row 206 r2 (#1704): rebased on 275 r3 957a9bfe0; share verbs need collaborator, viewer reads a share (duckworth-0169 C1, C2)

#readable returns false for an agent session, so a `*` share no longer shows a user's message
in an agent's trail. New tests: a sharee's session.list refuses (Q1), and an agent bound to the
shared thread, a chief run and the tester match no share (Q2). BUILD.md records the Q1
follow-up, Q2-Q4 and the live --migrate as Mos's go under Q173. README names the agent rule.

agents/launchpad/work/queue-206/BUILD.md

@@ -0,0 +1,158 @@
+# Row 206 build notes (Launchpad): 193b2, thread shares (#1704)
+
+Brief: docs/plans/2026-10-20_human-users-build.md, "Brief: 193b2, thread shares (schema 3l)"
+(blob de3a6310b). Design: agents/morgana/work/queue-193/DESIGN.md at e2d161e2e (sha256 dd7fcb41…),
+sections 4.3, 5.2-5.6 and 8. Reviewer: Duckworth. Assignment: sage-2789.
+
+## Base and chain
+
+- Started on aca16404c (sage-2789) on branch launchpad/row206; 631a256ba pushed there (sage-2854).
+- Round 2: rebased onto Morgana's 275 r3, 957a9bfe0 (morgana-0143, which carries duckworth-0166
+  B1), on the new branch launchpad/row206-r275. No force push of the old branch.
+- After 253 lands, rebase onto its tip under a new branch name.
+- 275 gives `VIEWER_VERBS`, `userLevel(verb)` and verb-aware `#granted`/`#grantedThread`, and
+  `#userGrants` keeps a live grant of any level, so a viewer binds. On the rebase:
+  - USER_VERBS keeps 275's block and gains the three share verbs. They are not in VIEWER_VERBS,
+    so `userLevel` asks collaborator and a viewer is refused each `access-refused` (design 4.3).
+  - `#threadRead`'s owner path passes `thread.messages` to `#grantedThread`, so a viewer owner
+    reads its own thread at the viewer level (duckworth-0169 C1). Share and unshare pass `verb`;
+    shares passes `thread.shares`.
+  - Two conflicts, both in broker.mjs: the USER_VERBS block and the `thread.messages` line (275's
+    `#grantedThread(s, 'thread.messages', #thread(...))` gives way to `#threadRead`, which now
+    holds that check). user-principal.test.mjs merged clean.
+- C2 sweep on 957a9bfe0: 275 touches agents/morgana/work/queue-275/BUILD.md, broker.mjs,
+  user-principal.test.mjs and viewer.test.mjs. Overlap with 206 is broker.mjs and
+  user-principal.test.mjs, both handled above. viewer.test.mjs has no schema-version or hash
+  pins, and its "every verb off the user list" test reads USER_VERBS, so the share verbs drop
+  out of it on their own.
+- The live `--migrate` (3l→3m on the running bus) is not part of this build. It is Mos's go under
+  Q173, with a backup first and a STATE report after (mos-1310 item 4).
+
+## What changed
+
+- Schema 3l→3m. `thread_shares` as design 5.2, its index and three append-only triggers, in
+  schema.sql and in the new step `src/migrations/3l-3m.sql` with the same SQL text. SCHEMA_SHA256
+  d5ca9bb9268994b175ac79d38939be4bb7f2e80bc0d9ea273eedaae50c29b8a9, SCHEMA_VERSION 3m.
+  `tests/fixtures/schema-3l.sql` is the 3l schema.sql (sha256 cd68512212ce…).
+- `thread_shares` joins `timedTables` (store.mjs), the broker's clock list, `COUNTED` in
+  scripts/stack-release.sh and `LISTED` in stack-release.test (T46). It has `at`, so it goes in
+  the counted list, not the untimed one.
+- broker.mjs:
+  - `#readable(s, t)` holds rules 1-4 of design 5.4. `#shared` reads the latest row per thread and
+    target. `#covered` reads the access document once per call and covers nothing on a read
+    failure, as `#userGrants` does.
+  - `#threadRead` admits the owner (with `#grantedThread`) or `#readable`, and serves only
+    `thread.messages`. `#thread` keeps the owner check for every write verb.
+  - `thread.share`, `thread.unshare`, `thread.shares` (design 5.3). `thread.list {shared:true}`
+    adds `owner`; the plain list keeps its shape (5.5).
+  - `replies` leaves out user thread messages except those in threads `#readable` admits.
+    `trail` needed no change: it already filters through `#hiddenMessage`, which calls `#readable`.
+  - USER_VERBS gains the three share verbs. `thread.shares` joins `#processingGate`'s read list.
+- packages/bus/README.md: the verb rows, a "Thread shares" section, and the schema line (v3m, the
+  new sha, 23 tables, 90 triggers). schema.test counts 89 triggers because it drops one first.
+
+## Choices and departures (for Sage and Duckworth)
+
+1. Label 3l→3m, not 3i-3j (design) or 3l (brief title). 264a took 3k-3l, and labels go by
+   landing order (sage-2789).
+2. A share covers every session of the thread, and `session.list` stays owner-only (sage-2818
+   Q1, from Sage's Q7 ruling, agents/sage/work/queue-264/RULINGS.md:72-77). broker.mjs keeps its
+   "no shares (Q7)" refusal: a sharee reads any session it can name but can't list them. A test
+   holds the refusal (human `thread-not-owned`, reader `read-only`, user `access-refused`).
+   **Follow-up**, bound to whichever of row 193 or the share wiring lands second: wire the sharee's
+   `session.list`. The bar is T1 sessions line 7 and REQ-USER-4 (candidate PRD 1509c7cc5,
+   docs/prd/mosaic-stack.md:1027-1052): read-only, and it needs current grants, the thread
+   owner's included.
+3. A reader session matches shares as the business human (sage-2818 Q2: accepted, for the human
+   principal only). Design 4.3 says reader sessions "stay owner-only", and 5.5 says "messages in
+   other users' unshared threads hidden" for human, reader and tester. The reader sees what the
+   owner sees, shares to the owner included. Q2 also found a gap in the first tip (16b9c6df6): an
+   agent session has no owner, but it matched a `*` share, so a shared user message showed in an
+   agent's trail. `#readable` now returns false unless the session is the business human, a
+   reader or a user. A test binds an assistant run to the shared thread and a chief run with no
+   thread, and checks that neither (nor the tester) sees the message after a `*` share and a share
+   to the owner.
+4. Access is read per request (sage-2818 Q3). Design 5.6's "30 s timer" and `access.reload` have
+   no path at this base: runtime.mjs:263 passes `access: () => loadAccess(file, context)`, read on
+   every request. The tests cover the per-request read (removed, expired, out of scope and
+   unreadable), which is the stricter case.
+5. Rule 3 asks the owner's grant for any level, like rule 2 (design: "still has a live grant
+   covering t"). A user owner lowered to viewer keeps the thread readable to its sharees.
+6. An unshare checks no coverage, so an owner can end a share whose target lost its grant.
+7. `thread.shares` for a user goes through `#grantedThread` at the collaborator level, like share
+   and unshare, so a viewer is refused it. Design 4.3 lists shares as "refused" for viewers.
+
+## Tests
+
+New: tests/thread-shares.test.mjs, 16 tests: the read flow and the write refusals, `*`, rule 2,
+rule 3 (with trail for human and reader), latest-row state, share-not-covered, target checks,
+lost owner coverage, tester and reader refusals (18 `action.refused` events, no rows), trail and
+replies, sessions, the sharee's `session.list` refusal (Q1), agents and the tester matching no
+share (Q2), the viewer column (C1: a viewer reads a share, its share verbs refuse,
+and a viewer target binds and reads), the 3l→3m migration and the 3l engine's refusal of a 3m store.
+
+Pins moved 3l→3m: account-, chief-of-staff, comment-, gitea-, grant-, name-, spec-, usage- and
+thread-migration, sessions, schema (23 tables, 89 triggers) and user-principal (USER_VERBS).
+The engine copies in account-, gitea-, grant- and comment-migration gain 3l-3m.sql;
+comment-migration's future step becomes 3m→3n. `later3l` in account-, gitea- and grant-migration
+also leaves out `thread_shares` objects, and the gitea and grant `rows()` lists leave out the
+table, since each compares a store migrated through 3m against an older one.
+
+## Mutants (design section 8 numbers)
+
+Each runs on a copy of the candidate tree with one edit, under `timeout -k 10 300`. The named
+test must fail on an assertion; a thrown error or a refusal before the assertion doesn't count.
+
+- M2. In `#readable`, delete the rule 2 line (`if (s.user && !this.#covered(s.user, ...)) return
+  false;`). Killed by "mutant 2: a share never widens a grant" (bob reads after his grant moves to
+  p2) and by the `*` test (carol reads).
+- M3. In `#readable`, delete the rule 3 line. Killed by "mutant 3" (the human reads A after
+  alice's grant is removed).
+- M4. In `#shared`, replace the latest-row lookup with any share row:
+  `SELECT op FROM thread_shares WHERE thread=? AND target=? AND op='share' LIMIT 1`. Killed by
+  "mutant 4" (bob still reads after the unshare).
+- M7. In `thread.send`, replace `this.#thread(s, a.thread)` with `this.#threadRead(s, a.thread)`.
+  Killed by the first test (bob's send to A must refuse `thread-not-owned`).
+- M8. In `thread.share`, delete the `share-not-covered` line. Killed by "mutant 8" (the share
+  to user:carol must refuse).
+- M9. In `thread.share`/`thread.unshare`, replace `this.#thread(s, a.thread)` with
+  `this.#threadRow(s, a.thread)`. Killed by the first test (bob's share of A to `*` must refuse).
+- Q2 probe (not a design mutant). In `#readable`, delete the human-principal line
+  (`if (!s.human && !s.reader && !s.user) return false;`). Killed by "only a human principal
+  matches a share" (the agent's trail shows the message after the `*` share).
+
+## Run limits
+
+From 264's table (agents/gizmoduck/work/queue-264/BUILD.md, Run limits), each at least 3x the
+longest recorded run. A timeout with no failed test goes to Sage first; a timeout in the shell
+phase goes to Mos unplaced (mos-1275).
+
+| Run | LIMIT |
+|---|---|
+| stack-release.test alone | 1800 s |
+| each other touched file alone | 300 s |
+| bus suite | 900 s |
+| cli suite | 1800 s |
+| each scripts/test-*.sh | 900 s |
+| each mutant probe | 300 s |
+
+## Review
+
+- Manifest aca16404c..631a256ba: APPROVE, no blockers (Duckworth, duckworth-0169, 16:57Z,
+  note agents/duckworth/work/row206/REVIEW-manifest-631a256ba.md on duckworth/reviews 84458606d).
+  Static only. Departures 1-7 accepted. Departure 1: whichever of 206 and row 271 lands second
+  relabels its step. Departure 4: the 30 s timer and `access.reload` case binds the row that adds
+  `access.reload` (193c).
+- Conditions for the 275 rebase round:
+  - C1, design 4.3's viewer column: share, unshare and shares each refuse a viewer; a viewer
+    reads a thread shared with it; `#threadRead`'s owner path passes `thread.messages` to 275's
+    verb-aware `#grantedThread`.
+  - C2: rerun the drift and pin sweeps on the rebased base (253 and 275 touch broker.mjs; 275
+    also touches the user-principal USER_VERBS pin).
+- Notes, no change asked: N1 `#readableThreads` binds a reader's owner as NULL (harmless); N2
+  replies reads the access file once per shared thread; N3 a share to a user absent from `users`
+  is stopped only by coverage; N4 the gate evidence goes in "Runs" below before in-review.
+
+## Runs
+
+None yet. Node and https git wait for Sage's CLEAR (Gander holds the slot for row 253 run 5).

agents/morgana/work/queue-275/BUILD.md

@@ -0,0 +1,90 @@
+# Row 275 (193b1b, #1780): viewer verbs and board refusals
+
+Morgana, 2026-10-22, for Duckworth (reviewer) and Sage (gate owner). Brief: docs/plans/2026-10-20_human-users-build.md,
+"Brief: 193b1b, viewer verbs and board refusals" (blob de3a6310b). Design: row 193 DESIGN.md r5 e2d161e2e
+(morgana/row193), sections 4.3, 8 and 9. Base: refactor aca16404c, branch morgana/row275. Assignment: sage-2788.
+
+## What the code did before
+
+- `#userGrants` (broker.mjs, FED R3) kept only grants that cover at level `collaborator` (`USER_LEVEL`).
+  A viewer-only user was refused `access-revoked` at `bindUser` and on every request.
+- `#granted` and `#grantedThread` asked `collaborator` for every user verb, reads included.
+- The reader session's board list was an inline array at the request gate.
+
+## The change
+
+1. `VIEWER_VERBS = ['project.list', 'thread.list', 'thread.messages', 'names']`, exported. `userLevel(verb)`
+   gives `viewer` for these and `collaborator` for the other user verbs (thread.create, thread.open,
+   thread.send). `USER_LEVEL` is gone.
+2. `#userGrants` keeps a live grant at any level (`covers(..., {level: 'viewer'})`), so a viewer binds and
+   passes the request gate. The verb check against `USER_VERBS` is unchanged and still comes first.
+3. `#granted(s, verb, project, instance)` and `#grantedThread(s, verb, t)` take the verb and ask
+   `userLevel(verb)`. Each handler passes its own verb name. A viewer gets `access-refused` on create,
+   open and send, the code design 4.3 names.
+4. `BOARD_VERBS` exports the reader list unchanged (inbox, agents, thread.claims, tasks, trail, decisions,
+   credentials, replies, messages, state, usage), and the reader gate uses it. None is in `USER_VERBS`, so
+   every user is refused them `access-refused`. The test reads the same constant and pins it written out.
+
+Downgrade path (design 4.3 note 2): a collaborator lowered to viewer still lists and reads its own threads
+and can't open or send. The runtime's user transport calls `bindUser`, so a viewer can now bind over the
+socket too. That is the intended effect; the verbs it reaches are the four above.
+
+Not in this row: the share verbs, `thread.list {shared: true}` and `#readable`'s share rules (193b2, row 206);
+the revocation timer, `access.reload` and the level-loss test (FED R4, which mutant 5 moved to). FED R4 has
+not landed; this row checks the level per request only, which is what R3 already reads per request.
+
+## Existing test changes (mos-1311 ruling)
+
+Mos approved both changes in mos-1311 (16:44:56Z), under mos-1272. They follow row 193 DESIGN r5
+(e2d161e2e, approved by Duckworth) section 4.3: the thread.list row at DESIGN.md:125 ("own threads still
+covered (from an earlier collaborator grant)") and note 2 at :139 ("A viewer can still read its own
+threads when a collaborator grant is lowered to viewer, but can't send or open them"). Condition 3: Duckworth
+confirms in review that both match section 4.3.
+
+All in `packages/bus/tests/user-principal.test.mjs` (FED R3, row 274):
+
+| Test | Assertion | Old expectation | New expectation | Design line |
+|---|---|---|---|---|
+| "R3: bindUser binds a granted user and refuses one with no live grant" (title was "...no live collaborator grant") | `bindUser` with `grant({ level: 'viewer' })` | refused `access-revoked` (case `'viewer level'` in the refused list) | binds: `assert.ok(user('alice'), 'viewer level')`; the case leaves the refused list | :125 viewer column; 4.3 viewer verbs need a bound viewer |
+| "R3: a removed or expired grant refuses the next request access-revoked..." | `thread.list` after `level: 'viewer'` ('downgraded') | `access-revoked` | `null` (answers) | :125 and :139 |
+| same test, added (mos-1311 condition 1) | `thread.send` and `thread.open` on A after the downgrade | (not asserted) | each `access-refused`; `messages` and `thread_opens` counts unchanged | :139 "can't send or open them" |
+
+The header comment of the file is updated to say a viewer grant binds. Every other R3 refusal (no grant,
+another user, another business, expired, unreadable file, no file, removed, file refused) is unchanged.
+No other test names a viewer grant on the bus (git grep for `level: 'viewer'` outside packages/business).
+
+## Tests, packages/bus/tests/viewer.test.mjs (new)
+
+1. VIEWER_VERBS is the ruled list and sits inside USER_VERBS.
+2. A viewer binds; project.list, names, thread.list and thread.messages answer what its grant covers
+   (alice downgraded, bob viewer from the start).
+3. A viewer is refused thread.create, thread.open and thread.send `access-refused`, and messages, threads
+   and thread_opens counts are unchanged. Kills mutant 6 at alice's send. r3 (duckworth-0166 B1): bob is
+   asked create only, as `#thread` refuses a non-owner `thread-not-owned` before the level check; open and
+   send are asked on alice's own thread. Bob stays the viewer who never held a collaborator grant.
+4. Every verb off USER_VERBS refuses a viewer `access-refused` before its own checks.
+5. Mixed grants: collaborator on project a, viewer on b. Create in a works, create in b refuses; send in b's
+   old thread refuses, open refuses, messages reads the message sent while collaborator (r3, N1).
+6. Board reads (BOARD_VERBS, the project file verbs, limits, plugins, instances, routes) refuse alice
+   (downgraded viewer), bob (viewer) and carol (collaborator) `access-refused`. Kills mutant 10.
+7. Governance pin, user side: one row per item of the 5.7 sentence (decisions, inbox entries, claims as
+   `agents` and `thread.claims`, tasks as `tasks` and `state`, project files as `project.files` and
+   `project.file`), each refused to a collaborator and a viewer while a run in carol's thread has raised a
+   decision the owner sees; carol still reads her own message with thread.messages. The owner side stays
+   in message-filter.test.mjs (row 205).
+
+## Mutants (design 8)
+
+| # | Mutation | Killed by |
+|---|---|---|
+| 6 | `'thread.send'` added to `VIEWER_VERBS` | viewer.test 3 (send answers); test 1 pin fails too |
+| 10 | `'trail'` added to `USER_VERBS` | viewer.test 6 (trail no longer access-refused); R3's exact USER_VERBS pin fails too |
+
+The kill rule for each mutant names the behaviour test above, not the pin.
+
+## Gate (brief)
+
+Duckworth approves the manifest. On Sage's gate: the touched test files whole (viewer, user-principal,
+message-filter), the bus suite and every `scripts/test-*.sh` green, mutants 6 and 10 killed. broker.mjs
+is imported by the cli, harness, business and seat suites as well; I'll propose them for the gate as in
+row 277 (sage-2590). Nothing has run yet: built during Gander's 253 slot with no node.

