diff --git a/.github/CI.md b/.github/CI.md
index 15b06c5be45..1831aefbb53 100644
--- a/.github/CI.md
+++ b/.github/CI.md
@@ -38,6 +38,8 @@ Memory-heavy builds and browser jobs retain appropriately sized Blacksmith runne
 
 WebKit acceptance on Blacksmith uses the matching, digest-pinned Playwright browser image for mobile and docs navigation. The app, database fixtures, native modules, and harness stay on the host and retain loopback URLs. Chromium and GitHub fallback keep native browser installation and launch. Update both workspace Playwright dependencies, the image index digest, and the expected client version/revision checks together; verify the installed release's native launch timeout and real WebKit acceptance before changing the pin.
 
+HTTP and docs browser installation first asks the pinned Playwright driver to simulate its OS dependency installation. When the simulation requires no package changes, the runner avoids an apt update; missing dependencies, proposed upgrades, or an unsuccessful simulation use the normal dependency installer. Browser selection and downloads still use the pinned driver, including full native Chromium for extension acceptance.
+
 Every HTTP and browser group consumes the same production build in an isolated job/database. Electron also uses that build and skips its development-route warm-up. Local HTTP and Electron development runs retain their dev-server behavior. Build inputs exclude test-only files so a harness edit can reuse an unchanged production build.
 
 Desktop inbox protocol, assistant actions UI, and organization search UI run as three parallel HTTP jobs with isolated databases, apps, and reports. Each harness owns its acceptance task, so an edit selects its own job. The inbox protocol task depends on server and realtime code; the browser tasks also depend on workspace UI. Desktop inbox needs no browser. The UI jobs and browser extension install Chromium while their app starts, waiting for both before executing assertions; browser-install failures still fail the job and preserve the install log. No acceptance assertions are removed by the split.
@@ -71,6 +73,8 @@ The current weights are median test durations in seconds from runs [41496623284]
 
 Desktop native outputs are keyed by source, build recipes, compiler, SDK, OS, architecture, and Node header bytes. Every build still validates restored checksums, executable modes, universal architectures, and the helper signature; invalid or incomplete outputs rebuild. Native-input pushes to main/staging seed trusted Node 22 and 24 caches without repeating the PR smoke suite. PR cache entries never populate trusted branch caches.
 
+Desktop releases resolve and validate their source once, then check out that immutable commit for packaging and four isolated smoke partitions. The release smoke partitions reuse the existing whole-file duration sharder on the release's Node 22 toolchain and run alongside signing and notarization. Historical tags without the sharder retain one complete smoke run, and native compilation caching is optional when the checked-out revision predates it. Packaging retains source checks, package validation, and packaged Electron smoke. Publication waits for packaging and every smoke partition, downloads the packaging job's immutable artifact ID from the same run, verifies any existing release assets, and uploads the updater manifest last. Artifact-only runs never publish.
+
 Each shard uploads its coverage/timing report, the complete discovery report, and its deterministic shard plan. `bun run test:scripts scripts/duration-shards.test.ts scripts/desktop-e2e.test.ts` checks partition coverage, unknown files, deterministic ordering, and balancing. The CLI regression executes tiny browser-free Playwright fixtures to prove that imported test factories and paths containing regex characters are selected correctly; it launches no Electron or browser.
 
 Local pushes run `lint:check` and `type-check` through Husky before Git sends commits. These gates reuse Turborepo's task cache; a failure stops the push. The pre-commit hook still formats staged files, and hosted CI owns tests, audits, builds, and acceptance checks.
diff --git a/.github/scripts/http-e2e.sh b/.github/scripts/http-e2e.sh
index e05cfbf3d09..8c5f185e7cd 100755
--- a/.github/scripts/http-e2e.sh
+++ b/.github/scripts/http-e2e.sh
@@ -75,7 +75,7 @@ start_browser_install() {
   local name=$1
   shift
   browsers_log="$report_dir/$name-playwright-install.log"
-  setsid --wait bunx --no-install playwright install --with-deps "$@" > "$browsers_log" 2>&1 &
+  setsid --wait bash "$GITHUB_WORKSPACE/.github/scripts/install-playwright.sh" "$@" > "$browsers_log" 2>&1 &
   browsers_pid=$!
 }
 
@@ -279,6 +279,7 @@ case "$group" in
     export REDIS_URL=redis://127.0.0.1:6379
     export NEXT_PUBLIC_FORCE_HOSTED=false
     export KNOWLEDGE_MEMBER_ACCESS=true CREDENTIAL_GROUPS=true ACCESS_CONTROL_ENABLED=true
+    export SIM_LINKS=true
     export NEXT_PUBLIC_ACCESS_CONTROL_ENABLED=true
     export API_ENCRYPTION_KEY="$ENCRYPTION_KEY"
     start_browser_install "$group" --no-shell chromium
diff --git a/.github/scripts/install-playwright.sh b/.github/scripts/install-playwright.sh
new file mode 100644
index 00000000000..c9065602919
--- /dev/null
+++ b/.github/scripts/install-playwright.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# The dependency dry run uses the pinned driver's package list without updating apt.
+set -euo pipefail
+
+browsers=()
+for argument in "$@"; do
+  case "$argument" in
+    --only-shell|--no-shell) ;;
+    *) browsers+=("$argument") ;;
+  esac
+done
+
+if ! bunx --no-install playwright install-deps --dry-run "${browsers[@]}"; then
+  bunx --no-install playwright install-deps "${browsers[@]}"
+fi
+exec bunx --no-install playwright install "$@"
diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index f8d7da153c0..836f2a2644d 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -57,20 +57,24 @@ on:
         default: true
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
-  build:
-    name: build
-    runs-on: macos-26
-    timeout-minutes: 60
+  source:
+    name: source
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      name: ${{ steps.channel.outputs.name }}
+      app_id: ${{ steps.channel.outputs.app_id }}
+      origin: ${{ steps.channel.outputs.origin }}
+      release_repository: ${{ steps.channel.outputs.release_repository }}
+      token_kind: ${{ steps.channel.outputs.token_kind }}
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
-          fetch-depth: 0
           persist-credentials: false
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.sha }}
 
       # Prerelease versions carry their environment in the tag: -dev.N is a
       # dev build, -staging.N a staging build. Legacy -alpha/-beta tags remain
@@ -115,11 +119,16 @@ jobs:
             echo "::error::Manual desktop releases must use a stable source-repository tag."
             exit 1
           fi
+          if [ "$GITHUB_EVENT_NAME" = workflow_dispatch ] && [ "$GITHUB_REF" != "refs/tags/$VERSION" ]; then
+            echo "::error::Run this workflow from the $VERSION tag, so it executes only that tag's code and its caches stay scoped to that tag."
+            exit 1
+          fi
           if [ "$PUBLISH" = true ] && [ "$SIGN" != true ]; then
             echo "::error::Desktop releases must be signed before publication."
             exit 1
           fi
           if [ "$TOKEN_KIND" = stable ]; then
+            git fetch --depth=1 origin "refs/tags/${VERSION}:refs/tags/${VERSION}"
             TAG_COMMIT="$(git rev-parse "refs/tags/${VERSION}^{commit}")"
             HEAD_COMMIT="$(git rev-parse HEAD)"
             if [ "$TAG_COMMIT" != "$HEAD_COMMIT" ]; then
@@ -140,28 +149,49 @@ jobs:
             exit 1
           fi
 
+  smoke:
+    name: smoke (${{ matrix.shard }}/${{ strategy.job-total }})
+    needs: source
+    runs-on: macos-26
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    steps:
+      - &checkout-source
+        name: Checkout verified source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          persist-credentials: false
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.4
 
-      - name: Setup Node
+      - &setup-node
+        name: Setup Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: 22
 
-      - name: Cache Electron binaries
+      - name: Cache Electron and Playwright downloads
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
         with:
           path: |
             ~/Library/Caches/electron
             ~/Library/Caches/electron-builder
-          key: electron-cache-${{ runner.os }}-${{ hashFiles('apps/desktop/package.json') }}
+            ~/Library/Caches/ms-playwright
+          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: desktop-downloads-${{ runner.os }}-
 
-      - name: Install dependencies
+      - &install-dependencies
+        name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Inject release version
+      - &inject-version
+        name: Inject release version
         env:
           VERSION: ${{ inputs.version }}
         run: |
@@ -175,27 +205,83 @@ jobs:
             exit 1
           fi
 
-      - name: Verify desktop source
-        run: |
-          bun run --cwd apps/desktop lint:check
-          bun run --cwd apps/desktop type-check
-          bun run --cwd apps/desktop test
+      - name: Restore native compilation
+        uses: ./.github/actions/desktop-native-cache
 
-      - name: Bundle main and preload
+      - &bundle-desktop
+        name: Bundle main and preload
         working-directory: apps/desktop
         env:
-          SIM_DESKTOP_DEFAULT_ORIGIN: ${{ steps.channel.outputs.origin }}
+          SIM_DESKTOP_DEFAULT_ORIGIN: ${{ needs.source.outputs.origin }}
         run: bun run build
 
       - name: Install system-browser fixture
         working-directory: apps/desktop
         run: bunx playwright install chromium
 
-      - name: Run Electron smoke tests
+      - name: Install tmux
+        run: brew install tmux
+
+      - name: Run Electron smoke partition
         working-directory: apps/desktop
         env:
-          SIM_DESKTOP_DEFAULT_ORIGIN: ${{ steps.channel.outputs.origin }}
-        run: bun run test:e2e
+          SIM_DESKTOP_DEFAULT_ORIGIN: ${{ needs.source.outputs.origin }}
+          PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/desktop-smoke.json
+          BACKGROUND_EXECUTOR_REPORT_PATH: test-results/background-executor-report.json
+          TERMINAL_CANCEL_REPORT_PATH: test-results/terminal-cancel-report.json
+          CONTINUE_SIGN_IN_REPORT_PATH: test-results/continue-sign-in-report.json
+        run: bun run ../../scripts/desktop-e2e.ts ${{ matrix.shard }}/${{ strategy.job-total }}
+
+      - name: Upload smoke coverage and timings
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: desktop-release-smoke-${{ matrix.shard }}
+          path: |
+            apps/desktop/test-results/*.json
+          if-no-files-found: ignore
+          retention-days: 7
+
+      - name: Upload Electron failure artifacts
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: desktop-release-smoke-failure-${{ matrix.shard }}
+          path: apps/desktop/test-results/
+          if-no-files-found: ignore
+          retention-days: 7
+
+  # Restores no caches: every byte that gets signed comes from this checkout or
+  # a fresh download, never from a cache another run could have written.
+  build:
+    name: build
+    needs: source
+    outputs:
+      artifact_id: ${{ steps.artifacts.outputs.artifact-id }}
+    runs-on: macos-26
+    timeout-minutes: 60
+    steps:
+      - *checkout-source
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.4
+          no-cache: true
+
+      - *setup-node
+
+      - *install-dependencies
+
+      - *inject-version
+
+      - name: Verify desktop source
+        run: |
+          bun run --cwd apps/desktop lint:check
+          bun run --cwd apps/desktop type-check
+          bun run --cwd apps/desktop test
+
+      - *bundle-desktop
 
       - name: Write App Store Connect API key
         if: ${{ inputs.sign }}
@@ -253,8 +339,8 @@ jobs:
           APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          PRODUCT_NAME: ${{ steps.channel.outputs.name }}
-          APP_ID: ${{ steps.channel.outputs.app_id }}
+          PRODUCT_NAME: ${{ needs.source.outputs.name }}
+          APP_ID: ${{ needs.source.outputs.app_id }}
         run: >
           bunx electron-builder --mac --publish never
           -c.productName="$PRODUCT_NAME" -c.appId="$APP_ID"
@@ -274,8 +360,8 @@ jobs:
         working-directory: apps/desktop
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: 'false'
-          PRODUCT_NAME: ${{ steps.channel.outputs.name }}
-          APP_ID: ${{ steps.channel.outputs.app_id }}
+          PRODUCT_NAME: ${{ needs.source.outputs.name }}
+          APP_ID: ${{ needs.source.outputs.app_id }}
         run: >
           bunx electron-builder --mac --publish never -c.mac.notarize=false
           -c.mac.identity=- -c.mac.hardenedRuntime=false
@@ -333,9 +419,9 @@ jobs:
       - name: Validate signature and notarization
         if: ${{ inputs.sign }}
         env:
-          APP_ID: ${{ steps.channel.outputs.app_id }}
+          APP_ID: ${{ needs.source.outputs.app_id }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          PRODUCT_NAME: ${{ steps.channel.outputs.name }}
+          PRODUCT_NAME: ${{ needs.source.outputs.name }}
           VERSION: ${{ inputs.version }}
         run: |
           SEMVER="${VERSION#v}"
@@ -403,13 +489,40 @@ jobs:
           fi
           SIM_DESKTOP_EXECUTABLE="$EXECUTABLE" bunx playwright test e2e/packaged-smoke.spec.ts
 
+      - name: Upload artifacts to the workflow run
+        id: artifacts
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: sim-desktop-${{ inputs.version }}
+          compression-level: 0
+          path: |
+            apps/desktop/release/*.dmg
+            apps/desktop/release/*.zip
+            apps/desktop/release/*.blockmap
+            apps/desktop/release/latest-mac.yml
+          retention-days: 7
+
+  publish:
+    name: publish
+    needs: [source, build, smoke]
+    if: inputs.publish
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Download verified desktop artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ needs.build.outputs.artifact_id }}
+          path: apps/desktop/release
+
       - name: Upload artifacts to the release
-        if: ${{ inputs.publish }}
         env:
           DESKTOP_RELEASE_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
-          RELEASE_REPOSITORY: ${{ steps.channel.outputs.release_repository }}
+          RELEASE_REPOSITORY: ${{ needs.source.outputs.release_repository }}
           SOURCE_RELEASE_TOKEN: ${{ github.token }}
-          TOKEN_KIND: ${{ steps.channel.outputs.token_kind }}
+          TOKEN_KIND: ${{ needs.source.outputs.token_kind }}
           VERSION: ${{ inputs.version }}
         run: |
           case "$TOKEN_KIND" in
@@ -448,7 +561,7 @@ jobs:
             local ARTIFACT="$1"
             local NAME SIZE DIGEST REMOTE REMOTE_SIZE REMOTE_DIGEST
             NAME="$(basename "$ARTIFACT")"
-            SIZE="$(stat -f%z "$ARTIFACT")"
+            SIZE="$(stat -c%s "$ARTIFACT")"
             DIGEST="sha256:$(shasum -a 256 "$ARTIFACT" | awk '{print $1}')"
             REMOTE="$(jq -c --arg name "$NAME" '.assets[] | select(.name == $name)' <<< "$RELEASE_JSON")"
             if [ -n "$REMOTE" ]; then
@@ -467,15 +580,3 @@ jobs:
             upload_or_verify "$ARTIFACT"
           done
           upload_or_verify "${ARTIFACTS[4]}"
-
-      - name: Upload artifacts to the workflow run
-        if: ${{ !inputs.publish }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: sim-desktop-${{ inputs.version }}
-          path: |
-            apps/desktop/release/*.dmg
-            apps/desktop/release/*.zip
-            apps/desktop/release/*.blockmap
-            apps/desktop/release/latest-mac.yml
-          retention-days: 7
diff --git a/.github/workflows/docs-negotiation.yml b/.github/workflows/docs-negotiation.yml
index 0fcdf596276..3cce1c8c815 100644
--- a/.github/workflows/docs-negotiation.yml
+++ b/.github/workflows/docs-negotiation.yml
@@ -20,6 +20,7 @@ on:
       - '.github/actions/setup/**'
       - '.github/scripts/stop-session.sh'
       - '.github/scripts/playwright-server.sh'
+      - '.github/scripts/install-playwright.sh'
   push:
     branches: [staging]
     paths:
@@ -40,6 +41,7 @@ on:
       - '.github/actions/setup/**'
       - '.github/scripts/stop-session.sh'
       - '.github/scripts/playwright-server.sh'
+      - '.github/scripts/install-playwright.sh'
   workflow_dispatch:
     inputs:
       benchmark:
@@ -375,7 +377,7 @@ jobs:
         if: matrix.group == 'chromium' || (matrix.group == 'webkit' && vars.CI_PROVIDER != '' && vars.CI_PROVIDER != 'blacksmith')
         env:
           BROWSER: ${{ matrix.group }}
-        run: bunx --no-install playwright install --with-deps --only-shell "$BROWSER"
+        run: bash .github/scripts/install-playwright.sh --only-shell "$BROWSER"
       - name: Verify production documentation
         id: acceptance
         env:
diff --git a/apps/desktop/README.md b/apps/desktop/README.md
index ce6f3212a71..3b33249a679 100644
--- a/apps/desktop/README.md
+++ b/apps/desktop/README.md
@@ -108,7 +108,8 @@ The build also derives the app icon from `SIM_DESKTOP_DEFAULT_ORIGIN`. Every cha
 
 CI (`.github/workflows/desktop-release.yml`, wired into `ci.yml`):
 - Stable builds run only after `release` on a `vX.Y.Z:` commit to main — **never before**: `scripts/create-single-release.ts` skips creation if the tag exists, so a desktop job publishing first would eat the changelog. Stable assets remain on `simstudioai/sim`; dev/staging assets publish to the public `simstudioai/sim-desktop-releases` repository so source-repository followers are not notified for internal shell builds. The job builds `--publish never`; reruns verify the size and SHA-256 digest of existing release assets instead of overwriting them.
-- **Secrets gate**: `desktop-signing` in `ci.yml` probes the six Apple secrets and skips the desktop job with a warning until they exist — releases never fail on a missing Apple account, and the first release after the secrets land ships desktop artifacts automatically. Manual/one-off builds: Actions → "desktop-release" → Run workflow with a `vX.Y.Z` version (`publish: false` uploads artifacts to the run instead of the release).
+- **Secrets gate**: `desktop-signing` in `ci.yml` probes the six Apple secrets and skips the desktop job with a warning until they exist — releases never fail on a missing Apple account, and the first release after the secrets land ships desktop artifacts automatically. Manual/one-off builds: Actions → "desktop-release" → Run workflow, select the `vX.Y.Z` tag under "Use workflow from", and enter the same version (`publish: false` uploads artifacts to the run instead of the release). Any other ref is refused, so a run only executes the tag's own code and workflow, and its caches stay scoped to that tag.
+- **Cache trust**: the signed `build` job restores no caches, so nothing it signs can come from a cache another run wrote. Only the unsigned smoke jobs use caches.
 - The product semver is **injected** from the release tag into `apps/desktop/package.json` at build time (repo package versions are placeholders). A mismatch guard fails the build.
 - Fuses are flipped at package time (`electronFuses` in `electron-builder.yml`): runAsNode off, NODE_OPTIONS off, inspect args off, ASAR-only + integrity validation, and cookie encryption on. The packaged smoke test asserts every fuse byte so Electron upgrades fail until new fuses receive an explicit policy.
 - **Cookie-encryption go/no-go**: on every Electron bump, verify a packaged build keeps its session across relaunch (there are historical cookie-persistence bugs with the `EnableCookieEncryption` fuse). If it reproduces, set `enableCookieEncryption: false` and record it here.
diff --git a/apps/desktop/docs/electron-upgrade-checklist.md b/apps/desktop/docs/electron-upgrade-checklist.md
index dbdd667bddf..157c8221e8a 100644
--- a/apps/desktop/docs/electron-upgrade-checklist.md
+++ b/apps/desktop/docs/electron-upgrade-checklist.md
@@ -13,5 +13,5 @@ The rendering-parity guarantee (identical to Chrome of the pinned version) is on
    - Workflow canvas (WebGL/ReactFlow), Monaco editing, a table export download.
    - Offline page appears with networking off; Retry recovers.
 6. **E2E:** `bun run test:e2e` green locally on the new pin; `desktop-e2e.yml` green in CI (the `latest` canary leg should already have hinted at surprises).
-7. **Signing/notarization smoke:** run `desktop-release.yml` via `workflow_dispatch` with `publish: false` against a test tag; `spctl`/`stapler` steps must pass.
+7. **Signing/notarization smoke:** run `desktop-release.yml` via `workflow_dispatch` with `publish: false`, selecting a test tag under "Use workflow from" and entering the same version; `spctl`/`stapler` steps must pass.
 8. **Ship** behind a staged rollout (10% `stagingPercentage`) and watch `update_error` / `renderer_gone` rates in the event logs before raising.
diff --git a/apps/docs/content/docs/browser-extension/index.mdx b/apps/docs/content/docs/browser-extension/index.mdx
index 8b0d35cfeca..0ed7bb43c28 100644
--- a/apps/docs/content/docs/browser-extension/index.mdx
+++ b/apps/docs/content/docs/browser-extension/index.mdx
@@ -1,38 +1,48 @@
 ---
 title: Sim browser extension
-description: Ask Sim about the page you’re reading, share a screenshot, and open your team’s Sim Links from Chrome.
+description: Ask Sim about a page, dictate a message, and open your team’s go/ links from Chrome.
 ---
 
-[Install Sim for Chrome](https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg) to ask questions about a page without leaving it. Open Chrome’s **Extensions** menu and pin **Sim** to keep it one click away.
+[Install Sim for Chrome](https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg), then pin **Sim** in Chrome’s **Extensions** menu.
 
 ## Ask about a page
 
-1. Open a web page and click **Sim** in the Chrome toolbar. Sign in to Sim if prompted.
-2. In the side panel, select the attachment chip to review the captured text, or use its **×** to remove it. To attach the page again after it changes, use the globe next to the message field.
-3. Ask a question and send it. For example, on a release notes page, ask “Which changes affect my team?”
+1. Open a page and click **Sim** in the toolbar. Sign in if prompted.
+2. Review the attached page by clicking its chip. Use **×** to remove it.
+3. Type your question and send it.
 
-To ask about a passage, select the text on the page, right-click, and choose **Ask Sim about selection**. You can attach up to three snapshots to compare pages. A snapshot stays as it was when you captured it. Chrome settings pages, other extensions, and pages without readable text can’t be attached.
+To ask about a passage, select it, right-click, and choose **Ask Sim about selection**. To add another page, open it and use **+ → Current page**. Each attached page stays as it was when captured.
 
-In version 0.1.3 or later, open **+ → Reference current page on send** to include the active tab each time you send a message. This is off by default. The setting appears above the workspace list, and Sim remembers your choice in this Chrome profile. The globe shows **Current page** while this is on. If you attached a page or selection yourself, Sim uses those snapshots instead. Turn the setting off in the same menu.
+Choose **+ → Page access → Allow across websites** and approve Chrome’s prompt once to use pages across websites. Your draft stays unsent during setup. To change access later, choose **Page access → Manage in browser**.
 
-If Chrome needs access after you switch tabs, your message stays in the composer. Select **Request site access**. If Chrome hasn’t shared the site address with Sim, paste it into **Site address**. Check the site shown on **Allow access**, approve it in Chrome’s permission dialog, then send again. For one-time access, click the Sim toolbar icon on the active tab and retry. Open **+ → Site access** to remove a saved permission.
+Turn on **+ → Reference current page on send** to include the active page whenever you send. Sim remembers your choice. Manually attached pages or selections take priority.
 
-To share a screenshot, drag the image file onto the open chat. It uploads to Sim and appears as an attachment you can remove before sending. If a website supplies only an image URL, paste the image itself or use the file picker.
+Chrome settings, other extensions, and pages without readable text can’t be attached.
 
-For faster access, press **Command + Shift + S** on macOS or **Alt + Shift + S** on Windows and Linux. In version 0.1.3 or later, the shortcut attaches highlighted text when you have a selection. It won't substitute the whole page for an unreadable selection. With no selection, it attaches the page or uses your send-time reference setting. On an already-open sidebar, Chrome may keep keyboard focus on the website. Click the message field, or use Chrome’s pane navigation (on Mac, **Command + Option + Up**).
+## Dictate or attach a screenshot
 
-If Chrome needs access to a new tab, the sidebar shows the shortcut assigned in this Chrome profile, or **Set shortcut** if none is assigned. You can change it under **Extensions → Keyboard shortcuts**.
+Click the microphone beside Send to dictate. Allow microphone access if Chrome asks, then click again to stop. Edit the draft and send when ready. If access is blocked, choose **Open settings**.
 
-## Roll out to a team
+Drag a screenshot file onto Chat, or use the file picker. It uploads as an attachment you can remove before sending. Dragging an image URL from a website doesn’t attach the image itself.
 
-Share the chat extension’s install link with your team. In managed Chrome, an admin can [allow the extension for an organizational unit](https://support.google.com/chrome/a/answer/6306504) so people can install it themselves.
+## Keyboard shortcut
 
-If your organization has [Sim Links](/search/sim-links), type `sim`, press **Space**, and enter part of a link name for suggestions. To open a shortcut by typing it directly, include the trailing slash, as in `sim/handbook/`. Teams that already use an internal host named `sim` should keep that hostname conflict in mind: the chat extension routes those navigations to Sim.
+Press **Command + Shift + S** on macOS or **Alt + Shift + S** on Windows and Linux. Sim attaches your selection, or the current page when **Reference current page** is off. With it on, the page is included when you send. An unreadable selection stays unsent.
 
-In version 0.1.3 or later, **+ → Browser shortcuts** can recover explicit `sim/handbook` searches on Google, Bing, DuckDuckGo, and Yahoo. Enable your provider and approve the site access shown by Chrome. This leaves ordinary searches and your default search engine unchanged. See [shortcut setup and supported inputs](/search/sim-links#open-links-from-the-address-bar).
+Change the binding in Chrome’s **Extensions → Keyboard shortcuts**. If Chrome keeps focus on the page, click the message field or use its pane-navigation shortcut (**Command + Option + Up** on Mac).
 
-## Page access and privacy
+## Open team links
 
-Sim reads a page or selection when you attach it, or when you send a message with **Reference current page** enabled. For repeat use on one site, choose **+ → Site access** to grant or revoke that site’s permission. Granting access doesn't start background capture. The page text goes to the hosted composer when attached and becomes part of the conversation when you send it.
+Type a shortcut such as `go/handbook` or `sim/handbook` in Chrome’s address bar. Both work once you're signed in to Sim and Links is on for your organization.
+
+For suggestions, type `sim`, press **Space**, and enter part of a link name. If Chrome searches instead of opening a shortcut, open the Sim extension and sign in.
+
+See [Links](/search/sim-links#open-links-from-the-address-bar) for supported inputs, Glean conflicts, and team rollout. Administrators can [allow the extension for a Chrome organizational unit](https://support.google.com/chrome/a/answer/6306504).
+
+## Privacy
+
+Sim reads page text when you attach it or send with **Reference current page** on. Approval alone doesn’t start background capture. Attached text appears in the Sim composer before you send; submitted content follows your conversation’s retention settings.
+
+Voice input sends microphone audio to Sim’s transcription provider while recording. It does not record tab audio or start when you open the panel. The transcript stays in your draft until you send.
 
 See [Sim’s browser extension privacy disclosure](https://www.sim.ai/privacy#browser-extension).
diff --git a/apps/docs/content/docs/platform/enterprise/audit-logs.mdx b/apps/docs/content/docs/platform/enterprise/audit-logs.mdx
index 5e3e2677af9..f7f58c486bb 100644
--- a/apps/docs/content/docs/platform/enterprise/audit-logs.mdx
+++ b/apps/docs/content/docs/platform/enterprise/audit-logs.mdx
@@ -101,7 +101,7 @@ Events use identifiers such as `resource.action`. These categories are represent
 | API keys | `api_key.created`, `api_key.revoked` |
 | Credentials | `credential.created`, `credential.deleted`, `oauth.disconnected` |
 | Organization | `organization.updated`, `org_member.added`, `org_member.role_changed`, `organization.sso_provider.updated` |
-| Sim links | `sim_link.created`, `sim_link.updated`, `sim_link.deleted` |
+| Links | `sim_link.created`, `sim_link.updated`, `sim_link.deleted` |
 | Exports and drains | `audit_logs.exported`, `data_drain.created`, `data_drain.updated`, `data_drain.ran`, `data_drain.tested` |
 
 Authentication failures and password-reset requests use an anonymous actor and record the target account separately. Impersonation and administrative session revocations identify the operator and target organization. Table-row mutations record summaries and counts without copying row contents.
diff --git a/apps/docs/content/docs/search/sim-links.mdx b/apps/docs/content/docs/search/sim-links.mdx
index 3520c7c0eac..906b6d22573 100644
--- a/apps/docs/content/docs/search/sim-links.mdx
+++ b/apps/docs/content/docs/search/sim-links.mdx
@@ -1,11 +1,11 @@
 ---
-title: Sim Links
-description: Short sim/ links that take everyone in your organization to the right page
+title: Links
+description: Short go/ and sim/ links that take everyone in your organization to the right page
 ---
 
-Sim Links are short names for pages your team opens often, like `sim/handbook` or `sim/okta`. Every member of your organization can use them, with or without a Search seat.
+Links are short names for pages your team opens often, like `handbook` or `okta`. They open as `sim/handbook` or `go/handbook`. Every member of your organization can use them, with or without a Search seat.
 
-Open **Sim Links** in the organization sidebar to see your organization's links. Search by name, destination, or description, or use **Sort → Opens** to see the 50 most opened links.
+Open **Links** in the organization sidebar to see your organization's links. Search by name, destination, or description, or use **Sort → Opens** to see the 50 most opened links.
 
 ## Open a link
 
@@ -15,15 +15,25 @@ Names ignore case and punctuation, so `sim/Team-Handbook` and `sim/teamhandbook`
 
 ## Open links from the address bar
 
-In Sim Cloud, open **Sim Links → Browser shortcuts** to install [Sim for Chrome](https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg) in your work profile. Type `sim` in Chrome’s address bar, press **Space**, and enter part of a link name. Chrome shows matching links, most opened first. Unlisted links can still open by name.
+[Install Sim for Chrome](https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg) in your work profile, then type `go/handbook` or `sim/handbook` in the address bar. Both work once you're signed in to Sim.
 
-To open links as `sim/handbook`, select **Enable sim/ shortcuts** in that dialog once, using the Chrome profile where Sim is installed. This opens your Sim Links directory in a new tab and lets Chrome remember the short host in that profile. If Chrome still sends a shortcut to search, enter `http://sim/handbook` or `sim/handbook/` with a trailing slash. Use **Copy link** in Sim to share an address that also works without the extension.
+For suggestions, type `sim`, press **Space**, and enter part of a name. Matching links appear with the most opened first. Unlisted links still open by name.
 
-In Sim for Chrome 0.1.3 or later, open the extension sidebar’s **+ → Browser shortcuts** and enable your search provider to recover `sim/handbook` when Chrome treats it as a search. Approve access to the exact sites shown. This is optional and supports Google (`google.com`), Bing, DuckDuckGo, and Yahoo. Sim remembers the choice in this Chrome profile. Ordinary searches still use your search engine; its default is unchanged.
+### If a shortcut opens search
 
-Recovery matches a whole `sim/<name>` shortcut, including simple slash-separated values such as `sim/jira/123`. For values containing spaces, query parameters, unsupported search domains, or a managed browser that blocks site access, use `sim` + **Space** or the full `https://www.sim.ai/sim/<name>` address. Turn recovery off in **Browser shortcuts**; this keeps the site permission, which you can remove through **Site access** or Chrome’s extension settings.
+This can happen if you installed the extension while signed out, or just cleared your browsing history. Opening the Sim extension and signing in fixes the first case, and the second fixes itself within a week. Until then, a trailing slash (`go/handbook/`) or `http://go/handbook` tells Chrome to navigate directly.
 
-If `sim` + **Space** sends link names to your search engine even when the address bar shows **Sim**, a Chrome site search may already use the `sim` shortcut. Enter `http://sim/handbook` to open the link directly. To restore suggestions, temporarily turn off the Sim extension, rename the old shortcut in `chrome://settings/searchEngines`, then turn Sim back on. If your organization manages the shortcut, ask your administrator to rename it.
+### Roll out to your team
+
+Administrators can [force-install Sim for Chrome](https://support.google.com/chrome/a/answer/6306504) for an organizational unit. Shortcuts start working once each person signs in through the extension, or the next time Chrome starts after they've signed in.
+
+### If another tool uses go/ or sim
+
+Sim routes both `go/` and `sim/` to your organization’s links. If Glean or another extension also handles `go/`, Chrome uses the most recently installed extension. Disable the other tool’s go-link handling or remove that extension to use Sim consistently. An existing intranet host named `go` or `sim` conflicts too.
+
+If `sim` + **Space** still searches while the address bar shows **Sim**, an old Chrome site-search shortcut may use the same keyword. Turn off the Sim extension, rename that shortcut in `chrome://settings/searchEngines`, then turn Sim back on. Ask your administrator if the shortcut is managed.
+
+### Use links without the extension
 
 Without the extension, add Sim as a Chrome site search shortcut to type `sim handbook` instead:
 
@@ -35,17 +45,15 @@ Type `sim`, press **Space**, then type a link name and press **Enter**. For mana
 
 ### Show favorites in regular Chrome suggestions
 
-In Sim, choose **Copy link** for a favorite. In Chrome’s bookmark manager (`chrome://bookmarks`), add a bookmark with that URL and name it after the shortcut, such as `sim/handbook`. Chrome can suggest that bookmark when you type `sim/handb` or `handbook` in the address bar. Administrators can distribute selected team favorites through Chrome’s [managed bookmarks policy](https://chromeenterprise.google/policies/managed-bookmarks/).
-
-Organization admins can also open **Browser shortcuts → Team bookmarks**, choose listed links, and select **Export bookmarks**. The downloaded JSON contains a folder to merge into Chrome’s managed bookmarks policy. Its links resolve in the exporting organization, so a bookmark shared outside the team cannot open another team's same-name destination.
+In Sim, choose **Copy link** for a favorite. In Chrome’s bookmark manager (`chrome://bookmarks`), add a bookmark with that URL and name it after the shortcut, such as `sim/handbook`. Chrome can suggest that bookmark when you type `sim/handb` or `handbook` in the address bar.
 
 ## Create a link
 
-1. Open **Sim Links** and select **New link**.
+1. Open **Links** and select **New link**.
 2. Enter the **Destination URL** and a **Name**. Names use letters, numbers, and `. : @ & ~ - _`; spaces become hyphens as you type.
 3. Optionally add a **Description**, then select **Create**.
 
-With Sim for Chrome 0.1.3 or later, right-click an HTTP or HTTPS link on a page and choose **Create Sim Link**. Check the destination and organization, enter a name, then choose **Create**. Sim strips query parameters and fragments from the initial destination. You can edit the address before saving. Closing the draft creates nothing.
+Right-click an HTTP or HTTPS link on a page and choose **Create link in Sim**. Check the destination and organization, enter a name, then choose **Create**. Sim strips query parameters and fragments from the initial destination. You can edit the address before saving. Closing the draft creates nothing.
 
 To share a link, right-click it and select **Copy link**.
 
@@ -67,7 +75,7 @@ Values fill each `{*}` in order, and the last `{*}` takes the rest. A link with
 
 By default, any member can edit or delete a link. The link's creator and organization admins can change two options under **Access**:
 
-- **Hide from the Sim Links page**: only the creator and admins see the link in the list, marked **Unlisted**. Anyone with the name can still open it.
+- **Hide from the Links page**: only the creator and admins see the link in the list, marked **Unlisted**. Anyone with the name can still open it.
 - **Only the creator and admins can edit**: only the creator and admins can edit or delete the link, marked **Restricted**.
 
 Changes to links are recorded in your organization's [audit logs](/platform/enterprise/audit-logs).
diff --git a/apps/extension/DESIGN.md b/apps/extension/DESIGN.md
index b2fd6ea2244..e3881a9b502 100644
--- a/apps/extension/DESIGN.md
+++ b/apps/extension/DESIGN.md
@@ -10,14 +10,20 @@ conversation persistence, streaming recovery, tool permissions, and organization
 or workspace authorization. The panel keeps Fast mode and omits the model selector.
 A conversation can continue in the full app.
 
+Voice input uses the existing microphone control beside Send. The browser asks for
+microphone permission on first use. Transcription updates the editable draft and
+never sends it automatically. Stop ends recording; Send and conversation changes
+discard unfinished transcription. The iframe delegates microphone access only to
+the configured Sim origin, and blocked access offers the browser's microphone settings.
+
 The user signs in in a normal Sim tab and lands in their organization chat. Choosing
 a workspace is optional; members without Build access use Assistant. They can open
 or create a conversation and explicitly attach the current page or highlighted text.
 The composer’s + menu offers Current page and Selected text. Pending snapshots sit
 inside the composer as compact removable chips alongside file attachments. Opening one
 shows the captured text, source, capture time, and conversation-retention disclosure.
-Partial captures remain labeled in the attachment row. Site access lives in the
-composer’s Site access action, which opens an extension-owned dialog; successful delivery adds no persistent status banner.
+Partial captures remain labeled in the attachment row. Page access lives in the
+composer’s Page access action, which opens an extension-owned dialog; successful delivery adds no persistent status banner.
 Snapshots are immutable: navigating to another page cannot silently change an attached
 source. Removing an attachment, changing organization or workspace, or starting a new conversation
 clears pending page context. Several explicitly attached pages can support comparison.
@@ -34,7 +40,7 @@ Existing Sim server tools remain subject to their existing authorization and app
 ## Ownership and data flow
 
 1. `apps/extension`: packaged MV3 service worker, side-panel host, bounded content
-   extraction, per-site permission controls, build artifacts, browser verification.
+   extraction, browser-wide page permission setup, build artifacts, browser verification.
 2. `packages/browser-extension-protocol`: versioned, strictly validated messages and
    immutable page snapshots shared by the extension, app, and server.
 3. `apps/sim/app/extension`: session gate, organization landing, optional workspace picker, app providers,
@@ -54,16 +60,20 @@ other workspace resources or browser-control tools.
 ## Permission and lifetime rules
 
 - Required browser capabilities: side panel, scripting, active tab, context menus,
-  and short-lived session storage for selection handoff. Required host access is
-  limited to the configured Sim origin and to `http(s)://sim/*`, which exists only so
-  one static redirect rule can send top-level navigations to that host to the Sim link resolver.
-- Other HTTP(S) origins are optional grants requested for the current site from a
-  user gesture. Each grant can be revoked. Keeping the panel open is not a grant
-  to read every subsequently selected tab.
-- No history, bookmarks, cookie API, debugger, native messaging, external messaging,
+  short-lived session storage for selection handoff, and local storage for preferences. Required host access is
+  limited to the configured Sim origin and to `http(s)://sim/*` and `http(s)://go/*`, which exist
+  only so one static redirect rule can send top-level navigations to those hosts to the link resolver.
+- HTTP(S) page access is one optional browser-wide grant, requested from a direct
+  user gesture. The browser owns revocation and restrictions. Approval enables
+  capture across sites; switching tabs alone does not extract content.
+- No history permission, bookmarks, cookie API, debugger, native messaging, external messaging,
   or arbitrary remote code execution. The only network interception is the static
-  `sim/` redirect rule above.
-- The only background network request is the `sim` address-bar keyword: after
+  `sim/` and `go/` redirect rule above.
+- Background network requests are limited to two. Once a week at browser start, and after
+  signing in to the panel, the worker asks the Sim origin whether links are on for the session;
+  if so, it opens `http://go/` and `http://sim/` in background tabs that close themselves, which
+  teaches Chrome's address bar these hosts and adds entries to browser history. The other is the
+  `sim` address-bar keyword: after
   `sim` and Space, the text typed before the first `/` or `?` is sent to the
   configured Sim origin with the signed-in session to suggest matching Sim links,
   unless it contains a space (a search) or is longer than a link name can be. Page
@@ -126,7 +136,7 @@ An absent backend or account is an unverified gate, not a pass.
 - [Chrome activeTab](https://developer.chrome.com/docs/extensions/develop/concepts/activeTab)
   and [optional permissions](https://developer.chrome.com/docs/extensions/reference/api/permissions):
   temporary access follows user invocation; cross-origin navigation requires fresh
-  authority. Request persistent access per site only when selected by the user.
+  authority. Request optional access across HTTP(S) websites once, matching Glean’s all-websites page-context option.
 - [Chrome extension security](https://developer.chrome.com/docs/extensions/develop/security-privacy/stay-secure)
   and [OWASP extension guidance](https://cheatsheetseries.owasp.org/cheatsheets/Browser_Extension_Vulnerabilities_Cheat_Sheet.html):
   minimize privileges and treat all incoming page messages as attacker-controlled.
diff --git a/apps/extension/README.md b/apps/extension/README.md
index 28584cfb483..b5a4621c7d1 100644
--- a/apps/extension/README.md
+++ b/apps/extension/README.md
@@ -4,7 +4,7 @@ The Chrome extension attaches an explicitly captured page or selection to the ex
 
 [User and administrator guide](https://docs.sim.ai/browser-extension)
 
-The keyboard shortcut prefers highlighted text and preserves the draft when a selection cannot be read. Chrome’s **Extensions → Keyboard shortcuts** page controls the binding per profile. A link’s context menu opens the existing Sim Links creation form with a reviewed destination; only selecting **Create** writes a link.
+The keyboard shortcut prefers highlighted text and preserves the draft when a selection cannot be read. Chrome’s **Extensions → Keyboard shortcuts** page controls the binding per profile. A link’s context menu opens the existing Links creation form with a reviewed destination; only selecting **Create** writes a link.
 
 ## Build and load
 
@@ -17,7 +17,7 @@ bun run --cwd apps/extension build
 
 In Chrome, open `chrome://extensions`, enable Developer mode, choose **Load unpacked**, and select `apps/extension/dist`. Copy the extension ID into the Sim server's `BROWSER_EXTENSION_IDS` configuration. It accepts comma-separated Chrome extension IDs. Restart the app after changing that configuration. Unconfigured IDs cannot embed the app.
 
-Click the Sim toolbar icon to open chat and attach the current page. **+ → Current page** adds a fresh snapshot; **Selected text** attaches the highlighted passage. Attachments appear as chips inside the composer. Attach up to three pages or selections to summarize, extract facts, or compare sources. To quote a passage, select it and choose **Ask Sim about selection** from the context menu. Review or remove the attachment before sending. **+ → Site access** opens the extension-owned permission dialog: **Allow access to [site]** grants access only to that site; **Remove access to [site]** revokes it. Persistent site permission never enables background capture.
+Click the Sim toolbar icon to open chat and attach the current page. **+ → Current page** adds a fresh snapshot; **Selected text** attaches the highlighted passage. Attachments appear as chips inside the composer. Attach pages or selections to summarize, extract facts, or compare sources. To quote a passage, select it and choose **Ask Sim about selection** from the context menu. Review or remove the attachment before sending. **+ → Page access** offers **Allow across websites**. Approve the browser prompt once to use pages across HTTP and HTTPS sites without per-site setup. Manage access in the browser’s extension settings. Permission alone never enables background capture.
 
 For local development:
 
@@ -29,21 +29,21 @@ SIM_EXTENSION_DEV=1 SIM_EXTENSION_ORIGIN=http://localhost:3000 bun run --cwd app
 
 ## Data and permissions
 
-- Required capabilities: `activeTab`, `scripting`, `sidePanel`, `storage`, `contextMenus`, `declarativeNetRequestWithHostAccess`, and access to the configured Sim origin and to `http(s)://sim/*`.
-- Type `sim`, press Space, enter the name, and press Enter to open an organization's [Sim link](https://docs.sim.ai/search/sim-links). Chrome can treat bare `sim/<name>` as a search before the redirect rule runs. Typing `http://sim/<name>` once lets Chrome learn the short host in that profile. A trailing slash (`sim/<name>/`) also selects navigation without relying on that history. A single static redirect rule rewrites top-level navigations to `http(s)://sim/*` to `<Sim origin>/sim/*` with the path and query unchanged. The `sim` host permission exists only for that rule: every navigation to that host is redirected before it loads, and no other request is matched or observed. An organization that already serves an intranet host named `sim` should not install this build, since its links would be redirected to Sim.
+- Required capabilities: `activeTab`, `scripting`, `sidePanel`, `storage`, `contextMenus`, `declarativeNetRequestWithHostAccess`, and access to the configured Sim origin and to `http(s)://sim/*` and `http(s)://go/*`.
+- Type `sim`, press Space, enter the name, and press Enter to open an organization's [link](https://docs.sim.ai/search/sim-links). `go/<name>` opens the same link. Chrome treats bare `go/<name>` or `sim/<name>` as a search until its history holds that short host, so on install, and at browser start once a week, the extension opens `http://go/` and `http://sim/` in background tabs that close themselves. It does this only once Sim says links are on for the signed-in session, so `go/x` stays an ordinary search for everyone else; signing in through the side panel checks again. Chrome counts a visit to an unfamiliar single-label host as typed, which is what the address bar checks, and repeating covers history that expires after 90 days or is cleared. A trailing slash (`go/<name>/`) always selects navigation. A single static redirect rule rewrites top-level navigations to `http(s)://sim/*` and `http(s)://go/*` to `<Sim origin>/sim/*` with the path and query unchanged. The `sim` and `go` host permissions exist only for that rule: every navigation to those hosts is redirected before it loads, and no other request is matched or observed. An organization that already serves an intranet host named `sim` or `go` should not install this build, since its links would be redirected to Sim. When another extension (such as another go-links tool) also redirects `go/`, Chrome applies the most recently installed extension's rule.
 - The `sim` address-bar keyword (`sim`, then Space) lists matching Sim links while you type and opens what you enter through the same resolver. For these suggestions, the background worker sends the text typed before the first `/` or `?`, and nothing else, unless that text contains a space (a search) or is longer than a link name can be, to `<Sim origin>/api/sim-links/suggestions` with the signed-in session, and the extension's content security policy allows connections to that origin alone. Unlisted links are never suggested.
-- **+ → Browser shortcuts** separately opts into recovery for exact Google, Bing, DuckDuckGo, or Yahoo HTTPS search hosts. After a direct Chrome permission grant, dynamic request rules redirect only top-level GET requests with one query parameter containing a whole `sim/<name>` shortcut. Only that value reaches `/sim-links/recover`, which validates it and redirects to the existing authenticated resolver. Ordinary search terms, additional search parameters, subframes, and unsupported inputs are not forwarded. Chrome applies these rules without an extension search-URL observer. Turning a provider off removes its rules while preserving site access; revoking access clears its recovery choice. This does not enable page reference or change the default search provider.
-- Optional HTTP/HTTPS site access is requested only by a menu action naming that site. Chrome's `activeTab` access is temporary and does not follow arbitrary new sites.
+- Optional HTTP/HTTPS access is requested together by **Allow across websites**, from a direct user action. Chrome's `activeTab` access is temporary and does not follow arbitrary new sites.
 - Page capture runs on demand in Chrome's isolated world. It excludes editable fields, inputs, hidden elements, scripts, and embedded documents. It reads only the top frame. PDF viewers and canvas documents may have no accessible text.
 - Extraction stops at 50,000 text characters, 150,000 serialized UTF-8 bytes, 15,000 visited nodes, or 150ms. The composer exposes truncation.
+- Attached pages share a 150,000-character and 450,000-byte snapshot budget per message, within the general 100-context ceiling. Shorter pages can share the available budget without a separate page-count restriction.
 - Source URLs omit credentials, query parameters, and fragments. Human-readable text can still contain sensitive information; it is the user-selected material they review and send into their conversation.
-- Snapshots stay in memory until handed to Sim and acknowledged or expired after 30 seconds. Extension storage contains only a short-lived intent with a tab/document identity and a SHA-256 URL digest, never raw URLs, captured text, or credentials. Closing a tab or navigating invalidates its pending intent. Sim applies its normal conversation retention once a message is sent.
-- No browser history, bookmarks, cookie access, debugger access, remote extension JavaScript, arbitrary network proxy, or background content collection is requested. Incognito use is disabled.
-- The iframe bridge checks both the exact configured origin and the exact frame, then validates versioned messages. The hosted composer may request only page capture, selection capture, or the native site-access and browser-shortcut dialogs. Requests require the current conversation nonce and Chrome transient user activation; arbitrary URLs, tabs, script execution, and network operations are never accepted. Permission grants still require a click in the extension-owned dialog. Shortcut settings are advertised separately so older installed shells keep working without the new action.
+- Snapshots stay in memory until handed to Sim and acknowledged or expired after 30 seconds. For captures, extension storage contains only a short-lived intent with a tab/document identity and a SHA-256 URL digest, never raw URLs, captured text, or credentials. Closing a tab or navigating invalidates its pending intent. Sim applies its normal conversation retention once a message is sent.
+- No browser history permission, bookmarks, cookie access, debugger access, remote extension JavaScript, arbitrary network proxy, or background content collection is requested. Incognito use is disabled.
+- The iframe bridge checks both the exact configured origin and the exact frame, then validates versioned messages. The hosted composer may request only page capture, selection capture, the native page-access dialog, or the browser's fixed microphone settings page. Requests require the current conversation nonce and Chrome transient user activation; arbitrary URLs, tabs, script execution, and network operations are never accepted. Permission grants still require a click in the extension-owned page-access control and browser approval.
 - Captures and queued toolbar intents are scoped to the receiving conversation. Changing conversation, workspace, or account discards an unfinished handoff. Captured attachments remain explicit snapshots when the source tab changes.
-- The complete hosted document, including portaled source dialogs and menus, is blocked from session replay. Clipboard writing is delegated only to the configured Sim origin. Clipboard reading and microphone capture are not delegated; voice input remains available in the main app.
+- The complete hosted document, including portaled source dialogs and menus, is blocked from session replay. Clipboard writing and microphone capture are delegated only to the configured Sim origin; clipboard reading and camera access are not delegated. Voice input starts only after the user clicks the microphone and the browser grants permission. The shared Sim voice service streams microphone audio to ElevenLabs for transcription into the editable draft. Stop ends capture while allowing the final transcript to arrive; Send and conversation changes cancel unfinished transcription. There is no tab-audio capture or background recording.
 
-With **Reference current page** enabled, a composer Send requests a single fresh snapshot for that conversation. The extension stores only the preference in local storage. A tab change does not read any content. Explicit snapshots take precedence; access denial, navigation and timeouts keep the draft unsent. When Chrome hides the active address, **Site access** lets the user enter a site and confirm its origin in Chrome’s permission dialog. The browser grants the selected scheme, host and port. Uploaded screenshot files stay in the hosted app’s normal attachment flow.
+With **Reference current page** enabled, a composer Send requests a single fresh snapshot for that conversation. Local storage holds only this preference and when the short hosts were last visited. A tab change does not read any content. Explicit snapshots take precedence; access denial, navigation and timeouts keep the draft unsent. **Allow across websites** works even when Chrome hides the active address; no address entry is required. The grant covers HTTP and HTTPS sites across tabs until the user revokes or restricts it in browser settings. Uploaded screenshot files stay in the hosted app’s normal attachment flow.
 
 ## Verification
 
@@ -55,7 +55,7 @@ bun run --cwd apps/extension build
 
 The E2E suite uses real Chromium, the packaged extension, and a disposable HTTP app fixture. It pregrants only the fixture page origin in a temporary package to exercise extraction without automating the browser's permission dialog. It checks HttpOnly session-cookie transport, origin/frame spoofing, sensitive-field exclusion, source URL minimization, selected excerpts, UTF-8 limits, stale-document handoffs, denied host access, and absence of page bytes in extension storage. The cookie check uses a fixture, not Better Auth or SSO. JSON results and a screenshot are written beside the caller-supplied report path. The E2E suite builds into a temporary directory and leaves shipping `dist` untouched.
 
-Release verification must additionally exercise the native toolbar and shortcut, Chrome's real grant/revoke prompt, sign-in/SSO and expiry against the running Sim app, side-panel closing/reopening, workspace changes, narrow widths, and the real Mothership streaming response. The fixture suite does not establish those integrations. The design document records launch scope and release criteria.
+Release verification must additionally exercise typing `go/<name>` in Chrome's real address bar on a clean profile (the e2e proves the visits, not the address bar), the native toolbar and shortcut, Chrome's real grant/revoke prompt, sign-in/SSO and expiry against the running Sim app, side-panel closing/reopening, workspace changes, narrow widths, and the real Mothership streaming response. The fixture suite does not establish those integrations. The design document records launch scope and release criteria.
 
 The authenticated acceptance suite runs against a real local app, Better Auth, and a disposable Postgres database whose name contains `test`. Enable `KNOWLEDGE_MEMBER_ACCESS`, `CREDENTIAL_GROUPS`, `ACCESS_CONTROL_ENABLED`, and `NEXT_PUBLIC_ACCESS_CONTROL_ENABLED` on that app to exercise restricted organization members:
 
diff --git a/apps/extension/package.json b/apps/extension/package.json
index 577d69f3edf..2529b2b9e69 100644
--- a/apps/extension/package.json
+++ b/apps/extension/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sim/extension",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",
diff --git a/apps/extension/scripts/build.ts b/apps/extension/scripts/build.ts
index 7bd61621109..1b44b2f98a3 100644
--- a/apps/extension/scripts/build.ts
+++ b/apps/extension/scripts/build.ts
@@ -2,6 +2,7 @@ import { createPublicKey } from 'node:crypto'
 import { cp, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { SIM_LINK_HOST_PATTERN, SIM_LINK_HOSTS } from '@sim/browser-extension-protocol'
 import { build } from 'esbuild'
 import postcss from 'postcss'
 import loadPostcssConfig from 'postcss-load-config'
@@ -90,7 +91,7 @@ for (const [size, file] of [
   await cp(resolve(root, '../sim/public/favicon', file), resolve(dist, `icon-${size}.png`))
 }
 /**
- * Only requests to the short host reach this rule. Chrome can classify bare `sim/<name>` as a
+ * Only requests to the short hosts reach this rule. Chrome can classify a bare `go/<name>` as a
  * search before navigation. Preserve the path and query for actual short-host navigations.
  */
 const simLinkRules = [
@@ -98,7 +99,10 @@ const simLinkRules = [
     id: 1,
     priority: 1,
     action: { type: 'redirect', redirect: { regexSubstitution: `${origin.origin}/sim/\\1` } },
-    condition: { regexFilter: '^https?://sim/(.*)$', resourceTypes: ['main_frame'] },
+    condition: {
+      regexFilter: `^https?://(?:${SIM_LINK_HOST_PATTERN})/(.*)$`,
+      resourceTypes: ['main_frame'],
+    },
   },
 ]
 await writeFile(resolve(dist, 'sim-links.json'), JSON.stringify(simLinkRules, null, 2))
@@ -110,7 +114,7 @@ await writeFile(
       name: development ? 'Sim (Development)' : 'Sim',
       version: packageJson.version,
       description:
-        "Ask Sim about the page you are reading, and open your organization's sim/ links from the address bar.",
+        "Ask Sim about the page you are reading, and open your organization's go/ and sim/ links from the address bar.",
       minimum_chrome_version: '120',
       permissions: [
         'activeTab',
@@ -120,7 +124,10 @@ await writeFile(
         'contextMenus',
         'declarativeNetRequestWithHostAccess',
       ],
-      host_permissions: [`${origin.origin}/*`, 'http://sim/*', 'https://sim/*'],
+      host_permissions: [
+        `${origin.origin}/*`,
+        ...SIM_LINK_HOSTS.flatMap((host) => [`http://${host}/*`, `https://${host}/*`]),
+      ],
       declarative_net_request: {
         rule_resources: [{ id: 'sim_links', enabled: true, path: 'sim-links.json' }],
       },
diff --git a/apps/extension/scripts/test-e2e.ts b/apps/extension/scripts/test-e2e.ts
index 8d1da01cd73..151f24c82d3 100644
--- a/apps/extension/scripts/test-e2e.ts
+++ b/apps/extension/scripts/test-e2e.ts
@@ -11,10 +11,13 @@ import {
   type AppToExtensionMessage,
   extensionToAppMessageSchema,
   pageSnapshotSchema,
+  SIM_LINK_HOSTS,
+  SIM_LINK_SUGGESTIONS_PATH,
 } from '@sim/browser-extension-protocol'
 import { SecretReveal } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { sleep } from '@sim/utils/helpers'
 import { generateId } from '@sim/utils/id'
 import { renderToStaticMarkup } from 'react-dom/server'
 
@@ -28,6 +31,8 @@ const checks: { name: string; status: 'passed' | 'failed'; durationMs: number; e
 const secretReveal = renderToStaticMarkup(
   createElement(SecretReveal, { value: 'SECRET_REVEAL_SENTINEL' })
 )
+let linksChecks = 0
+let shortHostVisits = 0
 const fixture = Bun.serve({
   hostname: '127.0.0.1',
   port: 0,
@@ -37,6 +42,14 @@ const fixture = Bun.serve({
       return new Response('Fixture session created', {
         headers: { 'set-cookie': 'fixture-session=present; Path=/; HttpOnly; SameSite=Lax' },
       })
+    if (url.pathname === SIM_LINK_SUGGESTIONS_PATH) {
+      linksChecks += 1
+      return Response.json({
+        enabled: request.headers.get('cookie')?.includes('fixture-session=present') === true,
+        links: [],
+      })
+    }
+    if (url.pathname === '/sim/') shortHostVisits += 1
     if (url.pathname === '/extension')
       return new Response(
         `<!doctype html><html><body>
@@ -83,14 +96,6 @@ const fixture = Bun.serve({
     )
   },
 })
-const searchProviders = [
-  { id: 'google', hosts: ['www.google.com', 'google.com'], path: '/search', parameter: 'q' },
-  { id: 'bing', hosts: ['www.bing.com', 'bing.com'], path: '/search', parameter: 'q' },
-  { id: 'duckduckgo', hosts: ['duckduckgo.com', 'www.duckduckgo.com'], path: '/', parameter: 'q' },
-  { id: 'yahoo', hosts: ['search.yahoo.com'], path: '/search', parameter: 'p' },
-] as const
-const searchRequests: { url: string; method: string }[] = []
-let searchFixture: ReturnType<typeof Bun.serve> | undefined
 const temporary = await mkdtemp(resolve(tmpdir(), 'sim-extension-e2e-'))
 const extensionPath = resolve(temporary, 'extension')
 let context: BrowserContext | undefined
@@ -134,50 +139,6 @@ try {
     )
     assert(!existsSync(rejectedOutput), 'Invalid key material reached build output')
   })
-  const searchKey = resolve(temporary, 'search-key.pem')
-  const searchCertificate = resolve(temporary, 'search-cert.pem')
-  const certificate = spawnSync(
-    'openssl',
-    [
-      'req',
-      '-x509',
-      '-newkey',
-      'rsa:2048',
-      '-nodes',
-      '-days',
-      '1',
-      '-keyout',
-      searchKey,
-      '-out',
-      searchCertificate,
-      '-subj',
-      '/CN=extension-search.test',
-    ],
-    { encoding: 'utf8', timeout: 10_000 }
-  )
-  assert(certificate.status === 0, 'Could not create the isolated search fixture certificate')
-  searchFixture = Bun.serve({
-    hostname: '127.0.0.1',
-    port: 0,
-    tls: { key: await readFile(searchKey), cert: await readFile(searchCertificate) },
-    fetch(request) {
-      const path = new URL(request.url).pathname
-      if (path === '/' || path === '/search')
-        searchRequests.push({ url: request.url, method: request.method })
-      return new Response(
-        '<!doctype html><title>Local search fixture</title><h1>Search fixture</h1>',
-        {
-          headers: { 'content-type': 'text/html' },
-        }
-      )
-    },
-  })
-  const searchHosts = searchProviders.flatMap((provider) => [...provider.hosts])
-  const searchPort = searchFixture.port
-  const fixtureSearchHosts = [...searchHosts, 'm.google.com', 'www.google.com.evil.test']
-  const resolverRules = fixtureSearchHosts
-    .map((host) => `MAP ${host} 127.0.0.1:${searchPort}`)
-    .join(', ')
   const origin = `http://127.0.0.1:${fixture.port}`
   const pageOrigin = `http://localhost:${fixture.port}`
   const built = spawnSync(process.execPath, ['scripts/build.ts', `--outdir=${extensionPath}`], {
@@ -187,18 +148,14 @@ try {
   })
   assert(built.status === 0, `Extension build failed: ${built.stderr}`)
   const manifest = JSON.parse(await readFile(resolve(extensionPath, 'manifest.json'), 'utf8'))
-  // Pregrants isolate routing from consent; approved search hosts resolve to the local fixture.
-  manifest.host_permissions.push(
-    `${pageOrigin}/*`,
-    ...fixtureSearchHosts.map((host) => `https://${host}/*`)
-  )
+  // Pregrants isolate routing from consent.
+  manifest.host_permissions.push(`${pageOrigin}/*`)
   await writeFile(resolve(extensionPath, 'manifest.json'), JSON.stringify(manifest))
   context = await chromium.launchPersistentContext(resolve(temporary, 'profile'), {
     channel: 'chromium',
     headless: true,
     ignoreHTTPSErrors: true,
     args: [
-      `--host-resolver-rules=${resolverRules}`,
       '--no-proxy-server',
       '--enable-unsafe-extension-debugging',
       `--disable-extensions-except=${extensionPath}`,
@@ -208,6 +165,16 @@ try {
   const worker = context.serviceWorkers()[0] ?? (await context.waitForEvent('serviceworker'))
   context.setDefaultTimeout(15_000)
   const extensionId = worker.url().split('/')[2]
+  const shortHostsVisitedAt = () =>
+    worker.evaluate(
+      async () => typeof (await chrome.storage.local.get('shortHostsVisitedAt')).shortHostsVisitedAt
+    )
+  await check('Installing signed out leaves go/ and sim/ as ordinary searches', async () => {
+    await expect.poll(() => linksChecks, { timeout: 30_000 }).toBeGreaterThan(0)
+    await sleep(2_000)
+    assert((await shortHostsVisitedAt()) === 'undefined', 'Visits were recorded while signed out')
+    assert(shortHostVisits === 0, 'Short hosts were visited while signed out')
+  })
   const signIn = await context.newPage()
   await signIn.goto(`${origin}/sign-in`)
   await signIn.close()
@@ -360,18 +327,20 @@ try {
   }
 
   await check(
-    'HTTP and HTTPS navigations to the sim host reach the configured resolver',
+    'HTTP and HTTPS navigations to the sim and go hosts reach the configured resolver',
     async () => {
       const tab = await page.context().newPage()
       for (const scheme of ['http', 'https']) {
-        for (const path of [
-          'handbook',
-          'handbook/',
-          'jira/123?view=board',
-          'jira/a%2Fb?view=board%20view',
-        ]) {
-          await tab.goto(`${scheme}://sim/${path}`)
-          assert(tab.url() === `${origin}/sim/${path}`, `sim/${path} reached ${tab.url()}`)
+        for (const host of SIM_LINK_HOSTS) {
+          for (const path of [
+            'handbook',
+            'handbook/',
+            'jira/123?view=board',
+            'jira/a%2Fb?view=board%20view',
+          ]) {
+            await tab.goto(`${scheme}://${host}/${path}`)
+            assert(tab.url() === `${origin}/sim/${path}`, `${host}/${path} reached ${tab.url()}`)
+          }
         }
       }
       await tab.close()
@@ -448,7 +417,7 @@ try {
 
   await check('Capture stays local until the trusted hosted frame is ready', async () => {
     await capture()
-    await panel.getByRole('status').filter({ hasText: 'Waiting for Sim' }).waitFor()
+    await panel.getByRole('status').filter({ hasText: 'Attaching the page…' }).waitFor()
     assert((await snapshots()).length === 0, 'Capture crossed before readiness')
     await panel.evaluate(
       (sessionId) =>
@@ -500,6 +469,26 @@ try {
     )
     await page.reload()
   })
+  await check(
+    'A signed-in panel visits each short host in tabs that close themselves',
+    async () => {
+      await app.evaluate(
+        (targetOrigin) =>
+          parent.postMessage(
+            { channel: 'sim-extension', version: 1, type: 'signed-in' },
+            targetOrigin
+          ),
+        `chrome-extension://${extensionId}`
+      )
+      await expect.poll(shortHostsVisitedAt, { timeout: 30_000 }).toBe('number')
+      assert(shortHostVisits === SIM_LINK_HOSTS.length, `Visited ${shortHostVisits} short hosts`)
+      const leftBehind = await worker.evaluate(
+        async (simLinks) => (await chrome.tabs.query({ url: simLinks })).length,
+        ['http://go/*', 'http://sim/*', `${origin}/sim/`]
+      )
+      assert(leftBehind === 0, 'Short host tabs were left open')
+    }
+  )
   await check(
     'An expired toolbar intent asks for a fresh capture without delivering content',
     async () => {
@@ -509,7 +498,7 @@ try {
         await chrome.storage.session.set({ [`captureIntent:${pending.windowId}:expired`]: pending })
       }, intent)
       await expect(panel.getByRole('status')).toHaveText(
-        'The capture expired. Attach the page again.'
+        'The page attachment expired. Attach it again.'
       )
       assert((await snapshots()).length === before, 'Expired toolbar intent delivered content')
     }
@@ -688,7 +677,7 @@ try {
     }, intent)
     await panel
       .getByRole('status')
-      .filter({ hasText: /document|frame|changed|cannot/i })
+      .filter({ hasText: /document|frame|changed|cannot|unavailable/i })
       .waitFor()
     assert((await snapshots()).length === 3, 'Stale document handoff captured a new document')
   })
@@ -705,7 +694,7 @@ try {
     }, intent)
     await panel
       .getByRole('status')
-      .filter({ hasText: /changed before reading/i })
+      .filter({ hasText: /The page changed/ })
       .waitFor()
     assert((await snapshots()).length === 3, 'Stale URL handoff captured a different SPA route')
   })
@@ -715,10 +704,9 @@ try {
     )
     await page.goto('https://ungranted.example/')
     await capture()
-    await panel
-      .getByRole('status')
-      .filter({ hasText: /access|permission|cannot/i })
-      .waitFor()
+    await expect(
+      panel.getByRole('button', { name: 'Allow across websites', exact: true })
+    ).toBeEnabled()
     assert((await snapshots()).length === 3, 'Unpermitted page was captured')
   })
   await check('Changing the receiving conversation expires an undelivered capture', async () => {
@@ -727,7 +715,7 @@ try {
       document.body.dataset.ignoreCaptures = 'true'
     })
     await capture()
-    await panel.getByRole('status').filter({ hasText: 'Waiting for Sim' }).waitFor()
+    await panel.getByRole('status').filter({ hasText: 'Attaching the page…' }).waitFor()
     const queuedIntent = await pendingIntent()
     await worker.evaluate(async (intent) => {
       await chrome.storage.session.set({ [`captureIntent:${intent.windowId}:queued`]: intent })
@@ -737,14 +725,16 @@ try {
       delete document.body.dataset.ignoreCaptures
     })
     await ready()
-    await panel
-      .getByRole('status')
-      .filter({ hasText: /conversation changed|previous conversation was discarded/ })
-      .waitFor()
-    await panel
-      .getByRole('status')
-      .filter({ hasText: /previous conversation was discarded/ })
-      .waitFor()
+    await expect(panel.getByRole('status')).toHaveText('The chat changed. Attach the page again.')
+    await expect
+      .poll(() =>
+        worker.evaluate(
+          async (key) => (await chrome.storage.session.get(key))[key],
+          `captureIntent:${queuedIntent.windowId}:queued`
+        )
+      )
+      .toBeUndefined()
+    await settleMessages()
     assert((await snapshots()).length === 3, 'A capture crossed into another conversation')
     await capture()
     await app.waitForFunction(
@@ -778,7 +768,10 @@ try {
       )
     await receipt(generateId())
     await capture()
-    await panel.getByRole('status').filter({ hasText: 'previous capture' }).waitFor()
+    await panel
+      .getByRole('status')
+      .filter({ hasText: 'Wait for the page attachment, then try again.' })
+      .waitFor()
     assert((await snapshots()).length === 5, 'A stale receipt released the pending capture')
     await receipt(receiverSessionId)
     await panel.waitForFunction(() => document.querySelector('[role="status"]')?.textContent === '')
@@ -1058,7 +1051,7 @@ try {
         )
       await panel.bringToFront()
       await openAccess()
-      const dialog = panel.getByRole('dialog', { name: 'Site access' })
+      const dialog = panel.getByRole('dialog', { name: 'Page access' })
       await expect(dialog).toBeVisible()
       await settleMessages()
       assert(policyErrors.length === 0, `Site access violated CSP: ${policyErrors.join('\n')}`)
@@ -1321,7 +1314,7 @@ try {
     }
   )
   await check(
-    'Site access requests only the address the user confirms, without reading the page',
+    'Page access asks the browser for website access without reading before approval',
     async () => {
       const source = 'https://private-source.example'
       const privateUrl = `${source}/sensitive-path?token=PRIVATE_URL_SENTINEL#fragment`
@@ -1355,34 +1348,11 @@ try {
           return execute(...args)
         }) as typeof chrome.scripting.executeScript
       })
-      await panel.getByRole('button', { name: 'Request site access' }).click()
-      const dialog = panel.getByRole('dialog', { name: 'Site access' })
-      await expect(dialog).toBeVisible()
-      const address = dialog.getByRole('textbox', { name: 'Site address' })
-      await expect(address).toHaveValue('')
-      const allow = dialog.getByRole('button', { name: /^Allow access/ })
-      for (const unsafe of [
-        'https://user:password@example.com/',
-        'https://*.example.com/',
-        'https://%2A.example.com/',
-        'https://＊.example.com/',
-        '<all_urls>',
-        'chrome://settings/',
-      ]) {
-        await address.fill(unsafe)
-        await expect(allow, `Do not offer to grant access for ${unsafe}`).toHaveAccessibleName(
-          'Allow access'
-        )
-        await expect(allow).toBeDisabled()
-      }
-      await address.fill('http://intranet.example:8080/private-path')
-      await expect(allow).toHaveAccessibleName('Allow access to http://intranet.example:8080')
-      const allowedHost = 'https://approved-site.example'
-      await address.fill(`${allowedHost}/private-path?token=INPUT_SECRET#fragment`)
-      await expect(allow).toHaveAccessibleName(`Allow access to ${allowedHost}`)
+      const allow = panel.getByRole('button', { name: 'Allow across websites', exact: true })
+      await expect(allow).toBeEnabled()
       assert(
         (await panel.locator('body').getAttribute('data-requested-access')) === null,
-        'Typing initiated a permission request'
+        'A failed capture initiated a permission request without an explicit action'
       )
       const grantedSites = () =>
         worker.evaluate(async () => ((await chrome.permissions.getAll()).origins ?? []).sort())
@@ -1391,7 +1361,7 @@ try {
       await expect(panel.locator('body')).toHaveAttribute('data-request-gesture', 'true')
       const requested = await panel.locator('body').getAttribute('data-requested-access')
       assert(requested, 'The user action never reached Chrome')
-      expect(JSON.parse(requested)).toEqual([{ origins: ['https://approved-site.example:443/*'] }])
+      expect(JSON.parse(requested)).toEqual([{ origins: ['https://*/*', 'http://*/*'] }])
       expect(await grantedSites(), 'A site received persistent access without approval').toEqual(
         previousAccess
       )
@@ -1404,118 +1374,6 @@ try {
       await expect(app.locator('body')).toHaveAttribute('data-reference-request', denied.requestId)
     }
   )
-  await check(
-    'Opted-in shortcut recovery redirects only explicit searches on the chosen providers',
-    async () => {
-      const tab = await page.context().newPage()
-      const toggle = async (provider: string, enabled: boolean) => {
-        const result = await panel.evaluate(
-          ({ provider, enabled }) =>
-            chrome.runtime.sendMessage({ type: 'set-search-recovery', provider, enabled }),
-          { provider, enabled }
-        )
-        assert(
-          result?.ok === true,
-          `Could not ${enabled ? 'enable' : 'disable'} ${provider} recovery`
-        )
-      }
-      const unchanged = async (url: string) => {
-        await tab.goto(url)
-        assert(tab.url() === url, `An ordinary or ambiguous search was redirected: ${url}`)
-        assert(
-          (await tab.title()) === 'Local search fixture',
-          'A provider request escaped the local fixture'
-        )
-      }
-      try {
-        for (const provider of searchProviders) {
-          const endpoint = `https://${provider.hosts[0]}${provider.path}`
-          const url = `${endpoint}?${provider.parameter}=sim%2Faskit`
-          await unchanged(url)
-          await toggle(provider.id, true)
-          for (const host of provider.hosts) {
-            for (const shortcut of ['sim%2Faskit', 'sim/jira/ABC-123']) {
-              const candidate = `https://${host}${provider.path}?client=chrome&${provider.parameter}=${shortcut}&source=qa`
-              const prior = searchRequests.filter((request) => request.url === candidate).length
-              await tab.goto(candidate)
-              assert(
-                tab.url() === `${origin}/sim-links/recover?q=${shortcut}`,
-                `${provider.id} lost the explicit shortcut`
-              )
-              assert(
-                searchRequests.filter((request) => request.url === candidate).length === prior,
-                'The matched shortcut reached the search provider'
-              )
-            }
-          }
-          for (const query of [
-            `${provider.parameter}=quarterly+planning`,
-            `${provider.parameter}=sim%2Faskit%20help`,
-            `${provider.parameter}=sim%2Faskit+help`,
-            `${provider.parameter}=sim%252Faskit`,
-            `${provider.parameter}=sim%2Faskit%ZZ`,
-            `${provider.parameter}=sim%2Faskit&${provider.parameter}=other`,
-            `${provider.parameter}=other&${provider.parameter}=sim%2Faskit`,
-            `${provider.parameter}=sim%2Faskit&%${provider.parameter.charCodeAt(0).toString(16)}=other`,
-          ])
-            await unchanged(`${endpoint}?${query}`)
-          await toggle(provider.id, false)
-          await unchanged(url)
-          assert(
-            await worker.evaluate(
-              (origins) => chrome.permissions.contains({ origins }),
-              provider.hosts.map((host) => `https://${host}/*`)
-            ),
-            'Disabling recovery removed a capture permission'
-          )
-        }
-        await toggle('google', true)
-        for (const url of [
-          'https://www.google.com/other?q=sim%2Faskit',
-          'https://m.google.com/search?q=sim%2Faskit',
-          'https://www.google.com.evil.test/search?q=sim%2Faskit',
-          'https://www.google.com/search?%71=sim%2Faskit',
-        ])
-          await unchanged(url)
-        const search = 'https://www.google.com/search?q=sim%2Faskit'
-        await tab.goto(`${origin}/post-fixture`)
-        await Promise.all([
-          tab.waitForNavigation(),
-          tab.evaluate((url) => {
-            const form = document.createElement('form')
-            form.method = 'POST'
-            form.action = url
-            document.body.append(form)
-            form.submit()
-          }, search),
-        ])
-        assert(
-          tab.url() === search &&
-            searchRequests.some((request) => request.url === search && request.method === 'POST'),
-          'A POST search was recovered'
-        )
-        await tab.goto(`${origin}/frame-fixture`)
-        await Promise.all([
-          tab.waitForEvent(
-            'framenavigated',
-            (child) => child.parentFrame() !== null && child.url() === search
-          ),
-          tab.evaluate((url) => {
-            const child = document.createElement('iframe')
-            child.src = url
-            document.body.append(child)
-          }, search),
-        ])
-        assert(
-          tab.url() === `${origin}/frame-fixture`,
-          'A subframe search changed the top-level page'
-        )
-        await toggle('google', false)
-      } finally {
-        await tab.close()
-      }
-    }
-  )
   await mkdir(dirname(output), { recursive: true })
   await panel.screenshot({ path: output.replace(/\.json$/, '.png'), fullPage: true })
 } catch (error) {
@@ -1530,7 +1388,6 @@ try {
 } finally {
   await context?.close()
   fixture.stop(true)
-  searchFixture?.stop(true)
   await mkdir(dirname(output), { recursive: true })
   await writeFile(output, JSON.stringify({ suite: 'browser-extension', checks }, null, 2))
   await rm(temporary, { recursive: true, force: true })
diff --git a/apps/extension/src/background.ts b/apps/extension/src/background.ts
index b0a76732c7f..a21909266b0 100644
--- a/apps/extension/src/background.ts
+++ b/apps/extension/src/background.ts
@@ -10,7 +10,7 @@ import {
 } from '@/config'
 import { captureIntentSchema } from '@/intent'
 import { registerSimLinkOmnibox } from '@/omnibox'
-import { registerSearchRecovery } from '@/search-recovery'
+import { registerShortHostVisits } from '@/short-hosts'
 import { digestUrl } from '@/utils'
 
 const logger = createLogger('BrowserExtension')
@@ -29,7 +29,7 @@ async function configure() {
   })
   chrome.contextMenus.create({
     id: LINK_MENU,
-    title: 'Create Sim Link',
+    title: 'Create link in Sim',
     contexts: ['link'],
     documentUrlPatterns: ['http://*/*', 'https://*/*'],
     targetUrlPatterns: ['http://*/*', 'https://*/*'],
@@ -91,7 +91,7 @@ function open(tab: chrome.tabs.Tab, trigger: 'page' | 'selection' | 'keyboard')
 }
 
 registerSimLinkOmnibox()
-registerSearchRecovery()
+registerShortHostVisits()
 chrome.runtime.onInstalled.addListener(() => {
   void configure().catch(() => logger.warn('Could not initialize extension controls'))
 })
diff --git a/apps/extension/src/capture.ts b/apps/extension/src/capture.ts
index 984874204a9..143dcc1f29e 100644
--- a/apps/extension/src/capture.ts
+++ b/apps/extension/src/capture.ts
@@ -4,10 +4,12 @@ import {
   pageSnapshotSchema,
 } from '@sim/browser-extension-protocol'
 import { generateId } from '@sim/utils/id'
-import { SIM_ORIGIN } from '@/config'
+import { PAGE_ACCESS_ORIGINS, SIM_ORIGIN } from '@/config'
 import { extractPageText } from '@/extract'
 import { digestUrl } from '@/utils'
 
