From cad05fe21b60264a75a15ceb2a9900b45cc65064 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dawid=20Dydlin=CC=81ski?= <d.dydlinski@dydlak.cloud>
Date: Mon, 24 Aug 2026 22:42:41 +0200
Subject: [PATCH 01/28] feat(checklists): add setting to insert new items at
 the end of a checklist\n\nAdd a per-user 'newItemInsertion' setting
 (top|bottom, default top) that\ncontrols whether new checklist items are
 prepended (current behavior) or\nappended at the end. The createItem server
 action reads the setting and\nbranches between prepend (order 0, shifting
 existing items) and append\n(order = max+1, leaving existing items in
 place).\n\nCloses #434

---
 .../Profile/Parts/UserPreferencesTab.tsx      | 30 +++++++++++
 app/_schemas/user-schemas.ts                  |  3 ++
 app/_server/actions/checklist-item/crud.ts    | 13 +++--
 app/_translations/en.json                     |  5 ++
 app/_types/index.ts                           |  1 +
 app/_types/user.ts                            |  2 +
 tests/server-actions/checklist-item.test.ts   | 52 +++++++++++++++++++
 7 files changed, 103 insertions(+), 3 deletions(-)

diff --git a/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx b/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx
index 3ac1e18e4..15693784c 100644
--- a/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx
+++ b/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx
@@ -33,6 +33,7 @@ import {
   HideMobileStatusDropdown,
   HideTimeTrackingOnCards,
   CodeBlockStyle,
+  NewItemInsertion,
 } from "@/app/_types";
 import { Modes } from "@/app/_types/enums";
 import { DEFAULT_WEEK_START, WeekDay } from "@/app/_consts/calendar";
@@ -75,6 +76,7 @@ const getSettingsFromUser = (user: SanitisedUser | null): Partial<SanitisedUser>
   markdownTheme: user?.markdownTheme || "prism",
   defaultChecklistFilter: user?.defaultChecklistFilter || "all",
   checklistItemClickAction: user?.checklistItemClickAction || "toggle",
+  newItemInsertion: user?.newItemInsertion || "top",
   defaultNoteFilter: user?.defaultNoteFilter || "all",
   quickCreateNotes: user?.quickCreateNotes || "disable",
   quickCreateNotesCategory: user?.quickCreateNotesCategory || "",
@@ -176,6 +178,7 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
     "showChecklistEmojis",
     "defaultChecklistFilter",
     "checklistItemClickAction",
+    "newItemInsertion",
   ]);
   const hasKanbanChanges = hasChanges([
     "hideStatusOnCards",
@@ -345,6 +348,11 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
     { id: "edit", name: t('settings.checklistItemClickActionEdit') },
   ];
 
+  const newItemInsertionOptions = [
+    { id: "top", name: t('settings.newItemInsertionTop') },
+    { id: "bottom", name: t('settings.newItemInsertionBottom') },
+  ];
+
   const defaultChecklistFilterOptions = [
     { id: "all", name: t('checklists.allChecklists') },
     { id: "completed", name: t('checklists.completed') },
@@ -893,6 +901,7 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
                   "showChecklistEmojis",
                   "defaultChecklistFilter",
                   "checklistItemClickAction",
+                  "newItemInsertion",
                 ],
                 checklistSettingsSchema,
                 "Checklists"
@@ -1009,6 +1018,27 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
             {t('settings.checklistItemClickActionDescription')}
           </p>
         </div>
+
+        <div className="space-y-2">
+          <Label htmlFor="new-item-insertion">
+            {t('settings.newItemInsertion')}
+          </Label>
+          <Dropdown
+            value={currentSettings.newItemInsertion || "top"}
+            onChange={(value) =>
+              handleSettingChange(
+                "newItemInsertion",
+                value as NewItemInsertion
+              )
+            }
+            options={newItemInsertionOptions}
+            placeholder={t('settings.selectNewItemInsertion')}
+            className="w-full"
+          />
+          <p className="text-md lg:text-sm text-muted-foreground">
+            {t('settings.newItemInsertionDescription')}
+          </p>
+        </div>
       </FormWrapper>
 
       <FormWrapper
diff --git a/app/_schemas/user-schemas.ts b/app/_schemas/user-schemas.ts
index 18371e5a7..41ddf35bf 100644
--- a/app/_schemas/user-schemas.ts
+++ b/app/_schemas/user-schemas.ts
@@ -74,6 +74,9 @@ export const checklistSettingsSchema = z.object({
   checklistItemClickAction: z.enum(["toggle", "edit"], {
     message: "Checklist item click action must be either 'toggle' or 'edit'",
   }),
+  newItemInsertion: z.enum(["top", "bottom"], {
+    message: "New item insertion must be either 'top' or 'bottom'",
+  }),
 });
 
 export const kanbanSettingsSchema = z.object({
diff --git a/app/_server/actions/checklist-item/crud.ts b/app/_server/actions/checklist-item/crud.ts
index 218700ed2..5f9289df1 100644
--- a/app/_server/actions/checklist-item/crud.ts
+++ b/app/_server/actions/checklist-item/crud.ts
@@ -15,7 +15,7 @@ import {
   extractHashtagsFromContent,
   normalizeTag,
 } from "@/app/_utils/tag-utils";
-import { isAdmin, getUsername } from "@/app/_server/actions/users";
+import { isAdmin, getUsername, getUserByUsername } from "@/app/_server/actions/users";
 import { Checklist, Item, KanbanPriority, Result } from "@/app/_types";
 import {
   ItemTypes,
@@ -262,11 +262,16 @@ export const createItem = async (
       order: item.order + 1,
     }));
 
+    const userRecord = await getUserByUsername(currentUser);
+    const insertAtBottom = userRecord?.newItemInsertion === "bottom";
+
     const newItem = {
       id: `${stored.uuid}-${Date.now()}`,
       text,
       completed: false,
-      order: 0,
+      order: insertAtBottom
+        ? stored.items.reduce((max, item) => Math.max(max, item.order ?? 0), -1) + 1
+        : 0,
       description: description || undefined,
       createdBy: currentUser,
       createdAt: now,
@@ -296,7 +301,9 @@ export const createItem = async (
 
     const updatedList = {
       ...stored,
-      items: [newItem, ...shiftedItems],
+      items: insertAtBottom
+        ? [...stored.items, newItem]
+        : [newItem, ...shiftedItems],
       tags: mergedTags,
       updatedAt: new Date().toISOString(),
     };
diff --git a/app/_translations/en.json b/app/_translations/en.json
index 248e8f1fd..8bbe00b31 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -948,6 +948,11 @@
     "checklistItemClickActionDescription": "Choose what happens when you click a task's text. \"Mark as complete\" toggles the checkbox  (default); \"Edit task name\" opens the task for inline editing — you'll still need to click the checkbox itself to complete it.",
     "checklistItemClickActionToggle": "Mark as complete/incomplete",
     "checklistItemClickActionEdit": "Edit list item",
+    "newItemInsertion": "New item insertion",
+    "selectNewItemInsertion": "Select where new items are added",
+    "newItemInsertionDescription": "Choose whether new items are added to the top (default) or the bottom of a checklist.",
+    "newItemInsertionTop": "Top of the list",
+    "newItemInsertionBottom": "Bottom of the list",
     "selectShowChecklistEmojis": "Select emoji visibility",
     "showChecklistEmojisDescription": "Show an automatic emoji next to checklist items based on their text."
   },
diff --git a/app/_types/index.ts b/app/_types/index.ts
index bacd97b5d..1029f2b76 100644
--- a/app/_types/index.ts
+++ b/app/_types/index.ts
@@ -45,6 +45,7 @@ export type {
   HideTimeTrackingOnCards,
   CodeBlockStyle,
   ChecklistItemClickAction,
+  NewItemInsertion,
 } from "./user";
 
 export type {
diff --git a/app/_types/user.ts b/app/_types/user.ts
index 5e3bb45ce..9ae0711a5 100644
--- a/app/_types/user.ts
+++ b/app/_types/user.ts
@@ -44,6 +44,7 @@ export type HideMobileStatusDropdown = "enable" | "disable";
 export type HideTimeTrackingOnCards = "enable" | "disable";
 export type CodeBlockStyle = "default" | "themed";
 export type ChecklistItemClickAction = "toggle" | "edit";
+export type NewItemInsertion = "top" | "bottom";
 
 export interface User {
   username: string;
@@ -84,6 +85,7 @@ export interface User {
   hideMobileStatusDropdown?: HideMobileStatusDropdown;
   hideTimeTrackingOnCards?: HideTimeTrackingOnCards;
   codeBlockStyle?: CodeBlockStyle;
+  newItemInsertion?: NewItemInsertion;
   mfaEnabled?: boolean;
   mfaSecret?: string;
   mfaRecoveryCode?: string;
diff --git a/tests/server-actions/checklist-item.test.ts b/tests/server-actions/checklist-item.test.ts
index d56776a1a..a3fbed7d8 100644
--- a/tests/server-actions/checklist-item.test.ts
+++ b/tests/server-actions/checklist-item.test.ts
@@ -6,6 +6,7 @@ const mockEnsureDir = vi.fn();
 const mockServerWriteFile = vi.fn();
 const mockGetUsername = vi.fn();
 const mockGetCurrentUser = vi.fn();
+const mockGetUserByUsername = vi.fn();
 const mockIsAdmin = vi.fn();
 const mockCanReach = vi.fn();
 const mockUsersWithAccess = vi.fn();
@@ -25,6 +26,7 @@ vi.mock("@/app/_server/actions/file", () => ({
 vi.mock("@/app/_server/actions/users", () => ({
   getUsername: (...args: any[]) => mockGetUsername(...args),
   getCurrentUser: (...args: any[]) => mockGetCurrentUser(...args),
+  getUserByUsername: (...args: any[]) => mockGetUserByUsername(...args),
   isAdmin: (...args: any[]) => mockIsAdmin(...args),
 }));
 
@@ -119,6 +121,7 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
     mockServerWriteFile.mockResolvedValue(undefined);
     mockGetUsername.mockResolvedValue("testuser");
     mockGetCurrentUser.mockResolvedValue({ username: "testuser" });
+    mockGetUserByUsername.mockResolvedValue(null);
     mockIsAdmin.mockResolvedValue(false);
     mockCanReach.mockResolvedValue(true);
     mockUsersWithAccess.mockResolvedValue([]);
@@ -345,6 +348,55 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
 
       expect(result.success).toBe(true);
     });
+
+    it("should prepend new item (order 0) by default", async () => {
+      mockGetUserByUsername.mockResolvedValue(null);
+
+      const formData = createFormData({
+        uuid: "test-uuid-123",
+        text: "New top item",
+        category: "TestCategory",
+      });
+
+      const result = await createItem(mockChecklist, formData);
+
+      expect(result.success).toBe(true);
+      expect(result.data?.order).toBe(0);
+
+      const writtenList = mockListToMarkdown.mock.calls.at(-1)?.[0];
+      expect(writtenList.items[0].id).toBe(result.data?.id);
+      expect(writtenList.items[0].order).toBe(0);
+      // existing items shifted down by one
+      expect(writtenList.items[1].order).toBe(1);
+    });
+
+    it("should append new item at the end when newItemInsertion is 'bottom'", async () => {
+      mockGetUserByUsername.mockResolvedValue({
+        username: "testuser",
+        newItemInsertion: "bottom",
+      });
+
+      const formData = createFormData({
+        uuid: "test-uuid-123",
+        text: "New bottom item",
+        category: "TestCategory",
+      });
+
+      const result = await createItem(mockChecklist, formData);
+
+      expect(result.success).toBe(true);
+      // existing max order is 2 (item-3), so new order is 3
+      expect(result.data?.order).toBe(3);
+
+      const writtenList = mockListToMarkdown.mock.calls.at(-1)?.[0];
+      // new item is the last element
+      expect(writtenList.items.at(-1).id).toBe(result.data?.id);
+      expect(writtenList.items.at(-1).order).toBe(3);
+      // existing items keep their original order (not shifted)
+      expect(writtenList.items[0].order).toBe(0);
+      expect(writtenList.items[1].order).toBe(1);
+      expect(writtenList.items[2].order).toBe(2);
+    });
   });
 
   describe("deleteItem", () => {

From 69b7e81bc60a2310c32ce9ded9fee4055cb717f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dawid=20Dydlin=CC=81ski?= <d.dydlinski@dydlak.cloud>
Date: Mon, 24 Aug 2026 22:44:16 +0200
Subject: [PATCH 02/28] feat(i18n): translate new-item-insertion setting for
 all locales\n\nAdd newItemInsertion, selectNewItemInsertion,
 newItemInsertionDescription,\nnewItemInsertionTop and newItemInsertionBottom
 translations for de, es, fr,\nit, ko, nl, pl, pt, ru, tr, vi, zh, klingon and
 pirate locales.

---
 app/_translations/de.json      | 5 +++++
 app/_translations/es.json      | 5 +++++
 app/_translations/fr.json      | 5 +++++
 app/_translations/it.json      | 5 +++++
 app/_translations/klingon.json | 5 +++++
 app/_translations/ko.json      | 5 +++++
 app/_translations/nl.json      | 5 +++++
 app/_translations/pirate.json  | 5 +++++
 app/_translations/pl.json      | 5 +++++
 app/_translations/pt.json      | 5 +++++
 app/_translations/ru.json      | 5 +++++
 app/_translations/tr.json      | 5 +++++
 app/_translations/vi.json      | 7 ++++++-
 app/_translations/zh.json      | 5 +++++
 14 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/app/_translations/de.json b/app/_translations/de.json
index 946cc1f8a..a611be4cb 100644
--- a/app/_translations/de.json
+++ b/app/_translations/de.json
@@ -922,6 +922,11 @@
     "checklistItemClickActionDescription": "Wählen Sie aus, was passiert, wenn Sie auf den Text einer Aufgabe klicken. \n„Als abgeschlossen markieren“ schaltet das Kontrollkästchen ein (Standard); \n„Aufgabennamen bearbeiten“ öffnet die Aufgabe zur Inline-Bearbeitung – Sie müssen noch das Kontrollkästchen selbst anklicken, um sie abzuschließen.",
     "checklistItemClickActionToggle": "Als vollständig/unvollständig markieren",
     "checklistItemClickActionEdit": "Listenelement bearbeiten",
+    "newItemInsertion": "Position neuer Einträge",
+    "selectNewItemInsertion": "Wählen Sie, wo neue Einträge hinzugefügt werden",
+    "newItemInsertionDescription": "Legen Sie fest, ob neue Einträge oben (Standard) oder unten in der Checkliste hinzugefügt werden.",
+    "newItemInsertionTop": "Anfang der Liste",
+    "newItemInsertionBottom": "Ende der Liste",
     "useSystemDefault": "Systemstandard verwenden",
     "selectShowChecklistEmojis": "Emoji-Sichtbarkeit wählen",
     "showChecklistEmojisDescription": "Zeigt anhand des Textes automatisch ein Emoji neben Checklisteneinträgen."
diff --git a/app/_translations/es.json b/app/_translations/es.json
index 802a25382..f6c6a24e8 100644
--- a/app/_translations/es.json
+++ b/app/_translations/es.json
@@ -922,6 +922,11 @@
     "checklistItemClickActionDescription": "Elija qué sucede cuando hace clic en el texto de una tarea. \n\"Marcar como completo\" activa la casilla de verificación (predeterminada); \n\"Editar nombre de la tarea\" abre la tarea para su edición en línea; aún deberá hacer clic en la casilla de verificación para completarla.",
     "checklistItemClickActionToggle": "Marcar como completo/incompleto",
     "checklistItemClickActionEdit": "Editar elemento de la lista",
+    "newItemInsertion": "Inserción de nuevos elementos",
+    "selectNewItemInsertion": "Selecciona dónde se añaden los nuevos elementos",
+    "newItemInsertionDescription": "Elige si los nuevos elementos se añaden al principio (predeterminado) o al final de una lista de verificación.",
+    "newItemInsertionTop": "Principio de la lista",
+    "newItemInsertionBottom": "Final de la lista",
     "useSystemDefault": "Usar el sistema predeterminado",
     "selectShowChecklistEmojis": "Seleccionar visibilidad de emojis",
     "showChecklistEmojisDescription": "Muestra un emoji automático junto a los elementos de la lista según su texto."
diff --git a/app/_translations/fr.json b/app/_translations/fr.json
index 4366f27c2..56442a734 100644
--- a/app/_translations/fr.json
+++ b/app/_translations/fr.json
@@ -922,6 +922,11 @@
     "checklistItemClickActionDescription": "Choisissez ce qui se passe lorsque vous cliquez sur le texte d'une tâche. \n« Marquer comme terminé » coche la case (par défaut) ; \n« Modifier le nom de la tâche » ouvre la tâche pour une modification en ligne ; vous devrez toujours cliquer sur la case à cocher elle-même pour la terminer.",
     "checklistItemClickActionToggle": "Marquer comme complet/incomplet",
     "checklistItemClickActionEdit": "Modifier un élément de liste",
+    "newItemInsertion": "Insertion des nouveaux éléments",
+    "selectNewItemInsertion": "Sélectionnez l'emplacement d'ajout des nouveaux éléments",
+    "newItemInsertionDescription": "Choisissez si les nouveaux éléments sont ajoutés en haut (par défaut) ou en bas d'une liste de contrôle.",
+    "newItemInsertionTop": "Haut de la liste",
+    "newItemInsertionBottom": "Bas de la liste",
     "useSystemDefault": "Utiliser les valeurs par défaut du système",
     "selectShowChecklistEmojis": "Choisir la visibilité des émojis",
     "showChecklistEmojisDescription": "Affiche un émoji automatique à côté des éléments de liste selon leur texte."
diff --git a/app/_translations/it.json b/app/_translations/it.json
index f6cefd4bb..0d6808c24 100644
--- a/app/_translations/it.json
+++ b/app/_translations/it.json
@@ -922,6 +922,11 @@
     "checklistItemClickActionDescription": "Scegli cosa succede quando fai clic sul testo di un'attività. \n\"Segna come completato\" attiva/disattiva la casella di controllo (impostazione predefinita); \n\"Modifica nome attività\" apre l'attività per la modifica in linea: dovrai comunque fare clic sulla casella di controllo stessa per completarla.",
     "checklistItemClickActionToggle": "Contrassegna come completo/incompleto",
     "checklistItemClickActionEdit": "Modifica elemento elenco",
+    "newItemInsertion": "Inserimento nuovi elementi",
+    "selectNewItemInsertion": "Seleziona dove vengono aggiunti i nuovi elementi",
+    "newItemInsertionDescription": "Scegli se i nuovi elementi vengono aggiunti in cima (predefinito) o in fondo a una checklist.",
+    "newItemInsertionTop": "Inizio della lista",
+    "newItemInsertionBottom": "Fine della lista",
     "useSystemDefault": "Utilizza l'impostazione predefinita del sistema",
     "selectShowChecklistEmojis": "Seleziona visibilità emoji",
     "showChecklistEmojisDescription": "Mostra un'emoji automatica accanto agli elementi della checklist in base al testo."
diff --git a/app/_translations/klingon.json b/app/_translations/klingon.json
index cfc42aa9e..c91f37690 100644
--- a/app/_translations/klingon.json
+++ b/app/_translations/klingon.json
@@ -947,6 +947,11 @@
     "checklistItemClickActionDescription": "Choose what happens when you click a task's text. \"Mark as complete\" toggles the checkbox  (default); \"Edit task name\" opens the task for inline editing — you'll still need to click the checkbox itself to complete it.",
     "checklistItemClickActionToggle": "Mark as complete/incomplete",
     "checklistItemClickActionEdit": "Edit list item",
+    "newItemInsertion": "New item insertion",
+    "selectNewItemInsertion": "Select where new items are added",
+    "newItemInsertionDescription": "Choose whether new items are added to the top (default) or the bottom of a checklist.",
+    "newItemInsertionTop": "Top of the list",
+    "newItemInsertionBottom": "Bottom of the list",
     "useSystemDefault": "Use system default",
     "selectShowChecklistEmojis": "Emoji cha'ghach yIwIv",
     "showChecklistEmojisDescription": "mu'mey ghop tetlh Segh Emoji cha' pagh."
diff --git a/app/_translations/ko.json b/app/_translations/ko.json
index 36bddf0f5..0b99a9396 100644
--- a/app/_translations/ko.json
+++ b/app/_translations/ko.json
@@ -947,6 +947,11 @@
     "checklistItemClickActionDescription": "작업 텍스트를 클릭하면 어떻게 되는지 선택하세요. \n\"완료로 표시\"는 확인란을 전환합니다(기본값). \n\"작업 이름 편집\"은 인라인 편집을 위한 작업을 엽니다. 완료하려면 확인란 자체를 클릭해야 합니다.",
     "checklistItemClickActionToggle": "완료/미완료로 표시",
     "checklistItemClickActionEdit": "목록 항목 편집",
+    "newItemInsertion": "새 항목 삽입 위치",
+    "selectNewItemInsertion": "새 항목이 추가될 위치를 선택하세요",
+    "newItemInsertionDescription": "체크리스트에서 새 항목을 맨 위(기본값)에 추가할지 맨 아래에 추가할지 선택하세요.",
+    "newItemInsertionTop": "목록 맨 위",
+    "newItemInsertionBottom": "목록 맨 아래",
     "useSystemDefault": "시스템 기본값 사용",
     "selectShowChecklistEmojis": "이모지 표시 선택",
     "showChecklistEmojisDescription": "체크리스트 항목의 텍스트에 따라 이모지를 자동으로 표시합니다."
diff --git a/app/_translations/nl.json b/app/_translations/nl.json
index 25a951038..b5d677feb 100644
--- a/app/_translations/nl.json
+++ b/app/_translations/nl.json
@@ -922,6 +922,11 @@
     "checklistItemClickActionDescription": "Kies wat er gebeurt als u op de tekst van een taak klikt. \n\"Markeren als voltooid\" schakelt het selectievakje in (standaard); \nMet 'Taaknaam bewerken' wordt de taak geopend voor inline bewerken. U moet nog steeds op het selectievakje zelf klikken om deze te voltooien.",
     "checklistItemClickActionToggle": "Markeer als compleet/onvolledig",
     "checklistItemClickActionEdit": "Lijstitem bewerken",
+    "newItemInsertion": "Positie van nieuwe items",
+    "selectNewItemInsertion": "Selecteer waar nieuwe items worden toegevoegd",
+    "newItemInsertionDescription": "Kies of nieuwe items bovenaan (standaard) of onderaan een checklist worden toegevoegd.",
+    "newItemInsertionTop": "Bovenaan de lijst",
+    "newItemInsertionBottom": "Onderaan de lijst",
     "useSystemDefault": "Gebruik systeemstandaard",
     "selectShowChecklistEmojis": "Emoji-zichtbaarheid kiezen",
     "showChecklistEmojisDescription": "Toont automatisch een emoji naast checklistitems op basis van de tekst."
diff --git a/app/_translations/pirate.json b/app/_translations/pirate.json
index 78332498e..437032aac 100644
--- a/app/_translations/pirate.json
+++ b/app/_translations/pirate.json
@@ -947,6 +947,11 @@
     "checklistItemClickActionDescription": "Choose what happens when you click a task's text. \"Mark as complete\" toggles the checkbox  (default); \"Edit task name\" opens the task for inline editing — you'll still need to click the checkbox itself to complete it.",
     "checklistItemClickActionToggle": "Mark as complete/incomplete",
     "checklistItemClickActionEdit": "Edit list item",
+    "newItemInsertion": "Stow new cargo",
+    "selectNewItemInsertion": "Choose where new loot be stowed",
+    "newItemInsertionDescription": "Choose whether new cargo be stowed at the top (default) or the bottom o' the manifest.",
+    "newItemInsertionTop": "Top o' the manifest",
+    "newItemInsertionBottom": "Bottom o' the manifest",
     "useSystemDefault": "Use system default",
     "selectShowChecklistEmojis": "Choose yer rune showin'",
     "showChecklistEmojisDescription": "Marks each manifest entry with a rune drawn from its words."
diff --git a/app/_translations/pl.json b/app/_translations/pl.json
index 9dc28d2fe..b7feaf241 100644
--- a/app/_translations/pl.json
+++ b/app/_translations/pl.json
@@ -922,6 +922,11 @@
     "checklistItemClickActionDescription": "Wybierz, co się stanie, gdy klikniesz tekst zadania. \n„Oznacz jako ukończone” przełącza pole wyboru (domyślnie); \n„Edytuj nazwę zadania” otwiera zadanie do edycji bezpośredniej — nadal będziesz musiał kliknąć samo pole wyboru, aby je ukończyć.",
     "checklistItemClickActionToggle": "Oznacz jako ukończone/niekompletne",
     "checklistItemClickActionEdit": "Edytuj element listy",
+    "newItemInsertion": "Wstawianie nowych elementów",
+    "selectNewItemInsertion": "Wybierz, gdzie dodawane są nowe elementy",
+    "newItemInsertionDescription": "Wybierz, czy nowe elementy są dodawane na górze (domyślnie) czy na dole listy kontrolnej.",
+    "newItemInsertionTop": "Góra listy",
+    "newItemInsertionBottom": "Dół listy",
     "useSystemDefault": "Użyj ustawień domyślnych systemu",
     "selectShowChecklistEmojis": "Wybierz widoczność emotikonów",
     "showChecklistEmojisDescription": "Pokazuje automatyczne emoji obok pozycji listy na podstawie ich tekstu."
diff --git a/app/_translations/pt.json b/app/_translations/pt.json
index 1689ce83c..c06295561 100644
--- a/app/_translations/pt.json
+++ b/app/_translations/pt.json
@@ -948,6 +948,11 @@
     "checklistItemClickActionDescription": "Escolha o que acontece quando clica no texto de uma tarefa. \"Marcar como concluída\" alterna a caixa de verificação (predefinido); \"Editar nome da tarefa\" abre a tarefa para edição inline — ainda precisará de clicar na própria caixa de verificação para a concluir.",
     "checklistItemClickActionToggle": "Marcar como concluída/incompleta",
     "checklistItemClickActionEdit": "Editar item da lista",
+    "newItemInsertion": "Inserção de novos itens",
+    "selectNewItemInsertion": "Selecione onde os novos itens são adicionados",
+    "newItemInsertionDescription": "Escolha se os novos itens são adicionados no topo (padrão) ou no final de uma lista de verificação.",
+    "newItemInsertionTop": "Topo da lista",
+    "newItemInsertionBottom": "Final da lista",
     "selectShowChecklistEmojis": "Selecionar visibilidade dos emojis",
     "showChecklistEmojisDescription": "Mostra um emoji automático junto dos itens da lista com base no texto."
   },
diff --git a/app/_translations/ru.json b/app/_translations/ru.json
index c7233644c..cf0e1b0c2 100644
--- a/app/_translations/ru.json
+++ b/app/_translations/ru.json
@@ -947,6 +947,11 @@
     "checklistItemClickActionDescription": "Выберите, что произойдет, если щелкнуть текст задачи. \n«Отметить как завершенное» переключает флажок (по умолчанию); \n«Редактировать имя задачи» открывает задачу для оперативного редактирования — для ее завершения все равно нужно будет нажать на сам флажок.",
     "checklistItemClickActionToggle": "Отметить как завершенное/незавершенное",
     "checklistItemClickActionEdit": "Изменить элемент списка",
+    "newItemInsertion": "Добавление новых элементов",
+    "selectNewItemInsertion": "Выберите, куда добавляются новые элементы",
+    "newItemInsertionDescription": "Выберите, добавляются ли новые элементы в начало (по умолчанию) или в конец контрольного списка.",
+    "newItemInsertionTop": "В начало списка",
+    "newItemInsertionBottom": "В конец списка",
     "useSystemDefault": "Использовать системные настройки по умолчанию",
     "selectShowChecklistEmojis": "Выберите отображение эмодзи",
     "showChecklistEmojisDescription": "Показывает автоматическое эмодзи рядом с пунктами чеклиста по их тексту."
diff --git a/app/_translations/tr.json b/app/_translations/tr.json
index 2c3e80465..b841f96ae 100644
--- a/app/_translations/tr.json
+++ b/app/_translations/tr.json
@@ -947,6 +947,11 @@
     "checklistItemClickActionDescription": "Bir görevin metnini tıklattığınızda ne olacağını seçin. \n\"Tamamlandı olarak işaretle\" onay kutusunu değiştirir (varsayılan); \n\"Görev adını düzenle\", görevi satır içi düzenleme için açar; bunu tamamlamak için yine de onay kutusunu tıklamanız gerekir.",
     "checklistItemClickActionToggle": "Tamamlandı/tamamlanmadı olarak işaretle",
     "checklistItemClickActionEdit": "Liste öğesini düzenle",
+    "newItemInsertion": "Yeni öğe ekleme konumu",
+    "selectNewItemInsertion": "Yeni öğelerin nereye ekleneceğini seçin",
+    "newItemInsertionDescription": "Yeni öğelerin kontrol listesinin üstüne (varsayılan) mı yoksa altına mı ekleneceğini seçin.",
+    "newItemInsertionTop": "Listenin başı",
+    "newItemInsertionBottom": "Listenin sonu",
     "useSystemDefault": "Sistem varsayılanını kullan",
     "selectShowChecklistEmojis": "Emoji görünürlüğünü seçin",
     "showChecklistEmojisDescription": "Metnine göre liste öğelerinin yanında otomatik emoji gösterir."
diff --git a/app/_translations/vi.json b/app/_translations/vi.json
index 996621975..afb4ad888 100644
--- a/app/_translations/vi.json
+++ b/app/_translations/vi.json
@@ -946,7 +946,12 @@
     "selectChecklistItemClickAction": "Chọn hành động nhấp vào mục danh sách kiểm tra",
     "checklistItemClickActionDescription": "Chọn điều gì sẽ xảy ra khi bạn nhấp vào văn bản của nhiệm vụ. \"Đánh dấu là hoàn thành\" chuyển đổi hộp kiểm (mặc định); \"Chỉnh sửa tên tác vụ\" sẽ mở tác vụ để chỉnh sửa nội tuyến — bạn vẫn cần phải nhấp vào hộp kiểm để hoàn thành tác vụ đó.",
     "checklistItemClickActionToggle": "Đánh dấu là hoàn thành/chưa hoàn thành",
-    "checklistItemClickActionEdit": "Chỉnh sửa mục danh sách"
+    "checklistItemClickActionEdit": "Chỉnh sửa mục danh sách",
+    "newItemInsertion": "Vị trí thêm mục mới",
+    "selectNewItemInsertion": "Chọn nơi thêm mục mới",
+    "newItemInsertionDescription": "Chọn xem các mục mới được thêm vào đầu (mặc định) hay cuối danh sách kiểm tra.",
+    "newItemInsertionTop": "Đầu danh sách",
+    "newItemInsertionBottom": "Cuối danh sách"
   },
   "admin": {
     "title": "Quản trị viên",
diff --git a/app/_translations/zh.json b/app/_translations/zh.json
index 3eac83368..f7f795279 100644
--- a/app/_translations/zh.json
+++ b/app/_translations/zh.json
@@ -947,6 +947,11 @@
     "checklistItemClickActionDescription": "选择单击任务文本时会发生的情况。 \n“标记为完成”切换复选框（默认）； \n“编辑任务名称”打开任务进行内联编辑 - 您仍然需要单击复选框本身来完成它。",
     "checklistItemClickActionToggle": "标记为完整/不完整",
     "checklistItemClickActionEdit": "编辑列表项",
+    "newItemInsertion": "新项目插入位置",
+    "selectNewItemInsertion": "选择新项目的添加位置",
+    "newItemInsertionDescription": "选择新项目是添加到清单的顶部（默认）还是底部。",
+    "newItemInsertionTop": "列表顶部",
+    "newItemInsertionBottom": "列表底部",
     "useSystemDefault": "使用系统默认值",
     "selectShowChecklistEmojis": "选择 Emoji 显示方式",
     "showChecklistEmojisDescription": "根据清单项目的文字自动在旁边显示 Emoji。"

From a80b8a5468dcfac8e65ebcb067f0b7bd16d13126 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dawid=20Dydlin=CC=81ski?= <d.dydlinski@dydlak.cloud>
Date: Tue, 25 Aug 2026 12:04:17 +0200
Subject: [PATCH 03/28] add mcp server for remote jotty access via REST API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a self-contained mcp-server subpackage that exposes a jotty·page
instance to MCP clients (Claude Desktop, Cursor, etc.) over stdio or
Streamable HTTP, proxying 53 tools to the existing REST API with an API key.

- src/client.ts: JottyClient REST wrapper (x-api-key header, timeouts, typed errors)
- src/index.ts: env-driven dispatch between stdio and http transports
- src/http.ts: Streamable HTTP transport with one McpServer + JottyClient per
  client session, optional MCP_TOKEN bearer gate, server-side fallback key
- src/tools/*: checklists, notes, tasks, kanban boards, discovery (categories,
  summary, search), admin (exports, logs, rebuild-index), misc (health, user)
- scripts/*: protocol smoke test plus stdio/http/live integration tests
- README with Claude Desktop and Cursor config and the auth model
---
 mcp-server/.gitignore                   |    4 +
 mcp-server/README.md                    |  318 ++++++
 mcp-server/package-lock.json            | 1241 +++++++++++++++++++++++
 mcp-server/package.json                 |   44 +
 mcp-server/scripts/integration-http.mjs |   84 ++
 mcp-server/scripts/integration.mjs      |  162 +++
 mcp-server/scripts/live-lifecycle.mjs   |  243 +++++
 mcp-server/scripts/smoke.mjs            |  120 +++
 mcp-server/src/client.ts                |  126 +++
 mcp-server/src/http.ts                  |  217 ++++
 mcp-server/src/index.ts                 |  103 ++
 mcp-server/src/tools/admin.ts           |  144 +++
 mcp-server/src/tools/checklists.ts      |  277 +++++
 mcp-server/src/tools/discovery.ts       |   72 ++
 mcp-server/src/tools/index.ts           |   35 +
 mcp-server/src/tools/kanban.ts          |  337 ++++++
 mcp-server/src/tools/misc.ts            |   67 ++
 mcp-server/src/tools/notes.ts           |  116 +++
 mcp-server/src/tools/shared.ts          |   52 +
 mcp-server/src/tools/tasks.ts           |  308 ++++++
 mcp-server/src/tools/types.ts           |   10 +
 mcp-server/tsconfig.json                |   20 +
 22 files changed, 4100 insertions(+)
 create mode 100644 mcp-server/.gitignore
 create mode 100644 mcp-server/README.md
 create mode 100644 mcp-server/package-lock.json
 create mode 100644 mcp-server/package.json
 create mode 100644 mcp-server/scripts/integration-http.mjs
 create mode 100644 mcp-server/scripts/integration.mjs
 create mode 100644 mcp-server/scripts/live-lifecycle.mjs
 create mode 100644 mcp-server/scripts/smoke.mjs
 create mode 100644 mcp-server/src/client.ts
 create mode 100644 mcp-server/src/http.ts
 create mode 100644 mcp-server/src/index.ts
 create mode 100644 mcp-server/src/tools/admin.ts
 create mode 100644 mcp-server/src/tools/checklists.ts
 create mode 100644 mcp-server/src/tools/discovery.ts
 create mode 100644 mcp-server/src/tools/index.ts
 create mode 100644 mcp-server/src/tools/kanban.ts
 create mode 100644 mcp-server/src/tools/misc.ts
 create mode 100644 mcp-server/src/tools/notes.ts
 create mode 100644 mcp-server/src/tools/shared.ts
 create mode 100644 mcp-server/src/tools/tasks.ts
 create mode 100644 mcp-server/src/tools/types.ts
 create mode 100644 mcp-server/tsconfig.json

diff --git a/mcp-server/.gitignore b/mcp-server/.gitignore
new file mode 100644
index 000000000..6b3b97dfb
--- /dev/null
+++ b/mcp-server/.gitignore
@@ -0,0 +1,4 @@
+node_modules/
+dist/
+*.tsbuildinfo
+.DS_Store
\ No newline at end of file
diff --git a/mcp-server/README.md b/mcp-server/README.md
new file mode 100644
index 000000000..439a24d04
--- /dev/null
+++ b/mcp-server/README.md
@@ -0,0 +1,318 @@
+# jotty-mcp
+
+A [Model Context Protocol](https://modelcontextprotocol.io) server that exposes a
+**[jotty·page](https://jotty.page)** instance to AI clients (Claude Desktop,
+Cursor, etc.). It proxies every tool call to your Jotty instance's
+[REST API](../howto/API.md) using an API key, so an assistant can read and manage
+your checklists, notes, kanban boards, and more.
+
+It ships inside the Jotty repository as a self-contained subpackage with its **own**
+`node_modules` (so its `zod` version never clashes with the Next.js app).
+
+## Two ways to run it
+
+The same binary supports two transports, picked by `MCP_TRANSPORT`. Pick one:
+
+### 1. Local (stdio) — run on your personal machine  *(default, simplest)*
+
+The MCP server is a **local process** your AI client launches; it makes outbound
+HTTPS calls to your Jotty instance. The API key lives on your machine. Nothing new
+runs on the server.
+
+```
+your machine                            jotty server
+─────────────                           ────────────────
+Cursor / Claude Desktop
+     │ spawns child process (stdio)
+     ▼
+ jotty-mcp  ──── HTTPS, x-api-key ───►  Jotty REST API (unchanged)
+ JOTTY_URL + JOTTY_API_KEY from env
+```
+
+Client config (Cursor / Claude Desktop):
+
+```jsonc
+{ "mcpServers": { "jotty": {
+  "command": "node",
+  "args": ["/absolute/path/to/mcp-server/dist/index.js"],
+  "env": { "JOTTY_URL": "https://jotty.example.com", "JOTTY_API_KEY": "ck_…" }
+}}}
+```
+
+→ Best for personal use: key never leaves your machine, Jotty stays untouched.
+
+### 2. Hosted (HTTP) — run next to the Jotty app
+
+The MCP server runs **on the Jotty host** as a small listening service; your AI
+client just points at a URL. Each client sends its own Jotty `x-api-key`, so
+multiple users keep their accounts isolated. Protect the endpoint with
+`MCP_TOKEN` (Bearer) since it's network-exposed.
+
+```
+your machine                              jotty server
+─────────────                             ────────────────────────────
+Cursor                                    jotty app (:3000)  ← unchanged
+   │ HTTPS to URL                              ▲
+   │ headers: x-api-key + Authorization        │ localhost
+   ▼                                           │
+ jotty-mcp (MCP_TRANSPORT=http, :3001)  ───────┘
+ JOTTY_URL=http://localhost:3000
+```
+
+Client config (Cursor):
+
+```jsonc
+{ "mcpServers": { "jotty": {
+  "url": "https://jotty.example.com/mcp",
+  "headers": { "x-api-key": "ck_…", "Authorization": "Bearer your-mcp-token" }
+}}}
+```
+
+→ Best for shared/multi-user: one endpoint, no local process per client. (Claude
+Desktop's stdio-only builds should use option 1.)
+
+Detailed setup for both is below.
+
+## Not bundled with the Jotty Docker image
+
+`jotty-mcp` is a **separate program**, not part of the Jotty web app:
+
+- It is **not** included in the published Jotty Docker image
+  (`ghcr.io/fccview/jotty:latest`) and is **not** built by `next build` / the
+  `Dockerfile`.
+- It is **not** started by `docker compose` — the compose file only runs the
+  `jotty` service (and optional `api-docs`). There is no `jotty-mcp` service
+  defined, so hosting Jotty via Docker Compose runs Jotty only and **does not run
+  the MCP server**.
+- It has its **own** `package.json` / `node_modules`, deliberately decoupled from
+  the Next.js app so dependency versions (e.g. `zod`) never clash.
+
+So you must run it yourself, in one of the two ways above:
+
+- **Local (stdio):** build and run `jotty-mcp` on **your personal machine** — your
+  AI client (Cursor / Claude Desktop) launches it. Nothing to add to your Jotty
+  deployment.
+- **Hosted (HTTP):** run it as a **separate sidecar** next to Jotty (e.g. its own
+  container/process, with `JOTTY_URL=http://jotty:3000`). It is never baked into
+  the Jotty image and never auto-started by Jotty.
+
+In short: Jotty's deployment is unchanged by this subpackage; `jotty-mcp` is an
+optional companion you run separately.
+
+## What it exposes
+
+54 tools across the full Jotty API:
+
+| Area | Tools |
+| --- | --- |
+| **Checklists** | `list_checklists`, `create_checklist`, `update_checklist`, `delete_checklist`, `create_checklist_item`, `update_checklist_item`, `delete_checklist_item`, `check_item`, `uncheck_item`, `reorder_checklist_items` |
+| **Notes** | `list_notes`, `create_note`, `get_note`, `update_note`, `delete_note` |
+| **Tasks (kanban columns)** | `list_tasks`, `create_task`, `get_task`, `update_task`, `delete_task`, `get_task_statuses`, `create_task_status`, `update_task_status`, `delete_task_status`, `create_task_item`, `get_task_item`, `move_task_item`, `delete_task_item` |
+| **Kanban boards** | `list_boards`, `create_board`, `get_board`, `update_board`, `delete_board`, `set_board_statuses`, `create_board_item`, `update_board_item`, `delete_board_item`, `move_board_item`, `assign_board_item`, `set_board_item_reminder`, `clear_board_item_reminder`, `get_board_calendar` |
+| **Discovery** | `list_categories`, `get_summary`, `search` |
+| **Admin / exports / logs** | `request_export`, `get_export_progress`, `list_logs`, `export_logs`, `get_logs_stats`, `rebuild_link_index` |
+| **Misc** | `health`, `get_user`, `get_current_user`, `rebuild_link_index` |
+
+Tool arguments are validated with JSON Schema (via `zod`). Items are addressed by
+dot-notation index paths (e.g. `0.1`) for nested sub-items, and by UUID for
+lists/notes/boards — matching the [API docs](../howto/API.md).
+
+## Prerequisites
+
+- Node.js **20+** (uses the built-in `fetch`).
+- A running Jotty instance you can reach over HTTP(S).
+- A Jotty **API key** — generate one in Jotty → **Profile → Settings → API Key**
+  (it looks like `ck_…`).
+
+## Build
+
+```bash
+cd mcp-server
+npm install
+npm run build      # outputs to dist/
+```
+
+## Configure (local / stdio mode)
+
+In local stdio mode the server reads two required environment variables (and one
+optional). For HTTP mode env, see [HTTP / remote mode](#http--remote-mode-streamable-http) below.
+
+| Variable | Required | Description |
+| --- | --- | --- |
+| `JOTTY_URL` | yes | Base URL of your Jotty instance, e.g. `https://jotty.example.com` |
+| `JOTTY_API_KEY` | yes | Your `ck_…` API key |
+| `JOTTY_TIMEOUT_MS` | no | Per-request timeout in ms (default `30000`) |
+
+## Run
+
+```bash
+JOTTY_URL=https://jotty.example.com JOTTY_API_KEY=ck_your_key node dist/index.js
+```
+
+It speaks MCP over stdio, so you run it as a child process of your MCP client.
+
+## Use with Claude Desktop
+
+Add an entry to your `claude_desktop_config.json` (Claude → Settings → Developer →
+Edit Config):
+
+```jsonc
+{
+  "mcpServers": {
+    "jotty": {
+      "command": "node",
+      "args": ["/absolute/path/to/jotty/mcp-server/dist/index.js"],
+      "env": {
+        "JOTTY_URL": "https://jotty.example.com",
+        "JOTTY_API_KEY": "ck_your_key"
+      }
+    }
+  }
+}
+```
+
+Restart Claude Desktop and you'll see the Jotty tools available.
+
+## Use with Cursor
+
+Add to `~/.cursor/mcp.json` (or `.cursor/mcp.json` in your project):
+
+```jsonc
+{
+  "mcpServers": {
+    "jotty": {
+      "command": "node",
+      "args": ["/absolute/path/to/jotty/mcp-server/dist/index.js"],
+      "env": {
+        "JOTTY_URL": "https://jotty.example.com",
+        "JOTTY_API_KEY": "ck_your_key"
+      }
+    }
+  }
+}
+```
+
+## HTTP / remote mode (Streamable HTTP)
+
+The stdio mode above runs the server **on your own machine**. If you'd rather run
+the MCP server **on the Jotty host** (or anywhere reachable) and point your client
+at a URL, use the HTTP transport. Same binary, selected by `MCP_TRANSPORT=http`.
+
+### 1. Run the server on the Jotty host
+
+```bash
+# On the server that runs Jotty (e.g. Jotty on :3000)
+cd mcp-server && npm install && npm run build
+
+MCP_TRANSPORT=http \
+JOTTY_URL=http://localhost:3000 \
+MCP_PORT=3001 \
+MCP_HOST=0.0.0.0 \
+MCP_TOKEN=choose-a-long-random-secret \
+  node dist/index.js
+```
+
+Environment (HTTP mode):
+
+| Variable | Required | Description |
+| --- | --- | --- |
+| `MCP_TRANSPORT` | yes | set to `http` |
+| `JOTTY_URL` | yes | where Jotty's REST API is — usually `http://localhost:3000` when colocated |
+| `MCP_PORT` | no | bind port (default `3001`) |
+| `MCP_HOST` | no | bind host (default `0.0.0.0`; use `127.0.0.1` for local-only) |
+| `MCP_TOKEN` | recommended | shared secret; clients must send `Authorization: Bearer <token>`. Without it the endpoint is open — restrict the network (localhost / Tailscale / reverse proxy). |
+| `JOTTY_API_KEY` | optional | server-side fallback Jotty key used only when a client omits its own `x-api-key` |
+
+### 2. Connect your client to the URL
+
+The client **does not** set `JOTTY_URL`. It sets the MCP endpoint URL and sends the
+Jotty API key as the `x-api-key` header:
+
+**Cursor** (`~/.cursor/mcp.json`):
+
+```jsonc
+{
+  "mcpServers": {
+    "jotty": {
+      "url": "https://jotty.example.com/mcp",
+      "headers": {
+        "x-api-key": "ck_your_key",
+        "Authorization": "Bearer choose-a-long-random-secret"
+      }
+    }
+  }
+}
+```
+
+> If you set `MCP_TOKEN` on the server, include `Authorization: Bearer <token>` in
+> the client headers. If you didn't set a token, drop that header.
+
+**Claude Desktop** does not yet support the `url`/remote form in all builds; for
+Claude Desktop use the stdio config above. HTTP mode is intended for Cursor and
+any client that supports the Streamable HTTP transport.
+
+### Auth model summary
+
+Two independent layers, by design:
+- **MCP endpoint auth** (optional, server-side `MCP_TOKEN`): gates who can reach
+  the MCP server at all (`Authorization: Bearer`).
+- **Jotty account auth** (required, per-client `x-api-key`): which Jotty account
+  each session acts as. Each connecting client gets its own `JottyClient`, so
+  multiple users on one MCP server keep their own keys/data isolated.
+
+## Security notes
+
+- The Jotty API key grants **full access** to the Jotty account it belongs to.
+  Treat it like a password — put it in your MCP client's config, not in source
+  files. Rotate it from Jotty → Profile → Settings → API Key.
+- **stdio mode:** the server runs locally and only makes outbound HTTPS requests
+  to your Jotty URL. No inbound ports are opened.
+- **HTTP mode:** the server opens a listening port. Always set `MCP_TOKEN` and/or
+  bind to `127.0.0.1` / put it behind a reverse proxy / Tailscale so the endpoint
+  isn't publicly reachable. Each session still requires a valid Jotty `x-api-key`.
+- Errors from Jotty (bad UUID, missing title, `403`, etc.) are returned to the
+  model as MCP `isError` results rather than crashing the server.
+
+## Project layout
+
+```
+mcp-server/
+  src/
+    index.ts            # entrypoint: env config, dispatches stdio vs http
+    client.ts           # JottyClient: REST fetch wrapper with x-api-key
+    http.ts             # Streamable HTTP transport: per-session McpServer + JottyClient
+    tools/
+      index.ts          # registerAllTools() aggregator
+      shared.ts         # json/text/fail/run result helpers
+      types.ts          # ToolModule interface
+      checklists.ts     # /api/checklists tools
+      notes.ts          # /api/notes tools
+      tasks.ts           # /api/tasks tools
+      kanban.ts          # /api/kanban tools
+      discovery.ts       # categories, summary, search
+      admin.ts           # exports, logs, admin
+      misc.ts            # health, user, rebuild-index
+  scripts/
+    smoke.mjs            # stdio protocol smoke test (no Jotty needed)
+    integration.mjs      # stdio end-to-end test (needs a running Jotty)
+    integration-http.mjs # http end-to-end test (needs running Jotty + http server)
+```
+
+## Tests
+
+```bash
+# Protocol smoke test — no Jotty instance required
+JOTTY_URL=http://127.0.0.1:9 JOTTY_API_KEY=ck_dummy node scripts/smoke.mjs
+
+# stdio end-to-end — run Jotty locally first (e.g. `next dev`),
+# inject a test API key for an admin user, then:
+JOTTY_URL=http://127.0.0.1:3000 JOTTY_API_KEY=ck_test_… node scripts/integration.mjs
+
+# http end-to-end — also start the http server, then:
+#   MCP_TRANSPORT=http JOTTY_URL=http://127.0.0.1:3000 MCP_PORT=3001 node dist/index.js &
+MCP_URL=http://127.0.0.1:3001/mcp JOTTY_API_KEY=ck_test_… node scripts/integration-http.mjs
+```
+
+## License
+
+MIT, same as Jotty.
\ No newline at end of file
diff --git a/mcp-server/package-lock.json b/mcp-server/package-lock.json
new file mode 100644
index 000000000..23f799755
--- /dev/null
+++ b/mcp-server/package-lock.json
@@ -0,0 +1,1241 @@
+{
+  "name": "jotty-mcp",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "jotty-mcp",
+      "version": "1.0.0",
+      "license": "MIT",
+      "dependencies": {
+        "@modelcontextprotocol/sdk": "^1.30.0",
+        "zod": "^3.25.76"
+      },
+      "bin": {
+        "jotty-mcp": "dist/index.js"
+      },
+      "devDependencies": {
+        "@types/node": "^20.19.0",
+        "typescript": "^5.9.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@hono/node-server": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.1.tgz",
+      "integrity": "sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "peerDependencies": {
+        "hono": "^4"
+      }
+    },
+    "node_modules/@modelcontextprotocol/sdk": {
+      "version": "1.30.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz",
+      "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==",
+      "license": "MIT",
+      "dependencies": {
+        "@hono/node-server": "^1.19.9 || ^2.0.5",
+        "ajv": "^8.17.1",
+        "ajv-formats": "^3.0.1",
+        "content-type": "^1.0.5",
+        "cors": "^2.8.5",
+        "cross-spawn": "^7.0.5",
+        "eventsource": "^3.0.2",
+        "eventsource-parser": "^3.0.0",
+        "express": "^5.2.1",
+        "express-rate-limit": "^8.2.1",
+        "hono": "^4.11.4",
+        "jose": "^6.1.3",
+        "json-schema-typed": "^8.0.2",
+        "pkce-challenge": "^5.0.0",
+        "raw-body": "^3.0.0",
+        "zod": "^3.25 || ^4.0",
+        "zod-to-json-schema": "^3.25.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@cfworker/json-schema": "^4.1.1",
+        "zod": "^3.25 || ^4.0"
+      },
+      "peerDependenciesMeta": {
+        "@cfworker/json-schema": {
+          "optional": true
+        },
+        "zod": {
+          "optional": false
+        }
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "20.19.43",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz",
+      "integrity": "sha512-6oYBAi5ikg4Pl+kGsoYtawUMBT2zZMCvPNF7pVLnHZfd1zf38DRiWn/gT01RYCdUqkv7Fhr+C9ot4/tb+2sVvA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/accepts": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
+      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "^3.0.0",
+        "negotiator": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/body-parser": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
+      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "^3.1.2",
+        "content-type": "^2.0.0",
+        "debug": "^4.4.3",
+        "http-errors": "^2.0.1",
+        "iconv-lite": "^0.7.2",
+        "on-finished": "^2.4.1",
+        "qs": "^6.15.2",
+        "raw-body": "^3.0.2",
+        "type-is": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/body-parser/node_modules/content-type": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/content-disposition": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
+      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie-signature": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
+      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.6.0"
+      }
+    },
+    "node_modules/cors": {
+      "version": "2.8.6",
+      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
+      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
+      "license": "MIT",
+      "dependencies": {
+        "object-assign": "^4",
+        "vary": "^1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "license": "MIT"
+    },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "license": "MIT"
+    },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/eventsource": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz",
+      "integrity": "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==",
+      "license": "MIT",
+      "dependencies": {
+        "eventsource-parser": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/eventsource-parser": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.1.tgz",
+      "integrity": "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/express": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
+      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "^2.0.0",
+        "body-parser": "^2.2.1",
+        "content-disposition": "^1.0.0",
+        "content-type": "^1.0.5",
+        "cookie": "^0.7.1",
+        "cookie-signature": "^1.2.1",
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "finalhandler": "^2.1.0",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.0",
+        "merge-descriptors": "^2.0.0",
+        "mime-types": "^3.0.0",
+        "on-finished": "^2.4.1",
+        "once": "^1.4.0",
+        "parseurl": "^1.3.3",
+        "proxy-addr": "^2.0.7",
+        "qs": "^6.14.0",
+        "range-parser": "^1.2.1",
+        "router": "^2.2.0",
+        "send": "^1.1.0",
+        "serve-static": "^2.2.0",
+        "statuses": "^2.0.1",
+        "type-is": "^2.0.1",
+        "vary": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/express-rate-limit": {
+      "version": "8.6.2",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.6.2.tgz",
+      "integrity": "sha512-YH4ru+eOJxQABscKFfRCy9R7x9QFGdezclVMwwgFFndzS2Xnm0uo6B0ABZsLhcpeptGv2qvuJVWlQr9gQZoC3A==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "ip-address": "^10.2.0"
+      },
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": ">= 4.11"
+      }
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "license": "MIT"
+    },
+    "node_modules/fast-uri": {
+      "version": "3.1.6",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz",
+      "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/finalhandler": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
+      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "on-finished": "^2.4.1",
+        "parseurl": "^1.3.3",
+        "statuses": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
+      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/hono": {
+      "version": "4.13.4",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.4.tgz",
+      "integrity": "sha512-AGEwKIyRMHRv1t8Wjwa3LHxQ61X5CqrdFT+4BRNTpqS5aJNnpl5WLjADb7vFlJzI/8uK7T5QLVApCMQKNa3LgQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.9.0"
+      }
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ip-address": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
+      "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/is-promise": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
+      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
+      "license": "MIT"
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "license": "ISC"
+    },
+    "node_modules/jose": {
+      "version": "6.2.10",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.10.tgz",
+      "integrity": "sha512-iiW7J9qRFlGxvCOIBDBDxFePQSn7ZMAnrYGhrrOo6siO/MIqwfyilLR27pkfDgUk+raLuzADS8A3S/KLBisc0g==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "license": "MIT"
+    },
+    "node_modules/json-schema-typed": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz",
+      "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
+      "license": "BSD-2-Clause"
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/media-typer": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz",
+      "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/merge-descriptors": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
+      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.54.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
+      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
+      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "^1.54.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/negotiator": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz",
+      "integrity": "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==",
+      "license": "MIT",
+      "dependencies": {
+        "content-type": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/negotiator/node_modules/content-type": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "8.4.2",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
+      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/pkce-challenge": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz",
+      "integrity": "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.15.3",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
+      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
+      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
+      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.7.0",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/router": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
+      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "is-promise": "^4.0.0",
+        "parseurl": "^1.3.3",
+        "path-to-regexp": "^8.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/send": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
+      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.1",
+        "mime-types": "^3.0.2",
+        "ms": "^2.1.3",
+        "on-finished": "^2.4.1",
+        "range-parser": "^1.2.1",
+        "statuses": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/serve-static": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
+      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "parseurl": "^1.3.3",
+        "send": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "license": "ISC"
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
+    "node_modules/type-is": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
+      "license": "MIT",
+      "dependencies": {
+        "content-type": "^2.0.0",
+        "media-typer": "^1.1.0",
+        "mime-types": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/type-is/node_modules/content-type": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    },
+    "node_modules/zod": {
+      "version": "3.25.76",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
+      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    },
+    "node_modules/zod-to-json-schema": {
+      "version": "3.25.2",
+      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz",
+      "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==",
+      "license": "ISC",
+      "peerDependencies": {
+        "zod": "^3.25.28 || ^4"
+      }
+    }
+  }
+}
diff --git a/mcp-server/package.json b/mcp-server/package.json
new file mode 100644
index 000000000..8c5608814
--- /dev/null
+++ b/mcp-server/package.json
@@ -0,0 +1,44 @@
+{
+  "name": "jotty-mcp",
+  "version": "1.0.0",
+  "description": "MCP server that exposes a remote jotty·page instance (checklists, notes, kanban boards, and more) over stdio via its REST API.",
+  "type": "module",
+  "bin": {
+    "jotty-mcp": "dist/index.js"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "smoke": "node scripts/smoke.mjs",
+    "integration": "node scripts/integration.mjs",
+    "integration:http": "node scripts/integration-http.mjs",
+    "live": "node scripts/live-lifecycle.mjs"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "jotty",
+    "jotty.page",
+    "checklist",
+    "kanban",
+    "notes"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.0",
+    "typescript": "^5.9.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}
\ No newline at end of file
diff --git a/mcp-server/scripts/integration-http.mjs b/mcp-server/scripts/integration-http.mjs
new file mode 100644
index 000000000..b0a1a0533
--- /dev/null
+++ b/mcp-server/scripts/integration-http.mjs
@@ -0,0 +1,84 @@
+/*
+ * Real integration test for the HTTP (Streamable HTTP) transport. Uses the MCP
+ * SDK's own Client against the running jotty-mcp http server, which in turn
+ * proxies to a running Jotty instance. Validates the full
+ *   Cursor-like client -> MCP http server -> Jotty REST API
+ * path over the network.
+ *
+ * Env: MCP_URL (http endpoint), JOTTY_API_KEY (ck_… sent as x-api-key header).
+ */
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+
+const mcpUrl = process.env.MCP_URL || "http://127.0.0.1:3001/mcp";
+const apiKey = process.env.JOTTY_API_KEY;
+
+let ok = true;
+const check = (cond, msg) => {
+  if (!cond) {
+    ok = false;
+    console.error("  FAIL:", msg);
+  } else {
+    console.log("  ok:", msg);
+  }
+};
+
+const transport = new StreamableHTTPClientTransport(new URL(mcpUrl), {
+  requestInit: {
+    headers: { "x-api-key": apiKey },
+  },
+});
+const client = new Client({ name: "http-integration-test", version: "0.0.1" });
+
+try {
+  await client.connect(transport);
+  check(true, "client connected to MCP http server");
+
+  const tools = await client.listTools();
+  check(tools.tools.length >= 40, `listTools returned ${tools.tools.length} tools`);
+  check(
+    tools.tools.some((t) => t.name === "list_checklists"),
+    "tool list includes list_checklists",
+  );
+
+  // health (public)
+  const health = await client.callTool({ name: "health", arguments: {} });
+  const healthData = JSON.parse(health.content[0].text);
+  check(healthData.status === "healthy", `health => ${healthData.status} v${healthData.version}`);
+  check(health.isError !== true, "health is not an error");
+
+  // list_checklists (authenticated, proxied to Jotty)
+  const lists = await client.callTool({ name: "list_checklists", arguments: {} });
+  const listsData = JSON.parse(lists.content[0].text);
+  check(Array.isArray(listsData.checklists), `list_checklists => ${listsData.checklists?.length} lists`);
+
+  // get_summary
+  const summary = await client.callTool({ name: "get_summary", arguments: {} });
+  const summaryData = JSON.parse(summary.content[0].text);
+  check(typeof summaryData.summary.checklists.total === "number", "get_summary returns numbers");
+
+  // create + delete round-trip over HTTP
+  const created = await client.callTool({
+    name: "create_checklist",
+    arguments: { title: "HTTP MCP Test", category: "MCP-HTTP", type: "simple" },
+  });
+  const createdData = JSON.parse(created.content[0].text);
+  const newId = createdData.data?.id;
+  check(!!newId, `create_checklist => id ${newId}`);
+  if (newId) {
+    const del = await client.callTool({ name: "delete_checklist", arguments: { listId: newId } });
+    check(del.content[0].text.includes("true"), "delete_checklist ok");
+  }
+
+  // error path: bad uuid
+  const bad = await client.callTool({ name: "get_note", arguments: { noteId: "not-real-uuid-9999" } });
+  check(bad.isError === true, "get_note bad uuid => isError");
+
+  console.log(ok ? "\nHTTP INTEGRATION TEST PASSED" : "\nHTTP INTEGRATION TEST FAILED");
+  process.exit(ok ? 0 : 1);
+} catch (err) {
+  console.error("test crashed:", err);
+  process.exit(1);
+} finally {
+  await transport.close();
+}
\ No newline at end of file
diff --git a/mcp-server/scripts/integration.mjs b/mcp-server/scripts/integration.mjs
new file mode 100644
index 000000000..9408b3dcf
--- /dev/null
+++ b/mcp-server/scripts/integration.mjs
@@ -0,0 +1,162 @@
+/*
+ * Real integration test: starts the built jotty-mcp stdio server pointed at a
+ * live Jotty instance and drives authenticated MCP tool calls through it,
+ * verifying the full MCP -> REST proxy path returns real data.
+ *
+ * Env: JOTTY_URL, JOTTY_API_KEY (the test key injected into users.json).
+ */
+import { spawn } from "node:child_process";
+
+const child = spawn("node", ["dist/index.js"], {
+  cwd: process.cwd(),
+  env: process.env,
+  stdio: ["pipe", "pipe", "pipe"],
+});
+
+let buf = "";
+const responses = new Map();
+child.stdout.on("data", (chunk) => {
+  buf += chunk.toString();
+  let idx;
+  while ((idx = buf.indexOf("\n")) >= 0) {
+    const line = buf.slice(0, idx).trim();
+    buf = buf.slice(idx + 1);
+    if (line) {
+      try {
+        const obj = JSON.parse(line);
+        if (obj.id != null) responses.set(obj.id, obj);
+      } catch {
+        /* ignore */
+      }
+    }
+  }
+});
+const stderr = [];
+child.stderr.on("data", (c) => stderr.push(c.toString()));
+
+let nextId = 1;
+const pending = new Map();
+function send(method, params) {
+  const id = nextId++;
+  return new Promise((resolve) => {
+    pending.set(id, resolve);
+    child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
+  });
+}
+// Resolve pending as responses arrive.
+const checkInterval = setInterval(() => {
+  for (const [id, resolve] of pending) {
+    if (responses.has(id)) {
+      pending.delete(id);
+      resolve(responses.get(id));
+    }
+  }
+}, 50);
+
+function callTool(name, args) {
+  return send("tools/call", { name, arguments: args });
+}
+
+function parseText(res) {
+  const t = res?.result?.content?.[0]?.text;
+  return t ? JSON.parse(t) : null;
+}
+
+async function main() {
+  let ok = true;
+  const check = (cond, msg) => {
+    if (!cond) {
+      ok = false;
+      console.error("  FAIL:", msg);
+    } else {
+      console.log("  ok:", msg);
+    }
+  };
+
+  // initialize
+  const init = await send("initialize", {
+    protocolVersion: "2025-06-18",
+    capabilities: {},
+    clientInfo: { name: "integration-test", version: "0.0.1" },
+  });
+  child.stdin.write(
+    JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }) + "\n",
+  );
+  check(init?.result?.serverInfo?.name === "jotty", "initialize ok");
+
+  // health (public)
+  const health = await callTool("health", {});
+  const healthData = parseText(health);
+  check(healthData?.status === "healthy", "health returns healthy status");
+  check(!!healthData?.version, `health version=${healthData?.version}`);
+
+  // list_checklists (authenticated)
+  const lists = await callTool("list_checklists", {});
+  const listsData = parseText(lists);
+  check(Array.isArray(listsData?.checklists), `list_checklists returns array (len=${listsData?.checklists?.length})`);
+  const firstList = listsData?.checklists?.[0];
+  if (firstList) {
+    check(!!firstList.id, `first checklist has id: ${firstList.id}`);
+    check(typeof firstList.title === "string", `first checklist has title: ${firstList.title}`);
+  }
+
+  // get_summary (authenticated)
+  const summary = await callTool("get_summary", {});
+  const summaryData = parseText(summary);
+  check(!!summaryData?.summary, "get_summary returns summary object");
+  check(typeof summaryData.summary.notes?.total === "number", `summary notes.total=${summaryData.summary.notes?.total}`);
+  check(typeof summaryData.summary.checklists?.total === "number", `summary checklists.total=${summaryData.summary.checklists?.total}`);
+
+  // list_categories (authenticated)
+  const cats = await callTool("list_categories", {});
+  const catsData = parseText(cats);
+  check(!!catsData?.categories, "list_categories returns categories");
+  check(Array.isArray(catsData.categories?.notes), "categories.notes is array");
+  check(Array.isArray(catsData.categories?.checklists), "categories.checklists is array");
+
+  // list_notes (authenticated)
+  const notes = await callTool("list_notes", {});
+  const notesData = parseText(notes);
+  check(Array.isArray(notesData?.notes), `list_notes returns array (len=${notesData?.notes?.length})`);
+
+  // create + delete a checklist round-trip
+  const created = await callTool("create_checklist", {
+    title: "MCP Integration Test Checklist",
+    category: "MCP-Test",
+    type: "simple",
+  });
+  const createdData = parseText(created);
+  const newId = createdData?.data?.id;
+  check(!!newId, `create_checklist returned id: ${newId}`);
+  if (newId) {
+    const itemRes = await callTool("create_checklist_item", {
+      listId: newId,
+      text: "Item added via MCP",
+    });
+    check(itemRes?.result?.content?.[0]?.text.includes("true"), "create_checklist_item ok");
+    const del = await callTool("delete_checklist", { listId: newId });
+    check(del?.result?.content?.[0]?.text.includes("true"), "delete_checklist ok");
+  }
+
+  // search (authenticated)
+  const search = await callTool("search", { q: "the", type: "note" });
+  const searchData = parseText(search);
+  check(Array.isArray(searchData?.results), `search returns results array (len=${searchData?.results?.length})`);
+
+  // error path: bad UUID should be isError
+  const bad = await callTool("get_note", { noteId: "not-a-real-uuid-1234" });
+  check(bad?.result?.isError === true, "get_note with bad uuid returns isError");
+
+  clearInterval(checkInterval);
+  child.stdin.end();
+  child.kill();
+
+  console.log("stderr:", stderr.join("").trim() || "(empty)");
+  console.log(ok ? "\nINTEGRATION TEST PASSED" : "\nINTEGRATION TEST FAILED");
+  process.exit(ok ? 0 : 1);
+}
+
+main().catch((e) => {
+  console.error("test crashed:", e);
+  process.exit(1);
+});
\ No newline at end of file
diff --git a/mcp-server/scripts/live-lifecycle.mjs b/mcp-server/scripts/live-lifecycle.mjs
new file mode 100644
index 000000000..8ce3ecad9
--- /dev/null
+++ b/mcp-server/scripts/live-lifecycle.mjs
@@ -0,0 +1,243 @@
+/*
+ * Live MCP lifecycle test against a real Jotty instance.
+ *
+ * Drives the actual jotty-mcp tools (MCP Client -> stdio server -> Jotty REST API):
+ *   - health, summary, categories, search (reads)
+ *   - note: create -> update -> get -> delete
+ *   - checklist: create -> add item -> edit item -> check -> uncheck -> delete
+ *   - kanban board: create -> add item -> move status -> assign -> reminder -> delete
+ *
+ * Everything created here is deleted at the end so the test account is left clean.
+ *
+ * Env: JOTTY_URL, JOTTY_API_KEY
+ */
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const serverPath = join(here, "..", "dist", "index.js");
+
+const jottyUrl = process.env.JOTTY_URL;
+const apiKey = process.env.JOTTY_API_KEY;
+if (!jottyUrl || !apiKey) {
+  console.error("JOTTY_URL and JOTTY_API_KEY are required");
+  process.exit(2);
+}
+
+const created = { notes: [], checklists: [], boards: [] };
+let ok = true;
+const check = (cond, msg) => {
+  if (!cond) {
+    ok = false;
+    console.error("  FAIL:", msg);
+  } else {
+    console.log("  ok:", msg);
+  }
+};
+
+const transport = new StdioClientTransport({
+  command: "node",
+  args: [serverPath],
+  env: {
+    ...process.env,
+    JOTTY_URL: jottyUrl,
+    JOTTY_API_KEY: apiKey,
+  },
+});
+const client = new Client({ name: "live-lifecycle-test", version: "1.0.0" });
+
+const tool = async (name, args) => {
+  const res = await client.callTool({ name, arguments: args ?? {} });
+  const text = res.content?.[0]?.text;
+  let data = null;
+  try {
+    data = text ? JSON.parse(text) : null;
+  } catch {
+    /* non-json */
+  }
+  return { isError: res.isError === true, data, raw: text };
+};
+
+async function main() {
+  await client.connect(transport);
+  check(true, "connected to jotty-mcp over stdio");
+
+  console.log("\n== reads ==");
+  const health = await tool("health");
+  check(health.data?.status === "healthy", `health => ${health.data?.status} v${health.data?.version}`);
+
+  const summary = await tool("get_summary");
+  const before = {
+    notes: summary.data?.summary?.notes?.total,
+    lists: summary.data?.summary?.checklists?.total,
+  };
+  check(typeof before.notes === "number", `summary before => notes=${before.notes} checklists=${before.lists}`);
+
+  const cats = await tool("list_categories");
+  check(!!cats.data?.categories, "list_categories ok");
+
+  const me = await tool("get_current_user");
+  check(!!me.data?.user?.username, `get_current_user => "${me.data?.user?.username}"`);
+  check(me.data?.user?.apiKey === undefined, "get_current_user does not leak apiKey");
+
+  console.log("\n== note lifecycle ==");
+  const createdNote = await tool("create_note", {
+    title: "MCP Test Note",
+    content: "# Created via MCP\n\nThis note was created by the jotty-mcp lifecycle test.",
+    category: "MCP-Test",
+  });
+  const noteId = createdNote.data?.data?.id;
+  check(!!noteId, `create_note => id ${noteId}`);
+  created.notes.push(noteId);
+
+  const updatedNote = await tool("update_note", {
+    noteId,
+    title: "MCP Test Note (edited)",
+    content: "# Edited via MCP\n\nContent was updated. Adds a [searchable-token](link).",
+  });
+  check(updatedNote.data?.data?.title?.includes("edited"), `update_note => "${updatedNote.data?.data?.title}"`);
+
+  const gotNote = await tool("get_note", { noteId });
+  check(
+    gotNote.data?.data?.content?.includes("Edited via MCP"),
+    "get_note returns updated content",
+  );
+
+  const noteSearch = await tool("search", { q: "searchable-token", type: "note" });
+  check(
+    (noteSearch.data?.results ?? []).some((r) => r.uuid === noteId || r.id === noteId),
+    "search finds the note by content",
+  );
+
+  console.log("\n== checklist lifecycle ==");
+  const createdList = await tool("create_checklist", {
+    title: "MCP Test Checklist",
+    category: "MCP-Test",
+    type: "simple",
+  });
+  const listId = createdList.data?.data?.id;
+  check(!!listId, `create_checklist => id ${listId}`);
+  created.checklists.push(listId);
+
+  const item1 = await tool("create_checklist_item", {
+    listId,
+    text: "First item — created via MCP",
+  });
+  check(item1.data?.success === true, "create_checklist_item #1");
+
+  const item2 = await tool("create_checklist_item", {
+    listId,
+    text: "Second item",
+  });
+  check(item2.data?.success === true, "create_checklist_item #2");
+
+  const editItem = await tool("update_checklist_item", {
+    listId,
+    itemIndex: "0",
+    text: "First item — EDITED via MCP",
+    priority: "high",
+  });
+  check(editItem.data?.success === true, "update_checklist_item (text + priority)");
+
+  const checkIt = await tool("check_item", { listId, itemIndex: "1" });
+  check(checkIt.data?.success === true, "check_item #2");
+
+  const listsNow = await tool("list_checklists", { category: "MCP-Test" });
+  const ourList = (listsNow.data?.checklists ?? []).find((l) => l.id === listId);
+  check(!!ourList, "list_checklists (filtered) returns the new list");
+  check(ourList?.items?.length === 2, `list has 2 items (got ${ourList?.items?.length})`);
+  check(ourList?.items?.[1]?.completed === true, "item #2 is completed after check_item");
+
+  const uncheckIt = await tool("uncheck_item", { listId, itemIndex: "1" });
+  check(uncheckIt.data?.success === true, "uncheck_item #2");
+
+  console.log("\n== kanban board lifecycle ==");
+  const createdBoard = await tool("create_board", {
+    title: "MCP Test Board",
+    category: "MCP-Test",
+    statuses: [
+      { id: "todo", label: "To Do", order: 0 },
+      { id: "doing", label: "Doing", order: 1, color: "#3b82f6" },
+      { id: "done", label: "Done", order: 2 },
+    ],
+  });
+  const boardId = createdBoard.data?.data?.id;
+  check(!!boardId, `create_board => id ${boardId}`);
+  created.boards.push(boardId);
+
+  const boardItem = await tool("create_board_item", {
+    boardId,
+    text: "Task A",
+    status: "todo",
+    description: "Created via MCP",
+  });
+  const itemId = boardItem.data?.data?.id;
+  check(!!itemId, `create_board_item => id ${itemId}`);
+
+  const moved = await tool("move_board_item", { boardId, itemId, status: "doing" });
+  check(moved.data?.success === true, "move_board_item todo -> doing");
+
+  const assigned = await tool("assign_board_item", { boardId, itemId, assignee: "" });
+  check(assigned.data?.success === true, "assign_board_item (clear)");
+
+  const reminder = await tool("set_board_item_reminder", {
+    boardId,
+    itemId,
+    datetime: "2099-01-01T09:00:00.000Z",
+  });
+  check(reminder.data?.success === true, "set_board_item_reminder");
+
+  const gotBoard = await tool("get_board", { boardId });
+  const bItem = (gotBoard.data?.board?.items ?? []).find((i) => i.id === itemId);
+  check(bItem?.status === "doing", `get_board shows item moved to doing`);
+  check(!!bItem?.reminder?.datetime, "get_board shows reminder set");
+
+  const clearReminder = await tool("clear_board_item_reminder", { boardId, itemId });
+  check(clearReminder.data?.success === true, "clear_board_item_reminder");
+
+  console.log("\n== summary after ==");
+  const summary2 = await tool("get_summary");
+  const after = {
+    notes: summary2.data?.summary?.notes?.total,
+    lists: summary2.data?.summary?.checklists?.total,
+  };
+  check(after.notes === before.notes + 1, `notes total went ${before.notes} -> ${after.notes}`);
+  // The simple checklist AND the kanban board both count as checklists.
+  check(after.lists === before.lists + 2, `checklists total went ${before.lists} -> ${after.lists} (+1 list, +1 board)`);
+
+  console.log("\n== cleanup ==");
+  for (const id of created.boards) {
+    const r = await tool("delete_board", { boardId: id });
+    check(r.data?.success === true, `delete_board ${id}`);
+  }
+  for (const id of created.checklists) {
+    const r = await tool("delete_checklist", { listId: id });
+    check(r.data?.success === true, `delete_checklist ${id}`);
+  }
+  for (const id of created.notes) {
+    const r = await tool("delete_note", { noteId: id });
+    check(r.data?.success === true, `delete_note ${id}`);
+  }
+
+  const summary3 = await tool("get_summary");
+  const finalCounts = {
+    notes: summary3.data?.summary?.notes?.total,
+    lists: summary3.data?.summary?.checklists?.total,
+  };
+  check(finalCounts.notes === before.notes, `notes restored to ${before.notes}`);
+  check(finalCounts.lists === before.lists, `checklists restored to ${before.lists}`);
+
+  console.log(ok ? "\nLIVE LIFECYCLE TEST PASSED" : "\nLIVE LIFECYCLE TEST FAILED");
+  process.exit(ok ? 0 : 1);
+}
+
+main().catch(async (e) => {
+  console.error("test crashed:", e);
+  // best-effort cleanup even on crash
+  for (const id of created.boards) await tool("delete_board", { boardId: id }).catch(() => {});
+  for (const id of created.checklists) await tool("delete_checklist", { listId: id }).catch(() => {});
+  for (const id of created.notes) await tool("delete_note", { noteId: id }).catch(() => {});
+  process.exit(1);
+});
\ No newline at end of file
diff --git a/mcp-server/scripts/smoke.mjs b/mcp-server/scripts/smoke.mjs
new file mode 100644
index 000000000..5f7589cdf
--- /dev/null
+++ b/mcp-server/scripts/smoke.mjs
@@ -0,0 +1,120 @@
+/*
+ * Smoke test for the jotty-mcp stdio server. Spawns the built server with dummy
+ * credentials and drives the MCP JSON-RPC protocol over stdin, checking that
+ * initialize, tools/list and a tools/call (health, against an unreachable URL)
+ * behave correctly. No real Jotty instance is required.
+ */
+import { spawn } from "node:child_process";
+
+const env = {
+  ...process.env,
+  JOTTY_URL: "http://127.0.0.1:9", // port 9 = discard; guarantees a connection failure
+  JOTTY_API_KEY: "ck_dummy_key_for_smoke_test",
+};
+
+const child = spawn("node", ["dist/index.js"], {
+  cwd: process.cwd(),
+  env,
+  stdio: ["pipe", "pipe", "pipe"],
+});
+
+let buf = "";
+const responses = [];
+child.stdout.on("data", (chunk) => {
+  buf += chunk.toString();
+  let idx;
+  while ((idx = buf.indexOf("\n")) >= 0) {
+    const line = buf.slice(0, idx).trim();
+    buf = buf.slice(idx + 1);
+    if (line) {
+      try {
+        responses.push(JSON.parse(line));
+      } catch {
+        responses.push({ _raw: line });
+      }
+    }
+  }
+});
+
+const stderr = [];
+child.stderr.on("data", (c) => stderr.push(c.toString()));
+
+const send = (obj) => child.stdin.write(JSON.stringify(obj) + "\n");
+
+// 1. initialize
+send({
+  jsonrpc: "2.0",
+  id: 1,
+  method: "initialize",
+  params: {
+    protocolVersion: "2025-06-18",
+    capabilities: {},
+    clientInfo: { name: "smoke-test", version: "0.0.1" },
+  },
+});
+
+// 2. initialized notification (no response expected)
+send({ jsonrpc: "2.0", method: "notifications/initialized" });
+
+// 3. tools/list
+send({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} });
+
+setTimeout(() => {
+  // 4. tools/call health — should fail gracefully (network error) with isError
+  send({
+    jsonrpc: "2.0",
+    id: 3,
+    method: "tools/call",
+    params: { name: "health", arguments: {} },
+  });
+}, 200);
+
+setTimeout(() => {
+  child.stdin.end();
+}, 800);
+
+child.on("close", (code) => {
+  const init = responses.find((r) => r.id === 1);
+  const list = responses.find((r) => r.id === 2);
+  const call = responses.find((r) => r.id === 3);
+
+  let ok = true;
+  const check = (cond, msg) => {
+    if (!cond) {
+      ok = false;
+      console.error("  FAIL:", msg);
+    } else {
+      console.log("  ok:", msg);
+    }
+  };
+
+  console.log("initialize:");
+  check(!!init, "initialize returned a result");
+  check(init?.result?.serverInfo?.name === "jotty", "server name is jotty");
+  check(!!init?.result?.capabilities?.tools, "advertises tools capability");
+
+  console.log("tools/list:");
+  check(!!list, "tools/list returned a result");
+  const names = (list?.result?.tools ?? []).map((t) => t.name);
+  check(names.length >= 40, `tools/list returned ${names.length} tools (>=40)`);
+  check(names.includes("list_checklists"), "includes list_checklists");
+  check(names.includes("create_note"), "includes create_note");
+  check(names.includes("move_board_item"), "includes move_board_item");
+  check(
+    !!list?.result?.tools?.find((t) => t.name === "list_checklists")?.inputSchema,
+    "list_checklists has an inputSchema",
+  );
+
+  console.log("tools/call health (unreachable URL):");
+  check(!!call, "health call returned a result");
+  check(call?.result?.isError === true, "health call reports isError (network failed)");
+  check(
+    typeof call?.result?.content?.[0]?.text === "string",
+    "health call returns a text content block",
+  );
+
+  console.log("stderr:", stderr.join("").trim() || "(empty)");
+  console.log("exit code:", code);
+  console.log(ok ? "\nSMOKE TEST PASSED" : "\nSMOKE TEST FAILED");
+  process.exit(ok ? 0 : 1);
+});
\ No newline at end of file
diff --git a/mcp-server/src/client.ts b/mcp-server/src/client.ts
new file mode 100644
index 000000000..14e06c18e
--- /dev/null
+++ b/mcp-server/src/client.ts
@@ -0,0 +1,126 @@
+/**
+ * Minimal REST client for a remote jotty·page instance.
+ *
+ * Every authenticated Jotty endpoint is reached the same way: send a JSON
+ * request with the `x-api-key` header and parse the JSON response. This class
+ * centralises that so the tool modules only describe *what* to call.
+ */
+
+export interface JottyClientOptions {
+  /** Base URL of the remote Jotty instance, e.g. https://jotty.example.com */
+  baseUrl: string;
+  /** API key (starts with `ck_`) generated from Jotty -> Profile -> Settings. */
+  apiKey: string;
+  /** Optional request timeout in milliseconds (default 30000). */
+  timeoutMs?: number;
+}
+
+export class JottyApiError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+    readonly body: unknown,
+  ) {
+    super(message);
+    this.name = "JottyApiError";
+  }
+}
+
+type QueryValue = string | number | boolean | undefined | null;
+
+function buildQuery(params: Record<string, QueryValue>): string {
+  const parts: string[] = [];
+  for (const [key, value] of Object.entries(params)) {
+    if (value === undefined || value === null || value === "") continue;
+    parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
+  }
+  return parts.length ? `?${parts.join("&")}` : "";
+}
+
+export class JottyClient {
+  private readonly baseUrl: string;
+  private readonly apiKey: string;
+  private readonly timeoutMs: number;
+
+  constructor(options: JottyClientOptions) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.apiKey = options.apiKey;
+    this.timeoutMs = options.timeoutMs ?? 30000;
+  }
+
+  private async request<T = unknown>(
+    method: string,
+    path: string,
+    query: Record<string, QueryValue> = {},
+    body?: unknown,
+  ): Promise<T> {
+    const url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}${buildQuery(query)}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+
+    try {
+      const headers: Record<string, string> = {
+        "x-api-key": this.apiKey,
+        Accept: "application/json",
+      };
+      const init: RequestInit = { method, headers, signal: controller.signal };
+      if (body !== undefined && method !== "GET" && method !== "DELETE") {
+        headers["Content-Type"] = "application/json";
+        init.body = JSON.stringify(body);
+      }
+
+      const res = await fetch(url, init);
+      const text = await res.text();
+      const parsed = text ? safeParse(text) : undefined;
+
+      if (!res.ok) {
+        const message =
+          (parsed && typeof parsed === "object" && "error" in parsed
+            ? String((parsed as { error: unknown }).error)
+            : `HTTP ${res.status}`) || `HTTP ${res.status}`;
+        throw new JottyApiError(message, res.status, parsed);
+      }
+      return parsed as T;
+    } catch (err) {
+      if (err instanceof JottyApiError) throw err;
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new JottyApiError(
+          `Request timed out after ${this.timeoutMs}ms`,
+          408,
+          undefined,
+        );
+      }
+      throw new JottyApiError(
+        err instanceof Error ? err.message : "Network request failed",
+        0,
+        undefined,
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  get<T = unknown>(path: string, query: Record<string, QueryValue> = {}): Promise<T> {
+    return this.request<T>("GET", path, query);
+  }
+  post<T = unknown>(path: string, body?: unknown, query: Record<string, QueryValue> = {}): Promise<T> {
+    return this.request<T>("POST", path, query, body);
+  }
+  put<T = unknown>(path: string, body?: unknown, query: Record<string, QueryValue> = {}): Promise<T> {
+    return this.request<T>("PUT", path, query, body);
+  }
+  patch<T = unknown>(path: string, body?: unknown, query: Record<string, QueryValue> = {}): Promise<T> {
+    return this.request<T>("PATCH", path, query, body);
+  }
+  delete<T = unknown>(path: string, query: Record<string, QueryValue> = {}): Promise<T> {
+    return this.request<T>("DELETE", path, query);
+  }
+}
+
+function safeParse(text: string): unknown {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
\ No newline at end of file
diff --git a/mcp-server/src/http.ts b/mcp-server/src/http.ts
new file mode 100644
index 000000000..c3e1c45bc
--- /dev/null
+++ b/mcp-server/src/http.ts
@@ -0,0 +1,217 @@
+import { randomUUID } from "node:crypto";
+import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
+
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+
+import { JottyClient } from "./client.js";
+import { registerAllTools } from "./tools/index.js";
+
+export interface HttpServerOptions {
+  /** Base URL of the Jotty REST API the server will proxy to. */
+  jottyUrl: string;
+  /** Bind host (default 0.0.0.0). */
+  host?: string;
+  /** Bind port (default 3001). */
+  port?: number;
+  /** Optional request timeout forwarded to each per-session JottyClient. */
+  timeoutMs?: number;
+  /**
+   * Optional shared secret protecting the MCP endpoint. When set, clients must
+   * send `Authorization: Bearer <token>`. When unset the endpoint is open —
+   * rely on network restrictions (localhost / Tailscale / reverse proxy).
+   */
+  mcpToken?: string;
+  /**
+   * Optional fallback Jotty API key used when a client connects without an
+   * `x-api-key` header. Lets you run a single-tenant server where the key is
+   * configured server-side instead of per-client.
+   */
+  fallbackApiKey?: string;
+}
+
+/** Header the client sends to supply its Jotty API key (ck_…). */
+const JOTTY_API_KEY_HEADER = "x-api-key";
+
+/** Read the raw request body as a string. Empty bodies (GET/DELETE) resolve to "". */
+function readBody(req: IncomingMessage): Promise<string> {
+  return new Promise((resolve, reject) => {
+    let data = "";
+    req.on("data", (chunk) => {
+      data += chunk;
+    });
+    req.on("end", () => resolve(data));
+    req.on("error", reject);
+  });
+}
+
+function getHeader(req: IncomingMessage, name: string): string | undefined {
+  const value = req.headers[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+/**
+ * Build a fresh per-session transport bound to a fresh McpServer + JottyClient
+ * carrying this client's API key. Returns the transport once `server.connect`
+ * has wired everything together (sessionId is populated after the initialize
+ * request is handled by the caller).
+ */
+async function createSession(
+  req: IncomingMessage,
+  options: Required<Pick<HttpServerOptions, "jottyUrl" | "timeoutMs">> &
+    Pick<HttpServerOptions, "fallbackApiKey">,
+): Promise<StreamableHTTPServerTransport> {
+  const apiKey = getHeader(req, JOTTY_API_KEY_HEADER) || options.fallbackApiKey;
+  if (!apiKey) {
+    throw new Error(
+      `Missing Jotty API key. Send it as the "${JOTTY_API_KEY_HEADER}" header (value starts with ck_).`,
+    );
+  }
+
+  const client = new JottyClient({
+    baseUrl: options.jottyUrl,
+    apiKey,
+    timeoutMs: options.timeoutMs,
+  });
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: () => randomUUID(),
+  });
+  const server = new McpServer({ name: "jotty", version: "1.0.0" });
+  registerAllTools(server, client);
+
+  await server.connect(transport);
+  return transport;
+}
+
+/**
+ * Start the Streamable HTTP MCP server. Each connecting client is given its
+ * own `McpServer` + `JottyClient` so per-client API keys and timeouts stay
+ * isolated. Session state is kept in memory.
+ */
+export async function startHttpServer(options: HttpServerOptions): Promise<void> {
+  const {
+    jottyUrl,
+    host = "0.0.0.0",
+    port = 3001,
+    timeoutMs = 30000,
+    mcpToken,
+    fallbackApiKey,
+  } = options;
+
+  const transports = new Map<string, StreamableHTTPServerTransport>();
+
+  const authenticate = (req: IncomingMessage): boolean => {
+    if (!mcpToken) return true;
+    const auth = getHeader(req, "authorization") || "";
+    return auth === `Bearer ${mcpToken}`;
+  };
+
+  const httpServer = createServer(
+    async (req: IncomingMessage, res: ServerResponse) => {
+      const path = (req.url || "/").split("?")[0];
+      if (path !== "/mcp") {
+        res.writeHead(404, { "content-type": "text/plain" });
+        res.end("Not found. Use POST /mcp.");
+        return;
+      }
+
+      if (!authenticate(req)) {
+        res.writeHead(401, { "content-type": "text/plain" });
+        res.end("Unauthorized.");
+        return;
+      }
+
+      try {
+        if (req.method === "POST") {
+          const body = await readBody(req);
+          let parsed: unknown;
+          try {
+            parsed = body ? JSON.parse(body) : undefined;
+          } catch {
+            res.writeHead(400, { "content-type": "text/plain" });
+            res.end("Invalid JSON body.");
+            return;
+          }
+
+          const sessionId = getHeader(req, "mcp-session-id");
+          if (sessionId) {
+            // Existing session: hand the message to its transport.
+            const transport = transports.get(sessionId);
+            if (!transport) {
+              res.writeHead(404, { "content-type": "text/plain" });
+              res.end("Session not found.");
+              return;
+            }
+            await transport.handleRequest(req, res, parsed);
+            return;
+          }
+
+          // No session id -> must be an initialize request starting a new session.
+          if (!isInitializeRequest(parsed)) {
+            res.writeHead(400, { "content-type": "text/plain" });
+            res.end("Missing mcp-session-id; initialize first.");
+            return;
+          }
+
+          let transport: StreamableHTTPServerTransport;
+          try {
+            transport = await createSession(req, { jottyUrl, timeoutMs, fallbackApiKey });
+          } catch (err) {
+            res.writeHead(401, { "content-type": "text/plain" });
+            res.end(err instanceof Error ? err.message : String(err));
+            return;
+          }
+          await transport.handleRequest(req, res, parsed);
+          if (transport.sessionId) {
+            transports.set(transport.sessionId, transport);
+          }
+          return;
+        }
+
+        if (req.method === "GET" || req.method === "DELETE") {
+          const sessionId = getHeader(req, "mcp-session-id");
+          if (!sessionId) {
+            res.writeHead(400, { "content-type": "text/plain" });
+            res.end("Missing mcp-session-id.");
+            return;
+          }
+          const transport = transports.get(sessionId);
+          if (!transport) {
+            res.writeHead(404, { "content-type": "text/plain" });
+            res.end("Session not found.");
+            return;
+          }
+          await transport.handleRequest(req, res);
+          return;
+        }
+
+        res.writeHead(405, { allow: "GET, POST, DELETE", "content-type": "text/plain" });
+        res.end("Method not allowed.");
+      } catch (err) {
+        console.error("[jotty-mcp] error handling request:", err);
+        if (!res.headersSent) {
+          res.writeHead(500, { "content-type": "text/plain" });
+          res.end("Internal server error.");
+        }
+      }
+    },
+  );
+
+  return new Promise<void>((resolve, reject) => {
+    httpServer.on("error", reject);
+    httpServer.listen(port, host, () => {
+      console.error(`[jotty-mcp] Streamable HTTP server listening on http://${host}:${port}/mcp`);
+      console.error(`[jotty-mcp] proxying to Jotty at ${jottyUrl}`);
+      if (mcpToken) {
+        console.error("[jotty-mcp] endpoint protected by MCP_TOKEN (Bearer auth)");
+      } else {
+        console.error("[jotty-mcp] WARNING: no MCP_TOKEN set — endpoint is open; restrict network access");
+      }
+      if (fallbackApiKey) {
+        console.error("[jotty-mcp] using server-side fallback API key when client omits x-api-key");
+      }
+      resolve();
+    });
+  });
+}
\ No newline at end of file
diff --git a/mcp-server/src/index.ts b/mcp-server/src/index.ts
new file mode 100644
index 000000000..6022e5e22
--- /dev/null
+++ b/mcp-server/src/index.ts
@@ -0,0 +1,103 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+import { JottyClient } from "./client.js";
+import { registerAllTools } from "./tools/index.js";
+import { startHttpServer } from "./http.js";
+
+/**
+ * Configuration is read from the environment.
+ *
+ * Required (both transports):
+ *   JOTTY_URL       — base URL of the Jotty REST API the server proxies to
+ *                     (stdio: your remote instance; http: usually http://localhost:3000)
+ *   JOTTY_API_KEY   — Jotty API key (ck_…). Used directly in stdio mode; in http
+ *                     mode it is only a fallback for clients that omit x-api-key.
+ *
+ * Transport selection:
+ *   MCP_TRANSPORT   — "stdio" (default) | "http"
+ *
+ * HTTP mode only:
+ *   MCP_HOST        — bind host (default 0.0.0.0)
+ *   MCP_PORT        — bind port (default 3001)
+ *   MCP_TOKEN       — optional shared secret; clients must send Authorization: Bearer <token>
+ *
+ * Optional (both):
+ *   JOTTY_TIMEOUT_MS — per-request timeout in ms (default 30000)
+ */
+function envOrThrow(name: string, message: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) {
+    throw new Error(message);
+  }
+  return value;
+}
+
+function timeoutFromEnv(): number {
+  const n = Number.parseInt(process.env.JOTTY_TIMEOUT_MS ?? "", 10);
+  return Number.isFinite(n) && n > 0 ? n : 30000;
+}
+
+/** stdio: a single client (the launching AI app) with a single server/client pair. */
+async function runStdio(): Promise<void> {
+  const baseUrl = envOrThrow(
+    "JOTTY_URL",
+    "JOTTY_URL is required (the base URL of your Jotty instance, e.g. https://jotty.example.com).",
+  );
+  const apiKey = envOrThrow(
+    "JOTTY_API_KEY",
+    "JOTTY_API_KEY is required (generate one in Jotty -> Profile -> Settings -> API Key).",
+  );
+
+  const client = new JottyClient({ baseUrl, apiKey, timeoutMs: timeoutFromEnv() });
+  const server = new McpServer({ name: "jotty", version: "1.0.0" });
+  registerAllTools(server, client);
+
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+/** http: a long-lived Streamable HTTP server with one McpServer per client session. */
+async function runHttp(): Promise<void> {
+  const jottyUrl = envOrThrow(
+    "JOTTY_URL",
+    "JOTTY_URL is required in http mode (where Jotty's REST API is, e.g. http://localhost:3000).",
+  );
+  const port = (() => {
+    const n = Number.parseInt(process.env.MCP_PORT ?? "", 10);
+    return Number.isFinite(n) && n > 0 ? n : 3001;
+  })();
+  const host = process.env.MCP_HOST?.trim() || "0.0.0.0";
+
+  const fallbackApiKey = process.env.JOTTY_API_KEY?.trim() || undefined;
+  const mcpToken = process.env.MCP_TOKEN?.trim() || undefined;
+
+  await startHttpServer({
+    jottyUrl,
+    host,
+    port,
+    timeoutMs: timeoutFromEnv(),
+    mcpToken,
+    fallbackApiKey,
+  });
+}
+
+async function main(): Promise<void> {
+  const transport = (process.env.MCP_TRANSPORT?.trim() || "stdio").toLowerCase();
+
+  if (transport === "http") {
+    await runHttp();
+    // The HTTP server keeps the process alive listening for requests.
+  } else if (transport === "stdio") {
+    await runStdio();
+    // The stdio transport keeps the process alive reading JSON-RPC from stdin.
+  } else {
+    throw new Error(`Unknown MCP_TRANSPORT "${transport}" — use "stdio" or "http".`);
+  }
+}
+
+main().catch((err) => {
+  // Configuration/startup errors go to stderr; stdout is reserved for MCP protocol.
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});
\ No newline at end of file
diff --git a/mcp-server/src/tools/admin.ts b/mcp-server/src/tools/admin.ts
new file mode 100644
index 000000000..4d864a446
--- /dev/null
+++ b/mcp-server/src/tools/admin.ts
@@ -0,0 +1,144 @@
+import { z } from "zod";
+import type { ToolModule } from "./types.js";
+import { json, run } from "./shared.js";
+
+/**
+ * Admin-leaning endpoints: data exports and audit logs. Many of these require
+ * admin permissions on the remote instance; non-admin callers will receive a
+ * 403 from Jotty, surfaced as an MCP error result.
+ */
+export const adminModule: ToolModule = {
+  register(server, client) {
+    // POST /api/exports
+    server.registerTool(
+      "request_export",
+      {
+        title: "Request data export",
+        description:
+          "Initiate a data export. type is one of all_checklists_notes, user_checklists_notes (needs username), all_users_data, whole_data_folder. Returns a downloadUrl.",
+        inputSchema: {
+          type: z
+            .enum([
+              "all_checklists_notes",
+              "user_checklists_notes",
+              "all_users_data",
+              "whole_data_folder",
+            ])
+            .describe("Export type."),
+          username: z
+            .string()
+            .optional()
+            .describe("Required only for user_checklists_notes."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post("/api/exports", {
+              type: args.type,
+              username: args.username,
+            }),
+          ),
+        ),
+    );
+
+    // GET /api/exports
+    server.registerTool(
+      "get_export_progress",
+      {
+        title: "Get export progress",
+        description: "Get the current progress of an ongoing export operation.",
+      },
+      async () => run(() => json(client.get("/api/exports"))),
+    );
+
+    // GET /api/logs
+    server.registerTool(
+      "list_logs",
+      {
+        title: "List audit logs",
+        description:
+          "Retrieve audit logs with filtering and pagination. Regular users only see their own logs; admins can filter by username.",
+        inputSchema: {
+          username: z.string().optional().describe("Filter by username (admin only)."),
+          action: z.string().optional().describe("Filter by action type, e.g. login."),
+          category: z
+            .enum([
+              "auth",
+              "user",
+              "checklist",
+              "note",
+              "sharing",
+              "settings",
+              "encryption",
+              "api",
+              "system",
+              "file",
+              "upload",
+            ])
+            .optional(),
+          level: z
+            .enum(["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"])
+            .optional(),
+          startDate: z.string().optional().describe("ISO 8601 start date."),
+          endDate: z.string().optional().describe("ISO 8601 end date."),
+          success: z.boolean().optional(),
+          limit: z.number().int().positive().max(1000).optional().describe("Default 50."),
+          offset: z.number().int().min(0).optional().describe("Default 0."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.get("/api/logs", {
+              username: args.username,
+              action: args.action,
+              category: args.category,
+              level: args.level,
+              startDate: args.startDate,
+              endDate: args.endDate,
+              success: args.success,
+              limit: args.limit,
+              offset: args.offset,
+            }),
+          ),
+        ),
+    );
+
+    // POST /api/logs/export
+    server.registerTool(
+      "export_logs",
+      {
+        title: "Export audit logs",
+        description:
+          "Export audit logs in JSON or CSV format using the same filter options as list_logs.",
+        inputSchema: {
+          format: z.enum(["json", "csv"]).describe("Export format."),
+          filters: z
+            .record(z.unknown())
+            .optional()
+            .describe("Filter object with the same keys as list_logs."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post("/api/logs/export", {
+              format: args.format,
+              filters: args.filters ?? {},
+            }),
+          ),
+        ),
+    );
+
+    // GET /api/logs/stats
+    server.registerTool(
+      "get_logs_stats",
+      {
+        title: "Get audit log statistics",
+        description: "Aggregated audit log statistics (admin only).",
+      },
+      async () => run(() => json(client.get("/api/logs/stats"))),
+    );
+  },
+};
\ No newline at end of file
diff --git a/mcp-server/src/tools/checklists.ts b/mcp-server/src/tools/checklists.ts
new file mode 100644
index 000000000..2e0194e52
--- /dev/null
+++ b/mcp-server/src/tools/checklists.ts
@@ -0,0 +1,277 @@
+import { z } from "zod";
+import type { ToolModule } from "./types.js";
+import { json, run } from "./shared.js";
+
+/**
+ * Checklists — both "simple" and "task"/"kanban" type lists live under
+ * /api/checklists. Items are addressed by dot-notation index paths (e.g. "0.1")
+ * so nested sub-items can be targeted. See howto/API.md for the full reference.
+ */
+export const checklistsModule: ToolModule = {
+  register(server, client) {
+    // GET /api/checklists
+    server.registerTool(
+      "list_checklists",
+      {
+        title: "List checklists",
+        description:
+          "List all checklists for the authenticated user. Optional filters: category, type (simple|task|kanban), and a search query q (matches title or item text).",
+        inputSchema: {
+          category: z.string().optional().describe("Filter by category name."),
+          type: z
+            .enum(["simple", "task", "kanban"])
+            .optional()
+            .describe("Filter by checklist type."),
+          q: z.string().optional().describe("Search title or item text."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.get("/api/checklists", {
+              category: args.category,
+              type: args.type,
+              q: args.q,
+            }),
+          ),
+        ),
+    );
+
+    // POST /api/checklists
+    server.registerTool(
+      "create_checklist",
+      {
+        title: "Create checklist",
+        description:
+          "Create a new checklist. type defaults to 'simple'; use 'task' or 'kanban' for advanced lists. category defaults to 'Uncategorized'.",
+        inputSchema: {
+          title: z.string().describe("Title of the new checklist."),
+          category: z.string().optional().describe("Category (defaults to Uncategorized)."),
+          type: z
+            .enum(["simple", "task", "kanban"])
+            .optional()
+            .describe("Checklist type (defaults to simple)."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post("/api/checklists", {
+              title: args.title,
+              category: args.category ?? "Uncategorized",
+              type: args.type ?? "simple",
+            }),
+          ),
+        ),
+    );
+
+    // PUT /api/checklists/{listId}
+    server.registerTool(
+      "update_checklist",
+      {
+        title: "Update checklist",
+        description: "Update a checklist's title and/or category.",
+        inputSchema: {
+          listId: z.string().describe("UUID of the checklist to update."),
+          title: z.string().optional().describe("New title."),
+          category: z.string().optional().describe("New category."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/checklists/${args.listId}`, {
+              title: args.title,
+              category: args.category,
+            }),
+          ),
+        ),
+    );
+
+    // DELETE /api/checklists/{listId}
+    server.registerTool(
+      "delete_checklist",
+      {
+        title: "Delete checklist",
+        description: "Delete a checklist by UUID.",
+        inputSchema: {
+          listId: z.string().describe("UUID of the checklist to delete."),
+        },
+      },
+      async (args) =>
+        run(() => json(client.delete(`/api/checklists/${args.listId}`))),
+    );
+
+    // POST /api/checklists/{listId}/items
+    server.registerTool(
+      "create_checklist_item",
+      {
+        title: "Create checklist item",
+        description:
+          "Add an item to a checklist. For task/kanban lists you may pass a status (e.g. todo|in_progress|completed) and time. Use parentIndex (dot path like '0' or '0.1') to create a nested sub-item.",
+        inputSchema: {
+          listId: z.string().describe("UUID of the checklist."),
+          text: z.string().describe("Item text."),
+          status: z.string().optional().describe("Initial status (task/kanban lists)."),
+          time: z
+            .union([z.literal(0), z.array(z.record(z.unknown()))])
+            .optional()
+            .describe("Time tracking value: 0 or an array of time entries."),
+          parentIndex: z
+            .string()
+            .optional()
+            .describe("Dot-notation index path of the parent item to nest under."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post(`/api/checklists/${args.listId}/items`, {
+              text: args.text,
+              status: args.status,
+              time: args.time,
+              parentIndex: args.parentIndex,
+            }),
+          ),
+        ),
+    );
+
+    // PATCH /api/checklists/{listId}/items/{itemIndex}
+    server.registerTool(
+      "update_checklist_item",
+      {
+        title: "Update checklist item",
+        description:
+          "Update one or more fields of a checklist item. itemIndex is a dot path (e.g. '0.1') for nested items. Omitted fields are left unchanged.",
+        inputSchema: {
+          listId: z.string().describe("UUID of the checklist."),
+          itemIndex: z
+            .string()
+            .describe("Dot-notation index path of the item (e.g. '0' or '0.1')."),
+          text: z.string().optional(),
+          description: z.string().optional(),
+          priority: z
+            .enum(["critical", "high", "medium", "low", "none"])
+            .optional(),
+          score: z.number().optional(),
+          startDate: z.string().optional().describe("ISO date string."),
+          targetDate: z.string().optional().describe("ISO date string."),
+          estimatedTime: z.number().optional().describe("Estimated hours."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.patch(
+              `/api/checklists/${args.listId}/items/${args.itemIndex}`,
+              {
+                text: args.text,
+                description: args.description,
+                priority: args.priority,
+                score: args.score,
+                startDate: args.startDate,
+                targetDate: args.targetDate,
+                estimatedTime: args.estimatedTime,
+              },
+            ),
+          ),
+        ),
+    );
+
+    // DELETE /api/checklists/{listId}/items/{itemIndex}
+    server.registerTool(
+      "delete_checklist_item",
+      {
+        title: "Delete checklist item",
+        description:
+          "Delete a checklist item by dot-notation index path (e.g. '0.1').",
+        inputSchema: {
+          listId: z.string().describe("UUID of the checklist."),
+          itemIndex: z
+            .string()
+            .describe("Dot-notation index path of the item to delete."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(client.delete(`/api/checklists/${args.listId}/items/${args.itemIndex}`)),
+        ),
+    );
+
+    // PUT /api/checklists/{listId}/items/{itemIndex}/check
+    server.registerTool(
+      "check_item",
+      {
+        title: "Check item",
+        description: "Mark a checklist item as completed.",
+        inputSchema: {
+          listId: z.string().describe("UUID of the checklist."),
+          itemIndex: z
+            .string()
+            .describe("Dot-notation index path of the item."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/checklists/${args.listId}/items/${args.itemIndex}/check`),
+          ),
+        ),
+    );
+
+    // PUT /api/checklists/{listId}/items/{itemIndex}/uncheck
+    server.registerTool(
+      "uncheck_item",
+      {
+        title: "Uncheck item",
+        description: "Mark a checklist item as incomplete.",
+        inputSchema: {
+          listId: z.string().describe("UUID of the checklist."),
+          itemIndex: z
+            .string()
+            .describe("Dot-notation index path of the item."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/checklists/${args.listId}/items/${args.itemIndex}/uncheck`),
+          ),
+        ),
+    );
+
+    // PUT /api/checklists/{listId}/items/reorder
+    server.registerTool(
+      "reorder_checklist_items",
+      {
+        title: "Reorder checklist items",
+        description:
+          "Reorder items by dragging activeItemId relative to overItemId. position is 'before' or 'after'. Set isDropInto=true to drop activeItem as a child of overItem.",
+        inputSchema: {
+          listId: z.string().describe("UUID of the checklist."),
+          activeItemId: z.string().describe("Item id being moved."),
+          overItemId: z.string().describe("Item id it is moved relative to."),
+          position: z
+            .enum(["before", "after"])
+            .optional()
+            .describe("before|after (defaults to before)."),
+          isDropInto: z
+            .boolean()
+            .optional()
+            .describe("Drop as a child of overItemId instead of reordering siblings."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/checklists/${args.listId}/items/reorder`, {
+              activeItemId: args.activeItemId,
+              overItemId: args.overItemId,
+              position: args.position ?? "before",
+              isDropInto: args.isDropInto ?? false,
+            }),
+          ),
+        ),
+    );
+  },
+};
\ No newline at end of file
diff --git a/mcp-server/src/tools/discovery.ts b/mcp-server/src/tools/discovery.ts
new file mode 100644
index 000000000..bc3149720
--- /dev/null
+++ b/mcp-server/src/tools/discovery.ts
@@ -0,0 +1,72 @@
+import { z } from "zod";
+import type { ToolModule } from "./types.js";
+import { json, run } from "./shared.js";
+
+/**
+ * Organisation & discovery endpoints: categories, summary statistics, and
+ * cross-content full-text search.
+ */
+export const discoveryModule: ToolModule = {
+  register(server, client) {
+    // GET /api/categories
+    server.registerTool(
+      "list_categories",
+      {
+        title: "List categories",
+        description:
+          "List all categories for notes and checklists for the authenticated user (archived categories excluded).",
+      },
+      async () => run(() => json(client.get("/api/categories"))),
+    );
+
+    // GET /api/summary
+    server.registerTool(
+      "get_summary",
+      {
+        title: "Get summary statistics",
+        description:
+          "Get statistics about notes, checklists, items and tasks with category breakdowns. Admins may query another user with username.",
+        inputSchema: {
+          username: z
+            .string()
+            .optional()
+            .describe("Username to query (admin only; defaults to the authenticated user)."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.get("/api/summary", {
+              username: args.username,
+            }),
+          ),
+        ),
+    );
+
+    // GET /api/search
+    server.registerTool(
+      "search",
+      {
+        title: "Search notes and checklists",
+        description:
+          "Full-text search across notes and checklists. type filters to 'note' or 'checklist'. q must be at least 2 characters.",
+        inputSchema: {
+          q: z.string().min(2).describe("Search query (min 2 characters)."),
+          type: z
+            .enum(["note", "checklist"])
+            .optional()
+            .describe("Restrict results to notes or checklists."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.get("/api/search", {
+              q: args.q,
+              type: args.type,
+            }),
+          ),
+        ),
+    );
+  },
+};
\ No newline at end of file
diff --git a/mcp-server/src/tools/index.ts b/mcp-server/src/tools/index.ts
new file mode 100644
index 000000000..4d4177e23
--- /dev/null
+++ b/mcp-server/src/tools/index.ts
@@ -0,0 +1,35 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { JottyClient } from "../client.js";
+import { checklistsModule } from "./checklists.js";
+import { notesModule } from "./notes.js";
+import { tasksModule } from "./tasks.js";
+import { kanbanModule } from "./kanban.js";
+import { discoveryModule } from "./discovery.js";
+import { adminModule } from "./admin.js";
+import { miscModule } from "./misc.js";
+
+const modules = [
+  checklistsModule,
+  notesModule,
+  tasksModule,
+  kanbanModule,
+  discoveryModule,
+  adminModule,
+  miscModule,
+];
+
+/** Total number of tools registered (handy for startup logging). */
+export const toolCount = 54;
+
+/**
+ * Register every tool group against the given server/client pair.
+ *
+ * In stdio mode this is called once. In HTTP mode it is called once per
+ * client session, so each session gets its own `JottyClient` carrying that
+ * client's API key.
+ */
+export function registerAllTools(server: McpServer, client: JottyClient): void {
+  for (const mod of modules) {
+    mod.register(server, client);
+  }
+}
\ No newline at end of file
diff --git a/mcp-server/src/tools/kanban.ts b/mcp-server/src/tools/kanban.ts
new file mode 100644
index 000000000..077766063
--- /dev/null
+++ b/mcp-server/src/tools/kanban.ts
@@ -0,0 +1,337 @@
+import { z } from "zod";
+import type { ToolModule } from "./types.js";
+import { json, run } from "./shared.js";
+
+/**
+ * Kanban boards — the dedicated /api/kanban surface for kanban-type lists.
+ * Unlike /api/tasks (index-based), kanban items are addressed by their item id,
+ * and boards support assignees, reminders and an ICS calendar export.
+ */
+export const kanbanModule: ToolModule = {
+  register(server, client) {
+    // GET /api/kanban
+    server.registerTool(
+      "list_boards",
+      {
+        title: "List kanban boards",
+        description:
+          "List all kanban boards for the authenticated user. Optional filters: category, status (boards containing an item with this status), and search q.",
+        inputSchema: {
+          category: z.string().optional(),
+          status: z.string().optional(),
+          q: z.string().optional().describe("Search title or item text."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.get("/api/kanban", {
+              category: args.category,
+              status: args.status,
+              q: args.q,
+            }),
+          ),
+        ),
+    );
+
+    // POST /api/kanban
+    server.registerTool(
+      "create_board",
+      {
+        title: "Create kanban board",
+        description:
+          "Create a new kanban board. statuses defines the columns; defaults to todo/in_progress/completed.",
+        inputSchema: {
+          title: z.string().describe("Board title."),
+          category: z.string().optional().describe("Category (defaults to Uncategorized)."),
+          statuses: z
+            .array(
+              z.object({
+                id: z.string(),
+                label: z.string(),
+                order: z.number().optional(),
+                color: z.string().optional(),
+              }),
+            )
+            .optional()
+            .describe("Custom Kanban columns."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post("/api/kanban", {
+              title: args.title,
+              category: args.category ?? "Uncategorized",
+              statuses: args.statuses,
+            }),
+          ),
+        ),
+    );
+
+    // GET /api/kanban/{boardId}
+    server.registerTool(
+      "get_board",
+      {
+        title: "Get kanban board",
+        description: "Retrieve a single kanban board by UUID.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+        },
+      },
+      async (args) =>
+        run(() => json(client.get(`/api/kanban/${args.boardId}`))),
+    );
+
+    // PUT /api/kanban/{boardId}
+    server.registerTool(
+      "update_board",
+      {
+        title: "Update kanban board",
+        description: "Update a board's title and/or category.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+          title: z.string().optional(),
+          category: z.string().optional(),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/kanban/${args.boardId}`, {
+              title: args.title,
+              category: args.category,
+            }),
+          ),
+        ),
+    );
+
+    // DELETE /api/kanban/{boardId}
+    server.registerTool(
+      "delete_board",
+      {
+        title: "Delete kanban board",
+        description: "Delete a kanban board by UUID.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+        },
+      },
+      async (args) =>
+        run(() => json(client.delete(`/api/kanban/${args.boardId}`))),
+    );
+
+    // PUT /api/kanban/{boardId}/statuses
+    server.registerTool(
+      "set_board_statuses",
+      {
+        title: "Set board statuses",
+        description:
+          "Replace the full set of Kanban column statuses for a board. Provide the complete statuses array.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+          statuses: z
+            .array(
+              z.object({
+                id: z.string(),
+                label: z.string(),
+                order: z.number().optional(),
+                color: z.string().optional(),
+              }),
+            )
+            .describe("Full statuses array to set."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/kanban/${args.boardId}/statuses`, {
+              statuses: args.statuses,
+            }),
+          ),
+        ),
+    );
+
+    // POST /api/kanban/{boardId}/items
+    server.registerTool(
+      "create_board_item",
+      {
+        title: "Create board item",
+        description: "Add an item to a kanban board. Optional status and description.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+          text: z.string().describe("Item text."),
+          status: z.string().optional().describe("Initial status (defaults to todo)."),
+          description: z.string().optional().describe("Item description/notes."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post(`/api/kanban/${args.boardId}/items`, {
+              text: args.text,
+              status: args.status,
+              description: args.description,
+            }),
+          ),
+        ),
+    );
+
+    // PUT /api/kanban/{boardId}/items/{itemId}
+    server.registerTool(
+      "update_board_item",
+      {
+        title: "Update board item",
+        description:
+          "Update a kanban item's text, priority, score, assignee and/or reminder. Omitted fields are left unchanged.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+          itemId: z.string().describe("Item id to update."),
+          text: z.string().optional(),
+          priority: z
+            .enum(["critical", "high", "medium", "low", "none"])
+            .optional(),
+          score: z.number().optional(),
+          assignee: z.string().optional().describe("Username to assign the item to."),
+          reminder: z
+            .object({
+              datetime: z.string(),
+              notified: z.boolean().optional(),
+            })
+            .optional()
+            .describe("Reminder object; set to null to clear."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/kanban/${args.boardId}/items/${args.itemId}`, {
+              text: args.text,
+              priority: args.priority,
+              score: args.score,
+              assignee: args.assignee,
+              reminder: args.reminder,
+            }),
+          ),
+        ),
+    );
+
+    // DELETE /api/kanban/{boardId}/items/{itemId}
+    server.registerTool(
+      "delete_board_item",
+      {
+        title: "Delete board item",
+        description: "Delete a kanban item by id.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+          itemId: z.string().describe("Item id to delete."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(client.delete(`/api/kanban/${args.boardId}/items/${args.itemId}`)),
+        ),
+    );
+
+    // PUT /api/kanban/{boardId}/items/{itemId}/status
+    server.registerTool(
+      "move_board_item",
+      {
+        title: "Move board item",
+        description: "Move a kanban item to a different column (change its status).",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+          itemId: z.string().describe("Item id to move."),
+          status: z.string().describe("New status id."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/kanban/${args.boardId}/items/${args.itemId}/status`, {
+              status: args.status,
+            }),
+          ),
+        ),
+    );
+
+    // PUT /api/kanban/{boardId}/items/{itemId}/assign
+    server.registerTool(
+      "assign_board_item",
+      {
+        title: "Assign board item",
+        description: "Assign a kanban item to a user (pass empty string to unassign).",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+          itemId: z.string().describe("Item id to assign."),
+          assignee: z.string().describe("Username to assign to (empty to clear)."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/kanban/${args.boardId}/items/${args.itemId}/assign`, {
+              assignee: args.assignee,
+            }),
+          ),
+        ),
+    );
+
+    // PUT /api/kanban/{boardId}/items/{itemId}/reminder
+    server.registerTool(
+      "set_board_item_reminder",
+      {
+        title: "Set board item reminder",
+        description: "Set a due-date/time reminder on a kanban item.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+          itemId: z.string().describe("Item id."),
+          datetime: z.string().describe("ISO 8601 datetime for the reminder."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/kanban/${args.boardId}/items/${args.itemId}/reminder`, {
+              datetime: args.datetime,
+            }),
+          ),
+        ),
+    );
+
+    // DELETE /api/kanban/{boardId}/items/{itemId}/reminder
+    server.registerTool(
+      "clear_board_item_reminder",
+      {
+        title: "Clear board item reminder",
+        description: "Remove the reminder from a kanban item.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+          itemId: z.string().describe("Item id."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.delete(`/api/kanban/${args.boardId}/items/${args.itemId}/reminder`),
+          ),
+        ),
+    );
+
+    // GET /api/kanban/{boardId}/calendar
+    server.registerTool(
+      "get_board_calendar",
+      {
+        title: "Get board calendar",
+        description:
+          "Get calendar events for items on a kanban board that have start/target dates. Returns JSON events.",
+        inputSchema: {
+          boardId: z.string().describe("UUID of the board."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(client.get(`/api/kanban/${args.boardId}/calendar`)),
+        ),
+    );
+  },
+};
\ No newline at end of file
diff --git a/mcp-server/src/tools/misc.ts b/mcp-server/src/tools/misc.ts
new file mode 100644
index 000000000..2658b7218
--- /dev/null
+++ b/mcp-server/src/tools/misc.ts
@@ -0,0 +1,67 @@
+import { z } from "zod";
+import type { ToolModule } from "./types.js";
+import { json, run } from "./shared.js";
+
+/**
+ * Misc endpoints: public health check, the authenticated user's profile, and
+ * the admin link-index rebuild.
+ */
+export const miscModule: ToolModule = {
+  register(server, client) {
+    // GET /api/health (public)
+    server.registerTool(
+      "health",
+      {
+        title: "Health check",
+        description:
+          "Check the remote Jotty instance is reachable and report its version. Does not require an API key.",
+      },
+      async () => run(() => json(client.get("/api/health"))),
+    );
+
+    // GET /api/user/{username}
+    server.registerTool(
+      "get_user",
+      {
+        title: "Get user information",
+        description:
+          "Retrieve user information. Returns full data for the authenticated user (or admin viewing anyone), otherwise only public fields.",
+        inputSchema: {
+          username: z
+            .string()
+            .describe("Username to look up. Use your own username for your full profile."),
+        },
+      },
+      async (args) =>
+        run(() => json(client.get(`/api/user/${args.username}`))),
+    );
+
+    // GET /api/user (the API-key user — "whoami")
+    server.registerTool(
+      "get_current_user",
+      {
+        title: "Get current user",
+        description:
+          "Get the authenticated user's own profile and settings (theme, landing page, pinned lists/notes, editor preferences). Sensitive fields like passwordHash and apiKey are never returned.",
+      },
+      async () => run(() => json(client.get("/api/user"))),
+    );
+
+    // POST /api/admin/rebuild-index
+    server.registerTool(
+      "rebuild_link_index",
+      {
+        title: "Rebuild link index",
+        description:
+          "Rebuild the internal link index for a user (admin only). Useful after bulk operations or migrations.",
+        inputSchema: {
+          username: z.string().describe("Username whose link index should be rebuilt."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(client.post("/api/admin/rebuild-index", { username: args.username })),
+        ),
+    );
+  },
+};
\ No newline at end of file
diff --git a/mcp-server/src/tools/notes.ts b/mcp-server/src/tools/notes.ts
new file mode 100644
index 000000000..deb3a0387
--- /dev/null
+++ b/mcp-server/src/tools/notes.ts
@@ -0,0 +1,116 @@
+import { z } from "zod";
+import type { ToolModule } from "./types.js";
+import { json, run } from "./shared.js";
+
+/**
+ * Notes — markdown documents under /api/notes. content is GitHub-Flavoured
+ * Markdown. Each note has a UUID id and an optional category.
+ */
+export const notesModule: ToolModule = {
+  register(server, client) {
+    // GET /api/notes
+    server.registerTool(
+      "list_notes",
+      {
+        title: "List notes",
+        description:
+          "List all notes for the authenticated user. Optional filters: category and search query q (matches title or content).",
+        inputSchema: {
+          category: z.string().optional().describe("Filter by category name."),
+          q: z.string().optional().describe("Search title or content."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.get("/api/notes", {
+              category: args.category,
+              q: args.q,
+            }),
+          ),
+        ),
+    );
+
+    // POST /api/notes
+    server.registerTool(
+      "create_note",
+      {
+        title: "Create note",
+        description:
+          "Create a new markdown note. content defaults to empty; category defaults to 'Uncategorized'.",
+        inputSchema: {
+          title: z.string().describe("Note title."),
+          content: z
+            .string()
+            .optional()
+            .describe("Markdown content (defaults to empty)."),
+          category: z.string().optional().describe("Category (defaults to Uncategorized)."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post("/api/notes", {
+              title: args.title,
+              content: args.content ?? "",
+              category: args.category ?? "Uncategorized",
+            }),
+          ),
+        ),
+    );
+
+    // GET /api/notes/{noteId}
+    server.registerTool(
+      "get_note",
+      {
+        title: "Get note",
+        description: "Retrieve a single note by UUID, including its content.",
+        inputSchema: {
+          noteId: z.string().describe("UUID of the note."),
+        },
+      },
+      async (args) =>
+        run(() => json(client.get(`/api/notes/${args.noteId}`))),
+    );
+
+    // PUT /api/notes/{noteId}
+    server.registerTool(
+      "update_note",
+      {
+        title: "Update note",
+        description:
+          "Update a note's title, content and/or category. Omitted fields are left unchanged.",
+        inputSchema: {
+          noteId: z.string().describe("UUID of the note."),
+          title: z.string().optional(),
+          content: z.string().optional().describe("New markdown content."),
+          category: z.string().optional(),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/notes/${args.noteId}`, {
+              title: args.title,
+              content: args.content,
+              category: args.category,
+            }),
+          ),
+        ),
+    );
+
+    // DELETE /api/notes/{noteId}
+    server.registerTool(
+      "delete_note",
+      {
+        title: "Delete note",
+        description: "Delete a note by UUID.",
+        inputSchema: {
+          noteId: z.string().describe("UUID of the note to delete."),
+        },
+      },
+      async (args) =>
+        run(() => json(client.delete(`/api/notes/${args.noteId}`))),
+    );
+  },
+};
\ No newline at end of file
diff --git a/mcp-server/src/tools/shared.ts b/mcp-server/src/tools/shared.ts
new file mode 100644
index 000000000..58725289a
--- /dev/null
+++ b/mcp-server/src/tools/shared.ts
@@ -0,0 +1,52 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+
+/**
+ * Build a successful tool result containing pretty-printed JSON.
+ *
+ * Accepts either a raw value or a Promise (e.g. a `JottyClient` call) so the
+ * common pattern `run(() => json(client.get(...)))` awaits the network request
+ * before serialising. Most Jotty endpoints return JSON, so this is the common
+ * happy path.
+ */
+export async function json(data: Promise<unknown> | unknown): Promise<CallToolResult> {
+  const resolved = await data;
+  return {
+    content: [{ type: "text", text: JSON.stringify(resolved, null, 2) }],
+  };
+}
+
+/** Build a successful tool result with plain text. */
+export function text(value: string): CallToolResult {
+  return {
+    content: [{ type: "text", text: value }],
+  };
+}
+
+/**
+ * Build an error tool result. Jotty API errors (bad UUID, missing title, 403,
+ * etc.) are surfaced to the model as `isError: true` so the client can react,
+ * rather than crashing the server.
+ */
+export function fail(message: string): CallToolResult {
+  return {
+    isError: true,
+    content: [{ type: "text", text: message }],
+  };
+}
+
+/**
+ * Run an async handler and convert thrown `JottyApiError`s into structured
+ * MCP error results. Keeps every tool callback free of repetitive try/catch.
+ */
+export async function run(
+  fn: () => Promise<CallToolResult>,
+): Promise<CallToolResult> {
+  try {
+    return await fn();
+  } catch (err) {
+    if (err instanceof Error) {
+      return fail(err.message);
+    }
+    return fail(String(err));
+  }
+}
\ No newline at end of file
diff --git a/mcp-server/src/tools/tasks.ts b/mcp-server/src/tools/tasks.ts
new file mode 100644
index 000000000..bd2671c42
--- /dev/null
+++ b/mcp-server/src/tools/tasks.ts
@@ -0,0 +1,308 @@
+import { z } from "zod";
+import type { ToolModule } from "./types.js";
+import { json, run } from "./shared.js";
+
+/**
+ * A "status" object used to define Kanban columns. Reused across create_task
+ * and the status endpoints.
+ */
+const statusShape = {
+  id: z.string().describe("Unique status id, e.g. 'todo' or 'review'."),
+  label: z.string().describe("Display label for the column."),
+  order: z.number().optional().describe("Display order."),
+  color: z.string().optional().describe("Hex color, e.g. '#3b82f6'."),
+};
+
+/**
+ * Tasks — task-type checklists with Kanban columns, exposed via /api/tasks.
+ * Items are addressed by dot-notation index paths; statuses define the board
+ * columns.
+ */
+export const tasksModule: ToolModule = {
+  register(server, client) {
+    // GET /api/tasks
+    server.registerTool(
+      "list_tasks",
+      {
+        title: "List tasks",
+        description:
+          "List all task checklists for the authenticated user. Optional filters: category, status (lists containing an item with this status), and search q.",
+        inputSchema: {
+          category: z.string().optional(),
+          status: z
+            .string()
+            .optional()
+            .describe("Only return tasks that contain an item with this status."),
+          q: z.string().optional().describe("Search title or item text."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.get("/api/tasks", {
+              category: args.category,
+              status: args.status,
+              q: args.q,
+            }),
+          ),
+        ),
+    );
+
+    // POST /api/tasks
+    server.registerTool(
+      "create_task",
+      {
+        title: "Create task",
+        description:
+          "Create a new task checklist (Kanban). statuses defines the columns; defaults to todo/in_progress/completed.",
+        inputSchema: {
+          title: z.string().describe("Task list title."),
+          category: z.string().optional().describe("Category (defaults to Uncategorized)."),
+          statuses: z
+            .array(z.object(statusShape))
+            .optional()
+            .describe("Custom Kanban columns."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post("/api/tasks", {
+              title: args.title,
+              category: args.category ?? "Uncategorized",
+              statuses: args.statuses,
+            }),
+          ),
+        ),
+    );
+
+    // GET /api/tasks/{taskId}
+    server.registerTool(
+      "get_task",
+      {
+        title: "Get task",
+        description: "Retrieve a single task checklist by UUID.",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+        },
+      },
+      async (args) => run(() => json(client.get(`/api/tasks/${args.taskId}`))),
+    );
+
+    // PUT /api/tasks/{taskId}
+    server.registerTool(
+      "update_task",
+      {
+        title: "Update task",
+        description: "Update a task's title and/or category.",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+          title: z.string().optional(),
+          category: z.string().optional(),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/tasks/${args.taskId}`, {
+              title: args.title,
+              category: args.category,
+            }),
+          ),
+        ),
+    );
+
+    // DELETE /api/tasks/{taskId}
+    server.registerTool(
+      "delete_task",
+      {
+        title: "Delete task",
+        description: "Delete a task checklist by UUID.",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+        },
+      },
+      async (args) =>
+        run(() => json(client.delete(`/api/tasks/${args.taskId}`))),
+    );
+
+    // GET /api/tasks/{taskId}/statuses
+    server.registerTool(
+      "get_task_statuses",
+      {
+        title: "Get task statuses",
+        description: "Retrieve the Kanban column statuses for a task.",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+        },
+      },
+      async (args) =>
+        run(() => json(client.get(`/api/tasks/${args.taskId}/statuses`))),
+    );
+
+    // POST /api/tasks/{taskId}/statuses
+    server.registerTool(
+      "create_task_status",
+      {
+        title: "Create task status",
+        description: "Add a new Kanban column status to a task.",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+          id: z.string().describe("Unique status id."),
+          label: z.string().describe("Display label."),
+          color: z.string().optional().describe("Hex color."),
+          order: z.number().optional().describe("Display order (defaults to last)."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post(`/api/tasks/${args.taskId}/statuses`, {
+              id: args.id,
+              label: args.label,
+              color: args.color,
+              order: args.order,
+            }),
+          ),
+        ),
+    );
+
+    // PUT /api/tasks/{taskId}/statuses/{statusId}
+    server.registerTool(
+      "update_task_status",
+      {
+        title: "Update task status",
+        description: "Update a Kanban column status (label, color, order).",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+          statusId: z.string().describe("Status id to update."),
+          label: z.string().optional(),
+          color: z.string().optional(),
+          order: z.number().optional(),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(
+              `/api/tasks/${args.taskId}/statuses/${args.statusId}`,
+              {
+                label: args.label,
+                color: args.color,
+                order: args.order,
+              },
+            ),
+          ),
+        ),
+    );
+
+    // DELETE /api/tasks/{taskId}/statuses/{statusId}
+    server.registerTool(
+      "delete_task_status",
+      {
+        title: "Delete task status",
+        description:
+          "Delete a Kanban column. Items with this status move to the first available status.",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+          statusId: z.string().describe("Status id to delete."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(client.delete(`/api/tasks/${args.taskId}/statuses/${args.statusId}`)),
+        ),
+    );
+
+    // POST /api/tasks/{taskId}/items
+    server.registerTool(
+      "create_task_item",
+      {
+        title: "Create task item",
+        description:
+          "Add an item to a task. Use parentIndex (dot path) to nest under an existing item. status defaults to 'todo'.",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+          text: z.string().describe("Item text."),
+          status: z.string().optional().describe("Initial status (defaults to todo)."),
+          parentIndex: z
+            .string()
+            .optional()
+            .describe("Dot-notation index path of the parent item."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.post(`/api/tasks/${args.taskId}/items`, {
+              text: args.text,
+              status: args.status,
+              parentIndex: args.parentIndex,
+            }),
+          ),
+        ),
+    );
+
+    // GET /api/tasks/{taskId}/items/{itemIndex}
+    server.registerTool(
+      "get_task_item",
+      {
+        title: "Get task item",
+        description: "Retrieve a single task item by dot-notation index path.",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+          itemIndex: z
+            .string()
+            .describe("Dot-notation index path (e.g. '0' or '0.1')."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(client.get(`/api/tasks/${args.taskId}/items/${args.itemIndex}`)),
+        ),
+    );
+
+    // PUT /api/tasks/{taskId}/items/{itemIndex}/status
+    server.registerTool(
+      "move_task_item",
+      {
+        title: "Move task item",
+        description: "Move a task item to a different Kanban column (change its status).",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+          itemIndex: z
+            .string()
+            .describe("Dot-notation index path of the item."),
+          status: z.string().describe("New status id."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(
+            client.put(`/api/tasks/${args.taskId}/items/${args.itemIndex}/status`, {
+              status: args.status,
+            }),
+          ),
+        ),
+    );
+
+    // DELETE /api/tasks/{taskId}/items/{itemIndex}
+    server.registerTool(
+      "delete_task_item",
+      {
+        title: "Delete task item",
+        description: "Delete a task item by dot-notation index path.",
+        inputSchema: {
+          taskId: z.string().describe("UUID of the task."),
+          itemIndex: z
+            .string()
+            .describe("Dot-notation index path of the item to delete."),
+        },
+      },
+      async (args) =>
+        run(() =>
+          json(client.delete(`/api/tasks/${args.taskId}/items/${args.itemIndex}`)),
+        ),
+    );
+  },
+};
\ No newline at end of file
diff --git a/mcp-server/src/tools/types.ts b/mcp-server/src/tools/types.ts
new file mode 100644
index 000000000..81cc39a51
--- /dev/null
+++ b/mcp-server/src/tools/types.ts
@@ -0,0 +1,10 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { JottyClient } from "../client.js";
+
+/**
+ * Every tool group exports one of these. `register` is called once at startup
+ * with the shared server + REST client, and wires up that group's tools.
+ */
+export interface ToolModule {
+  register(server: McpServer, client: JottyClient): void;
+}
\ No newline at end of file
diff --git a/mcp-server/tsconfig.json b/mcp-server/tsconfig.json
new file mode 100644
index 000000000..5d9896cdc
--- /dev/null
+++ b/mcp-server/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": ["ES2022"],
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": false,
+    "sourceMap": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false
+  },
+  "include": ["src/**/*"]
+}
\ No newline at end of file

From 3ebdb099a889ee6aca6664070802d8f460bbd6ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dawid=20Dydlin=CC=81ski?= <d.dydlinski@dydlak.cloud>
Date: Tue, 25 Aug 2026 12:33:19 +0200
Subject: [PATCH 04/28] fix kanban assign/reminder API endpoints for API-key
 auth
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The assign and reminder API routes resolved the user via withApiAuth but then
called assignKanbanItem/setKanbanItemReminder, which re-derive the user from the
session cookie through getCurrentUser(). With no cookie present, every API-key
caller got "Not authenticated" — so PUT .../assign, PUT .../reminder and
DELETE .../reminder failed over the REST API.

Pass the authenticated username through from the routes (mirroring how the
status/move route already passes user.username into updateItemStatus), with a
getCurrentUser() fallback so the web UI path is unchanged.
---
 app/_server/actions/kanban/items.ts            | 18 ++++++++++++++----
 .../[boardId]/items/[itemId]/assign/route.ts   |  2 +-
 .../[boardId]/items/[itemId]/reminder/route.ts |  4 ++--
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/app/_server/actions/kanban/items.ts b/app/_server/actions/kanban/items.ts
index 701d1b551..313b2ce87 100644
--- a/app/_server/actions/kanban/items.ts
+++ b/app/_server/actions/kanban/items.ts
@@ -127,14 +127,19 @@ export const updateKanbanItemScore = async (formData: FormData) => {
   }
 };
 
-export const assignKanbanItem = async (formData: FormData) => {
+export const assignKanbanItem = async (
+  formData: FormData,
+  apiUsername?: string,
+) => {
   try {
     const { uuid, itemId, assignee } = getFormData(formData, [
       "uuid", "itemId", "assignee",
     ]);
 
+    // API-key callers pass their username explicitly; web-UI callers rely on
+    // the session cookie via getCurrentUser().
     const [currentUser, list] = await Promise.all([
-      getCurrentUser(),
+      apiUsername ? Promise.resolve({ username: apiUsername }) : getCurrentUser(),
       getListById(uuid),
     ]);
     if (!currentUser) return { error: "Not authenticated" };
@@ -180,14 +185,19 @@ export const assignKanbanItem = async (formData: FormData) => {
   }
 };
 
-export const setKanbanItemReminder = async (formData: FormData) => {
+export const setKanbanItemReminder = async (
+  formData: FormData,
+  apiUsername?: string,
+) => {
   try {
     const { uuid, itemId, reminder: reminderStr } = getFormData(formData, [
       "uuid", "itemId", "reminder",
     ]);
 
+    // API-key callers pass their username explicitly; web-UI callers rely on
+    // the session cookie via getCurrentUser().
     const [currentUser, list] = await Promise.all([
-      getCurrentUser(),
+      apiUsername ? Promise.resolve({ username: apiUsername }) : getCurrentUser(),
       getListById(uuid),
     ]);
     if (!currentUser) return { error: "Not authenticated" };
diff --git a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
index 732ee095c..b7890b089 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
@@ -34,7 +34,7 @@ export async function PUT(
       formData.append("itemId", params.itemId);
       formData.append("assignee", assignee || "");
 
-      const result = await assignKanbanItem(formData);
+      const result = await assignKanbanItem(formData, user.username);
 
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
diff --git a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
index 779f7312e..51e06af13 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
@@ -41,7 +41,7 @@ export async function PUT(
       formData.append("itemId", params.itemId);
       formData.append("reminder", JSON.stringify({ datetime }));
 
-      const result = await setKanbanItemReminder(formData);
+      const result = await setKanbanItemReminder(formData, user.username);
 
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
@@ -83,7 +83,7 @@ export async function DELETE(
       formData.append("itemId", params.itemId);
       formData.append("reminder", "");
 
-      const result = await setKanbanItemReminder(formData);
+      const result = await setKanbanItemReminder(formData, user.username);
 
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });

From 975e24f0b4b004d1ee2a790b0febb649b19623cf Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 09:35:45 +0100
Subject: [PATCH 05/28] fix tests

---
 app/_server/actions/checklist-item/crud.ts  |  5 +++--
 tests/server-actions/checklist-item.test.ts | 13 ++++++++-----
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/app/_server/actions/checklist-item/crud.ts b/app/_server/actions/checklist-item/crud.ts
index 10285a5f7..e07690c4b 100644
--- a/app/_server/actions/checklist-item/crud.ts
+++ b/app/_server/actions/checklist-item/crud.ts
@@ -15,7 +15,8 @@ import {
   extractHashtagsFromContent,
   normalizeTag,
 } from "@/app/_utils/tag-utils";
-import { isAdmin, getUsername, getUserByUsername } from "@/app/_server/actions/users";
+import { isAdmin, getUsername } from "@/app/_server/actions/users";
+import { findUserRecord } from "@/app/_server/actions/users/records";
 import { Checklist, Item, KanbanPriority, Result } from "@/app/_types";
 import {
   ItemTypes,
@@ -282,7 +283,7 @@ export const createItem = async (
       order: item.order + 1,
     }));
 
-    const userRecord = await getUserByUsername(currentUser);
+    const userRecord = await findUserRecord(currentUser);
     const insertAtBottom = userRecord?.newItemInsertion === "bottom";
 
     const newItem = {
diff --git a/tests/server-actions/checklist-item.test.ts b/tests/server-actions/checklist-item.test.ts
index a3fbed7d8..d895635c6 100644
--- a/tests/server-actions/checklist-item.test.ts
+++ b/tests/server-actions/checklist-item.test.ts
@@ -6,7 +6,7 @@ const mockEnsureDir = vi.fn();
 const mockServerWriteFile = vi.fn();
 const mockGetUsername = vi.fn();
 const mockGetCurrentUser = vi.fn();
-const mockGetUserByUsername = vi.fn();
+const mockFindUserRecord = vi.fn();
 const mockIsAdmin = vi.fn();
 const mockCanReach = vi.fn();
 const mockUsersWithAccess = vi.fn();
@@ -26,10 +26,13 @@ vi.mock("@/app/_server/actions/file", () => ({
 vi.mock("@/app/_server/actions/users", () => ({
   getUsername: (...args: any[]) => mockGetUsername(...args),
   getCurrentUser: (...args: any[]) => mockGetCurrentUser(...args),
-  getUserByUsername: (...args: any[]) => mockGetUserByUsername(...args),
   isAdmin: (...args: any[]) => mockIsAdmin(...args),
 }));
 
+vi.mock("@/app/_server/actions/users/records", () => ({
+  findUserRecord: (...args: any[]) => mockFindUserRecord(...args),
+}));
+
 vi.mock("@/app/_server/actions/share/queries", () => ({
   canReach: (...args: any[]) => mockCanReach(...args),
   reachableFile: async (...args: any[]) =>
@@ -121,7 +124,7 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
     mockServerWriteFile.mockResolvedValue(undefined);
     mockGetUsername.mockResolvedValue("testuser");
     mockGetCurrentUser.mockResolvedValue({ username: "testuser" });
-    mockGetUserByUsername.mockResolvedValue(null);
+    mockFindUserRecord.mockResolvedValue(null);
     mockIsAdmin.mockResolvedValue(false);
     mockCanReach.mockResolvedValue(true);
     mockUsersWithAccess.mockResolvedValue([]);
@@ -350,7 +353,7 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
     });
 
     it("should prepend new item (order 0) by default", async () => {
-      mockGetUserByUsername.mockResolvedValue(null);
+      mockFindUserRecord.mockResolvedValue(null);
 
       const formData = createFormData({
         uuid: "test-uuid-123",
@@ -371,7 +374,7 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
     });
 
     it("should append new item at the end when newItemInsertion is 'bottom'", async () => {
-      mockGetUserByUsername.mockResolvedValue({
+      mockFindUserRecord.mockResolvedValue({
         username: "testuser",
         newItemInsertion: "bottom",
       });

From a5a428209aa426cc3ca340e90b20e2da9bce71ff Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 15:45:30 +0100
Subject: [PATCH 06/28] brain trust ftw

---
 .github/workflows/pr-checks.yml               |   2 +-
 .github/workflows/prebuild-release.yml        |   2 +-
 Dockerfile                                    |   2 +-
 README.md                                     |   2 +
 .../admin/checklist/[uuid]/page.tsx           |  16 +-
 .../admin/note/[uuid]/page.tsx                |   8 +-
 .../brain/[username]/page.tsx                 |  25 +
 app/(loggedInRoutes)/brain/page.tsx           |  18 +
 .../checklist/[uuid]/page.tsx                 |  16 +-
 app/(loggedInRoutes)/note/[uuid]/page.tsx     |   8 +-
 .../settings/connections/page.tsx             |  26 +-
 .../Admin/Parts/AdminContent.tsx              |   5 +-
 .../Parts/Sharing/SharingNetworkGraph.tsx     |  43 --
 .../Admin/Parts/SharingNetworkGraph.tsx       |  43 --
 .../Brain/BrainPageClient.tsx                 | 223 +++++++
 .../Brain/Parts/BrainButton.tsx               |  34 +
 .../Brain/Parts/BrainCanvas2D.tsx             | 349 ++++++++++
 .../Brain/Parts/BrainInspector.tsx            | 187 ++++++
 .../Brain/Parts/BrainLegend.tsx               |  61 ++
 .../Brain/Parts/BrainScene3D.tsx              | 449 +++++++++++++
 .../Brain/Parts/BrainToolbar.tsx              | 199 ++++++
 .../Brain/hooks/useBrainPalette.ts            |  56 ++
 .../Brain/hooks/useBrainPrefs.ts              | 105 +++
 .../Brain/hooks/useElementSize.ts             |  28 +
 .../Brain/server/BrainPage.tsx                |  33 +
 .../Brain/utils/brain-canvas.ts               |  17 +
 .../Brain/utils/brain-forces.ts               | 117 ++++
 .../Brain/utils/brain-glyphs.ts               | 185 ++++++
 .../Brain/utils/brain-graph.ts                | 219 +++++++
 .../Brain/utils/brain-three.ts                | 274 ++++++++
 .../Parts/Common/ChecklistHeader.tsx          |   3 +
 .../Checklists/Parts/Simple/ChecklistBody.tsx |  24 +-
 .../FeatureComponents/Kanban/Kanban.tsx       |  19 +-
 .../Notes/Parts/MentionedInSection.tsx        |  84 +++
 .../Parts/NoteEditor/NoteEditorContent.tsx    |  12 +-
 .../Parts/NoteEditor/NoteEditorHeader.tsx     |   2 +
 .../Notes/Parts/ReferencedBySection.tsx       | 144 ++--
 .../Notes/Parts/TableOfContents.tsx           |  19 +-
 .../TipTap/CustomExtensions/InternalLink.tsx  |   7 +-
 .../InternalLinkComponent.tsx                 | 364 ++++-------
 .../TipTap/CustomExtensions/SlashCommands.tsx |  36 +-
 .../Notes/Parts/UnifiedMarkdownRenderer.tsx   |  62 +-
 .../Notes/Parts/WikiLink.tsx                  | 113 ++++
 .../ConnectionsGraph/ConnectionsGraph.tsx     | 615 ------------------
 .../Parts/ConnectionsGraph/graph-data.ts      | 335 ----------
 .../Profile/Parts/LinksTab.tsx                | 468 -------------
 .../Sidebar/Parts/TagsList.tsx                |  11 +-
 .../Sidebar/SettingsSidebar.tsx               |   3 +-
 .../Layout/IndexingRelations.tsx              |  25 +
 app/_consts/relations.ts                      |  45 ++
 app/_providers/AppModeProvider.tsx            |   5 -
 app/_providers/MetadataProvider.tsx           |   3 +
 app/_providers/RelationsProvider.tsx          |  21 +
 app/_server/actions/category/crud.ts          |   3 +-
 app/_server/actions/category/move.ts          |  18 +-
 app/_server/actions/checklist/converters.ts   |  21 -
 app/_server/actions/checklist/creator.ts      |  21 -
 app/_server/actions/checklist/crud.ts         |  47 --
 app/_server/actions/checklist/readers.ts      |  63 +-
 app/_server/actions/file/atomic.ts            |  55 ++
 app/_server/actions/file/index.ts             |  22 +-
 app/_server/actions/lib/legacy-lookup.ts      |  19 +-
 app/_server/actions/lib/metadata-cache.ts     |   9 +
 app/_server/actions/lib/stamp-uuid.ts         |  54 ++
 app/_server/actions/link/index.ts             | 369 -----------
 app/_server/actions/note/creator.ts           |  25 +-
 app/_server/actions/note/crud.ts              |  65 +-
 app/_server/actions/note/index.ts             |   6 +-
 app/_server/actions/note/parsers.ts           | 127 +---
 app/_server/actions/note/queries.ts           |   8 +-
 app/_server/actions/note/readers.ts           |  74 +--
 app/_server/actions/relations/index.ts        | 142 ++++
 app/_server/actions/relations/indexer.ts      | 339 ++++++++++
 app/_server/actions/relations/parser.ts       |  63 ++
 app/_server/actions/relations/paths.ts        |  41 ++
 app/_server/actions/relations/queries.ts      | 269 ++++++++
 app/_server/actions/relations/store.ts        | 157 +++++
 app/_server/actions/relations/suggestions.ts  |  65 ++
 app/_server/actions/relations/tidy.ts         | 223 +++++++
 app/_server/actions/relations/tracking.ts     |  63 ++
 app/_server/actions/share/access.ts           |  17 +-
 app/_server/actions/share/category-info.ts    |   9 +
 app/_server/actions/share/mounts.ts           |   4 +-
 app/_server/actions/share/rename.ts           | 130 ++--
 app/_server/actions/tags/index.ts             |   3 +-
 app/_server/actions/users/auth.ts             |   5 +-
 app/_server/actions/users/crud.ts             |  39 +-
 app/_translations/en.json                     |  66 ++
 app/_types/context.ts                         |   2 -
 app/_types/index.ts                           |   1 -
 app/_types/links.ts                           |  16 -
 app/_types/relations.ts                       |  53 ++
 app/_types/websocket.ts                       |   2 +-
 app/_utils/checklist-utils.ts                 |   3 +-
 app/_utils/indexes-utils.ts                   |  82 ---
 app/_utils/item-href-utils.ts                 |  96 +++
 app/_utils/markdown-utils.tsx                 |  57 +-
 app/_utils/wikilink-utils.ts                  |  24 +
 app/_utils/yaml-metadata-utils.ts             |  10 +
 app/api/admin/rebuild-index/route.ts          |  27 +-
 app/layout.tsx                                |   5 -
 howto/API.md                                  |  18 +-
 howto/BRAIN.md                                |  99 +++
 instrumentation.ts                            |   7 +
 next.config.mjs                               |   2 +
 package.json                                  |  12 +-
 tests/mock-data/brain-seed.ts                 | 404 ++++++++++++
 tests/security/auth-required.test.ts          |  35 +-
 tests/server-actions/category.test.ts         |   1 +
 tests/server-actions/checklist.test.ts        |  27 -
 tests/server-actions/file.test.ts             |  24 +-
 tests/server-actions/link-index.test.ts       | 104 ---
 tests/server-actions/note-readers.test.ts     |   6 +
 tests/server-actions/note.test.ts             |  29 +-
 tests/server-actions/relations.test.ts        | 459 +++++++++++++
 tests/server-actions/share-visibility.test.ts | 235 +++++++
 tests/server-actions/tags.test.ts             |   6 +
 tests/server-actions/user-deletion.test.ts    | 265 ++++++++
 tests/server-actions/users.test.ts            |  26 +
 tests/setup.ts                                |   7 +
 tests/utils/connections-graph-data.test.ts    | 279 --------
 tsconfig.json                                 |   2 +-
 yarn.lock                                     | 505 +++++++-------
 123 files changed, 7033 insertions(+), 3710 deletions(-)
 create mode 100644 app/(loggedInRoutes)/brain/[username]/page.tsx
 create mode 100644 app/(loggedInRoutes)/brain/page.tsx
 delete mode 100644 app/_components/FeatureComponents/Admin/Parts/Sharing/SharingNetworkGraph.tsx
 delete mode 100644 app/_components/FeatureComponents/Admin/Parts/SharingNetworkGraph.tsx
 create mode 100644 app/_components/FeatureComponents/Brain/BrainPageClient.tsx
 create mode 100644 app/_components/FeatureComponents/Brain/Parts/BrainButton.tsx
 create mode 100644 app/_components/FeatureComponents/Brain/Parts/BrainCanvas2D.tsx
 create mode 100644 app/_components/FeatureComponents/Brain/Parts/BrainInspector.tsx
 create mode 100644 app/_components/FeatureComponents/Brain/Parts/BrainLegend.tsx
 create mode 100644 app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx
 create mode 100644 app/_components/FeatureComponents/Brain/Parts/BrainToolbar.tsx
 create mode 100644 app/_components/FeatureComponents/Brain/hooks/useBrainPalette.ts
 create mode 100644 app/_components/FeatureComponents/Brain/hooks/useBrainPrefs.ts
 create mode 100644 app/_components/FeatureComponents/Brain/hooks/useElementSize.ts
 create mode 100644 app/_components/FeatureComponents/Brain/server/BrainPage.tsx
 create mode 100644 app/_components/FeatureComponents/Brain/utils/brain-canvas.ts
 create mode 100644 app/_components/FeatureComponents/Brain/utils/brain-forces.ts
 create mode 100644 app/_components/FeatureComponents/Brain/utils/brain-glyphs.ts
 create mode 100644 app/_components/FeatureComponents/Brain/utils/brain-graph.ts
 create mode 100644 app/_components/FeatureComponents/Brain/utils/brain-three.ts
 create mode 100644 app/_components/FeatureComponents/Notes/Parts/MentionedInSection.tsx
 create mode 100644 app/_components/FeatureComponents/Notes/Parts/WikiLink.tsx
 delete mode 100644 app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/ConnectionsGraph.tsx
 delete mode 100644 app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/graph-data.ts
 delete mode 100644 app/_components/FeatureComponents/Profile/Parts/LinksTab.tsx
 create mode 100644 app/_components/GlobalComponents/Layout/IndexingRelations.tsx
 create mode 100644 app/_consts/relations.ts
 create mode 100644 app/_providers/RelationsProvider.tsx
 create mode 100644 app/_server/actions/file/atomic.ts
 create mode 100644 app/_server/actions/lib/stamp-uuid.ts
 delete mode 100644 app/_server/actions/link/index.ts
 create mode 100644 app/_server/actions/relations/index.ts
 create mode 100644 app/_server/actions/relations/indexer.ts
 create mode 100644 app/_server/actions/relations/parser.ts
 create mode 100644 app/_server/actions/relations/paths.ts
 create mode 100644 app/_server/actions/relations/queries.ts
 create mode 100644 app/_server/actions/relations/store.ts
 create mode 100644 app/_server/actions/relations/suggestions.ts
 create mode 100644 app/_server/actions/relations/tidy.ts
 create mode 100644 app/_server/actions/relations/tracking.ts
 delete mode 100644 app/_types/links.ts
 create mode 100644 app/_types/relations.ts
 delete mode 100644 app/_utils/indexes-utils.ts
 create mode 100644 app/_utils/item-href-utils.ts
 create mode 100644 app/_utils/wikilink-utils.ts
 create mode 100644 howto/BRAIN.md
 create mode 100644 tests/mock-data/brain-seed.ts
 delete mode 100644 tests/server-actions/link-index.test.ts
 create mode 100644 tests/server-actions/relations.test.ts
 create mode 100644 tests/server-actions/share-visibility.test.ts
 create mode 100644 tests/server-actions/user-deletion.test.ts
 delete mode 100644 tests/utils/connections-graph-data.test.ts

diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 94e3ea02a..5ff30552c 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -38,7 +38,7 @@ jobs:
       - name: Setup the best engine ever
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           cache: "yarn"
 
       - name: Install all dependencies
diff --git a/.github/workflows/prebuild-release.yml b/.github/workflows/prebuild-release.yml
index 5f53d32f2..1fd5fb875 100644
--- a/.github/workflows/prebuild-release.yml
+++ b/.github/workflows/prebuild-release.yml
@@ -16,7 +16,7 @@ jobs:
       - name: Setup the best engine ever
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'yarn'
 
       - name: Install dependencies
diff --git a/Dockerfile b/Dockerfile
index 77cf66802..c018f820e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:20-alpine AS base
+FROM node:24-alpine AS base
 
 FROM base AS deps
 RUN apk add --no-cache libc6-compat
diff --git a/README.md b/README.md
index 8e4caf5d0..c0b10d123 100644
--- a/README.md
+++ b/README.md
@@ -186,6 +186,8 @@ I will always detail these migrations in the release notes. I _highly recommend_
 
 📖 **For the complete MARKDOWN documentation, see [howto/MARKDOWN.md](howto/MARKDOWN.md)**
 
+📖 **For links, wikilinks and the brain view, see [howto/BRAIN.md](howto/BRAIN.md)**
+
 <a id="encryption"></a>
 
 ## ENCRYPTION
diff --git a/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx b/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx
index 60e7792db..8156eb41e 100644
--- a/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx
@@ -11,6 +11,8 @@ import type { Metadata } from "next";
 import { getMedatadaTitle } from "@/app/_server/actions/config";
 import { PermissionsProvider } from "@/app/_providers/PermissionsProvider";
 import { MetadataProvider } from "@/app/_providers/MetadataProvider";
+import { RelationsProvider } from "@/app/_providers/RelationsProvider";
+import { getItemRelations } from "@/app/_server/actions/relations";
 
 interface AdminChecklistPageProps {
   params: Promise<{
@@ -67,14 +69,18 @@ export default async function AdminChecklistPage(props: AdminChecklistPageProps)
     type: "checklist" as const,
   };
 
+  const relations = await getItemRelations(checklist.uuid || "");
+
   return (
     <MetadataProvider metadata={metadata}>
       <PermissionsProvider item={checklist}>
-        <ChecklistClient
-          checklist={checklist}
-          categories={categories}
-          user={user}
-        />
+        <RelationsProvider relations={relations}>
+          <ChecklistClient
+            checklist={checklist}
+            categories={categories}
+            user={user}
+          />
+        </RelationsProvider>
       </PermissionsProvider>
     </MetadataProvider>
   );
diff --git a/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx b/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx
index 9f39649d4..b6e96f13e 100644
--- a/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx
@@ -12,6 +12,8 @@ import type { Metadata } from "next";
 import { getMedatadaTitle } from "@/app/_server/actions/config";
 import { PermissionsProvider } from "@/app/_providers/PermissionsProvider";
 import { MetadataProvider } from "@/app/_providers/MetadataProvider";
+import { RelationsProvider } from "@/app/_providers/RelationsProvider";
+import { getItemRelations } from "@/app/_server/actions/relations";
 
 interface AdminNotePageProps {
   params: Promise<{
@@ -69,10 +71,14 @@ export default async function AdminNotePage(props: AdminNotePageProps) {
     type: "note" as const,
   };
 
+  const relations = await getItemRelations(note.uuid || "");
+
   return (
     <MetadataProvider metadata={metadata}>
       <PermissionsProvider item={note}>
-        <NoteClient note={note} categories={docsCategories} />
+        <RelationsProvider relations={relations}>
+          <NoteClient note={note} categories={docsCategories} />
+        </RelationsProvider>
       </PermissionsProvider>
     </MetadataProvider>
   );
diff --git a/app/(loggedInRoutes)/brain/[username]/page.tsx b/app/(loggedInRoutes)/brain/[username]/page.tsx
new file mode 100644
index 000000000..66c10dafa
--- /dev/null
+++ b/app/(loggedInRoutes)/brain/[username]/page.tsx
@@ -0,0 +1,25 @@
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import { BRAIN_FOCUS_PARAM } from "@/app/_consts/relations";
+import { decodeSegment } from "@/app/_utils/global-utils";
+import { BrainPage } from "@/app/_components/FeatureComponents/Brain/server/BrainPage";
+
+export const dynamic = "force-dynamic";
+
+export async function generateMetadata(): Promise<Metadata> {
+  const t = await getTranslations("brain");
+  return { title: t("title") };
+}
+
+export default async function UserBrainPage(props: {
+  params: Promise<{ username: string }>;
+  searchParams: Promise<Record<string, string | undefined>>;
+}) {
+  const [params, searchParams] = await Promise.all([props.params, props.searchParams]);
+  return (
+    <BrainPage
+      username={decodeSegment(params.username)}
+      focus={searchParams[BRAIN_FOCUS_PARAM]}
+    />
+  );
+}
diff --git a/app/(loggedInRoutes)/brain/page.tsx b/app/(loggedInRoutes)/brain/page.tsx
new file mode 100644
index 000000000..eb38cf503
--- /dev/null
+++ b/app/(loggedInRoutes)/brain/page.tsx
@@ -0,0 +1,18 @@
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import { BRAIN_FOCUS_PARAM } from "@/app/_consts/relations";
+import { BrainPage } from "@/app/_components/FeatureComponents/Brain/server/BrainPage";
+
+export const dynamic = "force-dynamic";
+
+export async function generateMetadata(): Promise<Metadata> {
+  const t = await getTranslations("brain");
+  return { title: t("title") };
+}
+
+export default async function OwnBrainPage(props: {
+  searchParams: Promise<Record<string, string | undefined>>;
+}) {
+  const searchParams = await props.searchParams;
+  return <BrainPage focus={searchParams[BRAIN_FOCUS_PARAM]} />;
+}
diff --git a/app/(loggedInRoutes)/checklist/[uuid]/page.tsx b/app/(loggedInRoutes)/checklist/[uuid]/page.tsx
index 05afed362..0d111b7bd 100644
--- a/app/(loggedInRoutes)/checklist/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/checklist/[uuid]/page.tsx
@@ -10,6 +10,8 @@ import { isUuid } from "@/app/_consts/identity";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 import { PermissionsProvider } from "@/app/_providers/PermissionsProvider";
 import { MetadataProvider } from "@/app/_providers/MetadataProvider";
+import { RelationsProvider } from "@/app/_providers/RelationsProvider";
+import { getItemRelations } from "@/app/_server/actions/relations";
 import { decodeSegment } from "@/app/_utils/global-utils";
 
 interface ChecklistPageProps {
@@ -82,14 +84,18 @@ export default async function ChecklistPage(props: ChecklistPageProps) {
     type: "checklist" as const,
   };
 
+  const relations = await getItemRelations(checklist.uuid || "");
+
   return (
     <MetadataProvider metadata={metadata}>
       <PermissionsProvider item={checklist}>
-        <ChecklistClient
-          checklist={checklist}
-          categories={categories}
-          user={user}
-        />
+        <RelationsProvider relations={relations}>
+          <ChecklistClient
+            checklist={checklist}
+            categories={categories}
+            user={user}
+          />
+        </RelationsProvider>
       </PermissionsProvider>
     </MetadataProvider>
   );
diff --git a/app/(loggedInRoutes)/note/[uuid]/page.tsx b/app/(loggedInRoutes)/note/[uuid]/page.tsx
index 3b04cefde..84f96082e 100644
--- a/app/(loggedInRoutes)/note/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/note/[uuid]/page.tsx
@@ -16,6 +16,8 @@ import { isUuid } from "@/app/_consts/identity";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 import { PermissionsProvider } from "@/app/_providers/PermissionsProvider";
 import { MetadataProvider } from "@/app/_providers/MetadataProvider";
+import { RelationsProvider } from "@/app/_providers/RelationsProvider";
+import { getItemRelations } from "@/app/_server/actions/relations";
 import { decodeSegment } from "@/app/_utils/global-utils";
 
 interface NotePageProps {
@@ -90,10 +92,14 @@ export default async function NotePage(props: NotePageProps) {
     type: "note" as const,
   };
 
+  const relations = await getItemRelations(note.uuid || "");
+
   return (
     <MetadataProvider metadata={metadata}>
       <PermissionsProvider item={note}>
-        <NoteClient note={note} categories={docsCategories} />
+        <RelationsProvider relations={relations}>
+          <NoteClient note={note} categories={docsCategories} />
+        </RelationsProvider>
       </PermissionsProvider>
     </MetadataProvider>
   );
diff --git a/app/(loggedInRoutes)/settings/connections/page.tsx b/app/(loggedInRoutes)/settings/connections/page.tsx
index db0bd01f2..386427e2b 100644
--- a/app/(loggedInRoutes)/settings/connections/page.tsx
+++ b/app/(loggedInRoutes)/settings/connections/page.tsx
@@ -1,24 +1,6 @@
-import { LinksTab } from "@/app/_components/FeatureComponents/Profile/Parts/LinksTab";
-import { readLinkIndex } from "@/app/_server/actions/link";
-import { getUsername } from "@/app/_server/actions/users";
-import { getArchivedItems } from "@/app/_server/actions/archived";
-import { getUserNotes } from "@/app/_server/actions/note";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
-import { filterArchivedLinkIndex } from "@/app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/graph-data";
+import { permanentRedirect } from "next/navigation";
+import { BRAIN_PATH } from "@/app/_consts/relations";
 
-export default async function ConnectionsPage() {
-    const username = await getUsername();
-    const [linkIndex, archivedResult, notesResult, checklistsResult] = await Promise.all([
-        readLinkIndex(username),
-        getArchivedItems(),
-        getUserNotes({ username, metadataOnly: true }),
-        getUserChecklists({ username, metadataOnly: true }),
-    ]);
-
-    const archivedItems = archivedResult.success ? archivedResult.data : [];
-    const filteredLinkIndex = filterArchivedLinkIndex(linkIndex, archivedItems || []);
-    const notes = notesResult.success ? notesResult.data || [] : [];
-    const checklists = checklistsResult.success ? checklistsResult.data || [] : [];
-
-    return <LinksTab linkIndex={filteredLinkIndex} notes={notes} checklists={checklists} />;
+export default function ConnectionsPage() {
+  permanentRedirect(BRAIN_PATH);
 }
diff --git a/app/_components/FeatureComponents/Admin/Parts/AdminContent.tsx b/app/_components/FeatureComponents/Admin/Parts/AdminContent.tsx
index d48b7e2cb..3194537de 100644
--- a/app/_components/FeatureComponents/Admin/Parts/AdminContent.tsx
+++ b/app/_components/FeatureComponents/Admin/Parts/AdminContent.tsx
@@ -13,7 +13,7 @@ import { AdminContentColumn } from "./AdminContentColumn";
 import { ExportContent } from "./AdminExport";
 import { Accordion } from "@/app/_components/GlobalComponents/Layout/Accordion";
 import { UserAvatar } from "@/app/_components/GlobalComponents/User/UserAvatar";
-import { rebuildLinkIndex } from "@/app/_server/actions/link";
+import { reindexRelations } from "@/app/_server/actions/relations";
 import { updateTagsFromContent } from "@/app/_server/actions/tags";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { useTranslations } from "next-intl";
@@ -106,7 +106,8 @@ export const AdminContent = ({
   const handleRebuildIndex = async (username: string) => {
     setRebuildingIndex(username);
     try {
-      await rebuildLinkIndex(username);
+      const result = await reindexRelations(username);
+      if (!result.success) throw new Error(result.error);
       showToast({
         type: "success",
         title: t('common.success'),
diff --git a/app/_components/FeatureComponents/Admin/Parts/Sharing/SharingNetworkGraph.tsx b/app/_components/FeatureComponents/Admin/Parts/Sharing/SharingNetworkGraph.tsx
deleted file mode 100644
index dcd90dc16..000000000
--- a/app/_components/FeatureComponents/Admin/Parts/Sharing/SharingNetworkGraph.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-"use client";
-
-import dynamic from "next/dynamic";
-import { useThemeColors } from "./AdminSharingFunctions";
-
-const ResponsiveNetwork = dynamic(
-    () => import("@nivo/network").then((mod) => mod.ResponsiveNetwork),
-    { ssr: false }
-);
-
-export const SharingNetworkGraph = ({ data }: { data: any }) => {
-    const colors = useThemeColors();
-    if (!data || data.nodes.length === 0) {
-        return (
-            <div className="flex items-center justify-center h-[500px] text-muted-foreground">
-                Not enough sharing data to display a network graph.
-            </div>
-        );
-    }
-
-    return (
-        <div className="h-[500px] w-full">
-            <ResponsiveNetwork
-                data={data}
-                margin={{ top: 0, right: 0, bottom: 0, left: 0 }}
-                linkDistance={(e: any) => e.distance}
-                centeringStrength={0.3}
-                repulsivity={6}
-                nodeSize={(n: any) => n.size}
-                activeNodeSize={(n: any) => n.size * 1.5}
-                nodeColor={(e: any) => e.color}
-                nodeBorderWidth={1}
-                nodeBorderColor={{
-                    from: "color",
-                    modifiers: [["darker", 0.8]],
-                }}
-                linkThickness={2}
-                linkBlendMode="multiply"
-                motionConfig="wobbly"
-            />
-        </div>
-    );
-};
diff --git a/app/_components/FeatureComponents/Admin/Parts/SharingNetworkGraph.tsx b/app/_components/FeatureComponents/Admin/Parts/SharingNetworkGraph.tsx
deleted file mode 100644
index d41ea6794..000000000
--- a/app/_components/FeatureComponents/Admin/Parts/SharingNetworkGraph.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-"use client";
-
-import dynamic from "next/dynamic";
-import { useThemeColors } from "./Sharing/AdminSharingFunctions";
-
-const ResponsiveNetwork = dynamic(
-    () => import("@nivo/network").then((mod) => mod.ResponsiveNetwork),
-    { ssr: false }
-);
-
-export const SharingNetworkGraph = ({ data }: { data: any }) => {
-    const colors = useThemeColors();
-    if (!data || data.nodes.length === 0) {
-        return (
-            <div className="flex items-center justify-center h-[500px] text-muted-foreground">
-                Not enough sharing data to display a network graph.
-            </div>
-        );
-    }
-
-    return (
-        <div className="h-[500px] w-full">
-            <ResponsiveNetwork
-                data={data}
-                margin={{ top: 0, right: 0, bottom: 0, left: 0 }}
-                linkDistance={(e: any) => e.distance}
-                centeringStrength={0.3}
-                repulsivity={6}
-                nodeSize={(n: any) => n.size}
-                activeNodeSize={(n: any) => n.size * 1.5}
-                nodeColor={(e: any) => e.color}
-                nodeBorderWidth={1}
-                nodeBorderColor={{
-                    from: "color",
-                    modifiers: [["darker", 0.8]],
-                }}
-                linkThickness={2}
-                linkBlendMode="multiply"
-                motionConfig="wobbly"
-            />
-        </div>
-    );
-};
diff --git a/app/_components/FeatureComponents/Brain/BrainPageClient.tsx b/app/_components/FeatureComponents/Brain/BrainPageClient.tsx
new file mode 100644
index 000000000..033f2c59b
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/BrainPageClient.tsx
@@ -0,0 +1,223 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import dynamic from "next/dynamic";
+import { useRouter } from "next/navigation";
+import { useTranslations } from "next-intl";
+import { AiBrain04Icon } from "hugeicons-react";
+import { Layout } from "@/app/_components/GlobalComponents/Layout/Layout";
+import { MobileHeader } from "@/app/_components/GlobalComponents/Layout/MobileHeader";
+import { IndexingRelations } from "@/app/_components/GlobalComponents/Layout/IndexingRelations";
+import { useShortcut } from "@/app/_providers/ShortcutsProvider";
+import { useToast } from "@/app/_providers/ToastProvider";
+import { connectItems } from "@/app/_server/actions/relations";
+import { createNote } from "@/app/_server/actions/note";
+import { BrainNodeKinds, RelationsStatus } from "@/app/_consts/relations";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { ItemTypes } from "@/app/_types/enums";
+import { itemHref } from "@/app/_utils/global-utils";
+import type { Category, SanitisedUser } from "@/app/_types";
+import type { BrainGraph, BrainNode } from "@/app/_types/relations";
+import { BrainToolbar } from "./Parts/BrainToolbar";
+import { BrainInspector } from "./Parts/BrainInspector";
+import { BrainLegend } from "./Parts/BrainLegend";
+import { useBrainPalette } from "./hooks/useBrainPalette";
+import { useBrainPrefs } from "./hooks/useBrainPrefs";
+import { BrainDimensions, brainView } from "./utils/brain-graph";
+
+const BrainCanvas3D = dynamic(() => import("./Parts/BrainScene3D"), {
+  ssr: false,
+});
+const BrainCanvas2D = dynamic(() => import("./Parts/BrainCanvas2D"), {
+  ssr: false,
+});
+
+interface BrainPageClientProps {
+  graph: BrainGraph;
+  focus: string | null;
+  isOwnBrain: boolean;
+  categories: Category[];
+  user: SanitisedUser | null;
+}
+
+const TAG_ROUTE = (tag: string) => `/?mode=tags&tag=${encodeURIComponent(tag)}`;
+
+export const BrainPageClient = ({
+  graph,
+  focus,
+  isOwnBrain,
+  categories,
+  user,
+}: BrainPageClientProps) => {
+  const t = useTranslations();
+  const router = useRouter();
+  const { showToast } = useToast();
+  const { openSettings, openCreateNoteModal, openCreateCategoryModal } =
+    useShortcut();
+  const palette = useBrainPalette();
+  const focusId =
+    focus && graph.nodes.some((node) => node.id === focus) ? focus : null;
+  const prefs = useBrainPrefs(Boolean(focusId));
+  const [selectedId, setSelectedId] = useState<string | null>(focusId);
+  const [flyTo, setFlyTo] = useState<{ id: string; at: number } | null>(null);
+
+  useEffect(() => setSelectedId(focusId), [focusId]);
+
+  const view = useMemo(
+    () => brainView(graph, prefs.filters, prefs.scope, focusId),
+    [graph, prefs.filters, prefs.scope, focusId],
+  );
+  const nodeIndex = useMemo(
+    () => new Map(graph.nodes.map((node) => [node.id, node])),
+    [graph.nodes],
+  );
+  const selected = selectedId ? nodeIndex.get(selectedId) || null : null;
+
+  const find = useCallback((id: string) => {
+    setSelectedId(id);
+    setFlyTo({ id, at: Date.now() });
+  }, []);
+
+  const open = useCallback(
+    async (node: BrainNode) => {
+      if (node.kind === BrainNodeKinds.NOTE)
+        return router.push(itemHref(ItemTypes.NOTE, node.id));
+      if (node.kind === BrainNodeKinds.CHECKLIST)
+        return router.push(itemHref(ItemTypes.CHECKLIST, node.id));
+      if (node.kind === BrainNodeKinds.TAG)
+        return router.push(TAG_ROUTE(node.title.replace(/^#/, "")));
+      if (!isOwnBrain) return;
+
+      const formData = new FormData();
+      formData.append("title", node.title);
+      formData.append("category", UNCATEGORIZED);
+      formData.append("rawContent", "");
+      const result = await createNote(formData);
+      if (result.success && result.data?.uuid) {
+        router.push(itemHref(ItemTypes.NOTE, result.data.uuid));
+        return;
+      }
+      showToast({
+        type: "error",
+        title: t("common.error"),
+        message: t("brain.createFailed"),
+      });
+    },
+    [router, isOwnBrain, showToast, t],
+  );
+
+  const connect = useCallback(
+    async (source: BrainNode, target: BrainNode) => {
+      const result = await connectItems(source.id, target.id);
+      if (!result.success) {
+        showToast({
+          type: "error",
+          title: t("common.error"),
+          message: t("brain.connectFailed"),
+        });
+        return;
+      }
+      showToast({
+        type: "success",
+        title: t("common.success"),
+        message: t("brain.connected", {
+          source: source.title,
+          target: target.title,
+        }),
+      });
+      router.refresh();
+    },
+    [router, showToast, t],
+  );
+
+  const Canvas =
+    prefs.dimension === BrainDimensions.THREE_D ? BrainCanvas3D : BrainCanvas2D;
+  const building = graph.status === RelationsStatus.BUILDING;
+  const empty = !building && graph.nodes.length === 0;
+
+  return (
+    <Layout
+      categories={categories}
+      onOpenSettings={openSettings}
+      onOpenCreateModal={openCreateNoteModal}
+      onOpenCategoryModal={openCreateCategoryModal}
+      user={user}
+    >
+      <div className="flex h-full min-h-0 flex-col">
+        <MobileHeader
+          user={user}
+          onOpenSettings={openSettings}
+          currentLocale={user?.preferredLocale || "en"}
+        />
+
+        <div className="relative min-h-0 w-full flex-1 overflow-hidden bg-background">
+          {building && <IndexingRelations />}
+
+          {empty && (
+            <div className="flex h-full flex-col items-center justify-center gap-3 px-6 text-center text-muted-foreground">
+              <AiBrain04Icon className="h-12 w-12 text-primary" />
+              <p className="max-w-md text-md lg:text-sm">{t("brain.empty")}</p>
+            </div>
+          )}
+
+          {!building && !empty && (
+            <>
+              <Canvas
+                nodes={view.nodes}
+                edges={view.edges}
+                focusId={focusId}
+                selectedId={selectedId}
+                colourMode={prefs.colourMode}
+                palette={palette}
+                flyTo={flyTo}
+                onSelect={setSelectedId}
+                onOpen={open}
+              />
+
+              <div className="pointer-events-none absolute inset-x-0 top-0 z-10 p-3 lg:p-4">
+                <div className="max-w-4xl">
+                  <BrainToolbar
+                    nodes={view.nodes}
+                    dimension={prefs.dimension}
+                    scope={prefs.scope}
+                    filters={prefs.filters}
+                    colourMode={prefs.colourMode}
+                    hasFocus={Boolean(focusId)}
+                    webglReady={prefs.webglReady}
+                    onDimension={prefs.setDimension}
+                    onScope={prefs.setScope}
+                    onFilters={prefs.setFilters}
+                    onColourMode={prefs.setColourMode}
+                    onFind={(node) => find(node.id)}
+                  />
+                </div>
+              </div>
+
+              <BrainLegend
+                graph={graph}
+                palette={palette}
+                shown={view.nodes.length}
+                owner={isOwnBrain ? null : graph.owner}
+              />
+
+              {selected && (
+                <div className="absolute inset-x-3 bottom-3 z-10 max-h-[45%] lg:inset-x-auto lg:bottom-4 lg:right-4 lg:top-40 lg:max-h-none lg:w-80">
+                  <BrainInspector
+                    node={selected}
+                    nodes={nodeIndex}
+                    edges={view.edges}
+                    canEdit={isOwnBrain}
+                    onPick={find}
+                    onOpen={open}
+                    onConnect={connect}
+                    onClose={() => setSelectedId(null)}
+                  />
+                </div>
+              )}
+            </>
+          )}
+        </div>
+      </div>
+    </Layout>
+  );
+};
diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainButton.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainButton.tsx
new file mode 100644
index 000000000..6e36a5c90
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainButton.tsx
@@ -0,0 +1,34 @@
+"use client";
+
+import Link from "next/link";
+import { useTranslations } from "next-intl";
+import { AiBrain04Icon } from "hugeicons-react";
+import { brainHref } from "@/app/_consts/relations";
+import { useAppMode } from "@/app/_providers/AppModeProvider";
+import { cn } from "@/app/_utils/global-utils";
+
+interface BrainButtonProps {
+  uuid?: string;
+  className?: string;
+}
+
+export const BrainButton = ({ uuid, className }: BrainButtonProps) => {
+  const t = useTranslations();
+  const { appSettings } = useAppMode();
+
+  if (!uuid || appSettings?.editor?.enableBilateralLinks === false) return null;
+
+  return (
+    <Link
+      href={brainHref(uuid)}
+      aria-label={t("brain.openBrain")}
+      title={t("brain.openBrain")}
+      className={cn(
+        "jotty-button jotty-button-outline inline-flex items-center justify-center rounded-jotty border border-input bg-background text-primary transition-colors hover:bg-accent hover:text-accent-foreground",
+        className,
+      )}
+    >
+      <AiBrain04Icon className="h-5 w-5" />
+    </Link>
+  );
+};
diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainCanvas2D.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainCanvas2D.tsx
new file mode 100644
index 000000000..c83c67e34
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainCanvas2D.tsx
@@ -0,0 +1,349 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import ForceGraph2D, {
+  ForceGraphMethods,
+  LinkObject,
+  NodeObject,
+} from "react-force-graph-2d";
+import { BrainEdgeKinds, BrainNodeKinds } from "@/app/_consts/relations";
+import type { BrainEdge, BrainNode } from "@/app/_types/relations";
+import {
+  edgeColour,
+  endpointId,
+  isItemNode,
+  neighbourMap,
+  nodeColour,
+  nodeRadius,
+  rgba,
+} from "../utils/brain-graph";
+import { BrainCanvasProps, FLY_MS } from "../utils/brain-canvas";
+import { useElementSize } from "../hooks/useElementSize";
+import { collideForce, gravityForce, regionForce } from "../utils/brain-forces";
+import { paintHalo, paintStamp } from "../utils/brain-glyphs";
+
+type CanvasNode = NodeObject<BrainNode> & BrainNode;
+type CanvasLink = LinkObject<BrainNode, BrainEdge> & BrainEdge;
+type GraphRef = ForceGraphMethods<CanvasNode, CanvasLink>;
+
+const FOCUS_ZOOM = 3;
+const CLICK_SLOP_PX = 6;
+const CLICK_MAX_MS = 450;
+const DOUBLE_CLICK_MS = 350;
+const REGION_PULL = 0.05;
+const GRAVITY = 0.012;
+const CHARGE = -110;
+const CHARGE_REACH = 500;
+const LINK_DISTANCE = 42;
+const PERSONAL_SPACE = 5;
+const LABEL_MAX_CHARS = 28;
+const LABEL_FONT_PX = 12;
+const LABEL_PAD_PX = 5;
+const HUB_LABELS = 10;
+const GLYPH_MIN_PX = 7;
+const DIM_ALPHA = 0.15;
+const FIT_PADDING = 120;
+const STAMP_SCALE = 1.05;
+
+interface Box {
+  left: number;
+  top: number;
+  right: number;
+  bottom: number;
+}
+
+const _overlaps = (a: Box, b: Box) =>
+  a.left < b.right && b.left < a.right && a.top < b.bottom && b.top < a.bottom;
+
+const _clip = (title: string) =>
+  title.length > LABEL_MAX_CHARS ? `${title.slice(0, LABEL_MAX_CHARS - 1)}…` : title;
+
+export default function BrainCanvas2D({
+  nodes,
+  edges,
+  focusId,
+  selectedId,
+  colourMode,
+  palette,
+  flyTo,
+  onSelect,
+  onOpen,
+}: BrainCanvasProps) {
+  const graphRef = useRef<GraphRef | undefined>(undefined);
+  const settledRef = useRef(false);
+  const { ref: containerRef, size } = useElementSize<HTMLDivElement>();
+  const [hoverId, setHoverId] = useState<string | null>(null);
+  const hoverRef = useRef<CanvasNode | null>(null);
+  const pressRef = useRef<{ x: number; y: number; at: number } | null>(null);
+  const lastClickRef = useRef({ id: "", at: 0 });
+
+  const graphData = useMemo(
+    () => ({
+      nodes: nodes.map((node) => ({ ...node })) as CanvasNode[],
+      links: edges.map((edge) => ({ ...edge })) as CanvasLink[],
+    }),
+    [nodes, edges],
+  );
+
+  useEffect(() => {
+    const graph = graphRef.current;
+    if (!graph) return;
+    graph.d3Force("charge")?.strength?.(CHARGE)?.distanceMax?.(CHARGE_REACH);
+    graph.d3Force("link")?.distance?.(LINK_DISTANCE);
+    graph.d3Force("collide", collideForce((node) => nodeRadius(node, false) + PERSONAL_SPACE));
+    graph.d3Force("region", regionForce(REGION_PULL));
+    graph.d3Force("gravity", gravityForce(GRAVITY));
+  }, [size.width, graphData]);
+
+  const nodeAt = (event: React.PointerEvent): CanvasNode | null => {
+    const graph = graphRef.current;
+    const container = containerRef.current;
+    if (!graph || !container) return null;
+    const rect = container.getBoundingClientRect();
+    const point = graph.screen2GraphCoords(event.clientX - rect.left, event.clientY - rect.top);
+    let best: CanvasNode | null = null;
+    let bestDistance = Infinity;
+    graphData.nodes.forEach((candidate) => {
+      const distance = Math.hypot((candidate.x || 0) - point.x, (candidate.y || 0) - point.y);
+      const reach = Math.max(6, nodeRadius(candidate, false)) * 1.4;
+      if (distance <= reach && distance < bestDistance) {
+        best = candidate;
+        bestDistance = distance;
+      }
+    });
+    return best;
+  };
+
+  const onPointerDown = (event: React.PointerEvent) => {
+    pressRef.current = { x: event.clientX, y: event.clientY, at: Date.now() };
+  };
+
+  const onPointerUp = (event: React.PointerEvent) => {
+    const press = pressRef.current;
+    pressRef.current = null;
+    if (!press || event.button !== 0) return;
+    const moved = Math.hypot(event.clientX - press.x, event.clientY - press.y);
+    if (moved > CLICK_SLOP_PX || Date.now() - press.at > CLICK_MAX_MS) return;
+
+    const node = hoverRef.current || nodeAt(event);
+    if (!node) {
+      onSelect(null);
+      return;
+    }
+    const now = Date.now();
+    const last = lastClickRef.current;
+    lastClickRef.current = { id: node.id, at: now };
+    if (last.id === node.id && now - last.at < DOUBLE_CLICK_MS) onOpen(node);
+    else onSelect(node.id);
+  };
+
+  const neighbours = useMemo(() => neighbourMap(edges, true), [edges]);
+  const hubs = useMemo(
+    () =>
+      new Set(
+        [...nodes]
+          .filter(isItemNode)
+          .sort((a, b) => b.degree - a.degree)
+          .slice(0, HUB_LABELS)
+          .map((node) => node.id),
+      ),
+    [nodes],
+  );
+
+  const anchor = hoverId || selectedId || focusId;
+  const lit = useMemo(
+    () =>
+      anchor
+        ? new Set([anchor, ...Array.from(neighbours.get(anchor) || [])])
+        : null,
+    [anchor, neighbours],
+  );
+
+  const centreOn = useCallback(
+    (id: string) => {
+      const node = graphData.nodes.find((candidate) => candidate.id === id);
+      if (!node || node.x === undefined || node.y === undefined) return;
+      graphRef.current?.centerAt(node.x, node.y, FLY_MS);
+      graphRef.current?.zoom(FOCUS_ZOOM, FLY_MS);
+    },
+    [graphData.nodes],
+  );
+
+  useEffect(() => {
+    if (flyTo) centreOn(flyTo.id);
+  }, [flyTo, centreOn]);
+
+  const isLitLink = useCallback(
+    (link: CanvasLink) =>
+      !lit ||
+      (lit.has(endpointId(link.source)) && lit.has(endpointId(link.target))),
+    [lit],
+  );
+
+  const drawNode = useCallback(
+    (raw: object, ctx: CanvasRenderingContext2D, scale: number) => {
+      const node = raw as CanvasNode;
+      const isAnchor = node.id === focusId || node.id === selectedId;
+      const radius = nodeRadius(node, node.id === focusId) * STAMP_SCALE;
+      const x = node.x || 0;
+      const y = node.y || 0;
+
+      ctx.globalAlpha = !lit || lit.has(node.id) ? 1 : DIM_ALPHA;
+      if (isAnchor || node.id === hoverId) {
+        paintHalo(
+          ctx,
+          x,
+          y,
+          radius * 1.55,
+          rgba(palette.primary, isAnchor ? 1 : 0.55),
+          Math.max(1.2 / scale, radius * 0.14),
+        );
+      }
+      paintStamp(
+        ctx,
+        node,
+        x,
+        y,
+        radius,
+        {
+          fill: nodeColour(node, colourMode, palette),
+          edge: rgba(palette.background),
+          mark: rgba(palette.background),
+        },
+        radius * scale >= GLYPH_MIN_PX,
+      );
+      ctx.globalAlpha = 1;
+    },
+    [focusId, selectedId, hoverId, lit, colourMode, palette],
+  );
+
+  const labelOrder = useMemo(() => {
+    const rank = (node: CanvasNode) => {
+      if (node.id === hoverId) return 0;
+      if (node.id === selectedId || node.id === focusId) return 1;
+      if (lit?.has(node.id)) return 2;
+      if (!lit && hubs.has(node.id)) return 3;
+      return -1;
+    };
+    return graphData.nodes
+      .map((node) => ({ node, rank: rank(node) }))
+      .filter((entry) => entry.rank >= 0)
+      .sort((a, b) => a.rank - b.rank || b.node.degree - a.node.degree)
+      .map((entry) => entry.node);
+  }, [graphData.nodes, hoverId, selectedId, focusId, lit, hubs]);
+
+  const drawLabels = useCallback(
+    (ctx: CanvasRenderingContext2D, scale: number) => {
+      const taken: Box[] = [];
+      const font = LABEL_FONT_PX / scale;
+      const pad = LABEL_PAD_PX / scale;
+      ctx.font = `600 ${font}px Inter, system-ui, sans-serif`;
+      ctx.textAlign = "center";
+      ctx.textBaseline = "middle";
+
+      labelOrder.forEach((node) => {
+        const text = _clip(node.title);
+        const width = ctx.measureText(text).width + pad * 2;
+        const height = font + pad * 1.4;
+        const x = node.x || 0;
+        const top = (node.y || 0) + nodeRadius(node, node.id === focusId) * STAMP_SCALE * 1.7 + 2 / scale;
+        const box = { left: x - width / 2, top, right: x + width / 2, bottom: top + height };
+        if (taken.some((other) => _overlaps(box, other))) return;
+        taken.push(box);
+
+        ctx.beginPath();
+        ctx.roundRect(box.left, box.top, width, height, height / 2);
+        ctx.fillStyle = rgba(palette.card);
+        ctx.fill();
+        ctx.lineWidth = 1 / scale;
+        ctx.strokeStyle = rgba(palette.border);
+        ctx.stroke();
+        ctx.fillStyle = rgba(palette.foreground);
+        ctx.fillText(text, x, box.top + height / 2);
+      });
+    },
+    [labelOrder, focusId, palette],
+  );
+
+  const paintHitArea = useCallback(
+    (raw: object, colour: string, ctx: CanvasRenderingContext2D) => {
+      const node = raw as CanvasNode;
+      ctx.fillStyle = colour;
+      ctx.beginPath();
+      ctx.arc(
+        node.x || 0,
+        node.y || 0,
+        Math.max(6, nodeRadius(node, false)),
+        0,
+        2 * Math.PI,
+      );
+      ctx.fill();
+    },
+    [],
+  );
+
+  return (
+    <div
+      ref={containerRef}
+      className="absolute inset-0"
+      onPointerDownCapture={onPointerDown}
+      onPointerUpCapture={onPointerUp}
+    >
+      {size.width > 0 && (
+        <ForceGraph2D
+          ref={graphRef}
+          width={size.width}
+          height={size.height}
+          graphData={graphData}
+          nodeId="id"
+          nodeLabel={() => ""}
+          nodeCanvasObject={drawNode}
+          onRenderFramePost={drawLabels}
+          nodePointerAreaPaint={paintHitArea}
+          linkColor={(link) =>
+            edgeColour(
+              link as CanvasLink,
+              palette,
+              isLitLink(link as CanvasLink),
+            )
+          }
+          linkWidth={(link) =>
+            lit && isLitLink(link as CanvasLink) ? 1.6 : 0.6
+          }
+          linkVisibility={(link) => {
+            const canvasLink = link as CanvasLink;
+            if (canvasLink.kind !== BrainEdgeKinds.SUGGESTED) return true;
+            return Boolean(anchor) &&
+              (endpointId(canvasLink.source) === anchor || endpointId(canvasLink.target) === anchor);
+          }}
+          linkLineDash={(link) =>
+            (link as CanvasLink).kind === BrainEdgeKinds.SUGGESTED
+              ? [3, 3]
+              : null
+          }
+          linkDirectionalParticles={(link) =>
+            lit &&
+            isLitLink(link as CanvasLink) &&
+            (link as CanvasLink).kind !== BrainEdgeKinds.TAG
+              ? 3
+              : 0
+          }
+          linkDirectionalParticleWidth={2}
+          linkDirectionalParticleColor={() => rgba(palette.primary, 0.95)}
+          onNodeHover={(node) => {
+            hoverRef.current = (node as CanvasNode | null) || null;
+            setHoverId(hoverRef.current?.id || null);
+          }}
+          onNodeRightClick={(node) => onOpen(node as CanvasNode)}
+          onEngineStop={() => {
+            if (settledRef.current) return;
+            settledRef.current = true;
+            if (focusId) centreOn(focusId);
+            else graphRef.current?.zoomToFit(600, FIT_PADDING);
+          }}
+          cooldownTicks={120}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainInspector.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainInspector.tsx
new file mode 100644
index 000000000..dede5d182
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainInspector.tsx
@@ -0,0 +1,187 @@
+"use client";
+
+import { useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
+import {
+  CheckmarkSquare04Icon,
+  File02Icon,
+  FileAddIcon,
+  Link01Icon,
+  Tag01Icon,
+  Cancel01Icon,
+} from "hugeicons-react";
+import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
+import { BrainEdgeKinds, BrainNodeKinds } from "@/app/_consts/relations";
+import type { BrainEdge, BrainNode } from "@/app/_types/relations";
+
+interface BrainInspectorProps {
+  node: BrainNode | null;
+  nodes: Map<string, BrainNode>;
+  edges: BrainEdge[];
+  canEdit: boolean;
+  onPick: (id: string) => void;
+  onOpen: (node: BrainNode) => void;
+  onConnect: (source: BrainNode, target: BrainNode) => Promise<void>;
+  onClose: () => void;
+}
+
+const KindIcon = ({ node }: { node: BrainNode }) => {
+  if (node.kind === BrainNodeKinds.CHECKLIST)
+    return <CheckmarkSquare04Icon className="h-4 w-4 shrink-0" />;
+  if (node.kind === BrainNodeKinds.TAG)
+    return <Tag01Icon className="h-4 w-4 shrink-0" />;
+  if (node.kind === BrainNodeKinds.GHOST)
+    return <FileAddIcon className="h-4 w-4 shrink-0" />;
+  return <File02Icon className="h-4 w-4 shrink-0" />;
+};
+
+interface Neighbour {
+  node: BrainNode;
+  edge: BrainEdge;
+  outgoing: boolean;
+}
+
+export const BrainInspector = ({
+  node,
+  nodes,
+  edges,
+  canEdit,
+  onPick,
+  onOpen,
+  onConnect,
+  onClose,
+}: BrainInspectorProps) => {
+  const t = useTranslations();
+  const [connecting, setConnecting] = useState<string | null>(null);
+
+  const neighbours = useMemo(() => {
+    if (!node) return [] as Neighbour[];
+    return edges
+      .filter((edge) => edge.source === node.id || edge.target === node.id)
+      .map((edge) => {
+        const outgoing = edge.source === node.id;
+        const other = nodes.get(outgoing ? edge.target : edge.source);
+        return other ? { node: other, edge, outgoing } : null;
+      })
+      .filter((entry): entry is Neighbour => entry !== null);
+  }, [node, nodes, edges]);
+
+  if (!node) return null;
+
+  const suggested = neighbours
+    .filter((entry) => entry.edge.kind === BrainEdgeKinds.SUGGESTED)
+    .sort((a, b) => b.edge.weight - a.edge.weight);
+  const outgoing = neighbours.filter(
+    (entry) => entry.outgoing && entry.edge.kind !== BrainEdgeKinds.SUGGESTED,
+  );
+  const incoming = neighbours.filter(
+    (entry) => !entry.outgoing && entry.edge.kind !== BrainEdgeKinds.SUGGESTED,
+  );
+  const openable =
+    node.kind === BrainNodeKinds.NOTE || node.kind === BrainNodeKinds.CHECKLIST;
+
+  const connect = async (other: BrainNode) => {
+    const [source, target] =
+      node.kind === BrainNodeKinds.NOTE ? [node, other] : [other, node];
+    setConnecting(other.id);
+    try {
+      await onConnect(source, target);
+    } finally {
+      setConnecting(null);
+    }
+  };
+
+  const canConnect = (other: BrainNode) =>
+    canEdit &&
+    (node.kind === BrainNodeKinds.NOTE || other.kind === BrainNodeKinds.NOTE);
+
+  const section = (title: string, entries: Neighbour[], action = false) =>
+    entries.length === 0 ? null : (
+      <div className="space-y-1.5">
+        <div className="text-md lg:text-xs uppercase tracking-wide text-muted-foreground">
+          {title} ({entries.length})
+        </div>
+        {entries.map(({ node: other, edge }) => (
+          <div
+            key={`${edge.kind}-${other.id}`}
+            className="flex items-center gap-1.5"
+          >
+            <button
+              type="button"
+              onClick={() => onPick(other.id)}
+              className="flex min-w-0 flex-1 items-center gap-2 rounded-jotty border border-border px-2.5 py-2 text-left text-md lg:text-sm transition-colors hover:bg-accent"
+            >
+              <KindIcon node={other} />
+              <span className="min-w-0 truncate">{other.title}</span>
+              {action && (
+                <span className="ml-auto shrink-0 text-md lg:text-xs text-muted-foreground">
+                  {Math.round(edge.weight * 100)}%
+                </span>
+              )}
+            </button>
+            {action && canConnect(other) && (
+              <Button
+                variant="outline"
+                size="icon"
+                className="h-9 w-9 shrink-0"
+                disabled={connecting === other.id}
+                onClick={() => connect(other)}
+                title={t("brain.promote", { title: other.title })}
+                aria-label={t("brain.promote", { title: other.title })}
+              >
+                <Link01Icon className="h-4 w-4" />
+              </Button>
+            )}
+          </div>
+        ))}
+      </div>
+    );
+
+  return (
+    <aside className="flex max-h-full flex-col gap-4 overflow-y-auto rounded-jotty border border-border bg-card p-4 jotty-scrollable-content">
+      <div className="flex items-start gap-2">
+        <div className="min-w-0 flex-1">
+          <div className="flex items-center gap-1.5 text-md lg:text-xs uppercase tracking-wide text-muted-foreground">
+            <KindIcon node={node} />
+            {t(`brain.kind.${node.kind}`)}
+          </div>
+          <h2 className="break-words text-lg font-semibold text-foreground">
+            {node.title}
+          </h2>
+          {node.category && (
+            <p className="text-md lg:text-sm text-muted-foreground">
+              {node.category}
+            </p>
+          )}
+        </div>
+        <Button
+          variant="ghost"
+          size="icon"
+          className="h-8 w-8"
+          onClick={onClose}
+          aria-label={t("common.close")}
+        >
+          <Cancel01Icon className="h-4 w-4" />
+        </Button>
+      </div>
+
+      {section(t("brain.linksTo"), outgoing)}
+      {section(t("brain.linkedFrom"), incoming)}
+      {section(t("brain.suggested"), suggested, true)}
+
+      {neighbours.length === 0 && (
+        <p className="text-md lg:text-sm text-muted-foreground">
+          {t("brain.lonely")}
+        </p>
+      )}
+
+      <Button onClick={() => onOpen(node)} className="w-full">
+        {openable
+          ? t("brain.open")
+          : node.kind === BrainNodeKinds.GHOST
+            ? t("brain.createGhost")
+            : t("brain.openTag")}
+      </Button>
+    </aside>
+  );
+};
diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainLegend.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainLegend.tsx
new file mode 100644
index 000000000..6234992d0
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainLegend.tsx
@@ -0,0 +1,61 @@
+"use client";
+
+import { useTranslations } from "next-intl";
+import { BrainEdgeKinds, BrainNodeKinds } from "@/app/_consts/relations";
+import type { BrainGraph } from "@/app/_types/relations";
+import { BrainPalette, edgeColour } from "../utils/brain-graph";
+
+interface BrainLegendProps {
+  graph: BrainGraph;
+  palette: BrainPalette;
+  shown: number;
+  owner: string | null;
+}
+
+const SWATCHES = [
+  BrainEdgeKinds.MENTION,
+  BrainEdgeKinds.WIKI,
+  BrainEdgeKinds.SUGGESTED,
+  BrainEdgeKinds.TAG,
+];
+
+export const BrainLegend = ({ graph, palette, shown, owner }: BrainLegendProps) => {
+  const t = useTranslations();
+  const items = graph.nodes.filter(
+    (node) =>
+      node.kind === BrainNodeKinds.NOTE ||
+      node.kind === BrainNodeKinds.CHECKLIST,
+  ).length;
+  const links = graph.edges.filter(
+    (edge) =>
+      edge.kind === BrainEdgeKinds.MENTION || edge.kind === BrainEdgeKinds.WIKI,
+  ).length;
+
+  return (
+    <div className="pointer-events-none absolute bottom-3 left-3 z-10 hidden rounded-jotty border border-border bg-card px-3 py-2 text-md lg:block lg:text-xs text-muted-foreground">
+      {owner && (
+        <div className="font-medium text-foreground">
+          {t("brain.viewingOwner", { owner })}
+        </div>
+      )}
+      <div>{t("brain.summary", { items, links, shown })}</div>
+      <div className="mt-1 flex flex-wrap gap-3">
+        {SWATCHES.map((kind) => (
+          <span key={kind} className="flex items-center gap-1.5">
+            <span
+              className="h-1.5 w-4 rounded-full"
+              style={{
+                backgroundColor: edgeColour(
+                  { source: "", target: "", kind, weight: 1 },
+                  palette,
+                  true,
+                ),
+              }}
+            />
+            {t(`brain.edges.${kind}`)}
+          </span>
+        ))}
+      </div>
+    </div>
+  );
+};
diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx
new file mode 100644
index 000000000..c00b156a6
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx
@@ -0,0 +1,449 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import ForceGraph3D, { ForceGraphMethods, LinkObject, NodeObject } from "react-force-graph-3d";
+import type { OrbitControls } from "three/examples/jsm/controls/OrbitControls.js";
+import { BrainEdgeKinds } from "@/app/_consts/relations";
+import type { BrainEdge, BrainNode } from "@/app/_types/relations";
+import {
+  endpointId,
+  hex,
+  isItemNode,
+  neighbourMap,
+  nodeRadius,
+  nodeRgb,
+  rgba,
+  solidEdgeColour,
+} from "../utils/brain-graph";
+import {
+  disposeParts,
+  forgetStamps,
+  LABEL_PIXEL_SHARE,
+  NodeParts,
+  nodeParts,
+  PartColours,
+  pickNode,
+  recolourParts,
+  tweenParts,
+} from "../utils/brain-three";
+import { BrainCanvasProps } from "../utils/brain-canvas";
+import { useElementSize } from "../hooks/useElementSize";
+import { collideForce, gravityForce, regionForce, spreadRadius } from "../utils/brain-forces";
+
+type CanvasNode = NodeObject<BrainNode> & BrainNode;
+type CanvasLink = LinkObject<BrainNode, BrainEdge> & BrainEdge;
+type GraphRef = ForceGraphMethods<CanvasNode, CanvasLink>;
+
+const TRANSPARENT = "rgba(0,0,0,0)";
+const DOUBLE_CLICK_MS = 350;
+const CLICK_SLOP_PX = 6;
+const CLICK_MAX_MS = 450;
+const PAN_MS = 700;
+const FRAME_MS = 900;
+const FOCUS_DISTANCE = 110;
+const MIN_FRAME_DISTANCE = 140;
+const MAX_FRAME_DISTANCE = 1600;
+const FRAME_SCALE = 2.3;
+const SAFE_ZONE = 0.28;
+const IDLE_ROTATE_MS = 25_000;
+const AUTO_ROTATE_SPEED = 0.35;
+const HUB_LABEL_SHARE = 8;
+const MAX_HUB_LABELS = 8;
+const CHARGE = -150;
+const CHARGE_REACH = 600;
+const LINK_DISTANCE = 58;
+const REGION_PULL = 0.05;
+const GRAVITY = 0.008;
+const PERSONAL_SPACE = 7;
+const DECLUTTER_EVERY = 6;
+const LABEL_GAP_PX = 4;
+
+const noLabel = () => "";
+const orbitProps = { controlType: "orbit" } as Record<string, unknown>;
+
+export default function BrainScene3D({
+  nodes,
+  edges,
+  focusId,
+  selectedId,
+  colourMode,
+  palette,
+  flyTo,
+  onSelect,
+  onOpen,
+}: BrainCanvasProps) {
+  const graphRef = useRef<GraphRef | undefined>(undefined);
+  const partsRef = useRef(new Map<string, NodeParts>());
+  const framedRef = useRef(false);
+  const lastClickRef = useRef({ id: "", at: 0 });
+  const idleTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const { ref: containerRef, size } = useElementSize<HTMLDivElement>();
+  const [hoverId, setHoverId] = useState<string | null>(null);
+
+  const graphData = useMemo(
+    () => ({
+      nodes: nodes.map((node) => ({ ...node })) as CanvasNode[],
+      links: edges.map((edge) => ({ ...edge })) as CanvasLink[],
+    }),
+    [nodes, edges],
+  );
+
+  const neighbours = useMemo(() => neighbourMap(edges, true), [edges]);
+  const hubs = useMemo(() => {
+    const count = Math.min(MAX_HUB_LABELS, Math.ceil(nodes.length / HUB_LABEL_SHARE));
+    return new Set(
+      nodes
+        .filter(isItemNode)
+        .sort((a, b) => b.degree - a.degree)
+        .slice(0, count)
+        .map((node) => node.id),
+    );
+  }, [nodes]);
+
+  const anchor = hoverId || selectedId || focusId;
+  const lit = useMemo(
+    () => (anchor ? new Set([anchor, ...Array.from(neighbours.get(anchor) || [])]) : null),
+    [anchor, neighbours],
+  );
+
+  const aim = useCallback(
+    (parts: NodeParts, id: string) => {
+      const chosen = id === selectedId || id === focusId;
+      const shown = !lit || lit.has(id);
+      parts.target.body = shown ? 1 : 0.16;
+      parts.target.ring = chosen ? 0.9 : id === hoverId ? 0.45 : 0;
+      parts.target.label =
+        shown && (chosen || id === hoverId || Boolean(lit) || hubs.has(id)) ? 1 : 0;
+    },
+    [selectedId, focusId, hoverId, lit, hubs],
+  );
+  const aimRef = useRef(aim);
+  aimRef.current = aim;
+
+  useEffect(() => {
+    partsRef.current.forEach(aim);
+  }, [aim]);
+
+  const nodeByIdRef = useRef(new Map<string, CanvasNode>());
+  nodeByIdRef.current = new Map(graphData.nodes.map((node) => [node.id, node]));
+  const priorityRef = useRef<(id: string) => number>(() => 0);
+  priorityRef.current = (id: string) => {
+    if (id === hoverId) return 0;
+    if (id === selectedId || id === focusId) return 1;
+    return 2;
+  };
+
+  const declutter = useCallback(() => {
+    const graph = graphRef.current;
+    const container = containerRef.current;
+    if (!graph || !container) return;
+    const height = container.clientHeight * LABEL_PIXEL_SHARE;
+    const wanted: { parts: NodeParts; node: CanvasNode; x: number; y: number }[] = [];
+
+    partsRef.current.forEach((parts, id) => {
+      const node = nodeByIdRef.current.get(id);
+      if (!node || parts.target.label === 0 || node.x === undefined) {
+        parts.crowded = false;
+        return;
+      }
+      const screen = graph.graph2ScreenCoords(node.x || 0, node.y || 0, node.z || 0);
+      wanted.push({ parts, node, x: screen.x, y: screen.y });
+    });
+
+    wanted.sort(
+      (a, b) =>
+        priorityRef.current(a.node.id) - priorityRef.current(b.node.id) ||
+        b.node.degree - a.node.degree,
+    );
+
+    const taken: { left: number; right: number; top: number; bottom: number }[] = [];
+    wanted.forEach(({ parts, x, y }) => {
+      const width = height * parts.labelAspect;
+      const box = {
+        left: x - width / 2 - LABEL_GAP_PX,
+        right: x + width / 2 + LABEL_GAP_PX,
+        top: y - height * 1.6,
+        bottom: y - height * 0.2,
+      };
+      parts.crowded = taken.some(
+        (other) =>
+          box.left < other.right && other.left < box.right && box.top < other.bottom && other.top < box.bottom,
+      );
+      if (!parts.crowded) taken.push(box);
+    });
+  }, [containerRef]);
+  const declutterRef = useRef(declutter);
+  declutterRef.current = declutter;
+
+  useEffect(() => {
+    let frame = 0;
+    let tick = 0;
+    const step = () => {
+      tick = (tick + 1) % DECLUTTER_EVERY;
+      if (tick === 0) declutterRef.current();
+      partsRef.current.forEach(tweenParts);
+      frame = requestAnimationFrame(step);
+    };
+    frame = requestAnimationFrame(step);
+    const parts = partsRef.current;
+    return () => {
+      cancelAnimationFrame(frame);
+      parts.forEach(disposeParts);
+      parts.clear();
+      forgetStamps();
+    };
+  }, []);
+
+  const controls = () => graphRef.current?.controls() as OrbitControls | undefined;
+
+  const pauseRotation = useCallback(() => {
+    const orbit = controls();
+    if (orbit) orbit.autoRotate = false;
+    if (idleTimerRef.current) clearTimeout(idleTimerRef.current);
+    idleTimerRef.current = setTimeout(() => {
+      const idle = controls();
+      if (idle) idle.autoRotate = true;
+    }, IDLE_ROTATE_MS);
+  }, []);
+
+  useEffect(() => {
+    const orbit = controls();
+    if (!orbit) return;
+    orbit.enableDamping = true;
+    orbit.dampingFactor = 0.12;
+    orbit.autoRotateSpeed = AUTO_ROTATE_SPEED;
+    orbit.addEventListener("start", pauseRotation);
+    return () => {
+      orbit.removeEventListener("start", pauseRotation);
+      if (idleTimerRef.current) clearTimeout(idleTimerRef.current);
+    };
+  }, [size.width, pauseRotation]);
+
+  useEffect(() => {
+    const graph = graphRef.current;
+    if (!graph) return;
+    graph.d3Force("charge")?.strength?.(CHARGE)?.distanceMax?.(CHARGE_REACH);
+    graph.d3Force("link")?.distance?.(LINK_DISTANCE);
+    graph.d3Force(
+      "collide",
+      collideForce((node) => nodeRadius(node, false) + PERSONAL_SPACE),
+    );
+    graph.d3Force("region", regionForce(REGION_PULL));
+    graph.d3Force("gravity", gravityForce(GRAVITY));
+  }, [size.width, graphData]);
+
+  const focusCamera = useCallback(
+    (id: string, closeUp: boolean) => {
+      const graph = graphRef.current;
+      const orbit = controls();
+      const node = graphData.nodes.find((candidate) => candidate.id === id);
+      if (!graph || !orbit || !node || node.x === undefined) return;
+
+      const point = { x: node.x || 0, y: node.y || 0, z: node.z || 0 };
+      const offset = graph.camera().position.clone().sub(orbit.target);
+
+      if (closeUp) {
+        offset.setLength(FOCUS_DISTANCE);
+      } else {
+        const screen = graph.graph2ScreenCoords(point.x, point.y, point.z);
+        const dx = Math.abs(screen.x / size.width - 0.5);
+        const dy = Math.abs(screen.y / size.height - 0.5);
+        if (dx < SAFE_ZONE && dy < SAFE_ZONE) return;
+      }
+
+      pauseRotation();
+      graph.cameraPosition(
+        { x: point.x + offset.x, y: point.y + offset.y, z: point.z + offset.z },
+        point,
+        PAN_MS,
+      );
+    },
+    [graphData.nodes, size.width, size.height, pauseRotation],
+  );
+
+  useEffect(() => {
+    if (flyTo) focusCamera(flyTo.id, true);
+  }, [flyTo, focusCamera]);
+
+  const frameGraph = useCallback(() => {
+    const graph = graphRef.current;
+    if (!graph) return;
+    const radius = spreadRadius(graphData.nodes);
+    const distance = Math.min(
+      MAX_FRAME_DISTANCE,
+      Math.max(MIN_FRAME_DISTANCE, radius * FRAME_SCALE),
+    );
+    graph.cameraPosition({ x: 0, y: 0, z: distance }, { x: 0, y: 0, z: 0 }, FRAME_MS);
+    const orbit = controls();
+    if (orbit) orbit.autoRotate = true;
+  }, [graphData.nodes]);
+
+  const coloursFor = useCallback(
+    (node: BrainNode): PartColours => ({
+      body: hex(nodeRgb(node, colourMode, palette)),
+      halo: rgba(palette.primary),
+      edge: rgba(palette.background),
+      mark: rgba(palette.background),
+      ink: rgba(palette.foreground),
+      paper: rgba(palette.card),
+      border: rgba(palette.border),
+    }),
+    [colourMode, palette],
+  );
+  const coloursRef = useRef(coloursFor);
+  coloursRef.current = coloursFor;
+  const focusRef = useRef(focusId);
+  focusRef.current = focusId;
+
+  const buildNode = useCallback((raw: object) => {
+    const node = raw as CanvasNode;
+    const previous = partsRef.current.get(node.id);
+    if (previous) disposeParts(previous);
+    const parts = nodeParts(
+      node,
+      nodeRadius(node, node.id === focusRef.current),
+      coloursRef.current(node),
+    );
+    aimRef.current(parts, node.id);
+    partsRef.current.set(node.id, parts);
+    return parts.group;
+  }, []);
+
+  useEffect(() => {
+    graphData.nodes.forEach((node) => {
+      const parts = partsRef.current.get(node.id);
+      if (parts) recolourParts(parts, node, coloursFor(node));
+    });
+  }, [coloursFor, graphData.nodes]);
+
+  const touches = useCallback(
+    (link: CanvasLink) =>
+      Boolean(anchor) &&
+      (endpointId(link.source) === anchor || endpointId(link.target) === anchor),
+    [anchor],
+  );
+
+  const linkColour = useCallback(
+    (link: object) => {
+      const canvasLink = link as CanvasLink;
+      if (!lit) return solidEdgeColour(canvasLink, palette, 0.35);
+      return solidEdgeColour(canvasLink, palette, touches(canvasLink) ? 0 : 0.85);
+    },
+    [lit, palette, touches],
+  );
+
+  const linkWidth = useCallback(
+    (link: object) => (touches(link as CanvasLink) ? 0.9 : 0),
+    [touches],
+  );
+
+  const linkShown = useCallback(
+    (link: object) => {
+      const canvasLink = link as CanvasLink;
+      return canvasLink.kind !== BrainEdgeKinds.SUGGESTED || touches(canvasLink);
+    },
+    [touches],
+  );
+
+  const particles = useCallback(
+    (link: object) => {
+      const canvasLink = link as CanvasLink;
+      return touches(canvasLink) && canvasLink.kind !== BrainEdgeKinds.TAG ? 2 : 0;
+    },
+    [touches],
+  );
+
+  const particleColour = useCallback(() => rgba(palette.primary), [palette]);
+
+  const pressRef = useRef<{ x: number; y: number; at: number } | null>(null);
+
+  const handleClick = useCallback(
+    (node: CanvasNode) => {
+      const now = Date.now();
+      const last = lastClickRef.current;
+      lastClickRef.current = { id: node.id, at: now };
+      if (last.id === node.id && now - last.at < DOUBLE_CLICK_MS) {
+        onOpen(node);
+        return;
+      }
+      onSelect(node.id);
+      focusCamera(node.id, false);
+    },
+    [onOpen, onSelect, focusCamera],
+  );
+
+  const onPointerDown = (event: React.PointerEvent) => {
+    pressRef.current = { x: event.clientX, y: event.clientY, at: Date.now() };
+  };
+
+  const onPointerUp = (event: React.PointerEvent) => {
+    const press = pressRef.current;
+    pressRef.current = null;
+    const graph = graphRef.current;
+    const container = containerRef.current;
+    if (!press || !graph || !container || event.button !== 0) return;
+    const moved = Math.hypot(event.clientX - press.x, event.clientY - press.y);
+    if (moved > CLICK_SLOP_PX || Date.now() - press.at > CLICK_MAX_MS) return;
+
+    const rect = container.getBoundingClientRect();
+    const id = pickNode(
+      partsRef.current,
+      graph.camera(),
+      ((event.clientX - rect.left) / rect.width) * 2 - 1,
+      -((event.clientY - rect.top) / rect.height) * 2 + 1,
+    );
+    const node = id ? graphData.nodes.find((candidate) => candidate.id === id) : null;
+    if (node) handleClick(node);
+    else onSelect(null);
+  };
+
+  return (
+    <div
+      ref={containerRef}
+      className="absolute inset-0"
+      onPointerDownCapture={onPointerDown}
+      onPointerUpCapture={onPointerUp}
+      onPointerMove={pauseRotation}
+    >
+      {size.width > 0 && (
+        <ForceGraph3D
+          {...orbitProps}
+          ref={graphRef}
+          width={size.width}
+          height={size.height}
+          graphData={graphData}
+          backgroundColor={TRANSPARENT}
+          showNavInfo={false}
+          nodeId="id"
+          nodeLabel={noLabel}
+          nodeThreeObject={buildNode}
+          linkColor={linkColour}
+          linkOpacity={0.85}
+          linkWidth={linkWidth}
+          linkVisibility={linkShown}
+          linkCurvature={(link) =>
+            (link as CanvasLink).kind === BrainEdgeKinds.SUGGESTED ? 0.25 : 0
+          }
+          linkDirectionalParticles={particles}
+          linkDirectionalParticleWidth={1.3}
+          linkDirectionalParticleSpeed={0.006}
+          linkDirectionalParticleColor={particleColour}
+          enableNodeDrag={false}
+          onNodeHover={(node) => {
+            setHoverId((node as CanvasNode | null)?.id || null);
+            if (node) pauseRotation();
+          }}
+          onNodeRightClick={(node) => onOpen(node as CanvasNode)}
+          onEngineStop={() => {
+            if (framedRef.current) return;
+            framedRef.current = true;
+            if (focusId) focusCamera(focusId, true);
+            else frameGraph();
+          }}
+          warmupTicks={60}
+          cooldownTicks={160}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainToolbar.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainToolbar.tsx
new file mode 100644
index 000000000..663e37d04
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainToolbar.tsx
@@ -0,0 +1,199 @@
+"use client";
+
+import { useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
+import {
+  CubeIcon,
+  GridViewIcon,
+  Search01Icon,
+  Target02Icon,
+} from "hugeicons-react";
+import type { BrainNode } from "@/app/_types/relations";
+import {
+  BrainColourModes,
+  BrainDimensions,
+  BrainFilters,
+  BrainScope,
+  MAX_DEPTH,
+  searchNodes,
+} from "../utils/brain-graph";
+
+interface BrainToolbarProps {
+  nodes: BrainNode[];
+  dimension: BrainDimensions;
+  scope: BrainScope;
+  filters: BrainFilters;
+  colourMode: BrainColourModes;
+  hasFocus: boolean;
+  webglReady: boolean;
+  onDimension: (dimension: BrainDimensions) => void;
+  onScope: (scope: BrainScope) => void;
+  onFilters: (filters: BrainFilters) => void;
+  onColourMode: (mode: BrainColourModes) => void;
+  onFind: (node: BrainNode) => void;
+}
+
+const FILTER_KEYS: Array<keyof BrainFilters> = [
+  "notes",
+  "checklists",
+  "tags",
+  "ghosts",
+  "suggestions",
+  "orphans",
+];
+
+const chip = (active: boolean) =>
+  `rounded-full border px-3 py-1 text-md lg:text-xs transition-colors ${
+    active
+      ? "border-primary bg-primary text-primary-foreground"
+      : "border-border bg-background text-muted-foreground hover:text-foreground"
+  }`;
+
+export const BrainToolbar = ({
+  nodes,
+  dimension,
+  scope,
+  filters,
+  colourMode,
+  hasFocus,
+  webglReady,
+  onDimension,
+  onScope,
+  onFilters,
+  onColourMode,
+  onFind,
+}: BrainToolbarProps) => {
+  const t = useTranslations();
+  const [query, setQuery] = useState("");
+  const matches = useMemo(() => searchNodes(nodes, query), [nodes, query]);
+
+  return (
+    <div className="pointer-events-auto flex flex-col gap-2 rounded-jotty border border-border bg-card p-3">
+      <div className="flex flex-wrap items-center gap-2">
+        <div className="relative min-w-[180px] flex-1">
+          <Search01Icon className="pointer-events-none absolute left-2.5 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" />
+          <input
+            value={query}
+            onChange={(event) => setQuery(event.target.value)}
+            onKeyDown={(event) => {
+              if (event.key === "Enter" && matches[0]) {
+                onFind(matches[0]);
+                setQuery("");
+              }
+            }}
+            placeholder={t("brain.search")}
+            aria-label={t("brain.search")}
+            className="h-10 w-full rounded-jotty border border-input bg-background pl-8 pr-3 text-md lg:text-sm focus:outline-none focus:ring-2 focus:ring-ring"
+          />
+          {matches.length > 0 && (
+            <ul className="absolute left-0 right-0 top-full z-20 mt-1 max-h-64 overflow-y-auto rounded-jotty border border-border bg-card">
+              {matches.map((node) => (
+                <li key={node.id}>
+                  <button
+                    type="button"
+                    onClick={() => {
+                      onFind(node);
+                      setQuery("");
+                    }}
+                    className="block w-full truncate px-3 py-2 text-left text-md lg:text-sm hover:bg-accent"
+                  >
+                    {node.title}
+                  </button>
+                </li>
+              ))}
+            </ul>
+          )}
+        </div>
+
+        <div
+          className="flex overflow-hidden rounded-jotty border border-border"
+          role="group"
+          aria-label={t("brain.dimension")}
+        >
+          {[BrainDimensions.THREE_D, BrainDimensions.TWO_D].map((option) => (
+            <button
+              key={option}
+              type="button"
+              disabled={option === BrainDimensions.THREE_D && !webglReady}
+              onClick={() => onDimension(option)}
+              aria-pressed={dimension === option}
+              className={`flex h-10 items-center gap-1.5 px-3 text-md lg:text-sm disabled:opacity-40 ${
+                dimension === option
+                  ? "bg-primary text-primary-foreground"
+                  : "bg-background hover:bg-accent"
+              }`}
+            >
+              {option === BrainDimensions.THREE_D ? (
+                <CubeIcon className="h-4 w-4" />
+              ) : (
+                <GridViewIcon className="h-4 w-4" />
+              )}
+              {t(`brain.dimensions.${option}`)}
+            </button>
+          ))}
+        </div>
+
+        {hasFocus && (
+          <button
+            type="button"
+            onClick={() => onScope({ ...scope, local: !scope.local })}
+            aria-pressed={scope.local}
+            className={`flex h-10 items-center gap-1.5 rounded-jotty border px-3 text-md lg:text-sm disabled:opacity-40 ${
+              scope.local
+                ? "border-primary bg-primary text-primary-foreground"
+                : "border-border bg-background hover:bg-accent"
+            }`}
+          >
+            <Target02Icon className="h-4 w-4" />
+            {scope.local ? t("brain.local") : t("brain.global")}
+          </button>
+        )}
+
+        {scope.local && hasFocus && (
+          <label className="flex items-center gap-2 text-md lg:text-sm text-muted-foreground">
+            {t("brain.depth", { depth: scope.depth })}
+            <input
+              type="range"
+              min={1}
+              max={MAX_DEPTH}
+              value={scope.depth}
+              onChange={(event) =>
+                onScope({ ...scope, depth: Number(event.target.value) })
+              }
+              className="accent-primary"
+            />
+          </label>
+        )}
+
+        <select
+          value={colourMode}
+          onChange={(event) =>
+            onColourMode(event.target.value as BrainColourModes)
+          }
+          aria-label={t("brain.colourBy")}
+          className="h-10 rounded-jotty border border-input bg-background px-2 text-md lg:text-sm"
+        >
+          {Object.values(BrainColourModes).map((mode) => (
+            <option key={mode} value={mode}>
+              {t(`brain.colourModes.${mode}`)}
+            </option>
+          ))}
+        </select>
+      </div>
+
+      <div className="flex flex-wrap gap-1.5">
+        {FILTER_KEYS.map((key) => (
+          <button
+            key={key}
+            type="button"
+            aria-pressed={filters[key]}
+            onClick={() => onFilters({ ...filters, [key]: !filters[key] })}
+            className={chip(filters[key])}
+          >
+            {t(`brain.filters.${key}`)}
+          </button>
+        ))}
+      </div>
+    </div>
+  );
+};
diff --git a/app/_components/FeatureComponents/Brain/hooks/useBrainPalette.ts b/app/_components/FeatureComponents/Brain/hooks/useBrainPalette.ts
new file mode 100644
index 000000000..909b49c92
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/hooks/useBrainPalette.ts
@@ -0,0 +1,56 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import type { BrainPalette, Rgb } from "../utils/brain-graph";
+
+const FALLBACK: BrainPalette = {
+  primary: [139, 59, 208],
+  foreground: [15, 23, 42],
+  muted: [100, 116, 139],
+  background: [255, 255, 255],
+  card: [255, 255, 255],
+  border: [226, 232, 240],
+};
+
+const _triple = (
+  styles: CSSStyleDeclaration,
+  name: string,
+  fallback: Rgb,
+): Rgb => {
+  const parts = styles
+    .getPropertyValue(name)
+    .trim()
+    .split(/[\s,]+/)
+    .map(Number)
+    .filter((value) => Number.isFinite(value));
+  return parts.length >= 3 ? [parts[0], parts[1], parts[2]] : fallback;
+};
+
+const _read = (): BrainPalette => {
+  const styles = getComputedStyle(document.documentElement);
+  return {
+    primary: _triple(styles, "--primary", FALLBACK.primary),
+    foreground: _triple(styles, "--foreground", FALLBACK.foreground),
+    muted: _triple(styles, "--muted-foreground", FALLBACK.muted),
+    background: _triple(styles, "--background", FALLBACK.background),
+    card: _triple(styles, "--card", FALLBACK.card),
+    border: _triple(styles, "--border", FALLBACK.border),
+  };
+};
+
+export const useBrainPalette = (): BrainPalette => {
+  const [palette, setPalette] = useState<BrainPalette>(FALLBACK);
+
+  useEffect(() => {
+    const update = () => setPalette(_read());
+    update();
+    const observer = new MutationObserver(update);
+    observer.observe(document.documentElement, {
+      attributes: true,
+      attributeFilter: ["class", "style", "data-theme"],
+    });
+    return () => observer.disconnect();
+  }, []);
+
+  return palette;
+};
diff --git a/app/_components/FeatureComponents/Brain/hooks/useBrainPrefs.ts b/app/_components/FeatureComponents/Brain/hooks/useBrainPrefs.ts
new file mode 100644
index 000000000..aefee22b6
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/hooks/useBrainPrefs.ts
@@ -0,0 +1,105 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import {
+  BrainColourModes,
+  BrainDimensions,
+  BrainFilters,
+  BrainScope,
+  DEFAULT_FILTERS,
+} from "../utils/brain-graph";
+
+const STORAGE_KEY = "jotty-brain-prefs";
+const LOCAL_DEPTH = 2;
+
+interface StoredPrefs {
+  dimension?: BrainDimensions;
+  filters?: Partial<BrainFilters>;
+  colourMode?: BrainColourModes;
+  depth?: number;
+}
+
+const _load = (): StoredPrefs => {
+  try {
+    return JSON.parse(
+      window.localStorage.getItem(STORAGE_KEY) || "{}",
+    ) as StoredPrefs;
+  } catch {
+    return {};
+  }
+};
+
+const _save = (prefs: StoredPrefs) => {
+  try {
+    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(prefs));
+  } catch {
+    return;
+  }
+};
+
+const _webgl = (): boolean => {
+  try {
+    const canvas = document.createElement("canvas");
+    return Boolean(canvas.getContext("webgl2") || canvas.getContext("webgl"));
+  } catch {
+    return false;
+  }
+};
+
+const _prefersFlat = (): boolean =>
+  window.matchMedia("(pointer: coarse)").matches ||
+  window.matchMedia("(prefers-reduced-motion: reduce)").matches;
+
+export const useBrainPrefs = (hasFocus: boolean) => {
+  const [dimension, setDimensionState] = useState(BrainDimensions.TWO_D);
+  const [filters, setFiltersState] = useState<BrainFilters>(DEFAULT_FILTERS);
+  const [colourMode, setColourModeState] = useState(BrainColourModes.TYPE);
+  const [scope, setScopeState] = useState<BrainScope>({
+    local: hasFocus,
+    depth: LOCAL_DEPTH,
+  });
+  const [webglReady, setWebglReady] = useState(false);
+
+  useEffect(() => {
+    const stored = _load();
+    const ready = _webgl();
+    setWebglReady(ready);
+    const wanted =
+      stored.dimension ||
+      (_prefersFlat() ? BrainDimensions.TWO_D : BrainDimensions.THREE_D);
+    setDimensionState(ready ? wanted : BrainDimensions.TWO_D);
+    setFiltersState({ ...DEFAULT_FILTERS, ...stored.filters });
+    if (stored.colourMode) setColourModeState(stored.colourMode);
+    if (stored.depth)
+      setScopeState((current) => ({ ...current, depth: stored.depth! }));
+  }, []);
+
+  const persist = useCallback(
+    (patch: StoredPrefs) => _save({ ..._load(), ...patch }),
+    [],
+  );
+
+  return {
+    dimension,
+    filters,
+    colourMode,
+    scope,
+    webglReady,
+    setDimension: (next: BrainDimensions) => {
+      setDimensionState(next);
+      persist({ dimension: next });
+    },
+    setFilters: (next: BrainFilters) => {
+      setFiltersState(next);
+      persist({ filters: next });
+    },
+    setColourMode: (next: BrainColourModes) => {
+      setColourModeState(next);
+      persist({ colourMode: next });
+    },
+    setScope: (next: BrainScope) => {
+      setScopeState(next);
+      persist({ depth: next.depth });
+    },
+  };
+};
diff --git a/app/_components/FeatureComponents/Brain/hooks/useElementSize.ts b/app/_components/FeatureComponents/Brain/hooks/useElementSize.ts
new file mode 100644
index 000000000..5e68deb3f
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/hooks/useElementSize.ts
@@ -0,0 +1,28 @@
+"use client";
+
+import { useEffect, useRef, useState } from "react";
+
+export const useElementSize = <T extends HTMLElement>() => {
+  const ref = useRef<T | null>(null);
+  const [size, setSize] = useState({ width: 0, height: 0 });
+
+  useEffect(() => {
+    const element = ref.current;
+    if (!element) return;
+
+    const update = () => {
+      const rect = element.getBoundingClientRect();
+      setSize({
+        width: Math.round(rect.width),
+        height: Math.round(rect.height),
+      });
+    };
+
+    update();
+    const observer = new ResizeObserver(update);
+    observer.observe(element);
+    return () => observer.disconnect();
+  }, []);
+
+  return { ref, size };
+};
diff --git a/app/_components/FeatureComponents/Brain/server/BrainPage.tsx b/app/_components/FeatureComponents/Brain/server/BrainPage.tsx
new file mode 100644
index 000000000..51ac3c48b
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/server/BrainPage.tsx
@@ -0,0 +1,33 @@
+import { notFound, redirect } from "next/navigation";
+import { getBrain } from "@/app/_server/actions/relations";
+import { getCurrentUser } from "@/app/_server/actions/users";
+import { getCategories } from "@/app/_server/actions/category";
+import { Modes } from "@/app/_types/enums";
+import { isUuid } from "@/app/_consts/identity";
+import { BrainPageClient } from "../BrainPageClient";
+
+interface BrainPageProps {
+  username?: string;
+  focus?: string;
+}
+
+export const BrainPage = async ({ username, focus }: BrainPageProps) => {
+  const user = await getCurrentUser();
+  if (!user?.username) redirect("/");
+
+  const [brain, categories] = await Promise.all([
+    getBrain(username),
+    getCategories(Modes.NOTES),
+  ]);
+  if (!brain.success || !brain.data) notFound();
+
+  return (
+    <BrainPageClient
+      graph={brain.data}
+      focus={focus && isUuid(focus) ? focus.toLowerCase() : null}
+      isOwnBrain={brain.data.owner === user.username}
+      categories={categories.success ? categories.data || [] : []}
+      user={user}
+    />
+  );
+};
diff --git a/app/_components/FeatureComponents/Brain/utils/brain-canvas.ts b/app/_components/FeatureComponents/Brain/utils/brain-canvas.ts
new file mode 100644
index 000000000..ea8ca254b
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/utils/brain-canvas.ts
@@ -0,0 +1,17 @@
+import type { BrainEdge, BrainNode } from "@/app/_types/relations";
+import type { BrainColourModes, BrainPalette } from "./brain-graph";
+
+export interface BrainCanvasProps {
+  nodes: BrainNode[];
+  edges: BrainEdge[];
+  focusId: string | null;
+  selectedId: string | null;
+  colourMode: BrainColourModes;
+  palette: BrainPalette;
+  flyTo: { id: string; at: number } | null;
+  onSelect: (id: string | null) => void;
+  onOpen: (node: BrainNode) => void;
+}
+
+export const FLY_MS = 1100;
+export const FLY_DISTANCE = 80;
diff --git a/app/_components/FeatureComponents/Brain/utils/brain-forces.ts b/app/_components/FeatureComponents/Brain/utils/brain-forces.ts
new file mode 100644
index 000000000..79f4dbed6
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/utils/brain-forces.ts
@@ -0,0 +1,117 @@
+import type { BrainNode } from "@/app/_types/relations";
+import { isItemNode } from "./brain-graph";
+
+interface SimNode extends BrainNode {
+  x?: number;
+  y?: number;
+  z?: number;
+  vx?: number;
+  vy?: number;
+  vz?: number;
+}
+
+type Force = ((alpha: number) => void) & { initialize: (nodes: SimNode[]) => void };
+
+const AXES = ["x", "y", "z"] as const;
+const VELOCITY = { x: "vx", y: "vy", z: "vz" } as const;
+
+const _region = (node: SimNode): string | null =>
+  isItemNode(node) ? node.category || null : null;
+
+const _force = (tick: (nodes: SimNode[], alpha: number) => void): Force => {
+  let nodes: SimNode[] = [];
+  const force = ((alpha: number) => tick(nodes, alpha)) as Force;
+  force.initialize = (next) => {
+    nodes = next;
+  };
+  return force;
+};
+
+export const regionForce = (strength: number): Force =>
+  _force((nodes, alpha) => {
+    const centres = new Map<string, { x: number; y: number; z: number; count: number }>();
+    nodes.forEach((node) => {
+      const region = _region(node);
+      if (!region) return;
+      const centre = centres.get(region) || { x: 0, y: 0, z: 0, count: 0 };
+      centre.x += node.x || 0;
+      centre.y += node.y || 0;
+      centre.z += node.z || 0;
+      centre.count += 1;
+      centres.set(region, centre);
+    });
+
+    nodes.forEach((node) => {
+      const region = _region(node);
+      const centre = region ? centres.get(region) : undefined;
+      if (!centre || centre.count < 2) return;
+      AXES.forEach((axis) => {
+        const target = centre[axis] / centre.count;
+        const key = VELOCITY[axis];
+        node[key] = (node[key] || 0) + (target - (node[axis] || 0)) * strength * alpha;
+      });
+    });
+  });
+
+export const gravityForce = (strength: number): Force =>
+  _force((nodes, alpha) => {
+    nodes.forEach((node) => {
+      AXES.forEach((axis) => {
+        const key = VELOCITY[axis];
+        node[key] = (node[key] || 0) - (node[axis] || 0) * strength * alpha;
+      });
+    });
+  });
+
+export const spreadRadius = (nodes: SimNode[], share = 0.9): number => {
+  const distances = nodes
+    .map((node) => Math.hypot(node.x || 0, node.y || 0, node.z || 0))
+    .sort((a, b) => a - b);
+  if (distances.length === 0) return 0;
+  return distances[Math.min(distances.length - 1, Math.floor(distances.length * share))];
+};
+
+const _cellKey = (x: number, y: number, z: number) => `${x},${y},${z}`;
+
+export const collideForce = (radiusOf: (node: SimNode) => number, strength = 0.7): Force =>
+  _force((nodes) => {
+    const reach = nodes.reduce((max, node) => Math.max(max, radiusOf(node)), 1) * 2;
+    const grid = new Map<string, SimNode[]>();
+    const cell = (value?: number) => Math.floor((value || 0) / reach);
+
+    nodes.forEach((node) => {
+      const key = _cellKey(cell(node.x), cell(node.y), cell(node.z));
+      const bucket = grid.get(key);
+      if (bucket) bucket.push(node);
+      else grid.set(key, [node]);
+    });
+
+    nodes.forEach((node) => {
+      const [cx, cy, cz] = [cell(node.x), cell(node.y), cell(node.z)];
+      const mine = radiusOf(node);
+      for (let dx = -1; dx <= 1; dx++) {
+        for (let dy = -1; dy <= 1; dy++) {
+          for (let dz = -1; dz <= 1; dz++) {
+            grid.get(_cellKey(cx + dx, cy + dy, cz + dz))?.forEach((other) => {
+              if (other === node || other.id > node.id) return;
+              const gap = mine + radiusOf(other);
+              const x = (node.x || 0) - (other.x || 0);
+              const y = (node.y || 0) - (other.y || 0);
+              const z = (node.z || 0) - (other.z || 0);
+              const distance = Math.hypot(x, y, z) || 0.01;
+              if (distance >= gap) return;
+              const push = ((gap - distance) / distance) * strength * 0.5;
+              node.vx = (node.vx || 0) + x * push;
+              node.vy = (node.vy || 0) + y * push;
+              other.vx = (other.vx || 0) - x * push;
+              other.vy = (other.vy || 0) - y * push;
+              if (node.z !== undefined) {
+                node.vz = (node.vz || 0) + z * push;
+                other.vz = (other.vz || 0) - z * push;
+              }
+            });
+          }
+        }
+      }
+    });
+  });
diff --git a/app/_components/FeatureComponents/Brain/utils/brain-glyphs.ts b/app/_components/FeatureComponents/Brain/utils/brain-glyphs.ts
new file mode 100644
index 000000000..17b0306c0
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/utils/brain-glyphs.ts
@@ -0,0 +1,185 @@
+import type { ReactElement } from "react";
+import {
+  CheckmarkSquare04Icon,
+  File02Icon,
+  FileAddIcon,
+  Tag01Icon,
+  TaskDaily01Icon,
+} from "hugeicons-react";
+import { BrainNodeKinds } from "@/app/_consts/relations";
+import { isKanbanType } from "@/app/_types/enums";
+import type { BrainNode } from "@/app/_types/relations";
+
+export enum NodeShapes {
+  DISC = "disc",
+  TILE = "tile",
+  GEM = "gem",
+  HOLLOW = "hollow",
+}
+
+export enum NodeGlyphs {
+  PAGE = "page",
+  TICK = "tick",
+  COLUMNS = "columns",
+  HASH = "hash",
+  PLUS = "plus",
+}
+
+export interface StampInk {
+  fill: string;
+  edge: string;
+  mark: string;
+}
+
+const EDGE_SHARE = 0.16;
+const TILE_CORNER = 0.34;
+const ICON_SHARE = 1.3;
+
+export const shapeOf = (node: BrainNode): NodeShapes => {
+  if (node.kind === BrainNodeKinds.GHOST) return NodeShapes.HOLLOW;
+  if (node.kind === BrainNodeKinds.TAG) return NodeShapes.GEM;
+  if (node.kind === BrainNodeKinds.CHECKLIST) return NodeShapes.TILE;
+  return NodeShapes.DISC;
+};
+
+export const glyphOf = (node: BrainNode): NodeGlyphs => {
+  if (node.kind === BrainNodeKinds.GHOST) return NodeGlyphs.PLUS;
+  if (node.kind === BrainNodeKinds.TAG) return NodeGlyphs.HASH;
+  if (node.kind === BrainNodeKinds.CHECKLIST) {
+    return isKanbanType(node.checklistType) ? NodeGlyphs.COLUMNS : NodeGlyphs.TICK;
+  }
+  return NodeGlyphs.PAGE;
+};
+
+export const stampKey = (node: BrainNode, ink: StampInk): string =>
+  [shapeOf(node), glyphOf(node), ink.fill, ink.edge, ink.mark].join("|");
+
+const _roundRect = (ctx: CanvasRenderingContext2D, x: number, y: number, size: number, corner: number) => {
+  const half = size / 2;
+  ctx.beginPath();
+  ctx.moveTo(x - half + corner, y - half);
+  ctx.arcTo(x + half, y - half, x + half, y + half, corner);
+  ctx.arcTo(x + half, y + half, x - half, y + half, corner);
+  ctx.arcTo(x - half, y + half, x - half, y - half, corner);
+  ctx.arcTo(x - half, y - half, x + half, y - half, corner);
+  ctx.closePath();
+};
+
+const _outline = (ctx: CanvasRenderingContext2D, shape: NodeShapes, x: number, y: number, r: number) => {
+  if (shape === NodeShapes.TILE) {
+    _roundRect(ctx, x, y, r * 1.8, r * TILE_CORNER * 1.8);
+    return;
+  }
+  if (shape === NodeShapes.GEM) {
+    ctx.beginPath();
+    ctx.moveTo(x, y - r);
+    ctx.lineTo(x + r, y);
+    ctx.lineTo(x, y + r);
+    ctx.lineTo(x - r, y);
+    ctx.closePath();
+    return;
+  }
+  ctx.beginPath();
+  ctx.arc(x, y, r, 0, Math.PI * 2);
+};
+
+type IconChild = ReactElement<{ d?: string }> | IconChild[] | null | undefined;
+
+type IconRender = {
+  render: (props: object, ref: null) => ReactElement<{ children?: IconChild }>;
+};
+
+const _flatten = (child: IconChild): ReactElement<{ d?: string }>[] =>
+  Array.isArray(child) ? child.flatMap(_flatten) : child ? [child] : [];
+
+const GLYPH_ICONS: Record<NodeGlyphs, unknown> = {
+  [NodeGlyphs.PAGE]: File02Icon,
+  [NodeGlyphs.TICK]: CheckmarkSquare04Icon,
+  [NodeGlyphs.COLUMNS]: TaskDaily01Icon,
+  [NodeGlyphs.HASH]: Tag01Icon,
+  [NodeGlyphs.PLUS]: FileAddIcon,
+};
+
+const ICON_BOX = 24;
+const ICON_STROKE = 1.9;
+const iconPaths = new Map<NodeGlyphs, Path2D[]>();
+
+const _pathsOf = (glyph: NodeGlyphs): Path2D[] => {
+  const cached = iconPaths.get(glyph);
+  if (cached) return cached;
+  const svg = (GLYPH_ICONS[glyph] as IconRender).render({}, null);
+  const paths = _flatten(svg.props.children)
+    .map((child) => child.props.d)
+    .filter((d): d is string => Boolean(d))
+    .map((d) => new Path2D(d));
+  iconPaths.set(glyph, paths);
+  return paths;
+};
+
+const _glyph = (ctx: CanvasRenderingContext2D, glyph: NodeGlyphs, x: number, y: number, size: number) => {
+  ctx.save();
+  ctx.translate(x - size / 2, y - size / 2);
+  ctx.scale(size / ICON_BOX, size / ICON_BOX);
+  ctx.lineWidth = ICON_STROKE;
+  ctx.lineCap = "round";
+  ctx.lineJoin = "round";
+  _pathsOf(glyph).forEach((path) => ctx.stroke(path));
+  ctx.restore();
+};
+
+export const paintStamp = (
+  ctx: CanvasRenderingContext2D,
+  node: BrainNode,
+  x: number,
+  y: number,
+  r: number,
+  ink: StampInk,
+  withGlyph = true,
+) => {
+  const shape = shapeOf(node);
+  const edge = r * EDGE_SHARE;
+
+  if (shape === NodeShapes.HOLLOW) {
+    _outline(ctx, NodeShapes.DISC, x, y, r + edge / 2);
+    ctx.fillStyle = ink.edge;
+    ctx.fill();
+    _outline(ctx, NodeShapes.DISC, x, y, r - edge / 2);
+    ctx.setLineDash([r * 0.45, r * 0.3]);
+    ctx.lineWidth = edge;
+    ctx.strokeStyle = ink.fill;
+    ctx.stroke();
+    ctx.setLineDash([]);
+    if (withGlyph) {
+      ctx.strokeStyle = ink.fill;
+      _glyph(ctx, NodeGlyphs.PLUS, x, y, r * ICON_SHARE);
+    }
+    return;
+  }
+
+  _outline(ctx, shape, x, y, r + edge);
+  ctx.fillStyle = ink.edge;
+  ctx.fill();
+  _outline(ctx, shape, x, y, r);
+  ctx.fillStyle = ink.fill;
+  ctx.fill();
+
+  if (withGlyph) {
+    ctx.strokeStyle = ink.mark;
+    _glyph(ctx, glyphOf(node), x, y, r * (shape === NodeShapes.GEM ? ICON_SHARE * 0.8 : ICON_SHARE));
+  }
+};
+
+export const paintHalo = (
+  ctx: CanvasRenderingContext2D,
+  x: number,
+  y: number,
+  r: number,
+  colour: string,
+  width: number,
+) => {
+  ctx.beginPath();
+  ctx.arc(x, y, r, 0, Math.PI * 2);
+  ctx.lineWidth = width;
+  ctx.strokeStyle = colour;
+  ctx.stroke();
+};
diff --git a/app/_components/FeatureComponents/Brain/utils/brain-graph.ts b/app/_components/FeatureComponents/Brain/utils/brain-graph.ts
new file mode 100644
index 000000000..accc7b6a0
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/utils/brain-graph.ts
@@ -0,0 +1,219 @@
+import { BrainEdgeKinds, BrainNodeKinds } from "@/app/_consts/relations";
+import type { BrainEdge, BrainGraph, BrainNode } from "@/app/_types/relations";
+
+export enum BrainDimensions {
+  THREE_D = "3d",
+  TWO_D = "2d",
+}
+
+export enum BrainColourModes {
+  TYPE = "type",
+  CATEGORY = "category",
+}
+
+export interface BrainFilters {
+  notes: boolean;
+  checklists: boolean;
+  tags: boolean;
+  ghosts: boolean;
+  suggestions: boolean;
+  orphans: boolean;
+}
+
+export interface BrainScope {
+  local: boolean;
+  depth: number;
+}
+
+export interface BrainView {
+  nodes: BrainNode[];
+  edges: BrainEdge[];
+}
+
+export const DEFAULT_FILTERS: BrainFilters = {
+  notes: true,
+  checklists: true,
+  tags: false,
+  ghosts: true,
+  suggestions: true,
+  orphans: true,
+};
+
+export const MAX_DEPTH = 3;
+
+const KIND_FILTER: Record<BrainNodeKinds, keyof BrainFilters> = {
+  [BrainNodeKinds.NOTE]: "notes",
+  [BrainNodeKinds.CHECKLIST]: "checklists",
+  [BrainNodeKinds.TAG]: "tags",
+  [BrainNodeKinds.GHOST]: "ghosts",
+};
+
+export const isItemNode = (node?: BrainNode | null): boolean =>
+  node?.kind === BrainNodeKinds.NOTE || node?.kind === BrainNodeKinds.CHECKLIST;
+
+export const neighbourMap = (edges: BrainEdge[], withSuggested = false) => {
+  const map = new Map<string, Set<string>>();
+  const add = (from: string, to: string) => {
+    if (!map.has(from)) map.set(from, new Set());
+    map.get(from)!.add(to);
+  };
+  edges.forEach((edge) => {
+    if (!withSuggested && edge.kind === BrainEdgeKinds.SUGGESTED) return;
+    add(edge.source, edge.target);
+    add(edge.target, edge.source);
+  });
+  return map;
+};
+
+const _within = (
+  focus: string,
+  neighbours: Map<string, Set<string>>,
+  depth: number,
+) => {
+  const reached = new Set([focus]);
+  let frontier = [focus];
+  for (let level = 0; level < depth; level++) {
+    const next: string[] = [];
+    frontier.forEach((id) =>
+      neighbours.get(id)?.forEach((other) => {
+        if (reached.has(other)) return;
+        reached.add(other);
+        next.push(other);
+      }),
+    );
+    frontier = next;
+  }
+  return reached;
+};
+
+export const brainView = (
+  graph: BrainGraph,
+  filters: BrainFilters,
+  scope: BrainScope,
+  focus: string | null,
+): BrainView => {
+  const edges = graph.edges.filter(
+    (edge) =>
+      (filters.suggestions || edge.kind !== BrainEdgeKinds.SUGGESTED) &&
+      (filters.tags || edge.kind !== BrainEdgeKinds.TAG),
+  );
+  const linked = neighbourMap(edges);
+  const local =
+    scope.local && focus
+      ? _within(focus, neighbourMap(edges, true), scope.depth)
+      : null;
+
+  const nodes = graph.nodes.filter((node) => {
+    if (!filters[KIND_FILTER[node.kind]]) return false;
+    if (local && !local.has(node.id)) return false;
+    if (!filters.orphans && !linked.has(node.id) && node.id !== focus)
+      return false;
+    return true;
+  });
+
+  const kept = new Set(nodes.map((node) => node.id));
+  return {
+    nodes,
+    edges: edges.filter(
+      (edge) => kept.has(edge.source) && kept.has(edge.target),
+    ),
+  };
+};
+
+export const searchNodes = (
+  nodes: BrainNode[],
+  query: string,
+  limit = 8,
+): BrainNode[] => {
+  const needle = query.trim().toLowerCase();
+  if (!needle) return [];
+  return nodes
+    .filter((node) => node.title.toLowerCase().includes(needle))
+    .sort((a, b) => b.degree - a.degree)
+    .slice(0, limit);
+};
+
+const _hue = (text: string): number => {
+  let hash = 0;
+  for (let i = 0; i < text.length; i++)
+    hash = (hash * 31 + text.charCodeAt(i)) >>> 0;
+  return hash % 360;
+};
+
+export type Rgb = [number, number, number];
+
+export interface BrainPalette {
+  primary: Rgb;
+  foreground: Rgb;
+  muted: Rgb;
+  background: Rgb;
+  card: Rgb;
+  border: Rgb;
+}
+
+export const mix = (from: Rgb, to: Rgb, amount: number): Rgb => [
+  Math.round(from[0] + (to[0] - from[0]) * amount),
+  Math.round(from[1] + (to[1] - from[1]) * amount),
+  Math.round(from[2] + (to[2] - from[2]) * amount),
+];
+
+export const rgba = ([r, g, b]: Rgb, alpha = 1): string =>
+  `rgba(${r}, ${g}, ${b}, ${alpha})`;
+
+export const hex = ([r, g, b]: Rgb): string =>
+  `#${[r, g, b].map((channel) => channel.toString(16).padStart(2, "0")).join("")}`;
+
+const _categoryTint = (category: string, palette: BrainPalette): Rgb => {
+  const spread = (_hue(category) % 7) / 7;
+  return spread < 0.5
+    ? mix(palette.primary, palette.foreground, spread * 0.9)
+    : mix(palette.primary, palette.background, (spread - 0.5) * 0.9);
+};
+
+export const nodeRgb = (
+  node: BrainNode,
+  mode: BrainColourModes,
+  palette: BrainPalette,
+): Rgb => {
+  if (node.kind === BrainNodeKinds.GHOST) return palette.muted;
+  if (node.kind === BrainNodeKinds.TAG)
+    return mix(palette.primary, palette.background, 0.45);
+  if (mode === BrainColourModes.CATEGORY) {
+    return _categoryTint(node.category || node.kind, palette);
+  }
+  return node.kind === BrainNodeKinds.CHECKLIST
+    ? mix(palette.primary, palette.foreground, 0.45)
+    : palette.primary;
+};
+
+export const nodeColour = (
+  node: BrainNode,
+  mode: BrainColourModes,
+  palette: BrainPalette,
+): string => rgba(nodeRgb(node, mode, palette));
+
+export const edgeRgb = (edge: BrainEdge, palette: BrainPalette): Rgb => {
+  if (edge.kind === BrainEdgeKinds.SUGGESTED) return palette.muted;
+  if (edge.kind === BrainEdgeKinds.TAG) return mix(palette.primary, palette.background, 0.55);
+  if (edge.kind === BrainEdgeKinds.WIKI) return palette.primary;
+  return mix(palette.foreground, palette.background, 0.35);
+};
+
+export const edgeColour = (edge: BrainEdge, palette: BrainPalette, lit: boolean): string =>
+  rgba(edgeRgb(edge, palette), lit ? 0.85 : 0.25);
+
+export const solidEdgeColour = (edge: BrainEdge, palette: BrainPalette, dim: number): string =>
+  rgba(mix(edgeRgb(edge, palette), palette.background, dim));
+
+export const nodeRadius = (node: BrainNode, emphasised: boolean): number => {
+  if (node.kind === BrainNodeKinds.TAG) return 2.2;
+  const base = Math.min(9, 3.2 + Math.sqrt(node.degree) * 1.1);
+  return emphasised ? base * 1.35 : base;
+};
+
+export const endpointId = (value: unknown): string => {
+  if (typeof value === "string") return value;
+  if (value && typeof value === "object" && "id" in value)
+    return String((value as { id: unknown }).id);
+  return "";
+};
diff --git a/app/_components/FeatureComponents/Brain/utils/brain-three.ts b/app/_components/FeatureComponents/Brain/utils/brain-three.ts
new file mode 100644
index 000000000..8ea65daf2
--- /dev/null
+++ b/app/_components/FeatureComponents/Brain/utils/brain-three.ts
@@ -0,0 +1,274 @@
+import * as THREE from "three";
+import type { BrainNode } from "@/app/_types/relations";
+import { paintStamp, stampKey, StampInk } from "./brain-glyphs";
+
+export interface PaintTarget {
+  body: number;
+  ring: number;
+  label: number;
+}
+
+export interface NodeParts {
+  group: THREE.Group;
+  body: THREE.Sprite;
+  hit: THREE.Mesh<THREE.BufferGeometry, THREE.MeshBasicMaterial>;
+  ring: THREE.Sprite;
+  label: THREE.Sprite;
+  labelAspect: number;
+  crowded: boolean;
+  target: PaintTarget;
+}
+
+const LABEL_FONT_PX = 40;
+const LABEL_PAD_X = 18;
+const LABEL_PAD_Y = 10;
+const LABEL_MAX_CHARS = 32;
+const LABEL_SCREEN_HEIGHT = 0.026;
+export const LABEL_PIXEL_SHARE = LABEL_SCREEN_HEIGHT * 1.35;
+const LABEL_LIFT = 3;
+const RING_TEXTURE_PX = 128;
+const STAMP_TEXTURE_PX = 128;
+const STAMP_PADDING = 1.25;
+const TWEEN_RATE = 0.2;
+const SETTLED = 0.004;
+const HIT_SCALE = 1.8;
+const HIT_MIN_EXTRA = 2.5;
+const PICKABLE_OPACITY = 0.3;
+
+const _ignoreRaycast = () => undefined;
+
+const stamps = new Map<string, THREE.CanvasTexture>();
+
+const _stampTexture = (node: BrainNode, ink: StampInk): THREE.CanvasTexture => {
+  const key = stampKey(node, ink);
+  const cached = stamps.get(key);
+  if (cached) return cached;
+
+  const canvas = document.createElement("canvas");
+  canvas.width = STAMP_TEXTURE_PX;
+  canvas.height = STAMP_TEXTURE_PX;
+  const context = canvas.getContext("2d")!;
+  const centre = STAMP_TEXTURE_PX / 2;
+  paintStamp(context, node, centre, centre, centre / STAMP_PADDING / 1.16, ink);
+
+  const texture = new THREE.CanvasTexture(canvas);
+  texture.colorSpace = THREE.SRGBColorSpace;
+  texture.anisotropy = 4;
+  stamps.set(key, texture);
+  return texture;
+};
+
+export const forgetStamps = () => {
+  stamps.forEach((texture) => texture.dispose());
+  stamps.clear();
+};
+
+const _stampSprite = (node: BrainNode, radius: number, ink: StampInk): THREE.Sprite => {
+  const sprite = new THREE.Sprite(
+    new THREE.SpriteMaterial({
+      map: _stampTexture(node, ink),
+      transparent: true,
+      alphaTest: 0.05,
+      opacity: 1,
+      depthWrite: true,
+    }),
+  );
+  sprite.raycast = _ignoreRaycast;
+  sprite.renderOrder = 5;
+  const size = radius * 2 * STAMP_PADDING;
+  sprite.scale.set(size, size, 1);
+  return sprite;
+};
+
+const _pill = (context: CanvasRenderingContext2D, width: number, height: number) => {
+  const radius = height / 2;
+  context.beginPath();
+  context.moveTo(radius, 0);
+  context.arcTo(width, 0, width, height, radius);
+  context.arcTo(width, height, 0, height, radius);
+  context.arcTo(0, height, 0, 0, radius);
+  context.arcTo(0, 0, width, 0, radius);
+  context.closePath();
+};
+
+const _sprite = (canvas: HTMLCanvasElement, fixedSize = false): THREE.Sprite => {
+  const texture = new THREE.CanvasTexture(canvas);
+  texture.colorSpace = THREE.SRGBColorSpace;
+  texture.anisotropy = 4;
+  const sprite = new THREE.Sprite(
+    new THREE.SpriteMaterial({
+      map: texture,
+      transparent: true,
+      opacity: 0,
+      depthWrite: false,
+      depthTest: false,
+      sizeAttenuation: !fixedSize,
+    }),
+  );
+  sprite.raycast = _ignoreRaycast;
+  sprite.visible = false;
+  return sprite;
+};
+
+const _labelCanvas = (text: string, ink: string, paper: string, border: string): HTMLCanvasElement => {
+  const shown = text.length > LABEL_MAX_CHARS ? `${text.slice(0, LABEL_MAX_CHARS - 1)}…` : text;
+  const canvas = document.createElement("canvas");
+  const context = canvas.getContext("2d")!;
+  const font = `600 ${LABEL_FONT_PX}px Inter, system-ui, sans-serif`;
+  context.font = font;
+  canvas.width = Math.ceil(context.measureText(shown).width) + LABEL_PAD_X * 2;
+  canvas.height = LABEL_FONT_PX + LABEL_PAD_Y * 2;
+
+  _pill(context, canvas.width, canvas.height);
+  context.fillStyle = paper;
+  context.fill();
+  context.lineWidth = 3;
+  context.strokeStyle = border;
+  context.stroke();
+  context.font = font;
+  context.textBaseline = "middle";
+  context.fillStyle = ink;
+  context.fillText(shown, LABEL_PAD_X, canvas.height / 2 + 2);
+  return canvas;
+};
+
+const _labelSprite = (text: string, ink: string, paper: string, border: string): THREE.Sprite => {
+  const canvas = _labelCanvas(text, ink, paper, border);
+  const sprite = _sprite(canvas, true);
+  sprite.renderOrder = 20;
+  sprite.center.set(0.5, 0);
+  sprite.scale.set((LABEL_SCREEN_HEIGHT * canvas.width) / canvas.height, LABEL_SCREEN_HEIGHT, 1);
+  return sprite;
+};
+
+const _ringCanvas = (colour: string): HTMLCanvasElement => {
+  const canvas = document.createElement("canvas");
+  canvas.width = RING_TEXTURE_PX;
+  canvas.height = RING_TEXTURE_PX;
+  const context = canvas.getContext("2d")!;
+  context.beginPath();
+  context.arc(RING_TEXTURE_PX / 2, RING_TEXTURE_PX / 2, RING_TEXTURE_PX / 2 - 6, 0, Math.PI * 2);
+  context.lineWidth = 6;
+  context.strokeStyle = colour;
+  context.stroke();
+  return canvas;
+};
+
+const _ringSprite = (colour: string, radius: number): THREE.Sprite => {
+  const sprite = _sprite(_ringCanvas(colour));
+  sprite.renderOrder = 10;
+  sprite.scale.set(radius * 3, radius * 3, 1);
+  return sprite;
+};
+
+export interface PartColours {
+  body: string;
+  halo: string;
+  edge: string;
+  mark: string;
+  ink: string;
+  paper: string;
+  border: string;
+}
+
+const _stampInk = (colours: PartColours): StampInk => ({
+  fill: colours.body,
+  edge: colours.edge,
+  mark: colours.mark,
+});
+
+export const nodeParts = (node: BrainNode, radius: number, colours: PartColours): NodeParts => {
+  const group = new THREE.Group();
+  const body = _stampSprite(node, radius, _stampInk(colours));
+
+  const hit = new THREE.Mesh(
+    new THREE.SphereGeometry(Math.max(radius * HIT_SCALE, radius + HIT_MIN_EXTRA), 12, 8),
+    new THREE.MeshBasicMaterial({ transparent: true, opacity: 0, depthWrite: false, colorWrite: false }),
+  );
+
+  hit.userData.nodeId = node.id;
+
+  const ring = _ringSprite(colours.halo, radius);
+  const label = _labelSprite(node.title, colours.ink, colours.paper, colours.border);
+  label.position.set(0, radius + LABEL_LIFT, 0);
+
+  group.add(body, hit, ring, label);
+  return {
+    group,
+    body,
+    hit,
+    ring,
+    label,
+    labelAspect: label.scale.x / label.scale.y,
+    crowded: false,
+    target: { body: 1, ring: 0, label: 0 },
+  };
+};
+
+const raycaster = new THREE.Raycaster();
+const pointer = new THREE.Vector2();
+
+export const pickNode = (
+  parts: Map<string, NodeParts>,
+  camera: THREE.Camera,
+  ndcX: number,
+  ndcY: number,
+): string | null => {
+  pointer.set(ndcX, ndcY);
+  raycaster.setFromCamera(pointer, camera);
+  const targets = Array.from(parts.values())
+    .filter((part) => part.body.material.opacity > PICKABLE_OPACITY)
+    .map((part) => part.hit);
+  const [first] = raycaster.intersectObjects(targets, false);
+  return (first?.object.userData.nodeId as string | undefined) || null;
+};
+
+const _swapTexture = (sprite: THREE.Sprite, canvas: HTMLCanvasElement) => {
+  const texture = new THREE.CanvasTexture(canvas);
+  texture.colorSpace = THREE.SRGBColorSpace;
+  texture.anisotropy = 4;
+  sprite.material.map?.dispose();
+  sprite.material.map = texture;
+  sprite.material.needsUpdate = true;
+};
+
+export const recolourParts = (parts: NodeParts, node: BrainNode, colours: PartColours) => {
+  const title = node.title;
+  parts.body.material.map = _stampTexture(node, _stampInk(colours));
+  parts.body.material.needsUpdate = true;
+  _swapTexture(parts.ring, _ringCanvas(colours.halo));
+  const canvas = _labelCanvas(title, colours.ink, colours.paper, colours.border);
+  _swapTexture(parts.label, canvas);
+};
+
+const _toward = (current: number, target: number): [number, boolean] => {
+  const next = current + (target - current) * TWEEN_RATE;
+  return Math.abs(target - next) < SETTLED ? [target, false] : [next, true];
+};
+
+export const tweenParts = (parts: NodeParts): boolean => {
+  const [body, bodyMoving] = _toward(parts.body.material.opacity, parts.target.body);
+  const [ring, ringMoving] = _toward(parts.ring.material.opacity, parts.target.ring);
+  const [label, labelMoving] = _toward(
+    parts.label.material.opacity,
+    parts.crowded ? 0 : parts.target.label,
+  );
+
+  parts.body.material.opacity = body;
+  parts.ring.material.opacity = ring;
+  parts.ring.visible = ring > SETTLED;
+  parts.label.material.opacity = label;
+  parts.label.visible = label > SETTLED;
+
+  return bodyMoving || ringMoving || labelMoving;
+};
+
+export const disposeParts = (parts: NodeParts) => {
+  parts.body.material.dispose();
+  parts.hit.geometry.dispose();
+  parts.hit.material.dispose();
+  [parts.ring, parts.label].forEach((sprite) => {
+    sprite.material.map?.dispose();
+    sprite.material.dispose();
+  });
+};
diff --git a/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistHeader.tsx b/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistHeader.tsx
index 815a1452d..79da47028 100644
--- a/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistHeader.tsx
+++ b/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistHeader.tsx
@@ -14,6 +14,7 @@ import {
   Copy01Icon,
   Copy02Icon,
 } from "hugeicons-react";
+import { BrainButton } from "@/app/_components/FeatureComponents/Brain/Parts/BrainButton";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { Checklist } from "@/app/_types";
 import { useChecklist } from "../../../../../_hooks/useChecklist";
@@ -147,6 +148,8 @@ export const ChecklistHeader = ({
             )}
           </div>
 
+          <BrainButton uuid={checklist.uuid} className="h-10 w-10" />
+
           {(permissions?.canEdit || permissions?.canDelete) && (
             <div
               className={`${permissions?.canEdit &&
diff --git a/app/_components/FeatureComponents/Checklists/Parts/Simple/ChecklistBody.tsx b/app/_components/FeatureComponents/Checklists/Parts/Simple/ChecklistBody.tsx
index 8a45d1996..242605621 100644
--- a/app/_components/FeatureComponents/Checklists/Parts/Simple/ChecklistBody.tsx
+++ b/app/_components/FeatureComponents/Checklists/Parts/Simple/ChecklistBody.tsx
@@ -13,7 +13,6 @@ import { Checklist, Item } from "@/app/_types";
 import { DropIndicator } from "./DropIndicator";
 import { ItemTypes, TaskStatusLabels } from "@/app/_types/enums";
 import { useMemo, useState } from "react";
-import { getReferences } from "@/app/_utils/indexes-utils";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { ReferencedBySection } from "@/app/_components/FeatureComponents/Notes/Parts/ReferencedBySection";
 import { useTranslations } from "next-intl";
@@ -51,7 +50,6 @@ export const ChecklistBody = ({
   isDeletingItem,
 }: ChecklistBodyProps) => {
   const t = useTranslations();
-  const { linkIndex, notes, checklists, appSettings } = useAppMode();
   const { isDragging, setIsDragging } = useUIStore();
   const [activeItem, setActiveItem] = useState<Item | null>(null);
   const [overItem, setOverItem] = useState<{
@@ -59,16 +57,6 @@ export const ChecklistBody = ({
     position: "before" | "after";
   } | null>(null);
 
-  const referencingItems = useMemo(() => {
-    return getReferences(
-      linkIndex,
-      localList.uuid,
-      ItemTypes.CHECKLIST,
-      notes,
-      checklists
-    );
-  }, [linkIndex, localList.uuid, notes, checklists]);
-
   const onDragStart = (event: DragStartEvent) => {
     const findItem = (items: Item[], id: string): Item | undefined => {
       for (const item of items) {
@@ -127,12 +115,7 @@ export const ChecklistBody = ({
           </p>
         </div>
 
-        {referencingItems.length > 0 &&
-          appSettings?.editor?.enableBilateralLinks && (
-            <div className="p-4">
-              <ReferencedBySection referencingItems={referencingItems} />
-            </div>
-          )}
+        <ReferencedBySection className="p-4" />
       </>
     );
   }
@@ -293,10 +276,7 @@ export const ChecklistBody = ({
           </div>
         </DndContext>
 
-        {referencingItems.length > 0 &&
-          appSettings?.editor?.enableBilateralLinks && (
-            <ReferencedBySection referencingItems={referencingItems} />
-          )}
+        <ReferencedBySection />
       </div>
     </>
   );
diff --git a/app/_components/FeatureComponents/Kanban/Kanban.tsx b/app/_components/FeatureComponents/Kanban/Kanban.tsx
index 99f9a47de..61cf6ee08 100644
--- a/app/_components/FeatureComponents/Kanban/Kanban.tsx
+++ b/app/_components/FeatureComponents/Kanban/Kanban.tsx
@@ -13,7 +13,6 @@ import { useKanbanBoard } from "@/app/_hooks/kanban/useKanban";
 import { useKanbanDnd } from "@/app/_hooks/kanban/useKanbanDnd";
 import { ItemTypes, TaskStatus, TaskStatusLabels } from "@/app/_types/enums";
 import { ReferencedBySection } from "../Notes/Parts/ReferencedBySection";
-import { getReferences } from "@/app/_utils/indexes-utils";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { usePermissions } from "@/app/_providers/PermissionsProvider";
 import {
@@ -64,8 +63,7 @@ export const Kanban = ({ checklist, onUpdate }: KanbanBoardProps) => {
   const [calendarSelectedItem, setCalendarSelectedItem] = useState<
     import("@/app/_types").Item | null
   >(null);
-  const { linkIndex, notes, checklists, appSettings, allSharedItems } =
-    useAppMode();
+  const { allSharedItems } = useAppMode();
   const isShared =
     allSharedItems?.checklists.some(
       (sharedChecklist) => sharedChecklist.uuid === checklist.uuid,
@@ -328,16 +326,6 @@ export const Kanban = ({ checklist, onUpdate }: KanbanBoardProps) => {
     ],
   );
 
-  const referencingItems = useMemo(() => {
-    return getReferences(
-      linkIndex,
-      localChecklist.uuid,
-      ItemTypes.CHECKLIST,
-      notes,
-      checklists,
-    );
-  }, [linkIndex, localChecklist.uuid, checklists, notes]);
-
   return (
     <div className="h-full flex flex-col bg-background overflow-y-auto overflow-x-hidden min-w-0 max-w-full jotty-scrollable-content">
       {permissions?.canEdit && (
@@ -477,10 +465,7 @@ export const Kanban = ({ checklist, onUpdate }: KanbanBoardProps) => {
         )}
 
         <div className="px-4 pt-4 pb-[100px] lg:pb-4">
-          {referencingItems.length > 0 &&
-            appSettings?.editor?.enableBilateralLinks && (
-              <ReferencedBySection referencingItems={referencingItems} />
-            )}
+          <ReferencedBySection />
         </div>
       </div>
 
diff --git a/app/_components/FeatureComponents/Notes/Parts/MentionedInSection.tsx b/app/_components/FeatureComponents/Notes/Parts/MentionedInSection.tsx
new file mode 100644
index 000000000..d33728333
--- /dev/null
+++ b/app/_components/FeatureComponents/Notes/Parts/MentionedInSection.tsx
@@ -0,0 +1,84 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { useTranslations } from "next-intl";
+import { Link04Icon } from "hugeicons-react";
+import { itemHref } from "@/app/_utils/global-utils";
+import { ItemTypes } from "@/app/_types/enums";
+import { useRelations } from "@/app/_providers/RelationsProvider";
+import { useToast } from "@/app/_providers/ToastProvider";
+import { linkMention } from "@/app/_server/actions/relations";
+import type { MentionedIn } from "@/app/_types/relations";
+
+export const MentionedInSection = () => {
+  const router = useRouter();
+  const t = useTranslations();
+  const { showToast } = useToast();
+  const { uuid: targetUuid, mentions } = useRelations();
+  const [linking, setLinking] = useState<string | null>(null);
+
+  if (!targetUuid || mentions.length === 0) return null;
+
+  const link = async (source: MentionedIn) => {
+    setLinking(source.uuid);
+    try {
+      const result = await linkMention(source.uuid, targetUuid);
+      if (!result.success) {
+        showToast({ type: "error", title: t("common.error"), message: t("relations.linkFailed") });
+        return;
+      }
+      showToast({
+        type: "success",
+        title: t("common.success"),
+        message: t("relations.linked", { title: source.title }),
+      });
+      router.refresh();
+    } finally {
+      setLinking(null);
+    }
+  };
+
+  return (
+    <div className="mt-8 space-y-4">
+      <h3 className="text-lg font-semibold text-foreground flex items-center gap-2">
+        <span>{t("relations.mentionedIn")}</span>
+        <span className="text-md lg:text-sm text-muted-foreground font-normal">
+          ({mentions.length})
+        </span>
+      </h3>
+      <p className="text-md lg:text-sm text-muted-foreground">{t("relations.mentionedInHint")}</p>
+
+      <div className="space-y-2">
+        {mentions.map((source) => (
+          <div
+            key={source.uuid}
+            className="flex items-start gap-3 bg-muted/50 border border-border rounded-jotty p-3"
+          >
+            <button
+              type="button"
+              onClick={() => router.push(itemHref(ItemTypes.NOTE, source.uuid))}
+              className="flex-1 min-w-0 text-left group"
+            >
+              <span className="block text-md lg:text-sm font-medium text-foreground group-hover:text-primary transition-colors">
+                {source.title}
+              </span>
+              <span className="block text-md lg:text-xs text-muted-foreground truncate">
+                {source.snippet}
+              </span>
+            </button>
+            <button
+              type="button"
+              onClick={() => link(source)}
+              disabled={linking !== null}
+              className="flex-shrink-0 inline-flex items-center gap-1.5 px-2 py-1 text-md lg:text-xs border border-border rounded-jotty text-foreground hover:border-primary hover:text-primary transition-colors disabled:opacity-50"
+            >
+              <Link04Icon className="h-3.5 w-3.5" />
+              {t("relations.linkMention")}
+            </button>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+};
diff --git a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorContent.tsx b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorContent.tsx
index 01bc5991b..6c0f30dd5 100644
--- a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorContent.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorContent.tsx
@@ -9,7 +9,6 @@ import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { useSettings } from "@/app/_utils/settings-store";
 import { useSearchParams } from "next/navigation";
 import { useEffect, useRef, useMemo } from "react";
-import { getReferences } from "@/app/_utils/indexes-utils";
 import { usePermissions } from "@/app/_providers/PermissionsProvider";
 import { MinimalEditorPanel } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/MinimalEditorPanel";
 import { useMinimalMode } from "@/app/_hooks/useMinimalMode";
@@ -50,7 +49,7 @@ export const NoteEditorContent = ({
   isEditingEncrypted,
 }: NoteEditorContentProps) => {
   const t = useTranslations();
-  const { user, linkIndex, notes, checklists, appSettings } = useAppMode();
+  const { user, notes, checklists } = useAppMode();
   const { compactMode } = useSettings();
   const searchParams = useSearchParams();
   const notesDefaultMode = user?.notesDefaultMode || "view";
@@ -59,10 +58,6 @@ export const NoteEditorContent = ({
   const { permissions } = usePermissions();
   const isMinimalMode = useMinimalMode();
 
-  const referencingItems = useMemo(() => {
-    return getReferences(linkIndex, noteId, ItemTypes.NOTE, notes, checklists);
-  }, [linkIndex, noteId, notes, checklists]);
-
   useEffect(() => {
     if (
       editorRef.current &&
@@ -171,10 +166,7 @@ export const NoteEditorContent = ({
             <UnifiedMarkdownRenderer
               content={encrypted ? editorContent : noteContent || ""}
             />
-            {referencingItems.length > 0 &&
-              appSettings?.editor?.enableBilateralLinks && (
-                <ReferencedBySection referencingItems={referencingItems} />
-              )}
+            <ReferencedBySection />
           </div>
         </>
       )}
diff --git a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorHeader.tsx b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorHeader.tsx
index 19d665a42..9312f1bed 100644
--- a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorHeader.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorHeader.tsx
@@ -2,6 +2,7 @@
 
 import { ShareModal } from "@/app/_components/GlobalComponents/Modals/SharingModals/ShareModal";
 import { CategoryTreeSelector } from "@/app/_components/GlobalComponents/Dropdowns/CategoryTreeSelector";
+import { BrainButton } from "@/app/_components/FeatureComponents/Brain/Parts/BrainButton";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import {
   Archive02Icon,
@@ -497,6 +498,7 @@ export const NoteEditorHeader = ({
                       )}
                     </Button>
                   )}
+                  <BrainButton uuid={note?.uuid} className="h-10 w-10" />
                   <DropdownMenu
                     align="right"
                     trigger={
diff --git a/app/_components/FeatureComponents/Notes/Parts/ReferencedBySection.tsx b/app/_components/FeatureComponents/Notes/Parts/ReferencedBySection.tsx
index 094a7309c..aba24026f 100644
--- a/app/_components/FeatureComponents/Notes/Parts/ReferencedBySection.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/ReferencedBySection.tsx
@@ -1,80 +1,100 @@
 "use client";
 
-import { File02Icon, CheckmarkSquare04Icon } from "hugeicons-react";
-import { itemHref } from "@/app/_utils/global-utils";
+import {
+  File02Icon,
+  CheckmarkSquare04Icon,
+  TaskDaily01Icon,
+} from "hugeicons-react";
 import { useRouter } from "next/navigation";
-import { ItemType } from "@/app/_types";
-import { ItemTypes } from "@/app/_types/enums";
 import { useTranslations } from "next-intl";
+import { itemHref } from "@/app/_utils/global-utils";
+import { ItemTypes, isKanbanType } from "@/app/_types/enums";
+import { RelationsStatus } from "@/app/_consts/relations";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import type { RelatedItem } from "@/app/_types/relations";
+import { useRelations } from "@/app/_providers/RelationsProvider";
+import { useAppMode } from "@/app/_providers/AppModeProvider";
+import { IndexingRelations } from "@/app/_components/GlobalComponents/Layout/IndexingRelations";
+import { MentionedInSection } from "./MentionedInSection";
 
-interface ReferencingItem {
-  type: ItemType;
-  uuid: string;
-  title: string;
-  category: string;
-}
-
-interface ReferencedBySectionProps {
-  referencingItems: ReferencingItem[];
-}
+const ItemIcon = ({ item }: { item: RelatedItem }) => {
+  if (item.type === ItemTypes.NOTE)
+    return <File02Icon className="h-4 w-4 text-blue-500" />;
+  if (isKanbanType(item.checklistType))
+    return <TaskDaily01Icon className="h-4 w-4 text-green-500" />;
+  return <CheckmarkSquare04Icon className="h-4 w-4 text-green-500" />;
+};
 
 export const ReferencedBySection = ({
-  referencingItems,
-}: ReferencedBySectionProps) => {
+  className = "",
+}: {
+  className?: string;
+}) => {
   const router = useRouter();
   const t = useTranslations();
-  if (referencingItems.length === 0) return null;
+  const { appSettings } = useAppMode();
+  const { status, backlinks, mentions } = useRelations();
 
-  const handleItemClick = (item: ReferencingItem) => {
-    router.push(itemHref(item.type as ItemTypes, item.uuid));
-  };
+  if (appSettings?.editor?.enableBilateralLinks === false) return null;
+  if (status === RelationsStatus.BUILDING) {
+    return (
+      <div className={className}>
+        <IndexingRelations compact />
+      </div>
+    );
+  }
+  if (backlinks.length === 0 && mentions.length === 0) return null;
 
   return (
-    <div className="mt-8 space-y-4">
-      <h3 className="text-lg font-semibold text-foreground flex items-center gap-2">
-        <span>{t("notes.referencedBy")}</span>
-        <span className="text-md lg:text-sm text-muted-foreground font-normal">
-          ({referencingItems.length})
-        </span>
-      </h3>
+    <div className={className}>
+      {backlinks.length > 0 && (
+        <div className="mt-8 space-y-4">
+          <h3 className="text-lg font-semibold text-foreground flex items-center gap-2">
+            <span>{t("notes.referencedBy")}</span>
+            <span className="text-md lg:text-sm text-muted-foreground font-normal">
+              ({backlinks.length})
+            </span>
+          </h3>
 
-      <div className="space-y-2">
-        {referencingItems.map((item) => (
-          <div
-            key={`${item.type}-${item.uuid}`}
-            onClick={() => handleItemClick(item)}
-            className="bg-muted/50 border border-border rounded-jotty p-3 cursor-pointer hover:shadow-sm hover:border-primary/30 transition-all duration-200 group"
-          >
-            <div className="flex items-center gap-3">
-              <div className="flex-shrink-0">
-                {item.type === ItemTypes.NOTE ? (
-                  <File02Icon className="h-4 w-4 text-blue-500" />
-                ) : (
-                  <CheckmarkSquare04Icon className="h-4 w-4 text-green-500" />
-                )}
-              </div>
-              <div className="flex-1 min-w-0">
-                <span className="text-md lg:text-sm font-medium text-foreground group-hover:text-primary transition-colors">
-                  {item.title}
-                </span>
-              </div>
-              <div className="flex items-center gap-2">
-                <span className="text-md lg:text-xs text-muted-foreground capitalize">
-                  {item.type}
-                </span>
-                {item.category && item.category !== "Uncategorized" && (
-                  <>
-                    <span className="text-md lg:text-xs text-muted-foreground">•</span>
-                    <span className="text-md lg:text-xs bg-primary/10 text-primary px-2 py-0.5 rounded">
-                      {item.category.split("/").pop()}
+          <div className="space-y-2">
+            {backlinks.map((item) => (
+              <button
+                type="button"
+                key={`${item.type}-${item.uuid}`}
+                onClick={() => router.push(itemHref(item.type, item.uuid))}
+                className="w-full text-left bg-muted/50 border border-border rounded-jotty p-3 cursor-pointer hover:shadow-sm hover:border-primary/30 transition-all duration-200 group"
+              >
+                <div className="flex items-center gap-3">
+                  <div className="flex-shrink-0">
+                    <ItemIcon item={item} />
+                  </div>
+                  <div className="flex-1 min-w-0">
+                    <span className="text-md lg:text-sm font-medium text-foreground group-hover:text-primary transition-colors">
+                      {item.title}
+                    </span>
+                  </div>
+                  <div className="flex items-center gap-2">
+                    <span className="text-md lg:text-xs text-muted-foreground">
+                      {t(`relations.kind.${item.kind}`)}
                     </span>
-                  </>
-                )}
-              </div>
-            </div>
+                    {item.category && item.category !== UNCATEGORIZED && (
+                      <>
+                        <span className="text-md lg:text-xs text-muted-foreground">
+                          •
+                        </span>
+                        <span className="text-md lg:text-xs bg-primary/10 text-primary px-2 py-0.5 rounded">
+                          {item.category.split("/").pop()}
+                        </span>
+                      </>
+                    )}
+                  </div>
+                </div>
+              </button>
+            ))}
           </div>
-        ))}
-      </div>
+        </div>
+      )}
+      <MentionedInSection />
     </div>
   );
 };
diff --git a/app/_components/FeatureComponents/Notes/Parts/TableOfContents.tsx b/app/_components/FeatureComponents/Notes/Parts/TableOfContents.tsx
index a2f716dd7..f10e6b2ad 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TableOfContents.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TableOfContents.tsx
@@ -6,6 +6,14 @@ import { cn } from "@/app/_utils/global-utils";
 import { extractHeadings as extractHeadingsFromMarkdown } from "@/app/_utils/markdown-utils";
 import { useTranslations } from "next-intl";
 
+const HEADINGS = "h1, h2, h3, h4, h5, h6";
+const LINK_PREVIEW = "[data-link-preview]";
+
+const ownHeadings = (root: ParentNode): HTMLElement[] =>
+  Array.from(root.querySelectorAll<HTMLElement>(HEADINGS)).filter(
+    (heading) => !heading.closest(LINK_PREVIEW),
+  );
+
 interface Heading {
   id: string;
   text: string;
@@ -20,13 +28,8 @@ interface TableOfContentsProps {
 
 const findHeadingEl = (id: string, text: string): HTMLElement | null => {
   const byId = document.getElementById(id);
-  if (byId) return byId;
-  const allHeadings = document.querySelectorAll("h1, h2, h3, h4, h5, h6");
-  return (
-    (Array.from(allHeadings).find(
-      (h) => h.textContent?.trim() === text
-    ) as HTMLElement) ?? null
-  );
+  if (byId && !byId.closest(LINK_PREVIEW)) return byId;
+  return ownHeadings(document).find((h) => h.textContent?.trim() === text) ?? null;
 };
 
 const useTableOfContents = (content?: string, isEditing?: boolean) => {
@@ -49,7 +52,7 @@ const useTableOfContents = (content?: string, isEditing?: boolean) => {
     const extractHeadingsFromDOM = (): Heading[] => {
       const contentArea = document.querySelector(".prose, [class*='prose']");
       const searchRoot = contentArea || document.body;
-      const headingElements = searchRoot.querySelectorAll("h1, h2, h3, h4, h5, h6");
+      const headingElements = ownHeadings(searchRoot);
       const extracted: Heading[] = [];
 
       headingElements.forEach((element) => {
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLink.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLink.tsx
index 9b8731c90..40dcdd2da 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLink.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLink.tsx
@@ -30,9 +30,6 @@ export const InternalLink = Node.create({
       itemId: {
         default: null,
       },
-      convertToBidirectional: {
-        default: false,
-      },
     };
   },
 
@@ -49,7 +46,6 @@ export const InternalLink = Node.create({
             category: element.getAttribute("data-category"),
             uuid: element.getAttribute("data-uuid"),
             itemId: element.getAttribute("data-item-id"),
-            convertToBidirectional: element.getAttribute("data-convert-to-bidirectional") === "true",
           };
         },
       },
@@ -57,7 +53,7 @@ export const InternalLink = Node.create({
   },
 
   renderHTML({ node, HTMLAttributes }) {
-    const { href, title, type, category, uuid, itemId, convertToBidirectional } = node.attrs;
+    const { href, title, type, category, uuid, itemId } = node.attrs;
 
     const children: DOMOutputSpec[] = [];
 
@@ -78,7 +74,6 @@ export const InternalLink = Node.create({
         "data-category": category || "",
         "data-uuid": uuid || "",
         "data-item-id": itemId || "",
-        "data-convert-to-bidirectional": convertToBidirectional ? "true" : "false",
         ...HTMLAttributes,
       },
       ...children,
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx
index b90dbc093..5d0dde360 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx
@@ -1,311 +1,173 @@
 "use client";
 
-import React, { useState, useEffect, useCallback } from "react";
+import React, { useState, useEffect, useCallback, useMemo } from "react";
 import { NodeViewWrapper } from "@tiptap/react";
-import {
-  File02Icon,
-  CheckmarkSquare04Icon,
-  TaskDaily01Icon,
-  FileLinkIcon,
-  Attachment01Icon,
-} from "hugeicons-react";
+import { File02Icon, CheckmarkSquare04Icon, TaskDaily01Icon } from "hugeicons-react";
 import { useRouter } from "next/navigation";
+import { capitalize } from "lodash";
+import { useTranslations } from "next-intl";
 import { getNoteById } from "@/app/_server/actions/note";
 import { getListById } from "@/app/_server/actions/checklist";
-import { decodeCategoryPath, itemHref } from "@/app/_utils/global-utils";
-import { capitalize } from "lodash";
+import { itemHref } from "@/app/_utils/global-utils";
+import { parseItemHref } from "@/app/_utils/item-href-utils";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { NoteCard } from "@/app/_components/GlobalComponents/Cards/NoteCard";
 import { ChecklistCard } from "@/app/_components/GlobalComponents/Cards/ChecklistCard";
 import { Checklist, Note } from "@/app/_types";
 import { isKanbanType, ItemTypes } from "@/app/_types/enums";
-import { useTranslations } from "next-intl";
 
-interface InternalLinkComponentProps {
-  node: {
-    attrs: {
-      href: string;
-      title: string;
-      type: string;
-      category: string;
-      uuid: string;
-      itemId: string;
-      convertToBidirectional: boolean;
-    };
-  };
-  editor: any;
-  updateAttributes: (attrs: Record<string, any>) => void;
+interface InternalLinkAttrs {
+  href: string;
+  title: string;
+  type?: string;
+  category?: string;
+  uuid?: string;
+  itemId?: string;
 }
 
-const _returnNote = async (
-  uuid: string,
-  router: any,
-  note?: Note,
-): Promise<boolean> => {
-  const finalNote = note || (await getNoteById(uuid));
-
-  if (finalNote?.uuid) {
-    router.push(itemHref(ItemTypes.NOTE, finalNote.uuid));
-    return true;
-  }
+interface InternalLinkComponentProps {
+  node: { attrs: InternalLinkAttrs };
+}
 
-  return false;
-};
+type LinkedItem = Partial<Note> | Partial<Checklist>;
 
-const _returnChecklist = async (
-  uuid: string,
-  router: any,
-  checklist?: Checklist,
-): Promise<boolean> => {
-  const finalChecklist = checklist || (await getListById(uuid));
+const isChecklist = (item?: LinkedItem | null): item is Partial<Checklist> =>
+  Boolean(item && "type" in item && item.type);
 
-  if (finalChecklist?.uuid) {
-    router.push(itemHref(ItemTypes.CHECKLIST, finalChecklist.uuid));
-    return true;
+const _fetchItem = async (uuid: string, type?: ItemTypes): Promise<Note | Checklist | null> => {
+  if (type !== ItemTypes.CHECKLIST) {
+    const note = await getNoteById(uuid);
+    if (note) return note;
   }
-
-  return false;
+  if (type !== ItemTypes.NOTE) {
+    const list = await getListById(uuid);
+    if (list) return list;
+  }
+  return null;
 };
 
-export const InternalLinkComponent = ({
-  node,
-  editor,
-  updateAttributes,
-}: InternalLinkComponentProps) => {
+export const InternalLinkComponent = ({ node }: InternalLinkComponentProps) => {
   const t = useTranslations();
   const router = useRouter();
-  const { href, title, uuid, itemId, type, category, convertToBidirectional } =
-    node.attrs;
-  const [showPopup, setShowPopup] = useState(false);
-  const [loadedFullItem, setLoadedFullItem] = useState<Note | Checklist | null>(
-    null,
-  );
-  const [isLoadingItem, setIsLoadingItem] = useState(false);
-  const potentialCategory = href
-    ?.replace("/jotty/", "")
-    .replace("/note/", "")
-    .replace("/checklist/", "")
-    .split("/")
-    .slice(1, -1)
-    .join("/");
+  const { href, title, uuid: attrUuid, category } = node.attrs;
   const { appSettings, notes, checklists } = useAppMode();
+  const [showPopup, setShowPopup] = useState(false);
+  const [loadedItem, setLoadedItem] = useState<Note | Checklist | null>(null);
+  const [isLoading, setIsLoading] = useState(false);
 
-  const isEditable = editor?.isEditable ?? false;
-  const isPathBasedLink =
-    href?.startsWith("/note/") || href?.startsWith("/checklist/");
-  const isJottyLink = href?.startsWith("/jotty/");
-
-  const canToggle = isPathBasedLink || isJottyLink;
-
-  const metadataItem =
-    (notes.find((n) => n.uuid === uuid) as Partial<Note> | undefined) ||
-    (checklists.find((c) => c.uuid === uuid) as Partial<Checklist> | undefined);
+  const target = useMemo(() => parseItemHref(href), [href]);
+  const uuid = (target?.uuid || attrUuid || "").toLowerCase();
 
-  const fullItem = loadedFullItem || metadataItem;
+  const knownItem: LinkedItem | undefined = useMemo(
+    () =>
+      notes.find((note) => note.uuid?.toLowerCase() === uuid) ||
+      checklists.find((list) => list.uuid?.toLowerCase() === uuid),
+    [notes, checklists, uuid],
+  );
 
-  const loadFullItem = useCallback(async () => {
-    if (loadedFullItem || isLoadingItem || !uuid) return;
+  const item: LinkedItem | undefined = loadedItem || knownItem;
+  const type = item
+    ? isChecklist(item)
+      ? ItemTypes.CHECKLIST
+      : ItemTypes.NOTE
+    : target?.type;
 
-    setIsLoadingItem(true);
+  const loadItem = useCallback(async () => {
+    if (loadedItem || isLoading || !uuid) return;
+    setIsLoading(true);
     try {
-      const isChecklist =
-        metadataItem && "type" in metadataItem && metadataItem.type;
-      if (isChecklist) {
-        const checklist = await getListById(uuid);
-        if (checklist) setLoadedFullItem(checklist);
-      } else {
-        const note = await getNoteById(uuid);
-        if (note) setLoadedFullItem(note);
-      }
+      setLoadedItem(await _fetchItem(uuid, type));
     } catch (error) {
-      console.warn("Failed to load item for preview:", error);
+      console.warn("Failed to load linked item:", error);
     } finally {
-      setIsLoadingItem(false);
+      setIsLoading(false);
     }
-  }, [uuid, loadedFullItem, isLoadingItem, metadataItem]);
+  }, [loadedItem, isLoading, uuid, type]);
 
   useEffect(() => {
-    if (showPopup && !loadedFullItem && !isLoadingItem) {
-      loadFullItem();
-    }
-  }, [showPopup, loadedFullItem, isLoadingItem, loadFullItem]);
+    if (showPopup) loadItem();
+  }, [showPopup, loadItem]);
 
-  const handleClick = async (e: React.MouseEvent) => {
-    e.preventDefault();
+  const handleClick = async (event: React.MouseEvent) => {
+    event.preventDefault();
     if (!href) return;
 
-    if (href.startsWith("/jotty/")) {
-      const uuidFromPath = href.replace("/jotty/", "");
-
-      if (fullItem?.uuid) {
-        router.push(
-          itemHref(
-            "type" in fullItem && fullItem.type
-              ? ItemTypes.CHECKLIST
-              : ItemTypes.NOTE,
-            fullItem.uuid,
-          ),
-        );
-        return;
-      }
-
-      try {
-        if (await _returnNote(uuidFromPath, router)) return;
-      } catch (error) {
-        console.warn("Failed to resolve /jotty/ link:", error);
-      }
-      try {
-        if (await _returnChecklist(uuidFromPath, router)) return;
-      } catch (error) {
-        console.warn("Failed to resolve /jotty/ link:", error);
-      }
-    } else {
-      router.push(href);
+    if (uuid && type) {
+      router.push(itemHref(type, uuid));
       return;
     }
-  };
-
-  const handleToggleConversion = (e: React.MouseEvent) => {
-    e.preventDefault();
-    e.stopPropagation();
 
-    if (isJottyLink) {
-      const isChecklist = fullItem && "type" in fullItem && fullItem.type;
-      const targetUuid = fullItem?.uuid || uuid || href.replace("/jotty/", "");
-
-      if (targetUuid) {
-        updateAttributes({
-          href: itemHref(
-            isChecklist ? ItemTypes.CHECKLIST : ItemTypes.NOTE,
-            targetUuid,
-          ),
-          type: isChecklist ? "checklist" : "note",
-          category: fullItem?.category || category || "Uncategorized",
-          convertToBidirectional: false,
-        });
-      } else {
-        console.warn("Cannot convert jotty to path - missing data");
-      }
-    } else if (isPathBasedLink) {
-      const resolvedUuid =
-        uuid ||
-        fullItem?.uuid ||
-        notes.find((n) => n.id === itemId && (n.category || "") === (category || ""))?.uuid ||
-        checklists.find((c) => c.id === itemId && (c.category || "") === (category || ""))?.uuid;
-
-      if (resolvedUuid) {
-        updateAttributes({
-          href: `/jotty/${resolvedUuid}`,
-          uuid: resolvedUuid,
-          convertToBidirectional: false,
-        });
-      } else {
-        console.log("Could not find item to convert");
+    if (uuid) {
+      const found = await _fetchItem(uuid).catch((error) => {
+        console.warn("Failed to resolve linked item:", error);
+        return null;
+      });
+      if (found?.uuid) {
+        router.push(itemHref(isChecklist(found) ? ItemTypes.CHECKLIST : ItemTypes.NOTE, found.uuid));
       }
+      return;
     }
+
+    router.push(href);
   };
 
+  const label = item?.title || title;
+  const shownCategory = item?.category || target?.legacy?.category || category;
+
   return (
     <NodeViewWrapper
       as="span"
       onClick={handleClick}
-      onMouseEnter={() => {
-        setShowPopup(true);
-      }}
-      onMouseLeave={() => {
-        setShowPopup(false);
-      }}
+      onMouseEnter={() => setShowPopup(true)}
+      onMouseLeave={() => setShowPopup(false)}
       className="inline-flex items-center gap-1.5 mx-1 px-2 py-1 bg-primary/10 border border-primary/20 rounded-jotty hover:bg-primary/15 transition-colors cursor-pointer group relative"
     >
-      {showPopup &&
-        href &&
-        (href.startsWith("/jotty/") ||
-          href.startsWith("/note/") ||
-          href.startsWith("/checklist/")) && (
-          <span className="block absolute top-[110%] left-0 min-w-[300px] max-w-[400px] z-10">
-            {isLoadingItem ? (
-              <div className="bg-card border border-border rounded-jotty p-4 text-muted-foreground text-sm">
-                Loading...
-              </div>
-            ) : loadedFullItem &&
-              "type" in loadedFullItem &&
-              loadedFullItem.type ? (
-              <ChecklistCard
-                list={loadedFullItem as Checklist}
-                onSelect={() => {}}
-              />
-            ) : loadedFullItem ? (
-              <NoteCard
-                note={loadedFullItem as Note}
-                onSelect={() => {}}
-                fullScrollableContent
-              />
-            ) : (
-              <div className="bg-card border border-border rounded-jotty p-4 text-muted-foreground text-sm">
-                {metadataItem?.title || title}
-              </div>
-            )}
-          </span>
-        )}
+      {showPopup && (
+        <span
+          data-link-preview=""
+          className="block absolute top-[110%] left-0 min-w-[300px] max-w-[400px] z-10"
+        >
+          {isLoading ? (
+            <span className="block bg-card border border-border rounded-jotty p-4 text-muted-foreground text-sm">
+              {t("common.loading")}
+            </span>
+          ) : loadedItem && isChecklist(loadedItem) ? (
+            <ChecklistCard list={loadedItem as Checklist} onSelect={() => {}} />
+          ) : loadedItem ? (
+            <NoteCard note={loadedItem as Note} onSelect={() => {}} fullScrollableContent />
+          ) : (
+            <span className="block bg-card border border-border rounded-jotty p-4 text-muted-foreground text-sm">
+              {label}
+            </span>
+          )}
+        </span>
+      )}
       <span className="flex-shrink-0">
-        {fullItem && "type" in fullItem && fullItem.type ? (
-          <>
-            {isKanbanType(fullItem.type) ? (
-              <TaskDaily01Icon className="h-5 w-5" />
-            ) : (
-              <CheckmarkSquare04Icon className="h-5 w-5" />
-            )}
-          </>
+        {isChecklist(item) ? (
+          isKanbanType(item.type) ? (
+            <TaskDaily01Icon className="h-5 w-5" />
+          ) : (
+            <CheckmarkSquare04Icon className="h-5 w-5" />
+          )
         ) : (
           <File02Icon className="h-5 w-5" />
         )}
       </span>
       <span className="text-md lg:text-sm font-medium text-foreground">
-        {appSettings?.parseContent === "yes"
-          ? title
-          : capitalize(title.replace(/-/g, " "))}
+        {appSettings?.parseContent === "yes" ? label : capitalize(label.replace(/-/g, " "))}
       </span>
-      ·
-      <span className="text-md lg:text-sm font-medium text-foreground bg-primary/30 px-2 py-0.5 rounded-jotty">
-        {fullItem?.category ||
-          decodeCategoryPath(potentialCategory) ||
-          "not-found"}
-      </span>
-      {isEditable && (isPathBasedLink || canToggle) && (
-        <div className="flex items-center gap-1.5 ml-2 pl-2 border-l border-border">
-          <span className="text-md lg:text-xs text-muted-foreground">
-            {t("editor.linkType")}
+      {shownCategory && (
+        <>
+          ·
+          <span className="text-md lg:text-sm font-medium text-foreground bg-primary/30 px-2 py-0.5 rounded-jotty">
+            {shownCategory}
           </span>
-          <button
-            onClick={handleToggleConversion}
-            className={`flex items-center gap-1.5 px-2.5 py-1 rounded-jotty text-sm lg:text-xs font-medium transition-all ${
-              isJottyLink
-                ? "bg-blue-500/20 text-blue-800 hover:bg-blue-500/30 border border-blue-500/30"
-                : convertToBidirectional
-                  ? "bg-blue-500/20 text-blue-800 hover:bg-blue-500/30 border border-blue-500/30"
-                  : "bg-muted text-muted-foreground hover:bg-muted/80 border border-border"
-            }`}
-            title={
-              isJottyLink
-                ? "Click to convert to path-based link (cross-platform compatible)"
-                : convertToBidirectional
-                  ? "Will convert to bidirectional UUID link on save (enables backlinks)"
-                  : "Click to convert to bidirectional UUID link (enables backlinks)"
-            }
-          >
-            {isJottyLink || convertToBidirectional ? (
-              <>
-                <FileLinkIcon className="h-3.5 w-3.5" />
-                <span>{t("editor.bidirectional")}</span>
-              </>
-            ) : (
-              <>
-                <Attachment01Icon className="h-3.5 w-3.5" />
-                <span>{t("editor.pathBased")}</span>
-              </>
-            )}
-          </button>
-        </div>
+        </>
+      )}
+      {!item && !isLoading && (
+        <span className="text-md lg:text-xs text-muted-foreground">
+          {t("relations.unreachable")}
+        </span>
       )}
     </NodeViewWrapper>
   );
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/SlashCommands.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/SlashCommands.tsx
index 806e2114b..b181e7cd3 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/SlashCommands.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/SlashCommands.tsx
@@ -25,6 +25,12 @@ import { TagMentionsList } from "@/app/_components/FeatureComponents/Notes/Parts
 import { ItemType } from "@/app/_types";
 import { ItemTypes } from "@/app/_types/enums";
 import { PluginKey } from "@tiptap/pm/state";
+import { itemHref } from "@/app/_utils/global-utils";
+
+const WIKILINK_OPEN = "[[";
+
+const mentionable = <T extends { uuid?: string }>(items?: T[]): T[] =>
+  items?.filter((item) => Boolean(item.uuid)) || [];
 
 export interface SlashCommandItem {
   title: string;
@@ -317,7 +323,7 @@ export const SlashCommands = Extension.create({
           range: any;
           props: AtMentionItem;
         }) => {
-          const linkTarget = props.uuid ? `/jotty/${props.uuid}` : ``;
+          const linkTarget = props.uuid ? itemHref(props.type, props.uuid) : "";
           editor
             .chain()
             .focus()
@@ -331,7 +337,6 @@ export const SlashCommands = Extension.create({
                 category: props.category,
                 uuid: props.uuid,
                 itemId: props.id,
-                convertToBidirectional: false,
               },
             })
             .run();
@@ -572,12 +577,8 @@ export const SlashCommands = Extension.create({
     return {
       updateAtMentionData:
         (notes: any[], checklists: any[], username: string) => () => {
-          atMentionData.notes =
-            notes?.filter((note: any) => note.owner === username) || [];
-          atMentionData.checklists =
-            checklists?.filter(
-              (checklist: any) => checklist.owner === username
-            ) || [];
+          atMentionData.notes = mentionable(notes);
+          atMentionData.checklists = mentionable(checklists);
 
           return true;
         },
@@ -590,14 +591,8 @@ export const SlashCommands = Extension.create({
   },
 
   addProseMirrorPlugins() {
-    atMentionData.notes =
-      this.options.notes?.filter(
-        (note: any) => note.owner === this.options.username
-      ) || [];
-    atMentionData.checklists =
-      this.options.checklists?.filter(
-        (checklist: any) => checklist.owner === this.options.username
-      ) || [];
+    atMentionData.notes = mentionable(this.options.notes);
+    atMentionData.checklists = mentionable(this.options.checklists);
     tagSuggestionData.tags = this.options.tags || [];
 
     const plugins = [];
@@ -620,6 +615,15 @@ export const SlashCommands = Extension.create({
           pluginKey: new PluginKey("atSuggestion"),
         })
       );
+      plugins.push(
+        Suggestion({
+          editor: this.editor,
+          ...this.options.atSuggestion,
+          char: WIKILINK_OPEN,
+          allowSpaces: true,
+          pluginKey: new PluginKey("wikiSuggestion"),
+        })
+      );
     }
 
     if (this.options.enableTags) {
diff --git a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
index 9b43201b6..f958899cb 100644
--- a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
@@ -25,10 +25,15 @@ import { prism } from "@/app/_utils/prism-utils";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { InternalLinkComponent } from "./TipTap/CustomExtensions/InternalLinkComponent";
 import { TagLinkViewComponent } from "@/app/_components/FeatureComponents/Tags/TagLinkComponent";
-import { ItemTypes } from "@/app/_types/enums";
 import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
-import { decodeCategoryPath, decodeSegment } from "@/app/_utils/global-utils";
-import { isUuid } from "@/app/_consts/identity";
+import { currentOrigins, parseItemHref } from "@/app/_utils/item-href-utils";
+import { remarkWikilinks, WIKILINK_TAG } from "@/app/_utils/wikilink-utils";
+import { WikiLink } from "./WikiLink";
+
+type WikiLinkComponents = Record<
+  typeof WIKILINK_TAG,
+  (props: { target?: string; label?: string }) => React.ReactElement
+>;
 import { NoteFooterStats } from "@/app/_components/GlobalComponents/Statistics/NoteFooterStats";
 import { useTranslations } from "next-intl";
 import {
@@ -157,7 +162,10 @@ export const UnifiedMarkdownRenderer = ({
     );
   }
 
-  const components: Partial<Components> = {
+  const components: Partial<Components> & WikiLinkComponents = {
+    [WIKILINK_TAG]: ({ target, label }: { target?: string; label?: string }) => (
+      <WikiLink target={target} label={label} />
+    ),
     table: ({ node, children, ...props }) => (
       <div className="jotty-x-scroll">
         <table {...props}>{children}</table>
@@ -214,51 +222,21 @@ export const UnifiedMarkdownRenderer = ({
       const childText = String(children);
       const isFileAttachment = childText.startsWith("📎 ") && href;
       const isVideoAttachment = childText.startsWith("🎥 ") && href;
-      const isInternalLink =
-        href &&
-        (href?.includes("/note/") ||
-          href?.includes("/checklist/") ||
-          href?.startsWith("/jotty/"));
-
-      if (isInternalLink) {
-        let linkType: ItemTypes;
-        let linkCategory: string | null = null;
-        let linkUuid: string | null = null;
-        let linkItemId: string = "";
-
-        if (href?.startsWith("/jotty/")) {
-          linkUuid = href.replace("/jotty/", "");
-          linkType = ItemTypes.NOTE;
-        } else {
-          linkType = href?.includes("/note/")
-            ? ItemTypes.NOTE
-            : ItemTypes.CHECKLIST;
-          const pathParts = href
-            ?.replace("/checklist/", "")
-            .replace("/note/", "")
-            .split("/");
-          linkItemId = decodeSegment(pathParts?.[pathParts.length - 1] || "");
-          linkUuid = isUuid(linkItemId) ? linkItemId : null;
-          linkCategory = decodeCategoryPath(
-            pathParts?.slice(0, -1).join("/") || "",
-          );
-        }
+      const itemTarget = parseItemHref(href, currentOrigins());
 
+      if (href && itemTarget) {
         return (
           <InternalLinkComponent
             node={{
               attrs: {
-                href: href || "",
+                href,
                 title: childText,
-                type: linkType,
-                category: linkCategory || "Uncategorized",
-                uuid: linkUuid || "",
-                itemId: linkItemId,
-                convertToBidirectional: false,
+                type: itemTarget.type,
+                category: itemTarget.legacy?.category,
+                uuid: itemTarget.uuid,
+                itemId: itemTarget.legacy?.id,
               },
             }}
-            editor={undefined as any}
-            updateAttributes={() => {}}
           />
         );
       }
@@ -595,7 +573,7 @@ export const UnifiedMarkdownRenderer = ({
         className={`prose prose-sm sm:prose-base lg:prose-lg xl:prose-2xl dark:prose-invert [&_ul]:list-disc [&_ol]:list-decimal [&_table]:border-collapse [&_table]:w-full [&_table]:my-4 [&_th]:border [&_th]:border-border [&_th]:px-3 [&_th]:py-2 [&_th]:bg-muted [&_th]:font-semibold [&_th]:text-left [&_td]:border [&_td]:border-border [&_td]:px-3 [&_td]:py-2 [&_tr:nth-child(even)]:bg-muted/50 ${className}`}
       >
         <ReactMarkdown
-          remarkPlugins={[remarkGfm]}
+          remarkPlugins={[remarkGfm, remarkWikilinks]}
           rehypePlugins={[rehypeSlug, rehypeRaw]}
           components={components}
         >
diff --git a/app/_components/FeatureComponents/Notes/Parts/WikiLink.tsx b/app/_components/FeatureComponents/Notes/Parts/WikiLink.tsx
new file mode 100644
index 000000000..bfbecc7b1
--- /dev/null
+++ b/app/_components/FeatureComponents/Notes/Parts/WikiLink.tsx
@@ -0,0 +1,113 @@
+"use client";
+
+import { useMemo, useState } from "react";
+import { useRouter } from "next/navigation";
+import { useTranslations } from "next-intl";
+import { FileAddIcon } from "hugeicons-react";
+import { useAppMode } from "@/app/_providers/AppModeProvider";
+import { useOptionalMetadata } from "@/app/_providers/MetadataProvider";
+import { useRelations } from "@/app/_providers/RelationsProvider";
+import { createNote } from "@/app/_server/actions/note";
+import { itemHref } from "@/app/_utils/global-utils";
+import { ItemTypes } from "@/app/_types/enums";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { InternalLinkComponent } from "./TipTap/CustomExtensions/InternalLinkComponent";
+
+interface WikiLinkProps {
+  target?: string;
+  label?: string;
+}
+
+interface Candidate {
+  type: ItemTypes;
+  uuid?: string;
+  title?: string;
+  owner?: string;
+  createdAt?: string;
+}
+
+const titleKey = (title = "") => title.trim().replace(/\s+/g, " ").toLowerCase();
+
+const byAge = (a: Candidate, b: Candidate) =>
+  (a.createdAt || "").localeCompare(b.createdAt || "") ||
+  (a.uuid || "").localeCompare(b.uuid || "");
+
+export const WikiLink = ({ target = "", label }: WikiLinkProps) => {
+  const t = useTranslations();
+  const router = useRouter();
+  const { notes, checklists, user } = useAppMode();
+  const { wikis } = useRelations();
+  const metadata = useOptionalMetadata();
+  const [isCreating, setIsCreating] = useState(false);
+
+  const match = useMemo(() => {
+    const key = titleKey(target);
+    const candidates: Candidate[] = [
+      ...notes.map((item) => ({ ...item, type: ItemTypes.NOTE })),
+      ...checklists.map((item) => ({ ...item, type: ItemTypes.CHECKLIST })),
+    ].filter((item) => item.uuid);
+
+    const bound = wikis[key]?.toLowerCase();
+    if (bound) {
+      const pinned = candidates.find((item) => item.uuid!.toLowerCase() === bound);
+      if (pinned) return pinned;
+    }
+
+    return (
+      candidates
+        .filter((item) => (!item.owner || item.owner === user?.username) && titleKey(item.title) === key)
+        .sort(byAge)[0] || null
+    );
+  }, [notes, checklists, target, wikis, user?.username]);
+
+  if (!user) return <span>{label || target}</span>;
+
+  if (match) {
+    return (
+      <InternalLinkComponent
+        node={{
+          attrs: {
+            href: itemHref(match.type, match.uuid!),
+            title: label || target,
+            type: match.type,
+            uuid: match.uuid!,
+          },
+        }}
+      />
+    );
+  }
+
+  const createFromGhost = async () => {
+    if (isCreating || !target.trim()) return;
+    setIsCreating(true);
+    try {
+      const formData = new FormData();
+      formData.append("title", target.trim());
+      formData.append("category", metadata?.category || UNCATEGORIZED);
+      formData.append("rawContent", "");
+      const result = await createNote(formData);
+      if (result.success && result.data?.uuid) {
+        router.push(itemHref(ItemTypes.NOTE, result.data.uuid));
+        return;
+      }
+      console.error("Could not create note from wikilink:", result.error);
+    } catch (error) {
+      console.error("Could not create note from wikilink:", error);
+    } finally {
+      setIsCreating(false);
+    }
+  };
+
+  return (
+    <button
+      type="button"
+      onClick={createFromGhost}
+      disabled={isCreating}
+      title={t("relations.createFromWikilink", { title: target })}
+      className="inline-flex items-center gap-1.5 mx-1 px-2 py-0.5 border border-dashed border-muted-foreground/50 text-muted-foreground rounded-jotty hover:border-primary hover:text-primary transition-colors"
+    >
+      <FileAddIcon className="h-4 w-4" />
+      <span className="text-md lg:text-sm">{label || target}</span>
+    </button>
+  );
+};
diff --git a/app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/ConnectionsGraph.tsx b/app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/ConnectionsGraph.tsx
deleted file mode 100644
index 362bd7d95..000000000
--- a/app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/ConnectionsGraph.tsx
+++ /dev/null
@@ -1,615 +0,0 @@
-"use client";
-
-import { useEffect, useMemo, useRef, useState } from "react";
-import type { PointerEvent } from "react";
-import ForceGraph2D, {
-  ForceGraphMethods,
-  LinkObject,
-  NodeObject,
-} from "react-force-graph-2d";
-import { useRouter } from "next/navigation";
-import { CheckmarkSquare04Icon, File02Icon } from "hugeicons-react";
-import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
-import { ItemTypes } from "@/app/_types/enums";
-import {
-  ConnectionGraphData,
-  ConnectionGraphLink,
-  ConnectionGraphNode,
-} from "./graph-data";
-
-interface ConnectionsGraphProps {
-  graphData: ConnectionGraphData;
-  selectedNodeId: string | null;
-  onSelectedNodeChange: (nodeId: string | null) => void;
-  showLabels: boolean;
-  showArrows: boolean;
-  nodeScale: number;
-  linkWidth: number;
-  linkDistance: number;
-  repelForce: number;
-  labels: ConnectionsGraphLabels;
-}
-
-export interface ConnectionsGraphLabels {
-  unknown: string;
-  total: string;
-  inbound: string;
-  outbound: string;
-  updated: string;
-  uuid: string;
-  openItem: string;
-  selectItem: string;
-  inspectHint: string;
-  linkedItems: string;
-}
-
-type CanvasNode = NodeObject<ConnectionGraphNode> & ConnectionGraphNode;
-type CanvasLink = LinkObject<ConnectionGraphNode, ConnectionGraphLink> &
-  ConnectionGraphLink;
-type GraphRef = ForceGraphMethods<
-  NodeObject<ConnectionGraphNode>,
-  LinkObject<ConnectionGraphNode, ConnectionGraphLink>
->;
-type LabelHitBox = {
-  node: CanvasNode;
-  left: number;
-  right: number;
-  top: number;
-  bottom: number;
-};
-type AxisForce = ((alpha: number) => void) & {
-  initialize: (nodes: CanvasNode[]) => void;
-};
-
-const TYPE_COLORS: Record<string, string> = {
-  [ItemTypes.NOTE]: "#3b82f6",
-  [ItemTypes.CHECKLIST]: "#10b981",
-};
-
-const getLinkId = (
-  value: string | number | NodeObject<ConnectionGraphNode> | undefined,
-) => {
-  if (typeof value === "string" || typeof value === "number") {
-    return String(value);
-  }
-  return value?.id ? String(value.id) : "";
-};
-
-const MIN_POINTER_RADIUS = 24;
-const COARSE_POINTER_RADIUS = 36;
-const CLICK_MOVE_TOLERANCE = 10;
-const LONG_RANGE_REPEL_FACTOR = 4;
-const MIN_REPEL_DISTANCE_MAX = 260;
-const CENTER_PULL_STRENGTH = 0.035;
-
-const getNodeRadius = (node: ConnectionGraphNode, scale: number) =>
-  Math.max(4, Math.min(18, 4 + node.connectionCount * 1.1)) * scale;
-
-const createAxisForce = (axis: "x" | "y", strength: number): AxisForce => {
-  let nodes: CanvasNode[] = [];
-  const velocity = axis === "x" ? "vx" : "vy";
-
-  const force = ((alpha: number) => {
-    nodes.forEach((node) => {
-      const position = node[axis] || 0;
-      node[velocity] =
-        (node[velocity] || 0) + (0 - position) * strength * alpha;
-    });
-  }) as AxisForce;
-
-  force.initialize = (nextNodes: CanvasNode[]) => {
-    nodes = nextNodes;
-  };
-
-  return force;
-};
-
-const formatDate = (value: string) => {
-  return new Intl.DateTimeFormat(undefined, {
-    month: "short",
-    day: "numeric",
-    year: "numeric",
-  }).format(new Date(value));
-};
-
-export const ConnectionsGraph = ({
-  graphData,
-  selectedNodeId,
-  onSelectedNodeChange,
-  showLabels,
-  showArrows,
-  nodeScale,
-  linkWidth,
-  linkDistance,
-  repelForce,
-  labels,
-}: ConnectionsGraphProps) => {
-  const graphRef = useRef<GraphRef | undefined>(undefined);
-  const containerRef = useRef<HTMLDivElement | null>(null);
-  const hasFitGraphRef = useRef(false);
-  const labelHitBoxesRef = useRef<LabelHitBox[]>([]);
-  const pointerDownRef = useRef<{
-    x: number;
-    y: number;
-    pointerId: number;
-  } | null>(null);
-  const router = useRouter();
-  const [dimensions, setDimensions] = useState({ width: 900, height: 620 });
-  const [isCoarsePointer, setIsCoarsePointer] = useState(false);
-
-  const selectedNode = useMemo(
-    () => graphData.nodes.find((node) => node.id === selectedNodeId) || null,
-    [graphData.nodes, selectedNodeId],
-  );
-  const inspectedNode = selectedNode;
-  const nodeById = useMemo(
-    () => new Map(graphData.nodes.map((node) => [node.id, node])),
-    [graphData.nodes],
-  );
-  const linkedNodes = useMemo(() => {
-    if (!inspectedNode) return [];
-
-    const seen = new Set<string>();
-    return graphData.links
-      .flatMap((link) => {
-        if (link.source === inspectedNode.id) return [link.target];
-        if (link.target === inspectedNode.id) return [link.source];
-        return [];
-      })
-      .filter((nodeId) => {
-        if (seen.has(nodeId)) return false;
-        seen.add(nodeId);
-        return true;
-      })
-      .map((nodeId) => nodeById.get(nodeId))
-      .filter((node): node is ConnectionGraphNode => Boolean(node))
-      .sort((a, b) => a.title.localeCompare(b.title));
-  }, [graphData.links, inspectedNode, nodeById]);
-  const canvasGraphData = useMemo(
-    () => ({
-      nodes: graphData.nodes.map((node) => ({ ...node })),
-      links: graphData.links.map((link) => ({ ...link })),
-    }),
-    [graphData],
-  );
-
-  const neighborIds = useMemo(() => {
-    if (!selectedNodeId) return new Set<string>();
-    const ids = new Set<string>([selectedNodeId]);
-    graphData.links.forEach((link) => {
-      if (link.source === selectedNodeId) ids.add(link.target);
-      if (link.target === selectedNodeId) ids.add(link.source);
-    });
-    return ids;
-  }, [graphData.links, selectedNodeId]);
-
-  useEffect(() => {
-    const coarsePointerQuery = window.matchMedia("(pointer: coarse)");
-    const updatePointerMode = () =>
-      setIsCoarsePointer(coarsePointerQuery.matches);
-
-    updatePointerMode();
-    coarsePointerQuery.addEventListener("change", updatePointerMode);
-    return () =>
-      coarsePointerQuery.removeEventListener("change", updatePointerMode);
-  }, []);
-
-  useEffect(() => {
-    const updateDimensions = () => {
-      if (!containerRef.current) return;
-      const rect = containerRef.current.getBoundingClientRect();
-      setDimensions({
-        width: Math.max(320, Math.round(rect.width)),
-        height: Math.max(420, Math.round(rect.height)),
-      });
-    };
-
-    updateDimensions();
-    const observer = new ResizeObserver(updateDimensions);
-    if (containerRef.current) observer.observe(containerRef.current);
-    return () => observer.disconnect();
-  }, []);
-
-  useEffect(() => {
-    const chargeForce = graphRef.current?.d3Force("charge");
-    chargeForce?.strength(-repelForce);
-    chargeForce?.distanceMax?.(
-      Math.max(MIN_REPEL_DISTANCE_MAX, linkDistance * LONG_RANGE_REPEL_FACTOR),
-    );
-    graphRef.current?.d3Force("link")?.distance(linkDistance);
-    graphRef.current?.d3Force("x", createAxisForce("x", CENTER_PULL_STRENGTH));
-    graphRef.current?.d3Force("y", createAxisForce("y", CENTER_PULL_STRENGTH));
-    graphRef.current?.d3ReheatSimulation();
-    hasFitGraphRef.current = false;
-  }, [linkDistance, repelForce]);
-
-  useEffect(() => {
-    graphRef.current?.d3ReheatSimulation();
-    hasFitGraphRef.current = false;
-  }, [graphData.nodes.length, graphData.links.length]);
-
-  const focusNode = (node: CanvasNode) => {
-    onSelectedNodeChange(node.id);
-    if (node.x !== undefined && node.y !== undefined) {
-      graphRef.current?.centerAt(node.x, node.y, 650);
-      graphRef.current?.zoom(2.4, 650);
-    }
-  };
-
-  const openNode = (node: ConnectionGraphNode) => {
-    router.push(node.url);
-  };
-
-  const findNodeAtPointer = (clientX: number, clientY: number) => {
-    const graph = graphRef.current;
-    const container = containerRef.current;
-    if (!graph || !container) return null;
-
-    const rect = container.getBoundingClientRect();
-    const pointerX = clientX - rect.left;
-    const pointerY = clientY - rect.top;
-    const zoom = Math.max(0.001, graph.zoom());
-    const minimumRadius = isCoarsePointer
-      ? COARSE_POINTER_RADIUS
-      : MIN_POINTER_RADIUS;
-    const graphPosition = graph.screen2GraphCoords(pointerX, pointerY);
-
-    const labelHit = labelHitBoxesRef.current.find(
-      (box) =>
-        graphPosition.x >= box.left &&
-        graphPosition.x <= box.right &&
-        graphPosition.y >= box.top &&
-        graphPosition.y <= box.bottom,
-    );
-    if (labelHit) return labelHit.node;
-
-    let closestNode: CanvasNode | null = null;
-    let closestDistance = Number.POSITIVE_INFINITY;
-
-    canvasGraphData.nodes.forEach((node) => {
-      const canvasNode = node as CanvasNode;
-      if (canvasNode.x === undefined || canvasNode.y === undefined) return;
-
-      const screenPosition = graph.graph2ScreenCoords(
-        canvasNode.x,
-        canvasNode.y,
-      );
-      const distance = Math.hypot(
-        screenPosition.x - pointerX,
-        screenPosition.y - pointerY,
-      );
-      const hitRadius = Math.max(
-        minimumRadius,
-        getNodeRadius(canvasNode, nodeScale) * zoom,
-      );
-
-      if (distance <= hitRadius && distance < closestDistance) {
-        closestNode = canvasNode;
-        closestDistance = distance;
-      }
-    });
-
-    return closestNode;
-  };
-
-  const handlePointerDownCapture = (event: PointerEvent<HTMLDivElement>) => {
-    pointerDownRef.current = {
-      x: event.clientX,
-      y: event.clientY,
-      pointerId: event.pointerId,
-    };
-  };
-
-  const handlePointerUpCapture = (event: PointerEvent<HTMLDivElement>) => {
-    const start = pointerDownRef.current;
-    pointerDownRef.current = null;
-    if (!start || start.pointerId !== event.pointerId) return;
-
-    const moved = Math.hypot(event.clientX - start.x, event.clientY - start.y);
-    if (moved > CLICK_MOVE_TOLERANCE) return;
-
-    const node = findNodeAtPointer(event.clientX, event.clientY);
-    if (!node) return;
-
-    event.preventDefault();
-    event.stopPropagation();
-
-    if (event.detail >= 2) {
-      openNode(node);
-      return;
-    }
-
-    focusNode(node);
-  };
-
-  return (
-    <div className="grid gap-4 xl:grid-cols-[minmax(0,1fr)_320px]">
-      <div
-        ref={containerRef}
-        onPointerDownCapture={handlePointerDownCapture}
-        onPointerUpCapture={handlePointerUpCapture}
-        className="h-[62vh] min-h-[460px] overflow-hidden rounded-jotty border border-border bg-card"
-      >
-        <ForceGraph2D
-          ref={graphRef}
-          width={dimensions.width}
-          height={dimensions.height}
-          graphData={canvasGraphData}
-          nodeId="id"
-          linkDirectionalArrowLength={(link) =>
-            showArrows && (link as CanvasLink).type === "explicit" ? 5 : 0
-          }
-          linkDirectionalArrowRelPos={1}
-          linkWidth={(link) => {
-            const canvasLink = link as CanvasLink;
-            const sourceId = getLinkId(canvasLink.source);
-            const targetId = getLinkId(canvasLink.target);
-            const highlighted =
-              !selectedNodeId ||
-              sourceId === selectedNodeId ||
-              targetId === selectedNodeId;
-            return highlighted
-              ? canvasLink.type === "tag"
-                ? Math.max(0.5, linkWidth * 0.7)
-                : linkWidth
-              : Math.max(0.5, linkWidth * 0.5);
-          }}
-          linkColor={(link) => {
-            const canvasLink = link as CanvasLink;
-            const sourceId = getLinkId(canvasLink.source);
-            const targetId = getLinkId(canvasLink.target);
-            if (
-              !selectedNodeId ||
-              sourceId === selectedNodeId ||
-              targetId === selectedNodeId
-            ) {
-              return canvasLink.type === "tag"
-                ? "rgba(244,114,182,0.46)"
-                : "rgba(148,163,184,0.7)";
-            }
-            return "rgba(148,163,184,0.18)";
-          }}
-          nodeRelSize={nodeScale}
-          nodeVal={(node) =>
-            Math.max(1.8, Math.min(9, 2 + (node as CanvasNode).weight))
-          }
-          nodeCanvasObject={(node, ctx, globalScale) => {
-            const canvasNode = node as CanvasNode;
-            const baseColor =
-              TYPE_COLORS[canvasNode.type] || TYPE_COLORS[ItemTypes.NOTE];
-            const radius = getNodeRadius(canvasNode, nodeScale);
-            const isSelected = selectedNodeId === canvasNode.id;
-            const isNeighbor = neighborIds.has(canvasNode.id);
-            const dimmed = selectedNodeId && !isNeighbor;
-
-            ctx.beginPath();
-            ctx.arc(
-              canvasNode.x || 0,
-              canvasNode.y || 0,
-              radius,
-              0,
-              2 * Math.PI,
-            );
-            ctx.fillStyle = dimmed ? "rgba(148,163,184,0.35)" : baseColor;
-            ctx.fill();
-
-            if (isSelected) {
-              ctx.lineWidth = 3 / globalScale;
-              ctx.strokeStyle = "#f8fafc";
-              ctx.stroke();
-            }
-          }}
-          onRenderFramePost={(ctx, globalScale) => {
-            labelHitBoxesRef.current = [];
-            if (!showLabels && !selectedNodeId) return;
-
-            const boxes: LabelHitBox[] = [];
-            const fontSize = Math.max(10, 13 / globalScale);
-            const paddingX = 4 / globalScale;
-            const paddingY = 3 / globalScale;
-            const gap = 6 / globalScale;
-            const sortedNodes = [...canvasGraphData.nodes].sort((a, b) => {
-              if (a.id === selectedNodeId) return -1;
-              if (b.id === selectedNodeId) return 1;
-              return b.connectionCount - a.connectionCount;
-            });
-
-            ctx.font = `600 ${fontSize}px Inter, system-ui, sans-serif`;
-            ctx.textAlign = "left";
-            ctx.textBaseline = "middle";
-
-            sortedNodes.forEach((node) => {
-              const canvasNode = node as CanvasNode;
-              if (canvasNode.x === undefined || canvasNode.y === undefined)
-                return;
-
-              const isPriority = canvasNode.id === selectedNodeId;
-              if (!showLabels && !isPriority) return;
-
-              const radius = getNodeRadius(canvasNode, nodeScale);
-              const label = canvasNode.label.slice(0, 34);
-              const textWidth = ctx.measureText(label).width;
-              const x = canvasNode.x + radius + gap;
-              const y = canvasNode.y;
-              const box = {
-                left: x - paddingX,
-                right: x + textWidth + paddingX,
-                top: y - fontSize / 2 - paddingY,
-                bottom: y + fontSize / 2 + paddingY,
-              };
-              const overlaps = boxes.some(
-                (existing) =>
-                  box.left < existing.right &&
-                  box.right > existing.left &&
-                  box.top < existing.bottom &&
-                  box.bottom > existing.top,
-              );
-
-              if (overlaps && !isPriority) return;
-
-              const hitBox = { ...box, node: canvasNode };
-              boxes.push(hitBox);
-              labelHitBoxesRef.current.push(hitBox);
-              ctx.fillStyle = "rgba(15,23,42,0.92)";
-              ctx.fillText(label, x, y);
-            });
-          }}
-          nodePointerAreaPaint={(node, color, ctx, globalScale) => {
-            const canvasNode = node as CanvasNode;
-            const radius = Math.max(
-              MIN_POINTER_RADIUS / globalScale,
-              getNodeRadius(canvasNode, nodeScale),
-            );
-            ctx.fillStyle = color;
-            ctx.beginPath();
-            ctx.arc(
-              canvasNode.x || 0,
-              canvasNode.y || 0,
-              radius,
-              0,
-              2 * Math.PI,
-            );
-            ctx.fill();
-          }}
-          onNodeClick={(node, event) => {
-            if (event.detail >= 2) {
-              openNode(node as ConnectionGraphNode);
-              return;
-            }
-            focusNode(node as CanvasNode);
-          }}
-          onNodeRightClick={(node) => openNode(node as ConnectionGraphNode)}
-          onBackgroundClick={() => onSelectedNodeChange(null)}
-          onNodeDragEnd={(node) => {
-            node.fx = node.x;
-            node.fy = node.y;
-            graphRef.current?.pauseAnimation();
-          }}
-          onEngineStop={() => {
-            if (!hasFitGraphRef.current) {
-              graphRef.current?.zoomToFit(450, 40);
-              hasFitGraphRef.current = true;
-            }
-            graphRef.current?.pauseAnimation();
-          }}
-          cooldownTicks={70}
-          cooldownTime={2500}
-          d3AlphaDecay={0.08}
-          enableNodeDrag={!isCoarsePointer}
-        />
-      </div>
-
-      <aside className="rounded-jotty border border-border bg-card p-4">
-        {inspectedNode ? (
-          <div className="space-y-4">
-            <div>
-              <div className="text-xs uppercase tracking-wide text-muted-foreground">
-                {inspectedNode.type}
-              </div>
-              <h3 className="break-words text-lg font-semibold">
-                {inspectedNode.title}
-              </h3>
-              <p className="text-sm text-muted-foreground">
-                {inspectedNode.category}
-              </p>
-            </div>
-
-            <div className="grid grid-cols-3 gap-2 text-center">
-              <div className="rounded-jotty bg-secondary p-2">
-                <div className="text-lg font-semibold">
-                  {inspectedNode.connectionCount}
-                </div>
-                <div className="text-xs text-muted-foreground">
-                  {labels.total}
-                </div>
-              </div>
-              <div className="rounded-jotty bg-secondary p-2">
-                <div className="text-lg font-semibold">
-                  {inspectedNode.inboundCount}
-                </div>
-                <div className="text-xs text-muted-foreground">
-                  {labels.inbound}
-                </div>
-              </div>
-              <div className="rounded-jotty bg-secondary p-2">
-                <div className="text-lg font-semibold">
-                  {inspectedNode.outboundCount}
-                </div>
-                <div className="text-xs text-muted-foreground">
-                  {labels.outbound}
-                </div>
-              </div>
-            </div>
-
-            <div className="space-y-2 text-sm">
-              <div className="flex justify-between gap-3">
-                <span className="text-muted-foreground">{labels.updated}</span>
-                <span>
-                  {inspectedNode.updatedAt
-                    ? formatDate(inspectedNode.updatedAt)
-                    : labels.unknown}
-                </span>
-              </div>
-              <div className="flex justify-between gap-3">
-                <span className="text-muted-foreground">{labels.uuid}</span>
-                <span className="truncate font-mono text-xs">
-                  {inspectedNode.id}
-                </span>
-              </div>
-            </div>
-
-            {inspectedNode.tags.length > 0 && (
-              <div className="flex flex-wrap gap-2">
-                {inspectedNode.tags.map((tag) => (
-                  <span
-                    key={tag}
-                    className="rounded-jotty bg-secondary px-2 py-1 text-xs"
-                  >
-                    #{tag}
-                  </span>
-                ))}
-              </div>
-            )}
-
-            {linkedNodes.length > 0 && (
-              <div className="space-y-2">
-                <div className="text-sm font-medium">{labels.linkedItems}</div>
-                <div className="max-h-48 space-y-1.5 overflow-y-auto pr-2">
-                  {linkedNodes.map((node) => {
-                    const Icon =
-                      node.type === ItemTypes.CHECKLIST
-                        ? CheckmarkSquare04Icon
-                        : File02Icon;
-
-                    return (
-                      <button
-                        key={node.id}
-                        type="button"
-                        onClick={() => openNode(node)}
-                        className="flex w-full items-center gap-2 rounded-jotty border border-border px-2.5 py-2 text-left text-sm transition-colors hover:bg-secondary"
-                      >
-                        <Icon className="h-4 w-4 shrink-0 text-muted-foreground" />
-                        <span className="min-w-0 truncate">{node.title}</span>
-                      </button>
-                    );
-                  })}
-                </div>
-              </div>
-            )}
-
-            <Button onClick={() => openNode(inspectedNode)} className="w-full">
-              {labels.openItem}
-            </Button>
-          </div>
-        ) : (
-          <div className="space-y-3 text-sm text-muted-foreground">
-            <h3 className="text-base font-semibold text-foreground">
-              {labels.selectItem}
-            </h3>
-            <p>{labels.inspectHint}</p>
-          </div>
-        )}
-      </aside>
-    </div>
-  );
-};
diff --git a/app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/graph-data.ts b/app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/graph-data.ts
deleted file mode 100644
index 1399d3907..000000000
--- a/app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/graph-data.ts
+++ /dev/null
@@ -1,335 +0,0 @@
-import { Checklist, ItemType, LinkIndex, Note } from "@/app/_types";
-import { ItemTypes } from "@/app/_types/enums";
-import { itemHref } from "@/app/_utils/global-utils";
-import { isUuid } from "@/app/_consts/identity";
-
-export const MAX_GRAPH_NODES = 600;
-export const MAX_TAG_LINK_FANOUT = 8;
-
-export interface ConnectionGraphNode {
-  id: string;
-  label: string;
-  title: string;
-  type: ItemType;
-  category: string;
-  itemId: string;
-  path: string;
-  url: string;
-  tags: string[];
-  createdAt?: string;
-  updatedAt?: string;
-  inboundCount: number;
-  outboundCount: number;
-  connectionCount: number;
-  weight: number;
-  orphan: boolean;
-}
-
-export interface ConnectionGraphLink {
-  source: string;
-  target: string;
-  directed: boolean;
-  type: "explicit" | "tag";
-  tag?: string;
-}
-
-export interface ConnectionGraphData {
-  nodes: ConnectionGraphNode[];
-  links: ConnectionGraphLink[];
-  totalNodes: number;
-  totalLinks: number;
-  truncated: number;
-}
-
-export interface ConnectionGraphFilters {
-  search: string;
-  showNotes: boolean;
-  showChecklists: boolean;
-  showOrphans: boolean;
-  showTagLinks: boolean;
-}
-
-type ItemLike = Partial<Note> | Partial<Checklist>;
-
-const fallbackTitle = (type: ItemType, id: string) =>
-  `${type === ItemTypes.CHECKLIST ? "Checklist" : "Note"} ${id.slice(0, 8)}`;
-
-const getItemKey = (item: ItemLike) =>
-  `${item.category || "Uncategorized"}/${item.id || ""}`;
-
-const normalizeTag = (tag: string) => tag.trim().replace(/^#/, "").toLowerCase();
-
-const addItemToMaps = (
-  item: ItemLike,
-  type: ItemType,
-  itemsByUuid: Map<string, { item: ItemLike; type: ItemType }>,
-  uuidByLegacyKey: Map<string, string>,
-) => {
-  if (!item.uuid) return;
-  itemsByUuid.set(item.uuid, { item, type });
-  if (item.id) {
-    uuidByLegacyKey.set(getItemKey(item), item.uuid);
-  }
-};
-
-export const resolveGraphId = (
-  rawId: string,
-  uuidByLegacyKey: Map<string, string>,
-) => {
-  if (isUuid(rawId)) return rawId;
-  return uuidByLegacyKey.get(rawId) || rawId;
-};
-
-export const buildArchivedIdSet = (archivedItems: ItemLike[]) => {
-  const archived = new Set<string>();
-  archivedItems.forEach((item) => {
-    if (item.uuid) archived.add(item.uuid);
-    if (item.id) archived.add(getItemKey(item));
-  });
-  return archived;
-};
-
-export const filterArchivedLinkIndex = (
-  linkIndex: LinkIndex,
-  archivedItems: ItemLike[],
-): LinkIndex => {
-  const archived = buildArchivedIdSet(archivedItems);
-  const shouldKeep = (id: string) => !archived.has(id);
-  const filterIds = (ids: string[]) => ids.filter(shouldKeep);
-  const filterGroup = (group: LinkIndex["notes"]) =>
-    Object.fromEntries(
-      Object.entries(group)
-        .filter(([key]) => shouldKeep(key))
-        .map(([key, links]) => [
-          key,
-          {
-            isLinkedTo: {
-              notes: filterIds(links.isLinkedTo.notes),
-              checklists: filterIds(links.isLinkedTo.checklists),
-            },
-            isReferencedIn: {
-              notes: filterIds(links.isReferencedIn.notes),
-              checklists: filterIds(links.isReferencedIn.checklists),
-            },
-          },
-        ]),
-    );
-
-  return {
-    notes: filterGroup(linkIndex.notes || {}),
-    checklists: filterGroup(linkIndex.checklists || {}),
-  };
-};
-
-export const buildConnectionGraphData = (
-  linkIndex: LinkIndex,
-  notes: Partial<Note>[],
-  checklists: Partial<Checklist>[],
-  includeOrphans = false,
-): ConnectionGraphData => {
-  const itemsByUuid = new Map<string, { item: ItemLike; type: ItemType }>();
-  const uuidByLegacyKey = new Map<string, string>();
-
-  notes.forEach((note) =>
-    addItemToMaps(note, ItemTypes.NOTE, itemsByUuid, uuidByLegacyKey),
-  );
-  checklists.forEach((checklist) =>
-    addItemToMaps(
-      checklist,
-      ItemTypes.CHECKLIST,
-      itemsByUuid,
-      uuidByLegacyKey,
-    ),
-  );
-
-  const outbound = new Map<string, number>();
-  const inbound = new Map<string, number>();
-  const tagConnections = new Map<string, number>();
-  const linkMap = new Map<string, ConnectionGraphLink>();
-
-  const addDirectedLinks = (
-    sourceRaw: string,
-    targets: string[],
-    targetType: ItemType,
-  ) => {
-    const source = resolveGraphId(sourceRaw, uuidByLegacyKey);
-    if (!itemsByUuid.has(source)) return;
-
-    targets.forEach((targetRaw) => {
-      const target = resolveGraphId(targetRaw, uuidByLegacyKey);
-      const targetItem = itemsByUuid.get(target);
-      if (!targetItem || targetItem.type !== targetType || source === target) {
-        return;
-      }
-
-      outbound.set(source, (outbound.get(source) || 0) + 1);
-      inbound.set(target, (inbound.get(target) || 0) + 1);
-
-      const linkKey = `explicit::${[source, target].sort().join("::")}`;
-      if (!linkMap.has(linkKey)) {
-        linkMap.set(linkKey, { source, target, directed: true, type: "explicit" });
-      }
-    });
-  };
-
-  Object.entries(linkIndex.notes || {}).forEach(([source, links]) => {
-    addDirectedLinks(source, links.isLinkedTo.notes, ItemTypes.NOTE);
-    addDirectedLinks(source, links.isLinkedTo.checklists, ItemTypes.CHECKLIST);
-  });
-
-  Object.entries(linkIndex.checklists || {}).forEach(([source, links]) => {
-    addDirectedLinks(source, links.isLinkedTo.notes, ItemTypes.NOTE);
-    addDirectedLinks(source, links.isLinkedTo.checklists, ItemTypes.CHECKLIST);
-  });
-
-  const nodesByTag = new Map<string, string[]>();
-  itemsByUuid.forEach(({ item }, uuid) => {
-    const uniqueTags = new Set((item.tags || []).map(normalizeTag).filter(Boolean));
-    uniqueTags.forEach((tag) => {
-      if (!nodesByTag.has(tag)) nodesByTag.set(tag, []);
-      nodesByTag.get(tag)?.push(uuid);
-    });
-  });
-
-  nodesByTag.forEach((taggedNodeIds, tag) => {
-    if (taggedNodeIds.length < 2) return;
-    const sortedIds = [...taggedNodeIds].sort();
-
-    sortedIds.forEach((source, sourceIndex) => {
-      const fanOutTargets = sortedIds.slice(
-        sourceIndex + 1,
-        sourceIndex + 1 + MAX_TAG_LINK_FANOUT,
-      );
-      fanOutTargets.forEach((target) => {
-        const linkKey = `tag::${tag}::${source}::${target}`;
-        if (linkMap.has(linkKey)) return;
-
-        linkMap.set(linkKey, {
-          source,
-          target,
-          directed: false,
-          type: "tag",
-          tag,
-        });
-        tagConnections.set(source, (tagConnections.get(source) || 0) + 1);
-        tagConnections.set(target, (tagConnections.get(target) || 0) + 1);
-      });
-    });
-  });
-
-  const nodes = Array.from(itemsByUuid.entries())
-    .map(([uuid, { item, type }]) => {
-      const inboundCount = inbound.get(uuid) || 0;
-      const outboundCount = outbound.get(uuid) || 0;
-      const tagConnectionCount = tagConnections.get(uuid) || 0;
-      const connectionCount = inboundCount + outboundCount + tagConnectionCount;
-      const category = item.category || "Uncategorized";
-      const itemId = item.id || uuid;
-      const path = `${category}/${itemId}`;
-
-      return {
-        id: uuid,
-        label: item.title || fallbackTitle(type, uuid),
-        title: item.title || fallbackTitle(type, uuid),
-        type,
-        category,
-        itemId,
-        path,
-        url: itemHref(type, uuid),
-        tags: item.tags || [],
-        createdAt: item.createdAt,
-        updatedAt: item.updatedAt,
-        inboundCount,
-        outboundCount,
-        connectionCount,
-        weight: connectionCount,
-        orphan: connectionCount === 0,
-      };
-    })
-    .filter((node) => includeOrphans || !node.orphan)
-    .sort((a, b) => b.connectionCount - a.connectionCount);
-
-  const visibleIds = new Set(nodes.map((node) => node.id));
-  const links = Array.from(linkMap.values()).filter(
-    (link) => visibleIds.has(link.source) && visibleIds.has(link.target),
-  );
-
-  if (nodes.length > MAX_GRAPH_NODES) {
-    const keptNodes = nodes.slice(0, MAX_GRAPH_NODES);
-    const keptIds = new Set(keptNodes.map((node) => node.id));
-    return {
-      nodes: keptNodes,
-      links: links.filter(
-        (link) => keptIds.has(link.source) && keptIds.has(link.target),
-      ),
-      totalNodes: nodes.length,
-      totalLinks: links.length,
-      truncated: nodes.length - MAX_GRAPH_NODES,
-    };
-  }
-
-  return {
-    nodes,
-    links,
-    totalNodes: nodes.length,
-    totalLinks: links.length,
-    truncated: 0,
-  };
-};
-
-export const filterConnectionGraphData = (
-  graphData: ConnectionGraphData,
-  filters: ConnectionGraphFilters,
-): ConnectionGraphData => {
-  const query = filters.search.trim().toLowerCase();
-  const sourceLinks = filters.showTagLinks
-    ? graphData.links
-    : graphData.links.filter((link) => link.type !== "tag");
-  const explicitlyConnectedIds = new Set<string>();
-  sourceLinks.forEach((link) => {
-    explicitlyConnectedIds.add(link.source);
-    explicitlyConnectedIds.add(link.target);
-  });
-
-  const matchingIds = new Set(
-    graphData.nodes
-      .filter((node) => {
-        if (!filters.showNotes && node.type === ItemTypes.NOTE) return false;
-        if (!filters.showChecklists && node.type === ItemTypes.CHECKLIST) {
-          return false;
-        }
-        if (!filters.showOrphans && !explicitlyConnectedIds.has(node.id)) {
-          return false;
-        }
-        if (!query) return true;
-
-        return [
-          node.title,
-          node.label,
-          node.path,
-          node.category,
-          node.type,
-          ...node.tags,
-        ]
-          .join(" ")
-          .toLowerCase()
-          .includes(query);
-      })
-      .map((node) => node.id),
-  );
-
-  const visibleIds = matchingIds;
-
-  const nodes = graphData.nodes.filter((node) => visibleIds.has(node.id));
-  const links = sourceLinks.filter(
-    (link) => visibleIds.has(link.source) && visibleIds.has(link.target),
-  );
-
-  return {
-    nodes,
-    links,
-    totalNodes: nodes.length,
-    totalLinks: links.length,
-    truncated: graphData.truncated,
-  };
-};
diff --git a/app/_components/FeatureComponents/Profile/Parts/LinksTab.tsx b/app/_components/FeatureComponents/Profile/Parts/LinksTab.tsx
deleted file mode 100644
index c5b03eb09..000000000
--- a/app/_components/FeatureComponents/Profile/Parts/LinksTab.tsx
+++ /dev/null
@@ -1,468 +0,0 @@
-"use client";
-
-import { useMemo, useState } from "react";
-import type React from "react";
-import {
-  File02Icon,
-  Link04Icon,
-  RefreshIcon,
-  SharedWifiIcon,
-} from "hugeicons-react";
-import { useTranslations } from "next-intl";
-import { LinkIndex } from "@/app/_types";
-import { Checklist, Note } from "@/app/_types";
-import { getUsername } from "@/app/_server/actions/users";
-import { rebuildLinkIndex } from "@/app/_server/actions/link";
-import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
-import { useToast } from "@/app/_providers/ToastProvider";
-import { ConnectionsGraph } from "./ConnectionsGraph/ConnectionsGraph";
-import {
-  buildConnectionGraphData,
-  ConnectionGraphFilters,
-  filterConnectionGraphData,
-} from "./ConnectionsGraph/graph-data";
-
-interface LinksTabProps {
-  linkIndex: LinkIndex;
-  notes: Partial<Note>[];
-  checklists: Partial<Checklist>[];
-}
-
-export const LinksTab = ({ linkIndex, notes, checklists }: LinksTabProps) => {
-  const t = useTranslations();
-  const { showToast } = useToast();
-  const [rebuildingIndex, setRebuildingIndex] = useState(false);
-  const [selectedNodeId, setSelectedNodeId] = useState<string | null>(null);
-  const [showLabels, setShowLabels] = useState(false);
-  const [showArrows, setShowArrows] = useState(true);
-  const [nodeScale, setNodeScale] = useState(1);
-  const [linkWidth, setLinkWidth] = useState(1.6);
-  const [linkDistance, setLinkDistance] = useState(90);
-  const [repelForce, setRepelForce] = useState(120);
-  const [filters, setFilters] = useState<ConnectionGraphFilters>({
-    search: "",
-    showNotes: true,
-    showChecklists: true,
-    showOrphans: false,
-    showTagLinks: true,
-  });
-
-  const graphData = useMemo(
-    () => buildConnectionGraphData(linkIndex, notes, checklists, true),
-    [linkIndex, notes, checklists],
-  );
-
-  const visibleGraphData = useMemo(
-    () => filterConnectionGraphData(graphData, filters),
-    [filters, graphData],
-  );
-
-  const connectedItems = graphData.nodes.filter((node) => !node.orphan).length;
-
-  const handleRebuildIndex = async () => {
-    setRebuildingIndex(true);
-    try {
-      const username = await getUsername();
-      await rebuildLinkIndex(username);
-      showToast({
-        type: "success",
-        title: t("common.success"),
-        message: t("profile.successfullyRebuiltIndexReload"),
-      });
-      window.location.reload();
-    } catch (error) {
-      console.error("Failed to rebuild index:", error);
-      showToast({
-        type: "error",
-        title: t("common.error"),
-        message: t("profile.failedToRebuildIndex"),
-      });
-    } finally {
-      setRebuildingIndex(false);
-    }
-  };
-
-  const updateFilters = (next: Partial<ConnectionGraphFilters>) => {
-    setFilters((current) => ({ ...current, ...next }));
-  };
-
-  if (graphData.totalNodes === 0) {
-    return (
-      <div className="space-y-6">
-        <Header />
-        <Stats totalNodes={0} totalLinks={0} connectedItems={0} />
-        <div className="rounded-jotty border border-border bg-card p-8">
-          <div className="mx-auto max-w-md space-y-4 text-center">
-            <Link04Icon className="mx-auto h-12 w-12" />
-            <div className="space-y-2">
-              <h3 className="text-lg font-semibold">
-                {t("profile.noLinksFound")}
-              </h3>
-              <p className="text-muted-foreground">
-                {t("profile.startCreatingInternalLinks")}{" "}
-                <code className="rounded bg-muted px-1 py-0.5 text-sm">
-                  /note/your-note
-                </code>{" "}
-                {t("profile.orFormat")}{" "}
-                <code className="rounded bg-muted px-1 py-0.5 text-sm">
-                  /checklist/your-list
-                </code>{" "}
-                {t("profile.inYourContent")}
-              </p>
-            </div>
-            <Button
-              variant="outline"
-              onClick={handleRebuildIndex}
-              disabled={rebuildingIndex}
-              className="gap-2"
-            >
-              <RefreshIcon
-                className={`h-4 w-4 ${rebuildingIndex ? "animate-spin" : ""}`}
-              />
-              {rebuildingIndex
-                ? t("admin.rebuilding")
-                : t("admin.rebuildIndexes")}
-            </Button>
-          </div>
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <div className="space-y-6">
-      <Header />
-      <Stats
-        totalNodes={graphData.totalNodes}
-        totalLinks={graphData.totalLinks}
-        connectedItems={connectedItems}
-      />
-
-      <section className="flex flex-col gap-4">
-        <div className="flex flex-col gap-3 lg:flex-row lg:items-center lg:justify-between">
-          <div>
-            <h3 className="text-lg font-semibold">
-              {t("profile.linkNetwork")}
-            </h3>
-            <p className="text-sm text-muted-foreground">
-              {t("profile.visibleGraphSummary", {
-                items: visibleGraphData.nodes.length,
-                links: visibleGraphData.links.length,
-              })}
-            </p>
-          </div>
-          <Button
-            variant="outline"
-            size="sm"
-            onClick={handleRebuildIndex}
-            disabled={rebuildingIndex}
-            className="w-full gap-2 sm:w-auto"
-            title={t("profile.rebuildLinkIndexes")}
-          >
-            <RefreshIcon
-              className={`h-4 w-4 ${rebuildingIndex ? "animate-spin" : ""}`}
-            />
-            {rebuildingIndex
-              ? t("admin.rebuilding")
-              : t("admin.rebuildIndexes")}
-          </Button>
-        </div>
-
-        {graphData.truncated > 0 && (
-          <p className="rounded-jotty border border-border bg-card p-3 text-sm text-muted-foreground">
-            {t("profile.graphTruncated", {
-              visible: visibleGraphData.nodes.length,
-              omitted: graphData.truncated,
-            })}
-          </p>
-        )}
-
-        <div className="order-2 lg:order-1">
-          <Controls
-            filters={filters}
-            updateFilters={updateFilters}
-            showLabels={showLabels}
-            setShowLabels={setShowLabels}
-            showArrows={showArrows}
-            setShowArrows={setShowArrows}
-            nodeScale={nodeScale}
-            setNodeScale={setNodeScale}
-            linkWidth={linkWidth}
-            setLinkWidth={setLinkWidth}
-            linkDistance={linkDistance}
-            setLinkDistance={setLinkDistance}
-            repelForce={repelForce}
-            setRepelForce={setRepelForce}
-          />
-        </div>
-
-        <div className="order-1 lg:order-2">
-          <ConnectionsGraph
-            graphData={visibleGraphData}
-            selectedNodeId={selectedNodeId}
-            onSelectedNodeChange={setSelectedNodeId}
-            showLabels={showLabels}
-            showArrows={showArrows}
-            nodeScale={nodeScale}
-            linkWidth={linkWidth}
-            linkDistance={linkDistance}
-            repelForce={repelForce}
-            labels={{
-              unknown: t("profile.unknown"),
-              total: t("profile.totalConnections"),
-              inbound: t("profile.inboundConnections"),
-              outbound: t("profile.outboundConnections"),
-              updated: t("profile.updated"),
-              uuid: t("profile.uuid"),
-              openItem: t("profile.openItem"),
-              selectItem: t("profile.selectItem"),
-              inspectHint: t("profile.inspectNodeHint"),
-              linkedItems: t("profile.linkedItems"),
-            }}
-          />
-        </div>
-      </section>
-    </div>
-  );
-
-  function Header() {
-    return (
-      <div className="space-y-2">
-        <h2 className="text-2xl font-bold">{t("profile.contentLinks")}</h2>
-        <p className="text-muted-foreground">
-          {t("profile.visualizeRelationships")}
-        </p>
-      </div>
-    );
-  }
-
-  function Stats({
-    totalNodes,
-    totalLinks,
-    connectedItems,
-  }: {
-    totalNodes: number;
-    totalLinks: number;
-    connectedItems: number;
-  }) {
-    return (
-      <div className="rounded-jotty border border-border bg-card p-4 sm:p-6">
-        <div className="grid grid-cols-1 gap-4 sm:grid-cols-3 sm:gap-6">
-          <Stat
-            icon={<File02Icon className="h-5 w-5" />}
-            value={totalNodes}
-            label={t("checklists.totalItems")}
-          />
-          <Stat
-            icon={<Link04Icon className="h-5 w-5" />}
-            value={totalLinks}
-            label={t("profile.connectionsTab")}
-          />
-          <Stat
-            icon={<SharedWifiIcon className="h-5 w-5" />}
-            value={connectedItems}
-            label={t("profile.connectedItems")}
-          />
-        </div>
-      </div>
-    );
-  }
-
-  function Stat({
-    icon,
-    value,
-    label,
-  }: {
-    icon: React.ReactNode;
-    value: number;
-    label: string;
-  }) {
-    return (
-      <div className="flex items-center gap-3">
-        <div className="rounded-jotty bg-secondary p-2">{icon}</div>
-        <div>
-          <div className="text-2xl font-bold text-foreground">{value}</div>
-          <div className="text-sm text-muted-foreground">{label}</div>
-        </div>
-      </div>
-    );
-  }
-};
-
-interface ControlsProps {
-  filters: ConnectionGraphFilters;
-  updateFilters: (next: Partial<ConnectionGraphFilters>) => void;
-  showLabels: boolean;
-  setShowLabels: (value: boolean) => void;
-  showArrows: boolean;
-  setShowArrows: (value: boolean) => void;
-  nodeScale: number;
-  setNodeScale: (value: number) => void;
-  linkWidth: number;
-  setLinkWidth: (value: number) => void;
-  linkDistance: number;
-  setLinkDistance: (value: number) => void;
-  repelForce: number;
-  setRepelForce: (value: number) => void;
-}
-
-const Controls = ({
-  filters,
-  updateFilters,
-  showLabels,
-  setShowLabels,
-  showArrows,
-  setShowArrows,
-  nodeScale,
-  setNodeScale,
-  linkWidth,
-  setLinkWidth,
-  linkDistance,
-  setLinkDistance,
-  repelForce,
-  setRepelForce,
-}: ControlsProps) => {
-  const t = useTranslations();
-
-  return (
-    <div className="rounded-jotty border border-border bg-card p-4">
-      <div className="grid gap-4">
-        <label className="space-y-1">
-          <span className="text-sm font-medium">{t("common.search")}</span>
-          <input
-            value={filters.search}
-            onChange={(event) => updateFilters({ search: event.target.value })}
-            placeholder={t("profile.graphSearchPlaceholder")}
-            className="h-10 w-full rounded-jotty border border-input bg-background px-3 text-sm"
-          />
-        </label>
-      </div>
-
-      <div className="mt-4 grid gap-3 sm:grid-cols-2 xl:grid-cols-3">
-        <Toggle
-          label={t("notes.title")}
-          checked={filters.showNotes}
-          onChange={(checked) => updateFilters({ showNotes: checked })}
-        />
-        <Toggle
-          label={t("checklists.title")}
-          checked={filters.showChecklists}
-          onChange={(checked) => updateFilters({ showChecklists: checked })}
-        />
-        <Toggle
-          label={t("profile.orphans")}
-          checked={filters.showOrphans}
-          onChange={(checked) => updateFilters({ showOrphans: checked })}
-        />
-        <Toggle
-          label={t("profile.labels")}
-          checked={showLabels}
-          onChange={setShowLabels}
-        />
-        <Toggle
-          label={t("profile.arrows")}
-          checked={showArrows}
-          onChange={setShowArrows}
-        />
-        <Toggle
-          label={t("profile.tagLinks")}
-          checked={filters.showTagLinks}
-          onChange={(checked) => updateFilters({ showTagLinks: checked })}
-        />
-      </div>
-
-      <div className="mt-4 grid gap-4 md:grid-cols-2 xl:grid-cols-4">
-        <Range
-          label={t("profile.nodeSize")}
-          value={nodeScale}
-          min={0.6}
-          max={1.8}
-          step={0.1}
-          onChange={setNodeScale}
-        />
-        <Range
-          label={t("profile.linkWidth")}
-          value={linkWidth}
-          min={0.5}
-          max={4}
-          step={0.1}
-          onChange={setLinkWidth}
-        />
-        <Range
-          label={t("profile.linkDistance")}
-          value={linkDistance}
-          min={45}
-          max={180}
-          step={5}
-          onChange={setLinkDistance}
-        />
-        <Range
-          label={t("profile.repelForce")}
-          value={repelForce}
-          min={40}
-          max={260}
-          step={10}
-          onChange={setRepelForce}
-        />
-      </div>
-    </div>
-  );
-};
-
-const Toggle = ({
-  label,
-  checked,
-  onChange,
-  disabled = false,
-}: {
-  label: string;
-  checked: boolean;
-  onChange: (value: boolean) => void;
-  disabled?: boolean;
-}) => (
-  <label className="flex min-h-10 items-center justify-between gap-3 rounded-jotty border border-border px-3 py-2 text-sm">
-    <span
-      className={`min-w-0 truncate ${disabled ? "text-muted-foreground" : ""}`}
-    >
-      {label}
-    </span>
-    <input
-      type="checkbox"
-      checked={checked}
-      disabled={disabled}
-      onChange={(event) => onChange(event.target.checked)}
-      className="h-4 w-4 shrink-0"
-    />
-  </label>
-);
-
-const Range = ({
-  label,
-  value,
-  min,
-  max,
-  step,
-  onChange,
-}: {
-  label: string;
-  value: number;
-  min: number;
-  max: number;
-  step: number;
-  onChange: (value: number) => void;
-}) => (
-  <label className="block min-h-16 rounded-jotty border border-border px-3 py-2">
-    <span className="block truncate text-sm font-medium">
-      {label} {value}
-    </span>
-    <input
-      type="range"
-      min={min}
-      max={max}
-      step={step}
-      value={value}
-      onChange={(event) => onChange(Number(event.target.value))}
-      className="mt-2 block w-full"
-    />
-  </label>
-);
diff --git a/app/_components/FeatureComponents/Sidebar/Parts/TagsList.tsx b/app/_components/FeatureComponents/Sidebar/Parts/TagsList.tsx
index 6d9e71e62..c5fd5631d 100644
--- a/app/_components/FeatureComponents/Sidebar/Parts/TagsList.tsx
+++ b/app/_components/FeatureComponents/Sidebar/Parts/TagsList.tsx
@@ -42,6 +42,7 @@ const TagRenderer = ({
     tag.noteUuids.length > 0 ||
     tag.checklistUuids.length > 0 ||
     children.length > 0;
+  const hasSubtags = children.length > 0;
   const isCollapsed = collapsedTags.has(tag.name);
 
   return (
@@ -54,16 +55,18 @@ const TagRenderer = ({
           )}
         >
           <button
+            type="button"
+            disabled={!hasSubtags}
             onClick={(e) => {
               e.stopPropagation();
-              if (hasContent) toggleTag(tag.name);
+              if (hasSubtags) toggleTag(tag.name);
             }}
             className={cn(
               "flex items-center shrink-0",
-              hasContent ? "cursor-pointer" : "cursor-default",
+              hasSubtags ? "cursor-pointer" : "cursor-default",
             )}
           >
-            {hasContent ? (
+            {hasSubtags ? (
               isCollapsed ? (
                 <ArrowRight01Icon className="h-5 w-5 lg:h-4 lg:w-4" />
               ) : (
@@ -94,7 +97,7 @@ const TagRenderer = ({
         </div>
       </div>
 
-      {!isCollapsed && children.length > 0 && (
+      {!isCollapsed && hasSubtags && (
         <div className="ml-2 border-l border-border/30 pl-2">
           {children.map((childTag) => (
             <TagRenderer
diff --git a/app/_components/FeatureComponents/Sidebar/SettingsSidebar.tsx b/app/_components/FeatureComponents/Sidebar/SettingsSidebar.tsx
index f13cc7a17..aed4b7220 100644
--- a/app/_components/FeatureComponents/Sidebar/SettingsSidebar.tsx
+++ b/app/_components/FeatureComponents/Sidebar/SettingsSidebar.tsx
@@ -6,6 +6,7 @@ import { usePathname } from "next/navigation";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { useState } from "react";
 import { useTranslations } from "next-intl";
+import { BRAIN_PATH } from "@/app/_consts/relations";
 import {
     UserIcon,
     Tv02Icon,
@@ -87,7 +88,7 @@ export const SettingsSidebar = ({ isOpen, onClose, isAdmin }: SettingsSidebarPro
                     id: "connections",
                     label: t("profile.connectionsTab"),
                     icon: SharedWifiIcon,
-                    path: "/settings/connections",
+                    path: BRAIN_PATH,
                 },
             ]
             : []),
diff --git a/app/_components/GlobalComponents/Layout/IndexingRelations.tsx b/app/_components/GlobalComponents/Layout/IndexingRelations.tsx
new file mode 100644
index 000000000..6cb2fe157
--- /dev/null
+++ b/app/_components/GlobalComponents/Layout/IndexingRelations.tsx
@@ -0,0 +1,25 @@
+"use client";
+
+import { useTranslations } from "next-intl";
+import { JottyIcon } from "./CustomIcons/JottyIcon";
+
+export const IndexingRelations = ({ compact = false }: { compact?: boolean }) => {
+  const t = useTranslations();
+
+  return (
+    <div
+      role="status"
+      aria-live="polite"
+      className={`flex flex-col items-center justify-center gap-3 text-muted-foreground ${
+        compact ? "py-6" : "h-full min-h-[50vh]"
+      }`}
+    >
+      <JottyIcon
+        className={`${compact ? "h-10 w-10" : "h-16 w-16"} text-primary animate-pulse`}
+        animated
+        slower
+      />
+      <span className="text-md lg:text-sm">{t("relations.indexing")}</span>
+    </div>
+  );
+};
diff --git a/app/_consts/relations.ts b/app/_consts/relations.ts
new file mode 100644
index 000000000..65f820987
--- /dev/null
+++ b/app/_consts/relations.ts
@@ -0,0 +1,45 @@
+export const RELATIONS_DB_NAME = ".relations.db";
+export const RELATIONS_SCHEMA_VERSION = 2;
+export const LEGACY_LINK_PREFIX = "/jotty/";
+export const WIKILINK_REGEX =
+  /\[\[([^\[\]|#^\n]+)(?:[#^][^\[\]|\n]*)?(?:\|([^\[\]\n]*))?\]\]/g;
+
+export enum LinkKinds {
+  MENTION = "mention",
+  WIKI = "wiki",
+}
+
+export enum RelationsStatus {
+  BUILDING = "building",
+  READY = "ready",
+}
+
+export enum BrainNodeKinds {
+  NOTE = "note",
+  CHECKLIST = "checklist",
+  GHOST = "ghost",
+  TAG = "tag",
+}
+
+export enum BrainEdgeKinds {
+  MENTION = "mention",
+  WIKI = "wiki",
+  TAG = "tag",
+  SUGGESTED = "suggested",
+}
+
+export const MENTION_MIN_TITLE = 3;
+export const MENTION_LIMIT = 30;
+export const MENTION_SNIPPET_CHARS = 60;
+
+export const SUGGESTIONS_PER_ITEM = 3;
+export const SUGGESTIONS_MAX = 250;
+export const SUGGESTION_HUB_LIMIT = 80;
+
+export const BRAIN_PATH = "/brain";
+export const BRAIN_FOCUS_PARAM = "focus";
+
+export const brainHref = (focus?: string, owner?: string): string => {
+  const base = owner ? `${BRAIN_PATH}/${encodeURIComponent(owner)}` : BRAIN_PATH;
+  return focus ? `${base}?${BRAIN_FOCUS_PARAM}=${focus}` : base;
+};
diff --git a/app/_providers/AppModeProvider.tsx b/app/_providers/AppModeProvider.tsx
index 80d8a5b6e..13d0b16d7 100644
--- a/app/_providers/AppModeProvider.tsx
+++ b/app/_providers/AppModeProvider.tsx
@@ -21,7 +21,6 @@ import {
   SanitisedUser,
 } from "@/app/_types";
 import { Modes } from "@/app/_types/enums";
-import { LinkIndex } from "../_types";
 import { buildTagsIndex } from "../_utils/tag-utils";
 import { useSidebarStore } from "../_utils/sidebar-store";
 
@@ -36,7 +35,6 @@ export const AppModeProvider = ({
   pathname,
   appVersion,
   initialSettings,
-  linkIndex,
   notes,
   checklists,
   allSharedItems,
@@ -52,7 +50,6 @@ export const AppModeProvider = ({
   pathname?: string;
   appVersion?: string;
   initialSettings?: AppSettings;
-  linkIndex?: LinkIndex | null;
   notes?: Partial<Note>[];
   checklists?: Partial<Checklist>[];
   allSharedItems?: AllSharedItems | null;
@@ -175,7 +172,6 @@ export const AppModeProvider = ({
       appSettings,
       appVersion: appVersion || "",
       usersPublicData,
-      linkIndex: linkIndex || null,
       notes: notes || [],
       checklists: checklists || [],
       allSharedItems: allSharedItems || null,
@@ -198,7 +194,6 @@ export const AppModeProvider = ({
       appSettings,
       appVersion,
       usersPublicData,
-      linkIndex,
       notes,
       checklists,
       allSharedItems,
diff --git a/app/_providers/MetadataProvider.tsx b/app/_providers/MetadataProvider.tsx
index 42ab30de0..f65564638 100644
--- a/app/_providers/MetadataProvider.tsx
+++ b/app/_providers/MetadataProvider.tsx
@@ -44,3 +44,6 @@ export const useMetadata = (): ItemMetadata => {
   }
   return context.metadata;
 };
+
+export const useOptionalMetadata = (): ItemMetadata | null =>
+  useContext(MetadataContext)?.metadata ?? null;
diff --git a/app/_providers/RelationsProvider.tsx b/app/_providers/RelationsProvider.tsx
new file mode 100644
index 000000000..2c50a5c0b
--- /dev/null
+++ b/app/_providers/RelationsProvider.tsx
@@ -0,0 +1,21 @@
+"use client";
+
+import { createContext, ReactNode, useContext } from "react";
+import { RelationsStatus } from "@/app/_consts/relations";
+import type { ItemRelations } from "@/app/_types/relations";
+
+const EMPTY: ItemRelations = { uuid: "", status: RelationsStatus.READY, backlinks: [], mentions: [], wikis: {} };
+
+const RelationsContext = createContext<ItemRelations>(EMPTY);
+
+export const RelationsProvider = ({
+  relations,
+  children,
+}: {
+  relations: ItemRelations;
+  children: ReactNode;
+}) => (
+  <RelationsContext.Provider value={relations}>{children}</RelationsContext.Provider>
+);
+
+export const useRelations = (): ItemRelations => useContext(RelationsContext);
diff --git a/app/_server/actions/category/crud.ts b/app/_server/actions/category/crud.ts
index 926c5afa4..1528d57cd 100644
--- a/app/_server/actions/category/crud.ts
+++ b/app/_server/actions/category/crud.ts
@@ -5,6 +5,7 @@ import path from "path";
 import {
   ensureDir,
   serverDeleteDir,
+  serverRenamePath,
   getUserModeDir,
 } from "@/app/_server/actions/file";
 import fs from "fs/promises";
@@ -324,7 +325,7 @@ export const renameCategory = async (formData: FormData) => {
       return { error: "Category with new name already exists" };
     }
 
-    await fs.rename(oldCategoryDir, newCategoryDir);
+    await serverRenamePath(oldCategoryDir, newCategoryDir);
 
     const username = await getUsername();
     if (mode === Modes.NOTES && username) {
diff --git a/app/_server/actions/category/move.ts b/app/_server/actions/category/move.ts
index 468e1d972..01ce4824a 100644
--- a/app/_server/actions/category/move.ts
+++ b/app/_server/actions/category/move.ts
@@ -6,12 +6,13 @@ import {
   ensureDir,
   getUserModeDir,
   readOrderFile,
+  serverRenamePath,
+  serverWriteFile,
   writeOrderFile,
 } from "@/app/_server/actions/file";
 import fs from "fs/promises";
 import { Modes } from "@/app/_types/enums";
 import { getUsername } from "@/app/_server/actions/users";
-import { rebuildLinkIndexInternal } from "@/app/_server/actions/link";
 import { logAudit } from "@/app/_server/actions/log";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { isPathSafe } from "@/app/_utils/path-utils";
@@ -119,10 +120,9 @@ const _restamp = async (
     );
     const content = await fs.readFile(filePath, "utf-8");
 
-    await fs.writeFile(
+    await serverWriteFile(
       filePath,
       updateYamlMetadata(content, { owner, category }),
-      "utf-8",
     );
   } catch (error) {
     console.error(`Failed to restamp ${filePath}:`, error);
@@ -382,7 +382,7 @@ export const moveNode = async (formData: FormData) => {
       const oldPath = path.join(oldParentDir, fileName);
       const newPath = path.join(newParentDir, fileName);
 
-      await fs.rename(oldPath, newPath);
+      await serverRenamePath(oldPath, newPath);
 
       if (activeType === "item") {
         await _restamp(newPath, destLoc.owner, destLoc.category);
@@ -430,16 +430,6 @@ export const moveNode = async (formData: FormData) => {
           console.warn("Failed to commit note move to git history:", error);
         }
       }
-
-      try {
-        await rebuildLinkIndexInternal(sourceLoc.owner);
-
-        if (destLoc.owner !== sourceLoc.owner) {
-          await rebuildLinkIndexInternal(destLoc.owner);
-        }
-      } catch (error) {
-        console.warn("Failed to update link index:", error);
-      }
     }
 
     await logAudit({
diff --git a/app/_server/actions/checklist/converters.ts b/app/_server/actions/checklist/converters.ts
index 9c4b3862a..edfda364c 100644
--- a/app/_server/actions/checklist/converters.ts
+++ b/app/_server/actions/checklist/converters.ts
@@ -16,10 +16,6 @@ import { revalidatePath } from "next/cache";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { getFormData } from "@/app/_utils/global-utils";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
-import {
-  updateIndexForItem,
-  parseInternalLinks,
-} from "@/app/_server/actions/link";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { getListById, getUserChecklists } from "./queries";
@@ -331,23 +327,6 @@ export const clearAllChecklistItems = async (formData: FormData) => {
 
     await serverWriteFile(filePath, listToMarkdown(updatedChecklist));
 
-    try {
-      const content = updatedChecklist.items.map((i) => i.text).join("\n");
-      const links = await parseInternalLinks(content);
-      await updateIndexForItem(
-        checklist.owner!,
-        ItemTypes.CHECKLIST,
-        updatedChecklist.uuid!,
-        links,
-      );
-    } catch (error) {
-      console.warn(
-        "Failed to update link index for checklist:",
-        updatedChecklist.id,
-        error,
-      );
-    }
-
     try {
       revalidatePath("/");
       revalidatePath(`/checklist/${checklist.uuid}`);
diff --git a/app/_server/actions/checklist/creator.ts b/app/_server/actions/checklist/creator.ts
index a10620936..6d973af3a 100644
--- a/app/_server/actions/checklist/creator.ts
+++ b/app/_server/actions/checklist/creator.ts
@@ -5,7 +5,6 @@ import { ensureDir, serverWriteFile } from "@/app/_server/actions/file";
 import { generateUniqueFilename } from "@/app/_utils/filename-utils";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
-import { updateIndexForItem, parseInternalLinks } from "@/app/_server/actions/link";
 import { targetDir, bouncer } from "@/app/_server/actions/share/target";
 import { generateUuid } from "@/app/_utils/yaml-metadata-utils";
 import { logContentEvent } from "@/app/_server/actions/log";
@@ -64,26 +63,6 @@ export const makeList = async (
 
     await serverWriteFile(filePath, listToMarkdown(newList));
 
-    try {
-      const content = newList.items.map((i) => i.text).join("\n");
-      const links = await parseInternalLinks(content);
-      const indexUsername = target.owner;
-      if (indexUsername) {
-        await updateIndexForItem(
-          indexUsername,
-          ItemTypes.CHECKLIST,
-          newList.uuid!,
-          links,
-        );
-      }
-    } catch (error) {
-      console.warn(
-        "Failed to update link index for new checklist:",
-        newList.id,
-        error,
-      );
-    }
-
     await logContentEvent(
       "checklist_created",
       "checklist",
diff --git a/app/_server/actions/checklist/crud.ts b/app/_server/actions/checklist/crud.ts
index 7a70cfab3..94f821261 100644
--- a/app/_server/actions/checklist/crud.ts
+++ b/app/_server/actions/checklist/crud.ts
@@ -15,12 +15,6 @@ import { generateUniqueFilename, sanitizeFilename } from "@/app/_utils/filename-
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { getFormData } from "@/app/_utils/global-utils";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
-import {
-  updateIndexForItem,
-  parseInternalLinks,
-  removeItemFromIndex,
-  rebuildLinkIndexInternal,
-} from "@/app/_server/actions/link";
 import { canReach } from "@/app/_server/actions/share/queries";
 import {
   targetDir,
@@ -187,37 +181,6 @@ export const updateList = async (formData: FormData) => {
 
     await serverWriteFile(filePath, listToMarkdown(updatedList));
 
-    try {
-      const content = updatedList.items.map((i) => i.text).join("\n");
-      const links = await parseInternalLinks(content);
-      const newItemKey = `${updatedList.category || UNCATEGORIZED}/${updatedList.id
-        }`;
-
-      const oldItemKey = `${home.category || UNCATEGORIZED}/${currentId}`;
-      if (oldItemKey !== newItemKey || isMoving) {
-        await rebuildLinkIndexInternal(home.owner);
-
-        if (destination.owner !== home.owner) {
-          await rebuildLinkIndexInternal(destination.owner);
-        }
-
-        revalidatePath("/");
-      }
-
-      await updateIndexForItem(
-        destination.owner,
-        ItemTypes.CHECKLIST,
-        updatedList.uuid!,
-        links
-      );
-    } catch (error) {
-      console.warn(
-        "Failed to update link index for checklist:",
-        updatedList.id,
-        error
-      );
-    }
-
     if (oldFilePath && oldFilePath !== filePath) {
       await serverDeleteFile(oldFilePath);
     }
@@ -331,16 +294,6 @@ export const deleteList = async (formData: FormData) => {
 
     await serverDeleteFile(filePath);
 
-    try {
-      await removeItemFromIndex(list.owner!, ItemTypes.CHECKLIST, list.uuid!);
-    } catch (error) {
-      console.warn(
-        "Failed to remove checklist from link index:",
-        list.id,
-        error
-      );
-    }
-
     try {
       revalidatePath("/");
       revalidatePath(`/checklist/${list.uuid}`);
diff --git a/app/_server/actions/checklist/readers.ts b/app/_server/actions/checklist/readers.ts
index 8e3a83936..7bc9a5070 100644
--- a/app/_server/actions/checklist/readers.ts
+++ b/app/_server/actions/checklist/readers.ts
@@ -14,10 +14,10 @@ import {
 } from "@/app/_server/actions/file";
 import { parseMarkdown } from "@/app/_utils/checklist-utils";
 import {
+  createdAtOf,
   extractYamlMetadata,
   generateUuid,
   toIso,
-  updateYamlMetadata,
 } from "@/app/_utils/yaml-metadata-utils";
 import { grepExtractFrontmatter } from "@/app/_utils/grep-utils";
 import type { FileStatsEntry } from "@/app/_server/actions/file";
@@ -26,32 +26,13 @@ import { orderByUuids } from "@/app/_utils/order-utils";
 import { getChecklistType } from "./parsers";
 import { isDebugFlag } from "@/app/_utils/env-utils";
 import { isKanbanType } from "@/app/_types/enums";
-import { singleFlight } from "@/app/_server/actions/lib/concurrency";
+import { stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
+import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
 const execAsync = promisify(exec);
 
 const debugCrud = isDebugFlag("crud");
 
-const _stampUuid = async (filePath: string): Promise<string | undefined> =>
-  singleFlight(`stamp:${filePath}`, async () => {
-    try {
-      const content = await serverReadFile(filePath);
-      if (!content) return undefined;
-
-      const { metadata } = extractYamlMetadata(content);
-      if (typeof metadata.uuid === "string" && metadata.uuid) {
-        return metadata.uuid;
-      }
-
-      const uuid = generateUuid();
-      await serverWriteFile(filePath, updateYamlMetadata(content, { uuid }));
-      return uuid;
-    } catch (error) {
-      console.warn("Failed to stamp UUID on checklist:", filePath, error);
-      return undefined;
-    }
-  });
-
 export type ChecklistReadResult =
   | Partial<Checklist>
   | Checklist
@@ -75,7 +56,7 @@ export const readListsRecursively = async (
         ? ""
         : `-not -path "*/${ARCHIVED_DIR_NAME}/*"`;
       const statsCmd = `find "${dir}" -name "*.md" ${excludeStr} -printf "%p|%W@|%T@\\n"`;
-      const metaCmd = `grep -rE "^(title|uuid|tags|checklistType):|^[[:space:]]+- |^---$" "${dir}"`;
+      const metaCmd = `grep -rE "^(title|uuid|tags|checklistType|createdAt|${SHARED_WITH_KEY}):|^[[:space:]]+- |^---$" "${dir}"`;
       const [statsOut, metaOut] = await Promise.all([
         execAsync(statsCmd, { maxBuffer: 10 * 1024 * 1024 }).catch(() => ({
           stdout: "",
@@ -100,7 +81,8 @@ export const readListsRecursively = async (
         );
       }
       const inFrontmatter = new Map<string, boolean>();
-      let inTagsFile = "";
+      let listFile = "";
+      let listKey = "";
       for (const line of metaLines) {
         const colonIdx = line.indexOf(":");
         if (colonIdx === -1) continue;
@@ -119,7 +101,7 @@ export const readListsRecursively = async (
         }
         if (!inFrontmatter.get(filePath)) continue;
         if (/^\s+-\s/.test(rest)) {
-          if (inTagsFile === filePath) {
+          if (listFile === filePath) {
             const tag = rest.replace(/^\s+-\s+/, "").trim();
             if (tag) {
               if (debugCrud)
@@ -132,13 +114,13 @@ export const readListsRecursively = async (
               if (!metadataCache!.has(filePath))
                 metadataCache!.set(filePath, {});
               const entry = metadataCache!.get(filePath)!;
-              if (!Array.isArray(entry.tags)) entry.tags = [];
-              (entry.tags as string[]).push(tag);
+              if (!Array.isArray(entry[listKey])) entry[listKey] = [];
+              (entry[listKey] as string[]).push(tag);
             }
           }
           continue;
         }
-        inTagsFile = "";
+        listFile = "";
         const innerColon = rest.indexOf(":");
         if (innerColon === -1) continue;
         const key = rest.slice(0, innerColon);
@@ -149,7 +131,8 @@ export const readListsRecursively = async (
           const trimmed = val.trim();
           if (trimmed === "") {
             entry.tags = [];
-            inTagsFile = filePath;
+            listFile = filePath;
+            listKey = key;
           } else {
             entry.tags = trimmed
               .replace(/^\[|\]$/g, "")
@@ -157,6 +140,10 @@ export const readListsRecursively = async (
               .map((t: string) => t.trim())
               .filter(Boolean);
           }
+        } else if (key === SHARED_WITH_KEY && val.trim() === "") {
+          entry[key] = [];
+          listFile = filePath;
+          listKey = key;
         } else {
           entry[key] = val.trim().replace(/^["']|["']$/g, "");
         }
@@ -222,14 +209,14 @@ export const readListsRecursively = async (
               uuid:
                 typeof metadata?.uuid === "string"
                   ? metadata.uuid
-                  : await _stampUuid(filePath),
+                  : await stampUuid(filePath),
               title: typeof metadata?.title === "string" ? metadata.title : id,
               type: isKanbanType(metadata?.checklistType as string)
                 ? "kanban"
                 : "simple",
               category: categoryPath,
               items: [],
-              createdAt: toIso(stats.birthtime),
+              createdAt: createdAtOf(metadata, stats.birthtime),
               updatedAt: toIso(stats.mtime),
               owner,
               isShared: false,
@@ -241,16 +228,8 @@ export const readListsRecursively = async (
           if (isRaw) {
             const { metadata } = extractYamlMetadata(content);
             const type = getChecklistType(content);
-            let uuid = metadata.uuid;
-            if (!uuid) {
-              uuid = generateUuid();
-              try {
-                const updatedContent = updateYamlMetadata(content, { uuid });
-                await serverWriteFile(filePath, updatedContent);
-              } catch (error) {
-                console.warn("Failed to save UUID to checklist file:", error);
-              }
-            }
+            const uuid =
+              metadata.uuid || (await stampUuid(filePath)) || generateUuid();
             return {
               id,
               title: id,
@@ -258,7 +237,7 @@ export const readListsRecursively = async (
               type,
               category: categoryPath,
               items: [],
-              createdAt: toIso(stats.birthtime),
+              createdAt: createdAtOf(metadata, stats.birthtime),
               updatedAt: toIso(stats.mtime),
               owner,
               isShared: false,
diff --git a/app/_server/actions/file/atomic.ts b/app/_server/actions/file/atomic.ts
new file mode 100644
index 000000000..b8a0277d0
--- /dev/null
+++ b/app/_server/actions/file/atomic.ts
@@ -0,0 +1,55 @@
+import fs from "fs/promises";
+import path from "path";
+import { randomUUID } from "crypto";
+import { extractYamlMetadata, toIso } from "@/app/_utils/yaml-metadata-utils";
+
+const FRONTMATTER_OPEN = /^(\uFEFF?---\r?\n)/;
+
+const _realTarget = async (filePath: string): Promise<string> => {
+  try {
+    return await fs.realpath(filePath);
+  } catch {
+    return filePath;
+  }
+};
+
+export const atomicWrite = async (filePath: string, content: string) => {
+  const target = await _realTarget(filePath);
+  const tmpPath = path.join(
+    path.dirname(target),
+    `.${path.basename(target)}.${randomUUID()}.tmp`,
+  );
+
+  try {
+    await fs.writeFile(tmpPath, content, "utf-8");
+    await fs.rename(tmpPath, target);
+  } catch (error) {
+    console.error(`Atomic write failed for ${filePath}:`, error);
+    await fs.unlink(tmpPath).catch(() => undefined);
+    throw error;
+  }
+};
+
+const _existingCreatedAt = async (filePath: string): Promise<string> => {
+  try {
+    const existing = await fs.readFile(filePath, "utf-8");
+    const stamped = extractYamlMetadata(existing).metadata.createdAt;
+    if (stamped) return toIso(stamped);
+
+    const stats = await fs.stat(filePath);
+    return toIso(stats.birthtime.getTime() > 0 ? stats.birthtime : stats.mtime);
+  } catch {
+    return new Date().toISOString();
+  }
+};
+
+export const withCreatedAt = async (
+  filePath: string,
+  content: string,
+): Promise<string> => {
+  if (!FRONTMATTER_OPEN.test(content)) return content;
+  if (extractYamlMetadata(content).metadata.createdAt) return content;
+
+  const createdAt = await _existingCreatedAt(filePath);
+  return content.replace(FRONTMATTER_OPEN, `$1createdAt: "${createdAt}"\n`);
+};
diff --git a/app/_server/actions/file/index.ts b/app/_server/actions/file/index.ts
index 408cc3475..085b754d8 100644
--- a/app/_server/actions/file/index.ts
+++ b/app/_server/actions/file/index.ts
@@ -10,6 +10,8 @@ import fs from "fs/promises";
 import path from "path";
 import { randomUUID } from "crypto";
 import { Modes } from "@/app/_types/enums";
+import { atomicWrite, withCreatedAt } from "@/app/_server/actions/file/atomic";
+import { isItemFile } from "@/app/_server/actions/relations/paths";
 
 export interface OrderData {
   categories?: string[];
@@ -140,14 +142,31 @@ export const serverReadFile = async (
   }
 };
 
+const _tracking = () => import("@/app/_server/actions/relations/tracking");
+
 export const serverWriteFile = async (filePath: string, content: string) => {
   await ensureDir(path.dirname(filePath));
-  await fs.writeFile(filePath, content, "utf-8");
+
+  if (!isItemFile(filePath)) {
+    await atomicWrite(filePath, content);
+    return;
+  }
+
+  const stamped = await withCreatedAt(filePath, content);
+  await atomicWrite(filePath, stamped);
+  await (await _tracking()).trackItemWrite(filePath, stamped);
+};
+
+export const serverRenamePath = async (from: string, to: string) => {
+  await ensureDir(path.dirname(to));
+  await fs.rename(from, to);
+  await (await _tracking()).trackMove(from, to);
 };
 
 export const serverDeleteFile = async (filePath: string) => {
   try {
     await fs.unlink(filePath);
+    await (await _tracking()).trackItemDelete(filePath);
   } catch (error) {
     const { logAudit } = await import("@/app/_server/actions/log");
     await logAudit({
@@ -194,6 +213,7 @@ export const listMdFilesUnderPath = async (
 export const serverDeleteDir = async (dirPath: string) => {
   try {
     await fs.rm(dirPath, { recursive: true });
+    await (await _tracking()).trackTreeDelete(dirPath);
   } catch (error) {
     const { logAudit } = await import("@/app/_server/actions/log");
     await logAudit({
diff --git a/app/_server/actions/lib/legacy-lookup.ts b/app/_server/actions/lib/legacy-lookup.ts
index efd2d417e..992f9faec 100644
--- a/app/_server/actions/lib/legacy-lookup.ts
+++ b/app/_server/actions/lib/legacy-lookup.ts
@@ -76,24 +76,13 @@ const _uuidFor = async (filePath: string): Promise<string | null> => {
     return existing;
   }
 
-  const { extractYamlMetadata, generateUuid, updateYamlMetadata } =
-    await import("@/app/_utils/yaml-metadata-utils");
   const { logAudit } = await import("@/app/_server/actions/log");
-  const { singleFlight } = await import("@/app/_server/actions/lib/concurrency");
+  const { stampUuid } = await import("@/app/_server/actions/lib/stamp-uuid");
 
   try {
-    return await singleFlight(`stamp:${filePath}`, async () => {
-      const content = await fs.readFile(filePath, "utf-8");
-      const { metadata } = extractYamlMetadata(content);
-
-      if (typeof metadata.uuid === "string" && metadata.uuid) {
-        return metadata.uuid;
-      }
-
-      const stamped = generateUuid();
-      await fs.writeFile(filePath, updateYamlMetadata(content, { uuid: stamped }), "utf-8");
-      return stamped;
-    });
+    const stamped = await stampUuid(filePath);
+    if (stamped) return stamped;
+    throw new Error("uuid stamp refused");
   } catch (error) {
     await logAudit({
       level: "WARNING",
diff --git a/app/_server/actions/lib/metadata-cache.ts b/app/_server/actions/lib/metadata-cache.ts
index ab323f91a..bad60ff07 100644
--- a/app/_server/actions/lib/metadata-cache.ts
+++ b/app/_server/actions/lib/metadata-cache.ts
@@ -90,6 +90,15 @@ export async function getOrCompute<T>(
   return [...(await promise)];
 }
 
+export function invalidatePath(target: string) {
+  const abs = path.resolve(target);
+  dirToKeys.forEach((_, dir) => {
+    if (abs === dir || abs.startsWith(dir + path.sep) || dir.startsWith(abs + path.sep)) {
+      invalidateDir(dir);
+    }
+  });
+}
+
 export function invalidateCached(key: string) {
   drop(key);
 }
diff --git a/app/_server/actions/lib/stamp-uuid.ts b/app/_server/actions/lib/stamp-uuid.ts
new file mode 100644
index 000000000..da9beb13f
--- /dev/null
+++ b/app/_server/actions/lib/stamp-uuid.ts
@@ -0,0 +1,54 @@
+import fs from "fs/promises";
+import { extractYamlMetadata, generateUuid } from "@/app/_utils/yaml-metadata-utils";
+import { serverWriteFile } from "@/app/_server/actions/file";
+import { singleFlight } from "@/app/_server/actions/lib/concurrency";
+
+const FRONTMATTER_OPEN = /^(\uFEFF?---\r?\n)/;
+const FRONTMATTER_BLOCK = /^\uFEFF?---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/;
+const UUID_LINE = /^uuid:\s*\S+/m;
+
+const _withUuid = (content: string, uuid: string): string =>
+  FRONTMATTER_OPEN.test(content)
+    ? content.replace(FRONTMATTER_OPEN, `$1uuid: ${uuid}\n`)
+    : `---\nuuid: ${uuid}\n---\n\n${content}`;
+
+const _stampable = (content: string, filePath: string): boolean => {
+  if (!content.trim()) {
+    console.warn("Refusing to stamp uuid on an empty read:", filePath);
+    return false;
+  }
+
+  const block = content.match(FRONTMATTER_BLOCK)?.[0];
+  if (!block) return true;
+
+  if (UUID_LINE.test(block)) {
+    console.warn("Frontmatter has a uuid line that did not parse, leaving it alone:", filePath);
+    return false;
+  }
+
+  const opened = FRONTMATTER_OPEN.test(content);
+  const parsed = Object.keys(extractYamlMetadata(content).metadata).length > 0;
+  if (opened && !parsed && block.split("\n").length > 3) {
+    console.warn("Frontmatter did not parse, refusing to stamp uuid:", filePath);
+    return false;
+  }
+
+  return true;
+};
+
+export const stampUuid = (filePath: string): Promise<string | undefined> =>
+  singleFlight(`stamp:${filePath}`, async () => {
+    try {
+      const content = await fs.readFile(filePath, "utf-8");
+      const existing = extractYamlMetadata(content).metadata.uuid;
+      if (typeof existing === "string" && existing) return existing;
+      if (!_stampable(content, filePath)) return undefined;
+
+      const uuid = generateUuid();
+      await serverWriteFile(filePath, _withUuid(content, uuid));
+      return uuid;
+    } catch (error) {
+      console.error("Failed to stamp uuid:", filePath, error);
+      return undefined;
+    }
+  });
diff --git a/app/_server/actions/link/index.ts b/app/_server/actions/link/index.ts
deleted file mode 100644
index 1c76ca71f..000000000
--- a/app/_server/actions/link/index.ts
+++ /dev/null
@@ -1,369 +0,0 @@
-"use server";
-
-import path from "path";
-import { getCurrentUser } from "@/app/_server/actions/users";
-import { getUserModeDir } from "@/app/_server/actions/file";
-import { ItemTypes, Modes } from "@/app/_types/enums";
-import { serverReadFile, serverWriteFile } from "@/app/_server/actions/file";
-import { getUserNotes } from "@/app/_server/actions/note";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
-import { ItemType, LinkIndex, ItemLinks } from "@/app/_types";
-
-export interface LinkTarget {
-  type: ItemType;
-  uuid: string;
-}
-
-const INDEX_FILENAME = ".index.json";
-
-const getIndexFilePath = async (username: string): Promise<string> => {
-  const userDir = await getUserModeDir(Modes.NOTES, username);
-  return path.join(userDir, INDEX_FILENAME);
-};
-
-export const readLinkIndex = async (username: string): Promise<LinkIndex> => {
-  try {
-    const indexPath = await getIndexFilePath(username);
-    const content = await serverReadFile(indexPath);
-    return JSON.parse(content) as LinkIndex;
-  } catch {
-    return { notes: {}, checklists: {} };
-  }
-};
-
-export const writeLinkIndex = async (
-  username: string,
-  index: LinkIndex,
-): Promise<void> => {
-  const indexPath = await getIndexFilePath(username);
-  await serverWriteFile(indexPath, JSON.stringify(index, null, 2));
-};
-
-export const parseInternalLinks = async (
-  content: string,
-): Promise<LinkTarget[]> => {
-  const links: LinkTarget[] = [];
-
-  const htmlRegex = /data-href="([^"]+)"[^>]*data-type="(note|checklist)"/g;
-  let match;
-  while ((match = htmlRegex.exec(content)) !== null) {
-    const href = match[1];
-    const type = match[2] as ItemType;
-
-    if (href?.startsWith("/jotty/")) {
-      const uuid = href.replace("/jotty/", "");
-      links.push({
-        type: type || ItemTypes.NOTE,
-        uuid,
-      });
-    } else if (href && !href.includes("/")) {
-      links.push({
-        type,
-        uuid: href,
-      });
-    }
-  }
-
-  if (links.length === 0) {
-    const markdownRegex = /\[([^\]]+)\]\(([^)]+)\)/g;
-    while ((match = markdownRegex.exec(content)) !== null) {
-      const href = match[2];
-
-      if (href?.startsWith("/jotty/")) {
-        const uuid = href.replace("/jotty/", "");
-        links.push({
-          type: ItemTypes.NOTE,
-          uuid,
-        });
-      }
-    }
-  }
-
-  const uniqueLinks = links.filter(
-    (link, index, self) =>
-      index ===
-      self.findIndex((l) => l.type === link.type && l.uuid === link.uuid),
-  );
-
-  return Promise.resolve(uniqueLinks);
-};
-
-export const updateIndexForItem = async (
-  username: string,
-  itemType: ItemType,
-  itemUuid: string,
-  currentLinks: LinkTarget[],
-): Promise<void> => {
-  if (!Array.isArray(currentLinks)) {
-    currentLinks = [];
-  }
-
-  const index = await readLinkIndex(username);
-
-  const currentItemKey = `${itemType}s`;
-  const currentItemLinks = index[currentItemKey][itemUuid] || {
-    isLinkedTo: { notes: [], checklists: [] },
-    isReferencedIn: { notes: [], checklists: [] },
-  };
-
-  for (const targetUuid of currentItemLinks.isLinkedTo.notes) {
-    if (index.notes[targetUuid]) {
-      const refKey = currentItemKey as keyof ItemLinks["isReferencedIn"];
-      index.notes[targetUuid].isReferencedIn[refKey] = index.notes[
-        targetUuid
-      ].isReferencedIn[refKey].filter((ref: string) => ref !== itemUuid);
-    }
-  }
-
-  for (const targetUuid of currentItemLinks.isLinkedTo.checklists) {
-    if (index.checklists[targetUuid]) {
-      const refKey = currentItemKey as keyof ItemLinks["isReferencedIn"];
-      index.checklists[targetUuid].isReferencedIn[refKey] = index.checklists[
-        targetUuid
-      ].isReferencedIn[refKey].filter((ref: string) => ref !== itemUuid);
-    }
-  }
-
-  index[currentItemKey][itemUuid] = {
-    isLinkedTo: { notes: [], checklists: [] },
-    isReferencedIn: { notes: [], checklists: [] },
-  };
-
-  for (const link of currentLinks) {
-    const targetKey = `${link.type}s`;
-
-    if (!(index[currentItemKey][itemUuid].isLinkedTo as any)[targetKey]) {
-      (index[currentItemKey][itemUuid].isLinkedTo as any)[targetKey] = [];
-    }
-    if (
-      !(index[currentItemKey][itemUuid].isLinkedTo as any)[targetKey].includes(
-        link.uuid,
-      )
-    ) {
-      (index[currentItemKey][itemUuid].isLinkedTo as any)[targetKey].push(
-        link.uuid,
-      );
-    }
-
-    if (!index[targetKey][link.uuid]) {
-      index[targetKey][link.uuid] = {
-        isLinkedTo: { notes: [], checklists: [] },
-        isReferencedIn: { notes: [], checklists: [] },
-      };
-    }
-    if (!(index[targetKey][link.uuid].isReferencedIn as any)[currentItemKey]) {
-      (index[targetKey][link.uuid].isReferencedIn as any)[currentItemKey] = [];
-    }
-    if (
-      !(index[targetKey][link.uuid].isReferencedIn as any)[
-        currentItemKey
-      ].includes(itemUuid)
-    ) {
-      (index[targetKey][link.uuid].isReferencedIn as any)[currentItemKey].push(
-        itemUuid,
-      );
-    }
-  }
-
-  await writeLinkIndex(username, index);
-};
-
-export const removeItemFromIndex = async (
-  username: string,
-  itemType: ItemType,
-  itemUuid: string,
-): Promise<void> => {
-  const index = await readLinkIndex(username);
-  const itemKey = `${itemType}s`;
-
-  if (!index[itemKey][itemUuid]) return;
-
-  const itemLinks = index[itemKey][itemUuid];
-
-  for (const linkedItem of itemLinks.isLinkedTo.notes) {
-    if (index.notes[linkedItem]) {
-      index.notes[linkedItem].isReferencedIn[
-        itemType === ItemTypes.NOTE ? Modes.NOTES : Modes.CHECKLISTS
-      ] = index.notes[linkedItem].isReferencedIn[
-        itemType === ItemTypes.NOTE ? Modes.NOTES : Modes.CHECKLISTS
-      ].filter((ref) => ref !== itemUuid);
-    }
-  }
-
-  for (const linkedItem of itemLinks.isLinkedTo.checklists) {
-    if (index.checklists[linkedItem]) {
-      index.checklists[linkedItem].isReferencedIn[
-        itemType === ItemTypes.NOTE ? Modes.NOTES : Modes.CHECKLISTS
-      ] = index.checklists[linkedItem].isReferencedIn[
-        itemType === ItemTypes.NOTE ? Modes.NOTES : Modes.CHECKLISTS
-      ].filter((ref) => ref !== itemUuid);
-    }
-  }
-
-  for (const referencingItem of itemLinks.isReferencedIn.notes) {
-    if (index.notes[referencingItem]) {
-      index.notes[referencingItem].isLinkedTo[
-        itemType === ItemTypes.NOTE ? Modes.NOTES : Modes.CHECKLISTS
-      ] = index.notes[referencingItem].isLinkedTo[
-        itemType === ItemTypes.NOTE ? Modes.NOTES : Modes.CHECKLISTS
-      ].filter((link) => link !== itemUuid);
-    }
-  }
-
-  for (const referencingItem of itemLinks.isReferencedIn.checklists) {
-    if (index.checklists[referencingItem]) {
-      index.checklists[referencingItem].isLinkedTo[
-        itemType === ItemTypes.NOTE ? Modes.NOTES : Modes.CHECKLISTS
-      ] = index.checklists[referencingItem].isLinkedTo[
-        itemType === ItemTypes.NOTE ? Modes.NOTES : Modes.CHECKLISTS
-      ].filter((link) => link !== itemUuid);
-    }
-  }
-
-  delete index[itemKey][itemUuid];
-
-  await writeLinkIndex(username, index);
-};
-
-export const updateItemCategory = async (
-  username: string,
-  itemType: ItemType,
-  oldItemId: string,
-  newItemId: string,
-): Promise<void> => {
-  const index = await readLinkIndex(username);
-  const itemKey = `${itemType}s`;
-
-  if (oldItemId === newItemId) return;
-
-  const oldItemData = index[itemKey][oldItemId];
-  if (!oldItemData) return;
-
-  index[itemKey][newItemId] = oldItemData;
-  delete index[itemKey][oldItemId];
-
-  for (const referencingNoteId of oldItemData.isReferencedIn.notes) {
-    if (index.notes[referencingNoteId]) {
-      index.notes[referencingNoteId].isLinkedTo.notes = index.notes[
-        referencingNoteId
-      ].isLinkedTo.notes.map((link) => (link === oldItemId ? newItemId : link));
-    }
-  }
-
-  for (const referencingChecklistId of oldItemData.isReferencedIn.checklists) {
-    if (index.checklists[referencingChecklistId]) {
-      index.checklists[referencingChecklistId].isLinkedTo.notes =
-        index.checklists[referencingChecklistId].isLinkedTo.notes.map((link) =>
-          link === oldItemId ? newItemId : link,
-        );
-    }
-  }
-
-  index[itemKey][newItemId].isReferencedIn = oldItemData.isReferencedIn;
-
-  await writeLinkIndex(username, index);
-};
-
-export const rebuildLinkIndexInternal = async (
-  username: string,
-): Promise<void> => {
-  const [notesResult, checklistsResult] = await Promise.all([
-    getUserNotes({ username }),
-    getUserChecklists({ username }),
-  ]);
-
-  const allNotes = notesResult.success ? notesResult.data || [] : [];
-  const allChecklists = checklistsResult.success
-    ? checklistsResult.data || []
-    : [];
-
-  const newIndex: LinkIndex = { notes: {}, checklists: {} };
-
-  for (const note of allNotes) {
-    if (note.uuid) {
-      newIndex.notes[note.uuid] = {
-        isLinkedTo: { notes: [], checklists: [] },
-        isReferencedIn: { notes: [], checklists: [] },
-      };
-    }
-  }
-
-  for (const checklist of allChecklists) {
-    if (checklist.uuid) {
-      newIndex.checklists[checklist.uuid] = {
-        isLinkedTo: { notes: [], checklists: [] },
-        isReferencedIn: { notes: [], checklists: [] },
-      };
-    }
-  }
-
-  for (const note of allNotes) {
-    if (!note.uuid) continue;
-    const links = await parseInternalLinks(note.content || "");
-    newIndex.notes[note.uuid].isLinkedTo = {
-      notes: links.filter((l) => l.type === ItemTypes.NOTE).map((l) => l.uuid),
-      checklists: links
-        .filter((l) => l.type === ItemTypes.CHECKLIST)
-        .map((l) => l.uuid),
-    };
-  }
-
-  for (const checklist of allChecklists) {
-    if (!checklist.uuid) continue;
-    const content = checklist?.items?.map((i) => i.text).join("\n") || "";
-    const links = await parseInternalLinks(content);
-    newIndex.checklists[checklist.uuid].isLinkedTo = {
-      notes: links.filter((l) => l.type === ItemTypes.NOTE).map((l) => l.uuid),
-      checklists: links
-        .filter((l) => l.type === ItemTypes.CHECKLIST)
-        .map((l) => l.uuid),
-    };
-  }
-
-  for (const [sourceType, items] of Object.entries(newIndex)) {
-    for (const [sourceUuid, itemLinks] of Object.entries(items)) {
-      for (const targetUuid of itemLinks.isLinkedTo.notes) {
-        if (newIndex.notes[targetUuid]) {
-          const refType =
-            sourceType === Modes.NOTES ? Modes.NOTES : Modes.CHECKLISTS;
-          if (
-            !newIndex.notes[targetUuid].isReferencedIn[refType].includes(
-              sourceUuid,
-            )
-          ) {
-            newIndex.notes[targetUuid].isReferencedIn[refType].push(sourceUuid);
-          }
-        }
-      }
-
-      for (const targetUuid of itemLinks.isLinkedTo.checklists) {
-        if (newIndex.checklists[targetUuid]) {
-          const refType =
-            sourceType === Modes.NOTES ? Modes.NOTES : Modes.CHECKLISTS;
-          if (
-            !newIndex.checklists[targetUuid].isReferencedIn[refType].includes(
-              sourceUuid,
-            )
-          ) {
-            newIndex.checklists[targetUuid].isReferencedIn[refType].push(
-              sourceUuid,
-            );
-          }
-        }
-      }
-    }
-  }
-
-  await writeLinkIndex(username, newIndex);
-};
-
-export const rebuildLinkIndex = async (username: string): Promise<void> => {
-  const currentUser = await getCurrentUser();
-  if (!currentUser) throw new Error("Not authenticated");
-
-  if (username !== currentUser.username && !currentUser.isAdmin) {
-    throw new Error("Unauthorized: can only rebuild your own link index");
-  }
-
-  await rebuildLinkIndexInternal(username);
-};
diff --git a/app/_server/actions/note/creator.ts b/app/_server/actions/note/creator.ts
index 3ded2da81..71b162b4b 100644
--- a/app/_server/actions/note/creator.ts
+++ b/app/_server/actions/note/creator.ts
@@ -11,10 +11,7 @@ import { sanitizeMarkdown } from "@/app/_utils/markdown-utils";
 import { extractHashtagsFromContent } from "@/app/_utils/tag-utils";
 import { getFormData } from "@/app/_utils/global-utils";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
-import {
-  updateIndexForItem,
-  parseInternalLinks,
-} from "@/app/_server/actions/link";
+import { tidyItemLinks } from "@/app/_server/actions/relations/tidy";
 import {
   extractYamlMetadata as stripYaml,
   generateUuid,
@@ -39,11 +36,14 @@ export const makeNote = async (
 
     const sanitizedContent = sanitizeMarkdown(rawContent);
     const { metadata, contentWithoutMetadata } = stripYaml(sanitizedContent);
-    const content = contentWithoutMetadata;
-    const encryptionMethod = detectEncryptionMethod(content) || undefined;
-    const encrypted = isEncrypted(content);
+    const encryptionMethod =
+      detectEncryptionMethod(contentWithoutMetadata) || undefined;
+    const encrypted = isEncrypted(contentWithoutMetadata);
 
     const target = await targetDir(Modes.NOTES, actor.username, category);
+    const content = encrypted
+      ? contentWithoutMetadata
+      : await tidyItemLinks(contentWithoutMetadata, target.owner);
 
     const verdict = await bouncer(
       target,
@@ -96,17 +96,6 @@ export const makeNote = async (
       commitNote(target.owner, relativePath, "create", title).catch(() => {});
     }
 
-    try {
-      const links = (await parseInternalLinks(newDoc.content)) || [];
-      await updateIndexForItem(target.owner, "note", newDoc.uuid!, links);
-    } catch (error) {
-      console.warn(
-        "Failed to update link index for new note:",
-        newDoc.id,
-        error,
-      );
-    }
-
     await logContentEvent(
       "note_created",
       "note",
diff --git a/app/_server/actions/note/crud.ts b/app/_server/actions/note/crud.ts
index b242ef8d8..b11d29338 100644
--- a/app/_server/actions/note/crud.ts
+++ b/app/_server/actions/note/crud.ts
@@ -21,11 +21,9 @@ import { extractHashtagsFromContent } from "@/app/_utils/tag-utils";
 import { getFormData } from "@/app/_utils/global-utils";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 import {
-  updateIndexForItem,
-  parseInternalLinks,
-  removeItemFromIndex,
-  rebuildLinkIndexInternal,
-} from "@/app/_server/actions/link";
+  refreshWikilinks,
+  tidyItemLinks,
+} from "@/app/_server/actions/relations/tidy";
 import { canReach } from "@/app/_server/actions/share/queries";
 import {
   extractYamlMetadata as stripYaml,
@@ -37,7 +35,7 @@ import {
 import { getSettings } from "@/app/_server/actions/config";
 import { logContentEvent } from "@/app/_server/actions/log";
 import { commitNote } from "@/app/_server/actions/history";
-import { noteToMarkdown, convertInternalLinksToNewFormat } from "./parsers";
+import { noteToMarkdown } from "./parsers";
 import { getNoteById } from "./queries";
 import {
   targetDir,
@@ -155,15 +153,12 @@ export const updateNote = async (formData: FormData, autosaveNotes = false) => {
     const sanitizedContent = sanitizeMarkdown(content);
     const { metadata: incomingMeta, contentWithoutMetadata } =
       stripYaml(sanitizedContent);
-    const processedContent = settings?.editor?.enableBilateralLinks
-      ? await convertInternalLinksToNewFormat(
-          contentWithoutMetadata,
-          actingUsername,
-          note.category,
-        )
-      : contentWithoutMetadata;
-
-    const convertedContent = processedContent;
+    const convertedContent = isEncrypted(contentWithoutMetadata)
+      ? contentWithoutMetadata
+      : refreshWikilinks(
+          await tidyItemLinks(contentWithoutMetadata, note.owner || actingUsername),
+          note.uuid,
+        );
 
     const encryptionMethod =
       detectEncryptionMethod(convertedContent) || undefined;
@@ -247,40 +242,6 @@ export const updateNote = async (formData: FormData, autosaveNotes = false) => {
       ).catch(() => {});
     }
 
-    if (settings?.editor?.enableBilateralLinks) {
-      try {
-        const links = (await parseInternalLinks(updatedDoc.content)) || [];
-        const newItemKey = `${updatedDoc.category || UNCATEGORIZED}/${
-          updatedDoc.id
-        }`;
-
-        const oldItemKey = `${home.category || UNCATEGORIZED}/${currentId}`;
-
-        if (oldItemKey !== newItemKey || isMoving) {
-          await rebuildLinkIndexInternal(home.owner);
-
-          if (destination.owner !== home.owner) {
-            await rebuildLinkIndexInternal(destination.owner);
-          }
-
-          revalidatePath("/");
-        }
-
-        await updateIndexForItem(
-          destination.owner,
-          "note",
-          updatedDoc.uuid!,
-          links,
-        );
-      } catch (error) {
-        console.warn(
-          "Failed to update link index for note:",
-          updatedDoc.id,
-          error,
-        );
-      }
-    }
-
     if (oldFilePath && oldFilePath !== filePath) {
       await serverDeleteFile(oldFilePath);
     }
@@ -404,12 +365,6 @@ export const deleteNote = async (formData: FormData, username?: string) => {
       ).catch(() => {});
     }
 
-    try {
-      await removeItemFromIndex(note.owner!, "note", note.uuid!);
-    } catch (error) {
-      console.warn("Failed to remove note from link index:", note.id, error);
-    }
-
     try {
       revalidatePath("/");
       revalidatePath(`/note/${note.uuid}`);
diff --git a/app/_server/actions/note/index.ts b/app/_server/actions/note/index.ts
index 2df7eb7f0..bd4c8f914 100644
--- a/app/_server/actions/note/index.ts
+++ b/app/_server/actions/note/index.ts
@@ -1,8 +1,4 @@
-export {
-  parseMarkdownNote,
-  noteToMarkdown,
-  convertInternalLinksToNewFormat,
-} from "./parsers";
+export { parseMarkdownNote, noteToMarkdown } from "./parsers";
 export { readNotesRecursively } from "./readers";
 export { CheckForNeedsMigration } from "./migration";
 export { createNote, updateNote, deleteNote, cloneNote } from "./crud";
diff --git a/app/_server/actions/note/parsers.ts b/app/_server/actions/note/parsers.ts
index 9fe95caf3..10a5afd84 100644
--- a/app/_server/actions/note/parsers.ts
+++ b/app/_server/actions/note/parsers.ts
@@ -6,6 +6,7 @@ import {
   generateYamlFrontmatter,
   generateUuid,
   strayMeta,
+  createdAtOf,
 } from "@/app/_utils/yaml-metadata-utils";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
@@ -32,7 +33,7 @@ export const parseMarkdownNote = (
     content: contentWithoutMetadata,
     category,
     createdAt: fileStats
-      ? fileStats.birthtime.toISOString()
+      ? createdAtOf(metadata, fileStats.birthtime)
       : new Date().toISOString(),
     updatedAt: fileStats
       ? fileStats.mtime.toISOString()
@@ -49,130 +50,6 @@ export const parseMarkdownNote = (
   };
 };
 
-export const convertInternalLinksToNewFormat = async (
-  content: string,
-  username?: string,
-  category?: string
-): Promise<string> => {
-  let convertedContent = content;
-
-  // @ts-ignore
-  const spanRegex = /<span[^>]*data-internal-link[^>]*>.*?<\/span>/gs;
-  const spanMatches = Array.from(content.matchAll(spanRegex));
-
-  for (const match of spanMatches) {
-    const [fullMatch] = match;
-    const hrefMatch = fullMatch.match(/data-href="([^"]*)"/);
-    const convertMatch = fullMatch.match(
-      /data-convert-to-bidirectional="([^"]*)"/
-    );
-
-    const href = hrefMatch?.[1];
-    const shouldConvert = convertMatch?.[1] === "true";
-
-    if (!shouldConvert || !href) {
-      continue;
-    }
-
-    if (href.startsWith("/jotty/")) {
-      continue;
-    }
-
-    if (href.startsWith("/note/")) {
-      const parts = href.split("/");
-      if (parts.length >= 3) {
-        const categoryAndId = parts.slice(2).join("/");
-        const lastSlashIndex = categoryAndId.lastIndexOf("/");
-        const id = categoryAndId.substring(lastSlashIndex + 1);
-
-        try {
-          const { getUserNotes } = await import("./queries");
-          const notes = await getUserNotes({ username, allowArchived: true });
-          if (notes.success && notes.data) {
-            const note = notes.data.find((n) => n.id === id);
-            if (note?.uuid) {
-              let updatedSpan = fullMatch
-                .replace(/data-href="[^"]*"/, `data-href="/jotty/${note.uuid}"`)
-                .replace(
-                  /data-convert-to-bidirectional="true"/,
-                  `data-convert-to-bidirectional="false"`
-                );
-
-              if (fullMatch.includes("data-uuid=")) {
-                updatedSpan = updatedSpan.replace(
-                  /data-uuid="[^"]*"/,
-                  `data-uuid="${note.uuid}"`
-                );
-              } else {
-                updatedSpan = updatedSpan.replace(
-                  "data-internal-link",
-                  `data-internal-link data-uuid="${note.uuid}"`
-                );
-              }
-              convertedContent = convertedContent.replace(
-                fullMatch,
-                updatedSpan
-              );
-            }
-          }
-        } catch (error) {
-          console.warn("Failed to convert note link:", href, error);
-        }
-      }
-    } else if (href.startsWith("/checklist/")) {
-      const parts = href.split("/");
-      if (parts.length >= 3) {
-        const categoryAndId = parts.slice(2).join("/");
-        const lastSlashIndex = categoryAndId.lastIndexOf("/");
-        const id = categoryAndId.substring(lastSlashIndex + 1);
-
-        try {
-          const { getUserChecklists } = await import("../checklist");
-          const checklists = await getUserChecklists({
-            username,
-            isRaw: true,
-            allowArchived: true,
-          });
-          if (checklists.success && checklists.data) {
-            const checklist = checklists.data.find((c) => c.id === id);
-            if (checklist?.uuid) {
-              let updatedSpan = fullMatch
-                .replace(
-                  /data-href="[^"]*"/,
-                  `data-href="/jotty/${checklist.uuid}"`
-                )
-                .replace(
-                  /data-convert-to-bidirectional="true"/,
-                  `data-convert-to-bidirectional="false"`
-                );
-
-              if (fullMatch.includes("data-uuid=")) {
-                updatedSpan = updatedSpan.replace(
-                  /data-uuid="[^"]*"/,
-                  `data-uuid="${checklist.uuid}"`
-                );
-              } else {
-                updatedSpan = updatedSpan.replace(
-                  "data-internal-link",
-                  `data-internal-link data-uuid="${checklist.uuid}"`
-                );
-              }
-              convertedContent = convertedContent.replace(
-                fullMatch,
-                updatedSpan
-              );
-            }
-          }
-        } catch (error) {
-          console.warn("Failed to convert checklist link:", href, error);
-        }
-      }
-    }
-  }
-
-  return convertedContent;
-};
-
 export const noteToMarkdown = (note: Note): string => {
   const metadata: Record<string, unknown> = { ...(note.extraMetadata || {}) };
   metadata.uuid = note.uuid || generateUuid();
diff --git a/app/_server/actions/note/queries.ts b/app/_server/actions/note/queries.ts
index 58a2592e9..8f9ad299e 100644
--- a/app/_server/actions/note/queries.ts
+++ b/app/_server/actions/note/queries.ts
@@ -10,7 +10,11 @@ import { getCurrentUser } from "@/app/_server/actions/users";
 import { getUserModeDir, ensureDir } from "@/app/_server/actions/file";
 import { readJsonFile } from "@/app/_server/actions/file";
 import { parseNoteContent } from "@/app/_utils/client-parser-utils";
-import { toIso } from "@/app/_utils/yaml-metadata-utils";
+import {
+  createdAtOf,
+  extractYamlMetadata,
+  toIso,
+} from "@/app/_utils/yaml-metadata-utils";
 import { readNotesRecursively } from "./readers";
 import { mountsFor, mountedItems } from "@/app/_server/actions/share/mounts";
 import { canReachFile } from "@/app/_server/actions/share/access";
@@ -123,7 +127,7 @@ export const getNoteById = async (
     title: parsedData.title,
     content: parsedData.content,
     category: noteCategory,
-    createdAt: toIso(stats.birthtime),
+    createdAt: createdAtOf(extractYamlMetadata(rawContent).metadata, stats.birthtime),
     updatedAt: toIso(stats.mtime),
     owner: ownerUsername,
     isShared,
diff --git a/app/_server/actions/note/readers.ts b/app/_server/actions/note/readers.ts
index ceb5e5bb4..8b9d2e64a 100644
--- a/app/_server/actions/note/readers.ts
+++ b/app/_server/actions/note/readers.ts
@@ -9,10 +9,10 @@ import {
   readOrderFile,
 } from "@/app/_server/actions/file";
 import {
+  createdAtOf,
   extractYamlMetadata,
   generateUuid,
   toIso,
-  updateYamlMetadata,
 } from "@/app/_utils/yaml-metadata-utils";
 import {
   grepExtractFrontmatter,
@@ -25,34 +25,11 @@ import { parseMarkdownNote } from "./parsers";
 import { Note } from "@/app/_types";
 import { promisify } from "util";
 import { exec } from "child_process";
-import { singleFlight } from "@/app/_server/actions/lib/concurrency";
+import { stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
+import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
 const execAsync = promisify(exec);
 
-const _stampUuid = async (filePath: string): Promise<string | undefined> =>
-  singleFlight(`stamp:${filePath}`, async () => {
-    try {
-      const content = await serverReadFile(filePath);
-      if (!content) return undefined;
-
-      const { metadata } = extractYamlMetadata(content);
-      if (typeof metadata.uuid === "string" && metadata.uuid) {
-        return metadata.uuid;
-      }
-
-      const uuid = generateUuid();
-      await fs.writeFile(
-        filePath,
-        updateYamlMetadata(content, { uuid }),
-        "utf-8",
-      );
-      return uuid;
-    } catch (error) {
-      console.warn("Failed to stamp UUID on note:", filePath, error);
-      return undefined;
-    }
-  });
-
 export const readNotesRecursively = async (
   dir: string,
   basePath: string = "",
@@ -73,7 +50,7 @@ export const readNotesRecursively = async (
         ? ""
         : `-not -path "*/${ARCHIVED_DIR_NAME}/*"`;
       const statsCmd = `find "${dir}" -name "*.md" ${excludeStr} -printf "%p|%W@|%T@\\n"`;
-      const metaCmd = `grep -rE "^(title|uuid|tags|encrypted):|^[[:space:]]+- |^---$" "${dir}"`;
+      const metaCmd = `grep -rE "^(title|uuid|tags|encrypted|createdAt|${SHARED_WITH_KEY}):|^[[:space:]]+- |^---$" "${dir}"`;
       const [statsOut, metaOut] = await Promise.all([
         execAsync(statsCmd, { maxBuffer: 10 * 1024 * 1024 }).catch(() => ({
           stdout: "",
@@ -94,7 +71,8 @@ export const readNotesRecursively = async (
 
       const inFrontmatter = new Map<string, boolean>();
 
-      let inTagsFile = "";
+      let listFile = "";
+      let listKey = "";
       for (const line of metaOut.stdout.split("\n")) {
         if (!line) continue;
         const colonIdx = line.indexOf(":");
@@ -107,19 +85,19 @@ export const readNotesRecursively = async (
         }
         if (!inFrontmatter.get(filePath)) continue;
         if (/^\s+-\s/.test(rest)) {
-          if (inTagsFile === filePath) {
+          if (listFile === filePath) {
             const tag = rest.replace(/^\s+-\s+/, "").trim();
             if (tag) {
               if (!metadataCache!.has(filePath))
                 metadataCache!.set(filePath, {});
               const entry = metadataCache!.get(filePath)!;
-              if (!Array.isArray(entry.tags)) entry.tags = [];
-              (entry.tags as string[]).push(tag);
+              if (!Array.isArray(entry[listKey])) entry[listKey] = [];
+              (entry[listKey] as string[]).push(tag);
             }
           }
           continue;
         }
-        inTagsFile = "";
+        listFile = "";
         const innerColon = rest.indexOf(":");
         if (innerColon === -1) continue;
         const key = rest.slice(0, innerColon);
@@ -130,7 +108,8 @@ export const readNotesRecursively = async (
           const trimmed = val.trim();
           if (trimmed === "") {
             entry.tags = [];
-            inTagsFile = filePath;
+            listFile = filePath;
+            listKey = key;
           } else {
             entry.tags = trimmed
               .replace(/^\[|\]$/g, "")
@@ -140,6 +119,10 @@ export const readNotesRecursively = async (
           }
         } else if (key === "encrypted") {
           entry.encrypted = val.trim() === "true";
+        } else if (key === SHARED_WITH_KEY && val.trim() === "") {
+          entry[key] = [];
+          listFile = filePath;
+          listKey = key;
         } else {
           entry[key] = val.trim().replace(/^["']|["']$/g, "");
         }
@@ -216,7 +199,7 @@ export const readNotesRecursively = async (
         const uuid =
           typeof metadata?.uuid === "string"
             ? metadata.uuid
-            : await _stampUuid(filePath);
+            : await stampUuid(filePath);
 
         if (!uuid) {
           console.warn("Skipping note without a resolvable uuid:", filePath);
@@ -228,7 +211,7 @@ export const readNotesRecursively = async (
           uuid,
           title: typeof metadata?.title === "string" ? metadata.title : id,
           category: categoryPath,
-          createdAt: toIso(stats.birthtime),
+          createdAt: createdAtOf(metadata, stats.birthtime),
           updatedAt: toIso(stats.mtime),
           owner,
           isShared: false,
@@ -248,7 +231,7 @@ export const readNotesRecursively = async (
         const uuid =
           typeof metadata?.uuid === "string"
             ? metadata.uuid
-            : await _stampUuid(filePath);
+            : await stampUuid(filePath);
 
         if (!uuid) {
           console.warn("Skipping note without a resolvable uuid:", filePath);
@@ -261,7 +244,7 @@ export const readNotesRecursively = async (
           title: typeof metadata?.title === "string" ? metadata.title : id,
           content: excerpt,
           category: categoryPath,
-          createdAt: toIso(stats.birthtime),
+          createdAt: createdAtOf(metadata, stats.birthtime),
           updatedAt: toIso(stats.mtime),
           owner,
           isShared: false,
@@ -273,26 +256,15 @@ export const readNotesRecursively = async (
         const content = await serverReadFile(filePath);
         if (isRaw) {
           const { metadata } = extractYamlMetadata(content);
-          let uuid = metadata.uuid;
-          if (!uuid) {
-            uuid = generateUuid();
-            try {
-              await fs.writeFile(
-                filePath,
-                updateYamlMetadata(content, { uuid }),
-                "utf-8",
-              );
-            } catch (error) {
-              console.warn("Failed to save UUID to note file:", error);
-            }
-          }
+          const uuid =
+            metadata.uuid || (await stampUuid(filePath)) || generateUuid();
           return {
             id,
             uuid,
             title: id,
             content: "",
             category: categoryPath,
-            createdAt: toIso(stats.birthtime),
+            createdAt: createdAtOf(metadata, stats.birthtime),
             updatedAt: toIso(stats.mtime),
             owner,
             isShared: false,
diff --git a/app/_server/actions/relations/index.ts b/app/_server/actions/relations/index.ts
new file mode 100644
index 000000000..9e1039881
--- /dev/null
+++ b/app/_server/actions/relations/index.ts
@@ -0,0 +1,142 @@
+"use server";
+
+import { getCurrentUser, canAccessAllContent } from "@/app/_server/actions/users";
+import { getSettings } from "@/app/_server/actions/config";
+import { getUserIndex } from "@/app/_server/actions/users/helpers";
+import { RelationsStatus } from "@/app/_consts/relations";
+import type { Result } from "@/app/_types";
+import type { BrainGraph, ItemRelations } from "@/app/_types/relations";
+import { backlinksFor, graphFor, visibleItems } from "./queries";
+import { rebuildOwnerRelations, rebuildRelations } from "./indexer";
+import { relationsDb } from "./store";
+import { getNoteById, updateNote } from "@/app/_server/actions/note";
+import { canReach } from "@/app/_server/actions/share/queries";
+import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
+import { itemHref } from "@/app/_utils/global-utils";
+import { escapeLinkText } from "@/app/_utils/item-href-utils";
+import { wrapMention } from "./tidy";
+
+const EMPTY_RELATIONS: ItemRelations = { uuid: "", status: RelationsStatus.READY, backlinks: [], mentions: [], wikis: {} };
+
+const _linksEnabled = async (): Promise<boolean> => {
+  const settings = await getSettings();
+  return settings?.editor?.enableBilateralLinks !== false;
+};
+
+const _ownerOf = (uuid: string): string | null => {
+  const row = relationsDb()
+    .prepare("SELECT owner FROM items WHERE uuid = ?")
+    .get(uuid.toLowerCase()) as { owner?: string } | undefined;
+  return row?.owner || null;
+};
+
+export const getItemRelations = async (uuid: string): Promise<ItemRelations> => {
+  try {
+    const user = await getCurrentUser();
+    if (!user?.username || !(await _linksEnabled())) return EMPTY_RELATIONS;
+
+    const visible = await visibleItems(user.username);
+    if (visible.has(uuid.toLowerCase())) return backlinksFor(uuid, visible);
+
+    const owner = _ownerOf(uuid);
+    if (!owner || !(await canAccessAllContent())) return EMPTY_RELATIONS;
+
+    return backlinksFor(uuid, await visibleItems(owner));
+  } catch (error) {
+    console.error("getItemRelations failed:", error);
+    return EMPTY_RELATIONS;
+  }
+};
+
+export const getBrain = async (username?: string): Promise<Result<BrainGraph>> => {
+  try {
+    const user = await getCurrentUser();
+    if (!user?.username) return { success: false, error: "Not authenticated" };
+    if (!(await _linksEnabled())) return { success: false, error: "Not found" };
+
+    const owner = username || user.username;
+    if (owner !== user.username) {
+      const peekable = (await canAccessAllContent()) && (await getUserIndex(owner)) !== -1;
+      if (!peekable) return { success: false, error: "Not found" };
+    }
+
+    return { success: true, data: graphFor(owner, await visibleItems(owner)) };
+  } catch (error) {
+    console.error("getBrain failed:", error);
+    return { success: false, error: "Failed to load relationships" };
+  }
+};
+
+export const reindexRelations = async (username?: string): Promise<Result<number>> => {
+  const user = await getCurrentUser();
+  if (!user?.username) return { success: false, error: "Not authenticated" };
+  if (!user.isAdmin) return { success: false, error: "Admins only" };
+
+  try {
+    if (!username) return { success: true, data: await rebuildRelations() };
+    if ((await getUserIndex(username)) === -1) return { success: false, error: "User not found" };
+    return { success: true, data: await rebuildOwnerRelations(username) };
+  } catch (error) {
+    console.error("reindexRelations failed:", error);
+    return { success: false, error: "Failed to rebuild relationships" };
+  }
+};
+
+const _itemRow = (uuid: string) =>
+  relationsDb()
+    .prepare("SELECT uuid, type, title FROM items WHERE uuid = ?")
+    .get(uuid.toLowerCase()) as { uuid: string; type: ItemTypes; title: string } | undefined;
+
+type Rewriter = (content: string, target: { title: string; href: string }) => string | null;
+
+const _editLinking = async (
+  sourceUuid: string,
+  targetUuid: string,
+  rewrite: Rewriter,
+  label: string,
+): Promise<Result<null>> => {
+  const user = await getCurrentUser();
+  if (!user?.username) return { success: false, error: "Not authenticated" };
+
+  try {
+    const allowed = await canReach(sourceUuid, ItemTypes.NOTE, user.username, PermissionTypes.EDIT);
+    if (!allowed) return { success: false, error: "Permission denied" };
+
+    const [note, target] = [await getNoteById(sourceUuid), _itemRow(targetUuid)];
+    if (!note || !target) return { success: false, error: "Not found" };
+    if (note.encrypted) return { success: false, error: "Encrypted notes stay closed" };
+
+    const visible = await visibleItems(user.username);
+    if (!visible.has(target.uuid)) return { success: false, error: "Not found" };
+
+    const content = rewrite(note.content || "", {
+      title: target.title,
+      href: itemHref(target.type, target.uuid),
+    });
+    if (content === null) return { success: false, error: "Mention not found" };
+
+    const formData = new FormData();
+    formData.append("uuid", note.uuid || sourceUuid);
+    formData.append("title", note.title);
+    formData.append("category", note.category || "");
+    formData.append("content", content);
+
+    const result = await updateNote(formData);
+    if (result && "error" in result && result.error) return { success: false, error: result.error };
+    return { success: true, data: null };
+  } catch (error) {
+    console.error(`${label} failed:`, error);
+    return { success: false, error: "Failed to connect items" };
+  }
+};
+
+const _appendLink: Rewriter = (content, { title, href }) =>
+  `${content.trimEnd()}\n\n[${escapeLinkText(title)}](${href})\n`;
+
+const _wrapFirst: Rewriter = (content, { title, href }) => wrapMention(content, title, href);
+
+export const connectItems = async (sourceUuid: string, targetUuid: string): Promise<Result<null>> =>
+  _editLinking(sourceUuid, targetUuid, _appendLink, "connectItems");
+
+export const linkMention = async (sourceUuid: string, targetUuid: string): Promise<Result<null>> =>
+  _editLinking(sourceUuid, targetUuid, _wrapFirst, "linkMention");
diff --git a/app/_server/actions/relations/indexer.ts b/app/_server/actions/relations/indexer.ts
new file mode 100644
index 000000000..2739824ce
--- /dev/null
+++ b/app/_server/actions/relations/indexer.ts
@@ -0,0 +1,339 @@
+import fs from "fs/promises";
+import path from "path";
+import type { DatabaseSync } from "node:sqlite";
+import { LinkKinds, RelationsStatus } from "@/app/_consts/relations";
+import { ItemTypes } from "@/app/_types/enums";
+import { isUuid } from "@/app/_consts/identity";
+import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+import { isEncrypted } from "@/app/_utils/encryption-utils";
+import { singleFlight } from "@/app/_server/actions/lib/concurrency";
+import { getAllFileStats } from "@/app/_server/actions/file";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { readLinks, titleKey } from "./parser";
+import { itemFileInfo, itemTreeRoots } from "./paths";
+import {
+  inTransaction,
+  relationsDb,
+  relationsStatus,
+  setRelationsStatus,
+} from "./store";
+
+const RELATIONS_ACTOR = "system";
+const RECONCILE_EVERY_MS = 60_000;
+
+const _origins = (): string[] => {
+  try {
+    return process.env.APP_URL ? [new URL(process.env.APP_URL).origin] : [];
+  } catch {
+    return [];
+  }
+};
+
+const _tally = (keys: string[]): Map<string, number> => {
+  const counts = new Map<string, number>();
+  keys.forEach((key) => counts.set(key, (counts.get(key) || 0) + 1));
+  return counts;
+};
+
+const _prefixOf = (dir: string): string =>
+  path.resolve(dir).replace(/[\\/]+$/, "") + path.sep;
+
+const _createdAt = (metadata: Record<string, unknown>, mtime: number): number => {
+  const raw = metadata.createdAt;
+  const stamp =
+    raw instanceof Date ? raw.getTime() : typeof raw === "string" ? Date.parse(raw) : NaN;
+  return Number.isFinite(stamp) ? stamp : mtime;
+};
+
+const _wikiLabels = (wikis: string[]): Map<string, string> => {
+  const labels = new Map<string, string>();
+  wikis.forEach((label) => {
+    const key = titleKey(label);
+    if (key && !labels.has(key)) labels.set(key, label);
+  });
+  return labels;
+};
+
+const _byTitle = (db: DatabaseSync, owner: string, key: string, exclude = ""): string | null => {
+  const row = db
+    .prepare(
+      `SELECT uuid FROM items WHERE owner = ? AND title_key = ? AND uuid <> ?
+       ORDER BY created ASC, uuid ASC LIMIT 1`,
+    )
+    .get(owner, key, exclude) as { uuid?: string } | undefined;
+  return row?.uuid || null;
+};
+
+const _bind = (db: DatabaseSync, src: string, text: string, dst: string) =>
+  db
+    .prepare(
+      `INSERT INTO bindings (src, text, dst) VALUES (?, ?, ?)
+       ON CONFLICT(src, text) DO UPDATE SET dst = excluded.dst`,
+    )
+    .run(src, text, dst);
+
+const _resolveWiki = (db: DatabaseSync, src: string, owner: string, text: string): string | null => {
+  const bound = db
+    .prepare(
+      `SELECT b.dst AS dst FROM bindings b JOIN items i ON i.uuid = b.dst
+       WHERE b.src = ? AND b.text = ?`,
+    )
+    .get(src, text) as { dst?: string } | undefined;
+  if (bound?.dst) return bound.dst;
+
+  const found = _byTitle(db, owner, text, src);
+  if (found) _bind(db, src, text, found);
+  return found;
+};
+
+const _adoptOrphans = (db: DatabaseSync, owner: string, uuid: string, key: string) => {
+  if (_byTitle(db, owner, key) !== uuid) return;
+  const orphans = db
+    .prepare(
+      `SELECT DISTINCT src FROM links WHERE kind = ? AND dst IS NULL AND dst_text = ?
+       AND src IN (SELECT uuid FROM items WHERE owner = ?)`,
+    )
+    .all(LinkKinds.WIKI, key, owner) as { src: string }[];
+  const adopt = db.prepare("UPDATE links SET dst = ? WHERE kind = ? AND dst IS NULL AND dst_text = ? AND src = ?");
+  orphans.forEach(({ src }) => {
+    if (src === uuid) return;
+    adopt.run(uuid, LinkKinds.WIKI, key, src);
+    _bind(db, src, key, uuid);
+  });
+};
+
+const _releaseTargets = (db: DatabaseSync, uuids: string[]) => {
+  const lost = db.prepare(
+    `SELECT DISTINCT l.src AS src, l.dst_text AS text, i.owner AS owner
+     FROM links l JOIN items i ON i.uuid = l.src WHERE l.kind = ? AND l.dst = ?`,
+  );
+  const release = db.prepare("UPDATE links SET dst = NULL WHERE kind = ? AND dst = ?");
+  const unbind = db.prepare("DELETE FROM bindings WHERE dst = ?");
+  const rebind = db.prepare("UPDATE links SET dst = ? WHERE kind = ? AND src = ? AND dst_text = ?");
+  uuids.forEach((uuid) => {
+    const rows = lost.all(LinkKinds.WIKI, uuid) as { src: string; text: string; owner: string }[];
+    release.run(LinkKinds.WIKI, uuid);
+    unbind.run(uuid);
+    rows.forEach(({ src, text, owner }) => {
+      const next = _resolveWiki(db, src, owner, text);
+      if (next) rebind.run(next, LinkKinds.WIKI, src, text);
+    });
+  });
+};
+
+export const indexItemFile = (
+  filePath: string,
+  content: string,
+  mtime: number,
+): string | null => {
+  const info = itemFileInfo(filePath);
+  if (!info) return null;
+
+  const absPath = path.resolve(filePath);
+  const { metadata, contentWithoutMetadata } = extractYamlMetadata(content);
+  const uuid = typeof metadata.uuid === "string" ? metadata.uuid.toLowerCase() : "";
+  if (!isUuid(uuid)) return null;
+
+  const title =
+    typeof metadata.title === "string" && metadata.title.trim()
+      ? metadata.title.trim()
+      : path.basename(absPath, ".md");
+  const key = titleKey(title);
+  const encrypted = metadata.encrypted === true || isEncrypted(contentWithoutMetadata);
+  const parsed = encrypted
+    ? { targets: [], wikis: [], text: "" }
+    : readLinks(contentWithoutMetadata, _origins());
+
+  const mentions = _tally(
+    parsed.targets
+      .map((target) => target.uuid)
+      .filter((dst): dst is string => Boolean(dst) && dst !== uuid),
+  );
+  const wikiLabels = _wikiLabels(parsed.wikis);
+  const wikis = _tally(parsed.wikis.map(titleKey).filter(Boolean));
+
+  inTransaction((db) => {
+    const displaced = db
+      .prepare("SELECT uuid FROM items WHERE path = ? AND uuid <> ?")
+      .all(absPath, uuid) as { uuid: string }[];
+    displaced.forEach((row) => _forgetUuid(db, row.uuid));
+
+    db.prepare(
+      `INSERT INTO items (uuid, path, owner, type, title, title_key, encrypted, created, mtime)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(uuid) DO UPDATE SET path = excluded.path, owner = excluded.owner,
+         type = excluded.type, title = excluded.title, title_key = excluded.title_key,
+         encrypted = excluded.encrypted, created = excluded.created, mtime = excluded.mtime`,
+    ).run(
+      uuid,
+      absPath,
+      info.owner,
+      info.type,
+      title,
+      key,
+      encrypted ? 1 : 0,
+      _createdAt(metadata, mtime),
+      mtime,
+    );
+
+    db.prepare("DELETE FROM links WHERE src = ?").run(uuid);
+    const insert = db.prepare(
+      "INSERT INTO links (src, dst, dst_text, dst_label, kind, weight) VALUES (?, ?, ?, ?, ?, ?)",
+    );
+    mentions.forEach((weight, dst) =>
+      insert.run(uuid, dst, null, null, LinkKinds.MENTION, weight),
+    );
+    wikis.forEach((weight, text) => {
+      const dst = _resolveWiki(db, uuid, info.owner, text);
+      insert.run(uuid, dst, text, wikiLabels.get(text) || text, LinkKinds.WIKI, weight);
+    });
+
+    _adoptOrphans(db, info.owner, uuid, key);
+
+    db.prepare("DELETE FROM texts WHERE uuid = ?").run(uuid);
+    if (parsed.text && info.type === ItemTypes.NOTE) {
+      db.prepare("INSERT INTO texts (uuid, body) VALUES (?, ?)").run(uuid, parsed.text);
+    }
+  });
+
+  return uuid;
+};
+
+const _forgetUuid = (db: DatabaseSync, uuid: string) => {
+  db.prepare("DELETE FROM links WHERE src = ?").run(uuid);
+  db.prepare("DELETE FROM bindings WHERE src = ?").run(uuid);
+  db.prepare("DELETE FROM texts WHERE uuid = ?").run(uuid);
+  db.prepare("DELETE FROM items WHERE uuid = ?").run(uuid);
+  _releaseTargets(db, [uuid]);
+};
+
+const _forgetWhere = (where: string, value: string) => {
+  inTransaction((db) => {
+    const rows = db.prepare(`SELECT uuid FROM items WHERE ${where}`).all(value) as {
+      uuid: string;
+    }[];
+    rows.forEach((row) => _forgetUuid(db, row.uuid));
+  });
+};
+
+export const forgetItemFile = (filePath: string) =>
+  _forgetWhere("path = ?", path.resolve(filePath));
+
+export const forgetItemTree = (dir: string) => {
+  const prefix = _prefixOf(dir);
+  _forgetWhere("substr(path, 1, length(?1)) = ?1", prefix);
+};
+
+const _indexFromDisk = async (filePath: string, mtime?: number) => {
+  try {
+    const [content, stats] = await Promise.all([
+      fs.readFile(filePath, "utf-8"),
+      mtime === undefined ? fs.stat(filePath) : Promise.resolve(null),
+    ]);
+    indexItemFile(filePath, content, mtime ?? Math.floor(stats!.mtimeMs));
+  } catch (error) {
+    console.error(`Relations could not index ${filePath}:`, error);
+  }
+};
+
+export const indexItemTree = async (dir: string) => {
+  const stats = await getAllFileStats(dir);
+  for (const [filePath, entry] of Array.from(stats)) {
+    if (itemFileInfo(filePath)) await _indexFromDisk(filePath, entry.mtime.getTime());
+  }
+};
+
+const _indexedMtimes = (): Map<string, number> => {
+  const rows = relationsDb().prepare("SELECT path, mtime FROM items").all() as {
+    path: string;
+    mtime: number;
+  }[];
+  return new Map(rows.map((row) => [row.path, row.mtime]));
+};
+
+const _reconcile = async (force = false): Promise<number> => {
+  const wasBuilding = relationsStatus() === RelationsStatus.BUILDING;
+  const indexed = _indexedMtimes();
+  const onDisk = new Map<string, number>();
+
+  for (const root of itemTreeRoots()) {
+    const stats = await getAllFileStats(root);
+    stats.forEach((entry, filePath) => {
+      if (itemFileInfo(filePath)) onDisk.set(path.resolve(filePath), entry.mtime.getTime());
+    });
+  }
+
+  let changed = 0;
+  for (const [filePath, mtime] of Array.from(onDisk)) {
+    if (!force && indexed.get(filePath) === mtime) continue;
+    await _indexFromDisk(filePath, mtime);
+    changed++;
+  }
+
+  for (const filePath of Array.from(indexed.keys())) {
+    if (onDisk.has(filePath)) continue;
+    forgetItemFile(filePath);
+    changed++;
+  }
+
+  setRelationsStatus(RelationsStatus.READY);
+
+  if (wasBuilding || changed > 0) {
+    await broadcast({ type: "relations", action: "updated", username: RELATIONS_ACTOR });
+  }
+
+  return changed;
+};
+
+export const reconcileRelations = (force = false): Promise<number> =>
+  singleFlight(`relations:reconcile:${force}`, async () => {
+    try {
+      return await _reconcile(force);
+    } catch (error) {
+      console.error("Relations reconcile failed:", error);
+      return 0;
+    }
+  });
+
+export const rebuildRelations = async (): Promise<number> => {
+  setRelationsStatus(RelationsStatus.BUILDING);
+  return reconcileRelations(true);
+};
+
+export const forgetMissing = async (dir: string) => {
+  const prefix = _prefixOf(dir);
+  const rows = relationsDb()
+    .prepare("SELECT path FROM items WHERE substr(path, 1, length(?1)) = ?1")
+    .all(prefix) as { path: string }[];
+  for (const row of rows) {
+    const present = await fs.stat(row.path).then(
+      () => true,
+      () => false,
+    );
+    if (!present) forgetItemFile(row.path);
+  }
+};
+
+export const rebuildOwnerRelations = async (owner: string): Promise<number> => {
+  const dirs = itemTreeRoots().map((root) => path.join(root, owner));
+  for (const dir of dirs) {
+    await indexItemTree(dir);
+    await forgetMissing(dir);
+  }
+  await broadcast({ type: "relations", action: "updated", username: owner });
+  return dirs.length;
+};
+
+declare global {
+  var __jottyRelationsCheckedAt: number | undefined;
+}
+
+export const ensureRelations = (): RelationsStatus => {
+  const status = relationsStatus();
+  const checkedAt = globalThis.__jottyRelationsCheckedAt || 0;
+  if (status === RelationsStatus.BUILDING || Date.now() - checkedAt > RECONCILE_EVERY_MS) {
+    globalThis.__jottyRelationsCheckedAt = Date.now();
+    void reconcileRelations();
+  }
+  return status;
+};
diff --git a/app/_server/actions/relations/parser.ts b/app/_server/actions/relations/parser.ts
new file mode 100644
index 000000000..c947a0cc3
--- /dev/null
+++ b/app/_server/actions/relations/parser.ts
@@ -0,0 +1,63 @@
+import { unified } from "unified";
+import remarkParse from "remark-parse";
+import remarkGfm from "remark-gfm";
+import { SKIP, visit } from "unist-util-visit";
+import type { Root } from "mdast";
+import { WIKILINK_REGEX } from "@/app/_consts/relations";
+import { ItemHrefTarget, parseItemHref } from "@/app/_utils/item-href-utils";
+
+export interface ParsedLinks {
+  targets: ItemHrefTarget[];
+  wikis: string[];
+  text: string;
+}
+
+const HTML_HREF_REGEX = /data-href="([^"]+)"/g;
+
+const processor = unified().use(remarkParse).use(remarkGfm);
+
+export const titleKey = (title: string): string =>
+  title.trim().replace(/\s+/g, " ").toLowerCase();
+
+const _wikis = (text: string): string[] =>
+  Array.from(text.matchAll(WIKILINK_REGEX), (m) => m[1].trim()).filter(
+    Boolean,
+  );
+
+export const readLinks = (markdown: string, origins: string[] = []): ParsedLinks => {
+  const targets: ItemHrefTarget[] = [];
+  const wikis: string[] = [];
+  const prose: string[] = [];
+  if (!markdown.trim()) return { targets, wikis, text: "" };
+
+  let tree: Root;
+  try {
+    tree = processor.parse(markdown) as Root;
+  } catch (error) {
+    console.error("Relations parser could not read markdown:", error);
+    return { targets, wikis, text: "" };
+  }
+
+  const addHref = (href: string) => {
+    const target = parseItemHref(href, origins);
+    if (target) targets.push(target);
+  };
+
+  visit(tree, (node) => {
+    if (node.type === "link") {
+      addHref(node.url);
+      return SKIP;
+    }
+    if (node.type === "linkReference") return SKIP;
+    if (node.type === "definition") {
+      addHref(node.url);
+    } else if (node.type === "text") {
+      wikis.push(..._wikis(node.value));
+      prose.push(node.value.replace(WIKILINK_REGEX, " "));
+    } else if (node.type === "html") {
+      Array.from(node.value.matchAll(HTML_HREF_REGEX), (match) => addHref(match[1]));
+    }
+  });
+
+  return { targets, wikis, text: prose.join(" ").replace(/\s+/g, " ").trim() };
+};
diff --git a/app/_server/actions/relations/paths.ts b/app/_server/actions/relations/paths.ts
new file mode 100644
index 000000000..63828a841
--- /dev/null
+++ b/app/_server/actions/relations/paths.ts
@@ -0,0 +1,41 @@
+import path from "path";
+import { ARCHIVED_DIR_NAME, DATA_DIR, EXCLUDED_DIRS } from "@/app/_consts/files";
+import { ItemTypes, Modes } from "@/app/_types/enums";
+
+export interface ItemFileInfo {
+  owner: string;
+  type: ItemTypes;
+}
+
+const MODE_TYPES: Record<string, ItemTypes> = {
+  [Modes.NOTES]: ItemTypes.NOTE,
+  [Modes.CHECKLISTS]: ItemTypes.CHECKLIST,
+};
+
+export const dataRoot = (): string => path.join(process.cwd(), DATA_DIR);
+
+export const itemTreeRoots = (): string[] =>
+  Object.keys(MODE_TYPES).map((mode) => path.join(dataRoot(), mode));
+
+const _hiddenDir = (segment: string): boolean =>
+  EXCLUDED_DIRS.includes(segment) ||
+  (segment.startsWith(".") && segment !== ARCHIVED_DIR_NAME);
+
+export const itemFileInfo = (filePath: string): ItemFileInfo | null => {
+  if (!filePath.endsWith(".md")) return null;
+
+  const rel = path.relative(dataRoot(), path.resolve(filePath));
+  if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) return null;
+
+  const segments = rel.split(path.sep);
+  const type = MODE_TYPES[segments[0]];
+  if (!type || segments.length < 3) return null;
+
+  const folders = segments.slice(2, -1);
+  if (folders.some(_hiddenDir)) return null;
+
+  return { owner: segments[1], type };
+};
+
+export const isItemFile = (filePath: string): boolean =>
+  itemFileInfo(filePath) !== null;
diff --git a/app/_server/actions/relations/queries.ts b/app/_server/actions/relations/queries.ts
new file mode 100644
index 000000000..1d306eba5
--- /dev/null
+++ b/app/_server/actions/relations/queries.ts
@@ -0,0 +1,269 @@
+import { getUserNotes } from "@/app/_server/actions/note";
+import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import {
+  BrainEdgeKinds,
+  BrainNodeKinds,
+  LinkKinds,
+  MENTION_LIMIT,
+  MENTION_MIN_TITLE,
+  MENTION_SNIPPET_CHARS,
+  RelationsStatus,
+} from "@/app/_consts/relations";
+import { ItemTypes } from "@/app/_types/enums";
+import type {
+  BrainEdge,
+  BrainGraph,
+  BrainNode,
+  ItemRelations,
+  MentionedIn,
+  RelatedItem,
+} from "@/app/_types/relations";
+import { titleKey } from "./parser";
+import { ensureRelations } from "./indexer";
+import { relationsDb } from "./store";
+import { suggestEdges } from "./suggestions";
+
+export interface VisibleItem {
+  uuid: string;
+  type: ItemTypes;
+  title: string;
+  category: string;
+  owner?: string;
+  checklistType?: string;
+  tags: string[];
+}
+
+interface LinkRow {
+  src: string;
+  dst: string | null;
+  dst_text: string | null;
+  dst_label: string | null;
+  kind: LinkKinds;
+  weight: number;
+}
+
+const GHOST_PREFIX = "ghost:";
+const TAG_PREFIX = "tag:";
+
+export const visibleItems = async (username: string): Promise<Map<string, VisibleItem>> => {
+  const [notes, checklists] = await Promise.all([
+    getUserNotes({ username, metadataOnly: true }),
+    getUserChecklists({ username, metadataOnly: true }),
+  ]);
+
+  const visible = new Map<string, VisibleItem>();
+  const add = (item: VisibleItem) => {
+    const uuid = item.uuid.toLowerCase();
+    if (uuid) visible.set(uuid, { ...item, uuid });
+  };
+
+  (notes.success ? notes.data || [] : []).forEach((note) =>
+    add({
+      uuid: note.uuid || "",
+      type: ItemTypes.NOTE,
+      title: note.title || note.id || "",
+      category: note.category || UNCATEGORIZED,
+      owner: note.owner,
+      tags: note.tags || [],
+    }),
+  );
+
+  (checklists.success ? checklists.data || [] : []).forEach((list) =>
+    add({
+      uuid: list.uuid || "",
+      type: ItemTypes.CHECKLIST,
+      title: list.title || list.id || "",
+      category: list.category || UNCATEGORIZED,
+      owner: list.owner,
+      checklistType: list.type,
+      tags: list.tags || [],
+    }),
+  );
+
+  return visible;
+};
+
+const _related = (item: VisibleItem, kind: LinkKinds): RelatedItem => ({
+  uuid: item.uuid,
+  type: item.type,
+  title: item.title,
+  category: item.category,
+  owner: item.owner,
+  checklistType: item.checklistType,
+  kind,
+});
+
+const WORDS = new RegExp("[\\p{L}\\p{N}]+", "gu");
+const EMPTY = { backlinks: [], mentions: [], wikis: {} };
+
+const _escapeRegex = (text: string) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+const _phrase = (title: string): RegExp =>
+  new RegExp(
+    `(?<![\\p{L}\\p{N}])${title.trim().split(/\s+/).map(_escapeRegex).join("\\s+")}(?![\\p{L}\\p{N}])`,
+    "iu",
+  );
+
+const _snippet = (body: string, at: number, length: number): string => {
+  const start = Math.max(0, at - MENTION_SNIPPET_CHARS);
+  const end = Math.min(body.length, at + length + MENTION_SNIPPET_CHARS);
+  return `${start > 0 ? "…" : ""}${body.slice(start, end).trim()}${end < body.length ? "…" : ""}`;
+};
+
+const _mentionsOf = (
+  item: VisibleItem,
+  linked: Set<string>,
+  visible: Map<string, VisibleItem>,
+): MentionedIn[] => {
+  if (titleKey(item.title).length < MENTION_MIN_TITLE) return [];
+  const words = item.title.match(WORDS);
+  if (!words) return [];
+
+  const query = `"${words.join(" ").replace(/"/g, '""')}"`;
+  const rows = relationsDb()
+    .prepare("SELECT uuid, body FROM texts WHERE texts MATCH ? LIMIT 400")
+    .all(query) as { uuid: string; body: string }[];
+
+  const phrase = _phrase(item.title);
+  const found: MentionedIn[] = [];
+  for (const row of rows) {
+    if (found.length >= MENTION_LIMIT) break;
+    const source = visible.get(row.uuid);
+    if (!source || row.uuid === item.uuid || linked.has(row.uuid)) continue;
+    const match = phrase.exec(row.body);
+    if (!match) continue;
+    const { kind: _kind, ...related } = _related(source, LinkKinds.MENTION);
+    found.push({ ...related, snippet: _snippet(row.body, match.index, match[0].length) });
+  }
+  return found.sort((a, b) => a.title.localeCompare(b.title));
+};
+
+const _outgoingWikis = (uuid: string, visible: Map<string, VisibleItem>): Record<string, string> => {
+  const rows = relationsDb()
+    .prepare("SELECT dst_text, dst FROM links WHERE src = ? AND kind = ? AND dst IS NOT NULL")
+    .all(uuid, LinkKinds.WIKI) as { dst_text: string; dst: string }[];
+  return Object.fromEntries(
+    rows.filter((row) => visible.has(row.dst)).map((row) => [row.dst_text, row.dst]),
+  );
+};
+
+export const backlinksFor = (
+  uuid: string,
+  visible: Map<string, VisibleItem>,
+): ItemRelations => {
+  const status = ensureRelations();
+  const target = uuid.toLowerCase();
+  if (status === RelationsStatus.BUILDING) return { uuid: target, status, ...EMPTY };
+
+  const rows = relationsDb()
+    .prepare("SELECT DISTINCT src, kind FROM links WHERE dst = ? ORDER BY kind ASC")
+    .all(target) as { src: string; kind: LinkKinds }[];
+
+  const seen = new Set<string>();
+  const backlinks: RelatedItem[] = [];
+  rows.forEach(({ src, kind }) => {
+    const source = visible.get(src);
+    if (!source || src === target || seen.has(src)) return;
+    seen.add(src);
+    backlinks.push(_related(source, kind));
+  });
+
+  const item = visible.get(target);
+  return {
+    uuid: target,
+    status,
+    backlinks: backlinks.sort((a, b) => a.title.localeCompare(b.title)),
+    mentions: item ? _mentionsOf(item, seen, visible) : [],
+    wikis: _outgoingWikis(target, visible),
+  };
+};
+
+const _itemNode = (item: VisibleItem): BrainNode => ({
+  id: item.uuid,
+  kind: item.type === ItemTypes.CHECKLIST ? BrainNodeKinds.CHECKLIST : BrainNodeKinds.NOTE,
+  title: item.title,
+  category: item.category,
+  owner: item.owner,
+  checklistType: item.checklistType,
+  degree: 0,
+});
+
+export const graphFor = (owner: string, visible: Map<string, VisibleItem>): BrainGraph => {
+  const status = ensureRelations();
+  if (status === RelationsStatus.BUILDING) return { status, owner, nodes: [], edges: [] };
+
+  const sources = JSON.stringify(Array.from(visible.keys()));
+  const rows = relationsDb()
+    .prepare(
+      `SELECT src, dst, dst_text, dst_label, kind, weight FROM links
+       WHERE src IN (SELECT value FROM json_each(?))`,
+    )
+    .all(sources) as unknown as LinkRow[];
+
+  const nodes = new Map<string, BrainNode>();
+  visible.forEach((item) => nodes.set(item.uuid, _itemNode(item)));
+
+  const edges = new Map<string, BrainEdge>();
+  const connect = (source: string, target: string, kind: BrainEdgeKinds, weight: number) => {
+    if (source === target) return;
+    const key = `${source}>${target}>${kind}`;
+    const existing = edges.get(key);
+    if (existing) {
+      existing.weight += weight;
+      return;
+    }
+    edges.set(key, { source, target, kind, weight });
+  };
+
+  rows.forEach((row) => {
+    if (row.kind === LinkKinds.MENTION && row.dst && visible.has(row.dst)) {
+      connect(row.src, row.dst, BrainEdgeKinds.MENTION, row.weight);
+      return;
+    }
+
+    if (row.kind !== LinkKinds.WIKI || !row.dst_text) return;
+
+    if (row.dst) {
+      if (visible.has(row.dst)) connect(row.src, row.dst, BrainEdgeKinds.WIKI, row.weight);
+      return;
+    }
+
+    const ghostId = `${GHOST_PREFIX}${row.dst_text}`;
+    if (!nodes.has(ghostId)) {
+      nodes.set(ghostId, {
+        id: ghostId,
+        kind: BrainNodeKinds.GHOST,
+        title: row.dst_label || row.dst_text,
+        degree: 0,
+      });
+    }
+    connect(row.src, ghostId, BrainEdgeKinds.WIKI, row.weight);
+  });
+
+  visible.forEach((item) => {
+    item.tags.forEach((tag) => {
+      const name = tag.replace(/^#/, "").toLowerCase();
+      if (!name) return;
+      const tagId = `${TAG_PREFIX}${name}`;
+      if (!nodes.has(tagId)) {
+        nodes.set(tagId, { id: tagId, kind: BrainNodeKinds.TAG, title: `#${name}`, degree: 0 });
+      }
+      connect(item.uuid, tagId, BrainEdgeKinds.TAG, 1);
+    });
+  });
+
+  const edgeList = Array.from(edges.values());
+  const suggested = suggestEdges(edgeList, new Set(visible.keys()));
+  edgeList.forEach((edge) => {
+    nodes.get(edge.source)!.degree += 1;
+    nodes.get(edge.target)!.degree += 1;
+  });
+
+  return {
+    status,
+    owner,
+    nodes: Array.from(nodes.values()),
+    edges: [...edgeList, ...suggested],
+  };
+};
diff --git a/app/_server/actions/relations/store.ts b/app/_server/actions/relations/store.ts
new file mode 100644
index 000000000..037309482
--- /dev/null
+++ b/app/_server/actions/relations/store.ts
@@ -0,0 +1,157 @@
+import fs from "fs";
+import path from "path";
+import { DatabaseSync } from "node:sqlite";
+import { DATA_DIR } from "@/app/_consts/files";
+import {
+  RELATIONS_DB_NAME,
+  RELATIONS_SCHEMA_VERSION,
+  RelationsStatus,
+} from "@/app/_consts/relations";
+
+declare global {
+  var __jottyRelations: { db: DatabaseSync; file: string; schema: number } | undefined;
+}
+
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+  CREATE TABLE IF NOT EXISTS items (
+    uuid TEXT PRIMARY KEY,
+    path TEXT NOT NULL UNIQUE,
+    owner TEXT NOT NULL,
+    type TEXT NOT NULL,
+    title TEXT NOT NULL,
+    title_key TEXT NOT NULL,
+    encrypted INTEGER NOT NULL DEFAULT 0,
+    created REAL NOT NULL DEFAULT 0,
+    mtime REAL NOT NULL DEFAULT 0
+  );
+  CREATE INDEX IF NOT EXISTS items_title ON items(title_key);
+  CREATE TABLE IF NOT EXISTS links (
+    src TEXT NOT NULL,
+    dst TEXT,
+    dst_text TEXT,
+    dst_label TEXT,
+    kind TEXT NOT NULL,
+    weight INTEGER NOT NULL DEFAULT 1
+  );
+  CREATE INDEX IF NOT EXISTS links_src ON links(src);
+  CREATE INDEX IF NOT EXISTS links_dst ON links(dst);
+  CREATE INDEX IF NOT EXISTS links_text ON links(dst_text);
+  CREATE TABLE IF NOT EXISTS bindings (
+    src TEXT NOT NULL,
+    text TEXT NOT NULL,
+    dst TEXT NOT NULL,
+    PRIMARY KEY (src, text)
+  );
+  CREATE INDEX IF NOT EXISTS bindings_dst ON bindings(dst);
+  CREATE VIRTUAL TABLE IF NOT EXISTS texts USING fts5(
+    uuid UNINDEXED,
+    body,
+    tokenize = 'unicode61 remove_diacritics 2'
+  );
+`;
+
+export const relationsFile = (): string =>
+  process.env.JOTTY_RELATIONS_DB ||
+  path.join(process.cwd(), DATA_DIR, RELATIONS_DB_NAME);
+
+const _discard = (file: string) => {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      fs.rmSync(`${file}${suffix}`, { force: true });
+    } catch (error) {
+      console.error(`Could not remove stale relations file ${file}${suffix}:`, error);
+    }
+  }
+};
+
+const _schemaVersion = (db: DatabaseSync): number => {
+  try {
+    const row = db
+      .prepare("SELECT value FROM meta WHERE key = 'schema'")
+      .get() as { value?: string } | undefined;
+    return Number(row?.value || 0);
+  } catch {
+    return 0;
+  }
+};
+
+const _prepare = (db: DatabaseSync) => {
+  db.exec("PRAGMA journal_mode = WAL; PRAGMA synchronous = NORMAL; PRAGMA busy_timeout = 5000;");
+  const check = db.prepare("PRAGMA quick_check").get() as Record<string, string>;
+  if (Object.values(check)[0] !== "ok") throw new Error("relations db failed quick_check");
+  db.exec(SCHEMA);
+};
+
+const _fresh = (file: string): DatabaseSync => {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const db = new DatabaseSync(file);
+  _prepare(db);
+  const setMeta = db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES (?, ?)");
+  setMeta.run("schema", String(RELATIONS_SCHEMA_VERSION));
+  setMeta.run("status", RelationsStatus.BUILDING);
+  return db;
+};
+
+const _open = (file: string): DatabaseSync => {
+  if (!fs.existsSync(file)) return _fresh(file);
+
+  try {
+    const db = new DatabaseSync(file);
+    _prepare(db);
+    if (_schemaVersion(db) === RELATIONS_SCHEMA_VERSION) return db;
+    db.close();
+  } catch (error) {
+    console.error("Relations db unreadable, rebuilding from notes:", error);
+  }
+
+  _discard(file);
+  return _fresh(file);
+};
+
+export const relationsDb = (): DatabaseSync => {
+  const file = relationsFile();
+  const held = globalThis.__jottyRelations;
+  if (held?.db.isOpen && held.file === file && held.schema === RELATIONS_SCHEMA_VERSION) {
+    return held.db;
+  }
+  if (held?.db.isOpen) held.db.close();
+
+  const db = _open(file);
+  globalThis.__jottyRelations = { db, file, schema: RELATIONS_SCHEMA_VERSION };
+  return db;
+};
+
+export const closeRelationsDb = () => {
+  const held = globalThis.__jottyRelations;
+  if (held?.db.isOpen) held.db.close();
+  globalThis.__jottyRelations = undefined;
+};
+
+export const relationsStatus = (): RelationsStatus => {
+  const row = relationsDb()
+    .prepare("SELECT value FROM meta WHERE key = 'status'")
+    .get() as { value?: string } | undefined;
+  return row?.value === RelationsStatus.READY
+    ? RelationsStatus.READY
+    : RelationsStatus.BUILDING;
+};
+
+export const setRelationsStatus = (status: RelationsStatus) => {
+  relationsDb()
+    .prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('status', ?)")
+    .run(status);
+};
+
+export const inTransaction = <T>(work: (db: DatabaseSync) => T): T => {
+  const db = relationsDb();
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const result = work(db);
+    db.exec("COMMIT");
+    return result;
+  } catch (error) {
+    db.exec("ROLLBACK");
+    throw error;
+  }
+};
diff --git a/app/_server/actions/relations/suggestions.ts b/app/_server/actions/relations/suggestions.ts
new file mode 100644
index 000000000..b88e7d7ed
--- /dev/null
+++ b/app/_server/actions/relations/suggestions.ts
@@ -0,0 +1,65 @@
+import {
+  BrainEdgeKinds,
+  SUGGESTION_HUB_LIMIT,
+  SUGGESTIONS_MAX,
+  SUGGESTIONS_PER_ITEM,
+} from "@/app/_consts/relations";
+import type { BrainEdge } from "@/app/_types/relations";
+
+const _pairKey = (a: string, b: string) => (a < b ? `${a}|${b}` : `${b}|${a}`);
+
+const _neighbours = (edges: BrainEdge[]): Map<string, Set<string>> => {
+  const map = new Map<string, Set<string>>();
+  const add = (from: string, to: string) => {
+    if (!map.has(from)) map.set(from, new Set());
+    map.get(from)!.add(to);
+  };
+  edges.forEach((edge) => {
+    add(edge.source, edge.target);
+    add(edge.target, edge.source);
+  });
+  return map;
+};
+
+export const suggestEdges = (edges: BrainEdge[], items: Set<string>): BrainEdge[] => {
+  const neighbours = _neighbours(edges);
+  const linked = new Set(edges.map((edge) => _pairKey(edge.source, edge.target)));
+  const scores = new Map<string, number>();
+
+  neighbours.forEach((around) => {
+    if (around.size < 2 || around.size > SUGGESTION_HUB_LIMIT) return;
+    const weight = 1 / Math.log(1 + around.size);
+    const members = Array.from(around).filter((id) => items.has(id));
+
+    for (let i = 0; i < members.length; i++) {
+      for (let j = i + 1; j < members.length; j++) {
+        const key = _pairKey(members[i], members[j]);
+        if (linked.has(key)) continue;
+        scores.set(key, (scores.get(key) || 0) + weight);
+      }
+    }
+  });
+
+  const ranked = Array.from(scores.entries()).sort((a, b) => b[1] - a[1]);
+  const top = ranked[0]?.[1] || 1;
+  const perItem = new Map<string, number>();
+  const picked: BrainEdge[] = [];
+
+  for (const [key, score] of ranked) {
+    if (picked.length >= SUGGESTIONS_MAX) break;
+    const [source, target] = key.split("|");
+    if ((perItem.get(source) || 0) >= SUGGESTIONS_PER_ITEM) continue;
+    if ((perItem.get(target) || 0) >= SUGGESTIONS_PER_ITEM) continue;
+
+    perItem.set(source, (perItem.get(source) || 0) + 1);
+    perItem.set(target, (perItem.get(target) || 0) + 1);
+    picked.push({
+      source,
+      target,
+      kind: BrainEdgeKinds.SUGGESTED,
+      weight: Math.round((score / top) * 100) / 100,
+    });
+  }
+
+  return picked;
+};
diff --git a/app/_server/actions/relations/tidy.ts b/app/_server/actions/relations/tidy.ts
new file mode 100644
index 000000000..48a65e26f
--- /dev/null
+++ b/app/_server/actions/relations/tidy.ts
@@ -0,0 +1,223 @@
+import { unified } from "unified";
+import remarkParse from "remark-parse";
+import { SKIP, visit } from "unist-util-visit";
+import type { Link, Root, Text } from "mdast";
+import { WIKILINK_REGEX } from "@/app/_consts/relations";
+import { ItemTypes, Modes } from "@/app/_types/enums";
+import { itemHref } from "@/app/_utils/global-utils";
+import { parseItemHref } from "@/app/_utils/item-href-utils";
+import { titleKey } from "./parser";
+import { relationsDb } from "./store";
+
+interface Rewrite {
+  start: number;
+  end: number;
+  from: string;
+  to: string;
+}
+
+const processor = unified().use(remarkParse);
+
+const _typeOf = (uuid: string): ItemTypes | null => {
+  try {
+    const row = relationsDb()
+      .prepare("SELECT type FROM items WHERE uuid = ?")
+      .get(uuid) as { type?: string } | undefined;
+    if (row?.type === ItemTypes.NOTE || row?.type === ItemTypes.CHECKLIST) return row.type;
+  } catch (error) {
+    console.error("Relations could not resolve link type:", error);
+  }
+  return null;
+};
+
+const _legacyUuid = async (
+  type: ItemTypes,
+  category: string,
+  id: string,
+  owner: string,
+): Promise<string | null> => {
+  const { legacyResolve } = await import("@/app/_server/actions/lib/legacy-lookup");
+  const mode = type === ItemTypes.CHECKLIST ? Modes.CHECKLISTS : Modes.NOTES;
+  return legacyResolve(mode, category, id, owner);
+};
+
+const _canonical = async (url: string, owner: string): Promise<string | null> => {
+  const target = parseItemHref(url);
+  if (!target) return null;
+
+  if (target.uuid && target.type) return null;
+
+  if (target.uuid) {
+    const type = _typeOf(target.uuid);
+    return type ? itemHref(type, target.uuid) : null;
+  }
+
+  if (target.legacy && target.type) {
+    const uuid = await _legacyUuid(target.type, target.legacy.category, target.legacy.id, owner);
+    return uuid ? itemHref(target.type, uuid) : null;
+  }
+
+  return null;
+};
+
+export const tidyItemLinks = async (markdown: string, owner: string): Promise<string> => {
+  if (!markdown.includes("](")) return markdown;
+
+  let tree: Root;
+  try {
+    tree = processor.parse(markdown) as Root;
+  } catch (error) {
+    console.error("Could not parse markdown to tidy links:", error);
+    return markdown;
+  }
+
+  const links: Link[] = [];
+  visit(tree, "link", (node: Link) => {
+    links.push(node);
+  });
+
+  const rewrites: Rewrite[] = [];
+  for (const link of links) {
+    const start = link.position?.start.offset;
+    const end = link.position?.end.offset;
+    if (start === undefined || end === undefined) continue;
+
+    const to = await _canonical(link.url, owner);
+    if (to) rewrites.push({ start, end, from: link.url, to });
+  }
+
+  return rewrites.reverse().reduce((text, rewrite) => {
+    const source = text.slice(rewrite.start, rewrite.end);
+    const at = source.lastIndexOf(`(${rewrite.from}`);
+    if (at === -1) return text;
+
+    const fixed =
+      source.slice(0, at + 1) + rewrite.to + source.slice(at + 1 + rewrite.from.length);
+    return text.slice(0, rewrite.start) + fixed + text.slice(rewrite.end);
+  }, markdown);
+};
+
+interface Retitle {
+  uuid: string;
+  title: string;
+}
+
+const UNSAFE_WIKI_TITLE = /[\[\]|#^\n]/;
+
+const _retitles = (src: string): Map<string, Retitle> => {
+  const rows = relationsDb()
+    .prepare(
+      `SELECT b.text AS text, i.uuid AS uuid, i.title AS title, i.title_key AS key
+       FROM bindings b JOIN items i ON i.uuid = b.dst WHERE b.src = ?`,
+    )
+    .all(src) as { text: string; uuid: string; title: string; key: string }[];
+  return new Map(
+    rows
+      .filter((row) => row.key !== row.text && !UNSAFE_WIKI_TITLE.test(row.title))
+      .map((row) => [row.text, { uuid: row.uuid, title: row.title }]),
+  );
+};
+
+const _carryBindings = (src: string, carried: Map<string, Retitle>) => {
+  const insert = relationsDb().prepare(
+    `INSERT INTO bindings (src, text, dst) VALUES (?, ?, ?)
+     ON CONFLICT(src, text) DO UPDATE SET dst = excluded.dst`,
+  );
+  carried.forEach((target, key) => insert.run(src, key, target.uuid));
+};
+
+export const refreshWikilinks = (markdown: string, srcUuid?: string): string => {
+  if (!srcUuid || !markdown.includes("[[")) return markdown;
+
+  let retitles: Map<string, Retitle>;
+  let tree: Root;
+  try {
+    retitles = _retitles(srcUuid.toLowerCase());
+    if (retitles.size === 0) return markdown;
+    tree = processor.parse(markdown) as Root;
+  } catch (error) {
+    console.error("Could not refresh wikilinks:", error);
+    return markdown;
+  }
+
+  const rewrites: Rewrite[] = [];
+  visit(tree, "text", (node: Text) => {
+    const start = node.position?.start.offset;
+    const end = node.position?.end.offset;
+    if (start === undefined || end === undefined) return;
+    const raw = markdown.slice(start, end);
+    for (const match of Array.from(raw.matchAll(WIKILINK_REGEX))) {
+      const target = retitles.get(titleKey(match[1]));
+      if (!target || match.index === undefined) continue;
+      const at = start + match.index + 2;
+      rewrites.push({ start: at, end: at + match[1].length, from: match[1], to: target.title });
+    }
+  });
+
+  if (rewrites.length === 0) return markdown;
+
+  const carried = new Map<string, Retitle>();
+  rewrites.forEach((rewrite) => {
+    const target = retitles.get(titleKey(rewrite.from));
+    if (target) carried.set(titleKey(rewrite.to), target);
+  });
+  try {
+    _carryBindings(srcUuid.toLowerCase(), carried);
+  } catch (error) {
+    console.error("Could not carry wikilink bindings:", error);
+    return markdown;
+  }
+
+  return rewrites
+    .sort((a, b) => b.start - a.start)
+    .reduce(
+      (text, rewrite) => text.slice(0, rewrite.start) + rewrite.to + text.slice(rewrite.end),
+      markdown,
+    );
+};
+
+const _escapeRegex = (text: string) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+const _mentionRegex = (title: string): RegExp =>
+  new RegExp(
+    `(?<![\\p{L}\\p{N}])${title.trim().split(/\s+/).map(_escapeRegex).join("\\s+")}(?![\\p{L}\\p{N}])`,
+    "iu",
+  );
+
+const _insideWikilink = (raw: string, at: number): boolean =>
+  Array.from(raw.matchAll(WIKILINK_REGEX)).some(
+    (match) => match.index !== undefined && at >= match.index && at < match.index + match[0].length,
+  );
+
+export const wrapMention = (markdown: string, title: string, href: string): string | null => {
+  let tree: Root;
+  try {
+    tree = processor.parse(markdown) as Root;
+  } catch (error) {
+    console.error("Could not parse markdown to link a mention:", error);
+    return null;
+  }
+
+  const phrase = _mentionRegex(title);
+  let found: { start: number; end: number; text: string } | null = null;
+
+  visit(tree, (node) => {
+    if (found) return SKIP;
+    if (node.type === "link" || node.type === "linkReference") return SKIP;
+    if (node.type !== "text") return;
+    const start = node.position?.start.offset;
+    const end = node.position?.end.offset;
+    if (start === undefined || end === undefined) return;
+
+    const raw = markdown.slice(start, end);
+    const match = phrase.exec(raw);
+    if (!match || _insideWikilink(raw, match.index)) return;
+    found = { start: start + match.index, end: start + match.index + match[0].length, text: match[0] };
+    return SKIP;
+  });
+
+  if (!found) return null;
+  const { start, end, text } = found as { start: number; end: number; text: string };
+  const label = text.replace(/[\[\]]/g, "\\$&");
+  return `${markdown.slice(0, start)}[${label}](${href})${markdown.slice(end)}`;
+};
diff --git a/app/_server/actions/relations/tracking.ts b/app/_server/actions/relations/tracking.ts
new file mode 100644
index 000000000..c26c1ae7f
--- /dev/null
+++ b/app/_server/actions/relations/tracking.ts
@@ -0,0 +1,63 @@
+import fs from "fs/promises";
+import path from "path";
+import { invalidatePath } from "@/app/_server/actions/lib/metadata-cache";
+import { dataRoot, itemFileInfo } from "./paths";
+import {
+  forgetMissing,
+  forgetItemFile,
+  forgetItemTree,
+  indexItemFile,
+  indexItemTree,
+} from "./indexer";
+
+const _withinData = (target: string): boolean => {
+  const rel = path.relative(dataRoot(), path.resolve(target));
+  return Boolean(rel) && !rel.startsWith("..") && !path.isAbsolute(rel);
+};
+
+const _safely = async (label: string, target: string, work: () => unknown) => {
+  try {
+    await work();
+  } catch (error) {
+    console.error(`Relations ${label} failed for ${target}:`, error);
+  }
+};
+
+export const trackItemWrite = async (filePath: string, content: string) => {
+  if (!itemFileInfo(filePath)) return;
+  invalidatePath(filePath);
+  await _safely("write", filePath, async () => {
+    const stats = await fs.stat(filePath);
+    indexItemFile(filePath, content, Math.floor(stats.mtimeMs));
+  });
+};
+
+export const trackItemDelete = async (filePath: string) => {
+  if (!itemFileInfo(filePath)) return;
+  invalidatePath(filePath);
+  await _safely("delete", filePath, () => forgetItemFile(filePath));
+};
+
+export const trackTreeDelete = async (dir: string) => {
+  if (!_withinData(dir)) return;
+  invalidatePath(dir);
+  await _safely("tree delete", dir, () => forgetItemTree(dir));
+};
+
+export const trackMove = async (from: string, to: string) => {
+  if (!_withinData(from) && !_withinData(to)) return;
+  invalidatePath(from);
+  invalidatePath(to);
+  await _safely("move", `${from} -> ${to}`, async () => {
+    const stats = await fs.stat(to);
+    if (stats.isDirectory()) {
+      await indexItemTree(to);
+      await forgetMissing(from);
+      return;
+    }
+    if (itemFileInfo(to)) {
+      indexItemFile(to, await fs.readFile(to, "utf-8"), Math.floor(stats.mtimeMs));
+    }
+    forgetItemFile(from);
+  });
+};
diff --git a/app/_server/actions/share/access.ts b/app/_server/actions/share/access.ts
index 717ef627f..9f05b68d1 100644
--- a/app/_server/actions/share/access.ts
+++ b/app/_server/actions/share/access.ts
@@ -66,6 +66,15 @@ const _merge = (
   });
 };
 
+const _narrowest = (
+  a: SharingPermissions,
+  b: SharingPermissions,
+): SharingPermissions => ({
+  canRead: a.canRead && b.canRead,
+  canEdit: a.canEdit && b.canEdit,
+  canDelete: a.canDelete && b.canDelete,
+});
+
 const _chainGrants = async (
   userDir: string,
   startDir: string,
@@ -163,6 +172,9 @@ export const canReachFile = async (
   return granted(access.users[username], permission);
 };
 
+const _isInside = (dir: string, target: string): boolean =>
+  target === dir || target.startsWith(`${dir}${path.sep}`);
+
 export const sharedFiles = async (
   mode: Modes,
   username: string,
@@ -170,7 +182,7 @@ export const sharedFiles = async (
   const matches = await grepFilesByText(_modeDir(mode), username, "*.md");
   const ownDir = path.join(_modeDir(mode), username);
 
-  return matches.filter((filePath) => !filePath.startsWith(ownDir));
+  return matches.filter((filePath) => !_isInside(ownDir, filePath));
 };
 
 const _topMost = (dirs: string[]): string[] =>
@@ -230,6 +242,7 @@ export const listMounts = async (
     const existing = loose.get(access.owner);
     if (existing) {
       existing.uuids.push(uuid);
+      existing.perms = _narrowest(existing.perms, perms);
     } else {
       loose.set(access.owner, { uuids: [uuid], perms });
     }
@@ -272,5 +285,5 @@ export const sharedCats = async (
 
   return matches
     .map((filePath) => path.dirname(filePath))
-    .filter((dirPath) => !dirPath.startsWith(ownDir));
+    .filter((dirPath) => !_isInside(ownDir, dirPath));
 };
diff --git a/app/_server/actions/share/category-info.ts b/app/_server/actions/share/category-info.ts
index 0d1a9cc87..3f284a8ba 100644
--- a/app/_server/actions/share/category-info.ts
+++ b/app/_server/actions/share/category-info.ts
@@ -92,6 +92,15 @@ export const patchCatInfo = async (
     return next;
   });
 
+export const mutateCatInfo = async (
+  dirPath: string,
+  mutator: (info: CategoryInfo) => CategoryInfo | null,
+): Promise<boolean> =>
+  runQueued(_lane(dirPath), async () => {
+    const next = mutator(await readCatInfo(dirPath));
+    return next ? writeCatInfo(dirPath, next) : false;
+  });
+
 export const catUuid = async (dirPath: string): Promise<string> =>
   runQueued(_lane(dirPath), async () => {
     const info = await readCatInfo(dirPath);
diff --git a/app/_server/actions/share/mounts.ts b/app/_server/actions/share/mounts.ts
index 13ca3c9ed..fc76ead99 100644
--- a/app/_server/actions/share/mounts.ts
+++ b/app/_server/actions/share/mounts.ts
@@ -112,7 +112,9 @@ export const mountedItems = async <T extends MountableItem>(
         category: _mountedPath(mount, category),
         isShared: true,
         sharedFrom: mount.owner,
-        permissions: mount.permissions,
+        permissions:
+          parseSharedWith(item.sharedWith)?.users[username] ||
+          mount.permissions,
         isLoose: true,
       });
       continue;
diff --git a/app/_server/actions/share/rename.ts b/app/_server/actions/share/rename.ts
index f89294d11..d42565140 100644
--- a/app/_server/actions/share/rename.ts
+++ b/app/_server/actions/share/rename.ts
@@ -1,5 +1,5 @@
 import path from "path";
-import fs from "fs/promises";
+import { serverReadFile, serverWriteFile } from "@/app/_server/actions/file";
 import { revalidateTag } from "next/cache";
 import { Modes } from "@/app/_types/enums";
 import { SharingPermissions } from "@/app/_types/core";
@@ -7,116 +7,146 @@ import { DATA_DIR } from "@/app/_consts/files";
 import { CATEGORY_INFO_FILE, SHARED_WITH_KEY } from "@/app/_consts/sharing";
 import { parseSharedWith, toSharedWith } from "@/app/_utils/sharing-utils";
 import { grepFilesByText } from "@/app/_utils/grep-utils";
-import { updateYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
-import { readCatInfo, writeCatInfo } from "./category-info";
+import {
+  extractYamlMetadata,
+  updateYamlMetadata,
+} from "@/app/_utils/yaml-metadata-utils";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { mutateCatInfo } from "./category-info";
 import { dropMounts } from "./mounts";
 
 const RENAMED_MODES = [Modes.NOTES, Modes.CHECKLISTS];
 
+type Grants = Record<string, SharingPermissions>;
+type Reshape = (users: Grants) => Grants | null;
+
 const _modeTag = (mode: Modes): string =>
   mode === Modes.CHECKLISTS ? "layout-checklists" : "layout-notes";
 
-const _swapKey = (
-  users: Record<string, SharingPermissions>,
-  oldName: string,
-  newName: string,
-): Record<string, SharingPermissions> | null => {
-  const perms = users[oldName];
-  if (!perms) return null;
+const _refresh = (mode: Modes): void => {
+  dropMounts(mode);
+  revalidateTag(_modeTag(mode), { expire: 0 });
+};
 
-  const next = { ...users, [newName]: perms };
-  delete next[oldName];
+const _swapKey =
+  (oldName: string, newName: string): Reshape =>
+  (users) => {
+    const perms = users[oldName];
+    if (!perms) return null;
 
-  return next;
-};
+    const next = { ...users, [newName]: perms };
+    delete next[oldName];
+
+    return next;
+  };
+
+const _dropKey =
+  (username: string): Reshape =>
+  (users) => {
+    if (!users[username]) return null;
+
+    const next = { ...users };
+    delete next[username];
 
-const _renameInFiles = async (
+    return next;
+  };
+
+const _reshapeFiles = async (
   mode: Modes,
-  oldName: string,
-  newName: string,
+  username: string,
+  reshape: Reshape,
 ): Promise<number> => {
   const modeDir = path.join(process.cwd(), DATA_DIR, mode);
-  const candidates = await grepFilesByText(modeDir, oldName, "*.md");
+  const candidates = await grepFilesByText(modeDir, username, "*.md");
   let touched = 0;
 
   for (const filePath of candidates) {
     try {
-      const content = await fs.readFile(filePath, "utf-8");
-      const line = content.match(new RegExp(`^${SHARED_WITH_KEY}:.*$`, "m"));
-
-      if (!line) continue;
+      const content = await serverReadFile(filePath);
+      if (!content) continue;
 
-      const parsed = parseSharedWith(line[0].split(":").slice(1).join(":").trim());
+      const { metadata } = extractYamlMetadata(content);
+      const parsed = parseSharedWith(metadata[SHARED_WITH_KEY]);
       if (!parsed || parsed.optedOut) continue;
 
-      const swapped = _swapKey(parsed.users, oldName, newName);
-      if (!swapped) continue;
+      const reshaped = reshape(parsed.users);
+      if (!reshaped) continue;
 
       const updated = updateYamlMetadata(content, {
-        [SHARED_WITH_KEY]: toSharedWith(swapped),
+        [SHARED_WITH_KEY]: toSharedWith(reshaped),
       });
 
-      await fs.writeFile(filePath, updated, "utf-8");
+      await serverWriteFile(filePath, updated);
       touched += 1;
     } catch (error) {
-      console.error(`Failed renaming share in ${filePath}:`, error);
+      console.error(`Failed reshaping share in ${filePath}:`, error);
     }
   }
 
   return touched;
 };
 
-const _renameInCats = async (
+const _reshapeCats = async (
   mode: Modes,
-  oldName: string,
-  newName: string,
+  username: string,
+  reshape: Reshape,
 ): Promise<number> => {
   const modeDir = path.join(process.cwd(), DATA_DIR, mode);
-  const candidates = await grepFilesByText(modeDir, oldName, CATEGORY_INFO_FILE);
+  const candidates = await grepFilesByText(modeDir, username, CATEGORY_INFO_FILE);
   let touched = 0;
 
   for (const infoFile of candidates) {
     const dir = path.dirname(infoFile);
 
     try {
-      const info = await readCatInfo(dir);
-      if (!info.sharing?.users) continue;
+      const written = await mutateCatInfo(dir, (info) => {
+        if (!info.sharing?.users) return null;
 
-      const swapped = _swapKey(info.sharing.users, oldName, newName);
-      if (!swapped) continue;
+        const reshaped = reshape(info.sharing.users);
+        if (!reshaped) return null;
 
-      await writeCatInfo(dir, {
-        ...info,
-        sharing: { ...info.sharing, users: swapped },
+        return { ...info, sharing: { ...info.sharing, users: reshaped } };
       });
 
-      touched += 1;
+      if (written) touched += 1;
     } catch (error) {
-      console.error(`Failed renaming share in ${dir}:`, error);
+      console.error(`Failed reshaping share in ${dir}:`, error);
     }
   }
 
   return touched;
 };
 
-export const renameGrants = async (
-  oldName: string,
-  newName: string,
+const _reshapeGrants = async (
+  username: string,
+  reshape: Reshape,
 ): Promise<number> => {
   let touched = 0;
 
   for (const mode of RENAMED_MODES) {
     const perMode =
-      (await _renameInFiles(mode, oldName, newName)) +
-      (await _renameInCats(mode, oldName, newName));
+      (await _reshapeFiles(mode, username, reshape)) +
+      (await _reshapeCats(mode, username, reshape));
 
-    if (perMode > 0) {
-      dropMounts(mode);
-      revalidateTag(_modeTag(mode), { expire: 0 });
-    }
+    if (perMode > 0) _refresh(mode);
 
     touched += perMode;
   }
 
   return touched;
 };
+
+export const renameGrants = async (
+  oldName: string,
+  newName: string,
+): Promise<number> => _reshapeGrants(oldName, _swapKey(oldName, newName));
+
+export const revokeGrants = async (username: string): Promise<number> => {
+  const touched = await _reshapeGrants(username, _dropKey(username));
+
+  RENAMED_MODES.forEach(_refresh);
+
+  await broadcast({ type: "sharing", action: "deleted", username });
+
+  return touched;
+};
diff --git a/app/_server/actions/tags/index.ts b/app/_server/actions/tags/index.ts
index 8a97d3a17..35e719d5b 100644
--- a/app/_server/actions/tags/index.ts
+++ b/app/_server/actions/tags/index.ts
@@ -2,6 +2,7 @@
 
 import { join } from "path";
 import fs from "fs/promises";
+import { serverWriteFile } from "@/app/_server/actions/file";
 import { Result } from "@/app/_types";
 import { exportWholeDataFolder } from "../export";
 import { extractHashtagsFromContent } from "@/app/_utils/tag-utils";
@@ -75,7 +76,7 @@ const processDirectory = async (
           { tags: mergedTags },
           true,
         );
-        await fs.writeFile(filePath, updatedContent, "utf-8");
+        await serverWriteFile(filePath, updatedContent);
         updated++;
       }
 
diff --git a/app/_server/actions/users/auth.ts b/app/_server/actions/users/auth.ts
index acf4492a1..48ecd9ab8 100644
--- a/app/_server/actions/users/auth.ts
+++ b/app/_server/actions/users/auth.ts
@@ -25,12 +25,13 @@ export const canAccessAllContent = async (): Promise<boolean> => {
     const settingsResult = await getAppSettings();
 
     if (!settingsResult.success || !settingsResult.data) {
-      return true;
+      console.error("Content access settings unreadable, refusing admin peek");
+      return false;
     }
 
     return settingsResult.data.adminContentAccess !== "no";
   } catch (error) {
     console.error("Error checking content access:", error);
-    return true;
+    return false;
   }
 };
diff --git a/app/_server/actions/users/crud.ts b/app/_server/actions/users/crud.ts
index 87f5e495d..0c0264998 100644
--- a/app/_server/actions/users/crud.ts
+++ b/app/_server/actions/users/crud.ts
@@ -5,11 +5,15 @@ import {
   NOTES_DIR,
   USERS_FILE,
 } from "@/app/_consts/files";
-import { readJsonFile, writeJsonFile } from "../file";
+import {
+  readJsonFile,
+  serverDeleteDir,
+  serverRenamePath,
+  writeJsonFile,
+} from "../file";
 import { Result, SanitisedUser, User } from "@/app/_types";
 import { sanitizeUserForClient } from "@/app/_utils/user-sanitize-utils";
 import { removeAllSessionsForUser } from "../session";
-import fs from "fs/promises";
 import { createHash } from "crypto";
 import { ItemTypes } from "@/app/_types/enums";
 import { DEFAULT_WEEK_START } from "@/app/_consts/calendar";
@@ -17,7 +21,7 @@ import { getFormData } from "@/app/_utils/global-utils";
 import { logUserEvent } from "@/app/_server/actions/log";
 import { getUserIndex } from "./helpers";
 import { getCurrentUser } from "./queries";
-import { findUserRecord } from "./records";
+import { findUserRecord, mutateUsers } from "./records";
 
 export type UserUpdatePayload = {
   username?: string;
@@ -50,10 +54,8 @@ export async function _deleteUserCore(username: string): Promise<Result<null>> {
   await removeAllSessionsForUser(username);
 
   try {
-    await fs.rm(CHECKLISTS_DIR(username), { recursive: true, force: true });
-
-    const docsDir = NOTES_DIR(username);
-    await fs.rm(docsDir, { recursive: true, force: true });
+    await serverDeleteDir(CHECKLISTS_DIR(username));
+    await serverDeleteDir(NOTES_DIR(username));
   } catch (error) {
     console.warn(
       `Warning: Could not clean up data files for ${username}:`,
@@ -61,8 +63,23 @@ export async function _deleteUserCore(username: string): Promise<Result<null>> {
     );
   }
 
-  allUsers.splice(userIndex, 1);
-  await writeJsonFile(allUsers, USERS_FILE);
+  try {
+    const { revokeGrants } = await import("@/app/_server/actions/share/rename");
+
+    await revokeGrants(username);
+  } catch (error) {
+    console.error(`Could not revoke shares granted to ${username}:`, error);
+  }
+
+  const removed = await mutateUsers((users) => {
+    const index = users.findIndex((user: User) => user.username === username);
+    if (index === -1) return null;
+
+    users.splice(index, 1);
+    return true;
+  });
+
+  if (!removed) return { success: false, error: "Failed to delete user" };
 
   return { success: true, data: null };
 }
@@ -89,7 +106,7 @@ export async function _updateUserCore(
     try {
       const oldChecklistsPath = CHECKLISTS_DIR(targetUsername);
       const newChecklistsPath = CHECKLISTS_DIR(updates.username);
-      await fs.rename(oldChecklistsPath, newChecklistsPath);
+      await serverRenamePath(oldChecklistsPath, newChecklistsPath);
     } catch (error) {
       console.warn(
         `Could not rename checklists directory for ${targetUsername}:`,
@@ -100,7 +117,7 @@ export async function _updateUserCore(
     try {
       const oldNotesPath = NOTES_DIR(targetUsername);
       const newNotesPath = NOTES_DIR(updates.username);
-      await fs.rename(oldNotesPath, newNotesPath);
+      await serverRenamePath(oldNotesPath, newNotesPath);
     } catch (error) {
       console.warn(
         `Could not rename notes directory for ${targetUsername}:`,
diff --git a/app/_translations/en.json b/app/_translations/en.json
index 8bbe00b31..60059d291 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -1779,5 +1779,71 @@
     "sharingFolderMessage": "Open to view “{folder}”",
     "mentionTitle": "{user} mentioned you in a comment",
     "mentionMessage": "“{board}”"
+  },
+  "relations": {
+    "indexing": "Indexing relationships...",
+    "unreachable": "not reachable",
+    "createFromWikilink": "Create a note called \"{title}\"",
+    "mentionedIn": "Mentioned in",
+    "mentionedInHint": "These notes use this title as plain text. Link one to connect it.",
+    "linkMention": "Link",
+    "linked": "Linked the mention in {title}",
+    "linkFailed": "Couldn't link that mention",
+    "kind": {
+      "mention": "Link",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "Brain",
+    "openBrain": "Open in brain",
+    "search": "Find something in your brain...",
+    "dimension": "View",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Around this item",
+    "global": "Everything",
+    "depth": "Depth {depth}",
+    "colourBy": "Colour by",
+    "colourModes": {
+      "type": "Type",
+      "category": "Category"
+    },
+    "filters": {
+      "notes": "Notes",
+      "checklists": "Checklists",
+      "tags": "Tags",
+      "ghosts": "Not written yet",
+      "suggestions": "Suggestions",
+      "orphans": "Loners"
+    },
+    "kind": {
+      "note": "Note",
+      "checklist": "Checklist",
+      "ghost": "Not written yet",
+      "tag": "Tag"
+    },
+    "edges": {
+      "mention": "Link",
+      "wiki": "Wikilink",
+      "suggested": "Suggested",
+      "tag": "Tag"
+    },
+    "linksTo": "Links to",
+    "linkedFrom": "Linked from",
+    "suggested": "Might be related",
+    "promote": "Link to {title}",
+    "lonely": "Nothing connects here yet. Mention it with @ or [[ from another note.",
+    "open": "Open",
+    "createGhost": "Write this note",
+    "openTag": "Show everything tagged",
+    "createFailed": "Could not create that note",
+    "connectFailed": "Could not link those two",
+    "connected": "Linked {source} to {target}",
+    "empty": "Your brain is quiet. Link notes and checklists with @ or [[ and they will show up here.",
+    "viewingOwner": "Viewing {owner}'s brain",
+    "summary": "{items} items, {links} links, {shown} shown"
   }
 }
diff --git a/app/_types/context.ts b/app/_types/context.ts
index dea8404c0..d9ab4f690 100644
--- a/app/_types/context.ts
+++ b/app/_types/context.ts
@@ -2,7 +2,6 @@ import { Note } from "./note";
 import { Checklist } from "./checklist";
 import { User, SanitisedUser } from "./user";
 import { AppSettings } from "./config";
-import { LinkIndex } from "./links";
 import { AllSharedItems, UserSharedItems } from "./sharing";
 import { TagsIndex } from "./tags";
 
@@ -28,7 +27,6 @@ export interface AppModeContextType {
   appVersion: string;
   appSettings: AppSettings | null;
   usersPublicData: Partial<User>[];
-  linkIndex: LinkIndex | null;
   notes: Partial<Note>[];
   checklists: Partial<Checklist>[];
   allSharedItems: AllSharedItems | null;
diff --git a/app/_types/index.ts b/app/_types/index.ts
index 50a7ca604..ed740f664 100644
--- a/app/_types/index.ts
+++ b/app/_types/index.ts
@@ -63,7 +63,6 @@ export type {
 
 export type { Category } from "./category";
 
-export type { ItemLinks, LinkIndex } from "./links";
 
 export type { TagInfo, TagsIndex } from "./tags";
 
diff --git a/app/_types/links.ts b/app/_types/links.ts
deleted file mode 100644
index c6c93c1ee..000000000
--- a/app/_types/links.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-export interface ItemLinks {
-  isLinkedTo: {
-    notes: string[];
-    checklists: string[];
-  };
-  isReferencedIn: {
-    notes: string[];
-    checklists: string[];
-  };
-}
-
-export interface LinkIndex {
-  notes: Record<string, ItemLinks>;
-  checklists: Record<string, ItemLinks>;
-  [key: string]: Record<string, ItemLinks>;
-}
diff --git a/app/_types/relations.ts b/app/_types/relations.ts
new file mode 100644
index 000000000..ad019ac64
--- /dev/null
+++ b/app/_types/relations.ts
@@ -0,0 +1,53 @@
+import type {
+  BrainEdgeKinds,
+  BrainNodeKinds,
+  LinkKinds,
+  RelationsStatus,
+} from "@/app/_consts/relations";
+import type { ItemTypes } from "./enums";
+
+export interface RelatedItem {
+  uuid: string;
+  type: ItemTypes;
+  title: string;
+  category: string;
+  owner?: string;
+  checklistType?: string;
+  kind: LinkKinds;
+}
+
+export interface MentionedIn extends Omit<RelatedItem, "kind"> {
+  snippet: string;
+}
+
+export interface ItemRelations {
+  uuid: string;
+  status: RelationsStatus;
+  backlinks: RelatedItem[];
+  mentions: MentionedIn[];
+  wikis: Record<string, string>;
+}
+
+export interface BrainNode {
+  id: string;
+  kind: BrainNodeKinds;
+  title: string;
+  category?: string;
+  owner?: string;
+  checklistType?: string;
+  degree: number;
+}
+
+export interface BrainEdge {
+  source: string;
+  target: string;
+  kind: BrainEdgeKinds;
+  weight: number;
+}
+
+export interface BrainGraph {
+  status: RelationsStatus;
+  owner: string;
+  nodes: BrainNode[];
+  edges: BrainEdge[];
+}
diff --git a/app/_types/websocket.ts b/app/_types/websocket.ts
index 67cd34963..3c3ca9baa 100644
--- a/app/_types/websocket.ts
+++ b/app/_types/websocket.ts
@@ -1,5 +1,5 @@
 export interface WsEvent {
-  type: "checklist" | "note" | "category" | "settings" | "sharing" | "notification";
+  type: "checklist" | "note" | "category" | "settings" | "sharing" | "notification" | "relations";
   action: "created" | "updated" | "deleted";
   entityId?: string;
   username: string;
diff --git a/app/_utils/checklist-utils.ts b/app/_utils/checklist-utils.ts
index 90858805a..21e6f5754 100644
--- a/app/_utils/checklist-utils.ts
+++ b/app/_utils/checklist-utils.ts
@@ -13,6 +13,7 @@ import {
   generateYamlFrontmatter,
   generateUuid,
   strayMeta,
+  createdAtOf,
 } from "./yaml-metadata-utils";
 import { extractHashtagsFromContent, normalizeTag } from "./tag-utils";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
@@ -346,7 +347,7 @@ export const parseMarkdown = (
     category,
     items,
     createdAt: fileStats
-      ? fileStats.birthtime.toISOString()
+      ? createdAtOf(metadata, fileStats.birthtime)
       : new Date().toISOString(),
     updatedAt: fileStats
       ? fileStats.mtime.toISOString()
diff --git a/app/_utils/indexes-utils.ts b/app/_utils/indexes-utils.ts
deleted file mode 100644
index 8722f178e..000000000
--- a/app/_utils/indexes-utils.ts
+++ /dev/null
@@ -1,82 +0,0 @@
-import { LinkIndex } from "../_types";
-import { Checklist, ItemType, Note } from "../_types";
-import { ItemTypes } from "../_types/enums";
-
-export const createItemMap = (itemsArray: Note[] | Checklist[]) => {
-  return itemsArray.reduce(
-    (map: Map<string, Note | Checklist>, item: Note | Checklist) => {
-      if (item.uuid) {
-        map.set(item.uuid, item);
-      }
-      return map;
-    },
-    new Map()
-  );
-};
-
-export const getReferencingItems = (
-  uuids: string[],
-  map: Map<string, Note | Checklist>,
-  type: ItemType
-) => {
-  return uuids
-    .map((uuid) => {
-      const item = map.get(uuid);
-
-      if (item) {
-        return {
-          type,
-          title: item.title,
-          uuid: item.uuid,
-          category: item.category || "Uncategorized",
-          owner: item.owner,
-        };
-      }
-      return null;
-    })
-    .filter((item): item is NonNullable<typeof item> => item !== null);
-};
-
-export const getReferences = (
-  linkIndex: LinkIndex | null,
-  itemUuid: string | undefined,
-  itemType: ItemType,
-  notes: Partial<Note>[],
-  checklists: Partial<Checklist>[]
-) => {
-  if (!linkIndex || !itemUuid) return [];
-
-  const currentItemData =
-    itemType === ItemTypes.NOTE
-      ? linkIndex.notes[itemUuid]
-      : linkIndex.checklists[itemUuid];
-
-  const items: Array<{
-    type: ItemType;
-    uuid: string;
-    title: string;
-    category: string;
-    owner: string | undefined;
-  }> = [];
-
-  const notesMap = createItemMap(notes as Note[]);
-  const checklistsMap = createItemMap(checklists as Checklist[]);
-
-  if (!currentItemData) return [];
-
-  const referencedNotes = getReferencingItems(
-    currentItemData.isReferencedIn.notes,
-    notesMap,
-    ItemTypes.NOTE
-  );
-
-  const referencedChecklists = getReferencingItems(
-    currentItemData.isReferencedIn.checklists,
-    checklistsMap,
-    ItemTypes.CHECKLIST
-  );
-
-  items.push(...referencedNotes, ...referencedChecklists);
-
-  return items;
-};
diff --git a/app/_utils/item-href-utils.ts b/app/_utils/item-href-utils.ts
new file mode 100644
index 000000000..bccb74794
--- /dev/null
+++ b/app/_utils/item-href-utils.ts
@@ -0,0 +1,96 @@
+import { isUuid } from "@/app/_consts/identity";
+import { LEGACY_LINK_PREFIX } from "@/app/_consts/relations";
+import { ItemTypes } from "@/app/_types/enums";
+import { itemHref } from "@/app/_utils/global-utils";
+
+export interface ItemHrefTarget {
+  uuid?: string;
+  type?: ItemTypes;
+  legacy?: { category: string; id: string };
+}
+
+const PREFIXES: Array<[string, ItemTypes | undefined]> = [
+  ["/note/", ItemTypes.NOTE],
+  ["/checklist/", ItemTypes.CHECKLIST],
+  [LEGACY_LINK_PREFIX, undefined],
+];
+
+const _localPath = (href: string, origins: string[]): string | null => {
+  if (href.startsWith("/")) return href;
+  try {
+    const url = new URL(href);
+    return origins.includes(url.origin) ? url.pathname : null;
+  } catch {
+    return null;
+  }
+};
+
+const _decode = (segment: string): string => {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+};
+
+export const parseItemHref = (
+  href: string | null | undefined,
+  origins: string[] = [],
+): ItemHrefTarget | null => {
+  if (!href) return null;
+
+  const local = _localPath(href.trim(), origins);
+  if (!local) return null;
+
+  const pathOnly = local.split(/[?#]/)[0];
+  const match = PREFIXES.find(([prefix]) => pathOnly.startsWith(prefix));
+  if (!match) return null;
+
+  const [prefix, type] = match;
+  const parts = pathOnly.slice(prefix.length).split("/").filter(Boolean);
+  if (parts.length === 0) return null;
+
+  if (parts.length === 1 && isUuid(parts[0])) {
+    return { uuid: parts[0].toLowerCase(), type };
+  }
+
+  if (!type) return null;
+
+  const id = _decode(parts[parts.length - 1]);
+  if (isUuid(id)) return { uuid: id.toLowerCase(), type };
+
+  return {
+    type,
+    legacy: { category: parts.slice(0, -1).map(_decode).join("/"), id },
+  };
+};
+
+export const isItemHref = (
+  href: string | null | undefined,
+  origins: string[] = [],
+): boolean => parseItemHref(href, origins) !== null;
+
+const LINK_TEXT_SPECIALS = /([\[\]\\])/g;
+
+export const escapeLinkText = (text: string): string =>
+  text.replace(LINK_TEXT_SPECIALS, "\\$1");
+
+const _asType = (type: string | null | undefined): ItemTypes | undefined =>
+  type === ItemTypes.NOTE || type === ItemTypes.CHECKLIST ? type : undefined;
+
+export const canonicalItemHref = (
+  href: string | null | undefined,
+  uuid?: string | null,
+  type?: string | null,
+): string | null => {
+  const target = parseItemHref(href);
+  const resolvedUuid = target?.uuid || (uuid && isUuid(uuid) ? uuid : undefined);
+  const resolvedType = target?.type || _asType(type);
+
+  if (resolvedUuid && resolvedType) return itemHref(resolvedType, resolvedUuid);
+
+  return href || null;
+};
+
+export const currentOrigins = (): string[] =>
+  typeof window === "undefined" ? [] : [window.location.origin];
diff --git a/app/_utils/markdown-utils.tsx b/app/_utils/markdown-utils.tsx
index 8ddc93375..ef5a017ae 100644
--- a/app/_utils/markdown-utils.tsx
+++ b/app/_utils/markdown-utils.tsx
@@ -10,8 +10,12 @@ import { Element } from "hast";
 import { addCustomHtmlTurndownRules } from "@/app/_utils/custom-html-utils";
 import { html as beautifyHtml } from "js-beautify";
 import { TableSyntax } from "@/app/_types";
-import { decodeCategoryPath, decodeSegment } from "./global-utils";
-import { isUuid } from "@/app/_consts/identity";
+import {
+  canonicalItemHref,
+  escapeLinkText,
+  isItemHref,
+  parseItemHref,
+} from "./item-href-utils";
 import { getContrastColor } from "./color-utils";
 
 const turndownPluginGfm = require("turndown-plugin-gfm");
@@ -63,6 +67,8 @@ const hasComplexTableContent = (table: HTMLElement): boolean => {
   return false;
 };
 
+const WIKILINK_SPAN = /(!?\[\[[^\[\]\n]+\]\])/;
+
 export const createTurndownService = (tableSyntax?: TableSyntax) => {
   const service = new TurndownService({
     headingStyle: "atx",
@@ -81,6 +87,13 @@ export const createTurndownService = (tableSyntax?: TableSyntax) => {
     },
   });
 
+  const escapeMarkdown = service.escape.bind(service);
+  service.escape = (text: string) =>
+    text
+      .split(WIKILINK_SPAN)
+      .map((part, index) => (index % 2 === 1 ? part : escapeMarkdown(part)))
+      .join("");
+
   service.addRule("taskItem", {
     filter: (node) =>
       node.nodeName === "LI" && node.getAttribute("data-type") === "taskItem",
@@ -262,11 +275,15 @@ export const createTurndownService = (tableSyntax?: TableSyntax) => {
     },
     replacement: function (content, node) {
       const element = node as HTMLElement;
-      const href = element.getAttribute("data-href");
       const title = element.getAttribute("data-title");
+      const href = canonicalItemHref(
+        element.getAttribute("data-href"),
+        element.getAttribute("data-uuid"),
+        element.getAttribute("data-type"),
+      );
 
       if (href && title) {
-        return `[${title}](${href})`;
+        return `[${escapeLinkText(title)}](${href})`;
       }
 
       return content;
@@ -644,36 +661,17 @@ const markdownProcessor = unified()
 
         if (node.tagName === "a" && node.properties?.href) {
           const href = String(node.properties.href);
-          if (
-            href.startsWith("/jotty/") ||
-            href.startsWith("/note/") ||
-            href.startsWith("/checklist/")
-          ) {
+          if (isItemHref(href)) {
             const textContent =
               node.children?.[0]?.type === "text"
                 ? String(node.children[0].value)
                 : "";
 
-            let uuid = "";
-            let type = "note";
-            let category = "";
-            let itemId = "";
-
-            if (href.startsWith("/jotty/")) {
-              uuid = href.replace("/jotty/", "");
-            } else if (href.startsWith("/note/")) {
-              type = "note";
-              const pathParts = href.replace("/note/", "").split("/");
-              itemId = decodeSegment(pathParts.pop() || "");
-              uuid = isUuid(itemId) ? itemId : "";
-              category = decodeCategoryPath(pathParts.join("/"));
-            } else if (href.startsWith("/checklist/")) {
-              type = "checklist";
-              const pathParts = href.replace("/checklist/", "").split("/");
-              itemId = decodeSegment(pathParts.pop() || "");
-              uuid = isUuid(itemId) ? itemId : "";
-              category = decodeCategoryPath(pathParts.join("/"));
-            }
+            const target = parseItemHref(href);
+            const uuid = target?.uuid || "";
+            const type = target?.type || "";
+            const category = target?.legacy?.category || "";
+            const itemId = target?.legacy?.id || uuid;
 
             const newChildren: any[] = [];
 
@@ -693,7 +691,6 @@ const markdownProcessor = unified()
               "data-type": type,
               "data-category": category,
               "data-item-id": itemId,
-              "data-convert-to-bidirectional": "false",
             };
 
             node.children = newChildren;
diff --git a/app/_utils/wikilink-utils.ts b/app/_utils/wikilink-utils.ts
new file mode 100644
index 000000000..b12f2eb70
--- /dev/null
+++ b/app/_utils/wikilink-utils.ts
@@ -0,0 +1,24 @@
+import { findAndReplace } from "mdast-util-find-and-replace";
+import type { Root } from "mdast";
+import { WIKILINK_REGEX } from "@/app/_consts/relations";
+
+export const WIKILINK_TAG = "wiki-link";
+
+export const remarkWikilinks = () => (tree: Root) => {
+  findAndReplace(tree, [
+    [
+      new RegExp(WIKILINK_REGEX.source, "g"),
+      (_match: string, target: string, alias?: string) => {
+        const label = (alias || target).trim();
+        return {
+          type: "text",
+          value: label,
+          data: {
+            hName: WIKILINK_TAG,
+            hProperties: { target: target.trim(), label },
+          },
+        };
+      },
+    ],
+  ]);
+};
diff --git a/app/_utils/yaml-metadata-utils.ts b/app/_utils/yaml-metadata-utils.ts
index 74f83372a..b86b631b8 100644
--- a/app/_utils/yaml-metadata-utils.ts
+++ b/app/_utils/yaml-metadata-utils.ts
@@ -10,6 +10,16 @@ export const toIso = (d: Date | string | number | undefined | null): string => {
     : new Date(0).toISOString();
 };
 
+export const createdAtOf = (
+  metadata: Record<string, unknown> | null | undefined,
+  birthtime: Date,
+): string => {
+  const stamped = metadata?.[OwnedMetaKeys.CREATED_AT];
+  return stamped instanceof Date || typeof stamped === "string"
+    ? toIso(stamped)
+    : toIso(birthtime);
+};
+
 export interface DocumentMetadata {
   uuid?: string;
   title?: string;
diff --git a/app/api/admin/rebuild-index/route.ts b/app/api/admin/rebuild-index/route.ts
index 4a687b492..4348f69b5 100644
--- a/app/api/admin/rebuild-index/route.ts
+++ b/app/api/admin/rebuild-index/route.ts
@@ -1,22 +1,35 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth } from "@/app/_utils/api-utils";
-import { rebuildLinkIndex } from "@/app/_server/actions/link";
+import { getUserIndex } from "@/app/_server/actions/users/helpers";
+import {
+  rebuildOwnerRelations,
+  rebuildRelations,
+} from "@/app/_server/actions/relations/indexer";
 
 export const dynamic = "force-dynamic";
 
 export async function POST(request: NextRequest) {
   return withApiAuth(request, async (user) => {
+    if (!user.isAdmin) {
+      return NextResponse.json({ error: "Admin access required" }, { status: 403 });
+    }
+
     try {
-      const { username } = await request.json();
+      const { username } = await request.json().catch(() => ({}));
 
       if (!username) {
-        return NextResponse.json(
-          { error: "Username is required" },
-          { status: 400 }
-        );
+        await rebuildRelations();
+        return NextResponse.json({
+          success: true,
+          message: "Successfully rebuilt link index for every user",
+        });
+      }
+
+      if ((await getUserIndex(username)) === -1) {
+        return NextResponse.json({ error: "User not found" }, { status: 404 });
       }
 
-      await rebuildLinkIndex(username);
+      await rebuildOwnerRelations(username);
 
       return NextResponse.json({
         success: true,
diff --git a/app/layout.tsx b/app/layout.tsx
index 2065ce94d..d623c8b5d 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -19,7 +19,6 @@ import { getCategories } from "@/app/_server/actions/category";
 import { Modes } from "./_types/enums";
 import { getCurrentUser, getUsers } from "./_server/actions/users";
 import { readPackageVersion } from "@/app/_server/actions/config";
-import { readLinkIndex } from "@/app/_server/actions/link";
 import { headers } from "next/headers";
 import {
   themeInitScript,
@@ -170,9 +169,6 @@ export default async function RootLayout({
   const checklistCategories = user
     ? await getCategories(Modes.CHECKLISTS)
     : { success: false, data: [] };
-  const linkIndex = user?.username
-    ? await readLinkIndex(user.username)
-    : null;
   const messages = await getMessages();
 
   const [
@@ -264,7 +260,6 @@ export default async function RootLayout({
             pathname={pathname || ""}
             initialSettings={settings}
             usersPublicData={users}
-            linkIndex={linkIndex}
             notes={notes}
             checklists={checklists}
             allSharedItems={allSharedItems}
diff --git a/howto/API.md b/howto/API.md
index 8071d4475..2eed4ecee 100644
--- a/howto/API.md
+++ b/howto/API.md
@@ -1178,7 +1178,7 @@ Retrieves all categories for notes and checklists for the authenticated user. Ar
 
 **POST** `/api/admin/rebuild-index`
 
-Rebuilds the internal link index for a specific user. This is useful when the link relationships between notes and checklists become inconsistent due to bulk operations, data migrations, or other maintenance tasks.
+Rebuilds the relationships index, the list of which notes and checklists link to each other. Jotty keeps it up to date on its own and checks it against your files every minute, so you only need this after editing lots of files outside Jotty, restoring a backup, or if the brain looks wrong.
 
 **Request Body:**
 
@@ -1190,7 +1190,7 @@ Rebuilds the internal link index for a specific user. This is useful when the li
 
 **Parameters:**
 
-- `username` (required): Username whose link index should be rebuilt
+- `username` (optional): Rebuild only this user's items. Leave it out to rebuild every user.
 