packages/bus/README.md

@@ -240,10 +240,12 @@ a receipt with empty `changes`. A refusal is `action.refused` with its code alon
 | `project.create` | `{name,repo?}`; human sessions only (row 121, #1615). `repo` must name one of the business's `projects` (`unknown-repo`); a second project with the same name refuses `project-exists`. Returns `{id}`. |
 | `project.list` | No args; human sessions only. The business's projects, oldest first. |
 | `thread.create` | `{project,name}`; human sessions only. The thread belongs to the caller and to the business's one thread instance (Projects and threads, below). Returns `{id,instance}`. Refuses `project-not-found`, `thread-exists`, `thread-instance-missing` or `thread-instance-ambiguous`. |
-| `thread.list` | `{project?}`; human sessions only. The caller's own threads, oldest first. |
+| `thread.list` | `{project?,shared?}`; human sessions only. The caller's own threads, oldest first. With `shared: true` (row 206), the threads others own that the caller may read (Thread shares, below), each row adding `owner`. |
 | `thread.open` | `{thread,session?}`; human sessions only. Records a `thread_opens` row, which asks the launcher to start the thread's session. Returns `{opened}`. |
 | `thread.send` | `{thread,session?,body,class?}`; human sessions only. A message to the thread's instance, in that thread, with its `human.input` event as `request`. Returns `{id,request}`. |
-| `thread.messages` | `{thread,session?,after?,limit?}`; human sessions only. The session's messages oldest first, after the message `after` names (`message-not-found` when it isn't in the session), at most `limit` (default 50, 1 to 200). Writes nothing. |
+| `thread.messages` | `{thread,session?,after?,limit?}`; human sessions only. The session's messages oldest first, after the message `after` names (`message-not-found` when it isn't in the session), at most `limit` (default 50, 1 to 200). A thread shared with the caller reads too, any session of it (row 206). Writes nothing. |
+| `thread.share`, `thread.unshare` | `{thread,to}`; the thread's owner only (row 206, #1704). `to` is `user:<id>`, the business human's name or `*`; yourself refuses `invalid-request`. A share refuses `share-exists` when one is in force, and `share-not-covered` when a `user:` target has no live grant covering the thread. An unshare refuses `share-not-found` when none is. Each writes one `thread_shares` row. Returns `{thread,to,op}`. |
+| `thread.shares` | `{thread}`; the thread's owner only. The shares in force, `[{to,at,by}]`, oldest first. Writes nothing. |
 | `session.list` | `{thread}`; human and tester sessions (row 264a, #1769). The thread's sessions oldest first, `[{id,at,name,predecessor,default}]`. Writes nothing. |
 | `session.create` | `{thread,name,op}`; human and tester sessions. A new session of the thread, metadata only. A retry with the same `op` and name returns the first row; another name under that `op` refuses `session-op-conflict`, and a taken name `session-exists`. Returns `{id,thread,name}`. |
 
@@ -283,7 +285,32 @@ any run but the thread's current holder.
 
 A user reaches only their own threads (REQ-USER-2): `thread.open`, `thread.send` and
 `thread.messages` refuse `thread-not-found` for an unknown id and `thread-not-owned` for
-another user's thread.
+another user's thread, unless it is shared with them (Thread shares, below).
+
+### Thread shares (row 206, #1704)
+
+Schema `3m` adds `thread_shares`, append-only: one row per `share` or `unshare`, and the latest
+row per thread and target is the share's state. A thread's owner shares it read-only with a
+user (`user:<id>`), the business human or everyone (`*`). The 3l→3m step only adds the table,
+so every existing thread stays private to its owner.
+
+A session may read a thread it doesn't own only when all four hold (row 193 design 5.4):
+
+1. a share is in force to the caller's owner string or to `*`;
+2. a user caller has a live grant, of any level, covering the thread's project and instance;
+3. a thread owned by a user is still covered by that user's grant;
+4. neither the caller nor the owner is the tester.
+
+Only a human principal matches a share: the business human, a reader session as that human, or
+a user. An agent session matches none, `*` included, even when it is bound to the thread.
+A reader session reads as the business human. A sharee can't call `session.list` on the
+thread; it stays owner-only until row 193's share wiring. The check runs on every request against the
+access document the broker reads then, so a removed, expired or unreadable grant or an
+unshare ends reads on the next request. Only `thread.messages` admits a sharee; `thread.open`,
+`thread.send` and the share verbs refuse it `thread-not-owned`. `trail` and `replies` show a
+user's thread messages to the owner and readers while the check holds. The tester can't call
+the share verbs (`tester-refused`), and a viewer is refused them `access-refused`; a viewer
+reads a thread shared with it. Tests: `tests/thread-shares.test.mjs`.
 
 `threadsState(business)` is a trusted launcher API, like `bindLaunch`, not a socket verb.
 Per thread it returns `{thread,instance,pending,unread,lastMessage,lastOpen,lastClaim,holder}`:
@@ -766,10 +793,10 @@ scope probes and rotation/expiry notifications; S2 never probes real services.
 
 ## Schema and verification
 
-`schema.sql` is v3l, SHA-256
-`cd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a`.
-It has 22 tables, 87 triggers and five views. Source digest and a trusted full
-sqlite_master digest are checked at open, alongside schema version `3l`, WAL,
+`schema.sql` is v3m, SHA-256
+`d5ca9bb9268994b175ac79d38939be4bb7f2e80bc0d9ea273eedaae50c29b8a9`.
+It has 23 tables, 90 triggers and five views. Source digest and a trusted full
+sqlite_master digest are checked at open, alongside schema version `3m`, WAL,
 quick_check and foreign-key integrity. Missing metadata refuses; it never
 reinitializes an existing file. Full synchronous WAL transactions either commit
 or roll back. SQL UPDATE, DELETE and INSERT OR REPLACE refuse on evidence tables.

packages/bus/schema.sql

@@ -478,3 +478,18 @@ CREATE TABLE gitea_grants (
   PRIMARY KEY (business, agent),
   FOREIGN KEY (business, agent) REFERENCES gitea_users(business, agent)
 ) STRICT;
+-- Row 206 (193b2, #1704, row 193 design 5.2): a thread owner's read-only shares. The latest row per
+-- (thread, target) is the share's state. Append-only.
+CREATE TABLE thread_shares (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  op TEXT NOT NULL CHECK (op IN ('share','unshare')),
+  target TEXT NOT NULL,
+  by TEXT NOT NULL
+) STRICT;
+CREATE INDEX thread_shares_thread ON thread_shares (thread, target, seq);
+CREATE TRIGGER thread_shares_no_update BEFORE UPDATE ON thread_shares BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
+CREATE TRIGGER thread_shares_no_delete BEFORE DELETE ON thread_shares BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
+CREATE TRIGGER thread_shares_no_replace BEFORE INSERT ON thread_shares WHEN EXISTS (SELECT 1 FROM thread_shares WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;