+export const PAGE_CHANGED_MESSAGE = 'The page changed. Attach it again.'
+
 /** A public capture error whose message is safe to share with the hosted composer. */
 export class PageCaptureError extends Error {}
 
@@ -15,7 +17,7 @@ export class PageCaptureError extends Error {}
 export function captureErrorMessage(error: unknown): string {
   return error instanceof PageCaptureError
     ? error.message
-    : 'This page could not be read. Check site access and try again.'
+    : 'This page could not be read. Try again.'
 }
 
 /** Only emitted after verifying the selected document is still active. */
@@ -34,7 +36,7 @@ export class SiteAccessRequiredError extends PageCaptureError {
     readonly tabId: number,
     readonly windowId: number
   ) {
-    super('Allow site access to attach this page.')
+    super('Page access is required.')
   }
 }
 
@@ -49,9 +51,14 @@ export async function captureActivePage(
   if (tab?.id === undefined || tab.incognito)
     throw new PageCaptureError('This page cannot be attached.')
   if (expected && expected.tabId !== tab.id) {
-    throw new PageCaptureError('The page changed before reading. Attach it again.')
+    throw new PageCaptureError(PAGE_CHANGED_MESSAGE)
+  }
+  if (!tab.url) {
+    const allowed = await chrome.permissions.contains({ origins: PAGE_ACCESS_ORIGINS })
+    signal?.throwIfAborted()
+    if (allowed) throw new PageCaptureError('This page cannot be attached.')
+    throw new SiteAccessRequiredError(tab.id, tab.windowId)
   }
-  if (!tab.url) throw new SiteAccessRequiredError(tab.id, tab.windowId)
   let changed = false
   const activated = (active: chrome.tabs.OnActivatedInfo) => {
     if (active.windowId === tab.windowId && active.tabId !== tab.id) changed = true
@@ -70,14 +77,12 @@ export async function captureActivePage(
   signal?.addEventListener('abort', removeListeners, { once: true })
   try {
     const snapshot = await readTab({ tabId: tab.id, url: tab.url }, kind, expected, signal)
-    if (changed) throw new PageCaptureError('The page changed while reading. Attach it again.')
+    if (changed) throw new PageCaptureError(PAGE_CHANGED_MESSAGE)
     return snapshot
   } catch (error) {
-    if (changed) throw new PageCaptureError('The page changed while reading. Attach it again.')
+    if (changed) throw new PageCaptureError(PAGE_CHANGED_MESSAGE)
     if (expected && !(error instanceof PageCaptureError))
-      throw new PageCaptureError(
-        'The original document cannot be read. Attach the current page again.'
-      )
+      throw new PageCaptureError('The original page is unavailable. Attach the current page.')
     throw error
   } finally {
     removeListeners()
@@ -92,7 +97,7 @@ async function readTab(
 ) {
   const url = new URL(tab.url)
   if (expected && (await digestUrl(tab.url)) !== expected.urlDigest) {
-    throw new PageCaptureError('The page changed before reading. Attach it again.')
+    throw new PageCaptureError(PAGE_CHANGED_MESSAGE)
   }
   let pathname = url.pathname
   if (url.origin === SIM_ORIGIN) {
@@ -129,12 +134,12 @@ async function readTab(
     world: 'ISOLATED',
   })
   if (identity[0]?.documentId !== result.documentId || identity[0]?.result !== tab.url) {
-    throw new PageCaptureError('The page changed while reading. Attach it again.')
+    throw new PageCaptureError(PAGE_CHANGED_MESSAGE)
   }
   const [current] = await chrome.tabs.query({ active: true, currentWindow: true })
   signal?.throwIfAborted()
   if (current?.id !== tab.tabId || current.url !== tab.url || current.status === 'loading') {
-    throw new PageCaptureError('The page changed while reading. Attach it again.')
+    throw new PageCaptureError(PAGE_CHANGED_MESSAGE)
   }
   if (result.result.error) {
     if (kind === 'selection')
diff --git a/apps/extension/src/config.ts b/apps/extension/src/config.ts
index b6d38c9745b..ccbe186d507 100644
--- a/apps/extension/src/config.ts
+++ b/apps/extension/src/config.ts
@@ -1,7 +1,9 @@
 declare const __SIM_ORIGIN__: string
 export const SIM_ORIGIN = __SIM_ORIGIN__
+export const PAGE_ACCESS_ORIGINS = ['https://*/*', 'http://*/*']
 export const REFERENCE_PAGE_KEY = 'referenceCurrentPage'
 export const OPEN_SIM_COMMAND = 'open-sim'
+export const VISIT_SHORT_HOSTS_MESSAGE = 'visit-short-hosts'
 export const CAPTURE_INTENT_KEY = 'captureIntent'
 export const CAPTURE_INTENT_TTL_MS = 30_000
 export const captureIntentKey = (windowId: number, intentId: string) =>
diff --git a/apps/extension/src/extract.ts b/apps/extension/src/extract.ts
index b96882f64f2..61182298272 100644
--- a/apps/extension/src/extract.ts
+++ b/apps/extension/src/extract.ts
@@ -110,8 +110,7 @@ export function extractPageText(
     }
   }
   const text = parts.join('\n')
-  if (!text)
-    return { error: 'No readable text was found. This page may use a document viewer or canvas.' }
+  if (!text) return { error: 'No readable text was found on this page.' }
   return {
     url: source.href,
     title: document.title.slice(0, 512),
diff --git a/apps/extension/src/omnibox.ts b/apps/extension/src/omnibox.ts
index 008f9b9a3b7..80ba8ff326d 100644
--- a/apps/extension/src/omnibox.ts
+++ b/apps/extension/src/omnibox.ts
@@ -12,9 +12,10 @@ const logger = createLogger('BrowserExtensionOmnibox')
 
 /** Longer than the gap between a typist's keystrokes, so a name is looked up once it settles. */
 const SUGGEST_DELAY_MS = 220
-const SEARCH_HINT = 'Find a Sim link'
+const SEARCH_HINT = 'Find a link in Sim'
 // Chrome persists this template and substitutes the input when rendering the default row.
 const OPEN_LINK_HINT = 'Open <match>%s</match> in Sim'
+const SEARCH_LINKS_HINT = 'Find <match>%s</match> in Sim'
 
 /** A Sim link as suggested: its name, and what it shows beside the name. */
 interface SuggestedLink {
@@ -31,6 +32,7 @@ interface SuggestedLink {
 function readTyped(text: string): { name: string; rest: string } {
   const typed = text
     .trim()
+    // Only the keyword's own `sim/`: after it, `go/x` can be a link named `go` with a value.
     .replace(/^sim\//i, '')
     .replace(/^\/+/, '')
     .replace(/#.*$/, '')
@@ -139,9 +141,10 @@ export function registerSimLinkOmnibox() {
   chrome.omnibox.onInputChanged.addListener((text, suggest) => {
     pending?.abort()
     const { name, rest } = readTyped(text)
-    showHint(name || rest ? OPEN_LINK_HINT : SEARCH_HINT)
     // A name can't hold a space, so `sim card prices` is a search, not a link: ask Sim nothing.
-    if (/\s/.test(name) || name.length > SIM_LINK_NAME_MAX_LENGTH) {
+    const phrase = /\s/.test(name)
+    showHint(phrase ? SEARCH_LINKS_HINT : name || rest ? OPEN_LINK_HINT : SEARCH_HINT)
+    if (phrase || name.length > SIM_LINK_NAME_MAX_LENGTH) {
       suggest([])
       return
     }
diff --git a/apps/extension/src/reference.ts b/apps/extension/src/reference.ts
index eafd28b586d..2b3890c9370 100644
--- a/apps/extension/src/reference.ts
+++ b/apps/extension/src/reference.ts
@@ -11,6 +11,8 @@ import {
 } from '@/capture'
 import { REFERENCE_PAGE_KEY } from '@/config'
 
+export const PAGE_ATTACHMENT_PENDING_MESSAGE = 'Wait for the page attachment, then try again.'
+
 interface ReferenceOptions {
   session: () => string | null
   post: (message: ExtensionToAppMessage) => void
@@ -124,8 +126,7 @@ export function createReferenceCapture({
       replyError(
         sessionId,
         requestId,
-        manualError?.message ??
-          'A page attachment is still being prepared. Try again once it appears.',
+        manualError?.message ?? PAGE_ATTACHMENT_PENDING_MESSAGE,
         manualError?.reason
       )
       return
@@ -169,8 +170,7 @@ export function createReferenceCapture({
     refreshPreference,
     setPreference,
     busy: () => pending !== null,
-    manualRequested: () =>
-      cancel('An explicit attachment was requested. Try again after it appears.'),
+    manualRequested: () => cancel('Wait for the page attachment, then send again.'),
     preferenceChanged(value: unknown) {
       if (preferenceWrite) return
       revision++
diff --git a/apps/extension/src/search-recovery-dialog.tsx b/apps/extension/src/search-recovery-dialog.tsx
deleted file mode 100644
index bc89f7e943b..00000000000
--- a/apps/extension/src/search-recovery-dialog.tsx
+++ /dev/null
@@ -1,159 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from 'react'
-import {
-  Chip,
-  ChipModalBody,
-  ChipModalDescription,
-  ChipModalField,
-  ChipModalFooter,
-  ChipModalHeader,
-  ChipModalSurface,
-  Switch,
-} from '@sim/emcn'
-import {
-  readSearchRecovery,
-  SEARCH_RECOVERY_KEY,
-  SEARCH_RECOVERY_PROVIDERS,
-  setSearchRecovery,
-} from '@/search-recovery'
-
-interface SearchRecoveryDialogProps {
-  onClose: () => void
-}
-
-type SearchProvider = (typeof SEARCH_RECOVERY_PROVIDERS)[number]
-type SearchRecovery = Awaited<ReturnType<typeof readSearchRecovery>>
-
-/** Chrome owns modality so the dialog works without an injected scroll-lock stylesheet. */
-function mountSearchRecoveryDialog(dialog: HTMLDialogElement | null) {
-  if (!dialog) return
-  dialog.showModal()
-  return () => dialog.close()
-}
-
-export function SearchRecoveryDialog({ onClose }: SearchRecoveryDialogProps) {
-  const generation = useRef(0)
-  const [settings, setSettings] = useState<SearchRecovery>()
-  const [busyProvider, setBusyProvider] = useState<SearchProvider['id'] | null>(null)
-  const [notices, setNotices] = useState<Partial<Record<SearchProvider['id'], string>>>({})
-  const [loadError, setLoadError] = useState(false)
-
-  const refresh = useCallback(async () => {
-    const current = ++generation.current
-    try {
-      const next = await readSearchRecovery()
-      if (current === generation.current) {
-        setSettings(next)
-        setLoadError(false)
-      }
-    } catch {
-      if (current === generation.current) setLoadError(true)
-    }
-  }, [])
-
-  useEffect(() => {
-    const update = () => void refresh()
-    const stored = (changes: Record<string, chrome.storage.StorageChange>, area: string) => {
-      if (area === 'local' && SEARCH_RECOVERY_KEY in changes) update()
-    }
-    update()
-    chrome.permissions.onAdded.addListener(update)
-    chrome.permissions.onRemoved.addListener(update)
-    chrome.storage.onChanged.addListener(stored)
-    return () => {
-      generation.current++
-      chrome.permissions.onAdded.removeListener(update)
-      chrome.permissions.onRemoved.removeListener(update)
-      chrome.storage.onChanged.removeListener(stored)
-    }
-  }, [refresh])
-
-  async function changeProvider(provider: SearchProvider, enabled: boolean) {
-    if (!settings || busyProvider || loadError) return
-    setBusyProvider(provider.id)
-    setNotices((previous) => ({ ...previous, [provider.id]: '' }))
-    try {
-      if (enabled && !(await chrome.permissions.request({ origins: [...provider.origins] }))) {
-        setNotices((previous) => ({
-          ...previous,
-          [provider.id]: 'Site access was not granted. This shortcut is still off.',
-        }))
-        return
-      }
-      await setSearchRecovery(provider.id, enabled)
-      await refresh()
-    } catch {
-      setNotices((previous) => ({
-        ...previous,
-        [provider.id]: 'Could not change this shortcut. Try again.',
-      }))
-      await refresh()
-    } finally {
-      setBusyProvider(null)
-    }
-  }
-
-  return (
-    <dialog
-      ref={mountSearchRecoveryDialog}
-      aria-labelledby='search-recovery-title'
-      aria-describedby='search-recovery-description'
-      className='m-auto max-h-[85vh] w-[90vw] max-w-[440px] overflow-visible border-0 bg-transparent p-0 text-inherit backdrop:bg-black/10 backdrop:backdrop-blur-[2px]'
-      onCancel={(event) => {
-        event.preventDefault()
-        onClose()
-      }}
-      onClick={(event) => {
-        if (event.target === event.currentTarget) onClose()
-      }}
-    >
-      <ChipModalSurface className='max-h-[85vh]'>
-        <ChipModalHeader onClose={onClose}>
-          <span id='search-recovery-title'>Browser shortcuts</span>
-        </ChipModalHeader>
-        <ChipModalBody>
-          <ChipModalDescription id='search-recovery-description'>
-            Send explicit sim/ searches to your Sim Links. Ordinary searches stay with your search
-            engine.
-          </ChipModalDescription>
-          {SEARCH_RECOVERY_PROVIDERS.map((provider) => (
-            <ChipModalField
-              key={provider.id}
-              type='custom'
-              title={provider.label}
-              titleActions={
-                <Switch
-                  aria-label={`${provider.label} sim/ shortcuts`}
-                  aria-busy={busyProvider === provider.id}
-                  checked={settings?.[provider.id] ?? false}
-                  disabled={!settings || loadError || busyProvider !== null}
-                  onCheckedChange={(enabled) => void changeProvider(provider, enabled)}
-                />
-              }
-              hint={provider.origins.map((origin) => new URL(origin).origin).join(', ')}
-              submitOnEnter={false}
-            >
-              {notices[provider.id] && (
-                <p role='status' className='text-[var(--text-secondary)] text-caption'>
-                  {notices[provider.id]}
-                </p>
-              )}
-            </ChipModalField>
-          ))}
-          <p className='px-2 text-[var(--text-muted)] text-caption'>
-            Chrome asks for access to the sites shown above. Page reference stays unchanged. Turning
-            a shortcut off keeps site access.
-          </p>
-          {loadError && (
-            <div className='flex flex-wrap items-center gap-2 px-2'>
-              <p role='status' className='text-[var(--text-secondary)] text-caption'>
-                Could not load browser shortcuts.
-              </p>
-              <Chip onClick={() => void refresh()}>Retry</Chip>
-            </div>
-          )}
-        </ChipModalBody>
-        <ChipModalFooter defaultAction='dismiss' cancelLabel='Done' onCancel={onClose} />
-      </ChipModalSurface>
-    </dialog>
-  )
-}
diff --git a/apps/extension/src/search-recovery.ts b/apps/extension/src/search-recovery.ts
deleted file mode 100644
index f89356ad0a1..00000000000
--- a/apps/extension/src/search-recovery.ts
+++ /dev/null
@@ -1,198 +0,0 @@
-import { createLogger } from '@sim/logger'
-import { isRecordLike } from '@sim/utils/object'
-import { escapeRegExp } from '@sim/utils/string'
-import { SIM_ORIGIN } from '@/config'
-
-export const SEARCH_RECOVERY_KEY = 'searchRecovery'
-export const SEARCH_RECOVERY_PROVIDERS = [
-  {
-    id: 'google',
-    label: 'Google',
-    origins: ['https://www.google.com/*', 'https://google.com/*'],
-    path: '/search',
-    parameter: 'q',
-    ruleId: 101,
-  },
-  {
-    id: 'bing',
-    label: 'Bing',
-    origins: ['https://www.bing.com/*', 'https://bing.com/*'],
-    path: '/search',
-    parameter: 'q',
-    ruleId: 102,
-  },
-  {
-    id: 'duckduckgo',
-    label: 'DuckDuckGo',
-    origins: ['https://duckduckgo.com/*', 'https://www.duckduckgo.com/*'],
-    path: '/',
-    parameter: 'q',
-    ruleId: 103,
-  },
-  {
-    id: 'yahoo',
-    label: 'Yahoo',
-    origins: ['https://search.yahoo.com/*'],
-    path: '/search',
-    parameter: 'p',
-    ruleId: 104,
-  },
-] as const
-
-type ProviderId = (typeof SEARCH_RECOVERY_PROVIDERS)[number]['id']
-type RecoveryPreferences = Record<ProviderId, boolean>
-const logger = createLogger('BrowserShortcutRecovery')
-const MESSAGE_TYPE = 'set-search-recovery'
-
-/** Search text is never observed in JavaScript; Chrome matches only explicit shortcut requests. */
-function recoveryRules(
-  provider: (typeof SEARCH_RECOVERY_PROVIDERS)[number]
-): chrome.declarativeNetRequest.Rule[] {
-  const hosts = provider.origins.map((origin) => escapeRegExp(new URL(origin).host)).join('|')
-  const character = '(?:[a-z0-9._~:@/-]|%(?:2[6def]|3[0-9a]|4[0-9a-f]|5[0-9af]|6[1-9a-f]|7[0-9ae]))'
-  const shortcut = `sim(?:/|%2f)${character}+`
-  const condition = {
-    isUrlFilterCaseSensitive: false,
-    requestDomains: provider.origins.map((origin) => new URL(origin).hostname),
-    resourceTypes: [chrome.declarativeNetRequest.ResourceType.MAIN_FRAME],
-    requestMethods: [chrome.declarativeNetRequest.RequestMethod.GET],
-  }
-  // Separate ambiguity guards keep the redirect below Chrome's compiled-regex memory limit.
-  return [
-    {
-      id: provider.ruleId + 100,
-      priority: 2,
-      action: { type: chrome.declarativeNetRequest.RuleActionType.ALLOW },
-      condition: {
-        ...condition,
-        regexFilter: `[?&]${provider.parameter}=.*&${provider.parameter}=`,
-      },
-    },
-    {
-      id: provider.ruleId + 200,
-      priority: 2,
-      action: { type: chrome.declarativeNetRequest.RuleActionType.ALLOW },
-      condition: { ...condition, regexFilter: '[?&][^=&]*%[^=&]*=' },
-    },
-    {
-      id: provider.ruleId,
-      priority: 1,
-      action: {
-        type: chrome.declarativeNetRequest.RuleActionType.REDIRECT,
-        redirect: { regexSubstitution: `${SIM_ORIGIN}/sim-links/recover?q=\\1` },
-      },
-      condition: {
-        ...condition,
-        regexFilter: `^https://(?:${hosts})${escapeRegExp(provider.path)}\\?(?:[^#]*&)?${provider.parameter}=(${shortcut})(?:&[^#]*)?$`,
-      },
-    },
-  ]
-}
-
-/** A remembered choice is effective only while Chrome still grants that provider's sites. */
-export async function readSearchRecovery(): Promise<RecoveryPreferences> {
-  const stored = (await chrome.storage.local.get(SEARCH_RECOVERY_KEY))[SEARCH_RECOVERY_KEY]
-  const preferences: RecoveryPreferences = {
-    google: false,
-    bing: false,
-    duckduckgo: false,
-    yahoo: false,
-  }
-  for (const provider of SEARCH_RECOVERY_PROVIDERS) {
-    preferences[provider.id] =
-      isRecordLike(stored) &&
-      stored[provider.id] === true &&
-      (await chrome.permissions.contains({ origins: [...provider.origins] }))
-  }
-  return preferences
-}
-
-/** The worker serializes settings and rule updates across every open side panel. */
-export async function setSearchRecovery(provider: ProviderId, enabled: boolean): Promise<void> {
-  const response: unknown = await chrome.runtime.sendMessage({
-    type: MESSAGE_TYPE,
-    provider,
-    enabled,
-  })
-  if (!isRecordLike(response) || response.ok !== true)
-    throw new Error('Could not update browser shortcuts.')
-}
-
-/** Reconcile persisted, permission-bound rules at startup, on revocation, and after an explicit choice. */
-export function registerSearchRecovery() {
-  let pending = Promise.resolve()
-  const update = (choice?: { provider: ProviderId; enabled: boolean }) => {
-    const operation = pending.then(async () => {
-      const preferences = await readSearchRecovery()
-      if (choice) {
-        const provider = SEARCH_RECOVERY_PROVIDERS.find(
-          (provider) => provider.id === choice.provider
-        )
-        if (!provider) throw new Error('Unknown shortcut provider.')
-        if (
-          choice.enabled &&
-          !(await chrome.permissions.contains({ origins: [...provider.origins] }))
-        )
-          throw new Error('Search site access has not been granted.')
-        preferences[choice.provider] = choice.enabled
-      }
-      const rules = SEARCH_RECOVERY_PROVIDERS.filter(
-        (provider) => preferences[provider.id]
-      ).flatMap(recoveryRules)
-      for (const rule of rules) {
-        const supported = await chrome.declarativeNetRequest.isRegexSupported({
-          regex: rule.condition.regexFilter ?? '',
-          isCaseSensitive: false,
-          requireCapturing: true,
-        })
-        if (!supported.isSupported) throw new Error('Chrome cannot apply shortcut recovery.')
-      }
-      const ruleIds = SEARCH_RECOVERY_PROVIDERS.flatMap((provider) => [
-        provider.ruleId,
-        provider.ruleId + 100,
-        provider.ruleId + 200,
-      ])
-      const previousRules = (await chrome.declarativeNetRequest.getDynamicRules()).filter((rule) =>
-        ruleIds.includes(rule.id)
-      )
-      await chrome.declarativeNetRequest.updateDynamicRules({
-        removeRuleIds: ruleIds,
-        addRules: rules,
-      })
-      try {
-        await chrome.storage.local.set({ [SEARCH_RECOVERY_KEY]: preferences })
-      } catch (error) {
-        await chrome.declarativeNetRequest.updateDynamicRules({
-          removeRuleIds: ruleIds,
-          addRules: previousRules,
-        })
-        throw error
-      }
-    })
-    pending = operation.catch(() => logger.warn('Could not update browser shortcut recovery'))
-    return operation
-  }
-  const reconcile = () => {
-    void update().catch(() => {})
-  }
-  chrome.runtime.onInstalled.addListener(reconcile)
-  chrome.runtime.onStartup.addListener(reconcile)
-  chrome.permissions.onRemoved.addListener(reconcile)
-  chrome.runtime.onMessage.addListener((message: unknown, sender, respond) => {
-    if (
-      sender.id !== chrome.runtime.id ||
-      !sender.url?.startsWith(chrome.runtime.getURL('')) ||
-      !isRecordLike(message) ||
-      message.type !== MESSAGE_TYPE ||
-      typeof message.enabled !== 'boolean'
-    )
-      return
-    const provider = SEARCH_RECOVERY_PROVIDERS.find((provider) => provider.id === message.provider)
-    if (!provider) return
-    void update({ provider: provider.id, enabled: message.enabled }).then(
-      () => respond({ ok: true }),
-      () => respond({ ok: false })
-    )
-    return true
-  })
-}
diff --git a/apps/extension/src/short-hosts.ts b/apps/extension/src/short-hosts.ts
new file mode 100644
index 00000000000..6776723b467
--- /dev/null
+++ b/apps/extension/src/short-hosts.ts
@@ -0,0 +1,81 @@
+import {
+  SIM_LINK_HOSTS,
+  SIM_LINK_SUGGESTIONS_PATH,
+  simLinkSuggestionsSchema,
+} from '@sim/browser-extension-protocol'
+import { createLogger } from '@sim/logger'
+import { SIM_ORIGIN, VISIT_SHORT_HOSTS_MESSAGE } from '@/config'
+
+const logger = createLogger('ShortHosts')
+const VISITED_AT_KEY = 'shortHostsVisitedAt'
+const REFRESH_INTERVAL_MS = 7 * 24 * 60 * 60 * 1000
+const VISIT_TIMEOUT_MS = 15_000
+
+/** False when signed out or links are off here, where `go/x` should stay an ordinary search. */
+async function linksAreEnabled(): Promise<boolean> {
+  const response = await fetch(`${SIM_ORIGIN}${SIM_LINK_SUGGESTIONS_PATH}`, {
+    credentials: 'include',
+  })
+  if (!response.ok) return false
+  return simLinkSuggestionsSchema.parse(await response.json()).enabled === true
+}
+
+/**
+ * Closes once Chrome has committed the visit, which is what records the host in its history.
+ * False when it never got that far, such as the person closing the tab first.
+ */
+async function visitInBackground(host: string): Promise<boolean> {
+  const { id: tabId } = await chrome.tabs.create({ url: `http://${host}/`, active: false })
+  if (tabId === undefined) return false
+  const visited = await new Promise<boolean>((resolve) => {
+    const finish = (committed: boolean) => {
+      clearTimeout(timeout)
+      chrome.tabs.onUpdated.removeListener(updated)
+      resolve(committed)
+    }
+    const updated = (id: number, change: chrome.tabs.OnUpdatedInfo, tab: chrome.tabs.Tab) => {
+      if (id === tabId && (change.status === 'complete' || tab.url?.startsWith(SIM_ORIGIN))) {
+        finish(true)
+      }
+    }
+    const timeout = setTimeout(() => finish(false), VISIT_TIMEOUT_MS)
+    chrome.tabs.onUpdated.addListener(updated)
+  })
+  await chrome.tabs.remove(tabId).catch(() => undefined)
+  return visited
+}
+
+/**
+ * Chrome searches for `go/handbook` until its history holds `go` as a typed host, and it counts a
+ * visit to an unfamiliar single-label host as typed. So a background visit teaches the address bar
+ * without asking anything of the user. History expires after 90 days and can be cleared, which is
+ * why this repeats: a later visit only adds a history entry while the host is known, and relearns
+ * it once it isn't.
+ */
+async function visitShortHosts() {
+  const stored = await chrome.storage.local.get(VISITED_AT_KEY)
+  const visitedAt = stored[VISITED_AT_KEY]
+  if (typeof visitedAt === 'number' && Date.now() - visitedAt < REFRESH_INTERVAL_MS) return
+  if (!(await linksAreEnabled())) return
+  const visits = await Promise.all(SIM_LINK_HOSTS.map(visitInBackground))
+  if (visits.every(Boolean)) await chrome.storage.local.set({ [VISITED_AT_KEY]: Date.now() })
+}
+
+export function registerShortHostVisits() {
+  let visiting = false
+  const visit = () => {
+    if (visiting) return
+    visiting = true
+    void visitShortHosts()
+      .catch(() => logger.warn('Could not visit the short link hosts'))
+      .finally(() => {
+        visiting = false
+      })
+  }
+  chrome.runtime.onInstalled.addListener(visit)
+  chrome.runtime.onStartup.addListener(visit)
+  // Installing signed out leaves nothing to learn yet, so signing in to the panel is the next chance.
+  chrome.runtime.onMessage.addListener((message: unknown, sender) => {
+    if (sender.id === chrome.runtime.id && message === VISIT_SHORT_HOSTS_MESSAGE) visit()
+  })
+}
diff --git a/apps/extension/src/shortcut-hint.tsx b/apps/extension/src/shortcut-hint.tsx
deleted file mode 100644
index 543390bdb1c..00000000000
--- a/apps/extension/src/shortcut-hint.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-import { useEffect, useState } from 'react'
-import { OPEN_SIM_COMMAND } from '@/config'
-
-/** Reads the binding in this Chrome profile, including changes made in the shortcut settings. */
-export function ShortcutHint() {
-  const [shortcut, setShortcut] = useState<string | null>(null)
-  useEffect(() => {
-    let revision = 0
-    const read = () => {
-      const current = ++revision
-      void chrome.commands
-        .getAll()
-        .then((commands) => {
-          if (current === revision)
-            setShortcut(commands.find((entry) => entry.name === OPEN_SIM_COMMAND)?.shortcut ?? '')
-        })
-        .catch(() => {
-          if (current === revision) setShortcut(null)
-        })
-    }
-    read()
-    window.addEventListener('focus', read)
-    return () => {
-      revision++
-      window.removeEventListener('focus', read)
-    }
-  }, [])
-  if (shortcut === null) return null
-  return (
-    <p className='mt-1'>
-      {shortcut ? (
-        <>
-          For one-time access, press <kbd>{shortcut}</kbd> on the page.
-        </>
-      ) : (
-        <button
-          type='button'
-          className='underline underline-offset-2'
-          onClick={() => {
-            void chrome.tabs.create({ url: 'chrome://extensions/shortcuts' })
-          }}
-        >
-          Set shortcut
-        </button>
-      )}
-    </p>
-  )
-}
diff --git a/apps/extension/src/sidepanel.tsx b/apps/extension/src/sidepanel.tsx
index dc74d3d56f8..9c5b764f80d 100644
--- a/apps/extension/src/sidepanel.tsx
+++ b/apps/extension/src/sidepanel.tsx
@@ -4,28 +4,33 @@ import {
   type ExtensionToAppMessage,
   type PageSnapshot,
 } from '@sim/browser-extension-protocol'
-import { Chip } from '@sim/emcn'
 import { createRoot } from 'react-dom/client'
 import {
   captureActivePage,
   captureErrorMessage,
+  PAGE_CHANGED_MESSAGE,
   PageCaptureError,
   SiteAccessRequiredError,
   UnreadableSelectionError,
 } from '@/capture'
-import { CAPTURE_INTENT_KEY, CAPTURE_INTENT_TTL_MS, REFERENCE_PAGE_KEY, SIM_ORIGIN } from '@/config'
+import {
+  CAPTURE_INTENT_KEY,
+  CAPTURE_INTENT_TTL_MS,
+  REFERENCE_PAGE_KEY,
+  SIM_ORIGIN,
+  VISIT_SHORT_HOSTS_MESSAGE,
+} from '@/config'
 import { type CaptureIntent, captureIntentSchema } from '@/intent'
-import { createReferenceCapture } from '@/reference'
-import { SearchRecoveryDialog } from '@/search-recovery-dialog'
-import { ShortcutHint } from '@/shortcut-hint'
-import { SiteAccessDialog } from '@/site-access'
+import { createReferenceCapture, PAGE_ATTACHMENT_PENDING_MESSAGE } from '@/reference'
+import { PageAccessButton, SiteAccessDialog } from '@/site-access'
 import '@/shell.css'
 
+const PAGE_ATTACHMENT_EXPIRED_MESSAGE = 'The page attachment expired. Attach it again.'
 const BLOCKED_SELECTION =
   'Select readable text again, attach the page explicitly, or turn off Reference current page.'
 const KEYBOARD_FOCUS_HINT = navigator.platform.startsWith('Mac')
-  ? 'To type here, click the message field or press ⌘⌥↑ to move focus.'
-  : 'To type here, click the message field or use F6 to move focus.'
+  ? 'Click the message field, or press ⌘⌥↑ to move focus.'
+  : 'Click the message field, or press F6 to move focus.'
 
 interface SidePanelProps {
   origin: string
@@ -43,7 +48,6 @@ function SidePanel({ origin }: SidePanelProps) {
   const intentCutoffRef = useRef(0)
   const busyRef = useRef(false)
   const [accessOpen, setAccessOpen] = useState(false)
-  const [shortcutsOpen, setShortcutsOpen] = useState(false)
   const [status, setStatus] = useState<string | { message: string }>('')
   const referenceRef = useRef<ReturnType<typeof createReferenceCapture> | null>(null)
 
@@ -51,9 +55,7 @@ function SidePanel({ origin }: SidePanelProps) {
     if (!(status instanceof SiteAccessRequiredError)) return
     const navigated = (tabId: number, change: chrome.tabs.OnUpdatedInfo) => {
       if (tabId === status.tabId && (change.status === 'loading' || change.url !== undefined)) {
-        setStatus((current) =>
-          current === status ? 'The page changed. Try attaching it again.' : current
-        )
+        setStatus((current) => (current === status ? PAGE_CHANGED_MESSAGE : current))
       }
     }
     const activated = (tab: chrome.tabs.OnActivatedInfo) => {
@@ -76,7 +78,7 @@ function SidePanel({ origin }: SidePanelProps) {
     if (Date.now() - Date.parse(snapshot.capturedAt) > CAPTURE_INTENT_TTL_MS) {
       pendingRef.current = null
       focusRequested.current = false
-      setStatus('The capture expired. Attach the page again.')
+      setStatus(PAGE_ATTACHMENT_EXPIRED_MESSAGE)
       return
     }
     const message: ExtensionToAppMessage = {
@@ -111,9 +113,7 @@ function SidePanel({ origin }: SidePanelProps) {
     setStatus((status) => (typeof status === 'string' ? status : ''))
     intentCutoffRef.current = Date.now()
     setAccessOpen(false)
-    setShortcutsOpen(false)
-    if (pendingRef.current || busyRef.current)
-      setStatus('The conversation changed before delivery. Attach the page again.')
+    if (pendingRef.current || busyRef.current) setStatus('The chat changed. Attach the page again.')
     captureGenerationRef.current++
     pendingRef.current = null
     deliveredRef.current = null
@@ -133,12 +133,12 @@ function SidePanel({ origin }: SidePanelProps) {
     }
   ) {
     if (referenceRef.current?.busy()) {
-      setStatus('Wait for the current message to finish attaching its page.')
+      setStatus(PAGE_ATTACHMENT_PENDING_MESSAGE)
       return
     }
     if (busyRef.current) return
     if (pendingRef.current) {
-      setStatus('Waiting for Sim to receive the previous capture. Try again after it appears.')
+      setStatus(PAGE_ATTACHMENT_PENDING_MESSAGE)
       return
     }
     busyRef.current = true
@@ -150,7 +150,7 @@ function SidePanel({ origin }: SidePanelProps) {
       focusRequested.current = expected?.focusComposer === true
       unreadableSelection.current = null
       pendingRef.current = snapshot
-      setStatus('Waiting for Sim to receive the attachment…')
+      setStatus('Attaching the page…')
       deliver()
     } catch (error) {
       if (generation !== captureGenerationRef.current) return
@@ -174,7 +174,7 @@ function SidePanel({ origin }: SidePanelProps) {
       manualCaptureError: () => {
         if (busyRef.current || pendingRef.current || processingManual || manualIntents.size)
           return {
-            message: 'A page attachment is still being prepared. Try again once it appears.',
+            message: PAGE_ATTACHMENT_PENDING_MESSAGE,
           }
         if (unreadableSelection.current) return { message: BLOCKED_SELECTION, reason: 'selection' }
       },
@@ -247,15 +247,12 @@ function SidePanel({ origin }: SidePanelProps) {
         for (const key of keys) manualIntents.delete(key)
         const intent = intents[0]
         if (intent && intent.createdAt <= intentCutoffRef.current) {
-          if (!disposed)
-            setStatus(
-              'A capture from the previous conversation was discarded. Attach the page again.'
-            )
+          if (!disposed) setStatus('The chat changed. Attach the page again.')
           return
         }
         if (disposed || !intent) return
         if (!currentIntent(intent, window.id)) {
-          setStatus('The capture expired. Attach the page again.')
+          setStatus(PAGE_ATTACHMENT_EXPIRED_MESSAGE)
           return
         }
         if (intent.kind === 'focus') {
@@ -266,7 +263,7 @@ function SidePanel({ origin }: SidePanelProps) {
           }
         } else await capture(intent.kind, intent)
       } catch {
-        if (!disposed) setStatus('Could not receive the capture request. Attach the page again.')
+        if (!disposed) setStatus('Could not attach the page. Try again.')
       } finally {
         processingManual = false
         consumingIntent = false
@@ -316,13 +313,6 @@ function SidePanel({ origin }: SidePanelProps) {
         sessionId,
       }
       frameRef.current?.contentWindow?.postMessage(connected, SIM_ORIGIN)
-      const shortcuts: ExtensionToAppMessage = {
-        channel: 'sim-extension',
-        version: 1,
-        type: 'shortcuts-available',
-        sessionId,
-      }
-      frameRef.current?.contentWindow?.postMessage(shortcuts, SIM_ORIGIN)
       deliver()
       if (!pendingRef.current) deliverFocus()
     }
@@ -333,6 +323,8 @@ function SidePanel({ origin }: SidePanelProps) {
       if (parsed.data.type === 'theme') {
         appTheme = parsed.data.theme
         applyTheme()
+      } else if (parsed.data.type === 'signed-in') {
+        void chrome.runtime.sendMessage(VISIT_SHORT_HOSTS_MESSAGE).catch(() => undefined)
       } else if (parsed.data.type === 'ready') {
         void connect(parsed.data.sessionId)
       } else if (parsed.data.sessionId !== sessionRef.current) {
@@ -350,7 +342,8 @@ function SidePanel({ origin }: SidePanelProps) {
       } else if (parsed.data.type === 'action') {
         if (!navigator.userActivation.isActive) return
         if (parsed.data.action === 'site-access') setAccessOpen(true)
-        else if (parsed.data.action === 'browser-shortcuts') setShortcutsOpen(true)
+        else if (parsed.data.action === 'microphone-settings')
+          void chrome.tabs.create({ url: 'chrome://settings/content/microphone' })
         else void capture(parsed.data.action === 'capture-page' ? 'page' : 'selection')
       } else if (pendingRef.current?.id === parsed.data.snapshotId) {
         pendingRef.current = null
@@ -366,7 +359,7 @@ function SidePanel({ origin }: SidePanelProps) {
       ) {
         pendingRef.current = null
         focusRequested.current = false
-        setStatus('The capture expired. Attach the page again.')
+        setStatus(PAGE_ATTACHMENT_EXPIRED_MESSAGE)
       }
       void consumeIntent()
     }, 5_000)
@@ -402,18 +395,20 @@ function SidePanel({ origin }: SidePanelProps) {
         }
         role='status'
       >
-        {typeof status === 'string' ? status : status.message}
-        {status instanceof SiteAccessRequiredError && (
-          <>
-            <Chip className='ml-2' onClick={() => setAccessOpen(true)}>
-              Request site access
-            </Chip>
-            <ShortcutHint />
-          </>
+        {status instanceof SiteAccessRequiredError ? (
+          <PageAccessButton
+            onAccessGranted={() =>
+              setStatus((current) => (current instanceof SiteAccessRequiredError ? '' : current))
+            }
+          />
+        ) : typeof status === 'string' ? (
+          status
+        ) : (
+          status.message
         )}
       </div>
       <iframe
-        allow={`clipboard-write ${origin}`}
+        allow={`clipboard-write ${origin}; microphone ${origin}`}
         ref={frameRef}
         title='Sim chat'
         src={`${origin}/extension`}
@@ -424,12 +419,12 @@ function SidePanel({ origin }: SidePanelProps) {
       {accessOpen && (
         <SiteAccessDialog
           onClose={() => setAccessOpen(false)}
-          onAccessGranted={() =>
+          onAccessGranted={() => {
+            setAccessOpen(false)
             setStatus((current) => (current instanceof SiteAccessRequiredError ? '' : current))
-          }
+          }}
         />
       )}
-      {shortcutsOpen && <SearchRecoveryDialog onClose={() => setShortcutsOpen(false)} />}
     </main>
   )
 }
diff --git a/apps/extension/src/site-access.tsx b/apps/extension/src/site-access.tsx
index 5eb4de81e41..0ee685ade23 100644
--- a/apps/extension/src/site-access.tsx
+++ b/apps/extension/src/site-access.tsx
@@ -1,26 +1,56 @@
-import { useEffect, useRef, useState } from 'react'
-import { Chip, ChipModalBody, ChipModalField, ChipModalHeader, ChipModalSurface } from '@sim/emcn'
-import { parseSiteAddress, readSitePermission, requiredSite, sitePattern } from '@/site-permissions'
+import { useEffect, useState } from 'react'
+import { Chip, ChipModalBody, ChipModalHeader, ChipModalSurface } from '@sim/emcn'
+import { PAGE_ACCESS_ORIGINS } from '@/config'
 
-interface SiteAccessDialogProps {
-  onClose: () => void
+interface PageAccessButtonProps {
+  allowed?: boolean
   onAccessGranted: () => void
 }
 
-interface ActiveSite {
-  tabId: number
-  windowId: number
-  origin?: string
+export function PageAccessButton({ allowed, onAccessGranted }: PageAccessButtonProps) {
+  const [status, setStatus] = useState<'idle' | 'requesting' | 'error'>('idle')
+
+  async function enable() {
+    if (status === 'requesting') return
+    setStatus('requesting')
+    try {
+      const granted = await chrome.permissions.request({ origins: PAGE_ACCESS_ORIGINS })
+      setStatus('idle')
+      if (granted) onAccessGranted()
+    } catch {
+      setStatus('error')
+    }
+  }
+
+  if (allowed) {
+    return (
+      <Chip
+        onClick={() =>
+          void chrome.tabs.create({ url: `chrome://extensions/?id=${chrome.runtime.id}` })
+        }
+      >
+        Manage in browser
+      </Chip>
+    )
+  }
+
+  return (
+    <span className='inline-flex flex-wrap items-center gap-2'>
+      <Chip disabled={status === 'requesting'} onClick={() => void enable()}>
+        Allow across websites
+      </Chip>
+      {status === 'error' && (
+        <span role='status' className='text-[var(--text-error)] text-caption'>
+          Could not enable page access. Try again.
+        </span>
+      )}
+    </span>
+  )
 }
 
-async function getActiveSite(): Promise<ActiveSite | null> {
-  const [tab] = await chrome.tabs.query({ active: true, currentWindow: true })
-  if (tab?.id === undefined || tab.incognito) return null
-  const target = { tabId: tab.id, windowId: tab.windowId }
-  if (!tab.url) return target
-  const url = new URL(tab.url)
-  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) return null
-  return { ...target, origin: url.origin }
+interface SiteAccessDialogProps {
+  onClose: () => void
+  onAccessGranted: () => void
 }
 
 /** Native modality avoids the inline scroll-lock stylesheet blocked by the extension CSP. */
@@ -30,175 +60,36 @@ function mountAccessDialog(dialog: HTMLDialogElement | null) {
   return () => dialog.close()
 }
 
-interface SitePermissionFormProps {
-  site: ActiveSite
-  onAccessGranted: () => void
-}
-
-function SitePermissionForm({ site, onAccessGranted }: SitePermissionFormProps) {
-  const [address, setAddress] = useState('')
-  const [chosenOrigin, setChosenOrigin] = useState<string>()
-  const [notice, setNotice] = useState('')
-  const [busy, setBusy] = useState(false)
-  const [permission, setPermission] = useState<Awaited<ReturnType<typeof readSitePermission>>>()
-  const origin = chosenOrigin ?? site.origin
-  const target = origin ? new URL(origin) : parseSiteAddress(address)
-  const grant = permission?.origin === origin ? permission : undefined
-  const required = target && requiredSite(target)
+export function SiteAccessDialog({ onClose, onAccessGranted }: SiteAccessDialogProps) {
+  const [allowed, setAllowed] = useState<boolean>()
 
   useEffect(() => {
-    if (!origin) return
-    let generation = 0
+    let revision = 0
     const update = () => {
-      const current = ++generation
-      void readSitePermission(new URL(origin))
-        .then((permission) => {
-          if (current === generation) setPermission(permission)
-        })
-        .catch(() => {
-          if (current === generation)
-            setNotice('Could not check site access. Reopen the dialog to try again.')
-        })
+      const current = ++revision
+      void chrome.permissions.contains({ origins: PAGE_ACCESS_ORIGINS }).then(
+        (next) => {
+          if (current === revision) setAllowed(next)
+        },
+        () => {
+          if (current === revision) setAllowed(false)
+        }
+      )
     }
     update()
     chrome.permissions.onAdded.addListener(update)
     chrome.permissions.onRemoved.addListener(update)
     return () => {
-      generation++
+      revision++
       chrome.permissions.onAdded.removeListener(update)
       chrome.permissions.onRemoved.removeListener(update)
     }
-  }, [origin])
-
-  async function changeAccess() {
-    if (!target || busy || required || (origin && !grant)) return
-    setBusy(true)
-    setNotice('')
-    try {
-      if (grant?.allowed) {
-        if (!grant.removable.length) return
-        await chrome.permissions.remove({ origins: grant.removable })
-        const remaining = await readSitePermission(target)
-        setPermission(remaining)
-        if (!remaining.allowed) setChosenOrigin(undefined)
-        setNotice(
-          remaining.allowed ? 'Chrome still allows access to this site.' : 'Site access removed.'
-        )
-        return
-      }
-      if (!(await chrome.permissions.request({ origins: [sitePattern(target)] }))) {
-        setNotice('Access was not granted. Click the Sim toolbar icon for one-time access.')
-        return
-      }
-      setChosenOrigin(target.origin)
-      setAddress('')
-      const active = await getActiveSite()
-      if (
-        active?.tabId === site.tabId &&
-        active.windowId === site.windowId &&
-        active.origin === target.origin
-      ) {
-        onAccessGranted()
-        setNotice('Access granted. Try attaching the page again.')
-      } else {
-        setNotice('Access granted for this address. Open that site to attach its page.')
-      }
-    } catch {
-      setNotice('Could not change site access. Click the Sim toolbar icon for one-time access.')
-    } finally {
-      setBusy(false)
-    }
-  }
-
-  return (
-    <>
-      {!origin && (
-        <ChipModalField
-          type='input'
-          title='Site address'
-          value={address}
-          placeholder='https://example.com'
-          hint={
-            address && !target
-              ? 'Use an HTTP or HTTPS site address without credentials or wildcards.'
-              : 'Paste the page address, or click the Sim toolbar icon for one-time access.'
-          }
-          autoComplete='off'
-          maxLength={8192}
-          onChange={(value) => {
-            setAddress(value)
-            setNotice('')
-          }}
-          onSubmit={() => void changeAccess()}
-        />
-      )}
-      {required || (grant?.allowed && !grant.removable.length) ? (
-        <p className='text-[var(--text-muted)] text-small'>Sim already has access to this site.</p>
-      ) : (
-        <Chip
-          className='max-w-full'
-          disabled={busy || !target || Boolean(origin && !grant)}
-          onClick={() => void changeAccess()}
-        >
-          {`${grant?.allowed ? 'Remove access' : 'Allow access'}${target ? ` to ${target.origin}` : ''}`}
-        </Chip>
-      )}
-      {grant?.allPorts && (
-        <p className='text-[var(--text-muted)] text-small'>
-          This existing grant covers all ports on the host.
-        </p>
-      )}
-      {notice && (
-        <p role='status' className='text-[var(--text-secondary)] text-small'>
-          {notice}
-        </p>
-      )}
-    </>
-  )
-}
-
-export function SiteAccessDialog({ onClose, onAccessGranted }: SiteAccessDialogProps) {
-  const [site, setSite] = useState<(ActiveSite & { revision: number }) | null>()
-  const revision = useRef(0)
-  useEffect(() => {
-    let windowId: number | undefined
-    const update = () => {
-      const current = ++revision.current
-      setSite(undefined)
-      void getActiveSite()
-        .catch(() => null)
-        .then((next) => {
-          if (revision.current === current) {
-            windowId = next?.windowId
-            setSite(next && { ...next, revision: current })
-          }
-        })
-    }
-    const activated = (info: chrome.tabs.OnActivatedInfo) => {
-      if (windowId === undefined || info.windowId === windowId) update()
-    }
-    const navigated = (_id: number, change: chrome.tabs.OnUpdatedInfo, tab: chrome.tabs.Tab) => {
-      if (
-        tab.active &&
-        (windowId === undefined || tab.windowId === windowId) &&
-        (change.url !== undefined || change.status === 'loading')
-      )
-        update()
-    }
-    update()
-    chrome.tabs.onActivated.addListener(activated)
-    chrome.tabs.onUpdated.addListener(navigated)
-    return () => {
-      revision.current++
-      chrome.tabs.onActivated.removeListener(activated)
-      chrome.tabs.onUpdated.removeListener(navigated)
-    }
   }, [])
 
   return (
     <dialog
       ref={mountAccessDialog}
-      aria-labelledby='site-access-title'
+      aria-labelledby='page-access-title'
       className='m-auto max-h-[85vh] w-[90vw] max-w-[440px] overflow-visible border-0 bg-transparent p-0 text-inherit backdrop:bg-black/10 backdrop:backdrop-blur-[2px]'
       onCancel={(event) => {
         event.preventDefault()
@@ -210,23 +101,15 @@ export function SiteAccessDialog({ onClose, onAccessGranted }: SiteAccessDialogP
     >
       <ChipModalSurface>
         <ChipModalHeader onClose={onClose}>
-          <span id='site-access-title'>Site access</span>
+          <span id='page-access-title'>Page access</span>
         </ChipModalHeader>
         <ChipModalBody>
-          {site && (
-            <SitePermissionForm
-              key={site.revision}
-              site={site}
-              onAccessGranted={() => {
-                if (revision.current === site.revision) onAccessGranted()
-              }}
-            />
-          )}
-          {site === null && (
-            <p className='text-[var(--text-muted)] text-small'>
-              Open a web page to manage site access.
-            </p>
-          )}
+          <p className='text-[var(--text-muted)] text-small'>
+            {allowed
+              ? 'Allowed across websites.'
+              : 'Sim reads pages only when you attach them or send with Reference current page on.'}
+          </p>
+          <PageAccessButton allowed={allowed} onAccessGranted={onAccessGranted} />
         </ChipModalBody>
       </ChipModalSurface>
     </dialog>
diff --git a/apps/extension/src/site-permissions.ts b/apps/extension/src/site-permissions.ts
deleted file mode 100644
index 6a98a9c5968..00000000000
--- a/apps/extension/src/site-permissions.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { SIM_ORIGIN } from '@/config'
-
-/** Only a concrete web origin can be granted. Paths, queries, and fragments never enter a request. */
-export function parseSiteAddress(input: string): URL | null {
-  const address = input.trim()
-  if (!address || address.startsWith('//') || /[\\\u0000-\u001f\u007f]/.test(input)) return null
-  const withScheme = /^[a-z][a-z\d+.-]*:/i.test(address)
-  const hostWithPort = /^[\w.-]+:\d+(?:[/?#]|$)/.test(address)
-  const value = withScheme && !hostWithPort ? address : `https://${address}`
-  if (!/^https?:\/\/[^/\s]/i.test(value)) return null
-  const authority = value.slice(value.indexOf('//') + 2).split(/[/?#]/, 1)[0]
-  if (/[@%*\s]/.test(authority)) return null
-  try {
-    const site = new URL(value)
-    if (/[%*]/.test(site.hostname) || site.username || site.password) return null
-    return new URL(site.origin)
-  } catch {
-    return null
-  }
-}
-
-export function requiredSite(site: URL) {
-  const sim = new URL(SIM_ORIGIN)
-  return (
-    site.hostname === 'sim' ||
-    (site.hostname === sim.hostname &&
-      site.protocol === sim.protocol &&
-      (!sim.port || site.port === sim.port))
-  )
-}
-
-/** A match pattern without a port also grants access on other ports of this host. */
-export function sitePattern(site: URL) {
-  return `${site.protocol}//${site.hostname}:${site.port || (site.protocol === 'https:' ? '443' : '80')}/*`
-}
-
-export async function readSitePermission(site: URL) {
-  const pattern = sitePattern(site)
-  const [allowed, permissions] = await Promise.all([
-    chrome.permissions.contains({ origins: [pattern] }),
-    chrome.permissions.getAll(),
-  ])
-  const legacy = `${site.protocol}//${site.hostname}/*`
-  const removable = (permissions.origins ?? []).filter(
-    (origin) => origin === pattern || origin === legacy
-  )
-  return { origin: site.origin, allowed, removable, allPorts: removable.includes(legacy) }
-}
diff --git a/apps/sim/app/(landing)/comparisons/[provider]/page.tsx b/apps/sim/app/(landing)/comparisons/[provider]/page.tsx
index 3f690f18624..f0c18db4341 100644
--- a/apps/sim/app/(landing)/comparisons/[provider]/page.tsx
+++ b/apps/sim/app/(landing)/comparisons/[provider]/page.tsx
@@ -11,15 +11,19 @@ import { BrandIconTile, SimIconTile } from '@/app/(landing)/comparisons/componen
 import { ComparisonCards } from '@/app/(landing)/comparisons/components/comparison-cards'
 import { ComparisonLinkRow } from '@/app/(landing)/comparisons/components/comparison-link-row'
 import { ComparisonTable } from '@/app/(landing)/comparisons/components/comparison-table'
+import { GlanceTable } from '@/app/(landing)/comparisons/components/glance-table'
 import { MigrationSection } from '@/app/(landing)/comparisons/components/migration-section'
 import { ProseText } from '@/app/(landing)/comparisons/components/prose-text'
+import { QuestionSections } from '@/app/(landing)/comparisons/components/question-sections'
 import { getLibraryPostsForCompetitor } from '@/app/(landing)/comparisons/library-links'
 import {
   ALL_COMPETITORS,
+  answersQuestionsInPlace,
   buildBottomLine,
   buildComparisonFaqs,
   getCompetitorBySlug,
   getLatestVerifiedDate,
+  getQuestionSectionGroups,
   SIM_LATEST_VERIFIED,
 } from '@/app/(landing)/comparisons/utils'
 import { BackLink, ContentRelatedPosts } from '@/app/(landing)/components'
@@ -93,6 +97,13 @@ export default async function ComparisonProviderPage({
   }
 
   const faqs = buildComparisonFaqs(competitor)
+  const questionGroups = getQuestionSectionGroups(competitor)
+  const { lead } = questionGroups
+  const leadAnswer = competitor.leadAnswer ? (
+    <p className='max-w-[720px] text-[var(--text-body)] text-sm leading-[150%] tracking-[0.02em] lg:text-base'>
+      <ProseText prose={competitor.leadAnswer} />
+    </p>
+  ) : null
   const relatedPosts = await getLibraryPostsForCompetitor(competitor)
   const verdict = buildBottomLine(competitor)
   const CompetitorIcon = competitor.brand?.icon
@@ -117,6 +128,17 @@ export default async function ComparisonProviderPage({
     Math.max(SIM_LATEST_VERIFIED.getTime(), getLatestVerifiedDate(competitor).getTime())
   )
 
+  const verifiedDate = (
+    <time dateTime={latestVerified.toISOString().slice(0, 10)}>
+      {latestVerified.toLocaleDateString('en-US', {
+        month: 'long',
+        day: 'numeric',
+        year: 'numeric',
+        timeZone: 'UTC',
+      })}
+    </time>
+  )
+
   const productComparisonJsonLd = {
     '@context': 'https://schema.org',
     '@type': 'ItemList',
@@ -186,25 +208,28 @@ export default async function ComparisonProviderPage({
             >
               Sim vs {competitor.name}
             </h1>
-            {competitor.leadAnswer ? (
-              <p className='max-w-[720px] text-[var(--text-body)] text-sm leading-[150%] tracking-[0.02em] lg:text-base'>
-                <ProseText prose={competitor.leadAnswer} />
-              </p>
-            ) : null}
+            {lead ? (
+              <section
+                id='lead-question'
+                aria-labelledby='lead-question-heading'
+                className='flex flex-col gap-3'
+              >
+                <h2
+                  id='lead-question-heading'
+                  className='max-w-[720px] text-balance text-[var(--text-primary)] text-xl leading-[120%] tracking-[-0.02em] lg:text-2xl'
+                >
+                  {lead.question}
+                </h2>
+                {leadAnswer}
+              </section>
+            ) : (
+              leadAnswer
+            )}
             <p className='max-w-[720px] text-[var(--text-muted)] text-sm leading-[150%] tracking-[0.02em] lg:text-base'>
-              Sim is the open-source AI workspace where teams build, deploy, and manage AI agents
-              visually, conversationally, or with code. Here is how Sim compares to{' '}
-              {competitor.name} on platform architecture, AI capabilities, integrations, pricing,
-              security, and support. Every fact below is sourced and dated, last verified{' '}
-              <time dateTime={latestVerified.toISOString().slice(0, 10)}>
-                {latestVerified.toLocaleDateString('en-US', {
-                  month: 'long',
-                  day: 'numeric',
-                  year: 'numeric',
-                  timeZone: 'UTC',
-                })}
-              </time>
-              .
+              {lead
+                ? null
+                : `Sim is the open-source AI workspace where teams build, deploy, and manage AI agents visually, conversationally, or with code. Here is how Sim compares to ${competitor.name} on platform architecture, AI capabilities, integrations, pricing, security, and support. `}
+              Every fact below is sourced and dated, last verified {verifiedDate}.
             </p>
             <p className='sr-only'>
               Sim is an open-source AI workspace for building, deploying, and managing AI agents.
@@ -225,22 +250,7 @@ export default async function ComparisonProviderPage({
                 <div className='h-px w-full bg-[var(--border)]' />
               </>
             ) : null}
-            {competitor.betterThanAnswer ? (
-              <>
-                <section aria-labelledby='better-than-heading' className='px-6 py-10'>
-                  <h2
-                    id='better-than-heading'
-                    className='mb-4 text-[var(--text-primary)] text-xl leading-[100%] tracking-[-0.02em] lg:text-2xl'
-                  >
-                    Is Sim better than {competitor.name}?
-                  </h2>
-                  <p className='max-w-[720px] text-[var(--text-body)] text-small leading-[150%]'>
-                    <ProseText prose={competitor.betterThanAnswer} />
-                  </p>
-                </section>
-                <div className='h-px w-full bg-[var(--border)]' />
-              </>
-            ) : null}
+            <QuestionSections questions={questionGroups.opening} idPrefix='opening-question' />
             <div className='grid grid-cols-1 sm:grid-cols-2'>
               <section
                 aria-labelledby='what-is-sim-heading'
@@ -280,6 +290,14 @@ export default async function ComparisonProviderPage({
 
             <div className='h-px w-full bg-[var(--border)]' />
 
+            {competitor.glance ? (
+              <>
+                <GlanceTable rows={competitor.glance} competitorName={competitor.name} />
+                <div className='h-px w-full bg-[var(--border)]' />
+              </>
+            ) : null}
+            <QuestionSections questions={questionGroups.glance} idPrefix='glance-question' />
+
             <section aria-labelledby='comparison-table-heading' className='px-6 pt-10 pb-4'>
               <h2
                 id='comparison-table-heading'
@@ -351,6 +369,8 @@ export default async function ComparisonProviderPage({
 
             <div className='h-px w-full bg-[var(--border)]' />
 
+            <QuestionSections questions={questionGroups.closing} idPrefix='closing-question' />
+
             <section aria-labelledby='bottom-line-heading' className='px-6 py-10'>
               <h2
                 id='bottom-line-heading'
@@ -406,17 +426,19 @@ export default async function ComparisonProviderPage({
               </ul>
             </section>
 