 **Response:**
 
@@ -1201,12 +1201,18 @@ Rebuilds the internal link index for a specific user. This is useful when the li
 }
 ```
 
+**Errors:**
+
+- `403`: the API key does not belong to an admin
+- `404`: no user with that username
+
 **Notes:**
 
 - Only administrators can use this endpoint
-- The rebuild process scans all notes and checklists for the specified user and recreates the link relationships
-- This operation may take time for users with large amounts of content
-- The link index tracks internal references between notes and checklists (e.g., when one note links to another)
+- Rebuilding reads your notes and checklists and never changes them
+- Encrypted notes are skipped, their content is never read
+- Wikilinks keep pointing at the note they were first matched to, so a rebuild does not move them onto a different note with the same title
+- The index lives in `data/.relations.db`. If it is deleted, Jotty rebuilds it from your files
 
 ### 16. Get User Summary Statistics
 
@@ -1793,7 +1799,7 @@ curl -H "x-api-key: ck_your_api_key_here" \
      https://jotty-instance.com/api/exports
 ```
 
-### Rebuild link index for a user (admin only)
+### Rebuild the link index (admin only)
 
 ```bash
 curl -X POST \
diff --git a/howto/BRAIN.md b/howto/BRAIN.md
new file mode 100644
index 000000000..60ecd672d
--- /dev/null
+++ b/howto/BRAIN.md
@@ -0,0 +1,99 @@
+# Links and the Brain
+
+Notes and checklists can link to each other. Every link works both ways: the item you link to lists the item that links to it under **Referenced By**. The **Brain** draws all of those links as a map you can explore.
+
+---
+
+## Making a link
+
+There are three ways, and you can mix them freely.
+
+| How | What you type | What gets saved |
+| --- | --- | --- |
+| Mention | `@` then pick an item | `[Title](/note/<uuid>)` |
+| Wikilink picker | `[[` then pick an item | `[Title](/note/<uuid>)` |
+| Wikilink | `[[Title]]` typed out in full | `[[Title]]`, exactly as you typed it |
+
+Links made with the picker point at the item's id, so nothing you do to the item later can break them. Wikilinks are for people who like typing them out, and for notes brought over from Obsidian.
+
+Wikilinks understand the usual extras:
+
+- `[[Title|shown text]]` shows different text
+- `[[Title#Heading]]` points at a heading
+- `[[Title]]` for a note that doesn't exist yet shows a dashed button. Click it to create the note.
+
+---
+
+## How wikilinks find their note
+
+A wikilink is matched by title, ignoring upper and lower case and extra spaces, against your own notes and checklists.
+
+- **The first match sticks.** Once `[[Plan]]` has found a note, it keeps pointing at that note. A new note called "Plan" later on doesn't take the link over.
+- **Two items with the same title.** The link goes to the older one.
+- **Renaming the target.** The link keeps working. The next time you save the note that contains the link, Jotty updates the text to the new title, so `[[Plan]]` becomes `[[Q3 plan]]`. Headings and shown text are kept. Only the note you are saving changes. Other notes catch up when they are next saved, and their links keep working until then.
+- **Pointing a link somewhere else.** Edit the text inside `[[ ]]` and save. Different text is looked up again.
+- **Deleting the target.** Links move to the next item with that title, or become a "not written yet" button.
+
+Wikilinks inside code blocks and inline code are left alone.
+
+---
+
+## Mentioned in
+
+Below **Referenced By**, a **Mentioned in** list shows notes that contain this item's title as plain text but don't link to it yet. Press **Link** to turn the first plain mention in that note into a link. Nothing else in the note changes.
+
+Titles shorter than three characters are skipped, because they would match almost everything.
+
+---
+
+## Importing from Obsidian
+
+Copy your vault's Markdown files into a category and Jotty picks them up. The body of each note is left exactly as it was: `[[wikilinks]]` are read, never rewritten on import.
+
+Jotty adds two lines to each file's frontmatter the first time it sees it:
+
+- `uuid`, the id Jotty uses for the note's address
+- `createdAt`, so the note keeps its creation date
+
+Wikilinks are only rewritten when you rename a note in Jotty and then save a note that links to it, as described above.
+
+---
+
+## The Brain
+
+Open it with the brain button at the top of any note or checklist. The item you came from is highlighted.
+
+- **3D and 2D.** 3D is the default on devices that handle it. Phones, tablets and anyone with reduced motion turned on get 2D.
+- **Click** a node to select it and see its links. **Double click** opens it. Right click opens it too.
+- **Search** jumps to an item.
+- **Around this item** shows just the part of the map around the item you came from, with a depth slider. **Everything** shows the whole map again.
+- **Colour by** type or by category.
+- **Filters** show or hide notes, checklists, tags, "not written yet" items, suggestions and items with no links.
+- **Suggestions** are dashed lines between items that share a lot of neighbours but don't link to each other yet. They are listed as **Might be related** when you select an item, and on your own brain the link button next to one connects them.
+
+Node shapes:
+
+| Shape | Meaning |
+| --- | --- |
+| Circle with a note icon | Note |
+| Rounded square with a checklist icon | Checklist |
+| Rounded square with a task icon | Kanban board |
+| Diamond | Tag |
+| Dashed circle | A wikilink to a note that doesn't exist yet |
+
+Admins can open `/brain/<username>` to see another user's brain when **Admin Content Access** is turned on in the admin settings.
+
+Turning off **Bilateral Links** in the admin editor settings hides the brain, Referenced By and Mentioned in.
+
+---
+
+## The relationships index
+
+Jotty keeps the links in `data/.relations.db`, next to your notes. Your Markdown files stay the source of truth. The index holds the links, the titles, and a searchable copy of each unencrypted note's plain text, which powers **Mentioned in**.
+
+- Encrypted notes are never read. Their links don't appear anywhere.
+- If the file is missing or damaged, Jotty rebuilds it from your notes on start. While that runs, Referenced By and the Brain show "Indexing relationships...".
+- Files changed outside Jotty are picked up within about a minute.
+- Admins can rebuild it from **Admin > Content**, or with the [rebuild API](API.md#15-rebuild-link-index).
+
+A rebuild keeps track of which note each wikilink first matched. Deleting the file loses that: wikilinks whose target was renamed in Jotty, in notes not saved since, then fall back to matching by title.
diff --git a/instrumentation.ts b/instrumentation.ts
index 5a11f09ea..165bf90b6 100644
--- a/instrumentation.ts
+++ b/instrumentation.ts
@@ -109,6 +109,13 @@ export async function register() {
       console.log(`> WebSocket dev server running on ws://0.0.0.0:${WS_PORT}`);
     }
 
+    if (!(globalThis as any).__jottyRelationsStarted) {
+      (globalThis as any).__jottyRelationsStarted = true;
+      import("./app/_server/actions/relations/indexer")
+        .then(({ reconcileRelations }) => reconcileRelations())
+        .catch((err) => console.error("[relations] startup reconcile failed:", err));
+    }
+
     if ((globalThis as any).__jottyReminderScanStarted) return;
     (globalThis as any).__jottyReminderScanStarted = true;
 
diff --git a/next.config.mjs b/next.config.mjs
index 767bc697b..943316748 100644
--- a/next.config.mjs
+++ b/next.config.mjs
@@ -22,6 +22,8 @@ const nextConfig = {
     unoptimized: true,
   },
   async headers() {
+    if (process.env.NODE_ENV !== "production") return [];
+
     return [
       {
         source: "/:all*(svg|jpg|jpeg|png|gif|ico|webp|avif|woff|woff2|css|js)",
diff --git a/package.json b/package.json
index a35d8a550..587ca739a 100644
--- a/package.json
+++ b/package.json
@@ -12,6 +12,7 @@
     "test:coverage": "vitest run --coverage",
     "mock:data:lists": "tsx tests/mock-data/checklist-generator.ts",
     "mock:data:notes": "tsx tests/mock-data/note-generator.ts",
+    "mock:data:brain": "tsx --tsconfig tsconfig.json tests/mock-data/brain-seed.ts",
     "docker:test": "docker compose -f docker-compose.test.yml down && docker compose -f docker-compose.test.yml build && docker compose -f docker-compose.test.yml up -d",
     "docker:test:logs": "docker compose -f docker-compose.test.yml logs -f",
     "docker:test:restart": "docker compose -f docker-compose.test.yml down && docker compose -f docker-compose.test.yml up -d"
@@ -27,7 +28,6 @@
     "@fontsource-variable/work-sans": "5.2.8",
     "@hugeicons/core-free-icons": "3.0.0",
     "@hugeicons/react": "1.1.2",
-    "@nivo/network": "0.99.0",
     "@rcode-link/tiptap-drawio": "1.0.21",
     "@tiptap/core": "3.31.3",
     "@tiptap/extension-bubble-menu": "3.31.3",
@@ -63,8 +63,9 @@
     "jsonwebtoken": "9.0.2",
     "ldapts": "8.1.7",
     "libsodium-wrappers-sumo": "0.7.15",
+    "mdast-util-find-and-replace": "3.0.2",
     "mermaid": "10.9.8",
-    "next": "16.3.0",
+    "next": "16.3.6",
     "next-intl": "4.9.2",
     "next-themes": "0.2.1",
     "openpgp": "6.3.0",
@@ -75,6 +76,7 @@
     "react-day-picker": "9.14.0",
     "react-dom": "19.2.4",
     "react-force-graph-2d": "^1.29.1",
+    "react-force-graph-3d": "1.29.1",
     "react-markdown": "10.1.0",
     "react-masonry-css": "1.0.16",
     "react-simple-code-editor": "0.14.1",
@@ -91,6 +93,7 @@
     "speakeasy": "2.0.0",
     "tailwind-merge": "2.2.0",
     "tailwind-scrollbar": "4.0.2",
+    "three": "0.186.1",
     "tippy.js": "6.3.7",
     "turndown": "7.2.0",
     "turndown-plugin-gfm": "1.0.2",
@@ -146,11 +149,12 @@
     "@types/libsodium-wrappers": "0.7.14",
     "@types/libsodium-wrappers-sumo": "0.7.8",
     "@types/lodash": "4.17.20",
-    "@types/node": "20",
+    "@types/node": "24",
     "@types/proper-lockfile": "4.1.4",
     "@types/react": "19.2.13",
     "@types/react-dom": "19.2.3",
     "@types/sanitize-html": "2.16.0",
+    "@types/three": "0.186.0",
     "@types/turndown": "5.0.5",
     "@types/unist": "3.0.3",
     "@types/uuid": "10.0.0",
@@ -158,7 +162,7 @@
     "@vitest/coverage-v8": "4.1.8",
     "autoprefixer": "10.0.1",
     "eslint": "9",
-    "eslint-config-next": "16.3.0",
+    "eslint-config-next": "16.3.6",
     "postcss": "8.5.26",
     "serwist": "9.5.4",
     "tailwindcss": "3.3.0",
diff --git a/tests/mock-data/brain-seed.ts b/tests/mock-data/brain-seed.ts
new file mode 100644
index 000000000..cdb77092b
--- /dev/null
+++ b/tests/mock-data/brain-seed.ts
@@ -0,0 +1,404 @@
+import { promises as fs } from "fs";
+import path from "path";
+import { createHash } from "crypto";
+import lockfile from "proper-lockfile";
+import { noteToMarkdown } from "../../app/_server/actions/note/parsers";
+import { listToMarkdown } from "../../app/_utils/checklist-utils";
+import type { Checklist, Item, Note } from "../../app/_types";
+import { ChecklistsTypes } from "../../app/_types/enums";
+import { random, randomChoice, randomInt, randomSample, resetSeed } from "./utils";
+
+const USER_FLAG = "--user=";
+const DEFAULT_USER = "braintest";
+const USERNAME =
+  process.argv.find((arg) => arg.startsWith(USER_FLAG))?.slice(USER_FLAG.length) ||
+  process.env.BRAIN_SEED_USER ||
+  DEFAULT_USER;
+const PASSWORD = process.env.BRAIN_SEED_PASSWORD || "braintest-local-only";
+const SEED_CATEGORY = "Brain Seed";
+const DATA_DIR = path.join(process.cwd(), "data");
+const USERS_FILE = path.join(DATA_DIR, "users", "users.json");
+const NOTES_ROOT = path.join(DATA_DIR, "notes", USERNAME, SEED_CATEGORY);
+const LISTS_ROOT = path.join(DATA_DIR, "checklists", USERNAME, SEED_CATEGORY);
+const CREATED_MARKER = path.join(DATA_DIR, "notes", USERNAME, ".brain-seed-user");
+const YEAR_MS = 365 * 24 * 60 * 60 * 1000;
+
+interface Cluster {
+  category: string;
+  tag: string;
+  notes: string[];
+  lists: string[];
+}
+
+const CLUSTERS: Cluster[] = [
+  {
+    category: "Home",
+    tag: "home",
+    notes: ["Boiler service history", "Living room repaint plan", "House insurance notes", "Neighbours and contacts", "Moving in checklist retro"],
+    lists: ["Weekly cleaning rota", "Hardware store run", "Spare parts inventory", "Paint colour shortlist", "Bills to cancel"],
+  },
+  {
+    category: "Garden",
+    tag: "garden",
+    notes: ["Tomato growing log", "Composting notes", "Raised bed layout", "Pest control ideas", "Seed swap contacts"],
+    lists: ["Spring sowing plan", "Garden centre shopping", "Watering schedule", "Tools to sharpen", "Bulbs to plant"],
+  },
+  {
+    category: "Recipes",
+    tag: "cooking",
+    notes: ["Sourdough starter notes", "Weeknight curry", "Grandma's lasagne", "Meal prep principles", "Fermentation experiments"],
+    lists: ["Groceries this week", "Pantry staples", "Baking gear wishlist", "Dinner party menu", "Spices to restock"],
+  },
+  {
+    category: "Travel/Japan",
+    tag: "travel",
+    notes: ["Tokyo itinerary", "Kyoto temples shortlist", "JR pass maths", "Japanese phrases", "Onsen etiquette"],
+    lists: ["Packing list Japan", "Bookings to confirm", "Souvenirs for family", "Before we fly", "Food to try in Osaka"],
+  },
+  {
+    category: "Work/Projects",
+    tag: "work",
+    notes: ["Q3 roadmap", "Search rewrite design", "Incident review April", "Onboarding guide draft", "Architecture decisions"],
+    lists: ["Sprint board", "Launch checklist", "Hiring pipeline", "Tech debt backlog", "Release notes todo"],
+  },
+  {
+    category: "Work/Meetings",
+    tag: "meetings",
+    notes: ["Weekly sync notes", "One to one with Sam", "Planning offsite", "Customer call notes", "Retro themes"],
+    lists: ["Action items", "Agenda next week", "Follow ups", "Offsite logistics", "Questions for leadership"],
+  },
+  {
+    category: "Health",
+    tag: "health",
+    notes: ["Running plan", "Physio exercises", "Sleep experiments", "Blood test results summary", "Stretching routine"],
+    lists: ["Gym programme", "Supplements", "Race day kit", "Appointments", "Healthy snacks"],
+  },
+  {
+    category: "Reading",
+    tag: "books",
+    notes: ["Book notes Deep Work", "Book notes Thinking Fast and Slow", "Quotes I like", "Reading goals", "Sci-fi recommendations"],
+    lists: ["To read", "Books to lend back", "Library holds", "Gift ideas books", "Audiobooks queue"],
+  },
+  {
+    category: "Finance",
+    tag: "money",
+    notes: ["Budget principles", "Pension research", "Tax year notes", "Subscriptions audit", "Savings goals"],
+    lists: ["Monthly budget", "Receipts to file", "Accounts to close", "Big purchases", "Tax documents"],
+  },
+  {
+    category: "Ideas",
+    tag: "ideas",
+    notes: ["Side project ideas", "App features wishlist", "Blog post drafts", "Things to learn", "Random thoughts"],
+    lists: ["Weekend projects", "Domains to buy", "Talks to watch", "Experiments backlog", "Someday maybe"],
+  },
+];
+
+const SHARED_TAGS = ["urgent", "someday", "review", "family"];
+const GHOSTS = ["Unwritten travel journal", "Future house plans", "Recipe book idea", "Marathon training diary"];
+const KANBAN_STATUSES = ["todo", "in_progress", "completed"];
+
+let _minted = 0;
+
+const _uuid = (): string => {
+  _minted += 1;
+  const hex = createHash("sha256").update(`${USERNAME}:${_minted}`).digest("hex").slice(0, 32).split("");
+  hex[12] = "4";
+  hex[16] = ((parseInt(hex[16], 16) & 0x3) | 0x8).toString(16);
+  const h = hex.join("");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+};
+
+const _slug = (title: string) =>
+  title.toLowerCase().replace(/['’]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+
+interface Seeded {
+  uuid: string;
+  title: string;
+  type: "note" | "checklist";
+  cluster: Cluster;
+  kanban: boolean;
+}
+
+const _href = (item: Seeded, legacy = false) =>
+  legacy ? `/jotty/${item.uuid}` : `/${item.type}/${item.uuid}`;
+
+const _link = (item: Seeded, legacy = false) => `[${item.title}](${_href(item, legacy)})`;
+
+const _mention = (item: Seeded) => {
+  const roll = random();
+  if (roll < 0.1) return _link(item, true);
+  if (roll < 0.3) return `[[${item.title}]]`;
+  if (roll < 0.36) return `[[${item.title.toLowerCase()}]]`;
+  if (roll < 0.42) return `[[${item.title}|this one]]`;
+  return _link(item);
+};
+
+const _category = (cluster: Cluster) => `${SEED_CATEGORY}/${cluster.category}`;
+
+const _plan = (): Seeded[] => {
+  const all: Seeded[] = [];
+  CLUSTERS.forEach((cluster) => {
+    cluster.notes.forEach((title) => all.push({ uuid: _uuid(), title, type: "note", cluster, kanban: false }));
+    cluster.lists.forEach((title, index) =>
+      all.push({ uuid: _uuid(), title, type: "checklist", cluster, kanban: index % 2 === 1 }),
+    );
+  });
+  return all;
+};
+
+const _noteBody = (note: Seeded, all: Seeded[], index: number): string => {
+  const siblings = all.filter((item) => item.cluster === note.cluster && item.uuid !== note.uuid);
+  const others = all.filter((item) => item.cluster !== note.cluster);
+  const lines = [
+    `Notes about ${note.title.toLowerCase()}. #${note.cluster.tag}`,
+    "",
+    `Related: ${randomSample(siblings, randomInt(1, 3)).map(_mention).join(", ")}.`,
+  ];
+
+  if (random() < 0.4) lines.push("", `Also see ${_mention(randomChoice(others))} for context.`);
+  if (random() < 0.25) lines.push("", `One day: [[${randomChoice(GHOSTS)}]].`);
+  if (random() < 0.3) lines.push("", `Tagged #${randomChoice(SHARED_TAGS)} for later.`);
+  if (random() < 0.5) lines.push("", `I keep coming back to ${randomChoice(others).title} when I think about this.`);
+  if (index % 7 === 0) {
+    lines.push("", "```md", `[not a real link](/note/${randomChoice(others).uuid}) and [[Not A Wikilink]]`, "```");
+  }
+  return lines.join("\n");
+};
+
+const _itemsFor = (list: Seeded, all: Seeded[]): Item[] => {
+  const notes = all.filter((item) => item.type === "note");
+  const siblings = all.filter((item) => item.cluster === list.cluster && item.uuid !== list.uuid);
+  const count = randomInt(4, 8);
+  const now = new Date().toISOString();
+
+  return Array.from({ length: count }, (_, order) => {
+    const linked = random() < 0.35;
+    const target = linked ? randomChoice(random() < 0.7 ? siblings : notes) : null;
+    const text = target
+      ? `Check ${_link(target)} #${list.cluster.tag}`
+      : `${randomChoice(["Sort out", "Buy", "Book", "Call about", "Review", "Tidy"])} item ${order + 1}`;
+    const item: Item = {
+      id: `${list.uuid.slice(0, 8)}-${order}`,
+      text,
+      completed: random() < 0.3,
+      order,
+      createdAt: now,
+    };
+
+    if (list.kanban) {
+      item.status = randomChoice(KANBAN_STATUSES);
+      if (random() < 0.4) item.description = `Context in ${_link(randomChoice(notes))}`;
+    } else if (random() < 0.2) {
+      item.children = [
+        {
+          id: `${item.id}-child`,
+          text: `Sub task, see ${_link(randomChoice(siblings))}`,
+          completed: false,
+          order: 0,
+          createdAt: now,
+        },
+      ];
+    }
+    return item;
+  });
+};
+
+const _write = async (
+  root: string,
+  category: string,
+  title: string,
+  content: string,
+  createdAt = new Date().toISOString(),
+) => {
+  const dir = path.join(root, ...category.split("/"));
+  await fs.mkdir(dir, { recursive: true });
+  const stamped = content.replace(/^---\n/, `---\ncreatedAt: "${createdAt}"\n`);
+  await fs.writeFile(path.join(dir, `${_slug(title)}.md`), stamped, "utf-8");
+};
+
+const _withUsers = async (change: (users: Record<string, unknown>[]) => Record<string, unknown>[]) => {
+  const release = await lockfile.lock(USERS_FILE, { retries: { retries: 10, minTimeout: 100 } });
+  try {
+    const users = JSON.parse(await fs.readFile(USERS_FILE, "utf-8")) as Record<string, unknown>[];
+    const tmp = `${USERS_FILE}.${process.pid}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(change(users), null, 2), "utf-8");
+    await fs.rename(tmp, USERS_FILE);
+  } finally {
+    await release();
+  }
+};
+
+const _ensureUser = () =>
+  _withUsers((users) => {
+    if (users.some((user) => user.username === USERNAME)) return users;
+    created = true;
+    const now = new Date().toISOString();
+    return [
+      ...users,
+      {
+        username: USERNAME,
+        passwordHash: createHash("sha256").update(PASSWORD).digest("hex"),
+        isAdmin: false,
+        createdAt: now,
+        lastLogin: now,
+        preferredDateFormat: "system",
+        preferredTimeFormat: "system",
+        handedness: "right-handed",
+        hideMobileStatusDropdown: "disable",
+      },
+    ];
+  });
+
+let created = false;
+
+const _exists = (target: string) =>
+  fs.access(target).then(
+    () => true,
+    () => false,
+  );
+
+const _remove = async () => {
+  await fs.rm(NOTES_ROOT, { recursive: true, force: true });
+  await fs.rm(LISTS_ROOT, { recursive: true, force: true });
+  if (!(await _exists(CREATED_MARKER))) {
+    console.log(`Removed the ${SEED_CATEGORY} category from ${USERNAME}.`);
+    return;
+  }
+  await fs.rm(path.join(DATA_DIR, "notes", USERNAME), { recursive: true, force: true });
+  await fs.rm(path.join(DATA_DIR, "checklists", USERNAME), { recursive: true, force: true });
+  await _withUsers((users) => users.filter((user) => user.username !== USERNAME));
+  console.log(`Removed ${USERNAME} and all of their items.`);
+};
+
+const _seed = async () => {
+  resetSeed();
+  await fs.rm(NOTES_ROOT, { recursive: true, force: true });
+  await fs.rm(LISTS_ROOT, { recursive: true, force: true });
+  await _ensureUser();
+  if (created) {
+    await fs.mkdir(path.dirname(CREATED_MARKER), { recursive: true });
+    await fs.writeFile(CREATED_MARKER, "", "utf-8");
+  }
+
+  const all = _plan();
+  const notes = all.filter((item) => item.type === "note");
+  const lists = all.filter((item) => item.type === "checklist");
+  const now = new Date().toISOString();
+
+  for (let index = 0; index < notes.length; index++) {
+    const seeded = notes[index];
+    const note: Note = {
+      id: _slug(seeded.title),
+      uuid: seeded.uuid,
+      title: seeded.title,
+      content: _noteBody(seeded, all, index),
+      category: _category(seeded.cluster),
+      createdAt: now,
+      updatedAt: now,
+      owner: USERNAME,
+      tags: [seeded.cluster.tag],
+    };
+    await _write(NOTES_ROOT, seeded.cluster.category, seeded.title, noteToMarkdown(note));
+  }
+
+  const hub: Note = {
+    id: "index-of-everything",
+    uuid: _uuid(),
+    title: "Index of everything",
+    content: ["Start here.", "", ...randomSample(all, 16).map((item) => `- ${_link(item)}`)].join("\n"),
+    category: `${SEED_CATEGORY}/Ideas`,
+    createdAt: now,
+    updatedAt: now,
+    owner: USERNAME,
+    tags: ["ideas", "review"],
+  };
+  await _write(NOTES_ROOT, "Ideas", hub.title, noteToMarkdown(hub));
+
+  const secret: Note = {
+    id: "private-journal",
+    uuid: _uuid(),
+    title: "Private journal",
+    content: `-----BEGIN PGP MESSAGE-----\n\nhQEMA${"x".repeat(60)}\n[should never be indexed](/note/${notes[0].uuid})\n-----END PGP MESSAGE-----`,
+    category: `${SEED_CATEGORY}/Ideas`,
+    createdAt: now,
+    updatedAt: now,
+    owner: USERNAME,
+    encrypted: true,
+    encryptionMethod: "pgp",
+  };
+  await _write(NOTES_ROOT, "Ideas", secret.title, noteToMarkdown(secret));
+
+  for (const loner of ["Loose thought one", "Loose thought two", "Loose thought three"]) {
+    const note: Note = {
+      id: _slug(loner),
+      uuid: _uuid(),
+      title: loner,
+      content: "Nothing links here yet.",
+      category: `${SEED_CATEGORY}/Ideas`,
+      createdAt: now,
+      updatedAt: now,
+      owner: USERNAME,
+    };
+    await _write(NOTES_ROOT, "Ideas", loner, noteToMarkdown(note));
+  }
+
+  const twins = ["an old imported copy", "a newer copy"].map((body, index) => ({
+    id: `weekly-review-${index}`,
+    uuid: _uuid(),
+    title: "Weekly review",
+    content: `This is ${body}. Wikilinks to [[Weekly review]] should land on the old one.`,
+    category: `${SEED_CATEGORY}/Ideas`,
+    createdAt: new Date(Date.now() - (index === 0 ? YEAR_MS : 0)).toISOString(),
+    updatedAt: now,
+    owner: USERNAME,
+  }));
+  for (const twin of twins) {
+    await _write(NOTES_ROOT, "Ideas", twin.id, noteToMarkdown(twin as Note), twin.createdAt);
+  }
+
+  const renamer: Note = {
+    id: "rename-playground",
+    uuid: _uuid(),
+    title: "Rename playground",
+    content: [
+      "Rename the targets of these links, then save this note and watch the text follow.",
+      "",
+      `- [[${notes[0].title}]]`,
+      `- [[${notes[1].title}#Details|with an alias]]`,
+      `- [[Weekly review]]`,
+      "",
+      `Plain mention for the unlinked mentions panel: ${notes[2].title}.`,
+    ].join("\n"),
+    category: `${SEED_CATEGORY}/Ideas`,
+    createdAt: now,
+    updatedAt: now,
+    owner: USERNAME,
+  };
+  await _write(NOTES_ROOT, "Ideas", renamer.title, noteToMarkdown(renamer));
+
+  for (const seeded of lists) {
+    const list: Checklist = {
+      id: _slug(seeded.title),
+      uuid: seeded.uuid,
+      title: seeded.title,
+      type: seeded.kanban ? ChecklistsTypes.KANBAN : ChecklistsTypes.SIMPLE,
+      category: _category(seeded.cluster),
+      items: _itemsFor(seeded, all),
+      createdAt: now,
+      updatedAt: now,
+      owner: USERNAME,
+      tags: [seeded.cluster.tag],
+    } as Checklist;
+    await _write(LISTS_ROOT, seeded.cluster.category, seeded.title, listToMarkdown(list));
+  }
+
+  console.log(
+    `Seeded ${USERNAME} under ${SEED_CATEGORY}: ${notes.length + 8} notes, ${lists.length} checklists. ` +
+      "Rebuild relations from Admin > Content, or restart the dev server, to index them.",
+  );
+};
+
+(process.argv.includes("--remove") ? _remove() : _seed()).catch((error) => {
+  console.error("brain seed failed:", error);
+  process.exit(1);
+});
diff --git a/tests/security/auth-required.test.ts b/tests/security/auth-required.test.ts
index 6eead4366..3f9f140cc 100644
--- a/tests/security/auth-required.test.ts
+++ b/tests/security/auth-required.test.ts
@@ -54,16 +54,6 @@ vi.mock('@/app/_server/actions/log', () => ({
   logUserEvent: vi.fn(),
 }))
 
-vi.mock('@/app/_server/actions/link', async (importOriginal) => {
-  const actual = await importOriginal() as any
-  return {
-    ...actual,
-    parseInternalLinks: vi.fn().mockResolvedValue([]),
-    updateIndexForItem: vi.fn(),
-    removeItemFromIndex: vi.fn(),
-  }
-})
-
 vi.mock('@/app/_server/actions/ws/broadcast', () => ({
   broadcast: vi.fn().mockResolvedValue(undefined),
 }))
@@ -298,10 +288,29 @@ describe('Security: Authentication Required', () => {
       expect(result).toEqual({ success: true })
     })
 
-    it('rebuildLinkIndex should reject unauthenticated requests', async () => {
-      const { rebuildLinkIndex } = await import('@/app/_server/actions/link')
+    it('reindexRelations should reject unauthenticated requests', async () => {
+      const { reindexRelations } = await import('@/app/_server/actions/relations')
+
+      await expect(reindexRelations('anyuser')).resolves.toEqual({
+        success: false,
+        error: 'Not authenticated',
+      })
+    })
+
+    it('getBrain should reject unauthenticated requests', async () => {
+      const { getBrain } = await import('@/app/_server/actions/relations')
+
+      await expect(getBrain('anyuser')).resolves.toEqual({
+        success: false,
+        error: 'Not authenticated',
+      })
+    })
+
+    it('getItemRelations should return nothing to unauthenticated requests', async () => {
+      const { getItemRelations } = await import('@/app/_server/actions/relations')
 
-      await expect(rebuildLinkIndex('anyuser')).rejects.toThrow('Not authenticated')
+      const result = await getItemRelations('3f2a1b4c-1111-4222-8333-944455556666')
+      expect(result.backlinks).toEqual([])
     })
   })
 
diff --git a/tests/server-actions/category.test.ts b/tests/server-actions/category.test.ts
index 7b1107dbd..7c4539c36 100644
--- a/tests/server-actions/category.test.ts
+++ b/tests/server-actions/category.test.ts
@@ -21,6 +21,7 @@ const mockCatAccess = vi.fn()
 vi.mock('@/app/_server/actions/file', () => ({
   ensureDir: (...args: any[]) => mockEnsureDir(...args),
   serverDeleteDir: (...args: any[]) => mockServerDeleteDir(...args),
+  serverRenamePath: (from: string, to: string) => mockFs.rename(from, to),
   getUserModeDir: (...args: any[]) => mockGetUserModeDir(...args),
   readOrderFile: (...args: any[]) => mockReadOrderFile(...args),
   writeOrderFile: (...args: any[]) => mockWriteOrderFile(...args),
diff --git a/tests/server-actions/checklist.test.ts b/tests/server-actions/checklist.test.ts
index 574581c03..8d3ed1a4f 100644
--- a/tests/server-actions/checklist.test.ts
+++ b/tests/server-actions/checklist.test.ts
@@ -16,9 +16,6 @@ const mockReadOrderFile = vi.fn();
 const mockGetCurrentUser = vi.fn();
 const mockCheckUserPermission = vi.fn();
 const mockLogContentEvent = vi.fn();
-const mockParseInternalLinks = vi.fn();
-const mockUpdateIndexForItem = vi.fn();
-const mockRemoveItemFromIndex = vi.fn();
 
 vi.mock("@/app/_server/actions/file", () => ({
   getUserModeDir: (...args: any[]) => mockGetUserModeDir(...args),
@@ -49,15 +46,6 @@ vi.mock("@/app/_server/actions/log", () => ({
   logContentEvent: (...args: any[]) => mockLogContentEvent(...args),
 }));
 
-vi.mock("@/app/_server/actions/link", () => ({
-  parseInternalLinks: (...args: any[]) => mockParseInternalLinks(...args),
-  updateIndexForItem: (...args: any[]) => mockUpdateIndexForItem(...args),
-  removeItemFromIndex: (...args: any[]) => mockRemoveItemFromIndex(...args),
-  rebuildLinkIndex: vi.fn().mockResolvedValue(undefined),
-  rebuildLinkIndexInternal: vi.fn().mockResolvedValue(undefined),
-  updateItemCategory: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/app/_utils/checklist-utils", () => ({
   parseMarkdown: vi.fn().mockReturnValue({
     id: "test-list",
@@ -109,9 +97,6 @@ describe("Checklist Actions", () => {
     });
     mockCheckUserPermission.mockResolvedValue(true);
     mockLogContentEvent.mockResolvedValue(undefined);
-    mockParseInternalLinks.mockResolvedValue([]);
-    mockUpdateIndexForItem.mockResolvedValue(undefined);
-    mockRemoveItemFromIndex.mockResolvedValue(undefined);
   });
 
   describe("createList", () => {
@@ -177,18 +162,6 @@ describe("Checklist Actions", () => {
       );
     });
 
-    it("should update link index after creation", async () => {
-      const formData = createFormData({
-        title: "Linked List",
-        category: "TestCategory",
-        type: "simple",
-      });
-
-      await createList(formData);
-
-      expect(mockUpdateIndexForItem).toHaveBeenCalled();
-    });
-
     it("should handle creation errors gracefully", async () => {
       mockServerWriteFile.mockRejectedValue(new Error("Write failed"));
 
diff --git a/tests/server-actions/file.test.ts b/tests/server-actions/file.test.ts
index ccfdb83dc..2a70f89c9 100644
--- a/tests/server-actions/file.test.ts
+++ b/tests/server-actions/file.test.ts
@@ -223,13 +223,27 @@ describe("File Actions", () => {
       mockFs.mkdir.mockResolvedValue(undefined);
       mockFs.writeFile.mockResolvedValue(undefined);
 
+      mockFs.rename.mockResolvedValue(undefined);
+
       await serverWriteFile("/path/to/file.txt", "content");
 
-      expect(mockFs.writeFile).toHaveBeenCalledWith(
-        "/path/to/file.txt",
-        "content",
-        "utf-8",
-      );
+      const [tmpPath, written, encoding] = mockFs.writeFile.mock.calls[0];
+      expect(tmpPath).toMatch(/^\/path\/to\/\.file\.txt\..+\.tmp$/);
+      expect(written).toBe("content");
+      expect(encoding).toBe("utf-8");
+      expect(mockFs.rename).toHaveBeenCalledWith(tmpPath, "/path/to/file.txt");
+    });
+
+    it("should clean up the temp file and rethrow when the rename fails", async () => {
+      mockFs.access.mockResolvedValue(undefined);
+      mockFs.writeFile.mockResolvedValue(undefined);
+      mockFs.rename.mockRejectedValue(new Error("EXDEV"));
+      mockFs.unlink.mockResolvedValue(undefined);
+
+      await expect(serverWriteFile("/path/to/file.txt", "content")).rejects.toThrow("EXDEV");
+
+      const [tmpPath] = mockFs.writeFile.mock.calls[0];
+      expect(mockFs.unlink).toHaveBeenCalledWith(tmpPath);
     });
   });
 
diff --git a/tests/server-actions/link-index.test.ts b/tests/server-actions/link-index.test.ts
deleted file mode 100644
index f29e88d2c..000000000
--- a/tests/server-actions/link-index.test.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from "vitest";
-import { resetAllMocks } from "../setup";
-
-const mockGetCurrentUser = vi.fn();
-const mockGetUserNotes = vi.fn();
-const mockGetUserChecklists = vi.fn();
-const mockGetUserModeDir = vi.fn();
-const mockServerReadFile = vi.fn();
-const mockServerWriteFile = vi.fn();
-
-vi.mock("@/app/_server/actions/users", () => ({
-  getCurrentUser: (...args: any[]) => mockGetCurrentUser(...args),
-}));
-
-vi.mock("@/app/_server/actions/note", () => ({
-  getUserNotes: (...args: any[]) => mockGetUserNotes(...args),
-}));
-
-vi.mock("@/app/_server/actions/checklist", () => ({
-  getUserChecklists: (...args: any[]) => mockGetUserChecklists(...args),
-}));
-
-vi.mock("@/app/_server/actions/file", () => ({
-  getUserModeDir: (...args: any[]) => mockGetUserModeDir(...args),
-  serverReadFile: (...args: any[]) => mockServerReadFile(...args),
-  serverWriteFile: (...args: any[]) => mockServerWriteFile(...args),
-}));
-
-import {
-  rebuildLinkIndex,
-  rebuildLinkIndexInternal,
-} from "@/app/_server/actions/link";
-
-describe("link/index — auth-aware rebuild paths", () => {
-  beforeEach(() => {
-    resetAllMocks();
-    mockGetUserModeDir.mockResolvedValue("/fake/notes");
-    mockServerWriteFile.mockResolvedValue(undefined);
-    mockGetUserNotes.mockResolvedValue({ success: true, data: [] });
-    mockGetUserChecklists.mockResolvedValue({ success: true, data: [] });
-  });
-
-  describe("rebuildLinkIndex (public)", () => {
-    it("throws when not authenticated", async () => {
-      mockGetCurrentUser.mockResolvedValue(null);
-
-      await expect(rebuildLinkIndex("alice")).rejects.toThrow(
-        "Not authenticated",
-      );
-      expect(mockGetUserNotes).not.toHaveBeenCalled();
-    });
-
-    it("throws when the caller is neither the owner nor an admin", async () => {
-      mockGetCurrentUser.mockResolvedValue({
-        username: "bob",
-        isAdmin: false,
-      });
-
-      await expect(rebuildLinkIndex("alice")).rejects.toThrow(
-        "Unauthorized: can only rebuild your own link index",
-      );
-      expect(mockGetUserNotes).not.toHaveBeenCalled();
-    });
-
-    it("proceeds for the owner", async () => {
-      mockGetCurrentUser.mockResolvedValue({
-        username: "alice",
-        isAdmin: false,
-      });
-
-      await expect(rebuildLinkIndex("alice")).resolves.toBeUndefined();
-      expect(mockGetUserNotes).toHaveBeenCalledWith({ username: "alice" });
-    });
-
-    it("proceeds for an admin rebuilding another user's index", async () => {
-      mockGetCurrentUser.mockResolvedValue({
-        username: "admin",
-        isAdmin: true,
-      });
-
-      await expect(rebuildLinkIndex("alice")).resolves.toBeUndefined();
-      expect(mockGetUserNotes).toHaveBeenCalledWith({ username: "alice" });
-    });
-  });
-
-  describe("rebuildLinkIndexInternal", () => {
-    it("skips the auth check entirely and rebuilds for the given owner", async () => {
-      mockGetCurrentUser.mockResolvedValue(null);
-
-      await expect(
-        rebuildLinkIndexInternal("someone-else"),
-      ).resolves.toBeUndefined();
-
-      expect(mockGetCurrentUser).not.toHaveBeenCalled();
-      expect(mockGetUserNotes).toHaveBeenCalledWith({
-        username: "someone-else",
-      });
-      expect(mockGetUserChecklists).toHaveBeenCalledWith({
-        username: "someone-else",
-      });
-      expect(mockServerWriteFile).toHaveBeenCalledTimes(1);
-    });
-  });
-});
\ No newline at end of file
diff --git a/tests/server-actions/note-readers.test.ts b/tests/server-actions/note-readers.test.ts
index e75c9a980..e85c936bd 100644
--- a/tests/server-actions/note-readers.test.ts
+++ b/tests/server-actions/note-readers.test.ts
@@ -10,6 +10,7 @@ const mockGrepExcerpt = vi.fn();
 vi.mock("@/app/_server/actions/file", () => ({
   serverReadDir: (...args: any[]) => mockServerReadDir(...args),
   serverReadFile: (...args: any[]) => mockServerReadFile(...args),
+  serverWriteFile: (...args: any[]) => mockFs.writeFile(...args),
   readOrderFile: (...args: any[]) => mockReadOrderFile(...args),
 }));
 
@@ -53,6 +54,11 @@ describe("readNotesRecursively uuid contract", () => {
       mtime: new Date("2024-01-02T00:00:00.000Z"),
     });
     mockFs.writeFile.mockResolvedValue(undefined);
+    mockFs.readFile.mockImplementation(async (filePath: string) => {
+      const content = await mockServerReadFile(filePath);
+      if (content == null) throw new Error("ENOENT");
+      return content;
+    });
   });
 
   it("should stamp and return a uuid when the note has none", async () => {
diff --git a/tests/server-actions/note.test.ts b/tests/server-actions/note.test.ts
index 765e2d516..4afcbe3c8 100644
--- a/tests/server-actions/note.test.ts
+++ b/tests/server-actions/note.test.ts
@@ -12,9 +12,7 @@ const mockGetCurrentUser = vi.fn();
 const mockGetUsername = vi.fn();
 const mockCanReach = vi.fn();
 const mockLogContentEvent = vi.fn();
-const mockParseInternalLinks = vi.fn();
-const mockUpdateIndexForItem = vi.fn();
-const mockRemoveItemFromIndex = vi.fn();
+const mockTidyItemLinks = vi.fn();
 const mockCommitNote = vi.fn();
 const mockGetSettings = vi.fn();
 const mockExtractHashtagsFromContent = vi.fn();
@@ -72,12 +70,9 @@ vi.mock("@/app/_server/actions/log", () => ({
   logContentEvent: (...args: any[]) => mockLogContentEvent(...args),
 }));
 
-vi.mock("@/app/_server/actions/link", () => ({
-  parseInternalLinks: (...args: any[]) => mockParseInternalLinks(...args),
-  updateIndexForItem: (...args: any[]) => mockUpdateIndexForItem(...args),
-  removeItemFromIndex: (...args: any[]) => mockRemoveItemFromIndex(...args),
-  rebuildLinkIndex: vi.fn().mockResolvedValue(undefined),
-  rebuildLinkIndexInternal: vi.fn().mockResolvedValue(undefined),
+vi.mock("@/app/_server/actions/relations/tidy", () => ({
+  tidyItemLinks: (...args: any[]) => mockTidyItemLinks(...args),
+  refreshWikilinks: (markdown: string) => markdown,
 }));
 
 vi.mock("@/app/_server/actions/history", () => ({
@@ -197,9 +192,7 @@ describe("Note Actions", () => {
       },
     );
     mockLogContentEvent.mockResolvedValue(undefined);
-    mockParseInternalLinks.mockResolvedValue([]);
-    mockUpdateIndexForItem.mockResolvedValue(undefined);
-    mockRemoveItemFromIndex.mockResolvedValue(undefined);
+    mockTidyItemLinks.mockImplementation(async (content: string) => content);
     mockCommitNote.mockResolvedValue(undefined);
     mockGetSettings.mockResolvedValue({});
     mockExtractHashtagsFromContent.mockReturnValue([]);
@@ -268,16 +261,22 @@ describe("Note Actions", () => {
       );
     });
 
-    it("should update link index after creation", async () => {
+    it("should canonicalise internal links before saving", async () => {
       const formData = createFormData({
         title: "Linked Note",
         category: "TestCategory",
-        rawContent: "Content with [[link]]",
+      rawContent: "See [Old](/jotty/3f2a1b4c-1111-4222-8333-944455556666)",
       });
 
+      mockTidyItemLinks.mockResolvedValueOnce("tidied body");
+
       await createNote(formData);
 
-      expect(mockUpdateIndexForItem).toHaveBeenCalled();
+      expect(mockTidyItemLinks).toHaveBeenCalledWith(expect.any(String), "testuser");
+      expect(mockServerWriteFile).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.stringContaining("tidied body"),
+      );
     });
 
     it("should commit note to history", async () => {
diff --git a/tests/server-actions/relations.test.ts b/tests/server-actions/relations.test.ts
new file mode 100644
index 000000000..f012cea60
--- /dev/null
+++ b/tests/server-actions/relations.test.ts
@@ -0,0 +1,459 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import nodeFs from "fs";
+import os from "os";
+import path from "path";
+import { mockFs, resetAllMocks } from "../setup";
+import { ItemTypes } from "@/app/_types/enums";
+import { LinkKinds, RelationsStatus } from "@/app/_consts/relations";
+
+vi.unmock("unified");
+vi.unmock("unist-util-visit");
+
+const mockBroadcast = vi.fn();
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: (...args: unknown[]) => mockBroadcast(...args),
+}));
+
+vi.mock("@/app/_server/actions/note", () => ({ getUserNotes: vi.fn() }));
+vi.mock("@/app/_server/actions/checklist", () => ({ getUserChecklists: vi.fn() }));
+
+import { readLinks } from "@/app/_server/actions/relations/parser";
+import {
+  forgetItemFile,
+  forgetItemTree,
+  indexItemFile,
+  reconcileRelations,
+} from "@/app/_server/actions/relations/indexer";
+import { backlinksFor, graphFor, VisibleItem } from "@/app/_server/actions/relations/queries";
+import {
+  closeRelationsDb,
+  relationsStatus,
+  setRelationsStatus,
+} from "@/app/_server/actions/relations/store";
+import { stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
+import { refreshWikilinks, wrapMention } from "@/app/_server/actions/relations/tidy";
+
+const A = "aaaaaaaa-1111-4222-8333-944455556666";
+const B = "bbbbbbbb-1111-4222-8333-944455556666";
+const C = "cccccccc-1111-4222-8333-944455556666";
+const SECRET = "dddddddd-1111-4222-8333-944455556666";
+
+let root: string;
+
+const itemPath = (mode: string, owner: string, rel: string) =>
+  path.join(root, "data", mode, owner, rel);
+
+const OLD = "createdAt: 2020-01-01T00:00:00.000Z\n";
+const NEW = "createdAt: 2026-01-01T00:00:00.000Z\n";
+
+const note = (uuid: string, title: string, body: string, extra = "") =>
+  `---\nuuid: ${uuid}\ntitle: ${title}\n${extra}---\n\n${body}`;
+
+const write = (filePath: string, content: string) => {
+  nodeFs.mkdirSync(path.dirname(filePath), { recursive: true });
+  nodeFs.writeFileSync(filePath, content);
+  indexItemFile(filePath, content, Math.floor(nodeFs.statSync(filePath).mtimeMs));
+};
+
+const visibleOf = (items: Array<Partial<VisibleItem> & { uuid: string; title: string }>) =>
+  new Map(
+    items.map((item) => [
+      item.uuid,
+      {
+        type: ItemTypes.NOTE,
+        category: "Uncategorized",
+        owner: "alice",
+        tags: [],
+        ...item,
+      } as VisibleItem,
+    ]),
+  );
+
+const useRealFs = async () => {
+  const real = await vi.importActual<typeof import("fs/promises")>("fs/promises");
+  mockFs.readFile.mockImplementation(real.readFile as never);
+  mockFs.writeFile.mockImplementation(real.writeFile as never);
+  mockFs.stat.mockImplementation(real.stat as never);
+  mockFs.rename.mockImplementation(real.rename as never);
+  mockFs.unlink.mockImplementation(real.unlink as never);
+  mockFs.mkdir.mockImplementation(real.mkdir as never);
+  mockFs.access.mockImplementation(real.access as never);
+};
+
+describe("relations", () => {
+  beforeEach(async () => {
+    resetAllMocks();
+    await useRealFs();
+    root = nodeFs.mkdtempSync(path.join(os.tmpdir(), "jotty-relations-"));
+    vi.spyOn(process, "cwd").mockReturnValue(root);
+    process.env.JOTTY_RELATIONS_DB = path.join(root, "relations.db");
+    closeRelationsDb();
+    setRelationsStatus(RelationsStatus.READY);
+  });
+
+  afterEach(() => {
+    closeRelationsDb();
+    vi.restoreAllMocks();
+    nodeFs.rmSync(root, { recursive: true, force: true });
+  });
+
+  describe("readLinks", () => {
+    it("reads canonical, legacy and same-origin links and ignores code", () => {
+      const parsed = readLinks(
+        [
+          `[Shop [x]](/note/${A}) [Old](/jotty/${B})`,
+          `[Path](/checklist/Work/groceries) https://jotty.example/checklist/${C}`,
+          "```",
+          `[Code](/note/${SECRET}) [[Hidden]]`,
+          "```",
+          "`[[inline]]` [[Milk run|errand]] \\[\\[Escaped\\]\\]",
+          `[Elsewhere](https://other.example/note/${SECRET})`,
+        ].join("\n"),
+        ["https://jotty.example"],
+      );
+
+      expect(parsed.targets).toEqual([
+        { uuid: A, type: ItemTypes.NOTE },
+        { uuid: B, type: undefined },
+        { type: ItemTypes.CHECKLIST, legacy: { category: "Work", id: "groceries" } },
+        { uuid: C, type: ItemTypes.CHECKLIST },
+      ]);
+      expect(parsed.wikis).toEqual(["Milk run", "Escaped"]);
+    });
+  });
+
+  describe("backlinks", () => {
+    it("keeps an item's own backlinks when that item is saved again", () => {
+      write(itemPath("notes", "alice", "a.md"), note(A, "Alpha", `see [Beta](/note/${B})`));
+      write(itemPath("notes", "alice", "b.md"), note(B, "Beta", "first"));
+      write(itemPath("notes", "alice", "b.md"), note(B, "Beta", "edited"));
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Beta" }]);
+      expect(backlinksFor(B, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+    });
+
+    it("gives a checklist its backlinks from a note, even through a /jotty/ link", () => {
+      write(itemPath("notes", "alice", "a.md"), note(A, "Alpha", `[List](/jotty/${C})`));
+      write(itemPath("checklists", "alice", "list.md"), note(C, "List", "- [ ] milk"));
+
+      const visible = visibleOf([
+        { uuid: A, title: "Alpha" },
+        { uuid: C, title: "List", type: ItemTypes.CHECKLIST },
+      ]);
+      expect(backlinksFor(C, visible).backlinks).toMatchObject([
+        { uuid: A, kind: LinkKinds.MENTION },
+      ]);
+    });
+
+    it("indexes links inside kanban descriptions and sub-items", () => {
+      write(
+        itemPath("checklists", "alice", "board.md"),
+        note(C, "Board", `- [ ] task | status:todo | description:see [Alpha](/note/${A})`),
+      );
+
+      const visible = visibleOf([
+        { uuid: A, title: "Alpha" },
+        { uuid: C, title: "Board", type: ItemTypes.CHECKLIST },
+      ]);
+      expect(backlinksFor(A, visible).backlinks.map((item) => item.uuid)).toEqual([C]);
+    });
+
+    it("never reads links out of an encrypted note", () => {
+      write(
+        itemPath("notes", "alice", "secret.md"),
+        note(SECRET, "Secret", `[Alpha](/note/${A})`, "encrypted: true\n"),
+      );
+
+      const visible = visibleOf([
+        { uuid: A, title: "Alpha" },
+        { uuid: SECRET, title: "Secret" },
+      ]);
+      expect(backlinksFor(A, visible).backlinks).toEqual([]);
+    });
+
+    it("hides backlinks from items the viewer cannot see", () => {
+      write(itemPath("notes", "bob", "private.md"), note(SECRET, "Private", `[Alpha](/note/${A})`));
+      write(itemPath("notes", "alice", "a.md"), note(A, "Alpha", "hello"));
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }]);
+      expect(backlinksFor(A, visible).backlinks).toEqual([]);
+    });
+
+    it("survives a rename written before the old file is removed", () => {
+      write(itemPath("notes", "alice", "a.md"), note(A, "Alpha", `[Beta](/note/${B})`));
+      write(itemPath("notes", "alice", "Work/a-renamed.md"), note(A, "Alpha", `[Beta](/note/${B})`));
+      forgetItemFile(itemPath("notes", "alice", "a.md"));
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Beta" }]);
+      expect(backlinksFor(B, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+    });
+
+    it("drops everything under a deleted folder", () => {
+      write(itemPath("notes", "alice", "Work/a.md"), note(A, "Alpha", `[Beta](/note/${B})`));
+      forgetItemTree(itemPath("notes", "alice", "Work"));
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Beta" }]);
+      expect(backlinksFor(B, visible).backlinks).toEqual([]);
+    });
+
+    it("counts a [[wikilink]] as a backlink once the title exists", () => {
+      write(itemPath("notes", "alice", "a.md"), note(A, "Alpha", "going on a [[milk run]]"));
+      write(itemPath("notes", "alice", "b.md"), note(B, "Milk Run", "eggs"));
+
+      const visible = visibleOf([
+        { uuid: A, title: "Alpha" },
+        { uuid: B, title: "Milk Run" },
+      ]);
+      expect(backlinksFor(B, visible).backlinks).toMatchObject([
+        { uuid: A, kind: LinkKinds.WIKI },
+      ]);
+    });
+  });
+
+  describe("graphFor", () => {
+    it("draws ghosts for unresolved wikilinks and hubs for tags", () => {
+      write(itemPath("notes", "alice", "a.md"), note(A, "Alpha", `[[Someday]] [Beta](/note/${B})`));
+
+      const graph = graphFor(
+        "alice",
+        visibleOf([
+          { uuid: A, title: "Alpha", tags: ["home"] },
+          { uuid: B, title: "Beta", tags: ["home"] },
+        ]),
+      );
+
+      expect(graph.nodes.map((node) => node.id).sort()).toEqual(
+        [A, B, "ghost:someday", "tag:home"].sort(),
+      );
+      expect(graph.edges).toHaveLength(4);
+      expect(graph.nodes.find((node) => node.id === "ghost:someday")?.title).toBe("Someday");
+    });
+
+    it("leaves out links whose source the viewer cannot see", () => {
+      write(itemPath("notes", "bob", "private.md"), note(SECRET, "Private", `[Alpha](/note/${A})`));
+
+      const graph = graphFor("alice", visibleOf([{ uuid: A, title: "Alpha" }]));
+      expect(graph.edges).toEqual([]);
+      expect(graph.nodes.map((node) => node.id)).toEqual([A]);
+    });
+  });
+
+  describe("wikilink bindings", () => {
+    const aPath = () => itemPath("notes", "alice", "a.md");
+    const bPath = () => itemPath("notes", "alice", "b.md");
+    const all = () =>
+      visibleOf([
+        { uuid: A, title: "Alpha" },
+        { uuid: B, title: "Plan" },
+        { uuid: C, title: "Plan" },
+      ]);
+
+    it("keeps a wikilink on its target after the target is renamed", () => {
+      write(bPath(), note(B, "Plan", "target"));
+      write(aPath(), note(A, "Alpha", "see [[Plan]]"));
+      write(bPath(), note(B, "Q3 plan", "renamed"));
+      write(aPath(), note(A, "Alpha", "see [[Plan]] again"));
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Q3 plan" }]);
+      expect(backlinksFor(B, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+      expect(backlinksFor(A, visible).wikis).toEqual({ plan: B });
+    });
+
+    it("does not let a newer item with the same title steal the link", () => {
+      write(bPath(), note(B, "Plan", "old", OLD));
+      write(aPath(), note(A, "Alpha", "see [[Plan]]"));
+      write(itemPath("notes", "alice", "c.md"), note(C, "Plan", "new", NEW));
+
+      expect(backlinksFor(B, all()).backlinks.map((item) => item.uuid)).toEqual([A]);
+      expect(backlinksFor(C, all()).backlinks).toEqual([]);
+    });
+
+    it("picks the oldest item when a title is ambiguous from the start", () => {
+      write(itemPath("notes", "alice", "c.md"), note(C, "Plan", "new", NEW));
+      write(bPath(), note(B, "Plan", "old", OLD));
+      write(aPath(), note(A, "Alpha", "see [[Plan]]"));
+
+      expect(backlinksFor(A, all()).wikis).toEqual({ plan: B });
+    });
+
+    it("moves to the next match when the bound target is deleted", () => {
+      write(bPath(), note(B, "Plan", "old", OLD));
+      write(itemPath("notes", "alice", "c.md"), note(C, "Plan", "new", NEW));
+      write(aPath(), note(A, "Alpha", "see [[Plan]]"));
+
+      forgetItemFile(bPath());
+      expect(backlinksFor(A, all()).wikis).toEqual({ plan: C });
+    });
+
+    it("binds a ghost once a note with that title shows up", () => {
+      write(aPath(), note(A, "Alpha", "one day [[Plan]]"));
+      expect(graphFor("alice", all()).nodes.some((node) => node.id === "ghost:plan")).toBe(true);
+
+      write(bPath(), note(B, "Plan", "now it exists"));
+      expect(backlinksFor(B, all()).backlinks.map((item) => item.uuid)).toEqual([A]);
+      expect(graphFor("alice", all()).nodes.some((node) => node.id === "ghost:plan")).toBe(false);
+    });
+
+    it("retargets a link when its text is edited", () => {
+      write(bPath(), note(B, "Plan", "b"));
+      write(itemPath("notes", "alice", "c.md"), note(C, "Trip", "c"));
+      write(aPath(), note(A, "Alpha", "see [[Plan]]"));
+      write(aPath(), note(A, "Alpha", "see [[Trip]]"));
+
+      const visible = visibleOf([
+        { uuid: A, title: "Alpha" },
+        { uuid: B, title: "Plan" },
+        { uuid: C, title: "Trip" },
+      ]);
+      expect(backlinksFor(B, visible).backlinks).toEqual([]);
+      expect(backlinksFor(C, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+    });
+
+    it("keeps bindings through a full rebuild", async () => {
+      write(bPath(), note(B, "Plan", "b"));
+      write(aPath(), note(A, "Alpha", "see [[Plan]]"));
+      write(bPath(), note(B, "Renamed", "b"));
+
+      const { rebuildRelations } = await import("@/app/_server/actions/relations/indexer");
+      await rebuildRelations();
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Renamed" }]);
+      expect(backlinksFor(B, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+    });
+  });
+
+  describe("refreshWikilinks", () => {
+    it("rewrites renamed targets on save, keeping headings and aliases", () => {
+      write(bPath(), note(B, "Plan", "b"));
+      const body = "see [[Plan]], [[plan#Budget|the money]] and `[[Plan]]` in code";
+      write(aPath(), note(A, "Alpha", body));
+      write(bPath(), note(B, "Q3 plan", "b"));
+
+      const saved = refreshWikilinks(body, A);
+      expect(saved).toBe("see [[Q3 plan]], [[Q3 plan#Budget|the money]] and `[[Plan]]` in code");
+
+      write(aPath(), note(A, "Alpha", saved));
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Q3 plan" }]);
+      expect(backlinksFor(B, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+      expect(backlinksFor(A, visible).wikis).toEqual({ "q3 plan": B });
+    });
+
+    it("survives a stale save that still carries the old text", () => {
+      write(bPath(), note(B, "Plan", "b"));
+      write(aPath(), note(A, "Alpha", "see [[Plan]]"));
+      write(bPath(), note(B, "Q3 plan", "b"));
+      write(aPath(), note(A, "Alpha", refreshWikilinks("see [[Plan]]", A)));
+      write(aPath(), note(A, "Alpha", "see [[Plan]]"));
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Q3 plan" }]);
+      expect(backlinksFor(B, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+    });
+
+    it("leaves notes alone when nothing was renamed", () => {
+      write(bPath(), note(B, "Plan", "b"));
+      write(aPath(), note(A, "Alpha", "see [[plan]]"));
+      expect(refreshWikilinks("see [[plan]]", A)).toBe("see [[plan]]");
+    });
+
+    const aPath = () => itemPath("notes", "alice", "a.md");
+    const bPath = () => itemPath("notes", "alice", "b.md");
+  });
+
+  describe("unlinked mentions", () => {
+    it("lists notes that name the item in plain text but do not link it", () => {
+      write(itemPath("notes", "alice", "b.md"), note(B, "Milk Run", "target"));
+      write(itemPath("notes", "alice", "a.md"), note(A, "Alpha", "Tomorrow is the milk  run, again."));
+      write(itemPath("notes", "alice", "c.md"), note(C, "Gamma", `already linked [Milk Run](/note/${B})`));
+      write(itemPath("notes", "alice", "s.md"), note(SECRET, "Skimmed", "a milkrun is not it"));
+
+      const visible = visibleOf([
+        { uuid: A, title: "Alpha" },
+        { uuid: B, title: "Milk Run" },
+        { uuid: C, title: "Gamma" },
+        { uuid: SECRET, title: "Skimmed" },
+      ]);
+      const { mentions } = backlinksFor(B, visible);
+      expect(mentions.map((item) => item.uuid)).toEqual([A]);
+      expect(mentions[0].snippet).toContain("the milk run, again");
+    });
+
+    it("never reads encrypted notes", () => {
+      write(itemPath("notes", "alice", "b.md"), note(B, "Milk Run", "target"));
+      write(
+        itemPath("notes", "alice", "s.md"),
+        note(SECRET, "Secret", "milk run", "encrypted: true\n"),
+      );
+      const visible = visibleOf([
+        { uuid: B, title: "Milk Run" },
+        { uuid: SECRET, title: "Secret" },
+      ]);
+      expect(backlinksFor(B, visible).mentions).toEqual([]);
+    });
+
+    it("wraps the first plain mention, skipping code, links and wikilinks", () => {
+      const body = "`Milk Run` and [[Milk Run]] and [Milk Run](/x) then the milk run itself";
+      expect(wrapMention(body, "Milk Run", `/note/${B}`)).toBe(
+        `\`Milk Run\` and [[Milk Run]] and [Milk Run](/x) then the [milk run](/note/${B}) itself`,
+      );
+      expect(wrapMention("nothing here", "Milk Run", `/note/${B}`)).toBeNull();
+    });
+  });
+
+  describe("reconcileRelations", () => {
+    it("builds from scratch, then forgets files that disappeared", async () => {
+      const aPath = itemPath("notes", "alice", "a.md");
+      nodeFs.mkdirSync(path.dirname(aPath), { recursive: true });
+      nodeFs.writeFileSync(aPath, note(A, "Alpha", `[Beta](/note/${B})`));
+      nodeFs.writeFileSync(itemPath("notes", "alice", "b.md"), note(B, "Beta", "hi"));
+
+      setRelationsStatus(RelationsStatus.BUILDING);
+      await reconcileRelations();
+      expect(relationsStatus()).toBe(RelationsStatus.READY);
+      expect(mockBroadcast).toHaveBeenCalledWith(expect.objectContaining({ type: "relations" }));
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Beta" }]);
+      expect(backlinksFor(B, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+
+      nodeFs.rmSync(aPath);
+      await reconcileRelations();
+      expect(backlinksFor(B, visible).backlinks).toEqual([]);
+    });
+  });
+
+  describe("stampUuid", () => {
+    it("refuses to stamp an empty read instead of writing a stub", async () => {
+      const filePath = itemPath("notes", "alice", "empty.md");
+      nodeFs.mkdirSync(path.dirname(filePath), { recursive: true });
+      nodeFs.writeFileSync(filePath, "");
+
+      await expect(stampUuid(filePath)).resolves.toBeUndefined();
+      expect(nodeFs.readFileSync(filePath, "utf-8")).toBe("");
+    });
+
+    it("refuses to stamp frontmatter it could not parse", async () => {
+      const filePath = itemPath("notes", "alice", "broken.md");
+      const broken = "---\ntitle: [unclosed\nfoo: bar\n---\n\nprecious body";
+      nodeFs.mkdirSync(path.dirname(filePath), { recursive: true });
+      nodeFs.writeFileSync(filePath, broken);
+
+      await expect(stampUuid(filePath)).resolves.toBeUndefined();
+      expect(nodeFs.readFileSync(filePath, "utf-8")).toBe(broken);
+    });
+
+    it("stamps a uuid without touching the rest of the file", async () => {
+      const filePath = itemPath("notes", "alice", "plain.md");
+      nodeFs.mkdirSync(path.dirname(filePath), { recursive: true });
+      nodeFs.writeFileSync(filePath, "---\ntitle: Plain\n---\n\nbody stays");
+
+      const uuid = await stampUuid(filePath);
+      const written = nodeFs.readFileSync(filePath, "utf-8");
+
+      expect(uuid).toMatch(/^[0-9a-f-]{36}$/);
+      expect(written).toContain(`uuid: ${uuid}\n`);
+      expect(written).toContain("title: Plain\n");
+      expect(written).toContain("createdAt:");
+      expect(written.endsWith("body stays")).toBe(true);
+    });
+  });
+});
diff --git a/tests/server-actions/share-visibility.test.ts b/tests/server-actions/share-visibility.test.ts
new file mode 100644
index 000000000..dcccf3156
--- /dev/null
+++ b/tests/server-actions/share-visibility.test.ts
@@ -0,0 +1,235 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from "vitest";
+import path from "path";
+import { mkdirSync, rmSync, writeFileSync } from "fs";
+
+const { home, root } = vi.hoisted(() => {
+  const os = process.getBuiltinModule("os");
+  const fs = process.getBuiltinModule("fs");
+  const nodePath = process.getBuiltinModule("path");
+  const previous = process.cwd();
+
+  process.chdir(fs.mkdtempSync(nodePath.join(os.tmpdir(), "jotty-share-visibility-")));
+
+  return { home: previous, root: process.cwd() };
+});
+
+vi.unmock("fs/promises");
+vi.unmock("@/app/_utils/checklist-utils");
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: vi.fn(),
+}));
+
+vi.mock("@/app/_server/actions/users", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/app/_server/actions/users")>()),
+  canAccessAllContent: async () => false,
+}));
+
+import { getCategories } from "@/app/_server/actions/category/queries";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
+import { dropMounts, mountsFor } from "@/app/_server/actions/share/mounts";
+import { canReach } from "@/app/_server/actions/share/queries";
+import {
+  ItemTypes,
+  Modes,
+  PermissionTypes,
+} from "@/app/_types/enums";
+import { DATA_DIR } from "@/app/_consts/files";
+import { CATEGORY_INFO_FILE } from "@/app/_consts/sharing";
+
+const READ_ONLY = { canRead: true, canEdit: false, canDelete: false };
+const FULL = { canRead: true, canEdit: true, canDelete: true };
+
+const LIST_FULL = "11111111-1111-4111-8111-111111111111";
+const LIST_READ = "22222222-2222-4222-8222-222222222222";
+const NOTE_FULL = "33333333-3333-4333-8333-333333333333";
+const NOTE_READ = "44444444-4444-4444-8444-444444444444";
+const NOTE_LISTED = "55555555-5555-4555-8555-555555555555";
+
+const modeDir = (mode: Modes, owner: string, category = ""): string =>
+  path.join(root, DATA_DIR, mode, owner, category);
+
+const writeItem = (
+  mode: Modes,
+  owner: string,
+  category: string,
+  name: string,
+  frontmatter: string[],
+  body = "- [ ] milk",
+) => {
+  const dir = modeDir(mode, owner, category);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    path.join(dir, `${name}.md`),
+    ["---", ...frontmatter, "---", body, ""].join("\n"),
+  );
+};
+
+const writeFolder = (
+  mode: Modes,
+  owner: string,
+  category: string,
+  info: Record<string, unknown>,
+) => {
+  const dir = modeDir(mode, owner, category);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(path.join(dir, CATEGORY_INFO_FILE), JSON.stringify(info));
+};
+
+const permsOf = (items: { uuid?: string; permissions?: unknown }[]) =>
+  Object.fromEntries(items.map((item) => [item.uuid, item.permissions]));
+
+afterAll(() => {
+  process.chdir(home);
+  rmSync(root, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  rmSync(path.join(root, DATA_DIR), { recursive: true, force: true });
+  dropMounts(Modes.NOTES);
+  dropMounts(Modes.CHECKLISTS);
+});
+
+describe("Share visibility on disk", () => {
+  it("shows a folder share to a recipient with no content of their own (#582)", async () => {
+    writeItem(Modes.CHECKLISTS, "alice", "Groceries", "weekly", [
+      `uuid: ${LIST_FULL}`,
+      "title: Weekly",
+    ]);
+    writeFolder(Modes.CHECKLISTS, "alice", "Groceries", {
+      uuid: "groceries-uuid",
+      sharing: { users: { bob: READ_ONLY }, inherit: true },
+    });
+
+    const categories = await getCategories(Modes.CHECKLISTS, "bob");
+    const lists = await getUserChecklists({
+      username: "bob",
+      metadataOnly: true,
+      preserveOrder: true,
+    });
+
+    expect(categories.data).toEqual([
+      expect.objectContaining({
+        name: "Groceries",
+        sharedFrom: "alice",
+        permissions: READ_ONLY,
+      }),
+    ]);
+    expect(lists.data?.map((list) => list.uuid)).toEqual([LIST_FULL]);
+  });
+
+  it("gives each loose share its own permissions instead of the first one found (#604)", async () => {
+    writeItem(Modes.CHECKLISTS, "alice", "Misc", "full-access", [
+      `uuid: ${LIST_FULL}`,
+      "title: Full Access",
+      "sharedWith: bob:rwd",
+    ]);
+    writeItem(Modes.CHECKLISTS, "alice", "Misc", "read-only", [
+      `uuid: ${LIST_READ}`,
+      "title: Read Only",
+      "sharedWith: bob:r",
+    ]);
+
+    const lists = await getUserChecklists({
+      username: "bob",
+      metadataOnly: true,
+      preserveOrder: true,
+    });
+    const categories = await getCategories(Modes.CHECKLISTS, "bob");
+
+    expect(permsOf(lists.data || [])).toEqual({
+      [LIST_FULL]: FULL,
+      [LIST_READ]: READ_ONLY,
+    });
+    expect(categories.data?.[0]).toEqual(
+      expect.objectContaining({ isLoose: true, permissions: READ_ONLY }),
+    );
+  });
+
+  it("lets an item grant narrow a folder grant in the sidebar data (#604)", async () => {
+    writeFolder(Modes.NOTES, "alice", "Test", {
+      uuid: "test-uuid",
+      sharing: { users: { bob: FULL }, inherit: true },
+    });
+    writeItem(
+      Modes.NOTES,
+      "alice",
+      "Test",
+      "full-access",
+      [`uuid: ${NOTE_FULL}`, "title: Full Access"],
+      "hello",
+    );
+    writeItem(
+      Modes.NOTES,
+      "alice",
+      "Test",
+      "read-only",
+      [`uuid: ${NOTE_READ}`, "title: Read Only", "sharedWith: bob:r"],
+      "hello",
+    );
+    writeItem(
+      Modes.NOTES,
+      "alice",
+      "Test",
+      "yaml-list",
+      [`uuid: ${NOTE_LISTED}`, "title: Listed", "sharedWith:", "  - bob:rw"],
+      "hello",
+    );
+
+    const notes = await getUserNotes({
+      username: "bob",
+      metadataOnly: true,
+      preserveOrder: true,
+    });
+
+    expect(permsOf(notes.data || [])).toEqual({
+      [NOTE_FULL]: FULL,
+      [NOTE_READ]: READ_ONLY,
+      [NOTE_LISTED]: { canRead: true, canEdit: true, canDelete: false },
+    });
+    expect(
+      await canReach(NOTE_READ, ItemTypes.NOTE, "bob", PermissionTypes.DELETE),
+    ).toBe(false);
+  });
+
+  it("hides an item from a folder share once the item opts out (#604)", async () => {
+    writeFolder(Modes.NOTES, "alice", "Test", {
+      uuid: "test-uuid",
+      sharing: { users: { bob: FULL }, inherit: true },
+    });
+    writeItem(
+      Modes.NOTES,
+      "alice",
+      "Test",
+      "private",
+      [`uuid: ${NOTE_FULL}`, "title: Private", "sharedWith: none"],
+      "hello",
+    );
+
+    const notes = await getUserNotes({
+      username: "bob",
+      metadataOnly: true,
+      preserveOrder: true,
+    });
+
+    expect(notes.data).toEqual([]);
+  });
+
+  it("does not mistake another user's folder for the viewer's own when names share a prefix", async () => {
+    writeFolder(Modes.CHECKLISTS, "bobby", "Garage", {
+      uuid: "garage-uuid",
+      sharing: { users: { bob: READ_ONLY }, inherit: true },
+    });
+    writeItem(Modes.CHECKLISTS, "bobby", "Garage", "tools", [
+      `uuid: ${LIST_READ}`,
+      "title: Tools",
+    ]);
+
+    const mounts = await mountsFor(Modes.CHECKLISTS, "bob");
+
+    expect(mounts).toEqual([
+      expect.objectContaining({ owner: "bobby", categoryUuid: "garage-uuid" }),
+    ]);
+  });
+});
diff --git a/tests/server-actions/tags.test.ts b/tests/server-actions/tags.test.ts
index e86049c34..e7c325e80 100644
--- a/tests/server-actions/tags.test.ts
+++ b/tests/server-actions/tags.test.ts
@@ -6,6 +6,12 @@ const mockExtractYamlMetadata = vi.fn();
 const mockUpdateYamlMetadata = vi.fn();
 const mockExtractHashtagsFromContent = vi.fn();
 
+vi.mock("@/app/_server/actions/file", async (importOriginal) => ({
+  ...((await importOriginal()) as object),
+  serverWriteFile: (filePath: string, content: string) =>
+    mockFs.writeFile(filePath, content, "utf-8"),
+}));
+
 vi.mock("@/app/_server/actions/export", () => ({
   exportWholeDataFolder: (...args: any[]) => mockExportWholeDataFolder(...args),
 }));
diff --git a/tests/server-actions/user-deletion.test.ts b/tests/server-actions/user-deletion.test.ts
new file mode 100644
index 000000000..3aa9b49d5
--- /dev/null
+++ b/tests/server-actions/user-deletion.test.ts
@@ -0,0 +1,265 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from "vitest";
+import path from "path";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "fs";
+
+const { home, root } = vi.hoisted(() => {
+  const os = process.getBuiltinModule("os");
+  const fs = process.getBuiltinModule("fs");
+  const nodePath = process.getBuiltinModule("path");
+  const previous = process.cwd();
+
+  process.chdir(fs.mkdtempSync(nodePath.join(os.tmpdir(), "jotty-user-deletion-")));
+
+  return { home: previous, root: process.cwd() };
+});
+
+vi.unmock("fs/promises");
+
+const mockBroadcast = vi.fn();
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: (...args: unknown[]) => mockBroadcast(...args),
+}));
+
+vi.mock("@/app/_server/actions/relations/tracking", () => ({
+  trackItemWrite: vi.fn(),
+  trackItemDelete: vi.fn(),
+  trackTreeDelete: vi.fn(),
+  trackMove: vi.fn(),
+}));
+
+vi.mock("@/app/_server/actions/users", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/app/_server/actions/users")>()),
+  canAccessAllContent: async () => false,
+}));
+
+import { _deleteUserCore } from "@/app/_server/actions/users/crud";
+import { revokeGrants } from "@/app/_server/actions/share/rename";
+import { dropMounts, mountsFor } from "@/app/_server/actions/share/mounts";
+import { canReach } from "@/app/_server/actions/share/queries";
+import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import { DATA_DIR, USERS_FILE } from "@/app/_consts/files";
+import { CATEGORY_INFO_FILE } from "@/app/_consts/sharing";
+import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+
+const READ_ONLY = { canRead: true, canEdit: false, canDelete: false };
+const WRITABLE = { canRead: true, canEdit: true, canDelete: false };
+
+const PLAN = "11111111-1111-4111-8111-111111111111";
+const SOLO = "22222222-2222-4222-8222-222222222222";
+const BOB_NOTE = "33333333-3333-4333-8333-333333333333";
+
+const dirOf = (mode: Modes, owner: string, category = ""): string =>
+  path.join(root, DATA_DIR, mode, owner, category);
+
+const fileOf = (mode: Modes, owner: string, category: string, name: string) =>
+  path.join(dirOf(mode, owner, category), `${name}.md`);
+
+const writeItem = (
+  mode: Modes,
+  owner: string,
+  category: string,
+  name: string,
+  frontmatter: string[],
+  body: string,
+) => {
+  mkdirSync(dirOf(mode, owner, category), { recursive: true });
+  writeFileSync(
+    fileOf(mode, owner, category, name),
+    ["---", ...frontmatter, "---", body, ""].join("\n"),
+  );
+};
+
+const writeFolder = (
+  mode: Modes,
+  owner: string,
+  category: string,
+  info: Record<string, unknown>,
+) => {
+  mkdirSync(dirOf(mode, owner, category), { recursive: true });
+  writeFileSync(
+    path.join(dirOf(mode, owner, category), CATEGORY_INFO_FILE),
+    JSON.stringify(info),
+  );
+};
+
+const folderInfo = (mode: Modes, owner: string, category: string) =>
+  JSON.parse(
+    readFileSync(
+      path.join(dirOf(mode, owner, category), CATEGORY_INFO_FILE),
+      "utf-8",
+    ),
+  );
+
+const frontmatterOf = (filePath: string) =>
+  extractYamlMetadata(readFileSync(filePath, "utf-8"));
+
+const seedUsers = (users: Record<string, unknown>[]) => {
+  mkdirSync(path.dirname(path.join(root, USERS_FILE)), { recursive: true });
+  writeFileSync(path.join(root, USERS_FILE), JSON.stringify(users));
+};
+
+const seedShares = () => {
+  writeItem(
+    Modes.NOTES,
+    "alice",
+    "Work",
+    "plan",
+    [`uuid: ${PLAN}`, "title: Plan", "sharedWith: bob:rw, carol:r"],
+    "The plan body stays exactly as it was.",
+  );
+  writeItem(
+    Modes.NOTES,
+    "alice",
+    "Work",
+    "solo",
+    [`uuid: ${SOLO}`, "title: Solo", "sharedWith: bob:rwd"],
+    "Only bob had this one.",
+  );
+  writeFolder(Modes.CHECKLISTS, "alice", "Groceries", {
+    uuid: "groceries-uuid",
+    sharing: { users: { bob: WRITABLE, carol: READ_ONLY }, inherit: true },
+    order: { items: ["keep-me"] },
+  });
+  writeItem(
+    Modes.NOTES,
+    "bob",
+    "Mine",
+    "bobs",
+    [`uuid: ${BOB_NOTE}`, "title: Bobs", "sharedWith: carol:rw"],
+    "Bob's own note.",
+  );
+  writeFolder(Modes.NOTES, "bob", "Mine", {
+    uuid: "bob-folder-uuid",
+    sharing: { users: { carol: WRITABLE }, inherit: true },
+  });
+};
+
+afterAll(() => {
+  process.chdir(home);
+  rmSync(root, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  mockBroadcast.mockReset();
+  rmSync(path.join(root, DATA_DIR), { recursive: true, force: true });
+  dropMounts(Modes.NOTES);
+  dropMounts(Modes.CHECKLISTS);
+});
+
+describe("revokeGrants", () => {
+  it("drops only the revoked user from item and folder grants", async () => {
+    seedShares();
+
+    const touched = await revokeGrants("bob");
+
+    const plan = frontmatterOf(fileOf(Modes.NOTES, "alice", "Work", "plan"));
+    expect(plan.metadata.sharedWith).toBe("carol:r");
+    expect(plan.metadata.uuid).toBe(PLAN);
+    expect(plan.contentWithoutMetadata).toBe(
+      "The plan body stays exactly as it was.",
+    );
+
+    const groceries = folderInfo(Modes.CHECKLISTS, "alice", "Groceries");
+    expect(groceries.sharing.users).toEqual({ carol: READ_ONLY });
+    expect(groceries.sharing.inherit).toBe(true);
+    expect(groceries.uuid).toBe("groceries-uuid");
+    expect(groceries.order).toEqual({ items: ["keep-me"] });
+
+    expect(touched).toBe(3);
+    expect(mockBroadcast).toHaveBeenCalledWith(
+      expect.objectContaining({ type: "sharing", username: "bob" }),
+    );
+  });
+
+  it("keeps an item private instead of falling back to the folder grant", async () => {
+    seedShares();
+    writeFolder(Modes.NOTES, "alice", "Work", {
+      uuid: "work-uuid",
+      sharing: { users: { carol: WRITABLE }, inherit: true },
+    });
+
+    await revokeGrants("bob");
+
+    const solo = frontmatterOf(fileOf(Modes.NOTES, "alice", "Work", "solo"));
+    expect(solo.metadata.sharedWith).toBe("none");
+    expect(
+      await canReach(SOLO, ItemTypes.NOTE, "carol", PermissionTypes.READ),
+    ).toBe(false);
+  });
+
+  it("leaves files that never mentioned the user alone", async () => {
+    seedShares();
+    const before = readFileSync(
+      fileOf(Modes.NOTES, "bob", "Mine", "bobs"),
+      "utf-8",
+    );
+
+    await revokeGrants("dave");
+
+    expect(
+      readFileSync(fileOf(Modes.NOTES, "bob", "Mine", "bobs"), "utf-8"),
+    ).toBe(before);
+    expect(
+      folderInfo(Modes.CHECKLISTS, "alice", "Groceries").sharing.users,
+    ).toEqual({ bob: WRITABLE, carol: READ_ONLY });
+  });
+});
+
+describe("_deleteUserCore", () => {
+  it("removes the deleted user from every share and every mount (#600)", async () => {
+    seedShares();
+    seedUsers([
+      { username: "alice", passwordHash: "x", isAdmin: true, isSuperAdmin: true },
+      { username: "bob", passwordHash: "x", isAdmin: false },
+      { username: "carol", passwordHash: "x", isAdmin: false },
+    ]);
+
+    expect(await mountsFor(Modes.NOTES, "carol")).toHaveLength(2);
+
+    const result = await _deleteUserCore("bob");
+
+    expect(result.success).toBe(true);
+    expect(existsSync(dirOf(Modes.NOTES, "bob"))).toBe(false);
+
+    const users = JSON.parse(readFileSync(path.join(root, USERS_FILE), "utf-8"));
+    expect(users.map((user: { username: string }) => user.username)).toEqual([
+      "alice",
+      "carol",
+    ]);
+
+    expect(
+      frontmatterOf(fileOf(Modes.NOTES, "alice", "Work", "plan")).metadata
+        .sharedWith,
+    ).toBe("carol:r");
+    expect(
+      folderInfo(Modes.CHECKLISTS, "alice", "Groceries").sharing.users,
+    ).toEqual({ carol: READ_ONLY });
+
+    const carolNotes = await mountsFor(Modes.NOTES, "carol");
+    expect(carolNotes.map((mount) => mount.owner)).toEqual(["alice"]);
+    expect(await mountsFor(Modes.CHECKLISTS, "bob")).toEqual([]);
+  });
+
+  it("refuses to delete the super admin and leaves shares untouched", async () => {
+    seedShares();
+    seedUsers([
+      { username: "alice", passwordHash: "x", isAdmin: true, isSuperAdmin: true },
+      { username: "bob", passwordHash: "x", isAdmin: true },
+    ]);
+
+    const result = await _deleteUserCore("alice");
+
+    expect(result.success).toBe(false);
+    expect(
+      frontmatterOf(fileOf(Modes.NOTES, "alice", "Work", "plan")).metadata
+        .sharedWith,
+    ).toBe("bob:rw, carol:r");
+  });
+});
diff --git a/tests/server-actions/users.test.ts b/tests/server-actions/users.test.ts
index 64aed87e6..fda4a2548 100644
--- a/tests/server-actions/users.test.ts
+++ b/tests/server-actions/users.test.ts
@@ -7,6 +7,7 @@ const mockGetSessionId = vi.fn()
 const mockReadSessions = vi.fn()
 const mockLogUserEvent = vi.fn()
 const mockLogAudit = vi.fn()
+const mockRevokeGrants = vi.fn()
 
 vi.mock('@/app/_server/actions/file', () => ({
   readJsonFile: (...args: any[]) => mockReadJsonFile(...args),
@@ -19,6 +20,11 @@ vi.mock('@/app/_server/actions/session', () => ({
   removeAllSessionsForUser: vi.fn().mockResolvedValue(undefined),
 }))
 
+vi.mock('@/app/_server/actions/share/rename', () => ({
+  revokeGrants: (...args: any[]) => mockRevokeGrants(...args),
+  renameGrants: vi.fn(),
+}))
+
 vi.mock('@/app/_server/actions/log', () => ({
   logUserEvent: (...args: any[]) => mockLogUserEvent(...args),
   logAudit: (...args: any[]) => mockLogAudit(...args),
@@ -52,6 +58,7 @@ describe('Users Actions', () => {
     mockReadSessions.mockResolvedValue({ 'session-123': 'testuser' })
     mockLogUserEvent.mockResolvedValue(undefined)
     mockLogAudit.mockResolvedValue(undefined)
+    mockRevokeGrants.mockResolvedValue(0)
     mockFs.rm.mockResolvedValue(undefined)
   })
 
@@ -342,6 +349,7 @@ describe('Users Actions', () => {
 
       expect(result.success).toBe(true)
       expect(mockWriteJsonFile).toHaveBeenCalled()
+      expect(mockRevokeGrants).toHaveBeenCalledWith('testuser')
     })
   })
 
@@ -496,6 +504,24 @@ describe('Users Actions', () => {
 
       expect(result.success).toBe(false)
       expect(result.error).toBe('Cannot delete the super admin (system owner)')
+      expect(mockRevokeGrants).not.toHaveBeenCalled()
+    })
+
+    it('should revoke every share granted to the deleted user and drop their record', async () => {
+      mockReadJsonFile.mockResolvedValue([
+        { username: 'adminuser', passwordHash: 'hash', isAdmin: true },
+        { username: 'leaver', passwordHash: 'hash', isAdmin: false },
+      ])
+      mockReadSessions.mockResolvedValue({ 'session-123': 'adminuser' })
+
+      const result = await deleteUser(createFormData({ username: 'leaver' }))
+
+      expect(result.success).toBe(true)
+      expect(mockRevokeGrants).toHaveBeenCalledWith('leaver')
+      expect(mockLock).toHaveBeenCalled()
+
+      const [written] = mockWriteJsonFile.mock.calls.at(-1)!
+      expect(written.map((user: { username: string }) => user.username)).toEqual(['adminuser'])
     })
   })
 
diff --git a/tests/setup.ts b/tests/setup.ts
index dd6fa54be..5115dc608 100644
--- a/tests/setup.ts
+++ b/tests/setup.ts
@@ -7,6 +7,13 @@
  */
 
 import { vi, beforeAll, afterAll } from "vitest";
+import os from "os";
+import path from "path";
+
+process.env.JOTTY_RELATIONS_DB = path.join(
+  os.tmpdir(),
+  `jotty-relations-test-${process.pid}.db`,
+);
 
 const originalConsoleError = console.error;
 const originalConsoleWarn = console.warn;
diff --git a/tests/utils/connections-graph-data.test.ts b/tests/utils/connections-graph-data.test.ts
deleted file mode 100644
index b12a38c8d..000000000
--- a/tests/utils/connections-graph-data.test.ts
+++ /dev/null
@@ -1,279 +0,0 @@
-import { readFileSync } from "node:fs";
-import { describe, expect, it } from "vitest";
-import { ItemTypes } from "@/app/_types/enums";
-import { LinkIndex } from "@/app/_types";
-import {
-  buildConnectionGraphData,
-  filterArchivedLinkIndex,
-  filterConnectionGraphData,
-} from "@/app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/graph-data";
-
-const noteA = "11111111-1111-4111-8111-111111111111";
-const noteB = "22222222-2222-4222-8222-222222222222";
-const noteC = "33333333-3333-4333-8333-333333333333";
-const listA = "44444444-4444-4444-8444-444444444444";
-const listB = "55555555-5555-4555-8555-555555555555";
-
-const emptyLinks = () => ({
-  isLinkedTo: { notes: [], checklists: [] },
-  isReferencedIn: { notes: [], checklists: [] },
-});
-
-const baseIndex = (): LinkIndex => ({
-  notes: {},
-  checklists: {},
-});
-
-const notes = [
-  {
-    uuid: noteA,
-    id: "alpha",
-    title: "Alpha",
-    category: "Work",
-    createdAt: "2024-01-01T00:00:00.000Z",
-    updatedAt: "2024-01-02T00:00:00.000Z",
-    tags: ["project"],
-  },
-  {
-    uuid: noteB,
-    id: "beta",
-    title: "Beta",
-    category: "Work",
-    createdAt: "2024-01-03T00:00:00.000Z",
-    updatedAt: "2024-01-04T00:00:00.000Z",
-    tags: ["reference"],
-  },
-  {
-    uuid: noteC,
-    id: "orphan",
-    title: "Orphan",
-    category: "Personal",
-    createdAt: "2024-01-05T00:00:00.000Z",
-    updatedAt: "2024-01-06T00:00:00.000Z",
-  },
-];
-
-const checklists = [
-  {
-    uuid: listA,
-    id: "tasks",
-    title: "Tasks",
-    type: "simple" as const,
-    category: "Work",
-    items: [],
-    createdAt: "2024-01-07T00:00:00.000Z",
-    updatedAt: "2024-01-08T00:00:00.000Z",
-  },
-  {
-    uuid: listB,
-    id: "archive",
-    title: "Archive",
-    type: "task" as const,
-    category: "Old",
-    items: [],
-    createdAt: "2024-01-09T00:00:00.000Z",
-    updatedAt: "2024-01-10T00:00:00.000Z",
-  },
-];
-
-describe("connections graph data", () => {
-  it("builds note-to-note explicit links", () => {
-    const index = baseIndex();
-    index.notes[noteA] = {
-      ...emptyLinks(),
-      isLinkedTo: { notes: [noteB], checklists: [] },
-    };
-
-    const graph = buildConnectionGraphData(index, notes, checklists);
-
-    expect(graph.nodes.map((node) => node.id).sort()).toEqual([noteA, noteB]);
-    expect(graph.links).toEqual([{ source: noteA, target: noteB, directed: true, type: "explicit" }]);
-    expect(graph.nodes.find((node) => node.id === noteA)?.outboundCount).toBe(1);
-    expect(graph.nodes.find((node) => node.id === noteB)?.inboundCount).toBe(1);
-  });
-
-  it("builds note-to-checklist and checklist-to-note links", () => {
-    const index = baseIndex();
-    index.notes[noteA] = {
-      ...emptyLinks(),
-      isLinkedTo: { notes: [], checklists: [listA] },
-    };
-    index.checklists[listA] = {
-      ...emptyLinks(),
-      isLinkedTo: { notes: [noteB], checklists: [] },
-    };
-
-    const graph = buildConnectionGraphData(index, notes, checklists);
-
-    expect(graph.links).toHaveLength(2);
-    expect(graph.links).toContainEqual({ source: noteA, target: listA, directed: true, type: "explicit" });
-    expect(graph.links).toContainEqual({ source: listA, target: noteB, directed: true, type: "explicit" });
-    expect(graph.nodes.find((node) => node.id === listA)?.type).toBe(ItemTypes.CHECKLIST);
-  });
-
-  it("connects items that share tags", () => {
-    const index = baseIndex();
-    const taggedNotes = [
-      { ...notes[0], tags: ["project", "shared"] },
-      { ...notes[1], tags: ["shared"] },
-      { ...notes[2], tags: ["other"] },
-    ];
-
-    const graph = buildConnectionGraphData(index, taggedNotes, checklists);
-
-    expect(graph.links).toContainEqual({
-      source: noteA,
-      target: noteB,
-      directed: false,
-      type: "tag",
-      tag: "shared",
-    });
-    expect(graph.links).not.toContainEqual(
-      expect.objectContaining({ source: noteA, target: noteC, type: "tag" }),
-    );
-    expect(graph.nodes.find((node) => node.id === noteA)?.connectionCount).toBe(1);
-    expect(graph.nodes.find((node) => node.id === noteB)?.connectionCount).toBe(1);
-  });
-
-  it("de-dupes duplicate bidirectional visible edges", () => {
-    const index = baseIndex();
-    index.notes[noteA] = {
-      ...emptyLinks(),
-      isLinkedTo: { notes: [noteB], checklists: [] },
-    };
-    index.notes[noteB] = {
-      ...emptyLinks(),
-      isLinkedTo: { notes: [noteA], checklists: [] },
-    };
-
-    const graph = buildConnectionGraphData(index, notes, checklists);
-
-    expect(graph.links).toHaveLength(1);
-    expect(graph.links[0]).toMatchObject({ source: noteA, target: noteB, type: "explicit" });
-    expect(graph.nodes.find((node) => node.id === noteA)?.connectionCount).toBe(2);
-    expect(graph.nodes.find((node) => node.id === noteB)?.connectionCount).toBe(2);
-  });
-
-  it("filters archived items by UUID first and legacy key fallback", () => {
-    const index = baseIndex();
-    index.notes[noteA] = {
-      ...emptyLinks(),
-      isLinkedTo: { notes: [noteB], checklists: ["Old/archive"] },
-    };
-    index.notes[noteB] = emptyLinks();
-    index.checklists["Old/archive"] = emptyLinks();
-
-    const filtered = filterArchivedLinkIndex(index, [
-      { uuid: noteB, id: "wrong", title: "Wrong", content: "", createdAt: "", updatedAt: "" },
-      { id: "archive", title: "Archive", type: "task", category: "Old", items: [], createdAt: "", updatedAt: "" },
-    ]);
-
-    expect(filtered.notes[noteB]).toBeUndefined();
-    expect(filtered.checklists["Old/archive"]).toBeUndefined();
-    expect(filtered.notes[noteA].isLinkedTo.notes).toEqual([]);
-    expect(filtered.notes[noteA].isLinkedTo.checklists).toEqual([]);
-  });
-
-  it("filters missing targets", () => {
-    const index = baseIndex();
-    index.notes[noteA] = {
-      ...emptyLinks(),
-      isLinkedTo: {
-        notes: ["66666666-6666-4666-8666-666666666666"],
-        checklists: [],
-      },
-    };
-
-    const graph = buildConnectionGraphData(index, notes, checklists);
-
-    expect(graph.nodes).toEqual([]);
-    expect(graph.links).toEqual([]);
-  });
-
-  it("includes or excludes orphan nodes", () => {
-    const index = baseIndex();
-
-    expect(buildConnectionGraphData(index, notes, checklists).nodes).toEqual([]);
-
-    const graph = buildConnectionGraphData(index, notes, checklists, true);
-
-    expect(graph.nodes.map((node) => node.id)).toContain(noteC);
-    expect(graph.nodes.find((node) => node.id === noteC)?.orphan).toBe(true);
-  });
-
-  it("filters visible graph data by search and type", () => {
-    const index = baseIndex();
-    index.notes[noteA] = {
-      ...emptyLinks(),
-      isLinkedTo: { notes: [], checklists: [listA] },
-    };
-
-    const graph = buildConnectionGraphData(index, notes, checklists, true);
-    const filtered = filterConnectionGraphData(graph, {
-      search: "tasks",
-      showNotes: true,
-      showChecklists: true,
-      showOrphans: false,
-      showTagLinks: true,
-    });
-
-    expect(filtered.nodes.map((node) => node.id)).toEqual([listA]);
-    expect(filtered.links).toEqual([]);
-  });
-
-  it("can hide tag links from the visible graph", () => {
-    const index = baseIndex();
-    const taggedNotes = [
-      { ...notes[0], tags: ["shared"] },
-      { ...notes[1], tags: ["shared"] },
-    ];
-    const graph = buildConnectionGraphData(index, taggedNotes, checklists);
-    const filtered = filterConnectionGraphData(graph, {
-      search: "",
-      showNotes: true,
-      showChecklists: true,
-      showOrphans: false,
-      showTagLinks: false,
-    });
-
-    expect(graph.links.some((link) => link.type === "tag")).toBe(true);
-    expect(filtered.links).toEqual([]);
-    expect(filtered.nodes).toEqual([]);
-  });
-
-  it("puts the graph before the controls on mobile while keeping desktop controls first", () => {
-    const source = readFileSync(
-      "app/_components/FeatureComponents/Profile/Parts/LinksTab.tsx",
-      "utf8",
-    );
-
-    expect(source).toContain("order-2 lg:order-1");
-    expect(source).toContain("order-1 lg:order-2");
-    expect(source.indexOf("order-2 lg:order-1")).toBeLessThan(
-      source.indexOf("order-1 lg:order-2"),
-    );
-  });
-
-  it("uses existing profile translation keys for graph labels", () => {
-    const source = readFileSync(
-      "app/_components/FeatureComponents/Profile/Parts/LinksTab.tsx",
-      "utf8",
-    );
-
-    expect(source).not.toContain('t("common.unknown")');
-    expect(source).toContain('t("profile.unknown")');
-  });
-
-  it("paints a larger node pointer area for mobile tapping", () => {
-    const source = readFileSync(
-      "app/_components/FeatureComponents/Profile/Parts/ConnectionsGraph/ConnectionsGraph.tsx",
-      "utf8",
-    );
-
-    expect(source).toContain("MIN_POINTER_RADIUS");
-    expect(source).toContain("nodePointerAreaPaint");
-    expect(source).toContain("globalScale");
-    expect(source).toContain("MIN_POINTER_RADIUS / globalScale");
-    expect(source).toContain("enableNodeDrag={!isCoarsePointer}");
-  });
-});
diff --git a/tsconfig.json b/tsconfig.json
index 9283d88b8..c53d3deda 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -4,7 +4,7 @@
     "lib": [
       "dom",
       "dom.iterable",
-      "es6",
+      "es2022",
       "webworker"
     ],
     "allowJs": true,
diff --git a/yarn.lock b/yarn.lock
index 4fe493c82..35011cdec 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2,6 +2,17 @@
 # yarn lockfile v1
 
 
+"3d-force-graph@^1.79":
+  version "1.80.0"
+  resolved "https://registry.yarnpkg.com/3d-force-graph/-/3d-force-graph-1.80.0.tgz#295d84b44b8df7f416c2f2b838b5c441989a0d13"
+  integrity sha512-tzI353gW1nXPpnC7VTa3JjMg+3cp77qOLUFO0vucPTfF+q5R6sQsNsIqVTbRIb7RSypn14nBa4yfkOe9ThxASw==
+  dependencies:
+    accessor-fn "1"
+    kapsule "^1.16"
+    three ">=0.179 <1"
+    three-forcegraph "1"
+    three-render-objects "^1.41"
+
 "@babel/code-frame@^7.29.7":
   version "7.29.7"
   resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.29.7.tgz#f2fbbfea87c44a21590ec515b778b2c26d8866e7"
@@ -140,6 +151,11 @@
   resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.29.2.tgz#9a6e2d05f4b6692e1801cd4fb176ad823930ed5e"
   integrity sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==
 
+"@babel/runtime@^7.17.8":
+  version "7.29.7"
+  resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.29.7.tgz#12022450c45a4da6d8d8287b18a4ff2ddb23f768"
+  integrity sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==
+
 "@babel/template@^7.29.7":
   version "7.29.7"
   resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.29.7.tgz#4d9d4004f645cdd304de958c725162784ecac700"
@@ -238,6 +254,11 @@
   resolved "https://registry.yarnpkg.com/@date-fns/tz/-/tz-1.4.1.tgz#2d905f282304630e07bef6d02d2e7dbf3f0cc4e4"
   integrity sha512-P5LUNhtbj6YfI3iJjw5EL9eUAG6OitD0W3fWQcpQjDRc/QIsL0tRNuO1PcDvPccWL1fSTXXdE1ds+l95DV/OFA==
 
+"@dimforge/rapier3d-compat@~0.12.0":
+  version "0.12.0"
+  resolved "https://registry.yarnpkg.com/@dimforge/rapier3d-compat/-/rapier3d-compat-0.12.0.tgz#7b3365e1dfdc5cd957b45afe920b4ac06c7cd389"
+  integrity sha512-uekIGetywIgopfD97oDL5PfeezkFpNhwlzlaEYNOA0N6ghdsOvh/HYjSMek5Q2O1PYvRSDFcqFVJl4r4ZBwOow==
+
 "@dnd-kit/accessibility@^3.1.1":
   version "3.1.1"
   resolved "https://registry.yarnpkg.com/@dnd-kit/accessibility/-/accessibility-3.1.1.tgz#3b4202bd6bb370a0730f6734867785919beac6af"
@@ -927,134 +948,58 @@
     "@emnapi/runtime" "^1.4.3"
     "@tybys/wasm-util" "^0.10.0"
 
-"@next/env@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/env/-/env-16.3.0.tgz#9a109a0e1367044e082edf0ca265231768314dc7"
-  integrity sha512-o9r1S0BNiNreHP9Vs+Qnqd9kviDkJh8xIACY7UFZSmiGbbQRzPBBosvHzAU4TULHOIuOj/18RSsyz2qrREmIFw==
+"@next/env@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/env/-/env-16.3.6.tgz#47d93ed498a55f7db8bb309eeab0b5964b7964d6"
+  integrity sha512-x9Vblze1EbtltQYnNH38xCPWU3TVfBd1eXqA3+w9+BTpedkkdNpAaltXlGQ/nsc1+E0mVTNrtcbX3GoO09zeLQ==
 
-"@next/eslint-plugin-next@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/eslint-plugin-next/-/eslint-plugin-next-16.3.0.tgz#6131082c29ca68ea52ade8d361530445bdc9423e"
-  integrity sha512-OqgJ8PN0d04KcPhDX/PTY5tJUJZxlbrt7O7FBsm4XE0XW2JDrKnDXsc9uo9WUimJGPoo2j+JRGhyXApC//mvbw==
+"@next/eslint-plugin-next@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/eslint-plugin-next/-/eslint-plugin-next-16.3.6.tgz#285f6d86748a6480261a54810da679aeb32531cc"
+  integrity sha512-jowwDX+7DOlDIjJLgTMxudw+k37QnWu1JkZLkSi9MaJBfDYcfhAPMKBhXL0idYzFN/AGg//axnOR4cLkHX/Rng==
   dependencies:
     "@eslint-community/eslint-utils" "4.9.1"
     fast-glob "3.3.1"
 
-"@next/swc-darwin-arm64@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.0.tgz#d4f492a29837745e945e306d49d4c1c9181353df"
-  integrity sha512-55hpqq18bEVAlxedlTt3tFqZmKg2nUXT1kn1G/BGEy0R13h3LwtwHPVzzjG6P4LLeOHE32PFDQUVaJEWvBEZBw==
-
-"@next/swc-darwin-x64@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.0.tgz#98534e7cff6b8b5f7bc941fdee72926b00cd68ee"
-  integrity sha512-SOi96kSaF5T+0wW4koiM1bWzSPwjzTesC1p3df+FjdOi5LIQkBK/blxh7HdoKnNuI4PURF1OO7TZqtfnbWDSgw==
-
-"@next/swc-linux-arm64-gnu@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.0.tgz#aa84de7859471415fcfd36e03d01667137e6d9a6"
-  integrity sha512-P0gZAoPMF4dyTRzhmkV4PrqVzSOB6t4mC1oI3c4dqijJ+OVEVx5clIXAKR4/uQpsqw2KKM/0D5tVumcR2r5blg==
-
-"@next/swc-linux-arm64-musl@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.0.tgz#3c7211003c6ac82d06ae6944388132c8811425c7"
-  integrity sha512-tXXGKJw0m37O0eKJARVTX/TheKPhz0QFVtVVZXmOig+9YKLQOSP6hvf2pxv5DO7CLEJyTHx3Pg043CDQkv1G4Q==
-
-"@next/swc-linux-x64-gnu@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.0.tgz#e4412d917512729b1faf5c5e31f0ad53a38e2c6a"
-  integrity sha512-pjGxK5EY7yWml78ALejFkWmgHsU7wbFQrISiugpH6FbUJhgEvw3xFZ/EBAtLl7QtL0WdQKiG9eWJ3mOKGTukHw==
-
-"@next/swc-linux-x64-musl@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.0.tgz#e91531118ad14df129cbf00df7c4ca4a29152e7b"
-  integrity sha512-sjo++Xx+lomlPs3HRsHWhVDyGG6ms1kGW5EtHLERdII8AyG1i+f6aq68xHREO6AEMlhjTNEWBSmfJfqm9orf7g==
-
-"@next/swc-win32-arm64-msvc@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.0.tgz#b9b1307c21886e8ab99c3064c1417b279132ad49"
-  integrity sha512-C5JSgiO54wURdaxdEUIXqkz04uMqC9UmPX1gtDrV/5Tf1UowdWYI8uA5hfFbPolTlp0q4KZ60xlHePNibf0VIw==
-
-"@next/swc-win32-x64-msvc@16.3.0":
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.0.tgz#2045249907f2b9da5cabb7da69b75556c82f4671"
-  integrity sha512-fDOggsweNb5SSw0ZKVk6U+gxSyGFFlIBY/LBc1r8GUj4u/6t6oArL+Pmkg0MBnsgR+KkdsURilVH4F3GXUGepA==
-
-"@nivo/annotations@0.99.0":
-  version "0.99.0"
-  resolved "https://registry.yarnpkg.com/@nivo/annotations/-/annotations-0.99.0.tgz#ac6417022d9281b5b40b134d352c5039302aa5f6"
-  integrity sha512-jCuuXPbvpaqaz4xF7k5dv0OT2ubn5Nt0gWryuTe/8oVsC/9bzSuK8bM9vBty60m9tfO+X8vUYliuaCDwGksC2g==
-  dependencies:
-    "@nivo/colors" "0.99.0"
-    "@nivo/core" "0.99.0"
-    "@nivo/theming" "0.99.0"
-    "@react-spring/web" "9.4.5 || ^9.7.2 || ^10.0"
-    lodash "^4.17.21"
-
-"@nivo/colors@0.99.0":
-  version "0.99.0"
-  resolved "https://registry.yarnpkg.com/@nivo/colors/-/colors-0.99.0.tgz#f844a0f0de0597b35829405541e145f6db50c830"
-  integrity sha512-hyYt4lEFIfXOUmQ6k3HXm3KwhcgoJpocmoGzLUqzk7DzuhQYJo+4d5jIGGU0N/a70+9XbHIdpKNSblHAIASD3w==
-  dependencies:
-    "@nivo/core" "0.99.0"
-    "@nivo/theming" "0.99.0"
-    "@types/d3-color" "^3.0.0"
-    "@types/d3-scale" "^4.0.8"
-    "@types/d3-scale-chromatic" "^3.0.0"
-    d3-color "^3.1.0"
-    d3-scale "^4.0.2"
-    d3-scale-chromatic "^3.0.0"
-    lodash "^4.17.21"
-
-"@nivo/core@0.99.0":
-  version "0.99.0"
-  resolved "https://registry.yarnpkg.com/@nivo/core/-/core-0.99.0.tgz#91ccf3d2419fcfb5f740dba468f0d6f059933af4"
-  integrity sha512-olCItqhPG3xHL5ei+vg52aB6o+6S+xR2idpkd9RormTTUniZb8U2rOdcQojOojPY5i9kVeQyLFBpV4YfM7OZ9g==
-  dependencies:
-    "@nivo/theming" "0.99.0"
-    "@nivo/tooltip" "0.99.0"
-    "@react-spring/web" "9.4.5 || ^9.7.2 || ^10.0"
-    "@types/d3-shape" "^3.1.6"
-    d3-color "^3.1.0"
-    d3-format "^1.4.4"
-    d3-interpolate "^3.0.1"
-    d3-scale "^4.0.2"
-    d3-scale-chromatic "^3.0.0"
-    d3-shape "^3.2.0"
-    d3-time-format "^3.0.0"
-    lodash "^4.17.21"
-    react-virtualized-auto-sizer "^1.0.26"
-    use-debounce "^10.0.4"
-
-"@nivo/network@0.99.0":
-  version "0.99.0"
-  resolved "https://registry.yarnpkg.com/@nivo/network/-/network-0.99.0.tgz#502f6df6a95de173bbc9566b5304aaec8fd4c1d6"
-  integrity sha512-s+xSFpbv7Z6fNQQdq07v8NXOt15a9M2qgpocyCzm7gWHEsTkFBjNu5l5X5xA2eL9PuQ4vQbrAf64XNYA/rzKbw==
-  dependencies:
-    "@nivo/annotations" "0.99.0"
-    "@nivo/colors" "0.99.0"
-    "@nivo/core" "0.99.0"
-    "@nivo/theming" "0.99.0"
-    "@nivo/tooltip" "0.99.0"
-    "@react-spring/web" "9.4.5 || ^9.7.2 || ^10.0"
-    "@types/d3-force" "^2.1.0"
-    d3-force "^2.0.1"
-
-"@nivo/theming@0.99.0":
-  version "0.99.0"
-  resolved "https://registry.yarnpkg.com/@nivo/theming/-/theming-0.99.0.tgz#89de03832081153093dcfc2eb2fdaaf3424da963"
-  integrity sha512-KvXlf0nqBzh/g2hAIV9bzscYvpq1uuO3TnFN3RDXGI72CrbbZFTGzprPju3sy/myVsauv+Bb+V4f5TZ0jkYKRg==
-  dependencies:
-    lodash "^4.17.21"
-
-"@nivo/tooltip@0.99.0":
-  version "0.99.0"
-  resolved "https://registry.yarnpkg.com/@nivo/tooltip/-/tooltip-0.99.0.tgz#63a1bc3b428cb2a07a7f763ad8547e39dd4bcf13"
-  integrity sha512-weoEGR3xAetV4k2P6k96cdamGzKQ5F2Pq+uyDaHr1P3HYArM879Pl+x+TkU0aWjP6wgUZPx/GOBiV1Hb1JxIqg==
-  dependencies:
-    "@nivo/core" "0.99.0"
-    "@nivo/theming" "0.99.0"
-    "@react-spring/web" "9.4.5 || ^9.7.2 || ^10.0"
+"@next/swc-darwin-arm64@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.6.tgz#e92a4bfae82e0e0d2056a31806af16b7cd9b38bc"
+  integrity sha512-E/7GEqaUkt8mk/T8v9lAnrhzR06kdq1ZBkC12F8tAMkdIadwNp3H1KqHynDHrpcTlGCUdq/qu6vUL2aYVyYBdw==
+
+"@next/swc-darwin-x64@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.6.tgz#0feec7995215c85bd18df527983836897757ff80"
+  integrity sha512-yBE893/nDWTlaiBD1p+qgt7NUen4U5R6FXyH0s67Npq1S3E0cVSef1WIXC2xBRgQvwAvJq6DnS6Y6PrY0cy4Ew==
+
+"@next/swc-linux-arm64-gnu@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.6.tgz#f4a27ea38008e47ef670bacd4b4e92d0789209c2"
+  integrity sha512-KJDpjBqBPYlvkivmyrp+Qys6k/7ksbqGQvRVc6ZEGfR+cjQxx+nUkJaWmNZJsmoOrqYNbaXByF8wa0lBwDhB3Q==
+
+"@next/swc-linux-arm64-musl@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.6.tgz#1b2dbad64636efdb49e574d8234526129e3b2a34"
+  integrity sha512-mqNg2K+hvWskSRb/QM+Ix412DvBsuSF0XV+frTSw5vmoucNnIlynFwKYew8D01bfATErMOM7Bujrf0BA5DRKFA==
+
+"@next/swc-linux-x64-gnu@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.6.tgz#783f3fdf6e9f2bdf9d3f58e12cbed938c862c617"
+  integrity sha512-nFncBNGAYouRHjRVaITs9beZRfhX4ssVwpnvPIAbkZVH6LtGoAVlH4bJ8Cnf9SOo9bsXgPFer/GdHtEE3JNOkw==
+
+"@next/swc-linux-x64-musl@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.6.tgz#c19df8320300d80bb5dc1b503796ec4e7d2f15f8"
+  integrity sha512-5Mf3cHDGR/Iz0ng2Bj3zUR3p5QS9YK3Hn2QiAfavFmyF48zwThAjpFoiTKNIcOHLYS4zEk+gzyJ/9deQ2ZB8yQ==
+
+"@next/swc-win32-arm64-msvc@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.6.tgz#1e4e70b213f1d49223f5eb8aa0490b9fc615e807"
+  integrity sha512-0jkJy0C2kbrJWTk4YLa3xk80pVBpx8FCHJym7CnUfDAXe/FWv5qT7SQJbR0KuemyxaEDlEx5WT4VQJoTW+/9Qw==
+
+"@next/swc-win32-x64-msvc@16.3.6":
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.6.tgz#d7b84132a78b38792223b810e3fa0b20c980d895"
+  integrity sha512-/YXjI1e5OXcZ7YpxRwgP/1jAV/SBKTzeVKqN2mk7mLpcICsyn3Gl5+dIfDTJp70M0ccMhyMMRso4v6mPDCGepg==
 
 "@nodelib/fs.scandir@2.1.5":
   version "2.1.5"
@@ -1482,51 +1427,6 @@
   dependencies:
     "@tiptap/extension-image" "^2.0.3"
 
-"@react-spring/animated@~10.0.3":
-  version "10.0.3"
-  resolved "https://registry.yarnpkg.com/@react-spring/animated/-/animated-10.0.3.tgz#b42f7041a51d38f395e9ba5fb53ca68c34cd324f"
-  integrity sha512-7MrxADV3vaUADn2V9iYhaIL6iOWRx9nCJjYrsk2AHD2kwPr6fg7Pt0v+deX5RnCDmCKNnD6W5fasiyM8D+wzJQ==
-  dependencies:
-    "@react-spring/shared" "~10.0.3"
-    "@react-spring/types" "~10.0.3"
-
-"@react-spring/core@~10.0.3":
-  version "10.0.3"
-  resolved "https://registry.yarnpkg.com/@react-spring/core/-/core-10.0.3.tgz#3b4f3991f5902ce46770c2c1ef05c8e53c3a0f73"
-  integrity sha512-D4DwNO68oohDf/0HG2G0Uragzb9IA1oXblxrd6MZAcBcUQG2EHUWXewjdECMPLNmQvlYVyyBRH6gPxXM5DX7DQ==
-  dependencies:
-    "@react-spring/animated" "~10.0.3"
-    "@react-spring/shared" "~10.0.3"
-    "@react-spring/types" "~10.0.3"
-
-"@react-spring/rafz@~10.0.3":
-  version "10.0.3"
-  resolved "https://registry.yarnpkg.com/@react-spring/rafz/-/rafz-10.0.3.tgz#9b328c3992b23d6317452998670636d6b783f2c4"
-  integrity sha512-Ri2/xqt8OnQ2iFKkxKMSF4Nqv0LSWnxXT4jXFzBDsHgeeH/cHxTLupAWUwmV9hAGgmEhBmh5aONtj3J6R/18wg==
-
-"@react-spring/shared@~10.0.3":
-  version "10.0.3"
-  resolved "https://registry.yarnpkg.com/@react-spring/shared/-/shared-10.0.3.tgz#654d03c74d3277bae1a565aff981979536be6002"
-  integrity sha512-geCal66nrkaQzUVhPkGomylo+Jpd5VPK8tPMEDevQEfNSWAQP15swHm+MCRG4wVQrQlTi9lOzKzpRoTL3CA84Q==
-  dependencies:
-    "@react-spring/rafz" "~10.0.3"
-    "@react-spring/types" "~10.0.3"
-
-"@react-spring/types@~10.0.3":
-  version "10.0.3"
-  resolved "https://registry.yarnpkg.com/@react-spring/types/-/types-10.0.3.tgz#0c2d7a7e783a6f652bcd24cac80ed569bc2ad8d9"
-  integrity sha512-H5Ixkd2OuSIgHtxuHLTt7aJYfhMXKXT/rK32HPD/kSrOB6q6ooeiWAXkBy7L8F3ZxdkBb9ini9zP9UwnEFzWgQ==
-
-"@react-spring/web@9.4.5 || ^9.7.2 || ^10.0":
-  version "10.0.3"
-  resolved "https://registry.yarnpkg.com/@react-spring/web/-/web-10.0.3.tgz#ae3a9ea2362b1d70d2ec36a1e2747c6cee2540a9"
-  integrity sha512-ndU+kWY81rHsT7gTFtCJ6mrVhaJ6grFmgTnENipzmKqot4HGf5smPNK+cZZJqoGeDsj9ZsiWPW4geT/NyD484A==
-  dependencies:
-    "@react-spring/animated" "~10.0.3"
-    "@react-spring/core" "~10.0.3"
-    "@react-spring/shared" "~10.0.3"
-    "@react-spring/types" "~10.0.3"
-
 "@reduxjs/toolkit@1.x.x || 2.x.x":
   version "2.11.2"
   resolved "https://registry.yarnpkg.com/@reduxjs/toolkit/-/toolkit-2.11.2.tgz#582225acea567329ca6848583e7dd72580d38e82"
@@ -1891,10 +1791,10 @@
   resolved "https://registry.yarnpkg.com/@swc/counter/-/counter-0.1.3.tgz#cc7463bd02949611c6329596fccd2b0ec782b0e9"
   integrity sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==
 
-"@swc/helpers@0.5.15":
-  version "0.5.15"
-  resolved "https://registry.yarnpkg.com/@swc/helpers/-/helpers-0.5.15.tgz#79efab344c5819ecf83a43f3f9f811fc84b516d7"
-  integrity sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==
+"@swc/helpers@0.5.23":
+  version "0.5.23"
+  resolved "https://registry.yarnpkg.com/@swc/helpers/-/helpers-0.5.23.tgz#19287d0d86d962b111376039a50c792902c9a86a"
+  integrity sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==
   dependencies:
     tslib "^2.8.0"
 
@@ -2170,6 +2070,11 @@
   resolved "https://registry.yarnpkg.com/@tweenjs/tween.js/-/tween.js-25.0.0.tgz#7266baebcc3affe62a3a54318a3ea82d904cd0b9"
   integrity sha512-XKLA6syeBUaPzx4j3qwMqzzq+V4uo72BnlbOjmuljLrRqdsd3qnzvZZoxvMHZ23ndsRS4aufU6JOZYpCbU6T1A==
 
+"@tweenjs/tween.js@~23.1.3":
+  version "23.1.3"
+  resolved "https://registry.yarnpkg.com/@tweenjs/tween.js/-/tween.js-23.1.3.tgz#eff0245735c04a928bb19c026b58c2a56460539d"
+  integrity sha512-vJmvvwFxYuGnF2axRtPYocag6Clbb5YS7kLL+SO/TeVFzHqDIWrNKYtcsPMibjDx9O+bu+psAy9NKfWklassUA==
+
 "@tybys/wasm-util@^0.10.0":
   version "0.10.1"
   resolved "https://registry.yarnpkg.com/@tybys/wasm-util/-/wasm-util-0.10.1.tgz#ecddd3205cf1e2d5274649ff0eedd2991ed7f414"
@@ -2197,7 +2102,7 @@
   resolved "https://registry.yarnpkg.com/@types/d3-array/-/d3-array-3.2.2.tgz#e02151464d02d4a1b44646d0fcdb93faf88fde8c"
   integrity sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==
 
-"@types/d3-color@*", "@types/d3-color@^3.0.0":
+"@types/d3-color@*":
   version "3.1.3"
   resolved "https://registry.yarnpkg.com/@types/d3-color/-/d3-color-3.1.3.tgz#368c961a18de721da8200e80bf3943fb53136af2"
   integrity sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==
@@ -2207,11 +2112,6 @@
   resolved "https://registry.yarnpkg.com/@types/d3-ease/-/d3-ease-3.0.2.tgz#e28db1bfbfa617076f7770dd1d9a48eaa3b6c51b"
   integrity sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==
 
-"@types/d3-force@^2.1.0":
-  version "2.1.7"
-  resolved "https://registry.yarnpkg.com/@types/d3-force/-/d3-force-2.1.7.tgz#5ae22a54ea0eb0819081557429faeb72ab5eaf88"
-  integrity sha512-x5pvWw0HUBrcpMaMOd70ICEL27gOeC9hyhilTc+OP+4tErgEg3w+fZWA475eTrG7gi8BB0TNdfGRprpy09Vo9A==
-
 "@types/d3-interpolate@^3.0.1":
   version "3.0.4"
   resolved "https://registry.yarnpkg.com/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz#412b90e84870285f2ff8a846c6eb60344f12a41c"
@@ -2229,14 +2129,14 @@
   resolved "https://registry.yarnpkg.com/@types/d3-scale-chromatic/-/d3-scale-chromatic-3.1.0.tgz#dc6d4f9a98376f18ea50bad6c39537f1b5463c39"
   integrity sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ==
 
-"@types/d3-scale@^4.0.2", "@types/d3-scale@^4.0.3", "@types/d3-scale@^4.0.8":
+"@types/d3-scale@^4.0.2", "@types/d3-scale@^4.0.3":
   version "4.0.9"
   resolved "https://registry.yarnpkg.com/@types/d3-scale/-/d3-scale-4.0.9.tgz#57a2f707242e6fe1de81ad7bfcccaaf606179afb"
   integrity sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==
   dependencies:
     "@types/d3-time" "*"
 
-"@types/d3-shape@^3.1.0", "@types/d3-shape@^3.1.6":
+"@types/d3-shape@^3.1.0":
   version "3.1.8"
   resolved "https://registry.yarnpkg.com/@types/d3-shape/-/d3-shape-3.1.8.tgz#d1516cc508753be06852cd06758e3bb54a22b0e3"
   integrity sha512-lae0iWfcDeR7qt7rA88BNiqdvPS5pFVPpo5OfjElwNaT2yyekbM0C9vK+yqBqEmHr6lDkRnYNoTBYlAgJa7a4w==
@@ -2367,12 +2267,12 @@
   dependencies:
     undici-types "~7.19.0"
 
-"@types/node@20":
-  version "20.19.39"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-20.19.39.tgz#e98a3b575574070cd34b784bd173767269f95e99"
-  integrity sha512-orrrD74MBUyK8jOAD/r0+lfa1I2MO6I+vAkmAWzMYbCcgrN4lCrmK52gRFQq/JRxfYPfonkr4b0jcY7Olqdqbw==
+"@types/node@24":
+  version "24.19.0"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-24.19.0.tgz#becd0549e091f749520b8db8a446ec1559c88a0b"
+  integrity sha512-zY+5tKxXdhGh1PYI0ac+7juvEu4OI6vWtVVoj5i2m42jxAY1U+zHGt6QCyOFwykdP62sM3MJ9stoYYUw5aCWew==
   dependencies:
-    undici-types "~6.21.0"
+    undici-types ">=7.24.0 <7.24.7"
 
 "@types/prismjs@1.26.5":
   version "1.26.5"
@@ -2436,6 +2336,23 @@
   dependencies:
     "@types/node" "*"
 
+"@types/stats.js@*":
+  version "0.17.4"
+  resolved "https://registry.yarnpkg.com/@types/stats.js/-/stats.js-0.17.4.tgz#1933e5ff153a23c7664487833198d685c22e791e"
+  integrity sha512-jIBvWWShCvlBqBNIZt0KAshWpvSjhkwkEu4ZUcASoAvhmrgAUI2t1dXrjSL4xXVLB4FznPrIsX3nKXFl/Dt4vA==
+
+"@types/three@0.186.0":
+  version "0.186.0"
+  resolved "https://registry.yarnpkg.com/@types/three/-/three-0.186.0.tgz#fc936323d7eeb885052fd5de352e3772f488ea99"
+  integrity sha512-mxYSBpDC+D0pLfSP6sW4WZTcT+nrtmZcimMqnVmy36Hte3XpeYSrvgg4TRdaM1GemGog1AWzI5qL2VoIfMXbJQ==
+  dependencies:
+    "@dimforge/rapier3d-compat" "~0.12.0"
+    "@tweenjs/tween.js" "~23.1.3"
+    "@types/stats.js" "*"
+    "@types/webxr" ">=0.5.17"
+    fflate "~0.8.3"
+    meshoptimizer "~1.1.1"
+
 "@types/trusted-types@2.0.7", "@types/trusted-types@^2.0.7":
   version "2.0.7"
   resolved "https://registry.yarnpkg.com/@types/trusted-types/-/trusted-types-2.0.7.tgz#baccb07a970b91707df3a3e8ba6896c57ead2d11"
@@ -2466,6 +2383,11 @@
   resolved "https://registry.yarnpkg.com/@types/uuid/-/uuid-10.0.0.tgz#e9c07fe50da0f53dc24970cca94d619ff03f6f6d"
   integrity sha512-7gqG38EyHgyP1S+7+xomFtL+ZNHcKv6DwNaCZmJmo1vgMugyF3TCnXVg4t1uk89mLNwnLtnY3TpOpCOyp1/xHQ==
 
+"@types/webxr@>=0.5.17":
+  version "0.5.24"
+  resolved "https://registry.yarnpkg.com/@types/webxr/-/webxr-0.5.24.tgz#734d5d90dadc5809a53e422726c60337fa2f4a44"
+  integrity sha512-h8fgEd/DpoS9CBrjEQXR+dIDraopAEfu4wYVNY2tEPwk60stPWhvZMf4Foo5FakuQ7HFZoa8WceaWFervK2Ovg==
+
 "@types/ws@8.18.1":
   version "8.18.1"
   resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.18.1.tgz#48464e4bf2ddfd17db13d845467f6070ffea4aa9"
@@ -3455,7 +3377,7 @@ cytoscape@^3.28.1:
   resolved "https://registry.yarnpkg.com/cytoscape/-/cytoscape-3.33.2.tgz#3a58906b4002b7c237f54dfc9b971983757da791"
   integrity sha512-sj4HXd3DokGhzZAdjDejGvTPLqlt84vNFN8m7bGsOzDY5DyVcxIb2ejIXat2Iy7HxWhdT/N1oKyheJ5YdpsGuw==
 
-"d3-array@1 - 2", d3-array@2:
+"d3-array@1 - 2":
   version "2.12.1"
   resolved "https://registry.yarnpkg.com/d3-array/-/d3-array-2.12.1.tgz#e20b41aafcdffdf5d50928004ececf815a465e81"
   integrity sha512-B0ErZK/66mHtEsR1TkPEEkwdy+WDesimkM5gpZr5Dsg54BiTA5RXtYW5qTLIAcekaS9xfZrzBLF/OAkB3Qn1YQ==
@@ -3497,7 +3419,7 @@ d3-chord@3:
   dependencies:
     d3-path "1 - 3"
 
-"d3-color@1 - 3", d3-color@3, d3-color@^3.1.0:
+"d3-color@1 - 3", d3-color@3:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/d3-color/-/d3-color-3.1.0.tgz#395b2833dfac71507f12ac2f7af23bf819de24e2"
   integrity sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==
@@ -3516,11 +3438,6 @@ d3-delaunay@6:
   dependencies:
     delaunator "5"
 
-"d3-dispatch@1 - 2":
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/d3-dispatch/-/d3-dispatch-2.0.0.tgz#8a18e16f76dd3fcaef42163c97b926aa9b55e7cf"
-  integrity sha512-S/m2VsXI7gAti2pBoLClFFTMOO1HTtT0j99AuXLoGFKO6deHDdnv6ZGTxSTTUTgO1zVcv82fCOtDjYK4EECmWA==
-
 "d3-dispatch@1 - 3", d3-dispatch@3:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/d3-dispatch/-/d3-dispatch-3.0.1.tgz#5fc75284e9c2375c36c839411a0cf550cbfc4d5e"
@@ -3575,25 +3492,11 @@ d3-force@3:
     d3-quadtree "1 - 3"
     d3-timer "1 - 3"
 
-d3-force@^2.0.1:
-  version "2.1.1"
-  resolved "https://registry.yarnpkg.com/d3-force/-/d3-force-2.1.1.tgz#f20ccbf1e6c9e80add1926f09b51f686a8bc0937"
-  integrity sha512-nAuHEzBqMvpFVMf9OX75d00OxvOXdxY+xECIXjW6Gv8BRrXu6gAWbv/9XKrvfJ5i5DCokDW7RYE50LRoK092ew==
-  dependencies:
-    d3-dispatch "1 - 2"
-    d3-quadtree "1 - 2"
-    d3-timer "1 - 2"
-
 "d3-format@1 - 3", d3-format@3:
   version "3.1.2"
   resolved "https://registry.yarnpkg.com/d3-format/-/d3-format-3.1.2.tgz#01fdb46b58beb1f55b10b42ad70b6e344d5eb2ae"
   integrity sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==
 
-d3-format@^1.4.4:
-  version "1.4.5"
-  resolved "https://registry.yarnpkg.com/d3-format/-/d3-format-1.4.5.tgz#374f2ba1320e3717eb74a9356c67daee17a7edb4"
-  integrity sha512-J0piedu6Z8iB6TbIGfZgDzfXxUFN3qQRMofy2oPdXzQibYGqPB/9iMcxr/TGalU+2RsyDO+U4f33id8tbnSRMQ==
-
 d3-geo@3:
   version "3.1.1"
   resolved "https://registry.yarnpkg.com/d3-geo/-/d3-geo-3.1.1.tgz#6027cf51246f9b2ebd64f99e01dc7c3364033a4d"
@@ -3633,11 +3536,6 @@ d3-polygon@3:
   resolved "https://registry.yarnpkg.com/d3-polygon/-/d3-polygon-3.0.1.tgz#0b45d3dd1c48a29c8e057e6135693ec80bf16398"
   integrity sha512-3vbA7vXYwfe1SYhED++fPUQlWSYTTGmFmQiany/gdbiWgU/iEyQzyymwL9SkJjFFuCS4902BSzewVGsHHmHtXg==
 
-"d3-quadtree@1 - 2":
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/d3-quadtree/-/d3-quadtree-2.0.0.tgz#edbad045cef88701f6fee3aee8e93fb332d30f9d"
-  integrity sha512-b0Ed2t1UUalJpc3qXzKi+cPGxeXRr4KU9YSlocN74aTzp6R/Ud43t79yLLqxHRWZfsvWXmbDWPpoENK1K539xw==
-
 "d3-quadtree@1 - 3", d3-quadtree@3:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/d3-quadtree/-/d3-quadtree-3.0.1.tgz#6dca3e8be2b393c9a9d514dabbd80a92deef1a4f"
@@ -3656,7 +3554,7 @@ d3-sankey@^0.12.3:
     d3-array "1 - 2"
     d3-shape "^1.2.0"
 
-"d3-scale-chromatic@1 - 3", d3-scale-chromatic@3, d3-scale-chromatic@^3.0.0:
+"d3-scale-chromatic@1 - 3", d3-scale-chromatic@3:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/d3-scale-chromatic/-/d3-scale-chromatic-3.1.0.tgz#34c39da298b23c20e02f1a4b239bd0f22e7f1314"
   integrity sha512-A3s5PWiZ9YCXFye1o246KoscMWqf8BsD9eRiJ3He7C9OBaxKhAd5TFCdEx/7VbKtxxTsu//1mMJFrEt572cEyQ==
@@ -3680,7 +3578,7 @@ d3-sankey@^0.12.3:
   resolved "https://registry.yarnpkg.com/d3-selection/-/d3-selection-3.0.0.tgz#c25338207efa72cc5b9bd1458a1a41901f1e1b31"
   integrity sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ==
 
-d3-shape@3, d3-shape@^3.1.0, d3-shape@^3.2.0:
+d3-shape@3, d3-shape@^3.1.0:
   version "3.2.0"
   resolved "https://registry.yarnpkg.com/d3-shape/-/d3-shape-3.2.0.tgz#a1a839cbd9ba45f28674c69d7f855bcf91dfc6a5"
   integrity sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==
@@ -3701,20 +3599,6 @@ d3-shape@^1.2.0:
   dependencies:
     d3-time "1 - 3"
 
-d3-time-format@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/d3-time-format/-/d3-time-format-3.0.0.tgz#df8056c83659e01f20ac5da5fdeae7c08d5f1bb6"
-  integrity sha512-UXJh6EKsHBTjopVqZBhFysQcoXSv/5yLONZvkQ5Kk3qbwiUYkdX17Xa1PT6U1ZWXGGfB1ey5L8dKMlFq2DO0Ag==
-  dependencies:
-    d3-time "1 - 2"
-
-"d3-time@1 - 2":
-  version "2.1.1"
-  resolved "https://registry.yarnpkg.com/d3-time/-/d3-time-2.1.1.tgz#e9d8a8a88691f4548e68ca085e5ff956724a6682"
-  integrity sha512-/eIQe/eR4kCQwq7yxi7z4c6qEXf2IYGcjoWB5OOQy4Tq9Uv39/947qlDcN2TLkiTzQWzvnsuYPB9TrWaNfipKQ==
-  dependencies:
-    d3-array "2"
-
 "d3-time@1 - 3", "d3-time@2.1.1 - 3", d3-time@3, d3-time@^3.0.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/d3-time/-/d3-time-3.1.0.tgz#9310db56e992e3c0175e1ef385e545e48a9bb5c7"
@@ -3722,11 +3606,6 @@ d3-time-format@^3.0.0:
   dependencies:
     d3-array "2 - 3"
 
-"d3-timer@1 - 2":
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/d3-timer/-/d3-timer-2.0.0.tgz#055edb1d170cfe31ab2da8968deee940b56623e6"
-  integrity sha512-TO4VLh0/420Y/9dO3+f9abDEFYeCUr2WZRlxJvbp4HPTQcSylXNiL6yZa9FIUvV1yRiFufl1bszTCLDqv9PWNA==
-
 "d3-timer@1 - 3", d3-timer@3, d3-timer@^3.0.1:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/d3-timer/-/d3-timer-3.0.1.tgz#6284d2a2708285b1abb7e201eda4380af35e63b0"
@@ -3803,6 +3682,13 @@ damerau-levenshtein@^1.0.8:
   resolved "https://registry.yarnpkg.com/damerau-levenshtein/-/damerau-levenshtein-1.0.8.tgz#b43d286ccbd36bc5b2f7ed41caf2d0aba1f8a6e7"
   integrity sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==
 
+data-bind-mapper@1:
+  version "1.0.3"
+  resolved "https://registry.yarnpkg.com/data-bind-mapper/-/data-bind-mapper-1.0.3.tgz#275e55fd170331b1146479f3c7eb4256b8239481"
+  integrity sha512-QmU3lyEnbENQPo0M1F9BMu4s6cqNNp8iJA+b/HP2sSb7pf3dxwF3+EP1eO69rwBfH9kFJ1apmzrtogAmVt2/Xw==
+  dependencies:
+    accessor-fn "1"
+
 data-view-buffer@^1.0.2:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/data-view-buffer/-/data-view-buffer-1.0.2.tgz#211a03ba95ecaf7798a8c7198d79536211f88570"
@@ -4240,12 +4126,12 @@ escape-string-regexp@^5.0.0:
   resolved "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz#4683126b500b61762f2dbebace1806e8be31b1c8"
   integrity sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==
 
-eslint-config-next@16.3.0:
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/eslint-config-next/-/eslint-config-next-16.3.0.tgz#b6e7cdceb55d98577837937898d1be71e9d17273"
-  integrity sha512-lPrf1kHsMJEZqO0uXkNB400c5MGrhrTk3BNX7P0ol4gt61+iUlQfjy9TyIOEA9eOXrf+5+mYbT/JsY8+zqUByQ==
+eslint-config-next@16.3.6:
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/eslint-config-next/-/eslint-config-next-16.3.6.tgz#46adc0ce206ccb09e8a982875cbc7867f2be1391"
+  integrity sha512-1Upt3U7BDwU+ilpe2byZjAfts9oNq4d4fv/zXEvs8/4yS+cwOQW/WCxUNy8gCDquX67SzeehDvKblVC6ZBMocQ==
   dependencies:
-    "@next/eslint-plugin-next" "16.3.0"
+    "@next/eslint-plugin-next" "16.3.6"
     eslint-import-resolver-node "^0.3.6"
     eslint-import-resolver-typescript "^3.5.2"
     eslint-plugin-import "^2.32.0"
@@ -4554,6 +4440,11 @@ fdir@^6.4.4, fdir@^6.5.0:
   resolved "https://registry.yarnpkg.com/fdir/-/fdir-6.5.0.tgz#ed2ab967a331ade62f18d077dae192684d50d350"
   integrity sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==
 
+fflate@~0.8.3:
+  version "0.8.3"
+  resolved "https://registry.yarnpkg.com/fflate/-/fflate-0.8.3.tgz#bc27d8eb30343d4d512abb03480202ce65d825fc"
+  integrity sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==
+
 file-entry-cache@^8.0.0:
   version "8.0.0"
   resolved "https://registry.yarnpkg.com/file-entry-cache/-/file-entry-cache-8.0.0.tgz#7787bddcf1131bffb92636c69457bbc0edd6d81f"
@@ -5764,7 +5655,7 @@ lodash.throttle@4.1.1:
   resolved "https://registry.yarnpkg.com/lodash.throttle/-/lodash.throttle-4.1.1.tgz#c23e91b710242ac70c37f1e1cda9274cc39bf2f4"
   integrity sha512-wIkUCfVKpVsWo3JSZlc+8MB5it+2AN5W8J7YVMST30UrvcQNZ1Okbj+rbVniijTWE6FGYy4XJq/rHkas8qJMLQ==
 
-lodash@4.18.1, lodash@^4.17.15, lodash@^4.17.21:
+lodash@4.18.1, lodash@^4.17.15:
   version "4.18.1"
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.18.1.tgz#ff2b66c1f6326d59513de2407bf881439812771c"
   integrity sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==
@@ -5838,7 +5729,7 @@ math-intrinsics@^1.1.0:
   resolved "https://registry.yarnpkg.com/math-intrinsics/-/math-intrinsics-1.1.0.tgz#a0dd74be81e2aa5c2f27e65ce283605ee4e2b7f9"
   integrity sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==
 
-mdast-util-find-and-replace@^3.0.0:
+mdast-util-find-and-replace@3.0.2, mdast-util-find-and-replace@^3.0.0:
   version "3.0.2"
   resolved "https://registry.yarnpkg.com/mdast-util-find-and-replace/-/mdast-util-find-and-replace-3.0.2.tgz#70a3174c894e14df722abf43bc250cbae44b11df"
   integrity sha512-Tmd1Vg/m3Xz43afeNxDIhWRtFZgM2VLyaf4vSTYwudTyeuTneoL3qtWMA5jeLyz/O1vDJmmV4QuScFCA2tBPwg==
@@ -6079,6 +5970,11 @@ mermaid@10.9.8, mermaid@^11.12.1:
     uuid "^9.0.0 || ^10 || ^11.1.0 || ^12 || ^13 || ^14.0.0"
     web-worker "^1.2.0"
 
+meshoptimizer@~1.1.1:
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/meshoptimizer/-/meshoptimizer-1.1.1.tgz#20c7d050d59bdc573154814f6a37d47d89908cca"
+  integrity sha512-oRFNWJRDA/WTrVj7NWvqa5HqE1t9MYDj2VaWirQCzCCrAd2GHrqR/sQezCxiWATPNlKTcRaPRHPJwIRoPBAp5g==
+
 micromark-core-commonmark@^1.0.1:
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/micromark-core-commonmark/-/micromark-core-commonmark-1.1.0.tgz#1386628df59946b2d39fb2edfd10f3e8e0a75bb8"
@@ -6642,27 +6538,58 @@ next-themes@0.2.1:
   resolved "https://registry.yarnpkg.com/next-themes/-/next-themes-0.2.1.tgz#0c9f128e847979daf6c67f70b38e6b6567856e45"
   integrity sha512-B+AKNfYNIzh0vqQQKqQItTS8evEouKD7H5Hj3kmuPERwddR2TxvDSFZuTj6T7Jfn1oyeUyJMydPl1Bkxkh0W7A==
 
-next@16.3.0:
-  version "16.3.0"
-  resolved "https://registry.yarnpkg.com/next/-/next-16.3.0.tgz#03ed9eaf21bac38ceab5aa6f3b03f0fff587b42b"
-  integrity sha512-NEdGOzH+08eTXMUp9UYkA99Nhi5N6Thrhc1jgFOQgfgnGK/dA2hRwBpXep+exdFQrnwlRf/3Wixyp8lLBUpE2A==
+next@16.3.6:
+  version "16.3.6"
+  resolved "https://registry.yarnpkg.com/next/-/next-16.3.6.tgz#29a6cecb103bd2642a0ce322e68ecdb38a0f0af5"
+  integrity sha512-L+otWM/aQbYTx98aZhgEoMb4bZAXx1YVW4UMA/vuCyCoWG5HJyZUili8QAkqzrcC+5///tsz3s0M+SlyB5bLMw==
   dependencies:
-    "@next/env" "16.3.0"
-    "@swc/helpers" "0.5.15"
+    "@next/env" "16.3.6"
+    "@swc/helpers" "0.5.23"
     baseline-browser-mapping "^2.9.19"
     caniuse-lite "^1.0.30001579"
     postcss "8.5.23"
     styled-jsx "5.1.6"
   optionalDependencies:
-    "@next/swc-darwin-arm64" "16.3.0"
-    "@next/swc-darwin-x64" "16.3.0"
-    "@next/swc-linux-arm64-gnu" "16.3.0"
-    "@next/swc-linux-arm64-musl" "16.3.0"
-    "@next/swc-linux-x64-gnu" "16.3.0"
-    "@next/swc-linux-x64-musl" "16.3.0"
-    "@next/swc-win32-arm64-msvc" "16.3.0"
-    "@next/swc-win32-x64-msvc" "16.3.0"
-    sharp "^0.35.3"
+    "@next/swc-darwin-arm64" "16.3.6"
+    "@next/swc-darwin-x64" "16.3.6"
+    "@next/swc-linux-arm64-gnu" "16.3.6"
+    "@next/swc-linux-arm64-musl" "16.3.6"
+    "@next/swc-linux-x64-gnu" "16.3.6"
+    "@next/swc-linux-x64-musl" "16.3.6"
+    "@next/swc-win32-arm64-msvc" "16.3.6"
+    "@next/swc-win32-x64-msvc" "16.3.6"
+    sharp "^0.35.4"
+
+ngraph.events@^1.0.0, ngraph.events@^1.4.0:
+  version "1.4.0"
+  resolved "https://registry.yarnpkg.com/ngraph.events/-/ngraph.events-1.4.0.tgz#3153c0a5760172c744f7b2dbc5a3d8a72703e357"
+  integrity sha512-NeDGI4DSyjBNBRtA86222JoYietsmCXbs8CEB0dZ51Xeh4lhVl1y3wpWLumczvnha8sFQIW4E0vvVWwgmX2mGw==
+
+ngraph.forcelayout@3:
+  version "3.3.1"
+  resolved "https://registry.yarnpkg.com/ngraph.forcelayout/-/ngraph.forcelayout-3.3.1.tgz#981e1baee5e0593c490bc27219169f9cedfa4f8b"
+  integrity sha512-MKBuEh1wujyQHFTW57y5vd/uuEOK0XfXYxm3lC7kktjJLRdt/KEKEknyOlc6tjXflqBKEuYBBcu7Ax5VY+S6aw==
+  dependencies:
+    ngraph.events "^1.0.0"
+    ngraph.merge "^1.0.0"
+    ngraph.random "^1.0.0"
+
+ngraph.graph@20:
+  version "20.1.2"
+  resolved "https://registry.yarnpkg.com/ngraph.graph/-/ngraph.graph-20.1.2.tgz#903389a5370a864cb1a47c522f54994b38cb3923"
+  integrity sha512-W/G3GBR3Y5UxMLHTUCPP9v+pbtpzwuAEIqP5oZV+9IwgxAIEZwh+Foc60iPc1idlnK7Zxu0p3puxAyNmDvBd0Q==
+  dependencies:
+    ngraph.events "^1.4.0"
+
+ngraph.merge@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/ngraph.merge/-/ngraph.merge-1.0.0.tgz#d763cdfa48b1bbd4270ea246f06c9c8ff5d3477c"
+  integrity sha512-5J8YjGITUJeapsomtTALYsw7rFveYkM+lBj3QiYZ79EymQcuri65Nw3knQtFxQBU1r5iOaVRXrSwMENUPK62Vg==
+
+ngraph.random@^1.0.0:
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/ngraph.random/-/ngraph.random-1.2.0.tgz#3864ffbb9971e920db6c5f33ce5abc3d2439e3d2"
+  integrity sha512-4EUeAGbB2HWX9njd6bP6tciN6ByJfoaAvmVL9QTaZSeXrW46eNGA9GajiXiPBbvFqxUWFkEbyo6x5qsACUuVfA==
 
 node-addon-api@^7.0.0:
   version "7.1.1"
@@ -7015,6 +6942,13 @@ points-on-path@^0.2.1:
     path-data-parser "0.1.0"
     points-on-curve "0.2.0"
 
+polished@4:
+  version "4.3.1"
+  resolved "https://registry.yarnpkg.com/polished/-/polished-4.3.1.tgz#5a00ae32715609f83d89f6f31d0f0261c6170548"
+  integrity sha512-OBatVyC/N7SCW/FaDHrSd+vn0o5cS855TOmYi4OkdWUMSJCET/xip//ch8xGUvtr3i44X9LVyWwQlRMTN3pwSA==
+  dependencies:
+    "@babel/runtime" "^7.17.8"
+
 possible-typed-array-names@^1.0.0:
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz#93e3582bc0e5426586d9d07b79ee40fc841de4ae"
@@ -7312,6 +7246,15 @@ react-force-graph-2d@^1.29.1:
     prop-types "15"
     react-kapsule "^2.5"
 
+react-force-graph-3d@1.29.1:
+  version "1.29.1"
+  resolved "https://registry.yarnpkg.com/react-force-graph-3d/-/react-force-graph-3d-1.29.1.tgz#fee5a4b74ca1d4623358bb1057bfdffa8c3fe404"
+  integrity sha512-5Vp+PGpYnO+zLwgK2NvNqdXHvsWLrFzpDfJW1vUA1twjo9SPvXqfUYQrnRmAbD+K2tOxkZw1BkbH31l5b4TWHg==
+  dependencies:
+    "3d-force-graph" "^1.79"
+    prop-types "15"
+    react-kapsule "^2.5"
+
 react-is@^16.13.1:
   version "16.13.1"
   resolved "https://registry.yarnpkg.com/react-is/-/react-is-16.13.1.tgz#789729a4dc36de2999dc156dd6c1d9c18cea56a4"
@@ -7386,11 +7329,6 @@ react-style-singleton@^2.2.2, react-style-singleton@^2.2.3:
     get-nonce "^1.0.0"
     tslib "^2.0.0"
 
-react-virtualized-auto-sizer@^1.0.26:
-  version "1.0.26"
-  resolved "https://registry.yarnpkg.com/react-virtualized-auto-sizer/-/react-virtualized-auto-sizer-1.0.26.tgz#e9470ef6a778dc4f1d5fd76305fa2d8b610c357a"
-  integrity sha512-CblNyiNVw2o+hsa5/49NH2ogGxZ+t+3aweRvNSq7TVjDIlwk7ir4lencEg5HxHeSzwNarSkNkiu0qJSOXtxm5A==
-
 react@19.2.4:
   version "19.2.4"
   resolved "https://registry.yarnpkg.com/react/-/react-19.2.4.tgz#438e57baa19b77cb23aab516cf635cd0579ee09a"
@@ -7823,7 +7761,7 @@ set-proto@^1.0.0:
     es-errors "^1.3.0"
     es-object-atoms "^1.0.0"
 
-sharp@0.35.3, sharp@^0.35.3:
+sharp@0.35.3, sharp@^0.35.4:
   version "0.35.3"
   resolved "https://registry.yarnpkg.com/sharp/-/sharp-0.35.3.tgz#41ed21a46406be163eacd0be7b364b42fcf2885f"
   integrity sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==
@@ -8288,6 +8226,38 @@ thenify-all@^1.0.0:
   dependencies:
     any-promise "^1.0.0"
 
+three-forcegraph@1:
+  version "1.43.4"
+  resolved "https://registry.yarnpkg.com/three-forcegraph/-/three-forcegraph-1.43.4.tgz#9e85a75e729af143440d4a05edf3b197d717310e"
+  integrity sha512-FtmiZP/T16ZQaHza3JDaDn0YTXFtg9e7pGnTeU8nzu0NNkx7MpWbF/GvmpbQsWHx3rukHtkRv1fTorLPB3FDEA==
+  dependencies:
+    accessor-fn "1"
+    d3-array "1 - 3"
+    d3-force-3d "2 - 3"
+    d3-scale "1 - 4"
+    d3-scale-chromatic "1 - 3"
+    data-bind-mapper "1"
+    kapsule "^1.16"
+    ngraph.forcelayout "3"
+    ngraph.graph "20"
+    tinycolor2 "1"
+
+three-render-objects@^1.41:
+  version "1.42.0"
+  resolved "https://registry.yarnpkg.com/three-render-objects/-/three-render-objects-1.42.0.tgz#32ad1a6f83ecb92ec67573c79f7865b44d491aa6"
+  integrity sha512-KYfkPrYGEbIK8ChFocWqOF1aAN80FBUBWVYB8mB2oBpVuVN+52FvvngVYB5ieFANQu7Rt21rPYZ/xKaAgVWWRQ==
+  dependencies:
+    "@tweenjs/tween.js" "18 - 25"
+    accessor-fn "1"
+    float-tooltip "^1.7"
+    kapsule "^1.16"
+    polished "4"
+
+three@0.186.1, "three@>=0.179 <1":
+  version "0.186.1"
+  resolved "https://registry.yarnpkg.com/three/-/three-0.186.1.tgz#6d50f70c2c437f844179bbb56d6f5b774e1ca38a"
+  integrity sha512-blFeqb49wRCSGUGj7gtpfnSGHy2lwDk94RhUmS1c/hTby70kvChbWpkJ4Pm1390LqzzvTmzgXKHPEafJwCb8jA==
+
 tiny-invariant@^1.3.3:
   version "1.3.3"
   resolved "https://registry.yarnpkg.com/tiny-invariant/-/tiny-invariant-1.3.3.tgz#46680b7a873a0d5d10005995eb90a70d74d60127"
@@ -8298,7 +8268,7 @@ tinybench@^2.9.0:
   resolved "https://registry.yarnpkg.com/tinybench/-/tinybench-2.9.0.tgz#103c9f8ba6d7237a47ab6dd1dcff77251863426b"
   integrity sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==
 
-tinycolor2@^1.6.0:
+tinycolor2@1, tinycolor2@^1.6.0:
   version "1.6.0"
   resolved "https://registry.yarnpkg.com/tinycolor2/-/tinycolor2-1.6.0.tgz#f98007460169b0263b97072c5ae92484ce02d09e"
   integrity sha512-XPaBkWQJdsf3pLKJV9p4qN/S+fm2Oj8AIPo1BTUhg5oxkvm9+SVEGFdhyOz7tTdUTfvxMiAs4sp6/eZO2Ew+pw==
@@ -8493,10 +8463,10 @@ unbox-primitive@^1.1.0:
     has-symbols "^1.1.0"
     which-boxed-primitive "^1.1.1"
 
-undici-types@~6.21.0:
-  version "6.21.0"
-  resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-6.21.0.tgz#691d00af3909be93a7faa13be61b3a5b50ef12cb"
-  integrity sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==
+"undici-types@>=7.24.0 <7.24.7":
+  version "7.24.6"
+  resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-7.24.6.tgz#61275b485d7fd4e9d269c7cf04ec2873c9cc0f91"
+  integrity sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==
 
 undici-types@~7.19.0:
   version "7.19.2"
@@ -8619,11 +8589,6 @@ use-callback-ref@^1.3.3:
   dependencies:
     tslib "^2.0.0"
 
-use-debounce@^10.0.4:
-  version "10.1.1"
-  resolved "https://registry.yarnpkg.com/use-debounce/-/use-debounce-10.1.1.tgz#b08b596b60a55fd4c18b44b37fdc02f058baf30a"
-  integrity sha512-kvds8BHR2k28cFsxW8k3nc/tRga2rs1RHYCqmmGqb90MEeE++oALwzh2COiuBLO1/QXiOuShXoSN2ZpWnMmvuQ==
-
 use-intl@^4.9.2:
   version "4.13.0"
   resolved "https://registry.yarnpkg.com/use-intl/-/use-intl-4.13.0.tgz#bc60d5b71864a5adf906c901fc660b6c578885f9"

From f25790a446abc89c674f8e0aa37e2349e66a10ac Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 16:15:03 +0100
Subject: [PATCH 07/28] better look for links and better guides overall

---
 .../skills/jotty/references/persistence.md    |  23 +-
 AGENTS.md                                     |   4 +-
 .../Admin/Parts/EditorSettingsTab.tsx         |   6 -
 .../Parts/Common/ChecklistHeading.tsx         |   8 +-
 .../Parts/Common/ChecklistItemText.tsx        |  85 +++
 .../Checklists/Parts/Common/ItemLinkPopup.tsx |  22 +
 .../Parts/Simple/NestedChecklistItem.tsx      |  43 +-
 .../Kanban/ArchivedItemsModal.tsx             |   3 +-
 .../FeatureComponents/Kanban/CalendarView.tsx |   3 +-
 .../FeatureComponents/Kanban/Kanban.tsx       |   2 +-
 .../FeatureComponents/Kanban/KanbanCard.tsx   |   3 +-
 .../Kanban/KanbanCardDetail.tsx               |  12 +-
 .../Kanban/KanbanCardDetailSubtasks.tsx       |   9 +-
 .../FeatureComponents/Kanban/KanbanColumn.tsx |  32 +-
 .../Kanban/KanbanItemContent.tsx              |   8 +-
 .../CustomExtensions/CalloutExtension.tsx     |   3 +-
 .../InternalLinkComponent.tsx                 |  62 +-
 .../Notes/Parts/UnifiedMarkdownRenderer.tsx   |  24 +-
 .../Notes/Parts/WikiLink.tsx                  |  41 +-
 app/_consts/callouts.ts                       |  17 +
 app/_consts/user-settings.ts                  |   1 +
 app/_hooks/useItemLinkSuggestions.ts          | 114 +++
 app/_server/actions/relations/indexer.ts      |  49 +-
 app/_server/actions/relations/watcher.ts      | 122 +++
 app/_server/actions/share/operations.ts       |  58 +-
 app/_translations/de.json                     |   2 -
 app/_translations/en.json                     |   2 -
 app/_translations/es.json                     |   2 -
 app/_translations/fr.json                     |   2 -
 app/_translations/it.json                     |   2 -
 app/_translations/klingon.json                |   2 -
 app/_translations/ko.json                     |   2 -
 app/_translations/nl.json                     |   2 -
 app/_translations/pirate.json                 |   2 -
 app/_translations/pl.json                     |   2 -
 app/_translations/pt.json                     |   2 -
 app/_translations/ru.json                     |   2 -
 app/_translations/tr.json                     |   2 -
 app/_translations/vi.json                     |   2 -
 app/_translations/zh.json                     |   2 -
 app/_utils/callout-utils.ts                   |  12 +
 app/_utils/item-href-utils.ts                 |   9 +-
 app/_utils/markdown-utils.tsx                 |   9 +-
 app/_utils/wikilink-utils.ts                  |   6 +-
 app/api/admin/rebuild-index/route.ts          |  21 +-
 howto/API.md                                  | 708 +++++++++---------
 howto/BRAIN.md                                |  35 +-
 howto/CUSTOMISATIONS.md                       |  30 +-
 howto/DOCKER.md                               | 127 ++--
 howto/ENCRYPTION.md                           | 184 +++--
 howto/ENV-VARIABLES.md                        |  66 +-
 howto/LDAP.md                                 |  91 +--
 howto/MARKDOWN.md                             |  65 +-
 howto/MFA.md                                  |  69 +-
 howto/PATCHES.md                              |  40 +-
 howto/PWA.md                                  |  80 +-
 howto/SHORTCUTS.md                            |  43 +-
 howto/SSO.md                                  |  79 +-
 howto/TRANSLATIONS.md                         |  66 +-
 howto/UNRAID.md                               |  59 +-
 instrumentation.ts                            |   2 +
 tests/api/rebuild-index.test.ts               |  83 ++
 tests/server-actions/relations.test.ts        |  62 ++
 tests/server-actions/share-migration.test.ts  |   4 +
 tests/server-actions/sharing.test.ts          |   4 +
 tests/server-actions/users.test.ts            |  11 +
 tests/utils/callout-utils.test.ts             |  68 ++
 tests/utils/item-link-text.test.ts            |  37 +
 68 files changed, 1739 insertions(+), 1115 deletions(-)
 create mode 100644 app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistItemText.tsx
 create mode 100644 app/_components/FeatureComponents/Checklists/Parts/Common/ItemLinkPopup.tsx
 create mode 100644 app/_consts/callouts.ts
 create mode 100644 app/_hooks/useItemLinkSuggestions.ts
 create mode 100644 app/_server/actions/relations/watcher.ts
 create mode 100644 app/_utils/callout-utils.ts
 create mode 100644 tests/api/rebuild-index.test.ts
 create mode 100644 tests/utils/callout-utils.test.ts
 create mode 100644 tests/utils/item-link-text.test.ts

diff --git a/.agents/skills/jotty/references/persistence.md b/.agents/skills/jotty/references/persistence.md
index 5e9d26b0a..97ddeb03c 100644
--- a/.agents/skills/jotty/references/persistence.md
+++ b/.agents/skills/jotty/references/persistence.md
@@ -1,6 +1,6 @@
 # File persistence
 
-There is no database. A missed lock, a half-written file, or a loop that stats 800 notes is a real outage for a real person.
+Your files are the database. The only other store is a derived SQLite index of relationships, which can always be rebuilt from them. A missed lock, a half-written file, or a loop that stats 800 notes is a real outage for a real person.
 
 ## Layout
 
@@ -11,12 +11,12 @@ data/
   users/session-data.json
   notes/<username>/            markdown notes in category folders
   checklists/<username>/       markdown lists in category folders
-  notes/<username>/.index.json link index, keyed by uuid
   <any folder>/.category-info.json   folder uuid, sharing, order
   notifications/<username>.json
   encryption/<username>/       PGP key files, never the passphrase
   logs/
   .schema-version
+  .relations.db                derived links index (SQLite, WAL). Disposable.
 ```
 
 `.sharing.json` and `.order.json` are leftovers. Current code reads them during migration. New writes go to `.category-info.json`.
@@ -27,7 +27,7 @@ Schema version is `DATA_SCHEMA_VERSION` in `app/_consts/files.ts`. Old shapes st
 
 Notes and checklists are both `.md` with YAML frontmatter. Checklists are not JSON. `noteToMarkdown` / `listToMarkdown` write them. Readers parse them.
 
-Frontmatter carries `uuid`, `title`, timestamps, tags, encryption flags, checklist type. Body is markdown. Encrypted body is opaque ciphertext. Do not index it.
+Frontmatter carries `uuid`, `title`, `createdAt`, tags, encryption flags, checklist type. Body is markdown. Encrypted body is opaque ciphertext. Do not index it.
 
 ## Helpers
 
@@ -35,10 +35,11 @@ Frontmatter carries `uuid`, `title`, timestamps, tags, encryption flags, checkli
 
 - `ensureDir`
 - `readJsonFile` / `writeJsonFile` (atomic temp + rename)
-- `serverReadFile` / `serverWriteFile` / `serverDeleteFile`
+- `serverReadFile` / `serverWriteFile` / `serverDeleteFile` / `serverDeleteDir` / `serverRenamePath`
 - `getUserModeDir`
+- `stampUuid` in `lib/stamp-uuid.ts` for giving an item file its uuid
 
-`writeCatInfo` is also atomic. `serverWriteFile` is a straight write. Prefer the atomic helpers for JSON. Do not invent a third writer.
+`serverWriteFile` is atomic (temp file + rename), stamps `createdAt` on item files that lack it, invalidates the metadata cache and updates the relations index. Delete, rename and move go through the helpers above for the same reasons. A raw `fs.writeFile` or `fs.rename` on an item file skips all of that. Do not invent another writer.
 
 Paths: `path.join(process.cwd(), ...)`. Constants in `app/_consts/files.ts`. Never a relative `"data/..."` you hope is cwd.
 
@@ -67,11 +68,15 @@ Jotty is one Node process. Those in-process maps are enough until someone cluste
 
 ## Indexes
 
-`.index.json` under notes is the **link** index, keyed by item uuid. Create, update, delete, and move must call `updateIndexForItem` / `removeItemFromIndex`. It does not rebuild itself.
+`data/.relations.db` is the **relations** index, in `app/_server/actions/relations/`. It holds items, links between them, wikilink bindings and plain note text for "Mentioned in". It is derived and disposable: a missing, corrupt or old-schema file is discarded and rebuilt from the markdown on start, with the UI showing "Indexing relationships...". Bump `RELATIONS_SCHEMA_VERSION` when its shape changes. No migration, it just rebuilds.
 
-Folder order and sharing live in `.category-info.json` (`order.items` is a uuid list).
+- Writes keep it current through the file helpers (`trackItemWrite` and friends in `relations/tracking.ts`). Use the helpers and you get it for free.
+- Changes made outside Jotty are caught by a recursive `fs.watch` on the notes and checklists roots, throttled to one pass a minute, which only stats the paths that changed. If the watcher can't start, reads fall back to a full mtime reconcile at most once a minute.
+- Encrypted notes are indexed by uuid and title only. Their body is never parsed.
+- `bindings` remembers which uuid each `[[wikilink]]` text first resolved to, per source note. That memory survives edits and rebuilds, and is lost only if the file is deleted.
+- Queries are permission scoped through `visibleItems(username)`. Never return rows the viewer can't see.
 
-If you add a write path and forget the index, search and the graph go stale with nothing in the logs.
+Folder order and sharing live in `.category-info.json` (`order.items` is a uuid list).
 
 ## Path containment
 
@@ -83,4 +88,4 @@ Username is not a path segment you trust from the client either. Session usernam
 
 ## Data on this machine
 
-The `data/` directory in a running instance holds real notes. Tests use mocks and temp dirs. `yarn mock:data:notes` / `yarn mock:data:lists` fill a named user for local poking. Do not empty, reshape, or "fix" `data/` to make a test pass.
+The `data/` directory in a running instance holds real notes. Tests use mocks and temp dirs. `yarn mock:data:notes` / `yarn mock:data:lists` fill a named user for local poking. `yarn mock:data:brain --user=<name>` writes a linked set under a `Brain Seed` category, and `--remove` deletes only that category. Do not empty, reshape, or "fix" `data/` to make a test pass.
diff --git a/AGENTS.md b/AGENTS.md
index ef7f48ce7..74623e6cd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,6 @@
 # Jotty
 
-Jotty is a self-hosted app for notes, checklists and Kanban boards. There is no database. Every note, checklist, user and share is a file on a disk that the person running it owns.
+Jotty is a self-hosted app for notes, checklists and Kanban boards. Every note, checklist, user and share is a file on a disk that the person running it owns. The one database, `data/.relations.db`, is a derived index of links. Deleting it loses nothing anybody wrote: it is rebuilt from those files. Never make it the only home of user data.
 
 If we corrupt one of those files there is no restore button and nobody to email. There is a person and whatever backup they happened to take.
 
@@ -12,7 +12,7 @@ Read, change, write back on a shared file without a lock loses data. It has happ
 
 A write that fails halfway leaves a truncated note where a note used to be. Use the existing file helpers, they write atomically.
 
-Indexes do not rebuild themselves. Add a write path, miss the rebuild, and search goes stale with nothing in the logs to say so.
+Indexes go stale quietly. The file helpers keep the caches and the relations index in step, so write through them. A raw `fs` write on an item file leaves search, backlinks and the brain wrong with nothing in the logs to say so.
 
 Loops are expensive. One helper reading one item is fine. That same helper running once per item for a user with 800 notes is a stat storm. Caches and indexes already exist for this, look for them before you walk a directory yourself.
 
diff --git a/app/_components/FeatureComponents/Admin/Parts/EditorSettingsTab.tsx b/app/_components/FeatureComponents/Admin/Parts/EditorSettingsTab.tsx
index 24ae1f753..e5a0d8e61 100644
--- a/app/_components/FeatureComponents/Admin/Parts/EditorSettingsTab.tsx
+++ b/app/_components/FeatureComponents/Admin/Parts/EditorSettingsTab.tsx
@@ -253,15 +253,9 @@ export const EditorSettingsTab = () => {
               <label htmlFor="enableBilateralLinks" className="space-y-1 cursor-pointer">
                 <div className="text-md lg:text-sm font-medium">
                   {t("admin.bilateralLinks")}
-                  <span className="ml-1 text-sm lg:text-xs text-muted-foreground">
-                    {t("admin.experimental")}
-                  </span>
                 </div>
                 <p className="text-md lg:text-xs text-muted-foreground">
                   {t("admin.bilateralLinksDescription")}
-                  <span className="mt-1 block text-sm lg:text-xs italic text-muted-foreground">
-                    {t("admin.bilateralLinksWarning")}
-                  </span>
                 </p>
               </label>
               <Toggle
diff --git a/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistHeading.tsx b/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistHeading.tsx
index 088ca623d..978f03edf 100644
--- a/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistHeading.tsx
+++ b/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistHeading.tsx
@@ -19,6 +19,8 @@ import { CompletedSuggestionsDropdown } from "@/app/_components/FeatureComponent
 import { TaskStatus } from "@/app/_types/enums";
 import { useTranslations } from "next-intl";
 import { TagMentionsList } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/TagMentionsList";
+import { useItemLinkSuggestions } from "@/app/_hooks/useItemLinkSuggestions";
+import { ItemLinkPopup } from "./ItemLinkPopup";
 import {
   ArrowLeftIcon,
   ArrowRight01FreeIcons,
@@ -59,6 +61,7 @@ export const ChecklistHeading = ({
   const tagSuggestionsWrapperRef = useRef<HTMLDivElement>(null);
   const tagMentionsRef = useRef<{ onKeyDown: (event: KeyboardEvent) => boolean; focusSearch: () => void }>(null);
   const { user, tagsIndex, tagsEnabled } = useAppMode();
+  const linkSuggestions = useItemLinkSuggestions(newItemText, setNewItemText, inputRef);
   const { showCompletedSuggestions: sessionShowCompletedSuggestions } =
     useSettings();
 
@@ -161,6 +164,7 @@ export const ChecklistHeading = ({
   };
 
   const handleInputKeyDown = (e: React.KeyboardEvent<HTMLInputElement>) => {
+    if (linkSuggestions.handleKeyDown(e)) return;
     if (!showTagSuggestions || !tagMentionsRef.current) return;
     if (e.key === "Escape") {
       setShowTagSuggestions(false);
@@ -300,7 +304,9 @@ export const ChecklistHeading = ({
                   />
                 </div>
               )}
-              {showSuggestions &&
+              <ItemLinkPopup suggestions={linkSuggestions} />
+              {!linkSuggestions.open &&
+                showSuggestions &&
                 filteredSuggestions.length > 0 &&
                 newItemText.trim() !== "" && (
                   <div
diff --git a/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistItemText.tsx b/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistItemText.tsx
new file mode 100644
index 000000000..fb9ff7cce
--- /dev/null
+++ b/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistItemText.tsx
@@ -0,0 +1,85 @@
+"use client";
+
+import { Fragment, ReactNode, SyntheticEvent } from "react";
+import { WIKILINK_REGEX } from "@/app/_consts/relations";
+import { currentOrigins, parseItemHref } from "@/app/_utils/item-href-utils";
+import { useAppMode } from "@/app/_providers/AppModeProvider";
+import { TagLinkViewComponent } from "@/app/_components/FeatureComponents/Tags/TagLinkComponent";
+import { InternalLinkComponent } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent";
+import { WikiLink } from "@/app/_components/FeatureComponents/Notes/Parts/WikiLink";
+
+interface ChecklistItemTextProps {
+  text: string;
+  tagsEnabled?: boolean;
+  compact?: boolean;
+}
+
+const LINK_SOURCE = String.raw`\[((?:[^\[\]\\]|\\.)*)\]\(([^()\s]+)\)`;
+const TAG_SOURCE = String.raw`#([a-zA-Z][a-zA-Z0-9_/-]*)`;
+const TOKENS = new RegExp(`${LINK_SOURCE}|${WIKILINK_REGEX.source}|${TAG_SOURCE}`, "g");
+
+const _unescape = (label: string) => label.replace(/\\(.)/g, "$1");
+
+const _hush = (event: SyntheticEvent) => event.stopPropagation();
+
+const Inline = ({ children }: { children: ReactNode }) => (
+  <span
+    className="inline"
+    onPointerDown={_hush}
+    onMouseDown={_hush}
+    onClick={_hush}
+  >
+    {children}
+  </span>
+);
+
+export const ChecklistItemText = ({
+  text,
+  tagsEnabled = false,
+  compact = false,
+}: ChecklistItemTextProps) => {
+  const { appSettings } = useAppMode();
+  const linksEnabled = appSettings?.editor?.enableBilateralLinks !== false;
+  const parts: ReactNode[] = [];
+  let last = 0;
+
+  for (const match of Array.from(text.matchAll(TOKENS))) {
+    const at = match.index ?? 0;
+    const [whole, label, href, wikiTarget, wikiLabel, tag] = match;
+    let piece: ReactNode = null;
+
+    if (href !== undefined && linksEnabled) {
+      const target = parseItemHref(href, currentOrigins());
+      if (target) {
+        piece = (
+          <InternalLinkComponent
+            showCategory={!compact}
+            node={{ attrs: { href, title: _unescape(label || ""), type: target.type, uuid: target.uuid } }}
+          />
+        );
+      }
+    } else if (wikiTarget !== undefined && linksEnabled) {
+      piece = (
+        <WikiLink
+          target={wikiTarget.trim()}
+          label={wikiLabel?.trim() || undefined}
+          showCategory={!compact}
+        />
+      );
+    } else if (tag !== undefined && tagsEnabled) {
+      piece = <TagLinkViewComponent tag={tag} />;
+    }
+
+    if (!piece) continue;
+    if (at > last) parts.push(text.slice(last, at));
+    parts.push(
+      <Inline key={at}>
+        {piece}
+      </Inline>,
+    );
+    last = at + whole.length;
+  }
+
+  if (last < text.length) parts.push(text.slice(last));
+  return <>{parts.map((part, index) => <Fragment key={index}>{part}</Fragment>)}</>;
+};
diff --git a/app/_components/FeatureComponents/Checklists/Parts/Common/ItemLinkPopup.tsx b/app/_components/FeatureComponents/Checklists/Parts/Common/ItemLinkPopup.tsx
new file mode 100644
index 000000000..e4d702c0e
--- /dev/null
+++ b/app/_components/FeatureComponents/Checklists/Parts/Common/ItemLinkPopup.tsx
@@ -0,0 +1,22 @@
+"use client";
+
+import { AtMentionsList } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/AtMentionsList";
+import type { ItemLinkSuggestions } from "@/app/_hooks/useItemLinkSuggestions";
+
+export const ItemLinkPopup = ({ suggestions }: { suggestions: ItemLinkSuggestions }) => {
+  if (!suggestions.open) return null;
+
+  return (
+    <div
+      ref={suggestions.wrapperRef}
+      style={{ position: "fixed", top: suggestions.position.top, left: suggestions.position.left }}
+      className="z-[9999]"
+    >
+      <AtMentionsList
+        ref={suggestions.listRef}
+        items={suggestions.items}
+        command={(item) => suggestions.pick(item as (typeof suggestions.items)[number])}
+      />
+    </div>
+  );
+};
diff --git a/app/_components/FeatureComponents/Checklists/Parts/Simple/NestedChecklistItem.tsx b/app/_components/FeatureComponents/Checklists/Parts/Simple/NestedChecklistItem.tsx
index 524cd7ecc..a66fb1684 100644
--- a/app/_components/FeatureComponents/Checklists/Parts/Simple/NestedChecklistItem.tsx
+++ b/app/_components/FeatureComponents/Checklists/Parts/Simple/NestedChecklistItem.tsx
@@ -22,9 +22,11 @@ import { useShowEmojis } from "@/app/_hooks/useShowEmojis";
 import { useEmojiCache } from "@/app/_hooks/useEmojiCache";
 import { Checklist, Item } from "@/app/_types";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
-import { TagLinkViewComponent } from "@/app/_components/FeatureComponents/Tags/TagLinkComponent";
 import { Input } from "@/app/_components/GlobalComponents/FormElements/Input";
 import { useTagSuggestions } from "@/app/_hooks/useTagSuggestions";
+import { useItemLinkSuggestions } from "@/app/_hooks/useItemLinkSuggestions";
+import { ItemLinkPopup } from "@/app/_components/FeatureComponents/Checklists/Parts/Common/ItemLinkPopup";
+import { ChecklistItemText } from "@/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistItemText";
 import { TagMentionsList } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/TagMentionsList";
 import LastModifiedCreatedInfo from "../Common/LastModifiedCreatedInfo";
 import { RecurrenceIndicator } from "@/app/_components/GlobalComponents/Indicators/RecurrenceIndicator";
@@ -124,6 +126,12 @@ const NestedChecklistItemComponent = ({
     addSubItemInputRef,
     { tagsIndex, tagsEnabled: !!tagsEnabled }
   );
+  const editLinkSuggestions = useItemLinkSuggestions(editText, setEditText, inputRef);
+  const subItemLinkSuggestions = useItemLinkSuggestions(
+    newSubItemText,
+    setNewSubItemText,
+    addSubItemInputRef,
+  );
 
   useEffect(() => {
     const editorId = `checklist-item-${item.id}`;
@@ -179,6 +187,7 @@ const NestedChecklistItemComponent = ({
   };
 
   const handleEditKeyDown = (e: React.KeyboardEvent<HTMLInputElement>) => {
+    if (editLinkSuggestions.handleKeyDown(e)) return;
     if (
       editTagSuggestions.showTagSuggestions &&
       editTagSuggestions.tagMentionsRef.current
@@ -259,27 +268,6 @@ const NestedChecklistItemComponent = ({
   const displayText = showEmojis ? `${emoji}  ${cleanText}` : cleanText;
   const hasChildren = item.children && item.children.length > 0;
 
-  const renderTextWithHashtags = (text: string): React.ReactNode[] => {
-    const hashtagPattern = /#([a-zA-Z][a-zA-Z0-9_/-]*)/g;
-    const parts: React.ReactNode[] = [];
-    let lastIndex = 0;
-    let match;
-    while ((match = hashtagPattern.exec(text)) !== null) {
-      if (match.index > lastIndex) {
-        parts.push(text.slice(lastIndex, match.index));
-      }
-      parts.push(
-        <span key={match.index} onMouseDown={(e) => e.stopPropagation()}>
-          <TagLinkViewComponent tag={match[1]} />
-        </span>
-      );
-      lastIndex = match.index + match[0].length;
-    }
-    if (lastIndex < text.length) {
-      parts.push(text.slice(lastIndex));
-    }
-    return parts;
-  };
   const isChild = level > 0;
 
   const dropdownOptions = [
@@ -412,6 +400,7 @@ const NestedChecklistItemComponent = ({
                           />
                         </div>
                       )}
+                    <ItemLinkPopup suggestions={editLinkSuggestions} />
                     <Button
                       variant="ghost"
                       size="sm"
@@ -466,7 +455,7 @@ const NestedChecklistItemComponent = ({
                       !isPublicView
                     ) && (
                       <span className="break-words min-w-0">
-                        {tagsEnabled ? renderTextWithHashtags(displayText) : displayText}
+                        <ChecklistItemText text={displayText} tagsEnabled={!!tagsEnabled} />
                       </span>
                     )}
                   </label>
@@ -497,7 +486,7 @@ const NestedChecklistItemComponent = ({
                             : "text-foreground",
                         )}
                       >
-                        {tagsEnabled ? renderTextWithHashtags(displayText) : displayText}
+                        <ChecklistItemText text={displayText} tagsEnabled={!!tagsEnabled} />
                       </span>
                     )}
                 </div>
@@ -642,6 +631,7 @@ const NestedChecklistItemComponent = ({
                     />
                   </div>
                 )}
+              <ItemLinkPopup suggestions={subItemLinkSuggestions} />
               <form
                 onSubmit={handleAddSubItem}
                 className="flex gap-2 items-center pr-4"
@@ -652,7 +642,10 @@ const NestedChecklistItemComponent = ({
                   type="text"
                   value={newSubItemText}
                   onChange={subItemTagSuggestions.handleChange}
-                  onKeyDown={subItemTagSuggestions.handleKeyDown}
+                  onKeyDown={(e) => {
+                    if (subItemLinkSuggestions.handleKeyDown(e)) return;
+                    subItemTagSuggestions.handleKeyDown(e);
+                  }}
                   placeholder={t("checklists.addSubItemPlaceholder")}
                   autoFocus
                 />
diff --git a/app/_components/FeatureComponents/Kanban/ArchivedItemsModal.tsx b/app/_components/FeatureComponents/Kanban/ArchivedItemsModal.tsx
index 6181155a8..484fcd321 100644
--- a/app/_components/FeatureComponents/Kanban/ArchivedItemsModal.tsx
+++ b/app/_components/FeatureComponents/Kanban/ArchivedItemsModal.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import { plainItemText } from "@/app/_utils/item-href-utils";
 import { useState, useMemo } from "react";
 import { Archive02Icon } from "hugeicons-react";
 import { Modal } from "@/app/_components/GlobalComponents/Modals/Modal";
@@ -105,7 +106,7 @@ export const ArchivedItemsModal = ({
                 }}
               >
                 <div className="flex-1 min-w-0">
-                  <p className="text-md lg:text-sm font-medium truncate">{item.text}</p>
+                  <p className="text-md lg:text-sm font-medium truncate">{plainItemText(item.text)}</p>
                   <div className="flex items-center gap-2 mt-1">
                     {item.archivedAt && (
                       <p className="text-md lg:text-xs text-muted-foreground">
diff --git a/app/_components/FeatureComponents/Kanban/CalendarView.tsx b/app/_components/FeatureComponents/Kanban/CalendarView.tsx
index 2ff5ee70f..2f54a185c 100644
--- a/app/_components/FeatureComponents/Kanban/CalendarView.tsx
+++ b/app/_components/FeatureComponents/Kanban/CalendarView.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import { plainItemText } from "@/app/_utils/item-href-utils";
 import { KeyboardEvent } from "react";
 import { Checklist, Item } from "@/app/_types";
 import { useCalendarView } from "@/app/_hooks/kanban/useCalendarView";
@@ -203,7 +204,7 @@ export const CalendarView = ({ checklist, onItemClick }: CalendarViewProps) => {
                 onClick={() => onItemClick?.(item)}
                 className="text-xs px-2 py-1 rounded-jotty border border-border bg-muted/30 text-foreground cursor-pointer hover:bg-muted/50 transition-colors"
               >
-                {item.text}
+                {plainItemText(item.text)}
               </div>
             ))}
           </div>
diff --git a/app/_components/FeatureComponents/Kanban/Kanban.tsx b/app/_components/FeatureComponents/Kanban/Kanban.tsx
index 61cf6ee08..d80692ba6 100644
--- a/app/_components/FeatureComponents/Kanban/Kanban.tsx
+++ b/app/_components/FeatureComponents/Kanban/Kanban.tsx
@@ -258,7 +258,7 @@ export const Kanban = ({ checklist, onUpdate }: KanbanBoardProps) => {
       <div
         className={
           columns.length <= 6
-            ? "h-full min-w-0 kanban-grid gap-4 p-2 sm:p-4"
+            ? "min-h-full min-w-0 kanban-grid gap-4 p-2 sm:p-4"
             : "min-h-0 min-w-0 flex gap-4 p-2 sm:p-4"
         }
         style={
diff --git a/app/_components/FeatureComponents/Kanban/KanbanCard.tsx b/app/_components/FeatureComponents/Kanban/KanbanCard.tsx
index 178025b88..c55583f2f 100644
--- a/app/_components/FeatureComponents/Kanban/KanbanCard.tsx
+++ b/app/_components/FeatureComponents/Kanban/KanbanCard.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import { plainItemText } from "@/app/_utils/item-href-utils";
 import { useDragItem } from "@/app/_hooks/dnd";
 import { Item, Checklist, KanbanStatus } from "@/app/_types";
 import { cn } from "@/app/_utils/global-utils";
@@ -172,7 +173,7 @@ const KanbanCardComponent = ({
           style={style}
           {...handleProps}
           tabIndex={0}
-          aria-label={item.text}
+          aria-label={plainItemText(item.text)}
           onDoubleClick={() => onOpenDetail(item)}
           className={cn(
             "group bg-background border rounded-jotty p-3 transition-all duration-200 hover:shadow-md cursor-grab active:cursor-grabbing min-w-0",
diff --git a/app/_components/FeatureComponents/Kanban/KanbanCardDetail.tsx b/app/_components/FeatureComponents/Kanban/KanbanCardDetail.tsx
index 97388e9a2..a0a680c4d 100644
--- a/app/_components/FeatureComponents/Kanban/KanbanCardDetail.tsx
+++ b/app/_components/FeatureComponents/Kanban/KanbanCardDetail.tsx
@@ -1,6 +1,9 @@
 "use client";
 
-import { useState, useEffect, useMemo } from "react";
+import { plainItemText } from "@/app/_utils/item-href-utils";
+import { useState, useEffect, useMemo, useRef } from "react";
+import { useItemLinkSuggestions } from "@/app/_hooks/useItemLinkSuggestions";
+import { ItemLinkPopup } from "@/app/_components/FeatureComponents/Checklists/Parts/Common/ItemLinkPopup";
 import { Modal } from "@/app/_components/GlobalComponents/Modals/Modal";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { Item, Checklist, KanbanPriority } from "@/app/_types";
@@ -94,6 +97,8 @@ export const KanbanCardDetail = ({
   const [item, setItem] = useState(initialItem);
   const [isEditing, setIsEditing] = useState(false);
   const [editText, setEditText] = useState(initialItem.text);
+  const titleInputRef = useRef<HTMLInputElement>(null);
+  const titleLinks = useItemLinkSuggestions(editText, setEditText, titleInputRef);
   const [editDescription, setEditDescription] = useState(_unsanitizeDescription(initialItem.description || ""));
   const [scoreInput, setScoreInput] = useState(initialItem.score?.toString() || "");
   const [reminderInput, setReminderInput] = useState(initialItem.reminder?.datetime || "");
@@ -423,7 +428,7 @@ export const KanbanCardDetail = ({
       <Modal
         isOpen={isOpen}
         onClose={onClose}
-        title={item.text || t("checklists.untitledTask")}
+        title={plainItemText(item.text) || t("checklists.untitledTask")}
         size="fullscreen"
         allowEnlarge
         defaultEnlarged
@@ -439,16 +444,19 @@ export const KanbanCardDetail = ({
                   {t("kanban.itemTitle")}
                 </label>
                 <input
+                  ref={titleInputRef}
                   type="text"
                   value={editText}
                   onChange={(e) => setEditText(e.target.value)}
                   className="w-full px-3 py-2 bg-background border border-input rounded-jotty focus:outline-none focus:border-ring transition-all text-base"
                   placeholder={t("checklists.enterTaskTitle")}
                   onKeyDown={(e) => {
+                    if (titleLinks.handleKeyDown(e)) return;
                     if (e.key === "Enter" && !e.shiftKey) { e.preventDefault(); handleSave(); }
                     else if (e.key === "Escape") { e.preventDefault(); setEditText(item.text); setEditDescription(_unsanitizeDescription(item.description || "")); setIsEditing(false); }
                   }}
                 />
+                <ItemLinkPopup suggestions={titleLinks} />
               </div>
               <div>
                 <label className="block text-sm font-medium text-foreground mb-2">
diff --git a/app/_components/FeatureComponents/Kanban/KanbanCardDetailSubtasks.tsx b/app/_components/FeatureComponents/Kanban/KanbanCardDetailSubtasks.tsx
index 2d58ed9a5..a342d45a7 100644
--- a/app/_components/FeatureComponents/Kanban/KanbanCardDetailSubtasks.tsx
+++ b/app/_components/FeatureComponents/Kanban/KanbanCardDetailSubtasks.tsx
@@ -1,6 +1,8 @@
 "use client";
 
-import { useState } from "react";
+import { useRef, useState } from "react";
+import { useItemLinkSuggestions } from "@/app/_hooks/useItemLinkSuggestions";
+import { ItemLinkPopup } from "@/app/_components/FeatureComponents/Checklists/Parts/Common/ItemLinkPopup";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { Item, Checklist } from "@/app/_types";
 import { NestedChecklistItem } from "@/app/_components/FeatureComponents/Checklists/Parts/Simple/NestedChecklistItem";
@@ -32,6 +34,8 @@ export const KanbanCardDetailSubtasks = ({
 }: KanbanCardDetailSubtasksProps) => {
   const t = useTranslations();
   const [newSubtaskText, setNewSubtaskText] = useState("");
+  const subtaskInputRef = useRef<HTMLInputElement>(null);
+  const subtaskLinks = useItemLinkSuggestions(newSubtaskText, setNewSubtaskText, subtaskInputRef);
 
   const handleAdd = () => {
     if (!newSubtaskText.trim()) return;
@@ -101,18 +105,21 @@ export const KanbanCardDetailSubtasks = ({
       {canEdit && (
         <div className="flex gap-2">
           <input
+            ref={subtaskInputRef}
             type="text"
             value={newSubtaskText}
             onChange={(e) => setNewSubtaskText(e.target.value)}
             placeholder={t("checklists.addSubtask")}
             className="flex-1 px-3 py-2 text-sm bg-background border border-input rounded-jotty focus:outline-none focus:border-ring transition-all"
             onKeyDown={(e) => {
+              if (subtaskLinks.handleKeyDown(e)) return;
               if (e.key === "Enter" && !e.shiftKey) {
                 e.preventDefault();
                 handleAdd();
               }
             }}
           />
+          <ItemLinkPopup suggestions={subtaskLinks} />
           <Button
             onClick={handleAdd}
             disabled={!newSubtaskText.trim()}
diff --git a/app/_components/FeatureComponents/Kanban/KanbanColumn.tsx b/app/_components/FeatureComponents/Kanban/KanbanColumn.tsx
index 9b3330425..dec922735 100644
--- a/app/_components/FeatureComponents/Kanban/KanbanColumn.tsx
+++ b/app/_components/FeatureComponents/Kanban/KanbanColumn.tsx
@@ -1,6 +1,8 @@
 "use client";
 
 import { useMemo, memo, useState, useRef, useEffect } from "react";
+import { useItemLinkSuggestions } from "@/app/_hooks/useItemLinkSuggestions";
+import { ItemLinkPopup } from "@/app/_components/FeatureComponents/Checklists/Parts/Common/ItemLinkPopup";
 import { useDropList } from "@/app/_hooks/dnd";
 import { Item, Checklist, KanbanStatus } from "@/app/_types";
 import { KanbanCard } from "./KanbanCard";
@@ -42,12 +44,14 @@ const InlineAddInput = ({
 }: InlineAddInputProps) => {
   const [text, setText] = useState("");
   const inputRef = useRef<HTMLInputElement>(null);
+  const linkSuggestions = useItemLinkSuggestions(text, setText, inputRef);
 
   useEffect(() => {
     inputRef.current?.focus();
   }, []);
 
   const handleKeyDown = (e: React.KeyboardEvent<HTMLInputElement>) => {
+    if (linkSuggestions.handleKeyDown(e)) return;
     if (e.key === "Enter") {
       e.preventDefault();
       if (text.trim()) onSubmit(text.trim());
@@ -58,18 +62,22 @@ const InlineAddInput = ({
   };
 
   return (
-    <Input
-      id="inline-add-input"
-      type="text"
-      value={text}
-      onChange={(e) => setText(e.target.value)}
-      onKeyDown={handleKeyDown}
-      onBlur={() => {
-        if (!text.trim()) onCancel();
-      }}
-      placeholder={placeholder}
-      disabled={isLoading}
-    />
+    <>
+      <Input
+        id="inline-add-input"
+        ref={inputRef}
+        type="text"
+        value={text}
+        onChange={(e) => setText(e.target.value)}
+        onKeyDown={handleKeyDown}
+        onBlur={() => {
+          if (!text.trim()) onCancel();
+        }}
+        placeholder={placeholder}
+        disabled={isLoading}
+      />
+      <ItemLinkPopup suggestions={linkSuggestions} />
+    </>
   );
 };
 
diff --git a/app/_components/FeatureComponents/Kanban/KanbanItemContent.tsx b/app/_components/FeatureComponents/Kanban/KanbanItemContent.tsx
index fddbcdbfd..38eb97a6c 100644
--- a/app/_components/FeatureComponents/Kanban/KanbanItemContent.tsx
+++ b/app/_components/FeatureComponents/Kanban/KanbanItemContent.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import { plainItemText } from "@/app/_utils/item-href-utils";
 import { memo, type JSX } from "react";
 import { UserAvatar } from "@/app/_components/GlobalComponents/User/UserAvatar";
 import { Dropdown } from "@/app/_components/GlobalComponents/Dropdowns/Dropdown";
@@ -9,6 +10,7 @@ import { TaskStatusLabels } from "@/app/_types/enums";
 import { usePermissions } from "@/app/_providers/PermissionsProvider";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { useTranslations } from "next-intl";
+import { ChecklistItemText } from "@/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistItemText";
 
 interface KanbanItemContentProps {
   item: Item;
@@ -52,7 +54,7 @@ const KanbanItemContentComponent = ({
   formatDateTimeString,
 }: KanbanItemContentProps) => {
   const { permissions } = usePermissions();
-  const { user } = useAppMode();
+  const { user, tagsEnabled } = useAppMode();
   const t = useTranslations();
   const hideStatus = user?.hideStatusOnCards === "enable";
 
@@ -94,12 +96,12 @@ const KanbanItemContentComponent = ({
           ) : (
             <p
               className="text-md lg:text-sm font-medium text-foreground leading-tight truncate cursor-pointer"
-              title={item.text}
+              title={plainItemText(item.text)}
               onPointerDown={(e) => e.stopPropagation()}
               onMouseDown={(e) => onShowSubtaskModal()}
               onClick={(e) => onShowSubtaskModal()}
             >
-              {item.text}
+              <ChecklistItemText text={item.text} tagsEnabled={tagsEnabled} compact />
             </p>
           )}
         </div>
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/CalloutExtension.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/CalloutExtension.tsx
index 986f0ebe3..a6523a927 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/CalloutExtension.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/CalloutExtension.tsx
@@ -16,8 +16,7 @@ import {
 } from "hugeicons-react";
 import { useTranslations } from "next-intl";
 import { DropdownMenu } from "@/app/_components/GlobalComponents/Dropdowns/DropdownMenu";
-
-export type CalloutType = "info" | "warning" | "success" | "danger";
+import { CalloutType } from "@/app/_consts/callouts";
 
 const CalloutIcons: Record<CalloutType, typeof Idea01Icon> = {
   info: Idea01Icon,
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx
index 5d0dde360..cbb01f026 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import React, { useState, useEffect, useCallback, useMemo } from "react";
+import { createPortal } from "react-dom";
 import { NodeViewWrapper } from "@tiptap/react";
 import { File02Icon, CheckmarkSquare04Icon, TaskDaily01Icon } from "hugeicons-react";
 import { useRouter } from "next/navigation";
@@ -19,6 +20,7 @@ import { isKanbanType, ItemTypes } from "@/app/_types/enums";
 interface InternalLinkAttrs {
   href: string;
   title: string;
+  alias?: string;
   type?: string;
   category?: string;
   uuid?: string;
@@ -27,6 +29,7 @@ interface InternalLinkAttrs {
 
 interface InternalLinkComponentProps {
   node: { attrs: InternalLinkAttrs };
+  showCategory?: boolean;
 }
 
 type LinkedItem = Partial<Note> | Partial<Checklist>;
@@ -46,12 +49,13 @@ const _fetchItem = async (uuid: string, type?: ItemTypes): Promise<Note | Checkl
   return null;
 };
 
-export const InternalLinkComponent = ({ node }: InternalLinkComponentProps) => {
+export const InternalLinkComponent = ({ node, showCategory = true }: InternalLinkComponentProps) => {
   const t = useTranslations();
   const router = useRouter();
-  const { href, title, uuid: attrUuid, category } = node.attrs;
+  const { href, title, alias, uuid: attrUuid, category } = node.attrs;
   const { appSettings, notes, checklists } = useAppMode();
   const [showPopup, setShowPopup] = useState(false);
+  const [anchor, setAnchor] = useState<{ top: number; left: number } | null>(null);
   const [loadedItem, setLoadedItem] = useState<Note | Checklist | null>(null);
   const [isLoading, setIsLoading] = useState(false);
 
@@ -111,21 +115,34 @@ export const InternalLinkComponent = ({ node }: InternalLinkComponentProps) => {
     router.push(href);
   };
 
-  const label = item?.title || title;
+  const label = alias || item?.title || title;
   const shownCategory = item?.category || target?.legacy?.category || category;
+  const folder = shownCategory?.split("/").filter(Boolean).pop();
+  const unreachable = !item && !isLoading;
+  const Icon = isChecklist(item)
+    ? isKanbanType(item.type)
+      ? TaskDaily01Icon
+      : CheckmarkSquare04Icon
+    : File02Icon;
 
   return (
     <NodeViewWrapper
       as="span"
       onClick={handleClick}
-      onMouseEnter={() => setShowPopup(true)}
+      onMouseEnter={(event: React.MouseEvent<HTMLElement>) => {
+        const rect = event.currentTarget.getBoundingClientRect();
+        setAnchor({ top: rect.bottom, left: rect.left });
+        setShowPopup(true);
+      }}
       onMouseLeave={() => setShowPopup(false)}
-      className="inline-flex items-center gap-1.5 mx-1 px-2 py-1 bg-primary/10 border border-primary/20 rounded-jotty hover:bg-primary/15 transition-colors cursor-pointer group relative"
+      title={unreachable ? t("relations.unreachable") : shownCategory || undefined}
+      className={`inline cursor-pointer hover:underline ${unreachable ? "text-muted-foreground" : "text-primary"}`}
     >
-      {showPopup && (
+      {showPopup && anchor && typeof document !== "undefined" && createPortal(
         <span
           data-link-preview=""
-          className="block absolute top-[110%] left-0 min-w-[300px] max-w-[400px] z-10"
+          style={{ top: anchor.top, left: anchor.left }}
+          className="block fixed pt-1.5 min-w-[300px] max-w-[400px] z-50"
         >
           {isLoading ? (
             <span className="block bg-card border border-border rounded-jotty p-4 text-muted-foreground text-sm">
@@ -140,34 +157,15 @@ export const InternalLinkComponent = ({ node }: InternalLinkComponentProps) => {
               {label}
             </span>
           )}
-        </span>
+        </span>,
+        document.body,
       )}
-      <span className="flex-shrink-0">
-        {isChecklist(item) ? (
-          isKanbanType(item.type) ? (
-            <TaskDaily01Icon className="h-5 w-5" />
-          ) : (
-            <CheckmarkSquare04Icon className="h-5 w-5" />
-          )
-        ) : (
-          <File02Icon className="h-5 w-5" />
-        )}
-      </span>
-      <span className="text-md lg:text-sm font-medium text-foreground">
+      <Icon className="inline h-[1em] w-[1em] mr-1 align-[-0.125em]" />
+      <span className="font-medium">
         {appSettings?.parseContent === "yes" ? label : capitalize(label.replace(/-/g, " "))}
       </span>
-      {shownCategory && (
-        <>
-          ·
-          <span className="text-md lg:text-sm font-medium text-foreground bg-primary/30 px-2 py-0.5 rounded-jotty">
-            {shownCategory}
-          </span>
-        </>
-      )}
-      {!item && !isLoading && (
-        <span className="text-md lg:text-xs text-muted-foreground">
-          {t("relations.unreachable")}
-        </span>
+      {showCategory && folder && !unreachable && (
+        <span className="ml-1 text-[0.85em] text-muted-foreground">· {folder}</span>
       )}
     </NodeViewWrapper>
   );
diff --git a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
index f958899cb..d06216904 100644
--- a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
@@ -29,6 +29,8 @@ import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
 import { currentOrigins, parseItemHref } from "@/app/_utils/item-href-utils";
 import { remarkWikilinks, WIKILINK_TAG } from "@/app/_utils/wikilink-utils";
 import { WikiLink } from "./WikiLink";
+import { matchCallout } from "@/app/_utils/callout-utils";
+import { CalloutType } from "@/app/_consts/callouts";
 
 type WikiLinkComponents = Record<
   typeof WIKILINK_TAG,
@@ -298,7 +300,7 @@ export const UnifiedMarkdownRenderer = ({
     },
     blockquote({ node, children, ...props }) {
       const childArray = Children.toArray(children);
-      let calloutType: "info" | "warning" | "success" | "danger" | null = null;
+      let calloutType: CalloutType | null = null;
       let matchIndex = -1;
 
       for (let i = 0; i < childArray.length; i++) {
@@ -308,15 +310,9 @@ export const UnifiedMarkdownRenderer = ({
           const textContent = getRawTextFromChildren(
             childProps?.children as React.ReactNode,
           );
-          const match = textContent.match(
-            /^\[!(INFO|WARNING|SUCCESS|DANGER)\]/i,
-          );
-          if (match) {
-            calloutType = match[1].toLowerCase() as
-              | "info"
-              | "warning"
-              | "success"
-              | "danger";
+          const callout = matchCallout(textContent);
+          if (callout) {
+            calloutType = callout.type;
             matchIndex = i;
             break;
           }
@@ -341,12 +337,10 @@ export const UnifiedMarkdownRenderer = ({
             if (prefixStripped) return child;
 
             if (typeof child === "string") {
-              const match = child.match(
-                /^\[!(INFO|WARNING|SUCCESS|DANGER)\]\s*/i,
-              );
-              if (match) {
+              const callout = matchCallout(child);
+              if (callout) {
                 prefixStripped = true;
-                const remaining = child.replace(match[0], "");
+                const remaining = child.replace(callout.marker, "");
                 return remaining || null;
               }
               return child;
diff --git a/app/_components/FeatureComponents/Notes/Parts/WikiLink.tsx b/app/_components/FeatureComponents/Notes/Parts/WikiLink.tsx
index bfbecc7b1..d6bda6085 100644
--- a/app/_components/FeatureComponents/Notes/Parts/WikiLink.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/WikiLink.tsx
@@ -16,6 +16,7 @@ import { InternalLinkComponent } from "./TipTap/CustomExtensions/InternalLinkCom
 interface WikiLinkProps {
   target?: string;
   label?: string;
+  showCategory?: boolean;
 }
 
 interface Candidate {
@@ -32,15 +33,11 @@ const byAge = (a: Candidate, b: Candidate) =>
   (a.createdAt || "").localeCompare(b.createdAt || "") ||
   (a.uuid || "").localeCompare(b.uuid || "");
 
-export const WikiLink = ({ target = "", label }: WikiLinkProps) => {
-  const t = useTranslations();
-  const router = useRouter();
+export const useWikiMatch = (target: string): Candidate | null => {
   const { notes, checklists, user } = useAppMode();
   const { wikis } = useRelations();
-  const metadata = useOptionalMetadata();
-  const [isCreating, setIsCreating] = useState(false);
 
-  const match = useMemo(() => {
+  return useMemo(() => {
     const key = titleKey(target);
     const candidates: Candidate[] = [
       ...notes.map((item) => ({ ...item, type: ItemTypes.NOTE })),
@@ -59,16 +56,28 @@ export const WikiLink = ({ target = "", label }: WikiLinkProps) => {
         .sort(byAge)[0] || null
     );
   }, [notes, checklists, target, wikis, user?.username]);
+};
+
+export const WikiLink = ({ target = "", label, showCategory = true }: WikiLinkProps) => {
+  const t = useTranslations();
+  const router = useRouter();
+  const { user } = useAppMode();
+  const metadata = useOptionalMetadata();
+  const [isCreating, setIsCreating] = useState(false);
+
+  const match = useWikiMatch(target);
 
   if (!user) return <span>{label || target}</span>;
 
   if (match) {
     return (
       <InternalLinkComponent
+        showCategory={showCategory}
         node={{
           attrs: {
             href: itemHref(match.type, match.uuid!),
-            title: label || target,
+            title: target,
+            alias: label,
             type: match.type,
             uuid: match.uuid!,
           },
@@ -99,15 +108,19 @@ export const WikiLink = ({ target = "", label }: WikiLinkProps) => {
   };
 
   return (
-    <button
-      type="button"
+    <span
+      role="button"
+      tabIndex={0}
+      aria-disabled={isCreating}
       onClick={createFromGhost}
-      disabled={isCreating}
+      onKeyDown={(event) => {
+        if (event.key === "Enter") createFromGhost();
+      }}
       title={t("relations.createFromWikilink", { title: target })}
-      className="inline-flex items-center gap-1.5 mx-1 px-2 py-0.5 border border-dashed border-muted-foreground/50 text-muted-foreground rounded-jotty hover:border-primary hover:text-primary transition-colors"
+      className="inline cursor-pointer text-muted-foreground underline decoration-dashed underline-offset-4 hover:text-primary transition-colors"
     >
-      <FileAddIcon className="h-4 w-4" />
-      <span className="text-md lg:text-sm">{label || target}</span>
-    </button>
+      <FileAddIcon className="inline h-[1em] w-[1em] mr-1 align-[-0.125em]" />
+      {label || target}
+    </span>
   );
 };
diff --git a/app/_consts/callouts.ts b/app/_consts/callouts.ts
new file mode 100644
index 000000000..aa58c421a
--- /dev/null
+++ b/app/_consts/callouts.ts
@@ -0,0 +1,17 @@
+export type CalloutType = "info" | "warning" | "success" | "danger";
+
+export const CALLOUT_ALIASES: Record<string, CalloutType> = {
+  info: "info",
+  warning: "warning",
+  success: "success",
+  danger: "danger",
+  note: "info",
+  tip: "success",
+  important: "warning",
+  caution: "danger",
+};
+
+export const CALLOUT_MARKER = new RegExp(
+  `^\\[!(${Object.keys(CALLOUT_ALIASES).join("|")})\\]\\s*`,
+  "i",
+);
diff --git a/app/_consts/user-settings.ts b/app/_consts/user-settings.ts
index cddd75bb4..b617e915e 100644
--- a/app/_consts/user-settings.ts
+++ b/app/_consts/user-settings.ts
@@ -29,6 +29,7 @@ export const EDITABLE_SETTING_KEYS: ReadonlyArray<keyof User> = [
   "hideMobileStatusDropdown",
   "hideTimeTrackingOnCards",
   "codeBlockStyle",
+  "newItemInsertion",
 ] as const;
 
 export const EDITABLE_ENCRYPTION_KEYS = [
diff --git a/app/_hooks/useItemLinkSuggestions.ts b/app/_hooks/useItemLinkSuggestions.ts
new file mode 100644
index 000000000..98f0e663e
--- /dev/null
+++ b/app/_hooks/useItemLinkSuggestions.ts
@@ -0,0 +1,114 @@
+"use client";
+
+import { RefObject, useEffect, useMemo, useRef, useState } from "react";
+import { useAppMode } from "@/app/_providers/AppModeProvider";
+import { itemHref } from "@/app/_utils/global-utils";
+import { escapeLinkText } from "@/app/_utils/item-href-utils";
+import { ItemTypes } from "@/app/_types/enums";
+
+const LINK_TRIGGER = /(?:^|\s)(@|\[\[)([^\s@[\]]*(?: [^\s@[\]]+)*)$/;
+const AT_TRIGGER = "@";
+const SUGGESTION_LIMIT = 20;
+
+export interface LinkSuggestion {
+  id: string;
+  title: string;
+  type: ItemTypes;
+  category: string;
+}
+
+interface LinkQuery {
+  start: number;
+  query: string;
+}
+
+type ListHandle = { onKeyDown: (event: KeyboardEvent) => boolean; focusSearch: () => void };
+
+export const linkQueryOf = (text: string): LinkQuery | null => {
+  const match = text.match(LINK_TRIGGER);
+  if (!match || match.index === undefined) return null;
+  const [whole, trigger, query] = match;
+  if (trigger === AT_TRIGGER && query.includes(" ")) return null;
+  return { start: match.index + whole.length - trigger.length - query.length, query };
+};
+
+export const useItemLinkSuggestions = (
+  value: string,
+  setValue: (next: string) => void,
+  inputRef: RefObject<HTMLInputElement | HTMLTextAreaElement | null>,
+) => {
+  const { notes, checklists, appSettings } = useAppMode();
+  const enabled = appSettings?.editor?.enableBilateralLinks !== false;
+  const [dismissed, setDismissed] = useState<string | null>(null);
+  const [position, setPosition] = useState({ top: 0, left: 0 });
+  const listRef = useRef<ListHandle | null>(null);
+  const wrapperRef = useRef<HTMLDivElement | null>(null);
+
+  const found = enabled ? linkQueryOf(value) : null;
+  const open = Boolean(found) && dismissed !== value;
+
+  const items = useMemo<LinkSuggestion[]>(() => {
+    if (!found) return [];
+    const needle = found.query.toLowerCase();
+    return [
+      ...notes.map((note) => ({ ...note, type: ItemTypes.NOTE })),
+      ...checklists.map((list) => ({ ...list, type: ItemTypes.CHECKLIST })),
+    ]
+      .filter((item) => item.uuid && (item.title || "").toLowerCase().includes(needle))
+      .slice(0, SUGGESTION_LIMIT)
+      .map((item) => ({
+        id: item.uuid!,
+        title: item.title || "",
+        type: item.type,
+        category: item.category || "",
+      }));
+  }, [found?.query, notes, checklists]);
+
+  useEffect(() => {
+    if (!open || !inputRef.current) return;
+    const rect = inputRef.current.getBoundingClientRect();
+    setPosition({ top: rect.bottom + 4, left: rect.left });
+  }, [open, inputRef]);
+
+  useEffect(() => {
+    if (!open) return;
+    const close = (event: MouseEvent) => {
+      const target = event.target as Node;
+      if (wrapperRef.current?.contains(target) || inputRef.current?.contains(target)) return;
+      setDismissed(value);
+    };
+    document.addEventListener("mousedown", close);
+    return () => document.removeEventListener("mousedown", close);
+  }, [open, value, inputRef]);
+
+  const pick = (item: LinkSuggestion) => {
+    if (!found) return;
+    const link = `[${escapeLinkText(item.title)}](${itemHref(item.type, item.id)}) `;
+    setValue(`${value.slice(0, found.start)}${link}`);
+    inputRef.current?.focus();
+  };
+
+  const handleKeyDown = (event: React.KeyboardEvent): boolean => {
+    if (!open || items.length === 0 || !listRef.current) return false;
+    if (event.key === "Escape") {
+      setDismissed(value);
+      event.preventDefault();
+      return true;
+    }
+    const handled = listRef.current.onKeyDown(event.nativeEvent);
+    if (handled) event.preventDefault();
+    return handled;
+  };
+
+  return {
+    open: open && items.length > 0,
+    items,
+    position,
+    pick,
+    handleKeyDown,
+    listRef,
+    wrapperRef,
+  };
+};
+
+export type ItemLinkSuggestions = ReturnType<typeof useItemLinkSuggestions>;
diff --git a/app/_server/actions/relations/indexer.ts b/app/_server/actions/relations/indexer.ts
index 2739824ce..e66d622a1 100644
--- a/app/_server/actions/relations/indexer.ts
+++ b/app/_server/actions/relations/indexer.ts
@@ -285,6 +285,51 @@ const _reconcile = async (force = false): Promise<number> => {
   return changed;
 };
 
+const _statOf = (target: string) => fs.stat(target).catch(() => null);
+
+const _refreshPath = async (target: string, indexed: Map<string, number>): Promise<boolean> => {
+  const absPath = path.resolve(target);
+  const stats = await _statOf(absPath);
+
+  if (!stats) {
+    if (indexed.has(absPath)) {
+      forgetItemFile(absPath);
+      return true;
+    }
+    const before = indexed.size;
+    forgetItemTree(absPath);
+    return _indexedMtimes().size !== before;
+  }
+
+  if (stats.isDirectory()) {
+    await indexItemTree(absPath);
+    await forgetMissing(absPath);
+    return true;
+  }
+
+  if (!itemFileInfo(absPath)) return false;
+  const mtime = Math.floor(stats.mtimeMs);
+  if (indexed.get(absPath) === mtime) return false;
+  await _indexFromDisk(absPath, mtime);
+  return true;
+};
+
+export const refreshItemPaths = async (targets: string[]): Promise<number> => {
+  const indexed = _indexedMtimes();
+  let changed = 0;
+  for (const target of targets) {
+    try {
+      if (await _refreshPath(target, indexed)) changed++;
+    } catch (error) {
+      console.error(`Relations could not refresh ${target}:`, error);
+    }
+  }
+  if (changed > 0) {
+    await broadcast({ type: "relations", action: "updated", username: RELATIONS_ACTOR });
+  }
+  return changed;
+};
+
 export const reconcileRelations = (force = false): Promise<number> =>
   singleFlight(`relations:reconcile:${force}`, async () => {
     try {
@@ -331,7 +376,9 @@ declare global {
 export const ensureRelations = (): RelationsStatus => {
   const status = relationsStatus();
   const checkedAt = globalThis.__jottyRelationsCheckedAt || 0;
-  if (status === RelationsStatus.BUILDING || Date.now() - checkedAt > RECONCILE_EVERY_MS) {
+  const watched = Boolean(globalThis.__jottyRelationsWatch?.healthy);
+  const stale = !watched && Date.now() - checkedAt > RECONCILE_EVERY_MS;
+  if (status === RelationsStatus.BUILDING || stale) {
     globalThis.__jottyRelationsCheckedAt = Date.now();
     void reconcileRelations();
   }
diff --git a/app/_server/actions/relations/watcher.ts b/app/_server/actions/relations/watcher.ts
new file mode 100644
index 000000000..2c501049b
--- /dev/null
+++ b/app/_server/actions/relations/watcher.ts
@@ -0,0 +1,122 @@
+import fs from "fs";
+import path from "path";
+import { itemTreeRoots } from "./paths";
+import { refreshItemPaths } from "./indexer";
+
+export const WATCH_FLUSH_MS = 60_000;
+export const WATCH_SETTLE_MS = 1_000;
+const ARCHIVE_DIR = ".archive";
+
+interface Batcher {
+  add: (target: string) => void;
+  stop: () => void;
+}
+
+interface WatchState {
+  watchers: fs.FSWatcher[];
+  batcher: Batcher;
+  healthy: boolean;
+}
+
+declare global {
+  var __jottyRelationsWatch: WatchState | undefined;
+}
+
+export const throttledBatch = (
+  flush: (targets: string[]) => Promise<unknown>,
+  everyMs: number,
+  settleMs = WATCH_SETTLE_MS,
+  now: () => number = Date.now,
+): Batcher => {
+  const dirty = new Set<string>();
+  let lastFlush = -Infinity;
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  let running = false;
+
+  const run = async () => {
+    timer = null;
+    if (running) {
+      schedule();
+      return;
+    }
+    running = true;
+    lastFlush = now();
+    const targets = Array.from(dirty);
+    dirty.clear();
+    try {
+      await flush(targets);
+    } catch (error) {
+      console.error("Relations watch flush failed:", error);
+    } finally {
+      running = false;
+      if (dirty.size > 0) schedule();
+    }
+  };
+
+  const schedule = () => {
+    if (timer) return;
+    const wait = Math.max(settleMs, lastFlush + everyMs - now());
+    timer = setTimeout(run, wait);
+    timer.unref?.();
+  };
+
+  return {
+    add: (target) => {
+      dirty.add(target);
+      schedule();
+    },
+    stop: () => {
+      if (timer) clearTimeout(timer);
+      timer = null;
+      dirty.clear();
+    },
+  };
+};
+
+const _ignored = (filename: string): boolean =>
+  filename
+    .split(/[\\/]+/)
+    .some((part) => part.startsWith(".") && part !== ARCHIVE_DIR);
+
+const _unhealthy = (state: WatchState, root: string, error: unknown) => {
+  console.error(`Relations watcher stopped for ${root}, falling back to periodic checks:`, error);
+  state.healthy = false;
+};
+
+export const watchingRelations = (): boolean =>
+  Boolean(globalThis.__jottyRelationsWatch?.healthy);
+
+export const stopWatchingRelations = () => {
+  const state = globalThis.__jottyRelationsWatch;
+  if (!state) return;
+  state.watchers.forEach((watcher) => watcher.close());
+  state.batcher.stop();
+  globalThis.__jottyRelationsWatch = undefined;
+};
+
+export const watchRelations = (): boolean => {
+  if (globalThis.__jottyRelationsWatch) return watchingRelations();
+
+  const state: WatchState = {
+    watchers: [],
+    batcher: throttledBatch(refreshItemPaths, WATCH_FLUSH_MS),
+    healthy: true,
+  };
+  globalThis.__jottyRelationsWatch = state;
+
+  for (const root of itemTreeRoots()) {
+    try {
+      const watcher = fs.watch(root, { recursive: true, persistent: false }, (_event, filename) => {
+        const name = filename?.toString();
+        if (!name || _ignored(name)) return;
+        state.batcher.add(path.join(root, name));
+      });
+      watcher.on("error", (error) => _unhealthy(state, root, error));
+      state.watchers.push(watcher);
+    } catch (error) {
+      _unhealthy(state, root, error);
+    }
+  }
+
+  return state.healthy;
+};
diff --git a/app/_server/actions/share/operations.ts b/app/_server/actions/share/operations.ts
index e6e072d4d..0599c9652 100644
--- a/app/_server/actions/share/operations.ts
+++ b/app/_server/actions/share/operations.ts
@@ -23,7 +23,7 @@ import {
   getUsername,
   isAdmin,
 } from "@/app/_server/actions/users";
-import { readCatInfo, writeCatInfo, catDirByUuid } from "./category-info";
+import { catDirByUuid, mutateCatInfo } from "./category-info";
 import { dropMounts } from "./mounts";
 import { resolveAccess, catAccess } from "./access";
 
@@ -378,14 +378,14 @@ export const shareFolder = async (
     const dir = await _catDir(mode, owner, categoryUuid);
     if (!dir) return { success: false, error: "Category not found" };
 
-    const info = await readCatInfo(dir);
-    const users = { ...(info.sharing?.users || {}), [receiver]: permissions };
-
-    const written = await writeCatInfo(dir, {
+    const written = await mutateCatInfo(dir, (info) => ({
       ...info,
       uuid: categoryUuid,
-      sharing: { users, inherit: info.sharing?.inherit !== false },
-    });
+      sharing: {
+        users: { ...(info.sharing?.users || {}), [receiver]: permissions },
+        inherit: info.sharing?.inherit !== false,
+      },
+    }));
 
     if (!written) return { success: false, error: "Failed to share folder" };
 
@@ -433,13 +433,10 @@ export const unshareFolder = async (
 
     if (!dir) return { success: false, error: "Category not found" };
 
-    const info = await readCatInfo(dir);
-    const users = { ...(info.sharing?.users || {}) };
-    delete users[receiver];
-
-    const written = await writeCatInfo(dir, {
-      ...info,
-      sharing: { users, inherit: info.sharing?.inherit !== false },
+    const written = await mutateCatInfo(dir, (info) => {
+      const users = { ...(info.sharing?.users || {}) };
+      delete users[receiver];
+      return { ...info, sharing: { users, inherit: info.sharing?.inherit !== false } };
     });
 
     if (!written) return { success: false, error: "Failed to unshare folder" };
@@ -476,13 +473,11 @@ export const setFolderInherit = async (
     const dir = await _catDir(mode, owner, categoryUuid);
     if (!dir) return { success: false, error: "Category not found" };
 
-    const info = await readCatInfo(dir);
-
-    const written = await writeCatInfo(dir, {
+    const written = await mutateCatInfo(dir, (info) => ({
       ...info,
       uuid: categoryUuid,
       sharing: { users: info.sharing?.users || {}, inherit },
-    });
+    }));
 
     if (!written) return { success: false, error: "Failed to update folder" };
 
@@ -601,23 +596,22 @@ export const leaveFolder = async (
       return { success: false, error: "Not shared with you" };
     }
 
-    const info = await readCatInfo(dir);
     const fromAbove = await catAccess(mode, path.dirname(dir));
     const isInherited = Boolean(fromAbove?.users[caller]);
 
-    const users = isInherited
-      ? { ...access.users }
-      : { ...(info.sharing?.users || {}) };
-
-    delete users[caller];
-
-    const written = await writeCatInfo(dir, {
-      ...info,
-      uuid: info.uuid || categoryUuid,
-      sharing: {
-        users,
-        inherit: isInherited ? false : info.sharing?.inherit !== false,
-      },
+    const written = await mutateCatInfo(dir, (info) => {
+      const users = isInherited
+        ? { ...access.users }
+        : { ...(info.sharing?.users || {}) };
+      delete users[caller];
+      return {
+        ...info,
+        uuid: info.uuid || categoryUuid,
+        sharing: {
+          users,
+          inherit: isInherited ? false : info.sharing?.inherit !== false,
+        },
+      };
     });
 
     if (!written) return { success: false, error: "Failed to leave share" };
diff --git a/app/_translations/de.json b/app/_translations/de.json
index a611be4cb..b47cc2306 100644
--- a/app/_translations/de.json
+++ b/app/_translations/de.json
@@ -1025,9 +1025,7 @@
     "enableBubbleMenuDescription": "Schwebende Werkzeugleiste aktivieren, die erscheint, wenn Text ausgewählt ist",
     "enableTableToolbarDescription": "Werkzeugleiste aktivieren, die erscheint, wenn Tabellen bearbeitet werden",
     "bilateralLinks": "Wechselseitige Verknüpfungen",
-    "experimental": "(experimentell)",
     "bilateralLinksDescription": "Funktion aktivieren, Notizen und Aufgabenlisten im gleichen Dokument zu verknüpfen",
-    "bilateralLinksWarning": "Diese Funktion ist experimentell und funktioniert evtl. nicht wie erwartet. Sie könnte in Zukunft auch wieder entfernt werden.",
     "configureExternalServices": "Konfiguriere externe Service-URLs für Editor-Erweiterungen.",
     "drawioUrl": "Draw.io-URL",
     "optional": "(optional)",
diff --git a/app/_translations/en.json b/app/_translations/en.json
index 60059d291..d44f4df80 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -1054,9 +1054,7 @@
     "enableBubbleMenuDescription": "Enable the floating toolbar that appears when text is selected",
     "enableTableToolbarDescription": "Enable the toolbar that appears when editing tables",
     "bilateralLinks": "Bilateral Links",
-    "experimental": "(Experimental)",
     "bilateralLinksDescription": "Enable the ability to link to notes and checklists in the same document.",
-    "bilateralLinksWarning": "This feature is experimental and may not work as expected. It may also end up being removed/deprecated in the future.",
     "historyEnabled": "Note History",
     "historyDescription": "Track version history for notes. Allows restoring previous versions. Only manual saves create history points (not autosave).",
     "disableHistory": "Disable History",
diff --git a/app/_translations/es.json b/app/_translations/es.json
index f6c6a24e8..8494153c0 100644
--- a/app/_translations/es.json
+++ b/app/_translations/es.json
@@ -1025,9 +1025,7 @@
     "enableBubbleMenuDescription": "Habilite la barra flotante que aparece al seleccionar texto",
     "enableTableToolbarDescription": "Habilite la barra de herramientas al editar tablas",
     "bilateralLinks": "Enlaces bilaterales",
-    "experimental": "(Experimental)",
     "bilateralLinksDescription": "Habilite la capacidad de enlazar notas y listas en el mismo documento.",
-    "bilateralLinksWarning": "Esta función es experimental y puede no funcionar como se espera. También puede ser eliminada o deprecada en el futuro.",
     "configureExternalServices": "Configure URLs de servicios externos para integraciones del editor.",
     "drawioUrl": "URL de Draw.io",
     "optional": "(Opcional)",
diff --git a/app/_translations/fr.json b/app/_translations/fr.json
index 56442a734..4d1f3dec6 100644
--- a/app/_translations/fr.json
+++ b/app/_translations/fr.json
@@ -1025,9 +1025,7 @@
     "enableBubbleMenuDescription": "Activer la barre d’outils flottante qui apparaît lorsque du texte est sélectionné",
     "enableTableToolbarDescription": "Activer la barre d’outils qui apparaît lors de l’édition de tableaux",
     "bilateralLinks": "Liens bilatéraux",
-    "experimental": "(Expérimental)",
     "bilateralLinksDescription": "Activer la possibilité de lier des notes et des listes dans le même document.",
-    "bilateralLinksWarning": "Cette fonctionnalité est expérimentale et peut ne pas fonctionner comme prévu. Elle pourrait aussi être supprimée/dépréciée à l’avenir.",
     "configureExternalServices": "Configurer les URL de services externes pour les intégrations de l’éditeur.",
     "drawioUrl": "URL de Draw.io",
     "optional": "(Optionnel)",
diff --git a/app/_translations/it.json b/app/_translations/it.json
index 0d6808c24..3673016c3 100644
--- a/app/_translations/it.json
+++ b/app/_translations/it.json
@@ -1025,9 +1025,7 @@
     "enableBubbleMenuDescription": "Abilita la toolbar galleggiante quando selezioni del testo",
     "enableTableToolbarDescription": "Abilita la toolbar che appare modificando le tabelle",
     "bilateralLinks": "Link Bilaterali",
-    "experimental": "(Sperimentale)",
     "bilateralLinksDescription": "Abilita la possibilità di linkare note e checklist nello stesso documento.",
-    "bilateralLinksWarning": "Questa funzione è sperimentale e potrebbe non funzionare come previsto. Potrebbe essere rimossa in futuro.",
     "configureExternalServices": "Configura URL per servizi esterni integrati.",
     "drawioUrl": "URL Draw.io",
     "optional": "(Opzionale)",
diff --git a/app/_translations/klingon.json b/app/_translations/klingon.json
index c91f37690..8530c90c8 100644
--- a/app/_translations/klingon.json
+++ b/app/_translations/klingon.json
@@ -1050,9 +1050,7 @@
     "enableBubbleMenuDescription": "Bubble Menu yIchu'",
     "enableTableToolbarDescription": "Saras Toolbar yIchu'",
     "bilateralLinks": "lI'mey rap",
-    "experimental": "(Duy'Du')",
     "bilateralLinksDescription": "ghItlhDaq lI'mey rap yIchu'.",
-    "bilateralLinksWarning": "Duy'Du' patvam. Qapbe'laH.",
     "historyEnabled": "ghItlh Qu' tetlh",
     "historyDescription": "ghItlh Qu' tetlh yIvu'. nIteb Polbe', lo'wI' Pol neH.",
     "disableHistory": "Qu' tetlh yIQotmoH",
diff --git a/app/_translations/ko.json b/app/_translations/ko.json
index 0b99a9396..8b8843957 100644
--- a/app/_translations/ko.json
+++ b/app/_translations/ko.json
@@ -1050,9 +1050,7 @@
     "enableBubbleMenuDescription": "텍스트 선택 시 표시되는 플로팅 툴바 활성화",
     "enableTableToolbarDescription": "테이블 편집 시 표시되는 툴바 활성화",
     "bilateralLinks": "양방향 링크",
-    "experimental": "(실험적)",
     "bilateralLinksDescription": "같은 문서 내에서 노트와 체크리스트를 연결할 수 있습니다.",
-    "bilateralLinksWarning": "이 기능은 실험적이며 정상적으로 동작하지 않을 수 있고, 향후 제거될 수 있습니다.",
     "historyEnabled": "노트 기록",
     "historyDescription": "노트의 버전 기록을 추적하고 이전 버전으로 복원할 수 있습니다. 수동 저장만 기록이 생성됩니다.",
     "disableHistory": "기록 비활성화",
diff --git a/app/_translations/nl.json b/app/_translations/nl.json
index b5d677feb..f7397268e 100644
--- a/app/_translations/nl.json
+++ b/app/_translations/nl.json
@@ -1025,9 +1025,7 @@
     "enableBubbleMenuDescription": "Schakel de zwevende werkbalk in die verschijnt wanneer tekst wordt geselecteerd",
     "enableTableToolbarDescription": "Schakel de werkbalk in die verschijnt bij het bewerken van tabellen",
     "bilateralLinks": "Bilaterale links",
-    "experimental": "(Experimenteel)",
     "bilateralLinksDescription": "Schakel de mogelijkheid in om te linken naar notities en checklists in hetzelfde document.",
-    "bilateralLinksWarning": "Deze functie is experimenteel en werkt mogelijk niet zoals verwacht. Het kan ook in de toekomst worden verwijderd/afgeschaft.",
     "configureExternalServices": "Configureer externe service-URL's voor editor-integraties.",
     "drawioUrl": "Draw.io URL",
     "optional": "(Optioneel)",
diff --git a/app/_translations/pirate.json b/app/_translations/pirate.json
index 84b59df45..b4653d351 100644
--- a/app/_translations/pirate.json
+++ b/app/_translations/pirate.json
@@ -1050,9 +1050,7 @@
     "enableBubbleMenuDescription": "Enable bubble menu",
     "enableTableToolbarDescription": "Enable grid tools",
     "bilateralLinks": "Two-way Ropes",
-    "experimental": "(Risky)",
     "bilateralLinksDescription": "Tie logs together both ways.",
-    "bilateralLinksWarning": "This be experimental magic. Beware.",
     "historyEnabled": "History Log",
     "historyDescription": "Keep track of old versions.",
     "disableHistory": "Burn History",
diff --git a/app/_translations/pl.json b/app/_translations/pl.json
index b7feaf241..63f802c1e 100644
--- a/app/_translations/pl.json
+++ b/app/_translations/pl.json
@@ -1025,9 +1025,7 @@
     "enableBubbleMenuDescription": "Włącz pływający pasek narzędzi, który pojawia się po zaznaczeniu tekstu",
     "enableTableToolbarDescription": "Włącz pasek narzędziowy, który pojawia się przy edycji tabel",
     "bilateralLinks": "Linki dwukierunkowe",
-    "experimental": "(Eksperymentalny)",
     "bilateralLinksDescription": "Włącz możliwość łączenia notatek i list kontrolnych w tym samym dokumencie.",
-    "bilateralLinksWarning": "Ta funkcja jest eksperymentalna i może nie działać tak, jak oczekujesz. Może być też usunięta/deprecjonowana w przyszłości.",
     "configureExternalServices": "Skonfiguruj zewnętrzne adresy URL integracji edytora.",
     "drawioUrl": "Adres Draw.io",
     "optional": "(Opcjonalny)",
diff --git a/app/_translations/pt.json b/app/_translations/pt.json
index c06295561..26dbf2964 100644
--- a/app/_translations/pt.json
+++ b/app/_translations/pt.json
@@ -1054,9 +1054,7 @@
     "enableBubbleMenuDescription": "Ativar a barra de ferramentas flutuante que aparece quando o texto está selecionado",
     "enableTableToolbarDescription": "Ativar a barra de ferramentas que aparece ao editar tabelas",
     "bilateralLinks": "Ligações bilaterais",
-    "experimental": "(Experimental)",
     "bilateralLinksDescription": "Ativar a capacidade de criar ligações para notas e listas de verificação no mesmo documento.",
-    "bilateralLinksWarning": "Esta funcionalidade é experimental e pode não funcionar como esperado. Também pode acabar por ser removida/descontinuada no futuro.",
     "historyEnabled": "Histórico de notas",
     "historyDescription": "Acompanhar o histórico de versões das notas. Permite restaurar versões anteriores. Apenas as guardações manuais criam pontos no histórico (não a guardação automática).",
     "disableHistory": "Desativar histórico",
diff --git a/app/_translations/ru.json b/app/_translations/ru.json
index cf0e1b0c2..b67198333 100644
--- a/app/_translations/ru.json
+++ b/app/_translations/ru.json
@@ -1050,9 +1050,7 @@
     "enableBubbleMenuDescription": "Включить плавающую панель инструментов, которая появляется при выделении текста",
     "enableTableToolbarDescription": "Включить панель инструментов, которая появляется при редактировании таблиц",
     "bilateralLinks": "Двусторонние ссылки",
-    "experimental": "(Экспериментальная)",
     "bilateralLinksDescription": "Включить возможность связывать заметки и чеклисты в одном документе.",
-    "bilateralLinksWarning": "Эта функция экспериментальная и может работать не так, как ожидается. Она также может быть удалена/устареть в будущем.",
     "historyEnabled": "История заметок",
     "historyDescription": "Отслеживать версии заметок. Позволяет восстанавливать предыдущие версии. Только ручные сохранения создают точки истории (не автосохранение).",
     "disableHistory": "Отключить историю",
diff --git a/app/_translations/tr.json b/app/_translations/tr.json
index 8b4c6ea65..bfe25e02f 100644
--- a/app/_translations/tr.json
+++ b/app/_translations/tr.json
@@ -1050,9 +1050,7 @@
     "enableBubbleMenuDescription": "Metin seçildiğinde görünen yüzen araç çubuğunu etkinleştir",
     "enableTableToolbarDescription": "Tablo düzenlerken görünen araç çubuğunu etkinleştir",
     "bilateralLinks": "Çift Yönlü Bağlantılar",
-    "experimental": "(Deneysel)",
     "bilateralLinksDescription": "Aynı doküman içinde notlara ve kontrol listelerine bağlantı verme özelliğini etkinleştirir.",
-    "bilateralLinksWarning": "Bu özellik deneyseldir ve beklendiği gibi çalışmayabilir. Gelecekte kaldırılabilir veya desteği sonlandırılabilir.",
     "historyEnabled": "Not Geçmişi",
     "historyDescription": "Notlar için sürüm geçmişini takip eder. Önceki sürümlerin geri yüklenmesini sağlar. Yalnızca manuel kayıtlar geçmiş noktası oluşturur (otomatik kayıtlar değil).",
     "disableHistory": "Geçmişi Devre Dışı Bırak",
diff --git a/app/_translations/vi.json b/app/_translations/vi.json
index afb4ad888..972a840e7 100644
--- a/app/_translations/vi.json
+++ b/app/_translations/vi.json
@@ -1051,9 +1051,7 @@
     "enableBubbleMenuDescription": "Bật thanh công cụ nổi xuất hiện khi văn bản được chọn",
     "enableTableToolbarDescription": "Kích hoạt thanh công cụ xuất hiện khi chỉnh sửa bảng",
     "bilateralLinks": "Liên kết song phương",
-    "experimental": "(Thử nghiệm)",
     "bilateralLinksDescription": "Cho phép khả năng liên kết đến ghi chú và danh sách kiểm tra trong cùng một tài liệu.",
-    "bilateralLinksWarning": "Tính năng này đang thử nghiệm và có thể không hoạt động như mong đợi. Nó cũng có thể bị xóa/không được dùng nữa trong tương lai.",
     "historyEnabled": "Lịch sử ghi chú",
     "historyDescription": "Theo dõi lịch sử phiên bản để ghi chú. Cho phép khôi phục các phiên bản trước đó. Chỉ lưu thủ công mới tạo điểm lịch sử (không lưu tự động).",
     "disableHistory": "Tắt lịch sử",
diff --git a/app/_translations/zh.json b/app/_translations/zh.json
index f7f795279..a2c107af4 100644
--- a/app/_translations/zh.json
+++ b/app/_translations/zh.json
@@ -1050,9 +1050,7 @@
     "enableBubbleMenuDescription": "启用选择文本时出现的浮动工具栏",
     "enableTableToolbarDescription": "启用编辑表格时出现的工具栏",
     "bilateralLinks": "双向链接",
-    "experimental": "(实验性)",
     "bilateralLinksDescription": "启用在同一文档中链接笔记和清单的功能。",
-    "bilateralLinksWarning": "此功能处于实验阶段，可能无法按预期工作。将来也可能会被移除/弃用。",
     "historyEnabled": "笔记历史",
     "historyDescription": "跟踪笔记的版本历史。允许恢复以前的版本。仅手动保存会创建历史记录点（自动保存不会）。",
     "disableHistory": "禁用历史记录",
diff --git a/app/_utils/callout-utils.ts b/app/_utils/callout-utils.ts
new file mode 100644
index 000000000..2ceb514ee
--- /dev/null
+++ b/app/_utils/callout-utils.ts
@@ -0,0 +1,12 @@
+import { CALLOUT_ALIASES, CALLOUT_MARKER, CalloutType } from "@/app/_consts/callouts";
+
+export interface CalloutMatch {
+  type: CalloutType;
+  marker: string;
+}
+
+export const matchCallout = (text: string): CalloutMatch | null => {
+  const match = text.match(CALLOUT_MARKER);
+  if (!match) return null;
+  return { type: CALLOUT_ALIASES[match[1].toLowerCase()], marker: match[0] };
+};
diff --git a/app/_utils/item-href-utils.ts b/app/_utils/item-href-utils.ts
index bccb74794..bf95987c6 100644
--- a/app/_utils/item-href-utils.ts
+++ b/app/_utils/item-href-utils.ts
@@ -1,5 +1,5 @@
 import { isUuid } from "@/app/_consts/identity";
-import { LEGACY_LINK_PREFIX } from "@/app/_consts/relations";
+import { LEGACY_LINK_PREFIX, WIKILINK_REGEX } from "@/app/_consts/relations";
 import { ItemTypes } from "@/app/_types/enums";
 import { itemHref } from "@/app/_utils/global-utils";
 
@@ -94,3 +94,10 @@ export const canonicalItemHref = (
 
 export const currentOrigins = (): string[] =>
   typeof window === "undefined" ? [] : [window.location.origin];
+
+const MARKDOWN_LINK = /\[((?:[^\[\]\\]|\\.)*)\]\([^()\s]+\)/g;
+
+export const plainItemText = (text: string): string =>
+  text
+    .replace(MARKDOWN_LINK, (_whole, label: string) => label.replace(/\\(.)/g, "$1"))
+    .replace(WIKILINK_REGEX, (_whole, target: string, label?: string) => (label || target).trim());
diff --git a/app/_utils/markdown-utils.tsx b/app/_utils/markdown-utils.tsx
index ef5a017ae..d5d4e1fe7 100644
--- a/app/_utils/markdown-utils.tsx
+++ b/app/_utils/markdown-utils.tsx
@@ -17,6 +17,7 @@ import {
   parseItemHref,
 } from "./item-href-utils";
 import { getContrastColor } from "./color-utils";
+import { matchCallout } from "./callout-utils";
 
 const turndownPluginGfm = require("turndown-plugin-gfm");
 
@@ -706,10 +707,10 @@ const markdownProcessor = unified()
           if (firstChild && firstChild.children?.length > 0) {
             const textNode = firstChild.children[0];
             if (textNode?.type === "text") {
-              const match = String(textNode.value).match(/^\[!(INFO|WARNING|SUCCESS|DANGER)\]\s*/i);
-              if (match) {
-                const calloutType = match[1].toLowerCase();
-                textNode.value = String(textNode.value).replace(match[0], "");
+              const callout = matchCallout(String(textNode.value));
+              if (callout) {
+                const calloutType = callout.type;
+                textNode.value = String(textNode.value).replace(callout.marker, "");
                 if (!textNode.value && firstChild.children.length === 1) {
                   node.children = node.children.filter((c: any) => c !== firstChild);
                 }
diff --git a/app/_utils/wikilink-utils.ts b/app/_utils/wikilink-utils.ts
index b12f2eb70..db8c2190f 100644
--- a/app/_utils/wikilink-utils.ts
+++ b/app/_utils/wikilink-utils.ts
@@ -9,13 +9,13 @@ export const remarkWikilinks = () => (tree: Root) => {
     [
       new RegExp(WIKILINK_REGEX.source, "g"),
       (_match: string, target: string, alias?: string) => {
-        const label = (alias || target).trim();
+        const label = alias?.trim() || undefined;
         return {
           type: "text",
-          value: label,
+          value: label || target.trim(),
           data: {
             hName: WIKILINK_TAG,
-            hProperties: { target: target.trim(), label },
+            hProperties: { target: target.trim(), ...(label ? { label } : {}) },
           },
         };
       },
diff --git a/app/api/admin/rebuild-index/route.ts b/app/api/admin/rebuild-index/route.ts
index 4348f69b5..5708c082a 100644
--- a/app/api/admin/rebuild-index/route.ts
+++ b/app/api/admin/rebuild-index/route.ts
@@ -1,28 +1,19 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth } from "@/app/_utils/api-utils";
 import { getUserIndex } from "@/app/_server/actions/users/helpers";
-import {
-  rebuildOwnerRelations,
-  rebuildRelations,
-} from "@/app/_server/actions/relations/indexer";
+import { rebuildOwnerRelations } from "@/app/_server/actions/relations/indexer";
 
 export const dynamic = "force-dynamic";
 
 export async function POST(request: NextRequest) {
   return withApiAuth(request, async (user) => {
-    if (!user.isAdmin) {
-      return NextResponse.json({ error: "Admin access required" }, { status: 403 });
-    }
-
     try {
-      const { username } = await request.json().catch(() => ({}));
+      const body = await request.json().catch(() => ({}));
+      const requested = typeof body?.username === "string" ? body.username.trim() : "";
+      const username = requested || user.username;
 
-      if (!username) {
-        await rebuildRelations();
-        return NextResponse.json({
-          success: true,
-          message: "Successfully rebuilt link index for every user",
-        });
+      if (username !== user.username && !user.isAdmin) {
+        return NextResponse.json({ error: "Admin access required" }, { status: 403 });
       }
 
       if ((await getUserIndex(username)) === -1) {
diff --git a/howto/API.md b/howto/API.md
index 2eed4ecee..a29bb6ee4 100644
--- a/howto/API.md
+++ b/howto/API.md
@@ -1,46 +1,46 @@
-# Checklist API Documentation
+# Jotty API
 
-This API provides programmatic access to your checklists and notes. All endpoints require authentication via API key.
+The REST API reads and writes your notes and checklists. Everything except the health check needs an API key.
 
 ## Authentication
 
-### Getting an API Key
+### Getting an API key
 
-1. Log into your checklist application
-2. Navigate to your **Profile** (click on your username in the sidebar)
+1. Log into Jotty
+2. Open your **Profile** by clicking your username in the sidebar
 3. Go to the **Settings** tab
-4. In the **API Key** section, click **Generate** to create a new API key
-5. Copy the generated API key (format: `ck_` followed by random characters)
-6. **Important**: Store this key securely - it provides full access to your account
+4. In the **API Key** section, click **Generate**
+5. Copy the key. It starts with `ck_` followed by random characters
+6. Keep it somewhere safe. Anyone holding it has full access to your account
 
-### Using Your API Key
+### Using your API key
 
-Include your API key in the request header:
+Send it in the `x-api-key` header:
 
 ```
 x-api-key: ck_your_api_key_here
 ```
 
-**Note**: Replace `ck_your_api_key_here` with your actual API key.
+Every example in this file uses `ck_your_api_key_here`. Swap in your own key.
 
-## API Documentation Access
+## Interactive API docs
 
-The jotty API includes interactive documentation that allows you to explore and test all endpoints directly in your browser. The documentation is powered by ReDoc and provides a complete reference with request/response examples.
+Jotty can serve an OpenAPI spec that ReDoc renders as a browsable reference, with request and response examples for every endpoint.
 
-### Running the API Documentation
+### Running the API docs
 
-The API documentation runs as a separate Docker service and requires the main jotty application to be running.
+ReDoc runs as its own Docker service and reads the spec from your running Jotty instance, so Jotty has to be up first.
 
-#### Method 1: Using Docker Compose
+#### Using Docker Compose
 
-1. **Enable API Documentation**: Set the `ENABLE_API_DOCS` environment variable to `true` in your `docker-compose.yml`:
+1. Set `ENABLE_API_DOCS` to `true` in the Jotty service of your `docker-compose.yml`:
 
    ```yaml
    environment:
      - ENABLE_API_DOCS=true
    ```
 
-   **Add the configuration** for the frontend in your docker compose file underneath your jotty settings
+   Then add the ReDoc service underneath your Jotty service:
 
    ```yaml
     api-docs:
@@ -59,89 +59,73 @@ The API documentation runs as a separate Docker service and requires the main jo
     ```
 
 
-    **Important Notes**:
-    - The `SPEC_URL` must point to the `/api/docs` endpoint of your running jotty instance
-    - The documentation will only work if `ENABLE_API_DOCS=true` is set in the jotty environment variables
+    `SPEC_URL` has to point at the `/api/docs` endpoint of your Jotty instance, and that endpoint only answers when `ENABLE_API_DOCS=true` is set on Jotty.
 
-2. **Start the API Docs Service**: Run docker-compose with the `api-docs` profile:
+2. Start it with the `api-docs` profile:
 
    ```bash
    docker-compose --profile api-docs up -d
    ```
 
-3. **Access the Documentation**: Open your browser and navigate to:
-   - **Local**: `http://localhost:40126` (or your custom port)
-   - **Remote**: `http://your-domain.com`
+3. Open `http://localhost:40126`, or whichever host and port you mapped it to.
 
-
-### Features of the API Documentation
-
-- **Request/Response Examples**: See formatted JSON examples for all endpoints
-- **Schema Validation**: View detailed request/response schemas
-- **Real-time Updates**: Documentation updates automatically when the API changes
+The spec comes from the running instance, so the docs always match the version of Jotty you have deployed.
 
 ### Troubleshooting
 
-**Documentation shows "Failed to load"**:
-- Ensure `ENABLE_API_DOCS=true` is set in jotty's environment variables
-- Check that the jotty service is running and accessible
-- Verify the `SPEC_URL` is correct for your environment
+**The docs page says "Failed to load"**
+- Check that `ENABLE_API_DOCS=true` is set on the Jotty service
+- Check that Jotty is running and ReDoc can reach it
+- Check that `SPEC_URL` points at your instance's `/api/docs`
 
-**Cannot access on expected port**:
-- Check if the port is already in use: `netstat -tlnp | grep :8080`
-- Verify the port mapping in your docker-compose.yml
-- Ensure the api-docs service is running: `docker ps | grep api-docs`
+**Nothing answers on the port you expected**
+- See whether something else already has the port: `netstat -tlnp | grep :8080`
+- Check the port mapping in your docker-compose.yml
+- Check the api-docs container is running: `docker ps | grep api-docs`
 
-**Authentication fails in interactive docs**:
-- Make sure you're using a valid API key
-- Check that the API key has the required permissions
-- Verify the API key header format: `x-api-key: ck_your_key_here`
+**Requests fail with an auth error in the docs**
+- Check the API key is valid and belongs to a user allowed to do what you're trying
+- Check the header is spelled `x-api-key: ck_your_key_here`
 
 ## Identification
 
-All checklists and notes are identified using UUIDs (Universally Unique Identifiers). UUIDs are 36-character strings that uniquely identify each item in the system, for example: `f47ac10b-58cc-4372-a567-0e02b2c3d479`.
+Every note and checklist has a UUID, a 36-character string such as `f47ac10b-58cc-4372-a567-0e02b2c3d479`. Endpoints take the UUID, not the title.
 
-When referencing checklists or notes in API endpoints, you must use their UUID rather than titles or other identifiers.
+> **Deprecated: slug/category lookups.** A legacy filename slug still works as the item id, optionally with a `?category=` query parameter that defaults to "Uncategorized". Every such request logs a deprecation warning, and this fallback **will be removed in a future release**. All `id` fields in API responses are UUIDs, so switch any stored slugs to those now.
 
-> **Deprecated: slug/category lookups.** Passing a legacy filename slug as the item id (optionally with a `?category=` query parameter, defaulting to "Uncategorized") still resolves to the right item, but every such request logs a deprecation warning and this fallback **will be removed in a future release**. All `id` fields in API responses are UUIDs. Switch any stored slug/category references to UUIDs now.
-
-## Organization Features
+## Organization
 
 ### Categories
 
-All checklists and notes support categorization for better organization:
+Every note and checklist sits in a category, such as "Work", "Personal" or "Shopping". Categories can nest.
 
-- **Default Category**: Items without a specified category are automatically assigned to "Uncategorized"
-- **Category Filtering**: You can organize your content by categories like "Work", "Personal", "Shopping", etc.
-- **Category Breakdown**: The API provides category statistics in summary endpoints
+- Items created without a category go into "Uncategorized"
+- The list endpoints take a `category` filter
+- The summary endpoint breaks counts down per category
 
-### Checklist Types
+### Checklist types
 
-The API supports two types of checklists:
+There are two kinds of checklist.
 
-### Regular Checklists
+### Regular checklists
 
-- Simple checklists with basic items
-- Items have only `text` and `completed` status
-- Used for simple to-do lists and shopping lists
+Plain to-do and shopping lists. Items only have `text` and `completed`.
 
-### Task Checklists
+### Task checklists
 
-- Advanced checklists with task management features
-- Items include additional metadata:
-  - `status`: Task status (`in_progress`, `paused`, `completed`)
-  - `time`: Time tracking data (either `0` or JSON array of time entries)
-- Used for project management and time tracking
+Checklists for projects and time tracking. Items also carry:
+- `status`: `in_progress`, `paused` or `completed`
+- `time`: either `0` or a JSON array of time entries
 
-## Public Endpoints
+## Public endpoints
 
-These endpoints are publicly accessible and do not require authentication.
+These need no API key.
 
-### 1. Health Check
+### 1. Health check
 
 **GET** `/api/health`
 
-Returns the application health status and version information. This endpoint is useful for monitoring and load balancers.
+Returns whether the app is up and which version it is running. Point your uptime monitor or load balancer at it.
 
 **Response:**
 
@@ -153,30 +137,30 @@ Returns the application health status and version information. This endpoint is
 }
 ```
 
-**Response Fields:**
+**Response fields:**
 
-- `status`: Either "healthy" or "unhealthy"
-- `version`: Application version from package.json (null if unable to read)
-- `timestamp`: Current server timestamp in ISO 8601 format
-- `error`: Error message (only present when status is "unhealthy")
+- `status`: "healthy" or "unhealthy"
+- `version`: the version from package.json, or null if it couldn't be read
+- `timestamp`: current server time in ISO 8601
+- `error`: the error message, only present when status is "unhealthy"
 
-**Note**: This endpoint does not require authentication and is accessible to anyone.
+Anyone can call it, logged in or not.
 
-## Authenticated Endpoints
+## Authenticated endpoints
 
-The following endpoints require authentication via API key.
+Everything from here on needs an API key.
 
-### 2. Get All Checklists
+### 2. Get all checklists
 
 **GET** `/api/checklists`
 
-Retrieves all checklists for the authenticated user.
+Returns every checklist you own.
 
-**Query Parameters:**
+**Query parameters:**
 
-- `category` (optional): Filter checklists by category name
-- `type` (optional): Filter checklists by type (`simple` or `task`)
-- `q` (optional): Search checklists by title or item text
+- `category` (optional): only checklists in this category
+- `type` (optional): `simple` or `task`
+- `q` (optional): search titles and item text
 
 **Response:**
 
@@ -238,15 +222,15 @@ Retrieves all checklists for the authenticated user.
 }
 ```
 
-**Note**: All checklists include a `category` field for organization. If no category is specified when creating a checklist, it defaults to "Uncategorized".
+Every checklist has a `category`. Checklists created without one are in "Uncategorized".
 
-### 3. Create Checklist
+### 3. Create checklist
 
 **POST** `/api/checklists`
 
-Creates a new checklist for the authenticated user.
+Creates a checklist owned by you.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -258,9 +242,9 @@ Creates a new checklist for the authenticated user.
 
 **Parameters:**
 
-- `title` (required): The title of the checklist
-- `category` (optional): Category for the checklist (defaults to "Uncategorized")
-- `type` (optional): Type of checklist - `simple` or `task` (defaults to "simple")
+- `title` (required): the checklist title
+- `category` (optional): defaults to "Uncategorized"
+- `type` (optional): `simple` or `task`, defaults to "simple"
 
 **Response:**
 
@@ -279,13 +263,13 @@ Creates a new checklist for the authenticated user.
 }
 ```
 
-### 4. Update Checklist
+### 4. Update checklist
 
 **PUT** `/api/checklists/{listId}`
 
-Updates an existing checklist's title and/or category.
+Changes a checklist's title, category or both.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -296,8 +280,8 @@ Updates an existing checklist's title and/or category.
 
 **Parameters:**
 
-- `title` (optional): The updated title of the checklist
-- `category` (optional): The updated category for the checklist
+- `title` (optional): the new title
+- `category` (optional): the new category
 
 **Response:**
 
@@ -315,11 +299,11 @@ Updates an existing checklist's title and/or category.
 }
 ```
 
-### 5. Delete Checklist
+### 5. Delete checklist
 
 **DELETE** `/api/checklists/{listId}`
 
-Deletes an existing checklist for the authenticated user.
+Deletes a checklist.
 
 **Response:**
 
@@ -329,13 +313,13 @@ Deletes an existing checklist for the authenticated user.
 }
 ```
 
-### 6. Create Checklist Item
+### 6. Create checklist item
 
 **POST** `/api/checklists/{listId}/items`
 
-Adds a new item to the specified checklist.
+Adds an item to a checklist.
 
-**Request Body for Regular Checklists:**
+**Request body for regular checklists:**
 
 ```json
 {
@@ -343,7 +327,7 @@ Adds a new item to the specified checklist.
 }
 ```
 
-**Request Body for Task Checklists:**
+**Request body for task checklists:**
 
 ```json
 {
@@ -353,11 +337,11 @@ Adds a new item to the specified checklist.
 }
 ```
 
-**Task Checklist Parameters:**
+**Task checklist parameters:**
 
-- `text` (required): The task description
-- `status` (optional): Task status - `"in_progress"`, `"paused"`, or `"completed"` (defaults to `"in_progress"`)
-- `time` (optional): Time tracking value - either `0` for no time tracked or a JSON array of time entries (defaults to `0`)
+- `text` (required): what the task is
+- `status` (optional): `"in_progress"`, `"paused"` or `"completed"`, defaults to `"in_progress"`
+- `time` (optional): `0` for no time tracked, or a JSON array of time entries. Defaults to `0`
 
 **Response:**
 
@@ -367,9 +351,9 @@ Adds a new item to the specified checklist.
 }
 ```
 
-**Creating Nested Sub-Items:**
+**Creating nested sub-items:**
 
-To create a nested sub-item (child of an existing item), include the `parentIndex` parameter with the index path of the parent item:
+To put the new item under an existing one, send `parentIndex` with the parent's index path:
 
 ```json
 {
@@ -378,14 +362,14 @@ To create a nested sub-item (child of an existing item), include the `parentInde
 }
 ```
 
-Index paths use dot notation for nested items:
-- `"0"` - Creates a child of the first top-level item
-- `"0.1"` - Creates a child of the second child of the first item
-- `"2.0.1"` - Creates a grandchild of the third top-level item
+Index paths are dot-separated, one number per level:
+- `"0"` puts it under the first top-level item
+- `"0.1"` puts it under the second child of the first item
+- `"2.0.1"` puts it under the second child of the first child of the third top-level item
 
-**Nested Items in Response:**
+**Nested items in responses:**
 
-Items can contain a `children` array with nested sub-items:
+An item with sub-items has a `children` array:
 
 ```json
 {
@@ -440,13 +424,13 @@ Items can contain a `children` array with nested sub-items:
 }
 ```
 
-### Update Checklist Item
+### Update checklist item
 
 **PATCH** `/api/checklists/{listId}/items/{itemIndex}`
 
-Updates one or more writable fields on a checklist item. Omitted fields are left unchanged. Supports nested items using index paths.
+Changes any of the writable fields on an item. Fields you leave out stay as they are. `itemIndex` can be a nested index path.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -460,15 +444,15 @@ Updates one or more writable fields on a checklist item. Omitted fields are left
 }
 ```
 
-**Writable Fields:**
+**Writable fields:**
 
-- `text` (optional): Item title
-- `description` (optional): Item body or notes
-- `priority` (optional): `"critical"`, `"high"`, `"medium"`, `"low"`, or `"none"`
-- `score` (optional): Numeric score
-- `startDate` (optional): Start date as an ISO date string
-- `targetDate` (optional): Target date as an ISO date string
-- `estimatedTime` (optional): Estimated hours
+- `text` (optional): the item title
+- `description` (optional): the item body or notes
+- `priority` (optional): `"critical"`, `"high"`, `"medium"`, `"low"` or `"none"`
+- `score` (optional): a number
+- `startDate` (optional): an ISO date string
+- `targetDate` (optional): an ISO date string
+- `estimatedTime` (optional): estimated hours
 
 **Response:**
 
@@ -478,16 +462,16 @@ Updates one or more writable fields on a checklist item. Omitted fields are left
 }
 ```
 
-### 7. Check Item
+### 7. Check item
 
 **PUT** `/api/checklists/{listId}/items/{itemIndex}/check`
 
-Marks an item as completed. Supports both top-level and nested items using index paths.
+Marks an item as done. `itemIndex` can be a nested index path.
 
 **Examples:**
-- `/api/checklists/{listId}/items/0/check` - Check first top-level item
-- `/api/checklists/{listId}/items/0.1/check` - Check second child of first item
-- `/api/checklists/{listId}/items/2.0.1/check` - Check nested grandchild
+- `/api/checklists/{listId}/items/0/check` checks the first top-level item
+- `/api/checklists/{listId}/items/0.1/check` checks the second child of the first item
+- `/api/checklists/{listId}/items/2.0.1/check` checks a grandchild
 
 **Response:**
 
@@ -497,15 +481,15 @@ Marks an item as completed. Supports both top-level and nested items using index
 }
 ```
 
-### 8. Uncheck Item
+### 8. Uncheck item
 
 **PUT** `/api/checklists/{listId}/items/{itemIndex}/uncheck`
 
-Marks an item as incomplete. Supports both top-level and nested items using index paths.
+Marks an item as not done. `itemIndex` can be a nested index path.
 
 **Examples:**
-- `/api/checklists/{listId}/items/1/uncheck` - Uncheck second top-level item
-- `/api/checklists/{listId}/items/0.0/uncheck` - Uncheck first child of first item
+- `/api/checklists/{listId}/items/1/uncheck` unchecks the second top-level item
+- `/api/checklists/{listId}/items/0.0/uncheck` unchecks the first child of the first item
 
 **Response:**
 
@@ -515,16 +499,16 @@ Marks an item as incomplete. Supports both top-level and nested items using inde
 }
 ```
 
-### 9. Delete Item
+### 9. Delete item
 
 **DELETE** `/api/checklists/{listId}/items/{itemIndex}`
 
-Deletes a checklist item. Supports both top-level and nested items using index paths.
+Deletes a checklist item. `itemIndex` can be a nested index path.
 
 **Examples:**
-- `/api/checklists/{listId}/items/2` - Delete third top-level item
-- `/api/checklists/{listId}/items/0.1` - Delete second child of first item
-- `/api/checklists/{listId}/items/1.0.2` - Delete nested grandchild
+- `/api/checklists/{listId}/items/2` deletes the third top-level item
+- `/api/checklists/{listId}/items/0.1` deletes the second child of the first item
+- `/api/checklists/{listId}/items/1.0.2` deletes a grandchild
 
 **Response:**
 
@@ -534,16 +518,16 @@ Deletes a checklist item. Supports both top-level and nested items using index p
 }
 ```
 
-### 10. Get All Notes
+### 10. Get all notes
 
 **GET** `/api/notes`
 
-Retrieves all notes/documents for the authenticated user.
+Returns every note you own.
 
-**Query Parameters:**
+**Query parameters:**
 
-- `category` (optional): Filter notes by category name
-- `q` (optional): Search notes by title or content
+- `category` (optional): only notes in this category
+- `q` (optional): search titles and content
 
 **Response:**
 
@@ -562,15 +546,15 @@ Retrieves all notes/documents for the authenticated user.
 }
 ```
 
-**Note**: All notes include a `category` field for organization. If no category is specified when creating a note, it defaults to "Uncategorized".
+Every note has a `category`. Notes created without one are in "Uncategorized".
 
-### 10. Create Note
+### 10. Create note
 
 **POST** `/api/notes`
 
-Creates a new note for the authenticated user.
+Creates a note owned by you.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -582,9 +566,9 @@ Creates a new note for the authenticated user.
 
 **Parameters:**
 
-- `title` (required): The title of the note
-- `content` (optional): The content of the note in markdown format (defaults to empty string)
-- `category` (optional): Category for the note (defaults to "Uncategorized")
+- `title` (required): the note title
+- `content` (optional): the body in markdown, defaults to an empty string
+- `category` (optional): defaults to "Uncategorized"
 
 **Response:**
 
@@ -603,13 +587,13 @@ Creates a new note for the authenticated user.
 }
 ```
 
-### 11. Update Note
+### 11. Update note
 
 **PUT** `/api/notes/{noteId}`
 
-Updates an existing note for the authenticated user.
+Updates a note.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -622,10 +606,10 @@ Updates an existing note for the authenticated user.
 
 **Parameters:**
 
-- `title` (required): The updated title of the note
-- `content` (optional): The updated content of the note in markdown format
-- `category` (optional): New category for the note (defaults to "Uncategorized")
-- `originalCategory` (optional): The original category of the note (used to locate the existing note)
+- `title` (required): the new title
+- `content` (optional): the new body in markdown
+- `category` (optional): the category to put it in, defaults to "Uncategorized"
+- `originalCategory` (optional): the category the note is in now, used to find it
 
 **Response:**
 
@@ -644,11 +628,11 @@ Updates an existing note for the authenticated user.
 }
 ```
 
-### 12. Delete Note
+### 12. Delete note
 
 **DELETE** `/api/notes/{noteId}`
 
-Deletes an existing note for the authenticated user.
+Deletes a note.
 
 **Response:**
 
@@ -658,21 +642,21 @@ Deletes an existing note for the authenticated user.
 }
 ```
 
-## Task Management
+## Tasks
 
-The `/tasks` endpoints provide specialized access to task checklists with Kanban board functionality, including status management and column-based organization. Tasks are a specific type of checklist optimized for project management workflows.
+The `/tasks` endpoints work on task checklists as Kanban boards. Each board has its own list of statuses, one per column, and every item sits in one of them.
 
-### 13. Get All Tasks
+### 13. Get all tasks
 
 **GET** `/api/tasks`
 
-Retrieves all task checklists for the authenticated user.
+Returns every task checklist you own.
 
-**Query Parameters:**
+**Query parameters:**
 
-- `category` (optional): Filter tasks by category name
-- `status` (optional): Filter tasks that contain items with this status
-- `q` (optional): Search tasks by title or item text
+- `category` (optional): only tasks in this category
+- `status` (optional): only tasks with at least one item in this status
+- `q` (optional): search titles and item text
 
 **Response:**
 
@@ -704,13 +688,13 @@ Retrieves all task checklists for the authenticated user.
 }
 ```
 
-### 14. Create Task
+### 14. Create task
 
 **POST** `/api/tasks`
 
-Creates a new task checklist for the authenticated user.
+Creates a task checklist owned by you.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -726,9 +710,9 @@ Creates a new task checklist for the authenticated user.
 
 **Parameters:**
 
-- `title` (required): The title of the task checklist
-- `category` (optional): Category for the task (defaults to "Uncategorized")
-- `statuses` (optional): Custom Kanban column statuses (defaults to todo/in_progress/completed)
+- `title` (required): the task checklist title
+- `category` (optional): defaults to "Uncategorized"
+- `statuses` (optional): your own Kanban columns, defaults to todo/in_progress/completed
 
 **Response:**
 
@@ -751,11 +735,11 @@ Creates a new task checklist for the authenticated user.
 }
 ```
 
-### 15. Get Task
+### 15. Get task
 
 **GET** `/api/tasks/{taskId}`
 
-Retrieves a specific task checklist.
+Returns one task checklist.
 
 **Response:**
 
@@ -785,13 +769,13 @@ Retrieves a specific task checklist.
 }
 ```
 
-### 16. Update Task
+### 16. Update task
 
 **PUT** `/api/tasks/{taskId}`
 
-Updates task metadata (title, category). All fields are optional.
+Changes the title, the category or both. Both fields are optional.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -816,7 +800,7 @@ Updates task metadata (title, category). All fields are optional.
 }
 ```
 
-### 17. Delete Task
+### 17. Delete task
 
 **DELETE** `/api/tasks/{taskId}`
 
@@ -830,11 +814,11 @@ Deletes a task checklist.
 }
 ```
 
-### 18. Get Task Statuses
+### 18. Get task statuses
 
 **GET** `/api/tasks/{taskId}/statuses`
 
-Retrieves all Kanban column statuses for a task.
+Returns the Kanban columns of a task.
 
 **Response:**
 
@@ -848,13 +832,13 @@ Retrieves all Kanban column statuses for a task.
 }
 ```
 
-### 19. Create Status
+### 19. Create status
 
 **POST** `/api/tasks/{taskId}/statuses`
 
-Adds a new Kanban column status to a task.
+Adds a Kanban column to a task.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -867,10 +851,10 @@ Adds a new Kanban column status to a task.
 
 **Parameters:**
 
-- `id` (required): Unique identifier for the status
-- `label` (required): Display name for the status
-- `color` (optional): Color code for the status column
-- `order` (optional): Display order (defaults to last position)
+- `id` (required): a unique id for the status
+- `label` (required): the column name people see
+- `color` (optional): the column color
+- `order` (optional): where the column goes, defaults to last
 
 **Response:**
 
@@ -886,13 +870,13 @@ Adds a new Kanban column status to a task.
 }
 ```
 
-### 20. Update Status
+### 20. Update status
 
 **PUT** `/api/tasks/{taskId}/statuses/{statusId}`
 
-Updates a Kanban column status.
+Changes a Kanban column.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -916,11 +900,11 @@ Updates a Kanban column status.
 }
 ```
 
-### 21. Delete Status
+### 21. Delete status
 
 **DELETE** `/api/tasks/{taskId}/statuses/{statusId}`
 
-Deletes a Kanban column status. Items with this status will be automatically moved to the first available status.
+Deletes a Kanban column. Items in it move to the first remaining status.
 
 **Response:**
 
@@ -930,13 +914,13 @@ Deletes a Kanban column status. Items with this status will be automatically mov
 }
 ```
 
-### 22. Create Task Item
+### 22. Create task item
 
 **POST** `/api/tasks/{taskId}/items`
 
-Creates a new item in a task checklist.
+Adds an item to a task checklist.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -945,9 +929,9 @@ Creates a new item in a task checklist.
 }
 ```
 
-**Creating Nested Items:**
+**Creating nested items:**
 
-To create a nested sub-item, include the `parentIndex` parameter with the index path:
+To put the new item under an existing one, send `parentIndex` with the parent's index path:
 
 ```json
 {
@@ -958,15 +942,15 @@ To create a nested sub-item, include the `parentIndex` parameter with the index
 ```
 
 Index path examples:
-- `"0"` - Creates a child of the first top-level item
-- `"0.1"` - Creates a child of the second child of the first item
-- `"2.0.1"` - Creates a grandchild of the third top-level item
+- `"0"` puts it under the first top-level item
+- `"0.1"` puts it under the second child of the first item
+- `"2.0.1"` puts it under the second child of the first child of the third top-level item
 
 **Parameters:**
 
-- `text` (required): The text content of the item
-- `status` (optional): Initial status (defaults to "todo")
-- `parentIndex` (optional): Index path for creating nested items
+- `text` (required): the item text
+- `status` (optional): the starting status, defaults to "todo"
+- `parentIndex` (optional): index path of the parent item
 
 **Response:**
 
@@ -979,11 +963,11 @@ Index path examples:
 }
 ```
 
-### Get Task Item
+### Get task item
 
 **GET** `/api/tasks/{taskId}/items/{itemIndex}`
 
-Retrieves a single task item, including nested `children` and Kanban item fields. Supports nested index paths.
+Returns one task item with its `children` and Kanban fields. `itemIndex` can be a nested index path.
 
 **Response:**
 
@@ -1018,13 +1002,13 @@ Retrieves a single task item, including nested `children` and Kanban item fields
 }
 ```
 
-### 23. Update Item Status
+### 23. Update item status
 
 **PUT** `/api/tasks/{taskId}/items/{itemIndex}/status`
 
-Changes an item's status (moves it between Kanban columns).
+Moves an item to another Kanban column by changing its status.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -1034,7 +1018,7 @@ Changes an item's status (moves it between Kanban columns).
 
 **Parameters:**
 
-- `status` (required): The new status for the item
+- `status` (required): the new status
 
 **Response:**
 
@@ -1044,7 +1028,7 @@ Changes an item's status (moves it between Kanban columns).
 }
 ```
 
-**Example - Moving nested item:**
+**Example, moving a nested item:**
 
 ```bash
 PUT /api/tasks/550e8400-e29b-41d4-a716-446655440000/items/0.1/status
@@ -1053,7 +1037,7 @@ PUT /api/tasks/550e8400-e29b-41d4-a716-446655440000/items/0.1/status
 }
 ```
 
-### 24. Delete Task Item
+### 24. Delete task item
 
 **DELETE** `/api/tasks/{taskId}/items/{itemIndex}`
 
@@ -1067,7 +1051,7 @@ Deletes an item from a task checklist.
 }
 ```
 
-**Example - Deleting nested item:**
+**Example, deleting a nested item:**
 
 ```bash
 DELETE /api/tasks/550e8400-e29b-41d4-a716-446655440000/items/0.1
@@ -1075,13 +1059,13 @@ DELETE /api/tasks/550e8400-e29b-41d4-a716-446655440000/items/0.1
 
 This deletes the second child of the first top-level item.
 
-### 25. Get User Information
+### 25. Get user information
 
 **GET** `/api/user/{username}`
 
-Retrieves user information. Returns full user data if authenticated as the user or admin, otherwise returns only public information.
+Returns a user's profile. You get the full record for yourself, or for anyone if you are an admin. Everybody else gets the public fields only.
 
-**Response (Own Profile or Admin):**
+**Response (own profile or admin):**
 
 ```json
 {
@@ -1116,13 +1100,13 @@ Retrieves user information. Returns full user data if authenticated as the user
 }
 ```
 
-**Note**: Sensitive fields like `passwordHash` and `apiKey` are never returned.
+`passwordHash`, `apiKey` and other secrets are never in the response.
 
-### 14. Get All Categories
+### 14. Get all categories
 
 **GET** `/api/categories`
 
-Retrieves all categories for notes and checklists for the authenticated user. Archived categories are excluded.
+Returns your note and checklist categories. Archived categories are left out.
 
 **Response:**
 
@@ -1167,20 +1151,20 @@ Retrieves all categories for notes and checklists for the authenticated user. Ar
 }
 ```
 
-**Response Fields:**
+**Response fields:**
 
-- `name`: The category name
-- `path`: Full path to the category (includes parent categories)
-- `count`: Number of items in this category
-- `level`: Nesting level (0 for root categories)
+- `name`: the category name
+- `path`: the full path, parent categories included
+- `count`: how many items are in it
+- `level`: how deep it is nested, 0 for top-level categories
 
-### 15. Rebuild Link Index
+### 15. Rebuild link index
 
 **POST** `/api/admin/rebuild-index`
 
 Rebuilds the relationships index, the list of which notes and checklists link to each other. Jotty keeps it up to date on its own and checks it against your files every minute, so you only need this after editing lots of files outside Jotty, restoring a backup, or if the brain looks wrong.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -1190,7 +1174,7 @@ Rebuilds the relationships index, the list of which notes and checklists link to
 
 **Parameters:**
 
-- `username` (optional): Rebuild only this user's items. Leave it out to rebuild every user.
+- `username` (optional): Whose index to rebuild. Leave it out to rebuild your own. Only admins can name somebody else.
 
 **Response:**
 
@@ -1203,26 +1187,27 @@ Rebuilds the relationships index, the list of which notes and checklists link to
 
 **Errors:**
 
-- `403`: the API key does not belong to an admin
+- `401`: missing or invalid API key
+- `403`: you named another user and your API key does not belong to an admin
 - `404`: no user with that username
 
 **Notes:**
 
-- Only administrators can use this endpoint
+- Any user can rebuild their own index. Rebuilding everybody at once is in **Admin > Content**
 - Rebuilding reads your notes and checklists and never changes them
 - Encrypted notes are skipped, their content is never read
 - Wikilinks keep pointing at the note they were first matched to, so a rebuild does not move them onto a different note with the same title
 - The index lives in `data/.relations.db`. If it is deleted, Jotty rebuilds it from your files
 
-### 16. Get User Summary Statistics
+### 16. Get user summary statistics
 
 **GET** `/api/summary`
 
-Retrieves comprehensive statistics about the authenticated user's content, including notes, checklists, items, and tasks with category breakdowns.
+Returns counts for your notes, checklists, items and tasks, broken down by category.
 
-**Query Parameters:**
+**Query parameters:**
 
-- `username` (optional): Username to get summary for. If not provided, uses the authenticated user. **Note**: Only administrators can query other users' data.
+- `username` (optional): whose summary to return. Leave it out for your own. Only admins can ask for somebody else's.
 
 **Response:**
 
@@ -1266,35 +1251,35 @@ Retrieves comprehensive statistics about the authenticated user's content, inclu
 }
 ```
 
-**Response Fields:**
+**Response fields:**
 
-- `notes.total`: Total number of notes
-- `notes.categories`: Breakdown of notes by category
-- `checklists.total`: Total number of checklists
-- `checklists.categories`: Breakdown of checklists by category
-- `checklists.types`: Breakdown of checklists by type (simple/task)
-- `items.total`: Total number of checklist items
-- `items.completed`: Number of completed items
-- `items.pending`: Number of pending items
-- `items.completionRate`: Percentage of completed items (0-100)
-- `tasks.total`: Total number of tasks (from task-type checklists)
-- `tasks.completed`: Number of completed tasks
-- `tasks.inProgress`: Number of in-progress tasks
-- `tasks.todo`: Number of todo tasks
-- `tasks.completionRate`: Percentage of completed tasks (0-100)
+- `notes.total`: number of notes
+- `notes.categories`: notes per category
+- `checklists.total`: number of checklists
+- `checklists.categories`: checklists per category
+- `checklists.types`: checklists per type, simple or task
+- `items.total`: number of checklist items
+- `items.completed`: items ticked off
+- `items.pending`: items not ticked off
+- `items.completionRate`: percentage of items completed, 0-100
+- `tasks.total`: number of tasks in task checklists
+- `tasks.completed`: tasks completed
+- `tasks.inProgress`: tasks in progress
+- `tasks.todo`: tasks not started
+- `tasks.completionRate`: percentage of tasks completed, 0-100
 
-## Error Responses
+## Error responses
 
-All endpoints return appropriate HTTP status codes:
+Status codes you can get back:
 
-- `200` - Success
-- `400` - Bad Request (invalid parameters)
-- `401` - Unauthorized (invalid or missing API key)
-- `403` - Forbidden (admin access required for certain operations)
-- `404` - Not Found (checklist/item not found)
-- `500` - Internal Server Error
+- `200`: success
+- `400`: bad request, usually a missing or invalid parameter
+- `401`: missing or invalid API key
+- `403`: you're not allowed to do that, usually because it needs an admin
+- `404`: the checklist, note or item doesn't exist
+- `500`: something broke on the server
 
-Error response format:
+Errors come back as:
 
 ```json
 {
@@ -1302,15 +1287,15 @@ Error response format:
 }
 ```
 
-## Export Endpoints
+## Export endpoints
 
-### 1. Request Data Export
+### 1. Request data export
 
 **POST** `/api/exports`
 
-Initiates an export of user data. The API will return a download URL upon successful initiation.
+Starts an export and returns the URL to download it from.
 
-**Request Body:**
+**Request body:**
 
 ```json
 {
@@ -1319,12 +1304,12 @@ Initiates an export of user data. The API will return a download URL upon succes
 }
 ```
 
-**Export Types:**
+**Export types:**
 
-- `all_checklists_notes`: Exports all checklists and notes across all users.
-- `user_checklists_notes`: Exports all checklists and notes for a specific user. Requires `username` in the request body.
-- `all_users_data`: Exports all user registration data.
-- `whole_data_folder`: Exports the entire data folder, excluding temporary export files.
+- `all_checklists_notes`: every checklist and note, for every user
+- `user_checklists_notes`: every checklist and note for one user. Needs `username` in the body
+- `all_users_data`: the user records
+- `whole_data_folder`: the whole data folder, minus temporary export files
 
 **Response:**
 
@@ -1335,11 +1320,11 @@ Initiates an export of user data. The API will return a download URL upon succes
 }
 ```
 
-### 2. Get Export Progress
+### 2. Get export progress
 
 **GET** `/api/exports`
 
-Retrieves the current progress of an ongoing export operation.
+Returns how far along the running export is.
 
 **Response:**
 
@@ -1350,33 +1335,33 @@ Retrieves the current progress of an ongoing export operation.
 }
 ```
 
-## Audit Logs
+## Audit logs
 
-The audit logs API provides comprehensive tracking and monitoring of all user actions in the system. These endpoints allow you to retrieve, export, analyze, and manage audit logs.
+Jotty writes an audit log entry for logins, edits, shares and other user actions. These endpoints read, export, summarise and clean up those entries.
 
 ### GET /logs
 
-Retrieve audit logs with optional filtering and pagination.
+Returns audit log entries, filtered and paginated.
 
 **Access:**
-- Regular users can only view their own logs
-- Admins can view all users' logs
+- Users see their own logs
+- Admins see everybody's
 
-**Query Parameters:**
+**Query parameters:**
 
 | Parameter | Type | Required | Description |
 |-----------|------|----------|-------------|
-| username | string | No | Filter by username (admin only, defaults to current user for non-admins) |
-| action | string | No | Filter by action type (e.g., "login", "logout", "checklist_created") |
-| category | string | No | Filter by category (auth, user, checklist, note, sharing, settings, encryption, api, system, file, upload) |
-| level | string | No | Filter by log level (DEBUG, INFO, WARNING, ERROR, CRITICAL) |
-| startDate | string (ISO 8601) | No | Start date for log range (defaults to 30 days ago) |
-| endDate | string (ISO 8601) | No | End date for log range (defaults to now) |
-| success | boolean | No | Filter by success status |
-| limit | integer | No | Number of logs to return (default: 50) |
-| offset | integer | No | Number of logs to skip (default: 0) |
-
-**Request Example:**
+| username | string | No | Only this user's entries. Admin only, non-admins always get their own |
+| action | string | No | Action type, such as "login", "logout" or "checklist_created" |
+| category | string | No | One of auth, user, checklist, note, sharing, settings, encryption, api, system, file, upload |
+| level | string | No | DEBUG, INFO, WARNING, ERROR or CRITICAL |
+| startDate | string (ISO 8601) | No | Start of the range (default: 30 days ago) |
+| endDate | string (ISO 8601) | No | End of the range (default: now) |
+| success | boolean | No | Only entries that succeeded, or only ones that failed |
+| limit | integer | No | How many entries to return (default: 50) |
+| offset | integer | No | How many entries to skip (default: 0) |
+
+**Request example:**
 
 ```bash
 curl -X GET "http://localhost:3000/api/logs?category=auth&limit=10&success=true" \
@@ -1414,20 +1399,20 @@ curl -X GET "http://localhost:3000/api/logs?category=auth&limit=10&success=true"
 
 ### POST /logs/export
 
-Export audit logs in JSON or CSV format.
+Downloads audit logs as JSON or CSV.
 
 **Access:**
-- Regular users can only export their own logs
-- Admins can export logs for all users or specific users
+- Users export their own logs
+- Admins can export everybody's, or one user's
 
-**Request Body:**
+**Request body:**
 
 | Field | Type | Required | Description |
 |-------|------|----------|-------------|
-| format | string | Yes | Export format: "json" or "csv" |
-| filters | object | No | Same filter options as GET /logs |
+| format | string | Yes | "json" or "csv" |
+| filters | object | No | The same filters as GET /logs |
 
-**Request Example (JSON):**
+**Request example (JSON):**
 
 ```bash
 curl -X POST "http://localhost:3000/api/logs/export" \
@@ -1444,7 +1429,7 @@ curl -X POST "http://localhost:3000/api/logs/export" \
   }'
 ```
 
-**Request Example (CSV):**
+**Request example (CSV):**
 
 ```bash
 curl -X POST "http://localhost:3000/api/logs/export" \
@@ -1461,22 +1446,22 @@ curl -X POST "http://localhost:3000/api/logs/export" \
 
 **Response (JSON format):**
 
-Returns a JSON array of log entries with the Content-Disposition header set for file download.
+A JSON array of log entries, sent with a Content-Disposition header so it downloads as a file.
 
 **Response (CSV format):**
 
-Returns a CSV file with headers:
+A CSV file with these columns:
 ```
 Timestamp,Level,Username,Action,Category,Resource Type,Resource ID,Resource Title,Success,IP Address,Error Message
 ```
 
 ### GET /logs/stats
 
-Retrieve aggregated statistics for audit logs (admin only).
+Returns totals across the audit log: entries per level and category, the busiest actions and users, and recent activity.
 
-**Access:** Admin only
+**Access:** admins only.
 
-**Request Example:**
+**Request example:**
 
 ```bash
 curl -X GET "http://localhost:3000/api/logs/stats" \
@@ -1544,11 +1529,11 @@ curl -X GET "http://localhost:3000/api/logs/stats" \
 
 ### POST /logs/cleanup
 
-Delete audit logs older than the configured retention period (admin only).
+Deletes audit logs older than the retention period set on the instance.
 
-**Access:** Admin only
+**Access:** admins only.
 
-**Request Example:**
+**Request example:**
 
 ```bash
 curl -X POST "http://localhost:3000/api/logs/cleanup" \
@@ -1564,35 +1549,35 @@ curl -X POST "http://localhost:3000/api/logs/cleanup" \
 }
 ```
 
-### Audit Log Fields
+### Audit log fields
 
-Each audit log entry contains the following fields:
+Each entry has these fields:
 
 | Field | Type | Description |
 |-------|------|-------------|
-| id | string | Unix timestamp as string |
-| uuid | string | Generated UUID for the log entry |
-| timestamp | string | ISO 8601 format timestamp |
-| level | string | Log severity level (DEBUG, INFO, WARNING, ERROR, CRITICAL) |
-| username | string | Username of the user who performed the action |
-| action | string | Type of action performed |
-| category | string | Category of the log entry |
-| resourceType | string | Type of resource affected (e.g., "checklist", "note") |
-| resourceId | string | UUID of the affected resource |
-| resourceTitle | string | Human-readable name of the affected resource |
-| metadata | object | Custom data object with additional context |
+| id | string | Unix timestamp, as a string |
+| uuid | string | UUID of the entry |
+| timestamp | string | ISO 8601 timestamp |
+| level | string | DEBUG, INFO, WARNING, ERROR or CRITICAL |
+| username | string | Who did it |
+| action | string | What they did |
+| category | string | Which area it belongs to |
+| resourceType | string | What kind of thing it touched, such as "checklist" or "note" |
+| resourceId | string | UUID of the thing it touched |
+| resourceTitle | string | Title of the thing it touched |
+| metadata | object | Extra context, different per action |
 | ipAddress | string | IP address of the request |
-| userAgent | string | User agent string from the request |
-| success | boolean | Whether the action was successful |
-| errorMessage | string | Error message if the action failed |
-| duration | integer | Duration of the action in milliseconds |
+| userAgent | string | User agent of the request |
+| success | boolean | Whether it worked |
+| errorMessage | string | The error, if it didn't |
+| duration | integer | How long it took, in milliseconds |
 
-### Common Audit Actions
+### Common audit actions
 
 **Authentication:**
 - `login`, `logout`, `register`, `session_terminated`
 
-**User Management:**
+**User management:**
 - `user_created`, `user_updated`, `user_deleted`, `profile_updated`, `user_settings_updated`
 
 **Checklists:**
@@ -1610,7 +1595,7 @@ Each audit log entry contains the following fields:
 **API:**
 - `api_key_generated`, `api_request`
 
-## Usage Examples
+## Usage examples
 
 ### Health check (public endpoint)
 
@@ -1799,27 +1784,24 @@ curl -H "x-api-key: ck_your_api_key_here" \
      https://jotty-instance.com/api/exports
 ```
 
-### Rebuild the link index (admin only)
+### Rebuild your link index
 
 ```bash
 curl -X POST \
-     -H "x-api-key: ck_admin_api_key_here" \
-     -H "Content-Type: application/json" \
-     -d '{"username": "fccview"}' \
+     -H "x-api-key: ck_your_api_key_here" \
      https://jotty-instance.com/api/admin/rebuild-index
 ```
 
-## Cron Job Automation
+Admins can add `-H "Content-Type: application/json" -d '{"username": "fccview"}'` to rebuild somebody else's.
 
-The link index rebuild API can be automated using cron jobs to ensure link relationships remain consistent over time. This is particularly useful for:
+## Rebuilding the link index on a schedule
 
-- Regular maintenance of large installations
-- Ensuring data integrity after bulk operations
-- Preventing link reference issues in production environments
+> [!TIP]
+> You probably don't need this. Jotty already checks the index against your files every minute. A scheduled rebuild only earns its keep if something outside Jotty writes to the data folder regularly, a sync tool or a script, and you'd rather not wait for the check to notice.
 
-### Example Cron Job Setup
+### Example script
 
-Create a shell script (`rebuild-index.sh`) to rebuild the index for all users:
+This script (`rebuild-index.sh`) rebuilds the index for a list of users. It needs an admin API key:
 
 ```bash
 #!/bin/bash
@@ -1853,15 +1835,15 @@ done
 echo "Index rebuild complete"
 ```
 
-Make the script executable:
+Make it executable:
 
 ```bash
 chmod +x rebuild-index.sh
 ```
 
-### Cron Job Installation
+### Adding it to cron
 
-Add to your crontab to run weekly (every Sunday at 2:00 AM):
+To run it weekly, every Sunday at 2:00 AM:
 
 ```bash
 # Edit crontab
@@ -1871,16 +1853,16 @@ crontab -e
 0 2 * * 0 /path/to/rebuild-index.sh >> /var/log/checklist-index-rebuild.log 2>&1
 ```
 
-For daily rebuilds (not recommended for large installations):
+Daily also works, but on an instance with a lot of items that is a lot of reading for very little:
 
 ```bash
 # Daily at 2:00 AM
 0 2 * * * /path/to/rebuild-index.sh >> /var/log/checklist-index-rebuild.log 2>&1
 ```
 
-### Alternative: Single User Cron Job
+### Just your own index
 
-For rebuilding only your own index (non-admin users can only rebuild their own data):
+Without an admin key you can only rebuild your own index. This version does that:
 
 ```bash
 #!/bin/bash
@@ -1905,39 +1887,19 @@ else
 fi
 ```
 
-### Monitoring and Logging
-
-The scripts above include basic logging. For production environments, consider:
-
-1. **Log Rotation**: Use `logrotate` to manage log files
-2. **Monitoring**: Integrate with monitoring systems to alert on failures
-3. **Backup**: Run the rebuild after database backups
-4. **Performance**: Schedule during low-traffic periods
-
-### Best Practices
-
-- **Test First**: Run the script manually before scheduling
-- **Monitor Logs**: Regularly check logs for failures
-- **Resource Usage**: Be aware that rebuilds can be resource-intensive for large datasets
-- **Frequency**: Weekly is usually sufficient; daily may be overkill
-- **Error Handling**: Implement retry logic for transient failures
-
-## Important Notes
-
-- Item indices are 0-based (first item is index 0)
-- All timestamps are in ISO 8601 format
-- API keys are permanent and do not expire
-- Only items owned by the authenticated user are accessible (unless you're an admin)
-- All checklists and notes support categorization for better organization
-- For task checklists, the `status` and `time` parameters are optional when creating items
-- Time tracking data is stored as JSON arrays with `id`, `startTime`, `endTime`, and `duration` fields
-- The summary endpoint provides comprehensive statistics including category breakdowns
-- Admin users can query summary data for any user using the `username` parameter
-- Non-admin users can only query their own summary data
-- The user information endpoint returns different data based on authentication context
-- Categories endpoint excludes archived categories automatically
-- When creating notes, the `content` and `category` fields are optional
-- Admin endpoints require administrator privileges and API key authentication
-- The link index rebuild endpoint can be automated with cron jobs for regular maintenance
-- Link relationships between notes and checklists are maintained automatically, but the rebuild endpoint ensures consistency after bulk operations
-- This is a beta implementation - additional features will be added in future updates
+### Tips
+
+- Run the script by hand once before you schedule it
+- The log file grows every run, so give it a `logrotate` rule
+- If you back up the data folder on a schedule, run the rebuild after the backup rather than during it
+- Glance at the log now and then. A rebuild that fails every week is telling you something
+
+## Things worth knowing
+
+- Item indexes start at 0
+- Timestamps are ISO 8601
+- API keys don't expire. Regenerate yours from your profile if it leaks
+- You can only reach items you own, unless you're an admin
+- Time entries are JSON arrays with `id`, `startTime`, `endTime` and `duration`
+- The user endpoint returns more fields for yourself and for admins than for anybody else
+- The API is still growing. Expect new endpoints and fields, and existing ones to keep working
diff --git a/howto/BRAIN.md b/howto/BRAIN.md
index 60ecd672d..4d3d53195 100644
--- a/howto/BRAIN.md
+++ b/howto/BRAIN.md
@@ -1,12 +1,12 @@
-# Links and the Brain
+# Links and the brain
 
-Notes and checklists can link to each other. Every link works both ways: the item you link to lists the item that links to it under **Referenced By**. The **Brain** draws all of those links as a map you can explore.
+Notes and checklists can link to each other, and every link works both ways. The item you link to lists the item that links to it under **Referenced By**. The **Brain** draws all of those links as a map you can click around in.
 
 ---
 
 ## Making a link
 
-There are three ways, and you can mix them freely.
+There are three ways, and you can mix them in the same note.
 
 | How | What you type | What gets saved |
 | --- | --- | --- |
@@ -14,7 +14,7 @@ There are three ways, and you can mix them freely.
 | Wikilink picker | `[[` then pick an item | `[Title](/note/<uuid>)` |
 | Wikilink | `[[Title]]` typed out in full | `[[Title]]`, exactly as you typed it |
 
-Links made with the picker point at the item's id, so nothing you do to the item later can break them. Wikilinks are for people who like typing them out, and for notes brought over from Obsidian.
+Links made with the picker point at the item's id, so renaming or moving the item later won't break them. Wikilinks are for people who like typing them out, and for notes brought over from Obsidian.
 
 Wikilinks understand the usual extras:
 
@@ -26,12 +26,12 @@ Wikilinks understand the usual extras:
 
 ## How wikilinks find their note
 
-A wikilink is matched by title, ignoring upper and lower case and extra spaces, against your own notes and checklists.
+Jotty matches a wikilink by title against your own notes and checklists. Case and extra spaces don't matter.
 
 - **The first match sticks.** Once `[[Plan]]` has found a note, it keeps pointing at that note. A new note called "Plan" later on doesn't take the link over.
 - **Two items with the same title.** The link goes to the older one.
 - **Renaming the target.** The link keeps working. The next time you save the note that contains the link, Jotty updates the text to the new title, so `[[Plan]]` becomes `[[Q3 plan]]`. Headings and shown text are kept. Only the note you are saving changes. Other notes catch up when they are next saved, and their links keep working until then.
-- **Pointing a link somewhere else.** Edit the text inside `[[ ]]` and save. Different text is looked up again.
+- **Pointing a link somewhere else.** Edit the text inside `[[ ]]` and save. Jotty looks up the new text again.
 - **Deleting the target.** Links move to the next item with that title, or become a "not written yet" button.
 
 Wikilinks inside code blocks and inline code are left alone.
@@ -48,28 +48,28 @@ Titles shorter than three characters are skipped, because they would match almos
 
 ## Importing from Obsidian
 
-Copy your vault's Markdown files into a category and Jotty picks them up. The body of each note is left exactly as it was: `[[wikilinks]]` are read, never rewritten on import.
+Copy your vault's Markdown files into a category and Jotty picks them up. Jotty reads the `[[wikilinks]]` in each note but never rewrites the body on import.
 
 Jotty adds two lines to each file's frontmatter the first time it sees it:
 
 - `uuid`, the id Jotty uses for the note's address
 - `createdAt`, so the note keeps its creation date
 
-Wikilinks are only rewritten when you rename a note in Jotty and then save a note that links to it, as described above.
+After that, a wikilink only gets rewritten when you rename a note in Jotty and then save a note that links to it, as described above.
 
 ---
 
-## The Brain
+## The brain
 
 Open it with the brain button at the top of any note or checklist. The item you came from is highlighted.
 
-- **3D and 2D.** 3D is the default on devices that handle it. Phones, tablets and anyone with reduced motion turned on get 2D.
-- **Click** a node to select it and see its links. **Double click** opens it. Right click opens it too.
+- **3D and 2D.** 3D is the default on devices that can handle it. Phones, tablets and anyone with reduced motion turned on get 2D.
+- Click a node to select it and see its links. Double click or right click opens it.
 - **Search** jumps to an item.
-- **Around this item** shows just the part of the map around the item you came from, with a depth slider. **Everything** shows the whole map again.
+- **Around this item** shows only the part of the map near the item you came from, with a depth slider. **Everything** shows the whole map again.
 - **Colour by** type or by category.
 - **Filters** show or hide notes, checklists, tags, "not written yet" items, suggestions and items with no links.
-- **Suggestions** are dashed lines between items that share a lot of neighbours but don't link to each other yet. They are listed as **Might be related** when you select an item, and on your own brain the link button next to one connects them.
+- **Suggestions** are dashed lines between items that share a lot of neighbours but don't link to each other yet. When you select an item they're listed under **Might be related**, and on your own brain the link button next to one connects the two.
 
 Node shapes:
 
@@ -89,11 +89,12 @@ Turning off **Bilateral Links** in the admin editor settings hides the brain, Re
 
 ## The relationships index
 
-Jotty keeps the links in `data/.relations.db`, next to your notes. Your Markdown files stay the source of truth. The index holds the links, the titles, and a searchable copy of each unencrypted note's plain text, which powers **Mentioned in**.
+Jotty keeps the links in `data/.relations.db`, next to your notes. Your Markdown files are still the source of truth. The index holds the links, the titles, and a searchable copy of each unencrypted note's plain text, which is what **Mentioned in** searches.
 
-- Encrypted notes are never read. Their links don't appear anywhere.
-- If the file is missing or damaged, Jotty rebuilds it from your notes on start. While that runs, Referenced By and the Brain show "Indexing relationships...".
+- Jotty never reads encrypted notes, so their links don't appear anywhere.
+- If the file is missing or damaged, Jotty rebuilds it from your notes on start. While that runs, Referenced By and the brain show "Indexing relationships...".
 - Files changed outside Jotty are picked up within about a minute.
 - Admins can rebuild it from **Admin > Content**, or with the [rebuild API](API.md#15-rebuild-link-index).
 
-A rebuild keeps track of which note each wikilink first matched. Deleting the file loses that: wikilinks whose target was renamed in Jotty, in notes not saved since, then fall back to matching by title.
+> [!NOTE]
+> A rebuild remembers which note each wikilink first matched. Deleting the file forgets that. Wikilinks whose target you renamed in Jotty, sitting in notes you haven't saved since, go back to matching by title.
diff --git a/howto/CUSTOMISATIONS.md b/howto/CUSTOMISATIONS.md
index 5372cb751..c226bf5b4 100644
--- a/howto/CUSTOMISATIONS.md
+++ b/howto/CUSTOMISATIONS.md
@@ -1,15 +1,13 @@
-# Custom Manifest
+# Customisations
 
-You can completely customize your PWA by creating an override manifest file. This allows you to change the app name, description, icons, colors, and more.
+Themes and custom emojis live in the admin panel under **Admin > Styling**. This page is for the one thing that doesn't, which is overriding the PWA manifest by hand.
 
-**Note**: Custom themes and emojis can now be managed through the admin UI under **Admin → Styling**. The manifest customization below is for advanced PWA configuration.
+## Custom manifest
 
-### Custom manifest
+The manifest controls how Jotty looks when someone installs it as an app: name, description, icons, colours, shortcuts.
 
-You can completely customize your PWA by creating an override manifest file. This allows you to change the app name, description, icons, colors, and more.
-
-1. Create a file called `site.webmanifest` in your `config/` directory
-2. Add your custom manifest configuration:
+1. Create a file called `site.webmanifest` in your `config/` directory.
+2. Put your manifest in it:
 
 ```json
 {
@@ -51,18 +49,20 @@ You can completely customize your PWA by creating an override manifest file. Thi
 }
 ```
 
-3. Save the file and refresh your PWA
-4. The changes will take effect immediately
+3. Save the file and refresh your PWA. Jotty reads the file on every request, so there's nothing to restart.
+
+If this file exists, Jotty serves it as is and ignores the app name, description and icons set in the admin settings. If the file isn't valid JSON, Jotty ignores it and serves its own manifest instead.
 
-Learn more about how the PWA works visiting [howto/PWA.md](howto/PWA.md)
+More on how the PWA works in [PWA.md](PWA.md).
 
-**Note**: The override manifest takes precedence over any settings configured through the admin UI. Use this for complete customization control.
+## Config folder permissions
 
-### Configuration Validation
+Jotty checks `themes.json` and `emojis.json` in `config/` when it loads them. If one is malformed, it logs a warning in the server console and carries on with the built-in themes and emojis.
 
-The app validates your configuration files and will show warnings in the console if there are any format errors. Invalid configs will be ignored and the app will continue working with built-in themes and emojis.
+> [!WARNING]
+> The admin panel saves custom themes and emojis into `config/`, so Jotty needs to be able to write there. A read-only mount breaks saving them.
 
-**Important:** If you want to use custom themes and emojis, make sure your local `config/` directory has the correct permissions:
+Set the folder up like this:
 
 ```bash
 mkdir -p config
diff --git a/howto/DOCKER.md b/howto/DOCKER.md
index ef5ae3a8f..c5e8a42ad 100644
--- a/howto/DOCKER.md
+++ b/howto/DOCKER.md
@@ -1,8 +1,8 @@
-# Docker Compose Configuration Guide
+# Docker Compose configuration
 
-This guide explains every configuration value in the `docker-compose.yml` file for jotty·page.
+What each value in the jotty·page `docker-compose.yml` does.
 
-## Basic docker-compose.yml Example
+## Basic docker-compose.yml
 
 ```yaml
 services:
@@ -22,52 +22,53 @@ services:
     # platform: linux/arm64
 ```
 
-**note**: Scroll down if you are running this with podman or via rootless docker
+> [!NOTE]
+> Running with Podman or rootless Docker? There's an extra option for you further down.
 
-## Container Configuration
+## Container
 
 ```yaml
 image: ghcr.io/fccview/jotty:latest
 ```
 
-Specifies the Docker image to use. This pulls the latest stable version of jotty·page from GitHub Container Registry. You can use `latest`, `main`, `develop` _(for beta features when available)_ and the specific tag numbers for amd/arm specifically.
+The image to pull from GitHub Container Registry. `latest` is the current stable release. You can also use `main`, `develop` _(beta features, when there are any)_ or a specific version tag for amd or arm.
 
 ```yaml
 container_name: jotty
 ```
 
-Sets a custom name for the running container. This makes it easier to manage with docker commands.
+A fixed name for the container, so `docker logs jotty` and friends work without looking up an ID.
 
 ```yaml
 user: "1000:1000"
 ```
 
-Runs the container with the specified user and group ID. This should match your host system user for proper file permissions. **Alternatively**, you can use the `PUID` and `PGID` environment variables instead of the `user:` directive. If neither is set, defaults to `1000:1000`. The `user:` directive takes precedence if both are used. This is particularly useful when running on NAS systems like Unraid.
+The user and group ID the container runs as. Match it to the user on your host that owns the mounted folders, or you'll get permission errors. You can use the `PUID` and `PGID` environment variables instead, which tends to be easier on NAS systems like Unraid. If you set neither, it runs as `1000:1000`. If you set both, `user:` wins.
 
 ```yaml
 userns_mode: keep-id
 ```
 
-**Required for Podman and rootless Docker environments.** This option preserves the user namespace when mounting volumes, ensuring the container user (1000:1000) can properly access mounted directories.
+Required for Podman and rootless Docker. It keeps the user namespace when mounting volumes, so the container user (1000:1000) can read and write the mounted directories.
 
-**When you need this option:**
+You need it if:
 
-- Running with Podman instead of Docker
-- Running Docker in rootless mode
-- Getting permission denied errors when writing to mounted volumes (e.g., `EACCES: permission denied, open '/app/data/users/session-data.json'`)
+- you run Podman instead of Docker
+- you run Docker in rootless mode
+- you get permission denied errors writing to mounted volumes, e.g. `EACCES: permission denied, open '/app/data/users/session-data.json'`
 
-**Why it's needed:** In rootless environments, the container user cannot become root to access mounted volumes. The `userns_mode: keep-id` option maps the container user's UID/GID directly to the host's UID/GID, allowing proper file access. More info [here](https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md#using-volumes)
+In a rootless setup the container user can't become root to reach the mounted volumes. `userns_mode: keep-id` maps the container user's UID/GID straight to the host's UID/GID, which fixes that. The [Podman rootless tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md#using-volumes) has the details.
 
-## Network Configuration
+## Ports
 
 ```yaml
 ports:
   - "1122:3000"
 ```
 
-Maps host port 1122 to container port 3000. You can change `1122` to any available port on your host system.
+Maps port 1122 on the host to port 3000 in the container. Change `1122` to any free port on your host. Leave `3000` alone.
 
-## Storage Configuration
+## Volumes
 
 ```yaml
 volumes:
@@ -76,21 +77,21 @@ volumes:
   - ./cache:/app/.next/cache:rw
 ```
 
-Mounts host directories into the container for persistent data storage. Here's some detials:
+Host folders mounted into the container, so your data survives the container being replaced.
 
-- `- ./data:/app/data:rw` Mounts your local `data` directory to `/app/data` inside the container with read-write permissions. This stores your checklists, notes, users, and settings.
-- `- ./config:/app/config:ro` Mounts your local `config` directory to `/app/config` as read-only. This contains custom themes and configuration files.
-- `- ./cache:/app/.next/cache:rw` Optional mount for Next.js build cache. Improves performance by persisting cache between container restarts.
+- `- ./data:/app/data:rw` is your local `data` folder, mounted read-write at `/app/data`. Your checklists, notes, users and settings live here. Back it up.
+- `- ./config:/app/config:ro` is your local `config` folder, mounted read-only at `/app/config`. Custom themes and config files go here.
+- `- ./cache:/app/.next/cache:rw` is optional. It keeps the Next.js build cache between container restarts, so the app is faster after a restart.
 
-## Runtime Configuration
+## Restart policy
 
 ```yaml
 restart: unless-stopped
 ```
 
-Automatically restarts the container unless it was explicitly stopped. Ensures your app stays running.
+Docker restarts the container after a crash or a reboot, unless you stopped it yourself.
 
-## Environment Variables
+## Environment variables
 
 ```yaml
 environment:
@@ -111,44 +112,44 @@ environment:
   - OIDC_ADMIN_GROUPS=admins
 ```
 
-- `- NODE_ENV=production` Sets the Node.js environment to production mode for optimal performance and security.
-- `- PUID=1000` Optional. Process User ID that the container will run as. Defaults to `1000` if not set. Set this to match your host system's user ID (find it with `id -u` on Linux). Particularly useful on NAS systems like Unraid. **Note:** The `user:` directive in docker-compose takes precedence over PUID/PGID.
-- `- PGID=1000` Optional. Process Group ID that the container will run as. Defaults to `1000` if not set. Set this to match your host system's group ID (find it with `id -g` on Linux). **Note:** The `user:` directive in docker-compose takes precedence over PUID/PGID.
-- `- UMASK=002` Optional. Sets the default file creation mask. Defaults to `002` if not set. Controls default permissions for newly created files and directories.
-- `- HTTPS=true` Optional. Enables HTTPS mode for secure connections.
-- `- APP_URL=https://your-jotty-domain.com` Base URL of your jotty·page instance. Required for secure session (https) and SSO.
-- `- SERVE_PUBLIC_IMAGES=yes` Optional. Allows public access to uploaded images via direct URLs.
-- `- SERVE_PUBLIC_FILES=yes` Optional. Allows public access to uploaded files via direct URLs.
-- `- STOP_CHECK_UPDATES=no` Optional. If set to yes stops the github api call and won't give you a toast when a new update is available.
-- `- DISABLE_BRUTEFORCE_PROTECTION=true` Optional. Disables brute force protection for local login authentication. By default, accounts are temporarily locked after 3 failed login attempts with exponential delays (10s, 30s, 60s, etc.). Set to `true` to completely disable this security feature.
+- `- NODE_ENV=production` runs Node.js in production mode. Always set this on a real instance.
+- `- PUID=1000` Optional. The user ID the container runs as. Defaults to `1000`. Set it to your host user's ID, which `id -u` prints on Linux. Handy on NAS systems like Unraid. The `user:` directive in docker-compose takes precedence over PUID/PGID.
+- `- PGID=1000` Optional. The group ID the container runs as. Defaults to `1000`. Set it to your host group's ID, which `id -g` prints on Linux. The `user:` directive in docker-compose takes precedence over PUID/PGID.
+- `- UMASK=002` Optional. The file creation mask, which sets the default permissions on new files and folders. Defaults to `002`.
+- `- HTTPS=true` Optional. Turns on HTTPS mode, which marks session cookies as secure.
+- `- APP_URL=https://your-jotty-domain.com` The base URL of your jotty·page instance. Required for secure (https) sessions and for SSO.
+- `- SERVE_PUBLIC_IMAGES=yes` Optional. Lets anyone open uploaded images by their direct URL, without logging in.
+- `- SERVE_PUBLIC_FILES=yes` Optional. Same as above, for uploaded files.
+- `- STOP_CHECK_UPDATES=no` Optional. Set it to yes and jotty stops calling the GitHub API to check for updates, so you won't get the "new version available" toast.
+- `- DISABLE_BRUTEFORCE_PROTECTION=true` Optional. Turns off brute force protection for local login. By default an account locks for a while after 3 failed login attempts, with growing delays (10s, 30s, 60s, etc.). Set it to `true` to switch that off entirely.
 
-### SSO Configuration (Optional)
+### SSO (optional)
 
-- `- AUTH_MODE=oidc` Enables OIDC (OpenID Connect) single sign-on authentication. (Previously `SSO_MODE`, which still works as a fallback.)
-- `- OIDC_ISSUER=<YOUR_SSO_ISSUER>` URL of your OIDC provider (e.g., Authentik, Auth0, Keycloak).
-- `- OIDC_CLIENT_ID=<YOUR_SSO_CLIENT_ID>` Client ID from your OIDC provider configuration.
-- `- OIDC_CLIENT_SECRET=your_client_secret` Optional. Client secret for confidential OIDC client authentication.
-- `- OIDC_CLIENT_ID_FILE=/run/secrets/oidc_client_id` Optional. Path to file containing the OIDC client ID. If set, takes priority over `OIDC_CLIENT_ID`. Useful for Docker Secrets.
-- `- OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret` Optional. Path to file containing the OIDC client secret. If set, takes priority over `OIDC_CLIENT_SECRET`. Useful for Docker Secrets.
-- `- SSO_FALLBACK_LOCAL=yes` Optional. Allows both SSO and local authentication methods.
-- `- OIDC_ADMIN_GROUPS=admins` Optional. Comma-separated list of OIDC groups that should have admin privileges.
-- `- OIDC_ADMIN_ROLES=admin` Optional. Comma-separated list of OIDC roles that should have admin privileges.
-- `- OIDC_USER_GROUPS=jotty_users,app_users` Optional. Comma-separated list of OIDC groups allowed to access the application. If set, only users in these groups (or admins) can log in.
-- `- OIDC_USER_ROLES=user,member` Optional. Comma-separated list of OIDC roles allowed to access the application. If set, only users with these roles (or admins) can log in.
+- `- AUTH_MODE=oidc` turns on OIDC (OpenID Connect) single sign-on. The old name, `SSO_MODE`, still works as a fallback.
+- `- OIDC_ISSUER=<YOUR_SSO_ISSUER>` The URL of your OIDC provider (e.g. Authentik, Auth0, Keycloak).
+- `- OIDC_CLIENT_ID=<YOUR_SSO_CLIENT_ID>` The client ID from your OIDC provider.
+- `- OIDC_CLIENT_SECRET=your_client_secret` Optional. The client secret, if your provider uses a confidential client.
+- `- OIDC_CLIENT_ID_FILE=/run/secrets/oidc_client_id` Optional. A file that holds the OIDC client ID. If set, it wins over `OIDC_CLIENT_ID`. Use it with Docker Secrets.
+- `- OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret` Optional. A file that holds the OIDC client secret. If set, it wins over `OIDC_CLIENT_SECRET`. Use it with Docker Secrets.
+- `- SSO_FALLBACK_LOCAL=yes` Optional. Keeps local username and password login available next to SSO.
+- `- OIDC_ADMIN_GROUPS=admins` Optional. Comma-separated OIDC groups whose members become admins.
+- `- OIDC_ADMIN_ROLES=admin` Optional. Comma-separated OIDC roles that make a user an admin.
+- `- OIDC_USER_GROUPS=jotty_users,app_users` Optional. Comma-separated OIDC groups allowed to log in. If set, only members of these groups (and admins) get in.
+- `- OIDC_USER_ROLES=user,member` Optional. Comma-separated OIDC roles allowed to log in. If set, only users with one of these roles (and admins) get in.
 
-## API Documentation Service
+## API docs service
 
-jotty includes an optional API documentation service that provides interactive documentation for all API endpoints using ReDoc.
+jotty can run a separate ReDoc container that serves interactive docs for every API endpoint. It's optional.
 
-### Basic Setup
+### Setup
 
-1. **Enable API Docs**: Add `ENABLE_API_DOCS=true` to your jotty environment variables
-2. **Start the Service**: Run `docker-compose --profile api-docs up -d`
-3. **Access**: Visit `http://localhost:8080` (or your configured `API_DOCS_PORT`)
+1. Add `ENABLE_API_DOCS=true` to the jotty environment variables.
+2. Run `docker-compose --profile api-docs up -d`.
+3. Open `http://localhost:8080`, or whatever you set `API_DOCS_PORT` to.
 
-### Health Checks
+### Health checks
 
-To keep the image as small as possible I try to not install many extra dependencies if they are not needed by the main app. For health checks we will simply use node to make an http request to the health endpoint.
+I try to keep the image small, so it doesn't ship curl or wget just for health checks. Node is already there, so the health check uses it to call the health endpoint.
 
 ```yaml
 healthcheck:
@@ -159,7 +160,7 @@ healthcheck:
     retries: 3
 ```
 
-### Service Configuration
+### Service
 
 ```yaml
 api-docs:
@@ -175,21 +176,23 @@ api-docs:
     - api-docs
 ```
 
-## Platform Configuration
+## Platform
 
 ```yaml
 platform: linux/arm64
 ```
 
-Optional. Specifies the target platform. Uncomment this line if running on ARM64 systems (like Apple Silicon Macs or Raspberry Pi).
+Optional. The target platform. Uncomment it on ARM64 machines, like Apple Silicon Macs or a Raspberry Pi.
 
-## Podman Rootless via Quadlet
+## Podman rootless via Quadlet
 
-If you are running via [podman-quadlet](https://docs.podman.io/en/latest/markdown/podman-quadlet.1.html) you will need to set the options above for
- - PUID & PGID
- - userns_mode
+If you run jotty with [podman-quadlet](https://docs.podman.io/en/latest/markdown/podman-quadlet.1.html), set these from above:
+
+- PUID and PGID
+- userns_mode
+
+A complete Container unit looks like this:
 
-A complete Container unit looks like
 ```
 [Container]
 AutoUpdate=registry
diff --git a/howto/ENCRYPTION.md b/howto/ENCRYPTION.md
index c6c9d1ea8..7fa2ace5d 100644
--- a/howto/ENCRYPTION.md
+++ b/howto/ENCRYPTION.md
@@ -1,62 +1,61 @@
-# Encryption for Notes
+# Encryption for notes
 
-Jotty supports two encryption methods for securing your notes.
+Jotty can encrypt a note with a passphrase (XChaCha20-Poly1305) or with PGP.
 
-## Encryption Methods
+> [!CAUTION]
+> There is no recovery. If you lose the passphrase, or the PGP private key, the note is gone. I can't get it back, your admin can't get it back, nobody can. Put the passphrase in a password manager before you encrypt anything you care about.
 
-### XChaCha20-Poly1305 (Default, Recommended)
+## Encryption methods
 
-- **Simpler**: Uses a passphrase only, no key management required
-- **Faster**: Modern symmetric encryption algorithm
-- **Secure**: 256-bit keys derived using Argon2id key derivation
-- **Best for**: Most users who want simple, secure encryption
+### XChaCha20-Poly1305 (default, recommended)
+
+A passphrase is all you need, there are no keys to manage. It's a modern symmetric cipher, and the 256-bit key is derived from your passphrase with Argon2id. Pick this unless you have a reason not to.
 
 ### PGP
 
-- **Traditional**: Public-key cryptography with RSA-4096
-- **Key Management**: Requires generating/managing key pairs
-- **Interoperable**: Can encrypt/decrypt with external PGP tools
-- **Best for**: Users who need PGP compatibility or already have PGP keys
+Public-key encryption with RSA-4096. You generate or import a key pair and look after it yourself. The upside is that notes work with external PGP tools, so it makes sense if you need PGP compatibility or already have keys.
+
+> [!TIP]
+> After a lot of reading around I recommend XChaCha20 for most people. It's simpler and the design is modern. I still love PGP, so both are in.
 
-**After a lot of reading around, I recommend XChaCha20 for most users** due to its simplicity and modern cryptographic design. I still love PGP so I have decided to implement both and let users decide which one they prefer (you can actually decrypt notes encrypted with both methods, but only one will be defaulted at once for encryption).
+Jotty can decrypt notes encrypted with either method, but only one is the default for new encryption at any time.
 
-You can switch methods in **Profile → Encryption → Encryption Method**.
+You can switch methods in **Profile -> Encryption -> Encryption Method**.
 
 ---
 
-### 1. Choose Your Encryption Method
+### 1. Choose your encryption method
 
-Navigate to **Profile → Encryption** tab:
+Go to the **Profile -> Encryption** tab and pick an **Encryption Method**:
 
-1. Select your preferred **Encryption Method**:
-   - **XChaCha20-Poly1305** - Passphrase-based encryption
-   - **PGP** - Key pair-based encryption
+- **XChaCha20-Poly1305**, passphrase-based
+- **PGP**, key pair-based
 
-### 2. Set Up Encryption
+### 2. Set up encryption
 
 #### For XChaCha20-Poly1305
 
-No setup required! Simply create a strong passphrase when encrypting your notes:
+There's nothing to set up. You choose a passphrase when you encrypt a note:
 
-- Use a passphrase of at least 12 characters
-- Include uppercase, lowercase, numbers, and symbols
-- **IMPORTANT**: Store this passphrase in your password vault
-- You'll need to enter it each time you encrypt or decrypt
+- Use at least 12 characters
+- Mix uppercase, lowercase, numbers and symbols
+- **Store this passphrase in your password vault.** Lose it and the note is unreadable forever.
+- You enter it every time you encrypt or decrypt
 
 #### For PGP
 
-Navigate to **Profile → Encryption** tab and choose one of the following:
+Go to the **Profile -> Encryption** tab and either generate a key pair or import one.
 
-##### Generate New Key Pair
+##### Generate new key pair
 
 1. Click **"Generate New Key Pair"**
 2. Enter your name and email (optional)
-3. Create a strong passphrase (minimum 8 characters recommended)
-   - **IMPORTANT**: store this passphrase in your password vault! It cannot be recovered.
+3. Create a strong passphrase (at least 8 characters recommended)
+   - **Store this passphrase in your password vault. It cannot be recovered.**
 4. Click **"Generate Keys"**
-5. Your keys will be generated and saved automatically
+5. Jotty generates and saves the keys
 
-##### Import Existing Keys
+##### Import existing keys
 
 1. Click **"Import Existing Keys"**
 2. Paste your ASCII-armored PGP public key (starts with `-----BEGIN PGP PUBLIC KEY BLOCK-----`)
@@ -65,9 +64,9 @@ Navigate to **Profile → Encryption** tab and choose one of the following:
 
 ---
 
-### 3. Encrypt a Note
+### 3. Encrypt a note
 
-1. Open any note in the editor
+1. Open the note in the editor
 2. Click the **⋯** (more) menu in the top-right
 3. Select **"Encrypt Note"**
 
@@ -78,81 +77,74 @@ Navigate to **Profile → Encryption** tab and choose one of the following:
 
 #### For PGP
 
-4. Choose:
-   - **Use stored keys**: Use your configured keys (default)
-   - **Use custom keys**: Paste a specific public key
+4. Choose a key source:
+   - **Use stored keys** uses your configured keys (default)
+   - **Use custom keys** lets you paste a specific public key
 5. Click **"Encrypt"**
 
-**What gets encrypted:**
-- Note content (body)
-- Note title remains unencrypted for organization
-- Category remains unencrypted for organization
+Only the note body gets encrypted. The title and category stay in plain text so you can still organise the note.
 
 ---
 
-### 4. Decrypt a Note
+### 4. Decrypt a note
 
 1. Open the encrypted note
-   - If "Auto-decrypt on load" is enabled, you'll be prompted automatically, the note won't be decrypted on the server but only in the current tab session, refreshing the page will re-encrypt it
-   - If disabled you'll just see a message like "This note is encrypted"
-2. If not auto-prompted, click **⋯** menu → **"Decrypt Note"**
+   - With "Auto-decrypt on load" enabled you get a passphrase prompt straight away. The note is decrypted in the current tab only, never on the server, and refreshing the page puts it back to encrypted.
+   - With it disabled you see a "This note is encrypted" message instead
+2. If there was no prompt, click the **⋯** menu, then **"Decrypt Note"**
 
 #### For XChaCha20-Poly1305
 
-3. Enter your passphrase (the same one you used to encrypt)
+3. Enter the passphrase you used to encrypt it
 4. Click **"Decrypt"**
 
 #### For PGP
 
-3. Choose your key source:
-   - **Use stored keys**: Use your configured private key
-   - **Use custom keys**: Paste a specific private key
+3. Choose a key source:
+   - **Use stored keys** uses your configured private key
+   - **Use custom keys** lets you paste a specific private key
 4. Enter your passphrase
 5. Click **"Decrypt"**
 
 ---
 
-## Encryption Settings
+## Encryption settings
 
-### Auto-Decrypt on Load
+### Auto-decrypt on load
 
-**Location**: Profile → Encryption → Encryption Settings
+This lives in **Profile -> Encryption -> Encryption Settings**, labelled "Prompt for passphrase when opening encrypted notes".
 
-When enabled (default):
-- Encrypted notes automatically prompt for passphrase when opened
+It's on by default. Opening an encrypted note prompts for the passphrase.
 
-When disabled:
-- Encrypted notes show a "this note is encrypted message"
-- Must manually click "Decrypt Note" to decrypt - This WILL decrypt the note on the server
-- You can always just "view" and encrypted note without decrypting it, but you won't be able to edit it.
+When it's off:
+- Encrypted notes show a "This note is encrypted" message
+- You have to click "Decrypt Note" yourself, and that **does** decrypt the note on the server
+- You can still just view an encrypted note without decrypting it, but you can't edit it that way
 
-**Note**: Even with auto-decrypt enabled, your passphrase is NEVER stored. You must enter it each time.
+Either way, Jotty never stores your passphrase. You type it every time.
 
 ---
 
-## Docker Mapping (PGP Only)
+## Docker mapping (PGP only)
 
-### Mapping Custom Keys for Docker
+### Mapping custom keys for Docker
 
-If you want to use a custom location for your encryption keys (instead of the default `./data/encryption/{username}/`):
+Keys live in `./data/encryption/{username}/` by default. To keep them somewhere else:
 
-1. **Create your custom directory structure on your host:**
+1. **Create the directory on your host:**
    ```bash
    mkdir -p ./my-custom-keys/{username}/
    ```
-   Replace `{username}` with your actual username and use your desired custom path.
+   Replace `{username}` with your username and the path with wherever you want the keys.
 
-2. **Place the required files in your custom directory:**
+2. **Put your key files in it:**
 
-   **public.asc** (mandatory for encryption):
-   - Your ASCII-armored PGP public key file
-   
-   **private.asc** (mandatory for decryption):
-   - Your ASCII-armored PGP private key file
+   - `public.asc`, your ASCII-armored PGP public key. Needed to encrypt.
+   - `private.asc`, your ASCII-armored PGP private key. Needed to decrypt.
 
-3. **Add volume mapping in `docker-compose.yml`:**
+3. **Add a volume mapping in `docker-compose.yml`:**
 
-   Add this line to the `volumes` section under the `jotty` service:
+   Add the last line below to the `volumes` section of the `jotty` service:
    ```yaml
    services:
      jotty:
@@ -162,42 +154,37 @@ If you want to use a custom location for your encryption keys (instead of the de
          - ./cache:/app/.next/cache:rw
          - ./my-custom-keys/{username}:/app/data/encryption/{username}:ro
    ```
-   Replace `{username}` with your actual username and `./my-custom-keys/{username}` with your custom host path. Use `:ro` for read-only or `:rw` for read-write access.
+   Replace `{username}` with your username and `./my-custom-keys/{username}` with your host path. Use `:ro` for read-only or `:rw` for read-write.
 
-4. **Restart your container:**
+4. **Restart the container.**
 
-5. **Verify keys are detected:**
-   - Go to **Profile → Encryption**
-   - You should see your key information displayed
+5. **Check the keys were picked up** in **Profile -> Encryption**. Your key information should be there.
 
-**Note**: The "Custom Key Path" setting in the UI is for **local installations only**, not Docker deployments.
+The "Custom Key Path" setting in the UI is for local installs only. It does nothing useful in Docker, use the volume mapping instead.
 
 ---
 
-## Local Installation (Non-Docker, PGP Only)
+## Local installation (non-Docker, PGP only)
 
-### Custom Key Path
+### Custom key path
 
-For local installations, you can specify a custom absolute path for key storage:
+On a local install you can store keys at any absolute path:
 
-1. Go to **Profile → Encryption**
+1. Go to **Profile -> Encryption**
 2. Under "Custom Key Path (Local Installations)", enter an absolute path:
    - Linux/Mac: `/home/user/my-encryption-keys`
    - Windows: `C:\Users\user\my-encryption-keys`
 3. Click **"Set Custom Path"**
 
-**Important**: The path must:
-- Be an absolute path (not relative)
-- Exist and be writable by the application
-- Have proper permissions
+The path has to be absolute, it has to exist, and the app needs permission to write to it.
 
 ---
 
-## File Format
+## File format
 
-Encrypted notes use YAML frontmatter to indicate encryption status.
+Encrypted notes mark their encryption in the YAML frontmatter.
 
-### XChaCha20-Poly1305 Format
+### XChaCha20-Poly1305 format
 
 ```markdown
 ---
@@ -210,7 +197,7 @@ encryptionMethod: xchacha
 {"alg":"xchacha20","salt":"a1b2c3...","nonce":"x1y2z3...","data":"encrypted..."}
 ```
 
-### PGP Format
+### PGP format
 
 ```markdown
 ---
@@ -234,26 +221,25 @@ wcBMA... [encrypted content here] ...
 
 ### Search
 
-- Encrypted note content cannot be searched by the search feature
-- Note titles and metadata remain searchable
+Search can't see inside encrypted notes. Titles and metadata are still searchable.
 
 ### Sharing
 
-- Encrypted notes are only decryptable by the key owner
-- Shared encrypted notes will appear encrypted to others
+Only the key owner can decrypt a note. If you share an encrypted note, the other user sees it encrypted.
 
 ### Performance
 
-- Large notes take longer to encrypt/decrypt
-- Decryption happens in real-time when opening notes
+Big notes take longer to encrypt and decrypt. Decryption happens when you open the note.
 
 ### Recovery
 
-- No passphrase recovery mechanism (by design for security)
-- Lost passphrase = permanent loss of access to encrypted notes
-- Always maintain secure backups of your private key and passphrase
+There isn't any, on purpose.
+
+- There is no passphrase reset of any kind
+- A lost passphrase means the note is lost for good
+- Back up your private key and passphrase somewhere safe, and do it before you need them
 
 
 # Coming soon
 
-Hi! fccview here! I understand some people may want ABSOLUTE privacy when encrypting, so I am going to (at some point in the future) encrypt frontmatter/title on top of the note body. This requires a lot of thinking as it will break a ton of features if not done properly, but I didn't want this to block the release of the current system.
\ No newline at end of file
+Hi, fccview here. Some people want absolute privacy, so at some point I'm going to encrypt the frontmatter and title as well as the body. That needs a lot of thought, because done badly it breaks a ton of features, and I didn't want it to hold up the release of what's here now.
diff --git a/howto/ENV-VARIABLES.md b/howto/ENV-VARIABLES.md
index 26eaa9524..451f51b05 100644
--- a/howto/ENV-VARIABLES.md
+++ b/howto/ENV-VARIABLES.md
@@ -1,4 +1,4 @@
-# Environment Variables
+# Environment variables
 
 ```bash
 NODE_ENV=production
@@ -20,48 +20,48 @@ OIDC_ADMIN_GROUPS=admins
 
 ### Mandatory (for production instances)
 
-- `NODE_ENV=production` Sets the Node.js environment to production mode for optimal performance and security.
+- `NODE_ENV=production` runs Node.js in production mode. Set it on every real instance.
 
 ### Optional
 
-- `PUID=1000` Optional. Process User ID that the container will run as. Defaults to `1000` if not set. This is particularly useful when running on NAS systems like Unraid, where you need to match the user ID of your host system for proper file permissions on mounted volumes. Set this to match your host system's user ID (you can find it with `id -u` on Linux). **Note:** If you use the `user:` directive in docker-compose.yml, that will take precedence and the container will run as that user directly.
-- `PGID=1000` Optional. Process Group ID that the container will run as. Defaults to `1000` if not set. This should match your host system's group ID for proper file permissions on mounted volumes. You can find your group ID with `id -g` on Linux. **Note:** If you use the `user:` directive in docker-compose.yml, that will take precedence and the container will run as that group directly.
-- `UMASK=002` Optional. Sets the default file creation mask. Defaults to `002` if not set. This controls the default permissions for newly created files and directories. Common values are `002` (group writable) or `022` (owner writable only).
-- `HTTPS=true` Optional. Enables HTTPS mode for secure connections.
-- `APP_URL=https://your-jotty-domain.com` Force a base URL of your jotty·page instance. Required for SSO but optional otherwise - if you have trouble logging in with reverse proxy try setting this up as it will force the application to login using this exact url.
-- `INTERNAL_API_URL=http://localhost:3000` Optional. URL used for internal API calls within the container. Defaults to `http://localhost:3000` if not set. Only needed if you're experiencing session validation issues behind a reverse proxy.
-- `SERVE_PUBLIC_IMAGES=yes` Optional. Allows public access to uploaded images via direct URLs.
-- `SERVE_PUBLIC_FILES=yes` Optional. Allows public access to uploaded files via direct URLs.
-- `SERVE_PUBLIC_VIDEOS=yes` Optional. Allows public access to uploaded files via direct URLs.
-- `STOP_CHECK_UPDATES=yes` Optional. If set to yes stops the github api call and won't give you a toast when a new update is available.
-- `DEFAULT_LOCALE=en` Optional. Sets the default language for the application (e.g., on the login page) when no user is logged in or a user hasn't set a preference. Defaults to `en`.
-- `DISABLE_BRUTEFORCE_PROTECTION=yes` Optional. Disables brute force protection for local login authentication. By default, accounts are temporarily locked after 3 failed login attempts with exponential delays (10s, 30s, 60s, etc.). Set to `yes` to completely disable this security feature.
-- `ENABLE_PWA_ZOOM=yes` Optional. Enables zoomming on the PWA for accessibility reasons.
-- `JOTTY_BODY_SIZE_LIMIT=100mb` Optional. Maximum request body size accepted by Server Actions (uploads, drawio attachments, avatars, etc.). Defaults to `100mb`. Accepts `b`, `kb`, `mb`, `gb` (e.g. `50mb`, `2gb`). Applied at container start via the runtime patcher — see [Runtime Patches](./PATCHES.md).
-- `JOTTY_FREEBSD=1` Optional. **FreeBSD only.** Enables the FreeBSD compatibility patch which stubs `@swc/core` (no native or WASM binary is published for FreeBSD) and forces Next.js to use webpack instead of Turbopack. Has no effect on Linux/macOS/Windows — leave unset everywhere else. Applied at container start via the runtime patcher — see [Runtime Patches](./PATCHES.md).
+- `PUID=1000` Optional. The user ID the container runs as. Defaults to `1000`. On NAS systems like Unraid you'll want it to match the user that owns your mounted folders, or jotty can't write to them. `id -u` on Linux prints yours. If you use the `user:` directive in docker-compose.yml, that takes precedence and the container runs as that user.
+- `PGID=1000` Optional. The group ID the container runs as. Defaults to `1000`. Match it to the group that owns your mounted folders. `id -g` on Linux prints yours. If you use the `user:` directive in docker-compose.yml, that takes precedence and the container runs as that group.
+- `UMASK=002` Optional. The file creation mask. Defaults to `002`. It sets the default permissions on new files and folders. The usual values are `002` (group can write) or `022` (only the owner can write).
+- `HTTPS=true` Optional. Turns on HTTPS mode, which marks session cookies as secure.
+- `APP_URL=https://your-jotty-domain.com` Forces the base URL of your jotty·page instance. Required for SSO, optional otherwise. If logging in breaks behind a reverse proxy, try setting it, since jotty then logs you in against this exact URL.
+- `INTERNAL_API_URL=http://localhost:3000` Optional. The URL jotty uses for API calls to itself inside the container. Defaults to `http://localhost:3000`. You only need it if session validation fails behind a reverse proxy.
+- `SERVE_PUBLIC_IMAGES=yes` Optional. Lets anyone open uploaded images by their direct URL, without logging in.
+- `SERVE_PUBLIC_FILES=yes` Optional. Same, for uploaded files.
+- `SERVE_PUBLIC_VIDEOS=yes` Optional. Same, for uploaded videos.
+- `STOP_CHECK_UPDATES=yes` Optional. Stops jotty calling the GitHub API to check for updates, so you won't get the "new version available" toast.
+- `DEFAULT_LOCALE=en` Optional. The language jotty uses when nobody is logged in (the login page, for example) or when a user hasn't picked one. Defaults to `en`.
+- `DISABLE_BRUTEFORCE_PROTECTION=yes` Optional. Turns off brute force protection for local login. By default an account locks for a while after 3 failed login attempts, with growing delays (10s, 30s, 60s, etc.). Set it to `yes` to switch that off entirely.
+- `ENABLE_PWA_ZOOM=yes` Optional. Lets you zoom in the PWA, for accessibility. Zoom is off by default.
+- `JOTTY_BODY_SIZE_LIMIT=100mb` Optional. The biggest request body Server Actions accept (uploads, drawio attachments, avatars, etc.). Defaults to `100mb`. Accepts `b`, `kb`, `mb`, `gb` (e.g. `50mb`, `2gb`). The runtime patcher applies it when the container starts, see [Runtime Patches](./PATCHES.md).
+- `JOTTY_FREEBSD=1` Optional, and FreeBSD only. Turns on the FreeBSD compatibility patch, which stubs `@swc/core` (nobody publishes a native or WASM binary for FreeBSD) and makes Next.js use webpack instead of Turbopack. It does nothing on Linux, macOS or Windows, so leave it unset there. The runtime patcher applies it when the container starts, see [Runtime Patches](./PATCHES.md).
 
-## SSO Configuration (Optional)
+## SSO (optional)
 
 ### Mandatory
 
-- `APP_URL=https://your-jotty-domain.com` Tells the OIDC of your choice what url you are trying to authenticate against.
-- `AUTH_MODE=oidc` Enables OIDC (OpenID Connect) single sign-on authentication. (Previously `SSO_MODE`, which still works as a fallback.)
-- `OIDC_ISSUER=<YOUR_SSO_ISSUER>` URL of your OIDC provider (e.g., Authentik, Auth0, Keycloak).
-- `OIDC_CLIENT_ID=<YOUR_SSO_CLIENT_ID>` Client ID from your OIDC provider configuration.
+- `APP_URL=https://your-jotty-domain.com` The URL your OIDC provider sends users back to after they log in.
+- `AUTH_MODE=oidc` turns on OIDC (OpenID Connect) single sign-on. The old name, `SSO_MODE`, still works as a fallback.
+- `OIDC_ISSUER=<YOUR_SSO_ISSUER>` The URL of your OIDC provider (e.g. Authentik, Auth0, Keycloak).
+- `OIDC_CLIENT_ID=<YOUR_SSO_CLIENT_ID>` The client ID from your OIDC provider.
 
 ### Optional
 
-- `OIDC_CLIENT_SECRET=your_client_secret` Optional. Client secret for confidential OIDC client authentication.
-- `OIDC_CLIENT_ID_FILE=/run/secrets/oidc_client_id` Optional. Path to file containing the OIDC client ID. If set, takes priority over `OIDC_CLIENT_ID`. Useful for Docker Secrets.
-- `OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret` Optional. Path to file containing the OIDC client secret. If set, takes priority over `OIDC_CLIENT_SECRET`. Useful for Docker Secrets.
-- `SSO_FALLBACK_LOCAL=yes` Optional. Allows both SSO and local authentication methods.
-- `OIDC_ADMIN_GROUPS=admins` Optional. Comma-separated list of OIDC groups that should have admin privileges.
-- `OIDC_ADMIN_ROLES=admin` Optional. Comma-separated list of OIDC roles that should have admin privileges.
-- `OIDC_USER_GROUPS=jotty_users,app_users` Optional. Comma-separated list of OIDC groups allowed to access the application. If set, only users in these groups (or admins) can log in.
-- `OIDC_USER_ROLES=user,member` Optional. Comma-separated list of OIDC roles allowed to access the application. If set, only users with these roles (or admins) can log in.
-- `OIDC_GROUPS_SCOPE=groups` Optional. Scope to request for groups. Defaults to "groups". Set to empty string or "no" to disable for providers like Entra ID that don't support the groups scope.
-- `OIDC_LOGOUT_URL=https://authprovider.local/realms/master/logout` Optional. Custom logout URL for global logout. Full URL to redirect to when logging out.
+- `OIDC_CLIENT_SECRET=your_client_secret` Optional. The client secret, if your provider uses a confidential client.
+- `OIDC_CLIENT_ID_FILE=/run/secrets/oidc_client_id` Optional. A file that holds the OIDC client ID. If set, it wins over `OIDC_CLIENT_ID`. Use it with Docker Secrets.
+- `OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret` Optional. A file that holds the OIDC client secret. If set, it wins over `OIDC_CLIENT_SECRET`. Use it with Docker Secrets.
+- `SSO_FALLBACK_LOCAL=yes` Optional. Keeps local username and password login available next to SSO.
+- `OIDC_ADMIN_GROUPS=admins` Optional. Comma-separated OIDC groups whose members become admins.
+- `OIDC_ADMIN_ROLES=admin` Optional. Comma-separated OIDC roles that make a user an admin.
+- `OIDC_USER_GROUPS=jotty_users,app_users` Optional. Comma-separated OIDC groups allowed to log in. If set, only members of these groups (and admins) get in.
+- `OIDC_USER_ROLES=user,member` Optional. Comma-separated OIDC roles allowed to log in. If set, only users with one of these roles (and admins) get in.
+- `OIDC_GROUPS_SCOPE=groups` Optional. The scope jotty requests to get a user's groups. Defaults to "groups". Set it to an empty string or "no" for providers that don't support a groups scope, like Entra ID.
+- `OIDC_LOGOUT_URL=https://authprovider.local/realms/master/logout` Optional. A full URL to send users to when they log out, for a global logout at your provider.
 
 ### Debugger
 
-- `DEBUGGER=<value>` Optional. Helps you debug a variety of issues. For now you can use `proxy` to debug oidc/login/routing issues and `crud` to debug timing of crud operations. Setting it to `*` allows you to debug all available flags at once.
+- `DEBUGGER=<value>` Optional. Turns on extra logging. Right now there are two flags: `proxy` for OIDC, login and routing problems, and `crud` for timing create, read, update and delete operations. `*` turns on every flag at once.
diff --git a/howto/LDAP.md b/howto/LDAP.md
index d3fcfb89f..f2a74bbd7 100644
--- a/howto/LDAP.md
+++ b/howto/LDAP.md
@@ -1,14 +1,14 @@
-# LDAP Authentication
+# LDAP authentication
 
-`jotty·page` supports authenticating users directly against an LDAP or Active Directory server. Users enter their usual username and password in the standard login form — no browser redirects.
+`jotty·page` can check logins directly against an LDAP or Active Directory server. Users type their usual username and password into the normal login form. There are no browser redirects.
 
 ## Requirements
 
 - An LDAP server reachable from the container (OpenLDAP, LLDAP, Active Directory, FreeIPA, etc.)
 - A service account DN ("bind user") and password with search access to the user tree
-- For group-based access control or admin promotion: the **`memberof` overlay** must be enabled on the LDAP server. Without it, `LDAP_USER_GROUPS` and `LDAP_ADMIN_GROUPS` will silently have no effect (all authenticated users will be allowed in, none will be promoted to admin).
+- The **`memberof` overlay** enabled on the LDAP server, if you want group-based access control or admin promotion. Without it, `LDAP_USER_GROUPS` and `LDAP_ADMIN_GROUPS` silently do nothing. Every authenticated user gets in and nobody becomes admin.
 
-## Quick Start
+## Quick start
 
 ```yaml
 services:
@@ -21,27 +21,27 @@ services:
       - LDAP_BASE_DN=ou=users,dc=example,dc=com
 ```
 
-## Environment Variables
+## Environment variables
 
 ### Required
 
-- `AUTH_MODE=ldap` — Enables LDAP authentication. The standard username/password form is used; the OIDC "Sign in with SSO" button is not shown. (Previously `SSO_MODE=ldap`, which still works as a fallback.)
-- `LDAP_URL=ldap://ldap.example.com:389` — URL of your LDAP server. Use `ldaps://` on port `636` for TLS.
-- `LDAP_BIND_DN=cn=service,dc=example,dc=com` — Distinguished name of the service account used to search the directory.
-- `LDAP_BIND_PASSWORD=secret` — Password of the service account. See [Docker Secrets](#docker-secrets) for storing this securely.
-- `LDAP_BASE_DN=ou=users,dc=example,dc=com` — Base DN under which to search for users.
+- `AUTH_MODE=ldap` turns on LDAP authentication. Users log in with the normal username and password form, and the OIDC "Sign in with SSO" button is hidden. The old `SSO_MODE=ldap` still works as a fallback.
+- `LDAP_URL=ldap://ldap.example.com:389` is the URL of your LDAP server. Use `ldaps://` on port `636` for TLS.
+- `LDAP_BIND_DN=cn=service,dc=example,dc=com` is the distinguished name of the service account Jotty uses to search the directory.
+- `LDAP_BIND_PASSWORD=secret` is the service account password. See [Docker secrets](#docker-secrets) if you'd rather not keep it in plain sight.
+- `LDAP_BASE_DN=ou=users,dc=example,dc=com` is the base DN Jotty searches for users.
 
 ### Optional
 
-- `SSO_FALLBACK_LOCAL=yes` — Allow both LDAP and local password login simultaneously. When set, the standard form accepts both LDAP credentials and local accounts. Useful for a local admin fallback.
-- `LDAP_USER_ATTRIBUTE=uid` — The LDAP attribute matched against the submitted username. Defaults to `uid`. Use `sAMAccountName` for Active Directory.
-- `LDAP_ADMIN_GROUPS=cn=admins,ou=groups,dc=example,dc=com` — Pipe-separated list of group DNs. Users whose `memberOf` attribute contains any of these DNs are granted admin rights on first login. **Note:** DNs contain commas, so groups must be separated with `|`, not `,`.
-- `LDAP_USER_GROUPS=cn=jotty,ou=groups,dc=example,dc=com` — Pipe-separated list of group DNs. When set, only members of these groups (or admin groups) can log in. Users not in any listed group are rejected with an "unauthorized" error.
-- `LDAP_BIND_PASSWORD_FILE=/run/secrets/ldap_password` — Path to a file containing the service account password. Takes priority over `LDAP_BIND_PASSWORD` if both are set. See [Docker Secrets](#docker-secrets).
+- `SSO_FALLBACK_LOCAL=yes` lets the login form accept both LDAP credentials and local accounts.
+- `LDAP_USER_ATTRIBUTE=uid` is the LDAP attribute matched against the username someone types. Defaults to `uid`. Use `sAMAccountName` for Active Directory.
+- `LDAP_ADMIN_GROUPS=cn=admins,ou=groups,dc=example,dc=com` is a pipe-separated list of group DNs. A user whose `memberOf` contains any of them becomes admin on first login. DNs contain commas, so separate groups with `|`, not `,`.
+- `LDAP_USER_GROUPS=cn=jotty,ou=groups,dc=example,dc=com` is a pipe-separated list of group DNs. When set, only members of these groups (or of the admin groups) can log in. Anyone else gets an "unauthorized" error.
+- `LDAP_BIND_PASSWORD_FILE=/run/secrets/ldap_password` is a path to a file holding the service account password. It wins over `LDAP_BIND_PASSWORD` if both are set. See [Docker secrets](#docker-secrets).
 
-## Group-Based Access Control
+## Group-based access control
 
-Both `LDAP_USER_GROUPS` and `LDAP_ADMIN_GROUPS` are matched against the `memberOf` attribute of the authenticated user's LDAP entry. This is a multi-value attribute listing all group DNs the user belongs to, for example:
+`LDAP_USER_GROUPS` and `LDAP_ADMIN_GROUPS` are both matched against the `memberOf` attribute on the user's LDAP entry. It's a multi-value attribute with one group DN per line, for example:
 
 ```
 uid: alice
@@ -49,14 +49,15 @@ memberOf: cn=admins,ou=groups,dc=example,dc=com
 memberOf: cn=jotty,ou=groups,dc=example,dc=com
 ```
 
-**Access logic:**
-- If `LDAP_USER_GROUPS` is set: the user must be in at least one listed group, **or** in an `LDAP_ADMIN_GROUPS` group. Admin group membership bypasses the user group check.
-- If `LDAP_USER_GROUPS` is not set: all successfully authenticated LDAP users are allowed in.
-- Admin status (`LDAP_ADMIN_GROUPS`) is applied on first login and can be promoted later (e.g. by also adding the user to the admin group). It is never automatically revoked.
+How access is decided:
+- With `LDAP_USER_GROUPS` set, the user has to be in at least one listed group **or** in an `LDAP_ADMIN_GROUPS` group. Admins skip the user group check.
+- Without `LDAP_USER_GROUPS`, every LDAP user who authenticates gets in.
+- Admin status from `LDAP_ADMIN_GROUPS` is applied on first login, and a user can be promoted later by adding them to the admin group. Jotty never revokes it automatically.
 
-**Requirement:** The `memberof` overlay must be enabled on your LDAP server. On OpenLDAP this is the `memberof` module. Active Directory supports this natively. FreeIPA supports it with the `memberof` plugin. If the overlay is absent, `memberOf` will not appear on user entries and group checks will not work.
+> [!IMPORTANT]
+> None of this works without the `memberof` overlay on your LDAP server. On OpenLDAP that's the `memberof` module, FreeIPA has a `memberof` plugin, and Active Directory has it built in. Without the overlay, `memberOf` never shows up on user entries and group checks do nothing.
 
-## Active Directory Notes
+## Active Directory notes
 
 For Active Directory, set:
 
@@ -67,7 +68,7 @@ For Active Directory, set:
 - LDAP_BIND_DN=CN=service,CN=Users,DC=example,DC=com
 ```
 
-`memberOf` is supported natively in Active Directory — no extra configuration needed for group-based access control.
+Active Directory has `memberOf` built in, so group-based access control needs no extra setup.
 
 ## LDAPS (TLS)
 
@@ -77,7 +78,7 @@ Use `ldaps://` and port `636`:
 - LDAP_URL=ldaps://ldap.example.com:636
 ```
 
-`ldapts` validates the server certificate against the system CA store by default. If you are using a self-signed certificate, you need to add your CA certificate to the container. The recommended approach is to mount it and set `NODE_EXTRA_CA_CERTS`:
+`ldapts` checks the server certificate against the system CA store by default. With a self-signed certificate you need to get your CA certificate into the container. The easiest way is to mount it and set `NODE_EXTRA_CA_CERTS`:
 
 ```yaml
 services:
@@ -88,12 +89,12 @@ services:
       - ./ldap-ca.crt:/app/config/ldap-ca.crt:ro
 ```
 
-## Docker Secrets
+## Docker secrets
 
 <details>
-<summary>Storing the service account password securely</summary>
+<summary>Keeping the service account password out of the environment</summary>
 
-To prevent the service account password from appearing in `docker inspect` output, use a secrets file:
+To keep the service account password out of `docker inspect` output, put it in a secrets file:
 
 ```yaml
 services:
@@ -122,28 +123,28 @@ chmod 600 secrets/ldap_password.txt
 
 ## Limitations
 
-jotty·page manages a **local copy** of user accounts. LDAP is only consulted at login time. This means:
+jotty·page keeps a **local copy** of each user account and only talks to LDAP at login. So:
 
-- Changing a user's password or deleting a user in jotty's admin panel does **not** propagate to the LDAP server.
-- Changing a password in jotty's personal settings has no effect on LDAP login — the user always authenticates against LDAP.
-- Deleting a user in jotty removes their local notes and checklists, but does not remove them from the directory.
-- Admin status is set from `LDAP_ADMIN_GROUPS` on first login. Removing a user from the admin group in LDAP will not revoke their admin status in jotty (though a jotty admin can do so manually).
+- Changing a password or deleting a user in jotty's admin panel does **not** reach the LDAP server.
+- Changing a password in jotty's personal settings does nothing for LDAP login. The user always authenticates against LDAP.
+- Deleting a user in jotty removes their local notes and checklists, but leaves them in the directory.
+- Admin status comes from `LDAP_ADMIN_GROUPS` on first login. Taking someone out of the admin group in LDAP won't revoke their admin status in jotty. A jotty admin has to do that by hand.
 
 ## Troubleshooting
 
 ### Disclaimer
 
-LDAP support was implemented with the help of Claude code. It was tested under the following conditions:
-  * LDAP server: [lldap](https://github.com/lldap/lldap)
-  * Environment variables: all where tested except `LDAP_BIND_PASSWORD_FILE` and `LDAP_USER_ATTRIBUTE`.
-  * Group-based access control: the logic described above was verified.
-  * Correct first start behaviour was verified.
+LDAP support was built with the help of Claude Code. Here's what has actually been tested:
+  * The LDAP server was [lldap](https://github.com/lldap/lldap).
+  * Every environment variable except `LDAP_BIND_PASSWORD_FILE` and `LDAP_USER_ATTRIBUTE`.
+  * The group-based access logic described above.
+  * First start behaviour.
 
-Other LDAP servers have not been tested, yet.
+No other LDAP server has been tested yet.
 
 ### Login fails with "Authentication service unavailable"
 
-The service account bind or the LDAP search failed (connection refused, DNS failure, wrong URL). Set `DEBUGGER=true` in your environment to log the underlying error to stdout:
+Either the service account bind or the LDAP search failed. Usually that's a refused connection, a DNS failure or a wrong URL. Set `DEBUGGER=true` to log the real error to stdout:
 
 ```yaml
 - DEBUGGER=true
@@ -152,16 +153,16 @@ The service account bind or the LDAP search failed (connection refused, DNS fail
 ### Login fails with "Invalid username or password" but credentials are correct
 
 - Check that `LDAP_USER_ATTRIBUTE` matches the attribute used for login. OpenLDAP typically uses `uid`; Active Directory uses `sAMAccountName`.
-- Check that `LDAP_BASE_DN` covers the user's location in the directory tree.
-- Verify the service account has read access to the base DN.
+- Check that the user sits somewhere under `LDAP_BASE_DN`.
+- Check that the service account can read the base DN.
 
 ### Login fails with "You are not authorized"
 
-The user authenticated successfully but is not a member of any group listed in `LDAP_USER_GROUPS`. Either add the user to a permitted group in the directory, or remove `LDAP_USER_GROUPS` to allow all authenticated users.
+The password was right, but the user isn't in any group listed in `LDAP_USER_GROUPS`. Add them to one of those groups in the directory, or remove `LDAP_USER_GROUPS` to let every authenticated user in.
 
 ### Group membership is not being detected
 
-Ensure the `memberof` overlay is enabled on your LDAP server. You can verify by checking the user's entry directly:
+Check that the `memberof` overlay is enabled on your LDAP server. You can look at the user's entry directly:
 
 ```bash
 ldapsearch -x -H ldap://ldap.example.com \
@@ -173,4 +174,4 @@ If `memberOf` does not appear in the output, the overlay is not active.
 
 ### First LDAP user is not getting admin rights
 
-`LDAP_ADMIN_GROUPS` is only evaluated when a user's `memberOf` contains a matching DN. If no admin groups are configured, no LDAP user will be automatically promoted to admin. You can manually grant admin rights from jotty's admin panel, or set `SSO_FALLBACK_LOCAL=yes` and create a local admin account during initial setup.
+`LDAP_ADMIN_GROUPS` only kicks in when a user's `memberOf` contains a matching DN. With no admin groups configured, no LDAP user becomes admin automatically. Grant admin rights by hand in jotty's admin panel, or set `SSO_FALLBACK_LOCAL=yes` and create a local admin account during initial setup.
diff --git a/howto/MARKDOWN.md b/howto/MARKDOWN.md
index 66b8a34ef..aa45ee859 100644
--- a/howto/MARKDOWN.md
+++ b/howto/MARKDOWN.md
@@ -1,14 +1,12 @@
-# Markdown Guide
+# Markdown guide
 
-This guide covers all supported syntax for creating rich content in your notes. The editor uses an extended version of GitHub Flavored Markdown (GFM) that includes standard syntax as well as several custom HTML tags for advanced formatting.
+Everything you can write in a note. The editor speaks GitHub Flavored Markdown (GFM), plus a handful of HTML tags for the things Markdown can't do on its own.
 
 ---
 
 ## Standard Markdown
 
-These are the foundational elements for formatting your text.
-
-### Text Formatting
+### Text formatting
 
 <table style="min-width: 75px;">
    <colgroup>
@@ -91,7 +89,7 @@ These are the foundational elements for formatting your text.
             <p><code>![Alt Text](image_url)</code></p>
          </td>
          <td colspan="1" rowspan="1">
-            <p>An image will be displayed</p>
+            <p>Shows the image</p>
          </td>
       </tr>
       <tr>
@@ -107,13 +105,13 @@ These are the foundational elements for formatting your text.
       </tr>
       <tr>
          <td colspan="1" rowspan="1">
-            <p>Horizontal Rule</p>
+            <p>Horizontal rule</p>
          </td>
          <td colspan="1" rowspan="1">
             <p><code>---</code></p>
          </td>
          <td colspan="1" rowspan="1">
-            <p>A horizontal line will appear</p>
+            <p>A horizontal line</p>
          </td>
       </tr>
    </tbody>
@@ -131,7 +129,7 @@ These are the foundational elements for formatting your text.
 
 ### Lists
 
-**Unordered List**
+**Unordered list**
 
 ```markdown
 - Item 1
@@ -139,7 +137,7 @@ These are the foundational elements for formatting your text.
   - Nested Item
 ```
 
-**Ordered List**
+**Ordered list**
 
 ```markdown
 1. First Item
@@ -149,11 +147,11 @@ These are the foundational elements for formatting your text.
 
 ---
 
-## Advanced Elements
+## More elements
 
-### Task Lists
+### Task lists
 
-You can create checklists with interactive checkboxes directly in the editor.
+Checkboxes you can tick straight from the editor.
 
 ```markdown
 - [x] Completed task
@@ -162,7 +160,7 @@ You can create checklists with interactive checkboxes directly in the editor.
 
 ### Tables
 
-Create tables using standard Markdown pipe syntax or raw HTML.
+Use Markdown pipe syntax or plain HTML.
 
 ```markdown
 | Feature       | Status    |
@@ -171,9 +169,9 @@ Create tables using standard Markdown pipe syntax or raw HTML.
 | Keyboard Keys | Supported |
 ```
 
-### Code Blocks
+### Code blocks
 
-Wrap your code in triple backticks. You can specify a language for syntax highlighting.
+Wrap code in triple backticks. Put a language name after the opening backticks to get syntax highlighting.
 
 ````markdown
 javascript
@@ -185,24 +183,33 @@ function helloWorld() {
 
 ### Callouts
 
-Callouts are styled blocks that help highlight important information. They use the GitHub/Obsidian-style syntax and come in four types:
+Callouts are coloured boxes for things you don't want skimmed past. They use the GitHub and Obsidian syntax, and there are four styles. Jotty also reads GitHub's names for them, so a note copied from a README keeps its callouts.
 
-```markdown
-You can use !INFO, !WARNING, !SUCCESS, !DANGER.
+| Style   | Jotty name   | GitHub name     |
+| ------- | ------------ | --------------- |
+| Info    | `[!INFO]`    | `[!NOTE]`       |
+| Success | `[!SUCCESS]` | `[!TIP]`        |
+| Warning | `[!WARNING]` | `[!IMPORTANT]`  |
+| Danger  | `[!DANGER]`  | `[!CAUTION]`    |
 
+```markdown
 > [!INFO]
 > This is an informational callout for general tips and notes.
 
+> [!CAUTION]
+> This one renders as a danger callout, here and on GitHub.
 ```
 
-> [!INFO]
-> In the visual editor, you can insert callouts using the `/callout` slash command and change the type by clicking the icon.
+Saving a note from the rich text editor writes the Jotty name, so a `[!NOTE]` comes back as `[!INFO]`.
+
+> [!TIP]
+> In the rich text editor, type `/callout` to insert one. Click its icon to change the type.
 
 ---
 
-## Custom HTML Tags
+## Custom HTML tags
 
-For more advanced formatting, you can use the following HTML tags directly in the editor. They will persist when switching between editor modes and will render correctly in the final view.
+You can type these HTML tags straight into a note. They survive switching between the rich text editor and the Markdown editor, and they render in the note view.
 
 <table style="min-width: 75px;">
    <colgroup>
@@ -219,12 +226,12 @@ For more advanced formatting, you can use the following HTML tags directly in th
             <p><strong>Description</strong></p>
          </td>
          <td colspan="1" rowspan="1">
-            <p><strong>Syntax &amp; Example</strong></p>
+            <p><strong>Syntax &amp; example</strong></p>
          </td>
       </tr>
       <tr>
          <td colspan="1" rowspan="1">
-            <p><strong>Keyboard Key</strong></p>
+            <p><strong>Keyboard key</strong></p>
          </td>
          <td colspan="1" rowspan="1">
             <p><kbd class="bg-muted px-2 py-1 text-xs rounded-jotty border border-border shadow-border shadow-sm">Enter</kbd></p>
@@ -279,7 +286,7 @@ For more advanced formatting, you can use the following HTML tags directly in th
       </tr>
       <tr>
          <td colspan="1" rowspan="1">
-            <p><strong>Collapsible Section</strong></p>
+            <p><strong>Collapsible section</strong></p>
          </td>
          <td colspan="1" rowspan="1">
             <details>
@@ -307,10 +314,10 @@ For more advanced formatting, you can use the following HTML tags directly in th
       </tr>
       <tr>
          <td colspan="1" rowspan="1">
-            <p><strong>File Attachment</strong></p>
+            <p><strong>File attachment</strong></p>
          </td>
          <td colspan="1" rowspan="1">
-            <p>Creates a special link formatted as a downloadable file.</p>
+            <p>A link that shows as a downloadable file.</p>
          </td>
          <td colspan="1" rowspan="1">
             <p><code>[📎 report.pdf](/path/to/file)</code></p>
@@ -321,7 +328,7 @@ For more advanced formatting, you can use the following HTML tags directly in th
             <p><strong>Video</strong></p>
          </td>
          <td colspan="1" rowspan="1">
-            <p>Adds an embedded video to the note.</p>
+            <p>Embeds the video in the note.</p>
          </td>
          <td colspan="1" rowspan="1">
             <p><code>[🎥 video.mp4](/path/to/video)</code></p>
diff --git a/howto/MFA.md b/howto/MFA.md
index 7694eb1fc..8451b2ecc 100644
--- a/howto/MFA.md
+++ b/howto/MFA.md
@@ -1,68 +1,57 @@
-# Multi-Factor Authentication (MFA)
+# Multi-factor authentication (MFA)
 
-MFA adds an extra layer of security to your account by requiring both your password and a time-based one-time password (TOTP) from your authenticator app.
-
-## What is MFA?
-
-Multi-Factor Authentication (2FA/MFA) requires two pieces of information to log in:
-1. **Something you know**: Your password
-2. **Something you have**: Your phone with an authenticator app
-
-Even if someone steals your password, they can't access your account without your authenticator app.
+With MFA on, logging in takes your password plus a time-based one-time password (TOTP) from an authenticator app. Somebody who steals your password still can't get in without your phone.
 
 ## Enable MFA
 
-Navigate to **Profile → User Info**:
+Go to **Profile -> User Info**:
 
 1. Click **Enable MFA**
 2. Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)
 3. Enter the 6-digit code from your app
-4. **CRITICAL**: Save your recovery code in a secure location (password vault)
-5. MFA is now active
-
-## Recovery Code
+4. **Save your recovery code in your password vault.**
+5. MFA is on
 
-When enabling MFA, you receive a single recovery code. This code is for **administrator use only** to disable MFA if you lose access to your authenticator.
+## Recovery code
 
-**Important:**
-- Store the recovery code in your password vault
-- The recovery code can be used multiple times
-- Only administrators can use it to disable your MFA
-- You cannot use it yourself to log in
+> [!IMPORTANT]
+> Enabling MFA gives you a single recovery code. It's for admins only. If you lose your authenticator, an admin uses it to turn your MFA off.
 
-## Regenerate Recovery Code
+- Keep it in your password vault
+- It works more than once
+- Only admins can use it to disable your MFA
+- You can't log in with it yourself
 
-To generate a new recovery code:
+## Regenerate recovery code
 
-1. Go to **Profile → User Info**
+1. Go to **Profile -> User Info**
 2. Click **Regenerate Recovery Code**
 3. Enter your current MFA code to confirm
-4. Save the new code immediately
+4. Save the new code straight away
 
-**Warning:** This invalidates your previous recovery code.
+The old recovery code stops working.
 
 ## Disable MFA
 
-1. Go to **Profile → User Info**
+1. Go to **Profile -> User Info**
 2. Click **Disable MFA**
 3. Enter your current MFA code to confirm
-4. MFA is now disabled
+4. MFA is off
 
-## Supported Authenticator Apps
+## Supported authenticator apps
 
-Any TOTP-compatible authenticator app works:
+Any app that does RFC 6238 TOTP works, for example:
 
-- **Google Authenticator** (iOS, Android)
-- **Authy** (iOS, Android, Desktop)
-- **1Password** (Cross-platform)
-- **Bitwarden** (Cross-platform)
-- **Microsoft Authenticator** (iOS, Android)
-- **Any RFC 6238 TOTP app**
+- Google Authenticator (iOS, Android)
+- Authy (iOS, Android, desktop)
+- 1Password (cross-platform)
+- Bitwarden (cross-platform)
+- Microsoft Authenticator (iOS, Android)
 
-## Lost Access to Authenticator?
+## Lost your authenticator?
 
-If you lose your phone or authenticator app, contact your administrator. They can use your recovery code to disable MFA, allowing you to:
+Ask your admin. They use your recovery code to turn MFA off, and then you can:
 
 1. Log in with just your password
-2. Re-enable MFA with a new QR code
-3. Get a new recovery code
+2. Turn MFA back on with a new QR code
+3. Save the new recovery code that comes with it
diff --git a/howto/PATCHES.md b/howto/PATCHES.md
index af674a5d2..e5005919d 100644
--- a/howto/PATCHES.md
+++ b/howto/PATCHES.md
@@ -1,16 +1,16 @@
-# Runtime Patches
+# Runtime patches
 
-Some upstream issues (e.g. Next.js standalone builds ignoring `serverActions.bodySizeLimit`) need a small post-install rewrite of files inside `node_modules` to be resolved. jotty·page ships a tiny patch system that runs at container start, before the server boots.
+Some upstream bugs can only be fixed by rewriting a file inside `node_modules` after install. Next.js standalone builds ignoring `serverActions.bodySizeLimit` is one of them. jotty·page has a small patch runner for this. It runs every time the container starts, before the server boots.
 
 ## Where patches live
 
-- `patches/` — patches shipped with the image. Each file is a small JS module exporting `{ name, apply(ctx) }`. They are applied in alphabetical order.
-- `user_patches/` — optional, mounted from your host. Any `.js` files dropped here are applied **after** the built-in patches, so you can layer custom tweaks on top of (or in addition to) the defaults without rebuilding the image.
+- `patches/` holds the patches that ship with the image. Each one is a small JS module that exports `{ name, apply(ctx) }`. They run in alphabetical order.
+- `user_patches/` is optional and mounted from your host. Any `.js` file you put here runs **after** the built-in patches, so you can add your own tweaks without rebuilding the image.
 
 ## Adding your own patches
 
-1. Create a folder `user_patches/` next to your `docker-compose.yml`.
-2. Drop a `.js` file in it, e.g. `user_patches/my-tweak.js`:
+1. Create a `user_patches/` folder next to your `docker-compose.yml`.
+2. Put a `.js` file in it, e.g. `user_patches/my-tweak.js`:
 
    ```js
    const fs = require("fs");
@@ -33,21 +33,21 @@ Some upstream issues (e.g. Next.js standalone builds ignoring `serverActions.bod
      - ./user_patches:/app/user_patches:ro
    ```
 
-4. Restart the container. Patch output is logged to stdout on every start.
+4. Restart the container. Each patch logs its result to stdout on every start.
 
-Patches should be **idempotent** — they run on every restart. Use anchored regex/lookahead checks or compare against the target value before writing, so re-running the same patch is a no-op.
+Patches run on every restart, so write them to be **idempotent**. Check whether the file already has the value you want (an anchored regex or a lookahead does the job) before you write, and running the same patch twice changes nothing the second time.
 
 ## Built-in patches
 
 <details>
-<summary><code>body-size-limit_20260427.js</code> — raise the 1MB Server Actions body cap</summary>
+<summary><code>body-size-limit_20260427.js</code>, raises the 1MB Server Actions body cap</summary>
 
-Next.js 16 ignores `serverActions.bodySizeLimit` from `next.config` in standalone builds, leaving the hard-coded 1MB cap baked into `app-page*.runtime.prod.js`. This patch rewrites that cap so server actions (file uploads, drawio attachments, avatar uploads, etc.) accept larger payloads.
+In standalone builds Next.js 16 ignores `serverActions.bodySizeLimit` from `next.config` and keeps the hard-coded 1MB cap in `app-page*.runtime.prod.js`. This patch rewrites that cap, so server actions (file uploads, drawio attachments, avatar uploads, etc.) accept bigger payloads.
 
-- **Configurable via:** `JOTTY_BODY_SIZE_LIMIT` env var
-- **Default:** `100mb`
-- **Accepts:** `b`, `kb`, `mb`, `gb` (e.g. `50mb`, `2gb`)
-- **Tracking issue:** [#422](https://github.com/fccview/jotty/issues/422)
+- Set it with the `JOTTY_BODY_SIZE_LIMIT` env var.
+- Defaults to `100mb`.
+- Accepts `b`, `kb`, `mb`, `gb` (e.g. `50mb`, `2gb`).
+- Tracking issue: [#422](https://github.com/fccview/jotty/issues/422)
 
 ```yaml
 environment:
@@ -57,15 +57,15 @@ environment:
 </details>
 
 <details>
-<summary><code>freebsd_20260427.js</code> — FreeBSD compatibility (stub <code>@swc/core</code>, force webpack)</summary>
+<summary><code>freebsd_20260427.js</code>, FreeBSD compatibility (stubs <code>@swc/core</code>, forces webpack)</summary>
 
-FreeBSD has no prebuilt native binary for `@swc/core` and no published WASM fallback, so any module that imports it (next-intl, @serwist/turbopack) crashes at require time. Turbopack is also unavailable for the same reason. This patch:
+`@swc/core` has no prebuilt native binary for FreeBSD and no published WASM fallback, so anything that imports it (next-intl, @serwist/turbopack) crashes on require. Turbopack doesn't work there for the same reason. The patch does two things:
 
-1. Stubs `node_modules/@swc/core/binding.js` (hoisted + nested copies) so imports succeed. Stub methods only throw when actually called — which never happens in this project.
-2. Patches `next/dist/lib/bundler.js` `parseBundlerArgs()` to force the webpack bundler, so Next never tries to load Turbopack.
+1. Stubs `node_modules/@swc/core/binding.js`, both the hoisted and the nested copies, so the imports succeed. The stub methods only throw if something calls them, and nothing in jotty does.
+2. Patches `parseBundlerArgs()` in `next/dist/lib/bundler.js` to force the webpack bundler, so Next never tries to load Turbopack.
 
-- **Gated on:** `JOTTY_FREEBSD` env var. Without it, the patch is a strict no-op — nothing under `node_modules` is read or modified.
-- **Default:** disabled (Linux/macOS/Windows users should leave it unset).
+- It only runs when `JOTTY_FREEBSD` is set. Without it the patch doesn't read or touch anything under `node_modules`.
+- It's off by default. On Linux, macOS or Windows, leave it unset.
 
 ```yaml
 environment:
diff --git a/howto/PWA.md b/howto/PWA.md
index 4207c1182..55332db72 100644
--- a/howto/PWA.md
+++ b/howto/PWA.md
@@ -1,43 +1,43 @@
-# PWA Guide
+# PWA
 
-jotty·page is a fully functional Progressive Web App (PWA) that can be installed on your device for a native app-like experience. This guide covers how to install and customize your PWA experience.
+jotty·page is a Progressive Web App (PWA). Install it and it opens in its own window with its own icon, like any other app on your device.
 
 ## Installing the PWA
 
-### Automatic Installation Prompt
+### Install prompt
 
-When you visit jotty·page in a supported browser and from https, you'll automatically see an install prompt that appears as a banner or button. 
+Open jotty·page over https in a browser that supports PWAs and you'll get an install prompt, as a banner or a button.
 
-### Manual Installation (if no prompt appears)
+### Installing by hand
 
-If the automatic prompt doesn't appear, you can manually install jotty·page:
+No prompt? You can install it yourself.
 
-#### On Mobile (iOS Safari/Chrome)
+#### On mobile (iOS Safari/Chrome)
 
-1. Open jotty·page in your browser
-2. Tap the **Share** button (iOS) or **Menu** button (Android)
-3. Select **"Add to Home Screen"** (iOS) or **"Add to Home screen"** (Android)
-4. Confirm the installation
+1. Open jotty·page in your browser.
+2. Tap the **Share** button (iOS) or the **Menu** button (Android).
+3. Pick **"Add to Home Screen"** (iOS) or **"Add to Home screen"** (Android).
+4. Confirm.
 
-#### On Desktop (Chrome/Edge)
+#### On desktop (Chrome/Edge)
 
-1. Click the **Install** button in the address bar (looks like a computer with a down arrow)
-2. Or click the **Menu** (⋮) > **More tools** > **Create shortcut**
-3. Check **"Open as window"** and click **Create**
+1. Click the **Install** button in the address bar, the one that looks like a computer with a down arrow.
+2. Or open **Menu** (⋮) > **More tools** > **Create shortcut**.
+3. Tick **"Open as window"** and click **Create**.
 
-#### On Desktop (Firefox)
+#### On desktop (Firefox)
 
-1. Click the **Menu** (☰) > **More tools** > **Add to desktop**
-2. Confirm the installation
+1. Open **Menu** (☰) > **More tools** > **Add to desktop**.
+2. Confirm.
 
-## Customizing Your PWA
+## Customizing the PWA
 
-### Replacing the Manifest
+### Replacing the manifest
 
-You can completely customize your PWA by creating an override manifest file. This allows you to change the app name, description, icons, colors, and more.
+You can override the whole manifest with your own file, which lets you change the app name, description, icons, colors and anything else the manifest holds.
 
-1. Create a file called `site.webmanifest` in your `config/` directory
-2. Add your custom manifest configuration:
+1. Create a file called `site.webmanifest` in your `config/` directory.
+2. Put your manifest in it:
 
 ```json
 {
@@ -79,30 +79,26 @@ You can completely customize your PWA by creating an override manifest file. Thi
 }
 ```
 
-3. Save the file and refresh your PWA
-4. The changes will take effect immediately
+3. Save the file and refresh the PWA.
+4. jotty serves the new manifest straight away, no restart needed.
 
-**Note**: The override manifest takes precedence over any settings configured through the admin UI. Use this for complete customization control.
+Once `config/site.webmanifest` exists, jotty ignores the app name, description and icons set in the admin UI and serves your file as it is.
 
-## Important Notes About PWA Customization
+## Things to know before you customize
 
-### Theme and Splash Screen Behavior
+### The splash screen keeps its install-time colors
 
-**Theme colors are "baked in" at install time**
+When you install the PWA, it saves the current theme colors and uses them for the splash screen. So:
 
-When you install the PWA, the current theme colors are captured and used for the splash screen. This means:
+- the splash screen background matches whatever theme you had when you installed it
+- **changing your theme later does NOT update the splash screen**
+- to get a new splash screen color, uninstall the PWA and install it again
 
-- The splash screen background color matches your current theme at the time of installation
-- **Changing your theme after installation will NOT update the splash screen**
-- To change the splash screen theme, you must uninstall and reinstall the PWA
+### New icons need a reinstall
 
-### Icon Changes Require Reinstallation
+Icons work the same way. The PWA caches them when you install it.
 
-**Icon changes require app reinstallation**
-
-Similar to themes, PWA icons are cached during installation:
-
-- Custom icons set through the admin UI are used when installing
-- **Changing icons after installation will NOT update the installed app**
-- To see new icons, you must uninstall and reinstall the PWA
-- This applies to all icon sizes (16x16, 32x32, 180x180, 192x192, 512x512)
+- It uses the custom icons set in the admin UI at install time.
+- **Changing the icons later does NOT update the installed app.**
+- To see new icons, uninstall the PWA and install it again.
+- That goes for every icon size (16x16, 32x32, 180x180, 192x192, 512x512).
diff --git a/howto/SHORTCUTS.md b/howto/SHORTCUTS.md
index 3c85b0e30..e0c8fc17a 100644
--- a/howto/SHORTCUTS.md
+++ b/howto/SHORTCUTS.md
@@ -1,35 +1,34 @@
 # Shortcuts
 
-jotty·page supports a wide range of keyboard shortcuts to help you navigate and edit more efficiently without leaving the keyboard. They are divided into two main categories: global shortcuts that work anywhere in the app, and editor-specific shortcuts that work when you are writing a note.
+Global shortcuts work anywhere in the app. Editor and table shortcuts only work while you're writing a note.
 
-### Global App Shortcuts
+> [!NOTE]
+> The tables use Mac keys. On Windows and Linux, use `Ctrl` instead of `⌘ Cmd` and `Alt` instead of `⌥ Option`.
 
-These shortcuts are for managing the application, such as opening modals, switching between modes, and navigating to key pages.
+### Global shortcuts
 
 | Shortcut                                                                 | Action                                                         |
 | :----------------------------------------------------------------------- | :------------------------------------------------------------- |
 | <kbd>⌘ Cmd</kbd> + <kbd>K</kbd>                                          | Open the search palette                                        |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>N</kbd> | Create a new Note or Checklist (depending on the current mode) |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>C</kbd> | Create a new Category                                          |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>H</kbd>                       | Open the How To guides                                         |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>S</kbd> | Open the Settings modal                                        |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>←</kbd> | Switch to Checklists mode                                      |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>→</kbd> | Switch to Notes mode                                           |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>P</kbd> | Go to your Profile page                                        |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>A</kbd> | Go to the Admin page (Admins only)                             |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>N</kbd> | Create a new note or checklist, depending on the current mode  |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>C</kbd> | Create a new category                                          |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>H</kbd>                       | Open the How to guides                                         |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>S</kbd> | Open settings                                                 |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>Left</kbd> | Switch to checklists mode                                   |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>Right</kbd> | Switch to notes mode                                       |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>P</kbd> | Go to your profile page                                        |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>A</kbd> | Go to the admin page (admins only)                             |
 | <kbd>Esc</kbd>                                                           | Close any open modal                                           |
 
-**\*Note:** For Windows/Linux, use `Ctrl` instead of `⌘ Cmd` and `Alt` instead of `⌥ Option`.\*
+### Editor shortcuts
 
-### Editor Shortcuts
-
-These shortcuts are available when the note editor is focused. They allow you to format text and content on the fly.
+These work when the note editor has focus.
 
 | Shortcut                                                                 | Action                         |
 | :----------------------------------------------------------------------- | :----------------------------- |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>S</kbd>                       | Saves the document             |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>E</kbd>                       | Enter/Exit edit mode           |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>M</kbd> | Enter/Exit markdown mode       |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>S</kbd>                       | Save the note                  |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>E</kbd>                       | Enter or exit edit mode        |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>M</kbd> | Enter or exit Markdown mode    |
 | <kbd>⌘ Cmd</kbd> + <kbd>B</kbd>                                          | Toggle **Bold**                |
 | <kbd>⌘ Cmd</kbd> + <kbd>I</kbd>                                          | Toggle _Italic_                |
 | <kbd>⌘ Cmd</kbd> + <kbd>U</kbd>                                          | Toggle <u>Underline</u>        |
@@ -45,11 +44,9 @@ These shortcuts are available when the note editor is focused. They allow you to
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>9</kbd>                       | Toggle a task list (checklist) |
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>B</kbd>                       | Toggle a blockquote            |
 
-**\*Note:** For Windows/Linux, use `Ctrl` instead of `⌘ Cmd` and `Alt` instead of `⌥ Option`.\*
-
-### Table Shortcuts
+### Table shortcuts
 
-These shortcuts are available when working with tables in the editor.
+These work when your cursor is inside a table in the editor.
 
 | Shortcut                                                   | Action                |
 | :--------------------------------------------------------- | :-------------------- |
@@ -58,5 +55,3 @@ These shortcuts are available when working with tables in the editor.
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>C</kbd>         | Add column right      |
 | <kbd>⌘ Cmd</kbd> + <kbd>Backspace</kbd>                    | Delete current row    |
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>Backspace</kbd> | Delete current column |
-
-**\*Note:** For Windows/Linux, use `Ctrl` instead of `⌘ Cmd` and `Alt` instead of `⌥ Option`.\*
diff --git a/howto/SSO.md b/howto/SSO.md
index 499ad4982..6b96dde7b 100644
--- a/howto/SSO.md
+++ b/howto/SSO.md
@@ -1,17 +1,17 @@
 # SSO with OIDC
 
-`jotty·page` supports any OIDC provider (Authentik, Auth0, Keycloak, Okta, etc.) with these requirements:
+`jotty·page` works with any OIDC provider (Authentik, Auth0, Keycloak, Okta, etc.) that:
 
-- Supports PKCE (most modern providers do)
-- Can be configured as a public client (no client secret needed)
-- Provides standard OIDC scopes (openid, profile, email)
+- Supports PKCE (most current providers do)
+- Can be set up as a public client, with no client secret
+- Provides the standard OIDC scopes (openid, profile, email)
 
-1. Configure your OIDC Provider:
+1. Configure your OIDC provider:
 
 - Client Type: Public
 - Grant Type: Authorization Code with PKCE
 - PKCE Code Challenge Method: S256
-  - _**note** S256 is the only PKCE method Jotty supports_
+  - _S256 is the only PKCE method Jotty supports_
 - Scopes: openid, profile, email
 - Redirect URI: https://YOUR_APP_HOST/api/oidc/callback
 - Post-logout URI: https://YOUR_APP_HOST/
@@ -44,88 +44,87 @@ services:
       # - INTERNAL_API_URL=http://localhost:3000 # Use if getting 403 errors after SSO login
 ```
 
-**Note**: When OIDC_CLIENT_SECRET is set, jotty·page switches to confidential client mode using client authentication instead of PKCE. This is more secure but requires provider support.
+When `OIDC_CLIENT_SECRET` is set, jotty·page switches to confidential client mode and authenticates with the client secret instead of PKCE. It's more secure, but your provider has to support it.
 
-Dev verified Providers:
+Providers I've tested myself:
 
 - Auth0 (`OIDC_ISSUER=https://YOUR_TENANT.REGION.auth0.com`)
 - Authentik (`OIDC_ISSUER=https://YOUR_DOMAIN/application/o/APP_SLUG/`)
 
-Other providers will likely work, but I can at least guarantee these do as I have test them both locally.  
-Community verified Providers:
+Other providers will probably work, but these two I've run locally and can vouch for.
+
+Providers the community has confirmed:
 
 - [Pocket ID](https://github.com/fccview/jotty/issues/6#issuecomment-3350380435)(`OIDC_ISSUER: https://my-pocket-id.domain.com`)
 - [Authelia](https://github.com/fccview/jotty/issues/6#issuecomment-3369291122) (`OIDC_ISSUER: https://my-authelia.domain.com`)
 - [Google](https://github.com/fccview/jotty/issues/6#issuecomment-3437686494) (`OIDC_ISSUER: https://accounts.google.com`)
 - [Entra ID (Azure AD)](https://github.com/fccview/jotty/issues/6#issuecomment-3464237999) (`OIDC_ISSUER: https://login.microsoftonline.com/{tenant-id}/v2.0`)
 
-Provider's specific notes:
+Provider-specific notes:
 
-- **Google** provider doesn't support usage of `groups` with OIDC authentication, so do NOT set the `OIDC_ADMIN_GROUPS` environment variable.
-- **Entra ID** provider allows usage of admin groups with `OIDC_ADMIN_GROUPS={Entra Group ID}` variable. For that, ensure to include optional `groups` claim in the 'Token Configuration' pane of your 'Enterprise Registration' AND define the environment variable to `OIDC_GROUPS_SCOPE="no"` or `OIDC_GROUPS_SCOPE=""`. Alternatively, use `OIDC_ADMIN_ROLES=role-name` to make use of Application Groups configured in Entra.
+- **Google** doesn't support `groups` with OIDC, so do NOT set `OIDC_ADMIN_GROUPS`.
+- **Entra ID** supports admin groups with `OIDC_ADMIN_GROUPS={Entra Group ID}`. For that to work, add the optional `groups` claim in the 'Token Configuration' pane of your 'Enterprise Registration' AND set `OIDC_GROUPS_SCOPE="no"` or `OIDC_GROUPS_SCOPE=""`. Or use `OIDC_ADMIN_ROLES=role-name` to use Application Groups configured in Entra.
 
-p.s. **First user to sign in via SSO when no local users exist becomes admin automatically.**
+If there are no local users yet, **the first person to sign in through SSO becomes admin.**
 
 ## Troubleshooting
 
-### 403 Forbidden Error After SSO Login (Behind Reverse Proxy)
+### 403 Forbidden error after SSO login (behind a reverse proxy)
 
-If you successfully authenticate via SSO but get redirected back to the login page, and your logs show:
+You log in through SSO fine, land back on the login page, and your logs show:
 
 ```
 MIDDLEWARE - sessionCheck: Response { ... status: 403 ... }
 MIDDLEWARE - session is not ok
 ```
 
-This means the app is trying to validate your session by calling its own API through the external URL, but your reverse proxy is blocking it.
+The app is checking your session by calling its own API through the external URL, and your reverse proxy is blocking that call.
 
-**Solution**: Set the `INTERNAL_API_URL` environment variable:
+Set `INTERNAL_API_URL`:
 
 ```yaml
 environment:
   - INTERNAL_API_URL=http://localhost:3000
 ```
 
-This tells the app to use `localhost` for internal API calls instead of going through the reverse proxy. The default value is already `http://localhost:3000`, but explicitly setting it can help in some edge cases.
+That makes the app call itself on `localhost` instead of going out through the reverse proxy. The default is already `http://localhost:3000`, but setting it explicitly fixes some odd setups.
 
-**Why this happens**: When `APP_URL` is set to your external domain (e.g., `https://jotty.domain.com`), the middleware tries to validate sessions by making a fetch request to `https://jotty.domain.com/api/auth/check-session`. This request goes through your reverse proxy, which may block it with a 403 Forbidden response due to security policies or misconfigurations.
+Why it happens: with `APP_URL` set to your external domain (e.g. `https://jotty.domain.com`), the middleware checks sessions by fetching `https://jotty.domain.com/api/auth/check-session`. That request goes through your reverse proxy, and a security policy or a misconfiguration there can answer it with a 403.
 
-### My Super Admin/System Owner User Is Not Using SSO
+### My superadmin (system owner) user is not using SSO
 
-The first user to register in the system is the "Super Admin", referred to as "System Owner" in the web interface.
+The first user to register on an instance is the superadmin, called "System Owner" in the web interface.
 
-If this user is not an SSO user, or if you need to change the super admin to a different user, you can update their
-super admin status using the `update-super-admin.sh` script below.
+If that user isn't an SSO user, or you want to hand superadmin to someone else, use the `update-super-admin.sh` script below.
 
-> Run from the server **outside** of the Docker container, if using Docker.
-> You need write permissions to the `users.json` file. You will if running this as `root`.
+> [!WARNING]
+> Run it on the server, **outside** the Docker container if you use Docker.
+> You need write access to `users.json`. Running as `root` gives you that.
 
-1. Locate your `data` volume location on the server filesystem and the `users.json` file. e.g. if using the example `docker-compose.yml`, under
-   `volumes` you will see `./data:/app/data:rw`. The `data` volume is under the location of your compose file, making
-   the full path to `users.json`:
+1. Find your `data` volume on the server and the `users.json` inside it. With the example `docker-compose.yml`, `volumes`
+   has `./data:/app/data:rw`, so `data` sits next to your compose file and the full path is:
    `<compose_location>/data/users.json`
 
-2. Run the `update-super-admin.sh` script with the appropriate arguments to update the super admin user:
+2. Run `update-super-admin.sh` with the new superadmin and the path to `users.json`:
 
    ```bash
    wget -qO- https://raw.githubusercontent.com/fccview/jotty/main/scripts/update-super-admin.sh | bash -s -- <new super admin> <users.json location>
    ```
 
-   Alternatively download the script and run it directly.
+   You can also download the script and run it directly.
 
-   Omit the arguments (`wget -qO- ... | bash`) for help text.
+   Leave the arguments off (`wget -qO- ... | bash`) to get the help text.
 
-   The old Super Admin user will be left as an Admin. The new Super Admin has the ability to delete the old user if
-   you choose to do so.
+   The old superadmin stays on as an admin. The new superadmin can delete that user if you want.
 
-## Advanced: Using Docker Secrets
+## Advanced: using Docker secrets
 
 <details>
-<summary>Docker Secrets configuration</summary>
+<summary>Docker secrets configuration</summary>
 
-For enhanced security in production environments, you can store OIDC credentials in files instead of environment variables. This prevents secrets from appearing in `docker inspect` output.
+You can keep OIDC credentials in files instead of environment variables, so they don't show up in `docker inspect` output.
 
-**Example docker-compose.yml:**
+Example `docker-compose.yml`:
 
 ```yaml
 services:
@@ -147,7 +146,7 @@ secrets:
     file: ./secrets/oidc_client_secret.txt
 ```
 
-**Create the secret files:**
+Create the secret files:
 
 ```bash
 mkdir secrets
@@ -156,6 +155,6 @@ echo "your_client_secret" > secrets/oidc_client_secret.txt
 chmod 600 secrets/*
 ```
 
-**Note:** You can mix and match - use `OIDC_CLIENT_ID` directly and `OIDC_CLIENT_SECRET_FILE` for the secret, or vice versa. The `_FILE` variants take priority if both are set. Most users can skip this and use regular environment variables.
+You can mix the two, e.g. `OIDC_CLIENT_ID` as a plain variable and `OIDC_CLIENT_SECRET_FILE` for the secret, or the other way round. If both forms are set, the `_FILE` one wins. Most people can skip all of this and use plain environment variables.
 
 </details>
diff --git a/howto/TRANSLATIONS.md b/howto/TRANSLATIONS.md
index d372c6fe4..919565ed1 100644
--- a/howto/TRANSLATIONS.md
+++ b/howto/TRANSLATIONS.md
@@ -1,62 +1,60 @@
 # Translations
 
-Jotty uses [next-intl](https://next-intl-docs.vercel.app/) for internationalization, providing a pretty flexible translation system.
+Jotty uses [next-intl](https://next-intl-docs.vercel.app/) for translations. The language files live in `app/_translations/`, one JSON file per language, with English as the complete one.
 
-## How Translation Works
+## How Jotty picks a language
 
-### Translation System
+1. The language the user chose in their own settings.
+2. Otherwise, the `DEFAULT_LOCALE` environment variable. This is also what guests see on the login page before anyone has logged in.
+3. Otherwise, `en`.
 
-1. **Locale Detection**: The application determines the language in the following order: User's personally selected locale (in their user settings), the `DEFAULT_LOCALE` environment variable, and finally defaulting to `en` if neither are set. This ensures that guest users (e.g., on the login page) see the application in your preferred default language before they log in.
-2. **Translation Loading**: The corresponding JSON file is loaded from `app/_translations/`
-3. **Custom Overrides**: If a custom translation file is added in your `config/` directory and specified using the `CUSTOM_TRANSLATION_FILE` environment variable, it will be used instead of the default translations, allowing you to override specific strings. This should allow users who are not comfortable in making pull requests to still be able to have Jotty in their native language.
+Jotty loads the matching file from `app/_translations/`. Any key missing from it falls back to English, so a half-finished translation still works.
 
-## Creating Custom Translations
+If you set `CUSTOM_TRANSLATION_FILE`, Jotty then applies that file from your `config/` directory on top. Only the keys in your file change. This is for people who want Jotty in their language, or want to reword a few strings, without opening a pull request.
 
-### Option 1: Local Custom Translation File
+## Custom translations
 
-You can create a custom translation file to override or extend the default translations without modifying the core files:
+### Option 1: a local custom translation file
 
-1. **Create a custom translation file** in the `config/` directory (e.g., `config/custom-translations.json`)
+1. Create a JSON file in the `config/` directory, for example `config/custom-translations.json`.
 
-2. **Copy the structure** from the base translation file you want to customize:
-   - View the [English translation file](https://github.com/fccview/jotty/blob/main/app/_translations/en.json) for the complete structure
-   - You only need to include the keys you want to override, not the entire file
+2. Copy in the keys you want to change, using the same structure as the base file:
+   - The [English translation file](https://github.com/fccview/jotty/blob/main/app/_translations/en.json) has every key
+   - You only need the keys you want to override, not the whole file
 
-3. **Enable your custom translations** by setting the environment variable:
+3. Point Jotty at it with the environment variable:
    ```bash
    CUSTOM_TRANSLATION_FILE=custom-translations.json
    ```
 
-4. **Restart the application** for changes to take effect
+4. Restart Jotty so it picks up the variable.
 
-### Option 2: Create a New Language
+### Option 2: a new language
 
-To add a completely new language to the application:
-
-1. **Copy the English translation file**:
+1. Copy the English file:
    ```bash
    cp app/_translations/en.json app/_translations/[language-code].json
    ```
-   Replace `[language-code]` with the appropriate ISO 639-1 language code (e.g., `fr` for French, `de` for German, `es` for Spanish)
+   Replace `[language-code]` with the ISO 639-1 code for the language, e.g. `fr` for French, `de` for German, `es` for Spanish.
 
-2. **Translate all strings** in the new file to your target language, make sure to keep the variable placeholders in english (e.g., `{count}`)
+2. Translate the strings. Leave the placeholders in curly braces as they are, in English (e.g. `{count}`).
 
-3. **Create a pull request** with your new translation file
+3. Open a pull request with the new file.
 
-## Contributing Translations
+## Contributing translations
 
-We welcome and encourage community translations! If you've translated the application into a new language, please consider contributing it back to the project.
+If you've translated Jotty into a new language, or filled in gaps in an existing one, please send it back as a pull request. We already ship Klingon and pirate, so no language is too silly.
 
-## Translation File Structure
+## Translation file structure
 
-The translation files are organized into logical sections:
+The files are split into sections by feature:
 
-- `common` - Shared UI elements (buttons, labels, etc.)
-- `auth` - Authentication and login
-- `notes` - Notes feature
-- `checklists` - Checklists feature
-- `tasks` - Task management
-- `profile` - User profile and settings
-- And so on...
+- `common` - shared UI bits like buttons and labels
+- `auth` - authentication and login
+- `notes` - notes
+- `checklists` - checklists
+- `tasks` - task management
+- `profile` - user profile and settings
+- and so on
 
-Please use common sense when creating new strings if you plan on creating new features.
\ No newline at end of file
+If you're adding strings for a new feature, put them in the section for that feature and name the keys so the next person can find them.
diff --git a/howto/UNRAID.md b/howto/UNRAID.md
index de2af0a2f..4254ed457 100644
--- a/howto/UNRAID.md
+++ b/howto/UNRAID.md
@@ -1,47 +1,50 @@
-# Unraid Deployment Guide
+# Unraid
 
-jotty·page can be installed on Unraid through the Community Applications store.
-You can find the template **[here](https://github.com/fccview/unraid-templates/raw/main/templates/jotty.xml)**
+You can install jotty·page on Unraid from a template. It's on its way to the Community Applications store, and until then you can grab it **[here](https://github.com/fccview/unraid-templates/raw/main/templates/jotty.xml)**.
 
 ## Installation
 
-### Via Community Applications (Coming soon)
+### From Community Applications (coming soon)
 
-1. Go to the **Apps** tab in Unraid
-2. Search for "jotty"
-3. Click **Install** on the jotty·page template
-4. Configure settings (see below)
-5. Click **Apply**
+1. Open the **Apps** tab in Unraid.
+2. Search for "jotty".
+3. Click **Install** on the jotty·page template.
+4. Fill in the settings below.
+5. Click **Apply**.
 
 ## Configuration
 
-### Port Settings
-- **Host Port**: `1122` (default, change to any available port)
-- **Container Port**: `3000` (do not change)
+### Ports
 
-Access at: `http://[UNRAID-IP]:1122`
+- Host port `1122` is the default. Change it to any free port.
+- Container port `3000` stays as it is.
 
-### Storage Paths
+Then open `http://[UNRAID-IP]:1122`.
 
-Default location: `/mnt/user/appdata/jotty/`
+### Storage paths
 
-- **`/data`**: Checklists, notes, users, encryption keys (**back this up!**)
-- **`/config`**: Custom themes and configuration
-- **`/cache`**: Next.js cache (optional, can be removed to save space)
+The default location is `/mnt/user/appdata/jotty/`.
 
-### User/Group
+- `/data` holds checklists, notes, users and encryption keys.
+- `/config` holds custom themes and configuration.
+- `/cache` is the Next.js cache. It's optional, and you can remove it to save space.
 
-- **PUID**: `99` (Unraid nobody user)
-- **PGID**: `100` (Unraid users group)
-- **Extra Parameters**: `--user 99:100`
+> [!IMPORTANT]
+> Back up `/data`. Everything your users wrote lives there, and nothing else can bring it back.
 
-To use different user/group, remove `--user 99:100` from Extra Parameters and update PUID/PGID.
+### User and group
 
-### Environment Variables
+- PUID `99` is Unraid's nobody user.
+- PGID `100` is Unraid's users group.
+- Extra Parameters is set to `--user 99:100`.
 
-See [ENV-VARIABLES.md](ENV-VARIABLES.md) for full list.
+To run as a different user or group, remove `--user 99:100` from Extra Parameters and change PUID and PGID.
 
-## Image Tags
+### Environment variables
 
-- **`latest`**: Stable release (recommended)
-- **`develop`**: Development branch (beta pre-release)
+The full list is in [ENV-VARIABLES.md](ENV-VARIABLES.md).
+
+## Image tags
+
+- `latest` is the stable release. Use this one.
+- `develop` is the development branch, a beta pre-release.
diff --git a/instrumentation.ts b/instrumentation.ts
index 165bf90b6..db8a78bcd 100644
--- a/instrumentation.ts
+++ b/instrumentation.ts
@@ -113,6 +113,8 @@ export async function register() {
       (globalThis as any).__jottyRelationsStarted = true;
       import("./app/_server/actions/relations/indexer")
         .then(({ reconcileRelations }) => reconcileRelations())
+        .then(() => import("./app/_server/actions/relations/watcher"))
+        .then(({ watchRelations }) => watchRelations())
         .catch((err) => console.error("[relations] startup reconcile failed:", err));
     }
 
diff --git a/tests/api/rebuild-index.test.ts b/tests/api/rebuild-index.test.ts
new file mode 100644
index 000000000..fb1cca149
--- /dev/null
+++ b/tests/api/rebuild-index.test.ts
@@ -0,0 +1,83 @@
+import { describe, it, expect, beforeEach, vi } from "vitest"
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup"
+
+const mockRebuildOwner = vi.fn()
+const mockGetUserIndex = vi.fn()
+
+vi.mock("@/app/_server/actions/relations/indexer", () => ({
+  rebuildOwnerRelations: (...args: unknown[]) => mockRebuildOwner(...args),
+}))
+
+vi.mock("@/app/_server/actions/users/helpers", () => ({
+  getUserIndex: (...args: unknown[]) => mockGetUserIndex(...args),
+}))
+
+import { POST } from "@/app/api/admin/rebuild-index/route"
+
+const URL = "http://localhost:3000/api/admin/rebuild-index"
+
+describe("POST /api/admin/rebuild-index", () => {
+  beforeEach(() => {
+    resetApiMocks()
+    mockRebuildOwner.mockReset().mockResolvedValue(2)
+    mockGetUserIndex.mockReset().mockResolvedValue(0)
+    mockAuthenticateApiKey.mockResolvedValue(mockUser)
+  })
+
+  it("rejects requests without a valid api key", async () => {
+    mockAuthenticateApiKey.mockResolvedValue(null)
+
+    const response = await POST(createMockRequest("POST", URL, {}))
+
+    expect(response.status).toBe(401)
+    expect(mockRebuildOwner).not.toHaveBeenCalled()
+  })
+
+  it("rebuilds your own index when no username is sent", async () => {
+    const response = await POST(createMockRequest("POST", URL))
+    const data = await getResponseJson(response)
+
+    expect(response.status).toBe(200)
+    expect(data.success).toBe(true)
+    expect(mockRebuildOwner).toHaveBeenCalledWith("testuser")
+  })
+
+  it("lets you name yourself without being an admin", async () => {
+    const response = await POST(createMockRequest("POST", URL, { username: "testuser" }))
+
+    expect(response.status).toBe(200)
+    expect(mockRebuildOwner).toHaveBeenCalledWith("testuser")
+  })
+
+  it("refuses to rebuild somebody else's index for a non-admin", async () => {
+    const response = await POST(createMockRequest("POST", URL, { username: "otheruser" }))
+
+    expect(response.status).toBe(403)
+    expect(mockRebuildOwner).not.toHaveBeenCalled()
+  })
+
+  it("lets an admin rebuild another user's index", async () => {
+    mockAuthenticateApiKey.mockResolvedValue({ ...mockUser, isAdmin: true })
+
+    const response = await POST(createMockRequest("POST", URL, { username: "otheruser" }))
+
+    expect(response.status).toBe(200)
+    expect(mockRebuildOwner).toHaveBeenCalledWith("otheruser")
+  })
+
+  it("returns 404 for a user that does not exist", async () => {
+    mockAuthenticateApiKey.mockResolvedValue({ ...mockUser, isAdmin: true })
+    mockGetUserIndex.mockResolvedValue(-1)
+
+    const response = await POST(createMockRequest("POST", URL, { username: "ghost" }))
+
+    expect(response.status).toBe(404)
+    expect(mockRebuildOwner).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/server-actions/relations.test.ts b/tests/server-actions/relations.test.ts
index f012cea60..f64a8ad42 100644
--- a/tests/server-actions/relations.test.ts
+++ b/tests/server-actions/relations.test.ts
@@ -24,7 +24,9 @@ import {
   forgetItemTree,
   indexItemFile,
   reconcileRelations,
+  refreshItemPaths,
 } from "@/app/_server/actions/relations/indexer";
+import { throttledBatch } from "@/app/_server/actions/relations/watcher";
 import { backlinksFor, graphFor, VisibleItem } from "@/app/_server/actions/relations/queries";
 import {
   closeRelationsDb,
@@ -400,6 +402,66 @@ describe("relations", () => {
     });
   });
 
+  describe("watching", () => {
+    it("indexes the first change after a settle and batches the rest into one pass a minute", async () => {
+      vi.useFakeTimers();
+      try {
+        const flush = vi.fn().mockResolvedValue(0);
+        const batch = throttledBatch(flush, 60_000, 1_000);
+
+        batch.add("/a.md");
+        await vi.advanceTimersByTimeAsync(1_000);
+        expect(flush).toHaveBeenCalledTimes(1);
+        expect(flush).toHaveBeenLastCalledWith(["/a.md"]);
+
+        for (let edit = 0; edit < 10; edit++) {
+          batch.add("/a.md");
+          batch.add(`/b${edit % 2}.md`);
+          await vi.advanceTimersByTimeAsync(3_000);
+        }
+        expect(flush).toHaveBeenCalledTimes(1);
+
+        await vi.advanceTimersByTimeAsync(60_000);
+        expect(flush).toHaveBeenCalledTimes(2);
+        expect([...flush.mock.calls[1][0]].sort()).toEqual(["/a.md", "/b0.md", "/b1.md"]);
+        batch.stop();
+      } finally {
+        vi.useRealTimers();
+      }
+    });
+
+    it("re-reads only paths whose file actually changed", async () => {
+      const aPath = itemPath("notes", "alice", "a.md");
+      write(aPath, note(A, "Alpha", `[Beta](/note/${B})`));
+      mockBroadcast.mockClear();
+
+      expect(await refreshItemPaths([aPath])).toBe(0);
+      expect(mockBroadcast).not.toHaveBeenCalled();
+
+      nodeFs.writeFileSync(aPath, note(A, "Alpha", "no links now"));
+      nodeFs.utimesSync(aPath, new Date(), new Date(Date.now() + 5_000));
+      expect(await refreshItemPaths([aPath])).toBe(1);
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Beta" }]);
+      expect(backlinksFor(B, visible).backlinks).toEqual([]);
+
+      nodeFs.rmSync(aPath);
+      expect(await refreshItemPaths([aPath])).toBe(1);
+      expect(mockBroadcast).toHaveBeenCalledWith(expect.objectContaining({ type: "relations" }));
+    });
+
+    it("picks up a category folder moved outside Jotty", async () => {
+      const from = itemPath("notes", "alice", "Old");
+      const to = itemPath("notes", "alice", "New");
+      write(path.join(from, "a.md"), note(A, "Alpha", `[Beta](/note/${B})`));
+      nodeFs.renameSync(from, to);
+
+      await refreshItemPaths([from, to]);
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Beta" }]);
+      expect(backlinksFor(B, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+    });
+  });
+
   describe("reconcileRelations", () => {
     it("builds from scratch, then forgets files that disappeared", async () => {
       const aPath = itemPath("notes", "alice", "a.md");
diff --git a/tests/server-actions/share-migration.test.ts b/tests/server-actions/share-migration.test.ts
index 23cd7a250..10b6bf61d 100644
--- a/tests/server-actions/share-migration.test.ts
+++ b/tests/server-actions/share-migration.test.ts
@@ -21,6 +21,10 @@ vi.mock("@/app/_server/actions/lib/migration-check", () => ({
 vi.mock("@/app/_server/actions/share/category-info", () => ({
   readCatInfo: (...args: any[]) => mockReadCatInfo(...args),
   writeCatInfo: (...args: any[]) => mockWriteCatInfo(...args),
+  mutateCatInfo: async (dir: string, mutate: (info: unknown) => unknown) => {
+    const next = mutate(await mockReadCatInfo(dir));
+    return next ? mockWriteCatInfo(dir, next) : false;
+  },
   catUuid: (...args: any[]) => mockCatUuid(...args),
   dirUuids: (...args: any[]) => mockDirUuids(...args),
 }));
diff --git a/tests/server-actions/sharing.test.ts b/tests/server-actions/sharing.test.ts
index 6ad621176..7503f8de2 100644
--- a/tests/server-actions/sharing.test.ts
+++ b/tests/server-actions/sharing.test.ts
@@ -24,6 +24,10 @@ const mockOwnerOfList = vi.fn();
 vi.mock("@/app/_server/actions/share/category-info", () => ({
   readCatInfo: (...args: unknown[]) => mockReadCatInfo(...args),
   writeCatInfo: (...args: unknown[]) => mockWriteCatInfo(...args),
+  mutateCatInfo: async (dir: string, mutate: (info: unknown) => unknown) => {
+    const next = mutate(await mockReadCatInfo(dir));
+    return next ? mockWriteCatInfo(dir, next) : false;
+  },
   catDirByUuid: (...args: unknown[]) => mockCatDirByUuid(...args),
   catUuid: (...args: unknown[]) => mockCatUuid(...args),
 }));
diff --git a/tests/server-actions/users.test.ts b/tests/server-actions/users.test.ts
index fda4a2548..68f3fcb98 100644
--- a/tests/server-actions/users.test.ts
+++ b/tests/server-actions/users.test.ts
@@ -629,6 +629,17 @@ describe('Users Actions', () => {
       }))
     })
 
+    it('should save where new checklist items go', async () => {
+      mockReadJsonFile.mockResolvedValue([
+        { username: 'testuser', passwordHash: 'hash', isAdmin: false, newItemInsertion: 'top' },
+      ])
+
+      const result = await updateUserSettings({ newItemInsertion: 'bottom' })
+
+      expect(result.success).toBe(true)
+      expect(result.data?.user.newItemInsertion).toBe('bottom')
+    })
+
     it('should return the updated user without credentials or mfa secrets', async () => {
       mockReadJsonFile.mockResolvedValue([
         {
diff --git a/tests/utils/callout-utils.test.ts b/tests/utils/callout-utils.test.ts
new file mode 100644
index 000000000..bd651beb1
--- /dev/null
+++ b/tests/utils/callout-utils.test.ts
@@ -0,0 +1,68 @@
+import { describe, it, expect, vi } from "vitest";
+
+vi.unmock("unified");
+vi.unmock("unist-util-visit");
+vi.unmock("js-beautify");
+vi.unmock("@/app/_utils/markdown-utils");
+
+import { matchCallout } from "@/app/_utils/callout-utils";
+import { convertMarkdownToHtml } from "@/app/_utils/markdown-utils";
+
+describe("Callout Utils", () => {
+  describe("matchCallout", () => {
+    it.each([
+      ["INFO", "info"],
+      ["WARNING", "warning"],
+      ["SUCCESS", "success"],
+      ["DANGER", "danger"],
+    ])("should keep reading jotty's own [!%s]", (marker, type) => {
+      expect(matchCallout(`[!${marker}] hello`)?.type).toBe(type);
+    });
+
+    it.each([
+      ["NOTE", "info"],
+      ["TIP", "success"],
+      ["IMPORTANT", "warning"],
+      ["CAUTION", "danger"],
+    ])("should map github's [!%s] to %s", (marker, type) => {
+      expect(matchCallout(`[!${marker}]`)?.type).toBe(type);
+    });
+
+    it("should ignore case", () => {
+      expect(matchCallout("[!note]")?.type).toBe("info");
+      expect(matchCallout("[!Danger]")?.type).toBe("danger");
+    });
+
+    it("should return the marker with trailing whitespace", () => {
+      expect(matchCallout("[!TIP]  rest")?.marker).toBe("[!TIP]  ");
+    });
+
+    it("should refuse unknown or partial markers", () => {
+      expect(matchCallout("[!INFORMATION]")).toBeNull();
+      expect(matchCallout("[!BANANA]")).toBeNull();
+      expect(matchCallout("text [!INFO]")).toBeNull();
+      expect(matchCallout("[INFO]")).toBeNull();
+    });
+  });
+
+  describe("convertMarkdownToHtml", () => {
+    it("should render a legacy [!INFO] callout", () => {
+      const html = convertMarkdownToHtml("> [!INFO]\n> Old style");
+      expect(html).toContain('data-callout-type="info"');
+      expect(html).toContain("Old style");
+      expect(html).not.toContain("[!INFO]");
+    });
+
+    it("should render a github [!CAUTION] callout as danger", () => {
+      const html = convertMarkdownToHtml("> [!CAUTION]\n> Mind the gap");
+      expect(html).toContain('data-callout-type="danger"');
+      expect(html).not.toContain("[!CAUTION]");
+    });
+
+    it("should leave a plain blockquote alone", () => {
+      const html = convertMarkdownToHtml("> just a quote");
+      expect(html).toContain("<blockquote>");
+      expect(html).not.toContain("callout");
+    });
+  });
+});
diff --git a/tests/utils/item-link-text.test.ts b/tests/utils/item-link-text.test.ts
new file mode 100644
index 000000000..66114a28c
--- /dev/null
+++ b/tests/utils/item-link-text.test.ts
@@ -0,0 +1,37 @@
+import { describe, it, expect } from "vitest"
+import { plainItemText } from "@/app/_utils/item-href-utils"
+import { linkQueryOf } from "@/app/_hooks/useItemLinkSuggestions"
+
+describe("plainItemText", () => {
+  it("keeps the words of links and wikilinks and drops the syntax", () => {
+    expect(
+      plainItemText(
+        "Check [Boiler \\[old\\]](/note/9e5e4c9f-4dd0-4306-9690-3af758cc23f1) and [[Tokyo itinerary#Day 1|the trip]] then [[Plan]]",
+      ),
+    ).toBe("Check Boiler [old] and the trip then Plan")
+  })
+
+  it("leaves ordinary text alone", () => {
+    expect(plainItemText("Buy milk #home")).toBe("Buy milk #home")
+  })
+})
+
+describe("linkQueryOf", () => {
+  it("opens on @ at the start or after a space", () => {
+    expect(linkQueryOf("@boi")).toEqual({ start: 0, query: "boi" })
+    expect(linkQueryOf("Check the @boi")).toEqual({ start: 10, query: "boi" })
+  })
+
+  it("ignores @ inside an email address", () => {
+    expect(linkQueryOf("mail me@home")).toBeNull()
+  })
+
+  it("closes an @ query on a space but lets [[ run across words", () => {
+    expect(linkQueryOf("Check @boiler room")).toBeNull()
+    expect(linkQueryOf("and [[living room")).toEqual({ start: 4, query: "living room" })
+  })
+
+  it("stops once the wikilink is closed", () => {
+    expect(linkQueryOf("and [[Plan]]")).toBeNull()
+  })
+})

From 473d91f1e4fcb2879b09cc8f19dd56a755560354 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 16:21:11 +0100
Subject: [PATCH 08/28] slight re-style

---
 .../FeatureComponents/Howto/HowtoSidebar.tsx       |  4 ++++
 .../TipTap/CustomExtensions/SlashCommands.tsx      |  5 +++++
 app/_translations/en.json                          |  2 ++
 app/_utils/howto-utils.ts                          | 14 ++++++++++++++
 howto/BRAIN.md                                     |  2 +-
 5 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/app/_components/FeatureComponents/Howto/HowtoSidebar.tsx b/app/_components/FeatureComponents/Howto/HowtoSidebar.tsx
index 4f4a919e7..46c0cad5d 100644
--- a/app/_components/FeatureComponents/Howto/HowtoSidebar.tsx
+++ b/app/_components/FeatureComponents/Howto/HowtoSidebar.tsx
@@ -20,6 +20,8 @@ import {
   CodeIcon,
   RainIcon,
   Wrench01Icon,
+  AiBrain04Icon,
+  UserMultipleIcon,
 } from "hugeicons-react";
 
 interface HowtoSidebarProps {
@@ -41,6 +43,8 @@ const iconMap: Record<string, any> = {
   translation: TranslationIcon,
   rain: RainIcon,
   patch: Wrench01Icon,
+  brain: AiBrain04Icon,
+  users: UserMultipleIcon,
 };
 
 export const HowtoSidebar = ({ isOpen, onClose }: HowtoSidebarProps) => {
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/SlashCommands.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/SlashCommands.tsx
index b181e7cd3..9dc79881f 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/SlashCommands.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/SlashCommands.tsx
@@ -29,6 +29,8 @@ import { itemHref } from "@/app/_utils/global-utils";
 
 const WIKILINK_OPEN = "[[";
 
+const WIKILINK_CLOSE_CHAR = "]";
+
 const mentionable = <T extends { uuid?: string }>(items?: T[]): T[] =>
   items?.filter((item) => Boolean(item.uuid)) || [];
 
@@ -621,6 +623,9 @@ export const SlashCommands = Extension.create({
           ...this.options.atSuggestion,
           char: WIKILINK_OPEN,
           allowSpaces: true,
+          allow: ({ editor, state, range }: { editor: any; state: any; range: { from: number; to: number } }) =>
+            !editor.isActive("codeBlock") &&
+            !state.doc.textBetween(range.from, range.to).includes(WIKILINK_CLOSE_CHAR),
           pluginKey: new PluginKey("wikiSuggestion"),
         })
       );
diff --git a/app/_translations/en.json b/app/_translations/en.json
index d44f4df80..bfcb21dab 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -1743,6 +1743,7 @@
     "howTo": "How to",
     "shortcuts": "Shortcuts",
     "markdownGuide": "Markdown Guide",
+    "brain": "Links & Brain",
     "customisations": "Customisations",
     "docker": "Docker",
     "envVariables": "Env Variables",
@@ -1750,6 +1751,7 @@
     "pwa": "PWA",
     "encryption": "Encryption",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Translations",
     "unraid": "Unraid",
     "patches": "Patches"
diff --git a/app/_utils/howto-utils.ts b/app/_utils/howto-utils.ts
index 35b2fbdbc..1e985f4b8 100644
--- a/app/_utils/howto-utils.ts
+++ b/app/_utils/howto-utils.ts
@@ -24,6 +24,13 @@ export const getHowtoGuides = (t: any): HowtoGuide[] => [
     icon: "hash",
     translationKey: "help.markdownGuide",
   },
+  {
+    id: "brain",
+    name: t("help.brain"),
+    filename: "BRAIN.md",
+    icon: "brain",
+    translationKey: "help.brain",
+  },
   {
     id: "api",
     name: t("common.api"),
@@ -87,6 +94,13 @@ export const getHowtoGuides = (t: any): HowtoGuide[] => [
     icon: "squarelock",
     translationKey: "help.sso",
   },
+  {
+    id: "ldap",
+    name: t("help.ldap"),
+    filename: "LDAP.md",
+    icon: "users",
+    translationKey: "help.ldap",
+  },
   {
     id: "translations",
     name: t("help.translations"),
diff --git a/howto/BRAIN.md b/howto/BRAIN.md
index 4d3d53195..2b1952726 100644
--- a/howto/BRAIN.md
+++ b/howto/BRAIN.md
@@ -94,7 +94,7 @@ Jotty keeps the links in `data/.relations.db`, next to your notes. Your Markdown
 - Jotty never reads encrypted notes, so their links don't appear anywhere.
 - If the file is missing or damaged, Jotty rebuilds it from your notes on start. While that runs, Referenced By and the brain show "Indexing relationships...".
 - Files changed outside Jotty are picked up within about a minute.
-- Admins can rebuild it from **Admin > Content**, or with the [rebuild API](API.md#15-rebuild-link-index).
+- Anyone can rebuild their own index with the [rebuild API](API.md#15-rebuild-link-index). Admins can also rebuild another user's, or everyone's from **Admin > Content**.
 
 > [!NOTE]
 > A rebuild remembers which note each wikilink first matched. Deleting the file forgets that. Wikilinks whose target you renamed in Jotty, sitting in notes you haven't saved since, go back to matching by title.

From 71f764bb84cfb9367b574d3b85452a33ad7731d3 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 17:27:34 +0100
Subject: [PATCH 09/28] rabbit nitpicks and redblood bug

---
 README.md                                |   2 +
 app/_hooks/useNoteEditor.tsx             |  10 ++
 app/_server/actions/checklist/queries.ts |   4 +-
 app/_server/actions/note/crud.ts         |   1 +
 app/_server/actions/note/parsers.ts      |  10 +-
 app/_server/actions/relations/index.ts   |   2 +-
 app/_server/actions/share/target.ts      |   9 ++
 app/_utils/checklist-utils.ts            |  10 +-
 howto/API.md                             |  38 ++---
 howto/BRAIN.md                           |   2 +-
 howto/DOCKER.md                          |   2 +-
 package.json                             |   3 +
 tests/mock-data/brain-seed.ts            |  16 +-
 tests/server-actions/note.test.ts        |   1 +
 tests/server-actions/share-edit.test.ts  | 178 +++++++++++++++++++++++
 15 files changed, 247 insertions(+), 41 deletions(-)
 create mode 100644 tests/server-actions/share-edit.test.ts

diff --git a/README.md b/README.md
index c0b10d123..5c062e6d8 100644
--- a/README.md
+++ b/README.md
@@ -90,6 +90,8 @@ My recommended way to run `jotty·page` is with Docker. You can also use:
 - The [Proxmox community script](https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/jotty.sh) for Proxmox VE
 - The [Unraid template](howto/UNRAID.md) for Unraid Community Applications
 
+Running it without Docker, from source or from the prebuilt tarball, needs Node.js 22.15 or later.
+
 <a id="docker-compose"></a>
 
 ### Docker Compose (Recommended)
diff --git a/app/_hooks/useNoteEditor.tsx b/app/_hooks/useNoteEditor.tsx
index efea82080..a6e2d0017 100644
--- a/app/_hooks/useNoteEditor.tsx
+++ b/app/_hooks/useNoteEditor.tsx
@@ -270,6 +270,14 @@ export const useNoteEditor = ({
 
       const result = await updateNote(formData, useAutosave);
 
+      if (!result.success) {
+        showToast({
+          type: "error",
+          title: t("common.error"),
+          message: result.error || t("common.error"),
+        });
+      }
+
       if (useAutosave && result.success && result.data) {
         return;
       } else {
@@ -295,6 +303,8 @@ export const useNoteEditor = ({
       onUpdate,
       router,
       isEditingEncrypted,
+      showToast,
+      t,
     ]
   );
 
diff --git a/app/_server/actions/checklist/queries.ts b/app/_server/actions/checklist/queries.ts
index 26f46cd3b..08e3a639b 100644
--- a/app/_server/actions/checklist/queries.ts
+++ b/app/_server/actions/checklist/queries.ts
@@ -12,7 +12,9 @@ import { getUserModeDir, ensureDir } from "@/app/_server/actions/file";
 import { readJsonFile } from "@/app/_server/actions/file";
 import { parseChecklistContent } from "@/app/_utils/client-parser-utils";
 import {
+  createdAtOf,
   extractChecklistType,
+  extractYamlMetadata,
   toIso,
 } from "@/app/_utils/yaml-metadata-utils";
 import { readListsRecursively, type ChecklistReadResult } from "./readers";
@@ -338,7 +340,7 @@ export const getListById = async (
     type: checklistType as Checklist["type"],
     items: parsedData.items,
     category: listCategory,
-    createdAt: toIso(stats.birthtime),
+    createdAt: createdAtOf(extractYamlMetadata(rawContent).metadata, stats.birthtime),
     updatedAt: toIso(stats.mtime),
     owner: ownerUsername,
     isShared,
diff --git a/app/_server/actions/note/crud.ts b/app/_server/actions/note/crud.ts
index b11d29338..24ca5a82a 100644
--- a/app/_server/actions/note/crud.ts
+++ b/app/_server/actions/note/crud.ts
@@ -281,6 +281,7 @@ export const updateNote = async (formData: FormData, autosaveNotes = false) => {
       data: { ...updatedDoc, category: shownCategory },
     };
   } catch (error) {
+    console.error("Error updating note:", error);
     const { title, uuid } = getFormData(formData, ["title", "uuid"]);
     await logContentEvent(
       "note_updated",
diff --git a/app/_server/actions/note/parsers.ts b/app/_server/actions/note/parsers.ts
index 10a5afd84..54d8f5dbc 100644
--- a/app/_server/actions/note/parsers.ts
+++ b/app/_server/actions/note/parsers.ts
@@ -7,6 +7,7 @@ import {
   generateUuid,
   strayMeta,
   createdAtOf,
+  OwnedMetaKeys,
 } from "@/app/_utils/yaml-metadata-utils";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
@@ -32,9 +33,7 @@ export const parseMarkdownNote = (
     title,
     content: contentWithoutMetadata,
     category,
-    createdAt: fileStats
-      ? createdAtOf(metadata, fileStats.birthtime)
-      : new Date().toISOString(),
+    createdAt: createdAtOf(metadata, fileStats?.birthtime ?? new Date()),
     updatedAt: fileStats
       ? fileStats.mtime.toISOString()
       : new Date().toISOString(),
@@ -51,7 +50,10 @@ export const parseMarkdownNote = (
 };
 
 export const noteToMarkdown = (note: Note): string => {
-  const metadata: Record<string, unknown> = { ...(note.extraMetadata || {}) };
+  const metadata: Record<string, unknown> = {
+    ...(note.createdAt && { [OwnedMetaKeys.CREATED_AT]: note.createdAt }),
+    ...(note.extraMetadata || {}),
+  };
   metadata.uuid = note.uuid || generateUuid();
 
   let content = note.content || "";
diff --git a/app/_server/actions/relations/index.ts b/app/_server/actions/relations/index.ts
index 9e1039881..2d68c6fc6 100644
--- a/app/_server/actions/relations/index.ts
+++ b/app/_server/actions/relations/index.ts
@@ -118,7 +118,7 @@ const _editLinking = async (
     const formData = new FormData();
     formData.append("uuid", note.uuid || sourceUuid);
     formData.append("title", note.title);
-    formData.append("category", note.category || "");
+    formData.append("category", "");
     formData.append("content", content);
 
     const result = await updateNote(formData);
diff --git a/app/_server/actions/share/target.ts b/app/_server/actions/share/target.ts
index ce691a40e..8e2534382 100644
--- a/app/_server/actions/share/target.ts
+++ b/app/_server/actions/share/target.ts
@@ -105,6 +105,9 @@ export interface MovePlan {
   isMoving: boolean;
 }
 
+const _samePlace = (a: string, b: string): boolean =>
+  (a || UNCATEGORIZED) === (b || UNCATEGORIZED);
+
 export const movePlan = async (
   mode: Modes,
   username: string,
@@ -117,6 +120,12 @@ export const movePlan = async (
   };
 
   const target = await targetDir(mode, username, requested);
+  const shown = await shownAs(mode, username, home.owner, home.category);
+
+  if (_samePlace(requested, shown)) {
+    return { home, target, destination: home, isMoving: false };
+  }
+
   const anchored = target.isImplicit && target.owner === home.owner;
 
   const destination: Place = anchored
diff --git a/app/_utils/checklist-utils.ts b/app/_utils/checklist-utils.ts
index 21e6f5754..36946c37c 100644
--- a/app/_utils/checklist-utils.ts
+++ b/app/_utils/checklist-utils.ts
@@ -14,6 +14,7 @@ import {
   generateUuid,
   strayMeta,
   createdAtOf,
+  OwnedMetaKeys,
 } from "./yaml-metadata-utils";
 import { extractHashtagsFromContent, normalizeTag } from "./tag-utils";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
@@ -346,9 +347,7 @@ export const parseMarkdown = (
     type: checklistType,
     category,
     items,
-    createdAt: fileStats
-      ? createdAtOf(metadata, fileStats.birthtime)
-      : new Date().toISOString(),
+    createdAt: createdAtOf(metadata, fileStats?.birthtime ?? new Date()),
     updatedAt: fileStats
       ? fileStats.mtime.toISOString()
       : new Date().toISOString(),
@@ -533,7 +532,10 @@ const generateItemMarkdown = (
 };
 
 export const listToMarkdown = (list: Checklist): string => {
-  const metadata: Record<string, unknown> = { ...(list.extraMetadata || {}) };
+  const metadata: Record<string, unknown> = {
+    ...(list.createdAt && { [OwnedMetaKeys.CREATED_AT]: list.createdAt }),
+    ...(list.extraMetadata || {}),
+  };
   metadata.uuid = list.uuid || generateUuid();
   metadata.title = list.title || "Untitled Checklist";
   if (list.type === ChecklistsTypes.KANBAN) metadata.checklistType = "kanban";
diff --git a/howto/API.md b/howto/API.md
index a29bb6ee4..51aa179d2 100644
--- a/howto/API.md
+++ b/howto/API.md
@@ -548,7 +548,7 @@ Returns every note you own.
 
 Every note has a `category`. Notes created without one are in "Uncategorized".
 
-### 10. Create note
+### 11. Create note
 
 **POST** `/api/notes`
 
@@ -587,7 +587,7 @@ Creates a note owned by you.
 }
 ```
 
-### 11. Update note
+### 12. Update note
 
 **PUT** `/api/notes/{noteId}`
 
@@ -628,7 +628,7 @@ Updates a note.
 }
 ```
 
-### 12. Delete note
+### 13. Delete note
 
 **DELETE** `/api/notes/{noteId}`
 
@@ -646,7 +646,7 @@ Deletes a note.
 
 The `/tasks` endpoints work on task checklists as Kanban boards. Each board has its own list of statuses, one per column, and every item sits in one of them.
 
-### 13. Get all tasks
+### 14. Get all tasks
 
 **GET** `/api/tasks`
 
@@ -688,7 +688,7 @@ Returns every task checklist you own.
 }
 ```
 
-### 14. Create task
+### 15. Create task
 
 **POST** `/api/tasks`
 
@@ -735,7 +735,7 @@ Creates a task checklist owned by you.
 }
 ```
 
-### 15. Get task
+### 16. Get task
 
 **GET** `/api/tasks/{taskId}`
 
@@ -769,7 +769,7 @@ Returns one task checklist.
 }
 ```
 
-### 16. Update task
+### 17. Update task
 
 **PUT** `/api/tasks/{taskId}`
 
@@ -800,7 +800,7 @@ Changes the title, the category or both. Both fields are optional.
 }
 ```
 
-### 17. Delete task
+### 18. Delete task
 
 **DELETE** `/api/tasks/{taskId}`
 
@@ -814,7 +814,7 @@ Deletes a task checklist.
 }
 ```
 
-### 18. Get task statuses
+### 19. Get task statuses
 
 **GET** `/api/tasks/{taskId}/statuses`
 
@@ -832,7 +832,7 @@ Returns the Kanban columns of a task.
 }
 ```
 
-### 19. Create status
+### 20. Create status
 
 **POST** `/api/tasks/{taskId}/statuses`
 
@@ -870,7 +870,7 @@ Adds a Kanban column to a task.
 }
 ```
 
-### 20. Update status
+### 21. Update status
 
 **PUT** `/api/tasks/{taskId}/statuses/{statusId}`
 
@@ -900,7 +900,7 @@ Changes a Kanban column.
 }
 ```
 
-### 21. Delete status
+### 22. Delete status
 
 **DELETE** `/api/tasks/{taskId}/statuses/{statusId}`
 
@@ -914,7 +914,7 @@ Deletes a Kanban column. Items in it move to the first remaining status.
 }
 ```
 
-### 22. Create task item
+### 23. Create task item
 
 **POST** `/api/tasks/{taskId}/items`
 
@@ -1002,7 +1002,7 @@ Returns one task item with its `children` and Kanban fields. `itemIndex` can be
 }
 ```
 