packages/bus/src/broker.mjs

@@ -131,9 +131,19 @@ export const TESTER_VERBS = Object.freeze(['message.send', 'message.receive', 'm
 // FED R3 (#414, federation design 3.5): the collaborator level is this exact list. Every other verb
 // refuses a user access-refused before its own checks: owner verbs, board reads, message.*,
 // decision.*, project files, spec.read, assistant.stop, launch.*, name.set and usage.*.
-export const USER_VERBS = Object.freeze(['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names']);
-// The level a user's grant must reach for USER_VERBS (R1's covers, morgana-0005).
-const USER_LEVEL = 'collaborator';
+// Row 206 (193b2, row 193 design 4.3): and the share verbs on a user's own threads, which need a
+// collaborator grant, so a viewer gets access-refused on each.
+export const USER_VERBS = Object.freeze(['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names',
+  'thread.share', 'thread.unshare', 'thread.shares']);
+// Row 275 (193b1b, #1780, row 193 design 4.3 and 9): the user verbs a viewer grant reaches. They
+// read, so a live grant at any level covers them. thread.create, thread.open and thread.send need a
+// collaborator grant on the project and instance, so a viewer gets access-refused on each.
+export const VIEWER_VERBS = Object.freeze(['project.list', 'thread.list', 'thread.messages', 'names']);
+// The least level a user verb needs (R1's covers, morgana-0005; LEVELS runs from most to least).
+const userLevel = (verb) => (VIEWER_VERBS.includes(verb) ? 'viewer' : 'collaborator');
+// Row 275 (row 193 design 4.3): the owner's board reads, which a reader session may call. A user,
+// collaborator or viewer, is refused every one at the USER_VERBS gate.
+export const BOARD_VERBS = Object.freeze(['inbox', 'agents', 'thread.claims', 'tasks', 'trail', 'decisions', 'credentials', 'replies', 'messages', 'state', 'usage']);
 // Row 175: the organization verbs a tester may call. Its writes run every check the human's do
 // and log actor `tester`; row 176 adds routes reads; limits.set, organization.set and organization.revision refuse it.
 export const TESTER_ORGANIZATION_VERBS = Object.freeze(['limits', 'plugins', 'instances', 'plugins.set', 'instances.set', 'routes.set', 'routes']);
@@ -466,6 +476,7 @@ export class Broker {
       'session_defaults',
       'thread_claims',
       'thread_opens',
+      'thread_shares',
     ]) {
       const at = store.get(`SELECT max(at) at FROM ${table}`).at;
       if (at) {
@@ -511,7 +522,7 @@ export class Broker {
     if (s.human || s.reader || s.tester) return;
     if (!['inbox', 'agents', 'tasks', 'trail', 'decisions', 'replies', 'messages', 'state', 'usage',
       'requirements', 'spec.read', 'project.list', 'project.files', 'project.file', 'library.file', 'library.status',
-      'thread.list', 'thread.messages', 'names', 'instances', 'routes', 'hosts.status', 'grants.status',
+      'thread.list', 'thread.messages', 'thread.shares', 'names', 'instances', 'routes', 'hosts.status', 'grants.status',
       'processing.status', 'role.release', 'usage.end'].includes(verb)) this.#processingWork();
   }
   reconcileProcessing() { this.#processingMirror(this.#processingState()); }
@@ -753,18 +764,29 @@ export class Broker {
     return thread;
   }
   #thread(s, id) {
-    const t = this.#store.get('SELECT * FROM threads WHERE id=? AND business=?', identifier(id), s.business);
-    if (!t) fail('thread-not-found');
+    const t = this.#threadRow(s, id);
     // REQ-USER-2: a user reaches only their own threads.
     if (t.owner !== this.#owner(s)) fail('thread-not-owned');
     return t;
   }
+  #threadRow(s, id) {
+    return this.#store.get('SELECT * FROM threads WHERE id=? AND business=?', identifier(id), s.business) ?? fail('thread-not-found');
+  }
+  // Row 206 (193b2, design 5.4): the thread a read verb names, the caller's own or one #readable
+  // admits. Only thread.messages takes it; every write verb keeps #thread's owner check.
+  #threadRead(s, id) {
+    const t = this.#threadRow(s, id);
+    if (t.owner === this.#owner(s)) return this.#grantedThread(s, 'thread.messages', t);
+    if (!this.#readable(s, t)) fail('thread-not-owned');
+    return t;
+  }
   // Row 177 (#1675): who owns the threads a session makes. A tester's are `tester`'s, never the human's.
   #owner(s) {
     return s.tester ? 'tester' : s.user ? 'user:' + s.user : s.human;
   }
   // FED R3 (design 3.5): the user's live grants in the session's business, from one read of the
-  // access file. Any failure to read leaves none.
+  // access file. Any failure to read leaves none. Row 275: a grant at any level counts here; each
+  // verb's own check asks the level it needs (#granted).
   #userGrants(s) {
     let doc = null;
     try {
@@ -774,21 +796,22 @@ export class Broker {
     }
     const now = new Date();
     return (doc?.grants ?? []).filter((g) => g.user === s.user && g.business === s.business &&
-      covers(g, { business: s.business, project: g.projects[0], instance: g.instances[0] }, now, { level: USER_LEVEL }));
+      covers(g, { business: s.business, project: g.projects[0], instance: g.instances[0] }, now, { level: 'viewer' }));
   }
-  // Does one of the request's grants cover a thread of `instance` in `project`? A null `instance`
-  // asks about the project alone, a null `project` about the instance alone.
-  #granted(s, project, instance) {
+  // Does one of the request's grants cover a thread of `instance` in `project`, at the level `verb`
+  // needs? A null `instance` asks about the project alone, a null `project` about the instance alone.
+  #granted(s, verb, project, instance) {
     const now = new Date();
     return s.grants.some((g) => covers(g, {
       business: s.business,
       project: project ?? g.projects[0],
       instance: instance ?? g.instances[0],
-    }, now, { level: USER_LEVEL }));
+    }, now, { level: userLevel(verb) }));
   }
-  // A thread the request's grants still cover, else access-refused (design 3.5, thread.open/send/messages).
-  #grantedThread(s, t) {
-    if (s.user && !this.#granted(s, t.project, t.instance)) fail('access-refused');
+  // A thread the request's grants still cover at the level `verb` needs, else access-refused
+  // (design 3.5, thread.open/send/messages; row 193 design 4.3 for the level).
+  #grantedThread(s, verb, t) {
+    if (s.user && !this.#granted(s, verb, t.project, t.instance)) fail('access-refused');
     return t;
   }
   // Row 205 (193b1a, #1703, row 193 design 5.7): a message in a thread a user other than the caller
@@ -802,10 +825,62 @@ export class Broker {
     );
     return Boolean(t) && t.owner.startsWith('user:') && t.owner !== this.#owner(s) && !this.#readable(s, t);
   }
-  // Row 193 design 5.4. Rule 1 needs a share in force, and there is no thread_shares table before
-  // 193b2 (schema 3j), so nobody reads another's thread yet. 193b2 adds the share rule and rules 2-4.
+  // Row 206 (193b2, design 5.4): may a session read thread `t` it doesn't own? Rule 4 first: a
+  // tester's thread is never shared, and a tester is never a share's target and holds no grant. A
+  // reader session is the owner's board view, so it reads what is shared with the owner. Only a
+  // human principal (the business human, a reader as that human, a user) matches a share: an agent
+  // session, even one bound to the thread, matches none, `*` included (sage-2818 Q2).
   #readable(s, t) {
-    return false;
+    if (s.tester || t.owner === 'tester') return false;
+    if (!s.human && !s.reader && !s.user) return false;
+    const me = s.reader ? this.#business(s.business).human : this.#owner(s);
+    // Rule 1: a share in force to the caller or to everyone.
+    if (!this.#shared(t.id, me) && !this.#shared(t.id, '*')) return false;
+    // Rule 2: a share never widens a grant. The owner needs none.
+    if (s.user && !this.#covered(s.user, s.business, t)) return false;
+    // Rule 3: a thread whose user owner has lost coverage is hidden from its sharees too.
+    if (t.owner.startsWith('user:') && !this.#covered(t.owner.slice(5), s.business, t)) return false;
+    return true;
+  }
+  // A share's state is its latest row for the thread and target (design 5.2, Duckworth N12).
+  #shared(thread, target) {
+    return this.#store.get('SELECT op FROM thread_shares WHERE thread=? AND target=? ORDER BY seq DESC LIMIT 1', thread, target)?.op === 'share';
+  }
+  // Does a live grant of any level cover thread `t` for `user`? One read of the access file, as
+  // #userGrants does; any failure to read covers nothing (design 5.6, H3).
+  #covered(user, business, t) {
+    let doc = null;
+    try {
+      doc = this.#access?.() ?? null;
+    } catch {
+      doc = null;
+    }
+    const now = new Date();
+    return (doc?.grants ?? []).some((g) => g.user === user &&
+      covers(g, { business, project: t.project, instance: t.instance }, now, { level: 'viewer' }));
+  }
+  // The threads another principal owns that the session may read, oldest first.
+  #readableThreads(s, project) {
+    const me = s.reader ? this.#business(s.business).human : this.#owner(s);
+    return this.#store.all(
+      "SELECT t.* FROM threads t WHERE t.business=? AND t.owner IS NOT ? AND (? IS NULL OR t.project=?) AND EXISTS(SELECT 1 FROM thread_shares x WHERE x.thread=t.id AND x.target IN (?,'*')) ORDER BY t.seq",
+      s.business,
+      this.#owner(s) || null,
+      project ?? null,
+      project ?? null,
+      me || null,
+    ).filter((t) => this.#readable(s, t));
+  }
+  // Row 206 (design 5.3): a share's target, an owner string: `user:<id>`, the business human's
+  // name or `*`. A share with yourself is invalid.
+  #shareTarget(s, to) {
+    const b = this.#business(s.business);
+    if (typeof to !== 'string') fail('invalid-request');
+    const user = to.startsWith('user:') ? to.slice(5) : null;
+    if (!(to === '*' || to === b.human || (user !== null && ID_PATTERN.test(user) && !['human', 'tester', 'user', b.human].includes(user))))
+      fail('invalid-request');
+    if (to === this.#owner(s)) fail('invalid-request');
+    return to;
   }
   #agent(s) {
     if (s.tester) fail('tester-refused');
@@ -1011,7 +1086,8 @@ export class Broker {
   }
   // FED R3 (#414, design 3.6): the trusted user transport invokes this only after row 196's
   // verifyPrincipal checked the user CLI and its Console parent. It binds only a user the access
-  // file gives a live collaborator grant in the business (check 3), else access-revoked. A user id
+  // file gives a live grant in the business (check 3), else access-revoked. Row 275: a viewer grant
+  // binds too; the verbs it reaches are VIEWER_VERBS. A user id
   // is never the bus's own principals' or the business human's, whatever the file says.
   bindUser(record) {
     keys(record, ['business', 'user'], ['business', 'user']);
@@ -4226,7 +4302,7 @@ export class Broker {
         return result;
       }
       return this.#store.transaction(() => {
-        if (s.reader && !['inbox', 'agents', 'thread.claims', 'tasks', 'trail', 'decisions', 'credentials', 'replies', 'messages', 'state', 'usage'].includes(request.verb))
+        if (s.reader && !BOARD_VERBS.includes(request.verb))
           fail('read-only');
         if (s.tester && !TESTER_VERBS.includes(request.verb)) fail('tester-refused');
         // A tester reads the human's views, as a reader does, and its message verbs are its own.
@@ -5679,7 +5755,7 @@ export class Broker {
         return this.#store.all(
           'SELECT instance,name,at FROM instance_names n WHERE business=? AND seq=(SELECT max(seq) FROM instance_names WHERE business=n.business AND instance=n.instance) ORDER BY instance',
           s.business,
-        ).filter((r) => !s.user || this.#granted(s, null, r.instance));
+        ).filter((r) => !s.user || this.#granted(s, 'names', null, r.instance));
       }
       // Row 121 (#1615): projects group the user's threads (REQ-ORG-2). `repo` names a
       // project from the business file; the rename to repos is a P19 follow-up.
@@ -5709,7 +5785,7 @@ export class Broker {
         // FED R3 (design 3.5): a user lists granted projects only.
         return this.#store
           .all('SELECT id,at,name,repo FROM projects WHERE business=? ORDER BY seq', s.business)
-          .filter((p) => !s.user || this.#granted(s, p.id, null));
+          .filter((p) => !s.user || this.#granted(s, 'project.list', p.id, null));
       }
       // A thread belongs to the user who made it and to the business's one thread instance.
       // Row 177 (#1675): a tester's thread is owned by `tester`, so neither reaches the other's.
@@ -5721,7 +5797,7 @@ export class Broker {
         // before the project is looked up, so an ungranted id reads the same whether it exists or not.
         if (s.user) {
           const threaded = Object.keys(b.roles).filter((r) => this.#threaded(s.business, r));
-          if (threaded.length !== 1 || !this.#granted(s, identifier(a.project), threaded[0])) fail('access-refused');
+          if (threaded.length !== 1 || !this.#granted(s, 'thread.create', identifier(a.project), threaded[0])) fail('access-refused');
         }
         if (!this.#store.get('SELECT 1 FROM projects WHERE id=? AND business=?', identifier(a.project), s.business))
           fail('project-not-found');
@@ -5749,8 +5825,13 @@ export class Broker {
       // and the tester's lists only its own (row 175 listed it the business human's).
       case 'thread.list': {
         if (!s.tester && !s.user) this.#human(s);
-        keys(a, ['project']);
+        keys(a, ['project', 'shared']);
         if (a.project !== undefined) identifier(a.project);
+        if (a.shared !== undefined && a.shared !== true) fail('invalid-request');
+        // Row 206 (193b2, design 4.3): another's threads shared with the caller, each naming its
+        // owner. The plain list keeps its shape.
+        if (a.shared)
+          return this.#readableThreads(s, a.project).map((t) => ({ id: t.id, at: t.at, project: t.project, instance: t.instance, name: t.name, owner: t.owner }));
         // FED R3 (design 3.5): a user's own threads that its grants still cover.
         return this.#store.all(
           'SELECT id,at,project,instance,name FROM threads WHERE business=? AND owner=?' +
@@ -5759,14 +5840,14 @@ export class Broker {
           s.business,
           this.#owner(s),
           ...(a.project === undefined ? [] : [a.project]),
-        ).filter((t) => !s.user || this.#granted(s, t.project, t.instance));
+        ).filter((t) => !s.user || this.#granted(s, 'thread.list', t.project, t.instance));
       }
       // Opening a thread asks the launcher to start its session (REQ-LAUNCH-1). Row 264a: a thread
       // verb names one session of the thread, or works on its default (D3).
       case 'thread.open': {
         if (!s.tester && !s.user) this.#human(s);
         keys(a, ['thread', 'session'], ['thread']);
-        const t = this.#grantedThread(s, this.#thread(s, a.thread));
+        const t = this.#grantedThread(s, 'thread.open', this.#thread(s, a.thread));
         const session = this.#threadSession(t, a.session);
         this.#store.run('INSERT INTO thread_opens(at,thread,session,by) VALUES(?,?,?,?)', this.#now(), t.id, session, this.#owner(s));
         return { opened: t.id };
@@ -5776,7 +5857,7 @@ export class Broker {
       case 'thread.send': {
         if (!s.tester && !s.user) this.#human(s);
         keys(a, ['thread', 'session', 'body', 'class'], ['thread', 'body']);
-        const t = this.#grantedThread(s, this.#thread(s, a.thread));
+        const t = this.#grantedThread(s, 'thread.send', this.#thread(s, a.thread));
         const session = this.#threadSession(t, a.session);
         // Row 120's lists hold here as on message.send: the instance must hear from the human.
         this.#checkMessaging(s.business, 'human', t.instance);
@@ -5801,11 +5882,12 @@ export class Broker {
         // A user's message, like a tester's, is never the owner's authority evidence (design 3.5).
         return { id: mid, request: s.tester || s.user ? null : this.#event(s, 'human.input', { kind: 'instruction', message: mid }, mid) };
       }
-      // The thread's history, oldest first. Reading writes nothing.
+      // The thread's history, oldest first. Reading writes nothing. Row 206 (193b2): a thread shared
+      // with the caller reads too, every session of it, since a share is the whole thread's.
       case 'thread.messages': {
         if (!s.tester && !s.user) this.#human(s);
         keys(a, ['thread', 'session', 'after', 'limit'], ['thread']);
-        const t = this.#grantedThread(s, this.#thread(s, a.thread));
+        const t = this.#threadRead(s, a.thread);
         const session = this.#threadSession(t, a.session);
         const limit = a.limit ?? THREAD_PAGE;
         if (!Number.isInteger(limit) || limit < 1 || limit > THREAD_PAGE_MAX) fail('invalid-request');
@@ -5824,6 +5906,34 @@ export class Broker {
           after,
         );
       }
+      // Row 206 (193b2, #1704, design 5.3): the owner of a thread shares it read-only, or ends a share.
+      // A user's collaborator grant must still cover the thread, and a user target needs a live grant
+      // of any level that covers it. Each writes one row; the latest row per target is the state.
+      case 'thread.share':
+      case 'thread.unshare': {
+        if (!s.user) this.#human(s);
+        keys(a, ['thread', 'to'], ['thread', 'to']);
+        const t = this.#grantedThread(s, verb, this.#thread(s, a.thread));
+        const to = this.#shareTarget(s, a.to);
+        const op = verb === 'thread.share' ? 'share' : 'unshare';
+        if (op === 'unshare' && !this.#shared(t.id, to)) fail('share-not-found');
+        if (op === 'share') {
+          if (to.startsWith('user:') && !this.#covered(to.slice(5), s.business, t)) fail('share-not-covered');
+          if (this.#shared(t.id, to)) fail('share-exists');
+        }
+        this.#store.run('INSERT INTO thread_shares(at,business,thread,op,target,by) VALUES(?,?,?,?,?,?)', this.#now(), s.business, t.id, op, to, this.#owner(s));
+        return { thread: t.id, to, op };
+      }
+      // The shares in force on the caller's own thread, oldest first.
+      case 'thread.shares': {
+        if (!s.user) this.#human(s);
+        keys(a, ['thread'], ['thread']);
+        const t = this.#grantedThread(s, 'thread.shares', this.#thread(s, a.thread));
+        return this.#store.all(
+          "SELECT target AS \"to\",at,by FROM thread_shares x WHERE thread=? AND op='share' AND seq=(SELECT max(seq) FROM thread_shares WHERE thread=x.thread AND target=x.target) ORDER BY seq",
+          t.id,
+        );
+      }
       // Row 264a (#1769, T1 item 7): a thread's sessions, oldest first, and which one is the default.
       // Each user reaches only their own threads' sessions (REQ-USER-2); there are no shares (Q7).
       case 'session.list': {
@@ -5859,14 +5969,15 @@ export class Broker {
         if (!this.#store.get('SELECT id FROM messages WHERE id=? AND business=?', a.id, s.business))
           fail('message-not-found');
         // Row 205 (design 5.7): a hidden id fails as an unknown one does. Hidden replies are left out
-        // in the query, so a page of them doesn't come back short; #readable is false until 193b2,
-        // which adds the share exception to this clause too.
+        // in the query, so a page of them doesn't come back short. Row 206 (193b2): the threads
+        // #readable admits are the share exception.
         if (this.#hiddenMessage(s, a.id)) fail('message-not-found');
         return this.#store.all(
-          `SELECT * FROM messages m WHERE business=? AND in_reply_to=? AND NOT EXISTS(SELECT 1 FROM message_threads mt JOIN threads t ON t.id=mt.thread WHERE mt.message=m.id AND substr(t.owner,1,5)='user:' AND t.owner IS NOT ?) ORDER BY seq LIMIT ${REPLIES}`,
+          `SELECT * FROM messages m WHERE business=? AND in_reply_to=? AND NOT EXISTS(SELECT 1 FROM message_threads mt JOIN threads t ON t.id=mt.thread WHERE mt.message=m.id AND substr(t.owner,1,5)='user:' AND t.owner IS NOT ? AND t.id NOT IN (SELECT value FROM json_each(?))) ORDER BY seq LIMIT ${REPLIES}`,
           s.business,
           a.id,
           this.#owner(s) || null,
+          JSON.stringify(this.#readableThreads(s).map((t) => t.id)),
         );
       }
       default:

packages/bus/src/migrations/3l-3m.sql

@@ -0,0 +1,15 @@
+-- Row 206 (193b2, #1704, row 193 design 5.2): thread shares. Only a new table, its index and its
+-- append-only triggers; no existing row changes, so every thread stays private to its owner.
+CREATE TABLE thread_shares (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  op TEXT NOT NULL CHECK (op IN ('share','unshare')),
+  target TEXT NOT NULL,
+  by TEXT NOT NULL
+) STRICT;
+CREATE INDEX thread_shares_thread ON thread_shares (thread, target, seq);
+CREATE TRIGGER thread_shares_no_update BEFORE UPDATE ON thread_shares BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
+CREATE TRIGGER thread_shares_no_delete BEFORE DELETE ON thread_shares BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
+CREATE TRIGGER thread_shares_no_replace BEFORE INSERT ON thread_shares WHEN EXISTS (SELECT 1 FROM thread_shares WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;

packages/bus/src/store.mjs

@@ -13,8 +13,8 @@ import { join, isAbsolute } from 'node:path';
 import { createHash } from 'node:crypto';
 
 const ddl = readFileSync(new URL('../schema.sql', import.meta.url), 'utf8');
-export const SCHEMA_SHA256 = 'cd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a';
-export const SCHEMA_VERSION = '3l';
+export const SCHEMA_SHA256 = 'd5ca9bb9268994b175ac79d38939be4bb7f2e80bc0d9ea273eedaae50c29b8a9';
+export const SCHEMA_VERSION = '3m';
 // Ordered, named offline steps. New schema changes append a step and keep prior DDL pinned.
 const legacyDDL = readFileSync(new URL('./migrations/3b.sql', import.meta.url), 'utf8');
 const LEGACY_SHA256 = '179ffe356d4ff19a49b5ebad39b6c6bfd7771deb8e1b7c55b5e746f039d69e65';
@@ -72,6 +72,11 @@ const migrations = [{
   from: '3k',
   to: '3l',
   sql: readFileSync(new URL('./migrations/3k-3l.sql', import.meta.url), 'utf8'),
+}, {
+  // Row 206 (193b2, #1704): thread shares. Only a new table; no existing row changes.
+  from: '3l',
+  to: '3m',
+  sql: readFileSync(new URL('./migrations/3l-3m.sql', import.meta.url), 'utf8'),
 }];
 const timedTables = [
   'events',
@@ -87,6 +92,7 @@ const timedTables = [
   'session_defaults',
   'thread_claims',
   'thread_opens',
+  'thread_shares',
   'instance_names',
   'usage_records',
 ];

packages/bus/tests/account-migration.test.mjs

@@ -17,7 +17,8 @@ const ddl3h = readFileSync(new URL('./fixtures/schema-3h.sql', import.meta.url),
 const here = (p) => new URL(p, import.meta.url);
 // Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
 const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
-const later3l = (r) => SESSIONS_3L.includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
+// Row 206 (#1704): and the 3l→3m step's thread_shares. thread-shares.test.mjs tests it.
+const later3l = (r) => [...SESSIONS_3L, 'thread_shares'].includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
 function source3h(t) {
   const root = mkdtempSync(join(tmpdir(), 'account-migrate-'));
   t.after(() => rmSync(root, { recursive: true, force: true }));
@@ -84,6 +85,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
   copyFileSync(here('../src/migrations/3i-3j.sql'), join(moduleRoot, 'src/migrations/3i-3j.sql'));
   copyFileSync(here('../src/migrations/3j-3k.sql'), join(moduleRoot, 'src/migrations/3j-3k.sql'));
   copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
+  copyFileSync(here('../src/migrations/3l-3m.sql'), join(moduleRoot, 'src/migrations/3l-3m.sql'));
   return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }
 