-            <section aria-labelledby='faq-heading' className='px-6 py-10'>
-              <h2
-                id='faq-heading'
-                className='mb-4 text-[var(--text-primary)] text-xl leading-[100%] tracking-[-0.02em] lg:text-2xl'
-              >
-                Frequently asked questions
-              </h2>
-              <div>
-                <LandingFAQ faqs={faqs} />
-              </div>
-            </section>
+            {answersQuestionsInPlace(competitor) ? null : (
+              <section aria-labelledby='faq-heading' className='px-6 py-10'>
+                <h2
+                  id='faq-heading'
+                  className='mb-4 text-[var(--text-primary)] text-xl leading-[100%] tracking-[-0.02em] lg:text-2xl'
+                >
+                  Frequently asked questions
+                </h2>
+                <div>
+                  <LandingFAQ faqs={faqs} />
+                </div>
+              </section>
+            )}
           </div>
         </div>
 
diff --git a/apps/sim/app/(landing)/comparisons/components/glance-table/glance-table.tsx b/apps/sim/app/(landing)/comparisons/components/glance-table/glance-table.tsx
new file mode 100644
index 00000000000..cabdce9c482
--- /dev/null
+++ b/apps/sim/app/(landing)/comparisons/components/glance-table/glance-table.tsx
@@ -0,0 +1,85 @@
+import { cn } from '@sim/emcn'
+import type { GlanceRow } from '@/lib/compare/data'
+import { ProseText } from '@/app/(landing)/comparisons/components/prose-text'
+
+interface GlanceTableProps {
+  rows: GlanceRow[]
+  competitorName: string
+}
+
+const HEADER_CELL_CLASS =
+  'border-[var(--border)] border-l bg-[var(--surface-1)] px-4 py-3 font-medium text-[var(--text-muted)] text-small'
+const VALUE_CELL_CLASS =
+  'align-top text-[var(--text-body)] text-small leading-[150%] max-lg:block max-lg:px-4 max-lg:py-1 lg:border-[var(--border)] lg:border-t lg:border-l lg:px-4 lg:py-3'
+const STACKED_LABEL_CLASS = 'block font-medium text-[var(--text-muted)] text-caption lg:hidden'
+
+/**
+ * The main buying decision points as one table, each cell a sourced sentence with its citation
+ * links. Below `lg` each row stacks with labeled values, as the feature-by-feature table does.
+ * Server-rendered, so answer engines can extract the table without hydration.
+ */
+export function GlanceTable({ rows, competitorName }: GlanceTableProps) {
+  const heading = `Sim vs ${competitorName}: at a glance`
+  return (
+    <section id='glance' aria-labelledby='glance-heading' className='px-6 py-10'>
+      <h2
+        id='glance-heading'
+        className='mb-4 text-[var(--text-primary)] text-xl leading-[100%] tracking-[-0.02em] lg:text-2xl'
+      >
+        {heading}
+      </h2>
+      <div className='w-full overflow-hidden rounded-xl border border-[var(--border)]'>
+        <table className='w-full border-separate border-spacing-0 text-left max-lg:block lg:table-fixed'>
+          <caption className='sr-only'>{heading}</caption>
+          <colgroup>
+            <col className='w-[22%]' />
+            <col />
+            <col />
+          </colgroup>
+          <thead className='max-lg:hidden'>
+            <tr>
+              <th
+                scope='col'
+                className='bg-[var(--surface-1)] px-4 py-3 font-medium text-[var(--text-muted)] text-small'
+              >
+                Decision point
+              </th>
+              <th scope='col' className={HEADER_CELL_CLASS}>
+                Sim
+              </th>
+              <th scope='col' className={HEADER_CELL_CLASS}>
+                {competitorName}
+              </th>
+            </tr>
+          </thead>
+          <tbody className='max-lg:block'>
+            {rows.map((row, index) => (
+              <tr
+                key={row.label}
+                className={cn(
+                  'max-lg:block',
+                  index > 0 && 'max-lg:border-[var(--border)] max-lg:border-t'
+                )}
+              >
+                <th
+                  scope='row'
+                  className='align-top font-medium text-[var(--text-primary)] text-small leading-[150%] max-lg:block max-lg:px-4 max-lg:pt-3 max-lg:pb-1 lg:border-[var(--border)] lg:border-t lg:px-4 lg:py-3'
+                >
+                  {row.label}
+                </th>
+                <td className={VALUE_CELL_CLASS}>
+                  <span className={STACKED_LABEL_CLASS}>Sim</span>
+                  <ProseText prose={row.sim} />
+                </td>
+                <td className={cn(VALUE_CELL_CLASS, 'max-lg:pb-3')}>
+                  <span className={STACKED_LABEL_CLASS}>{competitorName}</span>
+                  <ProseText prose={row.competitor} />
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    </section>
+  )
+}
diff --git a/apps/sim/app/(landing)/comparisons/components/glance-table/index.ts b/apps/sim/app/(landing)/comparisons/components/glance-table/index.ts
new file mode 100644
index 00000000000..c07b040c291
--- /dev/null
+++ b/apps/sim/app/(landing)/comparisons/components/glance-table/index.ts
@@ -0,0 +1 @@
+export { GlanceTable } from './glance-table'
diff --git a/apps/sim/app/(landing)/comparisons/components/question-sections/index.ts b/apps/sim/app/(landing)/comparisons/components/question-sections/index.ts
new file mode 100644
index 00000000000..d90011152ee
--- /dev/null
+++ b/apps/sim/app/(landing)/comparisons/components/question-sections/index.ts
@@ -0,0 +1 @@
+export { QuestionSections } from './question-sections'
diff --git a/apps/sim/app/(landing)/comparisons/components/question-sections/question-sections.tsx b/apps/sim/app/(landing)/comparisons/components/question-sections/question-sections.tsx
new file mode 100644
index 00000000000..c3c7d8444a4
--- /dev/null
+++ b/apps/sim/app/(landing)/comparisons/components/question-sections/question-sections.tsx
@@ -0,0 +1,37 @@
+import { Fragment } from 'react'
+import type { ComparisonQuestion } from '@/lib/compare/data'
+import { ProseText } from '@/app/(landing)/comparisons/components/prose-text'
+
+interface QuestionSectionsProps {
+  questions: ComparisonQuestion[]
+  /** Prefix for each section's id, unique on the page. */
+  idPrefix: string
+}
+
+/**
+ * One section per buyer question, its heading worded as the buyer asks it and its answer
+ * directly beneath, each followed by a divider. Server-rendered, so answer engines can quote
+ * every answer on its own.
+ */
+export function QuestionSections({ questions, idPrefix }: QuestionSectionsProps) {
+  return questions.map(({ question, answer }, index) => {
+    const sectionId = `${idPrefix}-${index}`
+    const headingId = `${sectionId}-heading`
+    return (
+      <Fragment key={question}>
+        <section id={sectionId} aria-labelledby={headingId} className='px-6 py-10'>
+          <h2
+            id={headingId}
+            className='mb-4 text-[var(--text-primary)] text-xl leading-[100%] tracking-[-0.02em] lg:text-2xl'
+          >
+            {question}
+          </h2>
+          <p className='max-w-[720px] text-[var(--text-body)] text-small leading-[150%]'>
+            <ProseText prose={answer} />
+          </p>
+        </section>
+        <div className='h-px w-full bg-[var(--border)]' />
+      </Fragment>
+    )
+  })
+}
diff --git a/apps/sim/app/(landing)/comparisons/library-links.ts b/apps/sim/app/(landing)/comparisons/library-links.ts
index 3b6ddf616d9..2bcadc99e85 100644
--- a/apps/sim/app/(landing)/comparisons/library-links.ts
+++ b/apps/sim/app/(landing)/comparisons/library-links.ts
@@ -76,12 +76,16 @@ function topByScore<T>(items: T[], score: (item: T) => number): T[] {
 }
 
 /**
- * Library articles about, linking to, or naming `competitor`, strongest match first, then
- * newest first.
+ * The profile's `relatedReading` articles when it sets them; otherwise library articles about,
+ * linking to, or naming `competitor`, strongest match first, then newest first.
  */
 export async function getLibraryPostsForCompetitor(
   competitor: CompetitorProfile
 ): Promise<ContentMeta[]> {
+  if (competitor.relatedReading) {
+    const postsBySlug = new Map((await getAllPostMeta()).map((post) => [post.slug, post]))
+    return competitor.relatedReading.flatMap((slug) => postsBySlug.get(slug) ?? [])
+  }
   const patterns = buildMentionPatterns(competitor)
   const [posts, linkingPosts] = await Promise.all([
     getAllPostMeta(),
diff --git a/apps/sim/app/(landing)/comparisons/utils.ts b/apps/sim/app/(landing)/comparisons/utils.ts
index 94c9d0fd6d2..73be8869189 100644
--- a/apps/sim/app/(landing)/comparisons/utils.ts
+++ b/apps/sim/app/(landing)/comparisons/utils.ts
@@ -1,4 +1,5 @@
 import {
+  type ComparisonQuestion,
   type CompetitorProfile,
   claudeCoworkProfile,
   crewaiProfile,
@@ -12,6 +13,7 @@ import {
   n8nProfile,
   openaiAgentkitProfile,
   openClawProfile,
+  type Prose,
   pipedreamProfile,
   powerAutomateProfile,
   retoolProfile,
@@ -118,9 +120,16 @@ export function buildBottomLine(competitor: CompetitorProfile): ComparisonVerdic
  * question/answer pair is independently quotable per the landing GEO rules,
  * and every answer names "Sim" and the competitor explicitly. Every answer
  * draws on a real, sourced {@link Fact} field rather than a generic claim,
- * and no two questions repeat the same answer.
+ * and no two questions repeat the same answer. A profile that {@link answersQuestionsInPlace}
+ * gets those questions instead, so its FAQ data matches what the page shows.
  */
 export function buildComparisonFaqs(competitor: CompetitorProfile): ComparisonFaq[] {
+  if (answersQuestionsInPlace(competitor)) {
+    const { lead, opening, glance, closing } = getQuestionSectionGroups(competitor)
+    return [...(lead ? [lead] : []), ...opening, ...glance, ...closing].map(
+      ({ question, answer }) => ({ question, answer: proseToText(answer) })
+    )
+  }
   const name = competitor.name
   const facts = competitor.facts
   const faqs: ComparisonFaq[] = [
@@ -169,6 +178,44 @@ export function buildComparisonFaqs(competitor: CompetitorProfile): ComparisonFa
   return faqs
 }
 
+/**
+ * Whether the page answers its buyer questions as sections (see
+ * {@link CompetitorProfile.questions}). Such a page omits the FAQ block, and its FAQ structured
+ * data lists those questions instead.
+ */
+export function answersQuestionsInPlace(competitor: CompetitorProfile): boolean {
+  return competitor.questions !== undefined
+}
+
+/**
+ * The buyer questions the page answers in their own sections, by position: `lead` in the hero,
+ * `opening` (the "better than" and intro questions) ahead of the product definitions, `glance`
+ * after the at-a-glance table, and `closing` after the documented limitations.
+ */
+export function getQuestionSectionGroups(competitor: CompetitorProfile): {
+  lead: ComparisonQuestion | undefined
+  opening: ComparisonQuestion[]
+  glance: ComparisonQuestion[]
+  closing: ComparisonQuestion[]
+} {
+  const { leadQuestion, leadAnswer, betterThanAnswer, questions } = competitor
+  return {
+    lead: leadQuestion && leadAnswer ? { question: leadQuestion, answer: leadAnswer } : undefined,
+    opening: [
+      ...(betterThanAnswer
+        ? [{ question: `Is Sim better than ${competitor.name}?`, answer: betterThanAnswer }]
+        : []),
+      ...(questions?.intro ?? []),
+    ],
+    glance: questions?.glance ?? [],
+    closing: questions?.closing ?? [],
+  }
+}
+
+function proseToText(prose: Prose): string {
+  return prose.map((segment) => (typeof segment === 'string' ? segment : segment.text)).join('')
+}
+
 function buildKeyDifferenceAnswer(competitor: CompetitorProfile): string {
   const topFeature = competitor.standoutFeatures[0]
   const topLimitation = competitor.limitations[0]
diff --git a/apps/sim/app/(landing)/privacy/privacy-content.tsx b/apps/sim/app/(landing)/privacy/privacy-content.tsx
index ff2c77b48eb..c90897a0c81 100644
--- a/apps/sim/app/(landing)/privacy/privacy-content.tsx
+++ b/apps/sim/app/(landing)/privacy/privacy-content.tsx
@@ -44,7 +44,7 @@ function richText(content: string): ReactNode {
 export const PRIVACY_CONFIG: LegalPageConfig = {
   title: 'Privacy Policy',
   description: 'Sim Studio, Inc. · Operating the Sim platform (sim.ai)',
-  lastUpdated: 'November 3, 2026',
+  lastUpdated: 'November 4, 2026',
   intro: [
     {
       kind: 'paragraph',
@@ -806,13 +806,19 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
         {
           kind: 'paragraph',
           content: richText(
-            'When You ask Sim to attach a page or selection, the browser extension reads the requested text from the top frame of that page and transfers it, the page title, and a normalized page address to the hosted Sim composer. URL credentials, query parameters, and fragments are removed. The extractor skips form inputs, editable fields, scripts, embedded frames, and elements it detects as hidden. Page text, including text in collapsed sections, may still contain personal or sensitive information, such as personal communications or health, financial, or authentication information.'
+            'When You click the microphone and grant browser permission, Sim streams microphone audio to ElevenLabs for transcription into Your editable message draft. Opening the panel does not start recording, and this feature does not capture tab audio. Stopping voice input ends microphone capture; sending a message or changing conversations cancels unfinished transcription. Submitted transcripts become conversation content under the retention and processing rules below.'
           ),
         },
         {
           kind: 'paragraph',
           content: richText(
-            'Reference current page is an optional setting stored in Your Chrome profile. When it is on, sending a message from the sidebar includes a snapshot of the active tab unless You have attached a page or selection Yourself. Opening the panel or switching tabs does not trigger this capture. If Chrome has not granted access, Your draft stays in the composer. You can grant access to an individual site and send again, or turn the setting off. You can revoke site access in the extension or Chrome settings. Incognito capture is disabled.'
+            'When You ask Sim to attach a page or selection, or open Sim from its toolbar button or keyboard shortcut with Reference current page off, the browser extension reads the requested text from the top frame of that page and transfers it, the page title, and a normalized page address to the hosted Sim composer. URL credentials, query parameters, and fragments are removed. The extractor skips form inputs, editable fields, scripts, embedded frames, and elements it detects as hidden. Page text, including text in collapsed sections, may still contain personal or sensitive information, such as personal communications or health, financial, or authentication information.'
+          ),
+        },
+        {
+          kind: 'paragraph',
+          content: richText(
+            'Reference current page is an optional setting stored in Your Chrome profile. When it is on, sending a message from the sidebar includes a snapshot of the active tab unless You have attached a page or selection Yourself. Opening the panel or switching tabs does not trigger this capture. If Chrome has not granted access, Your draft stays in the composer. You can grant browser access and send again, or turn the setting off. Page access can be granted across HTTP and HTTPS websites. You can revoke or restrict access in Chrome settings. Incognito capture is disabled.'
           ),
         },
         {
@@ -836,13 +842,13 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
         {
           kind: 'paragraph',
           content: richText(
-            'When You use the sim address-bar keyword, the extension sends the typed link name, before any path values or query, to Sim with Your authenticated session to suggest Your organization’s links. Suggestions are cached in memory and are not written to extension storage. Opening a sim/ shortcut sends its path and query to Sim to resolve the destination, then opens that destination. Sim records each link’s visit count and last-visited time. These requests also use the operational diagnostics described in this Privacy Policy. Choosing Create Sim Link from the browser menu opens a draft with the selected link’s address, omitting query parameters and fragments. The destination becomes an organization Sim Link only when You confirm creation. The extension does not read Your browser history or unrelated address-bar input.'
+            'When You use the sim address-bar keyword, the extension sends the typed link name, before any path values or query, to Sim with Your authenticated session to suggest Your organization’s links. Suggestions are cached in memory and are not written to extension storage. Opening a sim/ or go/ shortcut sends its path and query to Sim to resolve the destination, then opens that destination. Sim records each link’s visit count and last-visited time. These requests also use the operational diagnostics described in this Privacy Policy. Choosing Create link in Sim from the browser menu opens a draft with the selected link’s address, omitting query parameters and fragments. The destination becomes an organization link only when You confirm creation. The extension does not read Your browser history or unrelated address-bar input.'
           ),
         },
         {
           kind: 'paragraph',
           content: richText(
-            'Browser shortcuts can optionally recover an explicit sim/ shortcut that Chrome sends to a supported search engine. After You enable a provider and approve access to its listed sites, Chrome applies request rules that send only the matching shortcut name and path values to Sim’s normal link resolver. Other search parameters and ordinary search terms are not sent to Sim by this feature. The extension stores Your provider choices locally and does not change Your default search engine. These site permissions can also allow page attachment when You explicitly request it; enabling shortcut recovery does not enable Reference current page or background capture. Turning recovery off stops these redirects. Site access remains until You revoke it in the extension or Chrome settings.'
+            'When Links are available for Your organization, the extension opens sim/ and go/ about once a week in background tabs that close themselves, so Chrome recognizes these shortcuts in the address bar. Those tabs load Sim’s link page with Your session, send no browsing data, and appear in Your browser history.'
           ),
         },
         {
diff --git a/apps/sim/app/api/organizations/[id]/sim-links/bookmarks/route.ts b/apps/sim/app/api/organizations/[id]/sim-links/bookmarks/route.ts
deleted file mode 100644
index 1d9701a136b..00000000000
--- a/apps/sim/app/api/organizations/[id]/sim-links/bookmarks/route.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { exportSimBookmarksContract } from '@/lib/api/contracts/sim-links'
-import {
-  defineInternalJsonRoute,
-  internalOrchestrationErrorPolicy,
-  internalRateLimits,
-  internalSessionAuth,
-} from '@/lib/api/server/routes'
-import { exportSimBookmarks } from '@/lib/sim-links/application/use-cases'
-
-export const POST = defineInternalJsonRoute({
-  contract: exportSimBookmarksContract,
-  auth: internalSessionAuth,
-  rateLimit: internalRateLimits.user({ bucketName: 'sim-links' }),
-  errorPolicy: internalOrchestrationErrorPolicy,
-  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
-  operation: exportSimBookmarks.operation,
-  useCase: exportSimBookmarks,
-  mapInput: ({ params, body }) => ({ organizationId: params.id, links: body.links }),
-  present: (links) => ({ links }),
-})
diff --git a/apps/sim/app/api/sim-links/suggestions/route.ts b/apps/sim/app/api/sim-links/suggestions/route.ts
index d7535a6cc71..539fbc374b1 100644
--- a/apps/sim/app/api/sim-links/suggestions/route.ts
+++ b/apps/sim/app/api/sim-links/suggestions/route.ts
@@ -20,5 +20,5 @@ export const GET = defineInternalJsonRoute({
   errorPolicy: internalOrchestrationErrorPolicy,
   staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
   mapInput: ({ query }) => ({ query: query.q }),
-  present: (links) => ({ links }),
+  present: (suggestions) => suggestions,
 })
diff --git a/apps/sim/app/extension/[workspaceId]/chat.tsx b/apps/sim/app/extension/[workspaceId]/chat.tsx
index 510b36b06f0..72f5250dc34 100644
--- a/apps/sim/app/extension/[workspaceId]/chat.tsx
+++ b/apps/sim/app/extension/[workspaceId]/chat.tsx
@@ -20,6 +20,7 @@ import { useChat } from '@/app/workspace/[workspaceId]/home/hooks/use-chat'
 import { fetchWorkspaceResourceRef } from '@/app/workspace/[workspaceId]/home/resolve-resource-ref'
 import type { FileAttachmentForApi } from '@/app/workspace/[workspaceId]/home/types'
 import { useMothershipChats } from '@/hooks/queries/mothership-chats'
+import { VoiceInputPermissionContext } from '@/hooks/use-voice-input'
 import type { ChatContext } from '@/stores/panel'
 
 interface ExtensionChatProps {
@@ -119,99 +120,101 @@ export function ExtensionChat({ workspaceId, workspaceName }: ExtensionChatProps
   )
 
   return (
-    <main
-      ref={fileDropTarget}
-      className='ph-no-capture flex h-dvh min-w-0 flex-col overflow-hidden bg-[var(--bg)] text-[var(--text-body)]'
-    >
-      <ExtensionHeader
-        workspaceId={workspaceId}
-        scopeName={workspaceName}
-        history={history}
-        chatId={chat.resolvedChatId}
-        onSelectChat={selectChat}
-        appHref={appHref}
-      />
-      {chat.error && (
-        <p role='alert' className='px-3 py-2 text-[var(--text-error)] text-caption'>
-          {chat.error}
-        </p>
-      )}
-      {composer.captureError && (
-        <p role='alert' className='px-3 py-2 text-[var(--text-error)] text-caption'>
-          {composer.captureError}
-        </p>
-      )}
-      {!selectedChatId && chat.messages.length === 0 && (
-        <div className='flex flex-1 items-center justify-center px-5'>
-          <h1 className='text-lg'>How can I help?</h1>
-        </div>
-      )}
-      <MothershipChat
-        onNavigateToChat={selectChat}
-        workspaceId={workspaceId}
-        userId={userId}
-        chatId={chat.resolvedChatId}
-        messages={chat.messages}
-        isSending={chat.isSending}
-        isReconnecting={chat.isReconnecting}
-        isLoading={
-          Boolean(selectedChatId) && chat.messages.length === 0 && chat.isChatHistoryPending
-        }
-        onSubmit={(message, files, contexts) => submit(message, files, contexts, false)}
-        onComposerSubmit={submit}
-        onStopGeneration={stop}
-        messageQueue={chat.messageQueue}
-        editingQueuedId={chat.editingQueuedId}
-        dispatchingHeadId={chat.dispatchingHeadId}
-        onRemoveQueuedMessage={chat.removeFromQueue}
-        onSendQueuedMessage={chat.sendNow}
-        onEditQueuedMessage={chat.editQueuedMessage}
-        onCancelQueueEdit={chat.cancelQueueEdit}
-        onViewSources={(messageId, requestId) =>
-          void setSourceParams(
-            { 'source-message': messageId, 'source-request': requestId ?? null },
-            { history: 'push' }
-          )
-        }
-        onWorkspaceResourceSelect={(resource) => void openResource(resource)}
-        composerKey={composerKey}
-        fileDropTarget={fileDropTarget}
-        draftScopeKey={`extension:${userId}:${workspaceId}:${selectedChatId ?? 'new'}`}
-        composerAttachments={composer.attachments}
-        composerResourceActions={composer.resourceActions}
-        composerToolbarActions={composer.toolbarActions}
-        composerModelSelectorOptions={composer.modelSelectorOptions}
-        layout='copilot-view'
-        className={cn('h-auto min-h-0', (selectedChatId || chat.messages.length > 0) && 'flex-1')}
-      />
-      <ChipModal
-        open={Boolean(sourceMessage)}
-        onOpenChange={(open) => {
-          if (!open) closeSources()
-        }}
-        srTitle='Cited sources'
-        size='sm'
+    <VoiceInputPermissionContext value={composer.openMicrophoneSettings}>
+      <main
+        ref={fileDropTarget}
+        className='ph-no-capture flex h-dvh min-w-0 flex-col overflow-hidden bg-[var(--bg)] text-[var(--text-body)]'
       >
-        <ChipModalHeader onClose={closeSources}>Cited sources</ChipModalHeader>
-        {sourceMessage && (
-          <div className='h-[60dvh] min-h-0'>
-            <SourcesResourceContent
-              chatId={chat.resolvedChatId}
-              resource={{
-                id: 'cited-sources',
-                type: 'sources',
-                title: 'Sources',
-                sources: {
-                  messageId: sourceMessage.id,
-                  ...(sourceParams['source-request']
-                    ? { requestId: sourceParams['source-request'] }
-                    : {}),
-                },
-              }}
-            />
+        <ExtensionHeader
+          workspaceId={workspaceId}
+          scopeName={workspaceName}
+          history={history}
+          chatId={chat.resolvedChatId}
+          onSelectChat={selectChat}
+          appHref={appHref}
+        />
+        {chat.error && (
+          <p role='alert' className='px-3 py-2 text-[var(--text-error)] text-caption'>
+            {chat.error}
+          </p>
+        )}
+        {composer.captureError && (
+          <p role='alert' className='px-3 py-2 text-[var(--text-error)] text-caption'>
+            {composer.captureError}
+          </p>
+        )}
+        {!selectedChatId && chat.messages.length === 0 && (
+          <div className='flex flex-1 items-center justify-center px-5'>
+            <h1 className='text-lg'>How can I help?</h1>
           </div>
         )}
-      </ChipModal>
-    </main>
+        <MothershipChat
+          onNavigateToChat={selectChat}
+          workspaceId={workspaceId}
+          userId={userId}
+          chatId={chat.resolvedChatId}
+          messages={chat.messages}
+          isSending={chat.isSending}
+          isReconnecting={chat.isReconnecting}
+          isLoading={
+            Boolean(selectedChatId) && chat.messages.length === 0 && chat.isChatHistoryPending
+          }
+          onSubmit={(message, files, contexts) => submit(message, files, contexts, false)}
+          onComposerSubmit={submit}
+          onStopGeneration={stop}
+          messageQueue={chat.messageQueue}
+          editingQueuedId={chat.editingQueuedId}
+          dispatchingHeadId={chat.dispatchingHeadId}
+          onRemoveQueuedMessage={chat.removeFromQueue}
+          onSendQueuedMessage={chat.sendNow}
+          onEditQueuedMessage={chat.editQueuedMessage}
+          onCancelQueueEdit={chat.cancelQueueEdit}
+          onViewSources={(messageId, requestId) =>
+            void setSourceParams(
+              { 'source-message': messageId, 'source-request': requestId ?? null },
+              { history: 'push' }
+            )
+          }
+          onWorkspaceResourceSelect={(resource) => void openResource(resource)}
+          composerKey={composerKey}
+          fileDropTarget={fileDropTarget}
+          draftScopeKey={`extension:${userId}:${workspaceId}:${selectedChatId ?? 'new'}`}
+          composerAttachments={composer.attachments}
+          composerResourceActions={composer.resourceActions}
+          composerToolbarActions={composer.toolbarActions}
+          composerModelSelectorOptions={composer.modelSelectorOptions}
+          layout='copilot-view'
+          className={cn('h-auto min-h-0', (selectedChatId || chat.messages.length > 0) && 'flex-1')}
+        />
+        <ChipModal
+          open={Boolean(sourceMessage)}
+          onOpenChange={(open) => {
+            if (!open) closeSources()
+          }}
+          srTitle='Cited sources'
+          size='sm'
+        >
+          <ChipModalHeader onClose={closeSources}>Cited sources</ChipModalHeader>
+          {sourceMessage && (
+            <div className='h-[60dvh] min-h-0'>
+              <SourcesResourceContent
+                chatId={chat.resolvedChatId}
+                resource={{
+                  id: 'cited-sources',
+                  type: 'sources',
+                  title: 'Sources',
+                  sources: {
+                    messageId: sourceMessage.id,
+                    ...(sourceParams['source-request']
+                      ? { requestId: sourceParams['source-request'] }
+                      : {}),
+                  },
+                }}
+              />
+            </div>
+          )}
+        </ChipModal>
+      </main>
+    </VoiceInputPermissionContext>
   )
 }
diff --git a/apps/sim/app/extension/[workspaceId]/workspace.tsx b/apps/sim/app/extension/[workspaceId]/workspace.tsx
index e0b5b393dff..6c5f61f72cb 100644
--- a/apps/sim/app/extension/[workspaceId]/workspace.tsx
+++ b/apps/sim/app/extension/[workspaceId]/workspace.tsx
@@ -4,7 +4,7 @@ import { Chip, ChipLink } from '@sim/emcn'
 import { isApiClientError } from '@/lib/api/client/errors'
 import { ExtensionChat } from '@/app/extension/[workspaceId]/chat'
 import ExtensionLoading from '@/app/extension/loading'
-import { ExtensionSignIn } from '@/app/extension/sign-in'
+import { ExtensionSessionExpired } from '@/app/extension/providers'
 import { ChatPlanModal } from '@/app/workspace/[workspaceId]/home/components/chat-plan-modal'
 import { BlockVisibilityLoader } from '@/app/workspace/[workspaceId]/providers/block-visibility-loader'
 import { CustomBlocksLoader } from '@/app/workspace/[workspaceId]/providers/custom-blocks-loader'
@@ -29,7 +29,7 @@ export function ExtensionWorkspace({ workspaceId }: ExtensionWorkspaceProps) {
     refetchInterval: WORKSPACE_HOST_CONTEXT_STALE_TIME,
     refetchOnWindowFocus: true,
   })
-  if (isApiClientError(error) && error.status === 401) return <ExtensionSignIn />
+  if (isApiClientError(error) && error.status === 401) return <ExtensionSessionExpired />
   if (isPending) return <ExtensionLoading />
   const accessDenied = isApiClientError(error) && (error.status === 403 || error.status === 404)
   if (accessDenied || !data) {
diff --git a/apps/sim/app/extension/create-link/page.tsx b/apps/sim/app/extension/create-link/page.tsx
index 2da41389562..a5d369273e7 100644
--- a/apps/sim/app/extension/create-link/page.tsx
+++ b/apps/sim/app/extension/create-link/page.tsx
@@ -16,8 +16,8 @@ export default async function CreateLinkPage() {
   if (!context)
     return (
       <StatusPageContent
-        title='Sim Links unavailable'
-        description='Your organization needs Sim Links enabled to create a link.'
+        title='Links unavailable'
+        description='Your organization needs Links enabled to create a link.'
       >
         <ChipLink href='/home'>Open Sim</ChipLink>
       </StatusPageContent>
diff --git a/apps/sim/app/extension/hooks/use-composer.tsx b/apps/sim/app/extension/hooks/use-composer.tsx
index 5d277fa6d6b..18c58fc8b12 100644
--- a/apps/sim/app/extension/hooks/use-composer.tsx
+++ b/apps/sim/app/extension/hooks/use-composer.tsx
@@ -26,7 +26,6 @@ export function useExtensionComposer(scopeKey: string) {
     clearSnapshots,
     removeSnapshot,
     connected,
-    shortcutsAvailable,
     requestAction,
     referenceEnabled,
     setReferenceEnabled,
@@ -68,17 +67,11 @@ export function useExtensionComposer(scopeKey: string) {
           )}
           <DropdownMenuItem onSelect={() => requestAction('site-access')}>
             <Settings className='size-[14px]' />
-            Site access
+            Page access
           </DropdownMenuItem>
-          {shortcutsAvailable && (
-            <DropdownMenuItem onSelect={() => requestAction('browser-shortcuts')}>
-              <Globe className='size-[14px]' />
-              Browser shortcuts
-            </DropdownMenuItem>
-          )}
         </>
       ) : undefined,
-    [connected, requestAction, referenceEnabled, setReferenceEnabled, shortcutsAvailable]
+    [connected, requestAction, referenceEnabled, setReferenceEnabled]
   )
   const prepareSubmission = useCallback<PrepareChatSubmission>(
     (text, contexts, send, reference = true) => {
@@ -110,7 +103,7 @@ export function useExtensionComposer(scopeKey: string) {
         snapshots.length > 0 || contexts?.some((context) => context.kind === 'browser_page')
       if (reference && !hasPage && referenceEnabled !== false) {
         if (!connected && window.parent !== window) {
-          toast.info('Connecting to the Sim extension. Try again in a moment.')
+          toast.info('Connecting to Sim. Try again in a moment.')
           return false
         }
         if (referenceEnabled) {
@@ -145,14 +138,19 @@ export function useExtensionComposer(scopeKey: string) {
           </Tooltip.Trigger>
           <Tooltip.Content side='top'>
             {referenceEnabled
-              ? 'Include the active tab when you send. Click to attach a fixed snapshot.'
+              ? 'Includes the active page when you send. Click to attach it now.'
               : 'Attach current page'}
           </Tooltip.Content>
         </Tooltip.Root>
       ) : undefined,
     [connected, requestAction, referenceEnabled]
   )
+  const openMicrophoneSettings = useCallback(
+    () => requestAction('microphone-settings'),
+    [requestAction]
+  )
   return {
+    openMicrophoneSettings: connected ? openMicrophoneSettings : null,
     attachments,
     resourceActions,
     toolbarActions,
diff --git a/apps/sim/app/extension/hooks/use-page-context.ts b/apps/sim/app/extension/hooks/use-page-context.ts
index bad88ac933e..a030ce27269 100644
--- a/apps/sim/app/extension/hooks/use-page-context.ts
+++ b/apps/sim/app/extension/hooks/use-page-context.ts
@@ -18,12 +18,10 @@ interface CaptureState {
   error?: string
   connected?: boolean
   referenceEnabled?: boolean
-  shortcutsAvailable?: boolean
 }
 
 type CaptureAction =
   | { type: 'connected'; scopeKey: string }
-  | { type: 'shortcuts'; scopeKey: string }
   | { type: 'preference'; enabled: boolean; scopeKey: string }
   | { type: 'receive'; snapshot: PageSnapshot; scopeKey: string }
   | { type: 'scope'; scopeKey: string }
@@ -42,14 +40,13 @@ function reduceCaptures(state: CaptureState, action: CaptureAction): CaptureStat
   if (action.scopeKey !== state.scopeKey) return state
   if (action.type === 'preference') return { ...state, referenceEnabled: action.enabled }
   if (action.type === 'connected') return { ...state, connected: true }
-  if (action.type === 'shortcuts') return { ...state, shortcutsAvailable: true }
   if (state.snapshots.some((snapshot) => snapshot.id === action.snapshot.id)) return state
   const snapshots = [...state.snapshots, action.snapshot]
   const error = getPageContextBudgetError(
     snapshots.map((snapshot) => ({ kind: 'browser_page', snapshot }))
   )
   return error
-    ? { ...state, error: `${error}. Remove one and capture again.` }
+    ? { ...state, error: `${error}. Remove a page and try again.` }
     : { ...state, snapshots, error: undefined }
 }
 
@@ -110,10 +107,6 @@ export function usePageContext(origins: string[], scopeKey: string) {
         }
         return
       }
-      if (parsed.data.type === 'shortcuts-available') {
-        if (bridgeRef.current?.sessionId === sessionId) dispatch({ type: 'shortcuts', scopeKey })
-        return
-      }
       if (parsed.data.type === 'reference-preference') {
         dispatch({ type: 'preference', enabled: parsed.data.enabled, scopeKey })
         if (!parsed.data.enabled && pending.current?.sessionId === sessionId) {
@@ -247,7 +240,6 @@ export function usePageContext(origins: string[], scopeKey: string) {
     setReferenceEnabled,
     captureForSend,
     connected: Boolean(state.connected),
-    shortcutsAvailable: Boolean(state.shortcutsAvailable),
     requestAction,
     snapshots: state.snapshots,
     captureError: state.error,
diff --git a/apps/sim/app/extension/o/[organizationId]/organization.tsx b/apps/sim/app/extension/o/[organizationId]/organization.tsx
index acaf54f0965..eaad05cbccc 100644
--- a/apps/sim/app/extension/o/[organizationId]/organization.tsx
+++ b/apps/sim/app/extension/o/[organizationId]/organization.tsx
@@ -10,7 +10,7 @@ import { ExtensionHeader } from '@/app/extension/[workspaceId]/header'
 import { extensionChatParam } from '@/app/extension/[workspaceId]/search-params'
 import { useExtensionComposer } from '@/app/extension/hooks/use-composer'
 import ExtensionLoading from '@/app/extension/loading'
-import { ExtensionSignIn } from '@/app/extension/sign-in'
+import { ExtensionSessionExpired } from '@/app/extension/providers'
 import { ExtensionUnavailable } from '@/app/extension/unavailable'
 import { OrganizationConversation } from '@/app/o/[organizationId]/components/organization-conversation'
 import { OrganizationProvider } from '@/app/o/[organizationId]/providers/organization-provider'
@@ -19,6 +19,7 @@ import type { ChatRequestMode } from '@/app/workspace/[workspaceId]/home/types'
 import { SettingsLoader } from '@/app/workspace/[workspaceId]/providers/settings-loader'
 import { useOrganizationMothershipChats } from '@/hooks/queries/mothership-chats'
 import { useOrganizationSummary } from '@/hooks/queries/organization'
+import { VoiceInputPermissionContext } from '@/hooks/use-voice-input'
 
 interface ExtensionOrganizationProps {
   context: OrganizationSurfaceContext
@@ -30,7 +31,7 @@ export function ExtensionOrganization({ context }: ExtensionOrganizationProps) {
   const denied = [access.error, history.error].find(
     (error) => isApiClientError(error) && [401, 403, 404].includes(error.status)
   )
-  if (isApiClientError(denied) && denied.status === 401) return <ExtensionSignIn />
+  if (isApiClientError(denied) && denied.status === 401) return <ExtensionSessionExpired />
   if (access.isPending) return <ExtensionLoading />
   if (denied || !access.data?.chatAccess)
     return (
@@ -162,35 +163,37 @@ function ExtensionOrganizationConversation({
       ? routes.search
       : routes.home
   return (
-    <OrganizationConversation
-      chatId={initialChatId}
-      requestMode={requestMode}
-      panelOptions={{
-        ...composer,
-        onSubmitted: () => {
-          onCommitMode()
-          composer.onSubmitted()
-        },
-        draftNamespace: 'extension',
-        onChatIdResolved,
-        onNavigateToChat: onSelectChat,
-        header: (
-          <>
-            <ExtensionHeader
-              scopeName={context.organization.name}
-              history={history}
-              chatId={selectedChatId}
-              onSelectChat={onSelectChat}
-              appHref={appHref}
-            />
-            {composer.captureError && (
-              <p role='alert' className='px-3 py-2 text-[var(--text-error)] text-caption'>
-                {composer.captureError}
-              </p>
-            )}
-          </>
-        ),
-      }}
-    />
+    <VoiceInputPermissionContext value={composer.openMicrophoneSettings}>
+      <OrganizationConversation
+        chatId={initialChatId}
+        requestMode={requestMode}
+        panelOptions={{
+          ...composer,
+          onSubmitted: () => {
+            onCommitMode()
+            composer.onSubmitted()
+          },
+          draftNamespace: 'extension',
+          onChatIdResolved,
+          onNavigateToChat: onSelectChat,
+          header: (
+            <>
+              <ExtensionHeader
+                scopeName={context.organization.name}
+                history={history}
+                chatId={selectedChatId}
+                onSelectChat={onSelectChat}
+                appHref={appHref}
+              />
+              {composer.captureError && (
+                <p role='alert' className='px-3 py-2 text-[var(--text-error)] text-caption'>
+                  {composer.captureError}
+                </p>
+              )}
+            </>
+          ),
+        }}
+      />
+    </VoiceInputPermissionContext>
   )
 }
diff --git a/apps/sim/app/extension/o/[organizationId]/page.tsx b/apps/sim/app/extension/o/[organizationId]/page.tsx
index 351e3818eaa..17de3827534 100644
--- a/apps/sim/app/extension/o/[organizationId]/page.tsx
+++ b/apps/sim/app/extension/o/[organizationId]/page.tsx
@@ -3,7 +3,7 @@ import { getSession } from '@/lib/auth'
 import { getOrganizationSurfaceContext } from '@/lib/organizations/surface'
 import ExtensionLoading from '@/app/extension/loading'
 import { ExtensionOrganization } from '@/app/extension/o/[organizationId]/organization'
-import { ExtensionSignIn } from '@/app/extension/sign-in'
+import { ExtensionSessionExpired } from '@/app/extension/providers'
 import { ExtensionUnavailable } from '@/app/extension/unavailable'
 
 interface ExtensionOrganizationPageProps {
@@ -15,7 +15,7 @@ export default async function ExtensionOrganizationPage({
 }: ExtensionOrganizationPageProps) {
   const { organizationId } = await params
   const session = await getSession()
-  if (!session?.user) return <ExtensionSignIn />
+  if (!session?.user) return <ExtensionSessionExpired />
   const context = await getOrganizationSurfaceContext(organizationId, session.user.id)
   if (
     !context ||
diff --git a/apps/sim/app/extension/providers.tsx b/apps/sim/app/extension/providers.tsx
index 50dee185626..18e4cf02865 100644
--- a/apps/sim/app/extension/providers.tsx
+++ b/apps/sim/app/extension/providers.tsx
@@ -1,6 +1,7 @@
 'use client'
 
-import { createContext, type ReactNode, useContext, useRef } from 'react'
+import { createContext, type ReactNode, useContext, useEffect, useRef } from 'react'
+import type { AppToExtensionMessage } from '@sim/browser-extension-protocol'
 import { SettingsNavigationProvider } from '@/components/settings/settings-navigation-provider'
 import { isApiClientError } from '@/lib/api/client/errors'
 import { useSession } from '@/lib/auth/client'
@@ -31,9 +32,20 @@ export function ExtensionProviders({
 }: ExtensionProvidersProps) {
   const focusComposer = useRef<ChatInputFocusHandle | null>(null)
   const { data: session, isPending, error } = useSession()
+  const signedIn = session?.user?.id === userId
+  useEffect(() => {
+    if (!signedIn) return
+    const message: AppToExtensionMessage = {
+      channel: 'sim-extension',
+      version: 1,
+      type: 'signed-in',
+    }
+    for (const origin of origins) window.parent.postMessage(message, origin)
+  }, [origins, signedIn])
   if (isPending) return <ExtensionLoading />
   const accessDenied = isApiClientError(error) && (error.status === 401 || error.status === 403)
-  if (accessDenied || !session?.user || session.user.id !== userId) return <ExtensionSignIn />
+  if (accessDenied || !session?.user || session.user.id !== userId)
+    return <ExtensionSignIn expectedUserId={userId} />
   return (
     <ExtensionIdentityContext.Provider value={{ origins, userId }}>
       <FeatureFlagsProvider
@@ -62,3 +74,8 @@ export function useExtensionIdentity(): ExtensionIdentity {
   if (!identity) throw new Error('Extension identity is unavailable')
   return identity
 }
+
+export function ExtensionSessionExpired() {
+  const { userId } = useExtensionIdentity()
+  return <ExtensionSignIn expectedUserId={userId} />
+}
diff --git a/apps/sim/app/extension/sign-in.tsx b/apps/sim/app/extension/sign-in.tsx
index 4f959f01405..74963d6697f 100644
--- a/apps/sim/app/extension/sign-in.tsx
+++ b/apps/sim/app/extension/sign-in.tsx
@@ -1,10 +1,12 @@
 'use client'
 
-import { useState } from 'react'
+import { useEffect, useState } from 'react'
 import { SIM_LINK_DRAFT_PATH } from '@sim/browser-extension-protocol'
 import { Chip, ChipLink } from '@sim/emcn'
-import { usePathname } from 'next/navigation'
+import { useQueryClient } from '@tanstack/react-query'
+import { usePathname, useRouter } from 'next/navigation'
 import { preserveLinkDraft } from '@/app/extension/create-link/destination'
+import { refreshSessionQuery } from '@/hooks/queries/session'
 import { useHydrated } from '@/hooks/use-hydrated'
 
 function LinkDraftSignIn() {
@@ -13,10 +15,10 @@ function LinkDraftSignIn() {
   const href = `/login?callbackUrl=${encodeURIComponent(SIM_LINK_DRAFT_PATH)}`
   return (
     <main className='flex h-dvh flex-col items-center justify-center gap-4 bg-[var(--bg)] p-6 text-center text-[var(--text-body)] text-small'>
-      <h1 className='text-lg'>Sign in to create a Sim Link</h1>
+      <h1 className='text-lg'>Sign in to create a link</h1>
       {needsSeparateTab ? (
         <>
-          <p>Sign in in another tab, then reload this draft.</p>
+          <p>Sign in, then return here and reload the draft.</p>
           <ChipLink href='/login' target='_blank' rel='noopener noreferrer'>
             Sign in
           </ChipLink>
@@ -38,15 +40,57 @@ function LinkDraftSignIn() {
   )
 }
 
-export function ExtensionSignIn() {
-  const pathname = usePathname()
-  if (pathname === SIM_LINK_DRAFT_PATH) return <LinkDraftSignIn />
+interface ExtensionSignInProps {
+  expectedUserId?: string
+}
+
+function PanelSignIn({ expectedUserId }: ExtensionSignInProps) {
+  const router = useRouter()
+  const queryClient = useQueryClient()
+  const [failed, setFailed] = useState(false)
+  useEffect(() => {
+    let active = true
+    let checking = false
+    let checkAgain = false
+    const resume = async (returning = false) => {
+      if (document.visibilityState === 'hidden') return
+      if (checking) {
+        checkAgain = true
+        return
+      }
+      checking = true
+      try {
+        const session = await refreshSessionQuery(queryClient)
+        if (active) {
+          setFailed(false)
+          if (session?.user) {
+            if (!expectedUserId) router.refresh()
+            else if (returning || session.user.id !== expectedUserId) window.location.reload()
+          }
+        }
+      } catch {
+        if (active) setFailed(true)
+      } finally {
+        checking = false
+        if (active && checkAgain) {
+          checkAgain = false
+          void resume(true)
+        }
+      }
+    }
+    const check = () => void resume(true)
+    window.addEventListener('focus', check)
+    document.addEventListener('visibilitychange', check)
+    void resume()
+    return () => {
+      active = false
+      window.removeEventListener('focus', check)
+      document.removeEventListener('visibilitychange', check)
+    }
+  }, [expectedUserId, queryClient, router])
   return (
     <main className='flex h-dvh flex-col items-center justify-center gap-4 bg-[var(--bg)] p-6 text-center text-[var(--text-body)] text-small'>
       <h1 className='text-lg'>Sign in to Sim</h1>
-      <p className='text-[var(--text-muted)] text-caption'>
-        Sign in in a browser tab, then reload this panel.
-      </p>
       <ChipLink
         href='/login?callbackUrl=%2Fextension'
         target='_blank'
@@ -55,7 +99,16 @@ export function ExtensionSignIn() {
       >
         Sign in
       </ChipLink>
-      <Chip onClick={() => window.location.reload()}>Reload panel</Chip>
+      <Chip onClick={() => window.location.reload()}>{failed ? 'Try again' : 'Refresh'}</Chip>
     </main>
   )
 }
+
+export function ExtensionSignIn({ expectedUserId }: ExtensionSignInProps) {
+  const pathname = usePathname()
+  return pathname === SIM_LINK_DRAFT_PATH ? (
+    <LinkDraftSignIn />
+  ) : (
+    <PanelSignIn expectedUserId={expectedUserId} />
+  )
+}
diff --git a/apps/sim/app/extension/workspaces.tsx b/apps/sim/app/extension/workspaces.tsx
index f7ccb05c4e0..e3ed7a67bf2 100644
--- a/apps/sim/app/extension/workspaces.tsx
+++ b/apps/sim/app/extension/workspaces.tsx
@@ -11,14 +11,14 @@ import {
 } from '@sim/emcn'
 import { isApiClientError } from '@/lib/api/client/errors'
 import ExtensionLoading from '@/app/extension/loading'
-import { ExtensionSignIn } from '@/app/extension/sign-in'
+import { ExtensionSessionExpired } from '@/app/extension/providers'
 import { useWorkspacesQuery } from '@/hooks/queries/workspace'
 
 export function ExtensionWorkspaces() {
   const [scrollElement, setScrollElement] = useState<HTMLElement | null>(null)
   const scrollEdges = useScrollEdges(scrollElement)
   const { data: workspaces, isPending, error, refetch } = useWorkspacesQuery()
-  if (isApiClientError(error) && error.status === 401) return <ExtensionSignIn />
+  if (isApiClientError(error) && error.status === 401) return <ExtensionSessionExpired />
   if (isPending) return <ExtensionLoading />
   const transientError =
     !isApiClientError(error) || error.status === 408 || error.status === 429 || error.status >= 500
diff --git a/apps/sim/app/llms-full.txt/route.ts b/apps/sim/app/llms-full.txt/route.ts
index eedce680267..f1ed68e438a 100644
--- a/apps/sim/app/llms-full.txt/route.ts
+++ b/apps/sim/app/llms-full.txt/route.ts
@@ -1,5 +1,5 @@
 import { CREDIT_TIERS } from '@/lib/billing/constants'
-import type { CompetitorProfile, Fact, Prose } from '@/lib/compare/data'
+import type { ComparisonQuestion, CompetitorProfile, Fact, Prose } from '@/lib/compare/data'
 import { simProfile } from '@/lib/compare/data'
 import { toSiteUrl } from '@/lib/core/utils/urls'
 import { getAllCustomerStoryMeta, getCustomerStorySource } from '@/lib/customers/registry'
@@ -13,6 +13,7 @@ import {
   ALL_COMPETITORS,
   buildBottomLine,
   getLatestVerifiedDate,
+  getQuestionSectionGroups,
   SIM_LATEST_VERIFIED,
 } from '@/app/(landing)/comparisons/utils'
 import { PLATFORM_MENU } from '@/app/(landing)/components/navbar/components/nav-menu-chip'
@@ -79,9 +80,14 @@ function isoDate(date: Date): string {
   return date.toISOString().slice(0, 10)
 }
 
+function questionMarkdown({ question, answer }: ComparisonQuestion): string {
+  return `**${question}**\n\n${proseToMarkdown(answer)}`
+}
+
 /** The key facts of one `/comparisons/{id}` page as markdown, from the same profile data. */
 function comparisonMarkdown(competitor: CompetitorProfile): string {
   const verdict = buildBottomLine(competitor)
+  const questions = getQuestionSectionGroups(competitor)
   const verified = new Date(
     Math.max(SIM_LATEST_VERIFIED.getTime(), getLatestVerifiedDate(competitor).getTime())
   )
@@ -98,8 +104,23 @@ function comparisonMarkdown(competitor: CompetitorProfile): string {
     `### Sim vs ${competitor.name}`,
     `URL: ${toSiteUrl(`/comparisons/${competitor.id}`)} · Facts last verified ${isoDate(verified)}`,
     `${competitor.name}: ${competitor.oneLiner}`,
-    competitor.leadAnswer ? proseToMarkdown(competitor.leadAnswer) : '',
-    competitor.betterThanAnswer ? proseToMarkdown(competitor.betterThanAnswer) : '',
+    questions.lead
+      ? questionMarkdown(questions.lead)
+      : competitor.leadAnswer
+        ? proseToMarkdown(competitor.leadAnswer)
+        : '',
+    ...questions.opening.map(questionMarkdown),
+    competitor.glance
+      ? [
+          `| Decision point | Sim | ${competitor.name} |`,
+          '| --- | --- | --- |',
+          ...competitor.glance.map(
+            (row) =>
+              `| ${row.label} | ${proseToMarkdown(row.sim)} | ${proseToMarkdown(row.competitor)} |`
+          ),
+        ].join('\n')
+      : '',
+    ...questions.glance.map(questionMarkdown),
     `- ${verdict.chooseSim}\n- ${verdict.chooseCompetitor}`,
     competitor.standoutFeatures.length > 0
       ? `Standout features of ${competitor.name}:\n\n${competitor.standoutFeatures.map((f) => `- ${f.title}: ${f.description}`).join('\n')}`
@@ -108,6 +129,7 @@ function comparisonMarkdown(competitor: CompetitorProfile): string {
       ? `Documented limitations of ${competitor.name}:\n\n${competitor.limitations.map((l) => `- ${l.title}: ${l.description}`).join('\n')}`
       : '',
     [`| Feature | Sim | ${competitor.name} |`, '| --- | --- | --- |', ...rows].join('\n'),
+    ...questions.closing.map(questionMarkdown),
   ]
     .filter(Boolean)
     .join('\n\n')
diff --git a/apps/sim/app/o/[organizationId]/components/organization-sidebar/navigation.ts b/apps/sim/app/o/[organizationId]/components/organization-sidebar/navigation.ts
index 68cf01d3b59..56826273d6f 100644
--- a/apps/sim/app/o/[organizationId]/components/organization-sidebar/navigation.ts
+++ b/apps/sim/app/o/[organizationId]/components/organization-sidebar/navigation.ts
@@ -20,7 +20,7 @@ const ORGANIZATION_NAV_ENTRIES: readonly OrganizationNavEntry[] = [
   { id: 'search', label: 'Search', icon: Search, route: 'search' },
   { id: 'people', label: 'People', icon: Users, route: 'people' },
   { id: 'integrations', label: 'Integrations', icon: Integration, route: 'integrations' },
-  { id: 'sim-links', label: 'Sim Links', icon: Link, route: 'simLinks' },
+  { id: 'sim-links', label: 'Links', icon: Link, route: 'simLinks' },
   { id: 'benchmark', label: 'Benchmark', icon: ChartColumn, route: 'benchmark' },
 ]
 
diff --git a/apps/sim/app/o/[organizationId]/links/browser-shortcuts-modal.tsx b/apps/sim/app/o/[organizationId]/links/browser-shortcuts-modal.tsx
deleted file mode 100644
index 59ccd7507ce..00000000000
--- a/apps/sim/app/o/[organizationId]/links/browser-shortcuts-modal.tsx
+++ /dev/null
@@ -1,73 +0,0 @@
-import {
-  ChipLink,
-  ChipModal,
-  ChipModalBody,
-  ChipModalDescription,
-  ChipModalFooter,
-  ChipModalHeader,
-} from '@sim/emcn'
-import { ManagedBookmarks } from '@/app/o/[organizationId]/links/managed-bookmarks'
-import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
-
-interface BrowserShortcutsModalProps {
-  onClose: () => void
-}
-
-export function BrowserShortcutsModal({ onClose }: BrowserShortcutsModalProps) {
-  const { viewer, organization } = useOrganizationContext()
-  return (
-    <ChipModal open onOpenChange={(open) => !open && onClose()} srTitle='Browser shortcuts'>
-      <ChipModalHeader onClose={onClose}>Browser shortcuts</ChipModalHeader>
-      <ChipModalBody>
-        <ChipModalDescription>
-          With Sim for Chrome installed, type <strong>sim</strong> in the address bar, press{' '}
-          <strong>Space</strong>, and start typing a link name. For suggestions outside this
-          shortcut,{' '}
-          <a
-            href='https://docs.sim.ai/search/sim-links#show-favorites-in-regular-chrome-suggestions'
-            target='_blank'
-            rel='noopener noreferrer'
-            className='underline underline-offset-2'
-          >
-            bookmark a favorite
-          </a>
-          .
-        </ChipModalDescription>
-        <ChipLink
-          href='http://sim/'
-          target='_blank'
-          rel='noopener noreferrer'
-          variant='primary'
-          className='self-start'
-        >
-          Enable sim/ shortcuts
-        </ChipLink>
-        <ChipModalDescription>
-          Still opening search results? In the Sim extension, open{' '}
-          <strong>+ → Browser shortcuts</strong> and enable your search provider.
-        </ChipModalDescription>
-        {viewer.isAdmin && (
-          <ManagedBookmarks key={organization.id} organizationId={organization.id} />
-        )}
-      </ChipModalBody>
-      <ChipModalFooter
-        secondaryActions={[
-          {
-            custom: (
-              <ChipLink
-                href='https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg'
-                target='_blank'
-                rel='noopener noreferrer'
-              >
-                Install Sim for Chrome
-              </ChipLink>
-            ),
-          },
-        ]}
-        defaultAction='dismiss'
-        cancelLabel='Done'
-        onCancel={onClose}
-      />
-    </ChipModal>
-  )
-}
diff --git a/apps/sim/app/o/[organizationId]/links/columns.ts b/apps/sim/app/o/[organizationId]/links/columns.ts
index d3e9db9c79e..f522b1d3a5d 100644
--- a/apps/sim/app/o/[organizationId]/links/columns.ts
+++ b/apps/sim/app/o/[organizationId]/links/columns.ts
@@ -11,7 +11,7 @@ export const SIM_LINK_COLUMNS = [
   { id: 'updated', header: 'Updated' },
 ] as const satisfies readonly ResourceColumn[]
 
-export const SIM_LINKS_SEARCH_PLACEHOLDER = 'Search Sim links...'
+export const SIM_LINKS_SEARCH_PLACEHOLDER = 'Search links...'
 
-export const BROWSER_SHORTCUTS_ACTION = { text: 'Browser shortcuts', icon: Globe } as const
+export const INSTALL_EXTENSION_ACTION = { text: 'Install Sim for Chrome', icon: Globe } as const
 export const NEW_SIM_LINK_ACTION = { text: 'New link', icon: Plus, variant: 'primary' } as const
diff --git a/apps/sim/app/o/[organizationId]/links/loading.tsx b/apps/sim/app/o/[organizationId]/links/loading.tsx
index 7e4b1438928..f955ff8dd99 100644
--- a/apps/sim/app/o/[organizationId]/links/loading.tsx
+++ b/apps/sim/app/o/[organizationId]/links/loading.tsx
@@ -3,7 +3,7 @@
 import { Link } from '@sim/emcn/icons'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import {
-  BROWSER_SHORTCUTS_ACTION,
+  INSTALL_EXTENSION_ACTION,
   NEW_SIM_LINK_ACTION,
   SIM_LINK_COLUMNS,
   SIM_LINKS_SEARCH_PLACEHOLDER,
@@ -16,9 +16,9 @@ export default function SimLinksLoading() {
     <div inert aria-busy className='contents'>
       <ResourceChromeFallback
         icon={Link}
-        title='Sim Links'
+        title='Links'
         columns={SIM_LINK_COLUMNS}
-        actions={hosted ? [BROWSER_SHORTCUTS_ACTION, NEW_SIM_LINK_ACTION] : [NEW_SIM_LINK_ACTION]}
+        actions={hosted ? [INSTALL_EXTENSION_ACTION, NEW_SIM_LINK_ACTION] : [NEW_SIM_LINK_ACTION]}
         searchPlaceholder={SIM_LINKS_SEARCH_PLACEHOLDER}
         hasSort
       />
diff --git a/apps/sim/app/o/[organizationId]/links/managed-bookmarks.tsx b/apps/sim/app/o/[organizationId]/links/managed-bookmarks.tsx
deleted file mode 100644
index 946b50f4971..00000000000
--- a/apps/sim/app/o/[organizationId]/links/managed-bookmarks.tsx
+++ /dev/null
@@ -1,108 +0,0 @@
-import { useState } from 'react'
-import { Chip, ChipCombobox, ChipModalField } from '@sim/emcn'
-import type { BookmarkLink } from '@/lib/api/contracts/sim-links'
-import { organizationRoutes } from '@/lib/navigation/paths'
-import { MAX_MANAGED_BOOKMARKS } from '@/lib/sim-links/validation'
-import { saveBlob } from '@/lib/uploads/client/download'
-import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
-import { useExportSimBookmarks, useSimLinks } from '@/hooks/queries/sim-links'
-import { useSearchFilterValue } from '@/hooks/use-search-filter-value'
-
-interface ManagedBookmarksProps {
-  organizationId: string
-}
-
-export function ManagedBookmarks({ organizationId }: ManagedBookmarksProps) {
-  const [search, setSearch] = useState('')
-  const [selected, setSelected] = useState<BookmarkLink[]>([])
-  const [notice, setNotice] = useState('')
-  const exporting = useExportSimBookmarks(organizationId)
-  const query = useSearchFilterValue(search, SEARCH_DEBOUNCE_MS)
-  const links = useSimLinks(organizationId, query, 'name', 'asc')
-  const listed = links.isPlaceholderData
-    ? []
-    : (links.data?.pages.flatMap((page) => page.links.filter((link) => !link.unlisted)) ?? [])
-  const selectedIds = new Set(selected.map((link) => link.id))
-  const candidates = new Map([...selected, ...listed].map((link) => [link.id, link]))
-  const visible = new Set(listed.map((link) => link.id))
-  const options = [...candidates.values()].map((link) => ({
-    value: link.id,
-    label: `sim/${link.name}`,
-    hidden: !visible.has(link.id),
-    disabled: selected.length >= MAX_MANAGED_BOOKMARKS && !selectedIds.has(link.id),
-  }))
-  function choose(ids: string[]) {
-    setNotice('')
-    exporting.reset()
-    setSelected(
-      ids.flatMap((id) => {
-        const link = candidates.get(id)
-        return link ? [{ id: link.id, name: link.name }] : []
-      })
-    )
-  }
-  function download() {
-    exporting.mutate(selected, {
-      onSuccess: ({ links: current }) => {
-        if (current.length !== selected.length) {
-          setSelected(current)
-          setNotice(
-            'Some links changed or are no longer listed. Review your selection before exporting.'
-          )
-          return
-        }
-        const routes = organizationRoutes(organizationId)
-        const children = current.map(({ name }) => ({
-          name: `sim/${name}`,
-          url: new URL(routes.openSimLink(name), window.location.origin).href,
-        }))
-        saveBlob(
-          new Blob([JSON.stringify([{ name: 'Sim Links', children }], null, 2)], {
-            type: 'application/json',
-          }),
-          'sim-managed-bookmarks.json'
-        )
-      },
-    })
-  }
-  return (
-    <ChipModalField
-      type='custom'
-      title='Team bookmarks'
-      hint='Choose links to include in your Chrome managed bookmarks policy.'
-    >
-      {(aria) => (
-        <div className='flex flex-col items-start gap-2'>
-          <ChipCombobox
-            {...aria}
-            options={options}
-            className='w-full'
-            multiSelect
-            searchable
-            searchMode='server'
-            multiSelectValues={[...selectedIds]}
-            disabled={exporting.isPending}
-            onMultiSelectChange={choose}
-            onSearchChange={setSearch}
-            placeholder='Choose links'
-            searchPlaceholder='Search links'
-            isLoading={links.isFetching && !links.isFetchingNextPage}
-            hasMore={links.hasNextPage}
-            onLoadMore={() => void links.fetchNextPage()}
-            isLoadingMore={links.isFetchingNextPage}
-            error={links.isError ? 'Could not load Sim Links.' : undefined}
-            emptyMessage='No listed links found'
-          />
-          <Chip onClick={download} disabled={!selected.length || exporting.isPending}>
-            Export bookmarks
-          </Chip>
-          {(notice || exporting.isError) && (
-            <span role='status' className='text-[var(--text-muted)] text-small'>
-              {exporting.isError ? 'Could not export these bookmarks. Try again.' : notice}
-            </span>
-          )}
-        </div>
-      )}
-    </ChipModalField>
-  )
-}
diff --git a/apps/sim/app/o/[organizationId]/links/page.tsx b/apps/sim/app/o/[organizationId]/links/page.tsx
index 4f4712dea23..21e80786b66 100644
--- a/apps/sim/app/o/[organizationId]/links/page.tsx
+++ b/apps/sim/app/o/[organizationId]/links/page.tsx
@@ -6,7 +6,7 @@ import { isSimLinksEnabled } from '@/lib/sim-links/feature-flag'
 import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
 import { SimLinks } from '@/app/o/[organizationId]/links/sim-links'
 
-export const metadata: Metadata = { title: 'Sim Links' }
+export const metadata: Metadata = { title: 'Links' }
 
 interface SimLinksPageProps {
   params: Promise<{ organizationId: string }>
diff --git a/apps/sim/app/o/[organizationId]/links/search-params.ts b/apps/sim/app/o/[organizationId]/links/search-params.ts
index 17b39723673..1fb8368f3e0 100644
--- a/apps/sim/app/o/[organizationId]/links/search-params.ts
+++ b/apps/sim/app/o/[organizationId]/links/search-params.ts
@@ -1,18 +1,21 @@
-import { createSerializer, parseAsString } from 'nuqs/server'
-import { SIM_LINK_SORTS } from '@/lib/sim-links/validation'
+import { truncateAtCodePoint } from '@sim/utils/string'
+import { createParser, createSerializer, parseAsString } from 'nuqs/server'
+import { SIM_LINK_SEARCH_MAX_LENGTH, SIM_LINK_SORTS } from '@/lib/sim-links/validation'
 import { createSortParams } from '@/lib/url-state'
 
-/** `create` opens the new-link editor, prefilled with its value as the name. */
-const simLinkViewParsers = { create: parseAsString } as const
+const boundedSearch = (value: string) => truncateAtCodePoint(value, SIM_LINK_SEARCH_MAX_LENGTH, '')
 
-export const serializeSimLinkView = createSerializer(simLinkViewParsers)
-
-/** `search` filters by name, destination, or description. */
+/**
+ * `create` opens the new-link editor, prefilled with its value as the name. `search` filters by
+ * name, destination, or description.
+ */
 export const simLinksParsers = {
-  ...simLinkViewParsers,
-  search: parseAsString.withDefault(''),
+  create: parseAsString,
+  search: createParser({ parse: boundedSearch, serialize: boundedSearch }).withDefault(''),
 } as const
 
+export const serializeSimLinkView = createSerializer(simLinksParsers)
+
 /** Shared `sort` + `dir` params for the Sim Links list. */
 export const simLinksSortParams = createSortParams(SIM_LINK_SORTS, {
   column: 'name',
diff --git a/apps/sim/app/o/[organizationId]/links/sim-link-modal.tsx b/apps/sim/app/o/[organizationId]/links/sim-link-modal.tsx
index 7e758732525..eee1870a3e5 100644
--- a/apps/sim/app/o/[organizationId]/links/sim-link-modal.tsx
+++ b/apps/sim/app/o/[organizationId]/links/sim-link-modal.tsx
@@ -100,7 +100,7 @@ export function SimLinkModal({
     else create.mutate(parsed.data, { onSuccess: onSaved ?? onClose })
   }
 
-  const title = link ? `Edit sim/${link.name}` : 'New Sim link'
+  const title = link ? `Edit ${link.name}` : 'New link'
   const [actionLabel, pendingLabel] = link ? ['Save', 'Saving'] : ['Create', 'Creating']
 
   return (
@@ -178,7 +178,7 @@ export function SimLinkModal({
                   onCheckedChange={(checked) => change('unlisted', checked === true)}
                 />
                 <span className='text-[var(--text-primary)] text-small'>
-                  Hide from the Sim Links page
+                  Hide from the Links page
                 </span>
               </label>
               <label htmlFor={restrictEditId} className='flex cursor-pointer items-center gap-2'>
diff --git a/apps/sim/app/o/[organizationId]/links/sim-link-shortcut.tsx b/apps/sim/app/o/[organizationId]/links/sim-link-shortcut.tsx
index 8f38068cc27..e47e9588ec4 100644
--- a/apps/sim/app/o/[organizationId]/links/sim-link-shortcut.tsx
+++ b/apps/sim/app/o/[organizationId]/links/sim-link-shortcut.tsx
@@ -47,7 +47,7 @@ function useExistingSimLink(organizationId: string, url: string) {
   const copyExisting = async () => {
     if (!existing) return false
     const done = await copy(simLinkUrl(window.location.origin, existing.name))
-    if (!done) toast.error('Unable to copy Sim link')
+    if (!done) toast.error('Unable to copy link')
     return done
   }
   return { existing, isPending, isError, copied, copyExisting }
@@ -82,7 +82,7 @@ export function SimLinkMenuItem({ organizationId, url, onCreate }: SimLinkShortc
   return (
     <DropdownMenuItem disabled={isPending} onSelect={onCreate}>
       <Plus className='size-[14px]' />
-      Create Sim link
+      Create link
     </DropdownMenuItem>
   )
 }
@@ -102,7 +102,7 @@ function ShortcutChip({ organizationId, url, onCreate }: SimLinkShortcutProps) {
   }
   return (
     <Chip leftIcon={Plus} disabled={isPending} onClick={onCreate}>
-      Create Sim link
+      Create link
     </Chip>
   )
 }
diff --git a/apps/sim/app/o/[organizationId]/links/sim-links.tsx b/apps/sim/app/o/[organizationId]/links/sim-links.tsx
index 5487c19193e..d966744ebb8 100644
--- a/apps/sim/app/o/[organizationId]/links/sim-links.tsx
+++ b/apps/sim/app/o/[organizationId]/links/sim-links.tsx
@@ -1,18 +1,17 @@
 'use client'
 
 import { type MouseEvent, useCallback, useMemo, useState } from 'react'
-import { Avatar, ChipConfirmModal, ChipModalError, writeTextToClipboard } from '@sim/emcn'
+import { Avatar, ChipConfirmModal, ChipModalError, toast, writeTextToClipboard } from '@sim/emcn'
 import { Link } from '@sim/emcn/icons'
 import { createLogger } from '@sim/logger'
 import { useQueryStates } from 'nuqs'
 import type { SimLink } from '@/lib/api/contracts/sim-links'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { simLinkPath, simLinkUrl } from '@/lib/navigation/paths'
-import { toSimLinkName } from '@/lib/sim-links/validation'
+import { SIM_LINK_SEARCH_MAX_LENGTH, toSimLinkName } from '@/lib/sim-links/validation'
 import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
-import { BrowserShortcutsModal } from '@/app/o/[organizationId]/links/browser-shortcuts-modal'
 import {
-  BROWSER_SHORTCUTS_ACTION,
+  INSTALL_EXTENSION_ACTION,
   NEW_SIM_LINK_ACTION,
   SIM_LINK_COLUMNS,
   SIM_LINKS_SEARCH_PLACEHOLDER,
@@ -42,12 +41,14 @@ import {
 import { useDeleteSimLink, useSimLinks } from '@/hooks/queries/sim-links'
 import { useContextMenu } from '@/hooks/use-context-menu'
 import { useDebouncedSearchSetter } from '@/hooks/use-debounced-search-setter'
-import { useHydrated } from '@/hooks/use-hydrated'
 import { useSearchFilterValue } from '@/hooks/use-search-filter-value'
 import { useUrlSort } from '@/hooks/use-url-sort'
 
 const logger = createLogger('SimLinks')
 
+const SIM_FOR_CHROME_URL =
+  'https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg'
+
 const SORT_OPTIONS = [
   { id: 'name', label: 'Name' },
   { id: 'popular', label: 'Opens' },
@@ -66,8 +67,10 @@ function openLink(name: string) {
 async function copyLink(name: string) {
   try {
     await writeTextToClipboard(simLinkUrl(window.location.origin, name))
+    toast.success('Link copied')
   } catch (error) {
     logger.error('Failed to copy Sim link', { error })
+    toast.error('Unable to copy link')
   }
 }
 