-### 23. Update item status
+### 24. Update item status
 
 **PUT** `/api/tasks/{taskId}/items/{itemIndex}/status`
 
@@ -1037,7 +1037,7 @@ PUT /api/tasks/550e8400-e29b-41d4-a716-446655440000/items/0.1/status
 }
 ```
 
-### 24. Delete task item
+### 25. Delete task item
 
 **DELETE** `/api/tasks/{taskId}/items/{itemIndex}`
 
@@ -1059,7 +1059,7 @@ DELETE /api/tasks/550e8400-e29b-41d4-a716-446655440000/items/0.1
 
 This deletes the second child of the first top-level item.
 
-### 25. Get user information
+### 26. Get user information
 
 **GET** `/api/user/{username}`
 
@@ -1102,7 +1102,7 @@ Returns a user's profile. You get the full record for yourself, or for anyone if
 
 `passwordHash`, `apiKey` and other secrets are never in the response.
 
-### 14. Get all categories
+### 27. Get all categories
 
 **GET** `/api/categories`
 
@@ -1158,7 +1158,7 @@ Returns your note and checklist categories. Archived categories are left out.
 - `count`: how many items are in it
 - `level`: how deep it is nested, 0 for top-level categories
 
-### 15. Rebuild link index
+### 28. Rebuild link index
 
 **POST** `/api/admin/rebuild-index`
 
@@ -1199,7 +1199,7 @@ Rebuilds the relationships index, the list of which notes and checklists link to
 - Wikilinks keep pointing at the note they were first matched to, so a rebuild does not move them onto a different note with the same title
 - The index lives in `data/.relations.db`. If it is deleted, Jotty rebuilds it from your files
 
-### 16. Get user summary statistics
+### 29. Get user summary statistics
 
 **GET** `/api/summary`
 
diff --git a/howto/BRAIN.md b/howto/BRAIN.md
index 2b1952726..7c0b93906 100644
--- a/howto/BRAIN.md
+++ b/howto/BRAIN.md
@@ -94,7 +94,7 @@ Jotty keeps the links in `data/.relations.db`, next to your notes. Your Markdown
 - Jotty never reads encrypted notes, so their links don't appear anywhere.
 - If the file is missing or damaged, Jotty rebuilds it from your notes on start. While that runs, Referenced By and the brain show "Indexing relationships...".
 - Files changed outside Jotty are picked up within about a minute.
-- Anyone can rebuild their own index with the [rebuild API](API.md#15-rebuild-link-index). Admins can also rebuild another user's, or everyone's from **Admin > Content**.
+- Anyone can rebuild their own index with the [rebuild API](API.md#28-rebuild-link-index). Admins can also rebuild another user's, or everyone's from **Admin > Content**.
 
 > [!NOTE]
 > A rebuild remembers which note each wikilink first matched. Deleting the file forgets that. Wikilinks whose target you renamed in Jotty, sitting in notes you haven't saved since, go back to matching by title.
diff --git a/howto/DOCKER.md b/howto/DOCKER.md
index c5e8a42ad..8af6490c9 100644
--- a/howto/DOCKER.md
+++ b/howto/DOCKER.md
@@ -80,7 +80,7 @@ volumes:
 Host folders mounted into the container, so your data survives the container being replaced.
 
 - `- ./data:/app/data:rw` is your local `data` folder, mounted read-write at `/app/data`. Your checklists, notes, users and settings live here. Back it up.
-- `- ./config:/app/config:ro` is your local `config` folder, mounted read-only at `/app/config`. Custom themes and config files go here.
+- `- ./config:/app/config:rw` is your local `config` folder, mounted read-write at `/app/config`. Custom themes and config files go here, and the admin panel saves to it.
 - `- ./cache:/app/.next/cache:rw` is optional. It keeps the Next.js build cache between container restarts, so the app is faster after a restart.
 
 ## Restart policy
diff --git a/package.json b/package.json
index 587ca739a..5ace3e882 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,9 @@
   "name": "jotty.page",
   "version": "1.27.0",
   "private": true,
+  "engines": {
+    "node": ">=22.15.0 <23 || >=23.11.0"
+  },
   "scripts": {
     "dev": "next dev",
     "build": "next build && node scripts/postbuild.js",
diff --git a/tests/mock-data/brain-seed.ts b/tests/mock-data/brain-seed.ts
index cdb77092b..7cd956c35 100644
--- a/tests/mock-data/brain-seed.ts
+++ b/tests/mock-data/brain-seed.ts
@@ -203,17 +203,13 @@ const _itemsFor = (list: Seeded, all: Seeded[]): Item[] => {
   });
 };
 
-const _write = async (
-  root: string,
-  category: string,
-  title: string,
-  content: string,
-  createdAt = new Date().toISOString(),
-) => {
+const _write = async (root: string, category: string, title: string, content: string) => {
   const dir = path.join(root, ...category.split("/"));
   await fs.mkdir(dir, { recursive: true });
-  const stamped = content.replace(/^---\n/, `---\ncreatedAt: "${createdAt}"\n`);
-  await fs.writeFile(path.join(dir, `${_slug(title)}.md`), stamped, "utf-8");
+  const file = path.join(dir, `${_slug(title)}.md`);
+  const tmp = `${file}.${process.pid}.tmp`;
+  await fs.writeFile(tmp, content, "utf-8");
+  await fs.rename(tmp, file);
 };
 
 const _withUsers = async (change: (users: Record<string, unknown>[]) => Record<string, unknown>[]) => {
@@ -353,7 +349,7 @@ const _seed = async () => {
     owner: USERNAME,
   }));
   for (const twin of twins) {
-    await _write(NOTES_ROOT, "Ideas", twin.id, noteToMarkdown(twin as Note), twin.createdAt);
+    await _write(NOTES_ROOT, "Ideas", twin.id, noteToMarkdown(twin as Note));
   }
 
   const renamer: Note = {
diff --git a/tests/server-actions/note.test.ts b/tests/server-actions/note.test.ts
index 4afcbe3c8..173978e69 100644
--- a/tests/server-actions/note.test.ts
+++ b/tests/server-actions/note.test.ts
@@ -89,6 +89,7 @@ vi.mock("@/app/_utils/filename-utils", () => ({
 }));
 
 vi.mock("@/app/_utils/yaml-metadata-utils", () => ({
+  OwnedMetaKeys: { CREATED_AT: "createdAt" },
   generateUuid: vi.fn().mockReturnValue("test-uuid-123"),
   generateYamlFrontmatter: (...args: any[]) =>
     mockGenerateYamlFrontmatter(...args),
diff --git a/tests/server-actions/share-edit.test.ts b/tests/server-actions/share-edit.test.ts
new file mode 100644
index 000000000..7d67b7e30
--- /dev/null
+++ b/tests/server-actions/share-edit.test.ts
@@ -0,0 +1,178 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from "vitest";
+import path from "path";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+
+const { home, root, actor } = vi.hoisted(() => {
+  const os = process.getBuiltinModule("os");
+  const fs = process.getBuiltinModule("fs");
+  const nodePath = process.getBuiltinModule("path");
+  const previous = process.cwd();
+
+  process.chdir(fs.mkdtempSync(nodePath.join(os.tmpdir(), "jotty-share-edit-")));
+
+  return { home: previous, root: process.cwd(), actor: { username: "alice" } };
+});
+
+vi.unmock("fs/promises");
+vi.unmock("@/app/_utils/checklist-utils");
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: vi.fn(),
+}));
+
+vi.mock("@/app/_server/actions/history", () => ({
+  commitNote: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/app/_server/actions/log", () => ({
+  logContentEvent: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/app/_server/actions/relations/tracking", () => ({
+  trackItemWrite: vi.fn(),
+  trackItemDelete: vi.fn(),
+  trackTreeDelete: vi.fn(),
+  trackMove: vi.fn(),
+}));
+
+vi.mock("@/app/_server/actions/relations/tidy", () => ({
+  tidyItemLinks: async (content: string) => content,
+  refreshWikilinks: (content: string) => content,
+}));
+
+vi.mock("@/app/_server/actions/users", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/app/_server/actions/users")>()),
+  canAccessAllContent: async () => false,
+  getUsername: async () => actor.username,
+  getCurrentUser: async () => ({ username: actor.username }),
+}));
+
+import { updateNote } from "@/app/_server/actions/note/crud";
+import { updateList } from "@/app/_server/actions/checklist/crud";
+import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+import { dropMounts } from "@/app/_server/actions/share/mounts";
+import { Modes } from "@/app/_types/enums";
+import { DATA_DIR, USERS_FILE } from "@/app/_consts/files";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+
+const NOTE = "66666666-6666-4666-8666-666666666666";
+const LIST = "88888888-8888-4888-8888-888888888888";
+const BORN = "2024-01-02T03:04:05.000Z";
+const BOB_OWN = "77777777-7777-4777-8777-777777777777";
+
+const noteDir = (owner: string, category = UNCATEGORIZED): string =>
+  path.join(root, DATA_DIR, Modes.NOTES, owner, category);
+
+const listDir = (owner: string): string =>
+  path.join(root, DATA_DIR, Modes.CHECKLISTS, owner, UNCATEGORIZED);
+
+const writeFile = (dir: string, name: string, frontmatter: string[], body: string) => {
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    path.join(dir, `${name}.md`),
+    ["---", ...frontmatter, "---", body, ""].join("\n"),
+  );
+};
+
+const writeNote = (owner: string, name: string, frontmatter: string[], body: string) =>
+  writeFile(noteDir(owner), name, frontmatter, body);
+
+const createdAtIn = (file: string): unknown =>
+  extractYamlMetadata(readFileSync(file, "utf-8")).metadata.createdAt;
+
+const saveAs = async (
+  username: string,
+  content: string,
+  category = UNCATEGORIZED,
+  title = "Plan",
+) => {
+  actor.username = username;
+  const formData = new FormData();
+  formData.append("uuid", NOTE);
+  formData.append("title", title);
+  formData.append("category", category);
+  formData.append("user", "alice");
+  formData.append("content", content);
+  return updateNote(formData);
+};
+
+afterAll(() => {
+  process.chdir(home);
+  rmSync(root, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  rmSync(path.join(root, DATA_DIR), { recursive: true, force: true });
+  dropMounts(Modes.NOTES);
+  mkdirSync(path.dirname(path.join(root, USERS_FILE)), { recursive: true });
+  writeFileSync(
+    path.join(root, USERS_FILE),
+    JSON.stringify([{ username: "alice" }, { username: "bob" }]),
+  );
+  writeNote(
+    "alice",
+    "plan",
+    [`createdAt: "${BORN}"`, `uuid: ${NOTE}`, "title: Plan", "sharedWith: bob:rwd"],
+    "first",
+  );
+  writeNote("bob", "mine", [`uuid: ${BOB_OWN}`, "title: Mine"], "bob's own");
+});
+
+describe("Editing an uncategorised shared note", () => {
+  it("keeps the note in the owner's folder when a recipient saves it", async () => {
+    expect(await saveAs("alice", "alice edit")).toMatchObject({ success: true });
+    expect(await saveAs("bob", "bob edit")).toMatchObject({ success: true });
+
+    expect(existsSync(path.join(noteDir("alice"), "plan.md"))).toBe(true);
+    expect(existsSync(path.join(noteDir("bob"), "plan.md"))).toBe(false);
+    expect(readFileSync(path.join(noteDir("alice"), "plan.md"), "utf-8")).toContain("bob edit");
+  });
+
+  it("lets the owner keep saving after a recipient edit", async () => {
+    await saveAs("alice", "alice edit");
+    await saveAs("bob", "bob edit");
+
+    expect(await saveAs("alice", "alice again")).toMatchObject({ success: true });
+    expect(readFileSync(path.join(noteDir("alice"), "plan.md"), "utf-8")).toContain("alice again");
+  });
+
+  it("still lets a recipient save when the client sends an empty category", async () => {
+    expect(await saveAs("bob", "bob edit", "")).toMatchObject({ success: true });
+    expect(existsSync(path.join(noteDir("alice"), "plan.md"))).toBe(true);
+  });
+});
+
+describe("Editing an uncategorised shared checklist", () => {
+  it("keeps the list in the owner's folder when a recipient saves it", async () => {
+    writeFile(
+      listDir("alice"),
+      "groceries",
+      [`uuid: ${LIST}`, "title: Groceries", "checklistType: simple", "sharedWith: bob:rwd"],
+      "- [ ] milk",
+    );
+    writeFile(listDir("bob"), "mine", ["uuid: 99999999-9999-4999-8999-999999999999", "title: Mine"], "- [ ] tea");
+
+    actor.username = "bob";
+    const formData = new FormData();
+    formData.append("uuid", LIST);
+    formData.append("title", "Groceries");
+    formData.append("category", UNCATEGORIZED);
+
+    expect(await updateList(formData)).toMatchObject({ success: true });
+    expect(readdirSync(listDir("alice"))).toHaveLength(1);
+    expect(readdirSync(listDir("bob"))).toEqual(["mine.md"]);
+  });
+});
+
+describe("Renaming a note", () => {
+  it("keeps its creation date in the renamed file", async () => {
+    expect(await saveAs("alice", "renamed", UNCATEGORIZED, "Q3 plan")).toMatchObject({
+      success: true,
+    });
+
+    const [renamed] = readdirSync(noteDir("alice"));
+
+    expect(renamed).not.toBe("plan.md");
+    expect(createdAtIn(path.join(noteDir("alice"), renamed))).toBe(BORN);
+  });
+});

From 4e1055076d06912049917b37f0f0fe949cb39119 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 19:40:23 +0100
Subject: [PATCH 10/28] bugfixes spree, why not

---
 README.md                                     |   2 +-
 .../admin/checklist/[uuid]/page.tsx           |   2 +-
 .../admin/note/[uuid]/page.tsx                |   7 +-
 .../checklist/[uuid]/page.tsx                 |   2 +-
 app/(loggedInRoutes)/checklists/page.tsx      |   2 +-
 app/(loggedInRoutes)/kanban/page.tsx          |   2 +-
 app/(loggedInRoutes)/note/[uuid]/page.tsx     |   6 +-
 app/(loggedInRoutes)/notes/page.tsx           |   2 +-
 app/(loggedInRoutes)/page.tsx                 |   8 +-
 .../settings/admin/content/page.tsx           |   4 +-
 .../settings/admin/overview/page.tsx          |   4 +-
 .../settings/admin/users/page.tsx             |   4 +-
 app/(loggedInRoutes)/tasks/page.tsx           |   2 +-
 .../Admin/Parts/AppSettingsTab.tsx            |   7 +-
 .../Checklists/ChecklistsClient.tsx           |   2 +-
 .../Checklists/Parts/ChecklistClient.tsx      |   6 +-
 .../Checklists/Parts/Simple/ChecklistBody.tsx |   4 +-
 .../Parts/Simple/NestedChecklistItem.tsx      |  61 +--
 .../Checklists/TasksClient.tsx                |   2 +-
 .../FeatureComponents/Header/QuickNav.tsx     |  12 +-
 .../Home/Parts/ChecklistHome.tsx              |   2 +-
 .../Home/Parts/NotesHome.tsx                  |   4 +-
 .../FeatureComponents/Home/Parts/TagsHome.tsx |   4 +-
 .../FeatureComponents/Howto/HowtoClient.tsx   |   2 +-
 .../FeatureComponents/Kanban/Kanban.tsx       |   2 +-
 .../Navigation/Parts/NavigationHelpIcon.tsx   |  16 +-
 .../FeatureComponents/Notes/NoteClient.tsx    |   8 +-
 .../FeatureComponents/Notes/NotesClient.tsx   |   2 +-
 .../Parts/CodeBlock/CodeBlockNodeView.tsx     |   3 +-
 .../Notes/Parts/NoteEditor/NoteEditor.tsx     |  97 +++--
 .../Parts/NoteEditor/NoteEditorHeader.tsx     |  56 ++-
 .../Notes/Parts/NoteEditor/NoteQuickBar.tsx   |  89 ++++
 .../CustomExtensions/BoldItalicInput.ts       |  47 ++
 .../CustomExtensions/DrawioExtension.tsx      |   3 +-
 .../InternalLinkComponent.tsx                 |   8 +-
 .../Parts/TipTap/EditorUtils/editorConfig.ts  |   5 +
 .../Notes/Parts/TipTap/MinimalModeEditor.tsx  |  22 +-
 .../Parts/TipTap/SyntaxHighlightedEditor.tsx  |  47 +-
 .../Parts/TipTap/Toolbar/TipTapToolbar.tsx    |  25 +-
 .../Notes/Parts/UnifiedMarkdownRenderer.tsx   |  24 +-
 .../PublicView/Parts/PublicChecklistBody.tsx  |  33 +-
 .../PublicView/Parts/TaskStatusSection.tsx    |  24 +-
 .../PublicView/PublicChecklistView.tsx        |  11 +-
 .../PublicView/PublicNoteView.tsx             |   2 +-
 .../Settings/SettingsClient.tsx               |   2 +-
 .../GlobalComponents/Dropdowns/Dropdown.tsx   |  27 +-
 .../Dropdowns/DropdownMenu.tsx                |  45 +-
 .../GlobalComponents/Layout/Layout.tsx        |   5 +-
 .../GlobalComponents/Layout/MobileHeader.tsx  |   3 +-
 .../ChecklistModals/EditChecklistModal.tsx    |   7 +-
 .../Modals/NotesModal/CreateNoteModal.tsx     |  34 +-
 .../Modals/NotesModal/EditNoteModal.tsx       |   4 +-
 app/_consts/identity.ts                       |   2 +
 app/_hooks/kanban/useKanban.ts                |  12 +-
 app/_hooks/useBottomBarSpace.ts               |  50 +++
 app/_hooks/useChecklist.tsx                   |   7 +-
 app/_hooks/useMenuPlacement.ts                |  54 +++
 app/_hooks/useNoteEditor.tsx                  |   9 +-
 app/_hooks/useReturnPath.ts                   |  28 ++
 app/_hooks/useShortcuts.ts                    |  10 +
 app/_hooks/useShowEmojis.ts                   |   6 +-
 app/_providers/ShortcutsProvider.tsx          |  76 +++-
 app/_server/actions/archived/index.ts         |   4 +-
 app/_server/actions/category/crud.ts          |   7 +-
 app/_server/actions/checklist-item/archive.ts |  19 +-
 .../actions/checklist-item/bulk-operations.ts |  43 +-
 app/_server/actions/checklist-item/crud.ts    | 408 +++---------------
 app/_server/actions/checklist-item/drop.ts    |  10 +-
 app/_server/actions/checklist-item/editor.ts  | 387 +++++++++++++++++
 app/_server/actions/checklist-item/reorder.ts |  10 +-
 app/_server/actions/checklist-item/stamper.ts | 140 ++++++
 app/_server/actions/checklist-item/status.ts  | 136 +-----
 .../actions/checklist-item/sub-items.ts       |  10 +-
 app/_server/actions/checklist/converters.ts   |  14 +-
 app/_server/actions/checklist/creator.ts      |   3 +-
 app/_server/actions/checklist/crud.ts         | 322 ++------------
 app/_server/actions/checklist/editor.ts       | 296 +++++++++++++
 app/_server/actions/checklist/index.ts        |   7 +-
 app/_server/actions/checklist/queries.ts      |  14 -
 app/_server/actions/checklist/readers.ts      |   6 +-
 app/_server/actions/checklist/viewer.ts       |  40 ++
 app/_server/actions/comments/index.ts         |   2 +-
 app/_server/actions/config/helpers.ts         |   4 +-
 app/_server/actions/config/settings.ts        |  16 +-
 app/_server/actions/dashboard/index.ts        |   3 +-
 app/_server/actions/export/index.ts           |   4 +-
 app/_server/actions/file/index.ts             |   5 +
 app/_server/actions/history/index.ts          |   4 +-
 app/_server/actions/kanban/calendar.ts        |   2 +-
 app/_server/actions/kanban/items.ts           |  30 +-
 app/_server/actions/kanban/search.ts          |   2 +-
 app/_server/actions/kanban/tempo.ts           |   2 +-
 app/_server/actions/kanban/time-entries.ts    |  17 +-
 app/_server/actions/lib/actor.ts              |  23 +
 app/_server/actions/lib/concurrency.ts        |   3 +
 app/_server/actions/lib/migration-check.ts    |   6 +-
 app/_server/actions/lib/read-only-message.ts  |  12 +
 app/_server/actions/lib/read-only.ts          |  50 +++
 app/_server/actions/lib/stamp-uuid.ts         |  15 +
 .../actions/migration/share-migration.ts      |  54 ++-
 app/_server/actions/note/creator.ts           |  11 +-
 app/_server/actions/note/crud.ts              | 405 ++---------------
 app/_server/actions/note/editor.ts            | 382 ++++++++++++++++
 app/_server/actions/note/index.ts             |   7 +-
 app/_server/actions/note/queries.ts           |  14 -
 app/_server/actions/note/readers.ts           |   6 +-
 app/_server/actions/note/viewer.ts            |  38 ++
 app/_server/actions/notifications/index.ts    |   4 +-
 app/_server/actions/relations/index.ts        |   3 +-
 app/_server/actions/relations/indexer.ts      |   4 +-
 app/_server/actions/relations/queries.ts      |   4 +-
 app/_server/actions/reminders/scanner.ts      | 175 ++++----
 app/_server/actions/share/category-info.ts    |  21 +-
 app/_server/actions/stats/index.ts            |   4 +-
 app/_styles/globals.css                       |  13 +
 app/_translations/en.json                     |  11 +-
 app/_types/enums.ts                           |   5 +
 app/_utils/base64-utils.ts                    |  42 ++
 app/_utils/checklist-utils.ts                 |   7 +-
 app/_utils/grep-utils.ts                      |  38 +-
 app/_utils/kanban/board-utils.ts              |  15 +
 app/_utils/markdown-editor-utils.ts           | 104 +++--
 app/_utils/markdown-utils.tsx                 |  79 ++--
 app/_utils/menu-placement-utils.ts            | 139 ++++++
 app/_utils/return-path-store.ts               |  20 +
 app/_utils/url-transform-utils.ts             |   6 +
 .../[listId]/items/[itemIndex]/check/route.ts |   6 +-
 .../[listId]/items/[itemIndex]/route.ts       |   6 +-
 .../items/[itemIndex]/uncheck/route.ts        |   6 +-
 .../[listId]/items/reorder/route.ts           |   2 +-
 app/api/checklists/[listId]/items/route.ts    |   6 +-
 app/api/checklists/[listId]/route.ts          |  11 +-
 app/api/checklists/route.ts                   |   2 +-
 app/api/kanban/[boardId]/calendar/route.ts    |   2 +-
 .../[boardId]/items/[itemId]/assign/route.ts  |   2 +-
 .../items/[itemId]/reminder/route.ts          |   2 +-
 .../kanban/[boardId]/items/[itemId]/route.ts  |   7 +-
 .../[boardId]/items/[itemId]/status/route.ts  |   7 +-
 app/api/kanban/[boardId]/items/route.ts       |   6 +-
 app/api/kanban/[boardId]/route.ts             |  15 +-
 app/api/kanban/[boardId]/statuses/route.ts    |   7 +-
 app/api/kanban/route.ts                       |   2 +-
 app/api/notes/[noteId]/route.ts               |  14 +-
 app/api/notes/route.ts                        |   2 +-
 app/api/summary/route.ts                      |   4 +-
 .../tasks/[taskId]/items/[itemIndex]/route.ts |   2 +-
 .../items/[itemIndex]/status/route.ts         |   7 +-
 app/api/tasks/[taskId]/items/route.ts         |   6 +-
 app/api/tasks/[taskId]/route.ts               |  15 +-
 .../[taskId]/statuses/[statusId]/route.ts     |   2 +-
 app/api/tasks/[taskId]/statuses/route.ts      |   2 +-
 app/api/tasks/route.ts                        |   2 +-
 app/layout.tsx                                |   4 +-
 app/public/checklist/[uuid]/page.tsx          |   9 +-
 app/public/note/[uuid]/page.tsx               |   2 +-
 howto/SHORTCUTS.md                            |   3 +-
 howto/SSO.md                                  |   6 +-
 tests/api/checklists.test.ts                  |   8 +-
 tests/api/items.test.ts                       |  26 +-
 tests/api/notes.test.ts                       |  10 +-
 tests/api/setup.ts                            |  45 +-
 tests/api/tasks.test.ts                       |  18 +-
 tests/mock-data/brain-seed.ts                 |   8 +-
 tests/security/actor-spoofing.test.ts         | 293 +++++++++++++
 tests/security/auth-required.test.ts          |   4 +-
 tests/security/read-by-uuid.test.ts           | 200 +++++++++
 tests/server-actions/archived.test.ts         |   4 +-
 tests/server-actions/checklist-item.test.ts   |  82 +++-
 tests/server-actions/comments.test.ts         |   2 +-
 tests/server-actions/config.test.ts           |  32 +-
 tests/server-actions/drop-item.test.ts        |   2 +-
 tests/server-actions/history.test.ts          |   2 +-
 tests/server-actions/note.test.ts             |  22 +
 tests/server-actions/read-only-mount.test.ts  | 197 +++++++++
 tests/server-actions/relations.test.ts        |   4 +-
 tests/server-actions/share-migration.test.ts  |  50 +++
 tests/utils/base64-utils.test.ts              |  76 ++++
 tests/utils/board-utils.test.ts               |  40 ++
 tests/utils/bold-italic-input.test.ts         |  50 +++
 tests/utils/checklist-frontmatter.test.ts     |  14 +
 tests/utils/markdown-list-editing.test.ts     |  97 +++++
 tests/utils/markdown-roundtrip.test.ts        | 105 +++++
 tests/utils/menu-placement-utils.test.ts      |  70 +++
 tests/utils/url-transform.test.ts             |  88 ++++
 184 files changed, 4518 insertions(+), 1945 deletions(-)
 create mode 100644 app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteQuickBar.tsx
 create mode 100644 app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/BoldItalicInput.ts
 create mode 100644 app/_hooks/useBottomBarSpace.ts
 create mode 100644 app/_hooks/useMenuPlacement.ts
 create mode 100644 app/_hooks/useReturnPath.ts
 create mode 100644 app/_server/actions/checklist-item/editor.ts
 create mode 100644 app/_server/actions/checklist-item/stamper.ts
 create mode 100644 app/_server/actions/checklist/editor.ts
 create mode 100644 app/_server/actions/checklist/viewer.ts
 create mode 100644 app/_server/actions/lib/read-only-message.ts
 create mode 100644 app/_server/actions/lib/read-only.ts
 create mode 100644 app/_server/actions/note/editor.ts
 create mode 100644 app/_server/actions/note/viewer.ts
 create mode 100644 app/_utils/base64-utils.ts
 create mode 100644 app/_utils/menu-placement-utils.ts
 create mode 100644 app/_utils/return-path-store.ts
 create mode 100644 app/_utils/url-transform-utils.ts
 create mode 100644 tests/security/actor-spoofing.test.ts
 create mode 100644 tests/security/read-by-uuid.test.ts
 create mode 100644 tests/server-actions/read-only-mount.test.ts
 create mode 100644 tests/utils/base64-utils.test.ts
 create mode 100644 tests/utils/bold-italic-input.test.ts
 create mode 100644 tests/utils/markdown-list-editing.test.ts
 create mode 100644 tests/utils/markdown-roundtrip.test.ts
 create mode 100644 tests/utils/menu-placement-utils.test.ts
 create mode 100644 tests/utils/url-transform.test.ts

diff --git a/README.md b/README.md
index 5c062e6d8..c3dae4cfe 100644
--- a/README.md
+++ b/README.md
@@ -90,7 +90,7 @@ My recommended way to run `jotty·page` is with Docker. You can also use:
 - The [Proxmox community script](https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/jotty.sh) for Proxmox VE
 - The [Unraid template](howto/UNRAID.md) for Unraid Community Applications
 
-Running it without Docker, from source or from the prebuilt tarball, needs Node.js 22.15 or later.
+Running it without Docker, from source or from the prebuilt tarball, needs Node.js 22.15 or later in the 22.x series, or Node.js 23.11 or later.
 
 <a id="docker-compose"></a>
 
diff --git a/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx b/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx
index 8156eb41e..c86700aa7 100644
--- a/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx
@@ -2,7 +2,7 @@ import { redirect } from "next/navigation";
 import {
   getListById,
   getUserChecklists,
-} from "@/app/_server/actions/checklist";
+} from "@/app/_server/actions/checklist/queries";
 import { getCategories } from "@/app/_server/actions/category";
 import { getCurrentUser, canAccessAllContent } from "@/app/_server/actions/users";
 import { ChecklistClient } from "@/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient";
diff --git a/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx b/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx
index b6e96f13e..ce3ae4220 100644
--- a/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx
@@ -1,9 +1,6 @@
 import { redirect } from "next/navigation";
-import {
-  CheckForNeedsMigration,
-  getNoteById,
-  getUserNotes,
-} from "@/app/_server/actions/note";
+import { CheckForNeedsMigration } from "@/app/_server/actions/note";
+import { getNoteById, getUserNotes } from "@/app/_server/actions/note/queries";
 import { getCurrentUser, canAccessAllContent } from "@/app/_server/actions/users";
 import { NoteClient } from "@/app/_components/FeatureComponents/Notes/NoteClient";
 import { Modes } from "@/app/_types/enums";
diff --git a/app/(loggedInRoutes)/checklist/[uuid]/page.tsx b/app/(loggedInRoutes)/checklist/[uuid]/page.tsx
index 0d111b7bd..d9ae15f7d 100644
--- a/app/(loggedInRoutes)/checklist/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/checklist/[uuid]/page.tsx
@@ -1,5 +1,5 @@
 import { redirect, permanentRedirect } from "next/navigation";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { getCategories } from "@/app/_server/actions/category";
 import { getCurrentUser, canAccessAllContent } from "@/app/_server/actions/users";
 import { ChecklistClient } from "@/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient";
diff --git a/app/(loggedInRoutes)/checklists/page.tsx b/app/(loggedInRoutes)/checklists/page.tsx
index 5cb3c8cc0..e122f9c19 100644
--- a/app/(loggedInRoutes)/checklists/page.tsx
+++ b/app/(loggedInRoutes)/checklists/page.tsx
@@ -1,4 +1,4 @@
-import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { ChecklistsPageClient } from "@/app/_components/FeatureComponents/Checklists/ChecklistsPageClient";
 import { Checklist } from "@/app/_types";
diff --git a/app/(loggedInRoutes)/kanban/page.tsx b/app/(loggedInRoutes)/kanban/page.tsx
index f32b1eba4..5da6b164c 100644
--- a/app/(loggedInRoutes)/kanban/page.tsx
+++ b/app/(loggedInRoutes)/kanban/page.tsx
@@ -1,4 +1,4 @@
-import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { KanbanPageClient } from "@/app/_components/FeatureComponents/Kanban/KanbanPageClient";
 import { Checklist } from "@/app/_types";
diff --git a/app/(loggedInRoutes)/note/[uuid]/page.tsx b/app/(loggedInRoutes)/note/[uuid]/page.tsx
index 84f96082e..414cd50a1 100644
--- a/app/(loggedInRoutes)/note/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/note/[uuid]/page.tsx
@@ -1,8 +1,6 @@
 import { redirect, permanentRedirect } from "next/navigation";
-import {
-  CheckForNeedsMigration,
-  getNoteById,
-} from "@/app/_server/actions/note";
+import { CheckForNeedsMigration } from "@/app/_server/actions/note";
+import { getNoteById } from "@/app/_server/actions/note/queries";
 import {
   getCurrentUser,
   canAccessAllContent,
diff --git a/app/(loggedInRoutes)/notes/page.tsx b/app/(loggedInRoutes)/notes/page.tsx
index e1b5745ee..918f3493b 100644
--- a/app/(loggedInRoutes)/notes/page.tsx
+++ b/app/(loggedInRoutes)/notes/page.tsx
@@ -1,4 +1,4 @@
-import { getUserNotes } from "@/app/_server/actions/note";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { NotesPageClient } from "@/app/_components/FeatureComponents/Notes/NotesPageClient";
 import { Note } from "@/app/_types";
diff --git a/app/(loggedInRoutes)/page.tsx b/app/(loggedInRoutes)/page.tsx
index 4960a52be..625a6eb9a 100644
--- a/app/(loggedInRoutes)/page.tsx
+++ b/app/(loggedInRoutes)/page.tsx
@@ -1,9 +1,7 @@
 import { getCategories } from "@/app/_server/actions/category";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
-import {
-  getUserNotes,
-  CheckForNeedsMigration,
-} from "@/app/_server/actions/note";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
+import { CheckForNeedsMigration } from "@/app/_server/actions/note";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
 import { HomeClient } from "@/app/_components/FeatureComponents/Home/HomeClient";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { Modes } from "@/app/_types/enums";
diff --git a/app/(loggedInRoutes)/settings/admin/content/page.tsx b/app/(loggedInRoutes)/settings/admin/content/page.tsx
index 9455256ee..e92cd54e2 100644
--- a/app/(loggedInRoutes)/settings/admin/content/page.tsx
+++ b/app/(loggedInRoutes)/settings/admin/content/page.tsx
@@ -1,6 +1,6 @@
 import { AdminContent } from "@/app/_components/FeatureComponents/Admin/Parts/AdminContent";
-import { getAllLists } from "@/app/_server/actions/checklist";
-import { getAllNotes } from "@/app/_server/actions/note";
+import { getAllLists } from "@/app/_server/actions/checklist/queries";
+import { getAllNotes } from "@/app/_server/actions/note/queries";
 import { canAccessAllContent, getUsersForAdmin } from "@/app/_server/actions/users";
 import { notFound } from "next/navigation";
 
diff --git a/app/(loggedInRoutes)/settings/admin/overview/page.tsx b/app/(loggedInRoutes)/settings/admin/overview/page.tsx
index d37149d70..23ec19659 100644
--- a/app/(loggedInRoutes)/settings/admin/overview/page.tsx
+++ b/app/(loggedInRoutes)/settings/admin/overview/page.tsx
@@ -1,8 +1,8 @@
 import { notFound } from "next/navigation";
 import { AdminOverview } from "@/app/_components/FeatureComponents/Admin/Parts/AdminOverview";
 import { isAdmin, getUsersForAdmin } from "@/app/_server/actions/users";
-import { getAllLists } from "@/app/_server/actions/checklist";
-import { getAllNotes } from "@/app/_server/actions/note";
+import { getAllLists } from "@/app/_server/actions/checklist/queries";
+import { getAllNotes } from "@/app/_server/actions/note/queries";
 
 export default async function AdminOverviewPage() {
     const admin = await isAdmin();
diff --git a/app/(loggedInRoutes)/settings/admin/users/page.tsx b/app/(loggedInRoutes)/settings/admin/users/page.tsx
index 4f304f699..84980a11e 100644
--- a/app/(loggedInRoutes)/settings/admin/users/page.tsx
+++ b/app/(loggedInRoutes)/settings/admin/users/page.tsx
@@ -1,6 +1,6 @@
 import { AdminUsersClient } from "@/app/_components/FeatureComponents/Admin/Parts/AdminUsersClient";
-import { getAllLists } from "@/app/_server/actions/checklist";
-import { getAllNotes } from "@/app/_server/actions/note";
+import { getAllLists } from "@/app/_server/actions/checklist/queries";
+import { getAllNotes } from "@/app/_server/actions/note/queries";
 import { isAdmin, getUsername, getUsersForAdmin } from "@/app/_server/actions/users";
 import { notFound } from "next/navigation";
 
diff --git a/app/(loggedInRoutes)/tasks/page.tsx b/app/(loggedInRoutes)/tasks/page.tsx
index 48b6c6402..e328ba898 100644
--- a/app/(loggedInRoutes)/tasks/page.tsx
+++ b/app/(loggedInRoutes)/tasks/page.tsx
@@ -1,4 +1,4 @@
-import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { TasksPageClient } from "@/app/_components/FeatureComponents/Checklists/TasksPageClient";
 import { Checklist } from "@/app/_types";
diff --git a/app/_components/FeatureComponents/Admin/Parts/AppSettingsTab.tsx b/app/_components/FeatureComponents/Admin/Parts/AppSettingsTab.tsx
index 56cc2c207..84cee2ce6 100644
--- a/app/_components/FeatureComponents/Admin/Parts/AppSettingsTab.tsx
+++ b/app/_components/FeatureComponents/Admin/Parts/AppSettingsTab.tsx
@@ -63,7 +63,12 @@ export const AppSettingsTab = () => {
     try {
       const formData = new FormData();
       Object.entries(settings).forEach(([key, value]) =>
-        formData.append(key, value)
+        formData.append(
+          key,
+          typeof value === "object" && value !== null
+            ? JSON.stringify(value)
+            : String(value)
+        )
       );
 
       const result = await updateAppSettings(formData);
diff --git a/app/_components/FeatureComponents/Checklists/ChecklistsClient.tsx b/app/_components/FeatureComponents/Checklists/ChecklistsClient.tsx
index a11c13937..73a1ddd09 100644
--- a/app/_components/FeatureComponents/Checklists/ChecklistsClient.tsx
+++ b/app/_components/FeatureComponents/Checklists/ChecklistsClient.tsx
@@ -142,7 +142,7 @@ export const ChecklistsClient = ({
           currentLocale={user?.preferredLocale || "en"}
         />
 
-        <div className="w-full px-4 py-6 h-full overflow-y-auto jotty-scrollable-content">
+        <div className="w-full px-4 py-6 h-full overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter">
           {children}
         </div>
       </Layout>
diff --git a/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient.tsx b/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient.tsx
index edb8a04fc..45bc00d7f 100644
--- a/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient.tsx
+++ b/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient.tsx
@@ -21,6 +21,7 @@ import { toggleArchive } from "@/app/_server/actions/dashboard";
 import { itemHref } from "@/app/_utils/global-utils";
 import { ItemTypes } from "@/app/_types/enums";
 import { useTranslations } from "next-intl";
+import { useReturnPath } from "@/app/_hooks/useReturnPath";
 
 interface ChecklistClientProps {
   checklist: Checklist;
@@ -48,6 +49,7 @@ export const ChecklistClient = ({
     useState<string>("");
   const { openCreateChecklistModal, openCreateCategoryModal, openSettings } =
     useShortcut();
+  const returnPath = useReturnPath(`/?mode=${Modes.CHECKLISTS}`);
   const prevChecklistId = useRef(checklist.id);
   const prevUpdatedAt = useRef(checklist.updatedAt);
 
@@ -68,7 +70,7 @@ export const ChecklistClient = ({
 
   const handleBack = () => {
     checkNavigation(() => {
-      router.push("/?mode=checklists");
+      router.push(returnPath);
     });
   };
 
@@ -106,7 +108,7 @@ export const ChecklistClient = ({
 
   const handleDelete = (deletedId: string) => {
     checkNavigation(() => {
-      router.push("/?mode=checklists");
+      router.push(returnPath);
     });
   };
 
diff --git a/app/_components/FeatureComponents/Checklists/Parts/Simple/ChecklistBody.tsx b/app/_components/FeatureComponents/Checklists/Parts/Simple/ChecklistBody.tsx
index 242605621..025428161 100644
--- a/app/_components/FeatureComponents/Checklists/Parts/Simple/ChecklistBody.tsx
+++ b/app/_components/FeatureComponents/Checklists/Parts/Simple/ChecklistBody.tsx
@@ -125,7 +125,7 @@ export const ChecklistBody = ({
       {localList.items.length > 0 && (
         <ChecklistProgress checklist={localList} />
       )}
-      <div className="flex-1 overflow-y-auto jotty-scrollable-content p-4">
+      <div className="flex-1 overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter p-4">
         <DndContext
           sensors={sensors}
           collisionDetection={closestCenter}
@@ -134,7 +134,7 @@ export const ChecklistBody = ({
           onDragCancel={onDragCancel}
           onDragOver={onDragOver}
         >
-          <div className="w-full min-h-[200px] space-y-4 overflow-hidden checklist-todo-container">
+          <div className="w-full min-h-[200px] space-y-4 overflow-x-clip checklist-todo-container">
             {incompleteItems.length > 0 && (
               <ChecklistItemsWrapper
                 title={TaskStatusLabels.TODO}
diff --git a/app/_components/FeatureComponents/Checklists/Parts/Simple/NestedChecklistItem.tsx b/app/_components/FeatureComponents/Checklists/Parts/Simple/NestedChecklistItem.tsx
index a66fb1684..8a2119482 100644
--- a/app/_components/FeatureComponents/Checklists/Parts/Simple/NestedChecklistItem.tsx
+++ b/app/_components/FeatureComponents/Checklists/Parts/Simple/NestedChecklistItem.tsx
@@ -35,6 +35,12 @@ import { useTranslations } from "next-intl";
 import { Droppable } from "./Droppable";
 import { DropIndicator } from "./DropIndicator";
 import { useEditorActivityStore } from "@/app/_utils/editor-activity-store";
+import { useMenuPlacement } from "@/app/_hooks/useMenuPlacement";
+import {
+  MenuAlign,
+  MenuSide,
+  menuPlacementClasses,
+} from "@/app/_utils/menu-placement-utils";
 
 interface NestedChecklistItemProps {
   item: Item;
@@ -46,6 +52,7 @@ interface NestedChecklistItemProps {
   onAddSubItem?: (parentId: string, text: string) => void;
   completed?: boolean;
   isPublicView?: boolean;
+  ownerShowsEmojis?: boolean;
   isDeletingItem: boolean;
   isDragDisabled?: boolean;
   isSubtask?: boolean;
@@ -67,6 +74,7 @@ const NestedChecklistItemComponent = ({
   onAddSubItem,
   completed = false,
   isPublicView = false,
+  ownerShowsEmojis,
   isDeletingItem,
   isDragDisabled = false,
   isSubtask = false,
@@ -99,7 +107,7 @@ const NestedChecklistItemComponent = ({
       },
     });
 
-  const showEmojis = useShowEmojis();
+  const showEmojis = useShowEmojis(ownerShowsEmojis);
   const emoji = useEmojiCache(item.text, showEmojis);
   const [isEditing, setIsEditing] = useState(false);
   const [editText, setEditText] = useState(item.text);
@@ -107,12 +115,18 @@ const NestedChecklistItemComponent = ({
   const [showAddSubItem, setShowAddSubItem] = useState(false);
   const [newSubItemText, setNewSubItemText] = useState("");
   const [isDropdownOpen, setIsDropdownOpen] = useState(false);
-  const [dropdownOpenUpward, setDropdownOpenUpward] = useState(false);
   const [isActive, setIsActive] = useState(false);
   const inputRef = useRef<HTMLInputElement>(null);
   const addSubItemInputRef = useRef<HTMLInputElement>(null);
   const dropdownRef = useRef<HTMLDivElement>(null);
-  const dropdownButtonRef = useRef<HTMLButtonElement>(null);
+  const dropdownMenuRef = useRef<HTMLDivElement>(null);
+  const dropdownPlacement = useMenuPlacement(
+    isDropdownOpen,
+    dropdownRef,
+    dropdownMenuRef,
+    MenuSide.Down,
+    MenuAlign.End,
+  );
 
   const editorActivity = useEditorActivityStore();
 
@@ -217,37 +231,7 @@ const NestedChecklistItemComponent = ({
     }
   };
 
-  const handleDropdownToggle = () => {
-    if (!isDropdownOpen && dropdownButtonRef.current) {
-      const rect = dropdownButtonRef.current.getBoundingClientRect();
-
-      let scrollParent: HTMLElement | null =
-        dropdownButtonRef.current.parentElement;
-      while (scrollParent) {
-        if (scrollParent.classList.contains("checklist-todo-container")) {
-          break;
-        }
-        scrollParent = scrollParent.parentElement;
-      }
-
-      let shouldOpenUpward = false;
-
-      if (scrollParent) {
-        const containerRect = scrollParent.getBoundingClientRect();
-        const containerStyle = window.getComputedStyle(scrollParent);
-        const paddingBottom = parseInt(containerStyle.paddingBottom) || 0;
-
-        const actualSpaceBelow =
-          containerRect.bottom - rect.bottom - paddingBottom;
-        const threshold = 200;
-
-        shouldOpenUpward = actualSpaceBelow < threshold;
-      }
-
-      setDropdownOpenUpward(shouldOpenUpward);
-    }
-    setIsDropdownOpen(!isDropdownOpen);
-  };
+  const handleDropdownToggle = () => setIsDropdownOpen(!isDropdownOpen);
 
   const handleDropdownAction = (actionId: string) => {
     setIsDropdownOpen(false);
@@ -546,7 +530,6 @@ const NestedChecklistItemComponent = ({
                 {!isPublicView && (
                   <div className="lg:hidden relative" ref={dropdownRef}>
                     <Button
-                      ref={dropdownButtonRef}
                       variant="ghost"
                       size="sm"
                       onClick={handleDropdownToggle}
@@ -558,11 +541,10 @@ const NestedChecklistItemComponent = ({
 
                     {isDropdownOpen && (
                       <div
+                        ref={dropdownMenuRef}
                         className={cn(
-                          "absolute right-0 z-50 w-48 bg-card border border-border rounded-jotty shadow-lg",
-                          dropdownOpenUpward
-                            ? "bottom-full mb-1 top-auto"
-                            : "top-full mt-1",
+                          "absolute z-50 w-48 bg-card border border-border rounded-jotty shadow-lg",
+                          menuPlacementClasses(dropdownPlacement),
                         )}
                       >
                         <div className="py-1">
@@ -704,6 +686,7 @@ const NestedChecklistItemComponent = ({
                     isDeletingItem={isDeletingItem}
                     isDragDisabled={isDragDisabled || draggedItemId === item.id}
                     isPublicView={isPublicView}
+                    ownerShowsEmojis={ownerShowsEmojis}
                     checklist={checklist}
                     isOver={overItem?.id === child.id}
                     overPosition={
diff --git a/app/_components/FeatureComponents/Checklists/TasksClient.tsx b/app/_components/FeatureComponents/Checklists/TasksClient.tsx
index cdf9c7b5d..fd5f4cf8a 100644
--- a/app/_components/FeatureComponents/Checklists/TasksClient.tsx
+++ b/app/_components/FeatureComponents/Checklists/TasksClient.tsx
@@ -120,7 +120,7 @@ export const TasksClient = ({
             >
                 <MobileHeader user={user} onOpenSettings={openSettings} currentLocale={user?.preferredLocale || "en"} />
                 
-                <div className="w-full min-w-0 px-4 py-6 h-full overflow-y-auto jotty-scrollable-content">
+                <div className="w-full min-w-0 px-4 py-6 h-full overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter">
                     {children}
                 </div>
             </Layout>
diff --git a/app/_components/FeatureComponents/Header/QuickNav.tsx b/app/_components/FeatureComponents/Header/QuickNav.tsx
index 6950979e2..2d04760ae 100644
--- a/app/_components/FeatureComponents/Header/QuickNav.tsx
+++ b/app/_components/FeatureComponents/Header/QuickNav.tsx
@@ -12,7 +12,7 @@ import { useRouter } from "next/navigation";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { useNavigationGuard } from "@/app/_providers/NavigationGuardProvider";
 import { AppMode, User, SanitisedUser } from "@/app/_types";
-import { Modes } from "@/app/_types/enums";
+import { BottomBarSpaces, Modes } from "@/app/_types/enums";
 import { cn, handleScroll } from "@/app/_utils/global-utils";
 import { NavigationGlobalIcon } from "../Navigation/Parts/NavigationGlobalIcon";
 import { NavigationSearchIcon } from "../Navigation/Parts/NavigationSearchIcon";
@@ -21,6 +21,7 @@ import { NotificationBell } from "../Notifications/NotificationBell";
 import { logout } from "@/app/_server/actions/auth";
 import { useState, useEffect, useRef } from "react";
 import { useTranslations } from "next-intl";
+import { useBottomBarSpace } from "@/app/_hooks/useBottomBarSpace";
 
 interface QuickNavProps {
   showSidebarToggle?: boolean;
@@ -49,6 +50,12 @@ export const QuickNav = ({
   const t = useTranslations();
   const [isScrolled, setIsScrolled] = useState(true);
   const lastScrollY = useRef(0);
+  const navRef = useRef<HTMLElement>(null);
+
+  useBottomBarSpace(navRef, BottomBarSpaces.QUICK_NAV, {
+    enabled: !isEditorInEditMode,
+    frozen: !isScrolled,
+  });
 
   const handleLogout = async () => {
     await logout();
@@ -75,6 +82,7 @@ export const QuickNav = ({
   return (
     <header className="lg:border-b lg:border-border no-print">
       <nav
+        ref={navRef}
         className={cn(
           "jotty-quick-nav fixed z-30 flex items-center justify-between p-2 lg:justify-around transition-[bottom] duration-300 ease-in-out",
           "lg:relative lg:bottom-auto lg:h-auto lg:justify-end lg:px-6 lg:py-5",
@@ -151,7 +159,7 @@ export const QuickNav = ({
               onClick={() =>
                 checkNavigation(() => {
                   onModeChange?.(modeOption);
-                  router.push("/");
+                  router.push(`/?mode=${modeOption}`);
                 })
               }
             />
diff --git a/app/_components/FeatureComponents/Home/Parts/ChecklistHome.tsx b/app/_components/FeatureComponents/Home/Parts/ChecklistHome.tsx
index ebef1c597..3ffe51afb 100644
--- a/app/_components/FeatureComponents/Home/Parts/ChecklistHome.tsx
+++ b/app/_components/FeatureComponents/Home/Parts/ChecklistHome.tsx
@@ -160,7 +160,7 @@ export const ChecklistHome = ({
   }
 
   return (
-    <div className="h-full overflow-y-auto bg-background pb-16 lg:pb-0 jotty-scrollable-content">
+    <div className="h-full overflow-y-auto bg-background jotty-scrollable-content jotty-quick-nav-gutter">
       <div className="max-w-full pt-6 pb-4 px-4 lg:pt-8 lg:pb-8 lg:px-8">
         <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-4 mb-6 lg:mb-8">
           <div className="flex items-center gap-3">
diff --git a/app/_components/FeatureComponents/Home/Parts/NotesHome.tsx b/app/_components/FeatureComponents/Home/Parts/NotesHome.tsx
index d9b29a397..593cfc140 100644
--- a/app/_components/FeatureComponents/Home/Parts/NotesHome.tsx
+++ b/app/_components/FeatureComponents/Home/Parts/NotesHome.tsx
@@ -144,7 +144,7 @@ export const NotesHome = ({
 
   if (!hasAnyNotes) {
     return (
-      <div className="flex-1 overflow-y-auto jotty-scrollable-content bg-background h-full">
+      <div className="flex-1 overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter bg-background h-full">
         <EmptyState
           icon={<File02Icon className="h-10 w-10 text-muted-foreground" />}
           title={t("notes.noNotesYet")}
@@ -157,7 +157,7 @@ export const NotesHome = ({
   }
 
   return (
-    <div className="flex-1 overflow-y-auto jotty-scrollable-content bg-background h-full">
+    <div className="flex-1 overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter bg-background h-full">
       <div className="max-w-full pt-6 pb-4 px-4 lg:pt-8 lg:pb-8 lg:px-8">
         <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-4 mb-6 lg:mb-8">
           <div className="flex items-center gap-3">
diff --git a/app/_components/FeatureComponents/Home/Parts/TagsHome.tsx b/app/_components/FeatureComponents/Home/Parts/TagsHome.tsx
index d244353d9..b5d5562e6 100644
--- a/app/_components/FeatureComponents/Home/Parts/TagsHome.tsx
+++ b/app/_components/FeatureComponents/Home/Parts/TagsHome.tsx
@@ -146,7 +146,7 @@ export const TagsHome = ({
 
   if (combinedItems.length === 0 && !selectedFilter) {
     return (
-      <div className="flex-1 overflow-y-auto jotty-scrollable-content bg-background h-full">
+      <div className="flex-1 overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter bg-background h-full">
         <EmptyState
           icon={<GridIcon className="h-10 w-10 text-muted-foreground" />}
           title={t("notes.tags")}
@@ -237,7 +237,7 @@ export const TagsHome = ({
   };
 
   return (
-    <div className="flex-1 overflow-y-auto jotty-scrollable-content bg-background h-full hide-scrollbar">
+    <div className="flex-1 overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter bg-background h-full hide-scrollbar">
       <div className="max-w-full pt-6 pb-4 px-4 lg:pt-8 lg:pb-8 lg:px-8">
         <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-4 mb-6 lg:mb-8">
           <div className="flex items-center gap-3">
diff --git a/app/_components/FeatureComponents/Howto/HowtoClient.tsx b/app/_components/FeatureComponents/Howto/HowtoClient.tsx
index 003bdbdd8..ce7e87281 100644
--- a/app/_components/FeatureComponents/Howto/HowtoClient.tsx
+++ b/app/_components/FeatureComponents/Howto/HowtoClient.tsx
@@ -30,7 +30,7 @@ export const HowtoClient = ({
         >
             <MobileHeader user={user} onOpenSettings={openSettings} currentLocale={user?.preferredLocale || "en"} />
             
-            <div className="w-full px-4 py-6 h-full overflow-y-auto jotty-scrollable-content">
+            <div className="w-full px-4 py-6 h-full overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter">
                 {children}
             </div>
         </Layout>
diff --git a/app/_components/FeatureComponents/Kanban/Kanban.tsx b/app/_components/FeatureComponents/Kanban/Kanban.tsx
index d80692ba6..72f4d8a90 100644
--- a/app/_components/FeatureComponents/Kanban/Kanban.tsx
+++ b/app/_components/FeatureComponents/Kanban/Kanban.tsx
@@ -327,7 +327,7 @@ export const Kanban = ({ checklist, onUpdate }: KanbanBoardProps) => {
   );
 
   return (
-    <div className="h-full flex flex-col bg-background overflow-y-auto overflow-x-hidden min-w-0 max-w-full jotty-scrollable-content">
+    <div className="h-full flex flex-col bg-background overflow-y-auto overflow-x-hidden min-w-0 max-w-full jotty-scrollable-content jotty-quick-nav-gutter">
       {permissions?.canEdit && (
         <ChecklistHeading
           key={focusKey}
diff --git a/app/_components/FeatureComponents/Navigation/Parts/NavigationHelpIcon.tsx b/app/_components/FeatureComponents/Navigation/Parts/NavigationHelpIcon.tsx
index af6b84783..3cd57c571 100644
--- a/app/_components/FeatureComponents/Navigation/Parts/NavigationHelpIcon.tsx
+++ b/app/_components/FeatureComponents/Navigation/Parts/NavigationHelpIcon.tsx
@@ -4,27 +4,31 @@ import { HelpCircleIcon } from "hugeicons-react";
 import { NavigationGlobalIcon } from "./NavigationGlobalIcon";
 import { useShortcuts } from "@/app/_hooks/useShortcuts";
 import { useRouter } from "next/navigation";
+import { useNavigationGuard } from "@/app/_providers/NavigationGuardProvider";
+
+const HOWTO_SHORTCUTS_PATH = "/howto/shortcuts";
 
 export const NavigationHelpIcon = () => {
   const router = useRouter();
+  const { checkNavigation } = useNavigationGuard();
+
+  const openHowto = () =>
+    checkNavigation(() => router.push(HOWTO_SHORTCUTS_PATH));
 
   useShortcuts([
     {
       code: "KeyH",
       modKey: true,
       shiftKey: true,
-      handler: () => router.push("/howto/shortcuts"),
+      skipInEditable: true,
+      handler: openHowto,
     },
   ]);
 
-  const handleHelpClick = () => {
-    router.push("/howto/shortcuts");
-  };
-
   return (
     <NavigationGlobalIcon
       icon={<HelpCircleIcon className="h-5 w-5" />}
-      onClick={handleHelpClick}
+      onClick={openHowto}
     />
   );
 };
diff --git a/app/_components/FeatureComponents/Notes/NoteClient.tsx b/app/_components/FeatureComponents/Notes/NoteClient.tsx
index 4fc2b195e..7b6669885 100644
--- a/app/_components/FeatureComponents/Notes/NoteClient.tsx
+++ b/app/_components/FeatureComponents/Notes/NoteClient.tsx
@@ -11,7 +11,8 @@ import { useShortcuts } from "@/app/_hooks/useShortcuts";
 import { useNoteEditor } from "@/app/_hooks/useNoteEditor";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { itemHref } from "@/app/_utils/global-utils";
-import { ItemTypes } from "@/app/_types/enums";
+import { ItemTypes, Modes } from "@/app/_types/enums";
+import { useReturnPath } from "@/app/_hooks/useReturnPath";
 import { CloneCategoryModal } from "@/app/_components/GlobalComponents/Modals/ConfirmationModals/CloneCategoryModal";
 import { SwipeNavigationWrapper } from "@/app/_components/FeatureComponents/Notes/Parts/SwipeNavigationWrapper";
 
@@ -28,6 +29,7 @@ export const NoteClient = ({ note, categories }: NoteClientProps) => {
   const { user } = useAppMode();
   const [localNote, setLocalNote] = useState<Note>(note);
   const [showCloneModal, setShowCloneModal] = useState(false);
+  const returnPath = useReturnPath(`/?mode=${Modes.NOTES}`);
   const prevNoteId = useRef(note.id);
   const prevUpdatedAt = useRef(note.updatedAt);
 
@@ -48,7 +50,7 @@ export const NoteClient = ({ note, categories }: NoteClientProps) => {
 
   const handleBack = () => {
     checkNavigation(() => {
-      router.push("/?mode=notes");
+      router.push(returnPath);
     });
   };
 
@@ -75,7 +77,7 @@ export const NoteClient = ({ note, categories }: NoteClientProps) => {
 
   const handleDelete = () => {
     checkNavigation(() => {
-      router.push("/?mode=notes");
+      router.push(returnPath);
     });
   };
 
diff --git a/app/_components/FeatureComponents/Notes/NotesClient.tsx b/app/_components/FeatureComponents/Notes/NotesClient.tsx
index 8dba0fa0a..9cdedb308 100644
--- a/app/_components/FeatureComponents/Notes/NotesClient.tsx
+++ b/app/_components/FeatureComponents/Notes/NotesClient.tsx
@@ -118,7 +118,7 @@ export const NotesClient = ({
       >
         <MobileHeader user={user} onOpenSettings={openSettings} currentLocale={user?.preferredLocale || "en"} />
         
-        <div className="w-full px-4 py-6 h-full overflow-y-auto jotty-scrollable-content">
+        <div className="w-full px-4 py-6 h-full overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter">
           {children}
         </div>
       </Layout>
diff --git a/app/_components/FeatureComponents/Notes/Parts/CodeBlock/CodeBlockNodeView.tsx b/app/_components/FeatureComponents/Notes/Parts/CodeBlock/CodeBlockNodeView.tsx
index 29ec85064..be3519602 100644
--- a/app/_components/FeatureComponents/Notes/Parts/CodeBlock/CodeBlockNodeView.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/CodeBlock/CodeBlockNodeView.tsx
@@ -15,8 +15,7 @@ export const CodeBlockNodeView = ({ node }: any) => {
   return (
     <NodeViewWrapper>
       <Renderer language={node.attrs.language} code={node.textContent}>
-        {/* @ts-ignore */}
-        <NodeViewContent as="code" />
+        <NodeViewContent<"code"> as="code" spellCheck={false} />
       </Renderer>
     </NodeViewWrapper>
   );
diff --git a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditor.tsx b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditor.tsx
index 55cf50dd9..0093c25a1 100644
--- a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditor.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditor.tsx
@@ -11,6 +11,7 @@ import { useSearchParams } from "next/navigation";
 import { usePermissions } from "@/app/_providers/PermissionsProvider";
 import { useNotesStore } from "@/app/_utils/notes-store";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
+import { NoteQuickBar } from "@/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteQuickBar";
 
 export interface NoteEditorProps {
   note: Note;
@@ -40,56 +41,58 @@ export const NoteEditor = ({
     searchParams?.get("editor") === "true";
 
   return (
-    <div className="flex-1 flex flex-col overflow-hidden bg-background h-full">
-      <NoteEditorHeader
-        note={note}
-        categories={categories}
-        isOwner={isOwner}
-        onBack={onBack}
-        onClone={onClone}
-        viewModel={viewModel}
-        showTOC={showTOC}
-        setShowTOC={setShowTOC}
-        onOpenDecryptModal={decryptModalRef}
-        onOpenViewModal={viewModalRef}
-      />
+    <NoteQuickBar active={viewModel.isEditing}>
+      <div className="jotty-note-bar-gutter flex-1 flex flex-col overflow-hidden bg-background h-full">
+        <NoteEditorHeader
+          note={note}
+          categories={categories}
+          isOwner={isOwner}
+          onBack={onBack}
+          onClone={onClone}
+          viewModel={viewModel}
+          showTOC={showTOC}
+          setShowTOC={setShowTOC}
+          onOpenDecryptModal={decryptModalRef}
+          onOpenViewModal={viewModalRef}
+        />
 
-      <div className="flex flex-1 w-full relative min-h-0">
-        <div className="flex-1 overflow-y-auto jotty-scrollable-content min-h-0">
-          <NoteEditorContent
-            isEditing={viewModel.isEditing}
-            noteContent={note.content}
-            editorContent={viewModel.editorContent}
-            onEditorContentChange={viewModel.handleEditorContentChange}
-            noteId={note.uuid}
-            encrypted={note.encrypted}
-            onOpenDecryptModal={() => decryptModalRef.current?.()}
-            onOpenViewModal={() => viewModalRef.current?.()}
-            isEditingEncrypted={viewModel.isEditingEncrypted}
-          />
-        </div>
-
-        {showTOC && (
-          <div className="w-64 border-l border-border">
-            <TableOfContents
-              content={
-                _isEditMode
-                  ? viewModel.derivedMarkdownContent
-                  : note.content || ""
-              }
-              isEditing={_isEditMode}
+        <div className="flex flex-1 w-full relative min-h-0">
+          <div className="jotty-quick-nav-gutter flex-1 overflow-y-auto jotty-scrollable-content min-h-0">
+            <NoteEditorContent
+              isEditing={viewModel.isEditing}
+              noteContent={note.content}
+              editorContent={viewModel.editorContent}
+              onEditorContentChange={viewModel.handleEditorContentChange}
+              noteId={note.uuid}
+              encrypted={note.encrypted}
+              onOpenDecryptModal={() => decryptModalRef.current?.()}
+              onOpenViewModal={() => viewModalRef.current?.()}
+              isEditingEncrypted={viewModel.isEditingEncrypted}
             />
           </div>
-        )}
-      </div>
 
-      <UnsavedChangesModal
-        isOpen={viewModel.showUnsavedChangesModal}
-        onClose={() => viewModel.setShowUnsavedChangesModal(false)}
-        onSave={viewModel.handleUnsavedChangesSave}
-        onDiscard={viewModel.handleUnsavedChangesDiscard}
-        noteTitle={note.title}
-      />
-    </div>
+          {showTOC && (
+            <div className="w-64 border-l border-border">
+              <TableOfContents
+                content={
+                  _isEditMode
+                    ? viewModel.derivedMarkdownContent
+                    : note.content || ""
+                }
+                isEditing={_isEditMode}
+              />
+            </div>
+          )}
+        </div>
+
+        <UnsavedChangesModal
+          isOpen={viewModel.showUnsavedChangesModal}
+          onClose={() => viewModel.setShowUnsavedChangesModal(false)}
+          onSave={viewModel.handleUnsavedChangesSave}
+          onDiscard={viewModel.handleUnsavedChangesDiscard}
+          noteTitle={note.title}
+        />
+      </div>
+    </NoteQuickBar>
   );
 };
diff --git a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorHeader.tsx b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorHeader.tsx
index 9312f1bed..1c261b371 100644
--- a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorHeader.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorHeader.tsx
@@ -57,6 +57,11 @@ import {
 import { useTranslations } from "next-intl";
 import { NoteHistoryModal } from "@/app/_components/GlobalComponents/Modals/NotesModal/NoteHistoryModal";
 import { useToast } from "@/app/_providers/ToastProvider";
+import {
+  QuickBarPortal,
+  QuickBarSlots,
+  quickBarButton,
+} from "@/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteQuickBar";
 
 interface NoteEditorHeaderProps {
   note: Note;
@@ -191,6 +196,20 @@ export const NoteEditorHeader = ({
     }
   };
 
+  const handleSaveClick = () => {
+    if (!isEditingEncrypted) {
+      handleSave();
+      return;
+    }
+    const cached = viewModel.getCachedPassphrase();
+    if (cached) {
+      handleSave(false, cached);
+      return;
+    }
+    setEncryptionModalMode("save");
+    setShowEncryptionModal(true);
+  };
+
   const handleHistoryClick = () => {
     setShowHistoryModal(true);
   };
@@ -364,19 +383,7 @@ export const NoteEditorHeader = ({
                 </Button>
                 <Button
                   size="sm"
-                  onClick={() => {
-                    if (isEditingEncrypted) {
-                      const cached = viewModel.getCachedPassphrase();
-                      if (cached) {
-                        handleSave(false, cached);
-                      } else {
-                        setEncryptionModalMode("save");
-                        setShowEncryptionModal(true);
-                      }
-                    } else {
-                      handleSave();
-                    }
-                  }}
+                  onClick={handleSaveClick}
                   className="hidden lg:flex"
                   disabled={status.isSaving || status.isAutoSaving}
                 >
@@ -396,33 +403,24 @@ export const NoteEditorHeader = ({
                   )}
                 </Button>
 
-                <div
-                  className={`fixed bottom-[20px] ${user?.handedness === "left-handed"
-                    ? "left-[2.5%]"
-                    : "right-[2.5%]"
-                    } lg:hidden z-50 flex flex-col gap-1 bg-background border border-border rounded-jotty p-1`}
-                >
+                <QuickBarPortal slot={QuickBarSlots.ACTIONS}>
                   <Button
                     variant="outline"
                     size="icon"
                     onClick={handleCancel}
+                    title={t("common.cancel")}
                     aria-label={t("common.cancel")}
+                    className={quickBarButton}
                   >
                     <Cancel01Icon className="h-5 w-5" />
                   </Button>
 
                   <Button
                     size="icon"
-                    onClick={() => {
-                      if (isEditingEncrypted) {
-                        setEncryptionModalMode("save");
-                        setShowEncryptionModal(true);
-                      } else {
-                        handleSave();
-                      }
-                    }}
-                    className="h-10 w-10"
+                    onClick={handleSaveClick}
+                    className={quickBarButton}
                     disabled={status.isSaving || status.isAutoSaving}
+                    title={status.isSaving ? t("common.saving") : t("common.save")}
                     aria-label={
                       status.isSaving ? t("common.saving") : t("common.save")
                     }
@@ -436,7 +434,7 @@ export const NoteEditorHeader = ({
                       <FloppyDiskIcon className="h-5 w-5" />
                     )}
                   </Button>
-                </div>
+                </QuickBarPortal>
               </>
             ) : (
               <>
diff --git a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteQuickBar.tsx b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteQuickBar.tsx
new file mode 100644
index 000000000..a5c791d1f
--- /dev/null
+++ b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteQuickBar.tsx
@@ -0,0 +1,89 @@
+"use client";
+
+import {
+  ReactNode,
+  createContext,
+  useContext,
+  useRef,
+  useState,
+} from "react";
+import { createPortal } from "react-dom";
+import { useTranslations } from "next-intl";
+import { useAppMode } from "@/app/_providers/AppModeProvider";
+import { useBottomBarSpace } from "@/app/_hooks/useBottomBarSpace";
+import { BottomBarSpaces } from "@/app/_types/enums";
+import { cn } from "@/app/_utils/global-utils";
+
+export enum QuickBarSlots {
+  MODES = "modes",
+  ACTIONS = "actions",
+}
+
+type SlotTargets = Record<QuickBarSlots, HTMLElement | null>;
+
+const QuickBarContext = createContext<SlotTargets | null>(null);
+
+export const quickBarButton = "h-10 w-auto min-w-0 max-w-[3rem] flex-1 px-0";
+
+interface NoteQuickBarProps {
+  active: boolean;
+  children: ReactNode;
+}
+
+export const NoteQuickBar = ({ active, children }: NoteQuickBarProps) => {
+  const t = useTranslations();
+  const { user } = useAppMode();
+  const barRef = useRef<HTMLDivElement>(null);
+  const [modes, setModes] = useState<HTMLElement | null>(null);
+  const [actions, setActions] = useState<HTMLElement | null>(null);
+
+  useBottomBarSpace(barRef, BottomBarSpaces.NOTE_BAR, { enabled: active });
+
+  return (
+    <QuickBarContext.Provider value={active ? { modes, actions } : null}>
+      {children}
+      {active && (
+        <div
+          ref={barRef}
+          role="toolbar"
+          aria-label={t("editor.quickControls")}
+          className={cn(
+            "jotty-note-quick-bar fixed inset-x-0 bottom-0 z-40 lg:hidden no-print",
+            "flex items-center gap-1 px-2 pt-2 pb-[max(0.5rem,env(safe-area-inset-bottom))]",
+            "bg-background border-t border-border",
+            user?.handedness === "left-handed" && "flex-row-reverse",
+          )}
+        >
+          <div ref={setModes} className="contents" />
+          <div className="flex-1 min-w-0" />
+          <div ref={setActions} className="contents" />
+        </div>
+      )}
+    </QuickBarContext.Provider>
+  );
+};
+
+interface QuickBarPortalProps {
+  slot: QuickBarSlots;
+  children: ReactNode;
+  fallbackClassName?: string;
+}
+
+export const QuickBarPortal = ({
+  slot,
+  children,
+  fallbackClassName,
+}: QuickBarPortalProps) => {
+  const targets = useContext(QuickBarContext);
+
+  if (!targets) {
+    return fallbackClassName ? (
+      <div className={cn(fallbackClassName, "[&>button]:w-10 [&>button]:flex-none")}>
+        {children}
+      </div>
+    ) : null;
+  }
+
+  const target = targets[slot];
+  return target ? createPortal(children, target) : null;
+};
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/BoldItalicInput.ts b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/BoldItalicInput.ts
new file mode 100644
index 000000000..d4b2ca90b
--- /dev/null
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/BoldItalicInput.ts
@@ -0,0 +1,47 @@
+import { Extension, InputRule } from "@tiptap/core";
+
+export const tripleStarRegex =
+  /(?:^|\s)(\*\*\*(?!\s+\*\*\*)((?:[^*]+))\*\*\*(?!\s+\*\*\*))$/;
+
+export const tripleUnderscoreRegex =
+  /(?:^|\s)(___(?!\s+___)((?:[^_]+))___(?!\s+___))$/;
+
+export const BoldItalicInput = Extension.create({
+  name: "boldItalicInput",
+
+  addInputRules() {
+    const { bold, italic } = this.editor.schema.marks;
+    if (!bold || !italic) return [];
+
+    const doubleMarkRule = (find: RegExp) =>
+      new InputRule({
+        find,
+        handler: ({ state, range, match }) => {
+          const fullMatch = match[0];
+          const text = match[match.length - 1];
+          if (!text) return null;
+
+          const { tr } = state;
+          const startSpaces = fullMatch.search(/\S/);
+          const textStart = range.from + fullMatch.indexOf(text);
+          const textEnd = textStart + text.length;
+
+          if (textEnd < range.to) tr.delete(textEnd, range.to);
+          if (textStart > range.from) tr.delete(range.from + startSpaces, textStart);
+
+          const markStart = range.from + startSpaces;
+          const markEnd = markStart + text.length;
+
+          tr.addMark(markStart, markEnd, bold.create());
+          tr.addMark(markStart, markEnd, italic.create());
+          tr.removeStoredMark(bold);
+          tr.removeStoredMark(italic);
+        },
+      });
+
+    return [
+      doubleMarkRule(tripleStarRegex),
+      doubleMarkRule(tripleUnderscoreRegex),
+    ];
+  },
+});
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/DrawioExtension.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/DrawioExtension.tsx
index d172f268d..2ad114968 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/DrawioExtension.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/DrawioExtension.tsx
@@ -8,6 +8,7 @@ import { Sun03Icon, GibbousMoonIcon } from "hugeicons-react";
 import { useTranslations } from "next-intl";
 import { ConfirmModal } from "@/app/_components/GlobalComponents/Modals/ConfirmationModals/ConfirmModal";
 import { Modal } from "@/app/_components/GlobalComponents/Modals/Modal";
+import { base64ToText } from "@/app/_utils/base64-utils";
 
 export const DrawioNodeView = ({
   node,
@@ -103,7 +104,7 @@ export const DrawioNodeView = ({
                   "data:image/svg+xml;base64,",
                   ""
                 );
-                svgData = atob(base64Data);
+                svgData = base64ToText(base64Data);
               } catch (e) {
                 console.error("Failed to decode SVG:", e);
               }
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx
index cbb01f026..ad97691aa 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/InternalLinkComponent.tsx
@@ -7,8 +7,8 @@ import { File02Icon, CheckmarkSquare04Icon, TaskDaily01Icon } from "hugeicons-re
 import { useRouter } from "next/navigation";
 import { capitalize } from "lodash";
 import { useTranslations } from "next-intl";
-import { getNoteById } from "@/app/_server/actions/note";
-import { getListById } from "@/app/_server/actions/checklist";
+import { viewNote } from "@/app/_server/actions/note";
+import { viewList } from "@/app/_server/actions/checklist";
 import { itemHref } from "@/app/_utils/global-utils";
 import { parseItemHref } from "@/app/_utils/item-href-utils";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
@@ -39,11 +39,11 @@ const isChecklist = (item?: LinkedItem | null): item is Partial<Checklist> =>
 
 const _fetchItem = async (uuid: string, type?: ItemTypes): Promise<Note | Checklist | null> => {
   if (type !== ItemTypes.CHECKLIST) {
-    const note = await getNoteById(uuid);
+    const note = await viewNote(uuid);
     if (note) return note;
   }
   if (type !== ItemTypes.NOTE) {
-    const list = await getListById(uuid);
+    const list = await viewList(uuid);
     if (list) return list;
   }
   return null;
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/EditorUtils/editorConfig.ts b/app/_components/FeatureComponents/Notes/Parts/TipTap/EditorUtils/editorConfig.ts
index 46c9a2a94..5bfb1133e 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/EditorUtils/editorConfig.ts
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/EditorUtils/editorConfig.ts
@@ -29,6 +29,7 @@ import { MermaidExtension } from "@/app/_components/FeatureComponents/Notes/Part
 import { DrawioExtension } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/DrawioExtension";
 import { ExcalidrawExtension } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/ExcalidrawExtension";
 import { CalloutExtension } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/CalloutExtension";
+import { BoldItalicInput } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/BoldItalicInput";
 import { generateCustomHtmlExtensions } from "@/app/_utils/custom-html-utils";
 import { getContrastColor } from "@/app/_utils/color-utils";
 
@@ -76,7 +77,11 @@ export const createEditorExtensions = (
       listItem: false,
       bulletList: false,
       hardBreak: false,
+      code: {
+        HTMLAttributes: { spellcheck: "false" },
+      },
     }),
+    BoldItalicInput,
     ...generateCustomHtmlExtensions(),
     DetailsExtension,
     CalloutExtension,
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/MinimalModeEditor.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/MinimalModeEditor.tsx
index 52c78cbb5..0b5fb2b74 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/MinimalModeEditor.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/MinimalModeEditor.tsx
@@ -8,7 +8,11 @@ import { ReadingProgressBar } from "@/app/_components/GlobalComponents/Layout/Re
 import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { useTranslations } from "next-intl";
-import { useAppMode } from "@/app/_providers/AppModeProvider";
+import {
+  QuickBarPortal,
+  QuickBarSlots,
+  quickBarButton,
+} from "@/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteQuickBar";
 import { useNotesStore } from "@/app/_utils/notes-store";
 import { VisualGuideRuler } from "./VisualGuideRuler";
 import { EditorSettingsDropdown } from "./Toolbar/EditorSettingsDropdown";
@@ -31,7 +35,6 @@ export const MinimalModeEditor = ({
   compactMode,
 }: MinimalModeEditorProps) => {
   const t = useTranslations();
-  const { user } = useAppMode();
   const { showLineNumbers, showRuler, showVisualGuides, visualGuideColumns } =
     useNotesStore();
   const { contentWithoutMetadata } = extractYamlMetadata(noteContent);
@@ -103,8 +106,9 @@ export const MinimalModeEditor = ({
         </div>
       </div>
 
-      <div
-        className={`fixed bottom-[130px] ${user?.handedness === "left-handed" ? "left-[2.5%]" : "right-[2.5%]"} lg:hidden z-40 flex flex-col gap-1 bg-background border border-border rounded-jotty p-1`}
+      <QuickBarPortal
+        slot={QuickBarSlots.MODES}
+        fallbackClassName="flex lg:hidden justify-end gap-1 p-1"
       >
         <Button
           variant={showPreview ? "default" : "ghost"}
@@ -112,7 +116,9 @@ export const MinimalModeEditor = ({
           onMouseDown={(e) => e.preventDefault()}
           onClick={() => setShowPreview(true)}
           title={t("editor.previewMode")}
-          className="h-10 w-10"
+          aria-label={t("editor.previewMode")}
+          aria-pressed={showPreview}
+          className={quickBarButton}
         >
           <ViewIcon className="h-5 w-5" />
         </Button>
@@ -123,11 +129,13 @@ export const MinimalModeEditor = ({
           onMouseDown={(e) => e.preventDefault()}
           onClick={() => setShowPreview(false)}
           title={t("editor.markdownEditor")}
-          className="h-10 w-10"
+          aria-label={t("editor.markdownEditor")}
+          aria-pressed={!showPreview}
+          className={quickBarButton}
         >
           <File02Icon className="h-5 w-5" />
         </Button>
-      </div>
+      </QuickBarPortal>
       {!showPreview && showRuler && (
         <VisualGuideRuler
           charWidth={charWidth}
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/SyntaxHighlightedEditor.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/SyntaxHighlightedEditor.tsx
index cd894457d..7dde4b01d 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/SyntaxHighlightedEditor.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/SyntaxHighlightedEditor.tsx
@@ -98,6 +98,29 @@ export const SyntaxHighlightedEditor = ({
     onChange(newContent);
   };
 
+  const applyListEdit = (
+    e: React.KeyboardEvent<HTMLTextAreaElement | HTMLDivElement>,
+    textarea: HTMLTextAreaElement,
+    newContent: string | null
+  ) => {
+    if (newContent === null) return;
+    e.preventDefault();
+    const { scrollTop, scrollLeft, selectionStart, selectionEnd } = textarea;
+    onChange(newContent);
+
+    requestAnimationFrame(() => {
+      const ta = document.getElementById(
+        "markdown-editor-textarea"
+      ) as HTMLTextAreaElement;
+      if (ta) {
+        ta.focus({ preventScroll: true });
+        ta.setSelectionRange(selectionStart, selectionEnd);
+        ta.scrollTop = scrollTop;
+        ta.scrollLeft = scrollLeft;
+      }
+    });
+  };
+
   const handleKeyDown = (
     e: React.KeyboardEvent<HTMLTextAreaElement | HTMLDivElement>
   ) => {
@@ -135,27 +158,9 @@ export const SyntaxHighlightedEditor = ({
       e.preventDefault();
       onLinkRequest?.(textarea.selectionStart !== textarea.selectionEnd);
     } else if (e.key === "Enter" && !isMod && !e.shiftKey && !e.altKey) {
-      const newContent =
-        MarkdownUtils.handleBulletListEnter(textarea) ??
-        MarkdownUtils.handleOrderedListEnter(textarea);
-      if (newContent !== null) {
-        e.preventDefault();
-        const { scrollTop, scrollLeft, selectionStart, selectionEnd } =
-          textarea;
-        onChange(newContent);
-
-        requestAnimationFrame(() => {
-          const ta = document.getElementById(
-            "markdown-editor-textarea"
-          ) as HTMLTextAreaElement;
-          if (ta) {
-            ta.focus({ preventScroll: true });
-            ta.setSelectionRange(selectionStart, selectionEnd);
-            ta.scrollTop = scrollTop;
-            ta.scrollLeft = scrollLeft;
-          }
-        });
-      }
+      applyListEdit(e, textarea, MarkdownUtils.handleListEnter(textarea));
+    } else if (e.key === "Tab" && !isMod && !e.shiftKey && !e.altKey) {
+      applyListEdit(e, textarea, MarkdownUtils.indentListItem(textarea));
     }
   };
 
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/Toolbar/TipTapToolbar.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/Toolbar/TipTapToolbar.tsx
index 4cc654a26..a9e0d3c4d 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/Toolbar/TipTapToolbar.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/Toolbar/TipTapToolbar.tsx
@@ -29,9 +29,13 @@ import { PrismThemeDropdown } from "@/app/_components/FeatureComponents/Notes/Pa
 import { EditorSettingsDropdown } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/Toolbar/EditorSettingsDropdown";
 import { useTranslations } from "next-intl";
 import { PromptModal } from "@/app/_components/GlobalComponents/Modals/ConfirmationModals/PromptModal";
-import { useAppMode } from "@/app/_providers/AppModeProvider";
 import * as MarkdownUtils from "@/app/_utils/markdown-editor-utils";
 import { insertTextAtCursor } from "@/app/_utils/markdown-editor-utils";
+import {
+  QuickBarPortal,
+  QuickBarSlots,
+  quickBarButton,
+} from "@/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteQuickBar";
 
 const isMac = typeof navigator !== "undefined" && /Mac|iPod|iPhone|iPad/.test(navigator.platform);
 const mod = isMac ? "⌘" : "Ctrl";
@@ -61,7 +65,6 @@ export const TiptapToolbar = ({
   onLinkRequestHandled,
 }: ToolbarProps) => {
   const t = useTranslations();
-  const { user } = useAppMode();
   const [showFileModal, setShowFileModal] = useState(false);
   const [showTableModal, setShowTableModal] = useState(false);
   const [showImageSizeModal, setShowImageSizeModal] = useState(false);
@@ -343,7 +346,10 @@ export const TiptapToolbar = ({
           </Button>
         </div>
 
-        <div className={`fixed bottom-[130px] ${user?.handedness === "left-handed" ? "left-[2.5%]" : "right-[2.5%]"} lg:hidden z-40 flex flex-col gap-1 bg-background border border-border rounded-jotty p-1`}>
+        <QuickBarPortal
+          slot={QuickBarSlots.MODES}
+          fallbackClassName="flex lg:hidden flex-shrink-0 items-center gap-1"
+        >
           {isMarkdownMode && onTogglePreview && (
             <Button
               variant={showPreview ? "default" : "ghost"}
@@ -351,7 +357,8 @@ export const TiptapToolbar = ({
               onMouseDown={(e) => e.preventDefault()}
               onClick={onTogglePreview}
               title={showPreview ? t('editor.hidePreview') : t('editor.showPreview')}
-              className="h-10 w-10"
+              aria-label={showPreview ? t('editor.hidePreview') : t('editor.showPreview')}
+              className={quickBarButton}
             >
               {showPreview ? (
                 <ViewOffSlashIcon className="h-5 w-5" />
@@ -366,7 +373,9 @@ export const TiptapToolbar = ({
             onMouseDown={(e) => e.preventDefault()}
             onClick={toggleMode}
             title={t('editor.toggleRichEditorMode')}
-            className="h-10 w-10"
+            aria-label={t('editor.toggleRichEditorMode')}
+            aria-pressed={!isMarkdownMode}
+            className={quickBarButton}
           >
             <Tv02Icon className="h-5 w-5" />
           </Button>
@@ -377,11 +386,13 @@ export const TiptapToolbar = ({
             onMouseDown={(e) => e.preventDefault()}
             onClick={toggleMode}
             title={t('editor.toggleMarkdownMode')}
-            className="h-10 w-10"
+            aria-label={t('editor.toggleMarkdownMode')}
+            aria-pressed={isMarkdownMode}
+            className={quickBarButton}
           >
             <File02Icon className="h-5 w-5" />
           </Button>
-        </div>
+        </QuickBarPortal>
 
         <div
           className={cn(
diff --git a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
index d06216904..ad93a231c 100644
--- a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
@@ -31,6 +31,8 @@ import { remarkWikilinks, WIKILINK_TAG } from "@/app/_utils/wikilink-utils";
 import { WikiLink } from "./WikiLink";
 import { matchCallout } from "@/app/_utils/callout-utils";
 import { CalloutType } from "@/app/_consts/callouts";
+import { base64ToSvg, base64ToText } from "@/app/_utils/base64-utils";
+import { noteUrlTransform } from "@/app/_utils/url-transform-utils";
 
 type WikiLinkComponents = Record<
   typeof WIKILINK_TAG,
@@ -45,6 +47,8 @@ import {
   AlertCircleIcon,
 } from "hugeicons-react";
 
+const TRAILING_NEWLINE = /\n$/;
+
 const getRawTextFromChildren = (children: React.ReactNode): string => {
   let text = "";
   Children.forEach(children, (child) => {
@@ -87,14 +91,14 @@ export const UnifiedMarkdownRenderer = ({
     /<!--\s*drawio-diagram\s+data:\s*([^\n]+)\s+svg:\s*([^\n]+)(?:\s+theme:\s*([^\n]+))?\s*-->/g,
     (match, dataBase64, svgBase64, theme) => {
       try {
-        const diagramData = atob(dataBase64.trim());
-        const svgData = atob(svgBase64.trim());
+        const diagramData = base64ToText(dataBase64.trim());
         const themeMode = theme ? theme.trim() : "light";
         return `<div data-drawio="" data-drawio-data="${diagramData.replace(
           /"/g,
           "&quot;",
         )}" data-drawio-svg="${svgBase64.trim()}" data-drawio-theme="${themeMode}">[Draw.io Diagram]</div>`;
       } catch (e) {
+        console.error("Failed to decode drawio diagram:", e);
         return match;
       }
     },
@@ -104,8 +108,8 @@ export const UnifiedMarkdownRenderer = ({
     /<!--\s*excalidraw-diagram\s+data:\s*([^\n]+)(?:\s+svg:\s*([^\n]+))?(?:\s+theme:\s*([^\n]+))?\s*-->/g,
     (match, dataBase64, svgBase64, theme) => {
       try {
-        const diagramData = atob(dataBase64.trim());
-        const svgData = svgBase64 ? atob(svgBase64.trim()) : "";
+        const diagramData = base64ToText(dataBase64.trim());
+        const svgData = svgBase64 ? base64ToText(svgBase64.trim()) : "";
         const themeMode = theme ? theme.trim() : "light";
         return `<div data-excalidraw="" data-excalidraw-data="${diagramData.replace(
           /"/g,
@@ -115,6 +119,7 @@ export const UnifiedMarkdownRenderer = ({
           "&quot;",
         )}" data-excalidraw-theme="${themeMode}">[Excalidraw Diagram]</div>`;
       } catch (e) {
+        console.error("Failed to decode excalidraw diagram:", e);
         return match;
       }
     },
@@ -180,7 +185,9 @@ export const UnifiedMarkdownRenderer = ({
         const codeElement = child as ReactElement<any>;
         const language =
           codeElement.props.className?.replace("language-", "") || "plaintext";
-        const rawCode = getRawTextFromChildren(codeElement.props.children);
+        const rawCode = getRawTextFromChildren(
+          codeElement.props.children,
+        ).replace(TRAILING_NEWLINE, "");
 
         if (language === "mermaid") {
           return (
@@ -452,9 +459,11 @@ export const UnifiedMarkdownRenderer = ({
         let decodedSvgData = rawSvgData;
         try {
           if (rawSvgData && !rawSvgData.trim().startsWith("<")) {
-            decodedSvgData = atob(rawSvgData);
+            decodedSvgData = base64ToSvg(rawSvgData);
           }
-        } catch (e) {}
+        } catch (e) {
+          console.error("Failed to decode drawio preview:", e);
+        }
         const themeMode = forceLightMode
           ? "light"
           : props["data-drawio-theme"] ||
@@ -570,6 +579,7 @@ export const UnifiedMarkdownRenderer = ({
           remarkPlugins={[remarkGfm, remarkWikilinks]}
           rehypePlugins={[rehypeSlug, rehypeRaw]}
           components={components}
+          urlTransform={noteUrlTransform}
         >
           {processedContent}
         </ReactMarkdown>
diff --git a/app/_components/FeatureComponents/PublicView/Parts/PublicChecklistBody.tsx b/app/_components/FeatureComponents/PublicView/Parts/PublicChecklistBody.tsx
index 209973ea5..a2c6ad615 100644
--- a/app/_components/FeatureComponents/PublicView/Parts/PublicChecklistBody.tsx
+++ b/app/_components/FeatureComponents/PublicView/Parts/PublicChecklistBody.tsx
@@ -1,15 +1,18 @@
-import { Checklist, Item } from "@/app/_types";
+import { Checklist } from "@/app/_types";
 import { CheckmarkSquare04Icon } from "hugeicons-react";
 import { TaskStatusSection } from "./TaskStatusSection";
 import { useMemo } from "react";
-import { isKanbanType, TaskStatus } from "@/app/_types/enums";
+import { isKanbanType } from "@/app/_types/enums";
+import { boardColumns } from "@/app/_utils/kanban/board-utils";
 import { NestedChecklistItem } from "../../Checklists/Parts/Simple/NestedChecklistItem";
 import { useTranslations } from "next-intl";
 
 export const PublicChecklistBody = ({
   checklist,
+  ownerShowsEmojis,
 }: {
   checklist: Checklist;
+  ownerShowsEmojis?: boolean;
 }) => {
   const t = useTranslations();
   const { totalCount } = useMemo(() => {
@@ -20,20 +23,10 @@ export const PublicChecklistBody = ({
     };
   }, [checklist.items]);
 
-  const taskItemsByStatus = useMemo(() => {
-    if (!isKanbanType(checklist.type)) return null;
-    const initialAcc: Record<string, Item[]> = {
-      todo: [],
-      in_progress: [],
-      paused: [],
-      completed: [],
-    };
-    return checklist.items.reduce((acc, item) => {
-      const status = item.status || TaskStatus.TODO;
-      if (acc[status]) acc[status].push(item);
-      return acc;
-    }, initialAcc);
-  }, [checklist.items, checklist.type]);
+  const statusColumns = useMemo(
+    () => (isKanbanType(checklist.type) ? boardColumns(checklist) : null),
+    [checklist],
+  );
 
   if (totalCount === 0) {
     return (
@@ -49,13 +42,14 @@ export const PublicChecklistBody = ({
     );
   }
 
-  if (isKanbanType(checklist.type) && taskItemsByStatus) {
-    return Object.entries(taskItemsByStatus).map(([status, items]) => (
+  if (statusColumns) {
+    return statusColumns.map(({ status, items }) => (
       <TaskStatusSection
-        key={status}
+        key={status.id}
         status={status}
         items={items}
         checklist={checklist}
+        ownerShowsEmojis={ownerShowsEmojis}
       />
     ));
   }
@@ -71,6 +65,7 @@ export const PublicChecklistBody = ({
           onToggle={() => {}}
           onDelete={() => {}}
           isPublicView={true}
+          ownerShowsEmojis={ownerShowsEmojis}
           isDeletingItem={false}
           isDragDisabled={true}
           checklist={checklist}
diff --git a/app/_components/FeatureComponents/PublicView/Parts/TaskStatusSection.tsx b/app/_components/FeatureComponents/PublicView/Parts/TaskStatusSection.tsx
index 521c59f18..f0649db7d 100644
--- a/app/_components/FeatureComponents/PublicView/Parts/TaskStatusSection.tsx
+++ b/app/_components/FeatureComponents/PublicView/Parts/TaskStatusSection.tsx
@@ -1,5 +1,5 @@
 import { cn } from "@/app/_utils/global-utils";
-import { Checklist, Item } from "@/app/_types";
+import { Checklist, Item, KanbanStatus } from "@/app/_types";
 import { TASK_STATUS_CONFIG } from "@/app/_consts/checklists";
 import { NestedChecklistItem } from "../../Checklists/Parts/Simple/NestedChecklistItem";
 
@@ -7,19 +7,30 @@ export const TaskStatusSection = ({
   status,
   items,
   checklist,
+  ownerShowsEmojis,
 }: {
-  status: string;
+  status: KanbanStatus;
   items: Item[];
   checklist: Checklist;
+  ownerShowsEmojis?: boolean;
 }) => {
-  const config = TASK_STATUS_CONFIG[status as keyof typeof TASK_STATUS_CONFIG];
-  if (!config || items.length === 0) return null;
+  if (items.length === 0) return null;
+
+  const config =
+    TASK_STATUS_CONFIG[status.id as keyof typeof TASK_STATUS_CONFIG];
 
   return (
     <div>
       <h3 className="text-lg font-semibold text-foreground mb-3 flex items-center gap-2">
-        <config.Icon className={cn("h-5 w-5", config.iconClassName)} />
-        {config.title} ({items.length})
+        {config && !status.color ? (
+          <config.Icon className={cn("h-5 w-5", config.iconClassName)} />
+        ) : (
+          <span
+            className="w-3 h-3 rounded-full shrink-0 bg-muted-foreground"
+            style={status.color ? { backgroundColor: status.color } : undefined}
+          />
+        )}
+        {status.label} ({items.length})
       </h3>
 
       <div className="space-y-2">
@@ -32,6 +43,7 @@ export const TaskStatusSection = ({
             onToggle={() => { }}
             onDelete={() => { }}
             isPublicView={true}
+            ownerShowsEmojis={ownerShowsEmojis}
             isDeletingItem={false}
             isDragDisabled={true}
             checklist={checklist}
diff --git a/app/_components/FeatureComponents/PublicView/PublicChecklistView.tsx b/app/_components/FeatureComponents/PublicView/PublicChecklistView.tsx
index 6655e3d75..4e5a897e7 100644
--- a/app/_components/FeatureComponents/PublicView/PublicChecklistView.tsx
+++ b/app/_components/FeatureComponents/PublicView/PublicChecklistView.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import { useState, useEffect } from "react";
+import { useTranslations } from "next-intl";
 import { Checklist, User } from "@/app/_types";
 import { PublicChecklistHeader } from "@/app/_components/FeatureComponents/PublicView/Parts/PublicChecklistHeader";
 import { PublicChecklistBody } from "@/app/_components/FeatureComponents/PublicView/Parts/PublicChecklistBody";
@@ -9,12 +10,15 @@ import { PublicUser } from "@/app/_utils/user-sanitize-utils";
 interface PublicChecklistViewProps {
   checklist: Checklist;
   user: PublicUser | null;
+  ownerShowsEmojis: boolean;
 }
 
 export const PublicChecklistView = ({
   checklist,
   user,
+  ownerShowsEmojis,
 }: PublicChecklistViewProps) => {
+  const t = useTranslations();
   const [avatarUrl, setAvatarUrl] = useState("");
 
   useEffect(() => {
@@ -34,12 +38,15 @@ export const PublicChecklistView = ({
         />
 
         <main className="space-y-6">
-          <PublicChecklistBody checklist={checklist} />
+          <PublicChecklistBody
+            checklist={checklist}
+            ownerShowsEmojis={ownerShowsEmojis}
+          />
         </main>
 
         <footer className="mt-12 pt-8 border-t border-border text-center">
           <p className="text-md lg:text-sm text-muted-foreground">
-            This checklist is shared publicly by {checklist.owner}
+            {t("checklists.sharedPubliclyBy", { owner: checklist.owner ?? "" })}
           </p>
         </footer>
       </div>
diff --git a/app/_components/FeatureComponents/PublicView/PublicNoteView.tsx b/app/_components/FeatureComponents/PublicView/PublicNoteView.tsx
index 5aa00f8f5..a1c69c7f8 100644
--- a/app/_components/FeatureComponents/PublicView/PublicNoteView.tsx
+++ b/app/_components/FeatureComponents/PublicView/PublicNoteView.tsx
@@ -140,7 +140,7 @@ export const PublicNoteView = ({ note, user }: PublicNoteViewProps) => {
 
         <div className="mt-12 pt-8 border-t border-border text-center no-print">
           <p className="text-md lg:text-sm text-muted-foreground">
-            This note is shared publicly by {note.owner}
+            {t("notes.sharedPubliclyBy", { owner: note.owner ?? "" })}
           </p>
         </div>
       </div>
diff --git a/app/_components/FeatureComponents/Settings/SettingsClient.tsx b/app/_components/FeatureComponents/Settings/SettingsClient.tsx
index 8462047a1..2192400ec 100644
--- a/app/_components/FeatureComponents/Settings/SettingsClient.tsx
+++ b/app/_components/FeatureComponents/Settings/SettingsClient.tsx
@@ -28,7 +28,7 @@ export const SettingsClient = ({
         >
             <MobileHeader user={user} onOpenSettings={openSettings} currentLocale={user?.preferredLocale || "en"} />
             
-            <div className="w-full px-4 py-6 h-full overflow-y-auto jotty-scrollable-content">
+            <div className="w-full px-4 py-6 h-full overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter">
                 {children}
             </div>
         </Layout>
diff --git a/app/_components/GlobalComponents/Dropdowns/Dropdown.tsx b/app/_components/GlobalComponents/Dropdowns/Dropdown.tsx
index e64dd18df..2d3023698 100644
--- a/app/_components/GlobalComponents/Dropdowns/Dropdown.tsx
+++ b/app/_components/GlobalComponents/Dropdowns/Dropdown.tsx
@@ -4,6 +4,13 @@ import { useState, useRef, useEffect } from "react";
 import { ArrowDown01Icon, MoreHorizontalIcon } from "hugeicons-react";
 import { cn } from "@/app/_utils/global-utils";
 import { Logo } from "../Layout/Logo/Logo";
+import { useMenuPlacement } from "@/app/_hooks/useMenuPlacement";
+import { useMediaQuery } from "@/app/_hooks/useMediaQuery";
+import {
+  MenuAlign,
+  MenuSide,
+  menuPlacementClasses,
+} from "@/app/_utils/menu-placement-utils";
 
 interface DropdownOption {
   id: number | string;
@@ -36,6 +43,15 @@ export const Dropdown = ({
 }: DropdownProps) => {
   const [isOpen, setIsOpen] = useState(false);
   const dropdownRef = useRef<HTMLDivElement>(null);
+  const menuRef = useRef<HTMLDivElement>(null);
+  const isDesktop = useMediaQuery("(min-width: 1024px)");
+  const placement = useMenuPlacement(
+    isOpen && !disabled,
+    dropdownRef,
+    menuRef,
+    direction === "up" ? MenuSide.Up : MenuSide.Down,
+    isDesktop ? MenuAlign.Start : MenuAlign.End,
+  );
 
   const selectedOption = options.find((opt) => opt.id === value);
 
@@ -124,10 +140,13 @@ export const Dropdown = ({
       )}
 
       {isOpen && !disabled && (
-        <div className={cn(
-          "jotty-dropdown-menu absolute right-0 lg:left-0 lg:right-auto z-50 w-full min-w-[200px] bg-card border border-border rounded-jotty shadow-lg max-h-48 overflow-y-auto",
-          direction === "up" ? "bottom-full mb-1" : "mt-1"
-        )}>
+        <div
+          ref={menuRef}
+          className={cn(
+            "jotty-dropdown-menu absolute z-50 w-full min-w-[200px] bg-card border border-border rounded-jotty shadow-lg max-h-48 overflow-y-auto",
+            menuPlacementClasses(placement)
+          )}
+        >
           <div className="py-1">
             {options.map((option) => (
               <button
diff --git a/app/_components/GlobalComponents/Dropdowns/DropdownMenu.tsx b/app/_components/GlobalComponents/Dropdowns/DropdownMenu.tsx
index db0d0eb7f..263e64624 100644
--- a/app/_components/GlobalComponents/Dropdowns/DropdownMenu.tsx
+++ b/app/_components/GlobalComponents/Dropdowns/DropdownMenu.tsx
@@ -3,6 +3,12 @@
 import React, { useState, useRef, useEffect } from "react";
 import { cn } from "@/app/_utils/global-utils";
 import { Button } from "../Buttons/Button";
+import { useMenuPlacement } from "@/app/_hooks/useMenuPlacement";
+import {
+  MenuAlign,
+  MenuSide,
+  menuPlacementClasses,
+} from "@/app/_utils/menu-placement-utils";
 
 interface DropdownItem {
   type?: "item" | "divider";
@@ -25,9 +31,15 @@ export const DropdownMenu = ({
   align = "left",
 }: DropdownMenuProps) => {
   const [isOpen, setIsOpen] = useState(false);
-  const [openUpward, setOpenUpward] = useState(false);
   const dropdownRef = useRef<HTMLDivElement>(null);
-  const triggerRef = useRef<HTMLDivElement>(null);
+  const menuRef = useRef<HTMLDivElement>(null);
+  const placement = useMenuPlacement(
+    isOpen,
+    dropdownRef,
+    menuRef,
+    MenuSide.Down,
+    align === "right" ? MenuAlign.End : MenuAlign.Start,
+  );
 
   useEffect(() => {
     const handleClickOutside = (event: MouseEvent) => {
@@ -60,44 +72,23 @@ export const DropdownMenu = ({
     setIsOpen(false);
   };
 
-  const handleToggle = () => {
-    if (!isOpen && triggerRef.current) {
-      const rect = triggerRef.current.getBoundingClientRect();
-
-      let scrollParent: HTMLElement | null = triggerRef.current.parentElement;
-      while (scrollParent) {
-        if (scrollParent.classList.contains('jotty-sidebar-categories') || scrollParent.classList.contains('jotty-sidebar-tags')) {
-          break;
-        }
-        scrollParent = scrollParent.parentElement;
-      }
-
-      if (scrollParent) {
-        const containerRect = scrollParent.getBoundingClientRect();
-        const actualSpaceBelow = containerRect.bottom - rect.bottom;
-        const threshold = 200;
-
-        setOpenUpward(actualSpaceBelow < threshold);
-      }
-    }
-    setIsOpen(!isOpen);
-  };
+  const handleToggle = () => setIsOpen(!isOpen);
 
   return (
     <div
       ref={dropdownRef}
       className="jotty-dropdown-menu relative inline-block"
     >
-      <div ref={triggerRef} onClick={handleToggle} className="cursor-pointer">
+      <div onClick={handleToggle} className="cursor-pointer">
         {trigger}
       </div>
 
       {isOpen && (
         <div
+          ref={menuRef}
           className={cn(
             "absolute min-w-56 w-fit bg-background border border-border rounded-jotty shadow-lg z-50 py-1",
-            openUpward ? "bottom-full mb-1" : "top-full mt-1",
-            align === "right" ? "right-0" : "left-0"
+            menuPlacementClasses(placement)
           )}
         >
           {items.map((item, index) => {
diff --git a/app/_components/GlobalComponents/Layout/Layout.tsx b/app/_components/GlobalComponents/Layout/Layout.tsx
index c49bd1abb..85374b38f 100644
--- a/app/_components/GlobalComponents/Layout/Layout.tsx
+++ b/app/_components/GlobalComponents/Layout/Layout.tsx
@@ -11,6 +11,7 @@ import { isMobileDevice } from "@/app/_utils/global-utils";
 import { Loading } from "@/app/_components/GlobalComponents/Layout/Loading";
 import { usePathname } from "next/navigation";
 import { useUIStore } from "@/app/_utils/ui-store";
+import { useTrackReturnPath } from "@/app/_hooks/useReturnPath";
 
 interface LayoutProps {
   categories: Category[];
@@ -49,6 +50,8 @@ export const Layout = ({
 
   const isSettingsPage = pathname?.startsWith("/settings");
 
+  useTrackReturnPath();
+
   useSidebarGesture({
     isOpen: sidebarOpen,
     onOpen: () => setSidebarOpen(true),
@@ -100,7 +103,7 @@ export const Layout = ({
           isEditorInEditMode={isEditorInEditMode}
         />
 
-        <div className="jotty-layout-content flex-1 overflow-hidden">
+        <div className="jotty-layout-content flex-1 overflow-hidden max-lg:flex max-lg:flex-col">
           {children}
         </div>
       </main>
diff --git a/app/_components/GlobalComponents/Layout/MobileHeader.tsx b/app/_components/GlobalComponents/Layout/MobileHeader.tsx
index 762c54afa..c26b77e69 100644
--- a/app/_components/GlobalComponents/Layout/MobileHeader.tsx
+++ b/app/_components/GlobalComponents/Layout/MobileHeader.tsx
@@ -12,6 +12,7 @@ import { cn, handleScroll } from "@/app/_utils/global-utils";
 import { useTranslations } from "next-intl";
 import { ConnectionIndicator } from "@/app/_components/GlobalComponents/Indicators/ConnectionIndicator";
 import { NotificationBell } from "../../FeatureComponents/Notifications/NotificationBell";
+import { menuCeilingProps } from "@/app/_utils/menu-placement-utils";
 
 interface MobileHeaderProps {
   user: SanitisedUser | null;
@@ -59,7 +60,7 @@ export const MobileHeader = ({
   );
 
   return (
-    <div className={mobileHeaderClasses}>
+    <div className={mobileHeaderClasses} {...menuCeilingProps}>
       <a href="/" className="flex items-center gap-3">
         <div className="relative">
           <DynamicLogo className="h-10 w-10" />
diff --git a/app/_components/GlobalComponents/Modals/ChecklistModals/EditChecklistModal.tsx b/app/_components/GlobalComponents/Modals/ChecklistModals/EditChecklistModal.tsx
index 64c24adb3..7ab0ccbb1 100644
--- a/app/_components/GlobalComponents/Modals/ChecklistModals/EditChecklistModal.tsx
+++ b/app/_components/GlobalComponents/Modals/ChecklistModals/EditChecklistModal.tsx
@@ -2,7 +2,7 @@
 
 import { useState, useEffect } from "react";
 import { useRouter } from "next/navigation";
-import { getListById, updateList } from "@/app/_server/actions/checklist";
+import { viewList, updateList } from "@/app/_server/actions/checklist";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { CategoryTreeSelector } from "@/app/_components/GlobalComponents/Dropdowns/CategoryTreeSelector";
 import { Modal } from "@/app/_components/GlobalComponents/Modals/Modal";
@@ -44,10 +44,7 @@ export const EditChecklistModal = ({
     const fetchChecklist = async () => {
       if (!user?.username || !initialChecklist.uuid) return;
 
-      const fetchedChecklist = await getListById(
-        initialChecklist.uuid,
-        user.username,
-      );
+      const fetchedChecklist = await viewList(initialChecklist.uuid);
 
       if (!fetchedChecklist) {
         setIsMissing(true);
diff --git a/app/_components/GlobalComponents/Modals/NotesModal/CreateNoteModal.tsx b/app/_components/GlobalComponents/Modals/NotesModal/CreateNoteModal.tsx
index 7992812b0..7f1701a9f 100644
--- a/app/_components/GlobalComponents/Modals/NotesModal/CreateNoteModal.tsx
+++ b/app/_components/GlobalComponents/Modals/NotesModal/CreateNoteModal.tsx
@@ -14,6 +14,7 @@ import { Toggle } from "@/app/_components/GlobalComponents/FormElements/Toggle";
 import { PGPEncryptionModal } from "@/app/_components/GlobalComponents/Modals/EncryptionModals/PGPEncryptionModal";
 import { XChaChaEncryptionModal } from "@/app/_components/GlobalComponents/Modals/EncryptionModals/XChaChaEncryptionModal";
 import { useTranslations } from "next-intl";
+import { useToast } from "@/app/_providers/ToastProvider";
 
 const ENCRYPTION_PLACEHOLDER_CONTENT = "Note placeholder";
 
@@ -32,6 +33,7 @@ export const CreateNoteModal = ({
 }: CreateNoteModalProps) => {
   const t = useTranslations();
   const { user } = useAppMode();
+  const { showToast } = useToast();
   const [title, setTitle] = useState("");
   const [category, setCategory] = useState(initialCategory);
   const [newCategory, setNewCategory] = useState("");
@@ -47,7 +49,16 @@ export const CreateNoteModal = ({
     titleInputRef.current?.focus();
   }, []);
 
-  const _resolveCategoryPath = async (): Promise<string> => {
+  const _complain = (message: string, error?: string) => {
+    console.warn("Note creation refused:", error || message);
+    showToast({
+      type: "error",
+      title: t("common.error"),
+      message: error || message,
+    });
+  };
+
+  const _resolveCategoryPath = async (): Promise<string | null> => {
     if (showNewCategory && newCategory.trim()) {
       const newCatTrimmed = newCategory.trim();
       const categoryFormData = new FormData();
@@ -56,7 +67,11 @@ export const CreateNoteModal = ({
       if (category) {
         categoryFormData.append("parent", category);
       }
-      await createCategory(categoryFormData);
+      const made = await createCategory(categoryFormData);
+      if (!made.success) {
+        _complain(t("notes.createCategoryFailed"), made.error);
+        return null;
+      }
       return category ? `${category}/${newCatTrimmed}` : newCatTrimmed;
     }
     return category;
@@ -64,17 +79,22 @@ export const CreateNoteModal = ({
 
   const _finalizeCreate = async (rawContent: string, isEncrypted = false) => {
     const finalCategoryPath = await _resolveCategoryPath();
+    if (finalCategoryPath === null) return;
+
     const formData = new FormData();
     formData.append("title", title.trim());
     formData.append("category", finalCategoryPath);
     formData.append("rawContent", rawContent);
     const result = await createNote(formData);
-    if (result.success) {
-      const doc = result.data && isEncrypted
-        ? { ...result.data, encrypted: true }
-        : result.data;
-      onCreated(doc);
+    if (!result.success) {
+      _complain(t("notes.createNoteFailed"), result.error);
+      return;
     }
+
+    const doc = result.data && isEncrypted
+      ? { ...result.data, encrypted: true }
+      : result.data;
+    onCreated(doc);
   };
 
   const handleSubmit = async (e: React.FormEvent) => {
diff --git a/app/_components/GlobalComponents/Modals/NotesModal/EditNoteModal.tsx b/app/_components/GlobalComponents/Modals/NotesModal/EditNoteModal.tsx
index 4d7ea2a58..7b119b1e7 100644
--- a/app/_components/GlobalComponents/Modals/NotesModal/EditNoteModal.tsx
+++ b/app/_components/GlobalComponents/Modals/NotesModal/EditNoteModal.tsx
@@ -5,7 +5,7 @@ import { useRouter } from "next/navigation";
 import { Modal } from "@/app/_components/GlobalComponents/Modals/Modal";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { CategoryTreeSelector } from "@/app/_components/GlobalComponents/Dropdowns/CategoryTreeSelector";
-import { getNoteById, updateNote } from "@/app/_server/actions/note";
+import { viewNote, updateNote } from "@/app/_server/actions/note";
 import { Note, Category } from "@/app/_types";
 import { ARCHIVED_DIR_NAME } from "@/app/_consts/files";
 import { itemHref } from "@/app/_utils/global-utils";
@@ -48,7 +48,7 @@ export const EditNoteModal = ({
     const fetchNote = async () => {
       if (!user?.username || !initialNote.uuid) return;
 
-      const fetchedNote = await getNoteById(initialNote.uuid, user.username);
+      const fetchedNote = await viewNote(initialNote.uuid);
 
       if (!fetchedNote) {
         setIsMissing(true);
diff --git a/app/_consts/identity.ts b/app/_consts/identity.ts
index a0c14893c..e1cb449c9 100644
--- a/app/_consts/identity.ts
+++ b/app/_consts/identity.ts
@@ -2,3 +2,5 @@ export const UUID_REGEX =
   /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
 export const isUuid = (value: string): boolean => UUID_REGEX.test(value);
+
+export const PATH_UUID_NAMESPACE = "3170b6d3-f27c-4d18-b640-d52e20c2790a";
diff --git a/app/_hooks/kanban/useKanban.ts b/app/_hooks/kanban/useKanban.ts
index 756f1d6b1..17da11572 100644
--- a/app/_hooks/kanban/useKanban.ts
+++ b/app/_hooks/kanban/useKanban.ts
@@ -8,7 +8,7 @@ import {
   updateItemStatus,
   createBulkItems,
 } from "@/app/_server/actions/checklist-item";
-import { getListById } from "@/app/_server/actions/checklist";
+import { viewList } from "@/app/_server/actions/checklist";
 import { getUsername } from "@/app/_server/actions/users";
 import { getColumnItems } from "@/app/_utils/kanban/board-utils";
 import { useDragStore } from "@/app/_utils/dnd/drag-store";
@@ -67,10 +67,7 @@ export const useKanbanBoard = ({
   }, [dragPhase, localChecklist.uuid, localChecklist.updatedAt]);
 
   const refreshChecklist = useCallback(async () => {
-    const updatedChecklist = await getListById(
-      localChecklist.uuid || "",
-      localChecklist.owner,
-    );
+    const updatedChecklist = await viewList(localChecklist.uuid || "");
     if (updatedChecklist) {
       setLocalChecklist(updatedChecklist);
       onUpdate(updatedChecklist);
@@ -121,10 +118,7 @@ export const useKanbanBoard = ({
       username,
     );
 
-    const updatedList = await getListById(
-      localChecklist.uuid || "",
-      localChecklist.owner || username,
-    );
+    const updatedList = await viewList(localChecklist.uuid || "");
     if (updatedList) {
       setLocalChecklist(updatedList);
       onUpdate(updatedList);
diff --git a/app/_hooks/useBottomBarSpace.ts b/app/_hooks/useBottomBarSpace.ts
new file mode 100644
index 000000000..c7b38aeae
--- /dev/null
+++ b/app/_hooks/useBottomBarSpace.ts
@@ -0,0 +1,50 @@
+import { RefObject, useEffect, useRef } from "react";
+import { BottomBarSpaces } from "@/app/_types/enums";
+
+interface BottomBarSpaceOptions {
+  enabled?: boolean;
+  frozen?: boolean;
+}
+
+const occupiedSpace = (bar: HTMLElement) => {
+  if (!bar.offsetHeight) return 0;
+  if (getComputedStyle(bar).position !== "fixed") return 0;
+  return Math.max(0, window.innerHeight - bar.getBoundingClientRect().top);
+};
+
+export const useBottomBarSpace = (
+  barRef: RefObject<HTMLElement | null>,
+  space: BottomBarSpaces,
+  { enabled = true, frozen = false }: BottomBarSpaceOptions = {},
+) => {
+  const frozenRef = useRef(frozen);
+
+  useEffect(() => {
+    frozenRef.current = frozen;
+  }, [frozen]);
+
+  useEffect(() => {
+    const bar = barRef.current;
+    const root = document.documentElement;
+    if (!enabled || !bar) return;
+
+    const measure = () => {
+      if (frozenRef.current) return;
+      root.style.setProperty(space, `${Math.ceil(occupiedSpace(bar))}px`);
+    };
+
+    measure();
+
+    const observer = new ResizeObserver(measure);
+    observer.observe(bar);
+    bar.addEventListener("transitionend", measure);
+    window.addEventListener("resize", measure);
+
+    return () => {
+      observer.disconnect();
+      bar.removeEventListener("transitionend", measure);
+      window.removeEventListener("resize", measure);
+      root.style.removeProperty(space);
+    };
+  }, [barRef, space, enabled]);
+};
diff --git a/app/_hooks/useChecklist.tsx b/app/_hooks/useChecklist.tsx
index 08e95ccd1..db4ce5d8b 100644
--- a/app/_hooks/useChecklist.tsx
+++ b/app/_hooks/useChecklist.tsx
@@ -13,7 +13,7 @@ import {
 import { Checklist, ChecklistType, Item, RecurrenceRule } from "@/app/_types";
 import {
   convertChecklistType,
-  getListById,
+  viewList,
 } from "@/app/_server/actions/checklist";
 import { runListDelete } from "@/app/_hooks/lib/delete-list";
 import {
@@ -667,10 +667,7 @@ export const useChecklist = ({
     }
     const result = await createItem(localList, formData, username);
 
-    const updatedList = await getListById(
-      localList.uuid || "",
-      localList.owner || username,
-    );
+    const updatedList = await viewList(localList.uuid || "");
 
     if (updatedList) {
       setLocalList(updatedList);
diff --git a/app/_hooks/useMenuPlacement.ts b/app/_hooks/useMenuPlacement.ts
new file mode 100644
index 000000000..2f4bc4f11
--- /dev/null
+++ b/app/_hooks/useMenuPlacement.ts
@@ -0,0 +1,54 @@
+import { RefObject, useCallback, useLayoutEffect, useState } from "react";
+import {
+  MenuAlign,
+  MenuPlacement,
+  MenuSide,
+  menuBounds,
+  placeMenu,
+} from "@/app/_utils/menu-placement-utils";
+
+export const useMenuPlacement = (
+  isOpen: boolean,
+  anchorRef: RefObject<HTMLElement | null>,
+  menuRef: RefObject<HTMLElement | null>,
+  side: MenuSide = MenuSide.Down,
+  align: MenuAlign = MenuAlign.Start,
+): MenuPlacement => {
+  const [placement, setPlacement] = useState<MenuPlacement>({ side, align });
+
+  const measure = useCallback(() => {
+    const anchor = anchorRef.current;
+    const menu = menuRef.current;
+    if (!anchor || !menu) return;
+
+    const next = placeMenu(
+      anchor.getBoundingClientRect(),
+      { width: menu.offsetWidth, height: menu.offsetHeight },
+      menuBounds(anchor),
+      { side, align },
+    );
+    setPlacement((prev) =>
+      prev.side === next.side && prev.align === next.align ? prev : next,
+    );
+  }, [anchorRef, menuRef, side, align]);
+
+  useLayoutEffect(() => {
+    if (!isOpen) {
+      setPlacement({ side, align });
+      return;
+    }
+
+    measure();
+
+    const vv = window.visualViewport;
+    window.addEventListener("resize", measure);
+    vv?.addEventListener("resize", measure);
+
+    return () => {
+      window.removeEventListener("resize", measure);
+      vv?.removeEventListener("resize", measure);
+    };
+  }, [isOpen, measure, side, align]);
+
+  return placement;
+};
diff --git a/app/_hooks/useNoteEditor.tsx b/app/_hooks/useNoteEditor.tsx
index a6e2d0017..852d74ce8 100644
--- a/app/_hooks/useNoteEditor.tsx
+++ b/app/_hooks/useNoteEditor.tsx
@@ -63,12 +63,9 @@ export const useNoteEditor = ({
   const [isPrinting, setIsPrinting] = useState(false);
   const notesDefaultMode = user?.notesDefaultMode || "view";
 
-  const [isEditing, setIsEditing] = useState(() => {
-    if (note.encrypted) return false;
-    const editor = searchParams?.get("editor");
-
-    return notesDefaultMode === "edit" || editor === "true" ? true : false;
-  });
+  const [isEditing, setIsEditing] = useState(
+    () => !note.encrypted && searchParams?.get("editor") === "true"
+  );
   const [status, setStatus] = useState({
     isSaving: false,
     isAutoSaving: false,
diff --git a/app/_hooks/useReturnPath.ts b/app/_hooks/useReturnPath.ts
new file mode 100644
index 000000000..691f8adb2
--- /dev/null
+++ b/app/_hooks/useReturnPath.ts
@@ -0,0 +1,28 @@
+import { useEffect } from "react";
+import { usePathname, useSearchParams } from "next/navigation";
+import { useAppMode } from "@/app/_providers/AppModeProvider";
+import { useReturnPathStore } from "@/app/_utils/return-path-store";
+
+const ITEM_ROUTES = ["/note/", "/checklist/", "/admin/note/", "/admin/checklist/"];
+
+export const useTrackReturnPath = () => {
+  const pathname = usePathname();
+  const searchParams = useSearchParams();
+  const { mode } = useAppMode();
+  const setReturnPath = useReturnPathStore((state) => state.setReturnPath);
+
+  useEffect(() => {
+    if (!pathname || ITEM_ROUTES.some((route) => pathname.startsWith(route))) {
+      return;
+    }
+    const params = new URLSearchParams(searchParams?.toString());
+    if (pathname === "/" && !params.has("mode") && mode) {
+      params.set("mode", mode);
+    }
+    const query = params.toString();
+    setReturnPath(query ? `${pathname}?${query}` : pathname);
+  }, [pathname, searchParams, mode, setReturnPath]);
+};
+
+export const useReturnPath = (fallback: string) =>
+  useReturnPathStore((state) => state.returnPath) || fallback;
diff --git a/app/_hooks/useShortcuts.ts b/app/_hooks/useShortcuts.ts
index f9755aa35..aad829ea9 100644
--- a/app/_hooks/useShortcuts.ts
+++ b/app/_hooks/useShortcuts.ts
@@ -6,8 +6,15 @@ type Shortcut = {
   shiftKey?: boolean;
   altKey?: boolean;
   modKey?: boolean;
+  skipInEditable?: boolean;
 };
 
+const EDITABLE_TAGS = ["INPUT", "TEXTAREA", "SELECT"];
+
+const isEditableTarget = (target: EventTarget | null) =>
+  target instanceof HTMLElement &&
+  (target.isContentEditable || EDITABLE_TAGS.includes(target.tagName));
+
 export const useShortcuts = (shortcuts: Shortcut[]) => {
   useEffect(() => {
     const handleKeyDown = (event: KeyboardEvent) => {
@@ -28,6 +35,9 @@ export const useShortcuts = (shortcuts: Shortcut[]) => {
         if (s.code !== event.code) {
           return false;
         }
+        if (s.skipInEditable && isEditableTarget(event.target)) {
+          return false;
+        }
 
         return true;
       });
diff --git a/app/_hooks/useShowEmojis.ts b/app/_hooks/useShowEmojis.ts
index 15595c57a..c6878a415 100644
--- a/app/_hooks/useShowEmojis.ts
+++ b/app/_hooks/useShowEmojis.ts
@@ -1,10 +1,14 @@
 import { useSettings } from "@/app/_utils/settings-store";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 
-export const useShowEmojis = (): boolean => {
+export const useShowEmojis = (ownerChoice?: boolean): boolean => {
   const { user } = useAppMode();
   const { showEmojis: sessionShowEmojis } = useSettings();
 
+  if (ownerChoice !== undefined) {
+    return ownerChoice;
+  }
+
   if (sessionShowEmojis !== null) {
     return sessionShowEmojis;
   }
diff --git a/app/_providers/ShortcutsProvider.tsx b/app/_providers/ShortcutsProvider.tsx
index d3816a042..14639aca6 100644
--- a/app/_providers/ShortcutsProvider.tsx
+++ b/app/_providers/ShortcutsProvider.tsx
@@ -7,6 +7,8 @@ import {
   ReactNode,
   useCallback,
   useMemo,
+  useRef,
+  useTransition,
 } from "react";
 import { useShortcuts } from "@/app/_hooks/useShortcuts";
 import { CreateNoteModal } from "@/app/_components/GlobalComponents/Modals/NotesModal/CreateNoteModal";
@@ -21,6 +23,8 @@ import { useAppMode } from "./AppModeProvider";
 import { useNavigationGuard } from "./NavigationGuardProvider";
 import { createNote } from "@/app/_server/actions/note";
 import { generateDateTimeTitle } from "../_utils/date-utils";
+import { useTranslations } from "next-intl";
+import { useToast } from "./ToastProvider";
 
 interface ShortcutContextType {
   openCreateNoteModal: (initialCategory?: string) => void;
@@ -53,6 +57,10 @@ export const ShortcutProvider = ({
   const router = useRouter();
   const { mode, setMode } = useAppMode();
   const { checkNavigation } = useNavigationGuard();
+  const { showToast } = useToast();
+  const t = useTranslations();
+  const quickLock = useRef(false);
+  const [isOpeningNote, startOpeningNote] = useTransition();
 
   const [showCreateNoteModal, setShowCreateNoteModal] = useState(false);
   const [showCreateCategoryModal, setShowCreateCategoryModal] = useState(false);
@@ -65,30 +73,62 @@ export const ShortcutProvider = ({
   const [initialParentCategory, setInitialParentCategory] =
     useState<string>("");
 
-  const openCreateNoteModal = useCallback(
+  const quickCreate = useCallback(
     async (category?: string) => {
-      if (user?.quickCreateNotes === "enable") {
-        const title = generateDateTimeTitle();
-        const defaultCategory =
-          category || user?.quickCreateNotesCategory || "";
+      if (quickLock.current || isOpeningNote) return;
+      quickLock.current = true;
 
+      try {
         const formData = new FormData();
-        formData.append("title", title);
-        formData.append("category", defaultCategory);
-        formData.append("content", "");
+        formData.append("title", generateDateTimeTitle());
+        formData.append(
+          "category",
+          category || user?.quickCreateNotesCategory || ""
+        );
+        formData.append("rawContent", "");
 
         const result = await createNote(formData);
 
-        if (result.success && result.data?.uuid) {
-          router.push(`${itemHref(ItemTypes.NOTE, result.data.uuid)}?editor=true`);
-          router.refresh();
+        if (!result.success || !result.data?.uuid) {
+          console.warn("Quick create refused:", result.error);
+          showToast({
+            type: "error",
+            title: t("common.error"),
+            message: result.error || t("notes.createNoteFailed"),
+          });
+          return;
         }
-      } else {
-        setInitialCategory(category || "");
-        setShowCreateNoteModal(true);
+
+        const href = itemHref(ItemTypes.NOTE, result.data.uuid);
+        startOpeningNote(() => {
+          router.push(`${href}?editor=true`);
+          router.refresh();
+        });
+      } catch (error) {
+        console.error("Quick create failed:", error);
+        showToast({
+          type: "error",
+          title: t("common.error"),
+          message: t("notes.createNoteFailed"),
+        });
+      } finally {
+        quickLock.current = false;
+      }
+    },
+    [user?.quickCreateNotesCategory, isOpeningNote, router, showToast, t]
+  );
+
+  const openCreateNoteModal = useCallback(
+    (category?: string) => {
+      if (user?.quickCreateNotes === "enable") {
+        checkNavigation(() => quickCreate(category));
+        return;
       }
+
+      setInitialCategory(category || "");
+      setShowCreateNoteModal(true);
     },
-    [user?.quickCreateNotes, user?.quickCreateNotesCategory, router]
+    [user?.quickCreateNotes, checkNavigation, quickCreate]
   );
 
   const openCreateChecklistModal = useCallback((category?: string) => {
@@ -112,14 +152,14 @@ export const ShortcutProvider = ({
   const shortcuts = useMemo(
     () => [
       {
-        code: "ArrowLeft01Icon",
+        code: "ArrowLeft",
         modKey: true,
         altKey: true,
         shiftKey: true,
         handler: () =>
           checkNavigation(() => {
             setMode(Modes.CHECKLISTS);
-            router.push("/");
+            router.push(`/?mode=${Modes.CHECKLISTS}`);
           }),
       },
       {
@@ -130,7 +170,7 @@ export const ShortcutProvider = ({
         handler: () =>
           checkNavigation(() => {
             setMode(Modes.NOTES);
-            router.push("/");
+            router.push(`/?mode=${Modes.NOTES}`);
           }),
       },
       {
diff --git a/app/_server/actions/archived/index.ts b/app/_server/actions/archived/index.ts
index a3408d260..c3e2b6049 100644
--- a/app/_server/actions/archived/index.ts
+++ b/app/_server/actions/archived/index.ts
@@ -1,8 +1,8 @@
 "use server";
 
 import { Checklist, Note, ItemType } from "@/app/_types";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
-import { getUserNotes } from "@/app/_server/actions/note";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
 import { ARCHIVED_DIR_NAME } from "@/app/_consts/files";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { ItemTypes } from "@/app/_types/enums";
diff --git a/app/_server/actions/category/crud.ts b/app/_server/actions/category/crud.ts
index 1528d57cd..f36421e87 100644
--- a/app/_server/actions/category/crud.ts
+++ b/app/_server/actions/category/crud.ts
@@ -21,6 +21,7 @@ import {
 } from "@/app/_server/actions/share/target";
 import { catUuid } from "@/app/_server/actions/share/category-info";
 import { PermissionTypes } from "@/app/_types/enums";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 
 const _mountTarget = async (mode: Modes, category: string) => {
   const username = await getUsername();
@@ -146,7 +147,7 @@ export const createCategory = async (formData: FormData) => {
       errorMessage: "Failed to create category",
       metadata: { categoryName: name },
     });
-    return { error: "Failed to create category" };
+    return { error: await failedWith(error, "Failed to create category") };
   }
 };
 
@@ -224,7 +225,7 @@ export const deleteCategory = async (formData: FormData) => {
       errorMessage: "Failed to delete category",
       metadata: { categoryPath },
     });
-    return { error: "Failed to delete category" };
+    return { error: await failedWith(error, "Failed to delete category") };
   }
 };
 
@@ -374,6 +375,6 @@ export const renameCategory = async (formData: FormData) => {
       errorMessage: "Failed to rename category",
       metadata: { oldPath },
     });
-    return { error: "Failed to rename category" };
+    return { error: await failedWith(error, "Failed to rename category") };
   }
 };
diff --git a/app/_server/actions/checklist-item/archive.ts b/app/_server/actions/checklist-item/archive.ts
index 1e6a2585c..b699c7ebc 100644
--- a/app/_server/actions/checklist-item/archive.ts
+++ b/app/_server/actions/checklist-item/archive.ts
@@ -6,9 +6,7 @@ import {
   serverWriteFile,
   ensureDir,
 } from "@/app/_server/actions/file";
-import {
-  getListById,
-} from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { getUsername } from "@/app/_server/actions/users";
 import { Checklist, Result } from "@/app/_types";
@@ -20,8 +18,9 @@ import {
 import { canReach } from "@/app/_server/actions/share/queries";
 import { diskPath } from "@/app/_server/actions/share/target";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
-export const archiveItem = async (
+const _archiveItem = async (
   formData: FormData
 ): Promise<Result<Checklist>> => {
   try {
@@ -103,7 +102,7 @@ export const archiveItem = async (
   }
 };
 
-export const unarchiveItem = async (
+const _unarchiveItem = async (
   formData: FormData
 ): Promise<Result<Checklist>> => {
   try {
@@ -188,3 +187,13 @@ export const unarchiveItem = async (
     return { success: false, error: "Failed to unarchive item" };
   }
 };
+
+export const archiveItem = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _archiveItem(formData),
+  );
+
+export const unarchiveItem = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _unarchiveItem(formData),
+  );
diff --git a/app/_server/actions/checklist-item/bulk-operations.ts b/app/_server/actions/checklist-item/bulk-operations.ts
index 28520706b..dc539c4e1 100644
--- a/app/_server/actions/checklist-item/bulk-operations.ts
+++ b/app/_server/actions/checklist-item/bulk-operations.ts
@@ -6,9 +6,7 @@ import {
   getUserModeDir,
   serverWriteFile,
 } from "@/app/_server/actions/file";
-import {
-  getListById,
-} from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import {
   listToMarkdown,
   areAllItemsCompleted
@@ -26,8 +24,10 @@ import {
 import { canReach } from "@/app/_server/actions/share/queries";
 import { diskPath } from "@/app/_server/actions/share/target";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
 
-export const createBulkItems = async (
+const _createBulkItems = async (
   formData: FormData
 ): Promise<Result<Checklist>> => {
   try {
@@ -119,7 +119,7 @@ export const createBulkItems = async (
   }
 };
 
-export const bulkToggleItems = async (
+const _bulkToggleItems = async (
   formData: FormData
 ): Promise<Result<Checklist>> => {
   try {
@@ -127,12 +127,14 @@ export const bulkToggleItems = async (
     const completed = formData.get("completed") === "true";
     const itemIdsStr = formData.get("itemIds") as string;
     const completedStatesStr = formData.get("completedStates") as string;
-    let currentUser = formData.get("username") as string;
+    const actor = await sessionActor(formData.get("username") as string | null);
 
-    if (!currentUser) {
-      currentUser = await getUsername();
+    if ("error" in actor) {
+      return { success: false, error: actor.error };
     }
 
+    const currentUser = actor.username;
+
     if (!uuid || !itemIdsStr) {
       return { success: false, error: "List uuid and item IDs are required" };
     }
@@ -287,19 +289,21 @@ export const bulkToggleItems = async (
   }
 };
 
-export const bulkDeleteItems = async (
+const _bulkDeleteItems = async (
   formData: FormData
 ): Promise<Result<Checklist>> => {
   try {
     const uuid = formData.get("uuid") as string;
     const itemIdsStr = formData.get("itemIds") as string;
     const itemIdsToDelete = JSON.parse(itemIdsStr) as string[];
-    let currentUser = formData.get("username") as string;
+    const actor = await sessionActor(formData.get("username") as string | null);
 
-    if (!currentUser) {
-      currentUser = await getUsername();
+    if ("error" in actor) {
+      return { success: false, error: actor.error };
     }
 
+    const currentUser = actor.username;
+
     if (!uuid || !itemIdsToDelete || itemIdsToDelete.length === 0) {
       return { success: true };
     }
@@ -376,3 +380,18 @@ export const bulkDeleteItems = async (
     return { success: false, error: "Failed to bulk delete items" };
   }
 };
+
+export const createBulkItems = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _createBulkItems(formData),
+  );
+
+export const bulkToggleItems = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _bulkToggleItems(formData),
+  );
+
+export const bulkDeleteItems = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _bulkDeleteItems(formData),
+  );
diff --git a/app/_server/actions/checklist-item/crud.ts b/app/_server/actions/checklist-item/crud.ts
index e07690c4b..0f14f16de 100644
--- a/app/_server/actions/checklist-item/crud.ts
+++ b/app/_server/actions/checklist-item/crud.ts
@@ -1,375 +1,33 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import path from "path";
-import {
-  serverWriteFile,
-  ensureDir,
-} from "@/app/_server/actions/file";
-import { getListById } from "@/app/_server/actions/checklist";
-import {
-  listToMarkdown,
-  areAllItemsCompleted,
-} from "@/app/_utils/checklist-utils";
-import {
-  extractHashtagsFromContent,
-  normalizeTag,
-} from "@/app/_utils/tag-utils";
-import { isAdmin, getUsername } from "@/app/_server/actions/users";
-import { findUserRecord } from "@/app/_server/actions/users/records";
-import { Checklist, Item, KanbanPriority, Result } from "@/app/_types";
-import {
-  ItemTypes,
-  Modes,
-  NotificationTargets,
-  PermissionTypes,
-  TaskStatus,
-} from "@/app/_types/enums";
-import { canReach, reachableFile } from "@/app/_server/actions/share/queries";
+import { serverWriteFile } from "@/app/_server/actions/file";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { areAllItemsCompleted, listToMarkdown } from "@/app/_utils/checklist-utils";
+import { getUsername } from "@/app/_server/actions/users";
+import { Checklist, Item, Result } from "@/app/_types";
+import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import { canReach } from "@/app/_server/actions/share/queries";
 import { diskPath } from "@/app/_server/actions/share/target";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { updateAllChildren, findItem } from "@/app/_utils/item-tree-utils";
-import { isKanbanType } from "@/app/_types/enums";
-import { notifyUser } from "@/app/_server/actions/notifications/internal";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
+import { addItem, editItem } from "./editor";
 
-export const updateItem = async (
-  checklist: Checklist,
+const _deleteItem = async (
   formData: FormData,
-  username?: string,
-  skipRevalidation = false,
 ): Promise<Result<Checklist>> => {
   try {
+    const uuid = formData.get("uuid") as string;
     const itemId = formData.get("itemId") as string;
-    const completedRaw = formData.get("completed");
-    const text = formData.get("text") as string;
-    const description = formData.get("description") as string;
-
-    const currentUser = (await getUsername()) || username;
-
-    if (!currentUser) {
-      throw new Error("Not authenticated");
-    }
-
-    const filePath = await reachableFile(
-      checklist.uuid,
-      ItemTypes.CHECKLIST,
-      currentUser,
-      PermissionTypes.EDIT,
-    );
-
-    if (!filePath) {
-      throw new Error("Permission denied");
-    }
-
-    const stored = await getListById(checklist.uuid, currentUser);
-
-    if (!stored) {
-      throw new Error("List not found");
-    }
-
-    const _updateParentBasedOnChildren = (parent: Item): Item => {
-      if ((parent.children || []).length < 1) return parent;
-      return { ...parent, completed: areAllItemsCompleted(parent.children!) };
-    };
-
-    const _findAndUpdateItem = (items: Item[], itemId: string, updates: Partial<Item>): Item[] =>
-      items.map((item) => {
-        if (item.id === itemId) {
-          let updatedItem = { ...item, ...updates };
-          if (updates.completed && item.children && item.children.length > 0) {
-            updatedItem.children = updateAllChildren(item.children, true);
-          } else if (updates.completed === false && item.children && item.children.length > 0) {
-            updatedItem.children = updateAllChildren(item.children, false);
-          }
-          return updatedItem;
-        }
-        if (item.children && item.children.length > 0) {
-          return _updateParentBasedOnChildren({
-            ...item,
-            children: _findAndUpdateItem(item.children, itemId, updates),
-          });
-        }
-        return item;
-      });
-
-    const now = new Date().toISOString();
-
-    const textInlineTags = text ? extractHashtagsFromContent(text) : [];
-    const existingTags = stored.tags || [];
-    const mergedTags = text
-      ? Array.from(
-        new Set([...existingTags.map(normalizeTag), ...textInlineTags]),
-      ).filter(Boolean)
-      : existingTags;
-
-    const priority = formData.get("priority") as string | null;
-    const score = formData.get("score") as string | null;
-    const assignee = formData.get("assignee") as string | null;
-    const reminder = formData.get("reminder") as string | null;
-    const targetDate = formData.get("targetDate") as string | null;
-    const startDate = formData.get("startDate") as string | null;
-    const estimatedTime = formData.get("estimatedTime") as string | null;
-
-    const updatedList = {
-      ...stored,
-      items: _findAndUpdateItem(stored.items, itemId, {
-        ...(completedRaw !== null && { completed: completedRaw === "true" }),
-        ...(text && { text }),
-        ...(description !== null &&
-          description !== undefined && { description }),
-        ...(priority !== null && { priority: (priority || undefined) as KanbanPriority | undefined }),
-        ...(score !== null && { score: score ? parseInt(score) : undefined }),
-        ...(assignee !== null && { assignee: assignee || undefined }),
-        ...(reminder !== null && {
-          reminder: reminder ? JSON.parse(reminder) : undefined,
-        }),
-        ...(targetDate !== null && { targetDate: targetDate || undefined }),
-        ...(startDate !== null && { startDate: startDate || undefined }),
-        ...(estimatedTime !== null && { estimatedTime: estimatedTime ? parseFloat(estimatedTime) : undefined }),
-        lastModifiedBy: currentUser,
-        lastModifiedAt: now,
-      }),
-      tags: mergedTags,
-      updatedAt: now,
-    };
-
-    await ensureDir(path.dirname(filePath));
-
-    await serverWriteFile(filePath, listToMarkdown(updatedList));
-
-    if (!skipRevalidation) {
-      try {
-        revalidatePath("/");
-        revalidatePath(`/checklist/${stored.uuid}`);
-      } catch (error) {
-        console.warn(
-          "Cache revalidation failed, but data was saved successfully:",
-          error,
-        );
-      }
-    }
-
-    if (assignee && assignee !== currentUser) {
-      const assignedItem = findItem(updatedList.items, itemId);
-      try {
-        await notifyUser(assignee, {
-          type: "assignment",
-          title: assignedItem?.text || "New task assigned",
-          message: `${currentUser} assigned you to a task in "${stored.title}"`,
-          data: {
-            itemId: stored.uuid,
-            itemType: NotificationTargets.CHECKLIST,
-            taskId: itemId,
-          },
-        });
-      } catch (error) {
-        console.warn("[checklist-item] assignment notification failed:", error);
-      }
-    }
-
-    await broadcast({
-      type: "checklist",
-      action: "updated",
-      entityId: stored.uuid,
-      username: currentUser,
-    });
-
-    return { success: true, data: updatedList as Checklist };
-  } catch (error) {
-    console.error(
-      "Error updating item:",
-      error instanceof Error ? error.stack : "No stack trace",
-    );
-    console.error(
-      "Error updating item:",
-      error instanceof Error ? error.message : String(error),
-    );
-    return { success: false, error: "Failed to update item" };
-  }
-};
 
-export const createItem = async (
-  list: Checklist,
-  formData: FormData,
-  username?: string,
-  skipRevalidation = false,
-) => {
-  try {
-    const text = formData.get("text") as string;
-    const status = formData.get("status") as string;
-    const timeStr = formData.get("time") as string;
-    const description = formData.get("description") as string;
-    const currentUser = (await getUsername()) || username;
-    const recurrenceStr = formData.get("recurrence") as string;
+    const currentUser = await getUsername();
 
     if (!currentUser) {
       throw new Error("Not authenticated");
     }
 
-    const filePath = await reachableFile(
-      list.uuid,
-      ItemTypes.CHECKLIST,
-      currentUser,
-      PermissionTypes.EDIT,
-    );
-
-    if (!filePath) {
-      throw new Error("Permission denied");
-    }
-
-    const stored = await getListById(list.uuid, currentUser);
-
-    if (!stored) {
-      throw new Error("List not found");
-    }
-
-    let timeEntries: any[] = [];
-    if (timeStr && timeStr !== "0") {
-      try {
-        timeEntries = JSON.parse(timeStr);
-      } catch (e) {
-        console.error("Failed to parse time entries:", e);
-        timeEntries = [];
-      }
-    }
-
-    const now = new Date().toISOString();
-
-    let recurrence = undefined;
-    if (recurrenceStr) {
-      try {
-        recurrence = JSON.parse(recurrenceStr);
-
-        if (recurrence && !recurrence.nextDue) {
-          const { calculateNextOccurrence } =
-            await import("@/app/_utils/recurrence-utils");
-          recurrence.nextDue = calculateNextOccurrence(
-            recurrence.rrule,
-            recurrence.dtstart,
-          );
-        }
-      } catch (e) {
-        console.error("Failed to parse recurrence:", e);
-        recurrence = undefined;
-      }
-    }
-
-    const getDefaultStatus = (): TaskStatus => {
-      if (status) return status as TaskStatus;
-
-      if (stored.statuses && stored.statuses.length > 0) {
-        const sortedStatuses = [...stored.statuses].sort(
-          (a, b) => a.order - b.order,
-        );
-        return sortedStatuses[0].id as TaskStatus;
-      }
-
-      return TaskStatus.TODO;
-    };
-
-    const defaultStatus = isKanbanType(stored.type)
-      ? getDefaultStatus()
-      : undefined;
-
-    let isSharedBoard = false;
-    if (isKanbanType(stored.type)) {
-      const { usersWithAccess } = await import("@/app/_server/actions/share/queries");
-      const sharedUsers = await usersWithAccess(stored.uuid);
-      isSharedBoard = sharedUsers.length > 0;
-    }
-
-    const shiftedItems = stored.items.map((item) => ({
-      ...item,
-      order: item.order + 1,
-    }));
-
-    const userRecord = await findUserRecord(currentUser);
-    const insertAtBottom = userRecord?.newItemInsertion === "bottom";
-
-    const newItem = {
-      id: `${stored.uuid}-${Date.now()}`,
-      text,
-      completed: false,
-      order: insertAtBottom
-        ? stored.items.reduce((max, item) => Math.max(max, item.order ?? 0), -1) + 1
-        : 0,
-      description: description || undefined,
-      createdBy: currentUser,
-      createdAt: now,
-      lastModifiedBy: currentUser,
-      lastModifiedAt: now,
-      ...(isKanbanType(stored.type) &&
-        defaultStatus && {
-        status: defaultStatus,
-        timeEntries,
-        history: [
-          {
-            status: defaultStatus,
-            timestamp: now,
-            user: currentUser,
-          },
-        ],
-      }),
-      ...(isSharedBoard && { assignee: currentUser }),
-      ...(recurrence && { recurrence }),
-    };
-
-    const inlineTags = extractHashtagsFromContent(text);
-    const existingTags = stored.tags || [];
-    const mergedTags = Array.from(
-      new Set([...existingTags.map(normalizeTag), ...inlineTags]),
-    ).filter(Boolean);
-
-    const updatedList = {
-      ...stored,
-      items: insertAtBottom
-        ? [...stored.items, newItem]
-        : [newItem, ...shiftedItems],
-      tags: mergedTags,
-      updatedAt: new Date().toISOString(),
-    };
-
-    await ensureDir(path.dirname(filePath));
-
-    await serverWriteFile(filePath, listToMarkdown(updatedList as Checklist));
-
-    if (!skipRevalidation) {
-      try {
-        revalidatePath("/");
-        revalidatePath(`/checklist/${stored.uuid}`);
-      } catch (error) {
-        console.warn(
-          "Cache revalidation failed, but data was saved successfully:",
-          error,
-        );
-      }
-    }
-
-    await broadcast({
-      type: "checklist",
-      action: "updated",
-      entityId: stored.uuid,
-      username: currentUser,
-    });
-
-    return { success: true, data: newItem };
-  } catch (error) {
-    console.error(
-      "Error creating item:",
-      error instanceof Error ? error.stack : "No stack trace",
-    );
-    return { success: false, error: "Failed to create item" };
-  }
-};
-
-export const deleteItem = async (
-  formData: FormData,
-): Promise<Result<Checklist>> => {
-  try {
-    const uuid = formData.get("uuid") as string;
-    const itemId = formData.get("itemId") as string;
-
-    const currentUser = await getUsername();
     const list = await getListById(uuid, currentUser);
     if (!list) {
       throw new Error("List not found");
@@ -449,6 +107,42 @@ export const deleteItem = async (
 
     return { success: true, data: updatedList as Checklist };
   } catch (error) {
-    return { success: false, error: "Failed to delete item" };
+    console.error("Error deleting item:", error);
+    return { success: false, error: await failedWith(error, "Failed to delete item") };
+  }
+};
+
+export const updateItem = async (
+  checklist: Checklist,
+  formData: FormData,
+  username?: string,
+  skipRevalidation = false,
+): Promise<Result<Checklist>> => {
+  const actor = await sessionActor(username);
+
+  if ("error" in actor) {
+    return { success: false, error: actor.error };
+  }
+
+  return editItem(actor, checklist, formData, skipRevalidation);
+};
+
+export const createItem = async (
+  list: Checklist,
+  formData: FormData,
+  username?: string,
+  skipRevalidation = false,
+): Promise<Result<Item>> => {
+  const actor = await sessionActor(username);
+
+  if ("error" in actor) {
+    return { success: false, error: actor.error };
   }
+
+  return addItem(actor, list, formData, skipRevalidation);
 };
+
+export const deleteItem = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _deleteItem(formData),
+  );
diff --git a/app/_server/actions/checklist-item/drop.ts b/app/_server/actions/checklist-item/drop.ts
index 612a62c82..430de9841 100644
--- a/app/_server/actions/checklist-item/drop.ts
+++ b/app/_server/actions/checklist-item/drop.ts
@@ -3,7 +3,7 @@
 import { revalidatePath } from "next/cache";
 import path from "path";
 import { serverWriteFile, ensureDir } from "@/app/_server/actions/file";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { getUsername } from "@/app/_server/actions/users";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { diskPath } from "@/app/_server/actions/share/target";
@@ -13,8 +13,9 @@ import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { DEFAULT_KANBAN_STATUSES } from "@/app/_consts/kanban";
 import { Checklist, Result } from "@/app/_types";
 import { ItemTypes, PermissionTypes, Modes } from "@/app/_types/enums";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
-export const dropItem = async (
+const _dropItem = async (
   formData: FormData,
 ): Promise<Result<Checklist>> => {
   try {
@@ -111,3 +112,8 @@ export const dropItem = async (
     return { success: false, error: "Failed to drop item" };
   }
 };
+
+export const dropItem = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _dropItem(formData),
+  );
diff --git a/app/_server/actions/checklist-item/editor.ts b/app/_server/actions/checklist-item/editor.ts
new file mode 100644
index 000000000..ea2c3d99a
--- /dev/null
+++ b/app/_server/actions/checklist-item/editor.ts
@@ -0,0 +1,387 @@
+import { revalidatePath } from "next/cache";
+import path from "path";
+import {
+  serverWriteFile,
+  ensureDir,
+} from "@/app/_server/actions/file";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import {
+  listToMarkdown,
+  areAllItemsCompleted,
+} from "@/app/_utils/checklist-utils";
+import {
+  extractHashtagsFromContent,
+  normalizeTag,
+} from "@/app/_utils/tag-utils";
+import { findUserRecord } from "@/app/_server/actions/users/records";
+import {
+  Checklist,
+  Item,
+  KanbanPriority,
+  Result,
+  SanitisedUser,
+} from "@/app/_types";
+import {
+  ItemTypes,
+  Modes,
+  NotificationTargets,
+  PermissionTypes,
+  TaskStatus,
+} from "@/app/_types/enums";
+import { reachableFile } from "@/app/_server/actions/share/queries";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { updateAllChildren, findItem } from "@/app/_utils/item-tree-utils";
+import { isKanbanType } from "@/app/_types/enums";
+import { notifyUser } from "@/app/_server/actions/notifications/internal";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+
+const _editItem = async (
+  actor: SanitisedUser,
+  checklist: Checklist,
+  formData: FormData,
+  skipRevalidation: boolean,
+): Promise<Result<Checklist>> => {
+  try {
+    const itemId = formData.get("itemId") as string;
+    const completedRaw = formData.get("completed");
+    const text = formData.get("text") as string;
+    const description = formData.get("description") as string;
+
+    const currentUser = actor?.username;
+
+    if (!currentUser) {
+      throw new Error("Not authenticated");
+    }
+
+    const filePath = await reachableFile(
+      checklist.uuid,
+      ItemTypes.CHECKLIST,
+      currentUser,
+      PermissionTypes.EDIT,
+    );
+
+    if (!filePath) {
+      throw new Error("Permission denied");
+    }
+
+    const stored = await getListById(checklist.uuid, currentUser);
+
+    if (!stored) {
+      throw new Error("List not found");
+    }
+
+    const _updateParentBasedOnChildren = (parent: Item): Item => {
+      if ((parent.children || []).length < 1) return parent;
+      return { ...parent, completed: areAllItemsCompleted(parent.children!) };
+    };
+
+    const _findAndUpdateItem = (items: Item[], itemId: string, updates: Partial<Item>): Item[] =>
+      items.map((item) => {
+        if (item.id === itemId) {
+          let updatedItem = { ...item, ...updates };
+          if (updates.completed && item.children && item.children.length > 0) {
+            updatedItem.children = updateAllChildren(item.children, true);
+          } else if (updates.completed === false && item.children && item.children.length > 0) {
+            updatedItem.children = updateAllChildren(item.children, false);
+          }
+          return updatedItem;
+        }
+        if (item.children && item.children.length > 0) {
+          return _updateParentBasedOnChildren({
+            ...item,
+            children: _findAndUpdateItem(item.children, itemId, updates),
+          });
+        }
+        return item;
+      });
+
+    const now = new Date().toISOString();
+
+    const textInlineTags = text ? extractHashtagsFromContent(text) : [];
+    const existingTags = stored.tags || [];
+    const mergedTags = text
+      ? Array.from(
+        new Set([...existingTags.map(normalizeTag), ...textInlineTags]),
+      ).filter(Boolean)
+      : existingTags;
+
+    const priority = formData.get("priority") as string | null;
+    const score = formData.get("score") as string | null;
+    const assignee = formData.get("assignee") as string | null;
+    const reminder = formData.get("reminder") as string | null;
+    const targetDate = formData.get("targetDate") as string | null;
+    const startDate = formData.get("startDate") as string | null;
+    const estimatedTime = formData.get("estimatedTime") as string | null;
+
+    const updatedList = {
+      ...stored,
+      items: _findAndUpdateItem(stored.items, itemId, {
+        ...(completedRaw !== null && { completed: completedRaw === "true" }),
+        ...(text && { text }),
+        ...(description !== null &&
+          description !== undefined && { description }),
+        ...(priority !== null && { priority: (priority || undefined) as KanbanPriority | undefined }),
+        ...(score !== null && { score: score ? parseInt(score) : undefined }),
+        ...(assignee !== null && { assignee: assignee || undefined }),
+        ...(reminder !== null && {
+          reminder: reminder ? JSON.parse(reminder) : undefined,
+        }),
+        ...(targetDate !== null && { targetDate: targetDate || undefined }),
+        ...(startDate !== null && { startDate: startDate || undefined }),
+        ...(estimatedTime !== null && { estimatedTime: estimatedTime ? parseFloat(estimatedTime) : undefined }),
+        lastModifiedBy: currentUser,
+        lastModifiedAt: now,
+      }),
+      tags: mergedTags,
+      updatedAt: now,
+    };
+
+    await ensureDir(path.dirname(filePath));
+
+    await serverWriteFile(filePath, listToMarkdown(updatedList));
+
+    if (!skipRevalidation) {
+      try {
+        revalidatePath("/");
+        revalidatePath(`/checklist/${stored.uuid}`);
+      } catch (error) {
+        console.warn(
+          "Cache revalidation failed, but data was saved successfully:",
+          error,
+        );
+      }
+    }
+
+    if (assignee && assignee !== currentUser) {
+      const assignedItem = findItem(updatedList.items, itemId);
+      try {
+        await notifyUser(assignee, {
+          type: "assignment",
+          title: assignedItem?.text || "New task assigned",
+          message: `${currentUser} assigned you to a task in "${stored.title}"`,
+          data: {
+            itemId: stored.uuid,
+            itemType: NotificationTargets.CHECKLIST,
+            taskId: itemId,
+          },
+        });
+      } catch (error) {
+        console.warn("[checklist-item] assignment notification failed:", error);
+      }
+    }
+
+    await broadcast({
+      type: "checklist",
+      action: "updated",
+      entityId: stored.uuid,
+      username: currentUser,
+    });
+
+    return { success: true, data: updatedList as Checklist };
+  } catch (error) {
+    console.error(
+      "Error updating item:",
+      error instanceof Error ? error.stack : "No stack trace",
+    );
+    console.error(
+      "Error updating item:",
+      error instanceof Error ? error.message : String(error),
+    );
+    return { success: false, error: await failedWith(error, "Failed to update item") };
+  }
+};
+
+const _addItem = async (
+  actor: SanitisedUser,
+  list: Checklist,
+  formData: FormData,
+  skipRevalidation: boolean,
+) => {
+  try {
+    const text = formData.get("text") as string;
+    const status = formData.get("status") as string;
+    const timeStr = formData.get("time") as string;
+    const description = formData.get("description") as string;
+    const currentUser = actor?.username;
+    const recurrenceStr = formData.get("recurrence") as string;
+
+    if (!currentUser) {
+      throw new Error("Not authenticated");
+    }
+
+    const filePath = await reachableFile(
+      list.uuid,
+      ItemTypes.CHECKLIST,
+      currentUser,
+      PermissionTypes.EDIT,
+    );
+
+    if (!filePath) {
+      throw new Error("Permission denied");
+    }
+
+    const stored = await getListById(list.uuid, currentUser);
+
+    if (!stored) {
+      throw new Error("List not found");
+    }
+
+    let timeEntries: any[] = [];
+    if (timeStr && timeStr !== "0") {
+      try {
+        timeEntries = JSON.parse(timeStr);
+      } catch (e) {
+        console.error("Failed to parse time entries:", e);
+        timeEntries = [];
+      }
+    }
+
+    const now = new Date().toISOString();
+
+    let recurrence = undefined;
+    if (recurrenceStr) {
+      try {
+        recurrence = JSON.parse(recurrenceStr);
+
+        if (recurrence && !recurrence.nextDue) {
+          const { calculateNextOccurrence } =
+            await import("@/app/_utils/recurrence-utils");
+          recurrence.nextDue = calculateNextOccurrence(
+            recurrence.rrule,
+            recurrence.dtstart,
+          );
+        }
+      } catch (e) {
+        console.error("Failed to parse recurrence:", e);
+        recurrence = undefined;
+      }
+    }
+
+    const getDefaultStatus = (): TaskStatus => {
+      if (status) return status as TaskStatus;
+
+      if (stored.statuses && stored.statuses.length > 0) {
+        const sortedStatuses = [...stored.statuses].sort(
+          (a, b) => a.order - b.order,
+        );
+        return sortedStatuses[0].id as TaskStatus;
+      }
+
+      return TaskStatus.TODO;
+    };
+
+    const defaultStatus = isKanbanType(stored.type)
+      ? getDefaultStatus()
+      : undefined;
+
+    let isSharedBoard = false;
+    if (isKanbanType(stored.type)) {
+      const { usersWithAccess } = await import("@/app/_server/actions/share/queries");
+      const sharedUsers = await usersWithAccess(stored.uuid);
+      isSharedBoard = sharedUsers.length > 0;
+    }
+
+    const shiftedItems = stored.items.map((item) => ({
+      ...item,
+      order: item.order + 1,
+    }));
+
+    const userRecord = await findUserRecord(currentUser);
+    const insertAtBottom = userRecord?.newItemInsertion === "bottom";
+
+    const newItem = {
+      id: `${stored.uuid}-${Date.now()}`,
+      text,
+      completed: false,
+      order: insertAtBottom
+        ? stored.items.reduce((max, item) => Math.max(max, item.order ?? 0), -1) + 1
+        : 0,
+      description: description || undefined,
+      createdBy: currentUser,
+      createdAt: now,
+      lastModifiedBy: currentUser,
+      lastModifiedAt: now,
+      ...(isKanbanType(stored.type) &&
+        defaultStatus && {
+        status: defaultStatus,
+        timeEntries,
+        history: [
+          {
+            status: defaultStatus,
+            timestamp: now,
+            user: currentUser,
+          },
+        ],
+      }),
+      ...(isSharedBoard && { assignee: currentUser }),
+      ...(recurrence && { recurrence }),
+    };
+
+    const inlineTags = extractHashtagsFromContent(text);
+    const existingTags = stored.tags || [];
+    const mergedTags = Array.from(
+      new Set([...existingTags.map(normalizeTag), ...inlineTags]),
+    ).filter(Boolean);
+
+    const updatedList = {
+      ...stored,
+      items: insertAtBottom
+        ? [...stored.items, newItem]
+        : [newItem, ...shiftedItems],
+      tags: mergedTags,
+      updatedAt: new Date().toISOString(),
+    };
+
+    await ensureDir(path.dirname(filePath));
+
+    await serverWriteFile(filePath, listToMarkdown(updatedList as Checklist));
+
+    if (!skipRevalidation) {
+      try {
+        revalidatePath("/");
+        revalidatePath(`/checklist/${stored.uuid}`);
+      } catch (error) {
+        console.warn(
+          "Cache revalidation failed, but data was saved successfully:",
+          error,
+        );
+      }
+    }
+
+    await broadcast({
+      type: "checklist",
+      action: "updated",
+      entityId: stored.uuid,
+      username: currentUser,
+    });
+
+    return { success: true, data: newItem };
+  } catch (error) {
+    console.error(
+      "Error creating item:",
+      error instanceof Error ? error.stack : "No stack trace",
+    );
+    return { success: false, error: await failedWith(error, "Failed to create item") };
+  }
+};
+
+export const editItem = async (
+  actor: SanitisedUser,
+  checklist: Checklist,
+  formData: FormData,
+  skipRevalidation = false,
+) =>
+  runQueued(itemLane(Modes.CHECKLISTS, checklist.uuid), () =>
+    _editItem(actor, checklist, formData, skipRevalidation),
+  );
+
+export const addItem = async (
+  actor: SanitisedUser,
+  list: Checklist,
+  formData: FormData,
+  skipRevalidation = false,
+) =>
+  runQueued(itemLane(Modes.CHECKLISTS, list.uuid), () =>
+    _addItem(actor, list, formData, skipRevalidation),
+  );
diff --git a/app/_server/actions/checklist-item/reorder.ts b/app/_server/actions/checklist-item/reorder.ts
index 052578bd8..55e90beca 100644
--- a/app/_server/actions/checklist-item/reorder.ts
+++ b/app/_server/actions/checklist-item/reorder.ts
@@ -6,15 +6,16 @@ import {
   serverWriteFile,
   ensureDir,
 } from "@/app/_server/actions/file";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { getUsername } from "@/app/_server/actions/users";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { diskPath } from "@/app/_server/actions/share/target";
 import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
-export const reorderItems = async (formData: FormData) => {
+const _reorderItems = async (formData: FormData) => {
   try {
     const uuid = formData.get("uuid") as string;
     const activeItemId = formData.get("activeItemId") as string;
@@ -168,3 +169,8 @@ export const reorderItems = async (formData: FormData) => {
     return { success: false, error: "Failed to reorder items" };
   }
 };
+
+export const reorderItems = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _reorderItems(formData),
+  );
diff --git a/app/_server/actions/checklist-item/stamper.ts b/app/_server/actions/checklist-item/stamper.ts
new file mode 100644
index 000000000..b3d8fc1ca
--- /dev/null
+++ b/app/_server/actions/checklist-item/stamper.ts
@@ -0,0 +1,140 @@
+import { revalidatePath } from "next/cache";
+import path from "path";
+import {
+  serverWriteFile,
+  ensureDir,
+} from "@/app/_server/actions/file";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { listToMarkdown } from "@/app/_utils/checklist-utils";
+import { Checklist, Result, SanitisedUser, TimeEntry } from "@/app/_types";
+import {
+  ItemTypes,
+  PermissionTypes,
+  Modes,
+} from "@/app/_types/enums";
+import { canReach } from "@/app/_server/actions/share/queries";
+import { diskPath } from "@/app/_server/actions/share/target";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { updateItem } from "@/app/_utils/item-tree-utils";
+import { applyStatus, completeParent } from "@/app/_utils/item-status-utils";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+
+const _stampStatus = async (
+  actor: SanitisedUser,
+  formData: FormData,
+): Promise<Result<Checklist>> => {
+  try {
+    const uuid = formData.get("uuid") as string;
+    const itemId = formData.get("itemId") as string;
+    const status = formData.get("status") as string;
+    const timeEntriesStr = formData.get("timeEntries") as string;
+    const username = actor?.username;
+
+    if (!username) {
+      return { success: false, error: "Not authenticated" };
+    }
+
+    if (!uuid || !itemId) {
+      return { success: false, error: "List uuid and item ID are required" };
+    }
+
+    if (!status && !timeEntriesStr) {
+      return {
+        success: false,
+        error: "Either status or timeEntries must be provided",
+      };
+    }
+
+    let parsedTimeEntries: TimeEntry[] | null = null;
+    if (timeEntriesStr) {
+      try {
+        const parsed = JSON.parse(timeEntriesStr);
+        if (!Array.isArray(parsed)) {
+          throw new Error("timeEntries must be an array");
+        }
+        const allObjects = parsed.every(
+          (entry) =>
+            entry !== null &&
+            typeof entry === "object" &&
+            !Array.isArray(entry)
+        );
+        if (!allObjects) {
+          throw new Error("timeEntries must contain objects");
+        }
+        parsedTimeEntries = parsed;
+      } catch (e) {
+        console.error("Failed to parse timeEntries:", e);
+        return { success: false, error: "Invalid timeEntries payload" };
+      }
+    }
+
+    const list = await getListById(uuid, username);
+    if (!list) {
+      return { success: false, error: "List not found" };
+    }
+
+    const canEdit = await canReach(
+      list.uuid!,
+      ItemTypes.CHECKLIST,
+      username,
+      PermissionTypes.EDIT
+    );
+
+    if (!canEdit) {
+      return { success: false, error: "Permission denied" };
+    }
+
+    const now = new Date().toISOString();
+
+    const statusItems = status
+      ? applyStatus(list.items, itemId, status, list.statuses, username, now)
+      : list.items;
+
+    const updatedItems = parsedTimeEntries
+      ? updateItem(statusItems, itemId, (item) => ({
+        ...item,
+        timeEntries: parsedTimeEntries!.map((entry) => ({
+          ...entry,
+          user: entry.user || username,
+        })),
+      }))
+      : statusItems;
+
+    const itemsWithParentAutoComplete = completeParent(
+      updatedItems, itemId, list.statuses, username, now
+    );
+
+    const updatedList = {
+      ...list,
+      items: itemsWithParentAutoComplete,
+      updatedAt: now,
+    };
+
+    const filePath = await diskPath(Modes.CHECKLISTS, username, list);
+    await ensureDir(path.dirname(filePath));
+
+    await serverWriteFile(filePath, listToMarkdown(updatedList));
+
+    try {
+      revalidatePath("/");
+      revalidatePath(`/checklist/${list.uuid}`);
+    } catch (error) {
+      console.warn(
+        "Cache revalidation failed, but data was saved successfully:",
+        error
+      );
+    }
+    await broadcast({ type: "checklist", action: "updated", entityId: list.uuid, username });
+
+    return { success: true, data: updatedList as Checklist };
+  } catch (error) {
+    console.error("Error updating item status:", error);
+    return { success: false, error: await failedWith(error, "Failed to update item status") };
+  }
+};
+
+export const stampStatus = async (actor: SanitisedUser, formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _stampStatus(actor, formData),
+  );
diff --git a/app/_server/actions/checklist-item/status.ts b/app/_server/actions/checklist-item/status.ts
index a6d9358f8..86535c519 100644
--- a/app/_server/actions/checklist-item/status.ts
+++ b/app/_server/actions/checklist-item/status.ts
@@ -1,137 +1,17 @@
 "use server";
 
-import { revalidatePath } from "next/cache";
-import path from "path";
-import {
-  serverWriteFile,
-  ensureDir,
-} from "@/app/_server/actions/file";
-import {
-  getListById,
-} from "@/app/_server/actions/checklist";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { getUsername } from "@/app/_server/actions/users";
-import { Checklist, Result, TimeEntry } from "@/app/_types";
-import {
-  ItemTypes,
-  PermissionTypes,
-  Modes,
-} from "@/app/_types/enums";
-import { canReach } from "@/app/_server/actions/share/queries";
-import { diskPath } from "@/app/_server/actions/share/target";
-import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { updateItem } from "@/app/_utils/item-tree-utils";
-import { applyStatus, completeParent } from "@/app/_utils/item-status-utils";
+import { Checklist, Result } from "@/app/_types";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
+import { stampStatus } from "./stamper";
 
 export const updateItemStatus = async (
   formData: FormData,
-  usernameOverride?: string
 ): Promise<Result<Checklist>> => {
-  try {
-    const uuid = formData.get("uuid") as string;
-    const itemId = formData.get("itemId") as string;
-    const status = formData.get("status") as string;
-    const timeEntriesStr = formData.get("timeEntries") as string;
-    const formDataUsername = formData.get("username") as string;
+  const actor = await sessionActor(formData.get("username") as string | null);
 
-    const username =
-      usernameOverride || formDataUsername || (await getUsername());
-
-    if (!uuid || !itemId) {
-      return { success: false, error: "List uuid and item ID are required" };
-    }
-
-    if (!status && !timeEntriesStr) {
-      return {
-        success: false,
-        error: "Either status or timeEntries must be provided",
-      };
-    }
-
-    let parsedTimeEntries: TimeEntry[] | null = null;
-    if (timeEntriesStr) {
-      try {
-        const parsed = JSON.parse(timeEntriesStr);
-        if (!Array.isArray(parsed)) {
-          throw new Error("timeEntries must be an array");
-        }
-        const allObjects = parsed.every(
-          (entry) =>
-            entry !== null &&
-            typeof entry === "object" &&
-            !Array.isArray(entry)
-        );
-        if (!allObjects) {
-          throw new Error("timeEntries must contain objects");
-        }
-        parsedTimeEntries = parsed;
-      } catch (e) {
-        console.error("Failed to parse timeEntries:", e);
-        return { success: false, error: "Invalid timeEntries payload" };
-      }
-    }
-
-    const list = await getListById(uuid, username);
-    if (!list) {
-      return { success: false, error: "List not found" };
-    }
-
-    const canEdit = await canReach(
-      list.uuid!,
-      ItemTypes.CHECKLIST,
-      username,
-      PermissionTypes.EDIT
-    );
-
-    if (!canEdit) {
-      return { success: false, error: "Permission denied" };
-    }
-
-    const now = new Date().toISOString();
-
-    const statusItems = status
-      ? applyStatus(list.items, itemId, status, list.statuses, username, now)
-      : list.items;
-
-    const updatedItems = parsedTimeEntries
-      ? updateItem(statusItems, itemId, (item) => ({
-        ...item,
-        timeEntries: parsedTimeEntries!.map((entry) => ({
-          ...entry,
-          user: entry.user || username,
-        })),
-      }))
-      : statusItems;
-
-    const itemsWithParentAutoComplete = completeParent(
-      updatedItems, itemId, list.statuses, username, now
-    );
-
-    const updatedList = {
-      ...list,
-      items: itemsWithParentAutoComplete,
-      updatedAt: now,
-    };
-
-    const filePath = await diskPath(Modes.CHECKLISTS, username, list);
-    await ensureDir(path.dirname(filePath));
-
-    await serverWriteFile(filePath, listToMarkdown(updatedList));
-
-    try {
-      revalidatePath("/");
-      revalidatePath(`/checklist/${list.uuid}`);
-    } catch (error) {
-      console.warn(
-        "Cache revalidation failed, but data was saved successfully:",
-        error
-      );
-    }
-    await broadcast({ type: "checklist", action: "updated", entityId: list.uuid, username });
-
-    return { success: true, data: updatedList as Checklist };
-  } catch (error) {
-    console.error("Error updating item status:", error);
-    return { success: false, error: "Failed to update item status" };
+  if ("error" in actor) {
+    return { success: false, error: actor.error };
   }
+
+  return stampStatus(actor, formData);
 };
diff --git a/app/_server/actions/checklist-item/sub-items.ts b/app/_server/actions/checklist-item/sub-items.ts
index bb7614adc..1323fa589 100644
--- a/app/_server/actions/checklist-item/sub-items.ts
+++ b/app/_server/actions/checklist-item/sub-items.ts
@@ -6,7 +6,7 @@ import {
   serverWriteFile,
   ensureDir,
 } from "@/app/_server/actions/file";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { getUsername } from "@/app/_server/actions/users";
 import { Checklist, Result } from "@/app/_types";
@@ -20,8 +20,9 @@ import {
 import { canReach } from "@/app/_server/actions/share/queries";
 import { diskPath } from "@/app/_server/actions/share/target";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
-export const createSubItem = async (
+const _createSubItem = async (
   formData: FormData
 ): Promise<Result<Checklist>> => {
   try {
@@ -146,3 +147,8 @@ export const createSubItem = async (
     return { success: false, error: "Failed to create sub-item" };
   }
 };
+
+export const createSubItem = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _createSubItem(formData),
+  );
diff --git a/app/_server/actions/checklist/converters.ts b/app/_server/actions/checklist/converters.ts
index edfda364c..959cd1f91 100644
--- a/app/_server/actions/checklist/converters.ts
+++ b/app/_server/actions/checklist/converters.ts
@@ -267,18 +267,10 @@ export const clearAllChecklistItems = async (formData: FormData) => {
     const uuid = formData.get("uuid") as string;
     const ownerUsername = formData.get("user") as string | null;
     const type = formData.get("type") as "completed" | "incomplete";
-    const apiUser = formData.get("apiUser") as string | null;
-
-    let actingUser = await getCurrentUser();
-    if (!actingUser && apiUser) {
-      try {
-        actingUser = JSON.parse(apiUser);
-      } catch {
-        return { error: "Invalid user data" };
-      }
-    }
 
-    if (!actingUser || !actingUser.username) {
+    const actingUser = await getCurrentUser();
+
+    if (!actingUser?.username) {
       return { error: "Not authenticated" };
     }
 
diff --git a/app/_server/actions/checklist/creator.ts b/app/_server/actions/checklist/creator.ts
index 6d973af3a..42ea88d84 100644
--- a/app/_server/actions/checklist/creator.ts
+++ b/app/_server/actions/checklist/creator.ts
@@ -10,6 +10,7 @@ import { generateUuid } from "@/app/_utils/yaml-metadata-utils";
 import { logContentEvent } from "@/app/_server/actions/log";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { getFormData } from "@/app/_utils/global-utils";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 
 /**
  * Server-only checklist creation. The acting principal is passed in already
@@ -90,6 +91,6 @@ export const makeList = async (
       false,
     );
     console.error("Error creating list:", error);
-    return { error: "Failed to create list" };
+    return { error: await failedWith(error, "Failed to create list") };
   }
 };
diff --git a/app/_server/actions/checklist/crud.ts b/app/_server/actions/checklist/crud.ts
index 94f821261..0c61355e7 100644
--- a/app/_server/actions/checklist/crud.ts
+++ b/app/_server/actions/checklist/crud.ts
@@ -2,42 +2,21 @@
 
 import path from "path";
 import { Checklist, Item } from "@/app/_types";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
 import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
 import { getCurrentUser } from "@/app/_server/actions/users";
-import {
-  ensureDir,
-  serverWriteFile,
-  serverDeleteFile,
-} from "@/app/_server/actions/file";
+import { ensureDir, serverWriteFile } from "@/app/_server/actions/file";
 import { revalidatePath } from "next/cache";
-import { generateUniqueFilename, sanitizeFilename } from "@/app/_utils/filename-utils";
+import { generateUniqueFilename } from "@/app/_utils/filename-utils";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { getFormData } from "@/app/_utils/global-utils";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 import { canReach } from "@/app/_server/actions/share/queries";
-import {
-  targetDir,
-  bouncer,
-  shownAs,
-  movePlan,
-  refusalMessage,
-} from "@/app/_server/actions/share/target";
-import { generateUuid, updateYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
-import { logContentEvent } from "@/app/_server/actions/log";
-import { getListById, getUserChecklists } from "./queries";
+import { targetDir, bouncer } from "@/app/_server/actions/share/target";
+import { generateUuid } from "@/app/_utils/yaml-metadata-utils";
+import { getListById } from "./queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { claimedName } from "@/app/_server/actions/lib/actor";
 import { makeList } from "./creator";
-
-const _listDirFor = (owner: string, category?: string): string =>
-  path.join(
-    process.cwd(),
-    "data",
-    CHECKLISTS_FOLDER,
-    owner,
-    category || UNCATEGORIZED,
-  );
+import { dropList, editList } from "./editor";
 
 export const createList = async (formData: FormData) => {
   const actor = await getCurrentUser();
@@ -59,275 +38,6 @@ export const createList = async (formData: FormData) => {
   return makeList(actor, formData);
 };
 
-export const updateList = async (formData: FormData) => {
-  try {
-    const uuid = formData.get("uuid") as string;
-    const title = formData.get("title") as string;
-    const category = formData.get("category") as string;
-    const apiUser = formData.get("apiUser") as string | null;
-
-    let actingUser = await getCurrentUser();
-    if (!actingUser && apiUser) {
-      try {
-        actingUser = JSON.parse(apiUser);
-      } catch {
-        return { error: "Invalid user data" };
-      }
-    }
-
-    if (!actingUser || !actingUser.username) {
-      return { error: "Not authenticated" };
-    }
-
-    const currentList = await getListById(uuid);
-
-    if (!currentList) {
-      throw new Error("List not found");
-    }
-
-    const canEdit = await canReach(
-      currentList.uuid!,
-      ItemTypes.CHECKLIST,
-      actingUser.username,
-      PermissionTypes.EDIT
-    );
-
-    if (!canEdit) {
-      return { error: "Permission denied" };
-    }
-
-    const shownSource = await shownAs(
-      Modes.CHECKLISTS,
-      actingUser.username,
-      currentList.owner!,
-      currentList.category || ""
-    );
-
-    const shownCategory = category || shownSource;
-    const { home, destination, target, isMoving } = await movePlan(
-      Modes.CHECKLISTS,
-      actingUser.username,
-      currentList,
-      shownCategory
-    );
-
-    if (isMoving) {
-      const verdict = await bouncer(
-        target,
-        actingUser.username,
-        PermissionTypes.CREATE
-      );
-
-      if (!verdict.allowed) {
-        return { error: verdict.error };
-      }
-
-      const canRemove = await canReach(
-        currentList.uuid!,
-        ItemTypes.CHECKLIST,
-        actingUser.username,
-        PermissionTypes.DELETE
-      );
-
-      if (!canRemove) {
-        return { error: await refusalMessage() };
-      }
-    }
-
-    const updatedList: Checklist = {
-      ...currentList,
-      title,
-      category: destination.category,
-      owner: destination.owner,
-      items: currentList.items,
-      updatedAt: new Date().toISOString(),
-    };
-
-    const sourceDir = _listDirFor(home.owner, home.category);
-    const categoryDir = _listDirFor(destination.owner, destination.category);
-    await ensureDir(categoryDir);
-
-    const currentId = currentList.id;
-    let newFilename: string;
-    let newId = currentId;
-
-    const fileRenameMode = actingUser?.fileRenameMode || "minimal";
-    const sanitizedTitle = sanitizeFilename(title, fileRenameMode);
-    const currentFilename = `${currentId}.md`;
-    const expectedFilename = `${sanitizedTitle}.md`;
-
-    if (title !== currentList.title || currentFilename !== expectedFilename) {
-      newFilename = await generateUniqueFilename(
-        categoryDir,
-        title,
-        ".md",
-        fileRenameMode
-      );
-      newId = path.basename(newFilename, ".md");
-    } else {
-      newFilename = `${currentId}.md`;
-    }
-
-    if (newId !== currentId) {
-      updatedList.id = newId;
-    }
-
-    const filePath = path.join(categoryDir, newFilename);
-
-    const oldFilePath =
-      isMoving || newId !== currentId
-        ? path.join(sourceDir, `${currentId}.md`)
-        : null;
-
-    await serverWriteFile(filePath, listToMarkdown(updatedList));
-
-    if (oldFilePath && oldFilePath !== filePath) {
-      await serverDeleteFile(oldFilePath);
-    }
-
-    try {
-      revalidatePath("/");
-      revalidatePath(`/checklist/${currentList.uuid}`);
-    } catch (error) {
-      console.warn(
-        "Cache revalidation failed, but data was saved successfully:",
-        error
-      );
-    }
-
-    await logContentEvent(
-      "checklist_updated",
-      "checklist",
-      updatedList.uuid!,
-      updatedList.title,
-      true,
-      { category: updatedList.category }
-    );
-
-    await broadcast({ type: "checklist", action: "updated", entityId: updatedList.uuid, username: actingUser.username });
-
-    return {
-      success: true,
-      data: { ...updatedList, category: shownCategory },
-    };
-  } catch (error) {
-    console.error("Error in updateList:", error);
-    try {
-      const { title, uuid } = getFormData(formData, ["title", "uuid"]);
-      await logContentEvent(
-        "checklist_updated",
-        "checklist",
-        uuid!,
-        title || "unknown",
-        false
-      );
-    } catch (logError) {
-      console.error("Failed to log the updateList failure:", logError);
-    }
-    return { error: "Failed to update list" };
-  }
-};
-
-export const deleteList = async (formData: FormData) => {
-  try {
-    const uuid = formData.get("uuid") as string;
-    const apiUser = formData.get("apiUser") as string | null;
-
-    let currentUser = await getCurrentUser();
-    if (!currentUser && apiUser) {
-      try {
-        currentUser = JSON.parse(apiUser);
-      } catch {
-        return { error: "Invalid user data" };
-      }
-    }
-
-    if (!currentUser) {
-      return { error: "Not authenticated" };
-    }
-
-    const list = await getListById(uuid);
-
-    if (!list) {
-      return { error: "List not found" };
-    }
-
-    const canDelete = await canReach(
-      list.uuid!,
-      ItemTypes.CHECKLIST,
-      currentUser.username,
-      PermissionTypes.DELETE
-    );
-
-    if (!canDelete) {
-      return { error: "Permission denied" };
-    }
-
-    const ownerUsername = list.owner || currentUser.username;
-    const source = await targetDir(
-      Modes.CHECKLISTS,
-      currentUser.username,
-      list.category || ""
-    );
-
-    const verdict = await bouncer(
-      source,
-      currentUser.username,
-      PermissionTypes.DELETE
-    );
-
-    if (!verdict.allowed) {
-      return { error: verdict.error };
-    }
-
-    const ownerDir = path.join(
-      process.cwd(),
-      "data",
-      CHECKLISTS_FOLDER,
-      ownerUsername
-    );
-    const filePath = path.join(
-      ownerDir,
-      list.category || UNCATEGORIZED,
-      `${list.id}.md`
-    );
-
-    await serverDeleteFile(filePath);
-
-    try {
-      revalidatePath("/");
-      revalidatePath(`/checklist/${list.uuid}`);
-    } catch (error) {
-      console.warn(
-        "Cache revalidation failed, but data was saved successfully:",
-        error
-      );
-    }
-    await logContentEvent(
-      "checklist_deleted",
-      "checklist",
-      list.uuid || "unknown",
-      list.title || "unknown",
-      true,
-      { category: list.category }
-    );
-    await broadcast({ type: "checklist", action: "deleted", entityId: list.uuid, username: currentUser.username });
-
-    return { success: true };
-  } catch (error) {
-    try {
-      const { title, uuid } = getFormData(formData, ["title", "uuid"]);
-      await logContentEvent(
-        "checklist_deleted",
-        "checklist",
-        uuid || "unknown",
-        title || "unknown",
-        false
-      );
-    } catch { }
-    return { error: "Failed to delete list" };
-  }
-};
 
 export const cloneChecklist = async (formData: FormData) => {
   try {
@@ -425,3 +135,23 @@ export const cloneChecklist = async (formData: FormData) => {
     return { error: "Failed to clone checklist" };
   }
 };
+
+export const updateList = async (formData: FormData) => {
+  const actor = await getCurrentUser();
+
+  if (!actor?.username) {
+    return { error: "Not authenticated" };
+  }
+
+  return editList(actor, formData);
+};
+
+export const deleteList = async (formData: FormData) => {
+  const actor = await getCurrentUser();
+
+  if (!actor?.username) {
+    return { error: "Not authenticated" };
+  }
+
+  return dropList(actor, formData);
+};
diff --git a/app/_server/actions/checklist/editor.ts b/app/_server/actions/checklist/editor.ts
new file mode 100644
index 000000000..5c06b7e8b
--- /dev/null
+++ b/app/_server/actions/checklist/editor.ts
@@ -0,0 +1,296 @@
+import path from "path";
+import { Checklist, SanitisedUser } from "@/app/_types";
+import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
+import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import {
+  ensureDir,
+  serverWriteFile,
+  serverDeleteFile,
+} from "@/app/_server/actions/file";
+import { revalidatePath } from "next/cache";
+import { generateUniqueFilename, sanitizeFilename } from "@/app/_utils/filename-utils";
+import { listToMarkdown } from "@/app/_utils/checklist-utils";
+import { getFormData } from "@/app/_utils/global-utils";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { canReach } from "@/app/_server/actions/share/queries";
+import {
+  targetDir,
+  bouncer,
+  shownAs,
+  movePlan,
+  refusalMessage,
+} from "@/app/_server/actions/share/target";
+import { logContentEvent } from "@/app/_server/actions/log";
+import { getListById } from "./queries";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+
+const _listDirFor = (owner: string, category?: string): string =>
+  path.join(
+    process.cwd(),
+    "data",
+    CHECKLISTS_FOLDER,
+    owner,
+    category || UNCATEGORIZED,
+  );
+
+const _editList = async (actingUser: SanitisedUser, formData: FormData) => {
+  try {
+    const uuid = formData.get("uuid") as string;
+    const title = formData.get("title") as string;
+    const category = formData.get("category") as string;
+
+    if (!actingUser?.username) {
+      return { error: "Not authenticated" };
+    }
+
+    const currentList = await getListById(uuid);
+
+    if (!currentList) {
+      throw new Error("List not found");
+    }
+
+    const canEdit = await canReach(
+      currentList.uuid!,
+      ItemTypes.CHECKLIST,
+      actingUser.username,
+      PermissionTypes.EDIT
+    );
+
+    if (!canEdit) {
+      return { error: "Permission denied" };
+    }
+
+    const shownSource = await shownAs(
+      Modes.CHECKLISTS,
+      actingUser.username,
+      currentList.owner!,
+      currentList.category || ""
+    );
+
+    const shownCategory = category || shownSource;
+    const { home, destination, target, isMoving } = await movePlan(
+      Modes.CHECKLISTS,
+      actingUser.username,
+      currentList,
+      shownCategory
+    );
+
+    if (isMoving) {
+      const verdict = await bouncer(
+        target,
+        actingUser.username,
+        PermissionTypes.CREATE
+      );
+
+      if (!verdict.allowed) {
+        return { error: verdict.error };
+      }
+
+      const canRemove = await canReach(
+        currentList.uuid!,
+        ItemTypes.CHECKLIST,
+        actingUser.username,
+        PermissionTypes.DELETE
+      );
+
+      if (!canRemove) {
+        return { error: await refusalMessage() };
+      }
+    }
+
+    const updatedList: Checklist = {
+      ...currentList,
+      title,
+      category: destination.category,
+      owner: destination.owner,
+      items: currentList.items,
+      updatedAt: new Date().toISOString(),
+    };
+
+    const sourceDir = _listDirFor(home.owner, home.category);
+    const categoryDir = _listDirFor(destination.owner, destination.category);
+    await ensureDir(categoryDir);
+
+    const currentId = currentList.id;
+    let newFilename: string;
+    let newId = currentId;
+
+    const fileRenameMode = actingUser?.fileRenameMode || "minimal";
+    const sanitizedTitle = sanitizeFilename(title, fileRenameMode);
+    const currentFilename = `${currentId}.md`;
+    const expectedFilename = `${sanitizedTitle}.md`;
+
+    if (title !== currentList.title || currentFilename !== expectedFilename) {
+      newFilename = await generateUniqueFilename(
+        categoryDir,
+        title,
+        ".md",
+        fileRenameMode
+      );
+      newId = path.basename(newFilename, ".md");
+    } else {
+      newFilename = `${currentId}.md`;
+    }
+
+    if (newId !== currentId) {
+      updatedList.id = newId;
+    }
+
+    const filePath = path.join(categoryDir, newFilename);
+
+    const oldFilePath =
+      isMoving || newId !== currentId
+        ? path.join(sourceDir, `${currentId}.md`)
+        : null;
+
+    await serverWriteFile(filePath, listToMarkdown(updatedList));
+
+    if (oldFilePath && oldFilePath !== filePath) {
+      await serverDeleteFile(oldFilePath);
+    }
+
+    try {
+      revalidatePath("/");
+      revalidatePath(`/checklist/${currentList.uuid}`);
+    } catch (error) {
+      console.warn(
+        "Cache revalidation failed, but data was saved successfully:",
+        error
+      );
+    }
+
+    await logContentEvent(
+      "checklist_updated",
+      "checklist",
+      updatedList.uuid!,
+      updatedList.title,
+      true,
+      { category: updatedList.category }
+    );
+
+    await broadcast({ type: "checklist", action: "updated", entityId: updatedList.uuid, username: actingUser.username });
+
+    return {
+      success: true,
+      data: { ...updatedList, category: shownCategory },
+    };
+  } catch (error) {
+    console.error("Error in updateList:", error);
+    try {
+      const { title, uuid } = getFormData(formData, ["title", "uuid"]);
+      await logContentEvent(
+        "checklist_updated",
+        "checklist",
+        uuid!,
+        title || "unknown",
+        false
+      );
+    } catch (logError) {
+      console.error("Failed to log the updateList failure:", logError);
+    }
+    return { error: await failedWith(error, "Failed to update list") };
+  }
+};
+
+export const editList = async (actor: SanitisedUser, formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _editList(actor, formData),
+  );
+
+export const dropList = async (
+  currentUser: SanitisedUser,
+  formData: FormData,
+): Promise<{ success?: boolean; error?: string }> => {
+  try {
+    const uuid = formData.get("uuid") as string;
+
+    if (!currentUser?.username) {
+      return { error: "Not authenticated" };
+    }
+
+    const list = await getListById(uuid);
+
+    if (!list) {
+      return { error: "List not found" };
+    }
+
+    const canDelete = await canReach(
+      list.uuid!,
+      ItemTypes.CHECKLIST,
+      currentUser.username,
+      PermissionTypes.DELETE
+    );
+
+    if (!canDelete) {
+      return { error: "Permission denied" };
+    }
+
+    const ownerUsername = list.owner || currentUser.username;
+    const source = await targetDir(
+      Modes.CHECKLISTS,
+      currentUser.username,
+      list.category || ""
+    );
+
+    const verdict = await bouncer(
+      source,
+      currentUser.username,
+      PermissionTypes.DELETE
+    );
+
+    if (!verdict.allowed) {
+      return { error: verdict.error };
+    }
+
+    const ownerDir = path.join(
+      process.cwd(),
+      "data",
+      CHECKLISTS_FOLDER,
+      ownerUsername
+    );
+    const filePath = path.join(
+      ownerDir,
+      list.category || UNCATEGORIZED,
+      `${list.id}.md`
+    );
+
+    await serverDeleteFile(filePath);
+
+    try {
+      revalidatePath("/");
+      revalidatePath(`/checklist/${list.uuid}`);
+    } catch (error) {
+      console.warn(
+        "Cache revalidation failed, but data was saved successfully:",
+        error
+      );
+    }
+    await logContentEvent(
+      "checklist_deleted",
+      "checklist",
+      list.uuid || "unknown",
+      list.title || "unknown",
+      true,
+      { category: list.category }
+    );
+    await broadcast({ type: "checklist", action: "deleted", entityId: list.uuid, username: currentUser.username });
+
+    return { success: true };
+  } catch (error) {
+    console.error("Error deleting list:", error);
+    try {
+      const { title, uuid } = getFormData(formData, ["title", "uuid"]);
+      await logContentEvent(
+        "checklist_deleted",
+        "checklist",
+        uuid || "unknown",
+        title || "unknown",
+        false
+      );
+    } catch { }
+    return { error: await failedWith(error, "Failed to delete list") };
+  }
+};
+
diff --git a/app/_server/actions/checklist/index.ts b/app/_server/actions/checklist/index.ts
index 76235da2a..e1d78a378 100644
--- a/app/_server/actions/checklist/index.ts
+++ b/app/_server/actions/checklist/index.ts
@@ -1,10 +1,5 @@
 export { readListsRecursively } from "./readers";
-export {
-  getUserChecklists,
-  getListById,
-  getAllLists,
-  getChecklistsForDisplay,
-} from "./queries";
+export { viewList, getChecklistsForDisplay } from "./viewer";
 export { createList, updateList, deleteList, cloneChecklist } from "./crud";
 export {
   convertChecklistType,
diff --git a/app/_server/actions/checklist/queries.ts b/app/_server/actions/checklist/queries.ts
index 08e3a639b..aa5bf5417 100644
--- a/app/_server/actions/checklist/queries.ts
+++ b/app/_server/actions/checklist/queries.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import path from "path";
 import fs from "fs/promises";
 import { Checklist, User, GetChecklistsOptions } from "@/app/_types";
@@ -392,15 +390,3 @@ export const getAllLists = async (
     return { success: false, error: "Failed to fetch all lists" };
   }
 };
-
-export const getChecklistsForDisplay = async (
-  filter?: { type: "category" | "tag"; value: string } | null,
-  limit: number = 20,
-  offset: number = 0,
-) => {
-  return getUserChecklists({
-    filter: filter || undefined,
-    limit,
-    offset: filter ? offset : undefined,
-  });
-};
diff --git a/app/_server/actions/checklist/readers.ts b/app/_server/actions/checklist/readers.ts
index 7bc9a5070..b51b96afe 100644
--- a/app/_server/actions/checklist/readers.ts
+++ b/app/_server/actions/checklist/readers.ts
@@ -26,7 +26,7 @@ import { orderByUuids } from "@/app/_utils/order-utils";
 import { getChecklistType } from "./parsers";
 import { isDebugFlag } from "@/app/_utils/env-utils";
 import { isKanbanType } from "@/app/_types/enums";
-import { stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
+import { lacksUuid, stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
 const execAsync = promisify(exec);
@@ -245,7 +245,7 @@ export const readListsRecursively = async (
               rawContent: content,
             };
           }
-          return parseMarkdown(
+          const list = parseMarkdown(
             content,
             id,
             categoryPath,
@@ -257,6 +257,8 @@ export const readListsRecursively = async (
             },
             fileName,
           );
+          if (!lacksUuid(content)) return list;
+          return { ...list, uuid: (await stampUuid(filePath)) || list.uuid };
         } catch {
           return null;
         }
diff --git a/app/_server/actions/checklist/viewer.ts b/app/_server/actions/checklist/viewer.ts
new file mode 100644
index 000000000..cba1b807f
--- /dev/null
+++ b/app/_server/actions/checklist/viewer.ts
@@ -0,0 +1,40 @@
+"use server";
+
+import { Checklist } from "@/app/_types";
+import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
+import { canReach } from "@/app/_server/actions/share/queries";
+import { getListById, getUserChecklists } from "./queries";
+
+export const viewList = async (
+  uuid: string,
+): Promise<Checklist | undefined> => {
+  if (!uuid) return undefined;
+
+  const actor = await sessionActor();
+  if ("error" in actor) return undefined;
+
+  const seen = await getListById(uuid, actor.username);
+  if (seen) return seen;
+
+  const allowed = await canReach(
+    uuid,
+    ItemTypes.CHECKLIST,
+    actor.username,
+    PermissionTypes.READ,
+  );
+
+  return allowed ? getListById(uuid) : undefined;
+};
+
+export const getChecklistsForDisplay = async (
+  filter?: { type: "category" | "tag"; value: string } | null,
+  limit: number = 20,
+  offset: number = 0,
+) => {
+  return getUserChecklists({
+    filter: filter || undefined,
+    limit,
+    offset: filter ? offset : undefined,
+  });
+};
diff --git a/app/_server/actions/comments/index.ts b/app/_server/actions/comments/index.ts
index d499c7b9a..c04d0761b 100644
--- a/app/_server/actions/comments/index.ts
+++ b/app/_server/actions/comments/index.ts
@@ -7,7 +7,7 @@ import {
   NotificationTargets,
   PermissionTypes,
 } from "@/app/_types/enums";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { getUsername, isAdmin, getUsers } from "@/app/_server/actions/users";
 import { notifyUser } from "@/app/_server/actions/notifications/internal";
diff --git a/app/_server/actions/config/helpers.ts b/app/_server/actions/config/helpers.ts
index e3a4ec861..73d194771 100644
--- a/app/_server/actions/config/helpers.ts
+++ b/app/_server/actions/config/helpers.ts
@@ -4,10 +4,10 @@ import path from "path";
 import fs from "fs/promises";
 import { Result } from "@/app/_types";
 import { getCurrentUser } from "../users";
-import { getListById } from "../checklist";
+import { getListById } from "../checklist/queries";
 import { Metadata } from "next";
 import { Modes } from "@/app/_types/enums";
-import { getNoteById } from "../note";
+import { getNoteById } from "../note/queries";
 import { getSettings } from "./settings";
 
 export const getMedatadaTitle = async (
diff --git a/app/_server/actions/config/settings.ts b/app/_server/actions/config/settings.ts
index 6e3cfe208..8383e2735 100644
--- a/app/_server/actions/config/settings.ts
+++ b/app/_server/actions/config/settings.ts
@@ -227,19 +227,15 @@ export const updateAppSettings = async (
       (formData.get("defaultTimeFormat") as "12-hours" | "24-hours") ||
       "12-hours";
 
-    let editorSettings = {
-      enableSlashCommands: true,
-      enableBubbleMenu: true,
-      enableTableToolbar: true,
-      enableBilateralLinks: true,
-    };
+    const existing = await getSettings();
+    let editorSettings: AppSettings["editor"] = existing.editor;
 
-    const editorData = formData.get("editor") as string;
-    if (editorData) {
+    const editorData = formData.get("editor");
+    if (typeof editorData === "string" && editorData) {
       try {
-        editorSettings = JSON.parse(editorData);
+        editorSettings = { ...existing.editor, ...JSON.parse(editorData) };
       } catch (error) {
-        console.warn("Failed to parse editor settings, using defaults");
+        console.warn("Unparseable editor settings, keeping current ones:", error);
       }
     }
 
diff --git a/app/_server/actions/dashboard/index.ts b/app/_server/actions/dashboard/index.ts
index 13fe16451..55120b9ff 100644
--- a/app/_server/actions/dashboard/index.ts
+++ b/app/_server/actions/dashboard/index.ts
@@ -3,7 +3,8 @@
 import { AppMode, Checklist, ItemType, Note, Result } from "@/app/_types";
 import { ItemTypes, Modes } from "@/app/_types/enums";
 import { updateList } from "../checklist";
-import { updateNote, getNoteById } from "../note";
+import { updateNote } from "../note";
+import { getNoteById } from "../note/queries";
 import { getCurrentUser, getUserIndex } from "../users";
 import { readJsonFile, writeJsonFile } from "../file";
 import { ARCHIVED_DIR_NAME, USERS_FILE } from "@/app/_consts/files";
diff --git a/app/_server/actions/export/index.ts b/app/_server/actions/export/index.ts
index 50bc1522a..bd126593a 100644
--- a/app/_server/actions/export/index.ts
+++ b/app/_server/actions/export/index.ts
@@ -6,8 +6,8 @@ import fsp from "fs/promises";
 import path from "path";
 import { ExportResult, ExportProgress } from "@/app/_types";
 import { DATA_DIR, USERS_FILE, EXPORT_TEMP_DIR } from "@/app/_consts/files";
-import { getAllLists } from "@/app/_server/actions/checklist";
-import { getAllNotes } from "@/app/_server/actions/note";
+import { getAllLists } from "@/app/_server/actions/checklist/queries";
+import { getAllNotes } from "@/app/_server/actions/note/queries";
 import { readJsonFile, ensureDir } from "@/app/_server/actions/file";
 import {
   getCurrentUser,
diff --git a/app/_server/actions/file/index.ts b/app/_server/actions/file/index.ts
index 085b754d8..114af6f82 100644
--- a/app/_server/actions/file/index.ts
+++ b/app/_server/actions/file/index.ts
@@ -12,6 +12,7 @@ import { randomUUID } from "crypto";
 import { Modes } from "@/app/_types/enums";
 import { atomicWrite, withCreatedAt } from "@/app/_server/actions/file/atomic";
 import { isItemFile } from "@/app/_server/actions/relations/paths";
+import { isReadOnlyError } from "@/app/_server/actions/lib/read-only";
 
 export interface OrderData {
   categories?: string[];
@@ -168,6 +169,8 @@ export const serverDeleteFile = async (filePath: string) => {
     await fs.unlink(filePath);
     await (await _tracking()).trackItemDelete(filePath);
   } catch (error) {
+    if (isReadOnlyError(error)) throw error;
+
     const { logAudit } = await import("@/app/_server/actions/log");
     await logAudit({
       level: "DEBUG",
@@ -215,6 +218,8 @@ export const serverDeleteDir = async (dirPath: string) => {
     await fs.rm(dirPath, { recursive: true });
     await (await _tracking()).trackTreeDelete(dirPath);
   } catch (error) {
+    if (isReadOnlyError(error)) throw error;
+
     const { logAudit } = await import("@/app/_server/actions/log");
     await logAudit({
       level: "DEBUG",
diff --git a/app/_server/actions/history/index.ts b/app/_server/actions/history/index.ts
index 12dccb569..08cab7cbc 100644
--- a/app/_server/actions/history/index.ts
+++ b/app/_server/actions/history/index.ts
@@ -343,7 +343,7 @@ export const getHistory = async (
     await ensureRepo(username);
     const git = _getGitInstance(userDir);
 
-    const { getNoteById } = await import("@/app/_server/actions/note");
+    const { getNoteById } = await import("@/app/_server/actions/note/queries");
     const note = await getNoteById(noteUuid, username);
 
     if (!note) {
@@ -468,7 +468,7 @@ export const getVersion = async (
     }
 
     if (content === null) {
-      const { getNoteById } = await import("@/app/_server/actions/note");
+      const { getNoteById } = await import("@/app/_server/actions/note/queries");
       const note = await getNoteById(noteUuid, username);
 
       if (note) {
diff --git a/app/_server/actions/kanban/calendar.ts b/app/_server/actions/kanban/calendar.ts
index 42acc147c..0a3e05714 100644
--- a/app/_server/actions/kanban/calendar.ts
+++ b/app/_server/actions/kanban/calendar.ts
@@ -1,7 +1,7 @@
 "use server";
 
 import { getFormData } from "@/app/_utils/global-utils";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { generateICS } from "@/app/_utils/kanban/calendar-utils";
 import { parseItemsForCalendar, CalendarEvent } from "@/app/_utils/kanban/calendar-utils";
 
diff --git a/app/_server/actions/kanban/items.ts b/app/_server/actions/kanban/items.ts
index bbd8e9442..e4c33810a 100644
--- a/app/_server/actions/kanban/items.ts
+++ b/app/_server/actions/kanban/items.ts
@@ -17,9 +17,10 @@ import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { getFormData } from "@/app/_utils/global-utils";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { notifyUser } from "@/app/_server/actions/notifications/internal";
 import { findItem, updateItem } from "@/app/_utils/item-tree-utils";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
 const _getFilePath = async (list: Checklist): Promise<string> => {
   const categoryDir = list.category || UNCATEGORIZED;
@@ -51,7 +52,7 @@ async function _saveAndBroadcast(list: Checklist, username: string) {
   } catch { }
 }
 
-export const updateKanbanItemPriority = async (formData: FormData) => {
+const _updateKanbanItemPriority = async (formData: FormData) => {
   try {
     const { uuid, itemId, priority } = getFormData(formData, [
       "uuid", "itemId", "priority",
@@ -89,7 +90,7 @@ export const updateKanbanItemPriority = async (formData: FormData) => {
   }
 };
 
-export const updateKanbanItemScore = async (formData: FormData) => {
+const _updateKanbanItemScore = async (formData: FormData) => {
   try {
     const { uuid, itemId, score } = getFormData(formData, [
       "uuid", "itemId", "score",
@@ -127,7 +128,7 @@ export const updateKanbanItemScore = async (formData: FormData) => {
   }
 };
 
-export const assignKanbanItem = async (formData: FormData) => {
+const _assignKanbanItem = async (formData: FormData) => {
   try {
     const { uuid, itemId, assignee } = getFormData(formData, [
       "uuid", "itemId", "assignee",
@@ -180,7 +181,7 @@ export const assignKanbanItem = async (formData: FormData) => {
   }
 };
 
-export const setKanbanItemReminder = async (formData: FormData) => {
+const _setKanbanItemReminder = async (formData: FormData) => {
   try {
     const { uuid, itemId, reminder: reminderStr } = getFormData(formData, [
       "uuid", "itemId", "reminder",
@@ -227,3 +228,22 @@ export const setKanbanItemReminder = async (formData: FormData) => {
   }
 };
 
+export const updateKanbanItemPriority = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _updateKanbanItemPriority(formData),
+  );
+
+export const updateKanbanItemScore = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _updateKanbanItemScore(formData),
+  );
+
+export const assignKanbanItem = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _assignKanbanItem(formData),
+  );
+
+export const setKanbanItemReminder = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _setKanbanItemReminder(formData),
+  );
diff --git a/app/_server/actions/kanban/search.ts b/app/_server/actions/kanban/search.ts
index 47c44987a..647f81343 100644
--- a/app/_server/actions/kanban/search.ts
+++ b/app/_server/actions/kanban/search.ts
@@ -2,7 +2,7 @@
 
 import { Checklist, Item, KanbanPriority } from "@/app/_types";
 import { getCurrentUser } from "@/app/_server/actions/users";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { getFormData } from "@/app/_utils/global-utils";
 
 const _matchesText = (item: Item, query: string): boolean => {
diff --git a/app/_server/actions/kanban/tempo.ts b/app/_server/actions/kanban/tempo.ts
index 645b788a5..0f01238a5 100644
--- a/app/_server/actions/kanban/tempo.ts
+++ b/app/_server/actions/kanban/tempo.ts
@@ -2,7 +2,7 @@
 
 import { Item, TimeEntry } from "@/app/_types";
 import { getCurrentUser } from "@/app/_server/actions/users";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
 import { getFormData } from "@/app/_utils/global-utils";
diff --git a/app/_server/actions/kanban/time-entries.ts b/app/_server/actions/kanban/time-entries.ts
index 1dd23e772..38cc179cd 100644
--- a/app/_server/actions/kanban/time-entries.ts
+++ b/app/_server/actions/kanban/time-entries.ts
@@ -3,7 +3,7 @@
 import { Checklist, TimeEntry } from "@/app/_types";
 import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
 import { getCurrentUser } from "@/app/_server/actions/users";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { getFormData } from "@/app/_utils/global-utils";
 import { updateItem, findItem } from "@/app/_utils/item-tree-utils";
@@ -15,6 +15,7 @@ import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { Modes } from "@/app/_types/enums";
 import { revalidatePath } from "next/cache";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
 const _getFilePath = async (list: Checklist): Promise<string> => {
   const categoryDir = list.category || UNCATEGORIZED;
@@ -46,7 +47,7 @@ async function _saveAndBroadcast(list: Checklist, username: string) {
   } catch { }
 }
 
-export const editTimeEntry = async (formData: FormData) => {
+const _editTimeEntry = async (formData: FormData) => {
   try {
     const { uuid, itemId, entryId } = getFormData(formData, [
       "uuid", "itemId", "entryId",
@@ -100,7 +101,7 @@ export const editTimeEntry = async (formData: FormData) => {
   }
 };
 
-export const deleteTimeEntry = async (formData: FormData) => {
+const _deleteTimeEntry = async (formData: FormData) => {
   try {
     const { uuid, itemId, entryId } = getFormData(formData, [
       "uuid", "itemId", "entryId",
@@ -139,3 +140,13 @@ export const deleteTimeEntry = async (formData: FormData) => {
     return { error: "Failed to delete time entry" };
   }
 };
+
+export const editTimeEntry = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _editTimeEntry(formData),
+  );
+
+export const deleteTimeEntry = async (formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _deleteTimeEntry(formData),
+  );
diff --git a/app/_server/actions/lib/actor.ts b/app/_server/actions/lib/actor.ts
index b0c3a3359..656b2b89c 100644
--- a/app/_server/actions/lib/actor.ts
+++ b/app/_server/actions/lib/actor.ts
@@ -1,3 +1,6 @@
+import { SanitisedUser } from "@/app/_types";
+import { getCurrentUser } from "@/app/_server/actions/users";
+
 /**
  * Client callers still ship a serialised user blob in their FormData. It is
  * never an identity source, only something we refuse when it disagrees with
@@ -18,3 +21,23 @@ export const claimedName = (formData: FormData): string | null => {
     return null;
   }
 };
+
+export const sessionActor = async (
+  claimed?: string | null,
+): Promise<SanitisedUser | { error: string }> => {
+  const actor = await getCurrentUser();
+
+  if (!actor?.username) {
+    return { error: "Not authenticated" };
+  }
+
+  if (claimed && claimed !== actor.username) {
+    console.error(
+      "Refusing change, claimed identity does not match session:",
+      actor.username,
+    );
+    return { error: "Identity mismatch" };
+  }
+
+  return actor;
+};
diff --git a/app/_server/actions/lib/concurrency.ts b/app/_server/actions/lib/concurrency.ts
index 442828eda..7cfcb6a5c 100644
--- a/app/_server/actions/lib/concurrency.ts
+++ b/app/_server/actions/lib/concurrency.ts
@@ -41,3 +41,6 @@ export const runQueued = <T>(
   queues.set(key, tail);
   return result;
 };
+
+export const itemLane = (mode: string, uuid: string): string =>
+  `item:${mode}:${uuid}`;
diff --git a/app/_server/actions/lib/migration-check.ts b/app/_server/actions/lib/migration-check.ts
index 799c4f2c1..52650662d 100644
--- a/app/_server/actions/lib/migration-check.ts
+++ b/app/_server/actions/lib/migration-check.ts
@@ -9,6 +9,7 @@ import {
   SCHEMA_VERSION_FILE,
 } from "@/app/_consts/files";
 import { LEGACY_ORDER_FILE, LEGACY_SHARING_FILE } from "@/app/_consts/sharing";
+import { isWritable } from "@/app/_server/actions/lib/read-only";
 
 const CHECKED_MODES = [Modes.NOTES, Modes.CHECKLISTS];
 
@@ -42,7 +43,10 @@ const _hasOrderFile = async (dirPath: string): Promise<boolean> => {
     const entries = await fs.readdir(dirPath, { withFileTypes: true });
 
     for (const entry of entries) {
-      if (entry.isFile() && entry.name === LEGACY_ORDER_FILE) return true;
+      if (entry.isFile() && entry.name === LEGACY_ORDER_FILE) {
+        if (await isWritable(dirPath)) return true;
+        continue;
+      }
 
       if (entry.isDirectory() && !excluded.includes(entry.name)) {
         if (await _hasOrderFile(path.join(dirPath, entry.name))) return true;
diff --git a/app/_server/actions/lib/read-only-message.ts b/app/_server/actions/lib/read-only-message.ts
new file mode 100644
index 000000000..c52656a34
--- /dev/null
+++ b/app/_server/actions/lib/read-only-message.ts
@@ -0,0 +1,12 @@
+import { getTranslations } from "next-intl/server";
+import { isReadOnlyError } from "@/app/_server/actions/lib/read-only";
+
+export const failedWith = async (
+  error: unknown,
+  fallback: string,
+): Promise<string> => {
+  if (!isReadOnlyError(error)) return fallback;
+
+  const t = await getTranslations("errors");
+  return t("readOnlyFolder");
+};
diff --git a/app/_server/actions/lib/read-only.ts b/app/_server/actions/lib/read-only.ts
new file mode 100644
index 000000000..942ec60d3
--- /dev/null
+++ b/app/_server/actions/lib/read-only.ts
@@ -0,0 +1,50 @@
+import path from "path";
+import fs from "fs/promises";
+import { constants } from "fs";
+import { v5 as uuidv5 } from "uuid";
+import { DATA_DIR } from "@/app/_consts/files";
+import { PATH_UUID_NAMESPACE, isUuid } from "@/app/_consts/identity";
+
+export enum ReadOnlyCodes {
+  READ_ONLY_FS = "EROFS",
+  ACCESS = "EACCES",
+  PERMISSION = "EPERM",
+}
+
+const READ_ONLY_CODES: string[] = Object.values(ReadOnlyCodes);
+const PATH_UUID_VERSION = "5";
+
+const warnedDirs = new Set<string>();
+
+export const isReadOnlyError = (error: unknown): boolean => {
+  const code = (error as { code?: unknown } | null)?.code;
+  return typeof code === "string" && READ_ONLY_CODES.includes(code);
+};
+
+export const pathUuid = (filePath: string): string => {
+  const dataRoot = path.resolve(process.cwd(), DATA_DIR);
+  const relative = path.relative(dataRoot, path.resolve(filePath));
+  return uuidv5(relative.split(path.sep).join("/"), PATH_UUID_NAMESPACE);
+};
+
+export const isPathUuid = (uuid: string): boolean =>
+  isUuid(uuid) && uuid.charAt(14) === PATH_UUID_VERSION;
+
+export const warnReadOnly = (dirPath: string): void => {
+  const key = path.resolve(dirPath);
+  if (warnedDirs.has(key)) return;
+
+  warnedDirs.add(key);
+  console.warn(
+    `Read-only folder ${dirPath}, leaving it untouched and deriving ids from paths`,
+  );
+};
+
+export const isWritable = async (dirPath: string): Promise<boolean> => {
+  try {
+    await fs.access(dirPath, constants.W_OK);
+    return true;
+  } catch (error) {
+    return !isReadOnlyError(error);
+  }
+};
diff --git a/app/_server/actions/lib/stamp-uuid.ts b/app/_server/actions/lib/stamp-uuid.ts
index da9beb13f..1fec125c7 100644
--- a/app/_server/actions/lib/stamp-uuid.ts
+++ b/app/_server/actions/lib/stamp-uuid.ts
@@ -1,7 +1,13 @@
+import path from "path";
 import fs from "fs/promises";
 import { extractYamlMetadata, generateUuid } from "@/app/_utils/yaml-metadata-utils";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import { singleFlight } from "@/app/_server/actions/lib/concurrency";
+import {
+  isWritable,
+  pathUuid,
+  warnReadOnly,
+} from "@/app/_server/actions/lib/read-only";
 
 const FRONTMATTER_OPEN = /^(\uFEFF?---\r?\n)/;
 const FRONTMATTER_BLOCK = /^\uFEFF?---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/;
@@ -36,12 +42,21 @@ const _stampable = (content: string, filePath: string): boolean => {
   return true;
 };
 
+export const lacksUuid = (content: string): boolean =>
+  !UUID_LINE.test(content.match(FRONTMATTER_BLOCK)?.[0] || "");
+
 export const stampUuid = (filePath: string): Promise<string | undefined> =>
   singleFlight(`stamp:${filePath}`, async () => {
     try {
       const content = await fs.readFile(filePath, "utf-8");
       const existing = extractYamlMetadata(content).metadata.uuid;
       if (typeof existing === "string" && existing) return existing;
+
+      if (!(await isWritable(path.dirname(filePath)))) {
+        warnReadOnly(path.dirname(filePath));
+        return pathUuid(filePath);
+      }
+
       if (!_stampable(content, filePath)) return undefined;
 
       const uuid = generateUuid();
diff --git a/app/_server/actions/migration/share-migration.ts b/app/_server/actions/migration/share-migration.ts
index fbd58e40d..fcfba3d00 100644
--- a/app/_server/actions/migration/share-migration.ts
+++ b/app/_server/actions/migration/share-migration.ts
@@ -13,11 +13,14 @@ import {
   SHARED_WITH_KEY,
 } from "@/app/_consts/sharing";
 import { toSharedWith } from "@/app/_utils/sharing-utils";
+import { updateYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+import { serverWriteFile } from "@/app/_server/actions/file";
+import { stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
 import {
-  extractYamlMetadata,
-  generateUuid,
-  updateYamlMetadata,
-} from "@/app/_utils/yaml-metadata-utils";
+  isReadOnlyError,
+  isWritable,
+  warnReadOnly,
+} from "@/app/_server/actions/lib/read-only";
 import { grepExtractFrontmatter } from "@/app/_utils/grep-utils";
 import { isAdmin } from "@/app/_server/actions/users";
 import { needsMigration } from "@/app/_server/actions/lib/migration-check";
@@ -100,22 +103,7 @@ const _mdNames = async (dirPath: string): Promise<string[]> => {
 
 const _stampItems = async (dirPath: string): Promise<void> => {
   for (const name of await _mdNames(dirPath)) {
-    const filePath = path.join(dirPath, name);
-
-    try {
-      const content = await fs.readFile(filePath, "utf-8");
-      const { metadata } = extractYamlMetadata(content);
-
-      if (metadata.uuid) continue;
-
-      await fs.writeFile(
-        filePath,
-        updateYamlMetadata(content, { uuid: generateUuid() }),
-        "utf-8",
-      );
-    } catch (error) {
-      console.error(`Failed to stamp uuid on ${filePath}:`, error);
-    }
+    await stampUuid(path.join(dirPath, name));
   }
 };
 
@@ -211,12 +199,22 @@ const _stampTree = async (
   isRoot: boolean,
   log: MigrationLog,
 ): Promise<void> => {
+  const subDirs = await _subDirs(dirPath);
+
+  if (!(await isWritable(dirPath))) {
+    warnReadOnly(dirPath);
+    log.changes.push(`Left read-only folder ${path.basename(dirPath)} untouched`);
+
+    for (const subDir of subDirs) {
+      await _stampTree(subDir, false, log);
+    }
+    return;
+  }
+
   if (!isRoot) {
     await catUuid(dirPath);
   }
 
-  const subDirs = await _subDirs(dirPath);
-
   for (const subDir of subDirs) {
     await catUuid(subDir);
   }
@@ -268,11 +266,15 @@ const _applyShares = async (
   users: Record<string, SharingPermissions>,
 ): Promise<void> => {
   const content = await fs.readFile(filePath, "utf-8");
+  if (!content.trim()) {
+    throw new Error(`Refusing to write shares onto an empty read: ${filePath}`);
+  }
+
   const updated = updateYamlMetadata(content, {
     [SHARED_WITH_KEY]: toSharedWith(users),
   });
 
-  await fs.writeFile(filePath, updated, "utf-8");
+  await serverWriteFile(filePath, updated);
 };
 
 const _migrateShares = async (
@@ -311,6 +313,12 @@ const _migrateShares = async (
         `Moved sharing into ${path.basename(filePath)} (${Object.keys(users).join(", ")})`,
       );
     } catch (error) {
+      if (isReadOnlyError(error)) {
+        warnReadOnly(path.dirname(filePath));
+        log.changes.push(`Skipped sharing on read-only ${path.basename(filePath)}`);
+        continue;
+      }
+
       failures += 1;
       console.error(`Failed to migrate shares for ${filePath}:`, error);
     }
diff --git a/app/_server/actions/note/creator.ts b/app/_server/actions/note/creator.ts
index 71b162b4b..6c4f2b628 100644
--- a/app/_server/actions/note/creator.ts
+++ b/app/_server/actions/note/creator.ts
@@ -1,4 +1,5 @@
 import path from "path";
+import { getTranslations } from "next-intl/server";
 import { Note, SanitisedUser } from "@/app/_types";
 import { Modes, PermissionTypes } from "@/app/_types/enums";
 import { ensureDir, serverWriteFile } from "@/app/_server/actions/file";
@@ -22,6 +23,7 @@ import { commitNote } from "@/app/_server/actions/history";
 import { targetDir, bouncer } from "@/app/_server/actions/share/target";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { noteToMarkdown } from "./parsers";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 
 export const makeNote = async (
   actor: SanitisedUser,
@@ -41,6 +43,13 @@ export const makeNote = async (
     const encrypted = isEncrypted(contentWithoutMetadata);
 
     const target = await targetDir(Modes.NOTES, actor.username, category);
+
+    if (category && !target.isMount && target.category !== category) {
+      console.warn("Refusing note outside its owner's folder:", category);
+      const t = await getTranslations("errors");
+      return { error: t("categoryOutOfBounds") };
+    }
+
     const content = encrypted
       ? contentWithoutMetadata
       : await tidyItemLinks(contentWithoutMetadata, target.owner);
@@ -123,6 +132,6 @@ export const makeNote = async (
       title || "unknown",
       false,
     );
-    return { error: "Failed to create note" };
+    return { error: await failedWith(error, "Failed to create note") };
   }
 };
diff --git a/app/_server/actions/note/crud.ts b/app/_server/actions/note/crud.ts
index 24ca5a82a..7a9f98f03 100644
--- a/app/_server/actions/note/crud.ts
+++ b/app/_server/actions/note/crud.ts
@@ -1,62 +1,24 @@
 "use server";
 
 import path from "path";
-import { Note } from "@/app/_types";
 import { generateUniqueFilename } from "@/app/_utils/filename-utils";
-import {
-  detectEncryptionMethod,
-  isEncrypted,
-} from "@/app/_utils/encryption-utils";
-import { getCurrentUser, getUsername } from "@/app/_server/actions/users";
-import {
-  ensureDir,
-  serverDeleteFile,
-  serverWriteFile,
-} from "@/app/_server/actions/file";
+import { getCurrentUser } from "@/app/_server/actions/users";
+import { ensureDir, serverWriteFile } from "@/app/_server/actions/file";
 import { revalidatePath } from "next/cache";
-import { NOTES_DIR } from "@/app/_consts/files";
 import { PermissionTypes, Modes } from "@/app/_types/enums";
-import { sanitizeMarkdown } from "@/app/_utils/markdown-utils";
-import { extractHashtagsFromContent } from "@/app/_utils/tag-utils";
-import { getFormData } from "@/app/_utils/global-utils";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
-import {
-  refreshWikilinks,
-  tidyItemLinks,
-} from "@/app/_server/actions/relations/tidy";
 import { canReach } from "@/app/_server/actions/share/queries";
 import {
   extractYamlMetadata as stripYaml,
   generateUuid,
   updateYamlMetadata,
-  strayMeta,
-  keptMeta,
 } from "@/app/_utils/yaml-metadata-utils";
-import { getSettings } from "@/app/_server/actions/config";
-import { logContentEvent } from "@/app/_server/actions/log";
-import { commitNote } from "@/app/_server/actions/history";
-import { noteToMarkdown } from "./parsers";
 import { getNoteById } from "./queries";
-import {
-  targetDir,
-  bouncer,
-  shownAs,
-  movePlan,
-  refusalMessage,
-} from "@/app/_server/actions/share/target";
+import { targetDir, bouncer } from "@/app/_server/actions/share/target";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { claimedName } from "@/app/_server/actions/lib/actor";
 import { makeNote } from "./creator";
-
-const _noteDirFor = (owner: string, category?: string): string =>
-  path.join(process.cwd(), NOTES_DIR(owner), category || UNCATEGORIZED);
-
-const _namedIn = (user: unknown): string | undefined => {
-  if (typeof user === "string") return user || undefined;
-
-  const named = (user as { username?: unknown })?.username;
-  return typeof named === "string" ? named : undefined;
-};
+import { dropNote, editNote } from "./editor";
 
 export const createNote = async (formData: FormData) => {
   const actor = await getCurrentUser();
@@ -78,342 +40,6 @@ export const createNote = async (formData: FormData) => {
   return makeNote(actor, formData);
 };
 
-export const updateNote = async (formData: FormData, autosaveNotes = false) => {
-  try {
-    const { title, content, category, user, uuid } = getFormData(formData, [
-      "title",
-      "content",
-      "category",
-      "user",
-      "uuid",
-    ]);
-    const settings = await getSettings();
-
-    const actingUsername = (await getUsername()) || _namedIn(user);
-
-    if (!actingUsername) {
-      return { error: "Not authenticated" };
-    }
-
-    const note = await getNoteById(uuid);
-
-    if (!note) {
-      throw new Error("Note not found");
-    }
-
-    const canEdit = await canReach(
-      note.uuid!,
-      "note",
-      actingUsername,
-      PermissionTypes.EDIT,
-    );
-
-    if (!canEdit) {
-      return { error: "Permission denied" };
-    }
-
-    const shownSource = await shownAs(
-      Modes.NOTES,
-      actingUsername,
-      note.owner!,
-      note.category || "",
-    );
-
-    const shownCategory = category || shownSource;
-    const { home, destination, target, isMoving } = await movePlan(
-      Modes.NOTES,
-      actingUsername,
-      note,
-      shownCategory,
-    );
-
-    if (isMoving) {
-      const verdict = await bouncer(
-        target,
-        actingUsername,
-        PermissionTypes.CREATE,
-      );
-
-      if (!verdict.allowed) {
-        return { error: verdict.error };
-      }
-
-      const canRemove = await canReach(
-        note.uuid!,
-        "note",
-        actingUsername,
-        PermissionTypes.DELETE,
-      );
-
-      if (!canRemove) {
-        return { error: await refusalMessage() };
-      }
-    }
-
-    const sanitizedContent = sanitizeMarkdown(content);
-    const { metadata: incomingMeta, contentWithoutMetadata } =
-      stripYaml(sanitizedContent);
-    const convertedContent = isEncrypted(contentWithoutMetadata)
-      ? contentWithoutMetadata
-      : refreshWikilinks(
-          await tidyItemLinks(contentWithoutMetadata, note.owner || actingUsername),
-          note.uuid,
-        );
-
-    const encryptionMethod =
-      detectEncryptionMethod(convertedContent) || undefined;
-
-    const extractedTags = extractHashtagsFromContent(convertedContent);
-    const sortedTags = Array.from(new Set(extractedTags)).sort();
-
-    const updatedDoc = {
-      ...note,
-      title,
-      content: convertedContent,
-      category: destination.category,
-      owner: destination.owner,
-      updatedAt: new Date().toISOString(),
-      encrypted: isEncrypted(convertedContent),
-      encryptionMethod,
-      tags: sortedTags.length > 0 ? sortedTags : undefined,
-      extraMetadata: keptMeta(note.extraMetadata, strayMeta(incomingMeta)),
-    };
-
-    const sourceDir = _noteDirFor(home.owner, home.category);
-    const categoryDir = _noteDirFor(destination.owner, destination.category);
-    await ensureDir(categoryDir);
-
-    const currentId = note.id;
-    let newFilename: string;
-    let newId = currentId;
-
-    if (title !== note.title) {
-      const ownerUser = await getCurrentUser();
-      const fileRenameMode = ownerUser?.fileRenameMode || "minimal";
-      newFilename = await generateUniqueFilename(
-        categoryDir,
-        title,
-        ".md",
-        fileRenameMode,
-      );
-      newId = path.basename(newFilename, ".md");
-    } else {
-      newFilename = `${currentId}.md`;
-    }
-
-    if (newId !== currentId) {
-      updatedDoc.id = newId;
-    }
-
-    const filePath = path.join(categoryDir, newFilename);
-
-    const oldFilePath =
-      isMoving || newId !== currentId
-        ? path.join(sourceDir, `${currentId}.md`)
-        : null;
-
-    await serverWriteFile(filePath, noteToMarkdown(updatedDoc));
-
-    if (!autosaveNotes && !updatedDoc.encrypted) {
-      const historyRelativePath = path.join(
-        updatedDoc.category || UNCATEGORIZED,
-        `${newId}.md`,
-      );
-
-      const historyAction = isMoving ? "move" : "update";
-
-      const historyMetadata = isMoving
-        ? {
-            oldCategory: home.category || UNCATEGORIZED,
-            newCategory: updatedDoc.category || UNCATEGORIZED,
-            oldPath: path.join(
-              home.category || UNCATEGORIZED,
-              `${currentId}.md`,
-            ),
-          }
-        : undefined;
-
-      commitNote(
-        destination.owner,
-        historyRelativePath,
-        historyAction,
-        title,
-        historyMetadata,
-      ).catch(() => {});
-    }
-
-    if (oldFilePath && oldFilePath !== filePath) {
-      await serverDeleteFile(oldFilePath);
-    }
-
-    try {
-      if (!autosaveNotes) {
-        revalidatePath("/");
-        revalidatePath(`/note/${note.uuid}`);
-      }
-    } catch (error) {
-      console.warn(
-        "Cache revalidation failed, but data was saved successfully:",
-        error,
-      );
-    }
-
-    if (!updatedDoc.encrypted) {
-      await logContentEvent(
-        "note_updated",
-        "note",
-        note.uuid!,
-        updatedDoc.title,
-        true,
-        { category: updatedDoc.category },
-      );
-    }
-
-    await broadcast({
-      type: "note",
-      action: "updated",
-      entityId: updatedDoc.uuid,
-      username: actingUsername,
-    });
-
-    return {
-      success: true,
-      data: { ...updatedDoc, category: shownCategory },
-    };
-  } catch (error) {
-    console.error("Error updating note:", error);
-    const { title, uuid } = getFormData(formData, ["title", "uuid"]);
-    await logContentEvent(
-      "note_updated",
-      "note",
-      uuid!,
-      title || "unknown",
-      false,
-    );
-    return { error: "Failed to update note" };
-  }
-};
-
-export const deleteNote = async (formData: FormData, username?: string) => {
-  try {
-    const { uuid } = getFormData(formData, ["uuid"]);
-
-    let currentUser: any = null;
-    if (username) {
-      const { findUserRecord } =
-        await import("@/app/_server/actions/users/records");
-      const userResult = await findUserRecord(username);
-      if (userResult) {
-        currentUser = userResult;
-      }
-    }
-
-    if (!currentUser) {
-      currentUser = await getCurrentUser();
-    }
-
-    if (!currentUser) {
-      return { error: "Not authenticated" };
-    }
-
-    const note = await getNoteById(uuid!);
-
-    if (!note) {
-      return { error: "Document not found" };
-    }
-
-    const canDelete = await canReach(
-      note.uuid!,
-      "note",
-      currentUser.username,
-      PermissionTypes.DELETE,
-    );
-
-    if (!canDelete) {
-      return { error: "Permission denied" };
-    }
-
-    const ownerUsername = note.owner || currentUser.username;
-    const source = await targetDir(
-      Modes.NOTES,
-      currentUser.username,
-      note.category || "",
-    );
-
-    const verdict = await bouncer(
-      source,
-      currentUser.username,
-      PermissionTypes.DELETE,
-    );
-
-    if (!verdict.allowed) {
-      return { error: verdict.error };
-    }
-
-    const homeCategory = note.category || UNCATEGORIZED;
-    const ownerDir = NOTES_DIR(ownerUsername);
-    const filePath = path.join(ownerDir, homeCategory, `${note.id}.md`);
-
-    await serverDeleteFile(filePath);
-
-    if (!note.encrypted) {
-      const deleteRelativePath = path.join(homeCategory, `${note.id}.md`);
-      commitNote(
-        ownerUsername,
-        deleteRelativePath,
-        "delete",
-        note.title || note.id,
-      ).catch(() => {});
-    }
-
-    try {
-      revalidatePath("/");
-      revalidatePath(`/note/${note.uuid}`);
-    } catch (error) {
-      console.warn(
-        "Cache revalidation failed, but data was saved successfully:",
-        error,
-      );
-    }
-
-    await logContentEvent(
-      "note_deleted",
-      "note",
-      note.uuid!,
-      note.title!,
-      true,
-      { category: note.category },
-    );
-
-    await broadcast({
-      type: "note",
-      action: "deleted",
-      entityId: note.uuid,
-      username: currentUser.username,
-    });
-
-    return { success: true };
-  } catch (error) {
-    console.error("Error deleting note:", error);
-
-    const { uuid } = getFormData(formData, ["uuid"]);
-
-    let title = "unknown";
-    try {
-      const note = await getNoteById(uuid!);
-      title = note?.title || "unknown";
-    } catch (lookupError) {
-      console.warn(
-        "Failed to re-read note while logging deletion:",
-        lookupError,
-      );
-    }
-
-    await logContentEvent("note_deleted", "note", uuid!, title, false);
-    return { error: "Failed to delete note" };
-  }
-};
-
 export const cloneNote = async (formData: FormData) => {
   try {
     const uuid = formData.get("uuid") as string;
@@ -523,3 +149,26 @@ export const cloneNote = async (formData: FormData) => {
     return { error: "Failed to clone note" };
   }
 };
+
+export const updateNote = async (
+  formData: FormData,
+  autosaveNotes = false,
+) => {
+  const actor = await getCurrentUser();
+
+  if (!actor?.username) {
+    return { error: "Not authenticated" };
+  }
+
+  return editNote(actor, formData, autosaveNotes);
+};
+
+export const deleteNote = async (formData: FormData) => {
+  const actor = await getCurrentUser();
+
+  if (!actor?.username) {
+    return { error: "Not authenticated" };
+  }
+
+  return dropNote(actor, formData);
+};
diff --git a/app/_server/actions/note/editor.ts b/app/_server/actions/note/editor.ts
new file mode 100644
index 000000000..d3396677e
--- /dev/null
+++ b/app/_server/actions/note/editor.ts
@@ -0,0 +1,382 @@
+import path from "path";
+import { SanitisedUser } from "@/app/_types";
+import { generateUniqueFilename } from "@/app/_utils/filename-utils";
+import {
+  detectEncryptionMethod,
+  isEncrypted,
+} from "@/app/_utils/encryption-utils";
+import {
+  ensureDir,
+  serverDeleteFile,
+  serverWriteFile,
+} from "@/app/_server/actions/file";
+import { revalidatePath } from "next/cache";
+import { NOTES_DIR } from "@/app/_consts/files";
+import { PermissionTypes, Modes } from "@/app/_types/enums";
+import { sanitizeMarkdown } from "@/app/_utils/markdown-utils";
+import { extractHashtagsFromContent } from "@/app/_utils/tag-utils";
+import { getFormData } from "@/app/_utils/global-utils";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import {
+  refreshWikilinks,
+  tidyItemLinks,
+} from "@/app/_server/actions/relations/tidy";
+import { canReach } from "@/app/_server/actions/share/queries";
+import {
+  extractYamlMetadata as stripYaml,
+  strayMeta,
+  keptMeta,
+} from "@/app/_utils/yaml-metadata-utils";
+import { logContentEvent } from "@/app/_server/actions/log";
+import { commitNote } from "@/app/_server/actions/history";
+import { noteToMarkdown } from "./parsers";
+import { getNoteById } from "./queries";
+import {
+  targetDir,
+  bouncer,
+  shownAs,
+  movePlan,
+  refusalMessage,
+} from "@/app/_server/actions/share/target";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+
+const _noteDirFor = (owner: string, category?: string): string =>
+  path.join(process.cwd(), NOTES_DIR(owner), category || UNCATEGORIZED);
+
+const _editNote = async (
+  actor: SanitisedUser,
+  formData: FormData,
+  autosaveNotes: boolean,
+) => {
+  try {
+    const { title, content, category, uuid } = getFormData(formData, [
+      "title",
+      "content",
+      "category",
+      "uuid",
+    ]);
+
+    const actingUsername = actor.username;
+
+    if (!actingUsername) {
+      return { error: "Not authenticated" };
+    }
+
+    const note = await getNoteById(uuid);
+
+    if (!note) {
+      throw new Error("Note not found");
+    }
+
+    const canEdit = await canReach(
+      note.uuid!,
+      "note",
+      actingUsername,
+      PermissionTypes.EDIT,
+    );
+
+    if (!canEdit) {
+      return { error: "Permission denied" };
+    }
+
+    const shownSource = await shownAs(
+      Modes.NOTES,
+      actingUsername,
+      note.owner!,
+      note.category || "",
+    );
+
+    const shownCategory = category || shownSource;
+    const { home, destination, target, isMoving } = await movePlan(
+      Modes.NOTES,
+      actingUsername,
+      note,
+      shownCategory,
+    );
+
+    if (isMoving) {
+      const verdict = await bouncer(
+        target,
+        actingUsername,
+        PermissionTypes.CREATE,
+      );
+
+      if (!verdict.allowed) {
+        return { error: verdict.error };
+      }
+
+      const canRemove = await canReach(
+        note.uuid!,
+        "note",
+        actingUsername,
+        PermissionTypes.DELETE,
+      );
+
+      if (!canRemove) {
+        return { error: await refusalMessage() };
+      }
+    }
+
+    const sanitizedContent = sanitizeMarkdown(content);
+    const { metadata: incomingMeta, contentWithoutMetadata } =
+      stripYaml(sanitizedContent);
+    const convertedContent = isEncrypted(contentWithoutMetadata)
+      ? contentWithoutMetadata
+      : refreshWikilinks(
+          await tidyItemLinks(contentWithoutMetadata, note.owner || actingUsername),
+          note.uuid,
+        );
+
+    const encryptionMethod =
+      detectEncryptionMethod(convertedContent) || undefined;
+
+    const extractedTags = extractHashtagsFromContent(convertedContent);
+    const sortedTags = Array.from(new Set(extractedTags)).sort();
+
+    const updatedDoc = {
+      ...note,
+      title,
+      content: convertedContent,
+      category: destination.category,
+      owner: destination.owner,
+      updatedAt: new Date().toISOString(),
+      encrypted: isEncrypted(convertedContent),
+      encryptionMethod,
+      tags: sortedTags.length > 0 ? sortedTags : undefined,
+      extraMetadata: keptMeta(note.extraMetadata, strayMeta(incomingMeta)),
+    };
+
+    const sourceDir = _noteDirFor(home.owner, home.category);
+    const categoryDir = _noteDirFor(destination.owner, destination.category);
+    await ensureDir(categoryDir);
+
+    const currentId = note.id;
+    let newFilename: string;
+    let newId = currentId;
+
+    if (title !== note.title) {
+      const fileRenameMode = actor.fileRenameMode || "minimal";
+      newFilename = await generateUniqueFilename(
+        categoryDir,
+        title,
+        ".md",
+        fileRenameMode,
+      );
+      newId = path.basename(newFilename, ".md");
+    } else {
+      newFilename = `${currentId}.md`;
+    }
+
+    if (newId !== currentId) {
+      updatedDoc.id = newId;
+    }
+
+    const filePath = path.join(categoryDir, newFilename);
+
+    const oldFilePath =
+      isMoving || newId !== currentId
+        ? path.join(sourceDir, `${currentId}.md`)
+        : null;
+
+    await serverWriteFile(filePath, noteToMarkdown(updatedDoc));
+
+    if (!autosaveNotes && !updatedDoc.encrypted) {
+      const historyRelativePath = path.join(
+        updatedDoc.category || UNCATEGORIZED,
+        `${newId}.md`,
+      );
+
+      const historyAction = isMoving ? "move" : "update";
+
+      const historyMetadata = isMoving
+        ? {
+            oldCategory: home.category || UNCATEGORIZED,
+            newCategory: updatedDoc.category || UNCATEGORIZED,
+            oldPath: path.join(
+              home.category || UNCATEGORIZED,
+              `${currentId}.md`,
+            ),
+          }
+        : undefined;
+
+      commitNote(
+        destination.owner,
+        historyRelativePath,
+        historyAction,
+        title,
+        historyMetadata,
+      ).catch(() => {});
+    }
+
+    if (oldFilePath && oldFilePath !== filePath) {
+      await serverDeleteFile(oldFilePath);
+    }
+
+    try {
+      if (!autosaveNotes) {
+        revalidatePath("/");
+        revalidatePath(`/note/${note.uuid}`);
+      }
+    } catch (error) {
+      console.warn(
+        "Cache revalidation failed, but data was saved successfully:",
+        error,
+      );
+    }
+
+    if (!updatedDoc.encrypted) {
+      await logContentEvent(
+        "note_updated",
+        "note",
+        note.uuid!,
+        updatedDoc.title,
+        true,
+        { category: updatedDoc.category },
+      );
+    }
+
+    await broadcast({
+      type: "note",
+      action: "updated",
+      entityId: updatedDoc.uuid,
+      username: actingUsername,
+    });
+
+    return {
+      success: true,
+      data: { ...updatedDoc, category: shownCategory },
+    };
+  } catch (error) {
+    console.error("Error updating note:", error);
+    const { title, uuid } = getFormData(formData, ["title", "uuid"]);
+    await logContentEvent(
+      "note_updated",
+      "note",
+      uuid!,
+      title || "unknown",
+      false,
+    );
+    return { error: await failedWith(error, "Failed to update note") };
+  }
+};
+
+export const editNote = async (
+  actor: SanitisedUser,
+  formData: FormData,
+  autosaveNotes = false,
+) =>
+  runQueued(itemLane(Modes.NOTES, formData.get("uuid") as string), () =>
+    _editNote(actor, formData, autosaveNotes),
+  );
+
+export const dropNote = async (
+  currentUser: SanitisedUser,
+  formData: FormData,
+): Promise<{ success?: boolean; error?: string }> => {
+  try {
+    const { uuid } = getFormData(formData, ["uuid"]);
+
+    if (!currentUser?.username) {
+      return { error: "Not authenticated" };
+    }
+
+    const note = await getNoteById(uuid!);
+
+    if (!note) {
+      return { error: "Document not found" };
+    }
+
+    const canDelete = await canReach(
+      note.uuid!,
+      "note",
+      currentUser.username,
+      PermissionTypes.DELETE,
+    );
+
+    if (!canDelete) {
+      return { error: "Permission denied" };
+    }
+
+    const ownerUsername = note.owner || currentUser.username;
+    const source = await targetDir(
+      Modes.NOTES,
+      currentUser.username,
+      note.category || "",
+    );
+
+    const verdict = await bouncer(
+      source,
+      currentUser.username,
+      PermissionTypes.DELETE,
+    );
+
+    if (!verdict.allowed) {
+      return { error: verdict.error };
+    }
+
+    const homeCategory = note.category || UNCATEGORIZED;
+    const ownerDir = NOTES_DIR(ownerUsername);
+    const filePath = path.join(ownerDir, homeCategory, `${note.id}.md`);
+
+    await serverDeleteFile(filePath);
+
+    if (!note.encrypted) {
+      const deleteRelativePath = path.join(homeCategory, `${note.id}.md`);
+      commitNote(
+        ownerUsername,
+        deleteRelativePath,
+        "delete",
+        note.title || note.id,
+      ).catch(() => {});
+    }
+
+    try {
+      revalidatePath("/");
+      revalidatePath(`/note/${note.uuid}`);
+    } catch (error) {
+      console.warn(
+        "Cache revalidation failed, but data was saved successfully:",
+        error,
+      );
+    }
+
+    await logContentEvent(
+      "note_deleted",
+      "note",
+      note.uuid!,
+      note.title!,
+      true,
+      { category: note.category },
+    );
+
+    await broadcast({
+      type: "note",
+      action: "deleted",
+      entityId: note.uuid,
+      username: currentUser.username,
+    });
+
+    return { success: true };
+  } catch (error) {
+    console.error("Error deleting note:", error);
+
+    const { uuid } = getFormData(formData, ["uuid"]);
+
+    let title = "unknown";
+    try {
+      const note = await getNoteById(uuid!);
+      title = note?.title || "unknown";
+    } catch (lookupError) {
+      console.warn(
+        "Failed to re-read note while logging deletion:",
+        lookupError,
+      );
+    }
+
+    await logContentEvent("note_deleted", "note", uuid!, title, false);
+    return { error: await failedWith(error, "Failed to delete note") };
+  }
+};
+
diff --git a/app/_server/actions/note/index.ts b/app/_server/actions/note/index.ts
index bd4c8f914..8ed0af4d3 100644
--- a/app/_server/actions/note/index.ts
+++ b/app/_server/actions/note/index.ts
@@ -2,9 +2,4 @@ export { parseMarkdownNote, noteToMarkdown } from "./parsers";
 export { readNotesRecursively } from "./readers";
 export { CheckForNeedsMigration } from "./migration";
 export { createNote, updateNote, deleteNote, cloneNote } from "./crud";
-export {
-  getNoteById,
-  getUserNotes,
-  getAllNotes,
-  getNotesForDisplay,
-} from "./queries";
+export { viewNote, getNotesForDisplay } from "./viewer";
diff --git a/app/_server/actions/note/queries.ts b/app/_server/actions/note/queries.ts
index 8f9ad299e..836f074ca 100644
--- a/app/_server/actions/note/queries.ts
+++ b/app/_server/actions/note/queries.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import path from "path";
 import fs from "fs/promises";
 import { Note, User, GetNotesOptions } from "@/app/_types";
@@ -357,15 +355,3 @@ export const getUserNotes = async (options: GetNotesOptions = {}) => {
     return { success: false, error: "Failed to fetch notes" };
   }
 };
-
-export const getNotesForDisplay = async (
-  filter?: { type: "category" | "tag"; value: string } | null,
-  limit: number = 20,
-  offset: number = 0,
-) => {
-  return getUserNotes({
-    filter: filter || undefined,
-    limit,
-    offset: filter ? offset : undefined,
-  });
-};
diff --git a/app/_server/actions/note/readers.ts b/app/_server/actions/note/readers.ts
index 8b9d2e64a..81773d7c1 100644
--- a/app/_server/actions/note/readers.ts
+++ b/app/_server/actions/note/readers.ts
@@ -25,7 +25,7 @@ import { parseMarkdownNote } from "./parsers";
 import { Note } from "@/app/_types";
 import { promisify } from "util";
 import { exec } from "child_process";
-import { stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
+import { lacksUuid, stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
 const execAsync = promisify(exec);
@@ -272,7 +272,7 @@ export const readNotesRecursively = async (
             rawContent: content,
           };
         } else {
-          return parseMarkdownNote(
+          const note = parseMarkdownNote(
             content,
             id,
             categoryPath,
@@ -284,6 +284,8 @@ export const readNotesRecursively = async (
             },
             fileName,
           );
+          if (!lacksUuid(content)) return note;
+          return { ...note, uuid: (await stampUuid(filePath)) || note.uuid };
         }
       }
     } catch (e) {
diff --git a/app/_server/actions/note/viewer.ts b/app/_server/actions/note/viewer.ts
new file mode 100644
index 000000000..ad5f863d9
--- /dev/null
+++ b/app/_server/actions/note/viewer.ts
@@ -0,0 +1,38 @@
+"use server";
+
+import { Note } from "@/app/_types";
+import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
+import { canReach } from "@/app/_server/actions/share/queries";
+import { getNoteById, getUserNotes } from "./queries";
+
+export const viewNote = async (uuid: string): Promise<Note | undefined> => {
+  if (!uuid) return undefined;
+
+  const actor = await sessionActor();
+  if ("error" in actor) return undefined;
+
+  const seen = await getNoteById(uuid, actor.username);
+  if (seen) return seen;
+
+  const allowed = await canReach(
+    uuid,
+    ItemTypes.NOTE,
+    actor.username,
+    PermissionTypes.READ,
+  );
+
+  return allowed ? getNoteById(uuid) : undefined;
+};
+
+export const getNotesForDisplay = async (
+  filter?: { type: "category" | "tag"; value: string } | null,
+  limit: number = 20,
+  offset: number = 0,
+) => {
+  return getUserNotes({
+    filter: filter || undefined,
+    limit,
+    offset: filter ? offset : undefined,
+  });
+};
diff --git a/app/_server/actions/notifications/index.ts b/app/_server/actions/notifications/index.ts
index d2bf1bb23..e47414930 100644
--- a/app/_server/actions/notifications/index.ts
+++ b/app/_server/actions/notifications/index.ts
@@ -3,8 +3,8 @@
 import { AppNotification, AppNotificationData } from "@/app/_types";
 import { Modes, NotificationTargets } from "@/app/_types/enums";
 import { getCurrentUser } from "@/app/_server/actions/users";
-import { getListById } from "@/app/_server/actions/checklist";
-import { getNoteById } from "@/app/_server/actions/note";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { getNoteById } from "@/app/_server/actions/note/queries";
 import { mountsFor } from "@/app/_server/actions/share/mounts";
 import { notifyUser, readNotificationsForUser, writeNotificationsForUser } from "./internal";
 
diff --git a/app/_server/actions/relations/index.ts b/app/_server/actions/relations/index.ts
index 2d68c6fc6..c17de8745 100644
--- a/app/_server/actions/relations/index.ts
+++ b/app/_server/actions/relations/index.ts
@@ -9,7 +9,8 @@ import type { BrainGraph, ItemRelations } from "@/app/_types/relations";
 import { backlinksFor, graphFor, visibleItems } from "./queries";
 import { rebuildOwnerRelations, rebuildRelations } from "./indexer";
 import { relationsDb } from "./store";
-import { getNoteById, updateNote } from "@/app/_server/actions/note";
+import { updateNote } from "@/app/_server/actions/note";
+import { getNoteById } from "@/app/_server/actions/note/queries";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
 import { itemHref } from "@/app/_utils/global-utils";
diff --git a/app/_server/actions/relations/indexer.ts b/app/_server/actions/relations/indexer.ts
index e66d622a1..3be773ea7 100644
--- a/app/_server/actions/relations/indexer.ts
+++ b/app/_server/actions/relations/indexer.ts
@@ -7,6 +7,7 @@ import { isUuid } from "@/app/_consts/identity";
 import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
 import { isEncrypted } from "@/app/_utils/encryption-utils";
 import { singleFlight } from "@/app/_server/actions/lib/concurrency";
+import { pathUuid } from "@/app/_server/actions/lib/read-only";
 import { getAllFileStats } from "@/app/_server/actions/file";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { readLinks, titleKey } from "./parser";
@@ -131,7 +132,8 @@ export const indexItemFile = (
 
   const absPath = path.resolve(filePath);
   const { metadata, contentWithoutMetadata } = extractYamlMetadata(content);
-  const uuid = typeof metadata.uuid === "string" ? metadata.uuid.toLowerCase() : "";
+  const uuid =
+    typeof metadata.uuid === "string" ? metadata.uuid.toLowerCase() : pathUuid(absPath);
   if (!isUuid(uuid)) return null;
 
   const title =
diff --git a/app/_server/actions/relations/queries.ts b/app/_server/actions/relations/queries.ts
index 1d306eba5..768431391 100644
--- a/app/_server/actions/relations/queries.ts
+++ b/app/_server/actions/relations/queries.ts
@@ -1,5 +1,5 @@
-import { getUserNotes } from "@/app/_server/actions/note";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 import {
   BrainEdgeKinds,
diff --git a/app/_server/actions/reminders/scanner.ts b/app/_server/actions/reminders/scanner.ts
index bdc23b401..920b5be4f 100644
--- a/app/_server/actions/reminders/scanner.ts
+++ b/app/_server/actions/reminders/scanner.ts
@@ -6,12 +6,16 @@ import { exec } from "child_process";
 import { promisify } from "util";
 import { Item } from "@/app/_types";
 import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
-import { ChecklistsTypes, NotificationTargets } from "@/app/_types/enums";
+import { ChecklistsTypes, Modes, NotificationTargets } from "@/app/_types/enums";
 import { parseMarkdown, listToMarkdown } from "@/app/_utils/checklist-utils";
+import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+import { serverWriteFile } from "@/app/_server/actions/file";
 import { updateItem } from "@/app/_utils/item-tree-utils";
 import { notifyUser } from "@/app/_server/actions/notifications/internal";
 import { usersWithAccess } from "@/app/_server/actions/share/queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { grepExtractField } from "@/app/_utils/grep-utils";
 
 const _execAsync = promisify(exec);
 
@@ -47,6 +51,95 @@ const _collectDueItems = (items: Item[], now: number): Item[] => {
   return due;
 };
 
+const _remindFile = async (
+  filePath: string,
+  checklistsRoot: string,
+  now: number,
+): Promise<void> => {
+  const uuid = await grepExtractField(filePath, "uuid");
+  if (!uuid) {
+    console.warn(`[reminders] skipping list without uuid: ${filePath}`);
+    return;
+  }
+
+  await runQueued(itemLane(Modes.CHECKLISTS, uuid), async () => {
+    const relPath = path.relative(checklistsRoot, filePath);
+    const parts = relPath.split(path.sep);
+    if (parts.length < 2) return;
+
+    const owner = parts[0];
+    const filename = parts[parts.length - 1];
+    const listId = filename.replace(/\.md$/, "");
+    const category = parts.slice(1, -1).join("/") || "Uncategorized";
+
+    const content = await fs.readFile(filePath, "utf-8");
+    if (extractYamlMetadata(content).metadata.uuid !== uuid) return;
+
+    const stats = await fs.stat(filePath);
+    const list = parseMarkdown(
+      content,
+      listId,
+      category,
+      owner,
+      false,
+      { birthtime: stats.birthtime, mtime: stats.mtime },
+      filePath,
+    );
+
+    if (list.type !== ChecklistsTypes.KANBAN) return;
+
+    const dueItems = _collectDueItems(list.items, now);
+    if (dueItems.length === 0) return;
+
+    const sharees = await usersWithAccess(uuid);
+    const recipients = Array.from(new Set([owner, ...sharees]));
+
+    let updatedItems = list.items;
+    for (const item of dueItems) {
+      for (const username of recipients) {
+        await notifyUser(username, {
+          type: "reminder",
+          title: "",
+          message: "",
+          titleKey: "reminderTitle",
+          messageKey: "reminderMessage",
+          messageVars: {
+            task: item.text,
+            board: list.title,
+          },
+          data: {
+            itemId: list.uuid,
+            itemType: NotificationTargets.CHECKLIST,
+            taskId: item.id,
+          },
+        });
+      }
+
+      updatedItems = updateItem(updatedItems, item.id, (it) => ({
+        ...it,
+        reminder: it.reminder
+          ? { ...it.reminder, notified: true }
+          : undefined,
+      }));
+    }
+
+    const updatedList = {
+      ...list,
+      items: updatedItems,
+      updatedAt: new Date().toISOString(),
+    };
+
+    await serverWriteFile(filePath, listToMarkdown(updatedList));
+
+    await broadcast({
+      type: "checklist",
+      action: "updated",
+      entityId: updatedList.uuid,
+      username: owner,
+    });
+  });
+};
+
 export const scanReminders = async (): Promise<void> => {
   if (_isRunning) return;
   _isRunning = true;
@@ -71,85 +164,7 @@ export const scanReminders = async (): Promise<void> => {
 
     for (const filePath of files) {
       try {
-        const relPath = path.relative(checklistsRoot, filePath);
-        const parts = relPath.split(path.sep);
-        if (parts.length < 2) continue;
-
-        const owner = parts[0];
-        const filename = parts[parts.length - 1];
-        const listId = filename.replace(/\.md$/, "");
-        const category = parts.slice(1, -1).join("/") || "Uncategorized";
-
-        const content = await fs.readFile(filePath, "utf-8");
-        const stats = await fs.stat(filePath);
-        const list = parseMarkdown(
-          content,
-          listId,
-          category,
-          owner,
-          false,
-          { birthtime: stats.birthtime, mtime: stats.mtime },
-          filePath,
-        );
-
-        if (list.type !== ChecklistsTypes.KANBAN) continue;
-
-        const dueItems = _collectDueItems(list.items, now);
-        if (dueItems.length === 0) continue;
-
-        if (!list.uuid) {
-          console.warn(
-            `[reminders] skipping list without uuid: ${filePath}`,
-          );
-          continue;
-        }
-
-        const sharees = await usersWithAccess(list.uuid);
-        const recipients = Array.from(new Set([owner, ...sharees]));
-
-        let updatedItems = list.items;
-        for (const item of dueItems) {
-          for (const username of recipients) {
-            await notifyUser(username, {
-              type: "reminder",
-              title: "",
-              message: "",
-              titleKey: "reminderTitle",
-              messageKey: "reminderMessage",
-              messageVars: {
-                task: item.text,
-                board: list.title,
-              },
-              data: {
-                itemId: list.uuid,
-                itemType: NotificationTargets.CHECKLIST,
-                taskId: item.id,
-              },
-            });
-          }
-
-          updatedItems = updateItem(updatedItems, item.id, (it) => ({
-            ...it,
-            reminder: it.reminder
-              ? { ...it.reminder, notified: true }
-              : undefined,
-          }));
-        }
-
-        const updatedList = {
-          ...list,
-          items: updatedItems,
-          updatedAt: new Date().toISOString(),
-        };
-
-        await fs.writeFile(filePath, listToMarkdown(updatedList), "utf-8");
-
-        await broadcast({
-          type: "checklist",
-          action: "updated",
-          entityId: updatedList.uuid,
-          username: owner,
-        });
+        await _remindFile(filePath, checklistsRoot, now);
       } catch (err) {
         console.error(`[reminders] failed to process ${filePath}:`, err);
       }
diff --git a/app/_server/actions/share/category-info.ts b/app/_server/actions/share/category-info.ts
index 3f284a8ba..7175fe612 100644
--- a/app/_server/actions/share/category-info.ts
+++ b/app/_server/actions/share/category-info.ts
@@ -14,6 +14,12 @@ import {
   grepExtractFrontmatter,
 } from "@/app/_utils/grep-utils";
 import { runQueued } from "@/app/_server/actions/lib/concurrency";
+import {
+  isReadOnlyError,
+  isWritable,
+  pathUuid,
+  warnReadOnly,
+} from "@/app/_server/actions/lib/read-only";
 
 const _abs = (dirPath: string): string =>
   path.isAbsolute(dirPath) ? dirPath : path.join(process.cwd(), dirPath);
@@ -72,7 +78,11 @@ export const writeCatInfo = async (
     await fs.rename(tmpPath, finalPath);
     return true;
   } catch (error) {
-    console.error(`Error writing ${CATEGORY_INFO_FILE} in ${dirPath}:`, error);
+    if (isReadOnlyError(error)) {
+      warnReadOnly(dirPath);
+    } else {
+      console.error(`Error writing ${CATEGORY_INFO_FILE} in ${dirPath}:`, error);
+    }
     try {
       await fs.unlink(tmpPath);
     } catch {}
@@ -106,9 +116,14 @@ export const catUuid = async (dirPath: string): Promise<string> =>
     const info = await readCatInfo(dirPath);
     if (info.uuid) return info.uuid;
 
+    if (!(await isWritable(_abs(dirPath)))) {
+      warnReadOnly(dirPath);
+      return pathUuid(_abs(dirPath));
+    }
+
     const uuid = randomUUID();
-    await writeCatInfo(dirPath, { ...info, uuid });
-    return uuid;
+    const saved = await writeCatInfo(dirPath, { ...info, uuid });
+    return saved ? uuid : pathUuid(_abs(dirPath));
   });
 
 export const catDirByUuid = async (
diff --git a/app/_server/actions/stats/index.ts b/app/_server/actions/stats/index.ts
index 495b2fe97..601640856 100644
--- a/app/_server/actions/stats/index.ts
+++ b/app/_server/actions/stats/index.ts
@@ -1,7 +1,7 @@
 "use server";
 
-import { getUserNotes } from "@/app/_server/actions/note";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { isKanbanType, TaskStatus } from "@/app/_types/enums";
 import { Checklist, Result } from "@/app/_types";
diff --git a/app/_styles/globals.css b/app/_styles/globals.css
index 69a2cb6c2..dd7bfb87d 100644
--- a/app/_styles/globals.css
+++ b/app/_styles/globals.css
@@ -674,6 +674,19 @@ pre.text-foreground span,
     -webkit-overflow-scrolling: touch;
 }
 
+@media (max-width: 1023px) {
+  .jotty-quick-nav-gutter::after {
+    content: "";
+    display: block;
+    flex-shrink: 0;
+    height: var(--jotty-quick-nav-space, 0px);
+  }
+
+  .jotty-note-bar-gutter {
+    padding-bottom: var(--jotty-note-bar-space, 0px);
+  }
+}
+
 .jotty-x-scroll,
 .tableWrapper {
     max-width: 100%;
diff --git a/app/_translations/en.json b/app/_translations/en.json
index bfcb21dab..f753a413e 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -402,6 +402,7 @@
     "enterNoteTitle": "Enter note title...",
     "byType": "By type",
     "publiclySharedNote": "Publicly shared",
+    "sharedPubliclyBy": "This note is shared publicly by {owner}",
     "copyRawContent": "Copy markdown",
     "quickSave": "Quick Save",
     "noteNotFound": "Note not found",
@@ -415,9 +416,12 @@
     "readingTime": "{count, plural, one {# minute read} other {# minutes read}}",
     "tags": "Tags",
     "noTagsFound": "No tags found",
-    "searchTags": "Search tags..."
+    "searchTags": "Search tags...",
+    "createNoteFailed": "Could not create the note",
+    "createCategoryFailed": "Could not create the category, the note was not created"
   },
   "checklists": {
+    "sharedPubliclyBy": "This checklist is shared publicly by {owner}",
     "title": "Checklists",
     "allChecklists": "All Checklists",
     "completed": "Completed",
@@ -1157,6 +1161,7 @@
     "tryAgain": "Try again",
     "contactSupport": "Contact support",
     "invalidInput": "Invalid input",
+    "categoryOutOfBounds": "That category is outside your notes, so nothing was created",
     "requiredField": "This field is required",
     "emailInvalid": "Please enter a valid email",
     "passwordTooShort": "Password must be at least 8 characters",
@@ -1196,7 +1201,8 @@
     "anErrorOccurred": "An error occurred.",
     "deleteUserConfirmation": "Delete user \"{username}\"? This cannot be undone.",
     "userDeletedSuccessfully": "User deleted successfully!",
-    "failedToDeleteUser": "Failed to delete user"
+    "failedToDeleteUser": "Failed to delete user",
+    "readOnlyFolder": "This folder is read-only on the server, so the change could not be saved."
   },
   "pwa": {
     "installPromptTitle": "Install App",
@@ -1258,6 +1264,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Toggle rich editor mode",
     "toggleMarkdownMode": "Toggle markdown mode",
+    "quickControls": "Editor controls",
     "toggleBold": "Toggle bold",
     "toggleItalic": "Toggle italic",
     "toggleUnderline": "Toggle underline",
diff --git a/app/_types/enums.ts b/app/_types/enums.ts
index 1542f39e6..59bf6c706 100644
--- a/app/_types/enums.ts
+++ b/app/_types/enums.ts
@@ -90,3 +90,8 @@ export enum ProfileTabs {
   USER_PREFERENCES = "userPreferences",
   AUDIT_LOGS = "audit_logs",
 }
+
+export enum BottomBarSpaces {
+  QUICK_NAV = "--jotty-quick-nav-space",
+  NOTE_BAR = "--jotty-note-bar-space",
+}
diff --git a/app/_utils/base64-utils.ts b/app/_utils/base64-utils.ts
new file mode 100644
index 000000000..369658611
--- /dev/null
+++ b/app/_utils/base64-utils.ts
@@ -0,0 +1,42 @@
+const BINARY_CHUNK = 0x8000;
+const LATIN1_HIGH = /[\u0080-\u00ff]/;
+const BEYOND_LATIN1 = /[^\u0000-\u00ff]/;
+
+const strictUtf8 = new TextDecoder("utf-8", { fatal: true });
+
+const bytesToBinary = (bytes: Uint8Array): string => {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += BINARY_CHUNK) {
+    binary += String.fromCharCode(
+      ...Array.from(bytes.subarray(i, i + BINARY_CHUNK)),
+    );
+  }
+  return binary;
+};
+
+const binaryToBytes = (binary: string): Uint8Array =>
+  Uint8Array.from(binary, (char) => char.charCodeAt(0));
+
+const tryUtf8 = (bytes: Uint8Array): string | null => {
+  try {
+    return strictUtf8.decode(bytes);
+  } catch {
+    return null;
+  }
+};
+
+export const utf8ToBase64 = (text: string): string =>
+  btoa(bytesToBinary(new TextEncoder().encode(text)));
+
+export const base64ToText = (base64: string): string => {
+  const binary = atob(base64);
+  return tryUtf8(binaryToBytes(binary)) ?? binary;
+};
+
+export const repairMojibake = (text: string): string => {
+  if (!LATIN1_HIGH.test(text) || BEYOND_LATIN1.test(text)) return text;
+  return tryUtf8(binaryToBytes(text)) ?? text;
+};
+
+export const base64ToSvg = (base64: string): string =>
+  repairMojibake(base64ToText(base64));
diff --git a/app/_utils/checklist-utils.ts b/app/_utils/checklist-utils.ts
index 36946c37c..26b0c7354 100644
--- a/app/_utils/checklist-utils.ts
+++ b/app/_utils/checklist-utils.ts
@@ -81,6 +81,9 @@ export const getCompletionRate = (
   return Math.round((completed / total) * 100);
 };
 
+const _flatDescription = (text: string): string =>
+  text.replace(/\r?\n/g, "\\n").replace(/\|/g, "∣");
+
 export const parseMarkdown = (
   content: string,
   id: string,
@@ -421,7 +424,7 @@ const generateItemMarkdown = (
     }
 
     if (item.description) {
-      metadata.push(`description:${item.description.replace(/\|/g, "∣")}`);
+      metadata.push(`description:${_flatDescription(item.description)}`);
     }
 
     if (item.recurrence) {
@@ -504,7 +507,7 @@ const generateItemMarkdown = (
     const metadata: string[] = [];
 
     if (item.description) {
-      metadata.push(`description:${item.description.replace(/\|/g, "∣")}`);
+      metadata.push(`description:${_flatDescription(item.description)}`);
     }
 
     if (Object.keys(itemMetadata).length > 0) {
diff --git a/app/_utils/grep-utils.ts b/app/_utils/grep-utils.ts
index e254267f9..18982977c 100644
--- a/app/_utils/grep-utils.ts
+++ b/app/_utils/grep-utils.ts
@@ -15,6 +15,7 @@ import { exec, execFile } from "child_process";
 import { promisify } from "util";
 import path from "path";
 import yaml from "js-yaml";
+import { isPathUuid, pathUuid } from "@/app/_server/actions/lib/read-only";
 
 const execAsync = promisify(exec);
 const execFileAsync = promisify(execFile);
@@ -65,13 +66,46 @@ export const grepFindFileByField = async (
   }
 };
 
-export const grepFindFileByUuid = async (
+const _unstampedFiles = async (dir: string): Promise<string[]> => {
+  try {
+    const { stdout } = await execFileAsync("grep", [
+      "-rL",
+      "^uuid: ",
+      dir,
+      "--include=*.md",
+    ]);
+    return stdout.trim().split("\n").filter(Boolean);
+  } catch (error) {
+    const stdout = (error as { stdout?: unknown })?.stdout;
+    return typeof stdout === "string"
+      ? stdout.trim().split("\n").filter(Boolean)
+      : [];
+  }
+};
+
+const _findUnstamped = async (
   dir: string,
   uuid: string,
 ): Promise<GrepFileResult | null> => {
-  return grepFindFileByField(dir, "uuid", uuid);
+  if (!isPathUuid(uuid)) return null;
+
+  const match = (await _unstampedFiles(dir)).find(
+    (filePath) => pathUuid(filePath) === uuid,
+  );
+  if (!match) return null;
+
+  const parts = path.relative(dir, match).split(path.sep);
+  const id = path.basename(parts.pop() || "", ".md");
+  return { filePath: match, id, category: parts.join("/") };
 };
 
+export const grepFindFileByUuid = async (
+  dir: string,
+  uuid: string,
+): Promise<GrepFileResult | null> =>
+  (await grepFindFileByField(dir, "uuid", uuid)) ||
+  (await _findUnstamped(dir, uuid));
+
 export const grepFindFilesByField = async (
   dir: string,
   field: string,
diff --git a/app/_utils/kanban/board-utils.ts b/app/_utils/kanban/board-utils.ts
index 26dfdf0a9..da68bdbe8 100644
--- a/app/_utils/kanban/board-utils.ts
+++ b/app/_utils/kanban/board-utils.ts
@@ -36,6 +36,21 @@ export const getColumnItems = (
   });
 };
 
+export const boardColumns = (
+  checklist: Checklist,
+): { status: KanbanStatus; items: Item[] }[] => {
+  const statuses = checklist.statuses?.length
+    ? checklist.statuses
+    : DEFAULT_KANBAN_STATUSES;
+
+  return [...statuses]
+    .sort((a, b) => a.order - b.order)
+    .map((status) => ({
+      status,
+      items: getColumnItems(checklist.items, status.id, statuses),
+    }));
+};
+
 export const visToColIndex = (
   visibleItems: Item[],
   columnItems: Item[],
diff --git a/app/_utils/markdown-editor-utils.ts b/app/_utils/markdown-editor-utils.ts
index 2e0369b82..81b954a83 100644
--- a/app/_utils/markdown-editor-utils.ts
+++ b/app/_utils/markdown-editor-utils.ts
@@ -404,30 +404,91 @@ export const insertTable = (
   return insertTextAtCursor(ta, "\n" + head + sep + rows + "\n", "", "", 0);
 };
 
-export const isInBulletListItem = (textarea: HTMLTextAreaElement): boolean => {
-  const { start } = getTextareaSelection(textarea);
-  const { lineContent } = _getLineAtPosition(textarea.value, start);
-  return /^-\s/.test(lineContent);
+const LIST_ITEM_REGEX = /^(\s*)([-*+]|\d+\.)(\s+)(\[[ xX]\](?:\s+|$))?(.*)$/;
+const ORDERED_MARKER_REGEX = /^\d+\.$/;
+const LIST_INDENT = "    ";
+const EMPTY_TASK = "[ ] ";
+
+interface ListItemParts {
+  indent: string;
+  marker: string;
+  spacing: string;
+  task: string;
+  content: string;
+}
+
+const _parseListItem = (line: string): ListItemParts | null => {
+  const match = line.match(LIST_ITEM_REGEX);
+  if (!match) return null;
+  const [, indent, marker, spacing, task = "", content] = match;
+  return { indent, marker, spacing, task, content };
+};
+
+const _listPrefix = ({ indent, marker, spacing, task }: ListItemParts) =>
+  indent + marker + spacing + task;
+
+const _isOrdered = (marker: string) => ORDERED_MARKER_REGEX.test(marker);
+
+const _nextMarker = (marker: string) =>
+  _isOrdered(marker) ? `${parseInt(marker, 10) + 1}.` : marker;
+
+const _nestedMarker = (
+  value: string,
+  lineStart: number,
+  item: ListItemParts,
+  indent: string
+): string => {
+  if (!_isOrdered(item.marker)) return item.marker;
+  const above = value.substring(0, Math.max(0, lineStart - 1)).split("\n");
+  for (let i = above.length - 1; i >= 0; i--) {
+    const prev = _parseListItem(above[i]);
+    if (!prev || prev.indent.length < indent.length) break;
+    if (prev.indent.length === indent.length && _isOrdered(prev.marker)) {
+      return _nextMarker(prev.marker);
+    }
+  }
+  return "1.";
 };
 
-export const handleBulletListEnter = (
+export const handleListEnter = (
   textarea: HTMLTextAreaElement
 ): string | null => {
-  const { start } = getTextareaSelection(textarea);
+  const { start, end } = getTextareaSelection(textarea);
+  if (start !== end) return null;
   const { lineContent, lineStart } = _getLineAtPosition(textarea.value, start);
 
-  const match = lineContent.match(/^(\s*)(-\s+)(.*)/);
-  if (!match) return null;
+  const item = _parseListItem(lineContent);
+  if (!item || start - lineStart < _listPrefix(item).length) return null;
 
-  const [, indent, bullet, content] = match;
-  if (!content.trim()) {
+  if (!item.content.trim()) {
     const newVal =
       textarea.value.substring(0, lineStart) +
       textarea.value.substring(lineStart + lineContent.length);
     return _updateEditor(textarea, newVal, lineStart, lineStart);
   }
 
-  return insertTextAtCursor(textarea, "\n" + indent + bullet, "", "", 0);
+  const task = item.task ? EMPTY_TASK : "";
+  const prefix = item.indent + _nextMarker(item.marker) + item.spacing + task;
+  return insertTextAtCursor(textarea, "\n" + prefix, "", "", 0);
+};
+
+export const indentListItem = (
+  textarea: HTMLTextAreaElement
+): string | null => {
+  const { start, end } = getTextareaSelection(textarea);
+  if (start !== end) return null;
+  const value = textarea.value;
+  const { lineContent, lineStart, lineEnd } = _getLineAtPosition(value, start);
+
+  const item = _parseListItem(lineContent);
+  if (!item) return null;
+
+  const indent = item.indent + LIST_INDENT;
+  const marker = _nestedMarker(value, lineStart, item, indent);
+  const newLine = _listPrefix({ ...item, indent, marker }) + item.content;
+  const newVal = value.substring(0, lineStart) + newLine + value.substring(lineEnd);
+  const cursor = start + newLine.length - lineContent.length;
+  return _updateEditor(textarea, newVal, cursor, cursor);
 };
 
 export const indentLines = (textarea: HTMLTextAreaElement): string => {
@@ -462,27 +523,6 @@ export const outdentLines = (textarea: HTMLTextAreaElement): string => {
   return result;
 };
 
-export const handleOrderedListEnter = (
-  textarea: HTMLTextAreaElement
-): string | null => {
-  const { start } = getTextareaSelection(textarea);
-  const { lineContent, lineStart } = _getLineAtPosition(textarea.value, start);
-
-  const match = lineContent.match(/^(\s*)(\d+)\.(\s+)(.*)/);
-  if (!match) return null;
-
-  const [, indent, numStr, spacing, content] = match;
-  if (!content.trim()) {
-    const newVal =
-      textarea.value.substring(0, lineStart) +
-      textarea.value.substring(lineStart + lineContent.length);
-    return _updateEditor(textarea, newVal, lineStart, lineStart);
-  }
-
-  const nextNum = parseInt(numStr, 10) + 1;
-  return insertTextAtCursor(textarea, `\n${indent}${nextNum}.${spacing}`, "", "", 0);
-};
-
 export const autolinkPastedContent = (
   textarea: HTMLTextAreaElement,
   pasted: string
diff --git a/app/_utils/markdown-utils.tsx b/app/_utils/markdown-utils.tsx
index d5d4e1fe7..38a3521a6 100644
--- a/app/_utils/markdown-utils.tsx
+++ b/app/_utils/markdown-utils.tsx
@@ -18,31 +18,10 @@ import {
 } from "./item-href-utils";
 import { getContrastColor } from "./color-utils";
 import { matchCallout } from "./callout-utils";
+import { base64ToSvg, base64ToText, utf8ToBase64 } from "./base64-utils";
 
 const turndownPluginGfm = require("turndown-plugin-gfm");
 
-const utf8ToBase64 = (str: string): string => {
-  if (typeof Buffer !== "undefined") {
-    return Buffer.from(str, "utf8").toString("base64");
-  }
-  const bytes = new TextEncoder().encode(str);
-  let binary = "";
-  bytes.forEach((b) => { binary += String.fromCharCode(b); });
-  return btoa(binary);
-};
-
-const base64ToUtf8 = (str: string): string => {
-  if (typeof Buffer !== "undefined") {
-    return Buffer.from(str, "base64").toString("utf8");
-  }
-  const binary = atob(str);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return new TextDecoder().decode(bytes);
-};
-
 const hasComplexTableContent = (table: HTMLElement): boolean => {
   const complexSelectors = ["ul", "ol", "pre", "table", "details", "hr"];
 
@@ -69,6 +48,20 @@ const hasComplexTableContent = (table: HTMLElement): boolean => {
 };
 
 const WIKILINK_SPAN = /(!?\[\[[^\[\]\n]+\]\])/;
+const EMPTY_PARAGRAPH_MARK = "\u200b";
+
+const isBlankChar = (char: string) =>
+  char === EMPTY_PARAGRAPH_MARK || /\s/.test(char);
+
+const trimBlankTail = (text: string): string => {
+  let end = text.length;
+  while (end > 0 && isBlankChar(text[end - 1])) end--;
+  return text.slice(end).includes(EMPTY_PARAGRAPH_MARK)
+    ? text.slice(0, end)
+    : text;
+};
+
+const normalizeLineEndings = (text: string) => text.replace(/\r\n/g, "\n");
 
 export const createTurndownService = (tableSyntax?: TableSyntax) => {
   const service = new TurndownService({
@@ -82,7 +75,7 @@ export const createTurndownService = (tableSyntax?: TableSyntax) => {
         if (element.querySelector?.("img")) {
           return content;
         }
-        return "\u200b";
+        return EMPTY_PARAGRAPH_MARK;
       }
       return content;
     },
@@ -490,8 +483,8 @@ const markdownProcessor = unified()
               const themeMode = themeMatch ? themeMatch[1].trim() : "light";
 
               try {
-                const diagramData = base64ToUtf8(dataBase64);
-                const svgData = base64ToUtf8(svgBase64);
+                const diagramData = base64ToText(dataBase64);
+                const svgData = base64ToSvg(svgBase64);
 
                 node.type = "element";
                 node.tagName = "div";
@@ -508,6 +501,7 @@ const markdownProcessor = unified()
                   },
                 ];
               } catch (e) {
+                console.error("Failed to decode draw.io diagram:", e);
               }
             }
           }
@@ -522,8 +516,8 @@ const markdownProcessor = unified()
               const themeMode = themeMatch ? themeMatch[1].trim() : "light";
 
               try {
-                const diagramData = base64ToUtf8(dataBase64);
-                const svgData = svgBase64 ? base64ToUtf8(svgBase64) : "";
+                const diagramData = base64ToText(dataBase64);
+                const svgData = svgBase64 ? base64ToText(svgBase64) : "";
 
                 node.type = "element";
                 node.tagName = "div";
@@ -540,6 +534,7 @@ const markdownProcessor = unified()
                   },
                 ];
               } catch (e) {
+                console.error("Failed to decode excalidraw diagram:", e);
               }
             }
           }
@@ -770,24 +765,30 @@ const markdownProcessor = unified()
   })
   .use(rehypeStringify);
 
+const CODE_STASH_MARK = "\uE000";
+const CODE_STASH_REGEX = new RegExp(
+  `${CODE_STASH_MARK}(\\d+)${CODE_STASH_MARK}`,
+  "g"
+);
+
 export const convertMarkdownToHtml = (markdown: string): string => {
   if (!markdown || typeof markdown !== "string") return "";
 
   const codeBlockRegex = /```[\s\S]*?```|`[^`]+`/g;
   const codeBlocks: string[] = [];
-  let processed = markdown.replace(codeBlockRegex, (match) => {
+  const stashed = markdown.replace(codeBlockRegex, (match) => {
     codeBlocks.push(match);
-    return `__CODE_BLOCK_${codeBlocks.length - 1}__`;
+    return `${CODE_STASH_MARK}${codeBlocks.length - 1}${CODE_STASH_MARK}`;
   });
 
-  processed = processed.replace(
-    /(?:^|(?<=[\s(]))#([a-zA-Z][a-zA-Z0-9_/-]*)/g,
-    '<span data-tag="$1">$1</span>'
-  );
-
-  codeBlocks.forEach((block, i) => {
-    processed = processed.replace(`__CODE_BLOCK_${i}__`, block);
-  });
+  const processed = stashed
+    .replace(
+      /(?:^|(?<=[\s(]))#([a-zA-Z][a-zA-Z0-9_/-]*)/g,
+      '<span data-tag="$1">$1</span>'
+    )
+    .replace(CODE_STASH_REGEX, (match, index: string) =>
+      codeBlocks[Number(index)] ?? match
+    );
 
   const file = markdownProcessor.processSync(processed);
 
@@ -799,7 +800,7 @@ export const convertHtmlToMarkdown = (
   tableSyntax?: TableSyntax
 ): string => {
   const turndownService = createTurndownService(tableSyntax);
-  return turndownService.turndown(html);
+  return trimBlankTail(turndownService.turndown(html));
 };
 
 export const processMarkdownContent = (content: string): string => {
@@ -830,7 +831,7 @@ export const getMarkdownPreviewContent = (
 export const sanitizeMarkdown = (markdown: string): string => {
   if (!markdown || typeof markdown !== "string") return "";
 
-  let result = markdown.replace(
+  let result = trimBlankTail(normalizeLineEndings(markdown)).replace(
     /\\+\[(📎|🎥)\s+([^\]]+?)\\+\]\\+\(([^)]+?)\\+\)/g,
     "[$1 $2]($3)"
   );
diff --git a/app/_utils/menu-placement-utils.ts b/app/_utils/menu-placement-utils.ts
new file mode 100644
index 000000000..e775c7aad
--- /dev/null
+++ b/app/_utils/menu-placement-utils.ts
@@ -0,0 +1,139 @@
+export enum MenuSide {
+  Down = "down",
+  Up = "up",
+}
+
+export enum MenuAlign {
+  Start = "start",
+  End = "end",
+}
+
+export interface MenuPlacement {
+  side: MenuSide;
+  align: MenuAlign;
+}
+
+export interface MenuBox {
+  top: number;
+  right: number;
+  bottom: number;
+  left: number;
+}
+
+export interface MenuSize {
+  width: number;
+  height: number;
+}
+
+const HEADER_ATTR = "data-menu-ceiling";
+export const menuCeilingProps = { [HEADER_ATTR]: "" };
+const MENU_GAP = 4;
+
+const CLIPPING = new Set(["hidden", "clip", "auto", "scroll"]);
+const STUCK = new Set(["fixed", "sticky"]);
+
+const pick = <T>(
+  preferred: T,
+  other: T,
+  room: (choice: T) => number,
+  needed: number,
+): T => {
+  if (room(preferred) >= needed) return preferred;
+  if (room(other) >= needed) return other;
+  return room(other) > room(preferred) ? other : preferred;
+};
+
+export const placeMenu = (
+  anchor: MenuBox,
+  menu: MenuSize,
+  bounds: MenuBox,
+  preferred: MenuPlacement,
+): MenuPlacement => {
+  const sideRoom = (side: MenuSide) =>
+    side === MenuSide.Down
+      ? bounds.bottom - anchor.bottom - MENU_GAP
+      : anchor.top - bounds.top - MENU_GAP;
+  const alignRoom = (align: MenuAlign) =>
+    align === MenuAlign.Start
+      ? bounds.right - anchor.left
+      : anchor.right - bounds.left;
+
+  const flipSide =
+    preferred.side === MenuSide.Down ? MenuSide.Up : MenuSide.Down;
+  const flipAlign =
+    preferred.align === MenuAlign.Start ? MenuAlign.End : MenuAlign.Start;
+
+  return {
+    side: pick(preferred.side, flipSide, sideRoom, menu.height),
+    align: pick(preferred.align, flipAlign, alignRoom, menu.width),
+  };
+};
+
+const viewportBox = (): MenuBox => {
+  const vv = window.visualViewport;
+  if (!vv) {
+    return {
+      top: 0,
+      left: 0,
+      right: window.innerWidth,
+      bottom: window.innerHeight,
+    };
+  }
+  return {
+    top: vv.offsetTop,
+    left: vv.offsetLeft,
+    right: vv.offsetLeft + vv.width,
+    bottom: vv.offsetTop + vv.height,
+  };
+};
+
+const clipToAncestors = (anchor: HTMLElement, box: MenuBox): MenuBox => {
+  const clipped = { ...box };
+  let node = anchor.parentElement;
+
+  while (node && node !== document.body) {
+    const style = window.getComputedStyle(node);
+    const clipsX = CLIPPING.has(style.overflowX);
+    const clipsY = CLIPPING.has(style.overflowY);
+
+    if (clipsX || clipsY) {
+      const rect = node.getBoundingClientRect();
+      if (clipsX) {
+        clipped.left = Math.max(clipped.left, rect.left);
+        clipped.right = Math.min(clipped.right, rect.right);
+      }
+      if (clipsY) {
+        clipped.top = Math.max(clipped.top, rect.top);
+        clipped.bottom = Math.min(clipped.bottom, rect.bottom);
+      }
+    }
+    node = node.parentElement;
+  }
+
+  return clipped;
+};
+
+const belowHeaders = (anchor: HTMLElement, box: MenuBox): MenuBox => {
+  const anchorTop = anchor.getBoundingClientRect().top;
+  let top = box.top;
+
+  document.querySelectorAll<HTMLElement>(`[${HEADER_ATTR}]`).forEach((el) => {
+    if (el.contains(anchor)) return;
+    if (!STUCK.has(window.getComputedStyle(el).position)) return;
+    const rect = el.getBoundingClientRect();
+    if (rect.height > 0 && rect.bottom <= anchorTop) {
+      top = Math.max(top, rect.bottom);
+    }
+  });
+
+  return { ...box, top };
+};
+
+export const menuBounds = (anchor: HTMLElement): MenuBox =>
+  belowHeaders(anchor, clipToAncestors(anchor, viewportBox()));
+
+export const menuPlacementClasses = ({ side, align }: MenuPlacement) =>
+  [
+    side === MenuSide.Up ? "bottom-full mb-1" : "top-full mt-1",
+    align === MenuAlign.End ? "right-0" : "left-0",
+  ].join(" ");
diff --git a/app/_utils/return-path-store.ts b/app/_utils/return-path-store.ts
new file mode 100644
index 000000000..7c0e6e57f
--- /dev/null
+++ b/app/_utils/return-path-store.ts
@@ -0,0 +1,20 @@
+import { create } from "zustand";
+import { createJSONStorage, persist } from "zustand/middleware";
+
+interface ReturnPathState {
+  returnPath: string | null;
+  setReturnPath: (path: string) => void;
+}
+
+export const useReturnPathStore = create<ReturnPathState>()(
+  persist(
+    (set) => ({
+      returnPath: null,
+      setReturnPath: (returnPath) => set({ returnPath }),
+    }),
+    {
+      name: "return-path",
+      storage: createJSONStorage(() => sessionStorage),
+    },
+  ),
+);
diff --git a/app/_utils/url-transform-utils.ts b/app/_utils/url-transform-utils.ts
new file mode 100644
index 000000000..79e60fe3d
--- /dev/null
+++ b/app/_utils/url-transform-utils.ts
@@ -0,0 +1,6 @@
+import { defaultUrlTransform } from "react-markdown";
+
+const DIALABLE_PROTOCOL = /^(tel|sms):/i;
+
+export const noteUrlTransform = (url: string): string =>
+  DIALABLE_PROTOCOL.test(url) ? url : defaultUrlTransform(url);
diff --git a/app/api/checklists/[listId]/items/[itemIndex]/check/route.ts b/app/api/checklists/[listId]/items/[itemIndex]/check/route.ts
index de284a494..c1628d4f8 100644
--- a/app/api/checklists/[listId]/items/[itemIndex]/check/route.ts
+++ b/app/api/checklists/[listId]/items/[itemIndex]/check/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { updateItem } from "@/app/_server/actions/checklist-item";
-import { getListById } from "@/app/_server/actions/checklist";
+import { editItem } from "@/app/_server/actions/checklist-item/editor";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 
 export const dynamic = "force-dynamic";
 
@@ -54,7 +54,7 @@ export async function PUT(
       formData.append("itemId", item.id);
       formData.append("completed", "true");
 
-      const result = await updateItem(list, formData, user.username, true);
+      const result = await editItem(user, list, formData, true);
 
       if (!result.success) {
         return NextResponse.json(
diff --git a/app/api/checklists/[listId]/items/[itemIndex]/route.ts b/app/api/checklists/[listId]/items/[itemIndex]/route.ts
index 7637c7665..82a0bfc20 100644
--- a/app/api/checklists/[listId]/items/[itemIndex]/route.ts
+++ b/app/api/checklists/[listId]/items/[itemIndex]/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
-import { updateItem } from "@/app/_server/actions/checklist-item";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { editItem } from "@/app/_server/actions/checklist-item/editor";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import path from "path";
@@ -174,7 +174,7 @@ export async function PATCH(
           estimatedTime === null ? "" : String(estimatedTime),
         );
 
-      const result = await updateItem(list, formData, user.username, true);
+      const result = await editItem(user, list, formData, true);
 
       if (!result.success) {
         return NextResponse.json(
diff --git a/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route.ts b/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route.ts
index 90889d076..de02ef504 100644
--- a/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route.ts
+++ b/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { updateItem } from "@/app/_server/actions/checklist-item";
-import { getListById } from "@/app/_server/actions/checklist";
+import { editItem } from "@/app/_server/actions/checklist-item/editor";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 
 export const dynamic = "force-dynamic";
 
@@ -54,7 +54,7 @@ export async function PUT(
       formData.append("itemId", item.id);
       formData.append("completed", "false");
 
-      const result = await updateItem(list, formData, user.username, true);
+      const result = await editItem(user, list, formData, true);
 
       if (!result.success) {
         return NextResponse.json(
diff --git a/app/api/checklists/[listId]/items/reorder/route.ts b/app/api/checklists/[listId]/items/reorder/route.ts
index 9d02062d7..a19e9be07 100644
--- a/app/api/checklists/[listId]/items/reorder/route.ts
+++ b/app/api/checklists/[listId]/items/reorder/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { revalidatePath } from "next/cache";
 import { withApiAuth } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { serverWriteFile, ensureDir } from "@/app/_server/actions/file";
 import { canReach } from "@/app/_server/actions/share/queries";
diff --git a/app/api/checklists/[listId]/items/route.ts b/app/api/checklists/[listId]/items/route.ts
index fbfdc66c2..73386cba5 100644
--- a/app/api/checklists/[listId]/items/route.ts
+++ b/app/api/checklists/[listId]/items/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { createItem } from "@/app/_server/actions/checklist-item";
-import { getListById } from "@/app/_server/actions/checklist";
+import { addItem } from "@/app/_server/actions/checklist-item/editor";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import path from "path";
@@ -128,7 +128,7 @@ export async function POST(
         );
       }
 
-      const result = await createItem(list, formData, user.username, true);
+      const result = await addItem(user, list, formData, true);
 
       if (!result.success) {
         return NextResponse.json(
diff --git a/app/api/checklists/[listId]/route.ts b/app/api/checklists/[listId]/route.ts
index 49879a844..58c851b96 100644
--- a/app/api/checklists/[listId]/route.ts
+++ b/app/api/checklists/[listId]/route.ts
@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById, updateList, deleteList } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { dropList, editList } from "@/app/_server/actions/checklist/editor";
 
 export const dynamic = "force-dynamic";
 
@@ -21,9 +22,7 @@ export async function PUT(request: NextRequest, props: { params: Promise<{ listI
       formData.append("uuid", list.uuid!);
       formData.append("title", title ?? list.title);
       formData.append("category", category ?? list.category ?? "Uncategorized");
-      formData.append("apiUser", JSON.stringify(user));
-
-      const result = await updateList(formData);
+      const result = await editList(user, formData);
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
       }
@@ -60,9 +59,7 @@ export async function DELETE(request: NextRequest, props: { params: Promise<{ li
 
       const formData = new FormData();
       formData.append("uuid", list.uuid!);
-      formData.append("apiUser", JSON.stringify(user));
-
-      const result = await deleteList(formData);
+      const result = await dropList(user, formData);
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
       }
diff --git a/app/api/checklists/route.ts b/app/api/checklists/route.ts
index 0c04aad10..a906d3f71 100644
--- a/app/api/checklists/route.ts
+++ b/app/api/checklists/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth } from "@/app/_utils/api-utils";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { makeList } from "@/app/_server/actions/checklist/creator";
 import { ChecklistsTypes, isKanbanType } from "@/app/_types/enums";
 import { Checklist, Result } from "@/app/_types";
diff --git a/app/api/kanban/[boardId]/calendar/route.ts b/app/api/kanban/[boardId]/calendar/route.ts
index 94a16c4f3..f46d33d34 100644
--- a/app/api/kanban/[boardId]/calendar/route.ts
+++ b/app/api/kanban/[boardId]/calendar/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import {
   generateICS,
   parseItemsForCalendar,
diff --git a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
index 732ee095c..d3082375e 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { assignKanbanItem } from "@/app/_server/actions/kanban/items";
 import { isKanbanType } from "@/app/_types/enums";
 
diff --git a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
index 779f7312e..dd2c0aaa0 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { setKanbanItemReminder } from "@/app/_server/actions/kanban/items";
 import { isKanbanType } from "@/app/_types/enums";
 
diff --git a/app/api/kanban/[boardId]/items/[itemId]/route.ts b/app/api/kanban/[boardId]/items/[itemId]/route.ts
index 8720049c3..eea381273 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/route.ts
@@ -1,7 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
-import { updateItem, deleteItem } from "@/app/_server/actions/checklist-item";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { deleteItem } from "@/app/_server/actions/checklist-item";
+import { editItem } from "@/app/_server/actions/checklist-item/editor";
 import { isKanbanType } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
@@ -38,7 +39,7 @@ export async function PUT(
       if (reminder !== undefined)
         formData.append("reminder", JSON.stringify(reminder));
 
-      const result = await updateItem(board, formData, user.username);
+      const result = await editItem(user, board, formData);
 
       if (!result.success) {
         return NextResponse.json(
diff --git a/app/api/kanban/[boardId]/items/[itemId]/status/route.ts b/app/api/kanban/[boardId]/items/[itemId]/status/route.ts
index 0917d7c0e..5f8f58f91 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/status/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/status/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
-import { updateItemStatus } from "@/app/_server/actions/checklist-item";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { stampStatus } from "@/app/_server/actions/checklist-item/stamper";
 import { isKanbanType } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
@@ -40,9 +40,8 @@ export async function PUT(
       formData.append("uuid", board.uuid!);
       formData.append("itemId", params.itemId);
       formData.append("status", status);
-      formData.append("username", user.username);
 
-      const result = await updateItemStatus(formData, user.username);
+      const result = await stampStatus(user, formData);
 
       if (!result.success) {
         return NextResponse.json(
diff --git a/app/api/kanban/[boardId]/items/route.ts b/app/api/kanban/[boardId]/items/route.ts
index 70383e0a5..f681b069d 100644
--- a/app/api/kanban/[boardId]/items/route.ts
+++ b/app/api/kanban/[boardId]/items/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
-import { createItem } from "@/app/_server/actions/checklist-item";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { addItem } from "@/app/_server/actions/checklist-item/editor";
 import { isKanbanType } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
@@ -41,7 +41,7 @@ export async function POST(
       if (status) formData.append("status", status);
       if (description) formData.append("description", description);
 
-      const result = await createItem(board, formData, user.username);
+      const result = await addItem(user, board, formData);
 
       if (!result.success || !result.data) {
         return NextResponse.json(
diff --git a/app/api/kanban/[boardId]/route.ts b/app/api/kanban/[boardId]/route.ts
index 52aa74284..f5e1d04cb 100644
--- a/app/api/kanban/[boardId]/route.ts
+++ b/app/api/kanban/[boardId]/route.ts
@@ -1,10 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import {
-  getListById,
-  updateList,
-  deleteList,
-} from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { dropList, editList } from "@/app/_server/actions/checklist/editor";
 import { isKanbanType } from "@/app/_types/enums";
 import { transformBoard } from "@/app/_utils/kanban/api-transforms";
 
@@ -71,9 +68,7 @@ export async function PUT(
         "category",
         category ?? board.category ?? "Uncategorized",
       );
-      formData.append("apiUser", JSON.stringify(user));
-
-      const result = await updateList(formData);
+      const result = await editList(user, formData);
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
       }
@@ -111,9 +106,7 @@ export async function DELETE(
 
       const formData = new FormData();
       formData.append("uuid", board.uuid!);
-      formData.append("apiUser", JSON.stringify(user));
-
-      const result = await deleteList(formData);
+      const result = await dropList(user, formData);
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
       }
diff --git a/app/api/kanban/[boardId]/statuses/route.ts b/app/api/kanban/[boardId]/statuses/route.ts
index 840fd1acb..a4e606b67 100644
--- a/app/api/kanban/[boardId]/statuses/route.ts
+++ b/app/api/kanban/[boardId]/statuses/route.ts
@@ -1,9 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import {
-  getListById,
-  updateChecklistStatuses,
-} from "@/app/_server/actions/checklist";
+import { updateChecklistStatuses } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { isKanbanType } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
@@ -41,7 +39,6 @@ export async function PUT(
       const formData = new FormData();
       formData.append("uuid", board.uuid!);
       formData.append("statusesStr", JSON.stringify(statuses));
-      formData.append("apiUser", JSON.stringify(user));
 
       const result = await updateChecklistStatuses(formData);
 
diff --git a/app/api/kanban/route.ts b/app/api/kanban/route.ts
index 7667ad1ef..5abaed834 100644
--- a/app/api/kanban/route.ts
+++ b/app/api/kanban/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth } from "@/app/_utils/api-utils";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { makeList } from "@/app/_server/actions/checklist/creator";
 import { isKanbanType } from "@/app/_types/enums";
 import { Checklist, Result } from "@/app/_types";
diff --git a/app/api/notes/[noteId]/route.ts b/app/api/notes/[noteId]/route.ts
index 7c20ab8d9..d2be8130f 100644
--- a/app/api/notes/[noteId]/route.ts
+++ b/app/api/notes/[noteId]/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth } from "@/app/_utils/api-utils";
-import { updateNote, deleteNote } from "@/app/_server/actions/note";
+import { dropNote, editNote } from "@/app/_server/actions/note/editor";
 import { resolveApiId } from "@/app/_server/actions/lib/legacy-lookup";
 import { Modes } from "@/app/_types/enums";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
@@ -30,7 +30,7 @@ export async function GET(request: NextRequest, props: { params: Promise<{ noteI
     return withApiAuth(request, async (user) => {
         try {
             const uuid = await _noteUuid(request, params.noteId, user.username);
-            const { getNoteById } = await import("@/app/_server/actions/note");
+            const { getNoteById } = await import("@/app/_server/actions/note/queries");
             const note = uuid ? await getNoteById(uuid, user.username) : undefined;
 
             if (!note) {
@@ -67,7 +67,7 @@ export async function PUT(request: NextRequest, props: { params: Promise<{ noteI
             const { title, content, category } = body;
 
             const uuid = await _noteUuid(request, params.noteId, user.username);
-            const { getUserNotes } = await import("@/app/_server/actions/note");
+            const { getUserNotes } = await import("@/app/_server/actions/note/queries");
             const notes = await getUserNotes({ username: user.username });
 
             if (!notes.success || !notes.data) {
@@ -87,9 +87,7 @@ export async function PUT(request: NextRequest, props: { params: Promise<{ noteI
             formData.append("title", title ?? note.title);
             formData.append("content", content ?? note.content ?? "");
             formData.append("category", category ?? note.category ?? UNCATEGORIZED);
-            formData.append("user", user.username);
-
-            const result = await updateNote(formData);
+            const result = await editNote(user, formData);
             if (result.error) {
                 return NextResponse.json({ error: result.error }, { status: 400 });
             }
@@ -120,7 +118,7 @@ export async function DELETE(request: NextRequest, props: { params: Promise<{ no
     return withApiAuth(request, async (user) => {
         try {
             const uuid = await _noteUuid(request, params.noteId, user.username);
-            const { getUserNotes } = await import("@/app/_server/actions/note");
+            const { getUserNotes } = await import("@/app/_server/actions/note/queries");
             const notes = await getUserNotes({ username: user.username });
 
             if (!notes.success || !notes.data) {
@@ -138,7 +136,7 @@ export async function DELETE(request: NextRequest, props: { params: Promise<{ no
             const formData = new FormData();
             formData.append("uuid", note.uuid!);
 
-            const result = await deleteNote(formData, user.username);
+            const result = await dropNote(user, formData);
             if (result.error) {
                 return NextResponse.json({ error: result.error }, { status: 400 });
             }
diff --git a/app/api/notes/route.ts b/app/api/notes/route.ts
index 6124e7686..22b90c286 100644
--- a/app/api/notes/route.ts
+++ b/app/api/notes/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth } from "@/app/_utils/api-utils";
-import { getUserNotes } from "@/app/_server/actions/note";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
 import { makeNote } from "@/app/_server/actions/note/creator";
 
 export const dynamic = "force-dynamic";
diff --git a/app/api/summary/route.ts b/app/api/summary/route.ts
index ac347284d..4205d7360 100644
--- a/app/api/summary/route.ts
+++ b/app/api/summary/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth } from "@/app/_utils/api-utils";
-import { getUserNotes } from "@/app/_server/actions/note";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { Checklist, Result } from "@/app/_types";
 import { isKanbanType, TaskStatus } from "@/app/_types/enums";
 
diff --git a/app/api/tasks/[taskId]/items/[itemIndex]/route.ts b/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
index 41fdbff83..4eb73437e 100644
--- a/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
+++ b/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import path from "path";
diff --git a/app/api/tasks/[taskId]/items/[itemIndex]/status/route.ts b/app/api/tasks/[taskId]/items/[itemIndex]/status/route.ts
index 670a52894..005823bc1 100644
--- a/app/api/tasks/[taskId]/items/[itemIndex]/status/route.ts
+++ b/app/api/tasks/[taskId]/items/[itemIndex]/status/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
-import { updateItemStatus } from "@/app/_server/actions/checklist-item";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { stampStatus } from "@/app/_server/actions/checklist-item/stamper";
 import { isKanbanType } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
@@ -69,9 +69,8 @@ export async function PUT(
       formData.append("uuid", task.uuid!);
       formData.append("itemId", item.id);
       formData.append("status", status);
-      formData.append("username", user.username);
 
-      const result = await updateItemStatus(formData, user.username);
+      const result = await stampStatus(user, formData);
 
       if (!result.success) {
         return NextResponse.json(
diff --git a/app/api/tasks/[taskId]/items/route.ts b/app/api/tasks/[taskId]/items/route.ts
index c4bcc7d89..117aef521 100644
--- a/app/api/tasks/[taskId]/items/route.ts
+++ b/app/api/tasks/[taskId]/items/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { createItem } from "@/app/_server/actions/checklist-item";
-import { getListById } from "@/app/_server/actions/checklist";
+import { addItem } from "@/app/_server/actions/checklist-item/editor";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import { isKanbanType, TaskStatus } from "@/app/_types/enums";
@@ -128,7 +128,7 @@ export async function POST(
       formData.append("text", text);
       formData.append("status", status || TaskStatus.TODO);
 
-      const result = await createItem(task, formData, user.username, true);
+      const result = await addItem(user, task, formData, true);
 
       if (!result.success) {
         return NextResponse.json(
diff --git a/app/api/tasks/[taskId]/route.ts b/app/api/tasks/[taskId]/route.ts
index 4d858822a..7740ee532 100644
--- a/app/api/tasks/[taskId]/route.ts
+++ b/app/api/tasks/[taskId]/route.ts
@@ -1,10 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import {
-  getListById,
-  updateList,
-  deleteList,
-} from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { dropList, editList } from "@/app/_server/actions/checklist/editor";
 import { isKanbanType } from "@/app/_types/enums";
 import { toApiItem } from "@/app/_utils/api-item";
 
@@ -82,9 +79,7 @@ export async function PUT(
       formData.append("uuid", task.uuid!);
       formData.append("title", title ?? task.title);
       formData.append("category", category ?? task.category ?? "Uncategorized");
-      formData.append("apiUser", JSON.stringify(user));
-
-      const result = await updateList(formData);
+      const result = await editList(user, formData);
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
       }
@@ -135,9 +130,7 @@ export async function DELETE(
 
       const formData = new FormData();
       formData.append("uuid", task.uuid!);
-      formData.append("apiUser", JSON.stringify(user));
-
-      const result = await deleteList(formData);
+      const result = await dropList(user, formData);
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
       }
diff --git a/app/api/tasks/[taskId]/statuses/[statusId]/route.ts b/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
index 181befe75..9b39e7016 100644
--- a/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
+++ b/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import path from "path";
diff --git a/app/api/tasks/[taskId]/statuses/route.ts b/app/api/tasks/[taskId]/statuses/route.ts
index cbcb293fd..393256072 100644
--- a/app/api/tasks/[taskId]/statuses/route.ts
+++ b/app/api/tasks/[taskId]/statuses/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import path from "path";
diff --git a/app/api/tasks/route.ts b/app/api/tasks/route.ts
index 62299b248..93e18cedc 100644
--- a/app/api/tasks/route.ts
+++ b/app/api/tasks/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth } from "@/app/_utils/api-utils";
-import { getUserChecklists } from "@/app/_server/actions/checklist";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { makeList } from "@/app/_server/actions/checklist/creator";
 import { isKanbanType } from "@/app/_types/enums";
 import { Checklist, Result } from "@/app/_types";
diff --git a/app/layout.tsx b/app/layout.tsx
index d623c8b5d..5feaf2776 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -26,8 +26,8 @@ import {
   rgbToHex,
 } from "./_consts/themes";
 import { loadCustomThemes } from "./_server/actions/config";
-import { getUserChecklists } from "./_server/actions/checklist";
-import { getUserNotes } from "./_server/actions/note";
+import { getUserChecklists } from "./_server/actions/checklist/queries";
+import { getUserNotes } from "./_server/actions/note/queries";
 
 import SuppressWarnings from "./_components/GlobalComponents/Layout/SuppressWarnings";
 import {
diff --git a/app/public/checklist/[uuid]/page.tsx b/app/public/checklist/[uuid]/page.tsx
index f2a305067..f9ec21b9d 100644
--- a/app/public/checklist/[uuid]/page.tsx
+++ b/app/public/checklist/[uuid]/page.tsx
@@ -1,5 +1,5 @@
 import { redirect, permanentRedirect } from "next/navigation";
-import { getListById } from "@/app/_server/actions/checklist";
+import { getListById } from "@/app/_server/actions/checklist/queries";
 import { isUuid } from "@/app/_consts/identity";
 import { PublicChecklistView } from "@/app/_components/FeatureComponents/PublicView/PublicChecklistView";
 import { CheckForNeedsMigration } from "@/app/_server/actions/note";
@@ -67,6 +67,7 @@ export default async function PublicChecklistPage(
     userRecord,
     !!isEnvEnabled(process.env.SERVE_PUBLIC_IMAGES),
   );
+  const ownerShowsEmojis = userRecord?.showChecklistEmojis !== "disable";
 
   const isPubliclyShared = await isPublicItem(
     checklist.uuid!,
@@ -90,7 +91,11 @@ export default async function PublicChecklistPage(
     return (
       <MetadataProvider metadata={metadata}>
         <PermissionsProvider item={checklist}>
-          <PublicChecklistView checklist={checklist} user={user} />
+          <PublicChecklistView
+            checklist={checklist}
+            user={user}
+            ownerShowsEmojis={ownerShowsEmojis}
+          />
         </PermissionsProvider>
       </MetadataProvider>
     );
diff --git a/app/public/note/[uuid]/page.tsx b/app/public/note/[uuid]/page.tsx
index a740f0aee..2c7ae55de 100644
--- a/app/public/note/[uuid]/page.tsx
+++ b/app/public/note/[uuid]/page.tsx
@@ -1,5 +1,5 @@
 import { redirect, permanentRedirect } from "next/navigation";
-import { getNoteById } from "@/app/_server/actions/note";
+import { getNoteById } from "@/app/_server/actions/note/queries";
 import { isUuid } from "@/app/_consts/identity";
 import { PublicNoteView } from "@/app/_components/FeatureComponents/PublicView/PublicNoteView";
 import { getCurrentUser } from "@/app/_server/actions/users";
diff --git a/howto/SHORTCUTS.md b/howto/SHORTCUTS.md
index e0c8fc17a..3352835bd 100644
--- a/howto/SHORTCUTS.md
+++ b/howto/SHORTCUTS.md
@@ -12,7 +12,7 @@ Global shortcuts work anywhere in the app. Editor and table shortcuts only work
 | <kbd>⌘ Cmd</kbd> + <kbd>K</kbd>                                          | Open the search palette                                        |
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>N</kbd> | Create a new note or checklist, depending on the current mode  |
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>C</kbd> | Create a new category                                          |
-| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>H</kbd>                       | Open the How to guides                                         |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>H</kbd>                       | Open the How to guides (outside the editor, where it highlights) |
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>S</kbd> | Open settings                                                 |
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>Left</kbd> | Switch to checklists mode                                   |
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>⌥ Option</kbd> + <kbd>Right</kbd> | Switch to notes mode                                       |
@@ -33,6 +33,7 @@ These work when the note editor has focus.
 | <kbd>⌘ Cmd</kbd> + <kbd>I</kbd>                                          | Toggle _Italic_                |
 | <kbd>⌘ Cmd</kbd> + <kbd>U</kbd>                                          | Toggle <u>Underline</u>        |
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>X</kbd>                       | Toggle ~~Strikethrough~~       |
+| <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>H</kbd>                       | Toggle highlight               |
 | <kbd>⌘ Cmd</kbd> + <kbd>E</kbd>                                          | Toggle `inline code`           |
 | <kbd>⌘ Cmd</kbd> + <kbd>Shift</kbd> + <kbd>K</kbd>                       | Add or edit a link             |
 | <kbd>⌘ Cmd</kbd> + <kbd>⌥ Option</kbd> + <kbd>1</kbd>                    | Apply Heading 1 style          |
diff --git a/howto/SSO.md b/howto/SSO.md
index 6b96dde7b..e0f13f583 100644
--- a/howto/SSO.md
+++ b/howto/SSO.md
@@ -3,17 +3,19 @@
 `jotty·page` works with any OIDC provider (Authentik, Auth0, Keycloak, Okta, etc.) that:
 
 - Supports PKCE (most current providers do)
-- Can be set up as a public client, with no client secret
+- Can be set up as either a public client (no client secret) or a confidential client (with a client secret)
 - Provides the standard OIDC scopes (openid, profile, email)
 
 1. Configure your OIDC provider:
 
-- Client Type: Public
+- Client Type: Public, or Confidential if you set `OIDC_CLIENT_SECRET`
+  - _Some providers, like Authelia, refuse a client secret on a public client. Pick one or the other_
 - Grant Type: Authorization Code with PKCE
 - PKCE Code Challenge Method: S256
   - _S256 is the only PKCE method Jotty supports_
 - Scopes: openid, profile, email
 - Redirect URI: https://YOUR_APP_HOST/api/oidc/callback
+  - _Jotty builds this from `APP_URL` as written, so leave the trailing `/` off `APP_URL` or you get `//api/oidc/callback`_
 - Post-logout URI: https://YOUR_APP_HOST/
 
 2. Get these values from your provider:
diff --git a/tests/api/checklists.test.ts b/tests/api/checklists.test.ts
index 79e8ba925..1b903960d 100644
--- a/tests/api/checklists.test.ts
+++ b/tests/api/checklists.test.ts
@@ -5,8 +5,8 @@ import {
   mockGetUserChecklists,
   mockCreateList,
   mockMakeList,
-  mockUpdateList,
-  mockDeleteList,
+  mockEditList,
+  mockDropList,
   mockGetListById,
   resetApiMocks,
   createMockRequest,
@@ -282,7 +282,7 @@ describe("Checklists API", () => {
       };
 
       mockGetListById.mockResolvedValue(existingList);
-      mockUpdateList.mockResolvedValue({ success: true, data: updatedList });
+      mockEditList.mockResolvedValue({ success: true, data: updatedList });
 
       const request = createMockRequest(
         "PUT",
@@ -354,7 +354,7 @@ describe("Checklists API", () => {
       };
 
       mockGetListById.mockResolvedValue(existingList);
-      mockDeleteList.mockResolvedValue({ success: true });
+      mockDropList.mockResolvedValue({ success: true });
 
       const request = createMockRequest(
         "DELETE",
diff --git a/tests/api/items.test.ts b/tests/api/items.test.ts
index 2258a8593..c77855337 100644
--- a/tests/api/items.test.ts
+++ b/tests/api/items.test.ts
@@ -3,8 +3,8 @@ import {
   mockUser,
   mockAuthenticateApiKey,
   mockGetListById,
-  mockCreateItem,
-  mockUpdateItem,
+  mockAddItem,
+  mockEditItem,
   mockServerWriteFile,
   resetApiMocks,
   createMockRequest,
@@ -61,7 +61,7 @@ describe("Checklist Items API", () => {
   describe("POST /api/checklists/:id/items", () => {
     it("should create a regular item", async () => {
       mockGetListById.mockResolvedValue(mockList)
-      mockCreateItem.mockResolvedValue({ success: true, data: { id: "new-item" } })
+      mockAddItem.mockResolvedValue({ success: true, data: { id: "new-item" } })
 
       const request = createMockRequest("POST", "http://localhost:3000/api/checklists/uuid-1/items", {
         text: "Test Item - Regular",
@@ -76,7 +76,7 @@ describe("Checklist Items API", () => {
     it("should create a task item with status", async () => {
       const taskList = { ...mockList, type: "task" }
       mockGetListById.mockResolvedValue(taskList)
-      mockCreateItem.mockResolvedValue({ success: true, data: { id: "new-task-item" } })
+      mockAddItem.mockResolvedValue({ success: true, data: { id: "new-task-item" } })
 
       const request = createMockRequest("POST", "http://localhost:3000/api/checklists/uuid-1/items", {
         text: "Test Item - Task",
@@ -173,7 +173,7 @@ describe("Checklist Items API", () => {
   describe("PUT /api/checklists/:id/items/:index/check", () => {
     it("should check an item", async () => {
       mockGetListById.mockResolvedValue(mockList)
-      mockUpdateItem.mockResolvedValue({ success: true })
+      mockEditItem.mockResolvedValue({ success: true })
 
       const request = createMockRequest("PUT", "http://localhost:3000/api/checklists/uuid-1/items/0/check")
       const response = await CHECK(request, { params: Promise.resolve({ listId: "uuid-1", itemIndex: "0" }) })
@@ -185,7 +185,7 @@ describe("Checklist Items API", () => {
 
     it("should check a nested item", async () => {
       mockGetListById.mockResolvedValue(mockList)
-      mockUpdateItem.mockResolvedValue({ success: true })
+      mockEditItem.mockResolvedValue({ success: true })
 
       const request = createMockRequest("PUT", "http://localhost:3000/api/checklists/uuid-1/items/0.0/check")
       const response = await CHECK(request, { params: Promise.resolve({ listId: "uuid-1", itemIndex: "0.0" }) })
@@ -232,7 +232,7 @@ describe("Checklist Items API", () => {
   describe("PUT /api/checklists/:id/items/:index/uncheck", () => {
     it("should uncheck an item", async () => {
       mockGetListById.mockResolvedValue(mockList)
-      mockUpdateItem.mockResolvedValue({ success: true })
+      mockEditItem.mockResolvedValue({ success: true })
 
       const request = createMockRequest("PUT", "http://localhost:3000/api/checklists/uuid-1/items/0/uncheck")
       const response = await UNCHECK(request, { params: Promise.resolve({ listId: "uuid-1", itemIndex: "0" }) })
@@ -244,7 +244,7 @@ describe("Checklist Items API", () => {
 
     it("should uncheck a nested item", async () => {
       mockGetListById.mockResolvedValue(mockList)
-      mockUpdateItem.mockResolvedValue({ success: true })
+      mockEditItem.mockResolvedValue({ success: true })
 
       const request = createMockRequest("PUT", "http://localhost:3000/api/checklists/uuid-1/items/0.0/uncheck")
       const response = await UNCHECK(request, { params: Promise.resolve({ listId: "uuid-1", itemIndex: "0.0" }) })
@@ -291,7 +291,7 @@ describe("Checklist Items API", () => {
   describe("PATCH /api/checklists/:id/items/:index", () => {
     it("should update writable kanban item fields", async () => {
       mockGetListById.mockResolvedValue({ ...mockList, type: "kanban" })
-      mockUpdateItem.mockResolvedValue({ success: true })
+      mockEditItem.mockResolvedValue({ success: true })
 
       const request = createMockRequest("PATCH", "http://localhost:3000/api/checklists/uuid-1/items/0", {
         description: "Implementation notes",
@@ -306,9 +306,9 @@ describe("Checklist Items API", () => {
 
       expect(response.status).toBe(200)
       expect(data.success).toBe(true)
-      expect(mockUpdateItem).toHaveBeenCalledOnce()
+      expect(mockEditItem).toHaveBeenCalledOnce()
 
-      const formData = mockUpdateItem.mock.calls[0][1] as FormData
+      const formData = mockEditItem.mock.calls[0][2] as FormData
       expect(formData.get("itemId")).toBe("item-1")
       expect(formData.get("description")).toBe("Implementation notes")
       expect(formData.get("priority")).toBe("high")
@@ -325,7 +325,7 @@ describe("Checklist Items API", () => {
 
       expect(response.status).toBe(400)
       expect(data.error).toBe("Provide at least one field to update")
-      expect(mockUpdateItem).not.toHaveBeenCalled()
+      expect(mockEditItem).not.toHaveBeenCalled()
     })
 
     it("should return 400 for invalid priority", async () => {
@@ -337,7 +337,7 @@ describe("Checklist Items API", () => {
 
       expect(response.status).toBe(400)
       expect(data.error).toContain("'priority' must be one of")
-      expect(mockUpdateItem).not.toHaveBeenCalled()
+      expect(mockEditItem).not.toHaveBeenCalled()
     })
   })
 
diff --git a/tests/api/notes.test.ts b/tests/api/notes.test.ts
index 7161ba214..8048ba07e 100644
--- a/tests/api/notes.test.ts
+++ b/tests/api/notes.test.ts
@@ -5,8 +5,8 @@ import {
   mockGetUserNotes,
   mockCreateNote,
   mockMakeNote,
-  mockUpdateNote,
-  mockDeleteNote,
+  mockEditNote,
+  mockDropNote,
   resetApiMocks,
   createMockRequest,
   getResponseJson,
@@ -145,7 +145,7 @@ describe("Notes API", () => {
       }
 
       mockGetUserNotes.mockResolvedValue({ success: true, data: [existingNote] })
-      mockUpdateNote.mockResolvedValue({ success: true, data: updatedNote })
+      mockEditNote.mockResolvedValue({ success: true, data: updatedNote })
 
       const request = createMockRequest("PUT", "http://localhost:3000/api/notes/uuid-1", {
         title: "Updated Test Note - API",
@@ -175,7 +175,7 @@ describe("Notes API", () => {
       }
 
       mockGetUserNotes.mockResolvedValue({ success: true, data: [existingNote] })
-      mockUpdateNote.mockResolvedValue({ success: true, data: updatedNote })
+      mockEditNote.mockResolvedValue({ success: true, data: updatedNote })
 
       const request = createMockRequest("PUT", "http://localhost:3000/api/notes/uuid-1", {
         content: "Updated content only",
@@ -226,7 +226,7 @@ describe("Notes API", () => {
       }
 
       mockGetUserNotes.mockResolvedValue({ success: true, data: [existingNote] })
-      mockDeleteNote.mockResolvedValue({ success: true })
+      mockDropNote.mockResolvedValue({ success: true })
 
       const request = createMockRequest("DELETE", "http://localhost:3000/api/notes/uuid-1")
       const response = await DELETE(request, { params: Promise.resolve({ noteId: "uuid-1" }) })
diff --git a/tests/api/setup.ts b/tests/api/setup.ts
index 0d3e33992..aa15eda88 100644
--- a/tests/api/setup.ts
+++ b/tests/api/setup.ts
@@ -9,6 +9,13 @@ export const mockUser = {
 };
 
 export const mockAuthenticateApiKey = vi.fn();
+export const mockEditNote = vi.fn();
+export const mockDropNote = vi.fn();
+export const mockEditList = vi.fn();
+export const mockDropList = vi.fn();
+export const mockAddItem = vi.fn();
+export const mockEditItem = vi.fn();
+export const mockStampStatus = vi.fn();
 export const mockGetUserNotes = vi.fn();
 export const mockCreateNote = vi.fn();
 export const mockUpdateNote = vi.fn();
@@ -41,19 +48,25 @@ vi.mock("@/app/_server/actions/api", () => ({
   authenticateApiKey: (...args: any[]) => mockAuthenticateApiKey(...args),
 }));
 
-vi.mock("@/app/_server/actions/note", () => ({
+vi.mock("@/app/_server/actions/note/queries", () => ({
   getUserNotes: (...args: any[]) => mockGetUserNotes(...args),
+}));
+
+vi.mock("@/app/_server/actions/note", () => ({
   createNote: (...args: any[]) => mockCreateNote(...args),
   updateNote: (...args: any[]) => mockUpdateNote(...args),
   deleteNote: (...args: any[]) => mockDeleteNote(...args),
 }));
 
-vi.mock("@/app/_server/actions/checklist", () => ({
+vi.mock("@/app/_server/actions/checklist/queries", () => ({
   getUserChecklists: (...args: any[]) => mockGetUserChecklists(...args),
+  getListById: (...args: any[]) => mockGetListById(...args),
+}));
+
+vi.mock("@/app/_server/actions/checklist", () => ({
   createList: (...args: any[]) => mockCreateList(...args),
   updateList: (...args: any[]) => mockUpdateList(...args),
   deleteList: (...args: any[]) => mockDeleteList(...args),
-  getListById: (...args: any[]) => mockGetListById(...args),
 }));
 
 vi.mock("@/app/_server/actions/checklist/creator", () => ({
@@ -64,6 +77,25 @@ vi.mock("@/app/_server/actions/note/creator", () => ({
   makeNote: (...args: any[]) => mockMakeNote(...args),
 }));
 
+vi.mock("@/app/_server/actions/note/editor", () => ({
+  editNote: (...args: any[]) => mockEditNote(...args),
+  dropNote: (...args: any[]) => mockDropNote(...args),
+}));
+
+vi.mock("@/app/_server/actions/checklist/editor", () => ({
+  editList: (...args: any[]) => mockEditList(...args),
+  dropList: (...args: any[]) => mockDropList(...args),
+}));
+
+vi.mock("@/app/_server/actions/checklist-item/editor", () => ({
+  addItem: (...args: any[]) => mockAddItem(...args),
+  editItem: (...args: any[]) => mockEditItem(...args),
+}));
+
+vi.mock("@/app/_server/actions/checklist-item/stamper", () => ({
+  stampStatus: (...args: any[]) => mockStampStatus(...args),
+}));
+
 vi.mock("@/app/_server/actions/checklist-item", () => ({
   createItem: (...args: any[]) => mockCreateItem(...args),
   updateItem: (...args: any[]) => mockUpdateItem(...args),
@@ -109,6 +141,13 @@ vi.mock("@/app/_server/actions/lib/legacy-lookup", () => ({
 export function resetApiMocks() {
   vi.clearAllMocks();
   mockAuthenticateApiKey.mockReset();
+  mockEditNote.mockReset();
+  mockDropNote.mockReset();
+  mockEditList.mockReset();
+  mockDropList.mockReset();
+  mockAddItem.mockReset();
+  mockEditItem.mockReset();
+  mockStampStatus.mockReset();
   mockGetUserNotes.mockReset();
   mockCreateNote.mockReset();
   mockUpdateNote.mockReset();
diff --git a/tests/api/tasks.test.ts b/tests/api/tasks.test.ts
index 58bc1ed33..993e049a3 100644
--- a/tests/api/tasks.test.ts
+++ b/tests/api/tasks.test.ts
@@ -5,11 +5,11 @@ import {
   mockGetUserChecklists,
   mockCreateList,
   mockMakeList,
-  mockUpdateList,
-  mockDeleteList,
+  mockEditList,
+  mockDropList,
   mockGetListById,
-  mockCreateItem,
-  mockUpdateItemStatus,
+  mockAddItem,
+  mockStampStatus,
   mockServerWriteFile,
   resetApiMocks,
   createMockRequest,
@@ -223,7 +223,7 @@ describe("Tasks API", () => {
     it("should update a task", async () => {
       const updatedTask = { ...mockTask, title: "Updated Task Board", category: "Work" }
       mockGetListById.mockResolvedValue(mockTask)
-      mockUpdateList.mockResolvedValue({ success: true, data: updatedTask })
+      mockEditList.mockResolvedValue({ success: true, data: updatedTask })
 
       const request = createMockRequest("PUT", "http://localhost:3000/api/tasks/task-uuid-1", {
         title: "Updated Task Board",
@@ -267,7 +267,7 @@ describe("Tasks API", () => {
   describe("DELETE /api/tasks/:taskId", () => {
     it("should delete a task", async () => {
       mockGetListById.mockResolvedValue(mockTask)
-      mockDeleteList.mockResolvedValue({ success: true })
+      mockDropList.mockResolvedValue({ success: true })
 
       const request = createMockRequest("DELETE", "http://localhost:3000/api/tasks/task-uuid-1")
       const response = await DELETE_TASK(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) })
@@ -484,7 +484,7 @@ describe("Tasks API", () => {
   describe("POST /api/tasks/:taskId/items", () => {
     it("should create a task item", async () => {
       mockGetListById.mockResolvedValue(mockTask)
-      mockCreateItem.mockResolvedValue({ success: true, data: { id: "new-item" } })
+      mockAddItem.mockResolvedValue({ success: true, data: { id: "new-item" } })
 
       const request = createMockRequest("POST", "http://localhost:3000/api/tasks/task-uuid-1/items", {
         text: "Implement feature X",
@@ -542,7 +542,7 @@ describe("Tasks API", () => {
   describe("PUT /api/tasks/:taskId/items/:itemIndex/status", () => {
     it("should update item status", async () => {
       mockGetListById.mockResolvedValue(mockTask)
-      mockUpdateItemStatus.mockResolvedValue({ success: true })
+      mockStampStatus.mockResolvedValue({ success: true })
 
       const request = createMockRequest("PUT", "http://localhost:3000/api/tasks/task-uuid-1/items/0/status", {
         status: "in_progress",
@@ -556,7 +556,7 @@ describe("Tasks API", () => {
 
     it("should update nested item status", async () => {
       mockGetListById.mockResolvedValue(mockTask)
-      mockUpdateItemStatus.mockResolvedValue({ success: true })
+      mockStampStatus.mockResolvedValue({ success: true })
 
       const request = createMockRequest("PUT", "http://localhost:3000/api/tasks/task-uuid-1/items/0.0/status", {
         status: "in_progress",
diff --git a/tests/mock-data/brain-seed.ts b/tests/mock-data/brain-seed.ts
index 7cd956c35..fcdfe3a08 100644
--- a/tests/mock-data/brain-seed.ts
+++ b/tests/mock-data/brain-seed.ts
@@ -233,6 +233,7 @@ const _ensureUser = () =>
       ...users,
       {
         username: USERNAME,
+        brainSeedCreated: true,
         passwordHash: createHash("sha256").update(PASSWORD).digest("hex"),
         isAdmin: false,
         createdAt: now,
@@ -253,10 +254,15 @@ const _exists = (target: string) =>
     () => false,
   );
 
+const _seededUser = async () => {
+  const users = JSON.parse(await fs.readFile(USERS_FILE, "utf-8")) as Record<string, unknown>[];
+  return users.some((user) => user.username === USERNAME && user.brainSeedCreated === true);
+};
+
 const _remove = async () => {
   await fs.rm(NOTES_ROOT, { recursive: true, force: true });
   await fs.rm(LISTS_ROOT, { recursive: true, force: true });
-  if (!(await _exists(CREATED_MARKER))) {
+  if (!(await _seededUser()) || !(await _exists(CREATED_MARKER))) {
     console.log(`Removed the ${SEED_CATEGORY} category from ${USERNAME}.`);
     return;
   }
diff --git a/tests/security/actor-spoofing.test.ts b/tests/security/actor-spoofing.test.ts
new file mode 100644
index 000000000..ad2754985
--- /dev/null
+++ b/tests/security/actor-spoofing.test.ts
@@ -0,0 +1,293 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { NextRequest } from 'next/server'
+import { resetAllMocks, createFormData } from '../setup'
+
+const VICTIM = 'victim'
+const MALLORY = 'mallory'
+const LIST_PATH = '/data/checklists/victim/Personal/shopping.md'
+
+const mockGetCurrentUser = vi.fn()
+const mockWrite = vi.fn()
+const mockDelete = vi.fn()
+const mockCanReach = vi.fn()
+const mockAuthenticateApiKey = vi.fn()
+
+const victimNote = () => ({
+  uuid: 'note-uuid',
+  id: 'diary',
+  title: 'Diary',
+  content: 'dear diary',
+  category: 'Personal',
+  owner: VICTIM,
+})
+
+const victimList = () => ({
+  uuid: 'list-uuid',
+  id: 'shopping',
+  title: 'Shopping',
+  category: 'Personal',
+  owner: VICTIM,
+  type: 'simple',
+  items: [{ id: 'milk', text: 'Milk', completed: false, order: 0 }],
+  createdAt: '2024-01-01T00:00:00.000Z',
+  updatedAt: '2024-01-01T00:00:00.000Z',
+})
+
+vi.mock('@/app/_server/actions/users', () => ({
+  getCurrentUser: () => mockGetCurrentUser(),
+  getUsername: async () => (await mockGetCurrentUser())?.username || '',
+  isAdmin: vi.fn().mockResolvedValue(false),
+}))
+
+vi.mock('@/app/_server/actions/users/records', () => ({
+  findUserRecord: vi.fn().mockResolvedValue(null),
+}))
+
+vi.mock('@/app/_server/actions/file', () => ({
+  ensureDir: vi.fn(),
+  getUserModeDir: vi.fn().mockResolvedValue('/data/checklists/victim'),
+  serverWriteFile: (...args: unknown[]) => mockWrite(...args),
+  serverDeleteFile: (...args: unknown[]) => mockDelete(...args),
+}))
+
+vi.mock('@/app/_server/actions/note/queries', () => ({
+  getNoteById: async () => victimNote(),
+  getUserNotes: async () => ({ success: true, data: [victimNote()] }),
+}))
+
+vi.mock('@/app/_server/actions/checklist/queries', () => ({
+  getListById: async () => victimList(),
+  getUserChecklists: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/share/queries', () => ({
+  canReach: (...args: unknown[]) => mockCanReach(...args),
+  reachableFile: async (...args: unknown[]) =>
+    (await mockCanReach(...args)) ? LIST_PATH : null,
+  usersWithAccess: vi.fn().mockResolvedValue([]),
+}))
+
+vi.mock('@/app/_server/actions/share/target', () => ({
+  shownAs: vi.fn().mockResolvedValue('Personal'),
+  movePlan: vi.fn().mockResolvedValue({
+    home: { owner: 'victim', category: 'Personal' },
+    destination: { owner: 'victim', category: 'Personal' },
+    target: {},
+    isMoving: false,
+  }),
+  bouncer: vi.fn().mockResolvedValue({ allowed: true }),
+  targetDir: vi.fn().mockResolvedValue({
+    owner: 'victim',
+    category: 'Personal',
+    dir: '/data/notes/victim/Personal',
+    isMount: false,
+  }),
+  diskPath: vi.fn().mockResolvedValue(LIST_PATH),
+  refusalMessage: vi.fn().mockResolvedValue('Refused'),
+}))
+
+vi.mock('@/app/_server/actions/relations/tidy', () => ({
+  refreshWikilinks: (content: string) => content,
+  tidyItemLinks: async (content: string) => content,
+}))
+
+vi.mock('@/app/_server/actions/log', () => ({
+  logContentEvent: vi.fn(),
+  logAudit: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/ws/broadcast', () => ({
+  broadcast: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('@/app/_server/actions/history', () => ({
+  commitNote: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('@/app/_server/actions/notifications/internal', () => ({
+  notifyUser: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/api', () => ({
+  authenticateApiKey: (...args: unknown[]) => mockAuthenticateApiKey(...args),
+}))
+
+vi.mock('@/app/_server/actions/lib/legacy-lookup', () => ({
+  resolveApiId: async (_mode: string, param: string) => param,
+}))
+
+const actorsAsked = () => mockCanReach.mock.calls.map((call) => call[2])
+
+const apiRequest = (method: string, url: string, body?: unknown) =>
+  new NextRequest(new URL(url, 'http://localhost:3000'), {
+    method,
+    headers: { 'Content-Type': 'application/json', 'x-api-key': 'victim-key' },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  })
+
+describe('Security: acting identity comes from the session, never the request', () => {
+  beforeEach(() => {
+    resetAllMocks()
+    mockGetCurrentUser.mockResolvedValue(null)
+    mockAuthenticateApiKey.mockResolvedValue(null)
+    mockCanReach.mockImplementation(
+      async (_uuid: string, _type: string, username: string) => username === VICTIM,
+    )
+  })
+
+  describe('without a session', () => {
+    it('updateNote refuses a victim named in FormData and writes nothing', async () => {
+      const { updateNote } = await import('@/app/_server/actions/note/crud')
+
+      for (const user of [VICTIM, JSON.stringify({ username: VICTIM })]) {
+        const result = await updateNote(
+          createFormData({ uuid: 'note-uuid', title: 'Diary', content: 'pwned', user }),
+        )
+
+        expect(result.error).toBe('Not authenticated')
+      }
+
+      expect(mockWrite).not.toHaveBeenCalled()
+      expect(mockCanReach).not.toHaveBeenCalled()
+    })
+
+    it('deleteNote refuses and deletes nothing', async () => {
+      const { deleteNote } = await import('@/app/_server/actions/note/crud')
+
+      const result = await deleteNote(createFormData({ uuid: 'note-uuid', user: VICTIM }))
+
+      expect(result.error).toBe('Not authenticated')
+      expect(mockDelete).not.toHaveBeenCalled()
+    })
+
+    it('updateItem and createItem refuse a victim passed as the username argument', async () => {
+      const { updateItem, createItem } = await import('@/app/_server/actions/checklist-item/crud')
+
+      const updated = await updateItem(
+        victimList() as any,
+        createFormData({ itemId: 'milk', completed: 'true' }),
+        VICTIM,
+      )
+      const created = await createItem(
+        victimList() as any,
+        createFormData({ text: 'pwned' }),
+        VICTIM,
+      )
+
+      expect(updated).toEqual({ success: false, error: 'Not authenticated' })
+      expect(created).toEqual({ success: false, error: 'Not authenticated' })
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+
+    it('updateItemStatus and bulk item actions refuse a victim named in FormData', async () => {
+      const { updateItemStatus } = await import('@/app/_server/actions/checklist-item/status')
+      const { bulkToggleItems, bulkDeleteItems } = await import(
+        '@/app/_server/actions/checklist-item/bulk-operations'
+      )
+
+      const results = [
+        await updateItemStatus(
+          createFormData({ uuid: 'list-uuid', itemId: 'milk', status: 'completed', username: VICTIM }),
+        ),
+        await bulkToggleItems(
+          createFormData({ uuid: 'list-uuid', itemIds: '["milk"]', completed: 'true', username: VICTIM }),
+        ),
+        await bulkDeleteItems(
+          createFormData({ uuid: 'list-uuid', itemIds: '["milk"]', username: VICTIM }),
+        ),
+      ]
+
+      for (const result of results) {
+        expect(result).toEqual({ success: false, error: 'Not authenticated' })
+      }
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+
+    it('updateList and deleteList ignore a forged apiUser blob', async () => {
+      const { updateList, deleteList } = await import('@/app/_server/actions/checklist/crud')
+      const apiUser = JSON.stringify({ username: VICTIM })
+
+      const updated = await updateList(
+        createFormData({ uuid: 'list-uuid', title: 'pwned', category: 'Personal', apiUser }),
+      )
+      const deleted = await deleteList(createFormData({ uuid: 'list-uuid', apiUser }))
+
+      expect(updated.error).toBe('Not authenticated')
+      expect(deleted.error).toBe('Not authenticated')
+      expect(mockWrite).not.toHaveBeenCalled()
+      expect(mockDelete).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('with a session for somebody else', () => {
+    beforeEach(() => {
+      mockGetCurrentUser.mockResolvedValue({ username: MALLORY })
+    })
+
+    it('refuses item actions that claim a different user', async () => {
+      const { updateItem, createItem } = await import('@/app/_server/actions/checklist-item/crud')
+      const { updateItemStatus } = await import('@/app/_server/actions/checklist-item/status')
+
+      const results = [
+        await updateItem(victimList() as any, createFormData({ itemId: 'milk', completed: 'true' }), VICTIM),
+        await createItem(victimList() as any, createFormData({ text: 'pwned' }), VICTIM),
+        await updateItemStatus(
+          createFormData({ uuid: 'list-uuid', itemId: 'milk', status: 'completed', username: VICTIM }),
+        ),
+      ]
+
+      for (const result of results) {
+        expect(result).toEqual({ success: false, error: 'Identity mismatch' })
+      }
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+
+    it('updateNote checks permission for the session user, not the FormData user', async () => {
+      const { updateNote } = await import('@/app/_server/actions/note/crud')
+
+      const result = await updateNote(
+        createFormData({ uuid: 'note-uuid', title: 'Diary', content: 'pwned', user: VICTIM }),
+      )
+
+      expect(result.error).toBe('Permission denied')
+      expect(actorsAsked()).toEqual([MALLORY])
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('API key routes still act as the key owner', () => {
+    beforeEach(() => {
+      mockAuthenticateApiKey.mockResolvedValue({ username: VICTIM, isAdmin: false })
+    })
+
+    it('PUT /api/notes/:id updates the note as the API key user', async () => {
+      const { PUT } = await import('@/app/api/notes/[noteId]/route')
+
+      const response = await PUT(
+        apiRequest('PUT', '/api/notes/note-uuid', { content: 'from a shortcut' }),
+        { params: Promise.resolve({ noteId: 'note-uuid' }) },
+      )
+      const body = await response.json()
+
+      expect(response.status).toBe(200)
+      expect(body.success).toBe(true)
+      expect(body.data.content).toBe('from a shortcut')
+      expect(mockWrite).toHaveBeenCalledOnce()
+      expect(new Set(actorsAsked())).toEqual(new Set([VICTIM]))
+    })
+
+    it('PUT /api/checklists/:id/items/:index/check ticks the item as the API key user', async () => {
+      const { PUT } = await import('@/app/api/checklists/[listId]/items/[itemIndex]/check/route')
+
+      const response = await PUT(
+        apiRequest('PUT', '/api/checklists/list-uuid/items/0/check'),
+        { params: Promise.resolve({ listId: 'list-uuid', itemIndex: '0' }) },
+      )
+
+      expect(response.status).toBe(200)
+      expect(await response.json()).toEqual({ success: true })
+      expect(mockWrite).toHaveBeenCalledOnce()
+      expect(new Set(actorsAsked())).toEqual(new Set([VICTIM]))
+    })
+  })
+})
diff --git a/tests/security/auth-required.test.ts b/tests/security/auth-required.test.ts
index 3f9f140cc..458336941 100644
--- a/tests/security/auth-required.test.ts
+++ b/tests/security/auth-required.test.ts
@@ -106,7 +106,7 @@ describe('Security: Authentication Required', () => {
     })
 
     it('getUserNotes should reject unauthenticated requests', async () => {
-      const { getUserNotes } = await import('@/app/_server/actions/note')
+      const { getUserNotes } = await import('@/app/_server/actions/note/queries')
 
       const result = await getUserNotes()
 
@@ -143,7 +143,7 @@ describe('Security: Authentication Required', () => {
     })
 
     it('getUserChecklists should reject unauthenticated requests', async () => {
-      const { getUserChecklists } = await import('@/app/_server/actions/checklist')
+      const { getUserChecklists } = await import('@/app/_server/actions/checklist/queries')
 
       const result = await getUserChecklists()
 
diff --git a/tests/security/read-by-uuid.test.ts b/tests/security/read-by-uuid.test.ts
new file mode 100644
index 000000000..bb2e365ea
--- /dev/null
+++ b/tests/security/read-by-uuid.test.ts
@@ -0,0 +1,200 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import path from 'path'
+import { resetAllMocks, mockFs } from '../setup'
+import { Modes } from '@/app/_types/enums'
+
+const VICTIM = 'victim'
+const MALLORY = 'mallory'
+const READER = 'reader'
+const NOTE_UUID = 'note-uuid'
+const LIST_UUID = 'list-uuid'
+
+const homeOf = (mode: Modes, username: string) =>
+  path.join(process.cwd(), 'data', mode, username)
+
+const NOTE_PATH = path.join(homeOf(Modes.NOTES, VICTIM), 'Personal', 'diary.md')
+const LIST_PATH = path.join(homeOf(Modes.CHECKLISTS, VICTIM), 'Personal', 'shopping.md')
+
+const FILES: Record<string, string> = {
+  [NOTE_PATH]: `---\nuuid: ${NOTE_UUID}\ntitle: Diary\n---\n\ndear diary`,
+  [LIST_PATH]: `---\nuuid: ${LIST_UUID}\ntitle: Shopping\n---\n\n- [ ] Milk`,
+}
+
+const mockGetCurrentUser = vi.fn()
+const mockGrepFind = vi.fn()
+const mockReaders = vi.fn()
+const mockCanAccessAll = vi.fn()
+
+const readers = (): string[] => mockReaders() || []
+const mayRead = (username: string) =>
+  username === VICTIM || readers().includes(username)
+
+vi.mock('@/app/_server/actions/users', () => ({
+  getCurrentUser: () => mockGetCurrentUser(),
+  getUsername: async () => (await mockGetCurrentUser())?.username || '',
+  getUserByNoteUuid: async () => ({ success: true, data: { username: VICTIM } }),
+  getUserByChecklistUuid: async () => ({ success: true, data: { username: VICTIM } }),
+}))
+
+vi.mock('@/app/_utils/grep-utils', () => ({
+  grepFindFileByUuid: (...args: unknown[]) => mockGrepFind(...args),
+}))
+
+vi.mock('@/app/_server/actions/file', () => ({
+  serverReadFile: async (filePath: string) => FILES[filePath] || '',
+  readJsonFile: vi.fn().mockResolvedValue([]),
+  ensureDir: vi.fn(),
+  getUserModeDir: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/share/mounts', () => ({
+  mountsFor: async (_mode: Modes, username: string) =>
+    readers().includes(username) ? [{ owner: VICTIM }] : [],
+  mountedItems: vi.fn().mockResolvedValue([]),
+}))
+
+vi.mock('@/app/_server/actions/share/access', () => ({
+  canReachFile: async (_mode: Modes, _file: string, username: string) =>
+    mayRead(username),
+}))
+
+vi.mock('@/app/_server/actions/share/queries', () => ({
+  canReach: async (_uuid: string, _type: string, username: string) =>
+    Boolean(username) && ((await mockCanAccessAll()) || mayRead(username)),
+}))
+
+vi.mock('@/app/_server/actions/lib/metadata-cache', () => ({
+  getOrCompute: vi.fn(),
+  metaCacheKey: vi.fn(),
+}))
+
+const signIn = (username: string | null) =>
+  mockGetCurrentUser.mockResolvedValue(
+    username ? { username, isAdmin: false } : null,
+  )
+
+describe('Security: client reads by uuid are gated by the session', () => {
+  beforeEach(() => {
+    resetAllMocks()
+    mockReaders.mockReturnValue([])
+    mockCanAccessAll.mockResolvedValue(false)
+    mockFs.stat.mockResolvedValue({ birthtime: new Date(0), mtime: new Date(0) })
+    mockGrepFind.mockImplementation(async (dir: string, uuid: string) => {
+      if (dir === homeOf(Modes.NOTES, VICTIM) && uuid === NOTE_UUID) {
+        return { filePath: NOTE_PATH, id: 'diary', category: 'Personal' }
+      }
+      if (dir === homeOf(Modes.CHECKLISTS, VICTIM) && uuid === LIST_UUID) {
+        return { filePath: LIST_PATH, id: 'shopping', category: 'Personal' }
+      }
+      return null
+    })
+  })
+
+  describe('without a session', () => {
+    beforeEach(() => signIn(null))
+
+    it('viewNote refuses and never touches the disk', async () => {
+      const { viewNote } = await import('@/app/_server/actions/note')
+
+      expect(await viewNote(NOTE_UUID)).toBeUndefined()
+      expect(mockGrepFind).not.toHaveBeenCalled()
+    })
+
+    it('viewList refuses and never touches the disk', async () => {
+      const { viewList } = await import('@/app/_server/actions/checklist')
+
+      expect(await viewList(LIST_UUID)).toBeUndefined()
+      expect(mockGrepFind).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('a stranger with the uuid', () => {
+    beforeEach(() => signIn(MALLORY))
+
+    it('cannot read an unshared note', async () => {
+      const { viewNote } = await import('@/app/_server/actions/note')
+
+      expect(await viewNote(NOTE_UUID)).toBeUndefined()
+    })
+
+    it('cannot read an unshared checklist', async () => {
+      const { viewList } = await import('@/app/_server/actions/checklist')
+
+      expect(await viewList(LIST_UUID)).toBeUndefined()
+    })
+
+    it('cannot borrow the owner name by sending it along', async () => {
+      const { viewNote } = await import('@/app/_server/actions/note')
+      const { viewList } = await import('@/app/_server/actions/checklist')
+      const spoofNote = viewNote as unknown as (uuid: string, as: string) => ReturnType<typeof viewNote>
+      const spoofList = viewList as unknown as (uuid: string, as: string) => ReturnType<typeof viewList>
+
+      expect(await spoofNote(NOTE_UUID, VICTIM)).toBeUndefined()
+      expect(await spoofList(LIST_UUID, VICTIM)).toBeUndefined()
+    })
+  })
+
+  describe('a user holding a READ share', () => {
+    beforeEach(() => {
+      signIn(READER)
+      mockReaders.mockReturnValue([READER])
+    })
+
+    it('can read the shared note', async () => {
+      const { viewNote } = await import('@/app/_server/actions/note')
+
+      const note = await viewNote(NOTE_UUID)
+
+      expect(note?.content).toContain('dear diary')
+      expect(note?.owner).toBe(VICTIM)
+      expect(note?.isShared).toBe(true)
+    })
+
+    it('can read the shared checklist', async () => {
+      const { viewList } = await import('@/app/_server/actions/checklist')
+
+      const list = await viewList(LIST_UUID)
+
+      expect(list?.items.map((item) => item.text)).toEqual(['Milk'])
+      expect(list?.owner).toBe(VICTIM)
+      expect(list?.isShared).toBe(true)
+    })
+  })
+
+  describe('the owner', () => {
+    beforeEach(() => signIn(VICTIM))
+
+    it('can read their note', async () => {
+      const { viewNote } = await import('@/app/_server/actions/note')
+
+      const note = await viewNote(NOTE_UUID)
+
+      expect(note?.title).toBe('Diary')
+      expect(note?.owner).toBe(VICTIM)
+      expect(note?.isShared).toBe(false)
+    })
+
+    it('can read their checklist', async () => {
+      const { viewList } = await import('@/app/_server/actions/checklist')
+
+      const list = await viewList(LIST_UUID)
+
+      expect(list?.title).toBe('Shopping')
+      expect(list?.owner).toBe(VICTIM)
+      expect(list?.isShared).toBe(false)
+    })
+  })
+
+  describe('an admin allowed to see all content', () => {
+    beforeEach(() => {
+      signIn(MALLORY)
+      mockCanAccessAll.mockResolvedValue(true)
+    })
+
+    it('reads through the permission check, not around it', async () => {
+      const { viewNote } = await import('@/app/_server/actions/note')
+
+      expect((await viewNote(NOTE_UUID))?.owner).toBe(VICTIM)
+    })
+  })
+})
diff --git a/tests/server-actions/archived.test.ts b/tests/server-actions/archived.test.ts
index e1aa69f3f..717d1b343 100644
--- a/tests/server-actions/archived.test.ts
+++ b/tests/server-actions/archived.test.ts
@@ -9,11 +9,11 @@ vi.mock("@/app/_server/actions/users", () => ({
   getCurrentUser: (...args: any[]) => mockGetCurrentUser(...args),
 }));
 
-vi.mock("@/app/_server/actions/checklist", () => ({
+vi.mock("@/app/_server/actions/checklist/queries", () => ({
   getUserChecklists: (...args: any[]) => mockGetUserChecklists(...args),
 }));
 
-vi.mock("@/app/_server/actions/note", () => ({
+vi.mock("@/app/_server/actions/note/queries", () => ({
   getUserNotes: (...args: any[]) => mockGetUserNotes(...args),
 }));
 
diff --git a/tests/server-actions/checklist-item.test.ts b/tests/server-actions/checklist-item.test.ts
index d895635c6..052746ac3 100644
--- a/tests/server-actions/checklist-item.test.ts
+++ b/tests/server-actions/checklist-item.test.ts
@@ -44,7 +44,7 @@ vi.mock("@/app/_server/actions/share/target", () => ({
   diskPath: (...args: any[]) => mockDiskPath(...args),
 }));
 
-vi.mock("@/app/_server/actions/checklist", () => ({
+vi.mock("@/app/_server/actions/checklist/queries", () => ({
   getUserChecklists: (...args: any[]) => mockGetUserChecklists(...args),
   getListById: (...args: any[]) => mockGetListById(...args),
   getAllLists: (...args: any[]) => mockGetAllLists(...args),
@@ -66,6 +66,7 @@ import {
   bulkToggleItems,
   bulkDeleteItems,
 } from "@/app/_server/actions/checklist-item";
+import { editItem } from "@/app/_server/actions/checklist-item/editor";
 
 const mockChecklist = {
   id: "test-list",
@@ -1219,7 +1220,7 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
           category: 'TestCategory',
         });
 
-        const result = await updateItemStatus(formData, 'shared-user');
+        const result = await updateItemStatus(formData);
 
         expect(result.success).toBe(true);
       });
@@ -1234,7 +1235,7 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
           category: 'TestCategory',
         });
 
-        const result = await updateItemStatus(formData, 'shared-user');
+        const result = await updateItemStatus(formData);
 
         expect(result.success).toBe(false);
         expect(result.error).toBe('Permission denied');
@@ -1252,7 +1253,7 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
           category: 'TestCategory',
         });
 
-        const result = await updateItemStatus(formData, 'shared-user');
+        const result = await updateItemStatus(formData);
 
         expect(result.success).toBe(true);
       });
@@ -1269,7 +1270,7 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
           category: 'TestCategory',
         });
 
-        const result = await updateItemStatus(formData, 'shared-user');
+        const result = await updateItemStatus(formData);
 
         expect(result.success).toBe(false);
       });
@@ -1543,6 +1544,61 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
       });
     });
   });
+  describe("concurrent writes on one checklist", () => {
+    let disk: typeof mockChecklist;
+
+    const shoppingList = () => ({
+      ...structuredClone(mockChecklist),
+      items: [
+        { id: "item-1", text: "First item", completed: false, order: 0 },
+        { id: "item-2", text: "Second item", completed: true, order: 1 },
+        { id: "item-3", text: "Third item", completed: false, order: 2 },
+      ],
+    });
+
+    const settle = () => new Promise((resolve) => setTimeout(resolve, 5));
+
+    beforeEach(() => {
+      disk = shoppingList();
+      mockGetListById.mockImplementation(async () => {
+        const snapshot = structuredClone(disk);
+        await settle();
+        return snapshot;
+      });
+      mockListToMarkdown.mockImplementation((list: typeof mockChecklist) =>
+        JSON.stringify(list),
+      );
+      mockServerWriteFile.mockImplementation(
+        async (_path: string, content: string) => {
+          await settle();
+          disk = JSON.parse(content);
+        },
+      );
+    });
+
+    it("should keep both ticks when two toggles land at once", async () => {
+      const [first, second] = await Promise.all([
+        updateItem(shoppingList(), createFormData({ itemId: "item-1", completed: "true" })),
+        updateItem(shoppingList(), createFormData({ itemId: "item-3", completed: "true" })),
+      ]);
+
+      expect(first.success && second.success).toBe(true);
+      expect(disk.items.find((item) => item.id === "item-1")?.completed).toBe(true);
+      expect(disk.items.find((item) => item.id === "item-3")?.completed).toBe(true);
+    });
+
+    it("should keep both items when two adds land at once", async () => {
+      await Promise.all([
+        createItem(shoppingList(), createFormData({ text: "Milk" })),
+        createItem(shoppingList(), createFormData({ text: "Eggs" })),
+      ]);
+
+      const texts = disk.items.map((item) => item.text);
+      expect(texts).toEqual(expect.arrayContaining(["Milk", "Eggs"]));
+      expect(disk.items).toHaveLength(5);
+    });
+  });
+
   describe("canonical persistence", () => {
     const forgedList = {
       ...mockChecklist,
@@ -1605,26 +1661,32 @@ describe("Checklist Item Actions - Comprehensive Tests", () => {
       expect(mockGetListById).toHaveBeenCalledWith("test-uuid-123", "testuser");
     });
 
-    it("should refuse when there is no session and no api principal", async () => {
+    it("should refuse when there is no session, whatever name is passed", async () => {
       mockGetUsername.mockResolvedValue("");
+      mockGetCurrentUser.mockResolvedValue(null);
 
       const formData = createFormData({ itemId: "item-1", completed: "true" });
 
-      const result = await updateItem(mockChecklist as any, formData);
+      const result = await updateItem(
+        mockChecklist as any,
+        formData,
+        "apiuser",
+      );
 
       expect(result.success).toBe(false);
       expect(mockServerWriteFile).not.toHaveBeenCalled();
     });
 
-    it("should let an api principal act when there is no session", async () => {
+    it("should let an api principal act through the server-only editor", async () => {
       mockGetUsername.mockResolvedValue("");
+      mockGetCurrentUser.mockResolvedValue(null);
 
       const formData = createFormData({ itemId: "item-1", completed: "true" });
 
-      const result = await updateItem(
+      const result = await editItem(
+        { username: "apiuser" } as any,
         mockChecklist as any,
         formData,
-        "apiuser",
       );
 
       expect(result.success).toBe(true);
diff --git a/tests/server-actions/comments.test.ts b/tests/server-actions/comments.test.ts
index c3da0e90e..5509598a7 100644
--- a/tests/server-actions/comments.test.ts
+++ b/tests/server-actions/comments.test.ts
@@ -28,7 +28,7 @@ vi.mock("@/app/_server/actions/share/queries", () => ({
   canReach: (...args: any[]) => mockCanReach(...args),
 }));
 
-vi.mock("@/app/_server/actions/checklist", () => ({
+vi.mock("@/app/_server/actions/checklist/queries", () => ({
   getListById: (...args: any[]) => mockGetListById(...args),
 }));
 
diff --git a/tests/server-actions/config.test.ts b/tests/server-actions/config.test.ts
index b39c23904..cfece9206 100644
--- a/tests/server-actions/config.test.ts
+++ b/tests/server-actions/config.test.ts
@@ -14,11 +14,11 @@ vi.mock("@/app/_server/actions/log", () => ({
   logAudit: (...args: any[]) => mockLogAudit(...args),
 }));
 
-vi.mock("@/app/_server/actions/checklist", () => ({
+vi.mock("@/app/_server/actions/checklist/queries", () => ({
   getListById: vi.fn().mockResolvedValue(null),
 }));
 
-vi.mock("@/app/_server/actions/note", () => ({
+vi.mock("@/app/_server/actions/note/queries", () => ({
   getNoteById: vi.fn().mockResolvedValue(null),
 }));
 
@@ -185,6 +185,34 @@ describe("Config Actions", () => {
         }),
       );
     });
+
+    it("should keep stored editor settings when the editor field is unparseable", async () => {
+      mockGetCurrentUser.mockResolvedValue({
+        username: "superadmin",
+        isAdmin: true,
+        isSuperAdmin: true,
+      });
+      mockFs.readFile.mockResolvedValue(
+        JSON.stringify({
+          appName: "Jotty",
+          editor: { historyEnabled: true, enableSlashCommands: false },
+        }),
+      );
+      mockFs.access.mockResolvedValue(undefined);
+      mockFs.writeFile.mockResolvedValue(undefined);
+
+      const formData = createFormData({
+        appName: "Jotty",
+        editor: "[object Object]",
+      });
+
+      const result = await updateAppSettings(formData);
+
+      expect(result.success).toBe(true);
+      const written = JSON.parse(mockFs.writeFile.mock.calls[0][1] as string);
+      expect(written.editor.historyEnabled).toBe(true);
+      expect(written.editor.enableSlashCommands).toBe(false);
+    });
   });
 
   describe("saveCustomCSS", () => {
diff --git a/tests/server-actions/drop-item.test.ts b/tests/server-actions/drop-item.test.ts
index 7f5bae1a9..6dd2692fb 100644
--- a/tests/server-actions/drop-item.test.ts
+++ b/tests/server-actions/drop-item.test.ts
@@ -26,7 +26,7 @@ vi.mock("@/app/_server/actions/share/target", () => ({
   diskPath: (...args: unknown[]) => mockDiskPath(...args),
 }));
 
-vi.mock("@/app/_server/actions/checklist", () => ({
+vi.mock("@/app/_server/actions/checklist/queries", () => ({
   getListById: (...args: unknown[]) => mockGetListById(...args),
 }));
 
diff --git a/tests/server-actions/history.test.ts b/tests/server-actions/history.test.ts
index 0f2446bd4..d251d8305 100644
--- a/tests/server-actions/history.test.ts
+++ b/tests/server-actions/history.test.ts
@@ -21,7 +21,7 @@ vi.mock("@/app/_server/actions/share/queries", () => ({
     canReach: (...args: any[]) => mockCanReach(...args),
 }));
 
-vi.mock("@/app/_server/actions/note", () => ({
+vi.mock("@/app/_server/actions/note/queries", () => ({
     getNoteById: (...args: any[]) => mockGetNoteById(...args),
 }));
 
diff --git a/tests/server-actions/note.test.ts b/tests/server-actions/note.test.ts
index 173978e69..967f7a89c 100644
--- a/tests/server-actions/note.test.ts
+++ b/tests/server-actions/note.test.ts
@@ -311,6 +311,28 @@ describe("Note Actions", () => {
       expect(result.error).toBe("Failed to create note");
     });
 
+    it("should refuse a category that escapes the owner's folder instead of filing it at the root", async () => {
+      mockTargetDir.mockResolvedValue({
+        dir: "/data/notes/testuser",
+        owner: "testuser",
+        category: "",
+        isMount: false,
+        isImplicit: false,
+      });
+
+      const formData = createFormData({
+        title: "Escapee",
+        category: "../elsewhere",
+        rawContent: "Content",
+      });
+
+      const result = await createNote(formData);
+
+      expect(result.success).toBeUndefined();
+      expect(result.error).toBeTruthy();
+      expect(mockServerWriteFile).not.toHaveBeenCalled();
+    });
+
     it("should refuse forged formData identity when there is no session", async () => {
       mockGetCurrentUser.mockResolvedValue(null);
 
diff --git a/tests/server-actions/read-only-mount.test.ts b/tests/server-actions/read-only-mount.test.ts
new file mode 100644
index 000000000..a3e67be2c
--- /dev/null
+++ b/tests/server-actions/read-only-mount.test.ts
@@ -0,0 +1,197 @@
+import { describe, it, expect, vi, beforeEach, afterEach, afterAll } from "vitest";
+import path from "path";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "fs";
+
+const { home, root } = vi.hoisted(() => {
+  const os = process.getBuiltinModule("os");
+  const fs = process.getBuiltinModule("fs");
+  const nodePath = process.getBuiltinModule("path");
+  const previous = process.cwd();
+
+  process.chdir(fs.mkdtempSync(nodePath.join(os.tmpdir(), "jotty-read-only-")));
+
+  return { home: previous, root: process.cwd() };
+});
+
+const mockIsAdmin = vi.fn();
+
+vi.unmock("fs/promises");
+vi.unmock("@/app/_utils/checklist-utils");
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: vi.fn(),
+}));
+
+vi.mock("next-intl/server", () => ({
+  getTranslations: async () => (key: string) => key,
+}));
+
+vi.mock("@/app/_server/actions/users", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/app/_server/actions/users")>()),
+  canAccessAllContent: async () => false,
+  isAdmin: (...args: unknown[]) => mockIsAdmin(...args),
+}));
+
+import { catUuid } from "@/app/_server/actions/share/category-info";
+import { stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
+import { isPathUuid, pathUuid } from "@/app/_server/actions/lib/read-only";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import { grepFindFileByUuid } from "@/app/_utils/grep-utils";
+import { getNoteById, getUserNotes } from "@/app/_server/actions/note/queries";
+import { buildCategoryTree } from "@/app/_utils/category-utils";
+import { migrateToInlineSharing } from "@/app/_server/actions/migration/share-migration";
+import { needsMigration } from "@/app/_server/actions/lib/migration-check";
+import { serverDeleteFile } from "@/app/_server/actions/file";
+import { dropMounts } from "@/app/_server/actions/share/mounts";
+import { CATEGORY_INFO_FILE, LEGACY_ORDER_FILE } from "@/app/_consts/sharing";
+import { DATA_DIR, SCHEMA_VERSION_FILE } from "@/app/_consts/files";
+import { Modes } from "@/app/_types/enums";
+
+const USER_DIR = path.join(root, DATA_DIR, Modes.NOTES, "alice");
+const MOUNT_DIR = path.join(USER_DIR, "git", "joplin");
+const NOTE_PATH = path.join(MOUNT_DIR, "old-note.md");
+const NOTE_BODY = "# Old note\n\nFrom the archive\n";
+const IS_ROOT = process.getuid?.() === 0;
+
+const lock = () => chmodSync(MOUNT_DIR, 0o555);
+const unlock = () => {
+  if (existsSync(MOUNT_DIR)) chmodSync(MOUNT_DIR, 0o755);
+};
+
+const leftovers = () =>
+  readdirSync(MOUNT_DIR).filter((name) => name !== "old-note.md");
+
+afterAll(() => {
+  unlock();
+  process.chdir(home);
+  rmSync(root, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  unlock();
+  rmSync(path.join(root, DATA_DIR), { recursive: true, force: true });
+  dropMounts(Modes.NOTES);
+  mockIsAdmin.mockResolvedValue(true);
+  mkdirSync(MOUNT_DIR, { recursive: true });
+  writeFileSync(NOTE_PATH, NOTE_BODY);
+  lock();
+});
+
+afterEach(() => {
+  unlock();
+  vi.restoreAllMocks();
+});
+
+describe.skipIf(IS_ROOT)("Read-only mounted category (#580)", () => {
+  it("derives a stable category uuid without writing category info", async () => {
+    const first = await catUuid(MOUNT_DIR);
+    const second = await catUuid(MOUNT_DIR);
+
+    expect(first).toBe(pathUuid(MOUNT_DIR));
+    expect(second).toBe(first);
+    expect(isPathUuid(first)).toBe(true);
+    expect(existsSync(path.join(MOUNT_DIR, CATEGORY_INFO_FILE))).toBe(false);
+    expect(leftovers()).toEqual([]);
+  });
+
+  it("derives an item uuid from the path and leaves the file untouched", async () => {
+    const uuid = await stampUuid(NOTE_PATH);
+
+    expect(uuid).toBe(pathUuid(NOTE_PATH));
+    expect(readFileSync(NOTE_PATH, "utf-8")).toBe(NOTE_BODY);
+    expect(leftovers()).toEqual([]);
+  });
+
+  it("finds an unstamped item by its derived uuid", async () => {
+    const found = await grepFindFileByUuid(USER_DIR, pathUuid(NOTE_PATH));
+
+    expect(found).toEqual({
+      filePath: NOTE_PATH,
+      id: "old-note",
+      category: "git/joplin",
+    });
+  });
+
+  it("does not scan for derived uuids when the uuid is a random one", async () => {
+    const found = await grepFindFileByUuid(
+      USER_DIR,
+      "11111111-1111-4111-8111-111111111111",
+    );
+
+    expect(found).toBeNull();
+  });
+
+  it("lists and opens read-only notes with the same uuid every time", async () => {
+    const listed = await getUserNotes({ username: "alice", metadataOnly: true });
+    const full = await getUserNotes({ username: "alice" });
+    const expected = pathUuid(NOTE_PATH);
+
+    expect(listed.data?.map((note) => note.uuid)).toEqual([expected]);
+    expect(full.data?.map((note) => note.uuid)).toEqual([expected]);
+
+    const opened = await getNoteById(expected, "alice");
+    expect(opened?.uuid).toBe(expected);
+    expect(opened?.content).toContain("From the archive");
+    expect(readFileSync(NOTE_PATH, "utf-8")).toBe(NOTE_BODY);
+  });
+
+  it("builds the category tree over a read-only folder", async () => {
+    const tree = await buildCategoryTree(USER_DIR);
+    const mount = tree.find((category) => category.path === "git/joplin");
+
+    expect(mount?.uuid).toBe(pathUuid(MOUNT_DIR));
+    expect(mount?.count).toBe(1);
+  });
+
+  it("migrates around a read-only folder with one warning and does not loop", async () => {
+    unlock();
+    writeFileSync(
+      path.join(MOUNT_DIR, LEGACY_ORDER_FILE),
+      JSON.stringify({ items: ["old-note"] }),
+    );
+    lock();
+
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const result = await migrateToInlineSharing();
+
+    expect(result.success).toBe(true);
+    expect(await needsMigration()).toBe(false);
+    expect(existsSync(path.join(root, SCHEMA_VERSION_FILE))).toBe(true);
+    expect(existsSync(path.join(MOUNT_DIR, LEGACY_ORDER_FILE))).toBe(true);
+    expect(readFileSync(NOTE_PATH, "utf-8")).toBe(NOTE_BODY);
+
+    const mountWarnings = warn.mock.calls.filter((call) =>
+      String(call[0]).includes(MOUNT_DIR),
+    );
+    expect(mountWarnings.length).toBeLessThanOrEqual(1);
+  });
+
+  it("refuses to pretend a delete in a read-only folder worked", async () => {
+    let caught: unknown;
+
+    try {
+      await serverDeleteFile(NOTE_PATH);
+    } catch (error) {
+      caught = error;
+    }
+
+    expect(existsSync(NOTE_PATH)).toBe(true);
+    expect(await failedWith(caught, "Failed to delete note")).toBe(
+      "readOnlyFolder",
+    );
+  });
+
+  it("keeps the generic message for other failures", async () => {
+    expect(await failedWith(new Error("boom"), "Failed to delete note")).toBe(
+      "Failed to delete note",
+    );
+  });
+});
diff --git a/tests/server-actions/relations.test.ts b/tests/server-actions/relations.test.ts
index f64a8ad42..57635afb9 100644
--- a/tests/server-actions/relations.test.ts
+++ b/tests/server-actions/relations.test.ts
@@ -15,8 +15,8 @@ vi.mock("@/app/_server/actions/ws/broadcast", () => ({
   broadcast: (...args: unknown[]) => mockBroadcast(...args),
 }));
 
-vi.mock("@/app/_server/actions/note", () => ({ getUserNotes: vi.fn() }));
-vi.mock("@/app/_server/actions/checklist", () => ({ getUserChecklists: vi.fn() }));
+vi.mock("@/app/_server/actions/note/queries", () => ({ getUserNotes: vi.fn() }));
+vi.mock("@/app/_server/actions/checklist/queries", () => ({ getUserChecklists: vi.fn() }));
 
 import { readLinks } from "@/app/_server/actions/relations/parser";
 import {
diff --git a/tests/server-actions/share-migration.test.ts b/tests/server-actions/share-migration.test.ts
index 10b6bf61d..a9d56a4bc 100644
--- a/tests/server-actions/share-migration.test.ts
+++ b/tests/server-actions/share-migration.test.ts
@@ -29,6 +29,12 @@ vi.mock("@/app/_server/actions/share/category-info", () => ({
   dirUuids: (...args: any[]) => mockDirUuids(...args),
 }));
 
+vi.mock("@/app/_server/actions/relations/tracking", () => ({
+  trackItemWrite: vi.fn().mockResolvedValue(undefined),
+  trackItemDelete: vi.fn().mockResolvedValue(undefined),
+  trackMove: vi.fn().mockResolvedValue(undefined),
+}));
+
 vi.mock("@/app/_utils/grep-utils", () => ({
   grepExtractFrontmatter: (...args: any[]) => mockGrepFrontmatter(...args),
   grepFindFileByUuid: vi.fn().mockResolvedValue(null),
@@ -182,4 +188,48 @@ describe("share migration ordering", () => {
       path.join(WORK_DIR, ".order.json"),
     );
   });
+
+  describe("uuid stamping", () => {
+    const BLANK = path.join(OWNER_DIR, "blank.md");
+    const BARE = path.join(OWNER_DIR, "bare.md");
+
+    beforeEach(() => {
+      mockFs.rename.mockResolvedValue(undefined);
+      mockFs.readdir.mockImplementation(async (dir: string) => {
+        if (dir === NOTES_DIR) return [dirEntry("alice")];
+        if (dir === OWNER_DIR) {
+          return [fileEntry("blank.md"), fileEntry("bare.md")];
+        }
+        return [];
+      });
+      mockFs.readFile.mockImplementation(async (target: string) => {
+        if (target === ORDER_FILE) return JSON.stringify(legacyOrder);
+        if (target === BLANK) return "  \n";
+        if (target === BARE) return "# Bare\n\nBody";
+        throw new Error("ENOENT");
+      });
+    });
+
+    const writesTo = (target: string) =>
+      mockFs.writeFile.mock.calls.filter(([written]) =>
+        String(written).includes(path.basename(target)),
+      );
+
+    it("should never write a stub over an empty read", async () => {
+      await migrateToInlineSharing();
+
+      expect(writesTo(BLANK)).toEqual([]);
+      expect(mockFs.rename).not.toHaveBeenCalledWith(expect.anything(), BLANK);
+    });
+
+    it("should stamp a bare item through a temp file and rename", async () => {
+      await migrateToInlineSharing();
+
+      const [tmpPath, written] = writesTo(BARE)[0];
+      expect(tmpPath).not.toBe(BARE);
+      expect(written).toMatch(/^uuid: \S+$/m);
+      expect(written).toContain("# Bare\n\nBody");
+      expect(mockFs.rename).toHaveBeenCalledWith(tmpPath, BARE);
+    });
+  });
 });
diff --git a/tests/utils/base64-utils.test.ts b/tests/utils/base64-utils.test.ts
new file mode 100644
index 000000000..4cfa5cf28
--- /dev/null
+++ b/tests/utils/base64-utils.test.ts
@@ -0,0 +1,76 @@
+import { describe, it, expect, vi } from "vitest";
+
+vi.unmock("unified");
+vi.unmock("unist-util-visit");
+vi.unmock("js-beautify");
+vi.unmock("@/app/_utils/markdown-utils");
+
+import {
+  base64ToSvg,
+  base64ToText,
+  repairMojibake,
+  utf8ToBase64,
+} from "@/app/_utils/base64-utils";
+import {
+  convertHtmlToMarkdown,
+  convertMarkdownToHtml,
+} from "@/app/_utils/markdown-utils";
+
+const accented = "Café à la crème, naïve façade";
+const wide = "图表 🦄 Ωmega";
+const latin1Base64 = (text: string) => btoa(text);
+const mojibakeOf = (text: string) =>
+  String.fromCharCode(...Array.from(new TextEncoder().encode(text)));
+
+describe("base64 utils", () => {
+  it.each([accented, wide, "plain ascii", ""])(
+    "should round trip %s through utf8 base64",
+    (text) => {
+      expect(base64ToText(utf8ToBase64(text))).toBe(text);
+    },
+  );
+
+  it("should match node's utf8 base64 so saved notes stay readable", () => {
+    expect(utf8ToBase64(accented)).toBe(
+      Buffer.from(accented, "utf8").toString("base64"),
+    );
+  });
+
+  it("should still read diagrams saved with plain btoa", () => {
+    expect(base64ToText(latin1Base64(accented))).toBe(accented);
+  });
+
+  it("should repair a preview saved double encoded", () => {
+    const saved = utf8ToBase64(mojibakeOf(accented));
+    expect(base64ToSvg(saved)).toBe(accented);
+  });
+
+  it("should leave real latin1 and wide text alone", () => {
+    expect(repairMojibake(accented)).toBe(accented);
+    expect(repairMojibake(wide)).toBe(wide);
+    expect(repairMojibake("<svg>ok</svg>")).toBe("<svg>ok</svg>");
+  });
+
+  it("should throw on garbage so callers can keep the raw comment", () => {
+    expect(() => base64ToText("not base64 !!")).toThrow();
+  });
+});
+
+describe("drawio diagram round trip", () => {
+  const svg = `<svg xmlns="http://www.w3.org/2000/svg"><text>${accented} ${wide}</text></svg>`;
+  const xml = `<mxfile><diagram name="${accented}"/></mxfile>`;
+
+  it("should survive editor html -> markdown -> editor html", () => {
+    const markdown = convertHtmlToMarkdown(
+      `<div data-drawio="" data-drawio-data="${xml.replace(/"/g, "&quot;")}" data-drawio-svg="${svg.replace(/"/g, "&quot;")}" data-drawio-theme="light">[Draw.io Diagram]</div>`,
+    );
+    const data = markdown.match(/data: (\S+)/)?.[1] ?? "";
+    const preview = markdown.match(/svg: (\S+)/)?.[1] ?? "";
+    expect(base64ToText(data)).toBe(xml);
+    expect(base64ToSvg(preview)).toBe(svg);
+
+    const html = convertMarkdownToHtml(markdown);
+    expect(html).toContain(accented);
+    expect(html).toContain(wide);
+  });
+});
diff --git a/tests/utils/board-utils.test.ts b/tests/utils/board-utils.test.ts
index d5a93344e..67b30675f 100644
--- a/tests/utils/board-utils.test.ts
+++ b/tests/utils/board-utils.test.ts
@@ -3,6 +3,7 @@ import {
   getColumnItems,
   visToColIndex,
   applyDrop,
+  boardColumns,
 } from "@/app/_utils/kanban/board-utils";
 import { DEFAULT_KANBAN_STATUSES } from "@/app/_consts/kanban";
 import { TaskStatus } from "@/app/_types/enums";
@@ -223,3 +224,42 @@ describe("applyDrop", () => {
     expect(applyDrop(board, "nope", TaskStatus.TODO, 0, USER, NOW)).toBe(board);
   });
 });
+
+describe("boardColumns", () => {
+  it("uses the board's own statuses and labels in board order (#598)", () => {
+    const board = {
+      ...makeBoard([
+        makeItem("a", "backlog"),
+        makeItem("b", "shipped"),
+        makeItem("c", "gone"),
+        makeItem("d", "shipped", { isArchived: true }),
+      ]),
+      statuses: [
+        { id: "shipped", label: "Shipped", order: 1 },
+        { id: "backlog", label: "Backlog", order: 0 },
+      ],
+    };
+
+    const columns = boardColumns(board);
+
+    expect(columns.map((column) => column.status.label)).toEqual([
+      "Backlog",
+      "Shipped",
+    ]);
+    expect(columns.map((column) => column.items.map((item) => item.id))).toEqual([
+      ["a", "c"],
+      ["b"],
+    ]);
+  });
+
+  it("falls back to the default statuses when the board has none", () => {
+    const board = { ...makeBoard([makeItem("a")]), statuses: undefined };
+
+    expect(boardColumns(board).map((column) => column.status.id)).toEqual(
+      [...DEFAULT_KANBAN_STATUSES]
+        .sort((a, b) => a.order - b.order)
+        .map((status) => status.id),
+    );
+    expect(boardColumns(board)[0].items.map((item) => item.id)).toEqual(["a"]);
+  });
+});
diff --git a/tests/utils/bold-italic-input.test.ts b/tests/utils/bold-italic-input.test.ts
new file mode 100644
index 000000000..352776540
--- /dev/null
+++ b/tests/utils/bold-italic-input.test.ts
@@ -0,0 +1,50 @@
+import { describe, it, expect, vi } from "vitest";
+
+vi.unmock("unified");
+vi.unmock("unist-util-visit");
+vi.unmock("js-beautify");
+vi.unmock("@/app/_utils/markdown-utils");
+
+import {
+  tripleStarRegex,
+  tripleUnderscoreRegex,
+} from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/BoldItalicInput";
+import {
+  convertHtmlToMarkdown,
+  convertMarkdownToHtml,
+} from "@/app/_utils/markdown-utils";
+
+describe("Bold italic input", () => {
+  it.each([
+    ["Today is a ***good day***", "good day"],
+    ["***start***", "start"],
+  ])("should catch %s", (typed, text) => {
+    const match = typed.match(tripleStarRegex);
+    expect(match?.[match.length - 1]).toBe(text);
+  });
+
+  it("should catch the underscore flavour", () => {
+    const match = "a ___quiet___".match(tripleUnderscoreRegex);
+    expect(match?.[match.length - 1]).toBe("quiet");
+  });
+
+  it.each(["**bold**", "*italic*", "***not yet**", "a***glued***"])(
+    "should leave %s to the other rules",
+    (typed) => {
+      expect(typed.match(tripleStarRegex)).toBeNull();
+    }
+  );
+
+  it("should store bold italic as ***text***", () => {
+    expect(
+      convertHtmlToMarkdown("<p>Today is a <strong><em>good day</em></strong></p>")
+    ).toBe("Today is a ***good day***");
+  });
+
+  it("should read ***text*** back as bold italic", () => {
+    const html = convertMarkdownToHtml("Today is a ***good day***");
+    expect(html).toMatch(/<(em|strong)><(strong|em)>good day<\/\2><\/\1>/);
+    expect(html).toContain("<strong>");
+    expect(html).toContain("<em>");
+  });
+});
diff --git a/tests/utils/checklist-frontmatter.test.ts b/tests/utils/checklist-frontmatter.test.ts
index 21683c509..3e9e7660a 100644
--- a/tests/utils/checklist-frontmatter.test.ts
+++ b/tests/utils/checklist-frontmatter.test.ts
@@ -116,4 +116,18 @@ describe("checklist frontmatter round-trip", () => {
     expect(list.sharedWith).toBeUndefined();
     expect(listToMarkdown(list)).not.toContain("sharedWith");
   });
+
+  it("keeps a multi-line description on one item line", () => {
+    const list = parseMarkdown(SHARED_BOARD, "shared-board", "Uncategorized", "fccview");
+    list.items[0].description = "first line\r\n\n- a | b";
+
+    const markdown = listToMarkdown(list);
+    const itemLines = markdown.split("\n").filter((line) => line.startsWith("- ["));
+
+    expect(itemLines).toHaveLength(1);
+
+    const reparsed = parseMarkdown(markdown, "shared-board", "Uncategorized", "fccview");
+    expect(reparsed.items[0].id).toBe("card-1");
+    expect(reparsed.items[0].description).toBe("first line\\n\\n- a | b");
+  });
 });
diff --git a/tests/utils/markdown-list-editing.test.ts b/tests/utils/markdown-list-editing.test.ts
new file mode 100644
index 000000000..84092bdfc
--- /dev/null
+++ b/tests/utils/markdown-list-editing.test.ts
@@ -0,0 +1,97 @@
+import { describe, it, expect } from "vitest";
+import {
+  handleListEnter,
+  indentListItem,
+} from "@/app/_utils/markdown-editor-utils";
+
+const CURSOR = "|";
+
+const fakeTextarea = (text: string) => {
+  const pos = text.indexOf(CURSOR);
+  const ta = {
+    value: text.replace(CURSOR, ""),
+    selectionStart: pos,
+    selectionEnd: pos,
+    setSelectionRange(start: number, end: number) {
+      ta.selectionStart = start;
+      ta.selectionEnd = end;
+    },
+  };
+  return ta as unknown as HTMLTextAreaElement;
+};
+
+const withCursor = (ta: HTMLTextAreaElement) =>
+  ta.value.slice(0, ta.selectionStart) + CURSOR + ta.value.slice(ta.selectionStart);
+
+const pressEnter = (text: string) => {
+  const ta = fakeTextarea(text);
+  return handleListEnter(ta) === null ? null : withCursor(ta);
+};
+
+const pressTab = (text: string) => {
+  const ta = fakeTextarea(text);
+  return indentListItem(ta) === null ? null : withCursor(ta);
+};
+
+describe("markdown list editing", () => {
+  describe("handleListEnter", () => {
+    it.each([
+      ["- a|", "- a\n- |"],
+      ["* a|", "* a\n* |"],
+      ["+ a|", "+ a\n+ |"],
+      ["-   a|", "-   a\n-   |"],
+      ["    - sub|", "    - sub\n    - |"],
+      ["        * deep|", "        * deep\n        * |"],
+      ["1. a|", "1. a\n2. |"],
+      ["    9.  sub|", "    9.  sub\n    10.  |"],
+      ["- [ ] a|", "- [ ] a\n- [ ] |"],
+      ["    - [x] done|", "    - [x] done\n    - [ ] |"],
+    ])("should continue %j", (input, expected) => {
+      expect(pressEnter(input)).toBe(expected);
+    });
+
+    it.each([
+      ["- a\n- |", "- a\n|"],
+      ["- a\n    - |", "- a\n|"],
+      ["1. a\n2. |", "1. a\n|"],
+      ["- [ ] a\n- [ ] |", "- [ ] a\n|"],
+    ])("should end the list on an empty item %j", (input, expected) => {
+      expect(pressEnter(input)).toBe(expected);
+    });
+
+    it.each([["plain|"], ["|- a"], ["---|"], ["**bold**|"]])(
+      "should leave %j to the default behaviour",
+      (input) => {
+        expect(pressEnter(input)).toBeNull();
+      }
+    );
+  });
+
+  describe("indentListItem", () => {
+    it.each([
+      ["- a\n- |", "- a\n    - |"],
+      ["- a\n- b|c", "- a\n    - b|c"],
+      ["* a\n* |", "* a\n    * |"],
+      ["- [ ] a\n- [ ] |", "- [ ] a\n    - [ ] |"],
+      ["1. a\n2. |", "1. a\n    1. |"],
+      ["1. a\n    1. b\n2. |", "1. a\n    1. b\n    2. |"],
+      ["1. a\n    1. b\n        1. c\n2. |", "1. a\n    1. b\n        1. c\n    2. |"],
+      ["2. |", "    1. |"],
+    ])("should indent the whole item %j", (input, expected) => {
+      expect(pressTab(input)).toBe(expected);
+    });
+
+    it.each([["plain|"], ["|"], ["text\n|"]])(
+      "should leave %j to the default tab",
+      (input) => {
+        expect(pressTab(input)).toBeNull();
+      }
+    );
+
+    it("should leave selections to the default tab", () => {
+      const ta = fakeTextarea("- a\n- b");
+      ta.setSelectionRange(0, 7);
+      expect(indentListItem(ta)).toBeNull();
+    });
+  });
+});
diff --git a/tests/utils/markdown-roundtrip.test.ts b/tests/utils/markdown-roundtrip.test.ts
new file mode 100644
index 000000000..04e7fd3e1
--- /dev/null
+++ b/tests/utils/markdown-roundtrip.test.ts
@@ -0,0 +1,105 @@
+import { describe, it, expect, vi } from "vitest";
+
+vi.unmock("unified");
+vi.unmock("unist-util-visit");
+vi.unmock("js-beautify");
+vi.unmock("@/app/_utils/markdown-utils");
+
+import {
+  convertHtmlToMarkdown,
+  convertMarkdownToHtml,
+  sanitizeMarkdown,
+} from "@/app/_utils/markdown-utils";
+
+const ZWSP = "​";
+
+const BASH_SNIPPET = [
+  "git diff --name-only -z HEAD --cached \\",
+  "| sort -zu \\",
+  "| grep -zE '\\.(ts|tsx|js|jsx|json|py|importliner)$|vite\\.config\\.mts$|\\.env\\.template$' \\",
+  "| grep -zvE '^(\\.|node_modules/|dist/)' \\",
+  "| while IFS= read -r -d '' f; do",
+  '    echo "--- FILE_START: $f ---"',
+  '    cat "$f"',
+  '    echo "--- FILE_END: $f ---"',
+  "    echo",
+  "done > script.txt",
+].join("\n");
+
+const decodeEntities = (html: string) =>
+  html
+    .replace(/&#x27;/g, "'")
+    .replace(/&quot;/g, '"')
+    .replace(/&gt;/g, ">")
+    .replace(/&lt;|&#x3C;/g, "<")
+    .replace(/&amp;|&#x26;/g, "&");
+
+describe("markdown round trip", () => {
+  const markdown = `Before\n\n\`\`\`bash\n${BASH_SNIPPET}\n\`\`\`\n\nAfter #tagged\n`;
+
+  it("keeps a bash code block with $' intact when rendering to html", () => {
+    const html = convertMarkdownToHtml(markdown);
+    const code = html.match(/<code[^>]*>([\s\S]*?)<\/code>/)?.[1] ?? "";
+
+    expect(decodeEntities(code)).toBe(`${BASH_SNIPPET}\n`);
+    expect(html).not.toContain("__CODE_BLOCK_");
+  });
+
+  it("keeps every replacement pattern literal inside code", () => {
+    const tricky = "echo $& $` $' $$ $1 $<name>";
+    const html = convertMarkdownToHtml(
+      `\`\`\`\n${tricky}\n\`\`\`\n\n#after and \`$'\` then #more`
+    );
+
+    expect(decodeEntities(html)).toContain(`<code>${tricky}\n</code>`);
+    expect(decodeEntities(html)).toContain("<code>$'</code> then");
+  });
+
+  it("survives html -> markdown -> html unchanged", () => {
+    const html = convertMarkdownToHtml(markdown);
+    const saved = convertHtmlToMarkdown(html);
+
+    expect(saved).toContain(BASH_SNIPPET);
+    expect(saved).not.toContain(ZWSP);
+    expect(convertHtmlToMarkdown(convertMarkdownToHtml(saved))).toBe(saved);
+  });
+});
+
+describe("saved note bytes", () => {
+  const editorHtml =
+    "<p>just testing this out</p><ul><li><p>goo</p></li><li><p>bar</p></li></ul><p></p>";
+
+  it("does not end a note with a zero-width space from the trailing empty paragraph", () => {
+    const markdown = convertHtmlToMarkdown(editorHtml);
+
+    expect(markdown).not.toContain(ZWSP);
+    expect(markdown.endsWith("bar")).toBe(true);
+  });
+
+  it("still keeps an empty paragraph in the middle of a note", () => {
+    const markdown = convertHtmlToMarkdown("<p>one</p><p></p><p>two</p>");
+
+    expect(markdown).toBe(`one\n\n${ZWSP}\n\ntwo`);
+  });
+
+  it("strips the CRLF a multipart form post adds and the stray zero-width tail", async () => {
+    const markdown = `just testing this out\n\n-   goo\n-   bar\n\n${ZWSP}`;
+    const form = new FormData();
+    form.append("content", markdown);
+    const received = (await new Response(form).formData()).get("content");
+
+    expect(received).toContain("\r\n");
+
+    const saved = sanitizeMarkdown(String(received));
+
+    expect(saved).not.toContain("\r");
+    expect(saved).not.toContain(ZWSP);
+    expect(saved).toBe("just testing this out\n\n-   goo\n-   bar");
+  });
+
+  it("leaves a note without a zero-width tail alone", () => {
+    expect(sanitizeMarkdown("line one\nline two\n")).toBe(
+      "line one\nline two\n"
+    );
+  });
+});
diff --git a/tests/utils/menu-placement-utils.test.ts b/tests/utils/menu-placement-utils.test.ts
new file mode 100644
index 000000000..e9d804bf3
--- /dev/null
+++ b/tests/utils/menu-placement-utils.test.ts
@@ -0,0 +1,70 @@
+import { describe, it, expect } from "vitest";
+import {
+  MenuAlign,
+  MenuSide,
+  menuPlacementClasses,
+  placeMenu,
+} from "@/app/_utils/menu-placement-utils";
+
+const bounds = { top: 60, left: 0, right: 400, bottom: 800 };
+const menu = { width: 200, height: 180 };
+const preferred = { side: MenuSide.Down, align: MenuAlign.Start };
+
+const anchorAt = (top: number, left: number) => ({
+  top,
+  left,
+  right: left + 32,
+  bottom: top + 32,
+});
+
+describe("placeMenu", () => {
+  it("keeps the preferred placement when it fits", () => {
+    expect(placeMenu(anchorAt(100, 20), menu, bounds, preferred)).toEqual(
+      preferred,
+    );
+  });
+
+  it("flips left when the rightmost anchor would overflow", () => {
+    expect(placeMenu(anchorAt(100, 360), menu, bounds, preferred).align).toBe(
+      MenuAlign.End,
+    );
+  });
+
+  it("flips right when an end aligned menu would overflow the left edge", () => {
+    expect(
+      placeMenu(anchorAt(100, 10), menu, bounds, {
+        side: MenuSide.Down,
+        align: MenuAlign.End,
+      }).align,
+    ).toBe(MenuAlign.Start);
+  });
+
+  it("flips up when there is no room below", () => {
+    expect(placeMenu(anchorAt(700, 20), menu, bounds, preferred).side).toBe(
+      MenuSide.Up,
+    );
+  });
+
+  it("opens down instead of up under the header", () => {
+    expect(
+      placeMenu(anchorAt(120, 20), menu, bounds, {
+        side: MenuSide.Up,
+        align: MenuAlign.Start,
+      }).side,
+    ).toBe(MenuSide.Down);
+  });
+
+  it("stays down when neither side fits but below is roomier", () => {
+    const tight = { ...bounds, bottom: 320 };
+    expect(placeMenu(anchorAt(150, 20), menu, tight, preferred).side).toBe(
+      MenuSide.Down,
+    );
+  });
+
+  it("builds tailwind classes for each placement", () => {
+    expect(
+      menuPlacementClasses({ side: MenuSide.Up, align: MenuAlign.End }),
+    ).toBe("bottom-full mb-1 right-0");
+    expect(menuPlacementClasses(preferred)).toBe("top-full mt-1 left-0");
+  });
+});
diff --git a/tests/utils/url-transform.test.ts b/tests/utils/url-transform.test.ts
new file mode 100644
index 000000000..cb8d1e911
--- /dev/null
+++ b/tests/utils/url-transform.test.ts
@@ -0,0 +1,88 @@
+import { describe, it, expect, vi } from "vitest";
+
+vi.unmock("unified");
+vi.unmock("unist-util-visit");
+vi.unmock("js-beautify");
+vi.unmock("@/app/_utils/markdown-utils");
+
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import ReactMarkdown from "react-markdown";
+import rehypeRaw from "rehype-raw";
+import { noteUrlTransform } from "@/app/_utils/url-transform-utils";
+import {
+  convertHtmlToMarkdown,
+  convertMarkdownToHtml,
+} from "@/app/_utils/markdown-utils";
+
+describe("noteUrlTransform", () => {
+  it.each([
+    "tel:+18005551212",
+    "TEL:+18005551212",
+    "sms:+18005551212?body=hi",
+    "mailto:someone@example.com",
+    "https://example.com",
+    "http://example.com/path?q=1#x",
+    "/note/abc",
+    "#heading",
+    "relative/path",
+  ])("should keep %s", (url) => {
+    expect(noteUrlTransform(url)).toBe(url);
+  });
+
+  it.each([
+    "javascript:alert(1)",
+    "JavaScript:alert(1)",
+    "java\nscript:alert(1)",
+    " javascript:alert(1)",
+    "\u0001javascript:alert(1)",
+    "data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==",
+    "vbscript:msgbox(1)",
+    "file:///etc/passwd",
+    "tel\n:javascript:alert(1)",
+    "xtel:+1800",
+  ])("should block %s", (url) => {
+    expect(noteUrlTransform(url)).toBe("");
+  });
+});
+
+describe("tel links through the editor round trip", () => {
+  it("should keep tel: when markdown becomes editor html", () => {
+    expect(convertMarkdownToHtml("[Call](tel:+18005551212)")).toContain(
+      'href="tel:+18005551212"',
+    );
+  });
+
+  it("should keep tel: when editor html is saved back to markdown", () => {
+    expect(
+      convertHtmlToMarkdown('<p><a href="tel:+18005551212">Call</a></p>'),
+    ).toBe("[Call](tel:+18005551212)");
+  });
+});
+
+describe("tel links in the note view", () => {
+  const render = (markdown: string) =>
+    renderToStaticMarkup(
+      createElement(
+        ReactMarkdown,
+        { rehypePlugins: [rehypeRaw], urlTransform: noteUrlTransform },
+        markdown,
+      ),
+    );
+
+  it("should render markdown and raw html tel links", () => {
+    const html = render(
+      '[Call](tel:+18005551212) <a href="sms:+18005551212">Text</a>',
+    );
+    expect(html).toContain('href="tel:+18005551212"');
+    expect(html).toContain('href="sms:+18005551212"');
+  });
+
+  it("should still empty dangerous hrefs from markdown and raw html", () => {
+    const html = render(
+      '[x](javascript:alert(1)) <a href="data:text/html,hi">y</a>',
+    );
+    expect(html).not.toContain("javascript:");
+    expect(html).not.toContain("data:");
+  });
+});

From ddc6d7cb6df3aa43d1551202c9f41be74384dac0 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 20:55:30 +0100
Subject: [PATCH 11/28] address bunny nitpicks so we can have a bugs free
 instance

---
 .../Brain/Parts/BrainScene3D.tsx              |   9 +
 .../Checklists/Parts/ChecklistClient.tsx      |   4 +-
 .../Parts/Common/ChecklistModals.tsx          |   8 +-
 .../FeatureComponents/Header/QuickNav.tsx     |  23 +-
 .../FeatureComponents/Kanban/KanbanCard.tsx   |   2 +-
 .../FeatureComponents/Notes/NoteClient.tsx    |   2 +-
 .../Parts/CodeBlock/CodeBlockNodeView.tsx     |   7 +-
 .../Notes/Parts/NoteEditor/NoteEditor.tsx     |  11 +-
 .../Parts/NoteEditor/NoteEditorContent.tsx    |  27 +-
 .../Parts/TipTap/EditorUtils/editorConfig.ts  |   3 +
 .../Parts/TipTap/FloatingMenu/BubbleMenu.tsx  | 105 +++---
 .../Notes/Parts/TipTap/TipTapEditor.tsx       |   2 +
 .../TipTap/Toolbar/ExtraItemsDropdown.tsx     |  17 +-
 .../Notes/Parts/UnifiedMarkdownRenderer.tsx   |  15 +-
 .../Profile/Parts/SessionManager.tsx          |   8 +-
 .../Profile/Parts/UserPreferencesTab.tsx      |   1 +
 .../Dropdowns/CategoryTreeSelector.tsx        |  53 ++-
 .../GlobalComponents/Dropdowns/Dropdown.tsx   |   3 +
 .../Modals/FilesModal/FileModal.tsx           |   4 +-
 .../Modals/UserModals/UserManagementModal.tsx |   4 +-
 app/_consts/kanban.ts                         |   6 +
 app/_hooks/kanban/useKanbanItem.tsx           |   2 +-
 app/_hooks/useBottomBarSpace.ts               |  30 +-
 app/_hooks/useChecklist.tsx                   |   2 +-
 app/_hooks/useFileManager.tsx                 |   2 +-
 app/_hooks/useNoteEditor.tsx                  |  18 +-
 app/_hooks/useSessionManager.tsx              |   4 +-
 app/_hooks/useUserManagementModal.tsx         |   2 +-
 app/_server/actions/checklist-item/crud.ts    | 126 +------
 app/_server/actions/checklist-item/grafter.ts | 151 ++++++++
 app/_server/actions/checklist-item/remover.ts | 103 ++++++
 .../actions/checklist-item/sub-items.ts       | 155 +-------
 app/_server/actions/checklist/converters.ts   | 114 +-----
 app/_server/actions/checklist/editor.ts       |  10 +-
 app/_server/actions/checklist/restatus.ts     | 120 ++++++
 app/_server/actions/config/settings.ts        |  27 +-
 app/_server/actions/config/validators.ts      |  36 +-
 app/_server/actions/kanban/calendar.ts        |  20 +-
 app/_server/actions/kanban/items.ts           | 241 ++----------
 app/_server/actions/kanban/search.ts          |  14 +-
 app/_server/actions/kanban/tweaker.ts         | 138 +++++++
 app/_server/actions/note/editor.ts            |   6 +-
 app/_server/actions/relations/queries.ts      |   7 +-
 app/_server/actions/relations/tidy.ts         |   5 +-
 app/_server/actions/share/access.ts           |   1 +
 app/_styles/globals.css                       |   8 +-
 app/_translations/en.json                     |   2 +
 app/_types/note.ts                            |   1 +
 app/_utils/api-utils.ts                       |  12 +-
 app/_utils/grep-utils.ts                      |  30 +-
 app/_utils/markdown-utils.tsx                 |  14 +-
 .../[listId]/items/[itemIndex]/route.ts       |  56 +--
 .../[listId]/items/reorder/route.ts           | 139 +++----
 app/api/checklists/[listId]/items/route.ts    |  72 +---
 .../[boardId]/items/[itemId]/assign/route.ts  |  14 +-
 .../items/[itemId]/reminder/route.ts          |  21 +-
 .../kanban/[boardId]/items/[itemId]/route.ts  |   8 +-
 app/api/kanban/[boardId]/statuses/route.ts    |   8 +-
 .../tasks/[taskId]/items/[itemIndex]/route.ts |  56 +--
 app/api/tasks/[taskId]/items/route.ts         |  74 +---
 .../[taskId]/statuses/[statusId]/route.ts     | 127 +++----
 app/api/tasks/[taskId]/statuses/route.ts      |  57 ++-
 tests/api/setup.ts                            |  42 +++
 tests/security/share-grants.test.ts           | 348 ++++++++++++++++++
 tests/server-actions/config.test.ts           |  77 ++++
 tests/server-actions/item-lane.test.ts        | 161 ++++++++
 tests/server-actions/read-only-mount.test.ts  |  23 ++
 tests/server-actions/share-visibility.test.ts |   5 +-
 tests/utils/markdown-roundtrip.test.ts        |   9 +
 69 files changed, 1831 insertions(+), 1181 deletions(-)
 create mode 100644 app/_server/actions/checklist-item/grafter.ts
 create mode 100644 app/_server/actions/checklist-item/remover.ts
 create mode 100644 app/_server/actions/checklist/restatus.ts
 create mode 100644 app/_server/actions/kanban/tweaker.ts
 create mode 100644 tests/security/share-grants.test.ts
 create mode 100644 tests/server-actions/item-lane.test.ts

diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx
index c00b156a6..2bf967d47 100644
--- a/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx
@@ -309,6 +309,15 @@ export default function BrainScene3D({
     return parts.group;
   }, []);
 
+  useEffect(() => {
+    const ids = new Set(graphData.nodes.map((node) => node.id));
+    partsRef.current.forEach((parts, id) => {
+      if (ids.has(id)) return;
+      disposeParts(parts);
+      partsRef.current.delete(id);
+    });
+  }, [graphData.nodes]);
+
   useEffect(() => {
     graphData.nodes.forEach((node) => {
       const parts = partsRef.current.get(node.id);
diff --git a/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient.tsx b/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient.tsx
index 45bc00d7f..26c92f503 100644
--- a/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient.tsx
+++ b/app/_components/FeatureComponents/Checklists/Parts/ChecklistClient.tsx
@@ -117,7 +117,7 @@ export const ChecklistClient = ({
     getNewType,
     handleConfirmConversion,
     sensors,
-    DeleteModal,
+    deleteModal,
   } = useChecklist({
     list: localChecklist,
     onUpdate: handleUpdate,
@@ -241,7 +241,7 @@ export const ChecklistClient = ({
         />
       )}
 
-      <DeleteModal />
+      {deleteModal}
       {showCloneModal && (
         <CloneCategoryModal
           isOpen={showCloneModal}
diff --git a/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistModals.tsx b/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistModals.tsx
index 8448e1d04..881ba176c 100644
--- a/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistModals.tsx
+++ b/app/_components/FeatureComponents/Checklists/Parts/Common/ChecklistModals.tsx
@@ -5,7 +5,7 @@ import { Checklist, ChecklistType } from "@/app/_types";
 import { useRouter } from "next/navigation";
 import { useTranslations } from "next-intl";
 
-import type { JSX } from "react";
+import type { ReactNode } from "react";
 
 interface ChecklistModalsProps {
   localList: Checklist;
@@ -19,7 +19,7 @@ interface ChecklistModalsProps {
   getNewType: (type: ChecklistType) => ChecklistType;
   handleBulkPaste: (itemsText: string) => void;
   isLoading: boolean;
-  DeleteModal: () => JSX.Element;
+  deleteModal: ReactNode;
 }
 
 export const ChecklistModals = ({
@@ -34,7 +34,7 @@ export const ChecklistModals = ({
   setShowBulkPasteModal,
   handleBulkPaste,
   isLoading,
-  DeleteModal,
+  deleteModal,
 }: ChecklistModalsProps) => {
   const router = useRouter();
   const t = useTranslations();
@@ -71,7 +71,7 @@ export const ChecklistModals = ({
           isLoading={isLoading}
         />
       )}
-      <DeleteModal />
+      {deleteModal}
     </>
   );
 };
diff --git a/app/_components/FeatureComponents/Header/QuickNav.tsx b/app/_components/FeatureComponents/Header/QuickNav.tsx
index 2d04760ae..2e9e440b4 100644
--- a/app/_components/FeatureComponents/Header/QuickNav.tsx
+++ b/app/_components/FeatureComponents/Header/QuickNav.tsx
@@ -23,6 +23,8 @@ import { useState, useEffect, useRef } from "react";
 import { useTranslations } from "next-intl";
 import { useBottomBarSpace } from "@/app/_hooks/useBottomBarSpace";
 
+const FLOATING_GAP = "2.5rem";
+
 interface QuickNavProps {
   showSidebarToggle?: boolean;
   onSidebarToggle?: () => void;
@@ -49,13 +51,10 @@ export const QuickNav = ({
   const showTagsTab = tagsEnabled && totalTags > 0;
   const t = useTranslations();
   const [isScrolled, setIsScrolled] = useState(true);
+  const [isAtTop, setIsAtTop] = useState(true);
   const lastScrollY = useRef(0);
   const navRef = useRef<HTMLElement>(null);
 
-  useBottomBarSpace(navRef, BottomBarSpaces.QUICK_NAV, {
-    enabled: !isEditorInEditMode,
-    frozen: !isScrolled,
-  });
 
   const handleLogout = async () => {
     await logout();
@@ -65,6 +64,10 @@ export const QuickNav = ({
   useEffect(() => {
     const handleGlobalScroll = (e: Event) => {
       handleScroll(e, "jotty-scrollable-content", setIsScrolled, lastScrollY);
+      const target = e.target as HTMLElement;
+      if (target.classList?.contains("jotty-scrollable-content")) {
+        setIsAtTop(target.scrollTop <= 0);
+      }
     };
 
     window.addEventListener("scroll", handleGlobalScroll, true);
@@ -74,8 +77,17 @@ export const QuickNav = ({
     };
   }, []);
 
+  const isDocked = isAtTop && !isEditorInEditMode;
+
+  useBottomBarSpace(navRef, BottomBarSpaces.QUICK_NAV, {
+    enabled: !isEditorInEditMode,
+    offset: FLOATING_GAP,
+  });
+
   const mobileClasses =
     "max-w-[80%] w-full rounded-jotty left-[10%] border bg-muted text-muted-foreground";
+  const dockedClasses =
+    "bottom-0 left-0 max-w-full rounded-none border-x-0 border-b-0 pb-[max(0.5rem,env(safe-area-inset-bottom))]";
   const desktopClasses =
     "lg:max-w-full lg:left-auto lg:rounded-none lg:border-none lg:bg-background";
 
@@ -84,11 +96,12 @@ export const QuickNav = ({
       <nav
         ref={navRef}
         className={cn(
-          "jotty-quick-nav fixed z-30 flex items-center justify-between p-2 lg:justify-around transition-[bottom] duration-300 ease-in-out",
+          "jotty-quick-nav fixed z-30 flex items-center justify-between p-2 lg:justify-around transition-[bottom,left,max-width,border-radius,padding] duration-300 ease-in-out",
           "lg:relative lg:bottom-auto lg:h-auto lg:justify-end lg:px-6 lg:py-5",
           mobileClasses,
           desktopClasses,
           isScrolled && !isEditorInEditMode ? "bottom-10" : "-bottom-20",
+          isDocked && dockedClasses,
           isEditorInEditMode && "lg:relative lg:bottom-auto",
         )}
       >
diff --git a/app/_components/FeatureComponents/Kanban/KanbanCard.tsx b/app/_components/FeatureComponents/Kanban/KanbanCard.tsx
index c55583f2f..800862224 100644
--- a/app/_components/FeatureComponents/Kanban/KanbanCard.tsx
+++ b/app/_components/FeatureComponents/Kanban/KanbanCard.tsx
@@ -307,7 +307,7 @@ const KanbanCardComponent = ({
           </div>
         </div>
       </div>
-      <kanbanItemHook.DeleteModal />
+      {kanbanItemHook.deleteModal}
     </>
   );
 };
diff --git a/app/_components/FeatureComponents/Notes/NoteClient.tsx b/app/_components/FeatureComponents/Notes/NoteClient.tsx
index 7b6669885..2e9968d00 100644
--- a/app/_components/FeatureComponents/Notes/NoteClient.tsx
+++ b/app/_components/FeatureComponents/Notes/NoteClient.tsx
@@ -124,7 +124,7 @@ export const NoteClient = ({ note, categories }: NoteClientProps) => {
           onClone={handleClone}
         />
       </SwipeNavigationWrapper>
-      <viewModel.DeleteModal />
+      {viewModel.deleteModal}
       {showCloneModal && (
         <CloneCategoryModal
           isOpen={showCloneModal}
diff --git a/app/_components/FeatureComponents/Notes/Parts/CodeBlock/CodeBlockNodeView.tsx b/app/_components/FeatureComponents/Notes/Parts/CodeBlock/CodeBlockNodeView.tsx
index be3519602..5d4d3622c 100644
--- a/app/_components/FeatureComponents/Notes/Parts/CodeBlock/CodeBlockNodeView.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/CodeBlock/CodeBlockNodeView.tsx
@@ -5,6 +5,8 @@ import { CodeBlockRenderer } from "./CodeBlockRenderer";
 import { ThemedCodeBlockRenderer } from "./ThemedCodeBlockRenderer";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 
+const TRAILING_NEWLINE = /\n$/;
+
 export const CodeBlockNodeView = ({ node }: any) => {
   const { user } = useAppMode();
   const Renderer =
@@ -14,7 +16,10 @@ export const CodeBlockNodeView = ({ node }: any) => {
 
   return (
     <NodeViewWrapper>
-      <Renderer language={node.attrs.language} code={node.textContent}>
+      <Renderer
+        language={node.attrs.language}
+        code={node.textContent.replace(TRAILING_NEWLINE, "")}
+      >
         <NodeViewContent<"code"> as="code" spellCheck={false} />
       </Renderer>
     </NodeViewWrapper>
diff --git a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditor.tsx b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditor.tsx
index 0093c25a1..cb431989c 100644
--- a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditor.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditor.tsx
@@ -41,8 +41,8 @@ export const NoteEditor = ({
     searchParams?.get("editor") === "true";
 
   return (
-    <NoteQuickBar active={viewModel.isEditing}>
-      <div className="jotty-note-bar-gutter flex-1 flex flex-col overflow-hidden bg-background h-full">
+    <NoteQuickBar active={viewModel.isEditorVisible}>
+      <div className="flex-1 flex flex-col overflow-hidden bg-background h-full">
         <NoteEditorHeader
           note={note}
           categories={categories}
@@ -57,9 +57,9 @@ export const NoteEditor = ({
         />
 
         <div className="flex flex-1 w-full relative min-h-0">
-          <div className="jotty-quick-nav-gutter flex-1 overflow-y-auto jotty-scrollable-content min-h-0">
+          <div className="flex-1 overflow-y-auto jotty-scrollable-content jotty-quick-nav-gutter min-h-0">
             <NoteEditorContent
-              isEditing={viewModel.isEditing}
+              isEditorVisible={viewModel.isEditorVisible}
               noteContent={note.content}
               editorContent={viewModel.editorContent}
               onEditorContentChange={viewModel.handleEditorContentChange}
@@ -67,8 +67,7 @@ export const NoteEditor = ({
               encrypted={note.encrypted}
               onOpenDecryptModal={() => decryptModalRef.current?.()}
               onOpenViewModal={() => viewModalRef.current?.()}
-              isEditingEncrypted={viewModel.isEditingEncrypted}
-            />
+              />
           </div>
 
           {showTOC && (
diff --git a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorContent.tsx b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorContent.tsx
index 6c0f30dd5..deb0339e3 100644
--- a/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorContent.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/NoteEditor/NoteEditorContent.tsx
@@ -7,9 +7,7 @@ import { ReferencedBySection } from "@/app/_components/FeatureComponents/Notes/P
 import { ReadingProgressBar } from "@/app/_components/GlobalComponents/Layout/ReadingProgressBar";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 import { useSettings } from "@/app/_utils/settings-store";
-import { useSearchParams } from "next/navigation";
 import { useEffect, useRef, useMemo } from "react";
-import { usePermissions } from "@/app/_providers/PermissionsProvider";
 import { MinimalEditorPanel } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/MinimalEditorPanel";
 import { useMinimalMode } from "@/app/_hooks/useMinimalMode";
 import { LockKeyIcon, ViewIcon, SquareUnlock01Icon } from "hugeicons-react";
@@ -22,7 +20,7 @@ import { useTranslations } from "next-intl";
 import { ItemTypes } from "@/app/_types/enums";
 
 interface NoteEditorContentProps {
-  isEditing: boolean;
+  isEditorVisible: boolean;
   noteContent?: string;
   editorContent: string;
   onEditorContentChange: (
@@ -34,11 +32,10 @@ interface NoteEditorContentProps {
   encrypted?: boolean;
   onOpenDecryptModal?: () => void;
   onOpenViewModal?: () => void;
-  isEditingEncrypted?: boolean;
 }
 
 export const NoteEditorContent = ({
-  isEditing,
+  isEditorVisible,
   noteContent,
   editorContent,
   onEditorContentChange,
@@ -46,22 +43,17 @@ export const NoteEditorContent = ({
   encrypted,
   onOpenDecryptModal,
   onOpenViewModal,
-  isEditingEncrypted,
 }: NoteEditorContentProps) => {
   const t = useTranslations();
   const { user, notes, checklists } = useAppMode();
   const { compactMode } = useSettings();
-  const searchParams = useSearchParams();
-  const notesDefaultMode = user?.notesDefaultMode || "view";
-  const editor = searchParams?.get("editor");
   const editorRef = useRef<TiptapEditorRef>(null);
-  const { permissions } = usePermissions();
   const isMinimalMode = useMinimalMode();
 
   useEffect(() => {
     if (
       editorRef.current &&
-      (isEditing || notesDefaultMode === "edit" || editor === "true") &&
+      isEditorVisible &&
       !isMinimalMode
     ) {
       editorRef.current.updateAtMentionData(
@@ -73,18 +65,11 @@ export const NoteEditorContent = ({
   }, [
     notes,
     checklists,
-    isEditing,
-    notesDefaultMode,
-    editor,
+    isEditorVisible,
     editorRef,
     isMinimalMode,
   ]);
 
-  const isEditMode =
-    (notesDefaultMode === "edit" || editor === "true" || isEditing) &&
-    permissions?.canEdit &&
-    (!encrypted || isEditingEncrypted);
-
   const isContentEncrypted = isEncrypted(editorContent || "");
 
   if (isContentEncrypted) {
@@ -137,7 +122,7 @@ export const NoteEditorContent = ({
   if (isMinimalMode) {
     return (
       <MinimalEditorPanel
-        isEditing={isEditMode ?? false}
+        isEditing={isEditorVisible}
         noteContent={encrypted ? editorContent : noteContent || ""}
         onEditorContentChange={onEditorContentChange}
       />
@@ -146,7 +131,7 @@ export const NoteEditorContent = ({
 
   return (
     <div className="flex-1 h-full">
-      {isEditMode ? (
+      {isEditorVisible ? (
         <TiptapEditor
           ref={editorRef}
           content={editorContent}
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/EditorUtils/editorConfig.ts b/app/_components/FeatureComponents/Notes/Parts/TipTap/EditorUtils/editorConfig.ts
index 5bfb1133e..eb0838b6c 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/EditorUtils/editorConfig.ts
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/EditorUtils/editorConfig.ts
@@ -97,6 +97,9 @@ export const createEditorExtensions = (
     Highlight.configure({
       multicolor: true,
     }).extend({
+      addKeyboardShortcuts() {
+        return {};
+      },
       addAttributes() {
         return {
           color: {
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/FloatingMenu/BubbleMenu.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/FloatingMenu/BubbleMenu.tsx
index 123a5a3a5..0979e2623 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/FloatingMenu/BubbleMenu.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/FloatingMenu/BubbleMenu.tsx
@@ -14,9 +14,24 @@ import {
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { ColorPicker } from "../ColorPicker/ColorPicker";
 import { useState, useRef, useEffect } from "react";
+import { createPortal } from "react-dom";
+import { MenuBox, menuBounds } from "@/app/_utils/menu-placement-utils";
 import { PromptModal } from "@/app/_components/GlobalComponents/Modals/ConfirmationModals/PromptModal";
 import { useTranslations } from "next-intl";
 
+const MENU_GAP = 8;
+const MOBILE_MENU_GAP = 20;
+const VIEWPORT_MARGIN = 8;
+const MOBILE_BREAKPOINT = 768;
+const MOBILE_AGENT = /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i;
+
+const selectionBounds = (editor: Editor, pos: number): MenuBox => {
+  const { node } = editor.view.domAtPos(pos);
+  const element = node instanceof HTMLElement ? node : node.parentElement;
+  if (element) return menuBounds(element);
+  return { top: 0, left: 0, right: window.innerWidth, bottom: window.innerHeight };
+};
+
 interface BubbleMenuProps {
   editor: Editor;
   isVisible: boolean;
@@ -40,48 +55,45 @@ export const BubbleMenu = ({ editor, isVisible, onClose }: BubbleMenuProps) => {
     if (!isVisible || !menuRef.current) return;
 
     const updatePosition = () => {
-      if (menuRef.current) {
-        const { from, to } = editor.state.selection;
-        if (from === to) return;
-
-        const startCoords = editor.view.coordsAtPos(from);
-        const endCoords = editor.view.coordsAtPos(to);
-        const menuRect = menuRef.current.getBoundingClientRect();
-        const viewportWidth = window.innerWidth;
-        const isMobile = /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent) ||
-                         window.innerWidth < 768;
-
-        let top: number;
-        let left: number;
-
-        if (isMobile) {
-          top = endCoords.bottom + 20;
-          left = endCoords.left;
-        } else {
-          top = startCoords.top - menuRect.height - 8;
-          left = startCoords.left;
-          if (top < 0) {
-            top = startCoords.bottom + 8;
-          }
-        }
-
-        if (left + menuRect.width > viewportWidth) {
-          left = viewportWidth - menuRect.width - 8;
-        }
-
-        if (left < 0) {
-          left = 8;
-        }
-
-        menuRef.current.style.left = `${left}px`;
-        menuRef.current.style.top = `${top}px`;
-
-        setColorPickerPosition({
-          x: left,
-          y: top - 10,
-        });
-        setTargetElement(menuRef.current);
-      }
+      const menu = menuRef.current;
+      if (!menu) return;
+      const { from, to, empty } = editor.state.selection;
+      if (empty) return;
+
+      const start = editor.view.coordsAtPos(from);
+      const end = editor.view.coordsAtPos(to);
+      const { width, height } = menu.getBoundingClientRect();
+      const viewportWidth = window.innerWidth;
+      const bounds = selectionBounds(editor, from);
+      const isMobile =
+        MOBILE_AGENT.test(navigator.userAgent) ||
+        viewportWidth < MOBILE_BREAKPOINT;
+
+      const above = Math.min(start.top, end.top) - height - MENU_GAP;
+      const below =
+        Math.max(start.bottom, end.bottom) +
+        (isMobile ? MOBILE_MENU_GAP : MENU_GAP);
+      const fitsAbove = above >= bounds.top + VIEWPORT_MARGIN;
+      const fitsBelow = below + height <= bounds.bottom - VIEWPORT_MARGIN;
+      const placeBelow = isMobile
+        ? fitsBelow || !fitsAbove
+        : !fitsAbove && fitsBelow;
+
+      const top = placeBelow ? below : above;
+      const anchorLeft = isMobile ? end.left : start.left;
+      const left = Math.max(
+        VIEWPORT_MARGIN,
+        Math.min(anchorLeft, viewportWidth - width - VIEWPORT_MARGIN),
+      );
+
+      menu.style.left = `${left}px`;
+      menu.style.top = `${top}px`;
+
+      setColorPickerPosition({
+        x: left,
+        y: top - 10,
+      });
+      setTargetElement(menu);
     };
 
     updatePosition();
@@ -91,10 +103,12 @@ export const BubbleMenu = ({ editor, isVisible, onClose }: BubbleMenuProps) => {
 
     window.addEventListener("scroll", handleScroll, true);
     window.addEventListener("resize", handleResize);
+    editor.on("selectionUpdate", updatePosition);
 
     return () => {
       window.removeEventListener("scroll", handleScroll, true);
       window.removeEventListener("resize", handleResize);
+      editor.off("selectionUpdate", updatePosition);
     };
   }, [isVisible, editor]);
 
@@ -138,9 +152,9 @@ export const BubbleMenu = ({ editor, isVisible, onClose }: BubbleMenuProps) => {
     return editor.getAttributes("highlight").color || "";
   };
 
-  if (!isVisible) return null;
+  if (!isVisible || typeof document === "undefined") return null;
 
-  return (
+  return createPortal(
     <>
       <div
         ref={menuRef}
@@ -254,6 +268,7 @@ export const BubbleMenu = ({ editor, isVisible, onClose }: BubbleMenuProps) => {
         defaultValue={previousUrl}
         confirmText={t("common.confirm")}
       />
-    </>
+    </>,
+    document.body,
   );
 };
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/TipTapEditor.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/TipTapEditor.tsx
index 893a2694f..f8a62cba5 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/TipTapEditor.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/TipTapEditor.tsx
@@ -27,6 +27,7 @@ import { VisualEditor } from "@/app/_components/FeatureComponents/Notes/Parts/Ti
 import { BubbleMenu } from "@/app/_components/FeatureComponents/Notes/Parts/TipTap/FloatingMenu/BubbleMenu";
 import { UnifiedMarkdownRenderer } from "@/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer";
 import { useTranslations } from "next-intl";
+import { menuCeilingProps } from "@/app/_utils/menu-placement-utils";
 
 type TiptapEditorProps = {
   content: string;
@@ -352,6 +353,7 @@ export const TiptapEditor = forwardRef<TiptapEditorRef, TiptapEditorProps>(
       <div className="flex flex-col h-full pb-0">
         <div
           className={`bg-background border-b border-border px-4 flex items-center justify-between sticky top-0 z-10 py-2`}
+          {...menuCeilingProps}
         >
           <TiptapToolbar
             editor={editor}
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/Toolbar/ExtraItemsDropdown.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/Toolbar/ExtraItemsDropdown.tsx
index 4dc5116ea..8454e4d5f 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/Toolbar/ExtraItemsDropdown.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/Toolbar/ExtraItemsDropdown.tsx
@@ -134,11 +134,12 @@ export const ExtraItemsDropdown = ({
           if (isMarkdownMode) {
             handleMarkdownInsert(MarkdownUtils.insertHighlight);
           } else {
-            editor.chain().focus().toggleMark("mark").run();
+            editor.chain().focus().toggleHighlight().run();
           }
         },
-        isActive: editor && editor.isActive("mark"),
+        isActive: editor && editor.isActive("highlight"),
         shortcut: { code: "KeyH", modKey: true, shiftKey: true },
+        textareaOwnsKey: true,
       },
       {
         icon: <TextSubscriptIcon className="h-4 w-4" />,
@@ -186,11 +187,13 @@ export const ExtraItemsDropdown = ({
 
   const shortcuts = useMemo(
     () =>
-      items.map((item) => ({
-        ...item.shortcut,
-        handler: item.command,
-      })),
-    [items]
+      items
+        .filter((item) => !(isMarkdownMode && item.textareaOwnsKey))
+        .map((item) => ({
+          ...item.shortcut,
+          handler: item.command,
+        })),
+    [items, isMarkdownMode]
   );
 
   useShortcuts(shortcuts);
diff --git a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
index ad93a231c..5234f3b54 100644
--- a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
@@ -33,6 +33,7 @@ import { matchCallout } from "@/app/_utils/callout-utils";
 import { CalloutType } from "@/app/_consts/callouts";
 import { base64ToSvg, base64ToText } from "@/app/_utils/base64-utils";
 import { noteUrlTransform } from "@/app/_utils/url-transform-utils";
+import { tagOutsideCode } from "@/app/_utils/markdown-utils";
 
 type WikiLinkComponents = Record<
   typeof WIKILINK_TAG,
@@ -125,19 +126,7 @@ export const UnifiedMarkdownRenderer = ({
     },
   );
 
-  const codeBlockRegex = /```[\s\S]*?```|`[^`]+`/g;
-  const codeBlocks: string[] = [];
-  processedContent = processedContent.replace(codeBlockRegex, (match) => {
-    codeBlocks.push(match);
-    return `__CODE_BLOCK_${codeBlocks.length - 1}__`;
-  });
-  processedContent = processedContent.replace(
-    /(?:^|(?<=[\s(]))#([a-zA-Z][a-zA-Z0-9_/-]*)/gm,
-    '<span data-tag="$1">$1</span>',
-  );
-  codeBlocks.forEach((block, i) => {
-    processedContent = processedContent.replace(`__CODE_BLOCK_${i}__`, block);
-  });
+  processedContent = tagOutsideCode(processedContent);
 
   useEffect(() => {
     setIsClient(true);
diff --git a/app/_components/FeatureComponents/Profile/Parts/SessionManager.tsx b/app/_components/FeatureComponents/Profile/Parts/SessionManager.tsx
index b3702960c..75b32d5f1 100644
--- a/app/_components/FeatureComponents/Profile/Parts/SessionManager.tsx
+++ b/app/_components/FeatureComponents/Profile/Parts/SessionManager.tsx
@@ -18,8 +18,8 @@ export const SessionManager = () => {
     terminating,
     handleTerminateSession,
     handleTerminateAllOtherSessions,
-    TerminateSessionModal,
-    TerminateAllSessionsModal,
+    terminateSessionModal,
+    terminateAllSessionsModal,
   } = useSessionManager();
 
   const { isDemoMode } = useAppMode();
@@ -72,8 +72,8 @@ export const SessionManager = () => {
         ))}
       </div>
 
-      <TerminateSessionModal />
-      <TerminateAllSessionsModal />
+      {terminateSessionModal}
+      {terminateAllSessionsModal}
     </div>
   );
 };
diff --git a/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx b/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx
index 15693784c..b3bbbf1fb 100644
--- a/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx
+++ b/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx
@@ -1024,6 +1024,7 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
             {t('settings.newItemInsertion')}
           </Label>
           <Dropdown
+            id="new-item-insertion"
             value={currentSettings.newItemInsertion || "top"}
             onChange={(value) =>
               handleSettingChange(
diff --git a/app/_components/GlobalComponents/Dropdowns/CategoryTreeSelector.tsx b/app/_components/GlobalComponents/Dropdowns/CategoryTreeSelector.tsx
index 02d953d2f..9cf95d1d7 100644
--- a/app/_components/GlobalComponents/Dropdowns/CategoryTreeSelector.tsx
+++ b/app/_components/GlobalComponents/Dropdowns/CategoryTreeSelector.tsx
@@ -1,6 +1,13 @@
 "use client";
 
-import { useState, useEffect, useRef, useMemo, useCallback } from "react";
+import {
+  useState,
+  useEffect,
+  useLayoutEffect,
+  useRef,
+  useMemo,
+  useCallback,
+} from "react";
 import { createPortal } from "react-dom";
 import { ArrowDown01Icon, Folder01Icon } from "hugeicons-react";
 import { cn } from "@/app/_utils/global-utils";
@@ -10,7 +17,9 @@ import { canFill } from "@/app/_utils/sharing-utils";
 import { useTranslations } from "next-intl";
 
 const DROPDOWN_MAX_HEIGHT = 240;
+const DROPDOWN_MIN_HEIGHT = 120;
 const VIEWPORT_MARGIN = 12;
+const TRIGGER_GAP = 4;
 
 interface CategoryTreeSelectorProps {
   categories: Category[];
@@ -22,12 +31,21 @@ interface CategoryTreeSelectorProps {
 }
 
 interface DropdownBox {
-  top: number;
+  top?: number;
+  bottom?: number;
   left: number;
   width: number;
   maxHeight: number;
 }
 
+const sameBox = (a: DropdownBox | null, b: DropdownBox) =>
+  !!a &&
+  a.top === b.top &&
+  a.bottom === b.bottom &&
+  a.left === b.left &&
+  a.width === b.width &&
+  a.maxHeight === b.maxHeight;
+
 export const CategoryTreeSelector = ({
   categories,
   selectedCategory,
@@ -76,19 +94,35 @@ export const CategoryTreeSelector = ({
     if (!trigger) return;
 
     const rect = trigger.getBoundingClientRect();
-    const below = window.innerHeight - rect.bottom - VIEWPORT_MARGIN;
-    const above = rect.top - VIEWPORT_MARGIN;
-    const dropUp = below < Math.min(DROPDOWN_MAX_HEIGHT, above) && above > below;
+    const needed = Math.min(
+      DROPDOWN_MAX_HEIGHT,
+      dropdownRef.current?.scrollHeight ?? DROPDOWN_MAX_HEIGHT
+    );
+    const below = window.innerHeight - rect.bottom - VIEWPORT_MARGIN - TRIGGER_GAP;
+    const above = rect.top - VIEWPORT_MARGIN - TRIGGER_GAP;
+    const dropUp = below < needed && above > below;
     const room = dropUp ? above : below;
 
-    setBox({
-      top: dropUp ? Math.max(VIEWPORT_MARGIN, rect.top - room - 4) : rect.bottom + 4,
+    const next: DropdownBox = {
+      ...(dropUp
+        ? { bottom: window.innerHeight - rect.top + TRIGGER_GAP }
+        : { top: rect.bottom + TRIGGER_GAP }),
       left: rect.left,
       width: rect.width,
-      maxHeight: Math.max(120, Math.min(DROPDOWN_MAX_HEIGHT, room)),
-    });
+      maxHeight: Math.max(
+        DROPDOWN_MIN_HEIGHT,
+        Math.min(DROPDOWN_MAX_HEIGHT, room)
+      ),
+    };
+    setBox((prev) => (sameBox(prev, next) ? prev : next));
   }, []);
 
+  const hasBox = box !== null;
+
+  useLayoutEffect(() => {
+    if (isOpen && hasBox) measure();
+  }, [isOpen, hasBox, measure]);
+
   useEffect(() => {
     if (!isOpen) {
       setBox(null);
@@ -148,6 +182,7 @@ export const CategoryTreeSelector = ({
         box
           ? {
             top: box.top,
+            bottom: box.bottom,
             left: box.left,
             width: box.width,
             maxHeight: box.maxHeight,
diff --git a/app/_components/GlobalComponents/Dropdowns/Dropdown.tsx b/app/_components/GlobalComponents/Dropdowns/Dropdown.tsx
index 2d3023698..840bef767 100644
--- a/app/_components/GlobalComponents/Dropdowns/Dropdown.tsx
+++ b/app/_components/GlobalComponents/Dropdowns/Dropdown.tsx
@@ -24,6 +24,7 @@ interface DropdownProps {
   value: string | number;
   options: DropdownOption[];
   onChange: (value: string) => void;
+  id?: string;
   className?: string;
   disabled?: boolean;
   placeholder?: string;
@@ -35,6 +36,7 @@ export const Dropdown = ({
   value,
   options,
   onChange,
+  id,
   className = "",
   disabled = false,
   placeholder = "",
@@ -93,6 +95,7 @@ export const Dropdown = ({
         </div>
       ) : (
         <button
+          id={id}
           type="button"
           onClick={(e) => {
             e.preventDefault();
diff --git a/app/_components/GlobalComponents/Modals/FilesModal/FileModal.tsx b/app/_components/GlobalComponents/Modals/FilesModal/FileModal.tsx
index 902753e3f..11c521397 100644
--- a/app/_components/GlobalComponents/Modals/FilesModal/FileModal.tsx
+++ b/app/_components/GlobalComponents/Modals/FilesModal/FileModal.tsx
@@ -39,7 +39,7 @@ export const FileModal = ({
     handleUpload,
     handleDeleteFile,
     filteredFiles,
-    DeleteModal,
+    deleteModal,
   } = useFileManager();
 
   useEffect(() => {
@@ -84,7 +84,7 @@ export const FileModal = ({
           />
         </div>
       </Modal>
-      <DeleteModal />
+      {deleteModal}
     </>
   );
 };
diff --git a/app/_components/GlobalComponents/Modals/UserModals/UserManagementModal.tsx b/app/_components/GlobalComponents/Modals/UserModals/UserManagementModal.tsx
index 1f7f10493..bce06c8f3 100644
--- a/app/_components/GlobalComponents/Modals/UserModals/UserManagementModal.tsx
+++ b/app/_components/GlobalComponents/Modals/UserModals/UserManagementModal.tsx
@@ -30,7 +30,7 @@ interface UserManagementModalProps {
 export const UserManagementModal = (props: UserManagementModalProps) => {
   const t = useTranslations();
   const { isOpen, onClose, mode, user } = props;
-  const { state, setters, handlers, DeleteModal } = useUserManagementModal(props);
+  const { state, setters, handlers, deleteModal } = useUserManagementModal(props);
 
   if (!isOpen) return null;
 
@@ -176,7 +176,7 @@ export const UserManagementModal = (props: UserManagementModalProps) => {
           </div>
         </div>
       </form>
-      <DeleteModal />
+      {deleteModal}
     </Modal>
   );
 };
diff --git a/app/_consts/kanban.ts b/app/_consts/kanban.ts
index 584810e22..c7caac146 100644
--- a/app/_consts/kanban.ts
+++ b/app/_consts/kanban.ts
@@ -27,3 +27,9 @@ export const DEFAULT_KANBAN_STATUSES: KanbanStatus[] = [
     autoComplete: false,
   },
 ];
+
+export const API_FALLBACK_STATUSES: KanbanStatus[] = [
+  { id: TaskStatus.TODO, label: TaskStatusLabels.TODO, order: 0 },
+  { id: TaskStatus.IN_PROGRESS, label: TaskStatusLabels.IN_PROGRESS, order: 1 },
+  { id: TaskStatus.COMPLETED, label: TaskStatusLabels.COMPLETED, order: 2 },
+];
diff --git a/app/_hooks/kanban/useKanbanItem.tsx b/app/_hooks/kanban/useKanbanItem.tsx
index 850953a41..5ff80909f 100644
--- a/app/_hooks/kanban/useKanbanItem.tsx
+++ b/app/_hooks/kanban/useKanbanItem.tsx
@@ -367,7 +367,7 @@ export const useKanbanItem = ({
     handleReminderSet,
     handleDelete: () => setShowDeleteModal(true),
     handleArchive,
-    DeleteModal: () => (
+    deleteModal: (
       <ConfirmModal
         isOpen={showDeleteModal}
         onClose={() => setShowDeleteModal(false)}
diff --git a/app/_hooks/useBottomBarSpace.ts b/app/_hooks/useBottomBarSpace.ts
index c7b38aeae..93fff9094 100644
--- a/app/_hooks/useBottomBarSpace.ts
+++ b/app/_hooks/useBottomBarSpace.ts
@@ -1,50 +1,42 @@
-import { RefObject, useEffect, useRef } from "react";
+import { RefObject, useEffect } from "react";
 import { BottomBarSpaces } from "@/app/_types/enums";
 
 interface BottomBarSpaceOptions {
   enabled?: boolean;
-  frozen?: boolean;
+  offset?: string;
 }
 
-const occupiedSpace = (bar: HTMLElement) => {
-  if (!bar.offsetHeight) return 0;
-  if (getComputedStyle(bar).position !== "fixed") return 0;
-  return Math.max(0, window.innerHeight - bar.getBoundingClientRect().top);
-};
+const isPinnedBar = (bar: HTMLElement) =>
+  bar.offsetHeight > 0 && getComputedStyle(bar).position === "fixed";
 
 export const useBottomBarSpace = (
   barRef: RefObject<HTMLElement | null>,
   space: BottomBarSpaces,
-  { enabled = true, frozen = false }: BottomBarSpaceOptions = {},
+  { enabled = true, offset = "0px" }: BottomBarSpaceOptions = {},
 ) => {
-  const frozenRef = useRef(frozen);
-
-  useEffect(() => {
-    frozenRef.current = frozen;
-  }, [frozen]);
-
   useEffect(() => {
     const bar = barRef.current;
     const root = document.documentElement;
     if (!enabled || !bar) return;
 
+    let reserved = 0;
+
     const measure = () => {
-      if (frozenRef.current) return;
-      root.style.setProperty(space, `${Math.ceil(occupiedSpace(bar))}px`);
+      if (!isPinnedBar(bar) || bar.offsetHeight <= reserved) return;
+      reserved = bar.offsetHeight;
+      root.style.setProperty(space, `calc(${reserved}px + ${offset})`);
     };
 
     measure();
 
     const observer = new ResizeObserver(measure);
     observer.observe(bar);
-    bar.addEventListener("transitionend", measure);
     window.addEventListener("resize", measure);
 
     return () => {
       observer.disconnect();
-      bar.removeEventListener("transitionend", measure);
       window.removeEventListener("resize", measure);
       root.style.removeProperty(space);
     };
-  }, [barRef, space, enabled]);
+  }, [barRef, space, enabled, offset]);
 };
diff --git a/app/_hooks/useChecklist.tsx b/app/_hooks/useChecklist.tsx
index db4ce5d8b..b07aa9b32 100644
--- a/app/_hooks/useChecklist.tsx
+++ b/app/_hooks/useChecklist.tsx
@@ -804,7 +804,7 @@ export const useChecklist = ({
     deletingItemsCount: itemsToDelete.length,
     pendingTogglesCount: pendingToggles.size,
     sensors,
-    DeleteModal: () => (
+    deleteModal: (
       <ConfirmModal
         isOpen={showDeleteModal}
         onClose={() => setShowDeleteModal(false)}
diff --git a/app/_hooks/useFileManager.tsx b/app/_hooks/useFileManager.tsx
index 6fdda0e3c..35dd99519 100644
--- a/app/_hooks/useFileManager.tsx
+++ b/app/_hooks/useFileManager.tsx
@@ -133,7 +133,7 @@ export const useFileManager = () => {
     handleUpload,
     handleDeleteFile,
     filteredFiles,
-    DeleteModal: () => (
+    deleteModal: (
       <ConfirmModal
         isOpen={showDeleteModal}
         onClose={() => {
diff --git a/app/_hooks/useNoteEditor.tsx b/app/_hooks/useNoteEditor.tsx
index 852d74ce8..245c7ed62 100644
--- a/app/_hooks/useNoteEditor.tsx
+++ b/app/_hooks/useNoteEditor.tsx
@@ -16,10 +16,12 @@ import { logContentEvent, logAudit } from "@/app/_server/actions/log";
 import { itemHref, publicHref } from "@/app/_utils/global-utils";
 import { Note } from "@/app/_types";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
+import { usePermissions } from "@/app/_providers/PermissionsProvider";
 import { useToast } from "@/app/_providers/ToastProvider";
 import { useMinimalMode } from "@/app/_hooks/useMinimalMode";
 import { ItemTypes } from "@/app/_types/enums";
 import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+import { isEncrypted } from "@/app/_utils/encryption-utils";
 import { ConfirmModal } from "@/app/_components/GlobalComponents/Modals/ConfirmationModals/ConfirmModal";
 
 interface UseNoteEditorProps {
@@ -39,6 +41,7 @@ export const useNoteEditor = ({
   const searchParams = useSearchParams();
   const router = useRouter();
   const { user } = useAppMode();
+  const { permissions } = usePermissions();
   const { showToast } = useToast();
   const isMinimalMode = useMinimalMode();
   const defaultEditorIsMarkdown = user?.notesDefaultEditor === "markdown";
@@ -150,10 +153,18 @@ export const useNoteEditor = ({
     }
   }, [note, isMinimalMode, defaultEditorIsMarkdown]);
 
+  const isEditorVisible =
+    (notesDefaultMode === "edit" ||
+      searchParams?.get("editor") === "true" ||
+      isEditing) &&
+    Boolean(permissions?.canEdit) &&
+    (!note.encrypted || isEditingEncrypted) &&
+    !isEncrypted(editorContent || "");
+
   const editorActivity = useEditorActivityStore();
 
   useEffect(() => {
-    if (isEditing) {
+    if (isEditorVisible) {
       editorActivity.register("note-editor");
     } else {
       editorActivity.unregister("note-editor");
@@ -161,7 +172,7 @@ export const useNoteEditor = ({
     return () => {
       editorActivity.unregister("note-editor");
     };
-  }, [isEditing]);
+  }, [isEditorVisible]);
 
   useEffect(() => {
     if (notesDefaultMode !== "edit" && !isEditing) {
@@ -483,6 +494,7 @@ export const useNoteEditor = ({
     isEditing,
     setIsEditing,
     isEditMode: notesDefaultMode === "edit" || isEditing,
+    isEditorVisible,
     status,
     hasUnsavedChanges,
     handleEdit,
@@ -506,7 +518,7 @@ export const useNoteEditor = ({
     clearPassphraseCache,
     getCachedPassphrase,
     getCachedMethod,
-    DeleteModal: () => (
+    deleteModal: (
       <ConfirmModal
         isOpen={showDeleteModal}
         onClose={() => setShowDeleteModal(false)}
diff --git a/app/_hooks/useSessionManager.tsx b/app/_hooks/useSessionManager.tsx
index 20e1142c9..14135ea7e 100644
--- a/app/_hooks/useSessionManager.tsx
+++ b/app/_hooks/useSessionManager.tsx
@@ -126,7 +126,7 @@ export const useSessionManager = () => {
     terminating,
     handleTerminateSession,
     handleTerminateAllOtherSessions,
-    TerminateSessionModal: () => (
+    terminateSessionModal: (
       <ConfirmModal
         isOpen={showTerminateModal}
         onClose={() => {
@@ -140,7 +140,7 @@ export const useSessionManager = () => {
         variant="destructive"
       />
     ),
-    TerminateAllSessionsModal: () => (
+    terminateAllSessionsModal: (
       <ConfirmModal
         isOpen={showTerminateAllModal}
         onClose={() => setShowTerminateAllModal(false)}
diff --git a/app/_hooks/useUserManagementModal.tsx b/app/_hooks/useUserManagementModal.tsx
index 2d89aad7d..df3f133fc 100644
--- a/app/_hooks/useUserManagementModal.tsx
+++ b/app/_hooks/useUserManagementModal.tsx
@@ -181,7 +181,7 @@ export const useUserManagementModal = ({
       setRecoveryCode,
     },
     handlers: { handleSubmit, handleDelete },
-    DeleteModal: () => (
+    deleteModal: (
       <ConfirmModal
         isOpen={showDeleteModal}
         onClose={() => setShowDeleteModal(false)}
diff --git a/app/_server/actions/checklist-item/crud.ts b/app/_server/actions/checklist-item/crud.ts
index 0f14f16de..faa084607 100644
--- a/app/_server/actions/checklist-item/crud.ts
+++ b/app/_server/actions/checklist-item/crud.ts
@@ -1,116 +1,9 @@
 "use server";
 
-import { revalidatePath } from "next/cache";
-import { serverWriteFile } from "@/app/_server/actions/file";
-import { getListById } from "@/app/_server/actions/checklist/queries";
-import { areAllItemsCompleted, listToMarkdown } from "@/app/_utils/checklist-utils";
-import { getUsername } from "@/app/_server/actions/users";
 import { Checklist, Item, Result } from "@/app/_types";
-import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
-import { canReach } from "@/app/_server/actions/share/queries";
-import { diskPath } from "@/app/_server/actions/share/target";
-import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { failedWith } from "@/app/_server/actions/lib/read-only-message";
-import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 import { sessionActor } from "@/app/_server/actions/lib/actor";
 import { addItem, editItem } from "./editor";
-
-const _deleteItem = async (
-  formData: FormData,
-): Promise<Result<Checklist>> => {
-  try {
-    const uuid = formData.get("uuid") as string;
-    const itemId = formData.get("itemId") as string;
-
-    const currentUser = await getUsername();
-
-    if (!currentUser) {
-      throw new Error("Not authenticated");
-    }
-
-    const list = await getListById(uuid, currentUser);
-    if (!list) {
-      throw new Error("List not found");
-    }
-
-    const canDelete = await canReach(
-      list.uuid!,
-      ItemTypes.CHECKLIST,
-      currentUser,
-      PermissionTypes.DELETE,
-    );
-
-    if (!canDelete) {
-      throw new Error("Permission denied");
-    }
-
-    const findItemExists = (items: any[], itemId: string): boolean => {
-      for (const item of items) {
-        if (item.id === itemId) {
-          return true;
-        }
-        if (item.children && findItemExists(item.children, itemId)) {
-          return true;
-        }
-      }
-      return false;
-    };
-
-    const filterOutItem = (items: any[], itemId: string): any[] => {
-      return items
-        .filter((item) => item.id !== itemId)
-        .map((item) => {
-          const children = item.children
-            ? filterOutItem(item.children, itemId)
-            : undefined;
-          const completed =
-            children && children.length > 0 && areAllItemsCompleted(children)
-              ? true
-              : item.completed;
-
-          return { ...item, children, completed };
-        })
-        .filter((item) => item.children?.length > 0 || item.id !== undefined);
-    };
-
-    const itemExists = findItemExists(list.items || [], itemId);
-    if (!itemExists) {
-      return { success: true };
-    }
-
-    const updatedList = {
-      ...list,
-      items: filterOutItem(list.items || [], itemId),
-      updatedAt: new Date().toISOString(),
-    };
-
-    const filePath = await diskPath(Modes.CHECKLISTS, currentUser, list);
-
-    await serverWriteFile(filePath, listToMarkdown(updatedList as Checklist));
-
-    try {
-      revalidatePath("/");
-      revalidatePath(`/checklist/${list.uuid}`);
-    } catch (error) {
-      console.warn(
-        "Cache revalidation failed, but data was saved successfully:",
-        error,
-      );
-    }
-
-    await broadcast({
-      type: "checklist",
-      action: "updated",
-      entityId: list.uuid,
-      username: currentUser,
-    });
-
-    return { success: true, data: updatedList as Checklist };
-  } catch (error) {
-    console.error("Error deleting item:", error);
-    return { success: false, error: await failedWith(error, "Failed to delete item") };
-  }
-};
+import { removeItem } from "./remover";
 
 export const updateItem = async (
   checklist: Checklist,
@@ -142,7 +35,18 @@ export const createItem = async (
   return addItem(actor, list, formData, skipRevalidation);
 };
 
-export const deleteItem = async (formData: FormData) =>
-  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
-    _deleteItem(formData),
+export const deleteItem = async (
+  formData: FormData,
+): Promise<Result<Checklist>> => {
+  const actor = await sessionActor();
+
+  if ("error" in actor) {
+    return { success: false, error: actor.error };
+  }
+
+  return removeItem(
+    actor,
+    formData.get("uuid") as string,
+    formData.get("itemId") as string,
   );
+};
diff --git a/app/_server/actions/checklist-item/grafter.ts b/app/_server/actions/checklist-item/grafter.ts
new file mode 100644
index 000000000..48049b622
--- /dev/null
+++ b/app/_server/actions/checklist-item/grafter.ts
@@ -0,0 +1,151 @@
+import { revalidatePath } from "next/cache";
+import path from "path";
+import {
+  serverWriteFile,
+  ensureDir,
+} from "@/app/_server/actions/file";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { listToMarkdown } from "@/app/_utils/checklist-utils";
+import { Checklist, Item, Result, SanitisedUser } from "@/app/_types";
+import {
+  ItemTypes,
+  PermissionTypes,
+  Modes,
+  TaskStatus,
+  isKanbanType,
+} from "@/app/_types/enums";
+import { reachableFile } from "@/app/_server/actions/share/queries";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+
+const _attach = (items: Item[], parentId: string, sprout: Item): boolean => {
+  for (const item of items) {
+    if (item.id === parentId) {
+      item.children = item.children || [];
+      item.children.push(sprout);
+      item.completed = false;
+      return true;
+    }
+
+    if (item.children && _attach(item.children, parentId, sprout)) {
+      item.completed = false;
+      return true;
+    }
+  }
+  return false;
+};
+
+const _renumber = (items: Item[]) => {
+  items.forEach((item, index) => {
+    item.order = index;
+    if (item.children) {
+      _renumber(item.children);
+    }
+  });
+};
+
+const _graftItem = async (
+  actor: SanitisedUser,
+  formData: FormData,
+): Promise<Result<Checklist>> => {
+  try {
+    const uuid = formData.get("uuid") as string;
+    const parentId = formData.get("parentId") as string;
+    const text = formData.get("text") as string;
+    const status = formData.get("status") as string | null;
+    const currentUser = actor?.username;
+
+    if (!currentUser) {
+      return { success: false, error: "Not authenticated" };
+    }
+
+    if (!uuid || !parentId || !text?.trim()) {
+      return {
+        success: false,
+        error: "List uuid, parent item ID and text are required",
+      };
+    }
+
+    const filePath = await reachableFile(
+      uuid,
+      ItemTypes.CHECKLIST,
+      currentUser,
+      PermissionTypes.EDIT,
+    );
+
+    if (!filePath) {
+      throw new Error("Permission denied");
+    }
+
+    const list = await getListById(uuid, currentUser);
+    if (!list) {
+      throw new Error("List not found");
+    }
+
+    const now = new Date().toISOString();
+
+    const sprout: Item = {
+      id: `${list.uuid}-sub-${Date.now()}`,
+      text,
+      completed: false,
+      order: 0,
+      createdBy: currentUser,
+      createdAt: now,
+      lastModifiedBy: currentUser,
+      lastModifiedAt: now,
+    };
+
+    if (isKanbanType(list.type)) {
+      const initial = status || TaskStatus.TODO;
+      sprout.status = initial;
+      sprout.timeEntries = [];
+      sprout.history = [
+        {
+          status: initial,
+          timestamp: now,
+          user: currentUser,
+        },
+      ];
+    }
+
+    const items = list.items || [];
+
+    if (!_attach(items, parentId, sprout)) {
+      throw new Error("Parent item not found");
+    }
+
+    _renumber(items);
+
+    const updatedList: Checklist = {
+      ...list,
+      items,
+      updatedAt: new Date().toISOString(),
+    };
+
+    await ensureDir(path.dirname(filePath));
+
+    await serverWriteFile(filePath, listToMarkdown(updatedList));
+
+    try {
+      revalidatePath("/");
+      revalidatePath(`/checklist/${list.uuid}`);
+    } catch (error) {
+      console.warn(
+        "Cache revalidation failed, but data was saved successfully:",
+        error
+      );
+    }
+
+    await broadcast({ type: "checklist", action: "updated", entityId: list.uuid, username: currentUser });
+
+    return { success: true, data: updatedList };
+  } catch (error) {
+    console.error("Error creating sub-item:", error);
+    return { success: false, error: "Failed to create sub-item" };
+  }
+};
+
+export const graftItem = async (actor: SanitisedUser, formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _graftItem(actor, formData),
+  );
diff --git a/app/_server/actions/checklist-item/remover.ts b/app/_server/actions/checklist-item/remover.ts
new file mode 100644
index 000000000..51a3f2f74
--- /dev/null
+++ b/app/_server/actions/checklist-item/remover.ts
@@ -0,0 +1,103 @@
+import { revalidatePath } from "next/cache";
+import { serverWriteFile } from "@/app/_server/actions/file";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { areAllItemsCompleted, listToMarkdown } from "@/app/_utils/checklist-utils";
+import { Checklist, Item, Result, SanitisedUser } from "@/app/_types";
+import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import { reachableFile } from "@/app/_server/actions/share/queries";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+
+const _holds = (items: Item[], itemId: string): boolean =>
+  items.some(
+    (item) => item.id === itemId || _holds(item.children || [], itemId),
+  );
+
+const _without = (items: Item[], itemId: string): Item[] =>
+  items
+    .filter((item) => item.id !== itemId)
+    .map((item) => {
+      const children = item.children
+        ? _without(item.children, itemId)
+        : undefined;
+      const completed =
+        children && children.length > 0 && areAllItemsCompleted(children)
+          ? true
+          : item.completed;
+
+      return { ...item, children, completed };
+    });
+
+const _removeItem = async (
+  actor: SanitisedUser,
+  uuid: string,
+  itemId: string,
+): Promise<Result<Checklist>> => {
+  try {
+    const currentUser = actor?.username;
+
+    if (!currentUser) {
+      throw new Error("Not authenticated");
+    }
+
+    const filePath = await reachableFile(
+      uuid,
+      ItemTypes.CHECKLIST,
+      currentUser,
+      PermissionTypes.DELETE,
+    );
+
+    if (!filePath) {
+      throw new Error("Permission denied");
+    }
+
+    const list = await getListById(uuid, currentUser);
+    if (!list) {
+      throw new Error("List not found");
+    }
+
+    if (!_holds(list.items || [], itemId)) {
+      return { success: true };
+    }
+
+    const updatedList: Checklist = {
+      ...list,
+      items: _without(list.items || [], itemId),
+      updatedAt: new Date().toISOString(),
+    };
+
+    await serverWriteFile(filePath, listToMarkdown(updatedList));
+
+    try {
+      revalidatePath("/");
+      revalidatePath(`/checklist/${list.uuid}`);
+    } catch (error) {
+      console.warn(
+        "Cache revalidation failed, but data was saved successfully:",
+        error,
+      );
+    }
+
+    await broadcast({
+      type: "checklist",
+      action: "updated",
+      entityId: list.uuid,
+      username: currentUser,
+    });
+
+    return { success: true, data: updatedList };
+  } catch (error) {
+    console.error("Error deleting item:", error);
+    return { success: false, error: await failedWith(error, "Failed to delete item") };
+  }
+};
+
+export const removeItem = async (
+  actor: SanitisedUser,
+  uuid: string,
+  itemId: string,
+) =>
+  runQueued(itemLane(Modes.CHECKLISTS, uuid), () =>
+    _removeItem(actor, uuid, itemId),
+  );
diff --git a/app/_server/actions/checklist-item/sub-items.ts b/app/_server/actions/checklist-item/sub-items.ts
index 1323fa589..fb91181e9 100644
--- a/app/_server/actions/checklist-item/sub-items.ts
+++ b/app/_server/actions/checklist-item/sub-items.ts
@@ -1,154 +1,17 @@
 "use server";
 
-import { revalidatePath } from "next/cache";
-import path from "path";
-import {
-  serverWriteFile,
-  ensureDir,
-} from "@/app/_server/actions/file";
-import { getListById } from "@/app/_server/actions/checklist/queries";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { getUsername } from "@/app/_server/actions/users";
 import { Checklist, Result } from "@/app/_types";
-import {
-  ItemTypes,
-  PermissionTypes,
-  Modes,
-  TaskStatus,
-  isKanbanType,
-} from "@/app/_types/enums";
-import { canReach } from "@/app/_server/actions/share/queries";
-import { diskPath } from "@/app/_server/actions/share/target";
-import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
+import { graftItem } from "./grafter";
 
-const _createSubItem = async (
-  formData: FormData
+export const createSubItem = async (
+  formData: FormData,
 ): Promise<Result<Checklist>> => {
-  try {
-    const uuid = formData.get("uuid") as string;
-    const parentId = formData.get("parentId") as string;
-    const text = formData.get("text") as string;
+  const actor = await sessionActor();
 
-    if (!uuid || !parentId || !text?.trim()) {
-      return {
-        success: false,
-        error: "List uuid, parent item ID and text are required",
-      };
-    }
-
-    const currentUser = await getUsername();
-    const list = await getListById(uuid, currentUser);
-    if (!list) {
-      throw new Error("List not found");
-    }
-
-    const canEdit = await canReach(
-      list.uuid!,
-      ItemTypes.CHECKLIST,
-      currentUser,
-      PermissionTypes.EDIT
-    );
-
-    if (!canEdit) {
-      throw new Error("Permission denied");
-    }
-
-    const addSubItemToParent = (
-      items: any[],
-      parentId: string,
-      newSubItem: any
-    ): boolean => {
-      for (let item of items) {
-        if (item.id === parentId) {
-          item.children = item.children || [];
-          item.children.push(newSubItem);
-          item.completed = false;
-          return true;
-        }
-
-        if (
-          item.children &&
-          addSubItemToParent(item.children, parentId, newSubItem)
-        ) {
-          item.completed = false;
-          return true;
-        }
-      }
-      return false;
-    };
-
-    const now = new Date().toISOString();
-
-    const newSubItem: any = {
-      id: `${list.uuid}-sub-${Date.now()}`,
-      text,
-      completed: false,
-      order: 0,
-      createdBy: currentUser,
-      createdAt: now,
-      lastModifiedBy: currentUser,
-      lastModifiedAt: now,
-    };
-
-    if (isKanbanType(list.type)) {
-      newSubItem.status = TaskStatus.TODO;
-      newSubItem.timeEntries = [];
-      newSubItem.history = [
-        {
-          status: TaskStatus.TODO,
-          timestamp: now,
-          user: currentUser,
-        },
-      ];
-    }
-
-    if (!addSubItemToParent(list.items || [], parentId, newSubItem)) {
-      throw new Error("Parent item not found");
-    }
-
-    const updateChildrenOrder = (items: any[]) => {
-      items.forEach((item, index) => {
-        item.order = index;
-        if (item.children) {
-          updateChildrenOrder(item.children);
-        }
-      });
-    };
-
-    updateChildrenOrder(list.items || []);
-
-    const updatedList = {
-      ...list,
-      items: list.items || [],
-      updatedAt: new Date().toISOString(),
-    };
-
-    const filePath = await diskPath(Modes.CHECKLISTS, currentUser, list);
-    await ensureDir(path.dirname(filePath));
-
-    await serverWriteFile(filePath, listToMarkdown(updatedList as Checklist));
-
-    try {
-      revalidatePath("/");
-      revalidatePath(`/checklist/${list.uuid}`);
-    } catch (error) {
-      console.warn(
-        "Cache revalidation failed, but data was saved successfully:",
-        error
-      );
-    }
-
-    await broadcast({ type: "checklist", action: "updated", entityId: list.uuid, username: currentUser });
-
-    return { success: true, data: updatedList as Checklist };
-  } catch (error) {
-    console.error("Error creating sub-item:", error);
-    return { success: false, error: "Failed to create sub-item" };
+  if ("error" in actor) {
+    return { success: false, error: actor.error };
   }
-};
 
-export const createSubItem = async (formData: FormData) =>
-  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
-    _createSubItem(formData),
-  );
+  return graftItem(actor, formData);
+};
diff --git a/app/_server/actions/checklist/converters.ts b/app/_server/actions/checklist/converters.ts
index 959cd1f91..47ec29eec 100644
--- a/app/_server/actions/checklist/converters.ts
+++ b/app/_server/actions/checklist/converters.ts
@@ -1,7 +1,7 @@
 "use server";
 
 import path from "path";
-import { Checklist, Item, ChecklistType } from "@/app/_types";
+import { Checklist, Item, ChecklistType, KanbanStatus, Result } from "@/app/_types";
 import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
 import {
   ItemTypes,
@@ -18,7 +18,9 @@ import { getFormData } from "@/app/_utils/global-utils";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
 import { getListById, getUserChecklists } from "./queries";
+import { restatus } from "./restatus";
 
 export const convertChecklistType = async (formData: FormData) => {
   try {
@@ -144,7 +146,9 @@ export const convertChecklistType = async (formData: FormData) => {
   }
 };
 
-export const updateChecklistStatuses = async (formData: FormData) => {
+export const updateChecklistStatuses = async (
+  formData: FormData,
+): Promise<Result<Checklist>> => {
   try {
     const { uuid, statusesStr } = getFormData(formData, [
       "uuid",
@@ -153,112 +157,18 @@ export const updateChecklistStatuses = async (formData: FormData) => {
 
     if (!uuid || !statusesStr) {
       console.error("Missing uuid or statusesStr");
-      return { error: "UUID and statuses are required" };
+      return { success: false, error: "UUID and statuses are required" };
     }
 
-    const lists = await getUserChecklists();
-    if (!lists.success || !lists.data) {
-      console.error("Failed to fetch lists:", lists.error);
-      throw new Error(lists.error || "Failed to fetch lists");
-    }
-
-    const list = lists.data.find((l) => l.uuid === uuid) as Checklist;
-
-    if (!list || !list.id || !list.createdAt) {
-      console.error("List not found or malformed:", { list });
-      throw new Error("List not found or is malformed");
-    }
-
-    const statuses = JSON.parse(statusesStr);
-
-    const oldStatusIds = (list.statuses || []).map((s) => s.id);
-    const newStatusIds = statuses.map((s: any) => s.id);
-    const removedStatusIds = oldStatusIds.filter(
-      (id) => !newStatusIds.includes(id),
-    );
-
-    const sortedStatuses = [...statuses].sort(
-      (a: any, b: any) => a.order - b.order,
-    );
-    const firstStatus = sortedStatuses[0];
-    const defaultStatusId = firstStatus?.id || "todo";
-
-    const currentUser = await getCurrentUser();
-    const username = currentUser?.username;
-    if (!username) {
-      throw new Error("Username not found");
-    }
-
-    const now = new Date().toISOString();
-    const updatedItems = list.items.map((item) => {
-      if (removedStatusIds.includes(item.status || "")) {
-        const history = item.history || [];
-        history.push({
-          status: defaultStatusId,
-          timestamp: now,
-          user: username,
-        });
-
-        return {
-          ...item,
-          status: defaultStatusId,
-          lastModifiedBy: username,
-          lastModifiedAt: now,
-          history,
-        };
-      }
-      return item;
-    });
+    const actor = await sessionActor();
+    if ("error" in actor) return { success: false, error: actor.error };
 
-    let filePath: string;
+    const statuses = JSON.parse(statusesStr) as KanbanStatus[];
 
-    if (list.isShared) {
-      const ownerDir = path.join(
-        process.cwd(),
-        "data",
-        CHECKLISTS_FOLDER,
-        list.owner!,
-      );
-      filePath = path.join(
-        ownerDir,
-        list.category || UNCATEGORIZED,
-        `${list.id}.md`,
-      );
-    } else {
-      const userDir = await getUserModeDir(Modes.CHECKLISTS);
-      filePath = path.join(
-        userDir,
-        list.category || UNCATEGORIZED,
-        `${list.id}.md`,
-      );
-    }
-
-    const updatedList: Checklist = {
-      ...list,
-      items: updatedItems,
-      statuses,
-      updatedAt: new Date().toISOString(),
-    };
-
-    const markdown = listToMarkdown(updatedList);
-    await serverWriteFile(filePath, markdown);
-
-    try {
-      revalidatePath("/", "layout");
-      revalidatePath(`/checklist/${list.uuid}`);
-      if (list.category) {
-        revalidatePath(`/category/${list.category}`);
-      }
-    } catch (error) {
-      console.warn(
-        "Cache revalidation failed, but data was saved successfully:",
-        error,
-      );
-    }
-    return { success: true, data: updatedList };
+    return await restatus(actor, uuid, () => statuses);
   } catch (error) {
     console.error("Error updating checklist statuses:", error);
-    return { error: "Failed to update checklist statuses" };
+    return { success: false, error: "Failed to update checklist statuses" };
   }
 };
 
diff --git a/app/_server/actions/checklist/editor.ts b/app/_server/actions/checklist/editor.ts
index 5c06b7e8b..383f7ad6e 100644
--- a/app/_server/actions/checklist/editor.ts
+++ b/app/_server/actions/checklist/editor.ts
@@ -199,7 +199,7 @@ export const editList = async (actor: SanitisedUser, formData: FormData) =>
     _editList(actor, formData),
   );
 
-export const dropList = async (
+const _dropList = async (
   currentUser: SanitisedUser,
   formData: FormData,
 ): Promise<{ success?: boolean; error?: string }> => {
@@ -289,8 +289,14 @@ export const dropList = async (
         title || "unknown",
         false
       );
-    } catch { }
+    } catch (logError) {
+      console.error("Failed to log the deleteList failure:", logError);
+    }
     return { error: await failedWith(error, "Failed to delete list") };
   }
 };
 
+export const dropList = async (actor: SanitisedUser, formData: FormData) =>
+  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
+    _dropList(actor, formData),
+  );
diff --git a/app/_server/actions/checklist/restatus.ts b/app/_server/actions/checklist/restatus.ts
new file mode 100644
index 000000000..bf57e493e
--- /dev/null
+++ b/app/_server/actions/checklist/restatus.ts
@@ -0,0 +1,120 @@
+import { revalidatePath } from "next/cache";
+import { Checklist, Item, Result, KanbanStatus, SanitisedUser } from "@/app/_types";
+import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import { DEFAULT_KANBAN_STATUSES } from "@/app/_consts/kanban";
+import { serverWriteFile } from "@/app/_server/actions/file";
+import { listToMarkdown } from "@/app/_utils/checklist-utils";
+import { reachableFile } from "@/app/_server/actions/share/queries";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { getListById } from "./queries";
+
+export type StatusReshaper = (current?: KanbanStatus[]) => KanbanStatus[];
+
+const _rehome = (
+  items: Item[],
+  removed: string[],
+  fallback: string,
+  username: string,
+  now: string,
+): Item[] =>
+  items.map((item) => {
+    const children = item.children
+      ? _rehome(item.children, removed, fallback, username, now)
+      : item.children;
+
+    if (!removed.includes(item.status || "")) {
+      return children === item.children ? item : { ...item, children };
+    }
+
+    return {
+      ...item,
+      children,
+      status: fallback,
+      lastModifiedBy: username,
+      lastModifiedAt: now,
+      history: [
+        ...(item.history || []),
+        { status: fallback, timestamp: now, user: username },
+      ],
+    };
+  });
+
+const _restatus = async (
+  actor: SanitisedUser,
+  uuid: string,
+  reshape: StatusReshaper,
+): Promise<Result<Checklist>> => {
+  try {
+    const username = actor?.username;
+    if (!username) return { success: false, error: "Not authenticated" };
+
+    const filePath = await reachableFile(
+      uuid,
+      ItemTypes.CHECKLIST,
+      username,
+      PermissionTypes.EDIT,
+    );
+    if (!filePath) return { success: false, error: "Permission denied" };
+
+    const list = await getListById(uuid, username);
+    if (!list || !list.id || !list.createdAt) {
+      return { success: false, error: "List not found or is malformed" };
+    }
+
+    const statuses = reshape(list.statuses);
+    const kept = new Set(statuses.map((status) => status.id));
+    const removed = (list.statuses || DEFAULT_KANBAN_STATUSES)
+      .map((status) => status.id)
+      .filter((id) => !kept.has(id));
+
+    const sorted = [...statuses].sort((a, b) => a.order - b.order);
+    const fallback = sorted[0]?.id || "todo";
+    const now = new Date().toISOString();
+
+    const updatedList: Checklist = {
+      ...list,
+      items: removed.length
+        ? _rehome(list.items, removed, fallback, username, now)
+        : list.items,
+      statuses,
+      updatedAt: now,
+    };
+
+    await serverWriteFile(filePath, listToMarkdown(updatedList));
+
+    try {
+      revalidatePath("/", "layout");
+      revalidatePath(`/checklist/${list.uuid}`);
+      if (list.category) {
+        revalidatePath(`/category/${list.category}`);
+      }
+    } catch (error) {
+      console.warn(
+        "Cache revalidation failed, but data was saved successfully:",
+        error,
+      );
+    }
+
+    await broadcast({
+      type: "checklist",
+      action: "updated",
+      entityId: list.uuid,
+      username,
+    });
+
+    return { success: true, data: updatedList };
+  } catch (error) {
+    console.error("Error updating checklist statuses:", error);
+    return { success: false, error: "Failed to update checklist statuses" };
+  }
+};
+
+export const restatus = async (
+  actor: SanitisedUser,
+  uuid: string,
+  reshape: StatusReshaper,
+): Promise<Result<Checklist>> =>
+  runQueued(itemLane(Modes.CHECKLISTS, uuid), () =>
+    _restatus(actor, uuid, reshape),
+  );
diff --git a/app/_server/actions/config/settings.ts b/app/_server/actions/config/settings.ts
index 8383e2735..101b4598f 100644
--- a/app/_server/actions/config/settings.ts
+++ b/app/_server/actions/config/settings.ts
@@ -9,6 +9,8 @@ import { MAX_FILE_SIZE } from "@/app/_consts/files";
 import { logAudit } from "@/app/_server/actions/log";
 import { DEFAULT_BORDER_RADIUS, clampRadius } from "@/app/_consts/styling";
 import { runQueued } from "@/app/_server/actions/lib/concurrency";
+import { getTranslations } from "next-intl/server";
+import { checkEditor } from "./validators";
 
 const DATA_SETTINGS_PATH = path.join(process.cwd(), "data", "settings.json");
 const SETTINGS_LANE = "app-settings";
@@ -231,14 +233,37 @@ export const updateAppSettings = async (
     let editorSettings: AppSettings["editor"] = existing.editor;
 
     const editorData = formData.get("editor");
+    let editorInput: unknown;
     if (typeof editorData === "string" && editorData) {
       try {
-        editorSettings = { ...existing.editor, ...JSON.parse(editorData) };
+        editorInput = JSON.parse(editorData);
       } catch (error) {
         console.warn("Unparseable editor settings, keeping current ones:", error);
       }
     }
 
+    if (editorInput !== undefined) {
+      const verdict = checkEditor(editorInput);
+
+      if ("badField" in verdict) {
+        const t = await getTranslations("errors");
+        const error = verdict.badField
+          ? t("invalidEditorSetting", { field: verdict.badField })
+          : t("invalidEditorSettings");
+
+        await logAudit({
+          level: "WARNING",
+          action: "app_settings_updated",
+          category: "settings",
+          success: false,
+          errorMessage: `Invalid editor settings: ${verdict.badField || "not an object"}`,
+        });
+        return { success: false, error };
+      }
+
+      editorSettings = { ...existing.editor, ...verdict.patch };
+    }
+
     await _persist({
       appName,
       appDescription,
diff --git a/app/_server/actions/config/validators.ts b/app/_server/actions/config/validators.ts
index f9af793a1..96a0340e7 100644
--- a/app/_server/actions/config/validators.ts
+++ b/app/_server/actions/config/validators.ts
@@ -1,4 +1,4 @@
-import { CustomThemeConfig, CustomEmojiConfig } from "@/app/_types";
+import { AppSettings, CustomThemeConfig, CustomEmojiConfig } from "@/app/_types";
 
 export const validateThemeConfig = (config: any): config is CustomThemeConfig => {
   if (!config || typeof config !== "object") return false;
@@ -31,3 +31,37 @@ export const validateEmojiConfig = (config: any): config is CustomEmojiConfig =>
 
   return true;
 };
+
+type EditorSettings = AppSettings["editor"];
+
+const EDITOR_FIELD_TYPES: Record<keyof EditorSettings, "boolean" | "string"> = {
+  enableSlashCommands: "boolean",
+  enableBubbleMenu: "boolean",
+  enableTableToolbar: "boolean",
+  enableBilateralLinks: "boolean",
+  enableTags: "boolean",
+  drawioUrl: "string",
+  drawioProxyEnabled: "boolean",
+  historyEnabled: "boolean",
+};
+
+export type EditorVerdict =
+  | { patch: Partial<EditorSettings> }
+  | { badField: string | null };
+
+export const checkEditor = (raw: unknown): EditorVerdict => {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { badField: null };
+  }
+
+  const incoming = raw as Record<string, unknown>;
+  const patch: Record<string, unknown> = {};
+
+  for (const [field, kind] of Object.entries(EDITOR_FIELD_TYPES)) {
+    if (!(field in incoming)) continue;
+    if (typeof incoming[field] !== kind) return { badField: field };
+    patch[field] = incoming[field];
+  }
+
+  return { patch: patch as Partial<EditorSettings> };
+};
diff --git a/app/_server/actions/kanban/calendar.ts b/app/_server/actions/kanban/calendar.ts
index 0a3e05714..791ef263c 100644
--- a/app/_server/actions/kanban/calendar.ts
+++ b/app/_server/actions/kanban/calendar.ts
@@ -1,15 +1,22 @@
 "use server";
 
 import { getFormData } from "@/app/_utils/global-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
-import { generateICS } from "@/app/_utils/kanban/calendar-utils";
-import { parseItemsForCalendar, CalendarEvent } from "@/app/_utils/kanban/calendar-utils";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
+import { viewList } from "@/app/_server/actions/checklist/viewer";
+import {
+  generateICS,
+  parseItemsForCalendar,
+  CalendarEvent,
+} from "@/app/_utils/kanban/calendar-utils";
 
 export const exportBoardAsICS = async (formData: FormData) => {
   try {
     const { uuid } = getFormData(formData, ["uuid"]);
 
-    const list = await getListById(uuid);
+    const actor = await sessionActor();
+    if ("error" in actor) return { error: actor.error };
+
+    const list = await viewList(uuid);
     if (!list) return { error: "Board not found" };
 
     const icsContent = generateICS(list.items, list.title);
@@ -24,7 +31,10 @@ export const getCalendarEvents = async (formData: FormData) => {
   try {
     const { uuid } = getFormData(formData, ["uuid"]);
 
-    const list = await getListById(uuid);
+    const actor = await sessionActor();
+    if ("error" in actor) return { error: actor.error };
+
+    const list = await viewList(uuid);
     if (!list) return { error: "Board not found" };
 
     const events: CalendarEvent[] = parseItemsForCalendar(list.items);
diff --git a/app/_server/actions/kanban/items.ts b/app/_server/actions/kanban/items.ts
index e4c33810a..abdd4bb6a 100644
--- a/app/_server/actions/kanban/items.ts
+++ b/app/_server/actions/kanban/items.ts
@@ -1,249 +1,62 @@
 "use server";
 
-import path from "path";
-import { Checklist, KanbanPriority, KanbanReminder } from "@/app/_types";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
-import { UNCATEGORIZED } from "@/app/_consts/notes";
-import {
-  ItemTypes,
-  Modes,
-  NotificationTargets,
-  PermissionTypes,
-} from "@/app/_types/enums";
-import { getCurrentUser } from "@/app/_server/actions/users";
-import { getUserModeDir, serverWriteFile } from "@/app/_server/actions/file";
-import { revalidatePath } from "next/cache";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
+import { KanbanPriority } from "@/app/_types";
 import { getFormData } from "@/app/_utils/global-utils";
-import { canReach } from "@/app/_server/actions/share/queries";
-import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { getListById } from "@/app/_server/actions/checklist/queries";
-import { notifyUser } from "@/app/_server/actions/notifications/internal";
-import { findItem, updateItem } from "@/app/_utils/item-tree-utils";
-import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
+import { assignItem, remindItem, tweakItem } from "./tweaker";
 
-const _getFilePath = async (list: Checklist): Promise<string> => {
-  const categoryDir = list.category || UNCATEGORIZED;
-  const filename = `${list.id}.md`;
-
-  if (list.owner) {
-    return path.join(
-      process.cwd(), "data", CHECKLISTS_FOLDER, list.owner, categoryDir, filename
-    );
-  }
-
-  const userDir = await getUserModeDir(Modes.CHECKLISTS);
-  return path.join(userDir, categoryDir, filename);
-};
-
-async function _saveAndBroadcast(list: Checklist, username: string) {
-  const filePath = await _getFilePath(list);
-  await serverWriteFile(filePath, listToMarkdown(list));
-
-  await broadcast({
-    type: "checklist",
-    action: "updated",
-    entityId: list.uuid,
-    username,
-  });
-
-  try {
-    revalidatePath("/");
-  } catch { }
-}
-
-const _updateKanbanItemPriority = async (formData: FormData) => {
+export const updateKanbanItemPriority = async (formData: FormData) => {
   try {
     const { uuid, itemId, priority } = getFormData(formData, [
       "uuid", "itemId", "priority",
     ]);
 
-    const [currentUser, list] = await Promise.all([
-      getCurrentUser(),
-      getListById(uuid),
-    ]);
-    if (!currentUser) return { error: "Not authenticated" };
-    if (!list) return { error: "List not found" };
-
-    const canEdit = await canReach(
-      list.uuid!, ItemTypes.CHECKLIST, currentUser.username, PermissionTypes.EDIT
-    );
-    if (!canEdit) return { error: "Permission denied" };
-
-    const now = new Date().toISOString();
-    const updatedList: Checklist = {
-      ...list,
-      items: updateItem(list.items, itemId, (item) => ({
-        ...item,
-        priority: priority as KanbanPriority,
-        lastModifiedBy: currentUser.username,
-        lastModifiedAt: now,
-      })),
-      updatedAt: now,
-    };
+    const actor = await sessionActor();
+    if ("error" in actor) return { error: actor.error };
 
-    await _saveAndBroadcast(updatedList, currentUser.username);
-    return { success: true, data: updatedList };
+    return await tweakItem(actor, uuid, itemId, {
+      priority: priority as KanbanPriority,
+    });
   } catch (error) {
     console.error("Error updating priority:", error);
     return { error: "Failed to update priority" };
   }
 };
 
-const _updateKanbanItemScore = async (formData: FormData) => {
+export const updateKanbanItemScore = async (formData: FormData) => {
   try {
     const { uuid, itemId, score } = getFormData(formData, [
       "uuid", "itemId", "score",
     ]);
 
-    const [currentUser, list] = await Promise.all([
-      getCurrentUser(),
-      getListById(uuid),
-    ]);
-    if (!currentUser) return { error: "Not authenticated" };
-    if (!list) return { error: "List not found" };
-
-    const canEdit = await canReach(
-      list.uuid!, ItemTypes.CHECKLIST, currentUser.username, PermissionTypes.EDIT
-    );
-    if (!canEdit) return { error: "Permission denied" };
+    const actor = await sessionActor();
+    if ("error" in actor) return { error: actor.error };
 
-    const now = new Date().toISOString();
-    const updatedList: Checklist = {
-      ...list,
-      items: updateItem(list.items, itemId, (item) => ({
-        ...item,
-        score: parseInt(score),
-        lastModifiedBy: currentUser.username,
-        lastModifiedAt: now,
-      })),
-      updatedAt: now,
-    };
-
-    await _saveAndBroadcast(updatedList, currentUser.username);
-    return { success: true, data: updatedList };
+    return await tweakItem(actor, uuid, itemId, { score: parseInt(score) });
   } catch (error) {
     console.error("Error updating score:", error);
     return { error: "Failed to update score" };
   }
 };
 
-const _assignKanbanItem = async (formData: FormData) => {
-  try {
-    const { uuid, itemId, assignee } = getFormData(formData, [
-      "uuid", "itemId", "assignee",
-    ]);
-
-    const [currentUser, list] = await Promise.all([
-      getCurrentUser(),
-      getListById(uuid),
-    ]);
-    if (!currentUser) return { error: "Not authenticated" };
-    if (!list) return { error: "List not found" };
-
-    const canEdit = await canReach(
-      list.uuid!, ItemTypes.CHECKLIST, currentUser.username, PermissionTypes.EDIT
-    );
-    if (!canEdit) return { error: "Permission denied" };
-
-    const now = new Date().toISOString();
-    const updatedList: Checklist = {
-      ...list,
-      items: updateItem(list.items, itemId, (item) => ({
-        ...item,
-        assignee: assignee || undefined,
-        lastModifiedBy: currentUser.username,
-        lastModifiedAt: now,
-      })),
-      updatedAt: now,
-    };
+export const assignKanbanItem = async (formData: FormData) => {
+  const { uuid, itemId, assignee } = getFormData(formData, [
+    "uuid", "itemId", "assignee",
+  ]);
 
-    await _saveAndBroadcast(updatedList, currentUser.username);
+  const actor = await sessionActor();
+  if ("error" in actor) return { error: actor.error };
 
-    if (assignee && assignee !== currentUser.username) {
-      const assignedItem = findItem(updatedList.items, itemId);
-      await notifyUser(assignee, {
-        type: "assignment",
-        title: assignedItem?.text || "New task assigned",
-        message: `${currentUser.username} assigned you to a task in "${updatedList.title}"`,
-        data: {
-          itemId: updatedList.uuid,
-          itemType: NotificationTargets.CHECKLIST,
-          taskId: itemId,
-        },
-      });
-    }
-
-    return { success: true, data: updatedList };
-  } catch (error) {
-    console.error("Error assigning item:", error);
-    return { error: "Failed to assign item" };
-  }
+  return assignItem(actor, uuid, itemId, assignee);
 };
 
-const _setKanbanItemReminder = async (formData: FormData) => {
-  try {
-    const { uuid, itemId, reminder: reminderStr } = getFormData(formData, [
-      "uuid", "itemId", "reminder",
-    ]);
-
-    const [currentUser, list] = await Promise.all([
-      getCurrentUser(),
-      getListById(uuid),
-    ]);
-    if (!currentUser) return { error: "Not authenticated" };
-    if (!list) return { error: "List not found" };
-
-    const canEdit = await canReach(
-      list.uuid!, ItemTypes.CHECKLIST, currentUser.username, PermissionTypes.EDIT
-    );
-    if (!canEdit) return { error: "Permission denied" };
-
-    let reminder: KanbanReminder | undefined;
-    if (reminderStr) {
-      try {
-        reminder = JSON.parse(reminderStr);
-      } catch {
-        reminder = { datetime: reminderStr };
-      }
-    }
+export const setKanbanItemReminder = async (formData: FormData) => {
+  const { uuid, itemId, reminder } = getFormData(formData, [
+    "uuid", "itemId", "reminder",
+  ]);
 
-    const now = new Date().toISOString();
-    const updatedList: Checklist = {
-      ...list,
-      items: updateItem(list.items, itemId, (item) => ({
-        ...item,
-        reminder,
-        lastModifiedBy: currentUser.username,
-        lastModifiedAt: now,
-      })),
-      updatedAt: now,
-    };
+  const actor = await sessionActor();
+  if ("error" in actor) return { error: actor.error };
 
-    await _saveAndBroadcast(updatedList, currentUser.username);
-    return { success: true, data: updatedList };
-  } catch (error) {
-    console.error("Error setting reminder:", error);
-    return { error: "Failed to set reminder" };
-  }
+  return remindItem(actor, uuid, itemId, reminder);
 };
-
-export const updateKanbanItemPriority = async (formData: FormData) =>
-  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
-    _updateKanbanItemPriority(formData),
-  );
-
-export const updateKanbanItemScore = async (formData: FormData) =>
-  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
-    _updateKanbanItemScore(formData),
-  );
-
-export const assignKanbanItem = async (formData: FormData) =>
-  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
-    _assignKanbanItem(formData),
-  );
-
-export const setKanbanItemReminder = async (formData: FormData) =>
-  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
-    _setKanbanItemReminder(formData),
-  );
diff --git a/app/_server/actions/kanban/search.ts b/app/_server/actions/kanban/search.ts
index 647f81343..9886686d7 100644
--- a/app/_server/actions/kanban/search.ts
+++ b/app/_server/actions/kanban/search.ts
@@ -1,8 +1,8 @@
 "use server";
 
-import { Checklist, Item, KanbanPriority } from "@/app/_types";
-import { getCurrentUser } from "@/app/_server/actions/users";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { Item, KanbanPriority } from "@/app/_types";
+import { sessionActor } from "@/app/_server/actions/lib/actor";
+import { viewList } from "@/app/_server/actions/checklist/viewer";
 import { getFormData } from "@/app/_utils/global-utils";
 
 const _matchesText = (item: Item, query: string): boolean => {
@@ -52,12 +52,10 @@ export const searchKanbanItems = async (formData: FormData) => {
     const priority = formData.get("priority") as KanbanPriority | null;
     const assignee = formData.get("assignee") as string | null;
 
-    const [currentUser, list] = await Promise.all([
-      getCurrentUser(),
-      getListById(uuid),
-    ]);
+    const actor = await sessionActor();
+    if ("error" in actor) return { error: actor.error };
 
-    if (!currentUser) return { error: "Not authenticated" };
+    const list = await viewList(uuid);
     if (!list) return { error: "List not found" };
 
     const filtered = _filterItems(
diff --git a/app/_server/actions/kanban/tweaker.ts b/app/_server/actions/kanban/tweaker.ts
new file mode 100644
index 000000000..fab930270
--- /dev/null
+++ b/app/_server/actions/kanban/tweaker.ts
@@ -0,0 +1,138 @@
+import { revalidatePath } from "next/cache";
+import { Checklist, Item, Result, KanbanReminder, SanitisedUser } from "@/app/_types";
+import {
+  ItemTypes,
+  Modes,
+  NotificationTargets,
+  PermissionTypes,
+} from "@/app/_types/enums";
+import { serverWriteFile } from "@/app/_server/actions/file";
+import { listToMarkdown } from "@/app/_utils/checklist-utils";
+import { reachableFile } from "@/app/_server/actions/share/queries";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { notifyUser } from "@/app/_server/actions/notifications/internal";
+import { findItem, updateItem } from "@/app/_utils/item-tree-utils";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+
+const _tweakItem = async (
+  actor: SanitisedUser,
+  uuid: string,
+  itemId: string,
+  patch: Partial<Item>,
+): Promise<Result<Checklist>> => {
+  const username = actor?.username;
+  if (!username) return { success: false, error: "Not authenticated" };
+
+  const filePath = await reachableFile(
+    uuid, ItemTypes.CHECKLIST, username, PermissionTypes.EDIT
+  );
+  if (!filePath) return { success: false, error: "Permission denied" };
+
+  const list = await getListById(uuid, username);
+  if (!list) return { success: false, error: "List not found" };
+
+  const now = new Date().toISOString();
+  const updatedList: Checklist = {
+    ...list,
+    items: updateItem(list.items, itemId, (item) => ({
+      ...item,
+      ...patch,
+      lastModifiedBy: username,
+      lastModifiedAt: now,
+    })),
+    updatedAt: now,
+  };
+
+  await serverWriteFile(filePath, listToMarkdown(updatedList));
+
+  await broadcast({
+    type: "checklist",
+    action: "updated",
+    entityId: updatedList.uuid,
+    username,
+  });
+
+  try {
+    revalidatePath("/");
+  } catch (error) {
+    console.warn("Cache revalidation failed, but data was saved successfully:", error);
+  }
+
+  return { success: true, data: updatedList };
+};
+
+export const tweakItem = async (
+  actor: SanitisedUser,
+  uuid: string,
+  itemId: string,
+  patch: Partial<Item>,
+): Promise<Result<Checklist>> =>
+  runQueued(itemLane(Modes.CHECKLISTS, uuid), () =>
+    _tweakItem(actor, uuid, itemId, patch),
+  );
+
+export const assignItem = async (
+  actor: SanitisedUser,
+  uuid: string,
+  itemId: string,
+  assignee: string,
+): Promise<Result<Checklist>> => {
+  try {
+    const result = await tweakItem(actor, uuid, itemId, {
+      assignee: assignee || undefined,
+    });
+
+    if (!result.data || !assignee || assignee === actor.username) {
+      return result;
+    }
+
+    const assignedItem = findItem(result.data.items, itemId);
+
+    try {
+      await notifyUser(assignee, {
+        type: "assignment",
+        title: assignedItem?.text || "New task assigned",
+        message: `${actor.username} assigned you to a task in "${result.data.title}"`,
+        data: {
+          itemId: result.data.uuid,
+          itemType: NotificationTargets.CHECKLIST,
+          taskId: itemId,
+        },
+      });
+    } catch (error) {
+      console.warn("[kanban] assignment notification failed:", error);
+    }
+
+    return result;
+  } catch (error) {
+    console.error("Error assigning item:", error);
+    return { success: false, error: "Failed to assign item" };
+  }
+};
+
+const _parseReminder = (raw: string): KanbanReminder | undefined => {
+  if (!raw) return undefined;
+
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return { datetime: raw };
+  }
+};
+
+export const remindItem = async (
+  actor: SanitisedUser,
+  uuid: string,
+  itemId: string,
+  reminder: string,
+): Promise<Result<Checklist>> => {
+  try {
+    return await tweakItem(actor, uuid, itemId, {
+      reminder: _parseReminder(reminder),
+    });
+  } catch (error) {
+    console.error("Error setting reminder:", error);
+    return { success: false, error: "Failed to set reminder" };
+  }
+};
diff --git a/app/_server/actions/note/editor.ts b/app/_server/actions/note/editor.ts
index d3396677e..627c9ec9f 100644
--- a/app/_server/actions/note/editor.ts
+++ b/app/_server/actions/note/editor.ts
@@ -271,7 +271,7 @@ export const editNote = async (
     _editNote(actor, formData, autosaveNotes),
   );
 
-export const dropNote = async (
+const _dropNote = async (
   currentUser: SanitisedUser,
   formData: FormData,
 ): Promise<{ success?: boolean; error?: string }> => {
@@ -380,3 +380,7 @@ export const dropNote = async (
   }
 };
 
+export const dropNote = async (actor: SanitisedUser, formData: FormData) =>
+  runQueued(itemLane(Modes.NOTES, formData.get("uuid") as string), () =>
+    _dropNote(actor, formData),
+  );
diff --git a/app/_server/actions/relations/queries.ts b/app/_server/actions/relations/queries.ts
index 768431391..3b849bfe0 100644
--- a/app/_server/actions/relations/queries.ts
+++ b/app/_server/actions/relations/queries.ts
@@ -122,8 +122,11 @@ const _mentionsOf = (
 
   const query = `"${words.join(" ").replace(/"/g, '""')}"`;
   const rows = relationsDb()
-    .prepare("SELECT uuid, body FROM texts WHERE texts MATCH ? LIMIT 400")
-    .all(query) as { uuid: string; body: string }[];
+    .prepare(
+      `SELECT uuid, body FROM texts WHERE texts MATCH ?
+       AND uuid IN (SELECT value FROM json_each(?)) LIMIT 400`,
+    )
+    .all(query, JSON.stringify(Array.from(visible.keys()))) as { uuid: string; body: string }[];
 
   const phrase = _phrase(item.title);
   const found: MentionedIn[] = [];
diff --git a/app/_server/actions/relations/tidy.ts b/app/_server/actions/relations/tidy.ts
index 48a65e26f..ed87bad94 100644
--- a/app/_server/actions/relations/tidy.ts
+++ b/app/_server/actions/relations/tidy.ts
@@ -45,11 +45,10 @@ const _canonical = async (url: string, owner: string): Promise<string | null> =>
   const target = parseItemHref(url);
   if (!target) return null;
 
-  if (target.uuid && target.type) return null;
-
   if (target.uuid) {
     const type = _typeOf(target.uuid);
-    return type ? itemHref(type, target.uuid) : null;
+    if (!type || type === target.type) return null;
+    return itemHref(type, target.uuid);
   }
 
   if (target.legacy && target.type) {
diff --git a/app/_server/actions/share/access.ts b/app/_server/actions/share/access.ts
index 9f05b68d1..15f028398 100644
--- a/app/_server/actions/share/access.ts
+++ b/app/_server/actions/share/access.ts
@@ -73,6 +73,7 @@ const _narrowest = (
   canRead: a.canRead && b.canRead,
   canEdit: a.canEdit && b.canEdit,
   canDelete: a.canDelete && b.canDelete,
+  canCreate: Boolean(a.canCreate && b.canCreate),
 });
 
 const _chainGrants = async (
diff --git a/app/_styles/globals.css b/app/_styles/globals.css
index dd7bfb87d..9bd16453b 100644
--- a/app/_styles/globals.css
+++ b/app/_styles/globals.css
@@ -675,16 +675,16 @@ pre.text-foreground span,
 }
 
 @media (max-width: 1023px) {
+  .jotty-layout-content {
+    padding-bottom: var(--jotty-note-bar-space, 0px);
+  }
+
   .jotty-quick-nav-gutter::after {
     content: "";
     display: block;
     flex-shrink: 0;
     height: var(--jotty-quick-nav-space, 0px);
   }
-
-  .jotty-note-bar-gutter {
-    padding-bottom: var(--jotty-note-bar-space, 0px);
-  }
 }
 
 .jotty-x-scroll,
diff --git a/app/_translations/en.json b/app/_translations/en.json
index f753a413e..47ecb3036 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -1161,6 +1161,8 @@
     "tryAgain": "Try again",
     "contactSupport": "Contact support",
     "invalidInput": "Invalid input",
+    "invalidEditorSettings": "Editor settings must be an object, nothing was saved",
+    "invalidEditorSetting": "Editor setting {field} has the wrong type, nothing was saved",
     "categoryOutOfBounds": "That category is outside your notes, so nothing was created",
     "requiredField": "This field is required",
     "emailInvalid": "Please enter a valid email",
diff --git a/app/_types/note.ts b/app/_types/note.ts
index b63113b9e..6bf4b37fb 100644
--- a/app/_types/note.ts
+++ b/app/_types/note.ts
@@ -33,6 +33,7 @@ export interface NoteEditorViewModel {
   setCategory: (category: string) => void;
   editorContent: string;
   isEditing: boolean;
+  isEditorVisible: boolean;
   setIsEditing: (isEditing: boolean) => void;
   status: {
     isSaving: boolean;
diff --git a/app/_utils/api-utils.ts b/app/_utils/api-utils.ts
index d073e1b6f..59b3d00d1 100644
--- a/app/_utils/api-utils.ts
+++ b/app/_utils/api-utils.ts
@@ -1,7 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { authenticateApiKey } from "@/app/_server/actions/api";
 import { resolveApiId } from "@/app/_server/actions/lib/legacy-lookup";
-import { Modes } from "@/app/_types/enums";
+import { canReach } from "@/app/_server/actions/share/queries";
+import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
 
 /**
  * @deprecated Legacy category+id fallback for checklist-family API routes
@@ -43,3 +44,12 @@ export const withApiAuth = async (
   }
 };
 
+
+export const turnAway = async (
+  username: string,
+  uuid: string,
+  permission: PermissionTypes,
+): Promise<NextResponse | null> =>
+  (await canReach(uuid, ItemTypes.CHECKLIST, username, permission))
+    ? null
+    : NextResponse.json({ error: "Forbidden" }, { status: 403 });
diff --git a/app/_utils/grep-utils.ts b/app/_utils/grep-utils.ts
index 18982977c..57540bffc 100644
--- a/app/_utils/grep-utils.ts
+++ b/app/_utils/grep-utils.ts
@@ -14,7 +14,9 @@
 import { exec, execFile } from "child_process";
 import { promisify } from "util";
 import path from "path";
+import fs from "fs/promises";
 import yaml from "js-yaml";
+import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
 import { isPathUuid, pathUuid } from "@/app/_server/actions/lib/read-only";
 
 const execAsync = promisify(exec);
@@ -66,20 +68,14 @@ export const grepFindFileByField = async (
   }
 };
 
-const _unstampedFiles = async (dir: string): Promise<string[]> => {
+const _storedUuid = async (filePath: string): Promise<string | undefined> => {
   try {
-    const { stdout } = await execFileAsync("grep", [
-      "-rL",
-      "^uuid: ",
-      dir,
-      "--include=*.md",
-    ]);
-    return stdout.trim().split("\n").filter(Boolean);
+    const { uuid } = extractYamlMetadata(await fs.readFile(filePath, "utf-8"))
+      .metadata;
+    return typeof uuid === "string" && uuid ? uuid : undefined;
   } catch (error) {
-    const stdout = (error as { stdout?: unknown })?.stdout;
-    return typeof stdout === "string"
-      ? stdout.trim().split("\n").filter(Boolean)
-      : [];
+    console.error("Failed to read frontmatter for derived uuid:", filePath, error);
+    return undefined;
   }
 };
 
@@ -89,14 +85,12 @@ const _findUnstamped = async (
 ): Promise<GrepFileResult | null> => {
   if (!isPathUuid(uuid)) return null;
 
-  const match = (await _unstampedFiles(dir)).find(
-    (filePath) => pathUuid(filePath) === uuid,
+  const match = (await grepListAllFiles(dir)).find(
+    (file) => pathUuid(file.filePath) === uuid,
   );
-  if (!match) return null;
+  if (!match || (await _storedUuid(match.filePath))) return null;
 
-  const parts = path.relative(dir, match).split(path.sep);
-  const id = path.basename(parts.pop() || "", ".md");
-  return { filePath: match, id, category: parts.join("/") };
+  return match;
 };
 
 export const grepFindFileByUuid = async (
diff --git a/app/_utils/markdown-utils.tsx b/app/_utils/markdown-utils.tsx
index 38a3521a6..1e99d908d 100644
--- a/app/_utils/markdown-utils.tsx
+++ b/app/_utils/markdown-utils.tsx
@@ -771,9 +771,7 @@ const CODE_STASH_REGEX = new RegExp(
   "g"
 );
 
-export const convertMarkdownToHtml = (markdown: string): string => {
-  if (!markdown || typeof markdown !== "string") return "";
-
+export const tagOutsideCode = (markdown: string): string => {
   const codeBlockRegex = /```[\s\S]*?```|`[^`]+`/g;
   const codeBlocks: string[] = [];
   const stashed = markdown.replace(codeBlockRegex, (match) => {
@@ -781,16 +779,20 @@ export const convertMarkdownToHtml = (markdown: string): string => {
     return `${CODE_STASH_MARK}${codeBlocks.length - 1}${CODE_STASH_MARK}`;
   });
 
-  const processed = stashed
+  return stashed
     .replace(
-      /(?:^|(?<=[\s(]))#([a-zA-Z][a-zA-Z0-9_/-]*)/g,
+      /(?:^|(?<=[\s(]))#([a-zA-Z][a-zA-Z0-9_/-]*)/gm,
       '<span data-tag="$1">$1</span>'
     )
     .replace(CODE_STASH_REGEX, (match, index: string) =>
       codeBlocks[Number(index)] ?? match
     );
+};
+
+export const convertMarkdownToHtml = (markdown: string): string => {
+  if (!markdown || typeof markdown !== "string") return "";
 
-  const file = markdownProcessor.processSync(processed);
+  const file = markdownProcessor.processSync(tagOutsideCode(markdown));
 
   return String(file);
 };
diff --git a/app/api/checklists/[listId]/items/[itemIndex]/route.ts b/app/api/checklists/[listId]/items/[itemIndex]/route.ts
index 82a0bfc20..d5d107cf0 100644
--- a/app/api/checklists/[listId]/items/[itemIndex]/route.ts
+++ b/app/api/checklists/[listId]/items/[itemIndex]/route.ts
@@ -1,12 +1,9 @@
 import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
 import { getListById } from "@/app/_server/actions/checklist/queries";
 import { editItem } from "@/app/_server/actions/checklist-item/editor";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { serverWriteFile } from "@/app/_server/actions/file";
-import path from "path";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
-import { KanbanPriorityLevel } from "@/app/_types/enums";
+import { removeItem } from "@/app/_server/actions/checklist-item/remover";
+import { KanbanPriorityLevel, PermissionTypes } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
 
@@ -236,42 +233,21 @@ export async function DELETE(
         return NextResponse.json({ error: "Item not found" }, { status: 404 });
       }
 
-      const filterOutItem = (items: any[], itemId: string): any[] => {
-        return items
-          .filter((item) => item.id !== itemId)
-          .map((item) => {
-            const filteredChildren = item.children
-              ? filterOutItem(item.children, itemId)
-              : undefined;
-            return {
-              ...item,
-              children:
-                filteredChildren && filteredChildren.length > 0
-                  ? filteredChildren
-                  : undefined,
-            };
-          });
-      };
-
-      const updatedList = {
-        ...list,
-        items: filterOutItem(list.items || [], item.id),
-        updatedAt: new Date().toISOString(),
-      };
-
-      const ownerDir = path.join(
-        process.cwd(),
-        "data",
-        CHECKLISTS_FOLDER,
-        list.owner!,
-      );
-      const filePath = path.join(
-        ownerDir,
-        list.category || "Uncategorized",
-        `${list.id}.md`,
+      const refused = await turnAway(
+        user.username,
+        list.uuid!,
+        PermissionTypes.DELETE,
       );
+      if (refused) return refused;
+
+      const result = await removeItem(user, list.uuid!, item.id);
 
-      await serverWriteFile(filePath, listToMarkdown(updatedList as any));
+      if (!result.success) {
+        return NextResponse.json(
+          { error: result.error || "Failed to delete item" },
+          { status: 500 },
+        );
+      }
 
       return NextResponse.json({ success: true });
     } catch (error) {
diff --git a/app/api/checklists/[listId]/items/reorder/route.ts b/app/api/checklists/[listId]/items/reorder/route.ts
index a19e9be07..38648b965 100644
--- a/app/api/checklists/[listId]/items/reorder/route.ts
+++ b/app/api/checklists/[listId]/items/reorder/route.ts
@@ -11,6 +11,7 @@ import path from "path";
 import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 import { resolveApiId } from "@/app/_server/actions/lib/legacy-lookup";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
 export const dynamic = "force-dynamic";
 
@@ -77,78 +78,84 @@ export async function PUT(
         request.nextUrl.searchParams.get("category"),
         user.username,
       );
-      const list = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!list) {
+      if (!uuid) {
         return NextResponse.json({ error: "List not found" }, { status: 404 });
       }
 
-      const canEdit = await canReach(
-        list.uuid!,
-        ItemTypes.CHECKLIST,
-        user.username,
-        PermissionTypes.EDIT,
-      );
-
-      if (!canEdit) {
-        return NextResponse.json({ error: "Forbidden" }, { status: 403 });
-      }
-
-      const items = cloneTree(list.items as unknown as TreeItem[]);
-
-      if (isDescendant(activeItemId, overItemId, items)) {
-        return NextResponse.json({ success: true });
-      }
-
-      const activeInfo = findInTree(items, activeItemId);
-      const overInfo = findInTree(items, overItemId);
+      return runQueued(itemLane(Modes.CHECKLISTS, uuid), async () => {
+        const list = await getListById(uuid, user.username);
+        if (!list) {
+          return NextResponse.json({ error: "List not found" }, { status: 404 });
+        }
+
+        const canEdit = await canReach(
+          list.uuid!,
+          ItemTypes.CHECKLIST,
+          user.username,
+          PermissionTypes.EDIT,
+        );
 
-      if (!activeInfo || !overInfo) {
-        return NextResponse.json({ error: "Item not found" }, { status: 404 });
-      }
+        if (!canEdit) {
+          return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+        }
+
+        const items = cloneTree(list.items as unknown as TreeItem[]);
+
+        if (isDescendant(activeItemId, overItemId, items)) {
+          return NextResponse.json({ success: true });
+        }
+
+        const activeInfo = findInTree(items, activeItemId);
+        const overInfo = findInTree(items, overItemId);
+
+        if (!activeInfo || !overInfo) {
+          return NextResponse.json({ error: "Item not found" }, { status: 404 });
+        }
+
+        if (activeItemId === overItemId) {
+          return NextResponse.json({ success: true });
+        }
+
+        activeInfo.siblings.splice(activeInfo.index, 1);
+
+        if (isDropInto) {
+          if (!overInfo.item.children) overInfo.item.children = [];
+          overInfo.item.children.push(activeInfo.item);
+        } else {
+          let insertAt = overInfo.siblings.findIndex((i) => i.id === overItemId);
+          if (position === "after") insertAt += 1;
+          overInfo.siblings.splice(insertAt, 0, activeInfo.item);
+        }
+
+        stampOrder(items);
+
+        const updatedList = { ...list, items, updatedAt: new Date().toISOString() };
+
+        const ownerDir = path.join(process.cwd(), "data", CHECKLISTS_FOLDER, list.owner!);
+        const categoryDir = path.join(ownerDir, list.category || UNCATEGORIZED);
+        await ensureDir(categoryDir);
+        await serverWriteFile(path.join(categoryDir, `${list.id}.md`), listToMarkdown(updatedList as any));
+
+        try {
+          revalidatePath("/");
+          revalidatePath(`/checklist/${list.uuid}`);
+        } catch (error) {
+          console.warn("Cache revalidation failed, but data was saved successfully:", error);
+        }
+
+        try {
+          await broadcast({
+            type: "checklist",
+            action: "updated",
+            entityId: list.uuid,
+            username: user.username,
+          });
+        } catch (error) {
+          console.warn("Broadcast failed, but data was saved successfully:", error);
+        }
 
-      if (activeItemId === overItemId) {
         return NextResponse.json({ success: true });
-      }
-
-      activeInfo.siblings.splice(activeInfo.index, 1);
-
-      if (isDropInto) {
-        if (!overInfo.item.children) overInfo.item.children = [];
-        overInfo.item.children.push(activeInfo.item);
-      } else {
-        let insertAt = overInfo.siblings.findIndex((i) => i.id === overItemId);
-        if (position === "after") insertAt += 1;
-        overInfo.siblings.splice(insertAt, 0, activeInfo.item);
-      }
-
-      stampOrder(items);
-
-      const updatedList = { ...list, items, updatedAt: new Date().toISOString() };
-
-      const ownerDir = path.join(process.cwd(), "data", CHECKLISTS_FOLDER, list.owner!);
-      const categoryDir = path.join(ownerDir, list.category || UNCATEGORIZED);
-      await ensureDir(categoryDir);
-      await serverWriteFile(path.join(categoryDir, `${list.id}.md`), listToMarkdown(updatedList as any));
-
-      try {
-        revalidatePath("/");
-        revalidatePath(`/checklist/${list.uuid}`);
-      } catch (error) {
-        console.warn("Cache revalidation failed, but data was saved successfully:", error);
-      }
-
-      try {
-        await broadcast({
-          type: "checklist",
-          action: "updated",
-          entityId: list.uuid,
-          username: user.username,
-        });
-      } catch (error) {
-        console.warn("Broadcast failed, but data was saved successfully:", error);
-      }
-
-      return NextResponse.json({ success: true });
+      });
     } catch (error) {
       console.error("API Error:", error);
       return NextResponse.json({ error: "Internal server error" }, { status: 500 });
diff --git a/app/api/checklists/[listId]/items/route.ts b/app/api/checklists/[listId]/items/route.ts
index 73386cba5..db7429cd9 100644
--- a/app/api/checklists/[listId]/items/route.ts
+++ b/app/api/checklists/[listId]/items/route.ts
@@ -1,12 +1,9 @@
 import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
 import { addItem } from "@/app/_server/actions/checklist-item/editor";
+import { graftItem } from "@/app/_server/actions/checklist-item/grafter";
 import { getListById } from "@/app/_server/actions/checklist/queries";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { serverWriteFile } from "@/app/_server/actions/file";
-import path from "path";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
-import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { PermissionTypes } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
 
@@ -33,6 +30,13 @@ export async function POST(
         return NextResponse.json({ error: "List not found" }, { status: 404 });
       }
 
+      const refused = await turnAway(
+        user.username,
+        list.uuid!,
+        PermissionTypes.EDIT,
+      );
+      if (refused) return refused;
+
       const formData = new FormData();
       formData.append("text", text);
 
@@ -62,60 +66,20 @@ export async function POST(
           );
         }
 
-        const newSubItem: any = {
-          id: `${list.uuid}-sub-${Date.now()}`,
-          text,
-          completed: false,
-          order: 0,
-        };
-
-        const addSubItemToParent = (
-          items: any[],
-          parentId: string,
-        ): boolean => {
-          for (let item of items) {
-            if (item.id === parentId) {
-              if (!item.children) {
-                item.children = [];
-              }
-              item.children.push(newSubItem);
-              return true;
-            }
-            if (item.children && addSubItemToParent(item.children, parentId)) {
-              return true;
-            }
-          }
-          return false;
-        };
+        const graft = new FormData();
+        graft.append("uuid", list.uuid!);
+        graft.append("parentId", parentItem.id);
+        graft.append("text", text);
+
+        const grafted = await graftItem(user, graft);
 
-        const updatedItems = JSON.parse(JSON.stringify(list.items));
-        if (!addSubItemToParent(updatedItems, parentItem.id)) {
+        if (!grafted.success) {
           return NextResponse.json(
-            { error: "Failed to add sub-item" },
+            { error: grafted.error || "Failed to add sub-item" },
             { status: 500 },
           );
         }
 
-        const updatedList = {
-          ...list,
-          items: updatedItems,
-          updatedAt: new Date().toISOString(),
-        };
-
-        const ownerDir = path.join(
-          process.cwd(),
-          "data",
-          CHECKLISTS_FOLDER,
-          list.owner!,
-        );
-        const filePath = path.join(
-          ownerDir,
-          list.category || UNCATEGORIZED,
-          `${list.id}.md`,
-        );
-
-        await serverWriteFile(filePath, listToMarkdown(updatedList as any));
-
         return NextResponse.json({ success: true });
       }
       if (status) {
diff --git a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
index d3082375e..a20b0b8fa 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
 import { getListById } from "@/app/_server/actions/checklist/queries";
-import { assignKanbanItem } from "@/app/_server/actions/kanban/items";
+import { assignItem } from "@/app/_server/actions/kanban/tweaker";
 import { isKanbanType } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
@@ -29,12 +29,12 @@ export async function PUT(
         );
       }
 
-      const formData = new FormData();
-      formData.append("uuid", board.uuid!);
-      formData.append("itemId", params.itemId);
-      formData.append("assignee", assignee || "");
-
-      const result = await assignKanbanItem(formData);
+      const result = await assignItem(
+        user,
+        board.uuid!,
+        params.itemId,
+        assignee || "",
+      );
 
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
diff --git a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
index dd2c0aaa0..b3ece54af 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
 import { getListById } from "@/app/_server/actions/checklist/queries";
-import { setKanbanItemReminder } from "@/app/_server/actions/kanban/items";
+import { remindItem } from "@/app/_server/actions/kanban/tweaker";
 import { isKanbanType } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
@@ -36,12 +36,12 @@ export async function PUT(
         );
       }
 
-      const formData = new FormData();
-      formData.append("uuid", board.uuid!);
-      formData.append("itemId", params.itemId);
-      formData.append("reminder", JSON.stringify({ datetime }));
-
-      const result = await setKanbanItemReminder(formData);
+      const result = await remindItem(
+        user,
+        board.uuid!,
+        params.itemId,
+        JSON.stringify({ datetime }),
+      );
 
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
@@ -78,12 +78,7 @@ export async function DELETE(
         );
       }
 
-      const formData = new FormData();
-      formData.append("uuid", board.uuid!);
-      formData.append("itemId", params.itemId);
-      formData.append("reminder", "");
-
-      const result = await setKanbanItemReminder(formData);
+      const result = await remindItem(user, board.uuid!, params.itemId, "");
 
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
diff --git a/app/api/kanban/[boardId]/items/[itemId]/route.ts b/app/api/kanban/[boardId]/items/[itemId]/route.ts
index eea381273..bdd3bfe5e 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/route.ts
@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
 import { getListById } from "@/app/_server/actions/checklist/queries";
-import { deleteItem } from "@/app/_server/actions/checklist-item";
+import { removeItem } from "@/app/_server/actions/checklist-item/remover";
 import { editItem } from "@/app/_server/actions/checklist-item/editor";
 import { isKanbanType } from "@/app/_types/enums";
 
@@ -79,11 +79,7 @@ export async function DELETE(
         );
       }
 
-      const formData = new FormData();
-      formData.append("uuid", board.uuid!);
-      formData.append("itemId", params.itemId);
-
-      const result = await deleteItem(formData);
+      const result = await removeItem(user, board.uuid!, params.itemId);
 
       if (!result.success) {
         return NextResponse.json(
diff --git a/app/api/kanban/[boardId]/statuses/route.ts b/app/api/kanban/[boardId]/statuses/route.ts
index a4e606b67..5dc877fd1 100644
--- a/app/api/kanban/[boardId]/statuses/route.ts
+++ b/app/api/kanban/[boardId]/statuses/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { updateChecklistStatuses } from "@/app/_server/actions/checklist";
+import { restatus } from "@/app/_server/actions/checklist/restatus";
 import { getListById } from "@/app/_server/actions/checklist/queries";
 import { isKanbanType } from "@/app/_types/enums";
 
@@ -36,11 +36,7 @@ export async function PUT(
         );
       }
 
-      const formData = new FormData();
-      formData.append("uuid", board.uuid!);
-      formData.append("statusesStr", JSON.stringify(statuses));
-
-      const result = await updateChecklistStatuses(formData);
+      const result = await restatus(user, board.uuid!, () => statuses);
 
       if (result.error) {
         return NextResponse.json({ error: result.error }, { status: 400 });
diff --git a/app/api/tasks/[taskId]/items/[itemIndex]/route.ts b/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
index 4eb73437e..31f93b992 100644
--- a/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
+++ b/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
@@ -1,11 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
 import { getListById } from "@/app/_server/actions/checklist/queries";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { serverWriteFile } from "@/app/_server/actions/file";
-import path from "path";
-import { isKanbanType } from "@/app/_types/enums";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
+import { removeItem } from "@/app/_server/actions/checklist-item/remover";
+import { isKanbanType, PermissionTypes } from "@/app/_types/enums";
 import { toApiItem } from "@/app/_utils/api-item";
 
 export const dynamic = "force-dynamic";
@@ -121,42 +118,21 @@ export async function DELETE(
         return NextResponse.json({ error: "Item not found" }, { status: 404 });
       }
 
-      const filterOutItem = (items: any[], itemId: string): any[] => {
-        return items
-          .filter((item) => item.id !== itemId)
-          .map((item) => {
-            const filteredChildren = item.children
-              ? filterOutItem(item.children, itemId)
-              : undefined;
-            return {
-              ...item,
-              children:
-                filteredChildren && filteredChildren.length > 0
-                  ? filteredChildren
-                  : undefined,
-            };
-          });
-      };
-
-      const updatedTask = {
-        ...task,
-        items: filterOutItem(task.items || [], item.id),
-        updatedAt: new Date().toISOString(),
-      };
-
-      const ownerDir = path.join(
-        process.cwd(),
-        "data",
-        CHECKLISTS_FOLDER,
-        task.owner!,
-      );
-      const filePath = path.join(
-        ownerDir,
-        task.category || "Uncategorized",
-        `${task.id}.md`,
+      const refused = await turnAway(
+        user.username,
+        task.uuid!,
+        PermissionTypes.DELETE,
       );
+      if (refused) return refused;
+
+      const result = await removeItem(user, task.uuid!, item.id);
 
-      await serverWriteFile(filePath, listToMarkdown(updatedTask as any));
+      if (!result.success) {
+        return NextResponse.json(
+          { error: result.error || "Failed to delete item" },
+          { status: 500 },
+        );
+      }
 
       return NextResponse.json({ success: true });
     } catch (error) {
diff --git a/app/api/tasks/[taskId]/items/route.ts b/app/api/tasks/[taskId]/items/route.ts
index 117aef521..2881c992c 100644
--- a/app/api/tasks/[taskId]/items/route.ts
+++ b/app/api/tasks/[taskId]/items/route.ts
@@ -1,12 +1,9 @@
 import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
 import { addItem } from "@/app/_server/actions/checklist-item/editor";
+import { graftItem } from "@/app/_server/actions/checklist-item/grafter";
 import { getListById } from "@/app/_server/actions/checklist/queries";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { serverWriteFile } from "@/app/_server/actions/file";
-import { isKanbanType, TaskStatus } from "@/app/_types/enums";
-import path from "path";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
+import { isKanbanType, PermissionTypes, TaskStatus } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
 
@@ -40,6 +37,13 @@ export async function POST(
         );
       }
 
+      const refused = await turnAway(
+        user.username,
+        task.uuid!,
+        PermissionTypes.EDIT,
+      );
+      if (refused) return refused;
+
       if (parentIndex !== undefined) {
         const indexPath = parentIndex
           .toString()
@@ -66,61 +70,21 @@ export async function POST(
           );
         }
 
-        const newSubItem: any = {
-          id: `${task.id}-sub-${Date.now()}`,
-          text,
-          status: status || TaskStatus.TODO,
-          completed: false,
-          order: 0,
-        };
-
-        const addSubItemToParent = (
-          items: any[],
-          parentId: string,
-        ): boolean => {
-          for (let item of items) {
-            if (item.id === parentId) {
-              if (!item.children) {
-                item.children = [];
-              }
-              item.children.push(newSubItem);
-              return true;
-            }
-            if (item.children && addSubItemToParent(item.children, parentId)) {
-              return true;
-            }
-          }
-          return false;
-        };
+        const graft = new FormData();
+        graft.append("uuid", task.uuid!);
+        graft.append("parentId", parentItem.id);
+        graft.append("text", text);
+        graft.append("status", status || TaskStatus.TODO);
+
+        const grafted = await graftItem(user, graft);
 
-        const updatedItems = JSON.parse(JSON.stringify(task.items));
-        if (!addSubItemToParent(updatedItems, parentItem.id)) {
+        if (!grafted.success) {
           return NextResponse.json(
-            { error: "Failed to add sub-item" },
+            { error: grafted.error || "Failed to add sub-item" },
             { status: 500 },
           );
         }
 
-        const updatedTask = {
-          ...task,
-          items: updatedItems,
-          updatedAt: new Date().toISOString(),
-        };
-
-        const ownerDir = path.join(
-          process.cwd(),
-          "data",
-          CHECKLISTS_FOLDER,
-          task.owner!,
-        );
-        const filePath = path.join(
-          ownerDir,
-          task.category || "Uncategorized",
-          `${task.id}.md`,
-        );
-
-        await serverWriteFile(filePath, listToMarkdown(updatedTask as any));
-
         return NextResponse.json({ success: true });
       }
 
diff --git a/app/api/tasks/[taskId]/statuses/[statusId]/route.ts b/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
index 9b39e7016..8c949d5fa 100644
--- a/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
+++ b/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
@@ -1,11 +1,9 @@
 import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
 import { getListById } from "@/app/_server/actions/checklist/queries";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { serverWriteFile } from "@/app/_server/actions/file";
-import path from "path";
-import { isKanbanType } from "@/app/_types/enums";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
+import { restatus } from "@/app/_server/actions/checklist/restatus";
+import { isKanbanType, PermissionTypes } from "@/app/_types/enums";
+import { API_FALLBACK_STATUSES } from "@/app/_consts/kanban";
 
 export const dynamic = "force-dynamic";
 
@@ -32,11 +30,7 @@ export async function PUT(
         );
       }
 
-      const currentStatuses = task.statuses || [
-        { id: "todo", label: "To Do", order: 0 },
-        { id: "in_progress", label: "In Progress", order: 1 },
-        { id: "completed", label: "Completed", order: 2 },
-      ];
+      const currentStatuses = task.statuses || API_FALLBACK_STATUSES;
 
       const statusIndex = currentStatuses.findIndex(
         (s) => s.id === params.statusId,
@@ -48,40 +42,36 @@ export async function PUT(
         );
       }
 
-      const updatedStatuses = currentStatuses.map((s) =>
-        s.id === params.statusId
-          ? {
-              ...s,
-              label: label ?? s.label,
-              color: color !== undefined ? color : s.color,
-              order: order !== undefined ? order : s.order,
-            }
-          : s,
+      const refused = await turnAway(
+        user.username,
+        task.uuid!,
+        PermissionTypes.EDIT,
       );
-
-      const updatedTask = {
-        ...task,
-        statuses: updatedStatuses,
-        updatedAt: new Date().toISOString(),
-      };
-
-      const ownerDir = path.join(
-        process.cwd(),
-        "data",
-        CHECKLISTS_FOLDER,
-        task.owner!,
-      );
-      const filePath = path.join(
-        ownerDir,
-        task.category || "Uncategorized",
-        `${task.id}.md`,
+      if (refused) return refused;
+
+      const result = await restatus(user, task.uuid!, (latest) =>
+        (latest || API_FALLBACK_STATUSES).map((s) =>
+          s.id === params.statusId
+            ? {
+                ...s,
+                label: label ?? s.label,
+                color: color !== undefined ? color : s.color,
+                order: order !== undefined ? order : s.order,
+              }
+            : s,
+        ),
       );
 
-      await serverWriteFile(filePath, listToMarkdown(updatedTask as any));
+      if (!result.success) {
+        return NextResponse.json(
+          { error: result.error || "Failed to update status" },
+          { status: 500 },
+        );
+      }
 
       return NextResponse.json({
         success: true,
-        data: updatedStatuses.find((s) => s.id === params.statusId),
+        data: result.data?.statuses?.find((s) => s.id === params.statusId),
       });
     } catch (error) {
       console.error("API Error:", error);
@@ -113,11 +103,7 @@ export async function DELETE(
         );
       }
 
-      const currentStatuses = task.statuses || [
-        { id: "todo", label: "To Do", order: 0 },
-        { id: "in_progress", label: "In Progress", order: 1 },
-        { id: "completed", label: "Completed", order: 2 },
-      ];
+      const currentStatuses = task.statuses || API_FALLBACK_STATUSES;
 
       const statusIndex = currentStatuses.findIndex(
         (s) => s.id === params.statusId,
@@ -129,48 +115,25 @@ export async function DELETE(
         );
       }
 
-      const updatedStatuses = currentStatuses.filter(
-        (s) => s.id !== params.statusId,
+      const refused = await turnAway(
+        user.username,
+        task.uuid!,
+        PermissionTypes.EDIT,
       );
+      if (refused) return refused;
 
-      const sortedStatuses = [...updatedStatuses].sort(
-        (a, b) => a.order - b.order,
-      );
-      const defaultStatusId = sortedStatuses[0]?.id || "todo";
-
-      const updateItemStatus = (items: any[]): any[] => {
-        return items.map((item) => {
-          const updatedItem = { ...item };
-          if (updatedItem.status === params.statusId) {
-            updatedItem.status = defaultStatusId;
-          }
-          if (updatedItem.children) {
-            updatedItem.children = updateItemStatus(updatedItem.children);
-          }
-          return updatedItem;
-        });
-      };
-
-      const updatedTask = {
-        ...task,
-        statuses: updatedStatuses,
-        items: updateItemStatus(task.items),
-        updatedAt: new Date().toISOString(),
-      };
-
-      const ownerDir = path.join(
-        process.cwd(),
-        "data",
-        CHECKLISTS_FOLDER,
-        task.owner!,
-      );
-      const filePath = path.join(
-        ownerDir,
-        task.category || "Uncategorized",
-        `${task.id}.md`,
+      const result = await restatus(user, task.uuid!, (latest) =>
+        (latest || API_FALLBACK_STATUSES).filter(
+          (s) => s.id !== params.statusId,
+        ),
       );
 
-      await serverWriteFile(filePath, listToMarkdown(updatedTask as any));
+      if (!result.success) {
+        return NextResponse.json(
+          { error: result.error || "Failed to delete status" },
+          { status: 500 },
+        );
+      }
 
       return NextResponse.json({ success: true });
     } catch (error) {
diff --git a/app/api/tasks/[taskId]/statuses/route.ts b/app/api/tasks/[taskId]/statuses/route.ts
index 393256072..ad223450c 100644
--- a/app/api/tasks/[taskId]/statuses/route.ts
+++ b/app/api/tasks/[taskId]/statuses/route.ts
@@ -1,12 +1,10 @@
 import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
 import { getListById } from "@/app/_server/actions/checklist/queries";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { serverWriteFile } from "@/app/_server/actions/file";
-import path from "path";
+import { restatus } from "@/app/_server/actions/checklist/restatus";
 import { KanbanStatus } from "@/app/_types";
-import { isKanbanType } from "@/app/_types/enums";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
+import { isKanbanType, PermissionTypes } from "@/app/_types/enums";
+import { API_FALLBACK_STATUSES } from "@/app/_consts/kanban";
 
 export const dynamic = "force-dynamic";
 
@@ -30,11 +28,7 @@ export async function GET(
         );
       }
 
-      const statuses = task.statuses || [
-        { id: "todo", label: "To Do", order: 0 },
-        { id: "in_progress", label: "In Progress", order: 1 },
-        { id: "completed", label: "Completed", order: 2 },
-      ];
+      const statuses = task.statuses || API_FALLBACK_STATUSES;
 
       return NextResponse.json({ statuses });
     } catch (error) {
@@ -77,11 +71,7 @@ export async function POST(
         );
       }
 
-      const currentStatuses = task.statuses || [
-        { id: "todo", label: "To Do", order: 0 },
-        { id: "in_progress", label: "In Progress", order: 1 },
-        { id: "completed", label: "Completed", order: 2 },
-      ];
+      const currentStatuses = task.statuses || API_FALLBACK_STATUSES;
 
       if (currentStatuses.some((s) => s.id === id)) {
         return NextResponse.json(
@@ -98,27 +88,24 @@ export async function POST(
         autoComplete: autoComplete ?? false,
       };
 
-      const updatedStatuses = [...currentStatuses, newStatus];
-
-      const updatedTask = {
-        ...task,
-        statuses: updatedStatuses,
-        updatedAt: new Date().toISOString(),
-      };
-
-      const ownerDir = path.join(
-        process.cwd(),
-        "data",
-        CHECKLISTS_FOLDER,
-        task.owner!,
-      );
-      const filePath = path.join(
-        ownerDir,
-        task.category || "Uncategorized",
-        `${task.id}.md`,
+      const refused = await turnAway(
+        user.username,
+        task.uuid!,
+        PermissionTypes.EDIT,
       );
+      if (refused) return refused;
 
-      await serverWriteFile(filePath, listToMarkdown(updatedTask as any));
+      const result = await restatus(user, task.uuid!, (latest) => {
+        const fresh = latest || API_FALLBACK_STATUSES;
+        return fresh.some((s) => s.id === id) ? fresh : [...fresh, newStatus];
+      });
+
+      if (!result.success) {
+        return NextResponse.json(
+          { error: result.error || "Failed to create status" },
+          { status: 500 },
+        );
+      }
 
       return NextResponse.json({ success: true, data: newStatus });
     } catch (error) {
diff --git a/tests/api/setup.ts b/tests/api/setup.ts
index aa15eda88..89fd7ea60 100644
--- a/tests/api/setup.ts
+++ b/tests/api/setup.ts
@@ -43,6 +43,12 @@ export const mockGetExportProgress = vi.fn();
 export const mockGetAppSettings = vi.fn();
 export const mockResolveApiId = vi.fn();
 export const mockLegacyResolve = vi.fn();
+export const mockRemoveItem = vi.fn();
+export const mockGraftItem = vi.fn();
+export const mockRestatus = vi.fn();
+export const mockAssignItem = vi.fn();
+export const mockRemindItem = vi.fn();
+export const mockCanReach = vi.fn();
 
 vi.mock("@/app/_server/actions/api", () => ({
   authenticateApiKey: (...args: any[]) => mockAuthenticateApiKey(...args),
@@ -92,6 +98,27 @@ vi.mock("@/app/_server/actions/checklist-item/editor", () => ({
   editItem: (...args: any[]) => mockEditItem(...args),
 }));
 
+vi.mock("@/app/_server/actions/checklist-item/remover", () => ({
+  removeItem: (...args: any[]) => mockRemoveItem(...args),
+}));
+
+vi.mock("@/app/_server/actions/checklist-item/grafter", () => ({
+  graftItem: (...args: any[]) => mockGraftItem(...args),
+}));
+
+vi.mock("@/app/_server/actions/checklist/restatus", () => ({
+  restatus: (...args: any[]) => mockRestatus(...args),
+}));
+
+vi.mock("@/app/_server/actions/kanban/tweaker", () => ({
+  assignItem: (...args: any[]) => mockAssignItem(...args),
+  remindItem: (...args: any[]) => mockRemindItem(...args),
+}));
+
+vi.mock("@/app/_server/actions/share/queries", () => ({
+  canReach: (...args: any[]) => mockCanReach(...args),
+}));
+
 vi.mock("@/app/_server/actions/checklist-item/stamper", () => ({
   stampStatus: (...args: any[]) => mockStampStatus(...args),
 }));
@@ -176,6 +203,21 @@ export function resetApiMocks() {
   mockLegacyResolve.mockReset();
   mockResolveApiId.mockReset();
   mockResolveApiId.mockImplementation(async (_mode: Modes, param: string) => param);
+  mockRemoveItem.mockReset();
+  mockRemoveItem.mockResolvedValue({ success: true });
+  mockGraftItem.mockReset();
+  mockGraftItem.mockResolvedValue({ success: true });
+  mockRestatus.mockReset();
+  mockRestatus.mockImplementation(
+    async (_user: any, _uuid: string, reshape: (current?: any[]) => any[]) => ({
+      success: true,
+      data: { statuses: reshape(undefined) },
+    }),
+  );
+  mockAssignItem.mockReset();
+  mockRemindItem.mockReset();
+  mockCanReach.mockReset();
+  mockCanReach.mockResolvedValue(true);
 }
 
 export function createMockRequest(
diff --git a/tests/security/share-grants.test.ts b/tests/security/share-grants.test.ts
new file mode 100644
index 000000000..d421b7898
--- /dev/null
+++ b/tests/security/share-grants.test.ts
@@ -0,0 +1,348 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { NextRequest } from 'next/server'
+import { resetAllMocks, createFormData } from '../setup'
+import { PermissionTypes } from '@/app/_types/enums'
+
+const VICTIM = 'victim'
+const READER = 'reader'
+const MALLORY = 'mallory'
+const LIST_UUID = 'board-uuid'
+const LIST_PATH = '/data/checklists/victim/Work/board.md'
+
+const GRANTS: Record<string, PermissionTypes[]> = {
+  [VICTIM]: [
+    PermissionTypes.READ,
+    PermissionTypes.EDIT,
+    PermissionTypes.CREATE,
+    PermissionTypes.DELETE,
+  ],
+  [READER]: [PermissionTypes.READ],
+}
+
+const mockGetCurrentUser = vi.fn()
+const mockAuthenticateApiKey = vi.fn()
+const mockWrite = vi.fn()
+
+const holds = (username: string, permission: PermissionTypes) =>
+  (GRANTS[username] || []).includes(permission)
+
+const victimBoard = () => ({
+  uuid: LIST_UUID,
+  id: 'board',
+  title: 'Board',
+  category: 'Work',
+  owner: VICTIM,
+  type: 'kanban',
+  statuses: [
+    { id: 'todo', label: 'To Do', order: 0 },
+    { id: 'review', label: 'Review', order: 1 },
+    { id: 'completed', label: 'Completed', order: 2 },
+  ],
+  items: [
+    {
+      id: 'milk',
+      text: 'Milk',
+      completed: false,
+      order: 0,
+      status: 'review',
+      children: [{ id: 'oat', text: 'Oat', completed: false, order: 0, status: 'review' }],
+    },
+  ],
+  createdAt: '2024-01-01T00:00:00.000Z',
+  updatedAt: '2024-01-01T00:00:00.000Z',
+})
+
+vi.mock('@/app/_server/actions/users', () => ({
+  getCurrentUser: () => mockGetCurrentUser(),
+  getUsername: async () => (await mockGetCurrentUser())?.username || '',
+  isAdmin: vi.fn().mockResolvedValue(false),
+}))
+
+vi.mock('@/app/_server/actions/users/records', () => ({
+  findUserRecord: vi.fn().mockResolvedValue(null),
+}))
+
+vi.mock('@/app/_server/actions/file', () => ({
+  ensureDir: vi.fn(),
+  getUserModeDir: vi.fn(),
+  serverWriteFile: (...args: unknown[]) => mockWrite(...args),
+}))
+
+vi.mock('@/app/_server/actions/checklist/queries', () => ({
+  getListById: async (_uuid: string, username?: string) =>
+    !username || GRANTS[username] ? victimBoard() : undefined,
+  getUserChecklists: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/share/queries', () => ({
+  canReach: async (_uuid: string, _type: string, username: string, permission: PermissionTypes) =>
+    holds(username, permission),
+  reachableFile: async (_uuid: string, _type: string, username: string, permission: PermissionTypes) =>
+    holds(username, permission) ? LIST_PATH : null,
+  usersWithAccess: vi.fn().mockResolvedValue([]),
+}))
+
+vi.mock('@/app/_server/actions/ws/broadcast', () => ({
+  broadcast: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('@/app/_server/actions/notifications/internal', () => ({
+  notifyUser: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/api', () => ({
+  authenticateApiKey: (...args: unknown[]) => mockAuthenticateApiKey(...args),
+}))
+
+vi.mock('@/app/_server/actions/lib/legacy-lookup', () => ({
+  resolveApiId: async (_mode: string, param: string) => param,
+}))
+
+const signIn = (username: string | null) =>
+  mockGetCurrentUser.mockResolvedValue(username ? { username, isAdmin: false } : null)
+
+const keyFor = (username: string) =>
+  mockAuthenticateApiKey.mockResolvedValue({ username, isAdmin: false })
+
+const apiRequest = (method: string, url: string, body?: unknown) =>
+  new NextRequest(new URL(url, 'http://localhost:3000'), {
+    method,
+    headers: { 'Content-Type': 'application/json', 'x-api-key': 'some-key' },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  })
+
+type Call = () => Promise<Response>
+
+const boardParams = <T extends Record<string, string>>(extra = {} as T) => ({
+  params: Promise.resolve({ boardId: LIST_UUID, ...extra }),
+})
+const listParams = <T extends Record<string, string>>(extra = {} as T) => ({
+  params: Promise.resolve({ listId: LIST_UUID, ...extra }),
+})
+const taskParams = <T extends Record<string, string>>(extra = {} as T) => ({
+  params: Promise.resolve({ taskId: LIST_UUID, ...extra }),
+})
+
+const itemShareRoutes = async (): Promise<Record<string, Call>> => {
+  const checklistItem = await import('@/app/api/checklists/[listId]/items/[itemIndex]/route')
+  const checklistItems = await import('@/app/api/checklists/[listId]/items/route')
+  const taskItems = await import('@/app/api/tasks/[taskId]/items/route')
+  const taskItem = await import('@/app/api/tasks/[taskId]/items/[itemIndex]/route')
+  const taskStatuses = await import('@/app/api/tasks/[taskId]/statuses/route')
+  const taskStatus = await import('@/app/api/tasks/[taskId]/statuses/[statusId]/route')
+
+  return {
+    'DELETE /api/checklists/:id/items/:index': () =>
+      checklistItem.DELETE(
+        apiRequest('DELETE', `/api/checklists/${LIST_UUID}/items/0`),
+        listParams({ itemIndex: '0' }),
+      ),
+    'POST /api/checklists/:id/items (sub-item)': () =>
+      checklistItems.POST(
+        apiRequest('POST', `/api/checklists/${LIST_UUID}/items`, { text: 'Butter', parentIndex: '0' }),
+        listParams(),
+      ),
+    'POST /api/tasks/:id/items (sub-item)': () =>
+      taskItems.POST(
+        apiRequest('POST', `/api/tasks/${LIST_UUID}/items`, { text: 'Butter', parentIndex: '0' }),
+        taskParams(),
+      ),
+    'DELETE /api/tasks/:id/items/:index': () =>
+      taskItem.DELETE(
+        apiRequest('DELETE', `/api/tasks/${LIST_UUID}/items/0`),
+        taskParams({ itemIndex: '0' }),
+      ),
+    'POST /api/tasks/:id/statuses': () =>
+      taskStatuses.POST(
+        apiRequest('POST', `/api/tasks/${LIST_UUID}/statuses`, { id: 'blocked', label: 'Blocked' }),
+        taskParams(),
+      ),
+    'PUT /api/tasks/:id/statuses/:statusId': () =>
+      taskStatus.PUT(
+        apiRequest('PUT', `/api/tasks/${LIST_UUID}/statuses/review`, { label: 'QA' }),
+        taskParams({ statusId: 'review' }),
+      ),
+    'DELETE /api/tasks/:id/statuses/:statusId': () =>
+      taskStatus.DELETE(
+        apiRequest('DELETE', `/api/tasks/${LIST_UUID}/statuses/review`),
+        taskParams({ statusId: 'review' }),
+      ),
+  }
+}
+
+const kanbanRoutes = async (): Promise<Record<string, Call>> => {
+  const statuses = await import('@/app/api/kanban/[boardId]/statuses/route')
+  const item = await import('@/app/api/kanban/[boardId]/items/[itemId]/route')
+  const assign = await import('@/app/api/kanban/[boardId]/items/[itemId]/assign/route')
+  const reminder = await import('@/app/api/kanban/[boardId]/items/[itemId]/reminder/route')
+
+  return {
+    'PUT /api/kanban/:id/statuses': () =>
+      statuses.PUT(
+        apiRequest('PUT', `/api/kanban/${LIST_UUID}/statuses`, {
+          statuses: [
+            { id: 'todo', label: 'To Do', order: 0 },
+            { id: 'completed', label: 'Completed', order: 1 },
+          ],
+        }),
+        boardParams(),
+      ),
+    'DELETE /api/kanban/:id/items/:itemId': () =>
+      item.DELETE(
+        apiRequest('DELETE', `/api/kanban/${LIST_UUID}/items/milk`),
+        boardParams({ itemId: 'milk' }),
+      ),
+    'PUT /api/kanban/:id/items/:itemId/assign': () =>
+      assign.PUT(
+        apiRequest('PUT', `/api/kanban/${LIST_UUID}/items/milk/assign`, { assignee: VICTIM }),
+        boardParams({ itemId: 'milk' }),
+      ),
+    'PUT /api/kanban/:id/items/:itemId/reminder': () =>
+      reminder.PUT(
+        apiRequest('PUT', `/api/kanban/${LIST_UUID}/items/milk/reminder`, {
+          datetime: '2030-01-01T09:00:00.000Z',
+        }),
+        boardParams({ itemId: 'milk' }),
+      ),
+    'DELETE /api/kanban/:id/items/:itemId/reminder': () =>
+      reminder.DELETE(
+        apiRequest('DELETE', `/api/kanban/${LIST_UUID}/items/milk/reminder`),
+        boardParams({ itemId: 'milk' }),
+      ),
+  }
+}
+
+describe('Security: share grants hold on every board read and mutation', () => {
+  beforeEach(() => {
+    resetAllMocks()
+    signIn(null)
+    mockAuthenticateApiKey.mockResolvedValue(null)
+    mockWrite.mockResolvedValue(undefined)
+  })
+
+  describe('kanban calendar and search actions', () => {
+    const readers = async () => {
+      const { exportBoardAsICS, getCalendarEvents } = await import('@/app/_server/actions/kanban/calendar')
+      const { searchKanbanItems } = await import('@/app/_server/actions/kanban/search')
+      return [exportBoardAsICS, getCalendarEvents, searchKanbanItems]
+    }
+
+    it('refuse without a session', async () => {
+      for (const action of await readers()) {
+        expect(await action(createFormData({ uuid: LIST_UUID }))).toEqual({ error: 'Not authenticated' })
+      }
+    })
+
+    it('refuse a stranger holding the uuid', async () => {
+      signIn(MALLORY)
+
+      for (const action of await readers()) {
+        const result = (await action(createFormData({ uuid: LIST_UUID }))) as { success?: boolean; data?: unknown }
+        expect(result.success).toBeUndefined()
+        expect(result.data).toBeUndefined()
+      }
+    })
+
+    it('serve a user holding a READ share', async () => {
+      signIn(READER)
+
+      for (const action of await readers()) {
+        const result = (await action(createFormData({ uuid: LIST_UUID }))) as { success?: boolean }
+        expect(result.success).toBe(true)
+      }
+    })
+  })
+
+  describe('an API key user holding only READ', () => {
+    beforeEach(() => keyFor(READER))
+
+    it('is refused on every item and status mutation route and writes nothing', async () => {
+      for (const [name, call] of Object.entries(await itemShareRoutes())) {
+        const response = await call()
+
+        expect({ name, status: response.status }).toEqual({ name, status: 403 })
+        expect(await response.json()).toEqual({ error: 'Forbidden' })
+      }
+
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+
+    it('is refused on the kanban mutation routes and writes nothing', async () => {
+      for (const [name, call] of Object.entries(await kanbanRoutes())) {
+        const response = await call()
+        const body = await response.json()
+
+        expect({ name, status: response.status }).toEqual({ name, status: 400 })
+        expect(body.success).toBeUndefined()
+        expect(body.error).toBeTruthy()
+      }
+
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+
+    it('is refused by the queued cores themselves, not just the routes', async () => {
+      const { removeItem } = await import('@/app/_server/actions/checklist-item/remover')
+      const { graftItem } = await import('@/app/_server/actions/checklist-item/grafter')
+      const { restatus } = await import('@/app/_server/actions/checklist/restatus')
+      const { tweakItem } = await import('@/app/_server/actions/kanban/tweaker')
+      const reader = { username: READER, isAdmin: false } as never
+
+      const results = [
+        await removeItem(reader, LIST_UUID, 'milk'),
+        await graftItem(reader, createFormData({ uuid: LIST_UUID, parentId: 'milk', text: 'Butter' })),
+        await restatus(reader, LIST_UUID, () => []),
+        await tweakItem(reader, LIST_UUID, 'milk', { priority: 'high' as never }),
+      ]
+
+      for (const result of results) {
+        expect(result.success).toBe(false)
+      }
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('the owner via API key', () => {
+    beforeEach(() => keyFor(VICTIM))
+
+    it('still succeeds on every item and status mutation route', async () => {
+      for (const [name, call] of Object.entries(await itemShareRoutes())) {
+        mockWrite.mockClear()
+        const response = await call()
+        const body = await response.json()
+
+        expect({ name, status: response.status }).toEqual({ name, status: 200 })
+        expect(body.success).toBe(true)
+        expect(mockWrite).toHaveBeenCalledOnce()
+        expect(mockWrite.mock.calls[0][0]).toBe(LIST_PATH)
+      }
+    })
+
+    it('still succeeds on the kanban mutation routes without a session', async () => {
+      for (const [name, call] of Object.entries(await kanbanRoutes())) {
+        mockWrite.mockClear()
+        const response = await call()
+        const body = await response.json()
+
+        expect({ name, status: response.status }).toEqual({ name, status: 200 })
+        expect(body.success).toBe(true)
+        expect(mockWrite).toHaveBeenCalledOnce()
+      }
+    })
+
+    it('rehomes items on nested levels when a status is deleted', async () => {
+      const { DELETE } = await import('@/app/api/tasks/[taskId]/statuses/[statusId]/route')
+
+      await DELETE(
+        apiRequest('DELETE', `/api/tasks/${LIST_UUID}/statuses/review`),
+        taskParams({ statusId: 'review' }),
+      )
+
+      const { listToMarkdown } = await import('@/app/_utils/checklist-utils')
+      const written = vi.mocked(listToMarkdown).mock.calls.at(-1)?.[0]
+
+      expect(written?.statuses?.map((status) => status.id)).toEqual(['todo', 'completed'])
+      expect(written?.items[0].status).toBe('todo')
+      expect(written?.items[0].children?.[0].status).toBe('todo')
+    })
+  })
+})
diff --git a/tests/server-actions/config.test.ts b/tests/server-actions/config.test.ts
index cfece9206..44431e22f 100644
--- a/tests/server-actions/config.test.ts
+++ b/tests/server-actions/config.test.ts
@@ -14,6 +14,11 @@ vi.mock("@/app/_server/actions/log", () => ({
   logAudit: (...args: any[]) => mockLogAudit(...args),
 }));
 
+vi.mock("next-intl/server", () => ({
+  getTranslations: async () => (key: string, values?: Record<string, string>) =>
+    values?.field ? `${key}:${values.field}` : key,
+}));
+
 vi.mock("@/app/_server/actions/checklist/queries", () => ({
   getListById: vi.fn().mockResolvedValue(null),
 }));
@@ -213,6 +218,78 @@ describe("Config Actions", () => {
       expect(written.editor.historyEnabled).toBe(true);
       expect(written.editor.enableSlashCommands).toBe(false);
     });
+
+    describe("editor payload shape", () => {
+      beforeEach(() => {
+        mockGetCurrentUser.mockResolvedValue({
+          username: "superadmin",
+          isAdmin: true,
+          isSuperAdmin: true,
+        });
+        mockFs.readFile.mockResolvedValue(
+          JSON.stringify({
+            appName: "Jotty",
+            editor: { historyEnabled: true, enableSlashCommands: false },
+          }),
+        );
+        mockFs.access.mockResolvedValue(undefined);
+        mockFs.writeFile.mockResolvedValue(undefined);
+      });
+
+      const save = (editor?: string) =>
+        updateAppSettings(
+          createFormData(
+            editor === undefined ? { appName: "Jotty" } : { appName: "Jotty", editor },
+          ),
+        );
+
+      const written = () =>
+        JSON.parse(mockFs.writeFile.mock.calls[0][1] as string);
+
+      it("should refuse a null editor flag and name the field", async () => {
+        const result = await save(JSON.stringify({ enableSlashCommands: null }));
+
+        expect(result.success).toBe(false);
+        expect(result.error).toBe("invalidEditorSetting:enableSlashCommands");
+        expect(mockFs.writeFile).not.toHaveBeenCalled();
+      });
+
+      it("should refuse a drawio url that is not a string", async () => {
+        const result = await save(JSON.stringify({ drawioUrl: 42 }));
+
+        expect(result.error).toBe("invalidEditorSetting:drawioUrl");
+        expect(mockFs.writeFile).not.toHaveBeenCalled();
+      });
+
+      it("should refuse an editor payload that is not an object", async () => {
+        const result = await save(JSON.stringify([true]));
+
+        expect(result.error).toBe("invalidEditorSettings");
+        expect(mockFs.writeFile).not.toHaveBeenCalled();
+      });
+
+      it("should merge valid fields and drop unknown ones", async () => {
+        const result = await save(
+          JSON.stringify({ enableBubbleMenu: false, sneaky: "yes" }),
+        );
+
+        expect(result.success).toBe(true);
+        expect(written().editor).toMatchObject({
+          enableBubbleMenu: false,
+          historyEnabled: true,
+          enableSlashCommands: false,
+        });
+        expect(written().editor.sneaky).toBeUndefined();
+      });
+
+      it("should keep stored editor settings when no editor payload is sent", async () => {
+        const result = await save();
+
+        expect(result.success).toBe(true);
+        expect(written().editor.historyEnabled).toBe(true);
+        expect(written().editor.enableSlashCommands).toBe(false);
+      });
+    });
   });
 
   describe("saveCustomCSS", () => {
diff --git a/tests/server-actions/item-lane.test.ts b/tests/server-actions/item-lane.test.ts
new file mode 100644
index 000000000..d67663d18
--- /dev/null
+++ b/tests/server-actions/item-lane.test.ts
@@ -0,0 +1,161 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { resetAllMocks, createFormData } from "../setup";
+
+const mockServerWriteFile = vi.fn();
+const mockServerDeleteFile = vi.fn();
+const mockGetListById = vi.fn();
+const mockGetNoteById = vi.fn();
+
+vi.mock("@/app/_server/actions/file", () => ({
+  ensureDir: vi.fn().mockResolvedValue(undefined),
+  serverWriteFile: (...args: any[]) => mockServerWriteFile(...args),
+  serverDeleteFile: (...args: any[]) => mockServerDeleteFile(...args),
+}));
+
+vi.mock("@/app/_server/actions/checklist/queries", () => ({
+  getListById: (...args: any[]) => mockGetListById(...args),
+}));
+
+vi.mock("@/app/_server/actions/note/queries", () => ({
+  getNoteById: (...args: any[]) => mockGetNoteById(...args),
+}));
+
+vi.mock("@/app/_server/actions/share/queries", () => ({
+  canReach: vi.fn().mockResolvedValue(true),
+}));
+
+vi.mock("@/app/_server/actions/share/target", () => ({
+  targetDir: async (_mode: unknown, owner: string, category: string) => ({
+    dir: `/data/${owner}/${category}`,
+    owner,
+    category,
+    isMount: false,
+    isImplicit: false,
+  }),
+  bouncer: async () => ({ allowed: true }),
+  shownAs: async (_m: unknown, _u: string, _o: string, category: string) =>
+    category,
+  movePlan: async (
+    _mode: unknown,
+    owner: string,
+    item: { category?: string },
+    category: string,
+  ) => ({
+    home: { owner, category: item.category || "" },
+    destination: { owner, category },
+    target: { dir: `/data/${owner}/${category}`, owner, category },
+    isMoving: false,
+  }),
+  refusalMessage: async () => "requiredPermissions",
+}));
+
+vi.mock("@/app/_server/actions/log", () => ({
+  logContentEvent: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/app/_server/actions/history", () => ({
+  commitNote: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/app/_server/actions/relations/tidy", () => ({
+  tidyItemLinks: async (content: string) => content,
+  refreshWikilinks: (content: string) => content,
+}));
+
+vi.mock("@/app/_utils/filename-utils", () => ({
+  generateUniqueFilename: vi.fn().mockResolvedValue("shopping.md"),
+  sanitizeFilename: vi.fn().mockReturnValue("shopping"),
+}));
+
+import { dropList, editList } from "@/app/_server/actions/checklist/editor";
+import { dropNote, editNote } from "@/app/_server/actions/note/editor";
+
+const actor = { username: "testuser", fileRenameMode: "minimal" } as any;
+
+const storedItem = {
+  id: "shopping",
+  uuid: "lane-uuid-1",
+  title: "Shopping",
+  category: "Home",
+  owner: "testuser",
+  content: "Milk",
+  items: [],
+};
+
+describe("item lane: edit and delete on one item", () => {
+  let disk: Map<string, string>;
+
+  const settle = () => new Promise((resolve) => setTimeout(resolve, 5));
+
+  const readItem = async () => {
+    const exists = disk.size > 0;
+    await settle();
+    return exists ? structuredClone(storedItem) : null;
+  };
+
+  beforeEach(() => {
+    resetAllMocks();
+    disk = new Map([["/data/testuser/Home/shopping.md", "stored"]]);
+    mockGetListById.mockImplementation(readItem);
+    mockGetNoteById.mockImplementation(readItem);
+    mockServerWriteFile.mockImplementation(
+      async (filePath: string, content: string) => {
+        await settle();
+        disk.set(filePath, content);
+      },
+    );
+    mockServerDeleteFile.mockImplementation(async () => {
+      await settle();
+      disk.clear();
+    });
+  });
+
+  const listForm = () =>
+    createFormData({ uuid: "lane-uuid-1", title: "Shopping", category: "Home" });
+
+  const noteForm = () =>
+    createFormData({
+      uuid: "lane-uuid-1",
+      title: "Shopping",
+      category: "Home",
+      content: "Milk and eggs",
+    });
+
+  it("should not bring a checklist back when an edit races its delete", async () => {
+    const [edited, dropped] = await Promise.all([
+      editList(actor, listForm()),
+      dropList(actor, listForm()),
+    ]);
+
+    expect(edited.success).toBe(true);
+    expect(dropped.success).toBe(true);
+    expect(disk.size).toBe(0);
+  });
+
+  it("should not recreate a checklist when the delete lands first", async () => {
+    await Promise.all([dropList(actor, listForm()), editList(actor, listForm())]);
+
+    expect(disk.size).toBe(0);
+  });
+
+  it("should not bring a note back when an edit races its delete", async () => {
+    const [edited, dropped] = await Promise.all([
+      editNote(actor, noteForm()),
+      dropNote(actor, noteForm()),
+    ]);
+
+    expect(edited.success).toBe(true);
+    expect(dropped.success).toBe(true);
+    expect(disk.size).toBe(0);
+  });
+
+  it("should not recreate a note when the delete lands first", async () => {
+    await Promise.all([dropNote(actor, noteForm()), editNote(actor, noteForm())]);
+
+    expect(disk.size).toBe(0);
+  });
+});
diff --git a/tests/server-actions/read-only-mount.test.ts b/tests/server-actions/read-only-mount.test.ts
index a3e67be2c..d18a94778 100644
--- a/tests/server-actions/read-only-mount.test.ts
+++ b/tests/server-actions/read-only-mount.test.ts
@@ -120,6 +120,29 @@ describe.skipIf(IS_ROOT)("Read-only mounted category (#580)", () => {
     });
   });
 
+  it("finds an unstamped item whose body has a uuid line", async () => {
+    unlock();
+    writeFileSync(NOTE_PATH, "# Old note\n\nuuid: example\n");
+    lock();
+
+    const found = await grepFindFileByUuid(USER_DIR, pathUuid(NOTE_PATH));
+
+    expect(found?.filePath).toBe(NOTE_PATH);
+  });
+
+  it("does not match a derived uuid when the frontmatter stores one", async () => {
+    unlock();
+    writeFileSync(
+      NOTE_PATH,
+      "---\nuuid: 22222222-2222-4222-8222-222222222222\n---\n# Old note\n",
+    );
+    lock();
+
+    const found = await grepFindFileByUuid(USER_DIR, pathUuid(NOTE_PATH));
+
+    expect(found).toBeNull();
+  });
+
   it("does not scan for derived uuids when the uuid is a random one", async () => {
     const found = await grepFindFileByUuid(
       USER_DIR,
diff --git a/tests/server-actions/share-visibility.test.ts b/tests/server-actions/share-visibility.test.ts
index dcccf3156..cb7fd0bd2 100644
--- a/tests/server-actions/share-visibility.test.ts
+++ b/tests/server-actions/share-visibility.test.ts
@@ -143,7 +143,10 @@ describe("Share visibility on disk", () => {
       [LIST_READ]: READ_ONLY,
     });
     expect(categories.data?.[0]).toEqual(
-      expect.objectContaining({ isLoose: true, permissions: READ_ONLY }),
+      expect.objectContaining({
+        isLoose: true,
+        permissions: { ...READ_ONLY, canCreate: false },
+      }),
     );
   });
 
diff --git a/tests/utils/markdown-roundtrip.test.ts b/tests/utils/markdown-roundtrip.test.ts
index 04e7fd3e1..e2fd1be74 100644
--- a/tests/utils/markdown-roundtrip.test.ts
+++ b/tests/utils/markdown-roundtrip.test.ts
@@ -9,6 +9,7 @@ import {
   convertHtmlToMarkdown,
   convertMarkdownToHtml,
   sanitizeMarkdown,
+  tagOutsideCode,
 } from "@/app/_utils/markdown-utils";
 
 const ZWSP = "​";
@@ -37,6 +38,14 @@ const decodeEntities = (html: string) =>
 describe("markdown round trip", () => {
   const markdown = `Before\n\n\`\`\`bash\n${BASH_SNIPPET}\n\`\`\`\n\nAfter #tagged\n`;
 
+  it("tags hashtags without touching the bash block for the view renderer", () => {
+    const tagged = tagOutsideCode(markdown);
+
+    expect(tagged).toBe(
+      `Before\n\n\`\`\`bash\n${BASH_SNIPPET}\n\`\`\`\n\nAfter <span data-tag="tagged">tagged</span>\n`,
+    );
+  });
+
   it("keeps a bash code block with $' intact when rendering to html", () => {
     const html = convertMarkdownToHtml(markdown);
     const code = html.match(/<code[^>]*>([\s\S]*?)<\/code>/)?.[1] ?? "";

From 09058a25917686f71b40098289776ef0e77aabcb Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 21:07:59 +0100
Subject: [PATCH 12/28] one last fix

---
 app/_server/actions/checklist-item/grafter.ts |  3 +-
 app/_server/actions/checklist/restatus.ts     |  6 +-
 app/_server/actions/kanban/tweaker.ts         | 56 ++++++++++---------
 3 files changed, 38 insertions(+), 27 deletions(-)

diff --git a/app/_server/actions/checklist-item/grafter.ts b/app/_server/actions/checklist-item/grafter.ts
index 48049b622..d9bbc5443 100644
--- a/app/_server/actions/checklist-item/grafter.ts
+++ b/app/_server/actions/checklist-item/grafter.ts
@@ -1,4 +1,5 @@
 import { revalidatePath } from "next/cache";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 import path from "path";
 import {
   serverWriteFile,
@@ -141,7 +142,7 @@ const _graftItem = async (
     return { success: true, data: updatedList };
   } catch (error) {
     console.error("Error creating sub-item:", error);
-    return { success: false, error: "Failed to create sub-item" };
+    return { success: false, error: await failedWith(error, "Failed to create sub-item") };
   }
 };
 
diff --git a/app/_server/actions/checklist/restatus.ts b/app/_server/actions/checklist/restatus.ts
index bf57e493e..49773392b 100644
--- a/app/_server/actions/checklist/restatus.ts
+++ b/app/_server/actions/checklist/restatus.ts
@@ -1,4 +1,5 @@
 import { revalidatePath } from "next/cache";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 import { Checklist, Item, Result, KanbanStatus, SanitisedUser } from "@/app/_types";
 import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
 import { DEFAULT_KANBAN_STATUSES } from "@/app/_consts/kanban";
@@ -106,7 +107,10 @@ const _restatus = async (
     return { success: true, data: updatedList };
   } catch (error) {
     console.error("Error updating checklist statuses:", error);
-    return { success: false, error: "Failed to update checklist statuses" };
+    return {
+      success: false,
+      error: await failedWith(error, "Failed to update checklist statuses"),
+    };
   }
 };
 
diff --git a/app/_server/actions/kanban/tweaker.ts b/app/_server/actions/kanban/tweaker.ts
index fab930270..e3d60172d 100644
--- a/app/_server/actions/kanban/tweaker.ts
+++ b/app/_server/actions/kanban/tweaker.ts
@@ -14,6 +14,7 @@ import { getListById } from "@/app/_server/actions/checklist/queries";
 import { notifyUser } from "@/app/_server/actions/notifications/internal";
 import { findItem, updateItem } from "@/app/_utils/item-tree-utils";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 
 const _tweakItem = async (
   actor: SanitisedUser,
@@ -32,34 +33,39 @@ const _tweakItem = async (
   const list = await getListById(uuid, username);
   if (!list) return { success: false, error: "List not found" };
 
-  const now = new Date().toISOString();
-  const updatedList: Checklist = {
-    ...list,
-    items: updateItem(list.items, itemId, (item) => ({
-      ...item,
-      ...patch,
-      lastModifiedBy: username,
-      lastModifiedAt: now,
-    })),
-    updatedAt: now,
-  };
-
-  await serverWriteFile(filePath, listToMarkdown(updatedList));
-
-  await broadcast({
-    type: "checklist",
-    action: "updated",
-    entityId: updatedList.uuid,
-    username,
-  });
-
   try {
-    revalidatePath("/");
+    const now = new Date().toISOString();
+    const updatedList: Checklist = {
+      ...list,
+      items: updateItem(list.items, itemId, (item) => ({
+        ...item,
+        ...patch,
+        lastModifiedBy: username,
+        lastModifiedAt: now,
+      })),
+      updatedAt: now,
+    };
+
+    await serverWriteFile(filePath, listToMarkdown(updatedList));
+
+    await broadcast({
+      type: "checklist",
+      action: "updated",
+      entityId: updatedList.uuid,
+      username,
+    });
+
+    try {
+      revalidatePath("/");
+    } catch (error) {
+      console.warn("Cache revalidation failed, but data was saved successfully:", error);
+    }
+
+    return { success: true, data: updatedList };
   } catch (error) {
-    console.warn("Cache revalidation failed, but data was saved successfully:", error);
+    console.error("Error updating item:", error);
+    return { success: false, error: await failedWith(error, "Failed to update item") };
   }
-
-  return { success: true, data: updatedList };
 };
 
 export const tweakItem = async (

From 8f7354ed3861bb3030fb21ed7fe7aa0de37e343b Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 22:17:19 +0100
Subject: [PATCH 13/28] almost good to go!!

---
 AGENTS.md                                     | 12 ++-
 .../Notes/Parts/DrawioRenderer.tsx            |  6 +-
 .../Notes/Parts/ExcalidrawRenderer.tsx        |  8 +-
 .../Notes/Parts/MermaidRenderer.tsx           |  2 +-
 .../Notes/Parts/SvgFrame.tsx                  | 38 ++++++++
 .../CustomExtensions/DrawioExtension.tsx      |  6 +-
 .../CustomExtensions/ExcalidrawExtension.tsx  |  6 +-
 .../CustomExtensions/MermaidExtension.tsx     |  2 +-
 .../CustomExtensions/OverlayExtension.tsx     |  6 +-
 .../Notes/Parts/UnifiedMarkdownRenderer.tsx   |  2 +
 app/_consts/notes.ts                          | 14 +++
 app/_server/actions/checklist-item/reorder.ts |  2 -
 app/_server/actions/checklist/editor.ts       | 11 ++-
 app/_server/actions/checklist/readers.ts      | 25 +++--
 app/_server/actions/checklist/viewer.ts       |  3 +-
 app/_server/actions/lib/read-only-message.ts  |  8 +-
 app/_server/actions/note/editor.ts            | 11 ++-
 app/_server/actions/note/readers.ts           | 25 +++--
 app/_server/actions/note/viewer.ts            |  3 +-
 app/_server/actions/relations/indexer.ts      |  2 +-
 app/_server/actions/reminders/scanner.ts      | 13 ++-
 app/_server/actions/tags/index.ts             |  8 ++
 app/_utils/api-utils.ts                       | 27 +++++-
 app/_utils/grep-utils.ts                      | 75 +++++++++------
 app/_utils/shell-utils.ts                     | 29 ++++++
 app/api/exports/[filename]/route.ts           | 30 ++++++
 app/api/exports/route.ts                      | 18 +---
 tests/api/setup.ts                            |  3 +
 tests/security/export-download.test.ts        | 93 +++++++++++++++++++
 tests/security/note-xss.test.tsx              | 68 ++++++++++++++
 tests/security/read-by-uuid.test.ts           | 17 +++-
 tests/security/share-grants.test.ts           |  2 +-
 tests/security/shell-injection.test.ts        | 65 +++++++++++++
 tests/server-actions/note-readers.test.ts     |  7 +-
 tests/server-actions/tags.test.ts             | 17 ++++
 35 files changed, 559 insertions(+), 105 deletions(-)
 create mode 100644 app/_components/FeatureComponents/Notes/Parts/SvgFrame.tsx
 create mode 100644 app/_utils/shell-utils.ts
 create mode 100644 tests/security/export-download.test.ts
 create mode 100644 tests/security/note-xss.test.tsx
 create mode 100644 tests/security/shell-injection.test.ts

diff --git a/AGENTS.md b/AGENTS.md
index 74623e6cd..3b461ee16 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -92,4 +92,14 @@ Same words for the same things, please.
 
 Smallest thing that proves the change works. Type check, lint what you touched, run the tests covering the area, and the whole suite if you changed something shared.
 
-The security tests cover auth, path containment and data leakage. If your change makes one fail, the change is wrong until proven otherwise. If you changed behaviour the tests cover, update them and tell me you did.
\ No newline at end of file
+The security tests cover auth, path containment and data leakage. If your change makes one fail, the change is wrong until proven otherwise. If you changed behaviour the tests cover, update them and tell me you did.
+
+<!-- BEGIN:nextjs-agent-rules -->
+
+# This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->
diff --git a/app/_components/FeatureComponents/Notes/Parts/DrawioRenderer.tsx b/app/_components/FeatureComponents/Notes/Parts/DrawioRenderer.tsx
index 357c27623..7d6f4f718 100644
--- a/app/_components/FeatureComponents/Notes/Parts/DrawioRenderer.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/DrawioRenderer.tsx
@@ -3,6 +3,7 @@
 import { useState } from "react";
 import { Sun03Icon, GibbousMoonIcon } from "hugeicons-react";
 import { useTranslations } from "next-intl";
+import { SvgFrame } from "@/app/_components/FeatureComponents/Notes/Parts/SvgFrame";
 
 interface DrawioRendererProps {
   svgData: string;
@@ -57,8 +58,9 @@ export const DrawioRenderer = ({
               ? "invert(0.92) contrast(0.85) brightness(1.1) saturate(1.2)"
               : "none",
         }}
-        dangerouslySetInnerHTML={{ __html: svgData }}
-      />
+      >
+        <SvgFrame svg={svgData} alt={t("editor.drawioDiagram")} />
+      </div>
     </div>
   );
 };
diff --git a/app/_components/FeatureComponents/Notes/Parts/ExcalidrawRenderer.tsx b/app/_components/FeatureComponents/Notes/Parts/ExcalidrawRenderer.tsx
index a9bacf50b..b1bd90877 100644
--- a/app/_components/FeatureComponents/Notes/Parts/ExcalidrawRenderer.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/ExcalidrawRenderer.tsx
@@ -2,6 +2,8 @@
 
 import { useState } from "react";
 import { Sun03Icon, GibbousMoonIcon } from "hugeicons-react";
+import { useTranslations } from "next-intl";
+import { SvgFrame } from "@/app/_components/FeatureComponents/Notes/Parts/SvgFrame";
 
 interface ExcalidrawRendererProps {
   svgData: string;
@@ -15,6 +17,7 @@ export const ExcalidrawRenderer = ({
   className = "",
 }: ExcalidrawRendererProps) => {
   const [themeMode, setThemeMode] = useState(initialTheme);
+  const t = useTranslations();
 
   if (!svgData) {
     return null;
@@ -47,8 +50,9 @@ export const ExcalidrawRenderer = ({
               ? "invert(0.92) contrast(0.85) brightness(1.1) saturate(1.2)"
               : "none",
         }}
-        dangerouslySetInnerHTML={{ __html: svgData }}
-      />
+      >
+        <SvgFrame svg={svgData} alt={t("editor.excalidrawDiagram")} />
+      </div>
     </div>
   );
 };
diff --git a/app/_components/FeatureComponents/Notes/Parts/MermaidRenderer.tsx b/app/_components/FeatureComponents/Notes/Parts/MermaidRenderer.tsx
index 1ee2c7fcb..72602698c 100644
--- a/app/_components/FeatureComponents/Notes/Parts/MermaidRenderer.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/MermaidRenderer.tsx
@@ -25,7 +25,7 @@ const initializeMermaidTheme = (forceLight = false) => {
   mermaid.initialize({
     startOnLoad: false,
     theme: "base",
-    securityLevel: "loose",
+    securityLevel: "strict",
     themeVariables: {
       primaryColor:
         _getCSSVariable("--primary", forceLight) || "rgb(139, 59, 208)",
diff --git a/app/_components/FeatureComponents/Notes/Parts/SvgFrame.tsx b/app/_components/FeatureComponents/Notes/Parts/SvgFrame.tsx
new file mode 100644
index 000000000..68cabbe62
--- /dev/null
+++ b/app/_components/FeatureComponents/Notes/Parts/SvgFrame.tsx
@@ -0,0 +1,38 @@
+"use client";
+
+import { useMemo } from "react";
+import { SVG_FRAME_ATTR } from "@/app/_consts/notes";
+
+const SVG_DATA_PREFIX = "data:image/svg+xml;charset=utf-8,";
+const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+const SVG_DATA_URI = /^data:image\/svg\+xml[;,]/i;
+const SVG_WITHOUT_NS = /<svg\b(?![^>]*\sxmlns=)/i;
+
+const toSvgSrc = (svg: string): string => {
+  const trimmed = svg.trim();
+  if (SVG_DATA_URI.test(trimmed)) return trimmed;
+
+  const namespaced = trimmed.replace(
+    SVG_WITHOUT_NS,
+    `<svg xmlns="${SVG_NAMESPACE}"`,
+  );
+  return `${SVG_DATA_PREFIX}${encodeURIComponent(namespaced)}`;
+};
+
+interface SvgFrameProps {
+  svg: string;
+  alt: string;
+}
+
+export const SvgFrame = ({ svg, alt }: SvgFrameProps) => {
+  const src = useMemo(() => toSvgSrc(svg), [svg]);
+
+  return (
+    <img
+      src={src}
+      alt={alt}
+      className="max-w-full h-auto my-0"
+      {...{ [SVG_FRAME_ATTR]: "" }}
+    />
+  );
+};
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/DrawioExtension.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/DrawioExtension.tsx
index 2ad114968..98d985616 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/DrawioExtension.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/DrawioExtension.tsx
@@ -9,6 +9,7 @@ import { useTranslations } from "next-intl";
 import { ConfirmModal } from "@/app/_components/GlobalComponents/Modals/ConfirmationModals/ConfirmModal";
 import { Modal } from "@/app/_components/GlobalComponents/Modals/Modal";
 import { base64ToText } from "@/app/_utils/base64-utils";
+import { SvgFrame } from "@/app/_components/FeatureComponents/Notes/Parts/SvgFrame";
 
 export const DrawioNodeView = ({
   node,
@@ -198,8 +199,9 @@ export const DrawioNodeView = ({
                     ? "invert(0.92) contrast(0.85) brightness(1.1) saturate(1.2)"
                     : "none",
               }}
-              dangerouslySetInnerHTML={{ __html: node.attrs.svgData }}
-            />
+            >
+              <SvgFrame svg={node.attrs.svgData} alt={t("editor.drawioDiagram")} />
+            </div>
           </>
         ) : (
           <div className="text-center py-12">
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/ExcalidrawExtension.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/ExcalidrawExtension.tsx
index 423b54985..5c939aff4 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/ExcalidrawExtension.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/ExcalidrawExtension.tsx
@@ -11,6 +11,7 @@ import { useRouter } from "next/navigation";
 import { ConfirmModal } from "@/app/_components/GlobalComponents/Modals/ConfirmationModals/ConfirmModal";
 import { Modal } from "@/app/_components/GlobalComponents/Modals/Modal";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
+import { SvgFrame } from "@/app/_components/FeatureComponents/Notes/Parts/SvgFrame";
 
 const Excalidraw = dynamic(
   async () => (await import("@excalidraw/excalidraw")).Excalidraw,
@@ -194,8 +195,9 @@ export const ExcalidrawNodeView = ({
                     ? "invert(0.92) contrast(0.85) brightness(1.1) saturate(1.2)"
                     : "none",
               }}
-              dangerouslySetInnerHTML={{ __html: node.attrs.svgData || "" }}
-            />
+            >
+              <SvgFrame svg={node.attrs.svgData || ""} alt={t("editor.excalidrawDiagram")} />
+            </div>
           </>
         ) : (
           <div className="text-center py-12">
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/MermaidExtension.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/MermaidExtension.tsx
index b3aed5d23..238cecacd 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/MermaidExtension.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/MermaidExtension.tsx
@@ -25,7 +25,7 @@ const initializeMermaidTheme = () => {
   mermaid.initialize({
     startOnLoad: false,
     theme: "base",
-    securityLevel: "loose",
+    securityLevel: "strict",
     themeVariables: {
       primaryColor: getCSSVariable("--primary") || "rgb(139, 59, 208)",
       primaryTextColor:
diff --git a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/OverlayExtension.tsx b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/OverlayExtension.tsx
index 65e72b346..b75fbe10e 100644
--- a/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/OverlayExtension.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/TipTap/CustomExtensions/OverlayExtension.tsx
@@ -1,5 +1,6 @@
 import { Extension } from "@tiptap/core";
 import { Plugin, PluginKey } from "@tiptap/pm/state";
+import { SVG_FRAME_ATTR } from "@/app/_consts/notes";
 
 export interface OverlayPosition {
   x: number;
@@ -31,7 +32,10 @@ export const OverlayExtension = Extension.create<OverlayExtensionOptions>({
             click: (view, event) => {
               const target = event.target as HTMLElement;
 
-              if (target.tagName === "IMG") {
+              const isResizable =
+                target.tagName === "IMG" && !target.hasAttribute(SVG_FRAME_ATTR);
+
+              if (isResizable) {
                 const rect = target.getBoundingClientRect();
                 this.options.onImageClick?.({
                   x: rect.left + rect.width / 2,
diff --git a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
index 5234f3b54..2e5c9587d 100644
--- a/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
+++ b/app/_components/FeatureComponents/Notes/Parts/UnifiedMarkdownRenderer.tsx
@@ -33,6 +33,7 @@ import { matchCallout } from "@/app/_utils/callout-utils";
 import { CalloutType } from "@/app/_consts/callouts";
 import { base64ToSvg, base64ToText } from "@/app/_utils/base64-utils";
 import { noteUrlTransform } from "@/app/_utils/url-transform-utils";
+import { BOUNCED_ELEMENTS } from "@/app/_consts/notes";
 import { tagOutsideCode } from "@/app/_utils/markdown-utils";
 
 type WikiLinkComponents = Record<
@@ -569,6 +570,7 @@ export const UnifiedMarkdownRenderer = ({
           rehypePlugins={[rehypeSlug, rehypeRaw]}
           components={components}
           urlTransform={noteUrlTransform}
+          disallowedElements={BOUNCED_ELEMENTS}
         >
           {processedContent}
         </ReactMarkdown>
diff --git a/app/_consts/notes.ts b/app/_consts/notes.ts
index 542dadd49..05d93e5af 100644
--- a/app/_consts/notes.ts
+++ b/app/_consts/notes.ts
@@ -90,3 +90,17 @@ export const QUOTES = [
   "There's nobody here but us chickens!",
   "Gee Brain, what are we gonna do tonight?",
 ];
+
+export const BOUNCED_ELEMENTS = [
+  "iframe",
+  "frame",
+  "frameset",
+  "object",
+  "embed",
+  "script",
+  "base",
+  "meta",
+  "link",
+];
+
+export const SVG_FRAME_ATTR = "data-svg-frame";
diff --git a/app/_server/actions/checklist-item/reorder.ts b/app/_server/actions/checklist-item/reorder.ts
index 55e90beca..449ecf58d 100644
--- a/app/_server/actions/checklist-item/reorder.ts
+++ b/app/_server/actions/checklist-item/reorder.ts
@@ -161,8 +161,6 @@ const _reorderItems = async (formData: FormData) => {
 
     await broadcast({ type: "checklist", action: "updated", entityId: list.uuid, username: currentUser });
 
-    await new Promise((resolve) => setTimeout(resolve, 100));
-
     return { success: true };
   } catch (error) {
     console.error("Error reordering items:", error);
diff --git a/app/_server/actions/checklist/editor.ts b/app/_server/actions/checklist/editor.ts
index 383f7ad6e..057ec4ed8 100644
--- a/app/_server/actions/checklist/editor.ts
+++ b/app/_server/actions/checklist/editor.ts
@@ -23,7 +23,11 @@ import {
 import { logContentEvent } from "@/app/_server/actions/log";
 import { getListById } from "./queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import {
+  failedWith,
+  readOnlyNotice,
+} from "@/app/_server/actions/lib/read-only-message";
+import { isWritable } from "@/app/_server/actions/lib/read-only";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
 const _listDirFor = (owner: string, category?: string): string =>
@@ -145,6 +149,11 @@ const _editList = async (actingUser: SanitisedUser, formData: FormData) => {
         ? path.join(sourceDir, `${currentId}.md`)
         : null;
 
+    const leavesSource = oldFilePath !== null && oldFilePath !== filePath;
+    if (leavesSource && !(await isWritable(sourceDir))) {
+      return { error: await readOnlyNotice() };
+    }
+
     await serverWriteFile(filePath, listToMarkdown(updatedList));
 
     if (oldFilePath && oldFilePath !== filePath) {
diff --git a/app/_server/actions/checklist/readers.ts b/app/_server/actions/checklist/readers.ts
index b51b96afe..e556031cc 100644
--- a/app/_server/actions/checklist/readers.ts
+++ b/app/_server/actions/checklist/readers.ts
@@ -2,8 +2,7 @@
 
 import path from "path";
 import fs from "fs/promises";
-import { promisify } from "util";
-import { exec } from "child_process";
+import { boxedShell } from "@/app/_utils/shell-utils";
 import { Checklist } from "@/app/_types";
 import { ARCHIVED_DIR_NAME, EXCLUDED_DIRS } from "@/app/_consts/files";
 import {
@@ -29,8 +28,6 @@ import { isKanbanType } from "@/app/_types/enums";
 import { lacksUuid, stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
-const execAsync = promisify(exec);
-
 const debugCrud = isDebugFlag("crud");
 
 export type ChecklistReadResult =
@@ -55,17 +52,17 @@ export const readListsRecursively = async (
       const excludeStr = allowArchived
         ? ""
         : `-not -path "*/${ARCHIVED_DIR_NAME}/*"`;
-      const statsCmd = `find "${dir}" -name "*.md" ${excludeStr} -printf "%p|%W@|%T@\\n"`;
-      const metaCmd = `grep -rE "^(title|uuid|tags|checklistType|createdAt|${SHARED_WITH_KEY}):|^[[:space:]]+- |^---$" "${dir}"`;
+      const statsCmd = `find "$1" -name "*.md" ${excludeStr} -printf "%p|%W@|%T@\\n"`;
+      const metaCmd = `grep -rE "^(title|uuid|tags|checklistType|createdAt|${SHARED_WITH_KEY}):|^[[:space:]]+- |^---$" "$1"`;
       const [statsOut, metaOut] = await Promise.all([
-        execAsync(statsCmd, { maxBuffer: 10 * 1024 * 1024 }).catch(() => ({
-          stdout: "",
-        })),
-        execAsync(metaCmd, { maxBuffer: 10 * 1024 * 1024 }).catch(() => ({
-          stdout: "",
-        })),
+        boxedShell(statsCmd, [dir], { maxBuffer: 10 * 1024 * 1024 }).catch(
+          () => "",
+        ),
+        boxedShell(metaCmd, [dir], { maxBuffer: 10 * 1024 * 1024 }).catch(
+          () => "",
+        ),
       ]);
-      statsOut.stdout.split("\n").forEach((line) => {
+      statsOut.split("\n").forEach((line) => {
         const [p, b, m] = line.split("|");
         if (p && b && m)
           statsCache!.set(p, {
@@ -73,7 +70,7 @@ export const readListsRecursively = async (
             mtime: new Date(parseFloat(m) * 1000),
           });
       });
-      const metaLines = metaOut.stdout.split("\n").filter(Boolean);
+      const metaLines = metaOut.split("\n").filter(Boolean);
       if (debugCrud && metaLines.length) {
         console.warn(
           "[tags grep] sample (first 40 lines):",
diff --git a/app/_server/actions/checklist/viewer.ts b/app/_server/actions/checklist/viewer.ts
index cba1b807f..83e651433 100644
--- a/app/_server/actions/checklist/viewer.ts
+++ b/app/_server/actions/checklist/viewer.ts
@@ -2,6 +2,7 @@
 
 import { Checklist } from "@/app/_types";
 import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
+import { isUuid } from "@/app/_consts/identity";
 import { sessionActor } from "@/app/_server/actions/lib/actor";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { getListById, getUserChecklists } from "./queries";
@@ -9,7 +10,7 @@ import { getListById, getUserChecklists } from "./queries";
 export const viewList = async (
   uuid: string,
 ): Promise<Checklist | undefined> => {
-  if (!uuid) return undefined;
+  if (!isUuid(uuid)) return undefined;
 
   const actor = await sessionActor();
   if ("error" in actor) return undefined;
diff --git a/app/_server/actions/lib/read-only-message.ts b/app/_server/actions/lib/read-only-message.ts
index c52656a34..db83a6f28 100644
--- a/app/_server/actions/lib/read-only-message.ts
+++ b/app/_server/actions/lib/read-only-message.ts
@@ -1,12 +1,16 @@
 import { getTranslations } from "next-intl/server";
 import { isReadOnlyError } from "@/app/_server/actions/lib/read-only";
 
+export const readOnlyNotice = async (): Promise<string> => {
+  const t = await getTranslations("errors");
+  return t("readOnlyFolder");
+};
+
 export const failedWith = async (
   error: unknown,
   fallback: string,
 ): Promise<string> => {
   if (!isReadOnlyError(error)) return fallback;
 
-  const t = await getTranslations("errors");
-  return t("readOnlyFolder");
+  return readOnlyNotice();
 };
diff --git a/app/_server/actions/note/editor.ts b/app/_server/actions/note/editor.ts
index 627c9ec9f..efa48fb22 100644
--- a/app/_server/actions/note/editor.ts
+++ b/app/_server/actions/note/editor.ts
@@ -39,7 +39,11 @@ import {
   refusalMessage,
 } from "@/app/_server/actions/share/target";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import {
+  failedWith,
+  readOnlyNotice,
+} from "@/app/_server/actions/lib/read-only-message";
+import { isWritable } from "@/app/_server/actions/lib/read-only";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
 const _noteDirFor = (owner: string, category?: string): string =>
@@ -180,6 +184,11 @@ const _editNote = async (
         ? path.join(sourceDir, `${currentId}.md`)
         : null;
 
+    const leavesSource = oldFilePath !== null && oldFilePath !== filePath;
+    if (leavesSource && !(await isWritable(sourceDir))) {
+      return { error: await readOnlyNotice() };
+    }
+
     await serverWriteFile(filePath, noteToMarkdown(updatedDoc));
 
     if (!autosaveNotes && !updatedDoc.encrypted) {
diff --git a/app/_server/actions/note/readers.ts b/app/_server/actions/note/readers.ts
index 81773d7c1..5a6cb560e 100644
--- a/app/_server/actions/note/readers.ts
+++ b/app/_server/actions/note/readers.ts
@@ -23,13 +23,10 @@ import { dirUuids } from "@/app/_server/actions/share/category-info";
 import { orderByUuids } from "@/app/_utils/order-utils";
 import { parseMarkdownNote } from "./parsers";
 import { Note } from "@/app/_types";
-import { promisify } from "util";
-import { exec } from "child_process";
+import { boxedShell } from "@/app/_utils/shell-utils";
 import { lacksUuid, stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
-const execAsync = promisify(exec);
-
 export const readNotesRecursively = async (
   dir: string,
   basePath: string = "",
@@ -49,18 +46,18 @@ export const readNotesRecursively = async (
       const excludeStr = allowArchived
         ? ""
         : `-not -path "*/${ARCHIVED_DIR_NAME}/*"`;
-      const statsCmd = `find "${dir}" -name "*.md" ${excludeStr} -printf "%p|%W@|%T@\\n"`;
-      const metaCmd = `grep -rE "^(title|uuid|tags|encrypted|createdAt|${SHARED_WITH_KEY}):|^[[:space:]]+- |^---$" "${dir}"`;
+      const statsCmd = `find "$1" -name "*.md" ${excludeStr} -printf "%p|%W@|%T@\\n"`;
+      const metaCmd = `grep -rE "^(title|uuid|tags|encrypted|createdAt|${SHARED_WITH_KEY}):|^[[:space:]]+- |^---$" "$1"`;
       const [statsOut, metaOut] = await Promise.all([
-        execAsync(statsCmd, { maxBuffer: 10 * 1024 * 1024 }).catch(() => ({
-          stdout: "",
-        })),
-        execAsync(metaCmd, { maxBuffer: 10 * 1024 * 1024 }).catch(() => ({
-          stdout: "",
-        })),
+        boxedShell(statsCmd, [dir], { maxBuffer: 10 * 1024 * 1024 }).catch(
+          () => "",
+        ),
+        boxedShell(metaCmd, [dir], { maxBuffer: 10 * 1024 * 1024 }).catch(
+          () => "",
+        ),
       ]);
 
-      statsOut.stdout.split("\n").forEach((line) => {
+      statsOut.split("\n").forEach((line) => {
         const [p, b, m] = line.split("|");
         if (p && b && m)
           statsCache!.set(p, {
@@ -73,7 +70,7 @@ export const readNotesRecursively = async (
 
       let listFile = "";
       let listKey = "";
-      for (const line of metaOut.stdout.split("\n")) {
+      for (const line of metaOut.split("\n")) {
         if (!line) continue;
         const colonIdx = line.indexOf(":");
         if (colonIdx === -1) continue;
diff --git a/app/_server/actions/note/viewer.ts b/app/_server/actions/note/viewer.ts
index ad5f863d9..9758e5d44 100644
--- a/app/_server/actions/note/viewer.ts
+++ b/app/_server/actions/note/viewer.ts
@@ -2,12 +2,13 @@
 
 import { Note } from "@/app/_types";
 import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
+import { isUuid } from "@/app/_consts/identity";
 import { sessionActor } from "@/app/_server/actions/lib/actor";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { getNoteById, getUserNotes } from "./queries";
 
 export const viewNote = async (uuid: string): Promise<Note | undefined> => {
-  if (!uuid) return undefined;
+  if (!isUuid(uuid)) return undefined;
 
   const actor = await sessionActor();
   if ("error" in actor) return undefined;
diff --git a/app/_server/actions/relations/indexer.ts b/app/_server/actions/relations/indexer.ts
index 3be773ea7..c6c788ee7 100644
--- a/app/_server/actions/relations/indexer.ts
+++ b/app/_server/actions/relations/indexer.ts
@@ -223,7 +223,7 @@ export const forgetItemFile = (filePath: string) =>
 
 export const forgetItemTree = (dir: string) => {
   const prefix = _prefixOf(dir);
-  _forgetWhere("substr(path, 1, length(?1)) = ?1", prefix);
+  _forgetWhere("instr(path, ?) = 1", prefix);
 };
 
 const _indexFromDisk = async (filePath: string, mtime?: number) => {
diff --git a/app/_server/actions/reminders/scanner.ts b/app/_server/actions/reminders/scanner.ts
index 920b5be4f..28dedc3a6 100644
--- a/app/_server/actions/reminders/scanner.ts
+++ b/app/_server/actions/reminders/scanner.ts
@@ -2,8 +2,6 @@
 
 import path from "path";
 import fs from "fs/promises";
-import { exec } from "child_process";
-import { promisify } from "util";
 import { Item } from "@/app/_types";
 import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
 import { ChecklistsTypes, Modes, NotificationTargets } from "@/app/_types/enums";
@@ -16,18 +14,19 @@ import { usersWithAccess } from "@/app/_server/actions/share/queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 import { grepExtractField } from "@/app/_utils/grep-utils";
-
-const _execAsync = promisify(exec);
+import { boxedShell } from "@/app/_utils/shell-utils";
 
 let _isRunning = false;
 
 const _findFilesWithReminders = async (rootDir: string): Promise<string[]> => {
   try {
-    const { stdout } = await _execAsync(
-      `grep -rl "reminder:" "${rootDir}" --include="*.md" 2>/dev/null || true`,
+    const stdout = await boxedShell(
+      'grep -rl --include="*.md" -e "reminder:" -- "$1" 2>/dev/null || true',
+      [rootDir],
     );
     return stdout.trim().split("\n").filter(Boolean);
-  } catch {
+  } catch (error) {
+    console.error("Failed to scan for reminders:", error);
     return [];
   }
 };
diff --git a/app/_server/actions/tags/index.ts b/app/_server/actions/tags/index.ts
index 35e719d5b..c224aa10b 100644
--- a/app/_server/actions/tags/index.ts
+++ b/app/_server/actions/tags/index.ts
@@ -11,6 +11,7 @@ import {
   updateYamlMetadata,
 } from "@/app/_utils/yaml-metadata-utils";
 import { Modes } from "@/app/_types/enums";
+import { canAccessAllContent } from "@/app/_server/actions/users";
 
 const findMarkdownFiles = async (dirPath: string): Promise<string[]> => {
   const markdownFiles: string[] = [];
@@ -96,6 +97,13 @@ export const updateTagsFromContent = async (): Promise<
     changes: string[];
   }>
 > => {
+  if (!(await canAccessAllContent())) {
+    return {
+      success: false,
+      error: "Forbidden: Admin access with content permissions required",
+    };
+  }
+
   try {
     const changes: string[] = [];
 
diff --git a/app/_utils/api-utils.ts b/app/_utils/api-utils.ts
index 59b3d00d1..7fade579c 100644
--- a/app/_utils/api-utils.ts
+++ b/app/_utils/api-utils.ts
@@ -1,8 +1,15 @@
 import { NextRequest, NextResponse } from "next/server";
 import { authenticateApiKey } from "@/app/_server/actions/api";
+import { getAppSettings } from "@/app/_server/actions/config";
+import { getCurrentUser } from "@/app/_server/actions/users";
 import { resolveApiId } from "@/app/_server/actions/lib/legacy-lookup";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import { User } from "@/app/_types";
+
+export type ApiCaller = Pick<User, "username" | "isAdmin" | "isSuperAdmin">;
+
+export const API_KEY_HEADER = "x-api-key";
 
 /**
  * @deprecated Legacy category+id fallback for checklist-family API routes
@@ -27,7 +34,7 @@ export const withApiAuth = async (
   handler: (user: any, request: NextRequest) => Promise<NextResponse>
 ) => {
   try {
-    const apiKey = request.headers.get("x-api-key");
+    const apiKey = request.headers.get(API_KEY_HEADER);
     const user = await authenticateApiKey(apiKey || "");
 
     if (!user) {
@@ -53,3 +60,21 @@ export const turnAway = async (
   (await canReach(uuid, ItemTypes.CHECKLIST, username, permission))
     ? null
     : NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+export const whoGoesThere = async (
+  request: NextRequest,
+): Promise<ApiCaller | null> =>
+  (await getCurrentUser()) ??
+  (await authenticateApiKey(request.headers.get(API_KEY_HEADER) || ""));
+
+export const seesAllContent = async (user: ApiCaller): Promise<boolean> => {
+  if (user.isSuperAdmin) return true;
+  if (!user.isAdmin) return false;
+
+  const settingsResult = await getAppSettings();
+  if (!settingsResult.success || !settingsResult.data) {
+    return true;
+  }
+
+  return settingsResult.data.adminContentAccess !== "no";
+};
diff --git a/app/_utils/grep-utils.ts b/app/_utils/grep-utils.ts
index 57540bffc..a4c61b0f5 100644
--- a/app/_utils/grep-utils.ts
+++ b/app/_utils/grep-utils.ts
@@ -11,17 +11,22 @@
  * Enjoy it <3
  */
 
-import { exec, execFile } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import path from "path";
 import fs from "fs/promises";
 import yaml from "js-yaml";
 import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
 import { isPathUuid, pathUuid } from "@/app/_server/actions/lib/read-only";
+import { boxedShell } from "@/app/_utils/shell-utils";
 
-const execAsync = promisify(exec);
 const execFileAsync = promisify(execFile);
 
+const LINE_BREAK = /[\r\n]/;
+
+const _fieldLine = (field: string, value: string): string | null =>
+  LINE_BREAK.test(value) ? null : `${field}: ${value}`;
+
 const _isNoMatch = (error: unknown): boolean =>
   typeof error === "object" &&
   error !== null &&
@@ -45,10 +50,13 @@ export const grepFindFileByField = async (
   field: string,
   value: string,
 ): Promise<GrepFileResult | null> => {
+  const line = _fieldLine(field, value);
+  if (!line) return null;
+
   try {
-    const escapedValue = value.replace(/['"\\]/g, "\\$&");
-    const { stdout } = await execAsync(
-      `grep -rl "^${field}: ${escapedValue}$" "${dir}" --include="*.md" 2>/dev/null | head -1 || true`,
+    const stdout = await boxedShell(
+      'grep -rlxF --include="*.md" -e "$1" -- "$2" 2>/dev/null | head -1 || true',
+      [line, dir],
     );
 
     const filePath = stdout.trim();
@@ -63,7 +71,8 @@ export const grepFindFileByField = async (
     const category = parts.join("/");
 
     return { filePath, id, category };
-  } catch {
+  } catch (error) {
+    console.error("grepFindFileByField failed:", error);
     return null;
   }
 };
@@ -105,10 +114,13 @@ export const grepFindFilesByField = async (
   field: string,
   value: string,
 ): Promise<GrepFileResult[]> => {
+  const line = _fieldLine(field, value);
+  if (!line) return [];
+
   try {
-    const escapedValue = value.replace(/['"\\]/g, "\\$&");
-    const { stdout } = await execAsync(
-      `grep -rl "^${field}: ${escapedValue}$" "${dir}" --include="*.md" 2>/dev/null || true`,
+    const stdout = await boxedShell(
+      'grep -rlxF --include="*.md" -e "$1" -- "$2" 2>/dev/null || true',
+      [line, dir],
     );
 
     const files = stdout.trim().split("\n").filter(Boolean);
@@ -120,7 +132,8 @@ export const grepFindFilesByField = async (
       const category = parts.join("/");
       return { filePath, id, category };
     });
-  } catch {
+  } catch (error) {
+    console.error("grepFindFilesByField failed:", error);
     return [];
   }
 };
@@ -150,10 +163,11 @@ export const grepExtractAllFrontmatters = async (
   dir: string,
 ): Promise<Map<string, Record<string, unknown>>> => {
   try {
-    const { stdout } = await execAsync(
-      `find "${dir}" -name "*.md" -type f -print0 | sort -z | xargs -0 awk '` +
+    const stdout = await boxedShell(
+      `find "$1" -name "*.md" -type f -print0 | sort -z | xargs -0 awk '` +
         `FNR==1{if(NR>1)print "ENDFILE";print "FILE:"FILENAME;in_fm=($0=="---");next}` +
         `in_fm&&/^---$/{in_fm=0;next}in_fm{print}END{print "ENDFILE"}' 2>/dev/null || true`,
+      [dir],
       { maxBuffer: 50 * 1024 * 1024 },
     );
 
@@ -182,7 +196,8 @@ export const grepExtractAllFrontmatters = async (
     }
 
     return result;
-  } catch {
+  } catch (error) {
+    console.error("grepExtractAllFrontmatters failed:", error);
     return new Map();
   }
 };
@@ -191,8 +206,9 @@ export const grepExtractFrontmatter = async (
   filePath: string,
 ): Promise<Record<string, unknown> | null> => {
   try {
-    const { stdout } = await execAsync(
-      `sed -n '1{/^---$/!q;}; 2,/^---$/{/^---$/q;p;}' "${filePath}" 2>/dev/null || true`,
+    const stdout = await boxedShell(
+      `sed -n '1{/^---$/!q;}; 2,/^---$/{/^---$/q;p;}' "$1" 2>/dev/null || true`,
+      [filePath],
     );
 
     const yamlContent = stdout.trim();
@@ -205,7 +221,8 @@ export const grepExtractFrontmatter = async (
       return parsed as Record<string, unknown>;
     }
     return null;
-  } catch {
+  } catch (error) {
+    console.error("grepExtractFrontmatter failed:", filePath, error);
     return null;
   }
 };
@@ -214,8 +231,9 @@ export const grepListAllFiles = async (
   dir: string,
 ): Promise<GrepFileResult[]> => {
   try {
-    const { stdout } = await execAsync(
-      `find "${dir}" -name "*.md" -type f 2>/dev/null || true`,
+    const stdout = await boxedShell(
+      'find "$1" -name "*.md" -type f 2>/dev/null || true',
+      [dir],
     );
 
     const files = stdout.trim().split("\n").filter(Boolean);
@@ -227,7 +245,8 @@ export const grepListAllFiles = async (
       const category = parts.join("/");
       return { filePath, id, category };
     });
-  } catch {
+  } catch (error) {
+    console.error("grepListAllFiles failed:", error);
     return [];
   }
 };
@@ -258,11 +277,12 @@ export const grepExtractField = async (
   field: string,
 ): Promise<string | null> => {
   try {
-    const { stdout } = await execAsync(
-      `grep -m1 "^${field}:" "${filePath}" 2>/dev/null | sed 's/^${field}: *//' || true`,
+    const stdout = await boxedShell(
+      'grep -m1 -e "^$2:" -- "$1" 2>/dev/null || true',
+      [filePath, field],
     );
 
-    const value = stdout.trim();
+    const value = stdout.trim().slice(field.length + 1).trim();
     if (!value) {
       return null;
     }
@@ -275,7 +295,8 @@ export const grepExtractField = async (
     }
 
     return value;
-  } catch {
+  } catch (error) {
+    console.error("grepExtractField failed:", filePath, error);
     return null;
   }
 };
@@ -359,11 +380,13 @@ export const grepExtractExcerpt = async (
 ): Promise<string> => {
   try {
     const cap = length + EXCERPT_BUFFER;
-    const { stdout } = await execAsync(
-      `sed '1{/^---$/!{p;d;};}; /^---$/,/^---$/d' "${filePath}" 2>/dev/null | head -c ${cap} || true`,
+    const stdout = await boxedShell(
+      `sed '1{/^---$/!{p;d;};}; /^---$/,/^---$/d' "$1" 2>/dev/null | head -c "$2" || true`,
+      [filePath, String(cap)],
     );
     return fullCodeBlock(stdout, length);
-  } catch {
+  } catch (error) {
+    console.error("grepExtractExcerpt failed:", filePath, error);
     return "";
   }
 };
diff --git a/app/_utils/shell-utils.ts b/app/_utils/shell-utils.ts
new file mode 100644
index 000000000..77282bd60
--- /dev/null
+++ b/app/_utils/shell-utils.ts
@@ -0,0 +1,29 @@
+import { execFile } from "child_process";
+import { promisify } from "util";
+
+const execFileAsync = promisify(execFile);
+
+const SHELL = "sh";
+const SCRIPT_NAME = "jotty";
+
+export interface ShellOptions {
+  maxBuffer?: number;
+}
+
+/**
+ * Runs a fixed shell script with user data passed as positional arguments
+ * ($1, $2, ...). Arguments are never parsed by the shell, so paths and values
+ * containing $(...), backticks or quotes stay inert.
+ */
+export const boxedShell = async (
+  script: string,
+  args: string[],
+  options: ShellOptions = {},
+): Promise<string> => {
+  const { stdout } = await execFileAsync(
+    SHELL,
+    ["-c", script, SCRIPT_NAME, ...args],
+    { encoding: "utf8", ...options },
+  );
+  return stdout;
+};
diff --git a/app/api/exports/[filename]/route.ts b/app/api/exports/[filename]/route.ts
index 26a013f66..9154e4faa 100644
--- a/app/api/exports/[filename]/route.ts
+++ b/app/api/exports/[filename]/route.ts
@@ -3,15 +3,45 @@ import fs from "fs/promises";
 import path from "path";
 import { EXPORT_TEMP_DIR } from "@/app/_consts/files";
 import { resolvePath } from "@/app/_utils/path-utils";
+import {
+  ApiCaller,
+  seesAllContent,
+  whoGoesThere,
+} from "@/app/_utils/api-utils";
 
 export const dynamic = "force-dynamic";
 
+const OWN_EXPORT_SUFFIX = /^_content_\d+\.zip$/;
+
+const ownsExport = (username: string, filename: string): boolean =>
+  filename.startsWith(username) &&
+  OWN_EXPORT_SUFFIX.test(filename.slice(username.length));
+
+const mayDownload = async (
+  caller: ApiCaller,
+  filename: string,
+): Promise<boolean> =>
+  ownsExport(caller.username, filename) || (await seesAllContent(caller));
+
 export async function GET(
   request: NextRequest,
   props: { params: Promise<{ filename: string }> },
 ) {
+  const caller = await whoGoesThere(request);
+  if (!caller) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
   const params = await props.params;
   const filename = params.filename;
+
+  if (!(await mayDownload(caller, filename))) {
+    console.warn(`Export download refused for ${caller.username}: ${filename}`);
+    return new NextResponse("File not found or error during download.", {
+      status: 404,
+    });
+  }
+
   const baseDir = path.resolve(process.cwd(), EXPORT_TEMP_DIR);
   const resolved = resolvePath(baseDir, filename);
   if (!resolved.ok) {
diff --git a/app/api/exports/route.ts b/app/api/exports/route.ts
index 44b3b7470..679eb1ee0 100644
--- a/app/api/exports/route.ts
+++ b/app/api/exports/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { seesAllContent, withApiAuth } from "@/app/_utils/api-utils";
 import {
   exportAllChecklistsNotes,
   exportUserChecklistsNotes,
@@ -8,22 +8,10 @@ import {
   getExportProgress,
 } from "@/app/_server/actions/export";
 import { getAppSettings } from "@/app/_server/actions/config";
-import { ExportType, User } from "@/app/_types";
+import { ExportType } from "@/app/_types";
 
 export const dynamic = "force-dynamic";
 
-const canAccessOtherUsersContent = async (user: User): Promise<boolean> => {
-  if (user.isSuperAdmin) return true;
-  if (!user.isAdmin) return false;
-
-  const settingsResult = await getAppSettings();
-  if (!settingsResult.success || !settingsResult.data) {
-    return true;
-  }
-
-  return settingsResult.data.adminContentAccess !== "no";
-};
-
 export async function POST(
   request: NextRequest,
   _context: { params: Promise<Record<string, never>> }
@@ -40,7 +28,7 @@ export async function POST(
         );
       }
 
-      const hasContentAccess = await canAccessOtherUsersContent(user);
+      const hasContentAccess = await seesAllContent(user);
 
       let result;
       switch (type as ExportType) {
diff --git a/tests/api/setup.ts b/tests/api/setup.ts
index 89fd7ea60..e6cc9bc3a 100644
--- a/tests/api/setup.ts
+++ b/tests/api/setup.ts
@@ -33,6 +33,7 @@ export const mockDeleteItem = vi.fn();
 export const mockUpdateItemStatus = vi.fn();
 export const mockGetCategories = vi.fn();
 export const mockIsAdmin = vi.fn();
+export const mockGetCurrentUser = vi.fn();
 export const mockServerWriteFile = vi.fn();
 export const mockFindUserRecord = vi.fn();
 export const mockExportAllChecklistsNotes = vi.fn();
@@ -136,6 +137,7 @@ vi.mock("@/app/_server/actions/category", () => ({
 
 vi.mock("@/app/_server/actions/users", () => ({
   isAdmin: (...args: any[]) => mockIsAdmin(...args),
+  getCurrentUser: (...args: any[]) => mockGetCurrentUser(...args),
 }));
 
 vi.mock("@/app/_server/actions/users/records", () => ({
@@ -168,6 +170,7 @@ vi.mock("@/app/_server/actions/lib/legacy-lookup", () => ({
 export function resetApiMocks() {
   vi.clearAllMocks();
   mockAuthenticateApiKey.mockReset();
+  mockGetCurrentUser.mockReset();
   mockEditNote.mockReset();
   mockDropNote.mockReset();
   mockEditList.mockReset();
diff --git a/tests/security/export-download.test.ts b/tests/security/export-download.test.ts
new file mode 100644
index 000000000..96c581b5c
--- /dev/null
+++ b/tests/security/export-download.test.ts
@@ -0,0 +1,93 @@
+import { describe, it, expect, beforeEach, afterAll, vi } from "vitest";
+import os from "os";
+import path from "path";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  mockGetCurrentUser,
+  mockGetAppSettings,
+  resetApiMocks,
+  createMockRequest,
+} from "../api/setup";
+import { EXPORT_TEMP_DIR } from "@/app/_consts/files";
+import { GET } from "@/app/api/exports/[filename]/route";
+
+const SANDBOX = mkdtempSync(path.join(os.tmpdir(), "jotty-exports-"));
+const EXPORT_DIR = path.resolve(SANDBOX, EXPORT_TEMP_DIR);
+const cwdSpy = vi.spyOn(process, "cwd").mockReturnValue(SANDBOX);
+const OWN = `${mockUser.username}_content_1700000000000.zip`;
+const WHOLE = "whole_data_folder_1700000000000.zip";
+const LOOKALIKE = `${mockUser.username}_content_content_1700000000000.zip`;
+const ADMIN = { ...mockUser, username: "boss", isAdmin: true };
+
+const plant = (name: string) => {
+  mkdirSync(EXPORT_DIR, { recursive: true });
+  writeFileSync(path.join(EXPORT_DIR, name), "zip");
+};
+
+const fetchExport = async (name: string, headers: Record<string, string> = {}) =>
+  GET(createMockRequest("GET", `http://localhost:3000/api/exports/${name}`, undefined, headers), {
+    params: Promise.resolve({ filename: name }),
+  });
+
+afterAll(() => {
+  cwdSpy.mockRestore();
+  rmSync(SANDBOX, { recursive: true, force: true });
+});
+
+describe("Security: export downloads", () => {
+  beforeEach(() => {
+    resetApiMocks();
+    cwdSpy.mockReturnValue(SANDBOX);
+    mockGetAppSettings.mockResolvedValue({ success: true, data: { adminContentAccess: "yes" } });
+    [OWN, WHOLE, LOOKALIKE].forEach(plant);
+  });
+
+  it("refuses somebody with no session and no api key", async () => {
+    const response = await fetchExport(WHOLE, { "x-api-key": "" });
+
+    expect(response.status).toBe(401);
+    expect(existsSync(path.join(EXPORT_DIR, WHOLE))).toBe(true);
+  });
+
+  it("refuses a regular user asking for an admin export", async () => {
+    mockAuthenticateApiKey.mockResolvedValue(mockUser);
+
+    const response = await fetchExport(WHOLE);
+
+    expect(response.status).toBe(404);
+    expect(existsSync(path.join(EXPORT_DIR, WHOLE))).toBe(true);
+  });
+
+  it("refuses a regular user asking for an export named like theirs", async () => {
+    mockGetCurrentUser.mockResolvedValue(mockUser);
+
+    const response = await fetchExport(LOOKALIKE);
+
+    expect(response.status).toBe(404);
+  });
+
+  it("serves a user their own export by session or api key", async () => {
+    mockGetCurrentUser.mockResolvedValue(mockUser);
+    expect((await fetchExport(OWN)).status).toBe(200);
+
+    plant(OWN);
+    mockGetCurrentUser.mockResolvedValue(null);
+    mockAuthenticateApiKey.mockResolvedValue(mockUser);
+    expect((await fetchExport(OWN)).status).toBe(200);
+  });
+
+  it("serves an admin with content access any export", async () => {
+    mockGetCurrentUser.mockResolvedValue(ADMIN);
+
+    expect((await fetchExport(WHOLE)).status).toBe(200);
+  });
+
+  it("refuses an admin when admin content access is off", async () => {
+    mockGetCurrentUser.mockResolvedValue(ADMIN);
+    mockGetAppSettings.mockResolvedValue({ success: true, data: { adminContentAccess: "no" } });
+
+    expect((await fetchExport(WHOLE)).status).toBe(404);
+  });
+});
diff --git a/tests/security/note-xss.test.tsx b/tests/security/note-xss.test.tsx
new file mode 100644
index 000000000..d4a48ab35
--- /dev/null
+++ b/tests/security/note-xss.test.tsx
@@ -0,0 +1,68 @@
+import { describe, it, expect } from "vitest";
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import ReactMarkdown from "react-markdown";
+import rehypeRaw from "rehype-raw";
+import { SvgFrame } from "@/app/_components/FeatureComponents/Notes/Parts/SvgFrame";
+import { BOUNCED_ELEMENTS, SVG_FRAME_ATTR } from "@/app/_consts/notes";
+import { noteUrlTransform } from "@/app/_utils/url-transform-utils";
+
+const EVIL_SVG =
+  '<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"><foreignObject><img src="x" onerror="alert(2)"/></foreignObject></svg>';
+
+const renderNote = (markdown: string): string =>
+  renderToStaticMarkup(
+    createElement(
+      ReactMarkdown,
+      {
+        rehypePlugins: [rehypeRaw],
+        urlTransform: noteUrlTransform,
+        disallowedElements: BOUNCED_ELEMENTS,
+      },
+      markdown,
+    ),
+  );
+
+describe("Security: script in note content", () => {
+  it("renders diagram svg as an image, never as live markup", () => {
+    const html = renderToStaticMarkup(
+      createElement(SvgFrame, { svg: EVIL_SVG, alt: "diagram" }),
+    );
+
+    expect(html.startsWith("<img")).toBe(true);
+    expect(html).not.toContain("<svg");
+    expect(html).not.toContain("onerror=");
+  });
+
+  it("keeps diagrams working when the stored svg is not a clean document", () => {
+    const frame = (svg: string) =>
+      renderToStaticMarkup(createElement(SvgFrame, { svg, alt: "diagram" }));
+    const dataUri = "data:image/svg+xml;base64,PHN2Zy8+";
+
+    expect(frame(dataUri)).toContain(`src="${dataUri}"`);
+    expect(frame('<svg viewBox="0 0 1 1"></svg>')).toContain(
+      encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg"'),
+    );
+    expect(frame("<svg/>")).toContain(SVG_FRAME_ATTR);
+  });
+
+  it("drops an unclosed iframe carrying a srcdoc script", () => {
+    const html = renderNote('hi\n\n<iframe srcdoc="<script>parent.alert(1)</script>">');
+
+    expect(html).not.toContain("iframe");
+    expect(html).toContain("hi");
+  });
+
+  it("drops object, embed and base tags", () => {
+    const html = renderNote(
+      '<object data="x"></object><embed src="x"><base href="https://evil.test/">',
+    );
+
+    expect(html).not.toMatch(/<(object|embed|base)/);
+  });
+
+  it("still dials tel links and blocks javascript links", () => {
+    expect(renderNote("[call](tel:123)")).toContain('href="tel:123"');
+    expect(renderNote("[x](javascript:alert(1))")).not.toContain("javascript:");
+  });
+});
diff --git a/tests/security/read-by-uuid.test.ts b/tests/security/read-by-uuid.test.ts
index bb2e365ea..f44aeae52 100644
--- a/tests/security/read-by-uuid.test.ts
+++ b/tests/security/read-by-uuid.test.ts
@@ -6,8 +6,8 @@ import { Modes } from '@/app/_types/enums'
 const VICTIM = 'victim'
 const MALLORY = 'mallory'
 const READER = 'reader'
-const NOTE_UUID = 'note-uuid'
-const LIST_UUID = 'list-uuid'
+const NOTE_UUID = '6f1c2b4e-8a3d-4c5e-9f10-2b3c4d5e6f70'
+const LIST_UUID = '7a2d3c5f-9b4e-4d6f-8a21-3c4d5e6f7081'
 
 const homeOf = (mode: Modes, username: string) =>
   path.join(process.cwd(), 'data', mode, username)
@@ -108,6 +108,19 @@ describe('Security: client reads by uuid are gated by the session', () => {
     })
   })
 
+  describe('a signed-in user sending something that is not a uuid', () => {
+    beforeEach(() => signIn(MALLORY))
+
+    it('is refused before any lookup runs', async () => {
+      const { viewNote } = await import('@/app/_server/actions/note')
+      const { viewList } = await import('@/app/_server/actions/checklist')
+
+      expect(await viewNote('x$(touch /tmp/pwn)')).toBeUndefined()
+      expect(await viewList('x`touch /tmp/pwn`')).toBeUndefined()
+      expect(mockGrepFind).not.toHaveBeenCalled()
+    })
+  })
+
   describe('a stranger with the uuid', () => {
     beforeEach(() => signIn(MALLORY))
 
diff --git a/tests/security/share-grants.test.ts b/tests/security/share-grants.test.ts
index d421b7898..e025d9534 100644
--- a/tests/security/share-grants.test.ts
+++ b/tests/security/share-grants.test.ts
@@ -6,7 +6,7 @@ import { PermissionTypes } from '@/app/_types/enums'
 const VICTIM = 'victim'
 const READER = 'reader'
 const MALLORY = 'mallory'
-const LIST_UUID = 'board-uuid'
+const LIST_UUID = '8b3e4d6a-ac5f-4e70-9b32-4d5e6f708192'
 const LIST_PATH = '/data/checklists/victim/Work/board.md'
 
 const GRANTS: Record<string, PermissionTypes[]> = {
diff --git a/tests/security/shell-injection.test.ts b/tests/security/shell-injection.test.ts
new file mode 100644
index 000000000..e4ccc9bef
--- /dev/null
+++ b/tests/security/shell-injection.test.ts
@@ -0,0 +1,65 @@
+import { describe, it, expect, afterAll, beforeEach } from "vitest";
+import os from "os";
+import path from "path";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import {
+  grepExtractExcerpt,
+  grepExtractField,
+  grepExtractFrontmatter,
+  grepFindFileByUuid,
+  grepFindFilesByField,
+  grepListAllFiles,
+} from "@/app/_utils/grep-utils";
+
+const ROOT = mkdtempSync(path.join(os.tmpdir(), "jotty-shell-"));
+const PWNED = path.join(ROOT, "pwned");
+const PAYLOAD = `$(touch ${PWNED})`;
+const TICKS = `\`touch ${PWNED}\``;
+const UUID = "0798d08a-5750-4035-aa73-4d45e008f3bb";
+
+const EVIL_DIR = path.join(ROOT, PAYLOAD);
+const EVIL_NOTE = path.join(EVIL_DIR, "note.md");
+
+afterAll(() => {
+  rmSync(ROOT, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  rmSync(PWNED, { force: true });
+  mkdirSync(EVIL_DIR, { recursive: true });
+  writeFileSync(
+    EVIL_NOTE,
+    ["---", `uuid: ${UUID}`, "title: Evil", "---", "body", ""].join("\n"),
+  );
+});
+
+describe("Security: shell injection in grep utils", () => {
+  it("does not run command substitution from a looked-up value", async () => {
+    await grepFindFileByUuid(ROOT, `x${PAYLOAD}`);
+    await grepFindFileByUuid(ROOT, `x${TICKS}`);
+    await grepFindFilesByField(ROOT, "uuid", `x${PAYLOAD}`);
+
+    expect(existsSync(PWNED)).toBe(false);
+  });
+
+  it("treats a looked-up value as a literal, not a pattern", async () => {
+    expect(await grepFindFileByUuid(ROOT, ".*")).toBeNull();
+    expect(await grepFindFilesByField(ROOT, "uuid", ".*")).toEqual([]);
+  });
+
+  it("does not run command substitution from a category name in a path", async () => {
+    await grepExtractFrontmatter(EVIL_NOTE);
+    await grepExtractExcerpt(EVIL_NOTE);
+    await grepExtractField(EVIL_NOTE, "uuid");
+    await grepListAllFiles(EVIL_DIR);
+
+    expect(existsSync(PWNED)).toBe(false);
+  });
+
+  it("still reads files that live in an oddly named category", async () => {
+    expect((await grepFindFileByUuid(ROOT, UUID))?.filePath).toBe(EVIL_NOTE);
+    expect((await grepExtractFrontmatter(EVIL_NOTE))?.title).toBe("Evil");
+    expect(await grepExtractField(EVIL_NOTE, "uuid")).toBe(UUID);
+    expect(await grepExtractExcerpt(EVIL_NOTE)).toBe("body");
+  });
+});
diff --git a/tests/server-actions/note-readers.test.ts b/tests/server-actions/note-readers.test.ts
index e85c936bd..4088b2ae8 100644
--- a/tests/server-actions/note-readers.test.ts
+++ b/tests/server-actions/note-readers.test.ts
@@ -27,10 +27,9 @@ vi.mock("@/app/_server/actions/note/parsers", () => ({
   parseMarkdownNote: vi.fn(),
 }));
 
-vi.mock("child_process", () => ({
-  exec: vi.fn((_cmd: string, _opts: unknown, callback: any) => {
-    const done = callback || _opts;
-    done(new Error("exec unavailable in tests"));
+vi.mock("@/app/_utils/shell-utils", () => ({
+  boxedShell: vi.fn(async () => {
+    throw new Error("shell unavailable in tests");
   }),
 }));
 
diff --git a/tests/server-actions/tags.test.ts b/tests/server-actions/tags.test.ts
index e7c325e80..93000c2bd 100644
--- a/tests/server-actions/tags.test.ts
+++ b/tests/server-actions/tags.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect, beforeEach, vi } from "vitest";
 import { mockFs, resetAllMocks } from "../setup";
 
 const mockExportWholeDataFolder = vi.fn();
+const mockCanAccessAllContent = vi.fn();
 const mockExtractYamlMetadata = vi.fn();
 const mockUpdateYamlMetadata = vi.fn();
 const mockExtractHashtagsFromContent = vi.fn();
@@ -12,6 +13,10 @@ vi.mock("@/app/_server/actions/file", async (importOriginal) => ({
     mockFs.writeFile(filePath, content, "utf-8"),
 }));
 
+vi.mock("@/app/_server/actions/users", () => ({
+  canAccessAllContent: (...args: any[]) => mockCanAccessAllContent(...args),
+}));
+
 vi.mock("@/app/_server/actions/export", () => ({
   exportWholeDataFolder: (...args: any[]) => mockExportWholeDataFolder(...args),
 }));
@@ -31,6 +36,7 @@ import { updateTagsFromContent } from "@/app/_server/actions/tags";
 describe("Tags Server Actions", () => {
   beforeEach(() => {
     resetAllMocks();
+    mockCanAccessAllContent.mockResolvedValue(true);
     mockExportWholeDataFolder.mockResolvedValue({ success: true });
     mockExtractYamlMetadata.mockReturnValue({
       metadata: { uuid: "test-uuid", tags: [] },
@@ -43,6 +49,17 @@ describe("Tags Server Actions", () => {
   });
 
   describe("updateTagsFromContent", () => {
+    it("refuses anybody without admin content access and touches nothing", async () => {
+      mockCanAccessAllContent.mockResolvedValue(false);
+
+      const result = await updateTagsFromContent();
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("Forbidden");
+      expect(mockExportWholeDataFolder).not.toHaveBeenCalled();
+      expect(mockFs.writeFile).not.toHaveBeenCalled();
+    });
+
     it("should backup data before processing", async () => {
       mockFs.access.mockResolvedValue(undefined);
       mockFs.readdir.mockResolvedValue([]);

From e3f97646731819161da74ab914501ede2bdf23b6 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Sun, 27 Sep 2026 22:19:15 +0100
Subject: [PATCH 14/28] bump the bastard

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 5ace3e882..ed81483e3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jotty.page",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "private": true,
   "engines": {
     "node": ">=22.15.0 <23 || >=23.11.0"

From 3dc8fc4907ab4156ba27a0b3b916c92fc9ac194a Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 06:31:01 +0000
Subject: [PATCH 15/28] Add JSDoc to page handlers, root layout, and Brain
 graph components

---
 app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx       | 4 ++++
 app/(loggedInRoutes)/admin/note/[uuid]/page.tsx            | 4 ++++
 app/(loggedInRoutes)/brain/[username]/page.tsx             | 7 +++++++
 app/(loggedInRoutes)/brain/page.tsx                        | 6 ++++++
 app/(loggedInRoutes)/checklist/[uuid]/page.tsx             | 4 ++++
 app/(loggedInRoutes)/note/[uuid]/page.tsx                  | 4 ++++
 app/(loggedInRoutes)/settings/connections/page.tsx         | 3 +++
 .../FeatureComponents/Brain/Parts/BrainCanvas2D.tsx        | 4 ++++
 .../FeatureComponents/Brain/Parts/BrainScene3D.tsx         | 4 ++++
 app/layout.tsx                                             | 4 ++++
 app/public/checklist/[uuid]/page.tsx                       | 4 ++++
 11 files changed, 48 insertions(+)

diff --git a/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx b/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx
index c86700aa7..e7aa1abe5 100644
--- a/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/admin/checklist/[uuid]/page.tsx
@@ -28,6 +28,10 @@ export async function generateMetadata(props: AdminChecklistPageProps): Promise<
   return getMedatadaTitle(Modes.CHECKLISTS, uuid);
 }
 
+/**
+ * Render a checklist with metadata and relations for a user with access to all content.
+ * Redirect home when access is denied or the checklist cannot be loaded.
+ */
 export default async function AdminChecklistPage(props: AdminChecklistPageProps) {
   const params = await props.params;
   const { uuid } = params;
diff --git a/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx b/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx
index ce3ae4220..d872c7953 100644
--- a/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/admin/note/[uuid]/page.tsx
@@ -26,6 +26,10 @@ export async function generateMetadata(props: AdminNotePageProps): Promise<Metad
   return getMedatadaTitle(Modes.NOTES, uuid);
 }
 
+/**
+ * Render a note with metadata and relations for a user with access to all content.
+ * Run legacy note migration first and redirect home if access or loading fails.
+ */
 export default async function AdminNotePage(props: AdminNotePageProps) {
   const params = await props.params;
   const { uuid } = params;
diff --git a/app/(loggedInRoutes)/brain/[username]/page.tsx b/app/(loggedInRoutes)/brain/[username]/page.tsx
index 66c10dafa..155985702 100644
--- a/app/(loggedInRoutes)/brain/[username]/page.tsx
+++ b/app/(loggedInRoutes)/brain/[username]/page.tsx
@@ -6,11 +6,18 @@ import { BrainPage } from "@/app/_components/FeatureComponents/Brain/server/Brai
 
 export const dynamic = "force-dynamic";
 
+/**
+ * Return the localized Brain title for the browser tab.
+ */
 export async function generateMetadata(): Promise<Metadata> {
   const t = await getTranslations("brain");
   return { title: t("title") };
 }
 
+/**
+ * Render the Brain for the decoded username from the route.
+ * Pass the optional focus query parameter to the shared Brain page.
+ */
 export default async function UserBrainPage(props: {
   params: Promise<{ username: string }>;
   searchParams: Promise<Record<string, string | undefined>>;
diff --git a/app/(loggedInRoutes)/brain/page.tsx b/app/(loggedInRoutes)/brain/page.tsx
index eb38cf503..e218c3c64 100644
--- a/app/(loggedInRoutes)/brain/page.tsx
+++ b/app/(loggedInRoutes)/brain/page.tsx
@@ -5,11 +5,17 @@ import { BrainPage } from "@/app/_components/FeatureComponents/Brain/server/Brai
 
 export const dynamic = "force-dynamic";
 
+/**
+ * Return the localized Brain title for the browser tab.
+ */
 export async function generateMetadata(): Promise<Metadata> {
   const t = await getTranslations("brain");
   return { title: t("title") };
 }
 
+/**
+ * Render the current user's Brain with the optional focus query parameter.
+ */
 export default async function OwnBrainPage(props: {
   searchParams: Promise<Record<string, string | undefined>>;
 }) {
diff --git a/app/(loggedInRoutes)/checklist/[uuid]/page.tsx b/app/(loggedInRoutes)/checklist/[uuid]/page.tsx
index d9ae15f7d..06340b79b 100644
--- a/app/(loggedInRoutes)/checklist/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/checklist/[uuid]/page.tsx
@@ -27,6 +27,10 @@ export async function generateMetadata(props: ChecklistPageProps): Promise<Metad
   return getMedatadaTitle(Modes.CHECKLISTS, params.uuid);
 }
 
+/**
+ * Resolve a checklist for the signed-in user and load its categories and relations.
+ * Redirect legacy slugs to UUID URLs and unavailable checklists to the home page.
+ */
 export default async function ChecklistPage(props: ChecklistPageProps) {
   const params = await props.params;
   const { uuid } = params;
diff --git a/app/(loggedInRoutes)/note/[uuid]/page.tsx b/app/(loggedInRoutes)/note/[uuid]/page.tsx
index 414cd50a1..9bef0f686 100644
--- a/app/(loggedInRoutes)/note/[uuid]/page.tsx
+++ b/app/(loggedInRoutes)/note/[uuid]/page.tsx
@@ -31,6 +31,10 @@ export async function generateMetadata(props: NotePageProps): Promise<Metadata>
   return getMedatadaTitle(Modes.NOTES, params.uuid);
 }
 
+/**
+ * Resolve a note for the signed-in user and load its categories and relations.
+ * Migrate legacy notes, redirect old slugs to UUID URLs, and redirect home if unavailable.
+ */
 export default async function NotePage(props: NotePageProps) {
   const params = await props.params;
   const { uuid } = params;
diff --git a/app/(loggedInRoutes)/settings/connections/page.tsx b/app/(loggedInRoutes)/settings/connections/page.tsx
index 386427e2b..51383bd37 100644
--- a/app/(loggedInRoutes)/settings/connections/page.tsx
+++ b/app/(loggedInRoutes)/settings/connections/page.tsx
@@ -1,6 +1,9 @@
 import { permanentRedirect } from "next/navigation";
 import { BRAIN_PATH } from "@/app/_consts/relations";
 
+/**
+ * Permanently redirect the retired connections settings route to the Brain.
+ */
 export default function ConnectionsPage() {
   permanentRedirect(BRAIN_PATH);
 }
diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainCanvas2D.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainCanvas2D.tsx
index c83c67e34..f0645326a 100644
--- a/app/_components/FeatureComponents/Brain/Parts/BrainCanvas2D.tsx
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainCanvas2D.tsx
@@ -58,6 +58,10 @@ const _overlaps = (a: Box, b: Box) =>
 const _clip = (title: string) =>
   title.length > LABEL_MAX_CHARS ? `${title.slice(0, LABEL_MAX_CHARS - 1)}…` : title;
 
+/**
+ * Render an interactive 2D graph of items and their relationships.
+ * Apply focus, selection and palette settings, and report node selections and opens.
+ */
 export default function BrainCanvas2D({
   nodes,
   edges,
diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx
index 2bf967d47..f0fca66db 100644
--- a/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainScene3D.tsx
@@ -61,6 +61,10 @@ const LABEL_GAP_PX = 4;
 const noLabel = () => "";
 const orbitProps = { controlType: "orbit" } as Record<string, unknown>;
 
+/**
+ * Render an interactive 3D graph of items and their relationships.
+ * Manage camera movement, node highlighting and labels, and release scene resources on cleanup.
+ */
 export default function BrainScene3D({
   nodes,
   edges,
diff --git a/app/layout.tsx b/app/layout.tsx
index 5feaf2776..36ea0220e 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -148,6 +148,10 @@ export async function generateViewport(): Promise<Viewport> {
   };
 }
 
+/**
+ * Load session, settings and initial item data for the application providers.
+ * Render the shared document shell while omitting private item lists on public routes.
+ */
 export default async function RootLayout({
   children,
 }: {
diff --git a/app/public/checklist/[uuid]/page.tsx b/app/public/checklist/[uuid]/page.tsx
index f9ec21b9d..94d733e4b 100644
--- a/app/public/checklist/[uuid]/page.tsx
+++ b/app/public/checklist/[uuid]/page.tsx
@@ -32,6 +32,10 @@ export async function generateMetadata(
   return getMedatadaTitle(Modes.CHECKLISTS, params.uuid);
 }
 
+/**
+ * Render a publicly shared checklist, or its owner's preview, with sanitized owner details.
+ * Respect the owner's emoji preference and redirect home when the checklist is unavailable.
+ */
 export default async function PublicChecklistPage(
   props: PublicChecklistPageProps,
 ) {

From fb0f66f3700faa0deb880c31fa752a6e5b514f2d Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 10:06:21 +0100
Subject: [PATCH 16/28] bit of a rehaul but the concept is the same

---
 .agents/skills/jotty/references/auth.md       |    2 +-
 .github/workflows/pr-checks.yml               |   28 +
 app/(loggedInRoutes)/howto/[path]/page.tsx    |    9 +-
 .../Howto/ApiExplorer/ApiExplorer.tsx         |   96 +
 .../Howto/ApiExplorer/OperationCard.tsx       |  171 ++
 .../Howto/ApiExplorer/api-explorer-utils.ts   |  122 ++
 .../Howto/ApiExplorer/useTryIt.ts             |   49 +
 app/_consts/api.ts                            |    1 +
 app/_consts/logs.ts                           |    1 +
 app/_schemas/api/admin.ts                     |   14 +
 app/_schemas/api/checklists.ts                |  106 +
 app/_schemas/api/common.ts                    |   41 +
 app/_schemas/api/discovery.ts                 |   84 +
 app/_schemas/api/exports.ts                   |   33 +
 app/_schemas/api/items.ts                     |   99 +
 app/_schemas/api/kanban.ts                    |  198 ++
 app/_schemas/api/logs.ts                      |  106 +
 app/_schemas/api/names.ts                     |   19 +
 app/_schemas/api/notes.ts                     |   34 +
 app/_schemas/api/tasks.ts                     |  104 +
 app/_schemas/api/users.ts                     |   38 +
 app/_server/actions/api/index.ts              |   23 +-
 .../actions/checklist-item/rearrange.ts       |  106 +
 app/_server/actions/checklist-item/reorder.ts |  184 +-
 app/_server/actions/checklist/creator.ts      |    4 +-
 app/_server/actions/export/builders.ts        |  295 +++
 app/_server/actions/export/index.ts           |  340 +--
 app/_server/actions/kanban/tweaker.ts         |   15 +-
 app/_server/actions/lib/audit-trail.ts        |   67 +
 app/_server/api/contract.ts                   |  101 +
 app/_server/api/define-route.ts               |  126 ++
 app/_server/api/openapi.ts                    |  151 ++
 app/_server/api/route-index.ts                |   83 +
 app/_server/api/spec.ts                       |   13 +
 app/_translations/de.json                     |  525 +++--
 app/_translations/en.json                     |  232 +-
 app/_translations/es.json                     |  493 +++--
 app/_translations/fr.json                     |  484 +++--
 app/_translations/it.json                     |  455 ++--
 app/_translations/klingon.json                |  264 ++-
 app/_translations/ko.json                     |  418 ++--
 app/_translations/nl.json                     |  467 ++--
 app/_translations/pirate.json                 |  271 ++-
 app/_translations/pl.json                     |  472 ++--
 app/_translations/pt.json                     |  426 ++--
 app/_translations/ru.json                     |  410 ++--
 app/_translations/tr.json                     |  434 ++--
 app/_translations/vi.json                     |  438 ++--
 app/_translations/zh.json                     |  414 ++--
 app/_types/audit.ts                           |   33 +-
 app/_types/enums.ts                           |    5 +
 app/_types/export.ts                          |   13 +-
 app/_types/openapi.ts                         |   56 +
 app/_utils/api-list-utils.ts                  |   71 +
 app/_utils/api-task.ts                        |   47 +
 app/_utils/api-utils.ts                       |   17 +-
 app/_utils/howto-utils.ts                     |    4 +-
 app/_utils/kanban/api-board.ts                |   48 +
 app/api/admin/rebuild-index/route.ts          |   65 +-
 app/api/categories/route.ts                   |   84 +-
 .../[listId]/items/[itemIndex]/check/route.ts |  124 +-
 .../[listId]/items/[itemIndex]/route.ts       |  332 +--
 .../items/[itemIndex]/uncheck/route.ts        |  124 +-
 .../[listId]/items/reorder/route.ts           |  199 +-
 app/api/checklists/[listId]/items/route.ts    |  169 +-
 app/api/checklists/[listId]/route.ts          |  136 +-
 app/api/checklists/route.ts                   |  201 +-
 app/api/docs/route.ts                         |  193 +-
 app/api/exports/[filename]/route.ts           |  118 +-
 app/api/exports/route.ts                      |  178 +-
 app/api/health/route.ts                       |   72 +-
 app/api/kanban/[boardId]/calendar/route.ts    |   92 +-
 .../[boardId]/items/[itemId]/assign/route.ts  |   80 +-
 .../items/[itemId]/reminder/route.ts          |  147 +-
 .../kanban/[boardId]/items/[itemId]/route.ts  |  156 +-
 .../[boardId]/items/[itemId]/status/route.ts  |   99 +-
 app/api/kanban/[boardId]/items/route.ts       |  102 +-
 app/api/kanban/[boardId]/route.ts             |  203 +-
 app/api/kanban/[boardId]/statuses/route.ts    |   86 +-
 app/api/kanban/route.ts                       |  167 +-
 app/api/logs/cleanup/route.ts                 |   48 +-
 app/api/logs/export/route.ts                  |  237 +-
 app/api/logs/route.ts                         |  158 +-
 app/api/logs/stats/route.ts                   |  150 +-
 app/api/notes/[noteId]/route.ts               |  268 ++-
 app/api/notes/route.ts                        |  158 +-
 app/api/openapi.json/route.ts                 |   24 +
 app/api/search/route.ts                       |  139 +-
 app/api/summary/route.ts                      |  207 +-
 .../tasks/[taskId]/items/[itemIndex]/route.ts |  213 +-
 .../items/[itemIndex]/status/route.ts         |  132 +-
 app/api/tasks/[taskId]/items/route.ts         |  181 +-
 app/api/tasks/[taskId]/route.ts               |  224 +-
 .../[taskId]/statuses/[statusId]/route.ts     |  238 +-
 app/api/tasks/[taskId]/statuses/route.ts      |  193 +-
 app/api/tasks/route.ts                        |  208 +-
 app/api/user/[username]/route.ts              |   71 +-
 app/api/user/route.ts                         |   41 +-
 docker-compose.mcp.yml                        |   55 +
 eslint.config.mjs                             |    4 +-
 howto/API.md                                  | 1913 +----------------
 howto/DOCKER.md                               |   10 +-
 mcp-server/.env.example                       |    3 +
 mcp-server/.gitignore                         |    7 +-
 mcp-server/Dockerfile                         |   18 +
 mcp-server/README.md                          |  323 +--
 mcp-server/bun.lock                           |  215 ++
 mcp-server/bunfig.toml                        |    2 +
 mcp-server/package-lock.json                  | 1241 -----------
 mcp-server/package.json                       |   47 +-
 mcp-server/scripts/integration-http.mjs       |   84 -
 mcp-server/scripts/integration.mjs            |  162 --
 mcp-server/scripts/live-lifecycle.mjs         |  243 ---
 mcp-server/scripts/smoke.mjs                  |  120 --
 mcp-server/src/client.ts                      |  126 --
 mcp-server/src/config/env.ts                  |   14 +
 mcp-server/src/config/load.ts                 |   38 +
 mcp-server/src/config/schema.ts               |   28 +
 mcp-server/src/http.ts                        |  217 --
 mcp-server/src/index.ts                       |  103 -
 mcp-server/src/jotty/client.ts                |   95 +
 mcp-server/src/jotty/openapi.ts               |   44 +
 mcp-server/src/jotty/spec.ts                  |   42 +
 mcp-server/src/main.ts                        |   40 +
 mcp-server/src/server/auth.ts                 |   27 +
 mcp-server/src/server/http.ts                 |   68 +
 mcp-server/src/server/mcp.ts                  |   21 +
 mcp-server/src/server/sessions.ts             |  112 +
 mcp-server/src/server/stdio.ts                |   14 +
 mcp-server/src/tools/admin.ts                 |  144 --
 mcp-server/src/tools/builtins.ts              |  126 ++
 mcp-server/src/tools/catalog.ts               |   29 +
 mcp-server/src/tools/checklists.ts            |  277 ---
 mcp-server/src/tools/context.ts               |   16 +
 mcp-server/src/tools/discovery.ts             |   72 -
 mcp-server/src/tools/errors.ts                |   47 +
 mcp-server/src/tools/index.ts                 |   35 -
 mcp-server/src/tools/kanban.ts                |  337 ---
 mcp-server/src/tools/misc.ts                  |   67 -
 mcp-server/src/tools/notes.ts                 |  116 -
 mcp-server/src/tools/operation.ts             |   68 +
 mcp-server/src/tools/register.ts              |   47 +
 mcp-server/src/tools/result.ts                |   23 +
 mcp-server/src/tools/schema.ts                |  107 +
 mcp-server/src/tools/shared.ts                |   52 -
 mcp-server/src/tools/tasks.ts                 |  308 ---
 mcp-server/src/tools/types.ts                 |   10 -
 mcp-server/src/utils/logger.ts                |   39 +
 mcp-server/src/utils/timeout.ts               |   21 +
 mcp-server/tests/helpers.ts                   |  118 +
 mcp-server/tests/preload.ts                   |    1 +
 mcp-server/tests/schema.test.ts               |   47 +
 mcp-server/tests/session.test.ts              |   70 +
 mcp-server/tests/tools.test.ts                |   86 +
 mcp-server/tsconfig.json                      |   31 +-
 proxy.ts                                      |    2 +-
 public/api/components/responses.yaml          |   24 -
 public/api/components/schemas.yaml            |  205 --
 public/api/components/security.yaml           |    6 -
 public/api/info.yaml                          |   12 -
 public/api/paths/admin.yaml                   |   34 -
 public/api/paths/categories.yaml              |   43 -
 public/api/paths/checklists.yaml              |  443 ----
 public/api/paths/exports.yaml                 |   56 -
 public/api/paths/health.yaml                  |   29 -
 public/api/paths/logs.yaml                    |  270 ---
 public/api/paths/notes.yaml                   |  251 ---
 public/api/paths/search.yaml                  |   69 -
 public/api/paths/summary.yaml                 |   74 -
 public/api/paths/tasks.yaml                   |  611 ------
 public/api/paths/users.yaml                   |   60 -
 public/openapi.yaml                           |   13 -
 tests/api/checklists.test.ts                  |   62 +
 tests/api/contracts.test.ts                   |   78 +
 tests/api/define-route.test.ts                |  127 ++
 tests/api/discovery.test.ts                   |  143 ++
 tests/api/edit-guards.test.ts                 |   58 +
 tests/api/exports.test.ts                     |   55 +-
 tests/api/items.test.ts                       |  142 ++
 tests/api/kanban.test.ts                      |  601 ++++++
 tests/api/logs.test.ts                        |  210 ++
 tests/api/setup.ts                            |    9 +
 tests/api/tasks.test.ts                       |  263 +++
 tests/security/kanban-grants.test.ts          |  292 +++
 tests/security/share-grants.test.ts           |    6 +-
 tests/server-actions/export-actions.test.ts   |   77 +
 tests/server-actions/rearrange.test.ts        |   89 +
 tsconfig.json                                 |    3 +-
 188 files changed, 13062 insertions(+), 14462 deletions(-)
 create mode 100644 app/_components/FeatureComponents/Howto/ApiExplorer/ApiExplorer.tsx
 create mode 100644 app/_components/FeatureComponents/Howto/ApiExplorer/OperationCard.tsx
 create mode 100644 app/_components/FeatureComponents/Howto/ApiExplorer/api-explorer-utils.ts
 create mode 100644 app/_components/FeatureComponents/Howto/ApiExplorer/useTryIt.ts
 create mode 100644 app/_consts/api.ts
 create mode 100644 app/_consts/logs.ts
 create mode 100644 app/_schemas/api/admin.ts
 create mode 100644 app/_schemas/api/checklists.ts
 create mode 100644 app/_schemas/api/common.ts
 create mode 100644 app/_schemas/api/discovery.ts
 create mode 100644 app/_schemas/api/exports.ts
 create mode 100644 app/_schemas/api/items.ts
 create mode 100644 app/_schemas/api/kanban.ts
 create mode 100644 app/_schemas/api/logs.ts
 create mode 100644 app/_schemas/api/names.ts
 create mode 100644 app/_schemas/api/notes.ts
 create mode 100644 app/_schemas/api/tasks.ts
 create mode 100644 app/_schemas/api/users.ts
 create mode 100644 app/_server/actions/checklist-item/rearrange.ts
 create mode 100644 app/_server/actions/export/builders.ts
 create mode 100644 app/_server/actions/lib/audit-trail.ts
 create mode 100644 app/_server/api/contract.ts
 create mode 100644 app/_server/api/define-route.ts
 create mode 100644 app/_server/api/openapi.ts
 create mode 100644 app/_server/api/route-index.ts
 create mode 100644 app/_server/api/spec.ts
 create mode 100644 app/_types/openapi.ts
 create mode 100644 app/_utils/api-list-utils.ts
 create mode 100644 app/_utils/api-task.ts
 create mode 100644 app/_utils/kanban/api-board.ts
 create mode 100644 app/api/openapi.json/route.ts
 create mode 100644 docker-compose.mcp.yml
 create mode 100644 mcp-server/.env.example
 create mode 100644 mcp-server/Dockerfile
 create mode 100644 mcp-server/bun.lock
 create mode 100644 mcp-server/bunfig.toml
 delete mode 100644 mcp-server/package-lock.json
 delete mode 100644 mcp-server/scripts/integration-http.mjs
 delete mode 100644 mcp-server/scripts/integration.mjs
 delete mode 100644 mcp-server/scripts/live-lifecycle.mjs
 delete mode 100644 mcp-server/scripts/smoke.mjs
 delete mode 100644 mcp-server/src/client.ts
 create mode 100644 mcp-server/src/config/env.ts
 create mode 100644 mcp-server/src/config/load.ts
 create mode 100644 mcp-server/src/config/schema.ts
 delete mode 100644 mcp-server/src/http.ts
 delete mode 100644 mcp-server/src/index.ts
 create mode 100644 mcp-server/src/jotty/client.ts
 create mode 100644 mcp-server/src/jotty/openapi.ts
 create mode 100644 mcp-server/src/jotty/spec.ts
 create mode 100644 mcp-server/src/main.ts
 create mode 100644 mcp-server/src/server/auth.ts
 create mode 100644 mcp-server/src/server/http.ts
 create mode 100644 mcp-server/src/server/mcp.ts
 create mode 100644 mcp-server/src/server/sessions.ts
 create mode 100644 mcp-server/src/server/stdio.ts
 delete mode 100644 mcp-server/src/tools/admin.ts
 create mode 100644 mcp-server/src/tools/builtins.ts
 create mode 100644 mcp-server/src/tools/catalog.ts
 delete mode 100644 mcp-server/src/tools/checklists.ts
 create mode 100644 mcp-server/src/tools/context.ts
 delete mode 100644 mcp-server/src/tools/discovery.ts
 create mode 100644 mcp-server/src/tools/errors.ts
 delete mode 100644 mcp-server/src/tools/index.ts
 delete mode 100644 mcp-server/src/tools/kanban.ts
 delete mode 100644 mcp-server/src/tools/misc.ts
 delete mode 100644 mcp-server/src/tools/notes.ts
 create mode 100644 mcp-server/src/tools/operation.ts
 create mode 100644 mcp-server/src/tools/register.ts
 create mode 100644 mcp-server/src/tools/result.ts
 create mode 100644 mcp-server/src/tools/schema.ts
 delete mode 100644 mcp-server/src/tools/shared.ts
 delete mode 100644 mcp-server/src/tools/tasks.ts
 delete mode 100644 mcp-server/src/tools/types.ts
 create mode 100644 mcp-server/src/utils/logger.ts
 create mode 100644 mcp-server/src/utils/timeout.ts
 create mode 100644 mcp-server/tests/helpers.ts
 create mode 100644 mcp-server/tests/preload.ts
 create mode 100644 mcp-server/tests/schema.test.ts
 create mode 100644 mcp-server/tests/session.test.ts
 create mode 100644 mcp-server/tests/tools.test.ts
 delete mode 100644 public/api/components/responses.yaml
 delete mode 100644 public/api/components/schemas.yaml
 delete mode 100644 public/api/components/security.yaml
 delete mode 100644 public/api/info.yaml
 delete mode 100644 public/api/paths/admin.yaml
 delete mode 100644 public/api/paths/categories.yaml
 delete mode 100644 public/api/paths/checklists.yaml
 delete mode 100644 public/api/paths/exports.yaml
 delete mode 100644 public/api/paths/health.yaml
 delete mode 100644 public/api/paths/logs.yaml
 delete mode 100644 public/api/paths/notes.yaml
 delete mode 100644 public/api/paths/search.yaml
 delete mode 100644 public/api/paths/summary.yaml
 delete mode 100644 public/api/paths/tasks.yaml
 delete mode 100644 public/api/paths/users.yaml
 delete mode 100644 public/openapi.yaml
 create mode 100644 tests/api/contracts.test.ts
 create mode 100644 tests/api/define-route.test.ts
 create mode 100644 tests/api/discovery.test.ts
 create mode 100644 tests/api/edit-guards.test.ts
 create mode 100644 tests/api/kanban.test.ts
 create mode 100644 tests/api/logs.test.ts
 create mode 100644 tests/security/kanban-grants.test.ts
 create mode 100644 tests/server-actions/export-actions.test.ts
 create mode 100644 tests/server-actions/rearrange.test.ts

diff --git a/.agents/skills/jotty/references/auth.md b/.agents/skills/jotty/references/auth.md
index 1c03bc116..4e0d63ee3 100644
--- a/.agents/skills/jotty/references/auth.md
+++ b/.agents/skills/jotty/references/auth.md
@@ -32,7 +32,7 @@ OIDC redirect URI has to match the IdP exactly, scheme included.
 
 ## API keys
 
-`authenticateApiKey` in `actions/api`. Header `x-api-key`. Keys are hashed at rest. Generating a new one is an audit event. See [api.md](api.md).
+`authenticateApiKey` in `actions/api`. Header `x-api-key`. Keys are stored in plain text in `users.json` on purpose, so users can see theirs again in Profile. Generate them with `crypto.randomBytes` and compare them timing-safe, never with `===`. Never log one. See [api.md](api.md).
 
 ## Sanitising
 
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 5ff30552c..e27974a33 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -58,3 +58,31 @@ jobs:
 
       - name: Server actions also need to be tested
         run: yarn test:run tests/server-actions --reporter=verbose
+
+  mcp:
+    name: The MCP server gets poked too
+    runs-on: ubuntu-latest
+    needs: validate-branch
+    defaults:
+      run:
+        working-directory: mcp-server
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Bun, because the MCP is fancy
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.14"
+
+      - name: Install MCP dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Types or it didn't happen
+        run: bun run typecheck
+
+      - name: Fake Jotty, real HTTP
+        run: bun test
+
+      - name: Make sure it still bundles
+        run: bun run build
diff --git a/app/(loggedInRoutes)/howto/[path]/page.tsx b/app/(loggedInRoutes)/howto/[path]/page.tsx
index 683e68447..d92b83693 100644
--- a/app/(loggedInRoutes)/howto/[path]/page.tsx
+++ b/app/(loggedInRoutes)/howto/[path]/page.tsx
@@ -4,7 +4,10 @@ import { readFile } from "@/app/_server/actions/file";
 import { convertMarkdownToHtml } from "@/app/_utils/markdown-utils";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
-import { getHowtoGuideById, getHowtoFilePath, isValidHowtoGuide } from "@/app/_utils/howto-utils";
+import { API_GUIDE_ID, getHowtoGuideById, getHowtoFilePath, isValidHowtoGuide } from "@/app/_utils/howto-utils";
+import { getSettings } from "@/app/_server/actions/config";
+import { apiSpec } from "@/app/_server/api/spec";
+import { ApiExplorer } from "@/app/_components/FeatureComponents/Howto/ApiExplorer/ApiExplorer";
 
 interface HowtoPageProps {
   params: Promise<{
@@ -63,9 +66,11 @@ export default async function HowtoPage(props: HowtoPageProps) {
   }
 
   const htmlContent = convertMarkdownToHtml(markdownContent);
+  const showExplorer = guide.id === API_GUIDE_ID && !(await getSettings())?.isDemo;
 
   return (
-    <div>
+    <div className="space-y-10">
+      {showExplorer && <ApiExplorer spec={await apiSpec("")} />}
       <div className="prose prose-sm sm:prose-base lg:prose-lg xl:prose-2xl dark:prose-invert max-w-none">
         <UnifiedMarkdownRenderer content={htmlContent} />
       </div>
diff --git a/app/_components/FeatureComponents/Howto/ApiExplorer/ApiExplorer.tsx b/app/_components/FeatureComponents/Howto/ApiExplorer/ApiExplorer.tsx
new file mode 100644
index 000000000..aa820919f
--- /dev/null
+++ b/app/_components/FeatureComponents/Howto/ApiExplorer/ApiExplorer.tsx
@@ -0,0 +1,96 @@
+"use client";
+
+import { useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
+import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
+import { Input } from "@/app/_components/GlobalComponents/FormElements/Input";
+import { getApiKey } from "@/app/_server/actions/api";
+import { ExplorerSpec, groupByTag, operationsOf } from "./api-explorer-utils";
+import { OperationCard } from "./OperationCard";
+
+interface ApiExplorerProps {
+  spec: ExplorerSpec;
+}
+
+const API_BASE = "/api";
+
+export const ApiExplorer = ({ spec }: ApiExplorerProps) => {
+  const t = useTranslations("apiExplorer");
+  const [apiKey, setApiKey] = useState("");
+  const [filter, setFilter] = useState("");
+  const [keyMissing, setKeyMissing] = useState(false);
+
+  const groups = useMemo(() => {
+    const needle = filter.trim().toLowerCase();
+    const matches = operationsOf(spec).filter(
+      (op) =>
+        !needle ||
+        [op.path, op.summary, op.operationId, op.method].some((field) =>
+          field.toLowerCase().includes(needle),
+        ),
+    );
+    return Object.entries(groupByTag(matches));
+  }, [spec, filter]);
+
+  const fillMyKey = async () => {
+    const result = await getApiKey();
+    const key = result.success ? result.data : null;
+    setKeyMissing(!key);
+    if (key) setApiKey(key);
+  };
+
+  return (
+    <div id="api-explorer" className="space-y-6">
+      <div className="space-y-2">
+        <h1 className="text-3xl font-bold text-foreground">{t("title")}</h1>
+        <p className="text-muted-foreground">{t("intro", { version: spec.info.version })}</p>
+        <p className="text-sm text-muted-foreground">{t("realData")}</p>
+      </div>
+
+      <div className="space-y-2">
+        <div className="flex items-end gap-3">
+          <Input
+            id="api-explorer-key"
+            type="password"
+            label={t("apiKey")}
+            autoComplete="off"
+            value={apiKey}
+            onChange={(event) => setApiKey(event.target.value)}
+          />
+          <Button variant="outline" className="h-11 lg:h-10 shrink-0" onClick={fillMyKey}>
+            {t("useMyKey")}
+          </Button>
+        </div>
+        <p className="text-md lg:text-xs text-muted-foreground">
+          {keyMissing ? t("noKeyYet") : t("apiKeyHint")}
+        </p>
+      </div>
+
+      <Input
+        id="api-explorer-filter"
+        type="search"
+        label={t("filter")}
+        placeholder={t("filterPlaceholder")}
+        value={filter}
+        onChange={(event) => setFilter(event.target.value)}
+      />
+
+      {groups.length === 0 && <p className="text-muted-foreground">{t("noMatches")}</p>}
+
+      {groups.map(([tag, operations]) => (
+        <section key={tag} className="space-y-2">
+          <h2 className="text-lg font-semibold text-foreground">{tag}</h2>
+          {operations.map((operation) => (
+            <OperationCard
+              key={operation.operationId}
+              spec={spec}
+              operation={operation}
+              apiKey={apiKey}
+              apiBase={API_BASE}
+            />
+          ))}
+        </section>
+      ))}
+    </div>
+  );
+};
diff --git a/app/_components/FeatureComponents/Howto/ApiExplorer/OperationCard.tsx b/app/_components/FeatureComponents/Howto/ApiExplorer/OperationCard.tsx
new file mode 100644
index 000000000..a58ed1979
--- /dev/null
+++ b/app/_components/FeatureComponents/Howto/ApiExplorer/OperationCard.tsx
@@ -0,0 +1,171 @@
+"use client";
+
+import { useState } from "react";
+import { useTranslations } from "next-intl";
+import { ArrowDown01Icon, ArrowRight01Icon } from "hugeicons-react";
+import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
+import { Input } from "@/app/_components/GlobalComponents/FormElements/Input";
+import { Textarea } from "@/app/_components/GlobalComponents/FormElements/Textarea";
+import { cn } from "@/app/_utils/global-utils";
+import {
+  ExplorerMethod,
+  ExplorerSpec,
+  Operation,
+  bodySchemaOf,
+  buildUrl,
+  resolve,
+  sampleOf,
+} from "./api-explorer-utils";
+import { useTryIt } from "./useTryIt";
+
+interface OperationCardProps {
+  spec: ExplorerSpec;
+  operation: Operation;
+  apiKey: string;
+  apiBase: string;
+}
+
+const METHOD_TONES: Record<string, string> = {
+  [ExplorerMethod.GET]: "bg-primary/10 text-primary",
+  [ExplorerMethod.DELETE]: "bg-destructive/10 text-destructive",
+};
+
+const DEFAULT_TONE = "bg-accent text-accent-foreground";
+const FIRST_ERROR_STATUS = 400;
+
+export const OperationCard = ({ spec, operation, apiKey, apiBase }: OperationCardProps) => {
+  const t = useTranslations("apiExplorer");
+  const [isOpen, setIsOpen] = useState(false);
+  const [values, setValues] = useState<Record<string, string>>({});
+  const bodySchema = bodySchemaOf(operation);
+  const [body, setBody] = useState(() =>
+    bodySchema ? JSON.stringify(sampleOf(spec, bodySchema), null, 2) : "",
+  );
+  const [showSchema, setShowSchema] = useState(false);
+  const { result, isSending, failure, send } = useTryIt();
+
+  const setValue = (name: string, value: string) =>
+    setValues((current) => ({ ...current, [name]: value }));
+
+  const handleSend = () =>
+    send(
+      operation.method,
+      buildUrl(apiBase, operation.path, values, operation.parameters),
+      apiKey,
+      bodySchema ? body : undefined,
+    );
+
+  const Chevron = isOpen ? ArrowDown01Icon : ArrowRight01Icon;
+
+  return (
+    <div className="border border-border rounded-jotty bg-card">
+      <button
+        type="button"
+        onClick={() => setIsOpen(!isOpen)}
+        aria-expanded={isOpen}
+        className="flex w-full items-center gap-3 p-3 text-left hover:bg-muted/50 transition-colors rounded-jotty"
+      >
+        <span
+          className={cn(
+            "w-16 shrink-0 rounded-jotty px-2 py-1 text-center font-mono text-xs font-semibold uppercase",
+            METHOD_TONES[operation.method] ?? DEFAULT_TONE,
+          )}
+        >
+          {operation.method}
+        </span>
+        <span className="font-mono text-sm text-foreground break-all">{operation.path}</span>
+        <span className="hidden md:inline text-sm text-muted-foreground truncate">
+          {operation.summary}
+        </span>
+        {operation.deprecated && (
+          <span className="text-xs text-muted-foreground">{t("deprecated")}</span>
+        )}
+        <Chevron className="ml-auto h-4 w-4 shrink-0 text-muted-foreground" />
+      </button>
+
+      {isOpen && (
+        <div className="space-y-4 border-t border-border/70 p-4">
+          <div className="space-y-1">
+            <p className="text-sm font-medium text-foreground">{operation.summary}</p>
+            {operation.description && (
+              <p className="text-sm text-muted-foreground">{operation.description}</p>
+            )}
+            <p className="font-mono text-xs text-muted-foreground">
+              {operation.operationId}
+              {operation.isPublic && ` · ${t("noKeyNeeded")}`}
+            </p>
+          </div>
+
+          {operation.parameters.length > 0 && (
+            <div className="grid gap-3 md:grid-cols-2">
+              {operation.parameters.map((param) => (
+                <Input
+                  key={`${param.in}-${param.name}`}
+                  id={`${operation.operationId}-${param.name}`}
+                  type="text"
+                  label={`${param.name}${param.required ? " *" : ""} (${param.in})`}
+                  description={param.description}
+                  placeholder={resolve(spec, param.schema).enum?.join(" | ")}
+                  value={values[param.name] ?? ""}
+                  onChange={(event) => setValue(param.name, event.target.value)}
+                />
+              ))}
+            </div>
+          )}
+
+          {bodySchema && (
+            <div className="space-y-2">
+              <Textarea
+                id={`${operation.operationId}-body`}
+                label={t("body")}
+                value={body}
+                rows={8}
+                className="font-mono text-xs"
+                onChange={(event) => setBody(event.target.value)}
+              />
+              <Button variant="link" size="xs" onClick={() => setShowSchema(!showSchema)}>
+                {showSchema ? t("hideSchema") : t("showSchema")}
+              </Button>
+              {showSchema && (
+                <pre className="max-h-72 overflow-auto rounded-jotty bg-muted p-3 font-mono text-xs">
+                  {JSON.stringify(resolve(spec, bodySchema), null, 2)}
+                </pre>
+              )}
+            </div>
+          )}
+
+          <div className="flex items-center gap-3">
+            <Button
+              size="sm"
+              onClick={handleSend}
+              disabled={isSending || (!apiKey && !operation.isPublic)}
+            >
+              {isSending ? t("sending") : t("send")}
+            </Button>
+            {!apiKey && !operation.isPublic && (
+              <span className="text-xs text-muted-foreground">{t("keyRequired")}</span>
+            )}
+          </div>
+
+          {failure && <p className="text-sm text-destructive">{t("requestFailed")}</p>}
+
+          {result && (
+            <div className="space-y-2">
+              <p
+                className={cn(
+                  "font-mono text-xs",
+                  result.status < FIRST_ERROR_STATUS ? "text-primary" : "text-destructive",
+                )}
+              >
+                {t("responseMeta", { status: result.status, ms: result.ms })}
+              </p>
+              <pre className="max-h-96 overflow-auto rounded-jotty bg-muted p-3 font-mono text-xs">
+                {result.body}
+              </pre>
+            </div>
+          )}
+        </div>
+      )}
+    </div>
+  );
+};
diff --git a/app/_components/FeatureComponents/Howto/ApiExplorer/api-explorer-utils.ts b/app/_components/FeatureComponents/Howto/ApiExplorer/api-explorer-utils.ts
new file mode 100644
index 000000000..f9786f514
--- /dev/null
+++ b/app/_components/FeatureComponents/Howto/ApiExplorer/api-explorer-utils.ts
@@ -0,0 +1,122 @@
+import {
+  JsonSchema,
+  OpenApiDocument,
+  ParameterLocation,
+  SpecOperation,
+  SpecParameter,
+} from "@/app/_types/openapi";
+
+export type ExplorerSpec = OpenApiDocument;
+
+export interface Operation extends SpecOperation {
+  method: string;
+  path: string;
+  isPublic: boolean;
+}
+
+export enum ExplorerMethod {
+  GET = "get",
+  POST = "post",
+  PUT = "put",
+  PATCH = "patch",
+  DELETE = "delete",
+}
+
+const METHOD_ORDER: string[] = Object.values(ExplorerMethod);
+
+const _byMethod = ([a]: [string, unknown], [b]: [string, unknown]) =>
+  METHOD_ORDER.indexOf(a) - METHOD_ORDER.indexOf(b);
+
+export const operationsOf = (spec: ExplorerSpec): Operation[] =>
+  Object.entries(spec.paths).flatMap(([path, methods]) =>
+    Object.entries(methods)
+      .sort(_byMethod)
+      .map(([method, op]) => ({
+        ...op,
+        method,
+        path,
+        isPublic: Array.isArray(op.security) && op.security.length === 0,
+      })),
+  );
+
+const REF_PREFIX = "#/components/schemas/";
+const MAX_DEPTH = 4;
+
+
+
+export const groupByTag = (operations: Operation[]) =>
+  operations.reduce<Record<string, Operation[]>>((groups, op) => {
+    const tag = op.tags[0] ?? "";
+    groups[tag] = [...(groups[tag] ?? []), op];
+    return groups;
+  }, {});
+
+export const resolve = (spec: ExplorerSpec, schema?: JsonSchema): JsonSchema =>
+  schema?.$ref
+    ? resolve(spec, spec.components.schemas[schema.$ref.replace(REF_PREFIX, "")])
+    : schema ?? {};
+
+const _firstType = (schema: JsonSchema) =>
+  Array.isArray(schema.type) ? schema.type[0] : schema.type;
+
+export const sampleOf = (spec: ExplorerSpec, raw?: JsonSchema, depth = 0): unknown => {
+  const schema = resolve(spec, raw);
+  if (schema.default !== undefined) return schema.default;
+  if (schema.const !== undefined) return schema.const;
+  if (schema.enum?.length) return schema.enum[0];
+  const variant = schema.anyOf?.[0] ?? schema.oneOf?.[0];
+  if (variant) return sampleOf(spec, variant, depth);
+  if (depth > MAX_DEPTH) return null;
+
+  switch (_firstType(schema)) {
+    case "object":
+      return Object.fromEntries(
+        Object.entries(schema.properties ?? {})
+          .filter(([key]) => depth === 0 || schema.required?.includes(key))
+          .map(([key, prop]) => [key, sampleOf(spec, prop, depth + 1)]),
+      );
+    case "array":
+      return [];
+    case "number":
+    case "integer":
+      return 0;
+    case "boolean":
+      return false;
+    case "string":
+      return "";
+    default:
+      return null;
+  }
+};
+
+export const bodySchemaOf = (op: Operation) =>
+  op.requestBody ? Object.values(op.requestBody.content)[0]?.schema : undefined;
+
+export const buildUrl = (
+  base: string,
+  path: string,
+  values: Record<string, string>,
+  params: SpecParameter[],
+) => {
+  const filled = params
+    .filter((param) => param.in === ParameterLocation.PATH)
+    .reduce(
+      (acc, param) =>
+        acc.replace(`{${param.name}}`, encodeURIComponent(values[param.name] ?? "")),
+      path,
+    );
+  const query = new URLSearchParams(
+    params
+      .filter((param) => param.in === ParameterLocation.QUERY && values[param.name])
+      .map((param) => [param.name, values[param.name]]),
+  ).toString();
+  return `${base}${filled}${query ? `?${query}` : ""}`;
+};
+
+export const pretty = (text: string) => {
+  try {
+    return JSON.stringify(JSON.parse(text), null, 2);
+  } catch {
+    return text;
+  }
+};
diff --git a/app/_components/FeatureComponents/Howto/ApiExplorer/useTryIt.ts b/app/_components/FeatureComponents/Howto/ApiExplorer/useTryIt.ts
new file mode 100644
index 000000000..2f9a1be9c
--- /dev/null
+++ b/app/_components/FeatureComponents/Howto/ApiExplorer/useTryIt.ts
@@ -0,0 +1,49 @@
+"use client";
+
+import { useState } from "react";
+import { API_KEY_HEADER } from "@/app/_consts/api";
+import { pretty } from "./api-explorer-utils";
+
+export interface TryItResult {
+  status: number;
+  body: string;
+  ms: number;
+}
+
+const JSON_TYPE = "application/json";
+
+export const useTryIt = () => {
+  const [result, setResult] = useState<TryItResult | null>(null);
+  const [isSending, setIsSending] = useState(false);
+  const [failure, setFailure] = useState(false);
+
+  const send = async (method: string, url: string, apiKey: string, body?: string) => {
+    setIsSending(true);
+    setFailure(false);
+    const started = performance.now();
+    try {
+      const response = await fetch(url, {
+        method: method.toUpperCase(),
+        headers: {
+          [API_KEY_HEADER]: apiKey,
+          ...(body !== undefined ? { "Content-Type": JSON_TYPE } : {}),
+        },
+        body,
+        cache: "no-store",
+      });
+      setResult({
+        status: response.status,
+        body: pretty(await response.text()),
+        ms: Math.round(performance.now() - started),
+      });
+    } catch (error) {
+      console.error("API explorer request failed:", error);
+      setResult(null);
+      setFailure(true);
+    } finally {
+      setIsSending(false);
+    }
+  };
+
+  return { result, isSending, failure, send };
+};
diff --git a/app/_consts/api.ts b/app/_consts/api.ts
new file mode 100644
index 000000000..8b8ca7dac
--- /dev/null
+++ b/app/_consts/api.ts
@@ -0,0 +1 @@
+export const API_KEY_HEADER = "x-api-key";
diff --git a/app/_consts/logs.ts b/app/_consts/logs.ts
new file mode 100644
index 000000000..738220dbd
--- /dev/null
+++ b/app/_consts/logs.ts
@@ -0,0 +1 @@
+export const LOG_WINDOW_DAYS = 30;
diff --git a/app/_schemas/api/admin.ts b/app/_schemas/api/admin.ts
new file mode 100644
index 000000000..e29a8938e
--- /dev/null
+++ b/app/_schemas/api/admin.ts
@@ -0,0 +1,14 @@
+import { z } from "zod";
+
+export const rebuildIndexBody = z.object({
+  username: z
+    .string()
+    .trim()
+    .optional()
+    .describe("Whose index to rebuild, yours when left out. Only admins can name somebody else"),
+});
+
+export const rebuiltSchema = z.object({
+  success: z.literal(true),
+  message: z.string(),
+});
diff --git a/app/_schemas/api/checklists.ts b/app/_schemas/api/checklists.ts
new file mode 100644
index 000000000..4f03e36d1
--- /dev/null
+++ b/app/_schemas/api/checklists.ts
@@ -0,0 +1,106 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { ChecklistsTypes, DropPosition, KanbanPriorityLevel } from "@/app/_types/enums";
+import { categoryField, required, searchQuery, timestamp, uuidParam } from "./common";
+import { apiItemSchema, checklistTypeSchema, itemIndexParam, timeEntrySchema } from "./items";
+
+const TYPE_REFUSAL = "Type must be 'simple' or 'kanban'";
+const PRIORITY_REFUSAL = `'priority' must be one of: ${Object.values(KanbanPriorityLevel).join(", ")}`;
+const REORDER_REFUSAL = "'activeItemId' and 'overItemId' are required";
+const POSITION_REFUSAL = "'position' must be 'before' or 'after'";
+const EMPTY_PATCH = "Provide at least one field to update";
+
+const mustBeString = (field: string) =>
+  z.string({ error: `'${field}' must be a string` });
+
+const mustBeNumber = (field: string) =>
+  z.number({ error: `'${field}' must be a number` });
+
+export const checklistSchema = z
+  .object({
+    id: z.string().describe("Checklist uuid"),
+    title: z.string(),
+    category: z.string(),
+    type: checklistTypeSchema,
+    owner: z.string().optional(),
+    isShared: z.boolean().optional().describe("True when another user shared it with you"),
+    items: z.array(apiItemSchema).optional(),
+    createdAt: timestamp.optional(),
+    updatedAt: timestamp.optional(),
+  })
+  .register(apiNames, { id: "Checklist" });
+
+export const checklistListQuery = z.object({
+  category: z.string().optional().describe("Only checklists in this folder"),
+  type: z
+    .string()
+    .optional()
+    .describe("Only checklists of this type, matched exactly: 'simple', 'kanban' or the legacy 'task'"),
+  q: searchQuery.describe("Case-insensitive match on the title or any top-level item text"),
+});
+
+export const checklistCreateBody = z.object({
+  title: required("Title"),
+  category: categoryField,
+  type: z
+    .enum(ChecklistsTypes, { error: TYPE_REFUSAL })
+    .default(ChecklistsTypes.SIMPLE)
+    .describe(checklistTypeSchema.description ?? ""),
+});
+
+export const checklistUpdateBody = z.object({
+  title: z.string().nullish(),
+  category: z.string().nullish().describe("Moving needs create on the target folder and delete on the list"),
+});
+
+export const itemCreateBody = z.object({
+  text: required("Text"),
+  status: z.string().optional().describe("Kanban lists only, a status id. Defaults to the board's first status"),
+  time: z
+    .union([z.number(), z.string(), z.array(timeEntrySchema)])
+    .optional()
+    .describe("Kanban lists only, 0 or the tracked time entries"),
+  parentIndex: z
+    .union([z.string(), z.number()])
+    .optional()
+    .describe("Tree index of the parent item, e.g. 0 or 2.1. Sub-items ignore status and time"),
+});
+
+export const itemUpdateBody = z
+  .object({
+    text: mustBeString("text").optional(),
+    description: mustBeString("description").nullish(),
+    priority: z.enum(KanbanPriorityLevel, { error: PRIORITY_REFUSAL }).nullish(),
+    score: mustBeNumber("score").nullish(),
+    startDate: mustBeString("startDate").nullish().describe("ISO date"),
+    targetDate: mustBeString("targetDate").nullish().describe("ISO date"),
+    estimatedTime: mustBeNumber("estimatedTime").nullish().describe("Estimated hours"),
+  })
+  .refine(
+    (patch) => Object.values(patch).some((value) => value !== undefined),
+    EMPTY_PATCH,
+  );
+
+export const itemReorderBody = z.object({
+  activeItemId: z.string({ error: REORDER_REFUSAL }).min(1, REORDER_REFUSAL).describe("Id of the item being moved"),
+  overItemId: z.string({ error: REORDER_REFUSAL }).min(1, REORDER_REFUSAL).describe("Id of the item it is dropped on"),
+  position: z
+    .enum(DropPosition, { error: POSITION_REFUSAL })
+    .default(DropPosition.BEFORE)
+    .describe("Side of overItemId to land on, ignored when isDropInto is true"),
+  isDropInto: z.boolean().default(false).describe("Make it the last child of overItemId"),
+});
+
+export const itemCreatedSchema = z.object({
+  success: z.literal(true),
+  data: z
+    .object({ id: z.string().optional().describe("Id of the new item") })
+    .optional()
+    .describe("Left out when the item was added under a parent"),
+});
+
+export const listParams = uuidParam("listId", "Checklist");
+
+export const listItemParams = listParams.extend({
+  itemIndex: z.string().describe(itemIndexParam.description ?? ""),
+});
diff --git a/app/_schemas/api/common.ts b/app/_schemas/api/common.ts
new file mode 100644
index 000000000..b5443d940
--- /dev/null
+++ b/app/_schemas/api/common.ts
@@ -0,0 +1,41 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+
+export const errorSchema = z
+  .object({
+    error: z.string(),
+    details: z.array(z.unknown()).optional(),
+  })
+  .register(apiNames, { id: "Error" });
+
+export const okSchema = z.object({ success: z.literal(true) }).register(apiNames, { id: "Ok" });
+
+export const envelope = <T extends z.ZodType>(data: T) =>
+  z.object({ success: z.literal(true), data });
+
+export const required = (label: string) =>
+  z.string({ error: `${label} is required` }).min(1, `${label} is required`);
+
+export const categoryField = z
+  .string()
+  .default(UNCATEGORIZED)
+  .describe("Folder path, nested with '/'");
+
+export const timestamp = z.string().describe("ISO 8601 timestamp");
+
+export const searchQuery = z
+  .string()
+  .optional()
+  .describe("Case-insensitive text filter");
+
+export const uuidParam = (name: string, label: string) =>
+  z.object({ [name]: z.string().describe(`${label} uuid`) });
+
+export const ERRORS = {
+  400: { description: "Invalid input", schema: errorSchema },
+  401: { description: "Missing or invalid API key", schema: errorSchema },
+  403: { description: "Not allowed for this user", schema: errorSchema },
+  404: { description: "Not found or not visible to this user", schema: errorSchema },
+  500: { description: "Server error", schema: errorSchema },
+} as const;
diff --git a/app/_schemas/api/discovery.ts b/app/_schemas/api/discovery.ts
new file mode 100644
index 000000000..de0b85ed0
--- /dev/null
+++ b/app/_schemas/api/discovery.ts
@@ -0,0 +1,84 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { ItemTypes } from "@/app/_types/enums";
+
+export const SEARCH_MIN_LEN = 2;
+
+const TOO_SHORT = `Query must be at least ${SEARCH_MIN_LEN} characters`;
+
+const tally = z.record(z.string(), z.number());
+
+export const categoryEntrySchema = z
+  .object({
+    name: z.string(),
+    path: z.string().describe("Full path, parent categories included"),
+    count: z.number().describe("Items directly in this category"),
+    level: z.number().describe("Nesting depth, 0 for top-level"),
+  })
+  .register(apiNames, { id: "CategoryEntry" });
+
+export const categoriesSchema = z.object({
+  categories: z.object({
+    notes: z.array(categoryEntrySchema),
+    checklists: z.array(categoryEntrySchema),
+  }),
+});
+
+export const searchParamsSchema = z.object({
+  q: z
+    .string({ error: TOO_SHORT })
+    .refine((q) => q.trim().length >= SEARCH_MIN_LEN, TOO_SHORT)
+    .describe(`Text to look for, at least ${SEARCH_MIN_LEN} characters`),
+  type: z
+    .enum(ItemTypes)
+    .optional()
+    .describe("Only notes or only checklists, both when left out"),
+});
+
+export const searchHitSchema = z
+  .object({
+    id: z.string().describe("File name of the match, without extension"),
+    uuid: z.string().optional().describe("Item uuid"),
+    type: z.enum(ItemTypes),
+    title: z.string(),
+    category: z.string(),
+    excerpt: z.string().optional().describe("The first matching line, when it is not just the title"),
+  })
+  .register(apiNames, { id: "SearchHit" });
+
+export const searchResultsSchema = z.object({
+  query: z.string(),
+  results: z.array(searchHitSchema),
+  total: z.number(),
+});
+
+export const summaryQuery = z.object({
+  username: z
+    .string()
+    .optional()
+    .describe("Whose summary to return, yours when left out. Admin only for anybody else"),
+});
+
+const completion = {
+  total: z.number(),
+  completed: z.number(),
+  completionRate: z.number().describe("Percentage, rounded"),
+};
+
+export const summarySchema = z
+  .object({
+    username: z.string(),
+    notes: z.object({ total: z.number(), categories: tally }),
+    checklists: z.object({
+      total: z.number(),
+      categories: tally,
+      types: tally.describe("Checklists per type"),
+    }),
+    items: z.object({ ...completion, pending: z.number() }),
+    tasks: z.object({
+      ...completion,
+      inProgress: z.number(),
+      todo: z.number(),
+    }),
+  })
+  .register(apiNames, { id: "Summary" });
diff --git a/app/_schemas/api/exports.ts b/app/_schemas/api/exports.ts
new file mode 100644
index 000000000..747989e16
--- /dev/null
+++ b/app/_schemas/api/exports.ts
@@ -0,0 +1,33 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { ExportKind } from "@/app/_types/export";
+
+export const exportRequestBody = z.object({
+  type: z
+    .enum(ExportKind, {
+      error: (issue) => (issue.input ? "Invalid export type" : "Export type is required"),
+    })
+    .describe("all_checklists_notes, all_users_data and whole_data_folder need an admin with content access"),
+  username: z
+    .string()
+    .optional()
+    .describe("Whose data to export, required for user_checklists_notes. Only admins with content access can name somebody else"),
+});
+
+export const exportStartedSchema = z.object({
+  success: z.literal(true),
+  downloadUrl: z.string().describe("Path to fetch the zip from, it can be downloaded once"),
+});
+
+export const exportProgressSchema = z
+  .object({
+    progress: z.number().describe("Percentage done"),
+    message: z.string(),
+  })
+  .register(apiNames, { id: "ExportProgress" });
+
+export const exportFileParams = z.object({
+  filename: z.string().describe("File name from the downloadUrl of a finished export"),
+});
+
+export const zipFileSchema = z.string().meta({ format: "binary" });
diff --git a/app/_schemas/api/items.ts b/app/_schemas/api/items.ts
new file mode 100644
index 000000000..28df4b1c8
--- /dev/null
+++ b/app/_schemas/api/items.ts
@@ -0,0 +1,99 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { ChecklistsTypes, KanbanPriorityLevel } from "@/app/_types/enums";
+import { timestamp } from "./common";
+
+export const checklistTypeSchema = z
+  .enum(ChecklistsTypes)
+  .describe("'task' is the legacy name for 'kanban' and is still accepted");
+
+export const prioritySchema = z.enum(KanbanPriorityLevel);
+
+export const timeEntrySchema = z
+  .object({
+    id: z.string(),
+    startTime: timestamp,
+    endTime: timestamp.optional(),
+    duration: z.number().optional(),
+    user: z.string().optional(),
+  })
+  .register(apiNames, { id: "TimeEntry" });
+
+export const statusChangeSchema = z
+  .object({
+    status: z.string(),
+    timestamp,
+    user: z.string(),
+  })
+  .register(apiNames, { id: "StatusChange" });
+
+export const kanbanStatusSchema = z
+  .object({
+    id: z.string().describe("Status id, used as an item's status value"),
+    label: z.string(),
+    color: z.string().optional(),
+    order: z.number(),
+    autoComplete: z.boolean().optional().describe("Items moved here are marked completed"),
+  })
+  .register(apiNames, { id: "KanbanStatus" });
+
+export const reminderSchema = z
+  .object({
+    datetime: timestamp,
+    notified: z.boolean().optional(),
+  })
+  .register(apiNames, { id: "KanbanReminder" });
+
+type ApiItemShape = {
+  id: string;
+  index: number;
+  text: string;
+  completed: boolean;
+  status?: string;
+  time?: number | z.infer<typeof timeEntrySchema>[];
+  description?: string;
+  priority?: KanbanPriorityLevel;
+  score?: number;
+  startDate?: string;
+  targetDate?: string;
+  estimatedTime?: number;
+  createdBy?: string;
+  createdAt?: string;
+  lastModifiedBy?: string;
+  lastModifiedAt?: string;
+  history?: z.infer<typeof statusChangeSchema>[];
+  children?: ApiItemShape[];
+};
+
+export const apiItemSchema: z.ZodType<ApiItemShape> = z
+  .object({
+    id: z.string().describe("Item id inside its list"),
+    index: z.number().describe("Position among its siblings"),
+    text: z.string(),
+    completed: z.boolean(),
+    status: z.string().optional().describe("Kanban lists only, a status id"),
+    time: z
+      .union([z.number(), z.array(timeEntrySchema)])
+      .optional()
+      .describe("Kanban lists only, 0 or the tracked time entries"),
+    description: z.string().optional(),
+    priority: prioritySchema.optional(),
+    score: z.number().optional(),
+    startDate: z.string().optional(),
+    targetDate: z.string().optional(),
+    estimatedTime: z.number().optional(),
+    createdBy: z.string().optional(),
+    createdAt: timestamp.optional(),
+    lastModifiedBy: z.string().optional(),
+    lastModifiedAt: timestamp.optional(),
+    history: z.array(statusChangeSchema).optional(),
+    get children() {
+      return z.array(apiItemSchema).optional();
+    },
+  })
+  .register(apiNames, { id: "ChecklistItem" });
+
+export const itemIndexParam = z
+  .string()
+  .regex(/^\d+(\.\d+)*$/, "Invalid item index")
+  .describe("Tree index inside the list, children joined with '.', e.g. 0 or 2.1");
diff --git a/app/_schemas/api/kanban.ts b/app/_schemas/api/kanban.ts
new file mode 100644
index 000000000..4c9461615
--- /dev/null
+++ b/app/_schemas/api/kanban.ts
@@ -0,0 +1,198 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { KanbanPriorityLevel } from "@/app/_types/enums";
+import { categoryField, errorSchema, required, searchQuery, timestamp, uuidParam } from "./common";
+import {
+  checklistTypeSchema,
+  kanbanStatusSchema,
+  prioritySchema,
+  reminderSchema,
+  statusChangeSchema,
+  timeEntrySchema,
+} from "./items";
+
+type CardShape = {
+  id: string;
+  index: number;
+  text: string;
+  status: string;
+  completed: boolean;
+  priority?: KanbanPriorityLevel;
+  score?: number;
+  assignee?: string;
+  reminder?: z.infer<typeof reminderSchema>;
+  children?: CardShape[];
+};
+
+export const kanbanCardSchema: z.ZodType<CardShape> = z
+  .object({
+    id: z.string().describe("Card id inside the board, use it as {itemId}"),
+    index: z.number().describe("Position among its siblings"),
+    text: z.string(),
+    status: z.string().describe("Status id, 'todo' when the card has none"),
+    completed: z.boolean(),
+    priority: prioritySchema.optional(),
+    score: z.number().optional(),
+    assignee: z.string().optional().describe("Username"),
+    reminder: reminderSchema.optional(),
+    get children() {
+      return z.array(kanbanCardSchema).optional();
+    },
+  })
+  .register(apiNames, { id: "KanbanCard" });
+
+export const boardSchema = z
+  .object({
+    id: z.string().describe("Board uuid"),
+    title: z.string(),
+    category: z.string(),
+    statuses: z
+      .array(kanbanStatusSchema)
+      .describe("The board's columns, or the default columns when the board never changed them"),
+    items: z.array(kanbanCardSchema),
+    createdAt: timestamp,
+    updatedAt: timestamp,
+  })
+  .register(apiNames, { id: "KanbanBoard" });
+
+type StoredCardShape = {
+  id: string;
+  text: string;
+  completed: boolean;
+  order: number;
+  status?: string;
+  description?: string;
+  priority?: KanbanPriorityLevel;
+  score?: number;
+  assignee?: string;
+  reminder?: z.infer<typeof reminderSchema>;
+  timeEntries?: z.infer<typeof timeEntrySchema>[];
+  history?: z.infer<typeof statusChangeSchema>[];
+  createdBy?: string;
+  createdAt?: string;
+  lastModifiedBy?: string;
+  lastModifiedAt?: string;
+  children?: StoredCardShape[];
+};
+
+export const storedCardSchema: z.ZodType<StoredCardShape> = z
+  .looseObject({
+    id: z.string().describe("Card id inside the board, use it as {itemId}"),
+    text: z.string(),
+    completed: z.boolean(),
+    order: z.number(),
+    status: z.string().optional(),
+    description: z.string().optional(),
+    priority: prioritySchema.optional(),
+    score: z.number().optional(),
+    assignee: z.string().optional(),
+    reminder: reminderSchema.optional(),
+    timeEntries: z.array(timeEntrySchema).optional(),
+    history: z.array(statusChangeSchema).optional(),
+    createdBy: z.string().optional(),
+    createdAt: timestamp.optional(),
+    lastModifiedBy: z.string().optional(),
+    lastModifiedAt: timestamp.optional(),
+    get children() {
+      return z.array(storedCardSchema).optional();
+    },
+  })
+  .describe("A card as stored in the board file. Other stored fields may appear.")
+  .register(apiNames, { id: "KanbanStoredCard" });
+
+export const storedBoardSchema = z
+  .looseObject({
+    id: z.string().describe("On-disk filename, changes on rename. Use uuid instead"),
+    uuid: z.string().describe("Board uuid"),
+    title: z.string(),
+    type: checklistTypeSchema,
+    category: z.string().optional(),
+    owner: z.string().optional(),
+    statuses: z.array(kanbanStatusSchema).optional(),
+    items: z.array(storedCardSchema),
+    createdAt: timestamp,
+    updatedAt: timestamp,
+  })
+  .describe("The whole board as stored after the change, unlike the trimmed KanbanBoard. Other stored fields may appear.")
+  .register(apiNames, { id: "KanbanStoredBoard" });
+
+export const calendarEventSchema = z
+  .object({
+    id: z.string().describe("Card id"),
+    itemId: z.string().describe("Card id, same as id"),
+    title: z.string().describe("Card text"),
+    startDate: z.string().describe("YYYY-MM-DD, the card's start date or its target date"),
+    endDate: z.string().describe("YYYY-MM-DD, the card's target date"),
+    status: z.string().optional(),
+    priority: prioritySchema.optional(),
+    completed: z.boolean(),
+  })
+  .register(apiNames, { id: "KanbanCalendarEvent" });
+
+export const BOARD_REFUSED = {
+  description: "Invalid input, not a kanban board, or the action failed",
+  schema: errorSchema,
+};
+
+export const boardParams = uuidParam("boardId", "Board");
+
+export const cardParams = boardParams.extend({
+  itemId: z.string().describe("Card id inside the board"),
+});
+
+export const boardListQuery = z.object({
+  category: z.string().optional().describe("Only boards in this folder"),
+  status: z.string().optional().describe("Only boards with at least one top-level card in this status id"),
+  q: searchQuery.describe("Case-insensitive match on the board title or any top-level card text"),
+});
+
+export const boardCreateBody = z.object({
+  title: required("Title"),
+  category: categoryField,
+  statuses: z
+    .array(kanbanStatusSchema)
+    .optional()
+    .describe("Columns for the new board, the default columns when left out"),
+});
+
+export const boardUpdateBody = z.object({
+  title: z.string().optional(),
+  category: z.string().optional().describe("Moving needs create on the target folder and delete on the board"),
+});
+
+export const statusesBody = z.object({
+  statuses: z
+    .array(kanbanStatusSchema, { error: "Statuses array is required" })
+    .describe("The full new column list. Cards in a removed column move to the lowest-order one"),
+});
+
+export const cardCreateBody = z.object({
+  text: required("Text"),
+  status: z.string().optional().describe("Status id, defaults to the board's first column"),
+  description: z.string().optional(),
+});
+
+export const cardUpdateBody = z.object({
+  text: z.string().optional().describe("Empty text is ignored"),
+  priority: z.union([prioritySchema, z.literal("")]).optional().describe("Empty string clears it"),
+  score: z
+    .union([z.number(), z.string().regex(/^-?\d*$/, "Score must be a number")])
+    .optional()
+    .describe("Empty string clears it"),
+  assignee: z.string().optional().describe("Username, empty string clears it"),
+  reminder: reminderSchema.nullable().optional().describe("null clears it"),
+});
+
+export const cardStatusBody = z.object({
+  status: required("Status").describe("Status id of the target column"),
+});
+
+export const cardAssignBody = z.object({
+  assignee: z.string().nullish().describe("Username. Empty or missing clears the assignee"),
+});
+
+export const cardReminderBody = z.object({
+  datetime: required("Datetime")
+    .refine((value) => !Number.isNaN(Date.parse(value)), "Datetime must be a valid date")
+    .describe("When the reminder fires. Any date Date.parse accepts, ISO 8601 recommended"),
+});
diff --git a/app/_schemas/api/logs.ts b/app/_schemas/api/logs.ts
new file mode 100644
index 000000000..8ae467de7
--- /dev/null
+++ b/app/_schemas/api/logs.ts
@@ -0,0 +1,106 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { AUDIT_CATEGORIES, AUDIT_LOG_LEVELS } from "@/app/_types/audit";
+import { LOG_WINDOW_DAYS } from "@/app/_consts/logs";
+import { timestamp } from "./common";
+import { validateNoPathTraversal } from "@/app/_utils/path-utils";
+
+export enum LogExportFormat {
+  JSON = "json",
+  CSV = "csv",
+}
+
+enum BooleanParam {
+  TRUE = "true",
+  FALSE = "false",
+}
+
+const DEFAULT_LIMIT = 50;
+
+export const auditLevelSchema = z.enum(AUDIT_LOG_LEVELS);
+export const auditCategorySchema = z.enum(AUDIT_CATEGORIES);
+
+const count = (fallback: number, label: string) =>
+  z.coerce.number().int().min(0).default(fallback).describe(label);
+
+const logFilterFields = {
+  username: z
+    .string()
+    .refine(validateNoPathTraversal, "Invalid username")
+    .optional()
+    .describe("Only this user's entries. Admin only, everybody else always gets their own"),
+  action: z.string().optional().describe("Action name, such as login or checklist_created"),
+  category: auditCategorySchema.optional(),
+  level: auditLevelSchema.optional(),
+  startDate: z.string().optional().describe(`ISO 8601 start of the range, defaults to ${LOG_WINDOW_DAYS} days before endDate`),
+  endDate: z.string().optional().describe("ISO 8601 end of the range, defaults to now"),
+};
+
+export const logListQuery = z.object({
+  ...logFilterFields,
+  success: z
+    .enum(BooleanParam)
+    .optional()
+    .transform((value) => (value === undefined ? undefined : value === BooleanParam.TRUE))
+    .describe("Only entries that succeeded, or only ones that failed"),
+  limit: count(DEFAULT_LIMIT, "How many entries to return"),
+  offset: count(0, "How many entries to skip"),
+});
+
+export const logExportBody = z.object({
+  format: z.enum(LogExportFormat, { error: "Invalid format. Must be 'json' or 'csv'" }),
+  filters: z
+    .object({
+      ...logFilterFields,
+      success: z.boolean().optional(),
+      limit: z.number().int().min(0).optional().describe("Most recent entries to keep, all when left out"),
+    })
+    .default({})
+    .describe("The same filters as GET /logs"),
+});
+
+export const auditLogSchema = z
+  .object({
+    id: z.string().describe("Unix timestamp, as a string"),
+    uuid: z.string(),
+    timestamp,
+    level: auditLevelSchema,
+    username: z.string(),
+    action: z.string(),
+    category: auditCategorySchema,
+    resourceType: z.string().nullish(),
+    resourceId: z.string().nullish(),
+    resourceTitle: z.string().nullish(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+    ipAddress: z.string(),
+    userAgent: z.string(),
+    success: z.boolean(),
+    errorMessage: z.string().nullish(),
+    duration: z.number().optional(),
+  })
+  .register(apiNames, { id: "AuditLogEntry" });
+
+export const logPageSchema = z.object({
+  success: z.literal(true),
+  logs: z.array(auditLogSchema),
+  total: z.number().describe("Matching entries before limit and offset"),
+});
+
+export const logStatsSchema = z
+  .object({
+    totalLogs: z.number(),
+    logsByLevel: z.record(z.string(), z.number()),
+    logsByCategory: z.record(z.string(), z.number()),
+    topActions: z.array(z.object({ action: z.string(), count: z.number() })),
+    topUsers: z.array(z.object({ username: z.string(), count: z.number() })),
+    recentActivity: z.array(auditLogSchema),
+  })
+  .register(apiNames, { id: "AuditLogStats" });
+
+export const cleanupSchema = z.object({
+  success: z.boolean(),
+  deletedFiles: z.number(),
+  error: z.string().optional(),
+});
+
+export const logFileSchema = z.string().describe("JSON array of entries, or CSV when format is csv");
diff --git a/app/_schemas/api/names.ts b/app/_schemas/api/names.ts
new file mode 100644
index 000000000..3d2300504
--- /dev/null
+++ b/app/_schemas/api/names.ts
@@ -0,0 +1,19 @@
+import { z } from "zod";
+
+type Meta = { id?: string; [key: string]: unknown };
+
+class ApiSchemaNames extends z.core.$ZodRegistry<Meta> {
+  override add<S extends z.core.$ZodType>(schema: S, meta: Meta = {}): this {
+    const previous = meta.id ? this._idmap.get(meta.id) : undefined;
+    if (previous) this.remove(previous);
+    return super.add(schema, meta);
+  }
+
+  override get<S extends z.core.$ZodType>(schema: S): Meta | undefined {
+    const own = super.get(schema);
+    const shared = z.globalRegistry.get(schema);
+    return own || shared ? { ...shared, ...own } : undefined;
+  }
+}
+
+export const apiNames = new ApiSchemaNames();
diff --git a/app/_schemas/api/notes.ts b/app/_schemas/api/notes.ts
new file mode 100644
index 000000000..665ea8e7e
--- /dev/null
+++ b/app/_schemas/api/notes.ts
@@ -0,0 +1,34 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { categoryField, required, searchQuery, timestamp, uuidParam } from "./common";
+
+export const noteSchema = z
+  .object({
+    id: z.string().describe("Note uuid"),
+    title: z.string(),
+    category: z.string(),
+    content: z.string().optional(),
+    owner: z.string().optional(),
+    createdAt: timestamp.optional(),
+    updatedAt: timestamp.optional(),
+  })
+  .register(apiNames, { id: "Note" });
+
+export const noteListQuery = z.object({
+  category: z.string().optional().describe("Only notes in this folder"),
+  q: searchQuery,
+});
+
+export const noteCreateBody = z.object({
+  title: required("Title"),
+  content: z.string().default(""),
+  category: categoryField,
+});
+
+export const noteUpdateBody = z.object({
+  title: z.string().optional(),
+  content: z.string().optional(),
+  category: z.string().optional(),
+});
+
+export const noteParams = uuidParam("noteId", "Note");
diff --git a/app/_schemas/api/tasks.ts b/app/_schemas/api/tasks.ts
new file mode 100644
index 000000000..680834b98
--- /dev/null
+++ b/app/_schemas/api/tasks.ts
@@ -0,0 +1,104 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { categoryField, required, searchQuery, timestamp, uuidParam } from "./common";
+import { apiItemSchema, itemIndexParam, kanbanStatusSchema } from "./items";
+
+const STATUS_FIELDS_REQUIRED = "Status id and label are required";
+const STATUS_IDS_UNIQUE = "Status ids must be unique";
+
+const statusField = z
+  .string({ error: STATUS_FIELDS_REQUIRED })
+  .min(1, STATUS_FIELDS_REQUIRED);
+
+export const taskStatusSchema = kanbanStatusSchema
+  .extend({
+    name: z
+      .string()
+      .optional()
+      .describe("Deprecated copy of label, only sent while a task still uses the default columns"),
+  })
+  .register(apiNames, { id: "TaskStatus" });
+
+export const taskSchema = z
+  .object({
+    id: z.string().describe("Task uuid"),
+    title: z.string(),
+    category: z.string(),
+    statuses: z.array(taskStatusSchema),
+    items: z.array(apiItemSchema).optional().describe("Left out of update responses"),
+    createdAt: timestamp.optional(),
+    updatedAt: timestamp.optional(),
+  })
+  .register(apiNames, { id: "Task" });
+
+export const taskListQuery = z.object({
+  category: z.string().optional().describe("Only tasks in this folder"),
+  status: z.string().optional().describe("Only tasks with at least one top-level item in this status id"),
+  q: searchQuery,
+});
+
+const newColumn = z
+  .object({
+    id: required("Status id"),
+    label: z.string().optional(),
+    name: z.string().optional().describe("Deprecated alias for label"),
+    color: z.string().optional(),
+    order: z.number().optional().describe("Defaults to the column's position in the array"),
+    autoComplete: z.boolean().optional().describe("Items moved here are marked completed"),
+  })
+  .refine((column) => Boolean(column.label || column.name), {
+    error: "Status label is required",
+  });
+
+export const taskCreateBody = z.object({
+  title: required("Title"),
+  category: categoryField,
+  statuses: z
+    .array(newColumn)
+    .refine((columns) => new Set(columns.map((column) => column.id)).size === columns.length, {
+      error: STATUS_IDS_UNIQUE,
+    })
+    .optional()
+    .describe("Your own Kanban columns, defaults to todo, in_progress and completed"),
+});
+
+export const taskUpdateBody = z.object({
+  title: z.string().optional(),
+  category: z.string().optional(),
+});
+
+export const taskParams = uuidParam("taskId", "Task");
+
+export const taskItemParams = taskParams.extend({ itemIndex: itemIndexParam });
+
+export const taskStatusParams = taskParams.extend({
+  statusId: z.string().describe("Status id"),
+});
+
+export const statusCreateBody = z.object({
+  id: statusField.describe("Status id, unique within the task"),
+  label: statusField.describe("Column name shown on the board"),
+  color: z.string().optional(),
+  order: z.number().optional().describe("Defaults to last"),
+  autoComplete: z.boolean().optional().describe("Items moved here are marked completed, defaults to false"),
+});
+
+export const statusUpdateBody = z.object({
+  label: z.string().optional(),
+  color: z.string().nullable().optional().describe("null clears the color"),
+  order: z.number().optional(),
+  autoComplete: z.boolean().optional().describe("Items moved here are marked completed"),
+});
+
+export const taskItemCreateBody = z.object({
+  text: required("Text"),
+  status: z.string().optional().describe("Starting status id, defaults to todo"),
+  parentIndex: z
+    .union([z.number().int().nonnegative(), itemIndexParam])
+    .optional()
+    .describe("Tree index of the parent item, e.g. 0 or 2.1"),
+});
+
+export const itemStatusBody = z.object({
+  status: required("Status").describe("Status id to move the item to"),
+});
diff --git a/app/_schemas/api/users.ts b/app/_schemas/api/users.ts
new file mode 100644
index 000000000..c49eefc6b
--- /dev/null
+++ b/app/_schemas/api/users.ts
@@ -0,0 +1,38 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { timestamp } from "./common";
+
+export const userProfileSchema = z
+  .object({
+    username: z.string(),
+    isAdmin: z.boolean(),
+    isSuperAdmin: z.boolean().optional(),
+    createdAt: timestamp.optional(),
+    avatarUrl: z.string().optional(),
+    preferredTheme: z.string().optional(),
+    preferredLocale: z.string().optional(),
+    mfaEnabled: z.boolean().optional(),
+    pinnedLists: z.array(z.string()).optional(),
+    pinnedNotes: z.array(z.string()).optional(),
+  })
+  .loose()
+  .describe("The user record with every secret removed, plus the user's preferences")
+  .register(apiNames, { id: "UserProfile" });
+
+export const publicProfileSchema = z
+  .object({
+    username: z.string(),
+    avatarUrl: z.string().optional(),
+    preferredTheme: z.string().optional(),
+  })
+  .register(apiNames, { id: "PublicUserProfile" });
+
+export const currentUserSchema = z.object({
+  user: userProfileSchema.and(z.object({ lastLogin: timestamp.optional() })),
+});
+
+export const userLookupSchema = z.object({
+  user: z.union([userProfileSchema, publicProfileSchema]),
+});
+
+export const usernameParams = z.object({ username: z.string().describe("Username") });
diff --git a/app/_server/actions/api/index.ts b/app/_server/actions/api/index.ts
index f6dd51ef0..2cf14cc4c 100644
--- a/app/_server/actions/api/index.ts
+++ b/app/_server/actions/api/index.ts
@@ -1,11 +1,22 @@
 "use server";
 
+import { randomBytes, timingSafeEqual } from "crypto";
 import { USERS_FILE } from "@/app/_consts/files";
 import { readJsonFile } from "../file";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { getCurrentUserRecord, mutateUsers } from "@/app/_server/actions/users/records";
 import { Result, User } from "@/app/_types";
 
+const API_KEY_PREFIX = "ck_";
+const API_KEY_BYTES = 16;
+
+const _sameKey = (stored: string | undefined, given: string): boolean => {
+  if (!stored) return false;
+  const a = Buffer.from(stored);
+  const b = Buffer.from(given);
+  return a.length === b.length && timingSafeEqual(a, b);
+};
+
 export const generateApiKey = async (): Promise<Result<string>> => {
   try {
     const currentUser = await getCurrentUser();
@@ -20,11 +31,7 @@ export const generateApiKey = async (): Promise<Result<string>> => {
 
       if (userIndex === -1) return null;
 
-      const prefix = "ck_";
-      const randomBytes = Array.from({ length: 32 }, () =>
-        Math.floor(Math.random() * 16).toString(16)
-      ).join("");
-      const apiKey = prefix + randomBytes;
+      const apiKey = `${API_KEY_PREFIX}${randomBytes(API_KEY_BYTES).toString("hex")}`;
 
       users[userIndex].apiKey = apiKey;
 
@@ -64,10 +71,8 @@ export const authenticateApiKey = async (
       return null;
     }
 
-    const users = await readJsonFile(USERS_FILE);
-    const user = users.find((u: User) => u.apiKey === apiKey);
-
-    return user || null;
+    const users: User[] = await readJsonFile(USERS_FILE);
+    return users.find((u) => _sameKey(u.apiKey, apiKey)) || null;
   } catch (error) {
     console.error("Error authenticating API key:", error);
     return null;
diff --git a/app/_server/actions/checklist-item/rearrange.ts b/app/_server/actions/checklist-item/rearrange.ts
new file mode 100644
index 000000000..a27b930b4
--- /dev/null
+++ b/app/_server/actions/checklist-item/rearrange.ts
@@ -0,0 +1,106 @@
+import path from "path";
+import { revalidatePath } from "next/cache";
+import { ensureDir, serverWriteFile } from "@/app/_server/actions/file";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { canReach } from "@/app/_server/actions/share/queries";
+import { diskPath } from "@/app/_server/actions/share/target";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { listToMarkdown } from "@/app/_utils/checklist-utils";
+import { DropPosition, ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import { Checklist, Item } from "@/app/_types";
+
+export enum Rearranged {
+  MOVED = "moved",
+  UNCHANGED = "unchanged",
+  NO_LIST = "noList",
+  NO_ITEM = "noItem",
+  FORBIDDEN = "forbidden",
+}
+
+export interface ItemMove {
+  listUuid: string;
+  activeItemId: string;
+  overItemId: string;
+  position: DropPosition;
+  isDropInto: boolean;
+}
+
+type Located = { item: Item; siblings: Item[]; index: number };
+
+const _findInTree = (items: Item[], id: string): Located | null => {
+  for (let i = 0; i < items.length; i++) {
+    if (items[i].id === id) return { item: items[i], siblings: items, index: i };
+    const found = items[i].children ? _findInTree(items[i].children!, id) : null;
+    if (found) return found;
+  }
+  return null;
+};
+
+const _isDescendant = (ancestorId: string, targetId: string, items: Item[]): boolean => {
+  const walk = (item: Item): boolean =>
+    (item.children || []).some((child) => child.id === targetId || walk(child));
+  const ancestor = _findInTree(items, ancestorId);
+  return ancestor ? walk(ancestor.item) : false;
+};
+
+const _stampOrder = (items: Item[]) =>
+  items.forEach((item, i) => {
+    item.order = i;
+    if (item.children) _stampOrder(item.children);
+  });
+
+const _cloneTree = (items: Item[]): Item[] =>
+  items.map((item) => ({ ...item, children: item.children ? _cloneTree(item.children) : undefined }));
+
+const _move = (items: Item[], move: ItemMove): Rearranged => {
+  if (move.activeItemId === move.overItemId) return Rearranged.UNCHANGED;
+  if (_isDescendant(move.activeItemId, move.overItemId, items)) return Rearranged.UNCHANGED;
+
+  const active = _findInTree(items, move.activeItemId);
+  const over = _findInTree(items, move.overItemId);
+  if (!active || !over) return Rearranged.NO_ITEM;
+
+  active.siblings.splice(active.index, 1);
+
+  if (move.isDropInto) {
+    over.item.children = [...(over.item.children || []), active.item];
+  } else {
+    const landing = over.siblings.findIndex((item) => item.id === move.overItemId);
+    over.siblings.splice(move.position === DropPosition.AFTER ? landing + 1 : landing, 0, active.item);
+  }
+
+  _stampOrder(items);
+  return Rearranged.MOVED;
+};
+
+const _announce = async (list: Checklist, username: string) => {
+  try {
+    revalidatePath("/");
+    revalidatePath(`/checklist/${list.uuid}`);
+  } catch (error) {
+    console.warn("Cache revalidation failed, but data was saved successfully:", error);
+  }
+  await broadcast({ type: "checklist", action: "updated", entityId: list.uuid, username });
+};
+
+export const rearrangeItems = (username: string, move: ItemMove): Promise<Rearranged> =>
+  runQueued(itemLane(Modes.CHECKLISTS, move.listUuid), async () => {
+    const list = await getListById(move.listUuid, username);
+    if (!list) return Rearranged.NO_LIST;
+
+    if (!(await canReach(list.uuid, ItemTypes.CHECKLIST, username, PermissionTypes.EDIT))) {
+      return Rearranged.FORBIDDEN;
+    }
+
+    const items = _cloneTree(list.items || []);
+    const outcome = _move(items, move);
+    if (outcome !== Rearranged.MOVED) return outcome;
+
+    const filePath = await diskPath(Modes.CHECKLISTS, username, list);
+    await ensureDir(path.dirname(filePath));
+    await serverWriteFile(filePath, listToMarkdown({ ...list, items, updatedAt: new Date().toISOString() }));
+    await _announce(list, username);
+
+    return Rearranged.MOVED;
+  });
diff --git a/app/_server/actions/checklist-item/reorder.ts b/app/_server/actions/checklist-item/reorder.ts
index 449ecf58d..9198bceb0 100644
--- a/app/_server/actions/checklist-item/reorder.ts
+++ b/app/_server/actions/checklist-item/reorder.ts
@@ -1,174 +1,34 @@
 "use server";
 
-import { revalidatePath } from "next/cache";
-import path from "path";
-import {
-  serverWriteFile,
-  ensureDir,
-} from "@/app/_server/actions/file";
-import { getListById } from "@/app/_server/actions/checklist/queries";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { getUsername } from "@/app/_server/actions/users";
-import { canReach } from "@/app/_server/actions/share/queries";
-import { diskPath } from "@/app/_server/actions/share/target";
-import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
-import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { DropPosition } from "@/app/_types/enums";
+import { Rearranged, rearrangeItems } from "./rearrange";
 
-const _reorderItems = async (formData: FormData) => {
-  try {
-    const uuid = formData.get("uuid") as string;
-    const activeItemId = formData.get("activeItemId") as string;
-    const overItemId = formData.get("overItemId") as string;
-    const isDropInto = formData.get("isDropInto") === "true";
-    const position = (formData.get("position") as string) || "before";
-
-    const currentUser = await getUsername();
-
-    if (!uuid || !activeItemId) {
-      return { success: false, error: "List uuid and item ID are required" };
-    }
-
-    const list = await getListById(uuid, currentUser);
-    if (!list) {
-      throw new Error("List not found");
-    }
-
-    const canEdit = await canReach(
-      list.uuid!,
-      ItemTypes.CHECKLIST,
-      currentUser,
-      PermissionTypes.EDIT
-    );
-
-    if (!canEdit) {
-      throw new Error("Permission denied");
-    }
-
-    const findItemWithParent = (
-      items: any[],
-      targetId: string,
-      parent: any = null
-    ): { item: any; parent: any; siblings: any[]; index: number } | null => {
-      for (let i = 0; i < items.length; i++) {
-        const item = items[i];
-        if (item.id === targetId) {
-          return { item, parent, siblings: items, index: i };
-        }
-        if (item.children) {
-          const found = findItemWithParent(item.children, targetId, item);
-          if (found) return found;
-        }
-      }
-      return null;
-    };
-
-    const cloneItems = (items: any[]): any[] => {
-      return items.map((item) => ({
-        ...item,
-        children: item.children ? cloneItems(item.children) : undefined,
-      }));
-    };
-
-    const isDescendantOf = (
-      ancestorId: string,
-      descendantId: string,
-      items: any[]
-    ): boolean => {
-      const findItem = (items: any[], id: string): any | null => {
-        for (const item of items) {
-          if (item.id === id) return item;
-          if (item.children) {
-            const found = findItem(item.children, id);
-            if (found) return found;
-          }
-        }
-        return null;
-      };
-
-      const checkDescendant = (item: any, targetId: string): boolean => {
-        if (!item.children) return false;
-        for (const child of item.children) {
-          if (child.id === targetId) return true;
-          if (checkDescendant(child, targetId)) return true;
-        }
-        return false;
-      };
-
-      const ancestor = findItem(items, ancestorId);
-      return ancestor ? checkDescendant(ancestor, descendantId) : false;
-    };
-
-    if (isDescendantOf(activeItemId, overItemId, list.items || [])) {
-      return { success: true };
-    }
+const FAILED = "Failed to reorder items";
 
-    const newItems = cloneItems(list.items || []);
+const DONE = new Set([Rearranged.MOVED, Rearranged.UNCHANGED]);
 
-    const activeInfo = findItemWithParent(newItems, activeItemId);
-    const overInfo = findItemWithParent(newItems, overItemId);
+export const reorderItems = async (formData: FormData) => {
+  const uuid = formData.get("uuid") as string;
+  const activeItemId = formData.get("activeItemId") as string;
 
-    if (!activeInfo || !overInfo) {
-      throw new Error("Item not found in hierarchy");
-    }
-
-    activeInfo.siblings.splice(activeInfo.index, 1);
-
-    if (isDropInto) {
-      if (!overInfo.item.children) {
-        overInfo.item.children = [];
-      }
-      overInfo.item.children.push(activeInfo.item);
-    } else {
-      const targetSiblings = overInfo.siblings;
-      let newIndex = targetSiblings.findIndex((item) => item.id === overItemId);
-      if (position === "after") {
-        newIndex = newIndex + 1;
-      }
-      targetSiblings.splice(newIndex, 0, activeInfo.item);
-    }
-
-    const updateOrder = (items: any[]) => {
-      items.forEach((item, idx) => {
-        item.order = idx;
-        if (item.children) updateOrder(item.children);
-      });
-    };
-    updateOrder(newItems);
-
-    const updatedList = {
-      ...list,
-      items: newItems,
-      updatedAt: new Date().toISOString(),
-    };
-
-    const filePath = await diskPath(Modes.CHECKLISTS, currentUser, list);
-    await ensureDir(path.dirname(filePath));
-
-    const markdownContent = listToMarkdown(updatedList as any);
-
-    await serverWriteFile(filePath, markdownContent);
-
-    try {
-      revalidatePath("/");
-      revalidatePath(`/checklist/${list.uuid}`);
-    } catch (error) {
-      console.warn(
-        "Cache revalidation failed, but data was saved successfully:",
-        error
-      );
-    }
-
-    await broadcast({ type: "checklist", action: "updated", entityId: list.uuid, username: currentUser });
+  if (!uuid || !activeItemId) {
+    return { success: false, error: "List uuid and item ID are required" };
+  }
 
-    return { success: true };
+  try {
+    const outcome = await rearrangeItems(await getUsername(), {
+      listUuid: uuid,
+      activeItemId,
+      overItemId: formData.get("overItemId") as string,
+      isDropInto: formData.get("isDropInto") === "true",
+      position: formData.get("position") === DropPosition.AFTER ? DropPosition.AFTER : DropPosition.BEFORE,
+    });
+    if (DONE.has(outcome)) return { success: true };
+    console.error(`Error reordering items: ${outcome}`);
+    return { success: false, error: FAILED };
   } catch (error) {
     console.error("Error reordering items:", error);
-    return { success: false, error: "Failed to reorder items" };
+    return { success: false, error: FAILED };
   }
 };
-
-export const reorderItems = async (formData: FormData) =>
-  runQueued(itemLane(Modes.CHECKLISTS, formData.get("uuid") as string), () =>
-    _reorderItems(formData),
-  );
diff --git a/app/_server/actions/checklist/creator.ts b/app/_server/actions/checklist/creator.ts
index 42ea88d84..8731aef29 100644
--- a/app/_server/actions/checklist/creator.ts
+++ b/app/_server/actions/checklist/creator.ts
@@ -1,5 +1,5 @@
 import path from "path";
-import { Checklist, ChecklistType, SanitisedUser } from "@/app/_types";
+import { Checklist, ChecklistType, KanbanStatus, SanitisedUser } from "@/app/_types";
 import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
 import { ensureDir, serverWriteFile } from "@/app/_server/actions/file";
 import { generateUniqueFilename } from "@/app/_utils/filename-utils";
@@ -20,6 +20,7 @@ import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 export const makeList = async (
   actor: SanitisedUser,
   formData: FormData,
+  statuses?: KanbanStatus[],
 ): Promise<{ success?: boolean; data?: Checklist; error?: string }> => {
   try {
     const title = formData.get("title") as string;
@@ -60,6 +61,7 @@ export const makeList = async (
       createdAt: new Date().toISOString(),
       updatedAt: new Date().toISOString(),
       owner: target.owner,
+      ...(statuses?.length ? { statuses } : {}),
     };
 
     await serverWriteFile(filePath, listToMarkdown(newList));
diff --git a/app/_server/actions/export/builders.ts b/app/_server/actions/export/builders.ts
new file mode 100644
index 000000000..de3b3e36c
--- /dev/null
+++ b/app/_server/actions/export/builders.ts
@@ -0,0 +1,295 @@
+import archiver from "archiver";
+import * as fs from "fs";
+import fsp from "fs/promises";
+import path from "path";
+import { ExportResult, ExportProgress } from "@/app/_types";
+import { DATA_DIR, USERS_FILE, EXPORT_TEMP_DIR } from "@/app/_consts/files";
+import { getAllLists } from "@/app/_server/actions/checklist/queries";
+import { getAllNotes } from "@/app/_server/actions/note/queries";
+import { readJsonFile, ensureDir } from "@/app/_server/actions/file";
+import { User } from "@/app/_types";
+import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
+import { NOTES_FOLDER } from "@/app/_consts/notes";
+
+let exportProgress: ExportProgress = {
+  progress: 0,
+  message: "Starting export...",
+};
+
+const updateProgress = (progress: number, message: string) => {
+  exportProgress = { progress, message };
+};
+
+export const readExportProgress = (): ExportProgress => exportProgress;
+
+const zipDirectory = async (
+  sourceDir: string,
+  outPath: string,
+  updateProgress: (progress: number, message: string) => void,
+  excludeTempExports: boolean = false,
+): Promise<void> => {
+  await ensureDir(path.dirname(outPath));
+  const archive = archiver("zip", { zlib: { level: 9 } });
+  const stream = fs.createWriteStream(outPath);
+
+  return new Promise((resolve, reject) => {
+    stream.on("close", () => {
+      resolve();
+    });
+    archive.on("error", (err: Error) => {
+      console.error("Archiver error:", err);
+      reject(err);
+    });
+
+    archive.pipe(stream);
+
+    let totalBytes = 0;
+
+    archive.on("progress", (progress: archiver.ProgressData) => {
+      totalBytes = progress.entries.total;
+      const transferredBytes = progress.entries.processed;
+      const currentProgress =
+        totalBytes > 0 ? Math.round((transferredBytes / totalBytes) * 100) : 0;
+      updateProgress(
+        currentProgress,
+        `Zipping files: ${transferredBytes}/${totalBytes} bytes`,
+      );
+    });
+
+    if (excludeTempExports) {
+      archive.glob("**/*", {
+        cwd: sourceDir,
+        ignore: ["temp_exports/**"],
+      });
+    } else {
+      archive.directory(sourceDir, false);
+    }
+
+    archive.finalize();
+  });
+};
+
+export const buildAllContent = async (): Promise<ExportResult> => {
+  updateProgress(0, "Preparing all checklists and notes for export...");
+  try {
+    const tempExportPath = path.join(
+      process.cwd(),
+      EXPORT_TEMP_DIR,
+      `all_checklists_notes_${Date.now()}.zip`,
+    );
+    const tempContentDir = path.join(
+      process.cwd(),
+      EXPORT_TEMP_DIR,
+      `content_${Date.now()}`,
+    );
+    await ensureDir(tempContentDir);
+
+    const allListsResult = await getAllLists();
+    const allNotesResult = await getAllNotes();
+
+    if (!allListsResult.success || !allNotesResult.success) {
+      throw new Error("Failed to retrieve checklists or notes.");
+    }
+
+    for (const list of allListsResult.data!) {
+      const userDir = path.join(
+        tempContentDir,
+        CHECKLISTS_FOLDER,
+        list.owner || "unknown_user",
+        list.category || "Uncategorized",
+      );
+      await ensureDir(userDir);
+      await fsp.writeFile(
+        path.join(userDir, `${list.id}.json`),
+        JSON.stringify(list, null, 2),
+        "utf-8",
+      );
+    }
+
+    for (const note of allNotesResult.data!) {
+      const userDir = path.join(
+        tempContentDir,
+        NOTES_FOLDER,
+        note.owner || "unknown_user",
+        note.category || "Uncategorized",
+      );
+      await ensureDir(userDir);
+      await fsp.writeFile(
+        path.join(userDir, `${note.id}.json`),
+        JSON.stringify(note, null, 2),
+        "utf-8",
+      );
+    }
+
+    updateProgress(50, "Compressing all checklists and notes...");
+    await zipDirectory(tempContentDir, tempExportPath, updateProgress);
+    await fsp.rm(tempContentDir, { recursive: true, force: true });
+
+    updateProgress(100, "Export completed.");
+    return {
+      success: true,
+      downloadUrl: `/api/exports/${path.basename(tempExportPath)}`,
+    };
+  } catch (error: any) {
+    console.error("Error exporting all checklists and notes:", error);
+    updateProgress(100, "Export failed.");
+    return {
+      success: false,
+      error: error.message || "Failed to export all checklists and notes.",
+    };
+  }
+};
+
+export const buildUserContent = async (
+  username: string,
+): Promise<ExportResult> => {
+  updateProgress(
+    0,
+    `Preparing ${username}'s checklists and notes for export...`,
+  );
+  try {
+    const tempExportPath = path.join(
+      process.cwd(),
+      EXPORT_TEMP_DIR,
+      `${username}_content_${Date.now()}.zip`,
+    );
+    const tempUserContentDir = path.join(
+      process.cwd(),
+      EXPORT_TEMP_DIR,
+      `user_content_${username}_${Date.now()}`,
+    );
+    await ensureDir(tempUserContentDir);
+
+    const allListsResult = await getAllLists();
+    const allNotesResult = await getAllNotes();
+
+    if (!allListsResult.success || !allNotesResult.success) {
+      throw new Error("Failed to retrieve checklists or notes.");
+    }
+
+    const userLists = allListsResult.data!.filter(
+      (list) => list.owner === username,
+    );
+    const userNotes = allNotesResult.data!.filter(
+      (note) => note.owner === username,
+    );
+
+    for (const list of userLists) {
+      const userDir = path.join(
+        tempUserContentDir,
+        CHECKLISTS_FOLDER,
+        list.category || "Uncategorized",
+      );
+      await ensureDir(userDir);
+      await fsp.writeFile(
+        path.join(userDir, `${list.id}.json`),
+        JSON.stringify(list, null, 2),
+        "utf-8",
+      );
+    }
+
+    for (const note of userNotes) {
+      const userDir = path.join(
+        tempUserContentDir,
+        NOTES_FOLDER,
+        note.category || "Uncategorized",
+      );
+      await ensureDir(userDir);
+      await fsp.writeFile(
+        path.join(userDir, `${note.id}.json`),
+        JSON.stringify(note, null, 2),
+        "utf-8",
+      );
+    }
+
+    updateProgress(50, `Compressing ${username}'s checklists and notes...`);
+    await zipDirectory(tempUserContentDir, tempExportPath, updateProgress);
+    await fsp.rm(tempUserContentDir, { recursive: true, force: true });
+
+    updateProgress(100, "Export completed.");
+    return {
+      success: true,
+      downloadUrl: `/api/exports/${path.basename(tempExportPath)}`,
+    };
+  } catch (error: any) {
+    console.error(`Error exporting ${username}'s checklists and notes:`, error);
+    updateProgress(100, "Export failed.");
+    return {
+      success: false,
+      error:
+        error.message || `Failed to export ${username}'s checklists and notes.`,
+    };
+  }
+};
+
+export const buildAllUsers = async (): Promise<ExportResult> => {
+  updateProgress(0, "Preparing all user data for export...");
+  try {
+    const tempExportPath = path.join(
+      process.cwd(),
+      EXPORT_TEMP_DIR,
+      `all_users_data_${Date.now()}.zip`,
+    );
+    const tempUserDir = path.join(
+      process.cwd(),
+      EXPORT_TEMP_DIR,
+      `users_data_${Date.now()}`,
+    );
+    await ensureDir(tempUserDir);
+
+    const users: User[] = await readJsonFile(USERS_FILE);
+    await fsp.writeFile(
+      path.join(tempUserDir, "users.json"),
+      JSON.stringify(users, null, 2),
+      "utf-8",
+    );
+
+    updateProgress(50, "Compressing all user data...");
+    await zipDirectory(tempUserDir, tempExportPath, updateProgress);
+    await fsp.rm(tempUserDir, { recursive: true, force: true });
+
+    updateProgress(100, "Export completed.");
+    return {
+      success: true,
+      downloadUrl: `/api/exports/${path.basename(tempExportPath)}`,
+    };
+  } catch (error: any) {
+    console.error("Error exporting all user data:", error);
+    updateProgress(100, "Export failed.");
+    return {
+      success: false,
+      error: error.message || "Failed to export all user data.",
+    };
+  }
+};
+
+export const buildWholeData = async (): Promise<ExportResult> => {
+  updateProgress(0, "Preparing the whole data folder for export...");
+  try {
+    const dataFolderPath = path.join(process.cwd(), DATA_DIR);
+    const tempExportPath = path.join(
+      process.cwd(),
+      EXPORT_TEMP_DIR,
+      `whole_data_folder_${Date.now()}.zip`,
+    );
+
+    await ensureDir(path.join(process.cwd(), EXPORT_TEMP_DIR));
+
+    updateProgress(50, "Compressing the whole data folder...");
+    await zipDirectory(dataFolderPath, tempExportPath, updateProgress, true);
+
+    updateProgress(100, "Export completed.");
+    return {
+      success: true,
+      downloadUrl: `/api/exports/${path.basename(tempExportPath)}`,
+    };
+  } catch (error: any) {
+    console.error("Error exporting whole data folder:", error);
+    console.error(error.stack);
+    updateProgress(100, "Export failed.");
+    return {
+      success: false,
+      error: error.message || "Failed to export whole data folder.",
+    };
+  }
+};
diff --git a/app/_server/actions/export/index.ts b/app/_server/actions/export/index.ts
index bd126593a..2ea8a8117 100644
--- a/app/_server/actions/export/index.ts
+++ b/app/_server/actions/export/index.ts
@@ -1,160 +1,34 @@
 "use server";
 
-import archiver from "archiver";
-import * as fs from "fs";
-import fsp from "fs/promises";
-import path from "path";
-import { ExportResult, ExportProgress } from "@/app/_types";
-import { DATA_DIR, USERS_FILE, EXPORT_TEMP_DIR } from "@/app/_consts/files";
-import { getAllLists } from "@/app/_server/actions/checklist/queries";
-import { getAllNotes } from "@/app/_server/actions/note/queries";
-import { readJsonFile, ensureDir } from "@/app/_server/actions/file";
+import { ExportProgress, ExportResult } from "@/app/_types";
 import {
   getCurrentUser,
   canAccessAllContent,
 } from "@/app/_server/actions/users";
-import { User } from "@/app/_types";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
-import { NOTES_FOLDER } from "@/app/_consts/notes";
-
-let exportProgress: ExportProgress = {
-  progress: 0,
-  message: "Starting export...",
-};
-
-const updateProgress = (progress: number, message: string) => {
-  exportProgress = { progress, message };
-};
-
-export const getExportProgress = async (): Promise<ExportProgress> => {
-  return exportProgress;
-};
-
-const zipDirectory = async (
-  sourceDir: string,
-  outPath: string,
-  updateProgress: (progress: number, message: string) => void,
-  excludeTempExports: boolean = false,
-): Promise<void> => {
-  await ensureDir(path.dirname(outPath));
-  const archive = archiver("zip", { zlib: { level: 9 } });
-  const stream = fs.createWriteStream(outPath);
-
-  return new Promise((resolve, reject) => {
-    stream.on("close", () => {
-      resolve();
-    });
-    archive.on("error", (err: Error) => {
-      console.error("Archiver error:", err);
-      reject(err);
-    });
-
-    archive.pipe(stream);
-
-    let totalBytes = 0;
-
-    archive.on("progress", (progress: archiver.ProgressData) => {
-      totalBytes = progress.entries.total;
-      const transferredBytes = progress.entries.processed;
-      const currentProgress =
-        totalBytes > 0 ? Math.round((transferredBytes / totalBytes) * 100) : 0;
-      updateProgress(
-        currentProgress,
-        `Zipping files: ${transferredBytes}/${totalBytes} bytes`,
-      );
-    });
-
-    if (excludeTempExports) {
-      archive.glob("**/*", {
-        cwd: sourceDir,
-        ignore: ["temp_exports/**"],
-      });
-    } else {
-      archive.directory(sourceDir, false);
-    }
-
-    archive.finalize();
-  });
-};
-
-export const exportAllChecklistsNotes = async (): Promise<ExportResult> => {
-  const hasAccess = await canAccessAllContent();
-  if (!hasAccess) {
-    return {
-      success: false,
-      error: "Forbidden: Admin access with content permissions required",
-    };
-  }
-
-  updateProgress(0, "Preparing all checklists and notes for export...");
-  try {
-    const tempExportPath = path.join(
-      process.cwd(),
-      EXPORT_TEMP_DIR,
-      `all_checklists_notes_${Date.now()}.zip`,
-    );
-    const tempContentDir = path.join(
-      process.cwd(),
-      EXPORT_TEMP_DIR,
-      `content_${Date.now()}`,
-    );
-    await ensureDir(tempContentDir);
+import {
+  buildAllContent,
+  buildAllUsers,
+  buildUserContent,
+  buildWholeData,
+  readExportProgress,
+} from "./builders";
 
-    const allListsResult = await getAllLists();
-    const allNotesResult = await getAllNotes();
+const ADMIN_ONLY = "Forbidden: Admin access with content permissions required";
+const OWN_ONLY = "Forbidden: You can only export your own data";
 
-    if (!allListsResult.success || !allNotesResult.success) {
-      throw new Error("Failed to retrieve checklists or notes.");
-    }
+const _asAdmin = async (build: () => Promise<ExportResult>): Promise<ExportResult> =>
+  (await canAccessAllContent()) ? build() : { success: false, error: ADMIN_ONLY };
 
-    for (const list of allListsResult.data!) {
-      const userDir = path.join(
-        tempContentDir,
-        CHECKLISTS_FOLDER,
-        list.owner || "unknown_user",
-        list.category || "Uncategorized",
-      );
-      await ensureDir(userDir);
-      await fsp.writeFile(
-        path.join(userDir, `${list.id}.json`),
-        JSON.stringify(list, null, 2),
-        "utf-8",
-      );
-    }
+export const getExportProgress = async (): Promise<ExportProgress> => readExportProgress();
 
-    for (const note of allNotesResult.data!) {
-      const userDir = path.join(
-        tempContentDir,
-        NOTES_FOLDER,
-        note.owner || "unknown_user",
-        note.category || "Uncategorized",
-      );
-      await ensureDir(userDir);
-      await fsp.writeFile(
-        path.join(userDir, `${note.id}.json`),
-        JSON.stringify(note, null, 2),
-        "utf-8",
-      );
-    }
+export const exportAllChecklistsNotes = async (): Promise<ExportResult> =>
+  _asAdmin(buildAllContent);
 
-    updateProgress(50, "Compressing all checklists and notes...");
-    await zipDirectory(tempContentDir, tempExportPath, updateProgress);
-    await fsp.rm(tempContentDir, { recursive: true, force: true });
+export const exportAllUsersData = async (): Promise<ExportResult> =>
+  _asAdmin(buildAllUsers);
 
-    updateProgress(100, "Export completed.");
-    return {
-      success: true,
-      downloadUrl: `/api/exports/${path.basename(tempExportPath)}`,
-    };
-  } catch (error: any) {
-    console.error("Error exporting all checklists and notes:", error);
-    updateProgress(100, "Export failed.");
-    return {
-      success: false,
-      error: error.message || "Failed to export all checklists and notes.",
-    };
-  }
-};
+export const exportWholeDataFolder = async (): Promise<ExportResult> =>
+  _asAdmin(buildWholeData);
 
 export const exportUserChecklistsNotes = async (
   username: string,
@@ -164,179 +38,9 @@ export const exportUserChecklistsNotes = async (
     return { success: false, error: "Not authenticated" };
   }
 
-  if (username !== currentUser.username) {
-    const hasAccess = await canAccessAllContent();
-    if (!hasAccess) {
-      return {
-        success: false,
-        error: "Forbidden: You can only export your own data",
-      };
-    }
-  }
-
-  updateProgress(
-    0,
-    `Preparing ${username}'s checklists and notes for export...`,
-  );
-  try {
-    const tempExportPath = path.join(
-      process.cwd(),
-      EXPORT_TEMP_DIR,
-      `${username}_content_${Date.now()}.zip`,
-    );
-    const tempUserContentDir = path.join(
-      process.cwd(),
-      EXPORT_TEMP_DIR,
-      `user_content_${username}_${Date.now()}`,
-    );
-    await ensureDir(tempUserContentDir);
-
-    const allListsResult = await getAllLists();
-    const allNotesResult = await getAllNotes();
-
-    if (!allListsResult.success || !allNotesResult.success) {
-      throw new Error("Failed to retrieve checklists or notes.");
-    }
-
-    const userLists = allListsResult.data!.filter(
-      (list) => list.owner === username,
-    );
-    const userNotes = allNotesResult.data!.filter(
-      (note) => note.owner === username,
-    );
-
-    for (const list of userLists) {
-      const userDir = path.join(
-        tempUserContentDir,
-        CHECKLISTS_FOLDER,
-        list.category || "Uncategorized",
-      );
-      await ensureDir(userDir);
-      await fsp.writeFile(
-        path.join(userDir, `${list.id}.json`),
-        JSON.stringify(list, null, 2),
-        "utf-8",
-      );
-    }
-
-    for (const note of userNotes) {
-      const userDir = path.join(
-        tempUserContentDir,
-        NOTES_FOLDER,
-        note.category || "Uncategorized",
-      );
-      await ensureDir(userDir);
-      await fsp.writeFile(
-        path.join(userDir, `${note.id}.json`),
-        JSON.stringify(note, null, 2),
-        "utf-8",
-      );
-    }
-
-    updateProgress(50, `Compressing ${username}'s checklists and notes...`);
-    await zipDirectory(tempUserContentDir, tempExportPath, updateProgress);
-    await fsp.rm(tempUserContentDir, { recursive: true, force: true });
-
-    updateProgress(100, "Export completed.");
-    return {
-      success: true,
-      downloadUrl: `/api/exports/${path.basename(tempExportPath)}`,
-    };
-  } catch (error: any) {
-    console.error(`Error exporting ${username}'s checklists and notes:`, error);
-    updateProgress(100, "Export failed.");
-    return {
-      success: false,
-      error:
-        error.message || `Failed to export ${username}'s checklists and notes.`,
-    };
-  }
-};
-
-export const exportAllUsersData = async (): Promise<ExportResult> => {
-  const hasAccess = await canAccessAllContent();
-  if (!hasAccess) {
-    return {
-      success: false,
-      error: "Forbidden: Admin access with content permissions required",
-    };
-  }
-
-  updateProgress(0, "Preparing all user data for export...");
-  try {
-    const tempExportPath = path.join(
-      process.cwd(),
-      EXPORT_TEMP_DIR,
-      `all_users_data_${Date.now()}.zip`,
-    );
-    const tempUserDir = path.join(
-      process.cwd(),
-      EXPORT_TEMP_DIR,
-      `users_data_${Date.now()}`,
-    );
-    await ensureDir(tempUserDir);
-
-    const users: User[] = await readJsonFile(USERS_FILE);
-    await fsp.writeFile(
-      path.join(tempUserDir, "users.json"),
-      JSON.stringify(users, null, 2),
-      "utf-8",
-    );
-
-    updateProgress(50, "Compressing all user data...");
-    await zipDirectory(tempUserDir, tempExportPath, updateProgress);
-    await fsp.rm(tempUserDir, { recursive: true, force: true });
-
-    updateProgress(100, "Export completed.");
-    return {
-      success: true,
-      downloadUrl: `/api/exports/${path.basename(tempExportPath)}`,
-    };
-  } catch (error: any) {
-    console.error("Error exporting all user data:", error);
-    updateProgress(100, "Export failed.");
-    return {
-      success: false,
-      error: error.message || "Failed to export all user data.",
-    };
+  if (username !== currentUser.username && !(await canAccessAllContent())) {
+    return { success: false, error: OWN_ONLY };
   }
-};
 
-export const exportWholeDataFolder = async (): Promise<ExportResult> => {
-  const hasAccess = await canAccessAllContent();
-  if (!hasAccess) {
-    return {
-      success: false,
-      error: "Forbidden: Admin access with content permissions required",
-    };
-  }
-
-  updateProgress(0, "Preparing the whole data folder for export...");
-  try {
-    const dataFolderPath = path.join(process.cwd(), DATA_DIR);
-    const tempExportPath = path.join(
-      process.cwd(),
-      EXPORT_TEMP_DIR,
-      `whole_data_folder_${Date.now()}.zip`,
-    );
-
-    await ensureDir(path.join(process.cwd(), EXPORT_TEMP_DIR));
-
-    updateProgress(50, "Compressing the whole data folder...");
-    await zipDirectory(dataFolderPath, tempExportPath, updateProgress, true);
-
-    updateProgress(100, "Export completed.");
-    return {
-      success: true,
-      downloadUrl: `/api/exports/${path.basename(tempExportPath)}`,
-    };
-  } catch (error: any) {
-    console.error("Error exporting whole data folder:", error);
-    console.error(error.stack);
-    updateProgress(100, "Export failed.");
-    return {
-      success: false,
-      error: error.message || "Failed to export whole data folder.",
-    };
-  }
+  return buildUserContent(username);
 };
diff --git a/app/_server/actions/kanban/tweaker.ts b/app/_server/actions/kanban/tweaker.ts
index e3d60172d..72ce6806c 100644
--- a/app/_server/actions/kanban/tweaker.ts
+++ b/app/_server/actions/kanban/tweaker.ts
@@ -8,7 +8,8 @@ import {
 } from "@/app/_types/enums";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { reachableFile } from "@/app/_server/actions/share/queries";
+import { canReach, reachableFile } from "@/app/_server/actions/share/queries";
+import { findUserRecord } from "@/app/_server/actions/users/records";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { getListById } from "@/app/_server/actions/checklist/queries";
 import { notifyUser } from "@/app/_server/actions/notifications/internal";
@@ -78,6 +79,15 @@ export const tweakItem = async (
     _tweakItem(actor, uuid, itemId, patch),
   );
 
+export const UNKNOWN_ASSIGNEE = "Assignee not found";
+export const BLIND_ASSIGNEE = "Assignee can't see this board";
+
+const _assigneeRefusal = async (assignee: string, uuid: string): Promise<string | null> => {
+  if (!(await findUserRecord(assignee))) return UNKNOWN_ASSIGNEE;
+  const sees = await canReach(uuid, ItemTypes.CHECKLIST, assignee, PermissionTypes.READ);
+  return sees ? null : BLIND_ASSIGNEE;
+};
+
 export const assignItem = async (
   actor: SanitisedUser,
   uuid: string,
@@ -85,6 +95,9 @@ export const assignItem = async (
   assignee: string,
 ): Promise<Result<Checklist>> => {
   try {
+    const refusal = assignee ? await _assigneeRefusal(assignee, uuid) : null;
+    if (refusal) return { success: false, error: refusal };
+
     const result = await tweakItem(actor, uuid, itemId, {
       assignee: assignee || undefined,
     });
diff --git a/app/_server/actions/lib/audit-trail.ts b/app/_server/actions/lib/audit-trail.ts
new file mode 100644
index 000000000..6d1e48fc5
--- /dev/null
+++ b/app/_server/actions/lib/audit-trail.ts
@@ -0,0 +1,67 @@
+import fs from "fs/promises";
+import { getDailyLogPath, getDateRange } from "@/app/_server/actions/log";
+import { readJsonFile } from "@/app/_server/actions/file";
+import { USERS_FILE } from "@/app/_consts/files";
+import { LOG_WINDOW_DAYS } from "@/app/_consts/logs";
+import { AuditCategory, AuditLogEntry, AuditLogLevel, User } from "@/app/_types";
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+export interface LogWindow {
+  startDate?: string;
+  endDate?: string;
+}
+
+export interface LogSieve {
+  action?: string;
+  category?: AuditCategory;
+  level?: AuditLogLevel;
+  success?: boolean;
+}
+
+const _readDay = async (username: string, date: Date): Promise<AuditLogEntry[]> => {
+  const logPath = await getDailyLogPath(username, date);
+  try {
+    return JSON.parse(await fs.readFile(logPath, "utf-8"));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+      console.error(`Unreadable audit log ${logPath}:`, error);
+    }
+    return [];
+  }
+};
+
+export const everyUsername = async (): Promise<string[]> => {
+  const users: User[] = await readJsonFile(USERS_FILE);
+  return users.map((user) => user.username);
+};
+
+export const digUpLogs = async (
+  usernames: string[],
+  { startDate, endDate }: LogWindow = {},
+): Promise<AuditLogEntry[]> => {
+  const end = endDate ? new Date(endDate) : new Date();
+  const start = startDate ? new Date(startDate) : new Date(end.getTime() - LOG_WINDOW_DAYS * DAY_MS);
+  const dates = await getDateRange(start, end);
+
+  const logs: AuditLogEntry[] = [];
+  for (const username of usernames) {
+    const days = await Promise.all(dates.map((date) => _readDay(username, date)));
+    logs.push(...days.flat());
+  }
+  return logs;
+};
+
+export const newestFirst = (logs: AuditLogEntry[]) =>
+  [...logs].sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
+
+export const sieveLogs = (logs: AuditLogEntry[], sieve: LogSieve) =>
+  newestFirst(
+    logs.filter(
+      (log) =>
+        (!sieve.action || log.action === sieve.action) &&
+        (!sieve.category || log.category === sieve.category) &&
+        (!sieve.level || log.level === sieve.level) &&
+        (sieve.success === undefined || log.success === sieve.success),
+    ),
+  );
diff --git a/app/_server/api/contract.ts b/app/_server/api/contract.ts
new file mode 100644
index 000000000..db78e79f8
--- /dev/null
+++ b/app/_server/api/contract.ts
@@ -0,0 +1,101 @@
+import type { NextRequest } from "next/server";
+import type { z } from "zod";
+import type { SanitisedUser } from "@/app/_types";
+
+export enum HttpMethod {
+  GET = "get",
+  POST = "post",
+  PUT = "put",
+  PATCH = "patch",
+  DELETE = "delete",
+}
+
+export enum ApiTag {
+  SYSTEM = "System",
+  NOTES = "Notes",
+  CHECKLISTS = "Checklists",
+  CHECKLIST_ITEMS = "Checklist items",
+  TASKS = "Tasks",
+  KANBAN = "Kanban",
+  DISCOVERY = "Discovery",
+  USERS = "Users",
+  EXPORTS = "Exports",
+  LOGS = "Logs",
+  ADMIN = "Admin",
+}
+
+export enum RouteAuth {
+  API_KEY = "apiKey",
+  SESSION_OR_KEY = "sessionOrKey",
+  PUBLIC = "public",
+}
+
+export enum MediaType {
+  JSON = "application/json",
+  YAML = "application/yaml",
+  ZIP = "application/zip",
+  CSV = "text/csv",
+  CALENDAR = "text/calendar",
+  BINARY = "application/octet-stream",
+}
+
+export interface ResponseBody {
+  mediaType: MediaType;
+  schema?: z.ZodType;
+}
+
+export interface ResponseSpec {
+  description: string;
+  schema?: z.ZodType;
+  mediaType?: MediaType;
+  alternatives?: ResponseBody[];
+}
+
+export type Schema = z.ZodType | undefined;
+
+export interface RouteContract<
+  P extends Schema = undefined,
+  Q extends Schema = undefined,
+  B extends Schema = undefined,
+> {
+  id: string;
+  method: HttpMethod;
+  path: string;
+  tag: ApiTag;
+  summary: string;
+  description?: string;
+  auth?: RouteAuth;
+  deprecated?: boolean;
+  params?: P;
+  query?: Q;
+  body?: B;
+  responses: Record<number, ResponseSpec>;
+}
+
+export type AnyContract = RouteContract<Schema, Schema, Schema>;
+
+export type Parsed<T extends Schema> = T extends z.ZodType
+  ? z.output<T>
+  : undefined;
+
+export interface RouteInput<
+  P extends Schema,
+  Q extends Schema,
+  B extends Schema,
+  U,
+> {
+  request: NextRequest;
+  user: U;
+  params: Parsed<P>;
+  query: Parsed<Q>;
+  body: Parsed<B>;
+}
+
+export type RouteParams = Promise<Record<string, string | string[]>>;
+
+export type ApiHandler = ((
+  request: NextRequest,
+  context?: { params: RouteParams },
+) => Promise<Response>) & { contract: AnyContract };
+
+export type ApiUser = SanitisedUser;
diff --git a/app/_server/api/define-route.ts b/app/_server/api/define-route.ts
new file mode 100644
index 000000000..6d427d8b4
--- /dev/null
+++ b/app/_server/api/define-route.ts
@@ -0,0 +1,126 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { authenticateApiKey } from "@/app/_server/actions/api";
+import { getCurrentUser } from "@/app/_server/actions/users";
+import { API_KEY_HEADER } from "@/app/_utils/api-utils";
+import { sanitizeUserForClient } from "@/app/_utils/user-sanitize-utils";
+import {
+  AnyContract,
+  ApiHandler,
+  ApiUser,
+  RouteAuth,
+  RouteContract,
+  RouteInput,
+  RouteParams,
+  Schema,
+} from "./contract";
+
+const INVALID_JSON = "Request body must be valid JSON";
+
+class BadInput extends Error {
+  constructor(
+    message: string,
+    readonly details?: z.core.$ZodIssue[],
+  ) {
+    super(message);
+  }
+}
+
+export const refuse = (error: string, status: number, extra?: object) =>
+  NextResponse.json({ error, ...extra }, { status });
+
+const _check = async <T extends Schema>(schema: T, value: unknown) => {
+  if (!schema) return undefined;
+  const result = await schema.safeParseAsync(value);
+  if (result.success) return result.data;
+  const [first] = result.error.issues;
+  throw new BadInput(first?.message ?? "Invalid input", result.error.issues);
+};
+
+const _readBody = async (request: NextRequest) => {
+  const text = await request.text();
+  if (!text.trim()) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new BadInput(INVALID_JSON);
+  }
+};
+
+const _parse = async <P extends Schema, Q extends Schema, B extends Schema>(
+  contract: RouteContract<P, Q, B>,
+  request: NextRequest,
+  params?: RouteParams,
+) => ({
+  params: await _check(contract.params, (await params) ?? {}),
+  query: await _check(
+    contract.query,
+    Object.fromEntries(request.nextUrl.searchParams),
+  ),
+  body: contract.body
+    ? await _check(contract.body, await _readBody(request))
+    : undefined,
+});
+
+const _run = async (
+  contract: AnyContract,
+  work: () => Promise<Response>,
+): Promise<Response> => {
+  try {
+    return await work();
+  } catch (error) {
+    if (error instanceof BadInput) {
+      return refuse(error.message, 400, error.details && { details: error.details });
+    }
+    console.error(`API ${contract.id} failed:`, error);
+    return refuse("Internal server error", 500);
+  }
+};
+
+type BareHandler = (
+  request: NextRequest,
+  context?: { params: RouteParams },
+) => Promise<Response>;
+
+const _caller = async (request: NextRequest, auth?: RouteAuth): Promise<ApiUser | null> => {
+  const keyed = sanitizeUserForClient(
+    await authenticateApiKey(request.headers.get(API_KEY_HEADER) || ""),
+  );
+  if (keyed || auth !== RouteAuth.SESSION_OR_KEY) return keyed;
+  return getCurrentUser();
+};
+
+const _attach = (contract: AnyContract, handler: BareHandler): ApiHandler =>
+  Object.assign(handler, { contract });
+
+export const defineRoute = <
+  P extends Schema = undefined,
+  Q extends Schema = undefined,
+  B extends Schema = undefined,
+>(
+  contract: RouteContract<P, Q, B>,
+  handler: (input: RouteInput<P, Q, B, ApiUser>) => Promise<Response>,
+): ApiHandler =>
+  _attach(contract as AnyContract, (request, context) =>
+    _run(contract as AnyContract, async () => {
+      const user = await _caller(request, contract.auth);
+      if (!user) return refuse("Unauthorized", 401);
+      const input = await _parse(contract, request, context?.params);
+      return handler({ request, user, ...input } as RouteInput<P, Q, B, ApiUser>);
+    }),
+  );
+
+export const definePublicRoute = <
+  P extends Schema = undefined,
+  Q extends Schema = undefined,
+  B extends Schema = undefined,
+>(
+  contract: RouteContract<P, Q, B>,
+  handler: (input: RouteInput<P, Q, B, null>) => Promise<Response>,
+): ApiHandler =>
+  _attach({ ...contract, auth: RouteAuth.PUBLIC } as AnyContract, (request, context) =>
+    _run(contract as AnyContract, async () => {
+      const input = await _parse(contract, request, context?.params);
+      return handler({ request, user: null, ...input } as RouteInput<P, Q, B, null>);
+    }),
+  );
diff --git a/app/_server/api/openapi.ts b/app/_server/api/openapi.ts
new file mode 100644
index 000000000..80669d211
--- /dev/null
+++ b/app/_server/api/openapi.ts
@@ -0,0 +1,151 @@
+import { z } from "zod";
+import { API_KEY_HEADER } from "@/app/_consts/api";
+import { apiNames } from "@/app/_schemas/api/names";
+import {
+  JsonSchema,
+  OpenApiDocument,
+  ParameterLocation,
+  SpecOperation,
+  SpecParameter,
+} from "@/app/_types/openapi";
+import { AnyContract, ApiHandler, MediaType, ResponseBody, ResponseSpec, RouteAuth } from "./contract";
+
+type Io = "input" | "output";
+type Convert = (schema: z.ZodType, io: Io) => JsonSchema;
+
+const API_KEY_SCHEME = "apiKey";
+const DEFS_REF = "#/$defs/";
+const COMPONENTS_REF = "#/components/schemas/";
+
+export const isApiHandler = (value: unknown): value is ApiHandler =>
+  typeof value === "function" && "contract" in value;
+
+export const contractsOf = (modules: object[]): AnyContract[] =>
+  modules.flatMap((mod) =>
+    Object.values(mod)
+      .filter(isApiHandler)
+      .map((handler) => handler.contract),
+  );
+
+const _isNoise = (key: string, value: unknown) =>
+  (key === "additionalProperties" && value === false) ||
+  (key === "id" && typeof value === "string");
+
+const _relink = (node: unknown): unknown => {
+  if (Array.isArray(node)) return node.map(_relink);
+  if (!node || typeof node !== "object") return node;
+  return Object.fromEntries(
+    Object.entries(node)
+      .filter(([key, value]) => !_isNoise(key, value))
+      .map(([key, value]) => [
+        key,
+        key === "$ref" && typeof value === "string"
+          ? value.replace(DEFS_REF, COMPONENTS_REF)
+          : _relink(value),
+      ]),
+  );
+};
+
+const _clean = (node: unknown) => _relink(node) as JsonSchema;
+
+const _converter = (components: Record<string, JsonSchema>): Convert => (schema, io) => {
+  const { $schema, $defs, ...json } = z.toJSONSchema(schema, {
+    io,
+    metadata: apiNames,
+    unrepresentable: "any",
+  });
+  Object.entries($defs ?? {}).forEach(([id, def]) => {
+    components[id] ??= _clean(def);
+  });
+  if (typeof json.id !== "string") return _clean(json);
+  components[json.id] ??= _clean(json);
+  return { $ref: `${COMPONENTS_REF}${json.id}` };
+};
+
+const _parameters = (convert: Convert, where: ParameterLocation, schema?: z.ZodType): SpecParameter[] => {
+  if (!schema) return [];
+  const json = convert(schema, "input");
+  const required = new Set(json.required ?? []);
+  return Object.entries(json.properties ?? {}).map(([name, prop]) => ({
+    name,
+    in: where,
+    required: where === ParameterLocation.PATH || required.has(name),
+    ...(prop.description ? { description: prop.description } : {}),
+    schema: prop,
+  }));
+};
+
+const _content = (spec: ResponseSpec, convert: Convert) => {
+  const bodies: ResponseBody[] = [
+    ...(spec.schema ? [{ mediaType: spec.mediaType ?? MediaType.JSON, schema: spec.schema }] : []),
+    ...(spec.alternatives ?? []),
+  ];
+  if (!bodies.length) return {};
+  return {
+    content: Object.fromEntries(
+      bodies.map(({ mediaType, schema }) => [mediaType, schema ? { schema: convert(schema, "output") } : {}]),
+    ),
+  };
+};
+
+const _operation = (contract: AnyContract, convert: Convert): SpecOperation => ({
+  operationId: contract.id,
+  summary: contract.summary,
+  ...(contract.description ? { description: contract.description } : {}),
+  tags: [contract.tag],
+  ...(contract.deprecated ? { deprecated: true } : {}),
+  ...(contract.auth === RouteAuth.PUBLIC ? { security: [] } : {}),
+  parameters: [
+    ..._parameters(convert, ParameterLocation.PATH, contract.params),
+    ..._parameters(convert, ParameterLocation.QUERY, contract.query),
+  ],
+  ...(contract.body
+    ? {
+        requestBody: {
+          required: true,
+          content: { [MediaType.JSON]: { schema: convert(contract.body, "input") } },
+        },
+      }
+    : {}),
+  responses: Object.fromEntries(
+    Object.entries(contract.responses).map(([status, spec]) => [
+      status,
+      { description: spec.description, ..._content(spec, convert) },
+    ]),
+  ),
+});
+
+export interface SpecOptions {
+  origin: string;
+  version: string;
+}
+
+export const buildSpec = (contracts: AnyContract[], { origin, version }: SpecOptions): OpenApiDocument => {
+  const schemas: Record<string, JsonSchema> = {};
+  const convert = _converter(schemas);
+  const paths: OpenApiDocument["paths"] = {};
+
+  contracts.forEach((contract) => {
+    paths[contract.path] ??= {};
+    paths[contract.path][contract.method] = _operation(contract, convert);
+  });
+
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "Jotty API",
+      version,
+      description: "REST API for notes, checklists, tasks and Kanban boards. Every request acts as the user who owns the API key.",
+    },
+    servers: [{ url: `${origin}/api` }],
+    security: [{ [API_KEY_SCHEME]: [] }],
+    tags: Array.from(new Set(contracts.map((contract) => contract.tag))).map((name) => ({ name })),
+    paths,
+    components: {
+      securitySchemes: {
+        [API_KEY_SCHEME]: { type: "apiKey", in: "header", name: API_KEY_HEADER },
+      },
+      schemas,
+    },
+  };
+};
diff --git a/app/_server/api/route-index.ts b/app/_server/api/route-index.ts
new file mode 100644
index 000000000..e6792d762
--- /dev/null
+++ b/app/_server/api/route-index.ts
@@ -0,0 +1,83 @@
+import * as adminRebuildIndex from "@/app/api/admin/rebuild-index/route";
+import * as categories from "@/app/api/categories/route";
+import * as checklists from "@/app/api/checklists/route";
+import * as checklistsListId from "@/app/api/checklists/[listId]/route";
+import * as checklistsListIdItems from "@/app/api/checklists/[listId]/items/route";
+import * as checklistsListIdItemsItemIndex from "@/app/api/checklists/[listId]/items/[itemIndex]/route";
+import * as checklistsListIdItemsItemIndexCheck from "@/app/api/checklists/[listId]/items/[itemIndex]/check/route";
+import * as checklistsListIdItemsItemIndexUncheck from "@/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route";
+import * as checklistsListIdItemsReorder from "@/app/api/checklists/[listId]/items/reorder/route";
+import * as docs from "@/app/api/docs/route";
+import * as exports from "@/app/api/exports/route";
+import * as exportsFilename from "@/app/api/exports/[filename]/route";
+import * as health from "@/app/api/health/route";
+import * as kanban from "@/app/api/kanban/route";
+import * as kanbanBoardId from "@/app/api/kanban/[boardId]/route";
+import * as kanbanBoardIdCalendar from "@/app/api/kanban/[boardId]/calendar/route";
+import * as kanbanBoardIdItems from "@/app/api/kanban/[boardId]/items/route";
+import * as kanbanBoardIdItemsItemId from "@/app/api/kanban/[boardId]/items/[itemId]/route";
+import * as kanbanBoardIdItemsItemIdAssign from "@/app/api/kanban/[boardId]/items/[itemId]/assign/route";
+import * as kanbanBoardIdItemsItemIdReminder from "@/app/api/kanban/[boardId]/items/[itemId]/reminder/route";
+import * as kanbanBoardIdItemsItemIdStatus from "@/app/api/kanban/[boardId]/items/[itemId]/status/route";
+import * as kanbanBoardIdStatuses from "@/app/api/kanban/[boardId]/statuses/route";
+import * as logs from "@/app/api/logs/route";
+import * as logsCleanup from "@/app/api/logs/cleanup/route";
+import * as logsExport from "@/app/api/logs/export/route";
+import * as logsStats from "@/app/api/logs/stats/route";
+import * as notes from "@/app/api/notes/route";
+import * as notesNoteId from "@/app/api/notes/[noteId]/route";
+import * as openapiJson from "@/app/api/openapi.json/route";
+import * as search from "@/app/api/search/route";
+import * as summary from "@/app/api/summary/route";
+import * as tasks from "@/app/api/tasks/route";
+import * as tasksTaskId from "@/app/api/tasks/[taskId]/route";
+import * as tasksTaskIdItems from "@/app/api/tasks/[taskId]/items/route";
+import * as tasksTaskIdItemsItemIndex from "@/app/api/tasks/[taskId]/items/[itemIndex]/route";
+import * as tasksTaskIdItemsItemIndexStatus from "@/app/api/tasks/[taskId]/items/[itemIndex]/status/route";
+import * as tasksTaskIdStatuses from "@/app/api/tasks/[taskId]/statuses/route";
+import * as tasksTaskIdStatusesStatusId from "@/app/api/tasks/[taskId]/statuses/[statusId]/route";
+import * as user from "@/app/api/user/route";
+import * as userUsername from "@/app/api/user/[username]/route";
+
+export const ROUTE_MODULES: object[] = [
+  adminRebuildIndex,
+  categories,
+  checklists,
+  checklistsListId,
+  checklistsListIdItems,
+  checklistsListIdItemsItemIndex,
+  checklistsListIdItemsItemIndexCheck,
+  checklistsListIdItemsItemIndexUncheck,
+  checklistsListIdItemsReorder,
+  docs,
+  exports,
+  exportsFilename,
+  health,
+  kanban,
+  kanbanBoardId,
+  kanbanBoardIdCalendar,
+  kanbanBoardIdItems,
+  kanbanBoardIdItemsItemId,
+  kanbanBoardIdItemsItemIdAssign,
+  kanbanBoardIdItemsItemIdReminder,
+  kanbanBoardIdItemsItemIdStatus,
+  kanbanBoardIdStatuses,
+  logs,
+  logsCleanup,
+  logsExport,
+  logsStats,
+  notes,
+  notesNoteId,
+  openapiJson,
+  search,
+  summary,
+  tasks,
+  tasksTaskId,
+  tasksTaskIdItems,
+  tasksTaskIdItemsItemIndex,
+  tasksTaskIdItemsItemIndexStatus,
+  tasksTaskIdStatuses,
+  tasksTaskIdStatusesStatusId,
+  user,
+  userUsername,
+];
diff --git a/app/_server/api/spec.ts b/app/_server/api/spec.ts
new file mode 100644
index 000000000..0644080a1
--- /dev/null
+++ b/app/_server/api/spec.ts
@@ -0,0 +1,13 @@
+import { readPackageVersion } from "@/app/_server/actions/config";
+import { buildSpec, contractsOf } from "./openapi";
+import { ROUTE_MODULES } from "./route-index";
+
+const UNKNOWN_VERSION = "unknown";
+
+export const apiSpec = async (origin: string) => {
+  const version = await readPackageVersion();
+  return buildSpec(contractsOf(ROUTE_MODULES), {
+    origin,
+    version: version.success && version.data ? version.data : UNKNOWN_VERSION,
+  });
+};
diff --git a/app/_translations/de.json b/app/_translations/de.json
index b47cc2306..736692d1c 100644
--- a/app/_translations/de.json
+++ b/app/_translations/de.json
@@ -21,6 +21,7 @@
     "back": "Zurück",
     "next": "Weiter",
     "previous": "Vorherige",
+    "continue": "Weiter",
     "submit": "Übermitteln",
     "create": "Erstellen",
     "update": "Aktualisieren",
@@ -100,7 +101,7 @@
     "deleteFile": "Datei löschen",
     "fileTooLarge": "Datei ist zu groß. Die Maximalgröße ist {maxSizeMB}MB. Deine Datei hat {fileSizeMB}MB.",
     "uploadFailed": "Hochladen fehlgeschlagen",
-    "uploadFailedRetry": "Hochladen fehlgeschlagen. Probiere es noch einmal.",
+    "uploadFailedRetry": "Hochladen fehlgeschlagen. Versuch es noch einmal.",
     "failedToDeleteFile": "Datei konnte nicht gelöscht werden",
     "previousMonth": "Vorheriger Monat",
     "nextMonth": "Nächster Monat",
@@ -126,13 +127,14 @@
     "expandAll": "Alle aufklappen",
     "saveChanges": "Änderungen speichern",
     "all": "Alle",
+    "items": "Elemente",
     "showAll": "Alle anzeigen",
     "creating": "Erstelle...",
     "createCategoryHeader": "Neue Kategorie anlegen",
     "parentCategory": "Elternkategorie (optional)",
     "noParent": "Keine Elternkategorie (Wurzel-Level)",
     "categoryNamePlaceholder": "Gib den Kategorie-Namen ein...",
-    "notAllowedName": "{name} ist nicht erlaubt. Bitte wähle einen anderen Namen.",
+    "notAllowedName": "{name} ist nicht erlaubt. Wähle einen anderen Namen.",
     "createCategory": "Kategorie erstellen",
     "selectCategory": "Kategorie auswählen...",
     "categoryWillBeCreatedIn": "Neue Kategorie wird erstellt in:",
@@ -172,7 +174,7 @@
     "noResults": "Keine Ergebnisse",
     "by": "von {owner}",
     "unsavedChanges": "Ungespeicherte Änderungen",
-    "unsavedChangesDetected": "⚠️ Ungespeicherte Änderungen entdeckt",
+    "unsavedChangesDetected": "Ungespeicherte Änderungen",
     "unsavedChangesMessage": "Du hast ungespeicherte Änderungen in {noteTitle}. Wenn du jetzt woanders hingehst, gehen deine Änderungen verloren.",
     "whatToDoWithUnsavedChanges": "Was möchtest du mit deinen ungespeicherten Änderungen tun?",
     "discard": "Verwerfen",
@@ -237,45 +239,42 @@
     "openSearch": "Suche öffnen",
     "closeSearch": "Suche schließen",
     "moreOptions": "Mehr Optionen",
-    "retry": "Wiederholen",
+    "history": "Verlauf",
+    "disable": "Deaktivieren",
     "restoring": "Wiederherstellung...",
+    "retry": "Wiederholen",
     "copiedToClipboard": "In die Zwischenablage kopiert",
     "offline": "Offline",
     "connected": "Verbunden",
     "reconnecting": "Verbindung wird wieder hergestellt...",
     "hide": "Ausblenden",
-    "continue": "Weiter",
-    "history": "Verlauf",
-    "disable": "Deaktivieren",
-    "items": "Elemente",
     "thisEntry": "diesen Eintrag",
     "preview": "Vorschau"
   },
-  "comments": {
-    "title": "Kommentare",
-    "titleWithCount": "{count, plural, one {# Kommentar} other {# Kommentare}}",
-    "noComments": "Noch keine Kommentare. Starte die Unterhaltung!",
-    "addComment": "Kommentar hinzufügen...",
-    "replyPlaceholder": "Antwort schreiben...",
-    "post": "Senden",
-    "reply": "Antworten",
-    "edit": "Bearbeiten",
-    "delete": "Löschen",
-    "save": "Speichern",
-    "cancel": "Abbrechen",
-    "edited": "bearbeitet",
-    "deleteConfirmTitle": "Kommentar löschen?",
-    "deleteConfirmMessage": "Dadurch wird der Kommentar und alle Antworten gelöscht. Diese Aktion kann nicht rückgängig gemacht werden.",
-    "commentDeleted": "Kommentar gelöscht",
-    "commentAdded": "Kommentar hinzugefügt",
-    "commentUpdated": "Kommentar aktualisiert",
-    "failedToAdd": "Kommentar konnte nicht hinzugefügt werden",
-    "failedToEdit": "Kommentar konnte nicht bearbeitet werden",
-    "failedToDelete": "Kommentar konnte nicht gelöscht werden",
-    "failedToLoad": "Kommentare konnten nicht geladen werden",
-    "readOnly": "Du benötigst Bearbeitungsrechte, um diese Karte zu kommentieren.",
-    "replyTo": "Antwort an {author}",
-    "noUsersFound": "Keine Benutzer gefunden"
+  "history": {
+    "noteHistory": "Notizverlauf",
+    "restore": "Wiederherstellen",
+    "restoreVersion": "Version wiederherstellen",
+    "restoreConfirm": "Diese Version wiederherstellen? \nAktuelle Inhalte werden ersetzt.",
+    "noHistory": "Keine Historie verfügbar",
+    "noHistoryDescription": "Speichern Sie Ihre Notiz, um einen Verlaufspunkt zu erstellen.",
+    "loadMore": "Mehr laden",
+    "featureDisabled": "Verlauf deaktiviert",
+    "disabledAdmin": "Der Notizverlauf ist ausgeschaltet. Du kannst ihn unter Administrator-Einstellungen > Editor einschalten.",
+    "disabledUser": "Der Notizverlauf ist ausgeschaltet. Bitte deinen Administrator, ihn einzuschalten.",
+    "goToSettings": "Zu den Einstellungen",
+    "manualSavesOnly": "Nur manuelles Speichern erzeugt einen Verlaufseintrag. Automatisches Speichern nicht.",
+    "fetchError": "Der Verlauf konnte nicht geladen werden",
+    "restoreError": "Die Version konnte nicht wiederhergestellt werden",
+    "viewContent": "Inhalt anzeigen",
+    "viewDiff": "Änderungen anzeigen",
+    "actionCreate": "Erstellt",
+    "actionUpdate": "Aktualisiert",
+    "actionRename": "Umbenannt",
+    "actionMove": "Verschoben",
+    "actionDelete": "Gelöscht",
+    "actionInit": "Initialisiert",
+    "actionUnknown": "Geändert"
   },
   "auth": {
     "loginTitle": "Anmelden",
@@ -296,7 +295,7 @@
     "sessionExpired": "Deine Sitzung ist abgelaufen",
     "setupComplete": "Einrichtung abgeschlossen",
     "createAccount": "Erstelle dein Konto",
-    "errorOccurred": "Ein Fehler ist aufgetreten. Bitte versuche es erneut.",
+    "errorOccurred": "Etwas ist schiefgelaufen. Versuch es noch einmal.",
     "enterUsername": "Gib deinen Benutzernamen ein",
     "enterPassword": "Gib dein Passwort ein",
     "chooseUsername": "Wähle einen Benutzernamen",
@@ -308,10 +307,10 @@
     "createAdminAccountDescription": "Erstelle dein Admin-Konto um zu beginnen",
     "version": "Version {version}",
     "createUser": "Benutzer erstellen",
-    "notAuthorized": "Du bist nicht berechtigt, auf diese Anwendung zuzugreifen. Kontaktiere deinen Administrator.",
-    "rememberMe": "Angemeldet bleiben",
     "attemptsRemaining": "Warnung: Noch {count, plural, one {# Versuch} other {# Versuche}} bis zur Kontosperre",
-    "accountLocked": "Zu viele fehlgeschlagene Versuche. Bitte versuche es in {seconds} {seconds, plural, one {Sekunde} other {Sekunden}} erneut."
+    "accountLocked": "Zu viele fehlgeschlagene Versuche. Versuch es in {seconds} {seconds, plural, one {Sekunde} other {Sekunden}} erneut.",
+    "notAuthorized": "Du hast keinen Zugriff auf diese Anwendung. Wende dich an deinen Administrator.",
+    "rememberMe": "Angemeldet bleiben"
   },
   "mfa": {
     "title": "Zwei-Faktor-Authentifizierung",
@@ -335,9 +334,9 @@
     "invalidCode": "Ungültiger Authentifizierungscode",
     "invalidRecoveryCode": "Ungültiger Wiederherstellungscode",
     "mfaRequired": "Zwei-Faktor-Authentifizierung ist erforderlich",
-    "mfaEnabledSuccess": "Zwei-Faktor-Authentifizierung erfolgreich aktiviert",
+    "mfaEnabledSuccess": "Zwei-Faktor-Authentifizierung aktiviert",
     "mfaDisabledSuccess": "Zwei-Faktor-Authentifizierung deaktiviert",
-    "tooManyAttempts": "Zu viele fehlgeschlagene Versuche. Bitte versuche es später erneut.",
+    "tooManyAttempts": "Zu viele fehlgeschlagene Versuche. Versuch es später erneut.",
     "disableTitle": "Zwei-Faktor-Authentifizierung deaktivieren",
     "disableDescription": "Gib deinen 2FA-Code ein um das Deaktivieren der Zwei-Faktor-Authentifizierung zu bestätigen",
     "disableWarning": "Dies wird dein Konto weniger sicher machen. Bist du sicher?",
@@ -357,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Dies wird deinen aktuellen Wiederherstellungscode ungültig machen",
     "regenerateRecoveryCodeDescription": "Gib deinen 2FA-Code ein um einen neuen Wiederherstellungscode zu generieren. Dein alter Code wird nicht mehr funktionieren.",
     "recoveryCodeRegenerated": "Neuer Wiederherstellungscode generiert",
-    "recoveryCodeRegeneratedInfo": "Dein neuer Wiederherstellungscode wurde generiert. Bewahre ihn an einem sicheren Ort auf - dies ist das einzige Mal, dass du ihn sehen wirst.",
-    "recoveryCodeRegeneratedSuccess": "Wiederherstellungscode erfolgreich neu generiert",
+    "recoveryCodeRegeneratedInfo": "Dein neuer Wiederherstellungscode ist bereit. Bewahre ihn an einem sicheren Ort auf, du siehst ihn nur dieses eine Mal.",
+    "recoveryCodeRegeneratedSuccess": "Wiederherstellungscode neu generiert",
     "recoveryCodeProfileDescription": "Verwende diesen Code zur Kontowiederherstellung, falls du den Zugriff auf deine Authenticator-App verlierst",
     "disableMfaForUser": "2FA für diesen Benutzer deaktivieren",
     "recoveryCodeRequired": "Wiederherstellungscode ist erforderlich",
@@ -372,7 +371,7 @@
     "recent": "Kürzlich",
     "browseAndManage": "Durchsuche und verwalte alle deine Notizen",
     "noNotesYet": "Noch keine Notizen",
-    "createFirstNote": "Erstelle deine erste Notiz um mit deiner Wissensdatenbank zu beginnen.",
+    "createFirstNote": "Hier ist noch nichts. Erstelle deine erste Notiz.",
     "createNewNote": "Neue Notiz erstellen",
     "noNotesFound": "Keine Notizen gefunden",
     "tryAdjustingFilters": "Versuche deine Filter anzupassen oder erstelle eine neue Notiz.",
@@ -403,22 +402,26 @@
     "enterNoteTitle": "Notiztitel eingeben...",
     "byType": "Nach Typ",
     "publiclySharedNote": "Öffentlich geteilt",
+    "sharedPubliclyBy": "Diese Notiz wird von {owner} öffentlich geteilt",
+    "copyRawContent": "Markdown kopieren",
     "quickSave": "Schnellspeichern",
     "noteNotFound": "Notiz nicht gefunden",
     "unarchiveNote": "Notiz entarchivieren",
     "enterNoteName": "Notizname eingeben...",
     "updateNote": "Notiz aktualisieren",
-    "tags": "Tags",
-    "noTagsFound": "Keine Tags gefunden",
-    "searchTags": "Tags suchen...",
-    "copyRawContent": "Markdown kopieren",
     "printSaveAsPdf": "Drucken / Als PDF speichern",
     "tableOfContents": "Inhaltsverzeichnis",
     "wordCount": "{count, plural, one {# Wort} other {# Wörter}}",
     "charCount": "{count, plural, one {# Zeichen} other {# Zeichen}}",
-    "readingTime": "{count, plural, one {# Minute Lesezeit} other {# Minuten Lesezeit}}"
+    "readingTime": "{count, plural, one {# Minute Lesezeit} other {# Minuten Lesezeit}}",
+    "tags": "Tags",
+    "noTagsFound": "Keine Tags gefunden",
+    "searchTags": "Tags suchen...",
+    "createNoteFailed": "Die Notiz konnte nicht erstellt werden",
+    "createCategoryFailed": "Die Kategorie konnte nicht erstellt werden, die Notiz wurde nicht angelegt"
   },
   "checklists": {
+    "sharedPubliclyBy": "Diese Aufgabenliste wird von {owner} öffentlich geteilt",
     "title": "Aufgabenlisten",
     "allChecklists": "Alle Aufgabenlisten",
     "completed": "Abgeschlossen",
@@ -432,7 +435,7 @@
     "progress": "Fortschritt",
     "totalItems": "Gesamtanzahl Elemente",
     "noChecklistsYet": "Noch keine Aufgabenlisten",
-    "createFirstChecklist": "Erstelle deine erste Aufgabenliste um mit der Organisation deiner Aufgaben zu beginnen.",
+    "createFirstChecklist": "Hier ist noch nichts. Erstelle deine erste Aufgabenliste.",
     "newChecklist": "Neue Aufgabenliste",
     "noChecklistsFound": "Keine Aufgabenlisten gefunden",
     "tryAdjustingFiltersChecklist": "Versuche deine Filter anzupassen oder erstelle eine neue Aufgabenliste.",
@@ -474,6 +477,7 @@
     "checklistType": "Typ der Aufgabenliste",
     "simpleChecklist": "Einfache Aufgabenliste",
     "taskProject": "Aufgabenprojekt",
+    "kanbanBoard": "Kanban-Board",
     "basicTodoItems": "Basis-Todo-Elemente",
     "withTimeTracking": "Mit Zeiterfassung",
     "noDescription": "Keine Beschreibung",
@@ -489,24 +493,35 @@
     "enterChecklistName": "Name der Aufgabenliste eingeben...",
     "updating": "Aktualisiere...",
     "updateChecklist": "Aufgabenliste aktualisieren",
+    "checkAll": "Alle abhaken",
+    "uncheckAll": "Alle Haken entfernen",
+    "clearAll": "Alle löschen",
+    "checkAllConfirmTitle": "Alle Einträge abhaken?",
+    "checkAllConfirmMessage": "Möchtest du wirklich alle {count} Einträge und Untereinträge abhaken? Sie werden als erledigt markiert.",
+    "uncheckAllConfirmTitle": "Alle Haken entfernen?",
+    "uncheckAllConfirmMessage": "Möchtest du wirklich alle {count} Einträge und Untereinträge deaktivieren? Sie werden als unerledigt markiert.",
+    "clearAllConfirmTitle": "Alle Einträge löschen?",
+    "clearAllCompletedConfirmMessage": "Möchtest du wirklich alle {count} erledigten Einträge und Untereinträge löschen? Dies kann nicht rückgängig gemacht werden.",
+    "clearAllIncompleteConfirmMessage": "Möchtest du wirklich alle {count} unerledigten Einträge und Untereinträge löschen? Dies kann nicht rückgängig gemacht werden.",
     "convertChecklistType": "Typ der Aufgabenliste umwandeln",
-    "dataLossWarning": "⚠️ Warnung vor Datenverlust",
+    "convertTypeConfirmation": "Von {currentType} zu {newType} umwandeln?",
+    "dataLossWarning": "Warnung vor Datenverlust",
     "dataLossWarningItems": "Folgende Daten gehen verloren:",
     "allTaskStatusesReset": "Alle Aufgabenstatus werden zurückgesetzt",
     "timeTrackingDataLost": "Zeiterfassungsdaten gehen verloren",
     "estimatedTimesRemoved": "Geschätzte Zeiten werden entfernt",
     "targetDatesCleared": "Zieldaten werden gelöscht",
-    "enhancedFeatures": "✨ Erweiterte Funktionen",
+    "enhancedFeatures": "Das bekommst du",
     "enhancedFeaturesYouWillGain": "Du erhältst:",
     "kanbanBoardWithDragDrop": "Kanban-Board mit Drag & Drop",
     "taskStatusTracking": "Aufgabenstatus-Tracking (Todo, In Bearbeitung, etc.)",
     "timeTrackingWithTimer": "Zeiterfassung mit integriertem Timer",
-    "actionCannotBeUndone": "Diese Aktion kann nicht rückgängig gemacht werden. Bist du sicher, dass du umwandeln möchtest?",
-    "convertTypeConfirmation": "Sie sind dabei, von {currentType} zu {newType} zu konvertieren. Möchten Sie fortfahren?",
+    "actionCannotBeUndone": "Das kann nicht rückgängig gemacht werden. Trotzdem umwandeln?",
     "convertAndLoseData": "Umwandeln & Daten verlieren",
     "convert": "Umwandeln",
     "convertToSimpleChecklist": "Zu einfacher Aufgabenliste umwandeln",
     "convertToTaskProject": "Zu Aufgabenprojekt umwandeln",
+    "convertToKanbanBoard": "In Kanban-Board umwandeln",
     "pasteYourList": "Füge deine Liste ein (ein Element pro Zeile)",
     "addItems": "{count} Elemente hinzufügen",
     "itemsWillBeAdded": "{count} Elemente werden hinzugefügt",
@@ -515,21 +530,35 @@
     "noItemsYet": "Noch keine Elemente",
     "addFirstItem": "Füge dein erstes Element hinzu um zu beginnen!",
     "noTasks": "Keine Aufgaben",
-    "noSubtasksYet": "Noch keine Unteraufgaben. Füge unten eine hinzu um zu beginnen.",
+    "noSubtasksYet": "Noch keine Unteraufgaben. Füge unten eine hinzu.",
     "addTime": "Zeit hinzufügen",
-    "enterTimeInMinutes": "Zeit in Minuten eingeben",
-    "checkAll": "Alle abhaken",
-    "checkAllConfirmTitle": "Alle Einträge abhaken?",
-    "checkAllConfirmMessage": "Möchtest du wirklich alle {count} Einträge und Untereinträge abhaken? Sie werden als erledigt markiert.",
-    "uncheckAll": "Alle Haken entfernen",
-    "uncheckAllConfirmTitle": "Alle Haken entfernen?",
-    "uncheckAllConfirmMessage": "Möchtest du wirklich alle {count} Einträge und Untereinträge deaktivieren? Sie werden als unerledigt markiert.",
-    "clearAll": "Alle löschen",
-    "clearAllConfirmTitle": "Alle Einträge löschen?",
-    "clearAllCompletedConfirmMessage": "Möchtest du wirklich alle {count} erledigten Einträge und Untereinträge löschen? Dies kann nicht rückgängig gemacht werden.",
-    "clearAllIncompleteConfirmMessage": "Möchtest du wirklich alle {count} unerledigten Einträge und Untereinträge löschen? Dies kann nicht rückgängig gemacht werden.",
-    "convertToKanbanBoard": "In Kanban-Board umwandeln",
-    "kanbanBoard": "Kanban-Board"
+    "enterTimeInMinutes": "Zeit in Minuten eingeben"
+  },
+  "comments": {
+    "title": "Kommentare",
+    "titleWithCount": "{count, plural, one {# Kommentar} other {# Kommentare}}",
+    "noComments": "Noch keine Kommentare. Starte die Unterhaltung!",
+    "addComment": "Kommentar hinzufügen...",
+    "replyPlaceholder": "Antwort schreiben...",
+    "post": "Senden",
+    "reply": "Antworten",
+    "edit": "Bearbeiten",
+    "delete": "Löschen",
+    "save": "Speichern",
+    "cancel": "Abbrechen",
+    "edited": "bearbeitet",
+    "deleteConfirmTitle": "Kommentar löschen?",
+    "deleteConfirmMessage": "Dadurch wird der Kommentar und alle Antworten gelöscht. Diese Aktion kann nicht rückgängig gemacht werden.",
+    "commentDeleted": "Kommentar gelöscht",
+    "commentAdded": "Kommentar hinzugefügt",
+    "commentUpdated": "Kommentar aktualisiert",
+    "failedToAdd": "Kommentar konnte nicht hinzugefügt werden",
+    "failedToEdit": "Kommentar konnte nicht bearbeitet werden",
+    "failedToDelete": "Kommentar konnte nicht gelöscht werden",
+    "failedToLoad": "Kommentare konnten nicht geladen werden",
+    "readOnly": "Du benötigst Bearbeitungsrechte, um diese Karte zu kommentieren.",
+    "replyTo": "Antwort an {author}",
+    "noUsersFound": "Keine Benutzer gefunden"
   },
   "tasks": {
     "title": "Aufgaben",
@@ -558,7 +587,7 @@
     "overdue": "Überfällig",
     "browseAndManageTaskLists": "Durchsuche und verwalte alle deine Aufgabenlisten",
     "noTaskListsYet": "Noch keine Aufgabenlisten",
-    "createFirstTaskList": "Erstelle deine erste Aufgabenliste um mit der Verwaltung deiner Projekte zu beginnen.",
+    "createFirstTaskList": "Hier ist noch nichts. Erstelle deine erste Aufgabenliste.",
     "newTaskList": "Neue Aufgabenliste",
     "taskLists": "Aufgabenlisten",
     "noTaskListsFound": "Keine Aufgabenlisten gefunden",
@@ -606,7 +635,7 @@
     "changeStatus": "Status ändern",
     "noBoards": "Keine Boards gefunden",
     "noBoardsYet": "Noch keine Kanban-Boards",
-    "createFirstBoard": "Erstelle dein erstes Kanban-Board, um deine Projekte zu verwalten.",
+    "createFirstBoard": "Hier ist noch nichts. Erstelle dein erstes Kanban-Board.",
     "newBoard": "Neues Board",
     "tryAdjustingFilters": "Passe deine Filter an oder erstelle ein neues Board.",
     "completed": "Erledigt",
@@ -659,7 +688,7 @@
     "quickSettingsHeader": "Schnelle Einstellungen (nur dieses Gerät)",
     "adminSettings": "Admin-Dashboard",
     "apiKey": "API-Schlüssel",
-    "apiKeyDescription": "Erzeuge einen API-Schlüssel für Zugriff auf deine Aufgabenlisten und Notizen aus anderen Anwendungen",
+    "apiKeyDescription": "Erzeuge einen API-Schlüssel, damit Skripte und Apps auf deine Aufgabenlisten und Notizen zugreifen können",
     "hideApiKey": "API-Schlüssel verstecken",
     "showApiKey": "API-Schlüssel anzeigen",
     "copyApiKey": "API-Schlüssel kopieren",
@@ -677,15 +706,15 @@
     "removeAvatar": "Benutzerbild entfernen",
     "usernameRequired": "Benutzername wird benötigt",
     "passwordsDoNotMatch": "Du hast das neue Passwort unterschiedlich geschrieben",
-    "profileUpdated": "Profil erfolgreich aktualisiert!",
+    "profileUpdated": "Profil aktualisiert",
     "failedToUpdateProfile": "Profil konnte nicht aktualisiert werden",
-    "failedToUpdateProfileRetry": "Profil konnte nicht aktualisiert werden. Probier es nochmal.",
-    "avatarUpdated": "Benutzerbild erfolgreich aktualisiert!",
+    "failedToUpdateProfileRetry": "Profil konnte nicht aktualisiert werden. Versuch es noch einmal.",
+    "avatarUpdated": "Benutzerbild aktualisiert",
     "failedToUpdateAvatar": "Benutzerbild konnte nicht aktualisiert werden",
-    "failedToUpdateAvatarRetry": "Benutzerbild konnte nicht aktualisiert werden. Prober es nochmal.",
-    "avatarRemoved": "Benutzerbild erfolgreich entfernt",
+    "failedToUpdateAvatarRetry": "Benutzerbild konnte nicht aktualisiert werden. Versuch es noch einmal.",
+    "avatarRemoved": "Benutzerbild entfernt",
     "failedToRemoveAvatar": "Benutzerbild konnte nicht entfernt werden",
-    "failedToRemoveAvatarRetry": "Benutzerbild konnte nicht entfernt werden. Probier es nochmal.",
+    "failedToRemoveAvatarRetry": "Benutzerbild konnte nicht entfernt werden. Versuch es noch einmal.",
     "activeSessions": "Aktive Sitzungen",
     "activeSession": "{count} aktive Sitzung",
     "activeSession_plural": "{count} aktive Sitzungen",
@@ -703,11 +732,11 @@
     "auditLogsTab": "Benutzerlogs",
     "rebuildLinkIndexes": "Verknüpfungs-Indizes neu erzeugen, um die Verbindungsdaten zu aktualisieren",
     "rebuildingLinkIndex": "Erzeuge Verknüpfungs-Indizes neu...",
-    "successfullyRebuiltIndex": "Verknüpfungs-Indizes erfolgreich neu erzeugt",
-    "successfullyRebuiltIndexReload": "Verknüpfungs-Indizes erfolgreich neu erzeugt! Die Seite wird sich neu laden, um die aktualisierten Verbindungen anzuzeigen.",
-    "failedToRebuildIndex": "Verknüpfungs-Indizes konnten nicht neu erzeugt werden. Probier es nochmal.",
+    "successfullyRebuiltIndex": "Verknüpfungsindex neu aufgebaut",
+    "successfullyRebuiltIndexReload": "Verknüpfungsindex neu aufgebaut. Die Seite lädt neu, um die neuen Verbindungen anzuzeigen.",
+    "failedToRebuildIndex": "Verknüpfungsindex konnte nicht neu aufgebaut werden. Versuch es noch einmal.",
     "contentLinks": "Verknüpfte Inhalte",
-    "visualizeRelationships": "Beziehungen zwischen deinen Notizen und Aufgabenlisten visualisieren",
+    "visualizeRelationships": "Sieh dir an, wie deine Notizen und Aufgabenlisten miteinander verknüpft sind",
     "connectedItems": "Verbundene Inhalte",
     "noLinksFound": "Keine Verbindungen gefunden",
     "startCreatingInternalLinks": "Beginnen Sie mit der Erstellung interner Links, indem Sie „@“ in Ihre Notizen eingeben, um das Beziehungsnetzwerk hier anzuzeigen.",
@@ -718,8 +747,8 @@
     "isolated": "isoliert",
     "connection": "Verbindung",
     "connection_plural": "Verbindungen",
-    "terminateSessionConfirm": "Bist du sicher, dass du diese Sitzung beenden willst?",
-    "terminateAllSessionsConfirm": "Bist du sicher, dass du alle anderen Sitzungen beenden willst?",
+    "terminateSessionConfirm": "Diese Sitzung beenden?",
+    "terminateAllSessionsConfirm": "Alle anderen Sitzungen beenden?",
     "validationErrorTitle": "Validerungsfehler",
     "visibleGraphSummary": "{items} sichtbare Elemente, {links} sichtbare Verbindungen",
     "graphTruncated": "Es werden die {visible} am stärksten verbundenen Elemente angezeigt. {omitted} schwächer verbundene Elemente wurden ausgeblendet.",
@@ -790,10 +819,10 @@
     "chooseAutoSaveInterval": "Wähle ein Intervall, in dem deine Notizen automatisch gespeichert werden sollen.",
     "defaultMode": "Standardmodus",
     "selectNotesDefaultMode": "Wähle den Standardmodus für Notizen",
-    "chooseNotesDefaultMode": "Wähle aus, ob Notizen automatisch im Bearbeitungsmodus sind oder nicht {mode} Schaltfäche im Notizen-Editor).",
+    "chooseNotesDefaultMode": "Wähle, ob Notizen im Bearbeitungsmodus geöffnet werden. Du kannst jederzeit mit der Schaltfläche {mode} im Notizen-Editor wechseln.",
     "defaultEditor": "Standard-Editor",
     "selectNotesDefaultEditor": "Wählen den Standard-Editor für Notizen",
-    "chooseDefaultEditor": "Wähle den Editor, der standardmäßig für deine Notizen verwendet wird - (du kannst jederzeit wechseln, indem du im Editor auf die {editor} Schaltfläche drückst).",
+    "chooseDefaultEditor": "Wähle den Standard-Editor für deine Notizen. Du kannst jederzeit mit der Schaltfläche {editor} im Notizen-Editor wechseln.",
     "tableSyntaxInNotes": "Tabellensyntax in Notizen",
     "selectTableSyntax": "Wähle die Tabellensyntax",
     "chooseTableSyntax": "Wähle aus, wie Tabellen in deinen Notizen dargestellt weden.",
@@ -802,7 +831,7 @@
     "chooseSyntaxTheme": "Wähle ein Thema für die Quelltext-Hervorhebung im Markdown-Editor.",
     "minimalMode": "Minimalmodus (Rich -Text Editor deaktivieren)",
     "selectMinimalMode": "Wähle, ob du den Minimalmodus nutzen willst",
-    "minimalModeDescription": "Wenn dies aktiviert ist, wird einfaches Markdown verwendet statt eines Rich-Text-Editors. Fortgeschrittene Funktionen wie zweiseitige Verlinkungen funktionieren in diesem Modus nicht.",
+    "minimalModeDescription": "Verwendet einfaches Markdown statt des Rich-Text-Editors. Zweiseitige Verlinkungen und andere fortgeschrittene Funktionen gehen in diesem Modus nicht.",
     "defaultNoteFilter": "Standardfilter für Notizen",
     "selectDefaultNoteFilter": "Wähle einen Standardfilter",
     "chooseDefaultNoteFilter": "Wähle den Standardfilter, der automatisch angewendet wird, wenn du die Notizen-Seite öffnest.",
@@ -829,8 +858,8 @@
     "currentPassword": "Aktuelles Passwort",
     "newPassword": "Neues Passwort",
     "confirmPassword": "Passwort bestätigen",
-    "passwordChanged": "Passwort wurde erfolgreich geändert",
-    "settingsSaved": "Einstellungen erfolgreich gespeichert",
+    "passwordChanged": "Passwort geändert",
+    "settingsSaved": "Einstellungen gespeichert",
     "dashCase": "Bindestrich-Format (bspw., mein-datei-name.md)",
     "minimal": "Minimal (entfernt nur ungültige Zeichen)",
     "noRename": "Keine Umbenennung (Original-Dateiname bleibt erhalten)",
@@ -840,6 +869,7 @@
     "seconds_plural": "{count} Sekunden",
     "hours12": "12 Stunden",
     "hours24": "24 Stunden",
+    "useSystemDefault": "Systemstandard verwenden",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "Standard",
@@ -863,7 +893,7 @@
     "chooseQuickCreateNotes": "Wähle aus, ob die Schnellerstellung für Notizen aktiviert ist.",
     "quickCreateNotesShowModal": "Zeige ein Modal, wenn Notizen erstellt werden",
     "quickCreateNotesSkipModal": "Überspringe das Modal und erzeuge sofort",
-    "quickCreateNotesDescription": "Wenn aktiviert, wird das Modal zur Notiz-Erstellung übersprungen und du gelangst direkt zum Editor.",
+    "quickCreateNotesDescription": "Überspringt den Dialog zur Notiz-Erstellung und bringt dich direkt in den Editor.",
     "defaultCategory": "Standardkategorie für schnell erstellte Notizen",
     "selectDefaultCategory": "Wähle eine Standardkategorie...",
     "defaultCategoryDescription": "Neue Notizen werden dieser Kategorie zugewiesen, wenn sie schnell erstellt werden.",
@@ -901,7 +931,7 @@
     "hideStatusOnCardsLabel": "Status auf Kanban-Karten",
     "showStatusOnCards": "Status anzeigen",
     "hideStatusOnCards": "Status ausblenden",
-    "hideStatusOnCardsDescription": "Blendet das Status-Label auf Kanban-Karten aus. Der Status ist bereits durch die Spalte ersichtlich, in der die Karte liegt.",
+    "hideStatusOnCardsDescription": "Blendet das Status-Label auf Kanban-Karten aus. Die Spalte zeigt den Status bereits an.",
     "hideMobileStatusDropdownLabel": "Mobiles Status-Dropdown auf Karten",
     "showMobileStatusDropdown": "Mobiles Dropdown anzeigen",
     "hideMobileStatusDropdown": "Mobiles Dropdown ausblenden",
@@ -914,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "Blendet Timer und erfasste Sitzungen auf Kanban-Karten aus. Die Zeiterfassung bleibt in der Detailansicht der Karte verfügbar.",
     "selectStatusOnCards": "Statussichtbarkeit auswählen",
     "codeBlockChoice": "Wählen Sie den Codeblockstil",
-    "themedCodeBlock": "Themenbezogener Codeblock",
     "defaultCodeBlock": "Codepen (Standard)",
+    "themedCodeBlock": "Themenbezogener Codeblock",
     "codeBlockChoiceDescription": "Wählen Sie zwischen dem Codepen-ähnlichen Standard-Codeblockstil oder einem thematischen Codeblockstil.",
     "checklistItemClickAction": "Klickaktion für Checklistenelement",
     "selectChecklistItemClickAction": "Klicken Sie auf die Aktion „Checklistenelement auswählen“.",
-    "checklistItemClickActionDescription": "Wählen Sie aus, was passiert, wenn Sie auf den Text einer Aufgabe klicken. \n„Als abgeschlossen markieren“ schaltet das Kontrollkästchen ein (Standard); \n„Aufgabennamen bearbeiten“ öffnet die Aufgabe zur Inline-Bearbeitung – Sie müssen noch das Kontrollkästchen selbst anklicken, um sie abzuschließen.",
+    "checklistItemClickActionDescription": "Wähle, was passiert, wenn du auf den Text einer Aufgabe klickst. „Als abgeschlossen markieren“ (Standard) schaltet das Kontrollkästchen um. „Aufgabennamen bearbeiten“ öffnet die Aufgabe zur Inline-Bearbeitung, und du klickst zum Abschließen auf das Kontrollkästchen selbst.",
     "checklistItemClickActionToggle": "Als vollständig/unvollständig markieren",
     "checklistItemClickActionEdit": "Listenelement bearbeiten",
     "newItemInsertion": "Position neuer Einträge",
@@ -927,7 +957,6 @@
     "newItemInsertionDescription": "Legen Sie fest, ob neue Einträge oben (Standard) oder unten in der Checkliste hinzugefügt werden.",
     "newItemInsertionTop": "Anfang der Liste",
     "newItemInsertionBottom": "Ende der Liste",
-    "useSystemDefault": "Systemstandard verwenden",
     "selectShowChecklistEmojis": "Emoji-Sichtbarkeit wählen",
     "showChecklistEmojisDescription": "Zeigt anhand des Textes automatisch ein Emoji neben Checklisteneinträgen."
   },
@@ -970,20 +999,24 @@
     "icon512": "512x512 Symbol",
     "icon512Description": "Hoch auflösendes Symbol für den PWA-Ladebildschirm.",
     "notifyNewUpdates": "Informiere mich über neue Versionen",
-    "thisUsesGithubAPI": "Dies nutzt die GitHub-API, um Aktualisierungen zu holen. Deaktiviert schaltet die API komplett aus und erlaubt keinen Datenverkehr zu und von GitHub.",
+    "thisUsesGithubAPI": "Dies nutzt die GitHub-API, um nach Aktualisierungen zu suchen. Ausgeschaltet gibt es keinen Datenverkehr zu und von GitHub.",
     "parseContent": "Immer den formatierten Inhalt anzeigen",
-    "parseContentEnabledDescription": "Wenn dies aktiviert ist, werden Titel in der Seitenleiste, in Suchergebnissen und überall in der Anwendung in der formatierten Version angezeigt.",
-    "parseContentDisabledDescription": "Wenn dies deaktiviert ist, wird der ursprüngliche Dateiname abgesichert und in einer von Menschen lesbaren Form angezeigt.",
-    "parseContentPerformanceWarning": "Wenn dies auf \"Nein\" gesetzt wird, wird die Leistung bei großen Datensätzen besser, aber die Lesbarkeit kann darunter leiden - insbesondere bei Dateinamen mit Sonderzeichen.",
+    "parseContentEnabledDescription": "Zeigt formatierte Titel in der Seitenleiste, in Suchergebnissen und überall sonst in der Anwendung.",
+    "parseContentDisabledDescription": "Zeigt stattdessen die ursprünglichen Dateinamen, bereinigt und lesbar gemacht.",
+    "parseContentPerformanceWarning": "Mit \"Nein\" laufen große Instanzen schneller, aber Titel sind schwerer zu lesen, vor allem Dateinamen mit nicht-lateinischen Zeichen.",
     "hideLanguageSelector": "Sprachen-Auswahl in der Kopfzeile ausblenden",
     "hideLanguageSelectorDescription": "Sprachen-Auswahl in der Kopfzeile anzeigen oder ausblenden",
+    "defaultDateFormat": "Standarddatumsformat",
+    "defaultDateFormatDescription": "Wird verwendet, wenn die Datumsformateinstellung eines Benutzers auf „Systemstandard verwenden“ eingestellt ist.",
+    "defaultTimeFormat": "Standardzeitformat",
+    "defaultTimeFormatDescription": "Wird verwendet, wenn die Zeitformateinstellung eines Benutzers auf „Systemstandard verwenden“ eingestellt ist.",
     "applicationIcons": "Anwendungssymbole",
     "saveChanges": "Änderungen speichern",
     "unsavedChanges": "Du hast nicht gespeicherte Änderungen.",
     "loadError": "Fehler beim Laden",
     "couldNotFetchSettings": "Einstellungen konnten nicht abgerufen werden.",
     "failedToLoadSettings": "Laden der Einstellungen ist fehlgeschlagen.",
-    "settingsSavedSuccessfully": "Einstellungen erfolgreich gespeichert.",
+    "settingsSavedSuccessfully": "Einstellungen gespeichert.",
     "failedToSaveSettings": "Einstellungen konnten nicht gespeichert werden.",
     "saveError": "Fehler beim Speichern",
     "unknownErrorOccurred": "Ein unbekannter Fehler ist aufgetreten.",
@@ -996,7 +1029,7 @@
     "colorVariables": "Farbvariablen",
     "livePreview": "Live-Vorschau",
     "unsavedCssChanges": "Du hast nicht gespeicherte CSS-Änderungen.",
-    "noCustomThemesYet": "Bisher gibt es keine benutzerdefinierten Themen. Klick auf \"Thema erstellen\", um loszulegen.",
+    "noCustomThemesYet": "Noch keine benutzerdefinierten Themen. Klick auf \"Thema erstellen\", um eins anzulegen.",
     "myCustomTheme": "Mein benutzerdefiniertes Thema",
     "iconNameDescription": "Symbolname (z.B., PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "Anwendungsversion",
@@ -1026,25 +1059,31 @@
     "enableTableToolbarDescription": "Werkzeugleiste aktivieren, die erscheint, wenn Tabellen bearbeitet werden",
     "bilateralLinks": "Wechselseitige Verknüpfungen",
     "bilateralLinksDescription": "Funktion aktivieren, Notizen und Aufgabenlisten im gleichen Dokument zu verknüpfen",
+    "historyEnabled": "Notizverlauf",
+    "historyDescription": "Versionsverlauf für Notizen. Ermöglicht die Wiederherstellung früherer Versionen. Nur manuelles Speichern erstellt Verlaufspunkte (nicht Autosave).",
+    "disableHistory": "Verlauf deaktivieren",
+    "disableHistoryWarning": "Das Deaktivieren des Verlaufs löscht dauerhaft alle gespeicherten Versionen für alle Nutzer. Dies kann nicht rückgängig gemacht werden.",
+    "historyDisabled": "Der Notizverlauf wurde deaktiviert und alle Verlaufsdaten gelöscht.",
+    "failedToDisableHistory": "Verlauf konnte nicht deaktiviert werden",
     "configureExternalServices": "Konfiguriere externe Service-URLs für Editor-Erweiterungen.",
     "drawioUrl": "Draw.io-URL",
     "optional": "(optional)",
-    "drawioUrlDescription": "Gib eine benutzerdefinierte URL zu einer Draw.io-Instanz ein. Lasse dies leer, um die öffentliche Standard-Instanz zu verwenden (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Nutze deine eigene Draw.io-Instanz. Leer lassen für die öffentliche (https://embed.diagrams.net).",
     "drawioUrlExample": "Beispiel für selbst gehosted: https://your-domain.com/drawio",
     "drawioProxyEnabled": "Draw.io über Jotty aufrufen",
-    "drawioProxyEnabledDescription": "Aktivieren, um Datenaustausch mit Draw.io über Jottys server laufen zu lassen. Bei internen Docker-Neztwerken (bspw., http://drawio:8080), die nicht von externen Nutzern aufrufbar sind, ist dies ein Muss.",
+    "drawioProxyEnabledDescription": "Leitet den Draw.io-Datenverkehr über Jottys Server. Nötig für interne Docker-Netzwerk-URLs (z. B. http://drawio:8080), die die Browser der Benutzer nicht erreichen.",
     "excalidrawUrl": "Excalidraw-URL",
-    "excalidrawUrlDescription": "Gib eine benutzerdefinierte URL zu einer Excalidraw-Instanz ein. Lasse dies leer, um die öffentliche Standard-Instanz zu verwenden (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Nutze deine eigene Excalidraw-Instanz. Leer lassen für die öffentliche (https://excalidraw.com).",
     "excalidrawUrlExample": "Beispiel für selbst gehosted: https://your-domain.com/excalidraw",
     "excalidrawProxyEnabled": "Excalidraw über Jotty aufrufen",
-    "excalidrawProxyEnabledDescription": "Aktivieren, um Datenaustausch mit Excalidraw über Jottys server laufen zu lassen. Bei internen Docker-Neztwerken (bspw., http://excalidraw:3000), die nicht von externen Nutzern aufrufbar sind, ist dies ein Muss.",
+    "excalidrawProxyEnabledDescription": "Leitet den Excalidraw-Datenverkehr über Jottys Server. Nötig für interne Docker-Netzwerk-URLs (z. B. http://excalidraw:3000), die die Browser der Benutzer nicht erreichen.",
     "saving": "Speichere...",
-    "editorSettingsSaved": "Editoreinstellungen erfolgreich gespeichert.",
+    "editorSettingsSaved": "Editoreinstellungen gespeichert.",
     "customEmojis": "Emoji Personalizzate",
-    "noEmojisYet": "Bisher keine benutzerdefinierten Emojis erstellt. Klick auf &quot;Emoji erstellen&quot;, um loszulegen.",
-    "enterAnyEmoji": "Gib irgendein Emoji ein oder verwende einen Emoji-Wähler (Windows: Win+.; Mac: Ctrl+Cmd+Space",
+    "noEmojisYet": "Noch keine benutzerdefinierten Emojis. Klick auf &quot;Emoji erstellen&quot;, um eins hinzuzufügen.",
+    "enterAnyEmoji": "Gib irgendein Emoji ein oder verwende den Emoji-Wähler (Windows: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Übersicht der Freigabeaktivitäten",
-    "detailedSharingBreakdown": "Detaillierter Bericht über das Freigabeverhalten und deren Nutzung",
+    "detailedSharingBreakdown": "Was geteilt wird und wer es teilt",
     "checkForUpdates": "Nach Updates suchen",
     "checkingForUpdates": "Suche nach Updates...",
     "updateAvailable": "Update verfügbar!",
@@ -1059,12 +1098,12 @@
     "userContent": "{checklistsLength} Aufgabenlisten • {notesLength} Notizen",
     "rebuildIndexes": "Indizes neu aufbauen",
     "rebuilding": "Bau neu auf...",
-    "successfullyRebuiltIndex": "Verknüpfungsindex für {username} erfolgreich neu aufgebaut",
+    "successfullyRebuiltIndex": "Verknüpfungsindex für {username} neu aufgebaut",
     "failedToRebuildIndex": "Konnte den Verknüpfungsindex für {username} nicht neu aufbauen",
     "totalItems": "{items} insgesamt von {userCount}",
     "privileges": "Admin-Berechtigungen",
     "adminContentAccess": "Admin-Zugriff auf Inhalte",
-    "adminContentAccessDescription": "Legt fest, ob Administratoren auf die Notizen und Aufgabenlisten aller Benutzer zugreifen können. Wenn dies deaktiviert ist, können Administratoren nur Benutzereinstellungen und Einstellungen ändern, aber nicht die Inhalte anderer Benutzer sehen.",
+    "adminContentAccessDescription": "Erlaubt Administratoren, die Notizen und Aufgabenlisten aller Benutzer zu öffnen. Ausgeschaltet können Administratoren Benutzer und Einstellungen verwalten, aber keine fremden Inhalte sehen.",
     "adminContentAccessYes": "Admins können alle Inhalte sehen",
     "adminContentAccessNo": "Admins können nur ihre eigenen Inhalte sehen",
     "superAdminOnly": "Kann nur vom Systembesitzer geändert werden",
@@ -1074,21 +1113,21 @@
     "confirmNewPassword": "Neues Passwort bestätigen",
     "dataExport": "Datenexport",
     "dataExportOptions": "Optionen für den Datenexport",
-    "selectExportType": "Wähle eine Export-Art aus und lade alle Daten aus deiner Applikation herunter.",
+    "selectExportType": "Wähle eine Export-Art und lade die Daten herunter.",
     "allChecklistsAndNotes": "Alle Aufgabenlisten und Notizen",
-    "allChecklistsAndNotesDescription": "Exportiert alle Aufgabenlisten und Notizen aller Benutzer. Dies erzeugt eine ZIP-Datei, die JSON-Daten enthält, organisiert nach Benutzer und Kategorie.",
+    "allChecklistsAndNotesDescription": "Exportiert die Aufgabenlisten und Notizen aller Benutzer als ZIP mit JSON-Dateien, gruppiert nach Benutzer und Kategorie.",
     "userChecklistsNotes": "Aufgabenlisten und Notizen eines bestimmten Benutzers",
     "userChecklistsNotesDescription": "Wähle einen Benutzer aus der Liste, um alle seine Aufgabenlisten und Notizen zu exportieren.",
     "allUsersData": "Kontodaten aller Benutzer",
     "allUsersDataDescription": "Exportiert eine JSON-Datei mit den Kontoinformationen aller Benutzer (Benutzernamen, Admin-Status etc.). Dieser Export enthält KEINE Notizen oder Aufgabenlisten.",
     "wholeDataFolder": "Komplettes Daten-Verzeichnis (Sicherheitskopie)",
-    "wholeDataFolderDescription": "Exportiert das gesamte 'data' Verzeichnis mit allen Benutzerinhalten, Metadaten und Einstellungen. Vorsicht bei der Benutzung, da dies zu einer sehr großen Datei führen kann!",
+    "wholeDataFolderDescription": "Exportiert das gesamte 'data' Verzeichnis mit allen Benutzerinhalten, Metadaten und Einstellungen. Die Datei kann groß werden.",
     "noSharingPermissionsLabel": "Bestimmte freigegebene Inhalte werden nicht angezeigt, da dies in den Zugriffsrechten so eingestellt ist.",
     "contentHidden": "Inhaltsdetails versteckt",
     "viewOnlySettingsNotice": "Nur der Systembesitzer kann diese Einstellungen ändern.",
     "auditLogContentRedacted": "[Inhalt versteckt]",
     "maxLogAgeDays": "Maximales Alter für Logs (Tage)",
-    "maxLogAgeDaysDescription": "Lege hier fest, wie lang Log-Nachrichten behalten werden. Wenn du die Log-Seite öffnest, wirst du aufgefordert, ältere Nachrihten zu löschen. Setze dies auf 0, wenn du sie unbegrenzt lange aufbewahren möchtest (keine automatisierten Aufforderungen aufzuräumen).",
+    "maxLogAgeDaysDescription": "Wie lange Audit-Logs aufbewahrt werden. Die Log-Seite bietet an, alles Ältere aufzuräumen. Setze dies auf 0, um Logs für immer zu behalten und nie gefragt zu werden.",
     "appPreferences": "Anwendungseinstellungen",
     "editEmoji": "Emoji bearbeiten",
     "addEmoji": "Emoji erstellen",
@@ -1107,16 +1146,6 @@
     "updateTagsTitle": "Notizen nach Hashtags durchsuchen und Frontmatter aktualisieren",
     "tagsUpdated": "{processed} Dateien verarbeitet, {updated} mit neuen Tags aktualisiert",
     "failedToUpdateTags": "Tags konnten nicht aktualisiert werden",
-    "historyEnabled": "Notizverlauf",
-    "historyDescription": "Versionsverlauf für Notizen. Ermöglicht die Wiederherstellung früherer Versionen. Nur manuelles Speichern erstellt Verlaufspunkte (nicht Autosave).",
-    "disableHistory": "Verlauf deaktivieren",
-    "disableHistoryWarning": "Das Deaktivieren des Verlaufs löscht dauerhaft alle gespeicherten Versionen für alle Nutzer. Dies kann nicht rückgängig gemacht werden.",
-    "historyDisabled": "Der Notizverlauf wurde deaktiviert und alle Verlaufsdaten gelöscht.",
-    "failedToDisableHistory": "Verlauf konnte nicht deaktiviert werden",
-    "defaultDateFormat": "Standarddatumsformat",
-    "defaultDateFormatDescription": "Wird verwendet, wenn die Datumsformateinstellung eines Benutzers auf „Systemstandard verwenden“ eingestellt ist.",
-    "defaultTimeFormatDescription": "Wird verwendet, wenn die Zeitformateinstellung eines Benutzers auf „Systemstandard verwenden“ eingestellt ist.",
-    "defaultTimeFormat": "Standardzeitformat",
     "borderRadius": "Eckenradius",
     "borderRadiusDescription": "Legt die Eckenrundung für die gesamte Instanz fest. Nutzer können sie in den Schnelleinstellungen überschreiben.",
     "borderRadiusSaved": "Eckenradius gespeichert",
@@ -1132,6 +1161,9 @@
     "tryAgain": "Probier es nochmal",
     "contactSupport": "Kundendienst kontaktieren",
     "invalidInput": "Ungültige Eingabe",
+    "invalidEditorSettings": "Editoreinstellungen müssen ein Objekt sein, nichts wurde gespeichert",
+    "invalidEditorSetting": "Die Editoreinstellung {field} hat den falschen Typ, nichts wurde gespeichert",
+    "categoryOutOfBounds": "Diese Kategorie liegt außerhalb deiner Notizen, deshalb wurde nichts erstellt",
     "requiredField": "Dieses Feld muss ausgefüllt werden",
     "emailInvalid": "Bitte gib eine gültige E-Mail-Adresse ein",
     "passwordTooShort": "Das Passwort muss mindestens 8 Zeichen haben",
@@ -1139,43 +1171,44 @@
     "networkError": "Netzwerkfehler",
     "timeout": "Anfrage hat zu lange gedauert",
     "permissionDenied": "Keine Berechtigung",
-    "requiredPermissions": "Du hast nicht die erforderlichen Berechtigungen, um diese Aktion auszuführen.",
+    "requiredPermissions": "Dafür hast du keine Berechtigung.",
     "loadError": "Fehler beim Laden",
     "failedToLoadCustomEmojis": "Benutzerdefinierte Emojis konnten nicht geladen werden",
-    "emojiDeletedSuccessfully": "Emoji erfolgreich gelöscht",
+    "emojiDeletedSuccessfully": "Emoji gelöscht",
     "deleteError": "Fehler beim Löschen",
     "failedToDeleteEmoji": "Emoji konnte nicht gelöscht werden",
     "validationError": "Vaidierungs-Fehler",
     "keywordAndEmojiRequired": "Schlüsselwort und Emoji müssen angegeben werden",
     "duplicateKeyword": "Schlüsselwort schon in Verwendung",
     "keywordAlreadyExists": "Dieses Schlüsselwort gibt es schon",
-    "emojiUpdatedSuccessfully": "Emoji erfolgreich aktualisiert",
-    "emojiCreatedSuccessfully": "Emoji erfolgreich erstellt",
+    "emojiUpdatedSuccessfully": "Emoji aktualisiert",
+    "emojiCreatedSuccessfully": "Emoji erstellt",
     "saveError": "Fehler beim Speichern",
     "failedToSaveEmoji": "Fehler beim Speichern des Emojis",
     "failedToLoadCustomCSS": "Benutzerdefiniertes CSS konnte nicht geladen werden",
     "couldNotLoadCustomCSS": "Benutzerdefiniertes CSS konnte nicht geladen werden.",
     "couldNotLoadThemes": "Themen konnten nicht geladen werden.",
-    "customCSSSavedSuccessfully": "Benutzerdefiniertes CSS erfolgreich gespeichert.",
+    "customCSSSavedSuccessfully": "Benutzerdefiniertes CSS gespeichert.",
     "themeNotFound": "Thema nicht gefunden.",
-    "themeDeletedSuccessfully": "Thema erfolgreich gelöscht.",
+    "themeDeletedSuccessfully": "Thema gelöscht.",
     "themeNameRequired": "Name des Themas muss ausgefüllt werden.",
-    "themeSavedSuccessfully": "Thema erfolgreich {action}.",
+    "themeSavedSuccessfully": "Thema {action}.",
     "anUnknownErrorOccurred": "Ein unbekannter Fehler ist aufgetreten.",
     "usernameRequired": "Benutzername muss angegeben werden",
     "passwordRequired": "Passwort muss angegeben werden",
     "passwordMinLength": "Passwort muss mindestens 6 Zeichen lang sein",
     "passwordsDoNotMatch": "Die Passwörter passen nicht zusammen",
-    "userSavedSuccessfully": "Benutzer erfolgreich {mode}!",
-    "failedToSaveUser": "Benutzer {user} konnte nicht {mode}",
+    "userSavedSuccessfully": "Benutzer {mode}.",
+    "failedToSaveUser": "Benutzer konnte nicht {mode} werden",
     "anErrorOccurred": "Ein Fehler ist aufgetreten.",
     "deleteUserConfirmation": "Willst du Benutzer \"{username}\" wirklich löschen? Das kann nicht rückgängig gemacht werden.",
-    "userDeletedSuccessfully": "Benutzer erfolgreich gelöscht.",
-    "failedToDeleteUser": "Benutzer konnte nicht gelöscht werden"
+    "userDeletedSuccessfully": "Benutzer gelöscht.",
+    "failedToDeleteUser": "Benutzer konnte nicht gelöscht werden",
+    "readOnlyFolder": "Dieser Ordner ist auf dem Server schreibgeschützt, die Änderung konnte nicht gespeichert werden."
   },
   "pwa": {
     "installPromptTitle": "Anwendung installieren",
-    "installPromptMessage": "Installiere diese Anwendung auf deinem Gerät, um eine bessere Erfahrung zu haben.",
+    "installPromptMessage": "Installiere Jotty auf deinem Gerät, damit es sich wie eine App öffnet",
     "installButton": "Installieren",
     "updateAvailable": "Neue Version verfügbar",
     "updateMessage": "Eine neue Version ist verfügbar.",
@@ -1195,7 +1228,11 @@
     "blockquote": "Zitat",
     "codeBlock": "Code-Block",
     "link": "Verknüpfung",
+    "addLink": "Link hinzufügen",
+    "enterURL": "URL eingeben",
     "image": "Bild",
+    "addImage": "Bild hinzufügen",
+    "enterImageURL": "Bild-URL eingeben",
     "table": "Tabelle",
     "horizontalRule": "Trennlinie",
     "undo": "Rückgängig",
@@ -1229,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Rich-Editor-Modus umschalten",
     "toggleMarkdownMode": "Markdown-Modus umschalten",
+    "quickControls": "Editor-Steuerung",
     "toggleBold": "Fettdruck umschalten",
     "toggleItalic": "Kursivdruck umschalten",
     "toggleUnderline": "Unterstreichung umschalten",
@@ -1318,19 +1356,15 @@
     "drawioDescription": "Visueller Diagramm-Editor",
     "excalidrawDescription": "Editor für Diagramme im Zeichenstil",
     "noLanguagesFound": "Keine Sprachen gefunden",
-    "ruler": "Lineal",
-    "lineNumbers": "Zeilennummern",
-    "addLink": "Link hinzufügen",
-    "enterURL": "URL eingeben",
-    "addImage": "Bild hinzufügen",
-    "enterImageURL": "Bild-URL eingeben",
     "callout": "Hinweis",
     "createCallout": "Hinweisblock erstellen",
     "changeCalloutType": "Hinweistyp ändern",
     "calloutInfo": "Info",
     "calloutWarning": "Warnung",
     "calloutSuccess": "Erfolg",
-    "calloutDanger": "Gefahr"
+    "calloutDanger": "Gefahr",
+    "ruler": "Lineal",
+    "lineNumbers": "Zeilennummern"
   },
   "sharing": {
     "share": "Freigeben",
@@ -1406,16 +1440,16 @@
     "viewNote": "Notiz anzeigen",
     "editNote": "Notiz bearbeiten",
     "privateKeyWarning": "WARNUNG: Dein privater Schlüssel erlaubt die Entschlüsselung aller verschlüsselter Notizen. Exportiere ihn nur, wenn du verstehst, was das für die Sicherheit bedeutet. Weitermachen?",
-    "publicKeyExported": "Öffentlichen Schlüssel erfolgreich exportiert",
-    "privateKeyExported": "Privaten Schlüssel erfolgreich exportiert",
+    "publicKeyExported": "Öffentlicher Schlüssel exportiert",
+    "privateKeyExported": "Privater Schlüssel exportiert",
     "failedToExportKey": "Schlüssel konnte nicht exportiert werden",
     "unexpectedError": "Ein unerwarteter Fehler ist aufgetreten",
-    "keysDeleted": "Schlüssel erfolgreich gelöscht",
+    "keysDeleted": "Schlüssel gelöscht",
     "failedToDeleteKeys": "Schlüssel konnten nicht gelöscht werden",
     "autoDecryptUpdated": "Einstellung zur automatischen Entschlüsselung aktualisiert",
     "failedToUpdateSetting": "Einstellung konnte nicht aktualisiert werden",
-    "enterValidPath": "Bitte gibt einen gültigen Pfad ein",
-    "customPathSet": "Benutzerdefinierter Schlüssel-Pfad wurde erfolgreich gesetzt",
+    "enterValidPath": "Gib einen gültigen Pfad ein",
+    "customPathSet": "Benutzerdefinierter Schlüssel-Pfad gesetzt",
     "failedToSetCustomPath": "Benutzerdefinierter Pfad konnte nicht gesetzt werden",
     "thisNoteIsEncrypted": "Diese Notiz ist verschlüsselt",
     "noteProtectedWith": "Diese Notiz ist durch eine {type}-Verschlüsselung geschützt.",
@@ -1426,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Wähle die Methode",
     "encryptionMethodsTitle": "Verschlüsselungsmethoden",
-    "xchachaDescription": "XChaCha20-Poly1305: moderne, schnelle, passwort-basierte Verschlüsselung",
-    "pgpDescription": "PGP: Traditionelle Kryptographie mit öffentlichem Schlüssel und Schlüsselpaarverwaltung",
+    "xchachaDescription": "XChaCha20-Poly1305: Verschlüsselung mit einer Passphrase",
+    "pgpDescription": "PGP: Verschlüsselung mit öffentlichem Schlüssel und einem Schlüsselpaar, das du verwaltest",
     "encryptionKeys": "Schlüssel",
     "keysConfigured": "Schlüssel konfiguriert",
     "algorithm": "Algorithmus:",
@@ -1441,9 +1475,9 @@
     "keysDisabledInDemo": "Gespeicherte Schlüssel sind im Demomodus deaktiviert.",
     "encryptionSettings": "Verschlüsselungseinstellungen",
     "promptForPassphrase": "Passwort abfragen, wenn verschlüsselte Notizen geöffnet werden",
-    "promptForPassphraseDescription": "Wenn aktiviert, wirst du nach dem Passwort gefragt, wenn du eine verschlüsselte Notiz öffnest. Die Notiz bleibt auf dem Server verschlüsselt, aber du kannst den Inhalt in deiner aktuellen Sitzung sehen.",
+    "promptForPassphraseDescription": "Fragt nach deiner Passphrase, wenn du eine verschlüsselte Notiz öffnest. Die Notiz bleibt auf dem Server verschlüsselt und du siehst den entschlüsselten Inhalt nur in diesem Tab.",
     "customKeyPath": "Benutzerdefinierter Schlüssel-Pfad (lokale Installationen)",
-    "customKeyPathDescription": "Gib einen benutzerdefinierten (absoluten) Dateipfad an, unter dem deine Schlüssel gespeichert werden. Dies ist nur nötig für lokale Installationen. Docker-Benutzer sollten stattdessen den Standardpfad in der docker-compose.yml mappen.",
+    "customKeyPathDescription": "Ein absoluter Dateipfad für deine Schlüssel. Nur lokale Installationen brauchen das. Docker-Benutzer sollten stattdessen den Standardpfad in der docker-compose.yml mappen.",
     "customPath": "Benutzerdefinierter Pfad",
     "customPathPlaceholder": "/home/user/my-keys",
     "customPathHelp": "Muss ein absoluter Pfad sein (z.B., /home/user/my-keys or C:\\Users\\user\\my-keys)",
@@ -1462,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "Notizinhalt wird vor dem Speichern verschlüsselt",
     "passphraseRequired": "Passwort muss angegeben werden",
     "incorrectPassphrase": "Ungültiges Passwort",
-    "noteEncryptedSuccessfully": "Notiz erfolgreich verschlüsselt",
+    "noteEncryptedSuccessfully": "Notiz verschlüsselt",
     "failedToEncryptNote": "Notiz konnte nicht verschlüsselt werden",
-    "noteDecryptedSuccessfully": "Notiz erfolgreich entschlüsselt",
+    "noteDecryptedSuccessfully": "Notiz entschlüsselt",
     "failedToDecryptNote": "Notiz konnte nicht entschlüsselt werden",
     "passphrase": "Passwort",
     "enterYourPassphrase": "Gib das Passwort ein",
@@ -1492,8 +1526,8 @@
     "privateKey": "Privater Schlüssel",
     "noStoredKeysFound": "Keine gespeicherten Schlüssel gefunden",
     "noEncryptionKeysConfigured": "Du hast keine Schlüssel konfiguriert",
-    "pastePublicKeyBelow": "Bitte füge unten einen öffentlichen Schlüssel ein, um den Notizinhalt zu verschlüsseln",
-    "generateOrImportKeysInProfile": "Unter Profil → Verschlüsselung kannst du Schlüssel speziell für Jotty erzeugen oder importieren",
+    "pastePublicKeyBelow": "Füge unten einen öffentlichen Schlüssel ein, um den Notizinhalt zu verschlüsseln",
+    "generateOrImportKeysInProfile": "Unter Profil > Verschlüsselung kannst du Schlüssel für Jotty erzeugen oder importieren",
     "useCustomKey": "Benutzerdefinierten {keyType} Schlüssel verwenden",
     "signWithPrivateKey": "Mit privatem Schlüssel signieren",
     "proveAuthenticityOfNote": "Authentizität dieser Notiz prüfen",
@@ -1513,7 +1547,7 @@
     "yourEmail": "deine@email.de",
     "generating": "Erzeuge...",
     "generateKeys": "Schlüssel erzeugen",
-    "keysGeneratedSuccessfully": "Schlüssel erfolgreich erzeugt",
+    "keysGeneratedSuccessfully": "Schlüssel erzeugt",
     "importPGPKeys": "PGP Schlüssel importieren",
     "publicKeyLabel": "Öffentlicher Schlüssel",
     "privateKeyLabel": "Privater Schlüssel",
@@ -1522,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Merke dir das Passwort! Es kann nicht wiederhergestellt werden.",
     "withoutPassphraseCannotDecrypt": "Ohne das Passwort kannst du deine Notizen nicht entschlüsseln.",
     "backupPrivateKeySafely": "Mache eine Sicherheitskopie deines privaten Schlüssels",
-    "pgpKeyPairGeneratedSuccessfully": "PGP Schlüsselpaar erfolgreich erzeugt",
+    "pgpKeyPairGeneratedSuccessfully": "PGP-Schlüsselpaar erzeugt",
     "failedToGenerateKeys": "Schlüssel konnten nicht erzeugt werden",
     "fingerprint": "Fingerabdruck",
     "keysSavedSecurely": "Keine Schlüssel wurden sicher gespeichert.",
@@ -1536,13 +1570,13 @@
     "bothKeysRequired": "Öffentlicher und privater Schlüssel werden benötigt",
     "invalidPublicKeyFormat": "Ungültiges Format für einen öffentlichen Schlüssel Muss ein in ASCII eingebetteter PGP Schlüssel sein.",
     "invalidPrivateKeyFormat": "Ungültiges Format für einen privaten Schlüssel Muss ein in ASCII eingebetteter PGP Schlüssel sein.",
-    "keysImportedSuccessfully": "Schlüssel erfolgreich importiert",
+    "keysImportedSuccessfully": "Schlüssel importiert",
     "failedToImportKeys": "Schlüssel konnten nicht importiert werden",
     "created": "Verschlüsselung eingerichtet",
     "notePlaceholder": "Ich bin ein Platzhalter, weil man eine leere Notiz nicht verschlüsseln kann."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Diese Einstellungen wirken sich nur auf die aktuelle Browser-Sitzung aus. Für dauerhafte Einstellungen schau bitte in deine",
+    "sessionOnlyPrefix": "Diese Einstellungen gelten nur für diese Browser-Sitzung. Für dauerhafte Einstellungen schau in deine",
     "accountSettings": "Benutzereinstellungen",
     "autosaveNotes": "Notizen automatisch speichern",
     "showNotePreview": "Vorschau der Notizen auf Karten zeigen",
@@ -1571,20 +1605,45 @@
     "migrationSuccessful": "Migration erfolgreich",
     "returnToApp": "Zur Anwendung zurückkehren",
     "adminAccessRequired": "Adminrechte nötig",
-    "adminAccessDescription": "Diese Migration erfordert Adminstrationsrechte. Bitte kontaktiere einen Administrator, damit er die System-Migration durchführt.",
+    "adminAccessDescription": "Diese Migration braucht einen Administrator. Bitte einen, sie auszuführen.",
     "whatsHappening": "Was passiert gerade?",
-    "sharingDataMigrationDescription": "Das System muss deine Freigabedaten migrieren. Das ist ein einmaliger Prozess, der Administrationsrechte benötigt.",
+    "sharingDataMigrationDescription": "Jotty muss deine Freigabedaten migrieren. Das passiert nur einmal und braucht einen Administrator.",
     "whatsChanging": "Was ändert sich?",
     "automaticBackupIncluded": "Automatische Sicherheitskopie inkludiert",
     "yamlFrontmatterIndustryStandard": "YAML-Frontmatter ist Industriestandard",
-    "noMigrationNeeded": "Keine Migration war nötig - dein System ist schon auf dem neusten Stand.",
-    "importantBackupData": "Wichtig: Lege eine Sicherheitskopie deiner Daten an"
+    "noMigrationNeeded": "Nichts zu migrieren, deine Daten sind schon auf dem neuesten Stand.",
+    "importantBackupData": "Wichtig: Lege eine Sicherheitskopie deiner Daten an",
+    "sharingNowWithData": "Deine Freigabedaten liegen jetzt bei deinen Notizen und Ordnern.",
+    "sharingMovesDescription": "Freigaben ziehen aus einer zentralen Datei in deine Daten um. Ordner lassen sich jetzt teilen, und geteilte Ordner erscheinen in deiner eigenen Seitenleiste statt in einem eigenen Bereich.",
+    "whatsHappeningBody": "Jede Freigabe in <code>.sharing.json</code> wird in das Frontmatter des zugehörigen Elements geschrieben, und jeder Ordner bekommt eine <code>.category-info.json</code> mit seiner Identität, seinen Freigaben und seiner Sortierung. Die alten Dateien werden entfernt, sobald die Daten umgezogen sind.",
+    "migrationChanges": "Änderungen durch die Migration",
+    "sharingTravelsTitle": "Freigaben reisen mit der Datei",
+    "sharingTravelsBody": "Jedes geteilte Element speichert in seinem eigenen Frontmatter, mit wem es geteilt ist. Verschieben oder Umbenennen macht eine Freigabe also nie kaputt.",
+    "folderSharingTitle": "Ordnerfreigabe",
+    "folderSharingBody": "Teile einen Ordner, und alles darin, jetzt und in Zukunft, wird mitgeteilt. Empfänger sehen ihn als normalen Ordner in ihrer eigenen Seitenleiste.",
+    "oneFilePerFolderTitle": "Eine Datei pro Ordner",
+    "oneFilePerFolderBody": "<code>.order.json</code> geht in <code>.category-info.json</code> auf, die Sortierung richtet sich nach der uuid statt nach dem Dateinamen.",
+    "permissionsUnchangedTitle": "Berechtigungen bleiben gleich",
+    "permissionsUnchangedBody": "Lesen, Bearbeiten und Löschen werden genau so übernommen, wie sie heute sind, pro Benutzer und pro Element.",
+    "backupWarningBody": "Diese Migration schreibt das Frontmatter deiner Notizen und Aufgabenlisten neu und löscht die alten Dateien <code>.sharing.json</code> und <code>.order.json</code>. Sichere deinen <code>data</code>-Ordner, bevor du weitermachst.",
+    "backupConfirmLabel": "Ich habe meinen data-Ordner gesichert und verstehe, was die Migration macht.",
+    "backupConfirmHint": "Bestätige, dass du eine Sicherung hast, bevor du weitermachst.",
+    "sharingDataMigrated": "Deine Freigabe- und Sortierdaten wurden migriert.",
+    "whatWasChanged": "Was geändert wurde:",
+    "migrationPartial": "Migration mit Resten abgeschlossen",
+    "leftoversTitle": "Einige alte Dateien wurden behalten",
+    "leftoversBody": "Die Migration konnte nicht alles übernehmen, deshalb liegen die unten aufgeführten alten Dateien unverändert auf der Festplatte. Nichts wurde gelöscht. Du kannst die Ursache beheben und die Migration erneut ausführen, oder jetzt in die App gehen und dich später darum kümmern.",
+    "overrideConfirmLabel": "Trotzdem weitermachen und diese Seite nicht mehr anzeigen.",
+    "overrideConfirmHint": "Die übrigen Dateien bleiben auf der Festplatte, aber die App behandelt deine Daten als migriert. Oben aufgeführte Freigaben oder Sortierungen greifen erst, wenn du erneut migrierst. Das geht jederzeit über /migration?force=1.",
+    "continueAnyway": "Trotzdem weiter",
+    "overriding": "Wird fortgesetzt...",
+    "overrideFailed": "Die Migration konnte nicht übersprungen werden"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Kategorie erfolreich umbenannt",
+    "categoryRenamedSuccessfully": "Kategorie umbenannt",
     "failedToRenameCategory": "Kategorie konnte nicht umbenannt werden",
     "categoryRenamedSuccessfullyMessage": "Kategorie {categoryName} umbenannt in {newName}",
-    "failedToRenameCategoryMessage": "Beim umbenennen der Kategorie ist ein Fehler aufgetreten."
+    "failedToRenameCategoryMessage": "Beim Umbenennen der Kategorie ist etwas schiefgelaufen."
   },
   "auditLogs": {
     "title": "Audit-Logs",
@@ -1601,17 +1660,17 @@
     "exportJSON": "JSON exportieren",
     "exportCSV": "CSV exportieren",
     "cleanupOldLogs": "Alte Logeinträge aufräumen",
-    "confirmCleanup": "Bist du sicher, dass du Logeinträge löschen willst, die älter sind als {days} Tage? Dies betrifft ALLE Benutzer und kann nicht rückgängig gemacht werden.",
+    "confirmCleanup": "Logeinträge löschen, die älter als {days} Tage sind? Das betrifft ALLE Benutzer und kann nicht rückgängig gemacht werden.",
     "confirmCleanupUnlimited": "Es ist keine automatische Reinigung konfiguriert (unendliche Speicherung). Du kannst immer noch Einträge manuell löschen, wenn du willst.",
     "deleteAllLogsModalTitle": "Ganzes Audit-Log löschen",
     "deleteAllLogsWarning": "Dadurch werden ALLE Logeinträge gelöscht, nicht nur ältere.",
     "deleteAllLogsWarningDescription": "Das gesamte Audit-Log wird vom System gelöscht.",
     "deletingAllLogs": "Lösche alle Logeinträge...",
     "deleteAllLogsButton": "Alle Logeinträge löschen",
-    "cleanupSuccess": "{count} alte Logdateien wurden erfolgreich gelöscht.",
+    "cleanupSuccess": "{count} alte Logdateien gelöscht",
     "cleanupError": "Alte Logeinträge konnten nicht gelöscht werden",
-    "userDescription": "Zeige alle deine Aktivitäten und Aktionen im System",
-    "adminDescription": "Zeige und verwalte Nutzeraktivität im gesamten System",
+    "userDescription": "Alles, was du in Jotty gemacht hast",
+    "adminDescription": "Was jeder Benutzer auf dieser Instanz gemacht hat",
     "level": "Level",
     "allLevels": "Alle Level",
     "allCategories": "Alle Kategorien",
@@ -1636,7 +1695,6 @@
     "register": "Registrierung",
     "sessionterminated": "Sitzung beendet",
     "usercreated": "Nutzer erstellt",
-    "userUpdated": "Nutzer aktualisiert",
     "userupdated": "Nutzer aktualisiert",
     "userdeleted": "Nutzer gelöscht",
     "profileupdated": "Profil geändert",
@@ -1676,9 +1734,9 @@
     "topActions": "Häufigste Aktionen",
     "mostActiveUsers": "Aktivste Benutzer",
     "oldLogsFound": "Es gibt {count} Logdateien, die älter sind als {days} Tage.",
-    "oldLogsFoundDescription": "Möchtest du sie aufräumen? Diese Aktion kann nicht rückgängig gemacht werden.",
+    "oldLogsFoundDescription": "Aufräumen? Das kann nicht rückgängig gemacht werden.",
     "cleanUpNow": "Jetzt aufräumen",
-    "cleanupSuccessMessage": "{count} alte Logdateien wurden erfolgreich gelöscht.",
+    "cleanupSuccessMessage": "{count} alte Logdateien gelöscht.",
     "security": "Sicherheit",
     "mfasecretgenerated": "MFA-Geheimnis erzeugt",
     "mfaenabled": "MFA aktiviert",
@@ -1694,6 +1752,7 @@
     "howTo": "Wie macht man...",
     "shortcuts": "Kurzbefehle",
     "markdownGuide": "Markdown-Erklärung",
+    "brain": "Links & Brain",
     "customisations": "Anpassungen",
     "docker": "Docker",
     "envVariables": "Umgebungsvariablen",
@@ -1701,37 +1760,21 @@
     "pwa": "PWA",
     "encryption": "Verschlüsselung",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Übersetzungen",
     "unraid": "Unraid",
     "patches": "Patches"
   },
-  "history": {
-    "fetchError": "Der Verlauf konnte nicht geladen werden",
-    "restoreError": "Die Version konnte nicht wiederhergestellt werden",
-    "manualSavesOnly": "Der Verlauf wird nur beim manuellen Speichern erstellt, nicht beim automatischen Speichern.",
-    "noHistory": "Keine Historie verfügbar",
-    "noHistoryDescription": "Speichern Sie Ihre Notiz, um einen Verlaufspunkt zu erstellen.",
-    "restore": "Wiederherstellen",
-    "loadMore": "Mehr laden",
-    "viewContent": "Inhalt anzeigen",
-    "viewDiff": "Änderungen anzeigen",
-    "noteHistory": "Notizverlauf",
-    "restoreVersion": "Version wiederherstellen",
-    "restoreConfirm": "Diese Version wiederherstellen? \nAktuelle Inhalte werden ersetzt.",
-    "featureDisabled": "Verlauf deaktiviert",
-    "disabledAdmin": "Der Notizverlauf ist derzeit deaktiviert. Sie können ihn in den Administrator-Einstellungen > Editor aktivieren.",
-    "disabledUser": "Der Notizverlauf ist derzeit deaktiviert. Bitte wenden Sie sich an Ihren Administrator, um diese Funktion zu aktivieren.",
-    "goToSettings": "Zu den Einstellungen",
-    "actionCreate": "Erstellt",
-    "actionUpdate": "Aktualisiert",
-    "actionRename": "Umbenannt",
-    "actionMove": "Verschoben",
-    "actionDelete": "Gelöscht",
-    "actionInit": "Initialisiert",
-    "actionUnknown": "Geändert"
+  "notFound": {
+    "title": "Seite nicht gefunden",
+    "newHaiku": "Neues Haiku",
+    "goHome": "Zur Startseite",
+    "seenCount": "Du hast {count} {count, plural, one {Haiku} other {Haikus}} gesehen",
+    "imNoPoet": "Ich bin kein Dichter, und Jotty auch nicht. Das sind zufällige Wörter in Folge."
   },
   "notifications": {
     "title": "Benachrichtigungen",
+    "unread": "ungelesen",
     "markAllRead": "Alles als gelesen markieren",
     "clearAll": "Alles löschen",
     "empty": "Keine Benachrichtigungen",
@@ -1739,7 +1782,6 @@
     "assignmentMessage": "„{task}“ in „{board}“",
     "reminderTitle": "Aufgabe überfällig",
     "reminderMessage": "„{task}“ in „{board}“ ist abgelaufen",
-    "unread": "ungelesen",
     "sharingTitle": "{user} hat ein {type} mit dir geteilt",
     "sharingMessage": "Öffnen, um das geteilte {type} anzuzeigen",
     "sharingFolderTitle": "{user} hat einen {type}-Ordner mit dir geteilt",
@@ -1747,11 +1789,92 @@
     "mentionTitle": "{user} hat dich in einem Kommentar erwähnt",
     "mentionMessage": "„{board}“"
   },
-  "notFound": {
-    "title": "Seite nicht gefunden",
-    "newHaiku": "Neues Haiku",
-    "goHome": "Zur Startseite",
-    "seenCount": "Du hast {count} {count, plural, one {Haiku} other {Haikus}} gesehen",
-    "imNoPoet": "Ich bin kein Dichter, und Jotty auch nicht. Das sind zufällige Wörter in Folge."
+  "relations": {
+    "indexing": "Verknüpfungen werden indiziert...",
+    "unreachable": "nicht erreichbar",
+    "createFromWikilink": "Eine Notiz namens \"{title}\" erstellen",
+    "mentionedIn": "Erwähnt in",
+    "mentionedInHint": "Diese Notizen nutzen den Titel als reinen Text. Verlinke eine, um sie zu verbinden.",
+    "linkMention": "Verlinken",
+    "linked": "Erwähnung in {title} verlinkt",
+    "linkFailed": "Die Erwähnung konnte nicht verlinkt werden",
+    "kind": {
+      "mention": "Link",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "Brain",
+    "openBrain": "Im Brain öffnen",
+    "search": "Such etwas in deinem Brain...",
+    "dimension": "Ansicht",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Rund um dieses Element",
+    "global": "Alles",
+    "depth": "Tiefe {depth}",
+    "colourBy": "Färben nach",
+    "colourModes": {
+      "type": "Typ",
+      "category": "Kategorie"
+    },
+    "filters": {
+      "notes": "Notizen",
+      "checklists": "Aufgabenlisten",
+      "tags": "Tags",
+      "ghosts": "Noch nicht geschrieben",
+      "suggestions": "Vorschläge",
+      "orphans": "Einzelgänger"
+    },
+    "kind": {
+      "note": "Notiz",
+      "checklist": "Aufgabenliste",
+      "ghost": "Noch nicht geschrieben",
+      "tag": "Tag"
+    },
+    "edges": {
+      "mention": "Link",
+      "wiki": "Wikilink",
+      "suggested": "Vorgeschlagen",
+      "tag": "Tag"
+    },
+    "linksTo": "Verlinkt auf",
+    "linkedFrom": "Verlinkt von",
+    "suggested": "Könnte zusammenhängen",
+    "promote": "Mit {title} verlinken",
+    "lonely": "Hier ist noch nichts verbunden. Erwähne es mit @ oder [[ in einer anderen Notiz.",
+    "open": "Öffnen",
+    "createGhost": "Diese Notiz schreiben",
+    "openTag": "Alles mit diesem Tag anzeigen",
+    "createFailed": "Die Notiz konnte nicht erstellt werden",
+    "connectFailed": "Die beiden konnten nicht verlinkt werden",
+    "connected": "{source} mit {target} verlinkt",
+    "empty": "Dein Brain ist still. Verlinke Notizen und Aufgabenlisten mit @ oder [[, dann tauchen sie hier auf.",
+    "viewingOwner": "Brain von {owner}",
+    "summary": "{items} Elemente, {links} Links, {shown} angezeigt"
+  },
+  "apiExplorer": {
+    "title": "API-Explorer",
+    "intro": "Jeder Endpunkt, den diese Instanz (v{version}) anbietet, erzeugt aus dem Code, der ihn bedient. Wähle einen, füll ihn aus und schick ihn ab.",
+    "realData": "Anfragen laufen als Besitzer des API-Schlüssels gegen echte Daten. Ein DELETE hier löscht wirklich.",
+    "apiKey": "API-Schlüssel",
+    "apiKeyHint": "Bleibt nur auf dieser Seite und wird vergessen, wenn du sie verlässt.",
+    "useMyKey": "Meinen Schlüssel verwenden",
+    "noKeyYet": "Du hast noch keinen API-Schlüssel. Erzeuge einen in deinen Profileinstellungen.",
+    "filter": "Filter",
+    "filterPlaceholder": "Pfad, Name oder Methode",
+    "noMatches": "Nichts passt zu diesem Filter.",
+    "body": "Request-Body (JSON)",
+    "showSchema": "Schema anzeigen",
+    "hideSchema": "Schema ausblenden",
+    "send": "Senden",
+    "sending": "Wird gesendet...",
+    "keyRequired": "Füge zuerst einen API-Schlüssel hinzu.",
+    "noKeyNeeded": "kein API-Schlüssel nötig",
+    "deprecated": "veraltet",
+    "requestFailed": "Die Anfrage hat den Server nie erreicht. Prüf deine Verbindung.",
+    "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/en.json b/app/_translations/en.json
index 47ecb3036..f8fa4f214 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -101,7 +101,7 @@
     "deleteFile": "Delete file",
     "fileTooLarge": "File is too large. Maximum size is {maxSizeMB}MB. Your file is {fileSizeMB}MB.",
     "uploadFailed": "Upload failed",
-    "uploadFailedRetry": "Upload failed. Please try again.",
+    "uploadFailedRetry": "Upload failed. Try again.",
     "failedToDeleteFile": "Failed to delete file",
     "previousMonth": "Previous month",
     "nextMonth": "Next month",
@@ -134,7 +134,7 @@
     "parentCategory": "Parent Category (Optional)",
     "noParent": "No parent (root level)",
     "categoryNamePlaceholder": "Enter category name...",
-    "notAllowedName": "{name} is not allowed. Please choose a different name.",
+    "notAllowedName": "{name} is not allowed. Pick a different name.",
     "createCategory": "Create category",
     "selectCategory": "Select category...",
     "categoryWillBeCreatedIn": "New category will be created in:",
@@ -174,7 +174,7 @@
     "noResults": "No results",
     "by": "by {owner}",
     "unsavedChanges": "Unsaved Changes",
-    "unsavedChangesDetected": "⚠️ Unsaved Changes Detected",
+    "unsavedChangesDetected": "Unsaved changes",
     "unsavedChangesMessage": "You have unsaved changes in {noteTitle}. If you leave now, your changes will be lost.",
     "whatToDoWithUnsavedChanges": "What would you like to do with your unsaved changes?",
     "discard": "Discard",
@@ -260,10 +260,10 @@
     "noHistoryDescription": "Save your note to create a history point.",
     "loadMore": "Load More",
     "featureDisabled": "History Disabled",
-    "disabledAdmin": "Note history is currently disabled. You can enable it in Admin Settings > Editor.",
-    "disabledUser": "Note history is currently disabled. Please contact your administrator to enable this feature.",
+    "disabledAdmin": "Note history is turned off. You can turn it on in Admin Settings > Editor.",
+    "disabledUser": "Note history is turned off. Ask your admin to turn it on.",
     "goToSettings": "Go to Settings",
-    "manualSavesOnly": "History is created on manual saves only, not autosave.",
+    "manualSavesOnly": "Only manual saves create history. Autosave doesn't.",
     "fetchError": "Failed to load history",
     "restoreError": "Failed to restore version",
     "viewContent": "View Content",
@@ -295,7 +295,7 @@
     "sessionExpired": "Your session has expired",
     "setupComplete": "Setup complete",
     "createAccount": "Create your account",
-    "errorOccurred": "An error occurred. Please try again.",
+    "errorOccurred": "Something went wrong. Try again.",
     "enterUsername": "Enter your username",
     "enterPassword": "Enter your password",
     "chooseUsername": "Choose a username",
@@ -308,8 +308,8 @@
     "version": "Version {version}",
     "createUser": "Create User",
     "attemptsRemaining": "Warning: {count, plural, one {# attempt} other {# attempts}} remaining before account lockout",
-    "accountLocked": "Too many failed attempts. Please try again in {seconds} {seconds, plural, one {second} other {seconds}}",
-    "notAuthorized": "You are not authorized to access this application. Please contact your administrator.",
+    "accountLocked": "Too many failed attempts. Try again in {seconds} {seconds, plural, one {second} other {seconds}}",
+    "notAuthorized": "You don't have access to this app. Ask your admin.",
     "rememberMe": "Remember me"
   },
   "mfa": {
@@ -334,9 +334,9 @@
     "invalidCode": "Invalid authentication code",
     "invalidRecoveryCode": "Invalid recovery code",
     "mfaRequired": "Two-factor authentication is required",
-    "mfaEnabledSuccess": "Two-factor authentication enabled successfully",
+    "mfaEnabledSuccess": "Two-factor authentication enabled",
     "mfaDisabledSuccess": "Two-factor authentication disabled",
-    "tooManyAttempts": "Too many failed attempts. Please try again later.",
+    "tooManyAttempts": "Too many failed attempts. Try again later.",
     "disableTitle": "Disable Two-Factor Authentication",
     "disableDescription": "Enter your 2FA code to confirm disabling two-factor authentication",
     "disableWarning": "This will make your account less secure. Are you sure?",
@@ -356,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "This will invalidate your current recovery code",
     "regenerateRecoveryCodeDescription": "Enter your 2FA code to generate a new recovery code. Your old code will no longer work.",
     "recoveryCodeRegenerated": "New Recovery Code Generated",
-    "recoveryCodeRegeneratedInfo": "Your new recovery code has been generated. Save it in a safe place - this is the only time you'll see it.",
-    "recoveryCodeRegeneratedSuccess": "Recovery code regenerated successfully",
+    "recoveryCodeRegeneratedInfo": "Your new recovery code is ready. Save it somewhere safe, this is the only time you'll see it.",
+    "recoveryCodeRegeneratedSuccess": "Recovery code regenerated",
     "recoveryCodeProfileDescription": "Use this code for account recovery if you lose access to your authenticator app",
     "disableMfaForUser": "Disable 2FA for this user",
     "recoveryCodeRequired": "Recovery code is required",
@@ -371,7 +371,7 @@
     "recent": "Recent",
     "browseAndManage": "Browse and manage all your notes",
     "noNotesYet": "No notes yet",
-    "createFirstNote": "Create your first note to get started with your knowledge base.",
+    "createFirstNote": "Nothing here yet. Create your first note.",
     "createNewNote": "Create New Note",
     "noNotesFound": "No notes found",
     "tryAdjustingFilters": "Try adjusting your filters or create a new note.",
@@ -435,7 +435,7 @@
     "progress": "Progress",
     "totalItems": "Total Items",
     "noChecklistsYet": "No Checklists yet",
-    "createFirstChecklist": "Create your first checklist to start organizing your tasks.",
+    "createFirstChecklist": "Nothing here yet. Create your first checklist.",
     "newChecklist": "New Checklist",
     "noChecklistsFound": "No checklists found",
     "tryAdjustingFiltersChecklist": "Try adjusting your filters or create a new checklist.",
@@ -504,19 +504,19 @@
     "clearAllCompletedConfirmMessage": "Are you sure you want to delete all {count} completed items and their children? This action cannot be undone.",
     "clearAllIncompleteConfirmMessage": "Are you sure you want to delete all {count} incomplete items and their children? This action cannot be undone.",
     "convertChecklistType": "Convert Checklist Type",
-    "convertTypeConfirmation": "You are about to convert from {currentType} to {newType}. Are you sure you want to proceed?",
-    "dataLossWarning": "⚠️ Data Loss Warning",
+    "convertTypeConfirmation": "Convert from {currentType} to {newType}?",
+    "dataLossWarning": "Data loss warning",
     "dataLossWarningItems": "The following data will be lost:",
     "allTaskStatusesReset": "All task statuses will be reset",
     "timeTrackingDataLost": "Time tracking data will be lost",
     "estimatedTimesRemoved": "Estimated times will be removed",
     "targetDatesCleared": "Target dates will be cleared",
-    "enhancedFeatures": "✨ Enhanced Features",
+    "enhancedFeatures": "What you get",
     "enhancedFeaturesYouWillGain": "You will gain:",
     "kanbanBoardWithDragDrop": "Kanban board with drag & drop",
     "taskStatusTracking": "Task status tracking (Todo, In Progress, etc.)",
     "timeTrackingWithTimer": "Time tracking with a built-in timer",
-    "actionCannotBeUndone": "This action cannot be undone. Are you sure you want to convert?",
+    "actionCannotBeUndone": "This can't be undone. Convert anyway?",
     "convertAndLoseData": "Convert & Lose Data",
     "convert": "Convert",
     "convertToSimpleChecklist": "Convert to simple checklist",
@@ -530,7 +530,7 @@
     "noItemsYet": "No items yet",
     "addFirstItem": "Add your first item to get started!",
     "noTasks": "No tasks",
-    "noSubtasksYet": "No subtasks yet. Add one below to get started.",
+    "noSubtasksYet": "No subtasks yet. Add one below.",
     "addTime": "Add Time",
     "enterTimeInMinutes": "Enter your time in minutes"
   },
@@ -587,7 +587,7 @@
     "overdue": "Overdue",
     "browseAndManageTaskLists": "Browse and manage all your task lists",
     "noTaskListsYet": "No task lists yet",
-    "createFirstTaskList": "Create your first task list to start managing your projects.",
+    "createFirstTaskList": "Nothing here yet. Create your first task list.",
     "newTaskList": "New Task List",
     "taskLists": "Task Lists",
     "noTaskListsFound": "No task lists found",
@@ -635,7 +635,7 @@
     "changeStatus": "Change status",
     "noBoards": "No boards found",
     "noBoardsYet": "No kanban boards yet",
-    "createFirstBoard": "Create your first kanban board to start managing your projects.",
+    "createFirstBoard": "Nothing here yet. Create your first kanban board.",
     "newBoard": "New Board",
     "tryAdjustingFilters": "Try adjusting your filters or create a new board.",
     "completed": "Completed",
@@ -688,7 +688,7 @@
     "quickSettingsHeader": "Quick settings (device only)",
     "adminSettings": "Admin Dashboard",
     "apiKey": "API Key",
-    "apiKeyDescription": "Generate an API key for programmatic access to your checklists and notes",
+    "apiKeyDescription": "Generate an API key so scripts and apps can reach your checklists and notes",
     "hideApiKey": "Hide API Key",
     "showApiKey": "Show API Key",
     "copyApiKey": "Copy API Key",
@@ -706,15 +706,15 @@
     "removeAvatar": "Remove Avatar",
     "usernameRequired": "Username is required",
     "passwordsDoNotMatch": "New passwords do not match",
-    "profileUpdated": "Profile updated successfully!",
+    "profileUpdated": "Profile updated",
     "failedToUpdateProfile": "Failed to update profile",
-    "failedToUpdateProfileRetry": "Failed to update profile. Please try again.",
-    "avatarUpdated": "Avatar updated successfully!",
+    "failedToUpdateProfileRetry": "Could not update your profile. Try again.",
+    "avatarUpdated": "Avatar updated",
     "failedToUpdateAvatar": "Failed to update avatar",
-    "failedToUpdateAvatarRetry": "Failed to update avatar. Please try again.",
-    "avatarRemoved": "Avatar removed successfully!",
+    "failedToUpdateAvatarRetry": "Could not update your avatar. Try again.",
+    "avatarRemoved": "Avatar removed",
     "failedToRemoveAvatar": "Failed to remove avatar",
-    "failedToRemoveAvatarRetry": "Failed to remove avatar. Please try again.",
+    "failedToRemoveAvatarRetry": "Could not remove your avatar. Try again.",
     "activeSessions": "Active Sessions",
     "activeSession": "{count} active session",
     "activeSession_plural": "{count} active sessions",
@@ -732,11 +732,11 @@
     "auditLogsTab": "User logs",
     "rebuildLinkIndexes": "Rebuild link indexes to update connection data",
     "rebuildingLinkIndex": "Rebuilding link index...",
-    "successfullyRebuiltIndex": "Successfully rebuilt link index",
-    "successfullyRebuiltIndexReload": "Successfully rebuilt link index! The page will reload to show updated connections.",
-    "failedToRebuildIndex": "Failed to rebuild link index. Please try again.",
+    "successfullyRebuiltIndex": "Link index rebuilt",
+    "successfullyRebuiltIndexReload": "Link index rebuilt. The page will reload to show the new connections.",
+    "failedToRebuildIndex": "Could not rebuild the link index. Try again.",
     "contentLinks": "Content Links",
-    "visualizeRelationships": "Visualize relationships between your notes and checklists",
+    "visualizeRelationships": "See how your notes and checklists link to each other",
     "connectedItems": "Connected Items",
     "noLinksFound": "No Links Found",
     "startCreatingInternalLinks": "Start creating internal links by typing `@` in your notes to see the relationship network here.",
@@ -747,8 +747,8 @@
     "isolated": "isolated",
     "connection": "connection",
     "connection_plural": "connections",
-    "terminateSessionConfirm": "Are you sure you want to terminate this session?",
-    "terminateAllSessionsConfirm": "Are you sure you want to terminate all other sessions?",
+    "terminateSessionConfirm": "Terminate this session?",
+    "terminateAllSessionsConfirm": "Terminate all other sessions?",
     "validationErrorTitle": "Validation Error",
     "visibleGraphSummary": "{items} visible items, {links} visible links",
     "graphTruncated": "Showing the top {visible} items by connection count. {omitted} lower-connected items were omitted.",
@@ -819,10 +819,10 @@
     "chooseAutoSaveInterval": "Choose the interval for automatic saving of your notes.",
     "defaultMode": "Default Mode",
     "selectNotesDefaultMode": "Select notes default mode",
-    "chooseNotesDefaultMode": "Choose if the note is automatically in edit mode or not {mode} button in the note editor).",
+    "chooseNotesDefaultMode": "Choose whether notes open in edit mode. You can always switch with the {mode} button in the note editor.",
     "defaultEditor": "Default Editor",
     "selectNotesDefaultEditor": "Select notes default editor",
-    "chooseDefaultEditor": "Choose the default editor for your notes - (you can always switch by clicking on the {editor} button in the note editor).",
+    "chooseDefaultEditor": "Choose the default editor for your notes. You can always switch with the {editor} button in the note editor.",
     "tableSyntaxInNotes": "Table Syntax in Notes",
     "selectTableSyntax": "Select table syntax",
     "chooseTableSyntax": "Choose how tables are rendered in your notes.",
@@ -831,7 +831,7 @@
     "chooseSyntaxTheme": "Choose the syntax highlighting theme for the markdown editor.",
     "minimalMode": "Minimal Mode (Disable Rich Text Editor)",
     "selectMinimalMode": "Select minimal mode",
-    "minimalModeDescription": "When enabled, uses a simple markdown renderer instead of the rich text editor. Advanced features like bilateral linking will not work in this mode.",
+    "minimalModeDescription": "Uses a simple markdown renderer instead of the rich text editor. Bilateral links and other advanced features don't work in this mode.",
     "defaultNoteFilter": "Default Note Filter",
     "selectDefaultNoteFilter": "Select default note filter",
     "chooseDefaultNoteFilter": "Choose the default filter to apply when opening the Notes page.",
@@ -858,8 +858,8 @@
     "currentPassword": "Current Password",
     "newPassword": "New Password",
     "confirmPassword": "Confirm Password",
-    "passwordChanged": "Password changed successfully",
-    "settingsSaved": "Settings saved successfully",
+    "passwordChanged": "Password changed",
+    "settingsSaved": "Settings saved",
     "dashCase": "Dash case (e.g., my-file-name.md)",
     "minimal": "Minimal (remove invalid characters only)",
     "noRename": "No rename (keep original filename)",
@@ -893,7 +893,7 @@
     "chooseQuickCreateNotes": "Choose the quick create notes mode.",
     "quickCreateNotesShowModal": "Show modal when creating notes",
     "quickCreateNotesSkipModal": "Skip modal and create instantly",
-    "quickCreateNotesDescription": "When enabled, creating a new note skips the create note modal and gets you straight to the note editor.",
+    "quickCreateNotesDescription": "Skips the create note dialog and takes you straight to the editor.",
     "defaultCategory": "Default category for quick create notes",
     "selectDefaultCategory": "Select default category...",
     "defaultCategoryDescription": "New notes will be created in this category when using quick create.",
@@ -931,7 +931,7 @@
     "hideStatusOnCardsLabel": "Status on Kanban Cards",
     "showStatusOnCards": "Show status",
     "hideStatusOnCards": "Hide status",
-    "hideStatusOnCardsDescription": "Hides the status label from Kanban card items. The status is already indicated by the column the card is placed in.",
+    "hideStatusOnCardsDescription": "Hides the status label on Kanban cards. The column already shows the status.",
     "hideMobileStatusDropdownLabel": "Mobile status dropdown on cards",
     "showMobileStatusDropdown": "Show mobile dropdown",
     "hideMobileStatusDropdown": "Hide mobile dropdown",
@@ -949,7 +949,7 @@
     "codeBlockChoiceDescription": "Choose between the codepen-like default code block style or a themed codeblock style.",
     "checklistItemClickAction": "Checklist item click action",
     "selectChecklistItemClickAction": "Select checklist item click action",
-    "checklistItemClickActionDescription": "Choose what happens when you click a task's text. \"Mark as complete\" toggles the checkbox  (default); \"Edit task name\" opens the task for inline editing — you'll still need to click the checkbox itself to complete it.",
+    "checklistItemClickActionDescription": "Choose what happens when you click a task's text. \"Mark as complete\" (default) toggles the checkbox. \"Edit task name\" opens the task for inline editing, and you click the checkbox itself to complete it.",
     "checklistItemClickActionToggle": "Mark as complete/incomplete",
     "checklistItemClickActionEdit": "Edit list item",
     "newItemInsertion": "New item insertion",
@@ -999,11 +999,11 @@
     "icon512": "512x512 Icon",
     "icon512Description": "High-resolution icon for PWA splash screens.",
     "notifyNewUpdates": "Notify me of new updates",
-    "thisUsesGithubAPI": "This uses the GitHub API to fetch updates, disabling fully disables the API and doesn't allow any traffic in and out from github.",
+    "thisUsesGithubAPI": "This uses the GitHub API to check for updates. Turning it off stops all traffic to and from GitHub.",
     "parseContent": "Always show parsed content",
-    "parseContentEnabledDescription": "When enabled this setting will show the parsed titles in the sidebar, search results, and overall across the app.",
-    "parseContentDisabledDescription": "When disabled, the original file names will be sanitised, made human readable and shown instead.",
-    "parseContentPerformanceWarning": "Setting this to \"no\" will improve performance on large datasets but may impact readability - especially on filenames with non latin characters.",
+    "parseContentEnabledDescription": "Shows parsed titles in the sidebar, in search results and everywhere else in the app.",
+    "parseContentDisabledDescription": "Shows the original file names instead, cleaned up to be human readable.",
+    "parseContentPerformanceWarning": "Setting this to \"no\" speeds up large instances but makes titles harder to read, especially filenames with non-latin characters.",
     "hideLanguageSelector": "Hide Language Selector in Header",
     "hideLanguageSelectorDescription": "Show/hide language dropdown in header",
     "defaultDateFormat": "Default Date Format",
@@ -1016,7 +1016,7 @@
     "loadError": "Load Error",
     "couldNotFetchSettings": "Could not fetch settings.",
     "failedToLoadSettings": "Failed to load settings",
-    "settingsSavedSuccessfully": "Settings saved successfully.",
+    "settingsSavedSuccessfully": "Settings saved.",
     "failedToSaveSettings": "Failed to save settings",
     "saveError": "Save Error",
     "unknownErrorOccurred": "An unknown error occurred.",
@@ -1029,7 +1029,7 @@
     "colorVariables": "Color Variables",
     "livePreview": "Live Preview",
     "unsavedCssChanges": "You have unsaved CSS changes.",
-    "noCustomThemesYet": "No custom themes created yet. Click \"Create Theme\" to get started.",
+    "noCustomThemesYet": "No custom themes yet. Click \"Create Theme\" to make one.",
     "myCustomTheme": "My Custom Theme",
     "iconNameDescription": "icon name (e.g., PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "App Version",
@@ -1068,22 +1068,22 @@
     "configureExternalServices": "Configure external service URLs for editor integrations.",
     "drawioUrl": "Draw.io URL",
     "optional": "(Optional)",
-    "drawioUrlDescription": "Specify a custom Draw.io instance URL. Leave empty to use the default public instance (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Use your own Draw.io instance. Leave empty for the public one (https://embed.diagrams.net).",
     "drawioUrlExample": "Example for self-hosted: https://your-domain.com/drawio",
     "drawioProxyEnabled": "Proxy Draw.io via Jotty",
-    "drawioProxyEnabledDescription": "Enable this to route Draw.io traffic through Jotty's server. Required for internal Docker network URLs (e.g., http://drawio:8080) that aren't accessible from users' browsers.",
+    "drawioProxyEnabledDescription": "Routes Draw.io traffic through Jotty's server. Needed for internal Docker network URLs (e.g., http://drawio:8080) that users' browsers can't reach.",
     "excalidrawUrl": "Excalidraw URL",
-    "excalidrawUrlDescription": "Specify a custom Excalidraw instance URL. Leave empty to use the default public instance (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Use your own Excalidraw instance. Leave empty for the public one (https://excalidraw.com).",
     "excalidrawUrlExample": "Example for self-hosted: https://your-domain.com/excalidraw",
     "excalidrawProxyEnabled": "Proxy Excalidraw via Jotty",
-    "excalidrawProxyEnabledDescription": "Enable this to route Excalidraw traffic through Jotty's server. Required for internal Docker network URLs (e.g., http://excalidraw:3000) that aren't accessible from users' browsers.",
+    "excalidrawProxyEnabledDescription": "Routes Excalidraw traffic through Jotty's server. Needed for internal Docker network URLs (e.g., http://excalidraw:3000) that users' browsers can't reach.",
     "saving": "Saving...",
-    "editorSettingsSaved": "Editor settings saved successfully.",
+    "editorSettingsSaved": "Editor settings saved.",
     "customEmojis": "Emoji Personalizzate",
-    "noEmojisYet": "No custom emojis created yet. Click &quot;Add Emoji&quot; to get started.",
-    "enterAnyEmoji": "Enter any emoji or use emoji picker (Win: Win+.; Mac: Ctrl+Cmd+Space",
+    "noEmojisYet": "No custom emojis yet. Click &quot;Add Emoji&quot; to add one.",
+    "enterAnyEmoji": "Enter any emoji or use the emoji picker (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Sharing Activity Overview",
-    "detailedSharingBreakdown": "Detailed breakdown of sharing patterns and user engagement",
+    "detailedSharingBreakdown": "What gets shared, and who shares it",
     "checkForUpdates": "Check for Updates",
     "checkingForUpdates": "Checking for updates...",
     "updateAvailable": "Update Available!",
@@ -1098,12 +1098,12 @@
     "userContent": "{checklistsLength} checklists • {notesLength} notes",
     "rebuildIndexes": "Rebuild Indexes",
     "rebuilding": "Rebuilding...",
-    "successfullyRebuiltIndex": "Successfully rebuilt link index for {username}",
+    "successfullyRebuiltIndex": "Rebuilt the link index for {username}",
     "failedToRebuildIndex": "Failed to rebuild link index for {username}",
     "totalItems": "{items} total items across {userCount}",
     "privileges": "Admin privileges",
     "adminContentAccess": "Admin Content Access",
-    "adminContentAccessDescription": "Controls whether administrators can access all users' notes and checklists. When disabled, admins can only manage users and settings but cannot view other users' content.",
+    "adminContentAccessDescription": "Lets admins open every user's notes and checklists. When off, admins can manage users and settings but can't see anyone else's content.",
     "adminContentAccessYes": "Admins can access all content",
     "adminContentAccessNo": "Admins can only access their own content",
     "superAdminOnly": "Only editable by system owner",
@@ -1113,21 +1113,21 @@
     "confirmNewPassword": "Confirm new password",
     "dataExport": "Data export",
     "dataExportOptions": "Data Export Options",
-    "selectExportType": "Select an export type and download data from your application.",
+    "selectExportType": "Pick an export type and download the data.",
     "allChecklistsAndNotes": "All checklists and notes",
-    "allChecklistsAndNotesDescription": "Exports all checklists and notes created by all users. This will generate a zip file containing JSON data organized by user and category.",
+    "allChecklistsAndNotesDescription": "Exports every user's checklists and notes as a zip of JSON files, grouped by user and category.",
     "userChecklistsNotes": "Specific User's Checklists and Notes",
-    "userChecklistsNotesDescription": "Select a user from the dropdown to export all checklists and notes belonging to that specific user.",
+    "userChecklistsNotesDescription": "Pick a user from the dropdown to export all of their checklists and notes.",
     "allUsersData": "All User Account Data",
     "allUsersDataDescription": "Exports a JSON file with all user account info (usernames, admin status, etc.). This does NOT include their checklist or note content.",
     "wholeDataFolder": "Entire Data Folder (Backup)",
-    "wholeDataFolderDescription": "Exports the entire 'data' folder, including all user content, metadata, and settings. Use with caution as this can be a large file.",
+    "wholeDataFolderDescription": "Exports the entire 'data' folder, with all user content, metadata and settings. This file can get large.",
     "noSharingPermissionsLabel": "Specific shared items are hidden based on your content access permissions.",
     "contentHidden": "Content details hidden",
     "viewOnlySettingsNotice": "Only the system owner can modify these settings.",
     "auditLogContentRedacted": "[Content Hidden]",
     "maxLogAgeDays": "Maximum Log Age (days)",
-    "maxLogAgeDaysDescription": "Set how long audit logs are retained. When viewing the audit logs page, you'll be prompted to clean up logs older than this threshold. Set to 0 for unlimited retention (no automatic cleanup prompts).",
+    "maxLogAgeDaysDescription": "How long to keep audit logs. The audit logs page offers to clean up anything older than this. Set to 0 to keep logs forever and never get the prompt.",
     "appPreferences": "App preferences",
     "editEmoji": "Edit Emoji",
     "addEmoji": "Add Emoji",
@@ -1171,44 +1171,44 @@
     "networkError": "Network error",
     "timeout": "Request timeout",
     "permissionDenied": "Permission denied",
-    "requiredPermissions": "You don't have the required permissions to perform this action.",
+    "requiredPermissions": "You don't have permission to do that.",
     "loadError": "Load Error",
     "failedToLoadCustomEmojis": "Failed to load custom emojis",
-    "emojiDeletedSuccessfully": "Emoji deleted successfully",
+    "emojiDeletedSuccessfully": "Emoji deleted",
     "deleteError": "Delete Error",
     "failedToDeleteEmoji": "Failed to delete emoji",
     "validationError": "Validation Error",
     "keywordAndEmojiRequired": "Keyword and emoji are required",
     "duplicateKeyword": "Duplicate Keyword",
     "keywordAlreadyExists": "Keyword already exists",
-    "emojiUpdatedSuccessfully": "Emoji updated successfully",
-    "emojiCreatedSuccessfully": "Emoji created successfully",
+    "emojiUpdatedSuccessfully": "Emoji updated",
+    "emojiCreatedSuccessfully": "Emoji created",
     "saveError": "Save Error",
     "failedToSaveEmoji": "Failed to save emoji",
     "failedToLoadCustomCSS": "Failed to load custom CSS",
     "couldNotLoadCustomCSS": "Could not load custom CSS.",
     "couldNotLoadThemes": "Could not load themes.",
-    "customCSSSavedSuccessfully": "Custom CSS saved successfully.",
+    "customCSSSavedSuccessfully": "Custom CSS saved.",
     "themeNotFound": "Theme not found.",
-    "themeDeletedSuccessfully": "Theme deleted successfully.",
+    "themeDeletedSuccessfully": "Theme deleted.",
     "themeNameRequired": "Theme name is required.",
-    "themeSavedSuccessfully": "Theme {action} successfully.",
+    "themeSavedSuccessfully": "Theme {action}.",
     "anUnknownErrorOccurred": "An unknown error occurred.",
     "usernameRequired": "Username is required",
     "passwordRequired": "Password is required",
     "passwordMinLength": "Password must be at least 6 characters long",
     "passwordsDoNotMatch": "Passwords do not match",
-    "userSavedSuccessfully": "User {mode} successfully!",
+    "userSavedSuccessfully": "User {mode}.",
     "failedToSaveUser": "Failed to {mode} user",
     "anErrorOccurred": "An error occurred.",
     "deleteUserConfirmation": "Delete user \"{username}\"? This cannot be undone.",
-    "userDeletedSuccessfully": "User deleted successfully!",
+    "userDeletedSuccessfully": "User deleted.",
     "failedToDeleteUser": "Failed to delete user",
     "readOnlyFolder": "This folder is read-only on the server, so the change could not be saved."
   },
   "pwa": {
     "installPromptTitle": "Install App",
-    "installPromptMessage": "Install this app on your device for a better experience",
+    "installPromptMessage": "Install Jotty on your device so it opens like an app",
     "installButton": "Install",
     "updateAvailable": "Update Available",
     "updateMessage": "A new version is available",
@@ -1440,16 +1440,16 @@
     "viewNote": "View Note",
     "editNote": "Edit Note",
     "privateKeyWarning": "WARNING: Your private key allows decryption of all encrypted notes. Only export if you understand the security implications. Continue?",
-    "publicKeyExported": "Public key exported successfully",
-    "privateKeyExported": "Private key exported successfully",
+    "publicKeyExported": "Public key exported",
+    "privateKeyExported": "Private key exported",
     "failedToExportKey": "Failed to export key",
     "unexpectedError": "An unexpected error occurred",
-    "keysDeleted": "Keys deleted successfully",
+    "keysDeleted": "Keys deleted",
     "failedToDeleteKeys": "Failed to delete keys",
     "autoDecryptUpdated": "Auto-decrypt setting updated",
     "failedToUpdateSetting": "Failed to update setting",
-    "enterValidPath": "Please enter a valid path",
-    "customPathSet": "Custom key path set successfully",
+    "enterValidPath": "Enter a valid path",
+    "customPathSet": "Custom key path set",
     "failedToSetCustomPath": "Failed to set custom path",
     "thisNoteIsEncrypted": "This note is encrypted",
     "noteProtectedWith": "This note is protected with {type} encryption.",
@@ -1460,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Select encryption method",
     "encryptionMethodsTitle": "Encryption Methods",
-    "xchachaDescription": "XChaCha20-Poly1305: Modern, fast, passphrase-based encryption",
-    "pgpDescription": "PGP: Traditional public-key cryptography with key pair management",
+    "xchachaDescription": "XChaCha20-Poly1305: encryption with a passphrase",
+    "pgpDescription": "PGP: public-key encryption with a key pair you manage",
     "encryptionKeys": "Encryption Keys",
     "keysConfigured": "Keys configured",
     "algorithm": "Algorithm: ",
@@ -1475,9 +1475,9 @@
     "keysDisabledInDemo": "Stored encryption keys are disabled in demo mode.",
     "encryptionSettings": "Encryption Settings",
     "promptForPassphrase": "Prompt for passphrase when opening encrypted notes",
-    "promptForPassphraseDescription": "If enabled, you will be prompted for your passphrase when opening an encrypted note. The note will stay encrypted on the server, but you will be able to see the decrypted content in the current tab session.",
+    "promptForPassphraseDescription": "Asks for your passphrase when you open an encrypted note. The note stays encrypted on the server and you see the decrypted content in this tab only.",
     "customKeyPath": "Custom Key Path (Local Installations)",
-    "customKeyPathDescription": "Specify a custom (absolute) filesystem path for storing encryption keys. This is only needed for local installations. Docker users should map the default path in docker-compose.yml instead.",
+    "customKeyPathDescription": "An absolute filesystem path for your encryption keys. Only local installs need this. Docker users should map the default path in docker-compose.yml instead.",
     "customPath": "Custom Path",
     "customPathPlaceholder": "/home/user/my-keys",
     "customPathHelp": "Must be an absolute path (e.g., /home/user/my-keys or C:\\Users\\user\\my-keys)",
@@ -1496,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "Note content will be encrypted before saving",
     "passphraseRequired": "Passphrase is required",
     "incorrectPassphrase": "Incorrect passphrase",
-    "noteEncryptedSuccessfully": "Note encrypted successfully",
+    "noteEncryptedSuccessfully": "Note encrypted",
     "failedToEncryptNote": "Failed to encrypt note",
-    "noteDecryptedSuccessfully": "Note decrypted successfully",
+    "noteDecryptedSuccessfully": "Note decrypted",
     "failedToDecryptNote": "Failed to decrypt note",
     "passphrase": "Passphrase",
     "enterYourPassphrase": "Enter your passphrase",
@@ -1526,8 +1526,8 @@
     "privateKey": "Private Key",
     "noStoredKeysFound": "No stored keys found",
     "noEncryptionKeysConfigured": "You don't have any encryption keys configured",
-    "pastePublicKeyBelow": "Please paste a public key below to encrypt the note content",
-    "generateOrImportKeysInProfile": "You can generate or import specific keys for Jotty in Profile → Encryption",
+    "pastePublicKeyBelow": "Paste a public key below to encrypt the note content",
+    "generateOrImportKeysInProfile": "You can generate or import keys for Jotty in Profile > Encryption",
     "useCustomKey": "Use custom {keyType} key",
     "signWithPrivateKey": "Sign with private key",
     "proveAuthenticityOfNote": "prove authenticity of this note",
@@ -1547,7 +1547,7 @@
     "yourEmail": "your@email.com",
     "generating": "Generating...",
     "generateKeys": "Generate Keys",
-    "keysGeneratedSuccessfully": "Keys Generated Successfully",
+    "keysGeneratedSuccessfully": "Keys generated",
     "importPGPKeys": "Import PGP Keys",
     "publicKeyLabel": "Public Key",
     "privateKeyLabel": "Private Key",
@@ -1556,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Remember your passphrase! It cannot be recovered.",
     "withoutPassphraseCannotDecrypt": "Without the passphrase, you cannot decrypt your notes.",
     "backupPrivateKeySafely": "Backup your private key safely.",
-    "pgpKeyPairGeneratedSuccessfully": "PGP key pair generated successfully",
+    "pgpKeyPairGeneratedSuccessfully": "PGP key pair generated",
     "failedToGenerateKeys": "Failed to generate keys",
     "fingerprint": "Fingerprint",
     "keysSavedSecurely": "Your keys have been saved securely.",
@@ -1570,13 +1570,13 @@
     "bothKeysRequired": "Both public and private keys are required",
     "invalidPublicKeyFormat": "Invalid public key format. Must be ASCII-armored PGP key.",
     "invalidPrivateKeyFormat": "Invalid private key format. Must be ASCII-armored PGP key.",
-    "keysImportedSuccessfully": "Keys imported successfully",
+    "keysImportedSuccessfully": "Keys imported",
     "failedToImportKeys": "Failed to import keys",
     "created": "Encryption created",
     "notePlaceholder": "I am a placeholder because you can't encrypt an empty note."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "These options only apply to the current browser session. For permanent settings please check your",
+    "sessionOnlyPrefix": "These options only apply to this browser session. For permanent settings, check your",
     "accountSettings": "user preferences",
     "autosaveNotes": "Autosave Notes",
     "showNotePreview": "Show Note Preview on Cards",
@@ -1605,13 +1605,13 @@
     "migrationSuccessful": "Migration Successful",
     "returnToApp": "Return to App",
     "adminAccessRequired": "Admin Access Required",
-    "adminAccessDescription": "This migration requires administrator privileges. Please contact an administrator to perform the system migration.",
+    "adminAccessDescription": "This migration needs an admin. Ask one to run it.",
     "whatsHappening": "What's happening?",
-    "sharingDataMigrationDescription": "The system needs to migrate your sharing data. This is a one-time process that requires administrator access.",
+    "sharingDataMigrationDescription": "Jotty needs to migrate your sharing data. It only runs once and needs an admin.",
     "whatsChanging": "What's changing?",
     "automaticBackupIncluded": "Automatic Backup Included",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter is Industry Standard",
-    "noMigrationNeeded": "No migration was needed - your system is already up to date.",
+    "noMigrationNeeded": "Nothing to migrate, your data is already up to date.",
     "importantBackupData": "Important: Backup Your Data",
     "sharingNowWithData": "Your sharing data now lives with your notes and folders.",
     "sharingMovesDescription": "Sharing moves out of a central file and into your data. Folders can now be shared, and shared folders show up in your own sidebar instead of a separate section.",
@@ -1627,7 +1627,7 @@
     "permissionsUnchangedBody": "Read, edit and delete carry over exactly as they are today, per user and per item.",
     "backupWarningBody": "This migration rewrites frontmatter across your notes and checklists and deletes the legacy <code>.sharing.json</code> and <code>.order.json</code> files. Back up your <code>data</code> folder before proceeding.",
     "backupConfirmLabel": "I have backed up my data folder and understand the migration process.",
-    "backupConfirmHint": "Please confirm you've created a backup before proceeding.",
+    "backupConfirmHint": "Confirm you have a backup before you continue.",
     "sharingDataMigrated": "Your sharing and ordering data has been migrated.",
     "whatWasChanged": "What was changed:",
     "migrationPartial": "Migration Finished With Leftovers",
@@ -1640,10 +1640,10 @@
     "overrideFailed": "Could not skip the migration"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Category successfully renamed",
+    "categoryRenamedSuccessfully": "Category renamed",
     "failedToRenameCategory": "Failed to rename category",
     "categoryRenamedSuccessfullyMessage": "Category {categoryName} renamed to {newName}",
-    "failedToRenameCategoryMessage": "An error occurred while renaming the category."
+    "failedToRenameCategoryMessage": "Something went wrong while renaming the category."
   },
   "auditLogs": {
     "title": "Audit Logs",
@@ -1660,17 +1660,17 @@
     "exportJSON": "Export JSON",
     "exportCSV": "Export CSV",
     "cleanupOldLogs": "Cleanup Old Logs",
-    "confirmCleanup": "Are you sure you want to delete logs older than {days} days? This will affect ALL users and cannot be undone.",
+    "confirmCleanup": "Delete logs older than {days} days? This affects ALL users and cannot be undone.",
     "confirmCleanupUnlimited": "No automatic cleanup is configured (unlimited retention). You can still manually delete old logs if needed.",
     "deleteAllLogsModalTitle": "Delete All Audit Logs",
     "deleteAllLogsWarning": "This will delete ALL logs, not just old ones",
     "deleteAllLogsWarningDescription": "The entire audit log history will be erased from the system.",
     "deletingAllLogs": "Deleting All Logs...",
     "deleteAllLogsButton": "Delete All Logs",
-    "cleanupSuccess": "Successfully deleted {count} old log files",
+    "cleanupSuccess": "Deleted {count} old log files",
     "cleanupError": "Failed to cleanup old logs",
-    "userDescription": "View all your activity and actions in the system",
-    "adminDescription": "View and manage all user activity across the system",
+    "userDescription": "Everything you have done in Jotty",
+    "adminDescription": "What every user has done on this instance",
     "level": "Level",
     "allLevels": "All Levels",
     "allCategories": "All Categories",
@@ -1734,9 +1734,9 @@
     "topActions": "Top Actions",
     "mostActiveUsers": "Most Active Users",
     "oldLogsFound": "There are {count} log files older than {days} days.",
-    "oldLogsFoundDescription": "Would you like to clean them up? This action cannot be undone.",
+    "oldLogsFoundDescription": "Clean them up? This cannot be undone.",
     "cleanUpNow": "Clean Up Now",
-    "cleanupSuccessMessage": "Successfully deleted {count} old log files.",
+    "cleanupSuccessMessage": "Deleted {count} old log files.",
     "security": "Security",
     "mfasecretgenerated": "MFA Secret Generated",
     "mfaenabled": "MFA Enabled",
@@ -1785,9 +1785,9 @@
     "sharingTitle": "{user} shared a {type} with you",
     "sharingMessage": "Open to view the shared {type}",
     "sharingFolderTitle": "{user} shared a {type} folder with you",
-    "sharingFolderMessage": "Open to view “{folder}”",
+    "sharingFolderMessage": "Open to view \"{folder}\"",
     "mentionTitle": "{user} mentioned you in a comment",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
   },
   "relations": {
     "indexing": "Indexing relationships...",
@@ -1854,5 +1854,27 @@
     "empty": "Your brain is quiet. Link notes and checklists with @ or [[ and they will show up here.",
     "viewingOwner": "Viewing {owner}'s brain",
     "summary": "{items} items, {links} links, {shown} shown"
+  },
+  "apiExplorer": {
+    "title": "API explorer",
+    "intro": "Every endpoint this instance (v{version}) exposes, generated from the code that serves it. Pick one, fill it in and send it.",
+    "realData": "Requests run as the owner of the API key against real data. A DELETE here deletes for real.",
+    "apiKey": "API key",
+    "apiKeyHint": "Kept on this page only and forgotten when you leave.",
+    "useMyKey": "Use my key",
+    "noKeyYet": "You don't have an API key yet. Generate one in your profile settings.",
+    "filter": "Filter",
+    "filterPlaceholder": "Path, name or method",
+    "noMatches": "Nothing matches that filter.",
+    "body": "Request body (JSON)",
+    "showSchema": "Show schema",
+    "hideSchema": "Hide schema",
+    "send": "Send",
+    "sending": "Sending...",
+    "keyRequired": "Add an API key first.",
+    "noKeyNeeded": "no API key needed",
+    "deprecated": "deprecated",
+    "requestFailed": "The request never reached the server. Check your connection.",
+    "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/es.json b/app/_translations/es.json
index 8494153c0..5a2821cb3 100644
--- a/app/_translations/es.json
+++ b/app/_translations/es.json
@@ -101,7 +101,7 @@
     "deleteFile": "Eliminar archivo",
     "fileTooLarge": "El archivo es demasiado grande. El tamaño máximo es {maxSizeMB}MB. Su archivo es de {fileSizeMB}MB.",
     "uploadFailed": "Error al subir",
-    "uploadFailedRetry": "Error al subir. Por favor, inténtelo de nuevo.",
+    "uploadFailedRetry": "Error al subir. Inténtelo de nuevo.",
     "failedToDeleteFile": "No se pudo eliminar el archivo",
     "previousMonth": "Mes anterior",
     "nextMonth": "Mes siguiente",
@@ -127,13 +127,14 @@
     "expandAll": "Expandir todo",
     "saveChanges": "Guardar cambios",
     "all": "Todo",
+    "items": "Elementos",
     "showAll": "Mostrar todo",
     "creating": "Creando...",
     "createCategoryHeader": "Crear una nueva categoría",
     "parentCategory": "Categoría principal (opcional)",
     "noParent": "Sin pariente (nivel de raíz)",
     "categoryNamePlaceholder": "Ingrese el nombre de la categoría...",
-    "notAllowedName": "{name} no está permitido. Por favor, elija otro nombre.",
+    "notAllowedName": "{name} no está permitido. Elija otro nombre.",
     "createCategory": "Crear categoría",
     "selectCategory": "Seleccionar categoría...",
     "categoryWillBeCreatedIn": "La nueva categoría se creará en:",
@@ -170,9 +171,10 @@
     "dismiss": "Descartar",
     "cleaning": "Limpiando...",
     "noResultsFound": "No se encontraron resultados",
+    "noResults": "Sin resultados",
     "by": "por {owner}",
     "unsavedChanges": "Cambios no guardados",
-    "unsavedChangesDetected": "⚠️ Cambios no guardados detectados",
+    "unsavedChangesDetected": "Cambios sin guardar",
     "unsavedChangesMessage": "Tiene cambios no guardados en {noteTitle}. Si sale ahora, perderá los cambios.",
     "whatToDoWithUnsavedChanges": "¿Qué le gustaría hacer con sus cambios no guardados?",
     "discard": "Descartar",
@@ -237,45 +239,42 @@
     "openSearch": "Abrir búsqueda",
     "closeSearch": "Cerrar búsqueda",
     "moreOptions": "Más opciones",
-    "retry": "Rever",
+    "history": "Historial",
+    "disable": "Desactivar",
     "restoring": "Restaurando...",
+    "retry": "Rever",
     "copiedToClipboard": "Copiado al portapapeles",
     "offline": "Desconectado",
     "connected": "Conectado",
     "reconnecting": "Reconectando...",
     "hide": "Ocultar",
-    "disable": "Desactivar",
-    "history": "Historial",
-    "items": "Elementos",
-    "noResults": "Sin resultados",
     "thisEntry": "esta entrada",
     "preview": "Vista previa"
   },
-  "comments": {
-    "title": "Comentarios",
-    "titleWithCount": "{count, plural, one {# Comentario} other {# Comentarios}}",
-    "noComments": "Aún no hay comentarios. ¡Inicia la conversación!",
-    "addComment": "Añadir un comentario...",
-    "replyPlaceholder": "Escribe una respuesta...",
-    "post": "Publicar",
-    "reply": "Responder",
-    "edit": "Editar",
-    "delete": "Eliminar",
-    "save": "Guardar",
-    "cancel": "Cancelar",
-    "edited": "editado",
-    "deleteConfirmTitle": "¿Eliminar comentario?",
-    "deleteConfirmMessage": "Esto eliminará el comentario y cualquier respuesta. Esta acción no se puede deshacer.",
-    "commentDeleted": "Comentario eliminado",
-    "commentAdded": "Comentario añadido",
-    "commentUpdated": "Comentario actualizado",
-    "failedToAdd": "Error al añadir comentario",
-    "failedToEdit": "Error al editar comentario",
-    "failedToDelete": "Error al eliminar comentario",
-    "failedToLoad": "Error al cargar comentarios",
-    "readOnly": "Necesitas acceso de edición para comentar en esta tarjeta.",
-    "replyTo": "Responder a {author}",
-    "noUsersFound": "No se encontraron usuarios"
+  "history": {
+    "noteHistory": "Historial de la nota",
+    "restore": "Restaurar",
+    "restoreVersion": "Restaurar versión",
+    "restoreConfirm": "¿Restaurar esta versión? \nEl contenido actual será reemplazado.",
+    "noHistory": "No hay historial disponible",
+    "noHistoryDescription": "Guarda la nota para crear un punto en el historial.",
+    "loadMore": "Cargar más",
+    "featureDisabled": "Historial desactivado",
+    "disabledAdmin": "El historial de notas está desactivado. Puede activarlo en Configuración de administración > Editor.",
+    "disabledUser": "El historial de notas está desactivado. Pida a su administrador que lo active.",
+    "goToSettings": "Ir a configuración",
+    "manualSavesOnly": "Solo el guardado manual crea historial. El guardado automático no.",
+    "fetchError": "Error al cargar el historial",
+    "restoreError": "No se pudo restaurar la versión",
+    "viewContent": "Ver contenido",
+    "viewDiff": "Ver cambios",
+    "actionCreate": "Creado",
+    "actionUpdate": "Actualizado",
+    "actionRename": "Renombrado",
+    "actionMove": "Movido",
+    "actionDelete": "Eliminado",
+    "actionInit": "Inicializado",
+    "actionUnknown": "Cambiado"
   },
   "auth": {
     "loginTitle": "Iniciar sesión",
@@ -296,7 +295,7 @@
     "sessionExpired": "Su sesión ha expirado",
     "setupComplete": "Configuración completa",
     "createAccount": "Cree su cuenta",
-    "errorOccurred": "Ocurrió un error. Por favor, inténtelo de nuevo.",
+    "errorOccurred": "Algo salió mal. Inténtelo de nuevo.",
     "enterUsername": "Ingrese su nombre de usuario",
     "enterPassword": "Ingrese su contraseña",
     "chooseUsername": "Elija un nombre de usuario",
@@ -309,8 +308,8 @@
     "version": "Versión {version}",
     "createUser": "Crear usuario",
     "attemptsRemaining": "Advertencia: {count, plural, one {# intento} other {# intentos}} restantes antes del bloqueo de cuenta",
-    "accountLocked": "Demasiados intentos fallidos. Por favor, inténtelo de nuevo en {seconds} {seconds, plural, one {segundo} other {segundos}}",
-    "notAuthorized": "No estás autorizado para acceder a esta aplicación. Ponte en contacto con tu administrador.",
+    "accountLocked": "Demasiados intentos fallidos. Inténtelo de nuevo en {seconds} {seconds, plural, one {segundo} other {segundos}}",
+    "notAuthorized": "No tienes acceso a esta aplicación. Pregunta a tu administrador.",
     "rememberMe": "Recuérdame"
   },
   "mfa": {
@@ -335,9 +334,9 @@
     "invalidCode": "Código de autenticación inválido",
     "invalidRecoveryCode": "Código de recuperación inválido",
     "mfaRequired": "Se requiere autenticación de dos factores",
-    "mfaEnabledSuccess": "Autenticación de dos factores habilitada correctamente",
+    "mfaEnabledSuccess": "Autenticación de dos factores habilitada",
     "mfaDisabledSuccess": "Autenticación de dos factores deshabilitada",
-    "tooManyAttempts": "Demasiados intentos fallidos. Por favor, inténtelo más tarde.",
+    "tooManyAttempts": "Demasiados intentos fallidos. Inténtelo más tarde.",
     "disableTitle": "Deshabilitar autenticación de dos factores",
     "disableDescription": "Ingrese su código 2FA para confirmar la desactivación de la autenticación de dos factores",
     "disableWarning": "Esto hará que su cuenta sea menos segura. ¿Está seguro?",
@@ -357,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Esto invalidará su código de recuperación actual",
     "regenerateRecoveryCodeDescription": "Ingrese su código 2FA para generar un nuevo código de recuperación. Su código anterior ya no funcionará.",
     "recoveryCodeRegenerated": "Nuevo código de recuperación generado",
-    "recoveryCodeRegeneratedInfo": "Su nuevo código de recuperación ha sido generado. Guárdelo en un lugar seguro; esta es la única vez que lo verá.",
-    "recoveryCodeRegeneratedSuccess": "Código de recuperación regenerado correctamente",
+    "recoveryCodeRegeneratedInfo": "Su nuevo código de recuperación está listo. Guárdelo en un lugar seguro, esta es la única vez que lo verá.",
+    "recoveryCodeRegeneratedSuccess": "Código de recuperación regenerado",
     "recoveryCodeProfileDescription": "Use este código para recuperar la cuenta si pierde el acceso a su aplicación de autenticación",
     "disableMfaForUser": "Deshabilitar 2FA para este usuario",
     "recoveryCodeRequired": "Se requiere código de recuperación",
@@ -372,7 +371,7 @@
     "recent": "Recientes",
     "browseAndManage": "Explore y gestione todas sus notas",
     "noNotesYet": "Aún no hay notas",
-    "createFirstNote": "Cree su primera nota para comenzar con su base de conocimientos.",
+    "createFirstNote": "Aún no hay nada aquí. Cree su primera nota.",
     "createNewNote": "Crear nueva nota",
     "noNotesFound": "No se encontraron notas",
     "tryAdjustingFilters": "Intente ajustar sus filtros o cree una nueva nota.",
@@ -403,22 +402,26 @@
     "enterNoteTitle": "Ingrese el título de la nota...",
     "byType": "Por tipo",
     "publiclySharedNote": "Nota compartida públicamente",
+    "sharedPubliclyBy": "{owner} comparte esta nota públicamente",
+    "copyRawContent": "Copiar markdown",
     "quickSave": "Guardado rápido",
     "noteNotFound": "Nota no encontrada",
     "unarchiveNote": "Desarchivar nota",
     "enterNoteName": "Ingrese el nombre de la nota...",
     "updateNote": "Actualizar nota",
-    "tags": "Etiquetas",
-    "noTagsFound": "No se encontraron etiquetas",
-    "searchTags": "Buscar etiquetas...",
-    "copyRawContent": "Copiar markdown",
     "printSaveAsPdf": "Imprimir / Guardar como PDF",
     "tableOfContents": "Tabla de contenidos",
     "wordCount": "{count, plural, one {# palabra} other {# palabras}}",
     "charCount": "{count, plural, one {# carácter} other {# caracteres}}",
-    "readingTime": "{count, plural, one {# minuto de lectura} other {# minutos de lectura}}"
+    "readingTime": "{count, plural, one {# minuto de lectura} other {# minutos de lectura}}",
+    "tags": "Etiquetas",
+    "noTagsFound": "No se encontraron etiquetas",
+    "searchTags": "Buscar etiquetas...",
+    "createNoteFailed": "No se pudo crear la nota",
+    "createCategoryFailed": "No se pudo crear la categoría, la nota no se creó"
   },
   "checklists": {
+    "sharedPubliclyBy": "{owner} comparte esta lista públicamente",
     "title": "Listas",
     "allChecklists": "Todas las Listas",
     "completed": "Completadas",
@@ -432,7 +435,7 @@
     "progress": "Progreso",
     "totalItems": "Total de elementos",
     "noChecklistsYet": "Aún no hay Listas",
-    "createFirstChecklist": "Cree su primera Lista para empezar a organizar sus tareas.",
+    "createFirstChecklist": "Aún no hay nada aquí. Cree su primera lista.",
     "newChecklist": "Nueva Lista",
     "noChecklistsFound": "No se encontraron Listas",
     "tryAdjustingFiltersChecklist": "Intente ajustar sus filtros o cree una nueva Lista.",
@@ -474,6 +477,7 @@
     "checklistType": "Tipo de Lista",
     "simpleChecklist": "Lista simple",
     "taskProject": "Proyecto de tareas",
+    "kanbanBoard": "Tablero Kanban",
     "basicTodoItems": "Tareas básicas",
     "withTimeTracking": "Con seguimiento de tiempo",
     "noDescription": "Sin descripción",
@@ -500,23 +504,24 @@
     "clearAllCompletedConfirmMessage": "¿Está seguro de que desea eliminar todos los {count} elementos completados? Esta acción no se puede deshacer.",
     "clearAllIncompleteConfirmMessage": "¿Está seguro de que desea eliminar todos los {count} elementos incompletos y sus elementos secundarios? \nEsta acción no se puede deshacer.",
     "convertChecklistType": "Convertir tipo de Lista",
-    "convertTypeConfirmation": "Está a punto de convertir de {currentType} a {newType}. ¿Está seguro de que desea continuar?",
-    "dataLossWarning": "⚠️ Advertencia de pérdida de datos",
+    "convertTypeConfirmation": "¿Convertir de {currentType} a {newType}?",
+    "dataLossWarning": "Advertencia de pérdida de datos",
     "dataLossWarningItems": "Se perderán los siguientes datos:",
     "allTaskStatusesReset": "Todos los estados de tareas se restablecerán",
     "timeTrackingDataLost": "Se perderán los datos de seguimiento de tiempo",
     "estimatedTimesRemoved": "Se eliminarán los tiempos estimados",
     "targetDatesCleared": "Se borrarán las fechas objetivo",
-    "enhancedFeatures": "✨ Funciones mejoradas",
+    "enhancedFeatures": "Lo que obtiene",
     "enhancedFeaturesYouWillGain": "Obtendrá:",
     "kanbanBoardWithDragDrop": "Tablero Kanban con arrastrar y soltar",
     "taskStatusTracking": "Seguimiento de estado de tareas (Por hacer, En progreso, etc.)",
     "timeTrackingWithTimer": "Seguimiento de tiempo con temporizador integrado",
-    "actionCannotBeUndone": "Esta acción no se puede deshacer. ¿Seguro que quiere convertir?",
+    "actionCannotBeUndone": "Esto no se puede deshacer. ¿Convertir de todos modos?",
     "convertAndLoseData": "Convertir y perder datos",
     "convert": "Convertir",
     "convertToSimpleChecklist": "Convertir a Lista simple",
     "convertToTaskProject": "Convertir a proyecto de tareas",
+    "convertToKanbanBoard": "Convertir en tablero Kanban",
     "pasteYourList": "Pegue su lista (un elemento por línea)",
     "addItems": "Agregar {count} elementos",
     "itemsWillBeAdded": "Se agregarán {count} elementos",
@@ -525,11 +530,35 @@
     "noItemsYet": "Aún no hay elementos",
     "addFirstItem": "¡Agregue su primer elemento para comenzar!",
     "noTasks": "Sin tareas",
-    "noSubtasksYet": "Aún no hay subtareas. Agregue una abajo para comenzar.",
+    "noSubtasksYet": "Aún no hay subtareas. Agregue una abajo.",
     "addTime": "Agregar hora",
-    "enterTimeInMinutes": "Ingresa tu tiempo en minutos",
-    "convertToKanbanBoard": "Convertir en tablero Kanban",
-    "kanbanBoard": "Tablero Kanban"
+    "enterTimeInMinutes": "Ingresa tu tiempo en minutos"
+  },
+  "comments": {
+    "title": "Comentarios",
+    "titleWithCount": "{count, plural, one {# Comentario} other {# Comentarios}}",
+    "noComments": "Aún no hay comentarios. ¡Inicia la conversación!",
+    "addComment": "Añadir un comentario...",
+    "replyPlaceholder": "Escribe una respuesta...",
+    "post": "Publicar",
+    "reply": "Responder",
+    "edit": "Editar",
+    "delete": "Eliminar",
+    "save": "Guardar",
+    "cancel": "Cancelar",
+    "edited": "editado",
+    "deleteConfirmTitle": "¿Eliminar comentario?",
+    "deleteConfirmMessage": "Esto eliminará el comentario y cualquier respuesta. Esta acción no se puede deshacer.",
+    "commentDeleted": "Comentario eliminado",
+    "commentAdded": "Comentario añadido",
+    "commentUpdated": "Comentario actualizado",
+    "failedToAdd": "Error al añadir comentario",
+    "failedToEdit": "Error al editar comentario",
+    "failedToDelete": "Error al eliminar comentario",
+    "failedToLoad": "Error al cargar comentarios",
+    "readOnly": "Necesitas acceso de edición para comentar en esta tarjeta.",
+    "replyTo": "Responder a {author}",
+    "noUsersFound": "No se encontraron usuarios"
   },
   "tasks": {
     "title": "Tareas",
@@ -558,7 +587,7 @@
     "overdue": "Atrasada",
     "browseAndManageTaskLists": "Explore y gestione todas sus listas de tareas",
     "noTaskListsYet": "Aún no hay listas de tareas",
-    "createFirstTaskList": "Cree su primera lista de tareas para comenzar a gestionar sus proyectos.",
+    "createFirstTaskList": "Aún no hay nada aquí. Cree su primera lista de tareas.",
     "newTaskList": "Nueva lista de tareas",
     "taskLists": "Listas de tareas",
     "noTaskListsFound": "No se encontraron listas de tareas",
@@ -606,7 +635,7 @@
     "changeStatus": "Cambiar estado",
     "noBoards": "No se encontraron tableros",
     "noBoardsYet": "Aún no hay tableros Kanban",
-    "createFirstBoard": "Cree su primer tablero Kanban para empezar a gestionar sus proyectos.",
+    "createFirstBoard": "Aún no hay nada aquí. Cree su primer tablero Kanban.",
     "newBoard": "Nuevo tablero",
     "tryAdjustingFilters": "Pruebe a ajustar los filtros o crear un nuevo tablero.",
     "completed": "Completado",
@@ -659,7 +688,7 @@
     "quickSettingsHeader": "Configuración rápida (solo dispositivo)",
     "adminSettings": "Panel de administración",
     "apiKey": "Clave API",
-    "apiKeyDescription": "Genere una clave API para el acceso programático a sus listas y notas",
+    "apiKeyDescription": "Genere una clave API para que scripts y aplicaciones accedan a sus listas y notas",
     "hideApiKey": "Ocultar clave API",
     "showApiKey": "Mostrar clave API",
     "copyApiKey": "Copiar clave API",
@@ -677,15 +706,15 @@
     "removeAvatar": "Eliminar avatar",
     "usernameRequired": "El nombre de usuario es obligatorio",
     "passwordsDoNotMatch": "Las nuevas contraseñas no coinciden",
-    "profileUpdated": "¡Perfil actualizado correctamente!",
+    "profileUpdated": "Perfil actualizado",
     "failedToUpdateProfile": "No se pudo actualizar el perfil",
-    "failedToUpdateProfileRetry": "No se pudo actualizar el perfil. Por favor, inténtelo de nuevo.",
-    "avatarUpdated": "¡Avatar actualizado correctamente!",
+    "failedToUpdateProfileRetry": "No se pudo actualizar el perfil. Inténtelo de nuevo.",
+    "avatarUpdated": "Avatar actualizado",
     "failedToUpdateAvatar": "No se pudo actualizar el avatar",
-    "failedToUpdateAvatarRetry": "No se pudo actualizar el avatar. Por favor, inténtelo de nuevo.",
-    "avatarRemoved": "¡Avatar eliminado correctamente!",
+    "failedToUpdateAvatarRetry": "No se pudo actualizar el avatar. Inténtelo de nuevo.",
+    "avatarRemoved": "Avatar eliminado",
     "failedToRemoveAvatar": "No se pudo eliminar el avatar",
-    "failedToRemoveAvatarRetry": "No se pudo eliminar el avatar. Por favor, inténtelo de nuevo.",
+    "failedToRemoveAvatarRetry": "No se pudo eliminar el avatar. Inténtelo de nuevo.",
     "activeSessions": "Sesiones activas",
     "activeSession": "{count} sesión activa",
     "activeSession_plural": "{count} sesiones activas",
@@ -703,11 +732,11 @@
     "auditLogsTab": "Registros de usuario",
     "rebuildLinkIndexes": "Reconstruir índices de enlaces para actualizar los datos de conexión",
     "rebuildingLinkIndex": "Reconstruyendo índice de enlaces...",
-    "successfullyRebuiltIndex": "Índice de enlaces reconstruido correctamente",
-    "successfullyRebuiltIndexReload": "¡Índice de enlaces reconstruido! La página se recargará para mostrar las conexiones actualizadas.",
-    "failedToRebuildIndex": "No se pudo reconstruir el índice de enlaces. Por favor, inténtelo de nuevo.",
+    "successfullyRebuiltIndex": "Índice de enlaces reconstruido",
+    "successfullyRebuiltIndexReload": "Índice de enlaces reconstruido. La página se recargará para mostrar las nuevas conexiones.",
+    "failedToRebuildIndex": "No se pudo reconstruir el índice de enlaces. Inténtelo de nuevo.",
     "contentLinks": "Enlaces de contenido",
-    "visualizeRelationships": "Visualiza las relaciones entre sus notas y Listas",
+    "visualizeRelationships": "Vea cómo se enlazan sus notas y listas entre sí",
     "connectedItems": "Elementos conectados",
     "noLinksFound": "No se encontraron enlaces",
     "startCreatingInternalLinks": "Comience a crear enlaces internos escribiendo `@` en sus notas para ver la red de relaciones aquí.",
@@ -718,8 +747,8 @@
     "isolated": "aislado",
     "connection": "conexión",
     "connection_plural": "conexiones",
-    "terminateSessionConfirm": "¿Está seguro de que desea terminar esta sesión?",
-    "terminateAllSessionsConfirm": "¿Está seguro de que desea terminar todas las demás sesiones?",
+    "terminateSessionConfirm": "¿Terminar esta sesión?",
+    "terminateAllSessionsConfirm": "¿Terminar todas las demás sesiones?",
     "validationErrorTitle": "Error de validación",
     "visibleGraphSummary": "{items} elementos visibles, {links} enlaces visibles",
     "graphTruncated": "Mostrando los {visible} elementos con más conexiones. Se omitieron {omitted} elementos con menos conexiones.",
@@ -790,10 +819,10 @@
     "chooseAutoSaveInterval": "Elija el intervalo para el guardado automático de sus notas.",
     "defaultMode": "Modo predeterminado",
     "selectNotesDefaultMode": "Seleccionar modo predeterminado de notas",
-    "chooseNotesDefaultMode": "Elija si la nota está automáticamente en modo edición o no {mode} botón en el editor de notas).",
+    "chooseNotesDefaultMode": "Elija si las notas se abren en modo edición. Siempre puede cambiar con el botón {mode} en el editor de notas.",
     "defaultEditor": "Editor predeterminado",
     "selectNotesDefaultEditor": "Seleccionar editor predeterminado de notas",
-    "chooseDefaultEditor": "Elija el editor predeterminado para sus notas - (siempre puede cambiar haciendo clic en el botón {editor} en el editor de notas).",
+    "chooseDefaultEditor": "Elija el editor predeterminado para sus notas. Siempre puede cambiar con el botón {editor} en el editor de notas.",
     "tableSyntaxInNotes": "Sintaxis de tabla en notas",
     "selectTableSyntax": "Seleccionar sintaxis de tabla",
     "chooseTableSyntax": "Elija cómo se renderizan las tablas en sus notas.",
@@ -802,7 +831,7 @@
     "chooseSyntaxTheme": "Elija el tema de resaltado de sintaxis para el editor Markdown.",
     "minimalMode": "Modo minimalista (deshabilitar editor de texto enriquecido)",
     "selectMinimalMode": "Seleccionar modo minimalista",
-    "minimalModeDescription": "Cuando está habilitado, usa un renderizador Markdown simple en lugar del editor de texto enriquecido. Las funciones avanzadas como el enlace bilateral no funcionarán en este modo.",
+    "minimalModeDescription": "Usa un renderizador Markdown simple en lugar del editor de texto enriquecido. Los enlaces bilaterales y otras funciones avanzadas no funcionan en este modo.",
     "defaultNoteFilter": "Filtro de nota predeterminado",
     "selectDefaultNoteFilter": "Seleccionar filtro de nota predeterminado",
     "chooseDefaultNoteFilter": "Elija el filtro predeterminado al abrir la página de notas.",
@@ -829,8 +858,8 @@
     "currentPassword": "Contraseña actual",
     "newPassword": "Nueva contraseña",
     "confirmPassword": "Confirmar contraseña",
-    "passwordChanged": "Contraseña cambiada correctamente",
-    "settingsSaved": "Configuración guardada correctamente",
+    "passwordChanged": "Contraseña cambiada",
+    "settingsSaved": "Configuración guardada",
     "dashCase": "Guion medio (ej., mi-archivo-nombre.md)",
     "minimal": "Mínimo (solo eliminar caracteres inválidos)",
     "noRename": "Sin renombrar (mantener el nombre original)",
@@ -840,6 +869,7 @@
     "seconds_plural": "{count} segundos",
     "hours12": "12 horas",
     "hours24": "24 horas",
+    "useSystemDefault": "Usar el sistema predeterminado",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "Predeterminado",
@@ -863,7 +893,7 @@
     "chooseQuickCreateNotes": "Elija el modo de creación rápida de notas.",
     "quickCreateNotesShowModal": "Mostrar modal al crear notas",
     "quickCreateNotesSkipModal": "Omitir modal y crear instantáneamente",
-    "quickCreateNotesDescription": "Cuando está habilitado, crear una nueva nota omite el modal de creación y le lleva directamente al editor de notas.",
+    "quickCreateNotesDescription": "Omite el diálogo de creación de notas y le lleva directamente al editor.",
     "defaultCategory": "Categoría predeterminada para creación rápida de notas",
     "selectDefaultCategory": "Seleccionar categoría predeterminada...",
     "defaultCategoryDescription": "Las nuevas notas se crearán en esta categoría al usar la creación rápida.",
@@ -901,7 +931,7 @@
     "hideStatusOnCardsLabel": "Estado en las tarjetas Kanban",
     "showStatusOnCards": "Mostrar estado",
     "hideStatusOnCards": "Ocultar estado",
-    "hideStatusOnCardsDescription": "Oculta la etiqueta de estado en las tarjetas Kanban. El estado ya se indica por la columna en la que se encuentra la tarjeta.",
+    "hideStatusOnCardsDescription": "Oculta la etiqueta de estado en las tarjetas Kanban. La columna ya muestra el estado.",
     "hideMobileStatusDropdownLabel": "Menú desplegable de estado móvil en tarjetas",
     "showMobileStatusDropdown": "Mostrar menú móvil",
     "hideMobileStatusDropdown": "Ocultar menú móvil",
@@ -914,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "Oculta el temporizador y las sesiones registradas en las tarjetas Kanban. El seguimiento de tiempo sigue disponible en la vista de detalle de la tarjeta.",
     "selectStatusOnCards": "Seleccionar visibilidad del estado",
     "codeBlockChoice": "Elija el estilo del bloque de código",
-    "themedCodeBlock": "Bloque de código temático",
     "defaultCodeBlock": "Codepen (predeterminado)",
+    "themedCodeBlock": "Bloque de código temático",
     "codeBlockChoiceDescription": "Elija entre el estilo de bloque de código predeterminado similar a un codepen o un estilo de bloque de código temático.",
     "checklistItemClickAction": "Acción de hacer clic en un elemento de la lista de verificación",
     "selectChecklistItemClickAction": "Seleccionar elemento de la lista de verificación hacer clic en acción",
-    "checklistItemClickActionDescription": "Elija qué sucede cuando hace clic en el texto de una tarea. \n\"Marcar como completo\" activa la casilla de verificación (predeterminada); \n\"Editar nombre de la tarea\" abre la tarea para su edición en línea; aún deberá hacer clic en la casilla de verificación para completarla.",
+    "checklistItemClickActionDescription": "Elija qué sucede cuando hace clic en el texto de una tarea. \"Marcar como completo\" (predeterminado) activa la casilla de verificación. \"Editar nombre de la tarea\" abre la tarea para editarla en línea, y para completarla hace clic en la propia casilla.",
     "checklistItemClickActionToggle": "Marcar como completo/incompleto",
     "checklistItemClickActionEdit": "Editar elemento de la lista",
     "newItemInsertion": "Inserción de nuevos elementos",
@@ -927,7 +957,6 @@
     "newItemInsertionDescription": "Elige si los nuevos elementos se añaden al principio (predeterminado) o al final de una lista de verificación.",
     "newItemInsertionTop": "Principio de la lista",
     "newItemInsertionBottom": "Final de la lista",
-    "useSystemDefault": "Usar el sistema predeterminado",
     "selectShowChecklistEmojis": "Seleccionar visibilidad de emojis",
     "showChecklistEmojisDescription": "Muestra un emoji automático junto a los elementos de la lista según su texto."
   },
@@ -970,20 +999,24 @@
     "icon512": "Icono 512x512",
     "icon512Description": "Icono de alta resolución para pantallas de inicio de PWA.",
     "notifyNewUpdates": "Notificarme sobre nuevas actualizaciones",
-    "thisUsesGithubAPI": "Esto utiliza la API de GitHub para obtener actualizaciones, deshabilitarlo impide cualquier tráfico hacia/desde GitHub.",
+    "thisUsesGithubAPI": "Esto utiliza la API de GitHub para buscar actualizaciones. Al desactivarlo se corta todo el tráfico hacia y desde GitHub.",
     "parseContent": "Mostrar siempre contenido procesado",
-    "parseContentEnabledDescription": "Cuando está habilitado, esta configuración mostrará los títulos procesados en la barra lateral, resultados de búsqueda y en toda la aplicación.",
-    "parseContentDisabledDescription": "Cuando está deshabilitado, los nombres de archivo originales se sanitizan, se hacen legibles y se muestran en su lugar.",
-    "parseContentPerformanceWarning": "Configurar esto en 'no' mejorará el rendimiento en grandes conjuntos de datos pero puede afectar la legibilidad, especialmente en nombres de archivo con caracteres no latinos.",
+    "parseContentEnabledDescription": "Muestra los títulos procesados en la barra lateral, en los resultados de búsqueda y en el resto de la aplicación.",
+    "parseContentDisabledDescription": "Muestra en su lugar los nombres de archivo originales, limpiados para que sean legibles.",
+    "parseContentPerformanceWarning": "Configurar esto en 'no' acelera las instancias grandes pero hace que los títulos sean más difíciles de leer, especialmente los nombres de archivo con caracteres no latinos.",
     "hideLanguageSelector": "Ocultar Selector de Idioma en el Encabezado",
     "hideLanguageSelectorDescription": "Mostrar/ocultar menú desplegable de idioma en el encabezado",
+    "defaultDateFormat": "Formato de fecha predeterminado",
+    "defaultDateFormatDescription": "Se utiliza cuando la preferencia de formato de fecha de un usuario está configurada en \"Usar valor predeterminado del sistema\".",
+    "defaultTimeFormat": "Formato de hora predeterminado",
+    "defaultTimeFormatDescription": "Se utiliza cuando la preferencia de formato de hora de un usuario está configurada en \"Usar valor predeterminado del sistema\".",
     "applicationIcons": "Iconos de la aplicación",
     "saveChanges": "Guardar cambios",
     "unsavedChanges": "Tiene cambios no guardados.",
     "loadError": "Error de carga",
     "couldNotFetchSettings": "No se pudieron obtener los ajustes.",
     "failedToLoadSettings": "No se pudo cargar la configuración",
-    "settingsSavedSuccessfully": "Configuración guardada correctamente.",
+    "settingsSavedSuccessfully": "Configuración guardada.",
     "failedToSaveSettings": "No se pudo guardar la configuración",
     "saveError": "Error al guardar",
     "unknownErrorOccurred": "Ocurrió un error desconocido.",
@@ -996,7 +1029,7 @@
     "colorVariables": "Variables de color",
     "livePreview": "Vista previa en vivo",
     "unsavedCssChanges": "Tiene cambios de CSS no guardados.",
-    "noCustomThemesYet": "Aún no se han creado temas personalizados. Haga clic en 'Crear tema' para comenzar.",
+    "noCustomThemesYet": "Aún no hay temas personalizados. Haga clic en 'Crear tema' para crear uno.",
     "myCustomTheme": "Mi tema personalizado",
     "iconNameDescription": "nombre del icono (ej., PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "Versión de la app",
@@ -1026,30 +1059,36 @@
     "enableTableToolbarDescription": "Habilite la barra de herramientas al editar tablas",
     "bilateralLinks": "Enlaces bilaterales",
     "bilateralLinksDescription": "Habilite la capacidad de enlazar notas y listas en el mismo documento.",
+    "historyEnabled": "Historial de notas",
+    "historyDescription": "Registra el historial de versiones de las notas. Permite restaurar versiones anteriores. Solo los guardados manuales crean puntos de historial (no el autoguardado).",
+    "disableHistory": "Desactivar historial",
+    "disableHistoryWarning": "Al desactivar el historial se borrarán permanentemente todas las versiones guardadas de todos los usuarios. No se puede deshacer.",
+    "historyDisabled": "El historial de notas se desactivó y se eliminaron todos los datos de historial.",
+    "failedToDisableHistory": "No se pudo desactivar el historial",
     "configureExternalServices": "Configure URLs de servicios externos para integraciones del editor.",
     "drawioUrl": "URL de Draw.io",
     "optional": "(Opcional)",
-    "drawioUrlDescription": "Especifica una URL personalizada de Draw.io. Déjelo vacío para usar la instancia pública por defecto (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Use su propia instancia de Draw.io. Déjelo vacío para usar la pública (https://embed.diagrams.net).",
     "drawioUrlExample": "Ejemplo para autohospedado: https://su-dominio.com/drawio",
     "drawioProxyEnabled": "Proxy Draw.io vía Jotty",
-    "drawioProxyEnabledDescription": "Habilite esto para enrutar el tráfico de Draw.io a través del servidor de Jotty. Requerido para URLs internas de red Docker (ej., http://drawio:8080) que no son accesibles desde los navegadores de los usuarios.",
+    "drawioProxyEnabledDescription": "Enruta el tráfico de Draw.io a través del servidor de Jotty. Necesario para URLs internas de red Docker (ej., http://drawio:8080) que los navegadores de los usuarios no pueden alcanzar.",
     "excalidrawUrl": "URL de Excalidraw",
-    "excalidrawUrlDescription": "Especifica una URL personalizada de Excalidraw. Déjelo vacío para usar la instancia pública por defecto (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Use su propia instancia de Excalidraw. Déjelo vacío para usar la pública (https://excalidraw.com).",
     "excalidrawUrlExample": "Ejemplo para autohospedado: https://su-dominio.com/excalidraw",
     "excalidrawProxyEnabled": "Proxy Excalidraw vía Jotty",
-    "excalidrawProxyEnabledDescription": "Habilite esto para enrutar el tráfico de Excalidraw a través del servidor de Jotty. Requerido para URLs internas de red Docker (ej., http://excalidraw:3000) que no son accesibles desde los navegadores de los usuarios.",
+    "excalidrawProxyEnabledDescription": "Enruta el tráfico de Excalidraw a través del servidor de Jotty. Necesario para URLs internas de red Docker (ej., http://excalidraw:3000) que los navegadores de los usuarios no pueden alcanzar.",
     "saving": "Guardando...",
-    "editorSettingsSaved": "Configuración del editor guardada correctamente.",
+    "editorSettingsSaved": "Configuración del editor guardada.",
     "customEmojis": "Emojis personalizados",
-    "noEmojisYet": "Aún no se han creado emojis personalizados. Haga clic en 'Agregar emoji' para comenzar.",
-    "enterAnyEmoji": "Ingresa cualquier emoji o use el selector de emojis (Win: Win+.; Mac: Ctrl+Cmd+Espacio",
+    "noEmojisYet": "Aún no hay emojis personalizados. Haga clic en 'Agregar emoji' para añadir uno.",
+    "enterAnyEmoji": "Ingrese cualquier emoji o use el selector de emojis (Win: Win+.; Mac: Ctrl+Cmd+Espacio)",
+    "sharingOverview": "Resumen de actividad de compartición",
+    "detailedSharingBreakdown": "Qué se comparte y quién lo comparte",
     "checkForUpdates": "Buscar actualizaciones",
     "checkingForUpdates": "Buscando actualizaciones...",
     "updateAvailable": "¡Actualización disponible!",
     "upToDate": "¡Estás actualizado!",
     "issuesAndBugs": "Problemas e informes de errores",
-    "sharingOverview": "Resumen de actividad de compartición",
-    "detailedSharingBreakdown": "Desglose detallado de patrones de compartición y participación de usuarios",
     "activeChecklistSharers": "Usuarios activos compartiendo listas",
     "activeNotesSharers": "Usuarios activos compartiendo notas",
     "totalSharing": "Total de acciones de compartición",
@@ -1059,12 +1098,12 @@
     "userContent": "{checklistsLength} listas • {notesLength} notas",
     "rebuildIndexes": "Reconstruir índices",
     "rebuilding": "Reconstruyendo...",
-    "successfullyRebuiltIndex": "Índice de enlaces reconstruido correctamente para {username}",
+    "successfullyRebuiltIndex": "Índice de enlaces reconstruido para {username}",
     "failedToRebuildIndex": "No se pudo reconstruir el índice de enlaces para {username}",
     "totalItems": "{items} elementos totales entre {userCount}",
     "privileges": "Privilegios de administrador",
     "adminContentAccess": "Acceso a contenido de administrador",
-    "adminContentAccessDescription": "Controla si los administradores pueden acceder a todas las notas y listas de los usuarios. Cuando está deshabilitado, los administradores solo pueden gestionar usuarios y ajustes pero no ver el contenido de otros.",
+    "adminContentAccessDescription": "Permite a los administradores abrir las notas y listas de todos los usuarios. Si está desactivado, pueden gestionar usuarios y ajustes pero no ver el contenido de nadie más.",
     "adminContentAccessYes": "Los administradores pueden acceder a todo el contenido",
     "adminContentAccessNo": "Los administradores solo pueden acceder a su propio contenido",
     "superAdminOnly": "Solo editable por el propietario del sistema",
@@ -1074,21 +1113,21 @@
     "confirmNewPassword": "Confirme la nueva contraseña",
     "dataExport": "Exportación de datos",
     "dataExportOptions": "Opciones de exportación de datos",
-    "selectExportType": "Seleccione un tipo de exportación y descargue datos de su aplicación.",
+    "selectExportType": "Elija un tipo de exportación y descargue los datos.",
     "allChecklistsAndNotes": "Todas las listas y notas",
-    "allChecklistsAndNotesDescription": "Exporta todas las listas y notas creadas por todos los usuarios. Esto generará un archivo zip con datos JSON organizados por usuario y categoría.",
+    "allChecklistsAndNotesDescription": "Exporta las listas y notas de todos los usuarios como un zip de archivos JSON, agrupados por usuario y categoría.",
     "userChecklistsNotes": "Listas y notas de un usuario específico",
-    "userChecklistsNotesDescription": "Seleccione un usuario del menú para exportar todas las listas y notas de ese usuario.",
+    "userChecklistsNotesDescription": "Elija un usuario del menú para exportar todas sus listas y notas.",
     "allUsersData": "Todos los datos de cuentas de usuario",
     "allUsersDataDescription": "Exporta un archivo JSON con toda la información de cuentas de usuario (nombres, estado de administrador, etc.). Esto NO incluye el contenido de sus listas o notas.",
     "wholeDataFolder": "Carpeta de datos completa (copia de seguridad)",
-    "wholeDataFolderDescription": "Exporte toda la carpeta 'data', incluyendo todo el contenido de usuario, metadatos y ajustes. Úselo con precaución ya que puede ser un archivo grande.",
+    "wholeDataFolderDescription": "Exporta toda la carpeta 'data', con todo el contenido de usuario, metadatos y ajustes. Este archivo puede ser grande.",
     "noSharingPermissionsLabel": "Elementos compartidos específicos están ocultos según sus permisos de acceso al contenido.",
     "contentHidden": "Detalles de contenido ocultos",
     "viewOnlySettingsNotice": "Solo el propietario del sistema puede modificar estos ajustes.",
     "auditLogContentRedacted": "[Contenido oculto]",
     "maxLogAgeDays": "Máxima antigüedad de registros (días)",
-    "maxLogAgeDaysDescription": "Establezca cuánto tiempo se conservan los registros de auditoría. Al ver la página de registros, se le pedirá limpiar los registros más antiguos que este umbral. Ponga 0 para retención ilimitada (sin limpieza automática).",
+    "maxLogAgeDaysDescription": "Cuánto tiempo se conservan los registros de auditoría. La página de registros ofrece limpiar todo lo que sea más antiguo. Ponga 0 para conservarlos para siempre y no ver nunca el aviso.",
     "appPreferences": "Preferencias de la app",
     "editEmoji": "Editar emoji",
     "addEmoji": "Agregar emoji",
@@ -1107,16 +1146,6 @@
     "updateTagsTitle": "Escanear notas en busca de hashtags y actualizar frontmatter",
     "tagsUpdated": "{processed} archivos procesados, {updated} actualizados con nuevas etiquetas",
     "failedToUpdateTags": "Error al actualizar las etiquetas",
-    "historyEnabled": "Historial de notas",
-    "historyDescription": "Registra el historial de versiones de las notas. Permite restaurar versiones anteriores. Solo los guardados manuales crean puntos de historial (no el autoguardado).",
-    "disableHistory": "Desactivar historial",
-    "disableHistoryWarning": "Al desactivar el historial se borrarán permanentemente todas las versiones guardadas de todos los usuarios. No se puede deshacer.",
-    "historyDisabled": "El historial de notas se desactivó y se eliminaron todos los datos de historial.",
-    "failedToDisableHistory": "No se pudo desactivar el historial",
-    "defaultDateFormat": "Formato de fecha predeterminado",
-    "defaultDateFormatDescription": "Se utiliza cuando la preferencia de formato de fecha de un usuario está configurada en \"Usar valor predeterminado del sistema\".",
-    "defaultTimeFormatDescription": "Se utiliza cuando la preferencia de formato de hora de un usuario está configurada en \"Usar valor predeterminado del sistema\".",
-    "defaultTimeFormat": "Formato de hora predeterminado",
     "borderRadius": "Radio de borde",
     "borderRadiusDescription": "Define el redondeo de esquinas de toda la instancia. Los usuarios pueden sobrescribirlo en los ajustes rápidos.",
     "borderRadiusSaved": "Radio de borde guardado",
@@ -1132,6 +1161,9 @@
     "tryAgain": "Inténtelo de nuevo",
     "contactSupport": "Contacte al soporte",
     "invalidInput": "Entrada inválida",
+    "invalidEditorSettings": "La configuración del editor debe ser un objeto, no se guardó nada",
+    "invalidEditorSetting": "El ajuste del editor {field} tiene un tipo incorrecto, no se guardó nada",
+    "categoryOutOfBounds": "Esa categoría está fuera de sus notas, así que no se creó nada",
     "requiredField": "Este campo es obligatorio",
     "emailInvalid": "Por favor, ingrese un correo válido",
     "passwordTooShort": "La contraseña debe tener al menos 8 caracteres",
@@ -1139,43 +1171,44 @@
     "networkError": "Error de red",
     "timeout": "Tiempo de espera agotado",
     "permissionDenied": "Permiso denegado",
-    "requiredPermissions": "No tienes los permisos necesarios para realizar esta acción.",
+    "requiredPermissions": "No tienes permiso para hacer eso.",
     "loadError": "Error de carga",
     "failedToLoadCustomEmojis": "No se pudieron cargar los emojis personalizados",
-    "emojiDeletedSuccessfully": "Emoji eliminado correctamente",
+    "emojiDeletedSuccessfully": "Emoji eliminado",
     "deleteError": "Error al eliminar",
     "failedToDeleteEmoji": "No se pudo eliminar el emoji",
     "validationError": "Error de validación",
     "keywordAndEmojiRequired": "Palabra clave y emoji son obligatorios",
     "duplicateKeyword": "Palabra clave duplicada",
     "keywordAlreadyExists": "La palabra clave ya existe",
-    "emojiUpdatedSuccessfully": "Emoji actualizado correctamente",
-    "emojiCreatedSuccessfully": "Emoji creado correctamente",
+    "emojiUpdatedSuccessfully": "Emoji actualizado",
+    "emojiCreatedSuccessfully": "Emoji creado",
     "saveError": "Error al guardar",
     "failedToSaveEmoji": "No se pudo guardar el emoji",
     "failedToLoadCustomCSS": "No se pudo cargar el CSS personalizado",
     "couldNotLoadCustomCSS": "No se pudo cargar el CSS personalizado.",
     "couldNotLoadThemes": "No se pudieron cargar los temas.",
-    "customCSSSavedSuccessfully": "CSS personalizado guardado correctamente.",
+    "customCSSSavedSuccessfully": "CSS personalizado guardado.",
     "themeNotFound": "Tema no encontrado.",
-    "themeDeletedSuccessfully": "Tema eliminado correctamente.",
+    "themeDeletedSuccessfully": "Tema eliminado.",
     "themeNameRequired": "El nombre del tema es obligatorio.",
-    "themeSavedSuccessfully": "Tema {action} correctamente.",
+    "themeSavedSuccessfully": "Tema {action}.",
     "anUnknownErrorOccurred": "Ocurrió un error desconocido.",
     "usernameRequired": "El nombre de usuario es obligatorio",
     "passwordRequired": "La contraseña es obligatoria",
     "passwordMinLength": "La contraseña debe tener al menos 6 caracteres",
     "passwordsDoNotMatch": "Las contraseñas no coinciden",
-    "userSavedSuccessfully": "¡Usuario {mode} correctamente!",
+    "userSavedSuccessfully": "Usuario {mode}.",
     "failedToSaveUser": "No se pudo {mode} el usuario",
     "anErrorOccurred": "Ocurrió un error.",
     "deleteUserConfirmation": "¿Eliminar usuario \"{username}\"? Esto no se puede deshacer.",
-    "userDeletedSuccessfully": "¡Usuario eliminado correctamente!",
-    "failedToDeleteUser": "No se pudo eliminar el usuario"
+    "userDeletedSuccessfully": "Usuario eliminado.",
+    "failedToDeleteUser": "No se pudo eliminar el usuario",