@@ -91,7 +93,7 @@ test('REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence
   const { root, path } = source3h(t), before = snapshot(path), was = master(path);
   assert.throws(() => new Store(root), /schema-mismatch/);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
   // Every table's rows as they were, usage_records with its seq values and sqlite_sequence with 50.
   assert.deepEqual(migrated3l(snapshot(path, before.columns).rows), before.rows);
   assert.deepEqual(before.rows.usage_records.map(r => r.seq), [1, 2, 3]);
@@ -141,7 +143,7 @@ test('REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with
   assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
   // Still a whole 3h store: the real step migrates it.
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
   assert.deepEqual(migrated3l(snapshot(path, before.columns).rows), before.rows);
 });
 
@@ -153,14 +155,14 @@ test('REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and
     schema: ddl3h,
     store: (source) => source
       .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3h).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3h';")
+      .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3h';")
       .replace(/\}, \{\n {2}\/\/ Row 126 \(#1620\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
   });
   const pinned = readFileSync(join(root, 'engine-3h/src/store.mjs'), 'utf8');
   assert.ok(pinned.includes("export const SCHEMA_VERSION = '3h';") && !pinned.includes('3h-3i'), 'the 3h engine has no 3h→3i step');
   assert.throws(() => new Store3h(root), /schema-mismatch/);
   assert.throws(() => new Store3h(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
   assert.deepEqual(master(path), was);
   assert.deepEqual(snapshot(path, after.columns).rows, after.rows);
 });

packages/bus/tests/chief-of-staff.test.mjs

@@ -614,7 +614,7 @@ async function database3c(t) {
   let source = readFileSync(here('../src/store.mjs'), 'utf8');
   const pinned = source
     .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3c).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3c';")
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3c';")
     .replace(/\}, \{\n {2}from: '3c',[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
   assert.notEqual(pinned, source);
   assert.ok(!pinned.includes('3c-3d'), 'the 3c engine has no 3c→3d step');
@@ -638,7 +638,7 @@ test('REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   t.after(() => store.close());
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
   assert.equal(store.get("SELECT body FROM events WHERE id='preserved'").body, '{"fixture":true}');
   assert.equal(store.get("SELECT holder_run FROM role_claims WHERE role='coder'").holder_run, 'coder-run');
   const b = new Broker({ store, businesses: demo(), organization: null });

packages/bus/tests/comment-migration.test.mjs

@@ -33,7 +33,7 @@ test('explicit 3b copy migration preserves evidence and opens as 3g; normal star
   const original = readFileSync(source);
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
   assert.equal(store.get("SELECT body FROM events WHERE id='preserved'").body, '{"fixture":true}');
   assert.equal(store.get('SELECT count(*) n FROM task_comment_cursors').n, 0);
   const epoch = store.get("SELECT value FROM meta WHERE key='comment_cursor_epoch'").value;
@@ -75,15 +75,15 @@ test('named migration registry chains 3b through 3g to a fixture-only future ver
   const sha = createHash('sha256').update(futureDDL).digest('hex');
   let source = readFileSync(new URL('../src/store.mjs', import.meta.url), 'utf8');
   source = source.replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${sha}';`)
-    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3m';")
-    .replace('}];\nconst timedTables', `}, { from: '3l', to: '3m', sql: ${JSON.stringify(futureSQL)} }];\nconst timedTables`);
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3n';")
+    .replace('}];\nconst timedTables', `}, { from: '3m', to: '3n', sql: ${JSON.stringify(futureSQL)} }];\nconst timedTables`);
   writeFileSync(join(moduleRoot, 'src/store.mjs'), source);
   writeFileSync(join(moduleRoot, 'schema.sql'), futureDDL);
-  for (const name of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql', '3j-3k.sql', '3k-3l.sql'])
+  for (const name of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql', '3j-3k.sql', '3k-3l.sql', '3l-3m.sql'])
     copyFileSync(new URL('../src/migrations/' + name, import.meta.url), join(moduleRoot, 'src/migrations', name));
   const { Store: FutureStore } = await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')));
   const future = new FutureStore(root, { migrateSchema: true });
-  assert.equal(future.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
+  assert.equal(future.get("SELECT value FROM meta WHERE key='schema_version'").value, '3n');
   assert.equal(future.get("SELECT name FROM sqlite_master WHERE name='future_fixture'").name, 'future_fixture');
   assert.equal(future.get("SELECT count(*) n FROM task_comment_cursors").n, 0);
   assert.equal(future.get("SELECT id FROM events").id, 'preserved');
@@ -109,7 +109,7 @@ test('offline command migrates only the supplied fixture root and reports usage
   const command = new URL('../src/migrate-schema.mjs', import.meta.url).pathname;
   const migrated = spawnSync(process.execPath, [command, root], { encoding: 'utf8' });
   assert.equal(migrated.status, 0, migrated.stderr);
-  assert.match(migrated.stdout, /bus schema 3l ready/);
+  assert.match(migrated.stdout, /bus schema 3m ready/);
   new Store(root).close();
   const usage = spawnSync(process.execPath, [command], { encoding: 'utf8' });
   assert.equal(usage.status, 2);