@@ -78,8 +81,6 @@ interface SimLinksProps {
 /** Every Sim link the viewer may browse, in the shared resource table. */
 export function SimLinks({ organizationId }: SimLinksProps) {
   const { hosted } = useDeploymentShape()
-  const hydrated = useHydrated()
-  const [showBrowserShortcuts, setShowBrowserShortcuts] = useState(false)
   const [{ search, create }, setView] = useQueryStates(simLinksParsers, simLinksUrlKeys)
   const setSearch = useDebouncedSearchSetter((value, options) =>
     setView({ search: value }, options)
@@ -106,7 +107,7 @@ export function SimLinks({ organizationId }: SimLinksProps) {
       loaded.map((link) => ({
         id: link.id,
         cells: {
-          name: { icon: <SimLinkIcon url={link.url} />, label: `sim/${link.name}` },
+          name: { icon: <SimLinkIcon url={link.url} />, label: link.name },
           destination: { label: link.url },
           description: { label: link.description },
           owner: link.createdBy
@@ -131,6 +132,7 @@ export function SimLinks({ organizationId }: SimLinksProps) {
 
   const searchConfig: SearchConfig = {
     value: search,
+    maxLength: SIM_LINK_SEARCH_MAX_LENGTH,
     onChange: setSearch,
     onClearAll: () => setSearch(''),
     placeholder: SIM_LINKS_SEARCH_PLACEHOLDER,
@@ -163,14 +165,13 @@ export function SimLinks({ organizationId }: SimLinksProps) {
     <Resource>
       <Resource.Header
         icon={Link}
-        title='Sim Links'
+        title='Links'
         actions={[
           ...(hosted
             ? [
                 {
-                  ...BROWSER_SHORTCUTS_ACTION,
-                  disabled: !hydrated,
-                  onSelect: () => setShowBrowserShortcuts(true),
+                  ...INSTALL_EXTENSION_ACTION,
+                  onSelect: () => window.open(SIM_FOR_CHROME_URL, '_blank', 'noopener,noreferrer'),
                 },
               ]
             : []),
@@ -197,7 +198,7 @@ export function SimLinks({ organizationId }: SimLinksProps) {
             <ResourceNoResults
               search={query}
               filterCount={0}
-              searchScope='Searched every Sim link you can see.'
+              searchScope='Searched every link you can see.'
               onClear={() => setSearch('')}
             />
           ) : (
@@ -205,9 +206,6 @@ export function SimLinks({ organizationId }: SimLinksProps) {
           ))
         }
       />
-      {hosted && showBrowserShortcuts && (
-        <BrowserShortcutsModal onClose={() => setShowBrowserShortcuts(false)} />
-      )}
       {menuLink && (
         <SimLinkContextMenu
           isOpen={contextMenu.isOpen}
@@ -247,8 +245,8 @@ export function SimLinks({ organizationId }: SimLinksProps) {
         onOpenChange={(open) => {
           if (!open && !remove.isPending) setDeleting(null)
         }}
-        title='Delete Sim link'
-        text={`sim/${deleting?.name ?? ''} will stop working for everyone in your organization.`}
+        title='Delete link'
+        text={`${deleting?.name ?? 'This link'} will stop working for everyone in your organization.`}
         confirm={{
           label: 'Delete',
           pendingLabel: 'Deleting',
diff --git a/apps/sim/app/sim-links/[organizationId]/[name]/page.tsx b/apps/sim/app/sim-links/[organizationId]/[name]/page.tsx
deleted file mode 100644
index b1721f0b126..00000000000
--- a/apps/sim/app/sim-links/[organizationId]/[name]/page.tsx
+++ /dev/null
@@ -1,51 +0,0 @@
-import { ChipLink, StatusPageContent } from '@sim/emcn'
-import { notFound, redirect } from 'next/navigation'
-import { getSession } from '@/lib/auth'
-import { organizationRoutes } from '@/lib/navigation/paths'
-import { resolveSimLinkOrganization } from '@/lib/sim-links/application/organization'
-import { resolveSimLink } from '@/lib/sim-links/application/use-cases'
-import { simLinkNameSchema } from '@/lib/sim-links/validation'
-import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
-
-interface OrganizationLinkPageProps {
-  params: Promise<{ organizationId: string; name: string }>
-}
-
-/** Bookmarks stay in their exporting organization even after the browser's active team changes. */
-export default async function OrganizationLinkPage({ params }: OrganizationLinkPageProps) {
-  const { organizationId, name: encodedName } = await params
-  const name = decodeURIComponent(encodedName)
-  if (!simLinkNameSchema.safeParse(name).success) notFound()
-  const routes = organizationRoutes(organizationId)
-  const session = await getSession()
-  if (!session?.user)
-    redirect(
-      buildAuthCrossLink('/login', {
-        callbackUrl: routes.openSimLink(name),
-        isInviteFlow: false,
-      })
-    )
-  const principal = {
-    kind: 'session',
-    userId: session.user.id,
-    sessionId: session.session.id,
-  } as const
-  if ((await resolveSimLinkOrganization(principal)) !== organizationId) notFound()
-  const result = await resolveSimLink.execute({
-    principal,
-    input: { organizationId, name, values: [], query: '' },
-  })
-  if (result.kind === 'redirect') redirect(result.url)
-  return (
-    <StatusPageContent
-      title={`sim/${name}`}
-      description={
-        result.kind === 'missing_values'
-          ? 'This link needs a value. Open it from Sim Links.'
-          : 'This link is unavailable.'
-      }
-    >
-      <ChipLink href={routes.simLinks}>Open Sim Links</ChipLink>
-    </StatusPageContent>
-  )
-}
diff --git a/apps/sim/app/sim-links/recover/route.ts b/apps/sim/app/sim-links/recover/route.ts
deleted file mode 100644
index 6e9dec34535..00000000000
--- a/apps/sim/app/sim-links/recover/route.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-import { SIM_LINK_NAME_MAX_LENGTH } from '@sim/browser-extension-protocol'
-import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-
-const MAX_VALUES = 8
-const MAX_VALUE_LENGTH = 256
-const MAX_DECODED_LENGTH = 5 + SIM_LINK_NAME_MAX_LENGTH + MAX_VALUES * (MAX_VALUE_LENGTH + 1)
-const SHORTCUT_SEGMENT = /^[A-Za-z0-9.:@&~_-]+$/
-const RESPONSE_HEADERS = {
-  'Cache-Control': 'no-store',
-  'Referrer-Policy': 'no-referrer',
-} as const
-
-/**
- * Next normalizes query spelling; the handoff still accepts only one q value. Rejecting other
- * parameters and surviving percent escapes prevents ambiguous or repeatedly decoded shortcuts.
- */
-function recoverSimLinkPath(search: string): string | null {
-  if (
-    !search.startsWith('?q=') ||
-    search.length > 3 + MAX_DECODED_LENGTH * 3 ||
-    search.includes('&')
-  ) {
-    return null
-  }
-
-  let shortcut: string
-  try {
-    shortcut = decodeURIComponent(search.slice(3))
-  } catch {
-    return null
-  }
-  if (shortcut.length > MAX_DECODED_LENGTH || !/^sim\//i.test(shortcut)) return null
-
-  const segments = shortcut.slice(4).replace(/\/$/, '').split('/')
-  const [name] = segments
-  if (
-    !name ||
-    name.length > SIM_LINK_NAME_MAX_LENGTH ||
-    !/[A-Za-z0-9]/.test(name) ||
-    segments.length > MAX_VALUES + 1 ||
-    segments.some(
-      (segment) =>
-        !SHORTCUT_SEGMENT.test(segment) ||
-        segment === '.' ||
-        segment === '..' ||
-        segment.length > MAX_VALUE_LENGTH
-    )
-  ) {
-    return null
-  }
-  return `/sim/${segments.map(encodeURIComponent).join('/')}`
-}
-
-/**
- * Search recovery navigation: no page is rendered and the canonical Sim link route owns
- * sign-in, current organization membership, feature availability, and destination resolution.
- */
-export const GET = withRouteHandler((request) => {
-  const destination = recoverSimLinkPath(request.nextUrl.search)
-  if (!destination) {
-    return new Response('Invalid Sim shortcut.', { status: 400, headers: RESPONSE_HEADERS })
-  }
-  return new Response(null, {
-    status: 307,
-    headers: { ...RESPONSE_HEADERS, Location: destination },
-  })
-})
diff --git a/apps/sim/app/sim/[[...path]]/page.tsx b/apps/sim/app/sim/[[...path]]/page.tsx
index 59da34a8eb6..698a4ffee5d 100644
--- a/apps/sim/app/sim/[[...path]]/page.tsx
+++ b/apps/sim/app/sim/[[...path]]/page.tsx
@@ -1,17 +1,21 @@
 import { ChipLink, StatusPageContent } from '@sim/emcn'
 import type { Metadata } from 'next'
-import { notFound, redirect } from 'next/navigation'
+import { redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth'
-import { organizationRoutes, simLinkPath } from '@/lib/navigation/paths'
+import { APP_ENTRY_PATH, organizationRoutes, simLinkPath } from '@/lib/navigation/paths'
 import { resolveSimLinkOrganization } from '@/lib/sim-links/application/organization'
-import { resolveSimLink, type SimLinkResolution } from '@/lib/sim-links/application/use-cases'
+import {
+  resolveSimLink,
+  type SimLinkResolution,
+  suggestSimLinks,
+} from '@/lib/sim-links/application/use-cases'
 import { parseTypedSimLink, simLinkNameSchema } from '@/lib/sim-links/validation'
 import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
 import { LogoShell } from '@/app/(landing)/components/logo-shell'
 import { serializeSimLinkView } from '@/app/o/[organizationId]/links/search-params'
 
 export const metadata: Metadata = {
-  title: 'Sim link',
+  title: 'Link',
   robots: { index: false, follow: false },
 }
 
@@ -53,8 +57,8 @@ function describeUnresolved(result: SimLinkResolution, validName: boolean, name:
     const needed = result.required === 1 ? 'a value' : `${result.required} values`
     return `This link needs ${needed}, like sim/${name}/${example}.`
   }
-  if (result.kind === 'invalid_values') return "Sim links can't open . or .. as a value."
-  return validName ? "This Sim link doesn't exist yet." : "That isn't a valid Sim link name."
+  if (result.kind === 'invalid_values') return "Links can't open . or .. as a value."
+  return validName ? "This link doesn't exist yet." : "That isn't a valid link name."
 }
 
 /**
@@ -78,7 +82,15 @@ export default async function SimLinkPage({ params, searchParams }: SimLinkPageP
     sessionId: session.session.id,
   } as const
   const organizationId = await resolveSimLinkOrganization(principal)
-  if (!organizationId) notFound()
+  if (!organizationId) {
+    return (
+      <LogoShell center theme='inherit'>
+        <StatusPageContent title='Links' description="Links aren't available for your account.">
+          <ChipLink href={APP_ENTRY_PATH}>Open Sim</ChipLink>
+        </StatusPageContent>
+      </LogoShell>
+    )
+  }
   const library = organizationRoutes(organizationId).simLinks
   const { name, values } = parseTypedSimLink(segments)
   if (!name) redirect(library)
@@ -90,19 +102,35 @@ export default async function SimLinkPage({ params, searchParams }: SimLinkPageP
   if (result.kind === 'redirect') redirect(result.url)
 
   const validName = simLinkNameSchema.safeParse(name).success
+  // A name can't hold a space, so `sim card prices` is someone looking for a link, not naming one.
+  if (result.kind === 'not_found' && /\s/.test(name)) {
+    redirect(serializeSimLinkView(library, { search: name }))
+  }
   const creatable = result.kind === 'not_found' && validName
+  const similar = creatable
+    ? await suggestSimLinks
+        .execute({ principal, input: { query: name } })
+        .then(({ links }) => links.slice(0, 3))
+        // Similar names are a courtesy: failing to find them must not take down this page.
+        .catch(() => [])
+    : []
   return (
     <LogoShell center theme='inherit'>
       <StatusPageContent
-        title={validName ? `sim/${name}` : 'Sim link'}
+        title={validName ? name : 'Link'}
         description={describeUnresolved(result, validName, name)}
       >
         {creatable && (
           <ChipLink variant='primary' href={serializeSimLinkView(library, { create: name })}>
-            Create sim/{name}
+            Create link
           </ChipLink>
         )}
-        <ChipLink href={library}>All Sim links</ChipLink>
+        {similar.map((link) => (
+          <ChipLink key={link.name} href={simLinkPath(link.name)}>
+            {link.name}
+          </ChipLink>
+        ))}
+        <ChipLink href={library}>All links</ChipLink>
       </StatusPageContent>
     </LogoShell>
   )
diff --git a/apps/sim/app/workspace/[workspaceId]/components/resource/components/resource-empty-state/sim-links-empty-state.tsx b/apps/sim/app/workspace/[workspaceId]/components/resource/components/resource-empty-state/sim-links-empty-state.tsx
index ccb58ef93b4..b0f2bcfbc48 100644
--- a/apps/sim/app/workspace/[workspaceId]/components/resource/components/resource-empty-state/sim-links-empty-state.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/components/resource/components/resource-empty-state/sim-links-empty-state.tsx
@@ -115,8 +115,8 @@ export function SimLinksEmptyState({ onCreate }: SimLinksEmptyStateProps) {
   return (
     <EmptyState
       graphic={<SimLinksGraphic />}
-      title='Sim Links'
-      description='Create links like sim/handbook for the pages your team opens most.'
+      title='Links'
+      description='Create short links like handbook for the pages your team opens most.'
       action={
         <Chip variant='primary' onClick={onCreate}>
           New link
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx
index c95228c963c..e2125fc0f5e 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx
@@ -1,12 +1,13 @@
 'use client'
 
 import { useEffect, useMemo, useState } from 'react'
-import { Chip } from '@sim/emcn'
+import { Chip, ChipLink } from '@sim/emcn'
 import { useQueryStates } from 'nuqs'
 import { ActivityStatus } from '@/components/ui/activity-status'
 import type { WorkspaceSearchFilters } from '@/lib/api/contracts/knowledge'
 import { useSession } from '@/lib/auth/client'
 import { type ResourceScope, resourceScopeKey } from '@/lib/core/resource-scope'
+import { organizationRoutes } from '@/lib/navigation/paths'
 import { SearchFilters } from '@/app/workspace/[workspaceId]/home/components/knowledge-search-results/search-filters'
 import {
   groupResultsByDocument,
@@ -150,6 +151,23 @@ function LiveSearchResults({
             Search found no results.
           </p>
         )}
+      {!isFetching && data?.live && accounts.length === 0 && (
+        <div className='flex items-center gap-2 px-2 py-2'>
+          <p role='status' className='text-[var(--text-muted)] text-caption'>
+            No connected apps are available for this search.
+          </p>
+          <ChipLink
+            variant='border'
+            href={
+              scope.kind === 'organization'
+                ? organizationRoutes(scope.organizationId).integrations
+                : `/workspace/${scope.workspaceId}/integrations`
+            }
+          >
+            Connect apps
+          </ChipLink>
+        </div>
+      )}
       {accounts.some((account) =>
         ['unavailable', 'timeout', 'rate_limited', 'reconnect'].includes(account.status)
       ) && (
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/message-sources/message-sources.test.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/message-sources/message-sources.test.tsx
index ef15254ff19..bec91fe068f 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/message-sources/message-sources.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/message-sources/message-sources.test.tsx
@@ -58,15 +58,15 @@ describe('creating a Sim link from the sources popover', () => {
     act(() => press(document.querySelector(`[aria-label="Actions for ${source.title}"]`)))
     await settle()
     const create = [...document.querySelectorAll('[role="menuitem"]')].find(
-      (item) => item.textContent === 'Create Sim link'
+      (item) => item.textContent === 'Create link'
     )
-    if (!(create instanceof HTMLElement)) throw new Error('Expected a Create Sim link item')
+    if (!(create instanceof HTMLElement)) throw new Error('Expected a Create link item')
     expect(create.getAttribute('aria-disabled')).not.toBe('true')
     act(() => create.click())
     await settle()
 
     const form = [...document.querySelectorAll('[role="dialog"]')].find((dialog) =>
-      dialog.textContent?.includes('New Sim link')
+      dialog.textContent?.includes('New link')
     )
     expect(form).toBeDefined()
     expect(document.querySelector<HTMLInputElement>('input[type="url"]')?.value).toBe(source.url)
diff --git a/apps/sim/content/library/airtable-ai-agent-data-entry-reporting/index.mdx b/apps/sim/content/library/airtable-ai-agent-data-entry-reporting/index.mdx
new file mode 100644
index 00000000000..3607f966259
--- /dev/null
+++ b/apps/sim/content/library/airtable-ai-agent-data-entry-reporting/index.mdx
@@ -0,0 +1,245 @@
+---
+slug: airtable-ai-agent-data-entry-reporting
+title: 'How Do You Build an Airtable AI Agent for Data Entry and Reporting?'
+description: 'Learn how to build an Airtable AI agent for structured data entry, controlled record updates, human approval, and scheduled reporting.'
+seoTitle: 'Build an Airtable AI Agent for Data Entry'
+date: 2026-11-04
+updated: 2026-11-04
+authors:
+  - andrew
+readingTime: 9
+tags: [AI Agents, Airtable, Data Entry, Reporting, Sim]
+ogImage: /library/airtable-ai-agent-data-entry-reporting/cover.jpg
+draft: false
+faq:
+  - q: "Which AI agent builder works best with Airtable?"
+    a: "Sim fits Airtable workflows that need AI enrichment, structured outputs, record updates, human approval, and scheduled reporting in one visual workflow."
+  - q: "Can AI automate data entry in Airtable?"
+    a: "Sim can automate Airtable data entry by reading incoming records, classifying or enriching their contents, validating structured outputs, and updating assigned fields."
+  - q: "Can an AI agent update existing Airtable records?"
+    a: "Sim can update an existing Airtable record when the workflow preserves the record ID and maps the generated values to specific Airtable fields."
+  - q: "How do you trigger an AI agent when Airtable gets a new record?"
+    a: "Sim can receive a new Airtable record through its Airtable trigger, after which the workflow can retrieve, enrich, review, and update the record."
+  - q: "How do you prevent duplicate records in an Airtable AI workflow?"
+    a: "Sim can prevent duplicates by retaining the original Airtable record ID, using an update action, and checking a processed version or run identifier before writing."
+  - q: "Can an Airtable AI agent require human approval?"
+    a: "Sim can require human approval by pausing with Human in the Loop, collecting the approval field, and using a downstream Condition to decide whether the Airtable update may proceed."
+  - q: "Can an AI agent create weekly reports from Airtable?"
+    a: "Sim can create weekly Airtable reports by reading records on a schedule, calculating reliable metrics, and using a model to summarize changes, exceptions, and recommended actions."
+  - q: "Should an AI agent calculate totals in an Airtable report?"
+    a: "Sim should use deterministic workflow logic or Airtable calculations for exact totals and use the model to explain those verified numbers in natural language."
+  - q: "Is Sim better than Zapier for Airtable AI automation?"
+    a: "Sim fits Airtable automation that requires agent reasoning, structured model outputs, human review, and multistep reporting, while Zapier fits basic trigger and action workflows."
+  - q: "Is Sim better than Make for Airtable AI automation?"
+    a: "Sim fits workflows centered on AI reasoning and controlled agent behavior, while Make fits detailed mapping and routing across applications."
+  - q: "Is Sim better than n8n for Airtable AI automation?"
+    a: "Sim fits teams seeking an AI-centered visual workspace, while n8n fits technical teams prioritizing self-hosting and broad general automation."
+  - q: "Is n8n open source?"
+    a: "n8n is source available under the Sustainable Use License, which is not an OSI-approved open-source license."
+  - q: "Is Sim open source?"
+    a: "Sim's core is open source under the Apache License 2.0, while code in apps/sim/ee is covered by the separate Sim Enterprise License."
+  - q: "Is Sim free?"
+    a: "Sim's core can be self-hosted under Apache 2.0. Code in apps/sim/ee is free for development, testing, and internal non-production use, while production use requires an active Sim Enterprise subscription."
+  - q: "What is the best open source Zapier alternative for Airtable AI agents?"
+    a: "Sim fits teams seeking an open-source Zapier alternative for Airtable AI agents because Sim's core uses the Apache License 2.0 and its visual builder supports model reasoning, tool calls, conditions, and controlled record updates."
+  - q: "What is the best n8n alternative for Airtable AI agents?"
+    a: "Sim fits teams seeking an n8n alternative focused on visual agent building, structured outputs, approval controls, and an Apache 2.0 core."
+  - q: "Sim vs Gumloop: which is better for Airtable automation?"
+    a: "Sim fits teams that want an open-source core, self-hosting, model flexibility, and explicit control over Airtable update and approval logic."
+  - q: "What Airtable fields should an AI agent update?"
+    a: "An Airtable AI agent should update only explicitly assigned fields such as category, summary, confidence, and suggested owner while leaving source data and human approval fields protected."
+  - q: "When should you not use AI for Airtable data entry?"
+    a: "Airtable should not use AI when a formula, lookup, validation rule, or fixed mapping can produce the correct result deterministically."
+  - q: "How do you test an Airtable AI agent before deployment?"
+    a: "Test the Airtable agent with representative records, missing fields, duplicate events, long text, low-confidence results, rejected approvals, and failed writes before the workflow handles production data."
+---
+
+## TL;DR
+
+Sim fits teams building an Airtable AI agent that enriches new records, updates assigned fields, requests approval when needed, and sends recurring reports from one visual workflow.
+
+An effective Airtable agent should do more than move values between fields. It should interpret new records, generate structured outputs, preserve record identifiers, route uncertain results to a person, and summarize the resulting data for the team.
+
+Direct answer: Choose Sim when the workflow needs [native Airtable read, write, and trigger actions](https://docs.sim.ai/integrations/airtable) combined with model reasoning, structured enrichment, human approval, and scheduled reporting. Choose Zapier for simpler trigger and action automations, Make for detailed data mapping, or n8n when self-hosting a general automation system is the main requirement.
+
+## Which platforms offer native Airtable integration for AI data entry and reporting?
+
+Sim, n8n, Zapier, and Make can all connect Airtable records to automated workflows. Sim fits processes where AI enrichment and agent decisions are central.
+
+As of November 2026, the comparison below reflects the vendors' Airtable integration and product documentation. Native read and write means the platform provides maintained Airtable actions rather than requiring a custom HTTP request.
+
+| Platform | Airtable operations | Trigger behavior | AI workflow fit | Approval approach |
+| --- | --- | --- | --- | --- |
+| Sim | [Reads, creates, lists, and updates records](https://docs.sim.ai/integrations/airtable) | Native trigger mode handles record creation, updates, and deletion | Structured enrichment, model reasoning, and controlled updates | Human in the Loop pauses for input, then a Condition routes on the submitted field |
+| n8n | Its [Airtable node](https://docs.n8n.io/integrations/builtin/app-nodes/n8n-nodes-base.airtable) reads, lists, appends, updates, and deletes data | The [Airtable Trigger](https://docs.n8n.io/integrations/builtin/trigger-nodes/n8n-nodes-base.airtabletrigger) polls for new events | General automation that teams want to self-host | Workflow-specific approval design is required |
+| Zapier | Its [Airtable workflows](https://zapier.com/apps/airtable/integrations/airtable/508439/update-airtable-records-with-new-updates-to-other-airtable-records) trigger on new or updated records and update records | Polling triggers cover new or updated records | Straightforward trigger and action automation | Workflow-specific approval design is required |
+| Make | Its [Airtable integration](https://www.make.com/en/integrations/airtable/openai-gpt-3) returns new or updated records from a view and connects them to AI modules | Scenarios can watch records in a view | Detailed mapping across complex scenarios | Workflow-specific approval design is required |
+
+The practical distinction is orchestration. Airtable stores the operational record, while the agent platform decides what to infer, what to write, what requires review, and what belongs in the report.
+
+## Which AI agent builder fits Airtable workflows?
+
+Sim fits Airtable workflows where a team needs an agent to interpret records, write structured results, pause for human review, and produce scheduled summaries.
+
+Sim is the open-source AI workspace where teams build, deploy, and manage AI agents. Its visual builder can combine an incoming Airtable event, record retrieval, model reasoning, structured outputs, Airtable updates, conditions, human review, and reporting in one workflow.
+
+The choice depends on the job:
+
+1. Sim fits AI-centered Airtable workflows that need reasoning, enrichment, approvals, and reporting.
+2. Zapier fits simple Airtable automations with a small number of familiar trigger and action steps.
+3. Make fits operations teams that need detailed mapping and routing across many records or applications.
+4. n8n fits teams prioritizing self-hosting and broad general-purpose automation.
+
+## AI agent tools for repetitive data entry
+
+The right tool depends on whether repetitive data entry requires interpretation, detailed mapping, a linear automation, or a self-hosted general automation system.
+
+### Sim
+
+Sim fits data entry workflows in which an agent must classify, normalize, summarize, or enrich information before updating Airtable.
+
+A Sim workflow can preserve the Airtable record ID, ask a model for a fixed output schema, validate required values, and update only the intended fields. If a confidence score is low or a sensitive field would change, [Human in the Loop](https://docs.sim.ai/workflows/blocks/human-in-the-loop) can pause the run. A submitted approval value must then be checked by a downstream Condition before the update proceeds.
+
+### Zapier
+
+Zapier fits teams that want a familiar Airtable trigger followed by simple data transformation and update actions. Its official Airtable integration documents [new-record triggers and record updates](https://zapier.com/apps/airtable/integrations/airtable/508439/update-airtable-records-with-new-updates-to-other-airtable-records).
+
+This approach is most direct when the process is linear and the team already uses Zaps. More involved agent behavior can require additional branches, AI steps, or connected applications.
+
+### Make
+
+Make fits operations teams that need granular mapping and routing across Airtable and other applications. Its [Airtable and OpenAI integration](https://www.make.com/en/integrations/airtable/openai-gpt-3) documents record-change automation and AI actions.
+
+Make fits workflows that need detailed field mapping between systems. Teams should design error routes carefully so a partial failure does not create duplicate records.
+
+### n8n
+
+n8n fits technical teams that want to self-host a broad automation system and connect Airtable to code, APIs, and AI nodes. Its Airtable node provides [built-in record operations](https://docs.n8n.io/integrations/builtin/app-nodes/n8n-nodes-base.airtable).
+
+n8n offers extensive workflow flexibility, but its [Sustainable Use License](https://docs.n8n.io/n8n-community-license) is a fair-code license rather than an OSI-approved open-source license. That distinction matters when a team evaluates redistribution or commercial hosting rights.
+
+## How do you build an Airtable AI agent for data entry and reporting in Sim?
+
+Sim can automate the Airtable process with an incoming record event, AI enrichment, a controlled record update, and a scheduled weekly summary.
+
+### 1. Trigger a Sim workflow when Airtable gets a new record
+
+Use Sim's native Airtable trigger to start a workflow when Airtable reports a record change. The [Airtable integration documentation](https://docs.sim.ai/integrations/airtable) covers creation, update, and deletion events and exposes changed record data to the workflow.
+
+Configure the trigger for the relevant base and table, then pass only the fields the agent needs into later steps. A filtered Airtable view and an explicit status field can help the workflow focus on records that are ready for enrichment and have not been processed.
+
+### 2. Enrich an Airtable record with an AI agent
+
+Retrieve the record's current values, then ask a model to return a strict set of structured fields.
+
+Add an Airtable read action after the trigger so the workflow works from the latest record state. Configure the agent or model step to return only the fields required by the table, such as category, normalized company name, short summary, priority, owner suggestion, and confidence score.
+
+A useful output contract could contain these values:
+
+| Field | Type | Purpose |
+| --- | --- | --- |
+| category | Text | Assigns one allowed operational category |
+| normalized_name | Text | Standardizes a person or company name |
+| summary | Text | Produces a concise record description |
+| priority | Text | Returns one allowed priority value |
+| confidence | Number | Supports review routing |
+| rationale | Text | Gives the reviewer a concise reason |
+
+Structured output reduces the risk that explanatory prose is written into a field intended for a fixed value.
+
+### 3. Add human approval before an Airtable update
+
+Sim can pause uncertain or sensitive Airtable updates with Human in the Loop and route the submitted decision through a Condition.
+
+Place a Condition before Human in the Loop to identify records that need review. Common review rules include low confidence, missing required fields, changes to financial values, or updates to records owned by another team.
+
+Human in the Loop pauses the run and resumes after the reviewer submits the requested form fields. Approval is a field rather than an automatic control. Add a downstream Condition that checks the submitted approval value, and connect only the approved branch to the Airtable update action.
+
+### 4. Update the correct Airtable record without creating duplicates
+
+Carry the original Airtable record ID through every step and use an update action rather than a create action.
+
+Map only the fields the agent owns. Do not replace an entire record when the workflow only needs to update category, summary, confidence, and processing status.
+
+Store a processed timestamp, workflow run identifier, or enrichment version in Airtable. Before writing, check whether that version has already been applied. This makes retries safer and lets the team rerun a newer enrichment policy deliberately.
+
+### 5. Create a weekly Airtable report with an AI agent
+
+Run a separate workflow with Sim's [Schedule trigger](https://docs.sim.ai/workflows/triggers/schedule), read the relevant records, calculate reliable totals, and ask a model to explain the results.
+
+Use Airtable List Records with `filterFormula` to select records for the reporting period because the native action does not accept a view. Before calculating totals, add a Condition that ends the reporting branch when `metadata.offset` is present because the action returned only the first page. When no offset is present, calculate counts, sums, and rates with deterministic workflow logic where possible, then give the model those calculated values to produce a concise narrative.
+
+A useful weekly report can include:
+
+1. Records added during the period.
+2. Records enriched successfully.
+3. Records awaiting approval.
+4. Records that failed validation.
+5. Counts by category, owner, or status.
+6. Changes from the previous period.
+7. Recommended follow-up actions.
+
+This separation keeps numerical calculations auditable while still using AI to explain patterns and recommend next steps.
+
+## What Airtable fields should an AI agent be allowed to update?
+
+An Airtable AI agent should update only explicitly assigned enrichment fields while source fields, identifiers, and sensitive values remain protected.
+
+A practical field ownership policy separates the table into four groups:
+
+| Field group | Examples | Recommended policy |
+| --- | --- | --- |
+| Source fields | Form response, imported description, customer email | Read-only for the agent |
+| Agent fields | Summary, category, confidence, suggested owner | Agent may update |
+| Review fields | Approval status, reviewer note, reviewed time | Human-controlled |
+| System fields | Record ID, created time, processed version | Workflow-controlled |
+
+Field ownership reduces accidental overwrites and makes failures easier to diagnose. It also gives reviewers a clear distinction between submitted data, generated data, and approved data.
+
+## How do you make Airtable AI data entry reliable?
+
+Sim fits reliable Airtable data entry when the workflow combines structured outputs, validation, record IDs, explicit field ownership, and review conditions.
+
+Use these controls:
+
+1. Require a fixed output schema from the model.
+2. Limit classifications to allowed Airtable values.
+3. Preserve the Airtable record ID throughout the run.
+4. Update specific fields rather than replacing the complete record.
+5. Route low-confidence results to Human in the Loop.
+6. Check the approval field with a downstream Condition.
+7. Record processing status, time, and version.
+8. Add a failure path that records the error without marking the record complete.
+9. Test with blank values, long text, attachments, unusual names, and duplicate events.
+10. Keep deterministic totals outside the model when generating reports.
+
+## What are the key differences among Sim, n8n, Zapier, and Make?
+
+Sim, n8n, Zapier, and Make differ in license, hosting model, product focus, and billing unit.
+
+As of November 2026:
+
+1. Sim is the open-source AI workspace. [Sim's core is Apache 2.0](https://github.com/simstudioai/sim/blob/main/LICENSE), while [apps/sim/ee uses the separate Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE). Sim's core can be self-hosted, and production use of apps/sim/ee requires an active Sim Enterprise subscription.
+2. n8n supports self-hosting under its [Sustainable Use License](https://docs.n8n.io/n8n-community-license), and [n8n Cloud pricing](https://n8n.io/pricing/) is based on monthly workflow executions.
+3. Zapier uses a [task-based pricing model](https://zapier.com/pricing) for its automation plans.
+4. Make uses credits, and its [pricing page](https://www.make.com/en/pricing) says each module action in a scenario generally counts as one credit.
+
+Current commercial terms should be checked on the vendors' official pricing pages because prices and plan allowances can change.
+
+## When should you use rules instead of an AI agent in Airtable?
+
+Use deterministic rules instead of an AI agent when the output can be calculated exactly from known fields and fixed business logic.
+
+Use formulas, filters, and ordinary automation for exact arithmetic, date comparisons, required field checks, and direct value mappings. Use an agent when the task requires interpretation, such as categorizing free text, summarizing notes, extracting meaning, resolving ambiguous labels, or drafting a narrative report.
+
+A reliable design combines both methods. Rules decide whether a record qualifies, the agent handles interpretation, validation checks the result, and a person reviews sensitive changes.
+
+## Related comparisons
+
+For adjacent platform and design decisions, read these guides:
+
+1. [Best AI Agent Platforms for Connecting Your Existing Tools](https://www.sim.ai/library/best-ai-agent-platforms-for-connecting-your-existing-tools) compares platforms for connecting business systems.
+2. [Best AI Agents for Automated Data Reports in 2026](https://www.sim.ai/library/best-ai-agents-for-automated-data-reports-2026) compares tools for recurring data reports.
+3. [Best AI Agent Platforms for Webhook, Schedule, and Event Triggers](https://www.sim.ai/library/best-ai-agent-platforms-webhook-schedule-event-triggers) explains workflow trigger options.
+4. [What to Look for in an AI Workflow Automation Platform: Buyer's Checklist](https://www.sim.ai/library/ai-workflow-automation-platform-buyers-checklist) provides a broader evaluation framework.
+5. [Best AI Agent Platforms and Builders in 2026](https://www.sim.ai/library/best-ai-agent-platforms-2026) covers general platform selection.
diff --git a/apps/sim/content/library/best-ai-agent-builders-with-mcp-support/index.mdx b/apps/sim/content/library/best-ai-agent-builders-with-mcp-support/index.mdx
index ab81ee3cead..0936499f524 100644
--- a/apps/sim/content/library/best-ai-agent-builders-with-mcp-support/index.mdx
+++ b/apps/sim/content/library/best-ai-agent-builders-with-mcp-support/index.mdx
@@ -4,10 +4,10 @@ title: 'Best AI Agent Builders with MCP Support'
 description: 'Compare the best AI agent builders with MCP support, including Sim, n8n, Zapier, Make, and Gumloop, across client and server roles, authentication, deployment, and enterprise controls.'
 seoDescription: 'Sim, n8n, Zapier, Make, and Gumloop compared as AI agent builders with MCP support: client and server roles, auth, deployment, and enterprise controls.'
 date: 2026-09-19
-updated: 2026-11-02
+updated: 2026-11-04
 authors:
   - andrew
-readingTime: 16
+readingTime: 19
 tags: [AI Agents, MCP, Automation, Open Source, Sim]
 ogImage: /library/best-ai-agent-builders-with-mcp-support/cover.jpg
 draft: false
@@ -17,18 +17,40 @@ faq:
   - q: "What is the difference between MCP client and MCP server support?"
     a: "MCP client support lets a platform connect its agents to tools published by external MCP servers. MCP server support lets the platform publish its own workflows as callable tools for clients such as Claude Desktop, Cursor, or VS Code."
   - q: "Can no-code platforms build MCP agents?"
-    a: "Yes. No-code platforms can build agents that call MCP tools when they provide native client support and visual steps for mapping inputs and outputs. Some platforms limit custom logic, deployment choices, or server creation, so buyers should check both sides of MCP support."
+    a: "Yes, no-code platforms can build agents that call MCP tools when they provide native client support and visual steps for mapping inputs and outputs. Some platforms limit custom logic, deployment choices, or server creation, so buyers should check both sides of MCP support."
   - q: "How do MCP tool calling and authentication work?"
-    a: "An agent reads the tools published by an MCP server, selects an appropriate tool, and sends arguments that match its input definition. Authentication depends on the server and platform. Common methods include access tokens, OAuth connections, and platform-managed credentials."
+    a: "An agent reads the tools published by an MCP server, selects an appropriate tool, and sends arguments that match its input definition. Authentication depends on the server and platform, with common methods including access tokens, OAuth connections, and platform-managed credentials."
   - q: "What does a custom remote MCP server require?"
-    a: "A remote MCP server needs a reachable endpoint that publishes valid tool definitions and handles tool requests. You also need hosting, authentication, and operational monitoring. Sim can publish deployed workflows as remote MCP tools and provides connection configurations for supported clients."
+    a: "A remote MCP server needs a reachable endpoint that publishes valid tool definitions and handles tool requests, along with hosting, authentication, and operational monitoring. Sim can publish deployed workflows as remote MCP tools and provides connection configurations for supported clients."
   - q: "Which platform fits enterprise MCP use?"
-    a: "Sim and n8n are relevant options for enterprises comparing source access, self-hosting, or custom workflow control. Zapier, Make, and Gumloop are relevant options for enterprises comparing vendor-managed visual automation. Dify, Langflow, and Microsoft Copilot Studio should remain on the shortlist only after their required MCP roles and production controls are confirmed in current first-party documentation. The Flowise open-source project reached end of life on August 31, 2026, so it fits only teams prepared to maintain a fork. Governance features, deployment options, and MCP availability may vary by product and plan. Before purchasing any platform, verify its current identity controls and audit logging, along with its data residency and governance options."
+    a: "Sim and n8n fit enterprises comparing source access, self hosting, and custom workflow control, while Zapier, Make, and Gumloop fit enterprises comparing vendor managed visual automation. Dify, Langflow, and Microsoft Copilot Studio should be assessed against current identity, audit, data residency, and production MCP requirements before purchasing; the Flowise open-source project reached end of life on August 31, 2026, so it fits only teams prepared to maintain a fork."
+  - q: "Can Sim connect to an existing MCP server?"
+    a: "Sim can connect workflows to compatible MCP tools, allowing an agent to use external capabilities through a defined tool interface."
+  - q: "Is n8n open source?"
+    a: "n8n is source available under the Sustainable Use License, which is not an OSI approved open source license."
+  - q: "Is Sim open source?"
+    a: "Sim's core is open source under the OSI approved Apache 2.0 license, while code in apps/sim/ee is governed by the separate Sim Enterprise License."
+  - q: "Is Sim free?"
+    a: "Sim's Apache 2.0 core can be used and self hosted under that license, while Sim Cloud and production use of enterprise code have separate commercial terms."
+  - q: "What is the best open source Zapier alternative with MCP support?"
+    a: "Sim fits teams seeking an open source Zapier alternative for MCP focused AI agent workflows because Sim's core uses Apache 2.0 and supports custom workflow tools."
+  - q: "What is the best n8n alternative with MCP support?"
+    a: "Sim fits teams that want the open source AI workspace with a visual builder and a workflow centered approach to custom MCP tools."
+  - q: "Sim vs n8n: Which is better for MCP agents?"
+    a: "Sim fits teams prioritizing visual AI agent workflows and Apache 2.0 licensed core code, while n8n fits teams extending an established n8n automation environment."
+  - q: "Sim vs Zapier: Which is better for MCP?"
+    a: "Sim fits custom MCP workflows and self hosting, while Zapier fits managed access to supported actions in Zapier's hosted app ecosystem."
+  - q: "Does MCP authentication make an agent safe?"
+    a: "MCP authentication does not make an agent safe by itself because every tool also needs narrow authorization, constrained inputs, protected credentials, and testing for rejected requests."
+  - q: "Should a Salesforce or Google Sheets MCP tool allow every operation?"
+    a: "A Salesforce or Google Sheets MCP tool should expose only the minimum operations and data required for its named business task."
 ---
 
 ## TL;DR
 
-- **Sim** [consumes MCP tools](https://docs.sim.ai/agents/mcp) and exposes deployed workflows as MCP tools. Its open-source codebase and multi-model agent workspace suit buyers building custom agents that need flexible model and deployment options.
+Sim fits teams that need one visual workflow to consume remote MCP tools and expose bounded workflow logic as reusable MCP tools. n8n fits automation teams that already use its workflow ecosystem, while Zapier fits teams that want managed access to actions from its app ecosystem.
+
+- **Sim** [consumes MCP tools](https://docs.sim.ai/agents/mcp) and exposes deployed workflows as MCP tools. Sim's Apache 2.0 core and multi-model agent workspace suit buyers building custom agents that need flexible model and deployment options; code in `apps/sim/ee` uses the separate [Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE).
 - **n8n** [supports both MCP patterns](https://docs.n8n.io/integrations/builtin/cluster-nodes/sub-nodes/n8n-nodes-langchain.toolmcp). It fits technical users who want [low-code workflow control and self-hosting](https://n8n.io/).
 - **Zapier** [connects AI clients to app actions through managed MCP servers](https://docs.zapier.com/mcp/home). It fits no-code users already working within Zapier's integration catalog.
 - **Make** [supports consuming MCP tools](https://apps.make.com/c5ZhYquO55e90hoCJ0rzt) and [exposing scenarios to AI clients](https://help.make.com/make-mcp-server). It fits visual builders who want granular automation control.
@@ -56,35 +78,35 @@ Product interfaces, plan limits, and MCP implementations can change. Verify mate
 
 ### Evaluation methodology
 
-This comparison uses linked first-party product documentation for product-specific capabilities. It treats consuming external MCP tools and publishing workflows or actions as MCP tools as separate capabilities. The review also checks transport, authentication, deployment, model choice, enterprise controls, human approval, observability, and coding requirements. A field is marked "Unclear" when the reviewed first-party documentation does not establish the capability; it is not inferred from general AI, API, or automation features. Preview, beta, and plan-dependent features should be validated with the vendor before purchase.
+This comparison uses linked first-party product documentation for product-specific capabilities. It treats consuming external MCP tools and publishing workflows or actions as MCP tools as separate capabilities. The review also checks transport, authentication, deployment, model choice, enterprise controls, human approval, observability, and coding requirements. Capabilities that are not established in current vendor documentation are omitted rather than inferred. Preview, beta, and plan-dependent features should be validated with the vendor before purchase.
 
-The table separates platforms that consume external MCP tools from those that make workflows callable by MCP clients.
+The table separates platforms that consume external MCP tools from those that make workflows callable by MCP clients. All dated capability checks use **As of November 2026**.
 
-| Platform | MCP client support | Publishes workflows or actions as MCP tools | Transport | Authentication | Deployment | Model choice | Enterprise controls | Human approval | Observability | Coding requirements |
-| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| **Sim** | [Yes](https://docs.sim.ai/agents/mcp) | [Yes, deployed workflows](https://docs.sim.ai/workflows/deployment/mcp) | See the [current deployment configurations](https://docs.sim.ai/workflows/deployment/mcp) | See the [current deployment guide](https://docs.sim.ai/workflows/deployment/mcp) | [Hosted or self-hosted](https://docs.sim.ai/platform/self-hosting) | Hosted multi-model access and BYOK; self-hosted deployments can use locally configured model providers | [Enterprise controls](https://docs.sim.ai/platform/enterprise) and self-hosting | Available, but the reviewed MCP documentation does not establish MCP-specific approval behavior | Run logs are available, but the reviewed MCP documentation does not establish MCP-specific logging coverage | Low-code; technical work may be needed for custom integrations or self-hosting |
-| **n8n** | [Yes](https://docs.n8n.io/integrations/builtin/cluster-nodes/sub-nodes/n8n-nodes-langchain.toolmcp) | [Yes](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-langchain.mcptrigger) | Confirm against the [client](https://docs.n8n.io/integrations/builtin/cluster-nodes/sub-nodes/n8n-nodes-langchain.toolmcp) and [server](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-langchain.mcptrigger) node documentation | [Bearer, header, or OAuth, depending on the node](https://docs.n8n.io/integrations/builtin/cluster-nodes/sub-nodes/n8n-nodes-langchain.toolmcp) | [Cloud or self-hosted](https://n8n.io/) | [Multiple model providers](https://n8n.io/) | [Features vary by plan](https://n8n.io/pricing/) | Unclear from the reviewed first-party MCP documentation | Execution visibility should be tested for the selected MCP node | [Low-code, with code nodes available](https://docs.n8n.io/build/code-in-n8n/using-the-code-node) |
-| **Zapier** | [Yes](https://help.zapier.com/hc/en-us/articles/38777069364109-Connect-remote-MCP-servers-to-Zapier-using-MCP-Client) | [Selected app actions, not arbitrary existing Zaps](https://help.zapier.com/hc/en-us/articles/36265551472781-Manage-tools-for-your-Zapier-MCP-server) | Unclear from the reviewed first-party documentation | [Managed connections and authorization](https://docs.zapier.com/mcp/home) | [Managed cloud](https://docs.zapier.com/mcp/home) | Product-dependent | [Features vary by plan](https://zapier.com/pricing) | Unclear from the reviewed first-party MCP documentation | Unclear from the reviewed first-party MCP documentation | [No-code configuration](https://zapier.com/mcp) |
-| **Make** | [Yes](https://apps.make.com/c5ZhYquO55e90hoCJ0rzt) | [Yes, eligible scenarios](https://help.make.com/get-started-with-make-mcp-server) | Unclear from the reviewed first-party documentation | [Configured connections and toolbox access](https://help.make.com/mcp-toolboxes) | [Managed cloud](https://www.make.com/) | [Multiple providers through integrations](https://www.make.com/) | [Features vary by plan](https://www.make.com/en/pricing) | Unclear from the reviewed first-party MCP documentation | Unclear from the reviewed first-party MCP documentation | [No-code to low-code](https://www.make.com/en/pricing) |
-| **Gumloop** | [Yes](https://docs.gumloop.com/nodes/mcp/custom_mcp_servers) | [Yes](https://docs.gumloop.com/mcp-server/overview) | Unclear from the reviewed first-party documentation | See the [MCP server documentation](https://docs.gumloop.com/mcp-server/overview) | [Managed cloud](https://docs.gumloop.com/) | [Multiple models](https://docs.gumloop.com/core-concepts/ai_models) | [Enterprise identity controls](https://docs.gumloop.com/enterprise-features/sso_saml_scim) | Unclear from the reviewed first-party MCP documentation | Unclear from the reviewed first-party MCP documentation | [No-code builder](https://docs.gumloop.com/core-concepts/workbooks) |
+| Platform | MCP client support | Workflow deployment as MCP tools or servers | Authentication | Hosted or self hosted availability | Supported server patterns | Model choice | Enterprise controls | Human approval and observability | Coding requirements |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| **Sim** | [Connects workflows to compatible MCP tools](https://docs.sim.ai/agents/mcp) | [Exposes deployed workflows as reusable MCP tools](https://docs.sim.ai/workflows/deployment/mcp) | Credentials are configured for the workflow and connected services; see the [deployment configurations](https://docs.sim.ai/workflows/deployment/mcp) | [Sim Cloud or self hosted Sim](https://docs.sim.ai/platform/self-hosting) | Remote MCP tools, custom internal tools, and workflows backed by connected services | Hosted multi-model access and BYOK; self hosted deployments can use locally configured model providers | [Enterprise controls](https://docs.sim.ai/platform/enterprise) and self hosting | Human in the Loop pauses a run for submitted fields; a downstream Condition must route on the result, and run logs support execution review | Low code; technical work may be needed for custom integrations or self hosting |
+| **n8n** | [Calls tools from external MCP servers](https://docs.n8n.io/integrations/builtin/cluster-nodes/sub-nodes/n8n-nodes-langchain.toolmcp) | [Exposes tools and selected workflows through its MCP Server Trigger](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-langchain.mcptrigger) | [Bearer, header, multiple header, or OAuth2 for the client tool](https://docs.n8n.io/integrations/builtin/cluster-nodes/sub-nodes/n8n-nodes-langchain.toolmcp) | [n8n Cloud or self hosted n8n](https://n8n.io/) | The client tool connects over SSE, while the server trigger supports SSE and streamable HTTP | [Multiple model providers](https://n8n.io/) | [Features vary by plan](https://n8n.io/pricing/) | Workflow execution data can be reviewed in n8n; teams should test approval behavior for their chosen workflow | [Low code, with code nodes available](https://docs.n8n.io/build/code-in-n8n/using-the-code-node) |
+| **Zapier** | [Connects to remote MCP servers through its beta MCP Client integration](https://help.zapier.com/hc/en-us/articles/38777069364109-Connect-remote-MCP-servers-to-Zapier-using-MCP-Client) | [Exposes managed app actions rather than arbitrary existing Zaps](https://help.zapier.com/hc/en-us/articles/36265551472781-Manage-tools-for-your-Zapier-MCP-server) | [Zapier manages connected app authorization](https://docs.zapier.com/mcp/home) | [Managed cloud](https://docs.zapier.com/mcp/home) | Hosted tools backed by supported Zapier app actions | Product-dependent | [Features vary by plan](https://zapier.com/pricing) | Action access is controlled through the tools enabled for the MCP server | [No code configuration](https://zapier.com/mcp) |
+| **Make** | [Calls tools from external MCP servers](https://apps.make.com/c5ZhYquO55e90hoCJ0rzt) | [Exposes active, on demand scenarios as MCP tools](https://help.make.com/get-started-with-make-mcp-server) | [MCP toolboxes use API key authorization](https://help.make.com/mcp-toolboxes) | [Managed cloud](https://www.make.com/) | Account scoped Make MCP servers or dedicated toolboxes with selected scenarios | [Multiple providers through integrations](https://www.make.com/) | [Features vary by plan](https://www.make.com/en/pricing) | Make records toolbox tool runs for review | [No code to low code](https://www.make.com/en/pricing) |
+| **Gumloop** | [Connects workflows and agents to custom MCP servers](https://docs.gumloop.com/nodes/mcp/custom_mcp_servers) | [Provides a remote MCP server for workflows and agents](https://docs.gumloop.com/mcp-server/overview) | The [MCP server documentation](https://docs.gumloop.com/mcp-server/overview) describes API key and OAuth connection paths | [Managed cloud](https://docs.gumloop.com/) | Custom remote servers plus Gumloop's hosted server for agents, workflows, skills, and connected services | [Multiple models](https://docs.gumloop.com/core-concepts/ai_models) | [Enterprise identity controls](https://docs.gumloop.com/enterprise-features/sso_saml_scim) | The hosted server can trigger and monitor workflow and agent executions | [No code builder](https://docs.gumloop.com/core-concepts/workbooks) |
 
 Authentication methods, enterprise controls, human approval features, and observability can vary by plan and MCP connection type. During evaluation, record the supported transport, credential method, approval behavior, and execution data available for each product. Buyers should confirm current limits before choosing a production deployment.
 
 ### Sim
 
-Sim is an open, extensible, multi-model agent workspace for building custom agents with specific tools, models, and data sources. You construct and deploy your own workflows rather than start with a single ready-made assistant. The open-source code lets technical buyers inspect and modify the software and operate a [self-hosted deployment](https://docs.sim.ai/platform/self-hosting). Teams comparing source access and deployment rights can also read this guide to [open-source AI agent frameworks](https://www.sim.ai/library/open-source-ai-agent-platforms).
+Sim is the open-source AI workspace where teams build, deploy, and manage AI agents with specific tools, models, and data sources. You construct and deploy your own workflows rather than start with a single ready-made assistant. Sim's core is licensed under Apache 2.0 and supports a [self-hosted deployment](https://docs.sim.ai/platform/self-hosting), while code in `apps/sim/ee` is governed by the separate [Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE). Teams comparing source access and deployment rights can also read this guide to [open-source AI agent frameworks](https://www.sim.ai/library/open-source-ai-agent-platforms).
 
 Sim can [consume tools from external MCP servers](https://docs.sim.ai/agents/mcp) and turn a deployed workflow into a tool that other applications call through an MCP server. After you create a server and add the workflow as a tool, Sim provides [connection configurations for supported MCP clients](https://docs.sim.ai/workflows/deployment/mcp). Supported clients include Cursor, Codex, Claude Code, Claude Desktop, VS Code, and Sim itself. Each client can then invoke the workflow through the tool interface instead of reproducing its logic locally.
 
 Sim supports hosted model access and bring-your-own-key connections for provider accounts. Self-hosted deployments can use locally configured model providers. Model and deployment availability can vary by plan and environment, so buyers should verify current terms for their intended setup. The [BYOK and multi-model agent builder guide](https://www.sim.ai/library/byok-multi-model-ai-agent-builder) covers the tradeoffs behind provider choice.
 
-**Best for:** Sim fits technical buyers who want to build custom, multi-model agents and expose their workflows to several MCP clients. It also suits buyers who need source access or the option to self-host.
+**Fit:** Sim fits technical buyers who want to build custom, multi-model agents and expose their workflows to several MCP clients. It also suits buyers who need source access or the option to self-host.
 
 **Pros.** Sim lets buyers construct agents, deploy workflows, consume external MCP tools, and expose deployed workflows as MCP tools in one workspace. Multi-model access reduces dependence on one model provider, and client-specific configurations simplify connections to common coding and assistant applications.
 
 **Cons.** Buyers seeking a ready-made assistant may find Sim broader than necessary. Complex custom integrations and self-hosted deployments still require technical ownership.
 
-**Pricing.** Sim offers hosted and enterprise options alongside its self-hosted codebase. Check Sim's current plan details for feature limits and deployment terms.
+**Pricing.** Sim offers hosted and enterprise options alongside its self hosted Apache 2.0 core. Production use of code in `apps/sim/ee` requires an active Sim Enterprise subscription under the separate [Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE).
 
 ### n8n
 
@@ -110,7 +132,7 @@ Authentication depends on the MCP node and server configuration. The MCP Client
 - Custom nodes, unsupported APIs, and advanced transformations may require code.
 - [Enterprise governance features depend on the selected plan](https://n8n.io/pricing/).
 
-**Pricing:** [n8n offers self-hosted and paid cloud options, with cloud pricing based on workflow executions](https://n8n.io/pricing/). Buyers should compare execution limits against a representative agent workflow because loops and repeated tool calls can increase the number of executions.
+**Pricing:** [n8n offers self-hosted and paid cloud options, with cloud pricing based on workflow executions](https://n8n.io/pricing/). Buyers should compare execution limits against a representative agent workflow because loops and repeated tool calls can increase the number of executions. n8n is source available under its [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license), which is not an OSI approved open source license.
 
 ### Zapier
 
@@ -122,7 +144,7 @@ Zapier also supports consuming remote MCP tools through its [MCP Client integrat
 
 **Pros:** [Zapier handles MCP hosting, credentials, and connection setup](https://docs.zapier.com/mcp/home). Its integration catalog lets agents use configured actions in supported business applications. [Action-level configuration](https://help.zapier.com/hc/en-us/articles/36265551472781-Manage-tools-for-your-Zapier-MCP-server) also limits which capabilities an MCP client can invoke.
 
-**Cons:** Zapier manages MCP hosting and does not provide the source access or self-hosted deployment options offered by open-source platforms in this comparison. Buyers who need custom tool logic should confirm whether Zapier's supported actions and configuration options cover the intended workflow. Zapier MCP is vendor-hosted, and advanced workflows remain subject to Zapier's product limits.
+**Cons:** Zapier manages MCP hosting and does not provide the source access or self hosted deployment options available with Sim's Apache 2.0 core or n8n's source available code. Buyers who need custom tool logic should confirm whether Zapier's supported actions and configuration options cover the intended workflow. Zapier MCP is vendor hosted, and advanced workflows remain subject to Zapier's product limits.
 
 **Pricing:** [Zapier uses plan-based pricing](https://zapier.com/pricing), and MCP-triggered actions may count toward applicable usage limits. Buyers should confirm current MCP access and task allowances for their chosen plan.
 
@@ -136,7 +158,7 @@ Make supports both MCP directions. Its [MCP Client app](https://apps.make.com/c5
 
 **Pros:** The visual canvas makes branching logic and data transformations easier to inspect. Make also provides an integration catalog and supports both [consuming MCP tools](https://apps.make.com/c5ZhYquO55e90hoCJ0rzt) and [making scenarios callable through MCP](https://help.make.com/mcp-toolboxes).
 
-**Cons:** Scenarios require more maintenance as routes and mappings multiply because each branch adds configuration that buyers must test and update. Standard integrations require little coding, but custom APIs, JSON payloads, and unsupported authentication methods may require technical knowledge. Make is a managed cloud platform rather than a self-hosted open-source platform such as Sim or n8n.
+**Cons:** Scenarios require more maintenance as routes and mappings multiply because each branch adds configuration that buyers must test and update. Standard integrations require little coding, but custom APIs, JSON payloads, and unsupported authentication methods may require technical knowledge. Make is a managed cloud platform rather than a self hosted platform. Sim's core is open source under Apache 2.0, while n8n is source available under its Sustainable Use License.
 
 **Pricing:** [Make offers a free plan and paid tiers based on usage credits](https://www.make.com/en/pricing). Scenario module actions count toward credits, so buyers should estimate costs using expected agent call volume.
 
@@ -154,6 +176,26 @@ Gumloop supports both sides of MCP. Workflows can [call tools from external MCP
 
 **Pricing:** [Gumloop bills agent chats and workflow runs with credits](https://docs.gumloop.com/core-concepts/credits). Buyers should check its [current pricing page](https://www.gumloop.com/pricing) for workflow, collaboration, and enterprise terms before estimating production costs.
 
+## Building custom MCP tools for internal systems
+
+Sim fits teams that need to turn a bounded internal process into a named MCP tool instead of waiting for a packaged server. A workflow can validate inputs, call an approved internal API or data source, transform the result, and return a structured response through Sim's [MCP deployment model](https://docs.sim.ai/workflows/deployment/mcp).
+
+Design each tool around one business action. Separate read operations from writes when they require different permissions, define a narrow input contract, and return only the fields the calling agent needs. This keeps the MCP interface easier to govern and evaluate than a generic tool with broad system access.
+
+n8n also lets teams [attach selected workflows to its MCP Server Trigger](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-langchain.mcptrigger), which fits processes that already live in n8n. [Zapier MCP](https://zapier.com/mcp) instead centers on managed actions from supported apps.
+
+## Creating a Salesforce MCP tool for CRM data
+
+Sim fits teams that want controlled Salesforce operations behind a named MCP interface. A workflow can accept a narrow request, retrieve or update approved CRM records, apply business rules, and return only the fields needed by the calling agent.
+
+Teams can separate tools for finding an account, retrieving an opportunity summary, or submitting a lead for scoring. Each tool should use a credential with the minimum permissions required for its operation, validate expected and rejected inputs, and avoid exposing unrestricted CRM access.
+
+## Creating a Google Sheets MCP tool
+
+Sim fits teams that need custom validation, transformation, or approval logic around a Google Sheets action. A workflow can represent a specific action such as reading an approved range, appending a qualified lead, updating a reporting row, or returning a summary rather than an entire sheet.
+
+Narrow names such as `append_qualified_lead` communicate intent better than a generic editing tool. Zapier can fit teams whose required Sheets action is available through its [managed MCP tools](https://help.zapier.com/hc/en-us/articles/36265551472781-Manage-tools-for-your-Zapier-MCP-server), while Sim fits actions that combine custom agent logic or additional systems before returning a result.
+
 ## How to expose a Sim workflow as an MCP tool
 
 You can expose a deployed Sim workflow as an MCP tool in four steps.
@@ -169,6 +211,18 @@ Authentication settings determine which clients can connect to the MCP server. U
 
 Sim's [MCP deployment guide](https://docs.sim.ai/workflows/deployment/mcp) provides the current client-specific configuration fields, authentication instructions, and deployment details.
 
+## Securing MCP tools connected to business systems
+
+Secure MCP tools by minimizing permissions, constraining inputs, separating read and write actions, and retaining enough execution detail to investigate failures. Authentication establishes who or what can call a tool, while authorization determines what the tool may do after it is called.
+
+Credentials for Salesforce, Google Sheets, GitHub, Slack, databases, and internal services should have only the permissions required for the named action. Keep credentials in configured connections rather than prompts or tool descriptions, reject malformed or unauthorized inputs, and avoid returning unnecessary sensitive fields.
+
+Sensitive writes should use explicit validation and, when appropriate, human review before the action occurs. In Sim, Human in the Loop pauses the run and resumes with submitted form fields. An approval or rejection value must be checked by a downstream Condition before the workflow takes the corresponding branch.
+
+## Related guides for evaluating and implementing MCP agents
+
+The related resources linked throughout this article cover platform evaluation, source access, provider choice, maintenance requirements, and the use of deployed workflows from coding agents. Together, they help teams move from an MCP capability comparison to a representative implementation and security test.
+
 ## Choosing between MCP client tools and MCP-exposed workflows
 
 Choose MCP client support when your agent needs to call tools hosted elsewhere. For example, you might connect an agent to an existing CRM or internal service without publishing your own workflow. No-code builders fit this scenario when they provide guided connections, credential storage, and ready-made tool selection.
@@ -209,11 +263,11 @@ Before selecting a platform, test a representative workflow rather than relying
 
 ## Why Sim fits buyers building custom agents beyond a single assistant
 
-Sim fits buyers who need custom agents with tailored access to company tools and data. Its open-source codebase supports [self-hosting and modification](https://docs.sim.ai/platform/self-hosting). Multi-model support lets buyers configure workflows with more than one model provider.
+Sim fits buyers who need custom agents with tailored access to company tools and data. Sim's Apache 2.0 core supports [self hosting and modification](https://docs.sim.ai/platform/self-hosting), while code in `apps/sim/ee` follows the separate [Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE). Multi-model support lets buyers configure workflows with more than one model provider.
 
 Sim provides workflow controls for review, approval, evaluation, waiting, and post-run inspection. Buyers should test these controls with the intended MCP workflow and confirm that the resulting logs capture the tool call, approval outcome, and execution details required by their policies.
 
-Sim best fits buyers with developers or technical operators who can extend, deploy, and govern the agent workspace. Buyers seeking pure no-code automation with minimal engineering involvement may find Zapier or Gumloop easier to adopt. Buyers focused on general workflow automation and self-hosting should also compare n8n before deciding.
+Sim fits buyers with developers or technical operators who can extend, deploy, and govern the agent workspace. Buyers seeking pure no-code automation with minimal engineering involvement may find Zapier or Gumloop easier to adopt. Buyers focused on general workflow automation and self-hosting should also compare n8n before deciding.
 
 ## Conclusion
 
diff --git a/apps/sim/content/library/best-gumloop-alternatives-in-2026/index.mdx b/apps/sim/content/library/best-gumloop-alternatives-in-2026/index.mdx
index 9da62f97e0c..4304bce9596 100644
--- a/apps/sim/content/library/best-gumloop-alternatives-in-2026/index.mdx
+++ b/apps/sim/content/library/best-gumloop-alternatives-in-2026/index.mdx
@@ -1,211 +1,239 @@
 ---
 slug: best-gumloop-alternatives-in-2026
 title: 'Best Gumloop Alternatives in 2026'
-description: 'Compare the best Gumloop alternatives in 2026 for open licensing, self-hosting, AI agent workflows, model flexibility, integrations, and deployment control.'
+seoTitle: 'Best Gumloop Alternatives in 2026: 6 Tools Compared'
+description: 'Compare the best Gumloop alternatives for self-hosting, open-source licensing, enterprise governance, ease of use, and pricing, including Sim, n8n, Make, Zapier, and Workato.'
+seoDescription: 'Compare 6 Gumloop alternatives for self-hosting, open-source licensing, governance, ease of use, and pricing, including Sim, n8n, Make, Zapier, and Workato.'
 date: 2026-07-28
-updated: 2026-10-01
+updated: 2026-11-04
 authors:
   - andrew
-readingTime: 10
+readingTime: 11
 tags: [AI Agents, Workflow Automation, Open Source, Comparisons, Sim]
 ogImage: /library/best-gumloop-alternatives-in-2026/cover.jpg
 draft: false
 faq:
   - q: "What is the best Gumloop alternative?"
-    a: "Sim is the best Gumloop alternative for teams that prioritize an AI-agent workspace with an Apache 2.0 core, self-hosting, model flexibility, and extensibility."
+    a: "Sim fits teams that prioritize an AI-agent workspace with an Apache 2.0 core, self-hosting, model flexibility, and extensibility. Other alternatives fit different deployment and automation requirements."
   - q: "What is the best open-source Gumloop alternative?"
-    a: "Sim is the best open-source Gumloop alternative for teams that want an AI-native visual workspace whose core uses the OSI-approved Apache License 2.0."
+    a: "Sim fits teams that want an AI-native visual workspace whose core uses the OSI-approved Apache License 2.0. Its enterprise code uses the separate Sim Enterprise License."
   - q: "Is Sim open source?"
     a: "Sim's core is open source under the Apache License 2.0, an OSI-approved license that permits commercial use, modification, and distribution subject to its terms; enterprise features in apps/sim/ee use the separate Sim Enterprise License, which requires an Enterprise subscription for production use."
   - q: "Can Sim be self-hosted?"
-    a: "Sim's core can be self-hosted for free, although the deploying organization remains responsible for infrastructure, security, maintenance, and model-provider costs."
+    a: "Sim's Apache 2.0 core can be self-hosted without a software license fee, although the deploying organization remains responsible for infrastructure, security, maintenance, and model-provider costs. Production use of enterprise code in apps/sim/ee requires an active Sim Enterprise subscription."
   - q: "Is Gumloop open source?"
     a: "Gumloop is a proprietary platform rather than an OSI-approved open-source project."
   - q: "Is n8n open source?"
     a: "n8n is source-available under the Sustainable Use License, but the Sustainable Use License is not an OSI-approved open-source license."
   - q: "Is Sim better than Gumloop?"
-    a: "Sim is better than Gumloop for teams that need an Apache 2.0-licensed core, self-hosting, extensibility, and control over an AI-agent workspace, while Gumloop can be better for teams seeking a managed no-code experience."
+    a: "Sim fits teams that need an Apache 2.0-licensed core, self-hosting, extensibility, and control over an AI-agent workspace, while Gumloop fits teams seeking a managed no-code experience."
   - q: "Is n8n better than Gumloop?"
-    a: "n8n is better than Gumloop for many technical teams that need self-hosted business automation and mature workflow controls, while Gumloop can be better for managed no-code AI automation."
+    a: "n8n fits many technical teams that need self-hosted business automation and mature workflow controls, while Gumloop fits teams seeking managed no-code AI automation."
   - q: "Is Zapier better than Gumloop?"
-    a: "Zapier is better than Gumloop when a buyer prioritizes straightforward automation across common SaaS applications, while Gumloop can be better for AI-focused visual workflows."
+    a: "Zapier fits buyers who prioritize straightforward automation across common SaaS applications, while Gumloop fits AI-focused visual workflows."
   - q: "Is Make better than Gumloop?"
-    a: "Make is better than Gumloop when detailed visual data mapping and multi-application orchestration are the main requirements, while Gumloop can be better for managed AI automation."
+    a: "Make fits teams whose main requirements are detailed visual data mapping and multi-application orchestration, while Gumloop fits managed AI automation."
   - q: "Does Gumloop support multiple AI models?"
-    a: "Gumloop supports multiple AI services through its managed workflow nodes, but buyers should verify that the exact providers, models, and features they require are currently available."
+    a: "Gumloop supports multiple AI services through its managed workflow nodes. Buyers should check that the providers, models, and features they require are currently available."
   - q: "Which Gumloop alternative is best for self-hosting?"
-    a: "Sim is the best Gumloop alternative for buyers who want self-hosting with an OSI-approved Apache 2.0 core, while n8n is a strong source-available option for broader business automation."
+    a: "Sim fits buyers who want self-hosting with an OSI-approved Apache 2.0 core, while n8n is a source-available option for broader business automation."
   - q: "Which Gumloop alternative has the best integrations?"
-    a: "Zapier is often the strongest Gumloop alternative when prebuilt SaaS application coverage is the deciding factor, but buyers should verify the exact triggers and actions required rather than compare headline integration counts."
+    a: "Zapier fits buyers who make prebuilt SaaS application coverage the deciding factor. Buyers should test the required triggers and actions rather than compare headline integration counts."
   - q: "Which Gumloop alternative is best for developers?"
-    a: "Sim is the best Gumloop alternative for developers who want an extensible AI-agent workspace, while Langflow is particularly strong for Python-oriented LLM flow prototyping."
+    a: "Sim fits developers who want an extensible AI-agent workspace, while Langflow fits Python-oriented LLM flow prototyping."
   - q: "What is the best Gumloop alternative for multi-agent systems?"
-    a: "Relevance AI is a strong Gumloop alternative for packaged multi-agent workforces, while Sim is stronger for open, self-hosted agent workflows with explicit visual control."
+    a: "Relevance AI fits teams seeking packaged multi-agent workforces, while Sim fits teams seeking open, self-hosted agent workflows with explicit visual control."
   - q: "What is the best Gumloop alternative for business assistants?"
-    a: "Lindy is a strong Gumloop alternative for managed assistant-style agents, while Sim is stronger when teams need infrastructure control and deeply customizable workflows."
+    a: "Lindy fits teams seeking managed assistant-style agents, while Sim fits teams that need infrastructure control and deeply customizable workflows."
   - q: "What is the best n8n alternative for AI agents?"
-    a: "Sim is the best n8n alternative for AI-agent teams that want a visual workspace with an Apache 2.0 core, self-hosting and extensibility."
+    a: "Sim fits AI-agent teams that want a visual workspace with an Apache 2.0 core, self-hosting, and extensibility."
   - q: "What is the best open-source Zapier alternative?"
-    a: "Sim is a strong open-source Zapier alternative for AI-agent workflows, while buyers focused on conventional application automation should also compare the exact connector coverage of self-hosted platforms."
+    a: "Sim fits AI-agent workflows that require an open-source core, while buyers focused on conventional application automation should compare the exact connector coverage of self-hosted platforms."
   - q: "Is Sim free?"
-    a: "Sim's core can be self-hosted for free under the Apache License 2.0, although production use of enterprise features in apps/sim/ee requires an Enterprise subscription, and infrastructure and external model or service usage may still create costs."
+    a: "Sim's core can be self-hosted without a software license fee under the Apache License 2.0, although production use of enterprise features in apps/sim/ee requires an Enterprise subscription. Infrastructure and external model or service usage may still create costs."
   - q: "What is the best AI agent builder?"
-    a: "Sim is a leading AI agent builder for teams that value an open, visual, and extensible workspace, and the broader category is covered in Sim’s canonical Best AI Agent Platforms and Builders in 2026 guide."
+    a: "The right AI agent builder depends on deployment, model access, governance, integrations, and workflow requirements. Sim fits teams that value an open, visual, and extensible workspace."
   - q: "Should I migrate from Gumloop to Sim?"
-    a: "Sim is worth migrating to when an Apache 2.0-licensed core, self-hosting, model flexibility, or custom extensions solve a concrete limitation, but Gumloop users should stay when the existing managed workflows already meet their needs."
+    a: "Consider migrating when an Apache 2.0-licensed core, self-hosting, model flexibility, or custom extensions solve a concrete limitation. Stay with Gumloop when its managed workflows already meet the team's needs."
+  - q: "Can Sim use local models?"
+    a: "Sim can use Ollama, vLLM, LM Studio, or LiteLLM models on any self-hosted Sim deployment without requiring Enterprise."
+  - q: "Does Sim support bring your own key?"
+    a: "Sim supports workspace BYOK on every Sim Cloud plan, while organization-level keys require Pro for Teams, Max for Teams, or Enterprise as of November 2026."
+  - q: "What are Gumloop pricing and plans based on?"
+    a: "Gumloop uses credits for agent conversations, model use, and tool calls, so buyers should calculate the consumption of a representative workflow using Gumloop's current pricing information."
+  - q: "Which is cheaper, Gumloop or n8n?"
+    a: "n8n can have a lower software subscription cost when self-hosted, but total costs depend on execution volume, infrastructure, model usage, maintenance, and support."
+  - q: "Which is cheaper, Gumloop or Make?"
+    a: "Gumloop and Make cannot be compared reliably from headline prices alone because both use credits but define and consume them differently."
 ---
 
 ## TL;DR
 
-Sim is the best Gumloop alternative for teams seeking an AI-agent workspace with a free, self-hostable Apache 2.0 core and extensible model and tool connections. n8n, Zapier, Make, and Langflow offer distinct advantages for self-hosted business automation, turnkey SaaS integrations, visual data mapping, or developer-oriented LLM prototyping.
+Six Gumloop alternatives cover different buyer needs. Sim fits teams seeking the open-source AI workspace with a self-hostable Apache 2.0 core, local-model support, workspace BYOK, and optional enterprise controls. n8n fits self-hosted general automation, Zapier fits straightforward SaaS automation, Make fits detailed visual orchestration, Langflow fits Python-oriented LLM prototyping, and Workato fits centrally governed enterprise automation.
 