+    "readOnlyFolder": "Esta carpeta es de solo lectura en el servidor, así que el cambio no se pudo guardar."
   },
   "pwa": {
     "installPromptTitle": "Instalar aplicación",
-    "installPromptMessage": "Instale esta aplicación en su dispositivo para una mejor experiencia",
+    "installPromptMessage": "Instale Jotty en su dispositivo para que se abra como una aplicación",
     "installButton": "Instalar",
     "updateAvailable": "Actualización disponible",
     "updateMessage": "Hay una nueva versión disponible",
@@ -1233,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Alternar modo de editor enriquecido",
     "toggleMarkdownMode": "Alternar modo Markdown",
+    "quickControls": "Controles del editor",
     "toggleBold": "Alternar negrita",
     "toggleItalic": "Alternar cursiva",
     "toggleUnderline": "Alternar subrayado",
@@ -1322,15 +1356,15 @@
     "drawioDescription": "Editor visual de diagramas",
     "excalidrawDescription": "Editor de diagramas tipo boceto",
     "noLanguagesFound": "No se encontraron idiomas",
-    "ruler": "Gobernante",
-    "lineNumbers": "Números de línea",
     "callout": "Aviso",
     "createCallout": "Crear un bloque de aviso",
     "changeCalloutType": "Cambiar tipo de aviso",
     "calloutInfo": "Información",
     "calloutWarning": "Advertencia",
     "calloutSuccess": "Éxito",
-    "calloutDanger": "Peligro"
+    "calloutDanger": "Peligro",
+    "ruler": "Gobernante",
+    "lineNumbers": "Números de línea"
   },
   "sharing": {
     "share": "Compartir",
@@ -1395,7 +1429,7 @@
     "encrypt": "Encriptar",
     "decrypt": "Desencriptar",
     "encrypted": "Encriptado",
-    "unencrypted": "No encriptado",
+    "decrypted": "Descifrado",
     "encryptionKey": "Clave de encriptación",
     "enterKey": "Ingrese clave de encriptación",
     "confirmKey": "Confirmar clave de encriptación",
@@ -1406,16 +1440,16 @@
     "viewNote": "Ver nota",
     "editNote": "Editar nota",
     "privateKeyWarning": "ADVERTENCIA: Su clave privada permite la desencriptación de todas las notas encriptadas. Solo exporte si comprende las implicaciones de seguridad. ¿Continuar?",
-    "publicKeyExported": "Clave pública exportada con éxito",
-    "privateKeyExported": "Clave privada exportada con éxito",
+    "publicKeyExported": "Clave pública exportada",
+    "privateKeyExported": "Clave privada exportada",
     "failedToExportKey": "No se pudo exportar la clave",
     "unexpectedError": "Ocurrió un error inesperado",
-    "keysDeleted": "Claves eliminadas con éxito",
+    "keysDeleted": "Claves eliminadas",
     "failedToDeleteKeys": "No se pudieron eliminar las claves",
     "autoDecryptUpdated": "Configuración de desencriptación automática actualizada",
     "failedToUpdateSetting": "No se pudo actualizar la configuración",
-    "enterValidPath": "Por favor, ingrese una ruta válida",
-    "customPathSet": "Ruta de clave personalizada establecida con éxito",
+    "enterValidPath": "Ingrese una ruta válida",
+    "customPathSet": "Ruta de clave personalizada establecida",
     "failedToSetCustomPath": "No se pudo establecer la ruta personalizada",
     "thisNoteIsEncrypted": "Esta nota está encriptada",
     "noteProtectedWith": "Esta nota está protegida con encriptación {type}.",
@@ -1426,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Seleccionar método de encriptación",
     "encryptionMethodsTitle": "Métodos de encriptación",
-    "xchachaDescription": "XChaCha20-Poly1305: Encriptación moderna, rápida y basada en frase de contraseña",
-    "pgpDescription": "PGP: Criptografía tradicional de clave pública con gestión de pares de claves",
+    "xchachaDescription": "XChaCha20-Poly1305: encriptación con frase de contraseña",
+    "pgpDescription": "PGP: encriptación de clave pública con un par de claves que usted gestiona",
     "encryptionKeys": "Claves de encriptación",
     "keysConfigured": "Claves configuradas",
     "algorithm": "Algoritmo: ",
@@ -1441,9 +1475,9 @@
     "keysDisabledInDemo": "Las claves de encriptación almacenadas están deshabilitadas en el modo de demostración.",
     "encryptionSettings": "Configuración de Encriptación",
     "promptForPassphrase": "Solicitar frase de contraseña al abrir notas encriptadas",
-    "promptForPassphraseDescription": "Si está habilitado, se le solicitará su frase de contraseña al abrir una nota encriptada. La nota permanecerá encriptada en el servidor, pero podrá ver el contenido desencriptado en la sesión actual de la pestaña.",
+    "promptForPassphraseDescription": "Pide su frase de contraseña al abrir una nota encriptada. La nota sigue encriptada en el servidor y el contenido desencriptado solo se ve en esta pestaña.",
     "customKeyPath": "Ruta de Clave Personalizada (Instalaciones Locales)",
-    "customKeyPathDescription": "Especifique una ruta personalizada (absoluta) del sistema de archivos para almacenar las claves de encriptación. Esto solo es necesario para instalaciones locales. Los usuarios de Docker deben mapear la ruta predeterminada en docker-compose.yml en su lugar.",
+    "customKeyPathDescription": "Una ruta absoluta del sistema de archivos para sus claves de encriptación. Solo la necesitan las instalaciones locales. Los usuarios de Docker deben mapear la ruta predeterminada en docker-compose.yml en su lugar.",
     "customPath": "Ruta Personalizada",
     "customPathPlaceholder": "/home/user/my-keys",
     "customPathHelp": "Debe ser una ruta absoluta (por ejemplo, /home/user/my-keys o C:\\Users\\user\\my-keys)",
@@ -1462,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "El contenido de la nota se encriptará antes de guardarla en el servidor",
     "passphraseRequired": "Se requiere frase de contraseña",
     "incorrectPassphrase": "Frase de contraseña incorrecta",
-    "noteEncryptedSuccessfully": "Nota encriptada con éxito",
+    "noteEncryptedSuccessfully": "Nota encriptada",
     "failedToEncryptNote": "Error al encriptar la nota",
-    "noteDecryptedSuccessfully": "Nota desencriptada con éxito",
+    "noteDecryptedSuccessfully": "Nota desencriptada",
     "failedToDecryptNote": "Error al desencriptar la nota",
     "passphrase": "Frase de contraseña",
     "enterYourPassphrase": "Ingrese su frase de contraseña",
@@ -1492,8 +1526,8 @@
     "privateKey": "Clave privada",
     "noStoredKeysFound": "No se encontraron claves almacenadas",
     "noEncryptionKeysConfigured": "No tiene claves de encriptación configuradas",
-    "pastePublicKeyBelow": "Por favor, pegue una clave pública para encriptar el contenido de la nota",
-    "generateOrImportKeysInProfile": "Puede generar o importar claves específicas para Jotty en Perfil → Encriptación",
+    "pastePublicKeyBelow": "Pegue una clave pública abajo para encriptar el contenido de la nota",
+    "generateOrImportKeysInProfile": "Puede generar o importar claves para Jotty en Perfil > Encriptación",
     "useCustomKey": "Usar clave {keyType} personalizada",
     "signWithPrivateKey": "Firmar con clave privada",
     "proveAuthenticityOfNote": "probar la autenticidad de esta nota",
@@ -1513,7 +1547,7 @@
     "yourEmail": "su@correo.com",
     "generating": "Generando...",
     "generateKeys": "Generar Claves",
-    "keysGeneratedSuccessfully": "Claves Generadas Exitosamente",
+    "keysGeneratedSuccessfully": "Claves generadas",
     "importPGPKeys": "Importar Claves PGP",
     "publicKeyLabel": "Clave Pública",
     "privateKeyLabel": "Clave Privada",
@@ -1522,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "¡Recuerde su frase de contraseña! No se puede recuperar.",
     "withoutPassphraseCannotDecrypt": "Sin la frase de contraseña, no puede descifrar sus notas.",
     "backupPrivateKeySafely": "Haga una copia de seguridad de su clave privada de forma segura.",
-    "pgpKeyPairGeneratedSuccessfully": "Par de claves PGP generado con éxito",
+    "pgpKeyPairGeneratedSuccessfully": "Par de claves PGP generado",
     "failedToGenerateKeys": "Error al generar claves",
     "fingerprint": "Huella digital",
     "keysSavedSecurely": "Sus claves han sido guardadas de forma segura.",
@@ -1536,14 +1570,13 @@
     "bothKeysRequired": "Se requieren tanto la clave pública como la privada",
     "invalidPublicKeyFormat": "Formato de clave pública inválido. Debe ser una clave PGP ASCII-armada.",
     "invalidPrivateKeyFormat": "Formato de clave privada inválido. Debe ser una clave PGP ASCII-armada.",
-    "keysImportedSuccessfully": "Claves importadas exitosamente",
+    "keysImportedSuccessfully": "Claves importadas",
     "failedToImportKeys": "Error al importar claves",
     "created": "Cifrado creado",
-    "decrypted": "Descifrado",
     "notePlaceholder": "Soy un marcador de posición porque no puedes cifrar una nota vacía."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Estas opciones solo se aplican a la sesión actual del navegador. Para configuraciones permanentes, por favor revise sus",
+    "sessionOnlyPrefix": "Estas opciones solo se aplican a esta sesión del navegador. Para configuraciones permanentes, revise sus",
     "accountSettings": "preferencias de usuario",
     "autosaveNotes": "Guardar notas automáticamente",
     "showNotePreview": "Mostrar vista previa de la nota en las tarjetas",
@@ -1572,20 +1605,45 @@
     "migrationSuccessful": "Migración Exitosa",
     "returnToApp": "Volver a la Aplicación",
     "adminAccessRequired": "Se requiere acceso de administrador",
-    "adminAccessDescription": "Esta migración requiere privilegios de administrador. Por favor, contacte a un administrador para realizar la migración del sistema.",
+    "adminAccessDescription": "Esta migración necesita un administrador. Pida a uno que la ejecute.",
     "whatsHappening": "¿Qué está pasando?",
-    "sharingDataMigrationDescription": "El sistema necesita migrar sus datos de compartición. Este es un proceso único que requiere acceso de administrador.",
+    "sharingDataMigrationDescription": "Jotty necesita migrar sus datos de compartición. Solo se ejecuta una vez y necesita un administrador.",
     "whatsChanging": "¿Qué está cambiando?",
     "automaticBackupIncluded": "Copia de seguridad automática incluida",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter es el estándar de la industria",
-    "noMigrationNeeded": "No se necesitó migración: su sistema ya está actualizado.",
-    "importantBackupData": "Importante: Haga una copia de seguridad de sus datos"
+    "noMigrationNeeded": "No hay nada que migrar, sus datos ya están al día.",
+    "importantBackupData": "Importante: Haga una copia de seguridad de sus datos",
+    "sharingNowWithData": "Sus datos de compartición ahora viven junto a sus notas y carpetas.",
+    "sharingMovesDescription": "La compartición sale de un archivo central y pasa a sus datos. Ahora se pueden compartir carpetas, y las carpetas compartidas aparecen en su propia barra lateral en lugar de en una sección aparte.",
+    "whatsHappeningBody": "Cada elemento compartido en <code>.sharing.json</code> se escribe en el frontmatter del elemento al que pertenece, y cada carpeta recibe un <code>.category-info.json</code> con su identidad, compartición y orden. Los archivos antiguos se eliminan cuando los datos se han movido.",
+    "migrationChanges": "Cambios de la migración",
+    "sharingTravelsTitle": "La compartición viaja con el archivo",
+    "sharingTravelsBody": "Cada elemento compartido registra con quién se comparte en su propio frontmatter, así que moverlo o renombrarlo nunca rompe una compartición.",
+    "folderSharingTitle": "Compartir carpetas",
+    "folderSharingBody": "Comparta una carpeta y todo lo que contenga, ahora y en el futuro, también se comparte. Los destinatarios la ven como una carpeta normal en su propia barra lateral.",
+    "oneFilePerFolderTitle": "Un archivo por carpeta",
+    "oneFilePerFolderBody": "<code>.order.json</code> se integra en <code>.category-info.json</code>, con el orden basado en el uuid en lugar del nombre de archivo.",
+    "permissionsUnchangedTitle": "Los permisos no cambian",
+    "permissionsUnchangedBody": "Lectura, edición y eliminación se mantienen exactamente como están hoy, por usuario y por elemento.",
+    "backupWarningBody": "Esta migración reescribe el frontmatter de sus notas y listas y elimina los archivos antiguos <code>.sharing.json</code> y <code>.order.json</code>. Haga una copia de seguridad de su carpeta <code>data</code> antes de continuar.",
+    "backupConfirmLabel": "He hecho una copia de seguridad de mi carpeta data y entiendo el proceso de migración.",
+    "backupConfirmHint": "Confirme que tiene una copia de seguridad antes de continuar.",
+    "sharingDataMigrated": "Sus datos de compartición y orden se han migrado.",
+    "whatWasChanged": "Qué se cambió:",
+    "migrationPartial": "Migración terminada con restos",
+    "leftoversTitle": "Se conservaron algunos archivos antiguos",
+    "leftoversBody": "La migración no pudo trasladarlo todo, así que los archivos antiguos de abajo se quedaron en el disco sin tocar. No se ha eliminado nada. Puede corregir la causa y volver a ejecutar la migración, o entrar ya en la aplicación y ocuparse de ello más tarde.",
+    "overrideConfirmLabel": "Continuar de todos modos y dejar de mostrar esta página.",
+    "overrideConfirmHint": "Los archivos restantes se quedan en el disco, pero la aplicación tratará sus datos como migrados. La compartición u orden indicados arriba no se aplicarán hasta que vuelva a migrar, algo que puede hacer en cualquier momento desde /migration?force=1.",
+    "continueAnyway": "Continuar de todos modos",
+    "overriding": "Continuando...",
+    "overrideFailed": "No se pudo omitir la migración"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Categoria cambiada de nombre exitosamente",
+    "categoryRenamedSuccessfully": "Categoría renombrada",
     "failedToRenameCategory": "Error al al cambiar el nombre de la categoria",
     "categoryRenamedSuccessfullyMessage": "Categoria {categoryName} cambiada de nombre a {newName}",
-    "failedToRenameCategoryMessage": "Ocurrió un error al al cambiar el nombre de la categoria."
+    "failedToRenameCategoryMessage": "Algo salió mal al cambiar el nombre de la categoría."
   },
   "auditLogs": {
     "title": "Registros de Auditoría",
@@ -1602,17 +1660,17 @@
     "exportJSON": "Exportar JSON",
     "exportCSV": "Exportar CSV",
     "cleanupOldLogs": "Limpiar Registros antiguos",
-    "confirmCleanup": "¿Está seguro de que desea eliminar los registros con más de {days} días? Esto afectará a TODOS los usuarios y no se puede deshacer.",
+    "confirmCleanup": "¿Eliminar los registros con más de {days} días? Esto afecta a TODOS los usuarios y no se puede deshacer.",
     "confirmCleanupUnlimited": "No hay una limpieza automática configurada (retención ilimitada). Aún puede eliminar manualmente los registros antiguos si es necesario.",
     "deleteAllLogsModalTitle": "Eliminar Todos los Registros de Auditoría",
     "deleteAllLogsWarning": "Esto eliminará TODOS los registros, no solo los antiguos",
     "deleteAllLogsWarningDescription": "Todo el historial de registros de auditoría será borrado del sistema.",
     "deletingAllLogs": "Eliminando Todos los Registros...",
     "deleteAllLogsButton": "Eliminar Todos los Registros",
-    "cleanupSuccess": "Se eliminaron correctamente {count} archivos de registro antiguos",
+    "cleanupSuccess": "Se eliminaron {count} archivos de registro antiguos",
     "cleanupError": "Error al limpiar los registros antiguos",
-    "userDescription": "Ver toda su actividad y acciones en el sistema",
-    "adminDescription": "Ver y administrar toda la actividad de los usuarios en el sistema",
+    "userDescription": "Todo lo que ha hecho en Jotty",
+    "adminDescription": "Lo que cada usuario ha hecho en esta instancia",
     "level": "Nivel",
     "allLevels": "Todos los Niveles",
     "allCategories": "Todas las Categorías",
@@ -1676,9 +1734,9 @@
     "topActions": "Acciones principales",
     "mostActiveUsers": "Usuarios más activos",
     "oldLogsFound": "Hay {count} archivos de registro con más de {days} días.",
-    "oldLogsFoundDescription": "¿Desea limpiarlos? Esta acción no se puede deshacer.",
+    "oldLogsFoundDescription": "¿Limpiarlos? Esto no se puede deshacer.",
     "cleanUpNow": "Limpiar Ahora",
-    "cleanupSuccessMessage": "Se eliminaron correctamente {count} archivos de registro antiguos.",
+    "cleanupSuccessMessage": "Se eliminaron {count} archivos de registro antiguos.",
     "security": "Seguridad",
     "mfasecretgenerated": "Se generó el Secreto MFA",
     "mfaenabled": "MFA activado",
@@ -1694,6 +1752,7 @@
     "howTo": "Cómo hacer",
     "shortcuts": "Atajos",
     "markdownGuide": "Guía de Markdown",
+    "brain": "Enlaces y Brain",
     "customisations": "Personalizaciones",
     "docker": "Docker",
     "envVariables": "Variables de Entorno",
@@ -1701,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "Encriptación",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Traducciones",
     "unraid": "Unraid",
     "patches": "Parches"
@@ -1712,33 +1772,9 @@
     "seenCount": "Has visto {count} {count, plural, one {haiku} other {haikus}}",
     "imNoPoet": "Yo no soy poeta, ni Jotty tampoco. Estas son palabras aleatorias en secuencia."
   },
-  "history": {
-    "fetchError": "Error al cargar el historial",
-    "restoreError": "No se pudo restaurar la versión",
-    "manualSavesOnly": "El historial se crea únicamente al guardar manualmente, no al guardar automáticamente.",
-    "noHistory": "No hay historial disponible",
-    "noHistoryDescription": "Guarda la nota para crear un punto en el historial.",
-    "restore": "Restaurar",
-    "loadMore": "Cargar más",
-    "viewContent": "Ver contenido",
-    "viewDiff": "Ver cambios",
-    "noteHistory": "Historial de la nota",
-    "restoreVersion": "Restaurar versión",
-    "restoreConfirm": "¿Restaurar esta versión? \nEl contenido actual será reemplazado.",
-    "featureDisabled": "Historial desactivado",
-    "disabledAdmin": "El historial de notas está desactivado actualmente. Puede activarlo en la Configuración de administración > Editor.",
-    "disabledUser": "El historial de notas está desactivado actualmente. Póngase en contacto con su administrador para activar esta función.",
-    "goToSettings": "Ir a configuración",
-    "actionCreate": "Creado",
-    "actionUpdate": "Actualizado",
-    "actionRename": "Renombrado",
-    "actionMove": "Movido",
-    "actionDelete": "Eliminado",
-    "actionInit": "Inicializado",
-    "actionUnknown": "Cambiado"
-  },
   "notifications": {
     "title": "Notificaciones",
+    "unread": "sin leer",
     "markAllRead": "Marcar todo como leído",
     "clearAll": "Borrar todo",
     "empty": "Sin notificaciones",
@@ -1746,12 +1782,99 @@
     "assignmentMessage": "\"{task}\" en \"{board}\"",
     "reminderTitle": "Tarea vencida",
     "reminderMessage": "\"{task}\" en \"{board}\" ya pasó su recordatorio",
-    "unread": "sin leer",
     "sharingTitle": "{user} compartió un {type} contigo",
     "sharingMessage": "Abre para ver el {type} compartido",
     "sharingFolderTitle": "{user} compartió una carpeta de {type} contigo",
-    "sharingFolderMessage": "Abre para ver “{folder}”",
+    "sharingFolderMessage": "Abre para ver \"{folder}\"",
     "mentionTitle": "{user} te mencionó en un comentario",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
+  },
+  "relations": {
+    "indexing": "Indexando relaciones...",
+    "unreachable": "no accesible",
+    "createFromWikilink": "Crear una nota llamada \"{title}\"",
+    "mentionedIn": "Mencionado en",
+    "mentionedInHint": "Estas notas usan este título como texto plano. Enlace una para conectarla.",
+    "linkMention": "Enlazar",
+    "linked": "Mención enlazada en {title}",
+    "linkFailed": "No se pudo enlazar esa mención",
+    "kind": {
+      "mention": "Enlace",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "Brain",
+    "openBrain": "Abrir en el brain",
+    "search": "Busque algo en su brain...",
+    "dimension": "Vista",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Alrededor de este elemento",
+    "global": "Todo",
+    "depth": "Profundidad {depth}",
+    "colourBy": "Colorear por",
+    "colourModes": {
+      "type": "Tipo",
+      "category": "Categoría"
+    },
+    "filters": {
+      "notes": "Notas",
+      "checklists": "Listas",
+      "tags": "Etiquetas",
+      "ghosts": "Aún sin escribir",
+      "suggestions": "Sugerencias",
+      "orphans": "Solitarios"
+    },
+    "kind": {
+      "note": "Nota",
+      "checklist": "Lista",
+      "ghost": "Aún sin escribir",
+      "tag": "Etiqueta"
+    },
+    "edges": {
+      "mention": "Enlace",
+      "wiki": "Wikilink",
+      "suggested": "Sugerido",
+      "tag": "Etiqueta"
+    },
+    "linksTo": "Enlaza a",
+    "linkedFrom": "Enlazado desde",
+    "suggested": "Podría estar relacionado",
+    "promote": "Enlazar con {title}",
+    "lonely": "Aquí aún no hay conexiones. Menciónelo con @ o [[ desde otra nota.",
+    "open": "Abrir",
+    "createGhost": "Escribir esta nota",
+    "openTag": "Mostrar todo lo etiquetado",
+    "createFailed": "No se pudo crear esa nota",
+    "connectFailed": "No se pudieron enlazar esos dos",
+    "connected": "{source} enlazado con {target}",
+    "empty": "Su brain está tranquilo. Enlace notas y listas con @ o [[ y aparecerán aquí.",
+    "viewingOwner": "Viendo el brain de {owner}",
+    "summary": "{items} elementos, {links} enlaces, {shown} mostrados"
+  },
+  "apiExplorer": {
+    "title": "Explorador de API",
+    "intro": "Todos los endpoints que expone esta instancia (v{version}), generados a partir del código que los sirve. Elija uno, rellénelo y envíelo.",
+    "realData": "Las peticiones se ejecutan como el propietario de la clave API sobre datos reales. Un DELETE aquí borra de verdad.",
+    "apiKey": "Clave API",
+    "apiKeyHint": "Se guarda solo en esta página y se olvida al salir.",
+    "useMyKey": "Usar mi clave",
+    "noKeyYet": "Aún no tiene una clave API. Genere una en la configuración de su perfil.",
+    "filter": "Filtrar",
+    "filterPlaceholder": "Ruta, nombre o método",
+    "noMatches": "Nada coincide con ese filtro.",
+    "body": "Cuerpo de la petición (JSON)",
+    "showSchema": "Mostrar esquema",
+    "hideSchema": "Ocultar esquema",
+    "send": "Enviar",
+    "sending": "Enviando...",
+    "keyRequired": "Añada primero una clave API.",
+    "noKeyNeeded": "no necesita clave API",
+    "deprecated": "obsoleto",
+    "requestFailed": "La petición no llegó al servidor. Revise su conexión.",
+    "responseMeta": "{status} en {ms} ms"
   }
 }
diff --git a/app/_translations/fr.json b/app/_translations/fr.json
index 4d1f3dec6..e3673b29a 100644
--- a/app/_translations/fr.json
+++ b/app/_translations/fr.json
@@ -101,7 +101,7 @@
     "deleteFile": "Supprimer le fichier",
     "fileTooLarge": "Le fichier est trop volumineux. La taille maximale est de {maxSizeMB} Mo. Votre fichier fait {fileSizeMB} Mo.",
     "uploadFailed": "Échec du téléversement",
-    "uploadFailedRetry": "Le téléversement a échoué. Veuillez réessayer.",
+    "uploadFailedRetry": "Le téléversement a échoué. Réessayez.",
     "failedToDeleteFile": "Échec de la suppression du fichier",
     "previousMonth": "Mois précédent",
     "nextMonth": "Mois suivant",
@@ -127,13 +127,14 @@
     "expandAll": "Tout développer",
     "saveChanges": "Enregistrer les modifications",
     "all": "Tous",
+    "items": "Éléments",
     "showAll": "Tout afficher",
     "creating": "Création...",
     "createCategoryHeader": "Créer une nouvelle catégorie",
     "parentCategory": "Catégorie parente (optionnel)",
     "noParent": "Pas de parent (niveau racine)",
     "categoryNamePlaceholder": "Saisir le nom de la catégorie...",
-    "notAllowedName": "{name} n’est pas autorisé. Veuillez choisir un autre nom.",
+    "notAllowedName": "{name} n’est pas autorisé. Choisissez un autre nom.",
     "createCategory": "Créer une catégorie",
     "selectCategory": "Sélectionner une catégorie...",
     "categoryWillBeCreatedIn": "La nouvelle catégorie sera créée dans :",
@@ -170,9 +171,10 @@
     "dismiss": "Ignorer",
     "cleaning": "Nettoyage...",
     "noResultsFound": "Aucun résultat trouvé",
+    "noResults": "Aucun résultat",
     "by": "par {owner}",
     "unsavedChanges": "Modifications non enregistrées",
-    "unsavedChangesDetected": "⚠️ Modifications non enregistrées détectées",
+    "unsavedChangesDetected": "Modifications non enregistrées",
     "unsavedChangesMessage": "Vous avez des modifications non enregistrées dans {noteTitle}. Si vous quittez maintenant, vos modifications seront perdues.",
     "whatToDoWithUnsavedChanges": "Que souhaitez‑vous faire de vos modifications non enregistrées ?",
     "discard": "Ignorer",
@@ -237,45 +239,42 @@
     "openSearch": "Ouvrir la recherche",
     "closeSearch": "Fermer la recherche",
     "moreOptions": "Plus d'options",
-    "retry": "Réessayer",
+    "history": "Historique",
+    "disable": "Désactiver",
     "restoring": "Restauration...",
+    "retry": "Réessayer",
     "copiedToClipboard": "Copié dans le presse-papiers",
     "offline": "Hors ligne",
     "connected": "Connecté",
     "reconnecting": "Reconnexion...",
     "hide": "Masquer",
-    "disable": "Désactiver",
-    "history": "Historique",
-    "items": "Éléments",
-    "noResults": "Aucun résultat",
     "thisEntry": "cette entrée",
     "preview": "Aperçu"
   },
-  "comments": {
-    "title": "Commentaires",
-    "titleWithCount": "{count, plural, one {# Commentaire} other {# Commentaires}}",
-    "noComments": "Aucun commentaire pour l'instant. Lancez la conversation !",
-    "addComment": "Ajouter un commentaire...",
-    "replyPlaceholder": "Écrire une réponse...",
-    "post": "Publier",
-    "reply": "Répondre",
-    "edit": "Modifier",
-    "delete": "Supprimer",
-    "save": "Enregistrer",
-    "cancel": "Annuler",
-    "edited": "modifié",
-    "deleteConfirmTitle": "Supprimer le commentaire ?",
-    "deleteConfirmMessage": "Cela supprimera le commentaire et toutes les réponses. Cette action est irréversible.",
-    "commentDeleted": "Commentaire supprimé",
-    "commentAdded": "Commentaire ajouté",
-    "commentUpdated": "Commentaire mis à jour",
-    "failedToAdd": "Échec de l'ajout du commentaire",
-    "failedToEdit": "Échec de la modification du commentaire",
-    "failedToDelete": "Échec de la suppression du commentaire",
-    "failedToLoad": "Échec du chargement des commentaires",
-    "readOnly": "Vous avez besoin d'un accès en écriture pour commenter cette carte.",
-    "replyTo": "Répondre à {author}",
-    "noUsersFound": "Aucun utilisateur trouvé"
+  "history": {
+    "noteHistory": "Historique de la note",
+    "restore": "Restaurer",
+    "restoreVersion": "Restaurer la version",
+    "restoreConfirm": "Restaurer cette version ? \nLe contenu actuel sera remplacé.",
+    "noHistory": "Aucun historique disponible",
+    "noHistoryDescription": "Enregistrez votre note pour créer un point dans l'historique.",
+    "loadMore": "Charger plus",
+    "featureDisabled": "Historique désactivé",
+    "disabledAdmin": "L'historique des notes est désactivé. Vous pouvez l'activer dans Paramètres d'administration > Éditeur.",
+    "disabledUser": "L'historique des notes est désactivé. Demandez à votre administrateur de l'activer.",
+    "goToSettings": "Aller aux paramètres",
+    "manualSavesOnly": "Seules les sauvegardes manuelles créent un historique. La sauvegarde automatique, non.",
+    "fetchError": "Erreur lors du chargement de l'historique",
+    "restoreError": "Échec de la restauration de la version",
+    "viewContent": "Afficher le contenu",
+    "viewDiff": "Afficher les modifications",
+    "actionCreate": "Créé",
+    "actionUpdate": "Mis à jour",
+    "actionRename": "Renommé",
+    "actionMove": "Déplacé",
+    "actionDelete": "Supprimé",
+    "actionInit": "Initialisé",
+    "actionUnknown": "Modifié"
   },
   "auth": {
     "loginTitle": "Connexion",
@@ -296,7 +295,7 @@
     "sessionExpired": "Votre session a expiré",
     "setupComplete": "Configuration terminée",
     "createAccount": "Créez votre compte",
-    "errorOccurred": "Une erreur s’est produite. Veuillez réessayer.",
+    "errorOccurred": "Un problème est survenu. Réessayez.",
     "enterUsername": "Saisissez votre nom d’utilisateur",
     "enterPassword": "Saisissez votre mot de passe",
     "chooseUsername": "Choisissez un nom d’utilisateur",
@@ -309,8 +308,8 @@
     "version": "Version {version}",
     "createUser": "Créer un utilisateur",
     "attemptsRemaining": "Attention : {count, plural, one {# tentative} other {# tentatives}} restantes avant le verrouillage du compte",
-    "accountLocked": "Trop de tentatives échouées. Veuillez réessayer dans {seconds} {seconds, plural, one {seconde} other {secondes}}",
-    "notAuthorized": "Vous n’êtes pas autorisé à accéder à cette application. Contactez votre administrateur.",
+    "accountLocked": "Trop de tentatives échouées. Réessayez dans {seconds} {seconds, plural, one {seconde} other {secondes}}",
+    "notAuthorized": "Vous n’avez pas accès à cette application. Demandez à votre administrateur.",
     "rememberMe": "Se souvenir de moi"
   },
   "mfa": {
@@ -335,9 +334,9 @@
     "invalidCode": "Code d’authentification invalide",
     "invalidRecoveryCode": "Code de récupération invalide",
     "mfaRequired": "L’authentification à deux facteurs est requise",
-    "mfaEnabledSuccess": "Authentification à deux facteurs activée avec succès",
+    "mfaEnabledSuccess": "Authentification à deux facteurs activée",
     "mfaDisabledSuccess": "Authentification à deux facteurs désactivée",
-    "tooManyAttempts": "Trop de tentatives échouées. Veuillez réessayer plus tard.",
+    "tooManyAttempts": "Trop de tentatives échouées. Réessayez plus tard.",
     "disableTitle": "Désactiver l’authentification à deux facteurs",
     "disableDescription": "Saisissez votre code 2FA pour confirmer la désactivation de l’authentification à deux facteurs",
     "disableWarning": "Cela rendra votre compte moins sécurisé. Êtes‑vous sûr ?",
@@ -357,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Cela invalidera votre code de récupération actuel",
     "regenerateRecoveryCodeDescription": "Saisissez votre code 2FA pour générer un nouveau code de récupération. Votre ancien code ne fonctionnera plus.",
     "recoveryCodeRegenerated": "Nouveau code de récupération généré",
-    "recoveryCodeRegeneratedInfo": "Votre nouveau code de récupération a été généré. Enregistrez‑le dans un endroit sûr – c’est la seule fois où il sera affiché.",
-    "recoveryCodeRegeneratedSuccess": "Code de récupération régénéré avec succès",
+    "recoveryCodeRegeneratedInfo": "Votre nouveau code de récupération est prêt. Enregistrez‑le dans un endroit sûr, c’est la seule fois où il sera affiché.",
+    "recoveryCodeRegeneratedSuccess": "Code de récupération régénéré",
     "recoveryCodeProfileDescription": "Utilisez ce code pour la récupération de compte si vous perdez l’accès à votre application d’authentification",
     "disableMfaForUser": "Désactiver la 2FA pour cet utilisateur",
     "recoveryCodeRequired": "Le code de récupération est requis",
@@ -372,7 +371,7 @@
     "recent": "Récentes",
     "browseAndManage": "Parcourez et gérez toutes vos notes",
     "noNotesYet": "Aucune note pour le moment",
-    "createFirstNote": "Créez votre première note pour commencer votre base de connaissances.",
+    "createFirstNote": "Rien ici pour l’instant. Créez votre première note.",
     "createNewNote": "Créer une nouvelle note",
     "noNotesFound": "Aucune note trouvée",
     "tryAdjustingFilters": "Essayez de modifier vos filtres ou créez une nouvelle note.",
@@ -403,22 +402,26 @@
     "enterNoteTitle": "Saisir le titre de la note...",
     "byType": "Par type",
     "publiclySharedNote": "Partagée publiquement",
+    "sharedPubliclyBy": "Cette note est partagée publiquement par {owner}",
+    "copyRawContent": "Copier markdown",
     "quickSave": "Enregistrement rapide",
     "noteNotFound": "Note introuvable",
     "unarchiveNote": "Désarchiver la note",
     "enterNoteName": "Saisir le nom de la note...",
     "updateNote": "Mettre la note à jour",
-    "tags": "Tags",
-    "noTagsFound": "Aucun tag trouvé",
-    "searchTags": "Rechercher des tags...",
-    "copyRawContent": "Copier markdown",
     "printSaveAsPdf": "Imprimer / Enregistrer en PDF",
     "tableOfContents": "Table des matières",
     "wordCount": "{count, plural, one {# mot} other {# mots}}",
     "charCount": "{count, plural, one {# caractère} other {# caractères}}",
-    "readingTime": "{count, plural, one {# minute de lecture} other {# minutes de lecture}}"
+    "readingTime": "{count, plural, one {# minute de lecture} other {# minutes de lecture}}",
+    "tags": "Tags",
+    "noTagsFound": "Aucun tag trouvé",
+    "searchTags": "Rechercher des tags...",
+    "createNoteFailed": "Impossible de créer la note",
+    "createCategoryFailed": "Impossible de créer la catégorie, la note n’a pas été créée"
   },
   "checklists": {
+    "sharedPubliclyBy": "Cette liste est partagée publiquement par {owner}",
     "title": "Listes",
     "allChecklists": "Toutes les listes",
     "completed": "Terminées",
@@ -432,7 +435,7 @@
     "progress": "Progression",
     "totalItems": "Nombre total d’éléments",
     "noChecklistsYet": "Aucune Liste pour le moment",
-    "createFirstChecklist": "Créez votre première liste pour commencer à organiser vos tâches.",
+    "createFirstChecklist": "Rien ici pour l’instant. Créez votre première liste.",
     "newChecklist": "Nouvelle Liste",
     "noChecklistsFound": "Aucune Liste trouvée",
     "tryAdjustingFiltersChecklist": "Essayez de modifier vos filtres ou créez une nouvelle Liste.",
@@ -474,6 +477,7 @@
     "checklistType": "Type de liste",
     "simpleChecklist": "Liste simple",
     "taskProject": "Projet de tâches",
+    "kanbanBoard": "Tableau Kanban",
     "basicTodoItems": "Éléments de todo basiques",
     "withTimeTracking": "Avec suivi du temps",
     "noDescription": "Aucune description",
@@ -500,23 +504,24 @@
     "clearAllCompletedConfirmMessage": "Êtes-vous sûr de vouloir supprimer tous les {count} éléments terminés ? Cette action ne peut pas être annulée.",
     "clearAllIncompleteConfirmMessage": "Voulez-vous vraiment supprimer tous les {count} éléments incomplets et leurs enfants ? \nCette action ne peut pas être annulée.",
     "convertChecklistType": "Convertir le type de liste",
-    "convertTypeConfirmation": "Vous êtes sur le point de convertir de {currentType} à {newType}. Voulez-vous continuer?",
-    "dataLossWarning": "⚠️ Avertissement de perte de données",
+    "convertTypeConfirmation": "Convertir de {currentType} à {newType} ?",
+    "dataLossWarning": "Avertissement de perte de données",
     "dataLossWarningItems": "Les données suivantes seront perdues :",
     "allTaskStatusesReset": "Tous les statuts des tâches seront réinitialisés",
     "timeTrackingDataLost": "Les données de suivi du temps seront perdues",
     "estimatedTimesRemoved": "Les temps estimés seront supprimés",
     "targetDatesCleared": "Les dates cibles seront effacées",
-    "enhancedFeatures": "✨ Fonctionnalités améliorées",
+    "enhancedFeatures": "Ce que vous obtenez",
     "enhancedFeaturesYouWillGain": "Vous obtiendrez :",
     "kanbanBoardWithDragDrop": "Tableau Kanban avec glisser‑déposer",
     "taskStatusTracking": "Suivi des statuts de tâches (À faire, En cours, etc.)",
     "timeTrackingWithTimer": "Suivi du temps avec un minuteur intégré",
-    "actionCannotBeUndone": "Cette action est irréversible. Êtes‑vous sûr de vouloir convertir ?",
+    "actionCannotBeUndone": "C’est irréversible. Convertir quand même ?",
     "convertAndLoseData": "Convertir et perdre les données",
     "convert": "Convertir",
     "convertToSimpleChecklist": "Convertir en liste simple",
     "convertToTaskProject": "Convertir en projet de tâches",
+    "convertToKanbanBoard": "Convertir en tableau Kanban",
     "pasteYourList": "Collez votre liste (un élément par ligne)",
     "addItems": "Ajouter {count} éléments",
     "itemsWillBeAdded": "{count} éléments seront ajoutés",
@@ -525,11 +530,35 @@
     "noItemsYet": "Aucun élément pour le moment",
     "addFirstItem": "Ajoutez votre premier élément pour commencer !",
     "noTasks": "Aucune tâche",
-    "noSubtasksYet": "Aucune sous‑tâche pour le moment. Ajoutez‑en une ci‑dessous pour commencer.",
+    "noSubtasksYet": "Aucune sous‑tâche pour le moment. Ajoutez‑en une ci‑dessous.",
     "addTime": "Ajouter du Temps",
-    "enterTimeInMinutes": "Entrez votre temps en minutes",
-    "convertToKanbanBoard": "Convertir en tableau Kanban",
-    "kanbanBoard": "Tableau Kanban"
+    "enterTimeInMinutes": "Entrez votre temps en minutes"
+  },
+  "comments": {
+    "title": "Commentaires",
+    "titleWithCount": "{count, plural, one {# Commentaire} other {# Commentaires}}",
+    "noComments": "Aucun commentaire pour l'instant. Lancez la conversation !",
+    "addComment": "Ajouter un commentaire...",
+    "replyPlaceholder": "Écrire une réponse...",
+    "post": "Publier",
+    "reply": "Répondre",
+    "edit": "Modifier",
+    "delete": "Supprimer",
+    "save": "Enregistrer",
+    "cancel": "Annuler",
+    "edited": "modifié",
+    "deleteConfirmTitle": "Supprimer le commentaire ?",
+    "deleteConfirmMessage": "Cela supprimera le commentaire et toutes les réponses. Cette action est irréversible.",
+    "commentDeleted": "Commentaire supprimé",
+    "commentAdded": "Commentaire ajouté",
+    "commentUpdated": "Commentaire mis à jour",
+    "failedToAdd": "Échec de l'ajout du commentaire",
+    "failedToEdit": "Échec de la modification du commentaire",
+    "failedToDelete": "Échec de la suppression du commentaire",
+    "failedToLoad": "Échec du chargement des commentaires",
+    "readOnly": "Vous avez besoin d'un accès en écriture pour commenter cette carte.",
+    "replyTo": "Répondre à {author}",
+    "noUsersFound": "Aucun utilisateur trouvé"
   },
   "tasks": {
     "title": "Tâches",
@@ -558,7 +587,7 @@
     "overdue": "En retard",
     "browseAndManageTaskLists": "Parcourez et gérez toutes vos Listes",
     "noTaskListsYet": "Aucune Liste pour le moment",
-    "createFirstTaskList": "Créez votre première Liste pour commencer à gérer vos projets.",
+    "createFirstTaskList": "Rien ici pour l’instant. Créez votre première liste de tâches.",
     "newTaskList": "Nouvelle Liste",
     "taskLists": "Listes",
     "noTaskListsFound": "Aucune Liste trouvée",
@@ -606,7 +635,7 @@
     "changeStatus": "Changer le statut",
     "noBoards": "Aucun tableau trouvé",
     "noBoardsYet": "Pas encore de tableaux Kanban",
-    "createFirstBoard": "Créez votre premier tableau Kanban pour gérer vos projets.",
+    "createFirstBoard": "Rien ici pour l’instant. Créez votre premier tableau Kanban.",
     "newBoard": "Nouveau tableau",
     "tryAdjustingFilters": "Essayez d'ajuster vos filtres ou créez un nouveau tableau.",
     "completed": "Terminé",
@@ -659,7 +688,7 @@
     "quickSettingsHeader": "Réglages rapides (appareil uniquement)",
     "adminSettings": "Tableau de bord admin",
     "apiKey": "Clé API",
-    "apiKeyDescription": "Générez une clé API pour un accès programmatique à vos listes et notes",
+    "apiKeyDescription": "Générez une clé API pour que des scripts et des applications accèdent à vos listes et notes",
     "hideApiKey": "Masquer la clé API",
     "showApiKey": "Afficher la clé API",
     "copyApiKey": "Copier la clé API",
@@ -677,15 +706,15 @@
     "removeAvatar": "Supprimer l’avatar",
     "usernameRequired": "Le nom d’utilisateur est requis",
     "passwordsDoNotMatch": "Les nouveaux mots de passe ne correspondent pas",
-    "profileUpdated": "Profil mis à jour avec succès !",
+    "profileUpdated": "Profil mis à jour",
     "failedToUpdateProfile": "Échec de la mise à jour du profil",
-    "failedToUpdateProfileRetry": "Échec de la mise à jour du profil. Veuillez réessayer.",
-    "avatarUpdated": "Avatar mis à jour avec succès !",
+    "failedToUpdateProfileRetry": "Impossible de mettre à jour le profil. Réessayez.",
+    "avatarUpdated": "Avatar mis à jour",
     "failedToUpdateAvatar": "Échec de la mise à jour de l’avatar",
-    "failedToUpdateAvatarRetry": "Échec de la mise à jour de l’avatar. Veuillez réessayer.",
-    "avatarRemoved": "Avatar supprimé avec succès !",
+    "failedToUpdateAvatarRetry": "Impossible de mettre à jour l’avatar. Réessayez.",
+    "avatarRemoved": "Avatar supprimé",
     "failedToRemoveAvatar": "Échec de la suppression de l’avatar",
-    "failedToRemoveAvatarRetry": "Échec de la suppression de l’avatar. Veuillez réessayer.",
+    "failedToRemoveAvatarRetry": "Impossible de supprimer l’avatar. Réessayez.",
     "activeSessions": "Sessions actives",
     "activeSession": "{count} session active",
     "activeSession_plural": "{count} sessions actives",
@@ -703,11 +732,11 @@
     "auditLogsTab": "Journaux utilisateur",
     "rebuildLinkIndexes": "Reconstruire les index de liens pour mettre à jour les données de connexion",
     "rebuildingLinkIndex": "Reconstruction de l’index de liens...",
-    "successfullyRebuiltIndex": "Index de liens reconstruit avec succès",
-    "successfullyRebuiltIndexReload": "Index de liens reconstruit avec succès ! La page va se recharger pour afficher les connexions mises à jour.",
-    "failedToRebuildIndex": "Échec de la reconstruction de l’index de liens. Veuillez réessayer.",
+    "successfullyRebuiltIndex": "Index de liens reconstruit",
+    "successfullyRebuiltIndexReload": "Index de liens reconstruit. La page va se recharger pour afficher les nouvelles connexions.",
+    "failedToRebuildIndex": "Impossible de reconstruire l’index de liens. Réessayez.",
     "contentLinks": "Liens de contenu",
-    "visualizeRelationships": "Visualisez les relations entre vos notes et listes",
+    "visualizeRelationships": "Voyez comment vos notes et listes sont liées entre elles",
     "connectedItems": "Éléments connectés",
     "noLinksFound": "Aucun lien trouvé",
     "startCreatingInternalLinks": "Commencez à créer des liens internes en tapant « @ » dans vos notes pour voir le réseau relationnel ici.",
@@ -718,8 +747,8 @@
     "isolated": "isolé",
     "connection": "connexion",
     "connection_plural": "connexions",
-    "terminateSessionConfirm": "Êtes‑vous sûr de vouloir terminer cette session ?",
-    "terminateAllSessionsConfirm": "Êtes‑vous sûr de vouloir terminer toutes les autres sessions ?",
+    "terminateSessionConfirm": "Terminer cette session ?",
+    "terminateAllSessionsConfirm": "Terminer toutes les autres sessions ?",
     "validationErrorTitle": "Erreur de validation",
     "visibleGraphSummary": "{items} éléments visibles, {links} liens visibles",
     "graphTruncated": "Affichage des {visible} éléments les plus connectés. {omitted} éléments moins connectés ont été masqués.",
@@ -790,10 +819,10 @@
     "chooseAutoSaveInterval": "Choisissez l’intervalle d’enregistrement automatique de vos notes.",
     "defaultMode": "Mode par défaut",
     "selectNotesDefaultMode": "Sélectionner le mode par défaut des notes",
-    "chooseNotesDefaultMode": "Choisissez si la note est automatiquement en mode édition ou non {mode} bouton dans l’éditeur de note).",
+    "chooseNotesDefaultMode": "Choisissez si les notes s’ouvrent en mode édition. Vous pouvez toujours changer avec le bouton {mode} dans l’éditeur de note.",
     "defaultEditor": "Éditeur par défaut",
     "selectNotesDefaultEditor": "Sélectionner l’éditeur par défaut des notes",
-    "chooseDefaultEditor": "Choisissez l’éditeur par défaut pour vos notes – (vous pouvez toujours changer en cliquant sur le bouton {editor} dans l’éditeur de note).",
+    "chooseDefaultEditor": "Choisissez l’éditeur par défaut pour vos notes. Vous pouvez toujours changer avec le bouton {editor} dans l’éditeur de note.",
     "tableSyntaxInNotes": "Syntaxe de tableau dans les notes",
     "selectTableSyntax": "Sélectionner la syntaxe de tableau",
     "chooseTableSyntax": "Choisissez comment les tableaux sont rendus dans vos notes.",
@@ -802,7 +831,7 @@
     "chooseSyntaxTheme": "Choisissez le thème de coloration syntaxique pour l’éditeur Markdown.",
     "minimalMode": "Mode minimal (désactiver l’éditeur riche)",
     "selectMinimalMode": "Sélectionner le mode minimal",
-    "minimalModeDescription": "Lorsqu’il est activé, utilise un simple rendu Markdown au lieu de l’éditeur riche. Les fonctionnalités avancées comme les liens bilatéraux ne fonctionneront pas dans ce mode.",
+    "minimalModeDescription": "Utilise un simple rendu Markdown au lieu de l’éditeur riche. Les liens bilatéraux et les autres fonctionnalités avancées ne marchent pas dans ce mode.",
     "defaultNoteFilter": "Filtre de note par défaut",
     "selectDefaultNoteFilter": "Sélectionner le filtre de note par défaut",
     "chooseDefaultNoteFilter": "Choisissez le filtre par défaut à appliquer à l’ouverture de la page Notes.",
@@ -829,8 +858,8 @@
     "currentPassword": "Mot de passe actuel",
     "newPassword": "Nouveau mot de passe",
     "confirmPassword": "Confirmer le mot de passe",
-    "passwordChanged": "Mot de passe changé avec succès",
-    "settingsSaved": "Paramètres enregistrés avec succès",
+    "passwordChanged": "Mot de passe changé",
+    "settingsSaved": "Paramètres enregistrés",
     "dashCase": "Tirets (ex. : mon-nom-de-fichier.md)",
     "minimal": "Minimal (supprimer uniquement les caractères invalides)",
     "noRename": "Pas de renommage (conserver le nom de fichier d’origine)",
@@ -840,6 +869,7 @@
     "seconds_plural": "{count} secondes",
     "hours12": "12 heures",
     "hours24": "24 heures",
+    "useSystemDefault": "Utiliser les valeurs par défaut du système",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "Par défaut",
@@ -863,7 +893,7 @@
     "chooseQuickCreateNotes": "Choisissez le mode de création rapide des notes.",
     "quickCreateNotesShowModal": "Afficher une fenêtre lors de la création de notes",
     "quickCreateNotesSkipModal": "Passer la fenêtre et créer instantanément",
-    "quickCreateNotesDescription": "Lorsqu’il est activé, la création d’une nouvelle note passe la fenêtre de création et vous amène directement à l’éditeur.",
+    "quickCreateNotesDescription": "Passe la fenêtre de création de note et vous amène directement à l’éditeur.",
     "defaultCategory": "Catégorie par défaut pour la création rapide",
     "selectDefaultCategory": "Sélectionner la catégorie par défaut...",
     "defaultCategoryDescription": "Les nouvelles notes seront créées dans cette catégorie lors de l’utilisation de la création rapide.",
@@ -901,7 +931,7 @@
     "hideStatusOnCardsLabel": "Statut sur les cartes Kanban",
     "showStatusOnCards": "Afficher le statut",
     "hideStatusOnCards": "Masquer le statut",
-    "hideStatusOnCardsDescription": "Masque l'étiquette de statut sur les cartes Kanban. Le statut est déjà indiqué par la colonne dans laquelle se trouve la carte.",
+    "hideStatusOnCardsDescription": "Masque l'étiquette de statut sur les cartes Kanban. La colonne indique déjà le statut.",
     "hideMobileStatusDropdownLabel": "Menu déroulant de statut mobile sur les cartes",
     "showMobileStatusDropdown": "Afficher le menu mobile",
     "hideMobileStatusDropdown": "Masquer le menu mobile",
@@ -914,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "Masque le minuteur et les sessions enregistrées sur les cartes Kanban. Le suivi du temps reste disponible dans la vue détaillée de la carte.",
     "selectStatusOnCards": "Sélectionner la visibilité du statut",
     "codeBlockChoice": "Choisissez le style de bloc de code",
-    "themedCodeBlock": "Bloc de code thématique",
     "defaultCodeBlock": "Codepen (par défaut)",
+    "themedCodeBlock": "Bloc de code thématique",
     "codeBlockChoiceDescription": "Choisissez entre le style de bloc de code par défaut de type codepen ou un style de bloc de code thématique.",
     "checklistItemClickAction": "Action de clic sur un élément de la liste de contrôle",
     "selectChecklistItemClickAction": "Sélectionnez l'élément de la liste de contrôle, cliquez sur l'action",
-    "checklistItemClickActionDescription": "Choisissez ce qui se passe lorsque vous cliquez sur le texte d'une tâche. \n« Marquer comme terminé » coche la case (par défaut) ; \n« Modifier le nom de la tâche » ouvre la tâche pour une modification en ligne ; vous devrez toujours cliquer sur la case à cocher elle-même pour la terminer.",
+    "checklistItemClickActionDescription": "Choisissez ce qui se passe lorsque vous cliquez sur le texte d'une tâche. « Marquer comme terminé » (par défaut) coche la case. « Modifier le nom de la tâche » ouvre la tâche pour une modification en ligne, et vous cliquez sur la case elle-même pour la terminer.",
     "checklistItemClickActionToggle": "Marquer comme complet/incomplet",
     "checklistItemClickActionEdit": "Modifier un élément de liste",
     "newItemInsertion": "Insertion des nouveaux éléments",
@@ -927,7 +957,6 @@
     "newItemInsertionDescription": "Choisissez si les nouveaux éléments sont ajoutés en haut (par défaut) ou en bas d'une liste de contrôle.",
     "newItemInsertionTop": "Haut de la liste",
     "newItemInsertionBottom": "Bas de la liste",
-    "useSystemDefault": "Utiliser les valeurs par défaut du système",
     "selectShowChecklistEmojis": "Choisir la visibilité des émojis",
     "showChecklistEmojisDescription": "Affiche un émoji automatique à côté des éléments de liste selon leur texte."
   },
@@ -970,20 +999,24 @@
     "icon512": "Icône 512x512",
     "icon512Description": "Icône haute résolution pour les écrans de démarrage PWA.",
     "notifyNewUpdates": "M’avertir des nouvelles mises à jour",
-    "thisUsesGithubAPI": "Cela utilise l’API GitHub pour récupérer les mises à jour, désactiver coupe complètement l’API et empêche tout trafic entrant/sortant vers GitHub.",
+    "thisUsesGithubAPI": "Cela utilise l’API GitHub pour vérifier les mises à jour. La désactiver coupe tout trafic vers et depuis GitHub.",
     "parseContent": "Toujours afficher le contenu analysé",
-    "parseContentEnabledDescription": "Lorsqu’il est activé, ce paramètre affichera les titres analysés dans la barre latérale, les résultats de recherche et globalement dans l’application.",
-    "parseContentDisabledDescription": "Lorsqu’il est désactivé, les noms de fichiers originaux seront nettoyés, rendus lisibles et affichés à la place.",
-    "parseContentPerformanceWarning": "Mettre ceci sur « non » améliorera les performances sur de grands ensembles de données mais peut réduire la lisibilité – en particulier pour les noms de fichiers avec des caractères non latins.",
+    "parseContentEnabledDescription": "Affiche les titres analysés dans la barre latérale, dans les résultats de recherche et partout ailleurs dans l’application.",
+    "parseContentDisabledDescription": "Affiche à la place les noms de fichiers originaux, nettoyés pour être lisibles.",
+    "parseContentPerformanceWarning": "Mettre ceci sur « non » accélère les grandes instances mais rend les titres moins lisibles, en particulier les noms de fichiers avec des caractères non latins.",
     "hideLanguageSelector": "Masquer le Sélecteur de Langue dans l'En-tête",
     "hideLanguageSelectorDescription": "Afficher/masquer le menu déroulant de sélection de langue dans l'en-tête",
+    "defaultDateFormat": "Format de date par défaut",
+    "defaultDateFormatDescription": "Utilisé lorsque la préférence de format de date d'un utilisateur est définie sur « Utiliser les paramètres par défaut du système ».",
+    "defaultTimeFormat": "Format d'heure par défaut",
+    "defaultTimeFormatDescription": "Utilisé lorsque la préférence de format d'heure d'un utilisateur est définie sur « Utiliser les paramètres par défaut du système ».",
     "applicationIcons": "Icônes de l'application",
     "saveChanges": "Enregistrer les modifications",
     "unsavedChanges": "Vous avez des modifications non enregistrées.",
     "loadError": "Erreur de chargement",
     "couldNotFetchSettings": "Impossible de récupérer les paramètres.",
     "failedToLoadSettings": "Échec du chargement des paramètres",
-    "settingsSavedSuccessfully": "Paramètres enregistrés avec succès.",
+    "settingsSavedSuccessfully": "Paramètres enregistrés.",
     "failedToSaveSettings": "Échec de l’enregistrement des paramètres",
     "saveError": "Erreur d’enregistrement",
     "unknownErrorOccurred": "Une erreur inconnue s’est produite.",
@@ -996,7 +1029,7 @@
     "colorVariables": "Variables de couleur",
     "livePreview": "Aperçu en direct",
     "unsavedCssChanges": "Vous avez des modifications CSS non enregistrées.",
-    "noCustomThemesYet": "Aucun thème personnalisé créé pour le moment. Cliquez sur « Créer un thème » pour commencer.",
+    "noCustomThemesYet": "Aucun thème personnalisé pour le moment. Cliquez sur « Créer un thème » pour en créer un.",
     "myCustomTheme": "Mon thème personnalisé",
     "iconNameDescription": "nom de l’icône (ex. : PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "Version de l’application",
@@ -1026,25 +1059,31 @@
     "enableTableToolbarDescription": "Activer la barre d’outils qui apparaît lors de l’édition de tableaux",
     "bilateralLinks": "Liens bilatéraux",
     "bilateralLinksDescription": "Activer la possibilité de lier des notes et des listes dans le même document.",
+    "historyEnabled": "Historique des notes",
+    "historyDescription": "Conserve l’historique des versions des notes. Permet de restaurer des versions antérieures. Seules les sauvegardes manuelles créent des points d’historique (pas l’enregistrement automatique).",
+    "disableHistory": "Désactiver l’historique",
+    "disableHistoryWarning": "Désactiver l’historique supprimera définitivement toutes les versions enregistrées pour tous les utilisateurs. Action irréversible.",
+    "historyDisabled": "L’historique des notes a été désactivé et toutes les données d’historique ont été supprimées.",
+    "failedToDisableHistory": "Échec de la désactivation de l’historique",
     "configureExternalServices": "Configurer les URL de services externes pour les intégrations de l’éditeur.",
     "drawioUrl": "URL de Draw.io",
     "optional": "(Optionnel)",
-    "drawioUrlDescription": "Spécifiez l’URL d’une instance Draw.io personnalisée. Laissez vide pour utiliser l’instance publique par défaut (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Utilisez votre propre instance Draw.io. Laissez vide pour l’instance publique (https://embed.diagrams.net).",
     "drawioUrlExample": "Exemple pour l’auto‑hébergement : https://votre-domaine.com/drawio",
     "drawioProxyEnabled": "Proxy Draw.io via Jotty",
-    "drawioProxyEnabledDescription": "Activez ceci pour faire transiter le trafic Draw.io via le serveur de Jotty. Requis pour les URL de réseau Docker interne (ex. : http://drawio:8080) non accessibles depuis les navigateurs des utilisateurs.",
+    "drawioProxyEnabledDescription": "Fait transiter le trafic Draw.io par le serveur de Jotty. Nécessaire pour les URL de réseau Docker interne (ex. : http://drawio:8080) que les navigateurs des utilisateurs ne peuvent pas atteindre.",
     "excalidrawUrl": "URL d’Excalidraw",
-    "excalidrawUrlDescription": "Spécifiez l’URL d’une instance Excalidraw personnalisée. Laissez vide pour utiliser l’instance publique par défaut (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Utilisez votre propre instance Excalidraw. Laissez vide pour l’instance publique (https://excalidraw.com).",
     "excalidrawUrlExample": "Exemple pour l’auto‑hébergement : https://votre-domaine.com/excalidraw",
     "excalidrawProxyEnabled": "Proxy Excalidraw via Jotty",
-    "excalidrawProxyEnabledDescription": "Activez ceci pour faire transiter le trafic Excalidraw via le serveur de Jotty. Requis pour les URL de réseau Docker interne (ex. : http://excalidraw:3000) non accessibles depuis les navigateurs des utilisateurs.",
+    "excalidrawProxyEnabledDescription": "Fait transiter le trafic Excalidraw par le serveur de Jotty. Nécessaire pour les URL de réseau Docker interne (ex. : http://excalidraw:3000) que les navigateurs des utilisateurs ne peuvent pas atteindre.",
     "saving": "Enregistrement...",
-    "editorSettingsSaved": "Paramètres de l’éditeur enregistrés avec succès.",
+    "editorSettingsSaved": "Paramètres de l’éditeur enregistrés.",
     "customEmojis": "Émojis personnalisés",
-    "noEmojisYet": "Aucun émoji personnalisé pour le moment. Cliquez sur &quot;Ajouter un émoji&quot; pour commencer.",
-    "enterAnyEmoji": "Saisissez un émoji ou utilisez le sélecteur (Windows : Win+. ; Mac : Ctrl+Cmd+Espace",
+    "noEmojisYet": "Aucun émoji personnalisé pour le moment. Cliquez sur &quot;Ajouter un émoji&quot; pour en ajouter un.",
+    "enterAnyEmoji": "Saisissez un émoji ou utilisez le sélecteur (Windows : Win+. ; Mac : Ctrl+Cmd+Espace)",
     "sharingOverview": "Vue d’ensemble de l’activité de partage",
-    "detailedSharingBreakdown": "Détail des habitudes de partage et de l'engagement des utilisateurs",
+    "detailedSharingBreakdown": "Ce qui est partagé, et par qui",
     "checkForUpdates": "Vérifier les mises à jour",
     "checkingForUpdates": "Vérification des mises à jour...",
     "updateAvailable": "Mise à jour disponible !",
@@ -1059,12 +1098,12 @@
     "userContent": "{checklistsLength} listes • {notesLength} notes",
     "rebuildIndexes": "Reconstruire les index",
     "rebuilding": "Reconstruction...",
-    "successfullyRebuiltIndex": "Index de liens reconstruit avec succès pour {username}",
+    "successfullyRebuiltIndex": "Index de liens reconstruit pour {username}",
     "failedToRebuildIndex": "Échec de la reconstruction de l’index de liens pour {username}",
     "totalItems": "{items} éléments au total sur {userCount}",
     "privileges": "Privilèges admin",
     "adminContentAccess": "Accès admin au contenu",
-    "adminContentAccessDescription": "Contrôle si les administrateurs peuvent accéder à toutes les notes et listes des utilisateurs. Quand désactivé, les admins peuvent seulement gérer les utilisateurs et paramètres, mais ne peuvent pas voir le contenu des autres.",
+    "adminContentAccessDescription": "Permet aux administrateurs d’ouvrir les notes et listes de tous les utilisateurs. Désactivé, les admins peuvent gérer les utilisateurs et les paramètres, mais ne voient pas le contenu des autres.",
     "adminContentAccessYes": "Les admins peuvent accéder à tout le contenu",
     "adminContentAccessNo": "Les admins ne peuvent accéder qu’à leur propre contenu",
     "superAdminOnly": "Modifiable uniquement par le propriétaire du système",
@@ -1074,21 +1113,21 @@
     "confirmNewPassword": "Confirmer le nouveau mot de passe",
     "dataExport": "Export de données",
     "dataExportOptions": "Options d’export de données",
-    "selectExportType": "Sélectionnez un type d’export pour télécharger les données de votre application.",
+    "selectExportType": "Choisissez un type d’export et téléchargez les données.",
     "allChecklistsAndNotes": "Toutes les listes et notes",
-    "allChecklistsAndNotesDescription": "Exporte toutes les listes et notes créées par tous les utilisateurs. Génère un fichier zip contenant des données JSON organisées par utilisateur et catégorie.",
+    "allChecklistsAndNotesDescription": "Exporte les listes et notes de tous les utilisateurs sous forme de zip de fichiers JSON, regroupés par utilisateur et catégorie.",
     "userChecklistsNotes": "Listes et notes d’un utilisateur spécifique",
-    "userChecklistsNotesDescription": "Sélectionnez un utilisateur dans la liste pour exporter toutes ses listes et notes.",
+    "userChecklistsNotesDescription": "Choisissez un utilisateur dans la liste pour exporter toutes ses listes et notes.",
     "allUsersData": "Toutes les données de comptes utilisateurs",
     "allUsersDataDescription": "Exporte un fichier JSON avec toutes les informations de compte utilisateur (noms, statut admin, etc.). N’inclut PAS le contenu de leurs listes/notes.",
     "wholeDataFolder": "Dossier de données complet (sauvegarde)",
-    "wholeDataFolderDescription": "Exporte l’intégralité du dossier « data », incluant tout le contenu, métadonnées et paramètres. À utiliser avec précaution car le fichier peut être volumineux.",
+    "wholeDataFolderDescription": "Exporte l’intégralité du dossier « data », avec tout le contenu, les métadonnées et les paramètres. Le fichier peut être volumineux.",
     "noSharingPermissionsLabel": "Certains éléments partagés sont cachés en fonction de vos permissions d’accès au contenu.",
     "contentHidden": "Détails de contenu masqués",
     "viewOnlySettingsNotice": "Seul le propriétaire du système peut modifier ces paramètres.",
     "auditLogContentRedacted": "[Contenu masqué]",
     "maxLogAgeDays": "Durée maximale de rétention des journaux (jours)",
-    "maxLogAgeDaysDescription": "Définissez la durée de conservation des journaux d’audit. Sur la page des journaux, un message vous proposera de nettoyer les journaux plus anciens que ce seuil. Mettez 0 pour une rétention illimitée (aucun nettoyage automatique).",
+    "maxLogAgeDaysDescription": "Durée de conservation des journaux d’audit. La page des journaux propose de nettoyer tout ce qui est plus ancien. Mettez 0 pour tout garder indéfiniment et ne jamais voir la proposition.",
     "appPreferences": "Préférences de l’application",
     "editEmoji": "Modifier l’émoji",
     "addEmoji": "Ajouter un émoji",
@@ -1107,16 +1146,6 @@
     "updateTagsTitle": "Analyser les notes pour les hashtags et mettre à jour le frontmatter",
     "tagsUpdated": "{processed} fichiers traités, {updated} mis à jour avec de nouveaux tags",
     "failedToUpdateTags": "Échec de la mise à jour des tags",
-    "historyEnabled": "Historique des notes",
-    "historyDescription": "Conserve l’historique des versions des notes. Permet de restaurer des versions antérieures. Seules les sauvegardes manuelles créent des points d’historique (pas l’enregistrement automatique).",
-    "disableHistory": "Désactiver l’historique",
-    "disableHistoryWarning": "Désactiver l’historique supprimera définitivement toutes les versions enregistrées pour tous les utilisateurs. Action irréversible.",
-    "historyDisabled": "L’historique des notes a été désactivé et toutes les données d’historique ont été supprimées.",
-    "failedToDisableHistory": "Échec de la désactivation de l’historique",
-    "defaultDateFormat": "Format de date par défaut",
-    "defaultDateFormatDescription": "Utilisé lorsque la préférence de format de date d'un utilisateur est définie sur « Utiliser les paramètres par défaut du système ».",
-    "defaultTimeFormatDescription": "Utilisé lorsque la préférence de format d'heure d'un utilisateur est définie sur « Utiliser les paramètres par défaut du système ».",
-    "defaultTimeFormat": "Format d'heure par défaut",
     "borderRadius": "Rayon des bords",
     "borderRadiusDescription": "Définit l'arrondi des coins pour toute l'instance. Les utilisateurs peuvent le remplacer dans les réglages rapides.",
     "borderRadiusSaved": "Rayon des bords enregistré",
@@ -1132,6 +1161,9 @@
     "tryAgain": "Réessayer",
     "contactSupport": "Contacter le support",
     "invalidInput": "Entrée invalide",
+    "invalidEditorSettings": "Les paramètres de l’éditeur doivent être un objet, rien n’a été enregistré",
+    "invalidEditorSetting": "Le paramètre d’éditeur {field} n’a pas le bon type, rien n’a été enregistré",
+    "categoryOutOfBounds": "Cette catégorie se trouve en dehors de vos notes, rien n’a donc été créé",
     "requiredField": "Ce champ est requis",
     "emailInvalid": "Veuillez saisir un e‑mail valide",
     "passwordTooShort": "Le mot de passe doit contenir au moins 8 caractères",
@@ -1139,43 +1171,44 @@
     "networkError": "Erreur réseau",
     "timeout": "Délai d’attente dépassé",
     "permissionDenied": "Permission refusée",
-    "requiredPermissions": "Vous n'avez pas les permissions requises pour effectuer cette action.",
+    "requiredPermissions": "Vous n'avez pas la permission de faire cela.",
     "loadError": "Erreur de chargement",
     "failedToLoadCustomEmojis": "Échec du chargement des émojis personnalisés",
-    "emojiDeletedSuccessfully": "Émoji supprimé avec succès",
+    "emojiDeletedSuccessfully": "Émoji supprimé",
     "deleteError": "Erreur de suppression",
     "failedToDeleteEmoji": "Échec de la suppression de l’émoji",
     "validationError": "Erreur de validation",
     "keywordAndEmojiRequired": "Le mot‑clé et l’émoji sont requis",
     "duplicateKeyword": "Mot‑clé en double",
     "keywordAlreadyExists": "Le mot‑clé existe déjà",
-    "emojiUpdatedSuccessfully": "Émoji mis à jour avec succès",
-    "emojiCreatedSuccessfully": "Émoji créé avec succès",
+    "emojiUpdatedSuccessfully": "Émoji mis à jour",
+    "emojiCreatedSuccessfully": "Émoji créé",
     "saveError": "Erreur d’enregistrement",
     "failedToSaveEmoji": "Échec de l’enregistrement de l’émoji",
     "failedToLoadCustomCSS": "Échec du chargement du CSS personnalisé",
     "couldNotLoadCustomCSS": "Impossible de charger le CSS personnalisé.",
     "couldNotLoadThemes": "Impossible de charger les thèmes.",
-    "customCSSSavedSuccessfully": "CSS personnalisé enregistré avec succès.",
+    "customCSSSavedSuccessfully": "CSS personnalisé enregistré.",
     "themeNotFound": "Thème introuvable.",
-    "themeDeletedSuccessfully": "Thème supprimé avec succès.",
+    "themeDeletedSuccessfully": "Thème supprimé.",
     "themeNameRequired": "Le nom du thème est requis.",
-    "themeSavedSuccessfully": "Thème {action} avec succès.",
+    "themeSavedSuccessfully": "Thème {action}.",
     "anUnknownErrorOccurred": "Une erreur inconnue s’est produite.",
     "usernameRequired": "Le nom d’utilisateur est requis",
     "passwordRequired": "Le mot de passe est requis",
     "passwordMinLength": "Le mot de passe doit contenir au moins 6 caractères",
     "passwordsDoNotMatch": "Les mots de passe ne correspondent pas",
-    "userSavedSuccessfully": "Utilisateur {mode} avec succès !",
+    "userSavedSuccessfully": "Utilisateur {mode}.",
     "failedToSaveUser": "Échec de {mode} l’utilisateur",
     "anErrorOccurred": "Une erreur s’est produite.",
     "deleteUserConfirmation": "Supprimer l’utilisateur « {username} » ? Cette action est irréversible.",
-    "userDeletedSuccessfully": "Utilisateur supprimé avec succès !",
-    "failedToDeleteUser": "Échec de la suppression de l’utilisateur"
+    "userDeletedSuccessfully": "Utilisateur supprimé.",
+    "failedToDeleteUser": "Échec de la suppression de l’utilisateur",
+    "readOnlyFolder": "Ce dossier est en lecture seule sur le serveur, la modification n’a donc pas pu être enregistrée."
   },
   "pwa": {
     "installPromptTitle": "Installer l’application",
-    "installPromptMessage": "Installez cette application sur votre appareil pour une meilleure expérience",
+    "installPromptMessage": "Installez Jotty sur votre appareil pour l’ouvrir comme une application",
     "installButton": "Installer",
     "updateAvailable": "Mise à jour disponible",
     "updateMessage": "Une nouvelle version est disponible",
@@ -1233,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Basculer en mode éditeur riche",
     "toggleMarkdownMode": "Basculer en mode Markdown",
+    "quickControls": "Contrôles de l’éditeur",
     "toggleBold": "Basculer en gras",
     "toggleItalic": "Basculer en italique",
     "toggleUnderline": "Basculer le soulignement",
@@ -1322,15 +1356,15 @@
     "drawioDescription": "Éditeur de diagrammes visuels",
     "excalidrawDescription": "Éditeur de diagrammes style croquis",
     "noLanguagesFound": "Aucun langage trouvé",
-    "ruler": "Règle",
-    "lineNumbers": "Numéros de ligne",
     "callout": "Encadré",
     "createCallout": "Créer un encadré",
     "changeCalloutType": "Modifier le type d’encadré",
     "calloutInfo": "Info",
     "calloutWarning": "Avertissement",
     "calloutSuccess": "Succès",
-    "calloutDanger": "Danger"
+    "calloutDanger": "Danger",
+    "ruler": "Règle",
+    "lineNumbers": "Numéros de ligne"
   },
   "sharing": {
     "share": "Partager",
@@ -1406,16 +1440,16 @@
     "viewNote": "Voir la note",
     "editNote": "Modifier la note",
     "privateKeyWarning": "AVERTISSEMENT : Votre clé privée permet le déchiffrement de toutes les notes chiffrées. Exportez‑la uniquement si vous comprenez les implications de sécurité. Continuer ?",
-    "publicKeyExported": "Clé publique exportée avec succès",
-    "privateKeyExported": "Clé privée exportée avec succès",
+    "publicKeyExported": "Clé publique exportée",
+    "privateKeyExported": "Clé privée exportée",
     "failedToExportKey": "Échec de l’export de la clé",
     "unexpectedError": "Une erreur inattendue s’est produite",
-    "keysDeleted": "Clés supprimées avec succès",
+    "keysDeleted": "Clés supprimées",
     "failedToDeleteKeys": "Échec de la suppression des clés",
     "autoDecryptUpdated": "Paramètre de déchiffrement automatique mis à jour",
     "failedToUpdateSetting": "Échec de la mise à jour du paramètre",
-    "enterValidPath": "Veuillez saisir un chemin valide",
-    "customPathSet": "Chemin personnalisé pour les clés défini avec succès",
+    "enterValidPath": "Saisissez un chemin valide",
+    "customPathSet": "Chemin personnalisé pour les clés défini",
     "failedToSetCustomPath": "Échec de la définition du chemin personnalisé",
     "thisNoteIsEncrypted": "Cette note est chiffrée",
     "noteProtectedWith": "Cette note est protégée avec un chiffrement {type}.",
@@ -1426,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Sélectionner une méthode de chiffrement",
     "encryptionMethodsTitle": "Méthodes de chiffrement",
-    "xchachaDescription": "XChaCha20-Poly1305 : chiffrement moderne, rapide, basé sur une phrase secrète",
-    "pgpDescription": "PGP : cryptographie classique à clé publique avec gestion de paires de clés",
+    "xchachaDescription": "XChaCha20-Poly1305 : chiffrement avec une phrase secrète",
+    "pgpDescription": "PGP : chiffrement à clé publique avec une paire de clés que vous gérez",
     "encryptionKeys": "Clés de chiffrement",
     "keysConfigured": "Clés configurées",
     "algorithm": "Algorithme : ",
@@ -1441,9 +1475,9 @@
     "keysDisabledInDemo": "Les clés de chiffrement stockées sont désactivées en mode démo.",
     "encryptionSettings": "Paramètres de chiffrement",
     "promptForPassphrase": "Demander la phrase de passe à l’ouverture des notes chiffrées",
-    "promptForPassphraseDescription": "Si activé, une demande de phrase de passe apparaîtra à l’ouverture d’une note chiffrée. La note restera chiffrée sur le serveur, mais son contenu sera visible dans l’onglet courant.",
+    "promptForPassphraseDescription": "Demande votre phrase secrète à l’ouverture d’une note chiffrée. La note reste chiffrée sur le serveur et le contenu déchiffré n’est visible que dans cet onglet.",
     "customKeyPath": "Chemin personnalisé des clés (installations locales)",
-    "customKeyPathDescription": "Spécifiez un chemin absolu pour stocker les clés de chiffrement. Nécessaire uniquement pour les installations locales. Les utilisateurs Docker doivent mapper le chemin par défaut dans docker-compose.yml.",
+    "customKeyPathDescription": "Un chemin absolu pour stocker vos clés de chiffrement. Seules les installations locales en ont besoin. Les utilisateurs Docker doivent plutôt mapper le chemin par défaut dans docker-compose.yml.",
     "customPath": "Chemin personnalisé",
     "customPathPlaceholder": "/home/user/mes-cles",
     "customPathHelp": "Doit être un chemin absolu (ex. : /home/user/mes-cles ou C:\\Users\\user\\mes-cles)",
@@ -1462,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "Le contenu de la note sera chiffré avant l’enregistrement",
     "passphraseRequired": "La phrase de passe est requise",
     "incorrectPassphrase": "Phrase de passe incorrecte",
-    "noteEncryptedSuccessfully": "Note chiffrée avec succès",
+    "noteEncryptedSuccessfully": "Note chiffrée",
     "failedToEncryptNote": "Échec du chiffrement de la note",
-    "noteDecryptedSuccessfully": "Note déchiffrée avec succès",
+    "noteDecryptedSuccessfully": "Note déchiffrée",
     "failedToDecryptNote": "Échec du déchiffrement de la note",
     "passphrase": "Phrase de passe",
     "enterYourPassphrase": "Saisissez votre phrase de passe",
@@ -1492,8 +1526,8 @@
     "privateKey": "Clé privée",
     "noStoredKeysFound": "Aucune clé stockée trouvée",
     "noEncryptionKeysConfigured": "Vous n’avez configuré aucune clé de chiffrement",
-    "pastePublicKeyBelow": "Veuillez coller une clé publique ci‑dessous pour chiffrer le contenu de la note",
-    "generateOrImportKeysInProfile": "Vous pouvez générer ou importer des clés spécifiques pour Jotty dans Profil → Chiffrement",
+    "pastePublicKeyBelow": "Collez une clé publique ci‑dessous pour chiffrer le contenu de la note",
+    "generateOrImportKeysInProfile": "Vous pouvez générer ou importer des clés pour Jotty dans Profil > Chiffrement",
     "useCustomKey": "Utiliser une clé {keyType} personnalisée",
     "signWithPrivateKey": "Signer avec la clé privée",
     "proveAuthenticityOfNote": "prouver l’authenticité de cette note",
@@ -1513,7 +1547,7 @@
     "yourEmail": "votre@email.com",
     "generating": "Génération...",
     "generateKeys": "Générer les clés",
-    "keysGeneratedSuccessfully": "Clés générées avec succès",
+    "keysGeneratedSuccessfully": "Clés générées",
     "importPGPKeys": "Importer des clés PGP",
     "publicKeyLabel": "Clé publique",
     "privateKeyLabel": "Clé privée",
@@ -1522,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Retenez bien votre phrase de passe ! Elle ne peut pas être récupérée.",
     "withoutPassphraseCannotDecrypt": "Sans la phrase de passe, vous ne pourrez pas déchiffrer vos notes.",
     "backupPrivateKeySafely": "Sauvegardez votre clé privée en lieu sûr.",
-    "pgpKeyPairGeneratedSuccessfully": "Paire de clés PGP générée avec succès",
+    "pgpKeyPairGeneratedSuccessfully": "Paire de clés PGP générée",
     "failedToGenerateKeys": "Échec de la génération des clés",
     "fingerprint": "Empreinte",
     "keysSavedSecurely": "Vos clés ont été enregistrées en toute sécurité.",
@@ -1536,13 +1570,13 @@
     "bothKeysRequired": "La clé publique et la clé privée sont toutes deux requises",
     "invalidPublicKeyFormat": "Format de clé publique invalide. Doit être une clé PGP ASCII armored.",
     "invalidPrivateKeyFormat": "Format de clé privée invalide. Doit être une clé PGP ASCII armored.",
-    "keysImportedSuccessfully": "Clés importées avec succès",
+    "keysImportedSuccessfully": "Clés importées",
     "failedToImportKeys": "Échec de l’import des clés",
     "created": "Chiffrement créé",
     "notePlaceholder": "Je suis un espace réservé car vous ne pouvez pas chiffrer une note vide."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Ces options ne s’appliquent qu’à la session du navigateur actuelle. Pour des paramètres permanents, veuillez consulter vos",
+    "sessionOnlyPrefix": "Ces options ne s’appliquent qu’à cette session du navigateur. Pour des paramètres permanents, consultez vos",
     "accountSettings": "préférences utilisateur",
     "autosaveNotes": "Enregistrement automatique des notes",
     "showNotePreview": "Afficher un aperçu de la note sur les cartes",
@@ -1571,20 +1605,45 @@
     "migrationSuccessful": "Migration réussie",
     "returnToApp": "Retourner à l’application",
     "adminAccessRequired": "Accès administrateur requis",
-    "adminAccessDescription": "Cette migration nécessite des privilèges administrateur. Veuillez contacter un administrateur pour effectuer la migration du système.",
+    "adminAccessDescription": "Cette migration nécessite un administrateur. Demandez à l’un d’eux de la lancer.",
     "whatsHappening": "Que se passe‑t‑il ?",
-    "sharingDataMigrationDescription": "Le système doit migrer vos données de partage. Il s’agit d’un processus unique nécessitant un accès administrateur.",
+    "sharingDataMigrationDescription": "Jotty doit migrer vos données de partage. Cela ne se fait qu’une fois et nécessite un administrateur.",
     "whatsChanging": "Qu’est‑ce qui change ?",
     "automaticBackupIncluded": "Sauvegarde automatique incluse",
     "yamlFrontmatterIndustryStandard": "Le frontmatter YAML est le standard de l’industrie",
-    "noMigrationNeeded": "Aucune migration nécessaire – votre système est déjà à jour.",
-    "importantBackupData": "Important : sauvegardez vos données"
+    "noMigrationNeeded": "Rien à migrer, vos données sont déjà à jour.",
+    "importantBackupData": "Important : sauvegardez vos données",
+    "sharingNowWithData": "Vos données de partage vivent désormais avec vos notes et dossiers.",
+    "sharingMovesDescription": "Le partage quitte un fichier central pour rejoindre vos données. Les dossiers peuvent maintenant être partagés, et les dossiers partagés apparaissent dans votre propre barre latérale au lieu d’une section à part.",
+    "whatsHappeningBody": "Chaque partage de <code>.sharing.json</code> est écrit dans le frontmatter de l’élément concerné, et chaque dossier reçoit un <code>.category-info.json</code> contenant son identité, son partage et son ordre. Les anciens fichiers sont supprimés une fois les données déplacées.",
+    "migrationChanges": "Changements de la migration",
+    "sharingTravelsTitle": "Le partage suit le fichier",
+    "sharingTravelsBody": "Chaque élément partagé enregistre avec qui il est partagé dans son propre frontmatter, donc le déplacer ou le renommer ne casse jamais un partage.",
+    "folderSharingTitle": "Partage de dossiers",
+    "folderSharingBody": "Partagez un dossier et tout ce qu’il contient, maintenant et à l’avenir, est partagé aussi. Les destinataires le voient comme un dossier normal dans leur propre barre latérale.",
+    "oneFilePerFolderTitle": "Un fichier par dossier",
+    "oneFilePerFolderBody": "<code>.order.json</code> est intégré à <code>.category-info.json</code>, avec un ordre basé sur l’uuid plutôt que sur le nom de fichier.",
+    "permissionsUnchangedTitle": "Les permissions ne changent pas",
+    "permissionsUnchangedBody": "Lecture, modification et suppression sont reprises exactement comme aujourd’hui, par utilisateur et par élément.",
+    "backupWarningBody": "Cette migration réécrit le frontmatter de vos notes et listes et supprime les anciens fichiers <code>.sharing.json</code> et <code>.order.json</code>. Sauvegardez votre dossier <code>data</code> avant de continuer.",
+    "backupConfirmLabel": "J’ai sauvegardé mon dossier data et je comprends le processus de migration.",
+    "backupConfirmHint": "Confirmez que vous avez une sauvegarde avant de continuer.",
+    "sharingDataMigrated": "Vos données de partage et d’ordre ont été migrées.",
+    "whatWasChanged": "Ce qui a changé :",
+    "migrationPartial": "Migration terminée avec des restes",
+    "leftoversTitle": "Certains anciens fichiers ont été conservés",
+    "leftoversBody": "La migration n’a pas pu tout convertir, les anciens fichiers ci‑dessous sont donc restés intacts sur le disque. Rien n’a été supprimé. Vous pouvez corriger la cause et relancer la migration, ou entrer dans l’application maintenant et vous en occuper plus tard.",
+    "overrideConfirmLabel": "Continuer quand même et ne plus afficher cette page.",
+    "overrideConfirmHint": "Les fichiers restants restent sur le disque, mais l’application considérera vos données comme migrées. Le partage ou l’ordre listés ci‑dessus ne seront pas appliqués tant que vous n’aurez pas relancé la migration, ce que vous pouvez faire à tout moment depuis /migration?force=1.",
+    "continueAnyway": "Continuer quand même",
+    "overriding": "Poursuite...",
+    "overrideFailed": "Impossible de passer la migration"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Catégorie renommée avec succès",
+    "categoryRenamedSuccessfully": "Catégorie renommée",
     "failedToRenameCategory": "Échec du renommage de la catégorie",
     "categoryRenamedSuccessfullyMessage": "Catégorie {categoryName} renommée en {newName}",
-    "failedToRenameCategoryMessage": "Une erreur s’est produite lors du renommage de la catégorie."
+    "failedToRenameCategoryMessage": "Un problème est survenu lors du renommage de la catégorie."
   },
   "auditLogs": {
     "title": "Journaux d’audit",
@@ -1601,17 +1660,17 @@
     "exportJSON": "Exporter en JSON",
     "exportCSV": "Exporter en CSV",
     "cleanupOldLogs": "Nettoyer les anciens journaux",
-    "confirmCleanup": "Êtes‑vous sûr de vouloir supprimer les journaux plus anciens que {days} jours ? Cela affectera TOUS les utilisateurs et est irréversible.",
+    "confirmCleanup": "Supprimer les journaux de plus de {days} jours ? Cela affecte TOUS les utilisateurs et est irréversible.",
     "confirmCleanupUnlimited": "Aucun nettoyage automatique n’est configuré (rétention illimitée). Vous pouvez toujours supprimer manuellement les anciens journaux si nécessaire.",
     "deleteAllLogsModalTitle": "Supprimer tous les journaux d’audit",
     "deleteAllLogsWarning": "Cela supprimera TOUS les journaux, pas seulement les anciens",
     "deleteAllLogsWarningDescription": "L’historique complet des journaux d’audit sera effacé du système.",
     "deletingAllLogs": "Suppression de tous les journaux...",
     "deleteAllLogsButton": "Supprimer tous les journaux",
-    "cleanupSuccess": "Suppression réussie de {count} anciens fichiers de journal",
+    "cleanupSuccess": "{count} anciens fichiers de journal supprimés",
     "cleanupError": "Échec du nettoyage des anciens journaux",
-    "userDescription": "Voir toute votre activité et vos actions dans le système",
-    "adminDescription": "Voir et gérer l’activité de tous les utilisateurs dans le système",
+    "userDescription": "Tout ce que vous avez fait dans Jotty",
+    "adminDescription": "Ce que chaque utilisateur a fait sur cette instance",
     "level": "Niveau",
     "allLevels": "Tous les niveaux",
     "allCategories": "Toutes les catégories",
@@ -1675,9 +1734,9 @@
     "topActions": "Actions les plus fréquentes",
     "mostActiveUsers": "Utilisateurs les plus actifs",
     "oldLogsFound": "Il y a {count} fichiers de journal plus anciens que {days} jours.",
-    "oldLogsFoundDescription": "Souhaitez‑vous les nettoyer ? Cette action est irréversible.",
+    "oldLogsFoundDescription": "Les nettoyer ? C’est irréversible.",
     "cleanUpNow": "Nettoyer maintenant",
-    "cleanupSuccessMessage": "Suppression réussie de {count} anciens fichiers de journal.",
+    "cleanupSuccessMessage": "{count} anciens fichiers de journal supprimés.",
     "security": "Sécurité",
     "mfasecretgenerated": "Secret MFA généré",
     "mfaenabled": "MFA activée",
@@ -1693,6 +1752,7 @@
     "howTo": "Comment faire",
     "shortcuts": "Raccourcis",
     "markdownGuide": "Guide Markdown",
+    "brain": "Liens et Brain",
     "customisations": "Personnalisations",
     "docker": "Docker",
     "envVariables": "Variables d’environnement",
@@ -1700,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "Chiffrement",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Traductions",
     "unraid": "Unraid",
     "patches": "Correctifs"
@@ -1711,33 +1772,9 @@
     "seenCount": "Vous avez vu {count} {count, plural, one {haiku} other {haikus}}",
     "imNoPoet": "Je ne suis pas poète, et Jotty non plus. Ce sont des mots aléatoires en séquence."
   },
-  "history": {
-    "fetchError": "Erreur lors du chargement de l'historique",
-    "restoreError": "Échec de la restauration de la version",
-    "manualSavesOnly": "L'historique est créé uniquement lors des sauvegardes manuelles, et non lors des sauvegardes automatiques.",
-    "noHistory": "Aucun historique disponible",
-    "noHistoryDescription": "Enregistrez votre note pour créer un point dans l'historique.",
-    "restore": "Restaurer",
-    "loadMore": "Charger plus",
-    "viewContent": "Afficher le contenu",
-    "viewDiff": "Afficher les modifications",
-    "noteHistory": "Historique de la note",
-    "restoreVersion": "Restaurer la version",
-    "restoreConfirm": "Restaurer cette version ? \nLe contenu actuel sera remplacé.",
-    "featureDisabled": "Historique désactivé",
-    "disabledAdmin": "L'historique des notes est actuellement désactivé. Vous pouvez l'activer dans les Paramètres d'administration > Éditeur.",
-    "disabledUser": "L'historique des notes est actuellement désactivé. Veuillez contacter votre administrateur pour activer cette fonctionnalité.",
-    "goToSettings": "Aller aux paramètres",
-    "actionCreate": "Créé",
-    "actionUpdate": "Mis à jour",
-    "actionRename": "Renommé",
-    "actionMove": "Déplacé",
-    "actionDelete": "Supprimé",
-    "actionInit": "Initialisé",
-    "actionUnknown": "Modifié"
-  },
   "notifications": {
     "title": "Notifications",
+    "unread": "non lu(s)",
     "markAllRead": "Marquer tout comme lu",
     "clearAll": "Tout effacer",
     "empty": "Aucune notification",
@@ -1745,12 +1782,99 @@
     "assignmentMessage": "\"{task}\" dans \"{board}\"",
     "reminderTitle": "Tâche en retard",
     "reminderMessage": "\"{task}\" dans \"{board}\" a dépassé son rappel",
-    "unread": "non lu(s)",
     "sharingTitle": "{user} a partagé un {type} avec vous",
     "sharingMessage": "Ouvrez pour voir le {type} partagé",
     "sharingFolderTitle": "{user} a partagé un dossier {type} avec vous",
     "sharingFolderMessage": "Ouvrez pour voir « {folder} »",
     "mentionTitle": "{user} vous a mentionné dans un commentaire",
     "mentionMessage": "« {board} »"
+  },
+  "relations": {
+    "indexing": "Indexation des relations...",
+    "unreachable": "inaccessible",
+    "createFromWikilink": "Créer une note nommée « {title} »",
+    "mentionedIn": "Mentionné dans",
+    "mentionedInHint": "Ces notes utilisent ce titre en texte brut. Liez‑en une pour la connecter.",
+    "linkMention": "Lier",
+    "linked": "Mention liée dans {title}",
+    "linkFailed": "Impossible de lier cette mention",
+    "kind": {
+      "mention": "Lien",
+      "wiki": "Wikilien"
+    }
+  },
+  "brain": {
+    "title": "Brain",
+    "openBrain": "Ouvrir dans le brain",
+    "search": "Cherchez quelque chose dans votre brain...",
+    "dimension": "Vue",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Autour de cet élément",
+    "global": "Tout",
+    "depth": "Profondeur {depth}",
+    "colourBy": "Colorer par",
+    "colourModes": {
+      "type": "Type",
+      "category": "Catégorie"
+    },
+    "filters": {
+      "notes": "Notes",
+      "checklists": "Listes",
+      "tags": "Tags",
+      "ghosts": "Pas encore écrit",
+      "suggestions": "Suggestions",
+      "orphans": "Solitaires"
+    },
+    "kind": {
+      "note": "Note",
+      "checklist": "Liste",
+      "ghost": "Pas encore écrit",
+      "tag": "Tag"
+    },
+    "edges": {
+      "mention": "Lien",
+      "wiki": "Wikilien",
+      "suggested": "Suggéré",
+      "tag": "Tag"
+    },
+    "linksTo": "Lie vers",
+    "linkedFrom": "Lié depuis",
+    "suggested": "Peut‑être lié",
+    "promote": "Lier à {title}",
+    "lonely": "Rien n’est encore connecté ici. Mentionnez‑le avec @ ou [[ depuis une autre note.",
+    "open": "Ouvrir",
+    "createGhost": "Écrire cette note",
+    "openTag": "Afficher tout ce qui a ce tag",
+    "createFailed": "Impossible de créer cette note",
+    "connectFailed": "Impossible de lier ces deux éléments",
+    "connected": "{source} lié à {target}",
+    "empty": "Votre brain est calme. Liez des notes et des listes avec @ ou [[ et elles apparaîtront ici.",
+    "viewingOwner": "Brain de {owner}",
+    "summary": "{items} éléments, {links} liens, {shown} affichés"
+  },
+  "apiExplorer": {
+    "title": "Explorateur d’API",
+    "intro": "Chaque endpoint exposé par cette instance (v{version}), généré à partir du code qui le sert. Choisissez‑en un, remplissez‑le et envoyez‑le.",
+    "realData": "Les requêtes s’exécutent en tant que propriétaire de la clé API, sur des données réelles. Un DELETE ici supprime pour de vrai.",
+    "apiKey": "Clé API",
+    "apiKeyHint": "Conservée sur cette page uniquement et oubliée quand vous la quittez.",
+    "useMyKey": "Utiliser ma clé",
+    "noKeyYet": "Vous n’avez pas encore de clé API. Générez‑en une dans les paramètres de votre profil.",
+    "filter": "Filtrer",
+    "filterPlaceholder": "Chemin, nom ou méthode",
+    "noMatches": "Rien ne correspond à ce filtre.",
+    "body": "Corps de la requête (JSON)",
+    "showSchema": "Afficher le schéma",
+    "hideSchema": "Masquer le schéma",
+    "send": "Envoyer",
+    "sending": "Envoi...",
+    "keyRequired": "Ajoutez d’abord une clé API.",
+    "noKeyNeeded": "aucune clé API requise",
+    "deprecated": "obsolète",
+    "requestFailed": "La requête n’a jamais atteint le serveur. Vérifiez votre connexion.",
+    "responseMeta": "{status} en {ms} ms"
   }
 }
diff --git a/app/_translations/it.json b/app/_translations/it.json
index 3673016c3..14f85e464 100644
--- a/app/_translations/it.json
+++ b/app/_translations/it.json
@@ -127,6 +127,7 @@
     "expandAll": "Espandi tutto",
     "saveChanges": "Salva modifiche",
     "all": "Tutti",
+    "items": "Elementi",
     "showAll": "Mostra tutto",
     "creating": "Creazione in corso...",
     "createCategoryHeader": "Crea nuova categoria",
@@ -170,9 +171,10 @@
     "dismiss": "Ignora",
     "cleaning": "Pulizia...",
     "noResultsFound": "Nessun risultato",
+    "noResults": "Nessun risultato",
     "by": "di {owner}",
     "unsavedChanges": "Modifiche non salvate",
-    "unsavedChangesDetected": "⚠️ Rilevate modifiche non salvate",
+    "unsavedChangesDetected": "Modifiche non salvate",
     "unsavedChangesMessage": "Hai modifiche non salvate in {noteTitle}. Se esci ora, le modifiche andranno perse.",
     "whatToDoWithUnsavedChanges": "Cosa vuoi fare con le modifiche non salvate?",
     "discard": "Ignora",
@@ -237,45 +239,42 @@
     "openSearch": "Apri ricerca",
     "closeSearch": "Chiudi ricerca",
     "moreOptions": "Altre opzioni",
-    "retry": "Riprova",
+    "history": "Cronologia",
+    "disable": "Disattiva",
     "restoring": "Ripristino...",
+    "retry": "Riprova",
     "copiedToClipboard": "Copiato negli appunti",
     "offline": "Non in linea",
     "connected": "Collegato",
     "reconnecting": "Riconnessione...",
     "hide": "Nascondi",
-    "disable": "Disattiva",
-    "history": "Cronologia",
-    "items": "Elementi",
-    "noResults": "Nessun risultato",
     "thisEntry": "questa voce",
     "preview": "Anteprima"
   },
-  "comments": {
-    "title": "Commenti",
-    "titleWithCount": "{count, plural, one {# Commento} other {# Commenti}}",
-    "noComments": "Nessun commento ancora. Inizia la conversazione!",
-    "addComment": "Aggiungi un commento...",
-    "replyPlaceholder": "Scrivi una risposta...",
-    "post": "Pubblica",
-    "reply": "Rispondi",
-    "edit": "Modifica",
-    "delete": "Elimina",
-    "save": "Salva",
-    "cancel": "Annulla",
-    "edited": "modificato",
-    "deleteConfirmTitle": "Eliminare il commento?",
-    "deleteConfirmMessage": "Questo eliminerà il commento e tutte le risposte. Questa azione non può essere annullata.",
-    "commentDeleted": "Commento eliminato",
-    "commentAdded": "Commento aggiunto",
-    "commentUpdated": "Commento aggiornato",
-    "failedToAdd": "Impossibile aggiungere il commento",
-    "failedToEdit": "Impossibile modificare il commento",
-    "failedToDelete": "Impossibile eliminare il commento",
-    "failedToLoad": "Impossibile caricare i commenti",
-    "readOnly": "È necessario l'accesso in modifica per commentare questa scheda.",
-    "replyTo": "Rispondi a {author}",
-    "noUsersFound": "Nessun utente trovato"
+  "history": {
+    "noteHistory": "Cronologia della nota",
+    "restore": "Ripristina",
+    "restoreVersion": "Ripristina versione",
+    "restoreConfirm": "Ripristinare questa versione? \nIl contenuto attuale verrà sostituito.",
+    "noHistory": "Nessuna cronologia disponibile",
+    "noHistoryDescription": "Salva la nota per creare un punto nella cronologia.",
+    "loadMore": "Carica altro",
+    "featureDisabled": "Cronologia disattivata",
+    "disabledAdmin": "La cronologia delle note è disattivata. Puoi attivarla in Impostazioni amministratore > Editor.",
+    "disabledUser": "La cronologia delle note è disattivata. Chiedi al tuo amministratore di attivarla.",
+    "goToSettings": "Vai alle impostazioni",
+    "manualSavesOnly": "Solo i salvataggi manuali creano la cronologia. Quelli automatici no.",
+    "fetchError": "Impossibile caricare la cronologia",
+    "restoreError": "Impossibile ripristinare la versione",
+    "viewContent": "Visualizza contenuto",
+    "viewDiff": "Visualizza modifiche",
+    "actionCreate": "Creato",
+    "actionUpdate": "Aggiornato",
+    "actionRename": "Rinominato",
+    "actionMove": "Spostato",
+    "actionDelete": "Eliminato",
+    "actionInit": "Inizializzato",
+    "actionUnknown": "Modificato"
   },
   "auth": {
     "loginTitle": "Accedi",
@@ -310,7 +309,7 @@
     "createUser": "Crea Utente",
     "attemptsRemaining": "Attenzione: {count, plural, one {# tentativo} other {# tentativi}} rimanenti prima del blocco dell'account",
     "accountLocked": "Troppi tentativi falliti. Riprova tra {seconds} {seconds, plural, one {secondo} other {secondi}}",
-    "notAuthorized": "Non sei autorizzato ad accedere a questa applicazione. Contatta l’amministratore.",
+    "notAuthorized": "Non hai accesso a questa app. Chiedi al tuo amministratore.",
     "rememberMe": "Ricordami"
   },
   "mfa": {
@@ -335,7 +334,7 @@
     "invalidCode": "Codice di autenticazione non valido",
     "invalidRecoveryCode": "Codice di recupero non valido",
     "mfaRequired": "È richiesta l'autenticazione a due fattori",
-    "mfaEnabledSuccess": "Autenticazione a due fattori attivata con successo",
+    "mfaEnabledSuccess": "Autenticazione a due fattori attivata",
     "mfaDisabledSuccess": "Autenticazione a due fattori disattivata",
     "tooManyAttempts": "Troppi tentativi falliti. Riprova più tardi.",
     "disableTitle": "Disattiva Autenticazione a Due Fattori",
@@ -357,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Questo invaliderà il tuo codice di recupero attuale",
     "regenerateRecoveryCodeDescription": "Inserisci il tuo codice 2FA per generare un nuovo codice di recupero. Il vecchio codice non funzionerà più.",
     "recoveryCodeRegenerated": "Nuovo Codice di Recupero Generato",
-    "recoveryCodeRegeneratedInfo": "Il tuo nuovo codice di recupero è stato generato. Salvalo in un posto sicuro - questa è l'unica volta che lo vedrai.",
-    "recoveryCodeRegeneratedSuccess": "Codice di recupero rigenerato con successo",
+    "recoveryCodeRegeneratedInfo": "Il tuo nuovo codice di recupero è pronto. Salvalo in un posto sicuro, questa è l'unica volta che lo vedrai.",
+    "recoveryCodeRegeneratedSuccess": "Codice di recupero rigenerato",
     "recoveryCodeProfileDescription": "Usa questo codice per recuperare l'account se perdi l'accesso alla tua app di autenticazione",
     "disableMfaForUser": "Disattiva 2FA per questo utente",
     "recoveryCodeRequired": "Il codice di recupero è obbligatorio",
@@ -372,7 +371,7 @@
     "recent": "Recenti",
     "browseAndManage": "Gestisci le tue note",
     "noNotesYet": "Nessuna nota",
-    "createFirstNote": "Crea la tua prima nota per iniziare.",
+    "createFirstNote": "Ancora niente qui. Crea la tua prima nota.",
     "createNewNote": "Crea Nuova Nota",
     "noNotesFound": "Nessuna nota trovata",
     "tryAdjustingFilters": "Prova a modificare i filtri o crea una nuova nota.",
@@ -403,22 +402,26 @@
     "enterNoteTitle": "Inserisci titolo nota...",
     "byType": "Per tipo",
     "publiclySharedNote": "Condivisa pubblicamente",
+    "sharedPubliclyBy": "Questa nota è condivisa pubblicamente da {owner}",
+    "copyRawContent": "Copia il markdown",
     "quickSave": "Salvataggio Rapido",
     "noteNotFound": "Nota non trovata",
     "unarchiveNote": "Annulla archiviazione nota",
     "enterNoteName": "Inserisci nome nota...",
     "updateNote": "Aggiorna Nota",
-    "tags": "Tag",
-    "noTagsFound": "Nessun tag trovato",
-    "searchTags": "Cerca tag...",
-    "copyRawContent": "Copia il markdown",
     "printSaveAsPdf": "Stampa / Salva come PDF",
     "tableOfContents": "Indice",
     "wordCount": "{count, plural, one {# parola} other {# parole}}",
     "charCount": "{count, plural, one {# carattere} other {# caratteri}}",
-    "readingTime": "{count, plural, one {# minuto di lettura} other {# minuti di lettura}}"
+    "readingTime": "{count, plural, one {# minuto di lettura} other {# minuti di lettura}}",
+    "tags": "Tag",
+    "noTagsFound": "Nessun tag trovato",
+    "searchTags": "Cerca tag...",
+    "createNoteFailed": "Impossibile creare la nota",
+    "createCategoryFailed": "Impossibile creare la categoria, la nota non è stata creata"
   },
   "checklists": {
+    "sharedPubliclyBy": "Questa checklist è condivisa pubblicamente da {owner}",
     "title": "Checklist",
     "allChecklists": "Tutte le Checklist",
     "completed": "Completate",
@@ -432,7 +435,7 @@
     "progress": "Progresso",
     "totalItems": "Elementi totali",
     "noChecklistsYet": "Nessuna Checklist presente",
-    "createFirstChecklist": "Crea la tua prima checklist per organizzare le tue attività.",
+    "createFirstChecklist": "Ancora niente qui. Crea la tua prima checklist.",
     "newChecklist": "Nuova Checklist",
     "noChecklistsFound": "Nessuna checklist trovata",
     "tryAdjustingFiltersChecklist": "Prova a modificare i filtri o crea una nuova checklist.",
@@ -474,6 +477,7 @@
     "checklistType": "Tipo Checklist",
     "simpleChecklist": "Checklist Semplice",
     "taskProject": "Progetto Attività",
+    "kanbanBoard": "Bacheca Kanban",
     "basicTodoItems": "Voci todo base",
     "withTimeTracking": "Con tracciamento tempo",
     "noDescription": "Nessuna descrizione",
@@ -500,23 +504,24 @@
     "clearAllCompletedConfirmMessage": "Sei sicuro di voler eliminare tutti i {count} elementi completati? Questa azione non può essere annullata.",
     "clearAllIncompleteConfirmMessage": "Vuoi eliminare tutti i {count} elementi incompleti e i relativi elementi secondari? \nQuesta azione non può essere annullata.",
     "convertChecklistType": "Converti Tipo Checklist",
-    "convertTypeConfirmation": "Stai per convertire da {currentType} a {newType}. Sei sicuro di voler procedere?",
-    "dataLossWarning": "⚠️ Avviso Perdita Dati",
+    "convertTypeConfirmation": "Convertire da {currentType} a {newType}?",
+    "dataLossWarning": "Avviso perdita dati",
     "dataLossWarningItems": "I seguenti dati andranno persi:",
     "allTaskStatusesReset": "Tutti gli stati delle attività verranno reimpostati",
     "timeTrackingDataLost": "I dati di tracciamento del tempo andranno persi",
     "estimatedTimesRemoved": "I tempi stimati verranno rimossi",
     "targetDatesCleared": "Le date target verranno cancellate",
-    "enhancedFeatures": "✨ Funzionalità Avanzate",
+    "enhancedFeatures": "Cosa ottieni",
     "enhancedFeaturesYouWillGain": "Otterrai:",
     "kanbanBoardWithDragDrop": "Kanban board con drag & drop",
     "taskStatusTracking": "Tracciamento stato attività (Da fare, In corso, ecc.)",
     "timeTrackingWithTimer": "Tracciamento tempo con timer integrato",
-    "actionCannotBeUndone": "Questa azione non può essere annullata. Sei sicuro di voler convertire?",
+    "actionCannotBeUndone": "Non si può annullare. Convertire comunque?",
     "convertAndLoseData": "Converti e Perdi Dati",
     "convert": "Converti",
     "convertToSimpleChecklist": "Converti in una checklist semplice",
     "convertToTaskProject": "Converti in liste attività",
+    "convertToKanbanBoard": "Converti in bacheca Kanban",
     "pasteYourList": "Incolla la tua lista (un item per riga)",
     "addItems": "Aggiungi {count} item",
     "itemsWillBeAdded": "Verranno aggiunti {count} item",
@@ -525,11 +530,35 @@
     "noItemsYet": "Ancora nessun item",
     "addFirstItem": "Aggiungi il tuo primo item per iniziare!",
     "noTasks": "Nessun task",
-    "noSubtasksYet": "Nessuna attività secondaria. Aggiungine una qui sotto per iniziare.",
+    "noSubtasksYet": "Nessuna attività secondaria. Aggiungine una qui sotto.",
     "addTime": "Aggiungi tempo",
-    "enterTimeInMinutes": "Inserisci il tuo tempo in minuti",
-    "convertToKanbanBoard": "Converti in bacheca Kanban",
-    "kanbanBoard": "Bacheca Kanban"
+    "enterTimeInMinutes": "Inserisci il tuo tempo in minuti"
+  },
+  "comments": {
+    "title": "Commenti",
+    "titleWithCount": "{count, plural, one {# Commento} other {# Commenti}}",
+    "noComments": "Nessun commento ancora. Inizia la conversazione!",
+    "addComment": "Aggiungi un commento...",
+    "replyPlaceholder": "Scrivi una risposta...",
+    "post": "Pubblica",
+    "reply": "Rispondi",
+    "edit": "Modifica",
+    "delete": "Elimina",
+    "save": "Salva",
+    "cancel": "Annulla",
+    "edited": "modificato",
+    "deleteConfirmTitle": "Eliminare il commento?",
+    "deleteConfirmMessage": "Questo eliminerà il commento e tutte le risposte. Questa azione non può essere annullata.",
+    "commentDeleted": "Commento eliminato",
+    "commentAdded": "Commento aggiunto",
+    "commentUpdated": "Commento aggiornato",
+    "failedToAdd": "Impossibile aggiungere il commento",
+    "failedToEdit": "Impossibile modificare il commento",
+    "failedToDelete": "Impossibile eliminare il commento",
+    "failedToLoad": "Impossibile caricare i commenti",
+    "readOnly": "È necessario l'accesso in modifica per commentare questa scheda.",
+    "replyTo": "Rispondi a {author}",
+    "noUsersFound": "Nessun utente trovato"
   },
   "tasks": {
     "title": "Attività",
@@ -558,7 +587,7 @@
     "overdue": "In ritardo",
     "browseAndManageTaskLists": "Gestisci le tue liste di attività",
     "noTaskListsYet": "Nessuna lista attività",
-    "createFirstTaskList": "Crea la tua prima lista per gestire i tuoi progetti.",
+    "createFirstTaskList": "Ancora niente qui. Crea la tua prima lista di attività.",
     "newTaskList": "Nuova Lista Attività",
     "taskLists": "Liste Attività",
     "noTaskListsFound": "Nessuna lista attività trovata",
@@ -606,7 +635,7 @@
     "changeStatus": "Cambia stato",
     "noBoards": "Nessuna board trovata",
     "noBoardsYet": "Nessuna board Kanban ancora",
-    "createFirstBoard": "Crea la tua prima board Kanban per gestire i tuoi progetti.",
+    "createFirstBoard": "Ancora niente qui. Crea la tua prima board Kanban.",
     "newBoard": "Nuova board",
     "tryAdjustingFilters": "Prova a modificare i filtri o crea una nuova board.",
     "completed": "Completato",
@@ -659,7 +688,7 @@
     "quickSettingsHeader": "Impostazioni rapide (solo questo dispositivo)",
     "adminSettings": "Admin Dashboard",
     "apiKey": "API Key",
-    "apiKeyDescription": "Genera una API key per l'accesso programmatico alle tue note e checklist",
+    "apiKeyDescription": "Genera una API key così script e app possono raggiungere le tue checklist e note",
     "hideApiKey": "Nascondi API Key",
     "showApiKey": "Mostra API Key",
     "copyApiKey": "Copia API Key",
@@ -677,13 +706,13 @@
     "removeAvatar": "Rimuovi Avatar",
     "usernameRequired": "Il nome utente è obbligatorio",
     "passwordsDoNotMatch": "Le nuove password non corrispondono",
-    "profileUpdated": "Profilo aggiornato con successo!",
+    "profileUpdated": "Profilo aggiornato",
     "failedToUpdateProfile": "Impossibile aggiornare il profilo",
     "failedToUpdateProfileRetry": "Impossibile aggiornare il profilo. Riprova.",
-    "avatarUpdated": "Avatar aggiornato con successo!",
+    "avatarUpdated": "Avatar aggiornato",
     "failedToUpdateAvatar": "Impossibile aggiornare l'avatar",
     "failedToUpdateAvatarRetry": "Impossibile aggiornare l'avatar. Riprova.",
-    "avatarRemoved": "Avatar rimosso con successo!",
+    "avatarRemoved": "Avatar rimosso",
     "failedToRemoveAvatar": "Impossibile rimuovere l'avatar",
     "failedToRemoveAvatarRetry": "Impossibile rimuovere l'avatar. Riprova.",
     "activeSessions": "Sessioni Attive",
@@ -703,11 +732,11 @@
     "auditLogsTab": "Log utente",
     "rebuildLinkIndexes": "Ricostruisci indici link per aggiornare i dati di connessione",
     "rebuildingLinkIndex": "Ricostruzione indice link...",
-    "successfullyRebuiltIndex": "Indice link ricostruito con successo",
-    "successfullyRebuiltIndexReload": "Indice link ricostruito! La pagina verrà ricaricata per mostrare le connessioni aggiornate.",
+    "successfullyRebuiltIndex": "Indice dei link ricostruito",
+    "successfullyRebuiltIndexReload": "Indice dei link ricostruito. La pagina verrà ricaricata per mostrare i nuovi collegamenti.",
     "failedToRebuildIndex": "Impossibile ricostruire l'indice dei link. Riprova.",
     "contentLinks": "Link Contenuti",
-    "visualizeRelationships": "Visualizza le relazioni tra le tue note e checklist",
+    "visualizeRelationships": "Guarda come le tue note e checklist si collegano tra loro",
     "connectedItems": "Elementi Connessi",
     "noLinksFound": "Nessun Link Trovato",
     "startCreatingInternalLinks": "Inizia a creare collegamenti interni digitando \"@\" nelle tue note per vedere la rete di relazioni qui.",
@@ -718,8 +747,8 @@
     "isolated": "isolato",
     "connection": "connessione",
     "connection_plural": "connessioni",
-    "terminateSessionConfirm": "Sei sicuro di voler terminare questa sessione?",
-    "terminateAllSessionsConfirm": "Sei sicuro di voler terminare tutte le altre sessioni?",
+    "terminateSessionConfirm": "Terminare questa sessione?",
+    "terminateAllSessionsConfirm": "Terminare tutte le altre sessioni?",
     "validationErrorTitle": "Errore di Validazione",
     "visibleGraphSummary": "{items} elementi visibili, {links} collegamenti visibili",
     "graphTruncated": "Visualizzazione dei {visible} elementi più collegati. {omitted} elementi meno collegati sono stati omessi.",
@@ -790,10 +819,10 @@
     "chooseAutoSaveInterval": "Scegli ogni quanto salvare automaticamente le note.",
     "defaultMode": "Modalità Predefinita",
     "selectNotesDefaultMode": "Seleziona modalità predefinita",
-    "chooseNotesDefaultMode": "Scegli se la nota si apre in modalità modifica o meno (pulsante {mode} nell'editor).",
+    "chooseNotesDefaultMode": "Scegli se le note si aprono in modalità modifica. Puoi sempre cambiare con il pulsante {mode} nell'editor.",
     "defaultEditor": "Editor Predefinito",
     "selectNotesDefaultEditor": "Seleziona editor predefinito",
-    "chooseDefaultEditor": "Scegli l'editor predefinito per le note (puoi sempre cambiare cliccando su {editor} nell'editor).",
+    "chooseDefaultEditor": "Scegli l'editor predefinito per le note. Puoi sempre cambiare con il pulsante {editor} nell'editor.",
     "tableSyntaxInNotes": "Sintassi Tabelle",
     "selectTableSyntax": "Seleziona sintassi tabelle",
     "chooseTableSyntax": "Scegli come vengono renderizzate le tabelle nelle note.",
@@ -802,7 +831,7 @@
     "chooseSyntaxTheme": "Scegli il tema per l'evidenziazione della sintassi markdown.",
     "minimalMode": "Modalità Minimale (Disabilita Rich Text)",
     "selectMinimalMode": "Seleziona modalità minimale",
-    "minimalModeDescription": "Se abilitato, usa un semplice renderer markdown invece dell'editor Rich Text. Funzioni avanzate come i link bilaterali non funzioneranno.",
+    "minimalModeDescription": "Usa un semplice renderer markdown invece dell'editor Rich Text. I link bilaterali e le altre funzioni avanzate non funzionano in questa modalità.",
     "defaultNoteFilter": "Filtro Note Predefinito",
     "selectDefaultNoteFilter": "Seleziona filtro",
     "chooseDefaultNoteFilter": "Scegli il filtro predefinito all'apertura della pagina Note.",
@@ -829,8 +858,8 @@
     "currentPassword": "Password Attuale",
     "newPassword": "Nuova Password",
     "confirmPassword": "Conferma Password",
-    "passwordChanged": "Password cambiata con successo",
-    "settingsSaved": "Impostazioni salvate con successo",
+    "passwordChanged": "Password cambiata",
+    "settingsSaved": "Impostazioni salvate",
     "dashCase": "Dash case (es. il-mio-file.md)",
     "minimal": "Minimale (rimuove solo caratteri non validi)",
     "noRename": "Nessuna rinomina (mantieni nome originale)",
@@ -840,6 +869,7 @@
     "seconds_plural": "{count} secondi",
     "hours12": "12 ore",
     "hours24": "24 ore",
+    "useSystemDefault": "Utilizza l'impostazione predefinita del sistema",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "Default",
@@ -863,7 +893,7 @@
     "chooseQuickCreateNotes": "Scegli la modalità di creazione rapida note.",
     "quickCreateNotesShowModal": "Mostra finestra alla creazione",
     "quickCreateNotesSkipModal": "Salta finestra e crea istantaneamente",
-    "quickCreateNotesDescription": "Se abilitato, la creazione di una nuova nota salta il popup e ti porta direttamente all'editor.",
+    "quickCreateNotesDescription": "Salta il popup di creazione e ti porta direttamente all'editor.",
     "defaultCategory": "Categoria predefinita per creazione rapida",
     "selectDefaultCategory": "Seleziona categoria...",
     "defaultCategoryDescription": "Le nuove note verranno create in questa categoria usando la creazione rapida.",
@@ -901,7 +931,7 @@
     "hideStatusOnCardsLabel": "Stato sulle schede Kanban",
     "showStatusOnCards": "Mostra stato",
     "hideStatusOnCards": "Nascondi stato",
-    "hideStatusOnCardsDescription": "Nasconde l'etichetta di stato dalle schede Kanban. Lo stato è già indicato dalla colonna in cui si trova la scheda.",
+    "hideStatusOnCardsDescription": "Nasconde l'etichetta di stato sulle schede Kanban. La colonna mostra già lo stato.",
     "hideMobileStatusDropdownLabel": "Menu a discesa stato mobile sulle schede",
     "showMobileStatusDropdown": "Mostra menu mobile",
     "hideMobileStatusDropdown": "Nascondi menu mobile",
@@ -914,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "Nasconde il timer e le sessioni registrate dalle schede Kanban. Il monitoraggio del tempo resta disponibile nella vista dettagli della scheda.",
     "selectStatusOnCards": "Seleziona visibilità stato",
     "codeBlockChoice": "Scegli lo stile del blocco di codice",
-    "themedCodeBlock": "Blocco di codice a tema",
     "defaultCodeBlock": "Codepen (predefinito)",
+    "themedCodeBlock": "Blocco di codice a tema",
     "codeBlockChoiceDescription": "Scegli tra lo stile di blocco codice predefinito simile a codepen o uno stile di blocco codice a tema.",
     "checklistItemClickAction": "Azione clic sull'elemento dell'elenco di controllo",
     "selectChecklistItemClickAction": "Selezionare l'azione clic sull'elemento dell'elenco di controllo",
-    "checklistItemClickActionDescription": "Scegli cosa succede quando fai clic sul testo di un'attività. \n\"Segna come completato\" attiva/disattiva la casella di controllo (impostazione predefinita); \n\"Modifica nome attività\" apre l'attività per la modifica in linea: dovrai comunque fare clic sulla casella di controllo stessa per completarla.",
+    "checklistItemClickActionDescription": "Scegli cosa succede quando fai clic sul testo di un'attività. \"Segna come completato\" (predefinito) attiva o disattiva la casella. \"Modifica nome attività\" apre l'attività per la modifica in linea, e per completarla fai clic sulla casella stessa.",
     "checklistItemClickActionToggle": "Contrassegna come completo/incompleto",
     "checklistItemClickActionEdit": "Modifica elemento elenco",
     "newItemInsertion": "Inserimento nuovi elementi",
@@ -927,7 +957,6 @@
     "newItemInsertionDescription": "Scegli se i nuovi elementi vengono aggiunti in cima (predefinito) o in fondo a una checklist.",
     "newItemInsertionTop": "Inizio della lista",
     "newItemInsertionBottom": "Fine della lista",
-    "useSystemDefault": "Utilizza l'impostazione predefinita del sistema",
     "selectShowChecklistEmojis": "Seleziona visibilità emoji",
     "showChecklistEmojisDescription": "Mostra un'emoji automatica accanto agli elementi della checklist in base al testo."
   },
@@ -970,20 +999,24 @@
     "icon512": "Icona 512x512",
     "icon512Description": "Icona alta risoluzione per splash screen PWA.",
     "notifyNewUpdates": "Notificami nuovi aggiornamenti",
-    "thisUsesGithubAPI": "Usa le API di GitHub per recuperare gli aggiornamenti; disabilitarlo disattiva completamente le API e impedisce il traffico verso GitHub.",
+    "thisUsesGithubAPI": "Usa le API di GitHub per controllare gli aggiornamenti. Disattivandolo si blocca tutto il traffico verso e da GitHub.",
     "parseContent": "Mostra sempre contenuto parsato",
-    "parseContentEnabledDescription": "Se abilitato, mostrerà i titoli formattati nella sidebar, nei risultati di ricerca e ovunque nell'app.",
-    "parseContentDisabledDescription": "Se disabilitato, verranno mostrati i nomi dei file originali (sanitizzati e leggibili).",
-    "parseContentPerformanceWarning": "Impostare su \"no\" migliora le performance su grandi dataset ma potrebbe ridurre la leggibilità - specialmente con nomi file contenenti caratteri non latini.",
+    "parseContentEnabledDescription": "Mostra i titoli formattati nella sidebar, nei risultati di ricerca e ovunque nell'app.",
+    "parseContentDisabledDescription": "Mostra invece i nomi dei file originali, ripuliti per essere leggibili.",
+    "parseContentPerformanceWarning": "Impostarlo su \"no\" velocizza le istanze grandi ma rende i titoli meno leggibili, soprattutto i nomi file con caratteri non latini.",
     "hideLanguageSelector": "Nascondi il selettore della Lingua nell'header",
     "hideLanguageSelectorDescription": "Mostra/nascondi menu a tendina di selezione lingua nell'header",
+    "defaultDateFormat": "Formato data predefinito",
+    "defaultDateFormatDescription": "Utilizzato quando la preferenza del formato data di un utente è impostata su \"Utilizza impostazione predefinita del sistema\".",
+    "defaultTimeFormat": "Formato ora predefinito",
+    "defaultTimeFormatDescription": "Utilizzato quando la preferenza del formato dell'ora di un utente è impostata su \"Utilizza impostazione predefinita del sistema\".",
     "applicationIcons": "Icone Applicazione",
     "saveChanges": "Salva Modifiche",
     "unsavedChanges": "Hai modifiche non salvate.",
     "loadError": "Errore Caricamento",
     "couldNotFetchSettings": "Impossibile recuperare le impostazioni.",
     "failedToLoadSettings": "Caricamento impostazioni fallito",
-    "settingsSavedSuccessfully": "Impostazioni salvate con successo.",
+    "settingsSavedSuccessfully": "Impostazioni salvate.",
     "failedToSaveSettings": "Salvataggio impostazioni fallito",
     "saveError": "Errore Salvataggio",
     "unknownErrorOccurred": "Si è verificato un errore sconosciuto.",
@@ -996,7 +1029,7 @@
     "colorVariables": "Variabili Colore",
     "livePreview": "Anteprima Live",
     "unsavedCssChanges": "Hai modifiche CSS non salvate.",
-    "noCustomThemesYet": "Nessun tema personalizzato. Clicca \"Crea Tema\" per iniziare.",
+    "noCustomThemesYet": "Nessun tema personalizzato. Clicca \"Crea Tema\" per crearne uno.",
     "myCustomTheme": "Il Mio Tema",
     "iconNameDescription": "nome icona (es. PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "Versione App",
@@ -1026,25 +1059,31 @@
     "enableTableToolbarDescription": "Abilita la toolbar che appare modificando le tabelle",
     "bilateralLinks": "Link Bilaterali",
     "bilateralLinksDescription": "Abilita la possibilità di linkare note e checklist nello stesso documento.",
+    "historyEnabled": "Cronologia note",
+    "historyDescription": "Tiene traccia della cronologia delle versioni delle note. Consente di ripristinare versioni precedenti. Solo i salvataggi manuali creano punti nella cronologia (non il salvataggio automatico).",
+    "disableHistory": "Disattiva cronologia",
+    "disableHistoryWarning": "La disattivazione elimina in modo permanente tutte le versioni salvate per tutti gli utenti. Operazione irreversibile.",
+    "historyDisabled": "La cronologia delle note è stata disattivata e tutti i dati di cronologia sono stati eliminati.",
+    "failedToDisableHistory": "Impossibile disattivare la cronologia",
     "configureExternalServices": "Configura URL per servizi esterni integrati.",
     "drawioUrl": "URL Draw.io",
     "optional": "(Opzionale)",
-    "drawioUrlDescription": "Specifica un'istanza Draw.io personalizzata. Lascia vuoto per usare quella pubblica (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Usa la tua istanza Draw.io. Lascia vuoto per quella pubblica (https://embed.diagrams.net).",
     "drawioUrlExample": "Esempio self-hosted: https://tuo-dominio.com/drawio",
     "drawioProxyEnabled": "Proxy Draw.io via Jotty",
-    "drawioProxyEnabledDescription": "Abilita per instradare il traffico Draw.io attraverso il server di Jotty. Richiesto per URL interni alla rete Docker (es. http://drawio:8080) non accessibili dal browser degli utenti.",
+    "drawioProxyEnabledDescription": "Instrada il traffico Draw.io attraverso il server di Jotty. Serve per URL interni alla rete Docker (es. http://drawio:8080) che il browser degli utenti non raggiunge.",
     "excalidrawUrl": "URL Excalidraw",
-    "excalidrawUrlDescription": "Specifica un'istanza Excalidraw personalizzata. Lascia vuoto per usare quella pubblica (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Usa la tua istanza Excalidraw. Lascia vuoto per quella pubblica (https://excalidraw.com).",
     "excalidrawUrlExample": "Esempio self-hosted: https://tuo-dominio.com/excalidraw",
     "excalidrawProxyEnabled": "Proxy Excalidraw via Jotty",
-    "excalidrawProxyEnabledDescription": "Abilita per instradare il traffico Excalidraw attraverso il server di Jotty. Richiesto per URL interni alla rete Docker (es. http://excalidraw:3000) non accessibili dal browser degli utenti.",
+    "excalidrawProxyEnabledDescription": "Instrada il traffico Excalidraw attraverso il server di Jotty. Serve per URL interni alla rete Docker (es. http://excalidraw:3000) che il browser degli utenti non raggiunge.",
     "saving": "Salvataggio...",
     "editorSettingsSaved": "Impostazioni editor salvate.",
     "customEmojis": "Emoji Personalizzate",
-    "noEmojisYet": "Nessuna emoji personalizzata. Clicca &quot;Aggiungi Emoji&quot; per iniziare.",
-    "enterAnyEmoji": "Inserisci un'emoji o usa il selettore (Win: Win+.; Mac: Ctrl+Cmd+Space",
+    "noEmojisYet": "Nessuna emoji personalizzata. Clicca &quot;Aggiungi Emoji&quot; per aggiungerne una.",
+    "enterAnyEmoji": "Inserisci un'emoji o usa il selettore (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Panoramica Condivisioni",
-    "detailedSharingBreakdown": "Dettagli sui pattern di condivisione e coinvolgimento utenti",
+    "detailedSharingBreakdown": "Cosa viene condiviso, e chi lo condivide",
     "checkForUpdates": "Verifica aggiornamenti",
     "checkingForUpdates": "Verifica aggiornamenti in corso...",
     "updateAvailable": "Aggiornamento disponibile!",
@@ -1064,7 +1103,7 @@
     "totalItems": "{items} elementi totali su {userCount} utenti",
     "privileges": "Privilegi Admin",
     "adminContentAccess": "Accesso Contenuti Admin",
-    "adminContentAccessDescription": "Controlla se gli amministratori possono accedere alle note e checklist di tutti gli utenti. Se disabilitato, gli admin possono solo gestire utenti e impostazioni ma non vedere i contenuti altrui.",
+    "adminContentAccessDescription": "Permette agli amministratori di aprire le note e checklist di tutti gli utenti. Se disattivato, gli admin gestiscono utenti e impostazioni ma non vedono i contenuti altrui.",
     "adminContentAccessYes": "Gli admin possono accedere a tutti i contenuti",
     "adminContentAccessNo": "Gli admin possono accedere solo ai propri contenuti",
     "superAdminOnly": "Modificabile solo dal proprietario del sistema",
@@ -1074,21 +1113,21 @@
     "confirmNewPassword": "Conferma nuova password",
     "dataExport": "Esportazione Dati",
     "dataExportOptions": "Opzioni Esportazione Dati",
-    "selectExportType": "Seleziona un tipo di export e scarica i dati.",
+    "selectExportType": "Scegli un tipo di export e scarica i dati.",
     "allChecklistsAndNotes": "Tutte le checklist e note",
-    "allChecklistsAndNotesDescription": "Esporta tutte le checklist e note di tutti gli utenti. Genera un file zip con i dati JSON organizzati per utente e categoria.",
+    "allChecklistsAndNotesDescription": "Esporta le checklist e le note di tutti gli utenti in uno zip di file JSON, raggruppati per utente e categoria.",
     "userChecklistsNotes": "Checklist e Note di un utente specifico",
-    "userChecklistsNotesDescription": "Seleziona un utente per esportare solo i suoi contenuti.",
+    "userChecklistsNotesDescription": "Scegli un utente dal menu per esportare tutte le sue checklist e note.",
     "allUsersData": "Dati Account di tutti gli utenti",
     "allUsersDataDescription": "Esporta un JSON con le info account di tutti (username, stato admin, ecc.). NON include i contenuti delle note.",
     "wholeDataFolder": "Intera cartella dati (Backup)",
-    "wholeDataFolderDescription": "Esporta l'intera cartella 'data', inclusi contenuti, metadati e impostazioni. Attenzione: il file può essere grande.",
+    "wholeDataFolderDescription": "Esporta l'intera cartella 'data', con contenuti, metadati e impostazioni. Il file può diventare grande.",
     "noSharingPermissionsLabel": "Gli elementi condivisi specifici sono nascosti in base ai tuoi permessi di accesso.",
     "contentHidden": "Dettagli contenuto nascosti",
     "viewOnlySettingsNotice": "Solo il proprietario del sistema può modificare queste impostazioni.",
     "auditLogContentRedacted": "[Contenuto Nascosto]",
     "maxLogAgeDays": "Età Massima Log (giorni)",
-    "maxLogAgeDaysDescription": "Imposta per quanto tempo conservare i log di audit. Visualizzando la pagina dei log, ti verrà chiesto di pulire quelli più vecchi di questa soglia. Imposta a 0 per conservazione illimitata (nessuna richiesta automatica).",
+    "maxLogAgeDaysDescription": "Per quanto tempo tenere i log di audit. La pagina dei log propone di pulire quelli più vecchi. Imposta 0 per tenerli per sempre e non ricevere mai la richiesta.",
     "appPreferences": "Preferenze app",
     "editEmoji": "Modifica Emoji",
     "addEmoji": "Aggiungi Emoji",
@@ -1107,16 +1146,6 @@
     "updateTagsTitle": "Scansiona le note per hashtag e aggiorna frontmatter",
     "tagsUpdated": "{processed} file elaborati, {updated} aggiornati con nuovi tag",
     "failedToUpdateTags": "Impossibile aggiornare i tag",
-    "historyEnabled": "Cronologia note",
-    "historyDescription": "Tiene traccia della cronologia delle versioni delle note. Consente di ripristinare versioni precedenti. Solo i salvataggi manuali creano punti nella cronologia (non il salvataggio automatico).",
-    "disableHistory": "Disattiva cronologia",
-    "disableHistoryWarning": "La disattivazione elimina in modo permanente tutte le versioni salvate per tutti gli utenti. Operazione irreversibile.",
-    "historyDisabled": "La cronologia delle note è stata disattivata e tutti i dati di cronologia sono stati eliminati.",
-    "failedToDisableHistory": "Impossibile disattivare la cronologia",
-    "defaultDateFormat": "Formato data predefinito",
-    "defaultDateFormatDescription": "Utilizzato quando la preferenza del formato data di un utente è impostata su \"Utilizza impostazione predefinita del sistema\".",
-    "defaultTimeFormatDescription": "Utilizzato quando la preferenza del formato dell'ora di un utente è impostata su \"Utilizza impostazione predefinita del sistema\".",
-    "defaultTimeFormat": "Formato ora predefinito",
     "borderRadius": "Raggio dei bordi",
     "borderRadiusDescription": "Imposta l'arrotondamento degli angoli per tutta l'istanza. Gli utenti possono sovrascriverlo nelle impostazioni rapide.",
     "borderRadiusSaved": "Raggio dei bordi salvato",
@@ -1132,6 +1161,9 @@
     "tryAgain": "Riprova",
     "contactSupport": "Contatta supporto",
     "invalidInput": "Input non valido",
+    "invalidEditorSettings": "Le impostazioni dell'editor devono essere un oggetto, non è stato salvato nulla",
+    "invalidEditorSetting": "L'impostazione dell'editor {field} ha il tipo sbagliato, non è stato salvato nulla",
+    "categoryOutOfBounds": "Quella categoria è fuori dalle tue note, quindi non è stato creato nulla",
     "requiredField": "Questo campo è obbligatorio",
     "emailInvalid": "Inserisci un'email valida",
     "passwordTooShort": "La password deve essere di almeno 8 caratteri",
@@ -1139,43 +1171,44 @@
     "networkError": "Errore di rete",
     "timeout": "Tempo scaduto",
     "permissionDenied": "Permesso negato",
-    "requiredPermissions": "Non hai i permessi necessari per eseguire questa azione.",
+    "requiredPermissions": "Non hai il permesso per farlo.",
     "loadError": "Errore Caricamento",
     "failedToLoadCustomEmojis": "Impossibile caricare emoji personalizzate",
-    "emojiDeletedSuccessfully": "Emoji eliminata con successo",
+    "emojiDeletedSuccessfully": "Emoji eliminata",
     "deleteError": "Errore Eliminazione",
     "failedToDeleteEmoji": "Impossibile eliminare emoji",
     "validationError": "Errore Validazione",
     "keywordAndEmojiRequired": "Parola chiave ed emoji sono obbligatorie",
     "duplicateKeyword": "Parola chiave duplicata",
     "keywordAlreadyExists": "La parola chiave esiste già",
-    "emojiUpdatedSuccessfully": "Emoji aggiornata con successo",
-    "emojiCreatedSuccessfully": "Emoji creata con successo",
+    "emojiUpdatedSuccessfully": "Emoji aggiornata",
+    "emojiCreatedSuccessfully": "Emoji creata",
     "saveError": "Errore Salvataggio",
     "failedToSaveEmoji": "Impossibile salvare emoji",
     "failedToLoadCustomCSS": "Impossibile caricare CSS personalizzato",
     "couldNotLoadCustomCSS": "Impossibile caricare CSS personalizzato.",
     "couldNotLoadThemes": "Impossibile caricare i temi.",
-    "customCSSSavedSuccessfully": "CSS personalizzato salvato con successo.",
+    "customCSSSavedSuccessfully": "CSS personalizzato salvato.",
     "themeNotFound": "Tema non trovato.",
-    "themeDeletedSuccessfully": "Tema eliminato con successo.",
+    "themeDeletedSuccessfully": "Tema eliminato.",
     "themeNameRequired": "Il nome del tema è obbligatorio.",
-    "themeSavedSuccessfully": "Tema {action} con successo.",
+    "themeSavedSuccessfully": "Tema {action}.",
     "anUnknownErrorOccurred": "Si è verificato un errore sconosciuto.",
     "usernameRequired": "Username obbligatorio",
     "passwordRequired": "Password obbligatoria",
     "passwordMinLength": "La password deve essere lunga almeno 6 caratteri",
     "passwordsDoNotMatch": "Le password non corrispondono",
-    "userSavedSuccessfully": "Utente {mode} con successo!",
+    "userSavedSuccessfully": "Utente {mode}.",
     "failedToSaveUser": "Impossibile {mode} utente",
     "anErrorOccurred": "Si è verificato un errore.",
     "deleteUserConfirmation": "Eliminare utente \"{username}\"? Non può essere annullato.",
-    "userDeletedSuccessfully": "Utente eliminato con successo!",
-    "failedToDeleteUser": "Impossibile eliminare utente"
+    "userDeletedSuccessfully": "Utente eliminato.",
+    "failedToDeleteUser": "Impossibile eliminare utente",
+    "readOnlyFolder": "Questa cartella è in sola lettura sul server, quindi la modifica non è stata salvata."
   },
   "pwa": {
     "installPromptTitle": "Installa App",
-    "installPromptMessage": "Installa l'app sul tuo dispositivo per un'esperienza migliore",
+    "installPromptMessage": "Installa Jotty sul tuo dispositivo per aprirlo come un'app",
     "installButton": "Installa",
     "updateAvailable": "Aggiornamento Disponibile",
     "updateMessage": "È disponibile una nuova versione",
@@ -1233,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Passa a editor visuale",
     "toggleMarkdownMode": "Passa a markdown",
+    "quickControls": "Controlli dell'editor",
     "toggleBold": "Grassetto",
     "toggleItalic": "Corsivo",
     "toggleUnderline": "Sottolineato",
@@ -1322,15 +1356,15 @@
     "drawioDescription": "Editor di diagrammi visivi",
     "excalidrawDescription": "Editor di diagrammi in stile schizzo",
     "noLanguagesFound": "Nessun linguaggio trovato",
-    "ruler": "Righello",
-    "lineNumbers": "Numeri di riga",
     "callout": "Riquadro",
     "createCallout": "Crea un riquadro informativo",
     "changeCalloutType": "Cambia tipo di riquadro",
     "calloutInfo": "Info",
     "calloutWarning": "Avviso",
     "calloutSuccess": "Successo",
-    "calloutDanger": "Pericolo"
+    "calloutDanger": "Pericolo",
+    "ruler": "Righello",
+    "lineNumbers": "Numeri di riga"
   },
   "sharing": {
     "share": "Condividi",
@@ -1410,7 +1444,7 @@
     "privateKeyExported": "Chiave privata esportata",
     "failedToExportKey": "Export chiave fallito",
     "unexpectedError": "Errore inaspettato",
-    "keysDeleted": "Chiavi eliminate con successo",
+    "keysDeleted": "Chiavi eliminate",
     "failedToDeleteKeys": "Impossibile eliminare le chiavi",
     "autoDecryptUpdated": "Impostazione auto-decriptazione aggiornata",
     "failedToUpdateSetting": "Impossibile aggiornare impostazione",
@@ -1426,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Seleziona metodo",
     "encryptionMethodsTitle": "Metodi Crittografia",
-    "xchachaDescription": "XChaCha20-Poly1305: Moderno, veloce, basato su passphrase",
-    "pgpDescription": "PGP: Crittografia a chiave pubblica tradizionale",
+    "xchachaDescription": "XChaCha20-Poly1305: crittografia con passphrase",
+    "pgpDescription": "PGP: crittografia a chiave pubblica con una coppia di chiavi gestita da te",
     "encryptionKeys": "Chiavi Crittografia",
     "keysConfigured": "Chiavi configurate",
     "algorithm": "Algoritmo: ",
@@ -1441,9 +1475,9 @@
     "keysDisabledInDemo": "Le chiavi salvate sono disabilitate in demo.",
     "encryptionSettings": "Impostazioni Crittografia",
     "promptForPassphrase": "Richiedi passphrase all'apertura note criptate",
-    "promptForPassphraseDescription": "Se abilitato, ti verrà chiesta la passphrase ogni volta che apri una nota criptata. La nota rimane criptata sul server, ma sarà visibile in chiaro nella sessione corrente.",
+    "promptForPassphraseDescription": "Chiede la passphrase quando apri una nota criptata. La nota resta criptata sul server e vedi il contenuto in chiaro solo in questa scheda.",
     "customKeyPath": "Percorso Chiavi Personalizzato (Installazioni Locali)",
-    "customKeyPathDescription": "Specifica un percorso assoluto locale per salvare le chiavi. Utile solo per installazioni locali. Gli utenti Docker dovrebbero mappare il volume in docker-compose.",
+    "customKeyPathDescription": "Un percorso assoluto dove salvare le chiavi. Serve solo per installazioni locali. Gli utenti Docker dovrebbero mappare il percorso predefinito in docker-compose.yml.",
     "customPath": "Percorso Personalizzato",
     "customPathPlaceholder": "/home/user/my-keys",
     "customPathHelp": "Deve essere un percorso assoluto (es. /home/user/my-keys o C:\\Users\\user\\my-keys)",
@@ -1462,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "Il contenuto della nota verrà criptato prima del salvataggio",
     "passphraseRequired": "Passphrase obbligatoria",
     "incorrectPassphrase": "Passphrase non corretta",
-    "noteEncryptedSuccessfully": "Nota criptata con successo",
+    "noteEncryptedSuccessfully": "Nota criptata",
     "failedToEncryptNote": "Impossibile criptare la nota",
-    "noteDecryptedSuccessfully": "Nota decriptata con successo",
+    "noteDecryptedSuccessfully": "Nota decriptata",
     "failedToDecryptNote": "Impossibile decriptare la nota",
     "passphrase": "Passphrase",
     "enterYourPassphrase": "Inserisci la tua passphrase",
@@ -1493,7 +1527,7 @@
     "noStoredKeysFound": "Nessuna chiave salvata trovata",
     "noEncryptionKeysConfigured": "Non hai configurato nessuna chiave di crittografia",
     "pastePublicKeyBelow": "Incolla una chiave pubblica qui sotto per criptare il contenuto della nota",
-    "generateOrImportKeysInProfile": "Puoi generare o importare chiavi specifiche per Jotty in Profilo → Crittografia",
+    "generateOrImportKeysInProfile": "Puoi generare o importare chiavi per Jotty in Profilo > Crittografia",
     "useCustomKey": "Usa chiave personalizzata {keyType}",
     "signWithPrivateKey": "Firma con chiave privata",
     "proveAuthenticityOfNote": "prova l'autenticità di questa nota",
@@ -1513,7 +1547,7 @@
     "yourEmail": "tua@email.com",
     "generating": "Generazione...",
     "generateKeys": "Genera Chiavi",
-    "keysGeneratedSuccessfully": "Chiavi Generate con Successo",
+    "keysGeneratedSuccessfully": "Chiavi generate",
     "importPGPKeys": "Importa Chiavi PGP",
     "publicKeyLabel": "Chiave Pubblica",
     "privateKeyLabel": "Chiave Privata",
@@ -1522,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Ricorda la tua passphrase! Non può essere recuperata.",
     "withoutPassphraseCannotDecrypt": "Senza la passphrase, non puoi decriptare le tue note.",
     "backupPrivateKeySafely": "Fai un backup sicuro della tua chiave privata.",
-    "pgpKeyPairGeneratedSuccessfully": "Coppia di chiavi PGP generata con successo",
+    "pgpKeyPairGeneratedSuccessfully": "Coppia di chiavi PGP generata",
     "failedToGenerateKeys": "Impossibile generare le chiavi",
     "fingerprint": "Impronta",
     "keysSavedSecurely": "Le tue chiavi sono state salvate in modo sicuro.",
@@ -1536,13 +1570,13 @@
     "bothKeysRequired": "Entrambe le chiavi (pubblica e privata) sono richieste",
     "invalidPublicKeyFormat": "Formato chiave pubblica non valido. Deve essere una chiave PGP ASCII-armored.",
     "invalidPrivateKeyFormat": "Formato chiave privata non valido. Deve essere una chiave PGP ASCII-armored.",
-    "keysImportedSuccessfully": "Chiavi importate con successo",
+    "keysImportedSuccessfully": "Chiavi importate",
     "failedToImportKeys": "Impossibile importare le chiavi",
     "created": "Crittografia creata",
     "notePlaceholder": "Sono un segnaposto perché non puoi crittografare una nota vuota."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Queste opzioni si applicano solo alla sessione corrente. Per modifiche permanenti vai su",
+    "sessionOnlyPrefix": "Queste opzioni valgono solo per questa sessione del browser. Per modifiche permanenti vai su",
     "accountSettings": "preferenze utente",
     "autosaveNotes": "Autosalvataggio Note",
     "showNotePreview": "Mostra anteprima note nelle card",
@@ -1571,20 +1605,45 @@
     "migrationSuccessful": "Migrazione Riuscita",
     "returnToApp": "Torna all'App",
     "adminAccessRequired": "Accesso Admin Richiesto",
-    "adminAccessDescription": "Questa migrazione richiede privilegi di amministratore. Contatta un admin per procedere.",
+    "adminAccessDescription": "Questa migrazione richiede un amministratore. Chiedi a uno di eseguirla.",
     "whatsHappening": "Cosa succede?",
-    "sharingDataMigrationDescription": "Il sistema deve migrare i dati di condivisione. È un processo una tantum che richiede accesso admin.",
+    "sharingDataMigrationDescription": "Jotty deve migrare i tuoi dati di condivisione. Succede una sola volta e serve un amministratore.",
     "whatsChanging": "Cosa cambia?",
     "automaticBackupIncluded": "Backup Automatico Incluso",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter è lo Standard Industriale",
-    "noMigrationNeeded": "Nessuna migrazione necessaria - il sistema è già aggiornato.",
-    "importantBackupData": "Importante: Fai il Backup dei Tuoi Dati"
+    "noMigrationNeeded": "Niente da migrare, i tuoi dati sono già aggiornati.",
+    "importantBackupData": "Importante: Fai il Backup dei Tuoi Dati",
+    "sharingNowWithData": "I tuoi dati di condivisione ora stanno insieme alle tue note e cartelle.",
+    "sharingMovesDescription": "La condivisione esce da un file centrale ed entra nei tuoi dati. Ora puoi condividere le cartelle, e le cartelle condivise compaiono nella tua sidebar invece che in una sezione separata.",
+    "whatsHappeningBody": "Ogni condivisione in <code>.sharing.json</code> viene scritta nel frontmatter dell'elemento a cui appartiene, e ogni cartella riceve un <code>.category-info.json</code> con identità, condivisione e ordinamento. I vecchi file vengono rimossi una volta spostati i dati.",
+    "migrationChanges": "Modifiche della migrazione",
+    "sharingTravelsTitle": "La condivisione viaggia con il file",
+    "sharingTravelsBody": "Ogni elemento condiviso registra nel proprio frontmatter con chi è condiviso, quindi spostarlo o rinominarlo non rompe mai una condivisione.",
+    "folderSharingTitle": "Condivisione delle cartelle",
+    "folderSharingBody": "Condividi una cartella e tutto quello che contiene, adesso e in futuro, viene condiviso. Chi la riceve la vede come una normale cartella nella propria sidebar.",
+    "oneFilePerFolderTitle": "Un file per cartella",
+    "oneFilePerFolderBody": "<code>.order.json</code> confluisce in <code>.category-info.json</code>, con l'ordinamento basato sull'uuid invece che sul nome del file.",
+    "permissionsUnchangedTitle": "I permessi non cambiano",
+    "permissionsUnchangedBody": "Lettura, modifica ed eliminazione restano esattamente come sono oggi, per utente e per elemento.",
+    "backupWarningBody": "Questa migrazione riscrive il frontmatter di note e checklist ed elimina i vecchi file <code>.sharing.json</code> e <code>.order.json</code>. Fai un backup della cartella <code>data</code> prima di procedere.",
+    "backupConfirmLabel": "Ho fatto un backup della cartella data e ho capito come funziona la migrazione.",
+    "backupConfirmHint": "Conferma di avere un backup prima di continuare.",
+    "sharingDataMigrated": "I tuoi dati di condivisione e ordinamento sono stati migrati.",
+    "whatWasChanged": "Cosa è cambiato:",
+    "migrationPartial": "Migrazione terminata con file rimasti",
+    "leftoversTitle": "Alcuni vecchi file sono stati tenuti",
+    "leftoversBody": "La migrazione non è riuscita a convertire tutto, quindi i vecchi file qui sotto sono rimasti sul disco intatti. Non è stato eliminato nulla. Puoi risolvere la causa e rilanciare la migrazione, oppure entrare nell'app ora e pensarci più tardi.",
+    "overrideConfirmLabel": "Continua comunque e non mostrare più questa pagina.",
+    "overrideConfirmHint": "I file rimasti restano sul disco, ma l'app considererà i tuoi dati migrati. Condivisioni e ordinamenti elencati sopra non verranno applicati finché non migri di nuovo, cosa che puoi fare in qualsiasi momento da /migration?force=1.",
+    "continueAnyway": "Continua comunque",
+    "overriding": "Continuo...",
+    "overrideFailed": "Impossibile saltare la migrazione"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Categoria rinominata con successo",
+    "categoryRenamedSuccessfully": "Categoria rinominata",
     "failedToRenameCategory": "Rinomina categoria fallita",
     "categoryRenamedSuccessfullyMessage": "Categoria {categoryName} rinominata in {newName}",
-    "failedToRenameCategoryMessage": "Si è verificato un errore durante la rinomina."
+    "failedToRenameCategoryMessage": "Qualcosa è andato storto durante la rinomina della categoria."
   },
   "auditLogs": {
     "title": "Registro Attività",
@@ -1601,7 +1660,7 @@
     "exportJSON": "Esporta JSON",
     "exportCSV": "Esporta CSV",
     "cleanupOldLogs": "Pulisci vecchi log",
-    "confirmCleanup": "Sei sicuro di voler eliminare i log più vecchi di {days} giorni? Questo influenzerà TUTTI gli utenti e non può essere annullato.",
+    "confirmCleanup": "Eliminare i log più vecchi di {days} giorni? Riguarda TUTTI gli utenti e non si può annullare.",
     "confirmCleanupUnlimited": "Nessuna pulizia automatica configurata (conservazione illimitata). Puoi comunque eliminare manualmente i vecchi log se necessario.",
     "deleteAllLogsModalTitle": "Elimina Tutti i Log di Audit",
     "deleteAllLogsWarning": "Questo eliminerà TUTTI i log, non solo quelli vecchi",
@@ -1610,8 +1669,8 @@
     "deleteAllLogsButton": "Elimina Tutti i Log",
     "cleanupSuccess": "Eliminati {count} vecchi log",
     "cleanupError": "Pulizia log fallita",
-    "userDescription": "Vedi tutte le tue attività e azioni nel sistema",
-    "adminDescription": "Vedi e gestisci le attività di tutti gli utenti",
+    "userDescription": "Tutto quello che hai fatto in Jotty",
+    "adminDescription": "Quello che ogni utente ha fatto su questa istanza",
     "level": "Livello",
     "allLevels": "Tutti i livelli",
     "allCategories": "Tutte le categorie",
@@ -1651,7 +1710,6 @@
     "notedecrypted": "Nota Decriptata",
     "noteeditedencrypted": "Nota Modificata (Criptata)",
     "notesavedencrypted": "Nota Salvata (Criptata)",
-    "itemShared": "Elemento Condiviso",
     "itemshared": "Elemento Condiviso",
     "itemunshared": "Elemento Non più condiviso",
     "sharepermissionsupdated": "Permessi Condivisione Aggiornati",
@@ -1676,9 +1734,9 @@
     "topActions": "Azioni Principali",
     "mostActiveUsers": "Utenti più attivi",
     "oldLogsFound": "Ci sono {count} file di log più vecchi di {days} giorni.",
-    "oldLogsFoundDescription": "Vuoi pulirli? Questa azione non può essere annullata.",
+    "oldLogsFoundDescription": "Vuoi pulirli? Non si può annullare.",
     "cleanUpNow": "Pulisci Ora",
-    "cleanupSuccessMessage": "Eliminati con successo {count} vecchi file di log.",
+    "cleanupSuccessMessage": "Eliminati {count} vecchi file di log.",
     "security": "Sicurezza",
     "mfasecretgenerated": "Segreto MFA Generato",
     "mfaenabled": "MFA Attivato",
@@ -1694,6 +1752,7 @@
     "howTo": "Come fare",
     "shortcuts": "Scorciatoie",
     "markdownGuide": "Guida Markdown",
+    "brain": "Link e Brain",
     "customisations": "Personalizzazioni",
     "docker": "Docker",
     "envVariables": "Variabili d'ambiente",
@@ -1701,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "Crittografia",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Traduzioni",
     "unraid": "Unraid",
     "patches": "Patch"
@@ -1712,33 +1772,9 @@
     "seenCount": "Hai visto {count} {count, plural, one {haiku} other {haiku}}",
     "imNoPoet": "Non sono un poeta, e nemmeno Jotty. Queste sono parole casuali in sequenza."
   },
-  "history": {
-    "fetchError": "Impossibile caricare la cronologia",
-    "restoreError": "Impossibile ripristinare la versione",
-    "manualSavesOnly": "La cronologia viene creata solo con i salvataggi manuali, non con quelli automatici.",
-    "noHistory": "Nessuna cronologia disponibile",
-    "noHistoryDescription": "Salva la nota per creare un punto nella cronologia.",
-    "restore": "Ripristina",
-    "loadMore": "Carica altro",
-    "viewContent": "Visualizza contenuto",
-    "viewDiff": "Visualizza modifiche",
-    "noteHistory": "Cronologia della nota",
-    "restoreVersion": "Ripristina versione",
-    "restoreConfirm": "Ripristinare questa versione? \nIl contenuto attuale verrà sostituito.",
-    "featureDisabled": "Cronologia disattivata",
-    "disabledAdmin": "La cronologia delle note è attualmente disattivata. Puoi abilitarla nelle Impostazioni amministratore > Editor.",
-    "disabledUser": "La cronologia delle note è attualmente disattivata. Contatta il tuo amministratore per abilitare questa funzione.",
-    "goToSettings": "Vai alle impostazioni",
-    "actionCreate": "Creato",
-    "actionUpdate": "Aggiornato",
-    "actionRename": "Rinominato",
-    "actionMove": "Spostato",
-    "actionDelete": "Eliminato",
-    "actionInit": "Inizializzato",
-    "actionUnknown": "Modificato"
-  },
   "notifications": {
     "title": "Notifiche",
+    "unread": "non letto",
     "markAllRead": "Segna tutto letto",
     "clearAll": "Cancella tutto",
     "empty": "Nessuna notifica",
@@ -1746,12 +1782,99 @@
     "assignmentMessage": "\"{task}\" in \"{board}\"",
     "reminderTitle": "Compito in ritardo",
     "reminderMessage": "\"{task}\" in \"{board}\" ha superato il promemoria",
-    "unread": "non letto",
     "sharingTitle": "{user} ha condiviso un {type} con te",
     "sharingMessage": "Apri per vedere il {type} condiviso",
     "sharingFolderTitle": "{user} ha condiviso una cartella {type} con te",
-    "sharingFolderMessage": "Apri per vedere “{folder}”",
+    "sharingFolderMessage": "Apri per vedere \"{folder}\"",
     "mentionTitle": "{user} ti ha menzionato in un commento",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
+  },
+  "relations": {
+    "indexing": "Indicizzazione dei collegamenti...",
+    "unreachable": "non raggiungibile",
+    "createFromWikilink": "Crea una nota chiamata \"{title}\"",
+    "mentionedIn": "Menzionata in",
+    "mentionedInHint": "Queste note usano questo titolo come testo semplice. Collegane una per connetterla.",
+    "linkMention": "Collega",
+    "linked": "Menzione collegata in {title}",
+    "linkFailed": "Impossibile collegare quella menzione",
+    "kind": {
+      "mention": "Link",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "Brain",
+    "openBrain": "Apri nel brain",
+    "search": "Cerca qualcosa nel tuo brain...",
+    "dimension": "Vista",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Intorno a questo elemento",
+    "global": "Tutto",
+    "depth": "Profondità {depth}",
+    "colourBy": "Colora per",
+    "colourModes": {
+      "type": "Tipo",
+      "category": "Categoria"
+    },
+    "filters": {
+      "notes": "Note",
+      "checklists": "Checklist",
+      "tags": "Tag",
+      "ghosts": "Non ancora scritte",
+      "suggestions": "Suggerimenti",
+      "orphans": "Solitari"
+    },
+    "kind": {
+      "note": "Nota",
+      "checklist": "Checklist",
+      "ghost": "Non ancora scritta",
+      "tag": "Tag"
+    },
+    "edges": {
+      "mention": "Link",
+      "wiki": "Wikilink",
+      "suggested": "Suggerito",
+      "tag": "Tag"
+    },
+    "linksTo": "Collega a",
+    "linkedFrom": "Collegata da",
+    "suggested": "Potrebbe essere correlato",
+    "promote": "Collega a {title}",
+    "lonely": "Qui non si collega ancora niente. Menzionalo con @ o [[ da un'altra nota.",
+    "open": "Apri",
+    "createGhost": "Scrivi questa nota",
+    "openTag": "Mostra tutto con questo tag",
+    "createFailed": "Impossibile creare quella nota",
+    "connectFailed": "Impossibile collegare quei due",
+    "connected": "{source} collegato a {target}",
+    "empty": "Il tuo brain è tranquillo. Collega note e checklist con @ o [[ e compariranno qui.",
+    "viewingOwner": "Stai guardando il brain di {owner}",
+    "summary": "{items} elementi, {links} link, {shown} mostrati"
+  },
+  "apiExplorer": {
+    "title": "Esploratore API",
+    "intro": "Tutti gli endpoint che questa istanza (v{version}) espone, generati dal codice che li serve. Scegline uno, compilalo e invialo.",
+    "realData": "Le richieste girano come il proprietario della API key, su dati reali. Un DELETE qui elimina davvero.",
+    "apiKey": "API key",
+    "apiKeyHint": "Resta solo su questa pagina e viene dimenticata quando esci.",
+    "useMyKey": "Usa la mia chiave",
+    "noKeyYet": "Non hai ancora una API key. Generala nelle impostazioni del profilo.",
+    "filter": "Filtra",
+    "filterPlaceholder": "Percorso, nome o metodo",
+    "noMatches": "Niente corrisponde a quel filtro.",
+    "body": "Corpo della richiesta (JSON)",
+    "showSchema": "Mostra schema",
+    "hideSchema": "Nascondi schema",
+    "send": "Invia",
+    "sending": "Invio...",
+    "keyRequired": "Aggiungi prima una API key.",
+    "noKeyNeeded": "nessuna API key necessaria",
+    "deprecated": "deprecato",
+    "requestFailed": "La richiesta non ha mai raggiunto il server. Controlla la connessione.",
+    "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/klingon.json b/app/_translations/klingon.json
index 8530c90c8..82d43cc10 100644
--- a/app/_translations/klingon.json
+++ b/app/_translations/klingon.json
@@ -127,6 +127,7 @@
     "expandAll": "Hoch Sach",
     "saveChanges": "choH Pol",
     "all": "Hoch",
+    "items": "chelmey",
     "showAll": "Hoch yIcha'",
     "creating": "chenmoHlI'...",
     "createCategoryHeader": "Segh chu' yIchenmoH",
@@ -173,7 +174,7 @@
     "noResults": "pagh tu'lu'",
     "by": "{owner} ghaH",
     "unsavedChanges": "choHmey Polbe'lu'",
-    "unsavedChangesDetected": "⚠️ choHmey Polbe'lu' tu'lu'",
+    "unsavedChangesDetected": "choHmey Polbe'lu' tu'lu'",
     "unsavedChangesMessage": "{noteTitle}Daq choHmey Dapolbe'pu'. bImejchugh, vaj choHmey chIl.",
     "whatToDoWithUnsavedChanges": "chay' choHmey Dapolbe'pu' Dalo' DaneH?",
     "discard": "woD",
@@ -247,36 +248,9 @@
     "connected": "Connected",
     "reconnecting": "Reconnecting...",
     "hide": "So'",
-    "items": "chelmey",
     "thisEntry": "this entry",
     "preview": "leghpre'"
   },
-  "comments": {
-    "title": "QIch",
-    "titleWithCount": "{count, plural, other {# QIch}}",
-    "noComments": "QIch DIj tu'lu'be'. jatlh choH!",
-    "addComment": "QIch DIj chel...",
-    "replyPlaceholder": "jang qon...",
-    "post": "ngeH",
-    "reply": "jang",
-    "edit": "choH",
-    "delete": "Qaw'",
-    "save": "pol",
-    "cancel": "qIl",
-    "edited": "choHpu'",
-    "deleteConfirmTitle": "QIch DIj Qaw'",
-    "deleteConfirmMessage": "QIch DIj jang je Qaw'. choH laHbe'.",
-    "commentDeleted": "QIch DIj Qaw'pu'",
-    "commentAdded": "QIch DIj chelpu'",
-    "commentUpdated": "QIch DIj choHpu'",
-    "failedToAdd": "QIch DIj chel laHbe'",
-    "failedToEdit": "QIch DIj choH laHbe'",
-    "failedToDelete": "QIch DIj Qaw' laHbe'",
-    "failedToLoad": "QIch DIj tu' laHbe'",
-    "readOnly": "DIj Qab DIj laH. DIj DIj Qab DIj.",
-    "replyTo": "{author} jang",
-    "noUsersFound": "tlhInganpu' tu'lu'be'"
-  },
   "history": {
     "noteHistory": "ghItlh Qu' tetlh",
     "restore": "SabHa'",
@@ -286,7 +260,7 @@
     "noHistoryDescription": "ghItlhlIj yIPol vaj Qu' tetlh DachenmoH.",
     "loadMore": "latlh yISuq",
     "featureDisabled": "Qu' tetlh Qot",
-    "disabledAdmin": "ghItlh Qu' tetlh Qot. SeHDaq yIchu'.",
+    "disabledAdmin": "ghItlh Qu' tetlh Qot. Admin Settings > EditorDaq yIchu'.",
     "disabledUser": "ghItlh Qu' tetlh Qot. ra'wI' yIghel.",
     "goToSettings": "SeH yIghoS",
     "manualSavesOnly": "nIteb Polbe', lo'wI' Pol neH poQ Qu' tetlh.",
@@ -382,7 +356,7 @@
     "regenerateRecoveryCodeWarning": "ToD mI' tlhIng yIQaw'",
     "regenerateRecoveryCodeDescription": "ToD mI' chu' DachenmoHmeH mI' yIghItlh. Qapbe' mI' tlhIng.",
     "recoveryCodeRegenerated": "ToD mI' chu' chen",
-    "recoveryCodeRegeneratedInfo": "ToD mI' chu' chen. yIPol - pIj Daleghbe'.",
+    "recoveryCodeRegeneratedInfo": "ToD mI' chu' chen. yIPol, wa'logh neH Dalegh.",
     "recoveryCodeRegeneratedSuccess": "ToD mI' chu' Qapla'",
     "recoveryCodeProfileDescription": "jan lI'be'chugh, ToD mI'vam yIlo'",
     "disableMfaForUser": "lo'wI'vamvaD cha'logh ngu'aS yIQotmoH",
@@ -397,7 +371,7 @@
     "recent": "ghItlh tlhIng",
     "browseAndManage": "ghItlhmey yInuD 'ej yIvu'",
     "noNotesYet": "ghItlhmey tu'be'lu'",
-    "createFirstNote": "bItaghmeH ghItlh wa'DIch yIchenmoH.",
+    "createFirstNote": "Pagh tu'lu'. ghItlh wa'DIch yIchenmoH.",
     "createNewNote": "ghItlh chu' yIchenmoH",
     "noNotesFound": "ghItlh tu'be'lu'",
     "tryAdjustingFilters": "vI'mey yIchoH pagh ghItlh chu' yIchenmoH.",
@@ -428,22 +402,26 @@
     "enterNoteTitle": "ghItlh pong yIghItlh...",
     "byType": "Segh lo'",
     "publiclySharedNote": "HochvaD lI'",
+    "sharedPubliclyBy": "{owner} HochvaD ghItlhvam ngeH",
     "copyRawContent": "markdown yIlan",
     "quickSave": "Do' Pol",
     "noteNotFound": "ghItlh tu'be'lu'",
     "unarchiveNote": "ghItlh yISabHa'",
     "enterNoteName": "ghItlh pong yIghItlh...",
     "updateNote": "ghItlh yIchoH",
-    "tags": "meq",
-    "noTagsFound": "meqmey tu'be'lu'",
-    "searchTags": "meqmey yInej...",
     "printSaveAsPdf": "nagh / PDF rur pol",
     "tableOfContents": "De'wI' tetlh",
     "wordCount": "{count, plural, one {# mu'} other {# mu'mey}}",
     "charCount": "{count, plural, one {# Degh} other {# Deghmey}}",
-    "readingTime": "{count, plural, one {# tup laD} other {# tupmey laD}}"
+    "readingTime": "{count, plural, one {# tup laD} other {# tupmey laD}}",
+    "tags": "meq",
+    "noTagsFound": "meqmey tu'be'lu'",
+    "searchTags": "meqmey yInej...",
+    "createNoteFailed": "ghItlh chenmoH Qapla'be'",
+    "createCategoryFailed": "Segh chenmoH Qapla'be', ghItlh chenmoHbe'lu'"
   },
   "checklists": {
+    "sharedPubliclyBy": "{owner} HochvaD tetlhvam ngeH",
     "title": "tetlhmey",
     "allChecklists": "Hoch tetlhmey",
     "completed": "rIn",
@@ -457,7 +435,7 @@
     "progress": "Ser",
     "totalItems": "Hoch Dochmey",
     "noChecklistsYet": "tetlhmey tu'be'lu'",
-    "createFirstChecklist": "Qu'mey Davu'meH tetlh wa'DIch yIchenmoH.",
+    "createFirstChecklist": "Pagh tu'lu'. tetlh wa'DIch yIchenmoH.",
     "newChecklist": "tetlh chu'",
     "noChecklistsFound": "tetlhmey tu'be'lu'",
     "tryAdjustingFiltersChecklist": "vI'mey yIchoH pagh tetlh chu' yIchenmoH.",
@@ -499,6 +477,7 @@
     "checklistType": "tetlh Segh",
     "simpleChecklist": "tetlh nap",
     "taskProject": "Qu' he",
+    "kanbanBoard": "Kanban beQ",
     "basicTodoItems": "Qu'mey nap",
     "withTimeTracking": "poH nger ghaj",
     "noDescription": "Delbe'",
@@ -525,14 +504,14 @@
     "clearAllCompletedConfirmMessage": "Hoch {count} Dochmey rIn DaQaw' DaneH'a'? SabHa'laHbe'.",
     "clearAllIncompleteConfirmMessage": "Hoch {count} Dochmey rInbe' DaQaw' DaneH'a'? SabHa'laHbe'.",
     "convertChecklistType": "tetlh Segh yIchoH",
-    "convertTypeConfirmation": "{currentType}vo' {newType}Daq bIchoH. bIvang DaneH'a'?",
-    "dataLossWarning": "⚠️ De' chIl ghuH",
+    "convertTypeConfirmation": "{currentType}vo' {newType}Daq bIchoH'a'?",
+    "dataLossWarning": "De' chIl ghuH",
     "dataLossWarningItems": "De'vam chIllu':",
     "allTaskStatusesReset": "Qu' ghu'mey choHqa'lu'",
     "timeTrackingDataLost": "poH nger De' chIllu'",
     "estimatedTimesRemoved": "poH nger chIllu'",
     "targetDatesCleared": "rIn jajmey chIllu'",
-    "enhancedFeatures": "✨ patmey HoS",
+    "enhancedFeatures": "patmey HoS",
     "enhancedFeaturesYouWillGain": "Daghaj:",
     "kanbanBoardWithDragDrop": "Kanban beQ",
     "taskStatusTracking": "Qu' ghu' (vang, rIn, latlh)",
@@ -542,6 +521,7 @@
     "convert": "choH",
     "convertToSimpleChecklist": "tetlh nap yIchoH",
     "convertToTaskProject": "Qu' he yIchoH",
+    "convertToKanbanBoard": "Kanban beQ DachoH",
     "pasteYourList": "tetlhlIj yIHu' (wa' Doch, wa' rI')",
     "addItems": "{count} Dochmey yIchel",
     "itemsWillBeAdded": "{count} Dochmey chellu'",
@@ -550,11 +530,35 @@
     "noItemsYet": "Dochmey tu'be'lu'",
     "addFirstItem": "bItaghmeH Doch wa'DIch yIchel!",
     "noTasks": "Qu'mey tu'be'lu'",
-    "noSubtasksYet": "Qu'Hommey tu'be'lu'. bItaghmeH wa' yIchel.",
+    "noSubtasksYet": "Qu'Hommey tu'be'lu'. bIngDaq wa' yIchel.",
     "addTime": "poH yIchel",
-    "enterTimeInMinutes": "tupmey yIghItlh",
-    "convertToKanbanBoard": "Kanban beQ DachoH",
-    "kanbanBoard": "Kanban beQ"
+    "enterTimeInMinutes": "tupmey yIghItlh"
+  },
+  "comments": {
+    "title": "QIch",
+    "titleWithCount": "{count, plural, other {# QIch}}",
+    "noComments": "QIch DIj tu'lu'be'. jatlh choH!",
+    "addComment": "QIch DIj chel...",
+    "replyPlaceholder": "jang qon...",
+    "post": "ngeH",
+    "reply": "jang",
+    "edit": "choH",
+    "delete": "Qaw'",
+    "save": "pol",
+    "cancel": "qIl",
+    "edited": "choHpu'",
+    "deleteConfirmTitle": "QIch DIj Qaw'",
+    "deleteConfirmMessage": "QIch DIj jang je Qaw'. choH laHbe'.",
+    "commentDeleted": "QIch DIj Qaw'pu'",
+    "commentAdded": "QIch DIj chelpu'",
+    "commentUpdated": "QIch DIj choHpu'",
+    "failedToAdd": "QIch DIj chel laHbe'",
+    "failedToEdit": "QIch DIj choH laHbe'",
+    "failedToDelete": "QIch DIj Qaw' laHbe'",
+    "failedToLoad": "QIch DIj tu' laHbe'",
+    "readOnly": "DIj Qab DIj laH. DIj DIj Qab DIj.",
+    "replyTo": "{author} jang",
+    "noUsersFound": "tlhInganpu' tu'lu'be'"
   },
   "tasks": {
     "title": "Qu'mey",
@@ -583,7 +587,7 @@
     "overdue": "poH nung",
     "browseAndManageTaskLists": "Qu' tetlhmey yInuD 'ej yIvu'",
     "noTaskListsYet": "Qu' tetlhmey tu'be'lu'",
-    "createFirstTaskList": "Qu'mey Davu'meH Qu' tetlh wa'DIch yIchenmoH.",
+    "createFirstTaskList": "Pagh tu'lu'. Qu' tetlh wa'DIch yIchenmoH.",
     "newTaskList": "Qu' tetlh chu'",
     "taskLists": "Qu' tetlhmey",
     "noTaskListsFound": "Qu' tetlhmey tu'be'lu'",
@@ -631,7 +635,7 @@
     "changeStatus": "ghu' yIchoH",
     "noBoards": "beQmey lutu'lu'be'",
     "noBoardsYet": "Kanban beQmey not yet",
-    "createFirstBoard": "Kanban beQ wa' yIchel 'ej QInmey yIvu'.",
+    "createFirstBoard": "Pagh tu'lu'. Kanban beQ wa'DIch yIchenmoH.",
     "newBoard": "beQ chu'",
     "tryAdjustingFilters": "Filter yIchoH pagh beQ chu' yIchel.",
     "completed": "rIn",
@@ -815,10 +819,10 @@
     "chooseAutoSaveInterval": "poH yIwIv vaj nIteb Pol.",
     "defaultMode": "maS mode",
     "selectNotesDefaultMode": "ghItlh maS mode yIwIv",
-    "chooseNotesDefaultMode": "nIteb choH pagh nIteb legh {mode}.",
+    "chooseNotesDefaultMode": "ghItlh DapoSmoHDI' choH mIw yIwIv. ghItlh choHwI'Daq {mode} leQ Dalo'DI' reH DachoHlaH.",
     "defaultEditor": "maS choHwI'",
     "selectNotesDefaultEditor": "ghItlh maS choHwI' yIwIv",
-    "chooseDefaultEditor": "ghItlh maS choHwI' yIwIv - ({editor} yIwIvlaH).",
+    "chooseDefaultEditor": "ghItlh choHwI' yIwIv. ghItlh choHwI'Daq {editor} leQ Dalo'DI' reH DachoHlaH.",
     "tableSyntaxInNotes": "ghItlh Saras mIw",
     "selectTableSyntax": "Saras mIw yIwIv",
     "chooseTableSyntax": "chay' Saras cha'lu'.",
@@ -827,7 +831,7 @@
     "chooseSyntaxTheme": "Markdown Hurgh yIwIv.",
     "minimalMode": "nap mode (Rich Text Editor QotmoH)",
     "selectMinimalMode": "nap mode yIwIv",
-    "minimalModeDescription": "markdown nap lo'. Rich Text Editor Qot.",
+    "minimalModeDescription": "markdown nap lo', Rich Text Editor ghobe'. mIwvamDaq cha'logh rar 'ej latlh pat HoS Qapbe'.",
     "defaultNoteFilter": "maS ghItlh vI'",
     "selectDefaultNoteFilter": "maS ghItlh vI' yIwIv",
     "chooseDefaultNoteFilter": "bI'elDI' vI' yIwIv.",
@@ -865,6 +869,7 @@
     "seconds_plural": "{count} lup",
     "hours12": "12 rep",
     "hours24": "24 rep",
+    "useSystemDefault": "Use system default",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "maS",
@@ -939,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "Kanban tetlhmeyvo' poH qonwI' je Sessions So'lu'. tetlh De'Daq poH qon lurarlu'.",
     "selectStatusOnCards": "ngoq leghlaHghach wIv",
     "codeBlockChoice": "Choose the code block style",
-    "themedCodeBlock": "Themed codeblock",
     "defaultCodeBlock": "Codepen (default)",
+    "themedCodeBlock": "Themed codeblock",
     "codeBlockChoiceDescription": "Choose between the codepen-like default code block style or a themed codeblock style.",
     "checklistItemClickAction": "Checklist item click action",
     "selectChecklistItemClickAction": "Select checklist item click action",
-    "checklistItemClickActionDescription": "Choose what happens when you click a task's text. \"Mark as complete\" toggles the checkbox  (default); \"Edit task name\" opens the task for inline editing — you'll still need to click the checkbox itself to complete it.",
+    "checklistItemClickActionDescription": "Qu' ghItlh DaweQDI' nuq qaS yIwIv. \"Mark as complete\" (motlh) checkbox choH. \"Edit task name\" Qu' pong choHmeH poSmoH, 'ej rInmoHmeH checkbox'e' yIweQ.",
     "checklistItemClickActionToggle": "Mark as complete/incomplete",
     "checklistItemClickActionEdit": "Edit list item",
     "newItemInsertion": "New item insertion",
@@ -952,7 +957,6 @@
     "newItemInsertionDescription": "Choose whether new items are added to the top (default) or the bottom of a checklist.",
     "newItemInsertionTop": "Top of the list",
     "newItemInsertionBottom": "Bottom of the list",
-    "useSystemDefault": "Use system default",
     "selectShowChecklistEmojis": "Emoji cha'ghach yIwIv",
     "showChecklistEmojisDescription": "mu'mey ghop tetlh Segh Emoji cha' pagh."
   },
@@ -995,13 +999,17 @@
     "icon512": "512x512 De'nI'",
     "icon512Description": "PWA De'nI'.",
     "notifyNewUpdates": "chu' De' yInob",
-    "thisUsesGithubAPI": "GitHub API lo'. Qotchugh, GitHub lo'be'.",
+    "thisUsesGithubAPI": "chu'mey nejmeH GitHub API lo'. Qotchugh, GitHub ghoSbe' Pagh, ghoSbe' GitHub vo' Pagh.",
     "parseContent": "De' cha' pIla'",
     "parseContentEnabledDescription": "chuchugh, pongmey cha'.",
     "parseContentDisabledDescription": "Qotchugh, pongmey nap cha'.",
     "parseContentPerformanceWarning": "\"ghobe'\" Dalo'chugh, nom Qap.",
     "hideLanguageSelector": "Hol wIv yISo'",
     "hideLanguageSelectorDescription": "Hol wIv yISo'",
+    "defaultDateFormat": "Default Date Format",
+    "defaultDateFormatDescription": "Used when a user's date format preference is set to \"Use system default\".",
+    "defaultTimeFormat": "Default Time Format",
+    "defaultTimeFormatDescription": "Used when a user's time format preference is set to \"Use system default\".",
     "applicationIcons": "De'wI' De'nI'mey",
     "saveChanges": "choHmey yIPol",
     "unsavedChanges": "choHmey Dapolbe'pu'.",
@@ -1063,17 +1071,17 @@
     "drawioUrlDescription": "Draw.io URL yIghItlh.",
     "drawioUrlExample": "URL: https://your-domain.com/drawio",
     "drawioProxyEnabled": "Jotty Draw.io Proxy",
-    "drawioProxyEnabledDescription": "Jotty server lo' Draw.io.",
+    "drawioProxyEnabledDescription": "Jotty server lo' Draw.io. Docker URLmey (e.g., http://drawio:8080) lo'wI' browser ghoSlaHbe'bogh poQ.",
     "excalidrawUrl": "Excalidraw URL",
     "excalidrawUrlDescription": "Excalidraw URL yIghItlh.",
     "excalidrawUrlExample": "URL: https://your-domain.com/excalidraw",
     "excalidrawProxyEnabled": "Jotty Excalidraw Proxy",
-    "excalidrawProxyEnabledDescription": "Jotty server lo' Excalidraw.",
+    "excalidrawProxyEnabledDescription": "Jotty server lo' Excalidraw. Docker URLmey (e.g., http://excalidraw:3000) lo'wI' browser ghoSlaHbe'bogh poQ.",
     "saving": "Pol'lI'...",
     "editorSettingsSaved": "choHwI' SeH Pol Qapla'.",
     "customEmojis": "Emoji TIgh",
     "noEmojisYet": "Custom emojis tu'be'lu'. &quot;Emoji yIchel&quot; yIwIv.",
-    "enterAnyEmoji": "Emoji yIghItlh (Win: Win+.; Mac: Ctrl+Cmd+Space",
+    "enterAnyEmoji": "Emoji yIghItlh pagh emoji wIvwI' yIlo' (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "ghom ghu'",
     "detailedSharingBreakdown": "ghom ghu' Del",
     "checkForUpdates": "chu' yInej",
@@ -1138,10 +1146,6 @@
     "updateTagsTitle": "meqmey yInej 'ej frontmatter yIchoH",
     "tagsUpdated": "{processed} teywI'mey, {updated} meqmey chu'",
     "failedToUpdateTags": "meqmey choH Qapla'be'",
-    "defaultDateFormat": "Default Date Format",
-    "defaultDateFormatDescription": "Used when a user's date format preference is set to \"Use system default\".",
-    "defaultTimeFormatDescription": "Used when a user's time format preference is set to \"Use system default\".",
-    "defaultTimeFormat": "Default Time Format",
     "borderRadius": "veH lermoHwI'",
     "borderRadiusDescription": "Hoch pat veH lermoHghach wIv. lo'wI'pu' chaH DIvI' choH laH.",
     "borderRadiusSaved": "veH lermoHwI' polta'",
@@ -1157,6 +1161,9 @@
     "tryAgain": "yInIDqa'",
     "contactSupport": "QaH yIghel",
     "invalidInput": "De' lughbe'",
+    "invalidEditorSettings": "choHwI' SeH object 'oHnIS, Pagh Pollu'",
+    "invalidEditorSetting": "choHwI' SeH {field} Segh muj, Pagh Pollu'",
+    "categoryOutOfBounds": "ghItlhmeylIj HurDaq Seghvam tu'lu', Pagh chenmoHlu'",
     "requiredField": "De' poQ",
     "emailInvalid": "QIn lughbe'",
     "passwordTooShort": "mu'pe' nI'be'",
@@ -1164,7 +1171,7 @@
     "networkError": "ghom Qagh",
     "timeout": "poH nung",
     "permissionDenied": "chaw'be'lu'",
-    "requiredPermissions": "Dochvam vIta'laHbe' — chaw' Daghajbe'.",
+    "requiredPermissions": "Dochvam Data'laHbe', chaw' Daghajbe'.",
     "loadError": "Su' Qagh",
     "failedToLoadCustomEmojis": "Custom Emojis Su' Qapla'be'",
     "emojiDeletedSuccessfully": "Emoji Qaw' Qapla'",
@@ -1196,7 +1203,8 @@
     "anErrorOccurred": "Qagh tu'lu'.",
     "deleteUserConfirmation": "\"{username}\" DaQaw' DaneH'a'? SabHa'laHbe'.",
     "userDeletedSuccessfully": "lo'wI' Qaw' Qapla'!",
-    "failedToDeleteUser": "lo'wI' Qaw' Qapla'be'"
+    "failedToDeleteUser": "lo'wI' Qaw' Qapla'be'",
+    "readOnlyFolder": "serverDaq qachvam laD neH, choH PollaHbe'lu'."
   },
   "pwa": {
     "installPromptTitle": "De'wI' yIlan",
@@ -1258,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Rich ChoHwI' yIchoH",
     "toggleMarkdownMode": "Markdown Mode yIchoH",
+    "quickControls": "choHwI' SeHlaw",
     "toggleBold": "tIq yIchoH",
     "toggleItalic": "vIH yIchoH",
     "toggleUnderline": "bIng tlhegh yIchoH",
@@ -1517,7 +1526,7 @@
     "privateKey": "So' pegh mI'",
     "noStoredKeysFound": "pegh mI'mey tu'be'lu'",
     "noEncryptionKeysConfigured": "pegh mI'mey Daghajbe'",
-    "pastePublicKeyBelow": "Hoch pegh mI' yIHu'",
+    "pastePublicKeyBelow": "ghItlh peghmeH, bIngDaq Hoch pegh mI' yIHu'",
     "generateOrImportKeysInProfile": "Profile > EncryptionDaq pegh mI' yIchenmoH",
     "useCustomKey": "{keyType} pegh mI' tIgh yIlo'",
     "signWithPrivateKey": "So' pegh mI' yIlo'",
@@ -1602,14 +1611,39 @@
     "whatsChanging": "choH?",
     "automaticBackupIncluded": "nIteb nIng",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter lo'",
-    "noMigrationNeeded": "choH poQbe' - pat chu'.",
-    "importantBackupData": "Potlh: De' yInIng"
+    "noMigrationNeeded": "choH poQbe', pat chu'.",
+    "importantBackupData": "Potlh: De' yInIng",
+    "sharingNowWithData": "DaH ghItlhmeylIj qachmeylIj je tlhej ngeH De'.",
+    "sharingMovesDescription": "ngeH De' botlh De'wI' teq 'ej De'lIjDaq lan. DaH qachmey ngeHlaHlu', 'ej qachmey ngeHlu'bogh sidebarlIjDaq Du'ang, latlh DoqDaq ghobe'.",
+    "whatsHappeningBody": "<code>.sharing.json</code>Daq Hoch ngeH Dochvetlh frontmatterDaq ghItlhlu', 'ej Hoch qach <code>.category-info.json</code> ghaj, pong ngeH ra' je ngaSbogh. De' vIHDI' De'wI' tlhIngmey teqlu'.",
+    "migrationChanges": "choHmey",
+    "sharingTravelsTitle": "De'wI' tlhej ngeH",
+    "sharingTravelsBody": "Hoch Doch ngeHlu'bogh frontmatterDaq nuvpu' ngeHlu'bogh qon, vaj DavIHDI' pagh pong DachoHDI' ngeH ghorbe'.",
+    "folderSharingTitle": "qach ngeH",
+    "folderSharingBody": "qach DangeHchugh, Hoch Doch naDevbogh, DaH je leSpoH, ngeHlu' je. sidebarchajDaq qach motlh legh nuvpu' HevwI'.",
+    "oneFilePerFolderTitle": "Hoch qachvaD wa' De'wI'",
+    "oneFilePerFolderBody": "<code>.category-info.json</code>Daq <code>.order.json</code> muvlu', 'ej uuid lo' ra', pong ghobe'.",
+    "permissionsUnchangedTitle": "chaw'mey choHbe'",
+    "permissionsUnchangedBody": "laD, choH, Qaw' je DaH rurmo' choHbe', Hoch lo'wI' Hoch Doch je.",
+    "backupWarningBody": "ghItlhmeylIj tetlhmeylIj je frontmatter ghItlhqa' choHvam, 'ej <code>.sharing.json</code> <code>.order.json</code> je Qaw'. bItaghpa' <code>data</code> qachlIj yInIng.",
+    "backupConfirmLabel": "data qachwIj vInIngpu' 'ej choH mIw vIyaj.",
+    "backupConfirmHint": "bItaghpa' De' DanIngpu' 'e' yIchaw'.",
+    "sharingDataMigrated": "ngeH ra' De'lIj choHpu'lu'.",
+    "whatWasChanged": "nuq choHlu'pu'?",
+    "migrationPartial": "choH rIn, 'ach De'wI' ratlh",
+    "leftoversTitle": "De'wI' tlhIngmey 'op ratlh",
+    "leftoversBody": "Hoch mughlaHbe' choH, vaj De'wI' tlhIngmey bIngDaq ratlh, Hotbe'lu'. Pagh Qaw'lu'. meq yItI' 'ej choH yItaghqa', pagh DaH De'wI' yI'el 'ej ghIq yIvang.",
+    "overrideConfirmLabel": "yIruch 'ej naDev Hablu'be'jaj.",
+    "overrideConfirmHint": "De'wI' ratlhbogh Qaw'be'lu', 'ach choH rIn 'e' Hoch De'wI' Qub. naDev ngeH ra' je Dalo'be'taHvIS choHqa'. /migration?force=1 Dalo'DI' reH choHqa'laH.",
+    "continueAnyway": "yIruch",
+    "overriding": "ruchlI'...",
+    "overrideFailed": "choH SuDlaHbe'"
   },
   "toasts": {
     "categoryRenamedSuccessfully": "Segh pong choH Qapla'",
     "failedToRenameCategory": "Segh pong choH Qapla'be'",
     "categoryRenamedSuccessfullyMessage": "Segh {categoryName} pong choH: {newName}",
-    "failedToRenameCategoryMessage": "Segh pong choH Qapla'be'."
+    "failedToRenameCategoryMessage": "Segh pong choHtaHvIS Qagh tu'lu'."
   },
   "auditLogs": {
     "title": "Qagh De'",
@@ -1659,13 +1693,9 @@
     "login": "'el",
     "logout": "mej",
     "register": "ghItlh",
-    "sessionTerminated": "poH rIn",
     "sessionterminated": "poH rIn",
-    "userCreated": "lo'wI' chen",
     "usercreated": "lo'wI' chen",
-    "userUpdated": "lo'wI' choH",
     "userupdated": "lo'wI' choH",
-    "userDeleted": "lo'wI' Qaw'",
     "userdeleted": "lo'wI' Qaw'",
     "profileupdated": "ghantoH choH",
     "checklistcreated": "tetlh chen",
@@ -1722,6 +1752,7 @@
     "howTo": "Chay'",
     "shortcuts": "Shortcuts",
     "markdownGuide": "Markdown mIw",
+    "brain": "rarmey & yab",
     "customisations": "Tigh",
     "docker": "Docker",
     "envVariables": "Env Variables",
@@ -1729,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "pegh",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Hol",
     "unraid": "Unraid",
     "patches": "Patches"
@@ -1742,6 +1774,7 @@
   },
   "notifications": {
     "title": "Notifications",
+    "unread": "laDlu'be'",
     "markAllRead": "Mark all read",
     "clearAll": "Clear all",
     "empty": "No notifications",
@@ -1749,12 +1782,99 @@
     "assignmentMessage": "\"{task}\" in \"{board}\"",
     "reminderTitle": "Task overdue",
     "reminderMessage": "\"{task}\" in \"{board}\" is past its reminder",
-    "unread": "laDlu'be'",
     "sharingTitle": "{user} {type} Dajach",
     "sharingMessage": "{type} yIleghmeH yI'el",
     "sharingFolderTitle": "{user} {type} ngaSwI' Dajach",
-    "sharingFolderMessage": "“{folder}” yIleghmeH yI'el",
+    "sharingFolderMessage": "\"{folder}\" yIleghmeH yI'el",
     "mentionTitle": "{user} QIch DIj SoH tuq",
-    "mentionMessage": "„{board}“"
+    "mentionMessage": "\"{board}\""
+  },
+  "relations": {
+    "indexing": "rarmey tetlh chenmoHlI'...",
+    "unreachable": "ghoSlaHbe'",
+    "createFromWikilink": "\"{title}\" ghItlh yIchenmoH",
+    "mentionedIn": "Daq pong",
+    "mentionedInHint": "ghItlhmeyvam pongvam lo', 'ach rarbe'. wa' yIrar.",
+    "linkMention": "yIrar",
+    "linked": "{title}Daq pong rarlu'",
+    "linkFailed": "pong rar Qapla'be'",
+    "kind": {
+      "mention": "rar",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "yab",
+    "openBrain": "yabDaq yIpoSmoH",
+    "search": "yablIjDaq yInej...",
+    "dimension": "legh",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Dochvam Dop",
+    "global": "Hoch",
+    "depth": "Saw' {depth}",
+    "colourBy": "rItlh",
+    "colourModes": {
+      "type": "Segh",
+      "category": "Segh"
+    },
+    "filters": {
+      "notes": "ghItlhmey",
+      "checklists": "tetlhmey",
+      "tags": "permey",
+      "ghosts": "ghItlhbe'lu'",
+      "suggestions": "chupmey",
+      "orphans": "mobmey"
+    },
+    "kind": {
+      "note": "ghItlh",
+      "checklist": "tetlh",
+      "ghost": "ghItlhbe'lu'",
+      "tag": "per"
+    },
+    "edges": {
+      "mention": "rar",
+      "wiki": "Wikilink",
+      "suggested": "chup",
+      "tag": "per"
+    },
+    "linksTo": "rarlu'bogh",
+    "linkedFrom": "rarwI'",
+    "suggested": "rarlaw'",
+    "promote": "{title} yIrar",
+    "lonely": "Dochvam rarbe'lu'. latlh ghItlhDaq @ pagh [[ yIlo'.",
+    "open": "yIpoSmoH",
+    "createGhost": "ghItlhvam yIghItlh",
+    "openTag": "Hoch per ghajbogh yI'ang",
+    "createFailed": "ghItlh chenmoH Qapla'be'",
+    "connectFailed": "cha' rar Qapla'be'",
+    "connected": "{source} {target} je rarlu'",
+    "empty": "tamtaH yablIj. @ pagh [[ lo'DI' ghItlhmey tetlhmey je Dararchugh, naDev Du'ang.",
+    "viewingOwner": "{owner} yab Daleghlu'",
+    "summary": "{items} Dochmey, {links} rarmey, {shown} 'anglu'"
+  },
+  "apiExplorer": {
+    "title": "API nejwI'",
+    "intro": "Hoch endpoint (v{version}) Suq, Qu'vam ngoq chenmoH. wa' yIwIv, yIteb, yIngeH.",
+    "realData": "API ngoQ ghajwI' De' teH lo' tlhobmey. naDev DELETE Qaw' teH.",
+    "apiKey": "API ngoq",
+    "apiKeyHint": "nav'vamDaq neH Pollu', bImejDI' lIjlu'.",
+    "useMyKey": "ngoqwIj yIlo'",
+    "noKeyYet": "API ngoq Daghajbe'. profile SeHDaq wa' yIchenmoH.",
+    "filter": "vI'",
+    "filterPlaceholder": "He, pong pagh mIw",
+    "noMatches": "vI'vam rurbe' Pagh.",
+    "body": "tlhob porgh (JSON)",
+    "showSchema": "schema yI'ang",
+    "hideSchema": "schema yISo'",
+    "send": "yIngeH",
+    "sending": "ngeHlI'...",
+    "keyRequired": "wa'DIch API ngoq yIchel.",
+    "noKeyNeeded": "API ngoq poQbe'",
+    "deprecated": "ngo'",
+    "requestFailed": "server ghoSbe' tlhob. rarlIj yInuD.",
+    "responseMeta": "{status}, {ms} ms"
   }
 }
diff --git a/app/_translations/ko.json b/app/_translations/ko.json
index 8b8843957..9c9213400 100644
--- a/app/_translations/ko.json
+++ b/app/_translations/ko.json
@@ -101,7 +101,7 @@
     "deleteFile": "파일 삭제",
     "fileTooLarge": "파일이 너무 큽니다. 최대 허용량은 {maxSizeMB}MB입니다. 현재 파일은 {fileSizeMB}MB입니다.",
     "uploadFailed": "업로드 실패",
-    "uploadFailedRetry": "업로드에 실패했습니다. 다시 시도해 주세요.",
+    "uploadFailedRetry": "업로드에 실패했습니다. 다시 시도하세요.",
     "failedToDeleteFile": "파일 삭제 실패",
     "previousMonth": "이전 달",
     "nextMonth": "다음 달",
@@ -127,16 +127,20 @@
     "expandAll": "모두 펼치기",
     "saveChanges": "변경 사항 저장",
     "all": "전체",
+    "items": "항목",
     "showAll": "모두 표시",
     "creating": "생성 중...",
     "createCategoryHeader": "새 카테고리 생성",
     "parentCategory": "상위 카테고리 (선택 사항)",
     "noParent": "상위 없음 (최상위)",
     "categoryNamePlaceholder": "카테고리 이름 입력...",
-    "notAllowedName": "{name}은(는) 사용할 수 없습니다. 다른 이름을 선택하세요.",
+    "notAllowedName": "{name}은(는) 사용할 수 없습니다. 다른 이름을 고르세요.",
     "createCategory": "카테고리 생성",
     "selectCategory": "카테고리 선택...",
     "categoryWillBeCreatedIn": "카테고리가 생성될 위치:",
+    "clone": "복제",
+    "cloneItem": "{item} 복제",
+    "selectCategoryForClone": "이 항목을 복사할 카테고리를 선택하세요:",
     "rootLevel": "최상위",
     "newCategory": "새 카테고리",
     "renameCategory": "카테고리 이름 변경",
@@ -170,7 +174,7 @@
     "noResults": "결과 없음",
     "by": "작성 {owner}",
     "unsavedChanges": "저장되지 않은 변경 사항",
-    "unsavedChangesDetected": "⚠️ 저장되지 않은 변경 사항이 있습니다",
+    "unsavedChangesDetected": "저장되지 않은 변경 사항",
     "unsavedChangesMessage": "{noteTitle}에 저장되지 않은 변경 사항이 있습니다. 지금 나가면 변경 사항이 적용되지 않습니다.",
     "whatToDoWithUnsavedChanges": "저장되지 않은 변경 사항을 어떻게 처리하시겠습니까?",
     "discard": "버리기",
@@ -239,44 +243,14 @@
     "disable": "비활성화",
     "restoring": "복원 중...",
     "retry": "다시 시도",
+    "copiedToClipboard": "클립보드에 복사됨",
     "offline": "오프라인",
     "connected": "연결됨",
     "reconnecting": "다시 연결하는 중...",
     "hide": "숨기기",
-    "items": "항목",
-    "clone": "복제",
-    "cloneItem": "{item} 복제",
-    "selectCategoryForClone": "이 항목을 복사할 카테고리를 선택하세요:",
-    "copiedToClipboard": "클립보드에 복사됨",
     "thisEntry": "이 항목",
     "preview": "미리보기"
   },
-  "comments": {
-    "title": "댓글",
-    "titleWithCount": "{count, plural, other {댓글 #개}}",
-    "noComments": "아직 댓글이 없습니다. 대화를 시작해보세요!",
-    "addComment": "댓글 추가...",
-    "replyPlaceholder": "답글 작성...",
-    "post": "게시",
-    "reply": "답글",
-    "edit": "수정",
-    "delete": "삭제",
-    "save": "저장",
-    "cancel": "취소",
-    "edited": "수정됨",
-    "deleteConfirmTitle": "댓글을 삭제하시겠습니까?",
-    "deleteConfirmMessage": "댓글과 모든 답글이 삭제됩니다. 이 작업은 되돌릴 수 없습니다.",
-    "commentDeleted": "댓글이 삭제되었습니다",
-    "commentAdded": "댓글이 추가되었습니다",
-    "commentUpdated": "댓글이 수정되었습니다",
-    "failedToAdd": "댓글 추가에 실패했습니다",
-    "failedToEdit": "댓글 수정에 실패했습니다",
-    "failedToDelete": "댓글 삭제에 실패했습니다",
-    "failedToLoad": "댓글을 불러오지 못했습니다",
-    "readOnly": "이 카드에 댓글을 작성하려면 편집 권한이 필요합니다.",
-    "replyTo": "{author}에게 답글",
-    "noUsersFound": "사용자를 찾을 수 없습니다"
-  },
   "history": {
     "noteHistory": "노트 기록",
     "restore": "복원",
@@ -286,10 +260,10 @@
     "noHistoryDescription": "노트를 저장하면 기록 지점이 생성됩니다.",
     "loadMore": "더 불러오기",
     "featureDisabled": "기록 기능 비활성화딤",
-    "disabledAdmin": "노트 기록 기능이 비활성화되어 있습니다. 관리자 설정 > 편집기에서 활성화할 수 있습니다.",
-    "disabledUser": "노트 기록 기능이 비활성화되어 있습니다. 이 기능을 사용하려면 관리자에게 문의하세요.",
+    "disabledAdmin": "노트 기록이 꺼져 있습니다. 관리자 설정 > 편집기에서 켤 수 있습니다.",
+    "disabledUser": "노트 기록이 꺼져 있습니다. 관리자에게 켜 달라고 요청하세요.",
     "goToSettings": "설정으로 이동",
-    "manualSavesOnly": "기록은 자동 저장이 아닌 수동 저장 시에만 생성됩니다.",
+    "manualSavesOnly": "기록은 수동 저장할 때만 남습니다. 자동 저장은 기록을 남기지 않습니다.",
     "fetchError": "기록을 불러오지 못했습니다",
     "restoreError": "버전을 복원하지 못했습니다",
     "viewContent": "내용 보기",
@@ -321,7 +295,7 @@
     "sessionExpired": "세션이 만료되었습니다",
     "setupComplete": "설정 완료",
     "createAccount": "계정 생성",
-    "errorOccurred": "오류가 발생했습니다. 다시 시도해주세요.",
+    "errorOccurred": "문제가 발생했습니다. 다시 시도하세요.",
     "enterUsername": "사용자 이름을 입력하세요",
     "enterPassword": "비밀번호를 입력하세요",
     "chooseUsername": "사용자 이름을 선택하세요",
@@ -335,7 +309,7 @@
     "createUser": "사용자 생성",
     "attemptsRemaining": "경고: {count, plural, one {#회} other {#회}}의 시도가 남아 있습니다",
     "accountLocked": "실패 시도가 너무 많습니다. {seconds} {seconds, plural, one {초} other {초}} 후에 다시 시도하세요",
-    "notAuthorized": "접근 권한이 없습니다. 관리자에게 문의하세요.",
+    "notAuthorized": "이 앱에 접근할 권한이 없습니다. 관리자에게 문의하세요.",
     "rememberMe": "로그인 상태 유지"
   },
   "mfa": {
@@ -360,9 +334,9 @@
     "invalidCode": "인증 코드가 올바르지 않습니다",
     "invalidRecoveryCode": "복구 코드가 올바르지 않습니다",
     "mfaRequired": "2단계 인증이 필요합니다",
-    "mfaEnabledSuccess": "2단계 인증이 성공적으로 활성화되었습니다",
+    "mfaEnabledSuccess": "2단계 인증이 활성화되었습니다",
     "mfaDisabledSuccess": "2단계 인증이 비활성화되었습니다",
-    "tooManyAttempts": "실패 시도가 너무 많습니다. 잠시 후 다시 시도해주세요.",
+    "tooManyAttempts": "실패 시도가 너무 많습니다. 나중에 다시 시도하세요.",
     "disableTitle": "2단계 인증 비활성화",
     "disableDescription": "2단계 인증을 비활성화하려면 2FA 코드를 입력하세요",
     "disableWarning": "계정 보안이 낮아집니다. 계속하시겠습니까?",
@@ -382,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "현재 사용 중인 복구 코드는 더 이상 사용할 수 없습니다",
     "regenerateRecoveryCodeDescription": "새 복구 코드를 생성하려면 2FA 코드를 입력하세요. 기존 코드는 무효화됩니다.",
     "recoveryCodeRegenerated": "새 복구 코드가 생성되었습니다",
-    "recoveryCodeRegeneratedInfo": "새 복구 코드가 생성되었습니다. 이 코드는 지금만 확인할 수 있으니 안전한 곳에 저장하세요.",
-    "recoveryCodeRegeneratedSuccess": "복구 코드가 성공적으로 재생성되었습니다",
+    "recoveryCodeRegeneratedInfo": "새 복구 코드가 준비되었습니다. 지금 한 번만 볼 수 있으니 안전한 곳에 저장하세요.",
+    "recoveryCodeRegeneratedSuccess": "복구 코드가 재생성되었습니다",
     "recoveryCodeProfileDescription": "인증 앱에 접근할 수 없을 경우 계정 복구에 이 코드를 사용하세요",
     "disableMfaForUser": "이 사용자에 대해 2단계 인증 비활성화",
     "recoveryCodeRequired": "복구 코드가 필요합니다",
@@ -397,7 +371,7 @@
     "recent": "최근",
     "browseAndManage": "모든 노트를 둘러보고 관리하세요",
     "noNotesYet": "아직 노트가 없습니다",
-    "createFirstNote": "첫 노트를 만들어 지식 베이스를 시작해보세요.",
+    "createFirstNote": "아직 아무것도 없습니다. 첫 노트를 만들어 보세요.",
     "createNewNote": "새 노트 만들기",
     "noNotesFound": "노트를 찾을 수 없습니다",
     "tryAdjustingFilters": "필터를 조정하거나 새 노트를 만들어보세요.",
@@ -428,6 +402,8 @@
     "enterNoteTitle": "노트 제목 입력...",
     "byType": "유형별",
     "publiclySharedNote": "공개 공유됨",
+    "sharedPubliclyBy": "{owner} 님이 공개로 공유한 노트입니다",
+    "copyRawContent": "마크다운 복사",
     "quickSave": "빠른 저장",
     "noteNotFound": "노트를 찾을 수 없습니다",
     "unarchiveNote": "노트 보관 해제",
@@ -438,12 +414,14 @@
     "wordCount": "{count, plural, one {# 단어} other {# 단어}}",
     "charCount": "{count, plural, one {# 글자} other {# 글자}}",
     "readingTime": "{count, plural, one {# 분 읽기} other {# 분 읽기}}",
-    "copyRawContent": "마크다운 복사",
+    "tags": "태그",
     "noTagsFound": "태그가 없습니다",
     "searchTags": "태그 검색...",
-    "tags": "태그"
+    "createNoteFailed": "노트를 만들지 못했습니다",
+    "createCategoryFailed": "카테고리를 만들지 못해 노트도 만들어지지 않았습니다"
   },
   "checklists": {
+    "sharedPubliclyBy": "{owner} 님이 공개로 공유한 체크리스트입니다",
     "title": "체크리스트",
     "allChecklists": "모든 체크리스트",
     "completed": "완료됨",
@@ -457,7 +435,7 @@
     "progress": "진행률",
     "totalItems": "전체 항목 수",
     "noChecklistsYet": "아직 체크리스트가 없습니다",
-    "createFirstChecklist": "첫 체크리스트를 만들어 작업을 정리해보세요.",
+    "createFirstChecklist": "아직 아무것도 없습니다. 첫 체크리스트를 만들어 보세요.",
     "newChecklist": "새 체크리스트",
     "noChecklistsFound": "체크리스트를 찾을 수 없습니다",
     "tryAdjustingFiltersChecklist": "필터를 조정하거나 새 체크리스트를 만들어보세요.",
@@ -499,6 +477,7 @@
     "checklistType": "체크리스트 유형",
     "simpleChecklist": "단순 체크리스트",
     "taskProject": "작업 프로젝트",
+    "kanbanBoard": "칸반 보드",
     "basicTodoItems": "기본 할 일 항목",
     "withTimeTracking": "시간 추적 포함",
     "noDescription": "설명 없음",
@@ -525,23 +504,24 @@
     "clearAllCompletedConfirmMessage": "완료된 {count}개의 모든 항목과 하위 항목을 삭제하시겠습니까? 이 작업은 되돌릴 수 없습니다.",
     "clearAllIncompleteConfirmMessage": "미완료된 {count}개의 모든 항목과 하위 항목을 삭제하시겠습니까? 이 작업은 되돌릴 수 없습니다.",
     "convertChecklistType": "체크리스트 유형 변환",
-    "convertTypeConfirmation": "{currentType}에서 {newType}(으)로 변환하려고 합니다. 계속하시겠습니까?",
-    "dataLossWarning": "⚠️ 데이터 손실 경고",
+    "convertTypeConfirmation": "{currentType}에서 {newType}(으)로 변환할까요?",
+    "dataLossWarning": "데이터 손실 경고",
     "dataLossWarningItems": "다음 데이터가 삭제됩니다:",
     "allTaskStatusesReset": "모든 작업 상태가 초기화됩니다",
     "timeTrackingDataLost": "시간 추적 데이터가 삭제됩니다",
     "estimatedTimesRemoved": "예상 시간이 제거됩니다",
     "targetDatesCleared": "목표 날짜가 초기화됩니다",
-    "enhancedFeatures": "✨ 향상된 기능",
+    "enhancedFeatures": "추가되는 기능",
     "enhancedFeaturesYouWillGain": "다음 기능을 사용할 수 있습니다:",
     "kanbanBoardWithDragDrop": "드래그 앤 드롭이 가능한 칸반 보드",
     "taskStatusTracking": "작업 상태 추적 (할 일, 진행 중 등)",
     "timeTrackingWithTimer": "내장 타이머를 이용한 시간 추적",
-    "actionCannotBeUndone": "이 작업은 되돌릴 수 없습니다. 정말 변환하시겠습니까?",
+    "actionCannotBeUndone": "되돌릴 수 없습니다. 그래도 변환할까요?",
     "convertAndLoseData": "변환 및 데이터 삭제",
     "convert": "변환",
     "convertToSimpleChecklist": "단순 체크리스트로 변환",
     "convertToTaskProject": "작업 프로젝트로 변환",
+    "convertToKanbanBoard": "칸반 보드로 변환",
     "pasteYourList": "목록을 붙여넣으세요 (한 줄에 한 항목)",
     "addItems": "{count}개 항목 추가",
     "itemsWillBeAdded": "{count}개의 항목이 추가됩니다",
@@ -550,11 +530,35 @@
     "noItemsYet": "아직 항목이 없습니다",
     "addFirstItem": "첫 항목을 추가하여 시작하세요!",
     "noTasks": "작업이 없습니다",
-    "noSubtasksYet": "하위 작업이 없습니다. 아래에서 추가해보세요.",
+    "noSubtasksYet": "하위 작업이 없습니다. 아래에서 추가하세요.",
     "addTime": "시간 추가",
-    "enterTimeInMinutes": "시간을 분 단위로 입력하세요",
-    "kanbanBoard": "칸반 보드",
-    "convertToKanbanBoard": "칸반 보드로 변환"
+    "enterTimeInMinutes": "시간을 분 단위로 입력하세요"
+  },
+  "comments": {
+    "title": "댓글",
+    "titleWithCount": "{count, plural, other {댓글 #개}}",
+    "noComments": "아직 댓글이 없습니다. 대화를 시작해보세요!",
+    "addComment": "댓글 추가...",
+    "replyPlaceholder": "답글 작성...",
+    "post": "게시",
+    "reply": "답글",
+    "edit": "수정",
+    "delete": "삭제",
+    "save": "저장",
+    "cancel": "취소",
+    "edited": "수정됨",
+    "deleteConfirmTitle": "댓글을 삭제하시겠습니까?",
+    "deleteConfirmMessage": "댓글과 모든 답글이 삭제됩니다. 이 작업은 되돌릴 수 없습니다.",
+    "commentDeleted": "댓글이 삭제되었습니다",
+    "commentAdded": "댓글이 추가되었습니다",
+    "commentUpdated": "댓글이 수정되었습니다",
+    "failedToAdd": "댓글 추가에 실패했습니다",
+    "failedToEdit": "댓글 수정에 실패했습니다",
+    "failedToDelete": "댓글 삭제에 실패했습니다",
+    "failedToLoad": "댓글을 불러오지 못했습니다",
+    "readOnly": "이 카드에 댓글을 작성하려면 편집 권한이 필요합니다.",
+    "replyTo": "{author}에게 답글",
+    "noUsersFound": "사용자를 찾을 수 없습니다"
   },
   "tasks": {
     "title": "작업",
@@ -583,7 +587,7 @@
     "overdue": "기한 초과",
     "browseAndManageTaskLists": "모든 작업 목록을 둘러보고 관리하세요",
     "noTaskListsYet": "아직 작업 목록이 없습니다",
-    "createFirstTaskList": "첫 작업 목록을 만들어 프로젝트 관리를 시작해보세요.",
+    "createFirstTaskList": "아직 아무것도 없습니다. 첫 작업 목록을 만들어 보세요.",
     "newTaskList": "새 작업 목록",
     "taskLists": "작업 목록",
     "noTaskListsFound": "작업 목록을 찾을 수 없습니다",
@@ -631,7 +635,7 @@
     "changeStatus": "상태 변경",
     "noBoards": "보드를 찾을 수 없습니다",
     "noBoardsYet": "아직 칸반 보드가 없습니다",
-    "createFirstBoard": "프로젝트 관리를 위해 첫 번째 칸반 보드를 만드세요.",
+    "createFirstBoard": "아직 아무것도 없습니다. 첫 칸반 보드를 만들어 보세요.",
     "newBoard": "새 보드",
     "tryAdjustingFilters": "필터를 조정하거나 새 보드를 만드세요.",
     "completed": "완료",
@@ -684,7 +688,7 @@
     "quickSettingsHeader": "빠른 설정 (이 기기만 적용)",
     "adminSettings": "과리자 대시보드",
     "apiKey": "API 키",
-    "apiKeyDescription": "체크리스트와 노트에 대한 프로그램 접근을 위한 API 키를 생성합니다",
+    "apiKeyDescription": "스크립트와 앱이 체크리스트와 노트에 접근할 수 있도록 API 키를 생성합니다",
     "hideApiKey": "API 키 숨기기",
     "showApiKey": "API 키 표시",
     "copyApiKey": "API 키 복사",
@@ -702,15 +706,15 @@
     "removeAvatar": "아바타 제거",
     "usernameRequired": "사용자 이름은 필수입니다",
     "passwordsDoNotMatch": "새 비밀번호가 일치하지 않습니다",
-    "profileUpdated": "프로필이 성공적으로 업데이트되었습니다!",
+    "profileUpdated": "프로필이 업데이트되었습니다",
     "failedToUpdateProfile": "프로필 업데이트에 실패했습니다",
-    "failedToUpdateProfileRetry": "프로필 업데이트에 실패했습니다. 다시 시도해주세요.",
-    "avatarUpdated": "아바타가 성공적으로 업데이트되었습니다!",
+    "failedToUpdateProfileRetry": "프로필을 업데이트하지 못했습니다. 다시 시도하세요.",
+    "avatarUpdated": "아바타가 업데이트되었습니다",
     "failedToUpdateAvatar": "아바타 업데이트에 실패했습니다",
-    "failedToUpdateAvatarRetry": "아바타 업데이트에 실패했습니다. 다시 시도해주세요.",
-    "avatarRemoved": "아바타가 성공적으로 제거되었습니다!",
+    "failedToUpdateAvatarRetry": "아바타를 업데이트하지 못했습니다. 다시 시도하세요.",
+    "avatarRemoved": "아바타가 제거되었습니다",
     "failedToRemoveAvatar": "아바타 제거에 실패했습니다",
-    "failedToRemoveAvatarRetry": "아바타 제거에 실패했습니다. 다시 시도해주세요.",
+    "failedToRemoveAvatarRetry": "아바타를 제거하지 못했습니다. 다시 시도하세요.",
     "activeSessions": "활성 세션",
     "activeSession": "{count}개의 활성 세션",
     "activeSession_plural": "{count}개의 활성 세션",
@@ -728,11 +732,11 @@
     "auditLogsTab": "사용자 로그",
     "rebuildLinkIndexes": "연결 데이터를 업데이트하기 위해 링크 인덱스를 다시 생성합니다",
     "rebuildingLinkIndex": "링크 인덱스 재생성 중...",
-    "successfullyRebuiltIndex": "링크 인덱스가 성공적으로 재생성되었습니다",
-    "successfullyRebuiltIndexReload": "링크 인덱스가 성공적으로 재생성되었습니다! 업데이트된 연결을 표시하기 위해 페이지가 새로고침됩니다.",
-    "failedToRebuildIndex": "링크 인덱스 재생성에 실패했습니다. 다시 시도해주세요.",
+    "successfullyRebuiltIndex": "링크 인덱스를 재생성했습니다",
+    "successfullyRebuiltIndexReload": "링크 인덱스를 재생성했습니다. 새 연결을 보여 주기 위해 페이지를 새로고침합니다.",
+    "failedToRebuildIndex": "링크 인덱스를 재생성하지 못했습니다. 다시 시도하세요.",
     "contentLinks": "콘텐츠 링크",
-    "visualizeRelationships": "노트와 체크리스트 간의 관계를 시각화합니다",
+    "visualizeRelationships": "노트와 체크리스트가 서로 어떻게 연결되는지 봅니다",
     "connectedItems": "연결된 항목",
     "noLinksFound": "링크를 찾을 수 없습니다",
     "startCreatingInternalLinks": "여기에서 관계 네트워크를 보려면 노트에 `@`를 입력하여 내부 링크 만들기를 시작하세요.",
@@ -743,8 +747,8 @@
     "isolated": "고립됨",
     "connection": "연결",
     "connection_plural": "연결",
-    "terminateSessionConfirm": "이 세션을 종료하시겠습니까?",
-    "terminateAllSessionsConfirm": "다른 모든 세션을 종료하시겠습니까?",
+    "terminateSessionConfirm": "이 세션을 종료할까요?",
+    "terminateAllSessionsConfirm": "다른 모든 세션을 종료할까요?",
     "validationErrorTitle": "유효성 검사 오류",
     "visibleGraphSummary": "표시된 항목 {items}개, 표시된 링크 {links}개",
     "graphTruncated": "연결 수가 가장 많은 상위 {visible}개 항목을 표시합니다. 연결이 적은 {omitted}개 항목은 생략되었습니다.",
@@ -815,10 +819,10 @@
     "chooseAutoSaveInterval": "노트 자동 저장 간격을 선택하세요.",
     "defaultMode": "기본 모드",
     "selectNotesDefaultMode": "노트 기본 모드 선택",
-    "chooseNotesDefaultMode": "노트를 기본적으로 편집 모드로 열지 선택하세요 (노트 에디터의 {mode} 버튼으로 변경 가능).",
+    "chooseNotesDefaultMode": "노트를 편집 모드로 열지 선택하세요. 노트 에디터의 {mode} 버튼으로 언제든 바꿀 수 있습니다.",
     "defaultEditor": "기본 에디터",
     "selectNotesDefaultEditor": "노트 기본 에디터 선택",
-    "chooseDefaultEditor": "노트에 사용할 기본 에디터를 선택하세요 - (노트 에디터의 {editor} 버튼을 클릭해 언제든 변경할 수 있습니다).",
+    "chooseDefaultEditor": "노트의 기본 에디터를 선택하세요. 노트 에디터의 {editor} 버튼으로 언제든 바꿀 수 있습니다.",
     "tableSyntaxInNotes": "노트의 테이블 문법",
     "selectTableSyntax": "테이블 문법 선택",
     "chooseTableSyntax": "노트에서 테이블을 표시하는 방식을 선택하세요.",
@@ -827,7 +831,7 @@
     "chooseSyntaxTheme": "마크다운 에디터의 문법 강조 테마를 선택하세요.",
     "minimalMode": "미니멀 모드 (리치 텍스트 에디터 비활성화)",
     "selectMinimalMode": "미니멀 모드 선택",
-    "minimalModeDescription": "활성화하면 리치 텍스트 에디터 대신 단순 마크다운 렌더러를 사용합니다. 양방향 링크 같은 고급 기능은 이 모드에서 작동하지 않습니다.",
+    "minimalModeDescription": "리치 텍스트 에디터 대신 단순한 마크다운 렌더러를 사용합니다. 양방향 링크 등 고급 기능은 이 모드에서 작동하지 않습니다.",
     "defaultNoteFilter": "기본 노트 필터",
     "selectDefaultNoteFilter": "기본 노트 필터 선택",
     "chooseDefaultNoteFilter": "노트 페이지를 열 때 적용할 기본 필터를 선택하세요.",
@@ -854,8 +858,8 @@
     "currentPassword": "현재 비밀번호",
     "newPassword": "새 비밀번호",
     "confirmPassword": "비밀번호 확인",
-    "passwordChanged": "비밀번호가 성공적으로 변경되었습니다",
-    "settingsSaved": "설정이 성공적으로 저장되었습니다",
+    "passwordChanged": "비밀번호가 변경되었습니다",
+    "settingsSaved": "설정이 저장되었습니다",
     "dashCase": "대시 표기법 (예: my-file-name.md)",
     "minimal": "최소 (잘못된 문자만 제거)",
     "noRename": "이름 변경 안함 (원본 파일명 유지)",
@@ -865,6 +869,7 @@
     "seconds_plural": "{count}초",
     "hours12": "12시간",
     "hours24": "24시간",
+    "useSystemDefault": "시스템 기본값 사용",
     "markdownTableSyntax": "마크다운",
     "htmlTableSyntax": "HTML",
     "default": "기본",
@@ -888,7 +893,7 @@
     "chooseQuickCreateNotes": "빠른 노트 생성 방식을 선택하세요.",
     "quickCreateNotesShowModal": "노트 생성 시 모달 표시",
     "quickCreateNotesSkipModal": "모달 건너뛰고 바로 생성",
-    "quickCreateNotesDescription": "활성화하면 새 노트를 만들 때 생성 모달을 건너뛰고 바로 노트 에디터로 이동합니다.",
+    "quickCreateNotesDescription": "노트 생성 대화상자를 건너뛰고 바로 에디터로 이동합니다.",
     "defaultCategory": "빠른 노트 생성 기본 카테고리",
     "selectDefaultCategory": "기본 카테고리 선택...",
     "defaultCategoryDescription": "빠른 생성 사용 시 새 노트가 이 카테고리에 생성됩니다.",
@@ -926,7 +931,7 @@
     "hideStatusOnCardsLabel": "칸반 카드의 상태",
     "showStatusOnCards": "상태 표시",
     "hideStatusOnCards": "상태 숨기기",
-    "hideStatusOnCardsDescription": "칸반 카드에서 상태 레이블을 숨깁니다. 상태는 카드가 있는 열로 이미 표시됩니다.",
+    "hideStatusOnCardsDescription": "칸반 카드의 상태 레이블을 숨깁니다. 열만 봐도 상태를 알 수 있습니다.",
     "hideMobileStatusDropdownLabel": "카드의 모바일 상태 드롭다운",
     "showMobileStatusDropdown": "모바일 드롭다운 표시",
     "hideMobileStatusDropdown": "모바일 드롭다운 숨기기",
@@ -939,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "칸반 카드에서 타이머와 기록된 세션을 숨깁니다. 시간 추적은 카드 상세 보기에서 계속 사용할 수 있습니다.",
     "selectStatusOnCards": "상태 표시 여부 선택",
     "codeBlockChoice": "코드 블록 스타일을 선택하세요",
-    "themedCodeBlock": "테마 코드블록",
     "defaultCodeBlock": "코드펜(기본값)",
+    "themedCodeBlock": "테마 코드블록",
     "codeBlockChoiceDescription": "codepen과 유사한 기본 코드 블록 스타일 또는 테마 코드 블록 스타일 중에서 선택하세요.",
     "checklistItemClickAction": "체크리스트 항목 클릭 동작",
     "selectChecklistItemClickAction": "체크리스트 항목 선택 클릭 동작",
-    "checklistItemClickActionDescription": "작업 텍스트를 클릭하면 어떻게 되는지 선택하세요. \n\"완료로 표시\"는 확인란을 전환합니다(기본값). \n\"작업 이름 편집\"은 인라인 편집을 위한 작업을 엽니다. 완료하려면 확인란 자체를 클릭해야 합니다.",
+    "checklistItemClickActionDescription": "작업 텍스트를 클릭했을 때의 동작을 선택하세요. \"완료로 표시\"(기본값)는 확인란을 전환합니다. \"작업 이름 편집\"은 작업을 인라인으로 편집하며, 완료하려면 확인란을 직접 클릭하세요.",
     "checklistItemClickActionToggle": "완료/미완료로 표시",
     "checklistItemClickActionEdit": "목록 항목 편집",
     "newItemInsertion": "새 항목 삽입 위치",
@@ -952,7 +957,6 @@
     "newItemInsertionDescription": "체크리스트에서 새 항목을 맨 위(기본값)에 추가할지 맨 아래에 추가할지 선택하세요.",
     "newItemInsertionTop": "목록 맨 위",
     "newItemInsertionBottom": "목록 맨 아래",
-    "useSystemDefault": "시스템 기본값 사용",
     "selectShowChecklistEmojis": "이모지 표시 선택",
     "showChecklistEmojisDescription": "체크리스트 항목의 텍스트에 따라 이모지를 자동으로 표시합니다."
   },
@@ -995,20 +999,24 @@
     "icon512": "512x512 아이콘",
     "icon512Description": "PWA 스플래시 화면용 고해상도 아이콘.",
     "notifyNewUpdates": "새 업데이트 알림 받기",
-    "thisUsesGithubAPI": "이 기능은 GitHub API를 사용합니다. 비활성화하면 GitHub와의 모든 트래픽이 차단됩니다.",
+    "thisUsesGithubAPI": "GitHub API로 업데이트를 확인합니다. 끄면 GitHub와 주고받는 모든 트래픽이 멈춥니다.",
     "parseContent": "항상 파싱된 콘텐츠 표시",
-    "parseContentEnabledDescription": "활성화 시 사이드바, 검색 결과 등 앱 전체에서 파싱된 제목을 표시합니다.",
-    "parseContentDisabledDescription": "비활성화 시 원본 파일명을 정리하여 사람이 읽기 쉬운 형태로 표시합니다.",
-    "parseContentPerformanceWarning": "\"아니오\"로 설정하면 대용량 데이터에서 성능이 향상되지만, 특히 비라틴 문자 파일명에서 가독성이 떨어질 수 있습니다.",
+    "parseContentEnabledDescription": "사이드바, 검색 결과 등 앱 곳곳에 파싱된 제목을 표시합니다.",
+    "parseContentDisabledDescription": "대신 원본 파일명을 읽기 쉽게 정리해서 표시합니다.",
+    "parseContentPerformanceWarning": "\"아니오\"로 설정하면 큰 인스턴스에서 빨라지지만, 특히 비라틴 문자 파일명에서 제목을 읽기 어려워집니다.",
     "hideLanguageSelector": "헤더에서 언어 선택기 숨기기",
     "hideLanguageSelectorDescription": "헤더의 언어 드롭다운 표시/숨김",
+    "defaultDateFormat": "기본 날짜 형식",
+    "defaultDateFormatDescription": "사용자의 날짜 형식 기본 설정이 \"시스템 기본값 사용\"으로 설정된 경우 사용됩니다.",
+    "defaultTimeFormat": "기본 시간 형식",
+    "defaultTimeFormatDescription": "사용자의 시간 형식 기본 설정이 \"시스템 기본값 사용\"으로 설정된 경우 사용됩니다.",
     "applicationIcons": "애플리케이션 아이콘",
     "saveChanges": "변경 사항 저장",
     "unsavedChanges": "저장되지 않은 변경 사항이 있습니다.",
     "loadError": "불러오기 오류",
     "couldNotFetchSettings": "설정을 불러올 수 없습니다.",
     "failedToLoadSettings": "설정 로드 실패",
-    "settingsSavedSuccessfully": "설정이 성공적으로 저장되었습니다.",
+    "settingsSavedSuccessfully": "설정이 저장되었습니다.",
     "failedToSaveSettings": "설정 저장 실패",
     "saveError": "저장 오류",
     "unknownErrorOccurred": "알 수 없는 오류가 발생했습니다.",
@@ -1021,7 +1029,7 @@
     "colorVariables": "색상 변수",
     "livePreview": "실시간 미리보기",
     "unsavedCssChanges": "저장되지 않은 CSS 변경 사항이 있습니다.",
-    "noCustomThemesYet": "아직 사용자 지정 테마가 없습니다. \"테마 생성\"을 클릭하여 시작하세요.",
+    "noCustomThemesYet": "아직 사용자 지정 테마가 없습니다. \"테마 생성\"을 클릭해 만드세요.",
     "myCustomTheme": "내 사용자 지정 테마",
     "iconNameDescription": "아이콘 이름 (예: PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "앱 버전",
@@ -1060,22 +1068,22 @@
     "configureExternalServices": "에디터 통합을 위한 외부 서비스 URL을 설정합니다.",
     "drawioUrl": "Draw.io URL",
     "optional": "(선택 사항)",
-    "drawioUrlDescription": "사용자 지정 Draw.io 인스턴스 URL을 지정합니다. 비워두면 기본 공개 인스턴스를 사용합니다 (https://embed.diagrams.net).",
+    "drawioUrlDescription": "직접 운영하는 Draw.io 인스턴스를 사용합니다. 비워두면 공개 인스턴스(https://embed.diagrams.net)를 사용합니다.",
     "drawioUrlExample": "셀프 호스팅 예: https://your-domain.com/drawio",
     "drawioProxyEnabled": "Jotty를 통해 Draw.io 프록시",
-    "drawioProxyEnabledDescription": "Draw.io 트래픽을 Jotty 서버를 통해 라우팅하려면 이 옵션을 활성화하세요. 사용자의 브라우저에서 접근할 수 없는 내부 Docker 네트워크 URL(예: http://drawio:8080)에 필요합니다.",
+    "drawioProxyEnabledDescription": "Draw.io 트래픽을 Jotty 서버를 거쳐 보냅니다. 사용자 브라우저에서 접근할 수 없는 내부 Docker 네트워크 URL(예: http://drawio:8080)에 필요합니다.",
     "excalidrawUrl": "Excalidraw URL",
-    "excalidrawUrlDescription": "사용자 지정 Excalidraw 인스턴스 URL을 지정합니다. 비워두면 기본 공개 인스턴스를 사용합니다 (https://excalidraw.com).",
+    "excalidrawUrlDescription": "직접 운영하는 Excalidraw 인스턴스를 사용합니다. 비워두면 공개 인스턴스(https://excalidraw.com)를 사용합니다.",
     "excalidrawUrlExample": "셀프 호스팅 예: https://your-domain.com/excalidraw",
     "excalidrawProxyEnabled": "Jotty를 통해 Excalidraw 프록시",
-    "excalidrawProxyEnabledDescription": "Excalidraw 트래픽을 Jotty 서버를 통해 라우팅하려면 이 옵션을 활성화하세요. 사용자의 브라우저에서 접근할 수 없는 내부 Docker 네트워크 URL(예: http://excalidraw:3000)에 필요합니다.",
+    "excalidrawProxyEnabledDescription": "Excalidraw 트래픽을 Jotty 서버를 거쳐 보냅니다. 사용자 브라우저에서 접근할 수 없는 내부 Docker 네트워크 URL(예: http://excalidraw:3000)에 필요합니다.",
     "saving": "저장 중...",
-    "editorSettingsSaved": "에디터 설정이 성공적으로 저장되었습니다.",
+    "editorSettingsSaved": "에디터 설정이 저장되었습니다.",
     "customEmojis": "사용자 지정 이모지",
-    "noEmojisYet": "아직 사용자 지정 이모지가 없습니다. &quot;이모지 추가&quot;를 클릭하세요.",
-    "enterAnyEmoji": "이모지를 입력하거나 이모지 선택기를 사용하세요 (Win: Win+.; Mac: Ctrl+Cmd+Space",
+    "noEmojisYet": "아직 사용자 지정 이모지가 없습니다. &quot;이모지 추가&quot;를 클릭해 추가하세요.",
+    "enterAnyEmoji": "이모지를 입력하거나 이모지 선택기를 사용하세요 (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "공유 활동 개요",
-    "detailedSharingBreakdown": "공유 패턴 및 사용자 참여에 대한 상세 분석",
+    "detailedSharingBreakdown": "무엇이 공유되고 누가 공유하는지",
     "checkForUpdates": "업데이트 확인",
     "checkingForUpdates": "업데이트 확인 중...",
     "updateAvailable": "업데이트 사용 가능!",
@@ -1090,12 +1098,12 @@
     "userContent": "체크리스트 {checklistsLength}개 • 노트 {notesLength}개",
     "rebuildIndexes": "인덱스 재구성",
     "rebuilding": "재구성 중...",
-    "successfullyRebuiltIndex": "{username}의 링크 인덱스를 성공적으로 재구성했습니다",
+    "successfullyRebuiltIndex": "{username}의 링크 인덱스를 재생성했습니다",
     "failedToRebuildIndex": "{username}의 링크 인덱스 재구성에 실패했습니다",
     "totalItems": "{userCount}명의 사용자 전체 항목 {items}개",
     "privileges": "관리자 권한",
     "adminContentAccess": "관리자 콘텐츠 접근",
-    "adminContentAccessDescription": "관리자가 모든 사용자의 메모와 체크리스트에 접근할 수 있는지 여부를 제어합니다. 이 옵션을 비활성화하면 관리자는 사용자와 설정만 관리할 수 있고 다른 사용자의 콘텐츠는 볼 수 없습니다.",
+    "adminContentAccessDescription": "관리자가 모든 사용자의 노트와 체크리스트를 열 수 있게 합니다. 끄면 관리자는 사용자와 설정은 관리할 수 있지만 다른 사람의 콘텐츠는 볼 수 없습니다.",
     "adminContentAccessYes": "관리자는 모든 콘텐츠에 접근 가능",
     "adminContentAccessNo": "관리자는 본인 콘텐츠만 접근 가능",
     "superAdminOnly": "시스템 소유자만 수정 가능",
@@ -1105,21 +1113,21 @@
     "confirmNewPassword": "새 비밀번호 확인",
     "dataExport": "데이터 내보내기",
     "dataExportOptions": "데이터 내보내기 옵션",
-    "selectExportType": "내보내기 유형을 선택하고 데이터를 다운로드하세요.",
+    "selectExportType": "내보내기 유형을 고르고 데이터를 다운로드하세요.",
     "allChecklistsAndNotes": "모든 체크리스트 및 노트",
-    "allChecklistsAndNotesDescription": "모든 사용자가 작성한 체크리스트와 메모를 모두 내보냅니다. 이렇게 하면 사용자 및 카테고리별로 정리된 JSON 데이터가 포함된 ZIP 파일이 생성됩니다.",
+    "allChecklistsAndNotesDescription": "모든 사용자의 체크리스트와 노트를 사용자 및 카테고리별로 묶은 JSON 파일 ZIP으로 내보냅니다.",
     "userChecklistsNotes": "특정 사용자의 체크리스트 및 노트",
-    "userChecklistsNotesDescription": "선택한 사용자의 체크리스트와 노트를 내보냅니다.",
+    "userChecklistsNotesDescription": "드롭다운에서 사용자를 골라 그 사용자의 체크리스트와 노트를 모두 내보냅니다.",
     "allUsersData": "모든 사용자 계정 데이터",
     "allUsersDataDescription": "모든 사용자 계정 정보(JSON)를 내보냅니다. 콘텐츠는 포함되지 않습니다.",
     "wholeDataFolder": "전체 데이터 폴더(백업)",
-    "wholeDataFolderDescription": "전체 data 폴더를 내보냅니다. 파일 크기가 클 수 있습니다.",
+    "wholeDataFolderDescription": "모든 사용자 콘텐츠, 메타데이터, 설정을 포함한 'data' 폴더 전체를 내보냅니다. 파일이 클 수 있습니다.",
     "noSharingPermissionsLabel": "콘텐츠 접근 권한에 따라 일부 공유 항목이 숨겨져 있습니다.",
     "contentHidden": "콘텐츠 세부 정보 숨김",
     "viewOnlySettingsNotice": "이 설정은 시스템 소유자만 변경할 수 있습니다.",
     "auditLogContentRedacted": "[콘텐츠 숨김]",
     "maxLogAgeDays": "로그 최대 보관 일수",
-    "maxLogAgeDaysDescription": "감사 로그 보관 기간을 설정합니다. 0은 무제한입니다.",
+    "maxLogAgeDaysDescription": "감사 로그를 보관할 기간입니다. 감사 로그 페이지에서 이보다 오래된 로그를 정리하도록 안내합니다. 0으로 설정하면 로그를 영구 보관하고 안내도 표시하지 않습니다.",
     "appPreferences": "앱 환경설정",
     "editEmoji": "이모지 편집",
     "addEmoji": "이모지 추가",
@@ -1138,10 +1146,6 @@
     "updateTagsTitle": "노트에서 해시태그를 검색하고 프론트매터를 업데이트합니다",
     "tagsUpdated": "{processed}개 파일 처리, {updated}개에 새 태그 반영",
     "failedToUpdateTags": "태그 업데이트에 실패했습니다",
-    "defaultDateFormat": "기본 날짜 형식",
-    "defaultDateFormatDescription": "사용자의 날짜 형식 기본 설정이 \"시스템 기본값 사용\"으로 설정된 경우 사용됩니다.",
-    "defaultTimeFormatDescription": "사용자의 시간 형식 기본 설정이 \"시스템 기본값 사용\"으로 설정된 경우 사용됩니다.",
-    "defaultTimeFormat": "기본 시간 형식",
     "borderRadius": "모서리 반경",
     "borderRadiusDescription": "인스턴스 전체의 모서리 둥글기를 설정합니다. 사용자는 빠른 설정에서 재정의할 수 있습니다.",
     "borderRadiusSaved": "모서리 반경이 저장되었습니다",
@@ -1157,6 +1161,9 @@
     "tryAgain": "다시 시도",
     "contactSupport": "지원팀에 문의",
     "invalidInput": "잘못된 입력",
+    "invalidEditorSettings": "에디터 설정은 객체여야 합니다. 아무것도 저장되지 않았습니다",
+    "invalidEditorSetting": "에디터 설정 {field}의 타입이 잘못되었습니다. 아무것도 저장되지 않았습니다",
+    "categoryOutOfBounds": "그 카테고리는 내 노트 밖에 있어서 아무것도 만들지 않았습니다",
     "requiredField": "필수 입력 항목입니다",
     "emailInvalid": "유효한 이메일을 입력하세요",
     "passwordTooShort": "비밀번호는 최소 8자 이상이어야 합니다",
@@ -1164,43 +1171,44 @@
     "networkError": "네트워크 오류",
     "timeout": "요청 시간 초과",
     "permissionDenied": "권한이 거부되었습니다",
-    "requiredPermissions": "이 작업을 수행할 필요한 권한이 없습니다.",
+    "requiredPermissions": "이 작업을 할 권한이 없습니다.",
     "loadError": "불러오기 오류",
     "failedToLoadCustomEmojis": "사용자 지정 이모지를 불러오지 못했습니다",
-    "emojiDeletedSuccessfully": "이모지가 성공적으로 삭제되었습니다",
+    "emojiDeletedSuccessfully": "이모지가 삭제되었습니다",
     "deleteError": "삭제 오류",
     "failedToDeleteEmoji": "이모지 삭제에 실패했습니다",
     "validationError": "유효성 검사 오류",
     "keywordAndEmojiRequired": "키워드와 이모지는 필수입니다",
     "duplicateKeyword": "중복된 키워드",
     "keywordAlreadyExists": "키워드가 이미 존재합니다",
-    "emojiUpdatedSuccessfully": "이모지가 성공적으로 업데이트되었습니다",
-    "emojiCreatedSuccessfully": "이모지가 성공적으로 생성되었습니다",
+    "emojiUpdatedSuccessfully": "이모지가 업데이트되었습니다",
+    "emojiCreatedSuccessfully": "이모지가 생성되었습니다",
     "saveError": "저장 오류",
     "failedToSaveEmoji": "이모지 저장에 실패했습니다",
     "failedToLoadCustomCSS": "사용자 지정 CSS를 불러오지 못했습니다",
     "couldNotLoadCustomCSS": "사용자 지정 CSS를 불러올 수 없습니다.",
     "couldNotLoadThemes": "테마를 불러올 수 없습니다.",
-    "customCSSSavedSuccessfully": "사용자 지정 CSS가 성공적으로 저장되었습니다.",
+    "customCSSSavedSuccessfully": "사용자 지정 CSS가 저장되었습니다.",
     "themeNotFound": "테마를 찾을 수 없습니다.",
-    "themeDeletedSuccessfully": "테마가 성공적으로 삭제되었습니다.",
+    "themeDeletedSuccessfully": "테마가 삭제되었습니다.",
     "themeNameRequired": "테마 이름은 필수입니다.",
-    "themeSavedSuccessfully": "테마가 성공적으로 {action}되었습니다.",
+    "themeSavedSuccessfully": "테마가 {action}되었습니다.",
     "anUnknownErrorOccurred": "알 수 없는 오류가 발생했습니다.",
     "usernameRequired": "사용자 이름은 필수입니다",
     "passwordRequired": "비밀번호는 필수입니다",
     "passwordMinLength": "비밀번호는 최소 6자 이상이어야 합니다",
     "passwordsDoNotMatch": "비밀번호가 일치하지 않습니다",
-    "userSavedSuccessfully": "사용자가 성공적으로 {mode}되었습니다!",
+    "userSavedSuccessfully": "사용자가 {mode}되었습니다.",
     "failedToSaveUser": "사용자 {mode}에 실패했습니다",
     "anErrorOccurred": "오류가 발생했습니다.",
     "deleteUserConfirmation": "사용자 \"{username}\"을(를) 삭제하시겠습니까? 이 작업은 되돌릴 수 없습니다.",
-    "userDeletedSuccessfully": "사용자가 성공적으로 삭제되었습니다!",
-    "failedToDeleteUser": "사용자 삭제에 실패했습니다"
+    "userDeletedSuccessfully": "사용자가 삭제되었습니다.",
+    "failedToDeleteUser": "사용자 삭제에 실패했습니다",
+    "readOnlyFolder": "서버에서 이 폴더는 읽기 전용이라 변경 사항을 저장하지 못했습니다."
   },
   "pwa": {
     "installPromptTitle": "앱 설치",
-    "installPromptMessage": "더 나은 사용 경험을 위해 이 앱을 기기에 설치하세요",
+    "installPromptMessage": "Jotty를 기기에 설치하면 앱처럼 열 수 있습니다",
     "installButton": "설치",
     "updateAvailable": "업데이트 가능",
     "updateMessage": "새 버전을 사용할 수 있습니다",
@@ -1258,6 +1266,7 @@
     "markdown": "마크다운",
     "toggleRichEditorMode": "리치 에디터 모드 전환",
     "toggleMarkdownMode": "마크다운 모드 전환",
+    "quickControls": "에디터 컨트롤",
     "toggleBold": "굵게 전환",
     "toggleItalic": "기울임꼴 전환",
     "toggleUnderline": "밑줄 전환",
@@ -1431,11 +1440,11 @@
     "viewNote": "노트 보기",
     "editNote": "노트 편집",
     "privateKeyWarning": "경고: 개인 키를 사용하면 암호화된 모든 노트를 복호화할 수 있습니다. 보안상의 위험을 충분히 이해한 경우에만 내보내기를 진행하십시오. 계속하시겠습니까?",
-    "publicKeyExported": "공개 키를 성공적으로 내보냈습니다",
-    "privateKeyExported": "개인 키를 성공적으로 내보냈습니다",
+    "publicKeyExported": "공개 키를 내보냈습니다",
+    "privateKeyExported": "개인 키를 내보냈습니다",
     "failedToExportKey": "키 내보내기에 실패했습니다",
     "unexpectedError": "예기치 않은 오류가 발생했습니다",
-    "keysDeleted": "키가 성공적으로 삭제되었습니다",
+    "keysDeleted": "키가 삭제되었습니다",
     "failedToDeleteKeys": "키 삭제에 실패했습니다",
     "autoDecryptUpdated": "자동 복호화 설정이 업데이트되었습니다",
     "failedToUpdateSetting": "설정 업데이트에 실패했습니다",
@@ -1451,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "암호화 방식 선택",
     "encryptionMethodsTitle": "암호화 방식",
-    "xchachaDescription": "XChaCha20-Poly1305: 최신, 빠른 암호 기반 암호화 방식",
-    "pgpDescription": "PGP: 키 쌍 관리 기능을 갖춘 전통적인 공개 키 암호화 방식",
+    "xchachaDescription": "XChaCha20-Poly1305: 암호 문구로 암호화",
+    "pgpDescription": "PGP: 직접 관리하는 키 쌍으로 공개 키 암호화",
     "encryptionKeys": "암호화 키",
     "keysConfigured": "키가 구성됨",
     "algorithm": "알고리즘: ",
@@ -1466,9 +1475,9 @@
     "keysDisabledInDemo": "데모 모드에서는 암호화 키 저장이 비활성화되어 있습니다.",
     "encryptionSettings": "암호화 설정",
     "promptForPassphrase": "암호화된 노트 암호를 입력하라는 메시지를 표시합니다.",
-    "promptForPassphraseDescription": "활성화 시 암호화된 노트를 열 때 암호를 요청합니다. 노트는 서버에 암호화된 상태로 유지되며, 현재 탭 세션에서만 복호화된 내용을 볼 수 있습니다.",
+    "promptForPassphraseDescription": "암호화된 노트를 열 때 암호 문구를 묻습니다. 노트는 서버에서 암호화된 상태로 남고, 복호화된 내용은 이 탭에서만 보입니다.",
     "customKeyPath": "사용자 지정 키 경로 (로컬 설치)",
-    "customKeyPathDescription": "암호화 키를 저장할 사용자 지정(절대) 파일 시스템 경로를 지정합니다. 로컬 설치에서만 필요합니다. Docker 사용자는 docker-compose.yml에서 기본 경로를 매핑하세요.",
+    "customKeyPathDescription": "암호화 키를 저장할 절대 파일 시스템 경로입니다. 로컬 설치에서만 필요합니다. Docker 사용자는 대신 docker-compose.yml에서 기본 경로를 매핑하세요.",
     "customPath": "사용자 지정 경로",
     "customPathPlaceholder": "/home/user/my-keys",
     "customPathHelp": "절대 경로여야 합니다 (예: /home/user/my-keys or C:\\Users\\user\\my-keys)",
@@ -1487,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "저장 전에 노트 내용이 암호화됩니다",
     "passphraseRequired": "암호가 필요합니다",
     "incorrectPassphrase": "암호가 올바르지 않습니다",
-    "noteEncryptedSuccessfully": "노트가 성공적으로 암호화되었습니다",
+    "noteEncryptedSuccessfully": "노트가 암호화되었습니다",
     "failedToEncryptNote": "노트 암호화에 실패했습니다",
-    "noteDecryptedSuccessfully": "노트가 성공적으로 복호화되었습니다",
+    "noteDecryptedSuccessfully": "노트가 복호화되었습니다",
     "failedToDecryptNote": "노트 복호화에 실패했습니다",
     "passphrase": "암호",
     "enterYourPassphrase": "암호를 입력하세요",
@@ -1518,7 +1527,7 @@
     "noStoredKeysFound": "저장된 키를 찾을 수 없습니다",
     "noEncryptionKeysConfigured": "구성된 암호화 키가 없습니다",
     "pastePublicKeyBelow": "노트 내용을 암호화하려면 아래에 공개 키를 붙여넣으세요",
-    "generateOrImportKeysInProfile": "프로필 → 암호화에서 Jotty용 키를 생성하거나 가져올 수 있습니다",
+    "generateOrImportKeysInProfile": "프로필 > 암호화에서 Jotty용 키를 생성하거나 가져올 수 있습니다",
     "useCustomKey": "사용자 지정 {keyType} 키 사용",
     "signWithPrivateKey": "개인 키로 서명",
     "proveAuthenticityOfNote": "이 노트의 진위를 증명",
@@ -1538,7 +1547,7 @@
     "yourEmail": "your@email.com",
     "generating": "생성 중...",
     "generateKeys": "키 생성",
-    "keysGeneratedSuccessfully": "키가 성공적으로 생성되었습니다",
+    "keysGeneratedSuccessfully": "키가 생성되었습니다",
     "importPGPKeys": "PGP 키 가져오기",
     "publicKeyLabel": "공개 키",
     "privateKeyLabel": "개인 키",
@@ -1547,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "암호를 반드시 기억하세요! 복구할 수 없습니다.",
     "withoutPassphraseCannotDecrypt": "암호 없이는 노트를 복호화할 수 없습니다.",
     "backupPrivateKeySafely": "개인 키를 안전하게 백업하세요.",
-    "pgpKeyPairGeneratedSuccessfully": "PGP 키 쌍이 성공적으로 생성되었습니다",
+    "pgpKeyPairGeneratedSuccessfully": "PGP 키 쌍이 생성되었습니다",
     "failedToGenerateKeys": "키 생성에 실패했습니다",
     "fingerprint": "지문",
     "keysSavedSecurely": "키가 안전하게 저장되었습니다.",
@@ -1561,13 +1570,13 @@
     "bothKeysRequired": "공개 키와 개인 키가 모두 필요합니다",
     "invalidPublicKeyFormat": "유효하지 않은 공개 키 형식입니다. ASCII 아머드 PGP 키여야 합니다.",
     "invalidPrivateKeyFormat": "유효하지 않은 개인 키 형식입니다. ASCII 아머드 PGP 키여야 합니다.",
-    "keysImportedSuccessfully": "키를 성공적으로 가져왔습니다",
+    "keysImportedSuccessfully": "키를 가져왔습니다",
     "failedToImportKeys": "키 가져오기에 실패했습니다",
     "created": "암호화가 생성되었습니다",
     "notePlaceholder": "빈 메모는 암호화할 수 없기 때문에 자리 표시자입니다."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "이 옵션은 현재 브라우저 세션에만 적용됩니다. 영구적인 설정은 다음에서 확인하세요:",
+    "sessionOnlyPrefix": "이 옵션은 이 브라우저 세션에만 적용됩니다. 영구 설정은 다음에서 확인하세요:",
     "accountSettings": "사용자 환경설정",
     "autosaveNotes": "노트 자동 저장",
     "showNotePreview": "카드에서 노트 미리보기 표시",
@@ -1596,20 +1605,45 @@
     "migrationSuccessful": "마이그레이션 성공",
     "returnToApp": "앱으로 돌아가기",
     "adminAccessRequired": "관리자 권한 필요",
-    "adminAccessDescription": "이 마이그레이션에는 관리자 권한이 필요합니다. 시스템 마이그레이션을 수행하려면 관리자에게 문의하세요.",
+    "adminAccessDescription": "이 마이그레이션은 관리자가 실행해야 합니다. 관리자에게 요청하세요.",
     "whatsHappening": "무슨 일이 진행 중인가요?",
-    "sharingDataMigrationDescription": "시스템에서 공유 데이터 마이그레이션이 필요합니다. 이는 관리자 권한이 필요한 일회성 작업입니다.",
+    "sharingDataMigrationDescription": "Jotty가 공유 데이터를 마이그레이션해야 합니다. 한 번만 실행되며 관리자가 필요합니다.",
     "whatsChanging": "무엇이 변경되나요?",
     "automaticBackupIncluded": "자동 백업 포함",
     "yamlFrontmatterIndustryStandard": "YAML 프론트매터는 업계 표준입니다",
-    "noMigrationNeeded": "마이그레이션이 필요하지 않습니다 — 시스템이 이미 최신 상태입니다.",
-    "importantBackupData": "중요: 데이터 백업"
+    "noMigrationNeeded": "마이그레이션할 것이 없습니다. 데이터가 이미 최신 상태입니다.",
+    "importantBackupData": "중요: 데이터 백업",
+    "sharingNowWithData": "이제 공유 데이터가 노트와 폴더에 함께 저장됩니다.",
+    "sharingMovesDescription": "공유 정보가 중앙 파일에서 내 데이터 안으로 옮겨집니다. 이제 폴더도 공유할 수 있고, 공유된 폴더는 별도 섹션이 아니라 내 사이드바에 표시됩니다.",
+    "whatsHappeningBody": "<code>.sharing.json</code>의 모든 공유는 해당 항목의 frontmatter에 기록되고, 모든 폴더에는 식별 정보, 공유, 정렬을 담은 <code>.category-info.json</code>이 생깁니다. 데이터를 옮긴 뒤 예전 파일은 삭제됩니다.",
+    "migrationChanges": "마이그레이션 변경 사항",
+    "sharingTravelsTitle": "공유 정보가 파일과 함께 이동합니다",
+    "sharingTravelsBody": "공유된 항목은 누구와 공유했는지를 자체 frontmatter에 기록하므로, 옮기거나 이름을 바꿔도 공유가 끊기지 않습니다.",
+    "folderSharingTitle": "폴더 공유",
+    "folderSharingBody": "폴더를 공유하면 그 안의 모든 것이 지금은 물론 앞으로도 함께 공유됩니다. 받는 사람의 사이드바에는 일반 폴더로 보입니다.",
+    "oneFilePerFolderTitle": "폴더당 파일 하나",
+    "oneFilePerFolderBody": "<code>.order.json</code>은 <code>.category-info.json</code>에 합쳐지고, 정렬은 파일명 대신 uuid를 기준으로 합니다.",
+    "permissionsUnchangedTitle": "권한은 그대로입니다",
+    "permissionsUnchangedBody": "읽기, 편집, 삭제 권한은 사용자별, 항목별로 지금과 똑같이 유지됩니다.",
+    "backupWarningBody": "이 마이그레이션은 노트와 체크리스트 전체의 frontmatter를 다시 쓰고 예전 <code>.sharing.json</code>과 <code>.order.json</code> 파일을 삭제합니다. 진행하기 전에 <code>data</code> 폴더를 백업하세요.",
+    "backupConfirmLabel": "data 폴더를 백업했고 마이그레이션 과정을 이해했습니다.",
+    "backupConfirmHint": "계속하기 전에 백업이 있는지 확인하세요.",
+    "sharingDataMigrated": "공유 및 정렬 데이터를 마이그레이션했습니다.",
+    "whatWasChanged": "변경된 내용:",
+    "migrationPartial": "마이그레이션이 남은 파일과 함께 끝났습니다",
+    "leftoversTitle": "일부 예전 파일이 남아 있습니다",
+    "leftoversBody": "마이그레이션이 모든 것을 변환하지 못해 아래의 예전 파일을 디스크에 그대로 두었습니다. 삭제된 것은 없습니다. 원인을 고친 뒤 마이그레이션을 다시 실행하거나, 지금 앱으로 들어가서 나중에 처리해도 됩니다.",
+    "overrideConfirmLabel": "그래도 계속하고 이 페이지를 더 이상 표시하지 않기.",
+    "overrideConfirmHint": "남은 파일은 디스크에 그대로 있지만, 앱은 데이터를 마이그레이션된 것으로 취급합니다. 위에 나온 공유나 정렬은 다시 마이그레이션할 때까지 적용되지 않으며, 다시 마이그레이션은 언제든 /migration?force=1에서 할 수 있습니다.",
+    "continueAnyway": "그래도 계속",
+    "overriding": "계속하는 중...",
+    "overrideFailed": "마이그레이션을 건너뛰지 못했습니다"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "카테고리 이름이 성공적으로 변경되었습니다",
+    "categoryRenamedSuccessfully": "카테고리 이름이 변경되었습니다",
     "failedToRenameCategory": "카테고리 이름 변경에 실패했습니다",
     "categoryRenamedSuccessfullyMessage": "카테고리 {categoryName}이(가) {newName}(으)로 변경되었습니다",
-    "failedToRenameCategoryMessage": "카테고리 이름을 변경하는 중 오류가 발생했습니다."
+    "failedToRenameCategoryMessage": "카테고리 이름을 바꾸는 중 문제가 발생했습니다."
   },
   "auditLogs": {
     "title": "감사 로그",
@@ -1626,17 +1660,17 @@
     "exportJSON": "JSON 내보내기",
     "exportCSV": "CSV 내보내기",
     "cleanupOldLogs": "오래된 로그 정리",
-    "confirmCleanup": "{days}일보다 오래된 로그를 삭제하시겠습니까? 이 작업은 모든 사용자에게 영향을 미치며 되돌릴 수 없습니다.",
+    "confirmCleanup": "{days}일보다 오래된 로그를 삭제할까요? 모든 사용자에게 영향을 주며 되돌릴 수 없습니다.",
     "confirmCleanupUnlimited": "자동 정리가 설정되어 있지 않습니다(무제한 보관). 필요 시 수동으로 오래된 로그를 삭제할 수 있습니다.",
     "deleteAllLogsModalTitle": "모든 감사 로그 삭제",
     "deleteAllLogsWarning": "오래된 로그뿐 아니라 모든 로그가 삭제됩니다",
     "deleteAllLogsWarningDescription": "시스템의 전체 감사 로그 기록이 삭제됩니다.",
     "deletingAllLogs": "모든 로그 삭제 중...",
     "deleteAllLogsButton": "모든 로그 삭제",
-    "cleanupSuccess": "{count}개의 오래된 로그 파일을 성공적으로 삭제했습니다",
+    "cleanupSuccess": "오래된 로그 파일 {count}개를 삭제했습니다",
     "cleanupError": "오래된 로그 정리에 실패했습니다",
-    "userDescription": "시스템에서의 모든 활동과 작업을 확인합니다",
-    "adminDescription": "시스템 전체의 사용자 활동을 확인하고 관리합니다",
+    "userDescription": "Jotty에서 내가 한 모든 활동",
+    "adminDescription": "이 인스턴스에서 모든 사용자가 한 활동",
     "level": "수준",
     "allLevels": "모든 수준",
     "allCategories": "모른 카테고리",
@@ -1659,13 +1693,9 @@
     "login": "로그인",
     "logout": "로그아웃",
     "register": "회원가입",
-    "sessionTerminated": "세션 종료됨",
     "sessionterminated": "세션 종료됨",
-    "userCreated": "사용자 생성됨",
     "usercreated": "사용자 생성됨",
-    "userUpdated": "사용자 업데이트됨",
     "userupdated": "사용자 업데이트됨",
-    "userDeleted": "사용자 삭제됨",
     "userdeleted": "사용자 삭제됨",
     "profileupdated": "프로필 업데이트됨",
     "checklistcreated": "체크리스트 생성됨",
@@ -1704,9 +1734,9 @@
     "topActions": "주요 작업",
     "mostActiveUsers": "가장 활발한 사용자",
     "oldLogsFound": "{days}일보다 오래된 로그 파일이 {count}개 있습니다.",
-    "oldLogsFoundDescription": "정리하시겠습니까? 이 작업은 되돌릴 수 없습니다.",
+    "oldLogsFoundDescription": "정리할까요? 되돌릴 수 없습니다.",
     "cleanUpNow": "지금 정리",
-    "cleanupSuccessMessage": "{count}개의 오래된 로그 파일을 성공적으로 삭제했습니다.",
+    "cleanupSuccessMessage": "오래된 로그 파일 {count}개를 삭제했습니다.",
     "security": "보안",
     "mfasecretgenerated": "MFA 비밀 키 생성됨",
     "mfaenabled": "MFA 활성화됨",
@@ -1722,6 +1752,7 @@
     "howTo": "사용 방법",
     "shortcuts": "단축키",
     "markdownGuide": "마크다운 가이드",
+    "brain": "링크와 브레인",
     "customisations": "커스트마이징",
     "docker": "도커",
     "envVariables": "환경 변수",
@@ -1729,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "암호화",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "번역",
     "unraid": "Unraid",
     "patches": "패치"
@@ -1742,6 +1774,7 @@
   },
   "notifications": {
     "title": "알림",
+    "unread": "읽지 않음",
     "markAllRead": "모두 읽은 것으로 표시",
     "clearAll": "모두 지우기",
     "empty": "알림 없음",
@@ -1749,12 +1782,99 @@
     "assignmentMessage": "\"{task}\"의 \"{board}\"",
     "reminderTitle": "작업 기한이 초과됨",
     "reminderMessage": "\"{board}\"의 \"{task}\"이(가) 알림을 지나갔습니다.",
-    "unread": "읽지 않음",
     "sharingTitle": "{user} 님이 {type}을(를) 공유했습니다",
     "sharingMessage": "공유된 {type}을(를) 보려면 열기",
     "sharingFolderTitle": "{user} 님이 {type} 폴더를 공유했습니다",
-    "sharingFolderMessage": "“{folder}”를 보려면 열기",
+    "sharingFolderMessage": "\"{folder}\" 보려면 열기",
     "mentionTitle": "{user}님이 댓글에서 회원님을 언급했습니다",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
+  },
+  "relations": {
+    "indexing": "연결 관계 인덱싱 중...",
+    "unreachable": "접근할 수 없음",
+    "createFromWikilink": "\"{title}\" 노트 만들기",
+    "mentionedIn": "언급된 곳",
+    "mentionedInHint": "이 노트들은 이 제목을 일반 텍스트로 쓰고 있습니다. 하나를 링크하면 연결됩니다.",
+    "linkMention": "링크",
+    "linked": "{title}의 언급을 링크했습니다",
+    "linkFailed": "그 언급을 링크하지 못했습니다",
+    "kind": {
+      "mention": "링크",
+      "wiki": "위키링크"
+    }
+  },
+  "brain": {
+    "title": "브레인",
+    "openBrain": "브레인에서 열기",
+    "search": "브레인에서 찾기...",
+    "dimension": "보기",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "이 항목 주변",
+    "global": "전체",
+    "depth": "깊이 {depth}",
+    "colourBy": "색상 기준",
+    "colourModes": {
+      "type": "유형",
+      "category": "카테고리"
+    },
+    "filters": {
+      "notes": "노트",
+      "checklists": "체크리스트",
+      "tags": "태그",
+      "ghosts": "아직 안 쓴 것",
+      "suggestions": "추천",
+      "orphans": "외톨이"
+    },
+    "kind": {
+      "note": "노트",
+      "checklist": "체크리스트",
+      "ghost": "아직 안 쓴 것",
+      "tag": "태그"
+    },
+    "edges": {
+      "mention": "링크",
+      "wiki": "위키링크",
+      "suggested": "추천",
+      "tag": "태그"
+    },
+    "linksTo": "링크 대상",
+    "linkedFrom": "링크한 곳",
+    "suggested": "관련 있을지도",
+    "promote": "{title}에 링크",
+    "lonely": "아직 여기에 연결된 것이 없습니다. 다른 노트에서 @ 또는 [[로 언급해 보세요.",
+    "open": "열기",
+    "createGhost": "이 노트 쓰기",
+    "openTag": "이 태그가 붙은 항목 모두 보기",
+    "createFailed": "그 노트를 만들지 못했습니다",
+    "connectFailed": "두 항목을 링크하지 못했습니다",
+    "connected": "{source}을(를) {target}에 링크했습니다",
+    "empty": "브레인이 조용합니다. @ 또는 [[로 노트와 체크리스트를 링크하면 여기에 나타납니다.",
+    "viewingOwner": "{owner} 님의 브레인 보는 중",
+    "summary": "항목 {items}개, 링크 {links}개, {shown}개 표시"
+  },
+  "apiExplorer": {
+    "title": "API 탐색기",
+    "intro": "이 인스턴스(v{version})가 제공하는 모든 엔드포인트로, 실제로 요청을 처리하는 코드에서 생성됩니다. 하나를 골라 채운 뒤 보내세요.",
+    "realData": "요청은 API 키 소유자 권한으로 실제 데이터에 실행됩니다. 여기서 DELETE를 보내면 정말로 삭제됩니다.",
+    "apiKey": "API 키",
+    "apiKeyHint": "이 페이지에만 보관되며 페이지를 떠나면 잊혀집니다.",
+    "useMyKey": "내 키 사용",
+    "noKeyYet": "아직 API 키가 없습니다. 프로필 설정에서 생성하세요.",
+    "filter": "필터",
+    "filterPlaceholder": "경로, 이름 또는 메서드",
+    "noMatches": "필터와 일치하는 항목이 없습니다.",
+    "body": "요청 본문 (JSON)",
+    "showSchema": "스키마 보기",
+    "hideSchema": "스키마 숨기기",
+    "send": "보내기",
+    "sending": "보내는 중...",
+    "keyRequired": "먼저 API 키를 추가하세요.",
+    "noKeyNeeded": "API 키 필요 없음",
+    "deprecated": "사용 중단됨",
+    "requestFailed": "요청이 서버에 닿지 못했습니다. 연결을 확인하세요.",
+    "responseMeta": "{status}, {ms} ms"
   }
 }
diff --git a/app/_translations/nl.json b/app/_translations/nl.json
index f7397268e..810fedc6f 100644
--- a/app/_translations/nl.json
+++ b/app/_translations/nl.json
@@ -127,6 +127,7 @@
     "expandAll": "Alles uitklappen",
     "saveChanges": "Wijzigingen opslaan",
     "all": "Alle",
+    "items": "Items",
     "showAll": "Alles tonen",
     "creating": "Aanmaken...",
     "createCategoryHeader": "Een nieuwe categorie aanmaken",
@@ -173,7 +174,7 @@
     "noResults": "Geen resultaten",
     "by": "door {owner}",
     "unsavedChanges": "Niet-opgeslagen wijzigingen",
-    "unsavedChangesDetected": "⚠️ Niet-opgeslagen wijzigingen gedetecteerd",
+    "unsavedChangesDetected": "Niet-opgeslagen wijzigingen",
     "unsavedChangesMessage": "U heeft niet-opgeslagen wijzigingen in {noteTitle}. Als u nu weggaat, gaan uw wijzigingen verloren.",
     "whatToDoWithUnsavedChanges": "Wat wilt u doen met uw niet-opgeslagen wijzigingen?",
     "discard": "Verwerpen",
@@ -238,44 +239,42 @@
     "openSearch": "Zoeken openen",
     "closeSearch": "Zoeken sluiten",
     "moreOptions": "Meer opties",
+    "history": "Geschiedenis",
+    "disable": "Uitschakelen",
+    "restoring": "Herstellen...",
+    "retry": "Opnieuw proberen",
     "copiedToClipboard": "Gekopieerd naar klembord",
     "offline": "Offline",
     "connected": "Aangesloten",
     "reconnecting": "Opnieuw verbinding maken...",
     "hide": "Verbergen",
-    "disable": "Uitschakelen",
-    "history": "Geschiedenis",
-    "items": "Items",
-    "restoring": "Herstellen...",
-    "retry": "Opnieuw proberen",
     "thisEntry": "deze invoer",
     "preview": "Voorbeeld"
   },
-  "comments": {
-    "title": "Reacties",
-    "titleWithCount": "{count, plural, one {# Reactie} other {# Reacties}}",
-    "noComments": "Nog geen reacties. Start het gesprek!",
-    "addComment": "Reactie toevoegen...",
-    "replyPlaceholder": "Schrijf een antwoord...",
-    "post": "Plaatsen",
-    "reply": "Beantwoorden",
-    "edit": "Bewerken",
-    "delete": "Verwijderen",
-    "save": "Opslaan",
-    "cancel": "Annuleren",
-    "edited": "bewerkt",
-    "deleteConfirmTitle": "Reactie verwijderen?",
-    "deleteConfirmMessage": "Dit verwijdert de reactie en alle antwoorden. Deze actie kan niet ongedaan worden gemaakt.",
-    "commentDeleted": "Reactie verwijderd",
-    "commentAdded": "Reactie toegevoegd",
-    "commentUpdated": "Reactie bijgewerkt",
-    "failedToAdd": "Reactie toevoegen mislukt",
-    "failedToEdit": "Reactie bewerken mislukt",
-    "failedToDelete": "Reactie verwijderen mislukt",
-    "failedToLoad": "Reacties laden mislukt",
-    "readOnly": "Je hebt bewerkingsrechten nodig om op deze kaart te reageren.",
-    "replyTo": "Antwoorden aan {author}",
-    "noUsersFound": "Geen gebruikers gevonden"
+  "history": {
+    "noteHistory": "Notitiegeschiedenis",
+    "restore": "Herstellen",
+    "restoreVersion": "Versie herstellen",
+    "restoreConfirm": "Deze versie herstellen? De huidige inhoud wordt vervangen.",
+    "noHistory": "Geen geschiedenis beschikbaar",
+    "noHistoryDescription": "Sla je notitie op om een geschiedenispunt aan te maken.",
+    "loadMore": "Meer laden",
+    "featureDisabled": "Geschiedenis uitgeschakeld",
+    "disabledAdmin": "Notitiegeschiedenis staat uit. Je kunt het aanzetten in Beheerdersinstellingen > Editor.",
+    "disabledUser": "Notitiegeschiedenis staat uit. Vraag je beheerder om het aan te zetten.",
+    "goToSettings": "Naar instellingen",
+    "manualSavesOnly": "Alleen handmatig opslaan maakt geschiedenis aan. Automatisch opslaan niet.",
+    "fetchError": "Geschiedenis laden mislukt",
+    "restoreError": "Versie herstellen mislukt",
+    "viewContent": "Inhoud bekijken",
+    "viewDiff": "Wijzigingen bekijken",
+    "actionCreate": "Aangemaakt",
+    "actionUpdate": "Bijgewerkt",
+    "actionRename": "Hernoemd",
+    "actionMove": "Verplaatst",
+    "actionDelete": "Verwijderd",
+    "actionInit": "Geïnitialiseerd",
+    "actionUnknown": "Gewijzigd"
   },
   "auth": {
     "loginTitle": "Inloggen",
@@ -310,7 +309,7 @@
     "createUser": "Gebruiker aanmaken",
     "attemptsRemaining": "Waarschuwing: {count, plural, one {# poging} other {# pogingen}} over voordat account wordt vergrendeld",
     "accountLocked": "Te veel mislukte pogingen. Probeer het opnieuw over {seconds} {seconds, plural, one {seconde} other {seconden}}",
-    "notAuthorized": "U bent niet geautoriseerd om toegang te krijgen tot deze applicatie. Neem contact op met uw beheerder.",
+    "notAuthorized": "Je hebt geen toegang tot deze app. Vraag het je beheerder.",
     "rememberMe": "Aangemeld blijven"
   },
   "mfa": {
@@ -335,7 +334,7 @@
     "invalidCode": "Ongeldige authenticatiecode",
     "invalidRecoveryCode": "Ongeldige herstelcode",
     "mfaRequired": "Twee-factorauthenticatie is vereist",
-    "mfaEnabledSuccess": "Twee-factorauthenticatie succesvol ingeschakeld",
+    "mfaEnabledSuccess": "Twee-factorauthenticatie ingeschakeld",
     "mfaDisabledSuccess": "Twee-factorauthenticatie uitgeschakeld",
     "tooManyAttempts": "Te veel mislukte pogingen. Probeer het later opnieuw.",
     "disableTitle": "Twee-factorauthenticatie uitschakelen",
@@ -357,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Dit zal uw huidige herstelcode ongeldig maken",
     "regenerateRecoveryCodeDescription": "Voer uw 2FA-code in om een nieuwe herstelcode te genereren. Uw oude code werkt niet meer.",
     "recoveryCodeRegenerated": "Nieuwe herstelcode gegenereerd",
-    "recoveryCodeRegeneratedInfo": "Uw nieuwe herstelcode is gegenereerd. Bewaar deze op een veilige plaats - dit is de enige keer dat u deze ziet.",
-    "recoveryCodeRegeneratedSuccess": "Herstelcode succesvol opnieuw gegenereerd",
+    "recoveryCodeRegeneratedInfo": "Je nieuwe herstelcode staat klaar. Bewaar hem op een veilige plek, dit is de enige keer dat je hem ziet.",
+    "recoveryCodeRegeneratedSuccess": "Herstelcode opnieuw gegenereerd",
     "recoveryCodeProfileDescription": "Gebruik deze code voor accountherstel als u geen toegang meer heeft tot uw authenticator-app",
     "disableMfaForUser": "2FA uitschakelen voor deze gebruiker",
     "recoveryCodeRequired": "Herstelcode is vereist",
@@ -372,7 +371,7 @@
     "recent": "Recent",
     "browseAndManage": "Blader door en beheer al uw notities",
     "noNotesYet": "Nog geen notities",
-    "createFirstNote": "Maak uw eerste notitie aan om te beginnen met uw kennisbank.",
+    "createFirstNote": "Nog niets hier. Maak je eerste notitie aan.",
     "createNewNote": "Nieuwe notitie aanmaken",
     "noNotesFound": "Geen notities gevonden",
     "tryAdjustingFilters": "Probeer uw filters aan te passen of maak een nieuwe notitie aan.",
@@ -403,22 +402,26 @@
     "enterNoteTitle": "Voer notitietitel in...",
     "byType": "Op type",
     "publiclySharedNote": "Openbaar gedeeld",
+    "sharedPubliclyBy": "Deze notitie wordt openbaar gedeeld door {owner}",
+    "copyRawContent": "Kopieer markdown",
     "quickSave": "Snel opslaan",
     "noteNotFound": "Notitie niet gevonden",
     "unarchiveNote": "Notitie dearchiveren",
     "enterNoteName": "Voer notitienaam in...",
     "updateNote": "Notitie bijwerken",
-    "tags": "Tags",
-    "noTagsFound": "Geen tags gevonden",
-    "searchTags": "Tags zoeken...",
-    "copyRawContent": "Kopieer markdown",
     "printSaveAsPdf": "Afdrukken / Opslaan als PDF",
     "tableOfContents": "Inhoudsopgave",
     "wordCount": "{count, plural, one {# woord} other {# woorden}}",
     "charCount": "{count, plural, one {# teken} other {# tekens}}",
-    "readingTime": "{count, plural, one {# minuut leestijd} other {# minuten leestijd}}"
+    "readingTime": "{count, plural, one {# minuut leestijd} other {# minuten leestijd}}",
+    "tags": "Tags",
+    "noTagsFound": "Geen tags gevonden",
+    "searchTags": "Tags zoeken...",
+    "createNoteFailed": "Kon de notitie niet aanmaken",
+    "createCategoryFailed": "Kon de categorie niet aanmaken, de notitie is niet aangemaakt"
   },
   "checklists": {
+    "sharedPubliclyBy": "Deze checklist wordt openbaar gedeeld door {owner}",
     "title": "Checklists",
     "allChecklists": "Alle checklists",
     "completed": "Voltooid",
@@ -432,7 +435,7 @@
     "progress": "Voortgang",
     "totalItems": "Totaal aantal items",
     "noChecklistsYet": "Nog geen checklists",
-    "createFirstChecklist": "Maak uw eerste checklist aan om uw taken te organiseren.",
+    "createFirstChecklist": "Nog niets hier. Maak je eerste checklist aan.",
     "newChecklist": "Nieuwe checklist",
     "noChecklistsFound": "Geen checklists gevonden",
     "tryAdjustingFiltersChecklist": "Probeer uw filters aan te passen of maak een nieuwe checklist aan.",
@@ -474,6 +477,7 @@
     "checklistType": "Checklist-type",
     "simpleChecklist": "Eenvoudige checklist",
     "taskProject": "Takenproject",
+    "kanbanBoard": "Kanban-bord",
     "basicTodoItems": "Basis takenlijst-items",
     "withTimeTracking": "Met tijdregistratie",
     "noDescription": "Geen beschrijving",
@@ -500,23 +504,24 @@
     "clearAllCompletedConfirmMessage": "Weet u zeker dat u alle {count} voltooide items en hun kinderen wilt verwijderen? Deze actie kan niet ongedaan worden gemaakt.",
     "clearAllIncompleteConfirmMessage": "Weet u zeker dat u alle {count} onvolledige items en hun kinderen wilt verwijderen? Deze actie kan niet ongedaan worden gemaakt.",
     "convertChecklistType": "Checklist-type converteren",
-    "convertTypeConfirmation": "U staat op het punt om te converteren van {currentType} naar {newType}. Weet u zeker dat u wilt doorgaan?",
-    "dataLossWarning": "⚠️ Waarschuwing voor gegevensverlies",
+    "convertTypeConfirmation": "Converteren van {currentType} naar {newType}?",
+    "dataLossWarning": "Waarschuwing voor gegevensverlies",
     "dataLossWarningItems": "De volgende gegevens gaan verloren:",
     "allTaskStatusesReset": "Alle taakstatussen worden gereset",
     "timeTrackingDataLost": "Tijdregistratiegegevens gaan verloren",
     "estimatedTimesRemoved": "Geschatte tijden worden verwijderd",
     "targetDatesCleared": "Streefdatums worden gewist",
-    "enhancedFeatures": "✨ Uitgebreide functies",
+    "enhancedFeatures": "Wat je krijgt",
     "enhancedFeaturesYouWillGain": "U krijgt:",
     "kanbanBoardWithDragDrop": "Kanban-bord met slepen & neerzetten",
     "taskStatusTracking": "Taakstatusregistratie (Te doen, Bezig, etc.)",
     "timeTrackingWithTimer": "Tijdregistratie met ingebouwde timer",
-    "actionCannotBeUndone": "Deze actie kan niet ongedaan worden gemaakt. Weet u zeker dat u wilt converteren?",
+    "actionCannotBeUndone": "Dit kan niet ongedaan worden gemaakt. Toch converteren?",
     "convertAndLoseData": "Converteren & gegevens verliezen",
     "convert": "Converteren",
     "convertToSimpleChecklist": "Converteren naar eenvoudige checklist",
     "convertToTaskProject": "Converteren naar takenproject",
+    "convertToKanbanBoard": "Omzetten naar Kanban-bord",
     "pasteYourList": "Plak uw lijst (één item per regel)",
     "addItems": "{count} items toevoegen",
     "itemsWillBeAdded": "{count} items worden toegevoegd",
@@ -525,11 +530,35 @@
     "noItemsYet": "Nog geen items",
     "addFirstItem": "Voeg uw eerste item toe om te beginnen!",
     "noTasks": "Geen taken",
-    "noSubtasksYet": "Nog geen subtaken. Voeg er hieronder een toe om te beginnen.",
+    "noSubtasksYet": "Nog geen subtaken. Voeg er hieronder een toe.",
     "addTime": "Tijd toevoegen",
-    "enterTimeInMinutes": "Voer uw tijd in minuten in",
-    "convertToKanbanBoard": "Omzetten naar Kanban-bord",
-    "kanbanBoard": "Kanban-bord"
+    "enterTimeInMinutes": "Voer uw tijd in minuten in"
+  },
+  "comments": {
+    "title": "Reacties",
+    "titleWithCount": "{count, plural, one {# Reactie} other {# Reacties}}",
+    "noComments": "Nog geen reacties. Start het gesprek!",
+    "addComment": "Reactie toevoegen...",
+    "replyPlaceholder": "Schrijf een antwoord...",
+    "post": "Plaatsen",
+    "reply": "Beantwoorden",
+    "edit": "Bewerken",
+    "delete": "Verwijderen",
+    "save": "Opslaan",
+    "cancel": "Annuleren",
+    "edited": "bewerkt",
+    "deleteConfirmTitle": "Reactie verwijderen?",
+    "deleteConfirmMessage": "Dit verwijdert de reactie en alle antwoorden. Deze actie kan niet ongedaan worden gemaakt.",
+    "commentDeleted": "Reactie verwijderd",
+    "commentAdded": "Reactie toegevoegd",
+    "commentUpdated": "Reactie bijgewerkt",
+    "failedToAdd": "Reactie toevoegen mislukt",
+    "failedToEdit": "Reactie bewerken mislukt",
+    "failedToDelete": "Reactie verwijderen mislukt",
+    "failedToLoad": "Reacties laden mislukt",
+    "readOnly": "Je hebt bewerkingsrechten nodig om op deze kaart te reageren.",
+    "replyTo": "Antwoorden aan {author}",
+    "noUsersFound": "Geen gebruikers gevonden"
   },
   "tasks": {
     "title": "Taken",
@@ -558,7 +587,7 @@
     "overdue": "Achterstallig",
     "browseAndManageTaskLists": "Blader door en beheer al uw takenlijsten",
     "noTaskListsYet": "Nog geen takenlijsten",
-    "createFirstTaskList": "Maak uw eerste takenlijst aan om uw projecten te beheren.",
+    "createFirstTaskList": "Nog niets hier. Maak je eerste takenlijst aan.",
     "newTaskList": "Nieuwe takenlijst",
     "taskLists": "Takenlijsten",
     "noTaskListsFound": "Geen takenlijsten gevonden",
@@ -606,7 +635,7 @@
     "changeStatus": "Status wijzigen",
     "noBoards": "Geen borden gevonden",
     "noBoardsYet": "Nog geen Kanban-borden",
-    "createFirstBoard": "Maak je eerste Kanban-bord om je projecten te beheren.",
+    "createFirstBoard": "Nog niets hier. Maak je eerste Kanban-bord aan.",
     "newBoard": "Nieuw bord",
     "tryAdjustingFilters": "Pas je filters aan of maak een nieuw bord.",
     "completed": "Voltooid",
@@ -659,7 +688,7 @@
     "quickSettingsHeader": "Snelle instellingen (alleen apparaat)",
     "adminSettings": "Beheerdersdashboard",
     "apiKey": "API-sleutel",
-    "apiKeyDescription": "Genereer een API-sleutel voor programmatische toegang tot uw checklists en notities",
+    "apiKeyDescription": "Genereer een API-sleutel zodat scripts en apps bij je checklists en notities kunnen",
     "hideApiKey": "API-sleutel verbergen",
     "showApiKey": "API-sleutel tonen",
     "copyApiKey": "API-sleutel kopiëren",
@@ -677,13 +706,13 @@
     "removeAvatar": "Avatar verwijderen",
     "usernameRequired": "Gebruikersnaam is verplicht",
     "passwordsDoNotMatch": "Nieuwe wachtwoorden komen niet overeen",
-    "profileUpdated": "Profiel succesvol bijgewerkt!",
+    "profileUpdated": "Profiel bijgewerkt",
     "failedToUpdateProfile": "Profiel bijwerken mislukt",
     "failedToUpdateProfileRetry": "Profiel bijwerken mislukt. Probeer het opnieuw.",
-    "avatarUpdated": "Avatar succesvol bijgewerkt!",
+    "avatarUpdated": "Avatar bijgewerkt",
     "failedToUpdateAvatar": "Avatar bijwerken mislukt",
     "failedToUpdateAvatarRetry": "Avatar bijwerken mislukt. Probeer het opnieuw.",
-    "avatarRemoved": "Avatar succesvol verwijderd!",
+    "avatarRemoved": "Avatar verwijderd",
     "failedToRemoveAvatar": "Avatar verwijderen mislukt",
     "failedToRemoveAvatarRetry": "Avatar verwijderen mislukt. Probeer het opnieuw.",
     "activeSessions": "Actieve sessies",
@@ -703,11 +732,11 @@
     "auditLogsTab": "Gebruikerslogboeken",
     "rebuildLinkIndexes": "Herbouw linkindexen om verbindingsgegevens bij te werken",
     "rebuildingLinkIndex": "Linkindex herbouwen...",
-    "successfullyRebuiltIndex": "Linkindex succesvol herbouwd",
-    "successfullyRebuiltIndexReload": "Linkindex succesvol herbouwd! De pagina wordt opnieuw geladen om bijgewerkte verbindingen te tonen.",
+    "successfullyRebuiltIndex": "Linkindex herbouwd",
+    "successfullyRebuiltIndexReload": "Linkindex herbouwd. De pagina wordt opnieuw geladen om de nieuwe verbindingen te tonen.",
     "failedToRebuildIndex": "Linkindex herbouwen mislukt. Probeer het opnieuw.",
     "contentLinks": "Inhoudslinks",
-    "visualizeRelationships": "Visualiseer relaties tussen uw notities en checklists",
+    "visualizeRelationships": "Bekijk hoe je notities en checklists naar elkaar linken",
     "connectedItems": "Verbonden items",
     "noLinksFound": "Geen links gevonden",
     "startCreatingInternalLinks": "Begin met het maken van interne links door `@` in uw notities te typen om het relatienetwerk hier te zien.",
@@ -718,8 +747,8 @@
     "isolated": "geïsoleerd",
     "connection": "verbinding",
     "connection_plural": "verbindingen",
-    "terminateSessionConfirm": "Weet u zeker dat u deze sessie wilt beëindigen?",
-    "terminateAllSessionsConfirm": "Weet u zeker dat u alle andere sessies wilt beëindigen?",
+    "terminateSessionConfirm": "Deze sessie beëindigen?",
+    "terminateAllSessionsConfirm": "Alle andere sessies beëindigen?",
     "validationErrorTitle": "Validatiefout",
     "visibleGraphSummary": "{items} zichtbare items, {links} zichtbare links",
     "graphTruncated": "De {visible} meest verbonden items worden weergegeven. {omitted} minder verbonden items zijn weggelaten.",
@@ -790,10 +819,10 @@
     "chooseAutoSaveInterval": "Kies het interval voor automatisch opslaan van uw notities.",
     "defaultMode": "Standaardmodus",
     "selectNotesDefaultMode": "Selecteer standaardmodus notities",
-    "chooseNotesDefaultMode": "Kies of de notitie automatisch in bewerkingsmodus staat of niet {mode} knop in de notitie-editor).",
+    "chooseNotesDefaultMode": "Kies of notities in bewerkingsmodus openen. Je kunt altijd wisselen met de {mode}-knop in de notitie-editor.",
     "defaultEditor": "Standaardeditor",
     "selectNotesDefaultEditor": "Selecteer standaardeditor notities",
-    "chooseDefaultEditor": "Kies de standaardeditor voor uw notities - (u kunt altijd wisselen door op de {editor} knop in de notitie-editor te klikken).",
+    "chooseDefaultEditor": "Kies de standaardeditor voor je notities. Je kunt altijd wisselen met de {editor}-knop in de notitie-editor.",
     "tableSyntaxInNotes": "Tabelsyntax in notities",
     "selectTableSyntax": "Selecteer tabelsyntax",
     "chooseTableSyntax": "Kies hoe tabellen worden weergegeven in uw notities.",
@@ -802,7 +831,7 @@
     "chooseSyntaxTheme": "Kies het syntax-highlightingthema voor de markdown-editor.",
     "minimalMode": "Minimale modus (Rich Text Editor uitschakelen)",
     "selectMinimalMode": "Selecteer minimale modus",
-    "minimalModeDescription": "Indien ingeschakeld wordt een eenvoudige markdown-renderer gebruikt in plaats van de rich text editor. Geavanceerde functies zoals bilaterale linking werken niet in deze modus.",
+    "minimalModeDescription": "Gebruikt een eenvoudige markdown-renderer in plaats van de rich text editor. Bilaterale links en andere geavanceerde functies werken niet in deze modus.",
     "defaultNoteFilter": "Standaard notitiefilter",
     "selectDefaultNoteFilter": "Selecteer standaard notitiefilter",
     "chooseDefaultNoteFilter": "Kies het standaardfilter dat wordt toegepast bij het openen van de Notitiespagina.",
@@ -829,8 +858,8 @@
     "currentPassword": "Huidig wachtwoord",
     "newPassword": "Nieuw wachtwoord",
     "confirmPassword": "Bevestig wachtwoord",
-    "passwordChanged": "Wachtwoord succesvol gewijzigd",
-    "settingsSaved": "Instellingen succesvol opgeslagen",
+    "passwordChanged": "Wachtwoord gewijzigd",
+    "settingsSaved": "Instellingen opgeslagen",
     "dashCase": "Streepjesnotatie (bijv., mijn-bestand-naam.md)",
     "minimal": "Minimaal (verwijder alleen ongeldige tekens)",
     "noRename": "Niet hernoemen (behoud originele bestandsnaam)",
@@ -840,6 +869,7 @@
     "seconds_plural": "{count} seconden",
     "hours12": "12 uur",
     "hours24": "24 uur",
+    "useSystemDefault": "Gebruik systeemstandaard",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "Standaard",
@@ -863,7 +893,7 @@
     "chooseQuickCreateNotes": "Kies de modus voor snel notities aanmaken.",
     "quickCreateNotesShowModal": "Toon modal bij het aanmaken van notities",
     "quickCreateNotesSkipModal": "Sla modal over en maak direct aan",
-    "quickCreateNotesDescription": "Indien ingeschakeld wordt bij het aanmaken van een nieuwe notitie de aanmaak-modal overgeslagen en gaat u direct naar de notitie-editor.",
+    "quickCreateNotesDescription": "Slaat het venster voor een nieuwe notitie over en brengt je direct naar de editor.",
     "defaultCategory": "Standaardcategorie voor snel aanmaken notities",
     "selectDefaultCategory": "Selecteer standaardcategorie...",
     "defaultCategoryDescription": "Nieuwe notities worden in deze categorie aangemaakt bij het gebruik van snel aanmaken.",
@@ -901,7 +931,7 @@
     "hideStatusOnCardsLabel": "Status op Kanban-kaarten",
     "showStatusOnCards": "Status tonen",
     "hideStatusOnCards": "Status verbergen",
-    "hideStatusOnCardsDescription": "Verbergt het statuslabel op Kanban-kaarten. De status is al zichtbaar via de kolom waarin de kaart zich bevindt.",
+    "hideStatusOnCardsDescription": "Verbergt het statuslabel op Kanban-kaarten. De kolom laat de status al zien.",
     "hideMobileStatusDropdownLabel": "Mobiele statuskeuzelijst op kaarten",
     "showMobileStatusDropdown": "Mobiele keuzelijst tonen",
     "hideMobileStatusDropdown": "Mobiele keuzelijst verbergen",
@@ -914,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "Verbergt de timer en geregistreerde sessies op Kanban-kaarten. Tijdregistratie blijft beschikbaar in de detailweergave van de kaart.",
     "selectStatusOnCards": "Selecteer zichtbaarheid status",
     "codeBlockChoice": "Kies de codeblokstijl",
-    "themedCodeBlock": "Thema-codeblok",
     "defaultCodeBlock": "Codepen (standaard)",
+    "themedCodeBlock": "Thema-codeblok",
     "codeBlockChoiceDescription": "Kies tussen de codepen-achtige standaardcodeblokstijl of een thematische codeblokstijl.",
     "checklistItemClickAction": "Klikactie op checklistitem",
     "selectChecklistItemClickAction": "Selecteer de klikactie voor het checklistitem",
-    "checklistItemClickActionDescription": "Kies wat er gebeurt als u op de tekst van een taak klikt. \n\"Markeren als voltooid\" schakelt het selectievakje in (standaard); \nMet 'Taaknaam bewerken' wordt de taak geopend voor inline bewerken. U moet nog steeds op het selectievakje zelf klikken om deze te voltooien.",
+    "checklistItemClickActionDescription": "Kies wat er gebeurt als je op de tekst van een taak klikt. \"Markeren als voltooid\" (standaard) zet het selectievakje aan of uit. \"Taaknaam bewerken\" opent de taak om inline te bewerken, en je klikt op het selectievakje zelf om hem te voltooien.",
     "checklistItemClickActionToggle": "Markeer als compleet/onvolledig",
     "checklistItemClickActionEdit": "Lijstitem bewerken",
     "newItemInsertion": "Positie van nieuwe items",
@@ -927,7 +957,6 @@
     "newItemInsertionDescription": "Kies of nieuwe items bovenaan (standaard) of onderaan een checklist worden toegevoegd.",
     "newItemInsertionTop": "Bovenaan de lijst",
     "newItemInsertionBottom": "Onderaan de lijst",
-    "useSystemDefault": "Gebruik systeemstandaard",
     "selectShowChecklistEmojis": "Emoji-zichtbaarheid kiezen",
     "showChecklistEmojisDescription": "Toont automatisch een emoji naast checklistitems op basis van de tekst."
   },
@@ -970,20 +999,24 @@
     "icon512": "512x512 Icoon",
     "icon512Description": "Hoge-resolutie icoon voor PWA-splashschermen.",
     "notifyNewUpdates": "Notificeer mij van nieuwe updates",
-    "thisUsesGithubAPI": "Dit gebruikt de GitHub API om updates op te halen, uitschakelen schakelt de API volledig uit en staat geen verkeer van en naar github toe.",
+    "thisUsesGithubAPI": "Dit gebruikt de GitHub API om op updates te controleren. Uitzetten stopt al het verkeer van en naar GitHub.",
     "parseContent": "Altijd geparseerde inhoud tonen",
-    "parseContentEnabledDescription": "Wanneer ingeschakeld toont deze instelling de geparseerde titels in de zijbalk, zoekresultaten en over de hele app.",
-    "parseContentDisabledDescription": "Wanneer uitgeschakeld, worden de originele bestandsnamen opgeschoond, leesbaar gemaakt en in plaats daarvan getoond.",
-    "parseContentPerformanceWarning": "Dit op \"nee\" zetten zal de prestaties verbeteren op grote datasets maar kan de leesbaarheid beïnvloeden - vooral bij bestandsnamen met niet-Latijnse tekens.",
+    "parseContentEnabledDescription": "Toont geparseerde titels in de zijbalk, in zoekresultaten en overal elders in de app.",
+    "parseContentDisabledDescription": "Toont in plaats daarvan de originele bestandsnamen, opgeschoond zodat ze leesbaar zijn.",
+    "parseContentPerformanceWarning": "Dit op \"nee\" zetten maakt grote instanties sneller maar titels minder leesbaar, vooral bestandsnamen met niet-Latijnse tekens.",
     "hideLanguageSelector": "Taalselector in header verbergen",
     "hideLanguageSelectorDescription": "Taaldropdown in header tonen/verbergen",
+    "defaultDateFormat": "Standaard datumnotatie",
+    "defaultDateFormatDescription": "Wordt gebruikt wanneer de datumnotatievoorkeur van een gebruiker is ingesteld op \"Gebruik systeemstandaard\".",
+    "defaultTimeFormat": "Standaard tijdformaat",
+    "defaultTimeFormatDescription": "Wordt gebruikt wanneer de tijdnotatievoorkeur van een gebruiker is ingesteld op \"Gebruik systeemstandaard\".",
     "applicationIcons": "Applicatie-iconen",
     "saveChanges": "Wijzigingen opslaan",
     "unsavedChanges": "U heeft niet-opgeslagen wijzigingen.",
     "loadError": "Laadfout",
     "couldNotFetchSettings": "Kon instellingen niet ophalen.",
     "failedToLoadSettings": "Instellingen laden mislukt",
-    "settingsSavedSuccessfully": "Instellingen succesvol opgeslagen.",
+    "settingsSavedSuccessfully": "Instellingen opgeslagen.",
     "failedToSaveSettings": "Instellingen opslaan mislukt",
     "saveError": "Opslagfout",
     "unknownErrorOccurred": "Een onbekende fout is opgetreden.",
@@ -996,7 +1029,7 @@
     "colorVariables": "Kleurvariabelen",
     "livePreview": "Live voorbeeld",
     "unsavedCssChanges": "U heeft niet-opgeslagen CSS-wijzigingen.",
-    "noCustomThemesYet": "Nog geen aangepaste thema's aangemaakt. Klik op \"Thema aanmaken\" om te beginnen.",
+    "noCustomThemesYet": "Nog geen aangepaste thema's. Klik op \"Thema aanmaken\" om er een te maken.",
     "myCustomTheme": "Mijn aangepaste thema",
     "iconNameDescription": "icoonnaam (bijv., PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "App-versie",
@@ -1026,25 +1059,31 @@
     "enableTableToolbarDescription": "Schakel de werkbalk in die verschijnt bij het bewerken van tabellen",
     "bilateralLinks": "Bilaterale links",
     "bilateralLinksDescription": "Schakel de mogelijkheid in om te linken naar notities en checklists in hetzelfde document.",
+    "historyEnabled": "Notitiegeschiedenis",
+    "historyDescription": "Houdt versiegeschiedenis voor notities bij. Hiermee kunt u eerdere versies herstellen. Alleen handmatig opslaan maakt geschiedenispunten (niet autosave).",
+    "disableHistory": "Geschiedenis uitschakelen",
+    "disableHistoryWarning": "Het uitschakelen van de geschiedenis verwijdert permanent alle opgeslagen versies voor alle gebruikers. Dit kan niet ongedaan worden gemaakt.",
+    "historyDisabled": "De notitiegeschiedenis is uitgeschakeld en alle geschiedenisgegevens zijn verwijderd.",
+    "failedToDisableHistory": "Geschiedenis uitschakelen mislukt",
     "configureExternalServices": "Configureer externe service-URL's voor editor-integraties.",
     "drawioUrl": "Draw.io URL",
     "optional": "(Optioneel)",
-    "drawioUrlDescription": "Specificeer een aangepaste Draw.io-instantie-URL. Laat leeg om de standaard publieke instantie te gebruiken (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Gebruik je eigen Draw.io-instantie. Laat leeg voor de publieke (https://embed.diagrams.net).",
     "drawioUrlExample": "Voorbeeld voor zelf-gehost: https://uw-domein.com/drawio",
     "drawioProxyEnabled": "Draw.io proxyen via Jotty",
-    "drawioProxyEnabledDescription": "Schakel dit in om Draw.io-verkeer via Jotty's server te routeren. Vereist voor interne Docker-netwerk-URL's (bijv., http://drawio:8080) die niet toegankelijk zijn vanaf de browsers van gebruikers.",
+    "drawioProxyEnabledDescription": "Stuurt Draw.io-verkeer via de server van Jotty. Nodig voor interne Docker-netwerk-URL's (bijv. http://drawio:8080) die de browsers van gebruikers niet kunnen bereiken.",
     "excalidrawUrl": "Excalidraw URL",
-    "excalidrawUrlDescription": "Specificeer een aangepaste Excalidraw-instantie-URL. Laat leeg om de standaard publieke instantie te gebruiken (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Gebruik je eigen Excalidraw-instantie. Laat leeg voor de publieke (https://excalidraw.com).",
     "excalidrawUrlExample": "Voorbeeld voor zelf-gehost: https://uw-domein.com/excalidraw",
     "excalidrawProxyEnabled": "Excalidraw proxyen via Jotty",
-    "excalidrawProxyEnabledDescription": "Schakel dit in om Excalidraw-verkeer via Jotty's server te routeren. Vereist voor interne Docker-netwerk-URL's (bijv., http://excalidraw:3000) die niet toegankelijk zijn vanaf de browsers van gebruikers.",
+    "excalidrawProxyEnabledDescription": "Stuurt Excalidraw-verkeer via de server van Jotty. Nodig voor interne Docker-netwerk-URL's (bijv. http://excalidraw:3000) die de browsers van gebruikers niet kunnen bereiken.",
     "saving": "Opslaan...",
-    "editorSettingsSaved": "Editor-instellingen succesvol opgeslagen.",
+    "editorSettingsSaved": "Editor-instellingen opgeslagen.",
     "customEmojis": "Aangepaste emoji's",
-    "noEmojisYet": "Nog geen aangepaste emoji's aangemaakt. Klik op &quot;Emoji toevoegen&quot; om te beginnen.",
-    "enterAnyEmoji": "Voer een emoji in of gebruik emojikiezer (Win: Win+.; Mac: Ctrl+Cmd+Space",
+    "noEmojisYet": "Nog geen aangepaste emoji's. Klik op &quot;Emoji toevoegen&quot; om er een toe te voegen.",
+    "enterAnyEmoji": "Voer een emoji in of gebruik de emojikiezer (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Overzicht deelactiviteit",
-    "detailedSharingBreakdown": "Gedetailleerde uitsplitsing van deelpatronen en gebruikersbetrokkenheid",
+    "detailedSharingBreakdown": "Wat er gedeeld wordt, en wie het deelt",
     "checkForUpdates": "Controleren op updates",
     "checkingForUpdates": "Controleren op updates...",
     "updateAvailable": "Update beschikbaar!",
@@ -1059,12 +1098,12 @@
     "userContent": "{checklistsLength} checklists • {notesLength} notities",
     "rebuildIndexes": "Indexen herbouwen",
     "rebuilding": "Herbouwen...",
-    "successfullyRebuiltIndex": "Linkindex succesvol herbouwd voor {username}",
+    "successfullyRebuiltIndex": "Linkindex herbouwd voor {username}",
     "failedToRebuildIndex": "Linkindex herbouwen mislukt voor {username}",
     "totalItems": "{items} totaal items over {userCount}",
     "privileges": "Beheerdersrechten",
     "adminContentAccess": "Beheerders inhoudstoegangstoegang",
-    "adminContentAccessDescription": "Regelt of beheerders toegang hebben tot de notities en checklists van alle gebruikers. Wanneer uitgeschakeld kunnen beheerders alleen gebruikers en instellingen beheren, maar niet de inhoud van andere gebruikers bekijken.",
+    "adminContentAccessDescription": "Laat beheerders de notities en checklists van elke gebruiker openen. Als dit uit staat, beheren beheerders gebruikers en instellingen maar zien ze de inhoud van anderen niet.",
     "adminContentAccessYes": "Beheerders hebben toegang tot alle inhoud",
     "adminContentAccessNo": "Beheerders hebben alleen toegang tot hun eigen inhoud",
     "superAdminOnly": "Alleen bewerkbaar door systeemeigenaar",
@@ -1074,21 +1113,21 @@
     "confirmNewPassword": "Bevestig nieuw wachtwoord",
     "dataExport": "Gegevensexport",
     "dataExportOptions": "Gegevensexportopties",
-    "selectExportType": "Selecteer een exporttype en download gegevens uit uw applicatie.",
+    "selectExportType": "Kies een exporttype en download de gegevens.",
     "allChecklistsAndNotes": "Alle checklists en notities",
-    "allChecklistsAndNotesDescription": "Exporteert alle checklists en notities die door alle gebruikers zijn aangemaakt. Dit genereert een zip-bestand met JSON-gegevens georganiseerd per gebruiker en categorie.",
+    "allChecklistsAndNotesDescription": "Exporteert de checklists en notities van alle gebruikers als een zip met JSON-bestanden, gegroepeerd per gebruiker en categorie.",
     "userChecklistsNotes": "Checklists en notities van specifieke gebruiker",
-    "userChecklistsNotesDescription": "Selecteer een gebruiker uit de dropdown om alle checklists en notities van die specifieke gebruiker te exporteren.",
+    "userChecklistsNotesDescription": "Kies een gebruiker uit de lijst om al diens checklists en notities te exporteren.",
     "allUsersData": "Alle gebruikersaccountgegevens",
     "allUsersDataDescription": "Exporteert een JSON-bestand met alle gebruikersaccountinformatie (gebruikersnamen, beheerderstatus, etc.). Dit bevat NIET hun checklist- of notitie-inhoud.",
     "wholeDataFolder": "Volledige datamap (Back-up)",
-    "wholeDataFolderDescription": "Exporteert de volledige 'data'-map, inclusief alle gebruikersinhoud, metadata en instellingen. Gebruik met voorzichtigheid aangezien dit een groot bestand kan zijn.",
+    "wholeDataFolderDescription": "Exporteert de volledige 'data'-map, met alle gebruikersinhoud, metadata en instellingen. Dit bestand kan groot worden.",
     "noSharingPermissionsLabel": "Specifieke gedeelde items zijn verborgen op basis van uw inhoudstoegangstoegangsrechten.",
     "contentHidden": "Inhoudsdetails verborgen",
     "viewOnlySettingsNotice": "Alleen de systeemeigenaar kan deze instellingen wijzigen.",
     "auditLogContentRedacted": "[Inhoud verborgen]",
     "maxLogAgeDays": "Maximale logboekleeftijd (dagen)",
-    "maxLogAgeDaysDescription": "Stel in hoe lang auditlogboeken worden bewaard. Bij het bekijken van de auditlogboekenpagina wordt u gevraagd om logboeken ouder dan deze drempel op te schonen. Stel in op 0 voor onbeperkte bewaring (geen automatische opschoonprompts).",
+    "maxLogAgeDaysDescription": "Hoe lang auditlogboeken bewaard blijven. De auditlogboekenpagina biedt aan om alles wat ouder is op te schonen. Zet op 0 om logboeken voor altijd te bewaren en de vraag nooit te krijgen.",
     "appPreferences": "App-voorkeuren",
     "editEmoji": "Emoji bewerken",
     "addEmoji": "Emoji toevoegen",
@@ -1107,16 +1146,6 @@
     "updateTagsTitle": "Scan notities op hashtags en update frontmatter",
     "tagsUpdated": "{processed} bestanden verwerkt, {updated} bijgewerkt met nieuwe tags",
     "failedToUpdateTags": "Tags bijwerken mislukt",
-    "historyEnabled": "Notitiegeschiedenis",
-    "historyDescription": "Houdt versiegeschiedenis voor notities bij. Hiermee kunt u eerdere versies herstellen. Alleen handmatig opslaan maakt geschiedenispunten (niet autosave).",
-    "disableHistory": "Geschiedenis uitschakelen",
-    "disableHistoryWarning": "Het uitschakelen van de geschiedenis verwijdert permanent alle opgeslagen versies voor alle gebruikers. Dit kan niet ongedaan worden gemaakt.",
-    "historyDisabled": "De notitiegeschiedenis is uitgeschakeld en alle geschiedenisgegevens zijn verwijderd.",
-    "failedToDisableHistory": "Geschiedenis uitschakelen mislukt",
-    "defaultDateFormat": "Standaard datumnotatie",
-    "defaultDateFormatDescription": "Wordt gebruikt wanneer de datumnotatievoorkeur van een gebruiker is ingesteld op \"Gebruik systeemstandaard\".",
-    "defaultTimeFormatDescription": "Wordt gebruikt wanneer de tijdnotatievoorkeur van een gebruiker is ingesteld op \"Gebruik systeemstandaard\".",
-    "defaultTimeFormat": "Standaard tijdformaat",
     "borderRadius": "Hoekradius",
     "borderRadiusDescription": "Bepaalt de afronding van hoeken in de hele instantie. Gebruikers kunnen dit overschrijven in snelle instellingen.",
     "borderRadiusSaved": "Hoekradius opgeslagen",
@@ -1132,6 +1161,9 @@
     "tryAgain": "Probeer opnieuw",
     "contactSupport": "Neem contact op met support",
     "invalidInput": "Ongeldige invoer",
+    "invalidEditorSettings": "Editor-instellingen moeten een object zijn, er is niets opgeslagen",
+    "invalidEditorSetting": "Editor-instelling {field} heeft het verkeerde type, er is niets opgeslagen",
+    "categoryOutOfBounds": "Die categorie valt buiten je notities, dus er is niets aangemaakt",
     "requiredField": "Dit veld is verplicht",
     "emailInvalid": "Voer een geldig e-mailadres in",
     "passwordTooShort": "Wachtwoord moet minimaal 8 tekens lang zijn",
@@ -1139,43 +1171,44 @@
     "networkError": "Netwerkfout",
     "timeout": "Verzoek time-out",
     "permissionDenied": "Toegang geweigerd",
-    "requiredPermissions": "Je hebt niet de vereiste rechten om deze actie uit te voeren.",
+    "requiredPermissions": "Je hebt geen toestemming om dat te doen.",
     "loadError": "Laadfout",
     "failedToLoadCustomEmojis": "Aangepaste emoji's laden mislukt",
-    "emojiDeletedSuccessfully": "Emoji succesvol verwijderd",
+    "emojiDeletedSuccessfully": "Emoji verwijderd",
     "deleteError": "Verwijderfout",
     "failedToDeleteEmoji": "Emoji verwijderen mislukt",
     "validationError": "Validatiefout",
     "keywordAndEmojiRequired": "Trefwoord en emoji zijn verplicht",
     "duplicateKeyword": "Dubbel trefwoord",
     "keywordAlreadyExists": "Trefwoord bestaat al",
-    "emojiUpdatedSuccessfully": "Emoji succesvol bijgewerkt",
-    "emojiCreatedSuccessfully": "Emoji succesvol aangemaakt",
+    "emojiUpdatedSuccessfully": "Emoji bijgewerkt",
+    "emojiCreatedSuccessfully": "Emoji aangemaakt",
     "saveError": "Opslagfout",
     "failedToSaveEmoji": "Emoji opslaan mislukt",
     "failedToLoadCustomCSS": "Aangepaste CSS laden mislukt",
     "couldNotLoadCustomCSS": "Kon aangepaste CSS niet laden.",
     "couldNotLoadThemes": "Kon thema's niet laden.",
-    "customCSSSavedSuccessfully": "Aangepaste CSS succesvol opgeslagen.",
+    "customCSSSavedSuccessfully": "Aangepaste CSS opgeslagen.",
     "themeNotFound": "Thema niet gevonden.",
-    "themeDeletedSuccessfully": "Thema succesvol verwijderd.",
+    "themeDeletedSuccessfully": "Thema verwijderd.",
     "themeNameRequired": "Themanaam is verplicht.",
-    "themeSavedSuccessfully": "Thema {action} succesvol.",
+    "themeSavedSuccessfully": "Thema {action}.",
     "anUnknownErrorOccurred": "Een onbekende fout is opgetreden.",
     "usernameRequired": "Gebruikersnaam is verplicht",
     "passwordRequired": "Wachtwoord is verplicht",
     "passwordMinLength": "Wachtwoord moet minimaal 6 tekens lang zijn",
     "passwordsDoNotMatch": "Wachtwoorden komen niet overeen",
-    "userSavedSuccessfully": "Gebruiker {mode} succesvol!",
+    "userSavedSuccessfully": "Gebruiker {mode}.",
     "failedToSaveUser": "{mode} gebruiker mislukt",
     "anErrorOccurred": "Er is een fout opgetreden.",
     "deleteUserConfirmation": "Gebruiker \"{username}\" verwijderen? Dit kan niet ongedaan worden gemaakt.",
-    "userDeletedSuccessfully": "Gebruiker succesvol verwijderd!",
-    "failedToDeleteUser": "Gebruiker verwijderen mislukt"
+    "userDeletedSuccessfully": "Gebruiker verwijderd.",
+    "failedToDeleteUser": "Gebruiker verwijderen mislukt",
+    "readOnlyFolder": "Deze map is alleen-lezen op de server, dus de wijziging kon niet worden opgeslagen."
   },
   "pwa": {
     "installPromptTitle": "App installeren",
-    "installPromptMessage": "Installeer deze app op uw apparaat voor een betere ervaring",
+    "installPromptMessage": "Installeer Jotty op je apparaat zodat het opent als een app",
     "installButton": "Installeren",
     "updateAvailable": "Update beschikbaar",
     "updateMessage": "Een nieuwe versie is beschikbaar",
@@ -1233,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Rich editor-modus wisselen",
     "toggleMarkdownMode": "Markdown-modus wisselen",
+    "quickControls": "Editorbediening",
     "toggleBold": "Vet wisselen",
     "toggleItalic": "Cursief wisselen",
     "toggleUnderline": "Onderstrepen wisselen",
@@ -1322,15 +1356,15 @@
     "drawioDescription": "Visuele diagrameditor",
     "excalidrawDescription": "Schets-stijl diagrameditor",
     "noLanguagesFound": "Geen talen gevonden",
-    "ruler": "Liniaal",
-    "lineNumbers": "Lijnnummers",
     "callout": "Callout",
     "createCallout": "Calloutblok maken",
     "changeCalloutType": "Callouttype wijzigen",
     "calloutInfo": "Info",
     "calloutWarning": "Waarschuwing",
     "calloutSuccess": "Gelukt",
-    "calloutDanger": "Gevaar"
+    "calloutDanger": "Gevaar",
+    "ruler": "Liniaal",
+    "lineNumbers": "Lijnnummers"
   },
   "sharing": {
     "share": "Delen",
@@ -1406,16 +1440,16 @@
     "viewNote": "Notitie bekijken",
     "editNote": "Notitie bewerken",
     "privateKeyWarning": "WAARSCHUWING: Uw privésleutel maakt ontsleuteling van alle versleutelde notities mogelijk. Exporteer alleen als u de beveiligingsimplicaties begrijpt. Doorgaan?",
-    "publicKeyExported": "Publieke sleutel succesvol geëxporteerd",
-    "privateKeyExported": "Privésleutel succesvol geëxporteerd",
+    "publicKeyExported": "Publieke sleutel geëxporteerd",
+    "privateKeyExported": "Privésleutel geëxporteerd",
     "failedToExportKey": "Sleutel exporteren mislukt",
     "unexpectedError": "Een onverwachte fout is opgetreden",
-    "keysDeleted": "Sleutels succesvol verwijderd",
+    "keysDeleted": "Sleutels verwijderd",
     "failedToDeleteKeys": "Sleutels verwijderen mislukt",
     "autoDecryptUpdated": "Automatisch ontsleutelen-instelling bijgewerkt",
     "failedToUpdateSetting": "Instelling bijwerken mislukt",
     "enterValidPath": "Voer een geldig pad in",
-    "customPathSet": "Aangepast sleutelpad succesvol ingesteld",
+    "customPathSet": "Aangepast sleutelpad ingesteld",
     "failedToSetCustomPath": "Aangepast pad instellen mislukt",
     "thisNoteIsEncrypted": "Deze notitie is versleuteld",
     "noteProtectedWith": "Deze notitie is beveiligd met {type} versleuteling.",
@@ -1426,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Selecteer versleutelingsmethode",
     "encryptionMethodsTitle": "Versleutelingsmethoden",
-    "xchachaDescription": "XChaCha20-Poly1305: Moderne, snelle, op wachtwoordzin gebaseerde versleuteling",
-    "pgpDescription": "PGP: Traditionele publieke-sleutelcryptografie met sleutelpaarbeheer",
+    "xchachaDescription": "XChaCha20-Poly1305: versleuteling met een wachtwoordzin",
+    "pgpDescription": "PGP: publieke-sleutelversleuteling met een sleutelpaar dat je zelf beheert",
     "encryptionKeys": "Versleutelingssleutels",
     "keysConfigured": "Sleutels geconfigureerd",
     "algorithm": "Algoritme: ",
@@ -1441,9 +1475,9 @@
     "keysDisabledInDemo": "Opgeslagen versleutelingssleutels zijn uitgeschakeld in demomodus.",
     "encryptionSettings": "Versleutelingsinstellingen",
     "promptForPassphrase": "Vraag om wachtwoordzin bij het openen van versleutelde notities",
-    "promptForPassphraseDescription": "Indien ingeschakeld wordt u gevraagd om uw wachtwoordzin bij het openen van een versleutelde notitie. De notitie blijft versleuteld op de server, maar u kunt de ontsleutelde inhoud zien in de huidige tabblade-sessie.",
+    "promptForPassphraseDescription": "Vraagt om je wachtwoordzin als je een versleutelde notitie opent. De notitie blijft versleuteld op de server en je ziet de ontsleutelde inhoud alleen in dit tabblad.",
     "customKeyPath": "Aangepast sleutelpad (lokale installaties)",
-    "customKeyPathDescription": "Specificeer een aangepast (absoluut) bestandssysteempad voor het opslaan van versleutelingssleutels. Dit is alleen nodig voor lokale installaties. Docker-gebruikers moeten in plaats daarvan het standaardpad in docker-compose.yml mappen.",
+    "customKeyPathDescription": "Een absoluut bestandssysteempad voor je versleutelingssleutels. Alleen lokale installaties hebben dit nodig. Docker-gebruikers mappen in plaats daarvan het standaardpad in docker-compose.yml.",
     "customPath": "Aangepast pad",
     "customPathPlaceholder": "/home/user/mijn-sleutels",
     "customPathHelp": "Moet een absoluut pad zijn (bijv., /home/user/mijn-sleutels of C:\\Users\\user\\mijn-sleutels)",
@@ -1462,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "Notitie-inhoud wordt versleuteld voordat deze wordt opgeslagen",
     "passphraseRequired": "Wachtwoordzin is verplicht",
     "incorrectPassphrase": "Onjuiste wachtwoordzin",
-    "noteEncryptedSuccessfully": "Notitie succesvol versleuteld",
+    "noteEncryptedSuccessfully": "Notitie versleuteld",
     "failedToEncryptNote": "Notitie versleutelen mislukt",
-    "noteDecryptedSuccessfully": "Notitie succesvol ontsleuteld",
+    "noteDecryptedSuccessfully": "Notitie ontsleuteld",
     "failedToDecryptNote": "Notitie ontsleutelen mislukt",
     "passphrase": "Wachtwoordzin",
     "enterYourPassphrase": "Voer uw wachtwoordzin in",
@@ -1493,7 +1527,7 @@
     "noStoredKeysFound": "Geen opgeslagen sleutels gevonden",
     "noEncryptionKeysConfigured": "U heeft geen versleutelingssleutels geconfigureerd",
     "pastePublicKeyBelow": "Plak hieronder een publieke sleutel om de notitie-inhoud te versleutelen",
-    "generateOrImportKeysInProfile": "U kunt specifieke sleutels voor Jotty genereren of importeren in Profiel → Versleuteling",
+    "generateOrImportKeysInProfile": "Je kunt sleutels voor Jotty genereren of importeren in Profiel > Versleuteling",
     "useCustomKey": "Gebruik aangepaste {keyType} sleutel",
     "signWithPrivateKey": "Onderteken met privésleutel",
     "proveAuthenticityOfNote": "authenticiteit van deze notitie bewijzen",
@@ -1513,7 +1547,7 @@
     "yourEmail": "uw@email.nl",
     "generating": "Genereren...",
     "generateKeys": "Sleutels genereren",
-    "keysGeneratedSuccessfully": "Sleutels succesvol gegenereerd",
+    "keysGeneratedSuccessfully": "Sleutels gegenereerd",
     "importPGPKeys": "PGP-sleutels importeren",
     "publicKeyLabel": "Publieke sleutel",
     "privateKeyLabel": "Privésleutel",
@@ -1522,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Onthoud uw wachtwoordzin! Deze kan niet worden hersteld.",
     "withoutPassphraseCannotDecrypt": "Zonder de wachtwoordzin kunt u uw notities niet ontsleutelen.",
     "backupPrivateKeySafely": "Maak een veilige back-up van uw privésleutel.",
-    "pgpKeyPairGeneratedSuccessfully": "PGP-sleutelpaar succesvol gegenereerd",
+    "pgpKeyPairGeneratedSuccessfully": "PGP-sleutelpaar gegenereerd",
     "failedToGenerateKeys": "Sleutels genereren mislukt",
     "fingerprint": "Vingerafdruk",
     "keysSavedSecurely": "Uw sleutels zijn veilig opgeslagen.",
@@ -1536,13 +1570,13 @@
     "bothKeysRequired": "Zowel publieke als privésleutels zijn vereist",
     "invalidPublicKeyFormat": "Ongeldig formaat publieke sleutel. Moet een ASCII-armored PGP-sleutel zijn.",
     "invalidPrivateKeyFormat": "Ongeldig formaat privésleutel. Moet een ASCII-armored PGP-sleutel zijn.",
-    "keysImportedSuccessfully": "Sleutels succesvol geëmporteerd",
+    "keysImportedSuccessfully": "Sleutels geïmporteerd",
     "failedToImportKeys": "Sleutels importeren mislukt",
     "created": "Versleuteling aangemaakt",
     "notePlaceholder": "Ik ben een tijdelijke aanduiding omdat je een lege notitie niet kunt coderen."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Deze opties zijn alleen van toepassing op de huidige browsersessie. Voor permanente instellingen raadpleeg uw",
+    "sessionOnlyPrefix": "Deze opties gelden alleen voor deze browsersessie. Voor permanente instellingen, bekijk je",
     "accountSettings": "gebruikersvoorkeuren",
     "autosaveNotes": "Notities automatisch opslaan",
     "showNotePreview": "Notitievoorbeeld op kaarten tonen",
@@ -1571,20 +1605,45 @@
     "migrationSuccessful": "Migratie succesvol",
     "returnToApp": "Terugkeren naar app",
     "adminAccessRequired": "Beheerderstoegang vereist",
-    "adminAccessDescription": "Deze migratie vereist beheerdersrechten. Neem contact op met een beheerder om de systeemmigratie uit te voeren.",
+    "adminAccessDescription": "Deze migratie heeft een beheerder nodig. Vraag er een om hem uit te voeren.",
     "whatsHappening": "Wat gebeurt er?",
-    "sharingDataMigrationDescription": "Het systeem moet uw deelgegevens migreren. Dit is een eenmalig proces dat beheerderstoegang vereist.",
+    "sharingDataMigrationDescription": "Jotty moet je deelgegevens migreren. Dit gebeurt maar één keer en heeft een beheerder nodig.",
     "whatsChanging": "Wat verandert er?",
     "automaticBackupIncluded": "Automatische back-up inbegrepen",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter is industriestandaard",
-    "noMigrationNeeded": "Geen migratie nodig - uw systeem is al up-to-date.",
-    "importantBackupData": "Belangrijk: Maak een back-up van uw gegevens"
+    "noMigrationNeeded": "Niets te migreren, je gegevens zijn al up-to-date.",
+    "importantBackupData": "Belangrijk: Maak een back-up van uw gegevens",
+    "sharingNowWithData": "Je deelgegevens staan nu bij je notities en mappen.",
+    "sharingMovesDescription": "Delen verhuist van een centraal bestand naar je eigen gegevens. Je kunt nu mappen delen, en gedeelde mappen verschijnen in je eigen zijbalk in plaats van in een aparte sectie.",
+    "whatsHappeningBody": "Elke share in <code>.sharing.json</code> wordt in de frontmatter van het bijbehorende item geschreven, en elke map krijgt een <code>.category-info.json</code> met zijn identiteit, delen en volgorde. De oude bestanden worden verwijderd zodra de gegevens zijn verplaatst.",
+    "migrationChanges": "Wijzigingen door de migratie",
+    "sharingTravelsTitle": "Delen reist mee met het bestand",
+    "sharingTravelsBody": "Elk gedeeld item houdt in zijn eigen frontmatter bij met wie het gedeeld is, dus verplaatsen of hernoemen breekt nooit een share.",
+    "folderSharingTitle": "Mappen delen",
+    "folderSharingBody": "Deel een map en alles erin, nu en later, wordt ook gedeeld. Ontvangers zien hem als een gewone map in hun eigen zijbalk.",
+    "oneFilePerFolderTitle": "Eén bestand per map",
+    "oneFilePerFolderBody": "<code>.order.json</code> gaat op in <code>.category-info.json</code>, met de volgorde op uuid in plaats van op bestandsnaam.",
+    "permissionsUnchangedTitle": "Rechten blijven hetzelfde",
+    "permissionsUnchangedBody": "Lezen, bewerken en verwijderen blijven precies zoals ze nu zijn, per gebruiker en per item.",
+    "backupWarningBody": "Deze migratie herschrijft de frontmatter van je notities en checklists en verwijdert de oude bestanden <code>.sharing.json</code> en <code>.order.json</code>. Maak een back-up van je <code>data</code>-map voordat je verdergaat.",
+    "backupConfirmLabel": "Ik heb een back-up van mijn data-map gemaakt en begrijp hoe de migratie werkt.",
+    "backupConfirmHint": "Bevestig dat je een back-up hebt voordat je verdergaat.",
+    "sharingDataMigrated": "Je deel- en volgordegegevens zijn gemigreerd.",
+    "whatWasChanged": "Wat er is veranderd:",
+    "migrationPartial": "Migratie klaar met restanten",
+    "leftoversTitle": "Sommige oude bestanden zijn bewaard",
+    "leftoversBody": "De migratie kon niet alles omzetten, dus de oude bestanden hieronder staan onaangeroerd op de schijf. Er is niets verwijderd. Je kunt de oorzaak oplossen en de migratie opnieuw draaien, of nu doorgaan naar de app en het later regelen.",
+    "overrideConfirmLabel": "Toch doorgaan en deze pagina niet meer tonen.",
+    "overrideConfirmHint": "De overgebleven bestanden blijven op de schijf, maar de app behandelt je gegevens als gemigreerd. Delen of volgorde die hierboven staan, worden pas toegepast als je opnieuw migreert. Dat kan altijd via /migration?force=1.",
+    "continueAnyway": "Toch doorgaan",
+    "overriding": "Doorgaan...",
+    "overrideFailed": "Kon de migratie niet overslaan"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Categorie succesvol hernoemd",
+    "categoryRenamedSuccessfully": "Categorie hernoemd",
     "failedToRenameCategory": "Categorie hernoemen mislukt",
     "categoryRenamedSuccessfullyMessage": "Categorie {categoryName} hernoemd naar {newName}",
-    "failedToRenameCategoryMessage": "Er is een fout opgetreden bij het hernoemen van de categorie."
+    "failedToRenameCategoryMessage": "Er ging iets mis bij het hernoemen van de categorie."
   },
   "auditLogs": {
     "title": "Auditlogboeken",
@@ -1601,17 +1660,17 @@
     "exportJSON": "JSON exporteren",
     "exportCSV": "CSV exporteren",
     "cleanupOldLogs": "Oude logboeken opschonen",
-    "confirmCleanup": "Weet u zeker dat u logboeken ouder dan {days} dagen wilt verwijderen? Dit heeft invloed op ALLE gebruikers en kan niet ongedaan worden gemaakt.",
+    "confirmCleanup": "Logboeken ouder dan {days} dagen verwijderen? Dit geldt voor ALLE gebruikers en kan niet ongedaan worden gemaakt.",
     "confirmCleanupUnlimited": "Geen automatische opschoning geconfigureerd (onbeperkte bewaring). U kunt oude logboeken nog steeds handmatig verwijderen indien nodig.",
     "deleteAllLogsModalTitle": "Alle auditlogboeken verwijderen",
     "deleteAllLogsWarning": "Dit verwijdert ALLE logboeken, niet alleen oude",
     "deleteAllLogsWarningDescription": "De volledige auditlogboekgeschiedenis wordt uit het systeem gewist.",
     "deletingAllLogs": "Alle logboeken verwijderen...",
     "deleteAllLogsButton": "Alle logboeken verwijderen",
-    "cleanupSuccess": "{count} oude logboekbestanden succesvol verwijderd",
+    "cleanupSuccess": "{count} oude logboekbestanden verwijderd",
     "cleanupError": "Oude logboeken opschonen mislukt",
-    "userDescription": "Bekijk al uw activiteit en acties in het systeem",
-    "adminDescription": "Bekijk en beheer alle gebruikersactiviteit in het systeem",
+    "userDescription": "Alles wat je in Jotty hebt gedaan",
+    "adminDescription": "Wat elke gebruiker op deze instantie heeft gedaan",
     "level": "Niveau",
     "allLevels": "Alle niveaus",
     "allCategories": "Alle categorieën",
@@ -1634,7 +1693,6 @@
     "login": "Inloggen",
     "logout": "Uitloggen",
     "register": "Registreren",
-    "sessionTerminated": "Sessie beëindigd",
     "sessionterminated": "Sessie beëindigd",
     "usercreated": "Gebruiker aangemaakt",
     "userupdated": "Gebruiker bijgewerkt",
@@ -1676,9 +1734,9 @@
     "topActions": "Topacties",
     "mostActiveUsers": "Meest actieve gebruikers",
     "oldLogsFound": "Er zijn {count} logboekbestanden ouder dan {days} dagen.",
-    "oldLogsFoundDescription": "Wilt u ze opschonen? Deze actie kan niet ongedaan worden gemaakt.",
+    "oldLogsFoundDescription": "Opschonen? Dit kan niet ongedaan worden gemaakt.",
     "cleanUpNow": "Nu opschonen",
-    "cleanupSuccessMessage": "{count} oude logboekbestanden succesvol verwijderd.",
+    "cleanupSuccessMessage": "{count} oude logboekbestanden verwijderd.",
     "security": "Beveiliging",
     "mfasecretgenerated": "MFA-geheim gegenereerd",
     "mfaenabled": "MFA ingeschakeld",
@@ -1694,6 +1752,7 @@
     "howTo": "Handleiding",
     "shortcuts": "Sneltoetsen",
     "markdownGuide": "Markdown-gids",
+    "brain": "Links & Brain",
     "customisations": "Aanpassingen",
     "docker": "Docker",
     "envVariables": "Omgevingsvariabelen",
@@ -1701,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "Versleuteling",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Vertalingen",
     "unraid": "Unraid",
     "patches": "Patches"
@@ -1714,44 +1774,107 @@
   },
   "notifications": {
     "title": "Meldingen",
+    "unread": "ongelezen",
     "markAllRead": "Markeer alles als gelezen",
     "clearAll": "Alles wissen",
     "empty": "Geen meldingen",
     "assignmentTitle": "Taak die aan jou is toegewezen",
-    "assignmentMessage": "\"{taak}\" in \"{bord}\"",
+    "assignmentMessage": "\"{task}\" in \"{board}\"",
     "reminderTitle": "Taak achterstallig",
     "reminderMessage": "\"{task}\" in \"{board}\" is voorbij de herinnering",
-    "unread": "ongelezen",
     "sharingTitle": "{user} heeft een {type} met je gedeeld",
     "sharingMessage": "Open om het gedeelde {type} te bekijken",
     "sharingFolderTitle": "{user} heeft een {type}-map met je gedeeld",
-    "sharingFolderMessage": "Open om “{folder}” te bekijken",
+    "sharingFolderMessage": "Open om \"{folder}\" te bekijken",
     "mentionTitle": "{user} noemde je in een reactie",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
   },
-  "history": {
-    "noteHistory": "Notitiegeschiedenis",
-    "restore": "Herstellen",
-    "restoreVersion": "Versie herstellen",
-    "restoreConfirm": "Deze versie herstellen? De huidige inhoud wordt vervangen.",
-    "noHistory": "Geen geschiedenis beschikbaar",
-    "noHistoryDescription": "Sla je notitie op om een geschiedenispunt aan te maken.",
-    "loadMore": "Meer laden",
-    "featureDisabled": "Geschiedenis uitgeschakeld",
-    "disabledAdmin": "Notitiegeschiedenis is momenteel uitgeschakeld. Je kunt dit inschakelen in Beheerdersinstellingen > Editor.",
-    "disabledUser": "Notitiegeschiedenis is momenteel uitgeschakeld. Neem contact op met je beheerder om deze functie in te schakelen.",
-    "goToSettings": "Naar instellingen",
-    "manualSavesOnly": "Geschiedenis wordt alleen bij handmatig opslaan aangemaakt, niet bij automatisch opslaan.",
-    "fetchError": "Geschiedenis laden mislukt",
-    "restoreError": "Versie herstellen mislukt",
-    "viewContent": "Inhoud bekijken",
-    "viewDiff": "Wijzigingen bekijken",
-    "actionCreate": "Aangemaakt",
-    "actionUpdate": "Bijgewerkt",
-    "actionRename": "Hernoemd",
-    "actionMove": "Verplaatst",
-    "actionDelete": "Verwijderd",
-    "actionInit": "Geïnitialiseerd",
-    "actionUnknown": "Gewijzigd"
+  "relations": {
+    "indexing": "Relaties indexeren...",
+    "unreachable": "niet bereikbaar",
+    "createFromWikilink": "Maak een notitie met de naam \"{title}\"",
+    "mentionedIn": "Genoemd in",
+    "mentionedInHint": "Deze notities gebruiken deze titel als gewone tekst. Link er een om ze te verbinden.",
+    "linkMention": "Linken",
+    "linked": "De vermelding in {title} is gelinkt",
+    "linkFailed": "Kon die vermelding niet linken",
+    "kind": {
+      "mention": "Link",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "Brain",
+    "openBrain": "Openen in brain",
+    "search": "Zoek iets in je brain...",
+    "dimension": "Weergave",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Rond dit item",
+    "global": "Alles",
+    "depth": "Diepte {depth}",
+    "colourBy": "Kleur op",
+    "colourModes": {
+      "type": "Type",
+      "category": "Categorie"
+    },
+    "filters": {
+      "notes": "Notities",
+      "checklists": "Checklists",
+      "tags": "Tags",
+      "ghosts": "Nog niet geschreven",
+      "suggestions": "Suggesties",
+      "orphans": "Eenlingen"
+    },
+    "kind": {
+      "note": "Notitie",
+      "checklist": "Checklist",
+      "ghost": "Nog niet geschreven",
+      "tag": "Tag"
+    },
+    "edges": {
+      "mention": "Link",
+      "wiki": "Wikilink",
+      "suggested": "Voorgesteld",
+      "tag": "Tag"
+    },
+    "linksTo": "Linkt naar",
+    "linkedFrom": "Gelinkt vanuit",
+    "suggested": "Mogelijk gerelateerd",
+    "promote": "Link naar {title}",
+    "lonely": "Hier is nog niets mee verbonden. Noem het met @ of [[ in een andere notitie.",
+    "open": "Openen",
+    "createGhost": "Schrijf deze notitie",
+    "openTag": "Toon alles met deze tag",
+    "createFailed": "Kon die notitie niet aanmaken",
+    "connectFailed": "Kon die twee niet linken",
+    "connected": "{source} gelinkt aan {target}",
+    "empty": "Je brain is nog stil. Link notities en checklists met @ of [[ en ze verschijnen hier.",
+    "viewingOwner": "Je bekijkt het brain van {owner}",
+    "summary": "{items} items, {links} links, {shown} getoond"
+  },
+  "apiExplorer": {
+    "title": "API-verkenner",
+    "intro": "Elk endpoint dat deze instantie (v{version}) aanbiedt, gegenereerd uit de code die het serveert. Kies er een, vul het in en verstuur het.",
+    "realData": "Verzoeken draaien als de eigenaar van de API-sleutel, op echte gegevens. Een DELETE hier verwijdert echt.",
+    "apiKey": "API-sleutel",
+    "apiKeyHint": "Blijft alleen op deze pagina en wordt vergeten als je weggaat.",
+    "useMyKey": "Mijn sleutel gebruiken",
+    "noKeyYet": "Je hebt nog geen API-sleutel. Genereer er een in je profielinstellingen.",
+    "filter": "Filter",
+    "filterPlaceholder": "Pad, naam of methode",
+    "noMatches": "Niets komt overeen met dat filter.",
+    "body": "Request body (JSON)",
+    "showSchema": "Schema tonen",
+    "hideSchema": "Schema verbergen",
+    "send": "Versturen",
+    "sending": "Versturen...",
+    "keyRequired": "Voeg eerst een API-sleutel toe.",
+    "noKeyNeeded": "geen API-sleutel nodig",
+    "deprecated": "verouderd",
+    "requestFailed": "Het verzoek heeft de server nooit bereikt. Controleer je verbinding.",
+    "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/pirate.json b/app/_translations/pirate.json
index b4653d351..6554b13fc 100644
--- a/app/_translations/pirate.json
+++ b/app/_translations/pirate.json
@@ -127,6 +127,7 @@
     "expandAll": "Unfurl All",
     "saveChanges": "Stow Changes",
     "all": "The Lot",
+    "items": "Cargo bits",
     "showAll": "Spy All",
     "creating": "Forging...",
     "createCategoryHeader": "Chart a new course",
@@ -173,7 +174,7 @@
     "noResults": "Empty Horizon",
     "by": "by {owner}",
     "unsavedChanges": "Loose Cargo",
-    "unsavedChangesDetected": "⚠️ Loose Cargo Detected",
+    "unsavedChangesDetected": "Loose Cargo",
     "unsavedChangesMessage": "Ye have loose cargo in {noteTitle}. If ye sail now, it'll be lost at sea.",
     "whatToDoWithUnsavedChanges": "What'll ye do with the loot?",
     "discard": "Toss it",
@@ -247,36 +248,9 @@
     "connected": "Connected",
     "reconnecting": "Reconnecting...",
     "hide": "Stow away",
-    "items": "Cargo bits",
     "thisEntry": "this entry",
     "preview": "Peek"
   },
-  "comments": {
-    "title": "Scribbles",
-    "titleWithCount": "{count, plural, one {# Scribble} other {# Scribbles}}",
-    "noComments": "No scribbles yet. Start the chatter!",
-    "addComment": "Scribble a note...",
-    "replyPlaceholder": "Write a reply, ye scallywag...",
-    "post": "Post it",
-    "reply": "Answer back",
-    "edit": "Scratch out",
-    "delete": "Keelhaul",
-    "save": "Stash it",
-    "cancel": "Abandon ship",
-    "edited": "scratched",
-    "deleteConfirmTitle": "Keelhaul this scribble?",
-    "deleteConfirmMessage": "This'll keelhaul the scribble and all replies. No turnin' back, matey.",
-    "commentDeleted": "Scribble keelhauled",
-    "commentAdded": "Scribble posted",
-    "commentUpdated": "Scribble scratched anew",
-    "failedToAdd": "Couldn't scribble that",
-    "failedToEdit": "Couldn't scratch that out",
-    "failedToDelete": "Couldn't keelhaul that",
-    "failedToLoad": "Couldn't fetch the scribbles",
-    "readOnly": "Ye need scribblin' rights to chatter on this card.",
-    "replyTo": "Answer back to {author}",
-    "noUsersFound": "No scallywags found"
-  },
   "history": {
     "noteHistory": "Log History",
     "restore": "Restore",
@@ -286,7 +260,7 @@
     "noHistoryDescription": "Stow yer log to make a mark in history.",
     "loadMore": "Dig Deeper",
     "featureDisabled": "History Becalmed",
-    "disabledAdmin": "The Captain has disabled the history logs.",
+    "disabledAdmin": "History logs be turned off. Turn 'em on in Admin Settings > Editor.",
     "disabledUser": "History is disabled. Beg the Captain to turn it on.",
     "goToSettings": "Steer to Rigging",
     "manualSavesOnly": "History is only marked when ye stow manually, not by magic.",
@@ -382,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "This will melt down yer old key",
     "regenerateRecoveryCodeDescription": "Enter yer mark to forge a new key. The old one be useless scrap.",
     "recoveryCodeRegenerated": "New Key Forged",
-    "recoveryCodeRegeneratedInfo": "Here be yer new key. Hide it well!",
-    "recoveryCodeRegeneratedSuccess": "Key forged successfully",
+    "recoveryCodeRegeneratedInfo": "Here be yer new key. Hide it well, ye'll only see it this once!",
+    "recoveryCodeRegeneratedSuccess": "Key forged",
     "recoveryCodeProfileDescription": "Use this if yer magic box falls overboard",
     "disableMfaForUser": "Disable Handshake for this swabbie",
     "recoveryCodeRequired": "Skeleton Key required",
@@ -428,22 +402,26 @@
     "enterNoteTitle": "Name yer log...",
     "byType": "By rig",
     "publiclySharedNote": "Shared with the world",
+    "sharedPubliclyBy": "This log be open to all, shared by {owner}",
     "copyRawContent": "Copy the runes",
     "quickSave": "Quick Stow",
     "noteNotFound": "Log lost at sea",
     "unarchiveNote": "Dig Up Log",
     "enterNoteName": "Name the parchment...",
     "updateNote": "Overhaul Log",
-    "tags": "Flags",
-    "noTagsFound": "No flags hoist",
-    "searchTags": "Spy for flags...",
     "printSaveAsPdf": "Print / Save as treasure map",
     "tableOfContents": "Ship's manifest",
     "wordCount": "{count, plural, one {# word} other {# words}}",
     "charCount": "{count, plural, one {# character} other {# characters}}",
-    "readingTime": "{count, plural, one {# minute o' readin'} other {# minutes o' readin'}}"
+    "readingTime": "{count, plural, one {# minute o' readin'} other {# minutes o' readin'}}",
+    "tags": "Flags",
+    "noTagsFound": "No flags hoist",
+    "searchTags": "Spy for flags...",
+    "createNoteFailed": "Couldn't scribe the log",
+    "createCategoryFailed": "Couldn't raise the heading, so the log weren't scribed neither"
   },
   "checklists": {
+    "sharedPubliclyBy": "This manifest be open to all, shared by {owner}",
     "title": "Manifests",
     "allChecklists": "All Manifests",
     "completed": "Plundered",
@@ -499,6 +477,7 @@
     "checklistType": "Manifest Rig",
     "simpleChecklist": "Simple List",
     "taskProject": "Grand Voyage",
+    "kanbanBoard": "Kanban chart",
     "basicTodoItems": "Basic chores",
     "withTimeTracking": "With hourglass",
     "noDescription": "No yarn",
@@ -526,13 +505,13 @@
     "clearAllIncompleteConfirmMessage": "Ye sure ye want to scuttle {count} unfinished items? Gone forever!",
     "convertChecklistType": "Refit Manifest",
     "convertTypeConfirmation": "Ye be changin' from {currentType} to {newType}. Aye?",
-    "dataLossWarning": "⚠️ Cargo Loss Warning",
+    "dataLossWarning": "Cargo Loss Warning",
     "dataLossWarningItems": "The following loot will be lost:",
     "allTaskStatusesReset": "All chore conditions reset",
     "timeTrackingDataLost": "Hourglass data lost",
     "estimatedTimesRemoved": "Guesses removed",
     "targetDatesCleared": "Dates wiped",
-    "enhancedFeatures": "✨ Shiny Features",
+    "enhancedFeatures": "What ye get",
     "enhancedFeaturesYouWillGain": "Ye will gain:",
     "kanbanBoardWithDragDrop": "Map table",
     "taskStatusTracking": "Condition tracking",
@@ -542,6 +521,7 @@
     "convert": "Refit",
     "convertToSimpleChecklist": "Refit to simple list",
     "convertToTaskProject": "Refit to grand voyage",
+    "convertToKanbanBoard": "Turn it into a Kanban chart",
     "pasteYourList": "Splice yer list (one per line)",
     "addItems": "Add {count} Items",
     "itemsWillBeAdded": "{count} items will be stowed",
@@ -550,11 +530,35 @@
     "noItemsYet": "Empty hold",
     "addFirstItem": "Stow yer first item!",
     "noTasks": "No chores",
-    "noSubtasksYet": "No small chores yet.",
+    "noSubtasksYet": "No small chores yet. Add one below.",
     "addTime": "Add Sand",
-    "enterTimeInMinutes": "Minutes of sand",
-    "convertToKanbanBoard": "Turn it into a Kanban chart",
-    "kanbanBoard": "Kanban chart"
+    "enterTimeInMinutes": "Minutes of sand"
+  },
+  "comments": {
+    "title": "Scribbles",
+    "titleWithCount": "{count, plural, one {# Scribble} other {# Scribbles}}",
+    "noComments": "No scribbles yet. Start the chatter!",
+    "addComment": "Scribble a note...",
+    "replyPlaceholder": "Write a reply, ye scallywag...",
+    "post": "Post it",
+    "reply": "Answer back",
+    "edit": "Scratch out",
+    "delete": "Keelhaul",
+    "save": "Stash it",
+    "cancel": "Abandon ship",
+    "edited": "scratched",
+    "deleteConfirmTitle": "Keelhaul this scribble?",
+    "deleteConfirmMessage": "This'll keelhaul the scribble and all replies. No turnin' back, matey.",
+    "commentDeleted": "Scribble keelhauled",
+    "commentAdded": "Scribble posted",
+    "commentUpdated": "Scribble scratched anew",
+    "failedToAdd": "Couldn't scribble that",
+    "failedToEdit": "Couldn't scratch that out",
+    "failedToDelete": "Couldn't keelhaul that",
+    "failedToLoad": "Couldn't fetch the scribbles",
+    "readOnly": "Ye need scribblin' rights to chatter on this card.",
+    "replyTo": "Answer back to {author}",
+    "noUsersFound": "No scallywags found"
   },
   "tasks": {
     "title": "Chores",
@@ -684,7 +688,7 @@
     "quickSettingsHeader": "Quick Rigging (this device only)",
     "adminSettings": "Captain's Quarters",
     "apiKey": "Skeleton Key",
-    "apiKeyDescription": "Forge a key for the robots",
+    "apiKeyDescription": "Forge a key so scripts and robots can reach yer manifests and logs",
     "hideApiKey": "Hide Key",
     "showApiKey": "Show Key",
     "copyApiKey": "Scribe Key",
@@ -815,10 +819,10 @@
     "chooseAutoSaveInterval": "How often the ship stows itself.",
     "defaultMode": "Default Stance",
     "selectNotesDefaultMode": "Pick stance",
-    "chooseNotesDefaultMode": "Ready to write or ready to read.",
+    "chooseNotesDefaultMode": "Ready to write or ready to read. Ye can always switch with the {mode} button in the log editor.",
     "defaultEditor": "Default Quill",
     "selectNotesDefaultEditor": "Pick quill",
-    "chooseDefaultEditor": "Pick yer favorite quill.",
+    "chooseDefaultEditor": "Pick yer favorite quill. Ye can always switch with the {editor} button in the log editor.",
     "tableSyntaxInNotes": "Grid Style",
     "selectTableSyntax": "Pick grid style",
     "chooseTableSyntax": "How yer grids look.",
@@ -827,7 +831,7 @@
     "chooseSyntaxTheme": "Colors for yer runes.",
     "minimalMode": "Barebones Mode",
     "selectMinimalMode": "Pick mode",
-    "minimalModeDescription": "Just the text, no fancy bits.",
+    "minimalModeDescription": "Just the text, no fancy bits. Bilateral links and other fancy tricks don't work in this mode.",
     "defaultNoteFilter": "Default Spyglass",
     "selectDefaultNoteFilter": "Pick spyglass",
     "chooseDefaultNoteFilter": "What ye see first in the logs.",
@@ -865,6 +869,7 @@
     "seconds_plural": "{count} seconds",
     "hours12": "12 bells",
     "hours24": "24 bells",
+    "useSystemDefault": "Use system default",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "Standard",
@@ -939,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "Hides the hourglass an' logged sessions from yer Kanban cards. Time trackin' stays in the card's detail view, savvy.",
     "selectStatusOnCards": "Pick status visibility",
     "codeBlockChoice": "Choose the code block style",
-    "themedCodeBlock": "Themed codeblock",
     "defaultCodeBlock": "Codepen (default)",
+    "themedCodeBlock": "Themed codeblock",
     "codeBlockChoiceDescription": "Choose between the codepen-like default code block style or a themed codeblock style.",
     "checklistItemClickAction": "Checklist item click action",
     "selectChecklistItemClickAction": "Select checklist item click action",
-    "checklistItemClickActionDescription": "Choose what happens when you click a task's text. \"Mark as complete\" toggles the checkbox  (default); \"Edit task name\" opens the task for inline editing — you'll still need to click the checkbox itself to complete it.",
+    "checklistItemClickActionDescription": "Choose what happens when ye click a task's words. \"Mark as complete\" (default) ticks the box. \"Edit task name\" opens the task for editin', and ye click the box itself to finish it.",
     "checklistItemClickActionToggle": "Mark as complete/incomplete",
     "checklistItemClickActionEdit": "Edit list item",
     "newItemInsertion": "Stow new cargo",
@@ -952,7 +957,6 @@
     "newItemInsertionDescription": "Choose whether new cargo be stowed at the top (default) or the bottom o' the manifest.",
     "newItemInsertionTop": "Top o' the manifest",
     "newItemInsertionBottom": "Bottom o' the manifest",
-    "useSystemDefault": "Use system default",
     "selectShowChecklistEmojis": "Choose yer rune showin'",
     "showChecklistEmojisDescription": "Marks each manifest entry with a rune drawn from its words."
   },
@@ -995,13 +999,17 @@
     "icon512": "512x512 Flag",
     "icon512Description": "Huge flag.",
     "notifyNewUpdates": "Squawk when updated",
-    "thisUsesGithubAPI": "Uses the GitHub",
+    "thisUsesGithubAPI": "Uses the GitHub API to spy for updates. Turn it off and no traffic sails to or from GitHub.",
     "parseContent": "Show translated titles",
     "parseContentEnabledDescription": "Show fancy titles.",
     "parseContentDisabledDescription": "Show filename scrawls.",
     "parseContentPerformanceWarning": "\"Nay\" makes the ship faster but harder to read.",
     "hideLanguageSelector": "Hide Lingo Flag",
     "hideLanguageSelectorDescription": "Hide the flag",
+    "defaultDateFormat": "Default Date Format",
+    "defaultDateFormatDescription": "Used when a user's date format preference is set to \"Use system default\".",
+    "defaultTimeFormat": "Default Time Format",
+    "defaultTimeFormatDescription": "Used when a user's time format preference is set to \"Use system default\".",
     "applicationIcons": "Ship Flags",
     "saveChanges": "Stow Changes",
     "unsavedChanges": "Loose cargo.",
@@ -1021,7 +1029,7 @@
     "colorVariables": "Paints",
     "livePreview": "Spy Glass",
     "unsavedCssChanges": "Wet paint.",
-    "noCustomThemesYet": "No custom paints yet.",
+    "noCustomThemesYet": "No custom paints yet. Click \"Create Theme\" to mix one.",
     "myCustomTheme": "Me Colors",
     "iconNameDescription": "icon name",
     "appVersion": "Ship Mark",
@@ -1063,17 +1071,17 @@
     "drawioUrlDescription": "Custom map maker URL.",
     "drawioUrlExample": "Example: https://your-domain.com/drawio",
     "drawioProxyEnabled": "Proxy Draw.io",
-    "drawioProxyEnabledDescription": "Route traffic through the ship.",
+    "drawioProxyEnabledDescription": "Route Draw.io traffic through the ship. Needed for internal Docker URLs (e.g., http://drawio:8080) that the crew's browsers can't reach.",
     "excalidrawUrl": "Excalidraw URL",
     "excalidrawUrlDescription": "Custom sketcher URL.",
     "excalidrawUrlExample": "Example: https://your-domain.com/excalidraw",
     "excalidrawProxyEnabled": "Proxy Excalidraw",
-    "excalidrawProxyEnabledDescription": "Route traffic through the ship.",
+    "excalidrawProxyEnabledDescription": "Route Excalidraw traffic through the ship. Needed for internal Docker URLs (e.g., http://excalidraw:3000) that the crew's browsers can't reach.",
     "saving": "Stowing...",
     "editorSettingsSaved": "Quill settings stowed.",
     "customEmojis": "Custom Runes",
-    "noEmojisYet": "No runes yet.",
-    "enterAnyEmoji": "Enter rune",
+    "noEmojisYet": "No runes yet. Click &quot;Add Emoji&quot; to carve one.",
+    "enterAnyEmoji": "Enter rune or use the emoji picker (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Divvying Overview",
     "detailedSharingBreakdown": "Who's sharing what",
     "checkForUpdates": "Spy for new ships",
@@ -1092,7 +1100,7 @@
     "rebuilding": "Retying...",
     "successfullyRebuiltIndex": "Knots retied for {username}",
     "failedToRebuildIndex": "Knots slipped for {username}",
-    "totalItems": "{items} items",
+    "totalItems": "{items} items o'plunder across {userCount}",
     "privileges": "Privileges",
     "adminContentAccess": "Captain's Skeleton Key",
     "adminContentAccessDescription": "Can the Captain open everyone's chest?",
@@ -1119,7 +1127,7 @@
     "viewOnlySettingsNotice": "Only the Admiral touches this.",
     "auditLogContentRedacted": "[Redacted]",
     "maxLogAgeDays": "Log Retention (Days)",
-    "maxLogAgeDaysDescription": "How long to keep the black book.",
+    "maxLogAgeDaysDescription": "How long to keep the black book. Set to 0 to keep it forever.",
     "appPreferences": "Ship Preferences",
     "editEmoji": "Refit Rune",
     "addEmoji": "Add Rune",
@@ -1138,10 +1146,6 @@
     "updateTagsTitle": "Scan for flags",
     "tagsUpdated": "Scanned {processed}, updated {updated}",
     "failedToUpdateTags": "Flag update failed",
-    "defaultDateFormat": "Default Date Format",
-    "defaultDateFormatDescription": "Used when a user's date format preference is set to \"Use system default\".",
-    "defaultTimeFormatDescription": "Used when a user's time format preference is set to \"Use system default\".",
-    "defaultTimeFormat": "Default Time Format",
     "borderRadius": "Corner roundin'",
     "borderRadiusDescription": "Sets how round the corners be across the whole ship. Crewmates may set their own in quick settin's.",
     "borderRadiusSaved": "Corner roundin' stowed away",
@@ -1157,6 +1161,9 @@
     "tryAgain": "Give it another go",
     "contactSupport": "Send a parrot",
     "invalidInput": "Garbage input",
+    "invalidEditorSettings": "Quill settings must be an object, nothin' was stowed",
+    "invalidEditorSetting": "Quill setting {field} be the wrong type, nothin' was stowed",
+    "categoryOutOfBounds": "That heading be outside yer own waters, so nothin' was made",
     "requiredField": "Ye must fill this",
     "emailInvalid": "That ain't an email",
     "passwordTooShort": "Code's too short",
@@ -1185,18 +1192,19 @@
     "themeNotFound": "Paint not found.",
     "themeDeletedSuccessfully": "Paint thrown overboard.",
     "themeNameRequired": "Paint needs a name.",
-    "themeSavedSuccessfully": "Paint {action} successfully.",
+    "themeSavedSuccessfully": "Paint {action}.",
     "anUnknownErrorOccurred": "A mystery error occurred.",
     "usernameRequired": "Name required",
     "passwordRequired": "Code required",
     "passwordMinLength": "Code too short (6)",
     "passwordsDoNotMatch": "Codes clash",
-    "userSavedSuccessfully": "Swabbie {mode} successfully!",
+    "userSavedSuccessfully": "Swabbie {mode}!",
     "failedToSaveUser": "Failed to {mode} swabbie",
     "anErrorOccurred": "Disaster struck.",
     "deleteUserConfirmation": "Execute \"{username}\"?",
     "userDeletedSuccessfully": "Swabbie fed to sharks!",
-    "failedToDeleteUser": "Sword jammed"
+    "failedToDeleteUser": "Sword jammed",
+    "readOnlyFolder": "This hold be read-only on the ship's server, so the change couldn't be stowed."
   },
   "pwa": {
     "installPromptTitle": "Dock the Ship",
@@ -1258,6 +1266,7 @@
     "markdown": "Runes",
     "toggleRichEditorMode": "Fancy Mode",
     "toggleMarkdownMode": "Rune Mode",
+    "quickControls": "Quill controls",
     "toggleBold": "Heavy",
     "toggleItalic": "Lean",
     "toggleUnderline": "Keel",
@@ -1518,7 +1527,7 @@
     "noStoredKeysFound": "No keys found",
     "noEncryptionKeysConfigured": "No keys set",
     "pastePublicKeyBelow": "Paste public key below",
-    "generateOrImportKeysInProfile": "Go to Yer Mug -> Davy Jones' Locker",
+    "generateOrImportKeysInProfile": "Forge or bring aboard yer keys in Yer Mug > Davy Jones' Locker",
     "useCustomKey": "Use custom {keyType} key",
     "signWithPrivateKey": "Sign with private key",
     "proveAuthenticityOfNote": "prove it's real",
@@ -1567,7 +1576,7 @@
     "notePlaceholder": "I am a placeholder because you can't encrypt an empty note."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "These rules only last 'til ye leave port. For permanent rules check",
+    "sessionOnlyPrefix": "These rules only last 'til ye leave port. For permanent rules, check",
     "accountSettings": "preferences",
     "autosaveNotes": "Auto-Stow Logs",
     "showNotePreview": "Spy Logs on Cards",
@@ -1593,23 +1602,48 @@
     "migrationFailed": "Refit Failed",
     "migrating": "Refitting...",
     "startMigration": "Start Refit",
-    "migrationSuccessful": "Refit Successful",
+    "migrationSuccessful": "Refit Done",
     "returnToApp": "Return to Deck",
     "adminAccessRequired": "Captain Only",
-    "adminAccessDescription": "Only the Captain can do this.",
+    "adminAccessDescription": "Only the Captain can run this refit. Ask 'em.",
     "whatsHappening": "What's brewin'?",
     "sharingDataMigrationDescription": "We need to move the cargo around.",
     "whatsChanging": "What's changin'?",
     "automaticBackupIncluded": "Auto Backup",
     "yamlFrontmatterIndustryStandard": "YAML is standard",
     "noMigrationNeeded": "Ship is ship-shape.",
-    "importantBackupData": "Important: Secure yer Cargo"
+    "importantBackupData": "Important: Secure yer Cargo",
+    "sharingNowWithData": "Yer sharin' rules now sail with yer logs and holds.",
+    "sharingMovesDescription": "Sharin' leaves the one central chest and moves into yer data. Holds can now be shared, and shared holds show up in yer own sidebar instead of a separate section.",
+    "whatsHappeningBody": "Every share in <code>.sharing.json</code> gets written into the frontmatter of the item it belongs to, and every hold gets a <code>.category-info.json</code> with its identity, sharin' and orderin'. The old files be thrown overboard once the data has moved.",
+    "migrationChanges": "Refit Changes",
+    "sharingTravelsTitle": "Sharin' sails with the file",
+    "sharingTravelsBody": "Each shared item records who it be shared with in its own frontmatter, so movin' or renamin' it never breaks a share.",
+    "folderSharingTitle": "Hold sharin'",
+    "folderSharingBody": "Share a hold and everythin' inside it, now and forever after, be shared too. The crew sees it as a normal hold in their own sidebar.",
+    "oneFilePerFolderTitle": "One file per hold",
+    "oneFilePerFolderBody": "<code>.order.json</code> gets folded into <code>.category-info.json</code>, with orderin' keyed by uuid instead of filename.",
+    "permissionsUnchangedTitle": "Rights stay the same",
+    "permissionsUnchangedBody": "Read, edit and delete carry over exactly as they be today, per mate and per item.",
+    "backupWarningBody": "This refit rewrites frontmatter across yer logs and manifests and scuttles the old <code>.sharing.json</code> and <code>.order.json</code> files. Back up yer <code>data</code> hold before ye sail on.",
+    "backupConfirmLabel": "I've backed up me data hold and I know what this refit does.",
+    "backupConfirmHint": "Swear ye have a backup before ye sail on.",
+    "sharingDataMigrated": "Yer sharin' and orderin' data has been moved.",
+    "whatWasChanged": "What got changed:",
+    "migrationPartial": "Refit Finished With Leftover Cargo",
+    "leftoversTitle": "Some old files were kept aboard",
+    "leftoversBody": "The refit couldn't translate everythin', so the old files below were left on disk untouched. Nothin' has been scuttled. Fix the cause and run the refit again, or head back to the deck now and deal with it later.",
+    "overrideConfirmLabel": "Sail on anyway and stop showin' this page.",
+    "overrideConfirmHint": "The leftover files stay on disk, but the ship will treat yer data as moved. Any sharin' or orderin' listed above won't apply until ye refit again, which ye can do any time from /migration?force=1.",
+    "continueAnyway": "Sail On Anyway",
+    "overriding": "Sailin' on...",
+    "overrideFailed": "Couldn't skip the refit"
   },
   "toasts": {
     "categoryRenamedSuccessfully": "Heading renamed",
     "failedToRenameCategory": "Could not rename heading",
     "categoryRenamedSuccessfullyMessage": "{categoryName} renamed to {newName}",
-    "failedToRenameCategoryMessage": "An error occurred."
+    "failedToRenameCategoryMessage": "Somethin' went wrong renamin' the heading."
   },
   "auditLogs": {
     "title": "The Black Book",
@@ -1626,7 +1660,7 @@
     "exportJSON": "JSON Export",
     "exportCSV": "CSV Export",
     "cleanupOldLogs": "Tear Out Pages",
-    "confirmCleanup": "Rip out pages older than {days} days? Gone forever.",
+    "confirmCleanup": "Rip out pages older than {days} days? This hits ALL the crew and they be gone forever.",
     "confirmCleanupUnlimited": "We keep everything forever unless ye tear it out.",
     "deleteAllLogsModalTitle": "Burn the Book",
     "deleteAllLogsWarning": "This burns the WHOLE book.",
@@ -1659,7 +1693,6 @@
     "login": "Boarded",
     "logout": "Departed",
     "register": "Signed Up",
-    "sessionTerminated": "Marooned",
     "sessionterminated": "Marooned",
     "usercreated": "Recruited",
     "userupdated": "Discipled",
@@ -1719,6 +1752,7 @@
     "howTo": "Guide",
     "shortcuts": "Shortcuts",
     "markdownGuide": "Rune Guide",
+    "brain": "Links & Brain",
     "customisations": "Tweaks",
     "docker": "Docker",
     "envVariables": "Winds",
@@ -1726,6 +1760,7 @@
     "pwa": "Docking",
     "encryption": "Locker",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Lingos",
     "unraid": "Unraid",
     "patches": "Patches"
@@ -1739,6 +1774,7 @@
   },
   "notifications": {
     "title": "Notifications",
+    "unread": "unread",
     "markAllRead": "Mark all read",
     "clearAll": "Clear all",
     "empty": "No notifications",
@@ -1746,12 +1782,99 @@
     "assignmentMessage": "\"{task}\" in \"{board}\"",
     "reminderTitle": "Task overdue",
     "reminderMessage": "\"{task}\" in \"{board}\" is past its reminder",
-    "unread": "unread",
     "sharingTitle": "{user} shared a {type} with ye",
     "sharingMessage": "Open to eyeball the shared {type}",
     "sharingFolderTitle": "{user} shared a {type} chest with ye",
-    "sharingFolderMessage": "Open to eyeball “{folder}”",
+    "sharingFolderMessage": "Open to eyeball \"{folder}\"",
     "mentionTitle": "{user} hollered yer name in a scribble",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
+  },
+  "relations": {
+    "indexing": "Chartin' the connections...",
+    "unreachable": "out o' reach",
+    "createFromWikilink": "Scribe a log called \"{title}\"",
+    "mentionedIn": "Spoken of in",
+    "mentionedInHint": "These logs use this title as plain words. Link one to tie 'em together.",
+    "linkMention": "Link",
+    "linked": "Tied the mention in {title}",
+    "linkFailed": "Couldn't tie that mention",
+    "kind": {
+      "mention": "Link",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "Brain",
+    "openBrain": "Open in brain",
+    "search": "Hunt for somethin' in yer brain...",
+    "dimension": "View",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Round this item",
+    "global": "The whole sea",
+    "depth": "Depth {depth}",
+    "colourBy": "Paint by",
+    "colourModes": {
+      "type": "Type",
+      "category": "Heading"
+    },
+    "filters": {
+      "notes": "Logs",
+      "checklists": "Manifests",
+      "tags": "Tags",
+      "ghosts": "Not scribed yet",
+      "suggestions": "Hunches",
+      "orphans": "Castaways"
+    },
+    "kind": {
+      "note": "Log",
+      "checklist": "Manifest",
+      "ghost": "Not scribed yet",
+      "tag": "Tag"
+    },
+    "edges": {
+      "mention": "Link",
+      "wiki": "Wikilink",
+      "suggested": "Hunch",
+      "tag": "Tag"
+    },
+    "linksTo": "Links to",
+    "linkedFrom": "Linked from",
+    "suggested": "Might be kin",
+    "promote": "Link to {title}",
+    "lonely": "Nothin' ties to this yet. Mention it with @ or [[ from another log.",
+    "open": "Open",
+    "createGhost": "Scribe this log",
+    "openTag": "Show everythin' tagged",
+    "createFailed": "Couldn't scribe that log",
+    "connectFailed": "Couldn't tie those two",
+    "connected": "Tied {source} to {target}",
+    "empty": "Yer brain be calm waters. Link logs and manifests with @ or [[ and they'll show up here.",
+    "viewingOwner": "Viewin' {owner}'s brain",
+    "summary": "{items} items, {links} links, {shown} shown"
+  },
+  "apiExplorer": {
+    "title": "API spyglass",
+    "intro": "Every endpoint this ship (v{version}) offers, drawn from the code that serves it. Pick one, fill it in and fire.",
+    "realData": "Requests run as the owner of the API key against real cargo. A DELETE here scuttles for real.",
+    "apiKey": "API key",
+    "apiKeyHint": "Kept on this page only and forgotten when ye leave.",
+    "useMyKey": "Use me key",
+    "noKeyYet": "Ye don't have an API key yet. Forge one in yer profile settings.",
+    "filter": "Filter",
+    "filterPlaceholder": "Path, name or method",
+    "noMatches": "Nothin' matches that filter.",
+    "body": "Request body (JSON)",
+    "showSchema": "Show schema",
+    "hideSchema": "Hide schema",
+    "send": "Fire",
+    "sending": "Firin'...",
+    "keyRequired": "Add an API key first.",
+    "noKeyNeeded": "no API key needed",
+    "deprecated": "deprecated",
+    "requestFailed": "The request never reached the ship. Check yer connection.",
+    "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/pl.json b/app/_translations/pl.json
index 63f802c1e..8a655d321 100644
--- a/app/_translations/pl.json
+++ b/app/_translations/pl.json
@@ -127,6 +127,7 @@
     "expandAll": "Rozwiń wszystko",
     "saveChanges": "Zapisz zmiany",
     "all": "Wszystko",
+    "items": "Elementy",
     "showAll": "Pokaż wszystkie",
     "creating": "Tworzenie…",
     "createCategoryHeader": "Utwórz nową kategorię",
@@ -173,7 +174,7 @@
     "noResults": "Brak wyników",
     "by": "przez {owner}",
     "unsavedChanges": "Niezapisane zmiany",
-    "unsavedChangesDetected": "⚠️ Wykryto niezapisane zmiany",
+    "unsavedChangesDetected": "Niezapisane zmiany",
     "unsavedChangesMessage": "Masz niezapisane zmiany w {noteTitle}. Jeśli odejdziesz teraz, Twoje zmiany zostaną utracone.",
     "whatToDoWithUnsavedChanges": "Co chcesz zrobić z niezapisanymi zmianami?",
     "discard": "Odrzuć",
@@ -238,44 +239,42 @@
     "openSearch": "Otwórz wyszukiwanie",
     "closeSearch": "Zamknij wyszukiwanie",
     "moreOptions": "Więcej opcji",
-    "retry": "Spróbować ponownie",
+    "history": "Historia",
+    "disable": "Wyłącz",
     "restoring": "Przywracam...",
+    "retry": "Spróbować ponownie",
     "copiedToClipboard": "Skopiowano do schowka",
     "offline": "Nieaktywny",
     "connected": "Połączony",
     "reconnecting": "Ponowne łączenie...",
     "hide": "Ukryj",
-    "disable": "Wyłącz",
-    "history": "Historia",
-    "items": "Elementy",
     "thisEntry": "ten wpis",
     "preview": "Podgląd"
   },
-  "comments": {
-    "title": "Komentarze",
-    "titleWithCount": "{count, plural, one {# Komentarz} few {# Komentarze} other {# Komentarzy}}",
-    "noComments": "Brak komentarzy. Rozpocznij rozmowę!",
-    "addComment": "Dodaj komentarz...",
-    "replyPlaceholder": "Napisz odpowiedź...",
-    "post": "Opublikuj",
-    "reply": "Odpowiedz",
-    "edit": "Edytuj",
-    "delete": "Usuń",
-    "save": "Zapisz",
-    "cancel": "Anuluj",
-    "edited": "edytowany",
-    "deleteConfirmTitle": "Usunąć komentarz?",
-    "deleteConfirmMessage": "Spowoduje to usunięcie komentarza i wszystkich odpowiedzi. Tej akcji nie można cofnąć.",
-    "commentDeleted": "Komentarz usunięty",
-    "commentAdded": "Komentarz dodany",
-    "commentUpdated": "Komentarz zaktualizowany",
-    "failedToAdd": "Nie udało się dodać komentarza",
-    "failedToEdit": "Nie udało się edytować komentarza",
-    "failedToDelete": "Nie udało się usunąć komentarza",
-    "failedToLoad": "Nie udało się załadować komentarzy",
-    "readOnly": "Aby komentować tę kartę, potrzebujesz uprawnień do edycji.",
-    "replyTo": "Odpowiedz użytkownikowi {author}",
-    "noUsersFound": "Nie znaleziono użytkowników"
+  "history": {
+    "noteHistory": "Historia notatki",
+    "restore": "Przywróć",
+    "restoreVersion": "Przywróć wersję",
+    "restoreConfirm": "Przywrócić tę wersję? \nBieżąca treść zostanie zastąpiona.",
+    "noHistory": "Brak dostępnej historii",
+    "noHistoryDescription": "Zapisz notatkę, aby utworzyć punkt w historii.",
+    "loadMore": "Załaduj więcej",
+    "featureDisabled": "Historia wyłączona",
+    "disabledAdmin": "Historia notatek jest wyłączona. Możesz ją włączyć w Ustawieniach administratora > Edytor.",
+    "disabledUser": "Historia notatek jest wyłączona. Poproś administratora, żeby ją włączył.",
+    "goToSettings": "Idź do ustawień",
+    "manualSavesOnly": "Historię tworzą tylko ręczne zapisy. Autozapis jej nie tworzy.",
+    "fetchError": "Nie udało się załadować historii",
+    "restoreError": "Nie udało się przywrócić wersji",
+    "viewContent": "Wyświetl zawartość",
+    "viewDiff": "Zobacz zmiany",
+    "actionCreate": "Utworzono",
+    "actionUpdate": "Zaktualizowano",
+    "actionRename": "Zmieniono nazwę",
+    "actionMove": "Przeniesiono",
+    "actionDelete": "Usunięto",
+    "actionInit": "Zainicjowano",
+    "actionUnknown": "Zmieniono"
   },
   "auth": {
     "loginTitle": "Logowanie",
@@ -296,7 +295,7 @@
     "sessionExpired": "Twoja sesja wygasła",
     "setupComplete": "Konfiguracja zakończona",
     "createAccount": "Utwórz konto",
-    "errorOccurred": "Wystąpił błąd. Spróbuj ponownie.",
+    "errorOccurred": "Coś poszło nie tak. Spróbuj ponownie.",
     "enterUsername": "Wprowadź nazwę użytkownika",
     "enterPassword": "Wprowadź hasło",
     "chooseUsername": "Wybierz nazwę użytkownika",
@@ -310,7 +309,7 @@
     "createUser": "Utwórz użytkownika",
     "attemptsRemaining": "Uwaga: {count, plural, one {# próba} few {# próby} other {# prób}} pozostało przed zablokowaniem konta",
     "accountLocked": "Zbyt wiele nieudanych prób. Spróbuj ponownie za {seconds} {seconds, plural, one {sekundę} few {sekundy} other {sekund}}",
-    "notAuthorized": "Nie masz uprawnień dostępu do tej aplikacji. Skontaktuj się z administratorem.",
+    "notAuthorized": "Nie masz dostępu do tej aplikacji. Poproś administratora.",
     "rememberMe": "Zapamiętaj mnie"
   },
   "mfa": {
@@ -335,7 +334,7 @@
     "invalidCode": "Nieprawidłowy kod uwierzytelniania",
     "invalidRecoveryCode": "Nieprawidłowy kod odzyskiwania",
     "mfaRequired": "Wymagana jest autoryzacja dwuskładnikowa",
-    "mfaEnabledSuccess": "Autoryzacja dwuskładnikowa została pomyślnie włączona",
+    "mfaEnabledSuccess": "Uwierzytelnianie dwuskładnikowe włączone",
     "mfaDisabledSuccess": "Autoryzacja dwuskładnikowa wyłączona",
     "tooManyAttempts": "Za dużo nieudanych prób. Spróbuj ponownie później.",
     "disableTitle": "Wyłącz Autoryzację Dwuskładnikową",
@@ -357,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Spowoduje to unieważnienie bieżącego kodu odzyskiwania",
     "regenerateRecoveryCodeDescription": "Wprowadź swój kod 2FA, aby wygenerować nowy kod odzyskiwania. Twój stary kod przestanie działać.",
     "recoveryCodeRegenerated": "Nowy Kod Odzyskiwania został wygenerowany",
-    "recoveryCodeRegeneratedInfo": "Twój nowy kod odzyskiwania został utworzony. Zapisz go w bezpiecznym miejscu – to jedyny raz, kiedy zobaczysz go.",
-    "recoveryCodeRegeneratedSuccess": "Kod odzyskiwania pomyślnie wygenerowany",
+    "recoveryCodeRegeneratedInfo": "Twój nowy kod odzyskiwania jest gotowy. Zapisz go w bezpiecznym miejscu, widzisz go tylko ten jeden raz.",
+    "recoveryCodeRegeneratedSuccess": "Kod odzyskiwania wygenerowany ponownie",
     "recoveryCodeProfileDescription": "Użyj tego kodu do przywracania konta, jeśli stracisz dostęp do aplikacji uwierzytelniającej",
     "disableMfaForUser": "Wyłącz 2FA dla tego użytkownika",
     "recoveryCodeRequired": "Kod odzyskiwania jest wymagany",
@@ -372,7 +371,7 @@
     "recent": "Ostatnie",
     "browseAndManage": "Przeglądaj i zarządzaj wszystkimi notatkami",
     "noNotesYet": "Brak jeszcze notatek",
-    "createFirstNote": "Utwórz pierwszą notatkę, aby rozpocząć pracę z bazą wiedzy.",
+    "createFirstNote": "Nic tu jeszcze nie ma. Utwórz pierwszą notatkę.",
     "createNewNote": "Stwórz nową notatkę",
     "noNotesFound": "Nie znaleziono notatek",
     "tryAdjustingFilters": "Spróbuj zmienić filtry lub utworzyć nową notatkę.",
@@ -403,22 +402,26 @@
     "enterNoteTitle": "Wprowadź tytuł notatki…",
     "byType": "Według typu",
     "publiclySharedNote": "Publicznie udostępniona",
+    "sharedPubliclyBy": "Tę notatkę publicznie udostępnia {owner}",
+    "copyRawContent": "Skopiuj markdown",
     "quickSave": "Szybkie zapisanie",
     "noteNotFound": "Notatka nie znaleziona",
     "unarchiveNote": "Odarchiwizuj notatkę",
     "enterNoteName": "Wprowadź nazwę notatki…",
     "updateNote": "Zaktualizuj notatkę",
-    "tags": "Tagi",
-    "noTagsFound": "Nie znaleziono tagów",
-    "searchTags": "Szukaj tagów...",
-    "copyRawContent": "Skopiuj markdown",
     "printSaveAsPdf": "Drukuj / Zapisz jako PDF",
     "tableOfContents": "Spis treści",
     "wordCount": "{count, plural, one {# słowo} few {# słowa} many {# słów} other {# słów}}",
     "charCount": "{count, plural, one {# znak} few {# znaki} many {# znaków} other {# znaków}}",
-    "readingTime": "{count, plural, one {# minuta czytania} few {# minuty czytania} many {# minut czytania} other {# minut czytania}}"
+    "readingTime": "{count, plural, one {# minuta czytania} few {# minuty czytania} many {# minut czytania} other {# minut czytania}}",
+    "tags": "Tagi",
+    "noTagsFound": "Nie znaleziono tagów",
+    "searchTags": "Szukaj tagów...",
+    "createNoteFailed": "Nie udało się utworzyć notatki",
+    "createCategoryFailed": "Nie udało się utworzyć kategorii, więc notatka nie powstała"
   },
   "checklists": {
+    "sharedPubliclyBy": "Tę listę publicznie udostępnia {owner}",
     "title": "Listy",
     "allChecklists": "Wszystkie Listy",
     "completed": "Ukończone",
@@ -432,7 +435,7 @@
     "progress": "Postęp",
     "totalItems": "Łączna liczba elementów",
     "noChecklistsYet": "Brak jeszcze list kontrolnych",
-    "createFirstChecklist": "Utwórz pierwszą listę kontrolną, aby zacząć organizować zadania.",
+    "createFirstChecklist": "Nic tu jeszcze nie ma. Utwórz pierwszą listę.",
     "newChecklist": "Nowa Lista",
     "noChecklistsFound": "Nie znaleziono list kontrolnych",
     "tryAdjustingFiltersChecklist": "Spróbuj zmienić filtry lub utworzyć nową listę kontrolną.",
@@ -474,6 +477,7 @@
     "checklistType": "Typ Listyj",
     "simpleChecklist": "Prosta Lista",
     "taskProject": "Projekt zadań",
+    "kanbanBoard": "Tablica Kanban",
     "basicTodoItems": "Podstawowe zadania",
     "withTimeTracking": "Z śledzeniem czasu",
     "noDescription": "Brak opisu",
@@ -500,23 +504,24 @@
     "clearAllCompletedConfirmMessage": "Czy na pewno chcesz usunąć wszystkie {count} ukończone elementy? Ta akcja nie może zostać cofnięta.",
     "clearAllIncompleteConfirmMessage": "Czy na pewno chcesz usunąć wszystkie niekompletne elementy ({count}) i ich elementy podrzędne? \nTej akcji nie można cofnąć.",
     "convertChecklistType": "Konwertuj typ Listyj",
-    "convertTypeConfirmation": "Zamierzasz przekonwertować z {currentType} na {newType}. Czy na pewno chcesz kontynuować?",
-    "dataLossWarning": "⚠️ Ostrzeżenie o utracie danych",
+    "convertTypeConfirmation": "Przekonwertować z {currentType} na {newType}?",
+    "dataLossWarning": "Ostrzeżenie o utracie danych",
     "dataLossWarningItems": "Poniższe dane zostaną utracone:",
     "allTaskStatusesReset": "Wszystkie statusy zadań zostaną zresetowane",
     "timeTrackingDataLost": "Dane śledzenia czasu zostaną utracone",
     "estimatedTimesRemoved": "Szacunkowe czasy zostaną usunięte",
     "targetDatesCleared": "Cele dat zostaną wyczyszczone",
-    "enhancedFeatures": "✨ Zaawansowane funkcje",
+    "enhancedFeatures": "Co zyskujesz",
     "enhancedFeaturesYouWillGain": "Zyskasz:",
     "kanbanBoardWithDragDrop": "Tablica Kanban z przeciąganiem i upuszczaniem",
     "taskStatusTracking": "Śledzenie statusów zadań (Do zrobienia, W trakcie itp.)",
     "timeTrackingWithTimer": "Śledzenie czasu z wbudowanym minutnikiem",
-    "actionCannotBeUndone": "Ta akcja nie może zostać cofnięta. Czy na pewno chcesz konwertować?",
+    "actionCannotBeUndone": "Tego nie da się cofnąć. Mimo to konwertować?",
     "convertAndLoseData": "Konwertuj i utracisz dane",
     "convert": "Konwertuj",
     "convertToSimpleChecklist": "Konwertuj do prostej Listyj",
     "convertToTaskProject": "Konwertuj do projektu zadań",
+    "convertToKanbanBoard": "Konwertuj na tablicę Kanban",
     "pasteYourList": "Wklej swoją listę (po jednym elemencie w linii)",
     "addItems": "Dodaj {count} elementów",
     "itemsWillBeAdded": "{count} elementy zostaną dodane",
@@ -525,11 +530,35 @@
     "noItemsYet": "Brak elementów",
     "addFirstItem": "Dodaj swój pierwszy element, aby rozpocząć!",
     "noTasks": "Brak zadań",
-    "noSubtasksYet": "Brak podzadań. Dodaj jedno poniżej, aby zacząć.",
+    "noSubtasksYet": "Brak podzadań. Dodaj jedno poniżej.",
     "addTime": "Dodaj Czas",
-    "enterTimeInMinutes": "Wprowadź czas w minutach",
-    "convertToKanbanBoard": "Konwertuj na tablicę Kanban",
-    "kanbanBoard": "Tablica Kanban"
+    "enterTimeInMinutes": "Wprowadź czas w minutach"
+  },
+  "comments": {
+    "title": "Komentarze",
+    "titleWithCount": "{count, plural, one {# Komentarz} few {# Komentarze} other {# Komentarzy}}",
+    "noComments": "Brak komentarzy. Rozpocznij rozmowę!",
+    "addComment": "Dodaj komentarz...",
+    "replyPlaceholder": "Napisz odpowiedź...",
+    "post": "Opublikuj",
+    "reply": "Odpowiedz",
+    "edit": "Edytuj",
+    "delete": "Usuń",
+    "save": "Zapisz",
+    "cancel": "Anuluj",
+    "edited": "edytowany",
+    "deleteConfirmTitle": "Usunąć komentarz?",
+    "deleteConfirmMessage": "Spowoduje to usunięcie komentarza i wszystkich odpowiedzi. Tej akcji nie można cofnąć.",
+    "commentDeleted": "Komentarz usunięty",
+    "commentAdded": "Komentarz dodany",
+    "commentUpdated": "Komentarz zaktualizowany",
+    "failedToAdd": "Nie udało się dodać komentarza",
+    "failedToEdit": "Nie udało się edytować komentarza",
+    "failedToDelete": "Nie udało się usunąć komentarza",
+    "failedToLoad": "Nie udało się załadować komentarzy",
+    "readOnly": "Aby komentować tę kartę, potrzebujesz uprawnień do edycji.",
+    "replyTo": "Odpowiedz użytkownikowi {author}",
+    "noUsersFound": "Nie znaleziono użytkowników"
   },
   "tasks": {
     "title": "Zadania",
@@ -558,7 +587,7 @@
     "overdue": "Przeglądnięte",
     "browseAndManageTaskLists": "Przeglądaj i zarządzaj wszystkimi listami zadań",
     "noTaskListsYet": "Brak jeszcze list zadań",
-    "createFirstTaskList": "Utwórz pierwszą listę zadań, aby zacząć zarządzać projektami.",
+    "createFirstTaskList": "Nic tu jeszcze nie ma. Utwórz pierwszą listę zadań.",
     "newTaskList": "Nowa lista zadań",
     "taskLists": "Listy zadań",
     "noTaskListsFound": "Nie znaleziono list zadań",
@@ -606,7 +635,7 @@
     "changeStatus": "Zmień status",
     "noBoards": "Nie znaleziono tablic",
     "noBoardsYet": "Brak tablic Kanban",
-    "createFirstBoard": "Utwórz pierwszą tablicę Kanban, aby zarządzać projektami.",
+    "createFirstBoard": "Nic tu jeszcze nie ma. Utwórz pierwszą tablicę Kanban.",
     "newBoard": "Nowa tablica",
     "tryAdjustingFilters": "Dostosuj filtry lub utwórz nową tablicę.",
     "completed": "Ukończono",
@@ -659,7 +688,7 @@
     "quickSettingsHeader": "Szybkie ustawienia (tylko urządzenie)",
     "adminSettings": "Panel administratora",
     "apiKey": "Klucz API",
-    "apiKeyDescription": "Wygeneruj klucz API, aby uzyskać programowy dostęp do swoich list kontrolnych i notatek",
+    "apiKeyDescription": "Wygeneruj klucz API, żeby skrypty i aplikacje miały dostęp do Twoich list i notatek",
     "hideApiKey": "Ukryj klucz API",
     "showApiKey": "Pokaż klucz API",
     "copyApiKey": "Skopiuj klucz API",
@@ -677,13 +706,13 @@
     "removeAvatar": "Usuń awatar",
     "usernameRequired": "Nazwa użytkownika jest wymagana",
     "passwordsDoNotMatch": "Nowe hasła nie pasują",
-    "profileUpdated": "Profil zaktualizowany pomyślnie!",
+    "profileUpdated": "Profil zaktualizowany",
     "failedToUpdateProfile": "Nie udało się zaktualizować profilu",
     "failedToUpdateProfileRetry": "Nie udało się zaktualizować profilu. Spróbuj ponownie.",
-    "avatarUpdated": "Awatar zaktualizowany pomyślnie!",
+    "avatarUpdated": "Awatar zaktualizowany",
     "failedToUpdateAvatar": "Nie udało się zaktualizować awatara",
     "failedToUpdateAvatarRetry": "Nie udało się zaktualizować awatara. Spróbuj ponownie.",
-    "avatarRemoved": "Awatar usunięty pomyślnie!",
+    "avatarRemoved": "Awatar usunięty",
     "failedToRemoveAvatar": "Nie udało się usunąć awatara",
     "failedToRemoveAvatarRetry": "Nie udało się usunąć awatara. Spróbuj ponownie.",
     "activeSessions": "Aktywne sesje",
@@ -703,11 +732,11 @@
     "auditLogsTab": "Dzienniki użytkownika",
     "rebuildLinkIndexes": "Przebuduj indeksy linków, aby zaktualizować dane połączeń",
     "rebuildingLinkIndex": "Przebudowywanie indeksu linków…",
-    "successfullyRebuiltIndex": "Indeks linków przebudowany pomyślnie",
-    "successfullyRebuiltIndexReload": "Indeks linków przebudowany! Strona zostanie przeładowana, aby pokazać zaktualizowane połączenia.",
+    "successfullyRebuiltIndex": "Indeks linków przebudowany",
+    "successfullyRebuiltIndexReload": "Indeks linków przebudowany. Strona przeładuje się, żeby pokazać nowe połączenia.",
     "failedToRebuildIndex": "Nie udało się przebudować indeksu linków. Spróbuj ponownie.",
     "contentLinks": "Linki treści",
-    "visualizeRelationships": "Wizualizuj relacje między notatkami i listami kontrolnymi",
+    "visualizeRelationships": "Zobacz, jak Twoje notatki i listy linkują do siebie nawzajem",
     "connectedItems": "Połączone elementy",
     "noLinksFound": "Nie znaleziono linków",
     "startCreatingInternalLinks": "Zacznij tworzyć linki wewnętrzne, wpisując `@` w swoich notatkach, aby zobaczyć tutaj sieć relacji.",
@@ -718,8 +747,8 @@
     "isolated": "izolowane",
     "connection": "połączenie",
     "connection_plural": "połączenia",
-    "terminateSessionConfirm": "Czy na pewno chcesz zakończyć tę sesję?",
-    "terminateAllSessionsConfirm": "Czy na pewno chcesz zakończyć wszystkie inne sesje?",
+    "terminateSessionConfirm": "Zakończyć tę sesję?",
+    "terminateAllSessionsConfirm": "Zakończyć wszystkie inne sesje?",
     "validationErrorTitle": "Błąd walidacji",
     "visibleGraphSummary": "{items, plural, one {# widoczny element} few {# widoczne elementy} other {# widocznych elementów}}, {links, plural, one {# widoczne połączenie} few {# widoczne połączenia} other {# widocznych połączeń}}",
     "graphTruncated": "Wyświetlono {visible} najczęściej połączonych elementów. Pominięto {omitted, plural, one {# słabiej połączony element} few {# słabiej połączone elementy} other {# słabiej połączonych elementów}}.",
@@ -790,10 +819,10 @@
     "chooseAutoSaveInterval": "Wybierz interwał, w którym będą automatycznie zapisywane notatki.",
     "defaultMode": "Domyślny tryb",
     "selectNotesDefaultMode": "Wybierz domyślny tryb notatek",
-    "chooseNotesDefaultMode": "Wybierz, czy notatka ma być w trybie edycji od razu, czy w trybie podglądu {mode} przy otwieraniu.",
+    "chooseNotesDefaultMode": "Wybierz, czy notatki otwierają się w trybie edycji. Zawsze możesz przełączyć przyciskiem {mode} w edytorze notatek.",
     "defaultEditor": "Domyślny edytor",
     "selectNotesDefaultEditor": "Wybierz domyślny edytor notatek",
-    "chooseDefaultEditor": "Wybierz domyślny edytor dla notatek – (możesz zawsze zmienić, klikając przycisk {editor} w edytorze).",
+    "chooseDefaultEditor": "Wybierz domyślny edytor notatek. Zawsze możesz przełączyć przyciskiem {editor} w edytorze notatek.",
     "tableSyntaxInNotes": "Składnia tabel w notatkach",
     "selectTableSyntax": "Wybierz składnię tabeli",
     "chooseTableSyntax": "Wybierz jak mają być renderowane tabele w notatkach.",
@@ -802,7 +831,7 @@
     "chooseSyntaxTheme": "Wybierz motyw podświetlania składni dla edytora Markdown.",
     "minimalMode": "Tryb Minimalny (Wyłącz Edytor Rich Text)",
     "selectMinimalMode": "Wybierz tryb minimalny",
-    "minimalModeDescription": "Po włączeniu używa prostego renderera markdown zamiast edytora rich text. Zaawansowane funkcje, takie jak dwukierunkowe linki, nie będą działać w tym trybie.",
+    "minimalModeDescription": "Używa prostego renderera markdown zamiast edytora rich text. Dwukierunkowe linki i inne zaawansowane funkcje nie działają w tym trybie.",
     "defaultNoteFilter": "Domyślny filtr notatek",
     "selectDefaultNoteFilter": "Wybierz domyślny filtr notatek",
     "chooseDefaultNoteFilter": "Wybierz domyślny filtr, który ma być zastosowany przy otwieraniu strony Notatki.",
@@ -829,8 +858,8 @@
     "currentPassword": "Aktualne hasło",
     "newPassword": "Nowe hasło",
     "confirmPassword": "Potwierdź hasło",
-    "passwordChanged": "Hasło zmienione pomyślnie",
-    "settingsSaved": "Ustawienia zapisane pomyślnie",
+    "passwordChanged": "Hasło zmienione",
+    "settingsSaved": "Ustawienia zapisane",
     "dashCase": "Słowo-średnikowe (np. moj-plik-nazwa.md)",
     "minimal": "Minimalny (usunięcie tylko nieprawidłowych znaków)",
     "noRename": "Brak zmiany nazwy (zachowaj oryginalną nazwę pliku)",
@@ -840,6 +869,7 @@
     "seconds_plural": "{count} sekundy",
     "hours12": "12‑godzinny",
     "hours24": "24‑godzinny",
+    "useSystemDefault": "Użyj ustawień domyślnych systemu",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "Domyślny",
@@ -863,7 +893,7 @@
     "chooseQuickCreateNotes": "Wybierz tryb szybkiego tworzenia notatek.",
     "quickCreateNotesShowModal": "Pokaż okno modalne przy tworzeniu notatki",
     "quickCreateNotesSkipModal": "Pomiń okno modalne i twórz natychmiastowo",
-    "quickCreateNotesDescription": "Po włączeniu nowa notatka zostanie utworzona bezpośrednio, pomijając okno modalne.",
+    "quickCreateNotesDescription": "Pomija okno tworzenia notatki i od razu otwiera edytor.",
     "defaultCategory": "Domyślna kategoria dla szybkiego tworzenia notatek",
     "selectDefaultCategory": "Wybierz domyślną kategorię…",
     "defaultCategoryDescription": "Nowe notatki będą utworzone w tej kategorii przy użyciu trybu szybkiego tworzenia.",
@@ -901,7 +931,7 @@
     "hideStatusOnCardsLabel": "Status na kartach Kanban",
     "showStatusOnCards": "Pokaż status",
     "hideStatusOnCards": "Ukryj status",
-    "hideStatusOnCardsDescription": "Ukrywa etykietę statusu na kartach Kanban. Status jest już wskazany przez kolumnę, w której znajduje się karta.",
+    "hideStatusOnCardsDescription": "Ukrywa etykietę statusu na kartach Kanban. Kolumna już pokazuje status.",
     "hideMobileStatusDropdownLabel": "Mobilna lista statusu na kartach",
     "showMobileStatusDropdown": "Pokaż listę mobilną",
     "hideMobileStatusDropdown": "Ukryj listę mobilną",
@@ -914,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "Ukrywa licznik i zarejestrowane sesje na kartach Kanban. Śledzenie czasu pozostaje dostępne w widoku szczegółów karty.",
     "selectStatusOnCards": "Wybierz widoczność statusu",
     "codeBlockChoice": "Wybierz styl bloku kodu",
-    "themedCodeBlock": "Tematyczny blok kodu",
     "defaultCodeBlock": "Codepen (domyślnie)",
+    "themedCodeBlock": "Tematyczny blok kodu",
     "codeBlockChoiceDescription": "Wybierz pomiędzy domyślnym stylem bloków kodu podobnym do codepen lub tematycznym stylem bloków kodu.",
     "checklistItemClickAction": "Akcja kliknięcia elementu listy kontrolnej",
     "selectChecklistItemClickAction": "Wybierz czynność kliknięcia elementu listy kontrolnej",
-    "checklistItemClickActionDescription": "Wybierz, co się stanie, gdy klikniesz tekst zadania. \n„Oznacz jako ukończone” przełącza pole wyboru (domyślnie); \n„Edytuj nazwę zadania” otwiera zadanie do edycji bezpośredniej — nadal będziesz musiał kliknąć samo pole wyboru, aby je ukończyć.",
+    "checklistItemClickActionDescription": "Wybierz, co się dzieje po kliknięciu tekstu zadania. „Oznacz jako ukończone” (domyślnie) przełącza pole wyboru. „Edytuj nazwę zadania” otwiera zadanie do edycji w miejscu, a żeby je ukończyć, klikasz samo pole wyboru.",
     "checklistItemClickActionToggle": "Oznacz jako ukończone/niekompletne",
     "checklistItemClickActionEdit": "Edytuj element listy",
     "newItemInsertion": "Wstawianie nowych elementów",
@@ -927,7 +957,6 @@
     "newItemInsertionDescription": "Wybierz, czy nowe elementy są dodawane na górze (domyślnie) czy na dole listy kontrolnej.",
     "newItemInsertionTop": "Góra listy",
     "newItemInsertionBottom": "Dół listy",
-    "useSystemDefault": "Użyj ustawień domyślnych systemu",
     "selectShowChecklistEmojis": "Wybierz widoczność emotikonów",
     "showChecklistEmojisDescription": "Pokazuje automatyczne emoji obok pozycji listy na podstawie ich tekstu."
   },
@@ -970,20 +999,24 @@
     "icon512": "Ikona 512x512",
     "icon512Description": "Wysokiej rozdzielczości ikona PWA.",
     "notifyNewUpdates": "Powiadom o nowych aktualizacjach",
-    "thisUsesGithubAPI": "Używa GitHub API do pobierania aktualizacji, wyłączając całkowicie API i nie pozwala na ruch w/ GitHub.",
+    "thisUsesGithubAPI": "Korzysta z API GitHuba, żeby sprawdzać aktualizacje. Wyłączenie zatrzymuje cały ruch do i z GitHuba.",
     "parseContent": "Zawsze pokazuj przetworzoną zawartość",
-    "parseContentEnabledDescription": "Po włączeniu ustawienie pokaże nazwy przetworzone w bocznym pasku, wynikach wyszukiwania oraz ogólnie w aplikacji.",
-    "parseContentDisabledDescription": "Po wyłączeniu oryginalne nazwy plików zostaną znormalizowane i pokazywane zamiast nich.",
-    "parseContentPerformanceWarning": "Ustawienie „nie” poprawi wydajność przy dużych zbiorach, ale może wpłynąć na czytelność – zwłaszcza przy nazwach nie‑latinowych znaków.",
+    "parseContentEnabledDescription": "Pokazuje przetworzone tytuły w pasku bocznym, w wynikach wyszukiwania i wszędzie indziej w aplikacji.",
+    "parseContentDisabledDescription": "Pokazuje zamiast tego oryginalne nazwy plików, oczyszczone tak, żeby dało się je czytać.",
+    "parseContentPerformanceWarning": "Ustawienie „nie” przyspiesza duże instancje, ale tytuły są trudniejsze do czytania, zwłaszcza nazwy plików ze znakami spoza alfabetu łacińskiego.",
     "hideLanguageSelector": "Ukryj selektor języka w nagłówku",
     "hideLanguageSelectorDescription": "Pokaż/ukryj rozwijane menu języków w nagłówku",
+    "defaultDateFormat": "Domyślny format daty",
+    "defaultDateFormatDescription": "Używane, gdy preferencja użytkownika dotycząca formatu daty jest ustawiona na „Użyj domyślnego formatu systemu”.",
+    "defaultTimeFormat": "Domyślny format czasu",
+    "defaultTimeFormatDescription": "Używane, gdy preferencja użytkownika dotycząca formatu czasu jest ustawiona na „Użyj domyślnego formatu systemu”.",
     "applicationIcons": "Ikony aplikacji",
     "saveChanges": "Zapisz zmiany",
     "unsavedChanges": "Masz niezapisane zmiany.",
     "loadError": "Błąd ładowania",
     "couldNotFetchSettings": "Nie udało się pobrać ustawień.",
     "failedToLoadSettings": "Nie udało się załadować ustawień",
-    "settingsSavedSuccessfully": "Ustawienia zapisane pomyślnie.",
+    "settingsSavedSuccessfully": "Ustawienia zapisane.",
     "failedToSaveSettings": "Nie udało się zapisać ustawień",
     "saveError": "Błąd zapisu",
     "unknownErrorOccurred": "Wystąpił nieznany błąd.",
@@ -996,7 +1029,7 @@
     "colorVariables": "Zmienne kolorów",
     "livePreview": "Podgląd na żywo",
     "unsavedCssChanges": "Masz niezapisane zmiany CSS.",
-    "noCustomThemesYet": "Brak jeszcze niestandardowych motywów. Kliknij „Utwórz motyw”, aby rozpocząć.",
+    "noCustomThemesYet": "Brak własnych motywów. Kliknij „Utwórz motyw”, żeby jakiś zrobić.",
     "myCustomTheme": "Mój niestandardowy motyw",
     "iconNameDescription": "nazwa ikony (np. PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "Wersja aplikacji",
@@ -1026,25 +1059,31 @@
     "enableTableToolbarDescription": "Włącz pasek narzędziowy, który pojawia się przy edycji tabel",
     "bilateralLinks": "Linki dwukierunkowe",
     "bilateralLinksDescription": "Włącz możliwość łączenia notatek i list kontrolnych w tym samym dokumencie.",
+    "historyEnabled": "Historia notatek",
+    "historyDescription": "Śledzi historię wersji notatek. Umożliwia przywracanie wcześniejszych wersji. Punkty historii tworzy tylko ręczny zapis (nie autozapis).",
+    "disableHistory": "Wyłącz historię",
+    "disableHistoryWarning": "Wyłączenie historii trwale usunie wszystkie zapisane wersje dla wszystkich użytkowników. Tej operacji nie cofniesz.",
+    "historyDisabled": "Historia notatek została wyłączona, a wszystkie dane historii usunięte.",
+    "failedToDisableHistory": "Nie udało się wyłączyć historii",
     "configureExternalServices": "Skonfiguruj zewnętrzne adresy URL integracji edytora.",
     "drawioUrl": "Adres Draw.io",
     "optional": "(Opcjonalny)",
-    "drawioUrlDescription": "Podaj własny adres URL instancji Draw.io. Pozostaw puste, aby użyć domyślnej publicznej instancji (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Użyj własnej instancji Draw.io. Zostaw puste, żeby korzystać z publicznej (https://embed.diagrams.net).",
     "drawioUrlExample": "Przykład dla samodzielnego hostingu: https://your-domain.com/drawio",
     "drawioProxyEnabled": "Przekieruj Draw.io przez Jotty",
-    "drawioProxyEnabledDescription": "Włącz, aby przekierować ruch Draw.io przez serwer Jotty. Wymagane przy wewnętrznych adresach Docker (np. http://drawio:8080), które nie są dostępne z przeglądarki użytkownika.",
+    "drawioProxyEnabledDescription": "Kieruje ruch Draw.io przez serwer Jotty. Potrzebne przy wewnętrznych adresach sieci Docker (np. http://drawio:8080), do których przeglądarki użytkowników nie mają dostępu.",
     "excalidrawUrl": "Adres Excalidraw",
-    "excalidrawUrlDescription": "Podaj własny adres URL instancji Excalidraw. Pozostaw puste, aby użyć domyślnej publicznej instancji (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Użyj własnej instancji Excalidraw. Zostaw puste, żeby korzystać z publicznej (https://excalidraw.com).",
     "excalidrawUrlExample": "Przykład dla samodzielnego hostingu: https://your-domain.com/excalidraw",
     "excalidrawProxyEnabled": "Przekieruj Excalidraw przez Jotty",
-    "excalidrawProxyEnabledDescription": "Włącz, aby przekierować ruch Excalidraw przez serwer Jotty. Wymagane przy wewnętrznych adresach Docker (np. http://excalidraw:3000), które nie są dostępne z przeglądarki użytkownika.",
+    "excalidrawProxyEnabledDescription": "Kieruje ruch Excalidraw przez serwer Jotty. Potrzebne przy wewnętrznych adresach sieci Docker (np. http://excalidraw:3000), do których przeglądarki użytkowników nie mają dostępu.",
     "saving": "Zapisywanie…",
-    "editorSettingsSaved": "Ustawienia edytora zapisane pomyślnie.",
+    "editorSettingsSaved": "Ustawienia edytora zapisane.",
     "customEmojis": "Emoji personalizowane",
-    "noEmojisYet": "Brak jeszcze emoji. Kliknij „Dodaj Emoji”, aby rozpocząć.",
-    "enterAnyEmoji": "Wprowadź dowolny emoji lub użyj pickera (Win: Win+.; Mac: Ctrl+Cmd+Space)",
+    "noEmojisYet": "Brak własnych emoji. Kliknij „Dodaj Emoji”, żeby jakieś dodać.",
+    "enterAnyEmoji": "Wpisz dowolne emoji lub użyj selektora emoji (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Przegląd udostępniania",
-    "detailedSharingBreakdown": "Szczegółowe podsumowanie udostępniania i zaangażowania użytkowników",
+    "detailedSharingBreakdown": "Co jest udostępniane i kto udostępnia",
     "checkForUpdates": "Sprawdź aktualizacje",
     "checkingForUpdates": "Sprawdzanie aktualizacji...",
     "updateAvailable": "Dostępna aktualizacja!",
@@ -1059,12 +1098,12 @@
     "userContent": "{checklistsLength} list kontrolnych • {notesLength} notatek",
     "rebuildIndexes": "Przebuduj indeksy",
     "rebuilding": "Przebudowywanie…",
-    "successfullyRebuiltIndex": "Indeks linków przebudowany pomyślnie dla {username}",
+    "successfullyRebuiltIndex": "Przebudowano indeks linków dla {username}",
     "failedToRebuildIndex": "Nie udało się przebudować indeksu linków dla {username}",
     "totalItems": "{items} elementów w sumie na {userCount}",
     "privileges": "Uprawnienia administratora",
     "adminContentAccess": "Dostęp do treści administratora",
-    "adminContentAccessDescription": "Kontroluje, czy administratorzy mają dostęp do wszystkich kont użytkowników. Jeśli wyłączone, admini mogą zarządzać tylko użytkownikami i ustawieniami, ale nie widzą innych danych.",
+    "adminContentAccessDescription": "Pozwala administratorom otwierać notatki i listy każdego użytkownika. Po wyłączeniu administratorzy zarządzają użytkownikami i ustawieniami, ale nie widzą cudzych treści.",
     "adminContentAccessYes": "Administratorzy mają pełny dostęp do treści",
     "adminContentAccessNo": "Administratorzy mają ograniczony dostęp (tylko własne)",
     "superAdminOnly": "Edytowalne tylko przez właściciela systemu",
@@ -1074,21 +1113,21 @@
     "confirmNewPassword": "Potwierdź nowe hasło",
     "dataExport": "Eksport danych",
     "dataExportOptions": "Opcje eksportu danych",
-    "selectExportType": "Wybierz typ eksportu i pobierz dane z aplikacji.",
+    "selectExportType": "Wybierz typ eksportu i pobierz dane.",
     "allChecklistsAndNotes": "Wszystkie Listy i notatki",
-    "allChecklistsAndNotesDescription": "Eksportuje wszystkie Listy i notatki utworzone przez wszystkich użytkowników. Utworzy plik ZIP zawierający dane JSON zorganizowane według użytkownika i kategorii.",
+    "allChecklistsAndNotesDescription": "Eksportuje listy i notatki wszystkich użytkowników jako ZIP z plikami JSON, pogrupowanymi według użytkownika i kategorii.",
     "userChecklistsNotes": "Specyficzne dla użytkownika Listy i notatki",
-    "userChecklistsNotesDescription": "Wybierz użytkownika z rozwijanej listy, aby wyeksportować wszystkie Listy i notatki należące do tego konkretnego użytkownika.",
+    "userChecklistsNotesDescription": "Wybierz użytkownika z listy, żeby wyeksportować wszystkie jego listy i notatki.",
     "allUsersData": "Całe dane konta użytkowników",
     "allUsersDataDescription": "Eksportuje plik JSON ze wszystkimi informacjami o koncie (nazwy, status admina itp.). Nie zawiera treści notatek ani list kontrolnych.",
     "wholeDataFolder": "Cały folder danych (backup)",
-    "wholeDataFolderDescription": "Eksportuje cały folder „data” z danymi użytkowników i ustawieniami. Używaj ostrożnie – może być bardzo duży.",
+    "wholeDataFolderDescription": "Eksportuje cały folder „data” ze wszystkimi treściami użytkowników, metadanymi i ustawieniami. Ten plik może być duży.",
     "noSharingPermissionsLabel": "Specyficzne udostępnione elementy są ukryte w zależności od uprawnień dostępu.",
     "contentHidden": "Szczegóły treści ukryte",
     "viewOnlySettingsNotice": "Tylko właściciel systemu może zmieniać te ustawienia.",
     "auditLogContentRedacted": "[Treść Ukryta]",
     "maxLogAgeDays": "Maksymalny wiek logów (dni)",
-    "maxLogAgeDaysDescription": "Ustaw, ile dni mają być przechowywane logi. Przy wyświetlaniu logów administrator będzie mógł prosić o usunięcie starszych niż ten próg.",
+    "maxLogAgeDaysDescription": "Jak długo przechowywać dzienniki audytu. Strona dzienników audytu zaproponuje usunięcie wszystkiego, co starsze. Ustaw 0, żeby trzymać dzienniki na zawsze i nigdy nie dostawać tej propozycji.",
     "appPreferences": "Preferencje aplikacji",
     "editEmoji": "Edytuj Emoji",
     "addEmoji": "Dodaj Emoji",
@@ -1107,16 +1146,6 @@
     "updateTagsTitle": "Przeskanuj notatki w poszukiwaniu hashtagów i zaktualizuj frontmatter",
     "tagsUpdated": "Przetworzono {processed} plików, zaktualizowano {updated} z nowymi tagami",
     "failedToUpdateTags": "Nie udało się zaktualizować tagów",
-    "historyEnabled": "Historia notatek",
-    "historyDescription": "Śledzi historię wersji notatek. Umożliwia przywracanie wcześniejszych wersji. Punkty historii tworzy tylko ręczny zapis (nie autozapis).",
-    "disableHistory": "Wyłącz historię",
-    "disableHistoryWarning": "Wyłączenie historii trwale usunie wszystkie zapisane wersje dla wszystkich użytkowników. Tej operacji nie cofniesz.",
-    "historyDisabled": "Historia notatek została wyłączona, a wszystkie dane historii usunięte.",
-    "failedToDisableHistory": "Nie udało się wyłączyć historii",
-    "defaultDateFormat": "Domyślny format daty",
-    "defaultDateFormatDescription": "Używane, gdy preferencja użytkownika dotycząca formatu daty jest ustawiona na „Użyj domyślnego formatu systemu”.",
-    "defaultTimeFormatDescription": "Używane, gdy preferencja użytkownika dotycząca formatu czasu jest ustawiona na „Użyj domyślnego formatu systemu”.",
-    "defaultTimeFormat": "Domyślny format czasu",
     "borderRadius": "Promień zaokrąglenia",
     "borderRadiusDescription": "Ustawia zaokrąglenie rogów w całej instancji. Użytkownicy mogą je nadpisać w szybkich ustawieniach.",
     "borderRadiusSaved": "Zapisano promień zaokrąglenia",
@@ -1132,6 +1161,9 @@
     "tryAgain": "Spróbuj ponownie",
     "contactSupport": "Skontaktuj się z pomocą techniczną",
     "invalidInput": "Nieprawidłowe dane wejściowe",
+    "invalidEditorSettings": "Ustawienia edytora muszą być obiektem, nic nie zostało zapisane",
+    "invalidEditorSetting": "Ustawienie edytora {field} ma zły typ, nic nie zostało zapisane",
+    "categoryOutOfBounds": "Ta kategoria leży poza Twoimi notatkami, więc nic nie zostało utworzone",
     "requiredField": "To pole jest wymagane",
     "emailInvalid": "Proszę podać prawidłowy adres e‑mail",
     "passwordTooShort": "Hasło musi mieć co najmniej 8 znaków",
@@ -1139,43 +1171,44 @@
     "networkError": "Błąd sieci",
     "timeout": "Przekroczono limit czasu żądania",
     "permissionDenied": "Zezwolenie odmówione",
-    "requiredPermissions": "Nie masz wymaganych uprawnień, aby wykonać tę czynność.",
+    "requiredPermissions": "Nie masz uprawnień, żeby to zrobić.",
     "loadError": "Błąd ładowania",
     "failedToLoadCustomEmojis": "Nie udało się załadować niestandardowych emoji",
-    "emojiDeletedSuccessfully": "Emoji usunięte pomyślnie",
+    "emojiDeletedSuccessfully": "Emoji usunięte",
     "deleteError": "Błąd usuwania",
     "failedToDeleteEmoji": "Nie udało się usunąć emoji",
     "validationError": "Błąd walidacji",
     "keywordAndEmojiRequired": "Słowo kluczowe i emoji są wymagane",
     "duplicateKeyword": "Zduplikowane słowo kluczowe",
     "keywordAlreadyExists": "Słowo kluczowe już istnieje",
-    "emojiUpdatedSuccessfully": "Emoji zaktualizowane pomyślnie",
-    "emojiCreatedSuccessfully": "Emoji utworzone pomyślnie",
+    "emojiUpdatedSuccessfully": "Emoji zaktualizowane",
+    "emojiCreatedSuccessfully": "Emoji utworzone",
     "saveError": "Błąd zapisu",
     "failedToSaveEmoji": "Nie udało się zapisać emoji",
     "failedToLoadCustomCSS": "Nie udało się załadować niestandardowego CSS",
     "couldNotLoadCustomCSS": "Nie można załadować niestandardowego CSS.",
     "couldNotLoadThemes": "Nie można załadować motywów.",
-    "customCSSSavedSuccessfully": "Niestandardowy CSS zapisany pomyślnie.",
+    "customCSSSavedSuccessfully": "Własny CSS zapisany.",
     "themeNotFound": "Motyw nie znaleziony.",
-    "themeDeletedSuccessfully": "Motyw usunięty pomyślnie.",
+    "themeDeletedSuccessfully": "Motyw usunięty.",
     "themeNameRequired": "Wymagana nazwa motywu.",
-    "themeSavedSuccessfully": "Motyw {action} pomyślnie.",
+    "themeSavedSuccessfully": "Motyw {action}.",
     "anUnknownErrorOccurred": "Wystąpił nieznany błąd.",
     "usernameRequired": "Nazwa użytkownika jest wymagana",
     "passwordRequired": "Hasło jest wymagane",
     "passwordMinLength": "Hasło musi mieć co najmniej 6 znaków",
     "passwordsDoNotMatch": "Hasła się nie zgadzają",
-    "userSavedSuccessfully": "Użytkownik {mode} pomyślnie!",
+    "userSavedSuccessfully": "Użytkownik {mode}.",
     "failedToSaveUser": "Nie udało się {mode} użytkownika",
     "anErrorOccurred": "Wystąpił błąd.",
     "deleteUserConfirmation": "Czy chcesz usunąć użytkownika „{username}”? Ta czynność nie może zostać cofnięta.",
-    "userDeletedSuccessfully": "Użytkownik usunięty pomyślnie!",
-    "failedToDeleteUser": "Nie udało się usunąć użytkownika"
+    "userDeletedSuccessfully": "Użytkownik usunięty.",
+    "failedToDeleteUser": "Nie udało się usunąć użytkownika",
+    "readOnlyFolder": "Ten folder jest na serwerze tylko do odczytu, więc zmiany nie dało się zapisać."
   },
   "pwa": {
     "installPromptTitle": "Zainstaluj aplikację",
-    "installPromptMessage": "Zainstaluj tę aplikację na swoim urządzeniu, aby uzyskać lepsze doświadczenie",
+    "installPromptMessage": "Zainstaluj Jotty na urządzeniu, żeby otwierało się jak aplikacja",
     "installButton": "Zainstaluj",
     "updateAvailable": "Dostępna aktualizacja",
     "updateMessage": "Nowa wersja jest dostępna",
@@ -1233,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Przełącz tryb Rich Editor",
     "toggleMarkdownMode": "Przełącz tryb Markdown",
+    "quickControls": "Sterowanie edytorem",
     "toggleBold": "Włącz/wyłącz pogrubienie",
     "toggleItalic": "Włącz/wyłącz kursywę",
     "toggleUnderline": "Włącz/wyłącz podkreślenie",
@@ -1322,15 +1356,15 @@
     "drawioDescription": "Edytor diagramów wizualnych",
     "excalidrawDescription": "Edytor szkicowy",
     "noLanguagesFound": "Nie znaleziono języków",
-    "ruler": "Linijka",
-    "lineNumbers": "Numery linii",
     "callout": "Ramka",
     "createCallout": "Utwórz blok ramki",
     "changeCalloutType": "Zmień typ ramki",
     "calloutInfo": "Informacja",
     "calloutWarning": "Ostrzeżenie",
     "calloutSuccess": "Sukces",
-    "calloutDanger": "Zagrożenie"
+    "calloutDanger": "Zagrożenie",
+    "ruler": "Linijka",
+    "lineNumbers": "Numery linii"
   },
   "sharing": {
     "share": "Udostępnij",
@@ -1406,16 +1440,16 @@
     "viewNote": "Wyświetl notatkę",
     "editNote": "Edytuj notatkę",
     "privateKeyWarning": "OSTRZEŻENIE: Twoja prywatna klucz umożliwia odszyfrowanie wszystkich zaszyfrowanych notatek. Wyeksportuj tylko wtedy, gdy rozumiesz konsekwencje bezpieczeństwa. Kontynuować?",
-    "publicKeyExported": "Publiczny klucz eksportowany pomyślnie",
-    "privateKeyExported": "Prywatny klucz eksportowany pomyślnie",
+    "publicKeyExported": "Klucz publiczny wyeksportowany",
+    "privateKeyExported": "Klucz prywatny wyeksportowany",
     "failedToExportKey": "Nie udało się wyeksportować klucza",
     "unexpectedError": "Wystąpił nieoczekiwany błąd",
-    "keysDeleted": "Klucze usunięte pomyślnie",
+    "keysDeleted": "Klucze usunięte",
     "failedToDeleteKeys": "Nie udało się usunąć kluczy",
     "autoDecryptUpdated": "Ustawienie automatycznego odszyfrowania zaktualizowane",
     "failedToUpdateSetting": "Nie udało się zaktualizować ustawienia",
-    "enterValidPath": "Proszę podać prawidłową ścieżkę",
-    "customPathSet": "Niestandardowa ścieżka kluczy została pomyślnie ustawiona",
+    "enterValidPath": "Podaj prawidłową ścieżkę",
+    "customPathSet": "Własna ścieżka kluczy ustawiona",
     "failedToSetCustomPath": "Nie udało się ustawić niestandardowej ścieżki",
     "thisNoteIsEncrypted": "Ta notatka jest zaszyfrowana",
     "noteProtectedWith": "Ta notatka chroniona kluczem {type}.",
@@ -1426,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Wybierz metodę szyfrowania",
     "encryptionMethodsTitle": "Metody szyfrowania",
-    "xchachaDescription": "XChaCha20-Poly1305: nowoczesne, szybkie i oparte na hasłach",
-    "pgpDescription": "PGP: tradycyjne kryptografii kluczy publicznych z zarządzaniem parą kluczy",
+    "xchachaDescription": "XChaCha20-Poly1305: szyfrowanie hasłem",
+    "pgpDescription": "PGP: szyfrowanie kluczem publicznym z parą kluczy, którą zarządzasz",
     "encryptionKeys": "Klucze szyfrowania",
     "keysConfigured": "Klucze skonfigurowane",
     "algorithm": "Algorytm: ",
@@ -1441,9 +1475,9 @@
     "keysDisabledInDemo": "Przechowywane klucze szyfrowania są wyłączone w trybie demo.",
     "encryptionSettings": "Ustawienia szyfrowania",
     "promptForPassphrase": "Zapytaj o hasło przy otwieraniu zaszyfrowanych notatek",
-    "promptForPassphraseDescription": "Jeśli włączone, zostaniesz poproszony o hasło przy otwieraniu zaszyfrowanej notatki. Notatka pozostanie zaszyfrowana na serwerze, ale możesz zobaczyć odszyfrowaną treść w bieżącej karcie.",
+    "promptForPassphraseDescription": "Pyta o hasło, gdy otwierasz zaszyfrowaną notatkę. Notatka zostaje zaszyfrowana na serwerze, a odszyfrowaną treść widzisz tylko w tej karcie.",
     "customKeyPath": "Niestandardowa ścieżka klucza (instalacje lokalne)",
-    "customKeyPathDescription": "Podaj absolutną ścieżkę do przechowywania kluczy szyfrujących. Jest potrzebna tylko przy instalacjach lokalnych. Użytkownicy Dockera powinni zamapować domyślną ścieżkę w docker-compose.yml.",
+    "customKeyPathDescription": "Bezwzględna ścieżka w systemie plików dla Twoich kluczy szyfrujących. Potrzebna tylko przy instalacjach lokalnych. Użytkownicy Dockera powinni zamiast tego zamapować domyślną ścieżkę w docker-compose.yml.",
     "customPath": "Niestandardowa ścieżka",
     "customPathPlaceholder": "/home/user/my-keys",
     "customPathHelp": "Musi być absolutną ścieżką (np. /home/user/my-keys lub C:\\Users\\user\\my-keys)",
@@ -1462,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "Treść notatki zostanie zaszyfrowana przed zapisaniem",
     "passphraseRequired": "Hasło jest wymagane",
     "incorrectPassphrase": "Niepoprawne hasło",
-    "noteEncryptedSuccessfully": "Notatka pomyślnie zaszyfrowana",
+    "noteEncryptedSuccessfully": "Notatka zaszyfrowana",
     "failedToEncryptNote": "Nie udało się zaszyfrować notatki",
-    "noteDecryptedSuccessfully": "Notatka pomyślnie odszyfrowana",
+    "noteDecryptedSuccessfully": "Notatka odszyfrowana",
     "failedToDecryptNote": "Nie udało się odszyfrować notatki",
     "passphrase": "Hasło",
     "enterYourPassphrase": "Wprowadź hasło",
@@ -1493,7 +1527,7 @@
     "noStoredKeysFound": "Nie znaleziono przechowywanych kluczy",
     "noEncryptionKeysConfigured": "Brak skonfigurowanych kluczy szyfrowania",
     "pastePublicKeyBelow": "Wklej publiczny klucz poniżej, aby zaszyfrować treść notatki",
-    "generateOrImportKeysInProfile": "Możesz wygenerować lub zaimportować konkretne klucze dla Jotty w Profil → Szyfrowanie",
+    "generateOrImportKeysInProfile": "Możesz wygenerować lub zaimportować klucze dla Jotty w Profil > Szyfrowanie",
     "useCustomKey": "Użyj niestandardowego {keyType} klucza",
     "signWithPrivateKey": "Podpisz prywatnym kluczem",
     "proveAuthenticityOfNote": "Udowodnij autentyczność tej notatki",
@@ -1513,7 +1547,7 @@
     "yourEmail": "twoj@email.com",
     "generating": "Generowanie…",
     "generateKeys": "Generuj klucze",
-    "keysGeneratedSuccessfully": "Klucze wygenerowane pomyślnie",
+    "keysGeneratedSuccessfully": "Klucze wygenerowane",
     "importPGPKeys": "Importuj klucze PGP",
     "publicKeyLabel": "Publiczny klucz",
     "privateKeyLabel": "Prywatny klucz",
@@ -1522,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Zapamiętaj hasło! Nie można go odzyskać.",
     "withoutPassphraseCannotDecrypt": "Bez hasła nie możesz odszyfrować notatek.",
     "backupPrivateKeySafely": "Zrób kopię prywatnego klucza w bezpiecznym miejscu.",
-    "pgpKeyPairGeneratedSuccessfully": "Pomyślnie wygenerowano parę kluczy PGP",
+    "pgpKeyPairGeneratedSuccessfully": "Para kluczy PGP wygenerowana",
     "failedToGenerateKeys": "Nie udało się wygenerować kluczy",
     "fingerprint": "Odcisk palca",
     "keysSavedSecurely": "Twoje klucze zostały bezpiecznie zapisane.",
@@ -1536,13 +1570,13 @@
     "bothKeysRequired": "Wymagane są oba klucze publiczny i prywatny",
     "invalidPublicKeyFormat": "Nieprawidłowy format klucza publicznego. Musi być ASCII‑armoured PGP.",
     "invalidPrivateKeyFormat": "Nieprawidłowy format klucza prywatnego. Musi być ASCII‑armoured PGP.",
-    "keysImportedSuccessfully": "Klucze pomyślnie zaimportowane",
+    "keysImportedSuccessfully": "Klucze zaimportowane",
     "failedToImportKeys": "Nie udało się importować kluczy",
     "created": "Szyfrowanie utworzone",
     "notePlaceholder": "Jestem symbolem zastępczym, ponieważ nie można zaszyfrować pustej notatki."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Te opcje mają zastosowanie tylko w bieżącej sesji przeglądarki. Aby zapisać ustawienia na stałe, sprawdź swoje",
+    "sessionOnlyPrefix": "Te opcje działają tylko w tej sesji przeglądarki. Stałe ustawienia znajdziesz w",
     "accountSettings": "Preferencje użytkownika",
     "autosaveNotes": "Automatyczne zapisywanie notatek",
     "showNotePreview": "Pokaż podgląd notatki na kartach",
@@ -1571,20 +1605,45 @@
     "migrationSuccessful": "Migracja pomyślna",
     "returnToApp": "Wróć do aplikacji",
     "adminAccessRequired": "Wymagane uprawnienia administratora",
-    "adminAccessDescription": "Ta migracja wymaga uprawnień administratora. Skontaktuj się z administratorem, aby wykonać migrację systemu.",
+    "adminAccessDescription": "Ta migracja wymaga administratora. Poproś go o jej uruchomienie.",
     "whatsHappening": "Co się dzieje?",
-    "sharingDataMigrationDescription": "System musi przemieścić Twoje dane udostępniania. To jednorazowy proces wymagający uprawnień administratora.",
+    "sharingDataMigrationDescription": "Jotty musi zmigrować Twoje dane udostępniania. Dzieje się to tylko raz i wymaga administratora.",
     "whatsChanging": "Co się zmienia?",
     "automaticBackupIncluded": "Włączone automatyczne tworzenie kopii zapasowej",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter to standard branżowy",
-    "noMigrationNeeded": "Nie wymagana migracja – Twój system jest już aktualny.",
-    "importantBackupData": "WAŻNE: Zrób kopię zapasową danych"
+    "noMigrationNeeded": "Nie ma czego migrować, Twoje dane są już aktualne.",
+    "importantBackupData": "WAŻNE: Zrób kopię zapasową danych",
+    "sharingNowWithData": "Dane udostępniania są teraz zapisane razem z Twoimi notatkami i folderami.",
+    "sharingMovesDescription": "Udostępnianie przenosi się z centralnego pliku do Twoich danych. Foldery można teraz udostępniać, a udostępnione foldery pojawiają się w Twoim pasku bocznym zamiast w osobnej sekcji.",
+    "whatsHappeningBody": "Każde udostępnienie z <code>.sharing.json</code> trafia do frontmattera elementu, którego dotyczy, a każdy folder dostaje plik <code>.category-info.json</code> z jego tożsamością, udostępnianiem i kolejnością. Stare pliki są usuwane, gdy dane zostaną przeniesione.",
+    "migrationChanges": "Zmiany w migracji",
+    "sharingTravelsTitle": "Udostępnianie podróżuje z plikiem",
+    "sharingTravelsBody": "Każdy udostępniony element zapisuje we własnym frontmatterze, komu jest udostępniony, więc przeniesienie lub zmiana nazwy nigdy nie psuje udostępnienia.",
+    "folderSharingTitle": "Udostępnianie folderów",
+    "folderSharingBody": "Udostępnij folder, a wszystko w nim, teraz i w przyszłości, też będzie udostępnione. Odbiorcy widzą go jako zwykły folder we własnym pasku bocznym.",
+    "oneFilePerFolderTitle": "Jeden plik na folder",
+    "oneFilePerFolderBody": "<code>.order.json</code> zostaje wchłonięty przez <code>.category-info.json</code>, a kolejność jest zapisywana według uuid zamiast nazwy pliku.",
+    "permissionsUnchangedTitle": "Uprawnienia się nie zmieniają",
+    "permissionsUnchangedBody": "Odczyt, edycja i usuwanie przechodzą dokładnie tak, jak są dziś, dla każdego użytkownika i każdego elementu.",
+    "backupWarningBody": "Ta migracja przepisuje frontmatter w Twoich notatkach i listach oraz usuwa stare pliki <code>.sharing.json</code> i <code>.order.json</code>. Zrób kopię zapasową folderu <code>data</code>, zanim przejdziesz dalej.",
+    "backupConfirmLabel": "Mam kopię zapasową folderu data i rozumiem, jak działa migracja.",
+    "backupConfirmHint": "Potwierdź, że masz kopię zapasową, zanim przejdziesz dalej.",
+    "sharingDataMigrated": "Twoje dane udostępniania i kolejności zostały zmigrowane.",
+    "whatWasChanged": "Co się zmieniło:",
+    "migrationPartial": "Migracja zakończona z pozostałościami",
+    "leftoversTitle": "Część starych plików została zachowana",
+    "leftoversBody": "Migracja nie przeniosła wszystkiego, więc poniższe stare pliki zostały na dysku nietknięte. Nic nie zostało usunięte. Możesz naprawić przyczynę i uruchomić migrację ponownie albo przejść teraz do aplikacji i zająć się tym później.",
+    "overrideConfirmLabel": "Kontynuuj mimo to i nie pokazuj więcej tej strony.",
+    "overrideConfirmHint": "Pozostałe pliki zostaną na dysku, ale aplikacja uzna Twoje dane za zmigrowane. Udostępnianie i kolejność wymienione powyżej nie zostaną zastosowane, dopóki nie uruchomisz migracji ponownie, co możesz zrobić w dowolnej chwili pod /migration?force=1.",
+    "continueAnyway": "Kontynuuj mimo to",
+    "overriding": "Kontynuowanie...",
+    "overrideFailed": "Nie udało się pominąć migracji"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Kategoria pomyślnie zmieniona",
+    "categoryRenamedSuccessfully": "Kategoria przemianowana",
     "failedToRenameCategory": "Nie udało się zmienić nazwy kategorii",
     "categoryRenamedSuccessfullyMessage": "Kategoria {categoryName} została zmieniona na {newName}",
-    "failedToRenameCategoryMessage": "Wystąpił błąd podczas zmiany nazwy kategorii."
+    "failedToRenameCategoryMessage": "Coś poszło nie tak podczas zmiany nazwy kategorii."
   },
   "auditLogs": {
     "title": "Dzienniki audytu",
@@ -1601,17 +1660,17 @@
     "exportJSON": "Eksportuj JSON",
     "exportCSV": "Eksportuj CSV",
     "cleanupOldLogs": "Czyszczenie starych dzienników",
-    "confirmCleanup": "Czy na pewno chcesz usunąć dzienniki starsze niż {days} dni? To wpłynie na WSZYSTKICH użytkowników i nie może być cofnięte.",
+    "confirmCleanup": "Usunąć dzienniki starsze niż {days} dni? To dotyczy WSZYSTKICH użytkowników i nie da się tego cofnąć.",
     "confirmCleanupUnlimited": "Nie ma skonfigurowanego automatycznego czyszczenia (nieograniczona retencja). Możesz nadal ręcznie usuwać stare dzienniki, jeśli potrzebujesz.",
     "deleteAllLogsModalTitle": "Usuń wszystkie dzienniki audytu",
     "deleteAllLogsWarning": "To usunie WSZYSTKIE dzienniki, a nie tylko stare.",
     "deleteAllLogsWarningDescription": "Cała historia dzienników audytu zostanie wyczyszczona z systemu.",
     "deletingAllLogs": "Usuwanie wszystkich dzienników…",
     "deleteAllLogsButton": "Usuń wszystkie dzienniki",
-    "cleanupSuccess": "Pomyślnie usunięto {count} starych plików dziennika",
+    "cleanupSuccess": "Usunięto {count} starych plików dziennika",
     "cleanupError": "Nie udało się wyczyścić starych dzienników",
-    "userDescription": "Zobacz swoją aktywność i działania w systemie",
-    "adminDescription": "Zobacz i zarządzaj wszystkimi aktywnościami użytkowników w całym systemie",
+    "userDescription": "Wszystko, co zrobiłeś w Jotty",
+    "adminDescription": "Co każdy użytkownik zrobił w tej instancji",
     "level": "Poziom",
     "allLevels": "Wszystkie poziomy",
     "allCategories": "Wszystkie kategorie",
@@ -1634,13 +1693,9 @@
     "login": "Logowanie",
     "logout": "Wylogowywanie",
     "register": "Rejestracja",
-    "sessionTerminated": "Sesja zakończona",
     "sessionterminated": "Sesja zakończona",
-    "userCreated": "Utworzono użytkownika",
     "usercreated": "Użytkownik utworzony",
-    "userUpdated": "Zaktualizowano użytkownika",
     "userupdated": "Użytkownik zaktualizowany",
-    "userDeleted": "Usunięto użytkownika",
     "userdeleted": "Użytkownik usunięty",
     "profileupdated": "Profil zaktualizowany",
     "checklistcreated": "Lista utworzona",
@@ -1660,6 +1715,7 @@
     "sharepermissionsupdated": "Zaktualizowano uprawnienia udostępniania",
     "settingsupdated": "Ustawienia zaktualizowane",
     "appsettingsupdated": "Zaktualizowano ustawienia aplikacji",
+    "usersettingsupdated": "Zaktualizowano ustawienia użytkownika",
     "themechanged": "Motyw zmieniony",
     "customthemesaved": "Zapisano niestandardowy motyw",
     "customemojisaved": "Zapisano niestandardowe emoji",
@@ -1678,9 +1734,9 @@
     "topActions": "Najczęstsze działania",
     "mostActiveUsers": "Najbardziej aktywni użytkownicy",
     "oldLogsFound": "Znaleziono {count} plików dziennika starszych niż {days} dni.",
-    "oldLogsFoundDescription": "Czy chcesz je usunąć? Ta akcja nie może być cofnięta.",
+    "oldLogsFoundDescription": "Usunąć je? Tego nie da się cofnąć.",
     "cleanUpNow": "Wyczyść teraz",
-    "cleanupSuccessMessage": "Pomyślnie usunięto {count} starych plików dziennika.",
+    "cleanupSuccessMessage": "Usunięto {count} starych plików dziennika.",
     "security": "Bezpieczeństwo",
     "mfasecretgenerated": "Utworzono sekret MFA",
     "mfaenabled": "MFA włączone",
@@ -1690,13 +1746,13 @@
     "mfaverificationfailed": "Weryfikacja MFA nie powiodła się",
     "mfabackupcodeused": "Użyto kodu kopii zapasowej MFA",
     "mfabackupcodefailed": "Nie udało się użyć kodu kopii zapasowej MFA",
-    "mfabackupcodesregenerated": "Wygenerowano kody kopii zapasowych MFA",
-    "usersettingsupdated": "Zaktualizowano ustawienia użytkownika"
+    "mfabackupcodesregenerated": "Wygenerowano kody kopii zapasowych MFA"
   },
   "help": {
     "howTo": "Jak to zrobić",
     "shortcuts": "Skróty klawiszowe",
     "markdownGuide": "Przewodnik po Markdownie",
+    "brain": "Linki i Mózg",
     "customisations": "Dostosowania",
     "docker": "Docker",
     "envVariables": "Zmienne środowiskowe",
@@ -1704,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "Szyfrowanie",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Tłumaczenia",
     "unraid": "Unraid",
     "patches": "Łatki"
@@ -1715,33 +1772,9 @@
     "seenCount": "Widziałeś {count} {count, plural, one {haiku} other {haiku}}",
     "imNoPoet": "Nie jestem poetą, podobnie jak Jotty. To tylko przypadkowa sekwencja słów."
   },
-  "history": {
-    "fetchError": "Nie udało się załadować historii",
-    "restoreError": "Nie udało się przywrócić wersji",
-    "manualSavesOnly": "Historia jest tworzona wyłącznie podczas zapisywania ręcznego, a nie automatycznego.",
-    "noHistory": "Brak dostępnej historii",
-    "noHistoryDescription": "Zapisz notatkę, aby utworzyć punkt w historii.",
-    "restore": "Przywróć",
-    "loadMore": "Załaduj więcej",
-    "viewContent": "Wyświetl zawartość",
-    "viewDiff": "Zobacz zmiany",
-    "noteHistory": "Historia notatki",
-    "restoreVersion": "Przywróć wersję",
-    "restoreConfirm": "Przywrócić tę wersję? \nBieżąca treść zostanie zastąpiona.",
-    "featureDisabled": "Historia wyłączona",
-    "disabledAdmin": "Historia notatek jest obecnie wyłączona. Możesz ją włączyć w Ustawieniach administratora > Edytor.",
-    "disabledUser": "Historia notatek jest obecnie wyłączona. Skontaktuj się z administratorem, aby włączyć tę funkcję.",
-    "goToSettings": "Idź do ustawień",
-    "actionCreate": "Utworzono",
-    "actionUpdate": "Zaktualizowano",
-    "actionRename": "Zmieniono nazwę",
-    "actionMove": "Przeniesiono",
-    "actionDelete": "Usunięto",
-    "actionInit": "Zainicjowano",
-    "actionUnknown": "Zmieniono"
-  },
   "notifications": {
     "title": "Powiadomienia",
+    "unread": "nieprzeczyt.",
     "markAllRead": "Zaznacz wszystkie jako przeczytane",
     "clearAll": "Wyczyść wszystko",
     "empty": "Brak powiadomień",
@@ -1749,12 +1782,99 @@
     "assignmentMessage": "„{task}” w „{board}”",
     "reminderTitle": "Zadanie przeterminowane",
     "reminderMessage": "Przypomnienie o zadaniu „{task}” w „{board}” minęło",
-    "unread": "nieprzeczyt.",
     "sharingTitle": "{user} udostępnił(a) ci {type}",
     "sharingMessage": "Otwórz, aby zobaczyć udostępniony {type}",
     "sharingFolderTitle": "{user} udostępnił(a) ci folder {type}",
     "sharingFolderMessage": "Otwórz, aby zobaczyć „{folder}”",
     "mentionTitle": "{user} wspomniał o Tobie w komentarzu",
     "mentionMessage": "„{board}”"
+  },
+  "relations": {
+    "indexing": "Indeksowanie powiązań...",
+    "unreachable": "niedostępne",
+    "createFromWikilink": "Utwórz notatkę o nazwie \"{title}\"",
+    "mentionedIn": "Wspomniane w",
+    "mentionedInHint": "Te notatki używają tego tytułu jako zwykłego tekstu. Podlinkuj jedną, żeby je połączyć.",
+    "linkMention": "Podlinkuj",
+    "linked": "Podlinkowano wzmiankę w {title}",
+    "linkFailed": "Nie udało się podlinkować tej wzmianki",
+    "kind": {
+      "mention": "Link",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "Mózg",
+    "openBrain": "Otwórz w mózgu",
+    "search": "Znajdź coś w swoim mózgu...",
+    "dimension": "Widok",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Wokół tego elementu",
+    "global": "Wszystko",
+    "depth": "Głębokość {depth}",
+    "colourBy": "Koloruj według",
+    "colourModes": {
+      "type": "Typ",
+      "category": "Kategoria"
+    },
+    "filters": {
+      "notes": "Notatki",
+      "checklists": "Listy",
+      "tags": "Tagi",
+      "ghosts": "Jeszcze nienapisane",
+      "suggestions": "Sugestie",
+      "orphans": "Samotniki"
+    },
+    "kind": {
+      "note": "Notatka",
+      "checklist": "Lista",
+      "ghost": "Jeszcze nienapisane",
+      "tag": "Tag"
+    },
+    "edges": {
+      "mention": "Link",
+      "wiki": "Wikilink",
+      "suggested": "Sugerowane",
+      "tag": "Tag"
+    },
+    "linksTo": "Linkuje do",
+    "linkedFrom": "Linkowane z",
+    "suggested": "Może być powiązane",
+    "promote": "Podlinkuj do {title}",
+    "lonely": "Nic tu jeszcze nie jest połączone. Wspomnij o tym przez @ lub [[ w innej notatce.",
+    "open": "Otwórz",
+    "createGhost": "Napisz tę notatkę",
+    "openTag": "Pokaż wszystko z tym tagiem",
+    "createFailed": "Nie udało się utworzyć tej notatki",
+    "connectFailed": "Nie udało się połączyć tych dwóch",
+    "connected": "Połączono {source} z {target}",
+    "empty": "W Twoim mózgu panuje cisza. Połącz notatki i listy przez @ lub [[, a pojawią się tutaj.",
+    "viewingOwner": "Przeglądasz mózg użytkownika {owner}",
+    "summary": "Elementy: {items}, linki: {links}, widoczne: {shown}"
+  },
+  "apiExplorer": {
+    "title": "Eksplorator API",
+    "intro": "Każdy endpoint, który udostępnia ta instancja (v{version}), wygenerowany z kodu, który go obsługuje. Wybierz jeden, wypełnij i wyślij.",
+    "realData": "Żądania działają jako właściciel klucza API na prawdziwych danych. DELETE tutaj naprawdę usuwa.",
+    "apiKey": "Klucz API",
+    "apiKeyHint": "Trzymany tylko na tej stronie i zapominany, gdy ją opuścisz.",
+    "useMyKey": "Użyj mojego klucza",
+    "noKeyYet": "Nie masz jeszcze klucza API. Wygeneruj go w ustawieniach profilu.",
+    "filter": "Filtr",
+    "filterPlaceholder": "Ścieżka, nazwa lub metoda",
+    "noMatches": "Nic nie pasuje do tego filtra.",
+    "body": "Treść żądania (JSON)",
+    "showSchema": "Pokaż schemat",
+    "hideSchema": "Ukryj schemat",
+    "send": "Wyślij",
+    "sending": "Wysyłanie...",
+    "keyRequired": "Najpierw dodaj klucz API.",
+    "noKeyNeeded": "klucz API niepotrzebny",
+    "deprecated": "przestarzałe",
+    "requestFailed": "Żądanie nie dotarło do serwera. Sprawdź połączenie.",
+    "responseMeta": "{status} w {ms} ms"
   }
 }
diff --git a/app/_translations/pt.json b/app/_translations/pt.json
index 26dbf2964..7449cc601 100644
--- a/app/_translations/pt.json
+++ b/app/_translations/pt.json
@@ -101,7 +101,7 @@
     "deleteFile": "Eliminar ficheiro",
     "fileTooLarge": "O ficheiro é demasiado grande. O tamanho máximo é {maxSizeMB}MB. O seu ficheiro tem {fileSizeMB}MB.",
     "uploadFailed": "Falha ao carregar",
-    "uploadFailedRetry": "Falha ao carregar. Por favor, tente novamente.",
+    "uploadFailedRetry": "Falha ao carregar. Tente novamente.",
     "failedToDeleteFile": "Falha ao eliminar o ficheiro",
     "previousMonth": "Mês anterior",
     "nextMonth": "Mês seguinte",
@@ -134,7 +134,7 @@
     "parentCategory": "Categoria principal (opcional)",
     "noParent": "Sem principal (nível raiz)",
     "categoryNamePlaceholder": "Introduzir nome da categoria...",
-    "notAllowedName": "{name} não é permitido. Por favor, escolha um nome diferente.",
+    "notAllowedName": "{name} não é permitido. Escolha um nome diferente.",
     "createCategory": "Criar categoria",
     "selectCategory": "Selecionar categoria...",
     "categoryWillBeCreatedIn": "A nova categoria será criada em:",
@@ -174,7 +174,7 @@
     "noResults": "Sem resultados",
     "by": "por {owner}",
     "unsavedChanges": "Alterações não guardadas",
-    "unsavedChangesDetected": "⚠️ Alterações não guardadas detetadas",
+    "unsavedChangesDetected": "Alterações não guardadas",
     "unsavedChangesMessage": "Tem alterações não guardadas em {noteTitle}. Se sair agora, as suas alterações serão perdidas.",
     "whatToDoWithUnsavedChanges": "O que pretende fazer com as alterações não guardadas?",
     "discard": "Descartar",
@@ -251,32 +251,6 @@
     "thisEntry": "esta entrada",
     "preview": "Pré-visualização"
   },
-  "comments": {
-    "title": "Comentários",
-    "titleWithCount": "{count, plural, one {# Comentário} other {# Comentários}}",
-    "noComments": "Ainda não há comentários. Inicie a conversa!",
-    "addComment": "Adicionar um comentário...",
-    "replyPlaceholder": "Escreva uma resposta...",
-    "post": "Publicar",
-    "reply": "Responder",
-    "edit": "Editar",
-    "delete": "Excluir",
-    "save": "Salvar",
-    "cancel": "Cancelar",
-    "edited": "editado",
-    "deleteConfirmTitle": "Excluir comentário?",
-    "deleteConfirmMessage": "Isso excluirá o comentário e quaisquer respostas. Esta ação não pode ser desfeita.",
-    "commentDeleted": "Comentário excluído",
-    "commentAdded": "Comentário adicionado",
-    "commentUpdated": "Comentário atualizado",
-    "failedToAdd": "Falha ao adicionar comentário",
-    "failedToEdit": "Falha ao editar comentário",
-    "failedToDelete": "Falha ao excluir comentário",
-    "failedToLoad": "Falha ao carregar comentários",
-    "readOnly": "Você precisa de acesso de edição para comentar neste cartão.",
-    "replyTo": "Responder a {author}",
-    "noUsersFound": "Nenhum usuário encontrado"
-  },
   "history": {
     "noteHistory": "Histórico da nota",
     "restore": "Restaurar",
@@ -286,10 +260,10 @@
     "noHistoryDescription": "Guarde a sua nota para criar um ponto no histórico.",
     "loadMore": "Carregar mais",
     "featureDisabled": "Histórico desativado",
-    "disabledAdmin": "O histórico de notas está atualmente desativado. Pode ativá-lo nas Definições de administrador > Editor.",
-    "disabledUser": "O histórico de notas está atualmente desativado. Contacte o seu administrador para ativar esta funcionalidade.",
+    "disabledAdmin": "O histórico de notas está desligado. Pode ligá-lo em Definições de administrador > Editor.",
+    "disabledUser": "O histórico de notas está desligado. Peça ao seu administrador para o ligar.",
     "goToSettings": "Ir para as definições",
-    "manualSavesOnly": "O histórico é criado apenas em guardações manuais, não em guardação automática.",
+    "manualSavesOnly": "Só as gravações manuais criam histórico. A gravação automática não.",
     "fetchError": "Falha ao carregar o histórico",
     "restoreError": "Falha ao restaurar a versão",
     "viewContent": "Ver conteúdo",
@@ -321,7 +295,7 @@
     "sessionExpired": "A sua sessão expirou",
     "setupComplete": "Configuração concluída",
     "createAccount": "Criar a sua conta",
-    "errorOccurred": "Ocorreu um erro. Por favor, tente novamente.",
+    "errorOccurred": "Algo correu mal. Tente novamente.",
     "enterUsername": "Introduzir o seu nome de utilizador",
     "enterPassword": "Introduzir a sua palavra-passe",
     "chooseUsername": "Escolher um nome de utilizador",
@@ -334,8 +308,8 @@
     "version": "Versão {version}",
     "createUser": "Criar utilizador",
     "attemptsRemaining": "Aviso: {count, plural, one {# tentativa restante} other {# tentativas restantes}} antes do bloqueio da conta",
-    "accountLocked": "Demasiadas tentativas falhadas. Por favor, tente novamente em {seconds} {seconds, plural, one {segundo} other {segundos}}",
-    "notAuthorized": "Não está autorizado a aceder a esta aplicação. Por favor, contacte o seu administrador.",
+    "accountLocked": "Demasiadas tentativas falhadas. Tente novamente em {seconds} {seconds, plural, one {segundo} other {segundos}}",
+    "notAuthorized": "Não tem acesso a esta aplicação. Fale com o seu administrador.",
     "rememberMe": "Lembrar-me"
   },
   "mfa": {
@@ -360,9 +334,9 @@
     "invalidCode": "Código de autenticação inválido",
     "invalidRecoveryCode": "Código de recuperação inválido",
     "mfaRequired": "A autenticação de dois fatores é obrigatória",
-    "mfaEnabledSuccess": "Autenticação de dois fatores ativada com sucesso",
+    "mfaEnabledSuccess": "Autenticação de dois fatores ativada",
     "mfaDisabledSuccess": "Autenticação de dois fatores desativada",
-    "tooManyAttempts": "Demasiadas tentativas falhadas. Por favor, tente mais tarde.",
+    "tooManyAttempts": "Demasiadas tentativas falhadas. Tente mais tarde.",
     "disableTitle": "Desativar autenticação de dois fatores",
     "disableDescription": "Introduza o seu código 2FA para confirmar a desativação da autenticação de dois fatores",
     "disableWarning": "Isto tornará a sua conta menos segura. Tem a certeza?",
@@ -382,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Isto invalidará o seu código de recuperação atual",
     "regenerateRecoveryCodeDescription": "Introduza o seu código 2FA para gerar um novo código de recuperação. O seu código antigo deixará de funcionar.",
     "recoveryCodeRegenerated": "Novo código de recuperação gerado",
-    "recoveryCodeRegeneratedInfo": "O seu novo código de recuperação foi gerado. Guarde-o num local seguro - esta é a única vez que o verá.",
-    "recoveryCodeRegeneratedSuccess": "Código de recuperação regenerado com sucesso",
+    "recoveryCodeRegeneratedInfo": "O seu novo código de recuperação está pronto. Guarde-o num local seguro, esta é a única vez que o verá.",
+    "recoveryCodeRegeneratedSuccess": "Código de recuperação regenerado",
     "recoveryCodeProfileDescription": "Use este código para recuperar a conta caso perca o acesso à sua aplicação de autenticação",
     "disableMfaForUser": "Desativar 2FA para este utilizador",
     "recoveryCodeRequired": "O código de recuperação é obrigatório",
@@ -397,7 +371,7 @@
     "recent": "Recentes",
     "browseAndManage": "Navegar e gerir todas as suas notas",
     "noNotesYet": "Ainda sem notas",
-    "createFirstNote": "Crie a sua primeira nota para começar a construir a sua base de conhecimentos.",
+    "createFirstNote": "Ainda não há nada aqui. Crie a sua primeira nota.",
     "createNewNote": "Criar nova nota",
     "noNotesFound": "Nenhuma nota encontrada",
     "tryAdjustingFilters": "Tente ajustar os filtros ou crie uma nova nota.",
@@ -428,6 +402,7 @@
     "enterNoteTitle": "Introduzir título da nota...",
     "byType": "Por tipo",
     "publiclySharedNote": "Partilhado publicamente",
+    "sharedPubliclyBy": "Esta nota é partilhada publicamente por {owner}",
     "copyRawContent": "Copiar markdown",
     "quickSave": "Guardar rapidamente",
     "noteNotFound": "Nota não encontrada",
@@ -441,9 +416,12 @@
     "readingTime": "{count, plural, one {# minuto de leitura} other {# minutos de leitura}}",
     "tags": "Etiquetas",
     "noTagsFound": "Nenhuma etiqueta encontrada",
-    "searchTags": "Pesquisar etiquetas..."
+    "searchTags": "Pesquisar etiquetas...",
+    "createNoteFailed": "Não foi possível criar a nota",
+    "createCategoryFailed": "Não foi possível criar a categoria, a nota não foi criada"
   },
   "checklists": {
+    "sharedPubliclyBy": "Esta lista de verificação é partilhada publicamente por {owner}",
     "title": "Listas de verificação",
     "allChecklists": "Todas as listas de verificação",
     "completed": "Concluídas",
@@ -457,7 +435,7 @@
     "progress": "Progresso",
     "totalItems": "Total de itens",
     "noChecklistsYet": "Ainda sem listas de verificação",
-    "createFirstChecklist": "Crie a sua primeira lista de verificação para começar a organizar as suas tarefas.",
+    "createFirstChecklist": "Ainda não há nada aqui. Crie a sua primeira lista de verificação.",
     "newChecklist": "Nova lista de verificação",
     "noChecklistsFound": "Nenhuma lista de verificação encontrada",
     "tryAdjustingFiltersChecklist": "Tente ajustar os filtros ou crie uma nova lista de verificação.",
@@ -526,19 +504,19 @@
     "clearAllCompletedConfirmMessage": "Tem a certeza de que pretende eliminar todos os {count} itens concluídos e os seus filhos? Esta ação não pode ser desfeita.",
     "clearAllIncompleteConfirmMessage": "Tem a certeza de que pretende eliminar todos os {count} itens incompletos e os seus filhos? Esta ação não pode ser desfeita.",
     "convertChecklistType": "Converter tipo de lista de verificação",
-    "convertTypeConfirmation": "Está prestes a converter de {currentType} para {newType}. Tem a certeza de que pretende continuar?",
-    "dataLossWarning": "⚠️ Aviso de perda de dados",
+    "convertTypeConfirmation": "Converter de {currentType} para {newType}?",
+    "dataLossWarning": "Aviso de perda de dados",
     "dataLossWarningItems": "Os seguintes dados serão perdidos:",
     "allTaskStatusesReset": "Todos os estados das tarefas serão repostos",
     "timeTrackingDataLost": "Os dados de controlo de tempo serão perdidos",
     "estimatedTimesRemoved": "Os tempos estimados serão removidos",
     "targetDatesCleared": "As datas alvo serão eliminadas",
-    "enhancedFeatures": "✨ Funcionalidades melhoradas",
+    "enhancedFeatures": "O que ganha",
     "enhancedFeaturesYouWillGain": "Vai ganhar:",
     "kanbanBoardWithDragDrop": "Quadro Kanban com arrastar e largar",
     "taskStatusTracking": "Controlo de estado de tarefas (A fazer, Em progresso, etc.)",
     "timeTrackingWithTimer": "Controlo de tempo com temporizador integrado",
-    "actionCannotBeUndone": "Esta ação não pode ser desfeita. Tem a certeza de que pretende converter?",
+    "actionCannotBeUndone": "Isto não pode ser desfeito. Converter mesmo assim?",
     "convertAndLoseData": "Converter e perder dados",
     "convert": "Converter",
     "convertToSimpleChecklist": "Converter para lista de verificação simples",
@@ -552,10 +530,36 @@
     "noItemsYet": "Ainda sem itens",
     "addFirstItem": "Adicione o seu primeiro item para começar!",
     "noTasks": "Sem tarefas",
-    "noSubtasksYet": "Ainda sem subtarefas. Adicione uma abaixo para começar.",
+    "noSubtasksYet": "Ainda sem subtarefas. Adicione uma abaixo.",
     "addTime": "Adicionar tempo",
     "enterTimeInMinutes": "Introduzir o seu tempo em minutos"
   },
+  "comments": {
+    "title": "Comentários",
+    "titleWithCount": "{count, plural, one {# Comentário} other {# Comentários}}",
+    "noComments": "Ainda não há comentários. Inicie a conversa!",
+    "addComment": "Adicionar um comentário...",
+    "replyPlaceholder": "Escreva uma resposta...",
+    "post": "Publicar",
+    "reply": "Responder",
+    "edit": "Editar",
+    "delete": "Excluir",
+    "save": "Salvar",
+    "cancel": "Cancelar",
+    "edited": "editado",
+    "deleteConfirmTitle": "Excluir comentário?",
+    "deleteConfirmMessage": "Isso excluirá o comentário e quaisquer respostas. Esta ação não pode ser desfeita.",
+    "commentDeleted": "Comentário excluído",
+    "commentAdded": "Comentário adicionado",
+    "commentUpdated": "Comentário atualizado",
+    "failedToAdd": "Falha ao adicionar comentário",
+    "failedToEdit": "Falha ao editar comentário",
+    "failedToDelete": "Falha ao excluir comentário",
+    "failedToLoad": "Falha ao carregar comentários",
+    "readOnly": "Você precisa de acesso de edição para comentar neste cartão.",
+    "replyTo": "Responder a {author}",
+    "noUsersFound": "Nenhum usuário encontrado"
+  },
   "tasks": {
     "title": "Tarefas",
     "addTask": "Adicionar tarefa",
@@ -583,7 +587,7 @@
     "overdue": "Em atraso",
     "browseAndManageTaskLists": "Navegar e gerir todas as suas listas de tarefas",
     "noTaskListsYet": "Ainda sem listas de tarefas",
-    "createFirstTaskList": "Crie a sua primeira lista de tarefas para começar a gerir os seus projetos.",
+    "createFirstTaskList": "Ainda não há nada aqui. Crie a sua primeira lista de tarefas.",
     "newTaskList": "Nova lista de tarefas",
     "taskLists": "Listas de tarefas",
     "noTaskListsFound": "Nenhuma lista de tarefas encontrada",
@@ -599,14 +603,6 @@
   },
   "kanban": {
     "status": "Estado",
-    "changeStatus": "Alterar estado",
-    "archiveAllItemsInColumn": "Arquivar todos os itens em {column}",
-    "archiveAllConfirmTitle": "Arquivar todos os itens?",
-    "archiveAllConfirmMessage": "Arquivar todos os {count} itens em {column}? Pode restaurá-los a partir do arquivo.",
-    "archiveAllSuccess": "{count} itens arquivados",
-    "archiveAllFailed": "Não foi possível arquivar todos os itens",
-    "archiveAllPartial": "{archived} de {total} itens arquivados. Não foi possível arquivar alguns itens.",
-    "moveFailed": "Não foi possível mover o cartão",
     "priority": "Prioridade",
     "score": "Pontuação",
     "assignee": "Responsável",
@@ -636,9 +632,10 @@
     "itemTitle": "Título do item",
     "manageStatuses": "Gerir estados",
     "viewArchived": "Ver arquivados",
+    "changeStatus": "Alterar estado",
     "noBoards": "Nenhum quadro encontrado",
     "noBoardsYet": "Ainda sem quadros kanban",
-    "createFirstBoard": "Crie o seu primeiro quadro kanban para começar a gerir os seus projetos.",
+    "createFirstBoard": "Ainda não há nada aqui. Crie o seu primeiro quadro kanban.",
     "newBoard": "Novo quadro",
     "tryAdjustingFilters": "Tente ajustar os filtros ou crie um novo quadro.",
     "completed": "Concluído",
@@ -650,6 +647,13 @@
     "targetDate": "Data alvo",
     "statusUpdated": "Estado atualizado",
     "itemArchived": "Item arquivado",
+    "archiveAllItemsInColumn": "Arquivar todos os itens em {column}",
+    "archiveAllConfirmTitle": "Arquivar todos os itens?",
+    "archiveAllConfirmMessage": "Arquivar todos os {count} itens em {column}? Pode restaurá-los a partir do arquivo.",
+    "archiveAllSuccess": "{count} itens arquivados",
+    "archiveAllFailed": "Não foi possível arquivar todos os itens",
+    "moveFailed": "Não foi possível mover o cartão",
+    "archiveAllPartial": "{archived} de {total} itens arquivados. Não foi possível arquivar alguns itens.",
     "itemDeleted": "Item eliminado",
     "estimatedTime": "Tempo estimado (horas)",
     "actualVsEstimated": "{actual} / {estimated}",
@@ -684,7 +688,7 @@
     "quickSettingsHeader": "Definições rápidas (apenas dispositivo)",
     "adminSettings": "Painel de administração",
     "apiKey": "Chave API",
-    "apiKeyDescription": "Gerar uma chave API para acesso programático às suas listas de verificação e notas",
+    "apiKeyDescription": "Gere uma chave API para que scripts e aplicações cheguem às suas listas de verificação e notas",
     "hideApiKey": "Ocultar chave API",
     "showApiKey": "Mostrar chave API",
     "copyApiKey": "Copiar chave API",
@@ -702,15 +706,15 @@
     "removeAvatar": "Remover avatar",
     "usernameRequired": "O nome de utilizador é obrigatório",
     "passwordsDoNotMatch": "As novas palavras-passe não coincidem",
-    "profileUpdated": "Perfil atualizado com sucesso!",
+    "profileUpdated": "Perfil atualizado",
     "failedToUpdateProfile": "Falha ao atualizar o perfil",
-    "failedToUpdateProfileRetry": "Falha ao atualizar o perfil. Por favor, tente novamente.",
-    "avatarUpdated": "Avatar atualizado com sucesso!",
+    "failedToUpdateProfileRetry": "Não foi possível atualizar o perfil. Tente novamente.",
+    "avatarUpdated": "Avatar atualizado",
     "failedToUpdateAvatar": "Falha ao atualizar o avatar",
-    "failedToUpdateAvatarRetry": "Falha ao atualizar o avatar. Por favor, tente novamente.",
-    "avatarRemoved": "Avatar removido com sucesso!",
+    "failedToUpdateAvatarRetry": "Não foi possível atualizar o avatar. Tente novamente.",
+    "avatarRemoved": "Avatar removido",
     "failedToRemoveAvatar": "Falha ao remover o avatar",
-    "failedToRemoveAvatarRetry": "Falha ao remover o avatar. Por favor, tente novamente.",
+    "failedToRemoveAvatarRetry": "Não foi possível remover o avatar. Tente novamente.",
     "activeSessions": "Sessões ativas",
     "activeSession": "{count} sessão ativa",
     "activeSession_plural": "{count} sessões ativas",
@@ -728,11 +732,11 @@
     "auditLogsTab": "Registos do utilizador",
     "rebuildLinkIndexes": "Reconstruir índices de ligações para atualizar dados de ligação",
     "rebuildingLinkIndex": "A reconstruir índice de ligações...",
-    "successfullyRebuiltIndex": "Índice de ligações reconstruído com sucesso",
-    "successfullyRebuiltIndexReload": "Índice de ligações reconstruído com sucesso! A página será recarregada para mostrar as ligações atualizadas.",
-    "failedToRebuildIndex": "Falha ao reconstruir o índice de ligações. Por favor, tente novamente.",
+    "successfullyRebuiltIndex": "Índice de ligações reconstruído",
+    "successfullyRebuiltIndexReload": "Índice de ligações reconstruído. A página vai recarregar para mostrar as novas ligações.",
+    "failedToRebuildIndex": "Não foi possível reconstruir o índice de ligações. Tente novamente.",
     "contentLinks": "Ligações de conteúdo",
-    "visualizeRelationships": "Visualizar relações entre as suas notas e listas de verificação",
+    "visualizeRelationships": "Veja como as suas notas e listas de verificação se ligam entre si",
     "connectedItems": "Itens ligados",
     "noLinksFound": "Nenhuma ligação encontrada",
     "startCreatingInternalLinks": "Comece a criar ligações internas digitando `@` nas suas notas para ver aqui a rede de relações.",
@@ -743,8 +747,8 @@
     "isolated": "isolado",
     "connection": "ligação",
     "connection_plural": "ligações",
-    "terminateSessionConfirm": "Tem a certeza de que pretende terminar esta sessão?",
-    "terminateAllSessionsConfirm": "Tem a certeza de que pretende terminar todas as outras sessões?",
+    "terminateSessionConfirm": "Terminar esta sessão?",
+    "terminateAllSessionsConfirm": "Terminar todas as outras sessões?",
     "validationErrorTitle": "Erro de validação",
     "visibleGraphSummary": "{items} itens visíveis, {links} ligações visíveis",
     "graphTruncated": "A mostrar os {visible} itens com mais ligações. {omitted} itens com menos ligações foram omitidos.",
@@ -768,16 +772,6 @@
     "uuid": "UUID"
   },
   "settings": {
-    "hideMobileStatusDropdownLabel": "Menu de estado móvel nos cartões",
-    "showMobileStatusDropdown": "Mostrar menu móvel",
-    "hideMobileStatusDropdown": "Ocultar menu móvel",
-    "selectMobileStatusDropdown": "Selecionar comportamento do menu de estado móvel",
-    "hideMobileStatusDropdownDescription": "Controla o menu de estado sempre visível nos cartões Kanban em dispositivos móveis. A definição da etiqueta de estado é separada.",
-    "hideTimeTrackingOnCardsLabel": "Controle de tempo nos cartões Kanban",
-    "showTimeTrackingOnCards": "Mostrar controle de tempo",
-    "hideTimeTrackingOnCards": "Ocultar controle de tempo",
-    "selectTimeTrackingOnCards": "Selecionar visibilidade do controle de tempo",
-    "hideTimeTrackingOnCardsDescription": "Oculta o cronômetro e as sessões registradas dos cartões Kanban. O controle de tempo continua disponível na visualização de detalhes do cartão.",
     "title": "Definições",
     "general": "Geral",
     "saveGeneral": "Guardar geral",
@@ -825,10 +819,10 @@
     "chooseAutoSaveInterval": "Escolha o intervalo para a guardação automática das suas notas.",
     "defaultMode": "Modo predefinido",
     "selectNotesDefaultMode": "Selecionar modo predefinido das notas",
-    "chooseNotesDefaultMode": "Escolha se a nota está automaticamente em modo de edição ou não {mode} no editor de notas).",
+    "chooseNotesDefaultMode": "Escolha se as notas abrem em modo de edição. Pode sempre alternar com o botão {mode} no editor de notas.",
     "defaultEditor": "Editor predefinido",
     "selectNotesDefaultEditor": "Selecionar editor predefinido das notas",
-    "chooseDefaultEditor": "Escolha o editor predefinido para as suas notas - (pode sempre alternar clicando no botão {editor} no editor de notas).",
+    "chooseDefaultEditor": "Escolha o editor predefinido para as suas notas. Pode sempre alternar com o botão {editor} no editor de notas.",
     "tableSyntaxInNotes": "Sintaxe de tabela nas notas",
     "selectTableSyntax": "Selecionar sintaxe de tabela",
     "chooseTableSyntax": "Escolha como as tabelas são apresentadas nas suas notas.",
@@ -837,7 +831,7 @@
     "chooseSyntaxTheme": "Escolha o tema de realce de sintaxe para o editor markdown.",
     "minimalMode": "Modo mínimo (desativar editor de texto enriquecido)",
     "selectMinimalMode": "Selecionar modo mínimo",
-    "minimalModeDescription": "Quando ativado, utiliza um processador markdown simples em vez do editor de texto enriquecido. Funcionalidades avançadas como ligações bilaterais não funcionarão neste modo.",
+    "minimalModeDescription": "Usa um processador markdown simples em vez do editor de texto enriquecido. As ligações bilaterais e outras funcionalidades avançadas não funcionam neste modo.",
     "defaultNoteFilter": "Filtro de notas predefinido",
     "selectDefaultNoteFilter": "Selecionar filtro de notas predefinido",
     "chooseDefaultNoteFilter": "Escolha o filtro predefinido a aplicar ao abrir a página de Notas.",
@@ -864,8 +858,8 @@
     "currentPassword": "Palavra-passe atual",
     "newPassword": "Nova palavra-passe",
     "confirmPassword": "Confirmar palavra-passe",
-    "passwordChanged": "Palavra-passe alterada com sucesso",
-    "settingsSaved": "Definições guardadas com sucesso",
+    "passwordChanged": "Palavra-passe alterada",
+    "settingsSaved": "Definições guardadas",
     "dashCase": "Com hífens (ex.: meu-ficheiro.md)",
     "minimal": "Mínimo (remover apenas caracteres inválidos)",
     "noRename": "Sem renomear (manter nome de ficheiro original)",
@@ -899,7 +893,7 @@
     "chooseQuickCreateNotes": "Escolha o modo de criação rápida de notas.",
     "quickCreateNotesShowModal": "Mostrar modal ao criar notas",
     "quickCreateNotesSkipModal": "Ignorar modal e criar instantaneamente",
-    "quickCreateNotesDescription": "Quando ativado, criar uma nova nota ignora o modal de criação e leva-o diretamente ao editor de notas.",
+    "quickCreateNotesDescription": "Salta a janela de criação de nota e leva-o diretamente ao editor.",
     "defaultCategory": "Categoria predefinida para criação rápida de notas",
     "selectDefaultCategory": "Selecionar categoria predefinida...",
     "defaultCategoryDescription": "As novas notas serão criadas nesta categoria ao usar a criação rápida.",
@@ -937,7 +931,17 @@
     "hideStatusOnCardsLabel": "Estado nos cartões Kanban",
     "showStatusOnCards": "Mostrar estado",
     "hideStatusOnCards": "Ocultar estado",
-    "hideStatusOnCardsDescription": "Oculta a etiqueta de estado dos itens dos cartões Kanban. O estado já é indicado pela coluna onde o cartão está colocado.",
+    "hideStatusOnCardsDescription": "Oculta a etiqueta de estado nos cartões Kanban. A coluna já mostra o estado.",
+    "hideMobileStatusDropdownLabel": "Menu de estado móvel nos cartões",
+    "showMobileStatusDropdown": "Mostrar menu móvel",
+    "hideMobileStatusDropdown": "Ocultar menu móvel",
+    "selectMobileStatusDropdown": "Selecionar comportamento do menu de estado móvel",
+    "hideMobileStatusDropdownDescription": "Controla o menu de estado sempre visível nos cartões Kanban em dispositivos móveis. A definição da etiqueta de estado é separada.",
+    "hideTimeTrackingOnCardsLabel": "Controle de tempo nos cartões Kanban",
+    "showTimeTrackingOnCards": "Mostrar controle de tempo",
+    "hideTimeTrackingOnCards": "Ocultar controle de tempo",
+    "selectTimeTrackingOnCards": "Selecionar visibilidade do controle de tempo",
+    "hideTimeTrackingOnCardsDescription": "Oculta o cronômetro e as sessões registradas dos cartões Kanban. O controle de tempo continua disponível na visualização de detalhes do cartão.",
     "selectStatusOnCards": "Selecionar visibilidade do estado",
     "codeBlockChoice": "Escolher o estilo do bloco de código",
     "defaultCodeBlock": "Codepen (predefinido)",
@@ -945,7 +949,7 @@
     "codeBlockChoiceDescription": "Escolha entre o estilo de bloco de código predefinido semelhante ao codepen ou um estilo de bloco de código temático.",
     "checklistItemClickAction": "Ação ao clicar em item de lista de verificação",
     "selectChecklistItemClickAction": "Selecionar ação ao clicar em item de lista de verificação",
-    "checklistItemClickActionDescription": "Escolha o que acontece quando clica no texto de uma tarefa. \"Marcar como concluída\" alterna a caixa de verificação (predefinido); \"Editar nome da tarefa\" abre a tarefa para edição inline — ainda precisará de clicar na própria caixa de verificação para a concluir.",
+    "checklistItemClickActionDescription": "Escolha o que acontece quando clica no texto de uma tarefa. \"Marcar como concluída\" (predefinido) alterna a caixa de verificação. \"Editar nome da tarefa\" abre a tarefa para edição inline, e clica na própria caixa de verificação para a concluir.",
     "checklistItemClickActionToggle": "Marcar como concluída/incompleta",
     "checklistItemClickActionEdit": "Editar item da lista",
     "newItemInsertion": "Inserção de novos itens",
@@ -995,11 +999,11 @@
     "icon512": "Ícone 512x512",
     "icon512Description": "Ícone de alta resolução para ecrãs de carregamento da PWA.",
     "notifyNewUpdates": "Notificar-me sobre novas atualizações",
-    "thisUsesGithubAPI": "Isto utiliza a API do GitHub para obter atualizações; desativar totalmente desativa a API e não permite qualquer tráfego de/para o github.",
+    "thisUsesGithubAPI": "Isto usa a API do GitHub para procurar atualizações. Desligá-lo para todo o tráfego de e para o GitHub.",
     "parseContent": "Mostrar sempre conteúdo processado",
-    "parseContentEnabledDescription": "Quando ativada, esta definição mostrará os títulos processados na barra lateral, resultados de pesquisa e em toda a aplicação.",
-    "parseContentDisabledDescription": "Quando desativada, os nomes de ficheiros originais serão higienizados, tornados legíveis e mostrados em alternativa.",
-    "parseContentPerformanceWarning": "Definir isto como \"não\" melhorará o desempenho em grandes conjuntos de dados, mas pode afetar a legibilidade - especialmente em nomes de ficheiros com caracteres não latinos.",
+    "parseContentEnabledDescription": "Mostra os títulos processados na barra lateral, nos resultados de pesquisa e em todo o resto da aplicação.",
+    "parseContentDisabledDescription": "Mostra os nomes de ficheiros originais, limpos para serem legíveis.",
+    "parseContentPerformanceWarning": "Definir isto como \"não\" torna as instâncias grandes mais rápidas mas os títulos menos legíveis, especialmente nomes de ficheiros com caracteres não latinos.",
     "hideLanguageSelector": "Ocultar seletor de idioma no cabeçalho",
     "hideLanguageSelectorDescription": "Mostrar/ocultar menu suspenso de idioma no cabeçalho",
     "defaultDateFormat": "Formato de data predefinido",
@@ -1012,7 +1016,7 @@
     "loadError": "Erro de carregamento",
     "couldNotFetchSettings": "Não foi possível obter as definições.",
     "failedToLoadSettings": "Falha ao carregar as definições",
-    "settingsSavedSuccessfully": "Definições guardadas com sucesso.",
+    "settingsSavedSuccessfully": "Definições guardadas.",
     "failedToSaveSettings": "Falha ao guardar as definições",
     "saveError": "Erro ao guardar",
     "unknownErrorOccurred": "Ocorreu um erro desconhecido.",
@@ -1025,7 +1029,7 @@
     "colorVariables": "Variáveis de cor",
     "livePreview": "Pré-visualização em direto",
     "unsavedCssChanges": "Tem alterações de CSS não guardadas.",
-    "noCustomThemesYet": "Ainda não foram criados temas personalizados. Clique em \"Criar tema\" para começar.",
+    "noCustomThemesYet": "Ainda não há temas personalizados. Clique em \"Criar tema\" para criar um.",
     "myCustomTheme": "O meu tema personalizado",
     "iconNameDescription": "nome do ícone (ex.: PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "Versão da aplicação",
@@ -1064,22 +1068,22 @@
     "configureExternalServices": "Configurar URLs de serviços externos para integrações do editor.",
     "drawioUrl": "URL do Draw.io",
     "optional": "(Opcional)",
-    "drawioUrlDescription": "Especifique um URL personalizado de instância Draw.io. Deixe vazio para usar a instância pública predefinida (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Use a sua própria instância Draw.io. Deixe vazio para usar a pública (https://embed.diagrams.net).",
     "drawioUrlExample": "Exemplo para alojamento próprio: https://seu-dominio.com/drawio",
     "drawioProxyEnabled": "Proxy Draw.io via Jotty",
-    "drawioProxyEnabledDescription": "Ativar isto para encaminhar o tráfego do Draw.io através do servidor do Jotty. Necessário para URLs de rede Docker interna (ex.: http://drawio:8080) que não são acessíveis a partir dos navegadores dos utilizadores.",
+    "drawioProxyEnabledDescription": "Encaminha o tráfego do Draw.io através do servidor do Jotty. Necessário para URLs de rede Docker interna (ex.: http://drawio:8080) que os navegadores dos utilizadores não alcançam.",
     "excalidrawUrl": "URL do Excalidraw",
-    "excalidrawUrlDescription": "Especifique um URL personalizado de instância Excalidraw. Deixe vazio para usar a instância pública predefinida (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Use a sua própria instância Excalidraw. Deixe vazio para usar a pública (https://excalidraw.com).",
     "excalidrawUrlExample": "Exemplo para alojamento próprio: https://seu-dominio.com/excalidraw",
     "excalidrawProxyEnabled": "Proxy Excalidraw via Jotty",
-    "excalidrawProxyEnabledDescription": "Ativar isto para encaminhar o tráfego do Excalidraw através do servidor do Jotty. Necessário para URLs de rede Docker interna (ex.: http://excalidraw:3000) que não são acessíveis a partir dos navegadores dos utilizadores.",
+    "excalidrawProxyEnabledDescription": "Encaminha o tráfego do Excalidraw através do servidor do Jotty. Necessário para URLs de rede Docker interna (ex.: http://excalidraw:3000) que os navegadores dos utilizadores não alcançam.",
     "saving": "A guardar...",
-    "editorSettingsSaved": "Definições do editor guardadas com sucesso.",
+    "editorSettingsSaved": "Definições do editor guardadas.",
     "customEmojis": "Emojis personalizados",
-    "noEmojisYet": "Ainda não foram criados emojis personalizados. Clique em &quot;Adicionar emoji&quot; para começar.",
-    "enterAnyEmoji": "Introduzir qualquer emoji ou usar o seletor de emoji (Windows: Win+.; Mac: Ctrl+Cmd+Space",
+    "noEmojisYet": "Ainda não há emojis personalizados. Clique em &quot;Adicionar emoji&quot; para adicionar um.",
+    "enterAnyEmoji": "Introduza qualquer emoji ou use o seletor de emoji (Windows: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Visão geral da atividade de partilha",
-    "detailedSharingBreakdown": "Análise detalhada dos padrões de partilha e envolvimento dos utilizadores",
+    "detailedSharingBreakdown": "O que é partilhado, e quem o partilha",
     "checkForUpdates": "Verificar atualizações",
     "checkingForUpdates": "A verificar atualizações...",
     "updateAvailable": "Atualização disponível!",
@@ -1094,12 +1098,12 @@
     "userContent": "{checklistsLength} listas de verificação • {notesLength} notas",
     "rebuildIndexes": "Reconstruir índices",
     "rebuilding": "A reconstruir...",
-    "successfullyRebuiltIndex": "Índice de ligações reconstruído com sucesso para {username}",
+    "successfullyRebuiltIndex": "Índice de ligações reconstruído para {username}",
     "failedToRebuildIndex": "Falha ao reconstruir o índice de ligações para {username}",
     "totalItems": "{items} itens totais em {userCount}",
     "privileges": "Privilégios de administrador",
     "adminContentAccess": "Acesso ao conteúdo do administrador",
-    "adminContentAccessDescription": "Controla se os administradores podem aceder às notas e listas de verificação de todos os utilizadores. Quando desativado, os administradores só podem gerir utilizadores e definições, mas não podem ver o conteúdo de outros utilizadores.",
+    "adminContentAccessDescription": "Permite aos administradores abrir as notas e listas de verificação de todos os utilizadores. Quando desligado, os administradores gerem utilizadores e definições mas não veem o conteúdo de mais ninguém.",
     "adminContentAccessYes": "Os administradores podem aceder a todo o conteúdo",
     "adminContentAccessNo": "Os administradores só podem aceder ao seu próprio conteúdo",
     "superAdminOnly": "Apenas editável pelo proprietário do sistema",
@@ -1109,21 +1113,21 @@
     "confirmNewPassword": "Confirmar nova palavra-passe",
     "dataExport": "Exportação de dados",
     "dataExportOptions": "Opções de exportação de dados",
-    "selectExportType": "Selecione um tipo de exportação e transfira dados da sua aplicação.",
+    "selectExportType": "Escolha um tipo de exportação e transfira os dados.",
     "allChecklistsAndNotes": "Todas as listas de verificação e notas",
-    "allChecklistsAndNotesDescription": "Exporta todas as listas de verificação e notas criadas por todos os utilizadores. Isto gerará um ficheiro zip com dados JSON organizados por utilizador e categoria.",
+    "allChecklistsAndNotesDescription": "Exporta as listas de verificação e notas de todos os utilizadores num zip de ficheiros JSON, agrupados por utilizador e categoria.",
     "userChecklistsNotes": "Listas de verificação e notas de um utilizador específico",
-    "userChecklistsNotesDescription": "Selecione um utilizador no menu suspenso para exportar todas as listas de verificação e notas pertencentes a esse utilizador específico.",
+    "userChecklistsNotesDescription": "Escolha um utilizador no menu para exportar todas as suas listas de verificação e notas.",
     "allUsersData": "Dados de todas as contas de utilizador",
     "allUsersDataDescription": "Exporta um ficheiro JSON com todas as informações de conta de utilizador (nomes de utilizador, estado de administrador, etc.). Isto NÃO inclui o conteúdo das suas listas de verificação ou notas.",
     "wholeDataFolder": "Pasta de dados completa (cópia de segurança)",
-    "wholeDataFolderDescription": "Exporta toda a pasta 'data', incluindo todo o conteúdo de utilizador, metadados e definições. Use com cuidado, pois pode ser um ficheiro grande.",
+    "wholeDataFolderDescription": "Exporta toda a pasta 'data', com todo o conteúdo de utilizador, metadados e definições. Este ficheiro pode ficar grande.",
     "noSharingPermissionsLabel": "Itens partilhados específicos estão ocultos com base nas suas permissões de acesso ao conteúdo.",
     "contentHidden": "Detalhes do conteúdo ocultos",
     "viewOnlySettingsNotice": "Apenas o proprietário do sistema pode modificar estas definições.",
     "auditLogContentRedacted": "[Conteúdo oculto]",
     "maxLogAgeDays": "Idade máxima dos registos (dias)",
-    "maxLogAgeDaysDescription": "Defina quanto tempo os registos de auditoria são retidos. Ao visualizar a página de registos de auditoria, será solicitado a limpar os registos mais antigos do que este limiar. Defina como 0 para retenção ilimitada (sem avisos de limpeza automática).",
+    "maxLogAgeDaysDescription": "Quanto tempo guardar os registos de auditoria. A página de registos oferece-se para limpar tudo o que for mais antigo. Defina 0 para guardar os registos para sempre e nunca receber o aviso.",
     "appPreferences": "Preferências da aplicação",
     "editEmoji": "Editar emoji",
     "addEmoji": "Adicionar emoji",
@@ -1157,6 +1161,9 @@
     "tryAgain": "Tentar novamente",
     "contactSupport": "Contactar suporte",
     "invalidInput": "Entrada inválida",
+    "invalidEditorSettings": "As definições do editor têm de ser um objeto, nada foi guardado",
+    "invalidEditorSetting": "A definição do editor {field} tem o tipo errado, nada foi guardado",
+    "categoryOutOfBounds": "Essa categoria está fora das suas notas, por isso nada foi criado",
     "requiredField": "Este campo é obrigatório",
     "emailInvalid": "Por favor, introduza um e-mail válido",
     "passwordTooShort": "A palavra-passe deve ter pelo menos 8 caracteres",
@@ -1164,43 +1171,44 @@
     "networkError": "Erro de rede",
     "timeout": "Tempo limite do pedido esgotado",
     "permissionDenied": "Permissão negada",
-    "requiredPermissions": "Não tens as permissões necessárias para realizar esta ação.",
+    "requiredPermissions": "Não tem permissão para fazer isso.",
     "loadError": "Erro de carregamento",
     "failedToLoadCustomEmojis": "Falha ao carregar emojis personalizados",
-    "emojiDeletedSuccessfully": "Emoji eliminado com sucesso",
+    "emojiDeletedSuccessfully": "Emoji eliminado",
     "deleteError": "Erro ao eliminar",
     "failedToDeleteEmoji": "Falha ao eliminar emoji",
     "validationError": "Erro de validação",
     "keywordAndEmojiRequired": "A palavra-chave e o emoji são obrigatórios",
     "duplicateKeyword": "Palavra-chave duplicada",
     "keywordAlreadyExists": "A palavra-chave já existe",
-    "emojiUpdatedSuccessfully": "Emoji atualizado com sucesso",
-    "emojiCreatedSuccessfully": "Emoji criado com sucesso",
+    "emojiUpdatedSuccessfully": "Emoji atualizado",
+    "emojiCreatedSuccessfully": "Emoji criado",
     "saveError": "Erro ao guardar",
     "failedToSaveEmoji": "Falha ao guardar emoji",
     "failedToLoadCustomCSS": "Falha ao carregar CSS personalizado",
     "couldNotLoadCustomCSS": "Não foi possível carregar o CSS personalizado.",
     "couldNotLoadThemes": "Não foi possível carregar os temas.",
-    "customCSSSavedSuccessfully": "CSS personalizado guardado com sucesso.",
+    "customCSSSavedSuccessfully": "CSS personalizado guardado.",
     "themeNotFound": "Tema não encontrado.",
-    "themeDeletedSuccessfully": "Tema eliminado com sucesso.",
+    "themeDeletedSuccessfully": "Tema eliminado.",
     "themeNameRequired": "O nome do tema é obrigatório.",
-    "themeSavedSuccessfully": "Tema {action} com sucesso.",
+    "themeSavedSuccessfully": "Tema {action}.",
     "anUnknownErrorOccurred": "Ocorreu um erro desconhecido.",
     "usernameRequired": "O nome de utilizador é obrigatório",
     "passwordRequired": "A palavra-passe é obrigatória",
     "passwordMinLength": "A palavra-passe deve ter pelo menos 6 caracteres",
     "passwordsDoNotMatch": "As palavras-passe não coincidem",
-    "userSavedSuccessfully": "Utilizador {mode} com sucesso!",
+    "userSavedSuccessfully": "Utilizador {mode}.",
     "failedToSaveUser": "Falha ao {mode} utilizador",
     "anErrorOccurred": "Ocorreu um erro.",
     "deleteUserConfirmation": "Eliminar utilizador \"{username}\"? Isto não pode ser desfeito.",
-    "userDeletedSuccessfully": "Utilizador eliminado com sucesso!",
-    "failedToDeleteUser": "Falha ao eliminar utilizador"
+    "userDeletedSuccessfully": "Utilizador eliminado.",
+    "failedToDeleteUser": "Falha ao eliminar utilizador",
+    "readOnlyFolder": "Esta pasta é só de leitura no servidor, por isso a alteração não foi guardada."
   },
   "pwa": {
     "installPromptTitle": "Instalar aplicação",
-    "installPromptMessage": "Instale esta aplicação no seu dispositivo para uma melhor experiência",
+    "installPromptMessage": "Instale o Jotty no seu dispositivo para o abrir como uma aplicação",
     "installButton": "Instalar",
     "updateAvailable": "Atualização disponível",
     "updateMessage": "Está disponível uma nova versão",
@@ -1258,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Alternar modo de editor enriquecido",
     "toggleMarkdownMode": "Alternar modo markdown",
+    "quickControls": "Controlos do editor",
     "toggleBold": "Alternar negrito",
     "toggleItalic": "Alternar itálico",
     "toggleUnderline": "Alternar sublinhado",
@@ -1431,16 +1440,16 @@
     "viewNote": "Ver nota",
     "editNote": "Editar nota",
     "privateKeyWarning": "AVISO: A sua chave privada permite a desencriptação de todas as notas encriptadas. Exporte apenas se compreender as implicações de segurança. Continuar?",
-    "publicKeyExported": "Chave pública exportada com sucesso",
-    "privateKeyExported": "Chave privada exportada com sucesso",
+    "publicKeyExported": "Chave pública exportada",
+    "privateKeyExported": "Chave privada exportada",
     "failedToExportKey": "Falha ao exportar chave",
     "unexpectedError": "Ocorreu um erro inesperado",
-    "keysDeleted": "Chaves eliminadas com sucesso",
+    "keysDeleted": "Chaves eliminadas",
     "failedToDeleteKeys": "Falha ao eliminar chaves",
     "autoDecryptUpdated": "Definição de desencriptação automática atualizada",
     "failedToUpdateSetting": "Falha ao atualizar a definição",
-    "enterValidPath": "Por favor, introduza um caminho válido",
-    "customPathSet": "Caminho de chave personalizado definido com sucesso",
+    "enterValidPath": "Introduza um caminho válido",
+    "customPathSet": "Caminho de chave personalizado definido",
     "failedToSetCustomPath": "Falha ao definir caminho personalizado",
     "thisNoteIsEncrypted": "Esta nota está encriptada",
     "noteProtectedWith": "Esta nota está protegida com encriptação {type}.",
@@ -1451,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Selecionar método de encriptação",
     "encryptionMethodsTitle": "Métodos de encriptação",
-    "xchachaDescription": "XChaCha20-Poly1305: Encriptação moderna, rápida, baseada em frase-chave",
-    "pgpDescription": "PGP: Criptografia de chave pública tradicional com gestão de par de chaves",
+    "xchachaDescription": "XChaCha20-Poly1305: encriptação com frase-chave",
+    "pgpDescription": "PGP: encriptação de chave pública com um par de chaves gerido por si",
     "encryptionKeys": "Chaves de encriptação",
     "keysConfigured": "Chaves configuradas",
     "algorithm": "Algoritmo: ",
@@ -1466,9 +1475,9 @@
     "keysDisabledInDemo": "As chaves de encriptação armazenadas estão desativadas no modo de demonstração.",
     "encryptionSettings": "Definições de encriptação",
     "promptForPassphrase": "Pedir frase-chave ao abrir notas encriptadas",
-    "promptForPassphraseDescription": "Se ativado, ser-lhe-á pedida a frase-chave ao abrir uma nota encriptada. A nota permanecerá encriptada no servidor, mas poderá ver o conteúdo desencriptado na sessão do separador atual.",
+    "promptForPassphraseDescription": "Pede a sua frase-chave quando abre uma nota encriptada. A nota fica encriptada no servidor e só vê o conteúdo desencriptado neste separador.",
     "customKeyPath": "Caminho de chave personalizado (instalações locais)",
-    "customKeyPathDescription": "Especifique um caminho de sistema de ficheiros personalizado (absoluto) para armazenar chaves de encriptação. Isto só é necessário para instalações locais. Os utilizadores de Docker devem mapear o caminho predefinido no docker-compose.yml.",
+    "customKeyPathDescription": "Um caminho absoluto do sistema de ficheiros para as suas chaves de encriptação. Só as instalações locais precisam disto. Os utilizadores de Docker devem mapear o caminho predefinido no docker-compose.yml.",
     "customPath": "Caminho personalizado",
     "customPathPlaceholder": "/home/utilizador/minhas-chaves",
     "customPathHelp": "Deve ser um caminho absoluto (ex.: /home/utilizador/minhas-chaves ou C:\\Users\\utilizador\\minhas-chaves)",
@@ -1487,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "O conteúdo da nota será encriptado antes de guardar",
     "passphraseRequired": "A frase-chave é obrigatória",
     "incorrectPassphrase": "Frase-chave incorreta",
-    "noteEncryptedSuccessfully": "Nota encriptada com sucesso",
+    "noteEncryptedSuccessfully": "Nota encriptada",
     "failedToEncryptNote": "Falha ao encriptar nota",
-    "noteDecryptedSuccessfully": "Nota desencriptada com sucesso",
+    "noteDecryptedSuccessfully": "Nota desencriptada",
     "failedToDecryptNote": "Falha ao desencriptar nota",
     "passphrase": "Frase-chave",
     "enterYourPassphrase": "Introduza a sua frase-chave",
@@ -1517,8 +1526,8 @@
     "privateKey": "Chave privada",
     "noStoredKeysFound": "Nenhuma chave armazenada encontrada",
     "noEncryptionKeysConfigured": "Não tem nenhuma chave de encriptação configurada",
-    "pastePublicKeyBelow": "Por favor, cole uma chave pública abaixo para encriptar o conteúdo da nota",
-    "generateOrImportKeysInProfile": "Pode gerar ou importar chaves específicas para o Jotty em Perfil → Encriptação",
+    "pastePublicKeyBelow": "Cole uma chave pública abaixo para encriptar o conteúdo da nota",
+    "generateOrImportKeysInProfile": "Pode gerar ou importar chaves para o Jotty em Perfil > Encriptação",
     "useCustomKey": "Usar chave {keyType} personalizada",
     "signWithPrivateKey": "Assinar com chave privada",
     "proveAuthenticityOfNote": "provar a autenticidade desta nota",
@@ -1538,7 +1547,7 @@
     "yourEmail": "o-seu@email.com",
     "generating": "A gerar...",
     "generateKeys": "Gerar chaves",
-    "keysGeneratedSuccessfully": "Chaves geradas com sucesso",
+    "keysGeneratedSuccessfully": "Chaves geradas",
     "importPGPKeys": "Importar chaves PGP",
     "publicKeyLabel": "Chave pública",
     "privateKeyLabel": "Chave privada",
@@ -1547,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Lembre-se da sua frase-chave! Não pode ser recuperada.",
     "withoutPassphraseCannotDecrypt": "Sem a frase-chave, não pode desencriptar as suas notas.",
     "backupPrivateKeySafely": "Faça uma cópia de segurança da sua chave privada em local seguro.",
-    "pgpKeyPairGeneratedSuccessfully": "Par de chaves PGP gerado com sucesso",
+    "pgpKeyPairGeneratedSuccessfully": "Par de chaves PGP gerado",
     "failedToGenerateKeys": "Falha ao gerar chaves",
     "fingerprint": "Impressão digital",
     "keysSavedSecurely": "As suas chaves foram guardadas em segurança.",
@@ -1561,13 +1570,13 @@
     "bothKeysRequired": "São necessárias tanto a chave pública como a privada",
     "invalidPublicKeyFormat": "Formato de chave pública inválido. Deve ser chave PGP em formato ASCII-armored.",
     "invalidPrivateKeyFormat": "Formato de chave privada inválido. Deve ser chave PGP em formato ASCII-armored.",
-    "keysImportedSuccessfully": "Chaves importadas com sucesso",
+    "keysImportedSuccessfully": "Chaves importadas",
     "failedToImportKeys": "Falha ao importar chaves",
     "created": "Encriptação criada",
     "notePlaceholder": "Sou um marcador de posição porque não pode encriptar uma nota vazia."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Estas opções aplicam-se apenas à sessão atual do navegador. Para definições permanentes, por favor verifique as suas",
+    "sessionOnlyPrefix": "Estas opções aplicam-se só a esta sessão do navegador. Para definições permanentes, veja as suas",
     "accountSettings": "preferências do utilizador",
     "autosaveNotes": "Guardação automática de notas",
     "showNotePreview": "Mostrar pré-visualização de notas nos cartões",
@@ -1596,20 +1605,45 @@
     "migrationSuccessful": "Migração bem-sucedida",
     "returnToApp": "Voltar à aplicação",
     "adminAccessRequired": "Acesso de administrador necessário",
-    "adminAccessDescription": "Esta migração requer privilégios de administrador. Por favor, contacte um administrador para realizar a migração do sistema.",
+    "adminAccessDescription": "Esta migração precisa de um administrador. Peça a um que a execute.",
     "whatsHappening": "O que está a acontecer?",
-    "sharingDataMigrationDescription": "O sistema precisa de migrar os seus dados de partilha. Este é um processo único que requer acesso de administrador.",
+    "sharingDataMigrationDescription": "O Jotty precisa de migrar os seus dados de partilha. Só acontece uma vez e precisa de um administrador.",
     "whatsChanging": "O que está a mudar?",
     "automaticBackupIncluded": "Cópia de segurança automática incluída",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter é o padrão da indústria",
-    "noMigrationNeeded": "Não foi necessária nenhuma migração - o seu sistema já está atualizado.",
-    "importantBackupData": "Importante: Faça uma cópia de segurança dos seus dados"
+    "noMigrationNeeded": "Nada para migrar, os seus dados já estão atualizados.",
+    "importantBackupData": "Importante: Faça uma cópia de segurança dos seus dados",
+    "sharingNowWithData": "Os seus dados de partilha estão agora junto das suas notas e pastas.",
+    "sharingMovesDescription": "A partilha sai de um ficheiro central e passa para os seus dados. Agora pode partilhar pastas, e as pastas partilhadas aparecem na sua própria barra lateral em vez de numa secção separada.",
+    "whatsHappeningBody": "Cada partilha em <code>.sharing.json</code> é escrita no frontmatter do item a que pertence, e cada pasta recebe um <code>.category-info.json</code> com a sua identidade, partilha e ordenação. Os ficheiros antigos são removidos depois de os dados serem movidos.",
+    "migrationChanges": "Alterações da migração",
+    "sharingTravelsTitle": "A partilha acompanha o ficheiro",
+    "sharingTravelsBody": "Cada item partilhado regista no seu próprio frontmatter com quem está partilhado, por isso movê-lo ou renomeá-lo nunca quebra uma partilha.",
+    "folderSharingTitle": "Partilha de pastas",
+    "folderSharingBody": "Partilhe uma pasta e tudo o que estiver dentro, agora e no futuro, fica partilhado também. Quem a recebe vê-a como uma pasta normal na sua própria barra lateral.",
+    "oneFilePerFolderTitle": "Um ficheiro por pasta",
+    "oneFilePerFolderBody": "O <code>.order.json</code> passa a fazer parte do <code>.category-info.json</code>, com a ordenação por uuid em vez de por nome de ficheiro.",
+    "permissionsUnchangedTitle": "As permissões não mudam",
+    "permissionsUnchangedBody": "Ler, editar e eliminar ficam exatamente como estão hoje, por utilizador e por item.",
+    "backupWarningBody": "Esta migração reescreve o frontmatter das suas notas e listas de verificação e elimina os ficheiros antigos <code>.sharing.json</code> e <code>.order.json</code>. Faça uma cópia de segurança da pasta <code>data</code> antes de continuar.",
+    "backupConfirmLabel": "Fiz uma cópia de segurança da minha pasta data e percebo como funciona a migração.",
+    "backupConfirmHint": "Confirme que tem uma cópia de segurança antes de continuar.",
+    "sharingDataMigrated": "Os seus dados de partilha e ordenação foram migrados.",
+    "whatWasChanged": "O que mudou:",
+    "migrationPartial": "Migração concluída com restos",
+    "leftoversTitle": "Alguns ficheiros antigos foram mantidos",
+    "leftoversBody": "A migração não conseguiu converter tudo, por isso os ficheiros antigos abaixo ficaram no disco intactos. Nada foi eliminado. Pode resolver a causa e voltar a correr a migração, ou entrar já na aplicação e tratar disso mais tarde.",
+    "overrideConfirmLabel": "Continuar mesmo assim e deixar de mostrar esta página.",
+    "overrideConfirmHint": "Os ficheiros restantes ficam no disco, mas a aplicação vai tratar os seus dados como migrados. As partilhas e ordenações listadas acima só serão aplicadas quando migrar de novo, o que pode fazer a qualquer momento em /migration?force=1.",
+    "continueAnyway": "Continuar mesmo assim",
+    "overriding": "A continuar...",
+    "overrideFailed": "Não foi possível saltar a migração"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Categoria renomeada com sucesso",
+    "categoryRenamedSuccessfully": "Categoria renomeada",
     "failedToRenameCategory": "Falha ao renomear categoria",
     "categoryRenamedSuccessfullyMessage": "Categoria {categoryName} renomeada para {newName}",
-    "failedToRenameCategoryMessage": "Ocorreu um erro ao renomear a categoria."
+    "failedToRenameCategoryMessage": "Algo correu mal ao renomear a categoria."
   },
   "auditLogs": {
     "title": "Registos de auditoria",
@@ -1626,17 +1660,17 @@
     "exportJSON": "Exportar JSON",
     "exportCSV": "Exportar CSV",
     "cleanupOldLogs": "Limpar registos antigos",
-    "confirmCleanup": "Tem a certeza de que pretende eliminar registos com mais de {days} dias? Isto afetará TODOS os utilizadores e não pode ser desfeito.",
+    "confirmCleanup": "Eliminar registos com mais de {days} dias? Isto afeta TODOS os utilizadores e não pode ser desfeito.",
     "confirmCleanupUnlimited": "Não está configurada nenhuma limpeza automática (retenção ilimitada). Ainda pode eliminar manualmente registos antigos se necessário.",
     "deleteAllLogsModalTitle": "Eliminar todos os registos de auditoria",
     "deleteAllLogsWarning": "Isto eliminará TODOS os registos, não apenas os antigos",
     "deleteAllLogsWarningDescription": "Todo o histórico de registos de auditoria será apagado do sistema.",
     "deletingAllLogs": "A eliminar todos os registos...",
     "deleteAllLogsButton": "Eliminar todos os registos",
-    "cleanupSuccess": "{count} ficheiros de registo antigos eliminados com sucesso",
+    "cleanupSuccess": "{count} ficheiros de registo antigos eliminados",
     "cleanupError": "Falha ao limpar registos antigos",
-    "userDescription": "Ver toda a sua atividade e ações no sistema",
-    "adminDescription": "Ver e gerir toda a atividade dos utilizadores no sistema",
+    "userDescription": "Tudo o que fez no Jotty",
+    "adminDescription": "O que cada utilizador fez nesta instância",
     "level": "Nível",
     "allLevels": "Todos os níveis",
     "allCategories": "Todas as categorias",
@@ -1700,9 +1734,9 @@
     "topActions": "Principais ações",
     "mostActiveUsers": "Utilizadores mais ativos",
     "oldLogsFound": "Existem {count} ficheiros de registo com mais de {days} dias.",
-    "oldLogsFoundDescription": "Pretende limpá-los? Esta ação não pode ser desfeita.",
+    "oldLogsFoundDescription": "Limpá-los? Isto não pode ser desfeito.",
     "cleanUpNow": "Limpar agora",
-    "cleanupSuccessMessage": "{count} ficheiros de registo antigos eliminados com sucesso.",
+    "cleanupSuccessMessage": "{count} ficheiros de registo antigos eliminados.",
     "security": "Segurança",
     "mfasecretgenerated": "Segredo MFA gerado",
     "mfaenabled": "MFA ativado",
@@ -1718,6 +1752,7 @@
     "howTo": "Como fazer",
     "shortcuts": "Atalhos",
     "markdownGuide": "Guia Markdown",
+    "brain": "Ligações e Brain",
     "customisations": "Personalizações",
     "docker": "Docker",
     "envVariables": "Variáveis de ambiente",
@@ -1725,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "Encriptação",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Traduções",
     "unraid": "Unraid",
     "patches": "Correções"
@@ -1749,8 +1785,96 @@
     "sharingTitle": "{user} partilhou um(a) {type} consigo",
     "sharingMessage": "Abrir para ver o(a) {type} partilhado(a)",
     "sharingFolderTitle": "{user} partilhou uma pasta de {type} consigo",
-    "sharingFolderMessage": "Abrir para ver “{folder}”",
+    "sharingFolderMessage": "Abrir para ver \"{folder}\"",
     "mentionTitle": "{user} mencionou você em um comentário",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
+  },
+  "relations": {
+    "indexing": "A indexar ligações...",
+    "unreachable": "inacessível",
+    "createFromWikilink": "Criar uma nota chamada \"{title}\"",
+    "mentionedIn": "Mencionada em",
+    "mentionedInHint": "Estas notas usam este título como texto simples. Ligue uma para as associar.",
+    "linkMention": "Ligar",
+    "linked": "Menção ligada em {title}",
+    "linkFailed": "Não foi possível ligar essa menção",
+    "kind": {
+      "mention": "Ligação",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "Brain",
+    "openBrain": "Abrir no brain",
+    "search": "Procure algo no seu brain...",
+    "dimension": "Vista",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "À volta deste item",
+    "global": "Tudo",
+    "depth": "Profundidade {depth}",
+    "colourBy": "Colorir por",
+    "colourModes": {
+      "type": "Tipo",
+      "category": "Categoria"
+    },
+    "filters": {
+      "notes": "Notas",
+      "checklists": "Listas de verificação",
+      "tags": "Etiquetas",
+      "ghosts": "Ainda não escritas",
+      "suggestions": "Sugestões",
+      "orphans": "Solitárias"
+    },
+    "kind": {
+      "note": "Nota",
+      "checklist": "Lista de verificação",
+      "ghost": "Ainda não escrita",
+      "tag": "Etiqueta"
+    },
+    "edges": {
+      "mention": "Ligação",
+      "wiki": "Wikilink",
+      "suggested": "Sugerida",
+      "tag": "Etiqueta"
+    },
+    "linksTo": "Liga a",
+    "linkedFrom": "Ligada a partir de",
+    "suggested": "Pode estar relacionado",
+    "promote": "Ligar a {title}",
+    "lonely": "Ainda nada se liga aqui. Mencione-o com @ ou [[ noutra nota.",
+    "open": "Abrir",
+    "createGhost": "Escrever esta nota",
+    "openTag": "Mostrar tudo com esta etiqueta",
+    "createFailed": "Não foi possível criar essa nota",
+    "connectFailed": "Não foi possível ligar os dois",
+    "connected": "{source} ligado a {target}",
+    "empty": "O seu brain está sossegado. Ligue notas e listas de verificação com @ ou [[ e elas aparecem aqui.",
+    "viewingOwner": "A ver o brain de {owner}",
+    "summary": "{items} itens, {links} ligações, {shown} visíveis"
+  },
+  "apiExplorer": {
+    "title": "Explorador da API",
+    "intro": "Todos os endpoints que esta instância (v{version}) expõe, gerados a partir do código que os serve. Escolha um, preencha-o e envie.",
+    "realData": "Os pedidos correm como o dono da chave API, sobre dados reais. Um DELETE aqui elimina mesmo.",
+    "apiKey": "Chave API",
+    "apiKeyHint": "Fica só nesta página e é esquecida quando sair.",
+    "useMyKey": "Usar a minha chave",
+    "noKeyYet": "Ainda não tem uma chave API. Gere uma nas definições do perfil.",
+    "filter": "Filtrar",
+    "filterPlaceholder": "Caminho, nome ou método",
+    "noMatches": "Nada corresponde a esse filtro.",
+    "body": "Corpo do pedido (JSON)",
+    "showSchema": "Mostrar esquema",
+    "hideSchema": "Ocultar esquema",
+    "send": "Enviar",
+    "sending": "A enviar...",
+    "keyRequired": "Adicione primeiro uma chave API.",
+    "noKeyNeeded": "não precisa de chave API",
+    "deprecated": "obsoleto",
+    "requestFailed": "O pedido nunca chegou ao servidor. Verifique a sua ligação.",
+    "responseMeta": "{status} em {ms} ms"
   }
 }
diff --git a/app/_translations/ru.json b/app/_translations/ru.json
index b67198333..67523a5c5 100644
--- a/app/_translations/ru.json
+++ b/app/_translations/ru.json
@@ -101,7 +101,7 @@
     "deleteFile": "Удалить файл",
     "fileTooLarge": "Файл слишком большой. Максимальный размер {maxSizeMB}МБ. Ваш файл {fileSizeMB}МБ.",
     "uploadFailed": "Ошибка загрузки",
-    "uploadFailedRetry": "Ошибка загрузки. Пожалуйста, попробуйте снова.",
+    "uploadFailedRetry": "Ошибка загрузки. Попробуйте снова.",
     "failedToDeleteFile": "Не удалось удалить файл",
     "previousMonth": "Предыдущий месяц",
     "nextMonth": "Следующий месяц",
@@ -127,13 +127,14 @@
     "expandAll": "Развернуть всё",
     "saveChanges": "Сохранить изменения",
     "all": "Все",
+    "items": "Элементы",
     "showAll": "Показать всё",
     "creating": "Создание...",
     "createCategoryHeader": "Создать новую категорию",
     "parentCategory": "Родительская категория (необязательно)",
     "noParent": "Без родителя (корневой уровень)",
     "categoryNamePlaceholder": "Введите название категории...",
-    "notAllowedName": "{name} не разрешено. Пожалуйста, выберите другое имя.",
+    "notAllowedName": "{name} не разрешено. Выберите другое имя.",
     "createCategory": "Создать категорию",
     "selectCategory": "Выберите категорию...",
     "categoryWillBeCreatedIn": "Новая категория будет создана в:",
@@ -173,7 +174,7 @@
     "noResults": "Нет результатов",
     "by": "от {owner}",
     "unsavedChanges": "Несохранённые изменения",
-    "unsavedChangesDetected": "⚠️ Обнаружены несохранённые изменения",
+    "unsavedChangesDetected": "Несохранённые изменения",
     "unsavedChangesMessage": "У вас есть несохранённые изменения в {noteTitle}. Если вы уйдёте сейчас, ваши изменения будут потеряны.",
     "whatToDoWithUnsavedChanges": "Что вы хотите сделать с несохранёнными изменениями?",
     "discard": "Отменить",
@@ -242,41 +243,14 @@
     "disable": "Отключить",
     "restoring": "Восстановление...",
     "retry": "Повторить",
-    "hide": "Скрыть",
     "copiedToClipboard": "Скопировано в буфер обмена",
     "offline": "Не в сети",
     "connected": "Подключено",
     "reconnecting": "Переподключение...",
-    "items": "Элементы",
+    "hide": "Скрыть",
     "thisEntry": "эта запись",
     "preview": "Предпросмотр"
   },
-  "comments": {
-    "title": "Комментарии",
-    "titleWithCount": "{count, plural, one {# комментарий} few {# комментария} many {# комментариев} other {# комментариев}}",
-    "noComments": "Пока нет комментариев. Начните обсуждение!",
-    "addComment": "Добавить комментарий...",
-    "replyPlaceholder": "Написать ответ...",
-    "post": "Опубликовать",
-    "reply": "Ответить",
-    "edit": "Изменить",
-    "delete": "Удалить",
-    "save": "Сохранить",
-    "cancel": "Отмена",
-    "edited": "изменено",
-    "deleteConfirmTitle": "Удалить комментарий?",
-    "deleteConfirmMessage": "Это удалит комментарий и все ответы. Действие нельзя отменить.",
-    "commentDeleted": "Комментарий удалён",
-    "commentAdded": "Комментарий добавлен",
-    "commentUpdated": "Комментарий обновлён",
-    "failedToAdd": "Не удалось добавить комментарий",
-    "failedToEdit": "Не удалось изменить комментарий",
-    "failedToDelete": "Не удалось удалить комментарий",
-    "failedToLoad": "Не удалось загрузить комментарии",
-    "readOnly": "Для комментариев к этой карточке требуется доступ на редактирование.",
-    "replyTo": "Ответить {author}",
-    "noUsersFound": "Пользователи не найдены"
-  },
   "history": {
     "noteHistory": "История заметки",
     "restore": "Восстановить",
@@ -286,10 +260,10 @@
     "noHistoryDescription": "Сохраните заметку, чтобы создать точку истории.",
     "loadMore": "Загрузить ещё",
     "featureDisabled": "История отключена",
-    "disabledAdmin": "История заметок сейчас отключена. Вы можете включить её в Админ-панели > Редактор.",
-    "disabledUser": "История заметок сейчас отключена. Пожалуйста, свяжитесь с администратором, чтобы включить эту функцию.",
+    "disabledAdmin": "История заметок выключена. Включить её можно в Админ-панели > Редактор.",
+    "disabledUser": "История заметок выключена. Попросите администратора включить её.",
     "goToSettings": "Перейти к настройкам",
-    "manualSavesOnly": "История создаётся только при ручном сохранении, а не при автосохранении.",
+    "manualSavesOnly": "Историю создают только ручные сохранения. Автосохранение её не создаёт.",
     "fetchError": "Не удалось загрузить историю",
     "restoreError": "Не удалось восстановить версию",
     "viewContent": "Просмотреть содержимое",
@@ -321,7 +295,7 @@
     "sessionExpired": "Ваша сессия истекла",
     "setupComplete": "Настройка завершена",
     "createAccount": "Создайте свой аккаунт",
-    "errorOccurred": "Произошла ошибка. Пожалуйста, попробуйте снова.",
+    "errorOccurred": "Что-то пошло не так. Попробуйте снова.",
     "enterUsername": "Введите имя пользователя",
     "enterPassword": "Введите пароль",
     "chooseUsername": "Выберите имя пользователя",
@@ -334,8 +308,8 @@
     "version": "Версия {version}",
     "createUser": "Создать пользователя",
     "attemptsRemaining": "Предупреждение: осталось {count, plural, one {# попытка} few {# попытки} many {# попыток} other {# попыток}} до блокировки аккаунта",
-    "accountLocked": "Слишком много неудачных попыток. Пожалуйста, попробуйте снова через {seconds} {seconds, plural, one {секунду} few {секунды} many {секунд} other {секунд}}",
-    "notAuthorized": "Вы не авторизованы для доступа к этому приложению. Пожалуйста, свяжитесь с администратором.",
+    "accountLocked": "Слишком много неудачных попыток. Попробуйте снова через {seconds} {seconds, plural, one {секунду} few {секунды} many {секунд} other {секунд}}",
+    "notAuthorized": "У вас нет доступа к этому приложению. Обратитесь к администратору.",
     "rememberMe": "Запомнить меня"
   },
   "mfa": {
@@ -360,9 +334,9 @@
     "invalidCode": "Неверный код аутентификации",
     "invalidRecoveryCode": "Неверный код восстановления",
     "mfaRequired": "Требуется двухфакторная аутентификация",
-    "mfaEnabledSuccess": "Двухфакторная аутентификация успешно включена",
+    "mfaEnabledSuccess": "Двухфакторная аутентификация включена",
     "mfaDisabledSuccess": "Двухфакторная аутентификация отключена",
-    "tooManyAttempts": "Слишком много неудачных попыток. Пожалуйста, попробуйте позже.",
+    "tooManyAttempts": "Слишком много неудачных попыток. Попробуйте позже.",
     "disableTitle": "Отключить двухфакторную аутентификацию",
     "disableDescription": "Введите ваш 2FA-код для подтверждения отключения двухфакторной аутентификации",
     "disableWarning": "Это сделает ваш аккаунт менее безопасным. Вы уверены?",
@@ -382,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Это сделает текущий код восстановления недействительным",
     "regenerateRecoveryCodeDescription": "Введите ваш 2FA-код для генерации нового кода восстановления. Ваш старый код больше не будет работать.",
     "recoveryCodeRegenerated": "Новый код восстановления сгенерирован",
-    "recoveryCodeRegeneratedInfo": "Ваш новый код восстановления был сгенерирован. Сохраните его в безопасном месте - вы увидите его только сейчас.",
-    "recoveryCodeRegeneratedSuccess": "Код восстановления успешно перегенерирован",
+    "recoveryCodeRegeneratedInfo": "Новый код восстановления готов. Сохраните его в надёжном месте, больше вы его не увидите.",
+    "recoveryCodeRegeneratedSuccess": "Код восстановления перевыпущен",
     "recoveryCodeProfileDescription": "Используйте этот код для восстановления аккаунта, если потеряете доступ к приложению-аутентификатору",
     "disableMfaForUser": "Отключить 2FA для этого пользователя",
     "recoveryCodeRequired": "Код восстановления обязателен",
@@ -397,7 +371,7 @@
     "recent": "Недавние",
     "browseAndManage": "Просматривайте и управляйте всеми вашими заметками",
     "noNotesYet": "Пока нет заметок",
-    "createFirstNote": "Создайте свою первую заметку, чтобы начать работу с базой знаний.",
+    "createFirstNote": "Здесь пока пусто. Создайте первую заметку.",
     "createNewNote": "Создать новую заметку",
     "noNotesFound": "Заметки не найдены",
     "tryAdjustingFilters": "Попробуйте изменить фильтры или создайте новую заметку.",
@@ -428,6 +402,7 @@
     "enterNoteTitle": "Введите название заметки...",
     "byType": "По типу",
     "publiclySharedNote": "Опубликовано",
+    "sharedPubliclyBy": "{owner} открыл(а) публичный доступ к этой заметке",
     "copyRawContent": "Копировать markdown",
     "quickSave": "Быстрое сохранение",
     "noteNotFound": "Заметка не найдена",
@@ -441,9 +416,12 @@
     "readingTime": "{count, plural, one {# минута чтения} few {# минуты чтения} many {# минут чтения} other {# минут чтения}}",
     "tags": "Теги",
     "noTagsFound": "Теги не найдены",
-    "searchTags": "Поиск тегов..."
+    "searchTags": "Поиск тегов...",
+    "createNoteFailed": "Не удалось создать заметку",
+    "createCategoryFailed": "Не удалось создать категорию, поэтому заметка не создана"
   },
   "checklists": {
+    "sharedPubliclyBy": "{owner} открыл(а) публичный доступ к этому чеклисту",
     "title": "Чеклисты",
     "allChecklists": "Все чеклисты",
     "completed": "Завершённые",
@@ -457,7 +435,7 @@
     "progress": "Прогресс",
     "totalItems": "Всего элементов",
     "noChecklistsYet": "Пока нет чеклистов",
-    "createFirstChecklist": "Создайте свой первый чеклист, чтобы начать организовывать задачи.",
+    "createFirstChecklist": "Здесь пока пусто. Создайте первый чеклист.",
     "newChecklist": "Новый чеклист",
     "noChecklistsFound": "Чеклисты не найдены",
     "tryAdjustingFiltersChecklist": "Попробуйте изменить фильтры или создайте новый чеклист.",
@@ -499,6 +477,7 @@
     "checklistType": "Тип чеклиста",
     "simpleChecklist": "Простой чеклист",
     "taskProject": "Проект задач",
+    "kanbanBoard": "Kanban-доска",
     "basicTodoItems": "Базовые задачи",
     "withTimeTracking": "С отслеживанием времени",
     "noDescription": "Без описания",
@@ -525,23 +504,24 @@
     "clearAllCompletedConfirmMessage": "Вы уверены, что хотите удалить все {count} выполненных элементов и их потомков? Это действие нельзя отменить.",
     "clearAllIncompleteConfirmMessage": "Вы уверены, что хотите удалить все {count} невыполненных элементов и их потомков? Это действие нельзя отменить.",
     "convertChecklistType": "Преобразовать тип чеклиста",
-    "convertTypeConfirmation": "Вы собираетесь преобразовать из {currentType} в {newType}. Вы уверены, что хотите продолжить?",
-    "dataLossWarning": "⚠️ Предупреждение о потере данных",
+    "convertTypeConfirmation": "Преобразовать из {currentType} в {newType}?",
+    "dataLossWarning": "Предупреждение о потере данных",
     "dataLossWarningItems": "Следующие данные будут потеряны:",
     "allTaskStatusesReset": "Все статусы задач будут сброшены",
     "timeTrackingDataLost": "Данные отслеживания времени будут потеряны",
     "estimatedTimesRemoved": "Расчётное время будет удалено",
     "targetDatesCleared": "Целевые даты будут очищены",
-    "enhancedFeatures": "✨ Расширенные функции",
+    "enhancedFeatures": "Что вы получите",
     "enhancedFeaturesYouWillGain": "Вы получите:",
     "kanbanBoardWithDragDrop": "Доска Канбан с перетаскиванием",
     "taskStatusTracking": "Отслеживание статуса задач (К выполнению, В процессе и т.д.)",
     "timeTrackingWithTimer": "Отслеживание времени со встроенным таймером",
-    "actionCannotBeUndone": "Это действие нельзя отменить. Вы уверены, что хотите преобразовать?",
+    "actionCannotBeUndone": "Это нельзя отменить. Всё равно преобразовать?",
     "convertAndLoseData": "Преобразовать и потерять данные",
     "convert": "Преобразовать",
     "convertToSimpleChecklist": "Преобразовать в простой чеклист",
     "convertToTaskProject": "Преобразовать в проект задач",
+    "convertToKanbanBoard": "Преобразовать в Kanban-доску",
     "pasteYourList": "Вставьте ваш список (один элемент на строку)",
     "addItems": "Добавить {count} элементов",
     "itemsWillBeAdded": "Будет добавлено {count} элементов",
@@ -550,11 +530,35 @@
     "noItemsYet": "Пока нет элементов",
     "addFirstItem": "Добавьте первый элемент, чтобы начать!",
     "noTasks": "Нет задач",
-    "noSubtasksYet": "Пока нет подзадач. Добавьте одну ниже, чтобы начать.",
+    "noSubtasksYet": "Пока нет подзадач. Добавьте одну ниже.",
     "addTime": "Добавить время",
-    "enterTimeInMinutes": "Введите время в минутах",
-    "convertToKanbanBoard": "Преобразовать в Kanban-доску",
-    "kanbanBoard": "Kanban-доска"
+    "enterTimeInMinutes": "Введите время в минутах"
+  },
+  "comments": {
+    "title": "Комментарии",
+    "titleWithCount": "{count, plural, one {# комментарий} few {# комментария} many {# комментариев} other {# комментариев}}",
+    "noComments": "Пока нет комментариев. Начните обсуждение!",
+    "addComment": "Добавить комментарий...",
+    "replyPlaceholder": "Написать ответ...",
+    "post": "Опубликовать",
+    "reply": "Ответить",
+    "edit": "Изменить",
+    "delete": "Удалить",
+    "save": "Сохранить",
+    "cancel": "Отмена",
+    "edited": "изменено",
+    "deleteConfirmTitle": "Удалить комментарий?",
+    "deleteConfirmMessage": "Это удалит комментарий и все ответы. Действие нельзя отменить.",
+    "commentDeleted": "Комментарий удалён",
+    "commentAdded": "Комментарий добавлен",
+    "commentUpdated": "Комментарий обновлён",
+    "failedToAdd": "Не удалось добавить комментарий",
+    "failedToEdit": "Не удалось изменить комментарий",
+    "failedToDelete": "Не удалось удалить комментарий",
+    "failedToLoad": "Не удалось загрузить комментарии",
+    "readOnly": "Для комментариев к этой карточке требуется доступ на редактирование.",
+    "replyTo": "Ответить {author}",
+    "noUsersFound": "Пользователи не найдены"
   },
   "tasks": {
     "title": "Задачи",
@@ -583,7 +587,7 @@
     "overdue": "Просрочено",
     "browseAndManageTaskLists": "Просматривайте и управляйте всеми вашими списками задач",
     "noTaskListsYet": "Пока нет списков задач",
-    "createFirstTaskList": "Создайте свой первый список задач, чтобы начать управлять проектами.",
+    "createFirstTaskList": "Здесь пока пусто. Создайте первый список задач.",
     "newTaskList": "Новый список задач",
     "taskLists": "Списки задач",
     "noTaskListsFound": "Списки задач не найдены",
@@ -631,7 +635,7 @@
     "changeStatus": "Изменить статус",
     "noBoards": "Доски не найдены",
     "noBoardsYet": "Пока нет досок Канбан",
-    "createFirstBoard": "Создайте первую доску Канбан для управления проектами.",
+    "createFirstBoard": "Здесь пока пусто. Создайте первую доску Канбан.",
     "newBoard": "Новая доска",
     "tryAdjustingFilters": "Измените фильтры или создайте новую доску.",
     "completed": "Завершено",
@@ -684,7 +688,7 @@
     "quickSettingsHeader": "Быстрые настройки (только устройство)",
     "adminSettings": "Панель администратора",
     "apiKey": "API-ключ",
-    "apiKeyDescription": "Сгенерируйте API-ключ для программного доступа к чеклистам и заметкам",
+    "apiKeyDescription": "Создайте API-ключ, чтобы скрипты и приложения могли работать с вашими чеклистами и заметками",
     "hideApiKey": "Скрыть API-ключ",
     "showApiKey": "Показать API-ключ",
     "copyApiKey": "Копировать API-ключ",
@@ -702,15 +706,15 @@
     "removeAvatar": "Удалить аватар",
     "usernameRequired": "Имя пользователя обязательно",
     "passwordsDoNotMatch": "Пароли не совпадают",
-    "profileUpdated": "Профиль успешно обновлён!",
+    "profileUpdated": "Профиль обновлён",
     "failedToUpdateProfile": "Не удалось обновить профиль",
-    "failedToUpdateProfileRetry": "Не удалось обновить профиль. Пожалуйста, попробуйте снова.",
-    "avatarUpdated": "Аватар успешно обновлён!",
+    "failedToUpdateProfileRetry": "Не удалось обновить профиль. Попробуйте снова.",
+    "avatarUpdated": "Аватар обновлён",
     "failedToUpdateAvatar": "Не удалось обновить аватар",
-    "failedToUpdateAvatarRetry": "Не удалось обновить аватар. Пожалуйста, попробуйте снова.",
-    "avatarRemoved": "Аватар успешно удалён!",
+    "failedToUpdateAvatarRetry": "Не удалось обновить аватар. Попробуйте снова.",
+    "avatarRemoved": "Аватар удалён",
     "failedToRemoveAvatar": "Не удалось удалить аватар",
-    "failedToRemoveAvatarRetry": "Не удалось удалить аватар. Пожалуйста, попробуйте снова.",
+    "failedToRemoveAvatarRetry": "Не удалось удалить аватар. Попробуйте снова.",
     "activeSessions": "Активные сессии",
     "activeSession": "{count} активная сессия",
     "activeSession_plural": "{count} активных сессий",
@@ -728,11 +732,11 @@
     "auditLogsTab": "Журналы пользователя",
     "rebuildLinkIndexes": "Перестроить индексы связей для обновления данных о связях",
     "rebuildingLinkIndex": "Перестроение индекса связей...",
-    "successfullyRebuiltIndex": "Индекс связей успешно перестроен",
-    "successfullyRebuiltIndexReload": "Индекс связей успешно перестроен! Страница перезагрузится для отображения обновлённых связей.",
-    "failedToRebuildIndex": "Не удалось перестроить индекс связей. Пожалуйста, попробуйте снова.",
+    "successfullyRebuiltIndex": "Индекс связей перестроен",
+    "successfullyRebuiltIndexReload": "Индекс связей перестроен. Страница перезагрузится, чтобы показать новые связи.",
+    "failedToRebuildIndex": "Не удалось перестроить индекс связей. Попробуйте снова.",
     "contentLinks": "Связи контента",
-    "visualizeRelationships": "Визуализируйте связи между вашими заметками и чеклистами",
+    "visualizeRelationships": "Посмотрите, как ваши заметки и чеклисты ссылаются друг на друга",
     "connectedItems": "Связанные элементы",
     "noLinksFound": "Связи не найдены",
     "startCreatingInternalLinks": "Начните создавать внутренние связи, введя @ в ваших заметках, чтобы увидеть сеть связей здесь.",
@@ -743,8 +747,8 @@
     "isolated": "изолирован",
     "connection": "связь",
     "connection_plural": "связей",
-    "terminateSessionConfirm": "Вы уверены, что хотите завершить эту сессию?",
-    "terminateAllSessionsConfirm": "Вы уверены, что хотите завершить все остальные сессии?",
+    "terminateSessionConfirm": "Завершить эту сессию?",
+    "terminateAllSessionsConfirm": "Завершить все остальные сессии?",
     "validationErrorTitle": "Ошибка валидации",
     "visibleGraphSummary": "Видимых элементов: {items}, видимых связей: {links}",
     "graphTruncated": "Показаны {visible} наиболее связанных элементов. {omitted} менее связанных элементов скрыто.",
@@ -815,10 +819,10 @@
     "chooseAutoSaveInterval": "Выберите интервал для автоматического сохранения заметок.",
     "defaultMode": "Режим по умолчанию",
     "selectNotesDefaultMode": "Выберите режим заметок по умолчанию",
-    "chooseNotesDefaultMode": "Выберите, находится ли заметка автоматически в режиме редактирования или нет (кнопка {mode} в редакторе заметок).",
+    "chooseNotesDefaultMode": "Выберите, открываются ли заметки в режиме редактирования. Переключиться можно в любой момент кнопкой {mode} в редакторе заметок.",
     "defaultEditor": "Редактор по умолчанию",
     "selectNotesDefaultEditor": "Выберите редактор заметок по умолчанию",
-    "chooseDefaultEditor": "Выберите редактор по умолчанию для ваших заметок - (вы всегда можете переключиться, нажав кнопку {editor} в редакторе заметок).",
+    "chooseDefaultEditor": "Выберите редактор заметок по умолчанию. Переключиться можно в любой момент кнопкой {editor} в редакторе заметок.",
     "tableSyntaxInNotes": "Синтаксис таблиц в заметках",
     "selectTableSyntax": "Выберите синтаксис таблиц",
     "chooseTableSyntax": "Выберите, как таблицы отображаются в заметках.",
@@ -827,7 +831,7 @@
     "chooseSyntaxTheme": "Выберите тему подсветки синтаксиса для markdown-редактора.",
     "minimalMode": "Минимальный режим (отключить Rich Text Editor)",
     "selectMinimalMode": "Выберите минимальный режим",
-    "minimalModeDescription": "При включении используется простой markdown-рендер вместо Rich Text Editor. Расширенные функции, такие как двусторонние ссылки, не будут работать в этом режиме.",
+    "minimalModeDescription": "Использует простой markdown-рендер вместо визуального редактора. Двусторонние ссылки и другие расширенные функции в этом режиме не работают.",
     "defaultNoteFilter": "Фильтр заметок по умолчанию",
     "selectDefaultNoteFilter": "Выберите фильтр заметок по умолчанию",
     "chooseDefaultNoteFilter": "Выберите фильтр по умолчанию при открытии страницы заметок.",
@@ -854,8 +858,8 @@
     "currentPassword": "Текущий пароль",
     "newPassword": "Новый пароль",
     "confirmPassword": "Подтвердите пароль",
-    "passwordChanged": "Пароль успешно изменён",
-    "settingsSaved": "Настройки успешно сохранены",
+    "passwordChanged": "Пароль изменён",
+    "settingsSaved": "Настройки сохранены",
     "dashCase": "Dash case (например, my-file-name.md)",
     "minimal": "Минимальный (удалить недопустимые символы)",
     "noRename": "Без переименования (сохранить оригинальное имя)",
@@ -865,6 +869,7 @@
     "seconds_plural": "{count} секунд",
     "hours12": "12 часов",
     "hours24": "24 часа",
+    "useSystemDefault": "Использовать системные настройки по умолчанию",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "По умолчанию",
@@ -888,7 +893,7 @@
     "chooseQuickCreateNotes": "Выберите режим быстрого создания заметок.",
     "quickCreateNotesShowModal": "Показывать модальное окно при создании заметок",
     "quickCreateNotesSkipModal": "Пропустить модальное окно и создавать мгновенно",
-    "quickCreateNotesDescription": "При включении создание новой заметки пропускает модальное окно и сразу открывает редактор.",
+    "quickCreateNotesDescription": "Пропускает окно создания заметки и сразу открывает редактор.",
     "defaultCategory": "Категория по умолчанию для быстрого создания заметок",
     "selectDefaultCategory": "Выберите категорию по умолчанию...",
     "defaultCategoryDescription": "Новые заметки будут создаваться в этой категории при использовании быстрого создания.",
@@ -926,7 +931,7 @@
     "hideStatusOnCardsLabel": "Статус на карточках Канбан",
     "showStatusOnCards": "Показать статус",
     "hideStatusOnCards": "Скрыть статус",
-    "hideStatusOnCardsDescription": "Скрывает метку статуса на карточках Канбан. Статус уже виден по колонке, в которой находится карточка.",
+    "hideStatusOnCardsDescription": "Скрывает метку статуса на карточках Канбан. Колонка и так показывает статус.",
     "hideMobileStatusDropdownLabel": "Мобильный выпадающий список статуса на карточках",
     "showMobileStatusDropdown": "Показать мобильный список",
     "hideMobileStatusDropdown": "Скрыть мобильный список",
@@ -939,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "Скрывает таймер и записанные сессии на карточках Kanban. Учёт времени остаётся доступным в подробном представлении карточки.",
     "selectStatusOnCards": "Выберите видимость статуса",
     "codeBlockChoice": "Выберите стиль блока кода",
-    "themedCodeBlock": "Тематический кодовый блок",
     "defaultCodeBlock": "Коден (по умолчанию)",
+    "themedCodeBlock": "Тематический кодовый блок",
     "codeBlockChoiceDescription": "Выбирайте между стилем блока кода по умолчанию, похожим на кодовое перо, или стилем тематического блока кода.",
     "checklistItemClickAction": "Действие при нажатии на элемент контрольного списка",
     "selectChecklistItemClickAction": "Выберите действие по клику на элемент контрольного списка",
-    "checklistItemClickActionDescription": "Выберите, что произойдет, если щелкнуть текст задачи. \n«Отметить как завершенное» переключает флажок (по умолчанию); \n«Редактировать имя задачи» открывает задачу для оперативного редактирования — для ее завершения все равно нужно будет нажать на сам флажок.",
+    "checklistItemClickActionDescription": "Выберите, что происходит при нажатии на текст задачи. «Отметить как завершённое» (по умолчанию) переключает флажок. «Редактировать имя задачи» открывает задачу для редактирования на месте, а чтобы завершить её, нажмите на сам флажок.",
     "checklistItemClickActionToggle": "Отметить как завершенное/незавершенное",
     "checklistItemClickActionEdit": "Изменить элемент списка",
     "newItemInsertion": "Добавление новых элементов",
@@ -952,7 +957,6 @@
     "newItemInsertionDescription": "Выберите, добавляются ли новые элементы в начало (по умолчанию) или в конец контрольного списка.",
     "newItemInsertionTop": "В начало списка",
     "newItemInsertionBottom": "В конец списка",
-    "useSystemDefault": "Использовать системные настройки по умолчанию",
     "selectShowChecklistEmojis": "Выберите отображение эмодзи",
     "showChecklistEmojisDescription": "Показывает автоматическое эмодзи рядом с пунктами чеклиста по их тексту."
   },
@@ -995,20 +999,24 @@
     "icon512": "512x512 Иконка",
     "icon512Description": "Высококачественная иконка для заставок PWA.",
     "notifyNewUpdates": "Уведомлять о новых обновлениях",
-    "thisUsesGithubAPI": "Использует GitHub API для получения обновлений, полное отключение отключает API и не позволяет никакому трафику входить и выходить из github.",
+    "thisUsesGithubAPI": "Использует GitHub API для проверки обновлений. Если выключить, весь трафик к GitHub и от него прекратится.",
     "parseContent": "Всегда показывать обработанный контент",
-    "parseContentEnabledDescription": "При включении этой настройки будут отображаться обработанные заголовки в боковой панели, результатах поиска и по всему приложению.",
-    "parseContentDisabledDescription": "При отключении оригинальные имена файлов будут очищены, сделаны читаемыми и показаны вместо этого.",
-    "parseContentPerformanceWarning": "Установка \"нет\" улучшит производительность на больших наборах данных, но может повлиять на читаемость - особенно на имена файлов с нелатинскими символами.",
+    "parseContentEnabledDescription": "Показывает обработанные заголовки в боковой панели, в результатах поиска и везде в приложении.",
+    "parseContentDisabledDescription": "Показывает вместо этого исходные имена файлов, приведённые к читаемому виду.",
+    "parseContentPerformanceWarning": "Значение \"нет\" ускоряет большие экземпляры, но заголовки читать труднее, особенно имена файлов с нелатинскими символами.",
     "hideLanguageSelector": "Скрыть выбор языка в заголовке",
     "hideLanguageSelectorDescription": "Показать/скрыть выпадающий список языка в заголовке",
+    "defaultDateFormat": "Формат даты по умолчанию",
+    "defaultDateFormatDescription": "Используется, когда в настройках формата даты пользователя установлено значение «Использовать системное значение по умолчанию».",
+    "defaultTimeFormat": "Формат времени по умолчанию",
+    "defaultTimeFormatDescription": "Используется, когда в настройках формата времени пользователя установлено значение «Использовать системное значение по умолчанию».",
     "applicationIcons": "Иконки приложения",
     "saveChanges": "Сохранить изменения",
     "unsavedChanges": "У вас есть несохранённые изменения.",
     "loadError": "Ошибка загрузки",
     "couldNotFetchSettings": "Не удалось получить настройки.",
     "failedToLoadSettings": "Не удалось загрузить настройки",
-    "settingsSavedSuccessfully": "Настройки успешно сохранены.",
+    "settingsSavedSuccessfully": "Настройки сохранены.",
     "failedToSaveSettings": "Не удалось сохранить настройки",
     "saveError": "Ошибка сохранения",
     "unknownErrorOccurred": "Произошла неизвестная ошибка.",
@@ -1021,7 +1029,7 @@
     "colorVariables": "Цветовые переменные",
     "livePreview": "Предпросмотр",
     "unsavedCssChanges": "У вас есть несохранённые изменения CSS.",
-    "noCustomThemesYet": "Пользовательские темы ещё не созданы. Нажмите \"Создать тему\", чтобы начать.",
+    "noCustomThemesYet": "Пользовательских тем пока нет. Нажмите \"Создать тему\", чтобы сделать тему.",
     "myCustomTheme": "Моя пользовательская тема",
     "iconNameDescription": "название иконки (например, PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "Версия приложения",
@@ -1060,22 +1068,22 @@
     "configureExternalServices": "Настройте URL внешних сервисов для интеграций редактора.",
     "drawioUrl": "URL Draw.io",
     "optional": "(Необязательно)",
-    "drawioUrlDescription": "Укажите пользовательский URL экземпляра Draw.io. Оставьте пустым для использования публичного экземпляра по умолчанию (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Используйте свой экземпляр Draw.io. Оставьте пустым для публичного (https://embed.diagrams.net).",
     "drawioUrlExample": "Пример для самодоступного: https://your-domain.com/drawio",
     "drawioProxyEnabled": "Прокси Draw.io через Jotty",
-    "drawioProxyEnabledDescription": "Включите это для маршрутизации трафика Draw.io через сервер Jotty. Требуется для внутренних URL Docker (например, http://drawio:8080), которые недоступны из браузеров пользователей.",
+    "drawioProxyEnabledDescription": "Направляет трафик Draw.io через сервер Jotty. Нужно для внутренних адресов сети Docker (например, http://drawio:8080), до которых браузеры пользователей не достают.",
     "excalidrawUrl": "URL Excalidraw",
-    "excalidrawUrlDescription": "Укажите пользовательский URL экземпляра Excalidraw. Оставьте пустым для использования публичного экземпляра по умолчанию (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Используйте свой экземпляр Excalidraw. Оставьте пустым для публичного (https://excalidraw.com).",
     "excalidrawUrlExample": "Пример для самодоступного: https://your-domain.com/excalidraw",
     "excalidrawProxyEnabled": "Прокси Excalidraw через Jotty",
-    "excalidrawProxyEnabledDescription": "Включите это для маршрутизации трафика Excalidraw через сервер Jotty. Требуется для внутренних URL Docker (например, http://excalidraw:3000), которые недоступны из браузеров пользователей.",
+    "excalidrawProxyEnabledDescription": "Направляет трафик Excalidraw через сервер Jotty. Нужно для внутренних адресов сети Docker (например, http://excalidraw:3000), до которых браузеры пользователей не достают.",
     "saving": "Сохранение...",
-    "editorSettingsSaved": "Настройки редактора успешно сохранены.",
+    "editorSettingsSaved": "Настройки редактора сохранены.",
     "customEmojis": "Пользовательские эмодзи",
-    "noEmojisYet": "Пользовательские эмодзи ещё не созданы. Нажмите \"Добавить эмодзи\", чтобы начать.",
-    "enterAnyEmoji": "Введите любой эмодзи или используйте выбор эмодзи (Win: Win+.; Mac: Ctrl+Cmd+Пробел)",
+    "noEmojisYet": "Пользовательских эмодзи пока нет. Нажмите \"Добавить эмодзи\", чтобы добавить.",
+    "enterAnyEmoji": "Введите любой эмодзи или воспользуйтесь выбором эмодзи (Win: Win+.; Mac: Ctrl+Cmd+Пробел)",
     "sharingOverview": "Обзор активности доступа",
-    "detailedSharingBreakdown": "Подробная разбивка паттернов доступа и вовлечённости пользователей",
+    "detailedSharingBreakdown": "Чем делятся и кто делится",
     "checkForUpdates": "Проверить обновления",
     "checkingForUpdates": "Проверка обновлений...",
     "updateAvailable": "Доступно обновление!",
@@ -1090,12 +1098,12 @@
     "userContent": "{checklistsLength} чеклистов • {notesLength} заметок",
     "rebuildIndexes": "Перестроить индексы",
     "rebuilding": "Перестроение...",
-    "successfullyRebuiltIndex": "Индекс связей успешно перестроен для {username}",
+    "successfullyRebuiltIndex": "Индекс связей перестроен для {username}",
     "failedToRebuildIndex": "Не удалось перестроить индекс связей для {username}",
     "totalItems": "{items} всего элементов у {userCount} пользователей",
     "privileges": "Привилегии администратора",
     "adminContentAccess": "Доступ администратора к контенту",
-    "adminContentAccessDescription": "Контролирует, могут ли администраторы получать доступ к заметкам и чеклистам всех пользователей. При отключении администраторы могут только управлять пользователями и настройками, но не могут просматривать контент других пользователей.",
+    "adminContentAccessDescription": "Позволяет администраторам открывать заметки и чеклисты любого пользователя. Если выключено, администраторы управляют пользователями и настройками, но не видят чужой контент.",
     "adminContentAccessYes": "Администраторы могут получать доступ ко всему контенту",
     "adminContentAccessNo": "Администраторы могут получать доступ только к своему контенту",
     "superAdminOnly": "Редактируется только владельцем системы",
@@ -1105,21 +1113,21 @@
     "confirmNewPassword": "Подтвердите новый пароль",
     "dataExport": "Экспорт данных",
     "dataExportOptions": "Параметры экспорта данных",
-    "selectExportType": "Выберите тип экспорта и скачайте данные из приложения.",
+    "selectExportType": "Выберите тип экспорта и скачайте данные.",
     "allChecklistsAndNotes": "Все чеклисты и заметки",
-    "allChecklistsAndNotesDescription": "Экспортирует все чеклисты и заметки, созданные всеми пользователями. Это создаст zip-файл с данными JSON, организованными по пользователям и категориям.",
+    "allChecklistsAndNotesDescription": "Экспортирует чеклисты и заметки всех пользователей в zip с JSON-файлами, сгруппированными по пользователю и категории.",
     "userChecklistsNotes": "Чеклисты и заметки конкретного пользователя",
-    "userChecklistsNotesDescription": "Выберите пользователя из выпадающего списка для экспорта всех чеклистов и заметок этого пользователя.",
+    "userChecklistsNotesDescription": "Выберите пользователя в списке, чтобы экспортировать все его чеклисты и заметки.",
     "allUsersData": "Данные всех аккаунтов пользователей",
     "allUsersDataDescription": "Экспортирует JSON-файл со всей информацией об аккаунтах пользователей (имена пользователей, статус админа и т.д.). Это НЕ включает содержимое чеклистов или заметок.",
     "wholeDataFolder": "Вся папка данных (резервная копия)",
-    "wholeDataFolderDescription": "Экспортирует всю папку 'data', включая весь контент пользователей, метаданные и настройки. Используйте с осторожностью, так как это может быть большой файл.",
+    "wholeDataFolderDescription": "Экспортирует всю папку 'data' со всем контентом пользователей, метаданными и настройками. Файл может получиться большим.",
     "noSharingPermissionsLabel": "Конкретные доступные элементы скрыты на основе ваших разрешений доступа к контенту.",
     "contentHidden": "Детали контента скрыты",
     "viewOnlySettingsNotice": "Только владелец системы может изменять эти настройки.",
     "auditLogContentRedacted": "[Контент скрыт]",
     "maxLogAgeDays": "Максимальный возраст журнала (дней)",
-    "maxLogAgeDaysDescription": "Установите, как долго хранятся аудиторские журналы. При просмотре страницы аудиторских журналов вам будет предложено очистить журналы старше этого порога. Установите 0 для неограниченного хранения (без автоматических запросов на очистку).",
+    "maxLogAgeDaysDescription": "Сколько хранить журналы аудита. Страница журналов аудита предложит удалить всё, что старше. Укажите 0, чтобы хранить журналы всегда и не получать это предложение.",
     "appPreferences": "Настройки приложения",
     "editEmoji": "Редактировать эмодзи",
     "addEmoji": "Добавить эмодзи",
@@ -1138,10 +1146,6 @@
     "updateTagsTitle": "Сканировать заметки на хештеги и обновить frontmatter",
     "tagsUpdated": "Обработано {processed} файлов, обновлено {updated} с новыми тегами",
     "failedToUpdateTags": "Не удалось обновить теги",
-    "defaultDateFormat": "Формат даты по умолчанию",
-    "defaultDateFormatDescription": "Используется, когда в настройках формата даты пользователя установлено значение «Использовать системное значение по умолчанию».",
-    "defaultTimeFormatDescription": "Используется, когда в настройках формата времени пользователя установлено значение «Использовать системное значение по умолчанию».",
-    "defaultTimeFormat": "Формат времени по умолчанию",
     "borderRadius": "Радиус скругления",
     "borderRadiusDescription": "Задаёт скругление углов во всём экземпляре. Пользователи могут переопределить его в быстрых настройках.",
     "borderRadiusSaved": "Радиус скругления сохранён",
@@ -1157,6 +1161,9 @@
     "tryAgain": "Попробовать снова",
     "contactSupport": "Связаться с поддержкой",
     "invalidInput": "Неверный ввод",
+    "invalidEditorSettings": "Настройки редактора должны быть объектом, ничего не сохранено",
+    "invalidEditorSetting": "У настройки редактора {field} неверный тип, ничего не сохранено",
+    "categoryOutOfBounds": "Эта категория находится за пределами ваших заметок, поэтому ничего не создано",
     "requiredField": "Это поле обязательно",
     "emailInvalid": "Пожалуйста, введите корректный email",
     "passwordTooShort": "Пароль должен содержать минимум 8 символов",
@@ -1164,43 +1171,44 @@
     "networkError": "Ошибка сети",
     "timeout": "Время ожидания истекло",
     "permissionDenied": "Доступ запрещён",
-    "requiredPermissions": "У вас нет необходимых прав для выполнения этого действия.",
+    "requiredPermissions": "У вас нет прав на это действие.",
     "loadError": "Ошибка загрузки",
     "failedToLoadCustomEmojis": "Не удалось загрузить пользовательские эмодзи",
-    "emojiDeletedSuccessfully": "Эмодзи успешно удалён",
+    "emojiDeletedSuccessfully": "Эмодзи удалён",
     "deleteError": "Ошибка удаления",
     "failedToDeleteEmoji": "Не удалось удалить эмодзи",
     "validationError": "Ошибка валидации",
     "keywordAndEmojiRequired": "Ключевое слово и эмодзи обязательны",
     "duplicateKeyword": "Дублирующееся ключевое слово",
     "keywordAlreadyExists": "Ключевое слово уже существует",
-    "emojiUpdatedSuccessfully": "Эмодзи успешно обновлён",
-    "emojiCreatedSuccessfully": "Эмодзи успешно создан",
+    "emojiUpdatedSuccessfully": "Эмодзи обновлён",
+    "emojiCreatedSuccessfully": "Эмодзи создан",
     "saveError": "Ошибка сохранения",
     "failedToSaveEmoji": "Не удалось сохранить эмодзи",
     "failedToLoadCustomCSS": "Не удалось загрузить пользовательский CSS",
     "couldNotLoadCustomCSS": "Не удалось загрузить пользовательский CSS.",
     "couldNotLoadThemes": "Не удалось загрузить темы.",
-    "customCSSSavedSuccessfully": "Пользовательский CSS успешно сохранён.",
+    "customCSSSavedSuccessfully": "Пользовательский CSS сохранён.",
     "themeNotFound": "Тема не найдена.",
-    "themeDeletedSuccessfully": "Тема успешно удалена.",
+    "themeDeletedSuccessfully": "Тема удалена.",
     "themeNameRequired": "Название темы обязательно.",
-    "themeSavedSuccessfully": "Тема {action} успешно.",
+    "themeSavedSuccessfully": "Тема {action}.",
     "anUnknownErrorOccurred": "Произошла неизвестная ошибка.",
     "usernameRequired": "Имя пользователя обязательно",
     "passwordRequired": "Пароль обязателен",
     "passwordMinLength": "Пароль должен содержать минимум 6 символов",
     "passwordsDoNotMatch": "Пароли не совпадают",
-    "userSavedSuccessfully": "Пользователь {mode} успешно!",
+    "userSavedSuccessfully": "Пользователь {mode}.",
     "failedToSaveUser": "Не удалось {mode} пользователя",
     "anErrorOccurred": "Произошла ошибка.",
     "deleteUserConfirmation": "Удалить пользователя \"{username}\"? Это нельзя отменить.",
-    "userDeletedSuccessfully": "Пользователь успешно удалён!",
-    "failedToDeleteUser": "Не удалось удалить пользователя"
+    "userDeletedSuccessfully": "Пользователь удалён.",
+    "failedToDeleteUser": "Не удалось удалить пользователя",
+    "readOnlyFolder": "Эта папка на сервере доступна только для чтения, поэтому изменение не сохранилось."
   },
   "pwa": {
     "installPromptTitle": "Установить приложение",
-    "installPromptMessage": "Установите это приложение на устройство для лучшего опыта",
+    "installPromptMessage": "Установите Jotty на устройство, чтобы он открывался как приложение",
     "installButton": "Установить",
     "updateAvailable": "Доступно обновление",
     "updateMessage": "Доступна новая версия",
@@ -1258,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Переключить режим Rich Editor",
     "toggleMarkdownMode": "Переключить режим Markdown",
+    "quickControls": "Управление редактором",
     "toggleBold": "Переключить жирный",
     "toggleItalic": "Переключить курсив",
     "toggleUnderline": "Переключить подчёркивание",
@@ -1431,16 +1440,16 @@
     "viewNote": "Просмотреть заметку",
     "editNote": "Редактировать заметку",
     "privateKeyWarning": "ВНИМАНИЕ: Ваш закрытый ключ позволяет расшифровать все зашифрованные заметки. Экспортируйте только если понимаете последствия для безопасности. Продолжить?",
-    "publicKeyExported": "Открытый ключ успешно экспортирован",
-    "privateKeyExported": "Закрытый ключ успешно экспортирован",
+    "publicKeyExported": "Открытый ключ экспортирован",
+    "privateKeyExported": "Закрытый ключ экспортирован",
     "failedToExportKey": "Не удалось экспортировать ключ",
     "unexpectedError": "Произошла неожиданная ошибка",
-    "keysDeleted": "Ключи успешно удалены",
+    "keysDeleted": "Ключи удалены",
     "failedToDeleteKeys": "Не удалось удалить ключи",
     "autoDecryptUpdated": "Настройка авторасшифровки обновлена",
     "failedToUpdateSetting": "Не удалось обновить настройку",
-    "enterValidPath": "Пожалуйста, введите корректный путь",
-    "customPathSet": "Пользовательский путь для ключа успешно установлен",
+    "enterValidPath": "Введите корректный путь",
+    "customPathSet": "Пользовательский путь для ключей установлен",
     "failedToSetCustomPath": "Не удалось установить пользовательский путь",
     "thisNoteIsEncrypted": "Эта заметка зашифрована",
     "noteProtectedWith": "Эта заметка защищена шифрованием {type}.",
@@ -1451,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Выберите метод шифрования",
     "encryptionMethodsTitle": "Методы шифрования",
-    "xchachaDescription": "XChaCha20-Poly1305: Современное, быстрое шифрование на основе парольной фразы",
-    "pgpDescription": "PGP: Традиционная криптография с открытым ключом и управлением ключевыми парами",
+    "xchachaDescription": "XChaCha20-Poly1305: шифрование парольной фразой",
+    "pgpDescription": "PGP: шифрование открытым ключом с парой ключей, которой вы управляете",
     "encryptionKeys": "Ключи шифрования",
     "keysConfigured": "Ключи настроены",
     "algorithm": "Алгоритм: ",
@@ -1466,9 +1475,9 @@
     "keysDisabledInDemo": "Сохранённые ключи шифрования отключены в демо-режиме.",
     "encryptionSettings": "Настройки шифрования",
     "promptForPassphrase": "Запрашивать парольную фразу при открытии зашифрованных заметок",
-    "promptForPassphraseDescription": "При включении вам будет предложено ввести парольную фразу при открытии зашифрованной заметки. Заметка останется зашифрованной на сервере, но вы сможете видеть расшифрованное содержимое в текущей сессии.",
+    "promptForPassphraseDescription": "Запрашивает парольную фразу, когда вы открываете зашифрованную заметку. Заметка остаётся зашифрованной на сервере, а расшифрованное содержимое видно только в этой вкладке.",
     "customKeyPath": "Пользовательский путь для ключа (локальные установки)",
-    "customKeyPathDescription": "Укажите пользовательский (абсолютный) путь в файловой системе для хранения ключей шифрования. Это требуется только для локальных установок. Пользователям Docker следует вместо этого указать путь по умолчанию в docker-compose.yml.",
+    "customKeyPathDescription": "Абсолютный путь в файловой системе для ваших ключей шифрования. Нужен только для локальных установок. Пользователям Docker вместо этого стоит смонтировать путь по умолчанию в docker-compose.yml.",
     "customPath": "Пользовательский путь",
     "customPathPlaceholder": "/home/user/my-keys",
     "customPathHelp": "Должен быть абсолютный путь (например, /home/user/my-keys или C:\\Users\\user\\my-keys)",
@@ -1487,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "Содержимое заметки будет зашифровано перед сохранением",
     "passphraseRequired": "Парольная фраза обязательна",
     "incorrectPassphrase": "Неверная парольная фраза",
-    "noteEncryptedSuccessfully": "Заметка успешно зашифрована",
+    "noteEncryptedSuccessfully": "Заметка зашифрована",
     "failedToEncryptNote": "Не удалось зашифровать заметку",
-    "noteDecryptedSuccessfully": "Заметка успешно расшифрована",
+    "noteDecryptedSuccessfully": "Заметка расшифрована",
     "failedToDecryptNote": "Не удалось расшифровать заметку",
     "passphrase": "Парольная фраза",
     "enterYourPassphrase": "Введите парольную фразу",
@@ -1517,8 +1526,8 @@
     "privateKey": "Закрытый ключ",
     "noStoredKeysFound": "Сохранённые ключи не найдены",
     "noEncryptionKeysConfigured": "У вас нет настроенных ключей шифрования",
-    "pastePublicKeyBelow": "Пожалуйста, вставьте открытый ключ ниже для шифрования содержимого заметки",
-    "generateOrImportKeysInProfile": "Вы можете сгенерировать или импортировать конкретные ключи для Jotty в Профиль → Шифрование",
+    "pastePublicKeyBelow": "Вставьте открытый ключ ниже, чтобы зашифровать содержимое заметки",
+    "generateOrImportKeysInProfile": "Сгенерировать или импортировать ключи для Jotty можно в Профиль > Шифрование",
     "useCustomKey": "Использовать пользовательский ключ {keyType}",
     "signWithPrivateKey": "Подписать закрытым ключом",
     "proveAuthenticityOfNote": "подтвердить подлинность этой заметки",
@@ -1538,7 +1547,7 @@
     "yourEmail": "user@email.com",
     "generating": "Генерация...",
     "generateKeys": "Сгенерировать ключи",
-    "keysGeneratedSuccessfully": "Ключи успешно сгенерированы",
+    "keysGeneratedSuccessfully": "Ключи сгенерированы",
     "importPGPKeys": "Импортировать ключи PGP",
     "publicKeyLabel": "Открытый ключ",
     "privateKeyLabel": "Закрытый ключ",
@@ -1547,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Запомните парольную фразу! Её нельзя восстановить.",
     "withoutPassphraseCannotDecrypt": "Без парольной фразы вы не сможете расшифровать свои заметки.",
     "backupPrivateKeySafely": "Безопасно сохраните закрытый ключ.",
-    "pgpKeyPairGeneratedSuccessfully": "Ключевая пара PGP успешно сгенерирована",
+    "pgpKeyPairGeneratedSuccessfully": "Пара ключей PGP сгенерирована",
     "failedToGenerateKeys": "Не удалось сгенерировать ключи",
     "fingerprint": "Отпечаток",
     "keysSavedSecurely": "Ваши ключи были безопасно сохранены.",
@@ -1561,13 +1570,13 @@
     "bothKeysRequired": "Оба ключа (открытый и закрытый) обязательны",
     "invalidPublicKeyFormat": "Неверный формат открытого ключа. Должен быть ASCII-armored PGP-ключ.",
     "invalidPrivateKeyFormat": "Неверный формат закрытого ключа. Должен быть ASCII-armored PGP-ключ.",
-    "keysImportedSuccessfully": "Ключи успешно импортированы",
+    "keysImportedSuccessfully": "Ключи импортированы",
     "failedToImportKeys": "Не удалось импортировать ключи",
     "created": "Шифрование создано",
     "notePlaceholder": "Я заполнитель, потому что пустую заметку невозможно зашифровать."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Эти параметры применяются только к текущей сессии браузера. Для постоянных настройек проверьте ваши",
+    "sessionOnlyPrefix": "Эти параметры действуют только в этой сессии браузера. Постоянные настройки находятся в",
     "accountSettings": "настройки пользователя",
     "autosaveNotes": "Автосохранение заметок",
     "showNotePreview": "Показывать предпросмотр заметки на карточках",
@@ -1596,20 +1605,45 @@
     "migrationSuccessful": "Миграция успешна",
     "returnToApp": "Вернуться в приложение",
     "adminAccessRequired": "Требуется доступ администратора",
-    "adminAccessDescription": "Для этой миграции требуются права администратора. Пожалуйста, свяжитесь с администратором для выполнения системной миграции.",
+    "adminAccessDescription": "Для этой миграции нужен администратор. Попросите его запустить её.",
     "whatsHappening": "Что происходит?",
-    "sharingDataMigrationDescription": "Системе нужно перенести ваши данные доступа. Это одноразовый процесс, требующий прав администратора.",
+    "sharingDataMigrationDescription": "Jotty нужно перенести ваши данные доступа. Это делается один раз и требует администратора.",
     "whatsChanging": "Что меняется?",
     "automaticBackupIncluded": "Включено автоматическое резервное копирование",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter - отраслевой стандарт",
-    "noMigrationNeeded": "Миграция не требовалась - ваша система уже обновлена.",
-    "importantBackupData": "Важно: Создайте резервную копию данных"
+    "noMigrationNeeded": "Переносить нечего, ваши данные уже актуальны.",
+    "importantBackupData": "Важно: Создайте резервную копию данных",
+    "sharingNowWithData": "Данные доступа теперь хранятся вместе с вашими заметками и папками.",
+    "sharingMovesDescription": "Доступ переезжает из общего файла в ваши данные. Папками теперь можно делиться, а общие папки появляются в вашей боковой панели, а не в отдельном разделе.",
+    "whatsHappeningBody": "Каждая запись из <code>.sharing.json</code> записывается во frontmatter элемента, к которому относится, а каждая папка получает <code>.category-info.json</code> с её идентификатором, доступом и порядком. Старые файлы удаляются, когда данные перенесены.",
+    "migrationChanges": "Изменения миграции",
+    "sharingTravelsTitle": "Доступ хранится вместе с файлом",
+    "sharingTravelsBody": "Каждый общий элемент хранит в своём frontmatter, с кем им поделились, поэтому перемещение или переименование никогда не ломает доступ.",
+    "folderSharingTitle": "Общие папки",
+    "folderSharingBody": "Поделитесь папкой, и всё внутри неё, сейчас и в будущем, тоже станет общим. Получатели видят её как обычную папку в своей боковой панели.",
+    "oneFilePerFolderTitle": "Один файл на папку",
+    "oneFilePerFolderBody": "<code>.order.json</code> входит в <code>.category-info.json</code>, а порядок хранится по uuid, а не по имени файла.",
+    "permissionsUnchangedTitle": "Права не меняются",
+    "permissionsUnchangedBody": "Чтение, редактирование и удаление переносятся ровно в том виде, в каком они есть сейчас, для каждого пользователя и каждого элемента.",
+    "backupWarningBody": "Эта миграция переписывает frontmatter в ваших заметках и чеклистах и удаляет старые файлы <code>.sharing.json</code> и <code>.order.json</code>. Сделайте резервную копию папки <code>data</code>, прежде чем продолжить.",
+    "backupConfirmLabel": "Я сделал(а) резервную копию папки data и понимаю, как проходит миграция.",
+    "backupConfirmHint": "Подтвердите, что у вас есть резервная копия, прежде чем продолжить.",
+    "sharingDataMigrated": "Ваши данные доступа и порядка перенесены.",
+    "whatWasChanged": "Что изменилось:",
+    "migrationPartial": "Миграция завершена, но остались файлы",
+    "leftoversTitle": "Часть старых файлов сохранена",
+    "leftoversBody": "Миграция не смогла перенести всё, поэтому старые файлы ниже остались на диске нетронутыми. Ничего не удалено. Можно устранить причину и запустить миграцию снова или перейти в приложение сейчас и разобраться позже.",
+    "overrideConfirmLabel": "Всё равно продолжить и больше не показывать эту страницу.",
+    "overrideConfirmHint": "Оставшиеся файлы останутся на диске, но приложение будет считать ваши данные перенесёнными. Доступ и порядок из списка выше не применятся, пока вы не запустите миграцию снова. Это можно сделать в любой момент по адресу /migration?force=1.",
+    "continueAnyway": "Всё равно продолжить",
+    "overriding": "Продолжаем...",
+    "overrideFailed": "Не удалось пропустить миграцию"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Категория успешно переименована",
+    "categoryRenamedSuccessfully": "Категория переименована",
     "failedToRenameCategory": "Не удалось переименовать категорию",
     "categoryRenamedSuccessfullyMessage": "Категория {categoryName} переименована в {newName}",
-    "failedToRenameCategoryMessage": "Произошла ошибка при переименовании категории."
+    "failedToRenameCategoryMessage": "Что-то пошло не так при переименовании категории."
   },
   "auditLogs": {
     "title": "Журналы аудита",
@@ -1626,17 +1660,17 @@
     "exportJSON": "Экспорт JSON",
     "exportCSV": "Экспорт CSV",
     "cleanupOldLogs": "Очистить старые журналы",
-    "confirmCleanup": "Вы уверены, что хотите удалить журналы старше {days} дней? Это затронет ВСЕХ пользователей и не может быть отменено.",
+    "confirmCleanup": "Удалить журналы старше {days} дней? Это затронет ВСЕХ пользователей и не может быть отменено.",
     "confirmCleanupUnlimited": "Автоматическая очистка не настроена (неограниченное хранение). Вы всё ещё можете вручную удалять старые журналы.",
     "deleteAllLogsModalTitle": "Удалить все журналы аудита",
     "deleteAllLogsWarning": "Это удалит ВСЕ журналы, не только старые",
     "deleteAllLogsWarningDescription": "Вся история журналов аудита будет стёрта из системы.",
     "deletingAllLogs": "Удаление всех журналов...",
     "deleteAllLogsButton": "Удалить все журналы",
-    "cleanupSuccess": "Успешно удалено {count} старых файлов журналов",
+    "cleanupSuccess": "Удалено старых файлов журналов: {count}",
     "cleanupError": "Не удалось очистить старые журналы",
-    "userDescription": "Просмотрите всю вашу активность и действия в системе",
-    "adminDescription": "Просматривайте и управляйте всей активностью пользователей в системе",
+    "userDescription": "Всё, что вы делали в Jotty",
+    "adminDescription": "Что делал каждый пользователь в этом экземпляре",
     "level": "Уровень",
     "allLevels": "Все уровни",
     "allCategories": "Все категории",
@@ -1700,9 +1734,9 @@
     "topActions": "Популярные действия",
     "mostActiveUsers": "Самые активные пользователи",
     "oldLogsFound": "Есть {count} файлов журналов старше {days} дней.",
-    "oldLogsFoundDescription": "Хотите их очистить? Это действие нельзя отменить.",
+    "oldLogsFoundDescription": "Очистить их? Это нельзя отменить.",
     "cleanUpNow": "Очистить сейчас",
-    "cleanupSuccessMessage": "Успешно удалено {count} старых файлов журналов.",
+    "cleanupSuccessMessage": "Удалено старых файлов журналов: {count}.",
     "security": "Безопасность",
     "mfasecretgenerated": "Секрет MFA сгенерирован",
     "mfaenabled": "MFA включён",
@@ -1718,6 +1752,7 @@
     "howTo": "Как",
     "shortcuts": "Горячие клавиши",
     "markdownGuide": "Руководство по Markdown",
+    "brain": "Ссылки и Мозг",
     "customisations": "Кастомизации",
     "docker": "Docker",
     "envVariables": "Переменные окружения",
@@ -1725,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "Шифрование",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Переводы",
     "unraid": "Unraid",
     "patches": "Патчи"
@@ -1738,6 +1774,7 @@
   },
   "notifications": {
     "title": "Уведомления",
+    "unread": "непрочит.",
     "markAllRead": "Отметить все прочитанными",
     "clearAll": "Очистить все",
     "empty": "Нет уведомлений",
@@ -1745,12 +1782,99 @@
     "assignmentMessage": "«{task}» на «{board}»",
     "reminderTitle": "Задача просрочена",
     "reminderMessage": "Напоминание о задаче \"{task}\" на \"{board}\" прошло.",
-    "unread": "непрочит.",
     "sharingTitle": "{user} поделился(-ась) с вами: {type}",
     "sharingMessage": "Откройте, чтобы посмотреть общий {type}",
     "sharingFolderTitle": "{user} поделился(-ась) с вами папкой: {type}",
     "sharingFolderMessage": "Откройте, чтобы посмотреть «{folder}»",
     "mentionTitle": "{user} упомянул вас в комментарии",
     "mentionMessage": "«{board}»"
+  },
+  "relations": {
+    "indexing": "Индексация связей...",
+    "unreachable": "недоступно",
+    "createFromWikilink": "Создать заметку «{title}»",
+    "mentionedIn": "Упоминается в",
+    "mentionedInHint": "В этих заметках это название встречается как обычный текст. Превратите упоминание в ссылку, чтобы связать их.",
+    "linkMention": "Связать",
+    "linked": "Упоминание в {title} стало ссылкой",
+    "linkFailed": "Не удалось связать это упоминание",
+    "kind": {
+      "mention": "Ссылка",
+      "wiki": "Вики-ссылка"
+    }
+  },
+  "brain": {
+    "title": "Мозг",
+    "openBrain": "Открыть в мозге",
+    "search": "Найти что-нибудь в мозге...",
+    "dimension": "Вид",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Вокруг этого элемента",
+    "global": "Всё",
+    "depth": "Глубина {depth}",
+    "colourBy": "Цвет по",
+    "colourModes": {
+      "type": "Типу",
+      "category": "Категории"
+    },
+    "filters": {
+      "notes": "Заметки",
+      "checklists": "Чеклисты",
+      "tags": "Теги",
+      "ghosts": "Ещё не написано",
+      "suggestions": "Предложения",
+      "orphans": "Одиночки"
+    },
+    "kind": {
+      "note": "Заметка",
+      "checklist": "Чеклист",
+      "ghost": "Ещё не написано",
+      "tag": "Тег"
+    },
+    "edges": {
+      "mention": "Ссылка",
+      "wiki": "Вики-ссылка",
+      "suggested": "Предложено",
+      "tag": "Тег"
+    },
+    "linksTo": "Ссылается на",
+    "linkedFrom": "Ссылки сюда",
+    "suggested": "Возможно, связано",
+    "promote": "Связать с {title}",
+    "lonely": "Здесь пока ничего не связано. Упомяните это через @ или [[ в другой заметке.",
+    "open": "Открыть",
+    "createGhost": "Написать эту заметку",
+    "openTag": "Показать всё с этим тегом",
+    "createFailed": "Не удалось создать эту заметку",
+    "connectFailed": "Не удалось связать эти два элемента",
+    "connected": "{source} связан(а) с {target}",
+    "empty": "В вашем мозге пока тихо. Связывайте заметки и чеклисты через @ или [[, и они появятся здесь.",
+    "viewingOwner": "Мозг пользователя {owner}",
+    "summary": "Элементов: {items}, ссылок: {links}, показано: {shown}"
+  },
+  "apiExplorer": {
+    "title": "Обозреватель API",
+    "intro": "Все эндпоинты этого экземпляра (v{version}), сгенерированные из кода, который их обслуживает. Выберите один, заполните и отправьте.",
+    "realData": "Запросы выполняются от имени владельца API-ключа на реальных данных. DELETE здесь удаляет по-настоящему.",
+    "apiKey": "API-ключ",
+    "apiKeyHint": "Хранится только на этой странице и забывается, когда вы уходите.",
+    "useMyKey": "Использовать мой ключ",
+    "noKeyYet": "У вас ещё нет API-ключа. Создайте его в настройках профиля.",
+    "filter": "Фильтр",
+    "filterPlaceholder": "Путь, название или метод",
+    "noMatches": "Под этот фильтр ничего не подходит.",
+    "body": "Тело запроса (JSON)",
+    "showSchema": "Показать схему",
+    "hideSchema": "Скрыть схему",
+    "send": "Отправить",
+    "sending": "Отправка...",
+    "keyRequired": "Сначала добавьте API-ключ.",
+    "noKeyNeeded": "API-ключ не нужен",
+    "deprecated": "устарело",
+    "requestFailed": "Запрос не дошёл до сервера. Проверьте соединение.",
+    "responseMeta": "{status} за {ms} мс"
   }
 }
diff --git a/app/_translations/tr.json b/app/_translations/tr.json
index bfe25e02f..4bb265a55 100644
--- a/app/_translations/tr.json
+++ b/app/_translations/tr.json
@@ -101,7 +101,7 @@
     "deleteFile": "Dosyayı sil",
     "fileTooLarge": "Dosya çok büyük. Maksimum boyut {maxSizeMB}MB. Dosyanız {fileSizeMB}MB.",
     "uploadFailed": "Yükleme başarısız",
-    "uploadFailedRetry": "Yükleme başarısız oldu. Lütfen tekrar deneyin.",
+    "uploadFailedRetry": "Yükleme başarısız oldu. Tekrar deneyin.",
     "failedToDeleteFile": "Dosya silinemedi",
     "previousMonth": "Önceki ay",
     "nextMonth": "Gelecek ay",
@@ -127,13 +127,14 @@
     "expandAll": "Tümünü genişlet",
     "saveChanges": "Değişiklikleri Kaydet",
     "all": "Hepsi",
+    "items": "Öğeler",
     "showAll": "Tümünü göster",
     "creating": "Oluşturuluyor...",
     "createCategoryHeader": "Yeni bir kategori oluştur",
     "parentCategory": "Üst Kategori (İsteğe Bağlı)",
     "noParent": "Üst kategori yok (kök seviye)",
     "categoryNamePlaceholder": "Kategori adını girin...",
-    "notAllowedName": "{name} ismine izin verilmiyor. Lütfen farklı bir isim seçin.",
+    "notAllowedName": "{name} ismine izin verilmiyor. Farklı bir isim seçin.",
     "createCategory": "Kategori oluştur",
     "selectCategory": "Kategori seçin...",
     "categoryWillBeCreatedIn": "Yeni kategori şurada oluşturulacak:",
@@ -173,7 +174,7 @@
     "noResults": "Sonuç yok",
     "by": "{owner} tarafından",
     "unsavedChanges": "Kaydedilmemiş Değişiklikler",
-    "unsavedChangesDetected": "⚠️ Kaydedilmemiş Değişiklikler Tespit Edildi",
+    "unsavedChangesDetected": "Kaydedilmemiş değişiklikler",
     "unsavedChangesMessage": "{noteTitle} başlığında kaydedilmemiş değişiklikleriniz var. Şimdi ayrılırsanız değişiklikleriniz kaybolacak.",
     "whatToDoWithUnsavedChanges": "Kaydedilmemiş değişikliklerinizle ne yapmak istersiniz?",
     "discard": "Vazgeç",
@@ -243,40 +244,13 @@
     "restoring": "Geri yükleniyor...",
     "retry": "Tekrar Dene",
     "copiedToClipboard": "Panoya kopyalandı",
-    "hide": "Gizle",
-    "items": "Öğeler",
-    "connected": "Bağlı",
     "offline": "Çevrimdışı",
+    "connected": "Bağlı",
     "reconnecting": "Yeniden bağlanıyor...",
+    "hide": "Gizle",
     "thisEntry": "bu giriş",
     "preview": "Önizleme"
   },
-  "comments": {
-    "title": "Yorumlar",
-    "titleWithCount": "{count, plural, one {# Yorum} other {# Yorum}}",
-    "noComments": "Henüz yorum yok. Sohbeti başlatın!",
-    "addComment": "Yorum ekle...",
-    "replyPlaceholder": "Yanıt yaz...",
-    "post": "Gönder",
-    "reply": "Yanıtla",
-    "edit": "Düzenle",
-    "delete": "Sil",
-    "save": "Kaydet",
-    "cancel": "İptal",
-    "edited": "düzenlendi",
-    "deleteConfirmTitle": "Yorum silinsin mi?",
-    "deleteConfirmMessage": "Bu, yorumu ve tüm yanıtları siler. Bu işlem geri alınamaz.",
-    "commentDeleted": "Yorum silindi",
-    "commentAdded": "Yorum eklendi",
-    "commentUpdated": "Yorum güncellendi",
-    "failedToAdd": "Yorum eklenemedi",
-    "failedToEdit": "Yorum düzenlenemedi",
-    "failedToDelete": "Yorum silinemedi",
-    "failedToLoad": "Yorumlar yüklenemedi",
-    "readOnly": "Bu karta yorum yapmak için düzenleme erişimi gerekir.",
-    "replyTo": "{author} kullanıcısına yanıtla",
-    "noUsersFound": "Kullanıcı bulunamadı"
-  },
   "history": {
     "noteHistory": "Not Geçmişi",
     "restore": "Geri Yükle",
@@ -286,10 +260,10 @@
     "noHistoryDescription": "Bir geçmiş noktası oluşturmak için notunuzu kaydedin.",
     "loadMore": "Daha Fazla Yükle",
     "featureDisabled": "Geçmiş Devre Dışı",
-    "disabledAdmin": "Not geçmişi şu anda devre dışı. Yönetici Ayarları > Düzenleyici kısmından etkinleştirebilirsiniz.",
-    "disabledUser": "Not geçmişi şu anda devre dışı. Lütfen bu özelliği etkinleştirmesi için yöneticinizle iletişime geçin.",
+    "disabledAdmin": "Not geçmişi kapalı. Yönetici Ayarları > Düzenleyici kısmından açabilirsiniz.",
+    "disabledUser": "Not geçmişi kapalı. Açması için yöneticinize başvurun.",
     "goToSettings": "Ayarlara Git",
-    "manualSavesOnly": "Geçmiş yalnızca manuel kayıtlarda oluşturulur, otomatik kayıtlarda değil.",
+    "manualSavesOnly": "Geçmişi yalnızca manuel kayıtlar oluşturur. Otomatik kayıt oluşturmaz.",
     "fetchError": "Geçmiş yüklenemedi",
     "restoreError": "Sürüm geri yüklenemedi",
     "viewContent": "İçeriği Görüntüle",
@@ -321,7 +295,7 @@
     "sessionExpired": "Oturumunuzun süresi doldu",
     "setupComplete": "Kurulum tamamlandı",
     "createAccount": "Hesabınızı oluşturun",
-    "errorOccurred": "Bir hata oluştu. Lütfen tekrar deneyin.",
+    "errorOccurred": "Bir şeyler ters gitti. Tekrar deneyin.",
     "enterUsername": "Kullanıcı adınızı girin",
     "enterPassword": "Şifrenizi girin",
     "chooseUsername": "Bir kullanıcı adı seçin",
@@ -334,8 +308,8 @@
     "version": "Sürüm {version}",
     "createUser": "Kullanıcı Oluştur",
     "attemptsRemaining": "Uyarı: Hesabın kilitlenmesine {count, plural, one {# deneme} other {# deneme}} kaldı",
-    "accountLocked": "Çok fazla hatalı deneme. Lütfen {seconds} {seconds, plural, one {saniye} other {saniye}} sonra tekrar deneyin",
-    "notAuthorized": "Bu uygulamaya erişim yetkiniz yok. Lütfen yöneticinizle iletişime geçin.",
+    "accountLocked": "Çok fazla hatalı deneme. {seconds} {seconds, plural, one {saniye} other {saniye}} sonra tekrar deneyin",
+    "notAuthorized": "Bu uygulamaya erişiminiz yok. Yöneticinize başvurun.",
     "rememberMe": "Beni hatırla"
   },
   "mfa": {
@@ -360,9 +334,9 @@
     "invalidCode": "Geçersiz doğrulama kodu",
     "invalidRecoveryCode": "Geçersiz kurtarma kodu",
     "mfaRequired": "İki faktörlü doğrulama gereklidir",
-    "mfaEnabledSuccess": "İki faktörlü doğrulama başarıyla etkinleştirildi",
+    "mfaEnabledSuccess": "İki faktörlü doğrulama etkinleştirildi",
     "mfaDisabledSuccess": "İki faktörlü doğrulama devre dışı bırakıldı",
-    "tooManyAttempts": "Çok fazla başarısız deneme. Lütfen daha sonra tekrar deneyin.",
+    "tooManyAttempts": "Çok fazla başarısız deneme. Daha sonra tekrar deneyin.",
     "disableTitle": "İki Faktörlü Doğrulamayı Devre Dışı Bırak",
     "disableDescription": "İki faktörlü doğrulamayı devre dışı bırakmayı onaylamak için 2FA kodunuzu girin",
     "disableWarning": "Bu işlem hesabınızı daha az güvenli hale getirecektir. Emin misiniz?",
@@ -382,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Bu işlem mevcut kurtarma kodunuzu geçersiz kılacaktır",
     "regenerateRecoveryCodeDescription": "Yeni bir kurtarma kodu oluşturmak için 2FA kodunuzu girin. Eski kodunuz artık çalışmayacaktır.",
     "recoveryCodeRegenerated": "Yeni Kurtarma Kodu Oluşturuldu",
-    "recoveryCodeRegeneratedInfo": "Yeni kurtarma kodunuz oluşturuldu. Bunu güvenli bir yerde saklayın - bu kodu yalnızca bir kez göreceksiniz.",
-    "recoveryCodeRegeneratedSuccess": "Kurtarma kodu başarıyla yeniden oluşturuldu",
+    "recoveryCodeRegeneratedInfo": "Yeni kurtarma kodunuz hazır. Güvenli bir yerde saklayın, bu kodu yalnızca şimdi göreceksiniz.",
+    "recoveryCodeRegeneratedSuccess": "Kurtarma kodu yeniden oluşturuldu",
     "recoveryCodeProfileDescription": "Doğrulama uygulamanıza erişimi kaybederseniz bu kodu hesap kurtarma için kullanın",
     "disableMfaForUser": "Bu kullanıcı için 2FA'yı devre dışı bırak",
     "recoveryCodeRequired": "Kurtarma kodu gereklidir",
@@ -397,7 +371,7 @@
     "recent": "Son Kullanılanlar",
     "browseAndManage": "Tüm notlarınıza göz atın ve yönetin",
     "noNotesYet": "Henüz not yok",
-    "createFirstNote": "Bilgi tabanınızı oluşturmaya başlamak için ilk notunuzu yazın.",
+    "createFirstNote": "Burada henüz bir şey yok. İlk notunuzu oluşturun.",
     "createNewNote": "Yeni Not Oluştur",
     "noNotesFound": "Not bulunamadı",
     "tryAdjustingFilters": "Filtrelerinizi ayarlamayı deneyin veya yeni bir not oluşturun.",
@@ -428,22 +402,26 @@
     "enterNoteTitle": "Not başlığını girin...",
     "byType": "Türe göre",
     "publiclySharedNote": "Herkese açık paylaşıldı",
+    "sharedPubliclyBy": "Bu not {owner} tarafından herkese açık paylaşılıyor",
     "copyRawContent": "Markdown olarak kopyala",
     "quickSave": "Hızlı Kaydet",
     "noteNotFound": "Not bulunamadı",
     "unarchiveNote": "Notu Arşivden Çıkar",
     "enterNoteName": "Not adını girin...",
     "updateNote": "Notu Güncelle",
-    "tags": "Etiketler",
-    "noTagsFound": "Etiket bulunamadı",
-    "searchTags": "Etiketlerde ara...",
     "printSaveAsPdf": "Yazdır / PDF olarak kaydet",
     "tableOfContents": "İçindekiler",
     "wordCount": "{count, plural, one {# kelime} other {# kelime}}",
     "charCount": "{count, plural, one {# karakter} other {# karakter}}",
-    "readingTime": "{count, plural, one {# dakika okuma} other {# dakika okuma}}"
+    "readingTime": "{count, plural, one {# dakika okuma} other {# dakika okuma}}",
+    "tags": "Etiketler",
+    "noTagsFound": "Etiket bulunamadı",
+    "searchTags": "Etiketlerde ara...",
+    "createNoteFailed": "Not oluşturulamadı",
+    "createCategoryFailed": "Kategori oluşturulamadı, bu yüzden not da oluşturulmadı"
   },
   "checklists": {
+    "sharedPubliclyBy": "Bu liste {owner} tarafından herkese açık paylaşılıyor",
     "title": "Listeleri",
     "allChecklists": "Tüm Listeleri",
     "completed": "Tamamlandı",
@@ -457,7 +435,7 @@
     "progress": "İlerleme",
     "totalItems": "Toplam Öğe",
     "noChecklistsYet": "Henüz Kontrol Listesi yok",
-    "createFirstChecklist": "Görevlerinizi düzenlemeye başlamak için ilk kontrol listenizi oluşturun.",
+    "createFirstChecklist": "Burada henüz bir şey yok. İlk kontrol listenizi oluşturun.",
     "newChecklist": "Yeni Kontrol Listesi",
     "noChecklistsFound": "Kontrol listesi bulunamadı",
     "tryAdjustingFiltersChecklist": "Filtrelerinizi ayarlamayı deneyin veya yeni bir kontrol listesi oluşturun.",
@@ -499,6 +477,7 @@
     "checklistType": "Kontrol Listesi Türü",
     "simpleChecklist": "Basit Kontrol Listesi",
     "taskProject": "Görev Projesi",
+    "kanbanBoard": "Kanban panosu",
     "basicTodoItems": "Temel yapılacaklar",
     "withTimeTracking": "Zaman takibi ile",
     "noDescription": "Açıklama yok",
@@ -525,23 +504,24 @@
     "clearAllCompletedConfirmMessage": "Tüm {count} tamamlanmış ögeyi ve alt ögelerini silmek istediğinizden emin misiniz? Bu işlem geri alınamaz.",
     "clearAllIncompleteConfirmMessage": "Tüm {count} tamamlanmamış ögeyi ve alt ögelerini silmek istediğinizden emin misiniz? Bu işlem geri alınamaz.",
     "convertChecklistType": "Kontrol Listesi Türünü Dönüştür",
-    "convertTypeConfirmation": "{currentType} türünden {newType} türüne dönüştürmek üzeresiniz. Devam etmek istediğinizden emin misiniz?",
-    "dataLossWarning": "⚠️ Veri Kaybı Uyarısı",
+    "convertTypeConfirmation": "{currentType} türünden {newType} türüne dönüştürülsün mü?",
+    "dataLossWarning": "Veri kaybı uyarısı",
     "dataLossWarningItems": "Aşağıdaki veriler kaybolacaktır:",
     "allTaskStatusesReset": "Tüm görev durumları sıfırlanacak",
     "timeTrackingDataLost": "Zaman takibi verileri kaybolacak",
     "estimatedTimesRemoved": "Tahmini süreler kaldırılacak",
     "targetDatesCleared": "Hedef tarihler temizlenecek",
-    "enhancedFeatures": "✨ Gelişmiş Özellikler",
+    "enhancedFeatures": "Neler kazanırsınız",
     "enhancedFeaturesYouWillGain": "Kazanacağınız özellikler:",
     "kanbanBoardWithDragDrop": "Sürükle ve bırak özellikli Kanban panosu",
     "taskStatusTracking": "Görev durumu takibi (Yapılacak, Devam Ediyor vb.)",
     "timeTrackingWithTimer": "Dahili zamanlayıcı ile zaman takibi",
-    "actionCannotBeUndone": "Bu işlem geri alınamaz. Dönüştürmek istediğinizden emin misiniz?",
+    "actionCannotBeUndone": "Bu işlem geri alınamaz. Yine de dönüştürülsün mü?",
     "convertAndLoseData": "Dönüştür ve Verileri Sil",
     "convert": "Dönüştür",
     "convertToSimpleChecklist": "Basit kontrol listesine dönüştür",
     "convertToTaskProject": "Görev projesine dönüştür",
+    "convertToKanbanBoard": "Kanban panosuna dönüştür",
     "pasteYourList": "Listenizi yapıştırın (her satıra bir öge)",
     "addItems": "{count} Öge Ekle",
     "itemsWillBeAdded": "{count} öge eklenecek",
@@ -550,11 +530,35 @@
     "noItemsYet": "Henüz öge yok",
     "addFirstItem": "Başlamak için ilk ögenizi ekleyin!",
     "noTasks": "Görev yok",
-    "noSubtasksYet": "Henüz alt görev yok. Başlamak için aşağıdan bir tane ekleyin.",
+    "noSubtasksYet": "Henüz alt görev yok. Aşağıdan bir tane ekleyin.",
     "addTime": "Süre Ekle",
-    "enterTimeInMinutes": "Süreyi dakika cinsinden girin",
-    "convertToKanbanBoard": "Kanban panosuna dönüştür",
-    "kanbanBoard": "Kanban panosu"
+    "enterTimeInMinutes": "Süreyi dakika cinsinden girin"
+  },
+  "comments": {
+    "title": "Yorumlar",
+    "titleWithCount": "{count, plural, one {# Yorum} other {# Yorum}}",
+    "noComments": "Henüz yorum yok. Sohbeti başlatın!",
+    "addComment": "Yorum ekle...",
+    "replyPlaceholder": "Yanıt yaz...",
+    "post": "Gönder",
+    "reply": "Yanıtla",
+    "edit": "Düzenle",
+    "delete": "Sil",
+    "save": "Kaydet",
+    "cancel": "İptal",
+    "edited": "düzenlendi",
+    "deleteConfirmTitle": "Yorum silinsin mi?",
+    "deleteConfirmMessage": "Bu, yorumu ve tüm yanıtları siler. Bu işlem geri alınamaz.",
+    "commentDeleted": "Yorum silindi",
+    "commentAdded": "Yorum eklendi",
+    "commentUpdated": "Yorum güncellendi",
+    "failedToAdd": "Yorum eklenemedi",
+    "failedToEdit": "Yorum düzenlenemedi",
+    "failedToDelete": "Yorum silinemedi",
+    "failedToLoad": "Yorumlar yüklenemedi",
+    "readOnly": "Bu karta yorum yapmak için düzenleme erişimi gerekir.",
+    "replyTo": "{author} kullanıcısına yanıtla",
+    "noUsersFound": "Kullanıcı bulunamadı"
   },
   "tasks": {
     "title": "Görevler",
@@ -583,7 +587,7 @@
     "overdue": "Gecikmiş",
     "browseAndManageTaskLists": "Tüm görev listelerinize göz atın ve yönetin",
     "noTaskListsYet": "Henüz görev listesi yok",
-    "createFirstTaskList": "Projelerinizi yönetmeye başlamak için ilk görev listenizi oluşturun.",
+    "createFirstTaskList": "Burada henüz bir şey yok. İlk görev listenizi oluşturun.",
     "newTaskList": "Yeni Görev Listesi",
     "taskLists": "Görev Listeleri",
     "noTaskListsFound": "Görev listesi bulunamadı",
@@ -631,7 +635,7 @@
     "changeStatus": "Durumu değiştir",
     "noBoards": "Pano bulunamadı",
     "noBoardsYet": "Henüz Kanban panosu yok",
-    "createFirstBoard": "Projelerinizi yönetmek için ilk Kanban panonuzu oluşturun.",
+    "createFirstBoard": "Burada henüz bir şey yok. İlk Kanban panonuzu oluşturun.",
     "newBoard": "Yeni pano",
     "tryAdjustingFilters": "Filtrelerinizi ayarlayın veya yeni bir pano oluşturun.",
     "completed": "Tamamlandı",
@@ -684,7 +688,7 @@
     "quickSettingsHeader": "Hızlı ayarlar (sadece bu cihaz)",
     "adminSettings": "Yönetici Paneli",
     "apiKey": "API Anahtarı",
-    "apiKeyDescription": "Listelerinize ve notlarınıza programlı erişim için bir API anahtarı oluşturun",
+    "apiKeyDescription": "Betiklerin ve uygulamaların listelerinize ve notlarınıza erişebilmesi için bir API anahtarı oluşturun",
     "hideApiKey": "API Anahtarını Gizle",
     "showApiKey": "API Anahtarını Göster",
     "copyApiKey": "API Anahtarını Kopyala",
@@ -702,15 +706,15 @@
     "removeAvatar": "Avatarı Kaldır",
     "usernameRequired": "Kullanıcı adı gereklidir",
     "passwordsDoNotMatch": "Yeni şifreler eşleşmiyor",
-    "profileUpdated": "Profil başarıyla güncellendi!",
+    "profileUpdated": "Profil güncellendi",
     "failedToUpdateProfile": "Profil güncellenemedi",
-    "failedToUpdateProfileRetry": "Profil güncellenemedi. Lütfen tekrar deneyin.",
-    "avatarUpdated": "Avatar başarıyla güncellendi!",
+    "failedToUpdateProfileRetry": "Profil güncellenemedi. Tekrar deneyin.",
+    "avatarUpdated": "Avatar güncellendi",
     "failedToUpdateAvatar": "Avatar güncellenemedi",
-    "failedToUpdateAvatarRetry": "Avatar güncellenemedi. Lütfen tekrar deneyin.",
-    "avatarRemoved": "Avatar başarıyla kaldırıldı!",
+    "failedToUpdateAvatarRetry": "Avatar güncellenemedi. Tekrar deneyin.",
+    "avatarRemoved": "Avatar kaldırıldı",
     "failedToRemoveAvatar": "Avatar kaldırılamadı",
-    "failedToRemoveAvatarRetry": "Avatar kaldırılamadı. Lütfen tekrar deneyin.",
+    "failedToRemoveAvatarRetry": "Avatar kaldırılamadı. Tekrar deneyin.",
     "activeSessions": "Aktif Oturumlar",
     "activeSession": "{count} aktif oturum",
     "activeSession_plural": "{count} aktif oturum",
@@ -728,11 +732,11 @@
     "auditLogsTab": "Kullanıcı günlükleri",
     "rebuildLinkIndexes": "Bağlantı verilerini güncellemek için indeksleri yeniden oluşturun",
     "rebuildingLinkIndex": "Bağlantı indeksi yeniden oluşturuluyor...",
-    "successfullyRebuiltIndex": "Bağlantı indeksi başarıyla yeniden oluşturuldu",
-    "successfullyRebuiltIndexReload": "Bağlantı indeksi başarıyla oluşturuldu! Güncellenmiş bağlantıları görmek için sayfa yenilenecek.",
-    "failedToRebuildIndex": "Bağlantı indeksi yeniden oluşturulamadı. Lütfen tekrar deneyin.",
+    "successfullyRebuiltIndex": "Bağlantı indeksi yeniden oluşturuldu",
+    "successfullyRebuiltIndexReload": "Bağlantı indeksi yeniden oluşturuldu. Yeni bağlantıları göstermek için sayfa yenilenecek.",
+    "failedToRebuildIndex": "Bağlantı indeksi yeniden oluşturulamadı. Tekrar deneyin.",
     "contentLinks": "İçerik Bağlantıları",
-    "visualizeRelationships": "Notlarınız ve listeleriniz arasındaki ilişkileri görselleştirin",
+    "visualizeRelationships": "Notlarınızın ve listelerinizin birbirine nasıl bağlandığını görün",
     "connectedItems": "Bağlantılı Öğeler",
     "noLinksFound": "Bağlantı Bulunamadı",
     "startCreatingInternalLinks": "Bağlantı ağını burada görmek için notlarınızda `@` yazarak iç bağlantılar oluşturmaya başlayın.",
@@ -743,8 +747,8 @@
     "isolated": "izole edilmiş",
     "connection": "bağlantı",
     "connection_plural": "bağlantı",
-    "terminateSessionConfirm": "Bu oturumu sonlandırmak istediğinizden emin misiniz?",
-    "terminateAllSessionsConfirm": "Diğer tüm oturumları sonlandırmak istediğinizden emin misiniz?",
+    "terminateSessionConfirm": "Bu oturum sonlandırılsın mı?",
+    "terminateAllSessionsConfirm": "Diğer tüm oturumlar sonlandırılsın mı?",
     "validationErrorTitle": "Doğrulama Hatası",
     "visibleGraphSummary": "{items} görünür öğe, {links} görünür bağlantı",
     "graphTruncated": "En çok bağlantıya sahip {visible} öğe gösteriliyor. Daha az bağlantılı {omitted} öğe atlandı.",
@@ -815,10 +819,10 @@
     "chooseAutoSaveInterval": "Notlarınızın otomatik olarak kaydedilme sıklığını seçin.",
     "defaultMode": "Varsayılan Mod",
     "selectNotesDefaultMode": "Notlar varsayılan modunu seçin",
-    "chooseNotesDefaultMode": "Notun otomatik olarak düzenleme modunda olup olmayacağını seçin (not düzenleyicideki {mode} butonu).",
+    "chooseNotesDefaultMode": "Notların düzenleme modunda açılıp açılmayacağını seçin. Not düzenleyicideki {mode} butonuyla her zaman geçiş yapabilirsiniz.",
     "defaultEditor": "Varsayılan Düzenleyici",
     "selectNotesDefaultEditor": "Varsayılan not düzenleyicisini seçin",
-    "chooseDefaultEditor": "Notlarınız için varsayılan düzenleyiciyi seçin - (not düzenleyicideki {editor} butonuna tıklayarak her zaman geçiş yapabilirsiniz).",
+    "chooseDefaultEditor": "Notlarınız için varsayılan düzenleyiciyi seçin. Not düzenleyicideki {editor} butonuyla her zaman geçiş yapabilirsiniz.",
     "tableSyntaxInNotes": "Notlardaki Tablo Sözdizimi",
     "selectTableSyntax": "Tablo sözdizimini seçin",
     "chooseTableSyntax": "Notlarınızda tabloların nasıl işleneceğini seçin.",
@@ -827,7 +831,7 @@
     "chooseSyntaxTheme": "Markdown düzenleyici için sözdizimi vurgulama temasını seçin.",
     "minimalMode": "Minimal Mod (Zengin Metin Düzenleyiciyi Devre Dışı Bırak)",
     "selectMinimalMode": "Minimal modu seçin",
-    "minimalModeDescription": "Etkinleştirildiğinde, zengin metin düzenleyici yerine basit bir markdown işleyici kullanılır. Çift yönlü bağlantı gibi gelişmiş özellikler bu modda çalışmaz.",
+    "minimalModeDescription": "Zengin metin düzenleyici yerine basit bir markdown işleyici kullanır. Çift yönlü bağlantılar ve diğer gelişmiş özellikler bu modda çalışmaz.",
     "defaultNoteFilter": "Varsayılan Not Filtresi",
     "selectDefaultNoteFilter": "Varsayılan not filtresini seçin",
     "chooseDefaultNoteFilter": "Notlar sayfası açıldığında uygulanacak varsayılan filtreyi seçin.",
@@ -854,8 +858,8 @@
     "currentPassword": "Mevcut Şifre",
     "newPassword": "Yeni Şifre",
     "confirmPassword": "Şifreyi Onayla",
-    "passwordChanged": "Şifre başarıyla değiştirildi",
-    "settingsSaved": "Ayarlar başarıyla kaydedildi",
+    "passwordChanged": "Şifre değiştirildi",
+    "settingsSaved": "Ayarlar kaydedildi",
     "dashCase": "Kısa çizgi (örneğin; dosya-adim.md)",
     "minimal": "Minimal (sadece geçersiz karakterleri kaldır)",
     "noRename": "Yeniden adlandırma yok (orijinal dosya adını koru)",
@@ -865,6 +869,7 @@
     "seconds_plural": "{count} saniye",
     "hours12": "12 saat",
     "hours24": "24 saat",
+    "useSystemDefault": "Sistem varsayılanını kullan",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "Varsayılan",
@@ -888,7 +893,7 @@
     "chooseQuickCreateNotes": "Hızlı not oluşturma modunu seçin.",
     "quickCreateNotesShowModal": "Not oluştururken modal penceresini göster",
     "quickCreateNotesSkipModal": "Modalı atla ve anında oluştur",
-    "quickCreateNotesDescription": "Etkinleştirildiğinde, yeni not oluşturma işlemi modal penceresini atlar ve sizi doğrudan düzenleyiciye yönlendirir.",
+    "quickCreateNotesDescription": "Not oluşturma penceresini atlar ve sizi doğrudan düzenleyiciye götürür.",
     "defaultCategory": "Hızlı oluşturulan notlar için varsayılan kategori",
     "selectDefaultCategory": "Varsayılan kategori seçin...",
     "defaultCategoryDescription": "Hızlı oluşturma kullanılırken yeni notlar bu kategoride oluşturulacaktır.",
@@ -916,10 +921,6 @@
       "sampleInputLabel": "Örnek Giriş",
       "sampleInputPlaceholder": "Bir metin girin..."
     },
-    "codeBlockChoice": "Kod bloğu stilini seçin",
-    "themedCodeBlock": "Temalı kod bloğu",
-    "defaultCodeBlock": "Kodlayıcı (varsayılan)",
-    "codeBlockChoiceDescription": "Codepen benzeri varsayılan kod bloğu stili veya temalı kod bloğu stili arasında seçim yapın.",
     "hideConnectionIndicatorDescription": "Logo alanındaki websocket bağlantı göstergesini gizler. Bu ayara bakılmadan, çevrimdışıysenız kırmızı noktayı görmeye devam edersiniz.",
     "selectConnectionIndicator": "Bağlantı göstergesi durumunu seçin",
     "showIndicator": "Göstergeyi göster",
@@ -930,7 +931,7 @@
     "hideStatusOnCardsLabel": "Kanban Kartlarında Durum",
     "showStatusOnCards": "Durumu göster",
     "hideStatusOnCards": "Durumu gizle",
-    "hideStatusOnCardsDescription": "Kanban kartlarındaki durum etiketini gizler. Durum, kartın bulunduğu sütun tarafından zaten belirtilmektedir.",
+    "hideStatusOnCardsDescription": "Kanban kartlarındaki durum etiketini gizler. Sütun zaten durumu gösterir.",
     "hideMobileStatusDropdownLabel": "Kartlarda mobil durum açılır menüsü",
     "showMobileStatusDropdown": "Mobil menüyü göster",
     "hideMobileStatusDropdown": "Mobil menüyü gizle",
@@ -942,9 +943,13 @@
     "selectTimeTrackingOnCards": "Zaman takibi görünürlüğünü seçin",
     "hideTimeTrackingOnCardsDescription": "Kanban kartlarındaki zamanlayıcıyı ve kaydedilen oturumları gizler. Zaman takibi kart detay görünümünde kullanılabilir kalır.",
     "selectStatusOnCards": "Durum görünürlüğünü seçin",
+    "codeBlockChoice": "Kod bloğu stilini seçin",
+    "defaultCodeBlock": "Kodlayıcı (varsayılan)",
+    "themedCodeBlock": "Temalı kod bloğu",
+    "codeBlockChoiceDescription": "Codepen benzeri varsayılan kod bloğu stili veya temalı kod bloğu stili arasında seçim yapın.",
     "checklistItemClickAction": "Kontrol listesi öğesi tıklama eylemi",
     "selectChecklistItemClickAction": "Kontrol listesi öğesini seçin tıklama eylemi",
-    "checklistItemClickActionDescription": "Bir görevin metnini tıklattığınızda ne olacağını seçin. \n\"Tamamlandı olarak işaretle\" onay kutusunu değiştirir (varsayılan); \n\"Görev adını düzenle\", görevi satır içi düzenleme için açar; bunu tamamlamak için yine de onay kutusunu tıklamanız gerekir.",
+    "checklistItemClickActionDescription": "Bir görevin metnine tıkladığınızda ne olacağını seçin. \"Tamamlandı olarak işaretle\" (varsayılan) onay kutusunu değiştirir. \"Görev adını düzenle\" görevi satır içi düzenleme için açar, tamamlamak için onay kutusunun kendisine tıklarsınız.",
     "checklistItemClickActionToggle": "Tamamlandı/tamamlanmadı olarak işaretle",
     "checklistItemClickActionEdit": "Liste öğesini düzenle",
     "newItemInsertion": "Yeni öğe ekleme konumu",
@@ -952,7 +957,6 @@
     "newItemInsertionDescription": "Yeni öğelerin kontrol listesinin üstüne (varsayılan) mı yoksa altına mı ekleneceğini seçin.",
     "newItemInsertionTop": "Listenin başı",
     "newItemInsertionBottom": "Listenin sonu",
-    "useSystemDefault": "Sistem varsayılanını kullan",
     "selectShowChecklistEmojis": "Emoji görünürlüğünü seçin",
     "showChecklistEmojisDescription": "Metnine göre liste öğelerinin yanında otomatik emoji gösterir."
   },
@@ -995,20 +999,24 @@
     "icon512": "512x512 Simge",
     "icon512Description": "PWA açılış ekranları için yüksek çözünürlüklü simge.",
     "notifyNewUpdates": "Yeni güncellemeleri bana bildir",
-    "thisUsesGithubAPI": "Bu özellik güncellemeleri kontrol etmek için GitHub API'sini kullanır. Devre dışı bırakmak API erişimini tamamen kapatır.",
+    "thisUsesGithubAPI": "Güncellemeleri kontrol etmek için GitHub API'sini kullanır. Kapatmak GitHub'a giden ve gelen tüm trafiği durdurur.",
     "parseContent": "İçeriği her zaman ayrıştırılmış (parsed) göster",
-    "parseContentEnabledDescription": "Etkinleştirildiğinde, kenar çubuğunda, arama sonuçlarında ve uygulama genelinde ayrıştırılmış başlıklar gösterilir.",
-    "parseContentDisabledDescription": "Devre dışı bırakıldığında, orijinal dosya adları temizlenip okunabilir hale getirilerek gösterilir.",
-    "parseContentPerformanceWarning": "Bunu \"hayır\" olarak ayarlamak büyük veri kümelerinde performansı artırır ancak okunabilirliği etkileyebilir (özellikle Latin alfabesi dışındaki dosya adlarında).",
+    "parseContentEnabledDescription": "Ayrıştırılmış başlıkları kenar çubuğunda, arama sonuçlarında ve uygulamanın geri kalanında gösterir.",
+    "parseContentDisabledDescription": "Bunun yerine orijinal dosya adlarını, okunabilir hale getirilmiş olarak gösterir.",
+    "parseContentPerformanceWarning": "Bunu \"hayır\" yapmak büyük örnekleri hızlandırır ama başlıkların okunması zorlaşır, özellikle Latin alfabesi dışındaki karakterler içeren dosya adlarında.",
     "hideLanguageSelector": "Üst Menüde Dil Seçiciyi Gizle",
     "hideLanguageSelectorDescription": "Üst kısımdaki dil seçim menüsünü gösterir/gizler",
+    "defaultDateFormat": "Varsayılan Tarih Formatı",
+    "defaultDateFormatDescription": "Kullanıcının tarih biçimi tercihi \"Sistem varsayılanını kullan\" olarak ayarlandığında kullanılır.",
+    "defaultTimeFormat": "Varsayılan Saat Formatı",
+    "defaultTimeFormatDescription": "Kullanıcının saat biçimi tercihi \"Sistem varsayılanını kullan\" olarak ayarlandığında kullanılır.",
     "applicationIcons": "Uygulama Simgeleri",
     "saveChanges": "Değişiklikleri Kaydet",
     "unsavedChanges": "Kaydedilmemiş değişiklikleriniz var.",
     "loadError": "Yükleme Hatası",
     "couldNotFetchSettings": "Ayarlar getirilemedi.",
     "failedToLoadSettings": "Ayarlar yüklenemedi",
-    "settingsSavedSuccessfully": "Ayarlar başarıyla kaydedildi.",
+    "settingsSavedSuccessfully": "Ayarlar kaydedildi.",
     "failedToSaveSettings": "Ayarlar kaydedilemedi",
     "saveError": "Kaydetme Hatası",
     "unknownErrorOccurred": "Bilinmeyen bir hata oluştu.",
@@ -1021,7 +1029,7 @@
     "colorVariables": "Renk Değişkenleri",
     "livePreview": "Canlı Önizleme",
     "unsavedCssChanges": "Kaydedilmemiş CSS değişiklikleriniz var.",
-    "noCustomThemesYet": "Henüz özel tema oluşturulmadı. Başlamak için \"Tema Oluştur\"a tıklayın.",
+    "noCustomThemesYet": "Henüz özel tema yok. Bir tane yapmak için \"Tema Oluştur\"a tıklayın.",
     "myCustomTheme": "Özel Temam",
     "iconNameDescription": "simge adı (örneğin; PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "Uygulama Sürümü",
@@ -1060,22 +1068,22 @@
     "configureExternalServices": "Düzenleyici entegrasyonları için harici servis URL'lerini yapılandırın.",
     "drawioUrl": "Draw.io URL",
     "optional": "(İsteğe bağlı)",
-    "drawioUrlDescription": "Özel bir Draw.io örneği URL'si belirtin. Varsayılan genel örneği kullanmak için boş bırakın (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Kendi Draw.io örneğinizi kullanın. Genel olanı kullanmak için boş bırakın (https://embed.diagrams.net).",
     "drawioUrlExample": "Kendi sunucunuz için örnek: https://alan-adiniz.com/drawio",
     "drawioProxyEnabled": "Draw.io'yu Jotty üzerinden vekil sunucu (proxy) ile aktar",
-    "drawioProxyEnabledDescription": "Draw.io trafiğini Jotty sunucusu üzerinden yönlendirmek için bunu etkinleştirin. Kullanıcıların tarayıcılarından erişilemeyen dahili Docker ağ URL'leri için gereklidir.",
+    "drawioProxyEnabledDescription": "Draw.io trafiğini Jotty sunucusu üzerinden yönlendirir. Kullanıcıların tarayıcılarının erişemediği dahili Docker ağ URL'leri (örn. http://drawio:8080) için gereklidir.",
     "excalidrawUrl": "Excalidraw URL",
-    "excalidrawUrlDescription": "Özel bir Excalidraw örneği URL'si belirtin. Varsayılan genel örneği kullanmak için boş bırakın (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Kendi Excalidraw örneğinizi kullanın. Genel olanı kullanmak için boş bırakın (https://excalidraw.com).",
     "excalidrawUrlExample": "Kendi sunucunuz için örnek: https://alan-adiniz.com/excalidraw",
     "excalidrawProxyEnabled": "Excalidraw'u Jotty üzerinden vekil sunucu (proxy) ile aktar",
-    "excalidrawProxyEnabledDescription": "Excalidraw trafiğini Jotty sunucusu üzerinden yönlendirmek için bunu etkinleştirin. Dahili ağlardaki URL'ler için gereklidir.",
+    "excalidrawProxyEnabledDescription": "Excalidraw trafiğini Jotty sunucusu üzerinden yönlendirir. Kullanıcıların tarayıcılarının erişemediği dahili Docker ağ URL'leri (örn. http://excalidraw:3000) için gereklidir.",
     "saving": "Kaydediliyor...",
-    "editorSettingsSaved": "Düzenleyici ayarları başarıyla kaydedildi.",
+    "editorSettingsSaved": "Düzenleyici ayarları kaydedildi.",
     "customEmojis": "Özel Emojiler",
-    "noEmojisYet": "Henüz özel emoji oluşturulmadı. Başlamak için \"Emoji Ekle\"ye tıklayın.",
+    "noEmojisYet": "Henüz özel emoji yok. Eklemek için \"Emoji Ekle\"ye tıklayın.",
     "enterAnyEmoji": "Herhangi bir emoji girin veya emoji seçiciyi kullanın (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Paylaşım Etkinliği Genel Bakış",
-    "detailedSharingBreakdown": "Paylaşım modellerinin ve kullanıcı etkileşiminin ayrıntılı dökümü",
+    "detailedSharingBreakdown": "Neler paylaşılıyor ve kim paylaşıyor",
     "checkForUpdates": "Güncellemeleri Kontrol Et",
     "checkingForUpdates": "Güncellemeler kontrol ediliyor...",
     "updateAvailable": "Güncelleme Mevcut!",
@@ -1086,18 +1094,16 @@
     "totalSharing": "Toplam Paylaşım Eylemi",
     "topContributors": "En Çok Katkıda Bulunanlar",
     "itemsShared": "Paylaşılan Öğeler",
-    "activityLevel": "Etkinlik Seviyesi",
-    "sharedCMS": "Paylaşılan İçerik Yönetimi",
     "totalPublicItems": "{count} genel öğe",
     "userContent": "{checklistsLength} kontrol listesi • {notesLength} not",
     "rebuildIndexes": "İndeksleri Yeniden Oluştur",
     "rebuilding": "Yeniden oluşturuluyor...",
-    "successfullyRebuiltIndex": "{username} için bağlantı indeksi başarıyla yeniden oluşturuldu",
+    "successfullyRebuiltIndex": "{username} için bağlantı indeksi yeniden oluşturuldu",
     "failedToRebuildIndex": "{username} için bağlantı indeksi yeniden oluşturulamadı",
     "totalItems": "{userCount} kullanıcı genelinde toplam {items} öğe",
     "privileges": "Yönetici yetkileri",
     "adminContentAccess": "Yönetici İçerik Erişimi",
-    "adminContentAccessDescription": "Yöneticilerin tüm kullanıcıların notlarına ve listelerine erişip erişemeyeceğini kontrol eder. Devre dışı bırakıldığında, yöneticiler sadece kullanıcıları ve ayarları yönetebilir, diğer kullanıcıların içeriğini göremez.",
+    "adminContentAccessDescription": "Yöneticilerin her kullanıcının notlarını ve listelerini açmasına izin verir. Kapalıyken yöneticiler kullanıcıları ve ayarları yönetebilir ama başkalarının içeriğini göremez.",
     "adminContentAccessYes": "Yöneticiler tüm içeriğe erişebilir",
     "adminContentAccessNo": "Yöneticiler sadece kendi içeriklerine erişebilir",
     "superAdminOnly": "Sadece sistem sahibi tarafından düzenlenebilir",
@@ -1107,21 +1113,21 @@
     "confirmNewPassword": "Yeni şifreyi onaylayın",
     "dataExport": "Veri dışa aktarma",
     "dataExportOptions": "Veri Dışa Aktarma Seçenekleri",
-    "selectExportType": "Bir dışa aktarma türü seçin ve verileri uygulamanızdan indirin.",
+    "selectExportType": "Bir dışa aktarma türü seçin ve verileri indirin.",
     "allChecklistsAndNotes": "Tüm kontrol listeleri ve notlar",
-    "allChecklistsAndNotesDescription": "Tüm kullanıcılar tarafından oluşturulan tüm verileri dışa aktarır. Kullanıcı ve kategoriye göre düzenlenmiş JSON verilerini içeren bir zip dosyası oluşturulur.",
+    "allChecklistsAndNotesDescription": "Tüm kullanıcıların listelerini ve notlarını, kullanıcı ve kategoriye göre gruplanmış JSON dosyalarından oluşan bir zip olarak dışa aktarır.",
     "userChecklistsNotes": "Belirli Kullanıcının Kontrol Listeleri ve Notları",
-    "userChecklistsNotesDescription": "Belirli bir kullanıcıya ait tüm verileri dışa aktarmak için listeden kullanıcı seçin.",
+    "userChecklistsNotesDescription": "Bir kullanıcının tüm listelerini ve notlarını dışa aktarmak için açılır listeden onu seçin.",
     "allUsersData": "Tüm Kullanıcı Hesap Verileri",
     "allUsersDataDescription": "Tüm kullanıcı hesap bilgilerini (kullanıcı adları, yönetici durumu vb.) içeren bir JSON dosyası dışa aktarır. İçerikleri kapsamaz.",
     "wholeDataFolder": "Tüm Veri Klasörü (Yedek)",
-    "wholeDataFolderDescription": "Tüm kullanıcı içerikleri, meta veriler ve ayarlar dahil olmak üzere tüm 'data' klasörünü dışa aktarır. Büyük bir dosya olabileceği için dikkatli kullanın.",
+    "wholeDataFolderDescription": "Tüm kullanıcı içerikleri, meta veriler ve ayarlarla birlikte 'data' klasörünün tamamını dışa aktarır. Bu dosya büyük olabilir.",
     "noSharingPermissionsLabel": "Belirli paylaşılan öğeler, içerik erişim izinlerinize bağlı olarak gizlenmiştir.",
     "contentHidden": "İçerik ayrıntıları gizli",
     "viewOnlySettingsNotice": "Bu ayarları yalnızca sistem sahibi değiştirebilir.",
     "auditLogContentRedacted": "[İçerik Gizlendi]",
     "maxLogAgeDays": "Maksimum Günlük Yaşı (gün)",
-    "maxLogAgeDaysDescription": "Denetim günlüklerinin ne kadar süreyle saklanacağını belirleyin. Bu süreden eski günlüklerin temizlenmesi için uyarı alırsınız. Sınırsız saklama için 0 yapın.",
+    "maxLogAgeDaysDescription": "Denetim günlüklerinin ne kadar süre saklanacağı. Denetim günlükleri sayfası bundan eski olanları temizlemeyi önerir. Günlükleri sonsuza kadar tutmak ve bu öneriyi hiç görmemek için 0 yapın.",
     "appPreferences": "Uygulama tercihleri",
     "editEmoji": "Emoji Düzenle",
     "addEmoji": "Emoji Ekle",
@@ -1140,10 +1146,6 @@
     "updateTagsTitle": "Notları etiketler için tara ve metadata bilgilerini güncelle",
     "tagsUpdated": "{processed} dosya işlendi, {updated} dosya yeni etiketlerle güncellendi",
     "failedToUpdateTags": "Etiketler güncellenemedi",
-    "defaultDateFormat": "Varsayılan Tarih Formatı",
-    "defaultDateFormatDescription": "Kullanıcının tarih biçimi tercihi \"Sistem varsayılanını kullan\" olarak ayarlandığında kullanılır.",
-    "defaultTimeFormatDescription": "Kullanıcının saat biçimi tercihi \"Sistem varsayılanını kullan\" olarak ayarlandığında kullanılır.",
-    "defaultTimeFormat": "Varsayılan Saat Formatı",
     "borderRadius": "Kenar yuvarlaklığı",
     "borderRadiusDescription": "Tüm örnekte kullanılan köşe yuvarlaklığını ayarlar. Kullanıcılar hızlı ayarlardan bunu geçersiz kılabilir.",
     "borderRadiusSaved": "Kenar yuvarlaklığı kaydedildi",
@@ -1159,6 +1161,9 @@
     "tryAgain": "Tekrar dene",
     "contactSupport": "Destekle iletişime geçin",
     "invalidInput": "Geçersiz giriş",
+    "invalidEditorSettings": "Düzenleyici ayarları bir nesne olmalı, hiçbir şey kaydedilmedi",
+    "invalidEditorSetting": "{field} düzenleyici ayarının türü yanlış, hiçbir şey kaydedilmedi",
+    "categoryOutOfBounds": "Bu kategori notlarınızın dışında, bu yüzden hiçbir şey oluşturulmadı",
     "requiredField": "Bu alan zorunludur",
     "emailInvalid": "Lütfen geçerli bir e-posta adresi girin",
     "passwordTooShort": "Şifre en az 8 karakter olmalıdır",
@@ -1166,43 +1171,44 @@
     "networkError": "Ağ hatası",
     "timeout": "İstek zaman aşımına uğradı",
     "permissionDenied": "İzin reddedildi",
-    "requiredPermissions": "Bu işlemi gerçekleştirmek için gerekli izinlere sahip değilsiniz.",
+    "requiredPermissions": "Bunu yapmak için izniniz yok.",
     "loadError": "Yükleme Hatası",
     "failedToLoadCustomEmojis": "Özel emojiler yüklenemedi",
-    "emojiDeletedSuccessfully": "Emoji başarıyla silindi",
+    "emojiDeletedSuccessfully": "Emoji silindi",
     "deleteError": "Silme Hatası",
     "failedToDeleteEmoji": "Emoji silinemedi",
     "validationError": "Doğrulama Hatası",
     "keywordAndEmojiRequired": "Anahtar kelime ve emoji gereklidir",
     "duplicateKeyword": "Yinelenen Anahtar Kelime",
     "keywordAlreadyExists": "Anahtar kelime zaten mevcut",
-    "emojiUpdatedSuccessfully": "Emoji başarıyla güncellendi",
-    "emojiCreatedSuccessfully": "Emoji başarıyla oluşturuldu",
+    "emojiUpdatedSuccessfully": "Emoji güncellendi",
+    "emojiCreatedSuccessfully": "Emoji oluşturuldu",
     "saveError": "Kaydetme Hatası",
     "failedToSaveEmoji": "Emoji kaydedilemedi",
     "failedToLoadCustomCSS": "Özel CSS yüklenemedi",
     "couldNotLoadCustomCSS": "Özel CSS yüklenemedi.",
     "couldNotLoadThemes": "Temalar yüklenemedi.",
-    "customCSSSavedSuccessfully": "Özel CSS başarıyla kaydedildi.",
+    "customCSSSavedSuccessfully": "Özel CSS kaydedildi.",
     "themeNotFound": "Tema bulunamadı.",
-    "themeDeletedSuccessfully": "Tema başarıyla silindi.",
+    "themeDeletedSuccessfully": "Tema silindi.",
     "themeNameRequired": "Tema adı gereklidir.",
-    "themeSavedSuccessfully": "Tema başarıyla {action}.",
+    "themeSavedSuccessfully": "Tema {action}.",
     "anUnknownErrorOccurred": "Bilinmeyen bir hata oluştu.",
     "usernameRequired": "Kullanıcı adı gereklidir",
     "passwordRequired": "Şifre gereklidir",
     "passwordMinLength": "Şifre en az 6 karakter uzunluğunda olmalıdır",
     "passwordsDoNotMatch": "Şifreler eşleşmiyor",
-    "userSavedSuccessfully": "Kullanıcı başarıyla {mode}!",
+    "userSavedSuccessfully": "Kullanıcı {mode}.",
     "failedToSaveUser": "Kullanıcı {mode} başarısız oldu",
     "anErrorOccurred": "Bir hata oluştu.",
     "deleteUserConfirmation": "\"{username}\" kullanıcısını silmek istediğinizden emin misiniz? Bu işlem geri alınamaz.",
-    "userDeletedSuccessfully": "Kullanıcı başarıyla silindi!",
-    "failedToDeleteUser": "Kullanıcı silinemedi"
+    "userDeletedSuccessfully": "Kullanıcı silindi.",
+    "failedToDeleteUser": "Kullanıcı silinemedi",
+    "readOnlyFolder": "Bu klasör sunucuda salt okunur, bu yüzden değişiklik kaydedilemedi."
   },
   "pwa": {
     "installPromptTitle": "Uygulamayı Yükle",
-    "installPromptMessage": "Daha iyi bir deneyim için bu uygulamayı cihazınıza yükleyin",
+    "installPromptMessage": "Jotty'yi cihazınıza yükleyin, uygulama gibi açılsın",
     "installButton": "Yükle",
     "updateAvailable": "Güncelleme Mevcut",
     "updateMessage": "Yeni bir sürüm mevcut",
@@ -1260,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Zengin düzenleyici moduna geç",
     "toggleMarkdownMode": "Markdown moduna geç",
+    "quickControls": "Düzenleyici kontrolleri",
     "toggleBold": "Kalın yap/kaldır",
     "toggleItalic": "İtalik yap/kaldır",
     "toggleUnderline": "Altı çizili yap/kaldır",
@@ -1356,8 +1363,8 @@
     "calloutWarning": "Uyarı",
     "calloutSuccess": "Başarılı",
     "calloutDanger": "Tehlike",
-    "lineNumbers": "Satır numaraları",
-    "ruler": "Cetvel"
+    "ruler": "Cetvel",
+    "lineNumbers": "Satır numaraları"
   },
   "sharing": {
     "share": "Paylaş",
@@ -1433,16 +1440,16 @@
     "viewNote": "Notu Görüntüle",
     "editNote": "Notu Düzenle",
     "privateKeyWarning": "UYARI: Özel anahtarınız tüm şifreli notların çözülmesini sağlar. Güvenlik risklerini anlıyorsanız dışa aktarın. Devam edilsin mi?",
-    "publicKeyExported": "Genel anahtar başarıyla dışa aktarıldı",
-    "privateKeyExported": "Özel anahtar başarıyla dışa aktarıldı",
+    "publicKeyExported": "Genel anahtar dışa aktarıldı",
+    "privateKeyExported": "Özel anahtar dışa aktarıldı",
     "failedToExportKey": "Anahtar dışa aktarılamadı",
     "unexpectedError": "Beklenmedik bir hata oluştu",
-    "keysDeleted": "Anahtarlar başarıyla silindi",
+    "keysDeleted": "Anahtarlar silindi",
     "failedToDeleteKeys": "Anahtarlar silinemedi",
     "autoDecryptUpdated": "Otomatik şifre çözme ayarı güncellendi",
     "failedToUpdateSetting": "Ayar güncellenemedi",
-    "enterValidPath": "Lütfen geçerli bir yol girin",
-    "customPathSet": "Özel anahtar yolu başarıyla ayarlandı",
+    "enterValidPath": "Geçerli bir yol girin",
+    "customPathSet": "Özel anahtar yolu ayarlandı",
     "failedToSetCustomPath": "Özel yol ayarlanamadı",
     "thisNoteIsEncrypted": "Bu not şifrelenmiş",
     "noteProtectedWith": "Bu not {type} şifrelemesi ile korunmaktadır.",
@@ -1453,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Şifreleme yöntemi seçin",
     "encryptionMethodsTitle": "Şifreleme Yöntemleri",
-    "xchachaDescription": "XChaCha20-Poly1305: Modern, hızlı, parola tabanlı şifreleme",
-    "pgpDescription": "PGP: Anahtar çifti yönetimi ile geleneksel genel anahtar kriptografisi",
+    "xchachaDescription": "XChaCha20-Poly1305: parola ile şifreleme",
+    "pgpDescription": "PGP: yönettiğiniz bir anahtar çiftiyle genel anahtar şifrelemesi",
     "encryptionKeys": "Şifreleme Anahtarları",
     "keysConfigured": "Anahtarlar yapılandırıldı",
     "algorithm": "Algoritma: ",
@@ -1468,9 +1475,9 @@
     "keysDisabledInDemo": "Kayıtlı şifreleme anahtarları demo modunda devre dışıdır.",
     "encryptionSettings": "Şifreleme Ayarları",
     "promptForPassphrase": "Şifreli notları açarken parola sor",
-    "promptForPassphraseDescription": "Etkinleştirilirse, şifreli bir notu açarken parolanız sorulacaktır. Not sunucuda şifreli kalmaya devam eder, ancak geçerli sekme oturumunda çözülmüş içeriği görebilirsiniz.",
+    "promptForPassphraseDescription": "Şifreli bir notu açtığınızda parolanızı sorar. Not sunucuda şifreli kalır ve çözülmüş içeriği yalnızca bu sekmede görürsünüz.",
     "customKeyPath": "Özel Anahtar Yolu (Yerel Kurulumlar)",
-    "customKeyPathDescription": "Şifreleme anahtarlarını saklamak için özel (mutlak) bir dosya sistemi yolu belirtin. Bu yalnızca yerel kurulumlar için gereklidir. Docker kullanıcıları bunun yerine docker-compose.yml dosyasındaki varsayılan yolu eşlemelidir.",
+    "customKeyPathDescription": "Şifreleme anahtarlarınız için mutlak bir dosya sistemi yolu. Yalnızca yerel kurulumlarda gerekir. Docker kullanıcıları bunun yerine docker-compose.yml içinde varsayılan yolu eşlemelidir.",
     "customPath": "Özel Yol",
     "customPathPlaceholder": "/home/kullanici/anahtarlarim",
     "customPathHelp": "Mutlak bir yol olmalıdır (örneğin, /home/kullanici/anahtarlarim veya C:\\Users\\kullanici\\anahtarlarim)",
@@ -1489,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "Not içeriği kaydedilmeden önce şifrelenecektir",
     "passphraseRequired": "Parola gereklidir",
     "incorrectPassphrase": "Hatalı parola",
-    "noteEncryptedSuccessfully": "Not başarıyla şifrelendi",
+    "noteEncryptedSuccessfully": "Not şifrelendi",
     "failedToEncryptNote": "Not şifrelenemedi",
-    "noteDecryptedSuccessfully": "Notun şifresi başarıyla çözüldü",
+    "noteDecryptedSuccessfully": "Notun şifresi çözüldü",
     "failedToDecryptNote": "Notun şifresi çözülemedi",
     "passphrase": "Parola",
     "enterYourPassphrase": "Parolanızı girin",
@@ -1519,8 +1526,8 @@
     "privateKey": "Özel Anahtar",
     "noStoredKeysFound": "Kayıtlı anahtar bulunamadı",
     "noEncryptionKeysConfigured": "Yapılandırılmış şifreleme anahtarınız yok",
-    "pastePublicKeyBelow": "Not içeriğini şifrelemek için lütfen aşağıya bir genel anahtar yapıştırın",
-    "generateOrImportKeysInProfile": "Jotty için özel anahtarları Profil → Şifreleme bölümünden oluşturabilir veya içe aktarabilirsiniz",
+    "pastePublicKeyBelow": "Not içeriğini şifrelemek için aşağıya bir genel anahtar yapıştırın",
+    "generateOrImportKeysInProfile": "Jotty için anahtarları Profil > Şifreleme bölümünden oluşturabilir veya içe aktarabilirsiniz",
     "useCustomKey": "Özel {keyType} anahtarı kullan",
     "signWithPrivateKey": "Özel anahtar ile imzala",
     "proveAuthenticityOfNote": "bu notun orijinalliğini kanıtla",
@@ -1540,7 +1547,7 @@
     "yourEmail": "eposta@adresiniz.com",
     "generating": "Oluşturuluyor...",
     "generateKeys": "Anahtarları Oluştur",
-    "keysGeneratedSuccessfully": "Anahtarlar Başarıyla Oluşturuldu",
+    "keysGeneratedSuccessfully": "Anahtarlar oluşturuldu",
     "importPGPKeys": "PGP Anahtarlarını İçe Aktar",
     "publicKeyLabel": "Genel Anahtar",
     "privateKeyLabel": "Özel Anahtar",
@@ -1549,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Parolanızı unutmayın! Kurtarılamaz.",
     "withoutPassphraseCannotDecrypt": "Parola olmadan notlarınızın şifresini çözemezsiniz.",
     "backupPrivateKeySafely": "Özel anahtarınızı güvenli bir şekilde yedekleyin.",
-    "pgpKeyPairGeneratedSuccessfully": "PGP anahtar çifti başarıyla oluşturuldu",
+    "pgpKeyPairGeneratedSuccessfully": "PGP anahtar çifti oluşturuldu",
     "failedToGenerateKeys": "Anahtarlar oluşturulamadı",
     "fingerprint": "Parmak İzi (Fingerprint)",
     "keysSavedSecurely": "Anahtarlarınız güvenli bir şekilde kaydedildi.",
@@ -1563,13 +1570,13 @@
     "bothKeysRequired": "Hem genel hem de özel anahtar gereklidir",
     "invalidPublicKeyFormat": "Geçersiz genel anahtar formatı. ASCII-armored PGP anahtarı olmalıdır.",
     "invalidPrivateKeyFormat": "Geçersiz özel anahtar formatı. ASCII-armored PGP anahtarı olmalıdır.",
-    "keysImportedSuccessfully": "Anahtarlar başarıyla içe aktarıldı",
+    "keysImportedSuccessfully": "Anahtarlar içe aktarıldı",
     "failedToImportKeys": "Anahtarlar içe aktarılamadı",
     "created": "Şifreleme oluşturuldu",
     "notePlaceholder": "Ben yer tutucuyum çünkü boş bir notu şifreleyemezsiniz."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Bu seçenekler yalnızca geçerli tarayıcı oturumu için geçerlidir. Kalıcı ayarlar için lütfen şurayı kontrol edin:",
+    "sessionOnlyPrefix": "Bu seçenekler yalnızca bu tarayıcı oturumunda geçerlidir. Kalıcı ayarlar için şuraya bakın:",
     "accountSettings": "kullanıcı tercihleri",
     "autosaveNotes": "Notları Otomatik Kaydet",
     "showNotePreview": "Kartlarda Not Önizlemesini Göster",
@@ -1598,20 +1605,45 @@
     "migrationSuccessful": "Taşıma Başarılı",
     "returnToApp": "Uygulamaya Dön",
     "adminAccessRequired": "Yönetici Erişimi Gerekli",
-    "adminAccessDescription": "Bu taşıma işlemi yönetici yetkileri gerektirir. Sistem taşımasını gerçekleştirmek için lütfen bir yönetici ile iletişime geçin.",
+    "adminAccessDescription": "Bu taşıma işlemi için bir yönetici gerekir. Çalıştırması için bir yöneticiye başvurun.",
     "whatsHappening": "Neler oluyor?",
-    "sharingDataMigrationDescription": "Sistemin paylaşım verilerinizi taşıması gerekiyor. Bu, yönetici erişimi gerektiren tek seferlik bir işlemdir.",
+    "sharingDataMigrationDescription": "Jotty'nin paylaşım verilerinizi taşıması gerekiyor. Bu yalnızca bir kez çalışır ve yönetici gerektirir.",
     "whatsChanging": "Neler değişiyor?",
     "automaticBackupIncluded": "Otomatik Yedekleme Dahildir",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter Endüstri Standardıdır",
-    "noMigrationNeeded": "Taşıma gerekmedi - sisteminiz zaten güncel.",
-    "importantBackupData": "Önemli: Verilerinizi Yedekleyin"
+    "noMigrationNeeded": "Taşınacak bir şey yok, verileriniz zaten güncel.",
+    "importantBackupData": "Önemli: Verilerinizi Yedekleyin",
+    "sharingNowWithData": "Paylaşım verileriniz artık notlarınız ve klasörlerinizle birlikte duruyor.",
+    "sharingMovesDescription": "Paylaşım merkezi bir dosyadan çıkıp verilerinizin içine taşınıyor. Artık klasörler paylaşılabiliyor ve paylaşılan klasörler ayrı bir bölüm yerine kendi kenar çubuğunuzda görünüyor.",
+    "whatsHappeningBody": "<code>.sharing.json</code> içindeki her paylaşım, ait olduğu öğenin frontmatter'ına yazılır ve her klasör kimliğini, paylaşımını ve sıralamasını tutan bir <code>.category-info.json</code> alır. Veriler taşındıktan sonra eski dosyalar silinir.",
+    "migrationChanges": "Taşıma Değişiklikleri",
+    "sharingTravelsTitle": "Paylaşım dosyayla birlikte gider",
+    "sharingTravelsBody": "Paylaşılan her öğe kimlerle paylaşıldığını kendi frontmatter'ında tutar, bu yüzden taşımak veya yeniden adlandırmak paylaşımı asla bozmaz.",
+    "folderSharingTitle": "Klasör paylaşımı",
+    "folderSharingBody": "Bir klasörü paylaşın, içindeki her şey de şimdi ve gelecekte paylaşılmış olur. Alıcılar onu kendi kenar çubuklarında normal bir klasör olarak görür.",
+    "oneFilePerFolderTitle": "Klasör başına tek dosya",
+    "oneFilePerFolderBody": "<code>.order.json</code>, <code>.category-info.json</code> içine alınır ve sıralama dosya adı yerine uuid ile tutulur.",
+    "permissionsUnchangedTitle": "İzinler değişmiyor",
+    "permissionsUnchangedBody": "Okuma, düzenleme ve silme izinleri kullanıcı ve öğe bazında bugün nasılsa aynen aktarılır.",
+    "backupWarningBody": "Bu taşıma işlemi notlarınızdaki ve listelerinizdeki frontmatter'ı yeniden yazar ve eski <code>.sharing.json</code> ile <code>.order.json</code> dosyalarını siler. Devam etmeden önce <code>data</code> klasörünüzü yedekleyin.",
+    "backupConfirmLabel": "data klasörümü yedekledim ve taşıma sürecini anlıyorum.",
+    "backupConfirmHint": "Devam etmeden önce yedeğiniz olduğunu onaylayın.",
+    "sharingDataMigrated": "Paylaşım ve sıralama verileriniz taşındı.",
+    "whatWasChanged": "Neler değişti:",
+    "migrationPartial": "Taşıma Artıklarla Tamamlandı",
+    "leftoversTitle": "Bazı eski dosyalar bırakıldı",
+    "leftoversBody": "Taşıma her şeyi aktaramadı, bu yüzden aşağıdaki eski dosyalar diskte olduğu gibi bırakıldı. Hiçbir şey silinmedi. Sorunu düzeltip taşımayı tekrar çalıştırabilir ya da şimdi uygulamaya geçip bununla sonra ilgilenebilirsiniz.",
+    "overrideConfirmLabel": "Yine de devam et ve bu sayfayı bir daha gösterme.",
+    "overrideConfirmHint": "Artık dosyalar diskte kalır ama uygulama verilerinizi taşınmış sayar. Yukarıda listelenen paylaşım veya sıralama, taşımayı tekrar çalıştırana kadar uygulanmaz. Bunu istediğiniz zaman /migration?force=1 adresinden yapabilirsiniz.",
+    "continueAnyway": "Yine de Devam Et",
+    "overriding": "Devam ediliyor...",
+    "overrideFailed": "Taşıma atlanamadı"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Kategori başarıyla yeniden adlandırıldı",
+    "categoryRenamedSuccessfully": "Kategori yeniden adlandırıldı",
     "failedToRenameCategory": "Kategori yeniden adlandırılamadı",
-    "categoryRenamedSuccessfullyMessage": "{categoryName} kategorisi başarıyla {newName} olarak değiştirildi",
-    "failedToRenameCategoryMessage": "Kategori yeniden adlandırılırken bir hata oluştu."
+    "categoryRenamedSuccessfullyMessage": "{categoryName} kategorisinin adı {newName} olarak değiştirildi",
+    "failedToRenameCategoryMessage": "Kategori yeniden adlandırılırken bir şeyler ters gitti."
   },
   "auditLogs": {
     "title": "Denetim Günlükleri",
@@ -1628,17 +1660,17 @@
     "exportJSON": "JSON Olarak Dışa Aktar",
     "exportCSV": "CSV Olarak Dışa Aktar",
     "cleanupOldLogs": "Eski Günlükleri Temizle",
-    "confirmCleanup": "{days} günden eski günlükleri silmek istediğinizden emin misiniz? Bu işlem TÜM kullanıcıları etkiler ve geri alınamaz.",
+    "confirmCleanup": "{days} günden eski günlükler silinsin mi? Bu işlem TÜM kullanıcıları etkiler ve geri alınamaz.",
     "confirmCleanupUnlimited": "Otomatik temizleme yapılandırılmamış (sınırsız saklama). Gerekirse eski günlükleri manuel olarak silebilirsiniz.",
     "deleteAllLogsModalTitle": "Tüm Denetim Günlüklerini Sil",
     "deleteAllLogsWarning": "Bu işlem sadece eskileri değil, TÜM günlükleri silecektir",
     "deleteAllLogsWarningDescription": "Tüm denetim günlüğü geçmişi sistemden silinecek.",
     "deletingAllLogs": "Tüm Günlükler Siliniyor...",
     "deleteAllLogsButton": "Tüm Günlükleri Sil",
-    "cleanupSuccess": "{count} adet eski günlük dosyası başarıyla silindi",
+    "cleanupSuccess": "{count} eski günlük dosyası silindi",
     "cleanupError": "Eski günlükler temizlenemedi",
-    "userDescription": "Sistemdeki tüm etkinliklerinizi ve eylemlerinizi görüntüleyin",
-    "adminDescription": "Sistem genelindeki tüm kullanıcı etkinliklerini görüntüleyin ve yönetin",
+    "userDescription": "Jotty'de yaptığınız her şey",
+    "adminDescription": "Bu örnekte her kullanıcının yaptıkları",
     "level": "Seviye",
     "allLevels": "Tüm Seviyeler",
     "allCategories": "Tüm Kategoriler",
@@ -1702,9 +1734,9 @@
     "topActions": "En Çok Yapılan Eylemler",
     "mostActiveUsers": "En Aktif Kullanıcılar",
     "oldLogsFound": "{days} günden eski {count} günlük dosyası bulundu.",
-    "oldLogsFoundDescription": "Bunları temizlemek ister misiniz? Bu işlem geri alınamaz.",
+    "oldLogsFoundDescription": "Temizlensin mi? Bu işlem geri alınamaz.",
     "cleanUpNow": "Şimdi Temizle",
-    "cleanupSuccessMessage": "{count} eski günlük dosyası başarıyla silindi.",
+    "cleanupSuccessMessage": "{count} eski günlük dosyası silindi.",
     "security": "Güvenlik",
     "mfasecretgenerated": "MFA Gizli Anahtarı Oluşturuldu",
     "mfaenabled": "MFA Etkinleştirildi",
@@ -1720,6 +1752,7 @@
     "howTo": "Nasıl Yapılır",
     "shortcuts": "Kısayollar",
     "markdownGuide": "Markdown Kılavuzu",
+    "brain": "Bağlantılar ve Beyin",
     "customisations": "Özelleştirmeler",
     "docker": "Docker",
     "envVariables": "Ortam Değişkenleri",
@@ -1727,6 +1760,7 @@
     "pwa": "PWA (Uygulama)",
     "encryption": "Şifreleme",
     "sso": "SSO (Tekli Giriş)",
+    "ldap": "LDAP",
     "translations": "Çeviriler",
     "unraid": "Unraid",
     "patches": "Yamalar"
@@ -1740,6 +1774,7 @@
   },
   "notifications": {
     "title": "Bildirimler",
+    "unread": "okunmadı",
     "markAllRead": "Tümünü okundu olarak işaretle",
     "clearAll": "Tümünü temizle",
     "empty": "Bildirim yok",
@@ -1747,12 +1782,99 @@
     "assignmentMessage": "\"{board}\" içindeki \"{task}\"",
     "reminderTitle": "Görev gecikti",
     "reminderMessage": "\"{board}\" içindeki \"{task}\" hatırlatıcısının tarihi geçti",
-    "unread": "okunmadı",
     "sharingTitle": "{user} sizinle bir {type} paylaştı",
     "sharingMessage": "Paylaşılan {type} öğesini görmek için açın",
     "sharingFolderTitle": "{user} sizinle bir {type} klasörü paylaştı",
-    "sharingFolderMessage": "“{folder}” klasörünü görmek için açın",
+    "sharingFolderMessage": "\"{folder}\" klasörünü görmek için açın",
     "mentionTitle": "{user} bir yorumda sizden bahsetti",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
+  },
+  "relations": {
+    "indexing": "İlişkiler indeksleniyor...",
+    "unreachable": "erişilemiyor",
+    "createFromWikilink": "\"{title}\" adında bir not oluştur",
+    "mentionedIn": "Şurada geçiyor",
+    "mentionedInHint": "Bu notlar bu başlığı düz metin olarak kullanıyor. Bağlamak için birini bağlantıya çevirin.",
+    "linkMention": "Bağla",
+    "linked": "{title} içindeki geçiş bağlandı",
+    "linkFailed": "Bu geçiş bağlanamadı",
+    "kind": {
+      "mention": "Bağlantı",
+      "wiki": "Wiki bağlantısı"
+    }
+  },
+  "brain": {
+    "title": "Beyin",
+    "openBrain": "Beyinde aç",
+    "search": "Beyninde bir şey bul...",
+    "dimension": "Görünüm",
+    "dimensions": {
+      "3d": "3B",
+      "2d": "2B"
+    },
+    "local": "Bu öğenin çevresi",
+    "global": "Her şey",
+    "depth": "Derinlik {depth}",
+    "colourBy": "Renklendir",
+    "colourModes": {
+      "type": "Türe göre",
+      "category": "Kategoriye göre"
+    },
+    "filters": {
+      "notes": "Notlar",
+      "checklists": "Listeler",
+      "tags": "Etiketler",
+      "ghosts": "Henüz yazılmadı",
+      "suggestions": "Öneriler",
+      "orphans": "Yalnızlar"
+    },
+    "kind": {
+      "note": "Not",
+      "checklist": "Liste",
+      "ghost": "Henüz yazılmadı",
+      "tag": "Etiket"
+    },
+    "edges": {
+      "mention": "Bağlantı",
+      "wiki": "Wiki bağlantısı",
+      "suggested": "Önerilen",
+      "tag": "Etiket"
+    },
+    "linksTo": "Bağlantı verdikleri",
+    "linkedFrom": "Bağlantı alınanlar",
+    "suggested": "İlgili olabilir",
+    "promote": "{title} ile bağla",
+    "lonely": "Burada henüz hiçbir bağlantı yok. Başka bir notta @ veya [[ ile bundan bahsedin.",
+    "open": "Aç",
+    "createGhost": "Bu notu yaz",
+    "openTag": "Bu etiketli her şeyi göster",
+    "createFailed": "Bu not oluşturulamadı",
+    "connectFailed": "Bu ikisi bağlanamadı",
+    "connected": "{source}, {target} ile bağlandı",
+    "empty": "Beyniniz sessiz. Notları ve listeleri @ veya [[ ile bağlayın, burada görünsünler.",
+    "viewingOwner": "{owner} kullanıcısının beyni görüntüleniyor",
+    "summary": "{items} öğe, {links} bağlantı, {shown} gösteriliyor"
+  },
+  "apiExplorer": {
+    "title": "API gezgini",
+    "intro": "Bu örneğin (v{version}) sunduğu her uç nokta, onu çalıştıran koddan üretildi. Birini seçin, doldurun ve gönderin.",
+    "realData": "İstekler API anahtarının sahibi olarak gerçek veriler üzerinde çalışır. Burada DELETE gerçekten siler.",
+    "apiKey": "API anahtarı",
+    "apiKeyHint": "Yalnızca bu sayfada tutulur ve ayrıldığınızda unutulur.",
+    "useMyKey": "Anahtarımı kullan",
+    "noKeyYet": "Henüz bir API anahtarınız yok. Profil ayarlarınızdan bir tane oluşturun.",
+    "filter": "Filtre",
+    "filterPlaceholder": "Yol, ad veya yöntem",
+    "noMatches": "Bu filtreyle eşleşen bir şey yok.",
+    "body": "İstek gövdesi (JSON)",
+    "showSchema": "Şemayı göster",
+    "hideSchema": "Şemayı gizle",
+    "send": "Gönder",
+    "sending": "Gönderiliyor...",
+    "keyRequired": "Önce bir API anahtarı ekleyin.",
+    "noKeyNeeded": "API anahtarı gerekmez",
+    "deprecated": "kullanımdan kalktı",
+    "requestFailed": "İstek sunucuya hiç ulaşmadı. Bağlantınızı kontrol edin.",
+    "responseMeta": "{status}, {ms} ms"
   }
 }
diff --git a/app/_translations/vi.json b/app/_translations/vi.json
index 972a840e7..bc15cc5e1 100644
--- a/app/_translations/vi.json
+++ b/app/_translations/vi.json
@@ -101,7 +101,7 @@
     "deleteFile": "Xóa tập tin",
     "fileTooLarge": "Tệp quá lớn. Kích thước tối đa là {maxSizeMB} MB. Tệp của bạn có kích thước {fileSizeMB} MB.",
     "uploadFailed": "Tải lên không thành công",
-    "uploadFailedRetry": "Tải lên không thành công. Vui lòng thử lại.",
+    "uploadFailedRetry": "Tải lên không thành công. Hãy thử lại.",
     "failedToDeleteFile": "Không thể xóa tập tin",
     "previousMonth": "Tháng trước",
     "nextMonth": "Tháng tiếp theo",
@@ -134,7 +134,7 @@
     "parentCategory": "Danh mục gốc (Tùy chọn)",
     "noParent": "Không có cha mẹ (cấp cơ sở)",
     "categoryNamePlaceholder": "Nhập tên danh mục...",
-    "notAllowedName": "{name} không được phép. Vui lòng chọn một tên khác.",
+    "notAllowedName": "Không được dùng {name}. Hãy chọn tên khác.",
     "createCategory": "Tạo danh mục",
     "selectCategory": "Chọn danh mục...",
     "categoryWillBeCreatedIn": "Danh mục mới sẽ được tạo trong:",
@@ -174,7 +174,7 @@
     "noResults": "Không có kết quả",
     "by": "bởi {owner}",
     "unsavedChanges": "Những thay đổi chưa được lưu",
-    "unsavedChangesDetected": "⚠️ Đã phát hiện những thay đổi chưa được lưu",
+    "unsavedChangesDetected": "Thay đổi chưa lưu",
     "unsavedChangesMessage": "Bạn có những thay đổi chưa được lưu trong {noteTitle}. Nếu bạn rời đi bây giờ, những thay đổi của bạn sẽ bị mất.",
     "whatToDoWithUnsavedChanges": "Bạn muốn làm gì với những thay đổi chưa được lưu của mình?",
     "discard": "Loại bỏ",
@@ -248,33 +248,8 @@
     "connected": "Đã kết nối",
     "reconnecting": "Đang kết nối lại...",
     "hide": "Ẩn",
-    "thisEntry": "mục này"
-  },
-  "comments": {
-    "title": "Bình luận",
-    "titleWithCount": "{count, plural, other {# bình luận}}",
-    "noComments": "Chưa có bình luận nào. Bắt đầu trò chuyện!",
-    "addComment": "Thêm bình luận...",
-    "replyPlaceholder": "Viết phản hồi...",
-    "post": "Đăng",
-    "reply": "Trả lời",
-    "edit": "Sửa",
-    "delete": "Xóa",
-    "save": "Lưu",
-    "cancel": "Hủy",
-    "edited": "đã sửa",
-    "deleteConfirmTitle": "Xóa bình luận?",
-    "deleteConfirmMessage": "Thao tác này sẽ xóa bình luận và tất cả phản hồi. Không thể hoàn tác.",
-    "commentDeleted": "Đã xóa bình luận",
-    "commentAdded": "Đã thêm bình luận",
-    "commentUpdated": "Đã cập nhật bình luận",
-    "failedToAdd": "Không thể thêm bình luận",
-    "failedToEdit": "Không thể sửa bình luận",
-    "failedToDelete": "Không thể xóa bình luận",
-    "failedToLoad": "Không thể tải bình luận",
-    "readOnly": "Bạn cần quyền chỉnh sửa để bình luận về thẻ này.",
-    "replyTo": "Trả lời {author}",
-    "noUsersFound": "Không tìm thấy người dùng"
+    "thisEntry": "mục này",
+    "preview": "Xem trước"
   },
   "history": {
     "noteHistory": "Lịch sử ghi chú",
@@ -285,10 +260,10 @@
     "noHistoryDescription": "Lưu ghi chú của bạn để tạo một điểm lịch sử.",
     "loadMore": "Tải thêm",
     "featureDisabled": "Lịch sử bị vô hiệu hóa",
-    "disabledAdmin": "Lịch sử ghi chú hiện đang bị vô hiệu hóa. Bạn có thể kích hoạt nó trong Cài đặt quản trị > Trình chỉnh sửa.",
-    "disabledUser": "Lịch sử ghi chú hiện đang bị vô hiệu hóa. Vui lòng liên hệ với quản trị viên của bạn để kích hoạt tính năng này.",
+    "disabledAdmin": "Lịch sử ghi chú đang tắt. Bạn có thể bật trong Cài đặt quản trị > Trình chỉnh sửa.",
+    "disabledUser": "Lịch sử ghi chú đang tắt. Hãy nhờ quản trị viên bật lên.",
     "goToSettings": "Đi tới Cài đặt",
-    "manualSavesOnly": "Lịch sử chỉ được tạo khi lưu thủ công chứ không phải lưu tự động.",
+    "manualSavesOnly": "Chỉ lưu thủ công mới tạo lịch sử. Lưu tự động thì không.",
     "fetchError": "Không tải được lịch sử",
     "restoreError": "Không thể khôi phục phiên bản",
     "viewContent": "Xem nội dung",
@@ -320,7 +295,7 @@
     "sessionExpired": "Phiên của bạn đã hết hạn",
     "setupComplete": "Thiết lập hoàn tất",
     "createAccount": "Tạo tài khoản của bạn",
-    "errorOccurred": "Đã xảy ra lỗi. Vui lòng thử lại.",
+    "errorOccurred": "Đã có lỗi. Hãy thử lại.",
     "enterUsername": "Nhập tên người dùng của bạn",
     "enterPassword": "Nhập mật khẩu của bạn",
     "chooseUsername": "Chọn tên người dùng",
@@ -333,8 +308,8 @@
     "version": "Phiên bản {version}",
     "createUser": "Tạo người dùng",
     "attemptsRemaining": "Cảnh báo: còn lại {count, plural, one {# lần thử} other {# lần thử}} trước khi khóa tài khoản",
-    "accountLocked": "Quá nhiều lần thử thất bại. Vui lòng thử lại sau {seconds} {seconds, plural, one {giây} other {giây}}",
-    "notAuthorized": "Bạn không được phép truy cập ứng dụng này. Vui lòng liên hệ với quản trị viên của bạn.",
+    "accountLocked": "Quá nhiều lần thử thất bại. Hãy thử lại sau {seconds} {seconds, plural, one {giây} other {giây}}",
+    "notAuthorized": "Bạn không có quyền truy cập ứng dụng này. Hãy hỏi quản trị viên.",
     "rememberMe": "nhớ tôi"
   },
   "mfa": {
@@ -359,9 +334,9 @@
     "invalidCode": "Mã xác thực không hợp lệ",
     "invalidRecoveryCode": "Mã khôi phục không hợp lệ",
     "mfaRequired": "Yêu cầu xác thực hai yếu tố",
-    "mfaEnabledSuccess": "Đã bật xác thực hai yếu tố thành công",
+    "mfaEnabledSuccess": "Đã bật xác thực hai yếu tố",
     "mfaDisabledSuccess": "Xác thực hai yếu tố bị vô hiệu hóa",
-    "tooManyAttempts": "Quá nhiều lần thất bại. Vui lòng thử lại sau.",
+    "tooManyAttempts": "Quá nhiều lần thử thất bại. Hãy thử lại sau.",
     "disableTitle": "Vô hiệu hóa xác thực hai yếu tố",
     "disableDescription": "Nhập mã 2FA của bạn để xác nhận việc tắt xác thực hai yếu tố",
     "disableWarning": "Điều này sẽ làm cho tài khoản của bạn kém an toàn hơn. Bạn có chắc không?",
@@ -381,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "Điều này sẽ làm mất hiệu lực mã khôi phục hiện tại của bạn",
     "regenerateRecoveryCodeDescription": "Nhập mã 2FA của bạn để tạo mã khôi phục mới. Mã cũ của bạn sẽ không còn hoạt động.",
     "recoveryCodeRegenerated": "Mã khôi phục mới được tạo",
-    "recoveryCodeRegeneratedInfo": "Mã khôi phục mới của bạn đã được tạo. Hãy lưu nó ở nơi an toàn - đây là lần duy nhất bạn nhìn thấy nó.",
-    "recoveryCodeRegeneratedSuccess": "Mã khôi phục được tạo lại thành công",
+    "recoveryCodeRegeneratedInfo": "Mã khôi phục mới đã sẵn sàng. Hãy lưu ở nơi an toàn, đây là lần duy nhất bạn thấy nó.",
+    "recoveryCodeRegeneratedSuccess": "Đã tạo lại mã khôi phục",
     "recoveryCodeProfileDescription": "Sử dụng mã này để khôi phục tài khoản nếu bạn mất quyền truy cập vào ứng dụng xác thực của mình",
     "disableMfaForUser": "Tắt 2FA cho người dùng này",
     "recoveryCodeRequired": "Mã khôi phục là bắt buộc",
@@ -396,7 +371,7 @@
     "recent": "Gần đây",
     "browseAndManage": "Duyệt và quản lý tất cả các ghi chú của bạn",
     "noNotesYet": "Chưa có ghi chú nào",
-    "createFirstNote": "Tạo ghi chú đầu tiên của bạn để bắt đầu với nền tảng kiến thức của bạn.",
+    "createFirstNote": "Chưa có gì ở đây. Hãy tạo ghi chú đầu tiên.",
     "createNewNote": "Tạo ghi chú mới",
     "noNotesFound": "Không tìm thấy ghi chú nào",
     "tryAdjustingFilters": "Hãy thử điều chỉnh bộ lọc của bạn hoặc tạo ghi chú mới.",
@@ -427,6 +402,7 @@
     "enterNoteTitle": "Nhập tiêu đề ghi chú...",
     "byType": "Theo loại",
     "publiclySharedNote": "Được chia sẻ công khai",
+    "sharedPubliclyBy": "Ghi chú này được {owner} chia sẻ công khai",
     "copyRawContent": "Sao chép đánh dấu",
     "quickSave": "Lưu nhanh",
     "noteNotFound": "Không tìm thấy ghi chú",
@@ -440,9 +416,12 @@
     "readingTime": "{count, plural, one {# phút đọc} other {# phút đọc}}",
     "tags": "Thẻ",
     "noTagsFound": "Không tìm thấy thẻ nào",
-    "searchTags": "Tìm kiếm thẻ..."
+    "searchTags": "Tìm kiếm thẻ...",
+    "createNoteFailed": "Không thể tạo ghi chú",
+    "createCategoryFailed": "Không thể tạo danh mục, ghi chú cũng chưa được tạo"
   },
   "checklists": {
+    "sharedPubliclyBy": "Danh sách kiểm tra này được {owner} chia sẻ công khai",
     "title": "Danh sách kiểm tra",
     "allChecklists": "Tất cả danh sách kiểm tra",
     "completed": "Đã hoàn thành",
@@ -456,7 +435,7 @@
     "progress": "Tiến độ",
     "totalItems": "Tổng số mặt hàng",
     "noChecklistsYet": "Chưa có danh sách kiểm tra nào",
-    "createFirstChecklist": "Tạo danh sách kiểm tra đầu tiên của bạn để bắt đầu sắp xếp các nhiệm vụ của bạn.",
+    "createFirstChecklist": "Chưa có gì ở đây. Hãy tạo danh sách kiểm tra đầu tiên.",
     "newChecklist": "Danh sách kiểm tra mới",
     "noChecklistsFound": "Không tìm thấy danh sách kiểm tra nào",
     "tryAdjustingFiltersChecklist": "Hãy thử điều chỉnh bộ lọc của bạn hoặc tạo danh sách kiểm tra mới.",
@@ -525,19 +504,19 @@
     "clearAllCompletedConfirmMessage": "Bạn có chắc chắn muốn xóa tất cả {count} mục đã hoàn thành và các mục con của chúng không? Không thể hoàn tác hành động này.",
     "clearAllIncompleteConfirmMessage": "Bạn có chắc chắn muốn xóa tất cả {count} mục chưa hoàn chỉnh và các mục con của chúng không? Không thể hoàn tác hành động này.",
     "convertChecklistType": "Chuyển đổi loại danh sách kiểm tra",
-    "convertTypeConfirmation": "Bạn sắp chuyển đổi từ {currentType} sang {newType}. Bạn có chắc chắn muốn tiếp tục không?",
-    "dataLossWarning": "⚠️ Cảnh báo mất dữ liệu",
+    "convertTypeConfirmation": "Chuyển đổi từ {currentType} sang {newType}?",
+    "dataLossWarning": "Cảnh báo mất dữ liệu",
     "dataLossWarningItems": "Dữ liệu sau sẽ bị mất:",
     "allTaskStatusesReset": "Tất cả trạng thái nhiệm vụ sẽ được đặt lại",
     "timeTrackingDataLost": "Dữ liệu theo dõi thời gian sẽ bị mất",
     "estimatedTimesRemoved": "Thời gian ước tính sẽ bị xóa",
     "targetDatesCleared": "Ngày mục tiêu sẽ bị xóa",
-    "enhancedFeatures": "✨ Tính năng nâng cao",
+    "enhancedFeatures": "Bạn sẽ có",
     "enhancedFeaturesYouWillGain": "Bạn sẽ đạt được:",
     "kanbanBoardWithDragDrop": "Bảng Kanban có tính năng kéo và thả",
     "taskStatusTracking": "Theo dõi trạng thái nhiệm vụ (Todo, In Progress, v.v.)",
     "timeTrackingWithTimer": "Theo dõi thời gian với bộ đếm thời gian tích hợp",
-    "actionCannotBeUndone": "Không thể hoàn tác hành động này. Bạn có chắc chắn muốn chuyển đổi?",
+    "actionCannotBeUndone": "Không thể hoàn tác. Vẫn chuyển đổi?",
     "convertAndLoseData": "Chuyển đổi và mất dữ liệu",
     "convert": "Chuyển đổi",
     "convertToSimpleChecklist": "Chuyển đổi sang danh sách kiểm tra đơn giản",
@@ -551,10 +530,36 @@
     "noItemsYet": "Chưa có mục nào",
     "addFirstItem": "Thêm mục đầu tiên của bạn để bắt đầu!",
     "noTasks": "Không có nhiệm vụ",
-    "noSubtasksYet": "Chưa có nhiệm vụ phụ nào. Thêm một cái bên dưới để bắt đầu.",
+    "noSubtasksYet": "Chưa có nhiệm vụ phụ. Thêm một cái bên dưới.",
     "addTime": "Thêm thời gian",
     "enterTimeInMinutes": "Nhập thời gian của bạn tính bằng phút"
   },
+  "comments": {
+    "title": "Bình luận",
+    "titleWithCount": "{count, plural, other {# bình luận}}",
+    "noComments": "Chưa có bình luận nào. Bắt đầu trò chuyện!",
+    "addComment": "Thêm bình luận...",
+    "replyPlaceholder": "Viết phản hồi...",
+    "post": "Đăng",
+    "reply": "Trả lời",
+    "edit": "Sửa",
+    "delete": "Xóa",
+    "save": "Lưu",
+    "cancel": "Hủy",
+    "edited": "đã sửa",
+    "deleteConfirmTitle": "Xóa bình luận?",
+    "deleteConfirmMessage": "Thao tác này sẽ xóa bình luận và tất cả phản hồi. Không thể hoàn tác.",
+    "commentDeleted": "Đã xóa bình luận",
+    "commentAdded": "Đã thêm bình luận",
+    "commentUpdated": "Đã cập nhật bình luận",
+    "failedToAdd": "Không thể thêm bình luận",
+    "failedToEdit": "Không thể sửa bình luận",
+    "failedToDelete": "Không thể xóa bình luận",
+    "failedToLoad": "Không thể tải bình luận",
+    "readOnly": "Bạn cần quyền chỉnh sửa để bình luận về thẻ này.",
+    "replyTo": "Trả lời {author}",
+    "noUsersFound": "Không tìm thấy người dùng"
+  },
   "tasks": {
     "title": "Nhiệm vụ",
     "addTask": "Thêm nhiệm vụ",
@@ -582,7 +587,7 @@
     "overdue": "Quá hạn",
     "browseAndManageTaskLists": "Duyệt và quản lý tất cả danh sách nhiệm vụ của bạn",
     "noTaskListsYet": "Chưa có danh sách nhiệm vụ",
-    "createFirstTaskList": "Tạo danh sách nhiệm vụ đầu tiên của bạn để bắt đầu quản lý dự án của bạn.",
+    "createFirstTaskList": "Chưa có gì ở đây. Hãy tạo danh sách nhiệm vụ đầu tiên.",
     "newTaskList": "Danh sách nhiệm vụ mới",
     "taskLists": "Danh sách nhiệm vụ",
     "noTaskListsFound": "Không tìm thấy danh sách nhiệm vụ",
@@ -630,7 +635,7 @@
     "changeStatus": "Thay đổi trạng thái",
     "noBoards": "Không tìm thấy bảng nào",
     "noBoardsYet": "Chưa có bảng Kanban nào",
-    "createFirstBoard": "Tạo bảng Kanban đầu tiên để bắt đầu quản lý dự án của bạn.",
+    "createFirstBoard": "Chưa có gì ở đây. Hãy tạo bảng Kanban đầu tiên.",
     "newBoard": "Bảng mới",
     "tryAdjustingFilters": "Hãy thử điều chỉnh bộ lọc của bạn hoặc tạo một bảng mới.",
     "completed": "Đã hoàn thành",
@@ -683,7 +688,7 @@
     "quickSettingsHeader": "Cài đặt nhanh (chỉ thiết bị)",
     "adminSettings": "Trang tổng quan dành cho quản trị viên",
     "apiKey": "Khóa API",
-    "apiKeyDescription": "Tạo khóa API để truy cập theo chương trình vào danh sách kiểm tra và ghi chú của bạn",
+    "apiKeyDescription": "Tạo khóa API để script và ứng dụng truy cập danh sách kiểm tra và ghi chú của bạn",
     "hideApiKey": "Ẩn khóa API",
     "showApiKey": "Hiển thị khóa API",
     "copyApiKey": "Sao chép khóa API",
@@ -701,15 +706,15 @@
     "removeAvatar": "Xóa hình đại diện",
     "usernameRequired": "Tên người dùng là bắt buộc",
     "passwordsDoNotMatch": "Mật khẩu mới không khớp",
-    "profileUpdated": "Hồ sơ được cập nhật thành công!",
+    "profileUpdated": "Đã cập nhật hồ sơ",
     "failedToUpdateProfile": "Không thể cập nhật hồ sơ",
-    "failedToUpdateProfileRetry": "Không thể cập nhật hồ sơ. Vui lòng thử lại.",
-    "avatarUpdated": "Đã cập nhật hình đại diện thành công!",
+    "failedToUpdateProfileRetry": "Không thể cập nhật hồ sơ. Hãy thử lại.",
+    "avatarUpdated": "Đã cập nhật hình đại diện",
     "failedToUpdateAvatar": "Không cập nhật được hình đại diện",
-    "failedToUpdateAvatarRetry": "Không cập nhật được hình đại diện. Vui lòng thử lại.",
-    "avatarRemoved": "Đã xóa avatar thành công!",
+    "failedToUpdateAvatarRetry": "Không thể cập nhật hình đại diện. Hãy thử lại.",
+    "avatarRemoved": "Đã xóa hình đại diện",
     "failedToRemoveAvatar": "Không xóa được hình đại diện",
-    "failedToRemoveAvatarRetry": "Không xóa được hình đại diện. Vui lòng thử lại.",
+    "failedToRemoveAvatarRetry": "Không thể xóa hình đại diện. Hãy thử lại.",
     "activeSessions": "Phiên hoạt động",
     "activeSession": "{count} phiên hoạt động",
     "activeSession_plural": "{count} phiên hoạt động",
@@ -727,11 +732,11 @@
     "auditLogsTab": "Nhật ký người dùng",
     "rebuildLinkIndexes": "Xây dựng lại chỉ mục liên kết để cập nhật dữ liệu kết nối",
     "rebuildingLinkIndex": "Xây dựng lại chỉ mục liên kết...",
-    "successfullyRebuiltIndex": "Đã xây dựng lại thành công chỉ mục liên kết",
-    "successfullyRebuiltIndexReload": "Đã xây dựng lại chỉ mục liên kết thành công! Trang sẽ tải lại để hiển thị các kết nối được cập nhật.",
-    "failedToRebuildIndex": "Không thể xây dựng lại chỉ mục liên kết. Vui lòng thử lại.",
+    "successfullyRebuiltIndex": "Đã xây dựng lại chỉ mục liên kết",
+    "successfullyRebuiltIndexReload": "Đã xây dựng lại chỉ mục liên kết. Trang sẽ tải lại để hiển thị các kết nối mới.",
+    "failedToRebuildIndex": "Không thể xây dựng lại chỉ mục liên kết. Hãy thử lại.",
     "contentLinks": "Liên kết nội dung",
-    "visualizeRelationships": "Trực quan hóa mối quan hệ giữa ghi chú và danh sách kiểm tra của bạn",
+    "visualizeRelationships": "Xem các ghi chú và danh sách kiểm tra liên kết với nhau thế nào",
     "connectedItems": "Các mục được kết nối",
     "noLinksFound": "Không tìm thấy liên kết",
     "startCreatingInternalLinks": "Bắt đầu tạo liên kết nội bộ bằng cách nhập `@` vào ghi chú của bạn để xem mạng lưới mối quan hệ tại đây.",
@@ -742,8 +747,8 @@
     "isolated": "bị cô lập",
     "connection": "kết nối",
     "connection_plural": "kết nối",
-    "terminateSessionConfirm": "Bạn có chắc chắn muốn chấm dứt phiên này không?",
-    "terminateAllSessionsConfirm": "Bạn có chắc chắn muốn chấm dứt tất cả các phiên khác không?",
+    "terminateSessionConfirm": "Kết thúc phiên này?",
+    "terminateAllSessionsConfirm": "Kết thúc tất cả các phiên khác?",
     "validationErrorTitle": "Lỗi xác thực",
     "visibleGraphSummary": "{items} mục hiển thị, {links} liên kết hiển thị",
     "graphTruncated": "Hiển thị các mục {visible} hàng đầu theo số lượng kết nối. {omitted} mục có kết nối thấp hơn đã bị bỏ qua.",
@@ -814,10 +819,10 @@
     "chooseAutoSaveInterval": "Chọn khoảng thời gian để tự động lưu ghi chú của bạn.",
     "defaultMode": "Chế độ mặc định",
     "selectNotesDefaultMode": "Chọn chế độ mặc định ghi chú",
-    "chooseNotesDefaultMode": "Chọn xem ghi chú có tự động ở chế độ chỉnh sửa hay không có nút {mode} trong trình chỉnh sửa ghi chú).",
+    "chooseNotesDefaultMode": "Chọn xem ghi chú có mở ở chế độ chỉnh sửa hay không. Bạn luôn có thể đổi bằng nút {mode} trong trình chỉnh sửa ghi chú.",
     "defaultEditor": "Trình chỉnh sửa mặc định",
     "selectNotesDefaultEditor": "Chọn trình soạn thảo mặc định của ghi chú",
-    "chooseDefaultEditor": "Chọn trình chỉnh sửa mặc định cho ghi chú của bạn - (bạn luôn có thể chuyển đổi bằng cách nhấp vào nút {editor} trong trình chỉnh sửa ghi chú).",
+    "chooseDefaultEditor": "Chọn trình chỉnh sửa mặc định cho ghi chú. Bạn luôn có thể đổi bằng nút {editor} trong trình chỉnh sửa ghi chú.",
     "tableSyntaxInNotes": "Cú pháp bảng trong ghi chú",
     "selectTableSyntax": "Chọn cú pháp bảng",
     "chooseTableSyntax": "Chọn cách hiển thị bảng trong ghi chú của bạn.",
@@ -826,7 +831,7 @@
     "chooseSyntaxTheme": "Chọn chủ đề tô sáng cú pháp cho trình chỉnh sửa đánh dấu.",
     "minimalMode": "Chế độ tối thiểu (Tắt trình soạn thảo văn bản đa dạng thức)",
     "selectMinimalMode": "Chọn chế độ tối thiểu",
-    "minimalModeDescription": "Khi được bật, hãy sử dụng trình kết xuất đánh dấu đơn giản thay vì trình soạn thảo văn bản đa dạng thức. Các tính năng nâng cao như liên kết song phương sẽ không hoạt động ở chế độ này.",
+    "minimalModeDescription": "Dùng trình hiển thị markdown đơn giản thay cho trình soạn thảo văn bản đa dạng thức. Liên kết hai chiều và các tính năng nâng cao khác không hoạt động ở chế độ này.",
     "defaultNoteFilter": "Bộ lọc ghi chú mặc định",
     "selectDefaultNoteFilter": "Chọn bộ lọc ghi chú mặc định",
     "chooseDefaultNoteFilter": "Chọn bộ lọc mặc định để áp dụng khi mở trang Ghi chú.",
@@ -853,8 +858,8 @@
     "currentPassword": "Mật khẩu hiện tại",
     "newPassword": "Mật khẩu mới",
     "confirmPassword": "Xác nhận mật khẩu",
-    "passwordChanged": "Đã thay đổi mật khẩu thành công",
-    "settingsSaved": "Đã lưu cài đặt thành công",
+    "passwordChanged": "Đã đổi mật khẩu",
+    "settingsSaved": "Đã lưu cài đặt",
     "dashCase": "Định dạng dấu gạch ngang (ví dụ: my-file-name.md)",
     "minimal": "Tối thiểu (chỉ xóa các ký tự không hợp lệ)",
     "noRename": "Không đổi tên (giữ tên file gốc)",
@@ -888,7 +893,7 @@
     "chooseQuickCreateNotes": "Chọn chế độ tạo ghi chú nhanh.",
     "quickCreateNotesShowModal": "Hiển thị phương thức khi tạo ghi chú",
     "quickCreateNotesSkipModal": "Bỏ qua phương thức và tạo ngay lập tức",
-    "quickCreateNotesDescription": "Khi được bật, việc tạo ghi chú mới sẽ bỏ qua phương thức tạo ghi chú và đưa bạn đến thẳng trình chỉnh sửa ghi chú.",
+    "quickCreateNotesDescription": "Bỏ qua hộp thoại tạo ghi chú và đưa bạn thẳng vào trình chỉnh sửa.",
     "defaultCategory": "Danh mục mặc định để tạo ghi chú nhanh",
     "selectDefaultCategory": "Chọn danh mục mặc định...",
     "defaultCategoryDescription": "Ghi chú mới sẽ được tạo trong danh mục này khi sử dụng tính năng tạo nhanh.",
@@ -926,7 +931,7 @@
     "hideStatusOnCardsLabel": "Trạng thái trên thẻ Kanban",
     "showStatusOnCards": "Hiển thị trạng thái",
     "hideStatusOnCards": "Ẩn trạng thái",
-    "hideStatusOnCardsDescription": "Ẩn nhãn trạng thái khỏi các mục thẻ Kanban. Trạng thái đã được biểu thị bằng cột mà thẻ được đặt vào.",
+    "hideStatusOnCardsDescription": "Ẩn nhãn trạng thái trên thẻ Kanban. Cột đã cho biết trạng thái.",
     "hideMobileStatusDropdownLabel": "Trạng thái di động thả xuống trên thẻ",
     "showMobileStatusDropdown": "Hiển thị menu thả xuống trên thiết bị di động",
     "hideMobileStatusDropdown": "Ẩn danh sách thả xuống trên thiết bị di động",
@@ -944,14 +949,16 @@
     "codeBlockChoiceDescription": "Chọn giữa kiểu khối mã mặc định giống như codepen hoặc kiểu khối mã theo chủ đề.",
     "checklistItemClickAction": "Hành động nhấp vào mục danh sách kiểm tra",
     "selectChecklistItemClickAction": "Chọn hành động nhấp vào mục danh sách kiểm tra",
-    "checklistItemClickActionDescription": "Chọn điều gì sẽ xảy ra khi bạn nhấp vào văn bản của nhiệm vụ. \"Đánh dấu là hoàn thành\" chuyển đổi hộp kiểm (mặc định); \"Chỉnh sửa tên tác vụ\" sẽ mở tác vụ để chỉnh sửa nội tuyến — bạn vẫn cần phải nhấp vào hộp kiểm để hoàn thành tác vụ đó.",
+    "checklistItemClickActionDescription": "Chọn điều xảy ra khi bạn nhấp vào văn bản của nhiệm vụ. \"Đánh dấu là hoàn thành\" (mặc định) bật tắt hộp kiểm. \"Chỉnh sửa tên tác vụ\" mở tác vụ để chỉnh sửa tại chỗ, và bạn nhấp vào chính hộp kiểm để hoàn thành.",
     "checklistItemClickActionToggle": "Đánh dấu là hoàn thành/chưa hoàn thành",
     "checklistItemClickActionEdit": "Chỉnh sửa mục danh sách",
     "newItemInsertion": "Vị trí thêm mục mới",
     "selectNewItemInsertion": "Chọn nơi thêm mục mới",
     "newItemInsertionDescription": "Chọn xem các mục mới được thêm vào đầu (mặc định) hay cuối danh sách kiểm tra.",
     "newItemInsertionTop": "Đầu danh sách",
-    "newItemInsertionBottom": "Cuối danh sách"
+    "newItemInsertionBottom": "Cuối danh sách",
+    "selectShowChecklistEmojis": "Chọn hiển thị biểu tượng cảm xúc",
+    "showChecklistEmojisDescription": "Hiển thị biểu tượng cảm xúc tự động bên cạnh các mục danh sách kiểm tra, dựa trên nội dung của chúng."
   },
   "admin": {
     "title": "Quản trị viên",
@@ -992,11 +999,11 @@
     "icon512": "Biểu tượng 512x512",
     "icon512Description": "Biểu tượng có độ phân giải cao cho màn hình giật gân PWA.",
     "notifyNewUpdates": "Thông báo cho tôi những cập nhật mới",
-    "thisUsesGithubAPI": "Điều này sử dụng API GitHub để tìm nạp các bản cập nhật, vô hiệu hóa hoàn toàn API và không cho phép bất kỳ lưu lượng truy cập nào vào và ra từ github.",
+    "thisUsesGithubAPI": "Tính năng này dùng API GitHub để kiểm tra bản cập nhật. Tắt đi sẽ chặn mọi lưu lượng đến và từ GitHub.",
     "parseContent": "Luôn hiển thị nội dung được phân tích cú pháp",
-    "parseContentEnabledDescription": "Khi được bật, cài đặt này sẽ hiển thị các tiêu đề được phân tích cú pháp trong thanh bên, kết quả tìm kiếm và tổng thể trên ứng dụng.",
-    "parseContentDisabledDescription": "Khi bị tắt, tên tệp gốc sẽ được làm sạch, giúp con người có thể đọc được và hiển thị thay thế.",
-    "parseContentPerformanceWarning": "Đặt cài đặt này thành \"không\" sẽ cải thiện hiệu suất trên các tập dữ liệu lớn nhưng có thể ảnh hưởng đến khả năng đọc - đặc biệt là trên tên tệp không có ký tự Latinh.",
+    "parseContentEnabledDescription": "Hiển thị tiêu đề đã phân tích trong thanh bên, kết quả tìm kiếm và mọi nơi khác trong ứng dụng.",
+    "parseContentDisabledDescription": "Thay vào đó hiển thị tên tệp gốc, đã được làm gọn cho dễ đọc.",
+    "parseContentPerformanceWarning": "Đặt thành \"không\" giúp các phiên bản lớn chạy nhanh hơn nhưng tiêu đề khó đọc hơn, nhất là tên tệp có ký tự không phải Latinh.",
     "hideLanguageSelector": "Ẩn bộ chọn ngôn ngữ trong tiêu đề",
     "hideLanguageSelectorDescription": "Hiển thị/ẩn danh sách ngôn ngữ thả xuống trong tiêu đề",
     "defaultDateFormat": "Định dạng ngày mặc định",
@@ -1009,7 +1016,7 @@
     "loadError": "Lỗi tải",
     "couldNotFetchSettings": "Không thể tìm nạp cài đặt.",
     "failedToLoadSettings": "Không tải được cài đặt",
-    "settingsSavedSuccessfully": "Đã lưu cài đặt thành công.",
+    "settingsSavedSuccessfully": "Đã lưu cài đặt.",
     "failedToSaveSettings": "Không lưu được cài đặt",
     "saveError": "Lưu lỗi",
     "unknownErrorOccurred": "Đã xảy ra lỗi không xác định.",
@@ -1022,7 +1029,7 @@
     "colorVariables": "Biến màu",
     "livePreview": "Xem trước trực tiếp",
     "unsavedCssChanges": "Bạn chưa lưu các thay đổi CSS.",
-    "noCustomThemesYet": "Chưa có chủ đề tùy chỉnh nào được tạo. Nhấp vào \"Tạo chủ đề\" để bắt đầu.",
+    "noCustomThemesYet": "Chưa có chủ đề tùy chỉnh. Nhấp vào \"Tạo chủ đề\" để tạo một cái.",
     "myCustomTheme": "Chủ đề tùy chỉnh của tôi",
     "iconNameDescription": "tên biểu tượng (ví dụ: PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "Phiên bản ứng dụng",
@@ -1061,22 +1068,22 @@
     "configureExternalServices": "Định cấu hình URL dịch vụ bên ngoài để tích hợp trình chỉnh sửa.",
     "drawioUrl": "URL Draw.io",
     "optional": "(Tùy chọn)",
-    "drawioUrlDescription": "Chỉ định URL phiên bản Draw.io tùy chỉnh. Để trống để sử dụng phiên bản công khai mặc định (https://embed.diagrams.net).",
+    "drawioUrlDescription": "Dùng phiên bản Draw.io của riêng bạn. Để trống để dùng phiên bản công khai (https://embed.diagrams.net).",
     "drawioUrlExample": "Ví dụ về tự lưu trữ: https://your-domain.com/drawio",
     "drawioProxyEnabled": "Proxy Draw.io thông qua Jotty",
-    "drawioProxyEnabledDescription": "Kích hoạt tính năng này để định tuyến lưu lượng truy cập Draw.io qua máy chủ của Jotty. Bắt buộc đối với các URL mạng Docker nội bộ (ví dụ: http://drawio:8080) không thể truy cập được từ trình duyệt của người dùng.",
+    "drawioProxyEnabledDescription": "Định tuyến lưu lượng Draw.io qua máy chủ của Jotty. Cần cho các URL mạng Docker nội bộ (ví dụ: http://drawio:8080) mà trình duyệt của người dùng không truy cập được.",
     "excalidrawUrl": "URL Excalidraw",
-    "excalidrawUrlDescription": "Chỉ định URL phiên bản Excalidraw tùy chỉnh. Để trống để sử dụng phiên bản công khai mặc định (https://excalidraw.com).",
+    "excalidrawUrlDescription": "Dùng phiên bản Excalidraw của riêng bạn. Để trống để dùng phiên bản công khai (https://excalidraw.com).",
     "excalidrawUrlExample": "Ví dụ về tự lưu trữ: https://your-domain.com/excalidraw",
     "excalidrawProxyEnabled": "Proxy Excalidraw thông qua Jotty",
-    "excalidrawProxyEnabledDescription": "Kích hoạt tính năng này để định tuyến lưu lượng truy cập Excalidraw qua máy chủ của Jotty. Bắt buộc đối với các URL mạng Docker nội bộ (ví dụ: http://excalidraw:3000) không thể truy cập được từ trình duyệt của người dùng.",
+    "excalidrawProxyEnabledDescription": "Định tuyến lưu lượng Excalidraw qua máy chủ của Jotty. Cần cho các URL mạng Docker nội bộ (ví dụ: http://excalidraw:3000) mà trình duyệt của người dùng không truy cập được.",
     "saving": "Đang lưu...",
-    "editorSettingsSaved": "Cài đặt trình chỉnh sửa đã được lưu thành công.",
+    "editorSettingsSaved": "Đã lưu cài đặt trình chỉnh sửa.",
     "customEmojis": "Cá nhân hóa biểu tượng cảm xúc",
-    "noEmojisYet": "Chưa có biểu tượng cảm xúc tùy chỉnh nào được tạo. Nhấp vào \"Thêm biểu tượng cảm xúc\" để bắt đầu.",
-    "enterAnyEmoji": "Nhập bất kỳ biểu tượng cảm xúc nào hoặc sử dụng bộ chọn biểu tượng cảm xúc (Win: Win+.; Mac: Ctrl+Cmd+Space",
+    "noEmojisYet": "Chưa có biểu tượng cảm xúc tùy chỉnh. Nhấp vào &quot;Thêm biểu tượng cảm xúc&quot; để thêm một cái.",
+    "enterAnyEmoji": "Nhập bất kỳ biểu tượng cảm xúc nào hoặc dùng bộ chọn biểu tượng cảm xúc (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Tổng quan về hoạt động chia sẻ",
-    "detailedSharingBreakdown": "Phân tích chi tiết về mô hình chia sẻ và mức độ tương tác của người dùng",
+    "detailedSharingBreakdown": "Những gì được chia sẻ, và ai chia sẻ",
     "checkForUpdates": "Kiểm tra cập nhật",
     "checkingForUpdates": "Đang kiểm tra cập nhật...",
     "updateAvailable": "Cập nhật có sẵn!",
@@ -1091,12 +1098,12 @@
     "userContent": "{checklistsLength} danh sách kiểm tra • {notesLength} ghi chú",
     "rebuildIndexes": "Xây dựng lại chỉ mục",
     "rebuilding": "Xây dựng lại...",
-    "successfullyRebuiltIndex": "Đã xây dựng lại thành công chỉ mục liên kết cho {username}",
+    "successfullyRebuiltIndex": "Đã xây dựng lại chỉ mục liên kết cho {username}",
     "failedToRebuildIndex": "Không thể xây dựng lại chỉ mục liên kết cho {username}",
     "totalItems": "{items} tổng số mục trên {userCount}",
     "privileges": "Đặc quyền của quản trị viên",
     "adminContentAccess": "Quyền truy cập nội dung của quản trị viên",
-    "adminContentAccessDescription": "Kiểm soát xem quản trị viên có thể truy cập tất cả ghi chú và danh sách kiểm tra của người dùng hay không. Khi bị tắt, quản trị viên chỉ có thể quản lý người dùng và cài đặt nhưng không thể xem nội dung của người dùng khác.",
+    "adminContentAccessDescription": "Cho phép quản trị viên mở ghi chú và danh sách kiểm tra của mọi người dùng. Khi tắt, quản trị viên vẫn quản lý được người dùng và cài đặt nhưng không xem được nội dung của người khác.",
     "adminContentAccessYes": "Quản trị viên có thể truy cập tất cả nội dung",
     "adminContentAccessNo": "Quản trị viên chỉ có thể truy cập nội dung của riêng họ",
     "superAdminOnly": "Chỉ chủ sở hữu hệ thống mới có thể chỉnh sửa",
@@ -1106,21 +1113,21 @@
     "confirmNewPassword": "Xác nhận mật khẩu mới",
     "dataExport": "Xuất dữ liệu",
     "dataExportOptions": "Tùy chọn xuất dữ liệu",
-    "selectExportType": "Chọn loại xuất và tải xuống dữ liệu từ ứng dụng của bạn.",
+    "selectExportType": "Chọn loại xuất và tải dữ liệu xuống.",
     "allChecklistsAndNotes": "Tất cả danh sách kiểm tra và ghi chú",
-    "allChecklistsAndNotesDescription": "Xuất tất cả danh sách kiểm tra và ghi chú được tạo bởi tất cả người dùng. Điều này sẽ tạo một tệp zip chứa dữ liệu JSON được sắp xếp theo người dùng và danh mục.",
+    "allChecklistsAndNotesDescription": "Xuất danh sách kiểm tra và ghi chú của mọi người dùng thành tệp zip chứa các tệp JSON, nhóm theo người dùng và danh mục.",
     "userChecklistsNotes": "Danh sách kiểm tra và ghi chú của người dùng cụ thể",
-    "userChecklistsNotesDescription": "Chọn một người dùng từ danh sách thả xuống để xuất tất cả danh sách kiểm tra và ghi chú của người dùng cụ thể đó.",
+    "userChecklistsNotesDescription": "Chọn một người dùng trong danh sách thả xuống để xuất tất cả danh sách kiểm tra và ghi chú của họ.",
     "allUsersData": "Tất cả dữ liệu tài khoản người dùng",
     "allUsersDataDescription": "Xuất tệp JSON có tất cả thông tin tài khoản người dùng (tên người dùng, trạng thái quản trị viên, v.v.). Điều này KHÔNG bao gồm danh sách kiểm tra hoặc nội dung ghi chú của họ.",
     "wholeDataFolder": "Toàn bộ thư mục dữ liệu (Sao lưu)",
-    "wholeDataFolderDescription": "Xuất toàn bộ thư mục 'dữ liệu', bao gồm tất cả nội dung, siêu dữ liệu và cài đặt của người dùng. Hãy thận trọng khi sử dụng vì đây có thể là một tệp lớn.",
+    "wholeDataFolderDescription": "Xuất toàn bộ thư mục 'data', gồm mọi nội dung, siêu dữ liệu và cài đặt của người dùng. Tệp này có thể rất lớn.",
     "noSharingPermissionsLabel": "Các mục được chia sẻ cụ thể sẽ bị ẩn dựa trên quyền truy cập nội dung của bạn.",
     "contentHidden": "Chi tiết nội dung bị ẩn",
     "viewOnlySettingsNotice": "Chỉ chủ sở hữu hệ thống mới có thể sửa đổi các cài đặt này.",
     "auditLogContentRedacted": "[Nội dung bị ẩn]",
     "maxLogAgeDays": "Tuổi đăng nhập tối đa (ngày)",
-    "maxLogAgeDaysDescription": "Đặt thời gian lưu giữ nhật ký kiểm tra. Khi xem trang nhật ký kiểm tra, bạn sẽ được nhắc xóa các nhật ký cũ hơn ngưỡng này. Đặt thành 0 để lưu giữ không giới hạn (không có lời nhắc dọn dẹp tự động).",
+    "maxLogAgeDaysDescription": "Thời gian giữ nhật ký kiểm tra. Trang nhật ký kiểm tra sẽ đề nghị dọn các nhật ký cũ hơn mốc này. Đặt 0 để giữ nhật ký mãi mãi và không bao giờ nhận lời nhắc.",
     "appPreferences": "Tùy chọn ứng dụng",
     "editEmoji": "Chỉnh sửa biểu tượng cảm xúc",
     "addEmoji": "Thêm biểu tượng cảm xúc",
@@ -1138,7 +1145,11 @@
     "updatingTags": "Đang cập nhật...",
     "updateTagsTitle": "Quét ghi chú để tìm hashtag và cập nhật nội dung chính",
     "tagsUpdated": "Đã xử lý tệp {processed}, cập nhật {updated} với thẻ mới",
-    "failedToUpdateTags": "Không cập nhật được thẻ"
+    "failedToUpdateTags": "Không cập nhật được thẻ",
+    "borderRadius": "Bo góc",
+    "borderRadiusDescription": "Đặt độ bo góc cho toàn bộ phiên bản. Người dùng có thể ghi đè cho riêng mình trong cài đặt nhanh.",
+    "borderRadiusSaved": "Đã lưu độ bo góc",
+    "borderRadiusLoadError": "Không thể tải độ bo góc"
   },
   "errors": {
     "notFound": "Không tìm thấy",
@@ -1150,6 +1161,9 @@
     "tryAgain": "Thử lại",
     "contactSupport": "Liên hệ hỗ trợ",
     "invalidInput": "Đầu vào không hợp lệ",
+    "invalidEditorSettings": "Cài đặt trình chỉnh sửa phải là một đối tượng, chưa lưu gì",
+    "invalidEditorSetting": "Cài đặt trình chỉnh sửa {field} sai kiểu, chưa lưu gì",
+    "categoryOutOfBounds": "Danh mục đó nằm ngoài ghi chú của bạn, nên chưa tạo gì",
     "requiredField": "Trường này là bắt buộc",
     "emailInvalid": "Vui lòng nhập email hợp lệ",
     "passwordTooShort": "Mật khẩu phải có ít nhất 8 ký tự",
@@ -1157,43 +1171,44 @@
     "networkError": "Lỗi mạng",
     "timeout": "Yêu cầu hết thời gian",
     "permissionDenied": "Quyền bị từ chối",
-    "requiredPermissions": "Bạn không có quyền cần thiết để thực hiện hành động này.",
+    "requiredPermissions": "Bạn không có quyền làm việc đó.",
     "loadError": "Lỗi tải",
     "failedToLoadCustomEmojis": "Không tải được biểu tượng cảm xúc tùy chỉnh",
-    "emojiDeletedSuccessfully": "Đã xóa biểu tượng cảm xúc thành công",
+    "emojiDeletedSuccessfully": "Đã xóa biểu tượng cảm xúc",
     "deleteError": "Xóa lỗi",
     "failedToDeleteEmoji": "Không xóa được biểu tượng cảm xúc",
     "validationError": "Lỗi xác thực",
     "keywordAndEmojiRequired": "Bắt buộc phải có từ khóa và biểu tượng cảm xúc",
     "duplicateKeyword": "Từ khóa trùng lặp",
     "keywordAlreadyExists": "Từ khóa đã tồn tại",
-    "emojiUpdatedSuccessfully": "Đã cập nhật biểu tượng cảm xúc thành công",
-    "emojiCreatedSuccessfully": "Đã tạo biểu tượng cảm xúc thành công",
+    "emojiUpdatedSuccessfully": "Đã cập nhật biểu tượng cảm xúc",
+    "emojiCreatedSuccessfully": "Đã tạo biểu tượng cảm xúc",
     "saveError": "Lưu lỗi",
     "failedToSaveEmoji": "Không lưu được biểu tượng cảm xúc",
     "failedToLoadCustomCSS": "Không tải được CSS tùy chỉnh",
     "couldNotLoadCustomCSS": "Không thể tải CSS tùy chỉnh.",
     "couldNotLoadThemes": "Không thể tải chủ đề.",
-    "customCSSSavedSuccessfully": "Đã lưu CSS tùy chỉnh thành công.",
+    "customCSSSavedSuccessfully": "Đã lưu CSS tùy chỉnh.",
     "themeNotFound": "Không tìm thấy chủ đề.",
-    "themeDeletedSuccessfully": "Đã xóa chủ đề thành công.",
+    "themeDeletedSuccessfully": "Đã xóa chủ đề.",
     "themeNameRequired": "Tên chủ đề là bắt buộc.",
-    "themeSavedSuccessfully": "Chủ đề {action} thành công.",
+    "themeSavedSuccessfully": "Chủ đề đã được {action}.",
     "anUnknownErrorOccurred": "Đã xảy ra lỗi không xác định.",
     "usernameRequired": "Tên người dùng là bắt buộc",
     "passwordRequired": "Cần có mật khẩu",
     "passwordMinLength": "Mật khẩu phải dài ít nhất 6 ký tự",
     "passwordsDoNotMatch": "Mật khẩu không khớp",
-    "userSavedSuccessfully": "Người dùng {mode} thành công!",
+    "userSavedSuccessfully": "Người dùng đã được {mode}.",
     "failedToSaveUser": "Không thể {mode} người dùng",
     "anErrorOccurred": "Đã xảy ra lỗi.",
     "deleteUserConfirmation": "Xóa người dùng \"{username}\"? Điều này không thể hoàn tác được.",
-    "userDeletedSuccessfully": "Người dùng đã xóa thành công!",
-    "failedToDeleteUser": "Không thể xóa người dùng"
+    "userDeletedSuccessfully": "Đã xóa người dùng.",
+    "failedToDeleteUser": "Không thể xóa người dùng",
+    "readOnlyFolder": "Thư mục này chỉ đọc trên máy chủ, nên không lưu được thay đổi."
   },
   "pwa": {
     "installPromptTitle": "Cài đặt ứng dụng",
-    "installPromptMessage": "Cài đặt ứng dụng này trên thiết bị của bạn để có trải nghiệm tốt hơn",
+    "installPromptMessage": "Cài Jotty trên thiết bị để mở như một ứng dụng",
     "installButton": "cài đặt",
     "updateAvailable": "Cập nhật có sẵn",
     "updateMessage": "Đã có phiên bản mới",
@@ -1251,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "Chuyển đổi chế độ soạn thảo phong phú",
     "toggleMarkdownMode": "Chuyển đổi chế độ Markdown",
+    "quickControls": "Điều khiển trình chỉnh sửa",
     "toggleBold": "Chuyển đổi in đậm",
     "toggleItalic": "Chuyển đổi chữ nghiêng",
     "toggleUnderline": "Chuyển đổi gạch chân",
@@ -1385,7 +1401,29 @@
     "failedToCopyUrl": "Không sao chép được URL vào bảng nhớ tạm",
     "searchUsers": "Tìm kiếm người dùng...",
     "toggleAllPermissions": "Chuyển đổi tất cả các quyền",
-    "shareModalTitle": "Chia sẻ {type}"
+    "shareModalTitle": "Chia sẻ {type}",
+    "readOnly": "Chỉ đọc",
+    "byOwner": "được chia sẻ bởi {user}",
+    "mountStaysTop": "Thư mục được chia sẻ luôn ở cấp cao nhất",
+    "inheritedVia": "Được chia sẻ qua {category}, bởi {user}",
+    "shareFolder": "Chia sẻ thư mục này",
+    "folderShareHint": "Mọi thứ trong thư mục này, hiện tại và sau này, đều được chia sẻ với những người bạn chọn.",
+    "optOut": "Giữ riêng mục này",
+    "optOutHint": "Chỉ ghi đè chia sẻ thư mục cho mục này.",
+    "useInherited": "Theo thư mục",
+    "publicFolderWarning": "Bất cứ thứ gì đặt vào thư mục này sẽ ngay lập tức đọc được bởi bất kỳ ai có liên kết.",
+    "readTip": "Chỉ đọc: {users}",
+    "writeTip": "Có thể chỉnh sửa: {users}",
+    "deleteTip": "Có thể chỉnh sửa và xóa: {users}",
+    "publicTip": "Được chia sẻ công khai",
+    "fromUserRead": "Chỉ đọc, được chia sẻ bởi {user}",
+    "fromUserWrite": "Có thể chỉnh sửa, được chia sẻ bởi {user}",
+    "fromUserDelete": "Có thể chỉnh sửa và xóa, được chia sẻ bởi {user}",
+    "leaveShare": "Rời chia sẻ",
+    "confirmLeaveItem": "Gỡ quyền truy cập của chính bạn vào \"{itemTitle}\"? Nó sẽ biến mất khỏi thanh bên và chủ sở hữu phải chia sẻ lại để bạn có lại.",
+    "confirmLeaveFolder": "Gỡ quyền truy cập của chính bạn vào \"{categoryName}\", được chia sẻ bởi {owner}? Nó sẽ biến mất khỏi thanh bên và {owner} phải chia sẻ lại để bạn có lại.",
+    "canCreate": "Có thể tạo",
+    "createHint": "Cho phép họ thêm mục mới và chuyển mục vào thư mục này."
   },
   "encryption": {
     "encrypt": "Mã hóa",
@@ -1402,16 +1440,16 @@
     "viewNote": "Xem ghi chú",
     "editNote": "Chỉnh sửa ghi chú",
     "privateKeyWarning": "CẢNH BÁO: Khóa riêng của bạn cho phép giải mã tất cả các ghi chú được mã hóa. Chỉ xuất nếu bạn hiểu ý nghĩa bảo mật. Tiếp tục?",
-    "publicKeyExported": "Khóa công khai được xuất thành công",
-    "privateKeyExported": "Đã xuất khóa riêng thành công",
+    "publicKeyExported": "Đã xuất khóa công khai",
+    "privateKeyExported": "Đã xuất khóa riêng",
     "failedToExportKey": "Không xuất được khóa",
     "unexpectedError": "Đã xảy ra lỗi không mong muốn",
-    "keysDeleted": "Đã xóa khóa thành công",
+    "keysDeleted": "Đã xóa khóa",
     "failedToDeleteKeys": "Không thể xóa phím",
     "autoDecryptUpdated": "Đã cập nhật cài đặt tự động giải mã",
     "failedToUpdateSetting": "Không cập nhật được cài đặt",
-    "enterValidPath": "Vui lòng nhập đường dẫn hợp lệ",
-    "customPathSet": "Đường dẫn khóa tùy chỉnh được đặt thành công",
+    "enterValidPath": "Hãy nhập đường dẫn hợp lệ",
+    "customPathSet": "Đã đặt đường dẫn khóa tùy chỉnh",
     "failedToSetCustomPath": "Không thể đặt đường dẫn tùy chỉnh",
     "thisNoteIsEncrypted": "Ghi chú này được mã hóa",
     "noteProtectedWith": "Ghi chú này được bảo vệ bằng mã hóa {type}.",
@@ -1422,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "Chọn phương thức mã hóa",
     "encryptionMethodsTitle": "Phương pháp mã hóa",
-    "xchachaDescription": "XChaCha20-Poly1305: Mã hóa dựa trên cụm mật khẩu hiện đại, nhanh chóng",
-    "pgpDescription": "PGP: Mật mã khóa công khai truyền thống với quản lý cặp khóa",
+    "xchachaDescription": "XChaCha20-Poly1305: mã hóa bằng cụm mật khẩu",
+    "pgpDescription": "PGP: mã hóa khóa công khai với cặp khóa do bạn quản lý",
     "encryptionKeys": "Khóa mã hóa",
     "keysConfigured": "Các phím được cấu hình",
     "algorithm": "Thuật toán:",
@@ -1437,9 +1475,9 @@
     "keysDisabledInDemo": "Khóa mã hóa được lưu trữ bị tắt ở chế độ demo.",
     "encryptionSettings": "Cài đặt mã hóa",
     "promptForPassphrase": "Nhắc cụm mật khẩu khi mở ghi chú được mã hóa",
-    "promptForPassphraseDescription": "Nếu được bật, bạn sẽ được nhắc nhập cụm mật khẩu khi mở ghi chú được mã hóa. Ghi chú sẽ vẫn được mã hóa trên máy chủ nhưng bạn sẽ có thể xem nội dung được giải mã trong phiên tab hiện tại.",
+    "promptForPassphraseDescription": "Hỏi cụm mật khẩu khi bạn mở một ghi chú được mã hóa. Ghi chú vẫn được mã hóa trên máy chủ và bạn chỉ thấy nội dung đã giải mã trong tab này.",
     "customKeyPath": "Đường dẫn khóa tùy chỉnh (Cài đặt cục bộ)",
-    "customKeyPathDescription": "Chỉ định đường dẫn hệ thống tệp tùy chỉnh (tuyệt đối) để lưu trữ khóa mã hóa. Điều này chỉ cần thiết cho cài đặt cục bộ. Thay vào đó, người dùng Docker nên ánh xạ đường dẫn mặc định trong docker-compose.yml.",
+    "customKeyPathDescription": "Đường dẫn tuyệt đối trong hệ thống tệp để lưu khóa mã hóa. Chỉ cài đặt cục bộ mới cần. Người dùng Docker nên ánh xạ đường dẫn mặc định trong docker-compose.yml.",
     "customPath": "Đường dẫn tùy chỉnh",
     "customPathPlaceholder": "/home/user/my-keys",
     "customPathHelp": "Phải là đường dẫn tuyệt đối (ví dụ: /home/user/my-keys hoặc C:\\Users\\user\\my-keys)",
@@ -1458,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "Lưu ý nội dung sẽ được mã hóa trước khi lưu",
     "passphraseRequired": "Cần có cụm mật khẩu",
     "incorrectPassphrase": "Cụm mật khẩu không chính xác",
-    "noteEncryptedSuccessfully": "Ghi chú được mã hóa thành công",
+    "noteEncryptedSuccessfully": "Đã mã hóa ghi chú",
     "failedToEncryptNote": "Không mã hóa được ghi chú",
-    "noteDecryptedSuccessfully": "Ghi chú được giải mã thành công",
+    "noteDecryptedSuccessfully": "Đã giải mã ghi chú",
     "failedToDecryptNote": "Không thể giải mã ghi chú",
     "passphrase": "Cụm mật khẩu",
     "enterYourPassphrase": "Nhập cụm mật khẩu của bạn",
@@ -1488,8 +1526,8 @@
     "privateKey": "Khóa riêng",
     "noStoredKeysFound": "Không tìm thấy khóa được lưu trữ nào",
     "noEncryptionKeysConfigured": "Bạn chưa định cấu hình bất kỳ khóa mã hóa nào",
-    "pastePublicKeyBelow": "Vui lòng dán khóa công khai bên dưới để mã hóa nội dung ghi chú",
-    "generateOrImportKeysInProfile": "Bạn có thể tạo hoặc nhập các khóa cụ thể cho Jotty trong Hồ sơ → Mã hóa",
+    "pastePublicKeyBelow": "Dán khóa công khai bên dưới để mã hóa nội dung ghi chú",
+    "generateOrImportKeysInProfile": "Bạn có thể tạo hoặc nhập khóa cho Jotty trong Hồ sơ > Mã hóa",
     "useCustomKey": "Sử dụng khóa {keyType} tùy chỉnh",
     "signWithPrivateKey": "Ký bằng khóa riêng",
     "proveAuthenticityOfNote": "chứng minh tính xác thực của ghi chú này",
@@ -1509,7 +1547,7 @@
     "yourEmail": "your@email.com",
     "generating": "Đang tạo...",
     "generateKeys": "Tạo khóa",
-    "keysGeneratedSuccessfully": "Khóa được tạo thành công",
+    "keysGeneratedSuccessfully": "Đã tạo khóa",
     "importPGPKeys": "Nhập khóa PGP",
     "publicKeyLabel": "Khóa công khai",
     "privateKeyLabel": "Khóa riêng",
@@ -1518,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "Hãy nhớ cụm mật khẩu của bạn! Nó không thể được phục hồi.",
     "withoutPassphraseCannotDecrypt": "Nếu không có cụm mật khẩu, bạn không thể giải mã ghi chú của mình.",
     "backupPrivateKeySafely": "Sao lưu khóa riêng của bạn một cách an toàn.",
-    "pgpKeyPairGeneratedSuccessfully": "Cặp khóa PGP được tạo thành công",
+    "pgpKeyPairGeneratedSuccessfully": "Đã tạo cặp khóa PGP",
     "failedToGenerateKeys": "Không tạo được khóa",
     "fingerprint": "Dấu vân tay",
     "keysSavedSecurely": "Chìa khóa của bạn đã được lưu an toàn.",
@@ -1532,13 +1570,13 @@
     "bothKeysRequired": "Cần có cả khóa chung và khóa riêng",
     "invalidPublicKeyFormat": "Định dạng khóa công khai không hợp lệ. Phải là khóa PGP được bọc thép ASCII.",
     "invalidPrivateKeyFormat": "Định dạng khóa riêng không hợp lệ. Phải là khóa PGP được bọc thép ASCII.",
-    "keysImportedSuccessfully": "Đã nhập khóa thành công",
+    "keysImportedSuccessfully": "Đã nhập khóa",
     "failedToImportKeys": "Không thể nhập khóa",
     "created": "Đã tạo mã hóa",
     "notePlaceholder": "Tôi là người giữ chỗ vì bạn không thể mã hóa một ghi chú trống."
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "Các tùy chọn này chỉ áp dụng cho phiên trình duyệt hiện tại. Đối với cài đặt cố định, vui lòng kiểm tra",
+    "sessionOnlyPrefix": "Các tùy chọn này chỉ áp dụng cho phiên trình duyệt này. Để cài đặt cố định, hãy xem",
     "accountSettings": "sở thích của người dùng",
     "autosaveNotes": "Tự động lưu ghi chú",
     "showNotePreview": "Hiển thị bản xem trước ghi chú trên thẻ",
@@ -1547,7 +1585,16 @@
     "viewMode": "Chế độ xem",
     "viewModeCard": "Thẻ",
     "viewModeList": "Danh sách",
-    "viewModeGrid": "Lưới"
+    "viewModeGrid": "Lưới",
+    "borderRadius": "Bo góc",
+    "useInstanceDefault": "Dùng mặc định của phiên bản",
+    "borderRadiusDescription": "Các góc cập nhật trên toàn ứng dụng khi bạn kéo.",
+    "kanbanColumnWidth": "Độ rộng cột Kanban",
+    "kanbanColumnWidthDescription": "Đặt độ rộng tùy chỉnh cho các cột trạng thái Kanban. Mặc định của phiên bản tự điều chỉnh cột theo không gian có sẵn.",
+    "kanbanColumnWidthCompact": "Gọn",
+    "kanbanColumnWidthComfortable": "Thoải mái",
+    "kanbanColumnWidthWide": "Rộng",
+    "kanbanColumnWidthAutoFit": "Tự vừa"
   },
   "migration": {
     "migrationComplete": "Quá trình di chuyển hoàn tất",
@@ -1558,20 +1605,45 @@
     "migrationSuccessful": "Di chuyển thành công",
     "returnToApp": "Quay lại ứng dụng",
     "adminAccessRequired": "Yêu cầu quyền truy cập của quản trị viên",
-    "adminAccessDescription": "Việc di chuyển này yêu cầu đặc quyền của quản trị viên. Vui lòng liên hệ với quản trị viên để thực hiện di chuyển hệ thống.",
+    "adminAccessDescription": "Việc di chuyển này cần quản trị viên. Hãy nhờ một quản trị viên chạy nó.",
     "whatsHappening": "Chuyện gì đang xảy ra vậy?",
-    "sharingDataMigrationDescription": "Hệ thống cần di chuyển dữ liệu chia sẻ của bạn. Đây là quy trình một lần yêu cầu quyền truy cập của quản trị viên.",
+    "sharingDataMigrationDescription": "Jotty cần di chuyển dữ liệu chia sẻ của bạn. Việc này chỉ chạy một lần và cần quản trị viên.",
     "whatsChanging": "Điều gì đang thay đổi?",
     "automaticBackupIncluded": "Bao gồm sao lưu tự động",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter là tiêu chuẩn ngành",
-    "noMigrationNeeded": "Không cần di chuyển - hệ thống của bạn đã được cập nhật.",
-    "importantBackupData": "Quan trọng: Sao lưu dữ liệu của bạn"
+    "noMigrationNeeded": "Không có gì để di chuyển, dữ liệu của bạn đã được cập nhật.",
+    "importantBackupData": "Quan trọng: Sao lưu dữ liệu của bạn",
+    "sharingNowWithData": "Dữ liệu chia sẻ của bạn giờ nằm cùng ghi chú và thư mục.",
+    "sharingMovesDescription": "Dữ liệu chia sẻ chuyển từ một tệp trung tâm vào dữ liệu của bạn. Giờ bạn có thể chia sẻ thư mục, và thư mục được chia sẻ hiện trong thanh bên của bạn thay vì một mục riêng.",
+    "whatsHappeningBody": "Mỗi lượt chia sẻ trong <code>.sharing.json</code> được ghi vào frontmatter của mục tương ứng, và mỗi thư mục có một <code>.category-info.json</code> chứa định danh, chia sẻ và thứ tự của nó. Các tệp cũ bị xóa khi dữ liệu đã chuyển xong.",
+    "migrationChanges": "Thay đổi khi di chuyển",
+    "sharingTravelsTitle": "Chia sẻ đi theo tệp",
+    "sharingTravelsBody": "Mỗi mục được chia sẻ tự ghi trong frontmatter của nó là được chia sẻ với ai, nên di chuyển hay đổi tên cũng không làm hỏng chia sẻ.",
+    "folderSharingTitle": "Chia sẻ thư mục",
+    "folderSharingBody": "Chia sẻ một thư mục thì mọi thứ bên trong, hiện tại và sau này, cũng được chia sẻ. Người nhận thấy nó như một thư mục bình thường trong thanh bên của họ.",
+    "oneFilePerFolderTitle": "Mỗi thư mục một tệp",
+    "oneFilePerFolderBody": "<code>.order.json</code> được gộp vào <code>.category-info.json</code>, thứ tự được đánh khóa theo uuid thay vì tên tệp.",
+    "permissionsUnchangedTitle": "Quyền không thay đổi",
+    "permissionsUnchangedBody": "Quyền đọc, chỉnh sửa và xóa giữ nguyên như hiện tại, theo từng người dùng và từng mục.",
+    "backupWarningBody": "Việc di chuyển này ghi lại frontmatter trên các ghi chú và danh sách kiểm tra của bạn, và xóa các tệp cũ <code>.sharing.json</code> và <code>.order.json</code>. Hãy sao lưu thư mục <code>data</code> trước khi tiếp tục.",
+    "backupConfirmLabel": "Tôi đã sao lưu thư mục data và hiểu quá trình di chuyển.",
+    "backupConfirmHint": "Hãy xác nhận bạn đã có bản sao lưu trước khi tiếp tục.",
+    "sharingDataMigrated": "Dữ liệu chia sẻ và thứ tự của bạn đã được di chuyển.",
+    "whatWasChanged": "Những gì đã thay đổi:",
+    "migrationPartial": "Di chuyển xong nhưng còn sót tệp",
+    "leftoversTitle": "Một số tệp cũ được giữ lại",
+    "leftoversBody": "Việc di chuyển không chuyển được hết, nên các tệp cũ bên dưới được để nguyên trên đĩa. Không có gì bị xóa. Bạn có thể sửa nguyên nhân rồi chạy lại, hoặc vào ứng dụng ngay và xử lý sau.",
+    "overrideConfirmLabel": "Vẫn tiếp tục và không hiện trang này nữa.",
+    "overrideConfirmHint": "Các tệp còn sót vẫn nằm trên đĩa, nhưng ứng dụng sẽ coi dữ liệu của bạn là đã di chuyển. Chia sẻ hoặc thứ tự liệt kê ở trên sẽ không được áp dụng cho đến khi bạn di chuyển lại, việc này bạn có thể làm bất cứ lúc nào từ /migration?force=1.",
+    "continueAnyway": "Vẫn tiếp tục",
+    "overriding": "Đang tiếp tục...",
+    "overrideFailed": "Không thể bỏ qua việc di chuyển"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "Đã đổi tên thành công danh mục",
+    "categoryRenamedSuccessfully": "Đã đổi tên danh mục",
     "failedToRenameCategory": "Không đổi tên được danh mục",
     "categoryRenamedSuccessfullyMessage": "Danh mục {categoryName} được đổi tên thành {newName}",
-    "failedToRenameCategoryMessage": "Đã xảy ra lỗi khi đổi tên danh mục."
+    "failedToRenameCategoryMessage": "Đã có lỗi khi đổi tên danh mục."
   },
   "auditLogs": {
     "title": "Nhật ký kiểm tra",
@@ -1588,17 +1660,17 @@
     "exportJSON": "Xuất JSON",
     "exportCSV": "Xuất CSV",
     "cleanupOldLogs": "Dọn dẹp nhật ký cũ",
-    "confirmCleanup": "Bạn có chắc chắn muốn xóa nhật ký cũ hơn {days} ngày không? Điều này sẽ ảnh hưởng đến TẤT CẢ người dùng và không thể hoàn tác.",
+    "confirmCleanup": "Xóa nhật ký cũ hơn {days} ngày? Việc này ảnh hưởng đến TẤT CẢ người dùng và không thể hoàn tác.",
     "confirmCleanupUnlimited": "Không có cấu hình dọn dẹp tự động (lưu giữ không giới hạn). Bạn vẫn có thể xóa nhật ký cũ theo cách thủ công nếu cần.",
     "deleteAllLogsModalTitle": "Xóa tất cả nhật ký kiểm tra",
     "deleteAllLogsWarning": "Điều này sẽ xóa TẤT CẢ nhật ký, không chỉ nhật ký cũ",
     "deleteAllLogsWarningDescription": "Toàn bộ lịch sử nhật ký kiểm tra sẽ bị xóa khỏi hệ thống.",
     "deletingAllLogs": "Đang xóa tất cả nhật ký...",
     "deleteAllLogsButton": "Xóa tất cả nhật ký",
-    "cleanupSuccess": "Đã xóa thành công {count} tệp nhật ký cũ",
+    "cleanupSuccess": "Đã xóa {count} tệp nhật ký cũ",
     "cleanupError": "Không thể dọn sạch nhật ký cũ",
-    "userDescription": "Xem tất cả hoạt động và hành động của bạn trong hệ thống",
-    "adminDescription": "Xem và quản lý mọi hoạt động của người dùng trên toàn hệ thống",
+    "userDescription": "Mọi việc bạn đã làm trong Jotty",
+    "adminDescription": "Mọi việc người dùng đã làm trên phiên bản này",
     "level": "Cấp độ",
     "allLevels": "Tất cả các cấp độ",
     "allCategories": "Tất cả danh mục",
@@ -1662,9 +1734,9 @@
     "topActions": "Hành động hàng đầu",
     "mostActiveUsers": "Người dùng tích cực nhất",
     "oldLogsFound": "Có {count} tệp nhật ký cũ hơn {days} ngày.",
-    "oldLogsFoundDescription": "Bạn có muốn làm sạch chúng? Không thể hoàn tác hành động này.",
+    "oldLogsFoundDescription": "Dọn chúng? Không thể hoàn tác.",
     "cleanUpNow": "Dọn dẹp ngay",
-    "cleanupSuccessMessage": "Đã xóa thành công {count} tệp nhật ký cũ.",
+    "cleanupSuccessMessage": "Đã xóa {count} tệp nhật ký cũ.",
     "security": "Bảo mật",
     "mfasecretgenerated": "Bí mật MFA đã được tạo",
     "mfaenabled": "Đã bật MFA",
@@ -1680,6 +1752,7 @@
     "howTo": "Làm thế nào để",
     "shortcuts": "Phím tắt",
     "markdownGuide": "Hướng dẫn Markdown",
+    "brain": "Liên kết & Bộ não",
     "customisations": "Tùy chỉnh",
     "docker": "Docker",
     "envVariables": "Biến Env",
@@ -1687,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "Mã hóa",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "Bản dịch",
     "unraid": "Unraid",
     "patches": "Bản vá"
@@ -1710,7 +1784,97 @@
     "reminderMessage": "\"{task}\" trong \"{board}\" đã hết lời nhắc",
     "sharingTitle": "{user} đã chia sẻ {type} với bạn",
     "sharingMessage": "Mở để xem {type} được chia sẻ",
+    "sharingFolderTitle": "{user} đã chia sẻ một thư mục {type} với bạn",
+    "sharingFolderMessage": "Mở để xem \"{folder}\"",
     "mentionTitle": "{user} đã nhắc đến bạn trong một bình luận",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
+  },
+  "relations": {
+    "indexing": "Đang lập chỉ mục liên kết...",
+    "unreachable": "không truy cập được",
+    "createFromWikilink": "Tạo ghi chú tên \"{title}\"",
+    "mentionedIn": "Được nhắc đến trong",
+    "mentionedInHint": "Các ghi chú này dùng tiêu đề này dưới dạng văn bản thường. Liên kết một cái để kết nối.",
+    "linkMention": "Liên kết",
+    "linked": "Đã liên kết lời nhắc trong {title}",
+    "linkFailed": "Không thể liên kết lời nhắc đó",
+    "kind": {
+      "mention": "Liên kết",
+      "wiki": "Wikilink"
+    }
+  },
+  "brain": {
+    "title": "Bộ não",
+    "openBrain": "Mở trong bộ não",
+    "search": "Tìm gì đó trong bộ não...",
+    "dimension": "Chế độ xem",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "Quanh mục này",
+    "global": "Tất cả",
+    "depth": "Độ sâu {depth}",
+    "colourBy": "Tô màu theo",
+    "colourModes": {
+      "type": "Loại",
+      "category": "Danh mục"
+    },
+    "filters": {
+      "notes": "Ghi chú",
+      "checklists": "Danh sách kiểm tra",
+      "tags": "Thẻ",
+      "ghosts": "Chưa viết",
+      "suggestions": "Gợi ý",
+      "orphans": "Kẻ cô đơn"
+    },
+    "kind": {
+      "note": "Ghi chú",
+      "checklist": "Danh sách kiểm tra",
+      "ghost": "Chưa viết",
+      "tag": "Thẻ"
+    },
+    "edges": {
+      "mention": "Liên kết",
+      "wiki": "Wikilink",
+      "suggested": "Gợi ý",
+      "tag": "Thẻ"
+    },
+    "linksTo": "Liên kết đến",
+    "linkedFrom": "Được liên kết từ",
+    "suggested": "Có thể liên quan",
+    "promote": "Liên kết đến {title}",
+    "lonely": "Chưa có gì kết nối đến đây. Nhắc đến nó bằng @ hoặc [[ từ ghi chú khác.",
+    "open": "Mở",
+    "createGhost": "Viết ghi chú này",
+    "openTag": "Hiện mọi thứ có thẻ này",
+    "createFailed": "Không thể tạo ghi chú đó",
+    "connectFailed": "Không thể liên kết hai mục đó",
+    "connected": "Đã liên kết {source} với {target}",
+    "empty": "Bộ não của bạn đang yên ắng. Liên kết ghi chú và danh sách kiểm tra bằng @ hoặc [[ và chúng sẽ hiện ở đây.",
+    "viewingOwner": "Đang xem bộ não của {owner}",
+    "summary": "{items} mục, {links} liên kết, hiển thị {shown}"
+  },
+  "apiExplorer": {
+    "title": "Trình khám phá API",
+    "intro": "Mọi endpoint mà phiên bản này (v{version}) cung cấp, được tạo từ chính mã phục vụ nó. Chọn một cái, điền vào và gửi.",
+    "realData": "Yêu cầu chạy với quyền của chủ khóa API trên dữ liệu thật. Gửi DELETE ở đây là xóa thật.",
+    "apiKey": "Khóa API",
+    "apiKeyHint": "Chỉ giữ trên trang này và bị quên khi bạn rời đi.",
+    "useMyKey": "Dùng khóa của tôi",
+    "noKeyYet": "Bạn chưa có khóa API. Hãy tạo một khóa trong cài đặt hồ sơ.",
+    "filter": "Lọc",
+    "filterPlaceholder": "Đường dẫn, tên hoặc phương thức",
+    "noMatches": "Không có gì khớp với bộ lọc.",
+    "body": "Nội dung yêu cầu (JSON)",
+    "showSchema": "Hiện schema",
+    "hideSchema": "Ẩn schema",
+    "send": "Gửi",
+    "sending": "Đang gửi...",
+    "keyRequired": "Hãy thêm khóa API trước.",
+    "noKeyNeeded": "không cần khóa API",
+    "deprecated": "không còn dùng",
+    "requestFailed": "Yêu cầu không đến được máy chủ. Hãy kiểm tra kết nối.",
+    "responseMeta": "{status} trong {ms} ms"
   }
 }
diff --git a/app/_translations/zh.json b/app/_translations/zh.json
index a2c107af4..a6843d5e8 100644
--- a/app/_translations/zh.json
+++ b/app/_translations/zh.json
@@ -127,13 +127,14 @@
     "expandAll": "全部展开",
     "saveChanges": "保存更改",
     "all": "全部",
+    "items": "项目",
     "showAll": "显示全部",
     "creating": "创建中...",
     "createCategoryHeader": "创建一个新分类",
     "parentCategory": "父分类（可选）",
     "noParent": "无父级（根目录）",
     "categoryNamePlaceholder": "输入分类名称...",
-    "notAllowedName": "{name} 是不允许的名称，请选择其他名称。",
+    "notAllowedName": "不能使用 {name}，请换一个名称。",
     "createCategory": "创建分类",
     "selectCategory": "选择分类...",
     "categoryWillBeCreatedIn": "新分类将创建于：",
@@ -173,7 +174,7 @@
     "noResults": "无结果",
     "by": "作者 {owner}",
     "unsavedChanges": "未保存的更改",
-    "unsavedChangesDetected": "⚠️ 检测到未保存的更改",
+    "unsavedChangesDetected": "有未保存的更改",
     "unsavedChangesMessage": "您在 {noteTitle} 中有未保存的更改。如果现在离开，更改将会丢失。",
     "whatToDoWithUnsavedChanges": "您希望如何处理未保存的更改？",
     "discard": "放弃",
@@ -247,36 +248,9 @@
     "connected": "已连接",
     "reconnecting": "正在重新连接...",
     "hide": "隐藏",
-    "items": "项目",
     "thisEntry": "这个条目",
     "preview": "预览"
   },
-  "comments": {
-    "title": "评论",
-    "titleWithCount": "{count, plural, other {# 条评论}}",
-    "noComments": "还没有评论。开始对话吧！",
-    "addComment": "添加评论...",
-    "replyPlaceholder": "写回复...",
-    "post": "发布",
-    "reply": "回复",
-    "edit": "编辑",
-    "delete": "删除",
-    "save": "保存",
-    "cancel": "取消",
-    "edited": "已编辑",
-    "deleteConfirmTitle": "删除评论？",
-    "deleteConfirmMessage": "这将删除评论及所有回复。此操作无法撤销。",
-    "commentDeleted": "评论已删除",
-    "commentAdded": "评论已添加",
-    "commentUpdated": "评论已更新",
-    "failedToAdd": "添加评论失败",
-    "failedToEdit": "编辑评论失败",
-    "failedToDelete": "删除评论失败",
-    "failedToLoad": "加载评论失败",
-    "readOnly": "您需要编辑权限才能评论此卡片。",
-    "replyTo": "回复 {author}",
-    "noUsersFound": "未找到用户"
-  },
   "history": {
     "noteHistory": "笔记历史",
     "restore": "恢复",
@@ -286,10 +260,10 @@
     "noHistoryDescription": "保存笔记以创建历史记录点。",
     "loadMore": "加载更多",
     "featureDisabled": "历史记录已禁用",
-    "disabledAdmin": "笔记历史记录目前已禁用。您可以在 管理设置 > 编辑器 中启用它。",
-    "disabledUser": "笔记历史记录目前已禁用。请联系您的管理员启用此功能。",
+    "disabledAdmin": "笔记历史记录已关闭。可在 管理设置 > 编辑器 中开启。",
+    "disabledUser": "笔记历史记录已关闭。请让管理员开启。",
     "goToSettings": "前往设置",
-    "manualSavesOnly": "历史记录仅在手动保存时创建，自动保存不会创建。",
+    "manualSavesOnly": "只有手动保存会创建历史记录，自动保存不会。",
     "fetchError": "加载历史记录失败",
     "restoreError": "恢复版本失败",
     "viewContent": "查看内容",
@@ -321,7 +295,7 @@
     "sessionExpired": "您的会话已过期",
     "setupComplete": "设置完成",
     "createAccount": "创建您的账户",
-    "errorOccurred": "发生错误，请重试。",
+    "errorOccurred": "出了点问题，请重试。",
     "enterUsername": "输入您的用户名",
     "enterPassword": "输入您的密码",
     "chooseUsername": "选择一个用户名",
@@ -335,7 +309,7 @@
     "createUser": "创建用户",
     "attemptsRemaining": "警告：在账户锁定前还剩 {count, plural, one {# 次尝试} other {# 次尝试}}",
     "accountLocked": "失败次数过多。请在 {seconds} {seconds, plural, one {秒} other {秒}} 后重试",
-    "notAuthorized": "您没有权限访问此应用程序。请联系您的管理员。",
+    "notAuthorized": "您无权访问此应用。请联系管理员。",
     "rememberMe": "记住我"
   },
   "mfa": {
@@ -360,7 +334,7 @@
     "invalidCode": "验证码无效",
     "invalidRecoveryCode": "恢复代码无效",
     "mfaRequired": "需要双重认证",
-    "mfaEnabledSuccess": "双重认证启用成功",
+    "mfaEnabledSuccess": "双重认证已启用",
     "mfaDisabledSuccess": "双重认证已禁用",
     "tooManyAttempts": "失败次数过多，请稍后再试。",
     "disableTitle": "禁用双重认证",
@@ -382,8 +356,8 @@
     "regenerateRecoveryCodeWarning": "这将使您当前的恢复代码失效",
     "regenerateRecoveryCodeDescription": "输入您的 2FA 代码以生成新的恢复代码。旧代码将不再有效。",
     "recoveryCodeRegenerated": "新恢复代码已生成",
-    "recoveryCodeRegeneratedInfo": "您的新恢复代码已生成。请将其保存在安全的地方——这是您唯一一次看到它的机会。",
-    "recoveryCodeRegeneratedSuccess": "恢复代码重新生成成功",
+    "recoveryCodeRegeneratedInfo": "新的恢复代码已生成。请妥善保存，这是您唯一一次看到它。",
+    "recoveryCodeRegeneratedSuccess": "恢复代码已重新生成",
     "recoveryCodeProfileDescription": "如果您无法访问身份验证器应用，请使用此代码进行账户恢复",
     "disableMfaForUser": "为该用户禁用 2FA",
     "recoveryCodeRequired": "需要恢复代码",
@@ -397,7 +371,7 @@
     "recent": "最近",
     "browseAndManage": "浏览和管理所有笔记",
     "noNotesYet": "暂无笔记",
-    "createFirstNote": "创建您的第一条笔记，开始构建您的知识库。",
+    "createFirstNote": "这里还是空的。创建您的第一条笔记吧。",
     "createNewNote": "创建新笔记",
     "noNotesFound": "未找到笔记",
     "tryAdjustingFilters": "尝试调整筛选条件或创建新笔记。",
@@ -428,22 +402,26 @@
     "enterNoteTitle": "输入笔记标题...",
     "byType": "按类型",
     "publiclySharedNote": "公开共享",
+    "sharedPubliclyBy": "此笔记由 {owner} 公开共享",
+    "copyRawContent": "复制 Markdown",
     "quickSave": "快速保存",
     "noteNotFound": "笔记未找到",
     "unarchiveNote": "取消归档笔记",
     "enterNoteName": "输入笔记名称...",
     "updateNote": "更新笔记",
-    "tags": "标签",
-    "noTagsFound": "未找到标签",
-    "searchTags": "搜索标签...",
-    "copyRawContent": "复制 Markdown",
     "printSaveAsPdf": "打印 / 另存为PDF",
     "tableOfContents": "目录",
     "wordCount": "{count, plural, one {# 个字} other {# 个字}}",
     "charCount": "{count, plural, one {# 个字符} other {# 个字符}}",
-    "readingTime": "{count, plural, one {# 分钟阅读} other {# 分钟阅读}}"
+    "readingTime": "{count, plural, one {# 分钟阅读} other {# 分钟阅读}}",
+    "tags": "标签",
+    "noTagsFound": "未找到标签",
+    "searchTags": "搜索标签...",
+    "createNoteFailed": "无法创建笔记",
+    "createCategoryFailed": "无法创建分类，笔记也未创建"
   },
   "checklists": {
+    "sharedPubliclyBy": "此清单由 {owner} 公开共享",
     "title": "清单",
     "allChecklists": "所有清单",
     "completed": "已完成",
@@ -457,7 +435,7 @@
     "progress": "进度",
     "totalItems": "项目总数",
     "noChecklistsYet": "暂无清单",
-    "createFirstChecklist": "创建您的第一个清单以开始组织任务。",
+    "createFirstChecklist": "这里还是空的。创建您的第一个清单吧。",
     "newChecklist": "新建清单",
     "noChecklistsFound": "未找到清单",
     "tryAdjustingFiltersChecklist": "尝试调整筛选条件或创建新清单。",
@@ -499,6 +477,7 @@
     "checklistType": "清单类型",
     "simpleChecklist": "简单清单",
     "taskProject": "任务项目",
+    "kanbanBoard": "看板",
     "basicTodoItems": "基本待办事项",
     "withTimeTracking": "带时间追踪",
     "noDescription": "无描述",
@@ -525,23 +504,24 @@
     "clearAllCompletedConfirmMessage": "确定要删除所有 {count} 个已完成的项目及其子项吗？此操作无法撤销。",
     "clearAllIncompleteConfirmMessage": "确定要删除所有 {count} 个未完成的项目及其子项吗？此操作无法撤销。",
     "convertChecklistType": "转换清单类型",
-    "convertTypeConfirmation": "您即将从 {currentType} 转换为 {newType}。确定要继续吗？",
-    "dataLossWarning": "⚠️ 数据丢失警告",
+    "convertTypeConfirmation": "从 {currentType} 转换为 {newType}？",
+    "dataLossWarning": "数据丢失警告",
     "dataLossWarningItems": "以下数据将会丢失：",
     "allTaskStatusesReset": "所有任务状态将被重置",
     "timeTrackingDataLost": "时间追踪数据将丢失",
     "estimatedTimesRemoved": "预估时间将被移除",
     "targetDatesCleared": "目标日期将被清除",
-    "enhancedFeatures": "✨ 增强功能",
+    "enhancedFeatures": "您将获得",
     "enhancedFeaturesYouWillGain": "您将获得：",
     "kanbanBoardWithDragDrop": "带拖放功能的看板",
     "taskStatusTracking": "任务状态追踪（待办、进行中等）",
     "timeTrackingWithTimer": "带内置计时器的时间追踪",
-    "actionCannotBeUndone": "此操作无法撤销。确定要转换吗？",
+    "actionCannotBeUndone": "此操作无法撤销。仍要转换吗？",
     "convertAndLoseData": "转换并丢失数据",
     "convert": "转换",
     "convertToSimpleChecklist": "转换为简单清单",
     "convertToTaskProject": "转换为任务项目",
+    "convertToKanbanBoard": "转换为看板",
     "pasteYourList": "粘贴您的列表（每行一项）",
     "addItems": "添加 {count} 个项目",
     "itemsWillBeAdded": "将添加 {count} 个项目",
@@ -550,11 +530,35 @@
     "noItemsYet": "暂无项目",
     "addFirstItem": "添加您的第一个项目以开始！",
     "noTasks": "无任务",
-    "noSubtasksYet": "暂无子任务。在下方添加一个以开始。",
+    "noSubtasksYet": "暂无子任务。在下方添加一个。",
     "addTime": "添加时间",
-    "enterTimeInMinutes": "输入时间（分钟）",
-    "convertToKanbanBoard": "转换为看板",
-    "kanbanBoard": "看板"
+    "enterTimeInMinutes": "输入时间（分钟）"
+  },
+  "comments": {
+    "title": "评论",
+    "titleWithCount": "{count, plural, other {# 条评论}}",
+    "noComments": "还没有评论。开始对话吧！",
+    "addComment": "添加评论...",
+    "replyPlaceholder": "写回复...",
+    "post": "发布",
+    "reply": "回复",
+    "edit": "编辑",
+    "delete": "删除",
+    "save": "保存",
+    "cancel": "取消",
+    "edited": "已编辑",
+    "deleteConfirmTitle": "删除评论？",
+    "deleteConfirmMessage": "这将删除评论及所有回复。此操作无法撤销。",
+    "commentDeleted": "评论已删除",
+    "commentAdded": "评论已添加",
+    "commentUpdated": "评论已更新",
+    "failedToAdd": "添加评论失败",
+    "failedToEdit": "编辑评论失败",
+    "failedToDelete": "删除评论失败",
+    "failedToLoad": "加载评论失败",
+    "readOnly": "您需要编辑权限才能评论此卡片。",
+    "replyTo": "回复 {author}",
+    "noUsersFound": "未找到用户"
   },
   "tasks": {
     "title": "任务",
@@ -583,7 +587,7 @@
     "overdue": "已逾期",
     "browseAndManageTaskLists": "浏览和管理所有任务列表",
     "noTaskListsYet": "暂无任务列表",
-    "createFirstTaskList": "创建您的第一个任务列表以开始管理项目。",
+    "createFirstTaskList": "这里还是空的。创建您的第一个任务列表吧。",
     "newTaskList": "新建任务列表",
     "taskLists": "任务列表",
     "noTaskListsFound": "未找到任务列表",
@@ -631,7 +635,7 @@
     "changeStatus": "更改状态",
     "noBoards": "未找到看板",
     "noBoardsYet": "暂无看板",
-    "createFirstBoard": "创建您的第一个看板以开始管理项目。",
+    "createFirstBoard": "这里还是空的。创建您的第一个看板吧。",
     "newBoard": "新建看板",
     "tryAdjustingFilters": "尝试调整筛选条件或创建新看板。",
     "completed": "已完成",
@@ -684,7 +688,7 @@
     "quickSettingsHeader": "快速设置（仅限本机）",
     "adminSettings": "管理后台",
     "apiKey": "API 密钥",
-    "apiKeyDescription": "生成 API 密钥以编程方式访问您的清单和笔记",
+    "apiKeyDescription": "生成 API 密钥，让脚本和应用访问您的清单和笔记",
     "hideApiKey": "隐藏 API 密钥",
     "showApiKey": "显示 API 密钥",
     "copyApiKey": "复制 API 密钥",
@@ -702,15 +706,15 @@
     "removeAvatar": "移除头像",
     "usernameRequired": "用户名必填",
     "passwordsDoNotMatch": "新密码不匹配",
-    "profileUpdated": "个人资料更新成功！",
+    "profileUpdated": "个人资料已更新",
     "failedToUpdateProfile": "更新个人资料失败",
-    "failedToUpdateProfileRetry": "更新个人资料失败，请重试。",
-    "avatarUpdated": "头像更新成功！",
+    "failedToUpdateProfileRetry": "无法更新个人资料，请重试。",
+    "avatarUpdated": "头像已更新",
     "failedToUpdateAvatar": "更新头像失败",
-    "failedToUpdateAvatarRetry": "更新头像失败，请重试。",
-    "avatarRemoved": "头像移除成功！",
+    "failedToUpdateAvatarRetry": "无法更新头像，请重试。",
+    "avatarRemoved": "头像已移除",
     "failedToRemoveAvatar": "移除头像失败",
-    "failedToRemoveAvatarRetry": "移除头像失败，请重试。",
+    "failedToRemoveAvatarRetry": "无法移除头像，请重试。",
     "activeSessions": "活跃会话",
     "activeSession": "{count} 个活跃会话",
     "activeSession_plural": "{count} 个活跃会话",
@@ -728,11 +732,11 @@
     "auditLogsTab": "用户日志",
     "rebuildLinkIndexes": "重建链接索引以更新关联数据",
     "rebuildingLinkIndex": "重建链接索引中...",
-    "successfullyRebuiltIndex": "重建链接索引成功",
-    "successfullyRebuiltIndexReload": "重建链接索引成功！页面将重新加载以显示更新后的关联。",
-    "failedToRebuildIndex": "重建链接索引失败，请重试。",
+    "successfullyRebuiltIndex": "链接索引已重建",
+    "successfullyRebuiltIndexReload": "链接索引已重建。页面将重新加载以显示新的关联。",
+    "failedToRebuildIndex": "无法重建链接索引，请重试。",
     "contentLinks": "内容链接",
-    "visualizeRelationships": "可视化笔记和清单之间的关系",
+    "visualizeRelationships": "查看笔记和清单之间如何互相链接",
     "connectedItems": "关联项目",
     "noLinksFound": "未找到链接",
     "startCreatingInternalLinks": "通过在笔记中输入“@”开始创建内部链接，以在此处查看关系网络。",
@@ -743,8 +747,8 @@
     "isolated": "孤立",
     "connection": "个连接",
     "connection_plural": "个连接",
-    "terminateSessionConfirm": "确定要终止此会话吗？",
-    "terminateAllSessionsConfirm": "确定要终止其他所有会话吗？",
+    "terminateSessionConfirm": "终止此会话？",
+    "terminateAllSessionsConfirm": "终止其他所有会话？",
     "validationErrorTitle": "验证错误",
     "visibleGraphSummary": "{items} 个可见项，{links} 条可见连接",
     "graphTruncated": "显示连接数最多的前 {visible} 个项目。已省略 {omitted} 个连接较少的项目。",
@@ -815,10 +819,10 @@
     "chooseAutoSaveInterval": "选择笔记自动保存的时间间隔。",
     "defaultMode": "默认模式",
     "selectNotesDefaultMode": "选择笔记默认模式",
-    "chooseNotesDefaultMode": "选择笔记默认处于编辑模式还是非编辑模式（笔记编辑器中的 {mode} 按钮）。",
+    "chooseNotesDefaultMode": "选择笔记是否以编辑模式打开。您随时可以用笔记编辑器中的 {mode} 按钮切换。",
     "defaultEditor": "默认编辑器",
     "selectNotesDefaultEditor": "选择笔记默认编辑器",
-    "chooseDefaultEditor": "选择笔记的默认编辑器 - （您可以随时点击笔记编辑器中的 {editor} 按钮进行切换）。",
+    "chooseDefaultEditor": "选择笔记的默认编辑器。您随时可以用笔记编辑器中的 {editor} 按钮切换。",
     "tableSyntaxInNotes": "笔记中的表格语法",
     "selectTableSyntax": "选择表格语法",
     "chooseTableSyntax": "选择表格在笔记中的渲染方式。",
@@ -827,7 +831,7 @@
     "chooseSyntaxTheme": "选择 Markdown 编辑器的语法高亮主题。",
     "minimalMode": "极简模式（禁用富文本编辑器）",
     "selectMinimalMode": "选择极简模式",
-    "minimalModeDescription": "启用后，将使用简单的 Markdown 渲染器代替富文本编辑器。双向链接等高级功能在此模式下将无法使用。",
+    "minimalModeDescription": "使用简单的 Markdown 渲染器代替富文本编辑器。双向链接等高级功能在此模式下无法使用。",
     "defaultNoteFilter": "默认笔记筛选器",
     "selectDefaultNoteFilter": "选择默认笔记筛选器",
     "chooseDefaultNoteFilter": "选择打开笔记页面时默认应用的筛选器。",
@@ -854,8 +858,8 @@
     "currentPassword": "当前密码",
     "newPassword": "新密码",
     "confirmPassword": "确认密码",
-    "passwordChanged": "密码更改成功",
-    "settingsSaved": "设置保存成功",
+    "passwordChanged": "密码已更改",
+    "settingsSaved": "设置已保存",
     "dashCase": "短横线命名 (例如：my-file-name.md)",
     "minimal": "极简 (仅移除非法字符)",
     "noRename": "不重命名 (保持原始文件名)",
@@ -865,6 +869,7 @@
     "seconds_plural": "{count} 秒",
     "hours12": "12 小时制",
     "hours24": "24 小时制",
+    "useSystemDefault": "使用系统默认值",
     "markdownTableSyntax": "Markdown",
     "htmlTableSyntax": "HTML",
     "default": "默认",
@@ -888,7 +893,7 @@
     "chooseQuickCreateNotes": "选择快速创建笔记的模式。",
     "quickCreateNotesShowModal": "创建笔记时显示模态框",
     "quickCreateNotesSkipModal": "跳过模态框直接创建",
-    "quickCreateNotesDescription": "启用后，新建笔记将跳过创建模态框，直接进入笔记编辑器。",
+    "quickCreateNotesDescription": "跳过新建笔记对话框，直接进入编辑器。",
     "defaultCategory": "快速创建笔记的默认分类",
     "selectDefaultCategory": "选择默认分类...",
     "defaultCategoryDescription": "使用快速创建时，新笔记将创建在此分类中。",
@@ -926,7 +931,7 @@
     "hideStatusOnCardsLabel": "看板卡片上的状态",
     "showStatusOnCards": "显示状态",
     "hideStatusOnCards": "隐藏状态",
-    "hideStatusOnCardsDescription": "隐藏看板卡片上的状态标签。状态已通过卡片所在的列显示。",
+    "hideStatusOnCardsDescription": "隐藏看板卡片上的状态标签。卡片所在的列已经显示了状态。",
     "hideMobileStatusDropdownLabel": "卡片上的移动端状态下拉菜单",
     "showMobileStatusDropdown": "显示移动端下拉菜单",
     "hideMobileStatusDropdown": "隐藏移动端下拉菜单",
@@ -939,12 +944,12 @@
     "hideTimeTrackingOnCardsDescription": "在看板卡片上隐藏计时器和已记录的会话。时间跟踪在卡片详情视图中仍然可用。",
     "selectStatusOnCards": "选择状态可见性",
     "codeBlockChoice": "选择代码块样式",
-    "themedCodeBlock": "主题代码块",
     "defaultCodeBlock": "Codepen（默认）",
+    "themedCodeBlock": "主题代码块",
     "codeBlockChoiceDescription": "在类似 codepen 的默认代码块样式或主题代码块样式之间进行选择。",
     "checklistItemClickAction": "核对清单项单击操作",
     "selectChecklistItemClickAction": "选择清单项目单击操作",
-    "checklistItemClickActionDescription": "选择单击任务文本时会发生的情况。 \n“标记为完成”切换复选框（默认）； \n“编辑任务名称”打开任务进行内联编辑 - 您仍然需要单击复选框本身来完成它。",
+    "checklistItemClickActionDescription": "选择单击任务文本时的行为。“标记为完成”（默认）切换复选框。“编辑任务名称”打开任务进行内联编辑，要完成任务需单击复选框本身。",
     "checklistItemClickActionToggle": "标记为完整/不完整",
     "checklistItemClickActionEdit": "编辑列表项",
     "newItemInsertion": "新项目插入位置",
@@ -952,7 +957,6 @@
     "newItemInsertionDescription": "选择新项目是添加到清单的顶部（默认）还是底部。",
     "newItemInsertionTop": "列表顶部",
     "newItemInsertionBottom": "列表底部",
-    "useSystemDefault": "使用系统默认值",
     "selectShowChecklistEmojis": "选择 Emoji 显示方式",
     "showChecklistEmojisDescription": "根据清单项目的文字自动在旁边显示 Emoji。"
   },
@@ -995,20 +999,24 @@
     "icon512": "512x512 图标",
     "icon512Description": "PWA 启动画面的高分辨率图标。",
     "notifyNewUpdates": "有新更新时通知我",
-    "thisUsesGithubAPI": "这使用 GitHub API 获取更新，禁用将完全关闭 API 且不允许任何进出 GitHub 的流量。",
+    "thisUsesGithubAPI": "此功能使用 GitHub API 检查更新。关闭后将停止与 GitHub 之间的所有流量。",
     "parseContent": "始终显示解析后的内容",
-    "parseContentEnabledDescription": "启用后，此设置将在侧边栏、搜索结果和整个应用中显示解析后的标题。",
-    "parseContentDisabledDescription": "禁用后，原始文件名将被净化，使其易于阅读并显示。",
-    "parseContentPerformanceWarning": "将其设置为 \"否\" 将提高大数据集的性能，但可能会影响可读性 - 尤其是在包含非拉丁字符的文件名上。",
+    "parseContentEnabledDescription": "在侧边栏、搜索结果和应用其他地方显示解析后的标题。",
+    "parseContentDisabledDescription": "改为显示原始文件名，并整理成易读的形式。",
+    "parseContentPerformanceWarning": "设为 \"否\" 会让大型实例更快，但标题更难读，尤其是包含非拉丁字符的文件名。",
     "hideLanguageSelector": "在页眉隐藏语言选择器",
     "hideLanguageSelectorDescription": "显示/隐藏页眉中的语言下拉菜单",
+    "defaultDateFormat": "默认日期格式",
+    "defaultDateFormatDescription": "当用户的日期格式首选项设置为“使用系统默认值”时使用。",
+    "defaultTimeFormat": "默认时间格式",
+    "defaultTimeFormatDescription": "当用户的时间格式首选项设置为“使用系统默认值”时使用。",
     "applicationIcons": "应用程序图标",
     "saveChanges": "保存更改",
     "unsavedChanges": "您有未保存的更改。",
     "loadError": "加载错误",
     "couldNotFetchSettings": "无法获取设置。",
     "failedToLoadSettings": "加载设置失败",
-    "settingsSavedSuccessfully": "设置保存成功。",
+    "settingsSavedSuccessfully": "设置已保存。",
     "failedToSaveSettings": "保存设置失败",
     "saveError": "保存错误",
     "unknownErrorOccurred": "发生未知错误。",
@@ -1021,7 +1029,7 @@
     "colorVariables": "颜色变量",
     "livePreview": "实时预览",
     "unsavedCssChanges": "您有未保存的 CSS 更改。",
-    "noCustomThemesYet": "暂无自定义主题。点击 \"创建主题\" 以开始。",
+    "noCustomThemesYet": "暂无自定义主题。点击 \"创建主题\" 新建一个。",
     "myCustomTheme": "我的自定义主题",
     "iconNameDescription": "图标名称 (例如：PaintBrush04Icon, Sun03Icon, GibbousMoonIcon)",
     "appVersion": "应用版本",
@@ -1060,22 +1068,22 @@
     "configureExternalServices": "配置编辑器集成的外部服务 URL。",
     "drawioUrl": "Draw.io URL",
     "optional": "(可选)",
-    "drawioUrlDescription": "指定自定义 Draw.io 实例 URL。留空则使用默认公共实例 (https://embed.diagrams.net)。",
+    "drawioUrlDescription": "使用您自己的 Draw.io 实例。留空则使用公共实例 (https://embed.diagrams.net)。",
     "drawioUrlExample": "自托管示例：https://your-domain.com/drawio",
     "drawioProxyEnabled": "通过 Jotty 代理 Draw.io",
-    "drawioProxyEnabledDescription": "启用此项以通过 Jotty 服务器路由 Draw.io 流量。对于用户浏览器无法访问的内部 Docker 网络 URL（例如 http://drawio:8080）是必需的。",
+    "drawioProxyEnabledDescription": "通过 Jotty 服务器转发 Draw.io 流量。用户浏览器无法访问的内部 Docker 网络 URL（例如 http://drawio:8080）需要开启此项。",
     "excalidrawUrl": "Excalidraw URL",
-    "excalidrawUrlDescription": "指定自定义 Excalidraw 实例 URL。留空则使用默认公共实例 (https://excalidraw.com)。",
+    "excalidrawUrlDescription": "使用您自己的 Excalidraw 实例。留空则使用公共实例 (https://excalidraw.com)。",
     "excalidrawUrlExample": "自托管示例：https://your-domain.com/excalidraw",
     "excalidrawProxyEnabled": "通过 Jotty 代理 Excalidraw",
-    "excalidrawProxyEnabledDescription": "启用此项以通过 Jotty 服务器路由 Excalidraw 流量。对于用户浏览器无法访问的内部 Docker 网络 URL（例如 http://excalidraw:3000）是必需的。",
+    "excalidrawProxyEnabledDescription": "通过 Jotty 服务器转发 Excalidraw 流量。用户浏览器无法访问的内部 Docker 网络 URL（例如 http://excalidraw:3000）需要开启此项。",
     "saving": "保存中...",
-    "editorSettingsSaved": "编辑器设置保存成功。",
+    "editorSettingsSaved": "编辑器设置已保存。",
     "customEmojis": "自定义 Emoji",
-    "noEmojisYet": "暂无自定义 Emoji。点击 \"添加 Emoji\" 以开始。",
+    "noEmojisYet": "暂无自定义 Emoji。点击 \"添加 Emoji\" 添加一个。",
     "enterAnyEmoji": "输入任何 Emoji 或使用 Emoji 选择器 (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "共享活动概览",
-    "detailedSharingBreakdown": "共享模式和用户参与度的详细分类",
+    "detailedSharingBreakdown": "共享了什么，由谁共享",
     "checkForUpdates": "检查更新",
     "checkingForUpdates": "检查更新中...",
     "updateAvailable": "有新更新可用！",
@@ -1090,12 +1098,12 @@
     "userContent": "{checklistsLength} 个清单 • {notesLength} 条笔记",
     "rebuildIndexes": "重建索引",
     "rebuilding": "重建中...",
-    "successfullyRebuiltIndex": "成功重建 {username} 的链接索引",
+    "successfullyRebuiltIndex": "已重建 {username} 的链接索引",
     "failedToRebuildIndex": "重建 {username} 的链接索引失败",
     "totalItems": "{userCount} 位用户共 {items} 个项目",
     "privileges": "管理员权限",
     "adminContentAccess": "管理员内容访问",
-    "adminContentAccessDescription": "控制管理员是否可以访问所有用户的笔记和清单。禁用时，管理员只能管理用户和设置，但无法查看其他用户的内容。",
+    "adminContentAccessDescription": "允许管理员打开所有用户的笔记和清单。关闭后，管理员可以管理用户和设置，但看不到其他人的内容。",
     "adminContentAccessYes": "管理员可以访问所有内容",
     "adminContentAccessNo": "管理员只能访问自己的内容",
     "superAdminOnly": "仅限系统所有者编辑",
@@ -1105,21 +1113,21 @@
     "confirmNewPassword": "确认新密码",
     "dataExport": "数据导出",
     "dataExportOptions": "数据导出选项",
-    "selectExportType": "选择导出类型并从您的应用程序下载数据。",
+    "selectExportType": "选择导出类型并下载数据。",
     "allChecklistsAndNotes": "所有清单和笔记",
-    "allChecklistsAndNotesDescription": "导出所有用户创建的所有清单和笔记。这将生成一个 zip 文件，其中包含按用户和分类组织的 JSON 数据。",
+    "allChecklistsAndNotesDescription": "将所有用户的清单和笔记导出为 JSON 文件的 zip 包，按用户和分类归组。",
     "userChecklistsNotes": "特定用户的清单和笔记",
-    "userChecklistsNotesDescription": "从下拉菜单中选择一个用户以导出该特定用户的所有清单和笔记。",
+    "userChecklistsNotesDescription": "从下拉菜单中选择一个用户，导出其全部清单和笔记。",
     "allUsersData": "所有用户账户数据",
     "allUsersDataDescription": "导出包含所有用户账户信息（用户名、管理员状态等）的 JSON 文件。这不包括他们的清单或笔记内容。",
     "wholeDataFolder": "整个 Data 文件夹（备份）",
-    "wholeDataFolderDescription": "导出整个 'data' 文件夹，包括所有用户内容、元数据和设置。请谨慎使用，因为文件可能很大。",
+    "wholeDataFolderDescription": "导出整个 'data' 文件夹，包含所有用户内容、元数据和设置。文件可能很大。",
     "noSharingPermissionsLabel": "根据您的内容访问权限，特定的共享项目已隐藏。",
     "contentHidden": "内容详情已隐藏",
     "viewOnlySettingsNotice": "只有系统所有者可以修改这些设置。",
     "auditLogContentRedacted": "[内容已隐藏]",
     "maxLogAgeDays": "日志最大保留天数",
-    "maxLogAgeDaysDescription": "设置审计日志保留的时间。查看审计日志页面时，如果存在早于此阈值的日志，系统将提示清理。设置为 0 表示无限期保留（不提示自动清理）。",
+    "maxLogAgeDaysDescription": "审计日志的保留时长。审计日志页面会提示清理早于此时长的日志。设为 0 则永久保留，也不再提示。",
     "appPreferences": "应用偏好",
     "editEmoji": "编辑 Emoji",
     "addEmoji": "添加 Emoji",
@@ -1138,10 +1146,6 @@
     "updateTagsTitle": "扫描笔记中的标签并更新前置数据",
     "tagsUpdated": "已处理 {processed} 个文件，{updated} 个已更新新标签",
     "failedToUpdateTags": "更新标签失败",
-    "defaultDateFormat": "默认日期格式",
-    "defaultDateFormatDescription": "当用户的日期格式首选项设置为“使用系统默认值”时使用。",
-    "defaultTimeFormatDescription": "当用户的时间格式首选项设置为“使用系统默认值”时使用。",
-    "defaultTimeFormat": "默认时间格式",
     "borderRadius": "圆角半径",
     "borderRadiusDescription": "设置整个实例的圆角大小。用户可在快速设置中覆盖此值。",
     "borderRadiusSaved": "圆角半径已保存",
@@ -1157,6 +1161,9 @@
     "tryAgain": "重试",
     "contactSupport": "联系支持",
     "invalidInput": "输入无效",
+    "invalidEditorSettings": "编辑器设置必须是对象，未保存任何内容",
+    "invalidEditorSetting": "编辑器设置 {field} 类型错误，未保存任何内容",
+    "categoryOutOfBounds": "该分类不在您的笔记范围内，未创建任何内容",
     "requiredField": "此字段必填",
     "emailInvalid": "请输入有效的邮箱",
     "passwordTooShort": "密码至少需要 8 个字符",
@@ -1164,43 +1171,44 @@
     "networkError": "网络错误",
     "timeout": "请求超时",
     "permissionDenied": "权限被拒绝",
-    "requiredPermissions": "您没有执行此操作所需的权限。",
+    "requiredPermissions": "您没有权限执行此操作。",
     "loadError": "加载错误",
     "failedToLoadCustomEmojis": "加载自定义 Emoji 失败",
-    "emojiDeletedSuccessfully": "Emoji 删除成功",
+    "emojiDeletedSuccessfully": "Emoji 已删除",
     "deleteError": "删除错误",
     "failedToDeleteEmoji": "删除 Emoji 失败",
     "validationError": "验证错误",
     "keywordAndEmojiRequired": "关键词和 Emoji 必填",
     "duplicateKeyword": "关键词重复",
     "keywordAlreadyExists": "关键词已存在",
-    "emojiUpdatedSuccessfully": "Emoji 更新成功",
-    "emojiCreatedSuccessfully": "Emoji 创建成功",
+    "emojiUpdatedSuccessfully": "Emoji 已更新",
+    "emojiCreatedSuccessfully": "Emoji 已创建",
     "saveError": "保存错误",
     "failedToSaveEmoji": "保存 Emoji 失败",
     "failedToLoadCustomCSS": "加载自定义 CSS 失败",
     "couldNotLoadCustomCSS": "无法加载自定义 CSS。",
     "couldNotLoadThemes": "无法加载主题。",
-    "customCSSSavedSuccessfully": "自定义 CSS 保存成功。",
+    "customCSSSavedSuccessfully": "自定义 CSS 已保存。",
     "themeNotFound": "主题未找到。",
-    "themeDeletedSuccessfully": "主题删除成功。",
+    "themeDeletedSuccessfully": "主题已删除。",
     "themeNameRequired": "主题名称必填。",
-    "themeSavedSuccessfully": "主题 {action} 成功。",
+    "themeSavedSuccessfully": "主题已{action}。",
     "anUnknownErrorOccurred": "发生未知错误。",
     "usernameRequired": "用户名必填",
     "passwordRequired": "密码必填",
     "passwordMinLength": "密码长度至少为 6 个字符",
     "passwordsDoNotMatch": "密码不匹配",
-    "userSavedSuccessfully": "用户 {mode} 成功！",
+    "userSavedSuccessfully": "用户已{mode}。",
     "failedToSaveUser": "用户 {mode} 失败",
     "anErrorOccurred": "发生错误。",
     "deleteUserConfirmation": "删除用户 \"{username}\"？此操作无法撤销。",
-    "userDeletedSuccessfully": "用户删除成功！",
-    "failedToDeleteUser": "删除用户失败"
+    "userDeletedSuccessfully": "用户已删除。",
+    "failedToDeleteUser": "删除用户失败",
+    "readOnlyFolder": "此文件夹在服务器上是只读的，无法保存更改。"
   },
   "pwa": {
     "installPromptTitle": "安装应用",
-    "installPromptMessage": "在您的设备上安装此应用以获得更好的体验",
+    "installPromptMessage": "将 Jotty 安装到设备上，像应用一样打开",
     "installButton": "安装",
     "updateAvailable": "更新可用",
     "updateMessage": "有新版本可用",
@@ -1258,6 +1266,7 @@
     "markdown": "Markdown",
     "toggleRichEditorMode": "切换富文本编辑器模式",
     "toggleMarkdownMode": "切换 Markdown 模式",
+    "quickControls": "编辑器控件",
     "toggleBold": "切换加粗",
     "toggleItalic": "切换斜体",
     "toggleUnderline": "切换下划线",
@@ -1431,16 +1440,16 @@
     "viewNote": "查看笔记",
     "editNote": "编辑笔记",
     "privateKeyWarning": "警告：您的私钥允许解密所有加密笔记。仅在您了解安全隐患的情况下导出。继续？",
-    "publicKeyExported": "公钥导出成功",
-    "privateKeyExported": "私钥导出成功",
+    "publicKeyExported": "公钥已导出",
+    "privateKeyExported": "私钥已导出",
     "failedToExportKey": "导出密钥失败",
     "unexpectedError": "发生意外错误",
-    "keysDeleted": "密钥删除成功",
+    "keysDeleted": "密钥已删除",
     "failedToDeleteKeys": "删除密钥失败",
     "autoDecryptUpdated": "自动解密设置已更新",
     "failedToUpdateSetting": "更新设置失败",
     "enterValidPath": "请输入有效路径",
-    "customPathSet": "自定义密钥路径设置成功",
+    "customPathSet": "自定义密钥路径已设置",
     "failedToSetCustomPath": "设置自定义路径失败",
     "thisNoteIsEncrypted": "此笔记已加密",
     "noteProtectedWith": "此笔记受 {type} 加密保护。",
@@ -1451,8 +1460,8 @@
     "pgp": "PGP",
     "selectMethod": "选择加密方法",
     "encryptionMethodsTitle": "加密方法",
-    "xchachaDescription": "XChaCha20-Poly1305：现代、快速、基于口令的加密",
-    "pgpDescription": "PGP：传统的公钥加密，需管理密钥对",
+    "xchachaDescription": "XChaCha20-Poly1305：使用口令加密",
+    "pgpDescription": "PGP：使用您自己管理的密钥对进行公钥加密",
     "encryptionKeys": "加密密钥",
     "keysConfigured": "密钥已配置",
     "algorithm": "算法：",
@@ -1466,9 +1475,9 @@
     "keysDisabledInDemo": "存储的加密密钥在演示模式下已禁用。",
     "encryptionSettings": "加密设置",
     "promptForPassphrase": "打开加密笔记时提示输入口令",
-    "promptForPassphraseDescription": "启用后，打开加密笔记时将提示您输入口令。笔记在服务器上保持加密，但您可以在当前标签会话中查看解密内容。",
+    "promptForPassphraseDescription": "打开加密笔记时询问口令。笔记在服务器上保持加密，解密内容只在当前标签页中可见。",
     "customKeyPath": "自定义密钥路径（本地安装）",
-    "customKeyPathDescription": "指定存储加密密钥的自定义（绝对）文件系统路径。仅本地安装需要。Docker 用户应在 docker-compose.yml 中映射默认路径。",
+    "customKeyPathDescription": "存储加密密钥的绝对文件系统路径。仅本地安装需要。Docker 用户应改为在 docker-compose.yml 中映射默认路径。",
     "customPath": "自定义路径",
     "customPathPlaceholder": "/home/user/my-keys",
     "customPathHelp": "必须是绝对路径（例如 /home/user/my-keys 或 C:\\Users\\user\\my-keys）",
@@ -1487,9 +1496,9 @@
     "noteWillBeEncryptedBeforeSaving": "笔记内容将在保存前加密",
     "passphraseRequired": "需要口令",
     "incorrectPassphrase": "口令不正确",
-    "noteEncryptedSuccessfully": "笔记加密成功",
+    "noteEncryptedSuccessfully": "笔记已加密",
     "failedToEncryptNote": "笔记加密失败",
-    "noteDecryptedSuccessfully": "笔记解密成功",
+    "noteDecryptedSuccessfully": "笔记已解密",
     "failedToDecryptNote": "笔记解密失败",
     "passphrase": "口令",
     "enterYourPassphrase": "输入您的口令",
@@ -1517,8 +1526,8 @@
     "privateKey": "私钥",
     "noStoredKeysFound": "未找到存储的密钥",
     "noEncryptionKeysConfigured": "您没有配置任何加密密钥",
-    "pastePublicKeyBelow": "请在下方粘贴公钥以加密笔记内容",
-    "generateOrImportKeysInProfile": "您可以在 个人资料 → 加密 中生成或导入 Jotty 专用密钥",
+    "pastePublicKeyBelow": "在下方粘贴公钥以加密笔记内容",
+    "generateOrImportKeysInProfile": "您可以在 个人资料 > 加密 中生成或导入 Jotty 专用密钥",
     "useCustomKey": "使用自定义 {keyType} 密钥",
     "signWithPrivateKey": "用私钥签名",
     "proveAuthenticityOfNote": "证明此笔记的真实性",
@@ -1538,7 +1547,7 @@
     "yourEmail": "your@email.com",
     "generating": "生成中...",
     "generateKeys": "生成密钥",
-    "keysGeneratedSuccessfully": "密钥生成成功",
+    "keysGeneratedSuccessfully": "密钥已生成",
     "importPGPKeys": "导入 PGP 密钥",
     "publicKeyLabel": "公钥",
     "privateKeyLabel": "私钥",
@@ -1547,7 +1556,7 @@
     "rememberPassphraseCannotRecover": "记住您的口令！它无法恢复。",
     "withoutPassphraseCannotDecrypt": "没有口令，您无法解密笔记。",
     "backupPrivateKeySafely": "安全备份您的私钥。",
-    "pgpKeyPairGeneratedSuccessfully": "PGP 密钥对生成成功",
+    "pgpKeyPairGeneratedSuccessfully": "PGP 密钥对已生成",
     "failedToGenerateKeys": "生成密钥失败",
     "fingerprint": "指纹",
     "keysSavedSecurely": "您的密钥已安全保存。",
@@ -1561,13 +1570,13 @@
     "bothKeysRequired": "公钥和私钥都是必需的",
     "invalidPublicKeyFormat": "无效的公钥格式。必须是 ASCII-armored PGP 密钥。",
     "invalidPrivateKeyFormat": "无效的私钥格式。必须是 ASCII-armored PGP 密钥。",
-    "keysImportedSuccessfully": "密钥导入成功",
+    "keysImportedSuccessfully": "密钥已导入",
     "failedToImportKeys": "导入密钥失败",
     "created": "加密已创建",
     "notePlaceholder": "我是一个占位符，因为你无法加密空笔记。"
   },
   "settingsModal": {
-    "sessionOnlyPrefix": "这些选项仅适用于当前浏览器会话。如需永久设置，请检查您的",
+    "sessionOnlyPrefix": "这些选项仅适用于此浏览器会话。如需永久设置，请查看您的",
     "accountSettings": "用户偏好",
     "autosaveNotes": "自动保存笔记",
     "showNotePreview": "在卡片上显示笔记预览",
@@ -1596,20 +1605,45 @@
     "migrationSuccessful": "迁移成功",
     "returnToApp": "返回应用",
     "adminAccessRequired": "需要管理员权限",
-    "adminAccessDescription": "此迁移需要管理员权限。请联系管理员执行系统迁移。",
+    "adminAccessDescription": "此迁移需要管理员执行。请联系管理员。",
     "whatsHappening": "发生了什么？",
-    "sharingDataMigrationDescription": "系统需要迁移您的共享数据。这是一次性过程，需要管理员权限。",
+    "sharingDataMigrationDescription": "Jotty 需要迁移您的共享数据。只运行一次，需要管理员执行。",
     "whatsChanging": "有什么变化？",
     "automaticBackupIncluded": "包含自动备份",
     "yamlFrontmatterIndustryStandard": "YAML Frontmatter 是行业标准",
-    "noMigrationNeeded": "无需迁移 - 您的系统已是最新。",
-    "importantBackupData": "重要：备份您的数据"
+    "noMigrationNeeded": "无需迁移，您的数据已是最新。",
+    "importantBackupData": "重要：备份您的数据",
+    "sharingNowWithData": "您的共享数据现在和笔记、文件夹保存在一起。",
+    "sharingMovesDescription": "共享信息从一个中心文件移入您的数据中。现在可以共享文件夹，共享的文件夹会出现在您自己的侧边栏，而不是单独的区域。",
+    "whatsHappeningBody": "<code>.sharing.json</code> 中的每条共享都会写入对应项目的 frontmatter，每个文件夹都会获得一个 <code>.category-info.json</code>，保存其标识、共享和排序。数据迁移完成后，旧文件会被删除。",
+    "migrationChanges": "迁移变更",
+    "sharingTravelsTitle": "共享随文件移动",
+    "sharingTravelsBody": "每个共享项目都在自己的 frontmatter 中记录共享对象，因此移动或重命名都不会破坏共享。",
+    "folderSharingTitle": "文件夹共享",
+    "folderSharingBody": "共享一个文件夹后，里面的所有内容，无论现在还是以后加入的，都会一起共享。接收者在自己的侧边栏中看到的是普通文件夹。",
+    "oneFilePerFolderTitle": "每个文件夹一个文件",
+    "oneFilePerFolderBody": "<code>.order.json</code> 并入 <code>.category-info.json</code>，排序以 uuid 而不是文件名为键。",
+    "permissionsUnchangedTitle": "权限保持不变",
+    "permissionsUnchangedBody": "读取、编辑和删除权限按用户、按项目原样保留。",
+    "backupWarningBody": "此迁移会改写所有笔记和清单的 frontmatter，并删除旧的 <code>.sharing.json</code> 和 <code>.order.json</code> 文件。继续之前请备份您的 <code>data</code> 文件夹。",
+    "backupConfirmLabel": "我已备份 data 文件夹，并了解迁移过程。",
+    "backupConfirmHint": "继续之前请确认您已有备份。",
+    "sharingDataMigrated": "您的共享和排序数据已迁移。",
+    "whatWasChanged": "变更内容：",
+    "migrationPartial": "迁移完成，但有遗留文件",
+    "leftoversTitle": "部分旧文件被保留",
+    "leftoversBody": "迁移无法转换全部内容，因此下列旧文件原样保留在磁盘上。没有删除任何东西。您可以修复原因后重新运行迁移，也可以现在进入应用，以后再处理。",
+    "overrideConfirmLabel": "仍然继续，并不再显示此页面。",
+    "overrideConfirmHint": "遗留文件会保留在磁盘上，但应用会把您的数据视为已迁移。上面列出的共享或排序在重新迁移前不会生效，您随时可以在 /migration?force=1 重新迁移。",
+    "continueAnyway": "仍然继续",
+    "overriding": "正在继续...",
+    "overrideFailed": "无法跳过迁移"
   },
   "toasts": {
-    "categoryRenamedSuccessfully": "分类重命名成功",
+    "categoryRenamedSuccessfully": "分类已重命名",
     "failedToRenameCategory": "重命名分类失败",
     "categoryRenamedSuccessfullyMessage": "分类 {categoryName} 已重命名为 {newName}",
-    "failedToRenameCategoryMessage": "重命名分类时出错。"
+    "failedToRenameCategoryMessage": "重命名分类时出了问题。"
   },
   "auditLogs": {
     "title": "审计日志",
@@ -1626,17 +1660,17 @@
     "exportJSON": "导出 JSON",
     "exportCSV": "导出 CSV",
     "cleanupOldLogs": "清理旧日志",
-    "confirmCleanup": "确定要删除早于 {days} 天的日志吗？这将影响所有用户且无法撤销。",
+    "confirmCleanup": "删除早于 {days} 天的日志？这会影响所有用户且无法撤销。",
     "confirmCleanupUnlimited": "未配置自动清理（无限期保留）。如果需要，您仍可以手动删除旧日志。",
     "deleteAllLogsModalTitle": "删除所有审计日志",
     "deleteAllLogsWarning": "这将删除所有日志，而不仅仅是旧日志",
     "deleteAllLogsWarningDescription": "整个审计日志历史将从系统中清除。",
     "deletingAllLogs": "正在删除所有日志...",
     "deleteAllLogsButton": "删除所有日志",
-    "cleanupSuccess": "成功删除了 {count} 个旧日志文件",
+    "cleanupSuccess": "已删除 {count} 个旧日志文件",
     "cleanupError": "清理旧日志失败",
-    "userDescription": "查看您在系统中的所有活动和操作",
-    "adminDescription": "查看和管理整个系统中的所有用户活动",
+    "userDescription": "您在 Jotty 中的所有操作",
+    "adminDescription": "此实例上每个用户的操作",
     "level": "级别",
     "allLevels": "所有级别",
     "allCategories": "所有分类",
@@ -1659,13 +1693,9 @@
     "login": "登录",
     "logout": "注销",
     "register": "注册",
-    "sessionTerminated": "会话终止",
     "sessionterminated": "会话终止",
-    "userCreated": "用户已创建",
     "usercreated": "用户已创建",
-    "userUpdated": "用户已更新",
     "userupdated": "用户已更新",
-    "userDeleted": "用户已删除",
     "userdeleted": "用户已删除",
     "profileupdated": "个人资料已更新",
     "checklistcreated": "清单已创建",
@@ -1704,9 +1734,9 @@
     "topActions": "热门操作",
     "mostActiveUsers": "最活跃用户",
     "oldLogsFound": "有 {count} 个早于 {days} 天的日志文件。",
-    "oldLogsFoundDescription": "您想清理它们吗？此操作无法撤销。",
+    "oldLogsFoundDescription": "清理它们？此操作无法撤销。",
     "cleanUpNow": "立即清理",
-    "cleanupSuccessMessage": "成功删除了 {count} 个旧日志文件。",
+    "cleanupSuccessMessage": "已删除 {count} 个旧日志文件。",
     "security": "安全",
     "mfasecretgenerated": "MFA 密钥已生成",
     "mfaenabled": "MFA 已启用",
@@ -1722,6 +1752,7 @@
     "howTo": "使用指南",
     "shortcuts": "快捷键",
     "markdownGuide": "Markdown 指南",
+    "brain": "链接与大脑",
     "customisations": "自定义",
     "docker": "Docker",
     "envVariables": "环境变量",
@@ -1729,6 +1760,7 @@
     "pwa": "PWA",
     "encryption": "加密",
     "sso": "SSO",
+    "ldap": "LDAP",
     "translations": "翻译",
     "unraid": "Unraid",
     "patches": "补丁"
@@ -1742,6 +1774,7 @@
   },
   "notifications": {
     "title": "通知",
+    "unread": "未读",
     "markAllRead": "标记全部已读",
     "clearAll": "全部清除",
     "empty": "没有通知",
@@ -1749,12 +1782,99 @@
     "assignmentMessage": "“{board}”中的“{task}”",
     "reminderTitle": "任务逾期",
     "reminderMessage": "“{board}”中的“{task}”已超过提醒时间",
-    "unread": "未读",
     "sharingTitle": "{user} 与你共享了{type}",
     "sharingMessage": "打开以查看共享的{type}",
     "sharingFolderTitle": "{user} 与你共享了{type}文件夹",
-    "sharingFolderMessage": "打开以查看“{folder}”",
+    "sharingFolderMessage": "打开以查看 \"{folder}\"",
     "mentionTitle": "{user} 在评论中提到了你",
-    "mentionMessage": "“{board}”"
+    "mentionMessage": "\"{board}\""
+  },
+  "relations": {
+    "indexing": "正在索引关联...",
+    "unreachable": "无法访问",
+    "createFromWikilink": "创建名为 \"{title}\" 的笔记",
+    "mentionedIn": "被提及于",
+    "mentionedInHint": "这些笔记以纯文本形式使用了此标题。链接其中一个即可建立关联。",
+    "linkMention": "链接",
+    "linked": "已链接 {title} 中的提及",
+    "linkFailed": "无法链接该提及",
+    "kind": {
+      "mention": "链接",
+      "wiki": "维基链接"
+    }
+  },
+  "brain": {
+    "title": "大脑",
+    "openBrain": "在大脑中打开",
+    "search": "在大脑中查找...",
+    "dimension": "视图",
+    "dimensions": {
+      "3d": "3D",
+      "2d": "2D"
+    },
+    "local": "此项目周围",
+    "global": "全部",
+    "depth": "深度 {depth}",
+    "colourBy": "着色依据",
+    "colourModes": {
+      "type": "类型",
+      "category": "分类"
+    },
+    "filters": {
+      "notes": "笔记",
+      "checklists": "清单",
+      "tags": "标签",
+      "ghosts": "尚未写",
+      "suggestions": "建议",
+      "orphans": "孤零零的"
+    },
+    "kind": {
+      "note": "笔记",
+      "checklist": "清单",
+      "ghost": "尚未写",
+      "tag": "标签"
+    },
+    "edges": {
+      "mention": "链接",
+      "wiki": "维基链接",
+      "suggested": "建议",
+      "tag": "标签"
+    },
+    "linksTo": "链接到",
+    "linkedFrom": "被链接自",
+    "suggested": "可能相关",
+    "promote": "链接到 {title}",
+    "lonely": "这里还没有任何关联。在其他笔记中用 @ 或 [[ 提及它。",
+    "open": "打开",
+    "createGhost": "写这条笔记",
+    "openTag": "显示所有带此标签的内容",
+    "createFailed": "无法创建该笔记",
+    "connectFailed": "无法链接这两项",
+    "connected": "已将 {source} 链接到 {target}",
+    "empty": "您的大脑很安静。用 @ 或 [[ 链接笔记和清单，它们就会出现在这里。",
+    "viewingOwner": "正在查看 {owner} 的大脑",
+    "summary": "{items} 个项目，{links} 个链接，显示 {shown} 个"
+  },
+  "apiExplorer": {
+    "title": "API 浏览器",
+    "intro": "此实例 (v{version}) 提供的所有端点，由实际处理请求的代码生成。选一个，填好后发送。",
+    "realData": "请求以 API 密钥所有者的身份作用于真实数据。在这里发送 DELETE 会真的删除。",
+    "apiKey": "API 密钥",
+    "apiKeyHint": "仅保留在此页面，离开后即被清除。",
+    "useMyKey": "使用我的密钥",
+    "noKeyYet": "您还没有 API 密钥。请在个人资料设置中生成一个。",
+    "filter": "筛选",
+    "filterPlaceholder": "路径、名称或方法",
+    "noMatches": "没有匹配此筛选条件的内容。",
+    "body": "请求体 (JSON)",
+    "showSchema": "显示 schema",
+    "hideSchema": "隐藏 schema",
+    "send": "发送",
+    "sending": "发送中...",
+    "keyRequired": "请先添加 API 密钥。",
+    "noKeyNeeded": "无需 API 密钥",
+    "deprecated": "已弃用",
+    "requestFailed": "请求没有到达服务器。请检查网络连接。",
+    "responseMeta": "{status}，耗时 {ms} ms"
   }
 }
diff --git a/app/_types/audit.ts b/app/_types/audit.ts
index dddf438b3..31371ed25 100644
--- a/app/_types/audit.ts
+++ b/app/_types/audit.ts
@@ -1,18 +1,23 @@
-export type AuditLogLevel = "DEBUG" | "INFO" | "WARNING" | "ERROR" | "CRITICAL";
+export const AUDIT_LOG_LEVELS = ["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"] as const;
 
-export type AuditCategory =
-  | "auth"
-  | "user"
-  | "checklist"
-  | "note"
-  | "sharing"
-  | "settings"
-  | "encryption"
-  | "api"
-  | "system"
-  | "file"
-  | "upload"
-  | "security";
+export type AuditLogLevel = (typeof AUDIT_LOG_LEVELS)[number];
+
+export const AUDIT_CATEGORIES = [
+  "auth",
+  "user",
+  "checklist",
+  "note",
+  "sharing",
+  "settings",
+  "encryption",
+  "api",
+  "system",
+  "file",
+  "upload",
+  "security",
+] as const;
+
+export type AuditCategory = (typeof AUDIT_CATEGORIES)[number];
 
 export type AuditAction =
   | "login"
diff --git a/app/_types/enums.ts b/app/_types/enums.ts
index 59bf6c706..61806c974 100644
--- a/app/_types/enums.ts
+++ b/app/_types/enums.ts
@@ -95,3 +95,8 @@ export enum BottomBarSpaces {
   QUICK_NAV = "--jotty-quick-nav-space",
   NOTE_BAR = "--jotty-note-bar-space",
 }
+
+export enum DropPosition {
+  BEFORE = "before",
+  AFTER = "after",
+}
diff --git a/app/_types/export.ts b/app/_types/export.ts
index 41cd80e6c..c0f2ecae9 100644
--- a/app/_types/export.ts
+++ b/app/_types/export.ts
@@ -9,8 +9,11 @@ export interface ExportResult {
   error?: string;
 }
 
-export type ExportType =
-  | "all_checklists_notes"
-  | "user_checklists_notes"
-  | "all_users_data"
-  | "whole_data_folder";
+export enum ExportKind {
+  ALL_CONTENT = "all_checklists_notes",
+  USER_CONTENT = "user_checklists_notes",
+  ALL_USERS = "all_users_data",
+  WHOLE_DATA = "whole_data_folder",
+}
+
+export type ExportType = `${ExportKind}`;
diff --git a/app/_types/openapi.ts b/app/_types/openapi.ts
new file mode 100644
index 000000000..0d893d918
--- /dev/null
+++ b/app/_types/openapi.ts
@@ -0,0 +1,56 @@
+export type JsonSchema = {
+  $ref?: string;
+  type?: string | string[];
+  properties?: Record<string, JsonSchema>;
+  required?: string[];
+  items?: JsonSchema;
+  enum?: unknown[];
+  const?: unknown;
+  default?: unknown;
+  anyOf?: JsonSchema[];
+  oneOf?: JsonSchema[];
+  description?: string;
+  [keyword: string]: unknown;
+};
+
+export enum ParameterLocation {
+  PATH = "path",
+  QUERY = "query",
+}
+
+export interface SpecParameter {
+  name: string;
+  in: ParameterLocation;
+  required: boolean;
+  description?: string;
+  schema: JsonSchema;
+}
+
+export interface SpecMedia {
+  schema?: JsonSchema;
+}
+
+export interface SpecOperation {
+  operationId: string;
+  summary: string;
+  description?: string;
+  tags: string[];
+  deprecated?: boolean;
+  security?: Record<string, string[]>[];
+  parameters: SpecParameter[];
+  requestBody?: { required: boolean; content: Record<string, SpecMedia> };
+  responses: Record<string, { description: string; content?: Record<string, SpecMedia> }>;
+}
+
+export interface OpenApiDocument {
+  openapi: string;
+  info: { title: string; version: string; description?: string };
+  servers: { url: string }[];
+  security: Record<string, string[]>[];
+  tags: { name: string }[];
+  paths: Record<string, Record<string, SpecOperation>>;
+  components: {
+    securitySchemes: Record<string, { type: string; in: string; name: string }>;
+    schemas: Record<string, JsonSchema>;
+  };
+}
diff --git a/app/_utils/api-list-utils.ts b/app/_utils/api-list-utils.ts
new file mode 100644
index 000000000..8ddd764b8
--- /dev/null
+++ b/app/_utils/api-list-utils.ts
@@ -0,0 +1,71 @@
+import { NextRequest } from "next/server";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { refuse } from "@/app/_server/api/define-route";
+import { listUuid, turnAway } from "@/app/_utils/api-utils";
+import { Checklist, Item } from "@/app/_types";
+import { PermissionTypes } from "@/app/_types/enums";
+
+export const LIST_NOT_FOUND = "List not found";
+export const INVALID_INDEX = "Invalid item index";
+export const OUT_OF_RANGE = "Item index out of range";
+
+type Found<T> = T | { refusal: Response };
+
+export const isRefusal = <T extends object>(found: Found<T>): found is { refusal: Response } =>
+  "refusal" in found;
+
+export const indexPath = (raw: string): number[] | null => {
+  const path = raw.split(".").map((part) => parseInt(part));
+  return path.every((idx) => idx >= 0) ? path : null;
+};
+
+export const itemAt = (items: Item[], [head, ...rest]: number[]): Item | undefined => {
+  const item = items[head];
+  if (!item || rest.length === 0) return item;
+  return itemAt(item.children || [], rest);
+};
+
+export const itemAtIndex = (items: Item[], raw: string): { item: Item; index: number } | null => {
+  const path = indexPath(raw);
+  const item = path ? itemAt(items, path) : undefined;
+  return path && item ? { item, index: path[path.length - 1] } : null;
+};
+
+export const guard = async (
+  username: string,
+  list: Checklist,
+  permission?: PermissionTypes,
+): Promise<Response | null> =>
+  permission ? turnAway(username, list.uuid, permission) : null;
+
+export const findList = async (
+  request: NextRequest,
+  listId: string,
+  username: string,
+  permission?: PermissionTypes,
+): Promise<Found<{ list: Checklist }>> => {
+  const uuid = await listUuid(request, listId, username);
+  const list = uuid ? await getListById(uuid, username) : undefined;
+  if (!list) return { refusal: refuse(LIST_NOT_FOUND, 404) };
+  const denied = await guard(username, list, permission);
+  return denied ? { refusal: denied } : { list };
+};
+
+export const findListItem = async (
+  request: NextRequest,
+  listId: string,
+  itemIndex: string,
+  username: string,
+  permission?: PermissionTypes,
+): Promise<Found<{ list: Checklist; item: Item }>> => {
+  const found = await findList(request, listId, username, permission);
+  if (isRefusal(found)) return found;
+
+  const path = indexPath(itemIndex);
+  if (!path) return { refusal: refuse(INVALID_INDEX, 400) };
+
+  const item = itemAt(found.list.items, path);
+  if (!item) return { refusal: refuse(OUT_OF_RANGE, 400) };
+
+  return { list: found.list, item };
+};
diff --git a/app/_utils/api-task.ts b/app/_utils/api-task.ts
new file mode 100644
index 000000000..f7fc8c9eb
--- /dev/null
+++ b/app/_utils/api-task.ts
@@ -0,0 +1,47 @@
+import { NextRequest } from "next/server";
+import { Checklist, KanbanStatus } from "@/app/_types";
+import { PermissionTypes, isKanbanType } from "@/app/_types/enums";
+import { API_FALLBACK_STATUSES } from "@/app/_consts/kanban";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { refuse } from "@/app/_server/api/define-route";
+import { listUuid } from "@/app/_utils/api-utils";
+import { guard } from "@/app/_utils/api-list-utils";
+
+export const TASK_NOT_FOUND = "Task not found";
+export const NOT_A_TASK = "Not a task checklist";
+
+export type TaskStatusView = KanbanStatus & { name?: string };
+
+export type TaskLookup = { task: Checklist } | { refusal: Response };
+
+export const LEGACY_TASK_STATUSES: TaskStatusView[] = API_FALLBACK_STATUSES.map(
+  (status) => ({ id: status.id, name: status.label, label: status.label, order: status.order }),
+);
+
+export const taskStatuses = (list?: Pick<Checklist, "statuses">): TaskStatusView[] =>
+  list?.statuses || LEGACY_TASK_STATUSES;
+
+export const toApiTask = (list?: Checklist) => ({
+  id: list?.uuid,
+  title: list?.title,
+  category: list?.category || UNCATEGORIZED,
+  statuses: taskStatuses(list),
+  createdAt: list?.createdAt,
+  updatedAt: list?.updatedAt,
+});
+
+
+export const fetchTask = async (
+  request: NextRequest,
+  taskId: string,
+  username: string,
+  permission?: PermissionTypes,
+): Promise<TaskLookup> => {
+  const uuid = await listUuid(request, taskId, username);
+  const task = uuid ? await getListById(uuid, username) : undefined;
+  if (!task) return { refusal: refuse(TASK_NOT_FOUND, 404) };
+  if (!isKanbanType(task.type)) return { refusal: refuse(NOT_A_TASK, 400) };
+  const denied = await guard(username, task, permission);
+  return denied ? { refusal: denied } : { task };
+};
diff --git a/app/_utils/api-utils.ts b/app/_utils/api-utils.ts
index 7fade579c..d036a0769 100644
--- a/app/_utils/api-utils.ts
+++ b/app/_utils/api-utils.ts
@@ -1,15 +1,18 @@
 import { NextRequest, NextResponse } from "next/server";
 import { authenticateApiKey } from "@/app/_server/actions/api";
-import { getAppSettings } from "@/app/_server/actions/config";
+import { getSettings } from "@/app/_server/actions/config";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { resolveApiId } from "@/app/_server/actions/lib/legacy-lookup";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
-import { User } from "@/app/_types";
+import { AppSettings, User } from "@/app/_types";
+import { API_KEY_HEADER } from "@/app/_consts/api";
 
 export type ApiCaller = Pick<User, "username" | "isAdmin" | "isSuperAdmin">;
 
-export const API_KEY_HEADER = "x-api-key";
+export { API_KEY_HEADER };
+
+const CONTENT_ACCESS_DENIED = "no";
 
 /**
  * @deprecated Legacy category+id fallback for checklist-family API routes
@@ -71,10 +74,6 @@ export const seesAllContent = async (user: ApiCaller): Promise<boolean> => {
   if (user.isSuperAdmin) return true;
   if (!user.isAdmin) return false;
 
-  const settingsResult = await getAppSettings();
-  if (!settingsResult.success || !settingsResult.data) {
-    return true;
-  }
-
-  return settingsResult.data.adminContentAccess !== "no";
+  const settings: AppSettings | null = await getSettings();
+  return settings?.adminContentAccess !== CONTENT_ACCESS_DENIED;
 };
diff --git a/app/_utils/howto-utils.ts b/app/_utils/howto-utils.ts
index 1e985f4b8..aa8fd5cab 100644
--- a/app/_utils/howto-utils.ts
+++ b/app/_utils/howto-utils.ts
@@ -1,6 +1,8 @@
 import { HOWTO_DIR } from "@/app/_consts/files";
 import path from "path";
 
+export const API_GUIDE_ID = "api";
+
 export interface HowtoGuide {
   id: string;
   name: string;
@@ -32,7 +34,7 @@ export const getHowtoGuides = (t: any): HowtoGuide[] => [
     translationKey: "help.brain",
   },
   {
-    id: "api",
+    id: API_GUIDE_ID,
     name: t("common.api"),
     filename: "API.md",
     icon: "code",
diff --git a/app/_utils/kanban/api-board.ts b/app/_utils/kanban/api-board.ts
new file mode 100644
index 000000000..a3230d13a
--- /dev/null
+++ b/app/_utils/kanban/api-board.ts
@@ -0,0 +1,48 @@
+import { NextRequest } from "next/server";
+import { listUuid } from "@/app/_utils/api-utils";
+import { guard } from "@/app/_utils/api-list-utils";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { refuse } from "@/app/_server/api/define-route";
+import { PermissionTypes, isKanbanType } from "@/app/_types/enums";
+import { Checklist, Item } from "@/app/_types";
+
+export const BOARD_NOT_FOUND = "Board not found";
+export const NOT_A_BOARD = "Not a kanban board";
+export const CARD_NOT_FOUND = "Item not found";
+
+interface BoardNeeds {
+  permission?: PermissionTypes;
+  itemId?: string;
+}
+
+type BoardLookup =
+  | { board: Checklist; card?: Item; refused?: undefined }
+  | { board?: undefined; card?: undefined; refused: Response };
+
+const _cardIn = (items: Item[], id: string): Item | undefined => {
+  for (const item of items) {
+    if (item.id === id) return item;
+    const nested = item.children ? _cardIn(item.children, id) : undefined;
+    if (nested) return nested;
+  }
+  return undefined;
+};
+
+export const boardFor = async (
+  request: NextRequest,
+  boardId: string,
+  username: string,
+  { permission, itemId }: BoardNeeds = {},
+): Promise<BoardLookup> => {
+  const uuid = await listUuid(request, boardId, username);
+  const board = uuid ? await getListById(uuid, username) : undefined;
+  if (!board) return { refused: refuse(BOARD_NOT_FOUND, 404) };
+  if (!isKanbanType(board.type)) return { refused: refuse(NOT_A_BOARD, 400) };
+
+  const denied = await guard(username, board, permission);
+  if (denied) return { refused: denied };
+
+  if (!itemId) return { board };
+  const card = _cardIn(board.items, itemId);
+  return card ? { board, card } : { refused: refuse(CARD_NOT_FOUND, 404) };
+};
diff --git a/app/api/admin/rebuild-index/route.ts b/app/api/admin/rebuild-index/route.ts
index 5708c082a..a8f669094 100644
--- a/app/api/admin/rebuild-index/route.ts
+++ b/app/api/admin/rebuild-index/route.ts
@@ -1,37 +1,52 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
 import { getUserIndex } from "@/app/_server/actions/users/helpers";
 import { rebuildOwnerRelations } from "@/app/_server/actions/relations/indexer";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { rebuildIndexBody, rebuiltSchema } from "@/app/_schemas/api/admin";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json().catch(() => ({}));
-      const requested = typeof body?.username === "string" ? body.username.trim() : "";
-      const username = requested || user.username;
+const NOT_REBUILT = "Failed to rebuild link index";
 
-      if (username !== user.username && !user.isAdmin) {
-        return NextResponse.json({ error: "Admin access required" }, { status: 403 });
-      }
+export const POST = defineRoute(
+  {
+    id: "rebuildLinkIndex",
+    method: HttpMethod.POST,
+    path: "/admin/rebuild-index",
+    tag: ApiTag.ADMIN,
+    summary: "Rebuild the link index",
+    description: "Rebuilds one user's links and backlinks from their files. Anybody can rebuild their own. Only admins can name somebody else. The body is optional.",
+    body: rebuildIndexBody,
+    responses: {
+      200: { description: "Rebuilt", schema: rebuiltSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const username = body.username || user.username;
 
-      if ((await getUserIndex(username)) === -1) {
-        return NextResponse.json({ error: "User not found" }, { status: 404 });
-      }
+    if (username !== user.username && !user.isAdmin) {
+      return refuse("Admin access required", 403);
+    }
 
-      await rebuildOwnerRelations(username);
+    if ((await getUserIndex(username)) === -1) return refuse("User not found", 404);
 
-      return NextResponse.json({
-        success: true,
-        message: `Successfully rebuilt link index for ${username}`,
-      });
+    try {
+      await rebuildOwnerRelations(username);
     } catch (error) {
       console.error("Failed to rebuild link index:", error);
-      return NextResponse.json(
-        { error: "Failed to rebuild link index" },
-        { status: 500 }
-      );
+      return refuse(NOT_REBUILT, 500);
     }
-  });
-}
+
+    return NextResponse.json({
+      success: true,
+      message: `Successfully rebuilt link index for ${username}`,
+    });
+  },
+);
diff --git a/app/api/categories/route.ts b/app/api/categories/route.ts
index 516052363..39364ae09 100644
--- a/app/api/categories/route.ts
+++ b/app/api/categories/route.ts
@@ -1,55 +1,47 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
 import { getCategories } from "@/app/_server/actions/category";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { categoriesSchema } from "@/app/_schemas/api/discovery";
+import { Category } from "@/app/_types";
 import { Modes } from "@/app/_types/enums";
 import { ARCHIVED_DIR_NAME } from "@/app/_consts/files";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const notesResult = await getCategories(Modes.NOTES, user.username);
-      const checklistsResult = await getCategories(
-        Modes.CHECKLISTS,
-        user.username,
-      );
+const _visible = (categories: Category[]) =>
+  categories
+    .filter((category) => !category.path.includes(ARCHIVED_DIR_NAME))
+    .map(({ name, path, count, level }) => ({ name, path, count, level }));
 
-      if (!notesResult.success || !checklistsResult.success) {
-        return NextResponse.json(
-          {
-            error:
-              notesResult.error ||
-              checklistsResult.error ||
-              "Failed to fetch categories",
-          },
-          { status: 500 },
-        );
-      }
+export const GET = defineRoute(
+  {
+    id: "listCategories",
+    method: HttpMethod.GET,
+    path: "/categories",
+    tag: ApiTag.DISCOVERY,
+    summary: "List categories",
+    description: "Your note and checklist categories, including shared ones. Archived categories are left out.",
+    responses: {
+      200: { description: "Categories per mode", schema: categoriesSchema },
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user }) => {
+    const notes = await getCategories(Modes.NOTES, user.username);
+    const checklists = await getCategories(Modes.CHECKLISTS, user.username);
 
-      const filterArchived = (categories: any[]) => {
-        return categories
-          .filter((cat) => !cat.path.includes(ARCHIVED_DIR_NAME))
-          .map((cat) => ({
-            name: cat.name,
-            path: cat.path,
-            count: cat.count,
-            level: cat.level,
-          }));
-      };
-
-      const categories = {
-        notes: filterArchived(notesResult.data || []),
-        checklists: filterArchived(checklistsResult.data || []),
-      };
-
-      return NextResponse.json({ categories });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+    if (!notes.success || !checklists.success) {
+      return refuse(notes.error || checklists.error || "Failed to fetch categories", 500);
     }
-  });
-}
+
+    return NextResponse.json({
+      categories: {
+        notes: _visible(notes.data || []),
+        checklists: _visible(checklists.data || []),
+      },
+    });
+  },
+);
diff --git a/app/api/checklists/[listId]/items/[itemIndex]/check/route.ts b/app/api/checklists/[listId]/items/[itemIndex]/check/route.ts
index c1628d4f8..18c7e7763 100644
--- a/app/api/checklists/[listId]/items/[itemIndex]/check/route.ts
+++ b/app/api/checklists/[listId]/items/[itemIndex]/check/route.ts
@@ -1,89 +1,45 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { PermissionTypes } from "@/app/_types/enums";
+import { findListItem, isRefusal } from "@/app/_utils/api-list-utils";
 import { editItem } from "@/app/_server/actions/checklist-item/editor";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { listItemParams } from "@/app/_schemas/api/checklists";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ listId: string; itemIndex: string }> }
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.listId, user.username);
-      const list = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!list) {
-        return NextResponse.json({ error: "List not found" }, { status: 404 });
-      }
-
-      const indexPath = params.itemIndex.split('.').map(i => parseInt(i));
-
-      for (const idx of indexPath) {
-        if (isNaN(idx) || idx < 0) {
-          return NextResponse.json(
-            { error: "Invalid item index" },
-            { status: 400 }
-          );
-        }
-      }
-
-      let item: any = null;
-      let currentItems = list.items;
-
-      for (const idx of indexPath) {
-        if (idx >= currentItems.length) {
-          return NextResponse.json(
-            { error: "Item index out of range" },
-            { status: 400 }
-          );
-        }
-        item = currentItems[idx];
-        currentItems = item.children || [];
-      }
-
-      if (!item) {
-        return NextResponse.json(
-          { error: "Item not found" },
-          { status: 404 }
-        );
-      }
-
-      const formData = new FormData();
-      formData.append("itemId", item.id);
-      formData.append("completed", "true");
-
-      const result = await editItem(user, list, formData, true);
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to check item" },
-          { status: 500 }
-        );
-      }
-
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      if (error instanceof Error) {
-        if (error.message === "List not found") {
-          return NextResponse.json(
-            { error: "List not found" },
-            { status: 404 }
-          );
-        }
-        if (error.message === "Item index out of range") {
-          return NextResponse.json(
-            { error: "Item index out of range" },
-            { status: 400 }
-          );
-        }
-        return NextResponse.json({ error: error.message }, { status: 500 });
-      }
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 }
-      );
+export const PUT = defineRoute(
+  {
+    id: "checkChecklistItem",
+    method: HttpMethod.PUT,
+    path: "/checklists/{listId}/items/{itemIndex}/check",
+    tag: ApiTag.CHECKLIST_ITEMS,
+    summary: "Check a checklist item",
+    description: "Marks the item and its sub-items as done. Needs edit permission.",
+    params: listItemParams,
+    responses: {
+      200: { description: "Done", schema: okSchema },
+      400: { description: "Invalid or out of range item index", schema: ERRORS[400].schema },
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: { description: "Write failed", schema: ERRORS[500].schema },
+    },
+  },
+  async ({ request, user, params }) => {
+    const found = await findListItem(request, params.listId, params.itemIndex, user.username, PermissionTypes.EDIT);
+    if (isRefusal(found)) return found.refusal;
+
+    const formData = new FormData();
+    formData.append("itemId", found.item.id);
+    formData.append("completed", "true");
+
+    const result = await editItem(user, found.list, formData, true);
+    if (!result.success) {
+      return refuse(result.error || "Failed to check item", 500);
     }
-  });
-}
+
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/checklists/[listId]/items/[itemIndex]/route.ts b/app/api/checklists/[listId]/items/[itemIndex]/route.ts
index d5d107cf0..c401235df 100644
--- a/app/api/checklists/[listId]/items/[itemIndex]/route.ts
+++ b/app/api/checklists/[listId]/items/[itemIndex]/route.ts
@@ -1,261 +1,87 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { findListItem, isRefusal } from "@/app/_utils/api-list-utils";
 import { editItem } from "@/app/_server/actions/checklist-item/editor";
 import { removeItem } from "@/app/_server/actions/checklist-item/remover";
-import { KanbanPriorityLevel, PermissionTypes } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { itemUpdateBody, listItemParams } from "@/app/_schemas/api/checklists";
+import { PermissionTypes } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
 
-const ALLOWED_PRIORITIES = Object.values(KanbanPriorityLevel) as string[];
-
-export async function PATCH(
-  request: NextRequest,
-  props: { params: Promise<{ listId: string; itemIndex: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const {
-        text,
-        description,
-        priority,
-        score,
-        startDate,
-        targetDate,
-        estimatedTime,
-      } = body;
-
-      const hasField =
-        text !== undefined ||
-        description !== undefined ||
-        priority !== undefined ||
-        score !== undefined ||
-        startDate !== undefined ||
-        targetDate !== undefined ||
-        estimatedTime !== undefined;
-
-      if (!hasField) {
-        return NextResponse.json(
-          { error: "Provide at least one field to update" },
-          { status: 400 },
-        );
-      }
-
-      if (text !== undefined && typeof text !== "string") {
-        return NextResponse.json(
-          { error: "'text' must be a string" },
-          { status: 400 },
-        );
-      }
-
-      if (
-        description !== undefined &&
-        description !== null &&
-        typeof description !== "string"
-      ) {
-        return NextResponse.json(
-          { error: "'description' must be a string" },
-          { status: 400 },
-        );
-      }
-
-      if (
-        priority !== undefined &&
-        priority !== null &&
-        !ALLOWED_PRIORITIES.includes(priority)
-      ) {
-        return NextResponse.json(
-          {
-            error: `'priority' must be one of: ${ALLOWED_PRIORITIES.join(", ")}`,
-          },
-          { status: 400 },
-        );
-      }
-
-      if (
-        score !== undefined &&
-        score !== null &&
-        (typeof score !== "number" || Number.isNaN(score))
-      ) {
-        return NextResponse.json(
-          { error: "'score' must be a number" },
-          { status: 400 },
-        );
-      }
-
-      if (
-        startDate !== undefined &&
-        startDate !== null &&
-        typeof startDate !== "string"
-      ) {
-        return NextResponse.json(
-          { error: "'startDate' must be a string" },
-          { status: 400 },
-        );
-      }
-
-      if (
-        targetDate !== undefined &&
-        targetDate !== null &&
-        typeof targetDate !== "string"
-      ) {
-        return NextResponse.json(
-          { error: "'targetDate' must be a string" },
-          { status: 400 },
-        );
-      }
-
-      if (
-        estimatedTime !== undefined &&
-        estimatedTime !== null &&
-        (typeof estimatedTime !== "number" || Number.isNaN(estimatedTime))
-      ) {
-        return NextResponse.json(
-          { error: "'estimatedTime' must be a number" },
-          { status: 400 },
-        );
-      }
-
-      const uuid = await listUuid(request, params.listId, user.username);
-      const list = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!list) {
-        return NextResponse.json({ error: "List not found" }, { status: 404 });
-      }
-
-      const indexPath = params.itemIndex.split(".").map((i) => parseInt(i));
-
-      for (const idx of indexPath) {
-        if (isNaN(idx) || idx < 0) {
-          return NextResponse.json(
-            { error: "Invalid item index" },
-            { status: 400 },
-          );
-        }
-      }
-
-      let item: any = null;
-      let currentItems = list.items;
-
-      for (const idx of indexPath) {
-        if (idx >= currentItems.length) {
-          return NextResponse.json(
-            { error: "Item index out of range" },
-            { status: 400 },
-          );
-        }
-        item = currentItems[idx];
-        currentItems = item.children || [];
-      }
-
-      if (!item) {
-        return NextResponse.json({ error: "Item not found" }, { status: 404 });
-      }
-
-      const formData = new FormData();
-      formData.append("itemId", item.id);
-      if (text !== undefined && text !== null) formData.append("text", text);
-      if (description !== undefined)
-        formData.append("description", description ?? "");
-      if (priority !== undefined) formData.append("priority", priority ?? "");
-      if (score !== undefined)
-        formData.append("score", score === null ? "" : String(score));
-      if (startDate !== undefined)
-        formData.append("startDate", startDate ?? "");
-      if (targetDate !== undefined)
-        formData.append("targetDate", targetDate ?? "");
-      if (estimatedTime !== undefined)
-        formData.append(
-          "estimatedTime",
-          estimatedTime === null ? "" : String(estimatedTime),
-        );
-
-      const result = await editItem(user, list, formData, true);
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to update item" },
-          { status: 500 },
-        );
-      }
-
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+const _blankable = (value: string | number | null) => (value === null ? "" : String(value));
+
+export const PATCH = defineRoute(
+  {
+    id: "updateChecklistItem",
+    method: HttpMethod.PATCH,
+    path: "/checklists/{listId}/items/{itemIndex}",
+    tag: ApiTag.CHECKLIST_ITEMS,
+    summary: "Update a checklist item",
+    description:
+      "Send at least one field. Fields left out keep their value, null clears every field except text. Needs edit permission.",
+    params: listItemParams,
+    body: itemUpdateBody,
+    responses: {
+      200: { description: "Updated", schema: okSchema },
+      400: { description: "Invalid input or item index out of range", schema: ERRORS[400].schema },
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: { description: "Write failed", schema: ERRORS[500].schema },
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const found = await findListItem(request, params.listId, params.itemIndex, user.username, PermissionTypes.EDIT);
+    if (isRefusal(found)) return found.refusal;
+
+    const formData = new FormData();
+    formData.append("itemId", found.item.id);
+    if (body.text !== undefined) formData.append("text", body.text);
+    if (body.description !== undefined) formData.append("description", _blankable(body.description));
+    if (body.priority !== undefined) formData.append("priority", _blankable(body.priority));
+    if (body.score !== undefined) formData.append("score", _blankable(body.score));
+    if (body.startDate !== undefined) formData.append("startDate", _blankable(body.startDate));
+    if (body.targetDate !== undefined) formData.append("targetDate", _blankable(body.targetDate));
+    if (body.estimatedTime !== undefined) formData.append("estimatedTime", _blankable(body.estimatedTime));
+
+    const result = await editItem(user, found.list, formData, true);
+    if (!result.success) {
+      return refuse(result.error || "Failed to update item", 500);
     }
-  });
-}
-
-export async function DELETE(
-  request: NextRequest,
-  props: { params: Promise<{ listId: string; itemIndex: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.listId, user.username);
-      const list = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!list) {
-        return NextResponse.json({ error: "List not found" }, { status: 404 });
-      }
-
-      const indexPath = params.itemIndex.split(".").map((i) => parseInt(i));
-
-      for (const idx of indexPath) {
-        if (isNaN(idx) || idx < 0) {
-          return NextResponse.json(
-            { error: "Invalid item index" },
-            { status: 400 },
-          );
-        }
-      }
 
-      let item: any = null;
-      let currentItems = list.items;
-
-      for (const idx of indexPath) {
-        if (idx >= currentItems.length) {
-          return NextResponse.json(
-            { error: "Item index out of range" },
-            { status: 400 },
-          );
-        }
-        item = currentItems[idx];
-        currentItems = item.children || [];
-      }
-
-      if (!item) {
-        return NextResponse.json({ error: "Item not found" }, { status: 404 });
-      }
-
-      const refused = await turnAway(
-        user.username,
-        list.uuid!,
-        PermissionTypes.DELETE,
-      );
-      if (refused) return refused;
-
-      const result = await removeItem(user, list.uuid!, item.id);
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to delete item" },
-          { status: 500 },
-        );
-      }
-
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+    return NextResponse.json({ success: true });
+  },
+);
+
+export const DELETE = defineRoute(
+  {
+    id: "deleteChecklistItem",
+    method: HttpMethod.DELETE,
+    path: "/checklists/{listId}/items/{itemIndex}",
+    tag: ApiTag.CHECKLIST_ITEMS,
+    summary: "Delete a checklist item",
+    description: "Removes the item and its sub-items. Needs delete permission.",
+    params: listItemParams,
+    responses: {
+      200: { description: "Deleted", schema: okSchema },
+      400: { description: "Invalid or out of range item index", schema: ERRORS[400].schema },
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const found = await findListItem(request, params.listId, params.itemIndex, user.username, PermissionTypes.DELETE);
+    if (isRefusal(found)) return found.refusal;
+
+    const result = await removeItem(user, found.list.uuid!, found.item.id);
+    if (!result.success) {
+      return refuse(result.error || "Failed to delete item", 500);
     }
-  });
-}
+
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route.ts b/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route.ts
index de02ef504..7ce2d3090 100644
--- a/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route.ts
+++ b/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route.ts
@@ -1,89 +1,45 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { PermissionTypes } from "@/app/_types/enums";
+import { findListItem, isRefusal } from "@/app/_utils/api-list-utils";
 import { editItem } from "@/app/_server/actions/checklist-item/editor";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { listItemParams } from "@/app/_schemas/api/checklists";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ listId: string; itemIndex: string }> }
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.listId, user.username);
-      const list = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!list) {
-        return NextResponse.json({ error: "List not found" }, { status: 404 });
-      }
-
-      const indexPath = params.itemIndex.split('.').map(i => parseInt(i));
-
-      for (const idx of indexPath) {
-        if (isNaN(idx) || idx < 0) {
-          return NextResponse.json(
-            { error: "Invalid item index" },
-            { status: 400 }
-          );
-        }
-      }
-
-      let item: any = null;
-      let currentItems = list.items;
-
-      for (const idx of indexPath) {
-        if (idx >= currentItems.length) {
-          return NextResponse.json(
-            { error: "Item index out of range" },
-            { status: 400 }
-          );
-        }
-        item = currentItems[idx];
-        currentItems = item.children || [];
-      }
-
-      if (!item) {
-        return NextResponse.json(
-          { error: "Item not found" },
-          { status: 404 }
-        );
-      }
-
-      const formData = new FormData();
-      formData.append("itemId", item.id);
-      formData.append("completed", "false");
-
-      const result = await editItem(user, list, formData, true);
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to uncheck item" },
-          { status: 500 }
-        );
-      }
-
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      if (error instanceof Error) {
-        if (error.message === "List not found") {
-          return NextResponse.json(
-            { error: "List not found" },
-            { status: 404 }
-          );
-        }
-        if (error.message === "Item index out of range") {
-          return NextResponse.json(
-            { error: "Item index out of range" },
-            { status: 400 }
-          );
-        }
-        return NextResponse.json({ error: error.message }, { status: 500 });
-      }
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 }
-      );
+export const PUT = defineRoute(
+  {
+    id: "uncheckChecklistItem",
+    method: HttpMethod.PUT,
+    path: "/checklists/{listId}/items/{itemIndex}/uncheck",
+    tag: ApiTag.CHECKLIST_ITEMS,
+    summary: "Uncheck a checklist item",
+    description: "Marks the item and its sub-items as not done. Needs edit permission.",
+    params: listItemParams,
+    responses: {
+      200: { description: "Done", schema: okSchema },
+      400: { description: "Invalid or out of range item index", schema: ERRORS[400].schema },
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: { description: "Write failed", schema: ERRORS[500].schema },
+    },
+  },
+  async ({ request, user, params }) => {
+    const found = await findListItem(request, params.listId, params.itemIndex, user.username, PermissionTypes.EDIT);
+    if (isRefusal(found)) return found.refusal;
+
+    const formData = new FormData();
+    formData.append("itemId", found.item.id);
+    formData.append("completed", "false");
+
+    const result = await editItem(user, found.list, formData, true);
+    if (!result.success) {
+      return refuse(result.error || "Failed to uncheck item", 500);
     }
-  });
-}
+
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/checklists/[listId]/items/reorder/route.ts b/app/api/checklists/[listId]/items/reorder/route.ts
index 38648b965..a02dbf314 100644
--- a/app/api/checklists/[listId]/items/reorder/route.ts
+++ b/app/api/checklists/[listId]/items/reorder/route.ts
@@ -1,164 +1,45 @@
-import { NextRequest, NextResponse } from "next/server";
-import { revalidatePath } from "next/cache";
-import { withApiAuth } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
-import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { serverWriteFile, ensureDir } from "@/app/_server/actions/file";
-import { canReach } from "@/app/_server/actions/share/queries";
-import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
-import path from "path";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
-import { UNCATEGORIZED } from "@/app/_consts/notes";
-import { resolveApiId } from "@/app/_server/actions/lib/legacy-lookup";
-import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { NextResponse } from "next/server";
+import { listUuid } from "@/app/_utils/api-utils";
+import { LIST_NOT_FOUND } from "@/app/_utils/api-list-utils";
+import { Rearranged, rearrangeItems } from "@/app/_server/actions/checklist-item/rearrange";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { itemReorderBody, listParams } from "@/app/_schemas/api/checklists";
 
 export const dynamic = "force-dynamic";
 
-type TreeItem = { id: string; order: number; children?: TreeItem[];[key: string]: unknown };
-type Located = { item: TreeItem; siblings: TreeItem[]; index: number };
-
-const findInTree = (items: TreeItem[], id: string): Located | null => {
-  for (let i = 0; i < items.length; i++) {
-    if (items[i].id === id) return { item: items[i], siblings: items, index: i };
-    if (items[i].children) {
-      const found = findInTree(items[i].children!, id);
-      if (found) return found;
-    }
-  }
-  return null;
-};
-
-const isDescendant = (ancestorId: string, targetId: string, items: TreeItem[]): boolean => {
-  const walk = (item: TreeItem): boolean => {
-    if (!item.children) return false;
-    return item.children.some((c) => c.id === targetId || walk(c));
-  };
-  const ancestor = findInTree(items, ancestorId);
-  return ancestor ? walk(ancestor.item) : false;
+const REFUSALS: Partial<Record<Rearranged, () => Response>> = {
+  [Rearranged.NO_LIST]: () => refuse(LIST_NOT_FOUND, 404),
+  [Rearranged.NO_ITEM]: () => refuse("Item not found", 404),
+  [Rearranged.FORBIDDEN]: () => refuse("Forbidden", 403),
 };
 
-const stampOrder = (items: TreeItem[]): void => {
-  items.forEach((item, i) => {
-    item.order = i;
-    if (item.children) stampOrder(item.children);
-  });
-};
-
-const cloneTree = (items: TreeItem[]): TreeItem[] =>
-  items.map((item) => ({ ...item, children: item.children ? cloneTree(item.children) : undefined }));
-
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ listId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { activeItemId, overItemId, position = "before", isDropInto = false } = body;
-
-      if (!activeItemId || !overItemId) {
-        return NextResponse.json(
-          { error: "'activeItemId' and 'overItemId' are required" },
-          { status: 400 },
-        );
-      }
-
-      if (position !== "before" && position !== "after") {
-        return NextResponse.json(
-          { error: "'position' must be 'before' or 'after'" },
-          { status: 400 },
-        );
-      }
-
-      const uuid = await resolveApiId(
-        Modes.CHECKLISTS,
-        params.listId,
-        request.nextUrl.searchParams.get("category"),
-        user.username,
-      );
-      if (!uuid) {
-        return NextResponse.json({ error: "List not found" }, { status: 404 });
-      }
-
-      return runQueued(itemLane(Modes.CHECKLISTS, uuid), async () => {
-        const list = await getListById(uuid, user.username);
-        if (!list) {
-          return NextResponse.json({ error: "List not found" }, { status: 404 });
-        }
-
-        const canEdit = await canReach(
-          list.uuid!,
-          ItemTypes.CHECKLIST,
-          user.username,
-          PermissionTypes.EDIT,
-        );
-
-        if (!canEdit) {
-          return NextResponse.json({ error: "Forbidden" }, { status: 403 });
-        }
-
-        const items = cloneTree(list.items as unknown as TreeItem[]);
-
-        if (isDescendant(activeItemId, overItemId, items)) {
-          return NextResponse.json({ success: true });
-        }
-
-        const activeInfo = findInTree(items, activeItemId);
-        const overInfo = findInTree(items, overItemId);
-
-        if (!activeInfo || !overInfo) {
-          return NextResponse.json({ error: "Item not found" }, { status: 404 });
-        }
-
-        if (activeItemId === overItemId) {
-          return NextResponse.json({ success: true });
-        }
-
-        activeInfo.siblings.splice(activeInfo.index, 1);
-
-        if (isDropInto) {
-          if (!overInfo.item.children) overInfo.item.children = [];
-          overInfo.item.children.push(activeInfo.item);
-        } else {
-          let insertAt = overInfo.siblings.findIndex((i) => i.id === overItemId);
-          if (position === "after") insertAt += 1;
-          overInfo.siblings.splice(insertAt, 0, activeInfo.item);
-        }
-
-        stampOrder(items);
-
-        const updatedList = { ...list, items, updatedAt: new Date().toISOString() };
-
-        const ownerDir = path.join(process.cwd(), "data", CHECKLISTS_FOLDER, list.owner!);
-        const categoryDir = path.join(ownerDir, list.category || UNCATEGORIZED);
-        await ensureDir(categoryDir);
-        await serverWriteFile(path.join(categoryDir, `${list.id}.md`), listToMarkdown(updatedList as any));
-
-        try {
-          revalidatePath("/");
-          revalidatePath(`/checklist/${list.uuid}`);
-        } catch (error) {
-          console.warn("Cache revalidation failed, but data was saved successfully:", error);
-        }
-
-        try {
-          await broadcast({
-            type: "checklist",
-            action: "updated",
-            entityId: list.uuid,
-            username: user.username,
-          });
-        } catch (error) {
-          console.warn("Broadcast failed, but data was saved successfully:", error);
-        }
-
-        return NextResponse.json({ success: true });
-      });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json({ error: "Internal server error" }, { status: 500 });
-    }
-  });
-}
+export const PUT = defineRoute(
+  {
+    id: "reorderChecklistItems",
+    method: HttpMethod.PUT,
+    path: "/checklists/{listId}/items/reorder",
+    tag: ApiTag.CHECKLIST_ITEMS,
+    summary: "Move a checklist item",
+    description:
+      "Moves activeItemId next to overItemId, or inside it with isDropInto. Dropping an item onto itself or one of its descendants does nothing. Needs edit permission.",
+    params: listParams,
+    body: itemReorderBody,
+    responses: {
+      200: { description: "Moved, or nothing to do", schema: okSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: { description: "List or item not found", schema: ERRORS[404].schema },
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const uuid = await listUuid(request, params.listId, user.username);
+    if (!uuid) return refuse(LIST_NOT_FOUND, 404);
+
+    const outcome = await rearrangeItems(user.username, { listUuid: uuid, ...body });
+    return REFUSALS[outcome]?.() ?? NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/checklists/[listId]/items/route.ts b/app/api/checklists/[listId]/items/route.ts
index db7429cd9..9bbcf39e7 100644
--- a/app/api/checklists/[listId]/items/route.ts
+++ b/app/api/checklists/[listId]/items/route.ts
@@ -1,116 +1,75 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { turnAway } from "@/app/_utils/api-utils";
+import { findList, indexPath, isRefusal, itemAt } from "@/app/_utils/api-list-utils";
 import { addItem } from "@/app/_server/actions/checklist-item/editor";
 import { graftItem } from "@/app/_server/actions/checklist-item/grafter";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { itemCreateBody, itemCreatedSchema, listParams } from "@/app/_schemas/api/checklists";
 import { PermissionTypes } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(
-  request: NextRequest,
-  props: { params: Promise<{ listId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { text, status, time, parentIndex } = body;
-
-      if (!text) {
-        return NextResponse.json(
-          { error: "Text is required" },
-          { status: 400 },
-        );
-      }
-
-      const uuid = await listUuid(request, params.listId, user.username);
-      const list = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!list) {
-        return NextResponse.json({ error: "List not found" }, { status: 404 });
+const NO_PARENT = "Parent item not found";
+
+export const POST = defineRoute(
+  {
+    id: "createChecklistItem",
+    method: HttpMethod.POST,
+    path: "/checklists/{listId}/items",
+    tag: ApiTag.CHECKLIST_ITEMS,
+    summary: "Add an item to a checklist",
+    description: "Adds a top-level item, or a sub-item when parentIndex is sent. Needs edit permission.",
+    params: listParams,
+    body: itemCreateBody,
+    responses: {
+      200: { description: "Item added", schema: itemCreatedSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: { description: "List or parent item not found", schema: ERRORS[404].schema },
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const found = await findList(request, params.listId, user.username);
+    if (isRefusal(found)) return found.refusal;
+    const { list } = found;
+
+    const refused = await turnAway(user.username, list.uuid!, PermissionTypes.EDIT);
+    if (refused) return refused;
+
+    if (body.parentIndex !== undefined) {
+      const path = indexPath(body.parentIndex.toString());
+      const parent = path ? itemAt(list.items, path) : undefined;
+      if (!parent) return refuse(NO_PARENT, 404);
+
+      const graft = new FormData();
+      graft.append("uuid", list.uuid!);
+      graft.append("parentId", parent.id);
+      graft.append("text", body.text);
+
+      const grafted = await graftItem(user, graft);
+      if (!grafted.success) {
+        return refuse(grafted.error || "Failed to add sub-item", 500);
       }
 
-      const refused = await turnAway(
-        user.username,
-        list.uuid!,
-        PermissionTypes.EDIT,
-      );
-      if (refused) return refused;
-
-      const formData = new FormData();
-      formData.append("text", text);
-
-      if (parentIndex !== undefined) {
-        const indexPath = parentIndex
-          .toString()
-          .split(".")
-          .map((i: string) => parseInt(i));
-        let parentItem: any = null;
-        let currentItems = list.items;
-
-        for (const idx of indexPath) {
-          if (idx >= currentItems.length) {
-            return NextResponse.json(
-              { error: "Parent item not found" },
-              { status: 404 },
-            );
-          }
-          parentItem = currentItems[idx];
-          currentItems = parentItem.children || [];
-        }
-
-        if (!parentItem) {
-          return NextResponse.json(
-            { error: "Parent item not found" },
-            { status: 404 },
-          );
-        }
-
-        const graft = new FormData();
-        graft.append("uuid", list.uuid!);
-        graft.append("parentId", parentItem.id);
-        graft.append("text", text);
-
-        const grafted = await graftItem(user, graft);
-
-        if (!grafted.success) {
-          return NextResponse.json(
-            { error: grafted.error || "Failed to add sub-item" },
-            { status: 500 },
-          );
-        }
-
-        return NextResponse.json({ success: true });
-      }
-      if (status) {
-        formData.append("status", status);
-      }
-      if (time !== undefined) {
-        formData.append(
-          "time",
-          typeof time === "string" ? time : JSON.stringify(time),
-        );
-      }
-
-      const result = await addItem(user, list, formData, true);
+      return NextResponse.json({ success: true });
+    }
 
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to create item" },
-          { status: 500 },
-        );
-      }
+    const formData = new FormData();
+    formData.append("text", body.text);
+    if (body.status) formData.append("status", body.status);
+    if (body.time !== undefined) {
+      formData.append("time", typeof body.time === "string" ? body.time : JSON.stringify(body.time));
+    }
 
-      return NextResponse.json({
-        success: true,
-        data: { id: result.data?.id },
-      });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+    const result = await addItem(user, list, formData, true);
+    if (!result.success) {
+      return refuse(result.error || "Failed to create item", 500);
     }
-  });
-}
+
+    return NextResponse.json({ success: true, data: { id: result.data?.id } });
+  },
+);
diff --git a/app/api/checklists/[listId]/route.ts b/app/api/checklists/[listId]/route.ts
index 58c851b96..14ac0b8bd 100644
--- a/app/api/checklists/[listId]/route.ts
+++ b/app/api/checklists/[listId]/route.ts
@@ -1,76 +1,94 @@
 import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { listUuid } from "@/app/_utils/api-utils";
 import { getListById } from "@/app/_server/actions/checklist/queries";
 import { dropList, editList } from "@/app/_server/actions/checklist/editor";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
+import { checklistSchema, checklistUpdateBody, listParams } from "@/app/_schemas/api/checklists";
+import { ChecklistsTypes } from "@/app/_types/enums";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(request: NextRequest, props: { params: Promise<{ listId: string }> }) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { title, category } = body;
+const NOT_FOUND = "Checklist not found";
 
-      const uuid = await listUuid(request, params.listId, user.username);
-      const list = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!list) {
-        return NextResponse.json({ error: "Checklist not found" }, { status: 404 });
-      }
+const _visibleList = async (request: NextRequest, listId: string, username: string) => {
+  const uuid = await listUuid(request, listId, username);
+  return uuid ? getListById(uuid, username) : undefined;
+};
 
-      const formData = new FormData();
-      formData.append("uuid", list.uuid!);
-      formData.append("title", title ?? list.title);
-      formData.append("category", category ?? list.category ?? "Uncategorized");
-      const result = await editList(user, formData);
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
+export const PUT = defineRoute(
+  {
+    id: "updateChecklist",
+    method: HttpMethod.PUT,
+    path: "/checklists/{listId}",
+    tag: ApiTag.CHECKLISTS,
+    summary: "Update a checklist",
+    description: "Renames or moves a checklist. Fields left out keep their current value. Needs edit permission.",
+    params: listParams,
+    body: checklistUpdateBody,
+    responses: {
+      200: { description: "Updated checklist", schema: envelope(checklistSchema) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const list = await _visibleList(request, params.listId, user.username);
+    if (!list) return refuse(NOT_FOUND, 404);
 
-      const transformedChecklist = {
+    const formData = new FormData();
+    formData.append("uuid", list.uuid!);
+    formData.append("title", body.title ?? list.title);
+    formData.append("category", body.category ?? list.category ?? UNCATEGORIZED);
+
+    const result = await editList(user, formData);
+    if (result.error) return refuse(result.error, 400);
+
+    return NextResponse.json({
+      success: true,
+      data: {
         id: result.data?.uuid,
         title: result.data?.title,
-        category: result.data?.category || "Uncategorized",
-        type: result.data?.type || "simple",
+        category: result.data?.category || UNCATEGORIZED,
+        type: result.data?.type || ChecklistsTypes.SIMPLE,
         createdAt: result.data?.createdAt,
         updatedAt: result.data?.updatedAt,
-      };
+      },
+    });
+  },
+);
 
-      return NextResponse.json({ success: true, data: transformedChecklist });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 }
-      );
-    }
-  });
-}
+export const DELETE = defineRoute(
+  {
+    id: "deleteChecklist",
+    method: HttpMethod.DELETE,
+    path: "/checklists/{listId}",
+    tag: ApiTag.CHECKLISTS,
+    summary: "Delete a checklist",
+    description: "Needs delete permission.",
+    params: listParams,
+    responses: {
+      200: { description: "Deleted", schema: okSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const list = await _visibleList(request, params.listId, user.username);
+    if (!list) return refuse(NOT_FOUND, 404);
 
-export async function DELETE(request: NextRequest, props: { params: Promise<{ listId: string }> }) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.listId, user.username);
-      const list = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!list) {
-        return NextResponse.json({ error: "Checklist not found" }, { status: 404 });
-      }
+    const formData = new FormData();
+    formData.append("uuid", list.uuid!);
 
-      const formData = new FormData();
-      formData.append("uuid", list.uuid!);
-      const result = await dropList(user, formData);
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
+    const result = await dropList(user, formData);
+    if (result.error) return refuse(result.error, 400);
 
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 }
-      );
-    }
-  });
-}
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/checklists/route.ts b/app/api/checklists/route.ts
index a906d3f71..039d70ae6 100644
--- a/app/api/checklists/route.ts
+++ b/app/api/checklists/route.ts
@@ -1,136 +1,105 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { z } from "zod";
 import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { makeList } from "@/app/_server/actions/checklist/creator";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { checklistCreateBody, checklistListQuery, checklistSchema } from "@/app/_schemas/api/checklists";
 import { ChecklistsTypes, isKanbanType } from "@/app/_types/enums";
 import { Checklist, Result } from "@/app/_types";
 import { toApiItem } from "@/app/_utils/api-item";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const { searchParams } = new URL(request.url);
-      const category = searchParams.get("category");
-      const type = searchParams.get("type");
-      const search = searchParams.get("q");
-
-      const lists = (await getUserChecklists({
-        username: user.username,
-      })) as Result<Checklist[]>;
-      if (!lists.success || !lists.data) {
-        return NextResponse.json(
-          { error: lists.error || "Failed to fetch checklists" },
-          { status: 500 },
-        );
-      }
-
-      let userLists = lists.data.filter(
-        (list) => list.owner === user.username || list.isShared,
-      );
+export const GET = defineRoute(
+  {
+    id: "listChecklists",
+    method: HttpMethod.GET,
+    path: "/checklists",
+    tag: ApiTag.CHECKLISTS,
+    summary: "List checklists",
+    description: "Checklists the API key owner owns or that were shared with them, items included.",
+    query: checklistListQuery,
+    responses: {
+      200: { description: "Checklists", schema: z.object({ checklists: z.array(checklistSchema) }) },
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    const lists = (await getUserChecklists({ username: user.username })) as Result<Checklist[]>;
+    if (!lists.success || !lists.data) {
+      return refuse(lists.error || "Failed to fetch checklists", 500);
+    }
 
-      if (category) {
-        userLists = userLists.filter((list) => list.category === category);
-      }
-      if (type) {
-        userLists = userLists.filter((list) => list.type === type);
-      }
-      if (search) {
-        const searchLower = search.toLowerCase();
-        userLists = userLists.filter(
-          (list) =>
-            list.title?.toLowerCase().includes(searchLower) ||
-            list.items.some((item) =>
-              item.text.toLowerCase().includes(searchLower),
-            ),
-        );
-      }
+    const needle = query.q?.toLowerCase();
+    const matches = lists.data.filter(
+      (list) =>
+        (list.owner === user.username || list.isShared) &&
+        (!query.category || list.category === query.category) &&
+        (!query.type || list.type === query.type) &&
+        (!needle ||
+          list.title?.toLowerCase().includes(needle) ||
+          list.items.some((item) => item.text.toLowerCase().includes(needle))),
+    );
 
-      const checklists = userLists.map((list) => ({
+    return NextResponse.json({
+      checklists: matches.map((list) => ({
         id: list.uuid,
         title: list.title,
-        category: list.category || "Uncategorized",
-        type: list.type || "simple",
+        category: list.category || UNCATEGORIZED,
+        type: list.type || ChecklistsTypes.SIMPLE,
         owner: list.owner,
         isShared: list.isShared ?? false,
-        items: list.items.map((item, index) =>
-          toApiItem(item, index, isKanbanType(list.type)),
-        ),
+        items: list.items.map((item, index) => toApiItem(item, index, isKanbanType(list.type))),
         createdAt: list.createdAt,
         updatedAt: list.updatedAt,
-      }));
-
-      return NextResponse.json({ checklists });
-    } catch (error) {
-      return NextResponse.json(
-        {
-          error:
-            error instanceof Error
-              ? error.message
-              : "Failed to fetch checklists",
-        },
-        { status: 500 },
-      );
-    }
-  });
-}
-
-export async function POST(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { title, category = "Uncategorized", type = "simple" } = body;
+      })),
+    });
+  },
+);
 
-      if (!title) {
-        return NextResponse.json(
-          { error: "Title is required" },
-          { status: 400 },
-        );
-      }
+export const POST = defineRoute(
+  {
+    id: "createChecklist",
+    method: HttpMethod.POST,
+    path: "/checklists",
+    tag: ApiTag.CHECKLISTS,
+    summary: "Create a checklist",
+    description: "Needs create permission on the target folder when it belongs to someone else.",
+    body: checklistCreateBody,
+    responses: {
+      200: { description: "Created checklist", schema: envelope(checklistSchema) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const formData = new FormData();
+    formData.append("title", body.title);
+    formData.append("category", body.category);
+    formData.append("type", body.type);
 
-      if (type !== ChecklistsTypes.SIMPLE && !isKanbanType(type)) {
-        return NextResponse.json(
-          { error: "Type must be 'simple' or 'kanban'" },
-          { status: 400 },
-        );
-      }
-
-      const formData = new FormData();
-      formData.append("title", title);
-      formData.append("category", category);
-      formData.append("type", type);
-
-      const result = await makeList(user, formData);
-
-      if (result.error || !result.data) {
-        console.error("Create list error:", result.error);
-        return NextResponse.json(
-          { error: result.error || "Failed to create checklist" },
-          { status: 400 },
-        );
-      }
+    const result = await makeList(user, formData);
+    if (result.error || !result.data) {
+      console.error("Create list error:", result.error);
+      return refuse(result.error || "Failed to create checklist", 400);
+    }
 
-      const transformedChecklist = {
-        id: result.data?.uuid,
-        title: result.data?.title,
-        category: result.data?.category || "Uncategorized",
-        type: result.data?.type || "simple",
+    return NextResponse.json({
+      success: true,
+      data: {
+        id: result.data.uuid,
+        title: result.data.title,
+        category: result.data.category || UNCATEGORIZED,
+        type: result.data.type || ChecklistsTypes.SIMPLE,
         items: [],
-        createdAt: result.data?.createdAt,
-        updatedAt: result.data?.updatedAt,
-      };
-
-      return NextResponse.json({ success: true, data: transformedChecklist });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        {
-          error:
-            error instanceof Error ? error.message : "Internal server error",
-        },
-        { status: 500 },
-      );
-    }
-  });
-}
+        createdAt: result.data.createdAt,
+        updatedAt: result.data.updatedAt,
+      },
+    });
+  },
+);
diff --git a/app/api/docs/route.ts b/app/api/docs/route.ts
index 5d26f13e8..747e271af 100644
--- a/app/api/docs/route.ts
+++ b/app/api/docs/route.ts
@@ -1,155 +1,64 @@
-import { NextRequest, NextResponse } from "next/server";
-import fs from "fs";
-import path from "path";
+import { NextResponse } from "next/server";
 import yaml from "js-yaml";
+import { z } from "zod";
 import { isEnvEnabled } from "@/app/_utils/env-utils";
+import { definePublicRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod, MediaType } from "@/app/_server/api/contract";
+import { apiSpec } from "@/app/_server/api/spec";
+import { ERRORS } from "@/app/_schemas/api/common";
 
 export const dynamic = "force-dynamic";
 
-function resolveFileRef(obj: unknown, baseDir: string): unknown {
-  if (typeof obj !== "object" || obj === null) {
-    return obj;
-  }
-
-  if (Array.isArray(obj)) {
-    return obj.map((item) => resolveFileRef(item, baseDir));
-  }
-
-  const record = obj as Record<string, unknown>;
-  const result: Record<string, unknown> = {};
-
-  for (const [key, value] of Object.entries(record)) {
-    if (key === "$ref" && typeof value === "string" && value.startsWith("./")) {
-      const refPath = path.resolve(baseDir, value);
-      if (fs.existsSync(refPath)) {
-        const content = fs.readFileSync(refPath, "utf8");
-        const loaded = yaml.load(content) as unknown;
-        const resolved = resolveFileRef(loaded, path.dirname(refPath));
-        if (
-          typeof resolved === "object" &&
-          resolved !== null &&
-          !Array.isArray(resolved)
-        ) {
-          Object.assign(result, resolved);
-        } else {
-          return resolved;
-        }
-      }
-    } else {
-      result[key] = resolveFileRef(value, baseDir);
-    }
-  }
-
-  return result;
-}
-
-function mergePaths(spec: Record<string, unknown>): Record<string, unknown> {
-  if (!spec.paths || typeof spec.paths !== "object") {
-    return spec;
-  }
-
-  const pathFiles = [
-    "./api/paths/health.yaml",
-    "./api/paths/search.yaml",
-    "./api/paths/checklists.yaml",
-    "./api/paths/notes.yaml",
-    "./api/paths/tasks.yaml",
-    "./api/paths/users.yaml",
-    "./api/paths/categories.yaml",
-    "./api/paths/summary.yaml",
-    "./api/paths/exports.yaml",
-    "./api/paths/admin.yaml",
-    "./api/paths/logs.yaml",
-  ];
-
-  const publicDir = path.join(process.cwd(), "public");
-  const mergedPaths: Record<string, unknown> = {};
-
-  for (const filePath of pathFiles) {
-    const fullPath = path.join(publicDir, filePath);
-    if (fs.existsSync(fullPath)) {
-      const content = fs.readFileSync(fullPath, "utf8");
-      const loaded = yaml.load(content) as Record<string, unknown>;
-      Object.assign(mergedPaths, loaded);
-    }
-  }
-
-  spec.paths = mergedPaths;
-  return spec;
+enum SpecFormat {
+  JSON = "json",
+  YAML = "yaml",
 }
 
-export async function OPTIONS(request: NextRequest) {
-  return new NextResponse(null, {
-    status: 200,
-    headers: {
-      "Access-Control-Allow-Origin": "*",
-      "Access-Control-Allow-Methods": "GET, OPTIONS",
-      "Access-Control-Allow-Headers": "Content-Type",
+const CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type",
+};
+
+const SPEC_HEADERS = { ...CORS_HEADERS, "Cache-Control": "public, max-age=300" };
+
+const _wantsYaml = (format: string | undefined, accept: string | null) =>
+  format
+    ? format === SpecFormat.YAML
+    : Boolean(accept?.includes(MediaType.YAML) || accept?.includes("text/yaml"));
+
+export const OPTIONS = async () =>
+  new NextResponse(null, { status: 200, headers: CORS_HEADERS });
+
+export const GET = definePublicRoute(
+  {
+    id: "getPublicApiDocs",
+    method: HttpMethod.GET,
+    path: "/docs",
+    tag: ApiTag.SYSTEM,
+    summary: "Get the public OpenAPI document",
+    description: "The same document as /openapi.json without an API key, for viewers such as Redoc. Answers 404 unless ENABLE_API_DOCS=true.",
+    query: z.object({
+      format: z.enum(SpecFormat).optional().describe("Defaults to JSON, or YAML when the Accept header asks for it"),
+    }),
+    responses: {
+      200: { description: "OpenAPI 3.1 document", schema: z.record(z.string(), z.unknown()) },
+      404: { description: "API docs are disabled on this instance", schema: ERRORS[404].schema },
     },
-  });
-}
-
-export async function GET(request: NextRequest) {
-  if (!isEnvEnabled(process.env.ENABLE_API_DOCS)) {
-    return NextResponse.json(
-      { error: "API docs not enabled" },
-      { status: 404 },
-    );
-  }
-
-  try {
-    const specPath = path.join(process.cwd(), "public", "openapi.yaml");
-    const specContent = fs.readFileSync(specPath, "utf8");
-    let spec = yaml.load(specContent) as Record<string, unknown>;
-
-    const publicDir = path.dirname(specPath);
-    spec = resolveFileRef(spec, publicDir) as Record<string, unknown>;
-    spec = mergePaths(spec);
-
-    const baseUrl = request.nextUrl.origin;
-
-    spec.servers = [
-      {
-        url: `${baseUrl}/api`,
-        description:
-          process.env.NODE_ENV === "production"
-            ? "Production server"
-            : "Development server",
-      },
-    ];
+  },
+  async ({ request, query }) => {
+    if (!isEnvEnabled(process.env.ENABLE_API_DOCS)) {
+      return refuse("API docs not enabled", 404);
+    }
 
-    const accept = request.headers.get("accept");
-    const format =
-      request.nextUrl.searchParams.get("format") ||
-      (accept?.includes("application/yaml") || accept?.includes("text/yaml")
-        ? "yaml"
-        : "json");
+    const spec = await apiSpec(request.nextUrl.origin);
 
-    if (format === "yaml") {
-      return new NextResponse(yaml.dump(spec), {
-        headers: {
-          "Content-Type": "application/yaml",
-          "Cache-Control": "public, max-age=300",
-          "Access-Control-Allow-Origin": "*",
-          "Access-Control-Allow-Methods": "GET, OPTIONS",
-          "Access-Control-Allow-Headers": "Content-Type",
-        },
+    if (_wantsYaml(query.format, request.headers.get("accept"))) {
+      return new NextResponse(yaml.dump(spec, { noRefs: true }), {
+        headers: { ...SPEC_HEADERS, "Content-Type": MediaType.YAML },
       });
     }
 
-    return NextResponse.json(spec, {
-      headers: {
-        "Cache-Control": "public, max-age=300",
-        "Access-Control-Allow-Origin": "*",
-        "Access-Control-Allow-Methods": "GET, OPTIONS",
-        "Access-Control-Allow-Headers": "Content-Type",
-      },
-    });
-  } catch (error) {
-    console.error("Failed to load API spec:", error);
-    return NextResponse.json(
-      { error: "Failed to load API spec" },
-      { status: 500 },
-    );
-  }
-}
+    return NextResponse.json(spec, { headers: SPEC_HEADERS });
+  },
+);
diff --git a/app/api/exports/[filename]/route.ts b/app/api/exports/[filename]/route.ts
index 9154e4faa..2b9a208ef 100644
--- a/app/api/exports/[filename]/route.ts
+++ b/app/api/exports/[filename]/route.ts
@@ -1,82 +1,80 @@
-import { NextRequest, NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import fs from "fs/promises";
 import path from "path";
 import { EXPORT_TEMP_DIR } from "@/app/_consts/files";
 import { resolvePath } from "@/app/_utils/path-utils";
-import {
-  ApiCaller,
-  seesAllContent,
-  whoGoesThere,
-} from "@/app/_utils/api-utils";
+import { ApiCaller, seesAllContent } from "@/app/_utils/api-utils";
+import { defineRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod, MediaType, RouteAuth } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { exportFileParams, zipFileSchema } from "@/app/_schemas/api/exports";
 
 export const dynamic = "force-dynamic";
 
 const OWN_EXPORT_SUFFIX = /^_content_\d+\.zip$/;
+const NOT_FOUND = "File not found or error during download.";
 
 const ownsExport = (username: string, filename: string): boolean =>
   filename.startsWith(username) &&
   OWN_EXPORT_SUFFIX.test(filename.slice(username.length));
 
-const mayDownload = async (
-  caller: ApiCaller,
-  filename: string,
-): Promise<boolean> =>
+const mayDownload = async (caller: ApiCaller, filename: string): Promise<boolean> =>
   ownsExport(caller.username, filename) || (await seesAllContent(caller));
 
-export async function GET(
-  request: NextRequest,
-  props: { params: Promise<{ filename: string }> },
-) {
-  const caller = await whoGoesThere(request);
-  if (!caller) {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  }
-
-  const params = await props.params;
-  const filename = params.filename;
+const _notFound = () => new NextResponse(NOT_FOUND, { status: 404 });
 
-  if (!(await mayDownload(caller, filename))) {
-    console.warn(`Export download refused for ${caller.username}: ${filename}`);
-    return new NextResponse("File not found or error during download.", {
-      status: 404,
-    });
+const _tidyTempDir = async (baseDir: string) => {
+  try {
+    if ((await fs.readdir(baseDir)).length === 0) await fs.rmdir(baseDir);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      console.log("Temporary export directory already removed or empty.");
+    } else {
+      console.error("Error cleaning up temp export directory:", error);
+    }
   }
+};
 
-  const baseDir = path.resolve(process.cwd(), EXPORT_TEMP_DIR);
-  const resolved = resolvePath(baseDir, filename);
-  if (!resolved.ok) {
-    return new NextResponse("File not found or error during download.", {
-      status: 404,
-    });
-  }
+export const GET = defineRoute(
+  {
+    id: "downloadExport",
+    method: HttpMethod.GET,
+    path: "/exports/{filename}",
+    tag: ApiTag.EXPORTS,
+    summary: "Download an export",
+    description: "Sends the zip once and deletes it. You can download your own user export. Admins with content access can download any. Also accepts the browser session cookie.",
+    params: exportFileParams,
+    responses: {
+      200: { description: "The zip", schema: zipFileSchema, mediaType: MediaType.ZIP },
+      401: ERRORS[401],
+      404: { description: "No such export, or not yours to download (plain text body)" },
+    },
+    auth: RouteAuth.SESSION_OR_KEY,
+  },
+  async ({ user: caller, params: { filename } }) => {
+    if (!(await mayDownload(caller, filename))) {
+      console.warn(`Export download refused for ${caller.username}: ${filename}`);
+      return _notFound();
+    }
 
-  try {
-    const fileBuffer = await fs.readFile(resolved.absolutePath);
-    const headers = new Headers();
-    headers.set("Content-Type", "application/zip");
-    headers.set("Content-Disposition", `attachment; filename="${filename}"`);
+    const baseDir = path.resolve(process.cwd(), EXPORT_TEMP_DIR);
+    const resolved = resolvePath(baseDir, filename);
+    if (!resolved.ok) return _notFound();
 
-    await fs.unlink(resolved.absolutePath);
     try {
-      const filesInDir = await fs.readdir(baseDir);
-      if (filesInDir.length === 0) {
-        await fs.rmdir(baseDir);
-      }
-    } catch (dirErr) {
-      if ((dirErr as NodeJS.ErrnoException).code === "ENOENT") {
-        console.log("Temporary export directory already removed or empty.");
-      } else {
-        console.error("Error cleaning up temp export directory:", dirErr);
-      }
-    }
+      const fileBuffer = await fs.readFile(resolved.absolutePath);
+      await fs.unlink(resolved.absolutePath);
+      await _tidyTempDir(baseDir);
 
-    return new NextResponse(new Blob([new Uint8Array(fileBuffer)]), {
-      headers,
-    });
-  } catch (error) {
-    console.error("Error serving exported file:", error);
-    return new NextResponse("File not found or error during download.", {
-      status: 404,
-    });
-  }
-}
+      return new NextResponse(new Blob([new Uint8Array(fileBuffer)]), {
+        headers: {
+          "Content-Type": MediaType.ZIP,
+          "Content-Disposition": `attachment; filename="${filename}"`,
+        },
+      });
+    } catch (error) {
+      console.error("Error serving exported file:", error);
+      return _notFound();
+    }
+  },
+);
diff --git a/app/api/exports/route.ts b/app/api/exports/route.ts
index 679eb1ee0..c3aed172a 100644
--- a/app/api/exports/route.ts
+++ b/app/api/exports/route.ts
@@ -1,118 +1,82 @@
-import { NextRequest, NextResponse } from "next/server";
-import { seesAllContent, withApiAuth } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { seesAllContent } from "@/app/_utils/api-utils";
 import {
-  exportAllChecklistsNotes,
-  exportUserChecklistsNotes,
-  exportAllUsersData,
-  exportWholeDataFolder,
-  getExportProgress,
-} from "@/app/_server/actions/export";
-import { getAppSettings } from "@/app/_server/actions/config";
-import { ExportType } from "@/app/_types";
+  buildAllContent,
+  buildUserContent,
+  readExportProgress,
+} from "@/app/_server/actions/export/builders";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import {
+  exportProgressSchema,
+  exportRequestBody,
+  exportStartedSchema,
+} from "@/app/_schemas/api/exports";
+import { ExportResult } from "@/app/_types";
+import { ExportKind } from "@/app/_types/export";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(
-  request: NextRequest,
-  _context: { params: Promise<Record<string, never>> }
-) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { type, username } = body;
-
-      if (!type) {
-        return NextResponse.json(
-          { error: "Export type is required" },
-          { status: 400 }
-        );
-      }
+const ADMIN_ONLY = "Forbidden: Admin access with content permissions required";
+const BROWSER_ONLY = "This export holds every user's credentials. Run it from the admin page while logged in";
 
-      const hasContentAccess = await seesAllContent(user);
+const SESSION_ONLY_EXPORTS = new Set<ExportKind>([ExportKind.ALL_USERS, ExportKind.WHOLE_DATA]);
 
-      let result;
-      switch (type as ExportType) {
-        case "all_checklists_notes":
-          if (!hasContentAccess) {
-            return NextResponse.json(
-              { error: "Forbidden: Admin access with content permissions required" },
-              { status: 403 }
-            );
-          }
-          result = await exportAllChecklistsNotes();
-          break;
-        case "user_checklists_notes":
-          if (!username) {
-            return NextResponse.json(
-              { error: "Username is required for user export" },
-              { status: 400 }
-            );
-          }
-          if (username !== user.username && !hasContentAccess) {
-            return NextResponse.json(
-              { error: "Forbidden: You can only export your own data" },
-              { status: 403 }
-            );
-          }
-          result = await exportUserChecklistsNotes(username);
-          break;
-        case "all_users_data":
-          if (!hasContentAccess) {
-            return NextResponse.json(
-              { error: "Forbidden: Admin access with content permissions required" },
-              { status: 403 }
-            );
-          }
-          result = await exportAllUsersData();
-          break;
-        case "whole_data_folder":
-          if (!hasContentAccess) {
-            return NextResponse.json(
-              { error: "Forbidden: Admin access with content permissions required" },
-              { status: 403 }
-            );
-          }
-          result = await exportWholeDataFolder();
-          break;
-        default:
-          return NextResponse.json(
-            { error: "Invalid export type" },
-            { status: 400 }
-          );
-      }
+export const POST = defineRoute(
+  {
+    id: "requestExport",
+    method: HttpMethod.POST,
+    path: "/exports",
+    tag: ApiTag.EXPORTS,
+    summary: "Start an export",
+    description: "Builds a zip and answers once it is ready with the path to download it from. Poll GET /exports from another request to follow progress. all_users_data and whole_data_folder contain every user's credentials, so they only run from the admin page in a logged-in browser and answer 403 here.",
+    body: exportRequestBody,
+    responses: {
+      200: { description: "Export ready", schema: exportStartedSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const hasContentAccess = await seesAllContent(user);
+    let result: ExportResult;
 
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || `Failed to export ${type}` },
-          { status: 500 }
-        );
+    if (body.type === ExportKind.USER_CONTENT) {
+      if (!body.username) return refuse("Username is required for user export", 400);
+      if (body.username !== user.username && !hasContentAccess) {
+        return refuse("Forbidden: You can only export your own data", 403);
       }
-
-      return NextResponse.json({
-        success: true,
-        downloadUrl: result.downloadUrl,
-      });
-    } catch (error) {
-      console.error("API Export Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 }
-      );
+      result = await buildUserContent(body.username);
+    } else {
+      if (!hasContentAccess) return refuse(ADMIN_ONLY, 403);
+      if (SESSION_ONLY_EXPORTS.has(body.type)) return refuse(BROWSER_ONLY, 403);
+      result = await buildAllContent();
     }
-  });
-}
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const progress = await getExportProgress();
-      return NextResponse.json(progress);
-    } catch (error) {
-      console.error("API Export Progress Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 }
-      );
+    if (!result.success) {
+      return refuse(result.error || `Failed to export ${body.type}`, 500);
     }
-  });
-}
+
+    return NextResponse.json({ success: true, downloadUrl: result.downloadUrl });
+  },
+);
+
+export const GET = defineRoute(
+  {
+    id: "getExportProgress",
+    method: HttpMethod.GET,
+    path: "/exports",
+    tag: ApiTag.EXPORTS,
+    summary: "Get export progress",
+    description: "Percentage and message of the latest export on this instance, whoever started it.",
+    responses: {
+      200: { description: "Progress", schema: exportProgressSchema },
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async () => NextResponse.json(readExportProgress()),
+);
diff --git a/app/api/health/route.ts b/app/api/health/route.ts
index 5d0d58107..26bd3f14d 100644
--- a/app/api/health/route.ts
+++ b/app/api/health/route.ts
@@ -1,39 +1,49 @@
 import { NextResponse } from "next/server";
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
 import { readPackageVersion } from "@/app/_server/actions/config";
+import { definePublicRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
 
 export const dynamic = "force-dynamic";
 
-export async function GET() {
-    try {
-        const versionResult = await readPackageVersion();
+enum HealthState {
+  HEALTHY = "healthy",
+  UNHEALTHY = "unhealthy",
+}
+
+const healthSchema = z
+  .object({
+    status: z.enum(HealthState),
+    version: z.string().nullable(),
+    timestamp: z.string(),
+    error: z.string().optional(),
+  })
+  .register(apiNames, { id: "Health" });
 
-        if (!versionResult.success) {
-            return NextResponse.json(
-                {
-                    status: "unhealthy",
-                    version: null,
-                    timestamp: new Date().toISOString(),
-                    error: versionResult.error
-                },
-                { status: 500 }
-            );
-        }
+export const GET = definePublicRoute(
+  {
+    id: "getHealth",
+    method: HttpMethod.GET,
+    path: "/health",
+    tag: ApiTag.SYSTEM,
+    summary: "Check instance health",
+    responses: {
+      200: { description: "Instance is up", schema: healthSchema },
+      500: { description: "Instance is unhealthy", schema: healthSchema },
+    },
+  },
+  async () => {
+    const version = await readPackageVersion();
+    const timestamp = new Date().toISOString();
 
-        return NextResponse.json({
-            status: "healthy",
-            version: versionResult.data,
-            timestamp: new Date().toISOString()
-        });
-    } catch (error) {
-        console.error("Health check API error:", error);
-        return NextResponse.json(
-            {
-                status: "unhealthy",
-                version: null,
-                timestamp: new Date().toISOString(),
-                error: "Internal server error"
-            },
-            { status: 500 }
-        );
+    if (!version.success) {
+      return NextResponse.json(
+        { status: HealthState.UNHEALTHY, version: null, timestamp, error: version.error },
+        { status: 500 },
+      );
     }
-}
+
+    return NextResponse.json({ status: HealthState.HEALTHY, version: version.data, timestamp });
+  },
+);
diff --git a/app/api/kanban/[boardId]/calendar/route.ts b/app/api/kanban/[boardId]/calendar/route.ts
index f46d33d34..3571f1b96 100644
--- a/app/api/kanban/[boardId]/calendar/route.ts
+++ b/app/api/kanban/[boardId]/calendar/route.ts
@@ -1,54 +1,50 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
-import {
-  generateICS,
-  parseItemsForCalendar,
-} from "@/app/_utils/kanban/calendar-utils";
-import { isKanbanType } from "@/app/_types/enums";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { defineRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod, MediaType } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { boardParams, calendarEventSchema } from "@/app/_schemas/api/kanban";
+import { generateICS, parseItemsForCalendar } from "@/app/_utils/kanban/calendar-utils";
+import { boardFor } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
+const _icsName = (title?: string) => encodeURIComponent(`${title || "board"}.ics`);
 
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
+export const GET = defineRoute(
+  {
+    id: "getBoardCalendar",
+    method: HttpMethod.GET,
+    path: "/kanban/{boardId}/calendar",
+    tag: ApiTag.KANBAN,
+    summary: "Get a board's cards as calendar events",
+    description: "Top-level, unarchived cards with a target date. Send `Accept: text/calendar` to download an .ics file instead of JSON.",
+    params: boardParams,
+    responses: {
+      200: {
+        description: "Calendar events, or an iCalendar file when Accept asks for text/calendar",
+        schema: z.object({ events: z.array(calendarEventSchema) }),
+        alternatives: [{ mediaType: MediaType.CALENDAR }],
+      },
+      400: { description: "Not a kanban board", schema: ERRORS[400].schema },
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username);
+    if (refused) return refused;
 
-      const accept = request.headers.get("accept") || "";
-
-      if (accept.includes("text/calendar")) {
-        const ics = generateICS(board.items, board.title || "Kanban");
-        return new NextResponse(ics, {
-          headers: {
-            "Content-Type": "text/calendar; charset=utf-8",
-            "Content-Disposition": `attachment; filename="${board.title || "board"}.ics"`,
-          },
-        });
-      }
-
-      const events = parseItemsForCalendar(board.items);
-      return NextResponse.json({ events });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+    if ((request.headers.get("accept") || "").includes(MediaType.CALENDAR)) {
+      return new NextResponse(generateICS(board.items, board.title || "Kanban"), {
+        headers: {
+          "Content-Type": `${MediaType.CALENDAR}; charset=utf-8`,
+          "Content-Disposition": `attachment; filename="board.ics"; filename*=UTF-8''${_icsName(board.title)}`,
+        },
+      });
     }
-  });
-}
+
+    return NextResponse.json({ events: parseItemsForCalendar(board.items) });
+  },
+);
diff --git a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
index a20b0b8fa..00fd95dd2 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
@@ -1,52 +1,40 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
 import { assignItem } from "@/app/_server/actions/kanban/tweaker";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, cardAssignBody, cardParams, storedBoardSchema } from "@/app/_schemas/api/kanban";
+import { boardFor } from "@/app/_utils/kanban/api-board";
+import { PermissionTypes } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string; itemId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { assignee } = body;
+export const PUT = defineRoute(
+  {
+    id: "assignBoardItem",
+    method: HttpMethod.PUT,
+    path: "/kanban/{boardId}/items/{itemId}/assign",
+    tag: ApiTag.KANBAN,
+    summary: "Assign a card",
+    description: "The assignee has to be a user who can see the board. Assigning someone other than the key owner sends them a notification. An empty or missing assignee clears it. Needs edit permission.",
+    params: cardParams,
+    body: cardAssignBody,
+    responses: {
+      200: { description: "The board after the change", schema: envelope(storedBoardSchema) },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.EDIT, itemId: params.itemId });
+    if (refused) return refused;
 
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
+    const result = await assignItem(user, board.uuid, params.itemId, body.assignee || "");
+    if (result.error) return refuse(result.error, 400);
 
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
-
-      const result = await assignItem(
-        user,
-        board.uuid!,
-        params.itemId,
-        assignee || "",
-      );
-
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
-
-      return NextResponse.json({ success: true, data: result.data });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+    return NextResponse.json({ success: true, data: result.data });
+  },
+);
diff --git a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
index b3ece54af..5a1639a78 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
@@ -1,96 +1,69 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { PermissionTypes } from "@/app/_types/enums";
 import { remindItem } from "@/app/_server/actions/kanban/tweaker";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, cardParams, cardReminderBody, storedBoardSchema } from "@/app/_schemas/api/kanban";
+import { boardFor } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string; itemId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { datetime } = body;
+export const PUT = defineRoute(
+  {
+    id: "setBoardItemReminder",
+    method: HttpMethod.PUT,
+    path: "/kanban/{boardId}/items/{itemId}/reminder",
+    tag: ApiTag.KANBAN,
+    summary: "Set a card reminder",
+    description: "Replaces any existing reminder and re-arms it to fire once at the new time. Needs edit permission.",
+    params: cardParams,
+    body: cardReminderBody,
+    responses: {
+      200: { description: "The board after the change", schema: envelope(storedBoardSchema) },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.EDIT, itemId: params.itemId });
+    if (refused) return refused;
 
-      if (!datetime) {
-        return NextResponse.json(
-          { error: "Datetime is required" },
-          { status: 400 },
-        );
-      }
+    const result = await remindItem(user, board.uuid, params.itemId, JSON.stringify({ datetime: body.datetime }));
+    if (result.error) return refuse(result.error, 400);
 
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
+    return NextResponse.json({ success: true, data: result.data });
+  },
+);
 
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
+export const DELETE = defineRoute(
+  {
+    id: "clearBoardItemReminder",
+    method: HttpMethod.DELETE,
+    path: "/kanban/{boardId}/items/{itemId}/reminder",
+    tag: ApiTag.KANBAN,
+    summary: "Clear a card reminder",
+    description: "Needs edit permission.",
+    params: cardParams,
+    responses: {
+      200: { description: "Cleared", schema: okSchema },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.EDIT, itemId: params.itemId });
+    if (refused) return refused;
 
-      const result = await remindItem(
-        user,
-        board.uuid!,
-        params.itemId,
-        JSON.stringify({ datetime }),
-      );
+    const result = await remindItem(user, board.uuid, params.itemId, "");
+    if (result.error) return refuse(result.error, 400);
 
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
-
-      return NextResponse.json({ success: true, data: result.data });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
-
-export async function DELETE(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string; itemId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
-
-      const result = await remindItem(user, board.uuid!, params.itemId, "");
-
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
-
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/kanban/[boardId]/items/[itemId]/route.ts b/app/api/kanban/[boardId]/items/[itemId]/route.ts
index bdd3bfe5e..a5c0da283 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/route.ts
@@ -1,100 +1,78 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { PermissionTypes } from "@/app/_types/enums";
 import { removeItem } from "@/app/_server/actions/checklist-item/remover";
 import { editItem } from "@/app/_server/actions/checklist-item/editor";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, cardParams, cardUpdateBody, storedBoardSchema } from "@/app/_schemas/api/kanban";
+import { boardFor } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string; itemId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { text, priority, score, assignee, reminder } = body;
+export const PUT = defineRoute(
+  {
+    id: "updateBoardItem",
+    method: HttpMethod.PUT,
+    path: "/kanban/{boardId}/items/{itemId}",
+    tag: ApiTag.KANBAN,
+    summary: "Update a card",
+    description: "Fields left out keep their current value. Assigning someone else notifies them. Use the status route to move a card between columns. Needs edit permission.",
+    params: cardParams,
+    body: cardUpdateBody,
+    responses: {
+      200: { description: "The board after the change", schema: envelope(storedBoardSchema) },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.EDIT, itemId: params.itemId });
+    if (refused) return refused;
 
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
+    const formData = new FormData();
+    formData.append("itemId", params.itemId);
+    if (body.text !== undefined) formData.append("text", body.text);
+    if (body.priority !== undefined) formData.append("priority", body.priority);
+    if (body.score !== undefined) formData.append("score", String(body.score));
+    if (body.assignee !== undefined) formData.append("assignee", body.assignee);
+    if (body.reminder !== undefined) formData.append("reminder", JSON.stringify(body.reminder));
 
-      if (board.type !== "kanban" && board.type !== "task") {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
+    const result = await editItem(user, board, formData);
+    if (!result.success) return refuse(result.error || "Failed to update item", 400);
 
-      const formData = new FormData();
-      formData.append("itemId", params.itemId);
-      if (text !== undefined) formData.append("text", text);
-      if (priority !== undefined) formData.append("priority", priority);
-      if (score !== undefined) formData.append("score", String(score));
-      if (assignee !== undefined) formData.append("assignee", assignee);
-      if (reminder !== undefined)
-        formData.append("reminder", JSON.stringify(reminder));
+    return NextResponse.json({ success: true, data: result.data });
+  },
+);
 
-      const result = await editItem(user, board, formData);
+export const DELETE = defineRoute(
+  {
+    id: "deleteBoardItem",
+    method: HttpMethod.DELETE,
+    path: "/kanban/{boardId}/items/{itemId}",
+    tag: ApiTag.KANBAN,
+    summary: "Delete a card",
+    description: "Removes the card and its sub-cards. Needs delete permission on the board. Edit alone is refused with 400. An unknown card id succeeds without changing anything.",
+    params: cardParams,
+    responses: {
+      200: { description: "Deleted", schema: okSchema },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.DELETE, itemId: params.itemId });
+    if (refused) return refused;
 
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to update item" },
-          { status: 400 },
-        );
-      }
+    const result = await removeItem(user, board.uuid, params.itemId);
+    if (!result.success) return refuse(result.error || "Failed to delete item", 400);
 
-      return NextResponse.json({ success: true, data: result.data });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
-
-export async function DELETE(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string; itemId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
-
-      const result = await removeItem(user, board.uuid!, params.itemId);
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to delete item" },
-          { status: 400 },
-        );
-      }
-
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/kanban/[boardId]/items/[itemId]/status/route.ts b/app/api/kanban/[boardId]/items/[itemId]/status/route.ts
index 5f8f58f91..48c396fb6 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/status/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/status/route.ts
@@ -1,62 +1,45 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { PermissionTypes } from "@/app/_types/enums";
 import { stampStatus } from "@/app/_server/actions/checklist-item/stamper";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, cardParams, cardStatusBody, storedBoardSchema } from "@/app/_schemas/api/kanban";
+import { boardFor } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string; itemId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { status } = body;
-
-      if (!status) {
-        return NextResponse.json(
-          { error: "Status is required" },
-          { status: 400 },
-        );
-      }
-
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
-
-      const formData = new FormData();
-      formData.append("uuid", board.uuid!);
-      formData.append("itemId", params.itemId);
-      formData.append("status", status);
-
-      const result = await stampStatus(user, formData);
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to update status" },
-          { status: 400 },
-        );
-      }
-
-      return NextResponse.json({ success: true, data: result.data });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+export const PUT = defineRoute(
+  {
+    id: "moveBoardItem",
+    method: HttpMethod.PUT,
+    path: "/kanban/{boardId}/items/{itemId}/status",
+    tag: ApiTag.KANBAN,
+    summary: "Move a card to another column",
+    description: "Records the change in the card's history. Moving into a column with autoComplete marks the card completed. Needs edit permission.",
+    params: cardParams,
+    body: cardStatusBody,
+    responses: {
+      200: { description: "The board after the change", schema: envelope(storedBoardSchema) },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.EDIT, itemId: params.itemId });
+    if (refused) return refused;
+
+    const formData = new FormData();
+    formData.append("uuid", board.uuid);
+    formData.append("itemId", params.itemId);
+    formData.append("status", body.status);
+
+    const result = await stampStatus(user, formData);
+    if (!result.success) return refuse(result.error || "Failed to update status", 400);
+
+    return NextResponse.json({ success: true, data: result.data });
+  },
+);
diff --git a/app/api/kanban/[boardId]/items/route.ts b/app/api/kanban/[boardId]/items/route.ts
index f681b069d..7ed0a2055 100644
--- a/app/api/kanban/[boardId]/items/route.ts
+++ b/app/api/kanban/[boardId]/items/route.ts
@@ -1,65 +1,47 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { PermissionTypes } from "@/app/_types/enums";
 import { addItem } from "@/app/_server/actions/checklist-item/editor";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, boardParams, cardCreateBody, storedCardSchema } from "@/app/_schemas/api/kanban";
+import { boardFor } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { text, status, description } = body;
-
-      if (!text) {
-        return NextResponse.json(
-          { error: "Text is required" },
-          { status: 400 },
-        );
-      }
-
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
-
-      const formData = new FormData();
-      formData.append("text", text);
-      if (status) formData.append("status", status);
-      if (description) formData.append("description", description);
-
-      const result = await addItem(user, board, formData);
-
-      if (!result.success || !result.data) {
-        return NextResponse.json(
-          { error: result.error || "Failed to create item" },
-          { status: 400 },
-        );
-      }
-
-      return NextResponse.json({ success: true, data: result.data });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        {
-          error:
-            error instanceof Error ? error.message : "Internal server error",
-        },
-        { status: 500 },
-      );
+export const POST = defineRoute(
+  {
+    id: "createBoardItem",
+    method: HttpMethod.POST,
+    path: "/kanban/{boardId}/items",
+    tag: ApiTag.KANBAN,
+    summary: "Add a card to a board",
+    description: "Lands at the top or bottom depending on the key owner's insertion setting. On a shared board the card is assigned to its creator. Needs edit permission.",
+    params: boardParams,
+    body: cardCreateBody,
+    responses: {
+      200: { description: "The new card", schema: envelope(storedCardSchema) },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.EDIT });
+    if (refused) return refused;
+
+    const formData = new FormData();
+    formData.append("text", body.text);
+    if (body.status) formData.append("status", body.status);
+    if (body.description) formData.append("description", body.description);
+
+    const result = await addItem(user, board, formData);
+    if (!result.success || !result.data) {
+      return refuse(result.error || "Failed to create item", 400);
     }
-  });
-}
+
+    return NextResponse.json({ success: true, data: result.data });
+  },
+);
diff --git a/app/api/kanban/[boardId]/route.ts b/app/api/kanban/[boardId]/route.ts
index f5e1d04cb..a20fbfa3f 100644
--- a/app/api/kanban/[boardId]/route.ts
+++ b/app/api/kanban/[boardId]/route.ts
@@ -1,123 +1,108 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { PermissionTypes } from "@/app/_types/enums";
+import { z } from "zod";
 import { dropList, editList } from "@/app/_server/actions/checklist/editor";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, boardParams, boardSchema, boardUpdateBody } from "@/app/_schemas/api/kanban";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
 import { transformBoard } from "@/app/_utils/kanban/api-transforms";
+import { boardFor } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
+export const GET = defineRoute(
+  {
+    id: "getBoard",
+    method: HttpMethod.GET,
+    path: "/kanban/{boardId}",
+    tag: ApiTag.KANBAN,
+    summary: "Get a Kanban board",
+    description: "Also returns boards shared with the API key owner.",
+    params: boardParams,
+    responses: {
+      200: { description: "The board", schema: z.object({ board: boardSchema }) },
+      400: { description: "Not a kanban board", schema: ERRORS[400].schema },
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username);
+    if (refused) return refused;
 
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
+    return NextResponse.json({ board: transformBoard(board) });
+  },
+);
 
-      return NextResponse.json({ board: transformBoard(board) });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+export const PUT = defineRoute(
+  {
+    id: "updateBoard",
+    method: HttpMethod.PUT,
+    path: "/kanban/{boardId}",
+    tag: ApiTag.KANBAN,
+    summary: "Rename or move a Kanban board",
+    description: "Fields left out keep their current value. Needs edit permission, and moving to another folder also needs delete on the board. A refused change answers 400.",
+    params: boardParams,
+    body: boardUpdateBody,
+    responses: {
+      200: { description: "Updated board", schema: z.object({ success: z.literal(true), data: boardSchema.nullable() }) },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.EDIT });
+    if (refused) return refused;
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { title, category } = body;
+    const formData = new FormData();
+    formData.append("uuid", board.uuid);
+    formData.append("title", body.title ?? board.title);
+    formData.append("category", body.category ?? board.category ?? UNCATEGORIZED);
 
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
+    const result = await editList(user, formData);
+    if (result.error) return refuse(result.error, 400);
 
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
+    return NextResponse.json({
+      success: true,
+      data: result.data ? transformBoard(result.data) : null,
+    });
+  },
+);
 
-      const formData = new FormData();
-      formData.append("uuid", board.uuid!);
-      formData.append("title", title ?? board.title);
-      formData.append(
-        "category",
-        category ?? board.category ?? "Uncategorized",
-      );
-      const result = await editList(user, formData);
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
+export const DELETE = defineRoute(
+  {
+    id: "deleteBoard",
+    method: HttpMethod.DELETE,
+    path: "/kanban/{boardId}",
+    tag: ApiTag.KANBAN,
+    summary: "Delete a Kanban board",
+    description: "Needs delete permission on the board. Edit alone is not enough. A refused delete answers 400.",
+    params: boardParams,
+    responses: {
+      200: { description: "Deleted", schema: okSchema },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.DELETE });
+    if (refused) return refused;
 
-      return NextResponse.json({ success: true, data: result.data ? transformBoard(result.data) : null });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+    const formData = new FormData();
+    formData.append("uuid", board.uuid);
 
-export async function DELETE(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
+    const result = await dropList(user, formData);
+    if (result.error) return refuse(result.error, 400);
 
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
-
-      const formData = new FormData();
-      formData.append("uuid", board.uuid!);
-      const result = await dropList(user, formData);
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
-
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/kanban/[boardId]/statuses/route.ts b/app/api/kanban/[boardId]/statuses/route.ts
index 5dc877fd1..0eca2d43f 100644
--- a/app/api/kanban/[boardId]/statuses/route.ts
+++ b/app/api/kanban/[boardId]/statuses/route.ts
@@ -1,54 +1,40 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { PermissionTypes } from "@/app/_types/enums";
 import { restatus } from "@/app/_server/actions/checklist/restatus";
-import { getListById } from "@/app/_server/actions/checklist/queries";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, boardParams, statusesBody, storedBoardSchema } from "@/app/_schemas/api/kanban";
+import { boardFor } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ boardId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { statuses } = body;
-
-      if (!statuses || !Array.isArray(statuses)) {
-        return NextResponse.json(
-          { error: "Statuses array is required" },
-          { status: 400 },
-        );
-      }
-
-      const uuid = await listUuid(request, params.boardId, user.username);
-      const board = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!board) {
-        return NextResponse.json({ error: "Board not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(board.type)) {
-        return NextResponse.json(
-          { error: "Not a kanban board" },
-          { status: 400 },
-        );
-      }
-
-      const result = await restatus(user, board.uuid!, () => statuses);
-
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
-
-      return NextResponse.json({ success: true, data: result.data });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+export const PUT = defineRoute(
+  {
+    id: "setBoardStatuses",
+    method: HttpMethod.PUT,
+    path: "/kanban/{boardId}/statuses",
+    tag: ApiTag.KANBAN,
+    summary: "Replace a board's columns",
+    description: "Send the whole column list. Cards in a column you leave out move to the lowest-order column and get a history entry. Needs edit permission.",
+    params: boardParams,
+    body: statusesBody,
+    responses: {
+      200: { description: "The board after the change", schema: envelope(storedBoardSchema) },
+      400: BOARD_REFUSED,
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const { board, refused } = await boardFor(request, params.boardId, user.username, { permission: PermissionTypes.EDIT });
+    if (refused) return refused;
+
+    const result = await restatus(user, board.uuid, () => body.statuses);
+    if (result.error) return refuse(result.error, 400);
+
+    return NextResponse.json({ success: true, data: result.data });
+  },
+);
diff --git a/app/api/kanban/route.ts b/app/api/kanban/route.ts
index 5abaed834..df3b8b5b8 100644
--- a/app/api/kanban/route.ts
+++ b/app/api/kanban/route.ts
@@ -1,111 +1,82 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { z } from "zod";
 import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { makeList } from "@/app/_server/actions/checklist/creator";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { boardCreateBody, boardListQuery, boardSchema } from "@/app/_schemas/api/kanban";
+import { ChecklistsTypes, isKanbanType } from "@/app/_types/enums";
 import { Checklist, Result } from "@/app/_types";
 import { transformBoard } from "@/app/_utils/kanban/api-transforms";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const { searchParams } = new URL(request.url);
-      const category = searchParams.get("category");
-      const status = searchParams.get("status");
-      const search = searchParams.get("q");
-
-      const lists = (await getUserChecklists({
-        username: user.username,
-      })) as Result<Checklist[]>;
-      if (!lists.success || !lists.data) {
-        return NextResponse.json(
-          { error: lists.error || "Failed to fetch boards" },
-          { status: 500 },
-        );
-      }
-
-      let boards = lists.data.filter(
-        (list) => list.owner === user.username && isKanbanType(list.type),
-      );
-
-      if (category) {
-        boards = boards.filter((list) => list.category === category);
-      }
-      if (status) {
-        boards = boards.filter((list) =>
-          list.items.some((item) => item.status === status),
-        );
-      }
-      if (search) {
-        const searchLower = search.toLowerCase();
-        boards = boards.filter(
-          (list) =>
-            list.title?.toLowerCase().includes(searchLower) ||
-            list.items.some((item) =>
-              item.text.toLowerCase().includes(searchLower),
-            ),
-        );
-      }
-
-      const data = boards.map((list) => transformBoard(list));
-
-      return NextResponse.json({ boards: data });
-    } catch (error) {
-      return NextResponse.json(
-        {
-          error:
-            error instanceof Error ? error.message : "Failed to fetch boards",
-        },
-        { status: 500 },
-      );
+export const GET = defineRoute(
+  {
+    id: "listBoards",
+    method: HttpMethod.GET,
+    path: "/kanban",
+    tag: ApiTag.KANBAN,
+    summary: "List Kanban boards",
+    description: "Boards the API key owner owns. Boards shared with them are left out, but GET /kanban/{boardId} returns them.",
+    query: boardListQuery,
+    responses: {
+      200: { description: "Boards", schema: z.object({ boards: z.array(boardSchema) }) },
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    const lists = (await getUserChecklists({ username: user.username })) as Result<Checklist[]>;
+    if (!lists.success || !lists.data) {
+      return refuse(lists.error || "Failed to fetch boards", 500);
     }
-  });
-}
 
-export async function POST(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { title, category = "Uncategorized", statuses } = body;
+    const needle = query.q?.toLowerCase();
+    const boards = lists.data.filter(
+      (list) =>
+        list.owner === user.username &&
+        isKanbanType(list.type) &&
+        (!query.category || list.category === query.category) &&
+        (!query.status || list.items.some((item) => item.status === query.status)) &&
+        (!needle ||
+          list.title?.toLowerCase().includes(needle) ||
+          list.items.some((item) => item.text.toLowerCase().includes(needle))),
+    );
 
-      if (!title) {
-        return NextResponse.json(
-          { error: "Title is required" },
-          { status: 400 },
-        );
-      }
+    return NextResponse.json({ boards: boards.map((list) => transformBoard(list)) });
+  },
+);
 
-      const formData = new FormData();
-      formData.append("title", title);
-      formData.append("category", category);
-      formData.append("type", "kanban");
+export const POST = defineRoute(
+  {
+    id: "createBoard",
+    method: HttpMethod.POST,
+    path: "/kanban",
+    tag: ApiTag.KANBAN,
+    summary: "Create a Kanban board",
+    description: "Needs create permission on the target folder, which a shared folder may not grant.",
+    body: boardCreateBody,
+    responses: {
+      200: { description: "Created board", schema: envelope(boardSchema) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const formData = new FormData();
+    formData.append("title", body.title);
+    formData.append("category", body.category);
+    formData.append("type", ChecklistsTypes.KANBAN);
 
-      if (statuses) {
-        formData.append("statuses", JSON.stringify(statuses));
-      }
-
-      const result = await makeList(user, formData);
-
-      if (result.error || !result.data) {
-        console.error("Create board error:", result.error);
-        return NextResponse.json(
-          { error: result.error || "Failed to create board" },
-          { status: 400 },
-        );
-      }
-
-      return NextResponse.json({ success: true, data: transformBoard(result.data) });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        {
-          error:
-            error instanceof Error ? error.message : "Internal server error",
-        },
-        { status: 500 },
-      );
+    const result = await makeList(user, formData, body.statuses);
+    if (result.error || !result.data) {
+      console.error("Create board error:", result.error);
+      return refuse(result.error || "Failed to create board", 400);
     }
-  });
-}
+
+    return NextResponse.json({ success: true, data: transformBoard(result.data) });
+  },
+);
diff --git a/app/api/logs/cleanup/route.ts b/app/api/logs/cleanup/route.ts
index 5940c035e..3a2b10eff 100644
--- a/app/api/logs/cleanup/route.ts
+++ b/app/api/logs/cleanup/route.ts
@@ -1,27 +1,29 @@
-import { NextRequest, NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import { cleanupOldLogs } from "@/app/_server/actions/log";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { cleanupSchema } from "@/app/_schemas/api/logs";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      if (!user.isAdmin) {
-        return NextResponse.json(
-          { error: "Admin access required" },
-          { status: 403 }
-        );
-      }
-
-      const result = await cleanupOldLogs();
-
-      return NextResponse.json(result);
-    } catch (error: any) {
-      return NextResponse.json(
-        { error: error.message || "Cleanup failed" },
-        { status: 500 }
-      );
-    }
-  });
-}
+export const POST = defineRoute(
+  {
+    id: "cleanupLogs",
+    method: HttpMethod.POST,
+    path: "/logs/cleanup",
+    tag: ApiTag.LOGS,
+    summary: "Delete old audit logs",
+    description: "Admin only. Deletes log files older than the instance's retention setting. Does nothing when retention is unlimited.",
+    responses: {
+      200: { description: "Cleanup result", schema: cleanupSchema },
+      401: ERRORS[401],
+      403: ERRORS[403],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user }) => {
+    if (!user.isAdmin) return refuse("Admin access required", 403);
+    return NextResponse.json(await cleanupOldLogs());
+  },
+);
diff --git a/app/api/logs/export/route.ts b/app/api/logs/export/route.ts
index 18d8bc000..48f376a68 100644
--- a/app/api/logs/export/route.ts
+++ b/app/api/logs/export/route.ts
@@ -1,163 +1,82 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
-import { getDailyLogPath, getDateRange } from "@/app/_server/actions/log";
-import { readJsonFile } from "@/app/_server/actions/file";
-import { USERS_FILE } from "@/app/_consts/files";
+import { NextResponse } from "next/server";
+import { digUpLogs, everyUsername, sieveLogs } from "@/app/_server/actions/lib/audit-trail";
+import { defineRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod, MediaType } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { LogExportFormat, logExportBody, logFileSchema } from "@/app/_schemas/api/logs";
 import { AuditLogEntry } from "@/app/_types";
-import fs from "fs/promises";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { format, filters = {} } = body;
-
-      if (!format || !["json", "csv"].includes(format)) {
-        return NextResponse.json(
-          { error: "Invalid format. Must be 'json' or 'csv'" },
-          { status: 400 }
-        );
-      }
-
-      const restrictedFilters = { ...filters };
-
-      if (!user.isAdmin) {
-        restrictedFilters.username = user.username;
-      }
-
-      let allLogs: AuditLogEntry[] = [];
-
-      const endDate = restrictedFilters.endDate ? new Date(restrictedFilters.endDate) : new Date();
-      const startDate = restrictedFilters.startDate
-        ? new Date(restrictedFilters.startDate)
-        : new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1000);
-
-      const dates = await getDateRange(startDate, endDate);
-
-      if (user.isAdmin && !restrictedFilters.username) {
-        const users: any[] = await readJsonFile(USERS_FILE);
-
-        for (const u of users) {
-          for (const date of dates) {
-            const logPath = await getDailyLogPath(u.username, date);
-
-            try {
-              const content = await fs.readFile(logPath, "utf-8");
-              const dailyLogs: AuditLogEntry[] = JSON.parse(content);
-              allLogs = allLogs.concat(dailyLogs);
-            } catch (error) {
-              continue;
-            }
-          }
-        }
-      } else {
-        const targetUsername =
-          user.isAdmin && restrictedFilters.username ? restrictedFilters.username : user.username;
-
-        for (const date of dates) {
-          const logPath = await getDailyLogPath(targetUsername, date);
-
-          try {
-            const content = await fs.readFile(logPath, "utf-8");
-            const dailyLogs: AuditLogEntry[] = JSON.parse(content);
-            allLogs = allLogs.concat(dailyLogs);
-          } catch (error) {
-            continue;
-          }
-        }
-      }
-
-      let filteredLogs = allLogs;
-
-      if (restrictedFilters.action) {
-        filteredLogs = filteredLogs.filter((log) => log.action === restrictedFilters.action);
-      }
-
-      if (restrictedFilters.category) {
-        filteredLogs = filteredLogs.filter(
-          (log) => log.category === restrictedFilters.category
-        );
-      }
-
-      if (restrictedFilters.level) {
-        filteredLogs = filteredLogs.filter((log) => log.level === restrictedFilters.level);
-      }
-
-      if (restrictedFilters.success !== undefined) {
-        filteredLogs = filteredLogs.filter(
-          (log) => log.success === restrictedFilters.success
-        );
-      }
-
-      filteredLogs.sort(
-        (a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
-      );
-
-      if (restrictedFilters.limit) {
-        filteredLogs = filteredLogs.slice(0, restrictedFilters.limit);
-      }
-
-      let exportData: string;
-      let contentType: string;
-
-      if (format === "json") {
-        exportData = JSON.stringify(filteredLogs, null, 2);
-        contentType = "application/json";
-      } else {
-        const headers = [
-          "Timestamp",
-          "Level",
-          "Username",
-          "Action",
-          "Category",
-          "Resource Type",
-          "Resource ID",
-          "Resource Title",
-          "Success",
-          "IP Address",
-          "Error Message",
-        ];
-
-        const csvRows = [
-          headers.join(","),
-          ...filteredLogs.map((log) =>
-            [
-              log.timestamp,
-              log.level,
-              log.username,
-              log.action,
-              log.category,
-              log.resourceType || "",
-              log.resourceId || "",
-              log.resourceTitle || "",
-              log.success,
-              log.ipAddress,
-              log.errorMessage || "",
-            ]
-              .map((field) => `"${String(field).replace(/"/g, '""')}"`)
-              .join(",")
-          ),
-        ];
-
-        exportData = csvRows.join("\n");
-        contentType = "text/csv";
-      }
-
-      const filename = `audit-logs-${Date.now()}.${format}`;
-
-      return new NextResponse(exportData, {
-        headers: {
-          "Content-Type": contentType,
-          "Content-Disposition": `attachment; filename="${filename}"`,
-        },
-      });
-    } catch (error: any) {
-      return NextResponse.json(
-        { error: error.message || "Export failed" },
-        { status: 500 }
-      );
-    }
-  });
-}
+const CSV_HEADERS = [
+  "Timestamp",
+  "Level",
+  "Username",
+  "Action",
+  "Category",
+  "Resource Type",
+  "Resource ID",
+  "Resource Title",
+  "Success",
+  "IP Address",
+  "Error Message",
+];
+
+const _csvCell = (field: unknown) => `"${String(field).replace(/"/g, '""')}"`;
+
+const _toCsv = (logs: AuditLogEntry[]) =>
+  [
+    CSV_HEADERS.join(","),
+    ...logs.map((log) =>
+      [
+        log.timestamp,
+        log.level,
+        log.username,
+        log.action,
+        log.category,
+        log.resourceType || "",
+        log.resourceId || "",
+        log.resourceTitle || "",
+        log.success,
+        log.ipAddress,
+        log.errorMessage || "",
+      ]
+        .map(_csvCell)
+        .join(","),
+    ),
+  ].join("\n");
+
+export const POST = defineRoute(
+  {
+    id: "exportLogs",
+    method: HttpMethod.POST,
+    path: "/logs/export",
+    tag: ApiTag.LOGS,
+    summary: "Download audit log entries",
+    description: "Sends matching entries as a JSON or CSV attachment, newest first. You export your own entries. Admins can export everybody's, or one user's with username.",
+    body: logExportBody,
+    responses: {
+      200: { description: "JSON array of entries, or CSV when format is csv", schema: logFileSchema, alternatives: [{ mediaType: MediaType.CSV }] },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const filters = { ...body.filters, username: user.isAdmin ? body.filters.username : user.username };
+    const usernames = filters.username ? [filters.username] : await everyUsername();
+
+    const matches = sieveLogs(await digUpLogs(usernames, filters), filters);
+    const logs = filters.limit ? matches.slice(0, filters.limit) : matches;
+
+    const isJson = body.format === LogExportFormat.JSON;
+    const filename = `audit-logs-${Date.now()}.${body.format}`;
+
+    return new NextResponse(isJson ? JSON.stringify(logs, null, 2) : _toCsv(logs), {
+      headers: {
+        "Content-Type": isJson ? MediaType.JSON : MediaType.CSV,
+        "Content-Disposition": `attachment; filename="${filename}"`,
+      },
+    });
+  },
+);
diff --git a/app/api/logs/route.ts b/app/api/logs/route.ts
index 539a29187..31ca4fc4f 100644
--- a/app/api/logs/route.ts
+++ b/app/api/logs/route.ts
@@ -1,126 +1,44 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
-import { getDailyLogPath, getDateRange } from "@/app/_server/actions/log";
-import { readJsonFile } from "@/app/_server/actions/file";
-import { USERS_FILE } from "@/app/_consts/files";
-import { AuditLogEntry } from "@/app/_types";
-import fs from "fs/promises";
+import { NextResponse } from "next/server";
+import { digUpLogs, everyUsername, sieveLogs } from "@/app/_server/actions/lib/audit-trail";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { logListQuery, logPageSchema } from "@/app/_schemas/api/logs";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const searchParams = request.nextUrl.searchParams;
-
-      const filters = {
-        username: searchParams.get("username") || undefined,
-        action: searchParams.get("action") as any,
-        category: searchParams.get("category") as any,
-        level: searchParams.get("level") as any,
-        startDate: searchParams.get("startDate") || undefined,
-        endDate: searchParams.get("endDate") || undefined,
-        success:
-          searchParams.get("success") === "true"
-            ? true
-            : searchParams.get("success") === "false"
-              ? false
-              : undefined,
-        limit: parseInt(searchParams.get("limit") || "50"),
-        offset: parseInt(searchParams.get("offset") || "0"),
-      };
-
-      if (!user.isAdmin && filters.username && filters.username !== user.username) {
-        return NextResponse.json(
-          { error: "Forbidden: You can only view your own logs" },
-          { status: 403 }
-        );
-      }
-
-      if (!user.isAdmin && !filters.username) {
-        filters.username = user.username;
-      }
-      let allLogs: AuditLogEntry[] = [];
-
-      const endDate = filters.endDate ? new Date(filters.endDate) : new Date();
-      const startDate = filters.startDate
-        ? new Date(filters.startDate)
-        : new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1000);
-
-      const dates = await getDateRange(startDate, endDate);
-
-      if (user.isAdmin && !filters.username) {
-        const users: any[] = await readJsonFile(USERS_FILE);
-
-        for (const u of users) {
-          for (const date of dates) {
-            const logPath = await getDailyLogPath(u.username, date);
-
-            try {
-              const content = await fs.readFile(logPath, "utf-8");
-              const dailyLogs: AuditLogEntry[] = JSON.parse(content);
-              allLogs = allLogs.concat(dailyLogs);
-            } catch (error) {
-              continue;
-            }
-          }
-        }
-      } else {
-        const targetUsername =
-          user.isAdmin && filters.username ? filters.username : user.username;
-
-        for (const date of dates) {
-          const logPath = await getDailyLogPath(targetUsername, date);
-
-          try {
-            const content = await fs.readFile(logPath, "utf-8");
-            const dailyLogs: AuditLogEntry[] = JSON.parse(content);
-            allLogs = allLogs.concat(dailyLogs);
-          } catch (error) {
-            continue;
-          }
-        }
-      }
-
-      let filteredLogs = allLogs;
-
-      if (filters.action) {
-        filteredLogs = filteredLogs.filter((log) => log.action === filters.action);
-      }
-
-      if (filters.category) {
-        filteredLogs = filteredLogs.filter(
-          (log) => log.category === filters.category
-        );
-      }
-
-      if (filters.level) {
-        filteredLogs = filteredLogs.filter((log) => log.level === filters.level);
-      }
-
-      if (filters.success !== undefined) {
-        filteredLogs = filteredLogs.filter(
-          (log) => log.success === filters.success
-        );
-      }
+export const GET = defineRoute(
+  {
+    id: "listLogs",
+    method: HttpMethod.GET,
+    path: "/logs",
+    tag: ApiTag.LOGS,
+    summary: "List audit log entries",
+    description: "Newest first. You see your own entries. Admins see everybody's, or one user's with username.",
+    query: logListQuery,
+    responses: {
+      200: { description: "A page of entries", schema: logPageSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    if (!user.isAdmin && query.username && query.username !== user.username) {
+      return refuse("Forbidden: You can only view your own logs", 403);
+    }
 
-      filteredLogs.sort(
-        (a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
-      );
+    const usernames = user.isAdmin && !query.username
+      ? await everyUsername()
+      : [user.isAdmin && query.username ? query.username : user.username];
 
-      const total = filteredLogs.length;
-      const paginatedLogs = filteredLogs.slice(filters.offset, filters.offset + filters.limit);
+    const matches = sieveLogs(await digUpLogs(usernames, query), query);
 
-      return NextResponse.json({
-        success: true,
-        logs: paginatedLogs,
-        total,
-      });
-    } catch (error: any) {
-      return NextResponse.json(
-        { error: error.message || "Failed to fetch audit logs" },
-        { status: 500 }
-      );
-    }
-  });
-}
+    return NextResponse.json({
+      success: true,
+      logs: matches.slice(query.offset, query.offset + query.limit),
+      total: matches.length,
+    });
+  },
+);
diff --git a/app/api/logs/stats/route.ts b/app/api/logs/stats/route.ts
index 171129d73..362c754b8 100644
--- a/app/api/logs/stats/route.ts
+++ b/app/api/logs/stats/route.ts
@@ -1,94 +1,62 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
-import { getDailyLogPath, getDateRange } from "@/app/_server/actions/log";
-import { readJsonFile } from "@/app/_server/actions/file";
-import { USERS_FILE } from "@/app/_consts/files";
-import { AuditLogEntry } from "@/app/_types";
-import fs from "fs/promises";
+import { NextResponse } from "next/server";
+import { digUpLogs, everyUsername, newestFirst } from "@/app/_server/actions/lib/audit-trail";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { logStatsSchema } from "@/app/_schemas/api/logs";
+import { AUDIT_LOG_LEVELS } from "@/app/_types/audit";
+import { LOG_WINDOW_DAYS } from "@/app/_consts/logs";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      if (!user.isAdmin) {
-        return NextResponse.json(
-          { error: "Admin access required" },
-          { status: 403 }
-        );
-      }
-
-      let allLogs: AuditLogEntry[] = [];
-      const endDate = new Date();
-      const startDate = new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1000);
-
-      const dates = await getDateRange(startDate, endDate);
-      const users: any[] = await readJsonFile(USERS_FILE);
-
-      for (const u of users) {
-        for (const date of dates) {
-          const logPath = await getDailyLogPath(u.username, date);
-
-          try {
-            const content = await fs.readFile(logPath, "utf-8");
-            const dailyLogs: AuditLogEntry[] = JSON.parse(content);
-            allLogs = allLogs.concat(dailyLogs);
-          } catch (error) {
-            continue;
-          }
-        }
-      }
-
-      const logsByLevel: any = {
-        DEBUG: 0,
-        INFO: 0,
-        WARNING: 0,
-        ERROR: 0,
-        CRITICAL: 0,
-      };
-
-      const logsByCategory: any = {};
-      const actionCounts: Map<string, number> = new Map();
-      const userCounts: Map<string, number> = new Map();
-
-      for (const log of allLogs) {
-        logsByLevel[log.level] = (logsByLevel[log.level] || 0) + 1;
-        logsByCategory[log.category] = (logsByCategory[log.category] || 0) + 1;
-
-        actionCounts.set(log.action, (actionCounts.get(log.action) || 0) + 1);
-        userCounts.set(log.username, (userCounts.get(log.username) || 0) + 1);
-      }
-
-      const topActions = Array.from(actionCounts.entries())
-        .sort((a, b) => b[1] - a[1])
-        .slice(0, 10)
-        .map(([action, count]) => ({ action, count }));
-
-      const topUsers = Array.from(userCounts.entries())
-        .sort((a, b) => b[1] - a[1])
-        .slice(0, 10)
-        .map(([username, count]) => ({ username, count }));
-
-      allLogs.sort(
-        (a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
-      );
-      const recentActivity = allLogs.slice(0, 10);
-
-      const stats = {
-        totalLogs: allLogs.length,
-        logsByLevel,
-        logsByCategory,
-        topActions,
-        topUsers,
-        recentActivity,
-      };
-
-      return NextResponse.json(stats);
-    } catch (error: any) {
-      return NextResponse.json(
-        { error: error.message || "Failed to fetch stats" },
-        { status: 500 }
-      );
-    }
-  });
-}
+const TOP_COUNT = 10;
+
+const _bump = (counts: Map<string, number>, key: string) =>
+  counts.set(key, (counts.get(key) || 0) + 1);
+
+const _top = (counts: Map<string, number>) =>
+  Array.from(counts.entries())
+    .sort((a, b) => b[1] - a[1])
+    .slice(0, TOP_COUNT);
+
+export const GET = defineRoute(
+  {
+    id: "getLogStats",
+    method: HttpMethod.GET,
+    path: "/logs/stats",
+    tag: ApiTag.LOGS,
+    summary: "Get audit log statistics",
+    description: `Admin only. Totals per level and category, the busiest actions and users, and the latest entries, across every user for the last ${LOG_WINDOW_DAYS} days.`,
+    responses: {
+      200: { description: "Statistics", schema: logStatsSchema },
+      401: ERRORS[401],
+      403: ERRORS[403],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user }) => {
+    if (!user.isAdmin) return refuse("Admin access required", 403);
+
+    const logs = await digUpLogs(await everyUsername());
+    const levels = new Map<string, number>(AUDIT_LOG_LEVELS.map((level) => [level, 0]));
+    const categories = new Map<string, number>();
+    const actions = new Map<string, number>();
+    const users = new Map<string, number>();
+
+    logs.forEach((log) => {
+      _bump(levels, log.level);
+      _bump(categories, log.category);
+      _bump(actions, log.action);
+      _bump(users, log.username);
+    });
+
+    return NextResponse.json({
+      totalLogs: logs.length,
+      logsByLevel: Object.fromEntries(levels),
+      logsByCategory: Object.fromEntries(categories),
+      topActions: _top(actions).map(([action, count]) => ({ action, count })),
+      topUsers: _top(users).map(([username, count]) => ({ username, count })),
+      recentActivity: newestFirst(logs).slice(0, TOP_COUNT),
+    });
+  },
+);
diff --git a/app/api/notes/[noteId]/route.ts b/app/api/notes/[noteId]/route.ts
index d2be8130f..abf380f2e 100644
--- a/app/api/notes/[noteId]/route.ts
+++ b/app/api/notes/[noteId]/route.ts
@@ -1,12 +1,18 @@
 import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
 import { dropNote, editNote } from "@/app/_server/actions/note/editor";
+import { getNoteById, getUserNotes } from "@/app/_server/actions/note/queries";
 import { resolveApiId } from "@/app/_server/actions/lib/legacy-lookup";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
+import { noteParams, noteSchema, noteUpdateBody } from "@/app/_schemas/api/notes";
 import { Modes } from "@/app/_types/enums";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
 
+const NOT_FOUND = "Note not found";
+
 /**
  * @deprecated Legacy category+slug fallback for the notes API, the twin of
  * listUuid in api-utils. Returns the param when it is already a uuid, otherwise
@@ -14,140 +20,132 @@ export const dynamic = "force-dynamic";
  * with the rest of the slug lookups.
  */
 const _noteUuid = async (
-    request: NextRequest,
-    noteId: string,
-    username: string,
+  request: NextRequest,
+  noteId: string,
+  username: string,
 ): Promise<string | null> =>
-    resolveApiId(
-        Modes.NOTES,
-        noteId,
-        request.nextUrl.searchParams.get("category"),
-        username,
-    );
-
-export async function GET(request: NextRequest, props: { params: Promise<{ noteId: string }> }) {
-    const params = await props.params;
-    return withApiAuth(request, async (user) => {
-        try {
-            const uuid = await _noteUuid(request, params.noteId, user.username);
-            const { getNoteById } = await import("@/app/_server/actions/note/queries");
-            const note = uuid ? await getNoteById(uuid, user.username) : undefined;
-
-            if (!note) {
-                return NextResponse.json({ error: "Note not found" }, { status: 404 });
-            }
-
-            return NextResponse.json({
-                success: true,
-                data: {
-                    id: note.uuid,
-                    title: note.title,
-                    category: note.category || UNCATEGORIZED,
-                    content: note.content,
-                    createdAt: note.createdAt,
-                    updatedAt: note.updatedAt,
-                    owner: note.owner,
-                },
-            });
-        } catch (error) {
-            console.error("API Error:", error);
-            return NextResponse.json(
-                { error: "Internal server error" },
-                { status: 500 }
-            );
-        }
-    });
-}
-
-export async function PUT(request: NextRequest, props: { params: Promise<{ noteId: string }> }) {
-    const params = await props.params;
-    return withApiAuth(request, async (user) => {
-        try {
-            const body = await request.json();
-            const { title, content, category } = body;
-
-            const uuid = await _noteUuid(request, params.noteId, user.username);
-            const { getUserNotes } = await import("@/app/_server/actions/note/queries");
-            const notes = await getUserNotes({ username: user.username });
-
-            if (!notes.success || !notes.data) {
-                return NextResponse.json(
-                    { error: "Failed to fetch notes" },
-                    { status: 500 }
-                );
-            }
-
-            const note = notes.data.find((n) => n.uuid === uuid);
-            if (!note) {
-                return NextResponse.json({ error: "Note not found" }, { status: 404 });
-            }
-
-            const formData = new FormData();
-            formData.append("uuid", note.uuid!);
-            formData.append("title", title ?? note.title);
-            formData.append("content", content ?? note.content ?? "");
-            formData.append("category", category ?? note.category ?? UNCATEGORIZED);
-            const result = await editNote(user, formData);
-            if (result.error) {
-                return NextResponse.json({ error: result.error }, { status: 400 });
-            }
-
-            const transformedNote = {
-                id: result.data?.uuid,
-                title: result.data?.title,
-                category: result.data?.category || UNCATEGORIZED,
-                content: result.data?.content,
-                createdAt: result.data?.createdAt,
-                updatedAt: result.data?.updatedAt,
-                owner: result.data?.owner,
-            };
-
-            return NextResponse.json({ success: true, data: transformedNote });
-        } catch (error) {
-            console.error("API Error:", error);
-            return NextResponse.json(
-                { error: "Internal server error" },
-                { status: 500 }
-            );
-        }
+  resolveApiId(
+    Modes.NOTES,
+    noteId,
+    request.nextUrl.searchParams.get("category"),
+    username,
+  );
+
+const _ownNote = async (request: NextRequest, noteId: string, username: string) => {
+  const uuid = await _noteUuid(request, noteId, username);
+  const notes = await getUserNotes({ username });
+  if (!notes.success || !notes.data) return { error: "Failed to fetch notes" };
+  return { note: notes.data.find((n) => n.uuid === uuid) };
+};
+
+export const GET = defineRoute(
+  {
+    id: "getNote",
+    method: HttpMethod.GET,
+    path: "/notes/{noteId}",
+    tag: ApiTag.NOTES,
+    summary: "Get a note",
+    params: noteParams,
+    responses: {
+      200: { description: "The note", schema: envelope(noteSchema) },
+      401: ERRORS[401],
+      404: ERRORS[404],
+    },
+  },
+  async ({ request, user, params }) => {
+    const uuid = await _noteUuid(request, params.noteId, user.username);
+    const note = uuid ? await getNoteById(uuid, user.username) : undefined;
+    if (!note) return refuse(NOT_FOUND, 404);
+
+    return NextResponse.json({
+      success: true,
+      data: {
+        id: note.uuid,
+        title: note.title,
+        category: note.category || UNCATEGORIZED,
+        content: note.content,
+        createdAt: note.createdAt,
+        updatedAt: note.updatedAt,
+        owner: note.owner,
+      },
     });
-}
-
-export async function DELETE(request: NextRequest, props: { params: Promise<{ noteId: string }> }) {
-    const params = await props.params;
-    return withApiAuth(request, async (user) => {
-        try {
-            const uuid = await _noteUuid(request, params.noteId, user.username);
-            const { getUserNotes } = await import("@/app/_server/actions/note/queries");
-            const notes = await getUserNotes({ username: user.username });
-
-            if (!notes.success || !notes.data) {
-                return NextResponse.json(
-                    { error: "Failed to fetch notes" },
-                    { status: 500 }
-                );
-            }
-
-            const note = notes.data.find((n) => n.uuid === uuid);
-            if (!note) {
-                return NextResponse.json({ error: "Note not found" }, { status: 404 });
-            }
-
-            const formData = new FormData();
-            formData.append("uuid", note.uuid!);
-
-            const result = await dropNote(user, formData);
-            if (result.error) {
-                return NextResponse.json({ error: result.error }, { status: 400 });
-            }
-
-            return NextResponse.json({ success: true });
-        } catch (error) {
-            console.error("API Error:", error);
-            return NextResponse.json(
-                { error: "Internal server error" },
-                { status: 500 }
-            );
-        }
+  },
+);
+
+export const PUT = defineRoute(
+  {
+    id: "updateNote",
+    method: HttpMethod.PUT,
+    path: "/notes/{noteId}",
+    tag: ApiTag.NOTES,
+    summary: "Update a note",
+    description: "Fields left out keep their current value.",
+    params: noteParams,
+    body: noteUpdateBody,
+    responses: {
+      200: { description: "Updated note", schema: envelope(noteSchema) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const { note, error } = await _ownNote(request, params.noteId, user.username);
+    if (error) return refuse(error, 500);
+    if (!note) return refuse(NOT_FOUND, 404);
+
+    const formData = new FormData();
+    formData.append("uuid", note.uuid!);
+    formData.append("title", body.title ?? note.title ?? "");
+    formData.append("content", body.content ?? note.content ?? "");
+    formData.append("category", body.category ?? note.category ?? UNCATEGORIZED);
+
+    const result = await editNote(user, formData);
+    if (result.error) return refuse(result.error, 400);
+
+    return NextResponse.json({
+      success: true,
+      data: {
+        id: result.data?.uuid,
+        title: result.data?.title,
+        category: result.data?.category || UNCATEGORIZED,
+        content: result.data?.content,
+        createdAt: result.data?.createdAt,
+        updatedAt: result.data?.updatedAt,
+        owner: result.data?.owner,
+      },
     });
-}
+  },
+);
+
+export const DELETE = defineRoute(
+  {
+    id: "deleteNote",
+    method: HttpMethod.DELETE,
+    path: "/notes/{noteId}",
+    tag: ApiTag.NOTES,
+    summary: "Delete a note",
+    params: noteParams,
+    responses: {
+      200: { description: "Deleted", schema: okSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const { note, error } = await _ownNote(request, params.noteId, user.username);
+    if (error) return refuse(error, 500);
+    if (!note) return refuse(NOT_FOUND, 404);
+
+    const formData = new FormData();
+    formData.append("uuid", note.uuid!);
+
+    const result = await dropNote(user, formData);
+    if (result.error) return refuse(result.error, 400);
+
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/notes/route.ts b/app/api/notes/route.ts
index 22b90c286..e4c38d805 100644
--- a/app/api/notes/route.ts
+++ b/app/api/notes/route.ts
@@ -1,105 +1,93 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { z } from "zod";
 import { getUserNotes } from "@/app/_server/actions/note/queries";
 import { makeNote } from "@/app/_server/actions/note/creator";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { noteCreateBody, noteListQuery, noteSchema } from "@/app/_schemas/api/notes";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const { searchParams } = new URL(request.url);
-      const category = searchParams.get("category");
-      const search = searchParams.get("q");
-
-      const notes = await getUserNotes({ username: user.username });
-      if (!notes.success || !notes.data) {
-        return NextResponse.json(
-          { error: notes.error || "Failed to fetch notes" },
-          { status: 500 }
-        );
-      }
-
-      let filteredNotes = notes.data;
+export const GET = defineRoute(
+  {
+    id: "listNotes",
+    method: HttpMethod.GET,
+    path: "/notes",
+    tag: ApiTag.NOTES,
+    summary: "List notes",
+    description: "Every note the API key owner can read, including shared ones.",
+    query: noteListQuery,
+    responses: {
+      200: { description: "Notes", schema: z.object({ notes: z.array(noteSchema) }) },
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    const notes = await getUserNotes({ username: user.username });
+    if (!notes.success || !notes.data) {
+      return refuse(notes.error || "Failed to fetch notes", 500);
+    }
 
-      if (category) {
-        filteredNotes = filteredNotes.filter(
-          (note) => note.category === category
-        );
-      }
-      if (search) {
-        const searchLower = search.toLowerCase();
-        filteredNotes = filteredNotes.filter(
-          (note) =>
-            note.title?.toLowerCase().includes(searchLower) ||
-            note.content?.toLowerCase().includes(searchLower)
-        );
-      }
+    const needle = query.q?.toLowerCase();
+    const matches = notes.data.filter(
+      (note) =>
+        (!query.category || note.category === query.category) &&
+        (!needle ||
+          note.title?.toLowerCase().includes(needle) ||
+          note.content?.toLowerCase().includes(needle)),
+    );
 
-      const transformedNotes = filteredNotes.map((note) => ({
+    return NextResponse.json({
+      notes: matches.map((note) => ({
         id: note.uuid,
         title: note.title,
-        category: note.category || "Uncategorized",
+        category: note.category || UNCATEGORIZED,
         content: note.content,
         createdAt: note.createdAt,
         updatedAt: note.updatedAt,
-      }));
-
-      return NextResponse.json({ notes: transformedNotes });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 }
-      );
-    }
-  });
-}
+      })),
+    });
+  },
+);
 
-export async function POST(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const {
-        title,
-        content = "",
-        category = "Uncategorized",
-      } = body;
+export const POST = defineRoute(
+  {
+    id: "createNote",
+    method: HttpMethod.POST,
+    path: "/notes",
+    tag: ApiTag.NOTES,
+    summary: "Create a note",
+    body: noteCreateBody,
+    responses: {
+      200: { description: "Created note", schema: envelope(noteSchema) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const formData = new FormData();
+    formData.append("title", body.title);
+    formData.append("rawContent", body.content);
+    formData.append("category", body.category);
 
-      if (!title) {
-        return NextResponse.json(
-          { error: "Title is required" },
-          { status: 400 }
-        );
-      }
+    const result = await makeNote(user, formData);
+    if (result.error) return refuse(result.error, 400);
 
-      const formData = new FormData();
-      formData.append("title", title);
-      formData.append("rawContent", content);
-      formData.append("category", category);
-
-      const result = await makeNote(user, formData);
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
-
-      const transformedNote = {
+    return NextResponse.json({
+      success: true,
+      data: {
         id: result.data?.uuid,
         title: result.data?.title,
-        category: result.data?.category || "Uncategorized",
-        content: result.data?.content || content,
+        category: result.data?.category || UNCATEGORIZED,
+        content: result.data?.content || body.content,
         createdAt: result.data?.createdAt,
         updatedAt: result.data?.updatedAt,
         owner: result.data?.owner,
-      };
-
-      return NextResponse.json({ success: true, data: transformedNote });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 }
-      );
-    }
-  });
-}
+      },
+    });
+  },
+);
diff --git a/app/api/openapi.json/route.ts b/app/api/openapi.json/route.ts
new file mode 100644
index 000000000..10d10ea44
--- /dev/null
+++ b/app/api/openapi.json/route.ts
@@ -0,0 +1,24 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { defineRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { apiSpec } from "@/app/_server/api/spec";
+import { ERRORS } from "@/app/_schemas/api/common";
+
+export const dynamic = "force-dynamic";
+
+export const GET = defineRoute(
+  {
+    id: "getOpenApiSpec",
+    method: HttpMethod.GET,
+    path: "/openapi.json",
+    tag: ApiTag.SYSTEM,
+    summary: "Get the OpenAPI document",
+    description: "Built from the route contracts, so it matches the version this instance runs.",
+    responses: {
+      200: { description: "OpenAPI 3.1 document", schema: z.record(z.string(), z.unknown()) },
+      401: ERRORS[401],
+    },
+  },
+  async ({ request }) => NextResponse.json(await apiSpec(request.nextUrl.origin)),
+);
diff --git a/app/api/search/route.ts b/app/api/search/route.ts
index 8b36caacd..3fc0dfc7a 100644
--- a/app/api/search/route.ts
+++ b/app/api/search/route.ts
@@ -1,17 +1,26 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
-import { search } from "@/app/_server/actions/search";
-import { grepSearchContent, grepExtractFrontmatter } from "@/app/_utils/grep-utils";
-import { NOTES_DIR } from "@/app/_consts/files";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
-import path from "path";
+import { NextResponse } from "next/server";
+import {
+  GrepSearchResult,
+  grepExtractFrontmatter,
+  grepSearchContent,
+} from "@/app/_utils/grep-utils";
+import { defineRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import {
+  SEARCH_MIN_LEN,
+  searchParamsSchema,
+  searchResultsSchema,
+} from "@/app/_schemas/api/discovery";
+import { ItemTypes } from "@/app/_types/enums";
+import { CHECKLISTS_DIR, NOTES_DIR } from "@/app/_consts/files";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
 
-const QUERY_MIN_LEN = 2;
 const RESULT_SLICE = 20;
 
-const cleanMatch = (line: string) =>
+const _cleanMatch = (line: string) =>
   line
     .replace(/^---$/, "")
     .replace(/^- \[[x ]\]\s*/i, "")
@@ -19,62 +28,68 @@ const cleanMatch = (line: string) =>
     .replace(/^#+\s*/, "")
     .trim();
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const { searchParams } = new URL(request.url);
-      const query = searchParams.get("q") || "";
-      const typeFilter = searchParams.get("type");
+const _escape = (query: string) => query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
-      if (query.trim().length < QUERY_MIN_LEN) {
-        return NextResponse.json(
-          { error: `Query must be at least ${QUERY_MIN_LEN} characters` },
-          { status: 400 },
-        );
-      }
+const _grep = async (dir: string, pattern: string, wanted: boolean) => {
+  if (!wanted) return [];
+  try {
+    return await grepSearchContent(dir, pattern);
+  } catch (error) {
+    console.error(`Search grep failed in ${dir}:`, error);
+    return [];
+  }
+};
 
-      const escaped = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const notesDir = NOTES_DIR(user.username);
-      const checklistsDir = path.join(process.cwd(), "data", CHECKLISTS_FOLDER, user.username);
+const _toHits = (hits: GrepSearchResult[], type: ItemTypes) =>
+  Promise.all(
+    hits.slice(0, RESULT_SLICE).map(async (hit) => {
+      const meta = await grepExtractFrontmatter(hit.filePath);
+      const title = (meta?.title as string) || hit.id;
+      const cleaned = _cleanMatch(hit.matchLine);
+      return {
+        id: hit.id,
+        uuid: meta?.uuid as string | undefined,
+        type,
+        title,
+        category: hit.category || UNCATEGORIZED,
+        excerpt: cleaned && cleaned.toLowerCase() !== title.toLowerCase() ? cleaned : undefined,
+      };
+    }),
+  );
 
-      const [rawNotes, rawChecklists] = await Promise.all([
-        typeFilter === "checklist" ? Promise.resolve([]) : grepSearchContent(notesDir, escaped).catch(() => []),
-        typeFilter === "note" ? Promise.resolve([]) : grepSearchContent(checklistsDir, escaped).catch(() => []),
-      ]);
+export const GET = defineRoute(
+  {
+    id: "search",
+    method: HttpMethod.GET,
+    path: "/search",
+    tag: ApiTag.DISCOVERY,
+    summary: "Search notes and checklists",
+    description: `Full-text search across your own notes and checklists. The query needs at least ${SEARCH_MIN_LEN} characters and each type returns at most ${RESULT_SLICE} hits.`,
+    query: searchParamsSchema,
+    responses: {
+      200: { description: "Matches", schema: searchResultsSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    const pattern = _escape(query.q);
 
-      const toResult = async (
-        hits: { filePath: string; id: string; category: string; matchLine: string }[],
-        type: "note" | "checklist",
-      ) =>
-        Promise.all(
-          hits.slice(0, RESULT_SLICE).map(async (hit) => {
-            const meta = await grepExtractFrontmatter(hit.filePath);
-            const title = (meta?.title as string) || hit.id;
-            const cleaned = cleanMatch(hit.matchLine);
-            return {
-              id: hit.id,
-              uuid: meta?.uuid as string | undefined,
-              type,
-              title,
-              category: hit.category || "Uncategorized",
-              excerpt: cleaned && cleaned.toLowerCase() !== title.toLowerCase() ? cleaned : undefined,
-            };
-          }),
-        );
+    const [rawNotes, rawChecklists] = await Promise.all([
+      _grep(NOTES_DIR(user.username), pattern, query.type !== ItemTypes.CHECKLIST),
+      _grep(CHECKLISTS_DIR(user.username), pattern, query.type !== ItemTypes.NOTE),
+    ]);
 
-      const [notes, checklists] = await Promise.all([
-        toResult(rawNotes, "note"),
-        toResult(rawChecklists, "checklist"),
-      ]);
+    const [notes, checklists] = await Promise.all([
+      _toHits(rawNotes, ItemTypes.NOTE),
+      _toHits(rawChecklists, ItemTypes.CHECKLIST),
+    ]);
 
-      return NextResponse.json({
-        query,
-        results: [...notes, ...checklists],
-        total: notes.length + checklists.length,
-      });
-    } catch (error) {
-      console.error("Search API error:", error);
-      return NextResponse.json({ error: "Internal server error" }, { status: 500 });
-    }
-  });
-}
+    return NextResponse.json({
+      query: query.q,
+      results: [...notes, ...checklists],
+      total: notes.length + checklists.length,
+    });
+  },
+);
diff --git a/app/api/summary/route.ts b/app/api/summary/route.ts
index 4205d7360..3d3e4e5dd 100644
--- a/app/api/summary/route.ts
+++ b/app/api/summary/route.ts
@@ -1,149 +1,108 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { z } from "zod";
 import { getUserNotes } from "@/app/_server/actions/note/queries";
 import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { summaryQuery, summarySchema } from "@/app/_schemas/api/discovery";
 import { Checklist, Result } from "@/app/_types";
-import { isKanbanType, TaskStatus } from "@/app/_types/enums";
+import { ChecklistsTypes, isKanbanType, TaskStatus } from "@/app/_types/enums";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const { searchParams } = new URL(request.url);
-      const requestedUsername = searchParams.get("username");
+const _tally = <T>(things: T[], keyOf: (thing: T) => string) =>
+  things.reduce<Record<string, number>>((acc, thing) => {
+    const key = keyOf(thing);
+    acc[key] = (acc[key] || 0) + 1;
+    return acc;
+  }, {});
 
-      if (requestedUsername && requestedUsername !== user.username) {
-        if (!user.isAdmin) {
-          return NextResponse.json(
-            {
-              error: "Only administrators can query other users' summary data",
-            },
-            { status: 403 },
-          );
-        }
-      }
+const _rate = (done: number, total: number) =>
+  total > 0 ? Math.round((done / total) * 100) : 0;
 
-      const username = requestedUsername || user.username;
+const _countItems = (lists: Checklist[]) => {
+  const counts = { total: 0, completed: 0, tasks: 0, tasksDone: 0, inProgress: 0, todo: 0 };
 
-      const notesResult = await getUserNotes({ username });
-      if (!notesResult.success || !notesResult.data) {
-        return NextResponse.json(
-          { error: notesResult.error || "Failed to fetch notes" },
-          { status: 500 },
-        );
-      }
-
-      const userNotes = notesResult.data.filter(
-        (note) => note.owner === username,
-      );
+  lists.forEach((list) => {
+    counts.total += list.items.length;
+    list.items.forEach((item) => {
+      if (item.completed) counts.completed++;
+      if (!isKanbanType(list.type) || !item.status) return;
+      counts.tasks++;
+      if (item.status === TaskStatus.COMPLETED) counts.tasksDone++;
+      if (item.status === TaskStatus.IN_PROGRESS) counts.inProgress++;
+      if (item.status === TaskStatus.TODO) counts.todo++;
+    });
+  });
 
-      const listsResult = (await getUserChecklists({ username })) as Result<
-        Checklist[]
-      >;
-      if (!listsResult.success || !listsResult.data) {
-        return NextResponse.json(
-          { error: listsResult.error || "Failed to fetch checklists" },
-          { status: 500 },
-        );
-      }
+  return counts;
+};
 
-      const userLists = listsResult.data.filter(
-        (list) => list.owner === username,
-      );
+export const GET = defineRoute(
+  {
+    id: "getSummary",
+    method: HttpMethod.GET,
+    path: "/summary",
+    tag: ApiTag.DISCOVERY,
+    summary: "Get usage summary",
+    description: "Counts of notes, checklists, items and Kanban tasks owned by a user. Shared items are not counted. Admins can ask for anybody's.",
+    query: summaryQuery,
+    responses: {
+      200: { description: "Summary", schema: z.object({ summary: summarySchema }) },
+      401: ERRORS[401],
+      403: ERRORS[403],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    if (query.username && query.username !== user.username && !user.isAdmin) {
+      return refuse("Only administrators can query other users' summary data", 403);
+    }
 
-      let totalItems = 0;
-      let completedItems = 0;
-      let totalTasks = 0;
-      let completedTasks = 0;
-      let inProgressTasks = 0;
-      let todoTasks = 0;
+    const username = query.username || user.username;
 
-      userLists.forEach((list) => {
-        totalItems += list.items.length;
+    const notesResult = await getUserNotes({ username });
+    if (!notesResult.success || !notesResult.data) {
+      return refuse(notesResult.error || "Failed to fetch notes", 500);
+    }
 
-        list.items.forEach((item) => {
-          if (item.completed) {
-            completedItems++;
-          }
+    const listsResult = (await getUserChecklists({ username })) as Result<Checklist[]>;
+    if (!listsResult.success || !listsResult.data) {
+      return refuse(listsResult.error || "Failed to fetch checklists", 500);
+    }
 
-          if (isKanbanType(list.type) && item.status) {
-            totalTasks++;
-            switch (item.status) {
-              case TaskStatus.COMPLETED:
-                completedTasks++;
-                break;
-              case TaskStatus.IN_PROGRESS:
-                inProgressTasks++;
-                break;
-              case TaskStatus.TODO:
-                todoTasks++;
-                break;
-            }
-          }
-        });
-      });
+    const notes = notesResult.data.filter((note) => note.owner === username);
+    const lists = listsResult.data.filter((list) => list.owner === username);
+    const counts = _countItems(lists);
 
-      const summary = {
+    return NextResponse.json({
+      summary: {
         username,
         notes: {
-          total: userNotes.length,
-          categories: userNotes.reduce(
-            (acc, note) => {
-              const category = note.category || "Uncategorized";
-              acc[category] = (acc[category] || 0) + 1;
-              return acc;
-            },
-            {} as Record<string, number>,
-          ),
+          total: notes.length,
+          categories: _tally(notes, (note) => note.category || UNCATEGORIZED),
         },
         checklists: {
-          total: userLists.length,
-          categories: userLists.reduce(
-            (acc, list) => {
-              const category = list.category || "Uncategorized";
-              acc[category] = (acc[category] || 0) + 1;
-              return acc;
-            },
-            {} as Record<string, number>,
-          ),
-          types: userLists.reduce(
-            (acc, list) => {
-              const type = list.type || "simple";
-              acc[type] = (acc[type] || 0) + 1;
-              return acc;
-            },
-            {} as Record<string, number>,
-          ),
+          total: lists.length,
+          categories: _tally(lists, (list) => list.category || UNCATEGORIZED),
+          types: _tally(lists, (list) => list.type || ChecklistsTypes.SIMPLE),
         },
         items: {
-          total: totalItems,
-          completed: completedItems,
-          pending: totalItems - completedItems,
-          completionRate:
-            totalItems > 0
-              ? Math.round((completedItems / totalItems) * 100)
-              : 0,
+          total: counts.total,
+          completed: counts.completed,
+          pending: counts.total - counts.completed,
+          completionRate: _rate(counts.completed, counts.total),
         },
         tasks: {
-          total: totalTasks,
-          completed: completedTasks,
-          inProgress: inProgressTasks,
-          todo: todoTasks,
-          completionRate:
-            totalTasks > 0
-              ? Math.round((completedTasks / totalTasks) * 100)
-              : 0,
+          total: counts.tasks,
+          completed: counts.tasksDone,
+          inProgress: counts.inProgress,
+          todo: counts.todo,
+          completionRate: _rate(counts.tasksDone, counts.tasks),
         },
-      };
-
-      return NextResponse.json({ summary });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+      },
+    });
+  },
+);
diff --git a/app/api/tasks/[taskId]/items/[itemIndex]/route.ts b/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
index 31f93b992..bf9504113 100644
--- a/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
+++ b/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
@@ -1,146 +1,81 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { z } from "zod";
 import { removeItem } from "@/app/_server/actions/checklist-item/remover";
-import { isKanbanType, PermissionTypes } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { apiItemSchema } from "@/app/_schemas/api/items";
+import { taskItemParams } from "@/app/_schemas/api/tasks";
+import { PermissionTypes } from "@/app/_types/enums";
 import { toApiItem } from "@/app/_utils/api-item";
+import { turnAway } from "@/app/_utils/api-utils";
+import { fetchTask } from "@/app/_utils/api-task";
+import { OUT_OF_RANGE, itemAtIndex } from "@/app/_utils/api-list-utils";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string; itemIndex: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(task.type)) {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
-
-      const indexPath = params.itemIndex.split(".").map((i) => parseInt(i));
-
-      for (const idx of indexPath) {
-        if (isNaN(idx) || idx < 0) {
-          return NextResponse.json(
-            { error: "Invalid item index" },
-            { status: 400 },
-          );
-        }
-      }
-
-      let item: any = null;
-      let itemIndex = 0;
-      let currentItems = task.items;
-
-      for (const idx of indexPath) {
-        if (idx >= currentItems.length) {
-          return NextResponse.json(
-            { error: "Item index out of range" },
-            { status: 400 },
-          );
-        }
-        item = currentItems[idx];
-        itemIndex = idx;
-        currentItems = item.children || [];
-      }
-
-      if (!item) {
-        return NextResponse.json({ error: "Item not found" }, { status: 404 });
-      }
-
-      return NextResponse.json({ item: toApiItem(item, itemIndex, true) });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+export const GET = defineRoute(
+  {
+    id: "getTaskItem",
+    method: HttpMethod.GET,
+    path: "/tasks/{taskId}/items/{itemIndex}",
+    tag: ApiTag.TASKS,
+    summary: "Get a task item",
+    description: "Returns one item with its children and Kanban fields.",
+    params: taskItemParams,
+    responses: {
+      200: { description: "The item", schema: z.object({ item: apiItemSchema }) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
+
+    const hit = itemAtIndex(found.task.items, params.itemIndex);
+    if (!hit) return refuse(OUT_OF_RANGE, 400);
+
+    return NextResponse.json({ item: toApiItem(hit.item, hit.index, true) });
+  },
+);
+
+export const DELETE = defineRoute(
+  {
+    id: "deleteTaskItem",
+    method: HttpMethod.DELETE,
+    path: "/tasks/{taskId}/items/{itemIndex}",
+    tag: ApiTag.TASKS,
+    summary: "Delete a task item",
+    description: "Needs the delete grant on a shared task. Children go with it.",
+    params: taskItemParams,
+    responses: {
+      200: { description: "Deleted", schema: okSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
+    const { task } = found;
+
+    const hit = itemAtIndex(task.items, params.itemIndex);
+    if (!hit) return refuse(OUT_OF_RANGE, 400);
+
+    const refused = await turnAway(user.username, task.uuid!, PermissionTypes.DELETE);
+    if (refused) return refused;
+
+    const result = await removeItem(user, task.uuid!, hit.item.id);
+    if (!result.success) {
+      return refuse(result.error || "Failed to delete item", 500);
     }
-  });
-}
-
-export async function DELETE(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string; itemIndex: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(task.type)) {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
 
-      const indexPath = params.itemIndex.split(".").map((i) => parseInt(i));
-
-      for (const idx of indexPath) {
-        if (isNaN(idx) || idx < 0) {
-          return NextResponse.json(
-            { error: "Invalid item index" },
-            { status: 400 },
-          );
-        }
-      }
-
-      let item: any = null;
-      let currentItems = task.items;
-
-      for (const idx of indexPath) {
-        if (idx >= currentItems.length) {
-          return NextResponse.json(
-            { error: "Item index out of range" },
-            { status: 400 },
-          );
-        }
-        item = currentItems[idx];
-        currentItems = item.children || [];
-      }
-
-      if (!item) {
-        return NextResponse.json({ error: "Item not found" }, { status: 404 });
-      }
-
-      const refused = await turnAway(
-        user.username,
-        task.uuid!,
-        PermissionTypes.DELETE,
-      );
-      if (refused) return refused;
-
-      const result = await removeItem(user, task.uuid!, item.id);
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to delete item" },
-          { status: 500 },
-        );
-      }
-
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/tasks/[taskId]/items/[itemIndex]/status/route.ts b/app/api/tasks/[taskId]/items/[itemIndex]/status/route.ts
index 005823bc1..3f4c4810d 100644
--- a/app/api/tasks/[taskId]/items/[itemIndex]/status/route.ts
+++ b/app/api/tasks/[taskId]/items/[itemIndex]/status/route.ts
@@ -1,91 +1,51 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { PermissionTypes } from "@/app/_types/enums";
 import { stampStatus } from "@/app/_server/actions/checklist-item/stamper";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { itemStatusBody, taskItemParams } from "@/app/_schemas/api/tasks";
+import { fetchTask } from "@/app/_utils/api-task";
+import { OUT_OF_RANGE, itemAtIndex } from "@/app/_utils/api-list-utils";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string; itemIndex: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { status } = body;
-
-      if (!status) {
-        return NextResponse.json(
-          { error: "Status is required" },
-          { status: 400 },
-        );
-      }
-
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(task.type)) {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
-
-      const indexPath = params.itemIndex.split(".").map((i) => parseInt(i));
-
-      for (const idx of indexPath) {
-        if (isNaN(idx) || idx < 0) {
-          return NextResponse.json(
-            { error: "Invalid item index" },
-            { status: 400 },
-          );
-        }
-      }
-
-      let item: any = null;
-      let currentItems = task.items;
-
-      for (const idx of indexPath) {
-        if (idx >= currentItems.length) {
-          return NextResponse.json(
-            { error: "Item index out of range" },
-            { status: 400 },
-          );
-        }
-        item = currentItems[idx];
-        currentItems = item.children || [];
-      }
-
-      if (!item) {
-        return NextResponse.json({ error: "Item not found" }, { status: 404 });
-      }
-
-      const formData = new FormData();
-      formData.append("uuid", task.uuid!);
-      formData.append("itemId", item.id);
-      formData.append("status", status);
-
-      const result = await stampStatus(user, formData);
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to update item status" },
-          { status: 500 },
-        );
-      }
-
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+export const PUT = defineRoute(
+  {
+    id: "updateTaskItemStatus",
+    method: HttpMethod.PUT,
+    path: "/tasks/{taskId}/items/{itemIndex}/status",
+    tag: ApiTag.TASKS,
+    summary: "Move a task item to another status",
+    params: taskItemParams,
+    body: itemStatusBody,
+    responses: {
+      200: { description: "Moved", schema: okSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const found = await fetchTask(request, params.taskId, user.username, PermissionTypes.EDIT);
+    if ("refusal" in found) return found.refusal;
+    const { task } = found;
+
+    const hit = itemAtIndex(task.items, params.itemIndex);
+    if (!hit) return refuse(OUT_OF_RANGE, 400);
+
+    const formData = new FormData();
+    formData.append("uuid", task.uuid!);
+    formData.append("itemId", hit.item.id);
+    formData.append("status", body.status);
+
+    const result = await stampStatus(user, formData);
+    if (!result.success) {
+      return refuse(result.error || "Failed to update item status", 500);
     }
-  });
-}
+
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/tasks/[taskId]/items/route.ts b/app/api/tasks/[taskId]/items/route.ts
index 2881c992c..3a9849a0f 100644
--- a/app/api/tasks/[taskId]/items/route.ts
+++ b/app/api/tasks/[taskId]/items/route.ts
@@ -1,116 +1,85 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { z } from "zod";
 import { addItem } from "@/app/_server/actions/checklist-item/editor";
 import { graftItem } from "@/app/_server/actions/checklist-item/grafter";
-import { getListById } from "@/app/_server/actions/checklist/queries";
-import { isKanbanType, PermissionTypes, TaskStatus } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { taskItemCreateBody, taskParams } from "@/app/_schemas/api/tasks";
+import { PermissionTypes, TaskStatus } from "@/app/_types/enums";
+import { turnAway } from "@/app/_utils/api-utils";
+import { fetchTask } from "@/app/_utils/api-task";
+import { itemAtIndex } from "@/app/_utils/api-list-utils";
 
 export const dynamic = "force-dynamic";
 
-export async function POST(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { text, status, parentIndex } = body;
-
-      if (!text) {
-        return NextResponse.json(
-          { error: "Text is required" },
-          { status: 400 },
-        );
-      }
-
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(task.type)) {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
-
-      const refused = await turnAway(
-        user.username,
-        task.uuid!,
-        PermissionTypes.EDIT,
-      );
-      if (refused) return refused;
-
-      if (parentIndex !== undefined) {
-        const indexPath = parentIndex
-          .toString()
-          .split(".")
-          .map((i: string) => parseInt(i));
-        let parentItem: any = null;
-        let currentItems = task.items;
-
-        for (const idx of indexPath) {
-          if (idx >= currentItems.length) {
-            return NextResponse.json(
-              { error: "Parent item not found" },
-              { status: 404 },
-            );
-          }
-          parentItem = currentItems[idx];
-          currentItems = parentItem.children || [];
-        }
-
-        if (!parentItem) {
-          return NextResponse.json(
-            { error: "Parent item not found" },
-            { status: 404 },
-          );
-        }
-
-        const graft = new FormData();
-        graft.append("uuid", task.uuid!);
-        graft.append("parentId", parentItem.id);
-        graft.append("text", text);
-        graft.append("status", status || TaskStatus.TODO);
-
-        const grafted = await graftItem(user, graft);
-
-        if (!grafted.success) {
-          return NextResponse.json(
-            { error: grafted.error || "Failed to add sub-item" },
-            { status: 500 },
-          );
-        }
-
-        return NextResponse.json({ success: true });
+const PARENT_NOT_FOUND = "Parent item not found";
+
+export const POST = defineRoute(
+  {
+    id: "createTaskItem",
+    method: HttpMethod.POST,
+    path: "/tasks/{taskId}/items",
+    tag: ApiTag.TASKS,
+    summary: "Add a task item",
+    description: "Adds a top-level item, or a sub-item under parentIndex. The response for a sub-item has no data field.",
+    params: taskParams,
+    body: taskItemCreateBody,
+    responses: {
+      200: {
+        description: "Created",
+        schema: z.union([
+          z.object({
+            success: z.literal(true),
+            data: z.object({ id: z.string().describe("Id of the new item inside the task") }),
+          }),
+          okSchema,
+        ]),
+      },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
+    const { task } = found;
+
+    const refused = await turnAway(user.username, task.uuid!, PermissionTypes.EDIT);
+    if (refused) return refused;
+
+    const status = body.status || TaskStatus.TODO;
+
+    if (body.parentIndex !== undefined) {
+      const parent = itemAtIndex(task.items, String(body.parentIndex));
+      if (!parent) return refuse(PARENT_NOT_FOUND, 404);
+
+      const graft = new FormData();
+      graft.append("uuid", task.uuid!);
+      graft.append("parentId", parent.item.id);
+      graft.append("text", body.text);
+      graft.append("status", status);
+
+      const grafted = await graftItem(user, graft);
+      if (!grafted.success) {
+        return refuse(grafted.error || "Failed to add sub-item", 500);
       }
 
-      const formData = new FormData();
-      formData.append("text", text);
-      formData.append("status", status || TaskStatus.TODO);
-
-      const result = await addItem(user, task, formData, true);
+      return NextResponse.json({ success: true });
+    }
 
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to create item" },
-          { status: 500 },
-        );
-      }
+    const formData = new FormData();
+    formData.append("text", body.text);
+    formData.append("status", status);
 
-      return NextResponse.json({
-        success: true,
-        data: { id: result.data?.id },
-      });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+    const result = await addItem(user, task, formData, true);
+    if (!result.success) {
+      return refuse(result.error || "Failed to create item", 500);
     }
-  });
-}
+
+    return NextResponse.json({ success: true, data: { id: result.data?.id } });
+  },
+);
diff --git a/app/api/tasks/[taskId]/route.ts b/app/api/tasks/[taskId]/route.ts
index 7740ee532..1b0317b0a 100644
--- a/app/api/tasks/[taskId]/route.ts
+++ b/app/api/tasks/[taskId]/route.ts
@@ -1,147 +1,107 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { z } from "zod";
 import { dropList, editList } from "@/app/_server/actions/checklist/editor";
-import { isKanbanType } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
+import { taskParams, taskSchema, taskUpdateBody } from "@/app/_schemas/api/tasks";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
 import { toApiItem } from "@/app/_utils/api-item";
+import { fetchTask, toApiTask } from "@/app/_utils/api-task";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
+export const GET = defineRoute(
+  {
+    id: "getTask",
+    method: HttpMethod.GET,
+    path: "/tasks/{taskId}",
+    tag: ApiTag.TASKS,
+    summary: "Get a task",
+    params: taskParams,
+    responses: {
+      200: { description: "The task", schema: z.object({ task: taskSchema }) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
+    const { task } = found;
 
-      if (!isKanbanType(task.type)) {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
-
-      const transformedTask = {
-        id: task.uuid,
-        title: task.title,
-        category: task.category || "Uncategorized",
-        statuses: task.statuses || [
-          { id: "todo", name: "To Do", order: 0 },
-          { id: "in_progress", name: "In Progress", order: 1 },
-          { id: "completed", name: "Completed", order: 2 },
-        ],
+    return NextResponse.json({
+      task: {
+        ...toApiTask(task),
         items: task.items.map((item, index) => toApiItem(item, index, true)),
-        createdAt: task.createdAt,
-        updatedAt: task.updatedAt,
-      };
-
-      return NextResponse.json({ task: transformedTask });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
-
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { title, category } = body;
-
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
+      },
+    });
+  },
+);
 
-      if (!isKanbanType(task.type)) {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
+export const PUT = defineRoute(
+  {
+    id: "updateTask",
+    method: HttpMethod.PUT,
+    path: "/tasks/{taskId}",
+    tag: ApiTag.TASKS,
+    summary: "Update a task",
+    description: "Changes the title, the category or both. Fields left out keep their current value.",
+    params: taskParams,
+    body: taskUpdateBody,
+    responses: {
+      200: { description: "Updated task, without items", schema: envelope(taskSchema) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
+    const { task } = found;
 
-      const formData = new FormData();
-      formData.append("uuid", task.uuid!);
-      formData.append("title", title ?? task.title);
-      formData.append("category", category ?? task.category ?? "Uncategorized");
-      const result = await editList(user, formData);
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
+    const formData = new FormData();
+    formData.append("uuid", task.uuid!);
+    formData.append("title", body.title ?? task.title);
+    formData.append("category", body.category ?? task.category ?? UNCATEGORIZED);
 
-      const transformedTask = {
-        id: result.data?.uuid,
-        title: result.data?.title,
-        category: result.data?.category || "Uncategorized",
-        statuses: result.data?.statuses || [
-          { id: "todo", name: "To Do", order: 0 },
-          { id: "in_progress", name: "In Progress", order: 1 },
-          { id: "completed", name: "Completed", order: 2 },
-        ],
-        createdAt: result.data?.createdAt,
-        updatedAt: result.data?.updatedAt,
-      };
+    const result = await editList(user, formData);
+    if (result.error) return refuse(result.error, 400);
 
-      return NextResponse.json({ success: true, data: transformedTask });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+    return NextResponse.json({ success: true, data: toApiTask(result.data) });
+  },
+);
 
-export async function DELETE(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
+export const DELETE = defineRoute(
+  {
+    id: "deleteTask",
+    method: HttpMethod.DELETE,
+    path: "/tasks/{taskId}",
+    tag: ApiTag.TASKS,
+    summary: "Delete a task",
+    params: taskParams,
+    responses: {
+      200: { description: "Deleted", schema: okSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
 
-      if (!isKanbanType(task.type)) {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
+    const formData = new FormData();
+    formData.append("uuid", found.task.uuid!);
 
-      const formData = new FormData();
-      formData.append("uuid", task.uuid!);
-      const result = await dropList(user, formData);
-      if (result.error) {
-        return NextResponse.json({ error: result.error }, { status: 400 });
-      }
+    const result = await dropList(user, formData);
+    if (result.error) return refuse(result.error, 400);
 
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
-    }
-  });
-}
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/tasks/[taskId]/statuses/[statusId]/route.ts b/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
index 8c949d5fa..320c13116 100644
--- a/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
+++ b/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
@@ -1,147 +1,113 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
 import { restatus } from "@/app/_server/actions/checklist/restatus";
-import { isKanbanType, PermissionTypes } from "@/app/_types/enums";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
+import { kanbanStatusSchema } from "@/app/_schemas/api/items";
+import { statusUpdateBody, taskStatusParams } from "@/app/_schemas/api/tasks";
+import { PermissionTypes } from "@/app/_types/enums";
 import { API_FALLBACK_STATUSES } from "@/app/_consts/kanban";
+import { turnAway } from "@/app/_utils/api-utils";
+import { fetchTask } from "@/app/_utils/api-task";
 
 export const dynamic = "force-dynamic";
 
-export async function PUT(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string; statusId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { label, color, order } = body;
-
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(task.type)) {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
-
-      const currentStatuses = task.statuses || API_FALLBACK_STATUSES;
-
-      const statusIndex = currentStatuses.findIndex(
-        (s) => s.id === params.statusId,
-      );
-      if (statusIndex === -1) {
-        return NextResponse.json(
-          { error: "Status not found" },
-          { status: 404 },
-        );
-      }
-
-      const refused = await turnAway(
-        user.username,
-        task.uuid!,
-        PermissionTypes.EDIT,
-      );
-      if (refused) return refused;
-
-      const result = await restatus(user, task.uuid!, (latest) =>
-        (latest || API_FALLBACK_STATUSES).map((s) =>
-          s.id === params.statusId
-            ? {
-                ...s,
-                label: label ?? s.label,
-                color: color !== undefined ? color : s.color,
-                order: order !== undefined ? order : s.order,
-              }
-            : s,
-        ),
-      );
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to update status" },
-          { status: 500 },
-        );
-      }
-
-      return NextResponse.json({
-        success: true,
-        data: result.data?.statuses?.find((s) => s.id === params.statusId),
-      });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+const STATUS_NOT_FOUND = "Status not found";
+
+export const PUT = defineRoute(
+  {
+    id: "updateTaskStatus",
+    method: HttpMethod.PUT,
+    path: "/tasks/{taskId}/statuses/{statusId}",
+    tag: ApiTag.TASKS,
+    summary: "Update a task status",
+    description: "Fields left out keep their current value. Needs the edit grant on a shared task.",
+    params: taskStatusParams,
+    body: statusUpdateBody,
+    responses: {
+      200: { description: "Updated status", schema: envelope(kanbanStatusSchema) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
+    const { task } = found;
+
+    const current = task.statuses || API_FALLBACK_STATUSES;
+    if (!current.some((status) => status.id === params.statusId)) {
+      return refuse(STATUS_NOT_FOUND, 404);
     }
-  });
-}
 
-export async function DELETE(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string; statusId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
-
-      if (task.type !== "kanban" && task.type !== "task") {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
-
-      const currentStatuses = task.statuses || API_FALLBACK_STATUSES;
-
-      const statusIndex = currentStatuses.findIndex(
-        (s) => s.id === params.statusId,
-      );
-      if (statusIndex === -1) {
-        return NextResponse.json(
-          { error: "Status not found" },
-          { status: 404 },
-        );
-      }
-
-      const refused = await turnAway(
-        user.username,
-        task.uuid!,
-        PermissionTypes.EDIT,
-      );
-      if (refused) return refused;
+    const refused = await turnAway(user.username, task.uuid!, PermissionTypes.EDIT);
+    if (refused) return refused;
+
+    const result = await restatus(user, task.uuid!, (latest) =>
+      (latest || API_FALLBACK_STATUSES).map((status) =>
+        status.id === params.statusId
+          ? {
+              ...status,
+              label: body.label ?? status.label,
+              color: body.color === undefined ? status.color : body.color ?? undefined,
+              order: body.order ?? status.order,
+              autoComplete: body.autoComplete ?? status.autoComplete,
+            }
+          : status,
+      ),
+    );
+    if (!result.success) {
+      return refuse(result.error || "Failed to update status", 500);
+    }
 
-      const result = await restatus(user, task.uuid!, (latest) =>
-        (latest || API_FALLBACK_STATUSES).filter(
-          (s) => s.id !== params.statusId,
-        ),
-      );
+    return NextResponse.json({
+      success: true,
+      data: result.data?.statuses?.find((status) => status.id === params.statusId),
+    });
+  },
+);
+
+export const DELETE = defineRoute(
+  {
+    id: "deleteTaskStatus",
+    method: HttpMethod.DELETE,
+    path: "/tasks/{taskId}/statuses/{statusId}",
+    tag: ApiTag.TASKS,
+    summary: "Delete a task status",
+    description: "Items in the deleted column, sub-items included, move to the remaining status with the lowest order and get a history entry. Needs the edit grant on a shared task.",
+    params: taskStatusParams,
+    responses: {
+      200: { description: "Deleted", schema: okSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
+    const { task } = found;
+
+    const current = task.statuses || API_FALLBACK_STATUSES;
+    if (!current.some((status) => status.id === params.statusId)) {
+      return refuse(STATUS_NOT_FOUND, 404);
+    }
 
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to delete status" },
-          { status: 500 },
-        );
-      }
+    const refused = await turnAway(user.username, task.uuid!, PermissionTypes.EDIT);
+    if (refused) return refused;
 
-      return NextResponse.json({ success: true });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+    const result = await restatus(user, task.uuid!, (latest) =>
+      (latest || API_FALLBACK_STATUSES).filter((status) => status.id !== params.statusId),
+    );
+    if (!result.success) {
+      return refuse(result.error || "Failed to delete status", 500);
     }
-  });
-}
+
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/tasks/[taskId]/statuses/route.ts b/app/api/tasks/[taskId]/statuses/route.ts
index ad223450c..6a22acc4c 100644
--- a/app/api/tasks/[taskId]/statuses/route.ts
+++ b/app/api/tasks/[taskId]/statuses/route.ts
@@ -1,119 +1,92 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth, listUuid, turnAway } from "@/app/_utils/api-utils";
-import { getListById } from "@/app/_server/actions/checklist/queries";
+import { NextResponse } from "next/server";
+import { z } from "zod";
 import { restatus } from "@/app/_server/actions/checklist/restatus";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { kanbanStatusSchema } from "@/app/_schemas/api/items";
+import { statusCreateBody, taskParams } from "@/app/_schemas/api/tasks";
 import { KanbanStatus } from "@/app/_types";
-import { isKanbanType, PermissionTypes } from "@/app/_types/enums";
+import { PermissionTypes } from "@/app/_types/enums";
 import { API_FALLBACK_STATUSES } from "@/app/_consts/kanban";
+import { turnAway } from "@/app/_utils/api-utils";
+import { fetchTask } from "@/app/_utils/api-task";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
-
-      if (!isKanbanType(task.type)) {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
-
-      const statuses = task.statuses || API_FALLBACK_STATUSES;
-
-      return NextResponse.json({ statuses });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+export const GET = defineRoute(
+  {
+    id: "listTaskStatuses",
+    method: HttpMethod.GET,
+    path: "/tasks/{taskId}/statuses",
+    tag: ApiTag.TASKS,
+    summary: "List task statuses",
+    description: "The Kanban columns of a task, in stored order.",
+    params: taskParams,
+    responses: {
+      200: { description: "Statuses", schema: z.object({ statuses: z.array(kanbanStatusSchema) }) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
+
+    return NextResponse.json({ statuses: found.task.statuses || API_FALLBACK_STATUSES });
+  },
+);
+
+export const POST = defineRoute(
+  {
+    id: "createTaskStatus",
+    method: HttpMethod.POST,
+    path: "/tasks/{taskId}/statuses",
+    tag: ApiTag.TASKS,
+    summary: "Add a task status",
+    description: "Adds a Kanban column. Needs the edit grant on a shared task.",
+    params: taskParams,
+    body: statusCreateBody,
+    responses: {
+      200: { description: "Created status", schema: envelope(kanbanStatusSchema) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const found = await fetchTask(request, params.taskId, user.username);
+    if ("refusal" in found) return found.refusal;
+    const { task } = found;
+
+    const current = task.statuses || API_FALLBACK_STATUSES;
+    if (current.some((status) => status.id === body.id)) {
+      return refuse("Status with this id already exists", 400);
     }
-  });
-}
-
-export async function POST(
-  request: NextRequest,
-  props: { params: Promise<{ taskId: string }> },
-) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { id, label, color, order, autoComplete } = body;
-
-      if (!id || !label) {
-        return NextResponse.json(
-          { error: "Status id and label are required" },
-          { status: 400 },
-        );
-      }
-
-      const uuid = await listUuid(request, params.taskId, user.username);
-      const task = uuid ? await getListById(uuid, user.username) : undefined;
-      if (!task) {
-        return NextResponse.json({ error: "Task not found" }, { status: 404 });
-      }
-
-      if (task.type !== "kanban" && task.type !== "task") {
-        return NextResponse.json(
-          { error: "Not a task checklist" },
-          { status: 400 },
-        );
-      }
 
-      const currentStatuses = task.statuses || API_FALLBACK_STATUSES;
-
-      if (currentStatuses.some((s) => s.id === id)) {
-        return NextResponse.json(
-          { error: "Status with this id already exists" },
-          { status: 400 },
-        );
-      }
-
-      const newStatus: KanbanStatus = {
-        id,
-        label,
-        color,
-        order: order ?? currentStatuses.length,
-        autoComplete: autoComplete ?? false,
-      };
-
-      const refused = await turnAway(
-        user.username,
-        task.uuid!,
-        PermissionTypes.EDIT,
-      );
-      if (refused) return refused;
-
-      const result = await restatus(user, task.uuid!, (latest) => {
-        const fresh = latest || API_FALLBACK_STATUSES;
-        return fresh.some((s) => s.id === id) ? fresh : [...fresh, newStatus];
-      });
-
-      if (!result.success) {
-        return NextResponse.json(
-          { error: result.error || "Failed to create status" },
-          { status: 500 },
-        );
-      }
-
-      return NextResponse.json({ success: true, data: newStatus });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        { error: "Internal server error" },
-        { status: 500 },
-      );
+    const created: KanbanStatus = {
+      id: body.id,
+      label: body.label,
+      color: body.color,
+      order: body.order ?? current.length,
+      autoComplete: body.autoComplete ?? false,
+    };
+
+    const refused = await turnAway(user.username, task.uuid!, PermissionTypes.EDIT);
+    if (refused) return refused;
+
+    const result = await restatus(user, task.uuid!, (latest) => {
+      const fresh = latest || API_FALLBACK_STATUSES;
+      return fresh.some((status) => status.id === body.id) ? fresh : [...fresh, created];
+    });
+    if (!result.success) {
+      return refuse(result.error || "Failed to create status", 500);
     }
-  });
-}
+
+    return NextResponse.json({ success: true, data: created });
+  },
+);
diff --git a/app/api/tasks/route.ts b/app/api/tasks/route.ts
index 93e18cedc..2dab26309 100644
--- a/app/api/tasks/route.ts
+++ b/app/api/tasks/route.ts
@@ -1,137 +1,99 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { z } from "zod";
 import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { makeList } from "@/app/_server/actions/checklist/creator";
-import { isKanbanType } from "@/app/_types/enums";
-import { Checklist, Result } from "@/app/_types";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { taskCreateBody, taskListQuery, taskSchema } from "@/app/_schemas/api/tasks";
+import { ChecklistsTypes, isKanbanType } from "@/app/_types/enums";
+import { Checklist, KanbanStatus, Result } from "@/app/_types";
 import { toApiItem } from "@/app/_utils/api-item";
+import { toApiTask } from "@/app/_utils/api-task";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const { searchParams } = new URL(request.url);
-      const category = searchParams.get("category");
-      const status = searchParams.get("status");
-      const search = searchParams.get("q");
+type NewColumn = NonNullable<z.output<typeof taskCreateBody>["statuses"]>[number];
 
-      const lists = (await getUserChecklists({
-        username: user.username,
-      })) as Result<Checklist[]>;
-      if (!lists.success || !lists.data) {
-        return NextResponse.json(
-          { error: lists.error || "Failed to fetch tasks" },
-          { status: 500 },
-        );
-      }
+const _toStatus = (column: NewColumn, position: number): KanbanStatus => ({
+  id: column.id,
+  label: column.label || column.name || column.id,
+  ...(column.color !== undefined && { color: column.color }),
+  order: column.order ?? position,
+  ...(column.autoComplete !== undefined && { autoComplete: column.autoComplete }),
+});
 
-      let userTasks = lists.data.filter(
-        (list) => list.owner === user.username && isKanbanType(list.type),
-      );
-
-      if (category) {
-        userTasks = userTasks.filter((list) => list.category === category);
-      }
-      if (status) {
-        userTasks = userTasks.filter((list) =>
-          list.items.some((item) => item.status === status),
-        );
-      }
-      if (search) {
-        const searchLower = search.toLowerCase();
-        userTasks = userTasks.filter(
-          (list) =>
-            list.title?.toLowerCase().includes(searchLower) ||
-            list.items.some((item) =>
-              item.text.toLowerCase().includes(searchLower),
-            ),
-        );
-      }
-
-      const tasks = userTasks.map((list) => ({
-        id: list.uuid,
-        title: list.title,
-        category: list.category || "Uncategorized",
-        statuses: list.statuses || [
-          { id: "todo", name: "To Do", order: 0 },
-          { id: "in_progress", name: "In Progress", order: 1 },
-          { id: "completed", name: "Completed", order: 2 },
-        ],
-        items: list.items.map((item, index) => toApiItem(item, index, true)),
-        createdAt: list.createdAt,
-        updatedAt: list.updatedAt,
-      }));
-
-      return NextResponse.json({ tasks });
-    } catch (error) {
-      return NextResponse.json(
-        {
-          error:
-            error instanceof Error ? error.message : "Failed to fetch tasks",
-        },
-        { status: 500 },
-      );
+export const GET = defineRoute(
+  {
+    id: "listTasks",
+    method: HttpMethod.GET,
+    path: "/tasks",
+    tag: ApiTag.TASKS,
+    summary: "List tasks",
+    description: "Task checklists the API key owner owns. Tasks shared with them are left out.",
+    query: taskListQuery,
+    responses: {
+      200: { description: "Tasks", schema: z.object({ tasks: z.array(taskSchema) }) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    const lists = (await getUserChecklists({ username: user.username })) as Result<Checklist[]>;
+    if (!lists.success || !lists.data) {
+      return refuse(lists.error || "Failed to fetch tasks", 500);
     }
-  });
-}
-
-export async function POST(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const body = await request.json();
-      const { title, category = "Uncategorized", statuses } = body;
 
-      if (!title) {
-        return NextResponse.json(
-          { error: "Title is required" },
-          { status: 400 },
-        );
-      }
+    const needle = query.q?.toLowerCase();
+    const matches = lists.data.filter(
+      (list) =>
+        list.owner === user.username &&
+        isKanbanType(list.type) &&
+        (!query.category || list.category === query.category) &&
+        (!query.status || list.items.some((item) => item.status === query.status)) &&
+        (!needle ||
+          list.title?.toLowerCase().includes(needle) ||
+          list.items.some((item) => item.text.toLowerCase().includes(needle))),
+    );
 
-      const formData = new FormData();
-      formData.append("title", title);
-      formData.append("category", category);
-      formData.append("type", "kanban");
-
-      if (statuses) {
-        formData.append("statuses", JSON.stringify(statuses));
-      }
-
-      const result = await makeList(user, formData);
-
-      if (result.error || !result.data) {
-        console.error("Create task error:", result.error);
-        return NextResponse.json(
-          { error: result.error || "Failed to create task" },
-          { status: 400 },
-        );
-      }
+    return NextResponse.json({
+      tasks: matches.map((list) => ({
+        ...toApiTask(list),
+        items: list.items.map((item, index) => toApiItem(item, index, true)),
+      })),
+    });
+  },
+);
 
-      const transformedTask = {
-        id: result.data?.uuid,
-        title: result.data?.title,
-        category: result.data?.category || "Uncategorized",
-        statuses: result.data?.statuses || [
-          { id: "todo", name: "To Do", order: 0 },
-          { id: "in_progress", name: "In Progress", order: 1 },
-          { id: "completed", name: "Completed", order: 2 },
-        ],
-        items: [],
-        createdAt: result.data?.createdAt,
-        updatedAt: result.data?.updatedAt,
-      };
+export const POST = defineRoute(
+  {
+    id: "createTask",
+    method: HttpMethod.POST,
+    path: "/tasks",
+    tag: ApiTag.TASKS,
+    summary: "Create a task",
+    description: "Creates a Kanban task checklist owned by the API key owner. Send statuses to pick your own columns.",
+    body: taskCreateBody,
+    responses: {
+      200: { description: "Created task", schema: envelope(taskSchema) },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const formData = new FormData();
+    formData.append("title", body.title);
+    formData.append("category", body.category);
+    formData.append("type", ChecklistsTypes.KANBAN);
 
-      return NextResponse.json({ success: true, data: transformedTask });
-    } catch (error) {
-      console.error("API Error:", error);
-      return NextResponse.json(
-        {
-          error:
-            error instanceof Error ? error.message : "Internal server error",
-        },
-        { status: 500 },
-      );
+    const result = await makeList(user, formData, body.statuses?.map(_toStatus));
+    if (result.error || !result.data) {
+      console.error("Create task error:", result.error);
+      return refuse(result.error || "Failed to create task", 400);
     }
-  });
-}
+
+    return NextResponse.json({ success: true, data: { ...toApiTask(result.data), items: [] } });
+  },
+);
diff --git a/app/api/user/[username]/route.ts b/app/api/user/[username]/route.ts
index 593ba6aa8..58216a999 100644
--- a/app/api/user/[username]/route.ts
+++ b/app/api/user/[username]/route.ts
@@ -1,42 +1,43 @@
+import { NextResponse } from "next/server";
 import { findUserRecord } from "@/app/_server/actions/users/records";
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { userLookupSchema, usernameParams } from "@/app/_schemas/api/users";
 import { sanitizeUserForClient } from "@/app/_utils/user-sanitize-utils";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest, props: { params: Promise<{ username: string }> }) {
-  const params = await props.params;
-  return withApiAuth(request, async (user) => {
-    try {
-      const { username } = params;
+export const GET = defineRoute(
+  {
+    id: "getUser",
+    method: HttpMethod.GET,
+    path: "/user/{username}",
+    tag: ApiTag.USERS,
+    summary: "Get a user",
+    description: "The full profile for yourself, or for anybody when you are an admin. Everybody else gets the public fields only.",
+    params: usernameParams,
+    responses: {
+      200: { description: "The user", schema: userLookupSchema },
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, params }) => {
+    const target = await findUserRecord(params.username);
+    if (!target) return refuse("User not found", 404);
 
-      const targetUser = await findUserRecord(username);
-
-      if (!targetUser) {
-        return NextResponse.json({ error: "User not found" }, { status: 404 });
-      }
-
-      const isOwnProfile = user.username === username;
-      const isAdminUser = user.isAdmin;
-
-      if (isOwnProfile || isAdminUser) {
-        return NextResponse.json({ user: sanitizeUserForClient(targetUser) });
-      }
-
-      return NextResponse.json({
-        user: {
-          username: targetUser.username,
-          avatarUrl: targetUser.avatarUrl,
-          preferredTheme: targetUser.preferredTheme,
-        },
-      });
-    } catch (error) {
-      console.error("Error fetching user info:", error);
-      return NextResponse.json(
-        { error: "Internal Server Error" },
-        { status: 500 }
-      );
+    if (user.username === params.username || user.isAdmin) {
+      return NextResponse.json({ user: sanitizeUserForClient(target) });
     }
-  });
-}
+
+    return NextResponse.json({
+      user: {
+        username: target.username,
+        avatarUrl: target.avatarUrl,
+        preferredTheme: target.preferredTheme,
+      },
+    });
+  },
+);
diff --git a/app/api/user/route.ts b/app/api/user/route.ts
index c4e7d03f6..173141df6 100644
--- a/app/api/user/route.ts
+++ b/app/api/user/route.ts
@@ -1,19 +1,28 @@
-import { NextRequest, NextResponse } from "next/server";
-import { withApiAuth } from "@/app/_utils/api-utils";
+import { NextResponse } from "next/server";
+import { findUserRecord } from "@/app/_server/actions/users/records";
+import { defineRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { currentUserSchema } from "@/app/_schemas/api/users";
 
 export const dynamic = "force-dynamic";
 
-export async function GET(request: NextRequest) {
-  return withApiAuth(request, async (user) => {
-    try {
-      const { passwordHash, apiKey, ...safeUserData } = user;
-      return NextResponse.json({ user: safeUserData });
-    } catch (error) {
-      console.error("Error fetching user info:", error);
-      return NextResponse.json(
-        { error: "Internal Server Error" },
-        { status: 500 }
-      );
-    }
-  });
-}
+export const GET = defineRoute(
+  {
+    id: "getCurrentUser",
+    method: HttpMethod.GET,
+    path: "/user",
+    tag: ApiTag.USERS,
+    summary: "Get the API key owner",
+    description: "Your own profile and preferences. Password hash, API key and MFA secrets are never included.",
+    responses: {
+      200: { description: "Your profile", schema: currentUserSchema },
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user }) => {
+    const record = await findUserRecord(user.username);
+    return NextResponse.json({ user: { ...user, lastLogin: record?.lastLogin } });
+  },
+);
diff --git a/docker-compose.mcp.yml b/docker-compose.mcp.yml
new file mode 100644
index 000000000..08e92ce42
--- /dev/null
+++ b/docker-compose.mcp.yml
@@ -0,0 +1,55 @@
+# Jotty + jotty-mcp on one network.
+# Good for: letting MCP clients (Claude, Cursor, ...) work with your notes,
+# checklists and boards next to the normal web UI. The MCP server reaches
+# Jotty internally at http://jotty:3000, so it never leaves the network.
+#
+# Setup:
+#   mkdir -p ./data ./config ./cache && sudo chown -R 1000:1000 ./data ./config ./cache
+#   docker compose -f docker-compose.mcp.yml up -d --build
+#
+# MCP endpoint: http://localhost:3001/mcp
+# Every client sends its own Jotty API key in the x-api-key header, so each
+# session acts as that user. More in mcp-server/README.md.
+
+services:
+  jotty:
+    image: ghcr.io/fccview/jotty:latest
+    container_name: jotty
+    user: "1000:1000"
+    ports:
+      - "1122:3000"
+    volumes:
+      - ./data:/app/data:rw
+      - ./config:/app/config:rw
+      - ./cache:/app/.next/cache:rw
+    networks: [jotty-net]
+    restart: unless-stopped
+    environment:
+      - NODE_ENV=production
+
+  jotty-mcp:
+    build: ./mcp-server
+    container_name: jotty-mcp
+    depends_on:
+      - jotty
+    ports:
+      - "3001:3001"
+    networks: [jotty-net]
+    restart: unless-stopped
+    environment:
+      JOTTY_URL: "http://jotty:3000"
+      JOTTY_MCP_TRANSPORT: "http"
+      JOTTY_MCP_PORT: "3001"
+      # Clients must send "Authorization: Bearer <token>". Leave it empty only
+      # on a network you trust.
+      JOTTY_MCP_AUTH_TOKEN: "changeme"
+      # Optional fallback key for clients that can't send x-api-key. Anyone who
+      # reaches port 3001 with the token above then acts as this user.
+      JOTTY_API_KEY: ""
+      # Caps the visible text of a result for small context windows. The full
+      # response is always in structuredContent.
+      JOTTY_MCP_MAX_TEXT_CHARS: "12000"
+
+networks:
+  jotty-net:
+    driver: bridge
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 55db59012..ea2fd81f1 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -1,7 +1,7 @@
-import { defineConfig } from "eslint/config";
+import { defineConfig, globalIgnores } from "eslint/config";
 import nextCoreWebVitals from "eslint-config-next/core-web-vitals";
 
-export default defineConfig([{
+export default defineConfig([globalIgnores(["mcp-server/**"]), {
     extends: [...nextCoreWebVitals],
 
     rules: {
diff --git a/howto/API.md b/howto/API.md
index 51aa179d2..0a38b0300 100644
--- a/howto/API.md
+++ b/howto/API.md
@@ -1,1905 +1,82 @@
 # Jotty API
 
-The REST API reads and writes your notes and checklists. Everything except the health check needs an API key.
+The REST API reads and writes your notes, checklists, tasks and Kanban boards. Everything except the health check needs an API key, and every request acts as the user who owns that key.
 
-## Authentication
+**Every endpoint is documented in the API explorer at the top of How to > API in Jotty.** It lists each one with its parameters, request body and responses, and lets you send real requests from the page. It's built from the code that serves the API, so it always matches the version you're running. Demo instances don't show it.
 
-### Getting an API key
+## Getting an API key
 
 1. Log into Jotty
 2. Open your **Profile** by clicking your username in the sidebar
 3. Go to the **Settings** tab
 4. In the **API Key** section, click **Generate**
 5. Copy the key. It starts with `ck_` followed by random characters
-6. Keep it somewhere safe. Anyone holding it has full access to your account
 
-### Using your API key
+Anyone holding the key can do everything you can, so keep it somewhere safe. Generating a new one replaces the old one.
 
-Send it in the `x-api-key` header:
+## Using it
 
-```
-x-api-key: ck_your_api_key_here
-```
-
-Every example in this file uses `ck_your_api_key_here`. Swap in your own key.
-
-## Interactive API docs
-
-Jotty can serve an OpenAPI spec that ReDoc renders as a browsable reference, with request and response examples for every endpoint.
-
-### Running the API docs
-
-ReDoc runs as its own Docker service and reads the spec from your running Jotty instance, so Jotty has to be up first.
-
-#### Using Docker Compose
-
-1. Set `ENABLE_API_DOCS` to `true` in the Jotty service of your `docker-compose.yml`:
-
-   ```yaml
-   environment:
-     - ENABLE_API_DOCS=true
-   ```
-
-   Then add the ReDoc service underneath your Jotty service:
-
-   ```yaml
-    api-docs:
-        image: redocly/redoc:latest
-        container_name: jotty-api-docs
-        ports:
-          - "40126:80"
-        environment:
-          SPEC_URL: http://your-jotty-url.com/api/docs
-        extra_hosts:
-          - "host.docker.internal:host-gateway"
-        depends_on:
-          - jotty
-        profiles:
-          - api-docs
-    ```
-
-
-    `SPEC_URL` has to point at the `/api/docs` endpoint of your Jotty instance, and that endpoint only answers when `ENABLE_API_DOCS=true` is set on Jotty.
-
-2. Start it with the `api-docs` profile:
-
-   ```bash
-   docker-compose --profile api-docs up -d
-   ```
-
-3. Open `http://localhost:40126`, or whichever host and port you mapped it to.
-
-The spec comes from the running instance, so the docs always match the version of Jotty you have deployed.
-
-### Troubleshooting
-
-**The docs page says "Failed to load"**
-- Check that `ENABLE_API_DOCS=true` is set on the Jotty service
-- Check that Jotty is running and ReDoc can reach it
-- Check that `SPEC_URL` points at your instance's `/api/docs`
-
-**Nothing answers on the port you expected**
-- See whether something else already has the port: `netstat -tlnp | grep :8080`
-- Check the port mapping in your docker-compose.yml
-- Check the api-docs container is running: `docker ps | grep api-docs`
-
-**Requests fail with an auth error in the docs**
-- Check the API key is valid and belongs to a user allowed to do what you're trying
-- Check the header is spelled `x-api-key: ck_your_key_here`
-
-## Identification
-
-Every note and checklist has a UUID, a 36-character string such as `f47ac10b-58cc-4372-a567-0e02b2c3d479`. Endpoints take the UUID, not the title.
-
-> **Deprecated: slug/category lookups.** A legacy filename slug still works as the item id, optionally with a `?category=` query parameter that defaults to "Uncategorized". Every such request logs a deprecation warning, and this fallback **will be removed in a future release**. All `id` fields in API responses are UUIDs, so switch any stored slugs to those now.
-
-## Organization
-
-### Categories
-
-Every note and checklist sits in a category, such as "Work", "Personal" or "Shopping". Categories can nest.
-
-- Items created without a category go into "Uncategorized"
-- The list endpoints take a `category` filter
-- The summary endpoint breaks counts down per category
-
-### Checklist types
-
-There are two kinds of checklist.
-
-### Regular checklists
-
-Plain to-do and shopping lists. Items only have `text` and `completed`.
-
-### Task checklists
-
-Checklists for projects and time tracking. Items also carry:
-- `status`: `in_progress`, `paused` or `completed`
-- `time`: either `0` or a JSON array of time entries
-
-## Public endpoints
-
-These need no API key.
-
-### 1. Health check
-
-**GET** `/api/health`
-
-Returns whether the app is up and which version it is running. Point your uptime monitor or load balancer at it.
-
-**Response:**
-
-```json
-{
-  "status": "healthy",
-  "version": "1.9.3",
-  "timestamp": "2025-10-31T21:15:57.009Z"
-}
-```
-
-**Response fields:**
-
-- `status`: "healthy" or "unhealthy"
-- `version`: the version from package.json, or null if it couldn't be read
-- `timestamp`: current server time in ISO 8601
-- `error`: the error message, only present when status is "unhealthy"
-
-Anyone can call it, logged in or not.
-
-## Authenticated endpoints
-
-Everything from here on needs an API key.
-
-### 2. Get all checklists
-
-**GET** `/api/checklists`
-
-Returns every checklist you own.
-
-**Query parameters:**
-
-- `category` (optional): only checklists in this category
-- `type` (optional): `simple` or `task`
-- `q` (optional): search titles and item text
-
-**Response:**
-
-```json
-{
-  "checklists": [
-    {
-      "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
-      "title": "My Tasks",
-      "category": "Work",
-      "type": "regular",
-      "items": [
-        {
-          "index": 0,
-          "text": "Task 1",
-          "completed": false
-        },
-        {
-          "index": 1,
-          "text": "Task 2",
-          "completed": true
-        }
-      ],
-      "createdAt": "2024-01-01T00:00:00.000Z",
-      "updatedAt": "2024-01-01T00:00:00.000Z"
-    },
-    {
-      "id": "550e8400-e29b-41d4-a716-446655440000",
-      "title": "Project Tasks",
-      "category": "Work",
-      "type": "task",
-      "items": [
-        {
-          "index": 0,
-          "text": "Task with status",
-          "completed": false,
-          "status": "in_progress",
-          "time": 0
-        },
-        {
-          "index": 1,
-          "text": "Task with time tracking",
-          "completed": false,
-          "status": "paused",
-          "time": [
-            {
-              "id": "1757951487325",
-              "startTime": "2025-09-15T15:51:24.610Z",
-              "endTime": "2025-09-15T15:51:27.325Z",
-              "duration": 2
-            }
-          ]
-        }
-      ],
-      "createdAt": "2024-01-01T00:00:00.000Z",
-      "updatedAt": "2024-01-01T00:00:00.000Z"
-    }
-  ]
-}
-```
-
-Every checklist has a `category`. Checklists created without one are in "Uncategorized".
-
-### 3. Create checklist
-
-**POST** `/api/checklists`
-
-Creates a checklist owned by you.
-
-**Request body:**
-
-```json
-{
-  "title": "My New Checklist",
-  "category": "Work",
-  "type": "simple"
-}
-```
-
-**Parameters:**
-
-- `title` (required): the checklist title
-- `category` (optional): defaults to "Uncategorized"
-- `type` (optional): `simple` or `task`, defaults to "simple"
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "data": {
-    "id": "550e8400-e29b-41d4-a716-446655440000",
-    "title": "My New Checklist",
-    "category": "Work",
-    "type": "simple",
-    "items": [],
-    "createdAt": "2024-01-01T00:00:00.000Z",
-    "updatedAt": "2024-01-01T00:00:00.000Z"
-  }
-}
-```
-
-### 4. Update checklist
-
-**PUT** `/api/checklists/{listId}`
-
-Changes a checklist's title, category or both.
-
-**Request body:**
-
-```json
-{
-  "title": "Updated Checklist Title",
-  "category": "Personal"
-}
-```
-
-**Parameters:**
-
-- `title` (optional): the new title
-- `category` (optional): the new category
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "data": {
-    "id": "550e8400-e29b-41d4-a716-446655440000",
-    "title": "Updated Checklist Title",
-    "category": "Personal",
-    "type": "simple",
-    "createdAt": "2024-01-01T00:00:00.000Z",
-    "updatedAt": "2024-01-01T12:30:00.000Z"
-  }
-}
-```
-
-### 5. Delete checklist
-
-**DELETE** `/api/checklists/{listId}`
-
-Deletes a checklist.
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-### 6. Create checklist item
-
-**POST** `/api/checklists/{listId}/items`
-
-Adds an item to a checklist.
-
-**Request body for regular checklists:**
-
-```json
-{
-  "text": "New task to complete"
-}
-```
-
-**Request body for task checklists:**
-
-```json
-{
-  "text": "New task to complete",
-  "status": "in_progress",
-  "time": 0
-}
-```
-
-**Task checklist parameters:**
-
-- `text` (required): what the task is
-- `status` (optional): `"in_progress"`, `"paused"` or `"completed"`, defaults to `"in_progress"`
-- `time` (optional): `0` for no time tracked, or a JSON array of time entries. Defaults to `0`
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-**Creating nested sub-items:**
-
-To put the new item under an existing one, send `parentIndex` with the parent's index path:
-
-```json
-{
-  "text": "Sub-task of first item",
-  "parentIndex": "0"
-}
-```
-
-Index paths are dot-separated, one number per level:
-- `"0"` puts it under the first top-level item
-- `"0.1"` puts it under the second child of the first item
-- `"2.0.1"` puts it under the second child of the first child of the third top-level item
-
-**Nested items in responses:**
-
-An item with sub-items has a `children` array:
-
-```json
-{
-  "items": [
-    {
-      "id": "list-123",
-      "index": 0,
-      "text": "Parent Task",
-      "completed": false,
-      "status": "in_progress",
-      "description": "Implementation notes",
-      "priority": "high",
-      "score": 5,
-      "startDate": "2026-06-10",
-      "targetDate": "2026-06-15",
-      "estimatedTime": 2.5,
-      "createdBy": "alice",
-      "createdAt": "2026-06-01T09:00:00.000Z",
-      "lastModifiedBy": "alice",
-      "lastModifiedAt": "2026-06-02T10:30:00.000Z",
-      "history": [
-        {
-          "status": "in_progress",
-          "timestamp": "2026-06-01T09:00:00.000Z",
-          "user": "alice"
-        }
-      ],
-      "children": [
-        {
-          "id": "list-sub-456",
-          "index": 0,
-          "text": "Sub-task 1",
-          "completed": false
-        },
-        {
-          "id": "list-sub-789",
-          "index": 1,
-          "text": "Sub-task 2",
-          "completed": true,
-          "children": [
-            {
-              "id": "list-sub-sub-999",
-              "index": 0,
-              "text": "Nested sub-task",
-              "completed": false
-            }
-          ]
-        }
-      ]
-    }
-  ]
-}
-```
-
-### Update checklist item
-
-**PATCH** `/api/checklists/{listId}/items/{itemIndex}`
-
-Changes any of the writable fields on an item. Fields you leave out stay as they are. `itemIndex` can be a nested index path.
-
-**Request body:**
-
-```json
-{
-  "text": "Updated task title",
-  "description": "Additional notes",
-  "priority": "high",
-  "score": 5,
-  "startDate": "2026-06-10",
-  "targetDate": "2026-06-15",
-  "estimatedTime": 2.5
-}
-```
-
-**Writable fields:**
-
-- `text` (optional): the item title
-- `description` (optional): the item body or notes
-- `priority` (optional): `"critical"`, `"high"`, `"medium"`, `"low"` or `"none"`
-- `score` (optional): a number
-- `startDate` (optional): an ISO date string
-- `targetDate` (optional): an ISO date string
-- `estimatedTime` (optional): estimated hours
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-### 7. Check item
-
-**PUT** `/api/checklists/{listId}/items/{itemIndex}/check`
-
-Marks an item as done. `itemIndex` can be a nested index path.
-
-**Examples:**
-- `/api/checklists/{listId}/items/0/check` checks the first top-level item
-- `/api/checklists/{listId}/items/0.1/check` checks the second child of the first item
-- `/api/checklists/{listId}/items/2.0.1/check` checks a grandchild
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-### 8. Uncheck item
-
-**PUT** `/api/checklists/{listId}/items/{itemIndex}/uncheck`
-
-Marks an item as not done. `itemIndex` can be a nested index path.
-
-**Examples:**
-- `/api/checklists/{listId}/items/1/uncheck` unchecks the second top-level item
-- `/api/checklists/{listId}/items/0.0/uncheck` unchecks the first child of the first item
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-### 9. Delete item
-
-**DELETE** `/api/checklists/{listId}/items/{itemIndex}`
-
-Deletes a checklist item. `itemIndex` can be a nested index path.
-
-**Examples:**
-- `/api/checklists/{listId}/items/2` deletes the third top-level item
-- `/api/checklists/{listId}/items/0.1` deletes the second child of the first item
-- `/api/checklists/{listId}/items/1.0.2` deletes a grandchild
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-### 10. Get all notes
-
-**GET** `/api/notes`
-
-Returns every note you own.
-
-**Query parameters:**
-
-- `category` (optional): only notes in this category
-- `q` (optional): search titles and content
-
-**Response:**
-
-```json
-{
-  "notes": [
-    {
-      "id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-      "title": "My Note",
-      "category": "Personal",
-      "content": "Note content here...",
-      "createdAt": "2024-01-01T00:00:00.000Z",
-      "updatedAt": "2024-01-01T00:00:00.000Z"
-    }
-  ]
-}
-```
-
-Every note has a `category`. Notes created without one are in "Uncategorized".
-
-### 11. Create note
-
-**POST** `/api/notes`
-
-Creates a note owned by you.
-
-**Request body:**
-
-```json
-{
-  "title": "My New Note",
-  "content": "Note content here...",
-  "category": "Personal"
-}
-```
-
-**Parameters:**
-
-- `title` (required): the note title
-- `content` (optional): the body in markdown, defaults to an empty string
-- `category` (optional): defaults to "Uncategorized"
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "data": {
-    "id": "note-123",
-    "title": "My New Note",
-    "content": "Note content here...",
-    "category": "Personal",
-    "createdAt": "2024-01-01T00:00:00.000Z",
-    "updatedAt": "2024-01-01T00:00:00.000Z",
-    "owner": "username"
-  }
-}
-```
-
-### 12. Update note
-
-**PUT** `/api/notes/{noteId}`
-
-Updates a note.
-
-**Request body:**
-
-```json
-{
-  "title": "Updated Note Title",
-  "content": "Updated note content...",
-  "category": "Work",
-  "originalCategory": "Personal"
-}
-```
-
-**Parameters:**
-
-- `title` (required): the new title
-- `content` (optional): the new body in markdown
-- `category` (optional): the category to put it in, defaults to "Uncategorized"
-- `originalCategory` (optional): the category the note is in now, used to find it
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "data": {
-    "id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-    "title": "Updated Note Title",
-    "content": "Updated note content...",
-    "category": "Work",
-    "createdAt": "2024-01-01T00:00:00.000Z",
-    "updatedAt": "2024-01-02T10:30:00.000Z",
-    "owner": "username"
-  }
-}
-```
-
-### 13. Delete note
-
-**DELETE** `/api/notes/{noteId}`
-
-Deletes a note.
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-## Tasks
-
-The `/tasks` endpoints work on task checklists as Kanban boards. Each board has its own list of statuses, one per column, and every item sits in one of them.
-
-### 14. Get all tasks
-
-**GET** `/api/tasks`
-
-Returns every task checklist you own.
-
-**Query parameters:**
-
-- `category` (optional): only tasks in this category
-- `status` (optional): only tasks with at least one item in this status
-- `q` (optional): search titles and item text
-
-**Response:**
-
-```json
-{
-  "tasks": [
-    {
-      "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
-      "title": "Sprint Tasks",
-      "category": "Work",
-      "statuses": [
-        { "id": "todo", "label": "To Do", "order": 0 },
-        { "id": "in_progress", "label": "In Progress", "order": 1 },
-        { "id": "completed", "label": "Completed", "order": 2 }
-      ],
-      "items": [
-        {
-          "id": "task-1",
-          "index": 0,
-          "text": "Implement user authentication",
-          "status": "in_progress",
-          "completed": false
-        }
-      ],
-      "createdAt": "2024-01-01T00:00:00.000Z",
-      "updatedAt": "2024-01-01T00:00:00.000Z"
-    }
-  ]
-}
-```
-
-### 15. Create task
-
-**POST** `/api/tasks`
-
-Creates a task checklist owned by you.
-
-**Request body:**
-
-```json
-{
-  "title": "New Sprint",
-  "category": "Work",
-  "statuses": [
-    { "id": "todo", "label": "To Do", "order": 0 },
-    { "id": "review", "label": "In Review", "order": 1, "color": "#3b82f6" },
-    { "id": "done", "label": "Done", "order": 2 }
-  ]
-}
-```
-
-**Parameters:**
-
-- `title` (required): the task checklist title
-- `category` (optional): defaults to "Uncategorized"
-- `statuses` (optional): your own Kanban columns, defaults to todo/in_progress/completed
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "data": {
-    "id": "550e8400-e29b-41d4-a716-446655440000",
-    "title": "New Sprint",
-    "category": "Work",
-    "statuses": [
-      { "id": "todo", "label": "To Do", "order": 0 },
-      { "id": "review", "label": "In Review", "order": 1, "color": "#3b82f6" },
-      { "id": "done", "label": "Done", "order": 2 }
-    ],
-    "items": [],
-    "createdAt": "2024-01-01T00:00:00.000Z",
-    "updatedAt": "2024-01-01T00:00:00.000Z"
-  }
-}
-```
-
-### 16. Get task
-
-**GET** `/api/tasks/{taskId}`
-
-Returns one task checklist.
-
-**Response:**
-
-```json
-{
-  "task": {
-    "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
-    "title": "Sprint Tasks",
-    "category": "Work",
-    "statuses": [
-      { "id": "todo", "label": "To Do", "order": 0 },
-      { "id": "in_progress", "label": "In Progress", "order": 1 },
-      { "id": "completed", "label": "Completed", "order": 2 }
-    ],
-    "items": [
-      {
-        "id": "task-1",
-        "index": 0,
-        "text": "Implement user authentication",
-        "status": "in_progress",
-        "completed": false
-      }
-    ],
-    "createdAt": "2024-01-01T00:00:00.000Z",
-    "updatedAt": "2024-01-01T00:00:00.000Z"
-  }
-}
-```
-
-### 17. Update task
-
-**PUT** `/api/tasks/{taskId}`
-
-Changes the title, the category or both. Both fields are optional.
-
-**Request body:**
-
-```json
-{
-  "title": "Updated Sprint Title",
-  "category": "Projects"
-}
-```
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "data": {
-    "id": "550e8400-e29b-41d4-a716-446655440000",
-    "title": "Updated Sprint Title",
-    "category": "Projects",
-    "statuses": [...],
-    "createdAt": "2024-01-01T00:00:00.000Z",
-    "updatedAt": "2024-01-01T12:30:00.000Z"
-  }
-}
-```
-
-### 18. Delete task
-
-**DELETE** `/api/tasks/{taskId}`
-
-Deletes a task checklist.
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-### 19. Get task statuses
-
-**GET** `/api/tasks/{taskId}/statuses`
-
-Returns the Kanban columns of a task.
-
-**Response:**
-
-```json
-{
-  "statuses": [
-    { "id": "todo", "label": "To Do", "order": 0 },
-    { "id": "in_progress", "label": "In Progress", "order": 1 },
-    { "id": "completed", "label": "Completed", "order": 2 }
-  ]
-}
-```
-
-### 20. Create status
-
-**POST** `/api/tasks/{taskId}/statuses`
-
-Adds a Kanban column to a task.
-
-**Request body:**
-
-```json
-{
-  "id": "review",
-  "label": "In Review",
-  "color": "#3b82f6",
-  "order": 2
-}
-```
-
-**Parameters:**
-
-- `id` (required): a unique id for the status
-- `label` (required): the column name people see
-- `color` (optional): the column color
-- `order` (optional): where the column goes, defaults to last
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "data": {
-    "id": "review",
-    "label": "In Review",
-    "color": "#3b82f6",
-    "order": 2
-  }
-}
-```
-
-### 21. Update status
-
-**PUT** `/api/tasks/{taskId}/statuses/{statusId}`
-
-Changes a Kanban column.
-
-**Request body:**
-
-```json
-{
-  "label": "Code Review",
-  "color": "#8b5cf6",
-  "order": 3
-}
-```
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "data": {
-    "id": "review",
-    "label": "Code Review",
-    "color": "#8b5cf6",
-    "order": 3
-  }
-}
-```
-
-### 22. Delete status
-
-**DELETE** `/api/tasks/{taskId}/statuses/{statusId}`
-
-Deletes a Kanban column. Items in it move to the first remaining status.
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-### 23. Create task item
-
-**POST** `/api/tasks/{taskId}/items`
-
-Adds an item to a task checklist.
-
-**Request body:**
-
-```json
-{
-  "text": "Implement user authentication",
-  "status": "todo"
-}
-```
-
-**Creating nested items:**
-
-To put the new item under an existing one, send `parentIndex` with the parent's index path:
-
-```json
-{
-  "text": "Sub-task: Add login form",
-  "status": "todo",
-  "parentIndex": "0"
-}
-```
-
-Index path examples:
-- `"0"` puts it under the first top-level item
-- `"0.1"` puts it under the second child of the first item
-- `"2.0.1"` puts it under the second child of the first child of the third top-level item
-
-**Parameters:**
-
-- `text` (required): the item text
-- `status` (optional): the starting status, defaults to "todo"
-- `parentIndex` (optional): index path of the parent item
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "data": {
-    "id": "task-item-1234567890"
-  }
-}
-```
-
-### Get task item
-
-**GET** `/api/tasks/{taskId}/items/{itemIndex}`
-
-Returns one task item with its `children` and Kanban fields. `itemIndex` can be a nested index path.
-
-**Response:**
-
-```json
-{
-  "item": {
-    "id": "task-item-1234567890",
-    "index": 0,
-    "text": "Implement user authentication",
-    "completed": false,
-    "status": "todo",
-    "time": 0,
-    "description": "Add login and token refresh",
-    "priority": "high",
-    "score": 5,
-    "startDate": "2026-06-10",
-    "targetDate": "2026-06-15",
-    "estimatedTime": 2.5,
-    "createdBy": "alice",
-    "createdAt": "2026-06-01T09:00:00.000Z",
-    "lastModifiedBy": "alice",
-    "lastModifiedAt": "2026-06-02T10:30:00.000Z",
-    "history": [
-      {
-        "status": "todo",
-        "timestamp": "2026-06-01T09:00:00.000Z",
-        "user": "alice"
-      }
-    ],
-    "children": []
-  }
-}
-```
-
-### 24. Update item status
-
-**PUT** `/api/tasks/{taskId}/items/{itemIndex}/status`
-
-Moves an item to another Kanban column by changing its status.
-
-**Request body:**
-
-```json
-{
-  "status": "in_progress"
-}
-```
-
-**Parameters:**
-
-- `status` (required): the new status
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-**Example, moving a nested item:**
-
-```bash
-PUT /api/tasks/550e8400-e29b-41d4-a716-446655440000/items/0.1/status
-{
-  "status": "completed"
-}
-```
-
-### 25. Delete task item
-
-**DELETE** `/api/tasks/{taskId}/items/{itemIndex}`
-
-Deletes an item from a task checklist.
-
-**Response:**
-
-```json
-{
-  "success": true
-}
-```
-
-**Example, deleting a nested item:**
-
-```bash
-DELETE /api/tasks/550e8400-e29b-41d4-a716-446655440000/items/0.1
-```
-
-This deletes the second child of the first top-level item.
-
-### 26. Get user information
-
-**GET** `/api/user/{username}`
-
-Returns a user's profile. You get the full record for yourself, or for anyone if you are an admin. Everybody else gets the public fields only.
-
-**Response (own profile or admin):**
-
-```json
-{
-  "user": {
-    "username": "fccview",
-    "isAdmin": true,
-    "createdAt": "2024-01-01T00:00:00.000Z",
-    "lastLogin": "2024-01-15T10:30:00.000Z",
-    "avatarUrl": "https://example.com/avatar.jpg",
-    "preferredTheme": "dark",
-    "imageSyntax": "markdown",
-    "tableSyntax": "markdown",
-    "landingPage": "checklists",
-    "notesAutoSaveInterval": 5000,
-    "notesDefaultEditor": "wysiwyg",
-    "notesDefaultMode": "edit",
-    "pinnedLists": ["Work/project-tasks"],
-    "pinnedNotes": ["Personal/important-note"]
-  }
-}
-```
-
-**Response (Public):**
-
-```json
-{
-  "user": {
-    "username": "fccview",
-    "avatarUrl": "https://example.com/avatar.jpg",
-    "preferredTheme": "dark"
-  }
-}
-```
-
-`passwordHash`, `apiKey` and other secrets are never in the response.
-
-### 27. Get all categories
-
-**GET** `/api/categories`
-
-Returns your note and checklist categories. Archived categories are left out.
-
-**Response:**
-
-```json
-{
-  "categories": {
-    "notes": [
-      {
-        "name": "Personal",
-        "path": "Personal",
-        "count": 5,
-        "level": 0
-      },
-      {
-        "name": "Work",
-        "path": "Work",
-        "count": 3,
-        "level": 0
-      },
-      {
-        "name": "Projects",
-        "path": "Work/Projects",
-        "count": 2,
-        "level": 1
-      }
-    ],
-    "checklists": [
-      {
-        "name": "Shopping",
-        "path": "Shopping",
-        "count": 4,
-        "level": 0
-      },
-      {
-        "name": "Work",
-        "path": "Work",
-        "count": 6,
-        "level": 0
-      }
-    ]
-  }
-}
-```
-
-**Response fields:**
-
-- `name`: the category name
-- `path`: the full path, parent categories included
-- `count`: how many items are in it
-- `level`: how deep it is nested, 0 for top-level categories
-
-### 28. Rebuild link index
-
-**POST** `/api/admin/rebuild-index`
-
-Rebuilds the relationships index, the list of which notes and checklists link to each other. Jotty keeps it up to date on its own and checks it against your files every minute, so you only need this after editing lots of files outside Jotty, restoring a backup, or if the brain looks wrong.
-
-**Request body:**
-
-```json
-{
-  "username": "fccview"
-}
-```
-
-**Parameters:**
-
-- `username` (optional): Whose index to rebuild. Leave it out to rebuild your own. Only admins can name somebody else.
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "message": "Successfully rebuilt link index for fccview"
-}
-```
-
-**Errors:**
-
-- `401`: missing or invalid API key
-- `403`: you named another user and your API key does not belong to an admin
-- `404`: no user with that username
-
-**Notes:**
-
-- Any user can rebuild their own index. Rebuilding everybody at once is in **Admin > Content**
-- Rebuilding reads your notes and checklists and never changes them
-- Encrypted notes are skipped, their content is never read
-- Wikilinks keep pointing at the note they were first matched to, so a rebuild does not move them onto a different note with the same title
-- The index lives in `data/.relations.db`. If it is deleted, Jotty rebuilds it from your files
-
-### 29. Get user summary statistics
-
-**GET** `/api/summary`
-
-Returns counts for your notes, checklists, items and tasks, broken down by category.
-
-**Query parameters:**
-
-- `username` (optional): whose summary to return. Leave it out for your own. Only admins can ask for somebody else's.
-
-**Response:**
-
-```json
-{
-  "summary": {
-    "username": "fccview",
-    "notes": {
-      "total": 4,
-      "categories": {
-        "Personal": 2,
-        "Work": 2
-      }
-    },
-    "checklists": {
-      "total": 6,
-      "categories": {
-        "Work": 3,
-        "Personal": 2,
-        "Uncategorized": 1
-      },
-      "types": {
-        "simple": 4,
-        "task": 2
-      }
-    },
-    "items": {
-      "total": 27,
-      "completed": 3,
-      "pending": 24,
-      "completionRate": 11
-    },
-    "tasks": {
-      "total": 14,
-      "completed": 0,
-      "inProgress": 8,
-      "todo": 6,
-      "completionRate": 0
-    }
-  }
-}
-```
-
-**Response fields:**
-
-- `notes.total`: number of notes
-- `notes.categories`: notes per category
-- `checklists.total`: number of checklists
-- `checklists.categories`: checklists per category
-- `checklists.types`: checklists per type, simple or task
-- `items.total`: number of checklist items
-- `items.completed`: items ticked off
-- `items.pending`: items not ticked off
-- `items.completionRate`: percentage of items completed, 0-100
-- `tasks.total`: number of tasks in task checklists
-- `tasks.completed`: tasks completed
-- `tasks.inProgress`: tasks in progress
-- `tasks.todo`: tasks not started
-- `tasks.completionRate`: percentage of tasks completed, 0-100
-
-## Error responses
-
-Status codes you can get back:
-
-- `200`: success
-- `400`: bad request, usually a missing or invalid parameter
-- `401`: missing or invalid API key
-- `403`: you're not allowed to do that, usually because it needs an admin
-- `404`: the checklist, note or item doesn't exist
-- `500`: something broke on the server
-
-Errors come back as:
-
-```json
-{
-  "error": "Error message description"
-}
-```
-
-## Export endpoints
-
-### 1. Request data export
-
-**POST** `/api/exports`
-
-Starts an export and returns the URL to download it from.
-
-**Request body:**
-
-```json
-{
-  "type": "<export_type>",
-  "username"?: "<username>"
-}
-```
-
-**Export types:**
-
-- `all_checklists_notes`: every checklist and note, for every user
-- `user_checklists_notes`: every checklist and note for one user. Needs `username` in the body
-- `all_users_data`: the user records
-- `whole_data_folder`: the whole data folder, minus temporary export files
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "downloadUrl": "/api/exports/all_checklists_notes_1678886400000.zip"
-}
-```
-
-### 2. Get export progress
-
-**GET** `/api/exports`
-
-Returns how far along the running export is.
-
-**Response:**
-
-```json
-{
-  "progress": 75,
-  "message": "Compressing files: 150/200 bytes"
-}
-```
-
-## Audit logs
-
-Jotty writes an audit log entry for logins, edits, shares and other user actions. These endpoints read, export, summarise and clean up those entries.
-
-### GET /logs
-
-Returns audit log entries, filtered and paginated.
-
-**Access:**
-- Users see their own logs
-- Admins see everybody's
-
-**Query parameters:**
-
-| Parameter | Type | Required | Description |
-|-----------|------|----------|-------------|
-| username | string | No | Only this user's entries. Admin only, non-admins always get their own |
-| action | string | No | Action type, such as "login", "logout" or "checklist_created" |
-| category | string | No | One of auth, user, checklist, note, sharing, settings, encryption, api, system, file, upload |
-| level | string | No | DEBUG, INFO, WARNING, ERROR or CRITICAL |
-| startDate | string (ISO 8601) | No | Start of the range (default: 30 days ago) |
-| endDate | string (ISO 8601) | No | End of the range (default: now) |
-| success | boolean | No | Only entries that succeeded, or only ones that failed |
-| limit | integer | No | How many entries to return (default: 50) |
-| offset | integer | No | How many entries to skip (default: 0) |
-
-**Request example:**
-
-```bash
-curl -X GET "http://localhost:3000/api/logs?category=auth&limit=10&success=true" \
-  -H "x-api-key: YOUR_API_KEY"
-```
-
-**Response:**
-
-```json
-{
-  "success": true,
-  "logs": [
-    {
-      "id": "1766778674300",
-      "uuid": "4a0d76b5-18de-400c-8b36-5fbdd9d8299b",
-      "timestamp": "2025-12-26T19:51:14.300Z",
-      "level": "INFO",
-      "username": "fccview",
-      "action": "login",
-      "category": "auth",
-      "resourceType": null,
-      "resourceId": null,
-      "resourceTitle": null,
-      "metadata": {},
-      "ipAddress": "::ffff:192.168.86.20",
-      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
-      "success": true,
-      "errorMessage": null,
-      "duration": 150
-    }
-  ],
-  "total": 1
-}
-```
-
-### POST /logs/export
-
-Downloads audit logs as JSON or CSV.
-
-**Access:**
-- Users export their own logs
-- Admins can export everybody's, or one user's
-
-**Request body:**
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| format | string | Yes | "json" or "csv" |
-| filters | object | No | The same filters as GET /logs |
-
-**Request example (JSON):**
-
-```bash
-curl -X POST "http://localhost:3000/api/logs/export" \
-  -H "x-api-key: YOUR_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "format": "json",
-    "filters": {
-      "category": "checklist",
-      "startDate": "2025-12-01T00:00:00Z",
-      "endDate": "2025-12-26T23:59:59Z",
-      "limit": 100
-    }
-  }'
-```
-
-**Request example (CSV):**
-
-```bash
-curl -X POST "http://localhost:3000/api/logs/export" \
-  -H "x-api-key: YOUR_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "format": "csv",
-    "filters": {
-      "success": false,
-      "level": "ERROR"
-    }
-  }' > error_logs.csv
-```
-
-**Response (JSON format):**
-
-A JSON array of log entries, sent with a Content-Disposition header so it downloads as a file.
-
-**Response (CSV format):**
-
-A CSV file with these columns:
-```
-Timestamp,Level,Username,Action,Category,Resource Type,Resource ID,Resource Title,Success,IP Address,Error Message
-```
-
-### GET /logs/stats
-
-Returns totals across the audit log: entries per level and category, the busiest actions and users, and recent activity.
-
-**Access:** admins only.
-
-**Request example:**
+Send the key in the `x-api-key` header:
 