packages/bus/tests/fixtures/schema-3l.sql

@@ -0,0 +1,480 @@
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
+CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL) STRICT;
+CREATE TABLE events (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN (
+    'session.launched',
+    'session.ended',
+    'action.allowed',
+    'action.refused',
+    'task.created',
+    'task.assigned',
+    'task.state',
+    'task.closed',
+    'task.changed.external',
+    'task.conflict',
+    'task.missing',
+    'review.requested',
+    'review.verdict',
+    'human.input',
+    'config.refused',
+    'credential.expiring',
+    'credential.expired',
+    'credential.changed',
+    'launch.revoked',
+    'launch.restored',
+    'digest.sent')),
+  actor_role TEXT, actor_run TEXT,
+  subject TEXT,
+  corrects TEXT REFERENCES events(id),
+  body TEXT NOT NULL CHECK (json_valid(body))
+) STRICT;
+CREATE TABLE role_claims (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL, role TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
+  holder_run TEXT NOT NULL,
+  harness TEXT NOT NULL, address TEXT,
+  by TEXT NOT NULL, reason TEXT,
+  decision TEXT
+) STRICT;
+CREATE TABLE decisions (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL, project TEXT,
+  raised_by_role TEXT NOT NULL, raised_by_run TEXT NOT NULL,
+  class TEXT NOT NULL CHECK (class IN ('routine','within-role','cross-role','gated')),
+  action TEXT NOT NULL,
+  route_to TEXT NOT NULL,
+  question TEXT NOT NULL,
+  options TEXT NOT NULL CHECK (json_valid(options) AND json_array_length(options) BETWEEN 2 AND 9),
+  recommendation TEXT NOT NULL,
+  task_ref TEXT CHECK (task_ref IS NULL OR (task_ref GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(task_ref, 9) GLOB '*[^0-9/]*' AND NOT substr(task_ref, 9) GLOB '*/*/*')), requirement_ref TEXT,
+  blocking INTEGER NOT NULL CHECK (blocking IN (0,1)),
+  supersedes TEXT REFERENCES decisions(id)
+, spec_path TEXT, spec_commit TEXT) STRICT;
+CREATE TABLE decision_events (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  at TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('seen','resolved','withdrawn','expired')),
+  by TEXT NOT NULL,
+  choice TEXT, note TEXT, via TEXT
+) STRICT;
+CREATE TABLE messages (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  from_role TEXT NOT NULL, from_run TEXT NOT NULL,
+  to_role TEXT NOT NULL,
+  class TEXT NOT NULL,
+  in_reply_to TEXT REFERENCES messages(id),
+  decision TEXT REFERENCES decisions(id),
+  corrects TEXT REFERENCES messages(id),
+  body TEXT NOT NULL
+, to_name TEXT) STRICT;
+CREATE TABLE deliveries (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  message TEXT NOT NULL REFERENCES messages(id),
+  at TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('routed','delivered','failed','read')),
+  holder_run TEXT, transport TEXT, address TEXT, detail TEXT
+) STRICT;
+CREATE TABLE task_snapshots (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  task_ref TEXT NOT NULL CHECK (task_ref GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(task_ref, 9) GLOB '*[^0-9/]*' AND NOT substr(task_ref, 9) GLOB '*/*/*'),
+  updated TEXT NOT NULL,
+  etag TEXT,
+  digest TEXT NOT NULL CHECK (length(digest) = 64 AND NOT digest GLOB '*[^0-9a-f]*'),
+  fields TEXT NOT NULL CHECK (json_valid(fields)),
+  source TEXT NOT NULL CHECK (source IN ('self','poll')),
+  via TEXT CHECK (via IN ('board','cursor','task','reconcile')),
+  read_at TEXT,
+  role TEXT, run TEXT,
+  CHECK ((source = 'self') = (role IS NOT NULL AND run IS NOT NULL)),
+  CHECK ((source = 'poll') = (via IS NOT NULL AND read_at IS NOT NULL)),
+  CHECK (json_type(fields, '$.bucket') IS 'integer'
+         OR (source IS 'poll' AND via IS 'task' AND json_type(fields, '$.gone') IS 'text'))
+) STRICT;
+CREATE INDEX task_snapshots_ref ON task_snapshots (business, task_ref, seq);
+CREATE TRIGGER decisions_resolve_once BEFORE INSERT ON decision_events
+  WHEN NEW.op IN ('resolved','withdrawn','expired') AND EXISTS (
+    SELECT 1 FROM decision_events WHERE decision = NEW.decision AND op IN ('resolved','withdrawn','expired'))
+  BEGIN SELECT RAISE(ABORT, 'decision already closed'); END;
+CREATE TRIGGER decisions_resolved_choice BEFORE INSERT ON decision_events
+  WHEN NEW.op = 'resolved' AND (NEW.choice IS NULL OR NOT EXISTS (
+    SELECT 1 FROM decisions d, json_each(d.options) o WHERE d.id = NEW.decision AND json_extract(o.value,'$.key') = NEW.choice))
+  BEGIN SELECT RAISE(ABORT, 'resolution must name one of the options'); END;
+CREATE TRIGGER role_one_holder BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'claim' AND (SELECT op FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'role already held'); END;
+CREATE TRIGGER role_release_by_holder BEFORE INSERT ON role_claims
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'role is not held'); END;
+CREATE TRIGGER role_release_same_run BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER role_revoke_needs_decision BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
+  BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
+CREATE TRIGGER meta_no_update BEFORE UPDATE ON meta BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER meta_no_delete BEFORE DELETE ON meta BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER events_no_update BEFORE UPDATE ON events BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER events_no_delete BEFORE DELETE ON events BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER role_claims_no_update BEFORE UPDATE ON role_claims BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER role_claims_no_delete BEFORE DELETE ON role_claims BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER decisions_no_update BEFORE UPDATE ON decisions BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decisions_no_delete BEFORE DELETE ON decisions BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decision_events_no_update BEFORE UPDATE ON decision_events BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER decision_events_no_delete BEFORE DELETE ON decision_events BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER messages_no_update BEFORE UPDATE ON messages BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER messages_no_delete BEFORE DELETE ON messages BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER deliveries_no_update BEFORE UPDATE ON deliveries BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER deliveries_no_delete BEFORE DELETE ON deliveries BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER meta_no_replace BEFORE INSERT ON meta WHEN EXISTS (SELECT 1 FROM meta WHERE key = NEW.key) BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER events_no_replace BEFORE INSERT ON events WHEN EXISTS (SELECT 1 FROM events WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER role_claims_no_replace BEFORE INSERT ON role_claims WHEN EXISTS (SELECT 1 FROM role_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER decisions_no_replace BEFORE INSERT ON decisions WHEN EXISTS (SELECT 1 FROM decisions WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decision_events_no_replace BEFORE INSERT ON decision_events WHEN EXISTS (SELECT 1 FROM decision_events WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER messages_no_replace BEFORE INSERT ON messages WHEN EXISTS (SELECT 1 FROM messages WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER deliveries_no_replace BEFORE INSERT ON deliveries WHEN EXISTS (SELECT 1 FROM deliveries WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER task_snapshots_no_update BEFORE UPDATE ON task_snapshots BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER task_snapshots_no_delete BEFORE DELETE ON task_snapshots BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER task_snapshots_no_replace BEFORE INSERT ON task_snapshots WHEN EXISTS (SELECT 1 FROM task_snapshots WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER decisions_blocking_needs_task BEFORE INSERT ON decisions
+  WHEN NEW.blocking = 1 AND NEW.task_ref IS NULL
+  BEGIN SELECT RAISE(ABORT, 'a blocking decision cites the task it blocks'); END;
+CREATE TRIGGER events_launch_by_human BEFORE INSERT ON events
+  WHEN NEW.kind IN ('launch.revoked','launch.restored') AND (NEW.actor_role IS NOT NULL OR NEW.actor_run IS NOT NULL)
+  BEGIN SELECT RAISE(ABORT, 'only the human revokes or restores launching'); END;
+CREATE TRIGGER events_credential_body BEFORE INSERT ON events
+  WHEN NEW.kind GLOB 'credential.*' AND (
+    json_extract(NEW.body, '$.service') IS NULL OR json_extract(NEW.body, '$.service') NOT IN ('gitea','vikunja')
+    OR json_extract(NEW.body, '$.instance') IS NULL)
+  BEGIN SELECT RAISE(ABORT, 'credential events name a service and a role instance'); END;
+CREATE TRIGGER events_task_missing_body BEFORE INSERT ON events
+  WHEN NEW.kind = 'task.missing' AND (
+    json_extract(NEW.body, '$.reason') IS NULL OR json_extract(NEW.body, '$.reason') NOT IN ('moved','not-found','no-access')
+    OR (json_extract(NEW.body, '$.reason') = 'moved' AND json_type(NEW.body, '$.project') IS NOT 'integer'))
+  BEGIN SELECT RAISE(ABORT, 'task.missing carries a reason, and the new project when moved'); END;
+CREATE TRIGGER events_task_subject BEFORE INSERT ON events
+  WHEN NEW.kind GLOB 'task.*' AND (NEW.subject IS NULL OR NOT (NEW.subject GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(NEW.subject, 9) GLOB '*[^0-9/]*' AND NOT substr(NEW.subject, 9) GLOB '*/*/*'))
+  BEGIN SELECT RAISE(ABORT, 'a task event names its task in subject'); END;
+CREATE TRIGGER events_task_created_body BEFORE INSERT ON events
+  WHEN NEW.kind = 'task.created' AND (
+    json_type(NEW.body, '$.request') IS NOT 'text'
+    OR NOT EXISTS (SELECT 1 FROM events WHERE id = json_extract(NEW.body, '$.request')
+                   AND kind = 'human.input' AND business = NEW.business)
+    OR json_type(NEW.body, '$.requirement') IS NOT 'text'
+    OR NOT json_extract(NEW.body, '$.requirement') GLOB 'REQ-[A-Z]*-[1-9]*'
+    OR json_extract(NEW.body, '$.requirement') GLOB 'REQ-*[^A-Z0-9-]*')
+  BEGIN SELECT RAISE(ABORT, 'task.created cites the human.input that asked for it and a requirement id'); END;
+CREATE VIEW launch_state AS
+  SELECT business, CASE kind WHEN 'launch.revoked' THEN 'revoked' ELSE 'allowed' END AS state, at
+  FROM events e WHERE kind IN ('launch.revoked','launch.restored')
+    AND seq = (SELECT max(seq) FROM events WHERE business = e.business AND kind IN ('launch.revoked','launch.restored'));
+CREATE VIEW task_external_changes AS
+  SELECT p.business, p.task_ref, p.seq, p.via, p.updated, p.digest, ls.digest AS self_digest
+  FROM task_snapshots p
+  LEFT JOIN task_snapshots ls ON ls.seq = (SELECT max(seq) FROM task_snapshots
+                                           WHERE business = p.business AND task_ref = p.task_ref AND source = 'self')
+  WHERE p.source = 'poll'
+    AND p.seq = (SELECT max(seq) FROM task_snapshots WHERE business = p.business AND task_ref = p.task_ref)
+    AND (ls.seq IS NULL OR (p.updated >= ls.updated AND p.read_at > ls.at AND p.digest <> ls.digest));
+CREATE VIEW task_current AS
+  SELECT s.seq, s.at, s.business, s.task_ref, s.updated, s.etag, s.digest, s.fields, s.source, s.via, s.read_at, s.role, s.run
+  FROM task_snapshots s
+  WHERE s.seq = (SELECT max(c.seq) FROM task_snapshots c
+                 WHERE c.business = s.business AND c.task_ref = s.task_ref
+                   AND (c.source = 'self'
+                        OR c.read_at > coalesce((SELECT ls.at FROM task_snapshots ls
+                                                 WHERE ls.business = c.business AND ls.task_ref = c.task_ref AND ls.source = 'self'
+                                                 ORDER BY ls.seq DESC LIMIT 1), '')));
+CREATE VIEW tasks_open AS
+  SELECT s.business, s.task_ref, json_extract(s.fields, '$.bucket') AS bucket, s.seq
+  FROM task_current s
+  WHERE json_type(s.fields, '$.gone') IS NULL
+    AND json_extract(s.fields, '$.done') = 0;
+CREATE VIEW urgent_inbox AS
+  SELECT d.id, d.business, d.task_ref, d.question, d.at
+  FROM decisions d
+  WHERE d.class = 'gated' AND d.blocking = 1
+    AND NOT EXISTS (SELECT 1 FROM decision_events x WHERE x.decision = d.id AND x.op IN ('resolved','withdrawn','expired'));
+CREATE TABLE task_comment_cursors (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  business TEXT NOT NULL,
+  task_id INTEGER NOT NULL CHECK (task_id > 0),
+  last_comment INTEGER NOT NULL CHECK (last_comment > 0)
+) STRICT;
+CREATE INDEX task_comment_cursors_latest ON task_comment_cursors (business, task_id, seq);
+CREATE TRIGGER task_comment_cursors_no_update BEFORE UPDATE ON task_comment_cursors
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_no_delete BEFORE DELETE ON task_comment_cursors
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_no_replace BEFORE INSERT ON task_comment_cursors
+  WHEN EXISTS (SELECT 1 FROM task_comment_cursors WHERE seq = NEW.seq)
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_forward BEFORE INSERT ON task_comment_cursors
+  WHEN NEW.last_comment <= COALESCE((SELECT last_comment FROM task_comment_cursors
+    WHERE business = NEW.business AND task_id = NEW.task_id ORDER BY seq DESC LIMIT 1), 0)
+  BEGIN SELECT RAISE(ABORT, 'comment cursor must advance'); END;
+CREATE TABLE projects (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  name TEXT NOT NULL,
+  repo TEXT,
+  created_by TEXT NOT NULL,
+  UNIQUE (business, name)
+) STRICT;
+CREATE TABLE threads (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  project TEXT NOT NULL REFERENCES projects(id),
+  instance TEXT NOT NULL,
+  owner TEXT NOT NULL,
+  name TEXT NOT NULL,
+  UNIQUE (project, name)
+) STRICT;
+CREATE TABLE sessions (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  instance TEXT NOT NULL,
+  owner TEXT NOT NULL,
+  name TEXT NOT NULL,
+  op TEXT NOT NULL,
+  predecessor TEXT REFERENCES sessions(id),
+  UNIQUE (thread, name),
+  UNIQUE (thread, op)
+) STRICT;
+CREATE TABLE session_defaults (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  by TEXT NOT NULL
+) STRICT;
+CREATE TABLE thread_claims (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  generation INTEGER NOT NULL CHECK (generation >= 1),
+  op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
+  holder_run TEXT NOT NULL,
+  harness TEXT NOT NULL, address TEXT,
+  by TEXT NOT NULL, reason TEXT,
+  decision TEXT
+) STRICT;
+CREATE TABLE message_threads (
+  message TEXT PRIMARY KEY REFERENCES messages(id),
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id)
+) STRICT;
+CREATE TABLE thread_opens (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  by TEXT NOT NULL
+) STRICT;
+CREATE INDEX thread_claims_thread ON thread_claims (thread, seq);
+CREATE INDEX thread_claims_session ON thread_claims (session, seq);
+CREATE INDEX message_threads_thread ON message_threads (thread);
+CREATE INDEX message_threads_session ON message_threads (session);
+CREATE INDEX session_defaults_thread ON session_defaults (thread, seq);
+CREATE TRIGGER threads_project_business BEFORE INSERT ON threads
+  WHEN (SELECT business FROM projects WHERE id = NEW.project) IS NOT NEW.business
+  BEGIN SELECT RAISE(ABORT, 'a thread belongs to its project''s business'); END;
+CREATE TRIGGER sessions_thread_match BEFORE INSERT ON sessions
+  WHEN NOT EXISTS (SELECT 1 FROM threads t WHERE t.id = NEW.thread AND t.business = NEW.business AND t.instance = NEW.instance AND t.owner = NEW.owner)
+  BEGIN SELECT RAISE(ABORT, 'a session has its thread''s business, instance and owner'); END;
+CREATE TRIGGER sessions_predecessor BEFORE INSERT ON sessions
+  WHEN NEW.predecessor IS NOT NULL AND (SELECT thread FROM sessions WHERE id = NEW.predecessor) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a session''s predecessor is in its thread'); END;
+CREATE TRIGGER sessions_id_not_thread BEFORE INSERT ON sessions
+  WHEN NEW.id IS NOT NEW.thread AND EXISTS (SELECT 1 FROM threads WHERE id = NEW.id)
+  BEGIN SELECT RAISE(ABORT, 'a session id names another thread'); END;
+CREATE TRIGGER threads_id_not_session BEFORE INSERT ON threads
+  WHEN EXISTS (SELECT 1 FROM sessions WHERE id = NEW.id)
+  BEGIN SELECT RAISE(ABORT, 'a thread id names a session'); END;
+CREATE TRIGGER session_defaults_match BEFORE INSERT ON session_defaults
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a default session is in its thread'); END;
+CREATE TRIGGER thread_one_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND (SELECT op FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'session already held'); END;
+CREATE TRIGGER thread_one_per_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND EXISTS (SELECT 1 FROM thread_claims c WHERE c.holder_run = NEW.holder_run AND c.business = NEW.business
+    AND c.seq = (SELECT max(seq) FROM thread_claims WHERE session = c.session) AND c.op = 'claim')
+  BEGIN SELECT RAISE(ABORT, 'run already holds a session'); END;
+CREATE TRIGGER thread_release_by_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'session is not held'); END;
+CREATE TRIGGER thread_release_same_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER thread_claim_generation BEFORE INSERT ON thread_claims
+  WHEN NEW.generation IS NOT (CASE WHEN NEW.op = 'claim'
+    THEN 1 + (SELECT count(*) FROM thread_claims WHERE session = NEW.session AND op = 'claim')
+    ELSE (SELECT generation FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) END)
+  BEGIN SELECT RAISE(ABORT, 'a claim row names its session''s generation'); END;
+CREATE TRIGGER thread_revoke_needs_decision BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
+  BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
+CREATE TRIGGER thread_claims_business BEFORE INSERT ON thread_claims
+  WHEN (SELECT business FROM threads WHERE id = NEW.thread) IS NOT NEW.business
+  BEGIN SELECT RAISE(ABORT, 'a thread claim names the thread''s business'); END;
+CREATE TRIGGER thread_claims_session BEFORE INSERT ON thread_claims
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a claim''s session is in its thread'); END;
+CREATE TRIGGER message_threads_match BEFORE INSERT ON message_threads
+  WHEN NOT EXISTS (SELECT 1 FROM messages m JOIN threads t ON t.id = NEW.thread
+    WHERE m.id = NEW.message AND m.business = t.business AND t.instance IN (m.to_role, m.from_role))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message is to or from the thread''s instance'); END;
+CREATE TRIGGER message_threads_session BEFORE INSERT ON message_threads
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a threaded message''s session is in its thread'); END;
+CREATE TRIGGER thread_opens_session BEFORE INSERT ON thread_opens
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'an open''s session is in its thread'); END;
+CREATE TRIGGER delivery_same_session BEFORE INSERT ON deliveries
+  WHEN NEW.op IN ('routed','delivered') AND (NEW.op = 'delivered' OR NEW.holder_run IS NOT NULL)
+    AND EXISTS (SELECT 1 FROM message_threads mt JOIN messages m ON m.id = mt.message JOIN threads t ON t.id = mt.thread
+      WHERE mt.message = NEW.message AND m.to_role = t.instance
+        AND NOT EXISTS (SELECT 1 FROM thread_claims c WHERE c.seq = (SELECT max(seq) FROM thread_claims WHERE session = mt.session)
+          AND c.op = 'claim' AND c.holder_run IS NEW.holder_run))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message goes only to its session''s holder'); END;
+CREATE TRIGGER projects_no_update BEFORE UPDATE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER projects_no_delete BEFORE DELETE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER projects_no_replace BEFORE INSERT ON projects WHEN EXISTS (SELECT 1 FROM projects WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER threads_no_update BEFORE UPDATE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER threads_no_delete BEFORE DELETE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER threads_no_replace BEFORE INSERT ON threads WHEN EXISTS (SELECT 1 FROM threads WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER sessions_no_update BEFORE UPDATE ON sessions BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER sessions_no_delete BEFORE DELETE ON sessions BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER sessions_no_replace BEFORE INSERT ON sessions WHEN EXISTS (SELECT 1 FROM sessions WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER session_defaults_no_update BEFORE UPDATE ON session_defaults BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER session_defaults_no_delete BEFORE DELETE ON session_defaults BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER session_defaults_no_replace BEFORE INSERT ON session_defaults WHEN EXISTS (SELECT 1 FROM session_defaults WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER thread_claims_no_update BEFORE UPDATE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_delete BEFORE DELETE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_replace BEFORE INSERT ON thread_claims WHEN EXISTS (SELECT 1 FROM thread_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER message_threads_no_update BEFORE UPDATE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_delete BEFORE DELETE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_replace BEFORE INSERT ON message_threads WHEN EXISTS (SELECT 1 FROM message_threads WHERE message = NEW.message) BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER thread_opens_no_update BEFORE UPDATE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_delete BEFORE DELETE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_replace BEFORE INSERT ON thread_opens WHEN EXISTS (SELECT 1 FROM thread_opens WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TABLE instance_names (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  instance TEXT NOT NULL,
+  name TEXT NOT NULL,
+  by TEXT NOT NULL
+) STRICT;
+CREATE TRIGGER instance_names_unique BEFORE INSERT ON instance_names
+  WHEN EXISTS (SELECT 1 FROM instance_names n WHERE n.business = NEW.business AND n.name = NEW.name
+    AND n.instance <> NEW.instance
+    AND n.seq = (SELECT max(seq) FROM instance_names WHERE business = n.business AND instance = n.instance))
+  BEGIN SELECT RAISE(ABORT, 'an instance name is unique in its business'); END;
+CREATE TRIGGER instance_names_no_update BEFORE UPDATE ON instance_names BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+CREATE TRIGGER instance_names_no_delete BEFORE DELETE ON instance_names BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+CREATE TRIGGER instance_names_no_replace BEFORE INSERT ON instance_names WHEN EXISTS (SELECT 1 FROM instance_names WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+-- Row 124 (#1618): immutable source snapshots and turn outcomes, never transcript text.
+CREATE TABLE usage_records (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  run TEXT NOT NULL,
+  instance TEXT NOT NULL,
+  provider TEXT,
+  model TEXT,
+  account TEXT,
+  turn TEXT NOT NULL,
+  source TEXT NOT NULL,
+  phase TEXT NOT NULL CHECK (phase IN ('begin','end')),
+  status TEXT NOT NULL CHECK (status IN ('known','unknown')),
+  code TEXT,
+  cursor TEXT CHECK (cursor IS NULL OR json_valid(cursor)),
+  input INTEGER,
+  output INTEGER,
+  cache_write INTEGER,
+  cache_read INTEGER,
+  UNIQUE (business,run,turn,source,phase),
+  CHECK ((status='unknown' AND input IS NULL AND output IS NULL AND cache_write IS NULL AND cache_read IS NULL)
+    OR (status='known' AND input >= 0 AND output >= 0 AND cache_write >= 0 AND cache_read >= 0
+      AND input IS NOT NULL AND output IS NOT NULL AND cache_write IS NOT NULL AND cache_read IS NOT NULL))
+) STRICT;
+CREATE TRIGGER usage_records_no_update BEFORE UPDATE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TRIGGER usage_records_no_delete BEFORE DELETE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TRIGGER usage_records_no_replace BEFORE INSERT ON usage_records WHEN EXISTS (SELECT 1 FROM usage_records WHERE seq=NEW.seq OR (business=NEW.business AND run=NEW.run AND turn=NEW.turn AND source=NEW.source AND phase=NEW.phase)) BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TABLE hosts (
+  business TEXT NOT NULL,
+  host TEXT NOT NULL,
+  address TEXT NOT NULL,
+  port INTEGER NOT NULL CHECK (port BETWEEN 1 AND 65535),
+  user TEXT NOT NULL,
+  sudo INTEGER NOT NULL CHECK (sudo IN (0,1)),
+  host_keys TEXT NOT NULL CHECK (json_valid(host_keys) AND json_type(host_keys) = 'array' AND json_array_length(host_keys) > 0),
+  installer_fingerprint TEXT,
+  state TEXT NOT NULL CHECK (state IN ('pending-install','ready')),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  checked_at TEXT,
+  PRIMARY KEY (business, host),
+  CHECK (state = 'pending-install' OR (installer_fingerprint IS NOT NULL AND checked_at IS NOT NULL))
+) STRICT;
+CREATE TABLE host_grants (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  host TEXT NOT NULL,
+  commands TEXT NOT NULL CHECK (json_valid(commands) AND json_type(commands) = 'array' AND json_array_length(commands) > 0),
+  rotate_by TEXT NOT NULL,
+  tag TEXT NOT NULL CHECK (length(tag) = 39 AND tag GLOB 'mosaic-*' AND NOT substr(tag, 8) GLOB '*[^0-9a-f]*'),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent, host),
+  FOREIGN KEY (business, host) REFERENCES hosts(business, host)
+) STRICT;
+CREATE TRIGGER events_grant_actor BEFORE INSERT ON events
+  WHEN NEW.kind = 'action.allowed'
+    AND (json_extract(NEW.body, '$.action') GLOB 'grant.*' OR json_extract(NEW.body, '$.operation') GLOB 'grant.*')
+    AND NOT (NEW.actor_role IS NULL AND NEW.actor_run IS 'grant')
+  BEGIN SELECT RAISE(ABORT, 'only the grant writer records grant events'); END;
+CREATE TABLE gitea_users (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  user TEXT NOT NULL,
+  id INTEGER NOT NULL CHECK (id > 0),
+  nonce TEXT NOT NULL CHECK (length(nonce) = 16 AND NOT nonce GLOB '*[^0-9a-f]*'),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent)
+) STRICT;
+CREATE TABLE gitea_grants (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  user TEXT NOT NULL,
+  token_id INTEGER NOT NULL CHECK (token_id > 0),
+  token_name TEXT NOT NULL,
+  projects TEXT NOT NULL CHECK (json_valid(projects) AND json_type(projects) = 'array' AND json_array_length(projects) > 0),
+  rotate_by TEXT NOT NULL,
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent),
+  FOREIGN KEY (business, agent) REFERENCES gitea_users(business, agent)
+) STRICT;