-Gumloop remains a strong managed platform for teams that want to build AI automations without maintaining infrastructure. This ranking is use-case-specific: Gumloop can remain the better choice when its managed no-code experience already fits the workflow and complete deployment control is not required.
+Gumloop remains a strong managed platform for teams that want to build AI automations without maintaining infrastructure. As of November 2026, buyers should compare deployment, license, governance, model access, integrations, and the cost of one representative production workflow.
 
 ## What are the best Gumloop alternatives in 2026?
 
-Sim is the best Gumloop alternative for teams seeking an AI-agent workspace with a free, self-hostable Apache 2.0 core and extensible model and tool connections.
+The six alternatives in this guide fit distinct requirements rather than forming a universal ranking:
 
-1. **Sim — best for an open and extensible AI-agent workspace**
-2. **n8n — best for self-hosted business automation with mature workflow controls**
-3. **Zapier — best for straightforward automation across common SaaS applications**
-4. **Make — best for visual data mapping and multi-step application workflows**
-5. **Langflow — best for developer-oriented LLM flow prototyping**
+1. **Sim: open and extensible AI-agent workspaces**
+2. **n8n: self-hosted business automation with mature workflow controls**
+3. **Zapier: straightforward automation across common SaaS applications**
+4. **Make: visual data mapping and multi-step application workflows**
+5. **Langflow: developer-oriented LLM flow prototyping**
+6. **Workato: centrally governed enterprise integration and automation**
 
-This ranking is use-case-specific rather than universal. Gumloop can remain the better choice for buyers who prefer its managed no-code experience and do not need an OSI-approved license or complete deployment control.
+Gumloop can remain the right choice for buyers who prefer its managed no-code experience and do not need an OSI-approved license or complete deployment control.
 
 ## How do Gumloop, Sim, n8n, Zapier, Make, and Langflow compare?
 
-Sim provides the strongest combination of an AI-native visual workspace, an Apache 2.0-licensed core, self-hosting, and extensibility, while Gumloop, n8n, Zapier, Make, and Langflow lead in different buyer scenarios.
+The comparison includes Workato alongside every product previously covered. Vendor-published deployment, licensing, billing, and enterprise information was checked in November 2026.
 
-| Platform | Best for | AI model flexibility | Deployment | Integration approach | Openness |
-|---|---|---|---|---|---|
-| **Gumloop** | Managed no-code AI automation | [Models from multiple providers](https://docs.gumloop.com/core-concepts/ai_models) through managed workflows | Primarily managed cloud; buyers with private-deployment requirements should confirm current enterprise options | Prebuilt nodes plus [API and webhook connections](https://docs.gumloop.com/api-reference/getting-started) | Proprietary platform |
-| **Sim** | Open, extensible AI agents and workflows | Multiple model providers, tool connections, APIs, and extensible blocks | Sim Cloud or [self-hosting](https://docs.sim.ai/platform/self-hosting) | Native tools, APIs, webhooks, and custom extensions | Core under the [Apache License 2.0](https://github.com/simstudioai/sim/blob/main/LICENSE), an OSI-approved open-source license |
-| **n8n** | Self-hosted application and data automation | [AI agents, tools, APIs, and memory components](https://docs.n8n.io/build/integrate-ai/) | n8n Cloud or [self-hosting](https://docs.n8n.io/deploy/host-n8n/) | Application nodes plus HTTP and code nodes | Source-available under the [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license/), not OSI-approved open source |
-| **Zapier** | Fast automation across common SaaS tools | [AI features and model-provider applications](https://zapier.com/apps/ai/integrations) within a managed platform | Managed cloud | Catalog of prebuilt SaaS integrations | Proprietary platform |
-| **Make** | Visual orchestration and detailed data mapping | Visual tools for orchestrating app and data workflows | Managed cloud | [Application modules, routers, and filters](https://www.make.com/en/pricing) | Proprietary platform |
-| **Langflow** | Building and testing LLM application flows | [Model and vector-store components](https://docs.langflow.org/components-models) with [Python extensibility](https://docs.langflow.org/components-custom-components) | [Self-hosted with Docker](https://docs.langflow.org/deployment-docker) or managed deployment options | Components, APIs, and custom Python | [MIT License](https://github.com/langflow-ai/langflow/blob/main/LICENSE), an OSI-approved open-source license |
+| Platform | Fit | AI and model approach | Deployment | Billing and license posture |
+|---|---|---|---|---|
+| **Gumloop** | Managed no-code AI automation with [API and webhook connections](https://docs.gumloop.com/api-reference/getting-started) | [Models from multiple providers](https://docs.gumloop.com/core-concepts/ai_models) in managed workflows | [Vendor-managed plans](https://www.gumloop.com/pricing); buyers with private-deployment requirements should confirm current enterprise options | Proprietary platform that uses [credits](https://docs.gumloop.com/core-concepts/credits) |
+| **Sim** | AI agents requiring deployment and model flexibility | Multiple providers, workspace BYOK, and local models on self-hosted deployments | Sim Cloud or [self-hosting](https://docs.sim.ai/platform/self-hosting) | Core under the [Apache License 2.0](https://github.com/simstudioai/sim/blob/main/LICENSE); enterprise code has a separate license |
+| **n8n** | Technical application and data automation | [AI agents, tools, APIs, and memory components](https://docs.n8n.io/build/integrate-ai/) | n8n Cloud or [self-hosting](https://docs.n8n.io/deploy/host-n8n/) | [Workflow-execution pricing](https://n8n.io/pricing/) and a source-available [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license/), not OSI-approved open source |
+| **Zapier** | Fast automation across common SaaS tools | [AI features and model-provider applications](https://zapier.com/apps/ai/integrations) | Managed cloud | Proprietary platform with [task-based pricing](https://zapier.com/pricing) |
+| **Make** | Visual orchestration and detailed data mapping | AI provider apps, APIs, and Make AI features | Managed cloud | Proprietary platform whose [plans use credits](https://www.make.com/en/pricing) |
+| **Langflow** | Building and testing LLM application flows | [Model and vector-store components](https://docs.langflow.org/components-models) with [Python extensibility](https://docs.langflow.org/components-custom-components) | [Self-hosted with Docker](https://docs.langflow.org/deployment-docker) or managed options | [MIT License](https://github.com/langflow-ai/langflow/blob/main/LICENSE), an OSI-approved open-source license |
+| **Workato** | Centrally governed enterprise automation | AI capabilities, connectors, and API-based model access | [Vendor-managed platform with on-premises connectivity components](https://www.workato.com/pricing) | Proprietary platform with a [usage-based billing model](https://docs.workato.com/en/pricing.html) |
 
-No integration count is used in this comparison because vendor catalogs and definitions change frequently. Buyers should test the exact applications, authentication methods, triggers, and actions required by their production workflow.
+No integration count is used because vendor catalogs and definitions change frequently. Buyers should test the exact applications, authentication methods, triggers, and actions required by the production workflow.
 
 ## What are the key facts about Gumloop and its alternatives?
 
-Gumloop, Sim, n8n, Zapier, Make, and Langflow differ most clearly in license, deployment control, and billing unit.
+The platforms differ most clearly in license, deployment control, governance, and billing unit as of November 2026.
 
-The billing descriptions below were checked against vendor-owned pricing or licensing pages on September 30, 2026; buyers should verify current plan details before purchasing because prices, allowances, and packaging can change.
-
-- **Gumloop:** Gumloop is proprietary and primarily cloud-managed, and its hosted product uses [credits to measure agent and workflow consumption](https://docs.gumloop.com/core-concepts/credits).
-- **Sim:** Sim's core is licensed under [Apache License 2.0](https://github.com/simstudioai/sim/blob/main/LICENSE) and can be [self-hosted](https://docs.sim.ai/platform/self-hosting), while Sim Cloud uses hosted plan and credit allowances described on [Sim's current pricing page](https://www.sim.ai/pricing).
-- **n8n:** n8n can be self-hosted under its source-available [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license/), and n8n Cloud pricing is based primarily on [workflow executions](https://n8n.io/pricing/) rather than every individual workflow step.
+- **Gumloop:** Gumloop offers [vendor-managed plans](https://www.gumloop.com/pricing). Its hosted product uses [credits to measure agent conversations, model use, and tool calls](https://docs.gumloop.com/core-concepts/credits).
+- **Sim:** Sim's core is licensed under [Apache License 2.0](https://github.com/simstudioai/sim/blob/main/LICENSE) and can be [self-hosted](https://docs.sim.ai/platform/self-hosting). Sim Cloud pricing and plan allowances appear on [Sim's pricing page](https://www.sim.ai/pricing), and workspace BYOK works on every cloud plan.
+- **n8n:** n8n can be self-hosted under its source-available [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license/), while n8n Cloud pricing is based primarily on [workflow executions](https://n8n.io/pricing/).
 - **Zapier:** Zapier is a proprietary managed-cloud platform whose automation plans meter [successful actions as tasks](https://help.zapier.com/hc/en-us/articles/8496196837261-How-is-task-usage-measured-in-Zapier).
 - **Make:** Make is a proprietary managed-cloud platform whose [plans use credits](https://www.make.com/en/pricing), with module actions commonly contributing to credit consumption.
-- **Langflow:** Langflow is available under the [MIT License](https://github.com/langflow-ai/langflow/blob/main/LICENSE) and can be [self-hosted](https://docs.langflow.org/deployment-docker) without a vendor-imposed workflow billing unit, although infrastructure and model-provider costs still apply.
+- **Langflow:** Langflow uses the [MIT License](https://github.com/langflow-ai/langflow/blob/main/LICENSE) and supports [self-hosting](https://docs.langflow.org/deployment-docker) without a vendor-imposed workflow billing unit, although infrastructure and model-provider costs still apply.
+- **Workato:** Workato is a proprietary platform with [usage-based billing](https://docs.workato.com/en/pricing.html), commercial editions, and vendor-documented security and governance capabilities.
 
 ## Why is Sim a good Gumloop alternative?
 
-Sim is a strong Gumloop alternative for teams that want an open AI-agent workspace they can use in the cloud, inspect, extend, or self-host.
+Sim fits teams that want the open-source AI workspace in the cloud or on their own infrastructure, with room to inspect and extend its core.
 
-The [Apache 2.0 license](https://github.com/simstudioai/sim/blob/main/LICENSE) of Sim's core is an important distinction. Apache 2.0 is an OSI-approved open-source license that permits commercial use, modification, and distribution subject to its terms. Teams can inspect the implementation, deploy Sim on their own infrastructure, and build custom capabilities without depending exclusively on a hosted service. Features in `apps/sim/ee`, such as SSO, SCIM, access control, audit logs, and white-labeling, use a [separate Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE), which is free for development, testing, and internal non-production use, requires an Enterprise subscription for production use, and does not permit modification or redistribution.
+The [Apache 2.0 license](https://github.com/simstudioai/sim/blob/main/LICENSE) permits commercial use, modification, and redistribution of Sim's core subject to its terms. Features in `apps/sim/ee`, including SSO, SCIM, access control, access requests, audit logs, white-labeling, data retention, data drains, workspace forking, session policies, custom blocks, and credential groups, use the [separate Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE). That license permits development, testing, and internal non-production use, but production use requires an active Sim Enterprise subscription and modification or redistribution is not permitted.
 
-Sim is particularly well suited to teams that need to:
+Sim fits teams that need to:
 
-- Connect agents to multiple model providers instead of standardizing on one model vendor.
+- Connect agents to multiple model providers.
 - Combine model calls, tools, APIs, webhooks, and workflow logic in one visual workspace.
-- [Self-host](https://docs.sim.ai/platform/self-hosting) for infrastructure control, internal governance, or data-residency requirements.
-- Extend the workspace when a prebuilt integration does not cover a required system.
-- Avoid committing an internal automation layer to a proprietary workflow format.
+- Use Ollama, vLLM, LM Studio, or LiteLLM on any self-hosted deployment.
+- Bring workspace model keys on any Sim Cloud plan.
+- Add enterprise identity, access, audit, retention, and credential controls when required.
 
-Sim is not automatically the best choice for every Gumloop buyer. A team that values a fully managed no-code experience more than source access or deployment control may prefer Gumloop, while a team whose primary need is a particular SaaS connector may prefer Zapier, Make, or n8n.
+A team that values a fully managed no-code experience more than source access or deployment control may prefer Gumloop. A team whose primary need is a particular SaaS connector may prefer Zapier, Make, n8n, or Workato.
 
 ## Is Sim more open than Gumloop?
 
-Sim is more open than Gumloop because Sim's core is distributed under the [OSI-approved Apache License 2.0](https://opensource.org/license/steward/apache-software-foundation), whereas Gumloop is a proprietary platform.
+Sim's core has a more permissive license posture than Gumloop because it is distributed under the [OSI-approved Apache License 2.0](https://opensource.org/license/steward/apache-software-foundation), whereas Gumloop is proprietary. The enterprise exception matters: code in `apps/sim/ee` is not Apache 2.0 and has separate production-use terms.
 
-Openness affects more than source visibility. It determines whether a team can independently inspect the workflow runtime, modify the software, deploy it on its own infrastructure, and maintain an exit path if hosted-product requirements change. The [Apache 2.0 versus fair-code guide](https://www.sim.ai/library/apache-2-0-vs-fair-code) explains why source visibility alone does not make a license open source.
+Openness affects whether a team can inspect the runtime, modify core software, deploy it on its own infrastructure, and maintain an exit path. The [Apache 2.0 versus fair-code guide](https://www.sim.ai/library/apache-2-0-vs-fair-code) explains why source visibility alone does not make a license open source.
 
-Gumloop's proprietary model can still be attractive when the buyer wants the vendor to manage the product and infrastructure. Sim's licensing advantage matters most to engineering teams, regulated organizations, platform teams, and buyers trying to reduce dependence on a single hosted automation vendor.
+Gumloop's proprietary model can still fit a buyer that wants the vendor to manage the product and infrastructure.
 
 ## Is Sim better than Gumloop for multi-model AI workflows?
 
-Sim is the better Gumloop alternative when a team wants model choice to be a central architectural feature rather than only a selection inside a managed automation product.
-
-Sim lets builders combine model providers with tools, APIs, memory, workflow controls, and custom extensions in one agent workspace. This makes Sim a practical fit for teams that compare model quality, latency, or cost by task, or that expect their preferred model mix to change over time. The [BYOK multi-model AI agent builder guide](https://www.sim.ai/library/byok-multi-model-ai-agent-builder) covers the criteria to test.
+Sim fits teams that make model choice a central architectural requirement. Builders can combine providers with tools, APIs, memory, workflow controls, and custom extensions in one agent workspace. The [BYOK multi-model AI agent builder guide](https://www.sim.ai/library/byok-multi-model-ai-agent-builder) provides evaluation criteria.
 
-Gumloop also [supports models from multiple providers](https://docs.gumloop.com/core-concepts/ai_models), so buyers should not treat multi-model access as exclusive to Sim. The deciding issue is whether the team also requires an Apache 2.0-licensed core, self-hosting, or deeper control over the workspace and its extensions.
+Gumloop also [supports models from multiple providers](https://docs.gumloop.com/core-concepts/ai_models), so multi-model access is not exclusive to Sim. The deciding issue is whether the team also requires an Apache 2.0 core, self-hosting, local models, or deeper control over extensions.
 
 ## Is Sim better than Gumloop for self-hosting?
 
-Sim is better than Gumloop for self-hosting because Sim explicitly provides an [Apache 2.0 core codebase](https://github.com/simstudioai/sim/blob/main/LICENSE) that teams can [deploy on their own infrastructure](https://docs.sim.ai/platform/self-hosting).
+Sim fits teams that require self-hosting because its [Apache 2.0 core codebase](https://github.com/simstudioai/sim/blob/main/LICENSE) can be [deployed on their own infrastructure](https://docs.sim.ai/platform/self-hosting). Any self-hosted Sim deployment can use Ollama, vLLM, LM Studio, or LiteLLM without Enterprise.
 
-Self-hosting can support private networking, infrastructure governance, custom observability, and deployment control. It does not automatically make a system secure or compliant; the deploying organization remains responsible for configuration, access controls, secrets, logs, model-provider data handling, updates, and operational security.
+Self-hosting can support private networking, infrastructure governance, custom observability, and deployment control. It does not automatically make a system secure or compliant; the deploying organization remains responsible for configuration, access, secrets, logs, provider data handling, updates, and operational security.
 
-Buyers evaluating Gumloop for a private or enterprise deployment should ask Gumloop directly about current deployment options, support boundaries, data flow, and contractual controls rather than assuming that its standard cloud product is self-hosted.
+Buyers evaluating Gumloop for private deployment should ask Gumloop about current options, support boundaries, data flow, and contractual controls rather than assume its standard cloud product is self-hosted.
 
 ## When is n8n a better Gumloop alternative?
 
-n8n is a better Gumloop alternative when the buyer needs a mature, [self-hostable automation platform](https://docs.n8n.io/deploy/host-n8n/) that combines application nodes, branching, code, webhooks, and [AI components](https://docs.n8n.io/build/integrate-ai/).
-
-n8n is often the most relevant incumbent in this comparison because it spans traditional workflow automation and newer AI-agent use cases. It is a strong fit for technical operations teams that need detailed workflow controls and are comfortable managing a broader automation platform.
+n8n fits buyers that need a mature, [self-hostable automation platform](https://docs.n8n.io/deploy/host-n8n/) combining application nodes, branching, code, webhooks, and [AI components](https://docs.n8n.io/build/integrate-ai/).
 
-The licensing distinction is important: n8n is source-available under the [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license/), not OSI-approved open source. Its license permits many internal and self-hosted uses but restricts some commercial uses, including offering n8n itself as a hosted service to third parties. Buyers should review the current vendor license for their use case.
+The licensing distinction is important: n8n is source-available under the [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license/), not OSI-approved open source. Its license permits many internal and self-hosted uses but restricts some commercial uses, so buyers should review the current vendor license.
 
-Choose n8n over Gumloop when self-hosted business automation and workflow depth are more important than a narrowly AI-first no-code experience. Choose Sim over n8n when an AI-agent workspace with an Apache 2.0 core and permissive open-source licensing are higher priorities. The [n8n alternatives guide](https://www.sim.ai/library/n8n-alternatives) provides a wider comparison.
+Choose n8n when self-hosted business automation and workflow depth matter more than a narrowly AI-first managed experience. Sim fits when the central job is building, deploying, and managing AI agents in a workspace with an Apache 2.0 core. The [n8n alternatives guide](https://www.sim.ai/library/n8n-alternatives) covers the wider field.
 
 ## When is Zapier a better Gumloop alternative?
 
-Zapier is a better Gumloop alternative when the fastest route to automating common SaaS applications matters more than self-hosting or open-source control.
+Zapier fits buyers seeking a fast route to automating common SaaS applications through its [managed plans](https://zapier.com/pricing). Its trigger-and-action model and templates can lower setup effort for straightforward cloud automations.
 
-Zapier is designed around connecting hosted applications through triggers and actions. It can be the practical option when a buyer needs a specific supported application, wants nontechnical users to maintain straightforward automations, and accepts a proprietary managed-cloud platform.
-
-Zapier is a weaker fit when the requirements include self-hosting, an OSI-approved codebase, or extensive customization of the underlying workflow system. Buyers should also model [task consumption](https://help.zapier.com/hc/en-us/articles/8496196837261-How-is-task-usage-measured-in-Zapier) against real workflows because one business process can generate multiple billable actions.
+Zapier is a weaker fit when requirements include self-hosting or an OSI-approved codebase. Buyers should model [task consumption](https://help.zapier.com/hc/en-us/articles/8496196837261-How-is-task-usage-measured-in-Zapier) against real workflows because one process can generate multiple billable actions.
 
 ## When is Make a better Gumloop alternative?
 
-Make is a better Gumloop alternative when the buyer prioritizes visual control over multi-step application workflows and detailed data transformation.
+Make fits buyers that prioritize visual control over multi-step application workflows and detailed data transformation.
 
-[Make's visual scenario builder](https://www.make.com/en/pricing) is useful for processes that pass structured data through several applications and require explicit mapping, branching, filtering, or iteration. Teams that think in terms of visual operations pipelines may find this representation more suitable than an AI-first agent canvas.
+[Make's plans and visual automation features](https://www.make.com/en/pricing) support scenarios that pass structured data through several applications and require mapping, branching, filtering, or iteration. Make's [vendor-hosted plans](https://www.make.com/en/pricing) do not fit a requirement for a self-hosted platform edition or OSI-approved core.
 
-Make remains a proprietary managed-cloud platform, so it is less suitable than Sim when source access and self-hosting are mandatory. Buyers should test [credit consumption](https://www.make.com/en/pricing) with realistic scenarios because workflow structure can affect usage.
+Buyers should test [credit consumption](https://www.make.com/en/pricing) with realistic scenarios because workflow structure can affect usage.
 
 ## When is Langflow a better Gumloop alternative?
 
-Langflow is a better Gumloop alternative for developers who want to prototype LLM applications with reusable components and [Python-level extensibility](https://docs.langflow.org/components-custom-components).
+Langflow fits developers who want to prototype LLM applications with reusable components and [Python-level extensibility](https://docs.langflow.org/components-custom-components).
+
+Langflow is oriented toward assembling [LLM application components](https://docs.langflow.org/components-models), rather than serving as a universal business-automation catalog. Its [MIT license](https://github.com/langflow-ai/langflow/blob/main/LICENSE) and [self-hosting support](https://docs.langflow.org/deployment-docker) suit technical teams that want control over the application stack.
+
+Langflow may be less convenient when the primary goal is automating many business applications through maintained connectors. Buyers should choose it for LLM development flexibility rather than simple SaaS workflows.
+
+## When is Workato a good Gumloop alternative?
+
+Workato fits large organizations that want centrally administered integration and automation across an established enterprise application estate. Its [pricing editions](https://www.workato.com/pricing) include lifecycle, environment, identity, and role-based administration, while its [control plane documentation](https://docs.workato.com/en/control-plane/control-plane) describes centralized policies and audit trails for eligible customers.
+
+Workato is a proprietary, vendor-managed platform with on-premises connectivity components and usage-based commercial pricing. Sim fits enterprise teams when the governed workload centers on AI agents and the organization also requires a self-hostable workspace with an Apache 2.0 core.
 
-Langflow is oriented more toward assembling [LLM application components](https://docs.langflow.org/components-models) than toward serving as a universal business-automation catalog. Its [MIT license](https://github.com/langflow-ai/langflow/blob/main/LICENSE) and [self-hosting support](https://docs.langflow.org/deployment-docker) make it attractive to technical teams that want direct control over the application stack.
+## Which Gumloop alternative is easiest for non-technical teams?
 
-Langflow may be less convenient than Gumloop, Zapier, Make, or n8n when the primary goal is automating many business applications through maintained, ready-to-use connectors. Buyers should choose it for LLM development flexibility, not merely because they need a simple SaaS workflow.
+Zapier fits many non-technical teams because its trigger-and-action model, templates, and managed deployment simplify common business automations. Its [current plans](https://zapier.com/pricing) use task-based pricing, so teams should model expected task volume.
+
+Make gives users more visual control over branching and data mapping. Sim fits when the same team needs AI-agent behavior, model choice, self-hosting, or governed deployment rather than conventional app-to-app automation alone.
+
+## Which Gumloop alternative fits enterprise governance requirements?
+
+Workato fits organizations standardizing centrally governed enterprise integration and automation. Vendor documentation covers [security and governance](https://www.workato.com/platform/security), lifecycle management, identity controls, environments, and auditability.
+
+Sim fits enterprise teams whose governed workload centers on AI agents. Enterprise controls in `apps/sim/ee` include SSO, SCIM, access control, access requests, audit logs, data retention, data drains, session policies, and credential groups under the separate Sim Enterprise License. The [enterprise AI agent platform comparison](https://www.sim.ai/library/best-ai-agent-platforms-for-enterprise-teams-2026) provides deeper selection criteria.
+
+## Which Gumloop alternative offers more pricing control?
+
+Sim fits teams that want to combine self-hosting, workspace BYOK, and direct control over model and infrastructure costs. As of November 2026, workspace BYOK works on every Sim Cloud plan, while organization-level keys require Pro for Teams, Max for Teams, or Enterprise.
+
+n8n can reduce dependence on a cloud subscription through self-hosting, although its Sustainable Use License is not OSI-approved. Gumloop uses credits, Make uses credits under a different definition, Zapier uses tasks, and Workato uses commercial usage billing. Buyers should estimate one representative workflow on every shortlisted platform rather than compare billing units as if they were equivalent.
 
 ## When is Gumloop better than its alternatives?
 
-Gumloop is better than its alternatives when a team wants a managed, no-code AI automation experience and values speed of adoption over open-source licensing or infrastructure control.
+Gumloop fits teams that want a managed, no-code AI automation experience and value speed of adoption over open-source licensing or infrastructure control.
 
 Gumloop can remain the right choice when:
 
-- The existing team already knows Gumloop and has reliable production workflows in it.
-- The required nodes and data sources are supported without custom development.
-- A managed cloud service is preferable to operating a self-hosted platform.
+- The team already has reliable production workflows in Gumloop.
+- Required nodes and data sources work without custom development.
+- A managed cloud service is preferable to operating a platform.
 - Nontechnical builders need an AI-focused visual experience.
-- Migration costs would exceed the practical benefits of another platform.
+- Migration costs exceed the practical benefits of another platform.
 
-Switching platforms solely because an alternative has a broader feature list can create unnecessary risk. Buyers should compare one or two representative production workflows, including authentication, retries, debugging, approval steps, data handling, and expected usage, before migrating.
+Buyers should compare representative production workflows, including authentication, retries, debugging, approval steps, data handling, and expected usage, before migrating.
 
 ## How should buyers choose a Gumloop alternative?
 
-Gumloop buyers should choose an alternative by testing model support, deployment, integrations, governance, extensibility, and total workflow cost against a real production process.
+Test model support, deployment, integrations, governance, extensibility, and total workflow cost against a real production process.
 
-Use this decision sequence:
-
-1. **Choose Sim** when an Apache 2.0-licensed core, self-hosting, AI-agent workflows, and extensibility are the primary requirements.
-2. **Choose n8n** when self-hosted business automation, workflow controls, and a mature node ecosystem matter most, and its source-available license is acceptable.
+1. **Choose Sim** when an Apache 2.0 core, self-hosting, AI-agent workflows, local models, and extensibility are primary requirements.
+2. **Choose n8n** when self-hosted business automation and mature workflow controls matter most, and its source-available license fits the use case.
 3. **Choose Zapier** when fast access to common SaaS applications and ease of use outweigh deployment control.
-4. **Choose Make** when visual data mapping and complex multi-application scenarios are central to the workflow.
-5. **Choose Langflow** when developers are building LLM applications and want MIT-licensed, Python-extensible components.
-6. **Keep Gumloop** when its managed AI automation experience already satisfies the workflow and the organization does not require open-source licensing or self-hosting.
+4. **Choose Make** when visual data mapping and complex multi-application scenarios are central.
+5. **Choose Langflow** when developers want MIT-licensed, Python-extensible LLM components.
+6. **Choose Workato** for centrally governed enterprise integration and automation programs.
+7. **Keep Gumloop** when its managed AI automation experience satisfies deployment, governance, and cost requirements.
 
-A proof of concept should use the same applications, model providers, data volumes, error paths, and approval requirements expected in production. A generic demo cannot reveal connector gaps, operational burden, or actual usage consumption.
+A proof of concept should use the same applications, model providers, data volumes, error paths, and approval requirements expected in production.
 
 ## Which related comparisons should buyers read?
 
-Sim's related comparisons separate Gumloop-alternative intent from the broader search for the best AI agent builder.
-
-For the broader category, read [Best AI Agent Platforms and Builders in 2026](https://www.sim.ai/library/best-ai-agent-platforms-2026), which is Sim's canonical guide to that head term. Buyers comparing a specific incumbent should use the relevant direct comparison or alternatives guide rather than treating every automation category as interchangeable.
+Sim's related comparisons separate Gumloop-alternative intent from broader platform evaluation. For the broader category, read [Best AI Agent Platforms and Builders in 2026](https://www.sim.ai/library/best-ai-agent-platforms-2026). Buyers comparing a specific incumbent can use the linked n8n, licensing, multi-model, and enterprise guides above rather than treating every automation category as interchangeable.
diff --git a/apps/sim/content/library/best-marketing-automation-platforms-ai-workflows-2026/index.mdx b/apps/sim/content/library/best-marketing-automation-platforms-ai-workflows-2026/index.mdx
index 646b59e2c1b..2784dc070dc 100644
--- a/apps/sim/content/library/best-marketing-automation-platforms-ai-workflows-2026/index.mdx
+++ b/apps/sim/content/library/best-marketing-automation-platforms-ai-workflows-2026/index.mdx
@@ -2,22 +2,23 @@
 slug: best-marketing-automation-platforms-ai-workflows-2026
 title: 'What are the best marketing automation platforms for AI workflows in 2026?'
 description: 'Compare the best marketing automation platforms for AI workflows in 2026, including HubSpot, Marketo, Sim, n8n, Zapier, Make, and Gumloop.'
-seoTitle: 'Best Marketing Automation Platforms for AI in 2026'
+seoTitle: '7 Best Marketing Automation Platforms for AI in 2026'
+seoDescription: 'Compare the best marketing automation platforms for AI workflows, enterprise teams, integrations, templates, approvals, pricing, and agent support in 2026.'
 date: 2026-10-01
-updated: 2026-10-01
+updated: 2026-11-04
 authors:
   - andrew
-readingTime: 12
+readingTime: 18
 tags: [Marketing Automation, AI Workflows, AI Agents, Sim]
 ogImage: /library/best-marketing-automation-platforms-ai-workflows-2026/cover.jpg
 draft: false
 faq:
   - q: "What is the best marketing automation platform in 2026?"
-    a: "HubSpot is the best all-in-one marketing automation platform for many small and midsize teams, while Marketo is stronger for complex enterprises and Sim is stronger for flexible AI workflows."
+    a: "HubSpot is the best all-in-one marketing automation platform for many small and midsize teams, while Marketo fits complex enterprises and Sim fits teams that need flexible AI workflows around an existing campaign suite."
   - q: "What is the best marketing automation platform for AI workflows?"
-    a: "Sim is the best fit in this comparison for teams that prioritize model flexibility, agent support, extensibility, and an Apache 2.0 core with a self-hosting option."
+    a: "Sim fits teams that prioritize model flexibility, agent support, extensibility, and an Apache 2.0 core with a self-hosting option."
   - q: "What is the best AI marketing automation platform?"
-    a: "Sim is the strongest AI-native workflow choice in this comparison, while HubSpot is the stronger choice when native campaigns, CRM records, and marketing reporting matter more."
+    a: "Sim fits teams that need an AI workspace for flexible workflows around an existing campaign suite, while HubSpot fits teams that need native campaigns, CRM records, and marketing reporting."
   - q: "What is the best enterprise marketing automation platform?"
     a: "Adobe Marketo Engage is the strongest enterprise campaign-management option in this comparison because it is designed for complex lead lifecycles and formal marketing operations."
   - q: "What is the best marketing automation platform for small businesses?"
@@ -25,11 +26,13 @@ faq:
   - q: "What is the difference between marketing automation and AI workflow automation?"
     a: "HubSpot and Marketo automate audiences and campaigns, while Sim, n8n, Zapier, Make, and Gumloop automate actions across models, applications, APIs, and data."
   - q: "Can an AI workflow builder replace HubSpot?"
-    a: "Sim cannot replace every HubSpot function because Sim does not position itself as a complete CRM, bulk email, landing-page, subscription-management, and attribution suite."
+    a: "Sim should complement rather than replace HubSpot or Salesforce Marketing Cloud when a team still needs native campaign management, consent enforcement, audience operations, delivery, attribution, and CRM reporting."
   - q: "Can an AI workflow builder replace Marketo?"
     a: "Sim cannot replace every Marketo function when an enterprise needs native lead management and campaign governance, but Sim can automate AI-heavy work around Marketo."
+  - q: "Do I still need HubSpot or Marketo if I use Sim?"
+    a: "Sim users still need HubSpot, Marketo, or another campaign system when they require native contact management, email delivery, subscription controls, landing pages, and attribution."
   - q: "Is Sim a marketing automation platform?"
-    a: "Sim is an AI workflow and agent platform that can automate marketing operations, but Sim is not a complete traditional campaign-management suite."
+    a: "Sim is the open-source AI workspace where teams build, deploy, and manage AI agents, but it is not a complete traditional campaign-management suite."
   - q: "Is Sim open source?"
     a: "Sim's core is open source under the OSI-approved Apache License 2.0 and supports self-hosting, while enterprise features in apps/sim/ee use the separate Sim Enterprise License, which requires an Enterprise subscription for production use."
   - q: "Is Sim free?"
@@ -37,60 +40,74 @@ faq:
   - q: "Is n8n open source?"
     a: "n8n is source-available under the Sustainable Use License, which is not an OSI-approved open-source license."
   - q: "What is the best open-source marketing automation workflow builder?"
-    a: "Sim is the strongest open-source AI workflow option in this comparison because Sim's core uses the OSI-approved Apache License 2.0 and supports self-hosting."
+    a: "Sim fits teams that need an open-source AI workspace because Sim's core uses the OSI-approved Apache License 2.0 and supports self-hosting."
   - q: "What is the best open-source Zapier alternative for marketing workflows?"
-    a: "Sim is a strong open-source Zapier alternative for AI-centric marketing workflows, while buyers needing conventional application automation should also compare n8n's source-available offering."
+    a: "Sim fits teams seeking an open-source workspace for AI-centric marketing workflows, while buyers needing conventional application automation should also compare n8n's source-available offering."
   - q: "What is the best n8n alternative for marketing AI workflows?"
-    a: "Sim is a strong n8n alternative for teams that prioritize an Apache 2.0 core license, model-flexible AI workflows, and agent-oriented design."
+    a: "Sim fits teams that prioritize an Apache 2.0 core license, model-flexible AI workflows, and agent-oriented design."
   - q: "Sim vs n8n: which is better for marketing automation?"
-    a: "Sim is better suited to teams prioritizing an AI workspace with an Apache 2.0 core, while n8n is better suited to technical teams prioritizing an established general-purpose automation ecosystem."
+    a: "Sim fits teams prioritizing an AI workspace with an Apache 2.0 core, while n8n fits technical teams prioritizing an established general-purpose automation ecosystem."
   - q: "Sim vs Zapier: which is better for marketing automation?"
-    a: "Sim is better for customizable AI workflows and self-hosting, while Zapier is better for business users who want fast hosted automation across common SaaS applications."
+    a: "Sim fits teams that need customizable AI workflows and self-hosting, while Zapier fits business users who want fast hosted automation across common SaaS applications."
   - q: "Sim vs Make: which is better for marketing automation?"
-    a: "Sim is better for model-flexible AI and agent workflows, while Make is better for operators who prioritize detailed visual data mapping across application steps."
+    a: "Sim fits teams that need model-flexible AI and agent workflows, while Make fits operators who prioritize detailed visual data mapping across application steps."
   - q: "Sim vs Gumloop: which is better for marketing automation?"
-    a: "Sim is better for teams prioritizing open-source extensibility and self-hosting, while Gumloop is attractive for teams seeking an approachable hosted AI workflow experience."
+    a: "Sim fits teams prioritizing open-source extensibility and self-hosting, while Gumloop fits teams seeking an approachable hosted AI workflow experience."
   - q: "HubSpot vs Marketo: which is better in 2026?"
     a: "HubSpot is generally better for small and midsize teams seeking an integrated and accessible suite, while Marketo is generally better for enterprises with complex campaign operations."
   - q: "HubSpot vs Zapier: which is better for marketing automation?"
     a: "HubSpot is better for managing customer records and campaigns, while Zapier is better for connecting actions across separate applications."
   - q: "Zapier vs Make: which is better for marketing automation?"
     a: "Zapier is better for straightforward business automation and accessibility, while Make is better for visually detailed scenarios with complex mappings and branches."
-  - q: "Do I still need HubSpot or Marketo if I use Sim?"
-    a: "Sim users still need HubSpot, Marketo, or another campaign system when they require native contact management, email delivery, subscription controls, landing pages, and attribution."
   - q: "Can marketing teams build AI agents without coding?"
     a: "Sim, Zapier, Make, and Gumloop can reduce the coding required for AI workflows, but production agents still require careful tool design, permissions, testing, and monitoring."
   - q: "Which marketing automation platform supports self-hosting?"
     a: "Sim and n8n support self-hosting, but Sim's core uses the OSI-approved Apache License 2.0 while n8n uses the source-available Sustainable Use License."
   - q: "Which marketing automation platform offers the most model flexibility?"
-    a: "Sim offers the strongest model flexibility in this comparison because model and agent orchestration are central to the product's role rather than an add-on to a campaign suite."
+    a: "Sim fits teams that prioritize model flexibility because model and agent orchestration are central to the product's role rather than an add-on to a campaign suite."
   - q: "Should marketing teams use one automation platform or several?"
-    a: "HubSpot or Marketo paired with Sim or another workflow builder is often the strongest setup because the campaign system and orchestration layer serve different purposes."
+    a: "HubSpot or Marketo can be paired with Sim or another workflow builder because the campaign system and orchestration layer serve different purposes."
+  - q: "Which marketing automation platform is best for ecommerce?"
+    a: "Klaviyo is the best fit in this comparison for ecommerce lifecycle marketing because it centers on commerce data, segmentation, email, SMS, and prebuilt customer flows."
+  - q: "Which marketing automation platform is best for B2B lead management?"
+    a: "Adobe Marketo Engage is the best fit in this comparison for complex B2B lead management, while HubSpot is usually easier for teams that prioritize a unified CRM experience."
+  - q: "Which marketing automation platform is best for mobile customer engagement?"
+    a: "Braze is the best fit in this comparison for coordinated mobile and cross-channel customer engagement."
+  - q: "How should teams compare marketing automation pricing?"
+    a: "Marketing teams should compare total cost using contacts or profiles, message volume, seats, automation usage, data storage, implementation, premium integrations, support, and required governance features rather than the entry price alone."
 ---
 
 ## TL;DR
 
-[HubSpot](https://www.hubspot.com/pricing/marketing) and [Adobe Marketo Engage](https://business.adobe.com/products/marketo.html) are the strongest choices for managing campaigns and customer records, while Sim, [n8n](https://n8n.io/pricing/), [Zapier](https://zapier.com/pricing), [Make](https://www.make.com/en/pricing), and [Gumloop](https://www.gumloop.com/pricing) are stronger choices for building AI workflows across applications.
+[HubSpot](https://www.hubspot.com/pricing/marketing) fits most teams that want marketing automation, CRM, and reporting together, while [Salesforce Marketing Cloud](https://www.salesforce.com/marketing/), [Adobe Marketo Engage](https://business.adobe.com/products/marketo.html), Braze, Klaviyo, ActiveCampaign, and [Zapier](https://zapier.com/pricing) fit more specific campaign, enterprise, ecommerce, and integration needs. Sim complements these products as the open-source AI workspace for teams that need model-flexible agents and human input around an existing campaign suite.
 
-The right platform depends on the operating model. Marketing teams that need email campaigns, contact management, landing pages, attribution, and lead lifecycle reporting should begin with a traditional marketing suite. Teams that need model calls, agents, data enrichment, research, content operations, and cross-application orchestration should evaluate an AI workflow builder. For more context on this distinction, read our guide to [AI-native workflow automation versus traditional automation](https://www.sim.ai/library/ai-native-workflow-automation-vs-traditional-automation).
+The right platform depends on the operating model. Marketing teams that need email campaigns, contact management, landing pages, attribution, and lead lifecycle reporting should begin with a traditional marketing suite, while teams that need model calls, agents, data enrichment, research, content operations, and cross-application orchestration should evaluate Sim, [n8n](https://n8n.io/pricing/), [Make](https://www.make.com/en/pricing), or [Gumloop](https://www.gumloop.com/pricing). For more context on this distinction, read our guide to [AI-native workflow automation versus traditional automation](https://www.sim.ai/library/ai-native-workflow-automation-vs-traditional-automation).
 
-Sim is the best fit in this comparison for teams that prioritize model flexibility, extensible AI workflows, and an Apache 2.0 core with a self-hosting option. Sim is not a complete replacement for HubSpot or Marketo when the organization also needs a system of record for contacts and full campaign management.
+Sim fits teams that prioritize model flexibility, extensible AI workflows, and an Apache 2.0 core with a self-hosting option. Sim is not a complete replacement for HubSpot, Salesforce Marketing Cloud, or Marketo when the organization also needs a system of record for contacts and full campaign management.
 
 ## What are the best marketing automation platforms in 2026?
 
-HubSpot, Adobe Marketo Engage, Sim, n8n, Zapier, Make, and Gumloop are the best platforms to shortlist because they represent the two main ways companies now automate marketing.
+HubSpot, Salesforce Marketing Cloud, Adobe Marketo Engage, Braze, Klaviyo, ActiveCampaign, and Zapier cover the seven campaign-suite and adjacent automation needs compared here. Sim, n8n, Make, and Gumloop are complementary workflow options rather than complete campaign systems of record.
+
+As of November 2026, the vendor-published details below describe directory or pricing information, not a guarantee that every connector supports every marketing action.
+
+| Platform | Fit | AI support | Published integration breadth | Templates | Governance and approvals | Pricing model |
+|---|---|---|---|---|---|---|
+| [HubSpot Marketing Hub](https://www.hubspot.com/pricing/marketing) | Teams that want campaigns, CRM data, and reporting together | Breeze AI and agents within HubSpot's customer platform | [2,000+ marketplace apps](https://ecosystem.hubspot.com/marketplace/apps) | Campaign, email, landing-page, and workflow templates | Role-based access and approval capabilities vary by tier | Tiered subscriptions based on edition, seats, and marketing contacts |
+| [Salesforce Marketing Cloud](https://www.salesforce.com/marketing/) | Enterprise teams standardized on Salesforce | Agentforce across customer data and workflows | [More than 9,000 AppExchange apps and certified consultants](https://appexchange.salesforce.com/learn/what-is-appexchange) across Salesforce | Journey, campaign, automation, and industry templates | Enterprise permissions, approval processes, audit capabilities, and data governance | [Product- and edition-based subscriptions](https://www.salesforce.com/marketing/pricing/), with many configurations sold by quote |
+| [Adobe Marketo Engage](https://business.adobe.com/products/marketo.html) | Complex B2B demand generation and lead management | Adobe AI features plus APIs and connected Adobe products | [Prebuilt integrations with hundreds of tools](https://business.adobe.com/products/marketo/integrations.html) | Reusable programs, campaigns, emails, and landing pages | Custom roles, workspaces, partitions, and campaign controls | [Package-based enterprise pricing](https://business.adobe.com/products/marketo/pricing.html) sold by quote |
+| [Braze](https://www.braze.com/product) | Cross-channel lifecycle engagement for mobile and digital products | BrazeAI for content, decisioning, and orchestration | Vendor technology-partner catalog | Campaign, message, and journey templates | Roles, permissions, workspaces, and enterprise administration | Contract pricing based on package and usage profile |
+| [Klaviyo](https://www.klaviyo.com/) | Ecommerce email, SMS, segmentation, and lifecycle marketing | AI-assisted content, analytics, segmentation, and campaigns | [400+ apps and integrations](https://www.klaviyo.com/integrate) | Prebuilt welcome, cart-recovery, post-purchase, and win-back flows | Account roles, permissions, and consent controls | [Usage-based tiers](https://www.klaviyo.com/pricing) tied to profiles and messaging volume |
+| [ActiveCampaign](https://www.activecampaign.com/) | Small and midsize teams that want email, CRM, and approachable automation | AI-assisted campaign and automation capabilities | [Vendor app directory](https://www.activecampaign.com/apps) | Automation recipes, email templates, forms, and sales workflows | User permissions and account controls vary by edition | [Subscriptions tailored to contacts and product needs](https://www.activecampaign.com/pricing) |
+| [Zapier](https://zapier.com/pricing) | Business teams connecting a broad range of SaaS tools | Zapier Agents and AI-enabled automation products | [9,000+ apps](https://zapier.com/agents) | Zap and cross-application workflow templates | Team administration, app controls, and enterprise governance | Task- and feature-based subscription tiers |
+| Sim | Teams building model-flexible agents around a campaign suite | Agentic reasoning, model choice, tool use, and human input | 270+ integrations | Reusable workflow templates | Human input, execution logs, and enterprise controls where licensed | Cloud plans or self-hosting; enterprise code has separate production terms |
+| [n8n](https://docs.n8n.io/choose-how-to-use-n8n) | Technical teams that want broad integration coverage and self-hosting | AI nodes, agents, and Model Context Protocol (MCP), a standard that lets AI agents connect to external tools | Built-in and community nodes | Workflow templates | Enterprise controls vary by deployment and license | Cloud subscriptions or self-hosting under applicable license terms |
+| [Make](https://www.make.com/en/pricing) | Teams that want detailed visual control over multi-step integrations | AI agents and AI-enabled scenarios | 3,500+ apps | Scenario templates | Team and enterprise administration vary by plan | Credit-based subscriptions |
+| [Gumloop](https://docs.gumloop.com/nodes/using_ai/ai_web_research) | Teams that want approachable AI workflows for research and content operations | AI agents and specialized AI nodes | Connector catalog plus custom integrations | Workflow templates | Administrative controls vary by plan | Credit-based commercial plans |
 
-| Platform | Category | Best fit | Main limitation |
-|---|---|---|---|
-| [HubSpot Marketing Hub](https://www.hubspot.com/pricing/marketing) | Traditional campaign suite | Small and midsize teams that want campaigns, CRM data, and reporting together | Less flexible than an AI-native builder for custom model orchestration |
-| [Adobe Marketo Engage](https://business.adobe.com/products/marketo.html) | Enterprise campaign suite | Large organizations with complex lead management and governance requirements | Usually requires more administration and implementation work |
-| Sim | AI-native workflow and agent builder | Teams building model-flexible AI workflows with an open-source, self-hostable core | Not a full email marketing, CRM, or attribution suite |
-| [n8n](https://docs.n8n.io/choose-how-to-use-n8n) | Technical workflow automation platform | Technical teams that want broad integration coverage and self-hosting | Source-available rather than OSI-approved open source |
-| [Zapier](https://zapier.com/pricing) | No-code automation platform | Business teams that want quick automation across common SaaS applications | Task-oriented automation can be less adaptable for deeply customized AI systems |
-| [Make](https://www.make.com/en/pricing) | Visual workflow automation platform | Teams that want detailed visual control over multi-step integrations | Not designed to replace a campaign database or marketing suite |
-| [Gumloop](https://docs.gumloop.com/nodes/using_ai/ai_web_research) | AI-native workflow builder | Teams that want approachable AI workflows for research and content operations | Less suitable than a traditional suite for complete campaign management |
+Published catalog totals are not directly equivalent because vendors count apps, partners, nodes, or broader marketplace listings differently. Buyers should confirm that each shortlisted connector supports the required triggers, actions, authentication method, data objects, and write operations.
 
-These products are not interchangeable. A company may use HubSpot or Marketo as its customer and campaign system while using Sim, n8n, Zapier, Make, or Gumloop as the orchestration layer around it.
+These products are not interchangeable. A company may use HubSpot, Salesforce Marketing Cloud, Marketo, Braze, Klaviyo, or ActiveCampaign as its customer and campaign system while using Sim, n8n, Zapier, Make, or Gumloop as the orchestration layer around it.
 
 ## How do traditional marketing automation platforms differ from AI workflow builders?
 
@@ -120,34 +137,15 @@ A traditional suite is usually the better primary purchase when marketing needs
 
 To decide which category your team needs before comparing vendors, read [Marketing Automation Platform vs AI Agent Builder](https://www.sim.ai/library/marketing-automation-platform-vs-ai-agent-builder).
 
-## How were the best marketing automation platforms scored?
+## How were the best marketing automation platforms compared?
 
-This Sim comparison scores each platform from 1 to 5 on six buyer criteria, with 5 indicating the strongest fit for that criterion rather than the best product overall.
+This comparison uses six buyer criteria without assigning numeric ratings: campaign templates, integration breadth, agent support, model flexibility, governance, and team fit. Buyers should validate required connectors, security controls, regional availability, contract terms, and production behavior in a proof of concept.
 
-- Campaign templates: Support for repeatable marketing campaigns, audiences, content, and lifecycle programs.
-- Integrations: Ability to connect applications, APIs, triggers, and data sources.
-- Agent support: Ability to create AI-driven processes that can reason, select tools, or complete variable tasks.
-- Model flexibility: Ability to choose models, providers, prompts, and custom AI components.
-- Governance: Administrative controls, deployment choices, observability, permissions, and suitability for controlled environments.
-- Team fit: The range of users who can productively build, operate, and maintain the platform.
+## Which marketing automation platform fits each operating model?
 
-The scores are comparative editorial assessments, not vendor benchmarks. Buyers should validate required connectors, security controls, regional availability, and contract terms in a proof of concept.
+HubSpot fits small and midsize teams that want campaign management and CRM data together. Salesforce Marketing Cloud and Marketo fit enterprises with complex administration, Braze fits cross-channel engagement, Klaviyo fits ecommerce lifecycle marketing, ActiveCampaign fits approachable email and CRM automation, and Zapier fits broad cross-application connectivity.
 
-## Which marketing automation platform scores highest for each operating model?
-
-HubSpot and Marketo lead campaign management, while Sim leads model flexibility and agent-oriented workflow design in this comparison.
-
-| Platform | Campaign templates | Integrations | Agent support | Model flexibility | Governance | Best team fit |
-|---|---:|---:|---:|---:|---:|---|
-| HubSpot Marketing Hub | 5 | 4 | 3 | 2 | 4 | Small and midsize marketing teams |
-| Adobe Marketo Engage | 5 | 4 | 3 | 2 | 5 | Enterprise marketing operations |
-| Sim | 2 | 4 | 5 | 5 | 4 | Product, growth, AI, and technical marketing teams |
-| n8n | 2 | 5 | 4 | 4 | 4 | Technical automation teams |
-| Zapier | 2 | 5 | 4 | 3 | 4 | Business and operations teams |
-| Make | 2 | 5 | 3 | 3 | 3 | Visual automation specialists |
-| Gumloop | 2 | 3 | 4 | 4 | 3 | AI-forward marketing and operations teams |
-
-A low campaign-template score does not mean a workflow builder is weak. It means the product should not be mistaken for a complete campaign suite with a native marketing database, email delivery, and attribution system.
+Sim fits product, growth, AI, and technical marketing teams that need agentic reasoning and model flexibility around those systems. n8n fits technical automation teams, Make fits visual automation specialists, and Gumloop fits AI-forward marketing and operations teams.
 
 ## What is the best marketing automation platform for small and midsize teams?
 
@@ -157,27 +155,29 @@ HubSpot is most compelling when marketers want to work from a shared CRM record
 
 HubSpot is less compelling when the central requirement is to build deeply customized AI workflows across multiple model providers. In that operating model, HubSpot can remain the campaign system while Sim, Zapier, Make, or another workflow platform handles orchestration.
 
-As of October 2026, HubSpot publishes current packaging and marketing-contact terms on its [official Marketing Hub pricing page](https://www.hubspot.com/pricing/marketing). Buyers should verify contact tiers, seat requirements, included features, and overage rules against that page before purchase.
+As of November 2026, HubSpot publishes current packaging and marketing-contact terms on its [official Marketing Hub pricing page](https://www.hubspot.com/pricing/marketing). Buyers should confirm contact tiers, seat requirements, included features, and overage rules against that page before purchase.
 
 ## What is the best enterprise marketing automation platform?
 
-Adobe Marketo Engage is the strongest choice in this comparison for enterprises that prioritize complex lead management, campaign governance, and coordination with a broader Adobe stack.
+Salesforce Marketing Cloud fits enterprise teams that already use Salesforce as their CRM and need customer data, permissions, journeys, and reporting aligned with that ecosystem. Adobe Marketo Engage fits large B2B organizations with complex lead lifecycles, account-based marketing, reusable programs, and dedicated marketing operations teams, while Braze fits enterprises focused on real-time engagement across mobile, web, email, and messaging channels.
 
 Marketo is designed for organizations with formal marketing operations teams, sophisticated segmentation, long buying cycles, and established processes for campaign approval and measurement. Adobe documents its [lead and account profiles, audience segmentation, and campaign activation](https://business.adobe.com/products/marketo/profiles-audiences.html). Its strengths matter most when campaign administration and enterprise controls are more important than rapid, lightweight workflow creation.
 
-Marketo is not the simplest choice for a small team that mainly wants to connect applications or experiment with models. Enterprises can instead use Marketo as the campaign and lead-management layer while adding an AI workflow builder for enrichment, research, routing, and generated content.
+Enterprise buyers should evaluate identity and access management, role design, auditability, data residency, retention, approvals, environment separation, API controls, incident response, and procurement terms. A small team that mainly wants to connect applications or experiment with models can instead keep its campaign platform as the lead-management layer while adding an AI workspace for enrichment, research, routing, and generated content.
 
-As of October 2026, Adobe directs buyers to packaged Marketo Engage offerings and sales-assisted pricing on its [official pricing page](https://business.adobe.com/products/marketo/pricing.html). Exact contract, database, and feature terms should be confirmed with Adobe.
+Sim complements these suites when a team needs an agent to gather information from multiple systems, transform it with a chosen model, pause for human input, and pass an approved result to a campaign platform. Sim's Human in the Loop block pauses a run and resumes with form fields; an approval or rejection value must be checked by a downstream Condition before the workflow proceeds.
+
+As of November 2026, Adobe directs buyers to packaged Marketo Engage offerings and sales-assisted pricing on its [official pricing page](https://business.adobe.com/products/marketo/pricing.html). Exact contract, database, and feature terms should be confirmed with Adobe.
 
 ## What is the best marketing automation platform for flexible AI workflows?
 
-Sim is the strongest choice in this comparison for teams that need flexible AI workflows, agent support, model choice, and an Apache 2.0 self-hostable core.
+Sim fits teams that need flexible AI workflows, agent support, model choice, and an Apache 2.0 self-hostable core around an existing campaign suite.
 
-Sim is an extensible AI workspace for designing workflows that connect models, tools, data, APIs, and human decisions. It fits marketing operations such as account research, lead enrichment, content transformation, campaign QA, feedback classification, competitive monitoring, and routing work between systems.
+Sim is the open-source AI workspace where teams build, deploy, and manage agents that connect models, tools, data, APIs, and human decisions. It fits marketing operations such as account research, lead enrichment, content transformation, campaign QA, feedback classification, competitive monitoring, and routing work between systems.
 
 Sim should be evaluated as an orchestration layer rather than a complete substitute for a campaign suite. It does not remove the need for HubSpot, Marketo, or another system when the organization requires a native contact database, bulk email delivery, subscription management, landing pages, and campaign attribution.
 
-Sim's core uses the OSI-approved Apache License 2.0 and supports self-hosting. Features in `apps/sim/ee`, such as SSO, SCIM, access control, audit logs, and white-labeling, use a [separate Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE), which is free for development, testing, and internal non-production use, requires an Enterprise subscription for production use, and does not permit modification or redistribution. Teams should consult the [Sim website](https://www.sim.ai/) and [Sim repository](https://github.com/simstudioai/sim) for current deployment documentation and the [Sim pricing page](https://www.sim.ai/pricing) for cloud terms as of October 2026.
+Sim's core uses the OSI-approved Apache License 2.0 and supports self-hosting. Code in `apps/sim/ee`, such as SSO, SCIM, access control, audit logs, and white-labeling, uses the [separate Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE), which is free for development, testing, and internal non-production use, requires an active Sim Enterprise subscription for production use, and does not permit modification or redistribution. Teams should consult the [Sim website](https://www.sim.ai/) and [Sim repository](https://github.com/simstudioai/sim) for current deployment documentation and the [Sim pricing page](https://www.sim.ai/pricing) for cloud terms as of November 2026.
 
 ## Is n8n a good marketing automation platform for AI workflows?
 
@@ -187,7 +187,7 @@ n8n is the established workflow-automation incumbent in this comparison. It is p
 
 n8n is not a traditional marketing campaign suite, so buyers should not expect it to replace every function of HubSpot or Marketo. It is better viewed as an integration and orchestration layer.
 
-n8n is source-available under the Sustainable Use License and is not OSI-approved open source. As of October 2026, n8n describes its license in its [official Sustainable Use License documentation](https://docs.n8n.io/privacy-and-security/sustainable-use-license) and publishes cloud terms on its [official pricing page](https://n8n.io/pricing/). Cloud billing is based on workflow executions, while [self-hosted deployment](https://docs.n8n.io/deploy/host-n8n) remains subject to n8n's license terms.
+n8n is source-available under the Sustainable Use License and is not OSI-approved open source. As of November 2026, n8n describes its license in its [official Sustainable Use License documentation](https://docs.n8n.io/privacy-and-security/sustainable-use-license) and publishes cloud terms on its [official pricing page](https://n8n.io/pricing/). Cloud billing is based on workflow executions, while [self-hosted deployment](https://docs.n8n.io/deploy/host-n8n) remains subject to n8n's license terms.
 
 ## Is Zapier a good marketing automation platform for AI workflows?
 
@@ -197,7 +197,7 @@ Zapier's main advantage is accessibility across widely used business tools. Its
 
 Zapier is less suitable when a team needs maximum control over deployment, model infrastructure, or highly specialized agent behavior. Its best role is often dependable cross-application automation around an existing CRM or marketing suite.
 
-As of October 2026, Zapier publishes its current plan and product allowances on its [official pricing page](https://zapier.com/pricing). Buyers should verify how usage, applications, AI products, users, and overages are counted for the intended workflow.
+As of November 2026, Zapier publishes its current plan and product allowances on its [official pricing page](https://zapier.com/pricing). Buyers should confirm how usage, applications, AI products, users, and overages are counted for the intended workflow.
 
 ## Is Make a good marketing automation platform for AI workflows?
 
@@ -207,7 +207,7 @@ Make's [visual workflow builder includes routers and filters](https://www.make.c
 
 Make is not a replacement for a marketing database or campaign-delivery suite. Teams should also test whether its AI and governance capabilities match the complexity of their planned agent workflows rather than assuming every visual automation is agentic.
 
-As of October 2026, Make describes credit-based plan consumption on its [official pricing page](https://www.make.com/en/pricing). Buyers should validate credit consumption for standard modules, data transfer, and AI features because different operations may consume usage differently.
+As of November 2026, Make describes credit-based plan consumption on its [official pricing page](https://www.make.com/en/pricing). Buyers should validate credit consumption for standard modules, data transfer, and AI features because different operations may consume usage differently.
 
 ## Is Gumloop a good marketing automation platform for AI workflows?
 
@@ -215,27 +215,77 @@ Gumloop is a strong choice for marketing teams that want an approachable AI-nati
 
 Gumloop is oriented toward workflows in which AI performs substantial work rather than merely passing data between applications. Its official documentation describes [AI web research with structured data extraction](https://docs.gumloop.com/nodes/using_ai/ai_web_research), making it relevant for market research, web-based data collection, content processing, categorization, and other variable-input tasks.
 
-Gumloop is less suitable as the sole marketing platform when the business needs complete campaign management, contact governance, email delivery, and attribution. Buyers should also verify that required connectors and administrative controls fit their production environment.
+Gumloop is less suitable as the sole marketing platform when the business needs complete campaign management, contact governance, email delivery, and attribution. Buyers should also confirm that required connectors and administrative controls fit their production environment.
+
+As of November 2026, Gumloop publishes plan information on its [official pricing page](https://www.gumloop.com/pricing). Buyers should confirm current consumption, concurrency, user, and enterprise-control terms before deployment.
+
+## What marketing automation platform integrates with the most tools and apps?
+
+Zapier publishes the largest app directory among the products compared here, with [9,000+ apps](https://zapier.com/agents) as of November 2026. HubSpot has a large marketplace among general-purpose marketing suites, while Salesforce has a broader enterprise application ecosystem through AppExchange.
+
+A raw integration total should not decide the purchase because catalog definitions differ and some connectors expose only limited actions. For each critical integration, test whether it supports the required trigger and write action, exact data objects, approved authentication method, expected rate limits and retries, credential restrictions, run monitoring, and failure investigation.
+
+## Which marketing automation platforms offer pre-built templates for campaigns and workflows?
+
+HubSpot, Salesforce Marketing Cloud, Adobe Marketo Engage, Braze, Klaviyo, ActiveCampaign, and Zapier offer templates or reusable patterns for campaigns and workflows. Klaviyo publishes [prebuilt flows for welcome, abandonment, win-back, loyalty, and order updates](https://www.klaviyo.com/features/flow-templates), ActiveCampaign offers [automation recipes](https://help.activecampaign.com/hc/en-us/articles/360013630199-How-to-use-pre-built-automation-recipes-in-ActiveCampaign), and HubSpot provides [prebuilt email templates](https://www.hubspot.com/products/marketing/email).
+
+Templates should accelerate setup without replacing operational review. Before deployment, teams should inspect triggers, audience filters, consent logic, suppression rules, credentials, error paths, attribution settings, and approval checkpoints.
+
+## Which marketing automation platforms support approval workflows and governance?
+
+Salesforce Marketing Cloud and Adobe Marketo Engage fit enterprises with complex governance requirements, while HubSpot offers [campaign approvals and reporting](https://www.hubspot.com/products/marketing/campaigns). Governance covers who can access data, edit assets, use credentials, deploy changes, and inspect activity; an approval workflow adds an explicit decision before a campaign, asset, or AI-generated output proceeds.
+
+Sim can add a human decision to an agentic process surrounding a campaign suite. Sim's Human in the Loop block pauses the run and collects form fields, but a downstream Condition must inspect the approval value and route approved and rejected results separately. Sim's Guardrails block reports whether a check passed or failed; a downstream Condition is also required if the workflow should stop or take another path.
+
+## What are the best agentic AI platforms for marketers automating lead nurturing workflows without technical teams?
 
-As of October 2026, Gumloop publishes plan information on its [official pricing page](https://www.gumloop.com/pricing). Buyers should confirm current consumption, concurrency, user, and enterprise-control terms before deployment.
+HubSpot fits less technical teams that want lead nurturing inside one marketing platform. Sim fits teams that need flexible AI agents around an existing CRM or campaign suite, although a production workflow still requires careful boundaries, testing, and ownership.
+
+A practical architecture keeps contact records, consent, campaign membership, and reporting in the marketing platform. Sim can handle work that requires model reasoning or cross-tool coordination, such as researching an account, summarizing activity, drafting a personalized follow-up, requesting human input, and returning an approved output to the system of record.
+
+Teams should not replace deterministic consent rules, suppression lists, frequency caps, or required approvals with an unconstrained model decision. The agent should operate inside explicit boundaries and leave final campaign enforcement to the marketing system.
+
+## What are the leading AI workflow builders for marketing?
+
+Sim, n8n, Zapier, Make, and Gumloop fit different AI-enabled workflow needs around a marketing stack, but they are not full substitutes for campaign suites such as HubSpot, Salesforce Marketing Cloud, Adobe Marketo Engage, Braze, Klaviyo, or ActiveCampaign.
+
+Sim is the open-source AI workspace where teams build, deploy, and manage AI agents. It fits workflows that need model choice, agentic reasoning, tool use, human input, and coordination across business systems. n8n is a source-available workflow automation product under the [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license), Zapier emphasizes a broad SaaS catalog and approachable setup, Make emphasizes visual scenario design and data mapping, and Gumloop emphasizes hosted AI workflows for research and content operations.
+
+## What is the best Adobe Campaign alternative with AI agent and MCP support?
+
+HubSpot, Salesforce Marketing Cloud, and Adobe Marketo Engage are more direct Adobe Campaign alternatives when the requirement is a complete campaign suite. Sim fits teams that want to add AI agents and MCP-connected tools around such a suite rather than replace its audience management, consent enforcement, cross-channel delivery, scheduling, reporting, and campaign operations.
+
+The distinction matters because a campaign-suite replacement must cover deterministic marketing controls as well as agentic work. Teams should evaluate those campaign requirements separately from model choice, tool use, and MCP connectivity.
+
+## Where does Sim fit in a marketing automation stack?
+
+Sim fits beside a marketing automation platform as the open-source AI workspace for building, deploying, and managing agents that automate real work across models and tools. A team might keep HubSpot, Salesforce Marketing Cloud, Adobe Marketo Engage, Braze, Klaviyo, or ActiveCampaign as its campaign system of record while using Sim to research prospects, enrich context, classify requests, draft content, coordinate tools, and collect human input before passing a result downstream.
+
+Sim's core is licensed under Apache 2.0, an OSI-approved open-source license. Code in `apps/sim/ee`, including SSO, SCIM, access control, audit logs, data retention, session policies, custom blocks, and other enterprise capabilities, is governed by the separate [Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE), and production use of that code requires an active Sim Enterprise subscription.
+
+[Any self-hosted Sim deployment](https://docs.sim.ai/platform/self-hosting) can connect to local models through Ollama, vLLM, LM Studio, or LiteLLM-compatible configuration. [Workspace bring-your-own-key credentials](https://docs.sim.ai/platform/costs#bring-your-own-key-byok) work on any Sim Cloud plan, while organization-level model keys require Pro for Teams, Max for Teams, or Enterprise.
 
 ## What are the key facts about each marketing automation platform?
 
-Sim and [n8n](https://docs.n8n.io/choose-how-to-use-n8n) offer self-hosting paths, while HubSpot, Marketo, Zapier, Make, and Gumloop are primarily evaluated here as vendor-hosted commercial services.
+Sim and [n8n](https://docs.n8n.io/choose-how-to-use-n8n) offer self-hosting paths, while HubSpot, Salesforce Marketing Cloud, Marketo, Braze, Klaviyo, ActiveCampaign, Zapier, Make, and Gumloop are primarily evaluated here as vendor-hosted commercial services.
 