 ```bash
-curl -X GET "http://localhost:3000/api/logs/stats" \
-  -H "x-api-key: YOUR_API_KEY"
+curl -H "x-api-key: ck_your_api_key_here" https://your-jotty-url.com/api/notes
 ```
 
-**Response:**
-
-```json
-{
-  "totalLogs": 1250,
-  "logsByLevel": {
-    "DEBUG": 50,
-    "INFO": 800,
-    "WARNING": 300,
-    "ERROR": 90,
-    "CRITICAL": 10
-  },
-  "logsByCategory": {
-    "auth": 450,
-    "user": 200,
-    "checklist": 300,
-    "note": 250,
-    "system": 50
-  },
-  "topActions": [
-    {
-      "action": "login",
-      "count": 350
-    },
-    {
-      "action": "checklist_updated",
-      "count": 245
-    }
-  ],
-  "topUsers": [
-    {
-      "username": "fccview",
-      "count": 425
-    },
-    {
-      "username": "john_doe",
-      "count": 380
-    }
-  ],
-  "recentActivity": [
-    {
-      "id": "1766778674300",
-      "uuid": "4a0d76b5-18de-400c-8b36-5fbdd9d8299b",
-      "timestamp": "2025-12-26T19:51:14.300Z",
-      "level": "WARNING",
-      "username": "fccview",
-      "action": "logs_cleaned",
-      "category": "system",
-      "metadata": {
-        "deletedFiles": 4
-      },
-      "ipAddress": "::ffff:192.168.86.20",
-      "userAgent": "Mozilla/5.0...",
-      "success": true
-    }
-  ]
-}
-```
+In the explorer, **Use my key** fills in your own key. Requests sent from there run against your real data, so a DELETE deletes for real.
 
-### POST /logs/cleanup
+## Ids
 
-Deletes audit logs older than the retention period set on the instance.
+Every note, checklist and board has a UUID such as `f47ac10b-58cc-4372-a567-0e02b2c3d479`. Endpoints take the UUID, and every `id` in a response is one.
 
-**Access:** admins only.
+Checklist and task items are addressed by their tree index inside the list: `0` is the first item, `2.1` is the second child of the third item. Kanban cards use their own item id.
 
-**Request example:**
+> **Deprecated: slug lookups.** A legacy filename slug still works as the item id, optionally with `?category=` (default "Uncategorized"). Every such request logs a warning, and this fallback **will be removed in a future release**. Switch any stored slugs to UUIDs now.
 
-```bash
-curl -X POST "http://localhost:3000/api/logs/cleanup" \
-  -H "x-api-key: YOUR_API_KEY"
-```
+## Errors
 
-**Response:**
+Errors come back as JSON with the status code telling you what went wrong:
 