packages/bus/tests/gitea-migration.test.mjs

@@ -34,11 +34,12 @@ function source3j(t) {
 }
 // Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
 const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
-const later3l = (r) => SESSIONS_3L.includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
+// Row 206 (#1704): and the 3l→3m step's thread_shares. thread-shares.test.mjs tests it.
+const later3l = (r) => [...SESSIONS_3L, 'thread_shares'].includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
 function rows(path) {
   const db = new DatabaseSync(path, { readOnly: true });
   try {
-    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('gitea_users','gitea_grants','sessions','session_defaults')").all()
+    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('gitea_users','gitea_grants','sessions','session_defaults','thread_shares')").all()
       .map(({ name }) => [name, db.prepare(`SELECT * FROM ${name} ORDER BY rowid`).all()
         .filter(r => name !== 'meta' || !['schema_version', 'schema_digest'].includes(r.key)).map(r => ({ ...r }))]));
   } finally { db.close(); }
@@ -74,6 +75,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
     copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
   writeFileSync(join(moduleRoot, 'src/migrations/3j-3k.sql'), step(readFileSync(here('../src/migrations/3j-3k.sql'), 'utf8')));
   copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
+  copyFileSync(here('../src/migrations/3l-3m.sql'), join(moduleRoot, 'src/migrations/3l-3m.sql'));
   return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }
 function fresh(t) {
@@ -95,7 +97,7 @@ test('3j copy migrates to 3k: every row kept, and sqlite_master gains only the t
   const { root, path } = source3j(t), before = rows(path), was = master(path);
   assert.throws(() => new Store(root), /schema-mismatch/);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
   assert.deepEqual(migrated3l(rows(path)), before);
   const now = master(path);
   assert.deepEqual(now.filter(r => !NEW.includes(r.name) && !later3l(r)), was.filter(r => !later3l(r)));
@@ -121,7 +123,7 @@ test('a 3j→3k step that fails partway leaves the store at 3j with every row an
   assert.deepEqual(master(path), was);
   assert.deepEqual(rows(path), before);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
 });
 
 test('the 3j engine refuses a migrated store, migrating or not, and leaves it as it was', async t => {
@@ -132,14 +134,14 @@ test('the 3j engine refuses a migrated store, migrating or not, and leaves it as
     schema: ddl3j,
     store: (source) => source
       .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3j).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3j';")
+      .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3j';")
       .replace(/\}, \{\n {2}\/\/ Row 236 \(#1742[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
   });
   const pinned = readFileSync(join(root, 'engine-3j/src/store.mjs'), 'utf8');
   assert.ok(pinned.includes("export const SCHEMA_VERSION = '3j';") && !pinned.includes('3j-3k'), 'the 3j engine has no 3j→3k step');
   assert.throws(() => new Store3j(root), /schema-mismatch/);
   assert.throws(() => new Store3j(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
   assert.deepEqual(master(path), was);
   assert.deepEqual(rows(path), after);
 });

packages/bus/tests/grant-migration.test.mjs

@@ -20,7 +20,8 @@ const NEW = ['hosts', 'host_grants', 'events_grant_actor', 'sqlite_autoindex_hos
 const LATER = ['gitea_users', 'gitea_grants', 'sqlite_autoindex_gitea_users_1', 'sqlite_autoindex_gitea_grants_1'];
 // Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
 const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
-const later3l = (r) => SESSIONS_3L.includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
+// Row 206 (#1704): and the 3l→3m step's thread_shares. thread-shares.test.mjs tests it.
+const later3l = (r) => [...SESSIONS_3L, 'thread_shares'].includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
 function source3i(t) {
   const root = mkdtempSync(join(tmpdir(), 'grant-migrate-'));
   t.after(() => rmSync(root, { recursive: true, force: true }));
@@ -40,7 +41,7 @@ function source3i(t) {
 function rows(path) {
   const db = new DatabaseSync(path, { readOnly: true });
   try {
-    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('hosts','host_grants','gitea_users','gitea_grants','sessions','session_defaults')").all()
+    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('hosts','host_grants','gitea_users','gitea_grants','sessions','session_defaults','thread_shares')").all()
       .map(({ name }) => [name, db.prepare(`SELECT * FROM ${name} ORDER BY rowid`).all()
         .filter(r => name !== 'meta' || !['schema_version', 'schema_digest'].includes(r.key)).map(r => ({ ...r }))]));
   } finally { db.close(); }
@@ -77,6 +78,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
   writeFileSync(join(moduleRoot, 'src/migrations/3i-3j.sql'), step(readFileSync(here('../src/migrations/3i-3j.sql'), 'utf8')));
   copyFileSync(here('../src/migrations/3j-3k.sql'), join(moduleRoot, 'src/migrations/3j-3k.sql'));
   copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
+  copyFileSync(here('../src/migrations/3l-3m.sql'), join(moduleRoot, 'src/migrations/3l-3m.sql'));
   return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }
 function fresh(t) {
@@ -100,7 +102,7 @@ test('3i copy migrates to 3j: every row kept, and sqlite_master gains only the t
   const { root, path } = source3i(t), before = rows(path), was = master(path);
   assert.throws(() => new Store(root), /schema-mismatch/);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
   assert.deepEqual(migrated3l(rows(path)), before);
   const now = master(path).filter(r => !LATER.includes(r.name));
   assert.deepEqual(now.filter(r => !NEW.includes(r.name) && !later3l(r)), was.filter(r => !later3l(r)));
@@ -125,7 +127,7 @@ test('a 3i→3j step that fails partway leaves the store at 3i with every row an
   assert.deepEqual(master(path), was);
   assert.deepEqual(rows(path), before);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
 });
 
 test('the 3i engine refuses a migrated store, migrating or not, and leaves it as it was', async t => {
@@ -136,14 +138,14 @@ test('the 3i engine refuses a migrated store, migrating or not, and leaves it as
     schema: ddl3i,
     store: (source) => source
       .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3i).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3i';")
+      .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3i';")
       .replace(/\}, \{\n {2}\/\/ Row 234 \(#1740\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
   });
   const pinned = readFileSync(join(root, 'engine-3i/src/store.mjs'), 'utf8');
   assert.ok(pinned.includes("export const SCHEMA_VERSION = '3i';") && !pinned.includes('3i-3j'), 'the 3i engine has no 3i→3j step');
   assert.throws(() => new Store3i(root), /schema-mismatch/);
   assert.throws(() => new Store3i(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
   assert.deepEqual(master(path), was);
   assert.deepEqual(rows(path), after);
 });

packages/bus/tests/name-migration.test.mjs

@@ -65,7 +65,7 @@ test('3f copy migrates to 3g preserving every old column/row, with an empty inst
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
     assert.deepEqual({ ...store.get('SELECT to_name FROM messages') }, { to_name: null });
     assert.equal(store.get('SELECT count(*) AS n FROM instance_names').n, 0);
     assert.deepEqual({ ...store.get('SELECT spec_path,spec_commit FROM decisions') }, { spec_path: 'docs/spec.md', spec_commit: 'c'.repeat(40) });

packages/bus/tests/schema.test.mjs

@@ -522,7 +522,8 @@ test('v3b prototype refusals, views and append-only mutations', (t) => {
   // Row 234 (#1740) adds hosts, host_grants and the events_grant_actor guard; grant-migration.test.mjs tests them.
   // Row 236 (#1742) adds gitea_users and gitea_grants; gitea-migration.test.mjs tests them.
   // Row 264a (#1769) adds sessions, session_defaults and 15 triggers; sessions.test.mjs tests them.
-  assert.equal(count('table') - 1, 22);
-  assert.equal(count('trigger'), 86);
+  // Row 206 (#1704) adds thread_shares and its 3 append-only triggers; thread-shares.test.mjs tests them.
+  assert.equal(count('table') - 1, 23);
+  assert.equal(count('trigger'), 89);
   assert.equal(count('view'), 5);
 });

packages/bus/tests/sessions.test.mjs

@@ -374,7 +374,7 @@ test('T7: a 3k store migrates to 3l, each thread\'s default session has the thre
   const { root, path } = source3k(t);
   assert.throws(() => new Store(root), /schema-mismatch/);
   new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
   // The migrated schema is the fresh one, object for object.
   const freshRoot = mkdtempSync(join(tmpdir(), 'sessions-fresh-'));
   t.after(() => rmSync(freshRoot, { recursive: true, force: true }));
@@ -430,7 +430,7 @@ async function engine3k(root) {
   const source = readFileSync(here('../src/store.mjs'), 'utf8');
   const edited = source
     .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3k).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3k';")
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3k';")
     .replace(/\}, \{\n {2}\/\/ Row 264a \(#1769\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
   assert.ok(edited.includes("export const SCHEMA_VERSION = '3k';") && edited.includes('3j-3k') && !edited.includes('3k-3l'), 'the 3k engine has no 3k→3l step');
   writeFileSync(join(moduleRoot, 'src/store.mjs'), edited);
@@ -447,7 +447,7 @@ test('T7 D9: the 3k engine refuses a 3l store, migrating or not, and leaves it a
   const Store3k = await engine3k(root);
   assert.throws(() => new Store3k(root), /schema-mismatch/);
   assert.throws(() => new Store3k(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
   assert.deepEqual(master(path), was);
   assert.deepEqual(rows(path), before);
   // The same engine opens a fresh 3k store, so the refusal is the version's and not a broken copy.

packages/bus/tests/spec-migration.test.mjs

@@ -63,7 +63,7 @@ test('3e copy migrates through 3f to 3g preserving every old column/row and addi
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
     assert.deepEqual({ ...store.get('SELECT spec_path,spec_commit FROM decisions') }, { spec_path: null, spec_commit: null });
     assert.equal(store.get('PRAGMA quick_check').quick_check, 'ok');
     assert.deepEqual(store.all('PRAGMA foreign_key_check'), []);

packages/bus/tests/thread-migration.test.mjs

@@ -49,7 +49,7 @@ async function database3d(t) {
   const source = readFileSync(here('../src/store.mjs'), 'utf8');
   const pinned = source
     .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3d).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3d';")
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3d';")
     .replace(/\}, \{\n {2}from: '3d',[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
   assert.ok(!pinned.includes('3d-3e'), 'the 3d engine has no 3d→3e step');
   writeFileSync(join(moduleRoot, 'src/store.mjs'), pinned);
@@ -101,7 +101,7 @@ test('REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and l
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   t.after(() => store.close());
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
   for (const table of ['projects', 'threads', 'thread_claims', 'message_threads', 'thread_opens'])
     assert.equal(store.get(`SELECT count(*) n FROM ${table}`).n, 0, table);
   // Parked: the undelivered ones are counted per business and role, and none is changed or given a thread.
@@ -161,5 +161,5 @@ test('REQ-THREAD-1: the offline command prints the kept-message counts before th
   const command = new URL('../src/migrate-schema.mjs', import.meta.url).pathname;
   const migrated = spawnSync(process.execPath, [command, root], { encoding: 'utf8' });
   assert.equal(migrated.status, 0, migrated.stderr);
-  assert.equal(migrated.stdout, [...REPORT, 'bus schema 3l ready', ''].join('\n'));
+  assert.equal(migrated.stdout, [...REPORT, 'bus schema 3m ready', ''].join('\n'));
 });