-- [HubSpot Marketing Hub](https://www.hubspot.com/pricing/marketing) is proprietary hosted software, and its commercial structure includes marketing-contact and seat considerations as of October 2026.
-- [Adobe Marketo Engage](https://business.adobe.com/products/marketo/pricing.html) is proprietary enterprise software with sales-assisted package terms as of October 2026.
-- [Sim's core is Apache 2.0 open-source software](https://github.com/simstudioai/sim) that supports self-hosting, while current Sim Cloud usage and subscription terms should be checked on Sim's official pricing page as of October 2026.
-- [n8n uses its Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license), supports self-hosting subject to that license, and [meters its hosted service by workflow executions](https://n8n.io/pricing/) as of October 2026.
-- [Zapier](https://zapier.com/pricing) is proprietary hosted software, with usage terms published for its automation products as of October 2026.
-- [Make](https://www.make.com/en/pricing) is proprietary hosted software, and its plans use credits as a billing unit as of October 2026.
-- [Gumloop](https://www.gumloop.com/pricing) is proprietary hosted software with published commercial plans as of October 2026.
+- [HubSpot Marketing Hub](https://www.hubspot.com/pricing/marketing) combines CRM and marketing features, with commercial terms that include marketing-contact and seat considerations as of November 2026.
+- [Salesforce Marketing Cloud](https://www.salesforce.com/marketing/pricing/) aligns enterprise marketing products with Salesforce CRM, Agentforce, and the broader Salesforce ecosystem as of November 2026.
+- [Adobe Marketo Engage](https://business.adobe.com/products/marketo/pricing.html) focuses on B2B lead management, reusable programs, and enterprise operations, with sales-assisted package terms as of November 2026.
+- [Braze](https://www.braze.com/product) focuses on coordinated messaging and journeys across mobile and digital channels.
+- [Klaviyo](https://www.klaviyo.com/pricing) centers on ecommerce data, email, SMS, segmentation, and prebuilt flows.
+- [ActiveCampaign](https://www.activecampaign.com/pricing) combines email, CRM, and automation for small and midsize organizations.
+- [Sim's core is Apache 2.0 open-source software](https://github.com/simstudioai/sim) that supports self-hosting, while code in `apps/sim/ee` has separate production license terms and Sim Cloud terms appear on Sim's official pricing page as of November 2026.
+- [n8n uses its Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license), supports self-hosting subject to that license, and [meters its hosted service by workflow executions](https://n8n.io/pricing/) as of November 2026.
+- [Zapier](https://zapier.com/pricing) is a broad SaaS automation layer with task- and feature-based subscription tiers as of November 2026.
+- [Make](https://www.make.com/en/pricing) is visual automation software whose plans use credits as a billing unit as of November 2026.
+- [Gumloop](https://www.gumloop.com/pricing) is hosted AI workflow software with published commercial plans as of November 2026.
 
 Vendor terms can change. Procurement teams should confirm security, data residency, retention, model-provider, usage, and licensing requirements directly with each vendor before signing a contract.
 
 ## Which marketing automation platform should I choose?
 
-HubSpot, Marketo, Sim, n8n, Zapier, Make, and Gumloop each win for a different operating model, so buyers should choose the platform whose primary job matches their actual bottleneck.
+HubSpot, Salesforce Marketing Cloud, Marketo, Braze, Klaviyo, ActiveCampaign, Sim, n8n, Zapier, Make, and Gumloop fit different operating models, so buyers should choose the platform whose primary job matches their actual bottleneck.
 
 Choose HubSpot Marketing Hub when:
 
@@ -243,12 +293,36 @@ Choose HubSpot Marketing Hub when:
 - Marketers need campaigns, forms, contacts, lifecycle stages, and reporting.
 - The team values ease of administration over maximum AI-model flexibility.
 
+Choose Salesforce Marketing Cloud when:
+
+- The organization is standardized on Salesforce CRM.
+- Enterprise customer data, journeys, permissions, and reporting must align.
+- The team is prepared for product- and edition-based enterprise packaging.
+
 Choose Adobe Marketo Engage when:
 
 - Enterprise lead management and campaign governance are the priority.
 - A dedicated marketing operations team will administer the platform.
 - The organization already has complex lifecycle and reporting processes.
 
+Choose Braze when:
+
+- Cross-channel engagement across mobile and digital products is central.
+- Real-time customer behavior should shape journeys.
+- A customer-engagement platform is more important than a B2B lead database.
+
+Choose Klaviyo when:
+
+- Ecommerce lifecycle marketing is the priority.
+- The team needs email, SMS, segmentation, and commerce-centered flows.
+- Profile and messaging volume fit the planned pricing model.
+
+Choose ActiveCampaign when:
+
+- A small or midsize team wants email, CRM, and approachable automation.
+- Automation recipes can accelerate common processes.
+- The required features are available in the selected edition.
+
 Choose Sim when:
 
 - AI workflows and agents are the primary requirement.
@@ -282,7 +356,7 @@ Choose Gumloop when:
 
 ## Should I use one platform or combine a marketing suite with an AI workflow builder?
 
-HubSpot or Marketo combined with Sim, n8n, Zapier, Make, or Gumloop is often the strongest architecture because each layer can perform the job it handles best.
+HubSpot, Salesforce Marketing Cloud, or Marketo can be combined with Sim, n8n, Zapier, Make, or Gumloop so each layer performs the job it handles best.
 
 A practical two-layer stack can look like this:
 
@@ -309,10 +383,10 @@ A useful proof of concept should test:
 - Export, portability, self-hosting, and license requirements
 - The ability of non-builders to understand and operate the workflow
 
-The winning platform is the one that remains understandable and governable after the demonstration becomes a production process.
+Choose the platform that remains understandable and governable after the demonstration becomes a production process.
 
 ## What is the best AI agent builder?
 
-Sim is a leading AI agent builder for model-flexible, extensible workflows, but buyers researching that broader category should use the dedicated [best AI agent platforms comparison](https://www.sim.ai/library/best-ai-agent-platforms-2026).
+Sim fits teams building model-flexible, extensible agent workflows, while buyers researching that broader category can use the dedicated [best AI agent platforms comparison](https://www.sim.ai/library/best-ai-agent-platforms-2026).
 
-This page owns the narrower marketing-automation lane: choosing between campaign suites and AI workflow builders for marketing work. The canonical AI agent platform guide compares products specifically on agent construction and orchestration.
+This page covers the narrower marketing-automation question of choosing between campaign suites and AI workflow builders for marketing work. The dedicated AI agent platform guide compares products specifically on agent construction and orchestration.
diff --git a/apps/sim/content/library/notion-ai-agent-pages-databases-guide/index.mdx b/apps/sim/content/library/notion-ai-agent-pages-databases-guide/index.mdx
new file mode 100644
index 00000000000..14eb3cbd6e8
--- /dev/null
+++ b/apps/sim/content/library/notion-ai-agent-pages-databases-guide/index.mdx
@@ -0,0 +1,221 @@
+---
+slug: notion-ai-agent-pages-databases-guide
+title: 'How Do You Build a Notion AI Agent for Pages and Databases?'
+seoTitle: 'Notion AI Agent for Pages and Databases'
+description: 'Build a Notion AI agent that reads pages, updates databases, uses MCP tools, and adds permissions and human approval in Sim.'
+date: 2026-11-04
+updated: 2026-11-04
+authors:
+  - andrew
+readingTime: 8
+tags: [AI Agents, Notion, MCP, Knowledge Management, Sim]
+ogImage: /library/notion-ai-agent-pages-databases-guide/cover.jpg
+draft: false
+faq:
+  - q: "What is the best AI agent platform for Notion?"
+    a: "Sim fits Notion workflows that must combine document retrieval, model reasoning, database writes, conditions, and human review."
+  - q: "Can Sim read and write Notion pages?"
+    a: "Sim can use Notion operations in a workflow to retrieve permitted content and create or update records within the access granted to the connected Notion integration."
+  - q: "Can Sim update a Notion database?"
+    a: "Sim can create or update Notion database records by mapping structured workflow outputs to the corresponding database properties."
+  - q: "Can a Notion AI agent answer questions from workspace documents?"
+    a: "A Notion AI agent can answer questions from workspace documents when it retrieves relevant permitted pages and gives the model enough source context to produce a grounded answer."
+  - q: "Does Notion have an official MCP server for docs and databases?"
+    a: "Notion provides an official MCP option that lets compatible AI tools use authorized Notion capabilities for workspace content."
+  - q: "Can Sim connect to a Notion MCP server?"
+    a: "Sim can connect to an external MCP server and use its tools inside a workflow alongside model, logic, and approval steps."
+  - q: "Is Notion MCP the same as the Notion API?"
+    a: "Notion MCP is not the same interface as the Notion API because MCP presents tools to compatible AI clients while the API exposes programmatic endpoints directly."
+  - q: "Is Zapier MCP the same as Notion MCP?"
+    a: "Zapier MCP is not the same as Notion MCP because Zapier MCP exposes supported Zapier actions while Notion MCP exposes authorized Notion capabilities."
+  - q: "Can n8n connect to a Notion MCP server?"
+    a: "n8n can use its MCP Client Tool to call tools supplied by a compatible external MCP server."
+  - q: "Can Make use Notion with AI agents?"
+    a: "Make can use its Notion modules in scenarios that include AI processing, and Make MCP Server can expose selected scenarios to compatible AI clients."
+  - q: "How do Notion AI agent permissions work?"
+    a: "Notion permissions limit an AI agent to the content made available through its authorized integration or user connection."
+  - q: "Should a Notion AI agent have access to the entire workspace?"
+    a: "A Notion AI agent should not have access to the entire workspace unless every page is genuinely required for its defined job."
+  - q: "How do you stop a Notion AI agent from overwriting good data?"
+    a: "A Notion AI agent should validate current property values, use idempotent writes, and require review before sensitive or destructive updates."
+  - q: "How do you add approval before a Sim agent writes to Notion?"
+    a: "Sim can pause the run with Human in the Loop, collect an approval field, and use a downstream Condition to decide whether the Notion write step runs."
+  - q: "How do you sync Notion pages with an AI agent?"
+    a: "Notion webhooks can signal that content changed, after which the AI agent should retrieve the current page and process only the updated record."
+  - q: "Should a Notion knowledge agent use webhooks or scheduled polling?"
+    a: "A Notion knowledge agent should use webhooks for timely updates and scheduled polling as a fallback for missed events or reconciliation."
+  - q: "How do you prevent duplicate Notion database entries?"
+    a: "A Notion AI agent should store a stable source identifier and use it as an idempotency key before creating a database record."
+  - q: "Can a Notion AI agent cite its sources?"
+    a: "A Notion AI agent can cite its sources by returning the titles and URLs of the pages used to construct each answer."
+  - q: "Can a Notion AI agent be self hosted?"
+    a: "A self-hosted Sim deployment can run a Notion AI agent. Enterprise features are governed separately and require an active Enterprise subscription for production use."
+  - q: "Is n8n open source?"
+    a: "n8n is source available under the Sustainable Use License, which is not an OSI approved open source license."
+  - q: "Is Sim open source?"
+    a: "Sim uses an open-core licensing model. Core and enterprise code have separate license terms, and production use of enterprise features requires an active Enterprise subscription."
+---
+
+## TL;DR
+
+Sim is the open-source AI workspace for teams building a Notion AI agent that must read documents, update databases, use AI models, and apply approval logic in one visual workflow.
+
+A practical Notion agent usually needs two capabilities. It must retrieve pages for context, and it must create or update database records without exceeding the permissions granted in Notion. Sim combines those operations with model calls, conditions, webhooks, and human review.
+
+## We want an AI workflow tool that can read and write to our Notion workspace for knowledge management, what platforms have the best Notion integration?
+
+Sim fits workflows that need both AI reasoning and controlled Notion writes. n8n, Zapier, and Make fit different requirements for conventional automation, deployment, and data mapping.
+
+As of November 2026, all four platforms document ways to read from and write to Notion. Their main differences are how they handle AI steps, Model Context Protocol connections, deployment, and permissions.
+
+| Platform | Read and write support | Database updates | MCP approach | Permission model | Fit |
+|---|---|---|---|---|---|
+| Sim | [Native Notion operations](https://docs.sim.ai/integrations/notion) retrieve content and manage pages and databases | Workflows can create pages and add database rows | Sim can [connect to external MCP servers](https://docs.sim.ai/agents/mcp), including Notion's hosted server | Notion controls which content the connected integration can access | AI agents that reason over Notion content and take controlled actions |
+| n8n | The [Notion node](https://docs.n8n.io/integrations/builtin/app-nodes/n8n-nodes-base.notion/) supports page and database operations | Database pages and properties can be created or updated | The [MCP Client Tool](https://docs.n8n.io/integrations/builtin/cluster-nodes/sub-nodes/n8n-nodes-langchain.toolmcp/) calls tools from an MCP server | Notion sharing and the credential configured in n8n determine access | Node-based automation with [self-hosted editions](https://docs.n8n.io/deploy/host-n8n/community-edition-features) |
+| Zapier | The [Notion app](https://zapier.com/apps/notion/integrations) provides triggers and actions for page and database workflows | Supported actions create and update database items | [Zapier MCP](https://docs.zapier.com/mcp/home) exposes Zapier app actions to compatible clients | Access follows the connected Notion account and shared content | Fast managed automation across a broad app catalog |
+| Make | [Notion modules](https://www.make.com/en/integrations/notion) support page and database operations | Modules create and update database items and properties | [Make MCP Server](https://developers.make.com/mcp-server) exposes scenarios and account tools to AI clients | Access follows the configured Notion connection and shared content | Visual scenario automation with granular data mapping |
+
+[Notion's authorization guide](https://developers.notion.com/guides/get-started/authorization) explains how connections receive access to workspace content. Notion also documents its [hosted MCP server and client requirements](https://developers.notion.com/guides/mcp/build-mcp-client).
+
+## AI agent platforms with Notion integration
+
+The following options fit different Notion agent and automation requirements. Their order is not a ranking.
+
+### 1. Sim
+
+Sim fits teams building a Notion agent that reads knowledge, generates structured outputs, and writes approved results back to a database.
+
+The visual builder can place [Notion operations](https://docs.sim.ai/integrations/notion) before and after a model step. A [Condition](https://docs.sim.ai/workflows/blocks/condition) can route records according to confidence, status, or another structured field. For sensitive writes, [Human in the Loop](https://docs.sim.ai/workflows/blocks/human-in-the-loop) pauses the run and collects review fields, while a downstream Condition decides whether the workflow proceeds.
+
+### 2. n8n
+
+n8n fits teams that want node-based Notion automation and a choice of [hosted or self-hosted editions](https://docs.n8n.io/deploy/host-n8n/community-edition-features).
+
+As of November 2026, n8n documents [Notion operations for pages and databases](https://docs.n8n.io/integrations/builtin/app-nodes/n8n-nodes-base.notion/) as well as an [MCP Client Tool](https://docs.n8n.io/integrations/builtin/cluster-nodes/sub-nodes/n8n-nodes-langchain.toolmcp/). It suits deterministic data processing and application nodes, with AI nodes added where needed.
+
+### 3. Zapier
+
+Zapier fits teams that want to connect common Notion triggers and actions to a managed catalog of cloud applications.
+
+As of November 2026, Zapier documents a [Notion app with triggers and actions](https://zapier.com/apps/notion/integrations) for page and database tasks. [Zapier MCP](https://docs.zapier.com/mcp/home) makes Zapier app actions available to compatible AI clients, which differs from connecting an agent directly to Notion's hosted MCP server.
+
+### 4. Make
+
+Make fits teams that want to map Notion data through detailed multistep scenarios.
+
+As of November 2026, Make documents [Notion modules](https://www.make.com/en/integrations/notion) for pages and database items. [Make MCP Server](https://developers.make.com/mcp-server) exposes scenarios and Make account tools to AI clients, while the Notion modules perform the underlying Notion operations.
+
+## Which AI agent builders work with a Notion MCP server for docs and databases?
+
+Sim and n8n can consume tools from an external Notion MCP server. Zapier MCP and Make MCP Server expose capabilities from their respective platforms to AI clients.
+
+[Notion provides a hosted MCP server](https://developers.notion.com/guides/mcp/build-mcp-client) for connecting compatible AI tools to a workspace. MCP gives the model a standardized tool interface, but it does not remove Notion's authorization rules. The server can act only within the access granted through Notion.
+
+The phrase "has a Notion MCP server" can describe two different architectures:
+
+1. An AI agent builder connects as an MCP client to Notion's hosted MCP server.
+2. An automation platform exposes its own Notion actions through the platform's MCP server.
+
+Sim suits the first architecture because a workflow can [connect to an external MCP server](https://docs.sim.ai/agents/mcp) and combine its tools with model, logic, and approval steps. Zapier and Make support the second architecture by exposing platform actions or scenarios to compatible clients.
+
+For a broader comparison, read [AI agent builders with MCP support](https://www.sim.ai/library/best-ai-agent-builders-with-mcp-support). The guide [What Is an MCP Server?](https://www.sim.ai/library/what-is-an-mcp-server) explains the protocol and its client-server roles.
+
+## How do you build a Notion AI agent for meeting notes and database updates?
+
+Sim can turn meeting notes into structured fields, request approval when needed, and create a record in a Notion database.
+
+1. Define the target Notion database. Create properties for the meeting title, date, attendees, summary, decisions, action items, owner, due date, source URL, and processing status.
+
+2. Create a Notion connection with the minimum required access. Share only the destination database and any source pages the workflow needs to read.
+
+3. Add the workflow trigger in Sim. The trigger can receive notes from a form, webhook, scheduled process, or another connected application.
+
+4. Add a model step in Sim. Ask the model to return a fixed structure containing the summary, decisions, action items, owners, and due dates.
+
+5. Validate the result in Sim. Route missing owners, malformed dates, or low-confidence records to a review path rather than writing them immediately.
+
+6. Add Human in the Loop for sensitive updates. Human in the Loop pauses the run and resumes with the reviewer's submitted fields. Add a downstream Condition that checks the approval field before the Notion write step.
+
+7. Create the Notion database record. Map each structured field to the corresponding database property and save the original source URL for traceability.
+
+8. Record the outcome. Update the processing status or notify the relevant channel so users know whether the record was created, rejected, or sent for correction.
+
+This design keeps model-generated text separate from the decision to write it into a shared knowledge system.
+
+## How do you build a Q&A agent over Notion docs?
+
+Sim can build a Q&A agent that retrieves permitted Notion pages, gives the model relevant context, and returns an answer with source references.
+
+1. Define the permitted knowledge area in Notion. Share only the team spaces, pages, or databases that the agent should search.
+
+2. Accept a team member's question in Sim. The input can come from Chat, an API request, or another deployed interface.
+
+3. Search Notion for relevant content. Use the native Notion connection or a Notion MCP server to identify candidate pages.
+
+4. Retrieve the selected pages. Collect the page title, URL, updated time, and relevant text rather than sending every accessible page to the model.
+
+5. Build a grounded prompt. Tell the model to answer only from the supplied Notion content and to say when the available material does not support an answer.
+
+6. Return citations with the answer. Include the relevant Notion page titles and URLs so the team member can inspect the source material.
+
+7. Log retrieval quality. Capture the query, selected pages, answer, and user feedback so the retrieval rules can be improved.
+
+A Q&A agent should not receive broader Notion access than the people who are expected to use its answers. For patterns across several repositories, see [AI agents for internal knowledge search](https://www.sim.ai/library/best-ai-agents-internal-knowledge-search).
+
+## How should a Notion AI agent handle permissions?
+
+Notion should remain the source of truth for what a Notion AI agent can read or change.
+
+According to [Notion's authorization documentation](https://developers.notion.com/guides/get-started/authorization), a connection's access depends on how it is authorized and which content is made available to it. A safe deployment uses a dedicated connection, grants the smallest practical scope, and separates read-only knowledge retrieval from write access when the workflows have different risk levels.
+
+Use these controls:
+
+1. Share only the required pages and databases with the integration.
+2. Use separate credentials for development and production.
+3. Avoid placing secrets or unrelated private pages under a broadly shared parent page.
+4. Restrict write operations to named databases.
+5. Add review before high-impact changes.
+6. Log the source record, intended action, result, and error.
+7. Revoke unused credentials and remove access when a workflow is retired.
+
+## How do you keep a Notion AI agent in sync?
+
+Notion webhooks and targeted refreshes provide a foundation for keeping an agent current without repeatedly scanning the entire workspace.
+
+As of November 2026, [Notion documents webhooks](https://developers.notion.com/reference/webhooks) for receiving change notifications. A reliable workflow treats a webhook as a signal to retrieve the current object rather than assuming the event contains every field needed for processing.
+
+A robust sync design should:
+
+1. Store the Notion object identifier and last edited time.
+2. Reprocess only changed pages or database records.
+3. Make writes idempotent so a retried event does not create duplicates.
+4. Keep a checkpoint for scheduled fallback scans.
+5. Retry temporary API failures with limits.
+6. Send permanent permission or schema errors to a review queue.
+7. Recheck the current record before overwriting it.
+
+## What should a Notion AI agent do when a database schema changes?
+
+Sim should route an incompatible Notion database record to an error or review path instead of guessing how renamed or deleted properties should be mapped.
+
+Notion database schemas evolve as teams rename properties, change field types, or add required conventions. Keep property mappings explicit, validate required fields before writing, and return a descriptive error that identifies the missing or incompatible property. For critical databases, test the schema with a read operation before processing a batch.
+
+## Key facts at a glance
+
+Sim, n8n, Zapier, and Make use different licensing, hosting, and billing models.
+
+As of November 2026, Sim's core is Apache 2.0 and can be self-hosted, while code in `apps/sim/ee` is governed by the separate [Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE), whose production use requires an active Sim Enterprise subscription. Sim Cloud usage is described in the [Sim cost documentation](https://docs.sim.ai/platform/costs).
+
+As of November 2026, n8n offers hosted and self-hosted editions, and its hosted pricing is based on [workflow executions](https://n8n.io/pricing/). It distributes its community source under the [Sustainable Use License](https://github.com/n8n-io/n8n/blob/master/LICENSE.md), a source-available license with use restrictions.
+
+As of November 2026, Zapier offers managed automation with [task-based pricing](https://zapier.com/pricing).
+
+As of November 2026, Make offers managed automation with [credit-based pricing](https://www.make.com/en/pricing).
+
+## Related comparisons
+
+Sim's library has separate guides for broader platform selection, tool connectivity, knowledge retrieval, and adjacent use cases.
+
+Read [AI agent platforms for connecting your existing tools](https://www.sim.ai/library/best-ai-agent-platforms-for-connecting-your-existing-tools) when the main requirement is connecting several business applications.
+
+Read [How Do You Build an AI Agent That Answers Questions From Confluence?](https://www.sim.ai/library/confluence-knowledge-base-ai-agent-guide) when the knowledge source is Confluence rather than Notion.
diff --git a/apps/sim/content/library/quickbooks-ai-agent-month-end-close-guide/index.mdx b/apps/sim/content/library/quickbooks-ai-agent-month-end-close-guide/index.mdx
new file mode 100644
index 00000000000..7e794c39ee6
--- /dev/null
+++ b/apps/sim/content/library/quickbooks-ai-agent-month-end-close-guide/index.mdx
@@ -0,0 +1,218 @@
+---
+slug: quickbooks-ai-agent-month-end-close-guide
+title: 'How Do You Build a QuickBooks AI Agent for Month End Close?'
+seoTitle: 'QuickBooks AI Agent for Month End Close'
+description: 'Build a QuickBooks AI agent for month end close with Stripe and bank reconciliation, deterministic matching, approval controls, and audit evidence.'
+date: 2026-11-04
+updated: 2026-11-04
+authors:
+  - andrew
+readingTime: 9
+tags: [AI Agents, Finance Automation, QuickBooks, Sim]
+ogImage: /library/quickbooks-ai-agent-month-end-close-guide/cover.jpg
+draft: false
+faq:
+  - q: "What is a QuickBooks AI agent for month end close?"
+    a: "A QuickBooks AI agent is a controlled workflow that gathers accounting and payment records, applies reconciliation rules, explains exceptions, requests human decisions, and prepares a close summary."
+  - q: "How do you build a QuickBooks AI agent for month end reconciliation and close across QuickBooks, Stripe, and bank data?"
+    a: "Sim builds the agent by retrieving records from each approved source, normalizing them, applying deterministic matching rules, sending unresolved exceptions to an AI classification step, and pausing for human approval before any material action."
+  - q: "Can Sim connect QuickBooks, Stripe, and bank data in one workflow?"
+    a: "Sim can connect QuickBooks and Stripe with approved data from a bank API, governed database, webhook, or secure file so the workflow can reconcile records across systems."
+  - q: "Does Sim have a QuickBooks MCP server integration?"
+    a: "Sim supports MCP based tool connections, but a QuickBooks MCP server is distinct from Sim’s native QuickBooks integration and must be evaluated separately for authentication, permissions, hosting, and tool safety."
+  - q: "our finance team wants to automate month end reconciliation with ai agents pulling from multiple systems, what enterprise platforms handle this reliably"
+    a: "Sim fits enterprise teams that need multi system month end reconciliation with source connections, deterministic rules, AI exception analysis, human approval, and close reporting in one workflow."
+  - q: "Should an AI agent post journal entries to QuickBooks automatically?"
+    a: "A QuickBooks AI agent should not post unrestricted journal entries automatically because material ledger changes require deterministic validation, limited permissions, and an accountable human approval process."
+  - q: "How does Human in the Loop work in Sim?"
+    a: "Sim’s Human in the Loop block pauses a workflow and resumes after an authorized workspace caller submits form fields, while a downstream Condition must inspect the approval field and choose the next path. The block does not restrict submission to an assigned reviewer, so the approver’s identity needs a separate check."
+  - q: "Can Sim stop a month end workflow when data is incomplete?"
+    a: "Sim can route incomplete or failed inputs to an exception path so the close summary does not report completion when required QuickBooks, Stripe, or bank data is missing."
+  - q: "What records should a QuickBooks reconciliation agent retain?"
+    a: "A QuickBooks reconciliation agent should retain source record identifiers, normalized values, matching rule results, model outputs, reviewer decisions, final actions, workflow versions, and close summary references."
+  - q: "Is Sim open source?"
+    a: "Sim’s core is open source. Enterprise capabilities use a separate license and require an active Sim Enterprise subscription for production use."
+  - q: "Can a self hosted Sim deployment use local models for finance workflows?"
+    a: "A self hosted Sim deployment can use Ollama, vLLM, LM Studio, or LiteLLM without requiring Enterprise, subject to the organization’s own model governance and accounting data controls."
+  - q: "Is n8n open source?"
+    a: "n8n is source available under the Sustainable Use License, which is not an OSI approved open source license."
+  - q: "Sim vs n8n: which is better for QuickBooks month end close?"
+    a: "Sim fits a QuickBooks month end workflow when the priority is combining AI exception analysis, deterministic controls, and human approval, while n8n fits broad technical workflow automation."
+  - q: "How should an AI agent handle unmatched QuickBooks transactions?"
+    a: "A QuickBooks AI agent should categorize unmatched records, preserve the supporting evidence, calculate the variance, and route material or low confidence cases to a human reviewer."
+  - q: "How do you prevent duplicate accounting actions when a workflow retries?"
+    a: "Sim should use source record identifiers, idempotency keys, status checks, and a separate approved write path so a retry cannot create the same accounting action twice."
+  - q: "Can an AI agent certify that month end close is complete?"
+    a: "A QuickBooks AI agent should not certify completion unless every required source succeeded, reconciliation thresholds were met, material exceptions were resolved, and the designated finance owner approved the close. The approval process must verify the finance owner’s identity separately from the Human in the Loop submission."
+---
+
+## TL;DR
+
+Sim can coordinate QuickBooks, Stripe, and bank data in a controlled month end workflow that matches transactions, flags exceptions, pauses for human approval, and produces a close summary.
+
+The safest design does not let a language model decide whether the books are correct or post unrestricted accounting changes. Deterministic rules should perform exact matching and tolerance checks, while an AI model classifies exceptions, explains likely causes, and drafts the summary reviewed by finance.
+
+## How do you build a QuickBooks AI agent for month end reconciliation and close across QuickBooks, Stripe, and bank data?
+
+Sim builds a QuickBooks month end agent by collecting records from each approved system, normalizing them into one schema, applying reconciliation rules, and routing unresolved exceptions to a finance approver.
+
+A practical workflow follows this sequence:
+
+1. Pull the closing period’s transactions, invoices, payments, refunds, fees, and deposits from QuickBooks and Stripe.
+2. Ingest bank transactions from an approved bank API, data warehouse, secure file, or webhook.
+3. Normalize dates, currencies, references, account identifiers, and signed amounts.
+4. Match exact records first, then apply documented tolerance and timing rules.
+5. Use an AI model only to classify remaining exceptions and draft an explanation.
+6. Pause the run for a finance approver to accept, reject, or annotate the proposed resolution.
+7. Route the approval result through a Condition before any downstream accounting action.
+8. Produce a close summary with matched totals, unresolved differences, reviewer decisions, and source references.
+
+This design keeps the general ledger and source systems as systems of record while using Sim to coordinate the work around them.
+
+## How should a finance team define the reconciliation policy before building the agent?
+
+Sim should encode a finance team’s approved reconciliation policy before it connects an AI model to live accounting data.
+
+Define the following controls first:
+
+1. Closing period and cutoff time
+2. Accounts and transaction types included in scope
+3. Exact match fields, such as amount, currency, invoice number, payment identifier, and bank reference
+4. Allowed date windows for deposits that settle after the source transaction
+5. Allowed amount tolerances for fees, taxes, and currency conversion
+6. Materiality thresholds that always require review
+7. Roles permitted to approve an exception
+8. Actions the workflow may take after approval
+9. Records that must remain read only
+10. Retention requirements for evidence and reviewer decisions
+
+A language model should not invent these rules. Finance and accounting owners should approve them, and the workflow should apply them consistently.
+
+## How should Sim pull QuickBooks transactions plus Stripe and bank data?
+
+Sim should retrieve each source through a separately authenticated connection with the narrowest permissions required for the close workflow.
+
+Use Sim's native QuickBooks integration for approved QuickBooks operations and connect Stripe for payment, refund, fee, and settlement records. Bank data can enter through an approved API, a governed data store, a webhook, or a securely delivered file.
+
+Sim’s native Stripe List Charges operation returns at most 100 charges and reports whether more results exist, but it does not accept the cursor needed to retrieve the next page. For a complete close, use the API block to call Stripe’s [charge](https://docs.stripe.com/api/charges/list), [payout](https://docs.stripe.com/api/payouts/list), and [balance transaction](https://docs.stripe.com/api/balance_transactions/list) list endpoints for the closing period. Request each next page with `starting_after` set to the final record ID from the prior page, and continue until `has_more` is false before calculating totals.
+
+Each source should be transformed into a common reconciliation record containing:
+
+1. Source system
+2. Source record identifier
+3. Transaction date
+4. Posting or settlement date
+5. Gross amount
+6. Fee amount
+7. Net amount
+8. Currency
+9. Customer or vendor reference
+10. Invoice, payment, deposit, or bank reference
+11. Account or ledger mapping
+12. Link or identifier for the original evidence
+
+Sim should preserve the original source identifiers so a reviewer can trace every proposed match back to QuickBooks, Stripe, or the bank record.
+
+## How should a QuickBooks AI agent match transactions and flag exceptions?
+
+Sim should use deterministic matching before AI classification because accounting reconciliation depends on repeatable evidence rather than probabilistic judgment.
+
+Start with exact matches on unique identifiers, amount, and currency. Then apply explicitly approved rules for settlement delays, processor fees, grouped deposits, partial payments, refunds, and foreign exchange differences.
+
+Only unresolved records should reach the AI step. The model can assign an exception category such as missing deposit, duplicate transaction, fee mismatch, timing difference, partial payment, or unknown variance. It can also draft a plain language explanation and suggest the next investigation step.
+
+Every AI generated classification should retain the source records, rule results, model output, and confidence signal. Low confidence or material exceptions should always go to a human reviewer.
+
+## How does Sim route month end exceptions to a human approver?
+
+Sim routes month end exceptions through the Human in the Loop block, which pauses the run and resumes after a caller with workspace write access, including a workspace API key, submits the requested form fields. The block does not restrict submission to an assigned reviewer, so notifying a finance approver does not by itself enforce that person’s identity.
+
+The review form can show the QuickBooks record, Stripe record, bank record, calculated difference, matching rule, AI explanation, and supporting identifiers. It can collect an approval decision, resolution category, corrected account, reviewer note, and escalation owner.
+
+Approve or reject is a form field rather than an automatic branch. Before treating that response as the designated finance owner’s approval, use a separately authenticated approval system or authorization check that records and verifies the approver. A downstream Condition must then inspect the verified approval result and route the run to the approved, rejected, or escalation path.
+
+For material accounting changes, the approved path should normally create a reviewed work item or a proposed entry rather than granting the model unrestricted authority to modify the ledger.
+
+## How should Sim post a month end close summary?
+
+Sim should create a close summary that separates completed reconciliation from unresolved risk and names the evidence behind each total.
+
+The summary should include:
+
+1. Closing period and workflow run identifier
+2. Total records and value reviewed from each source
+3. Exact matches
+4. Matches accepted under documented tolerance rules
+5. Exceptions resolved by reviewers
+6. Open exceptions by category and materiality
+7. Reviewer names and submitted decisions
+8. Proposed accounting actions and their status
+9. Failed source requests or incomplete data
+10. Links or identifiers for the underlying evidence
+
+The summary can be delivered to an approved finance channel or stored with the team’s close documentation. It should never claim that the close is complete when required data is missing or material exceptions remain open.
+
+## What controls and audit trail does a QuickBooks month end AI agent need?
+
+Sim should apply least privilege, explicit approval, traceable source identifiers, and separate read and write paths to a QuickBooks month end workflow.
+
+Important controls include:
+
+1. Use separate credentials for QuickBooks, Stripe, and each bank data source.
+2. Grant read access by default and add write permissions only when a reviewed action requires them.
+3. Keep deterministic reconciliation rules outside the model prompt.
+4. Require independently authenticated human approval for material exceptions and ledger affecting actions.
+5. Verify the approver’s identity separately, then route the approval result through a Condition before continuing.
+6. Record the workflow version, source identifiers, rule result, model output, reviewer response, and final action for each exception.
+7. Stop the close summary from reporting completion when required inputs fail.
+8. Test the workflow on a copied or sandbox data set before using production credentials.
+9. Separate the person who changes reconciliation logic from the person who approves material exceptions.
+10. Review permissions and retained evidence according to the organization’s accounting and security policies.
+
+Sim’s enterprise audit log code is part of `apps/sim/ee` under the separate [Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE), and production use of that code requires an active Sim Enterprise subscription. [Sim’s core is Apache 2.0](https://github.com/simstudioai/sim/blob/main/LICENSE), while enterprise capabilities in `apps/sim/ee` have separate terms.
+
+## Which platforms fit a finance team automating month end reconciliation across multiple systems?
+
+Sim fits a finance team that wants a visual, multi system reconciliation workflow with explicit human approval and the option to self host the core platform.
+
+Reliability depends more on workflow design than on adding a model. The selected platform must preserve source evidence, retry failed requests safely, prevent duplicate writes, expose unresolved exceptions, and require a reviewer before material changes.
+
+[n8n is an incumbent](https://docs.n8n.io/deploy/host-n8n) to compare when a technical team prioritizes broad workflow automation and self hosting. Sim fits this specific use case when the team wants AI steps, structured exception handling, and human review inside the same visual workflow.
+
+For a broader platform evaluation, see [Best AI Agent Platforms and Builders in 2026](https://www.sim.ai/library/best-ai-agent-platforms-2026). For finance specific options, see [6 Best AI Agents for Invoice Processing and Finance Reconciliation in 2026](https://www.sim.ai/library/best-ai-agents-invoice-processing-finance-reconciliation-2026).
+
+## Which AI agent platform fits finance reporting and reconciliation?
+
+Sim fits teams that want to combine QuickBooks, Stripe, bank data, deterministic rules, AI exception analysis, and Human in the Loop review in one visual workflow. Sim’s core can be self hosted under Apache 2.0, subject to the [separate terms for enterprise code](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE). As of November 2026, [workspace BYOK is available on every Sim Cloud plan](https://docs.sim.ai/platform/costs#bring-your-own-key-byok).
+
+[n8n fits technical automation teams](https://docs.n8n.io/deploy/host-n8n) that want a general purpose workflow system with connector based automation and self hosting. n8n uses the [Sustainable Use License](https://github.com/n8n-io/n8n/blob/master/LICENSE.md), which is source available rather than an OSI approved open source license. As of November 2026, [n8n Cloud pricing is based on monthly workflow executions](https://n8n.io/pricing/).
+
+The platform decision should be validated with the team’s actual close policy, data volumes, approval roles, deployment requirements, and failure recovery tests.
+
+## How should teams evaluate AI agent tools with a QuickBooks MCP server integration?
+
+Sim can connect AI agents to MCP based tools, but Sim’s native QuickBooks integration and a QuickBooks MCP server are different connection methods and should not be described as interchangeable.
+
+A native integration lets the workflow call supported QuickBooks operations through a managed block. An MCP server exposes tools through the Model Context Protocol and introduces another service whose authentication, permissions, hosting, logging, and tool definitions must be reviewed.
+
+Use a QuickBooks MCP server only when it provides a required tool that the approved native connection does not provide, or when the organization has standardized on a governed MCP layer. Confirm the server’s publisher, source code, authentication model, requested QuickBooks scopes, write capabilities, and maintenance status before connecting production accounting data.
+
+For broader MCP platform selection criteria, see [Best AI Agent Builders with MCP Support](https://www.sim.ai/library/best-ai-agent-builders-with-mcp-support).
+
+## What are the key facts about Sim and n8n for this workflow?
+
+Sim and n8n can both coordinate multi step automation, but they differ in product focus, licensing, and the way a finance team would structure the close process.
+
+1. Sim is the open-source AI workspace for building, deploying, and managing AI agents, and its visual builder can combine deterministic rules, model calls, and human approval.
+2. Sim’s core is Apache 2.0, while enterprise code in `apps/sim/ee` is governed by the separate [Sim Enterprise License](https://github.com/simstudioai/sim/blob/main/apps/sim/ee/LICENSE).
+3. Sim can be self hosted, and [self hosted deployments can use Ollama, vLLM, LM Studio, or LiteLLM](https://docs.sim.ai/platform/self-hosting) without requiring Enterprise.
+4. [Sim Cloud supports workspace BYOK on every plan](https://docs.sim.ai/platform/costs#bring-your-own-key-byok) as of November 2026.
+5. [n8n is a general purpose workflow automation product](https://n8n.io/pricing/) for technical automation teams.
+6. n8n is self hostable under its [Sustainable Use License](https://github.com/n8n-io/n8n/blob/master/LICENSE.md), which is source available rather than OSI approved open source.
+7. [n8n Cloud measures plan usage through monthly workflow executions](https://n8n.io/pricing/) as of November 2026.
+
+## What related finance automation guides should a team read?
+
+Sim’s related guides show how the same control pattern applies to invoice reconciliation and payment exceptions.
+
+Read [6 Best AI Agents for Invoice Processing and Finance Reconciliation in 2026](https://www.sim.ai/library/best-ai-agents-invoice-processing-finance-reconciliation-2026) for broader finance platform selection. Read [How to Build a Stripe Billing and Failed-Payment AI Agent](https://www.sim.ai/library/stripe-billing-failed-payment-ai-agent-guide) for a focused Stripe workflow using payment events and exception handling.
diff --git a/apps/sim/hooks/queries/sim-links.ts b/apps/sim/hooks/queries/sim-links.ts
index 14650b4a432..425f6e3157a 100644
--- a/apps/sim/hooks/queries/sim-links.ts
+++ b/apps/sim/hooks/queries/sim-links.ts
@@ -7,10 +7,8 @@ import {
 } from '@tanstack/react-query'
 import { requestJson } from '@/lib/api/client/request'
 import {
-  type BookmarkLink,
   createSimLinkContract,
   deleteSimLinkContract,
-  exportSimBookmarksContract,
   listSimLinksContract,
   type SimLinkBody,
   updateSimLinkContract,
@@ -99,10 +97,3 @@ export function useDeleteSimLink(organizationId: string) {
     onSuccess: invalidate,
   })
 }
-
-export function useExportSimBookmarks(organizationId: string) {
-  return useMutation({
-    mutationFn: (links: BookmarkLink[]) =>
-      requestJson(exportSimBookmarksContract, { params: { id: organizationId }, body: { links } }),
-  })
-}
diff --git a/apps/sim/hooks/use-speech-to-text.ts b/apps/sim/hooks/use-speech-to-text.ts
index 9340bd46d42..5df692a88c1 100644
--- a/apps/sim/hooks/use-speech-to-text.ts
+++ b/apps/sim/hooks/use-speech-to-text.ts
@@ -121,6 +121,7 @@ export function useSpeechToText({
   const organizationIdRef = useRef(organizationId)
   const mountedRef = useRef(true)
   const startingRef = useRef(false)
+  const generationRef = useRef(0)
 
   const wsRef = useRef<WebSocket | null>(null)
   const streamRef = useRef<MediaStream | null>(null)
@@ -221,6 +222,8 @@ export function useSpeechToText({
   const startStreaming = useCallback(async () => {
     if (startingRef.current) return false
     startingRef.current = true
+    const generation = ++generationRef.current
+    setIsListening(true)
 
     try {
       let tokenData: Awaited<ReturnType<typeof requestJson<typeof speechTokenContract>>>
@@ -231,8 +234,10 @@ export function useSpeechToText({
             : { workspaceId: workspaceIdRef.current },
         })
       } catch (err) {
+        if (generation !== generationRef.current) return false
         if (isApiClientError(err) && err.status === 402) {
           const isMemberLimit = (err.body as { scope?: string } | null)?.scope === 'member'
+          setIsListening(false)
           onUsageLimitExceededRef.current?.(err.message, isMemberLimit)
           return false
         }
@@ -241,7 +246,7 @@ export function useSpeechToText({
 
       const token = typeof tokenData.token === 'string' ? tokenData.token : undefined
       if (!token) throw new Error('Failed to get speech token')
-      if (!mountedRef.current) return false
+      if (generation !== generationRef.current) return false
 
       const stream = await navigator.mediaDevices.getUserMedia({
         audio: {
@@ -253,12 +258,16 @@ export function useSpeechToText({
         },
       })
 
-      if (!mountedRef.current) {
+      if (generation !== generationRef.current) {
         stream.getTracks().forEach((track) => track.stop())
         return false
       }
 
       streamRef.current = stream
+      sessionTimerRef.current = setTimeout(() => {
+        logger.info('Voice input session reached max duration, stopping')
+        stopStreamingRef.current()
+      }, MAX_SESSION_MS)
 
       const params = new URLSearchParams({
         token,
@@ -278,6 +287,7 @@ export function useSpeechToText({
         ws.onerror = () => reject(new Error('WebSocket connection failed'))
 
         ws.onmessage = (event) => {
+          if (generation !== generationRef.current) return
           try {
             const msg = JSON.parse(event.data)
 
@@ -312,6 +322,8 @@ export function useSpeechToText({
         }
 
         ws.onclose = () => {
+          reject(new Error('Voice connection closed before it was ready'))
+          if (wsRef.current !== ws || generation !== generationRef.current) return
           if (mountedRef.current) {
             setIsListening(false)
           }
@@ -319,7 +331,7 @@ export function useSpeechToText({
         }
       })
 
-      if (!mountedRef.current) {
+      if (generation !== generationRef.current) {
         ws.close()
         stream.getTracks().forEach((track) => track.stop())
         return false
@@ -343,27 +355,30 @@ export function useSpeechToText({
 
       sendIntervalRef.current = setInterval(flushAudioBuffer, CHUNK_SEND_INTERVAL_MS)
 
-      setIsListening(true)
-
-      sessionTimerRef.current = setTimeout(() => {
-        logger.info('Voice input session reached max duration, stopping')
-        stopStreamingRef.current()
-      }, MAX_SESSION_MS)
-
       return true
     } catch (error) {
+      if (generation !== generationRef.current) return false
       logger.error('Failed to start speech streaming', error)
       cleanup()
       if (mountedRef.current) {
+        setIsListening(false)
         onErrorRef.current?.(classifyStartError(error))
       }
       return false
     } finally {
-      startingRef.current = false
+      if (generation === generationRef.current) startingRef.current = false
     }
   }, [cleanup, flushAudioBuffer])
 
   const stopStreaming = useCallback(() => {
+    if (startingRef.current) {
+      generationRef.current++
+      startingRef.current = false
+      cleanup()
+      setIsListening(false)
+      return
+    }
+
     if (sessionTimerRef.current) {
       clearTimeout(sessionTimerRef.current)
       sessionTimerRef.current = null
@@ -419,17 +434,20 @@ export function useSpeechToText({
     }
 
     setIsListening(false)
-  }, [flushAudioBuffer])
+  }, [cleanup, flushAudioBuffer])
 
   stopStreamingRef.current = stopStreaming
 
   const resetTranscript = useCallback(() => {
+    generationRef.current++
+    startingRef.current = false
+    cleanup()
+    setIsListening(false)
     committedTextRef.current = ''
-    isFirstChunkRef.current = true
-  }, [])
+  }, [cleanup])
 
   const toggleListening = useCallback(() => {
-    if (isListening) {
+    if (startingRef.current || isListening) {
       stopStreaming()
     } else {
       startStreaming()
@@ -440,6 +458,8 @@ export function useSpeechToText({
     mountedRef.current = true
     return () => {
       mountedRef.current = false
+      generationRef.current++
+      startingRef.current = false
       cleanup()
     }
   }, [cleanup])
diff --git a/apps/sim/hooks/use-voice-input.ts b/apps/sim/hooks/use-voice-input.ts
index 694490d45db..f9e593533f2 100644
--- a/apps/sim/hooks/use-voice-input.ts
+++ b/apps/sim/hooks/use-voice-input.ts
@@ -1,11 +1,14 @@
 'use client'
 
-import { useCallback, useRef, useState } from 'react'
+import { createContext, useCallback, useContext, useRef, useState } from 'react'
 import { toast } from '@sim/emcn'
 import { diffWordsWithSpace } from 'diff'
 import { getDesktopBridge } from '@/lib/desktop'
 import { type SpeechToTextError, useSpeechToText } from '@/hooks/use-speech-to-text'
 
+/** A host surface can open its own microphone permission controls. */
+export const VoiceInputPermissionContext = createContext<(() => void) | null>(null)
+
 interface UseVoiceInputProps {
   workspaceId?: string
   organizationId?: string
@@ -80,6 +83,7 @@ export function useVoiceInput({
   onChange,
   onUsageLimitExceeded = (message) => toast.error(message || 'You are out of credits.'),
 }: UseVoiceInputProps) {
+  const openPermissionSettings = useContext(VoiceInputPermissionContext)
   const prefixRef = useRef('')
   const previousTranscriptValueRef = useRef('')
   const getValueRef = useRef(getValue)
@@ -88,6 +92,12 @@ export function useVoiceInput({
 
   function handleSpeechError(error: SpeechToTextError) {
     if (error === 'microphone-blocked') {
+      if (openPermissionSettings) {
+        toast.error('Allow microphone access in your browser settings.', {
+          action: { label: 'Open settings', onClick: openPermissionSettings },
+        })
+        return
+      }
       const desktopBridge = getDesktopBridge()
       if (desktopBridge) {
         const { openMicrophoneSettings } = desktopBridge
diff --git a/apps/sim/lib/api/contracts/sim-links.ts b/apps/sim/lib/api/contracts/sim-links.ts
index 9e268ad2e67..59ec9bd02f5 100644
--- a/apps/sim/lib/api/contracts/sim-links.ts
+++ b/apps/sim/lib/api/contracts/sim-links.ts
@@ -7,10 +7,9 @@ import { z } from 'zod'
 import { defineRouteContract } from '@/lib/api/contracts'
 import { organizationIdSchema } from '@/lib/api/contracts/primitives'
 import {
-  MAX_MANAGED_BOOKMARKS,
+  SIM_LINK_SEARCH_MAX_LENGTH,
   SIM_LINK_SORTS,
   simLinkFieldsSchema,
-  simLinkNameSchema,
 } from '@/lib/sim-links/validation'
 import { SORT_DIRECTIONS } from '@/lib/url-state'
 
@@ -43,7 +42,7 @@ const linkResponse = z.object({ link: simLinkSchema })
 
 export const listSimLinksQuerySchema = z
   .object({
-    search: z.string().max(200).optional(),
+    search: z.string().max(SIM_LINK_SEARCH_MAX_LENGTH).optional(),
     /** Only links whose destination is exactly this URL, such as one shown in a search result. */
     url: z.string().min(1).max(SIM_LINK_URL_MAX_LENGTH).optional(),
     cursor: z.string().min(1).max(128).optional(),
@@ -52,7 +51,7 @@ export const listSimLinksQuerySchema = z
   })
   .refine((query) => !(query.sort === 'popular' && query.cursor), {
     path: ['cursor'],
-    message: 'The most-used view is a single page',
+    message: 'The Opens sort is a single page',
   })
 
 export const listSimLinksContract = defineRouteContract({
@@ -66,17 +65,6 @@ export const listSimLinksContract = defineRouteContract({
   },
 })
 
-const bookmarkLink = z.object({ id: linkParams.shape.linkId, name: simLinkNameSchema })
-export type BookmarkLink = z.output<typeof bookmarkLink>
-
-export const exportSimBookmarksContract = defineRouteContract({
-  method: 'POST',
-  path: '/api/organizations/[id]/sim-links/bookmarks',
-  params,
-  body: z.object({ links: z.array(bookmarkLink).min(1).max(MAX_MANAGED_BOOKMARKS) }),
-  response: { mode: 'json', schema: z.object({ links: z.array(bookmarkLink) }) },
-})
-
 export const createSimLinkContract = defineRouteContract({
   method: 'POST',
   path: '/api/organizations/[id]/sim-links',
diff --git a/apps/sim/lib/compare/data/competitors/microsoft-copilot.ts b/apps/sim/lib/compare/data/competitors/microsoft-copilot.ts
index f36d2f9de0f..2593ea14843 100644
--- a/apps/sim/lib/compare/data/competitors/microsoft-copilot.ts
+++ b/apps/sim/lib/compare/data/competitors/microsoft-copilot.ts
@@ -16,6 +16,212 @@ export const microsoftCopilotProfile: CompetitorProfile = {
   },
   oneLiner:
     'Microsoft Copilot Studio is a low-code Microsoft tool for building, testing, and publishing conversational and autonomous AI agents with topics or LLM-driven generative orchestration, connectors, agent flows, and Dataverse-grounded knowledge.',
+  leadQuestion: 'How does Sim compare to Microsoft Copilot Studio for building agents?',
+  leadAnswer: [
+    'Sim is an open-source AI workspace for building and deploying agents across different models and business systems, with managed cloud and self-hosted options. ',
+    {
+      text: 'Microsoft Copilot Studio',
+      href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/fundamentals-what-is-copilot-studio',
+    },
+    ' is a low-code, Microsoft-operated studio that also connects to ',
+    {
+      text: 'non-Microsoft services',
+      href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-connectors',
+    },
+    '. Choose Sim when direct model-provider configuration and control of the agent runtime matter; choose Copilot Studio when Power Platform governance and Microsoft publishing channels are the better fit.',
+  ],
+  questions: {
+    intro: [
+      {
+        question:
+          'Is Sim a Microsoft Copilot Studio alternative that is not locked into Microsoft 365?',
+        answer: [
+          'Yes, if the requirement is an agent-building workspace with ',
+          { text: 'direct model-provider integrations', href: 'https://docs.sim.ai/introduction' },
+          ' and a choice of ',
+          {
+            text: 'cloud or self-hosted deployment',
+            href: 'https://docs.sim.ai/platform/self-hosting/docker',
+          },
+          '. That does not mean Copilot Studio is confined to Microsoft 365: Microsoft documents ',
+          {
+            text: 'connectors for outside apps, including Salesforce and Google services',
+            href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-connectors',
+          },
+          ', ',
+          {
+            text: 'non-default and bring-your-own-model options',
+            href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-messages-management',
+          },
+          ', and ',
+          {
+            text: 'standalone Copilot Studio',
+            href: 'https://www.microsoft.com/en-us/copilot/pricing/copilot-studio',
+          },
+          ". Sim is the different product fit when control over the workspace's hosting and provider configuration is the deciding factor.",
+        ],
+      },
+    ],
+    glance: [
+      {
+        question:
+          'How do Copilot Studio, Copilot Pro, Microsoft 365 Premium, and Agent Builder differ?',
+        answer: [
+          '"Copilot Pro" is an ',
+          {
+            text: 'older consumer subscription name',
+            href: 'https://www.microsoft.com/en-us/copilot/blog/2025/10/01/meet-microsoft-365-premium-your-ai-and-productivity-powerhouse/',
+          },
+          ' that still appears in searches; Microsoft describes ',
+          {
+            text: 'Microsoft 365 Premium',
+            href: 'https://support.microsoft.com/en-us/office/introducing-microsoft-365-premium',
+          },
+          ' as a subscription for one to six people with Copilot features, not as the standalone organizational agent-building license. Microsoft calls ',
+          {
+            text: 'Agent Builder',
+            href: 'https://www.microsoft.com/en-us/copilot/pricing/copilot-studio',
+          },
+          ' the lightweight, in-context creation experience inside Copilot, while Copilot Studio is its low-code agent-building product; its pricing page distinguishes capabilities included for eligible Microsoft 365 Copilot business users from standalone Studio use. If the goal is a workspace with direct model-provider integrations and self-hosting, compare Studio with Sim, not a consumer Copilot subscription.',
+        ],
+      },
+    ],
+    closing: [
+      {
+        question:
+          'What should an IT team switch to if Copilot Studio feels too limited outside the Microsoft ecosystem?',
+        answer: [
+          'Evaluate Sim if the sticking point is where the agent workspace runs or how directly the team configures model providers and tools, rather than assuming Copilot Studio cannot reach external systems. Before switching, map the agents, connectors, access rules, and publishing channels you actually use: Microsoft documents ',
+          {
+            text: 'outside-app connectors',
+            href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-connectors',
+          },
+          ', ',
+          {
+            text: 'granular governance',
+            href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/guidance/sec-gov-phase3',
+          },
+          ', and ',
+          {
+            text: 'multiple publishing channels',
+            href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/publication-fundamentals-publish-channels',
+          },
+          '. Rebuild and test one representative agent in Sim first; this is a migration decision, not a one-click replacement for every Microsoft capability.',
+        ],
+      },
+    ],
+  },
+  glance: [
+    {
+      label: 'Model choice',
+      sim: [
+        {
+          text: 'Direct integrations with multiple model providers',
+          href: 'https://docs.sim.ai/introduction',
+        },
+        ', including a ',
+        {
+          text: 'bring-your-own-key path',
+          href: 'https://docs.sim.ai/platform/costs#bring-your-own-key-byok',
+        },
+        '.',
+      ],
+      competitor: [
+        {
+          text: 'Provided models and separately billed bring-your-own-model configurations, including Azure Foundry',
+          href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-messages-management',
+        },
+        '.',
+      ],
+    },
+    {
+      label: 'Non-Microsoft integrations',
+      sim: [{ text: 'App integrations and tools for custom agents', href: '/integrations' }, '.'],
+      competitor: [
+        {
+          text: 'Standard, premium, and custom connectors',
+          href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-connectors',
+        },
+        ', including connections to services outside Microsoft.',
+      ],
+    },
+    {
+      label: 'Self-hosting',
+      sim: [
+        {
+          text: 'Docker or Kubernetes deployment',
+          href: 'https://docs.sim.ai/platform/self-hosting/docker',
+        },
+        '; the core is open source, while Enterprise features have ',
+        { text: 'separate licensing', href: 'https://docs.sim.ai/introduction' },
+        '.',
+      ],
+      competitor: [
+        'Microsoft documents ',
+        {
+          text: 'cloud deployments',
+          href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-licensing-gcc',
+        },
+        ', not a self-hosted Copilot Studio authoring or runtime deployment.',
+      ],
+    },
+    {
+      label: 'Governance and access control',
+      sim: [
+        { text: 'Workspace roles', href: 'https://docs.sim.ai/platform/permissions' },
+        ', with additional Enterprise controls separately licensed.',
+      ],
+      competitor: [
+        {
+          text: 'Entra ID access, Dataverse roles, and tenant- or environment-level data policies',
+          href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/guidance/sec-gov-phase3',
+        },
+        '.',
+      ],
+    },
+    {
+      label: 'Pricing model',
+      sim: [
+        { text: 'Credit-based cloud plans', href: '/pricing' },
+        ', with ',
+        {
+          text: 'BYOK billing distinctions',
+          href: 'https://docs.sim.ai/platform/costs#bring-your-own-key-byok',
+        },
+        '.',
+      ],
+      competitor: [
+        {
+          text: 'Copilot Credits',
+          href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-messages-management',
+        },
+        ' for metered standard-harness usage, with prepaid and pay-as-you-go options and different rules for eligible Microsoft 365 Copilot usage or BYO models.',
+      ],
+    },
+    {
+      label: 'Deployment options',
+      sim: [
+        {
+          text: 'Managed cloud or self-hosted workspace',
+          href: 'https://docs.sim.ai/platform/self-hosting/docker',
+        },
+        '.',
+      ],
+      competitor: [
+        {
+          text: 'Microsoft-operated commercial and government cloud environments',
+          href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-licensing-gcc',
+        },
+        '; agents can be ',
+        {
+          text: 'published to supported channels',
+          href: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/publication-fundamentals-publish-channels',
+        },
+        '.',
+      ],
+    },
+  ],
+  relatedReading: ['best-microsoft-copilot-studio-power-automate-alternatives'],
   standoutFeatures: [
     {
       title: 'Broad, independently audited compliance certification list',
diff --git a/apps/sim/lib/compare/data/index.ts b/apps/sim/lib/compare/data/index.ts
index fe98fe9e6ff..fee93aab365 100644
--- a/apps/sim/lib/compare/data/index.ts
+++ b/apps/sim/lib/compare/data/index.ts
@@ -21,11 +21,13 @@ export { zapierProfile } from '@/lib/compare/data/competitors/zapier'
 export { simProfile } from '@/lib/compare/data/sim'
 export type {
   ComparisonFacts,
+  ComparisonQuestion,
   CompetitorBrand,
   CompetitorMigration,
   CompetitorProfile,
   Fact,
   FactSource,
+  GlanceRow,
   Prose,
   ProseSegment,
 } from '@/lib/compare/data/types'
diff --git a/apps/sim/lib/compare/data/types.ts b/apps/sim/lib/compare/data/types.ts
index 04715fdf327..68e82d57727 100644
--- a/apps/sim/lib/compare/data/types.ts
+++ b/apps/sim/lib/compare/data/types.ts
@@ -184,6 +184,19 @@ export type ProseSegment = string | { text: string; href: string }
 /** A paragraph of comparison prose, as an ordered run of {@link ProseSegment}s. */
 export type Prose = ProseSegment[]
 
+/** A buyer question answered in its own section, worded the way buyers ask it. */
+export interface ComparisonQuestion {
+  question: string
+  answer: Prose
+}
+
+/** One row of the at-a-glance table: a buying decision point and each product's sourced answer. */
+export interface GlanceRow {
+  label: string
+  sim: Prose
+  competitor: Prose
+}
+
 /** Brand icon + colors for a competitor, sourced from a brand-intelligence lookup rather than the vendor's own docs. */
 export interface CompetitorBrand {
   /** Icon component from @/components/icons rendering this competitor's logo. */
@@ -244,6 +257,35 @@ export interface CompetitorProfile {
    * condition under which each one wins.
    */
   leadAnswer?: Prose
+  /**
+   * The question {@link leadAnswer} answers. When set, the hero shows the lead answer under it as
+   * a question heading, in place of the generic introduction.
+   */
+  leadQuestion?: string
+  /**
+   * Buyer questions answered as page sections, by position. A profile that sets them answers its
+   * buyer questions in place, so the page omits the FAQ block and its FAQ structured data lists
+   * these questions instead of {@link faqs} and the generated set.
+   */
+  questions?: {
+    /** After the lead, ahead of the product definitions: whether Sim fits the buyer's need. */
+    intro?: ComparisonQuestion[]
+    /** After the at-a-glance table, ahead of the detailed comparison. */
+    glance?: ComparisonQuestion[]
+    /** After the documented limitations, ahead of the bottom line: the switching decision. */
+    closing?: ComparisonQuestion[]
+  }
+  /**
+   * Summary of the main buying decision points, shown after the product definitions and ahead of
+   * the feature-by-feature comparison, which it summarizes rather than replaces.
+   */
+  glance?: GlanceRow[]
+  /**
+   * Library slugs listed under Related reading, in order, in place of the articles matched by
+   * {@link mentions}. Set it to point at one broader article, such as an alternatives roundup,
+   * instead of listing several that repeat this page.
+   */
+  relatedReading?: string[]
   /**
    * Answer to the "Is Sim better than {name}?" section, phrased the way buyers
    * ask the question of an AI model. Verdict first, then the condition that
diff --git a/apps/sim/lib/core/config/feature-flags.ts b/apps/sim/lib/core/config/feature-flags.ts
index e5153791165..5394541ae6e 100644
--- a/apps/sim/lib/core/config/feature-flags.ts
+++ b/apps/sim/lib/core/config/feature-flags.ts
@@ -69,7 +69,7 @@ const FEATURE_FLAGS = {
   },
   'sim-links': {
     description:
-      'Enable organization Sim links (go links): the Sim Links page and sim/<name> redirects. Supports organization rollout; disabled by default.',
+      'Enable organization links: the Links page and sim/<name> and go/<name> redirects. Supports organization rollout; disabled by default.',
     fallback: 'SIM_LINKS',
   },
   people: {
diff --git a/apps/sim/lib/internal/file/delegated-caller-write.integration.ts b/apps/sim/lib/internal/file/delegated-caller-write.integration.ts
new file mode 100644
index 00000000000..d234c9c713f
--- /dev/null
+++ b/apps/sim/lib/internal/file/delegated-caller-write.integration.ts
@@ -0,0 +1,146 @@
+/**
+ * Mothership runs a file tool through `tools execute`, whose use case authorizes the chat's
+ * delegated principal for `sim:tool-execution`. The File write that follows must still reach the
+ * workspace-file use cases, which admit only `sim:workspace-files`, and must still refuse a
+ * subject or workspace the original delegation does not cover. Exercises the real handler,
+ * application authorization, metadata and local storage against Postgres.
+ */
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import type { SubjectDelegatedPrincipal } from '@sim/auth/principal'
+import { db } from '@sim/db'
+import { auditLog, organization, user, workspace, workspaceFiles } from '@sim/db/schema'
+import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { createDelegatedPrincipal } from '@sim/testing/factories/principal.factory'
+import { setUploadDirServer, uploadsSetupMock } from '@sim/testing/mocks/uploads-setup.mock'
+import { generateId } from '@sim/utils/id'
+import { and, eq, inArray } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/uploads/core/setup.server', () => uploadsSetupMock)
+
+import { executeFileTool } from '@/lib/internal/file/execute-tool'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import { uploadCopilotFile } from '@/lib/uploads/contexts/copilot/file-manager'
+
+const fixtures: ReturnType<typeof createKnowledgeAclFixtureIds>[] = []
+
+async function seed() {
+  const ids = createKnowledgeAclFixtureIds()
+  fixtures.push(ids)
+  await seedKnowledgeAclFixture(ids)
+  return ids
+}
+
+type Fixture = Awaited<ReturnType<typeof seed>>
+
+/** The chat principal `tools execute` hands to the tool layer. */
+function toolExecutionPrincipal(subjectUserId: string, workspaceId: string) {
+  return createDelegatedPrincipal({
+    subjectUserId,
+    workspaceId,
+    audience: 'sim:tool-execution',
+    resourceScope: { chatId: generateId() },
+  })
+}
+
+/** A generated image as `image_generate` stores it outside a workflow run. */
+async function generatedImage(ownerId: string) {
+  return uploadCopilotFile({
+    buffer: Buffer.from(`image bytes ${generateId()}`),
+    fileName: `${generateId()}.webp`,
+    contentType: 'image/webp',
+    userId: ownerId,
+  })
+}
+
+async function writeCopy(
+  ids: Fixture,
+  principal: SubjectDelegatedPrincipal,
+  fileInput: Awaited<ReturnType<typeof generatedImage>>
+) {
+  const fileName = `saved-${generateId()}.webp`
+  const response = await executeFileTool({
+    toolId: 'file_write',
+    input: { operation: 'write', workspaceId: ids.workspaceId, fileName, fileInput },
+    headers: new Headers(),
+    requestId: generateId(),
+    context: {
+      workflowId: '',
+      workspaceId: ids.workspaceId,
+      userId: principal.subjectUserId,
+      callerPrincipal: principal,
+    },
+  })
+  const [saved] = await db
+    .select({ id: workspaceFiles.id, sizeBytes: workspaceFiles.sizeBytes })
+    .from(workspaceFiles)
+    .where(
+      and(
+        eq(workspaceFiles.workspaceId, ids.workspaceId),
+        eq(workspaceFiles.originalName, fileName),
+        eq(workspaceFiles.context, 'workspace')
+      )
+    )
+  return { status: response.status, saved }
+}
+
+const uploadRoot = mkdtempSync(path.join(tmpdir(), 'sim-delegated-caller-write-'))
+
+beforeAll(() => {
+  setUploadDirServer(uploadRoot)
+})
+
+afterAll(async () => {
+  try {
+    for (const ids of fixtures) {
+      await db.delete(auditLog).where(eq(auditLog.workspaceId, ids.workspaceId))
+      await db
+        .delete(workspaceFiles)
+        .where(inArray(workspaceFiles.userId, [ids.aliceId, ids.bobId]))
+      await deleteWorkspaceFixture(db, eq(workspace.id, ids.workspaceId))
+      await db.delete(organization).where(eq(organization.id, ids.organizationId))
+      await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+    }
+    await rm(uploadRoot, { recursive: true, force: true })
+  } finally {
+    await db.$client.end()
+  }
+})
+
+describe('a File write run directly from a Mothership chat', () => {
+  it('saves a generated image into Workspace Files', async () => {
+    const ids = await seed()
+    const image = await generatedImage(ids.aliceId)
+
+    const result = await writeCopy(ids, toolExecutionPrincipal(ids.aliceId, ids.workspaceId), image)
+
+    expect(result.status).toBe(200)
+    expect(result.saved?.sizeBytes).toBe(image.size)
+  })
+
+  it('still refuses a member whose role cannot write', async () => {
+    const ids = await seed()
+    const image = await generatedImage(ids.bobId)
+
+    const result = await writeCopy(ids, toolExecutionPrincipal(ids.bobId, ids.workspaceId), image)
+
+    expect(result.status).toBe(403)
+    expect(result.saved).toBeUndefined()
+  })
+
+  it('still refuses a delegation minted for another workspace', async () => {
+    const ids = await seed()
+    const image = await generatedImage(ids.aliceId)
+
+    const result = await writeCopy(ids, toolExecutionPrincipal(ids.aliceId, generateId()), image)
+
+    expect(result.status).toBe(403)
+    expect(result.saved).toBeUndefined()
+  })
+})
diff --git a/apps/sim/lib/internal/file/execute-tool.ts b/apps/sim/lib/internal/file/execute-tool.ts
index 88c3950d70b..15764b6d1db 100644
--- a/apps/sim/lib/internal/file/execute-tool.ts
+++ b/apps/sim/lib/internal/file/execute-tool.ts
@@ -1,4 +1,8 @@
-import { resolvePrincipalAttribution, resolvePrincipalSubject } from '@sim/auth/principal'
+import {
+  type Principal,
+  resolvePrincipalAttribution,
+  resolvePrincipalSubject,
+} from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { z } from 'zod'
@@ -25,6 +29,7 @@ import {
 import { parseInternalToolInput } from '@/lib/internal/tool-operations/parse-input'
 import type { InternalToolOperationHandler } from '@/lib/internal/tool-operations/types'
 import { WORKSPACE_FILES_DELEGATION_AUDIENCE } from '@/lib/workspace-files/application/authorization'
+import { rebindWorkspaceFileDelegatedPrincipal } from '@/lib/workspace-files/application/delegated-principal'
 import { searchWorkspaceFileContent } from '@/lib/workspace-files/application/search-workspace-file-content'
 import {
   FILE_SEARCH_DEFAULT_MAX_RESULTS,
@@ -79,6 +84,34 @@ const fileSearchInputSchema = z
   })
   .strict()
 
