Agency-client review workflow. Owners generate a per-site or per-artifact share link with optional password, expiry, and reviewer email allowlist. Clients leave feedback without registering for Hollahoop, but their identity is captured (name, email) and their pins are attributed.

Modes: (1) Open review - anyone with link can comment, captcha required, identity optional. (2) Allowlist review - only emails on the list can comment, magic-link auth on first visit. (3) Approval review - guest comments are not visible to other guests until project owner approves; useful when multiple clients review independently and you do not want them seeing each other.

Identity persistence: returning guests are recognised via signed cookie tied to the share link, so they keep their identity across visits without an account. Guest comments display a small "Guest" badge. Engagement integrity (#67) applies: guest votes do not count toward public stats. Optional one-click upgrade path: guest can convert to a real Hollahoop account and keep their pin/comment history. Out of scope: in-app voice/video comments (later if demand exists).