packages/bus/tests/thread-shares.test.mjs

@@ -0,0 +1,458 @@
+// Row 206 (193b2, #1704, row 193 design 5.2-5.6): a thread owner's read-only shares. The owner shares
+// a thread with a user, the business human or everyone; #readable lets a sharee read it while the
+// share is in force, the sharee's grant still covers it and a user owner's grant does too. Every
+// write verb keeps the owner check. Mutants 2, 3, 4, 7, 8 and 9 of design section 8 die here.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { DatabaseSync } from 'node:sqlite';
+import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { Store, schemaDigest } from '../src/store.mjs';
+import { Broker } from '../src/broker.mjs';
+
+const shipped = (name) =>
+  JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), 'utf8'));
+const here = (p) => new URL(p, import.meta.url);
+const grant = (over = {}) => ({
+  id: 'g-1', user: 'alice', business: 'demo', projects: ['*'], instances: ['assistant'], level: 'collaborator', ...over,
+});
+
+// As user-principal.test.mjs: the access document is a function each test edits between requests.
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-thread-shares-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const access = { doc: { accessVersion: 1, revision: 1, users: [], grants: [] }, fail: false };
+  const b = new Broker({
+    store,
+    businesses: {
+      demo: {
+        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
+        roles: {
+          chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+          assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
+        },
+        definitions: { 'chief-of-staff': {}, assistant: { messaging: shipped('assistant').messaging } },
+      },
+    },
+    access: () => {
+      if (access.fail) throw new Error('access file refused');
+      return access.doc;
+    },
+  });
+  const caps = {
+    human: b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }),
+    reader: b.bindReader({ business: 'demo' }),
+    tester: b.bindTester({ business: 'demo' }),
+  };
+  const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
+  const code = (who, verb, args = {}) => {
+    try {
+      call(who, verb, args);
+    } catch (e) {
+      return e.code;
+    }
+    return null;
+  };
+  const p1 = call('human', 'project.create', { name: 'shared' }).id;
+  const p2 = call('human', 'project.create', { name: 'private' }).id;
+  // alice and bob hold collaborator grants on p1, carol on p2 only.
+  const base = () => [grant({ projects: [p1] }), grant({ id: 'g-2', user: 'bob', projects: [p1] }), grant({ id: 'g-3', user: 'carol', projects: [p2] })];
+  access.doc.grants = base();
+  for (const name of ['alice', 'bob', 'carol']) caps[name] = b.bindUser({ business: 'demo', user: name });
+  const A = call('alice', 'thread.create', { project: p1, name: 'alice work' }).id;
+  const sent = call('alice', 'thread.send', { thread: A, body: 'alice: hello' }).id;
+  const H = call('human', 'thread.create', { project: p1, name: 'owner work' }).id;
+  call('human', 'thread.send', { thread: H, body: 'jason: hello' });
+  const rows = () => store.get('SELECT count(*) n FROM thread_shares').n;
+  const read = (who, thread) => call(who, 'thread.messages', { thread }).map((m) => m.body);
+  return { b, store, access, caps, call, code, p1, p2, base, A, sent, H, rows, read };
+}
+
+test('a share lets the sharee read the thread and nothing else: every write verb stays the owner\'s (mutants 7, 9)', (t) => {
+  const { call, code, A, p1, rows, read } = setup(t);
+  assert.equal(code('bob', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('bob', 'thread.list', { shared: true }), []);
+  assert.deepEqual(call('alice', 'thread.share', { thread: A, to: 'user:bob' }), { thread: A, to: 'user:bob', op: 'share' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  const [listed] = call('bob', 'thread.list', { shared: true });
+  assert.deepEqual(Object.keys(listed), ['id', 'at', 'project', 'instance', 'name', 'owner']);
+  assert.deepEqual({ ...listed, at: null }, { id: A, at: null, project: p1, instance: 'assistant', name: 'alice work', owner: 'user:alice' });
+  // The plain list keeps its shape and holds only bob's own threads.
+  assert.deepEqual(call('bob', 'thread.list'), []);
+  assert.deepEqual(Object.keys(call('alice', 'thread.list')[0]), ['id', 'at', 'project', 'instance', 'name']);
+  // Mutant 7 (#threadRead for thread.send) and mutant 9 (no owner check on thread.share) die here.
+  for (const [verb, args] of [
+    ['thread.send', { body: 'bob was here' }],
+    ['thread.open', {}],
+    ['thread.share', { to: '*' }],
+    ['thread.share', { to: 'jason' }],
+    ['thread.unshare', { to: 'user:bob' }],
+    ['thread.shares', {}],
+  ]) assert.equal(code('bob', verb, { thread: A, ...args }), 'thread-not-owned', verb);
+  assert.equal(rows(), 1);
+  assert.deepEqual(read('alice', A), ['alice: hello']);
+  // The share is bob's alone: the owner and carol still can't read.
+  assert.equal(code('human', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('human', 'thread.list', { shared: true }), []);
+  assert.equal(code('carol', 'thread.messages', { thread: A }), 'thread-not-owned');
+});
+
+test('the business human shares too, and a `*` share reaches every covered principal but the tester', (t) => {
+  const { call, code, A, H, rows, read } = setup(t);
+  assert.deepEqual(call('human', 'thread.share', { thread: H, to: 'user:alice' }), { thread: H, to: 'user:alice', op: 'share' });
+  assert.deepEqual(read('alice', H), ['jason: hello']);
+  assert.equal(code('bob', 'thread.messages', { thread: H }), 'thread-not-owned');
+  assert.deepEqual(call('alice', 'thread.share', { thread: A, to: '*' }), { thread: A, to: '*', op: 'share' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  assert.deepEqual(read('human', A), ['alice: hello']);
+  assert.deepEqual(call('human', 'thread.list', { shared: true }).map((x) => x.id), [A]);
+  // Rule 2: carol's grant doesn't cover p1, so `*` doesn't reach her. Rule 4: nor the tester.
+  assert.equal(code('carol', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('carol', 'thread.list', { shared: true }), []);
+  assert.equal(code('tester', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('tester', 'thread.list', { shared: true }), []);
+  assert.deepEqual(call('alice', 'thread.shares', { thread: A }).map((x) => [x.to, x.by]), [['*', 'user:alice']]);
+  assert.deepEqual(call('human', 'thread.shares', { thread: H }).map((x) => [x.to, x.by]), [['user:alice', 'jason']]);
+  assert.equal(rows(), 2);
+});
+
+test('mutant 2: a share never widens a grant; when the sharee\'s grant stops covering the thread, its reads end', (t) => {
+  const { access, call, code, base, A, p2, read } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'user:bob' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  // bob keeps a collaborator grant, so the user gate passes, but it now covers p2 only.
+  access.doc.grants = base().map((g) => (g.user === 'bob' ? { ...g, projects: [p2] } : g));
+  assert.equal(code('bob', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('bob', 'thread.list', { shared: true }), []);
+  // A grant on another instance is the same.
+  access.doc.grants = base().map((g) => (g.user === 'bob' ? { ...g, instances: ['chief'] } : g));
+  assert.equal(code('bob', 'thread.messages', { thread: A }), 'thread-not-owned');
+  access.doc.grants = base();
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  // Removed, expired or an unreadable file: the gate refuses bob's next request.
+  for (const [what, change] of [
+    ['removed', () => { access.doc.grants = base().filter((g) => g.user !== 'bob'); }],
+    ['expired', () => { access.doc.grants = base().map((g) => (g.user === 'bob' ? { ...g, expires: '2000-01-01T00:00:00Z' } : g)); }],
+    ['unreadable', () => { access.fail = true; }],
+  ]) {
+    change();
+    assert.equal(code('bob', 'thread.messages', { thread: A }), 'access-revoked', what);
+    access.doc.grants = base();
+    access.fail = false;
+    assert.deepEqual(read('bob', A), ['alice: hello'], what);
+  }
+});
+
+test('mutant 3: a thread whose user owner has lost coverage is hidden from its sharees, the owner\'s board included', (t) => {
+  const { access, call, code, base, A, sent, read } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'jason' });
+  assert.deepEqual(read('human', A), ['alice: hello']);
+  assert.ok(call('human', 'trail', { subject: sent }).some((r) => r.table === 'messages' && r.id === sent));
+  assert.ok(call('reader', 'trail', { subject: sent }).some((r) => r.table === 'messages' && r.id === sent));
+  for (const [what, change] of [
+    ['removed', () => { access.doc.grants = base().filter((g) => g.user !== 'alice'); }],
+    ['expired', () => { access.doc.grants = base().map((g) => (g.user === 'alice' ? { ...g, expires: '2000-01-01T00:00:00Z' } : g)); }],
+    ['out of scope', () => { access.doc.grants = base().map((g) => (g.user === 'alice' ? { ...g, projects: ['none'] } : g)); }],
+    ['unreadable', () => { access.fail = true; }],
+  ]) {
+    change();
+    assert.equal(code('human', 'thread.messages', { thread: A }), 'thread-not-owned', what);
+    assert.deepEqual(call('human', 'thread.list', { shared: true }), [], what);
+    for (const who of ['human', 'reader']) assert.deepEqual(call(who, 'trail', { subject: sent }), [], `${who} ${what}`);
+    access.doc.grants = base();
+    access.fail = false;
+    assert.deepEqual(read('human', A), ['alice: hello'], what);
+  }
+  // A viewer grant still covers: rule 3 asks for any level.
+  access.doc.grants = base().map((g) => (g.user === 'alice' ? { ...g, level: 'viewer' } : g));
+  assert.deepEqual(read('human', A), ['alice: hello']);
+});
+
+test('mutant 4: a share\'s state is its latest row, so an unshare ends it and a share after it starts it again', (t) => {
+  const { store, call, code, A, rows, read } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'user:bob' });
+  assert.equal(code('alice', 'thread.share', { thread: A, to: 'user:bob' }), 'share-exists');
+  assert.deepEqual(call('alice', 'thread.unshare', { thread: A, to: 'user:bob' }), { thread: A, to: 'user:bob', op: 'unshare' });
+  assert.equal(code('bob', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('bob', 'thread.list', { shared: true }), []);
+  assert.deepEqual(call('alice', 'thread.shares', { thread: A }), []);
+  assert.equal(code('alice', 'thread.unshare', { thread: A, to: 'user:bob' }), 'share-not-found');
+  assert.equal(code('alice', 'thread.unshare', { thread: A, to: '*' }), 'share-not-found');
+  call('alice', 'thread.share', { thread: A, to: 'user:bob' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  assert.deepEqual(call('alice', 'thread.shares', { thread: A }).map((x) => x.to), ['user:bob']);
+  assert.deepEqual(store.all('SELECT op,target,by FROM thread_shares ORDER BY seq').map((r) => ({ ...r })), [
+    { op: 'share', target: 'user:bob', by: 'user:alice' },
+    { op: 'unshare', target: 'user:bob', by: 'user:alice' },
+    { op: 'share', target: 'user:bob', by: 'user:alice' },
+  ]);
+  // An unshare of `*` leaves bob's own share in force.
+  call('alice', 'thread.share', { thread: A, to: '*' });
+  call('alice', 'thread.unshare', { thread: A, to: '*' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  assert.equal(code('human', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.equal(rows(), 5);
+});
+
+test('mutant 8: a user target needs a live grant of any level covering the thread, else share-not-covered', (t) => {
+  const { b, caps, access, call, code, base, A, p1, rows, read } = setup(t);
+  // carol's grant covers p2 only; dave has none; erin's is expired.
+  access.doc.grants = [...base(), grant({ id: 'g-4', user: 'erin', projects: [p1], expires: '2000-01-01T00:00:00Z' })];
+  for (const to of ['user:carol', 'user:dave', 'user:erin'])
+    assert.equal(code('alice', 'thread.share', { thread: A, to }), 'share-not-covered', to);
+  assert.equal(rows(), 0);
+  // A viewer grant is enough to be shared with, and the viewer reads the share (row 275).
+  access.doc.grants = [...base(), grant({ id: 'g-5', user: 'vic', projects: [p1], level: 'viewer' })];
+  assert.deepEqual(call('alice', 'thread.share', { thread: A, to: 'user:vic' }), { thread: A, to: 'user:vic', op: 'share' });
+  caps.vic = b.bindUser({ business: 'demo', user: 'vic' });
+  assert.deepEqual(read('vic', A), ['alice: hello']);
+  // An unshare checks no coverage: an uncovered target's share can still be ended.
+  access.doc.grants = base();
+  assert.deepEqual(call('alice', 'thread.unshare', { thread: A, to: 'user:vic' }), { thread: A, to: 'user:vic', op: 'unshare' });
+  assert.equal(rows(), 2);
+});
+
+test('a viewer reads a thread shared with it, and share, unshare and shares refuse a viewer access-refused (design 4.3)', (t) => {
+  const { access, call, code, base, A, rows, read } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'user:bob' });
+  // bob drops to viewer and still reads the share.
+  access.doc.grants = base().map((g) => (g.user === 'bob' ? { ...g, level: 'viewer' } : g));
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  assert.deepEqual(call('bob', 'thread.list', { shared: true }).map((x) => x.id), [A]);
+  // alice drops to viewer too: she reads her own thread, and each share verb on it refuses.
+  access.doc.grants = base().map((g) => ({ ...g, level: 'viewer' }));
+  assert.deepEqual(read('alice', A), ['alice: hello']);
+  for (const [verb, args] of [['thread.share', { to: '*' }], ['thread.unshare', { to: 'user:bob' }], ['thread.shares', {}]])
+    assert.equal(code('alice', verb, { thread: A, ...args }), 'access-refused', verb);
+  assert.equal(rows(), 1);
+  // Rule 3 asks any level, so alice's viewer grant keeps the thread readable to bob.
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+});
+
+test('a share target is `user:<id>`, the business human or `*`, and never the sharer', (t) => {
+  const { call, code, A, H, rows } = setup(t);
+  for (const to of ['user:alice', 'bob', 'tester', 'user:tester', 'user:human', 'user:user', 'user:jason', 'user:', 'user:Bad Name', '', 42, null, ['*']])
+    assert.equal(code('alice', 'thread.share', { thread: A, to }), 'invalid-request', JSON.stringify(to));
+  for (const to of ['jason', 'user:x y'])
+    assert.equal(code('human', 'thread.share', { thread: H, to }), 'invalid-request', to);
+  assert.equal(code('alice', 'thread.share', { thread: A }), 'invalid-request');
+  assert.equal(code('alice', 'thread.share', { thread: A, to: '*', extra: 1 }), 'invalid-request');
+  assert.equal(code('alice', 'thread.shares', { thread: A, to: '*' }), 'invalid-request');
+  assert.equal(code('alice', 'thread.share', { thread: randomUUID(), to: '*' }), 'thread-not-found');
+  assert.equal(code('alice', 'thread.list', { shared: false }), 'invalid-request');
+  assert.equal(code('alice', 'thread.list', { shared: 'yes' }), 'invalid-request');
+  assert.equal(rows(), 0);
+  // The owner shares its own threads only; a user's thread refuses the business human too.
+  assert.equal(code('human', 'thread.share', { thread: A, to: '*' }), 'thread-not-owned');
+  assert.equal(code('alice', 'thread.share', { thread: H, to: '*' }), 'thread-not-owned');
+  assert.equal(rows(), 0);
+  assert.deepEqual(call('human', 'thread.share', { thread: H, to: '*' }).op, 'share');
+});
+
+test('a user whose collaborator grant no longer covers its own thread can\'t share, unshare or list its shares', (t) => {
+  const { access, call, code, base, A, p2, rows } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'user:bob' });
+  access.doc.grants = base().map((g) => (g.user === 'alice' ? { ...g, projects: [p2] } : g));
+  for (const [verb, to] of [['thread.share', '*'], ['thread.unshare', 'user:bob'], ['thread.shares', undefined]])
+    assert.equal(code('alice', verb, { thread: A, ...(to ? { to } : {}) }), 'access-refused', verb);
+  assert.equal(rows(), 1);
+});
+
+test('the tester and a reader session never share: each verb refuses and writes nothing', (t) => {
+  const { store, call, code, A, H, rows } = setup(t);
+  const refusals = () => store.get("SELECT count(*) n FROM events WHERE kind='action.refused'").n;
+  const T = call('tester', 'thread.create', { project: call('human', 'project.list')[0].id, name: 'tester work' }).id;
+  const was = refusals();
+  for (const verb of ['thread.share', 'thread.unshare', 'thread.shares'])
+    for (const thread of [T, H, A]) {
+      assert.equal(code('tester', verb, { thread, to: '*' }), 'tester-refused', `${verb} ${thread}`);
+      assert.equal(code('reader', verb, { thread, to: '*' }), 'read-only', `${verb} ${thread}`);
+    }
+  // Each refusal is recorded, as every refused request is.
+  assert.equal(refusals() - was, 18);
+  assert.equal(rows(), 0);
+  // A share with `*` of the owner's thread doesn't reach the tester's reads.
+  call('human', 'thread.share', { thread: H, to: '*' });
+  assert.equal(code('tester', 'thread.messages', { thread: H }), 'thread-not-owned');
+});
+
+test('the owner\'s trail and replies show a user\'s message only while that user\'s thread is shared with the owner', (t) => {
+  const { store, call, code, A, sent } = setup(t);
+  // The run's reply to alice, as R3's `to: 'user'` path writes it.
+  const reply = randomUUID();
+  store.run(
+    'INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,in_reply_to,decision,corrects,body) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
+    reply, new Date().toISOString(), 'demo', 'assistant', 'assistant-run', 'user', 'INFO', sent, null, null, 'hello alice',
+  );
+  store.run('INSERT INTO message_threads(message,thread,session) VALUES(?,?,?)', reply, A, A);
+  for (const who of ['human', 'reader']) {
+    assert.deepEqual(call(who, 'trail', { subject: sent }), [], who);
+    assert.equal(code(who, 'replies', { id: sent }), 'message-not-found', who);
+  }
+  call('alice', 'thread.share', { thread: A, to: 'jason' });
+  for (const who of ['human', 'reader']) {
+    assert.ok(call(who, 'trail', { subject: sent }).some((r) => r.table === 'messages' && r.id === sent), who);
+    assert.deepEqual(call(who, 'replies', { id: sent }).map((m) => m.id), [reply], who);
+  }
+  // The tester never reads another's thread (rule 4).
+  assert.deepEqual(call('tester', 'trail', { subject: sent }), []);
+  assert.equal(code('tester', 'replies', { id: sent }), 'message-not-found');
+  call('alice', 'thread.unshare', { thread: A, to: 'jason' });
+  for (const who of ['human', 'reader']) {
+    assert.deepEqual(call(who, 'trail', { subject: sent }), [], who);
+    assert.equal(code(who, 'replies', { id: sent }), 'message-not-found', who);
+  }
+});
+
+test('a share covers every session of the thread', (t) => {
+  const { store, call, code, H, read } = setup(t);
+  call('human', 'session.create', { thread: H, name: 'second', op: 'op-second' });
+  const S = store.get("SELECT id FROM sessions WHERE thread=? AND name='second'", H).id;
+  call('human', 'thread.send', { thread: H, session: S, body: 'jason: second' });
+  call('human', 'thread.share', { thread: H, to: 'user:alice' });
+  assert.deepEqual(read('alice', H), ['jason: hello']);
+  assert.deepEqual(call('alice', 'thread.messages', { thread: H, session: S }).map((m) => m.body), ['jason: second']);
+  assert.equal(code('alice', 'thread.messages', { thread: H, session: randomUUID() }), 'session-not-found');
+  assert.equal(code('bob', 'thread.messages', { thread: H, session: S }), 'thread-not-owned');
+});
+
+test('a sharee can\'t list the thread\'s sessions: session.list stays owner-only (Q7, sage-2818 Q1)', (t) => {
+  const { call, code, A, H } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'jason' });
+  call('human', 'thread.share', { thread: H, to: '*' });
+  assert.equal(code('human', 'session.list', { thread: A }), 'thread-not-owned');
+  assert.equal(code('reader', 'session.list', { thread: A }), 'read-only');
+  for (const who of ['alice', 'bob']) assert.equal(code(who, 'session.list', { thread: H }), 'access-refused', who);
+  // The owners still list their own.
+  assert.equal(call('human', 'session.list', { thread: H }).length, 1);
+});
+
+test('only a human principal matches a share: an agent bound to the thread and the tester match none (sage-2818 Q2)', (t) => {
+  const { b, caps, call, code, A, H, sent } = setup(t);
+  // The assistant run serving alice's thread, and a chief run with no thread.
+  caps.agent = b.bindLaunch({ business: 'demo', role: 'assistant', run: 'assistant-run', harness: 'pi', thread: A });
+  caps.chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  for (const who of ['agent', 'chief']) call(who, 'role.claim');
+  const seen = (who) => call(who, 'trail', { subject: sent }).some((r) => r.table === 'messages' && r.id === sent);
+  for (const who of ['agent', 'chief', 'tester']) assert.equal(seen(who), false, `${who} before`);
+  call('alice', 'thread.share', { thread: A, to: '*' });
+  call('alice', 'thread.share', { thread: A, to: 'jason' });
+  // The human principals now read it; the agents and the tester see what they saw before.
+  for (const who of ['human', 'reader']) assert.equal(seen(who), true, who);
+  for (const who of ['agent', 'chief', 'tester']) assert.equal(seen(who), false, `${who} after`);
+  for (const who of ['agent', 'chief']) {
+    assert.equal(code(who, 'thread.messages', { thread: A }), 'human-required', who);
+    assert.equal(code(who, 'replies', { id: sent }), 'human-required', who);
+  }
+  assert.equal(code('tester', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.equal(code('tester', 'replies', { id: sent }), 'message-not-found');
+  call('human', 'thread.share', { thread: H, to: '*' });
+  assert.equal(code('tester', 'thread.messages', { thread: H }), 'thread-not-owned');
+});
+
+// The 3l→3m step. A 3l store from fixtures/schema-3l.sql, with one row in each thread table.
+const AT = '2026-10-22T00:00:00.000Z';
+const ddl3l = readFileSync(here('./fixtures/schema-3l.sql'), 'utf8');
+function source3l(t) {
+  const root = mkdtempSync(join(tmpdir(), 'thread-shares-migrate-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  mkdirSync(join(root, 'bus'), { mode: 0o700 });
+  const path = join(root, 'bus/bus.sqlite'), db = new DatabaseSync(path);
+  assert.equal(createHash('sha256').update(ddl3l).digest('hex'), 'cd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a');
+  db.exec(ddl3l);
+  const run = (sql, ...args) => db.prepare(sql).run(...args);
+  run('INSERT INTO meta VALUES (?,?)', 'schema_version', '3l');
+  run('INSERT INTO meta VALUES (?,?)', 'schema_digest', schemaDigest(db));
+  run('INSERT INTO meta VALUES (?,?)', 'comment_cursor_epoch', AT);
+  run('INSERT INTO projects(id,at,business,name,repo,created_by) VALUES(?,?,?,?,?,?)', 'p-1', AT, 'demo', 'stack work', 'stack', 'jason');
+  for (const [id, owner] of [['t1', 'jason'], ['t2', 'user:alice']]) {
+    run('INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)', id, AT, 'demo', 'p-1', 'assistant', owner, id);
+    run("INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) VALUES(?,?,?,?,?,?,'default','legacy-3l')", AT, 'demo', id, id, 'assistant', owner);
+    run("INSERT INTO session_defaults(at,thread,session,by) VALUES(?,?,?,'migration-3l')", AT, id, id);
+  }
+  run('INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,body) VALUES(?,?,?,?,?,?,?,?)', 'm-1', AT, 'demo', 'user', 'user:alice', 'assistant', 'INFO', 'm-1');
+  run('INSERT INTO message_threads VALUES(?,?,?)', 'm-1', 't2', 't2');
+  run('INSERT INTO thread_opens(seq,at,thread,session,by) VALUES(?,?,?,?,?)', 7, AT, 't2', 't2', 'user:alice');
+  db.close();
+  chmodSync(path, 0o600);
+  return { root, path };
+}
+const open = (path, fn) => {
+  const db = new DatabaseSync(path, { readOnly: true });
+  try { return fn(db); } finally { db.close(); }
+};
+const master = (path) => open(path, (db) => db.prepare('SELECT type,name,tbl_name,sql FROM sqlite_master ORDER BY type,name').all().map((r) => ({ ...r })));
+// Every table's rows but meta's, whose version and digest the step changes.
+const tables = (path) => open(path, (db) => Object.fromEntries(
+  db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('meta') ORDER BY name").all()
+    .map(({ name }) => [name, db.prepare(`SELECT * FROM "${name}" ORDER BY rowid`).all().map((r) => ({ ...r }))]),
+));
+const version = (path) => open(path, (db) => db.prepare("SELECT value FROM meta WHERE key='schema_version'").get().value);
+
+test('a 3l store migrates to 3m: thread_shares is new and empty, and every other row stays as it was', (t) => {
+  const { root, path } = source3l(t);
+  const before = tables(path);
+  assert.throws(() => new Store(root), /schema-mismatch/);
+  new Store(root, { migrateSchema: true }).close();
+  assert.equal(version(path), '3m');
+  const after = tables(path);
+  assert.deepEqual(after.thread_shares, []);
+  delete after.thread_shares;
+  assert.deepEqual(after, before);
+  // The migrated schema is the fresh one, object for object.
+  const freshRoot = mkdtempSync(join(tmpdir(), 'thread-shares-fresh-'));
+  t.after(() => rmSync(freshRoot, { recursive: true, force: true }));
+  new Store(freshRoot).close();
+  assert.deepEqual(master(path), master(join(freshRoot, 'bus/bus.sqlite')));
+  // No existing thread is shared: each stays private to its owner.
+  const store = new Store(root);
+  t.after(() => store.close());
+  store.run('INSERT INTO thread_shares(at,business,thread,op,target,by) VALUES(?,?,?,?,?,?)', AT, 'demo', 't2', 'share', 'jason', 'user:alice');
+  for (const [sql, args] of [
+    ["UPDATE thread_shares SET target='*'", []],
+    ['DELETE FROM thread_shares', []],
+    ['INSERT OR REPLACE INTO thread_shares(seq,at,business,thread,op,target,by) VALUES(?,?,?,?,?,?,?)', [1, AT, 'demo', 't2', 'unshare', 'jason', 'user:alice']],
+  ]) assert.throws(() => store.run(sql, ...args), /thread_shares is append-only/, sql);
+  assert.throws(() => store.run('INSERT INTO thread_shares(at,business,thread,op,target,by) VALUES(?,?,?,?,?,?)', AT, 'demo', 't2', 'grant', '*', 'user:alice'), /CHECK/);
+  assert.throws(() => store.run('INSERT INTO thread_shares(at,business,thread,op,target,by) VALUES(?,?,?,?,?,?)', AT, 'demo', 'no-such', 'share', '*', 'jason'), /FOREIGN KEY/);
+  assert.deepEqual(store.all('SELECT seq,thread,op,target FROM thread_shares').map((r) => ({ ...r })), [{ seq: 1, thread: 't2', op: 'share', target: 'jason' }]);
+});
+
+// The 3l engine is store.mjs at this change with the 3l schema and version and no 3l→3m step.
+async function engine3l(root) {
+  const moduleRoot = join(root, 'engine-3l');
+  mkdirSync(join(moduleRoot, 'src/migrations'), { recursive: true });
+  const source = readFileSync(here('../src/store.mjs'), 'utf8');
+  const edited = source
+    .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3l).digest('hex')}';`)
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3l';")
+    .replace(/\}, \{\n {2}\/\/ Row 206 \(193b2[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
+  assert.ok(edited.includes("export const SCHEMA_VERSION = '3l';") && edited.includes('3k-3l') && !edited.includes('3l-3m'), 'the 3l engine has no 3l→3m step');
+  writeFileSync(join(moduleRoot, 'src/store.mjs'), edited);
+  writeFileSync(join(moduleRoot, 'schema.sql'), ddl3l);
+  for (const file of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql', '3j-3k.sql', '3k-3l.sql'])
+    copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
+  return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
+}
+
+test('the 3l engine refuses a 3m store, migrating or not, and leaves it as it was', async (t) => {
+  const { root, path } = source3l(t);
+  new Store(root, { migrateSchema: true }).close();
+  const was = master(path), before = tables(path);
+  const Store3l = await engine3l(root);
+  assert.throws(() => new Store3l(root), /schema-mismatch/);
+  assert.throws(() => new Store3l(root, { migrateSchema: true }), /schema-mismatch/);
+  assert.equal(version(path), '3m');
+  assert.deepEqual(master(path), was);
+  assert.deepEqual(tables(path), before);
+  // The same engine opens a fresh 3l store, so the refusal is the version's and not a broken copy.
+  const { root: old } = source3l(t);
+  new Store3l(old).close();
+});