+/**
+ * A delegated caller arrives with its calling use case's audience (`sim:tool-execution`),
+ * but workspace-file use cases admit only `sim:workspace-files`; they still check the
+ * subject's access. A delegation for another workspace is left for them to refuse.
+ */
+function bindWorkspaceFilePrincipal(
+  principal: Principal,
+  workspaceId: string,
+  requestId: string
+): Principal {
+  if (
+    principal.kind !== 'delegated' ||
+    principal.audience === WORKSPACE_FILES_DELEGATION_AUDIENCE ||
+    principal.workspaceId !== workspaceId
+  ) {
+    return principal
+  }
+  const scope = principal.resourceScope
+  return rebindWorkspaceFileDelegatedPrincipal({
+    principal,
+    workspaceId,
+    delegationId: `file-tool:${requestId}`,
+    fileId: scope?.fileId,
+    chatId: scope?.chatId,
+    executionId: scope?.executionId,
+  })
+}
+
 export const executeFileTool: InternalToolOperationHandler = async (request) => {
   request.signal?.throwIfAborted()
   if (!FILE_MANAGE_TOOL_IDS.has(request.toolId)) {
@@ -117,7 +150,11 @@ export const executeFileTool: InternalToolOperationHandler = async (request) =>
   try {
     const principal =
       request.context.callerPrincipal && !request.context.executorDelegationOrigin
-        ? request.context.callerPrincipal
+        ? bindWorkspaceFilePrincipal(
+            request.context.callerPrincipal,
+            workspaceId,
+            request.requestId
+          )
         : await createExecutorPrincipalFromExecutionContext({
             context: request.context,
             audience: WORKSPACE_FILES_DELEGATION_AUDIENCE,
diff --git a/apps/sim/lib/internal/image/operations.ts b/apps/sim/lib/internal/image/operations.ts
index 82f61d11c66..0feef97bf1f 100644
--- a/apps/sim/lib/internal/image/operations.ts
+++ b/apps/sim/lib/internal/image/operations.ts
@@ -1,7 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { interruptibleSleep } from '@sim/utils/helpers'
-import { isRecordLike } from '@sim/utils/object'
+import { isRecordLike, omit } from '@sim/utils/object'
 import { getUserFacingErrorMessage } from '@/lib/core/errors/database-query-error'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
 import {
@@ -23,6 +23,7 @@ import { recordServiceMeteringFailure } from '@/lib/mothership/billing/service-o
 import { type FalAICostMetadata, getFalAICostMetadata } from '@/lib/tools/falai-pricing'
 import { uploadCopilotFile } from '@/lib/uploads/contexts/copilot'
 import { uploadExecutionFile } from '@/lib/uploads/contexts/execution'
+import { resolveStoredFileMetadata } from '@/lib/uploads/utils/stored-file-metadata'
 
 const logger = createLogger('ImageOperations')
 const MAX_IMAGE_BYTES = MAX_REMOTE_IMAGE_BYTES
@@ -595,8 +596,11 @@ async function storeGeneratedImage(
   context: ImageOperationContext
 ): Promise<StoredImageResponse> {
   context.signal?.throwIfAborted()
-  const timestamp = Date.now()
-  const safeFileName = imageResult.fileName || `image-${imageResult.provider}-${timestamp}.png`
+  const { fileName, mimeType: contentType } = resolveStoredFileMetadata(
+    imageResult.fileName || `image-${imageResult.provider}-${Date.now()}.png`,
+    imageResult.contentType,
+    imageResult.buffer
+  )
   const executionContext =
     context.workspaceId && context.workflowId && context.executionId
       ? {
@@ -606,56 +610,32 @@ async function storeGeneratedImage(
         }
       : null
 
-  if (executionContext) {
-    const imageFile = await uploadExecutionFile(
-      executionContext,
-      imageResult.buffer,
-      safeFileName,
-      imageResult.contentType,
-      context.userId
-    )
-    context.signal?.throwIfAborted()
-
-    return {
-      content: imageFile.url,
-      imageUrl: imageFile.url,
-      imageFile,
-      fileName: safeFileName,
-      contentType: imageResult.contentType,
-      provider: imageResult.provider,
-      model: imageResult.model,
-      metadata: {
-        provider: imageResult.provider,
-        model: imageResult.model,
-        description: imageResult.description,
-        revisedPrompt: imageResult.revisedPrompt,
-        seed: imageResult.seed,
-        jobId: imageResult.jobId,
-        contentType: imageResult.contentType,
-      },
-      __falaiCostDollars: imageResult.falaiCost?.costDollars,
-      __falaiBilling: imageResult.falaiCost,
-    }
-  }
-
-  const fileInfo = await uploadCopilotFile({
-    buffer: imageResult.buffer,
-    fileName: safeFileName,
-    contentType: imageResult.contentType,
-    userId: context.userId,
-  })
+  // A stored file output is kept as is; a bare URL would be downloaded and stored again.
+  const imageFile = executionContext
+    ? await uploadExecutionFile(
+        executionContext,
+        imageResult.buffer,
+        fileName,
+        contentType,
+        context.userId
+      )
+    : omit(
+        await uploadCopilotFile({
+          buffer: imageResult.buffer,
+          fileName,
+          contentType,
+          userId: context.userId,
+        }),
+        ['mimeType']
+      )
   context.signal?.throwIfAborted()
-  const imageUrl = fileInfo.url
-  logger.info(`[${context.requestId}] Stored generated image fallback`, {
-    fileName: safeFileName,
-    size: imageResult.buffer.length,
-  })
 
   return {
-    content: imageUrl,
-    imageUrl,
-    fileName: safeFileName,
-    contentType: imageResult.contentType,
+    content: imageFile.url,
+    imageUrl: imageFile.url,
+    imageFile,
+    fileName,
+    contentType,
     provider: imageResult.provider,
     model: imageResult.model,
     metadata: {
@@ -665,7 +645,7 @@ async function storeGeneratedImage(
       revisedPrompt: imageResult.revisedPrompt,
       seed: imageResult.seed,
       jobId: imageResult.jobId,
-      contentType: imageResult.contentType,
+      contentType,
     },
     __falaiCostDollars: imageResult.falaiCost?.costDollars,
     __falaiBilling: imageResult.falaiCost,
diff --git a/apps/sim/lib/internal/tool-operations/types.ts b/apps/sim/lib/internal/tool-operations/types.ts
index 605899e1adf..9a6db19cab7 100644
--- a/apps/sim/lib/internal/tool-operations/types.ts
+++ b/apps/sim/lib/internal/tool-operations/types.ts
@@ -22,7 +22,10 @@ export interface InternalToolOperationContext {
   executorDelegationOrigin?: ExecutorDelegationOrigin
   /** Trusted source block for saved MCP operation restrictions. */
   mcpBlockId?: string
-  /** Authenticated direct caller, supplied by an authorized use case, never tool input. */
+  /**
+   * Authenticated direct caller, supplied by an authorized use case, never tool input. A
+   * delegated principal carries that use case's audience; rebind it before another use case.
+   */
   callerPrincipal?: Principal
   copilotToolExecution?: boolean
   copilotInteractionMode?: 'interactive' | 'headless'
diff --git a/apps/sim/lib/logs/execution/logging-session.test.ts b/apps/sim/lib/logs/execution/logging-session.test.ts
index 4c4b625496d..69c1211fb30 100644
--- a/apps/sim/lib/logs/execution/logging-session.test.ts
+++ b/apps/sim/lib/logs/execution/logging-session.test.ts
@@ -6,6 +6,7 @@ import {
 } from '@sim/testing/mocks/billing-usage-reservation.mock'
 import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
 import { executionPayloadStoreMock } from '@sim/testing/mocks/execution-payload-store.mock'
+import { getMockLogger } from '@sim/testing/mocks/logger.mock'
 import {
   getMockPlatformEvent,
   telemetryMock,
@@ -774,6 +775,35 @@ describe('LoggingSession completion retries', () => {
     expect(rawLogs[128].output.value).toBe('row-128:raw-secret')
   })
 
+  it('labels a live block-log projection warning with the live phase', async () => {
+    const session = new LoggingSession('workflow-1', 'execution-live-phase', 'manual', 'req-1')
+    session.setResolvedSecretTraceRegistry(
+      createSecretRegistry([{ plaintext: 'raw-secret', replacement: '{{TOKEN}}' }])
+    )
+
+    await session.projectBlockLogsForDisplay([
+      {
+        blockId: 'function-1',
+        blockName: 'Function 1',
+        blockType: 'function',
+        startedAt: '2026-07-01T00:00:00.000Z',
+        endedAt: '2026-07-01T00:00:00.001Z',
+        durationMs: 1,
+        success: true,
+        executionOrder: 1,
+        output: { rows: Array.from({ length: 100_001 }, (_, index) => index) },
+        displayResolvedSecretTraceProvenance: createDisplayProvenance([
+          { plaintext: 'raw-secret', replacement: '{{TOKEN}}' },
+        ]),
+      },
+    ])
+
+    expect(getMockLogger('TraceSecretProjection').warn).toHaveBeenCalledWith(
+      'Omitting trace content that could not be sanitized',
+      expect.objectContaining({ executionId: 'execution-live-phase', phase: 'live' })
+    )
+  })
+
   it('projects a numeric Function result produced by a resolved numeric secret', async () => {
     const session = new LoggingSession('workflow-1', 'execution-numeric-secret', 'manual', 'req-1')
     session.setResolvedSecretTraceRegistry(
diff --git a/apps/sim/lib/logs/execution/logging-session.ts b/apps/sim/lib/logs/execution/logging-session.ts
index a3e4f8d88c9..dc205891752 100644
--- a/apps/sim/lib/logs/execution/logging-session.ts
+++ b/apps/sim/lib/logs/execution/logging-session.ts
@@ -309,11 +309,13 @@ export class LoggingSession {
 
   private async projectRawTraceSpans(
     traceSpans: TraceSpan[],
-    registry = this.resolvedSecretTraceRegistry
+    registry = this.resolvedSecretTraceRegistry,
+    phase?: 'live'
   ): Promise<TraceSpan[]> {
     return projectTraceSpansForSecrets(traceSpans, {
       registry,
       store: this.getSecretProjectionStore(),
+      phase,
     })
   }
 
@@ -365,7 +367,8 @@ export class LoggingSession {
             output: envelope,
           },
         ],
-        registry
+        registry,
+        'live'
       )
       const projected = this.readProjectedDisplayContent(projectedSpan?.output)
       return this.shouldClearLiveDisplay(registry)
@@ -426,7 +429,8 @@ export class LoggingSession {
               ...(log.childTraceSpans ? { children: log.childTraceSpans } : {}),
             },
           ],
-          registry
+          registry,
+          'live'
         )
         const display = this.readProjectedDisplayContent(projectedLog?.output)
         displayLogs.push({
@@ -1503,7 +1507,7 @@ export class LoggingSession {
    * structure with no content rather than unprojected values.
    */
   async projectTraceSpansForLiveDisplay(traceSpans: TraceSpan[]): Promise<TraceSpan[]> {
-    return this.projectRawTraceSpans(traceSpans)
+    return this.projectRawTraceSpans(traceSpans, undefined, 'live')
   }
 
   async safeComplete(params: SessionCompleteParams = {}): Promise<void> {
diff --git a/apps/sim/lib/logs/execution/trace-secret-projection.test.ts b/apps/sim/lib/logs/execution/trace-secret-projection.test.ts
index 84b214b1e55..bd339ed6f7a 100644
--- a/apps/sim/lib/logs/execution/trace-secret-projection.test.ts
+++ b/apps/sim/lib/logs/execution/trace-secret-projection.test.ts
@@ -1019,6 +1019,13 @@ describe('projectTraceSpansForSecrets', () => {
     }
 
     expect(warnMock).toHaveBeenCalledWith('Omitting trace content that could not be sanitized', {
+      executionId: 'execution-1',
+      workflowId: 'workflow-1',
+      workspaceId: 'workspace-1',
+      phase: 'write',
+      spanId: 'span-1',
+      spanType: 'function',
+      field: 'output',
       failure: { name: 'SyntaxError' },
     })
   })
@@ -1048,3 +1055,207 @@ describe('projectTraceSpansForSecrets', () => {
     expect(cursor?.children).toEqual([])
   })
 })
+
+describe('projectTraceSpansForSecrets whole-trace content budget', () => {
+  const SECRET_REGISTRY = createRegistry([
+    { plaintext: 'top-secret', replacement: '{{API_SECRET}}' },
+  ])
+
+  /** A span whose output alone fits the content budget but two-and-a-half of which do not. */
+  function heavySpan(id: string, marker: string, overrides: Partial<TraceSpan> = {}): TraceSpan {
+    return createSpan({
+      id,
+      output: { marker, items: Array.from({ length: 40_000 }, (_, index) => `row-${index}`) },
+      ...overrides,
+    })
+  }
+
+  it('keeps the spans checked before the budget ran out and withholds the rest', async () => {
+    const projected = await projectTraceSpansForSecrets(
+      [
+        heavySpan('span-a', 'first top-secret'),
+        heavySpan('span-b', 'second'),
+        heavySpan('span-c', 'third top-secret'),
+        createSpan({ id: 'span-d', output: { marker: 'fourth top-secret' } }),
+      ],
+      { registry: SECRET_REGISTRY, store: STORE, allowLargeValueWrites: false }
+    )
+
+    expect(projected.map((span) => span.id)).toEqual(['span-a', 'span-b', 'span-c', 'span-d'])
+    expect(projected[0].output?.marker).toBe('first {{API_SECRET}}')
+    expect(projected[0]).not.toHaveProperty('contentWithheld')
+    expect(projected[1].output?.marker).toBe('second')
+    for (const withheld of projected.slice(2)) {
+      expect(withheld).not.toHaveProperty('output')
+      expect(withheld.contentWithheld).toBe(true)
+    }
+    expect(JSON.stringify(projected)).not.toContain('top-secret')
+    expect(warnMock).toHaveBeenCalledWith(
+      'Trace content exceeded the projection budget; withholding the remaining content',
+      expect.objectContaining({
+        executionId: 'execution-1',
+        phase: 'read',
+        retainedSpanCount: 2,
+        withheldSpanCount: 2,
+      })
+    )
+  })
+
+  it('still withholds every span when a later span fails for any reason but the budget', async () => {
+    const projected = await projectTraceSpansForSecrets(
+      [
+        createSpan({ id: 'span-a', output: { marker: 'first' } }),
+        createSpan({
+          id: 'span-b',
+          toolCalls: Array.from({ length: 100_001 }, (_, index) => ({
+            name: `tool-${index}`,
+            duration: 0,
+            startTime: '2026-07-01T00:00:00.000Z',
+            endTime: '2026-07-01T00:00:00.000Z',
+            status: 'success',
+          })),
+        }),
+      ],
+      { registry: SECRET_REGISTRY, store: STORE, allowLargeValueWrites: false }
+    )
+
+    expect(projected[0]).not.toHaveProperty('output')
+    expect(projected[0].contentWithheld).toBe(true)
+    expect(warnMock).toHaveBeenCalledWith(
+      'Trace secret projection failed; retaining structural spans only',
+      expect.objectContaining({ executionId: 'execution-1', phase: 'read' })
+    )
+  })
+
+  it('keeps the retained spans and the withheld fallback within one structure budget', async () => {
+    const emptyChildren = (prefix: string) =>
+      Array.from({ length: 60_000 }, (_, index) => createSpan({ id: `${prefix}-${index}` }))
+    const projected = await projectTraceSpansForSecrets(
+      [
+        heavySpan('span-a', 'first', { children: emptyChildren('a') }),
+        createSpan({
+          id: 'span-b',
+          output: { items: Array.from({ length: 70_000 }, (_, index) => `row-${index}`) },
+          children: emptyChildren('b'),
+        }),
+      ],
+      { registry: SECRET_REGISTRY, store: STORE, allowLargeValueWrites: false }
+    )
+    const countSpans = (spans: TraceSpan[]): number =>
+      spans.reduce((total, span) => total + 1 + countSpans(span.children ?? []), 0)
+
+    expect(projected[0].output?.marker).toBe('first')
+    expect(projected[1]).not.toHaveProperty('output')
+    expect(countSpans(projected)).toBeLessThanOrEqual(100_000)
+  })
+
+  it('keeps the structure a whole-trace fallback would for the span that crossed the budget', async () => {
+    const toolCall = (index: number) => ({
+      name: `tool-${index}`,
+      duration: 0,
+      startTime: '2026-07-01T00:00:00.000Z',
+      endTime: '2026-07-01T00:00:00.000Z',
+      status: 'success' as const,
+    })
+    const projected = await projectTraceSpansForSecrets(
+      [
+        heavySpan('span-a', 'first', {
+          children: Array.from({ length: 30_000 }, (_, index) => createSpan({ id: `a-${index}` })),
+        }),
+        createSpan({
+          id: 'span-b',
+          output: { items: Array.from({ length: 70_000 }, (_, index) => `row-${index}`) },
+          toolCalls: Array.from({ length: 50_000 }, (_, index) => toolCall(index)),
+        }),
+      ],
+      { registry: SECRET_REGISTRY, store: STORE, allowLargeValueWrites: false }
+    )
+
+    expect(projected[0].output?.marker).toBe('first')
+    expect(projected[1]).not.toHaveProperty('output')
+    expect(projected[1].toolCalls).toHaveLength(50_000)
+  })
+
+  it('keeps checked content under a single workflow root when a descendant crosses the budget', async () => {
+    const projected = await projectTraceSpansForSecrets(
+      [
+        createSpan({
+          id: 'workflow-execution',
+          output: { marker: 'root top-secret' },
+          children: [
+            heavySpan('block-a', 'first top-secret'),
+            createSpan({
+              id: 'loop',
+              output: { marker: 'loop top-secret' },
+              children: [
+                heavySpan('iteration-1', 'second'),
+                heavySpan('iteration-2', 'third top-secret', {
+                  children: [createSpan({ id: 'nested', output: { marker: 'nested top-secret' } })],
+                }),
+                createSpan({ id: 'iteration-3', output: { marker: 'fourth top-secret' } }),
+              ],
+            }),
+            createSpan({ id: 'block-b', output: { marker: 'fifth top-secret' } }),
+          ],
+        }),
+        createSpan({ id: 'after-root', output: { marker: 'sixth top-secret' } }),
+      ],
+      { registry: SECRET_REGISTRY, store: STORE, allowLargeValueWrites: false }
+    )
+
+    const [root, afterRoot] = projected
+    const [blockA, loop, blockB] = root.children ?? []
+    const [iteration1, iteration2, iteration3] = loop.children ?? []
+
+    for (const [kept, marker] of [
+      [root, 'root {{API_SECRET}}'],
+      [blockA, 'first {{API_SECRET}}'],
+      [loop, 'loop {{API_SECRET}}'],
+      [iteration1, 'second'],
+    ] as const) {
+      expect(kept.output?.marker).toBe(marker)
+      expect(kept).not.toHaveProperty('contentWithheld')
+    }
+    for (const withheld of [iteration2, iteration2.children?.[0], iteration3, blockB, afterRoot]) {
+      expect(withheld).toMatchObject({ contentWithheld: true })
+      expect(withheld).not.toHaveProperty('output')
+    }
+    expect(JSON.stringify(projected)).not.toContain('top-secret')
+    expect(warnMock).toHaveBeenCalledWith(
+      'Trace content exceeded the projection budget; withholding the remaining content',
+      expect.objectContaining({ retainedSpanCount: 4, withheldSpanCount: 5 })
+    )
+  })
+
+  it('withholds every span when a descendant fails for any reason but the budget', async () => {
+    const projected = await projectTraceSpansForSecrets(
+      [
+        createSpan({
+          id: 'workflow-execution',
+          output: { marker: 'root' },
+          children: [
+            createSpan({ id: 'block-a', output: { marker: 'first' } }),
+            createSpan({
+              id: 'block-b',
+              toolCalls: Array.from({ length: 100_001 }, (_, index) => ({
+                name: `tool-${index}`,
+                duration: 0,
+                startTime: '2026-07-01T00:00:00.000Z',
+                endTime: '2026-07-01T00:00:00.000Z',
+                status: 'success',
+              })),
+            }),
+          ],
+        }),
+      ],
+      { registry: SECRET_REGISTRY, store: STORE, allowLargeValueWrites: false }
+    )
+
+    expect(projected[0]).not.toHaveProperty('output')
+    expect(projected[0].children?.[0]).not.toHaveProperty('output')
+    expect(warnMock).toHaveBeenCalledWith(
+      'Trace secret projection failed; retaining structural spans only',
+      expect.objectContaining({ executionId: 'execution-1', phase: 'read' })
+    )
+  })
+})
diff --git a/apps/sim/lib/logs/execution/trace-secret-projection.ts b/apps/sim/lib/logs/execution/trace-secret-projection.ts
index 9b3a1110476..5edc3638769 100644
--- a/apps/sim/lib/logs/execution/trace-secret-projection.ts
+++ b/apps/sim/lib/logs/execution/trace-secret-projection.ts
@@ -1,6 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
-import { isPlainRecord, omit } from '@sim/utils/object'
+import { filterUndefined, isPlainRecord, omit } from '@sim/utils/object'
 import { yieldWhenSliceExpires } from '@/lib/core/utils/event-loop'
 import {
   isLargeArrayManifest,
@@ -84,6 +84,10 @@ interface ProjectionContext {
   storedLargeValueCount: number
   /** Content fields omitted so far; a span compares it across its own fields to set `contentWithheld`. */
   omittedContentFields: number
+  logDetails: ProjectionLogDetails
+  displayFieldsBySpanId?: ReadonlyMap<string, string>
+  /** Set once the content walk runs out of budget; every span after that keeps only its structure. */
+  contentBudgetFailure?: TraceContentBudgetError
 }
 
 interface OversizedHydrationGate {
@@ -123,6 +127,13 @@ export interface ProjectTraceSpansForSecretsOptions {
   store: LargeValueStoreContext
   /** Read-only display projections omit ref-backed content instead of writing another ref. */
   allowLargeValueWrites?: boolean
+  /** Labels warnings; defaults to `write`, or `read` when large-value writes are disabled. */
+  phase?: ProjectionPhase
+  /**
+   * Synthetic spans that each carry one display-envelope value, keyed by span id. Warnings name
+   * the envelope field instead of the synthetic span and count it apart from real spans.
+   */
+  displayFieldsBySpanId?: ReadonlyMap<string, string>
 }
 
 class TraceSecretProjectionError extends Error {
@@ -132,6 +143,46 @@ class TraceSecretProjectionError extends Error {
   }
 }
 
+/**
+ * The content walk ran out of its node budget. Unlike every other projection failure, this says
+ * nothing about the content already checked: it only bounds how much more is walked.
+ */
+class TraceContentBudgetError extends TraceSecretProjectionError {}
+
+/**
+ * Why a projection ran: `write` prepares the run's stored log, `read` displays a stored log, and
+ * `live` streams a running execution to a viewer.
+ */
+type ProjectionPhase = 'write' | 'read' | 'live'
+
+/** Identifies the run behind a projection warning. */
+interface ProjectionLogDetails {
+  executionId?: string
+  workflowId?: string
+  workspaceId?: string
+  phase: ProjectionPhase
+}
+
+function projectionLogDetails(
+  store: LargeValueStoreContext,
+  phase: ProjectionPhase
+): ProjectionLogDetails {
+  return {
+    ...filterUndefined({
+      executionId: store.executionId,
+      workflowId: store.workflowId,
+      workspaceId: store.workspaceId,
+    }),
+    phase,
+  }
+}
+
+/** The span whose content field a per-field warning names. */
+interface ContentFieldOwner {
+  id: string
+  type: string
+}
+
 /**
  * Diagnostic payload for a projection fallback.
  *
@@ -150,7 +201,9 @@ function describeProjectionFailure(error: unknown): { name: string; reason?: str
 function createProjectionContext(
   matcher: ResolvedSecretMatcher,
   store: LargeValueStoreContext,
-  allowLargeValueWrites: boolean
+  allowLargeValueWrites: boolean,
+  logDetails: ProjectionLogDetails,
+  displayFieldsBySpanId?: ReadonlyMap<string, string>
 ): ProjectionContext {
   return {
     matcher,
@@ -168,13 +221,15 @@ function createProjectionContext(
     sourceLargeValueBytes: 0,
     storedLargeValueBytes: 0,
     storedLargeValueCount: 0,
+    logDetails,
+    displayFieldsBySpanId,
   }
 }
 
 function visitNode(state: TraversalState, depth: number): void {
   state.nodes += 1
   if (state.nodes > MAX_CONTENT_NODES) {
-    throw new TraceSecretProjectionError('Trace content node limit exceeded')
+    throw new TraceContentBudgetError('Trace content node limit exceeded')
   }
   if (depth > MAX_CONTENT_DEPTH) {
     throw new TraceSecretProjectionError('Trace content depth limit exceeded')
@@ -183,7 +238,7 @@ function visitNode(state: TraversalState, depth: number): void {
 
 function assertArrayFitsTraversal(value: readonly unknown[], state: TraversalState): void {
   if (value.length > MAX_CONTENT_NODES - state.nodes) {
-    throw new TraceSecretProjectionError('Trace content array exceeds the traversal limit')
+    throw new TraceContentBudgetError('Trace content array exceeds the traversal limit')
   }
 }
 
@@ -802,13 +857,20 @@ async function replaceLargeValues(
 
 async function sanitizeContentField(
   value: unknown,
-  context: ProjectionContext
+  context: ProjectionContext,
+  owner: ContentFieldOwner,
+  field: string
 ): Promise<unknown | typeof OMIT> {
   await yieldWhenSliceExpires()
   try {
     return await sanitizeMaterializedValue(value, context)
   } catch (error) {
+    const displayField = context.displayFieldsBySpanId?.get(owner.id)
     logger.warn('Omitting trace content that could not be sanitized', {
+      ...context.logDetails,
+      ...(displayField === undefined
+        ? { spanId: owner.id, spanType: owner.type, field }
+        : { displayField }),
       failure: describeProjectionFailure(error),
     })
     context.omittedContentFields += 1
@@ -829,6 +891,8 @@ function assertTraceStructureArrayFits(
 async function sanitizeIterationToolCalls(
   calls: IterationToolCall[],
   context: ProjectionContext,
+  owner: ContentFieldOwner,
+  field: string,
   state: BoundedTraceStructureState,
   depth: number
 ): Promise<IterationToolCall[]> {
@@ -839,7 +903,7 @@ async function sanitizeIterationToolCalls(
     if (!takeTraceStructureNode(state, depth)) {
       throw new TraceSecretProjectionError('Trace tool-call structure limit exceeded')
     }
-    const args = await sanitizeContentField(call.arguments, context)
+    const args = await sanitizeContentField(call.arguments, context, owner, `${field}.arguments`)
     sanitized.push(
       args === OMIT
         ? (omit(call, ['arguments']) as IterationToolCall)
@@ -852,6 +916,7 @@ async function sanitizeIterationToolCalls(
 async function sanitizeLegacyToolCalls(
   calls: ToolCall[],
   context: ProjectionContext,
+  owner: ContentFieldOwner,
   state: BoundedTraceStructureState,
   depth: number
 ): Promise<ToolCall[]> {
@@ -864,17 +929,17 @@ async function sanitizeLegacyToolCalls(
     }
     let projected: ToolCall = { ...call }
     if (call.input !== undefined) {
-      const input = await sanitizeContentField(call.input, context)
+      const input = await sanitizeContentField(call.input, context, owner, 'toolCalls.input')
       if (input === OMIT) projected = omit(projected, ['input']) as ToolCall
       else projected.input = input as Record<string, unknown>
     }
     if (call.output !== undefined) {
-      const output = await sanitizeContentField(call.output, context)
+      const output = await sanitizeContentField(call.output, context, owner, 'toolCalls.output')
       if (output === OMIT) projected = omit(projected, ['output']) as ToolCall
       else projected.output = output as Record<string, unknown>
     }
     if (call.error !== undefined) {
-      const error = await sanitizeContentField(call.error, context)
+      const error = await sanitizeContentField(call.error, context, owner, 'toolCalls.error')
       if (error === OMIT) projected = omit(projected, ['error']) as ToolCall
       else projected.error = error as string
     }
@@ -886,6 +951,7 @@ async function sanitizeLegacyToolCalls(
 async function sanitizeProviderSegment(
   segment: ProviderTimingSegment,
   context: ProjectionContext,
+  owner: ContentFieldOwner,
   state: BoundedTraceStructureState,
   depth: number
 ): Promise<ProviderTimingSegment> {
@@ -898,7 +964,12 @@ async function sanitizeProviderSegment(
   for (const key of ['assistantContent', 'thinkingContent', 'errorMessage'] as const) {
     const value = segment[key]
     if (value === undefined) continue
-    const sanitized = await sanitizeContentField(value, context)
+    const sanitized = await sanitizeContentField(
+      value,
+      context,
+      owner,
+      `providerTiming.segments.${key}`
+    )
     if (sanitized === OMIT) {
       projected = omit(projected, [key]) as ProviderTimingSegment
     } else {
@@ -910,6 +981,8 @@ async function sanitizeProviderSegment(
     projected.toolCalls = await sanitizeIterationToolCalls(
       segment.toolCalls,
       context,
+      owner,
+      'providerTiming.segments.toolCalls',
       state,
       depth + 1
     )
@@ -936,7 +1009,7 @@ async function sanitizeTraceSpan(
   for (const key of ['input', 'output', 'thinking', 'errorMessage'] as const) {
     const value = span[key]
     if (value === undefined) continue
-    const sanitized = await sanitizeContentField(value, context)
+    const sanitized = await sanitizeContentField(value, context, span, key)
     if (sanitized === OMIT) {
       projected = omit(projected, [key]) as TraceSpan
     } else {
@@ -948,20 +1021,28 @@ async function sanitizeTraceSpan(
     projected.modelToolCalls = await sanitizeIterationToolCalls(
       span.modelToolCalls,
       context,
+      span,
+      'modelToolCalls',
       state,
       depth + 1
     )
   }
 
   if (span.toolCalls !== undefined) {
-    projected.toolCalls = await sanitizeLegacyToolCalls(span.toolCalls, context, state, depth + 1)
+    projected.toolCalls = await sanitizeLegacyToolCalls(
+      span.toolCalls,
+      context,
+      span,
+      state,
+      depth + 1
+    )
   }
 
   if (span.providerTiming !== undefined) {
     assertTraceStructureArrayFits(span.providerTiming.segments, state)
     const segments: ProviderTimingSegment[] = []
     for (const segment of span.providerTiming.segments) {
-      segments.push(await sanitizeProviderSegment(segment, context, state, depth + 1))
+      segments.push(await sanitizeProviderSegment(segment, context, span, state, depth + 1))
     }
     projected.providerTiming = { ...span.providerTiming, segments }
   }
@@ -972,16 +1053,52 @@ async function sanitizeTraceSpan(
 
   if (span.children !== undefined) {
     assertTraceStructureArrayFits(span.children, state)
-    const children: TraceSpan[] = []
-    for (const child of span.children) {
-      children.push(await sanitizeTraceSpan(child, context, depth + 1, state, assertContentIsSafe))
-    }
-    projected.children = children
+    projected.children = await sanitizeSiblingSpans(
+      span.children,
+      context,
+      depth + 1,
+      state,
+      assertContentIsSafe
+    )
   }
 
   return projected
 }
 
+/**
+ * A budget failure stops at the span that crossed it, so the spans checked before it keep their
+ * content at any depth, ancestors included: each span's own content passed the whole-trace check
+ * before its children were walked. The span that crossed and every span after it fall back to
+ * structure, which resumes the budget where the retained spans left it.
+ */
+async function sanitizeSiblingSpans(
+  spans: readonly TraceSpan[],
+  context: ProjectionContext,
+  depth: number,
+  state: BoundedTraceStructureState,
+  assertContentIsSafe: SpanContentAssertion
+): Promise<TraceSpan[]> {
+  const projected: TraceSpan[] = []
+  let index = 0
+  for (; index < spans.length && !context.contentBudgetFailure; index += 1) {
+    const retainedStructureNodes = state.nodes
+    try {
+      projected.push(
+        await sanitizeTraceSpan(spans[index], context, depth, state, assertContentIsSafe)
+      )
+    } catch (error) {
+      if (!(error instanceof TraceContentBudgetError)) throw error
+      context.contentBudgetFailure = error
+      state.nodes = retainedStructureNodes
+      break
+    }
+  }
+  const withheld = projectBoundedArray(spans.slice(index), (span) =>
+    structuralOnlySpan(span, state, depth)
+  )
+  return projected.concat(withheld)
+}
+
 function stripLegacyToolCallContent(call: ToolCall): ToolCall {
   return omit(call, ['input', 'output', 'error']) as ToolCall
 }
@@ -1204,29 +1321,40 @@ function projectBoundedTraceSpans(
     span: TraceSpan,
     state: BoundedTraceStructureState,
     depth: number
-  ) => TraceSpan | undefined
+  ) => TraceSpan | undefined,
+  logDetails: ProjectionLogDetails
 ): TraceSpan[] {
   const state: BoundedTraceStructureState = { nodes: 0, truncated: false }
   const projected = projectBoundedArray(traceSpans, (span) => project(span, state, 0))
   if (state.truncated) {
-    logger.warn('Trace structure exceeded projection limits; truncating projected structure')
+    logger.warn(
+      'Trace structure exceeded projection limits; truncating projected structure',
+      logDetails
+    )
   }
   return projected
 }
 
-function structuralOnlyTraceSpans(traceSpans: TraceSpan[]): TraceSpan[] {
+function structuralOnlyTraceSpans(
+  traceSpans: TraceSpan[],
+  logDetails: ProjectionLogDetails
+): TraceSpan[] {
   try {
-    return projectBoundedTraceSpans(traceSpans, structuralOnlySpan)
+    return projectBoundedTraceSpans(traceSpans, structuralOnlySpan, logDetails)
   } catch (error) {
     logger.warn('Trace structure could not be safely traversed; omitting projected spans', {
+      ...logDetails,
       failure: describeProjectionFailure(error),
     })
     return []
   }
 }
 
-function cloneTraceSpansForProjection(traceSpans: TraceSpan[]): TraceSpan[] {
-  return projectBoundedTraceSpans(traceSpans, cloneTraceSpanForProjection)
+function cloneTraceSpansForProjection(
+  traceSpans: TraceSpan[],
+  logDetails: ProjectionLogDetails
+): TraceSpan[] {
+  return projectBoundedTraceSpans(traceSpans, cloneTraceSpanForProjection, logDetails)
 }
 
 function assertNoPlaintext(
@@ -1532,9 +1660,10 @@ async function verifyPostTransformLargeValues(
 async function assertPostTransformTraceSpansAreSafe(
   traceSpans: TraceSpan[],
   matcher: ResolvedSecretMatcher,
-  store: LargeValueStoreContext
+  store: LargeValueStoreContext,
+  logDetails: ProjectionLogDetails
 ): Promise<void> {
-  const projection = createProjectionContext(matcher, store, false)
+  const projection = createProjectionContext(matcher, store, false, logDetails)
   const context: PostTransformInvariantContext = {
     projection,
     plaintext: {
@@ -1555,6 +1684,34 @@ async function assertPostTransformTraceSpansAreSafe(
   await verifyPostTransformLargeValues(refs, context, new Set<string>())
 }
 
+/** Counts the real spans that kept or lost content, naming the withheld display-envelope fields apart. */
+function describeWithheldContent(
+  projected: readonly TraceSpan[],
+  displayFieldsBySpanId: ReadonlyMap<string, string> | undefined
+): { retainedSpanCount: number; withheldSpanCount: number; withheldDisplayFields?: string[] } {
+  let retainedSpanCount = 0
+  let withheldSpanCount = 0
+  const withheldDisplayFields: string[] = []
+  const visit = (spans: readonly TraceSpan[]) => {
+    for (const span of spans) {
+      const displayField = displayFieldsBySpanId?.get(span.id)
+      if (displayField === undefined) {
+        if (span.contentWithheld) withheldSpanCount += 1
+        else retainedSpanCount += 1
+      } else if (span.contentWithheld) {
+        withheldDisplayFields.push(displayField)
+      }
+      if (span.children) visit(span.children)
+    }
+  }
+  visit(projected)
+  return {
+    retainedSpanCount,
+    withheldSpanCount,
+    ...(withheldDisplayFields.length > 0 ? { withheldDisplayFields } : {}),
+  }
+}
+
 export interface EnforceTraceSpanSecretInvariantOptions {
   registry?: ResolvedSecretTraceRegistry
   store: LargeValueStoreContext
@@ -1570,21 +1727,23 @@ export async function enforceTraceSpanSecretInvariant(
   traceSpans: TraceSpan[],
   options: EnforceTraceSpanSecretInvariantOptions
 ): Promise<TraceSpan[]> {
+  const logDetails = projectionLogDetails(options.store, 'write')
   try {
-    if (!options.registry?.isComplete()) return structuralOnlyTraceSpans(traceSpans)
+    if (!options.registry?.isComplete()) return structuralOnlyTraceSpans(traceSpans, logDetails)
 
     const matcher = createResolvedSecretMatcher(options.registry.getActiveMatches(), {
       preserveNamedProvenanceLabels: true,
     })
     if (!matcher) return traceSpans
 
-    await assertPostTransformTraceSpansAreSafe(traceSpans, matcher, options.store)
+    await assertPostTransformTraceSpansAreSafe(traceSpans, matcher, options.store, logDetails)
     return traceSpans
   } catch (error) {
     logger.warn('Trace secret invariant failed; retaining structural spans only', {
+      ...logDetails,
       failure: describeProjectionFailure(error),
     })
-    return structuralOnlyTraceSpans(traceSpans)
+    return structuralOnlyTraceSpans(traceSpans, logDetails)
   }
 }
 
@@ -1596,34 +1755,60 @@ export async function projectTraceSpansForSecrets(
   traceSpans: TraceSpan[],
   options: ProjectTraceSpansForSecretsOptions
 ): Promise<TraceSpan[]> {
+  const allowLargeValueWrites = options.allowLargeValueWrites !== false
+  const logDetails = projectionLogDetails(
+    options.store,
+    options.phase ?? (allowLargeValueWrites ? 'write' : 'read')
+  )
   if (!options.registry?.isComplete()) {
-    return structuralOnlyTraceSpans(traceSpans)
+    return structuralOnlyTraceSpans(traceSpans, logDetails)
   }
 
   try {
     const matcher = createResolvedSecretMatcher(options.registry.getActiveMatches(), {
       preserveNamedProvenanceLabels: true,
     })
-    if (!matcher) return cloneTraceSpansForProjection(traceSpans)
+    if (!matcher) return cloneTraceSpansForProjection(traceSpans, logDetails)
 
     const context = createProjectionContext(
       matcher,
       options.store,
-      options.allowLargeValueWrites !== false
+      allowLargeValueWrites,
+      logDetails,
+      options.displayFieldsBySpanId
     )
 
-    const projected: TraceSpan[] = []
     const state: BoundedTraceStructureState = { nodes: 0, truncated: false }
     assertTraceStructureArrayFits(traceSpans, state)
-    const assertContentIsSafe = createSpanContentAssertion(traceSpans, context)
-    for (const span of traceSpans) {
-      projected.push(await sanitizeTraceSpan(span, context, 0, state, assertContentIsSafe))
+    const projected = await sanitizeSiblingSpans(
+      traceSpans,
+      context,
+      0,
+      state,
+      createSpanContentAssertion(traceSpans, context)
+    )
+    if (context.contentBudgetFailure) {
+      logger.warn(
+        'Trace content exceeded the projection budget; withholding the remaining content',
+        {
+          ...logDetails,
+          ...describeWithheldContent(projected, options.displayFieldsBySpanId),
+          failure: describeProjectionFailure(context.contentBudgetFailure),
+        }
+      )
+    }
+    if (state.truncated) {
+      logger.warn(
+        'Trace structure exceeded projection limits; truncating projected structure',
+        logDetails
+      )
     }
     return projected
   } catch (error) {
     logger.warn('Trace secret projection failed; retaining structural spans only', {
+      ...logDetails,
       failure: describeProjectionFailure(error),
     })
-    return structuralOnlyTraceSpans(traceSpans)
+    return structuralOnlyTraceSpans(traceSpans, logDetails)
   }
 }
diff --git a/apps/sim/lib/logs/execution/trace-store.test.ts b/apps/sim/lib/logs/execution/trace-store.test.ts
index 3e0a53c2d48..e17a9474815 100644
--- a/apps/sim/lib/logs/execution/trace-store.test.ts
+++ b/apps/sim/lib/logs/execution/trace-store.test.ts
@@ -28,6 +28,7 @@ const materializeLargeValueRefMock = executionPayloadStoreMockFns.mockMaterializ
 const storeExecutionTraceArchiveMock = executionPayloadStoreMockFns.mockStoreExecutionTraceArchive
 
 const mockLogger = getMockLogger('TraceStore')
+const projectionLogger = getMockLogger('TraceSecretProjection')
 
 const decryptSecretMock = encryptionMockFns.mockDecryptSecret
 
@@ -509,6 +510,123 @@ describe('projectExecutionDataForDisplay', () => {
   })
 })
 
+describe('projectExecutionDataForDisplay envelope isolation', () => {
+  const RUN_PROVENANCE = {
+    version: 1 as const,
+    complete: true,
+    entries: [{ name: 'OPENAI_API_KEY', encryptedValue: 'ciphertext' }],
+    scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+  }
+
+  function functionSpan(id: string, output: Record<string, unknown>): TraceSpan {
+    return {
+      id,
+      name: 'Function 1',
+      type: 'function',
+      duration: 1,
+      startTime: '2026-07-31T00:00:00.000Z',
+      endTime: '2026-07-31T00:00:00.001Z',
+      output,
+    }
+  }
+
+  it('withholds only the envelope value that holds a stored large value', async () => {
+    const displayData = await projectExecutionDataForDisplay(
+      {
+        error: 'Request failed with 12345678',
+        message: 'Run failed',
+        blockExecutions: [
+          {
+            blockId: 'function-1',
+            output: {
+              __simLargeValueRef: true,
+              version: 1,
+              id: 'lv_bbbbbbbbbbbb',
+              kind: 'string',
+              size: 32,
+            },
+          },
+        ],
+        traceSpans: [functionSpan('span-1', { result: 12345678 })],
+        executionState: { resolvedSecretTraceProvenance: RUN_PROVENANCE },
+      },
+      CONTEXT
+    )
+
+    expect(displayData.error).toBe('Request failed with {{OPENAI_API_KEY}}')
+    expect(displayData.message).toBe('Run failed')
+    expect(displayData).not.toHaveProperty('blockExecutions')
+    expect(projectionLogger.warn).toHaveBeenCalledWith(
+      'Omitting trace content that could not be sanitized',
+      {
+        executionId: CONTEXT.executionId,
+        workflowId: CONTEXT.workflowId,
+        workspaceId: CONTEXT.workspaceId,
+        phase: 'read',
+        displayField: 'blockExecutions',
+        failure: expect.objectContaining({ name: 'TraceSecretProjectionError' }),
+      }
+    )
+    expect(displayData.traceSpans).toEqual([
+      expect.objectContaining({ id: 'span-1', output: { result: '{{OPENAI_API_KEY}}' } }),
+    ])
+    expect(JSON.stringify(displayData)).not.toContain('12345678')
+  })
+
+  it('never mistakes a stored span for an envelope value', async () => {
+    const displayData = await projectExecutionDataForDisplay(
+      {
+        error: 'Run failed',
+        traceSpans: [
+          functionSpan('secret-safe-log-display-projection-error', { value: 'from a span' }),
+        ],
+        executionState: { resolvedSecretTraceProvenance: RUN_PROVENANCE },
+      },
+      CONTEXT
+    )
+
+    expect(displayData.error).toBe('Run failed')
+    expect(displayData.traceSpans).toEqual([
+      expect.objectContaining({
+        id: 'secret-safe-log-display-projection-error',
+        output: { value: 'from a span' },
+      }),
+    ])
+  })
+
+  it('spends the shared content budget on the trace before the block dumps', async () => {
+    const displayData = await projectExecutionDataForDisplay(
+      {
+        error: 'Request failed with 12345678',
+        blockExecutions: Array.from({ length: 70_000 }, (_, index) => `row-${index}`),
+        traceSpans: [
+          functionSpan('span-1', {
+            result: 12345678,
+            rows: Array.from({ length: 40_000 }, (_, index) => `row-${index}`),
+          }),
+        ],
+        executionState: { resolvedSecretTraceProvenance: RUN_PROVENANCE },
+      },
+      CONTEXT
+    )
+
+    expect(displayData.error).toBe('Request failed with {{OPENAI_API_KEY}}')
+    expect(displayData).not.toHaveProperty('blockExecutions')
+    expect(projectionLogger.warn).toHaveBeenCalledWith(
+      'Trace content exceeded the projection budget; withholding the remaining content',
+      expect.objectContaining({
+        retainedSpanCount: 1,
+        withheldSpanCount: 0,
+        withheldDisplayFields: ['blockExecutions'],
+      })
+    )
+    const [span] = displayData.traceSpans as TraceSpan[]
+    expect(span.output?.result).toBe('{{OPENAI_API_KEY}}')
+    expect(span).not.toHaveProperty('contentWithheld')
+    expect(JSON.stringify(displayData)).not.toContain('12345678')
+  })
+})
+
 describe('projectExecutionDataForDisplay provenance handling', () => {
   const PROVENANCE = { version: 1, complete: true, entries: [] } as const
 
diff --git a/apps/sim/lib/logs/execution/trace-store.ts b/apps/sim/lib/logs/execution/trace-store.ts
index 48c86eb92a2..a2efcc90909 100644
--- a/apps/sim/lib/logs/execution/trace-store.ts
+++ b/apps/sim/lib/logs/execution/trace-store.ts
@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { describeError, toError } from '@sim/utils/errors'
+import { generateShortId } from '@sim/utils/id'
 import { isRecordLike, omit } from '@sim/utils/object'
 import { assertKnownSizeWithinLimit } from '@/lib/core/utils/stream-limits'
 import { isLargeValueRef } from '@/lib/execution/payloads/large-value-ref'
@@ -374,16 +375,25 @@ export async function materializeExecutionData(
   }
 }
 
-const LOG_DISPLAY_CONTENT_KEYS = [
-  'finalOutput',
-  'workflowInput',
-  'blockInput',
-  'blockExecutions',
+/**
+ * Display envelope values project one per span, so an oversized or ref-backed value withholds
+ * only itself. They share the trace spans' content budget, so the bulky block dumps go after the
+ * spans: when the budget runs out, those lose their content before the run's error or its trace.
+ */
+const LEADING_LOG_DISPLAY_CONTENT_KEYS = [
   'error',
-  'errorDetails',
-  'completionFailure',
   'message',
+  'completionFailure',
+  'errorDetails',
+  'finalOutput',
+  'workflowInput',
+] as const
+const TRAILING_LOG_DISPLAY_CONTENT_KEYS = ['blockInput', 'blockExecutions'] as const
+const LOG_DISPLAY_CONTENT_KEYS = [
+  ...LEADING_LOG_DISPLAY_CONTENT_KEYS,
+  ...TRAILING_LOG_DISPLAY_CONTENT_KEYS,
 ] as const
+type LogDisplayContentKey = (typeof LOG_DISPLAY_CONTENT_KEYS)[number]
 
 const LOG_DISPLAY_PROJECTION_SPAN_ID = 'secret-safe-log-display-projection'
 const EXACT_LOG_VALUE_PROVENANCE_KEYS = {
@@ -466,10 +476,11 @@ export async function materializeExecutionDataForDisplayWithBlockOutputs(
       registry = blockImport.registry
     }
     const now = new Date().toISOString()
+    const blockOutputSpanId = `${LOG_DISPLAY_PROJECTION_SPAN_ID}-block-output`
     const [projected] = await projectTraceSpansForSecrets(
       [
         {
-          id: `${LOG_DISPLAY_PROJECTION_SPAN_ID}-block-output`,
+          id: blockOutputSpanId,
           name: 'Block Output Display Projection',
           type: 'display',
           duration: 0,
@@ -478,7 +489,12 @@ export async function materializeExecutionDataForDisplayWithBlockOutputs(
           output: { value: blockState.output },
         },
       ],
-      { registry, allowLargeValueWrites: false, store: projectionStore }
+      {
+        registry,
+        allowLargeValueWrites: false,
+        store: projectionStore,
+        displayFieldsBySpanId: new Map([[blockOutputSpanId, `blockOutput:${blockId}`]]),
+      }
     )
     if (projected?.output && Object.hasOwn(projected.output, 'value')) {
       blockOutputs.set(blockId, projected.output.value)
@@ -713,10 +729,11 @@ export async function projectExecutionDataForDisplay(
       exactRegistry.markIncomplete('untrusted-provenance', { origin: 'traceStore.exactProvenance' })
     }
 
+    const exactValueSpanId = `${LOG_DISPLAY_PROJECTION_SPAN_ID}-${valueKey}`
     const [projected] = await projectTraceSpansForSecrets(
       [
         {
-          id: `${LOG_DISPLAY_PROJECTION_SPAN_ID}-${valueKey}`,
+          id: exactValueSpanId,
           name: 'Exact Log Value Display Projection',
           type: 'display',
           duration: 0,
@@ -725,7 +742,12 @@ export async function projectExecutionDataForDisplay(
           output: { value: executionData[valueKey] },
         },
       ],
-      { registry: exactRegistry, allowLargeValueWrites: false, store: projectionStore }
+      {
+        registry: exactRegistry,
+        allowLargeValueWrites: false,
+        store: projectionStore,
+        displayFieldsBySpanId: new Map([[exactValueSpanId, valueKey]]),
+      }
     )
     if (projected?.output && Object.hasOwn(projected.output, 'value')) {
       exactValueProjections.set(valueKey, projected.output.value)
@@ -733,37 +755,51 @@ export async function projectExecutionDataForDisplay(
   }
   reportStoredDisplayProvenanceFaults('traceStore.displayProjection', context, provenanceFaults)
 
-  const envelope: Record<string, unknown> = {}
-  for (const key of LOG_DISPLAY_CONTENT_KEYS) {
-    const exactProvenanceKey =
-      EXACT_LOG_VALUE_PROVENANCE_KEYS[key as keyof typeof EXACT_LOG_VALUE_PROVENANCE_KEYS]
-    if (
-      Object.hasOwn(executionData, key) &&
-      (!exactProvenanceKey || !executionState || !Object.hasOwn(executionState, exactProvenanceKey))
-    ) {
-      envelope[key] = executionData[key]
-    }
-  }
-
   const now = new Date().toISOString()
-  const syntheticSpan: TraceSpan = {
-    id: LOG_DISPLAY_PROJECTION_SPAN_ID,
-    name: 'Log Display Projection',
-    type: 'display',
-    duration: 0,
-    startTime: now,
-    endTime: now,
-    output: envelope,
-  }
+  /** Unguessable per call, so no stored span id can be mistaken for an envelope value. */
+  const envelopeSpanIdPrefix = `${LOG_DISPLAY_PROJECTION_SPAN_ID}-${generateShortId()}`
+  const envelopeKeysBySpanId = new Map<string, LogDisplayContentKey>()
+  const envelopeSpans = (keys: readonly LogDisplayContentKey[]): TraceSpan[] =>
+    keys.flatMap((key) => {
+      const exactProvenanceKey =
+        EXACT_LOG_VALUE_PROVENANCE_KEYS[key as keyof typeof EXACT_LOG_VALUE_PROVENANCE_KEYS]
+      if (
+        !Object.hasOwn(executionData, key) ||
+        (exactProvenanceKey && executionState && Object.hasOwn(executionState, exactProvenanceKey))
+      ) {
+        return []
+      }
+      const id = `${envelopeSpanIdPrefix}-${key}`
+      envelopeKeysBySpanId.set(id, key)
+      return [
+        {
+          id,
+          name: 'Log Display Projection',
+          type: 'display',
+          duration: 0,
+          startTime: now,
+          endTime: now,
+          output: { value: executionData[key] },
+        },
+      ]
+    })
   const sourceTraceSpans = Array.isArray(executionData.traceSpans)
     ? (executionData.traceSpans as TraceSpan[])
     : []
   const spansToProject = retainStoredTraceSpans ? [] : sourceTraceSpans
-  const projectedSpans = await projectTraceSpansForSecrets([syntheticSpan, ...spansToProject], {
-    registry,
-    allowLargeValueWrites: false,
-    store: projectionStore,
-  })
+  const projectedSpans = await projectTraceSpansForSecrets(
+    [
+      ...envelopeSpans(LEADING_LOG_DISPLAY_CONTENT_KEYS),
+      ...spansToProject,
+      ...envelopeSpans(TRAILING_LOG_DISPLAY_CONTENT_KEYS),
+    ],
+    {
+      registry,
+      allowLargeValueWrites: false,
+      store: projectionStore,
+      displayFieldsBySpanId: envelopeKeysBySpanId,
+    }
+  )
 
   const displayData = omit(executionData, [
     ...LOG_DISPLAY_CONTENT_KEYS,
@@ -771,12 +807,10 @@ export async function projectExecutionDataForDisplay(
     'traceSpans',
   ]) as Record<string, unknown>
 
-  const projectedEnvelope = projectedSpans.find(
-    (span) => span.id === LOG_DISPLAY_PROJECTION_SPAN_ID
-  )?.output
-  if (projectedEnvelope) {
-    for (const key of LOG_DISPLAY_CONTENT_KEYS) {
-      if (Object.hasOwn(projectedEnvelope, key)) displayData[key] = projectedEnvelope[key]
+  for (const span of projectedSpans) {
+    const key = envelopeKeysBySpanId.get(span.id)
+    if (key && span.output && Object.hasOwn(span.output, 'value')) {
+      displayData[key] = span.output.value
     }
   }
   for (const [key, value] of exactValueProjections) {
@@ -786,7 +820,7 @@ export async function projectExecutionDataForDisplay(
   if (Array.isArray(executionData.traceSpans)) {
     displayData.traceSpans = retainStoredTraceSpans
       ? sourceTraceSpans
-      : projectedSpans.filter((span) => span.id !== LOG_DISPLAY_PROJECTION_SPAN_ID)
+      : projectedSpans.filter((span) => !envelopeKeysBySpanId.has(span.id))
   }
 
   return displayData
diff --git a/apps/sim/lib/mothership/chat/page-context.ts b/apps/sim/lib/mothership/chat/page-context.ts
index a3c4aa70d65..78c8b827645 100644
--- a/apps/sim/lib/mothership/chat/page-context.ts
+++ b/apps/sim/lib/mothership/chat/page-context.ts
@@ -1,17 +1,26 @@
-const MAX_PAGE_CONTEXTS = 3
+import type { PageSnapshot } from '@sim/browser-extension-protocol'
+import { utf8ByteLength } from '@sim/utils/paste'
+import { MAX_CHAT_CONTEXTS } from '@/lib/mothership/chat/context-limits'
+
+const MAX_PAGE_CONTEXT_TEXT_LENGTH = 150_000
+const MAX_PAGE_CONTEXT_BYTES = 450_000
 
 /** Bounds the combined page budget and refuses ambiguous snapshot identities within a turn. */
 export function getPageContextBudgetError(
-  contexts: readonly { kind: string; snapshot?: { id: string } }[]
+  contexts: readonly { kind: string; snapshot?: PageSnapshot }[]
 ): string | undefined {
-  let count = 0
+  if (contexts.length > MAX_CHAT_CONTEXTS) return 'Too many attachments'
+  let textLength = 0
+  let bytes = 0
   const ids = new Set<string>()
   for (const context of contexts) {
     if (context.kind !== 'browser_page') continue
-    if (++count > MAX_PAGE_CONTEXTS)
-      return `At most ${MAX_PAGE_CONTEXTS} page snapshots can be attached`
     if (!context.snapshot) return 'A page snapshot is required'
     if (ids.has(context.snapshot.id)) return 'Page snapshot IDs must be unique within a message'
     ids.add(context.snapshot.id)
+    textLength += context.snapshot.text.length
+    bytes += utf8ByteLength(JSON.stringify(context.snapshot))
+    if (textLength > MAX_PAGE_CONTEXT_TEXT_LENGTH || bytes > MAX_PAGE_CONTEXT_BYTES)
+      return 'These pages contain too much text'
   }
 }
diff --git a/apps/sim/lib/mothership/chat/process-contents.test.ts b/apps/sim/lib/mothership/chat/process-contents.test.ts
index 70ebf8fa21e..3391fa2f62a 100644
--- a/apps/sim/lib/mothership/chat/process-contents.test.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.test.ts
@@ -714,17 +714,42 @@ describe('processContextsServer - browser and terminal selections', () => {
     }
   )
 
-  it('refuses more than three page snapshots before resolving context', async () => {
+  it('delivers ten short page snapshots without dropping their sources', async () => {
+    const snapshots = Array.from({ length: 10 }, (_, index) => ({
+      ...snapshot,
+      id: `11111111-1111-4111-8111-11111111111${index}`,
+      url: `https://example.com/page-${index}`,
+      text: `Source ${index}`,
+    }))
+    const result = await processContextsServer(
+      snapshots.map((page, index) => ({
+        kind: 'browser_page' as const,
+        label: `Page (${index + 1})`,
+        snapshot: page,
+      })),
+      'user-1'
+    )
+    expect(result).toHaveLength(10)
+    for (const [index, context] of result.entries()) {
+      const payload = context.content.split('\n').find((line) => line.startsWith('{'))
+      expect(payload && JSON.parse(payload)).toEqual(snapshots[index])
+    }
+  })
+
+  it.each([
+    { name: 'combined text', text: 'x'.repeat(37_501) },
+    { name: 'combined serialized bytes', text: '\u0000'.repeat(18_751) },
+  ])('refuses an oversized page batch before resolving context: $name', async ({ text }) => {
     await expect(
       processContextsServer(
         Array.from({ length: 4 }, (_, index) => ({
           kind: 'browser_page' as const,
           label: `Page ${index}`,
-          snapshot: { ...snapshot, id: `11111111-1111-4111-8111-11111111111${index}` },
+          snapshot: { ...snapshot, text, id: `11111111-1111-4111-8111-11111111111${index}` },
         })),
         'user-1'
       )
-    ).rejects.toThrow('At most 3 page snapshots')
+    ).rejects.toThrow('These pages contain too much text')
   })
 
   it('points every browser and terminal mention at its exact tab', async () => {
diff --git a/apps/sim/lib/mothership/chat/process-contents.ts b/apps/sim/lib/mothership/chat/process-contents.ts
index a30934c35f7..c1898213abf 100644
--- a/apps/sim/lib/mothership/chat/process-contents.ts
+++ b/apps/sim/lib/mothership/chat/process-contents.ts
@@ -163,11 +163,11 @@ export async function processContextsServer(
   if (contexts.length > MAX_CHAT_CONTEXTS) {
     throw new Error(`Context count exceeds the maximum of ${MAX_CHAT_CONTEXTS}`)
   }
-  const pageBudgetError = getPageContextBudgetError(contexts)
-  if (pageBudgetError) throw new Error(pageBudgetError)
   for (const context of contexts) {
     if (context.kind === 'browser_page') pageSnapshotSchema.parse(context.snapshot)
   }
+  const pageBudgetError = getPageContextBudgetError(contexts)
+  if (pageBudgetError) throw new Error(pageBudgetError)
   if ((userMessage?.length ?? 0) > MAX_CHAT_MESSAGE_LENGTH) {
     throw new Error(`Message exceeds the maximum of ${MAX_CHAT_MESSAGE_LENGTH} characters`)
   }
diff --git a/apps/sim/lib/mothership/tools/server/knowledge/workspace-search.test.ts b/apps/sim/lib/mothership/tools/server/knowledge/workspace-search.test.ts
index 8ae1042bd73..ae675215799 100644
--- a/apps/sim/lib/mothership/tools/server/knowledge/workspace-search.test.ts
+++ b/apps/sim/lib/mothership/tools/server/knowledge/workspace-search.test.ts
@@ -246,6 +246,19 @@ describe('Assistant retrieval tools', () => {
     )
     expect(JSON.stringify(result)).not.toContain(secret)
   })
+  it('tells the model a search no account served searched nothing, not to narrow and retry', async () => {
+    mocks.search.mockResolvedValueOnce({
+      query: 'roadmap',
+      retrieval: { status: 'partial', timedOutLegs: [] },
+      results: [],
+      live: { backend: 'live', accounts: [], guidance: 'Nothing was searched: connect one.' },
+    })
+    const result = await searchWorkspaceServerTool.execute({ query: 'roadmap' }, context)
+    expect(result).toMatchObject({
+      success: true,
+      message: expect.stringMatching(/^Nothing was searched: (?!.*more specific query)/),
+    })
+  })
   it('rejects untrusted contexts, incompatible sources and out-of-scope document reads', async () => {
     expect(
       await searchWorkspaceServerTool.execute(
diff --git a/apps/sim/lib/mothership/tools/server/knowledge/workspace-search.ts b/apps/sim/lib/mothership/tools/server/knowledge/workspace-search.ts
index 3b04bcb713c..4da4825ad9d 100644
--- a/apps/sim/lib/mothership/tools/server/knowledge/workspace-search.ts
+++ b/apps/sim/lib/mothership/tools/server/knowledge/workspace-search.ts
@@ -85,9 +85,13 @@ export const searchWorkspaceServerTool: BaseServerTool = {
                   ...liveInput,
                   workspaceId: scope.workspaceId,
                 })
+          /** Every searched account reports a status, so none means no account could serve it. */
+          const nothingSearched = data.live?.accounts.length === 0
           return {
             success: true,
-            message: `${data.retrieval.status === 'partial' ? 'Search coverage is incomplete. Continue with a more specific query or source filter; these results cannot establish absence or completeness. ' : ''}Found ${data.results.length} live results. Read a documentId when its passage does not answer the question or more context is needed. ${CITATION_INSTRUCTION}`,
+            message: nothingSearched
+              ? 'Nothing was searched: no connected account can serve this search, so it says nothing about what exists. Follow the first line of live.guidance instead of retrying the same search.'
+              : `${data.retrieval.status === 'partial' ? 'Search coverage is incomplete. Continue with a more specific query or source filter; these results cannot establish absence or completeness. ' : ''}Found ${data.results.length} live results. Read a documentId when its passage does not answer the question or more context is needed. ${CITATION_INSTRUCTION}`,
             data: {
               ...data,
               results: data.results.map((item) => ({
diff --git a/apps/sim/lib/mothership/tools/server/settings-sim-links.ts b/apps/sim/lib/mothership/tools/server/settings-sim-links.ts
index 002289fec13..bfb1ff02b08 100644
--- a/apps/sim/lib/mothership/tools/server/settings-sim-links.ts
+++ b/apps/sim/lib/mothership/tools/server/settings-sim-links.ts
@@ -42,7 +42,7 @@ export const simLinkSettingsActions = {
           .trim()
           .min(1)
           .max(255)
-          .describe('The name as typed, with or without the sim/ prefix'),
+          .describe('The name as typed, with or without a sim/ or go/ prefix'),
       }),
     ]),
     async (context, input) =>
@@ -51,9 +51,7 @@ export const simLinkSettingsActions = {
           principal: context.principal,
           input: {
             organizationId: settingsOrganizationId(context),
-            ...('linkId' in input
-              ? { linkId: input.linkId }
-              : { name: input.name.replace(/^sim\//i, '') }),
+            ...('linkId' in input ? { linkId: input.linkId } : { name: input.name }),
           },
         })
       )
diff --git a/apps/sim/lib/navigation/paths.ts b/apps/sim/lib/navigation/paths.ts
index 3c861a01742..18f18ae0afd 100644
--- a/apps/sim/lib/navigation/paths.ts
+++ b/apps/sim/lib/navigation/paths.ts
@@ -45,8 +45,6 @@ export function organizationRoutes(organizationId: string) {
     benchmark: `${root}/benchmark`,
     memberSecrets: `${root}/integrations/secrets`,
     simLinks: `${root}/links`,
-    openSimLink: (name: string) =>
-      `/sim-links/${encodeURIComponent(organizationId)}/${encodeURIComponent(name)}`,
     people: `${root}/people`,
     person: (memberId: string) => `${root}/people/${encodeURIComponent(memberId)}`,
     organizationSecrets: `${root}/settings/integrations/secrets`,
diff --git a/apps/sim/lib/settings/sections.ts b/apps/sim/lib/settings/sections.ts
index a60585ff2bc..1e524c8a04c 100644
--- a/apps/sim/lib/settings/sections.ts
+++ b/apps/sim/lib/settings/sections.ts
@@ -56,9 +56,9 @@ export const settingsSections: Record<MothershipSettingsScope, readonly Settings
     { id: 'requests', label: 'Access requests', uiSection: 'requests' },
     {
       id: 'sim-links',
-      label: 'Sim links',
+      label: 'Links',
       userSetup:
-        'Members browse and follow links on the organization Links page. Available only where Sim links are enabled for the organization.',
+        'Members browse and follow links on the organization Links page. Available only where Links are enabled for the organization.',
     },
     {
       id: 'sso',
diff --git a/apps/sim/lib/sim-links/application/operations.ts b/apps/sim/lib/sim-links/application/operations.ts
index abf7eb0a56c..81057857d2a 100644
--- a/apps/sim/lib/sim-links/application/operations.ts
+++ b/apps/sim/lib/sim-links/application/operations.ts
@@ -50,13 +50,6 @@ export const simLinkOperations = {
     ...policy,
     capability: 'none',
   }),
-  // permission-group-exempt: Managed bookmarks are a Chrome admin export of organization-wide shortcuts.
-  exportBookmarks: defineOrganizationOperation({
-    id: 'organization.sim_links.export_bookmarks',
-    minimumRole: 'admin',
-    principalKinds: ['session'],
-    capability: 'none',
-  }),
   /** Not organization-scoped: it serves whichever organization `sim/` opens in for the session. */
   // permission-group-exempt: Sim links are organization-wide shortcuts, not a governed capability.
   suggest: defineOperation({
diff --git a/apps/sim/lib/sim-links/application/use-cases.ts b/apps/sim/lib/sim-links/application/use-cases.ts
index 19e24671ca9..7196407efb2 100644
--- a/apps/sim/lib/sim-links/application/use-cases.ts
+++ b/apps/sim/lib/sim-links/application/use-cases.ts
@@ -4,7 +4,6 @@ import { db } from '@sim/db'
 import { createLogger } from '@sim/logger'
 import { isOrgAdminRole } from '@sim/platform-authz/workspace'
 import { getPostgresErrorCode, toError } from '@sim/utils/errors'
-import type { BookmarkLink } from '@/lib/api/contracts/sim-links'
 import {
   defineAuthorizedOrganizationUseCase,
   type OrganizationUseCaseContext,
@@ -24,9 +23,9 @@ import { requireSimLinksEnabled } from '@/lib/sim-links/feature-flag'
 import type { SimLinkAccess, SimLinkRecord, SimLinkViewer } from '@/lib/sim-links/repository'
 import * as repository from '@/lib/sim-links/repository'
 import {
-  MAX_MANAGED_BOOKMARKS,
   type SimLinkFields,
   type SimLinkSort,
+  stripSimLinkPrefix,
   typedSimLinkPrefix,
 } from '@/lib/sim-links/validation'
 import type { SortDirection } from '@/lib/url-state'
@@ -81,11 +80,11 @@ async function lockEditableSimLink(
   viewer: SimLinkViewer
 ): Promise<SimLinkAccess> {
   const access = await repository.lockSimLinkAccess(tx, organizationId, linkId)
-  if (!access) throw new OrchestrationError('not_found', 'Sim link not found')
+  if (!access) throw new OrchestrationError('not_found', 'Link not found')
   if (!canEdit(access.restrictEdit, access.createdBy, viewer)) {
     throw new OrchestrationError(
       'forbidden',
-      'Only the creator or an organization admin can edit this Sim link'
+      'Only the creator or an organization admin can edit this link'
     )
   }
   return access
@@ -102,7 +101,10 @@ async function withUniqueName<T>(
   } catch (error) {
     if (getPostgresErrorCode(error) !== '23505') throw error
     const existing = await repository.findSimLinkDestination(organizationId, name)
-    throw new OrchestrationError('conflict', `sim/${existing?.name ?? name} already exists`)
+    throw new OrchestrationError(
+      'conflict',
+      `A link named ${existing?.name ?? name} already exists`
+    )
   }
 }
 
@@ -141,31 +143,10 @@ async function readView(
   viewer: SimLinkViewer
 ) {
   const record = await repository.getSimLink(tx, organizationId, linkId)
-  if (!record) throw new OrchestrationError('not_found', 'Sim link not found')
+  if (!record) throw new OrchestrationError('not_found', 'Link not found')
   return toView(record, viewer)
 }
 