 ```json
-{
-  "success": true,
-  "deletedFiles": 15
-}
-```
-
-### Audit log fields
-
-Each entry has these fields:
-
-| Field | Type | Description |
-|-------|------|-------------|
-| id | string | Unix timestamp, as a string |
-| uuid | string | UUID of the entry |
-| timestamp | string | ISO 8601 timestamp |
-| level | string | DEBUG, INFO, WARNING, ERROR or CRITICAL |
-| username | string | Who did it |
-| action | string | What they did |
-| category | string | Which area it belongs to |
-| resourceType | string | What kind of thing it touched, such as "checklist" or "note" |
-| resourceId | string | UUID of the thing it touched |
-| resourceTitle | string | Title of the thing it touched |
-| metadata | object | Extra context, different per action |
-| ipAddress | string | IP address of the request |
-| userAgent | string | User agent of the request |
-| success | boolean | Whether it worked |
-| errorMessage | string | The error, if it didn't |
-| duration | integer | How long it took, in milliseconds |
-
-### Common audit actions
-
-**Authentication:**
-- `login`, `logout`, `register`, `session_terminated`
-
-**User management:**
-- `user_created`, `user_updated`, `user_deleted`, `profile_updated`, `user_settings_updated`
-
-**Checklists:**
-- `checklist_created`, `checklist_updated`, `checklist_deleted`, `checklist_shared`, `checklist_unshared`
-
-**Notes:**
-- `note_created`, `note_updated`, `note_deleted`, `note_shared`, `note_unshared`
-
-**Encryption:**
-- `note_encrypted`, `note_decrypted`, `encryption_keys_generated`, `encryption_keys_imported`
-
-**System:**
-- `logs_cleaned`, `export_created`, `migration_check`, `file_scan`
-
-**API:**
-- `api_key_generated`, `api_request`
-
-## Usage examples
-
-### Health check (public endpoint)
-
-```bash
-curl https://jotty-instance.com/api/health
-```
-
-### Get all checklists
-
-```bash
-curl -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/checklists
-```
-
-### Filter checklists by category
-
-```bash
-curl -H "x-api-key: ck_your_api_key_here" \
-     "https://jotty-instance.com/api/checklists?category=Work"
-```
-
-### Filter checklists by type
-
-```bash
-curl -H "x-api-key: ck_your_api_key_here" \
-     "https://jotty-instance.com/api/checklists?type=task"
-```
-
-### Search checklists
-
-```bash
-curl -H "x-api-key: ck_your_api_key_here" \
-     "https://jotty-instance.com/api/checklists?q=meeting"
-```
-
-### Create a checklist
-
-```bash
-curl -X POST \
-     -H "x-api-key: ck_your_api_key_here" \
-     -H "Content-Type: application/json" \
-     -d '{"title": "My New Checklist", "category": "Work", "type": "simple"}' \
-     https://jotty-instance.com/api/checklists
-```
-
-### Update a checklist
-
-```bash
-curl -X PUT \
-     -H "x-api-key: ck_your_api_key_here" \
-     -H "Content-Type: application/json" \
-     -d '{"title": "Updated Title", "category": "Personal"}' \
-     https://jotty-instance.com/api/checklists/<checklist_id>
-```
-
-### Delete a checklist
-
-```bash
-curl -X DELETE \
-     -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/checklists/<checklist_id>
-```
-
-### Add item to regular checklist
-
-```bash
-curl -X POST \
-     -H "x-api-key: ck_your_api_key_here" \
-     -H "Content-Type: application/json" \
-     -d '{"text": "New task"}' \
-     https://jotty-instance.com/api/checklists/<checklist_id>/items
-```
-
-### Add item to task checklist
-
-```bash
-curl -X POST \
-     -H "x-api-key: ck_your_api_key_here" \
-     -H "Content-Type: application/json" \
-     -d '{"text": "New task with status", "status": "in_progress", "time": 0}' \
-     https://jotty-instance.com/api/checklists/<task_checklist_id>/items
-```
-
-### Check item (mark as completed)
-
-```bash
-curl -X PUT \
-     -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/checklists/<checklist_id>/items/<item_index>/check
-```
-
-### Uncheck item (mark as incomplete)
-
-```bash
-curl -X PUT \
-     -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/checklists/<checklist_id>/items/<item_index>/uncheck
-```
-
-### Get all notes
-
-```bash
-curl -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/notes
-```
-
-### Filter notes by category
-
-```bash
-curl -H "x-api-key: ck_your_api_key_here" \
-     "https://jotty-instance.com/api/notes?category=Personal"
-```
-
-### Search notes
-
-```bash
-curl -H "x-api-key: ck_your_api_key_here" \
-     "https://jotty-instance.com/api/notes?q=meeting"
-```
-
-### Create a note
-
-```bash
-curl -X POST \
-     -H "x-api-key: ck_your_api_key_here" \
-     -H "Content-Type: application/json" \
-     -d '{"title": "My New Note", "content": "This is the content", "category": "Personal"}' \
-     https://jotty-instance.com/api/notes
-```
-
-### Get user information
-
-```bash
-# Get your own user info
-curl -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/user/your_username
-
-# Get another user's public info
-curl -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/user/other_username
-```
-
-### Get all categories
-
-```bash
-curl -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/categories
-```
-
-### Get user summary statistics
-
-```bash
-# Get summary for current user
-curl -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/summary
-
-# Get summary for specific user (admin only)
-curl -H "x-api-key: ck_admin_api_key_here" \
-     "https://jotty-instance.com/api/summary?username=testuser"
-```
-
-### Export all checklists and notes
-
-```bash
-curl -X POST \
-     -H "x-api-key: ck_your_api_key_here" \
-     -H "Content-Type: application/json" \
-     -d '{"type": "all_checklists_notes"}' \
-     https://jotty-instance.com/api/exports
-```
-
-### Export user specific checklists and notes
-
-```bash
-curl -X POST \
-     -H "x-api-key: ck_your_api_key_here" \
-     -H "Content-Type: application/json" \
-     -d '{"type": "user_checklists_notes", "username": "testuser"}' \
-     https://jotty-instance.com/api/exports
-```
-
-### Get export progress
-
-```bash
-curl -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/exports
-```
-
-### Rebuild your link index
-
-```bash
-curl -X POST \
-     -H "x-api-key: ck_your_api_key_here" \
-     https://jotty-instance.com/api/admin/rebuild-index
-```
-
-Admins can add `-H "Content-Type: application/json" -d '{"username": "fccview"}'` to rebuild somebody else's.
-
-## Rebuilding the link index on a schedule
-
-> [!TIP]
-> You probably don't need this. Jotty already checks the index against your files every minute. A scheduled rebuild only earns its keep if something outside Jotty writes to the data folder regularly, a sync tool or a script, and you'd rather not wait for the check to notice.
-
-### Example script
-
-This script (`rebuild-index.sh`) rebuilds the index for a list of users. It needs an admin API key:
-
-```bash
-#!/bin/bash
-
-# rebuild-index.sh - Rebuild link indexes for specific users
-API_KEY="ck_your_admin_api_key_here"
-BASE_URL="https://jotty-instance.com"
-
-# Get all usernames (requires admin API access)
-usernames=("user1" "user2" "user3")
-
-for username in "${usernames[@]}"; do
-    echo "Rebuilding index for user: $username"
-
-    response=$(curl -s -X POST \
-        -H "x-api-key: $API_KEY" \
-        -H "Content-Type: application/json" \
-        -d "{\"username\": \"$username\"}" \
-        "$BASE_URL/api/admin/rebuild-index")
-
-    if echo "$response" | grep -q '"success":true'; then
-        echo "Successfully rebuilt index for $username"
-    else
-        echo "Failed to rebuild index for $username: $response"
-    fi
-
-    # Small delay between requests
-    sleep 1
-done
-
-echo "Index rebuild complete"
+{ "error": "Title is required" }
 ```
 
-Make it executable:
+Validation errors also carry a `details` array saying which field failed. `401` means the key is missing or wrong, `403` means the key's owner isn't allowed to do that, `404` means the item doesn't exist or isn't visible to them.
 
-```bash
-chmod +x rebuild-index.sh
-```
-
-### Adding it to cron
-
-To run it weekly, every Sunday at 2:00 AM:
-
-```bash
-# Edit crontab
-crontab -e
-
-# Add this line to run weekly on Sundays at 2:00 AM
-0 2 * * 0 /path/to/rebuild-index.sh >> /var/log/checklist-index-rebuild.log 2>&1
-```
-
-Daily also works, but on an instance with a lot of items that is a lot of reading for very little:
-
-```bash
-# Daily at 2:00 AM
-0 2 * * * /path/to/rebuild-index.sh >> /var/log/checklist-index-rebuild.log 2>&1
-```
-
-### Just your own index
-
-Without an admin key you can only rebuild your own index. This version does that:
-
-```bash
-#!/bin/bash
+## The spec
 
-# rebuild-my-index.sh - Rebuild link index for current user
-API_KEY="ck_your_api_key_here"
-USERNAME="your_username"
-BASE_URL="https://jotty-instance.com"
+- `GET /api/openapi.json` returns the OpenAPI 3.1 document to anyone with a valid API key. Scripts, code generators and the [MCP server](../mcp-server/README.md) use it to find out what your instance supports.
+- `GET /api/docs` returns the same document without a key, as JSON or as YAML with `?format=yaml`. It only answers when `ENABLE_API_DOCS=true` is set.
 
-echo "Rebuilding link index for $USERNAME"
+### ReDoc (optional)
 
-response=$(curl -s -X POST \
-    -H "x-api-key: $API_KEY" \
-    -H "Content-Type: application/json" \
-    -d "{\"username\": \"$USERNAME\"}" \
-    "$BASE_URL/api/admin/rebuild-index")
+To browse the docs outside Jotty, set `ENABLE_API_DOCS=true` on the Jotty service and add ReDoc next to it:
 
-if echo "$response" | grep -q '"success":true'; then
-    echo "✅ Successfully rebuilt index"
-else
-    echo "❌ Failed to rebuild index: $response"
-fi
+```yaml
+api-docs:
+  image: redocly/redoc:latest
+  container_name: jotty-api-docs
+  ports:
+    - "40126:80"
+  environment:
+    SPEC_URL: http://your-jotty-url.com/api/docs
+  depends_on:
+    - jotty
+  profiles:
+    - api-docs
 ```
 
-### Tips
+Start it with `docker compose --profile api-docs up -d` and open `http://localhost:40126`. If it says "Failed to load", check `ENABLE_API_DOCS=true` is set and that `SPEC_URL` points at your instance's `/api/docs`.
 
-- Run the script by hand once before you schedule it
-- The log file grows every run, so give it a `logrotate` rule
-- If you back up the data folder on a schedule, run the rebuild after the backup rather than during it
-- Glance at the log now and then. A rebuild that fails every week is telling you something
+## Audit log actions
 
-## Things worth knowing
+The logs endpoints filter by `action`, a free string. These are the common ones:
 
-- Item indexes start at 0
-- Timestamps are ISO 8601
-- API keys don't expire. Regenerate yours from your profile if it leaks
-- You can only reach items you own, unless you're an admin
-- Time entries are JSON arrays with `id`, `startTime`, `endTime` and `duration`
-- The user endpoint returns more fields for yourself and for admins than for anybody else
-- The API is still growing. Expect new endpoints and fields, and existing ones to keep working
+| Area | Actions |
+|---|---|
+| Authentication | `login`, `logout`, `register`, `session_terminated` |
+| Users | `user_created`, `user_updated`, `user_deleted`, `profile_updated`, `user_settings_updated` |
+| Checklists | `checklist_created`, `checklist_updated`, `checklist_deleted`, `checklist_shared`, `checklist_unshared` |
+| Notes | `note_created`, `note_updated`, `note_deleted`, `note_shared`, `note_unshared` |
+| Encryption | `note_encrypted`, `note_decrypted`, `encryption_keys_generated`, `encryption_keys_imported` |
+| System | `logs_cleaned`, `export_created`, `migration_check`, `file_scan` |
+| API | `api_key_generated`, `api_request` |
diff --git a/howto/DOCKER.md b/howto/DOCKER.md
index 8af6490c9..8178775ed 100644
--- a/howto/DOCKER.md
+++ b/howto/DOCKER.md
@@ -137,9 +137,17 @@ environment:
 - `- OIDC_USER_GROUPS=jotty_users,app_users` Optional. Comma-separated OIDC groups allowed to log in. If set, only members of these groups (and admins) get in.
 - `- OIDC_USER_ROLES=user,member` Optional. Comma-separated OIDC roles allowed to log in. If set, only users with one of these roles (and admins) get in.
 
+## MCP server
+
+`docker-compose.mcp.yml` in the repo root runs jotty and the [MCP server](../mcp-server/README.md) on one network, so assistants such as Claude or Cursor can work with your notes and lists:
+
+```bash
+docker compose -f docker-compose.mcp.yml up -d --build
+```
+
 ## API docs service
 
-jotty can run a separate ReDoc container that serves interactive docs for every API endpoint. It's optional.
+jotty can run a separate ReDoc container that serves interactive docs for every API endpoint. It's optional: the same docs, with a way to send requests, are already inside jotty under **How to > API**. ReDoc is for reading them outside the app.
 
 ### Setup
 
diff --git a/mcp-server/.env.example b/mcp-server/.env.example
new file mode 100644
index 000000000..1a5c938f5
--- /dev/null
+++ b/mcp-server/.env.example
@@ -0,0 +1,3 @@
+JOTTY_URL=http://localhost:3000
+JOTTY_API_KEY=
+JOTTY_MCP_AUTH_TOKEN=
diff --git a/mcp-server/.gitignore b/mcp-server/.gitignore
index 6b3b97dfb..9c97bbd46 100644
--- a/mcp-server/.gitignore
+++ b/mcp-server/.gitignore
@@ -1,4 +1,3 @@
-node_modules/
-dist/
-*.tsbuildinfo
-.DS_Store
\ No newline at end of file
+node_modules
+dist
+.env
diff --git a/mcp-server/Dockerfile b/mcp-server/Dockerfile
new file mode 100644
index 000000000..65a944945
--- /dev/null
+++ b/mcp-server/Dockerfile
@@ -0,0 +1,18 @@
+FROM oven/bun:1.3.14-alpine AS build
+WORKDIR /src
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+COPY tsconfig.json ./
+COPY src ./src
+RUN bun run build
+
+FROM oven/bun:1.3.14-alpine
+WORKDIR /app
+ENV NODE_ENV=production
+ENV JOTTY_MCP_TRANSPORT=http
+ENV JOTTY_MCP_PORT=3001
+COPY --from=build /src/dist/main.js /app/main.js
+EXPOSE 3001
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD wget -qO- http://127.0.0.1:3001/healthz >/dev/null 2>&1 || exit 1
+ENTRYPOINT ["bun", "run", "/app/main.js"]
diff --git a/mcp-server/README.md b/mcp-server/README.md
index 439a24d04..c5ab23c89 100644
--- a/mcp-server/README.md
+++ b/mcp-server/README.md
@@ -1,318 +1,109 @@
 # jotty-mcp
 
-A [Model Context Protocol](https://modelcontextprotocol.io) server that exposes a
-**[jotty·page](https://jotty.page)** instance to AI clients (Claude Desktop,
-Cursor, etc.). It proxies every tool call to your Jotty instance's
-[REST API](../howto/API.md) using an API key, so an assistant can read and manage
-your checklists, notes, kanban boards, and more.
+An MCP server for a Jotty instance. It lets an assistant read and change notes, checklists and Kanban boards as the user who owns the API key.
 
-It ships inside the Jotty repository as a self-contained subpackage with its **own**
-`node_modules` (so its `zod` version never clashes with the Next.js app).
+It lives in the Jotty repo but shares nothing with the app. It has its own `package.json`, runs on [Bun](https://bun.sh) and talks to Jotty over the REST API.
 
-## Two ways to run it
+## How it knows the API
 
-The same binary supports two transports, picked by `MCP_TRANSPORT`. Pick one:
+Jotty publishes its own contract at `/api/openapi.json`. It's generated from the code that serves each route. The MCP reads it on first use and caches it for five minutes per API key. Tool names, descriptions and input schemas all come from there.
 
-### 1. Local (stdio) — run on your personal machine  *(default, simplest)*
+That means:
 
-The MCP server is a **local process** your AI client launches; it makes outbound
-HTTPS calls to your Jotty instance. The API key lives on your machine. Nothing new
-runs on the server.
+- Pointing it at an older instance works. Tools for endpoints that instance doesn't have are left out, and `discover` lists them as unavailable.
+- A new route in Jotty is reachable straight away through `call_operation`, with no MCP release.
+- The only hand-kept list is `src/tools/catalog.ts`, the operation ids that get a dedicated tool.
 
-```
-your machine                            jotty server
-─────────────                           ────────────────
-Cursor / Claude Desktop
-     │ spawns child process (stdio)
-     ▼
- jotty-mcp  ──── HTTPS, x-api-key ───►  Jotty REST API (unchanged)
- JOTTY_URL + JOTTY_API_KEY from env
-```
-
-Client config (Cursor / Claude Desktop):
-
-```jsonc
-{ "mcpServers": { "jotty": {
-  "command": "node",
-  "args": ["/absolute/path/to/mcp-server/dist/index.js"],
-  "env": { "JOTTY_URL": "https://jotty.example.com", "JOTTY_API_KEY": "ck_…" }
-}}}
-```
-
-→ Best for personal use: key never leaves your machine, Jotty stays untouched.
-
-### 2. Hosted (HTTP) — run next to the Jotty app
-
-The MCP server runs **on the Jotty host** as a small listening service; your AI
-client just points at a URL. Each client sends its own Jotty `x-api-key`, so
-multiple users keep their accounts isolated. Protect the endpoint with
-`MCP_TOKEN` (Bearer) since it's network-exposed.
-
-```
-your machine                              jotty server
-─────────────                             ────────────────────────────
-Cursor                                    jotty app (:3000)  ← unchanged
-   │ HTTPS to URL                              ▲
-   │ headers: x-api-key + Authorization        │ localhost
-   ▼                                           │
- jotty-mcp (MCP_TRANSPORT=http, :3001)  ───────┘
- JOTTY_URL=http://localhost:3000
-```
-
-Client config (Cursor):
-
-```jsonc
-{ "mcpServers": { "jotty": {
-  "url": "https://jotty.example.com/mcp",
-  "headers": { "x-api-key": "ck_…", "Authorization": "Bearer your-mcp-token" }
-}}}
-```
-
-→ Best for shared/multi-user: one endpoint, no local process per client. (Claude
-Desktop's stdio-only builds should use option 1.)
-
-Detailed setup for both is below.
+## Tools
 
-## Not bundled with the Jotty Docker image
+The dedicated tools cover day to day work: search, categories, summary, notes, checklists and their items, and the common board actions. Each one is named after its operation id in snake case (`listNotes` is `list_notes`).
 
-`jotty-mcp` is a **separate program**, not part of the Jotty web app:
+Three built-in tools cover the rest:
 
-- It is **not** included in the published Jotty Docker image
-  (`ghcr.io/fccview/jotty:latest`) and is **not** built by `next build` / the
-  `Dockerfile`.
-- It is **not** started by `docker compose` — the compose file only runs the
-  `jotty` service (and optional `api-docs`). There is no `jotty-mcp` service
-  defined, so hosting Jotty via Docker Compose runs Jotty only and **does not run
-  the MCP server**.
-- It has its **own** `package.json` / `node_modules`, deliberately decoupled from
-  the Next.js app so dependency versions (e.g. `zod`) never clash.
+| Tool | What it does |
+|---|---|
+| `discover` | Lists every operation on the instance. Pass `operationId` to get one operation's input schema. |
+| `call_operation` | Calls any operation by id. Use it for tasks, statuses, reminders, exports and logs. |
+| `health` | Reports whether Jotty is reachable, its version, and whether the API key works. |
 
-So you must run it yourself, in one of the two ways above:
+Results carry the Jotty response in `structuredContent`. The visible text is the same JSON, cut off at `JOTTY_MCP_MAX_TEXT_CHARS`. Errors come back with `isError` and `{ kind, message, status, hint }`.
 
-- **Local (stdio):** build and run `jotty-mcp` on **your personal machine** — your
-  AI client (Cursor / Claude Desktop) launches it. Nothing to add to your Jotty
-  deployment.
-- **Hosted (HTTP):** run it as a **separate sidecar** next to Jotty (e.g. its own
-  container/process, with `JOTTY_URL=http://jotty:3000`). It is never baked into
-  the Jotty image and never auto-started by Jotty.
+## Running it
 
-In short: Jotty's deployment is unchanged by this subpackage; `jotty-mcp` is an
-optional companion you run separately.
+You need an API key. Generate one in Jotty under Profile.
 
-## What it exposes
+### stdio, on your own machine
 
-54 tools across the full Jotty API:
-
-| Area | Tools |
-| --- | --- |
-| **Checklists** | `list_checklists`, `create_checklist`, `update_checklist`, `delete_checklist`, `create_checklist_item`, `update_checklist_item`, `delete_checklist_item`, `check_item`, `uncheck_item`, `reorder_checklist_items` |
-| **Notes** | `list_notes`, `create_note`, `get_note`, `update_note`, `delete_note` |
-| **Tasks (kanban columns)** | `list_tasks`, `create_task`, `get_task`, `update_task`, `delete_task`, `get_task_statuses`, `create_task_status`, `update_task_status`, `delete_task_status`, `create_task_item`, `get_task_item`, `move_task_item`, `delete_task_item` |
-| **Kanban boards** | `list_boards`, `create_board`, `get_board`, `update_board`, `delete_board`, `set_board_statuses`, `create_board_item`, `update_board_item`, `delete_board_item`, `move_board_item`, `assign_board_item`, `set_board_item_reminder`, `clear_board_item_reminder`, `get_board_calendar` |
-| **Discovery** | `list_categories`, `get_summary`, `search` |
-| **Admin / exports / logs** | `request_export`, `get_export_progress`, `list_logs`, `export_logs`, `get_logs_stats`, `rebuild_link_index` |
-| **Misc** | `health`, `get_user`, `get_current_user`, `rebuild_link_index` |
-
-Tool arguments are validated with JSON Schema (via `zod`). Items are addressed by
-dot-notation index paths (e.g. `0.1`) for nested sub-items, and by UUID for
-lists/notes/boards — matching the [API docs](../howto/API.md).
-
-## Prerequisites
-
-- Node.js **20+** (uses the built-in `fetch`).
-- A running Jotty instance you can reach over HTTP(S).
-- A Jotty **API key** — generate one in Jotty → **Profile → Settings → API Key**
-  (it looks like `ck_…`).
-
-## Build
+Your MCP client starts the process. The key stays on your machine.
 
 ```bash
 cd mcp-server
-npm install
-npm run build      # outputs to dist/
+bun install
 ```
 
-## Configure (local / stdio mode)
-
-In local stdio mode the server reads two required environment variables (and one
-optional). For HTTP mode env, see [HTTP / remote mode](#http--remote-mode-streamable-http) below.
-
-| Variable | Required | Description |
-| --- | --- | --- |
-| `JOTTY_URL` | yes | Base URL of your Jotty instance, e.g. `https://jotty.example.com` |
-| `JOTTY_API_KEY` | yes | Your `ck_…` API key |
-| `JOTTY_TIMEOUT_MS` | no | Per-request timeout in ms (default `30000`) |
-
-## Run
-
-```bash
-JOTTY_URL=https://jotty.example.com JOTTY_API_KEY=ck_your_key node dist/index.js
-```
-
-It speaks MCP over stdio, so you run it as a child process of your MCP client.
-
-## Use with Claude Desktop
-
-Add an entry to your `claude_desktop_config.json` (Claude → Settings → Developer →
-Edit Config):
-
 ```jsonc
 {
   "mcpServers": {
     "jotty": {
-      "command": "node",
-      "args": ["/absolute/path/to/jotty/mcp-server/dist/index.js"],
+      "command": "bun",
+      "args": ["run", "/absolute/path/to/jotty/mcp-server/src/main.ts"],
       "env": {
         "JOTTY_URL": "https://jotty.example.com",
-        "JOTTY_API_KEY": "ck_your_key"
+        "JOTTY_API_KEY": "ck_..."
       }
     }
   }
 }
 ```
 
-Restart Claude Desktop and you'll see the Jotty tools available.
-
-## Use with Cursor
-
-Add to `~/.cursor/mcp.json` (or `.cursor/mcp.json` in your project):
+Claude Code:
 
-```jsonc
-{
-  "mcpServers": {
-    "jotty": {
-      "command": "node",
-      "args": ["/absolute/path/to/jotty/mcp-server/dist/index.js"],
-      "env": {
-        "JOTTY_URL": "https://jotty.example.com",
-        "JOTTY_API_KEY": "ck_your_key"
-      }
-    }
-  }
-}
+```bash
+claude mcp add jotty -e JOTTY_URL=https://jotty.example.com -e JOTTY_API_KEY=ck_... -- bun run /absolute/path/to/jotty/mcp-server/src/main.ts
 ```
 
-## HTTP / remote mode (Streamable HTTP)
+### HTTP, next to Jotty
 
-The stdio mode above runs the server **on your own machine**. If you'd rather run
-the MCP server **on the Jotty host** (or anywhere reachable) and point your client
-at a URL, use the HTTP transport. Same binary, selected by `MCP_TRANSPORT=http`.
+One server for several users. Each client sends its own Jotty key in `x-api-key`, so every session acts as its own user.
 
-### 1. Run the server on the Jotty host
+`docker-compose.mcp.yml` in the repo root runs Jotty and the MCP server on one network:
 
 ```bash
-# On the server that runs Jotty (e.g. Jotty on :3000)
-cd mcp-server && npm install && npm run build
-
-MCP_TRANSPORT=http \
-JOTTY_URL=http://localhost:3000 \
-MCP_PORT=3001 \
-MCP_HOST=0.0.0.0 \
-MCP_TOKEN=choose-a-long-random-secret \
-  node dist/index.js
+docker compose -f docker-compose.mcp.yml up -d --build
 ```
 
-Environment (HTTP mode):
-
-| Variable | Required | Description |
-| --- | --- | --- |
-| `MCP_TRANSPORT` | yes | set to `http` |
-| `JOTTY_URL` | yes | where Jotty's REST API is — usually `http://localhost:3000` when colocated |
-| `MCP_PORT` | no | bind port (default `3001`) |
-| `MCP_HOST` | no | bind host (default `0.0.0.0`; use `127.0.0.1` for local-only) |
-| `MCP_TOKEN` | recommended | shared secret; clients must send `Authorization: Bearer <token>`. Without it the endpoint is open — restrict the network (localhost / Tailscale / reverse proxy). |
-| `JOTTY_API_KEY` | optional | server-side fallback Jotty key used only when a client omits its own `x-api-key` |
-
-### 2. Connect your client to the URL
+It serves MCP at `http://<host>:3001/mcp` and health at `/healthz`.
 
-The client **does not** set `JOTTY_URL`. It sets the MCP endpoint URL and sends the
-Jotty API key as the `x-api-key` header:
+Set `JOTTY_MCP_AUTH_TOKEN` and every `/mcp` request has to send `Authorization: Bearer <token>`. Without it the endpoint is open. That's fine on a private network and a bad idea on a public port. If you also set `JOTTY_API_KEY` as a fallback, anyone who reaches the port acts as that user, and the server logs a warning at startup.
 
-**Cursor** (`~/.cursor/mcp.json`):
-
-```jsonc
-{
-  "mcpServers": {
-    "jotty": {
-      "url": "https://jotty.example.com/mcp",
-      "headers": {
-        "x-api-key": "ck_your_key",
-        "Authorization": "Bearer choose-a-long-random-secret"
-      }
-    }
-  }
-}
+```bash
+claude mcp add --transport http jotty http://localhost:3001/mcp \
+  --header "Authorization: Bearer <token>" \
+  --header "x-api-key: ck_..."
 ```
 
-> If you set `MCP_TOKEN` on the server, include `Authorization: Bearer <token>` in
-> the client headers. If you didn't set a token, drop that header.
-
-**Claude Desktop** does not yet support the `url`/remote form in all builds; for
-Claude Desktop use the stdio config above. HTTP mode is intended for Cursor and
-any client that supports the Streamable HTTP transport.
-
-### Auth model summary
-
-Two independent layers, by design:
-- **MCP endpoint auth** (optional, server-side `MCP_TOKEN`): gates who can reach
-  the MCP server at all (`Authorization: Bearer`).
-- **Jotty account auth** (required, per-client `x-api-key`): which Jotty account
-  each session acts as. Each connecting client gets its own `JottyClient`, so
-  multiple users on one MCP server keep their own keys/data isolated.
+## Settings
 
-## Security notes
+| Variable | Default | Meaning |
+|---|---|---|
+| `JOTTY_URL` | `http://localhost:3000` | Jotty base URL, without `/api` |
+| `JOTTY_API_KEY` | | Key for stdio, fallback for HTTP sessions |
+| `JOTTY_MCP_TRANSPORT` | `stdio` | `stdio` or `http` |
+| `JOTTY_MCP_PORT` | `3001` | HTTP port |
+| `JOTTY_MCP_BIND_HOST` | all interfaces | HTTP bind address |
+| `JOTTY_MCP_AUTH_TOKEN` | | Bearer token required on `/mcp` |
+| `JOTTY_MCP_TIMEOUT_MS` | `30000` | Per request timeout towards Jotty |
+| `JOTTY_MCP_MAX_TEXT_CHARS` | `12000` | Cap on the visible text of a result |
+| `JOTTY_MCP_SPEC_TTL_MS` | `300000` | How long the API spec is cached |
+| `JOTTY_MCP_LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error`, `silent`. Logs go to stderr. |
 
-- The Jotty API key grants **full access** to the Jotty account it belongs to.
-  Treat it like a password — put it in your MCP client's config, not in source
-  files. Rotate it from Jotty → Profile → Settings → API Key.
-- **stdio mode:** the server runs locally and only makes outbound HTTPS requests
-  to your Jotty URL. No inbound ports are opened.
-- **HTTP mode:** the server opens a listening port. Always set `MCP_TOKEN` and/or
-  bind to `127.0.0.1` / put it behind a reverse proxy / Tailscale so the endpoint
-  isn't publicly reachable. Each session still requires a valid Jotty `x-api-key`.
-- Errors from Jotty (bad UUID, missing title, `403`, etc.) are returned to the
-  model as MCP `isError` results rather than crashing the server.
-
-## Project layout
-
-```
-mcp-server/
-  src/
-    index.ts            # entrypoint: env config, dispatches stdio vs http
-    client.ts           # JottyClient: REST fetch wrapper with x-api-key
-    http.ts             # Streamable HTTP transport: per-session McpServer + JottyClient
-    tools/
-      index.ts          # registerAllTools() aggregator
-      shared.ts         # json/text/fail/run result helpers
-      types.ts          # ToolModule interface
-      checklists.ts     # /api/checklists tools
-      notes.ts          # /api/notes tools
-      tasks.ts           # /api/tasks tools
-      kanban.ts          # /api/kanban tools
-      discovery.ts       # categories, summary, search
-      admin.ts           # exports, logs, admin
-      misc.ts            # health, user, rebuild-index
-  scripts/
-    smoke.mjs            # stdio protocol smoke test (no Jotty needed)
-    integration.mjs      # stdio end-to-end test (needs a running Jotty)
-    integration-http.mjs # http end-to-end test (needs running Jotty + http server)
-```
-
-## Tests
+## Development
 
 ```bash
-# Protocol smoke test — no Jotty instance required
-JOTTY_URL=http://127.0.0.1:9 JOTTY_API_KEY=ck_dummy node scripts/smoke.mjs
-
-# stdio end-to-end — run Jotty locally first (e.g. `next dev`),
-# inject a test API key for an admin user, then:
-JOTTY_URL=http://127.0.0.1:3000 JOTTY_API_KEY=ck_test_… node scripts/integration.mjs
-
-# http end-to-end — also start the http server, then:
-#   MCP_TRANSPORT=http JOTTY_URL=http://127.0.0.1:3000 MCP_PORT=3001 node dist/index.js &
-MCP_URL=http://127.0.0.1:3001/mcp JOTTY_API_KEY=ck_test_… node scripts/integration-http.mjs
+bun run dev
+bun run typecheck
+bun test
+bun run build
 ```
 
-## License
-
-MIT, same as Jotty.
\ No newline at end of file
+Tests start a fake Jotty over real HTTP and drive the server through the MCP SDK client. Nothing is mocked at the fetch level.
diff --git a/mcp-server/bun.lock b/mcp-server/bun.lock
new file mode 100644
index 000000000..f1b4fbfe7
--- /dev/null
+++ b/mcp-server/bun.lock
@@ -0,0 +1,215 @@
+{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "jotty-mcp",
+      "dependencies": {
+        "@modelcontextprotocol/sdk": "1.30.0",
+      },
+      "devDependencies": {
+        "@types/bun": "1.3.14",
+        "typescript": "5.9.3",
+      },
+    },
+  },
+  "packages": {
+    "@hono/node-server": ["@hono/node-server@2.1.1", "", { "peerDependencies": { "hono": "^4" } }, "sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg=="],
+
+    "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.30.0", "", { "dependencies": { "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA=="],
+
+    "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
+
+    "@types/node": ["@types/node@26.6.3", "", { "dependencies": { "undici-types": "~8.9.0" } }, "sha512-dsqMQQoeTLqu9wynDD00q573mNzso3IdQOAfHRJqLCcmCFPoGo9A1bDpUcv/9tnKpErQWv9uKeGfl37EIS02Yg=="],
+
+    "accepts": ["accepts@2.0.0", "", { "dependencies": { "mime-types": "^3.0.0", "negotiator": "^1.0.0" } }, "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng=="],
+
+    "ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
+
+    "ajv-formats": ["ajv-formats@3.0.1", "", { "dependencies": { "ajv": "^8.0.0" } }, "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ=="],
+
+    "body-parser": ["body-parser@2.3.0", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^2.0.0", "debug": "^4.4.3", "http-errors": "^2.0.1", "iconv-lite": "^0.7.2", "on-finished": "^2.4.1", "qs": "^6.15.2", "raw-body": "^3.0.2", "type-is": "^2.1.0" } }, "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw=="],
+
+    "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
+
+    "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],
+
+    "call-bind-apply-helpers": ["call-bind-apply-helpers@1.0.2", "", { "dependencies": { "es-errors": "^1.3.0", "function-bind": "^1.1.2" } }, "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ=="],
+
+    "call-bound": ["call-bound@1.0.4", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "get-intrinsic": "^1.3.0" } }, "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg=="],
+
+    "content-disposition": ["content-disposition@1.1.0", "", {}, "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g=="],
+
+    "content-type": ["content-type@1.0.5", "", {}, "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA=="],
+
+    "cookie": ["cookie@0.7.2", "", {}, "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w=="],
+
+    "cookie-signature": ["cookie-signature@1.2.2", "", {}, "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg=="],
+
+    "cors": ["cors@2.8.6", "", { "dependencies": { "object-assign": "^4", "vary": "^1" } }, "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw=="],
+
+    "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
+
+    "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" }, "peerDependencies": { "supports-color": "*" }, "optionalPeers": ["supports-color"] }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
+
+    "depd": ["depd@2.0.0", "", {}, "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw=="],
+
+    "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="],
+
+    "ee-first": ["ee-first@1.1.1", "", {}, "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="],
+
+    "encodeurl": ["encodeurl@2.0.0", "", {}, "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg=="],
+
+    "es-define-property": ["es-define-property@1.0.1", "", {}, "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g=="],
+
+    "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
+
+    "es-object-atoms": ["es-object-atoms@1.1.2", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw=="],
+
+    "escape-html": ["escape-html@1.0.3", "", {}, "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow=="],
+
+    "etag": ["etag@1.8.1", "", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="],
+
+    "eventsource": ["eventsource@3.0.7", "", { "dependencies": { "eventsource-parser": "^3.0.1" } }, "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA=="],
+
+    "eventsource-parser": ["eventsource-parser@3.1.1", "", {}, "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ=="],
+
+    "express": ["express@5.2.1", "", { "dependencies": { "accepts": "^2.0.0", "body-parser": "^2.2.1", "content-disposition": "^1.0.0", "content-type": "^1.0.5", "cookie": "^0.7.1", "cookie-signature": "^1.2.1", "debug": "^4.4.0", "depd": "^2.0.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "finalhandler": "^2.1.0", "fresh": "^2.0.0", "http-errors": "^2.0.0", "merge-descriptors": "^2.0.0", "mime-types": "^3.0.0", "on-finished": "^2.4.1", "once": "^1.4.0", "parseurl": "^1.3.3", "proxy-addr": "^2.0.7", "qs": "^6.14.0", "range-parser": "^1.2.1", "router": "^2.2.0", "send": "^1.1.0", "serve-static": "^2.2.0", "statuses": "^2.0.1", "type-is": "^2.0.1", "vary": "^1.1.2" } }, "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw=="],
+
+    "express-rate-limit": ["express-rate-limit@8.7.0", "", { "dependencies": { "debug": "^4.4.3", "ip-address": "^10.2.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-hOwV7WOxXfjRpAM1DSJWZDXx3GhplwD8IfwuwvogD8i1Qnkgosw/H45s4ZnFAUHDAhPjlY9hLBvJhKmGMyY26g=="],
+
+    "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
+
+    "fast-uri": ["fast-uri@3.1.8", "", {}, "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg=="],
+
+    "finalhandler": ["finalhandler@2.1.1", "", { "dependencies": { "debug": "^4.4.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "on-finished": "^2.4.1", "parseurl": "^1.3.3", "statuses": "^2.0.1" } }, "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA=="],
+
+    "forwarded": ["forwarded@0.2.0", "", {}, "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="],
+
+    "fresh": ["fresh@2.0.0", "", {}, "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A=="],
+
+    "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="],
+
+    "get-intrinsic": ["get-intrinsic@1.3.0", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "function-bind": "^1.1.2", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "math-intrinsics": "^1.1.0" } }, "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ=="],
+
+    "get-proto": ["get-proto@1.0.1", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-object-atoms": "^1.0.0" } }, "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g=="],
+
+    "gopd": ["gopd@1.2.0", "", {}, "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg=="],
+
+    "has-symbols": ["has-symbols@1.1.0", "", {}, "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ=="],
+
+    "hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="],
+
+    "hono": ["hono@4.13.9", "", {}, "sha512-7dMkQmZoC4E6F7AtaQSPhlWAdnBti+j7rreMZl8QB4jFiEhP9TWbGWUMi8WYzBCgmgulxuvLQupKqo+Co6Omyg=="],
+
+    "http-errors": ["http-errors@2.0.1", "", { "dependencies": { "depd": "~2.0.0", "inherits": "~2.0.4", "setprototypeof": "~1.2.0", "statuses": "~2.0.2", "toidentifier": "~1.0.1" } }, "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ=="],
+
+    "iconv-lite": ["iconv-lite@0.7.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ=="],
+
+    "inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="],
+
+    "ip-address": ["ip-address@10.7.2", "", {}, "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w=="],
+
+    "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
+
+    "is-promise": ["is-promise@4.0.0", "", {}, "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ=="],
+
+    "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
+
+    "jose": ["jose@6.2.12", "", {}, "sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw=="],
+
+    "json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
+
+    "json-schema-typed": ["json-schema-typed@8.0.2", "", {}, "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA=="],
+
+    "math-intrinsics": ["math-intrinsics@1.1.0", "", {}, "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g=="],
+
+    "media-typer": ["media-typer@1.1.1", "", {}, "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ=="],
+
+    "merge-descriptors": ["merge-descriptors@2.0.0", "", {}, "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g=="],
+
+    "mime-db": ["mime-db@1.54.0", "", {}, "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ=="],
+
+    "mime-types": ["mime-types@3.0.2", "", { "dependencies": { "mime-db": "^1.54.0" } }, "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A=="],
+
+    "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
+
+    "negotiator": ["negotiator@1.1.0", "", { "dependencies": { "content-type": "^2.1.0" } }, "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg=="],
+
+    "object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="],
+
+    "object-inspect": ["object-inspect@1.13.4", "", {}, "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew=="],
+
+    "on-finished": ["on-finished@2.4.1", "", { "dependencies": { "ee-first": "1.1.1" } }, "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg=="],
+
+    "once": ["once@1.4.0", "", { "dependencies": { "wrappy": "1" } }, "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w=="],
+
+    "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="],
+
+    "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
+
+    "path-to-regexp": ["path-to-regexp@8.4.2", "", {}, "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA=="],
+
+    "pkce-challenge": ["pkce-challenge@5.0.1", "", {}, "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ=="],
+
+    "proxy-addr": ["proxy-addr@2.0.8", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ=="],
+
+    "qs": ["qs@6.16.0", "", { "dependencies": { "es-define-property": "^1.0.1", "side-channel": "^1.1.1" } }, "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA=="],
+
+    "range-parser": ["range-parser@1.3.0", "", {}, "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw=="],
+
+    "raw-body": ["raw-body@3.0.2", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.7.0", "unpipe": "~1.0.0" } }, "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA=="],
+
+    "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
+
+    "router": ["router@2.2.0", "", { "dependencies": { "debug": "^4.4.0", "depd": "^2.0.0", "is-promise": "^4.0.0", "parseurl": "^1.3.3", "path-to-regexp": "^8.0.0" } }, "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ=="],
+
+    "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],
+
+    "send": ["send@1.2.1", "", { "dependencies": { "debug": "^4.4.3", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "fresh": "^2.0.0", "http-errors": "^2.0.1", "mime-types": "^3.0.2", "ms": "^2.1.3", "on-finished": "^2.4.1", "range-parser": "^1.2.1", "statuses": "^2.0.2" } }, "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ=="],
+
+    "serve-static": ["serve-static@2.2.1", "", { "dependencies": { "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "parseurl": "^1.3.3", "send": "^1.2.0" } }, "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw=="],
+
+    "setprototypeof": ["setprototypeof@1.2.0", "", {}, "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="],
+
+    "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
+
+    "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
+
+    "side-channel": ["side-channel@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4", "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ=="],
+
+    "side-channel-list": ["side-channel-list@1.0.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4" } }, "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w=="],
+
+    "side-channel-map": ["side-channel-map@1.0.1", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3" } }, "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA=="],
+
+    "side-channel-weakmap": ["side-channel-weakmap@1.0.2", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3", "side-channel-map": "^1.0.1" } }, "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A=="],
+
+    "statuses": ["statuses@2.0.2", "", {}, "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw=="],
+
+    "toidentifier": ["toidentifier@1.0.1", "", {}, "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="],
+
+    "type-is": ["type-is@2.1.0", "", { "dependencies": { "content-type": "^2.0.0", "media-typer": "^1.1.0", "mime-types": "^3.0.0" } }, "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA=="],
+
+    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+
+    "undici-types": ["undici-types@8.9.0", "", {}, "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg=="],
+
+    "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="],
+
+    "vary": ["vary@1.1.2", "", {}, "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg=="],
+
+    "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
+
+    "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+
+    "zod": ["zod@4.6.5", "", {}, "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q=="],
+
+    "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="],
+
+    "body-parser/content-type": ["content-type@2.1.0", "", {}, "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag=="],
+
+    "negotiator/content-type": ["content-type@2.1.0", "", {}, "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag=="],
+
+    "type-is/content-type": ["content-type@2.1.0", "", {}, "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag=="],
+  }
+}
diff --git a/mcp-server/bunfig.toml b/mcp-server/bunfig.toml
new file mode 100644
index 000000000..6923e083c
--- /dev/null
+++ b/mcp-server/bunfig.toml
@@ -0,0 +1,2 @@
+[test]
+preload = ["./tests/preload.ts"]
diff --git a/mcp-server/package-lock.json b/mcp-server/package-lock.json
deleted file mode 100644
index 23f799755..000000000
--- a/mcp-server/package-lock.json
+++ /dev/null
@@ -1,1241 +0,0 @@
-{
-  "name": "jotty-mcp",
-  "version": "1.0.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "jotty-mcp",
-      "version": "1.0.0",
-      "license": "MIT",
-      "dependencies": {
-        "@modelcontextprotocol/sdk": "^1.30.0",
-        "zod": "^3.25.76"
-      },
-      "bin": {
-        "jotty-mcp": "dist/index.js"
-      },
-      "devDependencies": {
-        "@types/node": "^20.19.0",
-        "typescript": "^5.9.0"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@hono/node-server": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.1.tgz",
-      "integrity": "sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20"
-      },
-      "peerDependencies": {
-        "hono": "^4"
-      }
-    },
-    "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz",
-      "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==",
-      "license": "MIT",
-      "dependencies": {
-        "@hono/node-server": "^1.19.9 || ^2.0.5",
-        "ajv": "^8.17.1",
-        "ajv-formats": "^3.0.1",
-        "content-type": "^1.0.5",
-        "cors": "^2.8.5",
-        "cross-spawn": "^7.0.5",
-        "eventsource": "^3.0.2",
-        "eventsource-parser": "^3.0.0",
-        "express": "^5.2.1",
-        "express-rate-limit": "^8.2.1",
-        "hono": "^4.11.4",
-        "jose": "^6.1.3",
-        "json-schema-typed": "^8.0.2",
-        "pkce-challenge": "^5.0.0",
-        "raw-body": "^3.0.0",
-        "zod": "^3.25 || ^4.0",
-        "zod-to-json-schema": "^3.25.1"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@cfworker/json-schema": "^4.1.1",
-        "zod": "^3.25 || ^4.0"
-      },
-      "peerDependenciesMeta": {
-        "@cfworker/json-schema": {
-          "optional": true
-        },
-        "zod": {
-          "optional": false
-        }
-      }
-    },
-    "node_modules/@types/node": {
-      "version": "20.19.43",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz",
-      "integrity": "sha512-6oYBAi5ikg4Pl+kGsoYtawUMBT2zZMCvPNF7pVLnHZfd1zf38DRiWn/gT01RYCdUqkv7Fhr+C9ot4/tb+2sVvA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~6.21.0"
-      }
-    },
-    "node_modules/accepts": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
-      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-types": "^3.0.0",
-        "negotiator": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/ajv-formats": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
-      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^8.0.0"
-      },
-      "peerDependencies": {
-        "ajv": "^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "ajv": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
-      "license": "MIT",
-      "dependencies": {
-        "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
-        "debug": "^4.4.3",
-        "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
-        "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
-        "raw-body": "^3.0.2",
-        "type-is": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/bytes": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/call-bind-apply-helpers": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/call-bound": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
-      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "get-intrinsic": "^1.3.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/content-disposition": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
-      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/content-type": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/cookie": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/cookie-signature": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
-      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.6.0"
-      }
-    },
-    "node_modules/cors": {
-      "version": "2.8.6",
-      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
-      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
-      "license": "MIT",
-      "dependencies": {
-        "object-assign": "^4",
-        "vary": "^1"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/cross-spawn": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/depd": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
-      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/dunder-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "gopd": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/ee-first": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
-      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "license": "MIT"
-    },
-    "node_modules/encodeurl": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/es-define-property": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-errors": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-object-atoms": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
-      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/escape-html": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "license": "MIT"
-    },
-    "node_modules/etag": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
-      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/eventsource": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz",
-      "integrity": "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==",
-      "license": "MIT",
-      "dependencies": {
-        "eventsource-parser": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/eventsource-parser": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.1.tgz",
-      "integrity": "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/express": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
-      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
-      "license": "MIT",
-      "dependencies": {
-        "accepts": "^2.0.0",
-        "body-parser": "^2.2.1",
-        "content-disposition": "^1.0.0",
-        "content-type": "^1.0.5",
-        "cookie": "^0.7.1",
-        "cookie-signature": "^1.2.1",
-        "debug": "^4.4.0",
-        "depd": "^2.0.0",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "etag": "^1.8.1",
-        "finalhandler": "^2.1.0",
-        "fresh": "^2.0.0",
-        "http-errors": "^2.0.0",
-        "merge-descriptors": "^2.0.0",
-        "mime-types": "^3.0.0",
-        "on-finished": "^2.4.1",
-        "once": "^1.4.0",
-        "parseurl": "^1.3.3",
-        "proxy-addr": "^2.0.7",
-        "qs": "^6.14.0",
-        "range-parser": "^1.2.1",
-        "router": "^2.2.0",
-        "send": "^1.1.0",
-        "serve-static": "^2.2.0",
-        "statuses": "^2.0.1",
-        "type-is": "^2.0.1",
-        "vary": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/express-rate-limit": {
-      "version": "8.6.2",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.6.2.tgz",
-      "integrity": "sha512-YH4ru+eOJxQABscKFfRCy9R7x9QFGdezclVMwwgFFndzS2Xnm0uo6B0ABZsLhcpeptGv2qvuJVWlQr9gQZoC3A==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.3",
-        "ip-address": "^10.2.0"
-      },
-      "engines": {
-        "node": ">= 16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/express-rate-limit"
-      },
-      "peerDependencies": {
-        "express": ">= 4.11"
-      }
-    },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "license": "MIT"
-    },
-    "node_modules/fast-uri": {
-      "version": "3.1.6",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz",
-      "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/finalhandler": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
-      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.0",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "on-finished": "^2.4.1",
-        "parseurl": "^1.3.3",
-        "statuses": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 18.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/forwarded": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
-      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/fresh": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
-      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/function-bind": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-intrinsic": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "es-define-property": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "es-object-atoms": "^1.1.1",
-        "function-bind": "^1.1.2",
-        "get-proto": "^1.0.1",
-        "gopd": "^1.2.0",
-        "has-symbols": "^1.1.0",
-        "hasown": "^2.0.2",
-        "math-intrinsics": "^1.1.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
-      "license": "MIT",
-      "dependencies": {
-        "dunder-proto": "^1.0.1",
-        "es-object-atoms": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/gopd": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-symbols": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/hasown": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
-      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
-      "license": "MIT",
-      "dependencies": {
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/hono": {
-      "version": "4.13.4",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.4.tgz",
-      "integrity": "sha512-AGEwKIyRMHRv1t8Wjwa3LHxQ61X5CqrdFT+4BRNTpqS5aJNnpl5WLjADb7vFlJzI/8uK7T5QLVApCMQKNa3LgQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.9.0"
-      }
-    },
-    "node_modules/http-errors": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
-      "license": "MIT",
-      "dependencies": {
-        "depd": "~2.0.0",
-        "inherits": "~2.0.4",
-        "setprototypeof": "~1.2.0",
-        "statuses": "~2.0.2",
-        "toidentifier": "~1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/iconv-lite": {
-      "version": "0.7.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
-      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC"
-    },
-    "node_modules/ip-address": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
-      "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/ipaddr.js": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
-      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.10"
-      }
-    },
-    "node_modules/is-promise": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
-      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
-      "license": "MIT"
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC"
-    },
-    "node_modules/jose": {
-      "version": "6.2.10",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.10.tgz",
-      "integrity": "sha512-iiW7J9qRFlGxvCOIBDBDxFePQSn7ZMAnrYGhrrOo6siO/MIqwfyilLR27pkfDgUk+raLuzADS8A3S/KLBisc0g==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/panva"
-      }
-    },
-    "node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "license": "MIT"
-    },
-    "node_modules/json-schema-typed": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz",
-      "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
-      "license": "BSD-2-Clause"
-    },
-    "node_modules/math-intrinsics": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/media-typer": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz",
-      "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/merge-descriptors": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
-      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/mime-db": {
-      "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/mime-types": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "^1.54.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
-    },
-    "node_modules/negotiator": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz",
-      "integrity": "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==",
-      "license": "MIT",
-      "dependencies": {
-        "content-type": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/negotiator/node_modules/content-type": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/object-assign": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-inspect": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
-      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/on-finished": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
-      "license": "MIT",
-      "dependencies": {
-        "ee-first": "1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
-    "node_modules/parseurl": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
-      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/path-to-regexp": {
-      "version": "8.4.2",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
-      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/pkce-challenge": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz",
-      "integrity": "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.20.0"
-      }
-    },
-    "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
-      "license": "MIT",
-      "dependencies": {
-        "forwarded": "0.2.0",
-        "ipaddr.js": "1.9.1"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      }
-    },
-    "node_modules/qs": {
-      "version": "6.15.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "es-define-property": "^1.0.1",
-        "side-channel": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=0.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/range-parser": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
-      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/raw-body": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
-      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
-      "license": "MIT",
-      "dependencies": {
-        "bytes": "~3.1.2",
-        "http-errors": "~2.0.1",
-        "iconv-lite": "~0.7.0",
-        "unpipe": "~1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      }
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/router": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
-      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.0",
-        "depd": "^2.0.0",
-        "is-promise": "^4.0.0",
-        "parseurl": "^1.3.3",
-        "path-to-regexp": "^8.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "license": "MIT"
-    },
-    "node_modules/send": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
-      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.4.3",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "etag": "^1.8.1",
-        "fresh": "^2.0.0",
-        "http-errors": "^2.0.1",
-        "mime-types": "^3.0.2",
-        "ms": "^2.1.3",
-        "on-finished": "^2.4.1",
-        "range-parser": "^1.2.1",
-        "statuses": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/serve-static": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
-      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
-      "license": "MIT",
-      "dependencies": {
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "parseurl": "^1.3.3",
-        "send": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/setprototypeof": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
-      "license": "ISC"
-    },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "license": "MIT",
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/side-channel": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
-      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.4",
-        "side-channel-list": "^1.0.1",
-        "side-channel-map": "^1.0.1",
-        "side-channel-weakmap": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/side-channel-list": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
-      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/side-channel-map": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
-      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bound": "^1.0.2",
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.5",
-        "object-inspect": "^1.13.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/side-channel-weakmap": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
-      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bound": "^1.0.2",
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.5",
-        "object-inspect": "^1.13.3",
-        "side-channel-map": "^1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/statuses": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/toidentifier": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.6"
-      }
-    },
-    "node_modules/type-is": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
-      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
-      "license": "MIT",
-      "dependencies": {
-        "content-type": "^2.0.0",
-        "media-typer": "^1.1.0",
-        "mime-types": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/type-is/node_modules/content-type": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "6.21.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
-      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/unpipe": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
-      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/vary": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "license": "ISC",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "license": "ISC"
-    },
-    "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    },
-    "node_modules/zod-to-json-schema": {
-      "version": "3.25.2",
-      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz",
-      "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==",
-      "license": "ISC",
-      "peerDependencies": {
-        "zod": "^3.25.28 || ^4"
-      }
-    }
-  }
-}
diff --git a/mcp-server/package.json b/mcp-server/package.json
index 8c5608814..b59545a65 100644
--- a/mcp-server/package.json
+++ b/mcp-server/package.json
@@ -1,44 +1,21 @@
 {
   "name": "jotty-mcp",
-  "version": "1.0.0",
-  "description": "MCP server that exposes a remote jotty·page instance (checklists, notes, kanban boards, and more) over stdio via its REST API.",
+  "version": "0.1.0",
+  "private": true,
   "type": "module",
-  "bin": {
-    "jotty-mcp": "dist/index.js"
-  },
-  "main": "dist/index.js",
-  "files": [
-    "dist",
-    "README.md"
-  ],
+  "module": "src/main.ts",
   "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "start": "node dist/index.js",
-    "smoke": "node scripts/smoke.mjs",
-    "integration": "node scripts/integration.mjs",
-    "integration:http": "node scripts/integration-http.mjs",
-    "live": "node scripts/live-lifecycle.mjs"
+    "start": "bun run src/main.ts",
+    "dev": "bun --watch src/main.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test",
+    "build": "bun build src/main.ts --target=bun --outdir=dist --minify"
   },
-  "keywords": [
-    "mcp",
-    "model-context-protocol",
-    "jotty",
-    "jotty.page",
-    "checklist",
-    "kanban",
-    "notes"
-  ],
-  "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "zod": "^3.25.76"
+    "@modelcontextprotocol/sdk": "1.30.0"
   },
   "devDependencies": {
-    "@types/node": "^20.19.0",
-    "typescript": "^5.9.0"
-  },
-  "engines": {
-    "node": ">=20"
+    "@types/bun": "1.3.14",
+    "typescript": "5.9.3"
   }
-}
\ No newline at end of file
+}
diff --git a/mcp-server/scripts/integration-http.mjs b/mcp-server/scripts/integration-http.mjs
deleted file mode 100644
index b0a1a0533..000000000
--- a/mcp-server/scripts/integration-http.mjs
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Real integration test for the HTTP (Streamable HTTP) transport. Uses the MCP
- * SDK's own Client against the running jotty-mcp http server, which in turn
- * proxies to a running Jotty instance. Validates the full
- *   Cursor-like client -> MCP http server -> Jotty REST API
- * path over the network.
- *
- * Env: MCP_URL (http endpoint), JOTTY_API_KEY (ck_… sent as x-api-key header).
- */
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-
-const mcpUrl = process.env.MCP_URL || "http://127.0.0.1:3001/mcp";
-const apiKey = process.env.JOTTY_API_KEY;
-
-let ok = true;
-const check = (cond, msg) => {
-  if (!cond) {
-    ok = false;
-    console.error("  FAIL:", msg);
-  } else {
-    console.log("  ok:", msg);
-  }
-};
-
-const transport = new StreamableHTTPClientTransport(new URL(mcpUrl), {
-  requestInit: {
-    headers: { "x-api-key": apiKey },
-  },
-});
-const client = new Client({ name: "http-integration-test", version: "0.0.1" });
-
-try {
-  await client.connect(transport);
-  check(true, "client connected to MCP http server");
-
-  const tools = await client.listTools();
-  check(tools.tools.length >= 40, `listTools returned ${tools.tools.length} tools`);
-  check(
-    tools.tools.some((t) => t.name === "list_checklists"),
-    "tool list includes list_checklists",
-  );
-
-  // health (public)
-  const health = await client.callTool({ name: "health", arguments: {} });
-  const healthData = JSON.parse(health.content[0].text);
-  check(healthData.status === "healthy", `health => ${healthData.status} v${healthData.version}`);
-  check(health.isError !== true, "health is not an error");
-
-  // list_checklists (authenticated, proxied to Jotty)
-  const lists = await client.callTool({ name: "list_checklists", arguments: {} });
-  const listsData = JSON.parse(lists.content[0].text);
-  check(Array.isArray(listsData.checklists), `list_checklists => ${listsData.checklists?.length} lists`);
-
-  // get_summary
-  const summary = await client.callTool({ name: "get_summary", arguments: {} });
-  const summaryData = JSON.parse(summary.content[0].text);
-  check(typeof summaryData.summary.checklists.total === "number", "get_summary returns numbers");
-
-  // create + delete round-trip over HTTP
-  const created = await client.callTool({
-    name: "create_checklist",
-    arguments: { title: "HTTP MCP Test", category: "MCP-HTTP", type: "simple" },
-  });
-  const createdData = JSON.parse(created.content[0].text);
-  const newId = createdData.data?.id;
-  check(!!newId, `create_checklist => id ${newId}`);
-  if (newId) {
-    const del = await client.callTool({ name: "delete_checklist", arguments: { listId: newId } });
-    check(del.content[0].text.includes("true"), "delete_checklist ok");
-  }
-
-  // error path: bad uuid
-  const bad = await client.callTool({ name: "get_note", arguments: { noteId: "not-real-uuid-9999" } });
-  check(bad.isError === true, "get_note bad uuid => isError");
-
-  console.log(ok ? "\nHTTP INTEGRATION TEST PASSED" : "\nHTTP INTEGRATION TEST FAILED");
-  process.exit(ok ? 0 : 1);
-} catch (err) {
-  console.error("test crashed:", err);
-  process.exit(1);
-} finally {
-  await transport.close();
-}
\ No newline at end of file
diff --git a/mcp-server/scripts/integration.mjs b/mcp-server/scripts/integration.mjs
deleted file mode 100644
index 9408b3dcf..000000000
--- a/mcp-server/scripts/integration.mjs
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
- * Real integration test: starts the built jotty-mcp stdio server pointed at a
- * live Jotty instance and drives authenticated MCP tool calls through it,
- * verifying the full MCP -> REST proxy path returns real data.
- *
- * Env: JOTTY_URL, JOTTY_API_KEY (the test key injected into users.json).
- */
-import { spawn } from "node:child_process";
-
-const child = spawn("node", ["dist/index.js"], {
-  cwd: process.cwd(),
-  env: process.env,
-  stdio: ["pipe", "pipe", "pipe"],
-});
-
-let buf = "";
-const responses = new Map();
-child.stdout.on("data", (chunk) => {
-  buf += chunk.toString();
-  let idx;
-  while ((idx = buf.indexOf("\n")) >= 0) {
-    const line = buf.slice(0, idx).trim();
-    buf = buf.slice(idx + 1);
-    if (line) {
-      try {
-        const obj = JSON.parse(line);
-        if (obj.id != null) responses.set(obj.id, obj);
-      } catch {
-        /* ignore */
-      }
-    }
-  }
-});
-const stderr = [];
-child.stderr.on("data", (c) => stderr.push(c.toString()));
-
-let nextId = 1;
-const pending = new Map();
-function send(method, params) {
-  const id = nextId++;
-  return new Promise((resolve) => {
-    pending.set(id, resolve);
-    child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n");
-  });
-}
-// Resolve pending as responses arrive.
-const checkInterval = setInterval(() => {
-  for (const [id, resolve] of pending) {
-    if (responses.has(id)) {
-      pending.delete(id);
-      resolve(responses.get(id));
-    }
-  }
-}, 50);
-
-function callTool(name, args) {
-  return send("tools/call", { name, arguments: args });
-}
-
-function parseText(res) {
-  const t = res?.result?.content?.[0]?.text;
-  return t ? JSON.parse(t) : null;
-}
-
-async function main() {
-  let ok = true;
-  const check = (cond, msg) => {
-    if (!cond) {
-      ok = false;
-      console.error("  FAIL:", msg);
-    } else {
-      console.log("  ok:", msg);
-    }
-  };
-
-  // initialize
-  const init = await send("initialize", {
-    protocolVersion: "2025-06-18",
-    capabilities: {},
-    clientInfo: { name: "integration-test", version: "0.0.1" },
-  });
-  child.stdin.write(
-    JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }) + "\n",
-  );
-  check(init?.result?.serverInfo?.name === "jotty", "initialize ok");
-
-  // health (public)
-  const health = await callTool("health", {});
-  const healthData = parseText(health);
-  check(healthData?.status === "healthy", "health returns healthy status");
-  check(!!healthData?.version, `health version=${healthData?.version}`);
-
-  // list_checklists (authenticated)
-  const lists = await callTool("list_checklists", {});
-  const listsData = parseText(lists);
-  check(Array.isArray(listsData?.checklists), `list_checklists returns array (len=${listsData?.checklists?.length})`);
-  const firstList = listsData?.checklists?.[0];
-  if (firstList) {
-    check(!!firstList.id, `first checklist has id: ${firstList.id}`);
-    check(typeof firstList.title === "string", `first checklist has title: ${firstList.title}`);
-  }
-
-  // get_summary (authenticated)
-  const summary = await callTool("get_summary", {});
-  const summaryData = parseText(summary);
-  check(!!summaryData?.summary, "get_summary returns summary object");
-  check(typeof summaryData.summary.notes?.total === "number", `summary notes.total=${summaryData.summary.notes?.total}`);
-  check(typeof summaryData.summary.checklists?.total === "number", `summary checklists.total=${summaryData.summary.checklists?.total}`);
-
-  // list_categories (authenticated)
-  const cats = await callTool("list_categories", {});
-  const catsData = parseText(cats);
-  check(!!catsData?.categories, "list_categories returns categories");
-  check(Array.isArray(catsData.categories?.notes), "categories.notes is array");
-  check(Array.isArray(catsData.categories?.checklists), "categories.checklists is array");
-
-  // list_notes (authenticated)
-  const notes = await callTool("list_notes", {});
-  const notesData = parseText(notes);
-  check(Array.isArray(notesData?.notes), `list_notes returns array (len=${notesData?.notes?.length})`);
-
-  // create + delete a checklist round-trip
-  const created = await callTool("create_checklist", {
-    title: "MCP Integration Test Checklist",
-    category: "MCP-Test",
-    type: "simple",
-  });
-  const createdData = parseText(created);
-  const newId = createdData?.data?.id;
-  check(!!newId, `create_checklist returned id: ${newId}`);
-  if (newId) {
-    const itemRes = await callTool("create_checklist_item", {
-      listId: newId,
-      text: "Item added via MCP",
-    });
-    check(itemRes?.result?.content?.[0]?.text.includes("true"), "create_checklist_item ok");
-    const del = await callTool("delete_checklist", { listId: newId });
-    check(del?.result?.content?.[0]?.text.includes("true"), "delete_checklist ok");
-  }
-
-  // search (authenticated)
-  const search = await callTool("search", { q: "the", type: "note" });
-  const searchData = parseText(search);
-  check(Array.isArray(searchData?.results), `search returns results array (len=${searchData?.results?.length})`);
-
-  // error path: bad UUID should be isError
-  const bad = await callTool("get_note", { noteId: "not-a-real-uuid-1234" });
-  check(bad?.result?.isError === true, "get_note with bad uuid returns isError");
-
-  clearInterval(checkInterval);
-  child.stdin.end();
-  child.kill();
-
-  console.log("stderr:", stderr.join("").trim() || "(empty)");
-  console.log(ok ? "\nINTEGRATION TEST PASSED" : "\nINTEGRATION TEST FAILED");
-  process.exit(ok ? 0 : 1);
-}
-
-main().catch((e) => {
-  console.error("test crashed:", e);
-  process.exit(1);
-});
\ No newline at end of file
diff --git a/mcp-server/scripts/live-lifecycle.mjs b/mcp-server/scripts/live-lifecycle.mjs
deleted file mode 100644
index 8ce3ecad9..000000000
--- a/mcp-server/scripts/live-lifecycle.mjs
+++ /dev/null
@@ -1,243 +0,0 @@
-/*
- * Live MCP lifecycle test against a real Jotty instance.
- *
- * Drives the actual jotty-mcp tools (MCP Client -> stdio server -> Jotty REST API):
- *   - health, summary, categories, search (reads)
- *   - note: create -> update -> get -> delete
- *   - checklist: create -> add item -> edit item -> check -> uncheck -> delete
- *   - kanban board: create -> add item -> move status -> assign -> reminder -> delete
- *
- * Everything created here is deleted at the end so the test account is left clean.
- *
- * Env: JOTTY_URL, JOTTY_API_KEY
- */
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
-
-const here = dirname(fileURLToPath(import.meta.url));
-const serverPath = join(here, "..", "dist", "index.js");
-
-const jottyUrl = process.env.JOTTY_URL;
-const apiKey = process.env.JOTTY_API_KEY;
-if (!jottyUrl || !apiKey) {
-  console.error("JOTTY_URL and JOTTY_API_KEY are required");
-  process.exit(2);
-}
-
-const created = { notes: [], checklists: [], boards: [] };
-let ok = true;
-const check = (cond, msg) => {
-  if (!cond) {
-    ok = false;
-    console.error("  FAIL:", msg);
-  } else {
-    console.log("  ok:", msg);
-  }
-};
-
-const transport = new StdioClientTransport({
-  command: "node",
-  args: [serverPath],
-  env: {
-    ...process.env,
-    JOTTY_URL: jottyUrl,
-    JOTTY_API_KEY: apiKey,
-  },
-});
-const client = new Client({ name: "live-lifecycle-test", version: "1.0.0" });
-
-const tool = async (name, args) => {
-  const res = await client.callTool({ name, arguments: args ?? {} });
-  const text = res.content?.[0]?.text;
-  let data = null;
-  try {
-    data = text ? JSON.parse(text) : null;
-  } catch {
-    /* non-json */
-  }
-  return { isError: res.isError === true, data, raw: text };
-};
-
-async function main() {
-  await client.connect(transport);
-  check(true, "connected to jotty-mcp over stdio");
-
-  console.log("\n== reads ==");
-  const health = await tool("health");
-  check(health.data?.status === "healthy", `health => ${health.data?.status} v${health.data?.version}`);
-
-  const summary = await tool("get_summary");
-  const before = {
-    notes: summary.data?.summary?.notes?.total,
-    lists: summary.data?.summary?.checklists?.total,
-  };
-  check(typeof before.notes === "number", `summary before => notes=${before.notes} checklists=${before.lists}`);
-
-  const cats = await tool("list_categories");
-  check(!!cats.data?.categories, "list_categories ok");
-
-  const me = await tool("get_current_user");
-  check(!!me.data?.user?.username, `get_current_user => "${me.data?.user?.username}"`);
-  check(me.data?.user?.apiKey === undefined, "get_current_user does not leak apiKey");
-
-  console.log("\n== note lifecycle ==");
-  const createdNote = await tool("create_note", {
-    title: "MCP Test Note",
-    content: "# Created via MCP\n\nThis note was created by the jotty-mcp lifecycle test.",
-    category: "MCP-Test",
-  });
-  const noteId = createdNote.data?.data?.id;
-  check(!!noteId, `create_note => id ${noteId}`);
-  created.notes.push(noteId);
-
-  const updatedNote = await tool("update_note", {
-    noteId,
-    title: "MCP Test Note (edited)",
-    content: "# Edited via MCP\n\nContent was updated. Adds a [searchable-token](link).",
-  });
-  check(updatedNote.data?.data?.title?.includes("edited"), `update_note => "${updatedNote.data?.data?.title}"`);
-
-  const gotNote = await tool("get_note", { noteId });
-  check(
-    gotNote.data?.data?.content?.includes("Edited via MCP"),
-    "get_note returns updated content",
-  );
-
-  const noteSearch = await tool("search", { q: "searchable-token", type: "note" });
-  check(
-    (noteSearch.data?.results ?? []).some((r) => r.uuid === noteId || r.id === noteId),
-    "search finds the note by content",
-  );
-
-  console.log("\n== checklist lifecycle ==");
-  const createdList = await tool("create_checklist", {
-    title: "MCP Test Checklist",
-    category: "MCP-Test",
-    type: "simple",
-  });
-  const listId = createdList.data?.data?.id;
-  check(!!listId, `create_checklist => id ${listId}`);
-  created.checklists.push(listId);
-
-  const item1 = await tool("create_checklist_item", {
-    listId,
-    text: "First item — created via MCP",
-  });
-  check(item1.data?.success === true, "create_checklist_item #1");
-
-  const item2 = await tool("create_checklist_item", {
-    listId,
-    text: "Second item",
-  });
-  check(item2.data?.success === true, "create_checklist_item #2");
-
-  const editItem = await tool("update_checklist_item", {
-    listId,
-    itemIndex: "0",
-    text: "First item — EDITED via MCP",
-    priority: "high",
-  });
-  check(editItem.data?.success === true, "update_checklist_item (text + priority)");
-
-  const checkIt = await tool("check_item", { listId, itemIndex: "1" });
-  check(checkIt.data?.success === true, "check_item #2");
-
-  const listsNow = await tool("list_checklists", { category: "MCP-Test" });
-  const ourList = (listsNow.data?.checklists ?? []).find((l) => l.id === listId);
-  check(!!ourList, "list_checklists (filtered) returns the new list");
-  check(ourList?.items?.length === 2, `list has 2 items (got ${ourList?.items?.length})`);
-  check(ourList?.items?.[1]?.completed === true, "item #2 is completed after check_item");
-
-  const uncheckIt = await tool("uncheck_item", { listId, itemIndex: "1" });
-  check(uncheckIt.data?.success === true, "uncheck_item #2");
-
-  console.log("\n== kanban board lifecycle ==");
-  const createdBoard = await tool("create_board", {
-    title: "MCP Test Board",
-    category: "MCP-Test",
-    statuses: [
-      { id: "todo", label: "To Do", order: 0 },
-      { id: "doing", label: "Doing", order: 1, color: "#3b82f6" },
-      { id: "done", label: "Done", order: 2 },
-    ],
-  });
-  const boardId = createdBoard.data?.data?.id;
-  check(!!boardId, `create_board => id ${boardId}`);
-  created.boards.push(boardId);
-
-  const boardItem = await tool("create_board_item", {
-    boardId,
-    text: "Task A",
-    status: "todo",
-    description: "Created via MCP",
-  });
-  const itemId = boardItem.data?.data?.id;
-  check(!!itemId, `create_board_item => id ${itemId}`);
-
-  const moved = await tool("move_board_item", { boardId, itemId, status: "doing" });
-  check(moved.data?.success === true, "move_board_item todo -> doing");
-
-  const assigned = await tool("assign_board_item", { boardId, itemId, assignee: "" });
-  check(assigned.data?.success === true, "assign_board_item (clear)");
-
-  const reminder = await tool("set_board_item_reminder", {
-    boardId,
-    itemId,
-    datetime: "2099-01-01T09:00:00.000Z",
-  });
-  check(reminder.data?.success === true, "set_board_item_reminder");
-
-  const gotBoard = await tool("get_board", { boardId });
-  const bItem = (gotBoard.data?.board?.items ?? []).find((i) => i.id === itemId);
-  check(bItem?.status === "doing", `get_board shows item moved to doing`);
-  check(!!bItem?.reminder?.datetime, "get_board shows reminder set");
-
-  const clearReminder = await tool("clear_board_item_reminder", { boardId, itemId });
-  check(clearReminder.data?.success === true, "clear_board_item_reminder");
-
-  console.log("\n== summary after ==");
-  const summary2 = await tool("get_summary");
-  const after = {
-    notes: summary2.data?.summary?.notes?.total,
-    lists: summary2.data?.summary?.checklists?.total,
-  };
-  check(after.notes === before.notes + 1, `notes total went ${before.notes} -> ${after.notes}`);
-  // The simple checklist AND the kanban board both count as checklists.
-  check(after.lists === before.lists + 2, `checklists total went ${before.lists} -> ${after.lists} (+1 list, +1 board)`);
-
-  console.log("\n== cleanup ==");
-  for (const id of created.boards) {
-    const r = await tool("delete_board", { boardId: id });
-    check(r.data?.success === true, `delete_board ${id}`);
-  }
-  for (const id of created.checklists) {
-    const r = await tool("delete_checklist", { listId: id });
-    check(r.data?.success === true, `delete_checklist ${id}`);
-  }
-  for (const id of created.notes) {
-    const r = await tool("delete_note", { noteId: id });
-    check(r.data?.success === true, `delete_note ${id}`);
-  }
-
-  const summary3 = await tool("get_summary");
-  const finalCounts = {
-    notes: summary3.data?.summary?.notes?.total,
-    lists: summary3.data?.summary?.checklists?.total,
-  };
-  check(finalCounts.notes === before.notes, `notes restored to ${before.notes}`);
-  check(finalCounts.lists === before.lists, `checklists restored to ${before.lists}`);
-
-  console.log(ok ? "\nLIVE LIFECYCLE TEST PASSED" : "\nLIVE LIFECYCLE TEST FAILED");
-  process.exit(ok ? 0 : 1);
-}
-
-main().catch(async (e) => {
-  console.error("test crashed:", e);
-  // best-effort cleanup even on crash
-  for (const id of created.boards) await tool("delete_board", { boardId: id }).catch(() => {});
-  for (const id of created.checklists) await tool("delete_checklist", { listId: id }).catch(() => {});
-  for (const id of created.notes) await tool("delete_note", { noteId: id }).catch(() => {});
-  process.exit(1);
-});
\ No newline at end of file
diff --git a/mcp-server/scripts/smoke.mjs b/mcp-server/scripts/smoke.mjs
deleted file mode 100644
index 5f7589cdf..000000000
--- a/mcp-server/scripts/smoke.mjs
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Smoke test for the jotty-mcp stdio server. Spawns the built server with dummy
- * credentials and drives the MCP JSON-RPC protocol over stdin, checking that
- * initialize, tools/list and a tools/call (health, against an unreachable URL)
- * behave correctly. No real Jotty instance is required.
- */
-import { spawn } from "node:child_process";
-
-const env = {
-  ...process.env,
-  JOTTY_URL: "http://127.0.0.1:9", // port 9 = discard; guarantees a connection failure
-  JOTTY_API_KEY: "ck_dummy_key_for_smoke_test",
-};
-
-const child = spawn("node", ["dist/index.js"], {
-  cwd: process.cwd(),
-  env,
-  stdio: ["pipe", "pipe", "pipe"],
-});
-
-let buf = "";
-const responses = [];
-child.stdout.on("data", (chunk) => {
-  buf += chunk.toString();
-  let idx;
-  while ((idx = buf.indexOf("\n")) >= 0) {
-    const line = buf.slice(0, idx).trim();
-    buf = buf.slice(idx + 1);
-    if (line) {
-      try {
-        responses.push(JSON.parse(line));
-      } catch {
-        responses.push({ _raw: line });
-      }
-    }
-  }
-});
-
-const stderr = [];
-child.stderr.on("data", (c) => stderr.push(c.toString()));
-
-const send = (obj) => child.stdin.write(JSON.stringify(obj) + "\n");
-
-// 1. initialize
-send({
-  jsonrpc: "2.0",
-  id: 1,
-  method: "initialize",
-  params: {
-    protocolVersion: "2025-06-18",
-    capabilities: {},
-    clientInfo: { name: "smoke-test", version: "0.0.1" },
-  },
-});
-
-// 2. initialized notification (no response expected)
-send({ jsonrpc: "2.0", method: "notifications/initialized" });
-
-// 3. tools/list
-send({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} });
-
-setTimeout(() => {
-  // 4. tools/call health — should fail gracefully (network error) with isError
-  send({
-    jsonrpc: "2.0",
-    id: 3,
-    method: "tools/call",
-    params: { name: "health", arguments: {} },
-  });
-}, 200);
-
-setTimeout(() => {
-  child.stdin.end();
-}, 800);
-
-child.on("close", (code) => {
-  const init = responses.find((r) => r.id === 1);
-  const list = responses.find((r) => r.id === 2);
-  const call = responses.find((r) => r.id === 3);
-
-  let ok = true;
-  const check = (cond, msg) => {
-    if (!cond) {
-      ok = false;
-      console.error("  FAIL:", msg);
-    } else {
-      console.log("  ok:", msg);
-    }
-  };
-
-  console.log("initialize:");
-  check(!!init, "initialize returned a result");
-  check(init?.result?.serverInfo?.name === "jotty", "server name is jotty");
-  check(!!init?.result?.capabilities?.tools, "advertises tools capability");
-
-  console.log("tools/list:");
-  check(!!list, "tools/list returned a result");
-  const names = (list?.result?.tools ?? []).map((t) => t.name);
-  check(names.length >= 40, `tools/list returned ${names.length} tools (>=40)`);
-  check(names.includes("list_checklists"), "includes list_checklists");
-  check(names.includes("create_note"), "includes create_note");
-  check(names.includes("move_board_item"), "includes move_board_item");
-  check(
-    !!list?.result?.tools?.find((t) => t.name === "list_checklists")?.inputSchema,
-    "list_checklists has an inputSchema",
-  );
-
-  console.log("tools/call health (unreachable URL):");
-  check(!!call, "health call returned a result");
-  check(call?.result?.isError === true, "health call reports isError (network failed)");
-  check(
-    typeof call?.result?.content?.[0]?.text === "string",
-    "health call returns a text content block",
-  );
-
-  console.log("stderr:", stderr.join("").trim() || "(empty)");
-  console.log("exit code:", code);
-  console.log(ok ? "\nSMOKE TEST PASSED" : "\nSMOKE TEST FAILED");
-  process.exit(ok ? 0 : 1);
-});
\ No newline at end of file
diff --git a/mcp-server/src/client.ts b/mcp-server/src/client.ts
deleted file mode 100644
index 14e06c18e..000000000
--- a/mcp-server/src/client.ts
+++ /dev/null
@@ -1,126 +0,0 @@
-/**
- * Minimal REST client for a remote jotty·page instance.
- *
- * Every authenticated Jotty endpoint is reached the same way: send a JSON
- * request with the `x-api-key` header and parse the JSON response. This class
- * centralises that so the tool modules only describe *what* to call.
- */
-
-export interface JottyClientOptions {
-  /** Base URL of the remote Jotty instance, e.g. https://jotty.example.com */
-  baseUrl: string;
-  /** API key (starts with `ck_`) generated from Jotty -> Profile -> Settings. */
-  apiKey: string;
-  /** Optional request timeout in milliseconds (default 30000). */
-  timeoutMs?: number;
-}
-
-export class JottyApiError extends Error {
-  constructor(
-    message: string,
-    readonly status: number,
-    readonly body: unknown,
-  ) {
-    super(message);
-    this.name = "JottyApiError";
-  }
-}
-
-type QueryValue = string | number | boolean | undefined | null;
-
-function buildQuery(params: Record<string, QueryValue>): string {
-  const parts: string[] = [];
-  for (const [key, value] of Object.entries(params)) {
-    if (value === undefined || value === null || value === "") continue;
-    parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
-  }
-  return parts.length ? `?${parts.join("&")}` : "";
-}
-
-export class JottyClient {
-  private readonly baseUrl: string;
-  private readonly apiKey: string;
-  private readonly timeoutMs: number;
-
-  constructor(options: JottyClientOptions) {
-    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-    this.apiKey = options.apiKey;
-    this.timeoutMs = options.timeoutMs ?? 30000;
-  }
-
-  private async request<T = unknown>(
-    method: string,
-    path: string,
-    query: Record<string, QueryValue> = {},
-    body?: unknown,
-  ): Promise<T> {
-    const url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}${buildQuery(query)}`;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-
-    try {
-      const headers: Record<string, string> = {
-        "x-api-key": this.apiKey,
-        Accept: "application/json",
-      };
-      const init: RequestInit = { method, headers, signal: controller.signal };
-      if (body !== undefined && method !== "GET" && method !== "DELETE") {
-        headers["Content-Type"] = "application/json";
-        init.body = JSON.stringify(body);
-      }
-
-      const res = await fetch(url, init);
-      const text = await res.text();
-      const parsed = text ? safeParse(text) : undefined;
-
-      if (!res.ok) {
-        const message =
-          (parsed && typeof parsed === "object" && "error" in parsed
-            ? String((parsed as { error: unknown }).error)
-            : `HTTP ${res.status}`) || `HTTP ${res.status}`;
-        throw new JottyApiError(message, res.status, parsed);
-      }
-      return parsed as T;
-    } catch (err) {
-      if (err instanceof JottyApiError) throw err;
-      if (err instanceof Error && err.name === "AbortError") {
-        throw new JottyApiError(
-          `Request timed out after ${this.timeoutMs}ms`,
-          408,
-          undefined,
-        );
-      }
-      throw new JottyApiError(
-        err instanceof Error ? err.message : "Network request failed",
-        0,
-        undefined,
-      );
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-
-  get<T = unknown>(path: string, query: Record<string, QueryValue> = {}): Promise<T> {
-    return this.request<T>("GET", path, query);
-  }
-  post<T = unknown>(path: string, body?: unknown, query: Record<string, QueryValue> = {}): Promise<T> {
-    return this.request<T>("POST", path, query, body);
-  }
-  put<T = unknown>(path: string, body?: unknown, query: Record<string, QueryValue> = {}): Promise<T> {
-    return this.request<T>("PUT", path, query, body);
-  }
-  patch<T = unknown>(path: string, body?: unknown, query: Record<string, QueryValue> = {}): Promise<T> {
-    return this.request<T>("PATCH", path, query, body);
-  }
-  delete<T = unknown>(path: string, query: Record<string, QueryValue> = {}): Promise<T> {
-    return this.request<T>("DELETE", path, query);
-  }
-}
-
-function safeParse(text: string): unknown {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-}
\ No newline at end of file
diff --git a/mcp-server/src/config/env.ts b/mcp-server/src/config/env.ts
new file mode 100644
index 000000000..6ce148fba
--- /dev/null
+++ b/mcp-server/src/config/env.ts
@@ -0,0 +1,14 @@
+export enum EnvVar {
+  JottyUrl = "JOTTY_URL",
+  ApiKey = "JOTTY_API_KEY",
+  Transport = "JOTTY_MCP_TRANSPORT",
+  Port = "JOTTY_MCP_PORT",
+  BindHost = "JOTTY_MCP_BIND_HOST",
+  AuthToken = "JOTTY_MCP_AUTH_TOKEN",
+  TimeoutMs = "JOTTY_MCP_TIMEOUT_MS",
+  MaxTextChars = "JOTTY_MCP_MAX_TEXT_CHARS",
+  SpecTtlMs = "JOTTY_MCP_SPEC_TTL_MS",
+  LogLevel = "JOTTY_MCP_LOG_LEVEL",
+}
+
+export const readEnv = (name: EnvVar): string => (process.env[name] ?? "").trim();
diff --git a/mcp-server/src/config/load.ts b/mcp-server/src/config/load.ts
new file mode 100644
index 000000000..5b336d167
--- /dev/null
+++ b/mcp-server/src/config/load.ts
@@ -0,0 +1,38 @@
+import { EnvVar, readEnv } from "./env.ts";
+import { Transport, type McpConfig } from "./schema.ts";
+
+export const DEFAULT_CONFIG: McpConfig = {
+  jotty: { url: "http://localhost:3000", apiKey: "", timeoutMs: 30_000 },
+  server: { transport: Transport.Stdio, port: 3001, host: "", authToken: "" },
+  output: { maxTextChars: 12_000 },
+  specTtlMs: 300_000,
+};
+
+const positive = (raw: string, fallback: number): number => {
+  const value = Number(raw);
+  return Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+};
+
+const asTransport = (raw: string): Transport =>
+  Object.values(Transport).find((value) => value === raw.toLowerCase()) ??
+  DEFAULT_CONFIG.server.transport;
+
+const trimSlash = (url: string): string => url.replace(/\/+$/, "");
+
+export const loadConfig = (): McpConfig => ({
+  jotty: {
+    url: trimSlash(readEnv(EnvVar.JottyUrl) || DEFAULT_CONFIG.jotty.url),
+    apiKey: readEnv(EnvVar.ApiKey),
+    timeoutMs: positive(readEnv(EnvVar.TimeoutMs), DEFAULT_CONFIG.jotty.timeoutMs),
+  },
+  server: {
+    transport: asTransport(readEnv(EnvVar.Transport)),
+    port: positive(readEnv(EnvVar.Port), DEFAULT_CONFIG.server.port),
+    host: readEnv(EnvVar.BindHost),
+    authToken: readEnv(EnvVar.AuthToken),
+  },
+  output: {
+    maxTextChars: positive(readEnv(EnvVar.MaxTextChars), DEFAULT_CONFIG.output.maxTextChars),
+  },
+  specTtlMs: positive(readEnv(EnvVar.SpecTtlMs), DEFAULT_CONFIG.specTtlMs),
+});
diff --git a/mcp-server/src/config/schema.ts b/mcp-server/src/config/schema.ts
new file mode 100644
index 000000000..eec574cb3
--- /dev/null
+++ b/mcp-server/src/config/schema.ts
@@ -0,0 +1,28 @@
+export enum Transport {
+  Stdio = "stdio",
+  Http = "http",
+}
+
+export interface JottyConfig {
+  url: string;
+  apiKey: string;
+  timeoutMs: number;
+}
+
+export interface ServerConfig {
+  transport: Transport;
+  port: number;
+  host: string;
+  authToken: string;
+}
+
+export interface OutputConfig {
+  maxTextChars: number;
+}
+
+export interface McpConfig {
+  jotty: JottyConfig;
+  server: ServerConfig;
+  output: OutputConfig;
+  specTtlMs: number;
+}
diff --git a/mcp-server/src/http.ts b/mcp-server/src/http.ts
deleted file mode 100644
index c3e1c45bc..000000000
--- a/mcp-server/src/http.ts
+++ /dev/null
@@ -1,217 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-
-import { JottyClient } from "./client.js";
-import { registerAllTools } from "./tools/index.js";
-
-export interface HttpServerOptions {
-  /** Base URL of the Jotty REST API the server will proxy to. */
-  jottyUrl: string;
-  /** Bind host (default 0.0.0.0). */
-  host?: string;
-  /** Bind port (default 3001). */
-  port?: number;
-  /** Optional request timeout forwarded to each per-session JottyClient. */
-  timeoutMs?: number;
-  /**
-   * Optional shared secret protecting the MCP endpoint. When set, clients must
-   * send `Authorization: Bearer <token>`. When unset the endpoint is open —
-   * rely on network restrictions (localhost / Tailscale / reverse proxy).
-   */
-  mcpToken?: string;
-  /**
-   * Optional fallback Jotty API key used when a client connects without an
-   * `x-api-key` header. Lets you run a single-tenant server where the key is
-   * configured server-side instead of per-client.
-   */
-  fallbackApiKey?: string;
-}
-
-/** Header the client sends to supply its Jotty API key (ck_…). */
-const JOTTY_API_KEY_HEADER = "x-api-key";
-
-/** Read the raw request body as a string. Empty bodies (GET/DELETE) resolve to "". */
-function readBody(req: IncomingMessage): Promise<string> {
-  return new Promise((resolve, reject) => {
-    let data = "";
-    req.on("data", (chunk) => {
-      data += chunk;
-    });
-    req.on("end", () => resolve(data));
-    req.on("error", reject);
-  });
-}
-
-function getHeader(req: IncomingMessage, name: string): string | undefined {
-  const value = req.headers[name.toLowerCase()];
-  return Array.isArray(value) ? value[0] : value;
-}
-
-/**
- * Build a fresh per-session transport bound to a fresh McpServer + JottyClient
- * carrying this client's API key. Returns the transport once `server.connect`
- * has wired everything together (sessionId is populated after the initialize
- * request is handled by the caller).
- */
-async function createSession(
-  req: IncomingMessage,
-  options: Required<Pick<HttpServerOptions, "jottyUrl" | "timeoutMs">> &
-    Pick<HttpServerOptions, "fallbackApiKey">,
-): Promise<StreamableHTTPServerTransport> {
-  const apiKey = getHeader(req, JOTTY_API_KEY_HEADER) || options.fallbackApiKey;
-  if (!apiKey) {
-    throw new Error(
-      `Missing Jotty API key. Send it as the "${JOTTY_API_KEY_HEADER}" header (value starts with ck_).`,
-    );
-  }
-
-  const client = new JottyClient({
-    baseUrl: options.jottyUrl,
-    apiKey,
-    timeoutMs: options.timeoutMs,
-  });
-  const transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: () => randomUUID(),
-  });
-  const server = new McpServer({ name: "jotty", version: "1.0.0" });
-  registerAllTools(server, client);
-
-  await server.connect(transport);
-  return transport;
-}
-
-/**
- * Start the Streamable HTTP MCP server. Each connecting client is given its
- * own `McpServer` + `JottyClient` so per-client API keys and timeouts stay
- * isolated. Session state is kept in memory.
- */
-export async function startHttpServer(options: HttpServerOptions): Promise<void> {
-  const {
-    jottyUrl,
-    host = "0.0.0.0",
-    port = 3001,
-    timeoutMs = 30000,
-    mcpToken,
-    fallbackApiKey,
-  } = options;
-
-  const transports = new Map<string, StreamableHTTPServerTransport>();
-
-  const authenticate = (req: IncomingMessage): boolean => {
-    if (!mcpToken) return true;
-    const auth = getHeader(req, "authorization") || "";
-    return auth === `Bearer ${mcpToken}`;
-  };
-
-  const httpServer = createServer(
-    async (req: IncomingMessage, res: ServerResponse) => {
-      const path = (req.url || "/").split("?")[0];
-      if (path !== "/mcp") {
-        res.writeHead(404, { "content-type": "text/plain" });
-        res.end("Not found. Use POST /mcp.");
-        return;
-      }
-
-      if (!authenticate(req)) {
-        res.writeHead(401, { "content-type": "text/plain" });
-        res.end("Unauthorized.");
-        return;
-      }
-
-      try {
-        if (req.method === "POST") {
-          const body = await readBody(req);
-          let parsed: unknown;
-          try {
-            parsed = body ? JSON.parse(body) : undefined;
-          } catch {
-            res.writeHead(400, { "content-type": "text/plain" });
-            res.end("Invalid JSON body.");
-            return;
-          }
-
-          const sessionId = getHeader(req, "mcp-session-id");
-          if (sessionId) {
-            // Existing session: hand the message to its transport.
-            const transport = transports.get(sessionId);
-            if (!transport) {
-              res.writeHead(404, { "content-type": "text/plain" });
-              res.end("Session not found.");
-              return;
-            }
-            await transport.handleRequest(req, res, parsed);
-            return;
-          }
-
-          // No session id -> must be an initialize request starting a new session.
-          if (!isInitializeRequest(parsed)) {
-            res.writeHead(400, { "content-type": "text/plain" });
-            res.end("Missing mcp-session-id; initialize first.");
-            return;
-          }
-
-          let transport: StreamableHTTPServerTransport;
-          try {
-            transport = await createSession(req, { jottyUrl, timeoutMs, fallbackApiKey });
-          } catch (err) {
-            res.writeHead(401, { "content-type": "text/plain" });
-            res.end(err instanceof Error ? err.message : String(err));
-            return;
-          }
-          await transport.handleRequest(req, res, parsed);
-          if (transport.sessionId) {
-            transports.set(transport.sessionId, transport);
-          }
-          return;
-        }
-
-        if (req.method === "GET" || req.method === "DELETE") {
-          const sessionId = getHeader(req, "mcp-session-id");
-          if (!sessionId) {
-            res.writeHead(400, { "content-type": "text/plain" });
-            res.end("Missing mcp-session-id.");
-            return;
-          }
-          const transport = transports.get(sessionId);
-          if (!transport) {
-            res.writeHead(404, { "content-type": "text/plain" });
-            res.end("Session not found.");
-            return;
-          }
-          await transport.handleRequest(req, res);
-          return;
-        }
-
-        res.writeHead(405, { allow: "GET, POST, DELETE", "content-type": "text/plain" });
-        res.end("Method not allowed.");
-      } catch (err) {
-        console.error("[jotty-mcp] error handling request:", err);
-        if (!res.headersSent) {
-          res.writeHead(500, { "content-type": "text/plain" });
-          res.end("Internal server error.");
-        }
-      }
-    },
-  );
-
-  return new Promise<void>((resolve, reject) => {
-    httpServer.on("error", reject);
-    httpServer.listen(port, host, () => {
-      console.error(`[jotty-mcp] Streamable HTTP server listening on http://${host}:${port}/mcp`);
-      console.error(`[jotty-mcp] proxying to Jotty at ${jottyUrl}`);
-      if (mcpToken) {
-        console.error("[jotty-mcp] endpoint protected by MCP_TOKEN (Bearer auth)");
-      } else {
-        console.error("[jotty-mcp] WARNING: no MCP_TOKEN set — endpoint is open; restrict network access");
-      }
-      if (fallbackApiKey) {
-        console.error("[jotty-mcp] using server-side fallback API key when client omits x-api-key");
-      }
-      resolve();
-    });
-  });
-}
\ No newline at end of file
diff --git a/mcp-server/src/index.ts b/mcp-server/src/index.ts
deleted file mode 100644
index 6022e5e22..000000000
--- a/mcp-server/src/index.ts
+++ /dev/null
@@ -1,103 +0,0 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-
-import { JottyClient } from "./client.js";
-import { registerAllTools } from "./tools/index.js";
-import { startHttpServer } from "./http.js";
-
-/**
- * Configuration is read from the environment.
- *
- * Required (both transports):
- *   JOTTY_URL       — base URL of the Jotty REST API the server proxies to
- *                     (stdio: your remote instance; http: usually http://localhost:3000)
- *   JOTTY_API_KEY   — Jotty API key (ck_…). Used directly in stdio mode; in http
- *                     mode it is only a fallback for clients that omit x-api-key.
- *
- * Transport selection:
- *   MCP_TRANSPORT   — "stdio" (default) | "http"
- *
- * HTTP mode only:
- *   MCP_HOST        — bind host (default 0.0.0.0)
- *   MCP_PORT        — bind port (default 3001)
- *   MCP_TOKEN       — optional shared secret; clients must send Authorization: Bearer <token>
- *
- * Optional (both):
- *   JOTTY_TIMEOUT_MS — per-request timeout in ms (default 30000)
- */
-function envOrThrow(name: string, message: string): string {
-  const value = process.env[name]?.trim();
-  if (!value) {
-    throw new Error(message);
-  }
-  return value;
-}
-
-function timeoutFromEnv(): number {
-  const n = Number.parseInt(process.env.JOTTY_TIMEOUT_MS ?? "", 10);
-  return Number.isFinite(n) && n > 0 ? n : 30000;
-}
-
-/** stdio: a single client (the launching AI app) with a single server/client pair. */
-async function runStdio(): Promise<void> {
-  const baseUrl = envOrThrow(
-    "JOTTY_URL",
-    "JOTTY_URL is required (the base URL of your Jotty instance, e.g. https://jotty.example.com).",
-  );
-  const apiKey = envOrThrow(
-    "JOTTY_API_KEY",
-    "JOTTY_API_KEY is required (generate one in Jotty -> Profile -> Settings -> API Key).",
-  );
-
-  const client = new JottyClient({ baseUrl, apiKey, timeoutMs: timeoutFromEnv() });
-  const server = new McpServer({ name: "jotty", version: "1.0.0" });
-  registerAllTools(server, client);
-
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-}
-
-/** http: a long-lived Streamable HTTP server with one McpServer per client session. */
-async function runHttp(): Promise<void> {
-  const jottyUrl = envOrThrow(
-    "JOTTY_URL",
-    "JOTTY_URL is required in http mode (where Jotty's REST API is, e.g. http://localhost:3000).",
-  );
-  const port = (() => {
-    const n = Number.parseInt(process.env.MCP_PORT ?? "", 10);
-    return Number.isFinite(n) && n > 0 ? n : 3001;
-  })();
-  const host = process.env.MCP_HOST?.trim() || "0.0.0.0";
-
-  const fallbackApiKey = process.env.JOTTY_API_KEY?.trim() || undefined;
-  const mcpToken = process.env.MCP_TOKEN?.trim() || undefined;
-
-  await startHttpServer({
-    jottyUrl,
-    host,
-    port,
-    timeoutMs: timeoutFromEnv(),
-    mcpToken,
-    fallbackApiKey,
-  });
-}
-
-async function main(): Promise<void> {
-  const transport = (process.env.MCP_TRANSPORT?.trim() || "stdio").toLowerCase();
-
-  if (transport === "http") {
-    await runHttp();
-    // The HTTP server keeps the process alive listening for requests.
-  } else if (transport === "stdio") {
-    await runStdio();
-    // The stdio transport keeps the process alive reading JSON-RPC from stdin.
-  } else {
-    throw new Error(`Unknown MCP_TRANSPORT "${transport}" — use "stdio" or "http".`);
-  }
-}
-
-main().catch((err) => {
-  // Configuration/startup errors go to stderr; stdout is reserved for MCP protocol.
-  console.error(err instanceof Error ? err.message : String(err));
-  process.exit(1);
-});
\ No newline at end of file
diff --git a/mcp-server/src/jotty/client.ts b/mcp-server/src/jotty/client.ts
new file mode 100644
index 000000000..d1f2c45ae
--- /dev/null
+++ b/mcp-server/src/jotty/client.ts
@@ -0,0 +1,95 @@
+import type { JottyConfig } from "../config/schema.ts";
+import { logger } from "../utils/logger.ts";
+import { withDeadline } from "../utils/timeout.ts";
+
+const LOG_NS = "jotty";
+const API_PREFIX = "/api";
+const API_KEY_HEADER = "x-api-key";
+const JSON_TYPE = "application/json";
+
+export class JottyError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+    readonly body?: unknown,
+  ) {
+    super(message);
+    this.name = "JottyError";
+  }
+}
+
+export interface JottyRequest {
+  method: string;
+  path: string;
+  query?: Record<string, string>;
+  body?: unknown;
+  signal?: AbortSignal;
+}
+
+export interface JottyResponse {
+  status: number;
+  contentType: string;
+  data: unknown;
+}
+
+export interface JottyClient {
+  baseUrl: string;
+  hasApiKey: boolean;
+  identity: string;
+  send: (request: JottyRequest) => Promise<JottyResponse>;
+}
+
+const _url = (baseUrl: string, path: string, query?: Record<string, string>): string => {
+  const url = new URL(`${baseUrl}${API_PREFIX}${path}`);
+  Object.entries(query ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));
+  return url.toString();
+};
+
+const _decode = async (response: Response): Promise<unknown> => {
+  const text = await response.text();
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+};
+
+const _messageOf = (data: unknown, status: number): string =>
+  data && typeof data === "object" && "error" in data && typeof data.error === "string"
+    ? data.error
+    : `Jotty answered ${status}`;
+
+const _fingerprint = (apiKey: string): string =>
+  new Bun.CryptoHasher("sha256").update(apiKey).digest("hex").slice(0, 16);
+
+export const createClient = (config: JottyConfig, apiKey = config.apiKey): JottyClient => ({
+  baseUrl: config.url,
+  hasApiKey: Boolean(apiKey),
+  identity: `${config.url}#${_fingerprint(apiKey)}`,
+  send: ({ method, path, query, body, signal }) =>
+    withDeadline(
+      config.timeoutMs,
+      async (combined) => {
+        const started = Date.now();
+        const response = await fetch(_url(config.url, path, query), {
+          method: method.toUpperCase(),
+          headers: {
+            ...(apiKey ? { [API_KEY_HEADER]: apiKey } : {}),
+            ...(body === undefined ? {} : { "content-type": JSON_TYPE }),
+          },
+          body: body === undefined ? undefined : JSON.stringify(body),
+          signal: combined,
+        });
+        const data = await _decode(response);
+        logger.debug(LOG_NS, `${method.toUpperCase()} ${path} ${response.status} ${Date.now() - started}ms`);
+        if (!response.ok) throw new JottyError(_messageOf(data, response.status), response.status, data);
+        return {
+          status: response.status,
+          contentType: response.headers.get("content-type") ?? "",
+          data,
+        };
+      },
+      signal,
+    ),
+});
diff --git a/mcp-server/src/jotty/openapi.ts b/mcp-server/src/jotty/openapi.ts
new file mode 100644
index 000000000..324fd82c1
--- /dev/null
+++ b/mcp-server/src/jotty/openapi.ts
@@ -0,0 +1,44 @@
+export type JsonSchema = {
+  $ref?: string;
+  type?: string | string[];
+  properties?: Record<string, JsonSchema>;
+  required?: string[];
+  items?: JsonSchema;
+  description?: string;
+  [keyword: string]: unknown;
+};
+
+export enum ParamLocation {
+  Path = "path",
+  Query = "query",
+}
+
+export interface SpecParameter {
+  name: string;
+  in: ParamLocation;
+  required: boolean;
+  description?: string;
+  schema: JsonSchema;
+}
+
+export interface SpecOperation {
+  operationId: string;
+  summary: string;
+  description?: string;
+  tags?: string[];
+  deprecated?: boolean;
+  security?: unknown[];
+  parameters?: SpecParameter[];
+  requestBody?: { content: Record<string, { schema: JsonSchema }> };
+}
+
+export interface OpenApiDocument {
+  info: { title: string; version: string };
+  paths: Record<string, Record<string, SpecOperation>>;
+  components?: { schemas?: Record<string, JsonSchema> };
+}
+
+export interface Operation extends SpecOperation {
+  method: string;
+  path: string;
+}
diff --git a/mcp-server/src/jotty/spec.ts b/mcp-server/src/jotty/spec.ts
new file mode 100644
index 000000000..4a73c1893
--- /dev/null
+++ b/mcp-server/src/jotty/spec.ts
@@ -0,0 +1,42 @@
+import type { JottyClient } from "./client.ts";
+import type { OpenApiDocument, Operation } from "./openapi.ts";
+
+const SPEC_PATH = "/openapi.json";
+
+export interface Spec {
+  version: string;
+  operations: Map<string, Operation>;
+  schemas: NonNullable<NonNullable<OpenApiDocument["components"]>["schemas"]>;
+}
+
+export interface SpecSource {
+  load: (client: JottyClient, signal?: AbortSignal) => Promise<Spec>;
+}
+
+export const toSpec = (doc: OpenApiDocument): Spec => ({
+  version: doc.info.version,
+  schemas: doc.components?.schemas ?? {},
+  operations: new Map(
+    Object.entries(doc.paths).flatMap(([path, methods]) =>
+      Object.entries(methods).map(([method, op]): [string, Operation] => [
+        op.operationId,
+        { ...op, method, path },
+      ]),
+    ),
+  ),
+});
+
+export const createSpecSource = (ttlMs: number): SpecSource => {
+  const cache = new Map<string, { spec: Spec; at: number }>();
+
+  return {
+    load: async (client, signal) => {
+      const hit = cache.get(client.identity);
+      if (hit && Date.now() - hit.at < ttlMs) return hit.spec;
+      const response = await client.send({ method: "get", path: SPEC_PATH, signal });
+      const spec = toSpec(response.data as OpenApiDocument);
+      cache.set(client.identity, { spec, at: Date.now() });
+      return spec;
+    },
+  };
+};
diff --git a/mcp-server/src/main.ts b/mcp-server/src/main.ts
new file mode 100644
index 000000000..a20a83725
--- /dev/null
+++ b/mcp-server/src/main.ts
@@ -0,0 +1,40 @@
+import { loadConfig } from "./config/load.ts";
+import { Transport } from "./config/schema.ts";
+import { createClient } from "./jotty/client.ts";
+import { createSpecSource } from "./jotty/spec.ts";
+import { createSidecar, startHttp } from "./server/http.ts";
+import { startStdio } from "./server/stdio.ts";
+import type { ToolContext } from "./tools/context.ts";
+import { logger } from "./utils/logger.ts";
+
+const LOG_NS = "main";
+
+export const bootstrap = (): ToolContext => {
+  const config = loadConfig();
+  return {
+    config,
+    client: createClient(config.jotty),
+    specs: createSpecSource(config.specTtlMs),
+    startedAt: Date.now(),
+  };
+};
+
+export const main = async (): Promise<void> => {
+  const ctx = bootstrap();
+  const running =
+    ctx.config.server.transport === Transport.Http
+      ? startHttp(createSidecar(ctx), ctx.config)
+      : await startStdio(ctx);
+
+  const shutdown = (signal: string): void => {
+    logger.info(LOG_NS, `${signal} received, shutting down`);
+    void running.stop().then(() => process.exit(0));
+  };
+
+  process.on("SIGINT", () => shutdown("SIGINT"));
+  process.on("SIGTERM", () => shutdown("SIGTERM"));
+};
+
+if (import.meta.main) {
+  await main();
+}
diff --git a/mcp-server/src/server/auth.ts b/mcp-server/src/server/auth.ts
new file mode 100644
index 000000000..d1de1a310
--- /dev/null
+++ b/mcp-server/src/server/auth.ts
@@ -0,0 +1,27 @@
+import { timingSafeEqual } from "node:crypto";
+
+export const API_KEY_HEADER = "x-api-key";
+
+export interface Guard {
+  required: boolean;
+  allows: (request: Request) => boolean;
+}
+
+const _same = (a: string, b: string): boolean => {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+};
+
+export const bearerOf = (request: Request): string => {
+  const header = request.headers.get("authorization") ?? "";
+  return header.toLowerCase().startsWith("bearer ") ? header.slice(7).trim() : "";
+};
+
+export const createGuard = (token: string): Guard => ({
+  required: Boolean(token),
+  allows: (request) => (token ? _same(bearerOf(request), token) : true),
+});
+
+export const deniedResponse = (): Response =>
+  Response.json({ error: "You shall not pass!" }, { status: 401 });
diff --git a/mcp-server/src/server/http.ts b/mcp-server/src/server/http.ts
new file mode 100644
index 000000000..67ca5c747
--- /dev/null
+++ b/mcp-server/src/server/http.ts
@@ -0,0 +1,68 @@
+import type { McpConfig } from "../config/schema.ts";
+import { createClient } from "../jotty/client.ts";
+import type { ToolContext } from "../tools/context.ts";
+import { logger } from "../utils/logger.ts";
+import { API_KEY_HEADER, createGuard, deniedResponse } from "./auth.ts";
+import { createMcpServer, SERVER_NAME, SERVER_VERSION } from "./mcp.ts";
+import { createSessionPool, type SessionPool } from "./sessions.ts";
+
+const LOG_NS = "http";
+const BUN_MAX_IDLE_SECONDS = 255;
+
+export enum HttpPath {
+  Mcp = "/mcp",
+  Health = "/health",
+  Healthz = "/healthz",
+}
+
+export interface Sidecar {
+  fetch: (request: Request) => Promise<Response>;
+  pool: SessionPool;
+  close: () => Promise<void>;
+}
+
+export const createSidecar = (ctx: ToolContext): Sidecar => {
+  const guard = createGuard(ctx.config.server.authToken);
+  const pool = createSessionPool((request) =>
+    createMcpServer({
+      ...ctx,
+      client: createClient(ctx.config.jotty, request.headers.get(API_KEY_HEADER)?.trim() || ctx.config.jotty.apiKey),
+    }),
+  );
+
+  if (!guard.required && ctx.config.jotty.apiKey) {
+    logger.warn(LOG_NS, "JOTTY_API_KEY is set without JOTTY_MCP_AUTH_TOKEN, anyone who reaches this port acts as that user");
+  }
+
+  const fetchRequest = async (request: Request): Promise<Response> => {
+    const path = new URL(request.url).pathname.replace(/\/+$/, "") || "/";
+    if (path === HttpPath.Health || path === HttpPath.Healthz) {
+      return Response.json({ ok: true, name: SERVER_NAME, version: SERVER_VERSION });
+    }
+    if (path !== HttpPath.Mcp) return Response.json({ error: "Not found" }, { status: 404 });
+    if (!guard.allows(request)) {
+      logger.warn(LOG_NS, "rejected /mcp request without a valid bearer token");
+      return deniedResponse();
+    }
+    return pool.handle(request);
+  };
+
+  return { fetch: fetchRequest, pool, close: () => pool.close() };
+};
+
+export const startHttp = (sidecar: Sidecar, config: McpConfig) => {
+  const server = Bun.serve({
+    port: config.server.port,
+    hostname: config.server.host || undefined,
+    idleTimeout: BUN_MAX_IDLE_SECONDS,
+    fetch: sidecar.fetch,
+  });
+  logger.info(LOG_NS, `listening on ${config.server.host || "0.0.0.0"}:${server.port}${HttpPath.Mcp}`);
+  return {
+    port: server.port ?? config.server.port,
+    stop: async () => {
+      await server.stop(true);
+      await sidecar.close();
+    },
+  };
+};
diff --git a/mcp-server/src/server/mcp.ts b/mcp-server/src/server/mcp.ts
new file mode 100644
index 000000000..7f42d7443
--- /dev/null
+++ b/mcp-server/src/server/mcp.ts
@@ -0,0 +1,21 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { registerTools } from "../tools/register.ts";
+import type { ToolContext } from "../tools/context.ts";
+
+export const SERVER_NAME = "jotty-mcp";
+export const SERVER_VERSION = "0.1.0";
+
+export const SERVER_INSTRUCTIONS = [
+  "Tools for a Jotty instance: notes, checklists and Kanban boards, acting as the user who owns the API key.",
+  "Ids are uuids, so list or search first to get one. Checklist items are addressed by tree index, like 0 or 2.1.",
+  "The dedicated tools cover search, notes, checklists and boards. Use discover and call_operation for everything else the instance offers.",
+].join(" ");
+
+export const createMcpServer = (ctx: ToolContext): Server => {
+  const server = new Server(
+    { name: SERVER_NAME, version: SERVER_VERSION },
+    { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS },
+  );
+  registerTools(server, ctx);
+  return server;
+};
diff --git a/mcp-server/src/server/sessions.ts b/mcp-server/src/server/sessions.ts
new file mode 100644
index 000000000..5c2668059
--- /dev/null
+++ b/mcp-server/src/server/sessions.ts
@@ -0,0 +1,112 @@
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { logger } from "../utils/logger.ts";
+
+const LOG_NS = "sessions";
+
+export const SESSION_HEADER = "mcp-session-id";
+export const SESSION_IDLE_MS = 30 * 60 * 1000;
+
+enum RpcCode {
+  ParseError = -32700,
+  BadRequest = -32000,
+  NotFound = -32001,
+}
+
+enum RpcMessage {
+  BadJson = "Parse error: Invalid JSON",
+  NeedSession = "Bad Request: Mcp-Session-Id header is required",
+  NoSession = "Session not found",
+}
+
+interface Session {
+  server: Server;
+  transport: WebStandardStreamableHTTPServerTransport;
+  touchedAt: number;
+}
+
+export interface SessionPool {
+  handle: (request: Request) => Promise<Response>;
+  size: () => number;
+  close: () => Promise<void>;
+}
+
+const PARSE_FAILED = Symbol("parse-failed");
+
+const rpcFail = (status: number, code: RpcCode, message: RpcMessage): Response =>
+  Response.json({ jsonrpc: "2.0", error: { code, message }, id: null }, { status });
+
+const readBody = async (request: Request): Promise<unknown> => {
+  try {
+    return await request.json();
+  } catch {
+    return PARSE_FAILED;
+  }
+};
+
+const isHandshake = (body: unknown): boolean =>
+  Array.isArray(body) ? body.some(isInitializeRequest) : isInitializeRequest(body);
+
+export const createSessionPool = (forge: (request: Request) => Server): SessionPool => {
+  const sessions = new Map<string, Session>();
+
+  const dropStale = async (): Promise<void> => {
+    const cutoff = Date.now() - SESSION_IDLE_MS;
+    for (const [id, session] of [...sessions]) {
+      if (session.touchedAt > cutoff) continue;
+      sessions.delete(id);
+      logger.debug(LOG_NS, `session expired ${id.slice(0, 8)}`);
+      await session.server.close();
+    }
+  };
+
+  const open = async (request: Request, body: unknown): Promise<Response> => {
+    await dropStale();
+    const server = forge(request);
+    const session: Session = {
+      server,
+      touchedAt: Date.now(),
+      transport: new WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: () => crypto.randomUUID(),
+        onsessioninitialized: (id) => {
+          sessions.set(id, session);
+          logger.debug(LOG_NS, `session opened ${id.slice(0, 8)}`);
+        },
+        onsessionclosed: (id) => {
+          sessions.delete(id);
+          logger.debug(LOG_NS, `session closed ${id.slice(0, 8)}`);
+        },
+      }),
+    };
+    await server.connect(session.transport);
+    const response = await session.transport.handleRequest(request, { parsedBody: body });
+    if (!session.transport.sessionId) await server.close();
+    return response;
+  };
+
+  const handle = async (request: Request): Promise<Response> => {
+    const id = request.headers.get(SESSION_HEADER);
+    if (id) {
+      const session = sessions.get(id);
+      if (!session) return rpcFail(404, RpcCode.NotFound, RpcMessage.NoSession);
+      session.touchedAt = Date.now();
+      return session.transport.handleRequest(request);
+    }
+    if (request.method !== "POST") return rpcFail(400, RpcCode.BadRequest, RpcMessage.NeedSession);
+    const body = await readBody(request);
+    if (body === PARSE_FAILED) return rpcFail(400, RpcCode.ParseError, RpcMessage.BadJson);
+    if (!isHandshake(body)) return rpcFail(400, RpcCode.BadRequest, RpcMessage.NeedSession);
+    return open(request, body);
+  };
+
+  return {
+    handle,
+    size: () => sessions.size,
+    close: async () => {
+      const live = [...sessions.values()];
+      sessions.clear();
+      await Promise.all(live.map((session) => session.server.close()));
+    },
+  };
+};
diff --git a/mcp-server/src/server/stdio.ts b/mcp-server/src/server/stdio.ts
new file mode 100644
index 000000000..34ad4a55d
--- /dev/null
+++ b/mcp-server/src/server/stdio.ts
@@ -0,0 +1,14 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import type { ToolContext } from "../tools/context.ts";
+import { logger } from "../utils/logger.ts";
+import { createMcpServer } from "./mcp.ts";
+
+const LOG_NS = "stdio";
+
+export const startStdio = async (ctx: ToolContext) => {
+  if (!ctx.client.hasApiKey) logger.warn(LOG_NS, "JOTTY_API_KEY is empty, every call except health will be refused");
+  const server = createMcpServer(ctx);
+  await server.connect(new StdioServerTransport());
+  logger.info(LOG_NS, `serving ${ctx.client.baseUrl} over stdio`);
+  return { stop: () => server.close() };
+};
diff --git a/mcp-server/src/tools/admin.ts b/mcp-server/src/tools/admin.ts
deleted file mode 100644
index 4d864a446..000000000
--- a/mcp-server/src/tools/admin.ts
+++ /dev/null
@@ -1,144 +0,0 @@
-import { z } from "zod";
-import type { ToolModule } from "./types.js";
-import { json, run } from "./shared.js";
-
-/**
- * Admin-leaning endpoints: data exports and audit logs. Many of these require
- * admin permissions on the remote instance; non-admin callers will receive a
- * 403 from Jotty, surfaced as an MCP error result.
- */
-export const adminModule: ToolModule = {
-  register(server, client) {
-    // POST /api/exports
-    server.registerTool(
-      "request_export",
-      {
-        title: "Request data export",
-        description:
-          "Initiate a data export. type is one of all_checklists_notes, user_checklists_notes (needs username), all_users_data, whole_data_folder. Returns a downloadUrl.",
-        inputSchema: {
-          type: z
-            .enum([
-              "all_checklists_notes",
-              "user_checklists_notes",
-              "all_users_data",
-              "whole_data_folder",
-            ])
-            .describe("Export type."),
-          username: z
-            .string()
-            .optional()
-            .describe("Required only for user_checklists_notes."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post("/api/exports", {
-              type: args.type,
-              username: args.username,
-            }),
-          ),
-        ),
-    );
-
-    // GET /api/exports
-    server.registerTool(
-      "get_export_progress",
-      {
-        title: "Get export progress",
-        description: "Get the current progress of an ongoing export operation.",
-      },
-      async () => run(() => json(client.get("/api/exports"))),
-    );
-
-    // GET /api/logs
-    server.registerTool(
-      "list_logs",
-      {
-        title: "List audit logs",
-        description:
-          "Retrieve audit logs with filtering and pagination. Regular users only see their own logs; admins can filter by username.",
-        inputSchema: {
-          username: z.string().optional().describe("Filter by username (admin only)."),
-          action: z.string().optional().describe("Filter by action type, e.g. login."),
-          category: z
-            .enum([
-              "auth",
-              "user",
-              "checklist",
-              "note",
-              "sharing",
-              "settings",
-              "encryption",
-              "api",
-              "system",
-              "file",
-              "upload",
-            ])
-            .optional(),
-          level: z
-            .enum(["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"])
-            .optional(),
-          startDate: z.string().optional().describe("ISO 8601 start date."),
-          endDate: z.string().optional().describe("ISO 8601 end date."),
-          success: z.boolean().optional(),
-          limit: z.number().int().positive().max(1000).optional().describe("Default 50."),
-          offset: z.number().int().min(0).optional().describe("Default 0."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.get("/api/logs", {
-              username: args.username,
-              action: args.action,
-              category: args.category,
-              level: args.level,
-              startDate: args.startDate,
-              endDate: args.endDate,
-              success: args.success,
-              limit: args.limit,
-              offset: args.offset,
-            }),
-          ),
-        ),
-    );
-
-    // POST /api/logs/export
-    server.registerTool(
-      "export_logs",
-      {
-        title: "Export audit logs",
-        description:
-          "Export audit logs in JSON or CSV format using the same filter options as list_logs.",
-        inputSchema: {
-          format: z.enum(["json", "csv"]).describe("Export format."),
-          filters: z
-            .record(z.unknown())
-            .optional()
-            .describe("Filter object with the same keys as list_logs."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post("/api/logs/export", {
-              format: args.format,
-              filters: args.filters ?? {},
-            }),
-          ),
-        ),
-    );
-
-    // GET /api/logs/stats
-    server.registerTool(
-      "get_logs_stats",
-      {
-        title: "Get audit log statistics",
-        description: "Aggregated audit log statistics (admin only).",
-      },
-      async () => run(() => json(client.get("/api/logs/stats"))),
-    );
-  },
-};
\ No newline at end of file
diff --git a/mcp-server/src/tools/builtins.ts b/mcp-server/src/tools/builtins.ts
new file mode 100644
index 000000000..c2146c5de
--- /dev/null
+++ b/mcp-server/src/tools/builtins.ts
@@ -0,0 +1,126 @@
+import type { Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { Spec } from "../jotty/spec.ts";
+import { logger } from "../utils/logger.ts";
+import { CURATED_OPERATIONS, toolNameOf } from "./catalog.ts";
+import { BuiltinTool, type ToolContext } from "./context.ts";
+import { ToolErrorKind, errorResult, fromError } from "./errors.ts";
+import { runOperation } from "./operation.ts";
+import { toolResult, type ToolResult } from "./result.ts";
+import { toolInput } from "./schema.ts";
+
+const LOG_NS = "tool-builtin";
+const HEALTH_PATH = "/health";
+const READ_ONLY = { readOnlyHint: true, openWorldHint: false } as const;
+
+export const BUILTIN_TOOLS: Tool[] = [
+  {
+    name: BuiltinTool.Discover,
+    description:
+      "List every Jotty API operation this instance offers, with its operationId, method, path and summary, plus which dedicated tools are available. Pass operationId to get that operation's input schema for call_operation.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        tag: { type: "string", description: "Only operations in this group, e.g. Kanban or Tasks" },
+        operationId: { type: "string", description: "Return the full input schema for this one operation" },
+      },
+    },
+    annotations: { title: "Discover the Jotty API", ...READ_ONLY },
+  },
+  {
+    name: BuiltinTool.CallOperation,
+    description:
+      "Call any Jotty API operation by operationId, for things the dedicated tools don't cover (tasks, statuses, reminders, exports, logs). Use discover first to find the operationId and its arguments.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        operationId: { type: "string", description: "From discover" },
+        arguments: { type: "object", description: "Path, query and body fields as discover describes them" },
+      },
+      required: ["operationId"],
+    },
+    annotations: { title: "Call a Jotty API operation", destructiveHint: true, openWorldHint: false },
+  },
+  {
+    name: BuiltinTool.Health,
+    description: "Check that Jotty is reachable, which version it runs, and whether the API key works.",
+    inputSchema: { type: "object", properties: {} },
+    annotations: { title: "Jotty health", ...READ_ONLY },
+  },
+];
+
+const _summaryOf = (spec: Spec) =>
+  [...spec.operations.values()].map((op) => ({
+    operationId: op.operationId,
+    method: op.method.toUpperCase(),
+    path: `/api${op.path}`,
+    summary: op.summary,
+    tag: op.tags?.[0],
+    ...(op.deprecated ? { deprecated: true } : {}),
+  }));
+
+const _discover = (spec: Spec, args: Record<string, unknown>): ToolResult => {
+  if (typeof args.operationId === "string") {
+    const op = spec.operations.get(args.operationId);
+    if (!op) {
+      return errorResult(ToolErrorKind.NotFound, `No operation called ${args.operationId}.`, "Call discover without arguments to list them.");
+    }
+    const detail = { operationId: op.operationId, summary: op.summary, description: op.description, inputSchema: toolInput(spec, op).schema };
+    return toolResult(JSON.stringify(detail, null, 2), detail);
+  }
+
+  const operations = _summaryOf(spec).filter((op) => !args.tag || op.tag === args.tag);
+  const tools = CURATED_OPERATIONS.filter((id) => spec.operations.has(id)).map(toolNameOf);
+  const missing = CURATED_OPERATIONS.filter((id) => !spec.operations.has(id)).map(toolNameOf);
+  const lines = operations.map((op) => `${op.operationId}: ${op.method} ${op.path} - ${op.summary}`);
+  return toolResult(
+    [`Jotty ${spec.version}, ${operations.length} operations.`, ...lines].join("\n"),
+    { version: spec.version, tools, unavailableTools: missing, operations },
+  );
+};
+
+const _call = (ctx: ToolContext, spec: Spec, args: Record<string, unknown>, signal?: AbortSignal) => {
+  const op = typeof args.operationId === "string" ? spec.operations.get(args.operationId) : undefined;
+  if (!op) {
+    return Promise.resolve(
+      errorResult(ToolErrorKind.NotFound, `Unknown operationId ${String(args.operationId)}.`, "Use discover to list valid operationIds."),
+    );
+  }
+  const inner = args.arguments && typeof args.arguments === "object" ? (args.arguments as Record<string, unknown>) : {};
+  return runOperation(ctx, spec, op, inner, signal);
+};
+
+const _health = async (ctx: ToolContext, signal?: AbortSignal): Promise<ToolResult> => {
+  try {
+    const health = await ctx.client.send({ method: "get", path: HEALTH_PATH, signal });
+    const spec = await ctx.specs.load(ctx.client, signal).catch((err: unknown) => {
+      logger.warn(LOG_NS, "spec unavailable during health check", err);
+      return null;
+    });
+    const report = {
+      jotty: ctx.client.baseUrl,
+      upstream: health.data,
+      apiKey: !ctx.client.hasApiKey ? "missing" : spec ? "accepted" : "rejected",
+      operations: spec?.operations.size ?? 0,
+      uptimeSec: Math.round((Date.now() - ctx.startedAt) / 1000),
+    };
+    return toolResult(`Jotty at ${report.jotty} is up, API key ${report.apiKey}.`, report);
+  } catch (err) {
+    return fromError(err);
+  }
+};
+
+export const runBuiltin = async (
+  ctx: ToolContext,
+  name: BuiltinTool,
+  args: Record<string, unknown>,
+  signal?: AbortSignal,
+): Promise<ToolResult> => {
+  if (name === BuiltinTool.Health) return _health(ctx, signal);
+  try {
+    const spec = await ctx.specs.load(ctx.client, signal);
+    return name === BuiltinTool.Discover ? _discover(spec, args) : await _call(ctx, spec, args, signal);
+  } catch (err) {
+    logger.warn(LOG_NS, `${name} could not load the API spec`, err);
+    return fromError(err);
+  }
+};
diff --git a/mcp-server/src/tools/catalog.ts b/mcp-server/src/tools/catalog.ts
new file mode 100644
index 000000000..71596da93
--- /dev/null
+++ b/mcp-server/src/tools/catalog.ts
@@ -0,0 +1,29 @@
+export const CURATED_OPERATIONS = [
+  "search",
+  "listCategories",
+  "getSummary",
+  "getCurrentUser",
+  "listNotes",
+  "getNote",
+  "createNote",
+  "updateNote",
+  "deleteNote",
+  "listChecklists",
+  "createChecklist",
+  "updateChecklist",
+  "deleteChecklist",
+  "createChecklistItem",
+  "updateChecklistItem",
+  "deleteChecklistItem",
+  "checkChecklistItem",
+  "uncheckChecklistItem",
+  "listBoards",
+  "getBoard",
+  "createBoard",
+  "createBoardItem",
+  "updateBoardItem",
+  "moveBoardItem",
+] as const;
+
+export const toolNameOf = (operationId: string): string =>
+  operationId.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
diff --git a/mcp-server/src/tools/checklists.ts b/mcp-server/src/tools/checklists.ts
deleted file mode 100644
index 2e0194e52..000000000
--- a/mcp-server/src/tools/checklists.ts
+++ /dev/null
@@ -1,277 +0,0 @@
-import { z } from "zod";
-import type { ToolModule } from "./types.js";
-import { json, run } from "./shared.js";
-
-/**
- * Checklists — both "simple" and "task"/"kanban" type lists live under
- * /api/checklists. Items are addressed by dot-notation index paths (e.g. "0.1")
- * so nested sub-items can be targeted. See howto/API.md for the full reference.
- */
-export const checklistsModule: ToolModule = {
-  register(server, client) {
-    // GET /api/checklists
-    server.registerTool(
-      "list_checklists",
-      {
-        title: "List checklists",
-        description:
-          "List all checklists for the authenticated user. Optional filters: category, type (simple|task|kanban), and a search query q (matches title or item text).",
-        inputSchema: {
-          category: z.string().optional().describe("Filter by category name."),
-          type: z
-            .enum(["simple", "task", "kanban"])
-            .optional()
-            .describe("Filter by checklist type."),
-          q: z.string().optional().describe("Search title or item text."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.get("/api/checklists", {
-              category: args.category,
-              type: args.type,
-              q: args.q,
-            }),
-          ),
-        ),
-    );
-
-    // POST /api/checklists
-    server.registerTool(
-      "create_checklist",
-      {
-        title: "Create checklist",
-        description:
-          "Create a new checklist. type defaults to 'simple'; use 'task' or 'kanban' for advanced lists. category defaults to 'Uncategorized'.",
-        inputSchema: {
-          title: z.string().describe("Title of the new checklist."),
-          category: z.string().optional().describe("Category (defaults to Uncategorized)."),
-          type: z
-            .enum(["simple", "task", "kanban"])
-            .optional()
-            .describe("Checklist type (defaults to simple)."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post("/api/checklists", {
-              title: args.title,
-              category: args.category ?? "Uncategorized",
-              type: args.type ?? "simple",
-            }),
-          ),
-        ),
-    );
-
-    // PUT /api/checklists/{listId}
-    server.registerTool(
-      "update_checklist",
-      {
-        title: "Update checklist",
-        description: "Update a checklist's title and/or category.",
-        inputSchema: {
-          listId: z.string().describe("UUID of the checklist to update."),
-          title: z.string().optional().describe("New title."),
-          category: z.string().optional().describe("New category."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/checklists/${args.listId}`, {
-              title: args.title,
-              category: args.category,
-            }),
-          ),
-        ),
-    );
-
-    // DELETE /api/checklists/{listId}
-    server.registerTool(
-      "delete_checklist",
-      {
-        title: "Delete checklist",
-        description: "Delete a checklist by UUID.",
-        inputSchema: {
-          listId: z.string().describe("UUID of the checklist to delete."),
-        },
-      },
-      async (args) =>
-        run(() => json(client.delete(`/api/checklists/${args.listId}`))),
-    );
-
-    // POST /api/checklists/{listId}/items
-    server.registerTool(
-      "create_checklist_item",
-      {
-        title: "Create checklist item",
-        description:
-          "Add an item to a checklist. For task/kanban lists you may pass a status (e.g. todo|in_progress|completed) and time. Use parentIndex (dot path like '0' or '0.1') to create a nested sub-item.",
-        inputSchema: {
-          listId: z.string().describe("UUID of the checklist."),
-          text: z.string().describe("Item text."),
-          status: z.string().optional().describe("Initial status (task/kanban lists)."),
-          time: z
-            .union([z.literal(0), z.array(z.record(z.unknown()))])
-            .optional()
-            .describe("Time tracking value: 0 or an array of time entries."),
-          parentIndex: z
-            .string()
-            .optional()
-            .describe("Dot-notation index path of the parent item to nest under."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post(`/api/checklists/${args.listId}/items`, {
-              text: args.text,
-              status: args.status,
-              time: args.time,
-              parentIndex: args.parentIndex,
-            }),
-          ),
-        ),
-    );
-
-    // PATCH /api/checklists/{listId}/items/{itemIndex}
-    server.registerTool(
-      "update_checklist_item",
-      {
-        title: "Update checklist item",
-        description:
-          "Update one or more fields of a checklist item. itemIndex is a dot path (e.g. '0.1') for nested items. Omitted fields are left unchanged.",
-        inputSchema: {
-          listId: z.string().describe("UUID of the checklist."),
-          itemIndex: z
-            .string()
-            .describe("Dot-notation index path of the item (e.g. '0' or '0.1')."),
-          text: z.string().optional(),
-          description: z.string().optional(),
-          priority: z
-            .enum(["critical", "high", "medium", "low", "none"])
-            .optional(),
-          score: z.number().optional(),
-          startDate: z.string().optional().describe("ISO date string."),
-          targetDate: z.string().optional().describe("ISO date string."),
-          estimatedTime: z.number().optional().describe("Estimated hours."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.patch(
-              `/api/checklists/${args.listId}/items/${args.itemIndex}`,
-              {
-                text: args.text,
-                description: args.description,
-                priority: args.priority,
-                score: args.score,
-                startDate: args.startDate,
-                targetDate: args.targetDate,
-                estimatedTime: args.estimatedTime,
-              },
-            ),
-          ),
-        ),
-    );
-
-    // DELETE /api/checklists/{listId}/items/{itemIndex}
-    server.registerTool(
-      "delete_checklist_item",
-      {
-        title: "Delete checklist item",
-        description:
-          "Delete a checklist item by dot-notation index path (e.g. '0.1').",
-        inputSchema: {
-          listId: z.string().describe("UUID of the checklist."),
-          itemIndex: z
-            .string()
-            .describe("Dot-notation index path of the item to delete."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(client.delete(`/api/checklists/${args.listId}/items/${args.itemIndex}`)),
-        ),
-    );
-
-    // PUT /api/checklists/{listId}/items/{itemIndex}/check
-    server.registerTool(
-      "check_item",
-      {
-        title: "Check item",
-        description: "Mark a checklist item as completed.",
-        inputSchema: {
-          listId: z.string().describe("UUID of the checklist."),
-          itemIndex: z
-            .string()
-            .describe("Dot-notation index path of the item."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/checklists/${args.listId}/items/${args.itemIndex}/check`),
-          ),
-        ),
-    );
-
-    // PUT /api/checklists/{listId}/items/{itemIndex}/uncheck
-    server.registerTool(
-      "uncheck_item",
-      {
-        title: "Uncheck item",
-        description: "Mark a checklist item as incomplete.",
-        inputSchema: {
-          listId: z.string().describe("UUID of the checklist."),
-          itemIndex: z
-            .string()
-            .describe("Dot-notation index path of the item."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/checklists/${args.listId}/items/${args.itemIndex}/uncheck`),
-          ),
-        ),
-    );
-
-    // PUT /api/checklists/{listId}/items/reorder
-    server.registerTool(
-      "reorder_checklist_items",
-      {
-        title: "Reorder checklist items",
-        description:
-          "Reorder items by dragging activeItemId relative to overItemId. position is 'before' or 'after'. Set isDropInto=true to drop activeItem as a child of overItem.",
-        inputSchema: {
-          listId: z.string().describe("UUID of the checklist."),
-          activeItemId: z.string().describe("Item id being moved."),
-          overItemId: z.string().describe("Item id it is moved relative to."),
-          position: z
-            .enum(["before", "after"])
-            .optional()
-            .describe("before|after (defaults to before)."),
-          isDropInto: z
-            .boolean()
-            .optional()
-            .describe("Drop as a child of overItemId instead of reordering siblings."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/checklists/${args.listId}/items/reorder`, {
-              activeItemId: args.activeItemId,
-              overItemId: args.overItemId,
-              position: args.position ?? "before",
-              isDropInto: args.isDropInto ?? false,
-            }),
-          ),
-        ),
-    );
-  },
-};
\ No newline at end of file
diff --git a/mcp-server/src/tools/context.ts b/mcp-server/src/tools/context.ts
new file mode 100644
index 000000000..091a2e61f
--- /dev/null
+++ b/mcp-server/src/tools/context.ts
@@ -0,0 +1,16 @@
+import type { McpConfig } from "../config/schema.ts";
+import type { JottyClient } from "../jotty/client.ts";
+import type { SpecSource } from "../jotty/spec.ts";
+
+export interface ToolContext {
+  config: McpConfig;
+  client: JottyClient;
+  specs: SpecSource;
+  startedAt: number;
+}
+
+export enum BuiltinTool {
+  Discover = "discover",
+  CallOperation = "call_operation",
+  Health = "health",
+}
diff --git a/mcp-server/src/tools/discovery.ts b/mcp-server/src/tools/discovery.ts
deleted file mode 100644
index bc3149720..000000000
--- a/mcp-server/src/tools/discovery.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-import { z } from "zod";
-import type { ToolModule } from "./types.js";
-import { json, run } from "./shared.js";
-
-/**
- * Organisation & discovery endpoints: categories, summary statistics, and
- * cross-content full-text search.
- */
-export const discoveryModule: ToolModule = {
-  register(server, client) {
-    // GET /api/categories
-    server.registerTool(
-      "list_categories",
-      {
-        title: "List categories",
-        description:
-          "List all categories for notes and checklists for the authenticated user (archived categories excluded).",
-      },
-      async () => run(() => json(client.get("/api/categories"))),
-    );
-
-    // GET /api/summary
-    server.registerTool(
-      "get_summary",
-      {
-        title: "Get summary statistics",
-        description:
-          "Get statistics about notes, checklists, items and tasks with category breakdowns. Admins may query another user with username.",
-        inputSchema: {
-          username: z
-            .string()
-            .optional()
-            .describe("Username to query (admin only; defaults to the authenticated user)."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.get("/api/summary", {
-              username: args.username,
-            }),
-          ),
-        ),
-    );
-
-    // GET /api/search
-    server.registerTool(
-      "search",
-      {
-        title: "Search notes and checklists",
-        description:
-          "Full-text search across notes and checklists. type filters to 'note' or 'checklist'. q must be at least 2 characters.",
-        inputSchema: {
-          q: z.string().min(2).describe("Search query (min 2 characters)."),
-          type: z
-            .enum(["note", "checklist"])
-            .optional()
-            .describe("Restrict results to notes or checklists."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.get("/api/search", {
-              q: args.q,
-              type: args.type,
-            }),
-          ),
-        ),
-    );
-  },
-};
\ No newline at end of file
diff --git a/mcp-server/src/tools/errors.ts b/mcp-server/src/tools/errors.ts
new file mode 100644
index 000000000..701bd6eb1
--- /dev/null
+++ b/mcp-server/src/tools/errors.ts
@@ -0,0 +1,47 @@
+import { JottyError } from "../jotty/client.ts";
+import { TimeoutError } from "../utils/timeout.ts";
+import type { ToolResult } from "./result.ts";
+
+export enum ToolErrorKind {
+  Input = "input",
+  Auth = "auth",
+  Forbidden = "forbidden",
+  NotFound = "not_found",
+  Upstream = "upstream",
+  Timeout = "timeout",
+  Unsupported = "unsupported",
+}
+
+export const errorResult = (kind: ToolErrorKind, message: string, hint?: string, status?: number): ToolResult => ({
+  content: [{ type: "text", text: hint ? `${message}\n${hint}` : message }],
+  structuredContent: { error: { kind, message, ...(status ? { status } : {}), ...(hint ? { hint } : {}) } },
+  isError: true,
+});
+
+const KIND_BY_STATUS: Record<number, ToolErrorKind> = {
+  400: ToolErrorKind.Input,
+  401: ToolErrorKind.Auth,
+  403: ToolErrorKind.Forbidden,
+  404: ToolErrorKind.NotFound,
+};
+
+const HINTS: Partial<Record<ToolErrorKind, string>> = {
+  [ToolErrorKind.Input]: "Check the arguments against the tool's input schema.",
+  [ToolErrorKind.Auth]: "The Jotty API key is missing or wrong. Check JOTTY_API_KEY or the x-api-key header.",
+  [ToolErrorKind.Forbidden]: "The API key owner doesn't hold the permission for that action on that item.",
+  [ToolErrorKind.NotFound]: "Nothing with that id is visible to the API key owner. List first to get a valid id.",
+  [ToolErrorKind.Timeout]: "Jotty is slow or unreachable. Try the health tool.",
+  [ToolErrorKind.Upstream]: "Try the health tool to see whether Jotty is reachable.",
+};
+
+export const fromError = (err: unknown): ToolResult => {
+  if (err instanceof TimeoutError) {
+    return errorResult(ToolErrorKind.Timeout, err.message, HINTS[ToolErrorKind.Timeout]);
+  }
+  if (err instanceof JottyError) {
+    const kind = KIND_BY_STATUS[err.status] ?? ToolErrorKind.Upstream;
+    return errorResult(kind, err.message, HINTS[kind], err.status);
+  }
+  const message = err instanceof Error ? err.message : "Unexpected failure";
+  return errorResult(ToolErrorKind.Upstream, message, HINTS[ToolErrorKind.Upstream]);
+};
diff --git a/mcp-server/src/tools/index.ts b/mcp-server/src/tools/index.ts
deleted file mode 100644
index 4d4177e23..000000000
--- a/mcp-server/src/tools/index.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { JottyClient } from "../client.js";
-import { checklistsModule } from "./checklists.js";
-import { notesModule } from "./notes.js";
-import { tasksModule } from "./tasks.js";
-import { kanbanModule } from "./kanban.js";
-import { discoveryModule } from "./discovery.js";
-import { adminModule } from "./admin.js";
-import { miscModule } from "./misc.js";
-
-const modules = [
-  checklistsModule,
-  notesModule,
-  tasksModule,
-  kanbanModule,
-  discoveryModule,
-  adminModule,
-  miscModule,
-];
-
-/** Total number of tools registered (handy for startup logging). */
-export const toolCount = 54;
-
-/**
- * Register every tool group against the given server/client pair.
- *
- * In stdio mode this is called once. In HTTP mode it is called once per
- * client session, so each session gets its own `JottyClient` carrying that
- * client's API key.
- */
-export function registerAllTools(server: McpServer, client: JottyClient): void {
-  for (const mod of modules) {
-    mod.register(server, client);
-  }
-}
\ No newline at end of file
diff --git a/mcp-server/src/tools/kanban.ts b/mcp-server/src/tools/kanban.ts
deleted file mode 100644
index 077766063..000000000
--- a/mcp-server/src/tools/kanban.ts
+++ /dev/null
@@ -1,337 +0,0 @@
-import { z } from "zod";
-import type { ToolModule } from "./types.js";
-import { json, run } from "./shared.js";
-
-/**
- * Kanban boards — the dedicated /api/kanban surface for kanban-type lists.
- * Unlike /api/tasks (index-based), kanban items are addressed by their item id,
- * and boards support assignees, reminders and an ICS calendar export.
- */
-export const kanbanModule: ToolModule = {
-  register(server, client) {
-    // GET /api/kanban
-    server.registerTool(
-      "list_boards",
-      {
-        title: "List kanban boards",
-        description:
-          "List all kanban boards for the authenticated user. Optional filters: category, status (boards containing an item with this status), and search q.",
-        inputSchema: {
-          category: z.string().optional(),
-          status: z.string().optional(),
-          q: z.string().optional().describe("Search title or item text."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.get("/api/kanban", {
-              category: args.category,
-              status: args.status,
-              q: args.q,
-            }),
-          ),
-        ),
-    );
-
-    // POST /api/kanban
-    server.registerTool(
-      "create_board",
-      {
-        title: "Create kanban board",
-        description:
-          "Create a new kanban board. statuses defines the columns; defaults to todo/in_progress/completed.",
-        inputSchema: {
-          title: z.string().describe("Board title."),
-          category: z.string().optional().describe("Category (defaults to Uncategorized)."),
-          statuses: z
-            .array(
-              z.object({
-                id: z.string(),
-                label: z.string(),
-                order: z.number().optional(),
-                color: z.string().optional(),
-              }),
-            )
-            .optional()
-            .describe("Custom Kanban columns."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post("/api/kanban", {
-              title: args.title,
-              category: args.category ?? "Uncategorized",
-              statuses: args.statuses,
-            }),
-          ),
-        ),
-    );
-
-    // GET /api/kanban/{boardId}
-    server.registerTool(
-      "get_board",
-      {
-        title: "Get kanban board",
-        description: "Retrieve a single kanban board by UUID.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-        },
-      },
-      async (args) =>
-        run(() => json(client.get(`/api/kanban/${args.boardId}`))),
-    );
-
-    // PUT /api/kanban/{boardId}
-    server.registerTool(
-      "update_board",
-      {
-        title: "Update kanban board",
-        description: "Update a board's title and/or category.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-          title: z.string().optional(),
-          category: z.string().optional(),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/kanban/${args.boardId}`, {
-              title: args.title,
-              category: args.category,
-            }),
-          ),
-        ),
-    );
-
-    // DELETE /api/kanban/{boardId}
-    server.registerTool(
-      "delete_board",
-      {
-        title: "Delete kanban board",
-        description: "Delete a kanban board by UUID.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-        },
-      },
-      async (args) =>
-        run(() => json(client.delete(`/api/kanban/${args.boardId}`))),
-    );
-
-    // PUT /api/kanban/{boardId}/statuses
-    server.registerTool(
-      "set_board_statuses",
-      {
-        title: "Set board statuses",
-        description:
-          "Replace the full set of Kanban column statuses for a board. Provide the complete statuses array.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-          statuses: z
-            .array(
-              z.object({
-                id: z.string(),
-                label: z.string(),
-                order: z.number().optional(),
-                color: z.string().optional(),
-              }),
-            )
-            .describe("Full statuses array to set."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/kanban/${args.boardId}/statuses`, {
-              statuses: args.statuses,
-            }),
-          ),
-        ),
-    );
-
-    // POST /api/kanban/{boardId}/items
-    server.registerTool(
-      "create_board_item",
-      {
-        title: "Create board item",
-        description: "Add an item to a kanban board. Optional status and description.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-          text: z.string().describe("Item text."),
-          status: z.string().optional().describe("Initial status (defaults to todo)."),
-          description: z.string().optional().describe("Item description/notes."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post(`/api/kanban/${args.boardId}/items`, {
-              text: args.text,
-              status: args.status,
-              description: args.description,
-            }),
-          ),
-        ),
-    );
-
-    // PUT /api/kanban/{boardId}/items/{itemId}
-    server.registerTool(
-      "update_board_item",
-      {
-        title: "Update board item",
-        description:
-          "Update a kanban item's text, priority, score, assignee and/or reminder. Omitted fields are left unchanged.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-          itemId: z.string().describe("Item id to update."),
-          text: z.string().optional(),
-          priority: z
-            .enum(["critical", "high", "medium", "low", "none"])
-            .optional(),
-          score: z.number().optional(),
-          assignee: z.string().optional().describe("Username to assign the item to."),
-          reminder: z
-            .object({
-              datetime: z.string(),
-              notified: z.boolean().optional(),
-            })
-            .optional()
-            .describe("Reminder object; set to null to clear."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/kanban/${args.boardId}/items/${args.itemId}`, {
-              text: args.text,
-              priority: args.priority,
-              score: args.score,
-              assignee: args.assignee,
-              reminder: args.reminder,
-            }),
-          ),
-        ),
-    );
-
-    // DELETE /api/kanban/{boardId}/items/{itemId}
-    server.registerTool(
-      "delete_board_item",
-      {
-        title: "Delete board item",
-        description: "Delete a kanban item by id.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-          itemId: z.string().describe("Item id to delete."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(client.delete(`/api/kanban/${args.boardId}/items/${args.itemId}`)),
-        ),
-    );
-
-    // PUT /api/kanban/{boardId}/items/{itemId}/status
-    server.registerTool(
-      "move_board_item",
-      {
-        title: "Move board item",
-        description: "Move a kanban item to a different column (change its status).",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-          itemId: z.string().describe("Item id to move."),
-          status: z.string().describe("New status id."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/kanban/${args.boardId}/items/${args.itemId}/status`, {
-              status: args.status,
-            }),
-          ),
-        ),
-    );
-
-    // PUT /api/kanban/{boardId}/items/{itemId}/assign
-    server.registerTool(
-      "assign_board_item",
-      {
-        title: "Assign board item",
-        description: "Assign a kanban item to a user (pass empty string to unassign).",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-          itemId: z.string().describe("Item id to assign."),
-          assignee: z.string().describe("Username to assign to (empty to clear)."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/kanban/${args.boardId}/items/${args.itemId}/assign`, {
-              assignee: args.assignee,
-            }),
-          ),
-        ),
-    );
-
-    // PUT /api/kanban/{boardId}/items/{itemId}/reminder
-    server.registerTool(
-      "set_board_item_reminder",
-      {
-        title: "Set board item reminder",
-        description: "Set a due-date/time reminder on a kanban item.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-          itemId: z.string().describe("Item id."),
-          datetime: z.string().describe("ISO 8601 datetime for the reminder."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/kanban/${args.boardId}/items/${args.itemId}/reminder`, {
-              datetime: args.datetime,
-            }),
-          ),
-        ),
-    );
-
-    // DELETE /api/kanban/{boardId}/items/{itemId}/reminder
-    server.registerTool(
-      "clear_board_item_reminder",
-      {
-        title: "Clear board item reminder",
-        description: "Remove the reminder from a kanban item.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-          itemId: z.string().describe("Item id."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.delete(`/api/kanban/${args.boardId}/items/${args.itemId}/reminder`),
-          ),
-        ),
-    );
-
-    // GET /api/kanban/{boardId}/calendar
-    server.registerTool(
-      "get_board_calendar",
-      {
-        title: "Get board calendar",
-        description:
-          "Get calendar events for items on a kanban board that have start/target dates. Returns JSON events.",
-        inputSchema: {
-          boardId: z.string().describe("UUID of the board."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(client.get(`/api/kanban/${args.boardId}/calendar`)),
-        ),
-    );
-  },
-};
\ No newline at end of file
diff --git a/mcp-server/src/tools/misc.ts b/mcp-server/src/tools/misc.ts
deleted file mode 100644
index 2658b7218..000000000
--- a/mcp-server/src/tools/misc.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-import { z } from "zod";
-import type { ToolModule } from "./types.js";
-import { json, run } from "./shared.js";
-
-/**
- * Misc endpoints: public health check, the authenticated user's profile, and
- * the admin link-index rebuild.
- */
-export const miscModule: ToolModule = {
-  register(server, client) {
-    // GET /api/health (public)
-    server.registerTool(
-      "health",
-      {
-        title: "Health check",
-        description:
-          "Check the remote Jotty instance is reachable and report its version. Does not require an API key.",
-      },
-      async () => run(() => json(client.get("/api/health"))),
-    );
-
-    // GET /api/user/{username}
-    server.registerTool(
-      "get_user",
-      {
-        title: "Get user information",
-        description:
-          "Retrieve user information. Returns full data for the authenticated user (or admin viewing anyone), otherwise only public fields.",
-        inputSchema: {
-          username: z
-            .string()
-            .describe("Username to look up. Use your own username for your full profile."),
-        },
-      },
-      async (args) =>
-        run(() => json(client.get(`/api/user/${args.username}`))),
-    );
-
-    // GET /api/user (the API-key user — "whoami")
-    server.registerTool(
-      "get_current_user",
-      {
-        title: "Get current user",
-        description:
-          "Get the authenticated user's own profile and settings (theme, landing page, pinned lists/notes, editor preferences). Sensitive fields like passwordHash and apiKey are never returned.",
-      },
-      async () => run(() => json(client.get("/api/user"))),
-    );
-
-    // POST /api/admin/rebuild-index
-    server.registerTool(
-      "rebuild_link_index",
-      {
-        title: "Rebuild link index",
-        description:
-          "Rebuild the internal link index for a user (admin only). Useful after bulk operations or migrations.",
-        inputSchema: {
-          username: z.string().describe("Username whose link index should be rebuilt."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(client.post("/api/admin/rebuild-index", { username: args.username })),
-        ),
-    );
-  },
-};
\ No newline at end of file
diff --git a/mcp-server/src/tools/notes.ts b/mcp-server/src/tools/notes.ts
deleted file mode 100644
index deb3a0387..000000000
--- a/mcp-server/src/tools/notes.ts
+++ /dev/null
@@ -1,116 +0,0 @@
-import { z } from "zod";
-import type { ToolModule } from "./types.js";
-import { json, run } from "./shared.js";
-
-/**
- * Notes — markdown documents under /api/notes. content is GitHub-Flavoured
- * Markdown. Each note has a UUID id and an optional category.
- */
-export const notesModule: ToolModule = {
-  register(server, client) {
-    // GET /api/notes
-    server.registerTool(
-      "list_notes",
-      {
-        title: "List notes",
-        description:
-          "List all notes for the authenticated user. Optional filters: category and search query q (matches title or content).",
-        inputSchema: {
-          category: z.string().optional().describe("Filter by category name."),
-          q: z.string().optional().describe("Search title or content."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.get("/api/notes", {
-              category: args.category,
-              q: args.q,
-            }),
-          ),
-        ),
-    );
-
-    // POST /api/notes
-    server.registerTool(
-      "create_note",
-      {
-        title: "Create note",
-        description:
-          "Create a new markdown note. content defaults to empty; category defaults to 'Uncategorized'.",
-        inputSchema: {
-          title: z.string().describe("Note title."),
-          content: z
-            .string()
-            .optional()
-            .describe("Markdown content (defaults to empty)."),
-          category: z.string().optional().describe("Category (defaults to Uncategorized)."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post("/api/notes", {
-              title: args.title,
-              content: args.content ?? "",
-              category: args.category ?? "Uncategorized",
-            }),
-          ),
-        ),
-    );
-
-    // GET /api/notes/{noteId}
-    server.registerTool(
-      "get_note",
-      {
-        title: "Get note",
-        description: "Retrieve a single note by UUID, including its content.",
-        inputSchema: {
-          noteId: z.string().describe("UUID of the note."),
-        },
-      },
-      async (args) =>
-        run(() => json(client.get(`/api/notes/${args.noteId}`))),
-    );
-
-    // PUT /api/notes/{noteId}
-    server.registerTool(
-      "update_note",
-      {
-        title: "Update note",
-        description:
-          "Update a note's title, content and/or category. Omitted fields are left unchanged.",
-        inputSchema: {
-          noteId: z.string().describe("UUID of the note."),
-          title: z.string().optional(),
-          content: z.string().optional().describe("New markdown content."),
-          category: z.string().optional(),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/notes/${args.noteId}`, {
-              title: args.title,
-              content: args.content,
-              category: args.category,
-            }),
-          ),
-        ),
-    );
-
-    // DELETE /api/notes/{noteId}
-    server.registerTool(
-      "delete_note",
-      {
-        title: "Delete note",
-        description: "Delete a note by UUID.",
-        inputSchema: {
-          noteId: z.string().describe("UUID of the note to delete."),
-        },
-      },
-      async (args) =>
-        run(() => json(client.delete(`/api/notes/${args.noteId}`))),
-    );
-  },
-};
\ No newline at end of file
diff --git a/mcp-server/src/tools/operation.ts b/mcp-server/src/tools/operation.ts
new file mode 100644
index 000000000..a826dd729
--- /dev/null
+++ b/mcp-server/src/tools/operation.ts
@@ -0,0 +1,68 @@
+import type { Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { Operation } from "../jotty/openapi.ts";
+import type { Spec } from "../jotty/spec.ts";
+import { ToolErrorKind, errorResult, fromError } from "./errors.ts";
+import { asRecord, render, toolResult, type ToolResult } from "./result.ts";
+import type { ToolContext } from "./context.ts";
+import { fillPath, splitArgs, toolInput } from "./schema.ts";
+import { toolNameOf } from "./catalog.ts";
+import { logger } from "../utils/logger.ts";
+
+const LOG_NS = "tool-operation";
+
+enum Verb {
+  Get = "get",
+  Put = "put",
+  Delete = "delete",
+}
+
+const sentence = (text: string): string => (/[.!?]$/.test(text) ? text : `${text}.`);
+
+export const describe = (op: Operation): string =>
+  [op.summary, op.description, `Calls ${op.method.toUpperCase()} /api${op.path}`]
+    .filter((part): part is string => Boolean(part))
+    .map(sentence)
+    .join(" ");
+
+export const annotationsOf = (op: Operation): Tool["annotations"] => ({
+  title: op.summary,
+  readOnlyHint: op.method === Verb.Get,
+  destructiveHint: op.method === Verb.Delete,
+  idempotentHint: op.method === Verb.Get || op.method === Verb.Put || op.method === Verb.Delete,
+  openWorldHint: false,
+});
+
+export const operationTool = (spec: Spec, op: Operation): Tool => ({
+  name: toolNameOf(op.operationId),
+  description: describe(op),
+  inputSchema: toolInput(spec, op).schema as Tool["inputSchema"],
+  annotations: annotationsOf(op),
+});
+
+export const runOperation = async (
+  ctx: ToolContext,
+  spec: Spec,
+  op: Operation,
+  args: Record<string, unknown>,
+  signal?: AbortSignal,
+): Promise<ToolResult> => {
+  const { layout } = toolInput(spec, op);
+  const missing = layout.path.filter((name) => args[name] === undefined || args[name] === "");
+  if (missing.length) {
+    return errorResult(ToolErrorKind.Input, `Missing ${missing.join(", ")}.`, "List first to get a valid id.");
+  }
+  try {
+    const parts = splitArgs(layout, args);
+    const response = await ctx.client.send({
+      method: op.method,
+      path: fillPath(op.path, parts.path),
+      query: parts.query,
+      body: parts.body,
+      signal,
+    });
+    return toolResult(render(response.data, ctx.config.output.maxTextChars), asRecord(response.data));
+  } catch (err) {
+    logger.warn(LOG_NS, `${op.operationId} failed`, err);
+    return fromError(err);
+  }
+};
diff --git a/mcp-server/src/tools/register.ts b/mcp-server/src/tools/register.ts
new file mode 100644
index 000000000..16576070b
--- /dev/null
+++ b/mcp-server/src/tools/register.ts
@@ -0,0 +1,47 @@
+import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, type Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { Spec } from "../jotty/spec.ts";
+import { logger } from "../utils/logger.ts";
+import { BUILTIN_TOOLS, runBuiltin } from "./builtins.ts";
+import { CURATED_OPERATIONS, toolNameOf } from "./catalog.ts";
+import { BuiltinTool, type ToolContext } from "./context.ts";
+import { ToolErrorKind, errorResult } from "./errors.ts";
+import { operationTool, runOperation } from "./operation.ts";
+
+const LOG_NS = "tools";
+
+const isBuiltin = (name: string): name is BuiltinTool =>
+  Object.values(BuiltinTool).some((tool) => tool === name);
+
+const _curated = (spec: Spec) =>
+  CURATED_OPERATIONS.flatMap((id) => {
+    const op = spec.operations.get(id);
+    return op ? [op] : [];
+  });
+
+const _loadSpec = (ctx: ToolContext, signal?: AbortSignal): Promise<Spec | null> =>
+  ctx.specs.load(ctx.client, signal).catch((err: unknown) => {
+    logger.warn(LOG_NS, "could not load the Jotty API spec, only built-in tools are listed", err);
+    return null;
+  });
+
+export const registerTools = (server: Server, ctx: ToolContext): void => {
+  server.setRequestHandler(ListToolsRequestSchema, async (_request, extra) => {
+    const spec = await _loadSpec(ctx, extra.signal);
+    const tools: Tool[] = spec ? _curated(spec).map((op) => operationTool(spec, op)) : [];
+    return { tools: [...tools, ...BUILTIN_TOOLS] };
+  });
+
+  server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+    const { name } = request.params;
+    const args = request.params.arguments ?? {};
+    if (isBuiltin(name)) return runBuiltin(ctx, name, args, extra.signal);
+
+    const spec = await _loadSpec(ctx, extra.signal);
+    const op = spec && _curated(spec).find((candidate) => toolNameOf(candidate.operationId) === name);
+    if (!spec || !op) {
+      return errorResult(ToolErrorKind.Unsupported, `This Jotty instance has no ${name} tool.`, "Use discover to see what it offers.");
+    }
+    return runOperation(ctx, spec, op, args, extra.signal);
+  });
+};
diff --git a/mcp-server/src/tools/result.ts b/mcp-server/src/tools/result.ts
new file mode 100644
index 000000000..48f499c3c
--- /dev/null
+++ b/mcp-server/src/tools/result.ts
@@ -0,0 +1,23 @@
+export interface ToolResult {
+  [key: string]: unknown;
+  content: Array<{ type: "text"; text: string }>;
+  structuredContent?: Record<string, unknown>;
+  isError?: boolean;
+}
+
+const TRUNCATED = "\n... truncated, the full response is in structuredContent";
+
+export const asRecord = (data: unknown): Record<string, unknown> =>
+  data && typeof data === "object" && !Array.isArray(data)
+    ? (data as Record<string, unknown>)
+    : { result: data };
+
+export const render = (data: unknown, maxChars: number): string => {
+  const text = typeof data === "string" ? data : JSON.stringify(data, null, 2);
+  return text.length > maxChars ? `${text.slice(0, maxChars)}${TRUNCATED}` : text;
+};
+
+export const toolResult = (text: string, structured?: Record<string, unknown>): ToolResult => ({
+  content: [{ type: "text", text }],
+  ...(structured ? { structuredContent: structured } : {}),
+});
diff --git a/mcp-server/src/tools/schema.ts b/mcp-server/src/tools/schema.ts
new file mode 100644
index 000000000..17f3ca97e
--- /dev/null
+++ b/mcp-server/src/tools/schema.ts
@@ -0,0 +1,107 @@
+import type { JsonSchema, Operation } from "../jotty/openapi.ts";
+import { ParamLocation } from "../jotty/openapi.ts";
+import type { Spec } from "../jotty/spec.ts";
+
+const REF_PREFIX = "#/components/schemas/";
+const MAX_REF_DEPTH = 3;
+const BODY_KEY = "body";
+
+export enum BodyMode {
+  None = "none",
+  Flat = "flat",
+  Nested = "nested",
+}
+
+export interface ArgLayout {
+  path: string[];
+  query: string[];
+  body: BodyMode;
+}
+
+export interface ToolInput {
+  schema: JsonSchema;
+  layout: ArgLayout;
+}
+
+export const inline = (spec: Spec, node: unknown, depth = 0): unknown => {
+  if (Array.isArray(node)) return node.map((item) => inline(spec, item, depth));
+  if (!node || typeof node !== "object") return node;
+  const record = node as JsonSchema;
+  if (typeof record.$ref === "string") {
+    const target = spec.schemas[record.$ref.replace(REF_PREFIX, "")];
+    return target && depth < MAX_REF_DEPTH ? inline(spec, target, depth + 1) : {};
+  }
+  return Object.fromEntries(
+    Object.entries(record).map(([key, value]) => [key, inline(spec, value, depth)]),
+  );
+};
+
+const _bodyOf = (spec: Spec, op: Operation): JsonSchema | undefined => {
+  const media = Object.values(op.requestBody?.content ?? {})[0];
+  return media ? (inline(spec, media.schema) as JsonSchema) : undefined;
+};
+
+const _names = (op: Operation, where: ParamLocation): string[] =>
+  (op.parameters ?? []).filter((param) => param.in === where).map((param) => param.name);
+
+export const toolInput = (spec: Spec, op: Operation): ToolInput => {
+  const params = op.parameters ?? [];
+  const properties: Record<string, JsonSchema> = {};
+  const required: string[] = [];
+
+  params.forEach((param) => {
+    properties[param.name] = {
+      ...(inline(spec, param.schema) as JsonSchema),
+      ...(param.description ? { description: param.description } : {}),
+    };
+    if (param.required) required.push(param.name);
+  });
+
+  const body = _bodyOf(spec, op);
+  const bodyProps = body?.properties ?? {};
+  const clashes = Object.keys(bodyProps).some((name) => name in properties);
+  const mode = !body ? BodyMode.None : clashes || body.type !== "object" ? BodyMode.Nested : BodyMode.Flat;
+
+  if (mode === BodyMode.Flat) {
+    Object.assign(properties, bodyProps);
+    required.push(...(body?.required ?? []));
+  }
+  if (mode === BodyMode.Nested && body) {
+    properties[BODY_KEY] = body;
+    required.push(BODY_KEY);
+  }
+
+  return {
+    schema: { type: "object", properties, ...(required.length ? { required } : {}) },
+    layout: {
+      path: _names(op, ParamLocation.Path),
+      query: _names(op, ParamLocation.Query),
+      body: mode,
+    },
+  };
+};
+
+const _pick = (args: Record<string, unknown>, names: string[]) =>
+  Object.fromEntries(names.filter((name) => args[name] !== undefined).map((name) => [name, args[name]]));
+
+export const splitArgs = (layout: ArgLayout, args: Record<string, unknown>) => {
+  const taken = new Set([...layout.path, ...layout.query]);
+  const rest = Object.fromEntries(Object.entries(args).filter(([name]) => !taken.has(name)));
+  return {
+    path: _pick(args, layout.path),
+    query: Object.fromEntries(
+      Object.entries(_pick(args, layout.query)).map(([name, value]) => [name, String(value)]),
+    ),
+    body:
+      layout.body === BodyMode.None
+        ? undefined
+        : layout.body === BodyMode.Nested
+          ? (args[BODY_KEY] ?? {})
+          : rest,
+  };
+};
+
+export const fillPath = (template: string, values: Record<string, unknown>): string =>
+  template.replace(/\{([^}]+)\}/g, (_, name: string) =>
+    encodeURIComponent(String(values[name] ?? "")),
+  );
diff --git a/mcp-server/src/tools/shared.ts b/mcp-server/src/tools/shared.ts
deleted file mode 100644
index 58725289a..000000000
--- a/mcp-server/src/tools/shared.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
-
-/**
- * Build a successful tool result containing pretty-printed JSON.
- *
- * Accepts either a raw value or a Promise (e.g. a `JottyClient` call) so the
- * common pattern `run(() => json(client.get(...)))` awaits the network request
- * before serialising. Most Jotty endpoints return JSON, so this is the common
- * happy path.
- */
-export async function json(data: Promise<unknown> | unknown): Promise<CallToolResult> {
-  const resolved = await data;
-  return {
-    content: [{ type: "text", text: JSON.stringify(resolved, null, 2) }],
-  };
-}
-
-/** Build a successful tool result with plain text. */
-export function text(value: string): CallToolResult {
-  return {
-    content: [{ type: "text", text: value }],
-  };
-}
-
-/**
- * Build an error tool result. Jotty API errors (bad UUID, missing title, 403,
- * etc.) are surfaced to the model as `isError: true` so the client can react,
- * rather than crashing the server.
- */
-export function fail(message: string): CallToolResult {
-  return {
-    isError: true,
-    content: [{ type: "text", text: message }],
-  };
-}
-
-/**
- * Run an async handler and convert thrown `JottyApiError`s into structured
- * MCP error results. Keeps every tool callback free of repetitive try/catch.
- */
-export async function run(
-  fn: () => Promise<CallToolResult>,
-): Promise<CallToolResult> {
-  try {
-    return await fn();
-  } catch (err) {
-    if (err instanceof Error) {
-      return fail(err.message);
-    }
-    return fail(String(err));
-  }
-}
\ No newline at end of file
diff --git a/mcp-server/src/tools/tasks.ts b/mcp-server/src/tools/tasks.ts
deleted file mode 100644
index bd2671c42..000000000
--- a/mcp-server/src/tools/tasks.ts
+++ /dev/null
@@ -1,308 +0,0 @@
-import { z } from "zod";
-import type { ToolModule } from "./types.js";
-import { json, run } from "./shared.js";
-
-/**
- * A "status" object used to define Kanban columns. Reused across create_task
- * and the status endpoints.
- */
-const statusShape = {
-  id: z.string().describe("Unique status id, e.g. 'todo' or 'review'."),
-  label: z.string().describe("Display label for the column."),
-  order: z.number().optional().describe("Display order."),
-  color: z.string().optional().describe("Hex color, e.g. '#3b82f6'."),
-};
-
-/**
- * Tasks — task-type checklists with Kanban columns, exposed via /api/tasks.
- * Items are addressed by dot-notation index paths; statuses define the board
- * columns.
- */
-export const tasksModule: ToolModule = {
-  register(server, client) {
-    // GET /api/tasks
-    server.registerTool(
-      "list_tasks",
-      {
-        title: "List tasks",
-        description:
-          "List all task checklists for the authenticated user. Optional filters: category, status (lists containing an item with this status), and search q.",
-        inputSchema: {
-          category: z.string().optional(),
-          status: z
-            .string()
-            .optional()
-            .describe("Only return tasks that contain an item with this status."),
-          q: z.string().optional().describe("Search title or item text."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.get("/api/tasks", {
-              category: args.category,
-              status: args.status,
-              q: args.q,
-            }),
-          ),
-        ),
-    );
-
-    // POST /api/tasks
-    server.registerTool(
-      "create_task",
-      {
-        title: "Create task",
-        description:
-          "Create a new task checklist (Kanban). statuses defines the columns; defaults to todo/in_progress/completed.",
-        inputSchema: {
-          title: z.string().describe("Task list title."),
-          category: z.string().optional().describe("Category (defaults to Uncategorized)."),
-          statuses: z
-            .array(z.object(statusShape))
-            .optional()
-            .describe("Custom Kanban columns."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post("/api/tasks", {
-              title: args.title,
-              category: args.category ?? "Uncategorized",
-              statuses: args.statuses,
-            }),
-          ),
-        ),
-    );
-
-    // GET /api/tasks/{taskId}
-    server.registerTool(
-      "get_task",
-      {
-        title: "Get task",
-        description: "Retrieve a single task checklist by UUID.",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-        },
-      },
-      async (args) => run(() => json(client.get(`/api/tasks/${args.taskId}`))),
-    );
-
-    // PUT /api/tasks/{taskId}
-    server.registerTool(
-      "update_task",
-      {
-        title: "Update task",
-        description: "Update a task's title and/or category.",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-          title: z.string().optional(),
-          category: z.string().optional(),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/tasks/${args.taskId}`, {
-              title: args.title,
-              category: args.category,
-            }),
-          ),
-        ),
-    );
-
-    // DELETE /api/tasks/{taskId}
-    server.registerTool(
-      "delete_task",
-      {
-        title: "Delete task",
-        description: "Delete a task checklist by UUID.",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-        },
-      },
-      async (args) =>
-        run(() => json(client.delete(`/api/tasks/${args.taskId}`))),
-    );
-
-    // GET /api/tasks/{taskId}/statuses
-    server.registerTool(
-      "get_task_statuses",
-      {
-        title: "Get task statuses",
-        description: "Retrieve the Kanban column statuses for a task.",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-        },
-      },
-      async (args) =>
-        run(() => json(client.get(`/api/tasks/${args.taskId}/statuses`))),
-    );
-
-    // POST /api/tasks/{taskId}/statuses
-    server.registerTool(
-      "create_task_status",
-      {
-        title: "Create task status",
-        description: "Add a new Kanban column status to a task.",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-          id: z.string().describe("Unique status id."),
-          label: z.string().describe("Display label."),
-          color: z.string().optional().describe("Hex color."),
-          order: z.number().optional().describe("Display order (defaults to last)."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post(`/api/tasks/${args.taskId}/statuses`, {
-              id: args.id,
-              label: args.label,
-              color: args.color,
-              order: args.order,
-            }),
-          ),
-        ),
-    );
-
-    // PUT /api/tasks/{taskId}/statuses/{statusId}
-    server.registerTool(
-      "update_task_status",
-      {
-        title: "Update task status",
-        description: "Update a Kanban column status (label, color, order).",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-          statusId: z.string().describe("Status id to update."),
-          label: z.string().optional(),
-          color: z.string().optional(),
-          order: z.number().optional(),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(
-              `/api/tasks/${args.taskId}/statuses/${args.statusId}`,
-              {
-                label: args.label,
-                color: args.color,
-                order: args.order,
-              },
-            ),
-          ),
-        ),
-    );
-
-    // DELETE /api/tasks/{taskId}/statuses/{statusId}
-    server.registerTool(
-      "delete_task_status",
-      {
-        title: "Delete task status",
-        description:
-          "Delete a Kanban column. Items with this status move to the first available status.",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-          statusId: z.string().describe("Status id to delete."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(client.delete(`/api/tasks/${args.taskId}/statuses/${args.statusId}`)),
-        ),
-    );
-
-    // POST /api/tasks/{taskId}/items
-    server.registerTool(
-      "create_task_item",
-      {
-        title: "Create task item",
-        description:
-          "Add an item to a task. Use parentIndex (dot path) to nest under an existing item. status defaults to 'todo'.",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-          text: z.string().describe("Item text."),
-          status: z.string().optional().describe("Initial status (defaults to todo)."),
-          parentIndex: z
-            .string()
-            .optional()
-            .describe("Dot-notation index path of the parent item."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.post(`/api/tasks/${args.taskId}/items`, {
-              text: args.text,
-              status: args.status,
-              parentIndex: args.parentIndex,
-            }),
-          ),
-        ),
-    );
-
-    // GET /api/tasks/{taskId}/items/{itemIndex}
-    server.registerTool(
-      "get_task_item",
-      {
-        title: "Get task item",
-        description: "Retrieve a single task item by dot-notation index path.",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-          itemIndex: z
-            .string()
-            .describe("Dot-notation index path (e.g. '0' or '0.1')."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(client.get(`/api/tasks/${args.taskId}/items/${args.itemIndex}`)),
-        ),
-    );
-
-    // PUT /api/tasks/{taskId}/items/{itemIndex}/status
-    server.registerTool(
-      "move_task_item",
-      {
-        title: "Move task item",
-        description: "Move a task item to a different Kanban column (change its status).",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-          itemIndex: z
-            .string()
-            .describe("Dot-notation index path of the item."),
-          status: z.string().describe("New status id."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(
-            client.put(`/api/tasks/${args.taskId}/items/${args.itemIndex}/status`, {
-              status: args.status,
-            }),
-          ),
-        ),
-    );
-
-    // DELETE /api/tasks/{taskId}/items/{itemIndex}
-    server.registerTool(
-      "delete_task_item",
-      {
-        title: "Delete task item",
-        description: "Delete a task item by dot-notation index path.",
-        inputSchema: {
-          taskId: z.string().describe("UUID of the task."),
-          itemIndex: z
-            .string()
-            .describe("Dot-notation index path of the item to delete."),
-        },
-      },
-      async (args) =>
-        run(() =>
-          json(client.delete(`/api/tasks/${args.taskId}/items/${args.itemIndex}`)),
-        ),
-    );
-  },
-};
\ No newline at end of file
diff --git a/mcp-server/src/tools/types.ts b/mcp-server/src/tools/types.ts
deleted file mode 100644
index 81cc39a51..000000000
--- a/mcp-server/src/tools/types.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { JottyClient } from "../client.js";
-
-/**
- * Every tool group exports one of these. `register` is called once at startup
- * with the shared server + REST client, and wires up that group's tools.
- */
-export interface ToolModule {
-  register(server: McpServer, client: JottyClient): void;
-}
\ No newline at end of file
diff --git a/mcp-server/src/utils/logger.ts b/mcp-server/src/utils/logger.ts
new file mode 100644
index 000000000..39f79f057
--- /dev/null
+++ b/mcp-server/src/utils/logger.ts
@@ -0,0 +1,39 @@
+import { EnvVar, readEnv } from "../config/env.ts";
+
+export enum LogLevel {
+  Debug = "debug",
+  Info = "info",
+  Warn = "warn",
+  Error = "error",
+  Silent = "silent",
+}
+
+const RANKS: Record<LogLevel, number> = {
+  [LogLevel.Debug]: 10,
+  [LogLevel.Info]: 20,
+  [LogLevel.Warn]: 30,
+  [LogLevel.Error]: 40,
+  [LogLevel.Silent]: 99,
+};
+
+const currentLevel = (): LogLevel =>
+  Object.values(LogLevel).find((level) => level === readEnv(EnvVar.LogLevel).toLowerCase()) ??
+  LogLevel.Info;
+
+const emit = (level: LogLevel, namespace: string, message: string, extra?: unknown): void => {
+  if (RANKS[level] < RANKS[currentLevel()]) return;
+  const line = `${new Date().toISOString()} ${level.toUpperCase()} [${namespace}] ${message}`;
+  if (extra === undefined) console.error(line);
+  else console.error(line, extra instanceof Error ? extra.message : extra);
+};
+
+export const logger = {
+  debug: (namespace: string, message: string, extra?: unknown) =>
+    emit(LogLevel.Debug, namespace, message, extra),
+  info: (namespace: string, message: string, extra?: unknown) =>
+    emit(LogLevel.Info, namespace, message, extra),
+  warn: (namespace: string, message: string, extra?: unknown) =>
+    emit(LogLevel.Warn, namespace, message, extra),
+  error: (namespace: string, message: string, extra?: unknown) =>
+    emit(LogLevel.Error, namespace, message, extra),
+};
diff --git a/mcp-server/src/utils/timeout.ts b/mcp-server/src/utils/timeout.ts
new file mode 100644
index 000000000..2561c7414
--- /dev/null
+++ b/mcp-server/src/utils/timeout.ts
@@ -0,0 +1,21 @@
+export class TimeoutError extends Error {
+  constructor(ms: number) {
+    super(`Jotty did not answer within ${ms} ms`);
+    this.name = "TimeoutError";
+  }
+}
+
+export const withDeadline = async <T>(
+  ms: number,
+  run: (signal: AbortSignal) => Promise<T>,
+  outer?: AbortSignal,
+): Promise<T> => {
+  const timer = AbortSignal.timeout(ms);
+  const signal = outer ? AbortSignal.any([timer, outer]) : timer;
+  try {
+    return await run(signal);
+  } catch (err) {
+    if (timer.aborted) throw new TimeoutError(ms);
+    throw err;
+  }
+};
diff --git a/mcp-server/tests/helpers.ts b/mcp-server/tests/helpers.ts
new file mode 100644
index 000000000..1b9ba31fc
--- /dev/null
+++ b/mcp-server/tests/helpers.ts
@@ -0,0 +1,118 @@
+import { DEFAULT_CONFIG } from "../src/config/load.ts";
+import type { McpConfig } from "../src/config/schema.ts";
+import { createClient } from "../src/jotty/client.ts";
+import type { OpenApiDocument } from "../src/jotty/openapi.ts";
+import { createSpecSource } from "../src/jotty/spec.ts";
+import type { ToolContext } from "../src/tools/context.ts";
+import type { ToolResult } from "../src/tools/result.ts";
+
+export const API_KEY = "ck_test";
+
+export interface Hit {
+  method: string;
+  path: string;
+  apiKey: string | null;
+  body: unknown;
+}
+
+export interface FakeJotty {
+  url: string;
+  hits: Hit[];
+  stop: () => Promise<void>;
+}
+
+const NOTE = { id: "n-1", title: "Milk", category: "Uncategorized", content: "" };
+
+export const FAKE_SPEC: OpenApiDocument = {
+  info: { title: "Jotty API", version: "9.9.9" },
+  paths: {
+    "/notes": {
+      get: {
+        operationId: "listNotes",
+        summary: "List notes",
+        tags: ["Notes"],
+        parameters: [{ name: "q", in: "query" as never, required: false, schema: { type: "string" } }],
+      },
+      post: {
+        operationId: "createNote",
+        summary: "Create a note",
+        tags: ["Notes"],
+        requestBody: {
+          content: {
+            "application/json": {
+              schema: { type: "object", properties: { title: { type: "string" }, category: { type: "string" } }, required: ["title"] },
+            },
+          },
+        },
+      },
+    },
+    "/notes/{noteId}": {
+      get: {
+        operationId: "getNote",
+        summary: "Get a note",
+        tags: ["Notes"],
+        parameters: [{ name: "noteId", in: "path" as never, required: true, schema: { type: "string" } }],
+      },
+      delete: {
+        operationId: "deleteNote",
+        summary: "Delete a note",
+        tags: ["Notes"],
+        parameters: [{ name: "noteId", in: "path" as never, required: true, schema: { type: "string" } }],
+      },
+    },
+    "/tasks/{taskId}/statuses": {
+      post: {
+        operationId: "createTaskStatus",
+        summary: "Add a status",
+        tags: ["Tasks"],
+        parameters: [{ name: "taskId", in: "path" as never, required: true, schema: { type: "string" } }],
+        requestBody: {
+          content: {
+            "application/json": {
+              schema: { type: "object", properties: { taskId: { type: "string" }, label: { $ref: "#/components/schemas/Label" } } },
+            },
+          },
+        },
+      },
+    },
+  },
+  components: { schemas: { Label: { type: "string", description: "Shown on the column" } } },
+};
+
+const _json = (data: unknown, status = 200) => Response.json(data, { status });
+
+export const serveJotty = (spec: OpenApiDocument = FAKE_SPEC): FakeJotty => {
+  const hits: Hit[] = [];
+  const server = Bun.serve({
+    port: 0,
+    fetch: async (request) => {
+      const url = new URL(request.url);
+      const apiKey = request.headers.get("x-api-key");
+      const text = request.method === "GET" ? "" : await request.text();
+      hits.push({ method: request.method, path: `${url.pathname}${url.search}`, apiKey, body: text ? JSON.parse(text) : undefined });
+
+      if (url.pathname === "/api/health") return _json({ status: "healthy", version: spec.info.version });
+      if (apiKey !== API_KEY) return _json({ error: "Unauthorized" }, 401);
+      if (url.pathname === "/api/openapi.json") return _json(spec);
+      if (url.pathname === "/api/notes") return _json(request.method === "GET" ? { notes: [NOTE] } : { success: true, data: NOTE });
+      if (url.pathname === "/api/notes/n-1") return _json({ success: true, data: NOTE });
+      if (url.pathname.startsWith("/api/notes/")) return _json({ error: "Note not found" }, 404);
+      return _json({ success: true });
+    },
+  });
+  return { url: `http://127.0.0.1:${server.port}`, hits, stop: () => server.stop(true) };
+};
+
+export const makeConfig = (url: string, overrides: Partial<McpConfig["jotty"]> = {}): McpConfig => ({
+  ...DEFAULT_CONFIG,
+  jotty: { ...DEFAULT_CONFIG.jotty, url, apiKey: API_KEY, ...overrides },
+});
+
+export const makeCtx = (url: string, apiKey = API_KEY): ToolContext => {
+  const config = makeConfig(url, { apiKey });
+  return { config, client: createClient(config.jotty), specs: createSpecSource(60_000), startedAt: Date.now() };
+};
+
+export const structured = (result: ToolResult) => result.structuredContent ?? {};
+
+export const text = (result: ToolResult) => result.content.map((part) => part.text).join("\n");
diff --git a/mcp-server/tests/preload.ts b/mcp-server/tests/preload.ts
new file mode 100644
index 000000000..091e488a1
--- /dev/null
+++ b/mcp-server/tests/preload.ts
@@ -0,0 +1 @@
+process.env.JOTTY_MCP_LOG_LEVEL = "silent";
diff --git a/mcp-server/tests/schema.test.ts b/mcp-server/tests/schema.test.ts
new file mode 100644
index 000000000..5764a9f15
--- /dev/null
+++ b/mcp-server/tests/schema.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from "bun:test";
+import { toSpec } from "../src/jotty/spec.ts";
+import { BodyMode, fillPath, splitArgs, toolInput } from "../src/tools/schema.ts";
+import { toolNameOf } from "../src/tools/catalog.ts";
+import { FAKE_SPEC } from "./helpers.ts";
+
+const spec = toSpec(FAKE_SPEC);
+const op = (id: string) => {
+  const found = spec.operations.get(id);
+  if (!found) throw new Error(`missing ${id}`);
+  return found;
+};
+
+describe("toolInput", () => {
+  it("flattens path, query and body into one object schema", () => {
+    const { schema, layout } = toolInput(spec, op("createNote"));
+    expect(Object.keys(schema.properties ?? {})).toEqual(["title", "category"]);
+    expect(schema.required).toEqual(["title"]);
+    expect(layout.body).toBe(BodyMode.Flat);
+  });
+
+  it("nests the body when a field clashes with a path param, and inlines refs", () => {
+    const { schema, layout } = toolInput(spec, op("createTaskStatus"));
+    expect(layout.body).toBe(BodyMode.Nested);
+    expect(schema.required).toEqual(["taskId", "body"]);
+    const body = schema.properties?.body;
+    expect(body?.properties?.label).toEqual({ type: "string", description: "Shown on the column" });
+  });
+
+  it("splits arguments back into path, query and body", () => {
+    const { layout } = toolInput(spec, op("createTaskStatus"));
+    const parts = splitArgs(layout, { taskId: "t 1", body: { label: "Done" } });
+    expect(parts).toEqual({ path: { taskId: "t 1" }, query: {}, body: { label: "Done" } });
+    expect(fillPath("/tasks/{taskId}/statuses", parts.path)).toBe("/tasks/t%201/statuses");
+  });
+
+  it("stringifies query values and sends no body for reads", () => {
+    const { layout } = toolInput(spec, op("listNotes"));
+    expect(splitArgs(layout, { q: 5 })).toEqual({ path: {}, query: { q: "5" }, body: undefined });
+  });
+});
+
+describe("toolNameOf", () => {
+  it("snake cases operation ids", () => {
+    expect(toolNameOf("uncheckChecklistItem")).toBe("uncheck_checklist_item");
+  });
+});
diff --git a/mcp-server/tests/session.test.ts b/mcp-server/tests/session.test.ts
new file mode 100644
index 000000000..d5644d762
--- /dev/null
+++ b/mcp-server/tests/session.test.ts
@@ -0,0 +1,70 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { createSidecar, startHttp } from "../src/server/http.ts";
+import { createSpecSource } from "../src/jotty/spec.ts";
+import { createClient } from "../src/jotty/client.ts";
+import { API_KEY, makeConfig, serveJotty } from "./helpers.ts";
+
+const TOKEN = "mcp-secret";
+const jotty = serveJotty();
+let server: ReturnType<typeof startHttp>;
+
+const connect = async (headers: Record<string, string>) => {
+  const client = new Client({ name: "test", version: "0" });
+  await client.connect(
+    new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${server.port}/mcp`), { requestInit: { headers } }),
+  );
+  return client;
+};
+
+beforeAll(() => {
+  const config = makeConfig(jotty.url, { apiKey: "" });
+  config.server = { ...config.server, port: 0, authToken: TOKEN };
+  server = startHttp(
+    createSidecar({ config, client: createClient(config.jotty), specs: createSpecSource(60_000), startedAt: Date.now() }),
+    config,
+  );
+});
+
+afterAll(async () => {
+  await server.stop();
+  await jotty.stop();
+});
+
+describe("http transport", () => {
+  it("refuses /mcp without the bearer token", async () => {
+    const response = await fetch(`http://127.0.0.1:${server.port}/mcp`, { method: "POST", body: "{}" });
+    expect(response.status).toBe(401);
+  });
+
+  it("keeps /health open for orchestrators", async () => {
+    const response = await fetch(`http://127.0.0.1:${server.port}/health`);
+    expect(response.status).toBe(200);
+  });
+
+  it("lists spec-driven tools and calls them with the session's own API key", async () => {
+    const client = await connect({ authorization: `Bearer ${TOKEN}`, "x-api-key": API_KEY });
+    const { tools } = await client.listTools();
+    expect(tools.map((tool) => tool.name)).toEqual([
+      "list_notes",
+      "get_note",
+      "create_note",
+      "delete_note",
+      "discover",
+      "call_operation",
+      "health",
+    ]);
+    const result = await client.callTool({ name: "get_note", arguments: { noteId: "n-1" } });
+    expect(result.structuredContent).toMatchObject({ success: true, data: { id: "n-1" } });
+    expect(jotty.hits.at(-1)?.apiKey).toBe(API_KEY);
+    await client.close();
+  });
+
+  it("falls back to built-in tools when the session has no working key", async () => {
+    const client = await connect({ authorization: `Bearer ${TOKEN}` });
+    const { tools } = await client.listTools();
+    expect(tools.map((tool) => tool.name)).toEqual(["discover", "call_operation", "health"]);
+    await client.close();
+  });
+});
diff --git a/mcp-server/tests/tools.test.ts b/mcp-server/tests/tools.test.ts
new file mode 100644
index 000000000..f833570c0
--- /dev/null
+++ b/mcp-server/tests/tools.test.ts
@@ -0,0 +1,86 @@
+import { afterAll, describe, expect, it } from "bun:test";
+import { toSpec } from "../src/jotty/spec.ts";
+import { runBuiltin } from "../src/tools/builtins.ts";
+import { BuiltinTool } from "../src/tools/context.ts";
+import { runOperation } from "../src/tools/operation.ts";
+import { FAKE_SPEC, makeCtx, serveJotty, structured, text } from "./helpers.ts";
+
+const jotty = serveJotty();
+const spec = toSpec(FAKE_SPEC);
+const op = (id: string) => spec.operations.get(id)!;
+
+afterAll(() => jotty.stop());
+
+describe("runOperation", () => {
+  it("sends the API key and returns the response as structured content", async () => {
+    const result = await runOperation(makeCtx(jotty.url), spec, op("listNotes"), { q: "milk" });
+    expect(result.isError).toBeUndefined();
+    expect(structured(result)).toEqual({ notes: [{ id: "n-1", title: "Milk", category: "Uncategorized", content: "" }] });
+    expect(jotty.hits.at(-1)).toMatchObject({ method: "GET", path: "/api/notes?q=milk", apiKey: "ck_test" });
+  });
+
+  it("posts the flat arguments as the body", async () => {
+    await runOperation(makeCtx(jotty.url), spec, op("createNote"), { title: "Milk" });
+    expect(jotty.hits.at(-1)).toMatchObject({ method: "POST", path: "/api/notes", body: { title: "Milk" } });
+  });
+
+  it("turns a 404 into a not_found error with a hint", async () => {
+    const result = await runOperation(makeCtx(jotty.url), spec, op("getNote"), { noteId: "gone" });
+    expect(result.isError).toBe(true);
+    expect(structured(result).error).toMatchObject({ kind: "not_found", status: 404, message: "Note not found" });
+  });
+
+  it("refuses to call without a required path param", async () => {
+    const before = jotty.hits.length;
+    const result = await runOperation(makeCtx(jotty.url), spec, op("deleteNote"), {});
+    expect(structured(result).error).toMatchObject({ kind: "input" });
+    expect(jotty.hits.length).toBe(before);
+  });
+
+  it("reports a rejected API key as an auth error", async () => {
+    const result = await runOperation(makeCtx(jotty.url, "wrong"), spec, op("listNotes"), {});
+    expect(structured(result).error).toMatchObject({ kind: "auth", status: 401 });
+  });
+
+  it("truncates long visible text but keeps the full structured result", async () => {
+    const ctx = makeCtx(jotty.url);
+    ctx.config.output.maxTextChars = 20;
+    const result = await runOperation(ctx, spec, op("listNotes"), {});
+    expect(text(result)).toContain("truncated");
+    expect(structured(result)).toHaveProperty("notes");
+  });
+});
+
+describe("builtins", () => {
+  it("discover lists operations and which curated tools this instance lacks", async () => {
+    const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.Discover, {});
+    const data = structured(result);
+    expect(data.version).toBe("9.9.9");
+    expect(data.tools).toEqual(["list_notes", "get_note", "create_note", "delete_note"]);
+    expect(data.unavailableTools).toContain("list_boards");
+  });
+
+  it("discover returns one operation's input schema", async () => {
+    const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.Discover, { operationId: "createTaskStatus" });
+    expect(structured(result)).toMatchObject({ operationId: "createTaskStatus", inputSchema: { required: ["taskId", "body"] } });
+  });
+
+  it("call_operation reaches operations without a dedicated tool", async () => {
+    const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.CallOperation, {
+      operationId: "createTaskStatus",
+      arguments: { taskId: "t-1", body: { label: "Done" } },
+    });
+    expect(result.isError).toBeUndefined();
+    expect(jotty.hits.at(-1)).toMatchObject({ method: "POST", path: "/api/tasks/t-1/statuses", body: { label: "Done" } });
+  });
+
+  it("call_operation refuses unknown operation ids", async () => {
+    const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.CallOperation, { operationId: "dropDatabase" });
+    expect(structured(result).error).toMatchObject({ kind: "not_found" });
+  });
+
+  it("health reports a rejected key without failing", async () => {
+    const result = await runBuiltin(makeCtx(jotty.url, "wrong"), BuiltinTool.Health, {});
+    expect(structured(result)).toMatchObject({ apiKey: "rejected", operations: 0 });
+  });
+});
diff --git a/mcp-server/tsconfig.json b/mcp-server/tsconfig.json
index 5d9896cdc..0b2be33e7 100644
--- a/mcp-server/tsconfig.json
+++ b/mcp-server/tsconfig.json
@@ -1,20 +1,21 @@
 {
   "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "lib": ["ES2022"],
-    "outDir": "dist",
-    "rootDir": "src",
+    "lib": ["ESNext", "DOM"],
+    "target": "ESNext",
+    "module": "Preserve",
+    "moduleResolution": "bundler",
+    "moduleDetection": "force",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "noEmit": true,
     "strict": true,
-    "esModuleInterop": true,
     "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true,
-    "declaration": false,
-    "sourceMap": true,
-    "noUnusedLocals": false,
-    "noUnusedParameters": false
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedIndexedAccess": true,
+    "noImplicitOverride": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "types": ["bun"]
   },
-  "include": ["src/**/*"]
-}
\ No newline at end of file
+  "include": ["src/**/*.ts", "tests/**/*.ts"]
+}
diff --git a/proxy.ts b/proxy.ts
index 67ecb2e4f..5a4e46ebc 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -121,6 +121,6 @@ export const proxy = async (request: NextRequest) => {
 
 export const config = {
   matcher: [
-    "/((?!_next/static|_next/image|favicon.ico|site.webmanifest|sw.js|app-icons|app-screenshots|flags|fonts|images|repo-images|themes|openapi.yaml).*)",
+    "/((?!_next/static|_next/image|favicon.ico|site.webmanifest|sw.js|app-icons|app-screenshots|flags|fonts|images|repo-images|themes).*)",
   ],
 };
diff --git a/public/api/components/responses.yaml b/public/api/components/responses.yaml
deleted file mode 100644
index c4b1ab302..000000000
--- a/public/api/components/responses.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-UnauthorizedError:
-  description: API key missing or invalid
-  content:
-    application/json:
-      schema:
-        $ref: '#/components/schemas/Error'
-ForbiddenError:
-  description: Insufficient permissions
-  content:
-    application/json:
-      schema:
-        $ref: '#/components/schemas/Error'
-NotFoundError:
-  description: Resource not found
-  content:
-    application/json:
-      schema:
-        $ref: '#/components/schemas/Error'
-BadRequestError:
-  description: Invalid request parameters
-  content:
-    application/json:
-      schema:
-        $ref: '#/components/schemas/Error'
diff --git a/public/api/components/schemas.yaml b/public/api/components/schemas.yaml
deleted file mode 100644
index 7e274a0ec..000000000
--- a/public/api/components/schemas.yaml
+++ /dev/null
@@ -1,205 +0,0 @@
-Error:
-  type: object
-  properties:
-    error:
-      type: string
-      example: "Error message description"
-
-AuditLogEntry:
-  type: object
-  properties:
-    id:
-      type: string
-      description: Unix timestamp as string
-      example: "1766778674300"
-    uuid:
-      type: string
-      format: uuid
-      description: Generated UUID for the log entry
-      example: "4a0d76b5-18de-400c-8b36-5fbdd9d8299b"
-    timestamp:
-      type: string
-      format: date-time
-      description: ISO 8601 format timestamp
-      example: "2025-12-26T19:51:14.300Z"
-    level:
-      type: string
-      enum: [DEBUG, INFO, WARNING, ERROR, CRITICAL]
-      description: Log severity level
-      example: "INFO"
-    username:
-      type: string
-      description: Username of the user who performed the action
-      example: "fccview"
-    action:
-      type: string
-      description: Type of action performed
-      example: "login"
-    category:
-      type: string
-      enum: [auth, user, checklist, note, sharing, settings, encryption, api, system, file, upload]
-      description: Category of the log entry
-      example: "auth"
-    resourceType:
-      type: string
-      description: Type of resource affected (e.g., "checklist", "note", "user")
-      example: "checklist"
-    resourceId:
-      type: string
-      description: UUID of the affected resource
-      example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
-    resourceTitle:
-      type: string
-      description: Human-readable name of the affected resource
-      example: "My Checklist"
-    metadata:
-      type: object
-      description: Custom data object with additional context
-      additionalProperties: true
-      example:
-        deletedFiles: 4
-        deleteAll: true
-    ipAddress:
-      type: string
-      description: IP address of the request
-      example: "::ffff:192.168.86.20"
-    userAgent:
-      type: string
-      description: User agent string from the request
-      example: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
-    success:
-      type: boolean
-      description: Whether the action was successful
-      example: true
-    errorMessage:
-      type: string
-      description: Error message if the action failed
-      example: "Invalid credentials"
-    duration:
-      type: integer
-      description: Duration of the action in milliseconds
-      example: 150
-
-KanbanStatus:
-  type: object
-  properties:
-    id:
-      type: string
-      description: Unique identifier for the status
-      example: "todo"
-    label:
-      type: string
-      description: Display name for the status
-      example: "To Do"
-    color:
-      type: string
-      description: Optional color code for the status column
-      example: "#3b82f6"
-    order:
-      type: integer
-      description: Display order of the status column
-      example: 0
-
-ChecklistItem:
-  type: object
-  properties:
-    id:
-      type: string
-      description: Internal item ID
-      example: "listId-1234567890"
-    index:
-      type: integer
-      description: Position in the parent's items array
-      example: 0
-    text:
-      type: string
-      example: "Task 1"
-    completed:
-      type: boolean
-      example: false
-    status:
-      type: string
-      enum: [todo, in_progress, paused, completed]
-      description: Only present for task-type checklists
-    description:
-      type: string
-      description: Item body or notes
-      example: "Details and acceptance criteria for this item"
-    priority:
-      type: string
-      enum: [critical, high, medium, low, none]
-      description: Kanban item priority
-      example: "high"
-    score:
-      type: number
-      description: Numeric score for ordering or estimation
-      example: 5
-    startDate:
-      type: string
-      format: date
-      description: Start date
-      example: "2026-06-10"
-    targetDate:
-      type: string
-      format: date
-      description: Due or target date
-      example: "2026-06-15"
-    estimatedTime:
-      type: number
-      description: Estimated time in hours
-      example: 2.5
-    createdBy:
-      type: string
-      description: Username of the user who created the item
-      example: "alice"
-    createdAt:
-      type: string
-      format: date-time
-      description: Item creation timestamp
-    lastModifiedBy:
-      type: string
-      description: Username of the last user to edit the item
-      example: "alice"
-    lastModifiedAt:
-      type: string
-      format: date-time
-      description: Last item edit timestamp
-    history:
-      type: array
-      description: Status change history
-      items:
-        type: object
-        properties:
-          status:
-            type: string
-            example: "in_progress"
-          timestamp:
-            type: string
-            format: date-time
-          user:
-            type: string
-            example: "alice"
-    time:
-      oneOf:
-        - type: integer
-          example: 0
-        - type: array
-          items:
-            type: object
-            properties:
-              id:
-                type: string
-              startTime:
-                type: string
-                format: date-time
-              endTime:
-                type: string
-                format: date-time
-              duration:
-                type: integer
-      description: Only present for task-type checklists
-    children:
-      type: array
-      items:
-        $ref: '#/components/schemas/ChecklistItem'
-      description: Nested sub-items
diff --git a/public/api/components/security.yaml b/public/api/components/security.yaml
deleted file mode 100644
index e71e4cc2b..000000000
--- a/public/api/components/security.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-securitySchemes:
-  ApiKeyAuth:
-    type: apiKey
-    in: header
-    name: x-api-key
-    description: API key obtained from Profile → Settings → API Key
diff --git a/public/api/info.yaml b/public/api/info.yaml
deleted file mode 100644
index 3a4d3df19..000000000
--- a/public/api/info.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-title: Jotty API
-description: |
-  Programmatic access to your checklists and notes with full CRUD operations.
-
-  ## Authentication
-  All endpoints require authentication via API key in the `x-api-key` header.
-
-  Get your API key from: Profile → Settings → API Key → Generate
-version: "1.19.0"
-contact:
-  name: Jotty
-  url: https://github.com/fccview/jotty
diff --git a/public/api/paths/admin.yaml b/public/api/paths/admin.yaml
deleted file mode 100644
index d059696b2..000000000
--- a/public/api/paths/admin.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-/admin/rebuild-index:
-  post:
-    summary: Rebuild Link Index
-    description: Rebuilds internal link index for a user (admin only)
-    tags:
-      - Admin
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - username
-            properties:
-              username:
-                type: string
-                example: "fccview"
-    responses:
-      '200':
-        description: Index rebuilt successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                message:
-                  type: string
-                  example: "Successfully rebuilt link index for fccview"
-      '403':
-        description: Admin access required
diff --git a/public/api/paths/categories.yaml b/public/api/paths/categories.yaml
deleted file mode 100644
index 38d2d2a91..000000000
--- a/public/api/paths/categories.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-/categories:
-  get:
-    summary: Get All Categories
-    description: Retrieves all categories for notes and checklists
-    tags:
-      - Categories
-    responses:
-      '200':
-        description: Categories organized by type
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                categories:
-                  type: object
-                  properties:
-                    notes:
-                      type: array
-                      items:
-                        type: object
-                        properties:
-                          name:
-                            type: string
-                          path:
-                            type: string
-                          count:
-                            type: integer
-                          level:
-                            type: integer
-                    checklists:
-                      type: array
-                      items:
-                        type: object
-                        properties:
-                          name:
-                            type: string
-                          path:
-                            type: string
-                          count:
-                            type: integer
-                          level:
-                            type: integer
diff --git a/public/api/paths/checklists.yaml b/public/api/paths/checklists.yaml
deleted file mode 100644
index c3f0883ae..000000000
--- a/public/api/paths/checklists.yaml
+++ /dev/null
@@ -1,443 +0,0 @@
-/checklists:
-  get:
-    summary: Get All Checklists
-    description: Retrieves all checklists owned by or shared with the authenticated user. Supports filtering and search.
-    tags:
-      - Checklists
-    parameters:
-      - name: category
-        in: query
-        schema:
-          type: string
-        description: Filter checklists by category
-      - name: type
-        in: query
-        schema:
-          type: string
-          enum: [simple, task]
-        description: Filter checklists by type
-      - name: q
-        in: query
-        schema:
-          type: string
-        description: Search checklists by title or item text
-    responses:
-      '200':
-        description: List of checklists
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                checklists:
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      id:
-                        type: string
-                        format: uuid
-                        example: "f47ac10b-58cc-4372-a567-0e02b2c3d479"
-                      title:
-                        type: string
-                        example: "My Tasks"
-                      category:
-                        type: string
-                        example: "Work"
-                      type:
-                        type: string
-                        enum: [simple, task]
-                        example: "simple"
-                      items:
-                        type: array
-                        items:
-                          $ref: '#/components/schemas/ChecklistItem'
-                      createdAt:
-                        type: string
-                        format: date-time
-                      owner:
-                        type: string
-                        example: "alice"
-                      isShared:
-                        type: boolean
-                        description: True when this checklist was shared with the user by another user
-                        example: false
-                      updatedAt:
-                        type: string
-                        format: date-time
-
-  post:
-    summary: Create Checklist
-    description: Creates a new checklist for the authenticated user
-    tags:
-      - Checklists
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - title
-            properties:
-              title:
-                type: string
-                example: "My New Checklist"
-              category:
-                type: string
-                default: "Uncategorized"
-                example: "Work"
-              type:
-                type: string
-                enum: [simple, task]
-                default: simple
-                example: "simple"
-    responses:
-      '200':
-        description: Checklist created successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                data:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-                      format: uuid
-                    title:
-                      type: string
-                    category:
-                      type: string
-                    type:
-                      type: string
-                    items:
-                      type: array
-                      items: {}
-                    createdAt:
-                      type: string
-                      format: date-time
-                    updatedAt:
-                      type: string
-                      format: date-time
-      '400':
-        description: Invalid request (missing title or invalid type)
-
-/checklists/{listId}/items:
-  post:
-    summary: Create Checklist Item
-    description: |
-      Adds a new item to the specified checklist.
-
-      To create a nested item, provide the `parentIndex` parameter with the index path of the parent item (e.g., "0" for first item's child, "0.1" for second child of first item).
-    tags:
-      - Checklists
-    parameters:
-      - name: listId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the checklist
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - text
-            properties:
-              text:
-                type: string
-                example: "New task to complete"
-              parentIndex:
-                type: string
-                description: Index path of parent item (e.g., "0", "0.1", "2.0.1") for creating nested sub-items
-                example: "0"
-              status:
-                type: string
-                enum: [in_progress, paused, completed]
-                default: in_progress
-              time:
-                oneOf:
-                  - type: integer
-                    default: 0
-                  - type: array
-                    items:
-                      type: object
-                      properties:
-                        id:
-                          type: string
-                        startTime:
-                          type: string
-                          format: date-time
-                        endTime:
-                          type: string
-                          format: date-time
-                        duration:
-                          type: integer
-    responses:
-      '200':
-        description: Item created successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '404':
-        description: Checklist not found
-      '400':
-        description: Invalid request
-
-/checklists/{listId}/items/{itemIndex}:
-  patch:
-    summary: Update Checklist Item
-    description: |
-      Updates one or more writable fields on a checklist item.
-
-      Supports nested items using index paths (e.g., "0" for first item, "0.1" for second child of first item).
-    tags:
-      - Checklists
-    parameters:
-      - name: listId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-      - name: itemIndex
-        in: path
-        required: true
-        schema:
-          type: string
-        description: Index or index path (e.g., "0", "0.1", "2.0.1")
-        example: "0"
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              text:
-                type: string
-                example: "Updated task text"
-              description:
-                type: string
-                example: "Additional notes about this item"
-              priority:
-                type: string
-                enum: [critical, high, medium, low, none]
-                example: "high"
-              score:
-                type: number
-                example: 5
-              startDate:
-                type: string
-                format: date
-                example: "2026-06-10"
-              targetDate:
-                type: string
-                format: date
-                example: "2026-06-15"
-              estimatedTime:
-                type: number
-                example: 2.5
-    responses:
-      '200':
-        description: Item updated successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '400':
-        description: Missing fields or invalid index
-      '404':
-        description: Checklist or item not found
-  delete:
-    summary: Delete Item
-    description: |
-      Deletes a checklist item.
-
-      Supports nested items using index paths (e.g., "0" for first item, "0.1" for second child of first item, "2.0.1" for nested grandchild).
-    tags:
-      - Checklists
-    parameters:
-      - name: listId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-      - name: itemIndex
-        in: path
-        required: true
-        schema:
-          type: string
-        description: Index or index path (e.g., "0", "0.1", "2.0.1")
-        example: "1"
-    responses:
-      '200':
-        description: Item deleted successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '404':
-        description: Checklist or item not found
-      '400':
-        description: Invalid item index
-
-/checklists/{listId}/items/reorder:
-  put:
-    summary: Reorder Checklist Items
-    description: |
-      Moves an item before or after another item, or nests it as a child.
-
-      Use `position: "before"` or `"after"` for sibling placement, or `isDropInto: true` to nest the active item inside the over item.
-    tags:
-      - Checklists
-    parameters:
-      - name: listId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - activeItemId
-              - overItemId
-            properties:
-              activeItemId:
-                type: string
-                description: ID of the item being moved
-                example: "my-list-1716900000000"
-              overItemId:
-                type: string
-                description: ID of the reference item to move relative to
-                example: "my-list-1716900000001"
-              position:
-                type: string
-                enum: [before, after]
-                default: before
-                description: Whether to place the active item before or after the reference item
-              isDropInto:
-                type: boolean
-                default: false
-                description: When true, nests the active item as a child of the reference item
-    responses:
-      '200':
-        description: Items reordered successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '400':
-        description: Missing required fields or invalid position value
-      '404':
-        description: Checklist or item not found
-
-/checklists/{listId}/items/{itemIndex}/check:
-  put:
-    summary: Mark Item as Completed
-    description: |
-      Marks a checklist item as completed.
-
-      Supports nested items using index paths (e.g., "0" for first item, "0.1" for second child of first item, "2.0.1" for nested grandchild).
-    tags:
-      - Checklists
-    parameters:
-      - name: listId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-      - name: itemIndex
-        in: path
-        required: true
-        schema:
-          type: string
-        description: Index or index path (e.g., "0", "0.1", "2.0.1")
-        example: "0.1"
-    responses:
-      '200':
-        description: Item marked as completed
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '404':
-        description: Checklist or item not found
-      '400':
-        description: Invalid item index
-
-/checklists/{listId}/items/{itemIndex}/uncheck:
-  put:
-    summary: Mark Item as Incomplete
-    description: |
-      Marks a checklist item as incomplete.
-
-      Supports nested items using index paths (e.g., "0" for first item, "0.1" for second child of first item, "2.0.1" for nested grandchild).
-    tags:
-      - Checklists
-    parameters:
-      - name: listId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-      - name: itemIndex
-        in: path
-        required: true
-        schema:
-          type: string
-        description: Index or index path (e.g., "0", "0.1", "2.0.1")
-        example: "0.1"
-    responses:
-      '200':
-        description: Item marked as incomplete
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '404':
-        description: Checklist or item not found
-      '400':
-        description: Invalid item index
diff --git a/public/api/paths/exports.yaml b/public/api/paths/exports.yaml
deleted file mode 100644
index 955949dcc..000000000
--- a/public/api/paths/exports.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-/exports:
-  post:
-    summary: Request Data Export
-    description: Initiates an export of user data
-    tags:
-      - Exports
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              type:
-                type: string
-                enum: [all_checklists_notes, user_checklists_notes, all_users_data, whole_data_folder]
-                example: "all_checklists_notes"
-              username:
-                type: string
-                description: Required for user_checklists_notes type
-    responses:
-      '200':
-        description: Export initiated
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                downloadUrl:
-                  type: string
-                  example: "/api/exports/all_checklists_notes_1678886400000.zip"
-
-  get:
-    summary: Get Export Progress
-    description: Retrieves current export operation progress
-    tags:
-      - Exports
-    responses:
-      '200':
-        description: Export progress
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                progress:
-                  type: integer
-                  minimum: 0
-                  maximum: 100
-                  example: 75
-                message:
-                  type: string
-                  example: "Compressing files: 150/200 bytes"
diff --git a/public/api/paths/health.yaml b/public/api/paths/health.yaml
deleted file mode 100644
index a2362f8c3..000000000
--- a/public/api/paths/health.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-/health:
-  get:
-    summary: Health Check
-    description: Returns the application health status and version information
-    tags:
-      - System
-    security: []  # Public endpoint
-    responses:
-      '200':
-        description: Application is healthy
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                status:
-                  type: string
-                  enum: [healthy, unhealthy]
-                  example: healthy
-                version:
-                  type: string
-                  example: "1.9.3"
-                timestamp:
-                  type: string
-                  format: date-time
-                  example: "2025-10-31T21:15:57.009Z"
-                error:
-                  type: string
-                  description: Only present when status is unhealthy
diff --git a/public/api/paths/logs.yaml b/public/api/paths/logs.yaml
deleted file mode 100644
index 695559804..000000000
--- a/public/api/paths/logs.yaml
+++ /dev/null
@@ -1,270 +0,0 @@
-/logs:
-  get:
-    summary: Get Audit Logs
-    description: |
-      Retrieve audit logs with optional filtering and pagination.
-      - Regular users can only view their own logs
-      - Admins can view all users' logs by omitting the username parameter or specifying a username
-    tags:
-      - Audit Logs
-    parameters:
-      - in: query
-        name: username
-        schema:
-          type: string
-        description: Filter by username (admin only, defaults to current user for non-admins)
-        example: "fccview"
-      - in: query
-        name: action
-        schema:
-          type: string
-        description: Filter by action type
-        example: "login"
-      - in: query
-        name: category
-        schema:
-          type: string
-          enum: [auth, user, checklist, note, sharing, settings, encryption, api, system, file, upload]
-        description: Filter by category
-        example: "auth"
-      - in: query
-        name: level
-        schema:
-          type: string
-          enum: [DEBUG, INFO, WARNING, ERROR, CRITICAL]
-        description: Filter by log level
-        example: "INFO"
-      - in: query
-        name: startDate
-        schema:
-          type: string
-          format: date-time
-        description: Start date for log range (defaults to 30 days ago)
-        example: "2025-12-01T00:00:00Z"
-      - in: query
-        name: endDate
-        schema:
-          type: string
-          format: date-time
-        description: End date for log range (defaults to now)
-        example: "2025-12-26T23:59:59Z"
-      - in: query
-        name: success
-        schema:
-          type: boolean
-        description: Filter by success status
-        example: true
-      - in: query
-        name: limit
-        schema:
-          type: integer
-          default: 50
-        description: Number of logs to return
-        example: 50
-      - in: query
-        name: offset
-        schema:
-          type: integer
-          default: 0
-        description: Number of logs to skip
-        example: 0
-    responses:
-      '200':
-        description: Audit logs retrieved successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                logs:
-                  type: array
-                  items:
-                    $ref: '#/components/schemas/AuditLogEntry'
-                total:
-                  type: integer
-                  description: Total number of logs matching the filters
-                  example: 150
-      '403':
-        description: Forbidden - user tried to access another user's logs
-      '500':
-        description: Failed to fetch audit logs
-
-/logs/export:
-  post:
-    summary: Export Audit Logs
-    description: |
-      Export audit logs in JSON or CSV format.
-      - Regular users can only export their own logs
-      - Admins can export logs for all users or specific users
-    tags:
-      - Audit Logs
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - format
-            properties:
-              format:
-                type: string
-                enum: [json, csv]
-                description: Export format
-                example: "json"
-              filters:
-                type: object
-                description: Same filters as GET /logs endpoint
-                properties:
-                  username:
-                    type: string
-                  action:
-                    type: string
-                  category:
-                    type: string
-                  level:
-                    type: string
-                  startDate:
-                    type: string
-                    format: date-time
-                  endDate:
-                    type: string
-                    format: date-time
-                  success:
-                    type: boolean
-                  limit:
-                    type: integer
-    responses:
-      '200':
-        description: Audit logs exported successfully
-        content:
-          application/json:
-            schema:
-              description: When format is json
-              type: array
-              items:
-                $ref: '#/components/schemas/AuditLogEntry'
-          text/csv:
-            schema:
-              description: When format is csv
-              type: string
-              example: |
-                Timestamp,Level,Username,Action,Category,Resource Type,Resource ID,Resource Title,Success,IP Address,Error Message
-                "2025-12-26T19:51:14.300Z","WARNING","fccview","logs_cleaned","system","","","","true","::ffff:192.168.86.20",""
-      '400':
-        description: Invalid format specified
-      '500':
-        description: Export failed
-
-/logs/stats:
-  get:
-    summary: Get Audit Log Statistics
-    description: |
-      Retrieve aggregated statistics for audit logs (admin only).
-      Statistics include log counts by level, category, top actions, top users, and recent activity.
-    tags:
-      - Audit Logs
-    responses:
-      '200':
-        description: Statistics retrieved successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                totalLogs:
-                  type: integer
-                  description: Total number of logs in the system
-                  example: 1250
-                logsByLevel:
-                  type: object
-                  properties:
-                    DEBUG:
-                      type: integer
-                      example: 50
-                    INFO:
-                      type: integer
-                      example: 800
-                    WARNING:
-                      type: integer
-                      example: 300
-                    ERROR:
-                      type: integer
-                      example: 90
-                    CRITICAL:
-                      type: integer
-                      example: 10
-                logsByCategory:
-                  type: object
-                  additionalProperties:
-                    type: integer
-                  example:
-                    auth: 450
-                    user: 200
-                    checklist: 300
-                    note: 250
-                    system: 50
-                topActions:
-                  type: array
-                  description: Top 10 most frequent actions
-                  items:
-                    type: object
-                    properties:
-                      action:
-                        type: string
-                        example: "login"
-                      count:
-                        type: integer
-                        example: 350
-                topUsers:
-                  type: array
-                  description: Top 10 most active users
-                  items:
-                    type: object
-                    properties:
-                      username:
-                        type: string
-                        example: "fccview"
-                      count:
-                        type: integer
-                        example: 425
-                recentActivity:
-                  type: array
-                  description: Last 10 log entries
-                  items:
-                    $ref: '#/components/schemas/AuditLogEntry'
-      '403':
-        description: Admin access required
-      '500':
-        description: Failed to fetch statistics
-
-/logs/cleanup:
-  post:
-    summary: Cleanup Old Logs
-    description: |
-      Delete audit logs older than the configured retention period (admin only).
-      The retention period is configured via the maxLogAgeDays setting.
-    tags:
-      - Audit Logs
-    responses:
-      '200':
-        description: Cleanup completed successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                deletedFiles:
-                  type: integer
-                  description: Number of log files deleted
-                  example: 15
-      '403':
-        description: Admin access required
-      '500':
-        description: Cleanup failed
diff --git a/public/api/paths/notes.yaml b/public/api/paths/notes.yaml
deleted file mode 100644
index 0481b600e..000000000
--- a/public/api/paths/notes.yaml
+++ /dev/null
@@ -1,251 +0,0 @@
-/notes:
-  get:
-    summary: Get All Notes
-    description: Retrieves all notes for the authenticated user. Supports filtering and search.
-    tags:
-      - Notes
-    parameters:
-      - name: category
-        in: query
-        schema:
-          type: string
-        description: Filter notes by category
-      - name: q
-        in: query
-        schema:
-          type: string
-        description: Search notes by title or content
-    responses:
-      '200':
-        description: List of notes
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                notes:
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      id:
-                        type: string
-                        format: uuid
-                        example: "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
-                      title:
-                        type: string
-                        example: "My Note"
-                      category:
-                        type: string
-                        example: "Personal"
-                      content:
-                        type: string
-                        description: Markdown content
-                        example: "Note content here..."
-                      createdAt:
-                        type: string
-                        format: date-time
-                      updatedAt:
-                        type: string
-                        format: date-time
-
-  post:
-    summary: Create Note
-    description: Creates a new note for the authenticated user
-    tags:
-      - Notes
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - title
-            properties:
-              title:
-                type: string
-                example: "My New Note"
-              content:
-                type: string
-                description: Markdown content
-                example: "Note content here..."
-              category:
-                type: string
-                default: "Uncategorized"
-                example: "Personal"
-    responses:
-      '200':
-        description: Note created successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                data:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-                      format: uuid
-                    title:
-                      type: string
-                    content:
-                      type: string
-                    category:
-                      type: string
-                    createdAt:
-                      type: string
-                      format: date-time
-                    updatedAt:
-                      type: string
-                      format: date-time
-                    owner:
-                      type: string
-      '400':
-        description: Invalid request (missing title)
-
-/notes/{noteId}:
-  get:
-    summary: Get Note by id
-    description: Retrieves a single note by id
-    tags:
-      - Notes
-    parameters:
-      - name: noteId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the note
-    responses:
-      '200':
-        description: Note retrieved successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                data:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-                      format: uuid
-                    title:
-                      type: string
-                    content:
-                      type: string
-                    category:
-                      type: string
-                    createdAt:
-                      type: string
-                      format: date-time
-                    updatedAt:
-                      type: string
-                      format: date-time
-                    owner:
-                      type: string
-      '404':
-        description: Note not found
-      '400':
-        description: Invalid request
-  put:
-    summary: Update Note
-    description: Updates an existing note. All fields are optional - unspecified fields will preserve their current values.
-    tags:
-      - Notes
-    parameters:
-      - name: noteId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the note to update
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              title:
-                type: string
-                example: "Updated Note Title"
-              content:
-                type: string
-                description: Markdown content
-                example: "Updated note content..."
-              category:
-                type: string
-                example: "Work"
-    responses:
-      '200':
-        description: Note updated successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                data:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-                      format: uuid
-                    title:
-                      type: string
-                    content:
-                      type: string
-                    category:
-                      type: string
-                    createdAt:
-                      type: string
-                      format: date-time
-                    updatedAt:
-                      type: string
-                      format: date-time
-                    owner:
-                      type: string
-      '404':
-        description: Note not found
-      '400':
-        description: Invalid request
-
-  delete:
-    summary: Delete Note
-    description: Deletes an existing note
-    tags:
-      - Notes
-    parameters:
-      - name: noteId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the note to delete
-    responses:
-      '200':
-        description: Note deleted successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '404':
-        description: Note not found
diff --git a/public/api/paths/search.yaml b/public/api/paths/search.yaml
deleted file mode 100644
index 4b23c086a..000000000
--- a/public/api/paths/search.yaml
+++ /dev/null
@@ -1,69 +0,0 @@
-/search:
-  get:
-    summary: Search Notes and Checklists
-    description: |
-      Full-text search across all notes and checklists owned by the authenticated user.
-
-      Optionally filter results to a single content type. Results are ranked by relevance and capped at 20 per type.
-    tags:
-      - Search
-    parameters:
-      - name: q
-        in: query
-        required: true
-        schema:
-          type: string
-          minLength: 2
-        description: Search query (minimum 2 characters)
-        example: "meeting notes"
-      - name: type
-        in: query
-        schema:
-          type: string
-          enum: [note, checklist]
-        description: Restrict results to a single content type
-        example: "note"
-    responses:
-      '200':
-        description: Search results
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                query:
-                  type: string
-                  example: "meeting notes"
-                total:
-                  type: integer
-                  example: 4
-                results:
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      id:
-                        type: string
-                        example: "my-note-id"
-                      uuid:
-                        type: string
-                        format: uuid
-                        example: "f47ac10b-58cc-4372-a567-0e02b2c3d479"
-                      type:
-                        type: string
-                        enum: [note, checklist]
-                        example: "note"
-                      title:
-                        type: string
-                        example: "Weekly Meeting Notes"
-                      category:
-                        type: string
-                        example: "Work"
-                      excerpt:
-                        type: string
-                        description: Matching line from the content, omitted when it matches the title
-                        example: "discussed the new API roadmap"
-      '400':
-        description: Query too short (must be at least 2 characters)
-      '401':
-        description: Unauthorized
diff --git a/public/api/paths/summary.yaml b/public/api/paths/summary.yaml
deleted file mode 100644
index 15a914775..000000000
--- a/public/api/paths/summary.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-/summary:
-  get:
-    summary: Get User Summary Statistics
-    description: Retrieves comprehensive statistics about user content
-    tags:
-      - Statistics
-    parameters:
-      - name: username
-        in: query
-        schema:
-          type: string
-        description: Username to get summary for (admin only)
-    responses:
-      '200':
-        description: User statistics
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                summary:
-                  type: object
-                  properties:
-                    username:
-                      type: string
-                    notes:
-                      type: object
-                      properties:
-                        total:
-                          type: integer
-                        categories:
-                          type: object
-                          additionalProperties:
-                            type: integer
-                    checklists:
-                      type: object
-                      properties:
-                        total:
-                          type: integer
-                        categories:
-                          type: object
-                          additionalProperties:
-                            type: integer
-                        types:
-                          type: object
-                          properties:
-                            simple:
-                              type: integer
-                            task:
-                              type: integer
-                    items:
-                      type: object
-                      properties:
-                        total:
-                          type: integer
-                        completed:
-                          type: integer
-                        pending:
-                          type: integer
-                        completionRate:
-                          type: integer
-                    tasks:
-                      type: object
-                      properties:
-                        total:
-                          type: integer
-                        completed:
-                          type: integer
-                        inProgress:
-                          type: integer
-                        todo:
-                          type: integer
-                        completionRate:
-                          type: integer
diff --git a/public/api/paths/tasks.yaml b/public/api/paths/tasks.yaml
deleted file mode 100644
index e67350662..000000000
--- a/public/api/paths/tasks.yaml
+++ /dev/null
@@ -1,611 +0,0 @@
-/tasks:
-  get:
-    summary: Get All Tasks
-    description: Retrieves all task checklists for the authenticated user. Supports filtering and search.
-    tags:
-      - Tasks
-    parameters:
-      - name: category
-        in: query
-        schema:
-          type: string
-        description: Filter tasks by category
-      - name: status
-        in: query
-        schema:
-          type: string
-        description: Filter tasks that contain items with this status
-      - name: q
-        in: query
-        schema:
-          type: string
-        description: Search tasks by title or item text
-    responses:
-      '200':
-        description: List of tasks
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                tasks:
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      id:
-                        type: string
-                        format: uuid
-                        example: "f47ac10b-58cc-4372-a567-0e02b2c3d479"
-                      title:
-                        type: string
-                        example: "Sprint Tasks"
-                      category:
-                        type: string
-                        example: "Work"
-                      statuses:
-                        type: array
-                        items:
-                          $ref: '#/components/schemas/KanbanStatus'
-                      items:
-                        type: array
-                        items:
-                          $ref: '#/components/schemas/ChecklistItem'
-                      createdAt:
-                        type: string
-                        format: date-time
-                      updatedAt:
-                        type: string
-                        format: date-time
-
-  post:
-    summary: Create Task
-    description: Creates a new task checklist for the authenticated user
-    tags:
-      - Tasks
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - title
-            properties:
-              title:
-                type: string
-                example: "New Sprint"
-              category:
-                type: string
-                default: "Uncategorized"
-                example: "Work"
-              statuses:
-                type: array
-                items:
-                  $ref: '#/components/schemas/KanbanStatus'
-                description: Custom Kanban statuses (defaults to todo/in_progress/completed)
-    responses:
-      '200':
-        description: Task created successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                data:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-                      format: uuid
-                    title:
-                      type: string
-                    category:
-                      type: string
-                    statuses:
-                      type: array
-                      items:
-                        $ref: '#/components/schemas/KanbanStatus'
-                    items:
-                      type: array
-                      items:
-                        $ref: '#/components/schemas/ChecklistItem'
-                    createdAt:
-                      type: string
-                      format: date-time
-                    updatedAt:
-                      type: string
-                      format: date-time
-      '400':
-        description: Invalid request
-
-/tasks/{taskId}:
-  get:
-    summary: Get Task
-    description: Retrieves a specific task checklist
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task
-    responses:
-      '200':
-        description: Task details
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                task:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-                      format: uuid
-                    title:
-                      type: string
-                    category:
-                      type: string
-                    statuses:
-                      type: array
-                      items:
-                        $ref: '#/components/schemas/KanbanStatus'
-                    items:
-                      type: array
-                      items:
-                        $ref: '#/components/schemas/ChecklistItem'
-                    createdAt:
-                      type: string
-                      format: date-time
-                    updatedAt:
-                      type: string
-                      format: date-time
-      '404':
-        description: Task not found
-      '400':
-        description: Not a task checklist
-
-  put:
-    summary: Update Task
-    description: Updates task metadata (title, category). All fields are optional.
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task to update
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              title:
-                type: string
-                example: "Updated Sprint Title"
-              category:
-                type: string
-                example: "Work"
-    responses:
-      '200':
-        description: Task updated successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                data:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-                      format: uuid
-                    title:
-                      type: string
-                    category:
-                      type: string
-                    statuses:
-                      type: array
-                      items:
-                        $ref: '#/components/schemas/KanbanStatus'
-                    createdAt:
-                      type: string
-                      format: date-time
-                    updatedAt:
-                      type: string
-                      format: date-time
-      '404':
-        description: Task not found
-      '400':
-        description: Invalid request or not a task checklist
-
-  delete:
-    summary: Delete Task
-    description: Deletes a task checklist
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task to delete
-    responses:
-      '200':
-        description: Task deleted successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '404':
-        description: Task not found
-      '400':
-        description: Not a task checklist
-
-/tasks/{taskId}/statuses:
-  get:
-    summary: Get Task Statuses
-    description: Retrieves all Kanban column statuses for a task
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task
-    responses:
-      '200':
-        description: List of statuses
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                statuses:
-                  type: array
-                  items:
-                    $ref: '#/components/schemas/KanbanStatus'
-      '404':
-        description: Task not found
-      '400':
-        description: Not a task checklist
-
-  post:
-    summary: Create Status
-    description: Adds a new Kanban column status to a task
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - id
-              - label
-            properties:
-              id:
-                type: string
-                example: "review"
-              label:
-                type: string
-                example: "In Review"
-              color:
-                type: string
-                example: "#3b82f6"
-              order:
-                type: integer
-                example: 2
-    responses:
-      '200':
-        description: Status created successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                data:
-                  $ref: '#/components/schemas/KanbanStatus'
-      '400':
-        description: Invalid request or status ID already exists
-      '404':
-        description: Task not found
-
-/tasks/{taskId}/statuses/{statusId}:
-  put:
-    summary: Update Status
-    description: Updates a Kanban column status
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task
-      - name: statusId
-        in: path
-        required: true
-        schema:
-          type: string
-        description: ID of the status to update
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            properties:
-              label:
-                type: string
-                example: "Code Review"
-              color:
-                type: string
-                example: "#8b5cf6"
-              order:
-                type: integer
-                example: 3
-    responses:
-      '200':
-        description: Status updated successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                data:
-                  $ref: '#/components/schemas/KanbanStatus'
-      '404':
-        description: Task or status not found
-      '400':
-        description: Invalid request or not a task checklist
-
-  delete:
-    summary: Delete Status
-    description: Deletes a Kanban column status. Items with this status will be moved to the first available status.
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task
-      - name: statusId
-        in: path
-        required: true
-        schema:
-          type: string
-        description: ID of the status to delete
-    responses:
-      '200':
-        description: Status deleted successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '404':
-        description: Task or status not found
-      '400':
-        description: Not a task checklist
-
-/tasks/{taskId}/items:
-  post:
-    summary: Create Task Item
-    description: Creates a new item in a task checklist
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - text
-            properties:
-              text:
-                type: string
-                example: "Implement user authentication"
-              status:
-                type: string
-                default: "todo"
-                example: "todo"
-              parentIndex:
-                type: string
-                description: Index path for creating nested items (e.g., "0" for child of first item, "0.1" for grandchild)
-                example: "0"
-    responses:
-      '200':
-        description: Item created successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-                data:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-      '400':
-        description: Invalid request
-      '404':
-        description: Task or parent item not found
-
-/tasks/{taskId}/items/{itemIndex}/status:
-  put:
-    summary: Update Item Status
-    description: Changes an item's status (moves it between Kanban columns)
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task
-      - name: itemIndex
-        in: path
-        required: true
-        schema:
-          type: string
-        description: Index path of the item (e.g., "0", "0.1", "2.0.1")
-    requestBody:
-      required: true
-      content:
-        application/json:
-          schema:
-            type: object
-            required:
-              - status
-            properties:
-              status:
-                type: string
-                example: "in_progress"
-    responses:
-      '200':
-        description: Item status updated successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '400':
-        description: Invalid request or item index
-      '404':
-        description: Task or item not found
-
-/tasks/{taskId}/items/{itemIndex}:
-  get:
-    summary: Get Task Item
-    description: Retrieves a single item from a task checklist, including nested children and Kanban item fields.
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task
-      - name: itemIndex
-        in: path
-        required: true
-        schema:
-          type: string
-        description: Index path of the item to fetch (e.g., "0", "0.1", "2.0.1")
-    responses:
-      '200':
-        description: Item details
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                item:
-                  $ref: '#/components/schemas/ChecklistItem'
-      '400':
-        description: Invalid item index or not a task checklist
-      '404':
-        description: Task or item not found
-
-  delete:
-    summary: Delete Task Item
-    description: Deletes an item from a task checklist
-    tags:
-      - Tasks
-    parameters:
-      - name: taskId
-        in: path
-        required: true
-        schema:
-          type: string
-          format: uuid
-        description: UUID of the task
-      - name: itemIndex
-        in: path
-        required: true
-        schema:
-          type: string
-        description: Index path of the item to delete (e.g., "0", "0.1", "2.0.1")
-    responses:
-      '200':
-        description: Item deleted successfully
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                success:
-                  type: boolean
-                  example: true
-      '400':
-        description: Invalid item index or not a task checklist
-      '404':
-        description: Task or item not found
diff --git a/public/api/paths/users.yaml b/public/api/paths/users.yaml
deleted file mode 100644
index 94174e802..000000000
--- a/public/api/paths/users.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-/user/{username}:
-  get:
-    summary: Get User Information
-    description: Retrieves user information (full data if authenticated as user or admin, public data otherwise)
-    tags:
-      - Users
-    parameters:
-      - name: username
-        in: path
-        required: true
-        schema:
-          type: string
-        description: Username to retrieve information for
-    responses:
-      '200':
-        description: User information
-        content:
-          application/json:
-            schema:
-              type: object
-              properties:
-                user:
-                  type: object
-                  properties:
-                    username:
-                      type: string
-                    isAdmin:
-                      type: boolean
-                    createdAt:
-                      type: string
-                      format: date-time
-                    lastLogin:
-                      type: string
-                      format: date-time
-                    avatarUrl:
-                      type: string
-                    preferredTheme:
-                      type: string
-                    imageSyntax:
-                      type: string
-                    tableSyntax:
-                      type: string
-                    landingPage:
-                      type: string
-                    notesAutoSaveInterval:
-                      type: integer
-                    notesDefaultEditor:
-                      type: string
-                    notesDefaultMode:
-                      type: string
-                    pinnedLists:
-                      type: array
-                      items:
-                        type: string
-                    pinnedNotes:
-                      type: array
-                      items:
-                        type: string
-      '404':
-        description: User not found
diff --git a/public/openapi.yaml b/public/openapi.yaml
deleted file mode 100644
index 528592b4e..000000000
--- a/public/openapi.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-openapi: 3.0.3
-info:
-  $ref: './api/info.yaml'
-security:
-  - ApiKeyAuth: []
-paths: {}
-components:
-  securitySchemes:
-    $ref: './api/components/security.yaml'
-  schemas:
-    $ref: './api/components/schemas.yaml'
-  responses:
-    $ref: './api/components/responses.yaml'
diff --git a/tests/api/checklists.test.ts b/tests/api/checklists.test.ts
index 1b903960d..267b79524 100644
--- a/tests/api/checklists.test.ts
+++ b/tests/api/checklists.test.ts
@@ -246,6 +246,44 @@ describe("Checklists API", () => {
       expect(data.error).toBe("Type must be 'simple' or 'kanban'");
     });
 
+    it("accepts the legacy 'task' type", async () => {
+      mockMakeList.mockResolvedValue({
+        success: true,
+        data: { uuid: "task-uuid", title: "Board", category: "Work", type: "task" },
+      });
+
+      const response = await POST(
+        createMockRequest("POST", "http://localhost:3000/api/checklists", {
+          title: "Board",
+          category: "Work",
+          type: "task",
+        }),
+      );
+
+      expect(response.status).toBe(200);
+      const formData = mockMakeList.mock.calls[0][1] as FormData;
+      expect(formData.get("type")).toBe("task");
+    });
+
+    it("defaults category and type", async () => {
+      mockMakeList.mockResolvedValue({
+        success: true,
+        data: { uuid: "u", title: "Plain", type: "simple" },
+      });
+
+      const response = await POST(
+        createMockRequest("POST", "http://localhost:3000/api/checklists", { title: "Plain" }),
+      );
+      const data = await getResponseJson(response);
+
+      expect(response.status).toBe(200);
+      const formData = mockMakeList.mock.calls[0][1] as FormData;
+      expect(formData.get("category")).toBe("Uncategorized");
+      expect(formData.get("type")).toBe("simple");
+      expect(data.data.category).toBe("Uncategorized");
+      expect(data.data.items).toEqual([]);
+    });
+
     it("should return 401 for unauthorized requests", async () => {
       mockAuthenticateApiKey.mockResolvedValue(null);
 
@@ -302,6 +340,30 @@ describe("Checklists API", () => {
       expect(data.data.title).toBe("Updated Test Checklist - API");
     });
 
+    it("keeps title and category when the body is empty", async () => {
+      const existingList = {
+        id: "list-1",
+        uuid: "uuid-1",
+        title: "Keep Me",
+        category: "Work",
+        type: "simple",
+        items: [],
+        owner: "testuser",
+      };
+      mockGetListById.mockResolvedValue(existingList);
+      mockEditList.mockResolvedValue({ success: true, data: existingList });
+
+      const response = await PUT(
+        createMockRequest("PUT", "http://localhost:3000/api/checklists/uuid-1"),
+        { params: Promise.resolve({ listId: "uuid-1" }) },
+      );
+
+      expect(response.status).toBe(200);
+      const formData = mockEditList.mock.calls[0][1] as FormData;
+      expect(formData.get("title")).toBe("Keep Me");
+      expect(formData.get("category")).toBe("Work");
+    });
+
     it("should return 404 for non-existent checklist", async () => {
       mockGetListById.mockResolvedValue(null);
 
diff --git a/tests/api/contracts.test.ts b/tests/api/contracts.test.ts
new file mode 100644
index 000000000..513103283
--- /dev/null
+++ b/tests/api/contracts.test.ts
@@ -0,0 +1,78 @@
+import { describe, it, expect } from "vitest";
+import fs from "fs";
+import path from "path";
+import { ROUTE_MODULES } from "@/app/_server/api/route-index";
+import { buildSpec, contractsOf, isApiHandler } from "@/app/_server/api/openapi";
+import { apiNames } from "@/app/_schemas/api/names";
+import { z } from "zod";
+
+const API_DIR = path.join(process.cwd(), "app", "api");
+const INDEX_FILE = path.join(process.cwd(), "app", "_server", "api", "route-index.ts");
+const DEFINES = /define(Public)?Route\(/;
+
+const routeFiles = (dir: string): string[] =>
+  fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) return routeFiles(full);
+    return entry.name === "route.ts" ? [full] : [];
+  });
+
+const contractPath = (file: string) =>
+  "/" +
+  path
+    .relative(API_DIR, path.dirname(file))
+    .split(path.sep)
+    .map((segment) => segment.replace(/^\[(.+)\]$/, "{$1}"))
+    .join("/");
+
+const contracted = routeFiles(API_DIR).filter((file) =>
+  DEFINES.test(fs.readFileSync(file, "utf8")),
+);
+
+describe("API route contracts", () => {
+  it("lists every contracted route in the route index", () => {
+    const index = fs.readFileSync(INDEX_FILE, "utf8");
+    const missing = contracted
+      .map((file) => `@/app/api/${path.relative(API_DIR, path.dirname(file)).split(path.sep).join("/")}/route`)
+      .filter((spec) => !index.includes(`"${spec}"`));
+    expect(missing).toEqual([]);
+  });
+
+  it.each(contracted.map((file) => [path.relative(API_DIR, file), file]))(
+    "%s declares its own path and method",
+    async (_label, file) => {
+      const mod = await import(file);
+      const handlers = Object.entries(mod).filter(([, value]) => isApiHandler(value));
+      expect(handlers.length).toBeGreaterThan(0);
+      handlers.forEach(([name, handler]) => {
+        if (!isApiHandler(handler)) return;
+        expect(handler.contract.path).toBe(contractPath(file));
+        expect(handler.contract.method.toUpperCase()).toBe(name);
+      });
+    },
+  );
+
+  it("uses unique operation ids", () => {
+    const ids = contractsOf(ROUTE_MODULES).map((contract) => contract.id);
+    expect(ids.length).toBe(new Set(ids).size);
+  });
+
+  it("builds an OpenAPI document with every contract", () => {
+    const contracts = contractsOf(ROUTE_MODULES);
+    const spec = buildSpec(contracts, { origin: "http://localhost:3000", version: "test" });
+    const operations = Object.values(spec.paths).flatMap((ops) => Object.keys(ops));
+    expect(operations.length).toBe(contracts.length);
+    expect(JSON.stringify(spec)).not.toContain("#/$defs/");
+  });
+
+  it("lets a reloaded schema module register the same id again", () => {
+    const first = z.object({ a: z.string() });
+    const second = z.object({ b: z.string().describe("reloaded") });
+    expect(() => {
+      first.register(apiNames, { id: "Reloaded" });
+      second.register(apiNames, { id: "Reloaded" });
+    }).not.toThrow();
+    expect(apiNames.get(second)).toMatchObject({ id: "Reloaded" });
+    expect(apiNames.get(first)).toBeUndefined();
+  });
+});
diff --git a/tests/api/define-route.test.ts b/tests/api/define-route.test.ts
new file mode 100644
index 000000000..74f36b9dd
--- /dev/null
+++ b/tests/api/define-route.test.ts
@@ -0,0 +1,127 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { NextRequest } from "next/server";
+import { z } from "zod";
+import {
+  mockAuthenticateApiKey,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup";
+import { defineRoute, definePublicRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+
+const handler = vi.fn();
+
+const route = defineRoute(
+  {
+    id: "probe",
+    method: HttpMethod.POST,
+    path: "/probe/{probeId}",
+    tag: ApiTag.SYSTEM,
+    summary: "Probe",
+    params: z.object({ probeId: z.string() }),
+    query: z.object({ loud: z.enum(["yes", "no"]).optional() }),
+    body: z.object({ title: z.string({ error: "Title is required" }) }),
+    responses: {},
+  },
+  async (input) => {
+    handler(input);
+    return Response.json({ ok: true });
+  },
+);
+
+const call = (body: unknown, url = "http://localhost:3000/api/probe/p1") =>
+  route(createMockRequest("POST", url, body), {
+    params: Promise.resolve({ probeId: "p1" }),
+  });
+
+describe("defineRoute", () => {
+  beforeEach(() => {
+    resetApiMocks();
+    handler.mockReset();
+    mockAuthenticateApiKey.mockResolvedValue({
+      username: "testuser",
+      isAdmin: false,
+      passwordHash: "hash",
+      apiKey: "secret",
+      mfaSecret: "totp",
+    });
+  });
+
+  it("refuses a missing or wrong API key before parsing anything", async () => {
+    mockAuthenticateApiKey.mockResolvedValue(null);
+    const response = await call({});
+    expect(response.status).toBe(401);
+    expect((await getResponseJson(response)).error).toBe("Unauthorized");
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("hands the handler a sanitised user and parsed input", async () => {
+    const response = await call({ title: "Milk" }, "http://localhost:3000/api/probe/p1?loud=yes");
+    expect(response.status).toBe(200);
+    const input = handler.mock.calls[0][0];
+    expect(input.user.username).toBe("testuser");
+    expect(input.user).not.toHaveProperty("passwordHash");
+    expect(input.user).not.toHaveProperty("apiKey");
+    expect(input.user).not.toHaveProperty("mfaSecret");
+    expect(input.params).toEqual({ probeId: "p1" });
+    expect(input.query).toEqual({ loud: "yes" });
+    expect(input.body).toEqual({ title: "Milk" });
+  });
+
+  it("returns 400 with the first issue as the error message", async () => {
+    const response = await call({});
+    const data = await getResponseJson(response);
+    expect(response.status).toBe(400);
+    expect(data.error).toBe("Title is required");
+    expect(data.details[0].path).toEqual(["title"]);
+  });
+
+  it("returns 400 for a bad query value", async () => {
+    const response = await call({ title: "x" }, "http://localhost:3000/api/probe/p1?loud=maybe");
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 400 when the body is not JSON", async () => {
+    const broken = new NextRequest("http://localhost:3000/api/probe/p1", {
+      method: "POST",
+      headers: { "x-api-key": "test-api-key" },
+      body: "{nope",
+    });
+    const response = await route(broken, {
+      params: Promise.resolve({ probeId: "p1" }),
+    });
+    expect(response.status).toBe(400);
+    expect((await getResponseJson(response)).error).toBe("Request body must be valid JSON");
+  });
+
+  it("hides thrown errors behind a generic 500", async () => {
+    handler.mockImplementation(() => {
+      throw new Error("/secret/path/on/disk");
+    });
+    const response = await call({ title: "x" });
+    expect(response.status).toBe(500);
+    expect((await getResponseJson(response)).error).toBe("Internal server error");
+  });
+});
+
+describe("definePublicRoute", () => {
+  it("runs without an API key", async () => {
+    resetApiMocks();
+    const open = definePublicRoute(
+      {
+        id: "open",
+        method: HttpMethod.GET,
+        path: "/open",
+        tag: ApiTag.SYSTEM,
+        summary: "Open",
+        responses: {},
+      },
+      async ({ user }) => Response.json({ user }),
+    );
+    const response = await open(createMockRequest("GET", "http://localhost:3000/api/open", undefined, { "x-api-key": "" }));
+    expect(response.status).toBe(200);
+    expect(mockAuthenticateApiKey).not.toHaveBeenCalled();
+    expect(open.contract.auth).toBe("public");
+  });
+});
diff --git a/tests/api/discovery.test.ts b/tests/api/discovery.test.ts
new file mode 100644
index 000000000..015d7566a
--- /dev/null
+++ b/tests/api/discovery.test.ts
@@ -0,0 +1,143 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  mockFindUserRecord,
+  mockGetAppSettings,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup";
+
+const mockGrepSearch = vi.fn();
+const mockGrepFrontmatter = vi.fn();
+
+vi.mock("@/app/_utils/grep-utils", () => ({
+  grepSearchContent: (...args: unknown[]) => mockGrepSearch(...args),
+  grepExtractFrontmatter: (...args: unknown[]) => mockGrepFrontmatter(...args),
+}));
+
+import { GET as SEARCH } from "@/app/api/search/route";
+import { GET as CURRENT_USER } from "@/app/api/user/route";
+import { POST as REQUEST_EXPORT } from "@/app/api/exports/route";
+import { buildSpec, contractsOf } from "@/app/_server/api/openapi";
+import * as categories from "@/app/api/categories/route";
+import * as search from "@/app/api/search/route";
+import * as summary from "@/app/api/summary/route";
+import * as currentUser from "@/app/api/user/route";
+import * as user from "@/app/api/user/[username]/route";
+import * as exportsRoute from "@/app/api/exports/route";
+import * as exportFile from "@/app/api/exports/[filename]/route";
+import * as logs from "@/app/api/logs/route";
+import * as logStats from "@/app/api/logs/stats/route";
+import * as logExport from "@/app/api/logs/export/route";
+import * as logCleanup from "@/app/api/logs/cleanup/route";
+import * as rebuild from "@/app/api/admin/rebuild-index/route";
+
+const TOO_SHORT = "Query must be at least 2 characters";
+
+const find = (query: string) => SEARCH(createMockRequest("GET", `http://localhost:3000/api/search${query}`));
+
+describe("Discovery, user and export contracts", () => {
+  beforeEach(() => {
+    resetApiMocks();
+    mockAuthenticateApiKey.mockResolvedValue(mockUser);
+    mockGrepSearch.mockReset().mockResolvedValue([]);
+    mockGrepFrontmatter.mockReset().mockResolvedValue(null);
+  });
+
+  describe("GET /api/search", () => {
+    it("keeps the old message when q is missing or too short", async () => {
+      for (const query of ["", "?q=a", "?q=%20%20a%20"]) {
+        const response = await find(query);
+        expect(response.status).toBe(400);
+        expect((await getResponseJson(response)).error).toBe(TOO_SHORT);
+      }
+      expect(mockGrepSearch).not.toHaveBeenCalled();
+    });
+
+    it("rejects a type that is neither note nor checklist", async () => {
+      expect((await find("?q=milk&type=kanban")).status).toBe(400);
+    });
+
+    it("only greps notes when asked for notes", async () => {
+      mockGrepSearch.mockResolvedValue([
+        { filePath: "data/notes/testuser/Food/milk.md", id: "milk", category: "Food", matchLine: "# Milk" },
+      ]);
+      mockGrepFrontmatter.mockResolvedValue({ title: "Milk", uuid: "n-1" });
+
+      const data = await getResponseJson(await find("?q=milk&type=note"));
+
+      expect(mockGrepSearch).toHaveBeenCalledTimes(1);
+      expect(data).toEqual({
+        query: "milk",
+        results: [{ id: "milk", uuid: "n-1", type: "note", title: "Milk", category: "Food" }],
+        total: 1,
+      });
+    });
+
+    it("logs and survives a failing grep", async () => {
+      const spy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+      mockGrepSearch.mockRejectedValue(new Error("boom"));
+
+      const response = await find("?q=milk");
+
+      expect(response.status).toBe(200);
+      expect((await getResponseJson(response)).total).toBe(0);
+      expect(spy).toHaveBeenCalled();
+      spy.mockRestore();
+    });
+  });
+
+  describe("GET /api/user", () => {
+    it("returns your profile without any secret", async () => {
+      mockAuthenticateApiKey.mockResolvedValue({
+        ...mockUser,
+        passwordHash: "hash",
+        apiKey: "key",
+        mfaSecret: "totp",
+        mfaRecoveryCode: "recovery",
+        lastLogin: "2026-09-01T00:00:00.000Z",
+      });
+      mockFindUserRecord.mockResolvedValue({ ...mockUser, lastLogin: "2026-09-01T00:00:00.000Z" });
+
+      const response = await CURRENT_USER(createMockRequest("GET", "http://localhost:3000/api/user"));
+      const data = await getResponseJson(response);
+
+      expect(response.status).toBe(200);
+      expect(data.user.username).toBe("testuser");
+      expect(data.user.lastLogin).toBe("2026-09-01T00:00:00.000Z");
+      ["passwordHash", "apiKey", "mfaSecret", "mfaRecoveryCode"].forEach((secret) =>
+        expect(data.user).not.toHaveProperty(secret),
+      );
+    });
+  });
+
+  describe("POST /api/exports", () => {
+    it("treats an empty type as missing", async () => {
+      mockGetAppSettings.mockResolvedValue({ success: true, data: { adminContentAccess: "yes" } });
+
+      const response = await REQUEST_EXPORT(
+        createMockRequest("POST", "http://localhost:3000/api/exports", { type: "" }),
+      );
+
+      expect(response.status).toBe(400);
+      expect((await getResponseJson(response)).error).toBe("Export type is required");
+    });
+  });
+
+  it("builds an OpenAPI document for every migrated route", () => {
+    const contracts = contractsOf([
+      categories, search, summary, currentUser, user, exportsRoute, exportFile,
+      logs, logStats, logExport, logCleanup, rebuild,
+    ]);
+    const spec = buildSpec(contracts, { origin: "http://localhost:3000", version: "test" });
+
+    expect(contracts).toHaveLength(13);
+    expect(Object.keys(spec.paths)).toContain("/exports/{filename}");
+    expect(spec.paths["/exports/{filename}"].get).toMatchObject({
+      responses: { 200: { content: { "application/zip": { schema: { type: "string", format: "binary" } } } } },
+    });
+    expect(JSON.stringify(spec)).not.toContain("#/$defs/");
+  });
+});
diff --git a/tests/api/edit-guards.test.ts b/tests/api/edit-guards.test.ts
new file mode 100644
index 000000000..beb55637d
--- /dev/null
+++ b/tests/api/edit-guards.test.ts
@@ -0,0 +1,58 @@
+import { describe, it, expect, beforeEach } from "vitest"
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  mockGetListById,
+  mockCanReach,
+  mockEditItem,
+  mockStampStatus,
+  resetApiMocks,
+  createMockRequest,
+} from "./setup"
+import { PermissionTypes } from "@/app/_types/enums"
+import { PUT as CHECK } from "@/app/api/checklists/[listId]/items/[itemIndex]/check/route"
+import { PUT as UNCHECK } from "@/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route"
+import { PATCH } from "@/app/api/checklists/[listId]/items/[itemIndex]/route"
+import { PUT as MOVE_STATUS } from "@/app/api/tasks/[taskId]/items/[itemIndex]/status/route"
+
+const list = {
+  uuid: "uuid-1",
+  title: "Shopping",
+  type: "task",
+  owner: "someoneelse",
+  items: [{ id: "item-1", text: "Milk", completed: false, order: 0 }],
+}
+
+const listParams = { params: Promise.resolve({ listId: "uuid-1", itemIndex: "0" }) }
+const taskParams = { params: Promise.resolve({ taskId: "uuid-1", itemIndex: "0" }) }
+const url = "http://localhost:3000/api/checklists/uuid-1/items/0"
+
+describe("read-only collaborators", () => {
+  beforeEach(() => {
+    resetApiMocks()
+    mockAuthenticateApiKey.mockResolvedValue(mockUser)
+    mockGetListById.mockResolvedValue(list)
+    mockCanReach.mockImplementation(async (_uuid: string, _type: string, _user: string, permission: PermissionTypes) =>
+      permission === PermissionTypes.READ,
+    )
+  })
+
+  it.each([
+    ["check", () => CHECK(createMockRequest("PUT", `${url}/check`), listParams)],
+    ["uncheck", () => UNCHECK(createMockRequest("PUT", `${url}/uncheck`), listParams)],
+    ["update", () => PATCH(createMockRequest("PATCH", url, { text: "Oat milk" }), listParams)],
+  ])("get 403 on %s and nothing is written", async (_label, call) => {
+    const response = await call()
+    expect(response.status).toBe(403)
+    expect(mockEditItem).not.toHaveBeenCalled()
+  })
+
+  it("get 403 moving a task item and nothing is written", async () => {
+    const response = await MOVE_STATUS(
+      createMockRequest("PUT", "http://localhost:3000/api/tasks/uuid-1/items/0/status", { status: "completed" }),
+      taskParams,
+    )
+    expect(response.status).toBe(403)
+    expect(mockStampStatus).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/api/exports.test.ts b/tests/api/exports.test.ts
index 2291a7d10..996b4f84a 100644
--- a/tests/api/exports.test.ts
+++ b/tests/api/exports.test.ts
@@ -156,13 +156,9 @@ describe("Exports API", () => {
   })
 
   describe("POST /api/exports (all_users_data)", () => {
-    it("should export all users data for admin", async () => {
+    it("keeps it behind a browser session even for an admin key", async () => {
       mockAuthenticateApiKey.mockResolvedValue(adminUser)
       mockGetAppSettings.mockResolvedValue(mockAppSettings)
-      mockExportAllUsersData.mockResolvedValue({
-        success: true,
-        downloadUrl: "/api/exports/all_users_data_123.zip",
-      })
 
       const request = createMockRequest("POST", "http://localhost:3000/api/exports", {
         type: "all_users_data",
@@ -170,9 +166,9 @@ describe("Exports API", () => {
       const response = await POST(request, { params: Promise.resolve({}) })
       const data = await getResponseJson(response)
 
-      expect(response.status).toBe(200)
-      expect(data.success).toBe(true)
-      expect(data.downloadUrl).toBeDefined()
+      expect(response.status).toBe(403)
+      expect(data.error).toContain("admin page")
+      expect(mockExportAllUsersData).not.toHaveBeenCalled()
     })
 
     it("should return 403 for non-admin users", async () => {
@@ -203,13 +199,9 @@ describe("Exports API", () => {
   })
 
   describe("POST /api/exports (whole_data_folder)", () => {
-    it("should export whole data folder for admin", async () => {
+    it("keeps it behind a browser session even for an admin key", async () => {
       mockAuthenticateApiKey.mockResolvedValue(adminUser)
       mockGetAppSettings.mockResolvedValue(mockAppSettings)
-      mockExportWholeDataFolder.mockResolvedValue({
-        success: true,
-        downloadUrl: "/api/exports/whole_data_folder_123.zip",
-      })
 
       const request = createMockRequest("POST", "http://localhost:3000/api/exports", {
         type: "whole_data_folder",
@@ -217,9 +209,9 @@ describe("Exports API", () => {
       const response = await POST(request, { params: Promise.resolve({}) })
       const data = await getResponseJson(response)
 