-export const exportSimBookmarks = defineAuthorizedOrganizationUseCase({
-  operation: simLinkOperations.exportBookmarks,
-  ...rollout,
-  async execute({
-    input,
-    context,
-  }: OrganizationUseCaseContext<OrganizationInput & { links: BookmarkLink[] }>) {
-    if (!input.links.length || input.links.length > MAX_MANAGED_BOOKMARKS)
-      throw new OrchestrationError(
-        'validation',
-        `Choose between 1 and ${MAX_MANAGED_BOOKMARKS} bookmarks.`
-      )
-    const selected = new Map(input.links.map((link) => [link.id, link]))
-    const listed = await repository.listBookmarkCandidates(context.organizationId, [
-      ...selected.keys(),
-    ])
-    const current = new Map(listed.map((link) => [link.id, link.name]))
-    return [...selected.values()].filter((link) => current.get(link.id) === link.name)
-  },
-})
-
 export const listSimLinks = defineAuthorizedOrganizationUseCase({
   operation: simLinkOperations.list,
   ...rollout,
@@ -205,10 +186,15 @@ export const getSimLinkView = defineAuthorizedOrganizationUseCase({
     const linkId =
       'linkId' in input
         ? input.linkId
-        : (await repository.findSimLinkDestination(input.organizationId, input.name))?.id
+        : (
+            await repository.findSimLinkDestination(
+              input.organizationId,
+              stripSimLinkPrefix(input.name)
+            )
+          )?.id
     const record = linkId ? await repository.getSimLink(db, input.organizationId, linkId) : null
     if (!record || (record.unlisted && !canManage(record.createdBy?.id ?? null, viewer)))
-      throw new OrchestrationError('not_found', 'Sim link not found')
+      throw new OrchestrationError('not_found', 'Link not found')
     return toView(record, viewer)
   },
 })
@@ -256,7 +242,7 @@ export const updateSimLink = defineAuthorizedOrganizationUseCase({
         ) {
           throw new OrchestrationError(
             'forbidden',
-            'Only the creator or an organization admin can change who finds or edits this Sim link'
+            'Only the creator or an organization admin can change who finds or edits this link'
           )
         }
         await repository.updateSimLink(tx, organizationId, linkId, fields)
@@ -323,8 +309,11 @@ export const suggestSimLinks = defineAuthorizedCredentialUserUseCase({
   operation: simLinkOperations.suggest,
   async execute({ principal, input }: { principal: SessionPrincipal; input: { query: string } }) {
     const organizationId = await resolveSimLinkOrganization(principal)
+    if (!organizationId) return { enabled: false, links: [] }
     const prefix = typedSimLinkPrefix(input.query)
-    if (!organizationId || prefix === null) return []
-    return repository.suggestSimLinks(organizationId, prefix)
+    return {
+      enabled: true,
+      links: prefix === null ? [] : await repository.suggestSimLinks(organizationId, prefix),
+    }
   },
 })
diff --git a/apps/sim/lib/sim-links/feature-flag.ts b/apps/sim/lib/sim-links/feature-flag.ts
index 272fa5708a1..9e464efd796 100644
--- a/apps/sim/lib/sim-links/feature-flag.ts
+++ b/apps/sim/lib/sim-links/feature-flag.ts
@@ -7,6 +7,6 @@ export function isSimLinksEnabled(organizationId: string): Promise<boolean> {
 
 export async function requireSimLinksEnabled(organizationId: string): Promise<void> {
   if (!(await isSimLinksEnabled(organizationId))) {
-    throw new OrchestrationError('forbidden', 'Sim links are not enabled for this organization')
+    throw new OrchestrationError('forbidden', 'Links are not enabled for this organization')
   }
 }
diff --git a/apps/sim/lib/sim-links/repository.ts b/apps/sim/lib/sim-links/repository.ts
index 80319ad7f30..90424a70647 100644
--- a/apps/sim/lib/sim-links/repository.ts
+++ b/apps/sim/lib/sim-links/repository.ts
@@ -2,28 +2,16 @@ import { db } from '@sim/db'
 import { simLink, user } from '@sim/db/schema'
 import { generateId } from '@sim/utils/id'
 import { escapeLikePattern } from '@sim/utils/string'
-import { and, asc, desc, eq, gt, ilike, inArray, like, lt, or, type SQL, sql } from 'drizzle-orm'
+import { and, asc, desc, eq, gt, ilike, like, lt, or, type SQL, sql } from 'drizzle-orm'
 import type { DbOrTx, DbTransaction } from '@/lib/db/types'
 import {
   normalizeSimLinkName,
   type SimLinkFields,
   type SimLinkSort,
+  stripSimLinkPrefix,
 } from '@/lib/sim-links/validation'
 import type { SortDirection } from '@/lib/url-state'
 
-export function listBookmarkCandidates(organizationId: string, ids: string[]) {
-  return db
-    .select({ id: simLink.id, name: simLink.name })
-    .from(simLink)
-    .where(
-      and(
-        eq(simLink.organizationId, organizationId),
-        eq(simLink.unlisted, false),
-        inArray(simLink.id, ids)
-      )
-    )
-}
-
 const PAGE_SIZE = 50
 
 export interface SimLinkRecord {
@@ -107,10 +95,11 @@ export async function listSimLinks(
     conditions.push(or(eq(simLink.unlisted, false), eq(simLink.createdBy, viewer.userId)))
   }
   if (url) conditions.push(eq(simLink.url, url))
-  const query = search?.trim().replace(/^sim\//i, '')
+  const query = search && stripSimLinkPrefix(search.trim())
   if (query) {
     const pattern = `%${escapeLikePattern(query)}%`
-    const normalized = normalizeSimLinkName(query)
+    // Names hold no spaces, so a typed phrase like `team handbook` still finds `team-handbook`.
+    const normalized = normalizeSimLinkName(query).replace(/\s+/g, '')
     conditions.push(
       or(
         ilike(simLink.url, pattern),
@@ -152,13 +141,15 @@ export async function getSimLink(
 const SUGGESTION_LIMIT = 6
 
 /**
- * Listed links whose name starts with `namePrefix` (normalized), most visited first; the most
- * visited overall when it is empty. Unlisted links never appear: suggesting is browsing.
+ * Listed links whose name contains `typedName` (normalized), names starting with it first and then
+ * most visited; the most visited overall when it is empty. Unlisted links never appear: suggesting
+ * is browsing.
  */
 export async function suggestSimLinks(
   organizationId: string,
-  namePrefix: string
+  typedName: string
 ): Promise<{ name: string; description: string | null; url: string }[]> {
+  const pattern = escapeLikePattern(typedName)
   return db
     .select({ name: simLink.name, description: simLink.description, url: simLink.url })
     .from(simLink)
@@ -166,10 +157,14 @@ export async function suggestSimLinks(
       and(
         eq(simLink.organizationId, organizationId),
         eq(simLink.unlisted, false),
-        namePrefix ? like(simLink.normalizedName, `${escapeLikePattern(namePrefix)}%`) : undefined
+        typedName ? like(simLink.normalizedName, `%${pattern}%`) : undefined
       )
     )
-    .orderBy(desc(simLink.visitCount), asc(simLink.normalizedName))
+    .orderBy(
+      desc(sql`${simLink.normalizedName} like ${`${pattern}%`}`),
+      desc(simLink.visitCount),
+      asc(simLink.normalizedName)
+    )
     .limit(SUGGESTION_LIMIT)
 }
 
diff --git a/apps/sim/lib/sim-links/validation.ts b/apps/sim/lib/sim-links/validation.ts
index c91b8ae5919..34bef39bfc6 100644
--- a/apps/sim/lib/sim-links/validation.ts
+++ b/apps/sim/lib/sim-links/validation.ts
@@ -1,11 +1,15 @@
-import { SIM_LINK_NAME_MAX_LENGTH, SIM_LINK_URL_MAX_LENGTH } from '@sim/browser-extension-protocol'
+import {
+  SIM_LINK_HOST_PATTERN,
+  SIM_LINK_NAME_MAX_LENGTH,
+  SIM_LINK_URL_MAX_LENGTH,
+} from '@sim/browser-extension-protocol'
 import { z } from 'zod'
 
 const NAME_PATTERN = /^[A-Za-z0-9.:@&~_-]+$/
 const NAME_PUNCTUATION = /[.:@&~_-]/g
 const NAME_DISALLOWED = /[^A-Za-z0-9.:@&~_-]/g
-export const MAX_MANAGED_BOOKMARKS = 100
 export const SIM_LINK_DESCRIPTION_MAX_LENGTH = 500
+export const SIM_LINK_SEARCH_MAX_LENGTH = 200
 
 /** List orders: alphabetical by name, or most visited first. */
 export const SIM_LINK_SORTS = ['name', 'popular'] as const
@@ -19,13 +23,15 @@ export function normalizeSimLinkName(name: string): string {
   return name.toLowerCase().replace(NAME_PUNCTUATION, '')
 }
 
-/** Text as typed after `sim/`, whether or not the prefix itself was typed too. */
-function stripSimLinkPrefix(input: string): string {
-  return input.replace(/^sim\//i, '')
+const TYPED_HOST_PREFIX = new RegExp(`^(?:${SIM_LINK_HOST_PATTERN})/`, 'i')
+
+/** Drops a leading `sim/` or `go/` from typed text. */
+export function stripSimLinkPrefix(input: string): string {
+  return input.replace(TYPED_HOST_PREFIX, '')
 }
 
 /**
- * Shapes typed or pasted text into a name as it is entered: a leading `sim/` is dropped, spaces
+ * Shapes typed or pasted text into a name as it is entered: a leading `sim/` or `go/` is dropped, spaces
  * and slashes become hyphens, and any other character a name can't hold is removed.
  */
 export function toSimLinkName(input: string): string {
@@ -74,7 +80,11 @@ export function parseTypedSimLink(segments: readonly string[]): {
  * when a name was typed that no link can match, such as only punctuation.
  */
 export function typedSimLinkPrefix(query: string): string | null {
-  const [path = ''] = stripSimLinkPrefix(query.trim()).split('?')
+  // Only the keyword's own `sim/`: after it, `go/x` can be a link named `go` with a value.
+  const [path = ''] = query
+    .trim()
+    .replace(/^sim\//i, '')
+    .split('?')
   const { name } = parseTypedSimLink(path.split('/'))
   const prefix = normalizeSimLinkName(name)
   return name && !prefix ? null : prefix
diff --git a/apps/sim/lib/sim-search/live/application.test.ts b/apps/sim/lib/sim-search/live/application.test.ts
index b69d53ff555..5bed7b39f05 100644
--- a/apps/sim/lib/sim-search/live/application.test.ts
+++ b/apps/sim/lib/sim-search/live/application.test.ts
@@ -666,6 +666,28 @@ describe('authorized live retrieval', () => {
     expect(result.live?.accounts.map((status) => status.queryIndex)).toEqual([0, 1])
     expect(result.live?.guidance).toBe('Live coverage: slack')
   })
+  it('reports a search that reached no account as nothing searched, not as no results', async () => {
+    mocks.accounts.mockResolvedValue([])
+    const result = await searchLiveKnowledge.execute({ principal, input })
+    expect(mocks.search).not.toHaveBeenCalled()
+    expect(result.results).toEqual([])
+    expect(result.retrieval.status).toBe('partial')
+    expect(result.live?.accounts).toEqual([])
+    expect(result.live?.guidance).toMatch(
+      /^Nothing was searched: you have no connected sources here\. Connect your accounts at \S*\/workspace\/workspace\/integrations,/
+    )
+  })
+  it('names the filtered source when only other sources are connected', async () => {
+    const result = await searchLiveKnowledge.execute({
+      principal,
+      input: { ...input, filters: { source: 'slack' } },
+    })
+    expect(mocks.search).not.toHaveBeenCalled()
+    expect(result.retrieval.status).toBe('partial')
+    expect(result.live?.guidance).toMatch(
+      /^Nothing was searched: you have no connected slack account here\. .* or search without the source filter\./
+    )
+  })
   describe('result previews', () => {
     const excerpts = ['a', 'b', 'c', 'd'].map((id) => ({
       ...document,
diff --git a/apps/sim/lib/sim-search/live/application.ts b/apps/sim/lib/sim-search/live/application.ts
index 78e9817b53f..309c92ddb54 100644
--- a/apps/sim/lib/sim-search/live/application.ts
+++ b/apps/sim/lib/sim-search/live/application.ts
@@ -32,6 +32,7 @@ import {
   mapWithConcurrency,
   waitWithAbort,
 } from '@/lib/core/utils/concurrency'
+import { getBaseUrl } from '@/lib/core/utils/urls'
 import { MANAGED_MCP_CONNECTORS } from '@/lib/credential-groups/managed-mcp-connectors'
 import { requireOrganizationSearchAvailable } from '@/lib/knowledge/access/availability'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
@@ -49,6 +50,7 @@ import {
 import { RRF_K } from '@/lib/knowledge/search/recency'
 import { matchPassage } from '@/lib/knowledge/search/snippet'
 import { isKnowledgeSourceUrl } from '@/lib/knowledge/search/source-url'
+import { organizationRoutes } from '@/lib/navigation/paths'
 import { connectorDisplayName } from '@/lib/sim-search/connectors'
 import {
   type LiveAccountSession,
@@ -440,6 +442,24 @@ function compareAccounts(left: LiveAccount, right: LiveAccount): number {
   )
 }
 
+/**
+ * Why a plain search that reached no account returned nothing, and where the caller connects one;
+ * an empty result would otherwise read as a search that found nothing.
+ */
+function nothingSearchedGuidance(
+  owner: ResourceOwner,
+  source: string | undefined,
+  hasOtherAccounts: boolean
+): string {
+  const path = owner.organizationId
+    ? organizationRoutes(owner.organizationId).integrations
+    : `/workspace/${owner.workspaceId}/integrations`
+  const connect = new URL(path, getBaseUrl()).href
+  return source && hasOtherAccounts
+    ? `Nothing was searched: you have no connected ${source} account here. Connect one at ${connect}, or search without the source filter.`
+    : `Nothing was searched: you have no connected sources here. Connect your accounts at ${connect}, then search again.`
+}
+
 const liveKnowledgeSearch = defineAuthorizedKnowledgeUseCase({
   operation: knowledgeOperations.search,
   resolveContext: ({ input }: { input: LiveSearchInput }) => resolveKnowledgeOwnerContext(input),
@@ -503,6 +523,7 @@ const liveKnowledgeSearch = defineAuthorizedKnowledgeUseCase({
           nativesFor(account).length > 0
       )
       .sort(compareAccounts)
+    const nothingSearched = !queries && eligible.length === 0
     const selected = eligible.slice(0, MAX_ACCOUNTS)
     const openingAccount = createConcurrencyLimit(ACCOUNT_OPEN_CONCURRENCY)
     annotateSearchDiagnostics({
@@ -909,9 +930,14 @@ const liveKnowledgeSearch = defineAuthorizedKnowledgeUseCase({
       }
     })
     /** Live coverage guides the providers this call searched or tried to search. */
-    const guidance = liveSearchGuidance(
-      accounts.filter((account) => account.status !== 'reconnect').map(({ provider }) => provider)
-    )
+    const guidance = [
+      ...(nothingSearched
+        ? [nothingSearchedGuidance(input, filters?.source, allAccounts.length > 0)]
+        : []),
+      liveSearchGuidance(
+        accounts.filter((account) => account.status !== 'reconnect').map(({ provider }) => provider)
+      ),
+    ].join('\n')
     for (const account of eligible.slice(MAX_ACCOUNTS)) {
       for (const { queryIndex } of nativesFor(account))
         accounts.push({
@@ -934,9 +960,10 @@ const liveKnowledgeSearch = defineAuthorizedKnowledgeUseCase({
           message: 'No connection with this provider is configured and approved in this scope.',
         })
     }
-    const retrievalStatus = accounts.some((account) => account.status !== 'ok')
-      ? 'partial'
-      : 'complete'
+    const retrievalStatus =
+      nothingSearched || accounts.some((account) => account.status !== 'ok')
+        ? 'partial'
+        : 'complete'
     annotateSearchDiagnostics({
       resultCount: Math.min(ranked.length, input.topK),
       retrievalStatus,
diff --git a/apps/sim/lib/sim-search/live/atlassian.test.ts b/apps/sim/lib/sim-search/live/atlassian.test.ts
index 7a6fe15f8a3..df145b026e7 100644
--- a/apps/sim/lib/sim-search/live/atlassian.test.ts
+++ b/apps/sim/lib/sim-search/live/atlassian.test.ts
@@ -244,6 +244,13 @@ describe('Jira any-term search', () => {
     const page = await searchAtlassian(api, 'confluence', { ...query, textMatch: 'any' })
     expect(page.documents.map((document) => document.id)).toEqual(['5'])
   })
+
+  it('searches nothing for a Confluence query with no word left, which would list every page', async () => {
+    const api = client({})
+    const page = await searchAtlassian(api, 'confluence', { ...query, query: String.raw` :\ ` })
+    expect(page.documents).toEqual([])
+    expect(api.json).not.toHaveBeenCalled()
+  })
 })
 
 describe('Confluence plain search ranking', () => {
diff --git a/apps/sim/lib/sim-search/live/atlassian.ts b/apps/sim/lib/sim-search/live/atlassian.ts
index 4283b3eddf2..aae29c76799 100644
--- a/apps/sim/lib/sim-search/live/atlassian.ts
+++ b/apps/sim/lib/sim-search/live/atlassian.ts
@@ -132,6 +132,12 @@ export async function searchAtlassian(
   provider: 'jira' | 'confluence',
   input: NativeSearchInput
 ): Promise<NativePage> {
+  const text = nativeText(input)
+  const confluenceClause =
+    provider === 'confluence' && text && !input.native?.query
+      ? confluenceTextClause(text, input.textMatch)
+      : ''
+  if (confluenceClause === undefined) return { documents: [] }
   const allSites = (await sites(client)).filter(
     (site) =>
       !input.policy?.sites.length ||
@@ -166,7 +172,6 @@ export async function searchAtlassian(
       .join(' AND ') || undefined
   const direction = dateSortDirection(input.filters)
   const order = direction ? `${field} ${direction.toUpperCase()}` : undefined
-  const text = nativeText(input)
   // Jira's any-term JQL matches issues sharing two common words; like minimum-should-match,
   // keep only issues holding at least half the terms.
   const relevant = input.textMatch === 'any' && text ? holdsHalfTheTerms(text) : undefined
@@ -234,13 +239,15 @@ export async function searchAtlassian(
         }
       }
       const exact = await searchPages(
-        text ? confluenceTextClause(text, input.textMatch) : '',
+        confluenceClause,
         input.native?.cursor && single ? input.native.cursor : undefined
       )
+      const relevance = confluenceTextClause(text, 'any')
       // An all-terms match larger than a page comes back by raw term matches; rank it by relevance.
-      if (!text || input.native || order || input.textMatch === 'any' || !exact.next) return exact
+      if (!relevance || input.native || order || input.textMatch === 'any' || !exact.next)
+        return exact
       try {
-        const ranked = await searchPages(confluenceTextClause(text, 'any'))
+        const ranked = await searchPages(relevance)
         return { ...ranked, next: undefined, ranking: 'relevance' }
       } catch {
         // A cancelled search stops here; any other failure keeps the all-terms page.
diff --git a/apps/sim/lib/sim-search/live/service-session.ts b/apps/sim/lib/sim-search/live/service-session.ts
index df68caa9a5a..b30ce33124b 100644
--- a/apps/sim/lib/sim-search/live/service-session.ts
+++ b/apps/sim/lib/sim-search/live/service-session.ts
@@ -146,6 +146,7 @@ export async function createLiveServiceSession(input: {
         const query =
           search.native?.query ??
           (search.query ? confluenceTextClause(search.query, search.textMatch) : '')
+        if (query === undefined) return null
         return {
           ...search,
           native: { provider, ...search.native, query: scopeAtlassianQuery(query, scope) },
diff --git a/apps/sim/lib/sim-search/live/text-match.test.ts b/apps/sim/lib/sim-search/live/text-match.test.ts
index bd05d59e34c..82ac1b41003 100644
--- a/apps/sim/lib/sim-search/live/text-match.test.ts
+++ b/apps/sim/lib/sim-search/live/text-match.test.ts
@@ -59,6 +59,16 @@ describe('text match clauses', () => {
     )
   })
 
+  it('sends a colon or backslash to Confluence as a word break, which it otherwise rejects', () => {
+    expect(confluenceTextClause('Security: Weekly Report', 'all')).toBe(
+      'text ~ "Security  Weekly Report"'
+    )
+    expect(confluenceTextClause(String.raw`C:\builds\out`, 'any')).toBe(
+      'siteSearch ~ "C  builds out"'
+    )
+    expect(confluenceTextClause(String.raw` :\ `, 'all')).toBeUndefined()
+  })
+
   it('falls back to the all-terms clause when fewer than two terms are distinctive', () => {
     expect(jiraTextClause('how does it work', 'any')).toBe('text ~ "how does it work"')
   })
diff --git a/apps/sim/lib/sim-search/live/text-match.ts b/apps/sim/lib/sim-search/live/text-match.ts
index c5dd8958455..c8a40699012 100644
--- a/apps/sim/lib/sim-search/live/text-match.ts
+++ b/apps/sim/lib/sim-search/live/text-match.ts
@@ -150,9 +150,16 @@ export function jiraTextClause(text: string, match: TextMatch = 'all'): string {
  * The text clause for a plain query in Confluence CQL. `any` uses `siteSearch`, Confluence's own
  * relevance search, which ranks a page with the query's rarer words above the many pages sharing
  * one common word, where a `text ~` OR query ranks them the other way round.
+ *
+ * Confluence answers HTTP 400 to the escaped colon or backslash this phrase would carry, and its
+ * analyzer splits words on both, so they go as spaces. `undefined` means nothing is left to match:
+ * Confluence would list every page for such a phrase, so callers search nothing instead.
  */
-export function confluenceTextClause(text: string, match: TextMatch = 'all'): string {
-  return `${match === 'any' ? 'siteSearch' : 'text'} ~ ${escapeSearchPhrase(text)}`
+export function confluenceTextClause(text: string, match: TextMatch = 'all'): string | undefined {
+  const searchable = text.replace(/[:\\]/g, ' ').trim()
+  return searchable
+    ? `${match === 'any' ? 'siteSearch' : 'text'} ~ ${escapeSearchPhrase(searchable)}`
+    : undefined
 }
 
 /** How many distinct terms occur as whole words in the text. */
diff --git a/apps/sim/lib/webhooks/deploy.ts b/apps/sim/lib/webhooks/deploy.ts
index fc706d3d197..0cfb44e3290 100644
--- a/apps/sim/lib/webhooks/deploy.ts
+++ b/apps/sim/lib/webhooks/deploy.ts
@@ -1105,7 +1105,13 @@ export async function saveTriggerWebhooksForDeploy({
         externalSubscriptionCreated: result.externalSubscriptionCreated,
       })
     } catch (error: unknown) {
-      logger.error(`[${requestId}] Failed to create external subscription for ${block.id}`, error)
+      if (error instanceof WebhookDeploymentConfigurationError) {
+        logger.warn(`[${requestId}] Rejected webhook trigger configuration for ${block.id}`, {
+          error: error.message,
+        })
+      } else {
+        logger.error(`[${requestId}] Failed to create external subscription for ${block.id}`, error)
+      }
       await pendingVerificationTracker.clearAll()
       let cleanupFailure: unknown
       for (const sub of createdSubscriptions) {
diff --git a/apps/sim/lib/workflows/executor/resume-execution.ts b/apps/sim/lib/workflows/executor/resume-execution.ts
index 9de3b68235f..ebaea1ad89c 100644
--- a/apps/sim/lib/workflows/executor/resume-execution.ts
+++ b/apps/sim/lib/workflows/executor/resume-execution.ts
@@ -439,7 +439,8 @@ export async function executeResumeWorkflow({
     if (error instanceof ResumeWorkflowExecutionError) throw error
     const statusCode =
       isRecordLike(error) && typeof error.statusCode === 'number' ? error.statusCode : undefined
-    if (statusCode !== undefined && statusCode < 500) markFailureKind(error, 'user')
+    const retryable = isRecordLike(error) && error.retryable === true
+    if (statusCode !== undefined && statusCode < 500 && !retryable) markFailureKind(error, 'user')
     logFailureOnce(logger, 'Resume request failed', error, {
       executionId,
       metadata: () =>
diff --git a/apps/sim/public/library/airtable-ai-agent-data-entry-reporting/cover.jpg b/apps/sim/public/library/airtable-ai-agent-data-entry-reporting/cover.jpg
new file mode 100644
index 00000000000..9829b20f725
Binary files /dev/null and b/apps/sim/public/library/airtable-ai-agent-data-entry-reporting/cover.jpg differ
diff --git a/apps/sim/public/library/notion-ai-agent-pages-databases-guide/cover.jpg b/apps/sim/public/library/notion-ai-agent-pages-databases-guide/cover.jpg
new file mode 100644
index 00000000000..cdc0a0a7137
Binary files /dev/null and b/apps/sim/public/library/notion-ai-agent-pages-databases-guide/cover.jpg differ
diff --git a/apps/sim/public/library/quickbooks-ai-agent-month-end-close-guide/cover.jpg b/apps/sim/public/library/quickbooks-ai-agent-month-end-close-guide/cover.jpg
new file mode 100644
index 00000000000..682b3809f09
Binary files /dev/null and b/apps/sim/public/library/quickbooks-ai-agent-month-end-close-guide/cover.jpg differ
diff --git a/apps/sim/scripts/test-browser-extension-e2e.ts b/apps/sim/scripts/test-browser-extension-e2e.ts
index 3446e1984de..e0a622741b0 100644
--- a/apps/sim/scripts/test-browser-extension-e2e.ts
+++ b/apps/sim/scripts/test-browser-extension-e2e.ts
@@ -16,10 +16,12 @@ import {
   type Page,
   type Request,
   type Route,
+  type WebSocketRoute,
 } from '@playwright/test'
 import { pageSnapshotSchema } from '@sim/browser-extension-protocol'
 import { assertDisposableTestDatabaseUrl } from '@sim/db/testing/test-infrastructure'
 import { createLogger } from '@sim/logger'
+import { createDeferred } from '@sim/testing/helpers/deferred'
 import { toNumberOrNull, toStringOrNull } from '@sim/utils/coerce'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
@@ -75,6 +77,8 @@ const checks: {
 }[] = []
 const screenshots: string[] = []
 const browserErrors: string[] = []
+const voiceDiagnostics: Record<string, unknown>[] = []
+const signInRecoveryReceipts: Record<string, unknown>[] = []
 const httpErrors: { path: string; status: number; injected: boolean }[] = []
 const injectedRequests = new WeakSet<Request>()
 const pendingRequests = new Set<Request>()
@@ -187,9 +191,9 @@ const checkNavigation = (name: string, run: () => Promise<void>) => check('navig
 const checkComposer = (name: string, run: () => Promise<void>) => check('composer', name, run)
 const checkAccess = (name: string, run: () => Promise<void>) => check('access', name, run)
 
-async function screenshot(name: string) {
-  if (!panel) return
-  for (const frame of panel.frames()) {
+async function screenshot(name: string, target = panel) {
+  if (!target) return
+  for (const frame of target.frames()) {
     await frame.evaluate(() =>
       Promise.all(
         document
@@ -216,7 +220,7 @@ async function screenshot(name: string) {
     }
   }
   const path = `${report}.${name}.png`
-  await panel.screenshot({ path, fullPage: true, animations: 'disabled' })
+  await target.screenshot({ path, fullPage: true, animations: 'disabled' })
   screenshots.push(path)
 }
 
@@ -506,6 +510,14 @@ try {
     await login.waitForURL('**/login**')
     assert.equal(new URL(login.url()).origin, base.origin)
     await login.close()
+    const draft = await openPage()
+    try {
+      await draft.goto(`${base.origin}/extension/create-link`)
+      await expect(draft.getByRole('heading', { name: 'Sign in to create a link' })).toBeVisible()
+      await screenshot('create-link-sign-in', draft)
+    } finally {
+      await draft.close()
+    }
   })
   const signInAndSeed = async () => {
     const signup = await browserContext.request.post(`${base.origin}/api/auth/sign-up/email`, {
@@ -523,9 +535,91 @@ try {
     userId = String(id)
     await seed()
   }
+  let login: Page | null = null
+  await checkNavigation(
+    'Manual refresh recovers sign-in without focus or visibility changes',
+    async () => {
+      login = await openPage()
+      await login.goto(`${base.origin}/login`)
+      const recovery = await openPanel()
+      try {
+        const signedOutSession = recovery.waitForResponse(
+          (response) => new URL(response.url()).pathname === '/api/auth/get-session'
+        )
+        await recovery.goto(`chrome-extension://${extensionId}/sidepanel.html`)
+        const app = recovery.frames().find((candidate) => candidate.url().startsWith(base.origin))
+        assert(app, 'Recovery panel must load the real app')
+        await app.getByRole('heading', { name: 'Sign in to Sim', exact: true }).click()
+        assert.equal(await (await signedOutSession).json(), null)
+        await expect
+          .poll(
+            () =>
+              [...pendingRequests].filter(
+                (request) =>
+                  request.frame().page() === recovery &&
+                  new URL(request.url()).pathname === '/api/auth/get-session'
+              ).length
+          )
+          .toBe(0)
+        const events = await app.evaluateHandle(() => {
+          let focus = 0
+          let visibility = 0
+          const focused = () => focus++
+          const visible = () => visibility++
+          window.addEventListener('focus', focused)
+          document.addEventListener('visibilitychange', visible)
+          return {
+            snapshot: () => ({
+              focus,
+              visibility,
+              focused: document.hasFocus(),
+              visibilityState: document.visibilityState,
+            }),
+            dispose: () => {
+              window.removeEventListener('focus', focused)
+              document.removeEventListener('visibilitychange', visible)
+            },
+          }
+        })
+        try {
+          await signInAndSeed()
+          const beforeRefresh = await events.evaluate((observer) => observer.snapshot())
+          signInRecoveryReceipts.push({ phase: 'before-refresh', ...beforeRefresh })
+          assert.deepEqual(beforeRefresh, {
+            focus: 0,
+            visibility: 0,
+            focused: true,
+            visibilityState: 'visible',
+          })
+          await expect(
+            app.getByRole('heading', { name: 'Sign in to Sim', exact: true })
+          ).toBeVisible()
+          await screenshot('sign-in-manual-refresh', recovery)
+          const [response] = await Promise.all([
+            app.waitForNavigation({ waitUntil: 'load' }),
+            app.getByRole('button', { name: 'Refresh', exact: true }).click(),
+          ])
+          assert(response, 'Refresh must return a document response')
+          assert.equal(response.status(), 200)
+          assert(response.request().isNavigationRequest(), 'Refresh must reload the app document')
+          await expect(
+            app.getByRole('link', { name: 'Extension QA alpha', exact: true })
+          ).toBeVisible()
+          signInRecoveryReceipts.push({ phase: 'recovered', documentStatus: response.status() })
+          await screenshot('sign-in-manual-recovered', recovery)
+        } finally {
+          await events.evaluate((observer) => observer.dispose()).catch(() => {})
+          await events.dispose()
+        }
+      } finally {
+        await recovery.close()
+      }
+    }
+  )
   await checkNavigation('A real Better Auth session reaches the extension iframe', async () => {
-    await signInAndSeed()
-    await shell.reload()
+    assert(login, 'The sign-in tab must remain open until returning to the original panel')
+    await login.close()
+    await shell.bringToFront()
     await expect(
       frame().getByRole('link', { name: 'Extension QA alpha', exact: true })
     ).toBeVisible()
@@ -878,7 +972,7 @@ try {
     }
   }
   await checkNavigation(
-    'Capture, preview, removal, and the three-page cap use the real composer',
+    'Capture, preview, and removal support ten pages in the real composer',
     async () => {
       await capture()
       await expect(attachments()).toHaveCount(1)
@@ -994,13 +1088,16 @@ try {
         await focusBarrier.dispose()
         await focusObserver.dispose()
       }
-      await capture()
-      await capture()
-      await capture()
-      await expect(attachments()).toHaveCount(3)
-      await expect(frame().getByRole('alert').filter({ hasText: 'Remove one' })).toBeVisible()
-      await screenshot('page-limit')
-      await attachments().first().getByRole('button', { name: 'Remove page context' }).click()
+      for (let count = 2; count <= 10; count++) {
+        await capture()
+        await expect(attachments()).toHaveCount(count)
+      }
+      await expect(frame().getByRole('alert').filter({ hasText: 'Remove a page' })).toHaveCount(0)
+      await screenshot('many-pages')
+      for (let count = 10; count > 2; count--) {
+        await attachments().first().getByRole('button', { name: 'Remove page context' }).click()
+        await expect(attachments()).toHaveCount(count - 1)
+      }
       await expect(attachments()).toHaveCount(2)
       const stored = await frame().evaluate(() => JSON.stringify(localStorage))
       assert(
@@ -1084,14 +1181,14 @@ try {
               .evaluate((button) => (button as HTMLButtonElement).click())
             await screenshot('capture-menu')
             await frame()
-              .getByRole('menuitem', { name: 'Site access', exact: true })
+              .getByRole('menuitem', { name: 'Page access', exact: true })
               .evaluate((button) => (button as HTMLElement).click())
-            const access = shell.getByRole('dialog', { name: 'Site access', exact: true })
+            const access = shell.getByRole('dialog', { name: 'Page access', exact: true })
             await expect(
-              access.getByRole('button', { name: `Remove access to ${fixtureOrigin}`, exact: true })
+              access.getByRole('button', { name: 'Allow across websites', exact: true })
             ).toBeVisible()
             await expect(
-              frame().getByRole('menuitem', { name: 'Site access', exact: true })
+              frame().getByRole('menuitem', { name: 'Page access', exact: true })
             ).toHaveCount(0)
             await screenshot('site-options')
             await access.getByRole('button', { name: 'Close', exact: true }).click()
@@ -1326,22 +1423,299 @@ try {
       await expect(frame().getByRole('textbox', { name: 'Message', exact: true })).toHaveValue('')
     }
   )
-  await checkComposer(
-    'The extension blocks microphone capture even when the Sim origin has permission',
+  await checkNavigation(
+    'A sanitized link draft saves in the current organization and opens its destination',
     async () => {
-      await browserContext.grantPermissions(['microphone'], { origin: base.origin })
-      const denied = await frame().evaluate(async () => {
+      let draft = await openPage()
+      await setPageViewport(draft, 1280, 900)
+      const endpoint = `/api/organizations/${organizationId}/sim-links`
+      let writes = 0
+      draft.on('request', (request) => {
+        if (new URL(request.url()).pathname === endpoint && request.method() === 'POST') writes++
+      })
+      try {
+        await draft.goto(`${base.origin}/extension/create-link`)
+        await expect(
+          draft.getByRole('heading', { name: 'Links unavailable', exact: true })
+        ).toBeVisible()
+        await screenshot('create-link-unavailable', draft)
+        await draft.close()
+        await seedViewerOrganization()
+        draft = await openPage()
+        await setPageViewport(draft, 1280, 900)
+        draft.on('request', (request) => {
+          if (new URL(request.url()).pathname === endpoint && request.method() === 'POST') writes++
+        })
+        const destination = `${fixtureOrigin}/page`
+        const hash = new URLSearchParams({
+          url: `${destination}?private=QUERY_SECRET#FRAGMENT_SECRET`,
+        })
+        await draft.goto(`${base.origin}/extension/create-link#${hash}`)
+        const dialog = draft.getByRole('dialog', { name: 'New link', exact: true })
+        await expect(
+          dialog.getByRole('textbox', { name: 'Destination URL', exact: true })
+        ).toHaveValue(destination)
+        await expect.poll(() => new URL(draft.url()).hash).toBe('')
+        await screenshot('create-link-draft', draft)
+        await dialog.getByRole('button', { name: 'Create', exact: true }).click()
+        await expect(dialog.getByRole('textbox', { name: 'Name', exact: true })).toHaveAttribute(
+          'aria-invalid',
+          'true'
+        )
+        assert.equal(writes, 0, 'An invalid draft reached the create boundary')
+        await screenshot('create-link-validation', draft)
+        await dialog.getByRole('textbox', { name: 'Name', exact: true }).fill('qa-draft')
+        const saved = draft.waitForResponse(
+          (response) =>
+            new URL(response.url()).pathname === endpoint && response.request().method() === 'POST'
+        )
+        await dialog.getByRole('button', { name: 'Create', exact: true }).click()
+        assert.equal((await saved).status(), 200)
+        await draft.waitForURL(`${base.origin}/o/${organizationId}/links`)
+        const [row] =
+          await sql`select name, url from sim_link where organization_id=${organizationId}`
+        assert.equal(row?.name, 'qa-draft')
+        assert.equal(row?.url, destination)
+        const link = draft.getByRole('row').filter({ hasText: 'qa-draft' })
+        await expect(link).toBeVisible()
+        await screenshot('create-link-saved', draft)
+        const opened = browserContext.waitForEvent('page')
+        await link.click()
+        const resolved = await opened
         try {
-          const stream = await navigator.mediaDevices.getUserMedia({ audio: true })
-          stream.getTracks().forEach((track) => track.stop())
-          return false
-        } catch (error) {
-          return error instanceof DOMException && error.name === 'NotAllowedError'
+          await resolved.waitForURL(destination)
+        } finally {
+          await resolved.close()
+        }
+      } catch (error) {
+        if (!draft.isClosed()) await screenshot('create-link-failure', draft).catch(() => {})
+        throw error
+      } finally {
+        await draft.close()
+        await sql`delete from organization where id=${organizationId}`
+      }
+    }
+  )
+  await checkComposer(
+    'Voice input cancels startup, recovers permission, and preserves drafts through Send or restart',
+    async () => {
+      const input = frame().getByRole('textbox', { name: 'Message', exact: true })
+      const mic = frame().getByRole('button', { name: 'Voice input', exact: true })
+      const stop = frame().getByRole('button', { name: 'Stop listening', exact: true })
+      const sessions: { socket: WebSocketRoute; chunks: number; closed: boolean }[] = []
+      const connectionGate = createDeferred<void>()
+      const tokenGate = createDeferred<void>()
+      let holdToken = false
+      let tokenRequested = false
+      await shell.route('**/api/speech/token', async (route) => {
+        injectedRequests.add(route.request())
+        if (holdToken) {
+          tokenRequested = true
+          await tokenGate.promise
         }
+        return route.fulfill({ json: { token: 'synthetic-extension-voice' } })
       })
-      assert(denied, 'Microphone capture escaped the extension permissions policy')
-      await expect(frame().getByRole('button', { name: 'Voice input', exact: true })).toHaveCount(0)
-      await browserContext.clearPermissions()
+      await shell.routeWebSocket(
+        'wss://api.elevenlabs.io/v1/speech-to-text/realtime*',
+        async (socket) => {
+          const session = { socket, chunks: 0, closed: false }
+          sessions.push(session)
+          socket.onMessage((message) => {
+            const data = toRecord(JSON.parse(String(message)))
+            if (typeof data.audio_base_64 === 'string' && data.audio_base_64.length > 0) {
+              assert.equal(data.sample_rate, 16000)
+              assert(Buffer.from(data.audio_base_64, 'base64').length > 0)
+              session.chunks++
+            }
+          })
+          socket.onClose(async () => {
+            await socket.close()
+            session.closed = true
+          })
+          if (sessions.length === 1) await connectionGate.promise
+        }
+      )
+      type VoiceCaptureWindow = typeof window & {
+        __voiceCaptureProbe?: {
+          getUserMedia: MediaDevices['getUserMedia']
+          WebSocket: typeof WebSocket
+          tracks: MediaStreamTrack[]
+          sockets: WebSocket[]
+        }
+      }
+      await frame().evaluate(() => {
+        const probe = {
+          getUserMedia: navigator.mediaDevices.getUserMedia,
+          WebSocket: window.WebSocket,
+          tracks: [] as MediaStreamTrack[],
+          sockets: [] as WebSocket[],
+        }
+        ;(window as VoiceCaptureWindow).__voiceCaptureProbe = probe
+        navigator.mediaDevices.getUserMedia = async (constraints) => {
+          const stream = await probe.getUserMedia.call(navigator.mediaDevices, constraints)
+          probe.tracks.push(...stream.getTracks())
+          return stream
+        }
+        window.WebSocket = class extends probe.WebSocket {
+          constructor(url: string | URL, protocols?: string | string[]) {
+            super(url, protocols)
+            probe.sockets.push(this)
+          }
+        }
+      })
+      const captureState = () =>
+        frame().evaluate(() => {
+          const probe = (window as VoiceCaptureWindow).__voiceCaptureProbe
+          return {
+            tracks: probe?.tracks.map((track) => track.readyState) ?? [],
+            sockets: probe?.sockets.map((socket) => socket.readyState) ?? [],
+          }
+        })
+      const microphone = await browserContext.newCDPSession(shell)
+      const setMicrophonePermission = async (setting: 'granted' | 'denied') => {
+        await microphone.send('Browser.setPermission', {
+          permission: { name: 'microphone' },
+          setting,
+          origin: `chrome-extension://${extensionId}`,
+          embeddedOrigin: base.origin,
+        })
+        const state = await frame().evaluate(
+          async () =>
+            (await navigator.permissions.query({ name: 'microphone' as PermissionName })).state
+        )
+        voiceDiagnostics.push({ event: 'permission', setting, state })
+        assert.equal(state, setting)
+      }
+      const submitted: Record<string, unknown>[] = []
+      await shell.route('**/api/mothership/chat', (route) => {
+        if (route.request().method() !== 'POST') return route.continue()
+        submitted.push(toRecord(route.request().postDataJSON()))
+        injectedRequests.add(route.request())
+        return route.fulfill({ status: 403, json: { error: 'QA admission rejected' } })
+      })
+      try {
+        await expect(mic).toBeVisible()
+        await input.fill('Keep my draft')
+        assert.equal(sessions.length, 0, 'Voice started before an explicit click')
+        await screenshot('microphone-ready')
+        await setMicrophonePermission('denied')
+        await mic.click()
+        const settings = frame().getByRole('button', { name: 'Open settings', exact: true })
+        await expect(settings).toBeVisible()
+        await expect(input).toHaveValue('Keep my draft')
+        assert.equal(sessions.length, 0, 'Denied microphone started transcription')
+        await screenshot('microphone-blocked')
+        const opened = browserContext.waitForEvent('page')
+        await settings.click()
+        const settingsPage = await opened
+        await settingsPage.waitForURL('chrome://settings/content/microphone')
+        await settingsPage.close()
+        await shell.bringToFront()
+        const viewport = shell.viewportSize()
+        assert(viewport)
+        await setPanelViewport(viewport.width, viewport.height)
+        await setMicrophonePermission('granted')
+        await mic.click()
+        await expect.poll(() => sessions.length).toBe(1)
+        await expect.poll(captureState).toEqual({ tracks: ['live'], sockets: [0] })
+        await screenshot('microphone-connecting')
+        await frame()
+          .getByRole('button', { name: /^(Voice input|Stop listening)$/ })
+          .click()
+        await expect.poll(captureState).toEqual({ tracks: ['ended'], sockets: [3] })
+        await expect.poll(() => sessions[0].closed).toBe(true)
+        voiceDiagnostics.push({ event: 'cancel-connecting', ...(await captureState()) })
+        connectionGate.resolve()
+        await expect(mic).toBeVisible()
+        await expect(input).toHaveValue('Keep my draft')
+        assert.equal(sessions[0].chunks, 0, 'Cancelled startup sent audio')
+
+        holdToken = true
+        await mic.click()
+        await expect.poll(() => tokenRequested).toBe(true)
+        await stop.click()
+        tokenGate.resolve()
+        holdToken = false
+        await expect(mic).toBeVisible()
+        await expect(input).toHaveValue('Keep my draft')
+        await mic.click()
+        await expect(stop).toBeVisible()
+        await expect.poll(() => sessions[1]?.chunks ?? 0).toBeGreaterThan(0)
+        assert.equal(sessions.length, 2, 'Cancelled token request started another session')
+        assert.deepEqual((await captureState()).tracks, ['ended', 'live'])
+        sessions[1].socket.send(
+          JSON.stringify({ message_type: 'partial_transcript', text: 'first thought' })
+        )
+        await expect(input).toHaveValue('Keep my draft first thought')
+        await screenshot('microphone-listening')
+        await stop.click()
+        await expect(mic).toBeVisible()
+        await mic.click()
+        await expect(stop).toBeVisible()
+        await expect.poll(() => sessions.length).toBe(3)
+        sessions[1].socket.send(
+          JSON.stringify({ message_type: 'partial_transcript', text: 'stale thought' })
+        )
+        await expect.poll(() => sessions[1].closed).toBe(true)
+        await expect(stop).toBeVisible()
+        await expect(input).toHaveValue('Keep my draft first thought')
+        const chunks = sessions[2].chunks
+        await expect.poll(() => sessions[2].chunks).toBeGreaterThan(chunks)
+        sessions[2].socket.send(
+          JSON.stringify({ message_type: 'partial_transcript', text: 'second thought' })
+        )
+        await expect(input).toHaveValue('Keep my draft first thought second thought')
+        await input.press('Enter')
+        await expect.poll(() => submitted.length).toBe(1)
+        assert.equal(submitted[0].message, 'Keep my draft first thought second thought')
+        await expect(input).toHaveValue('')
+        await expect(mic).toBeVisible()
+        await expect.poll(() => sessions[2].closed).toBe(true)
+        await expect(
+          frame().getByRole('button', { name: 'Send message', exact: true })
+        ).toBeVisible()
+        await input.fill('Another draft')
+        await mic.click()
+        await expect(stop).toBeVisible()
+        await expect.poll(() => sessions[3]?.chunks ?? 0).toBeGreaterThan(0)
+        sessions[3].socket.send(
+          JSON.stringify({ message_type: 'partial_transcript', text: 'ready to send' })
+        )
+        await expect(input).toHaveValue('Another draft ready to send')
+        await screenshot('microphone-dictated-draft')
+        await stop.click()
+        await input.press('Enter')
+        await expect(input).toHaveValue('')
+        assert.equal(sessions[3].closed, false, 'Final-transcript grace must still be open')
+        sessions[3].socket.send(
+          JSON.stringify({ message_type: 'partial_transcript', text: 'late words' })
+        )
+        await expect.poll(() => sessions[3].closed).toBe(true)
+        await expect(input).toHaveValue('')
+        assert.equal(submitted.length, 2, 'Dictation submitted a message without Send')
+        await screenshot('microphone-after-send')
+      } finally {
+        voiceDiagnostics.push({ event: 'capture-finally', ...(await captureState()) })
+        connectionGate.resolve()
+        tokenGate.resolve()
+        await frame().evaluate(() => {
+          const probeWindow = window as VoiceCaptureWindow
+          const probe = probeWindow.__voiceCaptureProbe
+          if (!probe) return
+          navigator.mediaDevices.getUserMedia = probe.getUserMedia
+          window.WebSocket = probe.WebSocket
+          probe.tracks.forEach((track) => track.stop())
+          probeWindow.__voiceCaptureProbe = undefined
+        })
+        voiceDiagnostics.push({
+          event: 'finally',
+          sessions: sessions.map(({ chunks, closed }) => ({ chunks, closed })),
+        })
+        await shell.unroute('**/api/speech/token')
+        await shell.unroute('**/api/mothership/chat')
+        await microphone.send('Browser.resetPermissions')
+        await microphone.detach()
+      }
     }
   )
   await checkComposer(
@@ -1742,7 +2116,11 @@ try {
         .poll(() => new URL(frame().url()).pathname)
         .toBe(`/extension/o/${organizationId}`)
       await expect(frame().getByRole('textbox', { name: 'Ask Sim', exact: true })).toBeVisible()
+      await expect(frame().getByRole('button', { name: 'Voice input', exact: true })).toBeVisible()
       await screenshot('organization-new-chat')
+      await setPanelViewport(320, 844)
+      await screenshot('organization-microphone-320')
+      await setPanelViewport(390, 844)
       await capture()
       await expect(attachments()).toHaveCount(1)
       let submitted: unknown
@@ -1894,7 +2272,7 @@ try {
           const expectDraftHeld = async () => {
             await input().press('Enter')
             await expect(
-              frame().getByText('Connecting to the Sim extension. Try again in a moment.').first()
+              frame().getByText('Connecting to Sim. Try again in a moment.').first()
             ).toBeVisible()
             await expect(input()).toHaveValue(draft)
             assert.equal(received.length, 1)
@@ -2037,7 +2415,7 @@ try {
                 .getByRole('button', { name: org ? 'Send' : 'Send message', exact: true })
                 .click()
             await expect(
-              shell.getByRole('button', { name: 'Request site access', exact: true })
+              shell.getByRole('button', { name: 'Allow across websites', exact: true })
             ).toBeEnabled()
             await expect(input()).toHaveValue(draft)
             await expect
@@ -2576,7 +2954,11 @@ try {
             frame().getByRole('heading', { name: 'How can I help?', exact: true })
           )
         : undefined
+      await expect(frame().getByRole('button', { name: 'Voice input', exact: true })).toBeVisible()
       await screenshot('organization-assistant-page')
+      await setPanelViewport(320, 844)
+      await screenshot('assistant-microphone-320')
+      await setPanelViewport(390, 844)
       if (!liveChat)
         await shell.route('**/api/mothership/chat', (route) =>
           route.fulfill({ status: 403, json: { error: 'QA submission boundary' } })
@@ -2788,22 +3170,38 @@ try {
       }
     })
   }
-  await checkAccess('An initial workspace-list 401 opens sign-in recovery', async () => {
-    await browserContext.route(workspaceListUrl, async (route) => {
-      injectedRequests.add(route.request())
-      await route.fulfill({ status: 401, json: { error: 'QA workspace-list session expired' } })
-    })
-    try {
-      await navigate(`${base.origin}/extension`)
-      await expect(frame().getByRole('link', { name: 'Sign in', exact: true })).toBeVisible()
-      await expect(
-        frame().getByRole('navigation', { name: 'Workspaces', exact: true })
-      ).toHaveCount(0)
-      await screenshot('workspace-picker-initial-session-expired')
-    } finally {
-      await browserContext.unroute(workspaceListUrl)
+  await checkAccess(
+    'An initial workspace-list 401 recovers when the same user returns',
+    async () => {
+      await browserContext.route(workspaceListUrl, async (route) => {
+        injectedRequests.add(route.request())
+        await route.fulfill({ status: 401, json: { error: 'QA workspace-list session expired' } })
+      })
+      try {
+        await navigate(`${base.origin}/extension`)
+        await expect(frame().getByRole('link', { name: 'Sign in', exact: true })).toBeVisible()
+        await expect(
+          frame().getByRole('navigation', { name: 'Workspaces', exact: true })
+        ).toHaveCount(0)
+        await screenshot('workspace-picker-initial-session-expired')
+      } finally {
+        await browserContext.unroute(workspaceListUrl)
+      }
+      const returnedFrom = await openPage()
+      try {
+        await returnedFrom.goto(`${fixtureOrigin}/page`)
+        await returnedFrom.bringToFront()
+      } finally {
+        await returnedFrom.close()
+      }
+      await shell.bringToFront()
+      const choices = frame().getByRole('navigation', { name: 'Workspaces', exact: true })
+      await expect(choices).toBeVisible()
+      await screenshot('workspace-picker-session-restored')
+      await choices.getByRole('link', { name: 'Extension QA alpha', exact: true }).click()
+      await expect(frame().getByRole('textbox', { name: 'Message', exact: true })).toBeVisible()
     }
-  })
+  )
   await checkAccess(
     'Transient session, workspace, and permission-policy refetch failures preserve the mounted composer and page draft',
     async () => {
@@ -3024,6 +3422,8 @@ try {
         checks,
         screenshots,
         browserErrors,
+        voiceDiagnostics,
+        signInRecoveryReceipts,
         failedRequests,
         pendingRequests: pendingAtFailure,
         failureState,
diff --git a/apps/sim/scripts/test-landing-seo-e2e.ts b/apps/sim/scripts/test-landing-seo-e2e.ts
index 6b7171bff39..70bccd4127b 100644
--- a/apps/sim/scripts/test-landing-seo-e2e.ts
+++ b/apps/sim/scripts/test-landing-seo-e2e.ts
@@ -13,9 +13,11 @@ import {
   dustProfile,
   gumloopProfile,
   langflowProfile,
+  microsoftCopilotProfile,
   n8nProfile,
   openaiAgentkitProfile,
   openClawProfile,
+  type Prose,
   pipedreamProfile,
   vellumProfile,
 } from '@/lib/compare/data'
@@ -467,6 +469,78 @@ async function run() {
     assert.deepEqual(failures, [])
   })
 
+  await check(
+    'a comparison page answering its buyer questions in place keeps their order',
+    async () => {
+      const profile = microsoftCopilotProfile
+      const { status, body } = await get(`/comparisons/${profile.id}`)
+      assert.equal(status, 200)
+      const text = decodeHtml(body)
+      const { intro = [], glance = [], closing = [] } = profile.questions ?? {}
+      assert(
+        profile.leadQuestion && intro.length && glance.length && closing.length,
+        'profile no longer exercises every question position'
+      )
+      const questions = [
+        profile.leadQuestion,
+        ...[...intro, ...glance, ...closing].map((q) => q.question),
+      ]
+      assert.deepEqual(faqQuestions(body), questions, 'FAQPage lists the page questions in order')
+
+      const headings = [
+        profile.leadQuestion,
+        ...intro.map((q) => q.question),
+        `Sim vs ${profile.name}: at a glance`,
+        ...glance.map((q) => q.question),
+        'feature-by-feature comparison',
+        ...closing.map((q) => q.question),
+        'Bottom line',
+      ]
+      const positions = headings.map((heading) => text.indexOf(`${heading}</h2>`))
+      assert(
+        positions.every((at) => at >= 0),
+        `missing heading: ${headings[positions.indexOf(-1)]}`
+      )
+      assert.deepEqual(
+        [...positions].sort((a, b) => a - b),
+        positions,
+        'question sections are out of reading order'
+      )
+      assert(!text.includes('Frequently asked questions</h2>'), 'generated FAQ block still renders')
+      for (const row of profile.glance ?? []) {
+        assert(text.includes(`${row.label}</th>`), `at-a-glance row missing: ${row.label}`)
+      }
+
+      const visibleText = decodeHtml(
+        body
+          .replace(/<script\b[\s\S]*?<\/script>/g, '')
+          .replace(/<!--[\s\S]*?-->/g, '')
+          .replace(/<[^>]+>/g, '')
+      )
+      const proseText = (prose: Prose) =>
+        prose.map((part) => (typeof part === 'string' ? part : part.text)).join('')
+      const expectedProse = [
+        ...(profile.leadAnswer ? [profile.leadAnswer] : []),
+        ...[...intro, ...glance, ...closing].map((q) => q.answer),
+        ...(profile.glance ?? []).flatMap((row) => [row.sim, row.competitor]),
+      ]
+      for (const prose of expectedProse) {
+        const expected = proseText(prose)
+        assert(visibleText.includes(expected), `page text missing: ${expected.slice(0, 80)}`)
+      }
+
+      const relatedStart = text.indexOf('Related reading</h2>')
+      const relatedEnd = text.indexOf('More comparisons</h2>')
+      assert(relatedStart >= 0 && relatedEnd > relatedStart, 'related reading section missing')
+      const relatedSlugs = new Set(
+        [...text.slice(relatedStart, relatedEnd).matchAll(/href="\/library\/([^"/?#]+)"/g)].map(
+          (match) => match[1]
+        )
+      )
+      assert.deepEqual([...relatedSlugs], profile.relatedReading)
+    }
+  )
+
   await check('rebuilt integration pages render their comparison and FAQs', async () => {
     const failures: string[] = []
     for (const slug of ['github', 'shopify', 'snowflake']) {
diff --git a/apps/sim/scripts/test-organization-search-e2e.ts b/apps/sim/scripts/test-organization-search-e2e.ts
index 99627f66c2f..8606ca7c6de 100644
--- a/apps/sim/scripts/test-organization-search-e2e.ts
+++ b/apps/sim/scripts/test-organization-search-e2e.ts
@@ -445,7 +445,15 @@ try {
       const body = toRecord(response.request().postDataJSON())
       assert.equal(body.organizationId, organizationId)
       assert.equal(body.query, 'Launch notes')
-      await expect(page.getByText('Search found no results.', { exact: true })).toBeVisible()
+      // The seeded member has connected no account, so nothing was searched.
+      await expect(
+        page.getByText('No connected apps are available for this search.', { exact: true })
+      ).toBeVisible()
+      await expect(page.getByText('Search found no results.', { exact: true })).toHaveCount(0)
+      await expect(page.getByRole('link', { name: 'Connect apps' })).toHaveAttribute(
+        'href',
+        `${root}/integrations`
+      )
       await expect(page).toHaveURL(
         (url) => url.pathname === `${root}/search` && url.searchParams.get('q') === 'Launch notes'
       )
@@ -708,7 +716,9 @@ try {
               await navigation.getByRole('button', { name: 'Search', exact: true }).click()
               await expect(page).toHaveURL((url) => url.searchParams.get('mode') === 'search')
             }
-            await page.clock.pauseAt(new Date(Date.now() + 100))
+            const pausedAt = new Date()
+            await page.clock.setFixedTime(pausedAt)
+            await page.clock.pauseAt(pausedAt)
             const selected = navigation.getByRole('button', {
               name: selectedMode === 'assistant' ? 'Assistant' : 'Search',
               exact: true,
@@ -726,6 +736,7 @@ try {
           } finally {
             admission.resolve()
             heldAdmission = undefined
+            await page.clock.setSystemTime(new Date())
             await page.clock.resume()
           }
         }
@@ -1025,7 +1036,18 @@ try {
     verifyLegacyDraft(undefined, 'assistant')
   )
   await check('The UI completes without unexpected browser runtime errors', async () => {
-    await expect.poll(() => browserErrorEventCount).toBe(browserErrorCount)
+    const handledRedirectCount = () =>
+      browserErrorEvents.reduce(
+        (count, event) =>
+          event.stage === 'Search URLs cannot change an agent conversation into an assistant' &&
+          event.url === `${baseUrl.origin}${root}/search/chat/${agentId}` &&
+          event.digest === `NEXT_REDIRECT;replace;${root}/chat/${agentId};307;` &&
+          event.message.startsWith('Minified React error #419;')
+            ? count + event.count
+            : count,
+        0
+      )
+    await expect.poll(() => browserErrorEventCount - handledRedirectCount()).toBe(browserErrorCount)
     const deniedRecoveries = browserErrorEvents.filter(
       (event) =>
         event.digest === 'NEXT_HTTP_ERROR_FALLBACK;404' &&
@@ -1036,7 +1058,11 @@ try {
         ].includes(event.stage)
     )
     const recoveryCount = deniedRecoveries.reduce((total, event) => total + event.count, 0)
-    assert.equal(browserErrorEventCount, recoveryCount, 'Unexpected browser error events')
+    assert.equal(
+      browserErrorEventCount,
+      recoveryCount + handledRedirectCount(),
+      'Unexpected browser error events'
+    )
     assert.equal(browserErrorCount, recoveryCount, 'Unexpected browser runtime errors')
     for (const sample of browserErrorSamples) {
       const matchedCount = deniedRecoveries
diff --git a/apps/sim/scripts/test-sim-links-e2e.ts b/apps/sim/scripts/test-sim-links-e2e.ts
index a3edd66b422..feb3ecb8370 100644
--- a/apps/sim/scripts/test-sim-links-e2e.ts
+++ b/apps/sim/scripts/test-sim-links-e2e.ts
@@ -175,71 +175,6 @@ async function auditActions(orgId: string): Promise<string[]> {
 }
 
 async function run() {
-  await check(
-    'search recovery hands safe shortcuts to the canonical resolver without a page',
-    async () => {
-      const maximum = `sim/${'a'.repeat(64)}/${Array(8).fill('v'.repeat(256)).join('/')}`
-      const cases = [
-        ['sim/bookface', '/sim/bookface'],
-        ['SIM/Book-Face/', '/sim/Book-Face'],
-        ['sim/a.:@&~_-', '/sim/a.%3A%40%26~_-'],
-        ['sim/jira/PROD-123', '/sim/jira/PROD-123'],
-        [`${maximum}/`, `/${maximum}`],
-      ]
-      for (const [shortcut, destination] of cases) {
-        const response = await send(`/sim-links/recover?q=${encodeURIComponent(shortcut)}`, null)
-        assert.equal(response.status, 307, shortcut)
-        assert.equal(response.headers.get('location'), destination)
-        assert.equal(response.headers.get('cache-control'), 'no-store')
-        assert.equal(response.headers.get('referrer-policy'), 'no-referrer')
-        assert.equal(await response.text(), '')
-      }
-    }
-  )
-
-  await check(
-    'search recovery rejects ambiguous, escaping and oversized input without reflecting it',
-    async () => {
-      const invalidShortcuts = [
-        'sim/',
-        'sim/...',
-        'web/handbook',
-        'https://evil.example.com',
-        'sim/a/../private',
-        'sim/a/./private',
-        'sim/a//private',
-        'sim/a/%2e%2e',
-        'sim/a\\private',
-        'sim/a?private=secret',
-        'sim/a#private',
-        'sim/a private',
-        `sim/${'a'.repeat(65)}`,
-        `sim/a/${'v'.repeat(257)}`,
-        `sim/a/${Array(9).fill('v').join('/')}`,
-        `sim/a/${'v'.repeat(6400)}`,
-      ]
-      const queries = [
-        '',
-        '?q=',
-        '?q=sim%2Fa&q=sim%2Fb',
-        '?q=sim%2Fa&%71=sim%2Fb',
-        '?q=sim%2Fa&extra=private',
-        '?x=sim%2Fa',
-        '?q=sim%2Fa%ZZ',
-        '?q=sim%2Fa+private',
-        ...invalidShortcuts.map((shortcut) => `?q=${encodeURIComponent(shortcut)}`),
-      ]
-      for (const query of queries) {
-        const response = await send(`/sim-links/recover${query}`, null)
-        assert.equal(response.status, 400, query)
-        assert.equal(response.headers.get('location'), null)
-        assert.equal(response.headers.get('cache-control'), 'no-store')
-        assert.equal(response.headers.get('referrer-policy'), 'no-referrer')
-        assert.equal(await response.text(), 'Invalid Sim shortcut.')
-      }
-    }
-  )
-
   const orgId = await seedOrganization()
   const owner = await seedMember(orgId, 'owner')
   const member = await seedMember(orgId, 'member')
@@ -338,7 +273,7 @@ async function run() {
       body: fields({ name: 'team.handbook', url: 'https://other.example.com' }),
       expected: 409,
     })
-    assert.match(String(error), /sim\/Team-Handbook already exists/)
+    assert.match(String(error), /A link named Team-Handbook already exists/)
   })
 
   await check('unlisted links are hidden from other members but still resolve', async () => {
@@ -403,57 +338,37 @@ async function run() {
     await api({ ...outsider, orgId }, '', { expected: 404 })
   })
 
-  await check('team bookmarks preserve encoded names and organization across sign-in', async () => {
-    const destination = 'https://team.example.com/help'
-    for (const name of ['managed-help', 'managed:help@team&docs']) {
-      const path = `/sim-links/${encodeURIComponent(orgId)}/${encodeURIComponent(name)}`
-      await create(owner, { name, url: destination })
-      await create(outsider, { name, url: 'https://another-team.example.com/help' })
-      const signedOut = await send(path, null)
-      assert.equal(signedOut.status, 307, `${name}: expected sign-in redirect`)
-      const login = new URL(signedOut.headers.get('location') ?? '/', baseUrl)
-      assert.equal(login.pathname, '/login', name)
-      assert.equal(login.searchParams.get('callbackUrl'), path, name)
-      const opened = await send(path, member)
-      assert.equal(opened.status, 307, `${name}: expected destination redirect`)
-      assert.equal(opened.headers.get('location'), destination, name)
-      const denied = await send(path, outsider)
-      assert.equal(denied.status, 404, name)
-      assert(!denied.headers.get('location'), name)
-    }
-    for (const encodedName of ['%256Danaged-help', 'managed%2Fhelp']) {
-      const denied = await send(`/sim-links/${encodeURIComponent(orgId)}/${encodedName}`, member)
-      assert.equal(denied.status, 404, encodedName)
-      assert(!denied.headers.get('location'), encodedName)
+  await check('the address bar learns whether links are on and matches inside names', async () => {
+    const suggest = (caller: Member | null, q: string) =>
+      send(`/api/sim-links/suggestions?q=${encodeURIComponent(q)}`, caller)
+    assert.equal((await suggest(null, '')).status, 401)
+    const { enabled, links } = (await (await suggest(member, 'handbook')).json()) as {
+      enabled: boolean
+      links: { name: string }[]
     }
+    assert.equal(enabled, true)
+    assert(links.some((link) => link.name === 'Team-Handbook'))
+    const withoutOrganization = await seedMember(orgId, 'member')
+    await sql`delete from member where user_id = ${withoutOrganization.userId}`
+    assert.deepEqual(await (await suggest(withoutOrganization, '')).json(), {
+      enabled: false,
+      links: [],
+    })
+    assert.match((await open(withoutOrganization, 'handbook')).text, /aren.*t available/)
   })
 
-  await check(
-    'bookmark export requires admin access and drops stale or foreign selections',
-    async () => {
-      const name = 'managed-directory'
-      const id = await create(owner, { name, url: 'https://directory.example.com' })
-      const otherId = await create(outsider, { name, url: 'https://other.example.com' })
-      const request = {
-        links: [
-          { id, name },
-          { id: otherId, name },
-        ],
-      }
-      const exportPolicy = (caller: Member, expected = 200) =>
-        api(caller, '/bookmarks', { method: 'POST', body: request, expected })
-      assert.deepEqual((await exportPolicy(owner)).links, [{ id, name }])
-      await exportPolicy(member, 403)
-      await api(owner, `/${id}`, {
-        method: 'PUT',
-        body: fields({ name, url: 'https://directory.example.com', unlisted: true }),
-      })
-      assert.deepEqual((await exportPolicy(owner)).links, [])
-      await api(owner, `/${id}`, { method: 'DELETE' })
-      await create(owner, { name, url: 'https://replacement.example.com' })
-      assert.deepEqual((await exportPolicy(owner)).links, [])
-    }
-  )
+  await check('a typed phrase searches links and a near miss offers what exists', async () => {
+    const phrase = await open(member, 'team%20handbook')
+    assert(phrase.location, 'Expected a redirect to search')
+    assert.equal(new URL(phrase.location).searchParams.get('search'), 'team handbook')
+    const { links } = await api(member, '?search=team%20handbook', {})
+    assert(
+      Array.isArray(links) &&
+        links.some((link) => isRecordLike(link) && link.name === 'Team-Handbook'),
+      'Expected a typed phrase to find the hyphenated name'
+    )
+    assert.match((await open(member, 'handbook')).text, /Team-Handbook/)
+  })
 
   await check('redirects are counted and order the most-used view', async () => {
     const { links } = await api(member, '?sort=popular', {})
diff --git a/packages/browser-extension-protocol/src/index.ts b/packages/browser-extension-protocol/src/index.ts
index 1084bb3e88a..df0798afd6a 100644
--- a/packages/browser-extension-protocol/src/index.ts
+++ b/packages/browser-extension-protocol/src/index.ts
@@ -47,12 +47,13 @@ const extensionActionSchema = z.enum([
   'capture-page',
   'capture-selection',
   'site-access',
-  'browser-shortcuts',
+  'microphone-settings',
 ])
 export type ExtensionAction = z.infer<typeof extensionActionSchema>
 
 export const appToExtensionMessageSchema = z.discriminatedUnion('type', [
   z.strictObject({ ...envelope, type: z.literal('theme'), theme: z.enum(['light', 'dark']) }),
+  z.strictObject({ ...envelope, type: z.literal('signed-in') }),
   z.strictObject({ ...envelope, type: z.literal('ready'), sessionId: z.uuid() }),
   z.strictObject({ ...envelope, type: z.literal('composer-focused'), sessionId: z.uuid() }),
   z.strictObject({ ...envelope, type: z.literal('unavailable'), sessionId: z.uuid() }),
@@ -86,7 +87,6 @@ export type AppToExtensionMessage = z.infer<typeof appToExtensionMessageSchema>
 export const extensionToAppMessageSchema = z.discriminatedUnion('type', [
   z.strictObject({ ...envelope, type: z.literal('focus-composer'), sessionId: z.uuid() }),
   z.strictObject({ ...envelope, type: z.literal('connected'), sessionId: z.uuid() }),
-  z.strictObject({ ...envelope, type: z.literal('shortcuts-available'), sessionId: z.uuid() }),
   z.strictObject({
     ...envelope,
     type: z.literal('reference-preference'),
@@ -123,14 +123,20 @@ export const SIM_LINK_NAME_MAX_LENGTH = 64
 /** Destination limit shared by editable drafts and saved Sim links. */
 export const SIM_LINK_URL_MAX_LENGTH = 2048
 
+/** Short hosts a link opens from: `sim/<name>` and `go/<name>`. */
+export const SIM_LINK_HOSTS = ['sim', 'go'] as const
+
+export const SIM_LINK_HOST_PATTERN = SIM_LINK_HOSTS.join('|')
+
 /** Where the extension asks for the address-bar suggestions behind its `sim` keyword. */
 export const SIM_LINK_SUGGESTIONS_PATH = '/api/sim-links/suggestions'
 
 /**
- * Listed Sim links whose name starts with what was typed, most visited first. Not strict: an
- * installed extension lags the server, so a field added later must not break its parse.
+ * Listed Sim links matching what was typed, and whether links are on at all for this session. Not
+ * strict: an installed extension lags the server, so a field added later must not break its parse.
  */
 export const simLinkSuggestionsSchema = z.object({
+  enabled: z.boolean().optional(),
   links: z.array(
     z.object({ name: z.string(), description: z.string().nullable(), url: z.string() })
   ),