-      expect(response.status).toBe(200)
-      expect(data.success).toBe(true)
-      expect(data.downloadUrl).toBeDefined()
+      expect(response.status).toBe(403)
+      expect(data.error).toContain("admin page")
+      expect(mockExportWholeDataFolder).not.toHaveBeenCalled()
     })
 
     it("should return 403 for non-admin users", async () => {
@@ -297,7 +289,7 @@ describe("Exports API", () => {
 
   describe("GET /api/exports (progress)", () => {
     it("should return export progress", async () => {
-      mockGetExportProgress.mockResolvedValue({
+      mockGetExportProgress.mockReturnValue({
         progress: 50,
         message: "Processing files...",
       })
@@ -321,4 +313,33 @@ describe("Exports API", () => {
       expect(data.error).toBe("Unauthorized")
     })
   })
+
+  describe("admin content access turned off", () => {
+    const locked = { success: true, data: { adminContentAccess: "no" } }
+
+    it("refuses an admin key the all content export", async () => {
+      mockAuthenticateApiKey.mockResolvedValue(adminUser)
+      mockGetAppSettings.mockResolvedValue(locked)
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/exports", { type: "all_checklists_notes" })
+      const response = await POST(request, { params: Promise.resolve({}) })
+
+      expect(response.status).toBe(403)
+      expect(mockExportAllChecklistsNotes).not.toHaveBeenCalled()
+    })
+
+    it("refuses an admin key somebody else's export", async () => {
+      mockAuthenticateApiKey.mockResolvedValue(adminUser)
+      mockGetAppSettings.mockResolvedValue(locked)
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/exports", {
+        type: "user_checklists_notes",
+        username: "someoneelse",
+      })
+      const response = await POST(request, { params: Promise.resolve({}) })
+
+      expect(response.status).toBe(403)
+      expect(mockExportUserChecklistsNotes).not.toHaveBeenCalled()
+    })
+  })
 })
diff --git a/tests/api/items.test.ts b/tests/api/items.test.ts
index c77855337..b61d82f4c 100644
--- a/tests/api/items.test.ts
+++ b/tests/api/items.test.ts
@@ -1,4 +1,6 @@
 import { describe, it, expect, beforeEach } from "vitest"
+import { NextRequest } from "next/server"
+import { ItemTypes, PermissionTypes } from "@/app/_types/enums"
 import {
   mockUser,
   mockAuthenticateApiKey,
@@ -6,6 +8,8 @@ import {
   mockAddItem,
   mockEditItem,
   mockServerWriteFile,
+  mockCanReach,
+  mockRemoveItem,
   resetApiMocks,
   createMockRequest,
   getResponseJson,
@@ -15,6 +19,7 @@ import { POST } from "@/app/api/checklists/[listId]/items/route"
 import { PUT as CHECK } from "@/app/api/checklists/[listId]/items/[itemIndex]/check/route"
 import { PUT as UNCHECK } from "@/app/api/checklists/[listId]/items/[itemIndex]/uncheck/route"
 import { DELETE, PATCH } from "@/app/api/checklists/[listId]/items/[itemIndex]/route"
+import { PUT as REORDER } from "@/app/api/checklists/[listId]/items/reorder/route"
 
 describe("Checklist Items API", () => {
   const mockList = {
@@ -408,4 +413,141 @@ describe("Checklist Items API", () => {
       expect(data.error).toBe("Unauthorized")
     })
   })
+
+  describe("PATCH /api/checklists/:id/items/:index validation", () => {
+    const patch = (body: unknown) =>
+      PATCH(createMockRequest("PATCH", "http://localhost:3000/api/checklists/uuid-1/items/0", body), {
+        params: Promise.resolve({ listId: "uuid-1", itemIndex: "0" }),
+      })
+
+    it.each([
+      [{ text: 5 }, "'text' must be a string"],
+      [{ text: null }, "'text' must be a string"],
+      [{ description: 1 }, "'description' must be a string"],
+      [{ score: "5" }, "'score' must be a number"],
+      [{ startDate: 20260610 }, "'startDate' must be a string"],
+      [{ targetDate: true }, "'targetDate' must be a string"],
+      [{ estimatedTime: "2h" }, "'estimatedTime' must be a number"],
+      [{ unknown: "field" }, "Provide at least one field to update"],
+    ])("refuses %j with %s", async (body, message) => {
+      const response = await patch(body)
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe(message)
+      expect(mockEditItem).not.toHaveBeenCalled()
+    })
+
+    it("clears fields sent as null", async () => {
+      mockGetListById.mockResolvedValue({ ...mockList, type: "kanban" })
+      mockEditItem.mockResolvedValue({ success: true })
+
+      const response = await patch({ description: null, priority: null, score: null, estimatedTime: null })
+
+      expect(response.status).toBe(200)
+      const formData = mockEditItem.mock.calls[0][2] as FormData
+      expect(formData.get("description")).toBe("")
+      expect(formData.get("priority")).toBe("")
+      expect(formData.get("score")).toBe("")
+      expect(formData.get("estimatedTime")).toBe("")
+      expect(formData.has("text")).toBe(false)
+    })
+
+    it("refuses a body that is not JSON", async () => {
+      const request = new NextRequest(new URL("http://localhost:3000/api/checklists/uuid-1/items/0"), {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json", "x-api-key": "test-api-key" },
+        body: "{not json",
+      })
+      const response = await PATCH(request, { params: Promise.resolve({ listId: "uuid-1", itemIndex: "0" }) })
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Request body must be valid JSON")
+    })
+
+    it("returns 400 for a malformed item index", async () => {
+      mockGetListById.mockResolvedValue(mockList)
+
+      const response = await PATCH(
+        createMockRequest("PATCH", "http://localhost:3000/api/checklists/uuid-1/items/0.x", { text: "Milk" }),
+        { params: Promise.resolve({ listId: "uuid-1", itemIndex: "0.x" }) },
+      )
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Invalid item index")
+    })
+  })
+
+  describe("DELETE /api/checklists/:id/items/:index permissions", () => {
+    it("refuses a user without the delete grant", async () => {
+      mockGetListById.mockResolvedValue(mockList)
+      mockCanReach.mockResolvedValue(false)
+
+      const response = await DELETE(
+        createMockRequest("DELETE", "http://localhost:3000/api/checklists/uuid-1/items/1"),
+        { params: Promise.resolve({ listId: "uuid-1", itemIndex: "1" }) },
+      )
+
+      expect(response.status).toBe(403)
+      expect(mockCanReach).toHaveBeenCalledWith("uuid-1", ItemTypes.CHECKLIST, "testuser", PermissionTypes.DELETE)
+      expect(mockRemoveItem).not.toHaveBeenCalled()
+    })
+  })
+
+  describe("PUT /api/checklists/:id/items/reorder", () => {
+    const reorder = (body: unknown) =>
+      REORDER(createMockRequest("PUT", "http://localhost:3000/api/checklists/uuid-1/items/reorder", body), {
+        params: Promise.resolve({ listId: "uuid-1" }),
+      })
+
+    it.each([
+      [{ overItemId: "item-2" }, "'activeItemId' and 'overItemId' are required"],
+      [{ activeItemId: "item-2", overItemId: "" }, "'activeItemId' and 'overItemId' are required"],
+      [{ activeItemId: "item-2", overItemId: "item-1", position: "middle" }, "'position' must be 'before' or 'after'"],
+    ])("refuses %j with %s", async (body, message) => {
+      const response = await reorder(body)
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe(message)
+      expect(mockGetListById).not.toHaveBeenCalled()
+    })
+
+    it("returns 404 when the list is not visible", async () => {
+      mockGetListById.mockResolvedValue(undefined)
+
+      const response = await reorder({ activeItemId: "item-2", overItemId: "item-1" })
+
+      expect(response.status).toBe(404)
+      expect((await getResponseJson(response)).error).toBe("List not found")
+    })
+
+    it("refuses a user without the edit grant", async () => {
+      mockGetListById.mockResolvedValue(mockList)
+      mockCanReach.mockResolvedValue(false)
+
+      const response = await reorder({ activeItemId: "item-2", overItemId: "item-1" })
+
+      expect(response.status).toBe(403)
+      expect(mockCanReach).toHaveBeenCalledWith("uuid-1", ItemTypes.CHECKLIST, "testuser", PermissionTypes.EDIT)
+      expect(mockServerWriteFile).not.toHaveBeenCalled()
+    })
+
+    it("does nothing when an item is dropped into its own descendant", async () => {
+      mockGetListById.mockResolvedValue(mockList)
+
+      const response = await reorder({ activeItemId: "item-1", overItemId: "item-1-1-1", isDropInto: true })
+
+      expect(response.status).toBe(200)
+      expect(await getResponseJson(response)).toEqual({ success: true })
+      expect(mockServerWriteFile).not.toHaveBeenCalled()
+    })
+
+    it("returns 404 for an unknown item", async () => {
+      mockGetListById.mockResolvedValue(mockList)
+
+      const response = await reorder({ activeItemId: "ghost", overItemId: "item-1" })
+
+      expect(response.status).toBe(404)
+      expect((await getResponseJson(response)).error).toBe("Item not found")
+    })
+  })
 })
diff --git a/tests/api/kanban.test.ts b/tests/api/kanban.test.ts
new file mode 100644
index 000000000..0354cbaac
--- /dev/null
+++ b/tests/api/kanban.test.ts
@@ -0,0 +1,601 @@
+import { describe, it, expect, beforeEach } from "vitest"
+import { NextRequest } from "next/server"
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  mockGetUserChecklists,
+  mockMakeList,
+  mockEditList,
+  mockDropList,
+  mockGetListById,
+  mockAddItem,
+  mockEditItem,
+  mockRemoveItem,
+  mockStampStatus,
+  mockRestatus,
+  mockAssignItem,
+  mockRemindItem,
+  mockResolveApiId,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup"
+
+import { GET as LIST_BOARDS, POST as CREATE_BOARD } from "@/app/api/kanban/route"
+import { GET as GET_BOARD, PUT as UPDATE_BOARD, DELETE as DELETE_BOARD } from "@/app/api/kanban/[boardId]/route"
+import { PUT as SET_STATUSES } from "@/app/api/kanban/[boardId]/statuses/route"
+import { GET as GET_CALENDAR } from "@/app/api/kanban/[boardId]/calendar/route"
+import { POST as CREATE_CARD } from "@/app/api/kanban/[boardId]/items/route"
+import { PUT as UPDATE_CARD, DELETE as DELETE_CARD } from "@/app/api/kanban/[boardId]/items/[itemId]/route"
+import { PUT as MOVE_CARD } from "@/app/api/kanban/[boardId]/items/[itemId]/status/route"
+import { PUT as ASSIGN_CARD } from "@/app/api/kanban/[boardId]/items/[itemId]/assign/route"
+import { PUT as SET_REMINDER, DELETE as CLEAR_REMINDER } from "@/app/api/kanban/[boardId]/items/[itemId]/reminder/route"
+
+const BOARD_UUID = "4f1c2b3a-5d6e-4f70-8a9b-0c1d2e3f4a5b"
+const BASE = "http://localhost:3000/api/kanban"
+const DENIED = "Permission denied"
+
+const board = (overrides: Record<string, unknown> = {}) => ({
+  id: "sprint",
+  uuid: BOARD_UUID,
+  title: "Sprint",
+  category: "Work",
+  type: "kanban",
+  owner: mockUser.username,
+  statuses: [
+    { id: "todo", label: "To Do", order: 0 },
+    { id: "done", label: "Done", order: 1, autoComplete: true },
+  ],
+  items: [
+    {
+      id: "card-1",
+      text: "Write tests",
+      completed: false,
+      order: 0,
+      status: "todo",
+      priority: "high",
+      targetDate: "2030-01-10",
+    },
+  ],
+  createdAt: "2024-01-01T00:00:00.000Z",
+  updatedAt: "2024-01-02T00:00:00.000Z",
+  ...overrides,
+})
+
+const boardParams = (boardId = BOARD_UUID) => ({ params: Promise.resolve({ boardId }) })
+const cardParams = (itemId = "card-1") => ({ params: Promise.resolve({ boardId: BOARD_UUID, itemId }) })
+
+const rawRequest = (method: string, url: string, body: string) =>
+  new NextRequest(new URL(url), {
+    method,
+    headers: { "Content-Type": "application/json", "x-api-key": "test-api-key" },
+    body,
+  })
+
+describe("Kanban API", () => {
+  beforeEach(() => {
+    resetApiMocks()
+    mockAuthenticateApiKey.mockResolvedValue(mockUser)
+    mockGetListById.mockResolvedValue(board())
+  })
+
+  describe("GET /api/kanban", () => {
+    it("lists only the owner's kanban boards, trimmed", async () => {
+      mockGetUserChecklists.mockResolvedValue({
+        success: true,
+        data: [
+          board(),
+          board({ uuid: "legacy", type: "task", title: "Legacy" }),
+          board({ uuid: "groceries", type: "simple" }),
+          board({ uuid: "shared", owner: "someone-else" }),
+        ],
+      })
+
+      const response = await LIST_BOARDS(createMockRequest("GET", BASE))
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(200)
+      expect(data.boards.map((b: { id: string }) => b.id)).toEqual([BOARD_UUID, "legacy"])
+      expect(data.boards[0]).toEqual({
+        id: BOARD_UUID,
+        title: "Sprint",
+        category: "Work",
+        statuses: board().statuses,
+        items: [
+          {
+            id: "card-1",
+            index: 0,
+            text: "Write tests",
+            status: "todo",
+            completed: false,
+            priority: "high",
+          },
+        ],
+        createdAt: "2024-01-01T00:00:00.000Z",
+        updatedAt: "2024-01-02T00:00:00.000Z",
+      })
+    })
+
+    it("filters by category, status and text", async () => {
+      mockGetUserChecklists.mockResolvedValue({
+        success: true,
+        data: [board(), board({ uuid: "other", title: "Other", category: "Home", items: [] })],
+      })
+
+      const byStatus = await getResponseJson(await LIST_BOARDS(createMockRequest("GET", `${BASE}?status=todo`)))
+      const byText = await getResponseJson(await LIST_BOARDS(createMockRequest("GET", `${BASE}?q=WRITE`)))
+      const byCategory = await getResponseJson(await LIST_BOARDS(createMockRequest("GET", `${BASE}?category=Home`)))
+
+      expect(byStatus.boards.map((b: { id: string }) => b.id)).toEqual([BOARD_UUID])
+      expect(byText.boards.map((b: { id: string }) => b.id)).toEqual([BOARD_UUID])
+      expect(byCategory.boards.map((b: { id: string }) => b.id)).toEqual(["other"])
+    })
+
+    it("returns 401 without a valid key", async () => {
+      mockAuthenticateApiKey.mockResolvedValue(null)
+
+      const response = await LIST_BOARDS(createMockRequest("GET", BASE))
+
+      expect(response.status).toBe(401)
+      expect(await getResponseJson(response)).toEqual({ error: "Unauthorized" })
+    })
+
+    it("returns 500 when the lists cannot be read", async () => {
+      mockGetUserChecklists.mockResolvedValue({ success: false, error: "Disk on fire" })
+
+      const response = await LIST_BOARDS(createMockRequest("GET", BASE))
+
+      expect(response.status).toBe(500)
+      expect((await getResponseJson(response)).error).toBe("Disk on fire")
+    })
+  })
+
+  describe("POST /api/kanban", () => {
+    it("creates a kanban board in Uncategorized by default", async () => {
+      mockMakeList.mockResolvedValue({ success: true, data: board({ category: "Uncategorized", items: [] }) })
+
+      const response = await CREATE_BOARD(createMockRequest("POST", BASE, { title: "Sprint" }))
+      const data = await getResponseJson(response)
+      const formData: FormData = mockMakeList.mock.calls[0][1]
+
+      expect(response.status).toBe(200)
+      expect(data.success).toBe(true)
+      expect(data.data.id).toBe(BOARD_UUID)
+      expect(formData.get("type")).toBe("kanban")
+      expect(formData.get("category")).toBe("Uncategorized")
+    })
+
+    it("hands custom columns to makeList so they are written with the board", async () => {
+      const columns = [{ id: "backlog", label: "Backlog", order: 0 }]
+      mockMakeList.mockResolvedValue({ success: true, data: board({ statuses: columns }) })
+
+      const response = await CREATE_BOARD(createMockRequest("POST", BASE, { title: "Sprint", statuses: columns }))
+
+      expect(response.status).toBe(200)
+      expect(mockMakeList.mock.calls[0][2]).toEqual(columns)
+    })
+
+    it("keeps the exact message for a missing title", async () => {
+      const response = await CREATE_BOARD(createMockRequest("POST", BASE, { category: "Work" }))
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Title is required")
+      expect(mockMakeList).not.toHaveBeenCalled()
+    })
+
+    it("answers 400 to a body that is not JSON", async () => {
+      const response = await CREATE_BOARD(rawRequest("POST", BASE, "{nope"))
+
+      expect(response.status).toBe(400)
+      expect(mockMakeList).not.toHaveBeenCalled()
+    })
+
+    it("passes a folder refusal through as 400", async () => {
+      mockMakeList.mockResolvedValue({ error: "You can't create items here" })
+
+      const response = await CREATE_BOARD(createMockRequest("POST", BASE, { title: "Sprint", category: "Shared" }))
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("You can't create items here")
+    })
+  })
+
+  describe("GET /api/kanban/:boardId", () => {
+    it("returns the trimmed board", async () => {
+      const response = await GET_BOARD(createMockRequest("GET", `${BASE}/${BOARD_UUID}`), boardParams())
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(200)
+      expect(data.board.id).toBe(BOARD_UUID)
+      expect(data.board.items[0].index).toBe(0)
+      expect(mockGetListById).toHaveBeenCalledWith(BOARD_UUID, mockUser.username)
+    })
+
+    it("returns 404 for a board the key owner cannot see", async () => {
+      mockGetListById.mockResolvedValue(undefined)
+
+      const response = await GET_BOARD(createMockRequest("GET", `${BASE}/${BOARD_UUID}`), boardParams())
+
+      expect(response.status).toBe(404)
+      expect(await getResponseJson(response)).toEqual({ error: "Board not found" })
+    })
+
+    it("returns 400 for a plain checklist", async () => {
+      mockGetListById.mockResolvedValue(board({ type: "simple" }))
+
+      const response = await GET_BOARD(createMockRequest("GET", `${BASE}/${BOARD_UUID}`), boardParams())
+
+      expect(response.status).toBe(400)
+      expect(await getResponseJson(response)).toEqual({ error: "Not a kanban board" })
+    })
+
+    it("still resolves a legacy slug through ?category=", async () => {
+      mockResolveApiId.mockResolvedValue(BOARD_UUID)
+
+      const response = await GET_BOARD(
+        createMockRequest("GET", `${BASE}/sprint?category=Work`),
+        boardParams("sprint"),
+      )
+
+      expect(response.status).toBe(200)
+      expect(mockResolveApiId).toHaveBeenCalledWith(expect.anything(), "sprint", "Work", mockUser.username)
+    })
+  })
+
+  describe("PUT /api/kanban/:boardId", () => {
+    it("keeps fields that were left out", async () => {
+      mockEditList.mockResolvedValue({ success: true, data: board({ title: "Renamed" }) })
+
+      const response = await UPDATE_BOARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}`, { title: "Renamed" }),
+        boardParams(),
+      )
+      const formData: FormData = mockEditList.mock.calls[0][1]
+
+      expect(response.status).toBe(200)
+      expect((await getResponseJson(response)).data.title).toBe("Renamed")
+      expect(formData.get("uuid")).toBe(BOARD_UUID)
+      expect(formData.get("category")).toBe("Work")
+    })
+
+    it("answers 400 when the action refuses the edit", async () => {
+      mockEditList.mockResolvedValue({ error: DENIED })
+
+      const response = await UPDATE_BOARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}`, { title: "Mine now" }),
+        boardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect(await getResponseJson(response)).toEqual({ error: DENIED })
+    })
+
+    it("rejects a non-string title", async () => {
+      const response = await UPDATE_BOARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}`, { title: 42 }),
+        boardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect(mockEditList).not.toHaveBeenCalled()
+    })
+  })
+
+  describe("DELETE /api/kanban/:boardId", () => {
+    it("deletes the board", async () => {
+      mockDropList.mockResolvedValue({ success: true })
+
+      const response = await DELETE_BOARD(createMockRequest("DELETE", `${BASE}/${BOARD_UUID}`), boardParams())
+
+      expect(response.status).toBe(200)
+      expect(await getResponseJson(response)).toEqual({ success: true })
+    })
+
+    it("answers 400 when the action refuses the delete", async () => {
+      mockDropList.mockResolvedValue({ error: DENIED })
+
+      const response = await DELETE_BOARD(createMockRequest("DELETE", `${BASE}/${BOARD_UUID}`), boardParams())
+
+      expect(response.status).toBe(400)
+      expect(await getResponseJson(response)).toEqual({ error: DENIED })
+    })
+
+    it("returns 404 before asking the action for a board that cannot be seen", async () => {
+      mockGetListById.mockResolvedValue(undefined)
+
+      const response = await DELETE_BOARD(createMockRequest("DELETE", `${BASE}/${BOARD_UUID}`), boardParams())
+
+      expect(response.status).toBe(404)
+      expect(mockDropList).not.toHaveBeenCalled()
+    })
+  })
+
+  describe("PUT /api/kanban/:boardId/statuses", () => {
+    const statuses = [{ id: "todo", label: "To Do", order: 0 }]
+
+    it("replaces the columns", async () => {
+      const response = await SET_STATUSES(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/statuses`, { statuses }),
+        boardParams(),
+      )
+
+      expect(response.status).toBe(200)
+      expect((await getResponseJson(response)).data.statuses).toEqual(statuses)
+      expect(mockRestatus.mock.calls[0][1]).toBe(BOARD_UUID)
+    })
+
+    it.each([[{}], [{ statuses: "todo" }]])("keeps the exact message for %j", async (body) => {
+      const response = await SET_STATUSES(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/statuses`, body),
+        boardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Statuses array is required")
+      expect(mockRestatus).not.toHaveBeenCalled()
+    })
+
+    it("answers 400 when the action refuses", async () => {
+      mockRestatus.mockResolvedValue({ success: false, error: DENIED })
+
+      const response = await SET_STATUSES(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/statuses`, { statuses }),
+        boardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect(await getResponseJson(response)).toEqual({ error: DENIED })
+    })
+  })
+
+  describe("GET /api/kanban/:boardId/calendar", () => {
+    it("returns events as JSON", async () => {
+      const response = await GET_CALENDAR(createMockRequest("GET", `${BASE}/${BOARD_UUID}/calendar`), boardParams())
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(200)
+      expect(data.events).toHaveLength(1)
+      expect(data.events[0]).toMatchObject({ id: "card-1", itemId: "card-1", endDate: "2030-01-10" })
+    })
+
+    it("returns an iCalendar file when asked", async () => {
+      const response = await GET_CALENDAR(
+        createMockRequest("GET", `${BASE}/${BOARD_UUID}/calendar`, undefined, { Accept: "text/calendar" }),
+        boardParams(),
+      )
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get("Content-Type")).toContain("text/calendar")
+      expect(await response.text()).toContain("BEGIN:VCALENDAR")
+    })
+
+    it("returns 404 for a board the key owner cannot see", async () => {
+      mockGetListById.mockResolvedValue(undefined)
+
+      const response = await GET_CALENDAR(createMockRequest("GET", `${BASE}/${BOARD_UUID}/calendar`), boardParams())
+
+      expect(response.status).toBe(404)
+    })
+  })
+
+  describe("POST /api/kanban/:boardId/items", () => {
+    it("adds a card", async () => {
+      mockAddItem.mockResolvedValue({ success: true, data: { id: "card-2", text: "Ship", completed: false, order: 0 } })
+
+      const response = await CREATE_CARD(
+        createMockRequest("POST", `${BASE}/${BOARD_UUID}/items`, { text: "Ship", status: "done" }),
+        boardParams(),
+      )
+      const formData: FormData = mockAddItem.mock.calls[0][2]
+
+      expect(response.status).toBe(200)
+      expect((await getResponseJson(response)).data.id).toBe("card-2")
+      expect(formData.get("status")).toBe("done")
+      expect(formData.get("description")).toBeNull()
+    })
+
+    it("keeps the exact message for missing text", async () => {
+      const response = await CREATE_CARD(
+        createMockRequest("POST", `${BASE}/${BOARD_UUID}/items`, { status: "todo" }),
+        boardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Text is required")
+    })
+
+    it("answers 400 when the action refuses", async () => {
+      mockAddItem.mockResolvedValue({ success: false, error: DENIED })
+
+      const response = await CREATE_CARD(
+        createMockRequest("POST", `${BASE}/${BOARD_UUID}/items`, { text: "Sneaky" }),
+        boardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect(await getResponseJson(response)).toEqual({ error: DENIED })
+    })
+  })
+
+  describe("PUT /api/kanban/:boardId/items/:itemId", () => {
+    it("forwards only the fields that were sent", async () => {
+      mockEditItem.mockResolvedValue({ success: true, data: board() })
+
+      const response = await UPDATE_CARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1`, {
+          priority: "low",
+          score: 3,
+          reminder: { datetime: "2030-01-01T09:00:00.000Z" },
+        }),
+        cardParams(),
+      )
+      const formData: FormData = mockEditItem.mock.calls[0][2]
+
+      expect(response.status).toBe(200)
+      expect(formData.get("itemId")).toBe("card-1")
+      expect(formData.get("priority")).toBe("low")
+      expect(formData.get("score")).toBe("3")
+      expect(JSON.parse(formData.get("reminder") as string)).toEqual({ datetime: "2030-01-01T09:00:00.000Z" })
+      expect(formData.has("text")).toBe(false)
+      expect(formData.has("assignee")).toBe(false)
+    })
+
+    it("accepts a legacy task-typed board", async () => {
+      mockGetListById.mockResolvedValue(board({ type: "task" }))
+      mockEditItem.mockResolvedValue({ success: true, data: board() })
+
+      const response = await UPDATE_CARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1`, { text: "Renamed" }),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(200)
+    })
+
+    it("rejects an unknown priority", async () => {
+      const response = await UPDATE_CARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1`, { priority: "urgent-ish" }),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect(mockEditItem).not.toHaveBeenCalled()
+    })
+
+    it("answers 400 when the action refuses", async () => {
+      mockEditItem.mockResolvedValue({ success: false, error: DENIED })
+
+      const response = await UPDATE_CARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1`, { text: "Mine" }),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect(await getResponseJson(response)).toEqual({ error: DENIED })
+    })
+  })
+
+  describe("DELETE /api/kanban/:boardId/items/:itemId", () => {
+    it("deletes the card", async () => {
+      const response = await DELETE_CARD(createMockRequest("DELETE", `${BASE}/${BOARD_UUID}/items/card-1`), cardParams())
+
+      expect(response.status).toBe(200)
+      expect(await getResponseJson(response)).toEqual({ success: true })
+      expect(mockRemoveItem).toHaveBeenCalledWith(expect.anything(), BOARD_UUID, "card-1")
+    })
+
+    it("answers 400 when the action refuses", async () => {
+      mockRemoveItem.mockResolvedValue({ success: false, error: DENIED })
+
+      const response = await DELETE_CARD(createMockRequest("DELETE", `${BASE}/${BOARD_UUID}/items/card-1`), cardParams())
+
+      expect(response.status).toBe(400)
+      expect(await getResponseJson(response)).toEqual({ error: DENIED })
+    })
+  })
+
+  describe("PUT /api/kanban/:boardId/items/:itemId/status", () => {
+    it("moves the card", async () => {
+      mockStampStatus.mockResolvedValue({ success: true, data: board() })
+
+      const response = await MOVE_CARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1/status`, { status: "done" }),
+        cardParams(),
+      )
+      const formData: FormData = mockStampStatus.mock.calls[0][1]
+
+      expect(response.status).toBe(200)
+      expect(formData.get("uuid")).toBe(BOARD_UUID)
+      expect(formData.get("status")).toBe("done")
+    })
+
+    it("keeps the exact message for a missing status", async () => {
+      const response = await MOVE_CARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1/status`, {}),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Status is required")
+    })
+  })
+
+  describe("PUT /api/kanban/:boardId/items/:itemId/assign", () => {
+    it("unassigns on a null assignee", async () => {
+      mockAssignItem.mockResolvedValue({ success: true, data: board() })
+
+      const response = await ASSIGN_CARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1/assign`, { assignee: null }),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(200)
+      expect(mockAssignItem).toHaveBeenCalledWith(expect.anything(), BOARD_UUID, "card-1", "")
+    })
+
+    it("answers 400 when the action refuses", async () => {
+      mockAssignItem.mockResolvedValue({ success: false, error: DENIED })
+
+      const response = await ASSIGN_CARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1/assign`, { assignee: "bob" }),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect(await getResponseJson(response)).toEqual({ error: DENIED })
+    })
+  })
+
+  describe("/api/kanban/:boardId/items/:itemId/reminder", () => {
+    it("sets a reminder", async () => {
+      mockRemindItem.mockResolvedValue({ success: true, data: board() })
+
+      const response = await SET_REMINDER(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1/reminder`, { datetime: "2030-01-01T09:00:00.000Z" }),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(200)
+      expect(mockRemindItem).toHaveBeenCalledWith(
+        expect.anything(),
+        BOARD_UUID,
+        "card-1",
+        JSON.stringify({ datetime: "2030-01-01T09:00:00.000Z" }),
+      )
+    })
+
+    it("keeps the exact message for a missing datetime", async () => {
+      const response = await SET_REMINDER(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1/reminder`, {}),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Datetime is required")
+    })
+
+    it("rejects a datetime that is not a date", async () => {
+      const response = await SET_REMINDER(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1/reminder`, { datetime: "next tuesday-ish" }),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Datetime must be a valid date")
+      expect(mockRemindItem).not.toHaveBeenCalled()
+    })
+
+    it("clears a reminder", async () => {
+      mockRemindItem.mockResolvedValue({ success: true, data: board() })
+
+      const response = await CLEAR_REMINDER(
+        createMockRequest("DELETE", `${BASE}/${BOARD_UUID}/items/card-1/reminder`),
+        cardParams(),
+      )
+
+      expect(response.status).toBe(200)
+      expect(await getResponseJson(response)).toEqual({ success: true })
+      expect(mockRemindItem).toHaveBeenCalledWith(expect.anything(), BOARD_UUID, "card-1", "")
+    })
+  })
+})
diff --git a/tests/api/logs.test.ts b/tests/api/logs.test.ts
new file mode 100644
index 000000000..5dfcda49f
--- /dev/null
+++ b/tests/api/logs.test.ts
@@ -0,0 +1,210 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup";
+
+const mockDigUpLogs = vi.fn();
+const mockEveryUsername = vi.fn();
+const mockCleanupOldLogs = vi.fn();
+
+vi.mock("@/app/_server/actions/log", () => ({
+  cleanupOldLogs: (...args: unknown[]) => mockCleanupOldLogs(...args),
+  getDailyLogPath: vi.fn(),
+  getDateRange: vi.fn(),
+}));
+
+vi.mock("@/app/_server/actions/lib/audit-trail", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/app/_server/actions/lib/audit-trail")>()),
+  digUpLogs: (...args: unknown[]) => mockDigUpLogs(...args),
+  everyUsername: (...args: unknown[]) => mockEveryUsername(...args),
+}));
+
+import { GET as LIST } from "@/app/api/logs/route";
+import { GET as STATS } from "@/app/api/logs/stats/route";
+import { POST as EXPORT } from "@/app/api/logs/export/route";
+import { POST as CLEANUP } from "@/app/api/logs/cleanup/route";
+
+const ADMIN = { ...mockUser, isAdmin: true };
+
+const entry = (overrides: Record<string, unknown>) => ({
+  id: "1",
+  uuid: "u1",
+  timestamp: "2026-09-01T10:00:00.000Z",
+  level: "INFO",
+  username: "testuser",
+  action: "login",
+  category: "auth",
+  ipAddress: "::1",
+  userAgent: "curl",
+  success: true,
+  ...overrides,
+});
+
+const LOGS = [
+  entry({ id: "1", timestamp: "2026-09-01T10:00:00.000Z" }),
+  entry({ id: "2", timestamp: "2026-09-03T10:00:00.000Z", category: "security", level: "WARNING", success: false }),
+  entry({ id: "3", timestamp: "2026-09-02T10:00:00.000Z", action: "note_created", category: "note" }),
+];
+
+const list = (query = "") => LIST(createMockRequest("GET", `http://localhost:3000/api/logs${query}`));
+
+describe("Logs API", () => {
+  beforeEach(() => {
+    resetApiMocks();
+    mockAuthenticateApiKey.mockResolvedValue(mockUser);
+    mockDigUpLogs.mockReset().mockResolvedValue(LOGS);
+    mockEveryUsername.mockReset().mockResolvedValue(["testuser", "otheruser"]);
+    mockCleanupOldLogs.mockReset().mockResolvedValue({ success: true, deletedFiles: 0 });
+  });
+
+  describe("GET /api/logs", () => {
+    it("reads only your own logs when you are not an admin", async () => {
+      const response = await list();
+      const data = await getResponseJson(response);
+
+      expect(response.status).toBe(200);
+      expect(mockDigUpLogs.mock.calls[0][0]).toEqual(["testuser"]);
+      expect(data.success).toBe(true);
+      expect(data.total).toBe(3);
+      expect(data.logs.map((log: { id: string }) => log.id)).toEqual(["2", "3", "1"]);
+    });
+
+    it("refuses a non-admin asking for somebody else", async () => {
+      const response = await list("?username=otheruser");
+
+      expect(response.status).toBe(403);
+      expect((await getResponseJson(response)).error).toBe("Forbidden: You can only view your own logs");
+      expect(mockDigUpLogs).not.toHaveBeenCalled();
+    });
+
+    it("reads everybody for an admin who names nobody", async () => {
+      mockAuthenticateApiKey.mockResolvedValue(ADMIN);
+
+      await list();
+
+      expect(mockDigUpLogs.mock.calls[0][0]).toEqual(["testuser", "otheruser"]);
+    });
+
+    it.each(["../etc", "a/b", "a\\b"])("refuses a username that walks out of the logs folder: %s", async (name) => {
+      mockAuthenticateApiKey.mockResolvedValue(ADMIN);
+
+      const response = await list(`?username=${encodeURIComponent(name)}`);
+
+      expect(response.status).toBe(400);
+      expect(mockDigUpLogs).not.toHaveBeenCalled();
+    });
+
+    it("reads one user for an admin who names them", async () => {
+      mockAuthenticateApiKey.mockResolvedValue(ADMIN);
+
+      await list("?username=otheruser");
+
+      expect(mockEveryUsername).not.toHaveBeenCalled();
+      expect(mockDigUpLogs.mock.calls[0][0]).toEqual(["otheruser"]);
+    });
+
+    it("accepts the security category and filters by success", async () => {
+      const data = await getResponseJson(await list("?category=security&success=false"));
+
+      expect(data.total).toBe(1);
+      expect(data.logs[0].id).toBe("2");
+    });
+
+    it("applies limit and offset from the query string", async () => {
+      const data = await getResponseJson(await list("?limit=1&offset=1"));
+
+      expect(data.total).toBe(3);
+      expect(data.logs.map((log: { id: string }) => log.id)).toEqual(["3"]);
+    });
+
+    it("rejects a level that does not exist", async () => {
+      const response = await list("?level=LOUD");
+
+      expect(response.status).toBe(400);
+      expect(mockDigUpLogs).not.toHaveBeenCalled();
+    });
+
+    it("rejects a limit that is not a number", async () => {
+      expect((await list("?limit=lots")).status).toBe(400);
+    });
+  });
+
+  describe("GET /api/logs/stats", () => {
+    it("is admin only", async () => {
+      const response = await STATS(createMockRequest("GET", "http://localhost:3000/api/logs/stats"));
+
+      expect(response.status).toBe(403);
+      expect((await getResponseJson(response)).error).toBe("Admin access required");
+    });
+
+    it("counts levels, categories, actions and users", async () => {
+      mockAuthenticateApiKey.mockResolvedValue(ADMIN);
+
+      const data = await getResponseJson(
+        await STATS(createMockRequest("GET", "http://localhost:3000/api/logs/stats")),
+      );
+
+      expect(data.totalLogs).toBe(3);
+      expect(data.logsByLevel).toEqual({ DEBUG: 0, INFO: 2, WARNING: 1, ERROR: 0, CRITICAL: 0 });
+      expect(data.logsByCategory).toEqual({ auth: 1, security: 1, note: 1 });
+      expect(data.topActions[0]).toEqual({ action: "login", count: 2 });
+      expect(data.topUsers).toEqual([{ username: "testuser", count: 3 }]);
+      expect(data.recentActivity[0].id).toBe("2");
+    });
+  });
+
+  describe("POST /api/logs/export", () => {
+    const exportLogs = (body: unknown) =>
+      EXPORT(createMockRequest("POST", "http://localhost:3000/api/logs/export", body));
+
+    it("keeps the old message for a bad format", async () => {
+      const response = await exportLogs({ format: "xml" });
+
+      expect(response.status).toBe(400);
+      expect((await getResponseJson(response)).error).toBe("Invalid format. Must be 'json' or 'csv'");
+    });
+
+    it("pins a non-admin to their own logs whatever username they send", async () => {
+      await exportLogs({ format: "json", filters: { username: "otheruser" } });
+
+      expect(mockDigUpLogs.mock.calls[0][0]).toEqual(["testuser"]);
+    });
+
+    it("sends CSV as an attachment", async () => {
+      const response = await exportLogs({ format: "csv", filters: { level: "WARNING" } });
+      const text = await response.text();
+
+      expect(response.headers.get("Content-Type")).toBe("text/csv");
+      expect(response.headers.get("Content-Disposition")).toMatch(/^attachment; filename="audit-logs-\d+\.csv"$/);
+      expect(text.split("\n")).toHaveLength(2);
+      expect(text).toContain('"security"');
+    });
+
+    it("trims to the limit in the filters", async () => {
+      const response = await exportLogs({ format: "json", filters: { limit: 2 } });
+
+      expect(JSON.parse(await response.text())).toHaveLength(2);
+    });
+  });
+
+  describe("POST /api/logs/cleanup", () => {
+    const cleanup = () => CLEANUP(createMockRequest("POST", "http://localhost:3000/api/logs/cleanup"));
+
+    it("is admin only", async () => {
+      expect((await cleanup()).status).toBe(403);
+      expect(mockCleanupOldLogs).not.toHaveBeenCalled();
+    });
+
+    it("returns the cleanup result for an admin", async () => {
+      mockAuthenticateApiKey.mockResolvedValue(ADMIN);
+
+      const data = await getResponseJson(await cleanup());
+
+      expect(data).toEqual({ success: true, deletedFiles: 0 });
+    });
+  });
+});
diff --git a/tests/api/setup.ts b/tests/api/setup.ts
index e6cc9bc3a..779a80392 100644
--- a/tests/api/setup.ts
+++ b/tests/api/setup.ts
@@ -160,6 +160,15 @@ vi.mock("@/app/_server/actions/export", () => ({
 
 vi.mock("@/app/_server/actions/config", () => ({
   getAppSettings: (...args: any[]) => mockGetAppSettings(...args),
+  getSettings: async () => (await mockGetAppSettings())?.data ?? {},
+}));
+
+vi.mock("@/app/_server/actions/export/builders", () => ({
+  buildAllContent: (...args: any[]) => mockExportAllChecklistsNotes(...args),
+  buildUserContent: (...args: any[]) => mockExportUserChecklistsNotes(...args),
+  buildAllUsers: (...args: any[]) => mockExportAllUsersData(...args),
+  buildWholeData: (...args: any[]) => mockExportWholeDataFolder(...args),
+  readExportProgress: (...args: any[]) => mockGetExportProgress(...args),
 }));
 
 vi.mock("@/app/_server/actions/lib/legacy-lookup", () => ({
diff --git a/tests/api/tasks.test.ts b/tests/api/tasks.test.ts
index 993e049a3..e776db88b 100644
--- a/tests/api/tasks.test.ts
+++ b/tests/api/tasks.test.ts
@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach } from "vitest"
+import { NextRequest } from "next/server"
 import {
   mockUser,
   mockAuthenticateApiKey,
@@ -11,6 +12,10 @@ import {
   mockAddItem,
   mockStampStatus,
   mockServerWriteFile,
+  mockRestatus,
+  mockCanReach,
+  mockGraftItem,
+  mockRemoveItem,
   resetApiMocks,
   createMockRequest,
   getResponseJson,
@@ -723,4 +728,262 @@ describe("Tasks API", () => {
       expect(data.error).toBe("Unauthorized")
     })
   })
+
+  describe("default statuses", () => {
+    const bareTask = { ...mockTask, statuses: undefined }
+
+    it("sends label alongside the legacy name when a task has no stored statuses", async () => {
+      mockGetListById.mockResolvedValue(bareTask)
+
+      const request = createMockRequest("GET", "http://localhost:3000/api/tasks/task-uuid-1")
+      const response = await GET_TASK(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) })
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(200)
+      expect(data.task.statuses).toEqual([
+        { id: "todo", label: "To Do", name: "To Do", order: 0 },
+        { id: "in_progress", label: "In Progress", name: "In Progress", order: 1 },
+        { id: "completed", label: "Completed", name: "Completed", order: 2 },
+      ])
+    })
+
+    it("does the same on list, create and update", async () => {
+      mockGetUserChecklists.mockResolvedValue({ success: true, data: [bareTask] })
+      mockMakeList.mockResolvedValue({ success: true, data: bareTask })
+      mockGetListById.mockResolvedValue(bareTask)
+      mockEditList.mockResolvedValue({ success: true, data: bareTask })
+
+      const listed = await getResponseJson(await GET_TASKS(createMockRequest("GET", "http://localhost:3000/api/tasks")))
+      const created = await getResponseJson(
+        await POST_TASKS(createMockRequest("POST", "http://localhost:3000/api/tasks", { title: "Board" })),
+      )
+      const updated = await getResponseJson(
+        await PUT_TASK(createMockRequest("PUT", "http://localhost:3000/api/tasks/task-uuid-1", { title: "Board" }), {
+          params: Promise.resolve({ taskId: "task-uuid-1" }),
+        }),
+      )
+
+      ;[listed.tasks[0], created.data, updated.data].forEach((task) => {
+        expect(task.statuses[0]).toEqual({ id: "todo", label: "To Do", name: "To Do", order: 0 })
+      })
+      expect(mockRestatus).not.toHaveBeenCalled()
+    })
+
+    it("returns stored statuses untouched", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+
+      const request = createMockRequest("GET", "http://localhost:3000/api/tasks/task-uuid-1")
+      const data = await getResponseJson(await GET_TASK(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) }))
+
+      expect(data.task.statuses).toEqual(mockTask.statuses)
+    })
+  })
+
+  describe("POST /api/tasks with statuses", () => {
+    const created = { ...mockTask, statuses: undefined, uuid: "new-uuid" }
+
+    it("creates the task with the requested columns in one write", async () => {
+      mockMakeList.mockImplementation(async (_user: unknown, _form: FormData, statuses?: unknown[]) => ({
+        success: true,
+        data: { ...created, statuses },
+      }))
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks", {
+        title: "Sprint",
+        statuses: [
+          { id: "todo", label: "To Do", order: 0 },
+          { id: "review", label: "In Review", color: "#3b82f6" },
+          { id: "done", name: "Done", autoComplete: true },
+        ],
+      })
+      const response = await POST_TASKS(request)
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(200)
+      expect(mockRestatus).not.toHaveBeenCalled()
+      expect(data.data.statuses).toEqual([
+        { id: "todo", label: "To Do", order: 0 },
+        { id: "review", label: "In Review", color: "#3b82f6", order: 1 },
+        { id: "done", label: "Done", order: 2, autoComplete: true },
+      ])
+      expect(data.data.items).toEqual([])
+    })
+
+    it("refuses columns without an id before creating anything", async () => {
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks", {
+        title: "Sprint",
+        statuses: [{ label: "No id" }],
+      })
+      const response = await POST_TASKS(request)
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(400)
+      expect(data.error).toBe("Status id is required")
+      expect(mockMakeList).not.toHaveBeenCalled()
+    })
+
+    it("refuses duplicate column ids", async () => {
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks", {
+        title: "Sprint",
+        statuses: [
+          { id: "todo", label: "To Do" },
+          { id: "todo", label: "Again" },
+        ],
+      })
+      const response = await POST_TASKS(request)
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Status ids must be unique")
+      expect(mockMakeList).not.toHaveBeenCalled()
+    })
+
+  })
+
+  describe("input validation", () => {
+    it("returns 400 for a body that is not JSON", async () => {
+      const request = new NextRequest(new URL("http://localhost:3000/api/tasks"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "x-api-key": "test-api-key" },
+        body: "{not json",
+      })
+      const response = await POST_TASKS(request)
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Request body must be valid JSON")
+    })
+
+    it("returns 400 for a malformed item index", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+
+      const request = createMockRequest("GET", "http://localhost:3000/api/tasks/task-uuid-1/items/abc")
+      const response = await GET_TASK_ITEM(request, { params: Promise.resolve({ taskId: "task-uuid-1", itemIndex: "abc" }) })
+
+      expect(response.status).toBe(400)
+    })
+
+    it("returns 400 for a nested item index out of range", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+
+      const request = createMockRequest("GET", "http://localhost:3000/api/tasks/task-uuid-1/items/0.5")
+      const response = await GET_TASK_ITEM(request, { params: Promise.resolve({ taskId: "task-uuid-1", itemIndex: "0.5" }) })
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Item index out of range")
+    })
+
+    it("returns 404 when the parent index does not exist", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks/task-uuid-1/items", {
+        text: "Orphan",
+        parentIndex: "3",
+      })
+      const response = await POST_TASK_ITEM(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) })
+
+      expect(response.status).toBe(404)
+      expect((await getResponseJson(response)).error).toBe("Parent item not found")
+      expect(mockGraftItem).not.toHaveBeenCalled()
+    })
+
+    it("grafts under a numeric parent index", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks/task-uuid-1/items", {
+        text: "Child",
+        parentIndex: 0,
+      })
+      const response = await POST_TASK_ITEM(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) })
+
+      expect(response.status).toBe(200)
+      const graft = mockGraftItem.mock.calls[0][1] as FormData
+      expect(graft.get("parentId")).toBe("item-1")
+      expect(graft.get("status")).toBe("todo")
+    })
+
+    it("returns 400 for a malformed parent index", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks/task-uuid-1/items", {
+        text: "Child",
+        parentIndex: "zero",
+      })
+      const response = await POST_TASK_ITEM(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) })
+
+      expect(response.status).toBe(400)
+      expect(mockGraftItem).not.toHaveBeenCalled()
+    })
+
+    it("uses the exact message when a status label is missing", async () => {
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks/task-uuid-1/statuses", { id: "review" })
+      const response = await POST_STATUS(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) })
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Status id and label are required")
+    })
+  })
+
+  describe("status fields", () => {
+    it("keeps autoComplete on create", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks/task-uuid-1/statuses", {
+        id: "shipped",
+        label: "Shipped",
+        autoComplete: true,
+      })
+      const data = await getResponseJson(
+        await POST_STATUS(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) }),
+      )
+
+      expect(data.data).toEqual({ id: "shipped", label: "Shipped", order: 3, autoComplete: true })
+    })
+
+    it("updates autoComplete and clears a color sent as null", async () => {
+      const colored = {
+        ...mockTask,
+        statuses: [{ id: "todo", label: "To Do", order: 0, color: "#fff" }],
+      }
+      mockGetListById.mockResolvedValue(colored)
+      mockRestatus.mockImplementation(async (_user: unknown, _uuid: string, reshape: (current?: unknown[]) => unknown[]) => ({
+        success: true,
+        data: { statuses: reshape(colored.statuses) },
+      }))
+
+      const request = createMockRequest("PUT", "http://localhost:3000/api/tasks/task-uuid-1/statuses/todo", {
+        autoComplete: true,
+        color: null,
+      })
+      const data = await getResponseJson(
+        await PUT_STATUS(request, { params: Promise.resolve({ taskId: "task-uuid-1", statusId: "todo" }) }),
+      )
+
+      expect(data.data).toEqual({ id: "todo", label: "To Do", order: 0, autoComplete: true })
+    })
+  })
+
+  describe("share grants", () => {
+    it("refuses adding an item without the edit grant", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+      mockCanReach.mockResolvedValue(false)
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks/task-uuid-1/items", { text: "Nope" })
+      const response = await POST_TASK_ITEM(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) })
+
+      expect(response.status).toBe(403)
+      expect(mockAddItem).not.toHaveBeenCalled()
+    })
+
+    it("refuses deleting an item without the delete grant", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+      mockCanReach.mockImplementation(async (_uuid: string, _type: string, _user: string, permission: string) =>
+        permission !== "canDelete",
+      )
+
+      const request = createMockRequest("DELETE", "http://localhost:3000/api/tasks/task-uuid-1/items/0")
+      const response = await DELETE_TASK_ITEM(request, { params: Promise.resolve({ taskId: "task-uuid-1", itemIndex: "0" }) })
+
+      expect(response.status).toBe(403)
+      expect(mockRemoveItem).not.toHaveBeenCalled()
+    })
+  })
 })
diff --git a/tests/security/kanban-grants.test.ts b/tests/security/kanban-grants.test.ts
new file mode 100644
index 000000000..74e3d7941
--- /dev/null
+++ b/tests/security/kanban-grants.test.ts
@@ -0,0 +1,292 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { NextRequest } from 'next/server'
+import { resetAllMocks } from '../setup'
+import { PermissionTypes } from '@/app/_types/enums'
+
+const OWNER = 'owner'
+const READER = 'reader'
+const EDITOR = 'editor'
+const STRANGER = 'stranger'
+const BOARD_UUID = '1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d'
+const BOARD_PATH = '/data/checklists/owner/Work/board.md'
+
+const GRANTS: Record<string, PermissionTypes[]> = {
+  [OWNER]: [PermissionTypes.READ, PermissionTypes.EDIT, PermissionTypes.CREATE, PermissionTypes.DELETE],
+  [EDITOR]: [PermissionTypes.READ, PermissionTypes.EDIT],
+  [READER]: [PermissionTypes.READ],
+}
+
+const mockAuthenticateApiKey = vi.fn()
+const mockWrite = vi.fn()
+const mockDelete = vi.fn()
+
+const holds = (username: string, permission: PermissionTypes) =>
+  (GRANTS[username] || []).includes(permission)
+
+const ownerBoard = () => ({
+  uuid: BOARD_UUID,
+  id: 'board',
+  title: 'Board',
+  category: 'Work',
+  owner: OWNER,
+  type: 'kanban',
+  statuses: [
+    { id: 'todo', label: 'To Do', order: 0 },
+    { id: 'done', label: 'Done', order: 1 },
+  ],
+  items: [{ id: 'card', text: 'Card', completed: false, order: 0, status: 'todo' }],
+  createdAt: '2024-01-01T00:00:00.000Z',
+  updatedAt: '2024-01-01T00:00:00.000Z',
+})
+
+vi.mock('@/app/_server/actions/users', () => ({
+  getCurrentUser: vi.fn().mockResolvedValue(null),
+  getUsername: vi.fn().mockResolvedValue(''),
+  isAdmin: vi.fn().mockResolvedValue(false),
+}))
+
+vi.mock('@/app/_server/actions/users/records', () => ({
+  findUserRecord: vi.fn(async (username: string) => (username && username !== 'ghost' ? { username } : null)),
+}))
+
+vi.mock('@/app/_server/actions/file', () => ({
+  ensureDir: vi.fn(),
+  getUserModeDir: vi.fn(),
+  serverWriteFile: (...args: unknown[]) => mockWrite(...args),
+  serverDeleteFile: (...args: unknown[]) => mockDelete(...args),
+}))
+
+vi.mock('@/app/_server/actions/checklist/queries', () => ({
+  getListById: async (_uuid: string, username?: string) =>
+    !username || GRANTS[username] ? ownerBoard() : undefined,
+  getUserChecklists: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/share/queries', () => ({
+  canReach: async (_uuid: string, _type: string, username: string, permission: PermissionTypes) =>
+    holds(username, permission),
+  reachableFile: async (_uuid: string, _type: string, username: string, permission: PermissionTypes) =>
+    holds(username, permission) ? BOARD_PATH : null,
+  usersWithAccess: vi.fn().mockResolvedValue([]),
+}))
+
+vi.mock('@/app/_server/actions/ws/broadcast', () => ({
+  broadcast: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('@/app/_server/actions/notifications/internal', () => ({
+  notifyUser: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/log', () => ({
+  logContentEvent: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/api', () => ({
+  authenticateApiKey: (...args: unknown[]) => mockAuthenticateApiKey(...args),
+}))
+
+vi.mock('@/app/_server/actions/lib/legacy-lookup', () => ({
+  resolveApiId: async (_mode: string, param: string) => param,
+}))
+
+const keyFor = (username: string) =>
+  mockAuthenticateApiKey.mockResolvedValue({ username, isAdmin: false })
+
+const apiRequest = (method: string, url: string, body?: unknown) =>
+  new NextRequest(new URL(url, 'http://localhost:3000'), {
+    method,
+    headers: { 'Content-Type': 'application/json', 'x-api-key': 'some-key' },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  })
+
+type Call = () => Promise<Response>
+
+const onBoard = (extra: Record<string, string> = {}) => ({
+  params: Promise.resolve({ boardId: BOARD_UUID, ...extra }),
+})
+const onCard = () => onBoard({ itemId: 'card' })
+const BASE = `/api/kanban/${BOARD_UUID}`
+
+const readRoutes = async (): Promise<Record<string, Call>> => {
+  const board = await import('@/app/api/kanban/[boardId]/route')
+  const calendar = await import('@/app/api/kanban/[boardId]/calendar/route')
+
+  return {
+    'GET /api/kanban/:id': () => board.GET(apiRequest('GET', BASE), onBoard()),
+    'GET /api/kanban/:id/calendar': () => calendar.GET(apiRequest('GET', `${BASE}/calendar`), onBoard()),
+  }
+}
+
+const editRoutes = async (): Promise<Record<string, Call>> => {
+  const board = await import('@/app/api/kanban/[boardId]/route')
+  const statuses = await import('@/app/api/kanban/[boardId]/statuses/route')
+  const items = await import('@/app/api/kanban/[boardId]/items/route')
+  const item = await import('@/app/api/kanban/[boardId]/items/[itemId]/route')
+  const status = await import('@/app/api/kanban/[boardId]/items/[itemId]/status/route')
+  const assign = await import('@/app/api/kanban/[boardId]/items/[itemId]/assign/route')
+  const reminder = await import('@/app/api/kanban/[boardId]/items/[itemId]/reminder/route')
+
+  return {
+    'PUT /api/kanban/:id': () => board.PUT(apiRequest('PUT', BASE, { title: 'Taken' }), onBoard()),
+    'PUT /api/kanban/:id/statuses': () =>
+      statuses.PUT(apiRequest('PUT', `${BASE}/statuses`, { statuses: [{ id: 'todo', label: 'To Do', order: 0 }] }), onBoard()),
+    'POST /api/kanban/:id/items': () => items.POST(apiRequest('POST', `${BASE}/items`, { text: 'Sneaky' }), onBoard()),
+    'PUT /api/kanban/:id/items/:itemId': () => item.PUT(apiRequest('PUT', `${BASE}/items/card`, { text: 'Mine' }), onCard()),
+    'PUT /api/kanban/:id/items/:itemId/status': () =>
+      status.PUT(apiRequest('PUT', `${BASE}/items/card/status`, { status: 'done' }), onCard()),
+    'PUT /api/kanban/:id/items/:itemId/assign': () =>
+      assign.PUT(apiRequest('PUT', `${BASE}/items/card/assign`, { assignee: READER }), onCard()),
+    'PUT /api/kanban/:id/items/:itemId/reminder': () =>
+      reminder.PUT(apiRequest('PUT', `${BASE}/items/card/reminder`, { datetime: '2030-01-01T09:00:00.000Z' }), onCard()),
+    'DELETE /api/kanban/:id/items/:itemId/reminder': () =>
+      reminder.DELETE(apiRequest('DELETE', `${BASE}/items/card/reminder`), onCard()),
+  }
+}
+
+const deleteRoutes = async (): Promise<Record<string, Call>> => {
+  const board = await import('@/app/api/kanban/[boardId]/route')
+  const item = await import('@/app/api/kanban/[boardId]/items/[itemId]/route')
+
+  return {
+    'DELETE /api/kanban/:id': () => board.DELETE(apiRequest('DELETE', BASE), onBoard()),
+    'DELETE /api/kanban/:id/items/:itemId': () => item.DELETE(apiRequest('DELETE', `${BASE}/items/card`), onCard()),
+  }
+}
+
+const expectRefused = async (routes: Record<string, Call>, status: number) => {
+  for (const [name, call] of Object.entries(routes)) {
+    const response = await call()
+    const body = await response.json()
+
+    expect({ name, status: response.status }).toEqual({ name, status })
+    expect(body.success).toBeUndefined()
+    expect(body.error).toBeTruthy()
+  }
+  expect(mockWrite).not.toHaveBeenCalled()
+  expect(mockDelete).not.toHaveBeenCalled()
+}
+
+describe('Security: kanban API routes hold every share grant', () => {
+  beforeEach(() => {
+    resetAllMocks()
+    mockAuthenticateApiKey.mockResolvedValue(null)
+    mockWrite.mockResolvedValue(undefined)
+    mockDelete.mockResolvedValue(undefined)
+  })
+
+  describe('a stranger holding the board uuid', () => {
+    beforeEach(() => keyFor(STRANGER))
+
+    it('cannot read the board or its calendar', async () => {
+      await expectRefused(await readRoutes(), 404)
+    })
+
+    it('cannot change or delete anything', async () => {
+      await expectRefused({ ...(await editRoutes()), ...(await deleteRoutes()) }, 404)
+    })
+  })
+
+  describe('a user holding only READ', () => {
+    beforeEach(() => keyFor(READER))
+
+    it('can read the board and its calendar', async () => {
+      for (const [name, call] of Object.entries(await readRoutes())) {
+        expect({ name, status: (await call()).status }).toEqual({ name, status: 200 })
+      }
+    })
+
+    it('is refused on every edit route and writes nothing', async () => {
+      await expectRefused(await editRoutes(), 403)
+    })
+
+    it('is refused on every delete route and deletes nothing', async () => {
+      await expectRefused(await deleteRoutes(), 403)
+    })
+  })
+
+  describe('the owner', () => {
+    beforeEach(() => keyFor(OWNER))
+
+    it('gets through the same routes and writes the board file', async () => {
+      const through = [
+        'PUT /api/kanban/:id/statuses',
+        'POST /api/kanban/:id/items',
+        'PUT /api/kanban/:id/items/:itemId',
+        'PUT /api/kanban/:id/items/:itemId/assign',
+        'PUT /api/kanban/:id/items/:itemId/reminder',
+        'DELETE /api/kanban/:id/items/:itemId/reminder',
+        'DELETE /api/kanban/:id/items/:itemId',
+      ]
+      const routes = { ...(await editRoutes()), ...(await deleteRoutes()) }
+
+      for (const name of through) {
+        mockWrite.mockClear()
+        const response = await routes[name]()
+
+        expect({ name, status: response.status }).toEqual({ name, status: 200 })
+        expect(mockWrite).toHaveBeenCalledOnce()
+        expect(mockWrite.mock.calls[0][0]).toBe(BOARD_PATH)
+      }
+    })
+  })
+
+  describe('assigning a card', () => {
+    beforeEach(() => keyFor(OWNER))
+
+    it.each([
+      ['a user that does not exist', 'ghost', "Assignee not found"],
+      ['a user who cannot see the board', STRANGER, "Assignee can't see this board"],
+    ])('refuses %s and writes nothing', async (_label, assignee, message) => {
+      const { PUT } = await import('@/app/api/kanban/[boardId]/items/[itemId]/assign/route')
+
+      const response = await PUT(apiRequest('PUT', `${BASE}/items/card/assign`, { assignee }), onCard())
+
+      expect(response.status).toBe(400)
+      expect((await response.json()).error).toBe(message)
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('an unknown card', () => {
+    beforeEach(() => keyFor(OWNER))
+
+    it('answers 404 on every card route and writes nothing', async () => {
+      const onGhostCard = () => onBoard({ itemId: 'no-such-card' })
+      const item = await import('@/app/api/kanban/[boardId]/items/[itemId]/route')
+      const status = await import('@/app/api/kanban/[boardId]/items/[itemId]/status/route')
+      const assign = await import('@/app/api/kanban/[boardId]/items/[itemId]/assign/route')
+      const reminder = await import('@/app/api/kanban/[boardId]/items/[itemId]/reminder/route')
+      const calls: Call[] = [
+        () => item.PUT(apiRequest('PUT', `${BASE}/items/no-such-card`, { text: 'x' }), onGhostCard()),
+        () => item.DELETE(apiRequest('DELETE', `${BASE}/items/no-such-card`), onGhostCard()),
+        () => status.PUT(apiRequest('PUT', `${BASE}/items/no-such-card/status`, { status: 'done' }), onGhostCard()),
+        () => assign.PUT(apiRequest('PUT', `${BASE}/items/no-such-card/assign`, { assignee: EDITOR }), onGhostCard()),
+        () => reminder.PUT(apiRequest('PUT', `${BASE}/items/no-such-card/reminder`, { datetime: '2030-01-01T09:00:00.000Z' }), onGhostCard()),
+        () => reminder.DELETE(apiRequest('DELETE', `${BASE}/items/no-such-card/reminder`), onGhostCard()),
+      ]
+
+      for (const call of calls) expect((await call()).status).toBe(404)
+      expect(mockWrite).not.toHaveBeenCalled()
+      expect(mockDelete).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('a user holding EDIT but not DELETE', () => {
+    beforeEach(() => keyFor(EDITOR))
+
+    it('can still move cards around', async () => {
+      const { PUT } = await import('@/app/api/kanban/[boardId]/items/[itemId]/assign/route')
+
+      const response = await PUT(apiRequest('PUT', `${BASE}/items/card/assign`, { assignee: EDITOR }), onCard())
+
+      expect(response.status).toBe(200)
+      expect(mockWrite).toHaveBeenCalledOnce()
+      expect(mockWrite.mock.calls[0][0]).toBe(BOARD_PATH)
+    })
+
+    it('cannot delete the board or a card', async () => {
+      await expectRefused(await deleteRoutes(), 403)
+    })
+  })
+})
diff --git a/tests/security/share-grants.test.ts b/tests/security/share-grants.test.ts
index e025d9534..f8c9c276f 100644
--- a/tests/security/share-grants.test.ts
+++ b/tests/security/share-grants.test.ts
@@ -59,7 +59,7 @@ vi.mock('@/app/_server/actions/users', () => ({
 }))
 
 vi.mock('@/app/_server/actions/users/records', () => ({
-  findUserRecord: vi.fn().mockResolvedValue(null),
+  findUserRecord: vi.fn(async (username: string) => (username ? { username } : null)),
 }))
 
 vi.mock('@/app/_server/actions/file', () => ({
@@ -272,9 +272,9 @@ describe('Security: share grants hold on every board read and mutation', () => {
         const response = await call()
         const body = await response.json()
 
-        expect({ name, status: response.status }).toEqual({ name, status: 400 })
+        expect({ name, status: response.status }).toEqual({ name, status: 403 })
         expect(body.success).toBeUndefined()
-        expect(body.error).toBeTruthy()
+        expect(body.error).toBe('Forbidden')
       }
 
       expect(mockWrite).not.toHaveBeenCalled()
diff --git a/tests/server-actions/export-actions.test.ts b/tests/server-actions/export-actions.test.ts
new file mode 100644
index 000000000..227ef6c5c
--- /dev/null
+++ b/tests/server-actions/export-actions.test.ts
@@ -0,0 +1,77 @@
+import { describe, it, expect, beforeEach, vi } from "vitest"
+
+const { mockGetCurrentUser, mockCanAccessAllContent, build } = vi.hoisted(() => ({
+  mockGetCurrentUser: vi.fn(),
+  mockCanAccessAllContent: vi.fn(),
+  build: {
+    buildAllContent: vi.fn(),
+    buildAllUsers: vi.fn(),
+    buildWholeData: vi.fn(),
+    buildUserContent: vi.fn(),
+    readExportProgress: vi.fn(),
+  },
+}))
+
+vi.mock("@/app/_server/actions/users", () => ({
+  getCurrentUser: () => mockGetCurrentUser(),
+  canAccessAllContent: () => mockCanAccessAllContent(),
+}))
+
+vi.mock("@/app/_server/actions/export/builders", () => build)
+
+import {
+  exportAllChecklistsNotes,
+  exportAllUsersData,
+  exportUserChecklistsNotes,
+  exportWholeDataFolder,
+} from "@/app/_server/actions/export"
+
+const DONE = { success: true, downloadUrl: "/api/exports/x.zip" }
+
+describe("export server actions used by the admin page", () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    Object.values(build).forEach((fn) => fn.mockResolvedValue(DONE))
+    mockGetCurrentUser.mockResolvedValue({ username: "admin", isAdmin: true })
+  })
+
+  it.each([
+    ["all content", exportAllChecklistsNotes, build.buildAllContent],
+    ["all users", exportAllUsersData, build.buildAllUsers],
+    ["whole data folder", exportWholeDataFolder, build.buildWholeData],
+  ])("still run the %s export for an admin with content access", async (_label, action, builder) => {
+    mockCanAccessAllContent.mockResolvedValue(true)
+    expect(await action()).toEqual(DONE)
+    expect(builder).toHaveBeenCalled()
+  })
+
+  it.each([
+    ["all content", exportAllChecklistsNotes, build.buildAllContent],
+    ["all users", exportAllUsersData, build.buildAllUsers],
+    ["whole data folder", exportWholeDataFolder, build.buildWholeData],
+  ])("refuse the %s export without content access", async (_label, action, builder) => {
+    mockCanAccessAllContent.mockResolvedValue(false)
+    expect((await action()).success).toBe(false)
+    expect(builder).not.toHaveBeenCalled()
+  })
+
+  it("lets anybody logged in export their own data", async () => {
+    mockGetCurrentUser.mockResolvedValue({ username: "alice", isAdmin: false })
+    mockCanAccessAllContent.mockResolvedValue(false)
+    expect(await exportUserChecklistsNotes("alice")).toEqual(DONE)
+    expect(build.buildUserContent).toHaveBeenCalledWith("alice")
+  })
+
+  it("refuses somebody else's data without content access", async () => {
+    mockGetCurrentUser.mockResolvedValue({ username: "alice", isAdmin: false })
+    mockCanAccessAllContent.mockResolvedValue(false)
+    expect((await exportUserChecklistsNotes("bob")).success).toBe(false)
+    expect(build.buildUserContent).not.toHaveBeenCalled()
+  })
+
+  it("refuses when nobody is logged in", async () => {
+    mockGetCurrentUser.mockResolvedValue(null)
+    expect((await exportUserChecklistsNotes("alice")).success).toBe(false)
+    expect(build.buildUserContent).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/server-actions/rearrange.test.ts b/tests/server-actions/rearrange.test.ts
new file mode 100644
index 000000000..ba10fa8d1
--- /dev/null
+++ b/tests/server-actions/rearrange.test.ts
@@ -0,0 +1,89 @@
+import { describe, it, expect, beforeEach, vi } from "vitest"
+
+const { mocks } = vi.hoisted(() => ({
+  mocks: {
+    getListById: vi.fn(),
+    canReach: vi.fn(),
+    serverWriteFile: vi.fn(),
+    diskPath: vi.fn(),
+  },
+}))
+
+vi.mock("@/app/_server/actions/checklist/queries", () => ({ getListById: mocks.getListById }))
+vi.mock("@/app/_server/actions/share/queries", () => ({ canReach: mocks.canReach }))
+vi.mock("@/app/_server/actions/share/target", () => ({ diskPath: mocks.diskPath }))
+vi.mock("@/app/_server/actions/file", () => ({ serverWriteFile: mocks.serverWriteFile, ensureDir: vi.fn() }))
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({ broadcast: vi.fn() }))
+vi.mock("@/app/_utils/checklist-utils", () => ({ listToMarkdown: (list: unknown) => list }))
+
+import { Rearranged, rearrangeItems } from "@/app/_server/actions/checklist-item/rearrange"
+import { DropPosition } from "@/app/_types/enums"
+
+const list = () => ({
+  uuid: "list-1",
+  id: "groceries",
+  owner: "alice",
+  category: "Uncategorized",
+  items: [
+    { id: "a", text: "A", completed: false, order: 0 },
+    { id: "b", text: "B", completed: false, order: 1, children: [{ id: "b1", text: "B1", completed: false, order: 0 }] },
+    { id: "c", text: "C", completed: false, order: 2 },
+  ],
+})
+
+const move = (activeItemId: string, overItemId: string, extra = {}) => ({
+  listUuid: "list-1",
+  activeItemId,
+  overItemId,
+  position: DropPosition.BEFORE,
+  isDropInto: false,
+  ...extra,
+})
+
+const written = () => mocks.serverWriteFile.mock.calls[0][1].items.map((item: { id: string }) => item.id)
+
+describe("rearrangeItems", () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getListById.mockResolvedValue(list())
+    mocks.canReach.mockResolvedValue(true)
+    mocks.diskPath.mockResolvedValue("/tmp/jotty-test/groceries.md")
+  })
+
+  it("moves an item after another and writes the new order", async () => {
+    expect(await rearrangeItems("alice", move("a", "c", { position: DropPosition.AFTER }))).toBe(Rearranged.MOVED)
+    expect(written()).toEqual(["b", "c", "a"])
+  })
+
+  it("treats dropping an item on itself as nothing to do", async () => {
+    expect(await rearrangeItems("alice", move("a", "a"))).toBe(Rearranged.UNCHANGED)
+    expect(mocks.serverWriteFile).not.toHaveBeenCalled()
+  })
+
+  it("refuses to drop a parent into its own child", async () => {
+    expect(await rearrangeItems("alice", move("b", "b1", { isDropInto: true }))).toBe(Rearranged.UNCHANGED)
+    expect(mocks.serverWriteFile).not.toHaveBeenCalled()
+  })
+
+  it("writes nothing for a user without edit permission", async () => {
+    mocks.canReach.mockResolvedValue(false)
+    expect(await rearrangeItems("mallory", move("a", "c"))).toBe(Rearranged.FORBIDDEN)
+    expect(mocks.serverWriteFile).not.toHaveBeenCalled()
+  })
+
+  it("reports a list the user can't see", async () => {
+    mocks.getListById.mockResolvedValue(undefined)
+    expect(await rearrangeItems("mallory", move("a", "c"))).toBe(Rearranged.NO_LIST)
+  })
+
+  it("reports an unknown item", async () => {
+    expect(await rearrangeItems("alice", move("a", "zzz"))).toBe(Rearranged.NO_ITEM)
+    expect(mocks.serverWriteFile).not.toHaveBeenCalled()
+  })
+
+  it("writes to the path the share helpers resolve, not one built by hand", async () => {
+    await rearrangeItems("alice", move("a", "c"))
+    expect(mocks.diskPath).toHaveBeenCalled()
+    expect(mocks.serverWriteFile.mock.calls[0][0]).toBe("/tmp/jotty-test/groceries.md")
+  })
+})
diff --git a/tsconfig.json b/tsconfig.json
index c53d3deda..fae60ff9e 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -39,6 +39,7 @@
   ],
   "exclude": [
     "node_modules",
-    "public/sw.js"
+    "public/sw.js",
+    "mcp-server"
   ]
 }

From 272ed15bf66720ac3ed5807358ab426e6ce4537c Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 11:44:03 +0100
Subject: [PATCH 17/28] fix a bunch of constraints and issues with the api now
 that mcp is hard as fuck

---
 app/_consts/kanban.ts                         |   9 +-
 app/_schemas/api/checklists.ts                |  17 +-
 app/_schemas/api/common.ts                    |  20 ++
 app/_schemas/api/kanban.ts                    |   6 +-
 app/_schemas/api/notes.ts                     |   9 +-
 app/_server/actions/checklist-item/editor.ts  |  18 +-
 app/_server/actions/checklist-item/stamper.ts |   5 +
 app/_server/actions/kanban/assignee.ts        |  17 ++
 app/_server/actions/kanban/tweaker.ts         |  15 +-
 app/_server/actions/notifications/internal.ts |   6 +-
 app/_utils/api-checklist.ts                   |  22 ++
 app/_utils/api-list-utils.ts                  |  18 ++
 app/_utils/api-note.ts                        |  56 ++++++
 app/_utils/api-task.ts                        |   6 +-
 app/_utils/item-status-utils.ts               |   5 +-
 app/_utils/kanban/api-board.ts                |   9 +-
 app/api/checklists/[listId]/items/route.ts    |  25 ++-
 app/api/checklists/[listId]/route.ts          |  25 +++
 app/api/checklists/route.ts                   |  23 +--
 .../[boardId]/items/[itemId]/assign/route.ts  |  11 +-
 .../items/[itemId]/reminder/route.ts          |  10 +-
 .../kanban/[boardId]/items/[itemId]/route.ts  |  12 +-
 .../[boardId]/items/[itemId]/status/route.ts  |  11 +-
 app/api/kanban/[boardId]/route.ts             |   4 +-
 app/api/notes/route.ts                        |  17 +-
 app/api/summary/route.ts                      |   7 +
 .../[taskId]/statuses/[statusId]/route.ts     |  10 +-
 app/api/tasks/[taskId]/statuses/route.ts      |   8 +-
 docker-compose.mcp.yml                        |   2 +-
 mcp-server/README.md                          |  18 +-
 mcp-server/src/jotty/client.ts                |   9 +-
 mcp-server/src/jotty/openapi.ts               |   9 +
 mcp-server/src/tools/builtins.ts              |  41 ++--
 mcp-server/src/tools/catalog.ts               |  66 +++---
 mcp-server/src/tools/errors.ts                |   2 +-
 mcp-server/src/tools/operation.ts             |  76 +++++--
 mcp-server/src/tools/register.ts              |   2 +-
 mcp-server/src/tools/result.ts                |  52 ++++-
 mcp-server/tests/helpers.ts                   |  36 +++-
 mcp-server/tests/session.test.ts              |   1 +
 mcp-server/tests/tools.test.ts                |  52 ++++-
 tests/api/kanban.test.ts                      |  14 ++
 tests/api/list-views.test.ts                  | 189 ++++++++++++++++++
 tests/api/tasks.test.ts                       |  11 +-
 tests/api/user-summary.test.ts                |  12 ++
 tests/security/kanban-grants.test.ts          |  41 ++++
 tests/security/notification-paths.test.ts     |  39 ++++
 tests/utils/api-note.test.ts                  |  55 +++++
 tests/utils/item-status-utils.test.ts         |  17 ++
 49 files changed, 962 insertions(+), 183 deletions(-)
 create mode 100644 app/_server/actions/kanban/assignee.ts
 create mode 100644 app/_utils/api-checklist.ts
 create mode 100644 app/_utils/api-note.ts
 create mode 100644 tests/api/list-views.test.ts
 create mode 100644 tests/security/notification-paths.test.ts
 create mode 100644 tests/utils/api-note.test.ts

diff --git a/app/_consts/kanban.ts b/app/_consts/kanban.ts
index c7caac146..209042891 100644
--- a/app/_consts/kanban.ts
+++ b/app/_consts/kanban.ts
@@ -28,8 +28,7 @@ export const DEFAULT_KANBAN_STATUSES: KanbanStatus[] = [
   },
 ];
 
-export const API_FALLBACK_STATUSES: KanbanStatus[] = [
-  { id: TaskStatus.TODO, label: TaskStatusLabels.TODO, order: 0 },
-  { id: TaskStatus.IN_PROGRESS, label: TaskStatusLabels.IN_PROGRESS, order: 1 },
-  { id: TaskStatus.COMPLETED, label: TaskStatusLabels.COMPLETED, order: 2 },
-];
+export const UNKNOWN_STATUS = "Status not found on this board";
+
+export const boardColumns = (statuses?: KanbanStatus[]): KanbanStatus[] =>
+  statuses?.length ? statuses : DEFAULT_KANBAN_STATUSES;
diff --git a/app/_schemas/api/checklists.ts b/app/_schemas/api/checklists.ts
index 4f03e36d1..1c3d810de 100644
--- a/app/_schemas/api/checklists.ts
+++ b/app/_schemas/api/checklists.ts
@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { apiNames } from "@/app/_schemas/api/names";
 import { ChecklistsTypes, DropPosition, KanbanPriorityLevel } from "@/app/_types/enums";
-import { categoryField, required, searchQuery, timestamp, uuidParam } from "./common";
+import { ListView, categoryField, pageFields, required, searchQuery, timestamp, uuidParam } from "./common";
 import { apiItemSchema, checklistTypeSchema, itemIndexParam, timeEntrySchema } from "./items";
 
 const TYPE_REFUSAL = "Type must be 'simple' or 'kanban'";
@@ -25,6 +25,8 @@ export const checklistSchema = z
     owner: z.string().optional(),
     isShared: z.boolean().optional().describe("True when another user shared it with you"),
     items: z.array(apiItemSchema).optional(),
+    itemCount: z.number().optional().describe("Top-level items, in the summary view"),
+    completedCount: z.number().optional().describe("Completed top-level items, in the summary view"),
     createdAt: timestamp.optional(),
     updatedAt: timestamp.optional(),
   })
@@ -37,6 +39,11 @@ export const checklistListQuery = z.object({
     .optional()
     .describe("Only checklists of this type, matched exactly: 'simple', 'kanban' or the legacy 'task'"),
   q: searchQuery.describe("Case-insensitive match on the title or any top-level item text"),
+  view: z
+    .enum(ListView)
+    .default(ListView.FULL)
+    .describe("full returns every item, summary returns item counts instead"),
+  ...pageFields,
 });
 
 export const checklistCreateBody = z.object({
@@ -94,9 +101,11 @@ export const itemReorderBody = z.object({
 export const itemCreatedSchema = z.object({
   success: z.literal(true),
   data: z
-    .object({ id: z.string().optional().describe("Id of the new item") })
-    .optional()
-    .describe("Left out when the item was added under a parent"),
+    .object({
+      id: z.string().optional().describe("Id of the new item"),
+      index: z.string().optional().describe("Tree index of the new item, for the item routes"),
+    })
+    .optional(),
 });
 
 export const listParams = uuidParam("listId", "Checklist");
diff --git a/app/_schemas/api/common.ts b/app/_schemas/api/common.ts
index b5443d940..08b1b5c5c 100644
--- a/app/_schemas/api/common.ts
+++ b/app/_schemas/api/common.ts
@@ -29,6 +29,26 @@ export const searchQuery = z
   .optional()
   .describe("Case-insensitive text filter");
 
+export enum ListView {
+  FULL = "full",
+  SUMMARY = "summary",
+}
+
+export const pageFields = {
+  limit: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .optional()
+    .describe("Most results to return, all when left out"),
+  offset: z.coerce.number().int().min(0).default(0).describe("How many results to skip"),
+};
+
+export const page = <T>(rows: T[], { limit, offset }: { limit?: number; offset: number }): T[] =>
+  rows.slice(offset, limit === undefined ? undefined : offset + limit);
+
+export const totalField = z.number().optional().describe("Matching results before limit and offset");
+
 export const uuidParam = (name: string, label: string) =>
   z.object({ [name]: z.string().describe(`${label} uuid`) });
 
diff --git a/app/_schemas/api/kanban.ts b/app/_schemas/api/kanban.ts
index 4c9461615..b0dfbc3b2 100644
--- a/app/_schemas/api/kanban.ts
+++ b/app/_schemas/api/kanban.ts
@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { apiNames } from "@/app/_schemas/api/names";
 import { KanbanPriorityLevel } from "@/app/_types/enums";
-import { categoryField, errorSchema, required, searchQuery, timestamp, uuidParam } from "./common";
+import { categoryField, envelope, errorSchema, required, searchQuery, timestamp, uuidParam } from "./common";
 import {
   checklistTypeSchema,
   kanbanStatusSchema,
@@ -116,6 +116,10 @@ export const storedBoardSchema = z
   .describe("The whole board as stored after the change, unlike the trimmed KanbanBoard. Other stored fields may appear.")
   .register(apiNames, { id: "KanbanStoredBoard" });
 
+export const cardChangedSchema = envelope(storedBoardSchema).extend({
+  item: storedCardSchema.optional().describe("The changed card on its own, so you don't have to find it in the board"),
+});
+
 export const calendarEventSchema = z
   .object({
     id: z.string().describe("Card id"),
diff --git a/app/_schemas/api/notes.ts b/app/_schemas/api/notes.ts
index 665ea8e7e..0ffc7d172 100644
--- a/app/_schemas/api/notes.ts
+++ b/app/_schemas/api/notes.ts
@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { apiNames } from "@/app/_schemas/api/names";
-import { categoryField, required, searchQuery, timestamp, uuidParam } from "./common";
+import { ListView, categoryField, pageFields, required, searchQuery, timestamp, uuidParam } from "./common";
 
 export const noteSchema = z
   .object({
@@ -8,6 +8,8 @@ export const noteSchema = z
     title: z.string(),
     category: z.string(),
     content: z.string().optional(),
+    excerpt: z.string().optional().describe("Plain-text start of the content, in the summary view. Left out for encrypted notes"),
+    encrypted: z.boolean().optional().describe("The content is ciphertext and can't be read without the passphrase or key"),
     owner: z.string().optional(),
     createdAt: timestamp.optional(),
     updatedAt: timestamp.optional(),
@@ -17,6 +19,11 @@ export const noteSchema = z
 export const noteListQuery = z.object({
   category: z.string().optional().describe("Only notes in this folder"),
   q: searchQuery,
+  view: z
+    .enum(ListView)
+    .default(ListView.FULL)
+    .describe("full returns each note's content, summary returns an excerpt instead"),
+  ...pageFields,
 });
 
 export const noteCreateBody = z.object({
diff --git a/app/_server/actions/checklist-item/editor.ts b/app/_server/actions/checklist-item/editor.ts
index ea2c3d99a..529afdc45 100644
--- a/app/_server/actions/checklist-item/editor.ts
+++ b/app/_server/actions/checklist-item/editor.ts
@@ -33,6 +33,8 @@ import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { updateAllChildren, findItem } from "@/app/_utils/item-tree-utils";
 import { isKanbanType } from "@/app/_types/enums";
 import { notifyUser } from "@/app/_server/actions/notifications/internal";
+import { assigneeRefusal } from "@/app/_server/actions/kanban/assignee";
+import { UNKNOWN_STATUS, boardColumns } from "@/app/_consts/kanban";
 import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
 
@@ -71,6 +73,13 @@ const _editItem = async (
       throw new Error("List not found");
     }
 
+    const assignee = formData.get("assignee") as string | null;
+    const previousAssignee = findItem(stored.items, itemId)?.assignee;
+    if (assignee && assignee !== previousAssignee) {
+      const refusal = await assigneeRefusal(assignee, stored.uuid!);
+      if (refusal) return { success: false, error: refusal };
+    }
+
     const _updateParentBasedOnChildren = (parent: Item): Item => {
       if ((parent.children || []).length < 1) return parent;
       return { ...parent, completed: areAllItemsCompleted(parent.children!) };
@@ -108,7 +117,6 @@ const _editItem = async (
 
     const priority = formData.get("priority") as string | null;
     const score = formData.get("score") as string | null;
-    const assignee = formData.get("assignee") as string | null;
     const reminder = formData.get("reminder") as string | null;
     const targetDate = formData.get("targetDate") as string | null;
     const startDate = formData.get("startDate") as string | null;
@@ -227,6 +235,14 @@ const _addItem = async (
       throw new Error("List not found");
     }
 
+    if (
+      status &&
+      isKanbanType(stored.type) &&
+      !boardColumns(stored.statuses).some((column) => column.id === status)
+    ) {
+      return { success: false, error: UNKNOWN_STATUS };
+    }
+
     let timeEntries: any[] = [];
     if (timeStr && timeStr !== "0") {
       try {
diff --git a/app/_server/actions/checklist-item/stamper.ts b/app/_server/actions/checklist-item/stamper.ts
index b3d8fc1ca..bf2a15222 100644
--- a/app/_server/actions/checklist-item/stamper.ts
+++ b/app/_server/actions/checklist-item/stamper.ts
@@ -19,6 +19,7 @@ import { updateItem } from "@/app/_utils/item-tree-utils";
 import { applyStatus, completeParent } from "@/app/_utils/item-status-utils";
 import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { UNKNOWN_STATUS, boardColumns } from "@/app/_consts/kanban";
 
 const _stampStatus = async (
   actor: SanitisedUser,
@@ -85,6 +86,10 @@ const _stampStatus = async (
       return { success: false, error: "Permission denied" };
     }
 
+    if (status && !boardColumns(list.statuses).some((column) => column.id === status)) {
+      return { success: false, error: UNKNOWN_STATUS };
+    }
+
     const now = new Date().toISOString();
 
     const statusItems = status
diff --git a/app/_server/actions/kanban/assignee.ts b/app/_server/actions/kanban/assignee.ts
new file mode 100644
index 000000000..56c83a3d8
--- /dev/null
+++ b/app/_server/actions/kanban/assignee.ts
@@ -0,0 +1,17 @@
+import { canReach } from "@/app/_server/actions/share/queries";
+import { findUserRecord } from "@/app/_server/actions/users/records";
+import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
+import { validateNoPathTraversal } from "@/app/_utils/path-utils";
+
+export const UNKNOWN_ASSIGNEE = "Assignee not found";
+export const BLIND_ASSIGNEE = "Assignee can't see this board";
+
+export const assigneeRefusal = async (
+  assignee: string,
+  uuid: string,
+): Promise<string | null> => {
+  if (!validateNoPathTraversal(assignee)) return UNKNOWN_ASSIGNEE;
+  if (!(await findUserRecord(assignee))) return UNKNOWN_ASSIGNEE;
+  const sees = await canReach(uuid, ItemTypes.CHECKLIST, assignee, PermissionTypes.READ);
+  return sees ? null : BLIND_ASSIGNEE;
+};
diff --git a/app/_server/actions/kanban/tweaker.ts b/app/_server/actions/kanban/tweaker.ts
index 72ce6806c..e4c61cc2a 100644
--- a/app/_server/actions/kanban/tweaker.ts
+++ b/app/_server/actions/kanban/tweaker.ts
@@ -8,13 +8,13 @@ import {
 } from "@/app/_types/enums";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { canReach, reachableFile } from "@/app/_server/actions/share/queries";
-import { findUserRecord } from "@/app/_server/actions/users/records";
+import { reachableFile } from "@/app/_server/actions/share/queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { getListById } from "@/app/_server/actions/checklist/queries";
 import { notifyUser } from "@/app/_server/actions/notifications/internal";
 import { findItem, updateItem } from "@/app/_utils/item-tree-utils";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { assigneeRefusal } from "@/app/_server/actions/kanban/assignee";
 import { failedWith } from "@/app/_server/actions/lib/read-only-message";
 
 const _tweakItem = async (
@@ -79,15 +79,6 @@ export const tweakItem = async (
     _tweakItem(actor, uuid, itemId, patch),
   );
 
-export const UNKNOWN_ASSIGNEE = "Assignee not found";
-export const BLIND_ASSIGNEE = "Assignee can't see this board";
-
-const _assigneeRefusal = async (assignee: string, uuid: string): Promise<string | null> => {
-  if (!(await findUserRecord(assignee))) return UNKNOWN_ASSIGNEE;
-  const sees = await canReach(uuid, ItemTypes.CHECKLIST, assignee, PermissionTypes.READ);
-  return sees ? null : BLIND_ASSIGNEE;
-};
-
 export const assignItem = async (
   actor: SanitisedUser,
   uuid: string,
@@ -95,7 +86,7 @@ export const assignItem = async (
   assignee: string,
 ): Promise<Result<Checklist>> => {
   try {
-    const refusal = assignee ? await _assigneeRefusal(assignee, uuid) : null;
+    const refusal = assignee ? await assigneeRefusal(assignee, uuid) : null;
     if (refusal) return { success: false, error: refusal };
 
     const result = await tweakItem(actor, uuid, itemId, {
diff --git a/app/_server/actions/notifications/internal.ts b/app/_server/actions/notifications/internal.ts
index 6a1b73e62..5bdf7363b 100644
--- a/app/_server/actions/notifications/internal.ts
+++ b/app/_server/actions/notifications/internal.ts
@@ -1,13 +1,17 @@
 import path from "path";
 import { AppNotification, AppNotificationData } from "@/app/_types";
 import { NOTIFICATIONS_FILE } from "@/app/_consts/files";
+import { validateNoPathTraversal } from "@/app/_utils/path-utils";
 import { readJsonFile, writeJsonFile, ensureDir } from "@/app/_server/actions/file";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { runQueued } from "@/app/_server/actions/lib/concurrency";
 
 const DEDUP_WINDOW_MS = 60 * 60 * 1000;
 
-const _getPath = (username: string): string => NOTIFICATIONS_FILE(username);
+const _getPath = (username: string): string => {
+  if (!validateNoPathTraversal(username)) throw new Error(`Invalid notification recipient: ${username}`);
+  return NOTIFICATIONS_FILE(username);
+};
 
 const _lane = (username: string): string => `notifications:${username}`;
 
diff --git a/app/_utils/api-checklist.ts b/app/_utils/api-checklist.ts
new file mode 100644
index 000000000..f80d3ed6d
--- /dev/null
+++ b/app/_utils/api-checklist.ts
@@ -0,0 +1,22 @@
+import { Checklist } from "@/app/_types";
+import { ChecklistsTypes, isKanbanType } from "@/app/_types/enums";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { ListView } from "@/app/_schemas/api/common";
+import { toApiItem } from "@/app/_utils/api-item";
+
+export const toApiChecklist = (list: Checklist, view: ListView = ListView.FULL) => ({
+  id: list.uuid,
+  title: list.title,
+  category: list.category || UNCATEGORIZED,
+  type: list.type || ChecklistsTypes.SIMPLE,
+  owner: list.owner,
+  isShared: list.isShared ?? false,
+  ...(view === ListView.SUMMARY
+    ? {
+        itemCount: list.items.length,
+        completedCount: list.items.filter((item) => item.completed).length,
+      }
+    : { items: list.items.map((item, index) => toApiItem(item, index, isKanbanType(list.type))) }),
+  createdAt: list.createdAt,
+  updatedAt: list.updatedAt,
+});
diff --git a/app/_utils/api-list-utils.ts b/app/_utils/api-list-utils.ts
index 8ddd764b8..b9801a6d2 100644
--- a/app/_utils/api-list-utils.ts
+++ b/app/_utils/api-list-utils.ts
@@ -25,6 +25,24 @@ export const itemAt = (items: Item[], [head, ...rest]: number[]): Item | undefin
   return itemAt(item.children || [], rest);
 };
 
+export const indexOf = (items: Item[], id: string): string | undefined => {
+  for (let position = 0; position < items.length; position++) {
+    const item = items[position];
+    if (item.id === id) return String(position);
+    const nested = item.children ? indexOf(item.children, id) : undefined;
+    if (nested !== undefined) return `${position}.${nested}`;
+  }
+  return undefined;
+};
+
+const _ids = (items: Item[]): string[] =>
+  items.flatMap((item) => [item.id, ..._ids(item.children || [])]);
+
+export const newcomerIn = (before: Item[], after: Item[]): string | undefined => {
+  const known = new Set(_ids(before));
+  return _ids(after).find((id) => !known.has(id));
+};
+
 export const itemAtIndex = (items: Item[], raw: string): { item: Item; index: number } | null => {
   const path = indexPath(raw);
   const item = path ? itemAt(items, path) : undefined;
diff --git a/app/_utils/api-note.ts b/app/_utils/api-note.ts
new file mode 100644
index 000000000..1a31e4577
--- /dev/null
+++ b/app/_utils/api-note.ts
@@ -0,0 +1,56 @@
+import { Note } from "@/app/_types";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { ListView } from "@/app/_schemas/api/common";
+import { isEncrypted } from "@/app/_utils/encryption-utils";
+
+const EXCERPT_CHARS = 200;
+
+type ListedNote = Partial<Note>;
+
+export interface ApiNote {
+  id?: string;
+  title?: string;
+  category: string;
+  content?: string;
+  excerpt?: string;
+  encrypted?: boolean;
+  createdAt?: string;
+  updatedAt?: string;
+}
+
+const _isLocked = (note: ListedNote): boolean =>
+  Boolean(note.encrypted) || isEncrypted(note.content ?? "");
+
+const _plain = (content: string): string =>
+  content
+    .replace(/```[\s\S]*?```/g, " ")
+    .replace(/<[^>]+>/g, " ")
+    .replace(/!?\[([^\]]*)\]\([^)]*\)/g, "$1")
+    .replace(/\[\[([^\]|]+)(?:\|([^\]]+))?\]\]/g, (_, target, alias) => alias || target)
+    .replace(/^\s{0,3}(#{1,6}|>|[-*+]|\d+\.)\s+/gm, "")
+    .replace(/[*_`~]/g, "")
+    .replace(/\s+/g, " ")
+    .trim();
+
+export const noteExcerpt = (content: string): string => {
+  const flat = _plain(content);
+  if (flat.length <= EXCERPT_CHARS) return flat;
+  const cut = flat.slice(0, EXCERPT_CHARS);
+  const lastSpace = cut.lastIndexOf(" ");
+  return `${lastSpace > EXCERPT_CHARS / 2 ? cut.slice(0, lastSpace) : cut}...`;
+};
+
+export const toApiNote = (note: ListedNote, view: ListView = ListView.FULL): ApiNote => {
+  const locked = _isLocked(note);
+  return {
+    id: note.uuid,
+    title: note.title,
+    category: note.category || UNCATEGORIZED,
+    ...(view === ListView.SUMMARY
+      ? { excerpt: locked ? undefined : noteExcerpt(note.content ?? "") }
+      : { content: note.content }),
+    ...(locked && { encrypted: true }),
+    createdAt: note.createdAt,
+    updatedAt: note.updatedAt,
+  };
+};
diff --git a/app/_utils/api-task.ts b/app/_utils/api-task.ts
index f7fc8c9eb..bd6db922c 100644
--- a/app/_utils/api-task.ts
+++ b/app/_utils/api-task.ts
@@ -1,7 +1,7 @@
 import { NextRequest } from "next/server";
 import { Checklist, KanbanStatus } from "@/app/_types";
 import { PermissionTypes, isKanbanType } from "@/app/_types/enums";
-import { API_FALLBACK_STATUSES } from "@/app/_consts/kanban";
+import { DEFAULT_KANBAN_STATUSES } from "@/app/_consts/kanban";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 import { getListById } from "@/app/_server/actions/checklist/queries";
 import { refuse } from "@/app/_server/api/define-route";
@@ -15,8 +15,8 @@ export type TaskStatusView = KanbanStatus & { name?: string };
 
 export type TaskLookup = { task: Checklist } | { refusal: Response };
 
-export const LEGACY_TASK_STATUSES: TaskStatusView[] = API_FALLBACK_STATUSES.map(
-  (status) => ({ id: status.id, name: status.label, label: status.label, order: status.order }),
+export const LEGACY_TASK_STATUSES: TaskStatusView[] = DEFAULT_KANBAN_STATUSES.map(
+  (status) => ({ ...status, name: status.label }),
 );
 
 export const taskStatuses = (list?: Pick<Checklist, "statuses">): TaskStatusView[] =>
diff --git a/app/_utils/item-status-utils.ts b/app/_utils/item-status-utils.ts
index 99ee66c66..ee4750964 100644
--- a/app/_utils/item-status-utils.ts
+++ b/app/_utils/item-status-utils.ts
@@ -1,5 +1,6 @@
 import { Item, KanbanStatus } from "@/app/_types";
 import { updateItem, updateAllChildren } from "@/app/_utils/item-tree-utils";
+import { boardColumns } from "@/app/_consts/kanban";
 
 const _findParent = (items: Item[], childId: string): Item | null => {
   for (const item of items) {
@@ -27,7 +28,7 @@ export const applyStatus = (
       lastModifiedAt: now,
     };
 
-    const targetStatus = statuses?.find((s) => s.id === status);
+    const targetStatus = boardColumns(statuses).find((s) => s.id === status);
     if (targetStatus?.autoComplete) {
       updates.completed = true;
       if (item.children && item.children.length > 0) {
@@ -60,7 +61,7 @@ export const completeParent = (
   const allChildrenCompleted = parent.children.every((c) => c.completed);
   if (!allChildrenCompleted) return items;
 
-  const autoCompleteStatus = statuses?.find((s) => s.autoComplete);
+  const autoCompleteStatus = boardColumns(statuses).find((s) => s.autoComplete);
   if (!autoCompleteStatus) return items;
 
   const alreadyComplete =
diff --git a/app/_utils/kanban/api-board.ts b/app/_utils/kanban/api-board.ts
index a3230d13a..551fa59ea 100644
--- a/app/_utils/kanban/api-board.ts
+++ b/app/_utils/kanban/api-board.ts
@@ -1,4 +1,4 @@
-import { NextRequest } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
 import { listUuid } from "@/app/_utils/api-utils";
 import { guard } from "@/app/_utils/api-list-utils";
 import { getListById } from "@/app/_server/actions/checklist/queries";
@@ -46,3 +46,10 @@ export const boardFor = async (
   const card = _cardIn(board.items, itemId);
   return card ? { board, card } : { refused: refuse(CARD_NOT_FOUND, 404) };
 };
+
+export const cardChanged = (board: Checklist | undefined, itemId: string) =>
+  NextResponse.json({
+    success: true,
+    data: board,
+    item: board ? _cardIn(board.items, itemId) : undefined,
+  });
diff --git a/app/api/checklists/[listId]/items/route.ts b/app/api/checklists/[listId]/items/route.ts
index 9bbcf39e7..bc5809b77 100644
--- a/app/api/checklists/[listId]/items/route.ts
+++ b/app/api/checklists/[listId]/items/route.ts
@@ -1,6 +1,8 @@
 import { NextResponse } from "next/server";
 import { turnAway } from "@/app/_utils/api-utils";
-import { findList, indexPath, isRefusal, itemAt } from "@/app/_utils/api-list-utils";
+import { findList, indexOf, indexPath, isRefusal, itemAt, newcomerIn } from "@/app/_utils/api-list-utils";
+import { getListById } from "@/app/_server/actions/checklist/queries";
+import { UNKNOWN_STATUS } from "@/app/_consts/kanban";
 import { addItem } from "@/app/_server/actions/checklist-item/editor";
 import { graftItem } from "@/app/_server/actions/checklist-item/grafter";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
@@ -20,7 +22,7 @@ export const POST = defineRoute(
     path: "/checklists/{listId}/items",
     tag: ApiTag.CHECKLIST_ITEMS,
     summary: "Add an item to a checklist",
-    description: "Adds a top-level item, or a sub-item when parentIndex is sent. Needs edit permission.",
+    description: "Adds a top-level item, or a sub-item when parentIndex is sent. A new top-level item lands first or last depending on the key owner's insertion setting, so use the index in the response rather than guessing it. Needs edit permission.",
     params: listParams,
     body: itemCreateBody,
     responses: {
@@ -55,7 +57,14 @@ export const POST = defineRoute(
         return refuse(grafted.error || "Failed to add sub-item", 500);
       }
 
-      return NextResponse.json({ success: true });
+      const childId = grafted.data ? newcomerIn(list.items, grafted.data.items) : undefined;
+      return NextResponse.json({
+        success: true,
+        data: {
+          id: childId,
+          index: childId && grafted.data ? indexOf(grafted.data.items, childId) : undefined,
+        },
+      });
     }
 
     const formData = new FormData();
@@ -67,9 +76,15 @@ export const POST = defineRoute(
 
     const result = await addItem(user, list, formData, true);
     if (!result.success) {
-      return refuse(result.error || "Failed to create item", 500);
+      const status = result.error === UNKNOWN_STATUS ? 400 : 500;
+      return refuse(result.error || "Failed to create item", status);
     }
 
-    return NextResponse.json({ success: true, data: { id: result.data?.id } });
+    const id = result.data?.id;
+    const fresh = id ? await getListById(list.uuid!, user.username) : undefined;
+    return NextResponse.json({
+      success: true,
+      data: { id, index: id && fresh ? indexOf(fresh.items, id) : undefined },
+    });
   },
 );
diff --git a/app/api/checklists/[listId]/route.ts b/app/api/checklists/[listId]/route.ts
index 14ac0b8bd..bf1879384 100644
--- a/app/api/checklists/[listId]/route.ts
+++ b/app/api/checklists/[listId]/route.ts
@@ -8,6 +8,7 @@ import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
 import { checklistSchema, checklistUpdateBody, listParams } from "@/app/_schemas/api/checklists";
 import { ChecklistsTypes } from "@/app/_types/enums";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { toApiChecklist } from "@/app/_utils/api-checklist";
 
 export const dynamic = "force-dynamic";
 
@@ -18,6 +19,30 @@ const _visibleList = async (request: NextRequest, listId: string, username: stri
   return uuid ? getListById(uuid, username) : undefined;
 };
 
+export const GET = defineRoute(
+  {
+    id: "getChecklist",
+    method: HttpMethod.GET,
+    path: "/checklists/{listId}",
+    tag: ApiTag.CHECKLISTS,
+    summary: "Get a checklist",
+    description: "One checklist with its items, including ones shared with the API key owner. Each item carries the index the item routes take.",
+    params: listParams,
+    responses: {
+      200: { description: "The checklist", schema: envelope(checklistSchema) },
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ request, user, params }) => {
+    const list = await _visibleList(request, params.listId, user.username);
+    if (!list) return refuse(NOT_FOUND, 404);
+
+    return NextResponse.json({ success: true, data: toApiChecklist(list) });
+  },
+);
+
 export const PUT = defineRoute(
   {
     id: "updateChecklist",
diff --git a/app/api/checklists/route.ts b/app/api/checklists/route.ts
index 039d70ae6..6d3fdc4a8 100644
--- a/app/api/checklists/route.ts
+++ b/app/api/checklists/route.ts
@@ -4,11 +4,11 @@ import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { makeList } from "@/app/_server/actions/checklist/creator";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
-import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { ERRORS, envelope, page, totalField } from "@/app/_schemas/api/common";
+import { toApiChecklist } from "@/app/_utils/api-checklist";
 import { checklistCreateBody, checklistListQuery, checklistSchema } from "@/app/_schemas/api/checklists";
-import { ChecklistsTypes, isKanbanType } from "@/app/_types/enums";
+import { ChecklistsTypes } from "@/app/_types/enums";
 import { Checklist, Result } from "@/app/_types";
-import { toApiItem } from "@/app/_utils/api-item";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
@@ -20,10 +20,10 @@ export const GET = defineRoute(
     path: "/checklists",
     tag: ApiTag.CHECKLISTS,
     summary: "List checklists",
-    description: "Checklists the API key owner owns or that were shared with them, items included.",
+    description: "Checklists the API key owner owns or that were shared with them, items included. Use view=summary with limit and offset to page through them with item counts instead of items.",
     query: checklistListQuery,
     responses: {
-      200: { description: "Checklists", schema: z.object({ checklists: z.array(checklistSchema) }) },
+      200: { description: "Checklists", schema: z.object({ checklists: z.array(checklistSchema), total: totalField }) },
       401: ERRORS[401],
       500: ERRORS[500],
     },
@@ -46,17 +46,8 @@ export const GET = defineRoute(
     );
 
     return NextResponse.json({
-      checklists: matches.map((list) => ({
-        id: list.uuid,
-        title: list.title,
-        category: list.category || UNCATEGORIZED,
-        type: list.type || ChecklistsTypes.SIMPLE,
-        owner: list.owner,
-        isShared: list.isShared ?? false,
-        items: list.items.map((item, index) => toApiItem(item, index, isKanbanType(list.type))),
-        createdAt: list.createdAt,
-        updatedAt: list.updatedAt,
-      })),
+      checklists: page(matches, query).map((list) => toApiChecklist(list, query.view)),
+      total: matches.length,
     });
   },
 );
diff --git a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
index 00fd95dd2..31ea62e86 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/assign/route.ts
@@ -1,10 +1,9 @@
-import { NextResponse } from "next/server";
 import { assignItem } from "@/app/_server/actions/kanban/tweaker";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
-import { ERRORS, envelope } from "@/app/_schemas/api/common";
-import { BOARD_REFUSED, cardAssignBody, cardParams, storedBoardSchema } from "@/app/_schemas/api/kanban";
-import { boardFor } from "@/app/_utils/kanban/api-board";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, cardAssignBody, cardParams, cardChangedSchema } from "@/app/_schemas/api/kanban";
+import { boardFor, cardChanged } from "@/app/_utils/kanban/api-board";
 import { PermissionTypes } from "@/app/_types/enums";
 
 export const dynamic = "force-dynamic";
@@ -20,7 +19,7 @@ export const PUT = defineRoute(
     params: cardParams,
     body: cardAssignBody,
     responses: {
-      200: { description: "The board after the change", schema: envelope(storedBoardSchema) },
+      200: { description: "The board after the change", schema: cardChangedSchema },
       400: BOARD_REFUSED,
       401: ERRORS[401],
       403: ERRORS[403],
@@ -35,6 +34,6 @@ export const PUT = defineRoute(
     const result = await assignItem(user, board.uuid, params.itemId, body.assignee || "");
     if (result.error) return refuse(result.error, 400);
 
-    return NextResponse.json({ success: true, data: result.data });
+    return cardChanged(result.data, params.itemId);
   },
 );
diff --git a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
index 5a1639a78..1ea06009c 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/reminder/route.ts
@@ -3,9 +3,9 @@ import { PermissionTypes } from "@/app/_types/enums";
 import { remindItem } from "@/app/_server/actions/kanban/tweaker";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
-import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
-import { BOARD_REFUSED, cardParams, cardReminderBody, storedBoardSchema } from "@/app/_schemas/api/kanban";
-import { boardFor } from "@/app/_utils/kanban/api-board";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, cardParams, cardReminderBody, cardChangedSchema } from "@/app/_schemas/api/kanban";
+import { boardFor, cardChanged } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
@@ -20,7 +20,7 @@ export const PUT = defineRoute(
     params: cardParams,
     body: cardReminderBody,
     responses: {
-      200: { description: "The board after the change", schema: envelope(storedBoardSchema) },
+      200: { description: "The board after the change", schema: cardChangedSchema },
       400: BOARD_REFUSED,
       401: ERRORS[401],
       403: ERRORS[403],
@@ -35,7 +35,7 @@ export const PUT = defineRoute(
     const result = await remindItem(user, board.uuid, params.itemId, JSON.stringify({ datetime: body.datetime }));
     if (result.error) return refuse(result.error, 400);
 
-    return NextResponse.json({ success: true, data: result.data });
+    return cardChanged(result.data, params.itemId);
   },
 );
 
diff --git a/app/api/kanban/[boardId]/items/[itemId]/route.ts b/app/api/kanban/[boardId]/items/[itemId]/route.ts
index a5c0da283..16f3acd2f 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/route.ts
@@ -4,9 +4,9 @@ import { removeItem } from "@/app/_server/actions/checklist-item/remover";
 import { editItem } from "@/app/_server/actions/checklist-item/editor";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
-import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
-import { BOARD_REFUSED, cardParams, cardUpdateBody, storedBoardSchema } from "@/app/_schemas/api/kanban";
-import { boardFor } from "@/app/_utils/kanban/api-board";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, cardParams, cardUpdateBody, cardChangedSchema } from "@/app/_schemas/api/kanban";
+import { boardFor, cardChanged } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
@@ -21,7 +21,7 @@ export const PUT = defineRoute(
     params: cardParams,
     body: cardUpdateBody,
     responses: {
-      200: { description: "The board after the change", schema: envelope(storedBoardSchema) },
+      200: { description: "The board after the change", schema: cardChangedSchema },
       400: BOARD_REFUSED,
       401: ERRORS[401],
       403: ERRORS[403],
@@ -44,7 +44,7 @@ export const PUT = defineRoute(
     const result = await editItem(user, board, formData);
     if (!result.success) return refuse(result.error || "Failed to update item", 400);
 
-    return NextResponse.json({ success: true, data: result.data });
+    return cardChanged(result.data, params.itemId);
   },
 );
 
@@ -55,7 +55,7 @@ export const DELETE = defineRoute(
     path: "/kanban/{boardId}/items/{itemId}",
     tag: ApiTag.KANBAN,
     summary: "Delete a card",
-    description: "Removes the card and its sub-cards. Needs delete permission on the board. Edit alone is refused with 400. An unknown card id succeeds without changing anything.",
+    description: "Removes the card and its sub-cards. Needs delete permission on the board.",
     params: cardParams,
     responses: {
       200: { description: "Deleted", schema: okSchema },
diff --git a/app/api/kanban/[boardId]/items/[itemId]/status/route.ts b/app/api/kanban/[boardId]/items/[itemId]/status/route.ts
index 48c396fb6..ce7f09dd7 100644
--- a/app/api/kanban/[boardId]/items/[itemId]/status/route.ts
+++ b/app/api/kanban/[boardId]/items/[itemId]/status/route.ts
@@ -1,11 +1,10 @@
-import { NextResponse } from "next/server";
 import { PermissionTypes } from "@/app/_types/enums";
 import { stampStatus } from "@/app/_server/actions/checklist-item/stamper";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
-import { ERRORS, envelope } from "@/app/_schemas/api/common";
-import { BOARD_REFUSED, cardParams, cardStatusBody, storedBoardSchema } from "@/app/_schemas/api/kanban";
-import { boardFor } from "@/app/_utils/kanban/api-board";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { BOARD_REFUSED, cardParams, cardStatusBody, cardChangedSchema } from "@/app/_schemas/api/kanban";
+import { boardFor, cardChanged } from "@/app/_utils/kanban/api-board";
 
 export const dynamic = "force-dynamic";
 
@@ -20,7 +19,7 @@ export const PUT = defineRoute(
     params: cardParams,
     body: cardStatusBody,
     responses: {
-      200: { description: "The board after the change", schema: envelope(storedBoardSchema) },
+      200: { description: "The board after the change", schema: cardChangedSchema },
       400: BOARD_REFUSED,
       401: ERRORS[401],
       403: ERRORS[403],
@@ -40,6 +39,6 @@ export const PUT = defineRoute(
     const result = await stampStatus(user, formData);
     if (!result.success) return refuse(result.error || "Failed to update status", 400);
 
-    return NextResponse.json({ success: true, data: result.data });
+    return cardChanged(result.data, params.itemId);
   },
 );
diff --git a/app/api/kanban/[boardId]/route.ts b/app/api/kanban/[boardId]/route.ts
index a20fbfa3f..d70fdb9be 100644
--- a/app/api/kanban/[boardId]/route.ts
+++ b/app/api/kanban/[boardId]/route.ts
@@ -44,7 +44,7 @@ export const PUT = defineRoute(
     path: "/kanban/{boardId}",
     tag: ApiTag.KANBAN,
     summary: "Rename or move a Kanban board",
-    description: "Fields left out keep their current value. Needs edit permission, and moving to another folder also needs delete on the board. A refused change answers 400.",
+    description: "Fields left out keep their current value. Needs edit permission, and moving to another folder also needs delete on the board.",
     params: boardParams,
     body: boardUpdateBody,
     responses: {
@@ -82,7 +82,7 @@ export const DELETE = defineRoute(
     path: "/kanban/{boardId}",
     tag: ApiTag.KANBAN,
     summary: "Delete a Kanban board",
-    description: "Needs delete permission on the board. Edit alone is not enough. A refused delete answers 400.",
+    description: "Needs delete permission on the board. Edit alone is not enough.",
     params: boardParams,
     responses: {
       200: { description: "Deleted", schema: okSchema },
diff --git a/app/api/notes/route.ts b/app/api/notes/route.ts
index e4c38d805..b90e049be 100644
--- a/app/api/notes/route.ts
+++ b/app/api/notes/route.ts
@@ -4,7 +4,8 @@ import { getUserNotes } from "@/app/_server/actions/note/queries";
 import { makeNote } from "@/app/_server/actions/note/creator";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
-import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { ERRORS, envelope, page, totalField } from "@/app/_schemas/api/common";
+import { toApiNote } from "@/app/_utils/api-note";
 import { noteCreateBody, noteListQuery, noteSchema } from "@/app/_schemas/api/notes";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 
@@ -17,10 +18,10 @@ export const GET = defineRoute(
     path: "/notes",
     tag: ApiTag.NOTES,
     summary: "List notes",
-    description: "Every note the API key owner can read, including shared ones.",
+    description: "Every note the API key owner can read, including shared ones. Use view=summary with limit and offset to page through titles and excerpts without loading every note's content.",
     query: noteListQuery,
     responses: {
-      200: { description: "Notes", schema: z.object({ notes: z.array(noteSchema) }) },
+      200: { description: "Notes", schema: z.object({ notes: z.array(noteSchema), total: totalField }) },
       401: ERRORS[401],
       500: ERRORS[500],
     },
@@ -41,14 +42,8 @@ export const GET = defineRoute(
     );
 
     return NextResponse.json({
-      notes: matches.map((note) => ({
-        id: note.uuid,
-        title: note.title,
-        category: note.category || UNCATEGORIZED,
-        content: note.content,
-        createdAt: note.createdAt,
-        updatedAt: note.updatedAt,
-      })),
+      notes: page(matches, query).map((note) => toApiNote(note, query.view)),
+      total: matches.length,
     });
   },
 );
diff --git a/app/api/summary/route.ts b/app/api/summary/route.ts
index 3d3e4e5dd..697ef4b21 100644
--- a/app/api/summary/route.ts
+++ b/app/api/summary/route.ts
@@ -9,9 +9,12 @@ import { summaryQuery, summarySchema } from "@/app/_schemas/api/discovery";
 import { Checklist, Result } from "@/app/_types";
 import { ChecklistsTypes, isKanbanType, TaskStatus } from "@/app/_types/enums";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { findUserRecord } from "@/app/_server/actions/users/records";
 
 export const dynamic = "force-dynamic";
 
+const NO_SUCH_USER = "User not found";
+
 const _tally = <T>(things: T[], keyOf: (thing: T) => string) =>
   things.reduce<Record<string, number>>((acc, thing) => {
     const key = keyOf(thing);
@@ -53,6 +56,7 @@ export const GET = defineRoute(
       200: { description: "Summary", schema: z.object({ summary: summarySchema }) },
       401: ERRORS[401],
       403: ERRORS[403],
+      404: { description: "No user with that username", schema: ERRORS[404].schema },
       500: ERRORS[500],
     },
   },
@@ -62,6 +66,9 @@ export const GET = defineRoute(
     }
 
     const username = query.username || user.username;
+    if (username !== user.username && !(await findUserRecord(username))) {
+      return refuse(NO_SUCH_USER, 404);
+    }
 
     const notesResult = await getUserNotes({ username });
     if (!notesResult.success || !notesResult.data) {
diff --git a/app/api/tasks/[taskId]/statuses/[statusId]/route.ts b/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
index 320c13116..b092f5393 100644
--- a/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
+++ b/app/api/tasks/[taskId]/statuses/[statusId]/route.ts
@@ -6,7 +6,7 @@ import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
 import { kanbanStatusSchema } from "@/app/_schemas/api/items";
 import { statusUpdateBody, taskStatusParams } from "@/app/_schemas/api/tasks";
 import { PermissionTypes } from "@/app/_types/enums";
-import { API_FALLBACK_STATUSES } from "@/app/_consts/kanban";
+import { DEFAULT_KANBAN_STATUSES } from "@/app/_consts/kanban";
 import { turnAway } from "@/app/_utils/api-utils";
 import { fetchTask } from "@/app/_utils/api-task";
 
@@ -38,7 +38,7 @@ export const PUT = defineRoute(
     if ("refusal" in found) return found.refusal;
     const { task } = found;
 
-    const current = task.statuses || API_FALLBACK_STATUSES;
+    const current = task.statuses || DEFAULT_KANBAN_STATUSES;
     if (!current.some((status) => status.id === params.statusId)) {
       return refuse(STATUS_NOT_FOUND, 404);
     }
@@ -47,7 +47,7 @@ export const PUT = defineRoute(
     if (refused) return refused;
 
     const result = await restatus(user, task.uuid!, (latest) =>
-      (latest || API_FALLBACK_STATUSES).map((status) =>
+      (latest || DEFAULT_KANBAN_STATUSES).map((status) =>
         status.id === params.statusId
           ? {
               ...status,
@@ -93,7 +93,7 @@ export const DELETE = defineRoute(
     if ("refusal" in found) return found.refusal;
     const { task } = found;
 
-    const current = task.statuses || API_FALLBACK_STATUSES;
+    const current = task.statuses || DEFAULT_KANBAN_STATUSES;
     if (!current.some((status) => status.id === params.statusId)) {
       return refuse(STATUS_NOT_FOUND, 404);
     }
@@ -102,7 +102,7 @@ export const DELETE = defineRoute(
     if (refused) return refused;
 
     const result = await restatus(user, task.uuid!, (latest) =>
-      (latest || API_FALLBACK_STATUSES).filter((status) => status.id !== params.statusId),
+      (latest || DEFAULT_KANBAN_STATUSES).filter((status) => status.id !== params.statusId),
     );
     if (!result.success) {
       return refuse(result.error || "Failed to delete status", 500);
diff --git a/app/api/tasks/[taskId]/statuses/route.ts b/app/api/tasks/[taskId]/statuses/route.ts
index 6a22acc4c..8bea36052 100644
--- a/app/api/tasks/[taskId]/statuses/route.ts
+++ b/app/api/tasks/[taskId]/statuses/route.ts
@@ -8,7 +8,7 @@ import { kanbanStatusSchema } from "@/app/_schemas/api/items";
 import { statusCreateBody, taskParams } from "@/app/_schemas/api/tasks";
 import { KanbanStatus } from "@/app/_types";
 import { PermissionTypes } from "@/app/_types/enums";
-import { API_FALLBACK_STATUSES } from "@/app/_consts/kanban";
+import { DEFAULT_KANBAN_STATUSES } from "@/app/_consts/kanban";
 import { turnAway } from "@/app/_utils/api-utils";
 import { fetchTask } from "@/app/_utils/api-task";
 
@@ -35,7 +35,7 @@ export const GET = defineRoute(
     const found = await fetchTask(request, params.taskId, user.username);
     if ("refusal" in found) return found.refusal;
 
-    return NextResponse.json({ statuses: found.task.statuses || API_FALLBACK_STATUSES });
+    return NextResponse.json({ statuses: found.task.statuses || DEFAULT_KANBAN_STATUSES });
   },
 );
 
@@ -63,7 +63,7 @@ export const POST = defineRoute(
     if ("refusal" in found) return found.refusal;
     const { task } = found;
 
-    const current = task.statuses || API_FALLBACK_STATUSES;
+    const current = task.statuses || DEFAULT_KANBAN_STATUSES;
     if (current.some((status) => status.id === body.id)) {
       return refuse("Status with this id already exists", 400);
     }
@@ -80,7 +80,7 @@ export const POST = defineRoute(
     if (refused) return refused;
 
     const result = await restatus(user, task.uuid!, (latest) => {
-      const fresh = latest || API_FALLBACK_STATUSES;
+      const fresh = latest || DEFAULT_KANBAN_STATUSES;
       return fresh.some((status) => status.id === body.id) ? fresh : [...fresh, created];
     });
     if (!result.success) {
diff --git a/docker-compose.mcp.yml b/docker-compose.mcp.yml
index 08e92ce42..8a8b5777d 100644
--- a/docker-compose.mcp.yml
+++ b/docker-compose.mcp.yml
@@ -33,7 +33,7 @@ services:
     depends_on:
       - jotty
     ports:
-      - "3001:3001"
+      - "1133:3001"
     networks: [jotty-net]
     restart: unless-stopped
     environment:
diff --git a/mcp-server/README.md b/mcp-server/README.md
index c5ab23c89..7475cd5b4 100644
--- a/mcp-server/README.md
+++ b/mcp-server/README.md
@@ -12,7 +12,7 @@ That means:
 
 - Pointing it at an older instance works. Tools for endpoints that instance doesn't have are left out, and `discover` lists them as unavailable.
 - A new route in Jotty is reachable straight away through `call_operation`, with no MCP release.
-- The only hand-kept list is `src/tools/catalog.ts`, the operation ids that get a dedicated tool.
+- The only hand-kept list is `src/tools/catalog.ts`: the operation ids that get a dedicated tool, plus a few per-tool defaults.
 
 ## Tools
 
@@ -26,7 +26,19 @@ Three built-in tools cover the rest:
 | `call_operation` | Calls any operation by id. Use it for tasks, statuses, reminders, exports and logs. |
 | `health` | Reports whether Jotty is reachable, its version, and whether the API key works. |
 
-Results carry the Jotty response in `structuredContent`. The visible text is the same JSON, cut off at `JOTTY_MCP_MAX_TEXT_CHARS`. Errors come back with `isError` and `{ kind, message, status, hint }`.
+Results carry the Jotty response as compact JSON, in both the text and `structuredContent`.
+
+## Keeping the context small
+
+An assistant reads every character a tool returns, so the server keeps results short:
+
+- `list_notes` and `list_checklists` default to `view=summary` and `limit=25`. Notes come back with a short plain-text excerpt instead of their content, and checklists with item counts instead of items. `total` says how many matched, and `offset` pages through them. Pass `view=full` to get everything, then `get_note` or `get_checklist` for one item.
+- A result longer than `JOTTY_MCP_MAX_TEXT_CHARS` is trimmed to the rows that fit, with a `trimmed` field saying how many were left out. A single record that is still too long is cut, and the structured copy is dropped so the client can't show the full thing anyway.
+- `update_board_item` and `move_board_item` return the changed card, not the whole board.
+- Binary downloads, such as an export zip, aren't fetched. The tool returns the URL to download it from instead.
+- Encrypted notes are never excerpted. They come back flagged `encrypted`.
+
+Errors come back with `isError` and `{ kind, message, status, hint }`. Arguments the operation doesn't take are refused with the list of the ones it does.
 
 ## Running it
 
@@ -93,7 +105,7 @@ claude mcp add --transport http jotty http://localhost:3001/mcp \
 | `JOTTY_MCP_BIND_HOST` | all interfaces | HTTP bind address |
 | `JOTTY_MCP_AUTH_TOKEN` | | Bearer token required on `/mcp` |
 | `JOTTY_MCP_TIMEOUT_MS` | `30000` | Per request timeout towards Jotty |
-| `JOTTY_MCP_MAX_TEXT_CHARS` | `12000` | Cap on the visible text of a result |
+| `JOTTY_MCP_MAX_TEXT_CHARS` | `12000` | Longest result a tool returns, in characters |
 | `JOTTY_MCP_SPEC_TTL_MS` | `300000` | How long the API spec is cached |
 | `JOTTY_MCP_LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error`, `silent`. Logs go to stderr. |
 
diff --git a/mcp-server/src/jotty/client.ts b/mcp-server/src/jotty/client.ts
index d1f2c45ae..53f807448 100644
--- a/mcp-server/src/jotty/client.ts
+++ b/mcp-server/src/jotty/client.ts
@@ -4,7 +4,7 @@ import { withDeadline } from "../utils/timeout.ts";
 
 const LOG_NS = "jotty";
 const API_PREFIX = "/api";
-const API_KEY_HEADER = "x-api-key";
+export const API_KEY_HEADER = "x-api-key";
 const JSON_TYPE = "application/json";
 
 export class JottyError extends Error {
@@ -45,7 +45,14 @@ const _url = (baseUrl: string, path: string, query?: Record<string, string>): st
   return url.toString();
 };
 
+const READABLE_MEDIA = /json|yaml|^text\/|^$/;
+
 const _decode = async (response: Response): Promise<unknown> => {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!READABLE_MEDIA.test(contentType.split(";")[0] ?? "")) {
+    await response.body?.cancel();
+    return { binary: true, contentType, bytes: Number(response.headers.get("content-length")) || undefined };
+  }
   const text = await response.text();
   if (!text) return null;
   try {
diff --git a/mcp-server/src/jotty/openapi.ts b/mcp-server/src/jotty/openapi.ts
index 324fd82c1..08dd7419f 100644
--- a/mcp-server/src/jotty/openapi.ts
+++ b/mcp-server/src/jotty/openapi.ts
@@ -30,6 +30,7 @@ export interface SpecOperation {
   security?: unknown[];
   parameters?: SpecParameter[];
   requestBody?: { content: Record<string, { schema: JsonSchema }> };
+  responses?: Record<string, { content?: Record<string, unknown> }>;
 }
 
 export interface OpenApiDocument {
@@ -42,3 +43,11 @@ export interface Operation extends SpecOperation {
   method: string;
   path: string;
 }
+
+const READABLE_MEDIA = /json|yaml|^text\//;
+const SUCCESS = "200";
+
+export const binaryMediaOf = (op: SpecOperation): string | undefined => {
+  const media = Object.keys(op.responses?.[SUCCESS]?.content ?? {});
+  return media.length && !media.some((type) => READABLE_MEDIA.test(type)) ? media[0] : undefined;
+};
diff --git a/mcp-server/src/tools/builtins.ts b/mcp-server/src/tools/builtins.ts
index c2146c5de..c2e5bd275 100644
--- a/mcp-server/src/tools/builtins.ts
+++ b/mcp-server/src/tools/builtins.ts
@@ -5,12 +5,13 @@ import { CURATED_OPERATIONS, toolNameOf } from "./catalog.ts";
 import { BuiltinTool, type ToolContext } from "./context.ts";
 import { ToolErrorKind, errorResult, fromError } from "./errors.ts";
 import { runOperation } from "./operation.ts";
-import { toolResult, type ToolResult } from "./result.ts";
+import { respond, toolResult, type ToolResult } from "./result.ts";
 import { toolInput } from "./schema.ts";
 
 const LOG_NS = "tool-builtin";
 const HEALTH_PATH = "/health";
 const READ_ONLY = { readOnlyHint: true, openWorldHint: false } as const;
+const PLUMBING_TAG = "System";
 
 export const BUILTIN_TOOLS: Tool[] = [
   {
@@ -49,33 +50,33 @@ export const BUILTIN_TOOLS: Tool[] = [
 ];
 
 const _summaryOf = (spec: Spec) =>
-  [...spec.operations.values()].map((op) => ({
-    operationId: op.operationId,
-    method: op.method.toUpperCase(),
-    path: `/api${op.path}`,
-    summary: op.summary,
-    tag: op.tags?.[0],
-    ...(op.deprecated ? { deprecated: true } : {}),
-  }));
+  [...spec.operations.values()]
+    .filter((op) => op.tags?.[0] !== PLUMBING_TAG)
+    .map((op) => ({
+      operationId: op.operationId,
+      method: op.method.toUpperCase(),
+      path: `/api${op.path}`,
+      summary: op.summary,
+      tag: op.tags?.[0],
+      ...(op.deprecated ? { deprecated: true } : {}),
+    }));
 
-const _discover = (spec: Spec, args: Record<string, unknown>): ToolResult => {
+const _discover = (ctx: ToolContext, spec: Spec, args: Record<string, unknown>): ToolResult => {
+  const limit = ctx.config.output.maxTextChars;
   if (typeof args.operationId === "string") {
     const op = spec.operations.get(args.operationId);
     if (!op) {
       return errorResult(ToolErrorKind.NotFound, `No operation called ${args.operationId}.`, "Call discover without arguments to list them.");
     }
-    const detail = { operationId: op.operationId, summary: op.summary, description: op.description, inputSchema: toolInput(spec, op).schema };
-    return toolResult(JSON.stringify(detail, null, 2), detail);
+    return respond({ operationId: op.operationId, summary: op.summary, description: op.description, inputSchema: toolInput(spec, op).schema }, limit);
   }
 
   const operations = _summaryOf(spec).filter((op) => !args.tag || op.tag === args.tag);
+  if (args.tag) return respond({ version: spec.version, operations }, limit);
+
   const tools = CURATED_OPERATIONS.filter((id) => spec.operations.has(id)).map(toolNameOf);
-  const missing = CURATED_OPERATIONS.filter((id) => !spec.operations.has(id)).map(toolNameOf);
-  const lines = operations.map((op) => `${op.operationId}: ${op.method} ${op.path} - ${op.summary}`);
-  return toolResult(
-    [`Jotty ${spec.version}, ${operations.length} operations.`, ...lines].join("\n"),
-    { version: spec.version, tools, unavailableTools: missing, operations },
-  );
+  const unavailableTools = CURATED_OPERATIONS.filter((id) => !spec.operations.has(id)).map(toolNameOf);
+  return respond({ version: spec.version, tools, unavailableTools, operations }, limit);
 };
 
 const _call = (ctx: ToolContext, spec: Spec, args: Record<string, unknown>, signal?: AbortSignal) => {
@@ -86,7 +87,7 @@ const _call = (ctx: ToolContext, spec: Spec, args: Record<string, unknown>, sign
     );
   }
   const inner = args.arguments && typeof args.arguments === "object" ? (args.arguments as Record<string, unknown>) : {};
-  return runOperation(ctx, spec, op, inner, signal);
+  return runOperation(ctx, spec, op, inner, { signal });
 };
 
 const _health = async (ctx: ToolContext, signal?: AbortSignal): Promise<ToolResult> => {
@@ -118,7 +119,7 @@ export const runBuiltin = async (
   if (name === BuiltinTool.Health) return _health(ctx, signal);
   try {
     const spec = await ctx.specs.load(ctx.client, signal);
-    return name === BuiltinTool.Discover ? _discover(spec, args) : await _call(ctx, spec, args, signal);
+    return name === BuiltinTool.Discover ? _discover(ctx, spec, args) : await _call(ctx, spec, args, signal);
   } catch (err) {
     logger.warn(LOG_NS, `${name} could not load the API spec`, err);
     return fromError(err);
diff --git a/mcp-server/src/tools/catalog.ts b/mcp-server/src/tools/catalog.ts
index 71596da93..6fb625ab9 100644
--- a/mcp-server/src/tools/catalog.ts
+++ b/mcp-server/src/tools/catalog.ts
@@ -1,29 +1,43 @@
-export const CURATED_OPERATIONS = [
-  "search",
-  "listCategories",
-  "getSummary",
-  "getCurrentUser",
-  "listNotes",
-  "getNote",
-  "createNote",
-  "updateNote",
-  "deleteNote",
-  "listChecklists",
-  "createChecklist",
-  "updateChecklist",
-  "deleteChecklist",
-  "createChecklistItem",
-  "updateChecklistItem",
-  "deleteChecklistItem",
-  "checkChecklistItem",
-  "uncheckChecklistItem",
-  "listBoards",
-  "getBoard",
-  "createBoard",
-  "createBoardItem",
-  "updateBoardItem",
-  "moveBoardItem",
-] as const;
+export interface CatalogEntry {
+  id: string;
+  defaults?: Record<string, unknown>;
+  pick?: string;
+}
+
+const SUMMARY_PAGE = { view: "summary", limit: 25 };
+
+export const CATALOG: CatalogEntry[] = [
+  { id: "search" },
+  { id: "listCategories" },
+  { id: "getSummary" },
+  { id: "getCurrentUser" },
+  { id: "listNotes", defaults: SUMMARY_PAGE },
+  { id: "getNote" },
+  { id: "createNote" },
+  { id: "updateNote" },
+  { id: "deleteNote" },
+  { id: "listChecklists", defaults: SUMMARY_PAGE },
+  { id: "getChecklist" },
+  { id: "createChecklist" },
+  { id: "updateChecklist" },
+  { id: "deleteChecklist" },
+  { id: "createChecklistItem" },
+  { id: "updateChecklistItem" },
+  { id: "deleteChecklistItem" },
+  { id: "checkChecklistItem" },
+  { id: "uncheckChecklistItem" },
+  { id: "listBoards" },
+  { id: "getBoard" },
+  { id: "createBoard" },
+  { id: "createBoardItem" },
+  { id: "updateBoardItem", pick: "item" },
+  { id: "moveBoardItem", pick: "item" },
+];
+
+export const CURATED_OPERATIONS = CATALOG.map((entry) => entry.id);
+
+export const catalogEntry = (operationId: string): CatalogEntry | undefined =>
+  CATALOG.find((entry) => entry.id === operationId);
 
 export const toolNameOf = (operationId: string): string =>
   operationId.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
diff --git a/mcp-server/src/tools/errors.ts b/mcp-server/src/tools/errors.ts
index 701bd6eb1..fa3e148d1 100644
--- a/mcp-server/src/tools/errors.ts
+++ b/mcp-server/src/tools/errors.ts
@@ -29,7 +29,7 @@ const HINTS: Partial<Record<ToolErrorKind, string>> = {
   [ToolErrorKind.Input]: "Check the arguments against the tool's input schema.",
   [ToolErrorKind.Auth]: "The Jotty API key is missing or wrong. Check JOTTY_API_KEY or the x-api-key header.",
   [ToolErrorKind.Forbidden]: "The API key owner doesn't hold the permission for that action on that item.",
-  [ToolErrorKind.NotFound]: "Nothing with that id is visible to the API key owner. List first to get a valid id.",
+  [ToolErrorKind.NotFound]: "It doesn't exist or the API key owner can't see it. List or search first to get a valid id.",
   [ToolErrorKind.Timeout]: "Jotty is slow or unreachable. Try the health tool.",
   [ToolErrorKind.Upstream]: "Try the health tool to see whether Jotty is reachable.",
 };
diff --git a/mcp-server/src/tools/operation.ts b/mcp-server/src/tools/operation.ts
index a826dd729..aaa2f5a6f 100644
--- a/mcp-server/src/tools/operation.ts
+++ b/mcp-server/src/tools/operation.ts
@@ -1,14 +1,16 @@
 import type { Tool } from "@modelcontextprotocol/sdk/types.js";
-import type { Operation } from "../jotty/openapi.ts";
+import { binaryMediaOf, type JsonSchema, type Operation } from "../jotty/openapi.ts";
+import { API_KEY_HEADER, JottyError } from "../jotty/client.ts";
 import type { Spec } from "../jotty/spec.ts";
 import { ToolErrorKind, errorResult, fromError } from "./errors.ts";
-import { asRecord, render, toolResult, type ToolResult } from "./result.ts";
+import { respond, toolResult, type ToolResult } from "./result.ts";
 import type { ToolContext } from "./context.ts";
 import { fillPath, splitArgs, toolInput } from "./schema.ts";
-import { toolNameOf } from "./catalog.ts";
+import { catalogEntry, toolNameOf } from "./catalog.ts";
 import { logger } from "../utils/logger.ts";
 
 const LOG_NS = "tool-operation";
+const SERVER_ERROR = 500;
 
 enum Verb {
   Get = "get",
@@ -32,37 +34,77 @@ export const annotationsOf = (op: Operation): Tool["annotations"] => ({
   openWorldHint: false,
 });
 
+const _withDefaults = (schema: JsonSchema, defaults: Record<string, unknown> = {}): JsonSchema => ({
+  ...schema,
+  properties: Object.fromEntries(
+    Object.entries(schema.properties ?? {}).map(([name, prop]) => [
+      name,
+      name in defaults ? { ...prop, default: defaults[name] } : prop,
+    ]),
+  ),
+});
+
 export const operationTool = (spec: Spec, op: Operation): Tool => ({
   name: toolNameOf(op.operationId),
   description: describe(op),
-  inputSchema: toolInput(spec, op).schema as Tool["inputSchema"],
+  inputSchema: _withDefaults(toolInput(spec, op).schema, catalogEntry(op.operationId)?.defaults) as Tool["inputSchema"],
   annotations: annotationsOf(op),
 });
 
+const _picked = (data: unknown, field?: string): unknown => {
+  if (!field || !data || typeof data !== "object" || !(field in data)) return data;
+  const record = data as Record<string, unknown>;
+  return { success: record.success, [field]: record[field] };
+};
+
+const _download = (ctx: ToolContext, path: string, contentType: string): ToolResult => {
+  const report = { download: `${ctx.client.baseUrl}/api${path}`, contentType, header: API_KEY_HEADER };
+  return toolResult(
+    `This returns a file (${contentType}), which doesn't fit through MCP. Download it from ${report.download} with the ${API_KEY_HEADER} header.`,
+    report,
+  );
+};
+
+export interface RunOptions {
+  signal?: AbortSignal;
+  curated?: boolean;
+}
+
 export const runOperation = async (
   ctx: ToolContext,
   spec: Spec,
   op: Operation,
   args: Record<string, unknown>,
-  signal?: AbortSignal,
+  { signal, curated = false }: RunOptions = {},
 ): Promise<ToolResult> => {
-  const { layout } = toolInput(spec, op);
+  const { schema, layout } = toolInput(spec, op);
+  const entry = curated ? catalogEntry(op.operationId) : undefined;
+  const known = Object.keys(schema.properties ?? {});
+  const unknown = Object.keys(args).filter((name) => !known.includes(name));
+  if (unknown.length) {
+    return errorResult(
+      ToolErrorKind.Input,
+      `Unknown argument ${unknown.join(", ")}.`,
+      known.length ? `${op.operationId} takes: ${known.join(", ")}.` : `${op.operationId} takes no arguments.`,
+    );
+  }
   const missing = layout.path.filter((name) => args[name] === undefined || args[name] === "");
   if (missing.length) {
-    return errorResult(ToolErrorKind.Input, `Missing ${missing.join(", ")}.`, "List first to get a valid id.");
+    return errorResult(ToolErrorKind.Input, `Missing ${missing.join(", ")}.`, `Pass ${missing.join(" and ")}. List or search first if you don't have the id.`);
   }
+  const defaults = Object.fromEntries(
+    Object.entries(entry?.defaults ?? {}).filter(([name]) => known.includes(name)),
+  );
+  const parts = splitArgs(layout, { ...defaults, ...args });
+  const path = fillPath(op.path, parts.path);
+  const binary = binaryMediaOf(op);
+  if (binary) return _download(ctx, path, binary);
   try {
-    const parts = splitArgs(layout, args);
-    const response = await ctx.client.send({
-      method: op.method,
-      path: fillPath(op.path, parts.path),
-      query: parts.query,
-      body: parts.body,
-      signal,
-    });
-    return toolResult(render(response.data, ctx.config.output.maxTextChars), asRecord(response.data));
+    const response = await ctx.client.send({ method: op.method, path, query: parts.query, body: parts.body, signal });
+    return respond(_picked(response.data, entry?.pick), ctx.config.output.maxTextChars);
   } catch (err) {
-    logger.warn(LOG_NS, `${op.operationId} failed`, err);
+    const refused = err instanceof JottyError && err.status < SERVER_ERROR;
+    (refused ? logger.debug : logger.warn)(LOG_NS, `${op.operationId} failed`, err);
     return fromError(err);
   }
 };
diff --git a/mcp-server/src/tools/register.ts b/mcp-server/src/tools/register.ts
index 16576070b..e970e176c 100644
--- a/mcp-server/src/tools/register.ts
+++ b/mcp-server/src/tools/register.ts
@@ -42,6 +42,6 @@ export const registerTools = (server: Server, ctx: ToolContext): void => {
     if (!spec || !op) {
       return errorResult(ToolErrorKind.Unsupported, `This Jotty instance has no ${name} tool.`, "Use discover to see what it offers.");
     }
-    return runOperation(ctx, spec, op, args, extra.signal);
+    return runOperation(ctx, spec, op, args, { signal: extra.signal, curated: true });
   });
 };
diff --git a/mcp-server/src/tools/result.ts b/mcp-server/src/tools/result.ts
index 48f499c3c..ca0435660 100644
--- a/mcp-server/src/tools/result.ts
+++ b/mcp-server/src/tools/result.ts
@@ -5,19 +5,61 @@ export interface ToolResult {
   isError?: boolean;
 }
 
-const TRUNCATED = "\n... truncated, the full response is in structuredContent";
+export interface Trimmed {
+  field: string;
+  shown: number;
+  of: number;
+  hint: string;
+}
+
+const MORE_ROWS = "Pass offset to read the next rows, or narrow the request with a filter or view=summary.";
+const CUT_TEXT = "Narrow the request with a filter, limit and offset, or view=summary.";
+
+type Row = Record<string, unknown>;
 
 export const asRecord = (data: unknown): Record<string, unknown> =>
   data && typeof data === "object" && !Array.isArray(data)
     ? (data as Record<string, unknown>)
     : { result: data };
 
-export const render = (data: unknown, maxChars: number): string => {
-  const text = typeof data === "string" ? data : JSON.stringify(data, null, 2);
-  return text.length > maxChars ? `${text.slice(0, maxChars)}${TRUNCATED}` : text;
-};
+const _json = (data: unknown): string => (typeof data === "string" ? data : JSON.stringify(data));
 
 export const toolResult = (text: string, structured?: Record<string, unknown>): ToolResult => ({
   content: [{ type: "text", text }],
   ...(structured ? { structuredContent: structured } : {}),
 });
+
+const _longestList = (record: Row): string | undefined =>
+  Object.entries(record)
+    .filter(([, value]) => Array.isArray(value) && value.length > 1)
+    .sort(([, a], [, b]) => _json(b).length - _json(a).length)[0]?.[0];
+
+const _withRows = (record: Row, field: string, rows: unknown[], of: number): Row => ({
+  ...record,
+  [field]: rows,
+  trimmed: { field, shown: rows.length, of, hint: MORE_ROWS } satisfies Trimmed,
+});
+
+const _fitRows = (record: Row, field: string, maxChars: number): Row | null => {
+  const rows = record[field] as unknown[];
+  let low = 0;
+  let high = rows.length - 1;
+  while (low < high) {
+    const mid = Math.ceil((low + high) / 2);
+    if (_json(_withRows(record, field, rows.slice(0, mid), rows.length)).length <= maxChars) low = mid;
+    else high = mid - 1;
+  }
+  return low > 0 ? _withRows(record, field, rows.slice(0, low), rows.length) : null;
+};
+
+export const respond = (data: unknown, maxChars: number): ToolResult => {
+  const text = _json(data);
+  if (text.length <= maxChars) return toolResult(text, asRecord(data));
+
+  const record = asRecord(data);
+  const field = _longestList(record);
+  const fitted = field ? _fitRows(record, field, maxChars) : null;
+  if (fitted) return toolResult(_json(fitted), fitted);
+
+  return toolResult(`${text.slice(0, maxChars)}\n... cut at ${maxChars} of ${text.length} characters. ${CUT_TEXT}`);
+};
diff --git a/mcp-server/tests/helpers.ts b/mcp-server/tests/helpers.ts
index 1b9ba31fc..1e7759d79 100644
--- a/mcp-server/tests/helpers.ts
+++ b/mcp-server/tests/helpers.ts
@@ -22,6 +22,8 @@ export interface FakeJotty {
 }
 
 const NOTE = { id: "n-1", title: "Milk", category: "Uncategorized", content: "" };
+const CARD = { id: "c-1", text: "Write tests", status: "todo" };
+const MANY_NOTES = Array.from({ length: 30 }, (_, n) => ({ ...NOTE, id: `n-${n}`, content: "x".repeat(50) }));
 
 export const FAKE_SPEC: OpenApiDocument = {
   info: { title: "Jotty API", version: "9.9.9" },
@@ -31,7 +33,11 @@ export const FAKE_SPEC: OpenApiDocument = {
         operationId: "listNotes",
         summary: "List notes",
         tags: ["Notes"],
-        parameters: [{ name: "q", in: "query" as never, required: false, schema: { type: "string" } }],
+        parameters: [
+          { name: "q", in: "query" as never, required: false, schema: { type: "string" } },
+          { name: "view", in: "query" as never, required: false, schema: { type: "string", default: "full" } },
+          { name: "limit", in: "query" as never, required: false, schema: { type: "integer" } },
+        ],
       },
       post: {
         operationId: "createNote",
@@ -60,6 +66,27 @@ export const FAKE_SPEC: OpenApiDocument = {
         parameters: [{ name: "noteId", in: "path" as never, required: true, schema: { type: "string" } }],
       },
     },
+    "/exports/{filename}": {
+      get: {
+        operationId: "downloadExport",
+        summary: "Download an export",
+        tags: ["Exports"],
+        parameters: [{ name: "filename", in: "path" as never, required: true, schema: { type: "string" } }],
+        responses: { "200": { content: { "application/zip": {} } } },
+      },
+    },
+    "/kanban/{boardId}/items/{itemId}": {
+      put: {
+        operationId: "updateBoardItem",
+        summary: "Update a card",
+        tags: ["Kanban"],
+        parameters: [
+          { name: "boardId", in: "path" as never, required: true, schema: { type: "string" } },
+          { name: "itemId", in: "path" as never, required: true, schema: { type: "string" } },
+        ],
+        requestBody: { content: { "application/json": { schema: { type: "object", properties: { text: { type: "string" } } } } } },
+      },
+    },
     "/tasks/{taskId}/statuses": {
       post: {
         operationId: "createTaskStatus",
@@ -94,7 +121,13 @@ export const serveJotty = (spec: OpenApiDocument = FAKE_SPEC): FakeJotty => {
       if (url.pathname === "/api/health") return _json({ status: "healthy", version: spec.info.version });
       if (apiKey !== API_KEY) return _json({ error: "Unauthorized" }, 401);
       if (url.pathname === "/api/openapi.json") return _json(spec);
+      if (url.pathname === "/api/notes" && url.searchParams.get("q") === "many") {
+        return _json({ notes: MANY_NOTES, total: MANY_NOTES.length });
+      }
       if (url.pathname === "/api/notes") return _json(request.method === "GET" ? { notes: [NOTE] } : { success: true, data: NOTE });
+      if (url.pathname.startsWith("/api/kanban/")) {
+        return _json({ success: true, data: { uuid: "b-1", items: [CARD, { ...CARD, id: "c-2" }] }, item: CARD });
+      }
       if (url.pathname === "/api/notes/n-1") return _json({ success: true, data: NOTE });
       if (url.pathname.startsWith("/api/notes/")) return _json({ error: "Note not found" }, 404);
       return _json({ success: true });
@@ -105,6 +138,7 @@ export const serveJotty = (spec: OpenApiDocument = FAKE_SPEC): FakeJotty => {
 
 export const makeConfig = (url: string, overrides: Partial<McpConfig["jotty"]> = {}): McpConfig => ({
   ...DEFAULT_CONFIG,
+  output: { ...DEFAULT_CONFIG.output },
   jotty: { ...DEFAULT_CONFIG.jotty, url, apiKey: API_KEY, ...overrides },
 });
 
diff --git a/mcp-server/tests/session.test.ts b/mcp-server/tests/session.test.ts
index d5644d762..74af4b6ba 100644
--- a/mcp-server/tests/session.test.ts
+++ b/mcp-server/tests/session.test.ts
@@ -51,6 +51,7 @@ describe("http transport", () => {
       "get_note",
       "create_note",
       "delete_note",
+      "update_board_item",
       "discover",
       "call_operation",
       "health",
diff --git a/mcp-server/tests/tools.test.ts b/mcp-server/tests/tools.test.ts
index f833570c0..9655c4c91 100644
--- a/mcp-server/tests/tools.test.ts
+++ b/mcp-server/tests/tools.test.ts
@@ -42,12 +42,54 @@ describe("runOperation", () => {
     expect(structured(result).error).toMatchObject({ kind: "auth", status: 401 });
   });
 
-  it("truncates long visible text but keeps the full structured result", async () => {
+  it("trims a long list to the rows that fit and says how many are left", async () => {
+    const ctx = makeCtx(jotty.url);
+    ctx.config.output.maxTextChars = 1_000;
+    const result = await runOperation(ctx, spec, op("listNotes"), { q: "many" });
+    const data = structured(result);
+    expect(text(result).length).toBeLessThanOrEqual(1_000);
+    expect((data.notes as unknown[]).length).toBeLessThan(30);
+    expect(data.trimmed).toMatchObject({ field: "notes", of: 30 });
+  });
+
+  it("cuts an oversized single record and leaves out the structured copy", async () => {
     const ctx = makeCtx(jotty.url);
     ctx.config.output.maxTextChars = 20;
-    const result = await runOperation(ctx, spec, op("listNotes"), {});
-    expect(text(result)).toContain("truncated");
-    expect(structured(result)).toHaveProperty("notes");
+    const result = await runOperation(ctx, spec, op("getNote"), { noteId: "n-1" });
+    expect(text(result)).toContain("cut at 20");
+    expect(result.structuredContent).toBeUndefined();
+  });
+
+  it("applies the catalog defaults to curated tools only", async () => {
+    await runOperation(makeCtx(jotty.url), spec, op("listNotes"), {}, { curated: true });
+    expect(jotty.hits.at(-1)?.path).toBe("/api/notes?view=summary&limit=25");
+    await runOperation(makeCtx(jotty.url), spec, op("listNotes"), {});
+    expect(jotty.hits.at(-1)?.path).toBe("/api/notes");
+  });
+
+  it("lets the caller override a catalog default", async () => {
+    await runOperation(makeCtx(jotty.url), spec, op("listNotes"), { view: "full" }, { curated: true });
+    expect(jotty.hits.at(-1)?.path).toBe("/api/notes?view=full&limit=25");
+  });
+
+  it("refuses arguments the operation doesn't take", async () => {
+    const before = jotty.hits.length;
+    const result = await runOperation(makeCtx(jotty.url), spec, op("getNote"), { id: "n-1" });
+    expect(structured(result).error).toMatchObject({ kind: "input", message: "Unknown argument id." });
+    expect(text(result)).toContain("getNote takes: noteId");
+    expect(jotty.hits.length).toBe(before);
+  });
+
+  it("hands back a download link instead of fetching a binary file", async () => {
+    const before = jotty.hits.length;
+    const result = await runOperation(makeCtx(jotty.url), spec, op("downloadExport"), { filename: "a.zip" });
+    expect(structured(result)).toMatchObject({ download: `${jotty.url}/api/exports/a.zip`, contentType: "application/zip" });
+    expect(jotty.hits.length).toBe(before);
+  });
+
+  it("returns only the changed card from curated card tools", async () => {
+    const result = await runOperation(makeCtx(jotty.url), spec, op("updateBoardItem"), { boardId: "b-1", itemId: "c-1", text: "x" }, { curated: true });
+    expect(structured(result)).toEqual({ success: true, item: { id: "c-1", text: "Write tests", status: "todo" } });
   });
 });
 
@@ -56,7 +98,7 @@ describe("builtins", () => {
     const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.Discover, {});
     const data = structured(result);
     expect(data.version).toBe("9.9.9");
-    expect(data.tools).toEqual(["list_notes", "get_note", "create_note", "delete_note"]);
+    expect(data.tools).toEqual(["list_notes", "get_note", "create_note", "delete_note", "update_board_item"]);
     expect(data.unavailableTools).toContain("list_boards");
   });
 
diff --git a/tests/api/kanban.test.ts b/tests/api/kanban.test.ts
index 0354cbaac..4abea09a2 100644
--- a/tests/api/kanban.test.ts
+++ b/tests/api/kanban.test.ts
@@ -418,6 +418,20 @@ describe("Kanban API", () => {
   })
 
   describe("PUT /api/kanban/:boardId/items/:itemId", () => {
+    it("returns the changed card next to the board", async () => {
+      mockEditItem.mockResolvedValue({ success: true, data: board() })
+
+      const response = await UPDATE_CARD(
+        createMockRequest("PUT", `${BASE}/${BOARD_UUID}/items/card-1`, { priority: "low" }),
+        cardParams(),
+      )
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(200)
+      expect(data.data.uuid).toBe(BOARD_UUID)
+      expect(data.item.id).toBe("card-1")
+    })
+
     it("forwards only the fields that were sent", async () => {
       mockEditItem.mockResolvedValue({ success: true, data: board() })
 
diff --git a/tests/api/list-views.test.ts b/tests/api/list-views.test.ts
new file mode 100644
index 000000000..65f25043c
--- /dev/null
+++ b/tests/api/list-views.test.ts
@@ -0,0 +1,189 @@
+import { describe, it, expect, beforeEach } from "vitest"
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  mockGetUserNotes,
+  mockGetUserChecklists,
+  mockGetListById,
+  mockAddItem,
+  mockGraftItem,
+  mockCanReach,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup"
+
+import { GET as LIST_NOTES } from "@/app/api/notes/route"
+import { GET as LIST_CHECKLISTS } from "@/app/api/checklists/route"
+import { GET as GET_CHECKLIST } from "@/app/api/checklists/[listId]/route"
+import { POST as CREATE_ITEM } from "@/app/api/checklists/[listId]/items/route"
+
+const LIST_UUID = "7b1d2c3e-4f50-4a6b-8c7d-9e0f1a2b3c4d"
+
+const notes = Array.from({ length: 5 }, (_, n) => ({
+  id: `note-${n}`,
+  uuid: `uuid-${n}`,
+  title: `Note ${n}`,
+  category: "Work",
+  owner: mockUser.username,
+  content: `# Heading ${n}\n\nBody of note ${n}`,
+}))
+
+type Row = { id: string; text: string; completed: boolean; children?: Row[] }
+
+const list = (items: Row[] = [{ id: "a", text: "milk", completed: true }, { id: "b", text: "bread", completed: false }]) => ({
+  id: "groceries",
+  uuid: LIST_UUID,
+  title: "Groceries",
+  category: "Home",
+  type: "simple",
+  owner: mockUser.username,
+  items,
+})
+
+const listParams = () => ({ params: Promise.resolve({ listId: LIST_UUID }) })
+
+describe("List views and paging", () => {
+  beforeEach(() => {
+    resetApiMocks()
+    mockAuthenticateApiKey.mockResolvedValue(mockUser)
+    mockCanReach.mockResolvedValue(true)
+  })
+
+  describe("GET /api/notes", () => {
+    it("keeps returning full content by default", async () => {
+      mockGetUserNotes.mockResolvedValue({ success: true, data: notes })
+
+      const data = await getResponseJson(await LIST_NOTES(createMockRequest("GET", "http://localhost:3000/api/notes")))
+
+      expect(data.notes).toHaveLength(5)
+      expect(data.notes[0].content).toBe(notes[0].content)
+      expect(data.total).toBe(5)
+    })
+
+    it("returns titles and excerpts in the summary view", async () => {
+      mockGetUserNotes.mockResolvedValue({ success: true, data: notes })
+
+      const data = await getResponseJson(
+        await LIST_NOTES(createMockRequest("GET", "http://localhost:3000/api/notes?view=summary")),
+      )
+
+      expect(data.notes[0]).not.toHaveProperty("content")
+      expect(data.notes[0].excerpt).toBe("Heading 0 Body of note 0")
+    })
+
+    it("pages with limit and offset and reports the total", async () => {
+      mockGetUserNotes.mockResolvedValue({ success: true, data: notes })
+
+      const data = await getResponseJson(
+        await LIST_NOTES(createMockRequest("GET", "http://localhost:3000/api/notes?limit=2&offset=1")),
+      )
+
+      expect(data.notes.map((note: { id: string }) => note.id)).toEqual(["uuid-1", "uuid-2"])
+      expect(data.total).toBe(5)
+    })
+
+    it("refuses a limit below 1", async () => {
+      mockGetUserNotes.mockResolvedValue({ success: true, data: notes })
+
+      const response = await LIST_NOTES(createMockRequest("GET", "http://localhost:3000/api/notes?limit=0"))
+
+      expect(response.status).toBe(400)
+    })
+  })
+
+  describe("GET /api/checklists", () => {
+    it("returns counts instead of items in the summary view", async () => {
+      mockGetUserChecklists.mockResolvedValue({ success: true, data: [list()] })
+
+      const data = await getResponseJson(
+        await LIST_CHECKLISTS(createMockRequest("GET", "http://localhost:3000/api/checklists?view=summary")),
+      )
+
+      expect(data.checklists[0]).not.toHaveProperty("items")
+      expect(data.checklists[0].itemCount).toBe(2)
+      expect(data.checklists[0].completedCount).toBe(1)
+      expect(data.total).toBe(1)
+    })
+  })
+
+  describe("GET /api/checklists/:listId", () => {
+    it("returns one checklist with indexed items", async () => {
+      mockGetListById.mockResolvedValue(list())
+
+      const response = await GET_CHECKLIST(
+        createMockRequest("GET", `http://localhost:3000/api/checklists/${LIST_UUID}`),
+        listParams(),
+      )
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(200)
+      expect(data.data.id).toBe(LIST_UUID)
+      expect(data.data.items.map((item: { index: number }) => item.index)).toEqual([0, 1])
+    })
+
+    it("answers 404 for a list the key owner can't see", async () => {
+      mockGetListById.mockResolvedValue(undefined)
+
+      const response = await GET_CHECKLIST(
+        createMockRequest("GET", `http://localhost:3000/api/checklists/${LIST_UUID}`),
+        listParams(),
+      )
+
+      expect(response.status).toBe(404)
+    })
+  })
+
+  describe("POST /api/checklists/:listId/items", () => {
+    it("returns the index the new item landed on", async () => {
+      mockGetListById
+        .mockResolvedValueOnce(list())
+        .mockResolvedValueOnce(list([{ id: "new", text: "eggs", completed: false }, ...list().items]))
+      mockAddItem.mockResolvedValue({ success: true, data: { id: "new" } })
+
+      const data = await getResponseJson(
+        await CREATE_ITEM(
+          createMockRequest("POST", `http://localhost:3000/api/checklists/${LIST_UUID}/items`, { text: "eggs" }),
+          listParams(),
+        ),
+      )
+
+      expect(data.data).toEqual({ id: "new", index: "0" })
+    })
+
+    it("returns the id and index of a new sub-item", async () => {
+      mockGetListById.mockResolvedValue(list())
+      mockGraftItem.mockResolvedValue({
+        success: true,
+        data: list([
+          { id: "a", text: "milk", completed: true },
+          { id: "b", text: "bread", completed: false, children: [{ id: "b-sub", text: "sourdough", completed: false }] },
+        ]),
+      })
+
+      const data = await getResponseJson(
+        await CREATE_ITEM(
+          createMockRequest("POST", `http://localhost:3000/api/checklists/${LIST_UUID}/items`, {
+            text: "sourdough",
+            parentIndex: "1",
+          }),
+          listParams(),
+        ),
+      )
+
+      expect(data.data).toEqual({ id: "b-sub", index: "1.0" })
+    })
+
+    it("answers 400 for a status the board doesn't have", async () => {
+      mockGetListById.mockResolvedValue(list())
+      mockAddItem.mockResolvedValue({ success: false, error: "Status not found on this board" })
+
+      const response = await CREATE_ITEM(
+        createMockRequest("POST", `http://localhost:3000/api/checklists/${LIST_UUID}/items`, { text: "x", status: "done" }),
+        listParams(),
+      )
+
+      expect(response.status).toBe(400)
+    })
+  })
+})
diff --git a/tests/api/tasks.test.ts b/tests/api/tasks.test.ts
index e776db88b..3120bbb51 100644
--- a/tests/api/tasks.test.ts
+++ b/tests/api/tasks.test.ts
@@ -732,7 +732,7 @@ describe("Tasks API", () => {
   describe("default statuses", () => {
     const bareTask = { ...mockTask, statuses: undefined }
 
-    it("sends label alongside the legacy name when a task has no stored statuses", async () => {
+    it("sends the board's default columns, with the legacy name, when a task has no stored statuses", async () => {
       mockGetListById.mockResolvedValue(bareTask)
 
       const request = createMockRequest("GET", "http://localhost:3000/api/tasks/task-uuid-1")
@@ -741,9 +741,10 @@ describe("Tasks API", () => {
 
       expect(response.status).toBe(200)
       expect(data.task.statuses).toEqual([
-        { id: "todo", label: "To Do", name: "To Do", order: 0 },
-        { id: "in_progress", label: "In Progress", name: "In Progress", order: 1 },
-        { id: "completed", label: "Completed", name: "Completed", order: 2 },
+        { id: "todo", label: "To Do", name: "To Do", order: 0, autoComplete: false },
+        { id: "in_progress", label: "In Progress", name: "In Progress", order: 1, autoComplete: false },
+        { id: "completed", label: "Completed", name: "Completed", order: 2, autoComplete: true },
+        { id: "paused", label: "Paused", name: "Paused", order: 3, autoComplete: false },
       ])
     })
 
@@ -764,7 +765,7 @@ describe("Tasks API", () => {
       )
 
       ;[listed.tasks[0], created.data, updated.data].forEach((task) => {
-        expect(task.statuses[0]).toEqual({ id: "todo", label: "To Do", name: "To Do", order: 0 })
+        expect(task.statuses[0]).toEqual({ id: "todo", label: "To Do", name: "To Do", order: 0, autoComplete: false })
       })
       expect(mockRestatus).not.toHaveBeenCalled()
     })
diff --git a/tests/api/user-summary.test.ts b/tests/api/user-summary.test.ts
index 8c1d33674..fdb803858 100644
--- a/tests/api/user-summary.test.ts
+++ b/tests/api/user-summary.test.ts
@@ -162,9 +162,21 @@ describe("User & Summary API", () => {
       expect(data.summary.items.total).toBeGreaterThan(0)
     })
 
+    it("answers 404 when an admin asks for a user that does not exist", async () => {
+      mockAuthenticateApiKey.mockResolvedValue({ ...mockUser, isAdmin: true })
+      mockFindUserRecord.mockResolvedValue(null)
+
+      const request = createMockRequest("GET", "http://localhost:3000/api/summary?username=nobody")
+      const response = await GET_SUMMARY(request)
+
+      expect(response.status).toBe(404)
+      expect(mockGetUserNotes).not.toHaveBeenCalled()
+    })
+
     it("should return summary for specific user when admin", async () => {
       const adminUser = { ...mockUser, isAdmin: true }
       mockAuthenticateApiKey.mockResolvedValue(adminUser)
+      mockFindUserRecord.mockResolvedValue({ username: "otheruser" })
 
       const mockNotes = [{ id: "1", title: "Note 1", category: "Work", owner: "otheruser" }]
       const mockChecklists = [
diff --git a/tests/security/kanban-grants.test.ts b/tests/security/kanban-grants.test.ts
index 74e3d7941..acd52f578 100644
--- a/tests/security/kanban-grants.test.ts
+++ b/tests/security/kanban-grants.test.ts
@@ -248,6 +248,47 @@ describe('Security: kanban API routes hold every share grant', () => {
     })
   })
 
+  describe('assigning through a card update', () => {
+    beforeEach(() => keyFor(OWNER))
+
+    it.each([
+      ['a user that does not exist', 'ghost', "Assignee not found"],
+      ['a user who cannot see the board', STRANGER, "Assignee can't see this board"],
+      ['a name that walks out of the notifications folder', '../users/owner', "Assignee not found"],
+    ])('refuses %s and writes nothing', async (_label, assignee, message) => {
+      const { PUT } = await import('@/app/api/kanban/[boardId]/items/[itemId]/route')
+
+      const response = await PUT(apiRequest('PUT', `${BASE}/items/card`, { assignee }), onCard())
+
+      expect(response.status).toBe(400)
+      expect((await response.json()).error).toBe(message)
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+
+    it('still assigns someone who can see the board', async () => {
+      const { PUT } = await import('@/app/api/kanban/[boardId]/items/[itemId]/route')
+
+      const response = await PUT(apiRequest('PUT', `${BASE}/items/card`, { assignee: READER }), onCard())
+
+      expect(response.status).toBe(200)
+      expect(mockWrite).toHaveBeenCalled()
+    })
+  })
+
+  describe('moving a card to a column the board does not have', () => {
+    beforeEach(() => keyFor(OWNER))
+
+    it('answers 400 and writes nothing', async () => {
+      const { PUT } = await import('@/app/api/kanban/[boardId]/items/[itemId]/status/route')
+
+      const response = await PUT(apiRequest('PUT', `${BASE}/items/card/status`, { status: 'nowhere' }), onCard())
+
+      expect(response.status).toBe(400)
+      expect((await response.json()).error).toBe('Status not found on this board')
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+  })
+
   describe('an unknown card', () => {
     beforeEach(() => keyFor(OWNER))
 
diff --git a/tests/security/notification-paths.test.ts b/tests/security/notification-paths.test.ts
new file mode 100644
index 000000000..87125f331
--- /dev/null
+++ b/tests/security/notification-paths.test.ts
@@ -0,0 +1,39 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+
+const mockRead = vi.fn()
+const mockWriteJson = vi.fn()
+
+vi.mock('@/app/_server/actions/file', () => ({
+  readJsonFile: (...args: unknown[]) => mockRead(...args),
+  writeJsonFile: (...args: unknown[]) => mockWriteJson(...args),
+  ensureDir: vi.fn(),
+}))
+
+vi.mock('@/app/_server/actions/ws/broadcast', () => ({
+  broadcast: vi.fn().mockResolvedValue(undefined),
+}))
+
+const assignment = { type: 'assignment' as const, title: 'Card', message: 'you got a card' }
+
+describe('Security: notification files stay in the notifications folder', () => {
+  beforeEach(() => {
+    mockRead.mockReset().mockResolvedValue([])
+    mockWriteJson.mockReset()
+  })
+
+  it.each(['../users/owner', '../../etc/passwd', 'a/b', 'a\\b'])('refuses the recipient %s and writes nothing', async (recipient) => {
+    const { notifyUser } = await import('@/app/_server/actions/notifications/internal')
+
+    expect(await notifyUser(recipient, assignment)).toEqual(expect.objectContaining({ success: false }))
+    expect(mockWriteJson).not.toHaveBeenCalled()
+  })
+
+  it('still writes for a plain username', async () => {
+    const { notifyUser } = await import('@/app/_server/actions/notifications/internal')
+
+    await notifyUser('owner', assignment)
+
+    expect(mockWriteJson).toHaveBeenCalledTimes(1)
+    expect(String(mockWriteJson.mock.calls[0][1])).toMatch(/notifications[\\/]owner\.json$/)
+  })
+})
diff --git a/tests/utils/api-note.test.ts b/tests/utils/api-note.test.ts
new file mode 100644
index 000000000..8efb3bb3e
--- /dev/null
+++ b/tests/utils/api-note.test.ts
@@ -0,0 +1,55 @@
+import { describe, it, expect } from "vitest";
+import { noteExcerpt, toApiNote } from "@/app/_utils/api-note";
+import { ListView } from "@/app/_schemas/api/common";
+
+const note = (content: string, extra = {}) => ({
+  uuid: "uuid-1",
+  title: "Garden",
+  category: "Home",
+  content,
+  createdAt: "2026-01-01T00:00:00.000Z",
+  updatedAt: "2026-01-01T00:00:00.000Z",
+  ...extra,
+});
+
+describe("noteExcerpt", () => {
+  it("keeps link and wikilink text and drops markdown syntax", () => {
+    expect(noteExcerpt("# Plan\n\nSee [the log](/note/x) and [[Composting|compost]] **now**"))
+      .toBe("Plan See the log and compost now");
+  });
+
+  it("leaves code blocks out", () => {
+    expect(noteExcerpt("Before\n```js\nconst a = 1;\n```\nafter")).toBe("Before after");
+  });
+
+  it("cuts long content on a word boundary", () => {
+    const excerpt = noteExcerpt("word ".repeat(100));
+    expect(excerpt.length).toBeLessThanOrEqual(203);
+    expect(excerpt.endsWith("word...")).toBe(true);
+  });
+});
+
+describe("toApiNote", () => {
+  it("returns content in the full view", () => {
+    const api = toApiNote(note("hello"));
+    expect(api.content).toBe("hello");
+    expect(api).not.toHaveProperty("excerpt");
+  });
+
+  it("returns an excerpt instead of content in the summary view", () => {
+    const api = toApiNote(note("hello there"), ListView.SUMMARY);
+    expect(api.excerpt).toBe("hello there");
+    expect(api).not.toHaveProperty("content");
+  });
+
+  it("never previews an encrypted note", () => {
+    const pgp = "-----BEGIN PGP MESSAGE-----\nabc\n-----END PGP MESSAGE-----";
+    const api = toApiNote(note(pgp), ListView.SUMMARY);
+    expect(api.excerpt).toBeUndefined();
+    expect(api.encrypted).toBe(true);
+  });
+
+  it("flags encrypted notes in the full view too", () => {
+    expect(toApiNote(note("x", { encrypted: true })).encrypted).toBe(true);
+  });
+});
diff --git a/tests/utils/item-status-utils.test.ts b/tests/utils/item-status-utils.test.ts
index 92cdfc0bd..d2993dc65 100644
--- a/tests/utils/item-status-utils.test.ts
+++ b/tests/utils/item-status-utils.test.ts
@@ -119,3 +119,20 @@ describe("completeParent", () => {
     expect(result).toBe(items);
   });
 });
+
+describe("boards without stored columns", () => {
+  it("auto-completes a card moved into the default Completed column", () => {
+    const items = [makeItem("a", TaskStatus.TODO)];
+    const result = applyStatus(items, "a", TaskStatus.COMPLETED, undefined, USER, NOW);
+    expect(result[0].completed).toBe(true);
+  });
+
+  it("completes the parent once every child is done", () => {
+    const items = [
+      makeItem("p", TaskStatus.IN_PROGRESS, { children: [makeItem("c", TaskStatus.TODO, { completed: true })] }),
+    ];
+    const result = completeParent(items, "c", [], USER, NOW);
+    expect(result[0].completed).toBe(true);
+    expect(result[0].status).toBe(TaskStatus.COMPLETED);
+  });
+});

From cfedfc530ee56977c6cc6aaa2c6a2e458933a9c5 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 12:09:53 +0100
Subject: [PATCH 18/28] mcp should feel like magic when using it now

---
 .github/workflows/prebuild-release.yml        |  54 ++++++++
 .../FeatureComponents/Howto/HowtoSidebar.tsx  |   2 +
 app/_schemas/api/discovery.ts                 |   8 +-
 app/_schemas/api/items.ts                     |   2 +
 app/_schemas/api/kanban.ts                    |  24 +++-
 app/_schemas/api/tasks.ts                     |   3 +-
 app/_server/actions/log/writers.ts            |  34 +++--
 app/_server/api/caller-scope.ts               |   9 ++
 app/_server/api/define-route.ts               |   5 +-
 app/_translations/en.json                     |   3 +-
 app/_utils/api-item.ts                        |   9 +-
 app/_utils/api-list-utils.ts                  |  12 +-
 app/_utils/grep-utils.ts                      |  27 ++--
 app/_utils/howto-utils.ts                     |   7 +
 app/_utils/kanban/api-transforms.ts           |  17 ++-
 app/api/checklists/[listId]/route.ts          |   2 +-
 app/api/kanban/route.ts                       |  11 +-
 app/api/search/route.ts                       |   3 +-
 .../tasks/[taskId]/items/[itemIndex]/route.ts |   2 +-
 app/api/tasks/route.ts                        |   7 +-
 howto/API.md                                  |   2 +-
 howto/MCP.md                                  | 122 ++++++++++++++++++
 mcp-server/README.md                          | 122 +-----------------
 mcp-server/src/tools/builtins.ts              |   4 +-
 mcp-server/src/tools/catalog.ts               |   5 +-
 mcp-server/src/tools/errors.ts                |   6 +-
 mcp-server/src/tools/operation.ts             |  46 ++++++-
 mcp-server/src/tools/result.ts                |  20 +--
 mcp-server/tests/helpers.ts                   |  34 +++++
 mcp-server/tests/session.test.ts              |   2 +
 mcp-server/tests/tools.test.ts                |  44 ++++++-
 tests/api/discovery.test.ts                   |   2 +-
 tests/api/list-views.test.ts                  |  69 +++++++++-
 tests/server-actions/audit-caller.test.ts     |  39 ++++++
 34 files changed, 561 insertions(+), 197 deletions(-)
 create mode 100644 app/_server/api/caller-scope.ts
 create mode 100644 howto/MCP.md
 mode change 100644 => 120000 mcp-server/README.md
 create mode 100644 tests/server-actions/audit-caller.test.ts

diff --git a/.github/workflows/prebuild-release.yml b/.github/workflows/prebuild-release.yml
index 1fd5fb875..16b05237f 100644
--- a/.github/workflows/prebuild-release.yml
+++ b/.github/workflows/prebuild-release.yml
@@ -58,3 +58,57 @@ jobs:
             prebuild-release/jotty_*_prebuild.tar.gz
             prebuild-release/jotty_*_prebuild.tar.gz.sha256
           tag_name: ${{ steps.version.outputs.version }}
+
+  build-mcp:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    defaults:
+      run:
+        working-directory: mcp-server
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup the other best engine ever
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Make sure it still works
+        run: |
+          bun run typecheck
+          bun test
+
+      - name: Bake the MCP
+        run: bun run build
+
+      - name: Get version from tag
+        id: version
+        run: |
+          VERSION="${GITHUB_REF#refs/tags/}"
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+      - name: Structure the prebuild stuff
+        run: |
+          mkdir -p prebuild-release/jotty-mcp
+          cp dist/main.js prebuild-release/jotty-mcp/main.js
+          cp README.md prebuild-release/jotty-mcp/README.md
+          cp ../LICENSE prebuild-release/jotty-mcp/LICENSE
+
+      - name: Create tarball - a smaller funny name
+        run: |
+          cd prebuild-release
+          tar -czf jotty-mcp_${{ steps.version.outputs.version }}_prebuild.tar.gz jotty-mcp
+          sha256sum jotty-mcp_${{ steps.version.outputs.version }}_prebuild.tar.gz > jotty-mcp_${{ steps.version.outputs.version }}_prebuild.tar.gz.sha256
+
+      - name: Attach to Release - pray it works twice
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            mcp-server/prebuild-release/jotty-mcp_*_prebuild.tar.gz
+            mcp-server/prebuild-release/jotty-mcp_*_prebuild.tar.gz.sha256
+          tag_name: ${{ steps.version.outputs.version }}
diff --git a/app/_components/FeatureComponents/Howto/HowtoSidebar.tsx b/app/_components/FeatureComponents/Howto/HowtoSidebar.tsx
index 46c0cad5d..01ba0431b 100644
--- a/app/_components/FeatureComponents/Howto/HowtoSidebar.tsx
+++ b/app/_components/FeatureComponents/Howto/HowtoSidebar.tsx
@@ -22,6 +22,7 @@ import {
   Wrench01Icon,
   AiBrain04Icon,
   UserMultipleIcon,
+  RoboticIcon,
 } from "hugeicons-react";
 
 interface HowtoSidebarProps {
@@ -45,6 +46,7 @@ const iconMap: Record<string, any> = {
   patch: Wrench01Icon,
   brain: AiBrain04Icon,
   users: UserMultipleIcon,
+  robot: RoboticIcon,
 };
 
 export const HowtoSidebar = ({ isOpen, onClose }: HowtoSidebarProps) => {
diff --git a/app/_schemas/api/discovery.ts b/app/_schemas/api/discovery.ts
index de0b85ed0..2137a65de 100644
--- a/app/_schemas/api/discovery.ts
+++ b/app/_schemas/api/discovery.ts
@@ -37,8 +37,12 @@ export const searchParamsSchema = z.object({
 
 export const searchHitSchema = z
   .object({
-    id: z.string().describe("File name of the match, without extension"),
-    uuid: z.string().optional().describe("Item uuid"),
+    uuid: z.string().optional().describe("Item uuid, the id every other route takes"),
+    slug: z.string().describe("File name of the match, without extension"),
+    id: z
+      .string()
+      .meta({ deprecated: true })
+      .describe("Deprecated, the same value as slug. Use uuid to address the item"),
     type: z.enum(ItemTypes),
     title: z.string(),
     category: z.string(),
diff --git a/app/_schemas/api/items.ts b/app/_schemas/api/items.ts
index 28df4b1c8..e64d9acf0 100644
--- a/app/_schemas/api/items.ts
+++ b/app/_schemas/api/items.ts
@@ -47,6 +47,7 @@ export const reminderSchema = z
 type ApiItemShape = {
   id: string;
   index: number;
+  itemIndex: string;
   text: string;
   completed: boolean;
   status?: string;
@@ -69,6 +70,7 @@ export const apiItemSchema: z.ZodType<ApiItemShape> = z
   .object({
     id: z.string().describe("Item id inside its list"),
     index: z.number().describe("Position among its siblings"),
+    itemIndex: z.string().describe("Tree index to pass as {itemIndex}, e.g. 0 or 2.1"),
     text: z.string(),
     completed: z.boolean(),
     status: z.string().optional().describe("Kanban lists only, a status id"),
diff --git a/app/_schemas/api/kanban.ts b/app/_schemas/api/kanban.ts
index b0dfbc3b2..084c72cf3 100644
--- a/app/_schemas/api/kanban.ts
+++ b/app/_schemas/api/kanban.ts
@@ -1,7 +1,17 @@
 import { z } from "zod";
 import { apiNames } from "@/app/_schemas/api/names";
 import { KanbanPriorityLevel } from "@/app/_types/enums";
-import { categoryField, envelope, errorSchema, required, searchQuery, timestamp, uuidParam } from "./common";
+import {
+  ListView,
+  categoryField,
+  envelope,
+  errorSchema,
+  pageFields,
+  required,
+  searchQuery,
+  timestamp,
+  uuidParam,
+} from "./common";
 import {
   checklistTypeSchema,
   kanbanStatusSchema,
@@ -49,7 +59,12 @@ export const boardSchema = z
     statuses: z
       .array(kanbanStatusSchema)
       .describe("The board's columns, or the default columns when the board never changed them"),
-    items: z.array(kanbanCardSchema),
+    items: z.array(kanbanCardSchema).optional().describe("Left out in the summary view"),
+    itemCount: z.number().optional().describe("Top-level cards, in the summary view"),
+    statusCounts: z
+      .record(z.string(), z.number())
+      .optional()
+      .describe("Top-level cards per status id, in the summary view"),
     createdAt: timestamp,
     updatedAt: timestamp,
   })
@@ -148,6 +163,11 @@ export const boardListQuery = z.object({
   category: z.string().optional().describe("Only boards in this folder"),
   status: z.string().optional().describe("Only boards with at least one top-level card in this status id"),
   q: searchQuery.describe("Case-insensitive match on the board title or any top-level card text"),
+  view: z
+    .enum(ListView)
+    .default(ListView.FULL)
+    .describe("full returns every card, summary returns card counts per status instead"),
+  ...pageFields,
 });
 
 export const boardCreateBody = z.object({
diff --git a/app/_schemas/api/tasks.ts b/app/_schemas/api/tasks.ts
index 680834b98..986e436ce 100644
--- a/app/_schemas/api/tasks.ts
+++ b/app/_schemas/api/tasks.ts
@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { apiNames } from "@/app/_schemas/api/names";
-import { categoryField, required, searchQuery, timestamp, uuidParam } from "./common";
+import { categoryField, pageFields, required, searchQuery, timestamp, uuidParam } from "./common";
 import { apiItemSchema, itemIndexParam, kanbanStatusSchema } from "./items";
 
 const STATUS_FIELDS_REQUIRED = "Status id and label are required";
@@ -35,6 +35,7 @@ export const taskListQuery = z.object({
   category: z.string().optional().describe("Only tasks in this folder"),
   status: z.string().optional().describe("Only tasks with at least one top-level item in this status id"),
   q: searchQuery,
+  ...pageFields,
 });
 
 const newColumn = z
diff --git a/app/_server/actions/log/writers.ts b/app/_server/actions/log/writers.ts
index e20cce14c..992de56d4 100644
--- a/app/_server/actions/log/writers.ts
+++ b/app/_server/actions/log/writers.ts
@@ -12,23 +12,29 @@ import {
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { ensureDir } from "@/app/_server/actions/file";
 import { generateUuid } from "@/app/_utils/yaml-metadata-utils";
+import { apiCaller } from "@/app/_server/api/caller-scope";
+import { runQueued } from "@/app/_server/actions/lib/concurrency";
 import { shouldLog, getRequestContext, getDailyLogPath } from "./helpers";
 
+const SYSTEM_USER = "system";
+
 const writeToDailyLog = async (entry: AuditLogEntry, username: string): Promise<void> => {
   const logFilePath = await getDailyLogPath(username);
   await ensureDir(path.dirname(logFilePath));
 
-  let logs: AuditLogEntry[] = [];
+  await runQueued(logFilePath, async () => {
+    let logs: AuditLogEntry[] = [];
 
-  try {
-    const content = await fs.readFile(logFilePath, "utf-8");
-    logs = JSON.parse(content);
-  } catch (error) {
-    logs = [];
-  }
+    try {
+      const content = await fs.readFile(logFilePath, "utf-8");
+      logs = JSON.parse(content);
+    } catch (error) {
+      logs = [];
+    }
 
-  logs.push(entry);
-  await fs.writeFile(logFilePath, JSON.stringify(logs, null, 2), "utf-8");
+    logs.push(entry);
+    await fs.writeFile(logFilePath, JSON.stringify(logs, null, 2), "utf-8");
+  });
 };
 
 export const logAudit = async (params: {
@@ -49,11 +55,11 @@ export const logAudit = async (params: {
       return;
     }
 
-    let username = params.username;
-    if (!username) {
-      const user = await getCurrentUser();
-      username = user?.username || "system";
-    }
+    const username =
+      params.username ||
+      apiCaller()?.username ||
+      (await getCurrentUser())?.username ||
+      SYSTEM_USER;
 
     const { ipAddress, userAgent } = await getRequestContext();
 
diff --git a/app/_server/api/caller-scope.ts b/app/_server/api/caller-scope.ts
new file mode 100644
index 000000000..b5960cfaa
--- /dev/null
+++ b/app/_server/api/caller-scope.ts
@@ -0,0 +1,9 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { ApiUser } from "./contract";
+
+const scope = new AsyncLocalStorage<ApiUser>();
+
+export const actAs = <T>(user: ApiUser, work: () => Promise<T>): Promise<T> =>
+  scope.run(user, work);
+
+export const apiCaller = (): ApiUser | undefined => scope.getStore();
diff --git a/app/_server/api/define-route.ts b/app/_server/api/define-route.ts
index 6d427d8b4..f4c00548a 100644
--- a/app/_server/api/define-route.ts
+++ b/app/_server/api/define-route.ts
@@ -4,6 +4,7 @@ import { authenticateApiKey } from "@/app/_server/actions/api";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { API_KEY_HEADER } from "@/app/_utils/api-utils";
 import { sanitizeUserForClient } from "@/app/_utils/user-sanitize-utils";
+import { actAs } from "./caller-scope";
 import {
   AnyContract,
   ApiHandler,
@@ -106,7 +107,9 @@ export const defineRoute = <
       const user = await _caller(request, contract.auth);
       if (!user) return refuse("Unauthorized", 401);
       const input = await _parse(contract, request, context?.params);
-      return handler({ request, user, ...input } as RouteInput<P, Q, B, ApiUser>);
+      return actAs(user, () =>
+        handler({ request, user, ...input } as RouteInput<P, Q, B, ApiUser>),
+      );
     }),
   );
 
diff --git a/app/_translations/en.json b/app/_translations/en.json
index f8fa4f214..f54ea3539 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -1763,7 +1763,8 @@
     "ldap": "LDAP",
     "translations": "Translations",
     "unraid": "Unraid",
-    "patches": "Patches"
+    "patches": "Patches",
+    "mcp": "MCP"
   },
   "notFound": {
     "title": "Page Not Found",
diff --git a/app/_utils/api-item.ts b/app/_utils/api-item.ts
index 3243571c0..2f84d5b8d 100644
--- a/app/_utils/api-item.ts
+++ b/app/_utils/api-item.ts
@@ -4,6 +4,7 @@ import { TaskStatus } from "@/app/_types/enums";
 export interface ApiItem {
   id: string;
   index: number;
+  itemIndex: string;
   text: string;
   completed: boolean;
   status?: string;
@@ -22,14 +23,20 @@ export interface ApiItem {
   children?: ApiItem[];
 }
 
+const _joinIndex = (parent: string | undefined, index: number) =>
+  parent === undefined ? String(index) : `${parent}.${index}`;
+
 export const toApiItem = (
   item: Item,
   index: number,
   isKanban: boolean,
+  parent?: string,
 ): ApiItem => {
+  const itemIndex = _joinIndex(parent, index);
   const apiItem: ApiItem = {
     id: item.id,
     index,
+    itemIndex,
     text: item.text,
     completed: item.completed,
   };
@@ -57,7 +64,7 @@ export const toApiItem = (
 
   if (item.children && item.children.length > 0) {
     apiItem.children = item.children.map((child, childIndex) =>
-      toApiItem(child, childIndex, isKanban),
+      toApiItem(child, childIndex, isKanban, itemIndex),
     );
   }
 
diff --git a/app/_utils/api-list-utils.ts b/app/_utils/api-list-utils.ts
index b9801a6d2..a116a6922 100644
--- a/app/_utils/api-list-utils.ts
+++ b/app/_utils/api-list-utils.ts
@@ -43,10 +43,18 @@ export const newcomerIn = (before: Item[], after: Item[]): string | undefined =>
   return _ids(after).find((id) => !known.has(id));
 };
 
-export const itemAtIndex = (items: Item[], raw: string): { item: Item; index: number } | null => {
+interface IndexHit {
+  item: Item;
+  index: number;
+  parent?: string;
+}
+
+export const itemAtIndex = (items: Item[], raw: string): IndexHit | null => {
   const path = indexPath(raw);
   const item = path ? itemAt(items, path) : undefined;
-  return path && item ? { item, index: path[path.length - 1] } : null;
+  if (!path || !item) return null;
+  const parent = path.slice(0, -1).join(".");
+  return { item, index: path[path.length - 1], ...(parent && { parent }) };
 };
 
 export const guard = async (
diff --git a/app/_utils/grep-utils.ts b/app/_utils/grep-utils.ts
index a4c61b0f5..4b9861292 100644
--- a/app/_utils/grep-utils.ts
+++ b/app/_utils/grep-utils.ts
@@ -305,6 +305,17 @@ export interface GrepSearchResult extends GrepFileResult {
   matchLine: string;
 }
 
+const _bodyMatch = async (filePath: string, pattern: string): Promise<string> => {
+  try {
+    const matcher = new RegExp(pattern, "i");
+    const { contentWithoutMetadata } = extractYamlMetadata(await fs.readFile(filePath, "utf-8"));
+    return contentWithoutMetadata.split(LINE_BREAK).find((line) => matcher.test(line))?.trim() ?? "";
+  } catch (error) {
+    console.error("Search match-line failed:", filePath, error);
+    return "";
+  }
+};
+
 export const grepSearchContent = async (
   dir: string,
   pattern: string,
@@ -328,21 +339,7 @@ export const grepSearchContent = async (
         const id = path.basename(filename, ".md");
         const category = parts.join("/");
 
-        let matchLine = "";
-        try {
-          const { stdout: matchOut } = await execFileAsync("grep", [
-            "-im1",
-            "--",
-            pattern,
-            filePath,
-          ]);
-          matchLine = matchOut.trim();
-        } catch (error) {
-          if (!_isNoMatch(error)) {
-            console.error("grep match-line failed:", error);
-          }
-        }
-
+        const matchLine = await _bodyMatch(filePath, pattern);
         return { filePath, id, category, matchLine };
       }),
     );
diff --git a/app/_utils/howto-utils.ts b/app/_utils/howto-utils.ts
index aa8fd5cab..496f612ee 100644
--- a/app/_utils/howto-utils.ts
+++ b/app/_utils/howto-utils.ts
@@ -40,6 +40,13 @@ export const getHowtoGuides = (t: any): HowtoGuide[] => [
     icon: "code",
     translationKey: "common.api",
   },
+  {
+    id: "mcp",
+    name: t("help.mcp"),
+    filename: "MCP.md",
+    icon: "robot",
+    translationKey: "help.mcp",
+  },
   {
     id: "customisations",
     name: t("help.customisations"),
diff --git a/app/_utils/kanban/api-transforms.ts b/app/_utils/kanban/api-transforms.ts
index 7bf2b5584..61399919d 100644
--- a/app/_utils/kanban/api-transforms.ts
+++ b/app/_utils/kanban/api-transforms.ts
@@ -1,6 +1,8 @@
 import { Item, Checklist } from "@/app/_types";
 import { TaskStatus } from "@/app/_types/enums";
 import { DEFAULT_KANBAN_STATUSES } from "@/app/_consts/kanban";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { ListView } from "@/app/_schemas/api/common";
 
 interface TransformedItem {
   id: string;
@@ -38,12 +40,21 @@ export const transformItem = (item: Item, index: number): TransformedItem => {
   return baseItem;
 };
 
-export const transformBoard = (list: Checklist) => ({
+const _statusCounts = (items: Item[]) =>
+  items.reduce<Record<string, number>>((counts, item) => {
+    const status = item.status || TaskStatus.TODO;
+    counts[status] = (counts[status] ?? 0) + 1;
+    return counts;
+  }, {});
+
+export const transformBoard = (list: Checklist, view: ListView = ListView.FULL) => ({
   id: list.uuid,
   title: list.title,
-  category: list.category || "Uncategorized",
+  category: list.category || UNCATEGORIZED,
   statuses: list.statuses || DEFAULT_KANBAN_STATUSES,
-  items: list.items.map((item, index) => transformItem(item, index)),
+  ...(view === ListView.SUMMARY
+    ? { itemCount: list.items.length, statusCounts: _statusCounts(list.items) }
+    : { items: list.items.map((item, index) => transformItem(item, index)) }),
   createdAt: list.createdAt,
   updatedAt: list.updatedAt,
 });
diff --git a/app/api/checklists/[listId]/route.ts b/app/api/checklists/[listId]/route.ts
index bf1879384..c886ac893 100644
--- a/app/api/checklists/[listId]/route.ts
+++ b/app/api/checklists/[listId]/route.ts
@@ -26,7 +26,7 @@ export const GET = defineRoute(
     path: "/checklists/{listId}",
     tag: ApiTag.CHECKLISTS,
     summary: "Get a checklist",
-    description: "One checklist with its items, including ones shared with the API key owner. Each item carries the index the item routes take.",
+    description: "One checklist with its items, including ones shared with the API key owner. Each item carries itemIndex, the tree index the item routes take.",
     params: listParams,
     responses: {
       200: { description: "The checklist", schema: envelope(checklistSchema) },
diff --git a/app/api/kanban/route.ts b/app/api/kanban/route.ts
index df3b8b5b8..a4b3408f2 100644
--- a/app/api/kanban/route.ts
+++ b/app/api/kanban/route.ts
@@ -4,7 +4,7 @@ import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { makeList } from "@/app/_server/actions/checklist/creator";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
-import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { ERRORS, envelope, page, totalField } from "@/app/_schemas/api/common";
 import { boardCreateBody, boardListQuery, boardSchema } from "@/app/_schemas/api/kanban";
 import { ChecklistsTypes, isKanbanType } from "@/app/_types/enums";
 import { Checklist, Result } from "@/app/_types";
@@ -19,10 +19,10 @@ export const GET = defineRoute(
     path: "/kanban",
     tag: ApiTag.KANBAN,
     summary: "List Kanban boards",
-    description: "Boards the API key owner owns. Boards shared with them are left out, but GET /kanban/{boardId} returns them.",
+    description: "Boards the API key owner owns. Boards shared with them are left out, but GET /kanban/{boardId} returns them. Use view=summary with limit and offset to page through them with card counts per status instead of cards.",
     query: boardListQuery,
     responses: {
-      200: { description: "Boards", schema: z.object({ boards: z.array(boardSchema) }) },
+      200: { description: "Boards", schema: z.object({ boards: z.array(boardSchema), total: totalField }) },
       401: ERRORS[401],
       500: ERRORS[500],
     },
@@ -45,7 +45,10 @@ export const GET = defineRoute(
           list.items.some((item) => item.text.toLowerCase().includes(needle))),
     );
 
-    return NextResponse.json({ boards: boards.map((list) => transformBoard(list)) });
+    return NextResponse.json({
+      boards: page(boards, query).map((list) => transformBoard(list, query.view)),
+      total: boards.length,
+    });
   },
 );
 
diff --git a/app/api/search/route.ts b/app/api/search/route.ts
index 3fc0dfc7a..c01362c3c 100644
--- a/app/api/search/route.ts
+++ b/app/api/search/route.ts
@@ -47,8 +47,9 @@ const _toHits = (hits: GrepSearchResult[], type: ItemTypes) =>
       const title = (meta?.title as string) || hit.id;
       const cleaned = _cleanMatch(hit.matchLine);
       return {
-        id: hit.id,
         uuid: meta?.uuid as string | undefined,
+        slug: hit.id,
+        id: hit.id,
         type,
         title,
         category: hit.category || UNCATEGORIZED,
diff --git a/app/api/tasks/[taskId]/items/[itemIndex]/route.ts b/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
index bf9504113..8afabf22e 100644
--- a/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
+++ b/app/api/tasks/[taskId]/items/[itemIndex]/route.ts
@@ -38,7 +38,7 @@ export const GET = defineRoute(
     const hit = itemAtIndex(found.task.items, params.itemIndex);
     if (!hit) return refuse(OUT_OF_RANGE, 400);
 
-    return NextResponse.json({ item: toApiItem(hit.item, hit.index, true) });
+    return NextResponse.json({ item: toApiItem(hit.item, hit.index, true, hit.parent) });
   },
 );
 
diff --git a/app/api/tasks/route.ts b/app/api/tasks/route.ts
index 2dab26309..19534acf9 100644
--- a/app/api/tasks/route.ts
+++ b/app/api/tasks/route.ts
@@ -4,7 +4,7 @@ import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { makeList } from "@/app/_server/actions/checklist/creator";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
-import { ERRORS, envelope } from "@/app/_schemas/api/common";
+import { ERRORS, envelope, page, totalField } from "@/app/_schemas/api/common";
 import { taskCreateBody, taskListQuery, taskSchema } from "@/app/_schemas/api/tasks";
 import { ChecklistsTypes, isKanbanType } from "@/app/_types/enums";
 import { Checklist, KanbanStatus, Result } from "@/app/_types";
@@ -33,7 +33,7 @@ export const GET = defineRoute(
     description: "Task checklists the API key owner owns. Tasks shared with them are left out.",
     query: taskListQuery,
     responses: {
-      200: { description: "Tasks", schema: z.object({ tasks: z.array(taskSchema) }) },
+      200: { description: "Tasks", schema: z.object({ tasks: z.array(taskSchema), total: totalField }) },
       400: ERRORS[400],
       401: ERRORS[401],
       500: ERRORS[500],
@@ -58,10 +58,11 @@ export const GET = defineRoute(
     );
 
     return NextResponse.json({
-      tasks: matches.map((list) => ({
+      tasks: page(matches, query).map((list) => ({
         ...toApiTask(list),
         items: list.items.map((item, index) => toApiItem(item, index, true)),
       })),
+      total: matches.length,
     });
   },
 );
diff --git a/howto/API.md b/howto/API.md
index 0a38b0300..27d8e447a 100644
--- a/howto/API.md
+++ b/howto/API.md
@@ -44,7 +44,7 @@ Validation errors also carry a `details` array saying which field failed. `401`
 
 ## The spec
 
-- `GET /api/openapi.json` returns the OpenAPI 3.1 document to anyone with a valid API key. Scripts, code generators and the [MCP server](../mcp-server/README.md) use it to find out what your instance supports.
+- `GET /api/openapi.json` returns the OpenAPI 3.1 document to anyone with a valid API key. Scripts, code generators and the [MCP server](MCP.md) use it to find out what your instance supports.
 - `GET /api/docs` returns the same document without a key, as JSON or as YAML with `?format=yaml`. It only answers when `ENABLE_API_DOCS=true` is set.
 
 ### ReDoc (optional)
diff --git a/howto/MCP.md b/howto/MCP.md
new file mode 100644
index 000000000..8ff88f0ca
--- /dev/null
+++ b/howto/MCP.md
@@ -0,0 +1,122 @@
+# Jotty MCP server
+
+The MCP server lets an AI assistant such as Claude, Cursor or anything else that speaks MCP read and change your notes, checklists and Kanban boards. It talks to Jotty over the [REST API](API.md), so every request acts as the user who owns the API key.
+
+> [!CAUTION]
+> The assistant can do anything your API key can, deleting included. Give it a key from an account that only holds what you're happy for it to touch.
+
+You need an API key before anything else. [The API guide](API.md) explains how to generate one.
+
+## How it knows what Jotty can do
+
+Jotty publishes its own API description at `/api/openapi.json`. The MCP server reads it the first time a tool runs and caches it for five minutes. Tool names, descriptions and arguments all come from there.
+
+- Pointed at an older instance, it leaves out the tools that instance has no endpoint for, and `discover` lists them as unavailable.
+- A new Jotty route works straight away through `call_operation`, without updating the MCP server.
+
+---
+
+## Running it with Docker
+
+Use this when several people share one MCP server, or when you want it next to Jotty on a server. Each client sends its own Jotty key, so each session acts as its own user.
+
+`docker-compose.mcp.yml` in the Jotty repo runs Jotty and the MCP server on one network:
+
+```bash
+mkdir -p ./data ./config ./cache && sudo chown -R 1000:1000 ./data ./config ./cache
+docker compose -f docker-compose.mcp.yml up -d --build
+```
+
+The MCP endpoint is `http://<host>:1133/mcp`, with a health check at `/healthz`.
+
+> [!IMPORTANT]
+> Change `JOTTY_MCP_AUTH_TOKEN` from `changeme` before you start it. Every `/mcp` request has to send `Authorization: Bearer <token>`. Leaving the token empty opens the endpoint to anyone who can reach the port, which is fine on a private network and a bad idea anywhere else.
+
+Adding it to Claude Code:
+
+```bash
+claude mcp add --transport http jotty http://localhost:1133/mcp \
+  --header "Authorization: Bearer <token>" \
+  --header "x-api-key: ck_..."
+```
+
+> [!WARNING]
+> `JOTTY_API_KEY` on the MCP service is a fallback for clients that can't send `x-api-key`. With it set, anyone who reaches the port with the token acts as that key's owner. The server logs a warning at startup when you set both.
+
+## Running it with Bun
+
+Use this on your own machine. Your MCP client starts the server itself and the key never leaves your computer. You need [Bun](https://bun.sh) 1.3 or newer.
+
+```bash
+cd mcp-server
+bun install
+```
+
+Then add it to your client's MCP config:
+
+```jsonc
+{
+  "mcpServers": {
+    "jotty": {
+      "command": "bun",
+      "args": ["run", "/absolute/path/to/jotty/mcp-server/src/main.ts"],
+      "env": {
+        "JOTTY_URL": "https://jotty.example.com",
+        "JOTTY_API_KEY": "ck_..."
+      }
+    }
+  }
+}
+```
+
+Or in Claude Code:
+
+```bash
+claude mcp add jotty -e JOTTY_URL=https://jotty.example.com -e JOTTY_API_KEY=ck_... -- bun run /absolute/path/to/jotty/mcp-server/src/main.ts
+```
+
+---
+
+## Tools
+
+Each everyday action has its own tool, named after its API operation in snake case, so `listNotes` becomes `list_notes`. They cover search, categories, the usage summary, notes, checklists and their items, and the common board actions.
+
+Three more tools reach everything else:
+
+| Tool | What it does |
+|---|---|
+| `discover` | Lists the operations the other tools don't cover. Pass `operationId` to get any operation's arguments. |
+| `call_operation` | Calls any operation by id. This is how you reach tasks, statuses, reminders, exports and logs. |
+| `health` | Says whether Jotty is reachable, which version it runs and whether the API key works. |
+
+Notes, checklists and boards are addressed by UUID, so list or search first to get one. Checklist items take their `itemIndex`, like `0` or `2.1`, which `get_checklist` returns for every item.
+
+When something fails, the tool says why and what to try next. It also refuses arguments the operation doesn't take and lists the ones it does.
+
+## Keeping the context small
+
+An assistant reads every character a tool sends back, and a long answer pushes the rest of the conversation out. So the server keeps answers short:
+
+- `list_notes`, `list_checklists` and `list_boards` return 25 results at a time in a summary view. Notes come with a short excerpt instead of their content, checklists with item counts, and boards with card counts per column. `total` says how many matched, `offset` reads the next page, and `view=full` gets everything.
+- An answer longer than `JOTTY_MCP_MAX_TEXT_CHARS` keeps the rows that fit and adds a `trimmed` field with the `offset` for the next ones. A single record that's still too long gets cut.
+- Updating or moving a card returns that card, not the whole board.
+- Search results give you the `uuid` the other tools take and the file name as `slug`.
+- Export downloads aren't fetched. You get the link to download the file yourself.
+
+> [!NOTE]
+> Encrypted notes stay opaque here too. They never get an excerpt, and they come back flagged `encrypted`.
+
+## Settings
+
+| Variable | Default | What it does |
+|---|---|---|
+| `JOTTY_URL` | `http://localhost:3000` | Your Jotty address, without `/api` |
+| `JOTTY_API_KEY` | | The key to use with Bun, or the fallback for Docker sessions |
+| `JOTTY_MCP_TRANSPORT` | `stdio` | `stdio` when your client starts the server, `http` for a shared one |
+| `JOTTY_MCP_PORT` | `3001` | Port the HTTP server listens on inside the container |
+| `JOTTY_MCP_BIND_HOST` | all interfaces | Address the HTTP server binds to |
+| `JOTTY_MCP_AUTH_TOKEN` | | Bearer token every `/mcp` request must send |
+| `JOTTY_MCP_TIMEOUT_MS` | `30000` | How long to wait for Jotty before giving up |
+| `JOTTY_MCP_MAX_TEXT_CHARS` | `12000` | Longest answer a tool sends back, in characters |
+| `JOTTY_MCP_SPEC_TTL_MS` | `300000` | How long to cache the API description |
+| `JOTTY_MCP_LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error` or `silent`. Logs go to stderr |
diff --git a/mcp-server/README.md b/mcp-server/README.md
deleted file mode 100644
index 7475cd5b4..000000000
--- a/mcp-server/README.md
+++ /dev/null
@@ -1,121 +0,0 @@
-# jotty-mcp
-
-An MCP server for a Jotty instance. It lets an assistant read and change notes, checklists and Kanban boards as the user who owns the API key.
-
-It lives in the Jotty repo but shares nothing with the app. It has its own `package.json`, runs on [Bun](https://bun.sh) and talks to Jotty over the REST API.
-
-## How it knows the API
-
-Jotty publishes its own contract at `/api/openapi.json`. It's generated from the code that serves each route. The MCP reads it on first use and caches it for five minutes per API key. Tool names, descriptions and input schemas all come from there.
-
-That means:
-
-- Pointing it at an older instance works. Tools for endpoints that instance doesn't have are left out, and `discover` lists them as unavailable.
-- A new route in Jotty is reachable straight away through `call_operation`, with no MCP release.
-- The only hand-kept list is `src/tools/catalog.ts`: the operation ids that get a dedicated tool, plus a few per-tool defaults.
-
-## Tools
-
-The dedicated tools cover day to day work: search, categories, summary, notes, checklists and their items, and the common board actions. Each one is named after its operation id in snake case (`listNotes` is `list_notes`).
-
-Three built-in tools cover the rest:
-
-| Tool | What it does |
-|---|---|
-| `discover` | Lists every operation on the instance. Pass `operationId` to get one operation's input schema. |
-| `call_operation` | Calls any operation by id. Use it for tasks, statuses, reminders, exports and logs. |
-| `health` | Reports whether Jotty is reachable, its version, and whether the API key works. |
-
-Results carry the Jotty response as compact JSON, in both the text and `structuredContent`.
-
-## Keeping the context small
-
-An assistant reads every character a tool returns, so the server keeps results short:
-
-- `list_notes` and `list_checklists` default to `view=summary` and `limit=25`. Notes come back with a short plain-text excerpt instead of their content, and checklists with item counts instead of items. `total` says how many matched, and `offset` pages through them. Pass `view=full` to get everything, then `get_note` or `get_checklist` for one item.
-- A result longer than `JOTTY_MCP_MAX_TEXT_CHARS` is trimmed to the rows that fit, with a `trimmed` field saying how many were left out. A single record that is still too long is cut, and the structured copy is dropped so the client can't show the full thing anyway.
-- `update_board_item` and `move_board_item` return the changed card, not the whole board.
-- Binary downloads, such as an export zip, aren't fetched. The tool returns the URL to download it from instead.
-- Encrypted notes are never excerpted. They come back flagged `encrypted`.
-
-Errors come back with `isError` and `{ kind, message, status, hint }`. Arguments the operation doesn't take are refused with the list of the ones it does.
-
-## Running it
-
-You need an API key. Generate one in Jotty under Profile.
-
-### stdio, on your own machine
-
-Your MCP client starts the process. The key stays on your machine.
-
-```bash
-cd mcp-server
-bun install
-```
-
-```jsonc
-{
-  "mcpServers": {
-    "jotty": {
-      "command": "bun",
-      "args": ["run", "/absolute/path/to/jotty/mcp-server/src/main.ts"],
-      "env": {
-        "JOTTY_URL": "https://jotty.example.com",
-        "JOTTY_API_KEY": "ck_..."
-      }
-    }
-  }
-}
-```
-
-Claude Code:
-
-```bash
-claude mcp add jotty -e JOTTY_URL=https://jotty.example.com -e JOTTY_API_KEY=ck_... -- bun run /absolute/path/to/jotty/mcp-server/src/main.ts
-```
-
-### HTTP, next to Jotty
-
-One server for several users. Each client sends its own Jotty key in `x-api-key`, so every session acts as its own user.
-
-`docker-compose.mcp.yml` in the repo root runs Jotty and the MCP server on one network:
-
-```bash
-docker compose -f docker-compose.mcp.yml up -d --build
-```
-
-It serves MCP at `http://<host>:3001/mcp` and health at `/healthz`.
-
-Set `JOTTY_MCP_AUTH_TOKEN` and every `/mcp` request has to send `Authorization: Bearer <token>`. Without it the endpoint is open. That's fine on a private network and a bad idea on a public port. If you also set `JOTTY_API_KEY` as a fallback, anyone who reaches the port acts as that user, and the server logs a warning at startup.
-
-```bash
-claude mcp add --transport http jotty http://localhost:3001/mcp \
-  --header "Authorization: Bearer <token>" \
-  --header "x-api-key: ck_..."
-```
-
-## Settings
-
-| Variable | Default | Meaning |
-|---|---|---|
-| `JOTTY_URL` | `http://localhost:3000` | Jotty base URL, without `/api` |
-| `JOTTY_API_KEY` | | Key for stdio, fallback for HTTP sessions |
-| `JOTTY_MCP_TRANSPORT` | `stdio` | `stdio` or `http` |
-| `JOTTY_MCP_PORT` | `3001` | HTTP port |
-| `JOTTY_MCP_BIND_HOST` | all interfaces | HTTP bind address |
-| `JOTTY_MCP_AUTH_TOKEN` | | Bearer token required on `/mcp` |
-| `JOTTY_MCP_TIMEOUT_MS` | `30000` | Per request timeout towards Jotty |
-| `JOTTY_MCP_MAX_TEXT_CHARS` | `12000` | Longest result a tool returns, in characters |
-| `JOTTY_MCP_SPEC_TTL_MS` | `300000` | How long the API spec is cached |
-| `JOTTY_MCP_LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error`, `silent`. Logs go to stderr. |
-
-## Development
-
-```bash
-bun run dev
-bun run typecheck
-bun test
-bun run build
-```
-
-Tests start a fake Jotty over real HTTP and drive the server through the MCP SDK client. Nothing is mocked at the fetch level.
diff --git a/mcp-server/README.md b/mcp-server/README.md
new file mode 120000
index 000000000..2e87c0ccc
--- /dev/null
+++ b/mcp-server/README.md
@@ -0,0 +1 @@
+../howto/MCP.md
\ No newline at end of file
diff --git a/mcp-server/src/tools/builtins.ts b/mcp-server/src/tools/builtins.ts
index c2e5bd275..4a2a586cf 100644
--- a/mcp-server/src/tools/builtins.ts
+++ b/mcp-server/src/tools/builtins.ts
@@ -17,7 +17,7 @@ export const BUILTIN_TOOLS: Tool[] = [
   {
     name: BuiltinTool.Discover,
     description:
-      "List every Jotty API operation this instance offers, with its operationId, method, path and summary, plus which dedicated tools are available. Pass operationId to get that operation's input schema for call_operation.",
+      "List the Jotty API operations the dedicated tools don't cover, with their operationId, method, path and summary, plus which dedicated tools are available. Pass operationId to get any operation's input schema for call_operation.",
     inputSchema: {
       type: "object",
       properties: {
@@ -51,7 +51,7 @@ export const BUILTIN_TOOLS: Tool[] = [
 
 const _summaryOf = (spec: Spec) =>
   [...spec.operations.values()]
-    .filter((op) => op.tags?.[0] !== PLUMBING_TAG)
+    .filter((op) => op.tags?.[0] !== PLUMBING_TAG && !CURATED_OPERATIONS.includes(op.operationId))
     .map((op) => ({
       operationId: op.operationId,
       method: op.method.toUpperCase(),
diff --git a/mcp-server/src/tools/catalog.ts b/mcp-server/src/tools/catalog.ts
index 6fb625ab9..f1384a528 100644
--- a/mcp-server/src/tools/catalog.ts
+++ b/mcp-server/src/tools/catalog.ts
@@ -2,12 +2,13 @@ export interface CatalogEntry {
   id: string;
   defaults?: Record<string, unknown>;
   pick?: string;
+  omit?: string[];
 }
 
 const SUMMARY_PAGE = { view: "summary", limit: 25 };
 
 export const CATALOG: CatalogEntry[] = [
-  { id: "search" },
+  { id: "search", omit: ["id"] },
   { id: "listCategories" },
   { id: "getSummary" },
   { id: "getCurrentUser" },
@@ -26,7 +27,7 @@ export const CATALOG: CatalogEntry[] = [
   { id: "deleteChecklistItem" },
   { id: "checkChecklistItem" },
   { id: "uncheckChecklistItem" },
-  { id: "listBoards" },
+  { id: "listBoards", defaults: SUMMARY_PAGE },
   { id: "getBoard" },
   { id: "createBoard" },
   { id: "createBoardItem" },
diff --git a/mcp-server/src/tools/errors.ts b/mcp-server/src/tools/errors.ts
index fa3e148d1..4d5220e98 100644
--- a/mcp-server/src/tools/errors.ts
+++ b/mcp-server/src/tools/errors.ts
@@ -34,13 +34,15 @@ const HINTS: Partial<Record<ToolErrorKind, string>> = {
   [ToolErrorKind.Upstream]: "Try the health tool to see whether Jotty is reachable.",
 };
 
-export const fromError = (err: unknown): ToolResult => {
+export type ErrorHints = Partial<Record<ToolErrorKind, string>>;
+
+export const fromError = (err: unknown, hints: ErrorHints = {}): ToolResult => {
   if (err instanceof TimeoutError) {
     return errorResult(ToolErrorKind.Timeout, err.message, HINTS[ToolErrorKind.Timeout]);
   }
   if (err instanceof JottyError) {
     const kind = KIND_BY_STATUS[err.status] ?? ToolErrorKind.Upstream;
-    return errorResult(kind, err.message, HINTS[kind], err.status);
+    return errorResult(kind, err.message, hints[kind] ?? HINTS[kind], err.status);
   }
   const message = err instanceof Error ? err.message : "Unexpected failure";
   return errorResult(ToolErrorKind.Upstream, message, HINTS[ToolErrorKind.Upstream]);
diff --git a/mcp-server/src/tools/operation.ts b/mcp-server/src/tools/operation.ts
index aaa2f5a6f..52e618e8d 100644
--- a/mcp-server/src/tools/operation.ts
+++ b/mcp-server/src/tools/operation.ts
@@ -2,15 +2,18 @@ import type { Tool } from "@modelcontextprotocol/sdk/types.js";
 import { binaryMediaOf, type JsonSchema, type Operation } from "../jotty/openapi.ts";
 import { API_KEY_HEADER, JottyError } from "../jotty/client.ts";
 import type { Spec } from "../jotty/spec.ts";
-import { ToolErrorKind, errorResult, fromError } from "./errors.ts";
-import { respond, toolResult, type ToolResult } from "./result.ts";
+import { ToolErrorKind, errorResult, fromError, type ErrorHints } from "./errors.ts";
+import { respond, toolResult, type MoreRows, type ToolResult } from "./result.ts";
 import type { ToolContext } from "./context.ts";
-import { fillPath, splitArgs, toolInput } from "./schema.ts";
+import { fillPath, splitArgs, toolInput, type ArgLayout } from "./schema.ts";
 import { catalogEntry, toolNameOf } from "./catalog.ts";
 import { logger } from "../utils/logger.ts";
 
 const LOG_NS = "tool-operation";
 const SERVER_ERROR = 500;
+const OFFSET = "offset";
+const PAGING = new Set([OFFSET, "limit", "view"]);
+const ITEM_INDEX = "{itemIndex}";
 
 enum Verb {
   Get = "get",
@@ -57,6 +60,35 @@ const _picked = (data: unknown, field?: string): unknown => {
   return { success: record.success, [field]: record[field] };
 };
 
+const _omitted = (data: unknown, keys?: string[]): unknown => {
+  if (!keys?.length || !data || typeof data !== "object" || Array.isArray(data)) return data;
+  const strip = (row: unknown) =>
+    row && typeof row === "object" && !Array.isArray(row)
+      ? Object.fromEntries(Object.entries(row).filter(([key]) => !keys.includes(key)))
+      : row;
+  return Object.fromEntries(
+    Object.entries(data).map(([field, value]) => [field, Array.isArray(value) ? value.map(strip) : value]),
+  );
+};
+
+const _moreRows = (layout: ArgLayout, offset: unknown): MoreRows => {
+  if (layout.query.includes(OFFSET)) {
+    const start = Number(offset) || 0;
+    return (shown) => `Pass offset=${start + shown} to read the next rows, or narrow the request with a filter.`;
+  }
+  const filters = layout.query.filter((name) => !PAGING.has(name));
+  const narrow = filters.length ? `Narrow it with ${filters.join(", ")}` : "Use a more specific operation";
+  return () => `This operation doesn't page. ${narrow} to see the rest.`;
+};
+
+const _hintsFor = (op: Operation, curated: boolean): ErrorHints => ({
+  [ToolErrorKind.Input]: op.path.includes(ITEM_INDEX)
+    ? "Call get_checklist to see each item's itemIndex."
+    : curated
+      ? "Check the arguments against the tool's input schema."
+      : `Call discover with operationId ${op.operationId} to see what it takes.`,
+});
+
 const _download = (ctx: ToolContext, path: string, contentType: string): ToolResult => {
   const report = { download: `${ctx.client.baseUrl}/api${path}`, contentType, header: API_KEY_HEADER };
   return toolResult(
@@ -95,16 +127,18 @@ export const runOperation = async (
   const defaults = Object.fromEntries(
     Object.entries(entry?.defaults ?? {}).filter(([name]) => known.includes(name)),
   );
-  const parts = splitArgs(layout, { ...defaults, ...args });
+  const merged = { ...defaults, ...args };
+  const parts = splitArgs(layout, merged);
   const path = fillPath(op.path, parts.path);
   const binary = binaryMediaOf(op);
   if (binary) return _download(ctx, path, binary);
   try {
     const response = await ctx.client.send({ method: op.method, path, query: parts.query, body: parts.body, signal });
-    return respond(_picked(response.data, entry?.pick), ctx.config.output.maxTextChars);
+    const data = _omitted(_picked(response.data, entry?.pick), entry?.omit);
+    return respond(data, ctx.config.output.maxTextChars, _moreRows(layout, merged[OFFSET]));
   } catch (err) {
     const refused = err instanceof JottyError && err.status < SERVER_ERROR;
     (refused ? logger.debug : logger.warn)(LOG_NS, `${op.operationId} failed`, err);
-    return fromError(err);
+    return fromError(err, _hintsFor(op, curated));
   }
 };
diff --git a/mcp-server/src/tools/result.ts b/mcp-server/src/tools/result.ts
index ca0435660..1be321080 100644
--- a/mcp-server/src/tools/result.ts
+++ b/mcp-server/src/tools/result.ts
@@ -12,9 +12,12 @@ export interface Trimmed {
   hint: string;
 }
 
-const MORE_ROWS = "Pass offset to read the next rows, or narrow the request with a filter or view=summary.";
 const CUT_TEXT = "Narrow the request with a filter, limit and offset, or view=summary.";
 
+export type MoreRows = (shown: number) => string;
+
+const _moreRows: MoreRows = () => "Narrow the request with a filter to see the rest.";
+
 type Row = Record<string, unknown>;
 
 export const asRecord = (data: unknown): Record<string, unknown> =>
@@ -34,31 +37,32 @@ const _longestList = (record: Row): string | undefined =>
     .filter(([, value]) => Array.isArray(value) && value.length > 1)
     .sort(([, a], [, b]) => _json(b).length - _json(a).length)[0]?.[0];
 
-const _withRows = (record: Row, field: string, rows: unknown[], of: number): Row => ({
+const _withRows = (record: Row, field: string, rows: unknown[], of: number, more: MoreRows): Row => ({
   ...record,
   [field]: rows,
-  trimmed: { field, shown: rows.length, of, hint: MORE_ROWS } satisfies Trimmed,
+  trimmed: { field, shown: rows.length, of, hint: more(rows.length) } satisfies Trimmed,
 });
 
-const _fitRows = (record: Row, field: string, maxChars: number): Row | null => {
+const _fitRows = (record: Row, field: string, maxChars: number, more: MoreRows): Row | null => {
   const rows = record[field] as unknown[];
+  const fit = (count: number) => _withRows(record, field, rows.slice(0, count), rows.length, more);
   let low = 0;
   let high = rows.length - 1;
   while (low < high) {
     const mid = Math.ceil((low + high) / 2);
-    if (_json(_withRows(record, field, rows.slice(0, mid), rows.length)).length <= maxChars) low = mid;
+    if (_json(fit(mid)).length <= maxChars) low = mid;
     else high = mid - 1;
   }
-  return low > 0 ? _withRows(record, field, rows.slice(0, low), rows.length) : null;
+  return low > 0 ? fit(low) : null;
 };
 
-export const respond = (data: unknown, maxChars: number): ToolResult => {
+export const respond = (data: unknown, maxChars: number, more: MoreRows = _moreRows): ToolResult => {
   const text = _json(data);
   if (text.length <= maxChars) return toolResult(text, asRecord(data));
 
   const record = asRecord(data);
   const field = _longestList(record);
-  const fitted = field ? _fitRows(record, field, maxChars) : null;
+  const fitted = field ? _fitRows(record, field, maxChars, more) : null;
   if (fitted) return toolResult(_json(fitted), fitted);
 
   return toolResult(`${text.slice(0, maxChars)}\n... cut at ${maxChars} of ${text.length} characters. ${CUT_TEXT}`);
diff --git a/mcp-server/tests/helpers.ts b/mcp-server/tests/helpers.ts
index 1e7759d79..7ea6134b7 100644
--- a/mcp-server/tests/helpers.ts
+++ b/mcp-server/tests/helpers.ts
@@ -37,6 +37,7 @@ export const FAKE_SPEC: OpenApiDocument = {
           { name: "q", in: "query" as never, required: false, schema: { type: "string" } },
           { name: "view", in: "query" as never, required: false, schema: { type: "string", default: "full" } },
           { name: "limit", in: "query" as never, required: false, schema: { type: "integer" } },
+          { name: "offset", in: "query" as never, required: false, schema: { type: "integer" } },
         ],
       },
       post: {
@@ -66,6 +67,33 @@ export const FAKE_SPEC: OpenApiDocument = {
         parameters: [{ name: "noteId", in: "path" as never, required: true, schema: { type: "string" } }],
       },
     },
+    "/search": {
+      get: {
+        operationId: "search",
+        summary: "Search",
+        tags: ["Discovery"],
+        parameters: [{ name: "q", in: "query" as never, required: true, schema: { type: "string" } }],
+      },
+    },
+    "/tasks": {
+      get: {
+        operationId: "listTasks",
+        summary: "List tasks",
+        tags: ["Tasks"],
+        parameters: [{ name: "category", in: "query" as never, required: false, schema: { type: "string" } }],
+      },
+    },
+    "/checklists/{listId}/items/{itemIndex}/check": {
+      put: {
+        operationId: "checkChecklistItem",
+        summary: "Check an item",
+        tags: ["Checklist items"],
+        parameters: [
+          { name: "listId", in: "path" as never, required: true, schema: { type: "string" } },
+          { name: "itemIndex", in: "path" as never, required: true, schema: { type: "string" } },
+        ],
+      },
+    },
     "/exports/{filename}": {
       get: {
         operationId: "downloadExport",
@@ -124,6 +152,12 @@ export const serveJotty = (spec: OpenApiDocument = FAKE_SPEC): FakeJotty => {
       if (url.pathname === "/api/notes" && url.searchParams.get("q") === "many") {
         return _json({ notes: MANY_NOTES, total: MANY_NOTES.length });
       }
+      if (url.pathname === "/api/search") {
+        return _json({ results: [{ uuid: "u-1", slug: "milk", id: "milk", title: "Milk" }], total: 1 });
+      }
+      if (url.pathname === "/api/tasks") return _json({ tasks: MANY_NOTES });
+      if (url.pathname === "/api/tasks/bad/statuses") return _json({ error: "Status id is required" }, 400);
+      if (url.pathname.endsWith("/check")) return _json({ error: "Item index out of range" }, 400);
       if (url.pathname === "/api/notes") return _json(request.method === "GET" ? { notes: [NOTE] } : { success: true, data: NOTE });
       if (url.pathname.startsWith("/api/kanban/")) {
         return _json({ success: true, data: { uuid: "b-1", items: [CARD, { ...CARD, id: "c-2" }] }, item: CARD });
diff --git a/mcp-server/tests/session.test.ts b/mcp-server/tests/session.test.ts
index 74af4b6ba..c385d47b1 100644
--- a/mcp-server/tests/session.test.ts
+++ b/mcp-server/tests/session.test.ts
@@ -47,10 +47,12 @@ describe("http transport", () => {
     const client = await connect({ authorization: `Bearer ${TOKEN}`, "x-api-key": API_KEY });
     const { tools } = await client.listTools();
     expect(tools.map((tool) => tool.name)).toEqual([
+      "search",
       "list_notes",
       "get_note",
       "create_note",
       "delete_note",
+      "check_checklist_item",
       "update_board_item",
       "discover",
       "call_operation",
diff --git a/mcp-server/tests/tools.test.ts b/mcp-server/tests/tools.test.ts
index 9655c4c91..f33e4dd54 100644
--- a/mcp-server/tests/tools.test.ts
+++ b/mcp-server/tests/tools.test.ts
@@ -52,6 +52,33 @@ describe("runOperation", () => {
     expect(data.trimmed).toMatchObject({ field: "notes", of: 30 });
   });
 
+  it("says which offset reads the next rows", async () => {
+    const ctx = makeCtx(jotty.url);
+    ctx.config.output.maxTextChars = 1_000;
+    const result = await runOperation(ctx, spec, op("listNotes"), { q: "many", offset: 5 });
+    const trimmed = structured(result).trimmed as { shown: number; hint: string };
+    expect(trimmed.hint).toContain(`offset=${5 + trimmed.shown}`);
+  });
+
+  it("doesn't suggest offset to an operation that can't page", async () => {
+    const ctx = makeCtx(jotty.url);
+    ctx.config.output.maxTextChars = 1_000;
+    const result = await runOperation(ctx, spec, op("listTasks"), {});
+    const trimmed = structured(result).trimmed as { hint: string };
+    expect(trimmed.hint).not.toContain("offset");
+    expect(trimmed.hint).toContain("category");
+  });
+
+  it("leaves out the catalog's omitted row fields", async () => {
+    const result = await runOperation(makeCtx(jotty.url), spec, op("search"), { q: "milk" }, { curated: true });
+    expect(structured(result).results).toEqual([{ uuid: "u-1", slug: "milk", title: "Milk" }]);
+  });
+
+  it("points a bad item index at get_checklist", async () => {
+    const result = await runOperation(makeCtx(jotty.url), spec, op("checkChecklistItem"), { listId: "l-1", itemIndex: "9" }, { curated: true });
+    expect(text(result)).toContain("get_checklist");
+  });
+
   it("cuts an oversized single record and leaves out the structured copy", async () => {
     const ctx = makeCtx(jotty.url);
     ctx.config.output.maxTextChars = 20;
@@ -98,10 +125,25 @@ describe("builtins", () => {
     const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.Discover, {});
     const data = structured(result);
     expect(data.version).toBe("9.9.9");
-    expect(data.tools).toEqual(["list_notes", "get_note", "create_note", "delete_note", "update_board_item"]);
+    expect(data.tools).toEqual(["search", "list_notes", "get_note", "create_note", "delete_note", "check_checklist_item", "update_board_item"]);
     expect(data.unavailableTools).toContain("list_boards");
   });
 
+  it("discover leaves out the operations dedicated tools cover", async () => {
+    const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.Discover, {});
+    const ids = (structured(result).operations as { operationId: string }[]).map((entry) => entry.operationId);
+    expect(ids).toEqual(expect.arrayContaining(["listTasks", "downloadExport", "createTaskStatus"]));
+    expect(ids).not.toContain("listNotes");
+  });
+
+  it("call_operation input errors point at discover", async () => {
+    const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.CallOperation, {
+      operationId: "createTaskStatus",
+      arguments: { taskId: "bad", body: { label: "x" } },
+    });
+    expect(text(result)).toContain("Call discover with operationId createTaskStatus");
+  });
+
   it("discover returns one operation's input schema", async () => {
     const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.Discover, { operationId: "createTaskStatus" });
     expect(structured(result)).toMatchObject({ operationId: "createTaskStatus", inputSchema: { required: ["taskId", "body"] } });
diff --git a/tests/api/discovery.test.ts b/tests/api/discovery.test.ts
index 015d7566a..fac4d803f 100644
--- a/tests/api/discovery.test.ts
+++ b/tests/api/discovery.test.ts
@@ -71,7 +71,7 @@ describe("Discovery, user and export contracts", () => {
       expect(mockGrepSearch).toHaveBeenCalledTimes(1);
       expect(data).toEqual({
         query: "milk",
-        results: [{ id: "milk", uuid: "n-1", type: "note", title: "Milk", category: "Food" }],
+        results: [{ id: "milk", slug: "milk", uuid: "n-1", type: "note", title: "Milk", category: "Food" }],
         total: 1,
       });
     });
diff --git a/tests/api/list-views.test.ts b/tests/api/list-views.test.ts
index 65f25043c..0dd66a09f 100644
--- a/tests/api/list-views.test.ts
+++ b/tests/api/list-views.test.ts
@@ -17,6 +17,8 @@ import { GET as LIST_NOTES } from "@/app/api/notes/route"
 import { GET as LIST_CHECKLISTS } from "@/app/api/checklists/route"
 import { GET as GET_CHECKLIST } from "@/app/api/checklists/[listId]/route"
 import { POST as CREATE_ITEM } from "@/app/api/checklists/[listId]/items/route"
+import { GET as LIST_BOARDS } from "@/app/api/kanban/route"
+import { GET as LIST_TASKS } from "@/app/api/tasks/route"
 
 const LIST_UUID = "7b1d2c3e-4f50-4a6b-8c7d-9e0f1a2b3c4d"
 
@@ -29,7 +31,7 @@ const notes = Array.from({ length: 5 }, (_, n) => ({
   content: `# Heading ${n}\n\nBody of note ${n}`,
 }))
 
-type Row = { id: string; text: string; completed: boolean; children?: Row[] }
+type Row = { id: string; text: string; completed: boolean; status?: string; children?: Row[] }
 
 const list = (items: Row[] = [{ id: "a", text: "milk", completed: true }, { id: "b", text: "bread", completed: false }]) => ({
   id: "groceries",
@@ -107,6 +109,55 @@ describe("List views and paging", () => {
     })
   })
 
+  describe("GET /api/kanban", () => {
+    const boards = Array.from({ length: 3 }, (_, n) => ({
+      ...list([
+        { id: `c-${n}`, text: "card", completed: false, status: "todo" },
+        { id: `d-${n}`, text: "done card", completed: true, status: "completed" },
+      ]),
+      uuid: `board-${n}`,
+      type: "kanban",
+    }))
+
+    it("keeps returning every card by default", async () => {
+      mockGetUserChecklists.mockResolvedValue({ success: true, data: boards })
+
+      const data = await getResponseJson(await LIST_BOARDS(createMockRequest("GET", "http://localhost:3000/api/kanban")))
+
+      expect(data.boards).toHaveLength(3)
+      expect(data.boards[0].items).toHaveLength(2)
+      expect(data.total).toBe(3)
+    })
+
+    it("pages and counts cards per status in the summary view", async () => {
+      mockGetUserChecklists.mockResolvedValue({ success: true, data: boards })
+
+      const data = await getResponseJson(
+        await LIST_BOARDS(createMockRequest("GET", "http://localhost:3000/api/kanban?view=summary&limit=1&offset=1")),
+      )
+
+      expect(data.total).toBe(3)
+      expect(data.boards).toEqual([
+        expect.objectContaining({ id: "board-1", itemCount: 2, statusCounts: { todo: 1, completed: 1 } }),
+      ])
+      expect(data.boards[0].items).toBeUndefined()
+    })
+  })
+
+  describe("GET /api/tasks", () => {
+    it("pages with limit and offset and reports the total", async () => {
+      const tasks = Array.from({ length: 3 }, (_, n) => ({ ...list(), uuid: `task-${n}`, type: "kanban" }))
+      mockGetUserChecklists.mockResolvedValue({ success: true, data: tasks })
+
+      const data = await getResponseJson(
+        await LIST_TASKS(createMockRequest("GET", "http://localhost:3000/api/tasks?limit=2&offset=2")),
+      )
+
+      expect(data.total).toBe(3)
+      expect(data.tasks.map((task: { id: string }) => task.id)).toEqual(["task-2"])
+    })
+  })
+
   describe("GET /api/checklists/:listId", () => {
     it("returns one checklist with indexed items", async () => {
       mockGetListById.mockResolvedValue(list())
@@ -122,6 +173,22 @@ describe("List views and paging", () => {
       expect(data.data.items.map((item: { index: number }) => item.index)).toEqual([0, 1])
     })
 
+    it("gives every item, sub-items too, the itemIndex the item routes take", async () => {
+      mockGetListById.mockResolvedValue(
+        list([
+          { id: "a", text: "milk", completed: false },
+          { id: "b", text: "bread", completed: false, children: [{ id: "b-sub", text: "sourdough", completed: false }] },
+        ]),
+      )
+
+      const data = await getResponseJson(
+        await GET_CHECKLIST(createMockRequest("GET", `http://localhost:3000/api/checklists/${LIST_UUID}`), listParams()),
+      )
+
+      expect(data.data.items.map((item: { itemIndex: string }) => item.itemIndex)).toEqual(["0", "1"])
+      expect(data.data.items[1].children[0]).toMatchObject({ index: 0, itemIndex: "1.0" })
+    })
+
     it("answers 404 for a list the key owner can't see", async () => {
       mockGetListById.mockResolvedValue(undefined)
 
diff --git a/tests/server-actions/audit-caller.test.ts b/tests/server-actions/audit-caller.test.ts
new file mode 100644
index 000000000..b1ec7a08d
--- /dev/null
+++ b/tests/server-actions/audit-caller.test.ts
@@ -0,0 +1,39 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import fs from "fs/promises";
+
+const { mockGetCurrentUser } = vi.hoisted(() => ({ mockGetCurrentUser: vi.fn() }));
+
+vi.mock("@/app/_server/actions/users", () => ({ getCurrentUser: mockGetCurrentUser }));
+vi.mock("@/app/_server/actions/file", () => ({ ensureDir: vi.fn() }));
+
+import { logContentEvent } from "@/app/_server/actions/log/writers";
+import { actAs } from "@/app/_server/api/caller-scope";
+import type { ApiUser } from "@/app/_server/api/contract";
+
+const keyOwner = { username: "keyholder" } as ApiUser;
+
+const writtenPath = () => String(vi.mocked(fs.writeFile).mock.calls.at(-1)?.[0]);
+
+describe("audit log attribution", () => {
+  beforeEach(() => {
+    vi.mocked(fs.readFile).mockRejectedValue(new Error("ENOENT"));
+    vi.mocked(fs.writeFile).mockResolvedValue(undefined);
+    mockGetCurrentUser.mockResolvedValue(null);
+  });
+
+  it("files an API request under the API key owner", async () => {
+    await actAs(keyOwner, () => logContentEvent("note_created", "note", "u-1", "Milk", true));
+    expect(writtenPath()).toContain("/keyholder/");
+  });
+
+  it("still files a browser request under the session user", async () => {
+    mockGetCurrentUser.mockResolvedValue({ username: "browser" });
+    await logContentEvent("note_created", "note", "u-1", "Milk", true);
+    expect(writtenPath()).toContain("/browser/");
+  });
+
+  it("falls back to system when nobody is asking", async () => {
+    await logContentEvent("note_created", "note", "u-1", "Milk", true);
+    expect(writtenPath()).toContain("/system/");
+  });
+});

From 799e52f500ce8771c1827240813687f6338c98b3 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 13:32:57 +0100
Subject: [PATCH 19/28] getting there sugarplum

---
 .../Profile/Parts/UserPreferencesTab.tsx      | 333 +++++++-----------
 .../Search/Parts/SearchResults.tsx            |  17 +-
 .../FeatureComponents/Search/SearchBar.tsx    |   2 +
 .../FormElements/FormWrapper.tsx              |  46 ++-
 .../Layout/IndexingRelations.tsx              |   9 +-
 app/_consts/relations.ts                      |  12 +-
 app/_consts/search.ts                         |   9 +
 app/_consts/sharing.ts                        |   5 +
 app/_consts/user-settings.ts                  |   1 +
 app/_hooks/useSearch.ts                       |   4 +
 app/_schemas/api/discovery.ts                 |  16 +-
 app/_schemas/api/relations.ts                 | 163 +++++++++
 app/_schemas/user-schemas.ts                  |   6 +
 app/_server/actions/note/editor.ts            |  24 ++
 app/_server/actions/relations/explore.ts      | 303 ++++++++++++++++
 app/_server/actions/relations/index.ts        |  77 +---
 app/_server/actions/relations/indexer.ts      |  33 +-
 app/_server/actions/relations/parser.ts       |  21 +-
 app/_server/actions/relations/queries.ts      |  12 +-
 app/_server/actions/relations/search.ts       |  75 ++++
 app/_server/actions/relations/searchable.ts   |  43 +++
 app/_server/actions/relations/store.ts        |   3 +
 app/_server/actions/search/engine.ts          | 120 +++++++
 app/_server/actions/search/index.ts           |  82 ++---
 app/_server/actions/share/listing.ts          |  41 +++
 app/_server/actions/share/queries.ts          |  31 ++
 app/_server/api/contract.ts                   |   2 +
 app/_server/api/route-index.ts                |  10 +
 app/_translations/de.json                     |   4 -
 app/_translations/en.json                     |  13 +-
 app/_translations/es.json                     |   4 -
 app/_translations/fr.json                     |   4 -
 app/_translations/it.json                     |   4 -
 app/_translations/klingon.json                |   4 -
 app/_translations/ko.json                     |   4 -
 app/_translations/nl.json                     |   4 -
 app/_translations/pirate.json                 |   4 -
 app/_translations/pl.json                     |   4 -
 app/_translations/pt.json                     |   4 -
 app/_translations/ru.json                     |   4 -
 app/_translations/tr.json                     |   4 -
 app/_translations/vi.json                     |   4 -
 app/_translations/zh.json                     |   4 -
 app/_types/relations.ts                       |  42 +++
 app/_types/sharing.ts                         |  14 +-
 app/_types/user.ts                            |   2 +
 app/api/brain/route.ts                        |  33 ++
 app/api/relations/[itemId]/route.ts           |  32 ++
 app/api/relations/links/route.ts              |  40 +++
 app/api/relations/orphans/route.ts            |  32 ++
 app/api/search/route.ts                       |  72 +---
 app/api/shares/route.ts                       |  31 ++
 howto/BRAIN.md                                |  38 +-
 howto/MCP.md                                  |  13 +-
 mcp-server/src/server/mcp.ts                  |   5 +-
 mcp-server/src/tools/catalog.ts               |  14 +
 mcp-server/src/tools/operation.ts             |   1 +
 mcp-server/tests/helpers.ts                   |  19 +
 mcp-server/tests/session.test.ts              |   1 +
 mcp-server/tests/tools.test.ts                |   9 +-
 tests/api/relations.test.ts                   | 128 +++++++
 tests/api/setup.ts                            |   4 +
 .../server-actions/relations-explore.test.ts  | 274 ++++++++++++++
 tests/server-actions/relations.test.ts        |  21 ++
 64 files changed, 1901 insertions(+), 493 deletions(-)
 create mode 100644 app/_consts/search.ts
 create mode 100644 app/_schemas/api/relations.ts
 create mode 100644 app/_server/actions/relations/explore.ts
 create mode 100644 app/_server/actions/relations/search.ts
 create mode 100644 app/_server/actions/relations/searchable.ts
 create mode 100644 app/_server/actions/search/engine.ts
 create mode 100644 app/_server/actions/share/listing.ts
 create mode 100644 app/api/brain/route.ts
 create mode 100644 app/api/relations/[itemId]/route.ts
 create mode 100644 app/api/relations/links/route.ts
 create mode 100644 app/api/relations/orphans/route.ts
 create mode 100644 app/api/shares/route.ts
 create mode 100644 tests/api/relations.test.ts
 create mode 100644 tests/server-actions/relations-explore.test.ts

diff --git a/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx b/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx
index b3bbbf1fb..4a3dc371e 100644
--- a/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx
+++ b/app/_components/FeatureComponents/Profile/Parts/UserPreferencesTab.tsx
@@ -1,5 +1,5 @@
 "use client";
-import { useEffect, useState, type JSX } from "react";
+import { useEffect, useRef, useState, type JSX } from "react";
 import { useRouter } from "next/navigation";
 import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
@@ -37,6 +37,7 @@ import {
 } from "@/app/_types";
 import { Modes } from "@/app/_types/enums";
 import { DEFAULT_WEEK_START, WeekDay } from "@/app/_consts/calendar";
+import { DEFAULT_SEARCH_MODE, SearchModes } from "@/app/_consts/search";
 import { Dropdown } from "@/app/_components/GlobalComponents/Dropdowns/Dropdown";
 import { CategoryTreeSelector } from "@/app/_components/GlobalComponents/Dropdowns/CategoryTreeSelector";
 import { Label } from "@/app/_components/GlobalComponents/FormElements/label";
@@ -51,6 +52,12 @@ import {
 } from "@/app/_schemas/user-schemas";
 import { DeleteAccountModal } from "@/app/_components/GlobalComponents/Modals/UserModals/DeleteAccountModal";
 
+type SettingsSchema =
+  | typeof generalSettingsSchema
+  | typeof editorSettingsSchema
+  | typeof checklistSettingsSchema
+  | typeof kanbanSettingsSchema;
+
 interface SettingsTabProps {
   noteCategories: Category[];
   localeOptions: Array<{ id: string, name: JSX.Element }>;
@@ -85,19 +92,61 @@ const getSettingsFromUser = (user: SanitisedUser | null): Partial<SanitisedUser>
   hideMobileStatusDropdown: user?.hideMobileStatusDropdown || "disable",
   hideTimeTrackingOnCards: user?.hideTimeTrackingOnCards || "disable",
   codeBlockStyle: user?.codeBlockStyle || "default",
+  searchMode: user?.searchMode || DEFAULT_SEARCH_MODE,
 });
 
-const pick = <T extends object, K extends keyof T>(
-  obj: T,
-  keys: K[]
-): Pick<T, K> => {
-  const result = {} as Pick<T, K>;
-  keys.forEach((key) => {
-    if (key in obj) {
-      result[key] = obj[key];
-    }
-  });
-  return result;
+const sectionSchema = (
+  keys: (keyof User)[],
+  schema: SettingsSchema
+): Partial<Record<keyof User, SettingsSchema>> =>
+  Object.fromEntries(keys.map((key) => [key, schema]));
+
+const SETTING_SCHEMAS: Partial<Record<keyof User, SettingsSchema>> = {
+  ...sectionSchema(
+    [
+      "preferredLocale",
+      "preferredTheme",
+      "landingPage",
+      "fileRenameMode",
+      "preferredDateFormat",
+      "preferredTimeFormat",
+      "firstDayOfWeek",
+      "handedness",
+      "hideConnectionIndicator",
+      "searchMode",
+    ],
+    generalSettingsSchema
+  ),
+  ...sectionSchema(
+    [
+      "notesAutoSaveInterval",
+      "notesDefaultMode",
+      "notesDefaultEditor",
+      "tableSyntax",
+      "disableRichEditor",
+      "defaultNoteFilter",
+      "markdownTheme",
+      "codeBlockStyle",
+      "quickCreateNotes",
+      "quickCreateNotesCategory",
+    ],
+    editorSettingsSchema
+  ),
+  ...sectionSchema(
+    [
+      "enableRecurrence",
+      "showCompletedSuggestions",
+      "showChecklistEmojis",
+      "defaultChecklistFilter",
+      "checklistItemClickAction",
+      "newItemInsertion",
+    ],
+    checklistSettingsSchema
+  ),
+  ...sectionSchema(
+    ["hideStatusOnCards", "hideMobileStatusDropdown", "hideTimeTrackingOnCards"],
+    kanbanSettingsSchema
+  ),
 };
 
 export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTabProps) => {
@@ -108,19 +157,18 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
   const [showDeleteModal, setShowDeleteModal] = useState(false);
   const [allThemes, setAllThemes] = useState<any[]>([]);
   const [loadingThemes, setLoadingThemes] = useState(true);
-  const [initialSettings, setInitialSettings] = useState<Partial<User>>(
-    getSettingsFromUser(user)
-  );
   const [currentSettings, setCurrentSettings] = useState<Partial<User>>(
     getSettingsFromUser(user)
   );
   const [validationErrors, setValidationErrors] = useState<
     Record<string, string>
   >({});
+  const savedSettings = useRef<Partial<User>>(getSettingsFromUser(user));
+  const saveQueue = useRef<Promise<void>>(Promise.resolve());
 
   useEffect(() => {
     const newSettings = getSettingsFromUser(user);
-    setInitialSettings(newSettings);
+    savedSettings.current = newSettings;
     setCurrentSettings(newSettings);
   }, [user]);
 
@@ -138,121 +186,55 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
     loadThemes();
   }, []);
 
-  const handleSettingChange = <K extends keyof User>(
-    key: K,
-    value: User[K]
-  ) => {
-    setCurrentSettings((prev) => ({ ...prev, [key]: value }));
-  };
+  const revertSetting = (key: keyof User) =>
+    setCurrentSettings((prev) => ({ ...prev, [key]: savedSettings.current[key] }));
 
-  const hasChanges = (keys: (keyof Partial<User>)[]) => {
-    return keys.some((key) => currentSettings[key] !== initialSettings[key]);
-  };
+  const saveSetting = async (key: keyof User, value: User[keyof User]) => {
+    const schema = SETTING_SCHEMAS[key];
+    const parsed = schema?.partial().safeParse({ [key]: value });
 
-  const hasGeneralChanges = hasChanges([
-    "preferredLocale",
-    "preferredTheme",
-    "landingPage",
-    "fileRenameMode",
-    "preferredDateFormat",
-    "preferredTimeFormat",
-    "firstDayOfWeek",
-    "handedness",
-    "hideConnectionIndicator",
-  ]);
-  const hasEditorChanges = hasChanges([
-    "notesDefaultEditor",
-    "tableSyntax",
-    "notesDefaultMode",
-    "notesAutoSaveInterval",
-    "disableRichEditor",
-    "defaultNoteFilter",
-    "markdownTheme",
-    "codeBlockStyle",
-    "quickCreateNotes",
-    "quickCreateNotesCategory",
-  ]);
-  const hasChecklistsChanges = hasChanges([
-    "enableRecurrence",
-    "showCompletedSuggestions",
-    "showChecklistEmojis",
-    "defaultChecklistFilter",
-    "checklistItemClickAction",
-    "newItemInsertion",
-  ]);
-  const hasKanbanChanges = hasChanges([
-    "hideStatusOnCards",
-    "hideMobileStatusDropdown",
-    "hideTimeTrackingOnCards",
-  ]);
-
-  const validateAndSave = async <T extends Record<string, any>>(
-    settings: T,
-    schema: any,
-    sectionName: string,
-    updateInitialSettings: (prev: Partial<User>) => Partial<User>
-  ) => {
-    try {
-      schema.parse(settings);
-      setValidationErrors((prev) => {
-        const newErrors = { ...prev };
-        Object.keys(settings).forEach((key) => {
-          newErrors[key] = "";
-        });
-        return newErrors;
-      });
-    } catch (error: any) {
-      if (error.errors) {
-        const errors: Record<string, string> = {};
-        error.errors.forEach((err: any) => {
-          errors[err.path[0]] = err.message;
-        });
-        setValidationErrors((prev) => ({ ...prev, ...errors }));
-      }
+    if (parsed && !parsed.success) {
+      const message = parsed.error.issues[0]?.message || "";
+      setValidationErrors((prev) => ({ ...prev, [key]: message }));
+      revertSetting(key);
       showToast({
         type: "error",
         title: t("errors.validationError"),
-        message: "Please fix the validation errors before saving.",
+        message,
       });
       return;
     }
 
-    const result = await updateUserSettings(settings);
-    if (result.success) {
-      setInitialSettings((prev) => updateInitialSettings(prev));
-      router.refresh();
-      showToast({
-        type: "success",
-        title: `${sectionName} settings saved!`,
-        message: `Your ${sectionName.toLowerCase()} preferences have been updated.`,
-      });
-    } else {
-      console.error(
-        `Failed to save ${sectionName.toLowerCase()} settings:`,
-        result.error
-      );
+    setValidationErrors((prev) => ({ ...prev, [key]: "" }));
+
+    const result = await updateUserSettings({ [key]: value });
+    if (!result.success || !result.data?.user) {
+      console.error(`Failed to save setting ${String(key)}:`, result.error);
+      revertSetting(key);
       showToast({
         type: "error",
-        title: `Failed to save ${sectionName.toLowerCase()} settings`,
-        message: result.error || "An unknown error occurred.",
+        title: t("settings.settingsSaveFailed"),
+        message: result.error || t("settings.settingsSaveFailedDescription"),
       });
+      return;
     }
 
-    setUser(result.data?.user || null);
+    savedSettings.current = { ...savedSettings.current, [key]: value };
+    setUser(result.data.user);
     router.refresh();
+    showToast({
+      type: "success",
+      title: t("settings.settingsSaved"),
+    });
   };
 
-  const handleSaveSection = (
-    keys: (keyof User)[],
-    schema: any,
-    sectionName: string
+  const handleSettingChange = <K extends keyof User>(
+    key: K,
+    value: User[K]
   ) => {
-    const settingsToSave = pick(currentSettings, keys);
-
-    validateAndSave(settingsToSave, schema, sectionName, (prev) => ({
-      ...prev,
-      ...settingsToSave,
-    }));
+    if (currentSettings[key] === value) return;
+    setCurrentSettings((prev) => ({ ...prev, [key]: value }));
+    saveQueue.current = saveQueue.current.then(() => saveSetting(key, value));
   };
 
   const dateFormatOptions = [
@@ -348,6 +330,12 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
     { id: "edit", name: t('settings.checklistItemClickActionEdit') },
   ];
 
+  const searchModeOptions = [
+    { id: SearchModes.SMART, name: t('settings.searchModeSmart') },
+    { id: SearchModes.RANKED, name: t('settings.searchModeRanked') },
+    { id: SearchModes.SUBSTRING, name: t('settings.searchModeSubstring') },
+  ];
+
   const newItemInsertionOptions = [
     { id: "top", name: t('settings.newItemInsertionTop') },
     { id: "bottom", name: t('settings.newItemInsertionBottom') },
@@ -370,34 +358,7 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
 
   return (
     <div className="space-y-6">
-      <FormWrapper
-        title={t('settings.general')}
-        action={
-          <Button
-            onClick={() =>
-              handleSaveSection(
-                [
-                  "preferredLocale",
-                  "preferredTheme",
-                  "landingPage",
-                  "fileRenameMode",
-                  "preferredDateFormat",
-                  "preferredTimeFormat",
-                  "firstDayOfWeek",
-                  "handedness",
-                  "hideConnectionIndicator",
-                ],
-                generalSettingsSchema,
-                "General"
-              )
-            }
-            disabled={!hasGeneralChanges}
-            size="sm"
-          >
-            {t('settings.saveGeneral')}
-          </Button>
-        }
-      >
+      <FormWrapper title={t('settings.general')} collapsible>
         <div className="space-y-4">
           <div className="space-y-2">
             <Label htmlFor="preferred-locale">{t('settings.preferredLanguage')}</Label>
@@ -616,37 +577,28 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
               {t('settings.hideConnectionIndicatorDescription')}
             </p>
           </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="search-mode">{t('settings.searchMode')}</Label>
+            <Dropdown
+              id="search-mode"
+              value={currentSettings.searchMode || DEFAULT_SEARCH_MODE}
+              onChange={(value) => handleSettingChange("searchMode", value as SearchModes)}
+              options={searchModeOptions}
+              placeholder={t('settings.selectSearchMode')}
+              className="w-full"
+            />
+            <p className="text-md lg:text-sm text-muted-foreground">
+              {t('settings.searchModeDescription')}
+            </p>
+          </div>
         </div>
       </FormWrapper>
 
       <FormWrapper
         title={t('settings.notesPreferences')}
-        action={
-          <Button
-            onClick={() =>
-              handleSaveSection(
-                [
-                  "notesAutoSaveInterval",
-                  "notesDefaultMode",
-                  "notesDefaultEditor",
-                  "tableSyntax",
-                  "disableRichEditor",
-                  "defaultNoteFilter",
-                  "markdownTheme",
-                  "codeBlockStyle",
-                  "quickCreateNotes",
-                  "quickCreateNotesCategory",
-                ],
-                editorSettingsSchema,
-                "Notes Preferences"
-              )
-            }
-            disabled={!hasEditorChanges}
-            size="sm"
-          >
-            {t('settings.saveEditor')}
-          </Button>
-        }
+        collapsible
+        defaultOpen={false}
       >
         <div className="space-y-2">
           <Label htmlFor="auto-save-interval">{t('settings.autoSaveInterval')}</Label>
@@ -891,28 +843,8 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
 
       <FormWrapper
         title={t('settings.checklistsPreferences')}
-        action={
-          <Button
-            onClick={() =>
-              handleSaveSection(
-                [
-                  "enableRecurrence",
-                  "showCompletedSuggestions",
-                  "showChecklistEmojis",
-                  "defaultChecklistFilter",
-                  "checklistItemClickAction",
-                  "newItemInsertion",
-                ],
-                checklistSettingsSchema,
-                "Checklists"
-              )
-            }
-            disabled={!hasChecklistsChanges}
-            size="sm"
-          >
-            {t('settings.saveChecklists')}
-          </Button>
-        }
+        collapsible
+        defaultOpen={false}
       >
         <div className="space-y-2">
           <Label htmlFor="enable-recurrence">
@@ -1044,25 +976,8 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
 
       <FormWrapper
         title={t('settings.kanbanSection')}
-        action={
-          <Button
-            onClick={() =>
-              handleSaveSection(
-                [
-                  "hideStatusOnCards",
-                  "hideMobileStatusDropdown",
-                  "hideTimeTrackingOnCards",
-                ],
-                kanbanSettingsSchema,
-                "Kanban"
-              )
-            }
-            disabled={!hasKanbanChanges}
-            size="sm"
-          >
-            {t('settings.saveKanban')}
-          </Button>
-        }
+        collapsible
+        defaultOpen={false}
       >
         <div className="space-y-2">
           <Label htmlFor="hide-status-on-cards">
@@ -1134,7 +1049,7 @@ export const UserPreferencesTab = ({ noteCategories, localeOptions }: SettingsTa
         </div>
       </FormWrapper>
 
-      <FormWrapper title={t('settings.accountManagement')}>
+      <FormWrapper title={t('settings.accountManagement')} collapsible defaultOpen={false}>
         <div className="space-y-4">
           <div className="flex items-center justify-between p-4 bg-muted/50 rounded-jotty">
             <div>
diff --git a/app/_components/FeatureComponents/Search/Parts/SearchResults.tsx b/app/_components/FeatureComponents/Search/Parts/SearchResults.tsx
index f65440884..2cd21d4d3 100644
--- a/app/_components/FeatureComponents/Search/Parts/SearchResults.tsx
+++ b/app/_components/FeatureComponents/Search/Parts/SearchResults.tsx
@@ -5,6 +5,7 @@ import { cn } from "@/app/_utils/global-utils";
 import { ItemType } from "@/app/_types";
 import { ItemTypes } from "@/app/_types/enums";
 import { useTranslations } from "next-intl";
+import { IndexingRelations } from "@/app/_components/GlobalComponents/Layout/IndexingRelations";
 
 interface SearchResult {
   id: string;
@@ -22,6 +23,7 @@ interface SearchResultsProps {
   selectedIndex: number;
   onSelectResult: (result: SearchResult) => void;
   query: string;
+  indexing?: boolean;
 }
 
 export const SearchResults = ({
@@ -29,6 +31,7 @@ export const SearchResults = ({
   selectedIndex,
   onSelectResult,
   query,
+  indexing = false,
 }: SearchResultsProps) => {
   const t = useTranslations();
 
@@ -36,7 +39,9 @@ export const SearchResults = ({
     if (!content) return null;
 
     const lowerContent = content.toLowerCase();
-    const lowerQuery = query.toLowerCase();
+    const needles = [query, ...query.split(/\s+/)].map((part) => part.trim().toLowerCase());
+    const lowerQuery =
+      needles.find((part) => part.length > 1 && lowerContent.includes(part)) || needles[0];
     const index = lowerContent.indexOf(lowerQuery);
 
     if (index === -1) {
@@ -45,11 +50,11 @@ export const SearchResults = ({
     }
 
     const start = Math.max(0, index - 50);
-    const end = Math.min(content.length, index + query.length + 70);
+    const end = Math.min(content.length, index + lowerQuery.length + 70);
 
     const before = content.slice(start, index);
-    const match = content.slice(index, index + query.length);
-    const after = content.slice(index + query.length, end);
+    const match = content.slice(index, index + lowerQuery.length);
+    const after = content.slice(index + lowerQuery.length, end);
 
     return (
       <>
@@ -62,6 +67,10 @@ export const SearchResults = ({
     );
   };
 
+  if (results.length === 0 && indexing) {
+    return <IndexingRelations compact label={t("relations.indexingSearch")} />;
+  }
+
   if (results.length === 0) {
     return (
       <div className="p-4 text-center text-muted-foreground">
diff --git a/app/_components/FeatureComponents/Search/SearchBar.tsx b/app/_components/FeatureComponents/Search/SearchBar.tsx
index bb0e926e3..8acbbbf3d 100644
--- a/app/_components/FeatureComponents/Search/SearchBar.tsx
+++ b/app/_components/FeatureComponents/Search/SearchBar.tsx
@@ -34,6 +34,7 @@ export const SearchBar = ({
     handleSelectResult,
     inputRef,
     containerRef,
+    isIndexing,
   } = useSearch({ mode, onModeChange, onResultSelect });
 
   useEffect(() => {
@@ -67,6 +68,7 @@ export const SearchBar = ({
             selectedIndex={selectedIndex}
             onSelectResult={handleSelectResult}
             query={query}
+            indexing={isIndexing}
           />
         </div>
       )}
diff --git a/app/_components/GlobalComponents/FormElements/FormWrapper.tsx b/app/_components/GlobalComponents/FormElements/FormWrapper.tsx
index 43dbbde92..15bfa83d0 100644
--- a/app/_components/GlobalComponents/FormElements/FormWrapper.tsx
+++ b/app/_components/GlobalComponents/FormElements/FormWrapper.tsx
@@ -1,10 +1,15 @@
-import { ReactNode } from "react";
+"use client";
+
+import { ReactNode, useState } from "react";
+import { ArrowDown01Icon, ArrowRight01Icon } from "hugeicons-react";
 
 interface FormWrapperProps {
   title: string;
   children: ReactNode;
   action?: ReactNode;
   contentMaxHeight?: string;
+  collapsible?: boolean;
+  defaultOpen?: boolean;
 }
 
 export const FormWrapper = ({
@@ -12,20 +17,45 @@ export const FormWrapper = ({
   children,
   action,
   contentMaxHeight,
+  collapsible = false,
+  defaultOpen = true,
 }: FormWrapperProps) => {
+  const [isOpen, setIsOpen] = useState(!collapsible || defaultOpen);
+  const Chevron = isOpen ? ArrowDown01Icon : ArrowRight01Icon;
+
   return (
     <div className="jotty-form-wrapper bg-background border border-border rounded-jotty p-6">
-      <div className="jotty-form-wrapper-header flex items-center justify-between mb-4">
-        <h3 className="text-lg font-semibold">{title}</h3>
-        {action}
-      </div>
       <div
-        className={`jotty-form-wrapper-content space-y-6 ${
-          contentMaxHeight ? `max-h-[${contentMaxHeight}] overflow-y-auto` : ""
+        className={`jotty-form-wrapper-header flex items-center justify-between ${
+          isOpen ? "mb-4" : ""
         }`}
       >
-        {children}
+        {collapsible ? (
+          <button
+            type="button"
+            className={`flex items-center justify-between w-[calc(100%+3rem)] -mx-6 -mt-6 px-6 pt-6 text-left cursor-pointer ${
+              isOpen ? "" : "-mb-6 pb-6"
+            }`}
+            onClick={() => setIsOpen((open) => !open)}
+            aria-expanded={isOpen}
+          >
+            <h3 className="text-lg font-semibold">{title}</h3>
+            <Chevron className="h-5 w-5" />
+          </button>
+        ) : (
+          <h3 className="text-lg font-semibold">{title}</h3>
+        )}
+        {action}
       </div>
+      {isOpen && (
+        <div
+          className={`jotty-form-wrapper-content space-y-6 ${
+            contentMaxHeight ? `max-h-[${contentMaxHeight}] overflow-y-auto` : ""
+          }`}
+        >
+          {children}
+        </div>
+      )}
     </div>
   );
 };
diff --git a/app/_components/GlobalComponents/Layout/IndexingRelations.tsx b/app/_components/GlobalComponents/Layout/IndexingRelations.tsx
index 6cb2fe157..922ee8c27 100644
--- a/app/_components/GlobalComponents/Layout/IndexingRelations.tsx
+++ b/app/_components/GlobalComponents/Layout/IndexingRelations.tsx
@@ -3,7 +3,12 @@
 import { useTranslations } from "next-intl";
 import { JottyIcon } from "./CustomIcons/JottyIcon";
 
-export const IndexingRelations = ({ compact = false }: { compact?: boolean }) => {
+interface IndexingRelationsProps {
+  compact?: boolean;
+  label?: string;
+}
+
+export const IndexingRelations = ({ compact = false, label }: IndexingRelationsProps) => {
   const t = useTranslations();
 
   return (
@@ -19,7 +24,7 @@ export const IndexingRelations = ({ compact = false }: { compact?: boolean }) =>
         animated
         slower
       />
-      <span className="text-md lg:text-sm">{t("relations.indexing")}</span>
+      <span className="text-md lg:text-sm">{label || t("relations.indexing")}</span>
     </div>
   );
 };
diff --git a/app/_consts/relations.ts b/app/_consts/relations.ts
index 65f820987..b81ab2b49 100644
--- a/app/_consts/relations.ts
+++ b/app/_consts/relations.ts
@@ -1,5 +1,5 @@
 export const RELATIONS_DB_NAME = ".relations.db";
-export const RELATIONS_SCHEMA_VERSION = 2;
+export const RELATIONS_SCHEMA_VERSION = 4;
 export const LEGACY_LINK_PREFIX = "/jotty/";
 export const WIKILINK_REGEX =
   /\[\[([^\[\]|#^\n]+)(?:[#^][^\[\]|\n]*)?(?:\|([^\[\]\n]*))?\]\]/g;
@@ -36,6 +36,16 @@ export const SUGGESTIONS_PER_ITEM = 3;
 export const SUGGESTIONS_MAX = 250;
 export const SUGGESTION_HUB_LIMIT = 80;
 
+export enum LinkStyles {
+  APPEND = "append",
+  MENTION = "mention",
+}
+
+export const BRAIN_DEPTH_DEFAULT = 2;
+export const BRAIN_DEPTH_MAX = 3;
+export const BRAIN_NODES_DEFAULT = 60;
+export const BRAIN_NODES_MAX = 200;
+
 export const BRAIN_PATH = "/brain";
 export const BRAIN_FOCUS_PARAM = "focus";
 
diff --git a/app/_consts/search.ts b/app/_consts/search.ts
new file mode 100644
index 000000000..da0a69c87
--- /dev/null
+++ b/app/_consts/search.ts
@@ -0,0 +1,9 @@
+export enum SearchModes {
+  SMART = "smart",
+  RANKED = "ranked",
+  SUBSTRING = "substring",
+}
+
+export const DEFAULT_SEARCH_MODE = SearchModes.SMART;
+export const SEARCH_HITS_PER_TYPE = 20;
+export const SEARCH_SNIPPET_TOKENS = 12;
diff --git a/app/_consts/sharing.ts b/app/_consts/sharing.ts
index 5f51f59ed..fa2f96633 100644
--- a/app/_consts/sharing.ts
+++ b/app/_consts/sharing.ts
@@ -8,3 +8,8 @@ export const IMPLICIT_MOUNT_PREFIX = "shared-by:";
 export const SHARE_CODE_SEPARATOR = ":";
 export const SHARED_WITH_KEY = "sharedWith";
 export const SHARED_WITH_NONE = "none";
+
+export enum ShareDirections {
+  WITH_ME = "withMe",
+  BY_ME = "byMe",
+}
diff --git a/app/_consts/user-settings.ts b/app/_consts/user-settings.ts
index b617e915e..f8aae3c1b 100644
--- a/app/_consts/user-settings.ts
+++ b/app/_consts/user-settings.ts
@@ -30,6 +30,7 @@ export const EDITABLE_SETTING_KEYS: ReadonlyArray<keyof User> = [
   "hideTimeTrackingOnCards",
   "codeBlockStyle",
   "newItemInsertion",
+  "searchMode",
 ] as const;
 
 export const EDITABLE_ENCRYPTION_KEYS = [
diff --git a/app/_hooks/useSearch.ts b/app/_hooks/useSearch.ts
index de0bd0d5d..1153376ab 100644
--- a/app/_hooks/useSearch.ts
+++ b/app/_hooks/useSearch.ts
@@ -34,6 +34,7 @@ export const useSearch = ({
   const [selectedIndex, setSelectedIndex] = useState(0);
   const [results, setResults] = useState<SearchResult[]>([]);
   const [isSearching, setIsSearching] = useState(false);
+  const [isIndexing, setIsIndexing] = useState(false);
 
   const inputRef = useRef<HTMLInputElement>(null);
   const containerRef = useRef<HTMLDivElement>(null);
@@ -62,12 +63,14 @@ export const useSearch = ({
     const performSearch = async (searchQuery: string) => {
       if (!searchQuery.trim() || searchQuery.length < 2) {
         setResults([]);
+        setIsIndexing(false);
         return;
       }
 
       setIsSearching(true);
       try {
         const result = await search(searchQuery);
+        setIsIndexing(Boolean(result.indexing));
         if (result.success && result.data) {
           const formatted = result.data.map((item) => ({
             id: item.id,
@@ -155,5 +158,6 @@ export const useSearch = ({
     inputRef,
     containerRef,
     isSearching,
+    isIndexing,
   };
 };
diff --git a/app/_schemas/api/discovery.ts b/app/_schemas/api/discovery.ts
index 2137a65de..abbad8095 100644
--- a/app/_schemas/api/discovery.ts
+++ b/app/_schemas/api/discovery.ts
@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { apiNames } from "@/app/_schemas/api/names";
 import { ItemTypes } from "@/app/_types/enums";
+import { SearchModes } from "@/app/_consts/search";
 
 export const SEARCH_MIN_LEN = 2;
 
@@ -33,6 +34,12 @@ export const searchParamsSchema = z.object({
     .enum(ItemTypes)
     .optional()
     .describe("Only notes or only checklists, both when left out"),
+  match: z
+    .enum(SearchModes)
+    .optional()
+    .describe(
+      "smart ranks the best matches first, words in any order, then adds exact-text matches. ranked returns only the ranked matches. substring returns only the exact-text matches. Uses your search setting when left out, smart by default",
+    ),
 });
 
 export const searchHitSchema = z
@@ -46,7 +53,10 @@ export const searchHitSchema = z
     type: z.enum(ItemTypes),
     title: z.string(),
     category: z.string(),
-    excerpt: z.string().optional().describe("The first matching line, when it is not just the title"),
+    excerpt: z
+      .string()
+      .optional()
+      .describe("The text around the match, when it is not just the title"),
   })
   .register(apiNames, { id: "SearchHit" });
 
@@ -54,6 +64,10 @@ export const searchResultsSchema = z.object({
   query: z.string(),
   results: z.array(searchHitSchema),
   total: z.number(),
+  indexing: z
+    .boolean()
+    .optional()
+    .describe("True while Jotty builds its search index on first start. Ranked searches return nothing until it is done"),
 });
 
 export const summaryQuery = z.object({
diff --git a/app/_schemas/api/relations.ts b/app/_schemas/api/relations.ts
new file mode 100644
index 000000000..3f9e1fbab
--- /dev/null
+++ b/app/_schemas/api/relations.ts
@@ -0,0 +1,163 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import {
+  BRAIN_DEPTH_DEFAULT,
+  BRAIN_DEPTH_MAX,
+  BRAIN_NODES_DEFAULT,
+  BRAIN_NODES_MAX,
+  BrainEdgeKinds,
+  BrainNodeKinds,
+  LinkKinds,
+  LinkStyles,
+  RelationsStatus,
+} from "@/app/_consts/relations";
+import { ShareDirections } from "@/app/_consts/sharing";
+import { ItemTypes } from "@/app/_types/enums";
+import { pageFields, required, totalField, uuidParam } from "./common";
+
+const ORPHANS_DEFAULT = 25;
+
+const statusField = z
+  .enum(RelationsStatus)
+  .describe("building while Jotty indexes links on first start, when every list comes back empty");
+
+export const linkedItemSchema = z
+  .object({
+    uuid: z.string(),
+    type: z.enum(ItemTypes),
+    title: z.string(),
+    category: z.string(),
+    owner: z.string().optional(),
+  })
+  .register(apiNames, { id: "LinkedItem" });
+
+const relatedItemSchema = linkedItemSchema.extend({
+  kind: z.enum(LinkKinds).describe("mention for a [Title](/note/uuid) link, wiki for a [[Title]] link"),
+});
+
+export const relatedParams = uuidParam("itemId", "Note or checklist");
+
+export const relatedSchema = linkedItemSchema
+  .extend({
+    status: statusField,
+    tags: z.array(z.string()),
+    backlinks: z.array(relatedItemSchema).describe("Items that link to this one"),
+    links: z.array(relatedItemSchema).describe("Items this one links to"),
+    unwritten: z.array(z.string()).describe("Titles this item links to with [[wikilinks]] that no note has yet"),
+    mentions: z
+      .array(linkedItemSchema.extend({ snippet: z.string() }))
+      .describe("Notes that name this item in plain text without linking it"),
+    suggestions: z
+      .array(linkedItemSchema.extend({ score: z.number().describe("0 to 1, higher shares more neighbours") }))
+      .describe("Items that share a lot of neighbours with this one but aren't linked to it"),
+  })
+  .register(apiNames, { id: "Relations" });
+
+export const brainQuery = z.object({
+  focus: z
+    .string()
+    .optional()
+    .describe("Item uuid to centre on. Without it you get the most linked items"),
+  depth: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .max(BRAIN_DEPTH_MAX)
+    .default(BRAIN_DEPTH_DEFAULT)
+    .describe("How many links away from focus to go"),
+  limit: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .max(BRAIN_NODES_MAX)
+    .default(BRAIN_NODES_DEFAULT)
+    .describe("Most nodes to return, nearest and most linked first"),
+  suggestions: z
+    .stringbool()
+    .default(false)
+    .describe("Include suggested links between the nodes returned"),
+});
+
+export const brainSchema = z
+  .object({
+    status: statusField,
+    focus: z.string().optional(),
+    nodes: z.array(
+      z.object({
+        id: z.string().describe("Item uuid, or ghost:<title> for a wikilink target nobody has written"),
+        kind: z.enum(BrainNodeKinds),
+        title: z.string(),
+        category: z.string().optional(),
+        owner: z.string().optional(),
+        links: z.number().describe("Links to and from other items"),
+        distance: z.number().optional().describe("Links away from focus"),
+        tags: z.array(z.string()).optional(),
+      }),
+    ),
+    edges: z.array(
+      z.object({
+        source: z.string(),
+        target: z.string(),
+        kind: z.enum(BrainEdgeKinds),
+        weight: z.number().describe("How many times source links to target, or the suggestion score"),
+      }),
+    ),
+    total: z.number().describe("Nodes that matched before limit"),
+    truncated: z.boolean().describe("True when limit left some out"),
+  })
+  .register(apiNames, { id: "Brain" });
+
+export const orphansQuery = z.object({
+  type: z.enum(ItemTypes).optional().describe("Only notes or only checklists, both when left out"),
+  limit: z.coerce.number().int().min(1).default(ORPHANS_DEFAULT).describe("Most results to return"),
+  offset: pageFields.offset,
+});
+
+export const orphansSchema = z.object({
+  status: statusField,
+  orphans: z.array(linkedItemSchema),
+  total: z.number(),
+});
+
+export const linkBody = z.object({
+  source: required("source").describe("Uuid of the note that gets the link"),
+  target: required("target").describe("Uuid of the note or checklist to link to"),
+  style: z
+    .enum(LinkStyles)
+    .default(LinkStyles.APPEND)
+    .describe("append adds a link at the end of the note. mention turns the first plain mention of the target's title into a link"),
+});
+
+const permissionsSchema = z.object({
+  canRead: z.boolean(),
+  canEdit: z.boolean(),
+  canDelete: z.boolean(),
+  canCreate: z.boolean().optional(),
+});
+
+export const sharesQuery = z.object({
+  direction: z
+    .enum(ShareDirections)
+    .optional()
+    .describe("withMe for items other people shared with you, byMe for yours. Both when left out"),
+  type: z.enum(ItemTypes).optional().describe("Only notes or only checklists, both when left out"),
+  ...pageFields,
+});
+
+export const shareSchema = linkedItemSchema
+  .extend({
+    direction: z.enum(ShareDirections),
+    viaCategory: z.string().optional().describe("Set when the item is shared because its folder is"),
+    permissions: permissionsSchema.optional().describe("What you can do with it, on withMe items"),
+    isPublic: z.boolean().optional().describe("Anyone with the link can open it, on byMe items"),
+    sharedWith: z
+      .array(z.object({ username: z.string(), permissions: permissionsSchema }))
+      .optional()
+      .describe("Who holds it and what they can do, on byMe items"),
+  })
+  .register(apiNames, { id: "Share" });
+
+export const sharesSchema = z.object({
+  shares: z.array(shareSchema),
+  total: totalField,
+});
diff --git a/app/_schemas/user-schemas.ts b/app/_schemas/user-schemas.ts
index 41ddf35bf..8dbc41345 100644
--- a/app/_schemas/user-schemas.ts
+++ b/app/_schemas/user-schemas.ts
@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { Modes } from "@/app/_types/enums";
+import { SearchModes } from "@/app/_consts/search";
 
 export const userSettingsSchema = z.object({
   preferredTheme: z.string().min(1, "Theme is required"),
@@ -136,6 +137,11 @@ export const generalSettingsSchema = z.object({
       message: "Hide connection indicator must be either 'enable' or 'disable'",
     })
     .optional(),
+  searchMode: z
+    .enum(SearchModes, {
+      message: "Search mode must be 'smart', 'ranked' or 'substring'",
+    })
+    .optional(),
 });
 
 export type UserSettingsInput = z.infer<typeof userSettingsSchema>;
diff --git a/app/_server/actions/note/editor.ts b/app/_server/actions/note/editor.ts
index efa48fb22..01c0e06f1 100644
--- a/app/_server/actions/note/editor.ts
+++ b/app/_server/actions/note/editor.ts
@@ -280,6 +280,30 @@ export const editNote = async (
     _editNote(actor, formData, autosaveNotes),
   );
 
+export const NOTE_UNCHANGED = "Nothing to change";
+export const NOTE_ENCRYPTED = "Encrypted notes stay closed";
+
+export const rewriteNote = async (
+  actor: SanitisedUser,
+  uuid: string,
+  rewrite: (content: string) => string | null,
+) =>
+  runQueued(itemLane(Modes.NOTES, uuid), async () => {
+    const note = await getNoteById(uuid);
+    if (!note) return { error: "Note not found" };
+    if (note.encrypted) return { error: NOTE_ENCRYPTED };
+
+    const content = rewrite(note.content || "");
+    if (content === null) return { error: NOTE_UNCHANGED };
+
+    const formData = new FormData();
+    formData.append("uuid", note.uuid || uuid);
+    formData.append("title", note.title);
+    formData.append("category", "");
+    formData.append("content", content);
+    return _editNote(actor, formData, false);
+  });
+
 const _dropNote = async (
   currentUser: SanitisedUser,
   formData: FormData,
diff --git a/app/_server/actions/relations/explore.ts b/app/_server/actions/relations/explore.ts
new file mode 100644
index 000000000..f161855fd
--- /dev/null
+++ b/app/_server/actions/relations/explore.ts
@@ -0,0 +1,303 @@
+import { getSettings } from "@/app/_server/actions/config";
+import { NOTE_UNCHANGED, rewriteNote } from "@/app/_server/actions/note/editor";
+import { canReach } from "@/app/_server/actions/share/queries";
+import { itemHref } from "@/app/_utils/global-utils";
+import { escapeLinkText } from "@/app/_utils/item-href-utils";
+import {
+  BRAIN_DEPTH_MAX,
+  BRAIN_NODES_MAX,
+  BrainEdgeKinds,
+  BrainNodeKinds,
+  LinkKinds,
+  LinkStyles,
+  RelationsStatus,
+} from "@/app/_consts/relations";
+import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
+import type { Result, SanitisedUser } from "@/app/_types";
+import type {
+  BrainEdge,
+  BrainGraph,
+  BrainNode,
+  ItemRelations,
+  LinkedItem,
+  Neighbourhood,
+  RelatedItem,
+  RelationsView,
+  SuggestedItem,
+} from "@/app/_types/relations";
+import { backlinksFor, graphFor, visibleItems, type VisibleItem } from "./queries";
+import { relationsDb } from "./store";
+import { wrapMention } from "./tidy";
+
+export const LINKS_OFF = "Links are turned off on this instance";
+export const NOT_VISIBLE = "Not found";
+export const DENIED = "Permission denied";
+
+const LINKING = new Set<BrainEdgeKinds>([BrainEdgeKinds.WIKI, BrainEdgeKinds.MENTION]);
+
+export const linksEnabled = async (): Promise<boolean> => {
+  const settings = await getSettings();
+  return settings?.editor?.enableBilateralLinks !== false;
+};
+
+const _linked = (item: VisibleItem): LinkedItem => ({
+  uuid: item.uuid,
+  type: item.type,
+  title: item.title,
+  category: item.category,
+  owner: item.owner,
+});
+
+const _outgoing = (uuid: string, visible: Map<string, VisibleItem>) => {
+  const rows = relationsDb()
+    .prepare("SELECT dst, dst_text, dst_label, kind FROM links WHERE src = ?")
+    .all(uuid) as { dst: string | null; dst_text: string | null; dst_label: string | null; kind: LinkKinds }[];
+
+  const links: RelatedItem[] = [];
+  const unwritten = new Set<string>();
+  const seen = new Set<string>();
+  rows.forEach((row) => {
+    if (!row.dst) {
+      if (row.kind === LinkKinds.WIKI && row.dst_text) unwritten.add(row.dst_label || row.dst_text);
+      return;
+    }
+    const target = visible.get(row.dst);
+    if (!target || row.dst === uuid || seen.has(row.dst)) return;
+    seen.add(row.dst);
+    links.push({ ..._linked(target), kind: row.kind });
+  });
+
+  return {
+    links: links.sort((a, b) => a.title.localeCompare(b.title)),
+    unwritten: Array.from(unwritten).sort(),
+  };
+};
+
+const _suggestionsFor = (
+  uuid: string,
+  graph: BrainGraph,
+  visible: Map<string, VisibleItem>,
+): SuggestedItem[] =>
+  graph.edges
+    .filter((edge) => edge.kind === BrainEdgeKinds.SUGGESTED && (edge.source === uuid || edge.target === uuid))
+    .map((edge) => ({ other: visible.get(edge.source === uuid ? edge.target : edge.source), score: edge.weight }))
+    .filter((entry): entry is { other: VisibleItem; score: number } => Boolean(entry.other))
+    .map(({ other, score }) => ({ ..._linked(other), score }))
+    .sort((a, b) => b.score - a.score);
+
+export const relatedFor = async (
+  actor: SanitisedUser,
+  uuid: string,
+): Promise<Result<RelationsView>> => {
+  if (!(await linksEnabled())) return { success: false, error: LINKS_OFF };
+
+  const target = uuid.toLowerCase();
+  const visible = await visibleItems(actor.username);
+  const item = visible.get(target);
+  if (!item) return { success: false, error: NOT_VISIBLE };
+
+  const relations: ItemRelations = backlinksFor(target, visible);
+  const base = { ..._linked(item), tags: item.tags, status: relations.status };
+  if (relations.status === RelationsStatus.BUILDING) {
+    return {
+      success: true,
+      data: { ...base, backlinks: [], links: [], unwritten: [], mentions: [], suggestions: [] },
+    };
+  }
+
+  const graph = graphFor(actor.username, visible);
+  return {
+    success: true,
+    data: {
+      ...base,
+      backlinks: relations.backlinks,
+      ..._outgoing(target, visible),
+      mentions: relations.mentions,
+      suggestions: _suggestionsFor(target, graph, visible),
+    },
+  };
+};
+
+const _linkDegrees = (edges: BrainEdge[]): Map<string, number> => {
+  const degrees = new Map<string, number>();
+  const bump = (id: string) => degrees.set(id, (degrees.get(id) || 0) + 1);
+  edges.forEach((edge) => {
+    bump(edge.source);
+    bump(edge.target);
+  });
+  return degrees;
+};
+
+const _adjacency = (edges: BrainEdge[]): Map<string, Set<string>> => {
+  const around = new Map<string, Set<string>>();
+  const add = (from: string, to: string) => {
+    if (!around.has(from)) around.set(from, new Set());
+    around.get(from)!.add(to);
+  };
+  edges.forEach((edge) => {
+    add(edge.source, edge.target);
+    add(edge.target, edge.source);
+  });
+  return around;
+};
+
+const _ring = (focus: string, edges: BrainEdge[], depth: number): Map<string, number> => {
+  const around = _adjacency(edges);
+  const distance = new Map<string, number>([[focus, 0]]);
+  let frontier = [focus];
+  for (let step = 1; step <= depth && frontier.length; step++) {
+    const next: string[] = [];
+    frontier.forEach((id) =>
+      around.get(id)?.forEach((other) => {
+        if (distance.has(other)) return;
+        distance.set(other, step);
+        next.push(other);
+      }),
+    );
+    frontier = next;
+  }
+  return distance;
+};
+
+interface NeighbourhoodOptions {
+  focus?: string;
+  depth: number;
+  limit: number;
+  suggestions: boolean;
+}
+
+export const neighbourhoodFor = async (
+  actor: SanitisedUser,
+  { focus, depth, limit, suggestions }: NeighbourhoodOptions,
+): Promise<Result<Neighbourhood>> => {
+  if (!(await linksEnabled())) return { success: false, error: LINKS_OFF };
+
+  const visible = await visibleItems(actor.username);
+  const centre = focus?.toLowerCase();
+  if (centre && !visible.has(centre)) return { success: false, error: NOT_VISIBLE };
+
+  const graph = graphFor(actor.username, visible);
+  const empty = { status: graph.status, focus: centre, nodes: [], edges: [], total: 0, truncated: false };
+  if (graph.status === RelationsStatus.BUILDING) return { success: true, data: empty };
+
+  const links = graph.edges.filter((edge) => LINKING.has(edge.kind));
+  const degrees = _linkDegrees(links);
+  const byId = new Map(graph.nodes.map((node) => [node.id, node]));
+  const distance = centre ? _ring(centre, links, Math.min(depth, BRAIN_DEPTH_MAX)) : null;
+
+  const candidates = graph.nodes
+    .filter((node) => node.kind !== BrainNodeKinds.TAG)
+    .filter((node) => (distance ? distance.has(node.id) : (degrees.get(node.id) || 0) > 0))
+    .sort(
+      (a, b) =>
+        (distance ? distance.get(a.id)! - distance.get(b.id)! : 0) ||
+        (degrees.get(b.id) || 0) - (degrees.get(a.id) || 0) ||
+        a.title.localeCompare(b.title),
+    );
+
+  const cap = Math.min(limit, BRAIN_NODES_MAX);
+  const kept = new Set(candidates.slice(0, cap).map((node) => node.id));
+  const shown = (edge: BrainEdge) => kept.has(edge.source) && kept.has(edge.target);
+  const edges = [
+    ...links.filter(shown),
+    ...(suggestions ? graph.edges.filter((edge) => edge.kind === BrainEdgeKinds.SUGGESTED && shown(edge)) : []),
+  ];
+
+  const nodes = Array.from(kept).map((id) => {
+    const node = byId.get(id) as BrainNode;
+    const item = visible.get(id);
+    return {
+      id,
+      kind: node.kind,
+      title: node.title,
+      category: node.category,
+      owner: node.owner,
+      links: degrees.get(id) || 0,
+      ...(distance && { distance: distance.get(id) }),
+      ...(item?.tags.length && { tags: item.tags }),
+    };
+  });
+
+  return {
+    success: true,
+    data: { ...empty, nodes, edges, total: candidates.length, truncated: candidates.length > cap },
+  };
+};
+
+interface OrphanOptions {
+  type?: ItemTypes;
+  limit: number;
+  offset: number;
+}
+
+export const orphansFor = async (
+  actor: SanitisedUser,
+  { type, limit, offset }: OrphanOptions,
+): Promise<Result<{ status: RelationsStatus; orphans: LinkedItem[]; total: number }>> => {
+  if (!(await linksEnabled())) return { success: false, error: LINKS_OFF };
+
+  const visible = await visibleItems(actor.username);
+  const graph = graphFor(actor.username, visible);
+  if (graph.status === RelationsStatus.BUILDING) {
+    return { success: true, data: { status: graph.status, orphans: [], total: 0 } };
+  }
+
+  const connected = new Set<string>();
+  graph.edges
+    .filter((edge) => LINKING.has(edge.kind) && visible.has(edge.source) && visible.has(edge.target))
+    .forEach((edge) => {
+      connected.add(edge.source);
+      connected.add(edge.target);
+    });
+
+  const orphans = Array.from(visible.values())
+    .filter((item) => !connected.has(item.uuid) && (!type || item.type === type))
+    .map(_linked)
+    .sort((a, b) => a.title.localeCompare(b.title));
+
+  return {
+    success: true,
+    data: { status: graph.status, orphans: orphans.slice(offset, offset + limit), total: orphans.length },
+  };
+};
+
+const _appendLink = (title: string, href: string) => (content: string) =>
+  `${content.trimEnd()}\n\n[${escapeLinkText(title)}](${href})\n`;
+
+const _wrapFirst = (title: string, href: string) => (content: string) =>
+  wrapMention(content, title, href);
+
+export const MENTION_MISSING = "Mention not found";
+
+export const linkItems = async (
+  actor: SanitisedUser,
+  sourceUuid: string,
+  targetUuid: string,
+  style: LinkStyles,
+): Promise<Result<null>> => {
+  if (!(await linksEnabled())) return { success: false, error: LINKS_OFF };
+
+  const source = sourceUuid.toLowerCase();
+  const visible = await visibleItems(actor.username);
+  const target = visible.get(targetUuid.toLowerCase());
+  const from = visible.get(source);
+  if (!target || !from || from.type !== ItemTypes.NOTE) return { success: false, error: NOT_VISIBLE };
+  if (source === target.uuid) return { success: false, error: "An item can't link to itself" };
+
+  const allowed = await canReach(source, ItemTypes.NOTE, actor.username, PermissionTypes.EDIT);
+  if (!allowed) return { success: false, error: DENIED };
+
+  const href = itemHref(target.type, target.uuid);
+  const rewrite =
+    style === LinkStyles.MENTION ? _wrapFirst(target.title, href) : _appendLink(target.title, href);
+
+  try {
+    const result = await rewriteNote(actor, source, rewrite);
+    if (result.error === NOTE_UNCHANGED) return { success: false, error: MENTION_MISSING };
+    if (result.error) return { success: false, error: result.error };
+    return { success: true, data: null };
+  } catch (error) {
+    console.error("linkItems failed:", error);
+    return { success: false, error: "Failed to connect items" };
+  }
+};
diff --git a/app/_server/actions/relations/index.ts b/app/_server/actions/relations/index.ts
index c17de8745..15281e0c6 100644
--- a/app/_server/actions/relations/index.ts
+++ b/app/_server/actions/relations/index.ts
@@ -1,29 +1,17 @@
 "use server";
 
 import { getCurrentUser, canAccessAllContent } from "@/app/_server/actions/users";
-import { getSettings } from "@/app/_server/actions/config";
 import { getUserIndex } from "@/app/_server/actions/users/helpers";
-import { RelationsStatus } from "@/app/_consts/relations";
-import type { Result } from "@/app/_types";
+import { LinkStyles, RelationsStatus } from "@/app/_consts/relations";
+import type { Result, SanitisedUser } from "@/app/_types";
 import type { BrainGraph, ItemRelations } from "@/app/_types/relations";
 import { backlinksFor, graphFor, visibleItems } from "./queries";
 import { rebuildOwnerRelations, rebuildRelations } from "./indexer";
 import { relationsDb } from "./store";
-import { updateNote } from "@/app/_server/actions/note";
-import { getNoteById } from "@/app/_server/actions/note/queries";
-import { canReach } from "@/app/_server/actions/share/queries";
-import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
-import { itemHref } from "@/app/_utils/global-utils";
-import { escapeLinkText } from "@/app/_utils/item-href-utils";
-import { wrapMention } from "./tidy";
+import { linkItems, linksEnabled } from "./explore";
 
 const EMPTY_RELATIONS: ItemRelations = { uuid: "", status: RelationsStatus.READY, backlinks: [], mentions: [], wikis: {} };
 
-const _linksEnabled = async (): Promise<boolean> => {
-  const settings = await getSettings();
-  return settings?.editor?.enableBilateralLinks !== false;
-};
-
 const _ownerOf = (uuid: string): string | null => {
   const row = relationsDb()
     .prepare("SELECT owner FROM items WHERE uuid = ?")
@@ -34,7 +22,7 @@ const _ownerOf = (uuid: string): string | null => {
 export const getItemRelations = async (uuid: string): Promise<ItemRelations> => {
   try {
     const user = await getCurrentUser();
-    if (!user?.username || !(await _linksEnabled())) return EMPTY_RELATIONS;
+    if (!user?.username || !(await linksEnabled())) return EMPTY_RELATIONS;
 
     const visible = await visibleItems(user.username);
     if (visible.has(uuid.toLowerCase())) return backlinksFor(uuid, visible);
@@ -53,7 +41,7 @@ export const getBrain = async (username?: string): Promise<Result<BrainGraph>> =
   try {
     const user = await getCurrentUser();
     if (!user?.username) return { success: false, error: "Not authenticated" };
-    if (!(await _linksEnabled())) return { success: false, error: "Not found" };
+    if (!(await linksEnabled())) return { success: false, error: "Not found" };
 
     const owner = username || user.username;
     if (owner !== user.username) {
@@ -83,61 +71,16 @@ export const reindexRelations = async (username?: string): Promise<Result<number
   }
 };
 
-const _itemRow = (uuid: string) =>
-  relationsDb()
-    .prepare("SELECT uuid, type, title FROM items WHERE uuid = ?")
-    .get(uuid.toLowerCase()) as { uuid: string; type: ItemTypes; title: string } | undefined;
-
-type Rewriter = (content: string, target: { title: string; href: string }) => string | null;
-
-const _editLinking = async (
-  sourceUuid: string,
-  targetUuid: string,
-  rewrite: Rewriter,
-  label: string,
+const _asActor = async (
+  work: (actor: SanitisedUser) => Promise<Result<null>>,
 ): Promise<Result<null>> => {
   const user = await getCurrentUser();
   if (!user?.username) return { success: false, error: "Not authenticated" };
-
-  try {
-    const allowed = await canReach(sourceUuid, ItemTypes.NOTE, user.username, PermissionTypes.EDIT);
-    if (!allowed) return { success: false, error: "Permission denied" };
-
-    const [note, target] = [await getNoteById(sourceUuid), _itemRow(targetUuid)];
-    if (!note || !target) return { success: false, error: "Not found" };
-    if (note.encrypted) return { success: false, error: "Encrypted notes stay closed" };
-
-    const visible = await visibleItems(user.username);
-    if (!visible.has(target.uuid)) return { success: false, error: "Not found" };
-
-    const content = rewrite(note.content || "", {
-      title: target.title,
-      href: itemHref(target.type, target.uuid),
-    });
-    if (content === null) return { success: false, error: "Mention not found" };
-
-    const formData = new FormData();
-    formData.append("uuid", note.uuid || sourceUuid);
-    formData.append("title", note.title);
-    formData.append("category", "");
-    formData.append("content", content);
-
-    const result = await updateNote(formData);
-    if (result && "error" in result && result.error) return { success: false, error: result.error };
-    return { success: true, data: null };
-  } catch (error) {
-    console.error(`${label} failed:`, error);
-    return { success: false, error: "Failed to connect items" };
-  }
+  return work(user);
 };
 
-const _appendLink: Rewriter = (content, { title, href }) =>
-  `${content.trimEnd()}\n\n[${escapeLinkText(title)}](${href})\n`;
-
-const _wrapFirst: Rewriter = (content, { title, href }) => wrapMention(content, title, href);
-
 export const connectItems = async (sourceUuid: string, targetUuid: string): Promise<Result<null>> =>
-  _editLinking(sourceUuid, targetUuid, _appendLink, "connectItems");
+  _asActor((actor) => linkItems(actor, sourceUuid, targetUuid, LinkStyles.APPEND));
 
 export const linkMention = async (sourceUuid: string, targetUuid: string): Promise<Result<null>> =>
-  _editLinking(sourceUuid, targetUuid, _wrapFirst, "linkMention");
+  _asActor((actor) => linkItems(actor, sourceUuid, targetUuid, LinkStyles.MENTION));
diff --git a/app/_server/actions/relations/indexer.ts b/app/_server/actions/relations/indexer.ts
index c6c788ee7..61b1b50f5 100644
--- a/app/_server/actions/relations/indexer.ts
+++ b/app/_server/actions/relations/indexer.ts
@@ -2,7 +2,6 @@ import fs from "fs/promises";
 import path from "path";
 import type { DatabaseSync } from "node:sqlite";
 import { LinkKinds, RelationsStatus } from "@/app/_consts/relations";
-import { ItemTypes } from "@/app/_types/enums";
 import { isUuid } from "@/app/_consts/identity";
 import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
 import { isEncrypted } from "@/app/_utils/encryption-utils";
@@ -12,6 +11,7 @@ import { getAllFileStats } from "@/app/_server/actions/file";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { readLinks, titleKey } from "./parser";
 import { itemFileInfo, itemTreeRoots } from "./paths";
+import { searchableOf } from "./searchable";
 import {
   inTransaction,
   relationsDb,
@@ -142,9 +142,13 @@ export const indexItemFile = (
       : path.basename(absPath, ".md");
   const key = titleKey(title);
   const encrypted = metadata.encrypted === true || isEncrypted(contentWithoutMetadata);
+  const origins = _origins();
   const parsed = encrypted
-    ? { targets: [], wikis: [], text: "" }
-    : readLinks(contentWithoutMetadata, _origins());
+    ? { targets: [], wikis: [], text: "", readable: "" }
+    : readLinks(contentWithoutMetadata, origins);
+  const searchable = encrypted
+    ? null
+    : searchableOf(info.type, parsed, content, absPath, metadata, origins);
 
   const mentions = _tally(
     parsed.targets
@@ -193,8 +197,14 @@ export const indexItemFile = (
     _adoptOrphans(db, info.owner, uuid, key);
 
     db.prepare("DELETE FROM texts WHERE uuid = ?").run(uuid);
-    if (parsed.text && info.type === ItemTypes.NOTE) {
-      db.prepare("INSERT INTO texts (uuid, body) VALUES (?, ?)").run(uuid, parsed.text);
+    if (searchable) {
+      db.prepare("INSERT INTO texts (uuid, title, body, prose, extra) VALUES (?, ?, ?, ?, ?)").run(
+        uuid,
+        title,
+        searchable.body,
+        searchable.prose,
+        searchable.extra,
+      );
     }
   });
 
@@ -226,13 +236,20 @@ export const forgetItemTree = (dir: string) => {
   _forgetWhere("instr(path, ?) = 1", prefix);
 };
 
-const _indexFromDisk = async (filePath: string, mtime?: number) => {
+const _changedSince = async (filePath: string, mtime: number): Promise<boolean> => {
+  const now = await fs.stat(filePath).catch(() => null);
+  return !now || Math.floor(now.mtimeMs) !== mtime;
+};
+
+const _indexFromDisk = async (filePath: string, mtime?: number, recheck = false) => {
   try {
     const [content, stats] = await Promise.all([
       fs.readFile(filePath, "utf-8"),
       mtime === undefined ? fs.stat(filePath) : Promise.resolve(null),
     ]);
-    indexItemFile(filePath, content, mtime ?? Math.floor(stats!.mtimeMs));
+    const stamp = mtime ?? Math.floor(stats!.mtimeMs);
+    if (recheck && (await _changedSince(filePath, stamp))) return;
+    indexItemFile(filePath, content, stamp);
   } catch (error) {
     console.error(`Relations could not index ${filePath}:`, error);
   }
@@ -312,7 +329,7 @@ const _refreshPath = async (target: string, indexed: Map<string, number>): Promi
   if (!itemFileInfo(absPath)) return false;
   const mtime = Math.floor(stats.mtimeMs);
   if (indexed.get(absPath) === mtime) return false;
-  await _indexFromDisk(absPath, mtime);
+  await _indexFromDisk(absPath, mtime, true);
   return true;
 };
 
diff --git a/app/_server/actions/relations/parser.ts b/app/_server/actions/relations/parser.ts
index c947a0cc3..02f7a6bfa 100644
--- a/app/_server/actions/relations/parser.ts
+++ b/app/_server/actions/relations/parser.ts
@@ -2,7 +2,7 @@ import { unified } from "unified";
 import remarkParse from "remark-parse";
 import remarkGfm from "remark-gfm";
 import { SKIP, visit } from "unist-util-visit";
-import type { Root } from "mdast";
+import type { Nodes, Root } from "mdast";
 import { WIKILINK_REGEX } from "@/app/_consts/relations";
 import { ItemHrefTarget, parseItemHref } from "@/app/_utils/item-href-utils";
 
@@ -10,6 +10,7 @@ export interface ParsedLinks {
   targets: ItemHrefTarget[];
   wikis: string[];
   text: string;
+  readable: string;
 }
 
 const HTML_HREF_REGEX = /data-href="([^"]+)"/g;
@@ -19,6 +20,14 @@ const processor = unified().use(remarkParse).use(remarkGfm);
 export const titleKey = (title: string): string =>
   title.trim().replace(/\s+/g, " ").toLowerCase();
 
+const _plain = (node: Nodes): string => {
+  if ("value" in node && node.type !== "html") return node.value;
+  if ("children" in node) return node.children.map(_plain).join(" ");
+  return "";
+};
+
+const _squash = (parts: string[]) => parts.join(" ").replace(/\s+/g, " ").trim();
+
 const _wikis = (text: string): string[] =>
   Array.from(text.matchAll(WIKILINK_REGEX), (m) => m[1].trim()).filter(
     Boolean,
@@ -28,14 +37,16 @@ export const readLinks = (markdown: string, origins: string[] = []): ParsedLinks
   const targets: ItemHrefTarget[] = [];
   const wikis: string[] = [];
   const prose: string[] = [];
-  if (!markdown.trim()) return { targets, wikis, text: "" };
+  const readable: string[] = [];
+  const empty = { targets, wikis, text: "", readable: "" };
+  if (!markdown.trim()) return empty;
 
   let tree: Root;
   try {
     tree = processor.parse(markdown) as Root;
   } catch (error) {
     console.error("Relations parser could not read markdown:", error);
-    return { targets, wikis, text: "" };
+    return empty;
   }
 
   const addHref = (href: string) => {
@@ -46,6 +57,7 @@ export const readLinks = (markdown: string, origins: string[] = []): ParsedLinks
   visit(tree, (node) => {
     if (node.type === "link") {
       addHref(node.url);
+      readable.push(_plain(node));
       return SKIP;
     }
     if (node.type === "linkReference") return SKIP;
@@ -54,10 +66,11 @@ export const readLinks = (markdown: string, origins: string[] = []): ParsedLinks
     } else if (node.type === "text") {
       wikis.push(..._wikis(node.value));
       prose.push(node.value.replace(WIKILINK_REGEX, " "));
+      readable.push(node.value.replace(WIKILINK_REGEX, (_, target, shown) => shown || target));
     } else if (node.type === "html") {
       Array.from(node.value.matchAll(HTML_HREF_REGEX), (match) => addHref(match[1]));
     }
   });
 
-  return { targets, wikis, text: prose.join(" ").replace(/\s+/g, " ").trim() };
+  return { targets, wikis, text: _squash(prose), readable: _squash(readable) };
 };
diff --git a/app/_server/actions/relations/queries.ts b/app/_server/actions/relations/queries.ts
index 3b849bfe0..9238c96b7 100644
--- a/app/_server/actions/relations/queries.ts
+++ b/app/_server/actions/relations/queries.ts
@@ -120,13 +120,17 @@ const _mentionsOf = (
   const words = item.title.match(WORDS);
   if (!words) return [];
 
-  const query = `"${words.join(" ").replace(/"/g, '""')}"`;
+  const query = `prose : "${words.join(" ").replace(/"/g, '""')}"`;
   const rows = relationsDb()
     .prepare(
-      `SELECT uuid, body FROM texts WHERE texts MATCH ?
-       AND uuid IN (SELECT value FROM json_each(?)) LIMIT 400`,
+      `SELECT texts.uuid, texts.prose AS body FROM texts JOIN items i ON i.uuid = texts.uuid
+       WHERE texts MATCH ? AND i.type = ?
+       AND texts.uuid IN (SELECT value FROM json_each(?)) LIMIT 400`,
     )
-    .all(query, JSON.stringify(Array.from(visible.keys()))) as { uuid: string; body: string }[];
+    .all(query, ItemTypes.NOTE, JSON.stringify(Array.from(visible.keys()))) as {
+    uuid: string;
+    body: string;
+  }[];
 
   const phrase = _phrase(item.title);
   const found: MentionedIn[] = [];
diff --git a/app/_server/actions/relations/search.ts b/app/_server/actions/relations/search.ts
new file mode 100644
index 000000000..b10c5000b
--- /dev/null
+++ b/app/_server/actions/relations/search.ts
@@ -0,0 +1,75 @@
+import path from "path";
+import { SEARCH_SNIPPET_TOKENS } from "@/app/_consts/search";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { ItemTypes } from "@/app/_types/enums";
+import { dataRoot } from "./paths";
+import { relationsDb } from "./store";
+
+export interface RankedHit {
+  uuid: string;
+  path: string;
+  slug: string;
+  type: ItemTypes;
+  title: string;
+  category: string;
+  excerpt?: string;
+  rank: number;
+}
+
+interface RankedRow {
+  uuid: string;
+  path: string;
+  title: string;
+  type: ItemTypes;
+  excerpt: string;
+  rank: number;
+}
+
+const WORDS = new RegExp("[\\p{L}\\p{N}]+", "gu");
+
+export const ftsQuery = (text: string): string | null => {
+  const words = text.match(WORDS);
+  return words ? words.map((word) => `"${word}"*`).join(" ") : null;
+};
+
+const _category = (filePath: string): string => {
+  const folders = path.relative(dataRoot(), filePath).split(path.sep).slice(2, -1);
+  return folders.join("/") || UNCATEGORIZED;
+};
+
+const _excerpt = (excerpt: string, title: string): string | undefined => {
+  const trimmed = excerpt.trim();
+  return trimmed && trimmed.toLowerCase() !== title.toLowerCase() ? trimmed : undefined;
+};
+
+export const rankedSearch = (
+  owner: string,
+  text: string,
+  type: ItemTypes,
+  limit: number,
+): RankedHit[] => {
+  const query = ftsQuery(text);
+  if (!query) return [];
+
+  const rows = relationsDb()
+    .prepare(
+      `SELECT i.uuid, i.path, i.title, i.type,
+         snippet(texts, 2, '', '', '…', ${SEARCH_SNIPPET_TOKENS}) AS excerpt,
+         bm25(texts, 0.0, 8.0, 1.0, 0.0, 2.0) AS rank
+       FROM texts JOIN items i ON i.uuid = texts.uuid
+       WHERE texts MATCH ? AND i.owner = ? AND i.type = ? AND i.encrypted = 0
+       ORDER BY rank LIMIT ?`,
+    )
+    .all(query, owner, type, limit) as unknown as RankedRow[];
+
+  return rows.map((row) => ({
+    uuid: row.uuid,
+    path: row.path,
+    slug: path.basename(row.path, ".md"),
+    type: row.type,
+    title: row.title,
+    category: _category(row.path),
+    excerpt: _excerpt(row.excerpt, row.title),
+    rank: row.rank,
+  }));
+};
diff --git a/app/_server/actions/relations/searchable.ts b/app/_server/actions/relations/searchable.ts
new file mode 100644
index 000000000..e50ba3e16
--- /dev/null
+++ b/app/_server/actions/relations/searchable.ts
@@ -0,0 +1,43 @@
+import path from "path";
+import type { Item } from "@/app/_types";
+import { ItemTypes } from "@/app/_types/enums";
+import { parseMarkdown } from "@/app/_utils/checklist-utils";
+import { readLinks, type ParsedLinks } from "./parser";
+
+export interface Searchable {
+  body: string;
+  prose: string;
+  extra: string;
+}
+
+const _itemLines = (items: Item[]): string[] =>
+  items.flatMap((item) => [
+    item.text,
+    item.description || "",
+    ..._itemLines(item.children || []),
+  ]);
+
+const _tags = (metadata: Record<string, unknown>): string[] =>
+  Array.isArray(metadata.tags) ? metadata.tags.filter((tag) => typeof tag === "string") : [];
+
+const _checklistText = (content: string, filePath: string, origins: string[]): ParsedLinks => {
+  const id = path.basename(filePath, ".md");
+  const { items } = parseMarkdown(content, id, "", undefined, false, undefined, filePath);
+  return readLinks(_itemLines(items).filter(Boolean).join("\n\n"), origins);
+};
+
+export const searchableOf = (
+  type: ItemTypes,
+  parsed: ParsedLinks,
+  content: string,
+  filePath: string,
+  metadata: Record<string, unknown>,
+  origins: string[],
+): Searchable => {
+  const source = type === ItemTypes.CHECKLIST ? _checklistText(content, filePath, origins) : parsed;
+  return {
+    body: source.readable,
+    prose: source.text,
+    extra: _tags(metadata).join(" "),
+  };
+};
diff --git a/app/_server/actions/relations/store.ts b/app/_server/actions/relations/store.ts
index 037309482..222a93959 100644
--- a/app/_server/actions/relations/store.ts
+++ b/app/_server/actions/relations/store.ts
@@ -46,7 +46,10 @@ const SCHEMA = `
   CREATE INDEX IF NOT EXISTS bindings_dst ON bindings(dst);
   CREATE VIRTUAL TABLE IF NOT EXISTS texts USING fts5(
     uuid UNINDEXED,
+    title,
     body,
+    prose,
+    extra,
     tokenize = 'unicode61 remove_diacritics 2'
   );
 `;
diff --git a/app/_server/actions/search/engine.ts b/app/_server/actions/search/engine.ts
new file mode 100644
index 000000000..d9612e6d0
--- /dev/null
+++ b/app/_server/actions/search/engine.ts
@@ -0,0 +1,120 @@
+import path from "path";
+import { grepExtractFrontmatter, grepSearchContent } from "@/app/_utils/grep-utils";
+import { CHECKLISTS_DIR, NOTES_DIR } from "@/app/_consts/files";
+import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { RelationsStatus } from "@/app/_consts/relations";
+import { SEARCH_HITS_PER_TYPE, SearchModes } from "@/app/_consts/search";
+import { ItemTypes } from "@/app/_types/enums";
+import { ensureRelations } from "@/app/_server/actions/relations/indexer";
+import { rankedSearch } from "@/app/_server/actions/relations/search";
+
+export interface SearchHit {
+  uuid?: string;
+  slug: string;
+  type: ItemTypes;
+  title: string;
+  category: string;
+  excerpt?: string;
+}
+
+export interface SearchOutcome {
+  hits: SearchHit[];
+  indexing: boolean;
+}
+
+interface SearchOptions {
+  type?: ItemTypes;
+  mode: SearchModes;
+}
+
+const DIRS: Record<ItemTypes, (username: string) => string> = {
+  [ItemTypes.NOTE]: NOTES_DIR,
+  [ItemTypes.CHECKLIST]: CHECKLISTS_DIR,
+};
+
+const _cleanMatch = (line: string) =>
+  line
+    .replace(/^---$/, "")
+    .replace(/^- \[[x ]\]\s*/i, "")
+    .replace(/\s*\|.*$/, "")
+    .replace(/^#+\s*/, "")
+    .trim();
+
+const _escape = (query: string) => query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+const _grepHits = async (
+  username: string,
+  query: string,
+  type: ItemTypes,
+  skip: Set<string>,
+  limit: number,
+): Promise<SearchHit[]> => {
+  let found: Awaited<ReturnType<typeof grepSearchContent>> = [];
+  try {
+    found = await grepSearchContent(DIRS[type](username), _escape(query));
+  } catch (error) {
+    console.error(`Search grep failed for ${type}:`, error);
+  }
+
+  const fresh = found.filter((hit) => !skip.has(path.resolve(hit.filePath))).slice(0, limit);
+  return Promise.all(
+    fresh.map(async (hit) => {
+      const meta = await grepExtractFrontmatter(hit.filePath);
+      const title = (meta?.title as string) || hit.id;
+      const cleaned = _cleanMatch(hit.matchLine);
+      return {
+        uuid: meta?.uuid as string | undefined,
+        slug: hit.id,
+        type,
+        title,
+        category: hit.category || UNCATEGORIZED,
+        excerpt: cleaned && cleaned.toLowerCase() !== title.toLowerCase() ? cleaned : undefined,
+      };
+    }),
+  );
+};
+
+interface TypeHits {
+  ranked: { hit: SearchHit; rank: number }[];
+  fill: SearchHit[];
+}
+
+const _searchType = async (
+  username: string,
+  query: string,
+  type: ItemTypes,
+  mode: SearchModes,
+  ready: boolean,
+): Promise<TypeHits> => {
+  if (mode === SearchModes.SUBSTRING || (mode === SearchModes.SMART && !ready)) {
+    return { ranked: [], fill: await _grepHits(username, query, type, new Set(), SEARCH_HITS_PER_TYPE) };
+  }
+  if (!ready) return { ranked: [], fill: [] };
+
+  const found = rankedSearch(username, query, type, SEARCH_HITS_PER_TYPE);
+  const ranked = found.map(({ path: _path, rank, ...hit }) => ({ hit, rank }));
+  if (mode === SearchModes.RANKED || found.length >= SEARCH_HITS_PER_TYPE) return { ranked, fill: [] };
+
+  const seen = new Set(found.map((hit) => hit.path));
+  const room = SEARCH_HITS_PER_TYPE - found.length;
+  return { ranked, fill: await _grepHits(username, query, type, seen, room) };
+};
+
+export const searchItems = async (
+  username: string,
+  query: string,
+  { type, mode }: SearchOptions,
+): Promise<SearchOutcome> => {
+  const ready = mode === SearchModes.SUBSTRING || ensureRelations() === RelationsStatus.READY;
+  const types = type ? [type] : [ItemTypes.NOTE, ItemTypes.CHECKLIST];
+  const perType = await Promise.all(
+    types.map((each) => _searchType(username, query, each, mode, ready)),
+  );
+
+  const ranked = perType
+    .flatMap((hits) => hits.ranked)
+    .sort((a, b) => a.rank - b.rank)
+    .map((entry) => entry.hit);
+  const fill = perType.flatMap((hits) => hits.fill);
+  return { hits: [...ranked, ...fill], indexing: !ready && mode === SearchModes.RANKED };
+};
diff --git a/app/_server/actions/search/index.ts b/app/_server/actions/search/index.ts
index 944c8de76..73447cbdf 100644
--- a/app/_server/actions/search/index.ts
+++ b/app/_server/actions/search/index.ts
@@ -1,11 +1,9 @@
 "use server";
 
 import { getCurrentUser } from "@/app/_server/actions/users";
-import { NOTES_DIR } from "@/app/_consts/files";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
-import { grepSearchContent, grepExtractFrontmatter } from "@/app/_utils/grep-utils";
-import { ItemTypes } from "@/app/_types/enums";
-import path from "path";
+import { DEFAULT_SEARCH_MODE } from "@/app/_consts/search";
+import { SEARCH_MIN_LEN } from "@/app/_schemas/api/discovery";
+import { searchItems } from "./engine";
 
 export interface SearchResult {
   id: string;
@@ -16,8 +14,14 @@ export interface SearchResult {
   content?: string;
 }
 
-export const search = async (query: string): Promise<{ success: boolean; data: SearchResult[] }> => {
-  if (!query || query.trim().length < 2) {
+interface SearchResponse {
+  success: boolean;
+  data: SearchResult[];
+  indexing?: boolean;
+}
+
+export const search = async (query: string): Promise<SearchResponse> => {
+  if (!query || query.trim().length < SEARCH_MIN_LEN) {
     return { success: true, data: [] };
   }
 
@@ -26,54 +30,20 @@ export const search = async (query: string): Promise<{ success: boolean; data: S
     return { success: false, data: [] };
   }
 
-  const escapedQuery = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-
-  const notesDir = NOTES_DIR(user.username);
-  const checklistsDir = path.join(process.cwd(), "data", CHECKLISTS_FOLDER, user.username);
-
-  const [noteResults, checklistResults] = await Promise.all([
-    grepSearchContent(notesDir, escapedQuery).catch(() => []),
-    grepSearchContent(checklistsDir, escapedQuery).catch(() => []),
-  ]);
-
-  const cleanMatchLine = (line: string): string => {
-    let cleaned = line
-      .replace(/^---$/, "")
-      .replace(/^- \[[x ]\]\s*/i, "")
-      .replace(/\s*\|.*$/, "")
-      .replace(/^#+\s*/, "")
-      .trim();
-    return cleaned;
+  const { hits, indexing } = await searchItems(user.username, query, {
+    mode: user.searchMode || DEFAULT_SEARCH_MODE,
+  });
+
+  return {
+    success: true,
+    indexing,
+    data: hits.map((hit) => ({
+      id: hit.slug,
+      uuid: hit.uuid,
+      title: hit.title,
+      type: hit.type,
+      category: hit.category,
+      content: hit.excerpt,
+    })),
   };
-
-  const processResults = async (
-    results: { filePath: string; id: string; category: string; matchLine: string }[],
-    type: "note" | "checklist"
-  ): Promise<SearchResult[]> => {
-    return Promise.all(
-      results.slice(0, 20).map(async (result) => {
-        const metadata = await grepExtractFrontmatter(result.filePath);
-        const title = (metadata?.title as string) || result.id;
-        const cleaned = cleanMatchLine(result.matchLine);
-        const content = cleaned && cleaned.toLowerCase() !== title.toLowerCase()
-          ? cleaned
-          : undefined;
-        return {
-          id: result.id,
-          uuid: metadata?.uuid as string | undefined,
-          title,
-          type,
-          category: result.category || "Uncategorized",
-          content,
-        };
-      })
-    );
-  };
-
-  const [notes, checklists] = await Promise.all([
-    processResults(noteResults, "note"),
-    processResults(checklistResults, "checklist"),
-  ]);
-
-  return { success: true, data: [...notes, ...checklists] };
 };
diff --git a/app/_server/actions/share/listing.ts b/app/_server/actions/share/listing.ts
new file mode 100644
index 000000000..51269a636
--- /dev/null
+++ b/app/_server/actions/share/listing.ts
@@ -0,0 +1,41 @@
+import { PUBLIC_USER, ShareDirections } from "@/app/_consts/sharing";
+import { ItemTypes } from "@/app/_types/enums";
+import type { SanitisedUser } from "@/app/_types";
+import type { ShareListing } from "@/app/_types/sharing";
+import { visibleItems } from "@/app/_server/actions/relations/queries";
+import { sharesInvolving } from "./queries";
+
+interface ShareFilters {
+  direction?: ShareDirections;
+  type?: ItemTypes;
+}
+
+const _named = (listing: ShareListing, title: string, category: string) => ({
+  uuid: listing.uuid,
+  type: listing.type,
+  title,
+  category,
+  owner: listing.owner,
+  direction: listing.direction,
+  viaCategory: listing.viaCategory,
+  permissions: listing.permissions,
+  isPublic: listing.isPublic,
+  sharedWith: listing.people
+    ?.filter(([username]) => username !== PUBLIC_USER)
+    .map(([username, permissions]) => ({ username, permissions })),
+});
+
+export const sharesFor = async (actor: SanitisedUser, { direction, type }: ShareFilters) => {
+  const [listings, visible] = await Promise.all([
+    sharesInvolving(actor.username),
+    visibleItems(actor.username),
+  ]);
+
+  return listings
+    .filter((listing) => (!direction || listing.direction === direction) && (!type || listing.type === type))
+    .flatMap((listing) => {
+      const item = visible.get(listing.uuid.toLowerCase());
+      return item ? [_named(listing, item.title, item.category)] : [];
+    })
+    .sort((a, b) => a.direction.localeCompare(b.direction) || a.title.localeCompare(b.title));
+};
diff --git a/app/_server/actions/share/queries.ts b/app/_server/actions/share/queries.ts
index 25b652aa1..e6b07104a 100644
--- a/app/_server/actions/share/queries.ts
+++ b/app/_server/actions/share/queries.ts
@@ -10,6 +10,7 @@ import {
   FolderShares,
   GlobalShares,
   ItemShares,
+  ShareListing,
   SharedItemSummary,
   SharingData,
   UserSharedItem,
@@ -20,6 +21,7 @@ import {
   CATEGORY_INFO_FILE,
   PUBLIC_USER,
   SHARED_WITH_KEY,
+  ShareDirections,
 } from "@/app/_consts/sharing";
 import { getUsername, canAccessAllContent } from "@/app/_server/actions/users";
 import {
@@ -252,6 +254,7 @@ interface SharedFact {
   owner: string;
   users: Record<string, SharingPermissions>;
   isPublic: boolean;
+  viaCategory?: string;
 }
 
 const _factsFor = cache(async (mode: Modes): Promise<SharedFact[]> => {
@@ -270,6 +273,7 @@ const _factsFor = cache(async (mode: Modes): Promise<SharedFact[]> => {
       owner: access.owner,
       users: access.users,
       isPublic: access.isPublic,
+      viaCategory: access.inherited ? access.viaCategory : undefined,
     });
   }
 
@@ -334,6 +338,33 @@ export const sharedForUser = async (
   }
 };
 
+const _grantsOf = (fact: SharedFact, mode: Modes, username: string): ShareListing[] => {
+  const type = mode === Modes.NOTES ? ItemTypes.NOTE : ItemTypes.CHECKLIST;
+  const base = { uuid: fact.uuid, type, owner: fact.owner, viaCategory: fact.viaCategory };
+
+  if (fact.owner === username) {
+    const people = Object.entries(fact.users).filter(([name]) => name !== PUBLIC_USER);
+    return [{ ...base, direction: ShareDirections.BY_ME, isPublic: fact.isPublic, people }];
+  }
+
+  const mine = fact.users[username];
+  return mine ? [{ ...base, direction: ShareDirections.WITH_ME, permissions: mine }] : [];
+};
+
+export const sharesInvolving = async (username: string): Promise<ShareListing[]> => {
+  try {
+    const perMode = await Promise.all(
+      SHARED_MODES.map(async (mode) =>
+        (await _factsFor(mode)).flatMap((fact) => _grantsOf(fact, mode, username)),
+      ),
+    );
+    return perMode.flat();
+  } catch (error) {
+    console.error("Error in sharesInvolving:", error);
+    return [];
+  }
+};
+
 const _summaries = async (
   mode: Modes,
 ): Promise<{ all: SharedItemSummary[]; open: SharedItemSummary[] }> => {
diff --git a/app/_server/api/contract.ts b/app/_server/api/contract.ts
index db78e79f8..50ca7664d 100644
--- a/app/_server/api/contract.ts
+++ b/app/_server/api/contract.ts
@@ -18,6 +18,8 @@ export enum ApiTag {
   TASKS = "Tasks",
   KANBAN = "Kanban",
   DISCOVERY = "Discovery",
+  RELATIONS = "Relations",
+  SHARING = "Sharing",
   USERS = "Users",
   EXPORTS = "Exports",
   LOGS = "Logs",
diff --git a/app/_server/api/route-index.ts b/app/_server/api/route-index.ts
index e6792d762..6ac0dc80c 100644
--- a/app/_server/api/route-index.ts
+++ b/app/_server/api/route-index.ts
@@ -1,4 +1,5 @@
 import * as adminRebuildIndex from "@/app/api/admin/rebuild-index/route";
+import * as brain from "@/app/api/brain/route";
 import * as categories from "@/app/api/categories/route";
 import * as checklists from "@/app/api/checklists/route";
 import * as checklistsListId from "@/app/api/checklists/[listId]/route";
@@ -27,7 +28,11 @@ import * as logsStats from "@/app/api/logs/stats/route";
 import * as notes from "@/app/api/notes/route";
 import * as notesNoteId from "@/app/api/notes/[noteId]/route";
 import * as openapiJson from "@/app/api/openapi.json/route";
+import * as relationsItemId from "@/app/api/relations/[itemId]/route";
+import * as relationsLinks from "@/app/api/relations/links/route";
+import * as relationsOrphans from "@/app/api/relations/orphans/route";
 import * as search from "@/app/api/search/route";
+import * as shares from "@/app/api/shares/route";
 import * as summary from "@/app/api/summary/route";
 import * as tasks from "@/app/api/tasks/route";
 import * as tasksTaskId from "@/app/api/tasks/[taskId]/route";
@@ -41,6 +46,7 @@ import * as userUsername from "@/app/api/user/[username]/route";
 
 export const ROUTE_MODULES: object[] = [
   adminRebuildIndex,
+  brain,
   categories,
   checklists,
   checklistsListId,
@@ -69,7 +75,11 @@ export const ROUTE_MODULES: object[] = [
   notes,
   notesNoteId,
   openapiJson,
+  relationsItemId,
+  relationsLinks,
+  relationsOrphans,
   search,
+  shares,
   summary,
   tasks,
   tasksTaskId,
diff --git a/app/_translations/de.json b/app/_translations/de.json
index 736692d1c..a8efe5cdb 100644
--- a/app/_translations/de.json
+++ b/app/_translations/de.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Einstellungen",
     "general": "Allgemein",
-    "saveGeneral": "Allgemein speichern",
     "appearance": "Erscheinungsbild",
     "account": "Konto",
     "security": "Sicherheit",
@@ -813,7 +812,6 @@
     "rightHanded": "Rechtshänder",
     "leftHanded": "Linkshänder",
     "notesPreferences": "Notizen-Voreinstellungen",
-    "saveEditor": "Editoreinstellungen speichern",
     "autoSaveInterval": "Automatische Speicherung",
     "selectAutoSaveInterval": "Wähle ein Intervall für die automatische Speicherung",
     "chooseAutoSaveInterval": "Wähle ein Intervall, in dem deine Notizen automatisch gespeichert werden sollen.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Wähle einen Standardfilter",
     "chooseDefaultNoteFilter": "Wähle den Standardfilter, der automatisch angewendet wird, wenn du die Notizen-Seite öffnest.",
     "checklistsPreferences": "Voreinstellungen für Aufgabenlisten",
-    "saveChecklists": "Aufgabenlisten speichern",
     "recurringChecklists": "Wiederkehrende Aufgabenlisten",
     "beta": "(Beta)",
     "selectEnableRecurring": "Wähle aus, ob du wiederkehrende Aufgabenliste aktivieren möchtest.",
@@ -927,7 +924,6 @@
     "hideIndicator": "Anzeige ausblenden",
     "hideConnectionIndicator": "Verbindungsanzeige im Logo ausblenden",
     "kanbanSection": "Kanban-Einstellungen",
-    "saveKanban": "Kanban speichern",
     "hideStatusOnCardsLabel": "Status auf Kanban-Karten",
     "showStatusOnCards": "Status anzeigen",
     "hideStatusOnCards": "Status ausblenden",
diff --git a/app/_translations/en.json b/app/_translations/en.json
index f54ea3539..c5e3b8a57 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Settings",
     "general": "General",
-    "saveGeneral": "Save General",
     "appearance": "Appearance",
     "account": "Account",
     "security": "Security",
@@ -810,10 +809,15 @@
     "handedness": "Handedness",
     "selectHandedness": "Select handedness",
     "chooseHandedness": "Choose if you are right-handed or left-handed.",
+    "searchMode": "Search",
+    "selectSearchMode": "Select how search works",
+    "searchModeSmart": "Best matches first, then exact text",
+    "searchModeRanked": "Best matches only",
+    "searchModeSubstring": "Exact text only",
+    "searchModeDescription": "Best matches finds the words in any order and puts the most relevant items first. Exact text looks for the characters exactly as you typed them, anywhere in the file.",
     "rightHanded": "Right-handed",
     "leftHanded": "Left-handed",
     "notesPreferences": "Notes Preferences",
-    "saveEditor": "Save Editor",
     "autoSaveInterval": "Auto Save Interval",
     "selectAutoSaveInterval": "Select auto save interval",
     "chooseAutoSaveInterval": "Choose the interval for automatic saving of your notes.",
@@ -836,7 +840,6 @@
     "selectDefaultNoteFilter": "Select default note filter",
     "chooseDefaultNoteFilter": "Choose the default filter to apply when opening the Notes page.",
     "checklistsPreferences": "Checklists Preferences",
-    "saveChecklists": "Save Checklists",
     "recurringChecklists": "Recurring checklists",
     "beta": "(Beta)",
     "selectEnableRecurring": "Select enable to add recurring checklists",
@@ -860,6 +863,8 @@
     "confirmPassword": "Confirm Password",
     "passwordChanged": "Password changed",
     "settingsSaved": "Settings saved",
+    "settingsSaveFailed": "Failed to save settings",
+    "settingsSaveFailedDescription": "Your change was not saved. Try again.",
     "dashCase": "Dash case (e.g., my-file-name.md)",
     "minimal": "Minimal (remove invalid characters only)",
     "noRename": "No rename (keep original filename)",
@@ -927,7 +932,6 @@
     "hideIndicator": "Hide indicator",
     "hideConnectionIndicator": "Hide connection indicator from logo",
     "kanbanSection": "Kanban Preferences",
-    "saveKanban": "Save Kanban",
     "hideStatusOnCardsLabel": "Status on Kanban Cards",
     "showStatusOnCards": "Show status",
     "hideStatusOnCards": "Hide status",
@@ -1792,6 +1796,7 @@
   },
   "relations": {
     "indexing": "Indexing relationships...",
+    "indexingSearch": "Indexing your notes, search will be ready in a moment...",
     "unreachable": "not reachable",
     "createFromWikilink": "Create a note called \"{title}\"",
     "mentionedIn": "Mentioned in",
diff --git a/app/_translations/es.json b/app/_translations/es.json
index 5a2821cb3..3aba58720 100644
--- a/app/_translations/es.json
+++ b/app/_translations/es.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Configuración",
     "general": "General",
-    "saveGeneral": "Guardar general",
     "appearance": "Apariencia",
     "account": "Cuenta",
     "security": "Seguridad",
@@ -813,7 +812,6 @@
     "rightHanded": "Diestro",
     "leftHanded": "Zurdo",
     "notesPreferences": "Preferencias de notas",
-    "saveEditor": "Guardar editor",
     "autoSaveInterval": "Intervalo de guardado automático",
     "selectAutoSaveInterval": "Seleccionar intervalo de guardado automático",
     "chooseAutoSaveInterval": "Elija el intervalo para el guardado automático de sus notas.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Seleccionar filtro de nota predeterminado",
     "chooseDefaultNoteFilter": "Elija el filtro predeterminado al abrir la página de notas.",
     "checklistsPreferences": "Preferencias de Listas",
-    "saveChecklists": "Guardar Listas",
     "recurringChecklists": "Listas recurrentes",
     "beta": "(Beta)",
     "selectEnableRecurring": "Seleccionar habilitar para agregar Listas recurrentes",
@@ -927,7 +924,6 @@
     "hideIndicator": "Ocultar indicador",
     "hideConnectionIndicator": "Ocultar indicador de conexión del logotipo",
     "kanbanSection": "Preferencias de Kanban",
-    "saveKanban": "Guardar Kanban",
     "hideStatusOnCardsLabel": "Estado en las tarjetas Kanban",
     "showStatusOnCards": "Mostrar estado",
     "hideStatusOnCards": "Ocultar estado",
diff --git a/app/_translations/fr.json b/app/_translations/fr.json
index e3673b29a..7c07c61f3 100644
--- a/app/_translations/fr.json
+++ b/app/_translations/fr.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Paramètres",
     "general": "Général",
-    "saveGeneral": "Enregistrer (général)",
     "appearance": "Apparence",
     "account": "Compte",
     "security": "Sécurité",
@@ -813,7 +812,6 @@
     "rightHanded": "Droitier",
     "leftHanded": "Gaucher",
     "notesPreferences": "Préférences des notes",
-    "saveEditor": "Enregistrer (éditeur)",
     "autoSaveInterval": "Intervalle d’enregistrement automatique",
     "selectAutoSaveInterval": "Sélectionner l’intervalle d’auto‑enregistrement",
     "chooseAutoSaveInterval": "Choisissez l’intervalle d’enregistrement automatique de vos notes.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Sélectionner le filtre de note par défaut",
     "chooseDefaultNoteFilter": "Choisissez le filtre par défaut à appliquer à l’ouverture de la page Notes.",
     "checklistsPreferences": "Préférences des Listes",
-    "saveChecklists": "Enregistrer (listes)",
     "recurringChecklists": "Listes récurrentes",
     "beta": "(Bêta)",
     "selectEnableRecurring": "Sélectionner « activer » pour ajouter des listes récurrentes",
@@ -927,7 +924,6 @@
     "hideIndicator": "Masquer l'indicateur",
     "hideConnectionIndicator": "Masquer l'indicateur de connexion du logo",
     "kanbanSection": "Préférences Kanban",
-    "saveKanban": "Enregistrer Kanban",
     "hideStatusOnCardsLabel": "Statut sur les cartes Kanban",
     "showStatusOnCards": "Afficher le statut",
     "hideStatusOnCards": "Masquer le statut",
diff --git a/app/_translations/it.json b/app/_translations/it.json
index 14f85e464..143eb2345 100644
--- a/app/_translations/it.json
+++ b/app/_translations/it.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Impostazioni",
     "general": "Generale",
-    "saveGeneral": "Salva Generale",
     "appearance": "Aspetto",
     "account": "Account",
     "security": "Sicurezza",
@@ -813,7 +812,6 @@
     "rightHanded": "Destrorso",
     "leftHanded": "Mancino",
     "notesPreferences": "Preferenze Note",
-    "saveEditor": "Salva Editor",
     "autoSaveInterval": "Intervallo Auto-Salvataggio",
     "selectAutoSaveInterval": "Seleziona intervallo",
     "chooseAutoSaveInterval": "Scegli ogni quanto salvare automaticamente le note.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Seleziona filtro",
     "chooseDefaultNoteFilter": "Scegli il filtro predefinito all'apertura della pagina Note.",
     "checklistsPreferences": "Preferenze Checklist",
-    "saveChecklists": "Salva Checklist",
     "recurringChecklists": "Checklist ricorrenti",
     "beta": "(Beta)",
     "selectEnableRecurring": "Abilita per aggiungere checklist ricorrenti",
@@ -927,7 +924,6 @@
     "hideIndicator": "Nascondi indicatore",
     "hideConnectionIndicator": "Nascondi l'indicatore di connessione dal logo",
     "kanbanSection": "Preferenze Kanban",
-    "saveKanban": "Salva Kanban",
     "hideStatusOnCardsLabel": "Stato sulle schede Kanban",
     "showStatusOnCards": "Mostra stato",
     "hideStatusOnCards": "Nascondi stato",
diff --git a/app/_translations/klingon.json b/app/_translations/klingon.json
index 82d43cc10..b8bb561e9 100644
--- a/app/_translations/klingon.json
+++ b/app/_translations/klingon.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "SeH",
     "general": "Hoch",
-    "saveGeneral": "Hoch yIPol",
     "appearance": "De'nI'",
     "account": "QIn",
     "security": "Hung",
@@ -813,7 +812,6 @@
     "rightHanded": "nIH",
     "leftHanded": "poS",
     "notesPreferences": "ghItlh maS",
-    "saveEditor": "choHwI' yIPol",
     "autoSaveInterval": "nIteb Pol",
     "selectAutoSaveInterval": "nIteb Pol poH yIwIv",
     "chooseAutoSaveInterval": "poH yIwIv vaj nIteb Pol.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "maS ghItlh vI' yIwIv",
     "chooseDefaultNoteFilter": "bI'elDI' vI' yIwIv.",
     "checklistsPreferences": "tetlh maS",
-    "saveChecklists": "tetlhmey yIPol",
     "recurringChecklists": "tetlhmey vangqa'",
     "beta": "(Beta)",
     "selectEnableRecurring": "chu' vaj vangqa'",
@@ -927,7 +924,6 @@
     "hideIndicator": "Hide indicator",
     "hideConnectionIndicator": "Hide connection indicator from logo",
     "kanbanSection": "Kanban De'wI' mIwmey",
-    "saveKanban": "Kanban pol",
     "hideStatusOnCardsLabel": "Kanban ghItlhmey ngoq",
     "showStatusOnCards": "ngoq legh",
     "hideStatusOnCards": "ngoq So'",
diff --git a/app/_translations/ko.json b/app/_translations/ko.json
index 9c9213400..4775ba17e 100644
--- a/app/_translations/ko.json
+++ b/app/_translations/ko.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "설정",
     "general": "일반",
-    "saveGeneral": "일반 설정 저장",
     "appearance": "외형",
     "account": "계정",
     "security": "보안",
@@ -813,7 +812,6 @@
     "rightHanded": "오른손잡이",
     "leftHanded": "왼손잡이",
     "notesPreferences": "노트 설정",
-    "saveEditor": "에디터 설정 저장",
     "autoSaveInterval": "자동 저장 간격",
     "selectAutoSaveInterval": "자동 저장 간격 선택",
     "chooseAutoSaveInterval": "노트 자동 저장 간격을 선택하세요.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "기본 노트 필터 선택",
     "chooseDefaultNoteFilter": "노트 페이지를 열 때 적용할 기본 필터를 선택하세요.",
     "checklistsPreferences": "체크리스트 설정",
-    "saveChecklists": "체크리스트 설정 저장",
     "recurringChecklists": "반복 체크리스트",
     "beta": "(베타)",
     "selectEnableRecurring": "반복 체크리스트를 추가하려면 활성화하세요",
@@ -927,7 +924,6 @@
     "hideIndicator": "표시 숨기기",
     "hideConnectionIndicator": "로고에서 연결 표시 숨기기",
     "kanbanSection": "칸반 환경설정",
-    "saveKanban": "칸반 저장",
     "hideStatusOnCardsLabel": "칸반 카드의 상태",
     "showStatusOnCards": "상태 표시",
     "hideStatusOnCards": "상태 숨기기",
diff --git a/app/_translations/nl.json b/app/_translations/nl.json
index 810fedc6f..416b9c41d 100644
--- a/app/_translations/nl.json
+++ b/app/_translations/nl.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Instellingen",
     "general": "Algemeen",
-    "saveGeneral": "Algemeen opslaan",
     "appearance": "Weergave",
     "account": "Account",
     "security": "Beveiliging",
@@ -813,7 +812,6 @@
     "rightHanded": "Rechtshandig",
     "leftHanded": "Linkshandig",
     "notesPreferences": "Notitievoorkeuren",
-    "saveEditor": "Editor opslaan",
     "autoSaveInterval": "Automatisch opslaginterval",
     "selectAutoSaveInterval": "Selecteer automatisch opslaginterval",
     "chooseAutoSaveInterval": "Kies het interval voor automatisch opslaan van uw notities.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Selecteer standaard notitiefilter",
     "chooseDefaultNoteFilter": "Kies het standaardfilter dat wordt toegepast bij het openen van de Notitiespagina.",
     "checklistsPreferences": "Checklistvoorkeuren",
-    "saveChecklists": "Checklists opslaan",
     "recurringChecklists": "Terugkerende checklists",
     "beta": "(Beta)",
     "selectEnableRecurring": "Selecteer inschakelen om terugkerende checklists toe te voegen",
@@ -927,7 +924,6 @@
     "hideIndicator": "Indicator verbergen",
     "hideConnectionIndicator": "Verbindingsindicator verbergen in logo",
     "kanbanSection": "Kanban-voorkeuren",
-    "saveKanban": "Kanban opslaan",
     "hideStatusOnCardsLabel": "Status op Kanban-kaarten",
     "showStatusOnCards": "Status tonen",
     "hideStatusOnCards": "Status verbergen",
diff --git a/app/_translations/pirate.json b/app/_translations/pirate.json
index 6554b13fc..3069ae4cf 100644
--- a/app/_translations/pirate.json
+++ b/app/_translations/pirate.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Rigging",
     "general": "General",
-    "saveGeneral": "Stow General",
     "appearance": "Trim",
     "account": "Articles",
     "security": "Defense",
@@ -813,7 +812,6 @@
     "rightHanded": "Right-hooked",
     "leftHanded": "Left-hooked",
     "notesPreferences": "Log Preferences",
-    "saveEditor": "Stow Quill",
     "autoSaveInterval": "Auto Stow Timer",
     "selectAutoSaveInterval": "Pick timer",
     "chooseAutoSaveInterval": "How often the ship stows itself.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Pick spyglass",
     "chooseDefaultNoteFilter": "What ye see first in the logs.",
     "checklistsPreferences": "Manifest Preferences",
-    "saveChecklists": "Stow Manifests",
     "recurringChecklists": "Ghost Manifests",
     "beta": "(Testing)",
     "selectEnableRecurring": "Allow ghosts",
@@ -927,7 +924,6 @@
     "hideIndicator": "Hide indicator",
     "hideConnectionIndicator": "Hide connection indicator from logo",
     "kanbanSection": "Kanban Parley Terms",
-    "saveKanban": "Stow Kanban",
     "hideStatusOnCardsLabel": "Status on Kanban Scrolls",
     "showStatusOnCards": "Show status",
     "hideStatusOnCards": "Stow status",
diff --git a/app/_translations/pl.json b/app/_translations/pl.json
index 8a655d321..e30a7246e 100644
--- a/app/_translations/pl.json
+++ b/app/_translations/pl.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Ustawienia",
     "general": "Ogólne",
-    "saveGeneral": "Zapisz ogólne ustawienia",
     "appearance": "Wygląd",
     "account": "Konto",
     "security": "Bezpieczeństwo",
@@ -813,7 +812,6 @@
     "rightHanded": "Praworęczny",
     "leftHanded": "Leworęczny",
     "notesPreferences": "Ustawienia notatek",
-    "saveEditor": "Zapisz edytor",
     "autoSaveInterval": "Interwał automatycznego zapisu",
     "selectAutoSaveInterval": "Wybierz interwał automatycznego zapisu",
     "chooseAutoSaveInterval": "Wybierz interwał, w którym będą automatycznie zapisywane notatki.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Wybierz domyślny filtr notatek",
     "chooseDefaultNoteFilter": "Wybierz domyślny filtr, który ma być zastosowany przy otwieraniu strony Notatki.",
     "checklistsPreferences": "Ustawienia list kontrolnych",
-    "saveChecklists": "Zapisz Listy",
     "recurringChecklists": "Powtarzalne Listy",
     "beta": "(Beta)",
     "selectEnableRecurring": "Wybierz, czy dodać powtarzalne Listy",
@@ -927,7 +924,6 @@
     "hideIndicator": "Ukryj wskaźnik",
     "hideConnectionIndicator": "Ukryj wskaźnik połączenia przed logo",
     "kanbanSection": "Preferencje Kanban",
-    "saveKanban": "Zapisz Kanban",
     "hideStatusOnCardsLabel": "Status na kartach Kanban",
     "showStatusOnCards": "Pokaż status",
     "hideStatusOnCards": "Ukryj status",
diff --git a/app/_translations/pt.json b/app/_translations/pt.json
index 7449cc601..df07ae5c2 100644
--- a/app/_translations/pt.json
+++ b/app/_translations/pt.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Definições",
     "general": "Geral",
-    "saveGeneral": "Guardar geral",
     "appearance": "Aparência",
     "account": "Conta",
     "security": "Segurança",
@@ -813,7 +812,6 @@
     "rightHanded": "Destro",
     "leftHanded": "Esquerdino",
     "notesPreferences": "Preferências de notas",
-    "saveEditor": "Guardar editor",
     "autoSaveInterval": "Intervalo de guardação automática",
     "selectAutoSaveInterval": "Selecionar intervalo de guardação automática",
     "chooseAutoSaveInterval": "Escolha o intervalo para a guardação automática das suas notas.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Selecionar filtro de notas predefinido",
     "chooseDefaultNoteFilter": "Escolha o filtro predefinido a aplicar ao abrir a página de Notas.",
     "checklistsPreferences": "Preferências de listas de verificação",
-    "saveChecklists": "Guardar listas de verificação",
     "recurringChecklists": "Listas de verificação recorrentes",
     "beta": "(Beta)",
     "selectEnableRecurring": "Selecionar ativar para adicionar listas de verificação recorrentes",
@@ -927,7 +924,6 @@
     "hideIndicator": "Ocultar indicador",
     "hideConnectionIndicator": "Ocultar indicador de ligação do logótipo",
     "kanbanSection": "Preferências Kanban",
-    "saveKanban": "Guardar Kanban",
     "hideStatusOnCardsLabel": "Estado nos cartões Kanban",
     "showStatusOnCards": "Mostrar estado",
     "hideStatusOnCards": "Ocultar estado",
diff --git a/app/_translations/ru.json b/app/_translations/ru.json
index 67523a5c5..6a234d3c6 100644
--- a/app/_translations/ru.json
+++ b/app/_translations/ru.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Настройки",
     "general": "Общие",
-    "saveGeneral": "Сохранить общие",
     "appearance": "Внешний вид",
     "account": "Аккаунт",
     "security": "Безопасность",
@@ -813,7 +812,6 @@
     "rightHanded": "Правша",
     "leftHanded": "Левша",
     "notesPreferences": "Настройки заметок",
-    "saveEditor": "Сохранить редактор",
     "autoSaveInterval": "Интервал автосохранения",
     "selectAutoSaveInterval": "Выберите интервал автосохранения",
     "chooseAutoSaveInterval": "Выберите интервал для автоматического сохранения заметок.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Выберите фильтр заметок по умолчанию",
     "chooseDefaultNoteFilter": "Выберите фильтр по умолчанию при открытии страницы заметок.",
     "checklistsPreferences": "Настройки чеклистов",
-    "saveChecklists": "Сохранить чеклисты",
     "recurringChecklists": "Повторяющиеся чеклисты",
     "beta": "(Бета)",
     "selectEnableRecurring": "Выберите включение для добавления повторяющихся чеклистов",
@@ -927,7 +924,6 @@
     "hideIndicator": "Скрыть индикатор",
     "hideConnectionIndicator": "Скрыть индикатор подключения из логотипа",
     "kanbanSection": "Настройки Канбан",
-    "saveKanban": "Сохранить Канбан",
     "hideStatusOnCardsLabel": "Статус на карточках Канбан",
     "showStatusOnCards": "Показать статус",
     "hideStatusOnCards": "Скрыть статус",
diff --git a/app/_translations/tr.json b/app/_translations/tr.json
index 4bb265a55..651e06803 100644
--- a/app/_translations/tr.json
+++ b/app/_translations/tr.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Ayarlar",
     "general": "Genel",
-    "saveGeneral": "Genel Ayarları Kaydet",
     "appearance": "Görünüm",
     "account": "Hesap",
     "security": "Güvenlik",
@@ -813,7 +812,6 @@
     "rightHanded": "Sağlak",
     "leftHanded": "Solak",
     "notesPreferences": "Not Tercihleri",
-    "saveEditor": "Düzenleyiciyi Kaydet",
     "autoSaveInterval": "Otomatik Kaydetme Aralığı",
     "selectAutoSaveInterval": "Otomatik kaydetme aralığını seçin",
     "chooseAutoSaveInterval": "Notlarınızın otomatik olarak kaydedilme sıklığını seçin.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Varsayılan not filtresini seçin",
     "chooseDefaultNoteFilter": "Notlar sayfası açıldığında uygulanacak varsayılan filtreyi seçin.",
     "checklistsPreferences": "Kontrol Listesi Tercihleri",
-    "saveChecklists": "Listelerini Kaydet",
     "recurringChecklists": "Yinelenen Listeleri",
     "beta": "(Beta)",
     "selectEnableRecurring": "Yinelenen Listeleri eklemek için etkinleştirin",
@@ -927,7 +924,6 @@
     "hideIndicator": "Göstergeyi gizle",
     "hideConnectionIndicator": "Logodaki bağlantı göstergesini gizle",
     "kanbanSection": "Kanban Tercihleri",
-    "saveKanban": "Kanban'ı Kaydet",
     "hideStatusOnCardsLabel": "Kanban Kartlarında Durum",
     "showStatusOnCards": "Durumu göster",
     "hideStatusOnCards": "Durumu gizle",
diff --git a/app/_translations/vi.json b/app/_translations/vi.json
index bc15cc5e1..e0d5964bd 100644
--- a/app/_translations/vi.json
+++ b/app/_translations/vi.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "Cài đặt",
     "general": "chung",
-    "saveGeneral": "Lưu chung",
     "appearance": "Ngoại hình",
     "account": "Tài khoản",
     "security": "Bảo mật",
@@ -813,7 +812,6 @@
     "rightHanded": "Thuận tay phải",
     "leftHanded": "thuận tay trái",
     "notesPreferences": "Tùy chọn ghi chú",
-    "saveEditor": "Lưu trình chỉnh sửa",
     "autoSaveInterval": "Khoảng thời gian lưu tự động",
     "selectAutoSaveInterval": "Chọn khoảng thời gian lưu tự động",
     "chooseAutoSaveInterval": "Chọn khoảng thời gian để tự động lưu ghi chú của bạn.",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "Chọn bộ lọc ghi chú mặc định",
     "chooseDefaultNoteFilter": "Chọn bộ lọc mặc định để áp dụng khi mở trang Ghi chú.",
     "checklistsPreferences": "Tùy chọn danh sách kiểm tra",
-    "saveChecklists": "Lưu danh sách kiểm tra",
     "recurringChecklists": "Danh sách kiểm tra định kỳ",
     "beta": "(Thử nghiệm)",
     "selectEnableRecurring": "Chọn bật để thêm danh sách kiểm tra định kỳ",
@@ -927,7 +924,6 @@
     "hideIndicator": "Ẩn chỉ báo",
     "hideConnectionIndicator": "Ẩn chỉ báo kết nối khỏi logo",
     "kanbanSection": "Tùy chọn Kanban",
-    "saveKanban": "Lưu Kanban",
     "hideStatusOnCardsLabel": "Trạng thái trên thẻ Kanban",
     "showStatusOnCards": "Hiển thị trạng thái",
     "hideStatusOnCards": "Ẩn trạng thái",
diff --git a/app/_translations/zh.json b/app/_translations/zh.json
index a6843d5e8..157f1dacb 100644
--- a/app/_translations/zh.json
+++ b/app/_translations/zh.json
@@ -774,7 +774,6 @@
   "settings": {
     "title": "设置",
     "general": "常规",
-    "saveGeneral": "保存常规设置",
     "appearance": "外观",
     "account": "账户",
     "security": "安全",
@@ -813,7 +812,6 @@
     "rightHanded": "右撇子",
     "leftHanded": "左撇子",
     "notesPreferences": "笔记偏好",
-    "saveEditor": "保存编辑器设置",
     "autoSaveInterval": "自动保存间隔",
     "selectAutoSaveInterval": "选择自动保存间隔",
     "chooseAutoSaveInterval": "选择笔记自动保存的时间间隔。",
@@ -836,7 +834,6 @@
     "selectDefaultNoteFilter": "选择默认笔记筛选器",
     "chooseDefaultNoteFilter": "选择打开笔记页面时默认应用的筛选器。",
     "checklistsPreferences": "清单偏好",
-    "saveChecklists": "保存清单设置",
     "recurringChecklists": "重复清单",
     "beta": "(Beta)",
     "selectEnableRecurring": "选择启用以添加重复清单",
@@ -927,7 +924,6 @@
     "hideIndicator": "隐藏指示器",
     "hideConnectionIndicator": "隐藏徽标中的连接指示符",
     "kanbanSection": "看板偏好设置",
-    "saveKanban": "保存看板设置",
     "hideStatusOnCardsLabel": "看板卡片上的状态",
     "showStatusOnCards": "显示状态",
     "hideStatusOnCards": "隐藏状态",
diff --git a/app/_types/relations.ts b/app/_types/relations.ts
index ad019ac64..90f7a6155 100644
--- a/app/_types/relations.ts
+++ b/app/_types/relations.ts
@@ -51,3 +51,45 @@ export interface BrainGraph {
   nodes: BrainNode[];
   edges: BrainEdge[];
 }
+
+export interface LinkedItem {
+  uuid: string;
+  type: ItemTypes;
+  title: string;
+  category: string;
+  owner?: string;
+}
+
+export interface SuggestedItem extends LinkedItem {
+  score: number;
+}
+
+export interface RelationsView extends LinkedItem {
+  status: RelationsStatus;
+  tags: string[];
+  backlinks: RelatedItem[];
+  links: RelatedItem[];
+  unwritten: string[];
+  mentions: MentionedIn[];
+  suggestions: SuggestedItem[];
+}
+
+export interface NeighbourNode {
+  id: string;
+  kind: BrainNodeKinds;
+  title: string;
+  category?: string;
+  owner?: string;
+  links: number;
+  distance?: number;
+  tags?: string[];
+}
+
+export interface Neighbourhood {
+  status: RelationsStatus;
+  focus?: string;
+  nodes: NeighbourNode[];
+  edges: BrainEdge[];
+  total: number;
+  truncated: boolean;
+}
diff --git a/app/_types/sharing.ts b/app/_types/sharing.ts
index 07ef45e0f..793f3267c 100644
--- a/app/_types/sharing.ts
+++ b/app/_types/sharing.ts
@@ -1,5 +1,6 @@
 import { SharingPermissions } from "./core";
-import { Modes } from "./enums";
+import { ItemTypes, Modes } from "./enums";
+import type { ShareDirections } from "@/app/_consts/sharing";
 
 export interface CategorySharing {
   users: Record<string, SharingPermissions>;
@@ -135,3 +136,14 @@ export interface UserSharedItems {
   notes: UserSharedItem[];
   checklists: UserSharedItem[];
 }
+
+export interface ShareListing {
+  uuid: string;
+  type: ItemTypes;
+  owner: string;
+  direction: ShareDirections;
+  viaCategory?: string;
+  permissions?: SharingPermissions;
+  isPublic?: boolean;
+  people?: [string, SharingPermissions][];
+}
diff --git a/app/_types/user.ts b/app/_types/user.ts
index dcb29fc8b..6149807e8 100644
--- a/app/_types/user.ts
+++ b/app/_types/user.ts
@@ -1,5 +1,6 @@
 import { Modes } from "./enums";
 import { EncryptionSettings } from "./encryption";
+import type { SearchModes } from "@/app/_consts/search";
 
 export type EnableRecurrence = "enable" | "disable";
 export type ShowCompletedSuggestions = "enable" | "disable";
@@ -86,6 +87,7 @@ export interface User {
   hideTimeTrackingOnCards?: HideTimeTrackingOnCards;
   codeBlockStyle?: CodeBlockStyle;
   newItemInsertion?: NewItemInsertion;
+  searchMode?: SearchModes;
   mfaEnabled?: boolean;
   mfaSecret?: string;
   mfaRecoveryCode?: string;
diff --git a/app/api/brain/route.ts b/app/api/brain/route.ts
new file mode 100644
index 000000000..cc6462e0b
--- /dev/null
+++ b/app/api/brain/route.ts
@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { brainQuery, brainSchema } from "@/app/_schemas/api/relations";
+import { neighbourhoodFor } from "@/app/_server/actions/relations/explore";
+
+export const dynamic = "force-dynamic";
+
+export const GET = defineRoute(
+  {
+    id: "getBrain",
+    method: HttpMethod.GET,
+    path: "/brain",
+    tag: ApiTag.RELATIONS,
+    summary: "A slice of the link map",
+    description:
+      "With focus, the items up to depth links away from it, nearest first. Without it, the most linked items. Tags are listed on each node rather than drawn as nodes.",
+    query: brainQuery,
+    responses: {
+      200: { description: "Nodes and the links between them", schema: brainSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    const result = await neighbourhoodFor(user, query);
+    if (!result.success) return refuse(result.error || "Not found", 404);
+    return NextResponse.json(result.data);
+  },
+);
diff --git a/app/api/relations/[itemId]/route.ts b/app/api/relations/[itemId]/route.ts
new file mode 100644
index 000000000..f6769f656
--- /dev/null
+++ b/app/api/relations/[itemId]/route.ts
@@ -0,0 +1,32 @@
+import { NextResponse } from "next/server";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { relatedParams, relatedSchema } from "@/app/_schemas/api/relations";
+import { relatedFor } from "@/app/_server/actions/relations/explore";
+
+export const dynamic = "force-dynamic";
+
+export const GET = defineRoute(
+  {
+    id: "getRelated",
+    method: HttpMethod.GET,
+    path: "/relations/{itemId}",
+    tag: ApiTag.RELATIONS,
+    summary: "What an item links to and what links to it",
+    description:
+      "Backlinks, outgoing links, wikilinks to notes nobody has written, notes that name the item without linking it, and items that are probably related. Titles only, fetch an item to read it.",
+    params: relatedParams,
+    responses: {
+      200: { description: "The item's links", schema: relatedSchema },
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, params }) => {
+    const result = await relatedFor(user, params.itemId);
+    if (!result.success) return refuse(result.error || "Not found", 404);
+    return NextResponse.json(result.data);
+  },
+);
diff --git a/app/api/relations/links/route.ts b/app/api/relations/links/route.ts
new file mode 100644
index 000000000..ae8e5084f
--- /dev/null
+++ b/app/api/relations/links/route.ts
@@ -0,0 +1,40 @@
+import { NextResponse } from "next/server";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, okSchema } from "@/app/_schemas/api/common";
+import { linkBody } from "@/app/_schemas/api/relations";
+import { DENIED, LINKS_OFF, NOT_VISIBLE, linkItems } from "@/app/_server/actions/relations/explore";
+
+export const dynamic = "force-dynamic";
+
+const _statusOf = (error: string) => {
+  if (error === NOT_VISIBLE || error === LINKS_OFF) return 404;
+  if (error === DENIED) return 403;
+  return 400;
+};
+
+export const POST = defineRoute(
+  {
+    id: "connectItems",
+    method: HttpMethod.POST,
+    path: "/relations/links",
+    tag: ApiTag.RELATIONS,
+    summary: "Link a note to another item",
+    description:
+      "Writes a [Title](/note/uuid) link into the source note, so the link shows up in the note, in Referenced By and in the brain. Needs edit access to the source note. Encrypted notes are refused.",
+    body: linkBody,
+    responses: {
+      200: { description: "Linked", schema: okSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const result = await linkItems(user, body.source, body.target, body.style);
+    if (!result.success) return refuse(result.error || "Failed to connect items", _statusOf(result.error || ""));
+    return NextResponse.json({ success: true });
+  },
+);
diff --git a/app/api/relations/orphans/route.ts b/app/api/relations/orphans/route.ts
new file mode 100644
index 000000000..b96b4dba4
--- /dev/null
+++ b/app/api/relations/orphans/route.ts
@@ -0,0 +1,32 @@
+import { NextResponse } from "next/server";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { orphansQuery, orphansSchema } from "@/app/_schemas/api/relations";
+import { orphansFor } from "@/app/_server/actions/relations/explore";
+
+export const dynamic = "force-dynamic";
+
+export const GET = defineRoute(
+  {
+    id: "listOrphans",
+    method: HttpMethod.GET,
+    path: "/relations/orphans",
+    tag: ApiTag.RELATIONS,
+    summary: "Items with no links",
+    description: "Notes and checklists that link to nothing and that nothing links to. Tags don't count as links.",
+    query: orphansQuery,
+    responses: {
+      200: { description: "Unlinked items, by title", schema: orphansSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    const result = await orphansFor(user, query);
+    if (!result.success) return refuse(result.error || "Not found", 404);
+    return NextResponse.json(result.data);
+  },
+);
diff --git a/app/api/search/route.ts b/app/api/search/route.ts
index c01362c3c..962f65be7 100644
--- a/app/api/search/route.ts
+++ b/app/api/search/route.ts
@@ -1,9 +1,4 @@
 import { NextResponse } from "next/server";
-import {
-  GrepSearchResult,
-  grepExtractFrontmatter,
-  grepSearchContent,
-} from "@/app/_utils/grep-utils";
 import { defineRoute } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
 import { ERRORS } from "@/app/_schemas/api/common";
@@ -12,52 +7,11 @@ import {
   searchParamsSchema,
   searchResultsSchema,
 } from "@/app/_schemas/api/discovery";
-import { ItemTypes } from "@/app/_types/enums";
-import { CHECKLISTS_DIR, NOTES_DIR } from "@/app/_consts/files";
-import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { DEFAULT_SEARCH_MODE, SEARCH_HITS_PER_TYPE } from "@/app/_consts/search";
+import { searchItems } from "@/app/_server/actions/search/engine";
 
 export const dynamic = "force-dynamic";
 
-const RESULT_SLICE = 20;
-
-const _cleanMatch = (line: string) =>
-  line
-    .replace(/^---$/, "")
-    .replace(/^- \[[x ]\]\s*/i, "")
-    .replace(/\s*\|.*$/, "")
-    .replace(/^#+\s*/, "")
-    .trim();
-
-const _escape = (query: string) => query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-
-const _grep = async (dir: string, pattern: string, wanted: boolean) => {
-  if (!wanted) return [];
-  try {
-    return await grepSearchContent(dir, pattern);
-  } catch (error) {
-    console.error(`Search grep failed in ${dir}:`, error);
-    return [];
-  }
-};
-
-const _toHits = (hits: GrepSearchResult[], type: ItemTypes) =>
-  Promise.all(
-    hits.slice(0, RESULT_SLICE).map(async (hit) => {
-      const meta = await grepExtractFrontmatter(hit.filePath);
-      const title = (meta?.title as string) || hit.id;
-      const cleaned = _cleanMatch(hit.matchLine);
-      return {
-        uuid: meta?.uuid as string | undefined,
-        slug: hit.id,
-        id: hit.id,
-        type,
-        title,
-        category: hit.category || UNCATEGORIZED,
-        excerpt: cleaned && cleaned.toLowerCase() !== title.toLowerCase() ? cleaned : undefined,
-      };
-    }),
-  );
-
 export const GET = defineRoute(
   {
     id: "search",
@@ -65,7 +19,7 @@ export const GET = defineRoute(
     path: "/search",
     tag: ApiTag.DISCOVERY,
     summary: "Search notes and checklists",
-    description: `Full-text search across your own notes and checklists. The query needs at least ${SEARCH_MIN_LEN} characters and each type returns at most ${RESULT_SLICE} hits.`,
+    description: `Full-text search across your own notes and checklists. The query needs at least ${SEARCH_MIN_LEN} characters and each type returns at most ${SEARCH_HITS_PER_TYPE} hits. By default the best matches come first, finding the words in any order, and exact-text matches fill the rest.`,
     query: searchParamsSchema,
     responses: {
       200: { description: "Matches", schema: searchResultsSchema },
@@ -75,22 +29,16 @@ export const GET = defineRoute(
     },
   },
   async ({ user, query }) => {
-    const pattern = _escape(query.q);
-
-    const [rawNotes, rawChecklists] = await Promise.all([
-      _grep(NOTES_DIR(user.username), pattern, query.type !== ItemTypes.CHECKLIST),
-      _grep(CHECKLISTS_DIR(user.username), pattern, query.type !== ItemTypes.NOTE),
-    ]);
-
-    const [notes, checklists] = await Promise.all([
-      _toHits(rawNotes, ItemTypes.NOTE),
-      _toHits(rawChecklists, ItemTypes.CHECKLIST),
-    ]);
+    const { hits, indexing } = await searchItems(user.username, query.q, {
+      type: query.type,
+      mode: query.match || user.searchMode || DEFAULT_SEARCH_MODE,
+    });
 
     return NextResponse.json({
       query: query.q,
-      results: [...notes, ...checklists],
-      total: notes.length + checklists.length,
+      results: hits.map((hit) => ({ ...hit, id: hit.slug })),
+      total: hits.length,
+      ...(indexing && { indexing }),
     });
   },
 );
diff --git a/app/api/shares/route.ts b/app/api/shares/route.ts
new file mode 100644
index 000000000..2278a2eed
--- /dev/null
+++ b/app/api/shares/route.ts
@@ -0,0 +1,31 @@
+import { NextResponse } from "next/server";
+import { defineRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, page } from "@/app/_schemas/api/common";
+import { sharesQuery, sharesSchema } from "@/app/_schemas/api/relations";
+import { sharesFor } from "@/app/_server/actions/share/listing";
+
+export const dynamic = "force-dynamic";
+
+export const GET = defineRoute(
+  {
+    id: "listShares",
+    method: HttpMethod.GET,
+    path: "/shares",
+    tag: ApiTag.SHARING,
+    summary: "What you shared and what was shared with you",
+    description:
+      "withMe lists items other people shared with you and what you can do with each. byMe lists your shared items, who holds them and whether they're public. Read only.",
+    query: sharesQuery,
+    responses: {
+      200: { description: "Shares", schema: sharesSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    const shares = await sharesFor(user, query);
+    return NextResponse.json({ shares: page(shares, query), total: shares.length });
+  },
+);
diff --git a/howto/BRAIN.md b/howto/BRAIN.md
index 7c0b93906..49432bfc0 100644
--- a/howto/BRAIN.md
+++ b/howto/BRAIN.md
@@ -87,14 +87,46 @@ Turning off **Bilateral Links** in the admin editor settings hides the brain, Re
 
 ---
 
+## Search
+
+The search bar uses the same index. It finds the words in any order, so "curry weeknight" finds a note called "Weeknight curry", and it puts the best matches first. A title match counts most, then tags and the text itself. Checklist items and link text are searched too.
+
+You can change how it works under **Search** in your preferences:
+
+| Setting | What it does |
+| --- | --- |
+| Best matches first, then exact text | The default. Ranked matches come first, then anything the ranked search missed that contains exactly what you typed. |
+| Best matches only | Only the ranked matches. Part of a word, like "ann" for "planning", won't match. |
+| Exact text only | The characters exactly as you typed them, anywhere in the file, in no particular order. This is how search worked before the index. |
+
+> [!TIP]
+> While Jotty builds the index on first start, the default setting falls back to exact text, so search keeps working. With **Best matches only**, the search box shows "Indexing your notes" until the index is ready.
+
+---
+
 ## The relationships index
 
-Jotty keeps the links in `data/.relations.db`, next to your notes. Your Markdown files are still the source of truth. The index holds the links, the titles, and a searchable copy of each unencrypted note's plain text, which is what **Mentioned in** searches.
+Jotty keeps the links in `data/.relations.db`, next to your notes. Your Markdown files are still the source of truth. The index holds the links, the titles, and a searchable copy of each unencrypted note and checklist, which is what search and **Mentioned in** use.
 
-- Jotty never reads encrypted notes, so their links don't appear anywhere.
+- Jotty never reads encrypted notes, so their links don't appear anywhere and search only finds them by exact text.
 - If the file is missing or damaged, Jotty rebuilds it from your notes on start. While that runs, Referenced By and the brain show "Indexing relationships...".
 - Files changed outside Jotty are picked up within about a minute.
-- Anyone can rebuild their own index with the [rebuild API](API.md#28-rebuild-link-index). Admins can also rebuild another user's, or everyone's from **Admin > Content**.
+- Anyone can rebuild their own index with the rebuild route in the [API](API.md). Admins can also rebuild another user's, or everyone's from **Admin > Content**.
 
 > [!NOTE]
 > A rebuild remembers which note each wikilink first matched. Deleting the file forgets that. Wikilinks whose target you renamed in Jotty, sitting in notes you haven't saved since, go back to matching by title.
+
+---
+
+## From the API and MCP
+
+The same links are available with an API key, so scripts and AI assistants can follow them too:
+
+| Route | What it gives you |
+| --- | --- |
+| `GET /api/relations/{itemId}` | What links to an item, what it links to, unwritten wikilinks, plain mentions and suggestions |
+| `GET /api/brain` | The items around one item with `focus`, or the most linked items without it |
+| `GET /api/relations/orphans` | Notes and checklists with no links at all |
+| `POST /api/relations/links` | Adds a link to a note, at the end or on the first plain mention of the target's title |
+
+They follow the same rules as the brain. You only see items you can open, linking needs edit access to the note, and encrypted notes are refused. With **Bilateral Links** turned off they answer `404`.
diff --git a/howto/MCP.md b/howto/MCP.md
index 8ff88f0ca..6483e761a 100644
--- a/howto/MCP.md
+++ b/howto/MCP.md
@@ -81,6 +81,16 @@ claude mcp add jotty -e JOTTY_URL=https://jotty.example.com -e JOTTY_API_KEY=ck_
 
 Each everyday action has its own tool, named after its API operation in snake case, so `listNotes` becomes `list_notes`. They cover search, categories, the usage summary, notes, checklists and their items, and the common board actions.
 
+The assistant can also follow your [links](BRAIN.md) and see what's shared:
+
+| Tool | What it does |
+|---|---|
+| `get_related` | What links to an item and what it links to, as titles. The assistant reads only the ones that matter instead of opening everything |
+| `get_brain` | The items around one item, or your most linked items |
+| `list_orphans` | Items with no links |
+| `connect_items` | Links a note to another item, so notes the assistant writes join the map |
+| `list_shares` | What other people shared with you and what you shared, with who can do what. Read only |
+
 Three more tools reach everything else:
 
 | Tool | What it does |
@@ -100,7 +110,8 @@ An assistant reads every character a tool sends back, and a long answer pushes t
 - `list_notes`, `list_checklists` and `list_boards` return 25 results at a time in a summary view. Notes come with a short excerpt instead of their content, checklists with item counts, and boards with card counts per column. `total` says how many matched, `offset` reads the next page, and `view=full` gets everything.
 - An answer longer than `JOTTY_MCP_MAX_TEXT_CHARS` keeps the rows that fit and adds a `trimmed` field with the `offset` for the next ones. A single record that's still too long gets cut.
 - Updating or moving a card returns that card, not the whole board.
-- Search results give you the `uuid` the other tools take and the file name as `slug`.
+- Search puts the best matches first and gives you the `uuid` the other tools take and the file name as `slug`.
+- `get_brain` returns 60 items at most by default, nearest and most linked first, and says when it left some out.
 - Export downloads aren't fetched. You get the link to download the file yourself.
 
 > [!NOTE]
diff --git a/mcp-server/src/server/mcp.ts b/mcp-server/src/server/mcp.ts
index 7f42d7443..84654937d 100644
--- a/mcp-server/src/server/mcp.ts
+++ b/mcp-server/src/server/mcp.ts
@@ -8,7 +8,10 @@ export const SERVER_VERSION = "0.1.0";
 export const SERVER_INSTRUCTIONS = [
   "Tools for a Jotty instance: notes, checklists and Kanban boards, acting as the user who owns the API key.",
   "Ids are uuids, so list or search first to get one. Checklist items are addressed by tree index, like 0 or 2.1.",
-  "The dedicated tools cover search, notes, checklists and boards. Use discover and call_operation for everything else the instance offers.",
+  "Search ranks the best matches first and finds the words in any order.",
+  "Notes link to each other. After finding an item, get_related lists what links to it and what it links to, so you can follow the links and read only what matters. get_brain maps the items around one, or the most linked ones.",
+  "When you write a note about another item, link it with connect_items so it doesn't end up an orphan.",
+  "The dedicated tools cover search, links, shares, notes, checklists and boards. Use discover and call_operation for everything else the instance offers.",
 ].join(" ");
 
 export const createMcpServer = (ctx: ToolContext): Server => {
diff --git a/mcp-server/src/tools/catalog.ts b/mcp-server/src/tools/catalog.ts
index f1384a528..6360be2bf 100644
--- a/mcp-server/src/tools/catalog.ts
+++ b/mcp-server/src/tools/catalog.ts
@@ -1,8 +1,11 @@
+import { ToolErrorKind, type ErrorHints } from "./errors.ts";
+
 export interface CatalogEntry {
   id: string;
   defaults?: Record<string, unknown>;
   pick?: string;
   omit?: string[];
+  hints?: ErrorHints;
 }
 
 const SUMMARY_PAGE = { view: "summary", limit: 25 };
@@ -33,6 +36,17 @@ export const CATALOG: CatalogEntry[] = [
   { id: "createBoardItem" },
   { id: "updateBoardItem", pick: "item" },
   { id: "moveBoardItem", pick: "item" },
+  { id: "getRelated" },
+  { id: "getBrain" },
+  { id: "listOrphans" },
+  {
+    id: "connectItems",
+    hints: {
+      [ToolErrorKind.Input]:
+        "style=mention only works when the source note already has the target's title as plain text. style=append always works and adds the link at the end.",
+    },
+  },
+  { id: "listShares", defaults: { limit: 25 } },
 ];
 
 export const CURATED_OPERATIONS = CATALOG.map((entry) => entry.id);
diff --git a/mcp-server/src/tools/operation.ts b/mcp-server/src/tools/operation.ts
index 52e618e8d..b01b7d660 100644
--- a/mcp-server/src/tools/operation.ts
+++ b/mcp-server/src/tools/operation.ts
@@ -87,6 +87,7 @@ const _hintsFor = (op: Operation, curated: boolean): ErrorHints => ({
     : curated
       ? "Check the arguments against the tool's input schema."
       : `Call discover with operationId ${op.operationId} to see what it takes.`,
+  ...catalogEntry(op.operationId)?.hints,
 });
 
 const _download = (ctx: ToolContext, path: string, contentType: string): ToolResult => {
diff --git a/mcp-server/tests/helpers.ts b/mcp-server/tests/helpers.ts
index 7ea6134b7..5c790e776 100644
--- a/mcp-server/tests/helpers.ts
+++ b/mcp-server/tests/helpers.ts
@@ -94,6 +94,24 @@ export const FAKE_SPEC: OpenApiDocument = {
         ],
       },
     },
+    "/relations/links": {
+      post: {
+        operationId: "connectItems",
+        summary: "Link a note to another item",
+        tags: ["Relations"],
+        requestBody: {
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: { source: { type: "string" }, target: { type: "string" }, style: { type: "string" } },
+                required: ["source", "target"],
+              },
+            },
+          },
+        },
+      },
+    },
     "/exports/{filename}": {
       get: {
         operationId: "downloadExport",
@@ -158,6 +176,7 @@ export const serveJotty = (spec: OpenApiDocument = FAKE_SPEC): FakeJotty => {
       if (url.pathname === "/api/tasks") return _json({ tasks: MANY_NOTES });
       if (url.pathname === "/api/tasks/bad/statuses") return _json({ error: "Status id is required" }, 400);
       if (url.pathname.endsWith("/check")) return _json({ error: "Item index out of range" }, 400);
+      if (url.pathname === "/api/relations/links") return _json({ error: "Mention not found" }, 400);
       if (url.pathname === "/api/notes") return _json(request.method === "GET" ? { notes: [NOTE] } : { success: true, data: NOTE });
       if (url.pathname.startsWith("/api/kanban/")) {
         return _json({ success: true, data: { uuid: "b-1", items: [CARD, { ...CARD, id: "c-2" }] }, item: CARD });
diff --git a/mcp-server/tests/session.test.ts b/mcp-server/tests/session.test.ts
index c385d47b1..691be12d9 100644
--- a/mcp-server/tests/session.test.ts
+++ b/mcp-server/tests/session.test.ts
@@ -54,6 +54,7 @@ describe("http transport", () => {
       "delete_note",
       "check_checklist_item",
       "update_board_item",
+      "connect_items",
       "discover",
       "call_operation",
       "health",
diff --git a/mcp-server/tests/tools.test.ts b/mcp-server/tests/tools.test.ts
index f33e4dd54..c27c5e0bd 100644
--- a/mcp-server/tests/tools.test.ts
+++ b/mcp-server/tests/tools.test.ts
@@ -79,6 +79,13 @@ describe("runOperation", () => {
     expect(text(result)).toContain("get_checklist");
   });
 
+  it("uses the catalog's own hint for a refused mention link", async () => {
+    const result = await runOperation(makeCtx(jotty.url), spec, op("connectItems"), { source: "n-1", target: "n-2", style: "mention" }, { curated: true });
+    expect(text(result)).toContain("Mention not found");
+    expect(text(result)).toContain("style=append");
+    expect(text(result)).not.toContain("input schema");
+  });
+
   it("cuts an oversized single record and leaves out the structured copy", async () => {
     const ctx = makeCtx(jotty.url);
     ctx.config.output.maxTextChars = 20;
@@ -125,7 +132,7 @@ describe("builtins", () => {
     const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.Discover, {});
     const data = structured(result);
     expect(data.version).toBe("9.9.9");
-    expect(data.tools).toEqual(["search", "list_notes", "get_note", "create_note", "delete_note", "check_checklist_item", "update_board_item"]);
+    expect(data.tools).toEqual(["search", "list_notes", "get_note", "create_note", "delete_note", "check_checklist_item", "update_board_item", "connect_items"]);
     expect(data.unavailableTools).toContain("list_boards");
   });
 
diff --git a/tests/api/relations.test.ts b/tests/api/relations.test.ts
new file mode 100644
index 000000000..3295082e3
--- /dev/null
+++ b/tests/api/relations.test.ts
@@ -0,0 +1,128 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  mockSharesInvolving as mockShares,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup";
+import { ShareDirections } from "@/app/_consts/sharing";
+import { ItemTypes } from "@/app/_types/enums";
+
+const mockVisible = vi.fn();
+const mockLink = vi.fn();
+const mockRelated = vi.fn();
+
+vi.mock("@/app/_server/actions/relations/queries", () => ({
+  visibleItems: (...args: unknown[]) => mockVisible(...args),
+}));
+vi.mock("@/app/_server/actions/relations/explore", () => ({
+  LINKS_OFF: "Links are turned off on this instance",
+  NOT_VISIBLE: "Not found",
+  DENIED: "Permission denied",
+  linkItems: (...args: unknown[]) => mockLink(...args),
+  relatedFor: (...args: unknown[]) => mockRelated(...args),
+}));
+
+import { GET as SHARES } from "@/app/api/shares/route";
+import { POST as CONNECT } from "@/app/api/relations/links/route";
+import { GET as RELATED } from "@/app/api/relations/[itemId]/route";
+
+const READ = { canRead: true, canEdit: false, canDelete: false };
+const ALL = { canRead: true, canEdit: true, canDelete: true, canCreate: true };
+
+const visible = new Map([
+  ["n-1", { uuid: "n-1", type: ItemTypes.NOTE, title: "Holiday plan", category: "Travel", owner: "bob", tags: [] }],
+  ["c-1", { uuid: "c-1", type: ItemTypes.CHECKLIST, title: "Groceries", category: "Home", owner: "testuser", tags: [] }],
+]);
+
+const shares = (query = "") =>
+  SHARES(createMockRequest("GET", `http://localhost:3000/api/shares${query}`));
+
+const connect = (body: object) =>
+  CONNECT(createMockRequest("POST", "http://localhost:3000/api/relations/links", body));
+
+describe("Relations and shares contracts", () => {
+  beforeEach(() => {
+    resetApiMocks();
+    mockAuthenticateApiKey.mockResolvedValue(mockUser);
+    mockVisible.mockResolvedValue(visible);
+    mockShares.mockResolvedValue([
+      { uuid: "n-1", type: ItemTypes.NOTE, owner: "bob", direction: ShareDirections.WITH_ME, permissions: READ },
+      {
+        uuid: "c-1",
+        type: ItemTypes.CHECKLIST,
+        owner: "testuser",
+        direction: ShareDirections.BY_ME,
+        isPublic: true,
+        viaCategory: "Home",
+        people: [["alice", ALL], ["public", READ]],
+      },
+      { uuid: "gone", type: ItemTypes.NOTE, owner: "bob", direction: ShareDirections.WITH_ME, permissions: READ },
+    ]);
+  });
+
+  describe("GET /api/shares", () => {
+    it("lists both directions with titles, dropping items the caller can't see", async () => {
+      const response = await shares();
+      const body = await getResponseJson(response);
+
+      expect(response.status).toBe(200);
+      expect(mockShares).toHaveBeenCalledWith(mockUser.username);
+      expect(body.total).toBe(2);
+      expect(body.shares).toEqual([
+        expect.objectContaining({ uuid: "c-1", title: "Groceries", isPublic: true, viaCategory: "Home" }),
+        expect.objectContaining({ uuid: "n-1", title: "Holiday plan", owner: "bob", permissions: READ }),
+      ]);
+    });
+
+    it("never lists the public pseudo-user as a person", async () => {
+      const body = await getResponseJson(await shares(`?direction=${ShareDirections.BY_ME}`));
+      expect(body.shares).toHaveLength(1);
+      expect(body.shares[0].sharedWith).toEqual([{ username: "alice", permissions: ALL }]);
+    });
+
+    it("filters by type and pages", async () => {
+      const body = await getResponseJson(await shares("?type=note&limit=1"));
+      expect(body.shares.map((share: { uuid: string }) => share.uuid)).toEqual(["n-1"]);
+      expect(body.total).toBe(1);
+    });
+  });
+
+  describe("POST /api/relations/links", () => {
+    it("links as the key owner, appending by default", async () => {
+      mockLink.mockResolvedValue({ success: true, data: null });
+      const response = await connect({ source: "n-1", target: "c-1" });
+      expect(response.status).toBe(200);
+      expect(mockLink).toHaveBeenCalledWith(mockUser, "n-1", "c-1", "append");
+    });
+
+    it.each([
+      ["Not found", 404],
+      ["Links are turned off on this instance", 404],
+      ["Permission denied", 403],
+      ["Encrypted notes stay closed", 400],
+    ])("turns %s into a %i", async (error, status) => {
+      mockLink.mockResolvedValue({ success: false, error });
+      const response = await connect({ source: "n-1", target: "c-1", style: "mention" });
+      expect(response.status).toBe(status);
+      expect((await getResponseJson(response)).error).toBe(error);
+    });
+
+    it("rejects a missing target before touching anything", async () => {
+      const response = await connect({ source: "n-1" });
+      expect(response.status).toBe(400);
+      expect(mockLink).not.toHaveBeenCalled();
+    });
+  });
+
+  it("GET /api/relations/{itemId} is a 404 for items the caller can't see", async () => {
+    mockRelated.mockResolvedValue({ success: false, error: "Not found" });
+    const response = await RELATED(createMockRequest("GET", "http://localhost:3000/api/relations/x"), {
+      params: Promise.resolve({ itemId: "x" }),
+    });
+    expect(response.status).toBe(404);
+    expect(mockRelated).toHaveBeenCalledWith(mockUser, "x");
+  });
+});
diff --git a/tests/api/setup.ts b/tests/api/setup.ts
index 779a80392..1b53e0952 100644
--- a/tests/api/setup.ts
+++ b/tests/api/setup.ts
@@ -50,6 +50,7 @@ export const mockRestatus = vi.fn();
 export const mockAssignItem = vi.fn();
 export const mockRemindItem = vi.fn();
 export const mockCanReach = vi.fn();
+export const mockSharesInvolving = vi.fn();
 
 vi.mock("@/app/_server/actions/api", () => ({
   authenticateApiKey: (...args: any[]) => mockAuthenticateApiKey(...args),
@@ -118,6 +119,7 @@ vi.mock("@/app/_server/actions/kanban/tweaker", () => ({
 
 vi.mock("@/app/_server/actions/share/queries", () => ({
   canReach: (...args: any[]) => mockCanReach(...args),
+  sharesInvolving: (...args: any[]) => mockSharesInvolving(...args),
 }));
 
 vi.mock("@/app/_server/actions/checklist-item/stamper", () => ({
@@ -230,6 +232,8 @@ export function resetApiMocks() {
   mockRemindItem.mockReset();
   mockCanReach.mockReset();
   mockCanReach.mockResolvedValue(true);
+  mockSharesInvolving.mockReset();
+  mockSharesInvolving.mockResolvedValue([]);
 }
 
 export function createMockRequest(
diff --git a/tests/server-actions/relations-explore.test.ts b/tests/server-actions/relations-explore.test.ts
new file mode 100644
index 000000000..8c2cc3e32
--- /dev/null
+++ b/tests/server-actions/relations-explore.test.ts
@@ -0,0 +1,274 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import nodeFs from "fs";
+import os from "os";
+import path from "path";
+import { mockFs, resetAllMocks } from "../setup";
+import { ItemTypes } from "@/app/_types/enums";
+import { LinkStyles, RelationsStatus } from "@/app/_consts/relations";
+import { SearchModes } from "@/app/_consts/search";
+import type { SanitisedUser } from "@/app/_types";
+
+vi.unmock("unified");
+vi.unmock("unist-util-visit");
+vi.unmock("@/app/_utils/checklist-utils");
+
+const mockNotes = vi.fn();
+const mockChecklists = vi.fn();
+const mockSettings = vi.fn();
+const mockCanReach = vi.fn();
+const mockRewrite = vi.fn();
+const mockGrep = vi.fn();
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({ broadcast: vi.fn() }));
+vi.mock("@/app/_server/actions/note/queries", () => ({ getUserNotes: () => mockNotes() }));
+vi.mock("@/app/_server/actions/checklist/queries", () => ({
+  getUserChecklists: () => mockChecklists(),
+}));
+vi.mock("@/app/_server/actions/config", () => ({ getSettings: () => mockSettings() }));
+vi.mock("@/app/_server/actions/share/queries", () => ({
+  canReach: (...args: unknown[]) => mockCanReach(...args),
+}));
+vi.mock("@/app/_server/actions/note/editor", () => ({
+  NOTE_UNCHANGED: "Nothing to change",
+  rewriteNote: (...args: unknown[]) => mockRewrite(...args),
+}));
+vi.mock("@/app/_utils/grep-utils", () => ({
+  grepSearchContent: (...args: unknown[]) => mockGrep(...args),
+  grepExtractFrontmatter: vi.fn().mockResolvedValue({ title: "Grepped", uuid: "g-1" }),
+}));
+
+import { indexItemFile } from "@/app/_server/actions/relations/indexer";
+import { closeRelationsDb, setRelationsStatus } from "@/app/_server/actions/relations/store";
+import { backlinksFor } from "@/app/_server/actions/relations/queries";
+import {
+  LINKS_OFF,
+  MENTION_MISSING,
+  NOT_VISIBLE,
+  linkItems,
+  neighbourhoodFor,
+  orphansFor,
+  relatedFor,
+} from "@/app/_server/actions/relations/explore";
+import { searchItems } from "@/app/_server/actions/search/engine";
+
+const A = "aaaaaaaa-1111-4222-8333-944455556666";
+const B = "bbbbbbbb-1111-4222-8333-944455556666";
+const C = "cccccccc-1111-4222-8333-944455556666";
+const D = "dddddddd-1111-4222-8333-944455556666";
+const L = "eeeeeeee-1111-4222-8333-944455556666";
+const BOB = "ffffffff-1111-4222-8333-944455556666";
+
+const alice = { username: "alice" } as SanitisedUser;
+
+let root: string;
+
+const itemPath = (mode: string, owner: string, rel: string) =>
+  path.join(root, "data", mode, owner, rel);
+
+const doc = (uuid: string, title: string, body: string, extra = "") =>
+  `---\nuuid: ${uuid}\ntitle: ${title}\n${extra}---\n\n${body}`;
+
+const write = (filePath: string, content: string) => {
+  nodeFs.mkdirSync(path.dirname(filePath), { recursive: true });
+  nodeFs.writeFileSync(filePath, content);
+  indexItemFile(filePath, content, Math.floor(nodeFs.statSync(filePath).mtimeMs));
+};
+
+const meta = (uuid: string, title: string, tags: string[] = []) => ({
+  uuid,
+  title,
+  category: "Home",
+  owner: "alice",
+  tags,
+});
+
+const seed = () => {
+  write(itemPath("notes", "alice", "Home/curry.md"), doc(A, "Weeknight curry", "Onions, garlic, a tin of tomatoes."));
+  write(
+    itemPath("notes", "alice", "Home/meals.md"),
+    doc(B, "Meal plan", `Monday is [Weeknight curry](/note/${A}). Tuesday [[Soup ideas]].`),
+  );
+  write(itemPath("notes", "alice", "Home/stray.md"), doc(C, "Stray thought", "Nothing links here.", "tags: [home]\n"));
+  write(
+    itemPath("notes", "alice", "Home/diary.md"),
+    doc(D, "Diary", "cipher text curry", "encrypted: true\n"),
+  );
+  write(
+    itemPath("checklists", "alice", "Home/shop.md"),
+    doc(L, "Shopping", `- [ ] Tomatoes for the curry\n- [ ] Rice\n- [ ] Read the [Meal plan](/note/${B})`),
+  );
+  write(itemPath("notes", "bob", "curry.md"), doc(BOB, "Bob curry", "curry curry curry"));
+
+  mockNotes.mockResolvedValue({
+    success: true,
+    data: [meta(A, "Weeknight curry"), meta(B, "Meal plan"), meta(C, "Stray thought", ["home"]), meta(D, "Diary")],
+  });
+  mockChecklists.mockResolvedValue({ success: true, data: [meta(L, "Shopping")] });
+};
+
+const useRealFs = async () => {
+  const real = await vi.importActual<typeof import("fs/promises")>("fs/promises");
+  mockFs.readFile.mockImplementation(real.readFile as never);
+  mockFs.writeFile.mockImplementation(real.writeFile as never);
+  mockFs.stat.mockImplementation(real.stat as never);
+  mockFs.mkdir.mockImplementation(real.mkdir as never);
+};
+
+describe("relations explore", () => {
+  beforeEach(async () => {
+    resetAllMocks();
+    await useRealFs();
+    root = nodeFs.mkdtempSync(path.join(os.tmpdir(), "jotty-explore-"));
+    vi.spyOn(process, "cwd").mockReturnValue(root);
+    process.env.JOTTY_RELATIONS_DB = path.join(root, "relations.db");
+    closeRelationsDb();
+    setRelationsStatus(RelationsStatus.READY);
+    mockSettings.mockResolvedValue({ editor: { enableBilateralLinks: true } });
+    mockCanReach.mockResolvedValue(true);
+    mockGrep.mockReset().mockResolvedValue([]);
+    seed();
+  });
+
+  afterEach(() => {
+    closeRelationsDb();
+    vi.restoreAllMocks();
+    nodeFs.rmSync(root, { recursive: true, force: true });
+  });
+
+  describe("search", () => {
+    const titles = async (query: string, mode = SearchModes.RANKED) =>
+      (await searchItems("alice", query, { mode })).hits.map((hit) => hit.title);
+
+    it("finds the words in any order and ranks the title match first", async () => {
+      expect((await titles("curry weeknight"))[0]).toBe("Weeknight curry");
+    });
+
+    it("searches checklist items and link text across both types", async () => {
+      const found = await titles("curry");
+      expect(found).toEqual(expect.arrayContaining(["Weeknight curry", "Meal plan", "Shopping"]));
+    });
+
+    it("keeps to the caller's own unencrypted items", async () => {
+      const found = await titles("curry");
+      expect(found).not.toContain("Bob curry");
+      expect(found).not.toContain("Diary");
+    });
+
+    it("returns the slug and category from the file path", async () => {
+      const { hits } = await searchItems("alice", "stray", { mode: SearchModes.RANKED });
+      expect(hits[0]).toMatchObject({ uuid: C, slug: "stray", category: "Home", type: ItemTypes.NOTE });
+    });
+
+    it("fills a smart search with exact-text hits the index missed, without repeats", async () => {
+      mockGrep.mockImplementation(async (dir: string) =>
+        dir.includes("notes")
+          ? [
+              { filePath: itemPath("notes", "alice", "Home/curry.md"), id: "curry", category: "Home", matchLine: "" },
+              { filePath: itemPath("notes", "alice", "Home/odd.md"), id: "odd", category: "Home", matchLine: "curryish" },
+            ]
+          : [],
+      );
+      const { hits } = await searchItems("alice", "curry", { mode: SearchModes.SMART });
+      expect(hits.filter((hit) => hit.slug === "curry")).toHaveLength(1);
+      expect(hits[hits.length - 1].slug).toBe("odd");
+    });
+
+    it("uses only grep for substring and while the index builds in smart", async () => {
+      await searchItems("alice", "curry", { mode: SearchModes.SUBSTRING });
+      expect(mockGrep).toHaveBeenCalledTimes(2);
+
+      setRelationsStatus(RelationsStatus.BUILDING);
+      mockGrep.mockClear();
+      const smart = await searchItems("alice", "curry", { mode: SearchModes.SMART });
+      expect(mockGrep).toHaveBeenCalledTimes(2);
+      expect(smart.indexing).toBe(false);
+    });
+
+    it("says it is indexing instead of guessing when ranked-only runs before the index is ready", async () => {
+      setRelationsStatus(RelationsStatus.BUILDING);
+      const ranked = await searchItems("alice", "curry", { mode: SearchModes.RANKED });
+      expect(ranked).toEqual({ hits: [], indexing: true });
+      expect(mockGrep).not.toHaveBeenCalled();
+    });
+  });
+
+  it("only lists notes under Mentioned in, never checklists", () => {
+    write(itemPath("notes", "alice", "Home/rice.md"), doc(C, "Rice", "plain"));
+    const visible = new Map(
+      [meta(C, "Rice"), meta(L, "Shopping")].map((item, i) => [
+        item.uuid,
+        { ...item, type: i ? ItemTypes.CHECKLIST : ItemTypes.NOTE },
+      ]),
+    );
+    expect(backlinksFor(C, visible).mentions).toEqual([]);
+  });
+
+  describe("relatedFor", () => {
+    it("lists backlinks, outgoing links and unwritten wikilinks", async () => {
+      const result = await relatedFor(alice, B);
+      expect(result.success).toBe(true);
+      expect(result.data?.backlinks.map((item) => item.uuid)).toEqual([L]);
+      expect(result.data?.links.map((item) => item.uuid)).toEqual([A]);
+      expect(result.data?.unwritten).toEqual(["Soup ideas"]);
+    });
+
+    it("refuses items the caller can't see", async () => {
+      expect(await relatedFor(alice, BOB)).toEqual({ success: false, error: NOT_VISIBLE });
+    });
+
+    it("says so when links are turned off", async () => {
+      mockSettings.mockResolvedValue({ editor: { enableBilateralLinks: false } });
+      expect(await relatedFor(alice, B)).toEqual({ success: false, error: LINKS_OFF });
+    });
+  });
+
+  describe("neighbourhoodFor", () => {
+    const base = { depth: 1, limit: 60, suggestions: false };
+
+    it("walks out from the focus by depth", async () => {
+      const near = await neighbourhoodFor(alice, { ...base, focus: A });
+      expect(near.data?.nodes.map((node) => node.id).sort()).toEqual([A, B].sort());
+
+      const far = await neighbourhoodFor(alice, { ...base, focus: A, depth: 2 });
+      expect(far.data?.nodes.map((node) => node.id)).toEqual(expect.arrayContaining([L, "ghost:soup ideas"]));
+      expect(far.data?.nodes.find((node) => node.id === L)?.distance).toBe(2);
+    });
+
+    it("without a focus returns only linked items, most linked first, and flags a cut", async () => {
+      const map = await neighbourhoodFor(alice, { ...base, limit: 1 });
+      expect(map.data?.nodes.map((node) => node.id)).toEqual([B]);
+      expect(map.data?.truncated).toBe(true);
+      expect(map.data?.nodes.some((node) => node.id.startsWith("tag:"))).toBe(false);
+    });
+  });
+
+  it("lists orphans, ignoring tags", async () => {
+    const result = await orphansFor(alice, { limit: 25, offset: 0 });
+    expect(result.data?.orphans.map((item) => item.uuid).sort()).toEqual([C, D].sort());
+    expect(result.data?.total).toBe(2);
+  });
+
+  describe("linkItems", () => {
+    it("appends a link inside the source note's lane", async () => {
+      mockRewrite.mockImplementation(async (_actor, _uuid, rewrite) => {
+        expect(rewrite("Some text")).toBe(`Some text\n\n[Stray thought](/note/${C})\n`);
+        return { success: true };
+      });
+      expect(await linkItems(alice, A, C, LinkStyles.APPEND)).toEqual({ success: true, data: null });
+      expect(mockRewrite).toHaveBeenCalledWith(alice, A, expect.any(Function));
+    });
+
+    it("reports a missing mention", async () => {
+      mockRewrite.mockResolvedValue({ error: "Nothing to change" });
+      expect(await linkItems(alice, A, C, LinkStyles.MENTION)).toEqual({ success: false, error: MENTION_MISSING });
+    });
+
+    it("refuses hidden targets, checklist sources and missing edit rights", async () => {
+      expect((await linkItems(alice, A, BOB, LinkStyles.APPEND)).error).toBe(NOT_VISIBLE);
+      expect((await linkItems(alice, L, A, LinkStyles.APPEND)).error).toBe(NOT_VISIBLE);
+      mockCanReach.mockResolvedValue(false);
+      expect((await linkItems(alice, A, C, LinkStyles.APPEND)).error).toBe("Permission denied");
+      expect(mockRewrite).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/tests/server-actions/relations.test.ts b/tests/server-actions/relations.test.ts
index 57635afb9..d17bc8a65 100644
--- a/tests/server-actions/relations.test.ts
+++ b/tests/server-actions/relations.test.ts
@@ -450,6 +450,27 @@ describe("relations", () => {
       expect(mockBroadcast).toHaveBeenCalledWith(expect.objectContaining({ type: "relations" }));
     });
 
+    it("drops a watcher pass whose file was saved again while it was reading", async () => {
+      const aPath = itemPath("notes", "alice", "a.md");
+      write(aPath, note(A, "Alpha", "no links yet"));
+      const stale = note(A, "Alpha", "no links yet");
+      nodeFs.utimesSync(aPath, new Date(), new Date(Date.now() + 5_000));
+
+      const real = await vi.importActual<typeof import("fs/promises")>("fs/promises");
+      mockFs.readFile.mockImplementationOnce(async () => {
+        const fresh = note(A, "Alpha", `now [Beta](/note/${B})`);
+        nodeFs.writeFileSync(aPath, fresh);
+        nodeFs.utimesSync(aPath, new Date(), new Date(Date.now() + 10_000));
+        indexItemFile(aPath, fresh, Math.floor(nodeFs.statSync(aPath).mtimeMs));
+        return stale;
+      });
+      mockFs.readFile.mockImplementation(real.readFile as never);
+
+      await refreshItemPaths([aPath]);
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Beta" }]);
+      expect(backlinksFor(B, visible).backlinks.map((item) => item.uuid)).toEqual([A]);
+    });
+
     it("picks up a category folder moved outside Jotty", async () => {
       const from = itemPath("notes", "alice", "Old");
       const to = itemPath("notes", "alice", "New");

From 73cb5f5135021c9b2f9cbbe4b0dc505a6f412da2 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 13:56:30 +0100
Subject: [PATCH 20/28] fix bunny nitpicks

---
 .github/workflows/prebuild-release.yml         |  4 ++--
 .../Search/Parts/SearchResults.tsx             |  6 ++++++
 .../FeatureComponents/Search/SearchBar.tsx     |  2 ++
 app/_hooks/useSearch.ts                        | 13 ++++++++++---
 app/_server/actions/kanban/tweaker.ts          |  8 +++++++-
 app/_server/actions/lib/audit-trail.ts         |  4 ++--
 app/_server/actions/search/engine.ts           |  4 +---
 app/_translations/de.json                      | 14 +++++++++++---
 app/_translations/en.json                      |  9 +++++----
 app/_translations/es.json                      | 16 ++++++++++++----
 app/_translations/fr.json                      | 14 +++++++++++---
 app/_translations/it.json                      | 14 +++++++++++---
 app/_translations/klingon.json                 | 18 +++++++++++++-----
 app/_translations/ko.json                      | 14 +++++++++++---
 app/_translations/nl.json                      | 14 +++++++++++---
 app/_translations/pirate.json                  | 14 +++++++++++---
 app/_translations/pl.json                      | 12 ++++++++++--
 app/_translations/pt.json                      | 14 +++++++++++---
 app/_translations/ru.json                      | 12 ++++++++++--
 app/_translations/tr.json                      | 12 ++++++++++--
 app/_translations/vi.json                      | 14 +++++++++++---
 app/_translations/zh.json                      | 12 ++++++++++--
 app/_utils/api-list-utils.ts                   |  4 ++--
 app/_utils/grep-utils.ts                       | 14 +++++++-------
 mcp-server/src/server/http.ts                  |  2 ++
 tests/api/items.test.ts                        | 10 ++++++++++
 tests/security/kanban-grants.test.ts           | 12 ++++++++++++
 tests/security/shell-injection.test.ts         | 17 +++++++++++++++++
 28 files changed, 238 insertions(+), 65 deletions(-)

diff --git a/.github/workflows/prebuild-release.yml b/.github/workflows/prebuild-release.yml
index 16b05237f..a7258a066 100644
--- a/.github/workflows/prebuild-release.yml
+++ b/.github/workflows/prebuild-release.yml
@@ -52,7 +52,7 @@ jobs:
           sha256sum jotty_${{ steps.version.outputs.version }}_prebuild.tar.gz > jotty_${{ steps.version.outputs.version }}_prebuild.tar.gz.sha256
 
       - name: Attach to Release - pray it works
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           files: |
             prebuild-release/jotty_*_prebuild.tar.gz
@@ -106,7 +106,7 @@ jobs:
           sha256sum jotty-mcp_${{ steps.version.outputs.version }}_prebuild.tar.gz > jotty-mcp_${{ steps.version.outputs.version }}_prebuild.tar.gz.sha256
 
       - name: Attach to Release - pray it works twice
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           files: |
             mcp-server/prebuild-release/jotty-mcp_*_prebuild.tar.gz
diff --git a/app/_components/FeatureComponents/Search/Parts/SearchResults.tsx b/app/_components/FeatureComponents/Search/Parts/SearchResults.tsx
index 2cd21d4d3..f71059dc3 100644
--- a/app/_components/FeatureComponents/Search/Parts/SearchResults.tsx
+++ b/app/_components/FeatureComponents/Search/Parts/SearchResults.tsx
@@ -24,6 +24,7 @@ interface SearchResultsProps {
   onSelectResult: (result: SearchResult) => void;
   query: string;
   indexing?: boolean;
+  searching?: boolean;
 }
 
 export const SearchResults = ({
@@ -32,6 +33,7 @@ export const SearchResults = ({
   onSelectResult,
   query,
   indexing = false,
+  searching = false,
 }: SearchResultsProps) => {
   const t = useTranslations();
 
@@ -71,6 +73,10 @@ export const SearchResults = ({
     return <IndexingRelations compact label={t("relations.indexingSearch")} />;
   }
 
+  if (results.length === 0 && searching) {
+    return <IndexingRelations compact label={t("common.searching")} />;
+  }
+
   if (results.length === 0) {
     return (
       <div className="p-4 text-center text-muted-foreground">
diff --git a/app/_components/FeatureComponents/Search/SearchBar.tsx b/app/_components/FeatureComponents/Search/SearchBar.tsx
index 8acbbbf3d..6eb40e007 100644
--- a/app/_components/FeatureComponents/Search/SearchBar.tsx
+++ b/app/_components/FeatureComponents/Search/SearchBar.tsx
@@ -35,6 +35,7 @@ export const SearchBar = ({
     inputRef,
     containerRef,
     isIndexing,
+    isSearching,
   } = useSearch({ mode, onModeChange, onResultSelect });
 
   useEffect(() => {
@@ -69,6 +70,7 @@ export const SearchBar = ({
             onSelectResult={handleSelectResult}
             query={query}
             indexing={isIndexing}
+            searching={isSearching}
           />
         </div>
       )}
diff --git a/app/_hooks/useSearch.ts b/app/_hooks/useSearch.ts
index 1153376ab..60dbde1b4 100644
--- a/app/_hooks/useSearch.ts
+++ b/app/_hooks/useSearch.ts
@@ -33,10 +33,11 @@ export const useSearch = ({
   const [query, setQuery] = useState("");
   const [selectedIndex, setSelectedIndex] = useState(0);
   const [results, setResults] = useState<SearchResult[]>([]);
-  const [isSearching, setIsSearching] = useState(false);
+  const [settledQuery, setSettledQuery] = useState("");
   const [isIndexing, setIsIndexing] = useState(false);
 
   const inputRef = useRef<HTMLInputElement>(null);
+  const latestSearch = useRef(0);
   const containerRef = useRef<HTMLDivElement>(null);
 
   const handleSelectResult = useCallback(
@@ -61,15 +62,19 @@ export const useSearch = ({
 
   useEffect(() => {
     const performSearch = async (searchQuery: string) => {
+      const ticket = ++latestSearch.current;
+      const isLatest = () => ticket === latestSearch.current;
+
       if (!searchQuery.trim() || searchQuery.length < 2) {
         setResults([]);
         setIsIndexing(false);
+        setSettledQuery(searchQuery);
         return;
       }
 
-      setIsSearching(true);
       try {
         const result = await search(searchQuery);
+        if (!isLatest()) return;
         setIsIndexing(Boolean(result.indexing));
         if (result.success && result.data) {
           const formatted = result.data.map((item) => ({
@@ -89,7 +94,7 @@ export const useSearch = ({
       } catch (error) {
         console.error("Search failed:", error);
       } finally {
-        setIsSearching(false);
+        if (isLatest()) setSettledQuery(searchQuery);
       }
     };
 
@@ -97,6 +102,8 @@ export const useSearch = ({
     return () => clearTimeout(debounceTimeout);
   }, [query, appSettings]);
 
+  const isSearching = query.trim().length >= 2 && settledQuery !== query;
+
   useEffect(() => {
     const handleKeyDown = (e: KeyboardEvent) => {
       if ((e.metaKey || e.ctrlKey) && e.key === "k") {
diff --git a/app/_server/actions/kanban/tweaker.ts b/app/_server/actions/kanban/tweaker.ts
index e4c61cc2a..3a3949dab 100644
--- a/app/_server/actions/kanban/tweaker.ts
+++ b/app/_server/actions/kanban/tweaker.ts
@@ -8,7 +8,7 @@ import {
 } from "@/app/_types/enums";
 import { serverWriteFile } from "@/app/_server/actions/file";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
-import { reachableFile } from "@/app/_server/actions/share/queries";
+import { canReach, reachableFile } from "@/app/_server/actions/share/queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { getListById } from "@/app/_server/actions/checklist/queries";
 import { notifyUser } from "@/app/_server/actions/notifications/internal";
@@ -86,6 +86,12 @@ export const assignItem = async (
   assignee: string,
 ): Promise<Result<Checklist>> => {
   try {
+    const username = actor?.username;
+    if (!username) return { success: false, error: "Not authenticated" };
+    if (!(await canReach(uuid, ItemTypes.CHECKLIST, username, PermissionTypes.EDIT))) {
+      return { success: false, error: "Permission denied" };
+    }
+
     const refusal = assignee ? await assigneeRefusal(assignee, uuid) : null;
     if (refusal) return { success: false, error: refusal };
 
diff --git a/app/_server/actions/lib/audit-trail.ts b/app/_server/actions/lib/audit-trail.ts
index 6d1e48fc5..41c8fd068 100644
--- a/app/_server/actions/lib/audit-trail.ts
+++ b/app/_server/actions/lib/audit-trail.ts
@@ -32,8 +32,8 @@ const _readDay = async (username: string, date: Date): Promise<AuditLogEntry[]>
 };
 
 export const everyUsername = async (): Promise<string[]> => {
-  const users: User[] = await readJsonFile(USERS_FILE);
-  return users.map((user) => user.username);
+  const users: User[] | null = await readJsonFile(USERS_FILE);
+  return (users ?? []).map((user) => user.username);
 };
 
 export const digUpLogs = async (
diff --git a/app/_server/actions/search/engine.ts b/app/_server/actions/search/engine.ts
index d9612e6d0..c7764bf6c 100644
--- a/app/_server/actions/search/engine.ts
+++ b/app/_server/actions/search/engine.ts
@@ -40,8 +40,6 @@ const _cleanMatch = (line: string) =>
     .replace(/^#+\s*/, "")
     .trim();
 
-const _escape = (query: string) => query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-
 const _grepHits = async (
   username: string,
   query: string,
@@ -51,7 +49,7 @@ const _grepHits = async (
 ): Promise<SearchHit[]> => {
   let found: Awaited<ReturnType<typeof grepSearchContent>> = [];
   try {
-    found = await grepSearchContent(DIRS[type](username), _escape(query));
+    found = await grepSearchContent(DIRS[type](username), query);
   } catch (error) {
     console.error(`Search grep failed for ${type}:`, error);
   }
diff --git a/app/_translations/de.json b/app/_translations/de.json
index a8efe5cdb..c72cf6aa2 100644
--- a/app/_translations/de.json
+++ b/app/_translations/de.json
@@ -171,6 +171,7 @@
     "dismiss": "Verwerfen",
     "cleaning": "Bereinige...",
     "noResultsFound": "Keine Ergebnisse gefunden",
+    "searching": "Suche läuft...",
     "noResults": "Keine Ergebnisse",
     "by": "von {owner}",
     "unsavedChanges": "Ungespeicherte Änderungen",
@@ -809,6 +810,12 @@
     "handedness": "Händigkeit",
     "selectHandedness": "Wähle deine Händigkeit",
     "chooseHandedness": "Wähle aus, ob du Rechtshänder oder Linkshänder bist.",
+    "searchMode": "Suche",
+    "selectSearchMode": "Wähle, wie die Suche funktioniert",
+    "searchModeSmart": "Beste Treffer zuerst, dann genauer Text",
+    "searchModeRanked": "Nur beste Treffer",
+    "searchModeSubstring": "Nur genauer Text",
+    "searchModeDescription": "Beste Treffer findet die Wörter in beliebiger Reihenfolge und zeigt die relevantesten Einträge zuerst. Genauer Text sucht die Zeichen genau so, wie du sie eingegeben hast, irgendwo in der Datei.",
     "rightHanded": "Rechtshänder",
     "leftHanded": "Linkshänder",
     "notesPreferences": "Notizen-Voreinstellungen",
@@ -1076,7 +1083,7 @@
     "saving": "Speichere...",
     "editorSettingsSaved": "Editoreinstellungen gespeichert.",
     "customEmojis": "Emoji Personalizzate",
-    "noEmojisYet": "Noch keine benutzerdefinierten Emojis. Klick auf &quot;Emoji erstellen&quot;, um eins hinzuzufügen.",
+    "noEmojisYet": "Noch keine benutzerdefinierten Emojis. Klick auf \"Emoji erstellen\", um eins hinzuzufügen.",
     "enterAnyEmoji": "Gib irgendein Emoji ein oder verwende den Emoji-Wähler (Windows: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Übersicht der Freigabeaktivitäten",
     "detailedSharingBreakdown": "Was geteilt wird und wer es teilt",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "Was geändert wurde:",
     "migrationPartial": "Migration mit Resten abgeschlossen",
     "leftoversTitle": "Einige alte Dateien wurden behalten",
-    "leftoversBody": "Die Migration konnte nicht alles übernehmen, deshalb liegen die unten aufgeführten alten Dateien unverändert auf der Festplatte. Nichts wurde gelöscht. Du kannst die Ursache beheben und die Migration erneut ausführen, oder jetzt in die App gehen und dich später darum kümmern.",
+    "leftoversBody": "Die Migration konnte nicht alles übernehmen, deshalb liegen die unten aufgeführten alten Dateien unverändert auf der Festplatte. Du kannst die Ursache beheben und die Migration erneut ausführen, oder jetzt in die App gehen und dich später darum kümmern.",
     "overrideConfirmLabel": "Trotzdem weitermachen und diese Seite nicht mehr anzeigen.",
     "overrideConfirmHint": "Die übrigen Dateien bleiben auf der Festplatte, aber die App behandelt deine Daten als migriert. Oben aufgeführte Freigaben oder Sortierungen greifen erst, wenn du erneut migrierst. Das geht jederzeit über /migration?force=1.",
     "continueAnyway": "Trotzdem weiter",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "Verknüpfungen werden indiziert...",
+    "indexingSearch": "Deine Notizen werden indexiert, die Suche ist gleich bereit...",
     "unreachable": "nicht erreichbar",
     "createFromWikilink": "Eine Notiz namens \"{title}\" erstellen",
     "mentionedIn": "Erwähnt in",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Füge zuerst einen API-Schlüssel hinzu.",
     "noKeyNeeded": "kein API-Schlüssel nötig",
     "deprecated": "veraltet",
-    "requestFailed": "Die Anfrage hat den Server nie erreicht. Prüf deine Verbindung.",
+    "requestFailed": "Es kam keine Antwort zurück. Prüfe deine Verbindung und ob die Änderung übernommen wurde, bevor du es erneut versuchst.",
     "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/en.json b/app/_translations/en.json
index c5e3b8a57..9f696d9eb 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -171,6 +171,7 @@
     "dismiss": "Dismiss",
     "cleaning": "Cleaning...",
     "noResultsFound": "No results found",
+    "searching": "Searching...",
     "noResults": "No results",
     "by": "by {owner}",
     "unsavedChanges": "Unsaved Changes",
@@ -1083,8 +1084,8 @@
     "excalidrawProxyEnabledDescription": "Routes Excalidraw traffic through Jotty's server. Needed for internal Docker network URLs (e.g., http://excalidraw:3000) that users' browsers can't reach.",
     "saving": "Saving...",
     "editorSettingsSaved": "Editor settings saved.",
-    "customEmojis": "Emoji Personalizzate",
-    "noEmojisYet": "No custom emojis yet. Click &quot;Add Emoji&quot; to add one.",
+    "customEmojis": "Custom Emojis",
+    "noEmojisYet": "No custom emojis yet. Click \"Add Emoji\" to add one.",
     "enterAnyEmoji": "Enter any emoji or use the emoji picker (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Sharing Activity Overview",
     "detailedSharingBreakdown": "What gets shared, and who shares it",
@@ -1636,7 +1637,7 @@
     "whatWasChanged": "What was changed:",
     "migrationPartial": "Migration Finished With Leftovers",
     "leftoversTitle": "Some legacy files were kept",
-    "leftoversBody": "The migration could not translate everything, so the legacy files below were left on disk untouched. Nothing has been deleted. You can fix the cause and run the migration again, or continue into the app now and deal with it later.",
+    "leftoversBody": "The migration could not translate everything, so the legacy files below were left on disk untouched. You can fix the cause and run the migration again, or continue into the app now and deal with it later.",
     "overrideConfirmLabel": "Continue anyway and stop showing this page.",
     "overrideConfirmHint": "The leftover files stay on disk, but the app will treat your data as migrated. Any sharing or ordering listed above will not be applied until you migrate again, which you can do at any time from /migration?force=1.",
     "continueAnyway": "Continue Anyway",
@@ -1880,7 +1881,7 @@
     "keyRequired": "Add an API key first.",
     "noKeyNeeded": "no API key needed",
     "deprecated": "deprecated",
-    "requestFailed": "The request never reached the server. Check your connection.",
+    "requestFailed": "No response came back. Check your connection, and check whether the change went through before you try again.",
     "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/es.json b/app/_translations/es.json
index 3aba58720..9c90acb0a 100644
--- a/app/_translations/es.json
+++ b/app/_translations/es.json
@@ -171,6 +171,7 @@
     "dismiss": "Descartar",
     "cleaning": "Limpiando...",
     "noResultsFound": "No se encontraron resultados",
+    "searching": "Buscando...",
     "noResults": "Sin resultados",
     "by": "por {owner}",
     "unsavedChanges": "Cambios no guardados",
@@ -242,7 +243,7 @@
     "history": "Historial",
     "disable": "Desactivar",
     "restoring": "Restaurando...",
-    "retry": "Rever",
+    "retry": "Reintentar",
     "copiedToClipboard": "Copiado al portapapeles",
     "offline": "Desconectado",
     "connected": "Conectado",
@@ -809,6 +810,12 @@
     "handedness": "Lateralidad",
     "selectHandedness": "Seleccionar lateralidad",
     "chooseHandedness": "Elija si es diestro o zurdo.",
+    "searchMode": "Búsqueda",
+    "selectSearchMode": "Seleccione cómo funciona la búsqueda",
+    "searchModeSmart": "Mejores coincidencias primero, luego texto exacto",
+    "searchModeRanked": "Solo mejores coincidencias",
+    "searchModeSubstring": "Solo texto exacto",
+    "searchModeDescription": "Mejores coincidencias encuentra las palabras en cualquier orden y muestra primero los elementos más relevantes. Texto exacto busca los caracteres tal como los escribió, en cualquier parte del archivo.",
     "rightHanded": "Diestro",
     "leftHanded": "Zurdo",
     "notesPreferences": "Preferencias de notas",
@@ -1359,7 +1366,7 @@
     "calloutWarning": "Advertencia",
     "calloutSuccess": "Éxito",
     "calloutDanger": "Peligro",
-    "ruler": "Gobernante",
+    "ruler": "Regla",
     "lineNumbers": "Números de línea"
   },
   "sharing": {
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "Qué se cambió:",
     "migrationPartial": "Migración terminada con restos",
     "leftoversTitle": "Se conservaron algunos archivos antiguos",
-    "leftoversBody": "La migración no pudo trasladarlo todo, así que los archivos antiguos de abajo se quedaron en el disco sin tocar. No se ha eliminado nada. Puede corregir la causa y volver a ejecutar la migración, o entrar ya en la aplicación y ocuparse de ello más tarde.",
+    "leftoversBody": "La migración no pudo trasladarlo todo, así que los archivos antiguos de abajo se quedaron en el disco sin tocar. Puede corregir la causa y volver a ejecutar la migración, o entrar ya en la aplicación y ocuparse de ello más tarde.",
     "overrideConfirmLabel": "Continuar de todos modos y dejar de mostrar esta página.",
     "overrideConfirmHint": "Los archivos restantes se quedan en el disco, pero la aplicación tratará sus datos como migrados. La compartición u orden indicados arriba no se aplicarán hasta que vuelva a migrar, algo que puede hacer en cualquier momento desde /migration?force=1.",
     "continueAnyway": "Continuar de todos modos",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "Indexando relaciones...",
+    "indexingSearch": "Indexando sus notas, la búsqueda estará lista en un momento...",
     "unreachable": "no accesible",
     "createFromWikilink": "Crear una nota llamada \"{title}\"",
     "mentionedIn": "Mencionado en",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Añada primero una clave API.",
     "noKeyNeeded": "no necesita clave API",
     "deprecated": "obsoleto",
-    "requestFailed": "La petición no llegó al servidor. Revise su conexión.",
+    "requestFailed": "No llegó ninguna respuesta. Compruebe su conexión y si el cambio se aplicó antes de volver a intentarlo.",
     "responseMeta": "{status} en {ms} ms"
   }
 }
diff --git a/app/_translations/fr.json b/app/_translations/fr.json
index 7c07c61f3..4a3155ed2 100644
--- a/app/_translations/fr.json
+++ b/app/_translations/fr.json
@@ -171,6 +171,7 @@
     "dismiss": "Ignorer",
     "cleaning": "Nettoyage...",
     "noResultsFound": "Aucun résultat trouvé",
+    "searching": "Recherche en cours...",
     "noResults": "Aucun résultat",
     "by": "par {owner}",
     "unsavedChanges": "Modifications non enregistrées",
@@ -809,6 +810,12 @@
     "handedness": "Latéralité",
     "selectHandedness": "Sélectionner la latéralité",
     "chooseHandedness": "Choisissez si vous êtes droitier ou gaucher.",
+    "searchMode": "Recherche",
+    "selectSearchMode": "Choisissez le fonctionnement de la recherche",
+    "searchModeSmart": "Meilleurs résultats d’abord, puis texte exact",
+    "searchModeRanked": "Meilleurs résultats uniquement",
+    "searchModeSubstring": "Texte exact uniquement",
+    "searchModeDescription": "Meilleurs résultats trouve les mots dans n’importe quel ordre et affiche d’abord les éléments les plus pertinents. Texte exact cherche les caractères tels que vous les avez saisis, n’importe où dans le fichier.",
     "rightHanded": "Droitier",
     "leftHanded": "Gaucher",
     "notesPreferences": "Préférences des notes",
@@ -1076,7 +1083,7 @@
     "saving": "Enregistrement...",
     "editorSettingsSaved": "Paramètres de l’éditeur enregistrés.",
     "customEmojis": "Émojis personnalisés",
-    "noEmojisYet": "Aucun émoji personnalisé pour le moment. Cliquez sur &quot;Ajouter un émoji&quot; pour en ajouter un.",
+    "noEmojisYet": "Aucun émoji personnalisé pour le moment. Cliquez sur \"Ajouter un émoji\" pour en ajouter un.",
     "enterAnyEmoji": "Saisissez un émoji ou utilisez le sélecteur (Windows : Win+. ; Mac : Ctrl+Cmd+Espace)",
     "sharingOverview": "Vue d’ensemble de l’activité de partage",
     "detailedSharingBreakdown": "Ce qui est partagé, et par qui",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "Ce qui a changé :",
     "migrationPartial": "Migration terminée avec des restes",
     "leftoversTitle": "Certains anciens fichiers ont été conservés",
-    "leftoversBody": "La migration n’a pas pu tout convertir, les anciens fichiers ci‑dessous sont donc restés intacts sur le disque. Rien n’a été supprimé. Vous pouvez corriger la cause et relancer la migration, ou entrer dans l’application maintenant et vous en occuper plus tard.",
+    "leftoversBody": "La migration n’a pas pu tout convertir, les anciens fichiers ci‑dessous sont donc restés intacts sur le disque. Vous pouvez corriger la cause et relancer la migration, ou entrer dans l’application maintenant et vous en occuper plus tard.",
     "overrideConfirmLabel": "Continuer quand même et ne plus afficher cette page.",
     "overrideConfirmHint": "Les fichiers restants restent sur le disque, mais l’application considérera vos données comme migrées. Le partage ou l’ordre listés ci‑dessus ne seront pas appliqués tant que vous n’aurez pas relancé la migration, ce que vous pouvez faire à tout moment depuis /migration?force=1.",
     "continueAnyway": "Continuer quand même",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "Indexation des relations...",
+    "indexingSearch": "Indexation de vos notes, la recherche sera prête dans un instant...",
     "unreachable": "inaccessible",
     "createFromWikilink": "Créer une note nommée « {title} »",
     "mentionedIn": "Mentionné dans",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Ajoutez d’abord une clé API.",
     "noKeyNeeded": "aucune clé API requise",
     "deprecated": "obsolète",
-    "requestFailed": "La requête n’a jamais atteint le serveur. Vérifiez votre connexion.",
+    "requestFailed": "Aucune réponse n’est revenue. Vérifiez votre connexion, et vérifiez si la modification a été appliquée avant de réessayer.",
     "responseMeta": "{status} en {ms} ms"
   }
 }
diff --git a/app/_translations/it.json b/app/_translations/it.json
index 143eb2345..cede62601 100644
--- a/app/_translations/it.json
+++ b/app/_translations/it.json
@@ -171,6 +171,7 @@
     "dismiss": "Ignora",
     "cleaning": "Pulizia...",
     "noResultsFound": "Nessun risultato",
+    "searching": "Ricerca in corso...",
     "noResults": "Nessun risultato",
     "by": "di {owner}",
     "unsavedChanges": "Modifiche non salvate",
@@ -809,6 +810,12 @@
     "handedness": "Manualità",
     "selectHandedness": "Seleziona manualità",
     "chooseHandedness": "Scegli se sei destrorso o mancino.",
+    "searchMode": "Ricerca",
+    "selectSearchMode": "Scegli come funziona la ricerca",
+    "searchModeSmart": "Migliori risultati prima, poi testo esatto",
+    "searchModeRanked": "Solo migliori risultati",
+    "searchModeSubstring": "Solo testo esatto",
+    "searchModeDescription": "Migliori risultati trova le parole in qualsiasi ordine e mette per primi gli elementi più pertinenti. Testo esatto cerca i caratteri esattamente come li hai scritti, in qualsiasi punto del file.",
     "rightHanded": "Destrorso",
     "leftHanded": "Mancino",
     "notesPreferences": "Preferenze Note",
@@ -1076,7 +1083,7 @@
     "saving": "Salvataggio...",
     "editorSettingsSaved": "Impostazioni editor salvate.",
     "customEmojis": "Emoji Personalizzate",
-    "noEmojisYet": "Nessuna emoji personalizzata. Clicca &quot;Aggiungi Emoji&quot; per aggiungerne una.",
+    "noEmojisYet": "Nessuna emoji personalizzata. Clicca \"Aggiungi Emoji\" per aggiungerne una.",
     "enterAnyEmoji": "Inserisci un'emoji o usa il selettore (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Panoramica Condivisioni",
     "detailedSharingBreakdown": "Cosa viene condiviso, e chi lo condivide",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "Cosa è cambiato:",
     "migrationPartial": "Migrazione terminata con file rimasti",
     "leftoversTitle": "Alcuni vecchi file sono stati tenuti",
-    "leftoversBody": "La migrazione non è riuscita a convertire tutto, quindi i vecchi file qui sotto sono rimasti sul disco intatti. Non è stato eliminato nulla. Puoi risolvere la causa e rilanciare la migrazione, oppure entrare nell'app ora e pensarci più tardi.",
+    "leftoversBody": "La migrazione non è riuscita a convertire tutto, quindi i vecchi file qui sotto sono rimasti sul disco intatti. Puoi risolvere la causa e rilanciare la migrazione, oppure entrare nell'app ora e pensarci più tardi.",
     "overrideConfirmLabel": "Continua comunque e non mostrare più questa pagina.",
     "overrideConfirmHint": "I file rimasti restano sul disco, ma l'app considererà i tuoi dati migrati. Condivisioni e ordinamenti elencati sopra non verranno applicati finché non migri di nuovo, cosa che puoi fare in qualsiasi momento da /migration?force=1.",
     "continueAnyway": "Continua comunque",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "Indicizzazione dei collegamenti...",
+    "indexingSearch": "Indicizzazione delle note in corso, la ricerca sarà pronta tra un attimo...",
     "unreachable": "non raggiungibile",
     "createFromWikilink": "Crea una nota chiamata \"{title}\"",
     "mentionedIn": "Menzionata in",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Aggiungi prima una API key.",
     "noKeyNeeded": "nessuna API key necessaria",
     "deprecated": "deprecato",
-    "requestFailed": "La richiesta non ha mai raggiunto il server. Controlla la connessione.",
+    "requestFailed": "Non è arrivata nessuna risposta. Controlla la connessione e verifica se la modifica è andata a buon fine prima di riprovare.",
     "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/klingon.json b/app/_translations/klingon.json
index b8bb561e9..a49f3f3ce 100644
--- a/app/_translations/klingon.json
+++ b/app/_translations/klingon.json
@@ -171,6 +171,7 @@
     "dismiss": "yImej",
     "cleaning": "Say'moHlI'...",
     "noResultsFound": "pagh tu'lu'",
+    "searching": "nejtaH...",
     "noResults": "pagh tu'lu'",
     "by": "{owner} ghaH",
     "unsavedChanges": "choHmey Polbe'lu'",
@@ -556,7 +557,7 @@
     "failedToEdit": "QIch DIj choH laHbe'",
     "failedToDelete": "QIch DIj Qaw' laHbe'",
     "failedToLoad": "QIch DIj tu' laHbe'",
-    "readOnly": "DIj Qab DIj laH. DIj DIj Qab DIj.",
+    "readOnly": "QInvaD ghItlhmeH choHmeH chaw' DapoQ.",
     "replyTo": "{author} jang",
     "noUsersFound": "tlhInganpu' tu'lu'be'"
   },
@@ -809,6 +810,12 @@
     "handedness": "ghop",
     "selectHandedness": "ghop yIwIv",
     "chooseHandedness": "nIH pagh poS.",
+    "searchMode": "nej",
+    "selectSearchMode": "nejmeH mIw yIwIv",
+    "searchModeSmart": "QaQ Dop wa'DIch, ghIq ghItlh qar",
+    "searchModeRanked": "QaQ Dop neH",
+    "searchModeSubstring": "ghItlh qar neH",
+    "searchModeDescription": "QaQ Dop mu'mey tu' mIw Hoch Daq 'ej Doch potlh law' cha' wa'DIch. ghItlh qar ngutlhmey Dagheppu'bogh nej, teywI' Daq Hoch.",
     "rightHanded": "nIH",
     "leftHanded": "poS",
     "notesPreferences": "ghItlh maS",
@@ -1076,7 +1083,7 @@
     "saving": "Pol'lI'...",
     "editorSettingsSaved": "choHwI' SeH Pol Qapla'.",
     "customEmojis": "Emoji TIgh",
-    "noEmojisYet": "Custom emojis tu'be'lu'. &quot;Emoji yIchel&quot; yIwIv.",
+    "noEmojisYet": "Custom emojis tu'be'lu'. \"Emoji yIchel\" yIwIv.",
     "enterAnyEmoji": "Emoji yIghItlh pagh emoji wIvwI' yIlo' (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "ghom ghu'",
     "detailedSharingBreakdown": "ghom ghu' Del",
@@ -1617,7 +1624,7 @@
     "sharingTravelsBody": "Hoch Doch ngeHlu'bogh frontmatterDaq nuvpu' ngeHlu'bogh qon, vaj DavIHDI' pagh pong DachoHDI' ngeH ghorbe'.",
     "folderSharingTitle": "qach ngeH",
     "folderSharingBody": "qach DangeHchugh, Hoch Doch naDevbogh, DaH je leSpoH, ngeHlu' je. sidebarchajDaq qach motlh legh nuvpu' HevwI'.",
-    "oneFilePerFolderTitle": "Hoch qachvaD wa' De'wI'",
+    "oneFilePerFolderTitle": "Hoch qachvaD wa' teywI'",
     "oneFilePerFolderBody": "<code>.category-info.json</code>Daq <code>.order.json</code> muvlu', 'ej uuid lo' ra', pong ghobe'.",
     "permissionsUnchangedTitle": "chaw'mey choHbe'",
     "permissionsUnchangedBody": "laD, choH, Qaw' je DaH rurmo' choHbe', Hoch lo'wI' Hoch Doch je.",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "nuq choHlu'pu'?",
     "migrationPartial": "choH rIn, 'ach De'wI' ratlh",
     "leftoversTitle": "De'wI' tlhIngmey 'op ratlh",
-    "leftoversBody": "Hoch mughlaHbe' choH, vaj De'wI' tlhIngmey bIngDaq ratlh, Hotbe'lu'. Pagh Qaw'lu'. meq yItI' 'ej choH yItaghqa', pagh DaH De'wI' yI'el 'ej ghIq yIvang.",
+    "leftoversBody": "Hoch mughlaHbe' choH, vaj De'wI' tlhIngmey bIngDaq ratlh, Hotbe'lu'. meq yItI' 'ej choH yItaghqa', pagh DaH De'wI' yI'el 'ej ghIq yIvang.",
     "overrideConfirmLabel": "yIruch 'ej naDev Hablu'be'jaj.",
     "overrideConfirmHint": "De'wI' ratlhbogh Qaw'be'lu', 'ach choH rIn 'e' Hoch De'wI' Qub. naDev ngeH ra' je Dalo'be'taHvIS choHqa'. /migration?force=1 Dalo'DI' reH choHqa'laH.",
     "continueAnyway": "yIruch",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "rarmey tetlh chenmoHlI'...",
+    "indexingSearch": "ghItlhmeylIj nIqHom, tugh nej laH...",
     "unreachable": "ghoSlaHbe'",
     "createFromWikilink": "\"{title}\" ghItlh yIchenmoH",
     "mentionedIn": "Daq pong",
@@ -1870,7 +1878,7 @@
     "keyRequired": "wa'DIch API ngoq yIchel.",
     "noKeyNeeded": "API ngoq poQbe'",
     "deprecated": "ngo'",
-    "requestFailed": "server ghoSbe' tlhob. rarlIj yInuD.",
+    "requestFailed": "jang pagh chegh. rarwIj yInuD, 'ej choH chu'lu'pu''a' yInuD, ghIq yInIDqa'.",
     "responseMeta": "{status}, {ms} ms"
   }
 }
diff --git a/app/_translations/ko.json b/app/_translations/ko.json
index 4775ba17e..85c6f4eb1 100644
--- a/app/_translations/ko.json
+++ b/app/_translations/ko.json
@@ -171,6 +171,7 @@
     "dismiss": "닫기",
     "cleaning": "정리 중...",
     "noResultsFound": "결과를 찾을 수 없습니다",
+    "searching": "검색 중...",
     "noResults": "결과 없음",
     "by": "작성 {owner}",
     "unsavedChanges": "저장되지 않은 변경 사항",
@@ -809,6 +810,12 @@
     "handedness": "주 사용 손",
     "selectHandedness": "주 사용 손 선택",
     "chooseHandedness": "오른손잡이 또는 왼손잡이를 선택하세요.",
+    "searchMode": "검색",
+    "selectSearchMode": "검색 방식 선택",
+    "searchModeSmart": "가장 관련 있는 결과 먼저, 그다음 정확한 텍스트",
+    "searchModeRanked": "가장 관련 있는 결과만",
+    "searchModeSubstring": "정확한 텍스트만",
+    "searchModeDescription": "가장 관련 있는 결과는 단어를 순서에 관계없이 찾고 가장 관련 있는 항목을 먼저 보여 줍니다. 정확한 텍스트는 입력한 그대로의 문자를 파일 어디에서나 찾습니다.",
     "rightHanded": "오른손잡이",
     "leftHanded": "왼손잡이",
     "notesPreferences": "노트 설정",
@@ -1076,7 +1083,7 @@
     "saving": "저장 중...",
     "editorSettingsSaved": "에디터 설정이 저장되었습니다.",
     "customEmojis": "사용자 지정 이모지",
-    "noEmojisYet": "아직 사용자 지정 이모지가 없습니다. &quot;이모지 추가&quot;를 클릭해 추가하세요.",
+    "noEmojisYet": "아직 사용자 지정 이모지가 없습니다. \"이모지 추가\"를 클릭해 추가하세요.",
     "enterAnyEmoji": "이모지를 입력하거나 이모지 선택기를 사용하세요 (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "공유 활동 개요",
     "detailedSharingBreakdown": "무엇이 공유되고 누가 공유하는지",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "변경된 내용:",
     "migrationPartial": "마이그레이션이 남은 파일과 함께 끝났습니다",
     "leftoversTitle": "일부 예전 파일이 남아 있습니다",
-    "leftoversBody": "마이그레이션이 모든 것을 변환하지 못해 아래의 예전 파일을 디스크에 그대로 두었습니다. 삭제된 것은 없습니다. 원인을 고친 뒤 마이그레이션을 다시 실행하거나, 지금 앱으로 들어가서 나중에 처리해도 됩니다.",
+    "leftoversBody": "마이그레이션이 모든 것을 변환하지 못해 아래의 예전 파일을 디스크에 그대로 두었습니다. 원인을 고친 뒤 마이그레이션을 다시 실행하거나, 지금 앱으로 들어가서 나중에 처리해도 됩니다.",
     "overrideConfirmLabel": "그래도 계속하고 이 페이지를 더 이상 표시하지 않기.",
     "overrideConfirmHint": "남은 파일은 디스크에 그대로 있지만, 앱은 데이터를 마이그레이션된 것으로 취급합니다. 위에 나온 공유나 정렬은 다시 마이그레이션할 때까지 적용되지 않으며, 다시 마이그레이션은 언제든 /migration?force=1에서 할 수 있습니다.",
     "continueAnyway": "그래도 계속",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "연결 관계 인덱싱 중...",
+    "indexingSearch": "노트를 색인하는 중입니다. 곧 검색할 수 있습니다...",
     "unreachable": "접근할 수 없음",
     "createFromWikilink": "\"{title}\" 노트 만들기",
     "mentionedIn": "언급된 곳",
@@ -1870,7 +1878,7 @@
     "keyRequired": "먼저 API 키를 추가하세요.",
     "noKeyNeeded": "API 키 필요 없음",
     "deprecated": "사용 중단됨",
-    "requestFailed": "요청이 서버에 닿지 못했습니다. 연결을 확인하세요.",
+    "requestFailed": "응답을 받지 못했습니다. 연결을 확인하고, 다시 시도하기 전에 변경 사항이 적용되었는지 확인하세요.",
     "responseMeta": "{status}, {ms} ms"
   }
 }
diff --git a/app/_translations/nl.json b/app/_translations/nl.json
index 416b9c41d..15ceb4ae9 100644
--- a/app/_translations/nl.json
+++ b/app/_translations/nl.json
@@ -171,6 +171,7 @@
     "dismiss": "Sluiten",
     "cleaning": "Opruimen...",
     "noResultsFound": "Geen resultaten gevonden",
+    "searching": "Zoeken...",
     "noResults": "Geen resultaten",
     "by": "door {owner}",
     "unsavedChanges": "Niet-opgeslagen wijzigingen",
@@ -809,6 +810,12 @@
     "handedness": "Handigheid",
     "selectHandedness": "Selecteer handigheid",
     "chooseHandedness": "Kies of u rechts- of linkshandig bent.",
+    "searchMode": "Zoeken",
+    "selectSearchMode": "Kies hoe zoeken werkt",
+    "searchModeSmart": "Beste resultaten eerst, daarna exacte tekst",
+    "searchModeRanked": "Alleen beste resultaten",
+    "searchModeSubstring": "Alleen exacte tekst",
+    "searchModeDescription": "Beste resultaten vindt de woorden in elke volgorde en zet de meest relevante items bovenaan. Exacte tekst zoekt de tekens precies zoals je ze typte, overal in het bestand.",
     "rightHanded": "Rechtshandig",
     "leftHanded": "Linkshandig",
     "notesPreferences": "Notitievoorkeuren",
@@ -1076,7 +1083,7 @@
     "saving": "Opslaan...",
     "editorSettingsSaved": "Editor-instellingen opgeslagen.",
     "customEmojis": "Aangepaste emoji's",
-    "noEmojisYet": "Nog geen aangepaste emoji's. Klik op &quot;Emoji toevoegen&quot; om er een toe te voegen.",
+    "noEmojisYet": "Nog geen aangepaste emoji's. Klik op \"Emoji toevoegen\" om er een toe te voegen.",
     "enterAnyEmoji": "Voer een emoji in of gebruik de emojikiezer (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Overzicht deelactiviteit",
     "detailedSharingBreakdown": "Wat er gedeeld wordt, en wie het deelt",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "Wat er is veranderd:",
     "migrationPartial": "Migratie klaar met restanten",
     "leftoversTitle": "Sommige oude bestanden zijn bewaard",
-    "leftoversBody": "De migratie kon niet alles omzetten, dus de oude bestanden hieronder staan onaangeroerd op de schijf. Er is niets verwijderd. Je kunt de oorzaak oplossen en de migratie opnieuw draaien, of nu doorgaan naar de app en het later regelen.",
+    "leftoversBody": "De migratie kon niet alles omzetten, dus de oude bestanden hieronder staan onaangeroerd op de schijf. Je kunt de oorzaak oplossen en de migratie opnieuw draaien, of nu doorgaan naar de app en het later regelen.",
     "overrideConfirmLabel": "Toch doorgaan en deze pagina niet meer tonen.",
     "overrideConfirmHint": "De overgebleven bestanden blijven op de schijf, maar de app behandelt je gegevens als gemigreerd. Delen of volgorde die hierboven staan, worden pas toegepast als je opnieuw migreert. Dat kan altijd via /migration?force=1.",
     "continueAnyway": "Toch doorgaan",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "Relaties indexeren...",
+    "indexingSearch": "Je notities worden geïndexeerd, zoeken is zo klaar...",
     "unreachable": "niet bereikbaar",
     "createFromWikilink": "Maak een notitie met de naam \"{title}\"",
     "mentionedIn": "Genoemd in",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Voeg eerst een API-sleutel toe.",
     "noKeyNeeded": "geen API-sleutel nodig",
     "deprecated": "verouderd",
-    "requestFailed": "Het verzoek heeft de server nooit bereikt. Controleer je verbinding.",
+    "requestFailed": "Er kwam geen antwoord terug. Controleer je verbinding en kijk of de wijziging is doorgevoerd voordat je het opnieuw probeert.",
     "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/pirate.json b/app/_translations/pirate.json
index 3069ae4cf..b5777d22b 100644
--- a/app/_translations/pirate.json
+++ b/app/_translations/pirate.json
@@ -171,6 +171,7 @@
     "dismiss": "Begone",
     "cleaning": "Swabbing the deck...",
     "noResultsFound": "Found nary a thing",
+    "searching": "Scannin' the horizon...",
     "noResults": "Empty Horizon",
     "by": "by {owner}",
     "unsavedChanges": "Loose Cargo",
@@ -809,6 +810,12 @@
     "handedness": "Hook Hand",
     "selectHandedness": "Pick hand",
     "chooseHandedness": "Left hook or right hook?",
+    "searchMode": "Search",
+    "selectSearchMode": "Pick how the lookout searches",
+    "searchModeSmart": "Best finds first, then the exact words",
+    "searchModeRanked": "Best finds only",
+    "searchModeSubstring": "Exact words only",
+    "searchModeDescription": "Best finds spots yer words in any order an' hauls the most useful ones up first. Exact words hunts fer the letters just as ye typed 'em, anywhere in the file.",
     "rightHanded": "Right-hooked",
     "leftHanded": "Left-hooked",
     "notesPreferences": "Log Preferences",
@@ -1076,7 +1083,7 @@
     "saving": "Stowing...",
     "editorSettingsSaved": "Quill settings stowed.",
     "customEmojis": "Custom Runes",
-    "noEmojisYet": "No runes yet. Click &quot;Add Emoji&quot; to carve one.",
+    "noEmojisYet": "No runes yet. Click \"Add Emoji\" to carve one.",
     "enterAnyEmoji": "Enter rune or use the emoji picker (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Divvying Overview",
     "detailedSharingBreakdown": "Who's sharing what",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "What got changed:",
     "migrationPartial": "Refit Finished With Leftover Cargo",
     "leftoversTitle": "Some old files were kept aboard",
-    "leftoversBody": "The refit couldn't translate everythin', so the old files below were left on disk untouched. Nothin' has been scuttled. Fix the cause and run the refit again, or head back to the deck now and deal with it later.",
+    "leftoversBody": "The refit couldn't translate everythin', so the old files below were left on disk untouched. Fix the cause and run the refit again, or head back to the deck now and deal with it later.",
     "overrideConfirmLabel": "Sail on anyway and stop showin' this page.",
     "overrideConfirmHint": "The leftover files stay on disk, but the ship will treat yer data as moved. Any sharin' or orderin' listed above won't apply until ye refit again, which ye can do any time from /migration?force=1.",
     "continueAnyway": "Sail On Anyway",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "Chartin' the connections...",
+    "indexingSearch": "Chartin' yer scrolls, the lookout will be ready in a moment...",
     "unreachable": "out o' reach",
     "createFromWikilink": "Scribe a log called \"{title}\"",
     "mentionedIn": "Spoken of in",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Add an API key first.",
     "noKeyNeeded": "no API key needed",
     "deprecated": "deprecated",
-    "requestFailed": "The request never reached the ship. Check yer connection.",
+    "requestFailed": "No word came back. Check yer connection, an' check whether the change made it aboard before ye try again.",
     "responseMeta": "{status} in {ms} ms"
   }
 }
diff --git a/app/_translations/pl.json b/app/_translations/pl.json
index e30a7246e..22b34473e 100644
--- a/app/_translations/pl.json
+++ b/app/_translations/pl.json
@@ -171,6 +171,7 @@
     "dismiss": "Odrzuć",
     "cleaning": "Czyszczenie…",
     "noResultsFound": "Nie znaleziono wyników",
+    "searching": "Szukam...",
     "noResults": "Brak wyników",
     "by": "przez {owner}",
     "unsavedChanges": "Niezapisane zmiany",
@@ -809,6 +810,12 @@
     "handedness": "Ręczność",
     "selectHandedness": "Wybierz ręczność",
     "chooseHandedness": "Wybierz, czy jesteś praworęczny czy leworęczny.",
+    "searchMode": "Wyszukiwanie",
+    "selectSearchMode": "Wybierz, jak działa wyszukiwanie",
+    "searchModeSmart": "Najlepsze trafienia najpierw, potem dokładny tekst",
+    "searchModeRanked": "Tylko najlepsze trafienia",
+    "searchModeSubstring": "Tylko dokładny tekst",
+    "searchModeDescription": "Najlepsze trafienia znajdują słowa w dowolnej kolejności i pokazują najpierw najtrafniejsze elementy. Dokładny tekst szuka znaków dokładnie tak, jak je wpisano, w dowolnym miejscu pliku.",
     "rightHanded": "Praworęczny",
     "leftHanded": "Leworęczny",
     "notesPreferences": "Ustawienia notatek",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "Co się zmieniło:",
     "migrationPartial": "Migracja zakończona z pozostałościami",
     "leftoversTitle": "Część starych plików została zachowana",
-    "leftoversBody": "Migracja nie przeniosła wszystkiego, więc poniższe stare pliki zostały na dysku nietknięte. Nic nie zostało usunięte. Możesz naprawić przyczynę i uruchomić migrację ponownie albo przejść teraz do aplikacji i zająć się tym później.",
+    "leftoversBody": "Migracja nie przeniosła wszystkiego, więc poniższe stare pliki zostały na dysku nietknięte. Możesz naprawić przyczynę i uruchomić migrację ponownie albo przejść teraz do aplikacji i zająć się tym później.",
     "overrideConfirmLabel": "Kontynuuj mimo to i nie pokazuj więcej tej strony.",
     "overrideConfirmHint": "Pozostałe pliki zostaną na dysku, ale aplikacja uzna Twoje dane za zmigrowane. Udostępnianie i kolejność wymienione powyżej nie zostaną zastosowane, dopóki nie uruchomisz migracji ponownie, co możesz zrobić w dowolnej chwili pod /migration?force=1.",
     "continueAnyway": "Kontynuuj mimo to",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "Indeksowanie powiązań...",
+    "indexingSearch": "Indeksuję Twoje notatki, wyszukiwanie będzie gotowe za chwilę...",
     "unreachable": "niedostępne",
     "createFromWikilink": "Utwórz notatkę o nazwie \"{title}\"",
     "mentionedIn": "Wspomniane w",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Najpierw dodaj klucz API.",
     "noKeyNeeded": "klucz API niepotrzebny",
     "deprecated": "przestarzałe",
-    "requestFailed": "Żądanie nie dotarło do serwera. Sprawdź połączenie.",
+    "requestFailed": "Nie przyszła żadna odpowiedź. Sprawdź połączenie i to, czy zmiana została zapisana, zanim spróbujesz ponownie.",
     "responseMeta": "{status} w {ms} ms"
   }
 }
diff --git a/app/_translations/pt.json b/app/_translations/pt.json
index df07ae5c2..6a966d724 100644
--- a/app/_translations/pt.json
+++ b/app/_translations/pt.json
@@ -171,6 +171,7 @@
     "dismiss": "Dispensar",
     "cleaning": "A limpar...",
     "noResultsFound": "Nenhum resultado encontrado",
+    "searching": "A pesquisar...",
     "noResults": "Sem resultados",
     "by": "por {owner}",
     "unsavedChanges": "Alterações não guardadas",
@@ -809,6 +810,12 @@
     "handedness": "Mão dominante",
     "selectHandedness": "Selecionar mão dominante",
     "chooseHandedness": "Escolha se é destro ou esquerdino.",
+    "searchMode": "Pesquisa",
+    "selectSearchMode": "Escolha como funciona a pesquisa",
+    "searchModeSmart": "Melhores resultados primeiro, depois texto exato",
+    "searchModeRanked": "Apenas melhores resultados",
+    "searchModeSubstring": "Apenas texto exato",
+    "searchModeDescription": "Melhores resultados encontra as palavras em qualquer ordem e mostra primeiro os itens mais relevantes. Texto exato procura os caracteres exatamente como os escreveu, em qualquer parte do ficheiro.",
     "rightHanded": "Destro",
     "leftHanded": "Esquerdino",
     "notesPreferences": "Preferências de notas",
@@ -1076,7 +1083,7 @@
     "saving": "A guardar...",
     "editorSettingsSaved": "Definições do editor guardadas.",
     "customEmojis": "Emojis personalizados",
-    "noEmojisYet": "Ainda não há emojis personalizados. Clique em &quot;Adicionar emoji&quot; para adicionar um.",
+    "noEmojisYet": "Ainda não há emojis personalizados. Clique em \"Adicionar emoji\" para adicionar um.",
     "enterAnyEmoji": "Introduza qualquer emoji ou use o seletor de emoji (Windows: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Visão geral da atividade de partilha",
     "detailedSharingBreakdown": "O que é partilhado, e quem o partilha",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "O que mudou:",
     "migrationPartial": "Migração concluída com restos",
     "leftoversTitle": "Alguns ficheiros antigos foram mantidos",
-    "leftoversBody": "A migração não conseguiu converter tudo, por isso os ficheiros antigos abaixo ficaram no disco intactos. Nada foi eliminado. Pode resolver a causa e voltar a correr a migração, ou entrar já na aplicação e tratar disso mais tarde.",
+    "leftoversBody": "A migração não conseguiu converter tudo, por isso os ficheiros antigos abaixo ficaram no disco intactos. Pode resolver a causa e voltar a correr a migração, ou entrar já na aplicação e tratar disso mais tarde.",
     "overrideConfirmLabel": "Continuar mesmo assim e deixar de mostrar esta página.",
     "overrideConfirmHint": "Os ficheiros restantes ficam no disco, mas a aplicação vai tratar os seus dados como migrados. As partilhas e ordenações listadas acima só serão aplicadas quando migrar de novo, o que pode fazer a qualquer momento em /migration?force=1.",
     "continueAnyway": "Continuar mesmo assim",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "A indexar ligações...",
+    "indexingSearch": "A indexar as suas notas, a pesquisa estará pronta dentro de momentos...",
     "unreachable": "inacessível",
     "createFromWikilink": "Criar uma nota chamada \"{title}\"",
     "mentionedIn": "Mencionada em",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Adicione primeiro uma chave API.",
     "noKeyNeeded": "não precisa de chave API",
     "deprecated": "obsoleto",
-    "requestFailed": "O pedido nunca chegou ao servidor. Verifique a sua ligação.",
+    "requestFailed": "Não chegou nenhuma resposta. Verifique a ligação e confirme se a alteração foi aplicada antes de tentar novamente.",
     "responseMeta": "{status} em {ms} ms"
   }
 }
diff --git a/app/_translations/ru.json b/app/_translations/ru.json
index 6a234d3c6..92753b08d 100644
--- a/app/_translations/ru.json
+++ b/app/_translations/ru.json
@@ -171,6 +171,7 @@
     "dismiss": "Закрыть",
     "cleaning": "Очистка...",
     "noResultsFound": "Результаты не найдены",
+    "searching": "Поиск...",
     "noResults": "Нет результатов",
     "by": "от {owner}",
     "unsavedChanges": "Несохранённые изменения",
@@ -809,6 +810,12 @@
     "handedness": "Рабочая рука",
     "selectHandedness": "Выберите рабочую руку",
     "chooseHandedness": "Выберите, правша вы или левша.",
+    "searchMode": "Поиск",
+    "selectSearchMode": "Выберите, как работает поиск",
+    "searchModeSmart": "Сначала лучшие совпадения, затем точный текст",
+    "searchModeRanked": "Только лучшие совпадения",
+    "searchModeSubstring": "Только точный текст",
+    "searchModeDescription": "Лучшие совпадения находят слова в любом порядке и показывают самые подходящие элементы первыми. Точный текст ищет символы ровно так, как вы их ввели, в любом месте файла.",
     "rightHanded": "Правша",
     "leftHanded": "Левша",
     "notesPreferences": "Настройки заметок",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "Что изменилось:",
     "migrationPartial": "Миграция завершена, но остались файлы",
     "leftoversTitle": "Часть старых файлов сохранена",
-    "leftoversBody": "Миграция не смогла перенести всё, поэтому старые файлы ниже остались на диске нетронутыми. Ничего не удалено. Можно устранить причину и запустить миграцию снова или перейти в приложение сейчас и разобраться позже.",
+    "leftoversBody": "Миграция не смогла перенести всё, поэтому старые файлы ниже остались на диске нетронутыми. Можно устранить причину и запустить миграцию снова или перейти в приложение сейчас и разобраться позже.",
     "overrideConfirmLabel": "Всё равно продолжить и больше не показывать эту страницу.",
     "overrideConfirmHint": "Оставшиеся файлы останутся на диске, но приложение будет считать ваши данные перенесёнными. Доступ и порядок из списка выше не применятся, пока вы не запустите миграцию снова. Это можно сделать в любой момент по адресу /migration?force=1.",
     "continueAnyway": "Всё равно продолжить",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "Индексация связей...",
+    "indexingSearch": "Индексируем ваши заметки, поиск скоро будет готов...",
     "unreachable": "недоступно",
     "createFromWikilink": "Создать заметку «{title}»",
     "mentionedIn": "Упоминается в",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Сначала добавьте API-ключ.",
     "noKeyNeeded": "API-ключ не нужен",
     "deprecated": "устарело",
-    "requestFailed": "Запрос не дошёл до сервера. Проверьте соединение.",
+    "requestFailed": "Ответ не пришёл. Проверьте подключение и убедитесь, что изменение применилось, прежде чем повторять попытку.",
     "responseMeta": "{status} за {ms} мс"
   }
 }
diff --git a/app/_translations/tr.json b/app/_translations/tr.json
index 651e06803..955e97274 100644
--- a/app/_translations/tr.json
+++ b/app/_translations/tr.json
@@ -171,6 +171,7 @@
     "dismiss": "Kapat",
     "cleaning": "Temizleniyor...",
     "noResultsFound": "Sonuç bulunamadı",
+    "searching": "Aranıyor...",
     "noResults": "Sonuç yok",
     "by": "{owner} tarafından",
     "unsavedChanges": "Kaydedilmemiş Değişiklikler",
@@ -809,6 +810,12 @@
     "handedness": "El Kullanımı",
     "selectHandedness": "Kullanım yönünü seçin",
     "chooseHandedness": "Sağlak mı yoksa solak mı olduğunuzu seçin.",
+    "searchMode": "Arama",
+    "selectSearchMode": "Aramanın nasıl çalışacağını seçin",
+    "searchModeSmart": "Önce en iyi eşleşmeler, sonra tam metin",
+    "searchModeRanked": "Yalnızca en iyi eşleşmeler",
+    "searchModeSubstring": "Yalnızca tam metin",
+    "searchModeDescription": "En iyi eşleşmeler kelimeleri herhangi bir sırada bulur ve en ilgili öğeleri önce gösterir. Tam metin, karakterleri dosyanın herhangi bir yerinde tam olarak yazdığınız gibi arar.",
     "rightHanded": "Sağlak",
     "leftHanded": "Solak",
     "notesPreferences": "Not Tercihleri",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "Neler değişti:",
     "migrationPartial": "Taşıma Artıklarla Tamamlandı",
     "leftoversTitle": "Bazı eski dosyalar bırakıldı",
-    "leftoversBody": "Taşıma her şeyi aktaramadı, bu yüzden aşağıdaki eski dosyalar diskte olduğu gibi bırakıldı. Hiçbir şey silinmedi. Sorunu düzeltip taşımayı tekrar çalıştırabilir ya da şimdi uygulamaya geçip bununla sonra ilgilenebilirsiniz.",
+    "leftoversBody": "Taşıma her şeyi aktaramadı, bu yüzden aşağıdaki eski dosyalar diskte olduğu gibi bırakıldı. Sorunu düzeltip taşımayı tekrar çalıştırabilir ya da şimdi uygulamaya geçip bununla sonra ilgilenebilirsiniz.",
     "overrideConfirmLabel": "Yine de devam et ve bu sayfayı bir daha gösterme.",
     "overrideConfirmHint": "Artık dosyalar diskte kalır ama uygulama verilerinizi taşınmış sayar. Yukarıda listelenen paylaşım veya sıralama, taşımayı tekrar çalıştırana kadar uygulanmaz. Bunu istediğiniz zaman /migration?force=1 adresinden yapabilirsiniz.",
     "continueAnyway": "Yine de Devam Et",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "İlişkiler indeksleniyor...",
+    "indexingSearch": "Notlarınız dizinleniyor, arama birazdan hazır olacak...",
     "unreachable": "erişilemiyor",
     "createFromWikilink": "\"{title}\" adında bir not oluştur",
     "mentionedIn": "Şurada geçiyor",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Önce bir API anahtarı ekleyin.",
     "noKeyNeeded": "API anahtarı gerekmez",
     "deprecated": "kullanımdan kalktı",
-    "requestFailed": "İstek sunucuya hiç ulaşmadı. Bağlantınızı kontrol edin.",
+    "requestFailed": "Yanıt alınamadı. Bağlantınızı kontrol edin ve tekrar denemeden önce değişikliğin uygulanıp uygulanmadığına bakın.",
     "responseMeta": "{status}, {ms} ms"
   }
 }
diff --git a/app/_translations/vi.json b/app/_translations/vi.json
index e0d5964bd..f0d44266a 100644
--- a/app/_translations/vi.json
+++ b/app/_translations/vi.json
@@ -171,6 +171,7 @@
     "dismiss": "Loại bỏ",
     "cleaning": "Làm sạch...",
     "noResultsFound": "Không tìm thấy kết quả nào",
+    "searching": "Đang tìm...",
     "noResults": "Không có kết quả",
     "by": "bởi {owner}",
     "unsavedChanges": "Những thay đổi chưa được lưu",
@@ -809,6 +810,12 @@
     "handedness": "thuận tay",
     "selectHandedness": "Chọn thuận tay",
     "chooseHandedness": "Chọn xem bạn thuận tay phải hay tay trái.",
+    "searchMode": "Tìm kiếm",
+    "selectSearchMode": "Chọn cách tìm kiếm hoạt động",
+    "searchModeSmart": "Kết quả phù hợp nhất trước, sau đó văn bản chính xác",
+    "searchModeRanked": "Chỉ kết quả phù hợp nhất",
+    "searchModeSubstring": "Chỉ văn bản chính xác",
+    "searchModeDescription": "Kết quả phù hợp nhất tìm các từ theo bất kỳ thứ tự nào và đưa các mục liên quan nhất lên đầu. Văn bản chính xác tìm đúng các ký tự bạn đã gõ, ở bất kỳ đâu trong tệp.",
     "rightHanded": "Thuận tay phải",
     "leftHanded": "thuận tay trái",
     "notesPreferences": "Tùy chọn ghi chú",
@@ -1076,7 +1083,7 @@
     "saving": "Đang lưu...",
     "editorSettingsSaved": "Đã lưu cài đặt trình chỉnh sửa.",
     "customEmojis": "Cá nhân hóa biểu tượng cảm xúc",
-    "noEmojisYet": "Chưa có biểu tượng cảm xúc tùy chỉnh. Nhấp vào &quot;Thêm biểu tượng cảm xúc&quot; để thêm một cái.",
+    "noEmojisYet": "Chưa có biểu tượng cảm xúc tùy chỉnh. Nhấp vào \"Thêm biểu tượng cảm xúc\" để thêm một cái.",
     "enterAnyEmoji": "Nhập bất kỳ biểu tượng cảm xúc nào hoặc dùng bộ chọn biểu tượng cảm xúc (Win: Win+.; Mac: Ctrl+Cmd+Space)",
     "sharingOverview": "Tổng quan về hoạt động chia sẻ",
     "detailedSharingBreakdown": "Những gì được chia sẻ, và ai chia sẻ",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "Những gì đã thay đổi:",
     "migrationPartial": "Di chuyển xong nhưng còn sót tệp",
     "leftoversTitle": "Một số tệp cũ được giữ lại",
-    "leftoversBody": "Việc di chuyển không chuyển được hết, nên các tệp cũ bên dưới được để nguyên trên đĩa. Không có gì bị xóa. Bạn có thể sửa nguyên nhân rồi chạy lại, hoặc vào ứng dụng ngay và xử lý sau.",
+    "leftoversBody": "Việc di chuyển không chuyển được hết, nên các tệp cũ bên dưới được để nguyên trên đĩa. Bạn có thể sửa nguyên nhân rồi chạy lại, hoặc vào ứng dụng ngay và xử lý sau.",
     "overrideConfirmLabel": "Vẫn tiếp tục và không hiện trang này nữa.",
     "overrideConfirmHint": "Các tệp còn sót vẫn nằm trên đĩa, nhưng ứng dụng sẽ coi dữ liệu của bạn là đã di chuyển. Chia sẻ hoặc thứ tự liệt kê ở trên sẽ không được áp dụng cho đến khi bạn di chuyển lại, việc này bạn có thể làm bất cứ lúc nào từ /migration?force=1.",
     "continueAnyway": "Vẫn tiếp tục",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "Đang lập chỉ mục liên kết...",
+    "indexingSearch": "Đang lập chỉ mục ghi chú của bạn, tìm kiếm sẽ sẵn sàng ngay...",
     "unreachable": "không truy cập được",
     "createFromWikilink": "Tạo ghi chú tên \"{title}\"",
     "mentionedIn": "Được nhắc đến trong",
@@ -1870,7 +1878,7 @@
     "keyRequired": "Hãy thêm khóa API trước.",
     "noKeyNeeded": "không cần khóa API",
     "deprecated": "không còn dùng",
-    "requestFailed": "Yêu cầu không đến được máy chủ. Hãy kiểm tra kết nối.",
+    "requestFailed": "Không nhận được phản hồi. Hãy kiểm tra kết nối và xem thay đổi đã được áp dụng chưa trước khi thử lại.",
     "responseMeta": "{status} trong {ms} ms"
   }
 }
diff --git a/app/_translations/zh.json b/app/_translations/zh.json
index 157f1dacb..f4d78fbe1 100644
--- a/app/_translations/zh.json
+++ b/app/_translations/zh.json
@@ -171,6 +171,7 @@
     "dismiss": "忽略",
     "cleaning": "清理中...",
     "noResultsFound": "未找到结果",
+    "searching": "搜索中...",
     "noResults": "无结果",
     "by": "作者 {owner}",
     "unsavedChanges": "未保存的更改",
@@ -809,6 +810,12 @@
     "handedness": "惯用手",
     "selectHandedness": "选择惯用手",
     "chooseHandedness": "选择您是右撇子还是左撇子。",
+    "searchMode": "搜索",
+    "selectSearchMode": "选择搜索方式",
+    "searchModeSmart": "最佳匹配优先，然后是精确文本",
+    "searchModeRanked": "仅最佳匹配",
+    "searchModeSubstring": "仅精确文本",
+    "searchModeDescription": "最佳匹配会按任意顺序查找这些词，并把最相关的项目排在前面。精确文本会在文件中的任何位置查找与您输入完全相同的字符。",
     "rightHanded": "右撇子",
     "leftHanded": "左撇子",
     "notesPreferences": "笔记偏好",
@@ -1628,7 +1635,7 @@
     "whatWasChanged": "变更内容：",
     "migrationPartial": "迁移完成，但有遗留文件",
     "leftoversTitle": "部分旧文件被保留",
-    "leftoversBody": "迁移无法转换全部内容，因此下列旧文件原样保留在磁盘上。没有删除任何东西。您可以修复原因后重新运行迁移，也可以现在进入应用，以后再处理。",
+    "leftoversBody": "迁移无法转换全部内容，因此下列旧文件原样保留在磁盘上。您可以修复原因后重新运行迁移，也可以现在进入应用，以后再处理。",
     "overrideConfirmLabel": "仍然继续，并不再显示此页面。",
     "overrideConfirmHint": "遗留文件会保留在磁盘上，但应用会把您的数据视为已迁移。上面列出的共享或排序在重新迁移前不会生效，您随时可以在 /migration?force=1 重新迁移。",
     "continueAnyway": "仍然继续",
@@ -1787,6 +1794,7 @@
   },
   "relations": {
     "indexing": "正在索引关联...",
+    "indexingSearch": "正在为您的笔记建立索引，搜索马上就好...",
     "unreachable": "无法访问",
     "createFromWikilink": "创建名为 \"{title}\" 的笔记",
     "mentionedIn": "被提及于",
@@ -1870,7 +1878,7 @@
     "keyRequired": "请先添加 API 密钥。",
     "noKeyNeeded": "无需 API 密钥",
     "deprecated": "已弃用",
-    "requestFailed": "请求没有到达服务器。请检查网络连接。",
+    "requestFailed": "没有收到响应。请检查网络连接，并在重试之前确认更改是否已生效。",
     "responseMeta": "{status}，耗时 {ms} ms"
   }
 }
diff --git a/app/_utils/api-list-utils.ts b/app/_utils/api-list-utils.ts
index a116a6922..a3c21a67c 100644
--- a/app/_utils/api-list-utils.ts
+++ b/app/_utils/api-list-utils.ts
@@ -15,8 +15,8 @@ export const isRefusal = <T extends object>(found: Found<T>): found is { refusal
   "refusal" in found;
 
 export const indexPath = (raw: string): number[] | null => {
-  const path = raw.split(".").map((part) => parseInt(part));
-  return path.every((idx) => idx >= 0) ? path : null;
+  const parts = raw.split(".");
+  return parts.every((part) => /^\d+$/.test(part)) ? parts.map(Number) : null;
 };
 
 export const itemAt = (items: Item[], [head, ...rest]: number[]): Item | undefined => {
diff --git a/app/_utils/grep-utils.ts b/app/_utils/grep-utils.ts
index 4b9861292..95b745a20 100644
--- a/app/_utils/grep-utils.ts
+++ b/app/_utils/grep-utils.ts
@@ -305,11 +305,11 @@ export interface GrepSearchResult extends GrepFileResult {
   matchLine: string;
 }
 
-const _bodyMatch = async (filePath: string, pattern: string): Promise<string> => {
+const _bodyMatch = async (filePath: string, text: string): Promise<string> => {
   try {
-    const matcher = new RegExp(pattern, "i");
+    const needle = text.toLowerCase();
     const { contentWithoutMetadata } = extractYamlMetadata(await fs.readFile(filePath, "utf-8"));
-    return contentWithoutMetadata.split(LINE_BREAK).find((line) => matcher.test(line))?.trim() ?? "";
+    return contentWithoutMetadata.split(LINE_BREAK).find((line) => line.toLowerCase().includes(needle))?.trim() ?? "";
   } catch (error) {
     console.error("Search match-line failed:", filePath, error);
     return "";
@@ -318,14 +318,14 @@ const _bodyMatch = async (filePath: string, pattern: string): Promise<string> =>
 
 export const grepSearchContent = async (
   dir: string,
-  pattern: string,
+  text: string,
 ): Promise<GrepSearchResult[]> => {
   try {
     const { stdout } = await execFileAsync("grep", [
-      "-rli",
+      "-rliF",
       "--include=*.md",
       "--",
-      pattern,
+      text,
       dir,
     ]);
 
@@ -339,7 +339,7 @@ export const grepSearchContent = async (
         const id = path.basename(filename, ".md");
         const category = parts.join("/");
 
-        const matchLine = await _bodyMatch(filePath, pattern);
+        const matchLine = await _bodyMatch(filePath, text);
         return { filePath, id, category, matchLine };
       }),
     );
diff --git a/mcp-server/src/server/http.ts b/mcp-server/src/server/http.ts
index 67ca5c747..5c90df1e1 100644
--- a/mcp-server/src/server/http.ts
+++ b/mcp-server/src/server/http.ts
@@ -8,6 +8,7 @@ import { createSessionPool, type SessionPool } from "./sessions.ts";
 
 const LOG_NS = "http";
 const BUN_MAX_IDLE_SECONDS = 255;
+const MAX_BODY_BYTES = 10 * 1024 * 1024;
 
 export enum HttpPath {
   Mcp = "/mcp",
@@ -55,6 +56,7 @@ export const startHttp = (sidecar: Sidecar, config: McpConfig) => {
     port: config.server.port,
     hostname: config.server.host || undefined,
     idleTimeout: BUN_MAX_IDLE_SECONDS,
+    maxRequestBodySize: MAX_BODY_BYTES,
     fetch: sidecar.fetch,
   });
   logger.info(LOG_NS, `listening on ${config.server.host || "0.0.0.0"}:${server.port}${HttpPath.Mcp}`);
diff --git a/tests/api/items.test.ts b/tests/api/items.test.ts
index b61d82f4c..2c07d8fbb 100644
--- a/tests/api/items.test.ts
+++ b/tests/api/items.test.ts
@@ -358,6 +358,16 @@ describe("Checklist Items API", () => {
       expect(data.success).toBe(true)
     })
 
+    it.each(["1abc", "1e2", "1.5x", "-1", ""])("refuses %j instead of deleting item 1", async (itemIndex) => {
+      mockGetListById.mockResolvedValue(mockList)
+
+      const request = createMockRequest("DELETE", `http://localhost:3000/api/checklists/uuid-1/items/${itemIndex}`)
+      const response = await DELETE(request, { params: Promise.resolve({ listId: "uuid-1", itemIndex }) })
+
+      expect(response.status).toBe(400)
+      expect((await getResponseJson(response)).error).toBe("Invalid item index")
+    })
+
     it("should delete a nested item", async () => {
       mockGetListById.mockResolvedValue(mockList)
 
diff --git a/tests/security/kanban-grants.test.ts b/tests/security/kanban-grants.test.ts
index acd52f578..ca191eb40 100644
--- a/tests/security/kanban-grants.test.ts
+++ b/tests/security/kanban-grants.test.ts
@@ -248,6 +248,18 @@ describe('Security: kanban API routes hold every share grant', () => {
     })
   })
 
+  describe('assigning without EDIT', () => {
+    it.each(['ghost', STRANGER, EDITOR])('refuses %s the same way, before looking up the assignee', async (assignee) => {
+      const { assignItem } = await import('@/app/_server/actions/kanban/tweaker')
+      const reader = { username: READER, isAdmin: false } as Parameters<typeof assignItem>[0]
+
+      const result = await assignItem(reader, BOARD_UUID, 'card', assignee)
+
+      expect(result).toEqual({ success: false, error: 'Permission denied' })
+      expect(mockWrite).not.toHaveBeenCalled()
+    })
+  })
+
   describe('assigning through a card update', () => {
     beforeEach(() => keyFor(OWNER))
 
diff --git a/tests/security/shell-injection.test.ts b/tests/security/shell-injection.test.ts
index e4ccc9bef..d083dbf52 100644
--- a/tests/security/shell-injection.test.ts
+++ b/tests/security/shell-injection.test.ts
@@ -9,6 +9,7 @@ import {
   grepFindFileByUuid,
   grepFindFilesByField,
   grepListAllFiles,
+  grepSearchContent,
 } from "@/app/_utils/grep-utils";
 
 const ROOT = mkdtempSync(path.join(os.tmpdir(), "jotty-shell-"));
@@ -63,3 +64,19 @@ describe("Security: shell injection in grep utils", () => {
     expect(await grepExtractExcerpt(EVIL_NOTE)).toBe("body");
   });
 });
+
+describe("Search matches the text literally", () => {
+  const SEARCH_DIR = path.join(ROOT, "search");
+
+  beforeEach(() => {
+    mkdirSync(SEARCH_DIR, { recursive: true });
+    writeFileSync(path.join(SEARCH_DIR, "plain.md"), "---\ntitle: Plain\n---\nnothing special here\n");
+    writeFileSync(path.join(SEARCH_DIR, "maths.md"), "---\ntitle: Maths\n---\nremember a+b? equals c\n");
+  });
+
+  it.each(["a?", "a+b?", ".*", "[a-z]"])("only finds files that contain %j", async (text) => {
+    const hits = await grepSearchContent(SEARCH_DIR, text);
+    const expected = text === "a+b?" ? ["maths"] : [];
+    expect(hits.map((hit) => hit.id)).toEqual(expected);
+  });
+});

From 296945a2c00947b11fe20cd9c7d69a5061e50795 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 14:35:27 +0100
Subject: [PATCH 21/28] make build for mcp

---
 .github/workflows/mcp-docker-publish.yml | 51 ++++++++++++++++++++++++
 docker-compose.mcp.yml                   | 21 +---------
 howto/DOCKER.md                          |  2 +-
 howto/MCP.md                             |  4 +-
 mcp-server/Dockerfile                    |  2 +-
 mcp-server/package.json                  |  2 +-
 mcp-server/src/server/mcp.ts             |  3 +-
 mcp-server/tests/version.test.ts         | 15 +++++++
 mcp-server/tsconfig.json                 |  1 +
 9 files changed, 76 insertions(+), 25 deletions(-)
 create mode 100644 .github/workflows/mcp-docker-publish.yml
 create mode 100644 mcp-server/tests/version.test.ts

diff --git a/.github/workflows/mcp-docker-publish.yml b/.github/workflows/mcp-docker-publish.yml
new file mode 100644
index 000000000..eb9a214d0
--- /dev/null
+++ b/.github/workflows/mcp-docker-publish.yml
@@ -0,0 +1,51 @@
+name: Build and Publish MCP
+
+on:
+  push:
+    branches: ["main", "develop"]
+    tags: ["*"]
+
+jobs:
+  build-mcp-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: The MCP is called jotty-mcp so we keep it jotty-mcp
+        id: repo
+        run: echo "name=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')-mcp" >> $GITHUB_OUTPUT
+
+      - name: Buildx baby
+        uses: docker/setup-buildx-action@v3
+
+      - name: Boring github login
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Same tags as jotty, so the versions line up
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ steps.repo.outputs.name }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
+
+      - name: One small image, both arches, no emulation
+        uses: docker/build-push-action@v5
+        with:
+          context: mcp-server
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=mcp
+          cache-to: type=gha,mode=max,scope=mcp
diff --git a/docker-compose.mcp.yml b/docker-compose.mcp.yml
index 8a8b5777d..42be34415 100644
--- a/docker-compose.mcp.yml
+++ b/docker-compose.mcp.yml
@@ -1,16 +1,3 @@
-# Jotty + jotty-mcp on one network.
-# Good for: letting MCP clients (Claude, Cursor, ...) work with your notes,
-# checklists and boards next to the normal web UI. The MCP server reaches
-# Jotty internally at http://jotty:3000, so it never leaves the network.
-#
-# Setup:
-#   mkdir -p ./data ./config ./cache && sudo chown -R 1000:1000 ./data ./config ./cache
-#   docker compose -f docker-compose.mcp.yml up -d --build
-#
-# MCP endpoint: http://localhost:3001/mcp
-# Every client sends its own Jotty API key in the x-api-key header, so each
-# session acts as that user. More in mcp-server/README.md.
-
 services:
   jotty:
     image: ghcr.io/fccview/jotty:latest
@@ -28,7 +15,7 @@ services:
       - NODE_ENV=production
 
   jotty-mcp:
-    build: ./mcp-server
+    image: ghcr.io/fccview/jotty-mcp:latest
     container_name: jotty-mcp
     depends_on:
       - jotty
@@ -40,14 +27,8 @@ services:
       JOTTY_URL: "http://jotty:3000"
       JOTTY_MCP_TRANSPORT: "http"
       JOTTY_MCP_PORT: "3001"
-      # Clients must send "Authorization: Bearer <token>". Leave it empty only
-      # on a network you trust.
       JOTTY_MCP_AUTH_TOKEN: "changeme"
-      # Optional fallback key for clients that can't send x-api-key. Anyone who
-      # reaches port 3001 with the token above then acts as this user.
       JOTTY_API_KEY: ""
-      # Caps the visible text of a result for small context windows. The full
-      # response is always in structuredContent.
       JOTTY_MCP_MAX_TEXT_CHARS: "12000"
 
 networks:
diff --git a/howto/DOCKER.md b/howto/DOCKER.md
index 8178775ed..41eef654a 100644
--- a/howto/DOCKER.md
+++ b/howto/DOCKER.md
@@ -142,7 +142,7 @@ environment:
 `docker-compose.mcp.yml` in the repo root runs jotty and the [MCP server](../mcp-server/README.md) on one network, so assistants such as Claude or Cursor can work with your notes and lists:
 
 ```bash
-docker compose -f docker-compose.mcp.yml up -d --build
+docker compose -f docker-compose.mcp.yml up -d
 ```
 
 ## API docs service
diff --git a/howto/MCP.md b/howto/MCP.md
index 6483e761a..67ea1962e 100644
--- a/howto/MCP.md
+++ b/howto/MCP.md
@@ -24,11 +24,13 @@ Use this when several people share one MCP server, or when you want it next to J
 
 ```bash
 mkdir -p ./data ./config ./cache && sudo chown -R 1000:1000 ./data ./config ./cache
-docker compose -f docker-compose.mcp.yml up -d --build
+docker compose -f docker-compose.mcp.yml up -d
 ```
 
 The MCP endpoint is `http://<host>:1133/mcp`, with a health check at `/healthz`.
 
+The `ghcr.io/fccview/jotty-mcp` image carries the same version tags as Jotty. If you pin Jotty to a version, pin the MCP server to the same one.
+
 > [!IMPORTANT]
 > Change `JOTTY_MCP_AUTH_TOKEN` from `changeme` before you start it. Every `/mcp` request has to send `Authorization: Bearer <token>`. Leaving the token empty opens the endpoint to anyone who can reach the port, which is fine on a private network and a bad idea anywhere else.
 
diff --git a/mcp-server/Dockerfile b/mcp-server/Dockerfile
index 65a944945..1d0fed196 100644
--- a/mcp-server/Dockerfile
+++ b/mcp-server/Dockerfile
@@ -1,4 +1,4 @@
-FROM oven/bun:1.3.14-alpine AS build
+FROM --platform=$BUILDPLATFORM oven/bun:1.3.14-alpine AS build
 WORKDIR /src
 COPY package.json bun.lock ./
 RUN bun install --frozen-lockfile
diff --git a/mcp-server/package.json b/mcp-server/package.json
index b59545a65..144f558e6 100644
--- a/mcp-server/package.json
+++ b/mcp-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jotty-mcp",
-  "version": "0.1.0",
+  "version": "1.28.0",
   "private": true,
   "type": "module",
   "module": "src/main.ts",
diff --git a/mcp-server/src/server/mcp.ts b/mcp-server/src/server/mcp.ts
index 84654937d..28ad9c89a 100644
--- a/mcp-server/src/server/mcp.ts
+++ b/mcp-server/src/server/mcp.ts
@@ -1,9 +1,10 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { registerTools } from "../tools/register.ts";
 import type { ToolContext } from "../tools/context.ts";
+import manifest from "../../package.json" with { type: "json" };
 
 export const SERVER_NAME = "jotty-mcp";
-export const SERVER_VERSION = "0.1.0";
+export const SERVER_VERSION = manifest.version;
 
 export const SERVER_INSTRUCTIONS = [
   "Tools for a Jotty instance: notes, checklists and Kanban boards, acting as the user who owns the API key.",
diff --git a/mcp-server/tests/version.test.ts b/mcp-server/tests/version.test.ts
new file mode 100644
index 000000000..5c183af7f
--- /dev/null
+++ b/mcp-server/tests/version.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "bun:test";
+import manifest from "../package.json" with { type: "json" };
+import { SERVER_VERSION } from "../src/server/mcp.ts";
+
+const jotty = await Bun.file(new URL("../../package.json", import.meta.url)).json();
+
+describe("version", () => {
+  it("matches the Jotty version, so one tag covers both", () => {
+    expect(manifest.version).toBe(jotty.version);
+  });
+
+  it("is what the server reports", () => {
+    expect(SERVER_VERSION).toBe(manifest.version);
+  });
+});
diff --git a/mcp-server/tsconfig.json b/mcp-server/tsconfig.json
index 0b2be33e7..00744d4bf 100644
--- a/mcp-server/tsconfig.json
+++ b/mcp-server/tsconfig.json
@@ -5,6 +5,7 @@
     "module": "Preserve",
     "moduleResolution": "bundler",
     "moduleDetection": "force",
+    "resolveJsonModule": true,
     "allowImportingTsExtensions": true,
     "verbatimModuleSyntax": true,
     "noEmit": true,

From 13ef8140e99aaa809dd5f852d60517079e98dd34 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 15:15:24 +0100
Subject: [PATCH 22/28] make it so the mcp only works from the right jotty
 version onward

---
 howto/MCP.md                     |  2 +-
 mcp-server/src/jotty/spec.ts     | 17 +++++++++++++++--
 mcp-server/src/tools/builtins.ts | 27 +++++++++++++++++++++------
 mcp-server/src/tools/errors.ts   |  5 +++++
 mcp-server/tests/helpers.ts      |  6 +++---
 mcp-server/tests/tools.test.ts   | 17 +++++++++++++++++
 6 files changed, 62 insertions(+), 12 deletions(-)

diff --git a/howto/MCP.md b/howto/MCP.md
index 67ea1962e..8216eb3e9 100644
--- a/howto/MCP.md
+++ b/howto/MCP.md
@@ -5,7 +5,7 @@ The MCP server lets an AI assistant such as Claude, Cursor or anything else that
 > [!CAUTION]
 > The assistant can do anything your API key can, deleting included. Give it a key from an account that only holds what you're happy for it to touch.
 
-You need an API key before anything else. [The API guide](API.md) explains how to generate one.
+You need Jotty 1.28.0 or newer and an API key. [The API guide](API.md) explains how to generate one.
 
 ## How it knows what Jotty can do
 
diff --git a/mcp-server/src/jotty/spec.ts b/mcp-server/src/jotty/spec.ts
index 4a73c1893..b2b4f8202 100644
--- a/mcp-server/src/jotty/spec.ts
+++ b/mcp-server/src/jotty/spec.ts
@@ -1,7 +1,20 @@
-import type { JottyClient } from "./client.ts";
+import { JottyError, type JottyClient } from "./client.ts";
 import type { OpenApiDocument, Operation } from "./openapi.ts";
 
 const SPEC_PATH = "/openapi.json";
+export const OPENAPI_SINCE = "1.28.0";
+
+export class SpecMissingError extends Error {
+  constructor() {
+    super(`This Jotty has no /api${SPEC_PATH}, the MCP server needs Jotty ${OPENAPI_SINCE} or newer.`);
+    this.name = "SpecMissingError";
+  }
+}
+
+const _fetchSpec = (client: JottyClient, signal?: AbortSignal) =>
+  client.send({ method: "get", path: SPEC_PATH, signal }).catch((err: unknown) => {
+    throw err instanceof JottyError && err.status === 404 ? new SpecMissingError() : err;
+  });
 
 export interface Spec {
   version: string;
@@ -33,7 +46,7 @@ export const createSpecSource = (ttlMs: number): SpecSource => {
     load: async (client, signal) => {
       const hit = cache.get(client.identity);
       if (hit && Date.now() - hit.at < ttlMs) return hit.spec;
-      const response = await client.send({ method: "get", path: SPEC_PATH, signal });
+      const response = await _fetchSpec(client, signal);
       const spec = toSpec(response.data as OpenApiDocument);
       cache.set(client.identity, { spec, at: Date.now() });
       return spec;
diff --git a/mcp-server/src/tools/builtins.ts b/mcp-server/src/tools/builtins.ts
index 4a2a586cf..ffdc2014f 100644
--- a/mcp-server/src/tools/builtins.ts
+++ b/mcp-server/src/tools/builtins.ts
@@ -1,5 +1,6 @@
 import type { Tool } from "@modelcontextprotocol/sdk/types.js";
-import type { Spec } from "../jotty/spec.ts";
+import { JottyError } from "../jotty/client.ts";
+import { SpecMissingError, type Spec } from "../jotty/spec.ts";
 import { logger } from "../utils/logger.ts";
 import { CURATED_OPERATIONS, toolNameOf } from "./catalog.ts";
 import { BuiltinTool, type ToolContext } from "./context.ts";
@@ -90,21 +91,35 @@ const _call = (ctx: ToolContext, spec: Spec, args: Record<string, unknown>, sign
   return runOperation(ctx, spec, op, inner, { signal });
 };
 
+const REJECTED = new Set([401, 403]);
+
+const _keyStatus = (ctx: ToolContext, spec: Spec | null, problem: unknown): string => {
+  if (!ctx.client.hasApiKey) return "missing";
+  if (spec) return "accepted";
+  return problem instanceof JottyError && REJECTED.has(problem.status) ? "rejected" : "unchecked";
+};
+
 const _health = async (ctx: ToolContext, signal?: AbortSignal): Promise<ToolResult> => {
   try {
     const health = await ctx.client.send({ method: "get", path: HEALTH_PATH, signal });
-    const spec = await ctx.specs.load(ctx.client, signal).catch((err: unknown) => {
+    let spec: Spec | null = null;
+    let problem: unknown = null;
+    try {
+      spec = await ctx.specs.load(ctx.client, signal);
+    } catch (err) {
       logger.warn(LOG_NS, "spec unavailable during health check", err);
-      return null;
-    });
+      problem = err;
+    }
     const report = {
       jotty: ctx.client.baseUrl,
       upstream: health.data,
-      apiKey: !ctx.client.hasApiKey ? "missing" : spec ? "accepted" : "rejected",
+      apiKey: _keyStatus(ctx, spec, problem),
       operations: spec?.operations.size ?? 0,
       uptimeSec: Math.round((Date.now() - ctx.startedAt) / 1000),
+      ...(problem instanceof SpecMissingError && { problem: problem.message }),
     };
-    return toolResult(`Jotty at ${report.jotty} is up, API key ${report.apiKey}.`, report);
+    const summary = `Jotty at ${report.jotty} is up, API key ${report.apiKey}.`;
+    return toolResult(report.problem ? `${summary} ${report.problem}` : summary, report);
   } catch (err) {
     return fromError(err);
   }
diff --git a/mcp-server/src/tools/errors.ts b/mcp-server/src/tools/errors.ts
index 4d5220e98..ccb536ec5 100644
--- a/mcp-server/src/tools/errors.ts
+++ b/mcp-server/src/tools/errors.ts
@@ -1,4 +1,5 @@
 import { JottyError } from "../jotty/client.ts";
+import { OPENAPI_SINCE, SpecMissingError } from "../jotty/spec.ts";
 import { TimeoutError } from "../utils/timeout.ts";
 import type { ToolResult } from "./result.ts";
 
@@ -32,6 +33,7 @@ const HINTS: Partial<Record<ToolErrorKind, string>> = {
   [ToolErrorKind.NotFound]: "It doesn't exist or the API key owner can't see it. List or search first to get a valid id.",
   [ToolErrorKind.Timeout]: "Jotty is slow or unreachable. Try the health tool.",
   [ToolErrorKind.Upstream]: "Try the health tool to see whether Jotty is reachable.",
+  [ToolErrorKind.Unsupported]: `Update Jotty to ${OPENAPI_SINCE} or newer. The health tool shows the version it runs.`,
 };
 
 export type ErrorHints = Partial<Record<ToolErrorKind, string>>;
@@ -40,6 +42,9 @@ export const fromError = (err: unknown, hints: ErrorHints = {}): ToolResult => {
   if (err instanceof TimeoutError) {
     return errorResult(ToolErrorKind.Timeout, err.message, HINTS[ToolErrorKind.Timeout]);
   }
+  if (err instanceof SpecMissingError) {
+    return errorResult(ToolErrorKind.Unsupported, err.message, HINTS[ToolErrorKind.Unsupported]);
+  }
   if (err instanceof JottyError) {
     const kind = KIND_BY_STATUS[err.status] ?? ToolErrorKind.Upstream;
     return errorResult(kind, err.message, hints[kind] ?? HINTS[kind], err.status);
diff --git a/mcp-server/tests/helpers.ts b/mcp-server/tests/helpers.ts
index 5c790e776..e68bed302 100644
--- a/mcp-server/tests/helpers.ts
+++ b/mcp-server/tests/helpers.ts
@@ -154,7 +154,7 @@ export const FAKE_SPEC: OpenApiDocument = {
 
 const _json = (data: unknown, status = 200) => Response.json(data, { status });
 
-export const serveJotty = (spec: OpenApiDocument = FAKE_SPEC): FakeJotty => {
+export const serveJotty = (spec: OpenApiDocument | null = FAKE_SPEC): FakeJotty => {
   const hits: Hit[] = [];
   const server = Bun.serve({
     port: 0,
@@ -164,9 +164,9 @@ export const serveJotty = (spec: OpenApiDocument = FAKE_SPEC): FakeJotty => {
       const text = request.method === "GET" ? "" : await request.text();
       hits.push({ method: request.method, path: `${url.pathname}${url.search}`, apiKey, body: text ? JSON.parse(text) : undefined });
 
-      if (url.pathname === "/api/health") return _json({ status: "healthy", version: spec.info.version });
+      if (url.pathname === "/api/health") return _json({ status: "healthy", version: spec?.info.version ?? "1.27.0" });
       if (apiKey !== API_KEY) return _json({ error: "Unauthorized" }, 401);
-      if (url.pathname === "/api/openapi.json") return _json(spec);
+      if (url.pathname === "/api/openapi.json") return spec ? _json(spec) : _json({ error: "Not found" }, 404);
       if (url.pathname === "/api/notes" && url.searchParams.get("q") === "many") {
         return _json({ notes: MANY_NOTES, total: MANY_NOTES.length });
       }
diff --git a/mcp-server/tests/tools.test.ts b/mcp-server/tests/tools.test.ts
index c27c5e0bd..c50fc054a 100644
--- a/mcp-server/tests/tools.test.ts
+++ b/mcp-server/tests/tools.test.ts
@@ -174,4 +174,21 @@ describe("builtins", () => {
     const result = await runBuiltin(makeCtx(jotty.url, "wrong"), BuiltinTool.Health, {});
     expect(structured(result)).toMatchObject({ apiKey: "rejected", operations: 0 });
   });
+
+  describe("on a Jotty without the OpenAPI route", () => {
+    const old = serveJotty(null);
+    afterAll(() => old.stop());
+
+    it("health names the version problem instead of blaming the key", async () => {
+      const result = await runBuiltin(makeCtx(old.url), BuiltinTool.Health, {});
+      expect(structured(result)).toMatchObject({ apiKey: "unchecked", upstream: { version: "1.27.0" } });
+      expect(text(result)).toContain("needs Jotty 1.28.0 or newer");
+    });
+
+    it("call_operation says to update Jotty", async () => {
+      const result = await runBuiltin(makeCtx(old.url), BuiltinTool.CallOperation, { operationId: "listNotes" });
+      expect(structured(result).error).toMatchObject({ kind: "unsupported" });
+      expect(text(result)).toContain("Update Jotty to 1.28.0 or newer");
+    });
+  });
 });

From d578561fb1060136521d53e057b4062da314a466 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 15:39:29 +0100
Subject: [PATCH 23/28] fix issues with the mcp

---
 app/_server/actions/category/move.ts          |   7 +-
 app/_server/actions/checklist/editor.ts       |   5 +-
 app/_server/actions/note/editor.ts            |   6 +-
 app/_utils/filename-utils.ts                  |  17 ++-
 tests/server-actions/note-move-safety.test.ts | 112 ++++++++++++++++++
 5 files changed, 141 insertions(+), 6 deletions(-)
 create mode 100644 tests/server-actions/note-move-safety.test.ts

diff --git a/app/_server/actions/category/move.ts b/app/_server/actions/category/move.ts
index 01ce4824a..d2a2c8407 100644
--- a/app/_server/actions/category/move.ts
+++ b/app/_server/actions/category/move.ts
@@ -16,6 +16,7 @@ import { getUsername } from "@/app/_server/actions/users";
 import { logAudit } from "@/app/_server/actions/log";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { isPathSafe } from "@/app/_utils/path-utils";
+import { freeFilename } from "@/app/_utils/filename-utils";
 import { ARCHIVED_DIR_NAME, EXCLUDED_DIRS } from "@/app/_consts/files";
 import {
   catUuid,
@@ -379,8 +380,10 @@ export const moveNode = async (formData: FormData) => {
       await ensureDir(newParentDir);
 
       const fileName = activeType === "item" ? `${activeName}.md` : activeName;
+      const landingName =
+        activeType === "item" ? await freeFilename(newParentDir, activeName) : activeName;
       const oldPath = path.join(oldParentDir, fileName);
-      const newPath = path.join(newParentDir, fileName);
+      const newPath = path.join(newParentDir, landingName);
 
       await serverRenamePath(oldPath, newPath);
 
@@ -414,7 +417,7 @@ export const moveNode = async (formData: FormData) => {
 
           await commitNote(
             destLoc.owner,
-            path.join(destLoc.category || "Uncategorized", `${activeName}.md`),
+            path.join(destLoc.category || "Uncategorized", landingName),
             "move",
             title,
             {
diff --git a/app/_server/actions/checklist/editor.ts b/app/_server/actions/checklist/editor.ts
index 057ec4ed8..3402122a0 100644
--- a/app/_server/actions/checklist/editor.ts
+++ b/app/_server/actions/checklist/editor.ts
@@ -8,7 +8,7 @@ import {
   serverDeleteFile,
 } from "@/app/_server/actions/file";
 import { revalidatePath } from "next/cache";
-import { generateUniqueFilename, sanitizeFilename } from "@/app/_utils/filename-utils";
+import { freeFilename, generateUniqueFilename, sanitizeFilename } from "@/app/_utils/filename-utils";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { getFormData } from "@/app/_utils/global-utils";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
@@ -134,6 +134,9 @@ const _editList = async (actingUser: SanitisedUser, formData: FormData) => {
         fileRenameMode
       );
       newId = path.basename(newFilename, ".md");
+    } else if (isMoving) {
+      newFilename = await freeFilename(categoryDir, currentId);
+      newId = path.basename(newFilename, ".md");
     } else {
       newFilename = `${currentId}.md`;
     }
diff --git a/app/_server/actions/note/editor.ts b/app/_server/actions/note/editor.ts
index 01c0e06f1..66cf9e368 100644
--- a/app/_server/actions/note/editor.ts
+++ b/app/_server/actions/note/editor.ts
@@ -1,6 +1,6 @@
 import path from "path";
 import { SanitisedUser } from "@/app/_types";
-import { generateUniqueFilename } from "@/app/_utils/filename-utils";
+import { freeFilename, generateUniqueFilename } from "@/app/_utils/filename-utils";
 import {
   detectEncryptionMethod,
   isEncrypted,
@@ -169,6 +169,9 @@ const _editNote = async (
         fileRenameMode,
       );
       newId = path.basename(newFilename, ".md");
+    } else if (isMoving) {
+      newFilename = await freeFilename(categoryDir, currentId);
+      newId = path.basename(newFilename, ".md");
     } else {
       newFilename = `${currentId}.md`;
     }
@@ -299,7 +302,6 @@ export const rewriteNote = async (
     const formData = new FormData();
     formData.append("uuid", note.uuid || uuid);
     formData.append("title", note.title);
-    formData.append("category", "");
     formData.append("content", content);
     return _editNote(actor, formData, false);
   });
diff --git a/app/_utils/filename-utils.ts b/app/_utils/filename-utils.ts
index fa1eef871..421da2e87 100644
--- a/app/_utils/filename-utils.ts
+++ b/app/_utils/filename-utils.ts
@@ -69,4 +69,19 @@ export const generateUniqueFilename = async (
   }
 
   return filename;
-};
\ No newline at end of file
+};
+
+export const freeFilename = async (
+  directory: string,
+  id: string,
+  extension: string = ".md"
+): Promise<string> => {
+  for (let counter = 0; ; counter++) {
+    const filename = counter ? `${id}-${counter}${extension}` : `${id}${extension}`;
+    try {
+      await fs.access(path.join(directory, filename));
+    } catch {
+      return filename;
+    }
+  }
+};
diff --git a/tests/server-actions/note-move-safety.test.ts b/tests/server-actions/note-move-safety.test.ts
new file mode 100644
index 000000000..e848dddfe
--- /dev/null
+++ b/tests/server-actions/note-move-safety.test.ts
@@ -0,0 +1,112 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import path from "path";
+import { resetAllMocks, createFormData } from "../setup";
+import { NOTES_DIR } from "@/app/_consts/files";
+
+const disk = new Map<string, string>();
+const notes = new Map<string, Record<string, unknown>>();
+
+vi.mock("@/app/_server/actions/file", () => ({
+  ensureDir: vi.fn().mockResolvedValue(undefined),
+  serverWriteFile: async (filePath: string, content: string) => {
+    disk.set(filePath, content);
+  },
+  serverDeleteFile: async (filePath: string) => {
+    disk.delete(filePath);
+  },
+}));
+
+vi.mock("@/app/_server/actions/note/queries", () => ({
+  getNoteById: async (uuid: string) => notes.get(uuid),
+}));
+
+vi.mock("@/app/_server/actions/share/queries", () => ({
+  canReach: vi.fn().mockResolvedValue(true),
+}));
+
+vi.mock("@/app/_server/actions/share/target", () => ({
+  bouncer: async () => ({ allowed: true }),
+  shownAs: async (_m: unknown, _u: string, _o: string, category: string) => category,
+  movePlan: async (_mode: unknown, owner: string, item: { category?: string }, requested: string) => {
+    const home = { owner, category: item.category || "" };
+    const destination = { owner, category: requested };
+    return { home, destination, target: destination, isMoving: requested !== home.category };
+  },
+  refusalMessage: async () => "requiredPermissions",
+}));
+
+vi.mock("@/app/_server/actions/lib/read-only", () => ({
+  isWritable: vi.fn().mockResolvedValue(true),
+}));
+
+vi.mock("@/app/_server/actions/log", () => ({
+  logContentEvent: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/app/_server/actions/history", () => ({
+  commitNote: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/app/_server/actions/relations/tidy", () => ({
+  tidyItemLinks: async (content: string) => content,
+  refreshWikilinks: (content: string) => content,
+}));
+
+vi.mock("@/app/_utils/filename-utils", () => ({
+  generateUniqueFilename: vi.fn(),
+  freeFilename: async (dir: string, id: string) => {
+    for (let counter = 0; ; counter++) {
+      const name = counter ? `${id}-${counter}.md` : `${id}.md`;
+      if (!disk.has(path.join(dir, name))) return name;
+    }
+  },
+}));
+
+import { editNote, rewriteNote } from "@/app/_server/actions/note/editor";
+
+const actor = { username: "alice", fileRenameMode: "minimal" } as never;
+const dirOf = (category: string) => path.join(process.cwd(), NOTES_DIR("alice"), category);
+
+const seed = (uuid: string, category: string, content: string) => {
+  const note = { id: "overview", uuid, title: "Overview", category, owner: "alice", content };
+  notes.set(uuid, note);
+  disk.set(path.join(dirOf(category), "overview.md"), content);
+};
+
+describe("notes never land on top of each other", () => {
+  beforeEach(() => {
+    resetAllMocks();
+    disk.clear();
+    notes.clear();
+  });
+
+  it("keeps a note in its category when a link is written into it", async () => {
+    seed("n-1", "Homelab/Neovim", "Neovim things");
+
+    const result = await rewriteNote(actor, "n-1", (content) => `${content}\n\n[Shortcuts](/note/n-2)\n`);
+
+    expect(result).toMatchObject({ success: true });
+    const written = Array.from(disk.keys());
+    expect(written).toEqual([path.join(dirOf("Homelab/Neovim"), "overview.md")]);
+    expect(disk.get(written[0])).toContain("[Shortcuts](/note/n-2)");
+  });
+
+  it("gives a moved note a free filename instead of overwriting a namesake", async () => {
+    seed("n-1", "Homelab/Neovim", "Neovim things");
+    seed("n-2", "Uncategorized", "Hyprland things");
+
+    const result = await editNote(
+      actor,
+      createFormData({ uuid: "n-1", title: "Overview", category: "Uncategorized", content: "Neovim things" }),
+    );
+
+    expect(result).toMatchObject({ success: true, data: { id: "overview-1" } });
+    expect(disk.get(path.join(dirOf("Uncategorized"), "overview.md"))).toBe("Hyprland things");
+    expect(disk.get(path.join(dirOf("Uncategorized"), "overview-1.md"))).toContain("Neovim things");
+    expect(disk.has(path.join(dirOf("Homelab/Neovim"), "overview.md"))).toBe(false);
+  });
+});

From 08c9ef75dd87ba6cd6c8c0e49266d21db19d2db0 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 19:23:45 +0100
Subject: [PATCH 24/28] ok a lot of fixes were needed here, damn

---
 app/_consts/notes.ts                          |   8 +
 app/_consts/relations.ts                      |   2 +-
 app/_schemas/api/admin.ts                     |  53 +++++
 app/_schemas/api/common.ts                    |  10 +
 app/_schemas/api/howto.ts                     |  23 +++
 app/_schemas/api/notes.ts                     |  41 +++-
 app/_schemas/api/relations.ts                 |  36 +++-
 app/_schemas/api/tags.ts                      |  26 +++
 app/_schemas/api/tasks.ts                     |  10 +-
 app/_server/actions/checklist/queries.ts      |   3 +-
 app/_server/actions/checklist/readers.ts      |   3 +-
 app/_server/actions/lib/admin-peek.ts         |  22 +++
 app/_server/actions/lib/file-title.ts         |  23 +++
 app/_server/actions/lib/howto-docs.ts         |  27 +++
 app/_server/actions/lib/uuid-keeper.ts        |  66 +++++++
 app/_server/actions/note/editor.ts            |  23 ---
 app/_server/actions/note/queries.ts           |   3 +-
 app/_server/actions/note/readers.ts           |   5 +-
 app/_server/actions/note/splice.ts            | 143 ++++++++++++++
 app/_server/actions/relations/explore.ts      | 130 +++++++++---
 app/_server/actions/relations/freshen.ts      |  12 ++
 app/_server/actions/relations/indexer.ts      |  92 +++++++--
 app/_server/actions/relations/paths.ts        |   9 +
 app/_server/actions/relations/store.ts        |   6 +
 app/_server/actions/relations/watcher.ts      |  35 +++-
 app/_server/actions/users/auth.ts             |  18 +-
 app/_server/actions/uuid-clash/repair.ts      | 145 ++++++++++++++
 app/_server/actions/uuid-clash/scan.ts        | 107 ++++++++++
 app/_server/api/route-index.ts                |  10 +
 app/_types/relations.ts                       |   1 +
 app/_utils/api-note.ts                        |   6 +-
 app/_utils/checklist-utils.ts                 |   2 +-
 app/_utils/client-parser-utils.ts             |  10 +-
 app/_utils/grep-utils.ts                      |  25 ++-
 app/_utils/item-links.ts                      |  67 +++++++
 app/_utils/markdown-utils.tsx                 |  31 ++-
 app/_utils/note-edits.ts                      |  87 ++++++++
 app/_utils/text-lines.ts                      |  51 +++++
 app/_utils/text-slice.ts                      |  14 ++
 app/_utils/title-utils.ts                     |  26 +++
 app/_utils/yaml-metadata-utils.ts             |  25 +--
 app/api/admin/duplicate-uuids/route.ts        |  89 +++++++++
 app/api/brain/route.ts                        |   2 +-
 app/api/checklists/route.ts                   |   2 +-
 app/api/howto/[docId]/route.ts                |  33 ++++
 app/api/howto/route.ts                        |  28 +++
 app/api/kanban/route.ts                       |   2 +-
 app/api/notes/[noteId]/route.ts               |  77 +++++++-
 app/api/notes/[noteId]/tags/route.ts          |  88 +++++++++
 app/api/notes/route.ts                        |  11 +-
 app/api/relations/links/route.ts              |  57 +++++-
 app/api/relations/orphans/route.ts            |   2 +-
 app/api/tags/route.ts                         |  57 ++++++
 howto/API.md                                  |  26 +++
 howto/MCP.md                                  |  28 ++-
 mcp-server/src/server/mcp.ts                  |   9 +-
 mcp-server/src/tools/budget.ts                |  24 +++
 mcp-server/src/tools/builtins.ts              |  44 ++++-
 mcp-server/src/tools/catalog.ts               |  13 ++
 mcp-server/src/tools/operation.ts             |  17 +-
 mcp-server/src/tools/register.ts              |   7 +-
 mcp-server/src/tools/result.ts                |   2 +-
 mcp-server/tests/helpers.ts                   |   8 +
 mcp-server/tests/session.test.ts              |   1 +
 mcp-server/tests/tools.test.ts                |  41 +++-
 tests/api/duplicate-uuids.test.ts             |  88 +++++++++
 tests/api/howto.test.ts                       |  54 +++++
 tests/api/note-edits.test.ts                  | 187 ++++++++++++++++++
 tests/api/relations.test.ts                   |  37 +++-
 tests/api/setup.ts                            |  15 +-
 tests/api/tasks.test.ts                       |  31 +++
 tests/server-actions/note-move-safety.test.ts |  13 +-
 tests/server-actions/note-splice.test.ts      | 119 +++++++++++
 .../server-actions/relations-explore.test.ts  |  64 +++++-
 tests/server-actions/relations.test.ts        |  38 ++++
 tests/server-actions/titles.test.ts           |  61 ++++++
 tests/server-actions/uuid-clash.test.ts       | 142 +++++++++++++
 tests/server-actions/uuid-repair.test.ts      | 119 +++++++++++
 tests/setup.ts                                |   1 +
 tests/utils/item-links.test.ts                |  67 +++++++
 tests/utils/note-edits.test.ts                |  60 ++++++
 tests/utils/title-utils.test.ts               |  44 +++++
 82 files changed, 3024 insertions(+), 220 deletions(-)
 create mode 100644 app/_schemas/api/howto.ts
 create mode 100644 app/_schemas/api/tags.ts
 create mode 100644 app/_server/actions/lib/admin-peek.ts
 create mode 100644 app/_server/actions/lib/file-title.ts
 create mode 100644 app/_server/actions/lib/howto-docs.ts
 create mode 100644 app/_server/actions/lib/uuid-keeper.ts
 create mode 100644 app/_server/actions/note/splice.ts
 create mode 100644 app/_server/actions/relations/freshen.ts
 create mode 100644 app/_server/actions/uuid-clash/repair.ts
 create mode 100644 app/_server/actions/uuid-clash/scan.ts
 create mode 100644 app/_utils/item-links.ts
 create mode 100644 app/_utils/note-edits.ts
 create mode 100644 app/_utils/text-lines.ts
 create mode 100644 app/_utils/text-slice.ts
 create mode 100644 app/_utils/title-utils.ts
 create mode 100644 app/api/admin/duplicate-uuids/route.ts
 create mode 100644 app/api/howto/[docId]/route.ts
 create mode 100644 app/api/howto/route.ts
 create mode 100644 app/api/notes/[noteId]/tags/route.ts
 create mode 100644 app/api/tags/route.ts
 create mode 100644 mcp-server/src/tools/budget.ts
 create mode 100644 tests/api/duplicate-uuids.test.ts
 create mode 100644 tests/api/howto.test.ts
 create mode 100644 tests/api/note-edits.test.ts
 create mode 100644 tests/server-actions/note-splice.test.ts
 create mode 100644 tests/server-actions/titles.test.ts
 create mode 100644 tests/server-actions/uuid-clash.test.ts
 create mode 100644 tests/server-actions/uuid-repair.test.ts
 create mode 100644 tests/utils/item-links.test.ts
 create mode 100644 tests/utils/note-edits.test.ts
 create mode 100644 tests/utils/title-utils.test.ts

diff --git a/app/_consts/notes.ts b/app/_consts/notes.ts
index 05d93e5af..fafc53813 100644
--- a/app/_consts/notes.ts
+++ b/app/_consts/notes.ts
@@ -4,6 +4,14 @@ export const NOTES_FOLDER = Modes.NOTES;
 export const DEPRECATED_DOCS_FOLDER = Modes.DEPRECATED_DOCS;
 export const UNCATEGORIZED = "Uncategorized";
 
+export const MANAGED_KEY = "managed";
+
+export const MANAGED_WARNING =
+  "This note is marked managed: true, so a script rewrites it and may drop this change";
+
+export const isManaged = (metadata?: Record<string, unknown> | null): boolean =>
+  metadata?.[MANAGED_KEY] === true;
+
 export const QUOTES = [
   "Nothing... a whole lot of nothing.",
   "What's in the box?!",
diff --git a/app/_consts/relations.ts b/app/_consts/relations.ts
index b81ab2b49..ecf5b229e 100644
--- a/app/_consts/relations.ts
+++ b/app/_consts/relations.ts
@@ -1,5 +1,5 @@
 export const RELATIONS_DB_NAME = ".relations.db";
-export const RELATIONS_SCHEMA_VERSION = 4;
+export const RELATIONS_SCHEMA_VERSION = 5;
 export const LEGACY_LINK_PREFIX = "/jotty/";
 export const WIKILINK_REGEX =
   /\[\[([^\[\]|#^\n]+)(?:[#^][^\[\]|\n]*)?(?:\|([^\[\]\n]*))?\]\]/g;
diff --git a/app/_schemas/api/admin.ts b/app/_schemas/api/admin.ts
index e29a8938e..9f748f574 100644
--- a/app/_schemas/api/admin.ts
+++ b/app/_schemas/api/admin.ts
@@ -1,4 +1,7 @@
 import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+import { ItemTypes } from "@/app/_types/enums";
+import { required } from "./common";
 
 export const rebuildIndexBody = z.object({
   username: z
@@ -12,3 +15,53 @@ export const rebuiltSchema = z.object({
   success: z.literal(true),
   message: z.string(),
 });
+
+const clashUser = z
+  .string()
+  .optional()
+  .describe("Whose files to check, yours when left out. Naming somebody else needs an admin allowed to see other users' content");
+
+export const clashQuery = z.object({ username: clashUser });
+
+const clashFileSchema = z.object({
+  type: z.enum(ItemTypes),
+  path: z.string().describe("Where the file sits, like notes/Home/plan.md. Pass it to repairDuplicateUuid to pick this file"),
+  title: z.string(),
+  createdAt: z.string().optional().describe("From frontmatter. A file without one counts as the newest"),
+  keeps: z.boolean().describe("True for the file that owns the uuid now. Gets, links and the brain all open this one"),
+});
+
+export const clashListSchema = z.object({
+  duplicates: z.array(
+    z
+      .object({
+        uuid: z.string(),
+        owner: z.string(),
+        files: z.array(clashFileSchema).describe("Oldest createdAt first, the first one keeps the uuid"),
+      })
+      .register(apiNames, { id: "DuplicateUuid" }),
+  ),
+  total: z.number(),
+});
+
+export const clashRepairBody = z.object({
+  uuid: required("uuid").describe("The duplicated uuid"),
+  path: z
+    .string()
+    .optional()
+    .describe("The file that gets a fresh uuid, as listed. Every file but the keeper when left out"),
+  username: clashUser,
+});
+
+export const clashRepairSchema = z.object({
+  success: z.literal(true),
+  uuid: z.string(),
+  rekeyed: z
+    .array(z.object({ path: z.string(), uuid: z.string().describe("Its new uuid"), title: z.string() }))
+    .describe("Files that got a fresh uuid"),
+  relinked: z.array(z.string()).describe("Files whose links to the old uuid now point at the new one"),
+  ambiguous: z
+    .array(z.string())
+    .describe("Files with links to the old uuid whose text doesn't say which file they meant, left pointing at the keeper"),
+  skipped: z.array(z.string()).describe("Encrypted files that mention the old uuid, left untouched"),
+});
diff --git a/app/_schemas/api/common.ts b/app/_schemas/api/common.ts
index 08b1b5c5c..fc69efb16 100644
--- a/app/_schemas/api/common.ts
+++ b/app/_schemas/api/common.ts
@@ -44,6 +44,16 @@ export const pageFields = {
   offset: z.coerce.number().int().min(0).default(0).describe("How many results to skip"),
 };
 
+export const sliceQuery = z.object({
+  offset: z.coerce.number().int().min(0).default(0).describe("First character of content to return"),
+  limit: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .optional()
+    .describe("Most characters of content to return, all when left out"),
+});
+
 export const page = <T>(rows: T[], { limit, offset }: { limit?: number; offset: number }): T[] =>
   rows.slice(offset, limit === undefined ? undefined : offset + limit);
 
diff --git a/app/_schemas/api/howto.ts b/app/_schemas/api/howto.ts
new file mode 100644
index 000000000..aa97fc9cf
--- /dev/null
+++ b/app/_schemas/api/howto.ts
@@ -0,0 +1,23 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+
+export const docParams = z.object({
+  docId: z.string().describe("Guide id from listDocs, like mcp, api or markdown"),
+});
+
+export const docListSchema = z.object({
+  docs: z.array(
+    z
+      .object({ id: z.string(), title: z.string() })
+      .register(apiNames, { id: "DocSummary" }),
+  ),
+  total: z.number(),
+});
+
+export const docSchema = z.object({
+  id: z.string(),
+  title: z.string(),
+  content: z.string().describe("The guide as markdown"),
+  contentLength: z.number().describe("Characters in the whole guide"),
+  nextOffset: z.number().optional().describe("Pass this as offset to read the rest when limit cut the guide"),
+});
diff --git a/app/_schemas/api/notes.ts b/app/_schemas/api/notes.ts
index 0ffc7d172..52aa14d7d 100644
--- a/app/_schemas/api/notes.ts
+++ b/app/_schemas/api/notes.ts
@@ -1,6 +1,16 @@
 import { z } from "zod";
 import { apiNames } from "@/app/_schemas/api/names";
-import { ListView, categoryField, pageFields, required, searchQuery, timestamp, uuidParam } from "./common";
+import {
+  ListView,
+  categoryField,
+  envelope,
+  pageFields,
+  required,
+  searchQuery,
+  sliceQuery,
+  timestamp,
+  uuidParam,
+} from "./common";
 
 export const noteSchema = z
   .object({
@@ -11,6 +21,10 @@ export const noteSchema = z
     excerpt: z.string().optional().describe("Plain-text start of the content, in the summary view. Left out for encrypted notes"),
     encrypted: z.boolean().optional().describe("The content is ciphertext and can't be read without the passphrase or key"),
     owner: z.string().optional(),
+    tags: z.array(z.string()).optional().describe("Tags come from #hashtags in the content, like #work or #home/garden"),
+    managed: z.boolean().optional().describe("True when frontmatter says managed: true, meaning a script rewrites this note and may drop manual edits"),
+    contentLength: z.number().optional().describe("Characters in the whole content, on a single note"),
+    nextOffset: z.number().optional().describe("Pass this as offset to read the rest when limit cut the content"),
     createdAt: timestamp.optional(),
     updatedAt: timestamp.optional(),
   })
@@ -19,6 +33,11 @@ export const noteSchema = z
 export const noteListQuery = z.object({
   category: z.string().optional().describe("Only notes in this folder"),
   q: searchQuery,
+  tag: z.string().optional().describe("Only notes with this tag or one nested under it, like work or home/garden"),
+  ids: z
+    .string()
+    .optional()
+    .describe("Comma-separated note uuids, to read several notes in one call"),
   view: z
     .enum(ListView)
     .default(ListView.FULL)
@@ -39,3 +58,23 @@ export const noteUpdateBody = z.object({
 });
 
 export const noteParams = uuidParam("noteId", "Note");
+
+export const noteReadQuery = sliceQuery;
+
+export const notePatchBody = z.object({
+  find: required("find").describe("Exact text to replace, it must appear exactly once in the note"),
+  replace: z.string().describe("Text to put in its place, empty to delete it"),
+});
+
+export const noteTagBody = z
+  .object({
+    add: z.array(z.string()).optional().describe("Tags to add as #hashtags at the end of the note"),
+    remove: z.array(z.string()).optional().describe("Tags to take off. Their #hashtags come out of the content and the frontmatter drops them"),
+  })
+  .refine((body) => Boolean(body.add?.length || body.remove?.length), {
+    error: "Pass add or remove",
+  });
+
+export const warnedNote = envelope(noteSchema).extend({
+  warning: z.string().optional().describe("Set when a script manages the note and may overwrite the change"),
+});
diff --git a/app/_schemas/api/relations.ts b/app/_schemas/api/relations.ts
index 3f9e1fbab..389d9bacb 100644
--- a/app/_schemas/api/relations.ts
+++ b/app/_schemas/api/relations.ts
@@ -32,7 +32,11 @@ export const linkedItemSchema = z
   .register(apiNames, { id: "LinkedItem" });
 
 const relatedItemSchema = linkedItemSchema.extend({
-  kind: z.enum(LinkKinds).describe("mention for a [Title](/note/uuid) link, wiki for a [[Title]] link"),
+  kind: z
+    .enum(LinkKinds)
+    .describe(
+      "mention for any [Title](/note/uuid) markdown link, inline or on its own line, including the ones connect_items adds. wiki for a [[Title]] link",
+    ),
 });
 
 export const relatedParams = uuidParam("itemId", "Note or checklist");
@@ -48,8 +52,17 @@ export const relatedSchema = linkedItemSchema
       .array(linkedItemSchema.extend({ snippet: z.string() }))
       .describe("Notes that name this item in plain text without linking it"),
     suggestions: z
-      .array(linkedItemSchema.extend({ score: z.number().describe("0 to 1, higher shares more neighbours") }))
-      .describe("Items that share a lot of neighbours with this one but aren't linked to it"),
+      .array(
+        linkedItemSchema.extend({
+          score: z.number().describe("0 to 1, higher shares more neighbours, relative to the strongest pair"),
+          via: z
+            .array(z.string())
+            .describe("Titles of the items and #tags both share. One broad shared neighbour is weak evidence"),
+        }),
+      )
+      .describe(
+        "Items that share neighbours with this one but aren't linked to it. Jotty picks these from the link graph alone, so check via and read both items before linking",
+      ),
   })
   .register(apiNames, { id: "Relations" });
 
@@ -119,6 +132,23 @@ export const orphansSchema = z.object({
   total: z.number(),
 });
 
+export const unlinkBody = z.object({
+  source: required("source").describe("Uuid of the note that holds the link"),
+  target: required("target").describe("Uuid of the item it links to"),
+});
+
+export const unlinkedSchema = z.object({
+  success: z.literal(true),
+  removed: z.number().describe("Links taken out of the source note"),
+  wikiLinks: z.number().describe("[[wikilinks]] from the source to the target, which this leaves alone"),
+  warning: z.string().optional().describe("Set when a script manages the source note and may overwrite the change"),
+});
+
+export const linkedSchema = z.object({
+  success: z.literal(true),
+  warning: z.string().optional().describe("Set when a script manages the source note and may overwrite the change"),
+});
+
 export const linkBody = z.object({
   source: required("source").describe("Uuid of the note that gets the link"),
   target: required("target").describe("Uuid of the note or checklist to link to"),
diff --git a/app/_schemas/api/tags.ts b/app/_schemas/api/tags.ts
new file mode 100644
index 000000000..c477f70c9
--- /dev/null
+++ b/app/_schemas/api/tags.ts
@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { apiNames } from "@/app/_schemas/api/names";
+
+export const tagCountSchema = z
+  .object({
+    tag: z.string().describe("Tag name without the #, nested tags use /"),
+    notes: z.number().describe("Notes carrying this exact tag"),
+    checklists: z.number().describe("Checklists carrying this exact tag"),
+  })
+  .register(apiNames, { id: "TagCount" });
+
+export const tagListSchema = z.object({
+  tags: z.array(tagCountSchema),
+  total: z.number(),
+});
+
+export const taggedNoteSchema = z.object({
+  success: z.literal(true),
+  data: z.object({
+    id: z.string().describe("Note uuid"),
+    title: z.string(),
+    tags: z.array(z.string()),
+    changed: z.boolean().describe("False when the note already had those tags, so Jotty wrote nothing"),
+  }),
+  warning: z.string().optional().describe("Set when a script manages the note and may overwrite the change"),
+});
diff --git a/app/_schemas/api/tasks.ts b/app/_schemas/api/tasks.ts
index 986e436ce..afb84ea60 100644
--- a/app/_schemas/api/tasks.ts
+++ b/app/_schemas/api/tasks.ts
@@ -38,12 +38,18 @@ export const taskListQuery = z.object({
   ...pageFields,
 });
 
+const noColor = z
+  .string()
+  .nullish()
+  .transform((color) => color ?? undefined)
+  .describe("Left out or null for no color");
+
 const newColumn = z
   .object({
     id: required("Status id"),
     label: z.string().optional(),
     name: z.string().optional().describe("Deprecated alias for label"),
-    color: z.string().optional(),
+    color: noColor,
     order: z.number().optional().describe("Defaults to the column's position in the array"),
     autoComplete: z.boolean().optional().describe("Items moved here are marked completed"),
   })
@@ -79,7 +85,7 @@ export const taskStatusParams = taskParams.extend({
 export const statusCreateBody = z.object({
   id: statusField.describe("Status id, unique within the task"),
   label: statusField.describe("Column name shown on the board"),
-  color: z.string().optional(),
+  color: noColor,
   order: z.number().optional().describe("Defaults to last"),
   autoComplete: z.boolean().optional().describe("Items moved here are marked completed, defaults to false"),
 });
diff --git a/app/_server/actions/checklist/queries.ts b/app/_server/actions/checklist/queries.ts
index aa5bf5417..3d6c2b8dd 100644
--- a/app/_server/actions/checklist/queries.ts
+++ b/app/_server/actions/checklist/queries.ts
@@ -21,6 +21,7 @@ import { canReachFile } from "@/app/_server/actions/share/access";
 import { checkAndRefreshRecurringItems } from "./parsers";
 import { isDebugFlag } from "@/app/_utils/env-utils";
 import { getOrCompute, metaCacheKey } from "@/app/_server/actions/lib/metadata-cache";
+import { dropClashes } from "@/app/_server/actions/lib/uuid-keeper";
 
 export const getUserChecklists = async (options: GetChecklistsOptions = {}) => {
   const {
@@ -87,7 +88,7 @@ export const getUserChecklists = async (options: GetChecklistsOptions = {}) => {
         undefined,
       );
 
-    let lists: ChecklistReadResult[] = [...cached];
+    let lists: ChecklistReadResult[] = dropClashes(cached, absUserDir);
 
     if (layoutTiming && isDebugFlag("crud")) {
       console.warn(
diff --git a/app/_server/actions/checklist/readers.ts b/app/_server/actions/checklist/readers.ts
index e556031cc..d73ea2018 100644
--- a/app/_server/actions/checklist/readers.ts
+++ b/app/_server/actions/checklist/readers.ts
@@ -26,6 +26,7 @@ import { getChecklistType } from "./parsers";
 import { isDebugFlag } from "@/app/_utils/env-utils";
 import { isKanbanType } from "@/app/_types/enums";
 import { lacksUuid, stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
+import { titleFromFile } from "@/app/_server/actions/lib/file-title";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
 const debugCrud = isDebugFlag("crud");
@@ -207,7 +208,7 @@ export const readListsRecursively = async (
                 typeof metadata?.uuid === "string"
                   ? metadata.uuid
                   : await stampUuid(filePath),
-              title: typeof metadata?.title === "string" ? metadata.title : id,
+              title: await titleFromFile(metadata, filePath, id),
               type: isKanbanType(metadata?.checklistType as string)
                 ? "kanban"
                 : "simple",
diff --git a/app/_server/actions/lib/admin-peek.ts b/app/_server/actions/lib/admin-peek.ts
new file mode 100644
index 000000000..cec48031b
--- /dev/null
+++ b/app/_server/actions/lib/admin-peek.ts
@@ -0,0 +1,22 @@
+import type { SanitisedUser } from "@/app/_types";
+
+export const adminPeek = async (
+  user: Pick<SanitisedUser, "isAdmin" | "isSuperAdmin"> | null | undefined,
+): Promise<boolean> => {
+  if (!user) return false;
+  if (user.isSuperAdmin) return true;
+  if (!user.isAdmin) return false;
+
+  try {
+    const { getAppSettings } = await import("@/app/_server/actions/config");
+    const settings = await getAppSettings();
+    if (!settings.success || !settings.data) {
+      console.error("Content access settings unreadable, refusing admin peek");
+      return false;
+    }
+    return settings.data.adminContentAccess !== "no";
+  } catch (error) {
+    console.error("Error checking content access:", error);
+    return false;
+  }
+};
diff --git a/app/_server/actions/lib/file-title.ts b/app/_server/actions/lib/file-title.ts
new file mode 100644
index 000000000..ea2100c42
--- /dev/null
+++ b/app/_server/actions/lib/file-title.ts
@@ -0,0 +1,23 @@
+import fs from "fs/promises";
+import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+import { titleOf } from "@/app/_utils/title-utils";
+
+const _hasStored = (metadata?: Record<string, unknown> | null): boolean => {
+  const stored = metadata?.title;
+  return typeof stored === "number" || (typeof stored === "string" && stored.trim() !== "");
+};
+
+export const titleFromFile = async (
+  metadata: Record<string, unknown> | null | undefined,
+  filePath: string,
+  fileId: string,
+): Promise<string> => {
+  if (_hasStored(metadata)) return titleOf(metadata, "", fileId);
+  try {
+    const parsed = extractYamlMetadata(await fs.readFile(filePath, "utf-8"));
+    return titleOf(parsed.metadata, parsed.contentWithoutMetadata, fileId);
+  } catch (error) {
+    console.warn(`Could not read ${filePath} for its title:`, error);
+    return titleOf(metadata, "", fileId);
+  }
+};
diff --git a/app/_server/actions/lib/howto-docs.ts b/app/_server/actions/lib/howto-docs.ts
new file mode 100644
index 000000000..4ba3fa2f7
--- /dev/null
+++ b/app/_server/actions/lib/howto-docs.ts
@@ -0,0 +1,27 @@
+import { readFile } from "@/app/_server/actions/file";
+import { getHowtoFilePath, getHowtoGuides } from "@/app/_utils/howto-utils";
+import { leadingHeading } from "@/app/_utils/title-utils";
+
+export interface HowtoDoc {
+  id: string;
+  title: string;
+  content: string;
+}
+
+const _keyOnly = (key: string) => key;
+
+export const readHowto = async (id: string): Promise<HowtoDoc | null> => {
+  const guide = getHowtoGuides(_keyOnly).find((entry) => entry.id === id);
+  if (!guide) return null;
+  const content = await readFile(getHowtoFilePath(guide.filename));
+  if (!content) {
+    console.warn(`Howto guide ${guide.filename} is missing or empty`);
+    return null;
+  }
+  return { id: guide.id, title: leadingHeading(content) ?? guide.id, content };
+};
+
+export const listHowtos = async (): Promise<Array<Omit<HowtoDoc, "content">>> => {
+  const docs = await Promise.all(getHowtoGuides(_keyOnly).map((guide) => readHowto(guide.id)));
+  return docs.filter((doc): doc is HowtoDoc => doc !== null).map(({ id, title }) => ({ id, title }));
+};
diff --git a/app/_server/actions/lib/uuid-keeper.ts b/app/_server/actions/lib/uuid-keeper.ts
new file mode 100644
index 000000000..24f107dd3
--- /dev/null
+++ b/app/_server/actions/lib/uuid-keeper.ts
@@ -0,0 +1,66 @@
+import nodeFs from "fs";
+import path from "path";
+import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+
+const NEWEST = Number.POSITIVE_INFINITY;
+
+declare global {
+  var __jottyClashWarned: Set<string> | undefined;
+}
+
+const _createdOf = (filePath: string): number => {
+  try {
+    const { metadata } = extractYamlMetadata(nodeFs.readFileSync(filePath, "utf-8"));
+    const raw = metadata.createdAt;
+    const stamp =
+      raw instanceof Date ? raw.getTime() : typeof raw === "string" ? Date.parse(raw) : NaN;
+    return Number.isFinite(stamp) ? stamp : NEWEST;
+  } catch (error) {
+    console.warn(`Could not read ${filePath} to settle a duplicate uuid:`, error);
+    return NEWEST;
+  }
+};
+
+const _byPath = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
+
+export const rankClaims = (paths: string[]): string[] =>
+  Array.from(new Set(paths.map((claim) => path.resolve(claim))))
+    .map((claim) => ({ claim, created: _createdOf(claim) }))
+    .sort((a, b) => a.created - b.created || _byPath(a.claim, b.claim))
+    .map(({ claim }) => claim);
+
+export const warnClash = (uuid: string, ranked: string[]) => {
+  const warned = (globalThis.__jottyClashWarned ??= new Set());
+  const key = `${uuid}|${ranked.join("|")}`;
+  if (warned.has(key)) return;
+  warned.add(key);
+  console.warn(
+    `Duplicate uuid ${uuid}: ${ranked[0]} keeps it, also claimed by ${ranked.slice(1).join(", ")}`,
+  );
+};
+
+interface Claimant {
+  uuid?: string;
+  id?: string;
+  category?: string;
+}
+
+export const dropClashes = <T extends Claimant>(items: T[], dir: string): T[] => {
+  const byUuid = new Map<string, T[]>();
+  items.forEach((item) => {
+    if (!item.uuid || !item.id) return;
+    const key = item.uuid.toLowerCase();
+    byUuid.set(key, [...(byUuid.get(key) || []), item]);
+  });
+
+  const losers = new Set<T>();
+  byUuid.forEach((claimants, uuid) => {
+    if (claimants.length < 2) return;
+    const pathOf = (item: T) => path.resolve(dir, item.category || "", `${item.id}.md`);
+    const ranked = rankClaims(claimants.map(pathOf));
+    warnClash(uuid, ranked);
+    claimants.filter((item) => pathOf(item) !== ranked[0]).forEach((item) => losers.add(item));
+  });
+
+  return losers.size ? items.filter((item) => !losers.has(item)) : items;
+};
diff --git a/app/_server/actions/note/editor.ts b/app/_server/actions/note/editor.ts
index 66cf9e368..669a3d156 100644
--- a/app/_server/actions/note/editor.ts
+++ b/app/_server/actions/note/editor.ts
@@ -283,29 +283,6 @@ export const editNote = async (
     _editNote(actor, formData, autosaveNotes),
   );
 
-export const NOTE_UNCHANGED = "Nothing to change";
-export const NOTE_ENCRYPTED = "Encrypted notes stay closed";
-
-export const rewriteNote = async (
-  actor: SanitisedUser,
-  uuid: string,
-  rewrite: (content: string) => string | null,
-) =>
-  runQueued(itemLane(Modes.NOTES, uuid), async () => {
-    const note = await getNoteById(uuid);
-    if (!note) return { error: "Note not found" };
-    if (note.encrypted) return { error: NOTE_ENCRYPTED };
-
-    const content = rewrite(note.content || "");
-    if (content === null) return { error: NOTE_UNCHANGED };
-
-    const formData = new FormData();
-    formData.append("uuid", note.uuid || uuid);
-    formData.append("title", note.title);
-    formData.append("content", content);
-    return _editNote(actor, formData, false);
-  });
-
 const _dropNote = async (
   currentUser: SanitisedUser,
   formData: FormData,
diff --git a/app/_server/actions/note/queries.ts b/app/_server/actions/note/queries.ts
index 836f074ca..66fb7e3a2 100644
--- a/app/_server/actions/note/queries.ts
+++ b/app/_server/actions/note/queries.ts
@@ -18,6 +18,7 @@ import { mountsFor, mountedItems } from "@/app/_server/actions/share/mounts";
 import { canReachFile } from "@/app/_server/actions/share/access";
 import { isDebugFlag } from "@/app/_utils/env-utils";
 import { getOrCompute, metaCacheKey } from "@/app/_server/actions/lib/metadata-cache";
+import { dropClashes } from "@/app/_server/actions/lib/uuid-keeper";
 
 export const getAllNotes = async (allowArchived?: boolean) => {
   try {
@@ -211,7 +212,7 @@ export const getUserNotes = async (options: GetNotesOptions = {}) => {
         undefined,
       );
 
-    const notes: Note[] = [...cached];
+    const notes: Note[] = dropClashes(cached, resolvedDir);
 
     if (layoutTiming && isDebugFlag("crud")) {
       console.warn(
diff --git a/app/_server/actions/note/readers.ts b/app/_server/actions/note/readers.ts
index 5a6cb560e..4c556cd2e 100644
--- a/app/_server/actions/note/readers.ts
+++ b/app/_server/actions/note/readers.ts
@@ -25,6 +25,7 @@ import { parseMarkdownNote } from "./parsers";
 import { Note } from "@/app/_types";
 import { boxedShell } from "@/app/_utils/shell-utils";
 import { lacksUuid, stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
+import { titleFromFile } from "@/app/_server/actions/lib/file-title";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 
 export const readNotesRecursively = async (
@@ -206,7 +207,7 @@ export const readNotesRecursively = async (
         return {
           id,
           uuid,
-          title: typeof metadata?.title === "string" ? metadata.title : id,
+          title: await titleFromFile(metadata, filePath, id),
           category: categoryPath,
           createdAt: createdAtOf(metadata, stats.birthtime),
           updatedAt: toIso(stats.mtime),
@@ -238,7 +239,7 @@ export const readNotesRecursively = async (
         return {
           id,
           uuid,
-          title: typeof metadata?.title === "string" ? metadata.title : id,
+          title: await titleFromFile(metadata, filePath, id),
           content: excerpt,
           category: categoryPath,
           createdAt: createdAtOf(metadata, stats.birthtime),
diff --git a/app/_server/actions/note/splice.ts b/app/_server/actions/note/splice.ts
new file mode 100644
index 000000000..1ec6ad3bb
--- /dev/null
+++ b/app/_server/actions/note/splice.ts
@@ -0,0 +1,143 @@
+import path from "path";
+import fs from "fs/promises";
+import { revalidatePath } from "next/cache";
+import type { Result, SanitisedUser } from "@/app/_types";
+import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import { NOTES_DIR } from "@/app/_consts/files";
+import { UNCATEGORIZED, isManaged } from "@/app/_consts/notes";
+import { serverWriteFile } from "@/app/_server/actions/file";
+import { canReach } from "@/app/_server/actions/share/queries";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { getUserByNoteUuid } from "@/app/_server/actions/users";
+import { commitNote } from "@/app/_server/actions/history";
+import { logContentEvent } from "@/app/_server/actions/log";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { grepFindFileByUuid } from "@/app/_utils/grep-utils";
+import { isEncrypted } from "@/app/_utils/encryption-utils";
+import { extractHashtagsFromContent, normalizeTag } from "@/app/_utils/tag-utils";
+import {
+  extractYamlMetadata,
+  generateYamlFrontmatter,
+  splitFrontmatter,
+} from "@/app/_utils/yaml-metadata-utils";
+import { titleOf } from "@/app/_utils/title-utils";
+
+export const SPLICE_UNCHANGED = "Nothing to change";
+export const SPLICE_ENCRYPTED = "Encrypted notes stay closed";
+export const SPLICE_MISSING = "Note not found";
+export const SPLICE_DENIED = "Permission denied";
+
+export type SpliceEdit = { body: string } | { error: string };
+
+export interface Spliced {
+  uuid: string;
+  title: string;
+  category: string;
+  tags: string[];
+  managed: boolean;
+}
+
+const _tagSet = (body: string): Set<string> => new Set(extractHashtagsFromContent(body));
+
+const _storedTags = (metadata: Record<string, unknown>): string[] =>
+  Array.isArray(metadata.tags) ? metadata.tags.map((tag) => normalizeTag(String(tag))).filter(Boolean) : [];
+
+const _retagged = (metadata: Record<string, unknown>, before: string, after: string): string[] | null => {
+  const was = _tagSet(before);
+  const now = _tagSet(after);
+  const added = [...now].filter((tag) => !was.has(tag));
+  const dropped = new Set([...was].filter((tag) => !now.has(tag)));
+  if (!added.length && !dropped.size) return null;
+  const kept = _storedTags(metadata).filter((tag) => !dropped.has(tag));
+  return Array.from(new Set([...kept, ...added])).sort();
+};
+
+const _nextTags = (
+  metadata: Record<string, unknown>,
+  before: string,
+  after: string,
+  untag: string[],
+): string[] | null => {
+  const retagged = _retagged(metadata, before, after);
+  const base = retagged ?? _storedTags(metadata);
+  const kept = base.filter((tag) => !untag.includes(tag));
+  return retagged || kept.length !== base.length ? kept : null;
+};
+
+const _frontmatter = (prefix: string, metadata: Record<string, unknown>, tags: string[] | null): string => {
+  if (!tags) return prefix;
+  const { tags: _old, ...rest } = metadata;
+  return generateYamlFrontmatter(tags.length ? { ...rest, tags } : rest);
+};
+
+const _afterWrite = async (actor: SanitisedUser, owner: string, filePath: string, spliced: Spliced) => {
+  const relative = path.relative(path.join(process.cwd(), NOTES_DIR(owner)), filePath);
+  commitNote(owner, relative, "update", spliced.title).catch((error) =>
+    console.warn("Note history commit failed after a splice:", error),
+  );
+  await logContentEvent("note_updated", "note", spliced.uuid, spliced.title, true);
+  try {
+    revalidatePath(`/note/${spliced.uuid}`);
+  } catch (error) {
+    console.warn("Cache revalidation failed after a splice, the note was saved:", error);
+  }
+  await broadcast({ type: "note", action: "updated", entityId: spliced.uuid, username: actor.username });
+};
+
+export interface SpliceOptions {
+  untag?: string[];
+}
+
+const _splice = async (
+  actor: SanitisedUser,
+  uuid: string,
+  edit: (body: string) => SpliceEdit,
+  { untag = [] }: SpliceOptions,
+): Promise<Result<Spliced>> => {
+  const owner = await getUserByNoteUuid(uuid);
+  if (!owner.success || !owner.data) return { success: false, error: SPLICE_MISSING };
+  const found = await grepFindFileByUuid(path.join(process.cwd(), NOTES_DIR(owner.data.username)), uuid);
+  if (!found) return { success: false, error: SPLICE_MISSING };
+
+  const raw = await fs.readFile(found.filePath, "utf-8");
+  const { prefix, body } = splitFrontmatter(raw);
+  const { metadata } = extractYamlMetadata(raw);
+  if (metadata.encrypted === true || isEncrypted(body)) return { success: false, error: SPLICE_ENCRYPTED };
+
+  const result = edit(body);
+  if ("error" in result) return { success: false, error: result.error };
+  const retagged = _nextTags(metadata, body, result.body, untag);
+  if (result.body === body && !retagged) return { success: false, error: SPLICE_UNCHANGED };
+
+  const next = _frontmatter(prefix, metadata, retagged) + result.body;
+  await serverWriteFile(found.filePath, next);
+
+  const spliced = {
+    uuid,
+    title: titleOf(metadata, body, found.id),
+    category: found.category || UNCATEGORIZED,
+    tags: retagged ?? _storedTags(metadata),
+    managed: isManaged(metadata),
+  };
+  await _afterWrite(actor, owner.data.username, found.filePath, spliced);
+  return { success: true, data: spliced };
+};
+
+export const spliceNote = async (
+  actor: SanitisedUser,
+  uuid: string,
+  edit: (body: string) => SpliceEdit,
+  options: SpliceOptions = {},
+): Promise<Result<Spliced>> => {
+  const allowed = await canReach(uuid, ItemTypes.NOTE, actor.username, PermissionTypes.EDIT);
+  if (!allowed) return { success: false, error: SPLICE_DENIED };
+
+  return runQueued(itemLane(Modes.NOTES, uuid), async () => {
+    try {
+      return await _splice(actor, uuid, edit, options);
+    } catch (error) {
+      console.error(`spliceNote failed for ${uuid}:`, error);
+      return { success: false, error: "Failed to update note" };
+    }
+  });
+};
diff --git a/app/_server/actions/relations/explore.ts b/app/_server/actions/relations/explore.ts
index f161855fd..de3bba9a3 100644
--- a/app/_server/actions/relations/explore.ts
+++ b/app/_server/actions/relations/explore.ts
@@ -1,5 +1,7 @@
 import { getSettings } from "@/app/_server/actions/config";
-import { NOTE_UNCHANGED, rewriteNote } from "@/app/_server/actions/note/editor";
+import { spliceNote, type SpliceEdit } from "@/app/_server/actions/note/splice";
+import { unlinkItem } from "@/app/_utils/item-links";
+import { isUuid } from "@/app/_consts/identity";
 import { canReach } from "@/app/_server/actions/share/queries";
 import { itemHref } from "@/app/_utils/global-utils";
 import { escapeLinkText } from "@/app/_utils/item-href-utils";
@@ -26,6 +28,8 @@ import type {
   SuggestedItem,
 } from "@/app/_types/relations";
 import { backlinksFor, graphFor, visibleItems, type VisibleItem } from "./queries";
+import { freshRelations } from "./freshen";
+import { appOrigins } from "./paths";
 import { relationsDb } from "./store";
 import { wrapMention } from "./tidy";
 
@@ -73,17 +77,34 @@ const _outgoing = (uuid: string, visible: Map<string, VisibleItem>) => {
   };
 };
 
+const VIA_MAX = 5;
+
+const _sharedVia = (graph: BrainGraph) => {
+  const around = _adjacency(graph.edges.filter((edge) => edge.kind !== BrainEdgeKinds.SUGGESTED));
+  const titles = new Map(graph.nodes.map((node) => [node.id, node.title]));
+  return (a: string, b: string): string[] => {
+    const theirs = around.get(b) || new Set<string>();
+    return Array.from(around.get(a) || [])
+      .filter((id) => theirs.has(id))
+      .map((id) => titles.get(id) || id)
+      .sort((x, y) => x.localeCompare(y))
+      .slice(0, VIA_MAX);
+  };
+};
+
 const _suggestionsFor = (
   uuid: string,
   graph: BrainGraph,
   visible: Map<string, VisibleItem>,
-): SuggestedItem[] =>
-  graph.edges
+): SuggestedItem[] => {
+  const via = _sharedVia(graph);
+  return graph.edges
     .filter((edge) => edge.kind === BrainEdgeKinds.SUGGESTED && (edge.source === uuid || edge.target === uuid))
     .map((edge) => ({ other: visible.get(edge.source === uuid ? edge.target : edge.source), score: edge.weight }))
     .filter((entry): entry is { other: VisibleItem; score: number } => Boolean(entry.other))
-    .map(({ other, score }) => ({ ..._linked(other), score }))
-    .sort((a, b) => b.score - a.score);
+    .map(({ other, score }) => ({ ..._linked(other), score, via: via(uuid, other.uuid) }))
+    .sort((a, b) => b.score - a.score || b.via.length - a.via.length);
+};
 
 export const relatedFor = async (
   actor: SanitisedUser,
@@ -92,6 +113,7 @@ export const relatedFor = async (
   if (!(await linksEnabled())) return { success: false, error: LINKS_OFF };
 
   const target = uuid.toLowerCase();
+  await freshRelations([target]);
   const visible = await visibleItems(actor.username);
   const item = visible.get(target);
   if (!item) return { success: false, error: NOT_VISIBLE };
@@ -172,8 +194,9 @@ export const neighbourhoodFor = async (
 ): Promise<Result<Neighbourhood>> => {
   if (!(await linksEnabled())) return { success: false, error: LINKS_OFF };
 
-  const visible = await visibleItems(actor.username);
   const centre = focus?.toLowerCase();
+  await freshRelations(centre ? [centre] : []);
+  const visible = await visibleItems(actor.username);
   if (centre && !visible.has(centre)) return { success: false, error: NOT_VISIBLE };
 
   const graph = graphFor(actor.username, visible);
@@ -235,6 +258,7 @@ export const orphansFor = async (
   { type, limit, offset }: OrphanOptions,
 ): Promise<Result<{ status: RelationsStatus; orphans: LinkedItem[]; total: number }>> => {
   if (!(await linksEnabled())) return { success: false, error: LINKS_OFF };
+  await freshRelations();
 
   const visible = await visibleItems(actor.username);
   const graph = graphFor(actor.username, visible);
@@ -261,43 +285,93 @@ export const orphansFor = async (
   };
 };
 
-const _appendLink = (title: string, href: string) => (content: string) =>
-  `${content.trimEnd()}\n\n[${escapeLinkText(title)}](${href})\n`;
+export const MENTION_MISSING = "Mention not found";
+export const LINK_MISSING = "The source note has no link to that item";
 
-const _wrapFirst = (title: string, href: string) => (content: string) =>
-  wrapMention(content, title, href);
+const _eolOf = (body: string): string => (body.includes("\r\n") ? "\r\n" : "\n");
 
-export const MENTION_MISSING = "Mention not found";
+const _appendLink = (title: string, href: string) => (body: string): SpliceEdit => {
+  const eol = _eolOf(body);
+  const kept = body.trimEnd();
+  const gap = kept ? `${eol}${eol}` : "";
+  return { body: `${kept}${gap}[${escapeLinkText(title)}](${href})${body.slice(kept.length) || eol}` };
+};
+
+const _wrapFirst = (title: string, href: string) => (body: string): SpliceEdit => {
+  const wrapped = wrapMention(body, title, href);
+  return wrapped === null || wrapped === body ? { error: MENTION_MISSING } : { body: wrapped };
+};
+
+export interface LinkWrite {
+  managed: boolean;
+}
+
+export interface UnlinkWrite extends LinkWrite {
+  removed: number;
+  wikiLinks: number;
+}
+
+const _noteSource = async (actor: SanitisedUser, sourceUuid: string) => {
+  const visible = await visibleItems(actor.username);
+  const from = visible.get(sourceUuid.toLowerCase());
+  return { visible, from: from?.type === ItemTypes.NOTE ? from : undefined };
+};
 
 export const linkItems = async (
   actor: SanitisedUser,
   sourceUuid: string,
   targetUuid: string,
   style: LinkStyles,
-): Promise<Result<null>> => {
+): Promise<Result<LinkWrite>> => {
   if (!(await linksEnabled())) return { success: false, error: LINKS_OFF };
 
-  const source = sourceUuid.toLowerCase();
-  const visible = await visibleItems(actor.username);
+  const { visible, from } = await _noteSource(actor, sourceUuid);
   const target = visible.get(targetUuid.toLowerCase());
-  const from = visible.get(source);
-  if (!target || !from || from.type !== ItemTypes.NOTE) return { success: false, error: NOT_VISIBLE };
-  if (source === target.uuid) return { success: false, error: "An item can't link to itself" };
+  if (!target || !from) return { success: false, error: NOT_VISIBLE };
+  if (from.uuid === target.uuid) return { success: false, error: "An item can't link to itself" };
 
-  const allowed = await canReach(source, ItemTypes.NOTE, actor.username, PermissionTypes.EDIT);
+  const allowed = await canReach(from.uuid, ItemTypes.NOTE, actor.username, PermissionTypes.EDIT);
   if (!allowed) return { success: false, error: DENIED };
 
   const href = itemHref(target.type, target.uuid);
-  const rewrite =
+  const edit =
     style === LinkStyles.MENTION ? _wrapFirst(target.title, href) : _appendLink(target.title, href);
 
-  try {
-    const result = await rewriteNote(actor, source, rewrite);
-    if (result.error === NOTE_UNCHANGED) return { success: false, error: MENTION_MISSING };
-    if (result.error) return { success: false, error: result.error };
-    return { success: true, data: null };
-  } catch (error) {
-    console.error("linkItems failed:", error);
-    return { success: false, error: "Failed to connect items" };
-  }
+  const result = await spliceNote(actor, from.uuid, edit);
+  if (!result.success || !result.data) return { success: false, error: result.error };
+  return { success: true, data: { managed: result.data.managed } };
+};
+
+const _wikiLinksLeft = (source: string, target: string): number => {
+  const row = relationsDb()
+    .prepare("SELECT COUNT(*) AS n FROM links WHERE src = ? AND dst = ? AND kind = ?")
+    .get(source, target, LinkKinds.WIKI) as { n: number };
+  return row.n;
+};
+
+export const unlinkItems = async (
+  actor: SanitisedUser,
+  sourceUuid: string,
+  targetUuid: string,
+): Promise<Result<UnlinkWrite>> => {
+  if (!(await linksEnabled())) return { success: false, error: LINKS_OFF };
+  if (!isUuid(targetUuid)) return { success: false, error: NOT_VISIBLE };
+
+  const { from } = await _noteSource(actor, sourceUuid);
+  if (!from) return { success: false, error: NOT_VISIBLE };
+
+  const target = targetUuid.toLowerCase();
+  const origins = appOrigins();
+  let removed = 0;
+  const result = await spliceNote(actor, from.uuid, (body) => {
+    const unlinked = unlinkItem(body, target, origins);
+    removed = unlinked.removed;
+    return removed ? { body: unlinked.text } : { error: LINK_MISSING };
+  });
+  if (!result.success || !result.data) return { success: false, error: result.error };
+
+  return {
+    success: true,
+    data: { removed, managed: result.data.managed, wikiLinks: _wikiLinksLeft(from.uuid, target) },
+  };
 };
diff --git a/app/_server/actions/relations/freshen.ts b/app/_server/actions/relations/freshen.ts
new file mode 100644
index 000000000..979ffc91d
--- /dev/null
+++ b/app/_server/actions/relations/freshen.ts
@@ -0,0 +1,12 @@
+import { refreshItems, settleRelations } from "./indexer";
+import { flushRelationsWatch } from "./watcher";
+
+export const freshRelations = async (uuids: string[] = []): Promise<void> => {
+  try {
+    await flushRelationsWatch();
+    await settleRelations();
+    await refreshItems(uuids);
+  } catch (error) {
+    console.error("Relations could not catch up before answering:", error);
+  }
+};
diff --git a/app/_server/actions/relations/indexer.ts b/app/_server/actions/relations/indexer.ts
index 61b1b50f5..e215f0601 100644
--- a/app/_server/actions/relations/indexer.ts
+++ b/app/_server/actions/relations/indexer.ts
@@ -1,16 +1,19 @@
 import fs from "fs/promises";
+import nodeFs from "fs";
 import path from "path";
 import type { DatabaseSync } from "node:sqlite";
 import { LinkKinds, RelationsStatus } from "@/app/_consts/relations";
 import { isUuid } from "@/app/_consts/identity";
 import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+import { titleOf } from "@/app/_utils/title-utils";
 import { isEncrypted } from "@/app/_utils/encryption-utils";
 import { singleFlight } from "@/app/_server/actions/lib/concurrency";
 import { pathUuid } from "@/app/_server/actions/lib/read-only";
 import { getAllFileStats } from "@/app/_server/actions/file";
+import { rankClaims, warnClash } from "@/app/_server/actions/lib/uuid-keeper";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { readLinks, titleKey } from "./parser";
-import { itemFileInfo, itemTreeRoots } from "./paths";
+import { appOrigins, itemFileInfo, itemTreeRoots } from "./paths";
 import { searchableOf } from "./searchable";
 import {
   inTransaction,
@@ -22,14 +25,6 @@ import {
 const RELATIONS_ACTOR = "system";
 const RECONCILE_EVERY_MS = 60_000;
 
-const _origins = (): string[] => {
-  try {
-    return process.env.APP_URL ? [new URL(process.env.APP_URL).origin] : [];
-  } catch {
-    return [];
-  }
-};
-
 const _tally = (keys: string[]): Map<string, number> => {
   const counts = new Map<string, number>();
   keys.forEach((key) => counts.set(key, (counts.get(key) || 0) + 1));
@@ -122,6 +117,32 @@ const _releaseTargets = (db: DatabaseSync, uuids: string[]) => {
   });
 };
 
+const _rivalOf = (uuid: string, absPath: string): { path: string; mtime: number } | null => {
+  const row = relationsDb()
+    .prepare("SELECT path, mtime FROM items WHERE uuid = ? AND path <> ?")
+    .get(uuid, absPath) as { path: string; mtime: number } | undefined;
+  return row && nodeFs.existsSync(row.path) ? row : null;
+};
+
+const _noteClash = (db: DatabaseSync, filePath: string, uuid: string, mtime: number) =>
+  db.prepare("INSERT OR REPLACE INTO clashes (path, uuid, mtime) VALUES (?, ?, ?)").run(filePath, uuid, mtime);
+
+const _promoteClaims = (uuids: string[]) => {
+  if (!uuids.length) return;
+  const claims = relationsDb()
+    .prepare("SELECT path FROM clashes WHERE uuid IN (SELECT value FROM json_each(?))")
+    .all(JSON.stringify(uuids)) as { path: string }[];
+  claims.forEach(({ path: claim }) => {
+    relationsDb().prepare("DELETE FROM clashes WHERE path = ?").run(claim);
+    try {
+      const mtime = Math.floor(nodeFs.statSync(claim).mtimeMs);
+      indexItemFile(claim, nodeFs.readFileSync(claim, "utf-8"), mtime);
+    } catch (error) {
+      console.error(`Relations could not promote ${claim} after its rival went away:`, error);
+    }
+  });
+};
+
 export const indexItemFile = (
   filePath: string,
   content: string,
@@ -136,13 +157,10 @@ export const indexItemFile = (
     typeof metadata.uuid === "string" ? metadata.uuid.toLowerCase() : pathUuid(absPath);
   if (!isUuid(uuid)) return null;
 
-  const title =
-    typeof metadata.title === "string" && metadata.title.trim()
-      ? metadata.title.trim()
-      : path.basename(absPath, ".md");
+  const title = titleOf(metadata, contentWithoutMetadata, path.basename(absPath, ".md"));
   const key = titleKey(title);
   const encrypted = metadata.encrypted === true || isEncrypted(contentWithoutMetadata);
-  const origins = _origins();
+  const origins = appOrigins();
   const parsed = encrypted
     ? { targets: [], wikis: [], text: "", readable: "" }
     : readLinks(contentWithoutMetadata, origins);
@@ -157,12 +175,23 @@ export const indexItemFile = (
   );
   const wikiLabels = _wikiLabels(parsed.wikis);
   const wikis = _tally(parsed.wikis.map(titleKey).filter(Boolean));
+  const rival = _rivalOf(uuid, absPath);
+  const ranked = rival ? rankClaims([rival.path, absPath]) : [absPath];
+  if (rival) warnClash(uuid, ranked);
+  const loses = ranked[0] !== absPath;
 
-  inTransaction((db) => {
-    const displaced = db
+  const displaced = inTransaction((db) => {
+    const gone = db
       .prepare("SELECT uuid FROM items WHERE path = ? AND uuid <> ?")
       .all(absPath, uuid) as { uuid: string }[];
-    displaced.forEach((row) => _forgetUuid(db, row.uuid));
+    gone.forEach((row) => _forgetUuid(db, row.uuid));
+
+    if (loses) {
+      _noteClash(db, absPath, uuid, mtime);
+      return gone;
+    }
+    if (rival) _noteClash(db, rival.path, uuid, rival.mtime);
+    db.prepare("DELETE FROM clashes WHERE path = ?").run(absPath);
 
     db.prepare(
       `INSERT INTO items (uuid, path, owner, type, title, title_key, encrypted, created, mtime)
@@ -206,9 +235,11 @@ export const indexItemFile = (
         searchable.extra,
       );
     }
+    return gone;
   });
 
-  return uuid;
+  _promoteClaims(displaced.map((row) => row.uuid));
+  return loses ? null : uuid;
 };
 
 const _forgetUuid = (db: DatabaseSync, uuid: string) => {
@@ -220,12 +251,15 @@ const _forgetUuid = (db: DatabaseSync, uuid: string) => {
 };
 
 const _forgetWhere = (where: string, value: string) => {
-  inTransaction((db) => {
+  const forgotten = inTransaction((db) => {
+    db.prepare(`DELETE FROM clashes WHERE ${where}`).run(value);
     const rows = db.prepare(`SELECT uuid FROM items WHERE ${where}`).all(value) as {
       uuid: string;
     }[];
     rows.forEach((row) => _forgetUuid(db, row.uuid));
+    return rows.map((row) => row.uuid);
   });
+  _promoteClaims(forgotten);
 };
 
 export const forgetItemFile = (filePath: string) =>
@@ -263,7 +297,9 @@ export const indexItemTree = async (dir: string) => {
 };
 
 const _indexedMtimes = (): Map<string, number> => {
-  const rows = relationsDb().prepare("SELECT path, mtime FROM items").all() as {
+  const rows = relationsDb()
+    .prepare("SELECT path, mtime FROM items UNION ALL SELECT path, mtime FROM clashes")
+    .all() as {
     path: string;
     mtime: number;
   }[];
@@ -403,3 +439,19 @@ export const ensureRelations = (): RelationsStatus => {
   }
   return status;
 };
+
+export const settleRelations = async (): Promise<void> => {
+  if (relationsStatus() === RelationsStatus.BUILDING) return;
+  if (globalThis.__jottyRelationsWatch?.healthy) return;
+  if (Date.now() - (globalThis.__jottyRelationsCheckedAt || 0) <= RECONCILE_EVERY_MS) return;
+  globalThis.__jottyRelationsCheckedAt = Date.now();
+  await reconcileRelations();
+};
+
+export const refreshItems = async (uuids: string[]): Promise<number> => {
+  if (!uuids.length) return 0;
+  const rows = relationsDb()
+    .prepare("SELECT path FROM items WHERE uuid IN (SELECT value FROM json_each(?))")
+    .all(JSON.stringify(uuids.map((uuid) => uuid.toLowerCase()))) as { path: string }[];
+  return refreshItemPaths(rows.map((row) => row.path));
+};
diff --git a/app/_server/actions/relations/paths.ts b/app/_server/actions/relations/paths.ts
index 63828a841..04428864f 100644
--- a/app/_server/actions/relations/paths.ts
+++ b/app/_server/actions/relations/paths.ts
@@ -39,3 +39,12 @@ export const itemFileInfo = (filePath: string): ItemFileInfo | null => {
 
 export const isItemFile = (filePath: string): boolean =>
   itemFileInfo(filePath) !== null;
+
+export const appOrigins = (): string[] => {
+  try {
+    return process.env.APP_URL ? [new URL(process.env.APP_URL).origin] : [];
+  } catch (error) {
+    console.warn("APP_URL is not a valid URL, same-origin links are skipped:", error);
+    return [];
+  }
+};
diff --git a/app/_server/actions/relations/store.ts b/app/_server/actions/relations/store.ts
index 222a93959..516269049 100644
--- a/app/_server/actions/relations/store.ts
+++ b/app/_server/actions/relations/store.ts
@@ -44,6 +44,12 @@ const SCHEMA = `
     PRIMARY KEY (src, text)
   );
   CREATE INDEX IF NOT EXISTS bindings_dst ON bindings(dst);
+  CREATE TABLE IF NOT EXISTS clashes (
+    path TEXT PRIMARY KEY,
+    uuid TEXT NOT NULL,
+    mtime REAL NOT NULL DEFAULT 0
+  );
+  CREATE INDEX IF NOT EXISTS clashes_uuid ON clashes(uuid);
   CREATE VIRTUAL TABLE IF NOT EXISTS texts USING fts5(
     uuid UNINDEXED,
     title,
diff --git a/app/_server/actions/relations/watcher.ts b/app/_server/actions/relations/watcher.ts
index 2c501049b..b032cf35b 100644
--- a/app/_server/actions/relations/watcher.ts
+++ b/app/_server/actions/relations/watcher.ts
@@ -9,6 +9,7 @@ const ARCHIVE_DIR = ".archive";
 
 interface Batcher {
   add: (target: string) => void;
+  flush: () => Promise<void>;
   stop: () => void;
 }
 
@@ -31,15 +32,9 @@ export const throttledBatch = (
   const dirty = new Set<string>();
   let lastFlush = -Infinity;
   let timer: ReturnType<typeof setTimeout> | null = null;
-  let running = false;
+  let running: Promise<void> | null = null;
 
-  const run = async () => {
-    timer = null;
-    if (running) {
-      schedule();
-      return;
-    }
-    running = true;
+  const _drain = async () => {
     lastFlush = now();
     const targets = Array.from(dirty);
     dirty.clear();
@@ -48,11 +43,21 @@ export const throttledBatch = (
     } catch (error) {
       console.error("Relations watch flush failed:", error);
     } finally {
-      running = false;
+      running = null;
       if (dirty.size > 0) schedule();
     }
   };
 
+  const run = async () => {
+    timer = null;
+    if (running) {
+      schedule();
+      return;
+    }
+    running = _drain();
+    await running;
+  };
+
   const schedule = () => {
     if (timer) return;
     const wait = Math.max(settleMs, lastFlush + everyMs - now());
@@ -65,6 +70,13 @@ export const throttledBatch = (
       dirty.add(target);
       schedule();
     },
+    flush: async () => {
+      if (running) await running;
+      if (!dirty.size) return;
+      if (timer) clearTimeout(timer);
+      timer = null;
+      await run();
+    },
     stop: () => {
       if (timer) clearTimeout(timer);
       timer = null;
@@ -120,3 +132,8 @@ export const watchRelations = (): boolean => {
 
   return state.healthy;
 };
+
+export const flushRelationsWatch = async (): Promise<void> => {
+  const state = globalThis.__jottyRelationsWatch;
+  if (state?.healthy) await state.batcher.flush();
+};
diff --git a/app/_server/actions/users/auth.ts b/app/_server/actions/users/auth.ts
index 48ecd9ab8..8b070902f 100644
--- a/app/_server/actions/users/auth.ts
+++ b/app/_server/actions/users/auth.ts
@@ -1,6 +1,7 @@
 "use server";
 
 import { getCurrentUser } from "./queries";
+import { adminPeek } from "@/app/_server/actions/lib/admin-peek";
 
 export const isAuthenticated = async (): Promise<boolean> => {
   const user = await getCurrentUser();
@@ -14,22 +15,7 @@ export const isAdmin = async (): Promise<boolean> => {
 
 export const canAccessAllContent = async (): Promise<boolean> => {
   try {
-    const currentUser = await getCurrentUser();
-    if (!currentUser) return false;
-
-    if (currentUser.isSuperAdmin) return true;
-
-    if (!currentUser.isAdmin) return false;
-
-    const { getAppSettings } = await import("@/app/_server/actions/config");
-    const settingsResult = await getAppSettings();
-
-    if (!settingsResult.success || !settingsResult.data) {
-      console.error("Content access settings unreadable, refusing admin peek");
-      return false;
-    }
-
-    return settingsResult.data.adminContentAccess !== "no";
+    return await adminPeek(await getCurrentUser());
   } catch (error) {
     console.error("Error checking content access:", error);
     return false;
diff --git a/app/_server/actions/uuid-clash/repair.ts b/app/_server/actions/uuid-clash/repair.ts
new file mode 100644
index 000000000..baf3e95aa
--- /dev/null
+++ b/app/_server/actions/uuid-clash/repair.ts
@@ -0,0 +1,145 @@
+import path from "path";
+import fs from "fs/promises";
+import type { Result, SanitisedUser } from "@/app/_types";
+import { ItemTypes, Modes } from "@/app/_types/enums";
+import { serverWriteFile } from "@/app/_server/actions/file";
+import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { broadcast } from "@/app/_server/actions/ws/broadcast";
+import { appOrigins } from "@/app/_server/actions/relations/paths";
+import { titleKey } from "@/app/_server/actions/relations/parser";
+import { isEncrypted } from "@/app/_utils/encryption-utils";
+import { itemLinksTo, retargetLinks, unescapeLabel, type ItemLink } from "@/app/_utils/item-links";
+import { extractYamlMetadata, generateUuid, splitFrontmatter } from "@/app/_utils/yaml-metadata-utils";
+import { boxedShell } from "@/app/_utils/shell-utils";
+import { findClashes, itemRoots, shownPath, type ClashFile, type ItemRoot } from "./scan";
+
+export const NO_CLASH = "No duplicate for that uuid";
+export const NOT_CLAIMANT = "That path does not hold the duplicated uuid";
+
+const FILES_WITH = 'grep -rlF --include="*.md" --exclude-dir=.git -e "$1" -- "$2" 2>/dev/null || true';
+
+export interface Rekeyed {
+  path: string;
+  uuid: string;
+  title: string;
+}
+
+export interface ClashRepair {
+  uuid: string;
+  rekeyed: Rekeyed[];
+  relinked: string[];
+  ambiguous: string[];
+  skipped: string[];
+}
+
+interface Located {
+  root: ItemRoot;
+  filePath: string;
+}
+
+const _modeOf = (type: ItemTypes): Modes => (type === ItemTypes.NOTE ? Modes.NOTES : Modes.CHECKLISTS);
+
+const _locate = (owner: string, shown: string): Located | null => {
+  const root = itemRoots(owner).find((candidate) => shown.startsWith(`${candidate.mode}/`));
+  if (!root) return null;
+  const filePath = path.resolve(root.dir, shown.slice(root.mode.length + 1));
+  return shownPath(root, filePath) === shown ? { root, filePath } : null;
+};
+
+const _uuidLine = (uuid: string) => new RegExp(`^(uuid:[ \\t]*["']?)${uuid}(["']?[ \\t]*\\r?)$`, "im");
+
+const _rekey = async (owner: string, file: ClashFile, uuid: string): Promise<Rekeyed | null> => {
+  const found = _locate(owner, file.path);
+  if (!found) return null;
+  const fresh = generateUuid();
+  return runQueued(itemLane(_modeOf(file.type), uuid), async () => {
+    const { prefix, body } = splitFrontmatter(await fs.readFile(found.filePath, "utf-8"));
+    const swapped = prefix.replace(_uuidLine(uuid), `$1${fresh}$2`);
+    if (swapped === prefix) return null;
+    await serverWriteFile(found.filePath, swapped + body);
+    return { path: file.path, uuid: fresh, title: file.title };
+  });
+};
+
+const _pickLinks = (links: ItemLink[], owner: Rekeyed, stays: Set<string>, rivals: Set<string>) =>
+  links.filter((link) => {
+    const key = titleKey(unescapeLabel(link.label));
+    return key === titleKey(owner.title) && !stays.has(key) && !rivals.has(key);
+  });
+
+const _relink = async (
+  located: Located,
+  uuid: string,
+  moved: Rekeyed[],
+  stays: Set<string>,
+): Promise<"relinked" | "ambiguous" | "skipped" | null> => {
+  const lane = extractYamlMetadata(await fs.readFile(located.filePath, "utf-8")).metadata.uuid;
+  return runQueued(itemLane(located.root.mode, String(lane || located.filePath)), async () => {
+    const raw = await fs.readFile(located.filePath, "utf-8");
+    const { prefix, body } = splitFrontmatter(raw);
+    if (extractYamlMetadata(raw).metadata.encrypted === true || isEncrypted(body)) return "skipped";
+
+    const links = itemLinksTo(body, uuid, appOrigins());
+    if (!links.length) return null;
+    let next = body;
+    let taken = 0;
+    moved.forEach((owner) => {
+      const rivals = new Set(moved.filter((other) => other !== owner).map((other) => titleKey(other.title)));
+      const mine = _pickLinks(itemLinksTo(next, uuid, appOrigins()), owner, stays, rivals);
+      taken += mine.length;
+      next = retargetLinks(next, mine, uuid, owner.uuid);
+    });
+    if (next !== body) await serverWriteFile(located.filePath, prefix + next);
+    if (taken < links.length) return "ambiguous";
+    return taken ? "relinked" : null;
+  });
+};
+
+const _filesLinking = async (owner: string, uuid: string): Promise<Located[]> => {
+  const found = await Promise.all(
+    itemRoots(owner).map(async (root) => {
+      const out = await boxedShell(FILES_WITH, [uuid, root.dir]).catch((error) => {
+        console.error(`Duplicate uuid repair could not search ${root.dir}:`, error);
+        return "";
+      });
+      return out.split("\n").filter(Boolean).map((filePath) => ({ root, filePath }));
+    }),
+  );
+  return found.flat();
+};
+
+const _chosen = (files: ClashFile[], pick?: string): ClashFile[] | null => {
+  if (!pick) return files.filter((file) => !file.keeps);
+  const match = files.filter((file) => file.path === pick);
+  return match.length ? match : null;
+};
+
+export const repairClash = async (
+  actor: SanitisedUser,
+  owner: string,
+  uuid: string,
+  pick?: string,
+): Promise<Result<ClashRepair>> => {
+  const target = uuid.toLowerCase();
+  const clash = (await findClashes(owner)).find((entry) => entry.uuid === target);
+  if (!clash) return { success: false, error: NO_CLASH };
+  const chosen = _chosen(clash.files, pick);
+  if (!chosen) return { success: false, error: NOT_CLAIMANT };
+
+  const rekeyed = (await Promise.all(chosen.map((file) => _rekey(owner, file, target)))).filter(
+    (entry): entry is Rekeyed => entry !== null,
+  );
+  const stays = new Set(
+    clash.files.filter((file) => !chosen.includes(file)).map((file) => titleKey(file.title)),
+  );
+
+  const report: ClashRepair = { uuid: target, rekeyed, relinked: [], ambiguous: [], skipped: [] };
+  for (const located of await _filesLinking(owner, target)) {
+    const outcome = await _relink(located, target, rekeyed, stays);
+    if (outcome) report[outcome].push(shownPath(located.root, located.filePath));
+  }
+
+  await broadcast({ type: "note", action: "updated", username: actor.username });
+  console.info(`Duplicate uuid ${target} repaired for ${owner}:`, JSON.stringify(report));
+  return { success: true, data: report };
+};
diff --git a/app/_server/actions/uuid-clash/scan.ts b/app/_server/actions/uuid-clash/scan.ts
new file mode 100644
index 000000000..05aecabb2
--- /dev/null
+++ b/app/_server/actions/uuid-clash/scan.ts
@@ -0,0 +1,107 @@
+import path from "path";
+import fs from "fs/promises";
+import { CHECKLISTS_DIR, NOTES_DIR } from "@/app/_consts/files";
+import { ItemTypes, Modes } from "@/app/_types/enums";
+import { boxedShell } from "@/app/_utils/shell-utils";
+import { extractYamlMetadata, toIso } from "@/app/_utils/yaml-metadata-utils";
+import { titleOf } from "@/app/_utils/title-utils";
+import { rankClaims } from "@/app/_server/actions/lib/uuid-keeper";
+
+const UUID_LINES = 'grep -rE --include="*.md" --exclude-dir=.git "^uuid:[[:space:]]*[^[:space:]]" -- "$1" 2>/dev/null || true';
+const UUID_MARK = ":uuid:";
+const SCAN_BUFFER = 10 * 1024 * 1024;
+
+export interface ItemRoot {
+  type: ItemTypes;
+  mode: Modes;
+  dir: string;
+}
+
+export interface ClashFile {
+  type: ItemTypes;
+  path: string;
+  title: string;
+  createdAt?: string;
+  keeps: boolean;
+}
+
+export interface UuidClash {
+  uuid: string;
+  owner: string;
+  files: ClashFile[];
+}
+
+interface Claim {
+  root: ItemRoot;
+  filePath: string;
+}
+
+export const itemRoots = (owner: string): ItemRoot[] => [
+  { type: ItemTypes.NOTE, mode: Modes.NOTES, dir: path.join(process.cwd(), NOTES_DIR(owner)) },
+  { type: ItemTypes.CHECKLIST, mode: Modes.CHECKLISTS, dir: path.join(process.cwd(), CHECKLISTS_DIR(owner)) },
+];
+
+export const shownPath = (root: ItemRoot, filePath: string): string =>
+  [root.mode, ...path.relative(root.dir, filePath).split(path.sep)].join("/");
+
+const _claimsIn = async (root: ItemRoot): Promise<Array<[string, Claim]>> => {
+  const out = await boxedShell(UUID_LINES, [root.dir], { maxBuffer: SCAN_BUFFER }).catch((error) => {
+    console.error(`Duplicate uuid scan could not read ${root.dir}:`, error);
+    return "";
+  });
+  return out
+    .split("\n")
+    .filter((line) => line.includes(UUID_MARK))
+    .map((line): [string, Claim] => {
+      const cut = line.lastIndexOf(UUID_MARK);
+      const uuid = line.slice(cut + UUID_MARK.length).trim().replace(/^["']|["']$/g, "").toLowerCase();
+      return [uuid, { root, filePath: line.slice(0, cut) }];
+    });
+};
+
+const _readClaim = async (claim: Claim) => {
+  try {
+    return extractYamlMetadata(await fs.readFile(claim.filePath, "utf-8"));
+  } catch (error) {
+    console.warn(`Duplicate uuid scan could not read ${claim.filePath}:`, error);
+    return null;
+  }
+};
+
+const _createdOf = (raw: unknown): string | undefined =>
+  raw instanceof Date || typeof raw === "string" ? toIso(raw) : undefined;
+
+const _confirmed = async (uuid: string, owner: string, claims: Claim[]): Promise<UuidClash | null> => {
+  const read = await Promise.all(claims.map(_readClaim));
+  const real = claims
+    .map((claim, index) => ({ claim, parsed: read[index] }))
+    .filter(({ parsed }) => String(parsed?.metadata.uuid || "").toLowerCase() === uuid);
+  if (real.length < 2) return null;
+
+  const ranked = rankClaims(real.map(({ claim }) => claim.filePath));
+  const byPath = new Map(real.map((entry) => [path.resolve(entry.claim.filePath), entry]));
+  return {
+    uuid,
+    owner,
+    files: ranked.map((filePath, index) => {
+      const { claim, parsed } = byPath.get(filePath)!;
+      return {
+        type: claim.root.type,
+        path: shownPath(claim.root, filePath),
+        title: titleOf(parsed?.metadata, parsed?.contentWithoutMetadata || "", path.basename(filePath, ".md")),
+        createdAt: _createdOf(parsed?.metadata.createdAt),
+        keeps: index === 0,
+      };
+    }),
+  };
+};
+
+export const findClashes = async (owner: string): Promise<UuidClash[]> => {
+  const claims = (await Promise.all(itemRoots(owner).map(_claimsIn))).flat();
+  const grouped = new Map<string, Claim[]>();
+  claims.forEach(([uuid, claim]) => grouped.set(uuid, [...(grouped.get(uuid) || []), claim]));
+
+  const suspects = Array.from(grouped).filter(([, group]) => group.length > 1);
+  const found = await Promise.all(suspects.map(([uuid, group]) => _confirmed(uuid, owner, group)));
+  return found.filter((clash): clash is UuidClash => clash !== null);
+};
diff --git a/app/_server/api/route-index.ts b/app/_server/api/route-index.ts
index 6ac0dc80c..256ab045c 100644
--- a/app/_server/api/route-index.ts
+++ b/app/_server/api/route-index.ts
@@ -1,3 +1,4 @@
+import * as adminDuplicateUuids from "@/app/api/admin/duplicate-uuids/route";
 import * as adminRebuildIndex from "@/app/api/admin/rebuild-index/route";
 import * as brain from "@/app/api/brain/route";
 import * as categories from "@/app/api/categories/route";
@@ -12,6 +13,8 @@ import * as docs from "@/app/api/docs/route";
 import * as exports from "@/app/api/exports/route";
 import * as exportsFilename from "@/app/api/exports/[filename]/route";
 import * as health from "@/app/api/health/route";
+import * as howto from "@/app/api/howto/route";
+import * as howtoDocId from "@/app/api/howto/[docId]/route";
 import * as kanban from "@/app/api/kanban/route";
 import * as kanbanBoardId from "@/app/api/kanban/[boardId]/route";
 import * as kanbanBoardIdCalendar from "@/app/api/kanban/[boardId]/calendar/route";
@@ -27,6 +30,7 @@ import * as logsExport from "@/app/api/logs/export/route";
 import * as logsStats from "@/app/api/logs/stats/route";
 import * as notes from "@/app/api/notes/route";
 import * as notesNoteId from "@/app/api/notes/[noteId]/route";
+import * as notesNoteIdTags from "@/app/api/notes/[noteId]/tags/route";
 import * as openapiJson from "@/app/api/openapi.json/route";
 import * as relationsItemId from "@/app/api/relations/[itemId]/route";
 import * as relationsLinks from "@/app/api/relations/links/route";
@@ -34,6 +38,7 @@ import * as relationsOrphans from "@/app/api/relations/orphans/route";
 import * as search from "@/app/api/search/route";
 import * as shares from "@/app/api/shares/route";
 import * as summary from "@/app/api/summary/route";
+import * as tags from "@/app/api/tags/route";
 import * as tasks from "@/app/api/tasks/route";
 import * as tasksTaskId from "@/app/api/tasks/[taskId]/route";
 import * as tasksTaskIdItems from "@/app/api/tasks/[taskId]/items/route";
@@ -45,6 +50,7 @@ import * as user from "@/app/api/user/route";
 import * as userUsername from "@/app/api/user/[username]/route";
 
 export const ROUTE_MODULES: object[] = [
+  adminDuplicateUuids,
   adminRebuildIndex,
   brain,
   categories,
@@ -59,6 +65,8 @@ export const ROUTE_MODULES: object[] = [
   exports,
   exportsFilename,
   health,
+  howto,
+  howtoDocId,
   kanban,
   kanbanBoardId,
   kanbanBoardIdCalendar,
@@ -74,6 +82,7 @@ export const ROUTE_MODULES: object[] = [
   logsStats,
   notes,
   notesNoteId,
+  notesNoteIdTags,
   openapiJson,
   relationsItemId,
   relationsLinks,
@@ -81,6 +90,7 @@ export const ROUTE_MODULES: object[] = [
   search,
   shares,
   summary,
+  tags,
   tasks,
   tasksTaskId,
   tasksTaskIdItems,
diff --git a/app/_types/relations.ts b/app/_types/relations.ts
index 90f7a6155..079a2fba1 100644
--- a/app/_types/relations.ts
+++ b/app/_types/relations.ts
@@ -62,6 +62,7 @@ export interface LinkedItem {
 
 export interface SuggestedItem extends LinkedItem {
   score: number;
+  via: string[];
 }
 
 export interface RelationsView extends LinkedItem {
diff --git a/app/_utils/api-note.ts b/app/_utils/api-note.ts
index 1a31e4577..ec278e7bc 100644
--- a/app/_utils/api-note.ts
+++ b/app/_utils/api-note.ts
@@ -1,5 +1,5 @@
 import { Note } from "@/app/_types";
-import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { UNCATEGORIZED, isManaged } from "@/app/_consts/notes";
 import { ListView } from "@/app/_schemas/api/common";
 import { isEncrypted } from "@/app/_utils/encryption-utils";
 
@@ -14,6 +14,8 @@ export interface ApiNote {
   content?: string;
   excerpt?: string;
   encrypted?: boolean;
+  tags?: string[];
+  managed?: boolean;
   createdAt?: string;
   updatedAt?: string;
 }
@@ -50,6 +52,8 @@ export const toApiNote = (note: ListedNote, view: ListView = ListView.FULL): Api
       ? { excerpt: locked ? undefined : noteExcerpt(note.content ?? "") }
       : { content: note.content }),
     ...(locked && { encrypted: true }),
+    tags: note.tags ?? [],
+    ...(isManaged(note.extraMetadata) && { managed: true }),
     createdAt: note.createdAt,
     updatedAt: note.updatedAt,
   };
diff --git a/app/_utils/checklist-utils.ts b/app/_utils/checklist-utils.ts
index 26b0c7354..97cd132b7 100644
--- a/app/_utils/checklist-utils.ts
+++ b/app/_utils/checklist-utils.ts
@@ -95,7 +95,7 @@ export const parseMarkdown = (
 ): Checklist => {
   const { metadata, contentWithoutMetadata } = extractYamlMetadata(content);
 
-  let title = extractTitle(
+  const title = extractTitle(
     content,
     fileName ? path.basename(fileName, ".md") : undefined,
   );
diff --git a/app/_utils/client-parser-utils.ts b/app/_utils/client-parser-utils.ts
index b10eb64ac..70b9d34df 100644
--- a/app/_utils/client-parser-utils.ts
+++ b/app/_utils/client-parser-utils.ts
@@ -12,6 +12,7 @@ import { ChecklistsTypes, isKanbanType, TaskStatus } from "@/app/_types/enums";
 import { parseRecurrenceFromMarkdown } from "@/app/_utils/recurrence-utils";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
 import { extractYamlMetadata, strayMeta } from "./yaml-metadata-utils";
+import { titleOf } from "./title-utils";
 
 export const parseChecklistContent = (
   rawContent: string,
@@ -28,12 +29,7 @@ export const parseChecklistContent = (
 } => {
   const { metadata, contentWithoutMetadata } = extractYamlMetadata(rawContent);
 
-  let title: string;
-  if (metadata.title) {
-    title = metadata.title;
-  } else {
-    title = id.replace(/-/g, " ");
-  }
+  const title = titleOf(metadata, contentWithoutMetadata, id);
 
   const checklistType =
     metadata?.checklistType ||
@@ -314,7 +310,7 @@ export const parseNoteContent = (
   const tags = Array.isArray(metadata.tags) ? metadata.tags : undefined;
 
   return {
-    title: metadata.title || id.replace(/-/g, " "),
+    title: titleOf(metadata, contentWithoutMetadata, id),
     content: contentWithoutMetadata,
     uuid: metadata.uuid,
     encrypted: metadata.encrypted || false,
diff --git a/app/_utils/grep-utils.ts b/app/_utils/grep-utils.ts
index 95b745a20..5b32c89ad 100644
--- a/app/_utils/grep-utils.ts
+++ b/app/_utils/grep-utils.ts
@@ -19,10 +19,12 @@ import yaml from "js-yaml";
 import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
 import { isPathUuid, pathUuid } from "@/app/_server/actions/lib/read-only";
 import { boxedShell } from "@/app/_utils/shell-utils";
+import { rankClaims, warnClash } from "@/app/_server/actions/lib/uuid-keeper";
 
 const execFileAsync = promisify(execFile);
 
 const LINE_BREAK = /[\r\n]/;
+const CR = "\r";
 
 const _fieldLine = (field: string, value: string): string | null =>
   LINE_BREAK.test(value) ? null : `${field}: ${value}`;
@@ -55,8 +57,8 @@ export const grepFindFileByField = async (
 
   try {
     const stdout = await boxedShell(
-      'grep -rlxF --include="*.md" -e "$1" -- "$2" 2>/dev/null | head -1 || true',
-      [line, dir],
+      'grep -rlxF --include="*.md" -e "$1" -e "$3" -- "$2" 2>/dev/null | head -1 || true',
+      [line, dir, `${line}${CR}`],
     );
 
     const filePath = stdout.trim();
@@ -102,11 +104,24 @@ const _findUnstamped = async (
   return match;
 };
 
+const _claimsUuid = async (uuid: string, file: GrepFileResult): Promise<boolean> =>
+  (await _storedUuid(file.filePath))?.toLowerCase() === uuid.toLowerCase();
+
+const _keeperOf = async (uuid: string, found: GrepFileResult[]): Promise<GrepFileResult | null> => {
+  if (found.length < 2) return found[0] || null;
+  const verdicts = await Promise.all(found.map((file) => _claimsUuid(uuid, file)));
+  const claimants = found.filter((_, index) => verdicts[index]);
+  if (claimants.length < 2) return claimants[0] || found[0];
+  const ranked = rankClaims(claimants.map((file) => file.filePath));
+  warnClash(uuid, ranked);
+  return claimants.find((file) => path.resolve(file.filePath) === ranked[0]) || claimants[0];
+};
+
 export const grepFindFileByUuid = async (
   dir: string,
   uuid: string,
 ): Promise<GrepFileResult | null> =>
-  (await grepFindFileByField(dir, "uuid", uuid)) ||
+  (await _keeperOf(uuid, await grepFindFilesByField(dir, "uuid", uuid))) ||
   (await _findUnstamped(dir, uuid));
 
 export const grepFindFilesByField = async (
@@ -119,8 +134,8 @@ export const grepFindFilesByField = async (
 
   try {
     const stdout = await boxedShell(
-      'grep -rlxF --include="*.md" -e "$1" -- "$2" 2>/dev/null || true',
-      [line, dir],
+      'grep -rlxF --include="*.md" -e "$1" -e "$3" -- "$2" 2>/dev/null || true',
+      [line, dir, `${line}${CR}`],
     );
 
     const files = stdout.trim().split("\n").filter(Boolean);
diff --git a/app/_utils/item-links.ts b/app/_utils/item-links.ts
new file mode 100644
index 000000000..b21a39b98
--- /dev/null
+++ b/app/_utils/item-links.ts
@@ -0,0 +1,67 @@
+import { parseItemHref } from "@/app/_utils/item-href-utils";
+import { dropLine, joinLines, lineAt, lineStart, splitLines } from "@/app/_utils/text-lines";
+
+const ITEM_LINK = /\[((?:[^\[\]\\]|\\.)*)\]\(\s*([^()\s]+)(\s+"[^"]*")?\s*\)/g;
+const CODE = /(```|~~~)[\s\S]*?\1|`[^`\r\n]+`/g;
+const BARE_LINE = /^\s*(?:[-*+]\s+|\d+[.)]\s+)?$/;
+
+export interface ItemLink {
+  start: number;
+  end: number;
+  label: string;
+  href: string;
+}
+
+const _codeRanges = (text: string): Array<[number, number]> =>
+  Array.from(text.matchAll(CODE), (match): [number, number] => [match.index, match.index + match[0].length]);
+
+const _inCode = (at: number, ranges: Array<[number, number]>): boolean =>
+  ranges.some(([start, end]) => at >= start && at < end);
+
+export const unescapeLabel = (label: string): string => label.replace(/\\(.)/g, "$1");
+
+export const itemLinksTo = (text: string, uuid: string, origins: string[] = []): ItemLink[] => {
+  const target = uuid.toLowerCase();
+  const code = _codeRanges(text);
+  return Array.from(text.matchAll(ITEM_LINK))
+    .filter((match) => text[match.index - 1] !== "!" && !_inCode(match.index, code))
+    .filter((match) => parseItemHref(match[2], origins)?.uuid === target)
+    .map((match) => ({
+      start: match.index,
+      end: match.index + match[0].length,
+      label: match[1],
+      href: match[2],
+    }));
+};
+
+export const retargetLinks = (
+  text: string,
+  links: ItemLink[],
+  from: string,
+  to: string,
+): string =>
+  [...links]
+    .sort((a, b) => b.start - a.start)
+    .reduce((result, link) => {
+      const hrefAt = link.start + link.label.length + 2;
+      const tail = result.slice(hrefAt, link.end).replace(new RegExp(from, "i"), to);
+      return result.slice(0, hrefAt) + tail + result.slice(link.end);
+    }, text);
+
+const _unlinkOne = (text: string, link: ItemLink): string => {
+  const lines = splitLines(text);
+  const index = lineAt(lines, link.start);
+  const start = lineStart(lines, index);
+  const line = lines[index].text;
+  const rest = line.slice(0, link.start - start) + line.slice(link.end - start);
+  if (BARE_LINE.test(rest)) return joinLines(dropLine(lines, index));
+  return text.slice(0, link.start) + link.label + text.slice(link.end);
+};
+
+export const unlinkItem = (text: string, uuid: string, origins: string[] = []): { text: string; removed: number } => {
+  const links = itemLinksTo(text, uuid, origins).sort((a, b) => b.start - a.start);
+  return {
+    text: links.reduce(_unlinkOne, text),
+    removed: links.length,
+  };
+};
diff --git a/app/_utils/markdown-utils.tsx b/app/_utils/markdown-utils.tsx
index 1e99d908d..7729604e0 100644
--- a/app/_utils/markdown-utils.tsx
+++ b/app/_utils/markdown-utils.tsx
@@ -830,6 +830,19 @@ export const getMarkdownPreviewContent = (
   }
 };
 
+const RISKY_HTML = [
+  /<iframe[\s\S]*?<\/iframe>/gi,
+  /<embed[\s\S]*?>/gi,
+  /<object[\s\S]*?<\/object>/gi,
+  /<script[\s\S]*?<\/script>/gi,
+];
+
+const _escapeTags = (match: string): string =>
+  match.replace(/</g, "&lt;").replace(/>/g, "&gt;");
+
+export const defangHtml = (text: string): string =>
+  RISKY_HTML.reduce((result, pattern) => result.replace(pattern, _escapeTags), text);
+
 export const sanitizeMarkdown = (markdown: string): string => {
   if (!markdown || typeof markdown !== "string") return "";
 
@@ -843,23 +856,7 @@ export const sanitizeMarkdown = (markdown: string): string => {
   );
   result = result.replace(/\\+\[([^\]]+?)\\+\]\\+\(([^)]+?)\\+\)/g, "[$1]($2)");
 
-  result = result.replace(/<iframe[\s\S]*?<\/iframe>/gi, (match) =>
-    match.replace(/</g, "&lt;").replace(/>/g, "&gt;")
-  );
-
-  result = result.replace(/<embed[\s\S]*?>/gi, (match) =>
-    match.replace(/</g, "&lt;").replace(/>/g, "&gt;")
-  );
-
-  result = result.replace(/<object[\s\S]*?<\/object>/gi, (match) =>
-    match.replace(/</g, "&lt;").replace(/>/g, "&gt;")
-  );
-
-  result = result.replace(/<script[\s\S]*?<\/script>/gi, (match) =>
-    match.replace(/</g, "&lt;").replace(/>/g, "&gt;")
-  );
-
-  return result;
+  return defangHtml(result);
 };
 
 export interface Heading {
diff --git a/app/_utils/note-edits.ts b/app/_utils/note-edits.ts
new file mode 100644
index 000000000..87cf4a12b
--- /dev/null
+++ b/app/_utils/note-edits.ts
@@ -0,0 +1,87 @@
+import { defangHtml } from "@/app/_utils/markdown-utils";
+import { extractHashtagsFromContent } from "@/app/_utils/tag-utils";
+import { dropLine, joinLines, splitLines } from "@/app/_utils/text-lines";
+
+export const FIND_MISSING = "The find text is not in the note";
+export const FIND_AMBIGUOUS = "The find text matches more than once. Include more of the text around it";
+export const TAG_INVALID = "Tags start with a letter and use letters, digits, _, - or /";
+
+const CRLF = "\r\n";
+const TAG_NAME = /^[a-zA-Z][a-zA-Z0-9_/-]*$/;
+const FENCE = /^\s*(```|~~~)/;
+const INLINE_CODE = /(`[^`]*`)/;
+const TAG_ONLY_LINE = /^\s*(?:#[a-zA-Z][a-zA-Z0-9_/-]*\s*)+$/;
+
+export type TextEdit = { body: string } | { error: string };
+
+const _eolOf = (body: string): string => (body.includes(CRLF) ? CRLF : "\n");
+
+const _asEol = (text: string, eol: string): string =>
+  eol === CRLF ? text.replace(/\r?\n/g, CRLF) : text;
+
+const _count = (haystack: string, needle: string): number =>
+  haystack.split(needle).length - 1;
+
+export const findReplace = (body: string, find: string, replace: string): TextEdit => {
+  const eol = _eolOf(body);
+  const needle = _asEol(find, eol);
+  const matches = _count(body, needle);
+  if (matches === 0) return { error: FIND_MISSING };
+  if (matches > 1) return { error: FIND_AMBIGUOUS };
+  const at = body.indexOf(needle);
+  const swapped = defangHtml(_asEol(replace, eol));
+  return { body: body.slice(0, at) + swapped + body.slice(at + needle.length) };
+};
+
+export const cleanTag = (tag: string): string | null => {
+  const name = tag.trim().replace(/^#/, "");
+  return TAG_NAME.test(name) ? name.toLowerCase() : null;
+};
+
+const _tagPattern = (tag: string): RegExp =>
+  new RegExp(`(^|[\\s(])#${tag.replace(/[/-]/g, "\\$&")}(?![a-zA-Z0-9_/-])[ \\t]?`, "gi");
+
+const _stripTags = (text: string, tags: string[]): string =>
+  text
+    .split(INLINE_CODE)
+    .map((part, index) =>
+      index % 2 ? part : tags.reduce((result, tag) => result.replace(_tagPattern(tag), "$1"), part),
+    )
+    .join("");
+
+export const addHashtags = (body: string, tags: string[]): string => {
+  const present = new Set(extractHashtagsFromContent(body));
+  const fresh = tags.filter((tag) => !present.has(tag));
+  if (!fresh.length) return body;
+
+  const eol = _eolOf(body);
+  const line = fresh.map((tag) => `#${tag}`).join(" ");
+  const trimmed = body.replace(/\s+$/, "");
+  const tail = body.slice(trimmed.length);
+  const lastLine = trimmed.split(/\r?\n/).pop() ?? "";
+
+  if (!trimmed) return `${line}${eol}`;
+  if (TAG_ONLY_LINE.test(lastLine)) return `${trimmed} ${line}${tail}`;
+  return `${trimmed}${eol}${eol}${line}${tail}`;
+};
+
+export const dropHashtags = (body: string, tags: string[]): string => {
+  let fence: string | null = null;
+  const emptied: number[] = [];
+  const lines = splitLines(body).map((line, index) => {
+    const opener = line.text.match(FENCE)?.[1];
+    if (fence) {
+      if (opener === fence) fence = null;
+      return line;
+    }
+    if (opener) {
+      fence = opener;
+      return line;
+    }
+    const stripped = _stripTags(line.text, tags);
+    if (stripped === line.text) return line;
+    if (!stripped.trim()) emptied.push(index);
+    return { ...line, text: stripped.replace(/[ \t]+$/, "") };
+  });
+  return joinLines(emptied.reverse().reduce(dropLine, lines));
+};
diff --git a/app/_utils/text-lines.ts b/app/_utils/text-lines.ts
new file mode 100644
index 000000000..0ca15381d
--- /dev/null
+++ b/app/_utils/text-lines.ts
@@ -0,0 +1,51 @@
+const LINE_BREAK = /(\r\n|\n|\r)/;
+
+export interface Line {
+  text: string;
+  eol: string;
+}
+
+export const splitLines = (text: string): Line[] => {
+  const parts = text.split(LINE_BREAK);
+  const lines: Line[] = [];
+  for (let i = 0; i < parts.length; i += 2) {
+    lines.push({ text: parts[i], eol: parts[i + 1] ?? "" });
+  }
+  return lines;
+};
+
+export const joinLines = (lines: Line[]): string =>
+  lines.map((line) => line.text + line.eol).join("");
+
+const _isBlank = (line?: Line): boolean => Boolean(line && line.eol && line.text.trim() === "");
+
+const _isEnd = (lines: Line[], index: number): boolean =>
+  index >= lines.length || (index === lines.length - 1 && !lines[index].eol && !lines[index].text);
+
+const _without = (lines: Line[], index: number): Line[] => [
+  ...lines.slice(0, index),
+  ...lines.slice(index + 1),
+];
+
+export const dropLine = (lines: Line[], index: number): Line[] => {
+  const kept = _without(lines, index);
+  const above = index - 1;
+  const gapAbove = above < 0 || _isBlank(kept[above]);
+  const gapBelow = _isEnd(kept, index) || _isBlank(kept[index]);
+  if (!gapAbove || !gapBelow) return kept;
+  if (above >= 0 && _isBlank(kept[above])) return _without(kept, above);
+  if (_isBlank(kept[index])) return _without(kept, index);
+  return kept;
+};
+
+export const lineAt = (lines: Line[], offset: number): number => {
+  let seen = 0;
+  for (let i = 0; i < lines.length; i++) {
+    seen += lines[i].text.length + lines[i].eol.length;
+    if (offset < seen) return i;
+  }
+  return lines.length - 1;
+};
+
+export const lineStart = (lines: Line[], index: number): number =>
+  lines.slice(0, index).reduce((sum, line) => sum + line.text.length + line.eol.length, 0);
diff --git a/app/_utils/text-slice.ts b/app/_utils/text-slice.ts
new file mode 100644
index 000000000..02431b71d
--- /dev/null
+++ b/app/_utils/text-slice.ts
@@ -0,0 +1,14 @@
+export interface TextSlice {
+  content: string;
+  contentLength: number;
+  nextOffset?: number;
+}
+
+export const sliceText = (text: string, offset: number, limit?: number): TextSlice => {
+  const end = limit === undefined ? text.length : offset + limit;
+  return {
+    content: text.slice(offset, end),
+    contentLength: text.length,
+    ...(end < text.length && { nextOffset: end }),
+  };
+};
diff --git a/app/_utils/title-utils.ts b/app/_utils/title-utils.ts
new file mode 100644
index 000000000..d7553b520
--- /dev/null
+++ b/app/_utils/title-utils.ts
@@ -0,0 +1,26 @@
+export const UNTITLED = "Untitled";
+
+const LEADING_H1 = /^#\s+(.+?)\s*$/;
+
+export const leadingHeading = (body: string): string | undefined => {
+  const first = body.split(/\r?\n/).find((line) => line.trim() !== "");
+  const heading = first?.trim().match(LEADING_H1)?.[1]?.trim();
+  return heading || undefined;
+};
+
+export const slugTitle = (fileId: string): string => fileId.replace(/-/g, " ");
+
+const _stored = (value: unknown): string | undefined => {
+  if (typeof value === "number") return String(value);
+  if (typeof value !== "string") return undefined;
+  return value.trim() || undefined;
+};
+
+export const titleOf = (
+  metadata: Record<string, unknown> | null | undefined,
+  body: string,
+  fileId?: string,
+): string =>
+  _stored(metadata?.title) ??
+  leadingHeading(body) ??
+  (fileId ? slugTitle(fileId) : UNTITLED);
diff --git a/app/_utils/yaml-metadata-utils.ts b/app/_utils/yaml-metadata-utils.ts
index b86b631b8..96ccd78ad 100644
--- a/app/_utils/yaml-metadata-utils.ts
+++ b/app/_utils/yaml-metadata-utils.ts
@@ -1,6 +1,7 @@
 import yaml from "js-yaml";
 import { v4 as uuidv4 } from "uuid";
 import { ChecklistsTypes, isKanbanType } from "../_types/enums";
+import { titleOf } from "./title-utils";
 
 export const toIso = (d: Date | string | number | undefined | null): string => {
   if (d == null) return new Date(0).toISOString();
@@ -141,22 +142,7 @@ export const updateYamlMetadata = (
 
 export const extractTitle = (content: string, filename?: string): string => {
   const { metadata, contentWithoutMetadata } = extractYamlMetadata(content);
-
-  if (metadata.title) {
-    return metadata.title;
-  }
-
-  const lines = contentWithoutMetadata.split("\n");
-  const titleLine = lines.find((line) => line.startsWith("# "));
-  if (titleLine) {
-    return titleLine.replace(/^#\s*/, "").trim();
-  }
-
-  if (filename) {
-    return filename.replace(/-/g, " ");
-  }
-
-  return "Untitled";
+  return titleOf(metadata, contentWithoutMetadata, filename);
 };
 
 export const extractChecklistType = (content: string): "kanban" | "simple" => {
@@ -241,6 +227,13 @@ export const migrateToYamlMetadata = (
   return frontmatter + cleanedContent;
 };
 
+const FRONTMATTER_BLOCK = /^\uFEFF?---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/;
+
+export const splitFrontmatter = (raw: string): { prefix: string; body: string } => {
+  const prefix = raw.match(FRONTMATTER_BLOCK)?.[0] ?? "";
+  return { prefix, body: raw.slice(prefix.length) };
+};
+
 export const extractUuid = (content: string): string | undefined => {
   const { metadata } = extractYamlMetadata(content);
   return metadata.uuid;
diff --git a/app/api/admin/duplicate-uuids/route.ts b/app/api/admin/duplicate-uuids/route.ts
new file mode 100644
index 000000000..fdca7d7d1
--- /dev/null
+++ b/app/api/admin/duplicate-uuids/route.ts
@@ -0,0 +1,89 @@
+import { NextResponse } from "next/server";
+import { getUserIndex } from "@/app/_server/actions/users/helpers";
+import { adminPeek } from "@/app/_server/actions/lib/admin-peek";
+import { findClashes } from "@/app/_server/actions/uuid-clash/scan";
+import { NOT_CLAIMANT, NO_CLASH, repairClash } from "@/app/_server/actions/uuid-clash/repair";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import type { ApiUser } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import {
+  clashListSchema,
+  clashQuery,
+  clashRepairBody,
+  clashRepairSchema,
+} from "@/app/_schemas/api/admin";
+
+export const dynamic = "force-dynamic";
+
+const ADMIN_ONLY = "Admin access with content permissions required";
+const NO_USER = "User not found";
+
+const _whose = async (user: ApiUser, username?: string): Promise<Response | string> => {
+  const owner = username || user.username;
+  if (owner !== user.username && !(await adminPeek(user))) return refuse(ADMIN_ONLY, 403);
+  if ((await getUserIndex(owner)) === -1) return refuse(NO_USER, 404);
+  return owner;
+};
+
+export const GET = defineRoute(
+  {
+    id: "listDuplicateUuids",
+    method: HttpMethod.GET,
+    path: "/admin/duplicate-uuids",
+    tag: ApiTag.ADMIN,
+    summary: "Find items that share a uuid",
+    description:
+      "Two files with the same uuid in their frontmatter, usually because a script copied one. The file with the oldest createdAt keeps the uuid, so every get, link and brain view opens that one, and the others stay hidden until you repair them. Anybody can check their own files. Naming somebody else needs an admin allowed to see other users' content.",
+    query: clashQuery,
+    responses: {
+      200: { description: "Duplicated uuids and the files holding them", schema: clashListSchema },
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+    },
+  },
+  async ({ user, query }) => {
+    const owner = await _whose(user, query.username);
+    if (typeof owner !== "string") return owner;
+    const duplicates = await findClashes(owner);
+    return NextResponse.json({ duplicates, total: duplicates.length });
+  },
+);
+
+export const POST = defineRoute(
+  {
+    id: "repairDuplicateUuid",
+    method: HttpMethod.POST,
+    path: "/admin/duplicate-uuids",
+    tag: ApiTag.ADMIN,
+    summary: "Give a duplicate a fresh uuid",
+    description:
+      "Gives the chosen file, or every file but the keeper, a new uuid, then points links at it when their text matches its title and not the keeper's. It leaves links that could mean either file alone and lists them in ambiguous. Anybody can repair their own files. Naming somebody else needs an admin allowed to see other users' content.",
+    body: clashRepairBody,
+    responses: {
+      200: { description: "What changed", schema: clashRepairSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const owner = await _whose(user, body.username);
+    if (typeof owner !== "string") return owner;
+
+    try {
+      const result = await repairClash(user, owner, body.uuid, body.path);
+      if (!result.success || !result.data) {
+        const error = result.error || NO_CLASH;
+        return refuse(error, error === NO_CLASH || error === NOT_CLAIMANT ? 404 : 400);
+      }
+      return NextResponse.json({ success: true, ...result.data });
+    } catch (error) {
+      console.error("Duplicate uuid repair failed:", error);
+      return refuse("Failed to repair the duplicate uuid", 500);
+    }
+  },
+);
diff --git a/app/api/brain/route.ts b/app/api/brain/route.ts
index cc6462e0b..2001071b6 100644
--- a/app/api/brain/route.ts
+++ b/app/api/brain/route.ts
@@ -15,7 +15,7 @@ export const GET = defineRoute(
     tag: ApiTag.RELATIONS,
     summary: "A slice of the link map",
     description:
-      "With focus, the items up to depth links away from it, nearest first. Without it, the most linked items. Tags are listed on each node rather than drawn as nodes.",
+      "With focus, the items up to depth links away from it, nearest first. Without it, the most linked items. Tags are the #hashtags in an item's content, listed on each node rather than drawn as nodes.",
     query: brainQuery,
     responses: {
       200: { description: "Nodes and the links between them", schema: brainSchema },
diff --git a/app/api/checklists/route.ts b/app/api/checklists/route.ts
index 6d3fdc4a8..1dad8e171 100644
--- a/app/api/checklists/route.ts
+++ b/app/api/checklists/route.ts
@@ -20,7 +20,7 @@ export const GET = defineRoute(
     path: "/checklists",
     tag: ApiTag.CHECKLISTS,
     summary: "List checklists",
-    description: "Checklists the API key owner owns or that were shared with them, items included. Use view=summary with limit and offset to page through them with item counts instead of items.",
+    description: "Checklists the API key owner owns or that were shared with them, items included. Jotty stores Kanban boards as checklists of type kanban, so they show up here too. Pass type=simple for plain lists only, and use listBoards and getBoard for a board's cards. Use view=summary with limit and offset to page through them with item counts instead of items.",
     query: checklistListQuery,
     responses: {
       200: { description: "Checklists", schema: z.object({ checklists: z.array(checklistSchema), total: totalField }) },
diff --git a/app/api/howto/[docId]/route.ts b/app/api/howto/[docId]/route.ts
new file mode 100644
index 000000000..01ce373c2
--- /dev/null
+++ b/app/api/howto/[docId]/route.ts
@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS, sliceQuery } from "@/app/_schemas/api/common";
+import { docParams, docSchema } from "@/app/_schemas/api/howto";
+import { readHowto } from "@/app/_server/actions/lib/howto-docs";
+import { sliceText } from "@/app/_utils/text-slice";
+
+export const dynamic = "force-dynamic";
+
+export const GET = defineRoute(
+  {
+    id: "readDoc",
+    method: HttpMethod.GET,
+    path: "/howto/{docId}",
+    tag: ApiTag.DISCOVERY,
+    summary: "Read a how-to guide",
+    description:
+      "Returns one guide as markdown. Use offset and limit to read a long guide in parts.",
+    params: docParams,
+    query: sliceQuery,
+    responses: {
+      200: { description: "The guide", schema: docSchema },
+      401: ERRORS[401],
+      404: ERRORS[404],
+    },
+  },
+  async ({ params, query }) => {
+    const doc = await readHowto(params.docId);
+    if (!doc) return refuse("Guide not found", 404);
+    return NextResponse.json({ id: doc.id, title: doc.title, ...sliceText(doc.content, query.offset, query.limit) });
+  },
+);
diff --git a/app/api/howto/route.ts b/app/api/howto/route.ts
new file mode 100644
index 000000000..157ad382a
--- /dev/null
+++ b/app/api/howto/route.ts
@@ -0,0 +1,28 @@
+import { NextResponse } from "next/server";
+import { defineRoute } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { docListSchema } from "@/app/_schemas/api/howto";
+import { listHowtos } from "@/app/_server/actions/lib/howto-docs";
+
+export const dynamic = "force-dynamic";
+
+export const GET = defineRoute(
+  {
+    id: "listDocs",
+    method: HttpMethod.GET,
+    path: "/howto",
+    tag: ApiTag.DISCOVERY,
+    summary: "List the how-to guides",
+    description:
+      "The guides this instance ships, the same ones as the How To pages in the app. Read one with readDoc.",
+    responses: {
+      200: { description: "Guides", schema: docListSchema },
+      401: ERRORS[401],
+    },
+  },
+  async () => {
+    const docs = await listHowtos();
+    return NextResponse.json({ docs, total: docs.length });
+  },
+);
diff --git a/app/api/kanban/route.ts b/app/api/kanban/route.ts
index a4b3408f2..f97e808d6 100644
--- a/app/api/kanban/route.ts
+++ b/app/api/kanban/route.ts
@@ -19,7 +19,7 @@ export const GET = defineRoute(
     path: "/kanban",
     tag: ApiTag.KANBAN,
     summary: "List Kanban boards",
-    description: "Boards the API key owner owns. Boards shared with them are left out, but GET /kanban/{boardId} returns them. Use view=summary with limit and offset to page through them with card counts per status instead of cards.",
+    description: "Boards the API key owner owns. They also appear in listChecklists as type kanban, but these board routes are the ones that understand cards and statuses. Boards shared with them are left out, but GET /kanban/{boardId} returns them. Use view=summary with limit and offset to page through them with card counts per status instead of cards.",
     query: boardListQuery,
     responses: {
       200: { description: "Boards", schema: z.object({ boards: z.array(boardSchema), total: totalField }) },
diff --git a/app/api/notes/[noteId]/route.ts b/app/api/notes/[noteId]/route.ts
index abf380f2e..eb2644ac3 100644
--- a/app/api/notes/[noteId]/route.ts
+++ b/app/api/notes/[noteId]/route.ts
@@ -5,9 +5,19 @@ import { resolveApiId } from "@/app/_server/actions/lib/legacy-lookup";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
 import { ERRORS, envelope, okSchema } from "@/app/_schemas/api/common";
-import { noteParams, noteSchema, noteUpdateBody } from "@/app/_schemas/api/notes";
+import {
+  noteParams,
+  notePatchBody,
+  noteReadQuery,
+  noteSchema,
+  noteUpdateBody,
+  warnedNote,
+} from "@/app/_schemas/api/notes";
+import { SPLICE_DENIED, SPLICE_MISSING, spliceNote } from "@/app/_server/actions/note/splice";
+import { findReplace } from "@/app/_utils/note-edits";
+import { sliceText } from "@/app/_utils/text-slice";
 import { Modes } from "@/app/_types/enums";
-import { UNCATEGORIZED } from "@/app/_consts/notes";
+import { MANAGED_WARNING, UNCATEGORIZED, isManaged } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
 
@@ -45,25 +55,31 @@ export const GET = defineRoute(
     path: "/notes/{noteId}",
     tag: ApiTag.NOTES,
     summary: "Get a note",
+    description:
+      "contentLength is the size of the whole content. For a very long note, pass offset and limit to read it in slices, and nextOffset says where the next slice starts.",
     params: noteParams,
+    query: noteReadQuery,
     responses: {
       200: { description: "The note", schema: envelope(noteSchema) },
       401: ERRORS[401],
       404: ERRORS[404],
     },
   },
-  async ({ request, user, params }) => {
+  async ({ request, user, params, query }) => {
     const uuid = await _noteUuid(request, params.noteId, user.username);
     const note = uuid ? await getNoteById(uuid, user.username) : undefined;
     if (!note) return refuse(NOT_FOUND, 404);
 
+
     return NextResponse.json({
       success: true,
       data: {
         id: note.uuid,
         title: note.title,
         category: note.category || UNCATEGORIZED,
-        content: note.content,
+        ...sliceText(note.content || "", query.offset, query.limit),
+        tags: note.tags || [],
+        ...(isManaged(note.extraMetadata) && { managed: true }),
         createdAt: note.createdAt,
         updatedAt: note.updatedAt,
         owner: note.owner,
@@ -79,11 +95,12 @@ export const PUT = defineRoute(
     path: "/notes/{noteId}",
     tag: ApiTag.NOTES,
     summary: "Update a note",
-    description: "Fields left out keep their current value.",
+    description:
+      "Fields left out keep their current value. content replaces the whole note, so read all of it first, checking contentLength, or use patchNote to change one part.",
     params: noteParams,
     body: noteUpdateBody,
     responses: {
-      200: { description: "Updated note", schema: envelope(noteSchema) },
+      200: { description: "Updated note", schema: warnedNote },
       400: ERRORS[400],
       401: ERRORS[401],
       404: ERRORS[404],
@@ -115,6 +132,54 @@ export const PUT = defineRoute(
         updatedAt: result.data?.updatedAt,
         owner: result.data?.owner,
       },
+      ...(isManaged(note.extraMetadata) && { warning: MANAGED_WARNING }),
+    });
+  },
+);
+
+const PATCH_STATUS: Record<string, number> = {
+  [SPLICE_MISSING]: 404,
+  [SPLICE_DENIED]: 403,
+};
+
+export const PATCH = defineRoute(
+  {
+    id: "patchNote",
+    method: HttpMethod.PATCH,
+    path: "/notes/{noteId}",
+    tag: ApiTag.NOTES,
+    summary: "Replace one piece of a note",
+    description:
+      "Swaps the exact find text for replace without sending the whole note. find must appear exactly once, so include enough surrounding text to make it unique. It keeps the note's line endings and leaves everything else byte for byte. It refuses encrypted notes.",
+    params: noteParams,
+    body: notePatchBody,
+    responses: {
+      200: { description: "Patched", schema: warnedNote },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+    },
+  },
+  async ({ request, user, params, body }) => {
+    const uuid = await _noteUuid(request, params.noteId, user.username);
+    if (!uuid) return refuse(NOT_FOUND, 404);
+
+    const result = await spliceNote(user, uuid, (text) => findReplace(text, body.find, body.replace));
+    if (!result.success || !result.data) {
+      const error = result.error || "Failed to update note";
+      return refuse(error, PATCH_STATUS[error] ?? 400);
+    }
+
+    return NextResponse.json({
+      success: true,
+      data: {
+        id: result.data.uuid,
+        title: result.data.title,
+        category: result.data.category,
+        ...(result.data.managed && { managed: true }),
+      },
+      ...(result.data.managed && { warning: MANAGED_WARNING }),
     });
   },
 );
diff --git a/app/api/notes/[noteId]/tags/route.ts b/app/api/notes/[noteId]/tags/route.ts
new file mode 100644
index 000000000..0973230e5
--- /dev/null
+++ b/app/api/notes/[noteId]/tags/route.ts
@@ -0,0 +1,88 @@
+import { NextResponse } from "next/server";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { noteParams, noteTagBody } from "@/app/_schemas/api/notes";
+import { taggedNoteSchema } from "@/app/_schemas/api/tags";
+import { MANAGED_WARNING, isManaged } from "@/app/_consts/notes";
+import { isUuid } from "@/app/_consts/identity";
+import { getNoteById } from "@/app/_server/actions/note/queries";
+import {
+  SPLICE_DENIED,
+  SPLICE_MISSING,
+  SPLICE_UNCHANGED,
+  spliceNote,
+} from "@/app/_server/actions/note/splice";
+import { TAG_INVALID, addHashtags, cleanTag, dropHashtags } from "@/app/_utils/note-edits";
+
+export const dynamic = "force-dynamic";
+
+const NOT_FOUND = "Note not found";
+
+const STATUS: Record<string, number> = {
+  [SPLICE_MISSING]: 404,
+  [SPLICE_DENIED]: 403,
+};
+
+const _cleaned = (tags: string[] = []) => {
+  const names = tags.map(cleanTag);
+  const bad = tags.filter((_, index) => !names[index]);
+  return { names: names.filter((name): name is string => Boolean(name)), bad };
+};
+
+const _unchanged = async (uuid: string, username: string) => {
+  const note = await getNoteById(uuid, username);
+  if (!note) return refuse(NOT_FOUND, 404);
+  return NextResponse.json({
+    success: true,
+    data: { id: uuid, title: note.title, tags: note.tags || [], changed: false },
+    ...(isManaged(note.extraMetadata) && { warning: MANAGED_WARNING }),
+  });
+};
+
+export const POST = defineRoute(
+  {
+    id: "tagNote",
+    method: HttpMethod.POST,
+    path: "/notes/{noteId}/tags",
+    tag: ApiTag.NOTES,
+    summary: "Add or remove a note's tags",
+    description:
+      "Tags are #hashtags in the note's content. add appends the missing ones on a tag line at the end, remove deletes those #hashtags wherever they sit outside code. Nothing else in the note changes, so you don't resend its content. It refuses encrypted notes.",
+    params: noteParams,
+    body: noteTagBody,
+    responses: {
+      200: { description: "The note's tags afterwards", schema: taggedNoteSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+    },
+  },
+  async ({ user, params, body }) => {
+    if (!isUuid(params.noteId)) return refuse(NOT_FOUND, 404);
+    const add = _cleaned(body.add);
+    const remove = _cleaned(body.remove);
+    const bad = [...add.bad, ...remove.bad];
+    if (bad.length) return refuse(`${TAG_INVALID}: ${bad.join(", ")}`, 400);
+
+    const result = await spliceNote(
+      user,
+      params.noteId,
+      (text) => ({ body: addHashtags(dropHashtags(text, remove.names), add.names) }),
+      { untag: remove.names },
+    );
+
+    if (result.error === SPLICE_UNCHANGED) return _unchanged(params.noteId, user.username);
+    if (!result.success || !result.data) {
+      const error = result.error || "Failed to tag note";
+      return refuse(error, STATUS[error] ?? 400);
+    }
+
+    return NextResponse.json({
+      success: true,
+      data: { id: result.data.uuid, title: result.data.title, tags: result.data.tags, changed: true },
+      ...(result.data.managed && { warning: MANAGED_WARNING }),
+    });
+  },
+);
diff --git a/app/api/notes/route.ts b/app/api/notes/route.ts
index b90e049be..624016dce 100644
--- a/app/api/notes/route.ts
+++ b/app/api/notes/route.ts
@@ -6,11 +6,17 @@ import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
 import { ERRORS, envelope, page, totalField } from "@/app/_schemas/api/common";
 import { toApiNote } from "@/app/_utils/api-note";
+import { tagMatchesFilter } from "@/app/_utils/tag-utils";
 import { noteCreateBody, noteListQuery, noteSchema } from "@/app/_schemas/api/notes";
 import { UNCATEGORIZED } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
 
+const _idSet = (ids?: string): Set<string> | null => {
+  const list = (ids || "").split(",").map((id) => id.trim().toLowerCase()).filter(Boolean);
+  return list.length ? new Set(list) : null;
+};
+
 export const GET = defineRoute(
   {
     id: "listNotes",
@@ -18,7 +24,7 @@ export const GET = defineRoute(
     path: "/notes",
     tag: ApiTag.NOTES,
     summary: "List notes",
-    description: "Every note the API key owner can read, including shared ones. Use view=summary with limit and offset to page through titles and excerpts without loading every note's content.",
+    description: "Every note the API key owner can read, including shared ones. Use view=summary with limit and offset to page through titles and excerpts without loading every note's content. Pass ids to read several known notes in one call, and tag to list the notes carrying a tag.",
     query: noteListQuery,
     responses: {
       200: { description: "Notes", schema: z.object({ notes: z.array(noteSchema), total: totalField }) },
@@ -33,9 +39,12 @@ export const GET = defineRoute(
     }
 
     const needle = query.q?.toLowerCase();
+    const wanted = _idSet(query.ids);
     const matches = notes.data.filter(
       (note) =>
         (!query.category || note.category === query.category) &&
+        (!wanted || wanted.has((note.uuid || "").toLowerCase())) &&
+        (!query.tag || (note.tags || []).some((tag) => tagMatchesFilter(tag, query.tag!))) &&
         (!needle ||
           note.title?.toLowerCase().includes(needle) ||
           note.content?.toLowerCase().includes(needle)),
diff --git a/app/api/relations/links/route.ts b/app/api/relations/links/route.ts
index ae8e5084f..4c91c94a4 100644
--- a/app/api/relations/links/route.ts
+++ b/app/api/relations/links/route.ts
@@ -1,18 +1,28 @@
 import { NextResponse } from "next/server";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
-import { ERRORS, okSchema } from "@/app/_schemas/api/common";
-import { linkBody } from "@/app/_schemas/api/relations";
-import { DENIED, LINKS_OFF, NOT_VISIBLE, linkItems } from "@/app/_server/actions/relations/explore";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { linkBody, linkedSchema, unlinkBody, unlinkedSchema } from "@/app/_schemas/api/relations";
+import { MANAGED_WARNING } from "@/app/_consts/notes";
+import {
+  DENIED,
+  LINK_MISSING,
+  LINKS_OFF,
+  NOT_VISIBLE,
+  linkItems,
+  unlinkItems,
+} from "@/app/_server/actions/relations/explore";
 
 export const dynamic = "force-dynamic";
 
 const _statusOf = (error: string) => {
-  if (error === NOT_VISIBLE || error === LINKS_OFF) return 404;
+  if (error === NOT_VISIBLE || error === LINKS_OFF || error === LINK_MISSING) return 404;
   if (error === DENIED) return 403;
   return 400;
 };
 
+const _warned = (managed: boolean) => (managed ? { warning: MANAGED_WARNING } : {});
+
 export const POST = defineRoute(
   {
     id: "connectItems",
@@ -21,10 +31,10 @@ export const POST = defineRoute(
     tag: ApiTag.RELATIONS,
     summary: "Link a note to another item",
     description:
-      "Writes a [Title](/note/uuid) link into the source note, so the link shows up in the note, in Referenced By and in the brain. Needs edit access to the source note. Encrypted notes are refused.",
+      "Writes a [Title](/note/uuid) link into the source note, so the link shows up in the note, in Referenced By and in the brain. Only link items that relate to each other. An item with no links is fine. Needs edit access to the source note. The rest of the note stays byte for byte. Encrypted notes are refused.",
     body: linkBody,
     responses: {
-      200: { description: "Linked", schema: okSchema },
+      200: { description: "Linked", schema: linkedSchema },
       400: ERRORS[400],
       401: ERRORS[401],
       403: ERRORS[403],
@@ -34,7 +44,38 @@ export const POST = defineRoute(
   },
   async ({ user, body }) => {
     const result = await linkItems(user, body.source, body.target, body.style);
-    if (!result.success) return refuse(result.error || "Failed to connect items", _statusOf(result.error || ""));
-    return NextResponse.json({ success: true });
+    if (!result.success || !result.data) {
+      return refuse(result.error || "Failed to connect items", _statusOf(result.error || ""));
+    }
+    return NextResponse.json({ success: true, ..._warned(result.data.managed) });
+  },
+);
+
+export const DELETE = defineRoute(
+  {
+    id: "disconnectItems",
+    method: HttpMethod.DELETE,
+    path: "/relations/links",
+    tag: ApiTag.RELATIONS,
+    summary: "Remove a note's links to another item",
+    description:
+      "Takes every [Title](/note/uuid) and legacy [Title](/jotty/uuid) link to the target out of the source note. A link alone on its line goes with the line and the blank line beside it. A link inside a sentence becomes plain text. Everything else stays byte for byte, line endings included. It leaves [[wikilinks]] alone and counts them in wikiLinks. Needs edit access to the source note, and it refuses encrypted notes.",
+    body: unlinkBody,
+    responses: {
+      200: { description: "Unlinked", schema: unlinkedSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      403: ERRORS[403],
+      404: ERRORS[404],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, body }) => {
+    const result = await unlinkItems(user, body.source, body.target);
+    if (!result.success || !result.data) {
+      return refuse(result.error || "Failed to disconnect items", _statusOf(result.error || ""));
+    }
+    const { removed, wikiLinks, managed } = result.data;
+    return NextResponse.json({ success: true, removed, wikiLinks, ..._warned(managed) });
   },
 );
diff --git a/app/api/relations/orphans/route.ts b/app/api/relations/orphans/route.ts
index b96b4dba4..3e7408f0c 100644
--- a/app/api/relations/orphans/route.ts
+++ b/app/api/relations/orphans/route.ts
@@ -14,7 +14,7 @@ export const GET = defineRoute(
     path: "/relations/orphans",
     tag: ApiTag.RELATIONS,
     summary: "Items with no links",
-    description: "Notes and checklists that link to nothing and that nothing links to. Tags don't count as links.",
+    description: "Notes and checklists that link to nothing and that nothing links to. Tags don't count as links. Having no links is normal. This isn't a to-do list, so only link an item to another one it relates to.",
     query: orphansQuery,
     responses: {
       200: { description: "Unlinked items, by title", schema: orphansSchema },
diff --git a/app/api/tags/route.ts b/app/api/tags/route.ts
new file mode 100644
index 000000000..8a3a23564
--- /dev/null
+++ b/app/api/tags/route.ts
@@ -0,0 +1,57 @@
+import { NextResponse } from "next/server";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
+import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { tagListSchema } from "@/app/_schemas/api/tags";
+import { normalizeTag } from "@/app/_utils/tag-utils";
+
+export const dynamic = "force-dynamic";
+
+interface Tally {
+  notes: number;
+  checklists: number;
+}
+
+type Counted = keyof Tally;
+
+const _tally = (counts: Map<string, Tally>, tags: string[] | undefined, kind: Counted) =>
+  new Set((tags || []).map(normalizeTag).filter(Boolean)).forEach((tag) => {
+    const entry = counts.get(tag) || { notes: 0, checklists: 0 };
+    entry[kind] += 1;
+    counts.set(tag, entry);
+  });
+
+export const GET = defineRoute(
+  {
+    id: "listTags",
+    method: HttpMethod.GET,
+    path: "/tags",
+    tag: ApiTag.DISCOVERY,
+    summary: "List tags",
+    description:
+      "Every tag on the notes and checklists the API key owner can read, with how many carry it. Tags are #hashtags written in the content, and #parent/child nests. Filter notes by one with listNotes tag=.",
+    responses: {
+      200: { description: "Tags", schema: tagListSchema },
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user }) => {
+    const [notes, lists] = await Promise.all([
+      getUserNotes({ username: user.username, metadataOnly: true }),
+      getUserChecklists({ username: user.username, metadataOnly: true }),
+    ]);
+    if (!notes.success || !lists.success) return refuse("Failed to read tags", 500);
+
+    const counts = new Map<string, Tally>();
+    (notes.data || []).forEach((note) => _tally(counts, note.tags, "notes"));
+    (lists.data || []).forEach((list) => _tally(counts, list.tags, "checklists"));
+
+    const tags = Array.from(counts, ([tag, tally]) => ({ tag, ...tally })).sort((a, b) =>
+      a.tag.localeCompare(b.tag),
+    );
+    return NextResponse.json({ tags, total: tags.length });
+  },
+);
diff --git a/howto/API.md b/howto/API.md
index 27d8e447a..c014149d9 100644
--- a/howto/API.md
+++ b/howto/API.md
@@ -32,6 +32,32 @@ Checklist and task items are addressed by their tree index inside the list: `0`
 
 > **Deprecated: slug lookups.** A legacy filename slug still works as the item id, optionally with `?category=` (default "Uncategorized"). Every such request logs a warning, and this fallback **will be removed in a future release**. Switch any stored slugs to UUIDs now.
 
+## Note files
+
+Every note is a markdown file in your data folder, with some YAML frontmatter at the top. If a script writes notes straight to disk, this is the shape Jotty expects:
+
+```markdown
+---
+uuid: 9f1c2a7e-4b3d-4c8e-9a61-2f5d7e0b8c14
+title: Weekly digest
+createdAt: 2026-09-28T09:00:00.000Z
+tags:
+  - home/garden
+  - work
+managed: true
+---
+# Weekly digest
+
+What changed this week. #work #home/garden
+```
+
+- `uuid` is the note's id, the one the API and every link use. Leave it out and Jotty adds one the first time it reads the file. Don't copy a file with its `uuid` in it. Two files with the same one collide, and only the older one opens until you run `repairDuplicateUuid`.
+- `title` is optional. Without it, Jotty uses a `# heading` on the first line, then the filename.
+- `createdAt` is optional. Jotty fills it in on the first save. When two files share a `uuid`, the one with the older `createdAt` keeps it.
+- `tags` is a copy of the `#hashtags` in the body. Put the hashtags in the body. A tag that only sits in the frontmatter is gone the next time someone saves the note in Jotty. `GET /api/tags` lists your tags, `GET /api/notes?tag=work` filters by one, and `POST /api/notes/{noteId}/tags` adds or removes them without resending the note.
+- `managed: true` marks a note your script rewrites. The API returns `"managed": true` on it, and any call that writes into it comes back with a `warning`, because your script will overwrite the change.
+- Jotty keeps any other keys you add, untouched.
+
 ## Errors
 
 Errors come back as JSON with the status code telling you what went wrong:
diff --git a/howto/MCP.md b/howto/MCP.md
index 8216eb3e9..7cfe21d42 100644
--- a/howto/MCP.md
+++ b/howto/MCP.md
@@ -89,10 +89,30 @@ The assistant can also follow your [links](BRAIN.md) and see what's shared:
 |---|---|
 | `get_related` | What links to an item and what it links to, as titles. The assistant reads only the ones that matter instead of opening everything |
 | `get_brain` | The items around one item, or your most linked items |
-| `list_orphans` | Items with no links |
-| `connect_items` | Links a note to another item, so notes the assistant writes join the map |
+| `list_orphans` | Items with no links. That's normal, it isn't a to-do list |
+| `connect_items` | Links a note to another item it relates to |
+| `disconnect_items` | Takes a note's links to an item back out, and closes the gap they leave |
 | `list_shares` | What other people shared with you and what you shared, with who can do what. Read only |
 
+These tools change part of a note without resending the rest. Everything else in the file stays byte for byte, line endings included.
+
+| Tool | What it does |
+|---|---|
+| `patch_note` | Swaps one exact piece of text for another. It refuses when the text isn't there or appears more than once |
+| `tag_note` | Adds or removes tags. Tags are the `#hashtags` in a note, and `#parent/child` nests |
+| `list_tags` | Every tag you use and how many notes and checklists carry it. `list_notes` takes `tag` to list the notes with one |
+
+If a script rewrites one of your notes, add `managed: true` to its frontmatter. The [API guide](API.md#note-files) has an example file. Tools then flag the note as managed, and any tool that writes into it warns that the script will overwrite the change.
+
+Two tools deal with duplicate UUIDs. They usually show up when a script copies a note file. The file with the oldest `createdAt` keeps the UUID, and the copies stay hidden until you repair them. `health` tells you when you have any.
+
+| Tool | What it does |
+|---|---|
+| `list_duplicate_uuids` | Which UUIDs more than one file uses, and which file keeps each one |
+| `repair_duplicate_uuid` | Gives the newer file, or the one you pick, a new UUID. Links whose text names that file move with it. Links that could mean either file stay put, and the tool lists them |
+
+The assistant can read these guides too. `list_docs` lists them and `read_doc` returns one as markdown, so it can check how Jotty works instead of guessing.
+
 Three more tools reach everything else:
 
 | Tool | What it does |
@@ -111,6 +131,8 @@ An assistant reads every character a tool sends back, and a long answer pushes t
 
 - `list_notes`, `list_checklists` and `list_boards` return 25 results at a time in a summary view. Notes come with a short excerpt instead of their content, checklists with item counts, and boards with card counts per column. `total` says how many matched, `offset` reads the next page, and `view=full` gets everything.
 - An answer longer than `JOTTY_MCP_MAX_TEXT_CHARS` keeps the rows that fit and adds a `trimmed` field with the `offset` for the next ones. A single record that's still too long gets cut.
+- That limit is only the default. Every tool takes `maxChars`, so the assistant can ask for more when it needs a whole answer, or less to save room.
+- `get_note` gives the note's length in `contentLength` and takes `offset` and `limit`, so the assistant can read a very long note in slices. `list_notes` takes `ids` to read several notes in one call.
 - Updating or moving a card returns that card, not the whole board.
 - Search puts the best matches first and gives you the `uuid` the other tools take and the file name as `slug`.
 - `get_brain` returns 60 items at most by default, nearest and most linked first, and says when it left some out.
@@ -130,6 +152,6 @@ An assistant reads every character a tool sends back, and a long answer pushes t
 | `JOTTY_MCP_BIND_HOST` | all interfaces | Address the HTTP server binds to |
 | `JOTTY_MCP_AUTH_TOKEN` | | Bearer token every `/mcp` request must send |
 | `JOTTY_MCP_TIMEOUT_MS` | `30000` | How long to wait for Jotty before giving up |
-| `JOTTY_MCP_MAX_TEXT_CHARS` | `12000` | Longest answer a tool sends back, in characters |
+| `JOTTY_MCP_MAX_TEXT_CHARS` | `12000` | Longest answer a tool sends back by default, in characters. A tool call can ask for a different size with `maxChars` |
 | `JOTTY_MCP_SPEC_TTL_MS` | `300000` | How long to cache the API description |
 | `JOTTY_MCP_LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error` or `silent`. Logs go to stderr |
diff --git a/mcp-server/src/server/mcp.ts b/mcp-server/src/server/mcp.ts
index 28ad9c89a..44d746896 100644
--- a/mcp-server/src/server/mcp.ts
+++ b/mcp-server/src/server/mcp.ts
@@ -10,9 +10,14 @@ export const SERVER_INSTRUCTIONS = [
   "Tools for a Jotty instance: notes, checklists and Kanban boards, acting as the user who owns the API key.",
   "Ids are uuids, so list or search first to get one. Checklist items are addressed by tree index, like 0 or 2.1.",
   "Search ranks the best matches first and finds the words in any order.",
+  "Every tool takes maxChars to raise or lower how much output it returns. get_note reports contentLength and takes offset and limit, so read a long note in slices until nextOffset is gone.",
+  "update_note replaces the whole content, so only send it after reading all of the note. For a small change use patch_note, which swaps one exact piece of text and leaves the rest untouched.",
+  "Tags are #hashtags in the content, and #parent/child nests. list_tags shows them, list_notes filters by tag, tag_note adds or removes them without resending the note.",
   "Notes link to each other. After finding an item, get_related lists what links to it and what it links to, so you can follow the links and read only what matters. get_brain maps the items around one, or the most linked ones.",
-  "When you write a note about another item, link it with connect_items so it doesn't end up an orphan.",
-  "The dedicated tools cover search, links, shares, notes, checklists and boards. Use discover and call_operation for everything else the instance offers.",
+  "Link items with connect_items only when they relate to each other, and remove a link with disconnect_items. An item with no links is fine, so don't add links just to empty list_orphans.",
+  "A script rewrites any note with managed: true, so edits to it may not last. Write tools say so in a warning.",
+  "list_docs and read_doc return Jotty's own guides. Read the api guide before writing a note file or its frontmatter by hand.",
+  "The dedicated tools cover search, links, tags, shares, notes, checklists and boards. Use discover and call_operation for everything else the instance offers.",
 ].join(" ");
 
 export const createMcpServer = (ctx: ToolContext): Server => {
diff --git a/mcp-server/src/tools/budget.ts b/mcp-server/src/tools/budget.ts
new file mode 100644
index 000000000..ae88a7b9b
--- /dev/null
+++ b/mcp-server/src/tools/budget.ts
@@ -0,0 +1,24 @@
+import type { JsonSchema } from "../jotty/openapi.ts";
+
+export const MAX_CHARS = "maxChars";
+
+export const budgetProp = (fallback: number): JsonSchema => ({
+  type: "integer",
+  minimum: 1,
+  description: `Most characters of output for this call, ${fallback} when left out. Raise it to read a large result whole, lower it to save room`,
+});
+
+export const withBudget = (schema: JsonSchema, fallback: number): JsonSchema =>
+  schema.properties?.[MAX_CHARS]
+    ? schema
+    : { ...schema, properties: { ...schema.properties, [MAX_CHARS]: budgetProp(fallback) } };
+
+export const budgetOf = (args: Record<string, unknown>, fallback: number): number => {
+  const asked = Number(args[MAX_CHARS]);
+  return Number.isInteger(asked) && asked > 0 ? asked : fallback;
+};
+
+export const withoutBudget = (args: Record<string, unknown>): Record<string, unknown> => {
+  const { [MAX_CHARS]: _budget, ...rest } = args;
+  return rest;
+};
diff --git a/mcp-server/src/tools/builtins.ts b/mcp-server/src/tools/builtins.ts
index ffdc2014f..4ecfde0f4 100644
--- a/mcp-server/src/tools/builtins.ts
+++ b/mcp-server/src/tools/builtins.ts
@@ -8,13 +8,15 @@ import { ToolErrorKind, errorResult, fromError } from "./errors.ts";
 import { runOperation } from "./operation.ts";
 import { respond, toolResult, type ToolResult } from "./result.ts";
 import { toolInput } from "./schema.ts";
+import { budgetOf, withBudget } from "./budget.ts";
+import type { JsonSchema } from "../jotty/openapi.ts";
 
 const LOG_NS = "tool-builtin";
 const HEALTH_PATH = "/health";
 const READ_ONLY = { readOnlyHint: true, openWorldHint: false } as const;
 const PLUMBING_TAG = "System";
 
-export const BUILTIN_TOOLS: Tool[] = [
+const BUILTIN_TOOLS: Tool[] = [
   {
     name: BuiltinTool.Discover,
     description:
@@ -50,6 +52,15 @@ export const BUILTIN_TOOLS: Tool[] = [
   },
 ];
 
+const BUDGETED = new Set<string>([BuiltinTool.Discover, BuiltinTool.CallOperation]);
+
+export const builtinTools = (maxChars: number): Tool[] =>
+  BUILTIN_TOOLS.map((tool) =>
+    BUDGETED.has(tool.name)
+      ? { ...tool, inputSchema: withBudget(tool.inputSchema as JsonSchema, maxChars) as Tool["inputSchema"] }
+      : tool,
+  );
+
 const _summaryOf = (spec: Spec) =>
   [...spec.operations.values()]
     .filter((op) => op.tags?.[0] !== PLUMBING_TAG && !CURATED_OPERATIONS.includes(op.operationId))
@@ -63,7 +74,7 @@ const _summaryOf = (spec: Spec) =>
     }));
 
 const _discover = (ctx: ToolContext, spec: Spec, args: Record<string, unknown>): ToolResult => {
-  const limit = ctx.config.output.maxTextChars;
+  const limit = budgetOf(args, ctx.config.output.maxTextChars);
   if (typeof args.operationId === "string") {
     const op = spec.operations.get(args.operationId);
     if (!op) {
@@ -88,7 +99,8 @@ const _call = (ctx: ToolContext, spec: Spec, args: Record<string, unknown>, sign
     );
   }
   const inner = args.arguments && typeof args.arguments === "object" ? (args.arguments as Record<string, unknown>) : {};
-  return runOperation(ctx, spec, op, inner, { signal });
+  const maxChars = budgetOf({ ...args, ...inner }, ctx.config.output.maxTextChars);
+  return runOperation(ctx, spec, op, inner, { signal, maxChars });
 };
 
 const REJECTED = new Set([401, 403]);
@@ -99,6 +111,22 @@ const _keyStatus = (ctx: ToolContext, spec: Spec | null, problem: unknown): stri
   return problem instanceof JottyError && REJECTED.has(problem.status) ? "rejected" : "unchecked";
 };
 
+const DUPLICATES_OP = "listDuplicateUuids";
+const DUPLICATES_TOOL = toolNameOf(DUPLICATES_OP);
+
+const _duplicates = async (ctx: ToolContext, spec: Spec, signal?: AbortSignal): Promise<number | undefined> => {
+  const op = spec.operations.get(DUPLICATES_OP);
+  if (!op) return undefined;
+  try {
+    const response = await ctx.client.send({ method: op.method, path: op.path, signal });
+    const total = (response.data as { total?: unknown } | null)?.total;
+    return typeof total === "number" ? total : undefined;
+  } catch (err) {
+    logger.warn(LOG_NS, "duplicate uuid check failed during health check", err);
+    return undefined;
+  }
+};
+
 const _health = async (ctx: ToolContext, signal?: AbortSignal): Promise<ToolResult> => {
   try {
     const health = await ctx.client.send({ method: "get", path: HEALTH_PATH, signal });
@@ -110,16 +138,22 @@ const _health = async (ctx: ToolContext, signal?: AbortSignal): Promise<ToolResu
       logger.warn(LOG_NS, "spec unavailable during health check", err);
       problem = err;
     }
+    const duplicateUuids = spec ? await _duplicates(ctx, spec, signal) : undefined;
     const report = {
       jotty: ctx.client.baseUrl,
       upstream: health.data,
       apiKey: _keyStatus(ctx, spec, problem),
       operations: spec?.operations.size ?? 0,
       uptimeSec: Math.round((Date.now() - ctx.startedAt) / 1000),
+      ...(duplicateUuids !== undefined && { duplicateUuids }),
       ...(problem instanceof SpecMissingError && { problem: problem.message }),
     };
-    const summary = `Jotty at ${report.jotty} is up, API key ${report.apiKey}.`;
-    return toolResult(report.problem ? `${summary} ${report.problem}` : summary, report);
+    const summary = [
+      `Jotty at ${report.jotty} is up, API key ${report.apiKey}.`,
+      duplicateUuids ? `${duplicateUuids} uuid(s) belong to more than one file. Run ${DUPLICATES_TOOL} to see them.` : "",
+      report.problem ?? "",
+    ];
+    return toolResult(summary.filter(Boolean).join(" "), report);
   } catch (err) {
     return fromError(err);
   }
diff --git a/mcp-server/src/tools/catalog.ts b/mcp-server/src/tools/catalog.ts
index 6360be2bf..9b19dd5f9 100644
--- a/mcp-server/src/tools/catalog.ts
+++ b/mcp-server/src/tools/catalog.ts
@@ -19,6 +19,9 @@ export const CATALOG: CatalogEntry[] = [
   { id: "getNote" },
   { id: "createNote" },
   { id: "updateNote" },
+  { id: "patchNote" },
+  { id: "tagNote" },
+  { id: "listTags" },
   { id: "deleteNote" },
   { id: "listChecklists", defaults: SUMMARY_PAGE },
   { id: "getChecklist" },
@@ -46,7 +49,17 @@ export const CATALOG: CatalogEntry[] = [
         "style=mention only works when the source note already has the target's title as plain text. style=append always works and adds the link at the end.",
     },
   },
+  {
+    id: "disconnectItems",
+    hints: {
+      [ToolErrorKind.NotFound]: "get_related on the source lists what it links to. This tool doesn't remove [[wikilinks]].",
+    },
+  },
   { id: "listShares", defaults: { limit: 25 } },
+  { id: "listDocs" },
+  { id: "readDoc" },
+  { id: "listDuplicateUuids" },
+  { id: "repairDuplicateUuid" },
 ];
 
 export const CURATED_OPERATIONS = CATALOG.map((entry) => entry.id);
diff --git a/mcp-server/src/tools/operation.ts b/mcp-server/src/tools/operation.ts
index b01b7d660..cc67e7e2b 100644
--- a/mcp-server/src/tools/operation.ts
+++ b/mcp-server/src/tools/operation.ts
@@ -8,6 +8,7 @@ import type { ToolContext } from "./context.ts";
 import { fillPath, splitArgs, toolInput, type ArgLayout } from "./schema.ts";
 import { catalogEntry, toolNameOf } from "./catalog.ts";
 import { logger } from "../utils/logger.ts";
+import { budgetOf, withBudget, withoutBudget } from "./budget.ts";
 
 const LOG_NS = "tool-operation";
 const SERVER_ERROR = 500;
@@ -47,10 +48,13 @@ const _withDefaults = (schema: JsonSchema, defaults: Record<string, unknown> = {
   ),
 });
 
-export const operationTool = (spec: Spec, op: Operation): Tool => ({
+export const operationTool = (spec: Spec, op: Operation, maxChars: number): Tool => ({
   name: toolNameOf(op.operationId),
   description: describe(op),
-  inputSchema: _withDefaults(toolInput(spec, op).schema, catalogEntry(op.operationId)?.defaults) as Tool["inputSchema"],
+  inputSchema: withBudget(
+    _withDefaults(toolInput(spec, op).schema, catalogEntry(op.operationId)?.defaults),
+    maxChars,
+  ) as Tool["inputSchema"],
   annotations: annotationsOf(op),
 });
 
@@ -101,15 +105,18 @@ const _download = (ctx: ToolContext, path: string, contentType: string): ToolRes
 export interface RunOptions {
   signal?: AbortSignal;
   curated?: boolean;
+  maxChars?: number;
 }
 
 export const runOperation = async (
   ctx: ToolContext,
   spec: Spec,
   op: Operation,
-  args: Record<string, unknown>,
-  { signal, curated = false }: RunOptions = {},
+  given: Record<string, unknown>,
+  { signal, curated = false, maxChars }: RunOptions = {},
 ): Promise<ToolResult> => {
+  const budget = maxChars ?? budgetOf(given, ctx.config.output.maxTextChars);
+  const args = withoutBudget(given);
   const { schema, layout } = toolInput(spec, op);
   const entry = curated ? catalogEntry(op.operationId) : undefined;
   const known = Object.keys(schema.properties ?? {});
@@ -136,7 +143,7 @@ export const runOperation = async (
   try {
     const response = await ctx.client.send({ method: op.method, path, query: parts.query, body: parts.body, signal });
     const data = _omitted(_picked(response.data, entry?.pick), entry?.omit);
-    return respond(data, ctx.config.output.maxTextChars, _moreRows(layout, merged[OFFSET]));
+    return respond(data, budget, _moreRows(layout, merged[OFFSET]));
   } catch (err) {
     const refused = err instanceof JottyError && err.status < SERVER_ERROR;
     (refused ? logger.debug : logger.warn)(LOG_NS, `${op.operationId} failed`, err);
diff --git a/mcp-server/src/tools/register.ts b/mcp-server/src/tools/register.ts
index e970e176c..2b9865dd1 100644
--- a/mcp-server/src/tools/register.ts
+++ b/mcp-server/src/tools/register.ts
@@ -2,7 +2,7 @@ import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, type Tool } from "@modelcontextprotocol/sdk/types.js";
 import type { Spec } from "../jotty/spec.ts";
 import { logger } from "../utils/logger.ts";
-import { BUILTIN_TOOLS, runBuiltin } from "./builtins.ts";
+import { builtinTools, runBuiltin } from "./builtins.ts";
 import { CURATED_OPERATIONS, toolNameOf } from "./catalog.ts";
 import { BuiltinTool, type ToolContext } from "./context.ts";
 import { ToolErrorKind, errorResult } from "./errors.ts";
@@ -28,8 +28,9 @@ const _loadSpec = (ctx: ToolContext, signal?: AbortSignal): Promise<Spec | null>
 export const registerTools = (server: Server, ctx: ToolContext): void => {
   server.setRequestHandler(ListToolsRequestSchema, async (_request, extra) => {
     const spec = await _loadSpec(ctx, extra.signal);
-    const tools: Tool[] = spec ? _curated(spec).map((op) => operationTool(spec, op)) : [];
-    return { tools: [...tools, ...BUILTIN_TOOLS] };
+    const maxChars = ctx.config.output.maxTextChars;
+    const tools: Tool[] = spec ? _curated(spec).map((op) => operationTool(spec, op, maxChars)) : [];
+    return { tools: [...tools, ...builtinTools(maxChars)] };
   });
 
   server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
diff --git a/mcp-server/src/tools/result.ts b/mcp-server/src/tools/result.ts
index 1be321080..4e0873edf 100644
--- a/mcp-server/src/tools/result.ts
+++ b/mcp-server/src/tools/result.ts
@@ -12,7 +12,7 @@ export interface Trimmed {
   hint: string;
 }
 
-const CUT_TEXT = "Narrow the request with a filter, limit and offset, or view=summary.";
+const CUT_TEXT = "Pass a bigger maxChars to get it whole, or narrow the request with a filter, limit and offset, or view=summary.";
 
 export type MoreRows = (shown: number) => string;
 
diff --git a/mcp-server/tests/helpers.ts b/mcp-server/tests/helpers.ts
index e68bed302..4a2ae2bb0 100644
--- a/mcp-server/tests/helpers.ts
+++ b/mcp-server/tests/helpers.ts
@@ -112,6 +112,13 @@ export const FAKE_SPEC: OpenApiDocument = {
         },
       },
     },
+    "/admin/duplicate-uuids": {
+      get: {
+        operationId: "listDuplicateUuids",
+        summary: "Find items that share a uuid",
+        tags: ["Admin"],
+      },
+    },
     "/exports/{filename}": {
       get: {
         operationId: "downloadExport",
@@ -173,6 +180,7 @@ export const serveJotty = (spec: OpenApiDocument | null = FAKE_SPEC): FakeJotty
       if (url.pathname === "/api/search") {
         return _json({ results: [{ uuid: "u-1", slug: "milk", id: "milk", title: "Milk" }], total: 1 });
       }
+      if (url.pathname === "/api/admin/duplicate-uuids") return _json({ duplicates: [{ uuid: "d-1" }], total: 1 });
       if (url.pathname === "/api/tasks") return _json({ tasks: MANY_NOTES });
       if (url.pathname === "/api/tasks/bad/statuses") return _json({ error: "Status id is required" }, 400);
       if (url.pathname.endsWith("/check")) return _json({ error: "Item index out of range" }, 400);
diff --git a/mcp-server/tests/session.test.ts b/mcp-server/tests/session.test.ts
index 691be12d9..3c2238e32 100644
--- a/mcp-server/tests/session.test.ts
+++ b/mcp-server/tests/session.test.ts
@@ -55,6 +55,7 @@ describe("http transport", () => {
       "check_checklist_item",
       "update_board_item",
       "connect_items",
+      "list_duplicate_uuids",
       "discover",
       "call_operation",
       "health",
diff --git a/mcp-server/tests/tools.test.ts b/mcp-server/tests/tools.test.ts
index c50fc054a..7dce86c43 100644
--- a/mcp-server/tests/tools.test.ts
+++ b/mcp-server/tests/tools.test.ts
@@ -1,8 +1,8 @@
 import { afterAll, describe, expect, it } from "bun:test";
 import { toSpec } from "../src/jotty/spec.ts";
-import { runBuiltin } from "../src/tools/builtins.ts";
+import { builtinTools, runBuiltin } from "../src/tools/builtins.ts";
 import { BuiltinTool } from "../src/tools/context.ts";
-import { runOperation } from "../src/tools/operation.ts";
+import { operationTool, runOperation } from "../src/tools/operation.ts";
 import { FAKE_SPEC, makeCtx, serveJotty, structured, text } from "./helpers.ts";
 
 const jotty = serveJotty();
@@ -94,6 +94,28 @@ describe("runOperation", () => {
     expect(result.structuredContent).toBeUndefined();
   });
 
+  it("lets the caller raise maxChars for one call without sending it to Jotty", async () => {
+    const ctx = makeCtx(jotty.url);
+    ctx.config.output.maxTextChars = 20;
+    const result = await runOperation(ctx, spec, op("getNote"), { noteId: "n-1", maxChars: 5_000 });
+    expect(text(result)).not.toContain("cut at");
+    expect(structured(result)).toMatchObject({ data: { title: "Milk" } });
+    expect(jotty.hits.at(-1)?.path).toBe("/api/notes/n-1");
+  });
+
+  it("lets the caller lower maxChars and says how to get the rest", async () => {
+    const result = await runOperation(makeCtx(jotty.url), spec, op("getNote"), { noteId: "n-1", maxChars: 30 });
+    expect(text(result)).toContain("cut at 30");
+    expect(text(result)).toContain("maxChars");
+  });
+
+  it("offers maxChars on every tool, defaulting to the server setting", () => {
+    const tool = operationTool(spec, op("getNote"), 12_000);
+    expect(tool.inputSchema.properties?.maxChars).toMatchObject({ type: "integer", minimum: 1 });
+    expect(JSON.stringify(tool.inputSchema.properties?.maxChars)).toContain("12000");
+    expect(builtinTools(12_000).find((entry) => entry.name === "call_operation")?.inputSchema.properties?.maxChars).toBeDefined();
+  });
+
   it("applies the catalog defaults to curated tools only", async () => {
     await runOperation(makeCtx(jotty.url), spec, op("listNotes"), {}, { curated: true });
     expect(jotty.hits.at(-1)?.path).toBe("/api/notes?view=summary&limit=25");
@@ -132,7 +154,7 @@ describe("builtins", () => {
     const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.Discover, {});
     const data = structured(result);
     expect(data.version).toBe("9.9.9");
-    expect(data.tools).toEqual(["search", "list_notes", "get_note", "create_note", "delete_note", "check_checklist_item", "update_board_item", "connect_items"]);
+    expect(data.tools).toEqual(["search", "list_notes", "get_note", "create_note", "delete_note", "check_checklist_item", "update_board_item", "connect_items", "list_duplicate_uuids"]);
     expect(data.unavailableTools).toContain("list_boards");
   });
 
@@ -170,6 +192,19 @@ describe("builtins", () => {
     expect(structured(result).error).toMatchObject({ kind: "not_found" });
   });
 
+  it("call_operation honours maxChars", async () => {
+    const ctx = makeCtx(jotty.url);
+    ctx.config.output.maxTextChars = 20;
+    const result = await runBuiltin(ctx, BuiltinTool.CallOperation, { operationId: "getNote", arguments: { noteId: "n-1" }, maxChars: 5_000 });
+    expect(text(result)).not.toContain("cut at");
+  });
+
+  it("health counts uuids shared by more than one file", async () => {
+    const result = await runBuiltin(makeCtx(jotty.url), BuiltinTool.Health, {});
+    expect(structured(result)).toMatchObject({ apiKey: "accepted", duplicateUuids: 1 });
+    expect(text(result)).toContain("list_duplicate_uuids");
+  });
+
   it("health reports a rejected key without failing", async () => {
     const result = await runBuiltin(makeCtx(jotty.url, "wrong"), BuiltinTool.Health, {});
     expect(structured(result)).toMatchObject({ apiKey: "rejected", operations: 0 });
diff --git a/tests/api/duplicate-uuids.test.ts b/tests/api/duplicate-uuids.test.ts
new file mode 100644
index 000000000..5df52ed46
--- /dev/null
+++ b/tests/api/duplicate-uuids.test.ts
@@ -0,0 +1,88 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  mockGetAppSettings,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup";
+
+const mockUserIndex = vi.fn();
+const mockFind = vi.fn();
+const mockRepair = vi.fn();
+
+vi.mock("@/app/_server/actions/users/helpers", () => ({
+  getUserIndex: (...args: unknown[]) => mockUserIndex(...args),
+}));
+vi.mock("@/app/_server/actions/uuid-clash/scan", () => ({
+  findClashes: (...args: unknown[]) => mockFind(...args),
+}));
+vi.mock("@/app/_server/actions/uuid-clash/repair", () => ({
+  NO_CLASH: "No duplicate for that uuid",
+  NOT_CLAIMANT: "That path does not hold the duplicated uuid",
+  repairClash: (...args: unknown[]) => mockRepair(...args),
+}));
+
+import { GET, POST } from "@/app/api/admin/duplicate-uuids/route";
+
+const DUP = "aaaaaaaa-1111-4222-8333-944455556666";
+const admin = { ...mockUser, isAdmin: true };
+const superAdmin = { ...mockUser, isAdmin: true, isSuperAdmin: true };
+
+const list = (query = "") => GET(createMockRequest("GET", `http://localhost:3000/api/admin/duplicate-uuids${query}`));
+const repair = (body: object) =>
+  POST(createMockRequest("POST", "http://localhost:3000/api/admin/duplicate-uuids", body));
+
+describe("duplicate uuid routes", () => {
+  beforeEach(() => {
+    resetApiMocks();
+    mockAuthenticateApiKey.mockResolvedValue(mockUser);
+    mockUserIndex.mockResolvedValue(0);
+    mockFind.mockResolvedValue([]);
+    mockGetAppSettings.mockResolvedValue({ success: true, data: { adminContentAccess: "yes" } });
+  });
+
+  it("lists the caller's own duplicates", async () => {
+    mockFind.mockResolvedValue([{ uuid: DUP, owner: mockUser.username, files: [] }]);
+    const response = await list();
+    expect(response.status).toBe(200);
+    expect((await getResponseJson(response)).total).toBe(1);
+    expect(mockFind).toHaveBeenCalledWith(mockUser.username);
+  });
+
+  it("refuses somebody else's files to a plain user, before saying whether they exist", async () => {
+    mockUserIndex.mockResolvedValue(-1);
+    expect((await list("?username=bob")).status).toBe(403);
+    expect((await repair({ uuid: DUP, username: "bob" })).status).toBe(403);
+    expect(mockFind).not.toHaveBeenCalled();
+    expect(mockRepair).not.toHaveBeenCalled();
+  });
+
+  it("refuses an admin when the instance keeps admins out of other people's content", async () => {
+    mockAuthenticateApiKey.mockResolvedValue(admin);
+    mockGetAppSettings.mockResolvedValue({ success: true, data: { adminContentAccess: "no" } });
+    expect((await list("?username=bob")).status).toBe(403);
+    expect(mockFind).not.toHaveBeenCalled();
+  });
+
+  it("lets an admin with content access, or the superadmin, look at another user", async () => {
+    mockAuthenticateApiKey.mockResolvedValue(admin);
+    expect((await list("?username=bob")).status).toBe(200);
+    expect(mockFind).toHaveBeenCalledWith("bob");
+
+    mockGetAppSettings.mockResolvedValue({ success: true, data: { adminContentAccess: "no" } });
+    mockAuthenticateApiKey.mockResolvedValue(superAdmin);
+    expect((await list("?username=bob")).status).toBe(200);
+  });
+
+  it("repairs and maps a missing duplicate to 404", async () => {
+    mockRepair.mockResolvedValue({ success: true, data: { uuid: DUP, rekeyed: [], relinked: [], ambiguous: [], skipped: [] } });
+    const response = await repair({ uuid: DUP, path: "notes/Home/a.md" });
+    expect(response.status).toBe(200);
+    expect(mockRepair).toHaveBeenCalledWith(mockUser, mockUser.username, DUP, "notes/Home/a.md");
+
+    mockRepair.mockResolvedValue({ success: false, error: "No duplicate for that uuid" });
+    expect((await repair({ uuid: DUP })).status).toBe(404);
+  });
+});
diff --git a/tests/api/howto.test.ts b/tests/api/howto.test.ts
new file mode 100644
index 000000000..19309c6b2
--- /dev/null
+++ b/tests/api/howto.test.ts
@@ -0,0 +1,54 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  mockReadFile,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup";
+
+import { GET as LIST } from "@/app/api/howto/route";
+import { GET as READ } from "@/app/api/howto/[docId]/route";
+import { getHowtoGuides } from "@/app/_utils/howto-utils";
+
+const GUIDE = "# Garden guide\n\nPlant things.\n";
+
+const read = (docId: string, query = "") =>
+  READ(createMockRequest("GET", `http://localhost:3000/api/howto/${docId}${query}`), {
+    params: Promise.resolve({ docId }),
+  });
+
+describe("how-to guides over the API", () => {
+  beforeEach(() => {
+    resetApiMocks();
+    mockAuthenticateApiKey.mockResolvedValue(mockUser);
+    mockReadFile.mockResolvedValue(GUIDE);
+  });
+
+  it("lists every guide in the app's registry with its heading as the title", async () => {
+    const body = await getResponseJson(await LIST(createMockRequest("GET", "http://localhost:3000/api/howto")));
+    const ids = getHowtoGuides((key: string) => key).map((guide) => guide.id);
+    expect(body.total).toBe(ids.length);
+    expect(body.docs[0]).toEqual({ id: ids[0], title: "Garden guide" });
+  });
+
+  it("reads one guide, in parts when asked", async () => {
+    const whole = await getResponseJson(await read("mcp"));
+    const part = await getResponseJson(await read("mcp", "?limit=8"));
+    expect(whole).toEqual({ id: "mcp", title: "Garden guide", content: GUIDE, contentLength: GUIDE.length });
+    expect(part).toMatchObject({ content: "# Garden", nextOffset: 8 });
+    expect(mockReadFile).toHaveBeenCalledWith(expect.stringMatching(/howto[\\/]MCP\.md$/));
+  });
+
+  it("only opens files from the registry", async () => {
+    const response = await read("..%2F..%2Fdata%2Fusers%2Fusers.json");
+    expect(response.status).toBe(404);
+    expect(mockReadFile).not.toHaveBeenCalled();
+  });
+
+  it("needs an API key", async () => {
+    mockAuthenticateApiKey.mockResolvedValue(null);
+    expect((await read("mcp")).status).toBe(401);
+  });
+});
diff --git a/tests/api/note-edits.test.ts b/tests/api/note-edits.test.ts
new file mode 100644
index 000000000..c0b94df99
--- /dev/null
+++ b/tests/api/note-edits.test.ts
@@ -0,0 +1,187 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import {
+  mockUser,
+  mockAuthenticateApiKey,
+  mockGetUserNotes,
+  mockGetUserChecklists,
+  mockGetNoteById,
+  mockSpliceNote,
+  resetApiMocks,
+  createMockRequest,
+  getResponseJson,
+} from "./setup";
+import { GET as LIST } from "@/app/api/notes/route";
+import { GET as READ, PATCH } from "@/app/api/notes/[noteId]/route";
+import { POST as TAG } from "@/app/api/notes/[noteId]/tags/route";
+import { GET as TAGS } from "@/app/api/tags/route";
+import { MANAGED_WARNING } from "@/app/_consts/notes";
+import { FIND_AMBIGUOUS } from "@/app/_utils/note-edits";
+import { SPLICE_DENIED, SPLICE_ENCRYPTED, SPLICE_UNCHANGED } from "@/app/_server/actions/note/splice";
+
+const NOTE = "aaaaaaaa-1111-4222-8333-944455556666";
+const OTHER = "bbbbbbbb-1111-4222-8333-944455556666";
+const params = { params: Promise.resolve({ noteId: NOTE }) };
+
+const stored = {
+  id: "garden-plan",
+  uuid: NOTE,
+  title: "Garden plan",
+  category: "Home",
+  content: "0123456789",
+  owner: "testuser",
+  tags: ["garden"],
+  extraMetadata: { managed: true },
+};
+
+const spliced = (extra = {}) => ({
+  success: true,
+  data: { uuid: NOTE, title: "Garden plan", category: "Home", tags: ["garden"], managed: false, ...extra },
+});
+
+describe("note edits over the API", () => {
+  beforeEach(() => {
+    resetApiMocks();
+    mockAuthenticateApiKey.mockResolvedValue(mockUser);
+  });
+
+  describe("GET /api/notes/{noteId}", () => {
+    it("returns the whole content with its length, tags and the managed flag", async () => {
+      mockGetNoteById.mockResolvedValue(stored);
+      const body = await getResponseJson(await READ(createMockRequest("GET", `/api/notes/${NOTE}`), params));
+      expect(body.data).toMatchObject({ content: "0123456789", contentLength: 10, tags: ["garden"], managed: true });
+      expect(body.data.nextOffset).toBeUndefined();
+    });
+
+    it("pages through long content with offset and limit", async () => {
+      mockGetNoteById.mockResolvedValue(stored);
+      const first = await getResponseJson(
+        await READ(createMockRequest("GET", `/api/notes/${NOTE}?limit=4`), params),
+      );
+      const last = await getResponseJson(
+        await READ(createMockRequest("GET", `/api/notes/${NOTE}?offset=8&limit=4`), params),
+      );
+      expect(first.data).toMatchObject({ content: "0123", contentLength: 10, nextOffset: 4 });
+      expect(last.data).toMatchObject({ content: "89", contentLength: 10 });
+      expect(last.data.nextOffset).toBeUndefined();
+    });
+  });
+
+  describe("GET /api/notes", () => {
+    const notes = [
+      { ...stored, uuid: NOTE, tags: ["home/garden"] },
+      { ...stored, uuid: OTHER, title: "Work log", tags: ["work"], extraMetadata: undefined },
+    ];
+
+    it("reads several notes by id in one call", async () => {
+      mockGetUserNotes.mockResolvedValue({ success: true, data: notes });
+      const body = await getResponseJson(await LIST(createMockRequest("GET", `/api/notes?ids=${OTHER.toUpperCase()}, nope`)));
+      expect(body.notes.map((note: { id: string }) => note.id)).toEqual([OTHER]);
+    });
+
+    it("filters by tag, nested tags included", async () => {
+      mockGetUserNotes.mockResolvedValue({ success: true, data: notes });
+      const body = await getResponseJson(await LIST(createMockRequest("GET", "/api/notes?tag=home")));
+      expect(body.notes).toHaveLength(1);
+      expect(body.notes[0]).toMatchObject({ id: NOTE, tags: ["home/garden"], managed: true });
+    });
+  });
+
+  describe("PATCH /api/notes/{noteId}", () => {
+    it("runs the find and replace inside the note's splice", async () => {
+      mockSpliceNote.mockImplementation(async (_user, _uuid, edit) => {
+        expect(edit("keep old keep")).toEqual({ body: "keep new keep" });
+        return spliced();
+      });
+      const response = await PATCH(
+        createMockRequest("PATCH", `/api/notes/${NOTE}`, { find: "old", replace: "new" }),
+        params,
+      );
+      expect(response.status).toBe(200);
+      expect(mockSpliceNote).toHaveBeenCalledWith(mockUser, NOTE, expect.any(Function));
+      expect((await getResponseJson(response)).warning).toBeUndefined();
+    });
+
+    it("warns when a script manages the note", async () => {
+      mockSpliceNote.mockResolvedValue(spliced({ managed: true }));
+      const body = await getResponseJson(
+        await PATCH(createMockRequest("PATCH", `/api/notes/${NOTE}`, { find: "a", replace: "b" }), params),
+      );
+      expect(body.warning).toBe(MANAGED_WARNING);
+    });
+
+    it.each([
+      [FIND_AMBIGUOUS, 400],
+      [SPLICE_ENCRYPTED, 400],
+      [SPLICE_DENIED, 403],
+    ])("turns %s into a %i", async (error, status) => {
+      mockSpliceNote.mockResolvedValue({ success: false, error });
+      const response = await PATCH(
+        createMockRequest("PATCH", `/api/notes/${NOTE}`, { find: "a", replace: "b" }),
+        params,
+      );
+      expect(response.status).toBe(status);
+    });
+
+    it("needs a find text", async () => {
+      const response = await PATCH(createMockRequest("PATCH", `/api/notes/${NOTE}`, { replace: "b" }), params);
+      expect(response.status).toBe(400);
+      expect(mockSpliceNote).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("POST /api/notes/{noteId}/tags", () => {
+    it("adds and removes hashtags without resending the note", async () => {
+      mockSpliceNote.mockImplementation(async (_user, _uuid, edit) => {
+        expect(edit("Body #old\n")).toEqual({ body: "Body\n\n#new\n" });
+        return spliced({ tags: ["new"] });
+      });
+      const body = await getResponseJson(
+        await TAG(createMockRequest("POST", `/api/notes/${NOTE}/tags`, { add: ["#New"], remove: ["old"] }), params),
+      );
+      expect(body.data).toEqual({ id: NOTE, title: "Garden plan", tags: ["new"], changed: true });
+    });
+
+    it("answers without writing when the tags already match", async () => {
+      mockSpliceNote.mockResolvedValue({ success: false, error: SPLICE_UNCHANGED });
+      mockGetNoteById.mockResolvedValue(stored);
+      const body = await getResponseJson(
+        await TAG(createMockRequest("POST", `/api/notes/${NOTE}/tags`, { add: ["garden"] }), params),
+      );
+      expect(body.data).toMatchObject({ tags: ["garden"], changed: false });
+      expect(body.warning).toBe(MANAGED_WARNING);
+    });
+
+    it("refuses tag names that can't be hashtags", async () => {
+      const response = await TAG(
+        createMockRequest("POST", `/api/notes/${NOTE}/tags`, { add: ["two words"] }),
+        params,
+      );
+      expect(response.status).toBe(400);
+      expect(mockSpliceNote).not.toHaveBeenCalled();
+    });
+
+    it("needs add or remove", async () => {
+      const response = await TAG(createMockRequest("POST", `/api/notes/${NOTE}/tags`, {}), params);
+      expect(response.status).toBe(400);
+    });
+  });
+
+  describe("GET /api/tags", () => {
+    it("counts each tag across notes and checklists", async () => {
+      mockGetUserNotes.mockResolvedValue({
+        success: true,
+        data: [{ uuid: NOTE, tags: ["Garden", "work"] }, { uuid: OTHER, tags: ["garden"] }],
+      });
+      mockGetUserChecklists.mockResolvedValue({ success: true, data: [{ uuid: "c", tags: ["garden"] }] });
+
+      const body = await getResponseJson(await TAGS(createMockRequest("GET", "/api/tags")));
+      expect(body).toEqual({
+        tags: [
+          { tag: "garden", notes: 2, checklists: 1 },
+          { tag: "work", notes: 1, checklists: 0 },
+        ],
+        total: 2,
+      });
+    });
+  });
+});
diff --git a/tests/api/relations.test.ts b/tests/api/relations.test.ts
index 3295082e3..4dda9c578 100644
--- a/tests/api/relations.test.ts
+++ b/tests/api/relations.test.ts
@@ -13,6 +13,7 @@ import { ItemTypes } from "@/app/_types/enums";
 const mockVisible = vi.fn();
 const mockLink = vi.fn();
 const mockRelated = vi.fn();
+const mockUnlink = vi.fn();
 
 vi.mock("@/app/_server/actions/relations/queries", () => ({
   visibleItems: (...args: unknown[]) => mockVisible(...args),
@@ -21,12 +22,15 @@ vi.mock("@/app/_server/actions/relations/explore", () => ({
   LINKS_OFF: "Links are turned off on this instance",
   NOT_VISIBLE: "Not found",
   DENIED: "Permission denied",
+  LINK_MISSING: "The source note has no link to that item",
   linkItems: (...args: unknown[]) => mockLink(...args),
+  unlinkItems: (...args: unknown[]) => mockUnlink(...args),
   relatedFor: (...args: unknown[]) => mockRelated(...args),
 }));
 
 import { GET as SHARES } from "@/app/api/shares/route";
-import { POST as CONNECT } from "@/app/api/relations/links/route";
+import { POST as CONNECT, DELETE as DISCONNECT } from "@/app/api/relations/links/route";
+import { MANAGED_WARNING } from "@/app/_consts/notes";
 import { GET as RELATED } from "@/app/api/relations/[itemId]/route";
 
 const READ = { canRead: true, canEdit: false, canDelete: false };
@@ -43,6 +47,9 @@ const shares = (query = "") =>
 const connect = (body: object) =>
   CONNECT(createMockRequest("POST", "http://localhost:3000/api/relations/links", body));
 
+const disconnect = (body: object) =>
+  DISCONNECT(createMockRequest("DELETE", "http://localhost:3000/api/relations/links", body));
+
 describe("Relations and shares contracts", () => {
   beforeEach(() => {
     resetApiMocks();
@@ -92,12 +99,19 @@ describe("Relations and shares contracts", () => {
 
   describe("POST /api/relations/links", () => {
     it("links as the key owner, appending by default", async () => {
-      mockLink.mockResolvedValue({ success: true, data: null });
+      mockLink.mockResolvedValue({ success: true, data: { managed: false } });
       const response = await connect({ source: "n-1", target: "c-1" });
       expect(response.status).toBe(200);
+      expect(await getResponseJson(response)).toEqual({ success: true });
       expect(mockLink).toHaveBeenCalledWith(mockUser, "n-1", "c-1", "append");
     });
 
+    it("warns when the source note is managed by a script", async () => {
+      mockLink.mockResolvedValue({ success: true, data: { managed: true } });
+      const body = await getResponseJson(await connect({ source: "n-1", target: "c-1" }));
+      expect(body).toEqual({ success: true, warning: MANAGED_WARNING });
+    });
+
     it.each([
       ["Not found", 404],
       ["Links are turned off on this instance", 404],
@@ -117,6 +131,25 @@ describe("Relations and shares contracts", () => {
     });
   });
 
+  describe("DELETE /api/relations/links", () => {
+    it("reports how many links it removed and the wikilinks it left", async () => {
+      mockUnlink.mockResolvedValue({ success: true, data: { removed: 2, wikiLinks: 1, managed: false } });
+      const response = await disconnect({ source: "n-1", target: "c-1" });
+      expect(response.status).toBe(200);
+      expect(await getResponseJson(response)).toEqual({ success: true, removed: 2, wikiLinks: 1 });
+      expect(mockUnlink).toHaveBeenCalledWith(mockUser, "n-1", "c-1");
+    });
+
+    it.each([
+      ["The source note has no link to that item", 404],
+      ["Permission denied", 403],
+      ["Encrypted notes stay closed", 400],
+    ])("turns %s into a %i", async (error, status) => {
+      mockUnlink.mockResolvedValue({ success: false, error });
+      expect((await disconnect({ source: "n-1", target: "c-1" })).status).toBe(status);
+    });
+  });
+
   it("GET /api/relations/{itemId} is a 404 for items the caller can't see", async () => {
     mockRelated.mockResolvedValue({ success: false, error: "Not found" });
     const response = await RELATED(createMockRequest("GET", "http://localhost:3000/api/relations/x"), {
diff --git a/tests/api/setup.ts b/tests/api/setup.ts
index 1b53e0952..8fa52bce0 100644
--- a/tests/api/setup.ts
+++ b/tests/api/setup.ts
@@ -10,6 +10,9 @@ export const mockUser = {
 
 export const mockAuthenticateApiKey = vi.fn();
 export const mockEditNote = vi.fn();
+export const mockGetNoteById = vi.fn();
+export const mockReadFile = vi.fn();
+export const mockSpliceNote = vi.fn();
 export const mockDropNote = vi.fn();
 export const mockEditList = vi.fn();
 export const mockDropList = vi.fn();
@@ -58,6 +61,12 @@ vi.mock("@/app/_server/actions/api", () => ({
 
 vi.mock("@/app/_server/actions/note/queries", () => ({
   getUserNotes: (...args: any[]) => mockGetUserNotes(...args),
+  getNoteById: (...args: any[]) => mockGetNoteById(...args),
+}));
+
+vi.mock("@/app/_server/actions/note/splice", async (original) => ({
+  ...(await original<typeof import("@/app/_server/actions/note/splice")>()),
+  spliceNote: (...args: any[]) => mockSpliceNote(...args),
 }));
 
 vi.mock("@/app/_server/actions/note", () => ({
@@ -148,6 +157,7 @@ vi.mock("@/app/_server/actions/users/records", () => ({
 
 vi.mock("@/app/_server/actions/file", () => ({
   serverWriteFile: (...args: any[]) => mockServerWriteFile(...args),
+  readFile: (...args: any[]) => mockReadFile(...args),
 }));
 
 vi.mock("@/app/_server/actions/export", () => ({
@@ -183,6 +193,9 @@ export function resetApiMocks() {
   mockAuthenticateApiKey.mockReset();
   mockGetCurrentUser.mockReset();
   mockEditNote.mockReset();
+  mockGetNoteById.mockReset();
+  mockReadFile.mockReset();
+  mockSpliceNote.mockReset();
   mockDropNote.mockReset();
   mockEditList.mockReset();
   mockDropList.mockReset();
@@ -253,7 +266,7 @@ export function createMockRequest(
     headers: requestHeaders,
   };
 
-  if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
+  if (body && method !== "GET" && method !== "HEAD") {
     requestInit.body = JSON.stringify(body);
   }
 
diff --git a/tests/api/tasks.test.ts b/tests/api/tasks.test.ts
index 3120bbb51..5330742ef 100644
--- a/tests/api/tasks.test.ts
+++ b/tests/api/tasks.test.ts
@@ -359,6 +359,21 @@ describe("Tasks API", () => {
       expect(data.data.id).toBe("review")
     })
 
+    it("accepts a null color as no color", async () => {
+      mockGetListById.mockResolvedValue(mockTask)
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks/task-uuid-1/statuses", {
+        id: "review",
+        label: "In Review",
+        color: null,
+      })
+      const response = await POST_STATUS(request, { params: Promise.resolve({ taskId: "task-uuid-1" }) })
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(200)
+      expect(data.data.color).toBeUndefined()
+    })
+
     it("should return 400 when id or label is missing", async () => {
       mockGetListById.mockResolvedValue(mockTask)
 
@@ -838,6 +853,22 @@ describe("Tasks API", () => {
       expect(mockMakeList).not.toHaveBeenCalled()
     })
 
+    it("treats a null column color as no color", async () => {
+      mockMakeList.mockImplementation(async (_user: unknown, _form: FormData, statuses?: unknown[]) => ({
+        success: true,
+        data: { ...created, statuses },
+      }))
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/tasks", {
+        title: "Sprint",
+        statuses: [{ id: "todo", label: "To Do", color: null }],
+      })
+      const response = await POST_TASKS(request)
+      const data = await getResponseJson(response)
+
+      expect(response.status).toBe(200)
+      expect(data.data.statuses).toEqual([{ id: "todo", label: "To Do", order: 0 }])
+    })
   })
 
   describe("input validation", () => {
diff --git a/tests/server-actions/note-move-safety.test.ts b/tests/server-actions/note-move-safety.test.ts
index e848dddfe..2b6233f54 100644
--- a/tests/server-actions/note-move-safety.test.ts
+++ b/tests/server-actions/note-move-safety.test.ts
@@ -66,7 +66,7 @@ vi.mock("@/app/_utils/filename-utils", () => ({
   },
 }));
 
-import { editNote, rewriteNote } from "@/app/_server/actions/note/editor";
+import { editNote } from "@/app/_server/actions/note/editor";
 
 const actor = { username: "alice", fileRenameMode: "minimal" } as never;
 const dirOf = (category: string) => path.join(process.cwd(), NOTES_DIR("alice"), category);
@@ -84,17 +84,6 @@ describe("notes never land on top of each other", () => {
     notes.clear();
   });
 
-  it("keeps a note in its category when a link is written into it", async () => {
-    seed("n-1", "Homelab/Neovim", "Neovim things");
-
-    const result = await rewriteNote(actor, "n-1", (content) => `${content}\n\n[Shortcuts](/note/n-2)\n`);
-
-    expect(result).toMatchObject({ success: true });
-    const written = Array.from(disk.keys());
-    expect(written).toEqual([path.join(dirOf("Homelab/Neovim"), "overview.md")]);
-    expect(disk.get(written[0])).toContain("[Shortcuts](/note/n-2)");
-  });
-
   it("gives a moved note a free filename instead of overwriting a namesake", async () => {
     seed("n-1", "Homelab/Neovim", "Neovim things");
     seed("n-2", "Uncategorized", "Hyprland things");
diff --git a/tests/server-actions/note-splice.test.ts b/tests/server-actions/note-splice.test.ts
new file mode 100644
index 000000000..ab6e2376b
--- /dev/null
+++ b/tests/server-actions/note-splice.test.ts
@@ -0,0 +1,119 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import nodeFs from "fs";
+import os from "os";
+import path from "path";
+import { mockFs, resetAllMocks } from "../setup";
+import { RelationsStatus } from "@/app/_consts/relations";
+import type { SanitisedUser } from "@/app/_types";
+
+const mockCanReach = vi.fn();
+const mockBroadcast = vi.fn();
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: (...args: unknown[]) => mockBroadcast(...args),
+}));
+vi.mock("@/app/_server/actions/share/queries", () => ({
+  canReach: (...args: unknown[]) => mockCanReach(...args),
+}));
+vi.mock("@/app/_server/actions/users", () => ({
+  getUserByNoteUuid: async () => ({ success: true, data: { username: "alice" } }),
+}));
+vi.mock("@/app/_server/actions/history", () => ({ commitNote: vi.fn().mockResolvedValue({ success: true }) }));
+vi.mock("@/app/_server/actions/log", () => ({ logContentEvent: vi.fn() }));
+
+import { SPLICE_DENIED, SPLICE_ENCRYPTED, spliceNote } from "@/app/_server/actions/note/splice";
+import { closeRelationsDb, setRelationsStatus } from "@/app/_server/actions/relations/store";
+import { findReplace } from "@/app/_utils/note-edits";
+import { unlinkItem } from "@/app/_utils/item-links";
+
+const NOTE = "aaaaaaaa-1111-4222-8333-944455556666";
+const TARGET = "bbbbbbbb-1111-4222-8333-944455556666";
+const alice = { username: "alice" } as SanitisedUser;
+
+let root: string;
+let filePath: string;
+
+const put = (content: string) => {
+  nodeFs.mkdirSync(path.dirname(filePath), { recursive: true });
+  nodeFs.writeFileSync(filePath, content);
+};
+
+const onDisk = () => nodeFs.readFileSync(filePath, "utf-8");
+
+describe("spliceNote", () => {
+  beforeEach(async () => {
+    resetAllMocks();
+    const real = await vi.importActual<typeof import("fs/promises")>("fs/promises");
+    mockFs.readFile.mockImplementation(real.readFile as never);
+    mockFs.writeFile.mockImplementation(real.writeFile as never);
+    mockFs.stat.mockImplementation(real.stat as never);
+    mockFs.rename.mockImplementation(real.rename as never);
+    mockFs.mkdir.mockImplementation(real.mkdir as never);
+    mockFs.access.mockImplementation(real.access as never);
+    mockFs.unlink.mockImplementation(real.unlink as never);
+    root = nodeFs.mkdtempSync(path.join(os.tmpdir(), "jotty-splice-"));
+    vi.spyOn(process, "cwd").mockReturnValue(root);
+    process.env.JOTTY_RELATIONS_DB = path.join(root, "relations.db");
+    closeRelationsDb();
+    setRelationsStatus(RelationsStatus.READY);
+    filePath = path.join(root, "data", "notes", "alice", "Home", "plan.md");
+    mockCanReach.mockResolvedValue(true);
+  });
+
+  afterEach(() => {
+    closeRelationsDb();
+    vi.restoreAllMocks();
+    nodeFs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("removes a link in place, keeping every other byte, CRLF and frontmatter included", async () => {
+    const head = `---\r\nuuid: ${NOTE}\r\ntitle: 'Plan'\r\ncreatedAt: 2020-01-01T00:00:00.000Z\r\nsource: script\r\n---\r\n`;
+    put(`${head}Intro  \r\n\r\n[Target](/note/${TARGET})\r\n\r\nOutro\r\n`);
+
+    const result = await spliceNote(alice, NOTE, (body) => ({ body: unlinkItem(body, TARGET).text }));
+
+    expect(result.error).toBeUndefined();
+    expect(onDisk()).toBe(`${head}Intro  \r\n\r\nOutro\r\n`);
+    expect(nodeFs.readdirSync(path.dirname(filePath))).toEqual(["plan.md"]);
+    expect(mockBroadcast).toHaveBeenCalledWith(expect.objectContaining({ entityId: NOTE }));
+  });
+
+  it("keeps frontmatter tags in step when an edit changes the hashtags", async () => {
+    put(`---\nuuid: ${NOTE}\ntitle: Plan\ncreatedAt: 2020-01-01T00:00:00.000Z\ntags:\n  - legacy\n---\nText #old\n`);
+
+    const result = await spliceNote(alice, NOTE, (body) => findReplace(body, "#old", "#fresh"));
+
+    expect(result.data?.tags).toEqual(["fresh", "legacy"]);
+    expect(onDisk()).toContain("  - fresh\n  - legacy\n");
+    expect(onDisk().endsWith("---\nText #fresh\n")).toBe(true);
+  });
+
+  it("drops a tag that only lives in frontmatter when asked to untag it", async () => {
+    put(`---\nuuid: ${NOTE}\ntitle: Plan\ncreatedAt: 2020-01-01T00:00:00.000Z\ntags:\n  - hidden\n  - work\n---\nBody #work\n`);
+
+    const result = await spliceNote(alice, NOTE, (body) => ({ body }), { untag: ["hidden"] });
+
+    expect(result.data?.tags).toEqual(["work"]);
+    expect(onDisk()).not.toContain("hidden");
+    expect(onDisk().endsWith("---\nBody #work\n")).toBe(true);
+  });
+
+  it("reports a managed note so callers can warn", async () => {
+    put(`---\nuuid: ${NOTE}\ntitle: Plan\ncreatedAt: 2020-01-01T00:00:00.000Z\nmanaged: true\n---\nold\n`);
+    const result = await spliceNote(alice, NOTE, (body) => findReplace(body, "old", "new"));
+    expect(result.data?.managed).toBe(true);
+  });
+
+  it("refuses encrypted notes and callers without edit rights", async () => {
+    const locked = `---\nuuid: ${NOTE}\ntitle: Plan\nencrypted: true\n---\n-----BEGIN PGP MESSAGE-----\nabc\n-----END PGP MESSAGE-----\n`;
+    put(locked);
+
+    expect(await spliceNote(alice, NOTE, (body) => ({ body: `${body}x` }))).toEqual({
+      success: false,
+      error: SPLICE_ENCRYPTED,
+    });
+    mockCanReach.mockResolvedValue(false);
+    expect((await spliceNote(alice, NOTE, (body) => ({ body: `${body}x` }))).error).toBe(SPLICE_DENIED);
+    expect(onDisk()).toBe(locked);
+  });
+});
diff --git a/tests/server-actions/relations-explore.test.ts b/tests/server-actions/relations-explore.test.ts
index 8c2cc3e32..95fe5b0a9 100644
--- a/tests/server-actions/relations-explore.test.ts
+++ b/tests/server-actions/relations-explore.test.ts
@@ -28,9 +28,8 @@ vi.mock("@/app/_server/actions/config", () => ({ getSettings: () => mockSettings
 vi.mock("@/app/_server/actions/share/queries", () => ({
   canReach: (...args: unknown[]) => mockCanReach(...args),
 }));
-vi.mock("@/app/_server/actions/note/editor", () => ({
-  NOTE_UNCHANGED: "Nothing to change",
-  rewriteNote: (...args: unknown[]) => mockRewrite(...args),
+vi.mock("@/app/_server/actions/note/splice", () => ({
+  spliceNote: (...args: unknown[]) => mockRewrite(...args),
 }));
 vi.mock("@/app/_utils/grep-utils", () => ({
   grepSearchContent: (...args: unknown[]) => mockGrep(...args),
@@ -41,6 +40,7 @@ import { indexItemFile } from "@/app/_server/actions/relations/indexer";
 import { closeRelationsDb, setRelationsStatus } from "@/app/_server/actions/relations/store";
 import { backlinksFor } from "@/app/_server/actions/relations/queries";
 import {
+  LINK_MISSING,
   LINKS_OFF,
   MENTION_MISSING,
   NOT_VISIBLE,
@@ -48,6 +48,7 @@ import {
   neighbourhoodFor,
   orphansFor,
   relatedFor,
+  unlinkItems,
 } from "@/app/_server/actions/relations/explore";
 import { searchItems } from "@/app/_server/actions/search/engine";
 
@@ -248,21 +249,41 @@ describe("relations explore", () => {
     expect(result.data?.total).toBe(2);
   });
 
+  describe("suggestions", () => {
+    it("says which shared neighbours a suggestion comes from", async () => {
+      const result = await relatedFor(alice, A);
+      expect(result.data?.suggestions).toEqual([
+        expect.objectContaining({ uuid: L, title: "Shopping", via: ["Meal plan"] }),
+      ]);
+    });
+  });
+
   describe("linkItems", () => {
+    const spliced = { success: true, data: { uuid: A, title: "Alpha", category: "Home", tags: [], managed: false } };
+
     it("appends a link inside the source note's lane", async () => {
-      mockRewrite.mockImplementation(async (_actor, _uuid, rewrite) => {
-        expect(rewrite("Some text")).toBe(`Some text\n\n[Stray thought](/note/${C})\n`);
-        return { success: true };
+      mockRewrite.mockImplementation(async (_actor, _uuid, edit) => {
+        expect(edit("Some text")).toEqual({ body: `Some text\n\n[Stray thought](/note/${C})\n` });
+        expect(edit("Crlf text\r\n")).toEqual({ body: `Crlf text\r\n\r\n[Stray thought](/note/${C})\r\n` });
+        return spliced;
       });
-      expect(await linkItems(alice, A, C, LinkStyles.APPEND)).toEqual({ success: true, data: null });
+      expect(await linkItems(alice, A, C, LinkStyles.APPEND)).toEqual({ success: true, data: { managed: false } });
       expect(mockRewrite).toHaveBeenCalledWith(alice, A, expect.any(Function));
     });
 
-    it("reports a missing mention", async () => {
-      mockRewrite.mockResolvedValue({ error: "Nothing to change" });
+    it("reports a missing mention without writing", async () => {
+      mockRewrite.mockImplementation(async (_actor, _uuid, edit) => {
+        const result = edit("Nothing relevant here");
+        return { success: false, error: result.error };
+      });
       expect(await linkItems(alice, A, C, LinkStyles.MENTION)).toEqual({ success: false, error: MENTION_MISSING });
     });
 
+    it("passes on a managed source so the caller can warn", async () => {
+      mockRewrite.mockResolvedValue({ ...spliced, data: { ...spliced.data, managed: true } });
+      expect(await linkItems(alice, A, C, LinkStyles.APPEND)).toEqual({ success: true, data: { managed: true } });
+    });
+
     it("refuses hidden targets, checklist sources and missing edit rights", async () => {
       expect((await linkItems(alice, A, BOB, LinkStyles.APPEND)).error).toBe(NOT_VISIBLE);
       expect((await linkItems(alice, L, A, LinkStyles.APPEND)).error).toBe(NOT_VISIBLE);
@@ -271,4 +292,29 @@ describe("relations explore", () => {
       expect(mockRewrite).not.toHaveBeenCalled();
     });
   });
+
+  describe("unlinkItems", () => {
+    it("removes the links and counts the wikilinks it leaves", async () => {
+      write(itemPath("notes", "alice", "a.md"), doc(A, "Alpha", "see [[Stray thought]]"));
+      mockRewrite.mockImplementation(async (_actor, _uuid, edit) => {
+        expect(edit(`Intro\n\n[Stray thought](/note/${C})\n`)).toEqual({ body: "Intro\n" });
+        return { success: true, data: { uuid: A, title: "Alpha", category: "Home", tags: [], managed: false } };
+      });
+
+      const result = await unlinkItems(alice, A, C);
+      expect(result.success).toBe(true);
+      expect(result.data?.removed).toBe(1);
+    });
+
+    it("says so when the source has no link to the target", async () => {
+      mockRewrite.mockImplementation(async (_actor, _uuid, edit) => ({ success: false, error: edit("plain").error }));
+      expect(await unlinkItems(alice, A, C)).toEqual({ success: false, error: LINK_MISSING });
+    });
+
+    it("refuses sources the caller can't see and targets that aren't uuids", async () => {
+      expect((await unlinkItems(alice, BOB, C)).error).toBe(NOT_VISIBLE);
+      expect((await unlinkItems(alice, A, "not-a-uuid")).error).toBe(NOT_VISIBLE);
+      expect(mockRewrite).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/tests/server-actions/relations.test.ts b/tests/server-actions/relations.test.ts
index d17bc8a65..9fd12fdba 100644
--- a/tests/server-actions/relations.test.ts
+++ b/tests/server-actions/relations.test.ts
@@ -25,6 +25,7 @@ import {
   indexItemFile,
   reconcileRelations,
   refreshItemPaths,
+  refreshItems,
 } from "@/app/_server/actions/relations/indexer";
 import { throttledBatch } from "@/app/_server/actions/relations/watcher";
 import { backlinksFor, graphFor, VisibleItem } from "@/app/_server/actions/relations/queries";
@@ -430,6 +431,43 @@ describe("relations", () => {
       }
     });
 
+    it("lets a read flush pending changes without waiting out the minute", async () => {
+      vi.useFakeTimers();
+      try {
+        const flush = vi.fn().mockResolvedValue(0);
+        const batch = throttledBatch(flush, 60_000, 1_000);
+
+        batch.add("/a.md");
+        await vi.advanceTimersByTimeAsync(1_000);
+        batch.add("/b.md");
+        await batch.flush();
+
+        expect(flush).toHaveBeenCalledTimes(2);
+        expect(flush).toHaveBeenLastCalledWith(["/b.md"]);
+        await vi.advanceTimersByTimeAsync(120_000);
+        expect(flush).toHaveBeenCalledTimes(2);
+
+        await batch.flush();
+        expect(flush).toHaveBeenCalledTimes(2);
+        batch.stop();
+      } finally {
+        vi.useRealTimers();
+      }
+    });
+
+    it("refreshes a named item that changed on disk behind the index", async () => {
+      const aPath = itemPath("notes", "alice", "a.md");
+      write(aPath, note(A, "Alpha", `[Beta](/note/${B})`));
+      nodeFs.writeFileSync(aPath, note(A, "Alpha", "edited by a script"));
+      nodeFs.utimesSync(aPath, new Date(), new Date(Date.now() + 5_000));
+
+      const visible = visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Beta" }]);
+      expect(backlinksFor(B, visible).backlinks).toHaveLength(1);
+
+      expect(await refreshItems([A.toUpperCase()])).toBe(1);
+      expect(backlinksFor(B, visible).backlinks).toEqual([]);
+    });
+
     it("re-reads only paths whose file actually changed", async () => {
       const aPath = itemPath("notes", "alice", "a.md");
       write(aPath, note(A, "Alpha", `[Beta](/note/${B})`));
diff --git a/tests/server-actions/titles.test.ts b/tests/server-actions/titles.test.ts
new file mode 100644
index 000000000..3173c56f6
--- /dev/null
+++ b/tests/server-actions/titles.test.ts
@@ -0,0 +1,61 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import nodeFs from "fs";
+import os from "os";
+import path from "path";
+import { mockFs, resetAllMocks } from "../setup";
+import { RelationsStatus } from "@/app/_consts/relations";
+
+const mockBroadcast = vi.fn();
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: (...args: unknown[]) => mockBroadcast(...args),
+}));
+
+import { indexItemFile } from "@/app/_server/actions/relations/indexer";
+import { closeRelationsDb, relationsDb, setRelationsStatus } from "@/app/_server/actions/relations/store";
+import { titleFromFile } from "@/app/_server/actions/lib/file-title";
+import { parseNoteContent } from "@/app/_utils/client-parser-utils";
+
+const UUID = "aaaaaaaa-2222-4333-8444-955566667777";
+const HEADING = "Planting the Spring Garden";
+const CONTENT = `---\nuuid: ${UUID}\n---\n# ${HEADING}\n\nBody text.\n`;
+
+let root: string;
+
+describe("one title per item", () => {
+  beforeEach(async () => {
+    resetAllMocks();
+    const real = await vi.importActual<typeof import("fs/promises")>("fs/promises");
+    mockFs.readFile.mockImplementation(real.readFile as never);
+    root = nodeFs.mkdtempSync(path.join(os.tmpdir(), "jotty-titles-"));
+    vi.spyOn(process, "cwd").mockReturnValue(root);
+    process.env.JOTTY_RELATIONS_DB = path.join(root, "relations.db");
+    closeRelationsDb();
+    setRelationsStatus(RelationsStatus.READY);
+  });
+
+  afterEach(() => {
+    closeRelationsDb();
+    vi.restoreAllMocks();
+    nodeFs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("gives the reader, the parser and the relations index the same title", async () => {
+    const filePath = path.join(root, "data", "notes", "alice", "Home", "garden-plan.md");
+    nodeFs.mkdirSync(path.dirname(filePath), { recursive: true });
+    nodeFs.writeFileSync(filePath, CONTENT);
+
+    indexItemFile(filePath, CONTENT, Date.now());
+    const indexed = relationsDb().prepare("SELECT title FROM items WHERE uuid = ?").get(UUID) as { title: string };
+
+    expect(await titleFromFile({ uuid: UUID }, filePath, "garden-plan")).toBe(HEADING);
+    expect(parseNoteContent(CONTENT, "garden-plan").title).toBe(HEADING);
+    expect(indexed.title).toBe(HEADING);
+  });
+
+  it("skips the file read when frontmatter already has a title", async () => {
+    const missing = path.join(root, "does-not-exist.md");
+    expect(await titleFromFile({ title: "Weekly Digest" }, missing, "weekly-digest")).toBe("Weekly Digest");
+    expect(mockFs.readFile).not.toHaveBeenCalled();
+  });
+});
diff --git a/tests/server-actions/uuid-clash.test.ts b/tests/server-actions/uuid-clash.test.ts
new file mode 100644
index 000000000..88443f2f4
--- /dev/null
+++ b/tests/server-actions/uuid-clash.test.ts
@@ -0,0 +1,142 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import nodeFs from "fs";
+import os from "os";
+import path from "path";
+import { mockFs, resetAllMocks } from "../setup";
+import { RelationsStatus } from "@/app/_consts/relations";
+
+const mockBroadcast = vi.fn();
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: (...args: unknown[]) => mockBroadcast(...args),
+}));
+
+import { dropClashes, rankClaims } from "@/app/_server/actions/lib/uuid-keeper";
+import { grepFindFileByUuid } from "@/app/_utils/grep-utils";
+import { forgetItemFile, indexItemFile } from "@/app/_server/actions/relations/indexer";
+import { closeRelationsDb, relationsDb, setRelationsStatus } from "@/app/_server/actions/relations/store";
+
+const SHARED = "aaaaaaaa-1111-4222-8333-944455556666";
+
+let root: string;
+let warn: ReturnType<typeof vi.spyOn>;
+
+const noteDir = () => path.join(root, "data", "notes", "alice");
+
+const put = (rel: string, title: string, created?: string) => {
+  const filePath = path.join(noteDir(), rel);
+  const content = `---\nuuid: ${SHARED}\ntitle: ${title}\n${created ? `createdAt: ${created}\n` : ""}---\n\nBody of ${title}.\n`;
+  nodeFs.mkdirSync(path.dirname(filePath), { recursive: true });
+  nodeFs.writeFileSync(filePath, content);
+  return { filePath, content };
+};
+
+const indexed = () =>
+  relationsDb().prepare("SELECT path, title FROM items WHERE uuid = ?").get(SHARED) as
+    | { path: string; title: string }
+    | undefined;
+
+describe("duplicate uuids", () => {
+  beforeEach(async () => {
+    resetAllMocks();
+    const real = await vi.importActual<typeof import("fs/promises")>("fs/promises");
+    mockFs.readFile.mockImplementation(real.readFile as never);
+    root = nodeFs.mkdtempSync(path.join(os.tmpdir(), "jotty-clash-"));
+    vi.spyOn(process, "cwd").mockReturnValue(root);
+    process.env.JOTTY_RELATIONS_DB = path.join(root, "relations.db");
+    closeRelationsDb();
+    setRelationsStatus(RelationsStatus.READY);
+    globalThis.__jottyClashWarned = undefined;
+    warn = vi.spyOn(console, "warn").mockImplementation(() => undefined);
+  });
+
+  afterEach(() => {
+    closeRelationsDb();
+    vi.restoreAllMocks();
+    nodeFs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("lets the oldest createdAt keep the uuid, and treats a missing one as newest", () => {
+    const older = put("Home/old.md", "Old", "2020-01-01T00:00:00.000Z");
+    const newer = put("Home/new.md", "New", "2024-01-01T00:00:00.000Z");
+    const unstamped = put("Home/aaa.md", "Script copy");
+
+    expect(rankClaims([unstamped.filePath, newer.filePath, older.filePath])).toEqual([
+      older.filePath,
+      newer.filePath,
+      unstamped.filePath,
+    ]);
+  });
+
+  it("breaks a createdAt tie on the path so every reader picks the same file", () => {
+    const b = put("b.md", "B", "2020-01-01T00:00:00.000Z");
+    const a = put("a.md", "A", "2020-01-01T00:00:00.000Z");
+    expect(rankClaims([b.filePath, a.filePath])[0]).toBe(a.filePath);
+    expect(rankClaims([a.filePath, b.filePath])[0]).toBe(a.filePath);
+  });
+
+  it("lists one note per uuid and warns once with both paths", () => {
+    const keeper = put("Home/old.md", "Old", "2020-01-01T00:00:00.000Z");
+    const copy = put("Home/new.md", "New");
+    const listed = [
+      { uuid: SHARED, id: "new", category: "Home", title: "New" },
+      { uuid: SHARED, id: "old", category: "Home", title: "Old" },
+      { uuid: "other", id: "x", category: "Home", title: "X" },
+    ];
+
+    const kept = dropClashes(listed, noteDir());
+    dropClashes(listed, noteDir());
+
+    expect(kept.map((note) => note.title)).toEqual(["Old", "X"]);
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(String(warn.mock.calls[0][0])).toContain(keeper.filePath);
+    expect(String(warn.mock.calls[0][0])).toContain(copy.filePath);
+  });
+
+  it("opens the keeper when a link or get asks for the uuid", async () => {
+    put("Home/zzz-old.md", "Old", "2020-01-01T00:00:00.000Z");
+    put("Home/aaa-new.md", "New");
+    nodeFs.mkdirSync(path.join(noteDir(), "Other"), { recursive: true });
+    nodeFs.writeFileSync(
+      path.join(noteDir(), "Other/mentions.md"),
+      `---\nuuid: bbbbbbbb-1111-4222-8333-944455556666\n---\n\n\`\`\`\nuuid: ${SHARED}\n\`\`\`\n`,
+    );
+
+    const found = await grepFindFileByUuid(noteDir(), SHARED);
+    expect(found?.id).toBe("zzz-old");
+  });
+
+  it("finds a note whose frontmatter uses CRLF line endings", async () => {
+    const filePath = path.join(noteDir(), "Home", "windows.md");
+    nodeFs.mkdirSync(path.dirname(filePath), { recursive: true });
+    nodeFs.writeFileSync(filePath, `---\r\nuuid: ${SHARED}\r\ntitle: Windows\r\n---\r\nBody\r\n`);
+
+    expect((await grepFindFileByUuid(noteDir(), SHARED))?.id).toBe("windows");
+  });
+
+  it("indexes the keeper whichever file the index sees first", () => {
+    const keeper = put("Home/old.md", "Old", "2020-01-01T00:00:00.000Z");
+    const copy = put("Home/new.md", "New");
+
+    indexItemFile(copy.filePath, copy.content, 2);
+    indexItemFile(keeper.filePath, keeper.content, 1);
+    expect(indexed()?.title).toBe("Old");
+
+    indexItemFile(copy.filePath, copy.content, 3);
+    expect(indexed()?.title).toBe("Old");
+  });
+
+  it("hands the uuid to the survivor when the keeper is deleted", () => {
+    const keeper = put("Home/old.md", "Old", "2020-01-01T00:00:00.000Z");
+    const copy = put("Home/new.md", "New");
+    indexItemFile(keeper.filePath, keeper.content, 1);
+    indexItemFile(copy.filePath, copy.content, 2);
+
+    nodeFs.rmSync(keeper.filePath);
+    forgetItemFile(keeper.filePath);
+
+    expect(indexed()?.title).toBe("New");
+    const clashes = relationsDb().prepare("SELECT COUNT(*) AS n FROM clashes").get() as { n: number };
+    expect(clashes.n).toBe(0);
+  });
+});
diff --git a/tests/server-actions/uuid-repair.test.ts b/tests/server-actions/uuid-repair.test.ts
new file mode 100644
index 000000000..4406def78
--- /dev/null
+++ b/tests/server-actions/uuid-repair.test.ts
@@ -0,0 +1,119 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import nodeFs from "fs";
+import os from "os";
+import path from "path";
+import { mockFs, resetAllMocks } from "../setup";
+import { RelationsStatus } from "@/app/_consts/relations";
+import type { SanitisedUser } from "@/app/_types";
+
+vi.unmock("unified");
+vi.unmock("unist-util-visit");
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({ broadcast: vi.fn() }));
+
+import { findClashes } from "@/app/_server/actions/uuid-clash/scan";
+import { NOT_CLAIMANT, NO_CLASH, repairClash } from "@/app/_server/actions/uuid-clash/repair";
+import { closeRelationsDb, setRelationsStatus } from "@/app/_server/actions/relations/store";
+import { extractYamlMetadata } from "@/app/_utils/yaml-metadata-utils";
+
+const DUP = "aaaaaaaa-1111-4222-8333-944455556666";
+const LINKER = "bbbbbbbb-1111-4222-8333-944455556666";
+const alice = { username: "alice" } as SanitisedUser;
+
+let root: string;
+
+const notePath = (rel: string) => path.join(root, "data", "notes", "alice", rel);
+
+const put = (rel: string, content: string) => {
+  nodeFs.mkdirSync(path.dirname(notePath(rel)), { recursive: true });
+  nodeFs.writeFileSync(notePath(rel), content);
+};
+
+const read = (rel: string) => nodeFs.readFileSync(notePath(rel), "utf-8");
+
+const seed = () => {
+  put("Home/digest.md", `---\nuuid: ${DUP}\ntitle: Weekly Digest\ncreatedAt: 2020-01-01T00:00:00.000Z\n---\nThe original.\n`);
+  put("Scripts/releases.md", `---\nuuid: ${DUP}\ntitle: Release Feed\n---\nWritten by a script.\n`);
+  put(
+    "Home/index.md",
+    [
+      `---\nuuid: ${LINKER}\ntitle: Index\ncreatedAt: 2020-01-01T00:00:00.000Z\n---`,
+      `See [Weekly Digest](/note/${DUP}) and [Release Feed](/jotty/${DUP}).`,
+      `Also [this one](/note/${DUP}).`,
+      "",
+    ].join("\n"),
+  );
+};
+
+describe("duplicate uuid scan and repair", () => {
+  beforeEach(async () => {
+    resetAllMocks();
+    const real = await vi.importActual<typeof import("fs/promises")>("fs/promises");
+    mockFs.readFile.mockImplementation(real.readFile as never);
+    mockFs.writeFile.mockImplementation(real.writeFile as never);
+    mockFs.stat.mockImplementation(real.stat as never);
+    mockFs.rename.mockImplementation(real.rename as never);
+    mockFs.mkdir.mockImplementation(real.mkdir as never);
+    mockFs.unlink.mockImplementation(real.unlink as never);
+    root = nodeFs.mkdtempSync(path.join(os.tmpdir(), "jotty-repair-"));
+    vi.spyOn(process, "cwd").mockReturnValue(root);
+    process.env.JOTTY_RELATIONS_DB = path.join(root, "relations.db");
+    closeRelationsDb();
+    setRelationsStatus(RelationsStatus.READY);
+    vi.spyOn(console, "warn").mockImplementation(() => undefined);
+    vi.spyOn(console, "info").mockImplementation(() => undefined);
+    seed();
+  });
+
+  afterEach(() => {
+    closeRelationsDb();
+    vi.restoreAllMocks();
+    nodeFs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("lists both files, keeper first, and ignores a uuid quoted in a body", async () => {
+    put("Home/code.md", `---\nuuid: cccccccc-1111-4222-8333-944455556666\n---\n\`\`\`\nuuid: ${DUP}\n\`\`\`\n`);
+
+    expect(await findClashes("alice")).toEqual([
+      {
+        uuid: DUP,
+        owner: "alice",
+        files: [
+          expect.objectContaining({ path: "notes/Home/digest.md", title: "Weekly Digest", keeps: true }),
+          expect.objectContaining({ path: "notes/Scripts/releases.md", title: "Release Feed", keeps: false }),
+        ],
+      },
+    ]);
+  });
+
+  it("re-keys the newer file and moves only the links that name it", async () => {
+    const result = await repairClash(alice, "alice", DUP);
+
+    expect(result.success).toBe(true);
+    const fresh = result.data!.rekeyed[0].uuid;
+    expect(result.data).toMatchObject({
+      rekeyed: [{ path: "notes/Scripts/releases.md", title: "Release Feed" }],
+      ambiguous: ["notes/Home/index.md"],
+    });
+    expect(extractYamlMetadata(read("Scripts/releases.md")).metadata.uuid).toBe(fresh);
+    expect(extractYamlMetadata(read("Home/digest.md")).metadata.uuid).toBe(DUP);
+    expect(read("Home/index.md")).toContain(`[Weekly Digest](/note/${DUP})`);
+    expect(read("Home/index.md")).toContain(`[Release Feed](/jotty/${fresh})`);
+    expect(read("Home/index.md")).toContain(`[this one](/note/${DUP})`);
+    expect(await findClashes("alice")).toEqual([]);
+  });
+
+  it("re-keys an explicitly chosen file, even the keeper", async () => {
+    const result = await repairClash(alice, "alice", DUP, "notes/Home/digest.md");
+    expect(result.data?.rekeyed.map((entry) => entry.path)).toEqual(["notes/Home/digest.md"]);
+    expect(extractYamlMetadata(read("Scripts/releases.md")).metadata.uuid).toBe(DUP);
+  });
+
+  it("refuses paths that aren't claimants and uuids that aren't duplicated", async () => {
+    expect(await repairClash(alice, "alice", DUP, "notes/../../etc/passwd")).toEqual({
+      success: false,
+      error: NOT_CLAIMANT,
+    });
+    expect(await repairClash(alice, "alice", LINKER)).toEqual({ success: false, error: NO_CLASH });
+  });
+});
diff --git a/tests/setup.ts b/tests/setup.ts
index 5115dc608..68f8856ea 100644
--- a/tests/setup.ts
+++ b/tests/setup.ts
@@ -186,6 +186,7 @@ vi.mock("unist-util-visit", () => ({
 
 vi.mock("@/app/_utils/markdown-utils", () => ({
   sanitizeMarkdown: vi.fn().mockImplementation((content: string) => content),
+  defangHtml: vi.fn().mockImplementation((content: string) => content),
   convertMarkdownToHtml: vi
     .fn()
     .mockImplementation((content: string) => content),
diff --git a/tests/utils/item-links.test.ts b/tests/utils/item-links.test.ts
new file mode 100644
index 000000000..451ad9670
--- /dev/null
+++ b/tests/utils/item-links.test.ts
@@ -0,0 +1,67 @@
+import { describe, it, expect } from "vitest";
+import { itemLinksTo, retargetLinks, unlinkItem } from "@/app/_utils/item-links";
+
+const T = "aaaaaaaa-1111-4222-8333-944455556666";
+const OTHER = "bbbbbbbb-1111-4222-8333-944455556666";
+const FRESH = "cccccccc-1111-4222-8333-944455556666";
+
+describe("itemLinksTo", () => {
+  it("finds canonical, legacy and same-origin links but not code, images or other items", () => {
+    const text = [
+      `[Garden](/note/${T}) and [Old](/jotty/${T})`,
+      `![pic](/note/${T}) [Else](/note/${OTHER})`,
+      "```",
+      `[Code](/note/${T})`,
+      "```",
+      `\`[inline](/note/${T})\` [Abs](https://jotty.example/checklist/${T})`,
+    ].join("\n");
+
+    const labels = itemLinksTo(text, T, ["https://jotty.example"]).map((link) => link.label);
+    expect(labels).toEqual(["Garden", "Old", "Abs"]);
+  });
+});
+
+describe("retargetLinks", () => {
+  it("rewrites only the href, even when the label holds the uuid", () => {
+    const text = `see [${T}](/note/${T})`;
+    const moved = retargetLinks(text, itemLinksTo(text, T), T, FRESH);
+    expect(moved).toBe(`see [${T}](/note/${FRESH})`);
+  });
+});
+
+describe("unlinkItem", () => {
+  it("removes an appended link and the blank line in front of it", () => {
+    const text = `Some text.\n\n[Garden](/note/${T})\n`;
+    expect(unlinkItem(text, T)).toEqual({ text: "Some text.\n", removed: 1 });
+  });
+
+  it("closes the gap when a link line sits between paragraphs", () => {
+    const text = `First.\n\n[Garden](/note/${T})\n\nSecond.`;
+    expect(unlinkItem(text, T).text).toBe("First.\n\nSecond.");
+  });
+
+  it("removes a legacy link on its own bullet line", () => {
+    const text = `- keep\n- [Garden](/jotty/${T})\n- also keep`;
+    expect(unlinkItem(text, T).text).toBe("- keep\n- also keep");
+  });
+
+  it("turns an inline link back into its words", () => {
+    const text = `Read the [Garden \\[plan\\]](/note/${T}) first.`;
+    expect(unlinkItem(text, T).text).toBe("Read the Garden \\[plan\\] first.");
+  });
+
+  it("keeps CRLF line endings and every other byte", () => {
+    const text = `A\r\n\r\n[Garden](/note/${T})\r\n\r\nB [Else](/note/${OTHER})\r\n`;
+    expect(unlinkItem(text, T).text).toBe(`A\r\n\r\nB [Else](/note/${OTHER})\r\n`);
+  });
+
+  it("removes several links to the same item in one pass", () => {
+    const text = `Intro [Garden](/note/${T}).\n\n[Garden](/note/${T})\n[Garden](/jotty/${T})\n`;
+    expect(unlinkItem(text, T)).toEqual({ text: "Intro Garden.\n", removed: 3 });
+  });
+
+  it("leaves the text alone when nothing links to the item", () => {
+    const text = `No [links](/note/${OTHER}) here\n`;
+    expect(unlinkItem(text, T)).toEqual({ text, removed: 0 });
+  });
+});
diff --git a/tests/utils/note-edits.test.ts b/tests/utils/note-edits.test.ts
new file mode 100644
index 000000000..ca3cf942b
--- /dev/null
+++ b/tests/utils/note-edits.test.ts
@@ -0,0 +1,60 @@
+import { describe, it, expect, vi } from "vitest";
+
+vi.unmock("@/app/_utils/markdown-utils");
+
+import {
+  FIND_AMBIGUOUS,
+  FIND_MISSING,
+  addHashtags,
+  cleanTag,
+  dropHashtags,
+  findReplace,
+} from "@/app/_utils/note-edits";
+
+describe("findReplace", () => {
+  it("swaps a unique match and leaves the rest alone", () => {
+    expect(findReplace("one\ntwo\nthree\n", "two", "2")).toEqual({ body: "one\n2\nthree\n" });
+  });
+
+  it("refuses a missing or repeated match", () => {
+    expect(findReplace("a b a", "c", "x")).toEqual({ error: FIND_MISSING });
+    expect(findReplace("a b a", "a", "x")).toEqual({ error: FIND_AMBIGUOUS });
+  });
+
+  it("matches LF input against a CRLF note and writes CRLF back", () => {
+    const body = "Intro\r\nold line\r\nnext\r\n";
+    expect(findReplace(body, "old line\nnext", "new line\nnext")).toEqual({
+      body: "Intro\r\nnew line\r\nnext\r\n",
+    });
+  });
+
+  it("defangs script tags in the inserted text", () => {
+    const result = findReplace("x", "x", "<script>alert(1)</script>");
+    expect(result).toEqual({ body: "&lt;script&gt;alert(1)&lt;/script&gt;" });
+  });
+});
+
+describe("hashtags", () => {
+  it("cleans tag names and refuses odd ones", () => {
+    expect(cleanTag("#Garden/Veg")).toBe("garden/veg");
+    expect(cleanTag("1st")).toBeNull();
+    expect(cleanTag("two words")).toBeNull();
+  });
+
+  it("appends a tag line, or extends an existing one, keeping the ending", () => {
+    expect(addHashtags("Notes here.\n", ["garden"])).toBe("Notes here.\n\n#garden\n");
+    expect(addHashtags("Notes\r\n\r\n#garden\r\n", ["work"])).toBe("Notes\r\n\r\n#garden #work\r\n");
+    expect(addHashtags("Has #garden inline", ["garden"])).toBe("Has #garden inline");
+  });
+
+  it("removes tags outside code and drops lines left empty", () => {
+    const body = "Intro #garden text\n\n#garden\n\n```\n#garden\n```\n`#garden` #gardening\n";
+    expect(dropHashtags(body, ["garden"])).toBe(
+      "Intro text\n\n```\n#garden\n```\n`#garden` #gardening\n",
+    );
+  });
+
+  it("keeps other tags on a shared tag line", () => {
+    expect(dropHashtags("Body\n\n#garden #work\n", ["garden"])).toBe("Body\n\n#work\n");
+  });
+});
diff --git a/tests/utils/title-utils.test.ts b/tests/utils/title-utils.test.ts
new file mode 100644
index 000000000..54de8c9be
--- /dev/null
+++ b/tests/utils/title-utils.test.ts
@@ -0,0 +1,44 @@
+import { describe, it, expect } from "vitest";
+import { leadingHeading, titleOf, UNTITLED } from "@/app/_utils/title-utils";
+import { extractTitle } from "@/app/_utils/yaml-metadata-utils";
+import { parseChecklistContent, parseNoteContent } from "@/app/_utils/client-parser-utils";
+
+const UUID = "aaaaaaaa-2222-4333-8444-955566667777";
+const SLUG = "garden-plan";
+const HEADING = "Planting the Spring Garden";
+const UNTITLED_FILE = `---\nuuid: ${UUID}\n---\n# ${HEADING}\n\nThis guide explains things.\n\n\`\`\`python\n# not a title\n\`\`\`\n`;
+
+describe("titleOf", () => {
+  it("prefers the frontmatter title", () => {
+    expect(titleOf({ title: "Stored" }, `# ${HEADING}`, SLUG)).toBe("Stored");
+  });
+
+  it("falls back to a leading H1, then to the filename", () => {
+    expect(titleOf({}, `\n\n# ${HEADING}\nbody`, SLUG)).toBe(HEADING);
+    expect(titleOf({}, "body first\n# Later heading", SLUG)).toBe("garden plan");
+    expect(titleOf({}, "", undefined)).toBe(UNTITLED);
+  });
+
+  it("ignores blank or non-text titles and keeps numeric ones", () => {
+    expect(titleOf({ title: "   " }, "", SLUG)).toBe("garden plan");
+    expect(titleOf({ title: 2024 }, "", SLUG)).toBe("2024");
+  });
+
+  it("reads CRLF bodies and skips ## headings", () => {
+    expect(leadingHeading(`\r\n# ${HEADING}\r\nbody`)).toBe(HEADING);
+    expect(leadingHeading("## Section\nbody")).toBeUndefined();
+  });
+});
+
+describe("every parser agrees on the title", () => {
+  it("resolves the same title for a note written without a frontmatter title", () => {
+    expect(extractTitle(UNTITLED_FILE, SLUG)).toBe(HEADING);
+    expect(parseNoteContent(UNTITLED_FILE, SLUG).title).toBe(HEADING);
+  });
+
+  it("resolves checklist titles the same way", () => {
+    const list = `---\nuuid: ${UUID}\n---\n# Groceries\n- [ ] milk\n`;
+    expect(parseChecklistContent(list, "shopping").title).toBe("Groceries");
+    expect(parseChecklistContent("- [ ] milk\n", "weekly-shop").title).toBe("weekly shop");
+  });
+});

From fc773fbc57615ce2afbcab3bb15b6a393f0c12a2 Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 19:28:58 +0100
Subject: [PATCH 25/28] forgot typechecking ffs

---
 app/_server/actions/note/splice.ts     |  4 ++--
 app/_server/actions/relations/index.ts | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/app/_server/actions/note/splice.ts b/app/_server/actions/note/splice.ts
index 1ec6ad3bb..feff73097 100644
--- a/app/_server/actions/note/splice.ts
+++ b/app/_server/actions/note/splice.ts
@@ -45,8 +45,8 @@ const _storedTags = (metadata: Record<string, unknown>): string[] =>
 const _retagged = (metadata: Record<string, unknown>, before: string, after: string): string[] | null => {
   const was = _tagSet(before);
   const now = _tagSet(after);
-  const added = [...now].filter((tag) => !was.has(tag));
-  const dropped = new Set([...was].filter((tag) => !now.has(tag)));
+  const added = Array.from(now).filter((tag) => !was.has(tag));
+  const dropped = new Set(Array.from(was).filter((tag) => !now.has(tag)));
   if (!added.length && !dropped.size) return null;
   const kept = _storedTags(metadata).filter((tag) => !dropped.has(tag));
   return Array.from(new Set([...kept, ...added])).sort();
diff --git a/app/_server/actions/relations/index.ts b/app/_server/actions/relations/index.ts
index 15281e0c6..a6d7be33b 100644
--- a/app/_server/actions/relations/index.ts
+++ b/app/_server/actions/relations/index.ts
@@ -8,7 +8,7 @@ import type { BrainGraph, ItemRelations } from "@/app/_types/relations";
 import { backlinksFor, graphFor, visibleItems } from "./queries";
 import { rebuildOwnerRelations, rebuildRelations } from "./indexer";
 import { relationsDb } from "./store";
-import { linkItems, linksEnabled } from "./explore";
+import { linkItems, linksEnabled, type LinkWrite } from "./explore";
 
 const EMPTY_RELATIONS: ItemRelations = { uuid: "", status: RelationsStatus.READY, backlinks: [], mentions: [], wikis: {} };
 
@@ -71,16 +71,16 @@ export const reindexRelations = async (username?: string): Promise<Result<number
   }
 };
 
-const _asActor = async (
-  work: (actor: SanitisedUser) => Promise<Result<null>>,
-): Promise<Result<null>> => {
+const _asActor = async <T>(
+  work: (actor: SanitisedUser) => Promise<Result<T>>,
+): Promise<Result<T>> => {
   const user = await getCurrentUser();
   if (!user?.username) return { success: false, error: "Not authenticated" };
   return work(user);
 };
 
-export const connectItems = async (sourceUuid: string, targetUuid: string): Promise<Result<null>> =>
+export const connectItems = async (sourceUuid: string, targetUuid: string): Promise<Result<LinkWrite>> =>
   _asActor((actor) => linkItems(actor, sourceUuid, targetUuid, LinkStyles.APPEND));
 
-export const linkMention = async (sourceUuid: string, targetUuid: string): Promise<Result<null>> =>
+export const linkMention = async (sourceUuid: string, targetUuid: string): Promise<Result<LinkWrite>> =>
   _asActor((actor) => linkItems(actor, sourceUuid, targetUuid, LinkStyles.MENTION));

From 263e934700fd3ef6e2b6dd1112e30a735855825d Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 20:42:56 +0100
Subject: [PATCH 26/28] fix tags issue

---
 app/_server/actions/checklist/readers.ts |  72 +-------------
 app/_server/actions/note/readers.ts      |  62 +-----------
 app/_utils/frontmatter-scan.ts           |  80 ++++++++++++++++
 tests/utils/frontmatter-scan.test.ts     | 116 +++++++++++++++++++++++
 4 files changed, 202 insertions(+), 128 deletions(-)
 create mode 100644 app/_utils/frontmatter-scan.ts
 create mode 100644 tests/utils/frontmatter-scan.test.ts

diff --git a/app/_server/actions/checklist/readers.ts b/app/_server/actions/checklist/readers.ts
index d73ea2018..f5cc5fe42 100644
--- a/app/_server/actions/checklist/readers.ts
+++ b/app/_server/actions/checklist/readers.ts
@@ -28,6 +28,7 @@ import { isKanbanType } from "@/app/_types/enums";
 import { lacksUuid, stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
 import { titleFromFile } from "@/app/_server/actions/lib/file-title";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
+import { metaGrep, scanFrontmatter } from "@/app/_utils/frontmatter-scan";
 
 const debugCrud = isDebugFlag("crud");
 
@@ -54,7 +55,7 @@ export const readListsRecursively = async (
         ? ""
         : `-not -path "*/${ARCHIVED_DIR_NAME}/*"`;
       const statsCmd = `find "$1" -name "*.md" ${excludeStr} -printf "%p|%W@|%T@\\n"`;
-      const metaCmd = `grep -rE "^(title|uuid|tags|checklistType|createdAt|${SHARED_WITH_KEY}):|^[[:space:]]+- |^---$" "$1"`;
+      const metaCmd = metaGrep(["title", "uuid", "tags", "checklistType", "createdAt", SHARED_WITH_KEY]);
       const [statsOut, metaOut] = await Promise.all([
         boxedShell(statsCmd, [dir], { maxBuffer: 10 * 1024 * 1024 }).catch(
           () => "",
@@ -78,74 +79,7 @@ export const readListsRecursively = async (
           metaLines.slice(0, 40),
         );
       }
-      const inFrontmatter = new Map<string, boolean>();
-      let listFile = "";
-      let listKey = "";
-      for (const line of metaLines) {
-        const colonIdx = line.indexOf(":");
-        if (colonIdx === -1) continue;
-        const filePath = line.slice(0, colonIdx);
-        const rest = line.slice(colonIdx + 1);
-        if (rest.trim() === "---") {
-          inFrontmatter.set(filePath, !inFrontmatter.get(filePath));
-          if (debugCrud)
-            console.warn(
-              "[tags grep] --- seen, filePath:",
-              filePath,
-              "inFrontmatter:",
-              inFrontmatter.get(filePath),
-            );
-          continue;
-        }
-        if (!inFrontmatter.get(filePath)) continue;
-        if (/^\s+-\s/.test(rest)) {
-          if (listFile === filePath) {
-            const tag = rest.replace(/^\s+-\s+/, "").trim();
-            if (tag) {
-              if (debugCrud)
-                console.warn(
-                  "[tags grep] adding tag:",
-                  JSON.stringify(tag.slice(0, 50)),
-                  "filePath:",
-                  filePath,
-                );
-              if (!metadataCache!.has(filePath))
-                metadataCache!.set(filePath, {});
-              const entry = metadataCache!.get(filePath)!;
-              if (!Array.isArray(entry[listKey])) entry[listKey] = [];
-              (entry[listKey] as string[]).push(tag);
-            }
-          }
-          continue;
-        }
-        listFile = "";
-        const innerColon = rest.indexOf(":");
-        if (innerColon === -1) continue;
-        const key = rest.slice(0, innerColon);
-        const val = rest.slice(innerColon + 1);
-        if (!metadataCache!.has(filePath)) metadataCache!.set(filePath, {});
-        const entry = metadataCache!.get(filePath)!;
-        if (key === "tags") {
-          const trimmed = val.trim();
-          if (trimmed === "") {
-            entry.tags = [];
-            listFile = filePath;
-            listKey = key;
-          } else {
-            entry.tags = trimmed
-              .replace(/^\[|\]$/g, "")
-              .split(",")
-              .map((t: string) => t.trim())
-              .filter(Boolean);
-          }
-        } else if (key === SHARED_WITH_KEY && val.trim() === "") {
-          entry[key] = [];
-          listFile = filePath;
-          listKey = key;
-        } else {
-          entry[key] = val.trim().replace(/^["']|["']$/g, "");
-        }
-      }
+      scanFrontmatter(metaOut, metadataCache!);
     } catch (e) {
       console.warn("Optimization failed, falling back to standard mode", e);
     }
diff --git a/app/_server/actions/note/readers.ts b/app/_server/actions/note/readers.ts
index 4c556cd2e..8fddf3147 100644
--- a/app/_server/actions/note/readers.ts
+++ b/app/_server/actions/note/readers.ts
@@ -27,6 +27,7 @@ import { boxedShell } from "@/app/_utils/shell-utils";
 import { lacksUuid, stampUuid } from "@/app/_server/actions/lib/stamp-uuid";
 import { titleFromFile } from "@/app/_server/actions/lib/file-title";
 import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
+import { metaGrep, scanFrontmatter } from "@/app/_utils/frontmatter-scan";
 
 export const readNotesRecursively = async (
   dir: string,
@@ -48,7 +49,7 @@ export const readNotesRecursively = async (
         ? ""
         : `-not -path "*/${ARCHIVED_DIR_NAME}/*"`;
       const statsCmd = `find "$1" -name "*.md" ${excludeStr} -printf "%p|%W@|%T@\\n"`;
-      const metaCmd = `grep -rE "^(title|uuid|tags|encrypted|createdAt|${SHARED_WITH_KEY}):|^[[:space:]]+- |^---$" "$1"`;
+      const metaCmd = metaGrep(["title", "uuid", "tags", "encrypted", "createdAt", SHARED_WITH_KEY]);
       const [statsOut, metaOut] = await Promise.all([
         boxedShell(statsCmd, [dir], { maxBuffer: 10 * 1024 * 1024 }).catch(
           () => "",
@@ -67,64 +68,7 @@ export const readNotesRecursively = async (
           });
       });
 
-      const inFrontmatter = new Map<string, boolean>();
-
-      let listFile = "";
-      let listKey = "";
-      for (const line of metaOut.split("\n")) {
-        if (!line) continue;
-        const colonIdx = line.indexOf(":");
-        if (colonIdx === -1) continue;
-        const filePath = line.slice(0, colonIdx);
-        const rest = line.slice(colonIdx + 1);
-        if (rest.trim() === "---") {
-          inFrontmatter.set(filePath, !inFrontmatter.get(filePath));
-          continue;
-        }
-        if (!inFrontmatter.get(filePath)) continue;
-        if (/^\s+-\s/.test(rest)) {
-          if (listFile === filePath) {
-            const tag = rest.replace(/^\s+-\s+/, "").trim();
-            if (tag) {
-              if (!metadataCache!.has(filePath))
-                metadataCache!.set(filePath, {});
-              const entry = metadataCache!.get(filePath)!;
-              if (!Array.isArray(entry[listKey])) entry[listKey] = [];
-              (entry[listKey] as string[]).push(tag);
-            }
-          }
-          continue;
-        }
-        listFile = "";
-        const innerColon = rest.indexOf(":");
-        if (innerColon === -1) continue;
-        const key = rest.slice(0, innerColon);
-        const val = rest.slice(innerColon + 1);
-        if (!metadataCache!.has(filePath)) metadataCache!.set(filePath, {});
-        const entry = metadataCache!.get(filePath)!;
-        if (key === "tags") {
-          const trimmed = val.trim();
-          if (trimmed === "") {
-            entry.tags = [];
-            listFile = filePath;
-            listKey = key;
-          } else {
-            entry.tags = trimmed
-              .replace(/^\[|\]$/g, "")
-              .split(",")
-              .map((t: string) => t.trim())
-              .filter(Boolean);
-          }
-        } else if (key === "encrypted") {
-          entry.encrypted = val.trim() === "true";
-        } else if (key === SHARED_WITH_KEY && val.trim() === "") {
-          entry[key] = [];
-          listFile = filePath;
-          listKey = key;
-        } else {
-          entry[key] = val.trim().replace(/^["']|["']$/g, "");
-        }
-      }
+      scanFrontmatter(metaOut, metadataCache!);
     } catch (e) {
       console.warn("Optimization failed, falling back to standard mode", e);
     }
diff --git a/app/_utils/frontmatter-scan.ts b/app/_utils/frontmatter-scan.ts
new file mode 100644
index 000000000..aed559092
--- /dev/null
+++ b/app/_utils/frontmatter-scan.ts
@@ -0,0 +1,80 @@
+import { SHARED_WITH_KEY } from "@/app/_consts/sharing";
+
+export type MetaCache = Map<string, Record<string, unknown>>;
+
+const GREP_LINE = /^(.*?):(\d+):(.*)$/;
+const LIST_ITEM = /^\s+-\s+/;
+const FENCE = "---";
+const LIST_KEYS = ["tags", SHARED_WITH_KEY];
+
+interface FileScan {
+  entry: Record<string, unknown>;
+  closed: boolean;
+  listKey: string;
+  lastLine: number;
+}
+
+export const metaGrep = (keys: string[]): string =>
+  `grep -rnE "^(${keys.join("|")}):|^[[:space:]]+- |^---$" "$1"`;
+
+const _inlineList = (value: string): string[] =>
+  value
+    .replace(/^\[|\]$/g, "")
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+
+const _readKey = (entry: Record<string, unknown>, key: string, value: string): boolean => {
+  if (LIST_KEYS.includes(key) && value === "") {
+    entry[key] = [];
+    return true;
+  }
+  if (key === "tags") entry.tags = _inlineList(value);
+  else if (key === "encrypted") entry.encrypted = value === "true";
+  else entry[key] = value.replace(/^["']|["']$/g, "");
+  return false;
+};
+
+export const scanFrontmatter = (grepOut: string, cache: MetaCache): void => {
+  const scans = new Map<string, FileScan>();
+
+  for (const line of grepOut.split("\n")) {
+    const match = line.match(GREP_LINE);
+    if (!match) continue;
+    const [, filePath, lineText, rest] = match;
+    const lineNo = Number(lineText);
+    const scan = scans.get(filePath);
+
+    if (rest.trim() === FENCE) {
+      if (!scan && lineNo === 1) scans.set(filePath, { entry: {}, closed: false, listKey: "", lastLine: 1 });
+      else if (scan && !scan.closed) {
+        scan.closed = true;
+        cache.set(filePath, { ...cache.get(filePath), ...scan.entry });
+      }
+      continue;
+    }
+    if (!scan || scan.closed) continue;
+
+    if (LIST_ITEM.test(rest)) {
+      const item = rest.replace(LIST_ITEM, "").trim();
+      if (scan.listKey && lineNo === scan.lastLine + 1 && item) {
+        const list = scan.entry[scan.listKey];
+        if (Array.isArray(list)) list.push(item);
+        scan.lastLine = lineNo;
+      } else {
+        scan.listKey = "";
+      }
+      continue;
+    }
+
+    scan.listKey = "";
+    const colon = rest.indexOf(":");
+    if (colon === -1) continue;
+    const key = rest.slice(0, colon);
+    const opensList = _readKey(scan.entry, key, rest.slice(colon + 1).trim());
+    if (opensList) {
+      scan.listKey = key;
+      scan.lastLine = lineNo;
+    }
+  }
+};
diff --git a/tests/utils/frontmatter-scan.test.ts b/tests/utils/frontmatter-scan.test.ts
new file mode 100644
index 000000000..eab2e8021
--- /dev/null
+++ b/tests/utils/frontmatter-scan.test.ts
@@ -0,0 +1,116 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { execFileSync } from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { metaGrep, scanFrontmatter, MetaCache } from "@/app/_utils/frontmatter-scan";
+
+const KEYS = ["title", "uuid", "tags", "encrypted", "createdAt", "sharedWith"];
+
+const PLAN_NOTE = `---
+uuid: 32a02266-964f-48fb-b3e7-94476908d984
+title: degoog New plan
+tags:
+  - degoog
+---
+
+## 1. Engines
+
+- **Registry** in engines.ts
+    - \`id: string\`, \`label: string\`
+    - Nested again
+        - Deeper still
+
+---
+
+## 2. Slot plugins
+
+- **Types** in types.ts: Add \`SlotPlugin\`
+    - \`id: string\`, \`name\` / \`displayName: string\`
+    - **Sidebar**: Inside the results sidebar
+        - \`position: number\`
+
+---
+
+tags:
+  - not-a-tag
+
+#degoog
+`;
+
+const _scan = (dir: string): MetaCache => {
+  const out = execFileSync("sh", ["-c", metaGrep(KEYS), "sh", dir], { encoding: "utf-8" });
+  const cache: MetaCache = new Map();
+  scanFrontmatter(out, cache);
+  return cache;
+};
+
+describe("scanFrontmatter", () => {
+  let dir: string;
+
+  const write = (name: string, content: string) => {
+    const filePath = path.join(dir, name);
+    fs.writeFileSync(filePath, content);
+    return filePath;
+  };
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "jotty-fm-scan-"));
+  });
+
+  afterEach(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("should not read body list items between horizontal rules as tags", () => {
+    const filePath = write("plan.md", PLAN_NOTE);
+
+    const meta = _scan(dir).get(filePath);
+
+    expect(meta?.tags).toEqual(["degoog"]);
+    expect(meta?.title).toBe("degoog New plan");
+    expect(meta?.uuid).toBe("32a02266-964f-48fb-b3e7-94476908d984");
+  });
+
+  it("should read inline tags and plain keys", () => {
+    const filePath = write("inline.md", "---\ntitle: \"Quoted\"\ntags: [a, b]\nencrypted: true\n---\n\n- item\n");
+
+    const meta = _scan(dir).get(filePath);
+
+    expect(meta).toEqual({ title: "Quoted", tags: ["a", "b"], encrypted: true });
+  });
+
+  it("should stop a list at the first line that is not one of its items", () => {
+    const filePath = write(
+      "gap.md",
+      "---\ntags:\n  - one\n  - two\nother:\n  - stray\nsharedWith:\n  - alice\n---\n",
+    );
+
+    const meta = _scan(dir).get(filePath);
+
+    expect(meta?.tags).toEqual(["one", "two"]);
+    expect(meta?.sharedWith).toEqual(["alice"]);
+  });
+
+  it("should ignore files whose first line is not a fence", () => {
+    const filePath = write("nofm.md", "# Title\n\n---\ntags:\n  - fake\n---\n");
+
+    expect(_scan(dir).has(filePath)).toBe(false);
+  });
+
+  it("should ignore frontmatter that never closes", () => {
+    const filePath = write("open.md", "---\ntitle: Open\ntags:\n  - fake\n\nbody\n");
+
+    expect(_scan(dir).has(filePath)).toBe(false);
+  });
+
+  it("should keep each file separate", () => {
+    const plan = write("plan.md", PLAN_NOTE);
+    const post = write("post.md", "---\ntitle: Degoog blog post\ntags:\n  - degoog\n---\n\nBody\n");
+
+    const cache = _scan(dir);
+
+    expect(cache.get(plan)?.tags).toEqual(["degoog"]);
+    expect(cache.get(post)?.tags).toEqual(["degoog"]);
+  });
+});

From bf6df1fd7f5f4e3ac4d3f5af1fa838a1365bd97a Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 21:12:23 +0100
Subject: [PATCH 27/28] little mcp changes

---
 .../Brain/Parts/BrainLegend.tsx               |  9 ++-
 .../Brain/utils/brain-graph.ts                |  2 +
 app/_consts/relations.ts                      | 20 ++++++-
 app/_schemas/api/notes.ts                     | 24 ++++++--
 app/_schemas/api/relations.ts                 | 11 ++--
 app/_server/actions/relations/explore.ts      | 11 ++--
 app/_server/actions/relations/indexer.ts      | 30 +++++++---
 app/_server/actions/relations/parser.ts       | 43 ++++++++++----
 app/_server/actions/relations/queries.ts      | 19 ++++--
 app/_server/api/route-index.ts                |  2 +
 app/_translations/en.json                     |  4 +-
 app/api/brain/route.ts                        |  4 +-
 app/api/notes/batch/route.ts                  | 51 ++++++++++++++++
 app/api/notes/route.ts                        |  9 +--
 app/api/relations/[itemId]/route.ts           |  4 +-
 howto/BRAIN.md                                | 11 ++++
 howto/MCP.md                                  |  4 +-
 mcp-server/src/server/mcp.ts                  |  2 +-
 mcp-server/src/tools/catalog.ts               |  1 +
 tests/api/note-edits.test.ts                  | 42 +++++++++++--
 tests/server-actions/relations.test.ts        | 59 +++++++++++++++++--
 21 files changed, 290 insertions(+), 72 deletions(-)
 create mode 100644 app/api/notes/batch/route.ts

diff --git a/app/_components/FeatureComponents/Brain/Parts/BrainLegend.tsx b/app/_components/FeatureComponents/Brain/Parts/BrainLegend.tsx
index 6234992d0..54e218ef6 100644
--- a/app/_components/FeatureComponents/Brain/Parts/BrainLegend.tsx
+++ b/app/_components/FeatureComponents/Brain/Parts/BrainLegend.tsx
@@ -1,7 +1,7 @@
 "use client";
 
 import { useTranslations } from "next-intl";
-import { BrainEdgeKinds, BrainNodeKinds } from "@/app/_consts/relations";
+import { BrainEdgeKinds, BrainNodeKinds, LINK_EDGE_KINDS } from "@/app/_consts/relations";
 import type { BrainGraph } from "@/app/_types/relations";
 import { BrainPalette, edgeColour } from "../utils/brain-graph";
 
@@ -13,7 +13,9 @@ interface BrainLegendProps {
 }
 
 const SWATCHES = [
+  BrainEdgeKinds.LINK,
   BrainEdgeKinds.MENTION,
+  BrainEdgeKinds.CHECKLIST,
   BrainEdgeKinds.WIKI,
   BrainEdgeKinds.SUGGESTED,
   BrainEdgeKinds.TAG,
@@ -26,10 +28,7 @@ export const BrainLegend = ({ graph, palette, shown, owner }: BrainLegendProps)
       node.kind === BrainNodeKinds.NOTE ||
       node.kind === BrainNodeKinds.CHECKLIST,
   ).length;
-  const links = graph.edges.filter(
-    (edge) =>
-      edge.kind === BrainEdgeKinds.MENTION || edge.kind === BrainEdgeKinds.WIKI,
-  ).length;
+  const links = graph.edges.filter((edge) => LINK_EDGE_KINDS.has(edge.kind)).length;
 
   return (
     <div className="pointer-events-none absolute bottom-3 left-3 z-10 hidden rounded-jotty border border-border bg-card px-3 py-2 text-md lg:block lg:text-xs text-muted-foreground">
diff --git a/app/_components/FeatureComponents/Brain/utils/brain-graph.ts b/app/_components/FeatureComponents/Brain/utils/brain-graph.ts
index accc7b6a0..b718a5e6c 100644
--- a/app/_components/FeatureComponents/Brain/utils/brain-graph.ts
+++ b/app/_components/FeatureComponents/Brain/utils/brain-graph.ts
@@ -196,6 +196,8 @@ export const edgeRgb = (edge: BrainEdge, palette: BrainPalette): Rgb => {
   if (edge.kind === BrainEdgeKinds.SUGGESTED) return palette.muted;
   if (edge.kind === BrainEdgeKinds.TAG) return mix(palette.primary, palette.background, 0.55);
   if (edge.kind === BrainEdgeKinds.WIKI) return palette.primary;
+  if (edge.kind === BrainEdgeKinds.MENTION) return mix(palette.primary, palette.foreground, 0.5);
+  if (edge.kind === BrainEdgeKinds.CHECKLIST) return mix(palette.primary, palette.muted, 0.6);
   return mix(palette.foreground, palette.background, 0.35);
 };
 
diff --git a/app/_consts/relations.ts b/app/_consts/relations.ts
index ecf5b229e..843b6f9c7 100644
--- a/app/_consts/relations.ts
+++ b/app/_consts/relations.ts
@@ -1,14 +1,23 @@
 export const RELATIONS_DB_NAME = ".relations.db";
-export const RELATIONS_SCHEMA_VERSION = 5;
+export const RELATIONS_SCHEMA_VERSION = 6;
 export const LEGACY_LINK_PREFIX = "/jotty/";
 export const WIKILINK_REGEX =
   /\[\[([^\[\]|#^\n]+)(?:[#^][^\[\]|\n]*)?(?:\|([^\[\]\n]*))?\]\]/g;
 
 export enum LinkKinds {
+  LINK = "link",
   MENTION = "mention",
+  CHECKLIST = "checklist",
   WIKI = "wiki",
 }
 
+export const LINK_KIND_RANK: LinkKinds[] = [
+  LinkKinds.MENTION,
+  LinkKinds.LINK,
+  LinkKinds.CHECKLIST,
+  LinkKinds.WIKI,
+];
+
 export enum RelationsStatus {
   BUILDING = "building",
   READY = "ready",
@@ -22,12 +31,21 @@ export enum BrainNodeKinds {
 }
 
 export enum BrainEdgeKinds {
+  LINK = "link",
   MENTION = "mention",
+  CHECKLIST = "checklist",
   WIKI = "wiki",
   TAG = "tag",
   SUGGESTED = "suggested",
 }
 
+export const LINK_EDGE_KINDS = new Set<BrainEdgeKinds>([
+  BrainEdgeKinds.LINK,
+  BrainEdgeKinds.MENTION,
+  BrainEdgeKinds.CHECKLIST,
+  BrainEdgeKinds.WIKI,
+]);
+
 export const MENTION_MIN_TITLE = 3;
 export const MENTION_LIMIT = 30;
 export const MENTION_SNIPPET_CHARS = 60;
diff --git a/app/_schemas/api/notes.ts b/app/_schemas/api/notes.ts
index 52aa14d7d..365e7d620 100644
--- a/app/_schemas/api/notes.ts
+++ b/app/_schemas/api/notes.ts
@@ -23,7 +23,7 @@ export const noteSchema = z
     owner: z.string().optional(),
     tags: z.array(z.string()).optional().describe("Tags come from #hashtags in the content, like #work or #home/garden"),
     managed: z.boolean().optional().describe("True when frontmatter says managed: true, meaning a script rewrites this note and may drop manual edits"),
-    contentLength: z.number().optional().describe("Characters in the whole content, on a single note"),
+    contentLength: z.number().optional().describe("Characters in the whole content, on a single note or a batch"),
     nextOffset: z.number().optional().describe("Pass this as offset to read the rest when limit cut the content"),
     createdAt: timestamp.optional(),
     updatedAt: timestamp.optional(),
@@ -34,10 +34,6 @@ export const noteListQuery = z.object({
   category: z.string().optional().describe("Only notes in this folder"),
   q: searchQuery,
   tag: z.string().optional().describe("Only notes with this tag or one nested under it, like work or home/garden"),
-  ids: z
-    .string()
-    .optional()
-    .describe("Comma-separated note uuids, to read several notes in one call"),
   view: z
     .enum(ListView)
     .default(ListView.FULL)
@@ -45,6 +41,24 @@ export const noteListQuery = z.object({
   ...pageFields,
 });
 
+export const NOTES_BATCH_MAX = 50;
+
+export const noteIdList = (ids: string): string[] =>
+  Array.from(new Set(ids.split(",").map((id) => id.trim().toLowerCase()).filter(Boolean)));
+
+export const noteBatchQuery = z.object({
+  ids: required("ids")
+    .describe(`Comma-separated note uuids, ${NOTES_BATCH_MAX} at most`)
+    .refine((ids) => noteIdList(ids).length <= NOTES_BATCH_MAX, {
+      error: `Pass ${NOTES_BATCH_MAX} ids at most`,
+    }),
+});
+
+export const noteBatchSchema = z.object({
+  notes: z.array(noteSchema).describe("The notes found, in the order asked, each with its whole content and contentLength"),
+  missing: z.array(z.string()).describe("Ids that match no note you can read, or whose file couldn't be read"),
+});
+
 export const noteCreateBody = z.object({
   title: required("Title"),
   content: z.string().default(""),
diff --git a/app/_schemas/api/relations.ts b/app/_schemas/api/relations.ts
index 389d9bacb..3269d858c 100644
--- a/app/_schemas/api/relations.ts
+++ b/app/_schemas/api/relations.ts
@@ -17,6 +17,9 @@ import { pageFields, required, totalField, uuidParam } from "./common";
 
 const ORPHANS_DEFAULT = 25;
 
+export const LINK_KINDS_TEXT =
+  "kind says how the link is written. link is a [Title](/note/uuid) link standing on its own line, like the ones connect_items appends. mention is that same link inside a sentence, like connect_items style=mention makes. checklist is a link inside a checklist item or a - [ ] task. wiki is a [[Title]] link";
+
 const statusField = z
   .enum(RelationsStatus)
   .describe("building while Jotty indexes links on first start, when every list comes back empty");
@@ -34,9 +37,7 @@ export const linkedItemSchema = z
 const relatedItemSchema = linkedItemSchema.extend({
   kind: z
     .enum(LinkKinds)
-    .describe(
-      "mention for any [Title](/note/uuid) markdown link, inline or on its own line, including the ones connect_items adds. wiki for a [[Title]] link",
-    ),
+    .describe(`${LINK_KINDS_TEXT}. When one item links another in several ways, the first of mention, link, checklist, wiki wins`),
 });
 
 export const relatedParams = uuidParam("itemId", "Note or checklist");
@@ -111,7 +112,9 @@ export const brainSchema = z
       z.object({
         source: z.string(),
         target: z.string(),
-        kind: z.enum(BrainEdgeKinds),
+        kind: z
+          .enum(BrainEdgeKinds)
+          .describe(`${LINK_KINDS_TEXT}. suggested is a likely link Jotty found. Two items linked in several ways get an edge per kind`),
         weight: z.number().describe("How many times source links to target, or the suggestion score"),
       }),
     ),
diff --git a/app/_server/actions/relations/explore.ts b/app/_server/actions/relations/explore.ts
index de3bba9a3..ed2239b95 100644
--- a/app/_server/actions/relations/explore.ts
+++ b/app/_server/actions/relations/explore.ts
@@ -10,6 +10,7 @@ import {
   BRAIN_NODES_MAX,
   BrainEdgeKinds,
   BrainNodeKinds,
+  LINK_EDGE_KINDS,
   LinkKinds,
   LinkStyles,
   RelationsStatus,
@@ -27,7 +28,7 @@ import type {
   RelationsView,
   SuggestedItem,
 } from "@/app/_types/relations";
-import { backlinksFor, graphFor, visibleItems, type VisibleItem } from "./queries";
+import { backlinksFor, byKindRank, graphFor, visibleItems, type VisibleItem } from "./queries";
 import { freshRelations } from "./freshen";
 import { appOrigins } from "./paths";
 import { relationsDb } from "./store";
@@ -37,8 +38,6 @@ export const LINKS_OFF = "Links are turned off on this instance";
 export const NOT_VISIBLE = "Not found";
 export const DENIED = "Permission denied";
 
-const LINKING = new Set<BrainEdgeKinds>([BrainEdgeKinds.WIKI, BrainEdgeKinds.MENTION]);
-
 export const linksEnabled = async (): Promise<boolean> => {
   const settings = await getSettings();
   return settings?.editor?.enableBilateralLinks !== false;
@@ -60,7 +59,7 @@ const _outgoing = (uuid: string, visible: Map<string, VisibleItem>) => {
   const links: RelatedItem[] = [];
   const unwritten = new Set<string>();
   const seen = new Set<string>();
-  rows.forEach((row) => {
+  rows.sort(byKindRank).forEach((row) => {
     if (!row.dst) {
       if (row.kind === LinkKinds.WIKI && row.dst_text) unwritten.add(row.dst_label || row.dst_text);
       return;
@@ -203,7 +202,7 @@ export const neighbourhoodFor = async (
   const empty = { status: graph.status, focus: centre, nodes: [], edges: [], total: 0, truncated: false };
   if (graph.status === RelationsStatus.BUILDING) return { success: true, data: empty };
 
-  const links = graph.edges.filter((edge) => LINKING.has(edge.kind));
+  const links = graph.edges.filter((edge) => LINK_EDGE_KINDS.has(edge.kind));
   const degrees = _linkDegrees(links);
   const byId = new Map(graph.nodes.map((node) => [node.id, node]));
   const distance = centre ? _ring(centre, links, Math.min(depth, BRAIN_DEPTH_MAX)) : null;
@@ -268,7 +267,7 @@ export const orphansFor = async (
 
   const connected = new Set<string>();
   graph.edges
-    .filter((edge) => LINKING.has(edge.kind) && visible.has(edge.source) && visible.has(edge.target))
+    .filter((edge) => LINK_EDGE_KINDS.has(edge.kind) && visible.has(edge.source) && visible.has(edge.target))
     .forEach((edge) => {
       connected.add(edge.source);
       connected.add(edge.target);
diff --git a/app/_server/actions/relations/indexer.ts b/app/_server/actions/relations/indexer.ts
index e215f0601..7b7274647 100644
--- a/app/_server/actions/relations/indexer.ts
+++ b/app/_server/actions/relations/indexer.ts
@@ -12,7 +12,7 @@ import { pathUuid } from "@/app/_server/actions/lib/read-only";
 import { getAllFileStats } from "@/app/_server/actions/file";
 import { rankClaims, warnClash } from "@/app/_server/actions/lib/uuid-keeper";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { readLinks, titleKey } from "./parser";
+import { readLinks, titleKey, type LinkTarget } from "./parser";
 import { appOrigins, itemFileInfo, itemTreeRoots } from "./paths";
 import { searchableOf } from "./searchable";
 import {
@@ -31,6 +31,24 @@ const _tally = (keys: string[]): Map<string, number> => {
   return counts;
 };
 
+interface HrefLink {
+  dst: string;
+  kind: LinkKinds;
+  weight: number;
+}
+
+const _hrefLinks = (targets: LinkTarget[], self: string): HrefLink[] => {
+  const links = new Map<string, HrefLink>();
+  targets.forEach(({ uuid, kind }) => {
+    if (!uuid || uuid === self) return;
+    const key = `${kind}:${uuid}`;
+    const link = links.get(key);
+    if (link) link.weight++;
+    else links.set(key, { dst: uuid, kind, weight: 1 });
+  });
+  return Array.from(links.values());
+};
+
 const _prefixOf = (dir: string): string =>
   path.resolve(dir).replace(/[\\/]+$/, "") + path.sep;
 
@@ -168,11 +186,7 @@ export const indexItemFile = (
     ? null
     : searchableOf(info.type, parsed, content, absPath, metadata, origins);
 
-  const mentions = _tally(
-    parsed.targets
-      .map((target) => target.uuid)
-      .filter((dst): dst is string => Boolean(dst) && dst !== uuid),
-  );
+  const hrefs = _hrefLinks(parsed.targets, uuid);
   const wikiLabels = _wikiLabels(parsed.wikis);
   const wikis = _tally(parsed.wikis.map(titleKey).filter(Boolean));
   const rival = _rivalOf(uuid, absPath);
@@ -215,9 +229,7 @@ export const indexItemFile = (
     const insert = db.prepare(
       "INSERT INTO links (src, dst, dst_text, dst_label, kind, weight) VALUES (?, ?, ?, ?, ?, ?)",
     );
-    mentions.forEach((weight, dst) =>
-      insert.run(uuid, dst, null, null, LinkKinds.MENTION, weight),
-    );
+    hrefs.forEach(({ dst, kind, weight }) => insert.run(uuid, dst, null, null, kind, weight));
     wikis.forEach((weight, text) => {
       const dst = _resolveWiki(db, uuid, info.owner, text);
       insert.run(uuid, dst, text, wikiLabels.get(text) || text, LinkKinds.WIKI, weight);
diff --git a/app/_server/actions/relations/parser.ts b/app/_server/actions/relations/parser.ts
index 02f7a6bfa..845526344 100644
--- a/app/_server/actions/relations/parser.ts
+++ b/app/_server/actions/relations/parser.ts
@@ -2,18 +2,23 @@ import { unified } from "unified";
 import remarkParse from "remark-parse";
 import remarkGfm from "remark-gfm";
 import { SKIP, visit } from "unist-util-visit";
-import type { Nodes, Root } from "mdast";
-import { WIKILINK_REGEX } from "@/app/_consts/relations";
+import type { Nodes, Parents, Root } from "mdast";
+import { LinkKinds, WIKILINK_REGEX } from "@/app/_consts/relations";
 import { ItemHrefTarget, parseItemHref } from "@/app/_utils/item-href-utils";
 
+export interface LinkTarget extends ItemHrefTarget {
+  kind: LinkKinds;
+}
+
 export interface ParsedLinks {
-  targets: ItemHrefTarget[];
+  targets: LinkTarget[];
   wikis: string[];
   text: string;
   readable: string;
 }
 
 const HTML_HREF_REGEX = /data-href="([^"]+)"/g;
+const BLOCKS = new Set<string>(["paragraph", "heading", "tableCell"]);
 
 const processor = unified().use(remarkParse).use(remarkGfm);
 
@@ -33,8 +38,24 @@ const _wikis = (text: string): string[] =>
     Boolean,
   );
 
+const _lineage = (node: Nodes, parents: Map<Nodes, Parents>): Parents[] => {
+  const line: Parents[] = [];
+  for (let up = parents.get(node); up; up = parents.get(up)) line.push(up);
+  return line;
+};
+
+const _kindOf = (node: Nodes, parents: Map<Nodes, Parents>): LinkKinds => {
+  const line = _lineage(node, parents);
+  const task = line.find((up) => up.type === "listItem");
+  if (task?.type === "listItem" && typeof task.checked === "boolean") return LinkKinds.CHECKLIST;
+
+  const block = line.find((up) => BLOCKS.has(up.type));
+  if (!block) return LinkKinds.LINK;
+  return _squash([_plain(block)]) === _squash([_plain(node)]) ? LinkKinds.LINK : LinkKinds.MENTION;
+};
+
 export const readLinks = (markdown: string, origins: string[] = []): ParsedLinks => {
-  const targets: ItemHrefTarget[] = [];
+  const targets: LinkTarget[] = [];
   const wikis: string[] = [];
   const prose: string[] = [];
   const readable: string[] = [];
@@ -49,26 +70,28 @@ export const readLinks = (markdown: string, origins: string[] = []): ParsedLinks
     return empty;
   }
 
-  const addHref = (href: string) => {
+  const parents = new Map<Nodes, Parents>();
+  const addHref = (href: string, node: Nodes) => {
     const target = parseItemHref(href, origins);
-    if (target) targets.push(target);
+    if (target) targets.push({ ...target, kind: _kindOf(node, parents) });
   };
 
-  visit(tree, (node) => {
+  visit(tree, (node, _index, parent) => {
+    if (parent) parents.set(node, parent);
     if (node.type === "link") {
-      addHref(node.url);
+      addHref(node.url, node);
       readable.push(_plain(node));
       return SKIP;
     }
     if (node.type === "linkReference") return SKIP;
     if (node.type === "definition") {
-      addHref(node.url);
+      addHref(node.url, node);
     } else if (node.type === "text") {
       wikis.push(..._wikis(node.value));
       prose.push(node.value.replace(WIKILINK_REGEX, " "));
       readable.push(node.value.replace(WIKILINK_REGEX, (_, target, shown) => shown || target));
     } else if (node.type === "html") {
-      Array.from(node.value.matchAll(HTML_HREF_REGEX), (match) => addHref(match[1]));
+      Array.from(node.value.matchAll(HTML_HREF_REGEX), (match) => addHref(match[1], node));
     }
   });
 
diff --git a/app/_server/actions/relations/queries.ts b/app/_server/actions/relations/queries.ts
index 9238c96b7..05c6b2a96 100644
--- a/app/_server/actions/relations/queries.ts
+++ b/app/_server/actions/relations/queries.ts
@@ -4,6 +4,7 @@ import { UNCATEGORIZED } from "@/app/_consts/notes";
 import {
   BrainEdgeKinds,
   BrainNodeKinds,
+  LINK_KIND_RANK,
   LinkKinds,
   MENTION_LIMIT,
   MENTION_MIN_TITLE,
@@ -43,6 +44,15 @@ interface LinkRow {
   weight: number;
 }
 
+const HREF_EDGES: Partial<Record<LinkKinds, BrainEdgeKinds>> = {
+  [LinkKinds.LINK]: BrainEdgeKinds.LINK,
+  [LinkKinds.MENTION]: BrainEdgeKinds.MENTION,
+  [LinkKinds.CHECKLIST]: BrainEdgeKinds.CHECKLIST,
+};
+
+export const byKindRank = (a: { kind: LinkKinds }, b: { kind: LinkKinds }): number =>
+  LINK_KIND_RANK.indexOf(a.kind) - LINK_KIND_RANK.indexOf(b.kind);
+
 const GHOST_PREFIX = "ghost:";
 const TAG_PREFIX = "tag:";
 
@@ -164,12 +174,12 @@ export const backlinksFor = (
   if (status === RelationsStatus.BUILDING) return { uuid: target, status, ...EMPTY };
 
   const rows = relationsDb()
-    .prepare("SELECT DISTINCT src, kind FROM links WHERE dst = ? ORDER BY kind ASC")
+    .prepare("SELECT DISTINCT src, kind FROM links WHERE dst = ?")
     .all(target) as { src: string; kind: LinkKinds }[];
 
   const seen = new Set<string>();
   const backlinks: RelatedItem[] = [];
-  rows.forEach(({ src, kind }) => {
+  rows.sort(byKindRank).forEach(({ src, kind }) => {
     const source = visible.get(src);
     if (!source || src === target || seen.has(src)) return;
     seen.add(src);
@@ -224,8 +234,9 @@ export const graphFor = (owner: string, visible: Map<string, VisibleItem>): Brai
   };
 
   rows.forEach((row) => {
-    if (row.kind === LinkKinds.MENTION && row.dst && visible.has(row.dst)) {
-      connect(row.src, row.dst, BrainEdgeKinds.MENTION, row.weight);
+    const hrefEdge = HREF_EDGES[row.kind];
+    if (hrefEdge) {
+      if (row.dst && visible.has(row.dst)) connect(row.src, row.dst, hrefEdge, row.weight);
       return;
     }
 
diff --git a/app/_server/api/route-index.ts b/app/_server/api/route-index.ts
index 256ab045c..bb32db280 100644
--- a/app/_server/api/route-index.ts
+++ b/app/_server/api/route-index.ts
@@ -31,6 +31,7 @@ import * as logsStats from "@/app/api/logs/stats/route";
 import * as notes from "@/app/api/notes/route";
 import * as notesNoteId from "@/app/api/notes/[noteId]/route";
 import * as notesNoteIdTags from "@/app/api/notes/[noteId]/tags/route";
+import * as notesBatch from "@/app/api/notes/batch/route";
 import * as openapiJson from "@/app/api/openapi.json/route";
 import * as relationsItemId from "@/app/api/relations/[itemId]/route";
 import * as relationsLinks from "@/app/api/relations/links/route";
@@ -83,6 +84,7 @@ export const ROUTE_MODULES: object[] = [
   notes,
   notesNoteId,
   notesNoteIdTags,
+  notesBatch,
   openapiJson,
   relationsItemId,
   relationsLinks,
diff --git a/app/_translations/en.json b/app/_translations/en.json
index 9f696d9eb..98fa4bd97 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -1842,7 +1842,9 @@
       "tag": "Tag"
     },
     "edges": {
-      "mention": "Link",
+      "link": "Link",
+      "mention": "Mention",
+      "checklist": "Checklist",
       "wiki": "Wikilink",
       "suggested": "Suggested",
       "tag": "Tag"
diff --git a/app/api/brain/route.ts b/app/api/brain/route.ts
index 2001071b6..9a168ef37 100644
--- a/app/api/brain/route.ts
+++ b/app/api/brain/route.ts
@@ -2,7 +2,7 @@ import { NextResponse } from "next/server";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
 import { ERRORS } from "@/app/_schemas/api/common";
-import { brainQuery, brainSchema } from "@/app/_schemas/api/relations";
+import { LINK_KINDS_TEXT, brainQuery, brainSchema } from "@/app/_schemas/api/relations";
 import { neighbourhoodFor } from "@/app/_server/actions/relations/explore";
 
 export const dynamic = "force-dynamic";
@@ -15,7 +15,7 @@ export const GET = defineRoute(
     tag: ApiTag.RELATIONS,
     summary: "A slice of the link map",
     description:
-      "With focus, the items up to depth links away from it, nearest first. Without it, the most linked items. Tags are the #hashtags in an item's content, listed on each node rather than drawn as nodes.",
+      `With focus, the items up to depth links away from it, nearest first. Without it, the most linked items. Tags are the #hashtags in an item's content, listed on each node rather than drawn as nodes. Every edge carries a kind, and suggested marks a likely link when suggestions is on. ${LINK_KINDS_TEXT}.`,
     query: brainQuery,
     responses: {
       200: { description: "Nodes and the links between them", schema: brainSchema },
diff --git a/app/api/notes/batch/route.ts b/app/api/notes/batch/route.ts
new file mode 100644
index 000000000..14e49c67c
--- /dev/null
+++ b/app/api/notes/batch/route.ts
@@ -0,0 +1,51 @@
+import { NextResponse } from "next/server";
+import { getUserNotes } from "@/app/_server/actions/note/queries";
+import { defineRoute, refuse } from "@/app/_server/api/define-route";
+import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
+import { ERRORS } from "@/app/_schemas/api/common";
+import { noteBatchQuery, noteBatchSchema, noteIdList } from "@/app/_schemas/api/notes";
+import { toApiNote } from "@/app/_utils/api-note";
+import type { Note } from "@/app/_types";
+
+export const dynamic = "force-dynamic";
+
+export const GET = defineRoute(
+  {
+    id: "getNotes",
+    method: HttpMethod.GET,
+    path: "/notes/batch",
+    tag: ApiTag.NOTES,
+    summary: "Get several notes",
+    description:
+      "Reads the notes with the given uuids in one call, each with its whole content and contentLength. Ids that match no note you can read come back in missing instead of failing the call. For one very long note, getNote reads it in slices.",
+    query: noteBatchQuery,
+    responses: {
+      200: { description: "The notes found and the ids that weren't", schema: noteBatchSchema },
+      400: ERRORS[400],
+      401: ERRORS[401],
+      500: ERRORS[500],
+    },
+  },
+  async ({ user, query }) => {
+    const notes = await getUserNotes({ username: user.username });
+    if (!notes.success || !notes.data) {
+      return refuse(notes.error || "Failed to fetch notes", 500);
+    }
+
+    const byUuid = new Map<string, Partial<Note>>();
+    notes.data.forEach((note) => {
+      if (note.uuid) byUuid.set(note.uuid.toLowerCase(), note);
+    });
+
+    const asked = noteIdList(query.ids);
+    const found = asked.flatMap((id) => byUuid.get(id) ?? []);
+
+    return NextResponse.json({
+      notes: found.map((note) => ({
+        ...toApiNote(note),
+        contentLength: (note.content ?? "").length,
+      })),
+      missing: asked.filter((id) => !byUuid.has(id)),
+    });
+  },
+);
diff --git a/app/api/notes/route.ts b/app/api/notes/route.ts
index 624016dce..e1160ff8d 100644
--- a/app/api/notes/route.ts
+++ b/app/api/notes/route.ts
@@ -12,11 +12,6 @@ import { UNCATEGORIZED } from "@/app/_consts/notes";
 
 export const dynamic = "force-dynamic";
 
-const _idSet = (ids?: string): Set<string> | null => {
-  const list = (ids || "").split(",").map((id) => id.trim().toLowerCase()).filter(Boolean);
-  return list.length ? new Set(list) : null;
-};
-
 export const GET = defineRoute(
   {
     id: "listNotes",
@@ -24,7 +19,7 @@ export const GET = defineRoute(
     path: "/notes",
     tag: ApiTag.NOTES,
     summary: "List notes",
-    description: "Every note the API key owner can read, including shared ones. Use view=summary with limit and offset to page through titles and excerpts without loading every note's content. Pass ids to read several known notes in one call, and tag to list the notes carrying a tag.",
+    description: "Every note the API key owner can read, including shared ones. Use view=summary with limit and offset to page through titles and excerpts without loading every note's content. Pass tag to list the notes carrying a tag, and use getNotes to read several known notes in one call.",
     query: noteListQuery,
     responses: {
       200: { description: "Notes", schema: z.object({ notes: z.array(noteSchema), total: totalField }) },
@@ -39,11 +34,9 @@ export const GET = defineRoute(
     }
 
     const needle = query.q?.toLowerCase();
-    const wanted = _idSet(query.ids);
     const matches = notes.data.filter(
       (note) =>
         (!query.category || note.category === query.category) &&
-        (!wanted || wanted.has((note.uuid || "").toLowerCase())) &&
         (!query.tag || (note.tags || []).some((tag) => tagMatchesFilter(tag, query.tag!))) &&
         (!needle ||
           note.title?.toLowerCase().includes(needle) ||
diff --git a/app/api/relations/[itemId]/route.ts b/app/api/relations/[itemId]/route.ts
index f6769f656..886cedb48 100644
--- a/app/api/relations/[itemId]/route.ts
+++ b/app/api/relations/[itemId]/route.ts
@@ -2,7 +2,7 @@ import { NextResponse } from "next/server";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
 import { ERRORS } from "@/app/_schemas/api/common";
-import { relatedParams, relatedSchema } from "@/app/_schemas/api/relations";
+import { LINK_KINDS_TEXT, relatedParams, relatedSchema } from "@/app/_schemas/api/relations";
 import { relatedFor } from "@/app/_server/actions/relations/explore";
 
 export const dynamic = "force-dynamic";
@@ -15,7 +15,7 @@ export const GET = defineRoute(
     tag: ApiTag.RELATIONS,
     summary: "What an item links to and what links to it",
     description:
-      "Backlinks, outgoing links, wikilinks to notes nobody has written, notes that name the item without linking it, and items that are probably related. Titles only, fetch an item to read it.",
+      `Backlinks, outgoing links, wikilinks to notes nobody has written, notes that name the item without linking it, and items that are probably related. Titles only, fetch an item to read it. Backlinks and links each carry a kind. ${LINK_KINDS_TEXT}.`,
     params: relatedParams,
     responses: {
       200: { description: "The item's links", schema: relatedSchema },
diff --git a/howto/BRAIN.md b/howto/BRAIN.md
index 49432bfc0..d2bb98ad5 100644
--- a/howto/BRAIN.md
+++ b/howto/BRAIN.md
@@ -129,4 +129,15 @@ The same links are available with an API key, so scripts and AI assistants can f
 | `GET /api/relations/orphans` | Notes and checklists with no links at all |
 | `POST /api/relations/links` | Adds a link to a note, at the end or on the first plain mention of the target's title |
 
+Every link comes back with a `kind` that says how it's written:
+
+| Kind | What it is |
+| --- | --- |
+| `link` | A `[Title](/note/<uuid>)` link on a line of its own, like the ones `POST /api/relations/links` adds at the end |
+| `mention` | The same kind of link inside a sentence, like a mention picked with `@` or one the API turned into a link |
+| `checklist` | A link inside a checklist item, or inside a `- [ ]` task in a note |
+| `wiki` | A `[[Title]]` wikilink |
+
+When one item links another in more than one way, `/api/relations/{itemId}` shows one kind, the first of `mention`, `link`, `checklist` and `wiki`. The brain draws a line for each.
+
 They follow the same rules as the brain. You only see items you can open, linking needs edit access to the note, and encrypted notes are refused. With **Bilateral Links** turned off they answer `404`.
diff --git a/howto/MCP.md b/howto/MCP.md
index 7cfe21d42..66351ebdb 100644
--- a/howto/MCP.md
+++ b/howto/MCP.md
@@ -87,7 +87,7 @@ The assistant can also follow your [links](BRAIN.md) and see what's shared:
 
 | Tool | What it does |
 |---|---|
-| `get_related` | What links to an item and what it links to, as titles. The assistant reads only the ones that matter instead of opening everything |
+| `get_related` | What links to an item and what it links to, as titles. Each link says whether it's a `link`, `mention`, `checklist` or `wiki`. The assistant reads only the ones that matter instead of opening everything |
 | `get_brain` | The items around one item, or your most linked items |
 | `list_orphans` | Items with no links. That's normal, it isn't a to-do list |
 | `connect_items` | Links a note to another item it relates to |
@@ -132,7 +132,7 @@ An assistant reads every character a tool sends back, and a long answer pushes t
 - `list_notes`, `list_checklists` and `list_boards` return 25 results at a time in a summary view. Notes come with a short excerpt instead of their content, checklists with item counts, and boards with card counts per column. `total` says how many matched, `offset` reads the next page, and `view=full` gets everything.
 - An answer longer than `JOTTY_MCP_MAX_TEXT_CHARS` keeps the rows that fit and adds a `trimmed` field with the `offset` for the next ones. A single record that's still too long gets cut.
 - That limit is only the default. Every tool takes `maxChars`, so the assistant can ask for more when it needs a whole answer, or less to save room.
-- `get_note` gives the note's length in `contentLength` and takes `offset` and `limit`, so the assistant can read a very long note in slices. `list_notes` takes `ids` to read several notes in one call.
+- `get_note` gives the note's length in `contentLength` and takes `offset` and `limit`, so the assistant can read a very long note in slices. `get_notes` reads up to 50 notes by UUID in one call, each with its `contentLength`, and lists any it couldn't find under `missing`.
 - Updating or moving a card returns that card, not the whole board.
 - Search puts the best matches first and gives you the `uuid` the other tools take and the file name as `slug`.
 - `get_brain` returns 60 items at most by default, nearest and most linked first, and says when it left some out.
diff --git a/mcp-server/src/server/mcp.ts b/mcp-server/src/server/mcp.ts
index 44d746896..218cf9a77 100644
--- a/mcp-server/src/server/mcp.ts
+++ b/mcp-server/src/server/mcp.ts
@@ -10,7 +10,7 @@ export const SERVER_INSTRUCTIONS = [
   "Tools for a Jotty instance: notes, checklists and Kanban boards, acting as the user who owns the API key.",
   "Ids are uuids, so list or search first to get one. Checklist items are addressed by tree index, like 0 or 2.1.",
   "Search ranks the best matches first and finds the words in any order.",
-  "Every tool takes maxChars to raise or lower how much output it returns. get_note reports contentLength and takes offset and limit, so read a long note in slices until nextOffset is gone.",
+  "Every tool takes maxChars to raise or lower how much output it returns. get_note reports contentLength and takes offset and limit, so read a long note in slices until nextOffset is gone. get_notes reads several notes by id in one call.",
   "update_note replaces the whole content, so only send it after reading all of the note. For a small change use patch_note, which swaps one exact piece of text and leaves the rest untouched.",
   "Tags are #hashtags in the content, and #parent/child nests. list_tags shows them, list_notes filters by tag, tag_note adds or removes them without resending the note.",
   "Notes link to each other. After finding an item, get_related lists what links to it and what it links to, so you can follow the links and read only what matters. get_brain maps the items around one, or the most linked ones.",
diff --git a/mcp-server/src/tools/catalog.ts b/mcp-server/src/tools/catalog.ts
index 9b19dd5f9..fa874d0c9 100644
--- a/mcp-server/src/tools/catalog.ts
+++ b/mcp-server/src/tools/catalog.ts
@@ -17,6 +17,7 @@ export const CATALOG: CatalogEntry[] = [
   { id: "getCurrentUser" },
   { id: "listNotes", defaults: SUMMARY_PAGE },
   { id: "getNote" },
+  { id: "getNotes" },
   { id: "createNote" },
   { id: "updateNote" },
   { id: "patchNote" },
diff --git a/tests/api/note-edits.test.ts b/tests/api/note-edits.test.ts
index c0b94df99..675dcd638 100644
--- a/tests/api/note-edits.test.ts
+++ b/tests/api/note-edits.test.ts
@@ -11,6 +11,8 @@ import {
   getResponseJson,
 } from "./setup";
 import { GET as LIST } from "@/app/api/notes/route";
+import { GET as BATCH } from "@/app/api/notes/batch/route";
+import { NOTES_BATCH_MAX } from "@/app/_schemas/api/notes";
 import { GET as READ, PATCH } from "@/app/api/notes/[noteId]/route";
 import { POST as TAG } from "@/app/api/notes/[noteId]/tags/route";
 import { GET as TAGS } from "@/app/api/tags/route";
@@ -72,12 +74,6 @@ describe("note edits over the API", () => {
       { ...stored, uuid: OTHER, title: "Work log", tags: ["work"], extraMetadata: undefined },
     ];
 
-    it("reads several notes by id in one call", async () => {
-      mockGetUserNotes.mockResolvedValue({ success: true, data: notes });
-      const body = await getResponseJson(await LIST(createMockRequest("GET", `/api/notes?ids=${OTHER.toUpperCase()}, nope`)));
-      expect(body.notes.map((note: { id: string }) => note.id)).toEqual([OTHER]);
-    });
-
     it("filters by tag, nested tags included", async () => {
       mockGetUserNotes.mockResolvedValue({ success: true, data: notes });
       const body = await getResponseJson(await LIST(createMockRequest("GET", "/api/notes?tag=home")));
@@ -86,6 +82,40 @@ describe("note edits over the API", () => {
     });
   });
 
+  describe("GET /api/notes/batch", () => {
+    const notes = [
+      { ...stored, uuid: NOTE },
+      { ...stored, uuid: OTHER, title: "Work log", content: "log", extraMetadata: undefined },
+    ];
+    const batch = async (ids: string) =>
+      BATCH(createMockRequest("GET", `/api/notes/batch?ids=${encodeURIComponent(ids)}`));
+
+    it("reads several notes by id in the order asked, with their length", async () => {
+      mockGetUserNotes.mockResolvedValue({ success: true, data: notes });
+      const body = await getResponseJson(await batch(`${OTHER.toUpperCase()}, ${NOTE}`));
+      expect(body.notes).toMatchObject([
+        { id: OTHER, content: "log", contentLength: 3 },
+        { id: NOTE, content: "0123456789", contentLength: 10, managed: true },
+      ]);
+      expect(body.missing).toEqual([]);
+    });
+
+    it("lists unknown ids under missing instead of failing", async () => {
+      mockGetUserNotes.mockResolvedValue({ success: true, data: notes });
+      const response = await batch(`${NOTE},nope,${NOTE}`);
+      expect(response.status).toBe(200);
+      const body = await getResponseJson(response);
+      expect(body.notes.map((note: { id: string }) => note.id)).toEqual([NOTE]);
+      expect(body.missing).toEqual(["nope"]);
+    });
+
+    it("refuses an empty list and too many ids", async () => {
+      expect((await batch("")).status).toBe(400);
+      const many = Array.from({ length: NOTES_BATCH_MAX + 1 }, (_, i) => `id-${i}`).join(",");
+      expect((await batch(many)).status).toBe(400);
+    });
+  });
+
   describe("PATCH /api/notes/{noteId}", () => {
     it("runs the find and replace inside the note's splice", async () => {
       mockSpliceNote.mockImplementation(async (_user, _uuid, edit) => {
diff --git a/tests/server-actions/relations.test.ts b/tests/server-actions/relations.test.ts
index 9fd12fdba..338511264 100644
--- a/tests/server-actions/relations.test.ts
+++ b/tests/server-actions/relations.test.ts
@@ -4,7 +4,7 @@ import os from "os";
 import path from "path";
 import { mockFs, resetAllMocks } from "../setup";
 import { ItemTypes } from "@/app/_types/enums";
-import { LinkKinds, RelationsStatus } from "@/app/_consts/relations";
+import { BrainEdgeKinds, LinkKinds, RelationsStatus } from "@/app/_consts/relations";
 
 vi.unmock("unified");
 vi.unmock("unist-util-visit");
@@ -117,13 +117,28 @@ describe("relations", () => {
       );
 
       expect(parsed.targets).toEqual([
-        { uuid: A, type: ItemTypes.NOTE },
-        { uuid: B, type: undefined },
-        { type: ItemTypes.CHECKLIST, legacy: { category: "Work", id: "groceries" } },
-        { uuid: C, type: ItemTypes.CHECKLIST },
+        { uuid: A, type: ItemTypes.NOTE, kind: LinkKinds.MENTION },
+        { uuid: B, type: undefined, kind: LinkKinds.MENTION },
+        { type: ItemTypes.CHECKLIST, legacy: { category: "Work", id: "groceries" }, kind: LinkKinds.MENTION },
+        { uuid: C, type: ItemTypes.CHECKLIST, kind: LinkKinds.MENTION },
       ]);
       expect(parsed.wikis).toEqual(["Milk run", "Escaped"]);
     });
+
+    it("tells standalone links, mentions and checklist links apart", () => {
+      const kinds = (markdown: string) => readLinks(markdown).targets.map((target) => target.kind);
+
+      expect(kinds(`[Alpha](/note/${A})`)).toEqual([LinkKinds.LINK]);
+      expect(kinds(`## [Alpha](/note/${A})`)).toEqual([LinkKinds.LINK]);
+      expect(kinds(`- [Alpha](/note/${A})`)).toEqual([LinkKinds.LINK]);
+      expect(kinds(`**[Alpha](/note/${A})**`)).toEqual([LinkKinds.LINK]);
+      expect(kinds(`[alpha]: /note/${A}`)).toEqual([LinkKinds.LINK]);
+      expect(kinds(`talk to [Alpha](/note/${A}) first`)).toEqual([LinkKinds.MENTION]);
+      expect(kinds(`[Alpha](/note/${A}) [Beta](/note/${B})`)).toEqual([LinkKinds.MENTION, LinkKinds.MENTION]);
+      expect(kinds(`- [ ] [Alpha](/note/${A})`)).toEqual([LinkKinds.CHECKLIST]);
+      expect(kinds(`- [x] ask [Alpha](/note/${A})`)).toEqual([LinkKinds.CHECKLIST]);
+      expect(kinds(`- [ ] task\n  - see [Alpha](/note/${A}) too`)).toEqual([LinkKinds.MENTION]);
+    });
   });
 
   describe("backlinks", () => {
@@ -145,7 +160,7 @@ describe("relations", () => {
         { uuid: C, title: "List", type: ItemTypes.CHECKLIST },
       ]);
       expect(backlinksFor(C, visible).backlinks).toMatchObject([
-        { uuid: A, kind: LinkKinds.MENTION },
+        { uuid: A, kind: LinkKinds.LINK },
       ]);
     });
 
@@ -233,6 +248,38 @@ describe("relations", () => {
       expect(graph.nodes.find((node) => node.id === "ghost:someday")?.title).toBe("Someday");
     });
 
+    it("draws an edge per kind of link", () => {
+      write(
+        itemPath("notes", "alice", "a.md"),
+        note(A, "Alpha", `[Beta](/note/${B})\n\nask [Beta](/note/${B}) and [Gamma](/note/${C})\n\n- [ ] [Gamma](/note/${C})`),
+      );
+
+      const graph = graphFor(
+        "alice",
+        visibleOf([
+          { uuid: A, title: "Alpha" },
+          { uuid: B, title: "Beta" },
+          { uuid: C, title: "Gamma" },
+        ]),
+      );
+
+      const edges = graph.edges
+        .filter((edge) => edge.kind !== BrainEdgeKinds.SUGGESTED)
+        .map((edge) => `${edge.target}:${edge.kind}`)
+        .sort();
+      expect(edges).toEqual(
+        [
+          `${B}:${BrainEdgeKinds.LINK}`,
+          `${B}:${BrainEdgeKinds.MENTION}`,
+          `${C}:${BrainEdgeKinds.MENTION}`,
+          `${C}:${BrainEdgeKinds.CHECKLIST}`,
+        ].sort(),
+      );
+      expect(backlinksFor(B, visibleOf([{ uuid: A, title: "Alpha" }, { uuid: B, title: "Beta" }])).backlinks).toMatchObject([
+        { uuid: A, kind: LinkKinds.MENTION },
+      ]);
+    });
+
     it("leaves out links whose source the viewer cannot see", () => {
       write(itemPath("notes", "bob", "private.md"), note(SECRET, "Private", `[Alpha](/note/${A})`));
 

From 062284a7e6fd838330b473c5d3eeb4a5679b3ede Mon Sep 17 00:00:00 2001
From: fccview <f.campioneuk@gmail.com>
Date: Mon, 28 Sep 2026 22:46:09 +0100
Subject: [PATCH 28/28] some hardening

---
 .../settings/sessions/page.tsx                |  14 +-
 .../Admin/Parts/AdminAuditLogsClient.tsx      |   8 +-
 .../Kanban/KanbanCardDetail.tsx               |   2 +-
 .../Profile/Parts/AuditLogsTabClient.tsx      |   3 +-
 .../XChaChaEncryptionModal.tsx                |   4 +-
 app/_consts/logs.ts                           |   3 +
 app/_hooks/useFolderShare.ts                  |   2 +-
 app/_hooks/useNoteEditor.tsx                  |  22 +-
 app/_hooks/useSessionManager.tsx              |  19 +-
 app/_hooks/useSharingTools.ts                 |   2 +-
 app/_schemas/api/admin.ts                     |  11 +-
 app/_schemas/api/logs.ts                      |  51 ++-
 app/_server/actions/api/authenticate.ts       |  27 ++
 app/_server/actions/api/index.ts              |  27 +-
 app/_server/actions/auth/index.ts             |   7 +-
 app/_server/actions/category/crud.ts          |   2 +-
 app/_server/actions/category/move.ts          |   2 +-
 app/_server/actions/category/queries.ts       | 132 +-----
 app/_server/actions/category/tree.ts          | 132 ++++++
 app/_server/actions/checklist/converters.ts   |  80 ++--
 app/_server/actions/checklist/creator.ts      |   6 +
 app/_server/actions/checklist/crud.ts         |  18 +-
 app/_server/actions/checklist/editor.ts       |   6 +
 app/_server/actions/checklist/index.ts        |   1 -
 app/_server/actions/checklist/readers.ts      |   2 -
 app/_server/actions/config/helpers.ts         |  14 +-
 app/_server/actions/dashboard/index.ts        |   5 +-
 app/_server/actions/export/builders.ts        |  13 +-
 app/_server/actions/export/index.ts           |   3 +-
 app/_server/actions/export/naming.ts          |  18 +
 app/_server/actions/file/index.ts             |   4 +
 app/_server/actions/history/index.ts          | 383 +++---------------
 app/_server/actions/history/repo.ts           | 303 ++++++++++++++
 app/_server/actions/lib/audit-trail.ts        |  11 +-
 app/_server/actions/lib/filename-fence.ts     |  19 +
 app/_server/actions/log/cleanup.ts            | 196 ++-------
 app/_server/actions/log/client.ts             |  38 ++
 app/_server/actions/log/helpers.ts            |   7 +-
 app/_server/actions/log/readers.ts            |   7 +-
 app/_server/actions/log/sweep.ts              | 189 +++++++++
 app/_server/actions/log/writers.ts            |  10 +-
 app/_server/actions/mfa/index.ts              |  90 +---
 app/_server/actions/mfa/secret.ts             |  84 ++++
 app/_server/actions/note/creator.ts           |   8 +-
 app/_server/actions/note/crud.ts              |  18 +-
 app/_server/actions/note/editor.ts            |   8 +-
 app/_server/actions/note/index.ts             |   1 -
 app/_server/actions/note/readers.ts           |   2 -
 app/_server/actions/note/splice.ts            |  29 +-
 app/_server/actions/pgp/index.ts              |  47 ++-
 app/_server/actions/reminders/scanner.ts      |   2 -
 app/_server/actions/session/index.ts          | 178 ++------
 app/_server/actions/session/store.ts          | 145 +++++++
 app/_server/actions/share/access.ts           |   2 -
 app/_server/actions/share/category-info.ts    |   2 -
 app/_server/actions/share/lookups.ts          |  44 ++
 app/_server/actions/share/queries.ts          |   2 -
 app/_server/actions/share/target.ts           |  18 +-
 app/_server/actions/stats/index.ts            |   6 +-
 app/_server/actions/upload/index.ts           |  22 +-
 app/_server/actions/users/core.ts             | 143 +++++++
 app/_server/actions/users/crud.ts             | 138 +------
 app/_server/actions/users/ensure-user.ts      |   1 -
 app/_server/actions/users/helpers.ts          |  55 ++-
 app/_server/actions/users/index.ts            |   4 -
 app/_server/actions/users/queries.ts          |   2 +
 app/_server/actions/users/records.ts          |   2 +-
 app/_server/actions/uuid-clash/scan.ts        |  43 +-
 app/_server/actions/xchacha/index.ts          |   5 +
 app/_server/api/define-route.ts               |   2 +-
 app/_translations/en.json                     |   1 +
 app/_utils/api-utils.ts                       |   2 +-
 app/_utils/category-utils.ts                  |   2 -
 app/_utils/filename-utils.ts                  |   4 +-
 app/_utils/path-utils.ts                      |   4 +
 app/api/admin/duplicate-uuids/route.ts        |  11 +-
 app/api/auth/check-session/route.ts           |   2 +-
 app/api/categories/route.ts                   |   6 +-
 app/api/exports/[filename]/route.ts           |  24 +-
 app/api/exports/route.ts                      |   2 +
 app/api/logs/cleanup/route.ts                 |   4 +-
 app/api/oidc/callback/route.ts                |   4 +-
 docker-compose.mcp.yml                        |   2 +
 howto/API.md                                  |   4 +
 howto/MCP.md                                  |  19 +-
 mcp-server/Dockerfile                         |   1 +
 mcp-server/src/config/env.ts                  |   3 +
 mcp-server/src/config/load.ts                 |  25 +-
 mcp-server/src/config/schema.ts               |   3 +
 mcp-server/src/server/exposure.ts             |  56 +++
 mcp-server/src/server/http.ts                 |  26 +-
 mcp-server/src/server/sessions.ts             |  13 +-
 mcp-server/tests/exposure.test.ts             | 102 +++++
 tests/api/duplicate-uuids.test.ts             |  28 ++
 tests/api/exports.test.ts                     |  17 +
 tests/api/logs.test.ts                        |  53 ++-
 tests/api/setup.ts                            |  13 +-
 tests/security/actor-spoofing.test.ts         |   4 +-
 tests/security/auth-required.test.ts          |   4 +-
 tests/security/data-leakage.test.ts           |   9 +-
 tests/security/export-download.test.ts        |  33 +-
 tests/security/export-naming.test.ts          |  29 ++
 tests/security/filename-containment.test.ts   | 157 +++++++
 tests/security/kanban-grants.test.ts          |   2 +-
 tests/security/log-range.test.ts              |  38 ++
 tests/security/mount-sideways.test.ts         | 195 +++++++++
 tests/security/server-action-surface.test.ts  | 219 ++++++++++
 tests/security/share-grants.test.ts           |   2 +-
 tests/security/sweep-guards.test.ts           | 146 +++++++
 tests/security/upload-delete.test.ts          |  87 ++++
 tests/security/uuid-cross-user.test.ts        |  96 +++++
 tests/server-actions/api-key.test.ts          |   9 +-
 tests/server-actions/auth.test.ts             |   9 +-
 tests/server-actions/history.test.ts          |   7 +-
 tests/server-actions/item-lane.test.ts        |   2 +-
 tests/server-actions/note-move-safety.test.ts |   2 +-
 tests/server-actions/note-splice.test.ts      |   8 +-
 tests/server-actions/note.test.ts             |   2 +-
 tests/server-actions/session.test.ts          |  33 +-
 tests/server-actions/share-edit.test.ts       |   2 +-
 tests/server-actions/share-visibility.test.ts |   6 +-
 tests/server-actions/user-deletion.test.ts    |   2 +-
 tests/server-actions/users.test.ts            |  16 +-
 tests/server-actions/xchacha.test.ts          |  16 +
 124 files changed, 3150 insertions(+), 1322 deletions(-)
 create mode 100644 app/_server/actions/api/authenticate.ts
 create mode 100644 app/_server/actions/category/tree.ts
 create mode 100644 app/_server/actions/export/naming.ts
 create mode 100644 app/_server/actions/history/repo.ts
 create mode 100644 app/_server/actions/lib/filename-fence.ts
 create mode 100644 app/_server/actions/log/client.ts
 create mode 100644 app/_server/actions/log/sweep.ts
 create mode 100644 app/_server/actions/mfa/secret.ts
 create mode 100644 app/_server/actions/share/lookups.ts
 create mode 100644 app/_server/actions/users/core.ts
 create mode 100644 mcp-server/src/server/exposure.ts
 create mode 100644 mcp-server/tests/exposure.test.ts
 create mode 100644 tests/security/export-naming.test.ts
 create mode 100644 tests/security/filename-containment.test.ts
 create mode 100644 tests/security/log-range.test.ts
 create mode 100644 tests/security/mount-sideways.test.ts
 create mode 100644 tests/security/server-action-surface.test.ts
 create mode 100644 tests/security/sweep-guards.test.ts
 create mode 100644 tests/security/upload-delete.test.ts
 create mode 100644 tests/security/uuid-cross-user.test.ts

diff --git a/app/(loggedInRoutes)/settings/sessions/page.tsx b/app/(loggedInRoutes)/settings/sessions/page.tsx
index 55f8ca38e..f48dc1543 100644
--- a/app/(loggedInRoutes)/settings/sessions/page.tsx
+++ b/app/(loggedInRoutes)/settings/sessions/page.tsx
@@ -1,22 +1,14 @@
 import { getTranslations } from "next-intl/server";
 import { SessionsTabClient } from "@/app/_components/FeatureComponents/Profile/Parts/SessionsTabClient";
-import { getCurrentUser } from "@/app/_server/actions/users";
-import { getSessionsForUser, getSessionId } from "@/app/_server/actions/session";
+import { getMySessions } from "@/app/_server/actions/session";
 
 export default async function SessionsPage() {
     const t = await getTranslations();
-    const currentUser = await getCurrentUser();
-    const sessionId = await getSessionId();
+    const sessions = await getMySessions();
 
-    if (!currentUser) {
+    if (!sessions) {
         return <div>{t('errors.unauthorized')}</div>;
     }
 
-    const sessionsData = await getSessionsForUser(currentUser.username);
-    const sessions = sessionsData?.map((session) => ({
-        ...session,
-        isCurrent: session.id === sessionId,
-    })) || [];
-
     return <SessionsTabClient initialSessions={sessions} />;
 }
diff --git a/app/_components/FeatureComponents/Admin/Parts/AdminAuditLogsClient.tsx b/app/_components/FeatureComponents/Admin/Parts/AdminAuditLogsClient.tsx
index 24e051f6e..5df4e64e5 100644
--- a/app/_components/FeatureComponents/Admin/Parts/AdminAuditLogsClient.tsx
+++ b/app/_components/FeatureComponents/Admin/Parts/AdminAuditLogsClient.tsx
@@ -14,12 +14,8 @@ import {
 } from "hugeicons-react";
 import { Logo } from "@/app/_components/GlobalComponents/Layout/Logo/Logo";
 import { useTranslations } from "next-intl";
-import {
-  getAuditLogs,
-  exportAuditLogs,
-  cleanupOldLogs,
-  deleteAllLogs,
-} from "@/app/_server/actions/log";
+import { getAuditLogs, exportAuditLogs } from "@/app/_server/actions/log/readers";
+import { cleanupOldLogs, deleteAllLogs } from "@/app/_server/actions/log/cleanup";
 import { useToast } from "@/app/_providers/ToastProvider";
 import { DeleteAllLogsModal } from "@/app/_components/GlobalComponents/Modals/ConfirmationModals/DeleteAllLogsModal";
 
diff --git a/app/_components/FeatureComponents/Kanban/KanbanCardDetail.tsx b/app/_components/FeatureComponents/Kanban/KanbanCardDetail.tsx
index a0a680c4d..53f1176c7 100644
--- a/app/_components/FeatureComponents/Kanban/KanbanCardDetail.tsx
+++ b/app/_components/FeatureComponents/Kanban/KanbanCardDetail.tsx
@@ -14,7 +14,7 @@ import {
   bulkToggleItems,
   updateItemStatus,
 } from "@/app/_server/actions/checklist-item";
-import { usersWithAccess } from "@/app/_server/actions/share/queries";
+import { usersWithAccess } from "@/app/_server/actions/share/lookups";
 import { getUsers } from "@/app/_server/actions/users";
 import { FloppyDiskIcon, MultiplicationSignIcon, ArrowDown01Icon, ArrowRight01Icon } from "hugeicons-react";
 import { usePermissions } from "@/app/_providers/PermissionsProvider";
diff --git a/app/_components/FeatureComponents/Profile/Parts/AuditLogsTabClient.tsx b/app/_components/FeatureComponents/Profile/Parts/AuditLogsTabClient.tsx
index 520b18fdd..018f8204b 100644
--- a/app/_components/FeatureComponents/Profile/Parts/AuditLogsTabClient.tsx
+++ b/app/_components/FeatureComponents/Profile/Parts/AuditLogsTabClient.tsx
@@ -8,7 +8,8 @@ import { Button } from "@/app/_components/GlobalComponents/Buttons/Button";
 import { Download01Icon, ArrowLeft01Icon, ArrowRight01Icon, AlertCircleIcon } from "hugeicons-react";
 import { Logo } from "@/app/_components/GlobalComponents/Layout/Logo/Logo";
 import { useTranslations } from "next-intl";
-import { getAuditLogs, exportAuditLogs, cleanupOldLogs } from "@/app/_server/actions/log";
+import { getAuditLogs, exportAuditLogs } from "@/app/_server/actions/log/readers";
+import { cleanupOldLogs } from "@/app/_server/actions/log/cleanup";
 import { useToast } from "@/app/_providers/ToastProvider";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 
diff --git a/app/_components/GlobalComponents/Modals/EncryptionModals/XChaChaEncryptionModal.tsx b/app/_components/GlobalComponents/Modals/EncryptionModals/XChaChaEncryptionModal.tsx
index e18b09cbd..9e46e179c 100644
--- a/app/_components/GlobalComponents/Modals/EncryptionModals/XChaChaEncryptionModal.tsx
+++ b/app/_components/GlobalComponents/Modals/EncryptionModals/XChaChaEncryptionModal.tsx
@@ -9,7 +9,7 @@ import {
   encryptXChaCha,
   decryptXChaCha,
 } from "@/app/_server/actions/xchacha";
-import { logAudit } from "@/app/_server/actions/log";
+import { logClientAudit } from "@/app/_server/actions/log/client";
 import { useToast } from "@/app/_providers/ToastProvider";
 import { useTranslations } from "next-intl";
 
@@ -62,7 +62,7 @@ export const XChaChaEncryptionModal = ({
         const validateResult = await decryptXChaCha(validateFormData);
 
         if (!validateResult.success) {
-          await logAudit({
+          await logClientAudit({
             level: "WARNING",
             action: "note_saved_encrypted",
             category: "encryption",
diff --git a/app/_consts/logs.ts b/app/_consts/logs.ts
index 738220dbd..00ecf8082 100644
--- a/app/_consts/logs.ts
+++ b/app/_consts/logs.ts
@@ -1 +1,4 @@
 export const LOG_WINDOW_DAYS = 30;
+export const LOG_MAX_RANGE_DAYS = 366;
+export const LOG_READ_BATCH_DAYS = 31;
+export const DAY_MS = 24 * 60 * 60 * 1000;
diff --git a/app/_hooks/useFolderShare.ts b/app/_hooks/useFolderShare.ts
index 9a0639ec7..3e9f17e1c 100644
--- a/app/_hooks/useFolderShare.ts
+++ b/app/_hooks/useFolderShare.ts
@@ -8,7 +8,7 @@ import {
   unshareFolder,
   setFolderPublic,
 } from "@/app/_server/actions/share/operations";
-import { folderShares } from "@/app/_server/actions/share/queries";
+import { folderShares } from "@/app/_server/actions/share/lookups";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
 
 const READ_ONLY: SharingPermissions = {
diff --git a/app/_hooks/useNoteEditor.tsx b/app/_hooks/useNoteEditor.tsx
index 245c7ed62..acfe4ea9c 100644
--- a/app/_hooks/useNoteEditor.tsx
+++ b/app/_hooks/useNoteEditor.tsx
@@ -12,7 +12,7 @@ import { useNavigationGuard } from "@/app/_providers/NavigationGuardProvider";
 import { deleteNote, updateNote } from "@/app/_server/actions/note";
 import { encryptNoteContent } from "@/app/_server/actions/pgp";
 import { encryptXChaCha } from "@/app/_server/actions/xchacha";
-import { logContentEvent, logAudit } from "@/app/_server/actions/log";
+import { logClientAudit } from "@/app/_server/actions/log/client";
 import { itemHref, publicHref } from "@/app/_utils/global-utils";
 import { Note } from "@/app/_types";
 import { useAppMode } from "@/app/_providers/AppModeProvider";
@@ -224,7 +224,7 @@ export const useNoteEditor = ({
                 encryptFormData.append("signingPassphrase", signingData.signingPassphrase);
               }
             } catch (parseError) {
-              await logAudit({
+              await logClientAudit({
                 level: "DEBUG",
                 action: "note_saved_encrypted",
                 category: "note",
@@ -251,14 +251,16 @@ export const useNoteEditor = ({
             }
           }
 
-          await logContentEvent(
-            "note_saved_encrypted",
-            "note",
-            note.uuid!,
-            title,
-            true,
-            { encryptionMethod: note.encryptionMethod }
-          );
+          await logClientAudit({
+            level: "INFO",
+            action: "note_saved_encrypted",
+            category: "note",
+            resourceType: "note",
+            resourceId: note.uuid!,
+            resourceTitle: title,
+            success: true,
+            metadata: { encryptionMethod: note.encryptionMethod },
+          });
         } catch (error) {
           console.error("Error encrypting note:", error);
           setStatus((prev) => ({ ...prev, isSaving: false }));
diff --git a/app/_hooks/useSessionManager.tsx b/app/_hooks/useSessionManager.tsx
index 14135ea7e..6557523ac 100644
--- a/app/_hooks/useSessionManager.tsx
+++ b/app/_hooks/useSessionManager.tsx
@@ -1,11 +1,8 @@
 import { useState, useCallback, useEffect } from "react";
 import { Session } from "@/app/_types";
-import { getUsername } from "@/app/_server/actions/users";
 import { useTranslations } from 'next-intl';
 import {
-  getSessionsForUser,
-  SessionData,
-  getSessionId,
+  getMySessions,
   terminateSession,
   terminateAllOtherSessions,
 } from "@/app/_server/actions/session";
@@ -30,18 +27,8 @@ export const useSessionManager = () => {
   const loadSessions = useCallback(async () => {
     setStatus({ isLoading: true, error: null, success: null });
     try {
-      const username = await getUsername();
-      const sessionId = await getSessionId();
-      if (!username) throw new Error("Not authenticated");
-      const result = await getSessionsForUser(username);
-      const updatedSessions = result?.map((session: SessionData) => {
-        return {
-          ...session,
-          isCurrent: session.id === sessionId,
-        };
-      });
-
-      if (result) setSessions(updatedSessions);
+      const result = await getMySessions();
+      if (result) setSessions(result);
       else throw new Error("Failed to load sessions");
     } catch (err) {
       setStatus((prev) => ({
diff --git a/app/_hooks/useSharingTools.ts b/app/_hooks/useSharingTools.ts
index 3f9b73fe9..52020aa37 100644
--- a/app/_hooks/useSharingTools.ts
+++ b/app/_hooks/useSharingTools.ts
@@ -11,7 +11,7 @@ import {
   optOutItem,
   inheritItem,
 } from "../_server/actions/share/operations";
-import { itemShares } from "../_server/actions/share/queries";
+import { itemShares } from "../_server/actions/share/lookups";
 import { modeFor } from "@/app/_utils/sharing-utils";
 import { SharingPermissions } from "@/app/_types";
 import { getUsername } from "../_server/actions/users";
diff --git a/app/_schemas/api/admin.ts b/app/_schemas/api/admin.ts
index 9f748f574..1f83ce734 100644
--- a/app/_schemas/api/admin.ts
+++ b/app/_schemas/api/admin.ts
@@ -21,7 +21,14 @@ const clashUser = z
   .optional()
   .describe("Whose files to check, yours when left out. Naming somebody else needs an admin allowed to see other users' content");
 
-export const clashQuery = z.object({ username: clashUser });
+export const clashQuery = z.object({
+  username: clashUser,
+  acrossUsers: z
+    .enum(["true", "false"])
+    .optional()
+    .transform((value) => value === "true")
+    .describe("Report uuids shared by files of different users instead. Needs an admin allowed to see other users' content"),
+});
 
 const clashFileSchema = z.object({
   type: z.enum(ItemTypes),
@@ -29,6 +36,7 @@ const clashFileSchema = z.object({
   title: z.string(),
   createdAt: z.string().optional().describe("From frontmatter. A file without one counts as the newest"),
   keeps: z.boolean().describe("True for the file that owns the uuid now. Gets, links and the brain all open this one"),
+  owner: z.string().optional().describe("Whose folder the file is in. Only set with acrossUsers"),
 });
 
 export const clashListSchema = z.object({
@@ -37,6 +45,7 @@ export const clashListSchema = z.object({
       .object({
         uuid: z.string(),
         owner: z.string(),
+        owners: z.array(z.string()).optional().describe("Every user holding the uuid. Only set with acrossUsers"),
         files: z.array(clashFileSchema).describe("Oldest createdAt first, the first one keeps the uuid"),
       })
       .register(apiNames, { id: "DuplicateUuid" }),
diff --git a/app/_schemas/api/logs.ts b/app/_schemas/api/logs.ts
index 8ae467de7..7e378afc2 100644
--- a/app/_schemas/api/logs.ts
+++ b/app/_schemas/api/logs.ts
@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { apiNames } from "@/app/_schemas/api/names";
 import { AUDIT_CATEGORIES, AUDIT_LOG_LEVELS } from "@/app/_types/audit";
-import { LOG_WINDOW_DAYS } from "@/app/_consts/logs";
+import { DAY_MS, LOG_MAX_RANGE_DAYS, LOG_WINDOW_DAYS } from "@/app/_consts/logs";
 import { timestamp } from "./common";
 import { validateNoPathTraversal } from "@/app/_utils/path-utils";
 
@@ -20,6 +20,46 @@ const DEFAULT_LIMIT = 50;
 export const auditLevelSchema = z.enum(AUDIT_LOG_LEVELS);
 export const auditCategorySchema = z.enum(AUDIT_CATEGORIES);
 
+const ISO_DATE = /^(\d{4})-(\d{2})-(\d{2})(T\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?(Z|[+-]\d{2}:?\d{2})?)?$/;
+
+const isIsoDate = (value: string): boolean => {
+  const match = ISO_DATE.exec(value);
+  if (!match || Number.isNaN(Date.parse(value))) return false;
+
+  const [year, month, day] = [Number(match[1]), Number(match[2]), Number(match[3])];
+  const calendar = new Date(0);
+  calendar.setUTCFullYear(year, month - 1, day);
+  return (
+    year >= 1 &&
+    calendar.getUTCFullYear() === year &&
+    calendar.getUTCMonth() === month - 1 &&
+    calendar.getUTCDate() === day
+  );
+};
+
+const isoDate = (label: string) =>
+  z.string().refine(isIsoDate, "Must be an ISO 8601 date, such as 2024-05-01 or 2024-05-01T09:30:00Z").optional().describe(label);
+
+const _checkWindow = (
+  { startDate, endDate }: { startDate?: string; endDate?: string },
+  ctx: z.RefinementCtx,
+) => {
+  if ((startDate && !isIsoDate(startDate)) || (endDate && !isIsoDate(endDate))) return;
+
+  const end = endDate ? Date.parse(endDate) : Date.now();
+  const start = startDate ? Date.parse(startDate) : end - LOG_WINDOW_DAYS * DAY_MS;
+
+  if (start > end) {
+    ctx.addIssue({ code: "custom", path: ["startDate"], message: "startDate must not be after endDate" });
+  } else if (end - start > LOG_MAX_RANGE_DAYS * DAY_MS) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["startDate"],
+      message: `The date range can be at most ${LOG_MAX_RANGE_DAYS} days`,
+    });
+  }
+};
+
 const count = (fallback: number, label: string) =>
   z.coerce.number().int().min(0).default(fallback).describe(label);
 
@@ -32,8 +72,10 @@ const logFilterFields = {
   action: z.string().optional().describe("Action name, such as login or checklist_created"),
   category: auditCategorySchema.optional(),
   level: auditLevelSchema.optional(),
-  startDate: z.string().optional().describe(`ISO 8601 start of the range, defaults to ${LOG_WINDOW_DAYS} days before endDate`),
-  endDate: z.string().optional().describe("ISO 8601 end of the range, defaults to now"),
+  startDate: isoDate(
+    `ISO 8601 start of the range, defaults to ${LOG_WINDOW_DAYS} days before endDate. At most ${LOG_MAX_RANGE_DAYS} days before endDate`,
+  ),
+  endDate: isoDate("ISO 8601 end of the range, defaults to now"),
 };
 
 export const logListQuery = z.object({
@@ -45,7 +87,7 @@ export const logListQuery = z.object({
     .describe("Only entries that succeeded, or only ones that failed"),
   limit: count(DEFAULT_LIMIT, "How many entries to return"),
   offset: count(0, "How many entries to skip"),
-});
+}).superRefine(_checkWindow);
 
 export const logExportBody = z.object({
   format: z.enum(LogExportFormat, { error: "Invalid format. Must be 'json' or 'csv'" }),
@@ -55,6 +97,7 @@ export const logExportBody = z.object({
       success: z.boolean().optional(),
       limit: z.number().int().min(0).optional().describe("Most recent entries to keep, all when left out"),
     })
+    .superRefine(_checkWindow)
     .default({})
     .describe("The same filters as GET /logs"),
 });
diff --git a/app/_server/actions/api/authenticate.ts b/app/_server/actions/api/authenticate.ts
new file mode 100644
index 000000000..4dede739b
--- /dev/null
+++ b/app/_server/actions/api/authenticate.ts
@@ -0,0 +1,27 @@
+import { timingSafeEqual } from "crypto";
+import { USERS_FILE } from "@/app/_consts/files";
+import { readJsonFile } from "../file";
+import { User } from "@/app/_types";
+
+const _sameKey = (stored: string | undefined, given: string): boolean => {
+  if (!stored) return false;
+  const a = Buffer.from(stored);
+  const b = Buffer.from(given);
+  return a.length === b.length && timingSafeEqual(a, b);
+};
+
+export const authenticateApiKey = async (
+  apiKey: string
+): Promise<User | null> => {
+  try {
+    if (!apiKey) {
+      return null;
+    }
+
+    const users: User[] = await readJsonFile(USERS_FILE);
+    return users.find((u) => _sameKey(u.apiKey, apiKey)) || null;
+  } catch (error) {
+    console.error("Error authenticating API key:", error);
+    return null;
+  }
+};
diff --git a/app/_server/actions/api/index.ts b/app/_server/actions/api/index.ts
index 2cf14cc4c..82a6f6187 100644
--- a/app/_server/actions/api/index.ts
+++ b/app/_server/actions/api/index.ts
@@ -1,8 +1,6 @@
 "use server";
 
-import { randomBytes, timingSafeEqual } from "crypto";
-import { USERS_FILE } from "@/app/_consts/files";
-import { readJsonFile } from "../file";
+import { randomBytes } from "crypto";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { getCurrentUserRecord, mutateUsers } from "@/app/_server/actions/users/records";
 import { Result, User } from "@/app/_types";
@@ -10,13 +8,6 @@ import { Result, User } from "@/app/_types";
 const API_KEY_PREFIX = "ck_";
 const API_KEY_BYTES = 16;
 
-const _sameKey = (stored: string | undefined, given: string): boolean => {
-  if (!stored) return false;
-  const a = Buffer.from(stored);
-  const b = Buffer.from(given);
-  return a.length === b.length && timingSafeEqual(a, b);
-};
-
 export const generateApiKey = async (): Promise<Result<string>> => {
   try {
     const currentUser = await getCurrentUser();
@@ -62,19 +53,3 @@ export const getApiKey = async (): Promise<Result<string | null>> => {
     return { success: false, error: "Failed to get API key" };
   }
 };
-
-export const authenticateApiKey = async (
-  apiKey: string
-): Promise<User | null> => {
-  try {
-    if (!apiKey) {
-      return null;
-    }
-
-    const users: User[] = await readJsonFile(USERS_FILE);
-    return users.find((u) => _sameKey(u.apiKey, apiKey)) || null;
-  } catch (error) {
-    console.error("Error authenticating API key:", error);
-    return null;
-  }
-};
diff --git a/app/_server/actions/auth/index.ts b/app/_server/actions/auth/index.ts
index 6b2b96b37..defe0b7f1 100644
--- a/app/_server/actions/auth/index.ts
+++ b/app/_server/actions/auth/index.ts
@@ -11,7 +11,7 @@ import {
   readSessions,
   removeSession,
   swapSession,
-} from "../session";
+} from "../session/store";
 import {
   ensureCorDirsAndFiles,
   ensureDir,
@@ -22,7 +22,8 @@ import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
 import fs from "fs/promises";
 import { CHECKLISTS_DIR, NOTES_DIR, USERS_FILE } from "@/app/_consts/files";
 import { logAuthEvent } from "../log";
-import { getUsername, ensureUser } from "../users";
+import { getUsername } from "../users";
+import { ensureUser } from "../users/ensure-user";
 import {
   isSecureEnv,
   getAuthMode,
@@ -30,6 +31,7 @@ import {
   getMfaPendingCookieName,
 } from "@/app/_utils/env-utils";
 import { ldapLogin } from "./ldap";
+import { decryptMfaSecret } from "../mfa/secret";
 
 interface User {
   username: string;
@@ -377,7 +379,6 @@ export const verifyMfaLogin = async (formData: FormData) => {
       return { error: "MFA not properly configured" };
     }
 
-    const { decryptMfaSecret } = require("@/app/_server/actions/mfa");
     const decryptedSecret = await decryptMfaSecret(user.mfaSecret, username);
 
     isValid = speakeasy.totp.verify({
diff --git a/app/_server/actions/category/crud.ts b/app/_server/actions/category/crud.ts
index f36421e87..44f872872 100644
--- a/app/_server/actions/category/crud.ts
+++ b/app/_server/actions/category/crud.ts
@@ -331,7 +331,7 @@ export const renameCategory = async (formData: FormData) => {
     const username = await getUsername();
     if (mode === Modes.NOTES && username) {
       const { commitCategoryRename } =
-        await import("@/app/_server/actions/history");
+        await import("@/app/_server/actions/history/repo");
       await commitCategoryRename(username, oldPath, newPath);
     }
 
diff --git a/app/_server/actions/category/move.ts b/app/_server/actions/category/move.ts
index d2a2c8407..8c43872b8 100644
--- a/app/_server/actions/category/move.ts
+++ b/app/_server/actions/category/move.ts
@@ -410,7 +410,7 @@ export const moveNode = async (formData: FormData) => {
 
       if (activeType === "item" && mode === Modes.NOTES) {
         try {
-          const { commitNote } = await import("@/app/_server/actions/history");
+          const { commitNote } = await import("@/app/_server/actions/history/repo");
           const fileContent = await fs.readFile(newPath, "utf-8");
           const titleMatch = fileContent.match(/^title:\s*(.+)$/m);
           const title = titleMatch ? titleMatch[1] : activeName;
diff --git a/app/_server/actions/category/queries.ts b/app/_server/actions/category/queries.ts
index 7f2366fc2..b4bb772f2 100644
--- a/app/_server/actions/category/queries.ts
+++ b/app/_server/actions/category/queries.ts
@@ -1,134 +1,14 @@
 "use server";
 
-import path from "path";
-import {
-  ensureDir,
-  getUserModeDir,
-  readOrderFile,
-  serverReadDir,
-} from "@/app/_server/actions/file";
 import { Modes } from "@/app/_types/enums";
-import { Category } from "@/app/_types";
-import { SharedMount } from "@/app/_types/sharing";
-import { buildCategoryTree } from "@/app/_utils/category-utils";
 import { getUsername } from "@/app/_server/actions/users";
-import { mountsFor, userDirFor } from "@/app/_server/actions/share/mounts";
-import { catAccess } from "@/app/_server/actions/share/access";
+import { categoriesFor } from "./tree";
 
-const _mdCount = async (dir: string): Promise<number> => {
-  try {
-    const entries = await serverReadDir(dir);
-    return entries.filter((e) => e.isFile() && e.name.endsWith(".md")).length;
-  } catch (error) {
-    console.warn("Could not count items in shared folder:", dir, error);
-    return 0;
-  }
-};
-
-const _mountTree = async (
+export const getCategories = async (
   mode: Modes,
-  username: string,
-  mount: SharedMount,
-): Promise<Category[]> => {
-  if (mount.isImplicit) {
-    return [
-      {
-        name: mount.displayName,
-        count: mount.itemUuids?.length || 0,
-        path: mount.displayName,
-        level: 0,
-        uuid: mount.categoryUuid,
-        sharedFrom: mount.owner,
-        permissions: mount.permissions,
-        isLoose: true,
-      },
-    ];
-  }
-
-  const ownerDir = path.join(
-    process.cwd(),
-    userDirFor(mode, mount.owner),
-    mount.categoryPath,
-  );
-
-  const root: Category = {
-    name: mount.displayName,
-    count: await _mdCount(ownerDir),
-    path: mount.displayName,
-    level: 0,
-    uuid: mount.categoryUuid,
-    sharedFrom: mount.owner,
-    permissions: mount.permissions,
-  };
-
-  const subTree = await buildCategoryTree(ownerDir, mount.displayName, 1);
-
-  const granted = await Promise.all(
-    subTree.map(async (category) => {
-      const relative = category.path.slice(mount.displayName.length + 1);
-      const access = await catAccess(mode, path.join(ownerDir, relative));
-
-      return access?.users[username];
-    }),
-  );
-
-  const visible = subTree
-    .map((category, index) => ({ category, perms: granted[index] }))
-    .filter(({ perms }) => Boolean(perms))
-    .map(({ category, perms }) => ({
-      ...category,
-      sharedFrom: mount.owner,
-      permissions: perms,
-    }));
-
-  return [root, ...visible];
-};
-
-const _rootOf = (category: Category): string => category.path.split("/")[0];
-
-const _ordered = (groups: Map<string, Category[]>, uuids?: string[]) => {
-  const roots = Array.from(groups.keys());
-  const ranked = (uuids || [])
-    .map((uuid) =>
-      roots.find((root) => groups.get(root)?.[0]?.uuid === uuid),
-    )
-    .filter((root): root is string => Boolean(root));
-
-  const rest = roots.filter((root) => !ranked.includes(root));
-
-  return [...ranked, ...rest].flatMap((root) => groups.get(root) || []);
-};
-
-export const getCategories = async (mode: Modes, username?: string) => {
-  try {
-    const dir = await getUserModeDir(mode, username);
-    await ensureDir(dir);
-
-    const categories = await buildCategoryTree(dir);
-    const viewer = username || (await getUsername());
-
-    if (!viewer) {
-      return { success: true, data: categories };
-    }
-
-    const mounts = await mountsFor(mode, viewer);
-
-    for (const mount of mounts) {
-      categories.push(...(await _mountTree(mode, viewer, mount)));
-    }
-
-    const groups = new Map<string, Category[]>();
-
-    categories.forEach((category) => {
-      const root = _rootOf(category);
-      groups.set(root, [...(groups.get(root) || []), category]);
-    });
-
-    const order = await readOrderFile(dir);
+): Promise<Awaited<ReturnType<typeof categoriesFor>>> => {
+  const username = await getUsername();
+  if (!username) return { error: "Failed to fetch document categories" };
 
-    return { success: true, data: _ordered(groups, order?.categories) };
-  } catch (error) {
-    console.error("Error in getCategories:", error);
-    return { error: "Failed to fetch document categories" };
-  }
+  return categoriesFor(mode, username);
 };
diff --git a/app/_server/actions/category/tree.ts b/app/_server/actions/category/tree.ts
new file mode 100644
index 000000000..d2cf6d016
--- /dev/null
+++ b/app/_server/actions/category/tree.ts
@@ -0,0 +1,132 @@
+import path from "path";
+import {
+  ensureDir,
+  getUserModeDir,
+  readOrderFile,
+  serverReadDir,
+} from "@/app/_server/actions/file";
+import { Modes } from "@/app/_types/enums";
+import { Category } from "@/app/_types";
+import { SharedMount } from "@/app/_types/sharing";
+import { buildCategoryTree } from "@/app/_utils/category-utils";
+import { getUsername } from "@/app/_server/actions/users";
+import { mountsFor, userDirFor } from "@/app/_server/actions/share/mounts";
+import { catAccess } from "@/app/_server/actions/share/access";
+
+const _mdCount = async (dir: string): Promise<number> => {
+  try {
+    const entries = await serverReadDir(dir);
+    return entries.filter((e) => e.isFile() && e.name.endsWith(".md")).length;
+  } catch (error) {
+    console.warn("Could not count items in shared folder:", dir, error);
+    return 0;
+  }
+};
+
+const _mountTree = async (
+  mode: Modes,
+  username: string,
+  mount: SharedMount,
+): Promise<Category[]> => {
+  if (mount.isImplicit) {
+    return [
+      {
+        name: mount.displayName,
+        count: mount.itemUuids?.length || 0,
+        path: mount.displayName,
+        level: 0,
+        uuid: mount.categoryUuid,
+        sharedFrom: mount.owner,
+        permissions: mount.permissions,
+        isLoose: true,
+      },
+    ];
+  }
+
+  const ownerDir = path.join(
+    process.cwd(),
+    userDirFor(mode, mount.owner),
+    mount.categoryPath,
+  );
+
+  const root: Category = {
+    name: mount.displayName,
+    count: await _mdCount(ownerDir),
+    path: mount.displayName,
+    level: 0,
+    uuid: mount.categoryUuid,
+    sharedFrom: mount.owner,
+    permissions: mount.permissions,
+  };
+
+  const subTree = await buildCategoryTree(ownerDir, mount.displayName, 1);
+
+  const granted = await Promise.all(
+    subTree.map(async (category) => {
+      const relative = category.path.slice(mount.displayName.length + 1);
+      const access = await catAccess(mode, path.join(ownerDir, relative));
+
+      return access?.users[username];
+    }),
+  );
+
+  const visible = subTree
+    .map((category, index) => ({ category, perms: granted[index] }))
+    .filter(({ perms }) => Boolean(perms))
+    .map(({ category, perms }) => ({
+      ...category,
+      sharedFrom: mount.owner,
+      permissions: perms,
+    }));
+
+  return [root, ...visible];
+};
+
+const _rootOf = (category: Category): string => category.path.split("/")[0];
+
+const _ordered = (groups: Map<string, Category[]>, uuids?: string[]) => {
+  const roots = Array.from(groups.keys());
+  const ranked = (uuids || [])
+    .map((uuid) =>
+      roots.find((root) => groups.get(root)?.[0]?.uuid === uuid),
+    )
+    .filter((root): root is string => Boolean(root));
+
+  const rest = roots.filter((root) => !ranked.includes(root));
+
+  return [...ranked, ...rest].flatMap((root) => groups.get(root) || []);
+};
+
+export const categoriesFor = async (mode: Modes, username?: string) => {
+  try {
+    const dir = await getUserModeDir(mode, username);
+    await ensureDir(dir);
+
+    const categories = await buildCategoryTree(dir);
+    const viewer = username || (await getUsername());
+
+    if (!viewer) {
+      return { success: true, data: categories };
+    }
+
+    const mounts = await mountsFor(mode, viewer);
+
+    for (const mount of mounts) {
+      categories.push(...(await _mountTree(mode, viewer, mount)));
+    }
+
+    const groups = new Map<string, Category[]>();
+
+    categories.forEach((category) => {
+      const root = _rootOf(category);
+      groups.set(root, [...(groups.get(root) || []), category]);
+    });
+
+    const order = await readOrderFile(dir);
+
+    return { success: true, data: _ordered(groups, order?.categories) };
+  } catch (error) {
+    console.error("Error in getCategories:", error);
+    return { error: "Failed to fetch document categories" };
+  }
+};
diff --git a/app/_server/actions/checklist/converters.ts b/app/_server/actions/checklist/converters.ts
index 47ec29eec..68e24f04b 100644
--- a/app/_server/actions/checklist/converters.ts
+++ b/app/_server/actions/checklist/converters.ts
@@ -1,25 +1,21 @@
 "use server";
 
-import path from "path";
 import { Checklist, Item, ChecklistType, KanbanStatus, Result } from "@/app/_types";
-import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
 import {
   ItemTypes,
-  Modes,
   PermissionTypes,
   TaskStatus,
   isKanbanType,
 } from "@/app/_types/enums";
 import { getCurrentUser } from "@/app/_server/actions/users";
-import { getUserModeDir, serverWriteFile } from "@/app/_server/actions/file";
+import { serverWriteFile } from "@/app/_server/actions/file";
 import { revalidatePath } from "next/cache";
 import { listToMarkdown } from "@/app/_utils/checklist-utils";
 import { getFormData } from "@/app/_utils/global-utils";
-import { UNCATEGORIZED } from "@/app/_consts/notes";
-import { canReach } from "@/app/_server/actions/share/queries";
+import { reachableFile } from "@/app/_server/actions/share/queries";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { sessionActor } from "@/app/_server/actions/lib/actor";
-import { getListById, getUserChecklists } from "./queries";
+import { getListById } from "./queries";
 import { restatus } from "./restatus";
 
 export const convertChecklistType = async (formData: FormData) => {
@@ -31,17 +27,18 @@ export const convertChecklistType = async (formData: FormData) => {
       return { error: "UUID and type are required" };
     }
 
-    let list = await getListById(uuid);
-
-    if (!list) {
-      const lists = await getUserChecklists();
+    const actor = await sessionActor();
+    if ("error" in actor) return { error: actor.error };
 
-      if (!lists.success || !lists.data) {
-        throw new Error(lists.error || "Failed to fetch lists");
-      }
+    const filePath = await reachableFile(
+      uuid,
+      ItemTypes.CHECKLIST,
+      actor.username,
+      PermissionTypes.EDIT,
+    );
+    if (!filePath) return { error: "Permission denied" };
 
-      list = lists.data.find((l) => l.uuid === uuid) as Checklist;
-    }
+    const list = await getListById(uuid, actor.username);
 
     if (!list || !list.id || !list.createdAt) {
       throw new Error("List not found or is malformed");
@@ -51,23 +48,6 @@ export const convertChecklistType = async (formData: FormData) => {
       return { success: true };
     }
 
-    let filePath: string;
-    const categoryDir = list.category || UNCATEGORIZED;
-    const filename = `${list.id}.md`;
-
-    if (list.owner) {
-      const ownerDir = path.join(
-        process.cwd(),
-        "data",
-        CHECKLISTS_FOLDER,
-        list.owner,
-      );
-      filePath = path.join(ownerDir, categoryDir, filename);
-    } else {
-      const userDir = await getUserModeDir(Modes.CHECKLISTS);
-      filePath = path.join(userDir, categoryDir, filename);
-    }
-
     let convertedItems: any[];
 
     if (isKanbanType(newType)) {
@@ -132,12 +112,11 @@ export const convertChecklistType = async (formData: FormData) => {
         error,
       );
     }
-    const currentUser = await getCurrentUser();
     await broadcast({
       type: "checklist",
       action: "updated",
       entityId: updatedList.uuid,
-      username: currentUser?.username || "",
+      username: actor.username,
     });
     return { success: true, data: updatedList };
   } catch (error) {
@@ -175,7 +154,6 @@ export const updateChecklistStatuses = async (
 export const clearAllChecklistItems = async (formData: FormData) => {
   try {
     const uuid = formData.get("uuid") as string;
-    const ownerUsername = formData.get("user") as string | null;
     const type = formData.get("type") as "completed" | "incomplete";
 
     const actingUser = await getCurrentUser();
@@ -184,23 +162,23 @@ export const clearAllChecklistItems = async (formData: FormData) => {
       return { error: "Not authenticated" };
     }
 
-    const checklist = await getListById(uuid, ownerUsername || undefined);
-
-    if (!checklist) {
-      return { error: "Checklist not found" };
-    }
-
-    const canEdit = await canReach(
-      checklist.uuid!,
+    const filePath = await reachableFile(
+      uuid,
       ItemTypes.CHECKLIST,
       actingUser.username,
       PermissionTypes.EDIT,
     );
 
-    if (!canEdit) {
+    if (!filePath) {
       return { error: "Permission denied" };
     }
 
+    const checklist = await getListById(uuid);
+
+    if (!checklist) {
+      return { error: "Checklist not found" };
+    }
+
     const filteredItems = checklist.items.filter((item) => {
       if (type === "completed") {
         return !item.completed;
@@ -215,18 +193,6 @@ export const clearAllChecklistItems = async (formData: FormData) => {
       updatedAt: new Date().toISOString(),
     };
 
-    const ownerDir = path.join(
-      process.cwd(),
-      "data",
-      CHECKLISTS_FOLDER,
-      checklist.owner!,
-    );
-    const categoryDir = path.join(
-      ownerDir,
-      checklist.category || UNCATEGORIZED,
-    );
-    const filePath = path.join(categoryDir, `${checklist.id}.md`);
-
     await serverWriteFile(filePath, listToMarkdown(updatedChecklist));
 
     try {
diff --git a/app/_server/actions/checklist/creator.ts b/app/_server/actions/checklist/creator.ts
index 8731aef29..0d67151e7 100644
--- a/app/_server/actions/checklist/creator.ts
+++ b/app/_server/actions/checklist/creator.ts
@@ -11,6 +11,7 @@ import { logContentEvent } from "@/app/_server/actions/log";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { getFormData } from "@/app/_utils/global-utils";
 import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import { fenceFilename } from "@/app/_server/actions/lib/filename-fence";
 
 /**
  * Server-only checklist creation. The acting principal is passed in already
@@ -48,6 +49,11 @@ export const makeList = async (
       ".md",
       fileRenameMode,
     );
+    const straying = await fenceFilename(categoryDir, filename);
+    if (straying) {
+      return { error: straying };
+    }
+
     const id = path.basename(filename, ".md");
     const filePath = path.join(categoryDir, filename);
 
diff --git a/app/_server/actions/checklist/crud.ts b/app/_server/actions/checklist/crud.ts
index 0c61355e7..4bbb6e495 100644
--- a/app/_server/actions/checklist/crud.ts
+++ b/app/_server/actions/checklist/crud.ts
@@ -17,6 +17,7 @@ import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { claimedName } from "@/app/_server/actions/lib/actor";
 import { makeList } from "./creator";
 import { dropList, editList } from "./editor";
+import { fenceFilename } from "@/app/_server/actions/lib/filename-fence";
 
 export const createList = async (formData: FormData) => {
   const actor = await getCurrentUser();
@@ -43,19 +44,17 @@ export const cloneChecklist = async (formData: FormData) => {
   try {
     const uuid = formData.get("uuid") as string;
     const targetCategory = formData.get("category") as string;
-    const ownerUsername = formData.get("user") as string | null;
-
-    const checklist = await getListById(uuid, ownerUsername || undefined);
-    if (!checklist) {
-      return { error: "Checklist not found" };
-    }
-
     const currentUser = await getCurrentUser();
 
     if (!currentUser?.username) {
       return { error: "Not authenticated" };
     }
 
+    const checklist = await getListById(uuid);
+    if (!checklist) {
+      return { error: "Checklist not found" };
+    }
+
     const canReadSource = await canReach(
       checklist.uuid,
       ItemTypes.CHECKLIST,
@@ -100,6 +99,11 @@ export const cloneChecklist = async (formData: FormData) => {
       ".md",
       fileRenameMode
     );
+    const straying = await fenceFilename(categoryDir, filename);
+    if (straying) {
+      return { error: straying };
+    }
+
     const filePath = path.join(categoryDir, filename);
 
     const cloneUuid = generateUuid();
diff --git a/app/_server/actions/checklist/editor.ts b/app/_server/actions/checklist/editor.ts
index 3402122a0..85b0df4d2 100644
--- a/app/_server/actions/checklist/editor.ts
+++ b/app/_server/actions/checklist/editor.ts
@@ -29,6 +29,7 @@ import {
 } from "@/app/_server/actions/lib/read-only-message";
 import { isWritable } from "@/app/_server/actions/lib/read-only";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { fenceFilename } from "@/app/_server/actions/lib/filename-fence";
 
 const _listDirFor = (owner: string, category?: string): string =>
   path.join(
@@ -145,6 +146,11 @@ const _editList = async (actingUser: SanitisedUser, formData: FormData) => {
       updatedList.id = newId;
     }
 
+    const straying = await fenceFilename(categoryDir, newFilename);
+    if (straying) {
+      return { error: straying };
+    }
+
     const filePath = path.join(categoryDir, newFilename);
 
     const oldFilePath =
diff --git a/app/_server/actions/checklist/index.ts b/app/_server/actions/checklist/index.ts
index e1d78a378..f4f263f51 100644
--- a/app/_server/actions/checklist/index.ts
+++ b/app/_server/actions/checklist/index.ts
@@ -1,4 +1,3 @@
-export { readListsRecursively } from "./readers";
 export { viewList, getChecklistsForDisplay } from "./viewer";
 export { createList, updateList, deleteList, cloneChecklist } from "./crud";
 export {
diff --git a/app/_server/actions/checklist/readers.ts b/app/_server/actions/checklist/readers.ts
index f5cc5fe42..2d7b113a3 100644
--- a/app/_server/actions/checklist/readers.ts
+++ b/app/_server/actions/checklist/readers.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import path from "path";
 import fs from "fs/promises";
 import { boxedShell } from "@/app/_utils/shell-utils";
diff --git a/app/_server/actions/config/helpers.ts b/app/_server/actions/config/helpers.ts
index 73d194771..d6a787643 100644
--- a/app/_server/actions/config/helpers.ts
+++ b/app/_server/actions/config/helpers.ts
@@ -6,7 +6,8 @@ import { Result } from "@/app/_types";
 import { getCurrentUser } from "../users";
 import { getListById } from "../checklist/queries";
 import { Metadata } from "next";
-import { Modes } from "@/app/_types/enums";
+import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import { canReach, isPublicItem } from "../share/queries";
 import { getNoteById } from "../note/queries";
 import { getSettings } from "./settings";
 
@@ -21,8 +22,15 @@ export const getMedatadaTitle = async (
   const ogName = settings?.isRwMarkable ? "rwMarkable" : "jotty·page";
   const appName = settings?.appName || ogName;
 
-  const item =
-    appMode === Modes.CHECKLISTS
+  const itemType = appMode === Modes.CHECKLISTS ? ItemTypes.CHECKLIST : ItemTypes.NOTE;
+  const visible =
+    (await isPublicItem(uuid, itemType)) ||
+    (!!user?.username &&
+      (await canReach(uuid, itemType, user.username, PermissionTypes.READ)));
+
+  const item = !visible
+    ? null
+    : appMode === Modes.CHECKLISTS
       ? await getListById(uuid)
       : await getNoteById(uuid);
 
diff --git a/app/_server/actions/dashboard/index.ts b/app/_server/actions/dashboard/index.ts
index 55120b9ff..7afaec99b 100644
--- a/app/_server/actions/dashboard/index.ts
+++ b/app/_server/actions/dashboard/index.ts
@@ -5,7 +5,8 @@ import { ItemTypes, Modes } from "@/app/_types/enums";
 import { updateList } from "../checklist";
 import { updateNote } from "../note";
 import { getNoteById } from "../note/queries";
-import { getCurrentUser, getUserIndex } from "../users";
+import { getCurrentUser } from "../users";
+import { getUserIndex } from "../users/helpers";
 import { readJsonFile, writeJsonFile } from "../file";
 import { ARCHIVED_DIR_NAME, USERS_FILE } from "@/app/_consts/files";
 import { isPinnedEntry } from "@/app/_utils/global-utils";
@@ -102,7 +103,7 @@ export const toggleArchive = async (
     const noteItem = item as Note;
     let content = noteItem.content;
     if (content === undefined || content === null) {
-      const fullNote = await getNoteById(noteItem.uuid!, noteItem.owner);
+      const fullNote = await getNoteById(noteItem.uuid!);
       content = fullNote?.content || "";
     }
     formData.append("content", content);
diff --git a/app/_server/actions/export/builders.ts b/app/_server/actions/export/builders.ts
index de3b3e36c..5675c3b1c 100644
--- a/app/_server/actions/export/builders.ts
+++ b/app/_server/actions/export/builders.ts
@@ -10,6 +10,7 @@ import { readJsonFile, ensureDir } from "@/app/_server/actions/file";
 import { User } from "@/app/_types";
 import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
 import { NOTES_FOLDER } from "@/app/_consts/notes";
+import { exportName, exportableUser } from "./naming";
 
 let exportProgress: ExportProgress = {
   progress: 0,
@@ -75,7 +76,7 @@ export const buildAllContent = async (): Promise<ExportResult> => {
     const tempExportPath = path.join(
       process.cwd(),
       EXPORT_TEMP_DIR,
-      `all_checklists_notes_${Date.now()}.zip`,
+      exportName("all_checklists_notes"),
     );
     const tempContentDir = path.join(
       process.cwd(),
@@ -143,6 +144,10 @@ export const buildAllContent = async (): Promise<ExportResult> => {
 export const buildUserContent = async (
   username: string,
 ): Promise<ExportResult> => {
+  if (!(await exportableUser(username))) {
+    return { success: false, error: "User not found" };
+  }
+
   updateProgress(
     0,
     `Preparing ${username}'s checklists and notes for export...`,
@@ -151,7 +156,7 @@ export const buildUserContent = async (
     const tempExportPath = path.join(
       process.cwd(),
       EXPORT_TEMP_DIR,
-      `${username}_content_${Date.now()}.zip`,
+      exportName(`${username}_content`),
     );
     const tempUserContentDir = path.join(
       process.cwd(),
@@ -228,7 +233,7 @@ export const buildAllUsers = async (): Promise<ExportResult> => {
     const tempExportPath = path.join(
       process.cwd(),
       EXPORT_TEMP_DIR,
-      `all_users_data_${Date.now()}.zip`,
+      exportName("all_users_data"),
     );
     const tempUserDir = path.join(
       process.cwd(),
@@ -270,7 +275,7 @@ export const buildWholeData = async (): Promise<ExportResult> => {
     const tempExportPath = path.join(
       process.cwd(),
       EXPORT_TEMP_DIR,
-      `whole_data_folder_${Date.now()}.zip`,
+      exportName("whole_data_folder"),
     );
 
     await ensureDir(path.join(process.cwd(), EXPORT_TEMP_DIR));
diff --git a/app/_server/actions/export/index.ts b/app/_server/actions/export/index.ts
index 2ea8a8117..69f4d7221 100644
--- a/app/_server/actions/export/index.ts
+++ b/app/_server/actions/export/index.ts
@@ -19,7 +19,8 @@ const OWN_ONLY = "Forbidden: You can only export your own data";
 const _asAdmin = async (build: () => Promise<ExportResult>): Promise<ExportResult> =>
   (await canAccessAllContent()) ? build() : { success: false, error: ADMIN_ONLY };
 
-export const getExportProgress = async (): Promise<ExportProgress> => readExportProgress();
+export const getExportProgress = async (): Promise<ExportProgress> =>
+  (await getCurrentUser()) ? readExportProgress() : { progress: 0, message: "" };
 
 export const exportAllChecklistsNotes = async (): Promise<ExportResult> =>
   _asAdmin(buildAllContent);
diff --git a/app/_server/actions/export/naming.ts b/app/_server/actions/export/naming.ts
new file mode 100644
index 000000000..93d78a3e1
--- /dev/null
+++ b/app/_server/actions/export/naming.ts
@@ -0,0 +1,18 @@
+import path from "path";
+import { randomBytes } from "crypto";
+import { EXPORT_TEMP_DIR } from "@/app/_consts/files";
+import { findUserRecord } from "@/app/_server/actions/users/records";
+import { isPathSafe, validateNoPathTraversal } from "@/app/_utils/path-utils";
+
+export const EXPORT_TOKEN_BYTES = 16;
+export const SESSION_ONLY_EXPORT_PREFIXES = ["all_users_data_", "whole_data_folder_"];
+
+export const exportName = (prefix: string): string =>
+  `${prefix}_${Date.now()}_${randomBytes(EXPORT_TOKEN_BYTES).toString("hex")}.zip`;
+
+export const exportableUser = async (username: string): Promise<boolean> =>
+  Boolean(username) &&
+  validateNoPathTraversal(username) &&
+  !username.startsWith(".") &&
+  isPathSafe(path.join(process.cwd(), EXPORT_TEMP_DIR), username) &&
+  Boolean(await findUserRecord(username));
diff --git a/app/_server/actions/file/index.ts b/app/_server/actions/file/index.ts
index 114af6f82..391a03081 100644
--- a/app/_server/actions/file/index.ts
+++ b/app/_server/actions/file/index.ts
@@ -118,10 +118,14 @@ export const readFile = async (filePath: string): Promise<string> => {
 
 const getCwd = (): Promise<string> => Promise.resolve(process.cwd());
 
+const KNOWN_MODES = new Set<string>(Object.values(Modes));
+
 export const getUserModeDir = async (
   mode: Modes,
   username?: string,
 ): Promise<string> => {
+  if (!KNOWN_MODES.has(mode)) throw new Error(`Unknown mode: ${mode}`);
+
   const base = await getCwd();
   if (username) {
     return path.join(base, DATA_DIR, mode, username);
diff --git a/app/_server/actions/history/index.ts b/app/_server/actions/history/index.ts
index 08cab7cbc..d9f4d8f95 100644
--- a/app/_server/actions/history/index.ts
+++ b/app/_server/actions/history/index.ts
@@ -2,320 +2,52 @@
 
 import path from "path";
 import fs from "fs/promises";
-import simpleGit, { SimpleGit } from "simple-git";
-import { lock } from "proper-lockfile";
 import { NOTES_FOLDER } from "@/app/_consts/notes";
 import { getCurrentUser } from "@/app/_server/actions/users";
-import { canReach } from "@/app/_server/actions/share/queries";
-import { PermissionTypes } from "@/app/_types/enums";
-import { getSettings } from "@/app/_server/actions/config";
+import { reachableFile } from "@/app/_server/actions/share/queries";
+import { ItemTypes, PermissionTypes } from "@/app/_types/enums";
 import { USERS_FILE } from "@/app/_consts/files";
 import { readJsonFile } from "@/app/_server/actions/file";
-
-export interface HistoryEntry {
-  commitHash: string;
-  date: string;
-  message: string;
-  action: string;
-  title: string;
-}
-
-export interface HistoryVersion {
-  commitHash: string;
-  date: string;
-  content: string;
-  title: string;
-}
-
-interface HistoryResult<T> {
-  success: boolean;
-  data?: T;
-  error?: string;
-}
-
-type HistoryAction = "create" | "update" | "rename" | "move" | "delete";
-
-const LEGACY_LOCK_FILE = ".historylock";
-const LOCKS_DIR = ".locks";
-const LOCK_STALE_MS = 30000;
-const LOCK_RETRIES = {
-  retries: 5,
-  factor: 2,
-  minTimeout: 100,
-  maxTimeout: 2000,
-};
-
-const _turnstile = new Map<string, Promise<unknown>>();
-
-const USER_NOTES_DIR = (username: string) =>
-  path.join(process.cwd(), "data", NOTES_FOLDER, username);
-
-const LOCK_PATH = (username: string) =>
-  path.join(
-    process.cwd(),
-    "data",
-    LOCKS_DIR,
-    `history-${username.replace(/[^a-zA-Z0-9._-]/g, "_")}.lock`
-  );
-
-const GITIGNORE_CONTENT = `.index.json
-.order.json
-*.lock
-.historylock
-images/
-files/
-videos/
-*.tmp
-*.swp
-*~`;
-
-const _getGitInstance = (userDir: string): SimpleGit => {
-  return simpleGit(userDir, {
-    binary: "git",
-    maxConcurrentProcesses: 1,
-    trimmed: true,
-  });
-};
-
-const _sweepStale = async (lockPath: string): Promise<void> => {
-  const lockDir = `${lockPath}.lock`;
-
-  try {
-    const stats = await fs.stat(lockDir);
-    if (Date.now() - stats.mtimeMs < LOCK_STALE_MS * 2) return;
-    await fs.rm(lockDir, { recursive: true, force: true });
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException).code;
-    if (code !== "ENOENT") {
-      console.error("Failed to sweep stale history lock:", error);
-    }
-  }
-};
-
-const _dropLegacyLock = async (userDir: string): Promise<void> => {
-  const legacy = path.join(userDir, LEGACY_LOCK_FILE);
-
-  try {
-    await fs.rm(`${legacy}.lock`, { recursive: true, force: true });
-    await fs.rm(legacy, { force: true });
-  } catch (error) {
-    console.error("Failed to drop legacy history lock:", error);
-  }
-};
-
-const gatekeeper = async <T>(
-  username: string,
-  errand: () => Promise<T>
-): Promise<T> => {
-  const lockPath = LOCK_PATH(username);
-  const queued = _turnstile.get(username) ?? Promise.resolve();
-
-  const turn = queued.catch(() => { }).then(async () => {
-    await fs.mkdir(path.dirname(lockPath), { recursive: true });
-    await fs.writeFile(lockPath, "", { flag: "a" });
-    await _sweepStale(lockPath);
-
-    const release = await lock(lockPath, {
-      stale: LOCK_STALE_MS,
-      retries: LOCK_RETRIES,
-    });
-
-    try {
-      return await errand();
-    } finally {
-      try {
-        await release();
-      } catch (error) {
-        console.error("Failed to release history lock:", error);
-      }
-    }
-  });
-
-  _turnstile.set(username, turn.catch(() => { }));
-
-  return turn;
-};
-
-const _formatCommitMessage = (
-  action: HistoryAction,
-  noteTitle: string,
-  metadata?: { oldTitle?: string; oldCategory?: string; newCategory?: string }
-): string => {
-  switch (action) {
-    case "create":
-      return `[create] ${noteTitle}`;
-    case "update":
-      return `[update] ${noteTitle}`;
-    case "rename":
-      return `[rename] "${metadata?.oldTitle}" -> "${noteTitle}"`;
-    case "move":
-      return `[move] ${noteTitle}: ${metadata?.oldCategory} -> ${metadata?.newCategory}`;
-    case "delete":
-      return `[delete] ${noteTitle}`;
-    default:
-      return `[change] ${noteTitle}`;
-  }
-};
-
-const _parseCommitMessage = (
-  message: string
-): { action: string; title: string } => {
-  const match = message.match(/^\[(\w+)\]\s*(.*)$/);
-  if (match) {
-    return { action: match[1], title: match[2] };
-  }
-  return { action: "update", title: message };
-};
-
-const _isHistoryEnabled = async (): Promise<boolean> => {
-  try {
-    const settings = await getSettings();
-    return settings?.editor?.historyEnabled === true;
-  } catch {
-    return false;
-  }
-};
-
-export const ensureRepo = async (username: string): Promise<void> => {
-  const userDir = USER_NOTES_DIR(username);
-  const gitDir = path.join(userDir, ".git");
-
-  await _dropLegacyLock(userDir);
-
-  try {
-    await fs.access(gitDir);
-  } catch {
-    const git = _getGitInstance(userDir);
-    await git.init();
-
-    await git.addConfig("user.email", "history@local");
-    await git.addConfig("user.name", "History");
-
-    const gitignorePath = path.join(userDir, ".gitignore");
-    await fs.writeFile(gitignorePath, GITIGNORE_CONTENT);
-
-    await git.add(".gitignore");
-    await git.commit("[init] Initialize note history");
-  }
-};
-
-export const commitCategoryRename = async (
-  username: string,
-  oldPath: string,
-  newPath: string,
-): Promise<HistoryResult<string>> => {
-  const enabled = await _isHistoryEnabled();
-  if (!enabled) {
-    return { success: false };
-  }
-  const userDir = USER_NOTES_DIR(username);
-
-  try {
-    await fs.access(userDir);
-  } catch {
-    return { success: false, error: "User directory not found" };
-  }
-
-  await ensureRepo(username);
-
-  try {
-    return await gatekeeper(username, async () => {
-      const git = _getGitInstance(userDir);
-      const oldPathNorm = oldPath.replace(/\\/g, "/");
-      const newPathNorm = newPath.replace(/\\/g, "/");
-
-      await git.add(["-u", oldPathNorm]);
-      await git.add(newPathNorm);
-      await git.commit(`[move] Category: ${oldPathNorm} -> ${newPathNorm}`);
-
-      return { success: true };
-    });
-  } catch (error) {
-    console.error("Git category rename error:", error);
-    return { success: false, error: String(error) };
-  }
-};
-
-export const commitNote = async (
+import {
+  dropLegacyLock,
+  ensureRepo,
+  historyEnabled,
+  historyLockPath,
+  notesRepoDir,
+  parseCommit,
+  repoGit,
+} from "./repo";
+import type { HistoryEntry, HistoryResult, HistoryVersion } from "./repo";
+
+export type { HistoryEntry, HistoryVersion };
+
+const _ownerOf = (filePath: string): string =>
+  path
+    .relative(path.join(process.cwd(), "data", NOTES_FOLDER), filePath)
+    .split(path.sep)[0];
+
+const _readableNote = async (
+  noteUuid: string,
   username: string,
-  relativePath: string,
-  action: HistoryAction,
-  noteTitle: string,
-  metadata?: { oldTitle?: string; oldCategory?: string; newCategory?: string; oldPath?: string }
-): Promise<HistoryResult<string>> => {
-  const enabled = await _isHistoryEnabled();
-  if (!enabled) {
-    return { success: true };
-  }
-
-  const userDir = USER_NOTES_DIR(username);
-
-  try {
-    await fs.access(userDir);
-  } catch {
-    return { success: false, error: "User directory not found" };
-  }
-
-  await ensureRepo(username);
-
-  try {
-    return await gatekeeper(username, async () => {
-      const git = _getGitInstance(userDir);
-      const message = _formatCommitMessage(action, noteTitle, metadata);
-
-      const status = await git.status();
-      const normalizedPath = relativePath.replace(/\\/g, "/");
-
-      if (action === "delete") {
-        const hasDeletedFile = status.deleted.some(
-          (f) => f === normalizedPath || f.endsWith(path.basename(relativePath))
-        );
-        if (!hasDeletedFile) {
-          return { success: true };
-        }
-        await git.add(["-u", relativePath]);
-      } else if (action === "move" && metadata?.oldPath) {
-        const oldPathNormalized = metadata.oldPath.replace(/\\/g, "/");
-        const leftBehind = status.deleted.some(
-          (f) => f === oldPathNormalized || f === metadata.oldPath
-        );
-
-        if (leftBehind) {
-          await git.add(["-u", oldPathNormalized]);
-        }
-
-        await git.add(normalizedPath);
-      } else {
-        const hasChanges = status.files.some(
-          (f) =>
-            f.path === relativePath ||
-            f.path === normalizedPath ||
-            f.path.endsWith(path.basename(relativePath))
-        );
-
-        if (!hasChanges) {
-          return { success: true };
-        }
-
-        await git.add(relativePath);
-      }
+  permission: PermissionTypes,
+): Promise<string | null> => {
+  const filePath = await reachableFile(
+    noteUuid,
+    ItemTypes.NOTE,
+    username,
+    permission,
+  );
 
-      const result = await git.commit(message);
-      return { success: true, data: result.commit };
-    });
-  } catch (error) {
-    console.error("Git commit error:", error);
-    return { success: false, error: String(error) };
-  }
+  return filePath ? _ownerOf(filePath) : null;
 };
 
 export const getHistory = async (
   noteUuid: string,
-  noteOwner: string,
+  _noteOwner: string,
   page: number = 1,
   pageSize: number = 20
 ): Promise<HistoryResult<{ entries: HistoryEntry[]; hasMore: boolean }>> => {
-  const enabled = await _isHistoryEnabled();
+  const enabled = await historyEnabled();
   if (!enabled) {
     return { success: false, error: "History is not enabled" };
   }
@@ -325,23 +57,20 @@ export const getHistory = async (
     return { success: false, error: "Not authenticated" };
   }
 
-  const canRead = await canReach(
+  const username = await _readableNote(
     noteUuid,
-    "note",
     currentUser.username,
-    PermissionTypes.READ
+    PermissionTypes.READ,
   );
 
-  if (!canRead) {
+  if (!username) {
     return { success: false, error: "Permission denied" };
   }
-
-  const username = noteOwner || currentUser.username;
-  const userDir = USER_NOTES_DIR(username);
+  const userDir = notesRepoDir(username);
 
   try {
     await ensureRepo(username);
-    const git = _getGitInstance(userDir);
+    const git = repoGit(userDir);
 
     const { getNoteById } = await import("@/app/_server/actions/note/queries");
     const note = await getNoteById(noteUuid, username);
@@ -384,7 +113,7 @@ export const getHistory = async (
     const entries: HistoryEntry[] = parsedEntries
       .slice(0, pageSize)
       .map((entry) => {
-        const parsed = _parseCommitMessage(entry.message);
+        const parsed = parseCommit(entry.message);
         return {
           commitHash: entry.hash,
           date: entry.date,
@@ -402,10 +131,10 @@ export const getHistory = async (
 
 export const getVersion = async (
   noteUuid: string,
-  noteOwner: string,
+  _noteOwner: string,
   commitHash: string
 ): Promise<HistoryResult<HistoryVersion>> => {
-  const enabled = await _isHistoryEnabled();
+  const enabled = await historyEnabled();
   if (!enabled) {
     return { success: false, error: "History is not enabled" };
   }
@@ -419,22 +148,19 @@ export const getVersion = async (
     return { success: false, error: "Invalid commit hash" };
   }
 
-  const canRead = await canReach(
+  const username = await _readableNote(
     noteUuid,
-    "note",
     currentUser.username,
-    PermissionTypes.READ
+    PermissionTypes.READ,
   );
 
-  if (!canRead) {
+  if (!username) {
     return { success: false, error: "Permission denied" };
   }
-
-  const username = noteOwner || currentUser.username;
-  const userDir = USER_NOTES_DIR(username);
+  const userDir = notesRepoDir(username);
 
   try {
-    const git = _getGitInstance(userDir);
+    const git = repoGit(userDir);
 
     const { extractYamlMetadata } = await import(
       "@/app/_utils/yaml-metadata-utils"
@@ -522,10 +248,10 @@ export const getVersion = async (
 
 export const restoreNoteVersion = async (
   noteUuid: string,
-  noteOwner: string,
+  _noteOwner: string,
   commitHash: string
 ): Promise<HistoryResult<void>> => {
-  const enabled = await _isHistoryEnabled();
+  const enabled = await historyEnabled();
   if (!enabled) {
     return { success: false, error: "History is not enabled" };
   }
@@ -539,18 +265,17 @@ export const restoreNoteVersion = async (
     return { success: false, error: "Invalid commit hash" };
   }
 
-  const canEdit = await canReach(
+  const owner = await _readableNote(
     noteUuid,
-    "note",
     currentUser.username,
-    PermissionTypes.EDIT
+    PermissionTypes.EDIT,
   );
 
-  if (!canEdit) {
+  if (!owner) {
     return { success: false, error: "Permission denied" };
   }
 
-  const versionResult = await getVersion(noteUuid, noteOwner, commitHash);
+  const versionResult = await getVersion(noteUuid, owner, commitHash);
 
   if (!versionResult.success || !versionResult.data) {
     return { success: false, error: versionResult.error };
@@ -585,14 +310,14 @@ export const deleteAllRepos = async (): Promise<HistoryResult<void>> => {
     for (const user of users) {
       const userDir = path.join(dataDir, user.username);
       const userGitDir = path.join(userDir, ".git");
-      const userLockFile = LOCK_PATH(user.username);
+      const userLockFile = historyLockPath(user.username);
       const userGitignore = path.join(userDir, ".gitignore");
 
       try {
         await fs.rm(userGitDir, { recursive: true, force: true });
       } catch { }
 
-      await _dropLegacyLock(userDir);
+      await dropLegacyLock(userDir);
 
       try {
         await fs.rm(`${userLockFile}.lock`, { recursive: true, force: true });
diff --git a/app/_server/actions/history/repo.ts b/app/_server/actions/history/repo.ts
new file mode 100644
index 000000000..c092fe820
--- /dev/null
+++ b/app/_server/actions/history/repo.ts
@@ -0,0 +1,303 @@
+import path from "path";
+import fs from "fs/promises";
+import simpleGit, { SimpleGit } from "simple-git";
+import { lock } from "proper-lockfile";
+import { NOTES_FOLDER } from "@/app/_consts/notes";
+import { getSettings } from "@/app/_server/actions/config";
+
+export interface HistoryEntry {
+  commitHash: string;
+  date: string;
+  message: string;
+  action: string;
+  title: string;
+}
+
+export interface HistoryVersion {
+  commitHash: string;
+  date: string;
+  content: string;
+  title: string;
+}
+
+export interface HistoryResult<T> {
+  success: boolean;
+  data?: T;
+  error?: string;
+}
+
+export type HistoryAction = "create" | "update" | "rename" | "move" | "delete";
+
+const LEGACY_LOCK_FILE = ".historylock";
+const LOCKS_DIR = ".locks";
+const LOCK_STALE_MS = 30000;
+const LOCK_RETRIES = {
+  retries: 5,
+  factor: 2,
+  minTimeout: 100,
+  maxTimeout: 2000,
+};
+
+const _turnstile = new Map<string, Promise<unknown>>();
+
+export const notesRepoDir = (username: string) =>
+  path.join(process.cwd(), "data", NOTES_FOLDER, username);
+
+export const historyLockPath = (username: string) =>
+  path.join(
+    process.cwd(),
+    "data",
+    LOCKS_DIR,
+    `history-${username.replace(/[^a-zA-Z0-9._-]/g, "_")}.lock`
+  );
+
+const GITIGNORE_CONTENT = `.index.json
+.order.json
+*.lock
+.historylock
+images/
+files/
+videos/
+*.tmp
+*.swp
+*~`;
+
+export const repoGit = (userDir: string): SimpleGit => {
+  return simpleGit(userDir, {
+    binary: "git",
+    maxConcurrentProcesses: 1,
+    trimmed: true,
+  });
+};
+
+const _sweepStale = async (lockPath: string): Promise<void> => {
+  const lockDir = `${lockPath}.lock`;
+
+  try {
+    const stats = await fs.stat(lockDir);
+    if (Date.now() - stats.mtimeMs < LOCK_STALE_MS * 2) return;
+    await fs.rm(lockDir, { recursive: true, force: true });
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code !== "ENOENT") {
+      console.error("Failed to sweep stale history lock:", error);
+    }
+  }
+};
+
+export const dropLegacyLock = async (userDir: string): Promise<void> => {
+  const legacy = path.join(userDir, LEGACY_LOCK_FILE);
+
+  try {
+    await fs.rm(`${legacy}.lock`, { recursive: true, force: true });
+    await fs.rm(legacy, { force: true });
+  } catch (error) {
+    console.error("Failed to drop legacy history lock:", error);
+  }
+};
+
+const gatekeeper = async <T>(
+  username: string,
+  errand: () => Promise<T>
+): Promise<T> => {
+  const lockPath = historyLockPath(username);
+  const queued = _turnstile.get(username) ?? Promise.resolve();
+
+  const turn = queued.catch(() => { }).then(async () => {
+    await fs.mkdir(path.dirname(lockPath), { recursive: true });
+    await fs.writeFile(lockPath, "", { flag: "a" });
+    await _sweepStale(lockPath);
+
+    const release = await lock(lockPath, {
+      stale: LOCK_STALE_MS,
+      retries: LOCK_RETRIES,
+    });
+
+    try {
+      return await errand();
+    } finally {
+      try {
+        await release();
+      } catch (error) {
+        console.error("Failed to release history lock:", error);
+      }
+    }
+  });
+
+  _turnstile.set(username, turn.catch(() => { }));
+
+  return turn;
+};
+
+const _formatCommitMessage = (
+  action: HistoryAction,
+  noteTitle: string,
+  metadata?: { oldTitle?: string; oldCategory?: string; newCategory?: string }
+): string => {
+  switch (action) {
+    case "create":
+      return `[create] ${noteTitle}`;
+    case "update":
+      return `[update] ${noteTitle}`;
+    case "rename":
+      return `[rename] "${metadata?.oldTitle}" -> "${noteTitle}"`;
+    case "move":
+      return `[move] ${noteTitle}: ${metadata?.oldCategory} -> ${metadata?.newCategory}`;
+    case "delete":
+      return `[delete] ${noteTitle}`;
+    default:
+      return `[change] ${noteTitle}`;
+  }
+};
+
+export const parseCommit = (
+  message: string
+): { action: string; title: string } => {
+  const match = message.match(/^\[(\w+)\]\s*(.*)$/);
+  if (match) {
+    return { action: match[1], title: match[2] };
+  }
+  return { action: "update", title: message };
+};
+
+export const historyEnabled = async (): Promise<boolean> => {
+  try {
+    const settings = await getSettings();
+    return settings?.editor?.historyEnabled === true;
+  } catch {
+    return false;
+  }
+};
+
+export const ensureRepo = async (username: string): Promise<void> => {
+  const userDir = notesRepoDir(username);
+  const gitDir = path.join(userDir, ".git");
+
+  await dropLegacyLock(userDir);
+
+  try {
+    await fs.access(gitDir);
+  } catch {
+    const git = repoGit(userDir);
+    await git.init();
+
+    await git.addConfig("user.email", "history@local");
+    await git.addConfig("user.name", "History");
+
+    const gitignorePath = path.join(userDir, ".gitignore");
+    await fs.writeFile(gitignorePath, GITIGNORE_CONTENT);
+
+    await git.add(".gitignore");
+    await git.commit("[init] Initialize note history");
+  }
+};
+
+export const commitCategoryRename = async (
+  username: string,
+  oldPath: string,
+  newPath: string,
+): Promise<HistoryResult<string>> => {
+  const enabled = await historyEnabled();
+  if (!enabled) {
+    return { success: false };
+  }
+  const userDir = notesRepoDir(username);
+
+  try {
+    await fs.access(userDir);
+  } catch {
+    return { success: false, error: "User directory not found" };
+  }
+
+  await ensureRepo(username);
+
+  try {
+    return await gatekeeper(username, async () => {
+      const git = repoGit(userDir);
+      const oldPathNorm = oldPath.replace(/\\/g, "/");
+      const newPathNorm = newPath.replace(/\\/g, "/");
+
+      await git.add(["-u", oldPathNorm]);
+      await git.add(newPathNorm);
+      await git.commit(`[move] Category: ${oldPathNorm} -> ${newPathNorm}`);
+
+      return { success: true };
+    });
+  } catch (error) {
+    console.error("Git category rename error:", error);
+    return { success: false, error: String(error) };
+  }
+};
+
+export const commitNote = async (
+  username: string,
+  relativePath: string,
+  action: HistoryAction,
+  noteTitle: string,
+  metadata?: { oldTitle?: string; oldCategory?: string; newCategory?: string; oldPath?: string }
+): Promise<HistoryResult<string>> => {
+  const enabled = await historyEnabled();
+  if (!enabled) {
+    return { success: true };
+  }
+
+  const userDir = notesRepoDir(username);
+
+  try {
+    await fs.access(userDir);
+  } catch {
+    return { success: false, error: "User directory not found" };
+  }
+
+  await ensureRepo(username);
+
+  try {
+    return await gatekeeper(username, async () => {
+      const git = repoGit(userDir);
+      const message = _formatCommitMessage(action, noteTitle, metadata);
+
+      const status = await git.status();
+      const normalizedPath = relativePath.replace(/\\/g, "/");
+
+      if (action === "delete") {
+        const hasDeletedFile = status.deleted.some(
+          (f) => f === normalizedPath || f.endsWith(path.basename(relativePath))
+        );
+        if (!hasDeletedFile) {
+          return { success: true };
+        }
+        await git.add(["-u", relativePath]);
+      } else if (action === "move" && metadata?.oldPath) {
+        const oldPathNormalized = metadata.oldPath.replace(/\\/g, "/");
+        const leftBehind = status.deleted.some(
+          (f) => f === oldPathNormalized || f === metadata.oldPath
+        );
+
+        if (leftBehind) {
+          await git.add(["-u", oldPathNormalized]);
+        }
+
+        await git.add(normalizedPath);
+      } else {
+        const hasChanges = status.files.some(
+          (f) =>
+            f.path === relativePath ||
+            f.path === normalizedPath ||
+            f.path.endsWith(path.basename(relativePath))
+        );
+
+        if (!hasChanges) {
+          return { success: true };
+        }
+
+        await git.add(relativePath);
+      }
+
+      const result = await git.commit(message);
+      return { success: true, data: result.commit };
+    });
+  } catch (error) {
+    console.error("Git commit error:", error);
+    return { success: false, error: String(error) };
+  }
+};
diff --git a/app/_server/actions/lib/audit-trail.ts b/app/_server/actions/lib/audit-trail.ts
index 41c8fd068..9611857c6 100644
--- a/app/_server/actions/lib/audit-trail.ts
+++ b/app/_server/actions/lib/audit-trail.ts
@@ -2,11 +2,9 @@ import fs from "fs/promises";
 import { getDailyLogPath, getDateRange } from "@/app/_server/actions/log";
 import { readJsonFile } from "@/app/_server/actions/file";
 import { USERS_FILE } from "@/app/_consts/files";
-import { LOG_WINDOW_DAYS } from "@/app/_consts/logs";
+import { DAY_MS, LOG_READ_BATCH_DAYS, LOG_WINDOW_DAYS } from "@/app/_consts/logs";
 import { AuditCategory, AuditLogEntry, AuditLogLevel, User } from "@/app/_types";
 
-const DAY_MS = 24 * 60 * 60 * 1000;
-
 export interface LogWindow {
   startDate?: string;
   endDate?: string;
@@ -46,8 +44,11 @@ export const digUpLogs = async (
 
   const logs: AuditLogEntry[] = [];
   for (const username of usernames) {
-    const days = await Promise.all(dates.map((date) => _readDay(username, date)));
-    logs.push(...days.flat());
+    for (let at = 0; at < dates.length; at += LOG_READ_BATCH_DAYS) {
+      const batch = dates.slice(at, at + LOG_READ_BATCH_DAYS);
+      const days = await Promise.all(batch.map((date) => _readDay(username, date)));
+      logs.push(...days.flat());
+    }
   }
   return logs;
 };
diff --git a/app/_server/actions/lib/filename-fence.ts b/app/_server/actions/lib/filename-fence.ts
new file mode 100644
index 000000000..7e800b247
--- /dev/null
+++ b/app/_server/actions/lib/filename-fence.ts
@@ -0,0 +1,19 @@
+import path from "path";
+import { getTranslations } from "next-intl/server";
+import { isPathSafe } from "@/app/_utils/path-utils";
+
+export const fenceFilename = async (
+  categoryDir: string,
+  filename: string,
+): Promise<string | null> => {
+  const landsInside =
+    isPathSafe(categoryDir, filename) &&
+    path.dirname(path.resolve(categoryDir, filename)) ===
+      path.resolve(categoryDir);
+
+  if (landsInside) return null;
+
+  console.warn("Refusing filename outside its category:", filename);
+  const t = await getTranslations("errors");
+  return t("filenameOutOfBounds");
+};
diff --git a/app/_server/actions/log/cleanup.ts b/app/_server/actions/log/cleanup.ts
index b9038db7d..40f65e969 100644
--- a/app/_server/actions/log/cleanup.ts
+++ b/app/_server/actions/log/cleanup.ts
@@ -4,190 +4,46 @@ import path from "path";
 import fs from "fs/promises";
 import { getCurrentUser, isAdmin } from "@/app/_server/actions/users";
 import { logAudit } from "./writers";
+import { countOldLogs, sweepOldLogs } from "./sweep";
+import { validateNoPathTraversal } from "@/app/_utils/path-utils";
 
-export const checkCleanupNeeded = async (
-  username?: string
-): Promise<{
-  needed: boolean;
-  count: number;
-  maxAge: number;
-}> => {
-  try {
-    const { getSettings } = await import("@/app/_server/actions/config");
-    const settings = await getSettings();
-    const maxLogAgeDays = settings?.maxLogAgeDays ?? 0;
-
-    if (maxLogAgeDays === 0) {
-      return { needed: false, count: 0, maxAge: 0 };
-    }
-
-    const cutoffDate = new Date();
-    cutoffDate.setDate(cutoffDate.getDate() - maxLogAgeDays);
-
-    let oldFileCount = 0;
-    const logsBaseDir = path.join(process.cwd(), "data/logs");
-
-    try {
-      await fs.access(logsBaseDir);
-    } catch {
-      return { needed: false, count: 0, maxAge: maxLogAgeDays };
-    }
-
-    const userDirs = username
-      ? [{ name: username, isDirectory: () => true }]
-      : await fs.readdir(logsBaseDir, { withFileTypes: true });
+type CleanupCheck = { needed: boolean; count: number; maxAge: number };
+type CleanupResult = { success: boolean; deletedFiles: number; error?: string };
 
-    for (const userEntry of userDirs) {
-      if (!userEntry.isDirectory()) continue;
-
-      const userPath = path.join(logsBaseDir, userEntry.name);
-
-      try {
-        const years = await fs.readdir(userPath, { withFileTypes: true });
-
-        for (const yearEntry of years) {
-          if (!yearEntry.isDirectory()) continue;
-
-          const yearPath = path.join(userPath, yearEntry.name);
-          const months = await fs.readdir(yearPath, { withFileTypes: true });
+const _logOwner = async (
+  username?: string,
+): Promise<{ allowed: boolean; username?: string }> => {
+  const currentUser = await getCurrentUser();
+  if (!currentUser) return { allowed: false };
 
-          for (const monthEntry of months) {
-            if (!monthEntry.isDirectory()) continue;
+  if (username && !validateNoPathTraversal(username)) return { allowed: false };
 
-            const monthPath = path.join(yearPath, monthEntry.name);
-            const days = await fs.readdir(monthPath, { withFileTypes: true });
+  if (currentUser.isAdmin) return { allowed: true, username };
 
-            for (const dayEntry of days) {
-              if (!dayEntry.isFile() || !dayEntry.name.endsWith(".json")) continue;
+  if (username && username !== currentUser.username) return { allowed: false };
 
-              const day = dayEntry.name.replace(".json", "");
-              const fileDate = new Date(
-                `${yearEntry.name}-${monthEntry.name}-${day}`
-              );
+  return { allowed: true, username: currentUser.username };
+};
 
-              if (fileDate < cutoffDate) {
-                oldFileCount++;
-              }
-            }
-          }
-        }
-      } catch {
-        continue;
-      }
-    }
+export const checkCleanupNeeded = async (
+  username?: string
+): Promise<CleanupCheck> => {
+  const owner = await _logOwner(username);
+  if (!owner.allowed) return { needed: false, count: 0, maxAge: 0 };
 
-    return {
-      needed: oldFileCount > 0,
-      count: oldFileCount,
-      maxAge: maxLogAgeDays,
-    };
-  } catch (error) {
-    console.error("Error checking cleanup needed:", error);
-    return { needed: false, count: 0, maxAge: 0 };
-  }
+  return countOldLogs(owner.username);
 };
 
 export const cleanupOldLogs = async (
   username?: string,
   maxAgeDays?: number
-): Promise<{
-  success: boolean;
-  deletedFiles: number;
-  error?: string;
-}> => {
-  try {
-    let ageDays = maxAgeDays;
-
-    if (ageDays === undefined) {
-      const { getSettings } = await import("@/app/_server/actions/config");
-      const settings = await getSettings();
-      ageDays = settings?.maxLogAgeDays ?? 0;
-    }
-
-    if (ageDays === 0) {
-      return { success: true, deletedFiles: 0 };
-    }
-
-    if (!ageDays || ageDays < 0) {
-      return { success: true, deletedFiles: 0 };
-    }
-
-    const cutoffDate = new Date();
-    cutoffDate.setDate(cutoffDate.getDate() - ageDays);
-
-    let deletedCount = 0;
-    const logsBaseDir = path.join(process.cwd(), "data/logs");
-
-    try {
-      await fs.access(logsBaseDir);
-    } catch {
-      return { success: true, deletedFiles: 0 };
-    }
-
-    const userDirs = username
-      ? [{ name: username, isDirectory: () => true }]
-      : await fs.readdir(logsBaseDir, { withFileTypes: true });
-
-    for (const userEntry of userDirs) {
-      if (!userEntry.isDirectory()) continue;
-
-      const userPath = path.join(logsBaseDir, userEntry.name);
-
-      try {
-        const years = await fs.readdir(userPath, { withFileTypes: true });
-
-        for (const yearEntry of years) {
-          if (!yearEntry.isDirectory()) continue;
-
-          const yearPath = path.join(userPath, yearEntry.name);
-          const months = await fs.readdir(yearPath, { withFileTypes: true });
-
-          for (const monthEntry of months) {
-            if (!monthEntry.isDirectory()) continue;
-
-            const monthPath = path.join(yearPath, monthEntry.name);
-            const days = await fs.readdir(monthPath, { withFileTypes: true });
-
-            for (const dayEntry of days) {
-              if (!dayEntry.isFile() || !dayEntry.name.endsWith(".json")) continue;
-
-              const day = dayEntry.name.replace(".json", "");
-              const fileDate = new Date(
-                `${yearEntry.name}-${monthEntry.name}-${day}`
-              );
-
-              if (fileDate < cutoffDate) {
-                const filePath = path.join(monthPath, dayEntry.name);
-                await fs.unlink(filePath);
-                deletedCount++;
-              }
-            }
-          }
-        }
-      } catch {
-        continue;
-      }
-    }
-
-    const currentUser = await getCurrentUser();
-
-    await logAudit({
-      level: "INFO",
-      action: "logs_cleaned",
-      category: "system",
-      success: true,
-      username: currentUser?.username || username || "unknown",
-      metadata: { deletedFiles: deletedCount, maxAgeDays: ageDays },
-    });
-
-    return { success: true, deletedFiles: deletedCount };
-  } catch (error: any) {
-    return {
-      success: false,
-      deletedFiles: 0,
-      error: error.message || "Cleanup failed",
-    };
+): Promise<CleanupResult> => {
+  const owner = await _logOwner(username);
+  if (!owner.allowed) {
+    return { success: false, deletedFiles: 0, error: "Permission denied" };
   }
+
+  return sweepOldLogs(owner.username, maxAgeDays);
 };
 
 export const deleteAllLogs = async (): Promise<{
diff --git a/app/_server/actions/log/client.ts b/app/_server/actions/log/client.ts
new file mode 100644
index 000000000..28d2dad4f
--- /dev/null
+++ b/app/_server/actions/log/client.ts
@@ -0,0 +1,38 @@
+"use server";
+
+import {
+  AuditAction,
+  AuditCategory,
+  AuditLogLevel,
+  AuditMetadata,
+} from "@/app/_types";
+import { getCurrentUser } from "@/app/_server/actions/users";
+import { logAudit } from "./writers";
+
+export const logClientAudit = async (params: {
+  level: AuditLogLevel;
+  action: AuditAction;
+  category: AuditCategory;
+  success: boolean;
+  resourceType?: string;
+  resourceId?: string;
+  resourceTitle?: string;
+  errorMessage?: string;
+  metadata?: AuditMetadata;
+}): Promise<void> => {
+  const currentUser = await getCurrentUser();
+  if (!currentUser) return;
+
+  await logAudit({
+    level: params.level,
+    action: params.action,
+    category: params.category,
+    success: params.success,
+    resourceType: params.resourceType,
+    resourceId: params.resourceId,
+    resourceTitle: params.resourceTitle,
+    errorMessage: params.errorMessage,
+    metadata: params.metadata,
+    username: currentUser.username,
+  });
+};
diff --git a/app/_server/actions/log/helpers.ts b/app/_server/actions/log/helpers.ts
index be55b9cc9..ffe849d45 100644
--- a/app/_server/actions/log/helpers.ts
+++ b/app/_server/actions/log/helpers.ts
@@ -1,9 +1,8 @@
-"use server";
-
 import { headers } from "next/headers";
 import path from "path";
 import { AuditLogLevel } from "@/app/_types";
 import { getUserLogsDir } from "@/app/_consts/files";
+import { DAY_MS, LOG_MAX_RANGE_DAYS } from "@/app/_consts/logs";
 
 const getConfiguredLogLevel = async (): Promise<AuditLogLevel> => {
   const level = process.env.LOG_LEVEL?.toUpperCase() || "INFO";
@@ -46,6 +45,10 @@ export const getRequestContext = async () => {
 };
 
 export const getDateRange = async (start: Date, end: Date): Promise<Date[]> => {
+  if (end.getTime() - start.getTime() > LOG_MAX_RANGE_DAYS * DAY_MS) {
+    throw new RangeError(`Log range is longer than ${LOG_MAX_RANGE_DAYS} days`);
+  }
+
   const dates: Date[] = [];
   const current = new Date(start);
 
diff --git a/app/_server/actions/log/readers.ts b/app/_server/actions/log/readers.ts
index 9e4afaf83..bbc95a47f 100644
--- a/app/_server/actions/log/readers.ts
+++ b/app/_server/actions/log/readers.ts
@@ -11,6 +11,7 @@ import {
 import { getCurrentUser, isAdmin } from "@/app/_server/actions/users";
 import { readJsonFile } from "@/app/_server/actions/file";
 import { getDailyLogPath, getDateRange } from "./helpers";
+import { DAY_MS, LOG_MAX_RANGE_DAYS, LOG_WINDOW_DAYS } from "@/app/_consts/logs";
 
 export const getAuditLogs = async (
   filters: AuditLogFilters = {}
@@ -25,9 +26,11 @@ export const getAuditLogs = async (
   let allLogs: AuditLogEntry[] = [];
 
   const endDate = filters.endDate ? new Date(filters.endDate) : new Date();
-  const startDate = filters.startDate
+  const earliest = new Date(endDate.getTime() - LOG_MAX_RANGE_DAYS * DAY_MS);
+  const requested = filters.startDate
     ? new Date(filters.startDate)
-    : new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1000);
+    : new Date(endDate.getTime() - LOG_WINDOW_DAYS * DAY_MS);
+  const startDate = requested < earliest ? earliest : requested;
 
   const dates = await getDateRange(startDate, endDate);
 
diff --git a/app/_server/actions/log/sweep.ts b/app/_server/actions/log/sweep.ts
new file mode 100644
index 000000000..a27033d19
--- /dev/null
+++ b/app/_server/actions/log/sweep.ts
@@ -0,0 +1,189 @@
+import path from "path";
+import fs from "fs/promises";
+import { getCurrentUser } from "@/app/_server/actions/users";
+import { logAudit } from "./writers";
+
+export const countOldLogs = async (
+  username?: string
+): Promise<{
+  needed: boolean;
+  count: number;
+  maxAge: number;
+}> => {
+  try {
+    const { getSettings } = await import("@/app/_server/actions/config");
+    const settings = await getSettings();
+    const maxLogAgeDays = settings?.maxLogAgeDays ?? 0;
+
+    if (maxLogAgeDays === 0) {
+      return { needed: false, count: 0, maxAge: 0 };
+    }
+
+    const cutoffDate = new Date();
+    cutoffDate.setDate(cutoffDate.getDate() - maxLogAgeDays);
+
+    let oldFileCount = 0;
+    const logsBaseDir = path.join(process.cwd(), "data/logs");
+
+    try {
+      await fs.access(logsBaseDir);
+    } catch {
+      return { needed: false, count: 0, maxAge: maxLogAgeDays };
+    }
+
+    const userDirs = username
+      ? [{ name: username, isDirectory: () => true }]
+      : await fs.readdir(logsBaseDir, { withFileTypes: true });
+
+    for (const userEntry of userDirs) {
+      if (!userEntry.isDirectory()) continue;
+
+      const userPath = path.join(logsBaseDir, userEntry.name);
+
+      try {
+        const years = await fs.readdir(userPath, { withFileTypes: true });
+
+        for (const yearEntry of years) {
+          if (!yearEntry.isDirectory()) continue;
+
+          const yearPath = path.join(userPath, yearEntry.name);
+          const months = await fs.readdir(yearPath, { withFileTypes: true });
+
+          for (const monthEntry of months) {
+            if (!monthEntry.isDirectory()) continue;
+
+            const monthPath = path.join(yearPath, monthEntry.name);
+            const days = await fs.readdir(monthPath, { withFileTypes: true });
+
+            for (const dayEntry of days) {
+              if (!dayEntry.isFile() || !dayEntry.name.endsWith(".json")) continue;
+
+              const day = dayEntry.name.replace(".json", "");
+              const fileDate = new Date(
+                `${yearEntry.name}-${monthEntry.name}-${day}`
+              );
+
+              if (fileDate < cutoffDate) {
+                oldFileCount++;
+              }
+            }
+          }
+        }
+      } catch {
+        continue;
+      }
+    }
+
+    return {
+      needed: oldFileCount > 0,
+      count: oldFileCount,
+      maxAge: maxLogAgeDays,
+    };
+  } catch (error) {
+    console.error("Error checking cleanup needed:", error);
+    return { needed: false, count: 0, maxAge: 0 };
+  }
+};
+
+export const sweepOldLogs = async (
+  username?: string,
+  maxAgeDays?: number
+): Promise<{
+  success: boolean;
+  deletedFiles: number;
+  error?: string;
+}> => {
+  try {
+    let ageDays = maxAgeDays;
+
+    if (ageDays === undefined) {
+      const { getSettings } = await import("@/app/_server/actions/config");
+      const settings = await getSettings();
+      ageDays = settings?.maxLogAgeDays ?? 0;
+    }
+
+    if (ageDays === 0) {
+      return { success: true, deletedFiles: 0 };
+    }
+
+    if (!ageDays || ageDays < 0) {
+      return { success: true, deletedFiles: 0 };
+    }
+
+    const cutoffDate = new Date();
+    cutoffDate.setDate(cutoffDate.getDate() - ageDays);
+
+    let deletedCount = 0;
+    const logsBaseDir = path.join(process.cwd(), "data/logs");
+
+    try {
+      await fs.access(logsBaseDir);
+    } catch {
+      return { success: true, deletedFiles: 0 };
+    }
+
+    const userDirs = username
+      ? [{ name: username, isDirectory: () => true }]
+      : await fs.readdir(logsBaseDir, { withFileTypes: true });
+
+    for (const userEntry of userDirs) {
+      if (!userEntry.isDirectory()) continue;
+
+      const userPath = path.join(logsBaseDir, userEntry.name);
+
+      try {
+        const years = await fs.readdir(userPath, { withFileTypes: true });
+
+        for (const yearEntry of years) {
+          if (!yearEntry.isDirectory()) continue;
+
+          const yearPath = path.join(userPath, yearEntry.name);
+          const months = await fs.readdir(yearPath, { withFileTypes: true });
+
+          for (const monthEntry of months) {
+            if (!monthEntry.isDirectory()) continue;
+
+            const monthPath = path.join(yearPath, monthEntry.name);
+            const days = await fs.readdir(monthPath, { withFileTypes: true });
+
+            for (const dayEntry of days) {
+              if (!dayEntry.isFile() || !dayEntry.name.endsWith(".json")) continue;
+
+              const day = dayEntry.name.replace(".json", "");
+              const fileDate = new Date(
+                `${yearEntry.name}-${monthEntry.name}-${day}`
+              );
+
+              if (fileDate < cutoffDate) {
+                const filePath = path.join(monthPath, dayEntry.name);
+                await fs.unlink(filePath);
+                deletedCount++;
+              }
+            }
+          }
+        }
+      } catch {
+        continue;
+      }
+    }
+
+    const currentUser = await getCurrentUser();
+
+    await logAudit({
+      level: "INFO",
+      action: "logs_cleaned",
+      category: "system",
+      success: true,
+      username: currentUser?.username || username || "unknown",
+      metadata: { deletedFiles: deletedCount, maxAgeDays: ageDays },
+    });
+
+    return { success: true, deletedFiles: deletedCount };
+  } catch (error: any) {
+    return {
+      success: false,
+      deletedFiles: 0,
+      error: error.message || "Cleanup failed",
+    };
+  }
+};
diff --git a/app/_server/actions/log/writers.ts b/app/_server/actions/log/writers.ts
index 992de56d4..70e3b3492 100644
--- a/app/_server/actions/log/writers.ts
+++ b/app/_server/actions/log/writers.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import path from "path";
 import fs from "fs/promises";
 import {
@@ -15,11 +13,17 @@ import { generateUuid } from "@/app/_utils/yaml-metadata-utils";
 import { apiCaller } from "@/app/_server/api/caller-scope";
 import { runQueued } from "@/app/_server/actions/lib/concurrency";
 import { shouldLog, getRequestContext, getDailyLogPath } from "./helpers";
+import { validateNoPathTraversal } from "@/app/_utils/path-utils";
 
 const SYSTEM_USER = "system";
 
+const _logBucket = (username: string): string =>
+  username && !username.startsWith(".") && validateNoPathTraversal(username) && !username.includes("\0")
+    ? username
+    : SYSTEM_USER;
+
 const writeToDailyLog = async (entry: AuditLogEntry, username: string): Promise<void> => {
-  const logFilePath = await getDailyLogPath(username);
+  const logFilePath = await getDailyLogPath(_logBucket(username));
   await ensureDir(path.dirname(logFilePath));
 
   await runQueued(logFilePath, async () => {
diff --git a/app/_server/actions/mfa/index.ts b/app/_server/actions/mfa/index.ts
index 965e78dcd..45b90c2cc 100644
--- a/app/_server/actions/mfa/index.ts
+++ b/app/_server/actions/mfa/index.ts
@@ -6,94 +6,10 @@ import { getCurrentUser, getUsername } from "../users";
 import { findUserRecord, mutateUsers, patchUserFields } from "../users/records";
 import { logAudit } from "../log";
 import { getSettings } from "../config";
-import _sodium from "libsodium-wrappers-sumo";
 import { createHash, randomBytes } from "crypto";
+import { decryptMfaSecret, encryptMfaSecret } from "./secret";
 import { Result } from "@/app/_types";
 
-let sodium: any;
-const _getSodium = async () => {
-    if (!sodium) {
-        await _sodium.ready;
-        sodium = _sodium;
-    }
-    return sodium;
-};
-
-const _encryptSecret = async (secret: string, username: string): Promise<string> => {
-    const sod = await _getSodium();
-
-    const user = await findUserRecord(username);
-    if (!user) {
-        throw new Error("User not found");
-    }
-
-    const passphrase = user.passwordHash;
-    const salt = sod.randombytes_buf(sod.crypto_pwhash_SALTBYTES);
-
-    const key = sod.crypto_pwhash(
-        sod.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
-        passphrase,
-        salt,
-        sod.crypto_pwhash_OPSLIMIT_INTERACTIVE,
-        sod.crypto_pwhash_MEMLIMIT_INTERACTIVE,
-        sod.crypto_pwhash_ALG_DEFAULT
-    );
-
-    const nonce = sod.randombytes_buf(sod.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
-    const ciphertext = sod.crypto_aead_xchacha20poly1305_ietf_encrypt(
-        secret,
-        null,
-        null,
-        nonce,
-        key
-    );
-
-    const packageData = {
-        alg: "xchacha20",
-        salt: sod.to_hex(salt),
-        nonce: sod.to_hex(nonce),
-        data: sod.to_hex(ciphertext)
-    };
-
-    return JSON.stringify(packageData);
-};
-
-const _decryptSecret = async (encryptedSecret: string, username: string): Promise<string> => {
-    const sod = await _getSodium();
-    const pkg = JSON.parse(encryptedSecret);
-
-    const user = await findUserRecord(username);
-    if (!user) {
-        throw new Error("User not found");
-    }
-
-    const passphrase = user.passwordHash;
-    const salt = sod.from_hex(pkg.salt);
-    const nonce = sod.from_hex(pkg.nonce);
-    const ciphertext = sod.from_hex(pkg.data);
-
-    const key = sod.crypto_pwhash(
-        sod.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
-        passphrase,
-        salt,
-        sod.crypto_pwhash_OPSLIMIT_INTERACTIVE,
-        sod.crypto_pwhash_MEMLIMIT_INTERACTIVE,
-        sod.crypto_pwhash_ALG_DEFAULT
-    );
-
-    const decrypted = sod.crypto_aead_xchacha20poly1305_ietf_decrypt(
-        null,
-        ciphertext,
-        null,
-        nonce,
-        key
-    );
-
-    return sod.to_string(decrypted);
-};
-
-export const decryptMfaSecret = _decryptSecret;
-
 const _generateRecoveryCode = (): string => {
     return randomBytes(16).toString('hex').toUpperCase();
 };
@@ -186,7 +102,7 @@ export const verifyAndEnableMfa = async (token: string, secret: string): Promise
         const recoveryCode = _generateRecoveryCode();
         const hashedRecoveryCode = _hashRecoveryCode(recoveryCode);
 
-        const encryptedSecret = await _encryptSecret(secret, username);
+        const encryptedSecret = await encryptMfaSecret(secret, username);
 
         const saved = await patchUserFields(username, {
             mfaEnabled: true,
@@ -236,7 +152,7 @@ export const verifyMfaCode = async (code: string): Promise<Result<null>> => {
             return { success: false, error: "MFA not enabled" };
         }
 
-        const secret = await _decryptSecret(user.mfaSecret, username);
+        const secret = await decryptMfaSecret(user.mfaSecret, username);
 
         const verified = speakeasy.totp.verify({
             secret,
diff --git a/app/_server/actions/mfa/secret.ts b/app/_server/actions/mfa/secret.ts
new file mode 100644
index 000000000..c6b57771c
--- /dev/null
+++ b/app/_server/actions/mfa/secret.ts
@@ -0,0 +1,84 @@
+import _sodium from "libsodium-wrappers-sumo";
+import { findUserRecord } from "../users/records";
+
+let sodium: any;
+const _getSodium = async () => {
+    if (!sodium) {
+        await _sodium.ready;
+        sodium = _sodium;
+    }
+    return sodium;
+};
+
+export const encryptMfaSecret = async (secret: string, username: string): Promise<string> => {
+    const sod = await _getSodium();
+
+    const user = await findUserRecord(username);
+    if (!user) {
+        throw new Error("User not found");
+    }
+
+    const passphrase = user.passwordHash;
+    const salt = sod.randombytes_buf(sod.crypto_pwhash_SALTBYTES);
+
+    const key = sod.crypto_pwhash(
+        sod.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
+        passphrase,
+        salt,
+        sod.crypto_pwhash_OPSLIMIT_INTERACTIVE,
+        sod.crypto_pwhash_MEMLIMIT_INTERACTIVE,
+        sod.crypto_pwhash_ALG_DEFAULT
+    );
+
+    const nonce = sod.randombytes_buf(sod.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+    const ciphertext = sod.crypto_aead_xchacha20poly1305_ietf_encrypt(
+        secret,
+        null,
+        null,
+        nonce,
+        key
+    );
+
+    const packageData = {
+        alg: "xchacha20",
+        salt: sod.to_hex(salt),
+        nonce: sod.to_hex(nonce),
+        data: sod.to_hex(ciphertext)
+    };
+
+    return JSON.stringify(packageData);
+};
+
+export const decryptMfaSecret = async (encryptedSecret: string, username: string): Promise<string> => {
+    const sod = await _getSodium();
+    const pkg = JSON.parse(encryptedSecret);
+
+    const user = await findUserRecord(username);
+    if (!user) {
+        throw new Error("User not found");
+    }
+
+    const passphrase = user.passwordHash;
+    const salt = sod.from_hex(pkg.salt);
+    const nonce = sod.from_hex(pkg.nonce);
+    const ciphertext = sod.from_hex(pkg.data);
+
+    const key = sod.crypto_pwhash(
+        sod.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
+        passphrase,
+        salt,
+        sod.crypto_pwhash_OPSLIMIT_INTERACTIVE,
+        sod.crypto_pwhash_MEMLIMIT_INTERACTIVE,
+        sod.crypto_pwhash_ALG_DEFAULT
+    );
+
+    const decrypted = sod.crypto_aead_xchacha20poly1305_ietf_decrypt(
+        null,
+        ciphertext,
+        null,
+        nonce,
+        key
+    );
+
+    return sod.to_string(decrypted);
+};
diff --git a/app/_server/actions/note/creator.ts b/app/_server/actions/note/creator.ts
index 6c4f2b628..a3c98b052 100644
--- a/app/_server/actions/note/creator.ts
+++ b/app/_server/actions/note/creator.ts
@@ -19,11 +19,12 @@ import {
   strayMeta,
 } from "@/app/_utils/yaml-metadata-utils";
 import { logContentEvent } from "@/app/_server/actions/log";
-import { commitNote } from "@/app/_server/actions/history";
+import { commitNote } from "@/app/_server/actions/history/repo";
 import { targetDir, bouncer } from "@/app/_server/actions/share/target";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { noteToMarkdown } from "./parsers";
 import { failedWith } from "@/app/_server/actions/lib/read-only-message";
+import { fenceFilename } from "@/app/_server/actions/lib/filename-fence";
 
 export const makeNote = async (
   actor: SanitisedUser,
@@ -74,6 +75,11 @@ export const makeNote = async (
       ".md",
       fileRenameMode,
     );
+    const straying = await fenceFilename(categoryDir, filename);
+    if (straying) {
+      return { error: straying };
+    }
+
     const id = path.basename(filename, ".md");
     const filePath = path.join(categoryDir, filename);
 
diff --git a/app/_server/actions/note/crud.ts b/app/_server/actions/note/crud.ts
index 7a9f98f03..2ee161211 100644
--- a/app/_server/actions/note/crud.ts
+++ b/app/_server/actions/note/crud.ts
@@ -19,6 +19,7 @@ import { broadcast } from "@/app/_server/actions/ws/broadcast";
 import { claimedName } from "@/app/_server/actions/lib/actor";
 import { makeNote } from "./creator";
 import { dropNote, editNote } from "./editor";
+import { fenceFilename } from "@/app/_server/actions/lib/filename-fence";
 
 export const createNote = async (formData: FormData) => {
   const actor = await getCurrentUser();
@@ -44,19 +45,17 @@ export const cloneNote = async (formData: FormData) => {
   try {
     const uuid = formData.get("uuid") as string;
     const targetCategory = formData.get("category") as string;
-    const ownerUsername = formData.get("user") as string | null;
-
-    const note = await getNoteById(uuid, ownerUsername || undefined);
-    if (!note) {
-      return { error: "Note not found" };
-    }
-
     const currentUser = await getCurrentUser();
 
     if (!currentUser?.username) {
       return { error: "Not authenticated" };
     }
 
+    const note = await getNoteById(uuid);
+    if (!note) {
+      return { error: "Note not found" };
+    }
+
     const canReadSource = await canReach(
       note.uuid!,
       "note",
@@ -101,6 +100,11 @@ export const cloneNote = async (formData: FormData) => {
       ".md",
       fileRenameMode,
     );
+    const straying = await fenceFilename(categoryDir, filename);
+    if (straying) {
+      return { error: straying };
+    }
+
     const filePath = path.join(categoryDir, filename);
 
     const content = note.content || "";
diff --git a/app/_server/actions/note/editor.ts b/app/_server/actions/note/editor.ts
index 669a3d156..6f03b124b 100644
--- a/app/_server/actions/note/editor.ts
+++ b/app/_server/actions/note/editor.ts
@@ -28,7 +28,7 @@ import {
   keptMeta,
 } from "@/app/_utils/yaml-metadata-utils";
 import { logContentEvent } from "@/app/_server/actions/log";
-import { commitNote } from "@/app/_server/actions/history";
+import { commitNote } from "@/app/_server/actions/history/repo";
 import { noteToMarkdown } from "./parsers";
 import { getNoteById } from "./queries";
 import {
@@ -45,6 +45,7 @@ import {
 } from "@/app/_server/actions/lib/read-only-message";
 import { isWritable } from "@/app/_server/actions/lib/read-only";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
+import { fenceFilename } from "@/app/_server/actions/lib/filename-fence";
 
 const _noteDirFor = (owner: string, category?: string): string =>
   path.join(process.cwd(), NOTES_DIR(owner), category || UNCATEGORIZED);
@@ -180,6 +181,11 @@ const _editNote = async (
       updatedDoc.id = newId;
     }
 
+    const straying = await fenceFilename(categoryDir, newFilename);
+    if (straying) {
+      return { error: straying };
+    }
+
     const filePath = path.join(categoryDir, newFilename);
 
     const oldFilePath =
diff --git a/app/_server/actions/note/index.ts b/app/_server/actions/note/index.ts
index 8ed0af4d3..50d89f35d 100644
--- a/app/_server/actions/note/index.ts
+++ b/app/_server/actions/note/index.ts
@@ -1,5 +1,4 @@
 export { parseMarkdownNote, noteToMarkdown } from "./parsers";
-export { readNotesRecursively } from "./readers";
 export { CheckForNeedsMigration } from "./migration";
 export { createNote, updateNote, deleteNote, cloneNote } from "./crud";
 export { viewNote, getNotesForDisplay } from "./viewer";
diff --git a/app/_server/actions/note/readers.ts b/app/_server/actions/note/readers.ts
index 8fddf3147..7857a387d 100644
--- a/app/_server/actions/note/readers.ts
+++ b/app/_server/actions/note/readers.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import path from "path";
 import fs from "fs/promises";
 import { ARCHIVED_DIR_NAME, EXCLUDED_DIRS } from "@/app/_consts/files";
diff --git a/app/_server/actions/note/splice.ts b/app/_server/actions/note/splice.ts
index feff73097..9abf0d1b1 100644
--- a/app/_server/actions/note/splice.ts
+++ b/app/_server/actions/note/splice.ts
@@ -6,13 +6,11 @@ import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
 import { NOTES_DIR } from "@/app/_consts/files";
 import { UNCATEGORIZED, isManaged } from "@/app/_consts/notes";
 import { serverWriteFile } from "@/app/_server/actions/file";
-import { canReach } from "@/app/_server/actions/share/queries";
+import { reachableFile } from "@/app/_server/actions/share/queries";
 import { itemLane, runQueued } from "@/app/_server/actions/lib/concurrency";
-import { getUserByNoteUuid } from "@/app/_server/actions/users";
-import { commitNote } from "@/app/_server/actions/history";
+import { commitNote } from "@/app/_server/actions/history/repo";
 import { logContentEvent } from "@/app/_server/actions/log";
 import { broadcast } from "@/app/_server/actions/ws/broadcast";
-import { grepFindFileByUuid } from "@/app/_utils/grep-utils";
 import { isEncrypted } from "@/app/_utils/encryption-utils";
 import { extractHashtagsFromContent, normalizeTag } from "@/app/_utils/tag-utils";
 import {
@@ -88,16 +86,23 @@ export interface SpliceOptions {
   untag?: string[];
 }
 
+const _placeOf = (filePath: string) => {
+  const [owner, ...rest] = path
+    .relative(path.join(process.cwd(), NOTES_DIR("")), filePath)
+    .split(path.sep);
+  rest.pop();
+  return { owner, id: path.basename(filePath, ".md"), category: rest.join("/"), filePath };
+};
+
 const _splice = async (
   actor: SanitisedUser,
   uuid: string,
+  filePath: string,
   edit: (body: string) => SpliceEdit,
   { untag = [] }: SpliceOptions,
 ): Promise<Result<Spliced>> => {
-  const owner = await getUserByNoteUuid(uuid);
-  if (!owner.success || !owner.data) return { success: false, error: SPLICE_MISSING };
-  const found = await grepFindFileByUuid(path.join(process.cwd(), NOTES_DIR(owner.data.username)), uuid);
-  if (!found) return { success: false, error: SPLICE_MISSING };
+  const found = _placeOf(filePath);
+  if (!found.owner) return { success: false, error: SPLICE_MISSING };
 
   const raw = await fs.readFile(found.filePath, "utf-8");
   const { prefix, body } = splitFrontmatter(raw);
@@ -119,7 +124,7 @@ const _splice = async (
     tags: retagged ?? _storedTags(metadata),
     managed: isManaged(metadata),
   };
-  await _afterWrite(actor, owner.data.username, found.filePath, spliced);
+  await _afterWrite(actor, found.owner, found.filePath, spliced);
   return { success: true, data: spliced };
 };
 
@@ -129,12 +134,12 @@ export const spliceNote = async (
   edit: (body: string) => SpliceEdit,
   options: SpliceOptions = {},
 ): Promise<Result<Spliced>> => {
-  const allowed = await canReach(uuid, ItemTypes.NOTE, actor.username, PermissionTypes.EDIT);
-  if (!allowed) return { success: false, error: SPLICE_DENIED };
+  const filePath = await reachableFile(uuid, ItemTypes.NOTE, actor.username, PermissionTypes.EDIT);
+  if (!filePath) return { success: false, error: SPLICE_DENIED };
 
   return runQueued(itemLane(Modes.NOTES, uuid), async () => {
     try {
-      return await _splice(actor, uuid, edit, options);
+      return await _splice(actor, uuid, filePath, edit, options);
     } catch (error) {
       console.error(`spliceNote failed for ${uuid}:`, error);
       return { success: false, error: "Failed to update note" };
diff --git a/app/_server/actions/pgp/index.ts b/app/_server/actions/pgp/index.ts
index 693c61966..4dd497c4a 100644
--- a/app/_server/actions/pgp/index.ts
+++ b/app/_server/actions/pgp/index.ts
@@ -16,13 +16,47 @@ import {
 import { Result, SanitisedUser } from "@/app/_types";
 import { PGPKeyMetadata } from "@/app/_types";
 import { logAudit } from "@/app/_server/actions/log";
+import { DATA_DIR } from "@/app/_consts/files";
+
+const _defaultKeyDir = (username: string): string =>
+  path.join(process.cwd(), DATA_DIR, "encryption", username);
+
+const _realOr = async (target: string): Promise<string> => {
+  try {
+    return await fs.realpath(target);
+  } catch {
+    return path.resolve(target);
+  }
+};
+
+const _keyPathTrespasses = async (
+  username: string,
+  customPath: string,
+): Promise<boolean> => {
+  if (!path.isAbsolute(customPath) || customPath.includes("\0")) return true;
+
+  const real = await _realOr(customPath);
+  const dataRoot = await _realOr(path.join(process.cwd(), DATA_DIR));
+  const ownDir = await _realOr(_defaultKeyDir(username));
+  const within = (base: string) =>
+    real === base || real.startsWith(base + path.sep);
+
+  return within(dataRoot) && !within(ownDir);
+};
 
 const _getEncryptionDir = async (username: string): Promise<string> => {
   const user = await getCurrentUser();
-  if (user?.encryptionSettings?.customKeyPath) {
-    return user.encryptionSettings.customKeyPath;
+  const customPath = user?.encryptionSettings?.customKeyPath;
+
+  if (customPath && !(await _keyPathTrespasses(username, customPath))) {
+    return customPath;
+  }
+
+  if (customPath) {
+    console.warn("Ignoring custom key path inside the data folder for", username);
   }
-  return path.join(process.cwd(), "data", "encryption", username);
+
+  return _defaultKeyDir(username);
 };
 
 export const generateKeyPair = async (
@@ -478,6 +512,13 @@ export const setCustomKeyPath = async (
       return { success: false, error: "Custom path is not accessible" };
     }
 
+    if (await _keyPathTrespasses(user.username, customPath)) {
+      return {
+        success: false,
+        error: "Custom path must be absolute and outside the data folder",
+      };
+    }
+
     const saved = await patchUserFields(user.username, {
       encryptionSettings: {
         method: user.encryptionSettings?.method || "pgp",
diff --git a/app/_server/actions/reminders/scanner.ts b/app/_server/actions/reminders/scanner.ts
index 28dedc3a6..e7f7848a8 100644
--- a/app/_server/actions/reminders/scanner.ts
+++ b/app/_server/actions/reminders/scanner.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import path from "path";
 import fs from "fs/promises";
 import { Item } from "@/app/_types";
diff --git a/app/_server/actions/session/index.ts b/app/_server/actions/session/index.ts
index 55a19f090..4bb6aa19f 100644
--- a/app/_server/actions/session/index.ts
+++ b/app/_server/actions/session/index.ts
@@ -1,156 +1,20 @@
 "use server";
 
-import { cookies, headers } from "next/headers";
+import { cookies } from "next/headers";
 import { Result } from "@/app/_types";
 import { getCurrentUser } from "../users";
 import { logAuthEvent } from "@/app/_server/actions/log";
 import { getSessionCookieName } from "@/app/_utils/env-utils";
-import { mutateSessions, readSessionMap, readSessionMeta } from "./store";
-import type { LoginType, Session, SessionData } from "./store";
-
-export type { LoginType, Session, SessionData };
-
-const _stamp = async (
-  sessionId: string,
-  username: string,
-  loginType: LoginType,
-  rememberMe?: boolean,
-): Promise<SessionData> => {
-  const headersList = await headers();
-  const forwarded = headersList.get("x-forwarded-for");
-  const realIp = headersList.get("x-real-ip");
-  const now = new Date().toISOString();
-
-  return {
-    id: sessionId,
-    username,
-    userAgent: headersList.get("user-agent") || "Unknown",
-    ipAddress: forwarded || realIp || "Unknown",
-    createdAt: now,
-    lastActivity: now,
-    loginType,
-    ...(rememberMe !== undefined && { rememberMe }),
-  };
-};
-
-export const readSessionData = async (): Promise<
-  Record<string, SessionData>
-> => readSessionMeta();
-
-export const readSessions = async (): Promise<Session> => readSessionMap();
-
-export const createSession = async (
-  sessionId: string,
-  username: string,
-  loginType: LoginType,
-  rememberMe?: boolean,
-): Promise<void> => {
-  const sessionData = await _stamp(sessionId, username, loginType, rememberMe);
-
-  await mutateSessions((store) => {
-    store.data[sessionId] = sessionData;
-    store.sessions[sessionId] = username;
-    return true;
-  });
-};
-
-export const swapSession = async (
-  oldSessionId: string,
-  newSessionId: string,
-  username: string,
-  loginType: LoginType,
-  rememberMe?: boolean,
-): Promise<void> => {
-  const sessionData = await _stamp(
-    newSessionId,
-    username,
-    loginType,
-    rememberMe,
-  );
-
-  await mutateSessions((store) => {
-    delete store.data[oldSessionId];
-    delete store.sessions[oldSessionId];
-
-    store.data[newSessionId] = sessionData;
-    store.sessions[newSessionId] = username;
-
-    return true;
-  });
-};
-
-export const updateSessionActivity = async (
-  sessionId: string,
-): Promise<void> => {
-  await mutateSessions((store) => {
-    if (!store.data[sessionId]) return null;
-
-    store.data[sessionId].lastActivity = new Date().toISOString();
-    return true;
-  });
-};
-
-export const removeSession = async (sessionId: string): Promise<void> => {
-  await mutateSessions((store) => {
-    delete store.data[sessionId];
-    delete store.sessions[sessionId];
-    return true;
-  });
-};
+import {
+  getSessionId,
+  getSessionsForUser,
+  readSessionMeta,
+  removeAllSessionsForUser,
+  removeSession,
+} from "./store";
+import type { LoginType, SessionData } from "./store";
 
-export const removeAllSessionsForUser = async (
-  username: string,
-  exceptSessionId?: string,
-): Promise<void> => {
-  await mutateSessions((store) => {
-    const doomed = Object.entries(store.data)
-      .filter(
-        ([id, sessionData]) =>
-          sessionData.username === username &&
-          (!exceptSessionId || id !== exceptSessionId),
-      )
-      .map(([id]) => id);
-
-    for (const sessionId of doomed) {
-      delete store.data[sessionId];
-      delete store.sessions[sessionId];
-    }
-
-    return true;
-  });
-};
-
-export const clearAllSessions = async (): Promise<Result<null>> => {
-  const cleared = await mutateSessions((store) => {
-    store.sessions = {};
-    store.data = {};
-    return true;
-  });
-
-  if (!cleared) {
-    return {
-      success: false,
-      error: "Failed to clear all sessions",
-    };
-  }
-
-  return { success: true };
-};
-
-export const getSessionsForUser = async (
-  username: string,
-): Promise<SessionData[]> => {
-  const sessions = await readSessionMeta();
-
-  return Object.values(sessions).filter(
-    (session) => session.username === username,
-  );
-};
-
-export const getSessionId = async (): Promise<string> => {
-  const cookieName = getSessionCookieName();
-  return (await cookies()).get(cookieName)?.value || "";
-};
+export type CallerSession = SessionData & { isCurrent: boolean };
 
 export const getLoginType = async (): Promise<LoginType | undefined> => {
   const sessionId = await getSessionId();
@@ -160,6 +24,19 @@ export const getLoginType = async (): Promise<LoginType | undefined> => {
   return sessionsData[sessionId]?.loginType;
 };
 
+export const getMySessions = async (): Promise<CallerSession[] | null> => {
+  const currentUser = await getCurrentUser();
+  if (!currentUser) return null;
+
+  const sessionId = await getSessionId();
+  const sessions = await getSessionsForUser(currentUser.username);
+
+  return sessions.map((session) => ({
+    ...session,
+    isCurrent: session.id === sessionId,
+  }));
+};
+
 export const terminateSession = async (
   formData: FormData,
 ): Promise<Result<null>> => {
@@ -182,6 +59,15 @@ export const terminateSession = async (
       };
     }
 
+    const sessionsData = await readSessionMeta();
+
+    if (sessionsData[sessionId]?.username !== currentUser.username) {
+      return {
+        success: false,
+        error: "Session not found",
+      };
+    }
+
     await removeSession(sessionId);
 
     await logAuthEvent("session_terminated", currentUser.username, true);
diff --git a/app/_server/actions/session/store.ts b/app/_server/actions/session/store.ts
index f6c06401f..f04b88581 100644
--- a/app/_server/actions/session/store.ts
+++ b/app/_server/actions/session/store.ts
@@ -1,7 +1,10 @@
 import { lock, unlock } from "proper-lockfile";
 import fs from "fs/promises";
 import path from "path";
+import { cookies, headers } from "next/headers";
+import { Result } from "@/app/_types";
 import { SESSION_DATA_FILE, SESSIONS_FILE } from "@/app/_consts/files";
+import { getSessionCookieName } from "@/app/_utils/env-utils";
 import { readJsonFile, writeJsonFile } from "../file";
 
 export type LoginType = "local" | "sso" | "ldap" | "pending-mfa";
@@ -96,3 +99,145 @@ export const mutateSessions = async <T>(
     }
   }
 };
+
+const _stamp = async (
+  sessionId: string,
+  username: string,
+  loginType: LoginType,
+  rememberMe?: boolean,
+): Promise<SessionData> => {
+  const headersList = await headers();
+  const forwarded = headersList.get("x-forwarded-for");
+  const realIp = headersList.get("x-real-ip");
+  const now = new Date().toISOString();
+
+  return {
+    id: sessionId,
+    username,
+    userAgent: headersList.get("user-agent") || "Unknown",
+    ipAddress: forwarded || realIp || "Unknown",
+    createdAt: now,
+    lastActivity: now,
+    loginType,
+    ...(rememberMe !== undefined && { rememberMe }),
+  };
+};
+
+export const readSessionData = async (): Promise<
+  Record<string, SessionData>
+> => readSessionMeta();
+
+export const readSessions = async (): Promise<Session> => readSessionMap();
+
+export const createSession = async (
+  sessionId: string,
+  username: string,
+  loginType: LoginType,
+  rememberMe?: boolean,
+): Promise<void> => {
+  const sessionData = await _stamp(sessionId, username, loginType, rememberMe);
+
+  await mutateSessions((store) => {
+    store.data[sessionId] = sessionData;
+    store.sessions[sessionId] = username;
+    return true;
+  });
+};
+
+export const swapSession = async (
+  oldSessionId: string,
+  newSessionId: string,
+  username: string,
+  loginType: LoginType,
+  rememberMe?: boolean,
+): Promise<void> => {
+  const sessionData = await _stamp(
+    newSessionId,
+    username,
+    loginType,
+    rememberMe,
+  );
+
+  await mutateSessions((store) => {
+    delete store.data[oldSessionId];
+    delete store.sessions[oldSessionId];
+
+    store.data[newSessionId] = sessionData;
+    store.sessions[newSessionId] = username;
+
+    return true;
+  });
+};
+
+export const updateSessionActivity = async (
+  sessionId: string,
+): Promise<void> => {
+  await mutateSessions((store) => {
+    if (!store.data[sessionId]) return null;
+
+    store.data[sessionId].lastActivity = new Date().toISOString();
+    return true;
+  });
+};
+
+export const removeSession = async (sessionId: string): Promise<void> => {
+  await mutateSessions((store) => {
+    delete store.data[sessionId];
+    delete store.sessions[sessionId];
+    return true;
+  });
+};
+
+export const removeAllSessionsForUser = async (
+  username: string,
+  exceptSessionId?: string,
+): Promise<void> => {
+  await mutateSessions((store) => {
+    const doomed = Object.entries(store.data)
+      .filter(
+        ([id, sessionData]) =>
+          sessionData.username === username &&
+          (!exceptSessionId || id !== exceptSessionId),
+      )
+      .map(([id]) => id);
+
+    for (const sessionId of doomed) {
+      delete store.data[sessionId];
+      delete store.sessions[sessionId];
+    }
+
+    return true;
+  });
+};
+
+export const clearAllSessions = async (): Promise<Result<null>> => {
+  const cleared = await mutateSessions((store) => {
+    store.sessions = {};
+    store.data = {};
+    return true;
+  });
+
+  if (!cleared) {
+    return {
+      success: false,
+      error: "Failed to clear all sessions",
+    };
+  }
+
+  return { success: true };
+};
+
+export const getSessionsForUser = async (
+  username: string,
+): Promise<SessionData[]> => {
+  const sessions = await readSessionMeta();
+
+  return Object.values(sessions).filter(
+    (session) => session.username === username,
+  );
+};
+
+export const getSessionId = async (): Promise<string> => {
+  const cookieName = getSessionCookieName();
+  return (await cookies()).get(cookieName)?.value || "";
+};
diff --git a/app/_server/actions/share/access.ts b/app/_server/actions/share/access.ts
index 15f028398..faa8707a2 100644
--- a/app/_server/actions/share/access.ts
+++ b/app/_server/actions/share/access.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import path from "path";
 import { Modes, PermissionTypes } from "@/app/_types/enums";
 import { SharingPermissions } from "@/app/_types/core";
diff --git a/app/_server/actions/share/category-info.ts b/app/_server/actions/share/category-info.ts
index 7175fe612..b77aa61c8 100644
--- a/app/_server/actions/share/category-info.ts
+++ b/app/_server/actions/share/category-info.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import path from "path";
 import fs from "fs/promises";
 import { randomUUID } from "crypto";
diff --git a/app/_server/actions/share/lookups.ts b/app/_server/actions/share/lookups.ts
new file mode 100644
index 000000000..1b669aa91
--- /dev/null
+++ b/app/_server/actions/share/lookups.ts
@@ -0,0 +1,44 @@
+"use server";
+
+import { ItemType } from "@/app/_types/core";
+import { ItemTypes, Modes, PermissionTypes } from "@/app/_types/enums";
+import { FolderShares, ItemShares } from "@/app/_types/sharing";
+import { getUsername } from "@/app/_server/actions/users";
+import {
+  canReach,
+  folderShares as _folderShares,
+  itemShares as _itemShares,
+  usersWithAccess as _usersWithAccess,
+} from "./queries";
+
+const _canRead = async (uuid: string, itemType: ItemType): Promise<boolean> => {
+  const username = await getUsername();
+  if (!username) return false;
+
+  return canReach(uuid, itemType, username, PermissionTypes.READ);
+};
+
+export const usersWithAccess = async (
+  uuid: string,
+  itemType: ItemType = ItemTypes.CHECKLIST,
+): Promise<string[]> => {
+  if (!(await _canRead(uuid, itemType))) return [];
+
+  return _usersWithAccess(uuid, itemType);
+};
+
+export const itemShares = async (
+  uuid: string,
+  itemType: ItemType,
+): Promise<ItemShares> => {
+  if (!(await _canRead(uuid, itemType))) {
+    return { users: {}, isPublic: false, inherited: false };
+  }
+
+  return _itemShares(uuid, itemType);
+};
+
+export const folderShares = async (
+  mode: Modes,
+  categoryPath: string,
+): Promise<FolderShares> => _folderShares(mode, categoryPath);
diff --git a/app/_server/actions/share/queries.ts b/app/_server/actions/share/queries.ts
index e6b07104a..740e9b16d 100644
--- a/app/_server/actions/share/queries.ts
+++ b/app/_server/actions/share/queries.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import path from "path";
 import { cache } from "react";
 import { ItemType, SharingPermissions } from "@/app/_types/core";
diff --git a/app/_server/actions/share/target.ts b/app/_server/actions/share/target.ts
index 8e2534382..3c732a772 100644
--- a/app/_server/actions/share/target.ts
+++ b/app/_server/actions/share/target.ts
@@ -22,6 +22,12 @@ export interface TargetLocation {
 const _inside = (base: string, category: string): boolean =>
   !category || isPathSafe(base, category);
 
+const _plainSegments = (relative: string): boolean =>
+  !/[\\\0]/.test(relative) &&
+  relative
+    .split("/")
+    .every((segment) => segment !== "" && segment !== "." && segment !== "..");
+
 const _matches = (mount: SharedMount, category: string): boolean =>
   category === mount.displayName ||
   category.startsWith(`${mount.displayName}/`);
@@ -68,13 +74,23 @@ export const targetDir = async (
   if (!mount) return own;
 
   const relative = category.slice(mount.displayName.length).replace(/^\//, "");
+  const stranded: TargetLocation = { ...own, dir: home, category: "" };
+
+  if (relative && !_plainSegments(relative)) return stranded;
+
   const owned = mount.isImplicit
     ? ""
     : [mount.categoryPath, relative].filter(Boolean).join("/");
 
   const lodgings = path.join(process.cwd(), userDirFor(mode, mount.owner));
+  const sharedRoot = mount.isImplicit
+    ? lodgings
+    : path.join(lodgings, mount.categoryPath);
 
-  if (!_inside(lodgings, owned)) return own;
+  if (!_inside(lodgings, owned)) return stranded;
+  if (!mount.isImplicit && !isPathSafe(sharedRoot, path.join(lodgings, owned))) {
+    return stranded;
+  }
 
   return {
     dir: path.join(lodgings, owned),
diff --git a/app/_server/actions/stats/index.ts b/app/_server/actions/stats/index.ts
index 601640856..2290cdc32 100644
--- a/app/_server/actions/stats/index.ts
+++ b/app/_server/actions/stats/index.ts
@@ -2,7 +2,7 @@
 
 import { getUserNotes } from "@/app/_server/actions/note/queries";
 import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
-import { getCurrentUser } from "@/app/_server/actions/users";
+import { canAccessAllContent, getCurrentUser } from "@/app/_server/actions/users";
 import { isKanbanType, TaskStatus } from "@/app/_types/enums";
 import { Checklist, Result } from "@/app/_types";
 
@@ -43,6 +43,10 @@ export const getUserStats = async (
 
     const targetUsername = username || currentUser.username;
 
+    if (targetUsername !== currentUser.username && !(await canAccessAllContent())) {
+      return { success: false, error: "Permission denied" };
+    }
+
     const notesResult = await getUserNotes({ username: targetUsername });
     if (!notesResult.success || !notesResult.data) {
       return {
diff --git a/app/_server/actions/upload/index.ts b/app/_server/actions/upload/index.ts
index 8d014e745..160715a4f 100644
--- a/app/_server/actions/upload/index.ts
+++ b/app/_server/actions/upload/index.ts
@@ -4,7 +4,8 @@ import path from "path";
 import fs from "fs/promises";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { Modes } from "@/app/_types/enums";
-import { getUserModeDir } from "../file";
+import { getUserModeDir, serverDeleteFile } from "../file";
+import { resolvePath } from "@/app/_utils/path-utils";
 import {
   MAX_FILE_SIZE,
   ALLOWED_IMAGE_TYPES,
@@ -310,7 +311,7 @@ export const deleteFile = async (formData: FormData) => {
     }
 
     const userDir = await getUserModeDir(Modes.NOTES);
-    const targetDir = path.join(
+    const targetDir = path.resolve(
       userDir,
       fileType === "image"
         ? "images"
@@ -318,9 +319,22 @@ export const deleteFile = async (formData: FormData) => {
         ? "videos"
         : "files"
     );
-    const filePath = path.join(targetDir, fileName);
+    const resolved = resolvePath(targetDir, fileName);
+
+    if (
+      !resolved.ok ||
+      /[\\/]/.test(resolved.decodedInput) ||
+      path.dirname(resolved.absolutePath) !== targetDir
+    ) {
+      return { success: false, error: "Invalid file name" };
+    }
+
+    const stats = await fs.stat(resolved.absolutePath);
+    if (!stats.isFile()) {
+      return { success: false, error: "File not found" };
+    }
 
-    await fs.unlink(filePath);
+    await serverDeleteFile(resolved.absolutePath);
     return { success: true, data: null };
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
diff --git a/app/_server/actions/users/core.ts b/app/_server/actions/users/core.ts
new file mode 100644
index 000000000..ddaeff9e5
--- /dev/null
+++ b/app/_server/actions/users/core.ts
@@ -0,0 +1,143 @@
+import {
+  CHECKLISTS_DIR,
+  NOTES_DIR,
+  USERS_FILE,
+} from "@/app/_consts/files";
+import {
+  readJsonFile,
+  serverDeleteDir,
+  serverRenamePath,
+  writeJsonFile,
+} from "../file";
+import { Result, SanitisedUser, User } from "@/app/_types";
+import { sanitizeUserForClient } from "@/app/_utils/user-sanitize-utils";
+import { removeAllSessionsForUser } from "../session/store";
+import { getUserIndex } from "./helpers";
+import { mutateUsers } from "./records";
+
+export type UserUpdatePayload = {
+  username?: string;
+  passwordHash?: string;
+  isAdmin?: boolean;
+  avatarUrl?: string;
+};
+
+export async function _deleteUserCore(username: string): Promise<Result<null>> {
+  const allUsers = await readJsonFile(USERS_FILE);
+  const userIndex = await getUserIndex(username);
+
+  if (userIndex === -1) {
+    return { success: false, error: "User not found" };
+  }
+
+  const userToDelete = allUsers[userIndex];
+
+  if (userToDelete.isSuperAdmin) {
+    return { success: false, error: "Cannot delete the super admin (system owner)" };
+  }
+
+  if (userToDelete.isAdmin) {
+    const adminCount = allUsers.filter((user: User) => user.isAdmin).length;
+    if (adminCount === 1) {
+      return { success: false, error: "Cannot delete the last admin user" };
+    }
+  }
+
+  await removeAllSessionsForUser(username);
+
+  try {
+    await serverDeleteDir(CHECKLISTS_DIR(username));
+    await serverDeleteDir(NOTES_DIR(username));
+  } catch (error) {
+    console.warn(
+      `Warning: Could not clean up data files for ${username}:`,
+      error
+    );
+  }
+
+  try {
+    const { revokeGrants } = await import("@/app/_server/actions/share/rename");
+
+    await revokeGrants(username);
+  } catch (error) {
+    console.error(`Could not revoke shares granted to ${username}:`, error);
+  }
+
+  const removed = await mutateUsers((users) => {
+    const index = users.findIndex((user: User) => user.username === username);
+    if (index === -1) return null;
+
+    users.splice(index, 1);
+    return true;
+  });
+
+  if (!removed) return { success: false, error: "Failed to delete user" };
+
+  return { success: true, data: null };
+}
+
+export async function _updateUserCore(
+  targetUsername: string,
+  updates: UserUpdatePayload
+): Promise<Result<SanitisedUser>> {
+  if (Object.keys(updates).length === 0) {
+    return { success: false, error: "No updates provided." };
+  }
+
+  const allUsers = await readJsonFile(USERS_FILE);
+  const userIndex = await getUserIndex(targetUsername);
+
+  if (updates.username && updates.username !== targetUsername) {
+    const usernameExists = allUsers.some(
+      (user: User) => user.username === updates.username
+    );
+    if (usernameExists) {
+      return { success: false, error: "Username already exists" };
+    }
+
+    try {
+      const oldChecklistsPath = CHECKLISTS_DIR(targetUsername);
+      const newChecklistsPath = CHECKLISTS_DIR(updates.username);
+      await serverRenamePath(oldChecklistsPath, newChecklistsPath);
+    } catch (error) {
+      console.warn(
+        `Could not rename checklists directory for ${targetUsername}:`,
+        error
+      );
+    }
+
+    try {
+      const oldNotesPath = NOTES_DIR(targetUsername);
+      const newNotesPath = NOTES_DIR(updates.username);
+      await serverRenamePath(oldNotesPath, newNotesPath);
+    } catch (error) {
+      console.warn(
+        `Could not rename notes directory for ${targetUsername}:`,
+        error
+      );
+    }
+
+    try {
+      const { renameGrants } = await import(
+        "@/app/_server/actions/share/rename"
+      );
+
+      await renameGrants(targetUsername, updates.username);
+    } catch (error) {
+      console.warn(
+        `Could not update sharing data for username change ${targetUsername} -> ${updates.username}:`,
+        error
+      );
+    }
+  }
+
+  const updatedUser: User = {
+    ...allUsers[userIndex],
+    ...updates,
+  };
+
+  allUsers[userIndex] = updatedUser;
+  await writeJsonFile(allUsers, USERS_FILE);
+
+  return { success: true, data: sanitizeUserForClient(updatedUser)! };
+}
diff --git a/app/_server/actions/users/crud.ts b/app/_server/actions/users/crud.ts
index 0c0264998..7c3f92113 100644
--- a/app/_server/actions/users/crud.ts
+++ b/app/_server/actions/users/crud.ts
@@ -5,150 +5,20 @@ import {
   NOTES_DIR,
   USERS_FILE,
 } from "@/app/_consts/files";
-import {
-  readJsonFile,
-  serverDeleteDir,
-  serverRenamePath,
-  writeJsonFile,
-} from "../file";
+import { readJsonFile, writeJsonFile } from "../file";
 import { Result, SanitisedUser, User } from "@/app/_types";
 import { sanitizeUserForClient } from "@/app/_utils/user-sanitize-utils";
-import { removeAllSessionsForUser } from "../session";
 import { createHash } from "crypto";
 import { ItemTypes } from "@/app/_types/enums";
 import { DEFAULT_WEEK_START } from "@/app/_consts/calendar";
 import { getFormData } from "@/app/_utils/global-utils";
 import { logUserEvent } from "@/app/_server/actions/log";
-import { getUserIndex } from "./helpers";
+import { _deleteUserCore, _updateUserCore } from "./core";
+import type { UserUpdatePayload } from "./core";
 import { getCurrentUser } from "./queries";
 import { findUserRecord, mutateUsers } from "./records";
 
-export type UserUpdatePayload = {
-  username?: string;
-  passwordHash?: string;
-  isAdmin?: boolean;
-  avatarUrl?: string;
-};
-
-export async function _deleteUserCore(username: string): Promise<Result<null>> {
-  const allUsers = await readJsonFile(USERS_FILE);
-  const userIndex = await getUserIndex(username);
-
-  if (userIndex === -1) {
-    return { success: false, error: "User not found" };
-  }
-
-  const userToDelete = allUsers[userIndex];
-
-  if (userToDelete.isSuperAdmin) {
-    return { success: false, error: "Cannot delete the super admin (system owner)" };
-  }
-
-  if (userToDelete.isAdmin) {
-    const adminCount = allUsers.filter((user: User) => user.isAdmin).length;
-    if (adminCount === 1) {
-      return { success: false, error: "Cannot delete the last admin user" };
-    }
-  }
-
-  await removeAllSessionsForUser(username);
-
-  try {
-    await serverDeleteDir(CHECKLISTS_DIR(username));
-    await serverDeleteDir(NOTES_DIR(username));
-  } catch (error) {
-    console.warn(
-      `Warning: Could not clean up data files for ${username}:`,
-      error
-    );
-  }
-
-  try {
-    const { revokeGrants } = await import("@/app/_server/actions/share/rename");
-
-    await revokeGrants(username);
-  } catch (error) {
-    console.error(`Could not revoke shares granted to ${username}:`, error);
-  }
-
-  const removed = await mutateUsers((users) => {
-    const index = users.findIndex((user: User) => user.username === username);
-    if (index === -1) return null;
-
-    users.splice(index, 1);
-    return true;
-  });
-
-  if (!removed) return { success: false, error: "Failed to delete user" };
-
-  return { success: true, data: null };
-}
-
-export async function _updateUserCore(
-  targetUsername: string,
-  updates: UserUpdatePayload
-): Promise<Result<SanitisedUser>> {
-  if (Object.keys(updates).length === 0) {
-    return { success: false, error: "No updates provided." };
-  }
-
-  const allUsers = await readJsonFile(USERS_FILE);
-  const userIndex = await getUserIndex(targetUsername);
-
-  if (updates.username && updates.username !== targetUsername) {
-    const usernameExists = allUsers.some(
-      (user: User) => user.username === updates.username
-    );
-    if (usernameExists) {
-      return { success: false, error: "Username already exists" };
-    }
-
-    try {
-      const oldChecklistsPath = CHECKLISTS_DIR(targetUsername);
-      const newChecklistsPath = CHECKLISTS_DIR(updates.username);
-      await serverRenamePath(oldChecklistsPath, newChecklistsPath);
-    } catch (error) {
-      console.warn(
-        `Could not rename checklists directory for ${targetUsername}:`,
-        error
-      );
-    }
-
-    try {
-      const oldNotesPath = NOTES_DIR(targetUsername);
-      const newNotesPath = NOTES_DIR(updates.username);
-      await serverRenamePath(oldNotesPath, newNotesPath);
-    } catch (error) {
-      console.warn(
-        `Could not rename notes directory for ${targetUsername}:`,
-        error
-      );
-    }
-
-    try {
-      const { renameGrants } = await import(
-        "@/app/_server/actions/share/rename"
-      );
-
-      await renameGrants(targetUsername, updates.username);
-    } catch (error) {
-      console.warn(
-        `Could not update sharing data for username change ${targetUsername} -> ${updates.username}:`,
-        error
-      );
-    }
-  }
-
-  const updatedUser: User = {
-    ...allUsers[userIndex],
-    ...updates,
-  };
-
-  allUsers[userIndex] = updatedUser;
-  await writeJsonFile(allUsers, USERS_FILE);
-
-  return { success: true, data: sanitizeUserForClient(updatedUser)! };
-}
+export type { UserUpdatePayload };
 
 export const createUser = async (
   formData: FormData
diff --git a/app/_server/actions/users/ensure-user.ts b/app/_server/actions/users/ensure-user.ts
index fffefd009..89d2d7388 100644
--- a/app/_server/actions/users/ensure-user.ts
+++ b/app/_server/actions/users/ensure-user.ts
@@ -1,4 +1,3 @@
-"use server";
 import { lock, unlock } from "proper-lockfile";
 import { CHECKLISTS_FOLDER } from "@/app/_consts/checklists";
 import { NOTES_FOLDER } from "@/app/_consts/notes";
diff --git a/app/_server/actions/users/helpers.ts b/app/_server/actions/users/helpers.ts
index 555bf398c..fc0bc0f66 100644
--- a/app/_server/actions/users/helpers.ts
+++ b/app/_server/actions/users/helpers.ts
@@ -1,6 +1,6 @@
-"use server";
-
-import { USERS_FILE, NOTES_DIR, CHECKLISTS_DIR } from "@/app/_consts/files";
+import path from "path";
+import { DATA_DIR, USERS_FILE } from "@/app/_consts/files";
+import { modeFor } from "@/app/_utils/sharing-utils";
 import { readJsonFile } from "../file";
 import { Result, ItemType, User, PublicUserInfo } from "@/app/_types";
 import { ItemTypes } from "@/app/_types/enums";
@@ -13,12 +13,15 @@ export const getUserIndex = async (username: string): Promise<number> => {
   return allUsers.findIndex((user: User) => user.username === username);
 };
 
-const findUuidInDirectory = async (
-  dir: string,
-  targetUuid: string
-): Promise<boolean> => {
+const _ownerOnDisk = async (
+  uuid: string,
+  itemType: ItemType
+): Promise<string | null> => {
   const { grepFindFileByUuid } = await import("@/app/_utils/grep-utils");
-  return (await grepFindFileByUuid(dir, targetUuid)) !== null;
+  const modeDir = path.join(process.cwd(), DATA_DIR, modeFor(itemType));
+  const found = await grepFindFileByUuid(modeDir, uuid);
+
+  return found ? path.relative(modeDir, found.filePath).split(path.sep)[0] : null;
 };
 
 export const getUserByItemUuid = async (
@@ -26,30 +29,22 @@ export const getUserByItemUuid = async (
   itemType: ItemType
 ): Promise<Result<PublicUserInfo>> => {
   try {
-    const users = await readJsonFile(USERS_FILE);
+    const owner = await _ownerOnDisk(uuid, itemType);
+    const users: User[] = owner ? await readJsonFile(USERS_FILE) : [];
+    const user = users.find((candidate) => candidate.username === owner);
 
-    for (const user of users) {
-      try {
-        const userDir =
-          itemType === ItemTypes.NOTE
-            ? NOTES_DIR(user.username)
-            : CHECKLISTS_DIR(user.username);
+    if (user) {
+      return { success: true, data: toPublicUser(user)! };
+    }
 
-        const found = await findUuidInDirectory(userDir, uuid);
-        if (found) {
-          return { success: true, data: toPublicUser(user)! };
-        }
-      } catch (error) {
-        await logAudit({
-          level: "DEBUG",
-          action: "user_item_check",
-          category: "user",
-          success: false,
-          errorMessage: `Error checking items for user: ${user.username}`,
-          metadata: { error: String(error) }
-        });
-        continue;
-      }
+    if (owner) {
+      await logAudit({
+        level: "DEBUG",
+        action: "user_item_check",
+        category: "user",
+        success: false,
+        errorMessage: `Item folder has no matching user: ${owner}`,
+      });
     }
 
     return {
diff --git a/app/_server/actions/users/index.ts b/app/_server/actions/users/index.ts
index 2cc9397de..673a999df 100644
--- a/app/_server/actions/users/index.ts
+++ b/app/_server/actions/users/index.ts
@@ -1,7 +1,5 @@
 export type { UserUpdatePayload } from "./crud";
 
-export { ensureUser } from "./ensure-user";
-
 export {
   createUser,
   deleteUser,
@@ -24,5 +22,3 @@ export {
 export { isAuthenticated, isAdmin, canAccessAllContent } from "./auth";
 
 export { updateUserSettings } from "./settings";
-
-export { getUserIndex, getUserByItemUuid } from "./helpers";
diff --git a/app/_server/actions/users/queries.ts b/app/_server/actions/users/queries.ts
index 3d5579413..f649544cc 100644
--- a/app/_server/actions/users/queries.ts
+++ b/app/_server/actions/users/queries.ts
@@ -37,6 +37,8 @@ export const getUsername = async (): Promise<string> => {
 };
 
 export const getUsers = async (): Promise<PublicUserInfo[]> => {
+  if (!(await getCurrentUserRecord())) return [];
+
   const users = (await readJsonFile(USERS_FILE)) || [];
 
   if (!users || !Array.isArray(users)) {
diff --git a/app/_server/actions/users/records.ts b/app/_server/actions/users/records.ts
index d35939ad3..863fa88f0 100644
--- a/app/_server/actions/users/records.ts
+++ b/app/_server/actions/users/records.ts
@@ -4,7 +4,7 @@ import path from "path";
 import { USERS_FILE } from "@/app/_consts/files";
 import { readJsonFile, writeJsonFile } from "../file";
 import { User } from "@/app/_types";
-import { getSessionId, readSessions } from "../session";
+import { getSessionId, readSessions } from "../session/store";
 
 const LOCK_RETRIES = { retries: 10, minTimeout: 50, maxTimeout: 500 };
 
diff --git a/app/_server/actions/uuid-clash/scan.ts b/app/_server/actions/uuid-clash/scan.ts
index 05aecabb2..ef57be21b 100644
--- a/app/_server/actions/uuid-clash/scan.ts
+++ b/app/_server/actions/uuid-clash/scan.ts
@@ -23,17 +23,20 @@ export interface ClashFile {
   title: string;
   createdAt?: string;
   keeps: boolean;
+  owner?: string;
 }
 
 export interface UuidClash {
   uuid: string;
   owner: string;
+  owners?: string[];
   files: ClashFile[];
 }
 
 interface Claim {
   root: ItemRoot;
   filePath: string;
+  owner?: string;
 }
 
 export const itemRoots = (owner: string): ItemRoot[] => [
@@ -44,7 +47,7 @@ export const itemRoots = (owner: string): ItemRoot[] => [
 export const shownPath = (root: ItemRoot, filePath: string): string =>
   [root.mode, ...path.relative(root.dir, filePath).split(path.sep)].join("/");
 
-const _claimsIn = async (root: ItemRoot): Promise<Array<[string, Claim]>> => {
+const _claimsIn = async (root: ItemRoot, owner?: string): Promise<Array<[string, Claim]>> => {
   const out = await boxedShell(UUID_LINES, [root.dir], { maxBuffer: SCAN_BUFFER }).catch((error) => {
     console.error(`Duplicate uuid scan could not read ${root.dir}:`, error);
     return "";
@@ -55,7 +58,7 @@ const _claimsIn = async (root: ItemRoot): Promise<Array<[string, Claim]>> => {
     .map((line): [string, Claim] => {
       const cut = line.lastIndexOf(UUID_MARK);
       const uuid = line.slice(cut + UUID_MARK.length).trim().replace(/^["']|["']$/g, "").toLowerCase();
-      return [uuid, { root, filePath: line.slice(0, cut) }];
+      return [uuid, { root, filePath: line.slice(0, cut), owner }];
     });
 };
 
@@ -91,17 +94,49 @@ const _confirmed = async (uuid: string, owner: string, claims: Claim[]): Promise
         title: titleOf(parsed?.metadata, parsed?.contentWithoutMetadata || "", path.basename(filePath, ".md")),
         createdAt: _createdOf(parsed?.metadata.createdAt),
         keeps: index === 0,
+        ...(claim.owner && { owner: claim.owner }),
       };
     }),
   };
 };
 
-export const findClashes = async (owner: string): Promise<UuidClash[]> => {
-  const claims = (await Promise.all(itemRoots(owner).map(_claimsIn))).flat();
+const _grouped = (claims: Array<[string, Claim]>): Map<string, Claim[]> => {
   const grouped = new Map<string, Claim[]>();
   claims.forEach(([uuid, claim]) => grouped.set(uuid, [...(grouped.get(uuid) || []), claim]));
+  return grouped;
+};
+
+export const findClashes = async (owner: string): Promise<UuidClash[]> => {
+  const claims = (await Promise.all(itemRoots(owner).map((root) => _claimsIn(root)))).flat();
+  const grouped = _grouped(claims);
 
   const suspects = Array.from(grouped).filter(([, group]) => group.length > 1);
   const found = await Promise.all(suspects.map(([uuid, group]) => _confirmed(uuid, owner, group)));
   return found.filter((clash): clash is UuidClash => clash !== null);
 };
+
+export const findCrossUserClashes = async (usernames: string[]): Promise<UuidClash[]> => {
+  const claims = (
+    await Promise.all(
+      usernames.flatMap((username) => itemRoots(username).map((root) => _claimsIn(root, username))),
+    )
+  ).flat();
+
+  const suspects = Array.from(_grouped(claims)).filter(
+    ([, group]) => new Set(group.map((claim) => claim.owner)).size > 1,
+  );
+
+  const found = await Promise.all(
+    suspects.map(async ([uuid, group]): Promise<UuidClash | null> => {
+      const clash = await _confirmed(uuid, "", group);
+      if (!clash) return null;
+
+      const owners = Array.from(new Set(clash.files.map((file) => file.owner!)));
+      if (owners.length < 2) return null;
+
+      const keeper = clash.files.find((file) => file.keeps)!;
+      return { ...clash, owner: keeper.owner!, owners };
+    }),
+  );
+  return found.filter((clash): clash is UuidClash => clash !== null);
+};
diff --git a/app/_server/actions/xchacha/index.ts b/app/_server/actions/xchacha/index.ts
index 333a82b3c..a70ae808b 100644
--- a/app/_server/actions/xchacha/index.ts
+++ b/app/_server/actions/xchacha/index.ts
@@ -3,6 +3,7 @@
 import _sodium from "libsodium-wrappers-sumo";
 import { Result } from "@/app/_types";
 import { logAudit } from "@/app/_server/actions/log";
+import { getCurrentUser } from "@/app/_server/actions/users";
 
 let sodium: any;
 const getSodium = async () => {
@@ -17,6 +18,8 @@ export const encryptXChaCha = async (
   formData: FormData
 ): Promise<Result<{ encryptedContent: string }>> => {
   try {
+    if (!(await getCurrentUser())) return { success: false, error: "Not authenticated" };
+
     const sod = await getSodium();
     const content = formData.get("content") as string;
     const passphrase = formData.get("passphrase") as string;
@@ -84,6 +87,8 @@ export const decryptXChaCha = async (
   formData: FormData
 ): Promise<Result<{ decryptedContent: string }>> => {
   try {
+    if (!(await getCurrentUser())) return { success: false, error: "Not authenticated" };
+
     const sod = await getSodium();
     const encryptedString = formData.get("encryptedContent") as string;
     const passphrase = formData.get("passphrase") as string;
diff --git a/app/_server/api/define-route.ts b/app/_server/api/define-route.ts
index f4c00548a..3717b434c 100644
--- a/app/_server/api/define-route.ts
+++ b/app/_server/api/define-route.ts
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
-import { authenticateApiKey } from "@/app/_server/actions/api";
+import { authenticateApiKey } from "@/app/_server/actions/api/authenticate";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { API_KEY_HEADER } from "@/app/_utils/api-utils";
 import { sanitizeUserForClient } from "@/app/_utils/user-sanitize-utils";
diff --git a/app/_translations/en.json b/app/_translations/en.json
index 98fa4bd97..475fd56a4 100644
--- a/app/_translations/en.json
+++ b/app/_translations/en.json
@@ -1169,6 +1169,7 @@
     "invalidEditorSettings": "Editor settings must be an object, nothing was saved",
     "invalidEditorSetting": "Editor setting {field} has the wrong type, nothing was saved",
     "categoryOutOfBounds": "That category is outside your notes, so nothing was created",
+    "filenameOutOfBounds": "That title would put the file outside its category, so nothing was saved",
     "requiredField": "This field is required",
     "emailInvalid": "Please enter a valid email",
     "passwordTooShort": "Password must be at least 8 characters",
diff --git a/app/_utils/api-utils.ts b/app/_utils/api-utils.ts
index d036a0769..e571f7976 100644
--- a/app/_utils/api-utils.ts
+++ b/app/_utils/api-utils.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { authenticateApiKey } from "@/app/_server/actions/api";
+import { authenticateApiKey } from "@/app/_server/actions/api/authenticate";
 import { getSettings } from "@/app/_server/actions/config";
 import { getCurrentUser } from "@/app/_server/actions/users";
 import { resolveApiId } from "@/app/_server/actions/lib/legacy-lookup";
diff --git a/app/_utils/category-utils.ts b/app/_utils/category-utils.ts
index 1c0064992..8cec5cde2 100644
--- a/app/_utils/category-utils.ts
+++ b/app/_utils/category-utils.ts
@@ -1,5 +1,3 @@
-"use server";
-
 import { Category } from "../_types";
 import { serverReadDir, readOrderFile } from "../_server/actions/file";
 import path from "path";
diff --git a/app/_utils/filename-utils.ts b/app/_utils/filename-utils.ts
index 421da2e87..d50681356 100644
--- a/app/_utils/filename-utils.ts
+++ b/app/_utils/filename-utils.ts
@@ -5,6 +5,8 @@ import { FileRenameMode } from "@/app/_types";
 
 const invalidFilenameChars = /[<>:"/\\|?*\x00-\x1F]/g;
 const leadingTrailingJunk = /^[. ]+|[. ]+$/g;
+const pathBreakers = /[/\\\x00]/g;
+const leadingDots = /^\.+/;
 
 export const sanitizeFilename = (title: string, mode: FileRenameMode = "none"): string => {
   if (!title) return "";
@@ -29,7 +31,7 @@ export const sanitizeFilename = (title: string, mode: FileRenameMode = "none"):
         .trim();
 
     case "none":
-      return title;
+      return title.replace(pathBreakers, "").replace(leadingDots, "");
 
     default:
       return title
diff --git a/app/_utils/path-utils.ts b/app/_utils/path-utils.ts
index 2d1cc5847..8177a6157 100644
--- a/app/_utils/path-utils.ts
+++ b/app/_utils/path-utils.ts
@@ -34,6 +34,10 @@ export const resolvePath = (
     return { ok: false, reason: "invalid_encoding" };
   }
 
+  if (decodedInput.includes("\0")) {
+    return { ok: false, reason: "invalid_encoding" };
+  }
+
   const candidatePath = path.resolve(baseDir, decodedInput);
   const isInside =
     candidatePath === baseDir ||
diff --git a/app/api/admin/duplicate-uuids/route.ts b/app/api/admin/duplicate-uuids/route.ts
index fdca7d7d1..d8d9db234 100644
--- a/app/api/admin/duplicate-uuids/route.ts
+++ b/app/api/admin/duplicate-uuids/route.ts
@@ -1,7 +1,8 @@
 import { NextResponse } from "next/server";
 import { getUserIndex } from "@/app/_server/actions/users/helpers";
 import { adminPeek } from "@/app/_server/actions/lib/admin-peek";
-import { findClashes } from "@/app/_server/actions/uuid-clash/scan";
+import { findClashes, findCrossUserClashes } from "@/app/_server/actions/uuid-clash/scan";
+import { everyUsername } from "@/app/_server/actions/lib/audit-trail";
 import { NOT_CLAIMANT, NO_CLASH, repairClash } from "@/app/_server/actions/uuid-clash/repair";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
@@ -34,7 +35,7 @@ export const GET = defineRoute(
     tag: ApiTag.ADMIN,
     summary: "Find items that share a uuid",
     description:
-      "Two files with the same uuid in their frontmatter, usually because a script copied one. The file with the oldest createdAt keeps the uuid, so every get, link and brain view opens that one, and the others stay hidden until you repair them. Anybody can check their own files. Naming somebody else needs an admin allowed to see other users' content.",
+      "Two files with the same uuid in their frontmatter, usually because a script copied one. The file with the oldest createdAt keeps the uuid, so every get, link and brain view opens that one, and the others stay hidden until you repair them. Anybody can check their own files. Naming somebody else needs an admin allowed to see other users' content. With acrossUsers an admin allowed to see other users' content gets the uuids that files of different users share, which can make a permission check and a write land on different files until repaired.",
     query: clashQuery,
     responses: {
       200: { description: "Duplicated uuids and the files holding them", schema: clashListSchema },
@@ -44,6 +45,12 @@ export const GET = defineRoute(
     },
   },
   async ({ user, query }) => {
+    if (query.acrossUsers) {
+      if (!(await adminPeek(user))) return refuse(ADMIN_ONLY, 403);
+      const duplicates = await findCrossUserClashes(await everyUsername());
+      return NextResponse.json({ duplicates, total: duplicates.length });
+    }
+
     const owner = await _whose(user, query.username);
     if (typeof owner !== "string") return owner;
     const duplicates = await findClashes(owner);
diff --git a/app/api/auth/check-session/route.ts b/app/api/auth/check-session/route.ts
index 7fb3158ff..1d1d72378 100644
--- a/app/api/auth/check-session/route.ts
+++ b/app/api/auth/check-session/route.ts
@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { cookies } from "next/headers";
-import { readSessions } from "@/app/_server/actions/session";
+import { readSessions } from "@/app/_server/actions/session/store";
 import { getSessionCookieName } from "@/app/_utils/env-utils";
 
 type Session = Record<string, string>;
diff --git a/app/api/categories/route.ts b/app/api/categories/route.ts
index 39364ae09..345a32d56 100644
--- a/app/api/categories/route.ts
+++ b/app/api/categories/route.ts
@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { getCategories } from "@/app/_server/actions/category";
+import { categoriesFor } from "@/app/_server/actions/category/tree";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
 import { ERRORS } from "@/app/_schemas/api/common";
@@ -30,8 +30,8 @@ export const GET = defineRoute(
     },
   },
   async ({ user }) => {
-    const notes = await getCategories(Modes.NOTES, user.username);
-    const checklists = await getCategories(Modes.CHECKLISTS, user.username);
+    const notes = await categoriesFor(Modes.NOTES, user.username);
+    const checklists = await categoriesFor(Modes.CHECKLISTS, user.username);
 
     if (!notes.success || !checklists.success) {
       return refuse(notes.error || checklists.error || "Failed to fetch categories", 500);
diff --git a/app/api/exports/[filename]/route.ts b/app/api/exports/[filename]/route.ts
index 2b9a208ef..04d9d4c46 100644
--- a/app/api/exports/[filename]/route.ts
+++ b/app/api/exports/[filename]/route.ts
@@ -8,18 +8,34 @@ import { defineRoute } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod, MediaType, RouteAuth } from "@/app/_server/api/contract";
 import { ERRORS } from "@/app/_schemas/api/common";
 import { exportFileParams, zipFileSchema } from "@/app/_schemas/api/exports";
+import { getCurrentUser } from "@/app/_server/actions/users";
+import {
+  EXPORT_TOKEN_BYTES,
+  SESSION_ONLY_EXPORT_PREFIXES,
+} from "@/app/_server/actions/export/naming";
 
 export const dynamic = "force-dynamic";
 
-const OWN_EXPORT_SUFFIX = /^_content_\d+\.zip$/;
+const OWN_EXPORT_SUFFIX = new RegExp(`^_content_\\d+_[a-f0-9]{${EXPORT_TOKEN_BYTES * 2}}\\.zip$`);
 const NOT_FOUND = "File not found or error during download.";
 
 const ownsExport = (username: string, filename: string): boolean =>
   filename.startsWith(username) &&
   OWN_EXPORT_SUFFIX.test(filename.slice(username.length));
 
-const mayDownload = async (caller: ApiCaller, filename: string): Promise<boolean> =>
-  ownsExport(caller.username, filename) || (await seesAllContent(caller));
+const holdsCredentials = (filename: string): boolean =>
+  SESSION_ONLY_EXPORT_PREFIXES.some((prefix) => filename.startsWith(prefix));
+
+const inBrowser = async (caller: ApiCaller): Promise<boolean> =>
+  (await getCurrentUser())?.username === caller.username;
+
+const mayDownload = async (caller: ApiCaller, filename: string): Promise<boolean> => {
+  if (holdsCredentials(filename)) {
+    return (await seesAllContent(caller)) && (await inBrowser(caller));
+  }
+
+  return ownsExport(caller.username, filename) || (await seesAllContent(caller));
+};
 
 const _notFound = () => new NextResponse(NOT_FOUND, { status: 404 });
 
@@ -42,7 +58,7 @@ export const GET = defineRoute(
     path: "/exports/{filename}",
     tag: ApiTag.EXPORTS,
     summary: "Download an export",
-    description: "Sends the zip once and deletes it. You can download your own user export. Admins with content access can download any. Also accepts the browser session cookie.",
+    description: "Sends the zip once and deletes it. You can download your own user export. Admins with content access can download any, except all_users_data and whole_data_folder, which hold every user's credentials and only download in a logged-in browser. Also accepts the browser session cookie.",
     params: exportFileParams,
     responses: {
       200: { description: "The zip", schema: zipFileSchema, mediaType: MediaType.ZIP },
diff --git a/app/api/exports/route.ts b/app/api/exports/route.ts
index c3aed172a..544e90f80 100644
--- a/app/api/exports/route.ts
+++ b/app/api/exports/route.ts
@@ -5,6 +5,7 @@ import {
   buildUserContent,
   readExportProgress,
 } from "@/app/_server/actions/export/builders";
+import { exportableUser } from "@/app/_server/actions/export/naming";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
 import { ERRORS } from "@/app/_schemas/api/common";
@@ -49,6 +50,7 @@ export const POST = defineRoute(
       if (body.username !== user.username && !hasContentAccess) {
         return refuse("Forbidden: You can only export your own data", 403);
       }
+      if (!(await exportableUser(body.username))) return refuse("User not found", 400);
       result = await buildUserContent(body.username);
     } else {
       if (!hasContentAccess) return refuse(ADMIN_ONLY, 403);
diff --git a/app/api/logs/cleanup/route.ts b/app/api/logs/cleanup/route.ts
index 3a2b10eff..835140216 100644
--- a/app/api/logs/cleanup/route.ts
+++ b/app/api/logs/cleanup/route.ts
@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { cleanupOldLogs } from "@/app/_server/actions/log";
+import { sweepOldLogs } from "@/app/_server/actions/log/sweep";
 import { defineRoute, refuse } from "@/app/_server/api/define-route";
 import { ApiTag, HttpMethod } from "@/app/_server/api/contract";
 import { ERRORS } from "@/app/_schemas/api/common";
@@ -24,6 +24,6 @@ export const POST = defineRoute(
   },
   async ({ user }) => {
     if (!user.isAdmin) return refuse("Admin access required", 403);
-    return NextResponse.json(await cleanupOldLogs());
+    return NextResponse.json(await sweepOldLogs());
   },
 );
diff --git a/app/api/oidc/callback/route.ts b/app/api/oidc/callback/route.ts
index 74dc8d15a..5044d2be2 100644
--- a/app/api/oidc/callback/route.ts
+++ b/app/api/oidc/callback/route.ts
@@ -5,9 +5,9 @@ import path from "path";
 import { getEnvOrFile } from "@/app/_server/actions/file";
 import { lock, unlock } from "proper-lockfile";
 import { getAuthMode } from "@/app/_utils/env-utils";
-import { ensureUser } from "@/app/_server/actions/users";
+import { ensureUser } from "@/app/_server/actions/users/ensure-user";
 import { jwtVerify, createRemoteJWKSet, decodeJwt } from "jose";
-import { createSession } from "@/app/_server/actions/session";
+import { createSession } from "@/app/_server/actions/session/store";
 import {
   ensureCorDirsAndFiles,
   readJsonFile,
diff --git a/docker-compose.mcp.yml b/docker-compose.mcp.yml
index 42be34415..7344dfb54 100644
--- a/docker-compose.mcp.yml
+++ b/docker-compose.mcp.yml
@@ -28,6 +28,8 @@ services:
       JOTTY_MCP_TRANSPORT: "http"
       JOTTY_MCP_PORT: "3001"
       JOTTY_MCP_AUTH_TOKEN: "changeme"
+      JOTTY_MCP_ALLOWED_HOSTS: ""
+      JOTTY_MCP_ALLOWED_ORIGINS: ""
       JOTTY_API_KEY: ""
       JOTTY_MCP_MAX_TEXT_CHARS: "12000"
 
diff --git a/howto/API.md b/howto/API.md
index c014149d9..ff9cb0e10 100644
--- a/howto/API.md
+++ b/howto/API.md
@@ -93,6 +93,10 @@ api-docs:
 
 Start it with `docker compose --profile api-docs up -d` and open `http://localhost:40126`. If it says "Failed to load", check `ENABLE_API_DOCS=true` is set and that `SPEC_URL` points at your instance's `/api/docs`.
 
+## Audit log date ranges
+
+`GET /api/logs` and `POST /api/logs/export` take `startDate` and `endDate` as ISO 8601 dates, such as `2024-05-01` or `2024-05-01T09:30:00Z`. When you leave them out you get the last 30 days. A range longer than 366 days, a start after the end, or a date that isn't a real calendar date gets a `400`.
+
 ## Audit log actions
 
 The logs endpoints filter by `action`, a free string. These are the common ones:
diff --git a/howto/MCP.md b/howto/MCP.md
index 66351ebdb..0f870b5fd 100644
--- a/howto/MCP.md
+++ b/howto/MCP.md
@@ -32,7 +32,7 @@ The MCP endpoint is `http://<host>:1133/mcp`, with a health check at `/healthz`.
 The `ghcr.io/fccview/jotty-mcp` image carries the same version tags as Jotty. If you pin Jotty to a version, pin the MCP server to the same one.
 
 > [!IMPORTANT]
-> Change `JOTTY_MCP_AUTH_TOKEN` from `changeme` before you start it. Every `/mcp` request has to send `Authorization: Bearer <token>`. Leaving the token empty opens the endpoint to anyone who can reach the port, which is fine on a private network and a bad idea anywhere else.
+> Change `JOTTY_MCP_AUTH_TOKEN` from `changeme` before you start it. Every `/mcp` request has to send `Authorization: Bearer <token>`. The server refuses to start in HTTP mode with an empty token or `changeme` unless it only listens on `127.0.0.1`. If the port really is only reachable from a network you trust, set `JOTTY_MCP_ALLOW_NO_AUTH=true` to run it without a token anyway.
 
 Adding it to Claude Code:
 
@@ -43,7 +43,15 @@ claude mcp add --transport http jotty http://localhost:1133/mcp \
 ```
 
 > [!WARNING]
-> `JOTTY_API_KEY` on the MCP service is a fallback for clients that can't send `x-api-key`. With it set, anyone who reaches the port with the token acts as that key's owner. The server logs a warning at startup when you set both.
+> `JOTTY_API_KEY` on the MCP service is a fallback for clients that can't send `x-api-key`. With it set, anyone who reaches the port with the token acts as that key's owner. The server logs a warning at startup when `JOTTY_API_KEY` is set and `JOTTY_MCP_AUTH_TOKEN` is not.
+
+### Behind a reverse proxy
+
+The HTTP server checks the `Host` and `Origin` headers to stop a web page from talking to it through DNS rebinding.
+
+- Bound to `127.0.0.1`, it only answers `localhost`, `127.0.0.1` and `[::1]`.
+- Bound to all interfaces (the Docker image default), it answers any host name, and a browser `Origin` has to be loopback or the same host as the request.
+- Behind a proxy, list the public names in `JOTTY_MCP_ALLOWED_HOSTS` and, if a browser-based client connects, its address in `JOTTY_MCP_ALLOWED_ORIGINS`.
 
 ## Running it with Bun
 
@@ -149,8 +157,11 @@ An assistant reads every character a tool sends back, and a long answer pushes t
 | `JOTTY_API_KEY` | | The key to use with Bun, or the fallback for Docker sessions |
 | `JOTTY_MCP_TRANSPORT` | `stdio` | `stdio` when your client starts the server, `http` for a shared one |
 | `JOTTY_MCP_PORT` | `3001` | Port the HTTP server listens on inside the container |
-| `JOTTY_MCP_BIND_HOST` | all interfaces | Address the HTTP server binds to |
-| `JOTTY_MCP_AUTH_TOKEN` | | Bearer token every `/mcp` request must send |
+| `JOTTY_MCP_BIND_HOST` | `127.0.0.1`, `0.0.0.0` in the Docker image | Address the HTTP server binds to |
+| `JOTTY_MCP_AUTH_TOKEN` | | Bearer token every `/mcp` request must send. Required in HTTP mode unless bound to loopback |
+| `JOTTY_MCP_ALLOW_NO_AUTH` | `false` | Start in HTTP mode on a non-loopback address without a real token. Only for trusted networks |
+| `JOTTY_MCP_ALLOWED_HOSTS` | | Comma separated `Host` values to accept, e.g. `mcp.example.com` |
+| `JOTTY_MCP_ALLOWED_ORIGINS` | | Comma separated browser origins to accept, e.g. `https://app.example.com` |
 | `JOTTY_MCP_TIMEOUT_MS` | `30000` | How long to wait for Jotty before giving up |
 | `JOTTY_MCP_MAX_TEXT_CHARS` | `12000` | Longest answer a tool sends back by default, in characters. A tool call can ask for a different size with `maxChars` |
 | `JOTTY_MCP_SPEC_TTL_MS` | `300000` | How long to cache the API description |
diff --git a/mcp-server/Dockerfile b/mcp-server/Dockerfile
index 1d0fed196..433aa8dfd 100644
--- a/mcp-server/Dockerfile
+++ b/mcp-server/Dockerfile
@@ -11,6 +11,7 @@ WORKDIR /app
 ENV NODE_ENV=production
 ENV JOTTY_MCP_TRANSPORT=http
 ENV JOTTY_MCP_PORT=3001
+ENV JOTTY_MCP_BIND_HOST=0.0.0.0
 COPY --from=build /src/dist/main.js /app/main.js
 EXPOSE 3001
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
diff --git a/mcp-server/src/config/env.ts b/mcp-server/src/config/env.ts
index 6ce148fba..4dec15850 100644
--- a/mcp-server/src/config/env.ts
+++ b/mcp-server/src/config/env.ts
@@ -5,6 +5,9 @@ export enum EnvVar {
   Port = "JOTTY_MCP_PORT",
   BindHost = "JOTTY_MCP_BIND_HOST",
   AuthToken = "JOTTY_MCP_AUTH_TOKEN",
+  AllowNoAuth = "JOTTY_MCP_ALLOW_NO_AUTH",
+  AllowedHosts = "JOTTY_MCP_ALLOWED_HOSTS",
+  AllowedOrigins = "JOTTY_MCP_ALLOWED_ORIGINS",
   TimeoutMs = "JOTTY_MCP_TIMEOUT_MS",
   MaxTextChars = "JOTTY_MCP_MAX_TEXT_CHARS",
   SpecTtlMs = "JOTTY_MCP_SPEC_TTL_MS",
diff --git a/mcp-server/src/config/load.ts b/mcp-server/src/config/load.ts
index 5b336d167..f2f8d9bbc 100644
--- a/mcp-server/src/config/load.ts
+++ b/mcp-server/src/config/load.ts
@@ -1,9 +1,19 @@
 import { EnvVar, readEnv } from "./env.ts";
 import { Transport, type McpConfig } from "./schema.ts";
 
+export const LOOPBACK_HOST = "127.0.0.1";
+
 export const DEFAULT_CONFIG: McpConfig = {
   jotty: { url: "http://localhost:3000", apiKey: "", timeoutMs: 30_000 },
-  server: { transport: Transport.Stdio, port: 3001, host: "", authToken: "" },
+  server: {
+    transport: Transport.Stdio,
+    port: 3001,
+    host: LOOPBACK_HOST,
+    authToken: "",
+    allowNoAuth: false,
+    allowedHosts: [],
+    allowedOrigins: [],
+  },
   output: { maxTextChars: 12_000 },
   specTtlMs: 300_000,
 };
@@ -19,6 +29,14 @@ const asTransport = (raw: string): Transport =>
 
 const trimSlash = (url: string): string => url.replace(/\/+$/, "");
 
+const listOf = (raw: string): string[] =>
+  raw
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+
+const truthy = (raw: string): boolean => ["1", "true", "yes"].includes(raw.toLowerCase());
+
 export const loadConfig = (): McpConfig => ({
   jotty: {
     url: trimSlash(readEnv(EnvVar.JottyUrl) || DEFAULT_CONFIG.jotty.url),
@@ -28,8 +46,11 @@ export const loadConfig = (): McpConfig => ({
   server: {
     transport: asTransport(readEnv(EnvVar.Transport)),
     port: positive(readEnv(EnvVar.Port), DEFAULT_CONFIG.server.port),
-    host: readEnv(EnvVar.BindHost),
+    host: readEnv(EnvVar.BindHost) || DEFAULT_CONFIG.server.host,
     authToken: readEnv(EnvVar.AuthToken),
+    allowNoAuth: truthy(readEnv(EnvVar.AllowNoAuth)),
+    allowedHosts: listOf(readEnv(EnvVar.AllowedHosts)),
+    allowedOrigins: listOf(readEnv(EnvVar.AllowedOrigins)),
   },
   output: {
     maxTextChars: positive(readEnv(EnvVar.MaxTextChars), DEFAULT_CONFIG.output.maxTextChars),
diff --git a/mcp-server/src/config/schema.ts b/mcp-server/src/config/schema.ts
index eec574cb3..cdf6937f3 100644
--- a/mcp-server/src/config/schema.ts
+++ b/mcp-server/src/config/schema.ts
@@ -14,6 +14,9 @@ export interface ServerConfig {
   port: number;
   host: string;
   authToken: string;
+  allowNoAuth: boolean;
+  allowedHosts: string[];
+  allowedOrigins: string[];
 }
 
 export interface OutputConfig {
diff --git a/mcp-server/src/server/exposure.ts b/mcp-server/src/server/exposure.ts
new file mode 100644
index 000000000..db554c011
--- /dev/null
+++ b/mcp-server/src/server/exposure.ts
@@ -0,0 +1,56 @@
+import type { ServerConfig } from "../config/schema.ts";
+
+export const PLACEHOLDER_TOKEN = "changeme";
+
+const LOOPBACK_NAMES = new Set(["localhost", "::1", "[::1]"]);
+
+export const isLoopback = (host: string): boolean =>
+  LOOPBACK_NAMES.has(host.toLowerCase()) || /^127(\.\d{1,3}){3}$/.test(host);
+
+export const weakToken = (token: string): boolean => !token || token === PLACEHOLDER_TOKEN;
+
+export const exposureRefusal = (server: ServerConfig): string | null => {
+  if (!weakToken(server.authToken) || isLoopback(server.host) || server.allowNoAuth) return null;
+
+  return [
+    `Refusing to serve /mcp on ${server.host} with ${server.authToken ? "the placeholder" : "no"} JOTTY_MCP_AUTH_TOKEN.`,
+    "Set a real token, bind JOTTY_MCP_BIND_HOST to 127.0.0.1,",
+    "or set JOTTY_MCP_ALLOW_NO_AUTH=true if the port is only reachable from a network you trust.",
+  ].join(" ");
+};
+
+const LOOPBACK_ALIASES = ["localhost", "127.0.0.1", "::1"];
+
+const _bare = (host: string): string =>
+  host.startsWith("[") ? host.slice(1, host.indexOf("]")) : (host.split(":")[0] ?? "");
+
+export const hostsFor = (server: ServerConfig): string[] => {
+  if (server.allowedHosts.length) return server.allowedHosts;
+  return isLoopback(server.host) ? LOOPBACK_ALIASES : [];
+};
+
+const _hostnameOf = (origin: string): string | null => {
+  try {
+    return _bare(new URL(origin).host);
+  } catch {
+    return null;
+  }
+};
+
+export const createOriginCheck = (server: ServerConfig) => (request: Request): string | null => {
+  const hosts = hostsFor(server);
+  const host = request.headers.get("host") ?? "";
+  if (hosts.length && !hosts.includes(host) && !hosts.includes(_bare(host))) {
+    return `Invalid Host header: ${host}`;
+  }
+
+  const origin = request.headers.get("origin");
+  if (!origin) return null;
+  if (server.allowedOrigins.length) {
+    return server.allowedOrigins.includes(origin) ? null : `Invalid Origin header: ${origin}`;
+  }
+
+  const hostname = _hostnameOf(origin);
+  const trusted = hostname !== null && (isLoopback(hostname) || hostname === _bare(host));
+  return trusted ? null : `Invalid Origin header: ${origin}`;
+};
diff --git a/mcp-server/src/server/http.ts b/mcp-server/src/server/http.ts
index 5c90df1e1..c3c3c1e06 100644
--- a/mcp-server/src/server/http.ts
+++ b/mcp-server/src/server/http.ts
@@ -3,6 +3,7 @@ import { createClient } from "../jotty/client.ts";
 import type { ToolContext } from "../tools/context.ts";
 import { logger } from "../utils/logger.ts";
 import { API_KEY_HEADER, createGuard, deniedResponse } from "./auth.ts";
+import { createOriginCheck, exposureRefusal } from "./exposure.ts";
 import { createMcpServer, SERVER_NAME, SERVER_VERSION } from "./mcp.ts";
 import { createSessionPool, type SessionPool } from "./sessions.ts";
 
@@ -24,11 +25,14 @@ export interface Sidecar {
 
 export const createSidecar = (ctx: ToolContext): Sidecar => {
   const guard = createGuard(ctx.config.server.authToken);
-  const pool = createSessionPool((request) =>
-    createMcpServer({
-      ...ctx,
-      client: createClient(ctx.config.jotty, request.headers.get(API_KEY_HEADER)?.trim() || ctx.config.jotty.apiKey),
-    }),
+  const originCheck = createOriginCheck(ctx.config.server);
+  const pool = createSessionPool(
+    (request) =>
+      createMcpServer({
+        ...ctx,
+        client: createClient(ctx.config.jotty, request.headers.get(API_KEY_HEADER)?.trim() || ctx.config.jotty.apiKey),
+      }),
+    { allowedHosts: ctx.config.server.allowedHosts, allowedOrigins: ctx.config.server.allowedOrigins },
   );
 
   if (!guard.required && ctx.config.jotty.apiKey) {
@@ -41,6 +45,11 @@ export const createSidecar = (ctx: ToolContext): Sidecar => {
       return Response.json({ ok: true, name: SERVER_NAME, version: SERVER_VERSION });
     }
     if (path !== HttpPath.Mcp) return Response.json({ error: "Not found" }, { status: 404 });
+    const misdirected = originCheck(request);
+    if (misdirected) {
+      logger.warn(LOG_NS, `rejected /mcp request: ${misdirected}`);
+      return Response.json({ error: misdirected }, { status: 403 });
+    }
     if (!guard.allows(request)) {
       logger.warn(LOG_NS, "rejected /mcp request without a valid bearer token");
       return deniedResponse();
@@ -52,14 +61,17 @@ export const createSidecar = (ctx: ToolContext): Sidecar => {
 };
 
 export const startHttp = (sidecar: Sidecar, config: McpConfig) => {
+  const refusal = exposureRefusal(config.server);
+  if (refusal) throw new Error(refusal);
+
   const server = Bun.serve({
     port: config.server.port,
-    hostname: config.server.host || undefined,
+    hostname: config.server.host,
     idleTimeout: BUN_MAX_IDLE_SECONDS,
     maxRequestBodySize: MAX_BODY_BYTES,
     fetch: sidecar.fetch,
   });
-  logger.info(LOG_NS, `listening on ${config.server.host || "0.0.0.0"}:${server.port}${HttpPath.Mcp}`);
+  logger.info(LOG_NS, `listening on ${config.server.host}:${server.port}${HttpPath.Mcp}`);
   return {
     port: server.port ?? config.server.port,
     stop: async () => {
diff --git a/mcp-server/src/server/sessions.ts b/mcp-server/src/server/sessions.ts
index 5c2668059..87e7d4704 100644
--- a/mcp-server/src/server/sessions.ts
+++ b/mcp-server/src/server/sessions.ts
@@ -48,7 +48,15 @@ const readBody = async (request: Request): Promise<unknown> => {
 const isHandshake = (body: unknown): boolean =>
   Array.isArray(body) ? body.some(isInitializeRequest) : isInitializeRequest(body);
 
-export const createSessionPool = (forge: (request: Request) => Server): SessionPool => {
+export interface HostPolicy {
+  allowedHosts: string[];
+  allowedOrigins: string[];
+}
+
+export const createSessionPool = (
+  forge: (request: Request) => Server,
+  policy: HostPolicy = { allowedHosts: [], allowedOrigins: [] },
+): SessionPool => {
   const sessions = new Map<string, Session>();
 
   const dropStale = async (): Promise<void> => {
@@ -69,6 +77,9 @@ export const createSessionPool = (forge: (request: Request) => Server): SessionP
       touchedAt: Date.now(),
       transport: new WebStandardStreamableHTTPServerTransport({
         sessionIdGenerator: () => crypto.randomUUID(),
+        enableDnsRebindingProtection: true,
+        allowedHosts: policy.allowedHosts.length ? policy.allowedHosts : undefined,
+        allowedOrigins: policy.allowedOrigins.length ? policy.allowedOrigins : undefined,
         onsessioninitialized: (id) => {
           sessions.set(id, session);
           logger.debug(LOG_NS, `session opened ${id.slice(0, 8)}`);
diff --git a/mcp-server/tests/exposure.test.ts b/mcp-server/tests/exposure.test.ts
new file mode 100644
index 000000000..03b42c257
--- /dev/null
+++ b/mcp-server/tests/exposure.test.ts
@@ -0,0 +1,102 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { DEFAULT_CONFIG, loadConfig } from "../src/config/load.ts";
+import type { ServerConfig } from "../src/config/schema.ts";
+import { Transport } from "../src/config/schema.ts";
+import { createOriginCheck, exposureRefusal } from "../src/server/exposure.ts";
+import { createSidecar, startHttp } from "../src/server/http.ts";
+import { makeCtx } from "./helpers.ts";
+
+const server = (overrides: Partial<ServerConfig>): ServerConfig => ({
+  ...DEFAULT_CONFIG.server,
+  transport: Transport.Http,
+  ...overrides,
+});
+
+const ask = (headers: Record<string, string>) => new Request("http://x/mcp", { method: "POST", headers });
+
+const ENV_KEYS = ["JOTTY_MCP_BIND_HOST", "JOTTY_MCP_ALLOWED_HOSTS", "JOTTY_MCP_ALLOWED_ORIGINS", "JOTTY_MCP_ALLOW_NO_AUTH"];
+
+afterEach(() => {
+  for (const key of ENV_KEYS) delete process.env[key];
+});
+
+describe("http exposure", () => {
+  it("binds to loopback unless told otherwise", () => {
+    expect(loadConfig().server.host).toBe("127.0.0.1");
+    process.env.JOTTY_MCP_BIND_HOST = "0.0.0.0";
+    expect(loadConfig().server.host).toBe("0.0.0.0");
+  });
+
+  it("reads the allow lists and the opt-in", () => {
+    process.env.JOTTY_MCP_ALLOWED_HOSTS = "jotty.example.com, mcp.example.com:443";
+    process.env.JOTTY_MCP_ALLOWED_ORIGINS = "https://jotty.example.com";
+    process.env.JOTTY_MCP_ALLOW_NO_AUTH = "true";
+
+    const { allowedHosts, allowedOrigins, allowNoAuth } = loadConfig().server;
+    expect(allowedHosts).toEqual(["jotty.example.com", "mcp.example.com:443"]);
+    expect(allowedOrigins).toEqual(["https://jotty.example.com"]);
+    expect(allowNoAuth).toBe(true);
+  });
+
+  it.each(["", "changeme"])("refuses to expose %j beyond loopback", (authToken) => {
+    expect(exposureRefusal(server({ host: "0.0.0.0", authToken }))).toContain("Refusing");
+  });
+
+  it("allows a weak token on loopback or with the opt-in", () => {
+    expect(exposureRefusal(server({ host: "127.0.0.1", authToken: "" }))).toBeNull();
+    expect(exposureRefusal(server({ host: "localhost", authToken: "changeme" }))).toBeNull();
+    expect(exposureRefusal(server({ host: "0.0.0.0", authToken: "", allowNoAuth: true }))).toBeNull();
+    expect(exposureRefusal(server({ host: "0.0.0.0", authToken: "a-real-secret" }))).toBeNull();
+  });
+
+  it("does not start when the refusal applies", () => {
+    const ctx = makeCtx("http://127.0.0.1:1");
+    ctx.config.server = server({ host: "0.0.0.0", port: 0, authToken: "changeme" });
+    expect(() => startHttp(createSidecar(ctx), ctx.config)).toThrow("Refusing");
+  });
+
+  it("only answers loopback host names when bound to loopback", () => {
+    const check = createOriginCheck(server({ host: "127.0.0.1" }));
+
+    expect(check(ask({ host: "127.0.0.1:3001" }))).toBeNull();
+    expect(check(ask({ host: "localhost:3001" }))).toBeNull();
+    expect(check(ask({ host: "evil.example:3001" }))).toContain("Host");
+  });
+
+  it("refuses browser origins that are neither loopback nor the same host", () => {
+    const check = createOriginCheck(server({ host: "0.0.0.0" }));
+
+    expect(check(ask({ host: "nas.lan:1133" }))).toBeNull();
+    expect(check(ask({ host: "nas.lan:1133", origin: "http://nas.lan:1133" }))).toBeNull();
+    expect(check(ask({ host: "nas.lan:1133", origin: "http://localhost:6274" }))).toBeNull();
+    expect(check(ask({ host: "nas.lan:1133", origin: "https://evil.example" }))).toContain("Origin");
+  });
+
+  it("follows the configured lists for reverse proxies", () => {
+    const check = createOriginCheck(
+      server({ host: "0.0.0.0", allowedHosts: ["mcp.example.com"], allowedOrigins: ["https://app.example.com"] }),
+    );
+
+    expect(check(ask({ host: "mcp.example.com", origin: "https://app.example.com" }))).toBeNull();
+    expect(check(ask({ host: "other.example.com" }))).toContain("Host");
+    expect(check(ask({ host: "mcp.example.com", origin: "http://localhost:3000" }))).toContain("Origin");
+  });
+
+  it("answers a hostile origin with 403 before touching a session", async () => {
+    const ctx = makeCtx("http://127.0.0.1:1");
+    ctx.config.server = server({ host: "127.0.0.1", authToken: "secret" });
+    const sidecar = createSidecar(ctx);
+
+    const response = await sidecar.fetch(
+      new Request("http://127.0.0.1/mcp", {
+        method: "POST",
+        headers: { host: "127.0.0.1", origin: "https://evil.example", authorization: "Bearer secret" },
+        body: "{}",
+      }),
+    );
+
+    expect(response.status).toBe(403);
+    expect(sidecar.pool.size()).toBe(0);
+    await sidecar.close();
+  });
+});
diff --git a/tests/api/duplicate-uuids.test.ts b/tests/api/duplicate-uuids.test.ts
index 5df52ed46..bf6f37702 100644
--- a/tests/api/duplicate-uuids.test.ts
+++ b/tests/api/duplicate-uuids.test.ts
@@ -11,12 +11,17 @@ import {
 const mockUserIndex = vi.fn();
 const mockFind = vi.fn();
 const mockRepair = vi.fn();
+const mockFindAcross = vi.fn();
 
 vi.mock("@/app/_server/actions/users/helpers", () => ({
   getUserIndex: (...args: unknown[]) => mockUserIndex(...args),
 }));
 vi.mock("@/app/_server/actions/uuid-clash/scan", () => ({
   findClashes: (...args: unknown[]) => mockFind(...args),
+  findCrossUserClashes: (...args: unknown[]) => mockFindAcross(...args),
+}));
+vi.mock("@/app/_server/actions/lib/audit-trail", () => ({
+  everyUsername: async () => ["testuser", "bob"],
 }));
 vi.mock("@/app/_server/actions/uuid-clash/repair", () => ({
   NO_CLASH: "No duplicate for that uuid",
@@ -43,6 +48,29 @@ describe("duplicate uuid routes", () => {
     mockGetAppSettings.mockResolvedValue({ success: true, data: { adminContentAccess: "yes" } });
   });
 
+  it("keeps the cross-user scan for admins with content access", async () => {
+    mockFindAcross.mockResolvedValue([{ uuid: DUP, owner: "bob", owners: ["bob", "testuser"], files: [] }]);
+
+    expect((await list("?acrossUsers=true")).status).toBe(403);
+    expect(mockFindAcross).not.toHaveBeenCalled();
+
+    mockAuthenticateApiKey.mockResolvedValue(admin);
+    const response = await list("?acrossUsers=true");
+
+    expect(response.status).toBe(200);
+    expect((await getResponseJson(response)).duplicates[0].owners).toEqual(["bob", "testuser"]);
+    expect(mockFindAcross).toHaveBeenCalledWith(["testuser", "bob"]);
+    expect(mockFind).not.toHaveBeenCalled();
+  });
+
+  it("refuses the cross-user scan when admin content access is off", async () => {
+    mockAuthenticateApiKey.mockResolvedValue(admin);
+    mockGetAppSettings.mockResolvedValue({ success: true, data: { adminContentAccess: "no" } });
+
+    expect((await list("?acrossUsers=true")).status).toBe(403);
+    expect(mockFindAcross).not.toHaveBeenCalled();
+  });
+
   it("lists the caller's own duplicates", async () => {
     mockFind.mockResolvedValue([{ uuid: DUP, owner: mockUser.username, files: [] }]);
     const response = await list();
diff --git a/tests/api/exports.test.ts b/tests/api/exports.test.ts
index 996b4f84a..b3aa25668 100644
--- a/tests/api/exports.test.ts
+++ b/tests/api/exports.test.ts
@@ -8,6 +8,7 @@ import {
   mockExportWholeDataFolder,
   mockGetExportProgress,
   mockGetAppSettings,
+  mockExportableUser,
   resetApiMocks,
   createMockRequest,
   getResponseJson,
@@ -328,6 +329,22 @@ describe("Exports API", () => {
       expect(mockExportAllChecklistsNotes).not.toHaveBeenCalled()
     })
 
+    it("refuses a username that does not exist or escapes the export folder", async () => {
+      mockAuthenticateApiKey.mockResolvedValue(adminUser)
+      mockGetAppSettings.mockResolvedValue(mockAppSettings)
+      mockExportableUser.mockResolvedValue(false)
+
+      const request = createMockRequest("POST", "http://localhost:3000/api/exports", {
+        type: "user_checklists_notes",
+        username: "../../users",
+      })
+      const response = await POST(request, { params: Promise.resolve({}) })
+
+      expect(response.status).toBe(400)
+      expect(mockExportableUser).toHaveBeenCalledWith("../../users")
+      expect(mockExportUserChecklistsNotes).not.toHaveBeenCalled()
+    })
+
     it("refuses an admin key somebody else's export", async () => {
       mockAuthenticateApiKey.mockResolvedValue(adminUser)
       mockGetAppSettings.mockResolvedValue(locked)
diff --git a/tests/api/logs.test.ts b/tests/api/logs.test.ts
index 5dfcda49f..472cba815 100644
--- a/tests/api/logs.test.ts
+++ b/tests/api/logs.test.ts
@@ -12,11 +12,14 @@ const mockEveryUsername = vi.fn();
 const mockCleanupOldLogs = vi.fn();
 
 vi.mock("@/app/_server/actions/log", () => ({
-  cleanupOldLogs: (...args: unknown[]) => mockCleanupOldLogs(...args),
   getDailyLogPath: vi.fn(),
   getDateRange: vi.fn(),
 }));
 
+vi.mock("@/app/_server/actions/log/sweep", () => ({
+  sweepOldLogs: (...args: unknown[]) => mockCleanupOldLogs(...args),
+}));
+
 vi.mock("@/app/_server/actions/lib/audit-trail", async (importOriginal) => ({
   ...(await importOriginal<typeof import("@/app/_server/actions/lib/audit-trail")>()),
   digUpLogs: (...args: unknown[]) => mockDigUpLogs(...args),
@@ -157,6 +160,50 @@ describe("Logs API", () => {
     });
   });
 
+  describe("date range", () => {
+    it.each([
+      ["?startDate=0001-01-01", "at most 366 days"],
+      ["?startDate=2026-01-01&endDate=2024-01-01", "must not be after"],
+      ["?startDate=yesterday", "ISO 8601"],
+      ["?startDate=2026-02-31", "ISO 8601"],
+      ["?endDate=2026-13-01", "ISO 8601"],
+      ["?startDate=2024-01-01&endDate=2026-01-01", "at most 366 days"],
+    ])("refuses %s on GET /logs without reading anything", async (query, message) => {
+      const response = await list(query);
+
+      expect(response.status).toBe(400);
+      expect(JSON.stringify(await getResponseJson(response))).toContain(message);
+      expect(mockDigUpLogs).not.toHaveBeenCalled();
+    });
+
+    it("refuses an unbounded range on the export too", async () => {
+      const response = await EXPORT(
+        createMockRequest("POST", "http://localhost:3000/api/logs/export", {
+          format: "json",
+          filters: { startDate: "0001-01-01T00:00:00Z" },
+        }),
+      );
+
+      expect(response.status).toBe(400);
+      expect(mockDigUpLogs).not.toHaveBeenCalled();
+    });
+
+    it.each([
+      "",
+      "?startDate=2026-01-01",
+      "?startDate=2026-01-01&endDate=2026-09-01",
+      "?startDate=2025-09-01T00:00:00Z&endDate=2026-09-01T00:00:00.000Z",
+      "?endDate=2026-09-01T10:00:00%2B02:00",
+    ])("keeps accepting %s", async (query) => {
+      vi.useFakeTimers({ now: new Date("2026-09-28T12:00:00Z"), toFake: ["Date"] });
+      try {
+        expect((await list(query)).status).toBe(200);
+      } finally {
+        vi.useRealTimers();
+      }
+    });
+  });
+
   describe("POST /api/logs/export", () => {
     const exportLogs = (body: unknown) =>
       EXPORT(createMockRequest("POST", "http://localhost:3000/api/logs/export", body));
@@ -201,10 +248,12 @@ describe("Logs API", () => {
 
     it("returns the cleanup result for an admin", async () => {
       mockAuthenticateApiKey.mockResolvedValue(ADMIN);
+      mockCleanupOldLogs.mockResolvedValue({ success: true, deletedFiles: 3 });
 
       const data = await getResponseJson(await cleanup());
 
-      expect(data).toEqual({ success: true, deletedFiles: 0 });
+      expect(data).toEqual({ success: true, deletedFiles: 3 });
+      expect(mockCleanupOldLogs).toHaveBeenCalledWith();
     });
   });
 });
diff --git a/tests/api/setup.ts b/tests/api/setup.ts
index 8fa52bce0..8c6749c5e 100644
--- a/tests/api/setup.ts
+++ b/tests/api/setup.ts
@@ -41,6 +41,7 @@ export const mockServerWriteFile = vi.fn();
 export const mockFindUserRecord = vi.fn();
 export const mockExportAllChecklistsNotes = vi.fn();
 export const mockExportUserChecklistsNotes = vi.fn();
+export const mockExportableUser = vi.fn().mockResolvedValue(true);
 export const mockExportAllUsersData = vi.fn();
 export const mockExportWholeDataFolder = vi.fn();
 export const mockGetExportProgress = vi.fn();
@@ -55,7 +56,7 @@ export const mockRemindItem = vi.fn();
 export const mockCanReach = vi.fn();
 export const mockSharesInvolving = vi.fn();
 
-vi.mock("@/app/_server/actions/api", () => ({
+vi.mock("@/app/_server/actions/api/authenticate", () => ({
   authenticateApiKey: (...args: any[]) => mockAuthenticateApiKey(...args),
 }));
 
@@ -146,6 +147,10 @@ vi.mock("@/app/_server/actions/category", () => ({
   getCategories: (...args: any[]) => mockGetCategories(...args),
 }));
 
+vi.mock("@/app/_server/actions/category/tree", () => ({
+  categoriesFor: (...args: any[]) => mockGetCategories(...args),
+}));
+
 vi.mock("@/app/_server/actions/users", () => ({
   isAdmin: (...args: any[]) => mockIsAdmin(...args),
   getCurrentUser: (...args: any[]) => mockGetCurrentUser(...args),
@@ -183,6 +188,11 @@ vi.mock("@/app/_server/actions/export/builders", () => ({
   readExportProgress: (...args: any[]) => mockGetExportProgress(...args),
 }));
 
+vi.mock("@/app/_server/actions/export/naming", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/app/_server/actions/export/naming")>()),
+  exportableUser: (...args: any[]) => mockExportableUser(...args),
+}));
+
 vi.mock("@/app/_server/actions/lib/legacy-lookup", () => ({
   resolveApiId: (...args: any[]) => mockResolveApiId(...args),
   legacyResolve: (...args: any[]) => mockLegacyResolve(...args),
@@ -223,6 +233,7 @@ export function resetApiMocks() {
   mockFindUserRecord.mockReset();
   mockExportAllChecklistsNotes.mockReset();
   mockExportUserChecklistsNotes.mockReset();
+  mockExportableUser.mockReset().mockResolvedValue(true);
   mockExportAllUsersData.mockReset();
   mockExportWholeDataFolder.mockReset();
   mockGetExportProgress.mockReset();
diff --git a/tests/security/actor-spoofing.test.ts b/tests/security/actor-spoofing.test.ts
index ad2754985..6eb3cc33e 100644
--- a/tests/security/actor-spoofing.test.ts
+++ b/tests/security/actor-spoofing.test.ts
@@ -100,7 +100,7 @@ vi.mock('@/app/_server/actions/ws/broadcast', () => ({
   broadcast: vi.fn().mockResolvedValue(undefined),
 }))
 
-vi.mock('@/app/_server/actions/history', () => ({
+vi.mock('@/app/_server/actions/history/repo', () => ({
   commitNote: vi.fn().mockResolvedValue(undefined),
 }))
 
@@ -108,7 +108,7 @@ vi.mock('@/app/_server/actions/notifications/internal', () => ({
   notifyUser: vi.fn(),
 }))
 
-vi.mock('@/app/_server/actions/api', () => ({
+vi.mock('@/app/_server/actions/api/authenticate', () => ({
   authenticateApiKey: (...args: unknown[]) => mockAuthenticateApiKey(...args),
 }))
 
diff --git a/tests/security/auth-required.test.ts b/tests/security/auth-required.test.ts
index 458336941..f47c8aa39 100644
--- a/tests/security/auth-required.test.ts
+++ b/tests/security/auth-required.test.ts
@@ -23,7 +23,7 @@ vi.mock('@/app/_server/actions/users', async (importOriginal) => {
   }
 })
 
-vi.mock('@/app/_server/actions/session', () => ({
+vi.mock('@/app/_server/actions/session/store', () => ({
   getSessionId: () => mockGetSessionId(),
   readSessions: () => mockReadSessions(),
   createSession: vi.fn(),
@@ -58,7 +58,7 @@ vi.mock('@/app/_server/actions/ws/broadcast', () => ({
   broadcast: vi.fn().mockResolvedValue(undefined),
 }))
 
-vi.mock('@/app/_server/actions/history', () => ({
+vi.mock('@/app/_server/actions/history/repo', () => ({
   commitNote: vi.fn(),
 }))
 
diff --git a/tests/security/data-leakage.test.ts b/tests/security/data-leakage.test.ts
index 7c1194775..b5703763c 100644
--- a/tests/security/data-leakage.test.ts
+++ b/tests/security/data-leakage.test.ts
@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest'
+import path from 'path'
 import { resetAllMocks, createFormData } from '../setup'
 
 const mockReadJsonFile = vi.fn()
@@ -21,7 +22,7 @@ vi.mock('@/app/_server/actions/file', () => ({
   ensureDir: vi.fn(),
 }))
 
-vi.mock('@/app/_server/actions/session', () => ({
+vi.mock('@/app/_server/actions/session/store', () => ({
   getSessionId: () => mockGetSessionId(),
   readSessions: () => mockReadSessions(),
   removeAllSessionsForUser: vi.fn(),
@@ -213,6 +214,8 @@ describe('Security: Data Leakage Prevention', () => {
 
   describe('Sensitive Field Filtering', () => {
     it('user list should only contain safe fields', async () => {
+      mockGetSessionId.mockResolvedValue('sid')
+      mockReadSessions.mockResolvedValue({ sid: 'user1' })
       mockReadJsonFile.mockResolvedValue([
         {
           username: 'user1',
@@ -309,7 +312,9 @@ describe('Security: Data Leakage Prevention', () => {
 
     it('owner lookup by item uuid should only return public fields', async () => {
       mockReadJsonFile.mockResolvedValue([victimRecord])
-      mockGrepFindFileByUuid.mockResolvedValue({ filePath: '/data/victim/note.md' })
+      mockGrepFindFileByUuid.mockResolvedValue({
+        filePath: path.join(process.cwd(), 'data', 'notes', 'victim', 'note.md'),
+      })
 
       const { getUserByNoteUuid } = await import('@/app/_server/actions/users')
 
diff --git a/tests/security/export-download.test.ts b/tests/security/export-download.test.ts
index 96c581b5c..881642aa8 100644
--- a/tests/security/export-download.test.ts
+++ b/tests/security/export-download.test.ts
@@ -16,9 +16,13 @@ import { GET } from "@/app/api/exports/[filename]/route";
 const SANDBOX = mkdtempSync(path.join(os.tmpdir(), "jotty-exports-"));
 const EXPORT_DIR = path.resolve(SANDBOX, EXPORT_TEMP_DIR);
 const cwdSpy = vi.spyOn(process, "cwd").mockReturnValue(SANDBOX);
-const OWN = `${mockUser.username}_content_1700000000000.zip`;
-const WHOLE = "whole_data_folder_1700000000000.zip";
-const LOOKALIKE = `${mockUser.username}_content_content_1700000000000.zip`;
+const TOKEN = "0123456789abcdef0123456789abcdef";
+const OWN = `${mockUser.username}_content_1700000000000_${TOKEN}.zip`;
+const WHOLE = `whole_data_folder_1700000000000_${TOKEN}.zip`;
+const USERS = `all_users_data_1700000000000_${TOKEN}.zip`;
+const CONTENT = `all_checklists_notes_1700000000000_${TOKEN}.zip`;
+const LOOKALIKE = `${mockUser.username}_content_content_1700000000000_${TOKEN}.zip`;
+const GUESSABLE = `${mockUser.username}_content_1700000000000.zip`;
 const ADMIN = { ...mockUser, username: "boss", isAdmin: true };
 
 const plant = (name: string) => {
@@ -41,7 +45,7 @@ describe("Security: export downloads", () => {
     resetApiMocks();
     cwdSpy.mockReturnValue(SANDBOX);
     mockGetAppSettings.mockResolvedValue({ success: true, data: { adminContentAccess: "yes" } });
-    [OWN, WHOLE, LOOKALIKE].forEach(plant);
+    [OWN, WHOLE, USERS, CONTENT, LOOKALIKE, GUESSABLE].forEach(plant);
   });
 
   it("refuses somebody with no session and no api key", async () => {
@@ -90,4 +94,25 @@ describe("Security: export downloads", () => {
 
     expect((await fetchExport(WHOLE)).status).toBe(404);
   });
+
+  it("refuses an old-style export name without its token", async () => {
+    mockGetCurrentUser.mockResolvedValue(mockUser);
+
+    expect((await fetchExport(GUESSABLE)).status).toBe(404);
+  });
+
+  it.each([WHOLE, USERS])("refuses %s to an admin api key", async (name) => {
+    mockGetCurrentUser.mockResolvedValue(null);
+    mockAuthenticateApiKey.mockResolvedValue(ADMIN);
+
+    expect((await fetchExport(name)).status).toBe(404);
+    expect(existsSync(path.join(EXPORT_DIR, name))).toBe(true);
+  });
+
+  it("still serves an admin api key the content-only export", async () => {
+    mockGetCurrentUser.mockResolvedValue(null);
+    mockAuthenticateApiKey.mockResolvedValue(ADMIN);
+
+    expect((await fetchExport(CONTENT)).status).toBe(200);
+  });
 });
diff --git a/tests/security/export-naming.test.ts b/tests/security/export-naming.test.ts
new file mode 100644
index 000000000..f137d9aaa
--- /dev/null
+++ b/tests/security/export-naming.test.ts
@@ -0,0 +1,29 @@
+import { describe, it, expect, vi } from "vitest";
+
+vi.mock("@/app/_server/actions/users/records", () => ({
+  findUserRecord: vi.fn(async (username: string) => (username === "alice" ? { username } : null)),
+}));
+
+import { exportName, exportableUser, EXPORT_TOKEN_BYTES } from "@/app/_server/actions/export/naming";
+
+describe("Security: export file names", () => {
+  it("carries an unguessable token", () => {
+    const first = exportName("whole_data_folder");
+    const second = exportName("whole_data_folder");
+
+    expect(first).toMatch(new RegExp(`^whole_data_folder_\\d+_[a-f0-9]{${EXPORT_TOKEN_BYTES * 2}}\\.zip$`));
+    expect(first).not.toBe(second);
+  });
+
+  it("only exports a user that exists", async () => {
+    expect(await exportableUser("alice")).toBe(true);
+    expect(await exportableUser("nobody")).toBe(false);
+  });
+
+  it.each(["../users", "../../etc", "a/b", "a\\b", ".", "..", ".alice", ""])(
+    "refuses the export username %j",
+    async (username) => {
+      expect(await exportableUser(username)).toBe(false);
+    },
+  );
+});
diff --git a/tests/security/filename-containment.test.ts b/tests/security/filename-containment.test.ts
new file mode 100644
index 000000000..813f7596c
--- /dev/null
+++ b/tests/security/filename-containment.test.ts
@@ -0,0 +1,157 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import path from "path";
+import { createFormData } from "../setup";
+
+const mockServerWriteFile = vi.fn();
+const mockGenerateUniqueFilename = vi.fn();
+const CATEGORY_DIR = vi.hoisted(() => "/srv/jotty/data/notes/alice/Work");
+
+vi.mock("next-intl/server", () => ({
+  getTranslations: vi.fn().mockResolvedValue((key: string) => key),
+}));
+
+vi.mock("@/app/_utils/filename-utils", async (importOriginal) => {
+  const actual = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...actual,
+    generateUniqueFilename: (...args: unknown[]) =>
+      mockGenerateUniqueFilename(...args),
+  };
+});
+
+vi.mock("@/app/_server/actions/file", () => ({
+  ensureDir: vi.fn(),
+  serverWriteFile: (...args: unknown[]) => mockServerWriteFile(...args),
+}));
+
+vi.mock("@/app/_server/actions/share/target", () => ({
+  targetDir: vi.fn().mockResolvedValue({
+    dir: CATEGORY_DIR,
+    owner: "alice",
+    category: "Work",
+    isMount: false,
+  }),
+  bouncer: vi.fn().mockResolvedValue({ allowed: true }),
+}));
+
+vi.mock("@/app/_server/actions/relations/tidy", () => ({
+  tidyItemLinks: vi.fn().mockImplementation(async (content: string) => content),
+}));
+
+vi.mock("@/app/_server/actions/log", () => ({
+  logContentEvent: vi.fn(),
+}));
+
+vi.mock("@/app/_server/actions/history/repo", () => ({
+  commitNote: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({
+  broadcast: vi.fn(),
+}));
+
+vi.mock("@/app/_utils/checklist-utils", () => ({
+  listToMarkdown: vi.fn().mockReturnValue("# list"),
+}));
+
+import { sanitizeFilename } from "@/app/_utils/filename-utils";
+import { fenceFilename } from "@/app/_server/actions/lib/filename-fence";
+import { makeNote } from "@/app/_server/actions/note/creator";
+import { makeList } from "@/app/_server/actions/checklist/creator";
+import { FileRenameMode, SanitisedUser } from "@/app/_types";
+
+const ESCAPES = [
+  "../../bob/Uncategorized/x",
+  "..\\..\\bob\\x",
+  "/etc/cron.d/x",
+  "a\0b",
+  "..",
+  ".hidden",
+];
+
+const actor = (fileRenameMode: FileRenameMode): SanitisedUser => ({
+  username: "alice",
+  isAdmin: false,
+  fileRenameMode,
+  preferredDateFormat: "dd/mm/yyyy",
+  preferredTimeFormat: "24-hours",
+});
+
+describe("Security: titles cannot pick a path", () => {
+  beforeEach(() => {
+    mockServerWriteFile.mockReset();
+    mockGenerateUniqueFilename.mockReset();
+  });
+
+  describe("sanitizeFilename", () => {
+    const modes: FileRenameMode[] = ["none", "minimal", "dash-case"];
+
+    it.each(modes.flatMap((mode) => ESCAPES.map((title) => [mode, title])))(
+      "%s mode strips separators, NUL and leading dots from %j",
+      (mode, title) => {
+        const name = sanitizeFilename(title, mode as FileRenameMode);
+
+        expect(name).not.toMatch(/[/\\\0]/);
+        expect(name.startsWith(".")).toBe(false);
+        expect(fenceNoop(`${name || "x"}.md`)).toBe(true);
+      },
+    );
+
+    it("none mode leaves every other character alone", () => {
+      expect(sanitizeFilename("My: Note? <3 ü", "none")).toBe("My: Note? <3 ü");
+      expect(sanitizeFilename("v1.2 notes.", "none")).toBe("v1.2 notes.");
+    });
+  });
+
+  describe("fenceFilename", () => {
+    it.each(["x.md", "My Note.md", "a..b.md"])("lets %s through", async (name) => {
+      expect(await fenceFilename(CATEGORY_DIR, name)).toBeNull();
+    });
+
+    it.each(["../x.md", "../../bob/x.md", "sub/x.md", "/etc/x.md", "x\0.md", ""])(
+      "refuses %j",
+      async (name) => {
+        expect(await fenceFilename(CATEGORY_DIR, name)).toBe("filenameOutOfBounds");
+      },
+    );
+  });
+
+  describe("create refuses a filename that would leave its category", () => {
+    it.each([
+      ["note", makeNote],
+      ["checklist", makeList],
+    ] as const)("%s", async (_kind, make) => {
+      mockGenerateUniqueFilename.mockResolvedValue("../../bob/Uncategorized/x.md");
+
+      const result = await make(
+        actor("none"),
+        createFormData({ title: "../../bob/Uncategorized/x", category: "Work", rawContent: "hello" }),
+      );
+
+      expect(result.error).toBe("filenameOutOfBounds");
+      expect(mockServerWriteFile).not.toHaveBeenCalled();
+    });
+
+    it("writes a hostile title inside the category in none mode", async () => {
+      const { generateUniqueFilename } = await vi.importActual<
+        typeof import("@/app/_utils/filename-utils")
+      >("@/app/_utils/filename-utils");
+      mockGenerateUniqueFilename.mockImplementation(generateUniqueFilename);
+
+      const result = await makeNote(
+        actor("none"),
+        createFormData({ title: "../../bob/Uncategorized/x", category: "Work", rawContent: "hello" }),
+      );
+
+      expect(result.success).toBe(true);
+      expect(mockServerWriteFile).toHaveBeenCalledTimes(1);
+      expect(mockServerWriteFile.mock.calls[0][0]).toBe(
+        path.join(CATEGORY_DIR, "bobUncategorizedx.md"),
+      );
+      expect(result.data?.title).toBe("../../bob/Uncategorized/x");
+    });
+  });
+});
+
+const fenceNoop = (name: string) =>
+  path.dirname(path.resolve(CATEGORY_DIR, name)) === path.resolve(CATEGORY_DIR);
diff --git a/tests/security/kanban-grants.test.ts b/tests/security/kanban-grants.test.ts
index ca191eb40..8e8d9eaa1 100644
--- a/tests/security/kanban-grants.test.ts
+++ b/tests/security/kanban-grants.test.ts
@@ -82,7 +82,7 @@ vi.mock('@/app/_server/actions/log', () => ({
   logContentEvent: vi.fn(),
 }))
 
-vi.mock('@/app/_server/actions/api', () => ({
+vi.mock('@/app/_server/actions/api/authenticate', () => ({
   authenticateApiKey: (...args: unknown[]) => mockAuthenticateApiKey(...args),
 }))
 
diff --git a/tests/security/log-range.test.ts b/tests/security/log-range.test.ts
new file mode 100644
index 000000000..64971c345
--- /dev/null
+++ b/tests/security/log-range.test.ts
@@ -0,0 +1,38 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { mockFs, resetAllMocks } from "../setup";
+import { LOG_MAX_RANGE_DAYS, LOG_READ_BATCH_DAYS } from "@/app/_consts/logs";
+
+vi.mock("@/app/_server/actions/file", () => ({
+  readJsonFile: vi.fn().mockResolvedValue([]),
+}));
+
+import { digUpLogs } from "@/app/_server/actions/lib/audit-trail";
+import { getDateRange } from "@/app/_server/actions/log/helpers";
+
+describe("Security: audit log date ranges stay bounded", () => {
+  beforeEach(() => {
+    resetAllMocks();
+  });
+
+  it("refuses to build a range longer than the cap", async () => {
+    await expect(getDateRange(new Date("0001-01-01"), new Date("2026-01-01"))).rejects.toThrow(RangeError);
+    expect(await getDateRange(new Date("2026-01-01"), new Date("2026-01-03"))).toHaveLength(3);
+  });
+
+  it(`never has more than ${LOG_READ_BATCH_DAYS} day files open at once`, async () => {
+    let open = 0;
+    let peak = 0;
+    mockFs.readFile.mockImplementation(async () => {
+      open++;
+      peak = Math.max(peak, open);
+      await new Promise((resolve) => setTimeout(resolve, 1));
+      open--;
+      return "[]";
+    });
+
+    await digUpLogs(["alice"], { startDate: "2025-10-01", endDate: "2026-09-28" });
+
+    expect(mockFs.readFile.mock.calls.length).toBeLessThanOrEqual(LOG_MAX_RANGE_DAYS + 1);
+    expect(peak).toBeLessThanOrEqual(LOG_READ_BATCH_DAYS);
+  });
+});
diff --git a/tests/security/mount-sideways.test.ts b/tests/security/mount-sideways.test.ts
new file mode 100644
index 000000000..36e38dd75
--- /dev/null
+++ b/tests/security/mount-sideways.test.ts
@@ -0,0 +1,195 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from "vitest";
+import path from "path";
+import { existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from "fs";
+
+const { home, root } = vi.hoisted(() => {
+  const os = process.getBuiltinModule("os");
+  const fs = process.getBuiltinModule("fs");
+  const nodePath = process.getBuiltinModule("path");
+  const previous = process.cwd();
+
+  process.chdir(fs.mkdtempSync(nodePath.join(os.tmpdir(), "jotty-mount-sideways-")));
+
+  return { home: previous, root: process.cwd() };
+});
+
+vi.unmock("fs/promises");
+vi.unmock("@/app/_utils/checklist-utils");
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({ broadcast: vi.fn() }));
+
+vi.mock("next-intl/server", () => ({
+  getTranslations: vi.fn().mockResolvedValue((key: string) => key),
+}));
+
+vi.mock("@/app/_server/actions/history/repo", () => ({
+  commitNote: vi.fn().mockResolvedValue({ success: true }),
+  commitCategoryRename: vi.fn().mockResolvedValue({ success: true }),
+}));
+
+vi.mock("@/app/_server/actions/users", async (importOriginal) => {
+  const bob = {
+    username: "bob",
+    isAdmin: false,
+    fileRenameMode: "minimal",
+    preferredDateFormat: "dd/mm/yyyy",
+    preferredTimeFormat: "24-hours",
+  };
+  return {
+    ...(await importOriginal<typeof import("@/app/_server/actions/users")>()),
+    getCurrentUser: async () => bob,
+    getUsername: async () => "bob",
+    isAdmin: async () => false,
+    canAccessAllContent: async () => false,
+  };
+});
+
+import { targetDir } from "@/app/_server/actions/share/target";
+import { dropMounts, mountsFor } from "@/app/_server/actions/share/mounts";
+import { makeNote } from "@/app/_server/actions/note/creator";
+import { makeList } from "@/app/_server/actions/checklist/creator";
+import { updateNote } from "@/app/_server/actions/note/crud";
+import { createCategory } from "@/app/_server/actions/category/crud";
+import { moveNode } from "@/app/_server/actions/category/move";
+import { Modes } from "@/app/_types/enums";
+import { DATA_DIR } from "@/app/_consts/files";
+import { CATEGORY_INFO_FILE } from "@/app/_consts/sharing";
+import { SanitisedUser } from "@/app/_types";
+
+const FULL = { canRead: true, canEdit: true, canDelete: true, canCreate: true };
+const SHARED_NOTE = "66666666-6666-4666-8666-666666666666";
+const PRIVATE_NOTE = "77777777-7777-4777-8777-777777777777";
+
+const bob: SanitisedUser = {
+  username: "bob",
+  isAdmin: false,
+  fileRenameMode: "minimal",
+  preferredDateFormat: "dd/mm/yyyy",
+  preferredTimeFormat: "24-hours",
+};
+
+const dirOf = (mode: Modes, owner: string, category = ""): string =>
+  path.join(root, DATA_DIR, mode, owner, category);
+
+const writeItem = (mode: Modes, owner: string, category: string, name: string, uuid: string) => {
+  const dir = dirOf(mode, owner, category);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    path.join(dir, `${name}.md`),
+    ["---", `uuid: ${uuid}`, `title: ${name}`, "---", "- [ ] milk", ""].join("\n"),
+  );
+};
+
+const shareFolder = (mode: Modes, owner: string, category: string) => {
+  const dir = dirOf(mode, owner, category);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    path.join(dir, CATEGORY_INFO_FILE),
+    JSON.stringify({ uuid: `${mode}-recipes`, sharing: { users: { bob: FULL }, inherit: true } }),
+  );
+};
+
+const privateFiles = (mode: Modes) => readdirSync(dirOf(mode, "alice", "Private")).sort();
+
+let mountName: string;
+
+afterAll(() => {
+  process.chdir(home);
+  rmSync(root, { recursive: true, force: true });
+});
+
+beforeEach(async () => {
+  rmSync(path.join(root, DATA_DIR), { recursive: true, force: true });
+  dropMounts(Modes.NOTES);
+  dropMounts(Modes.CHECKLISTS);
+
+  for (const mode of [Modes.NOTES, Modes.CHECKLISTS]) {
+    shareFolder(mode, "alice", "Recipes");
+    writeItem(mode, "alice", "Private", "diary", PRIVATE_NOTE);
+    mkdirSync(dirOf(mode, "bob"), { recursive: true });
+  }
+  writeItem(Modes.NOTES, "alice", "Recipes", "pasta", SHARED_NOTE);
+
+  const [mount] = await mountsFor(Modes.NOTES, "bob");
+  mountName = mount.displayName;
+});
+
+describe("Security: a mount name cannot reach the owner's unshared folders", () => {
+  it("still resolves a real path inside the share", async () => {
+    const target = await targetDir(Modes.NOTES, "bob", `${mountName}/Sauces`);
+
+    expect(target.isMount).toBe(true);
+    expect(target.dir).toBe(dirOf(Modes.NOTES, "alice", "Recipes/Sauces"));
+  });
+
+  it.each(["/../Private", "/..", "/./../Private", "//Private", "/Sauces/../../Private", "/x\\..\\..\\Private"])(
+    "refuses the mount path %s",
+    async (suffix) => {
+      const target = await targetDir(Modes.NOTES, "bob", `${mountName}${suffix}`);
+
+      expect(target.isMount).toBe(false);
+      expect(target.owner).toBe("bob");
+      expect(target.dir.startsWith(dirOf(Modes.NOTES, "alice"))).toBe(false);
+    },
+  );
+
+  it("does not create a note in the owner's private folder", async () => {
+    const form = new FormData();
+    form.append("title", "planted");
+    form.append("category", `${mountName}/../Private`);
+    form.append("rawContent", "hi");
+
+    await makeNote(bob, form);
+
+    expect(privateFiles(Modes.NOTES)).toEqual(["diary.md"]);
+  });
+
+  it("does not create a checklist in the owner's private folder", async () => {
+    const [listMount] = await mountsFor(Modes.CHECKLISTS, "bob");
+    const form = new FormData();
+    form.append("title", "planted");
+    form.append("category", `${listMount.displayName}/../Private`);
+
+    await makeList(bob, form);
+
+    expect(privateFiles(Modes.CHECKLISTS)).toEqual(["diary.md"]);
+  });
+
+  it("does not move a shared note into the owner's private folder on update", async () => {
+    const form = new FormData();
+    form.append("uuid", SHARED_NOTE);
+    form.append("title", "pasta");
+    form.append("content", "- [ ] milk");
+    form.append("category", `${mountName}/../Private`);
+
+    await updateNote(form);
+
+    expect(privateFiles(Modes.NOTES)).toEqual(["diary.md"]);
+    expect(existsSync(path.join(dirOf(Modes.NOTES, "alice", "Recipes"), "pasta.md"))).toBe(true);
+  });
+
+  it("does not create a category inside the owner's private folder", async () => {
+    const form = new FormData();
+    form.append("name", "planted");
+    form.append("parent", `${mountName}/../Private`);
+    form.append("mode", Modes.NOTES);
+
+    await createCategory(form);
+
+    expect(privateFiles(Modes.NOTES)).toEqual(["diary.md"]);
+  });
+
+  it("does not move the owner's private folder into the share", async () => {
+    const form = new FormData();
+    form.append("mode", Modes.NOTES);
+    form.append("activeType", "category");
+    form.append("activeCategoryPath", `${mountName}/../Private`);
+    form.append("overType", "category");
+    form.append("targetCategoryPath", mountName);
+
+    await moveNode(form);
+
+    expect(existsSync(dirOf(Modes.NOTES, "alice", "Private/diary.md"))).toBe(true);
+    expect(existsSync(dirOf(Modes.NOTES, "alice", "Recipes/Private"))).toBe(false);
+  });
+});
diff --git a/tests/security/server-action-surface.test.ts b/tests/security/server-action-surface.test.ts
new file mode 100644
index 000000000..fabb01a81
--- /dev/null
+++ b/tests/security/server-action-surface.test.ts
@@ -0,0 +1,219 @@
+import { describe, it, expect } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+
+const ROOT = path.resolve(__dirname, "../..");
+const APP = path.join(ROOT, "app");
+
+const CALLER_GATES = new Set([
+  "getCurrentUser",
+  "getCurrentUserRecord",
+  "getUsername",
+  "isAdmin",
+  "isAuthenticated",
+  "canAccessAllContent",
+  "sessionActor",
+  "getSessionId",
+  "cookies",
+]);
+
+const NEVER_AN_ACTION = [
+  "createSession",
+  "swapSession",
+  "readSessions",
+  "readSessionData",
+  "removeSession",
+  "removeAllSessionsForUser",
+  "clearAllSessions",
+  "updateSessionActivity",
+  "getSessionsForUser",
+  "authenticateApiKey",
+  "ensureUser",
+  "_updateUserCore",
+  "_deleteUserCore",
+  "getUserIndex",
+  "getUserByItemUuid",
+  "decryptMfaSecret",
+  "encryptMfaSecret",
+  "logAudit",
+  "logAuthEvent",
+  "logUserEvent",
+  "logContentEvent",
+  "getDailyLogPath",
+  "getDateRange",
+  "countOldLogs",
+  "sweepOldLogs",
+  "readNotesRecursively",
+  "readListsRecursively",
+  "buildCategoryTree",
+  "categoriesFor",
+  "canReach",
+  "reachableFile",
+  "canReachFile",
+  "resolveAccess",
+  "sharedFiles",
+  "listMounts",
+  "globalShares",
+  "sharedForUser",
+  "sharesInvolving",
+  "allShared",
+  "readCatInfo",
+  "writeCatInfo",
+  "patchCatInfo",
+  "catUuid",
+  "ensureRepo",
+  "commitNote",
+  "commitCategoryRename",
+  "scanReminders",
+];
+
+const PUBLIC_ACTIONS: Record<string, string> = {
+  "auth/index.ts#register": "first-run setup, refuses once a user exists",
+  "auth/index.ts#login": "the login form",
+  "auth/index.ts#verifyMfaLogin": "gated by the pending-MFA cookie",
+  "config/settings.ts#getSettings": "public instance settings, no secrets",
+  "config/settings.ts#getBorderRadius": "theme value for the login page",
+  "config/css.ts#loadCustomCSS": "theme CSS for every page",
+  "config/emojis.ts#loadCustomEmojis": "theme data for every page",
+  "config/themes.ts#loadCustomThemes": "theme data for every page",
+  "config/helpers.ts#readPackageVersion": "the running version",
+  "github/index.ts#getLatestGitHubRelease": "fixed public URL",
+  "users/queries.ts#hasUsers": "first-run check on the login page",
+  "users/queries.ts#getPublicUser": "public profile fields only",
+  "users/queries.ts#getUserByNoteUuid": "public owner fields for public pages",
+  "users/queries.ts#getUserByChecklistUuid": "public owner fields for public pages",
+  "dashboard/index.ts#toggleArchive": "delegates to updateNote/updateList, which check the caller",
+  "share/lookups.ts#folderShares": "delegates to folderShares, which resolves the session user",
+  "checklist/viewer.ts#getChecklistsForDisplay": "delegates to getUserChecklists, which uses the session",
+  "note/viewer.ts#getNotesForDisplay": "delegates to getUserNotes, which uses the session",
+  "checklist-item/reorder.ts#reorderItems": "delegates to rearrangeItems with the session user",
+  "_utils/locale-utils.ts#getAvailableLocales": "static locale list",
+  "_utils/locale-utils.ts#getAvailableLocalesWithNames": "static locale list",
+};
+
+const walk = (dir: string, out: string[] = []): string[] => {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) walk(full, out);
+    else if (/\.tsx?$/.test(entry.name)) out.push(full);
+  }
+  return out;
+};
+
+const isServerModule = (source: ts.SourceFile): boolean => {
+  const first = source.statements[0];
+  return (
+    !!first &&
+    ts.isExpressionStatement(first) &&
+    ts.isStringLiteral(first.expression) &&
+    first.expression.text === "use server"
+  );
+};
+
+const exportedName = (node: ts.Node): string[] => {
+  const exported = ts.canHaveModifiers(node) &&
+    ts.getModifiers(node)?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+
+  if (ts.isExportDeclaration(node) && !node.isTypeOnly && node.exportClause && ts.isNamedExports(node.exportClause)) {
+    return node.exportClause.elements.filter((e) => !e.isTypeOnly).map((e) => e.name.text);
+  }
+  if (!exported) return [];
+  if (ts.isFunctionDeclaration(node) && node.name) return [node.name.text];
+  if (ts.isVariableStatement(node)) {
+    return node.declarationList.declarations
+      .map((d) => d.name)
+      .filter(ts.isIdentifier)
+      .map((n) => n.text);
+  }
+  return [];
+};
+
+const localBodies = (source: ts.SourceFile): Map<string, ts.Node> => {
+  const bodies = new Map<string, ts.Node>();
+  for (const statement of source.statements) {
+    if (ts.isFunctionDeclaration(statement) && statement.name) {
+      bodies.set(statement.name.text, statement);
+    }
+    if (ts.isVariableStatement(statement)) {
+      for (const decl of statement.declarationList.declarations) {
+        if (ts.isIdentifier(decl.name) && decl.initializer) {
+          bodies.set(decl.name.text, decl.initializer);
+        }
+      }
+    }
+  }
+  return bodies;
+};
+
+const reachesGate = (
+  name: string,
+  bodies: Map<string, ts.Node>,
+  seen = new Set<string>(),
+): boolean => {
+  if (seen.has(name)) return false;
+  seen.add(name);
+
+  const body = bodies.get(name);
+  if (!body) return false;
+
+  let found = false;
+  const visit = (node: ts.Node) => {
+    if (found) return;
+    if (ts.isIdentifier(node)) {
+      if (CALLER_GATES.has(node.text)) found = true;
+      else if (node.text !== name && bodies.has(node.text) && reachesGate(node.text, bodies, seen)) {
+        found = true;
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(body);
+  return found;
+};
+
+const surface = walk(APP).flatMap((file) => {
+  const source = ts.createSourceFile(file, fs.readFileSync(file, "utf8"), ts.ScriptTarget.Latest, true);
+  if (!isServerModule(source)) return [];
+
+  const bodies = localBodies(source);
+  const key = path.relative(path.join(APP, "_server/actions"), file).startsWith("..")
+    ? path.relative(APP, file)
+    : path.relative(path.join(APP, "_server/actions"), file);
+
+  return source.statements.flatMap(exportedName).map((name) => ({
+    id: `${key.split(path.sep).join("/")}#${name}`,
+    name,
+    reExported: !bodies.has(name),
+    guarded: reachesGate(name, bodies),
+  }));
+});
+
+describe("Security: every server action checks its caller", () => {
+  it("finds the server action modules", () => {
+    expect(surface.length).toBeGreaterThan(100);
+  });
+
+  it("never exposes an internal helper as a server action", () => {
+    const exposed = surface.filter((entry) => NEVER_AN_ACTION.includes(entry.name));
+    expect(exposed.map((entry) => entry.id)).toEqual([]);
+  });
+
+  it("does not re-export from a server action module", () => {
+    expect(surface.filter((entry) => entry.reExported).map((entry) => entry.id)).toEqual([]);
+  });
+
+  it("reaches a caller check in every export, or is knowingly public", () => {
+    const unguarded = surface
+      .filter((entry) => !entry.guarded && !PUBLIC_ACTIONS[entry.id])
+      .map((entry) => entry.id);
+
+    expect(unguarded).toEqual([]);
+  });
+
+  it("keeps the public allowlist honest", () => {
+    const ids = new Set(surface.map((entry) => entry.id));
+    const stale = Object.keys(PUBLIC_ACTIONS).filter((id) => !ids.has(id));
+    expect(stale).toEqual([]);
+  });
+});
diff --git a/tests/security/share-grants.test.ts b/tests/security/share-grants.test.ts
index f8c9c276f..a181b1647 100644
--- a/tests/security/share-grants.test.ts
+++ b/tests/security/share-grants.test.ts
@@ -90,7 +90,7 @@ vi.mock('@/app/_server/actions/notifications/internal', () => ({
   notifyUser: vi.fn(),
 }))
 
-vi.mock('@/app/_server/actions/api', () => ({
+vi.mock('@/app/_server/actions/api/authenticate', () => ({
   authenticateApiKey: (...args: unknown[]) => mockAuthenticateApiKey(...args),
 }))
 
diff --git a/tests/security/sweep-guards.test.ts b/tests/security/sweep-guards.test.ts
new file mode 100644
index 000000000..46eba4e08
--- /dev/null
+++ b/tests/security/sweep-guards.test.ts
@@ -0,0 +1,146 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import path from "path";
+import { createFormData, mockFs, resetAllMocks } from "../setup";
+
+const mockGetCurrentUser = vi.fn();
+const mockReachableFile = vi.fn();
+const mockGetListById = vi.fn();
+const mockServerWriteFile = vi.fn();
+const mockSweep = vi.fn();
+const mockCount = vi.fn();
+
+vi.mock("@/app/_server/actions/users", () => ({
+  getCurrentUser: () => mockGetCurrentUser(),
+  isAdmin: async () => Boolean((await mockGetCurrentUser())?.isAdmin),
+}));
+
+vi.mock("@/app/_server/actions/share/queries", () => ({
+  canReach: vi.fn().mockResolvedValue(false),
+  reachableFile: (...args: unknown[]) => mockReachableFile(...args),
+}));
+
+vi.mock("@/app/_server/actions/checklist/queries", () => ({
+  getListById: (...args: unknown[]) => mockGetListById(...args),
+  getUserChecklists: vi.fn(),
+}));
+
+vi.mock("@/app/_server/actions/file", () => ({
+  serverWriteFile: (...args: unknown[]) => mockServerWriteFile(...args),
+  ensureDir: vi.fn(),
+}));
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({ broadcast: vi.fn() }));
+
+vi.mock("@/app/_server/actions/log/sweep", () => ({
+  sweepOldLogs: (...args: unknown[]) => mockSweep(...args),
+  countOldLogs: (...args: unknown[]) => mockCount(...args),
+}));
+
+vi.mock("@/app/_server/api/caller-scope", () => ({ apiCaller: () => undefined }));
+
+vi.mock("next/headers", () => ({
+  cookies: () => ({ get: vi.fn() }),
+  headers: () => ({ get: () => null }),
+}));
+
+import { convertChecklistType } from "@/app/_server/actions/checklist/converters";
+import { cleanupOldLogs, checkCleanupNeeded } from "@/app/_server/actions/log/cleanup";
+import { logAudit } from "@/app/_server/actions/log/writers";
+
+const LIST_PATH = "/srv/jotty/data/checklists/alice/Home/groceries.md";
+
+describe("Security: sweep guards", () => {
+  beforeEach(() => {
+    resetAllMocks();
+    mockServerWriteFile.mockReset();
+    mockReachableFile.mockReset();
+    mockGetListById.mockReset();
+    mockSweep.mockReset().mockResolvedValue({ success: true, deletedFiles: 0 });
+    mockCount.mockReset().mockResolvedValue({ needed: false, count: 0, maxAge: 0 });
+  });
+
+  describe("convertChecklistType", () => {
+    const convert = () =>
+      convertChecklistType(createFormData({ uuid: "list-uuid", newType: "task" }));
+
+    it("refuses without a session", async () => {
+      mockGetCurrentUser.mockResolvedValue(null);
+
+      expect(await convert()).toEqual({ error: "Not authenticated" });
+      expect(mockServerWriteFile).not.toHaveBeenCalled();
+    });
+
+    it("refuses a user without edit on the list", async () => {
+      mockGetCurrentUser.mockResolvedValue({ username: "mallory" });
+      mockReachableFile.mockResolvedValue(null);
+
+      expect(await convert()).toEqual({ error: "Permission denied" });
+      expect(mockReachableFile).toHaveBeenCalledWith("list-uuid", "checklist", "mallory", "canEdit");
+      expect(mockServerWriteFile).not.toHaveBeenCalled();
+    });
+
+    it("writes to the file the permission check resolved", async () => {
+      mockGetCurrentUser.mockResolvedValue({ username: "bob" });
+      mockReachableFile.mockResolvedValue(LIST_PATH);
+      mockGetListById.mockResolvedValue({
+        id: "somewhere-else",
+        uuid: "list-uuid",
+        type: "simple",
+        category: "../../mallory",
+        owner: "mallory",
+        createdAt: "2024-01-01",
+        items: [],
+      });
+
+      await convert();
+
+      expect(mockServerWriteFile).toHaveBeenCalledTimes(1);
+      expect(mockServerWriteFile.mock.calls[0][0]).toBe(LIST_PATH);
+    });
+  });
+
+  describe("log cleanup", () => {
+    it("refuses without a session", async () => {
+      mockGetCurrentUser.mockResolvedValue(null);
+
+      expect((await cleanupOldLogs()).success).toBe(false);
+      expect(mockSweep).not.toHaveBeenCalled();
+    });
+
+    it("keeps a regular user to their own logs", async () => {
+      mockGetCurrentUser.mockResolvedValue({ username: "bob", isAdmin: false });
+
+      expect((await cleanupOldLogs("alice", 1)).success).toBe(false);
+      await cleanupOldLogs(undefined, 1);
+
+      expect(mockSweep).toHaveBeenCalledTimes(1);
+      expect(mockSweep).toHaveBeenCalledWith("bob", 1);
+    });
+
+    it("refuses a traversing username even for an admin", async () => {
+      mockGetCurrentUser.mockResolvedValue({ username: "root", isAdmin: true });
+
+      expect((await cleanupOldLogs("../../notes/alice", 1)).success).toBe(false);
+      expect((await checkCleanupNeeded("../x")).needed).toBe(false);
+      expect(mockSweep).not.toHaveBeenCalled();
+      expect(mockCount).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("audit log paths", () => {
+    it.each(["../../notes/alice/Secret", "a/b", "..", ".hidden", "a\0b"])(
+      "keeps the entry for %j inside the logs folder",
+      async (username) => {
+        mockGetCurrentUser.mockResolvedValue(null);
+        mockFs.readFile.mockRejectedValue(new Error("ENOENT"));
+        mockFs.writeFile.mockResolvedValue(undefined);
+
+        await logAudit({ level: "WARNING", action: "login", category: "auth", success: false, username });
+
+        const written = String(mockFs.writeFile.mock.calls[0][0]);
+        const logsRoot = path.join(process.cwd(), "data", "logs", "system") + path.sep;
+        expect(written.startsWith(logsRoot)).toBe(true);
+      },
+    );
+  });
+});
diff --git a/tests/security/upload-delete.test.ts b/tests/security/upload-delete.test.ts
new file mode 100644
index 000000000..aaeebcb7b
--- /dev/null
+++ b/tests/security/upload-delete.test.ts
@@ -0,0 +1,87 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import path from 'path'
+import { mockFs, resetAllMocks, createFormData } from '../setup'
+
+const mockGetCurrentUser = vi.fn()
+const mockServerDeleteFile = vi.fn()
+const { USER_DIR } = vi.hoisted(() => ({ USER_DIR: '/srv/jotty/data/notes/alice' }))
+
+vi.mock('@/app/_server/actions/users', () => ({
+  getCurrentUser: () => mockGetCurrentUser(),
+}))
+
+vi.mock('@/app/_server/actions/file', () => ({
+  getUserModeDir: vi.fn().mockResolvedValue(USER_DIR),
+  serverDeleteFile: (...args: unknown[]) => mockServerDeleteFile(...args),
+}))
+
+vi.mock('@/app/_server/actions/config', () => ({
+  getSettings: vi.fn().mockResolvedValue({}),
+}))
+
+import { deleteFile } from '@/app/_server/actions/upload'
+
+const attempt = (fileName: string, fileType = 'image') =>
+  deleteFile(createFormData({ fileName, fileType }))
+
+describe('Security: deleteFile stays inside the upload folder', () => {
+  beforeEach(() => {
+    resetAllMocks()
+    mockServerDeleteFile.mockReset().mockResolvedValue(undefined)
+    mockGetCurrentUser.mockResolvedValue({ username: 'alice' })
+    mockFs.stat.mockResolvedValue({ isFile: () => true })
+  })
+
+  it.each([
+    '../../bob/Uncategorized/diary.md',
+    '../../../users/users.json',
+    '..',
+    '/etc/passwd',
+    path.resolve(USER_DIR, '..', 'bob', 'x.png'),
+    '..%2F..%2Fbob%2Fnote.md',
+    '%2e%2e%2f%2e%2e%2fusers.json',
+    '..%5C..%5Cusers.json',
+    'nested/pic.png',
+    'pic.png\0.md',
+    'pic.png%00',
+    '%E0%A4%A',
+  ])('refuses %s and deletes nothing', async (fileName) => {
+    const result = await attempt(fileName)
+
+    expect(result.success).toBe(false)
+    expect(mockServerDeleteFile).not.toHaveBeenCalled()
+    expect(mockFs.unlink).not.toHaveBeenCalled()
+  })
+
+  it('refuses without a session', async () => {
+    mockGetCurrentUser.mockResolvedValue(null)
+
+    expect((await attempt('pic.png')).success).toBe(false)
+    expect(mockServerDeleteFile).not.toHaveBeenCalled()
+  })
+
+  it('refuses to delete a directory', async () => {
+    mockFs.stat.mockResolvedValue({ isFile: () => false })
+
+    expect((await attempt('pic.png')).success).toBe(false)
+    expect(mockServerDeleteFile).not.toHaveBeenCalled()
+  })
+
+  it('reports a missing file', async () => {
+    mockFs.stat.mockRejectedValue(Object.assign(new Error('nope'), { code: 'ENOENT' }))
+
+    expect(await attempt('gone.png')).toEqual({ success: false, error: 'File not found' })
+  })
+
+  it.each([
+    ['image', 'images'],
+    ['video', 'videos'],
+    ['file', 'files'],
+  ])('deletes a plain %s through the file helper', async (fileType, folder) => {
+    const result = await attempt('pic-1.png', fileType)
+
+    expect(result.success).toBe(true)
+    expect(mockServerDeleteFile).toHaveBeenCalledWith(path.join(USER_DIR, folder, 'pic-1.png'))
+    expect(mockFs.unlink).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/security/uuid-cross-user.test.ts b/tests/security/uuid-cross-user.test.ts
new file mode 100644
index 000000000..c204bb41d
--- /dev/null
+++ b/tests/security/uuid-cross-user.test.ts
@@ -0,0 +1,96 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import nodeFs from "fs";
+import os from "os";
+import path from "path";
+import { mockFs, resetAllMocks } from "../setup";
+import { RelationsStatus } from "@/app/_consts/relations";
+import type { SanitisedUser } from "@/app/_types";
+
+vi.mock("@/app/_server/actions/ws/broadcast", () => ({ broadcast: vi.fn() }));
+vi.mock("@/app/_server/actions/history/repo", () => ({ commitNote: vi.fn().mockResolvedValue({ success: true }) }));
+vi.mock("@/app/_server/actions/log", () => ({ logContentEvent: vi.fn(), logAudit: vi.fn() }));
+vi.mock("@/app/_server/actions/users", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/app/_server/actions/users")>()),
+  canAccessAllContent: async () => false,
+}));
+
+import { findClashes, findCrossUserClashes } from "@/app/_server/actions/uuid-clash/scan";
+import { spliceNote } from "@/app/_server/actions/note/splice";
+import { getUserByNoteUuid } from "@/app/_server/actions/users";
+import { closeRelationsDb, setRelationsStatus } from "@/app/_server/actions/relations/store";
+
+const DUP = "dddddddd-1111-4222-8333-944455556666";
+const alice = { username: "alice" } as SanitisedUser;
+
+let root: string;
+
+const noteFile = (owner: string) => path.join(root, "data", "notes", owner, "Home", "plan.md");
+
+const put = (owner: string, createdAt: string, body: string) => {
+  nodeFs.mkdirSync(path.dirname(noteFile(owner)), { recursive: true });
+  nodeFs.writeFileSync(noteFile(owner), `---\nuuid: ${DUP}\ntitle: Plan\ncreatedAt: ${createdAt}\n---\n${body}\n`);
+};
+
+describe("Security: a uuid shared across users", () => {
+  beforeEach(async () => {
+    resetAllMocks();
+    const real = await vi.importActual<typeof import("fs/promises")>("fs/promises");
+    mockFs.readFile.mockImplementation(real.readFile as never);
+    mockFs.writeFile.mockImplementation(real.writeFile as never);
+    mockFs.stat.mockImplementation(real.stat as never);
+    mockFs.rename.mockImplementation(real.rename as never);
+    mockFs.mkdir.mockImplementation(real.mkdir as never);
+    mockFs.access.mockImplementation(real.access as never);
+    mockFs.unlink.mockImplementation(real.unlink as never);
+    mockFs.readdir.mockImplementation(real.readdir as never);
+    root = nodeFs.mkdtempSync(path.join(os.tmpdir(), "jotty-cross-uuid-"));
+    vi.spyOn(process, "cwd").mockReturnValue(root);
+    process.env.JOTTY_RELATIONS_DB = path.join(root, "relations.db");
+    closeRelationsDb();
+    setRelationsStatus(RelationsStatus.READY);
+    vi.spyOn(console, "warn").mockImplementation(() => undefined);
+
+    nodeFs.mkdirSync(path.join(root, "data", "users"), { recursive: true });
+    nodeFs.writeFileSync(
+      path.join(root, "data", "users", "users.json"),
+      JSON.stringify([{ username: "bob" }, { username: "alice" }]),
+    );
+    put("alice", "2019-01-01T00:00:00.000Z", "alice's plan");
+    put("bob", "2024-01-01T00:00:00.000Z", "bob's private plan");
+  });
+
+  afterEach(() => {
+    closeRelationsDb();
+    vi.restoreAllMocks();
+    nodeFs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("is invisible to the per-owner scan", async () => {
+    expect(await findClashes("alice")).toEqual([]);
+    expect(await findClashes("bob")).toEqual([]);
+  });
+
+  it("is reported by the cross-user scan with the keeper first", async () => {
+    const [clash] = await findCrossUserClashes(["alice", "bob"]);
+
+    expect(clash.uuid).toBe(DUP);
+    expect(clash.owner).toBe("alice");
+    expect(clash.owners?.sort()).toEqual(["alice", "bob"]);
+    expect(clash.files.map((file) => [file.owner, file.keeps])).toEqual([
+      ["alice", true],
+      ["bob", false],
+    ]);
+  });
+
+  it("resolves the owner from the same file the permission check uses", async () => {
+    expect((await getUserByNoteUuid(DUP)).data?.username).toBe("alice");
+  });
+
+  it("writes an edit into the file the caller was allowed to edit", async () => {
+    const result = await spliceNote(alice, DUP, (body) => ({ body: `${body}edited\n` }));
+
+    expect(result.success).toBe(true);
+    expect(nodeFs.readFileSync(noteFile("alice"), "utf-8")).toContain("edited");
+    expect(nodeFs.readFileSync(noteFile("bob"), "utf-8")).not.toContain("edited");
+  });
+});
diff --git a/tests/server-actions/api-key.test.ts b/tests/server-actions/api-key.test.ts
index cedec6e73..90e3c15b0 100644
--- a/tests/server-actions/api-key.test.ts
+++ b/tests/server-actions/api-key.test.ts
@@ -11,7 +11,7 @@ vi.mock('@/app/_server/actions/file', () => ({
   writeJsonFile: (...args: any[]) => mockWriteJsonFile(...args),
 }))
 
-vi.mock('@/app/_server/actions/session', () => ({
+vi.mock('@/app/_server/actions/session/store', () => ({
   getSessionId: (...args: any[]) => mockGetSessionId(...args),
   readSessions: (...args: any[]) => mockReadSessions(...args),
   removeAllSessionsForUser: vi.fn().mockResolvedValue(undefined),
@@ -23,11 +23,8 @@ vi.mock('@/app/_server/actions/log', () => ({
   logAuthEvent: vi.fn(),
 }))
 
-import {
-  authenticateApiKey,
-  generateApiKey,
-  getApiKey,
-} from '@/app/_server/actions/api'
+import { generateApiKey, getApiKey } from '@/app/_server/actions/api'
+import { authenticateApiKey } from '@/app/_server/actions/api/authenticate'
 
 describe('API key actions', () => {
   const userWithKey = () => ({
diff --git a/tests/server-actions/auth.test.ts b/tests/server-actions/auth.test.ts
index 8c6dc16e8..d8fef350f 100644
--- a/tests/server-actions/auth.test.ts
+++ b/tests/server-actions/auth.test.ts
@@ -9,7 +9,7 @@ import {
   createFormData,
 } from '../setup'
 
-vi.mock('@/app/_server/actions/session', () => ({
+vi.mock('@/app/_server/actions/session/store', () => ({
   createSession: vi.fn().mockResolvedValue(undefined),
   readSessionData: vi.fn().mockResolvedValue({}),
   readSessions: vi.fn().mockResolvedValue({}),
@@ -30,6 +30,9 @@ vi.mock('@/app/_server/actions/log', () => ({
 
 vi.mock('@/app/_server/actions/users', () => ({
   getUsername: vi.fn().mockResolvedValue('testuser'),
+}))
+
+vi.mock('@/app/_server/actions/users/ensure-user', () => ({
   ensureUser: vi.fn().mockResolvedValue(undefined),
 }))
 
@@ -39,8 +42,8 @@ vi.mock('@/app/_server/actions/auth/ldap', () => ({
 
 import { register, login, logout } from '@/app/_server/actions/auth'
 import { readJsonFile, writeJsonFile } from '@/app/_server/actions/file'
-import { readSessions, createSession } from '@/app/_server/actions/session'
-import { ensureUser } from '@/app/_server/actions/users'
+import { readSessions, createSession } from '@/app/_server/actions/session/store'
+import { ensureUser } from '@/app/_server/actions/users/ensure-user'
 import { ldapLogin } from '@/app/_server/actions/auth/ldap'
 
 const mockReadJsonFile = readJsonFile as ReturnType<typeof vi.fn>
diff --git a/tests/server-actions/history.test.ts b/tests/server-actions/history.test.ts
index d251d8305..65383b9fd 100644
--- a/tests/server-actions/history.test.ts
+++ b/tests/server-actions/history.test.ts
@@ -18,14 +18,17 @@ vi.mock("@/app/_server/actions/users", () => ({
 }));
 
 vi.mock("@/app/_server/actions/share/queries", () => ({
-    canReach: (...args: any[]) => mockCanReach(...args),
+    reachableFile: async (uuid: string, ...rest: any[]) =>
+        (await mockCanReach(uuid, ...rest))
+            ? `${process.cwd()}/data/notes/testuser/Category/${uuid}.md`
+            : null,
 }));
 
 vi.mock("@/app/_server/actions/note/queries", () => ({
     getNoteById: (...args: any[]) => mockGetNoteById(...args),
 }));
 
-vi.mock("@/app/_server/actions/history", async (importOriginal) => {
+vi.mock("@/app/_server/actions/history/repo", async (importOriginal) => {
     const original = (await importOriginal()) as any;
     return {
         ...original,
diff --git a/tests/server-actions/item-lane.test.ts b/tests/server-actions/item-lane.test.ts
index d67663d18..f94f11074 100644
--- a/tests/server-actions/item-lane.test.ts
+++ b/tests/server-actions/item-lane.test.ts
@@ -57,7 +57,7 @@ vi.mock("@/app/_server/actions/ws/broadcast", () => ({
   broadcast: vi.fn().mockResolvedValue(undefined),
 }));
 
-vi.mock("@/app/_server/actions/history", () => ({
+vi.mock("@/app/_server/actions/history/repo", () => ({
   commitNote: vi.fn().mockResolvedValue(undefined),
 }));
 
diff --git a/tests/server-actions/note-move-safety.test.ts b/tests/server-actions/note-move-safety.test.ts
index 2b6233f54..65a306ea1 100644
--- a/tests/server-actions/note-move-safety.test.ts
+++ b/tests/server-actions/note-move-safety.test.ts
@@ -47,7 +47,7 @@ vi.mock("@/app/_server/actions/ws/broadcast", () => ({
   broadcast: vi.fn().mockResolvedValue(undefined),
 }));
 
-vi.mock("@/app/_server/actions/history", () => ({
+vi.mock("@/app/_server/actions/history/repo", () => ({
   commitNote: vi.fn().mockResolvedValue(undefined),
 }));
 
diff --git a/tests/server-actions/note-splice.test.ts b/tests/server-actions/note-splice.test.ts
index ab6e2376b..cb38c5a93 100644
--- a/tests/server-actions/note-splice.test.ts
+++ b/tests/server-actions/note-splice.test.ts
@@ -13,12 +13,10 @@ vi.mock("@/app/_server/actions/ws/broadcast", () => ({
   broadcast: (...args: unknown[]) => mockBroadcast(...args),
 }));
 vi.mock("@/app/_server/actions/share/queries", () => ({
-  canReach: (...args: unknown[]) => mockCanReach(...args),
+  reachableFile: async (...args: unknown[]) =>
+    (await mockCanReach(...args)) ? filePath : null,
 }));
-vi.mock("@/app/_server/actions/users", () => ({
-  getUserByNoteUuid: async () => ({ success: true, data: { username: "alice" } }),
-}));
-vi.mock("@/app/_server/actions/history", () => ({ commitNote: vi.fn().mockResolvedValue({ success: true }) }));
+vi.mock("@/app/_server/actions/history/repo", () => ({ commitNote: vi.fn().mockResolvedValue({ success: true }) }));
 vi.mock("@/app/_server/actions/log", () => ({ logContentEvent: vi.fn() }));
 
 import { SPLICE_DENIED, SPLICE_ENCRYPTED, spliceNote } from "@/app/_server/actions/note/splice";
diff --git a/tests/server-actions/note.test.ts b/tests/server-actions/note.test.ts
index 967f7a89c..c18dd3c51 100644
--- a/tests/server-actions/note.test.ts
+++ b/tests/server-actions/note.test.ts
@@ -75,7 +75,7 @@ vi.mock("@/app/_server/actions/relations/tidy", () => ({
   refreshWikilinks: (markdown: string) => markdown,
 }));
 
-vi.mock("@/app/_server/actions/history", () => ({
+vi.mock("@/app/_server/actions/history/repo", () => ({
   commitNote: (...args: any[]) => mockCommitNote(...args),
 }));
 
diff --git a/tests/server-actions/session.test.ts b/tests/server-actions/session.test.ts
index edebcccee..eba9cbe23 100644
--- a/tests/server-actions/session.test.ts
+++ b/tests/server-actions/session.test.ts
@@ -46,6 +46,9 @@ import {
   getSessionId,
   removeAllSessionsForUser,
   clearAllSessions,
+} from "@/app/_server/actions/session/store";
+import {
+  getMySessions,
   terminateSession,
   terminateAllOtherSessions,
 } from "@/app/_server/actions/session";
@@ -291,7 +294,12 @@ describe("Session Actions", () => {
     });
 
     it("should terminate session successfully", async () => {
-      mockReadJsonFile.mockResolvedValue({});
+      mockReadJsonFile.mockResolvedValue({
+        "session-to-terminate": {
+          id: "session-to-terminate",
+          username: "testuser",
+        },
+      });
 
       const formData = createFormData({ sessionId: "session-to-terminate" });
 
@@ -306,6 +314,29 @@ describe("Session Actions", () => {
     });
   });
 
+  describe("getMySessions", () => {
+    it("should refuse without a session", async () => {
+      mockGetCurrentUser.mockResolvedValue(null);
+
+      expect(await getMySessions()).toBeNull();
+    });
+
+    it("should only list the caller's sessions and flag the current one", async () => {
+      mockReadJsonFile.mockResolvedValue({
+        "session-123": { id: "session-123", username: "testuser" },
+        "session-456": { id: "session-456", username: "testuser" },
+        "session-789": { id: "session-789", username: "victim" },
+      });
+
+      const result = await getMySessions();
+
+      expect(result?.map((s) => [s.id, s.isCurrent])).toEqual([
+        ["session-123", true],
+        ["session-456", false],
+      ]);
+    });
+  });
+
   describe("terminateAllOtherSessions", () => {
     it("should return error when not authenticated", async () => {
       mockGetCurrentUser.mockResolvedValue(null);
diff --git a/tests/server-actions/share-edit.test.ts b/tests/server-actions/share-edit.test.ts
index 7d67b7e30..e28fb2eb2 100644
--- a/tests/server-actions/share-edit.test.ts
+++ b/tests/server-actions/share-edit.test.ts
@@ -20,7 +20,7 @@ vi.mock("@/app/_server/actions/ws/broadcast", () => ({
   broadcast: vi.fn(),
 }));
 
-vi.mock("@/app/_server/actions/history", () => ({
+vi.mock("@/app/_server/actions/history/repo", () => ({
   commitNote: vi.fn().mockResolvedValue(undefined),
 }));
 
diff --git a/tests/server-actions/share-visibility.test.ts b/tests/server-actions/share-visibility.test.ts
index cb7fd0bd2..b2cd78839 100644
--- a/tests/server-actions/share-visibility.test.ts
+++ b/tests/server-actions/share-visibility.test.ts
@@ -25,7 +25,7 @@ vi.mock("@/app/_server/actions/users", async (importOriginal) => ({
   canAccessAllContent: async () => false,
 }));
 
-import { getCategories } from "@/app/_server/actions/category/queries";
+import { categoriesFor } from "@/app/_server/actions/category/tree";
 import { getUserChecklists } from "@/app/_server/actions/checklist/queries";
 import { getUserNotes } from "@/app/_server/actions/note/queries";
 import { dropMounts, mountsFor } from "@/app/_server/actions/share/mounts";
@@ -102,7 +102,7 @@ describe("Share visibility on disk", () => {
       sharing: { users: { bob: READ_ONLY }, inherit: true },
     });
 
-    const categories = await getCategories(Modes.CHECKLISTS, "bob");
+    const categories = await categoriesFor(Modes.CHECKLISTS, "bob");
     const lists = await getUserChecklists({
       username: "bob",
       metadataOnly: true,
@@ -136,7 +136,7 @@ describe("Share visibility on disk", () => {
       metadataOnly: true,
       preserveOrder: true,
     });
-    const categories = await getCategories(Modes.CHECKLISTS, "bob");
+    const categories = await categoriesFor(Modes.CHECKLISTS, "bob");
 
     expect(permsOf(lists.data || [])).toEqual({
       [LIST_FULL]: FULL,
diff --git a/tests/server-actions/user-deletion.test.ts b/tests/server-actions/user-deletion.test.ts
index 3aa9b49d5..5f9a88085 100644
--- a/tests/server-actions/user-deletion.test.ts
+++ b/tests/server-actions/user-deletion.test.ts
@@ -39,7 +39,7 @@ vi.mock("@/app/_server/actions/users", async (importOriginal) => ({
   canAccessAllContent: async () => false,
 }));
 
-import { _deleteUserCore } from "@/app/_server/actions/users/crud";
+import { _deleteUserCore } from "@/app/_server/actions/users/core";
 import { revokeGrants } from "@/app/_server/actions/share/rename";
 import { dropMounts, mountsFor } from "@/app/_server/actions/share/mounts";
 import { canReach } from "@/app/_server/actions/share/queries";
diff --git a/tests/server-actions/users.test.ts b/tests/server-actions/users.test.ts
index 68f3fcb98..0b6f0a9da 100644
--- a/tests/server-actions/users.test.ts
+++ b/tests/server-actions/users.test.ts
@@ -14,7 +14,7 @@ vi.mock('@/app/_server/actions/file', () => ({
   writeJsonFile: (...args: any[]) => mockWriteJsonFile(...args),
 }))
 
-vi.mock('@/app/_server/actions/session', () => ({
+vi.mock('@/app/_server/actions/session/store', () => ({
   getSessionId: (...args: any[]) => mockGetSessionId(...args),
   readSessions: (...args: any[]) => mockReadSessions(...args),
   removeAllSessionsForUser: vi.fn().mockResolvedValue(undefined),
@@ -41,8 +41,8 @@ import {
   getUsers,
   getUsersForAdmin,
   updateUserSettings,
-  ensureUser,
 } from '@/app/_server/actions/users'
+import { ensureUser } from '@/app/_server/actions/users/ensure-user'
 import { getCurrentUserRecord } from '@/app/_server/actions/users/records'
 import { createHash } from 'crypto'
 
@@ -390,7 +390,19 @@ describe('Users Actions', () => {
       expect(result).toEqual([])
     })
 
+    it('should return nothing without a session', async () => {
+      mockGetSessionId.mockResolvedValue('')
+      mockReadSessions.mockResolvedValue({})
+      mockReadJsonFile.mockResolvedValue([
+        { username: 'user1', passwordHash: 'secret', isAdmin: true },
+      ])
+
+      expect(await getUsers()).toEqual([])
+    })
+
     it('should return users without password hash', async () => {
+      mockGetSessionId.mockResolvedValue('sid')
+      mockReadSessions.mockResolvedValue({ sid: 'user1' })
       mockReadJsonFile.mockResolvedValue([
         { username: 'user1', passwordHash: 'secret', isAdmin: true, isSuperAdmin: false, avatarUrl: '/avatar.png' },
         { username: 'user2', passwordHash: 'secret2', isAdmin: false, isSuperAdmin: false },
diff --git a/tests/server-actions/xchacha.test.ts b/tests/server-actions/xchacha.test.ts
index a700f8cd6..d299b3b2a 100644
--- a/tests/server-actions/xchacha.test.ts
+++ b/tests/server-actions/xchacha.test.ts
@@ -2,6 +2,11 @@ import { describe, it, expect, beforeEach, vi } from "vitest";
 import { resetAllMocks, createFormData } from "../setup";
 
 const mockLogAudit = vi.fn();
+const mockGetCurrentUser = vi.fn();
+
+vi.mock("@/app/_server/actions/users", () => ({
+  getCurrentUser: () => mockGetCurrentUser(),
+}));
 
 vi.mock("@/app/_server/actions/log", () => ({
   logAudit: (...args: any[]) => mockLogAudit(...args),
@@ -44,8 +49,19 @@ vi.mock("libsodium-wrappers-sumo", () => ({
 import { encryptXChaCha, decryptXChaCha } from "@/app/_server/actions/xchacha";
 
 describe("XChaCha Actions", () => {
+  it("should refuse to run without a session", async () => {
+    mockGetCurrentUser.mockResolvedValue(null);
+
+    const encrypted = await encryptXChaCha(createFormData({ content: "x", passphrase: "p" }));
+    const decrypted = await decryptXChaCha(createFormData({ encryptedContent: "{}", passphrase: "p" }));
+
+    expect(encrypted).toEqual({ success: false, error: "Not authenticated" });
+    expect(decrypted).toEqual({ success: false, error: "Not authenticated" });
+  });
+
   beforeEach(() => {
     resetAllMocks();
+    mockGetCurrentUser.mockResolvedValue({ username: "alice" });
     mockLogAudit.mockResolvedValue(undefined);
   });