packages/bus/tests/usage-migration.test.mjs

@@ -68,7 +68,7 @@ test('REQ-LIMIT-4 3g copy migrates through 3h, 3i, 3j and 3k to 3l preserving ev
   assert.throws(() => new Store(root), /schema-mismatch/);
   const store = new Store(root, { migrateSchema: true });
   try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
     assert.deepEqual({ ...store.get('SELECT to_name FROM messages') }, { to_name: null });
     assert.equal(store.get('SELECT count(*) AS n FROM usage_records').n, 0);
     assert.equal(store.get('SELECT name FROM instance_names').name, 'Builder');

packages/bus/tests/user-principal.test.mjs

@@ -1,6 +1,7 @@
 // FED R3 (#414, federation design 3.5, 3.6 and the R3 row of section 7): the broker's user principal.
-// A user binds only with a live collaborator grant, reaches the exact collaborator verb list, sees
-// only what its grants cover, and talks to the granted instance in its own threads. The access
+// A user binds only with a live grant (row 275: a viewer grant binds too; viewer.test.mjs has the
+// viewer cases), reaches the exact collaborator verb list, sees only what its grants cover, and
+// talks to the granted instance in its own threads. The access
 // document comes in as a function, as the runtime passes R1's loadAccess; each test changes it.
 import test from 'node:test';
 import assert from 'node:assert/strict';
@@ -83,15 +84,17 @@ function granted(t, options) {
   return { ...ctx, p1, p2, A };
 }
 
-test('R3: bindUser binds a granted user and refuses one with no live collaborator grant', (t) => {
+test('R3: bindUser binds a granted user and refuses one with no live grant', (t) => {
   const { b, access, user } = setup(t);
   assert.ok(user('alice'));
+  // Row 275 (193b1b): a viewer grant binds; it used to refuse here as the case 'viewer level'.
+  access.doc.grants = [grant({ level: 'viewer' })];
+  assert.ok(user('alice'), 'viewer level');
   for (const [what, grants] of [
     ['no grant', []],
     ['another user', [grant({ user: 'bob' })]],
     ['another business', [grant({ business: 'other' })]],
     ['expired', [grant({ expires: '2000-01-01T00:00:00Z' })]],
-    ['viewer level', [grant({ level: 'viewer' })]],
   ]) {
     access.doc.grants = grants;
     assert.throws(() => b.bindUser({ business: 'demo', user: 'alice' }), { code: 'access-revoked' }, what);
@@ -139,7 +142,9 @@ test('R3: every verb off the collaborator list refuses a user access-refused bef
   ]);
   // R3 r6 (sage-2576): the collaborator list as ruled, written out, so a widened USER_VERBS fails here
   // rather than leaving the set below with the verb it added (M3x, M6x).
-  assert.deepEqual(USER_VERBS, ['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names']);
+  assert.deepEqual(USER_VERBS, ['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names',
+    // Row 206 (193b2): the share verbs, owner only (thread-shares.test.mjs).
+    'thread.share', 'thread.unshare', 'thread.shares']);
   for (const v of USER_VERBS) others.delete(v);
   assert.ok(others.size > 40);
   for (const verb of others) {
@@ -297,7 +302,7 @@ test('R3: a user thread run cannot message the owner, while its uncited gated ra
 });
 
 test('R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request', (t) => {
-  const { call, code, access } = granted(t);
+  const { call, code, access, store, A } = granted(t);
   const reads = access.reads;
   call('alice', 'thread.list');
   call('alice', 'project.list');
@@ -307,8 +312,15 @@ test('R3: a removed or expired grant refuses the next request access-revoked, an
   assert.equal(code('alice', 'thread.list'), 'access-revoked', 'removed');
   access.doc.grants = kept.map((g) => ({ ...g, expires: '2000-01-01T00:00:00Z' }));
   assert.equal(code('alice', 'project.list'), 'access-revoked', 'expired');
+  // Row 275 (193b1b, design 4.3): a grant lowered to viewer still reads the user's own threads.
   access.doc.grants = kept.map((g) => ({ ...g, level: 'viewer' }));
-  assert.equal(code('alice', 'thread.list'), 'access-revoked', 'downgraded');
+  assert.equal(code('alice', 'thread.list'), null, 'downgraded');
+  // mos-1311 condition 1: the downgraded viewer still can't send or open, and nothing is stored.
+  const stored = () => ['messages', 'thread_opens'].map((x) => store.get(`SELECT count(*) n FROM ${x}`).n);
+  const before = stored();
+  assert.equal(code('alice', 'thread.send', { thread: A, body: 'still mine?' }), 'access-refused', 'downgraded send');
+  assert.equal(code('alice', 'thread.open', { thread: A }), 'access-refused', 'downgraded open');
+  assert.deepEqual(stored(), before, 'downgraded: nothing stored');
   access.fail = true;
   access.doc.grants = kept;
   assert.equal(code('alice', 'thread.list'), 'access-revoked', 'file refused');

packages/bus/tests/viewer.test.mjs

@@ -0,0 +1,182 @@
+// Row 275 (193b1b, #1780, row 193 design 4.3, 8 and 9): the viewer level on the bus. A viewer grant
+// binds and reaches VIEWER_VERBS only; thread.create, thread.open and thread.send need a collaborator
+// grant on the project and instance. Board reads refuse every user, collaborator or viewer, and the
+// user-side governance pin names each item of the 5.7 user sentence. The fixture is user-principal's.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Store } from '../src/store.mjs';
+import {
+  Broker, ACTIONS, USER_VERBS, VIEWER_VERBS, BOARD_VERBS, TESTER_VERBS, TESTER_ORGANIZATION_VERBS, PROJECT_FILE_VERBS,
+} from '../src/broker.mjs';
+
+const shipped = (name) =>
+  JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), 'utf8'));
+const options = [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }];
+const grant = (over = {}) => ({
+  id: 'g-1', user: 'alice', business: 'demo', projects: ['*'], instances: ['assistant'], level: 'collaborator', ...over,
+});
+
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-viewer-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const access = { doc: { accessVersion: 1, revision: 1, users: [], grants: [grant()] } };
+  const b = new Broker({
+    store,
+    businesses: {
+      demo: {
+        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
+        roles: {
+          chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+          assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
+        },
+        definitions: { 'chief-of-staff': {}, assistant: { messaging: shipped('assistant').messaging } },
+      },
+    },
+    access: () => access.doc,
+  });
+  const caps = { human: b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }) };
+  const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
+  const code = (who, verb, args = {}) => {
+    try {
+      call(who, verb, args);
+    } catch (e) {
+      return e.code;
+    }
+    return null;
+  };
+  const user = (name) => (caps[name] = b.bindUser({ business: 'demo', user: name }));
+  const launch = (name, thread) => {
+    caps[name] = b.bindLaunch({ business: 'demo', role: 'assistant', run: `${name}-run`, harness: 'pi', thread });
+    return call(name, 'role.claim');
+  };
+  return { b, store, access, caps, call, code, user, launch };
+}
+
+// Two projects. Alice, a collaborator on p1, made thread A there and sent one message; then her grant
+// is lowered to viewer (the downgrade path, design 4.3). Bob is a viewer on p1 from the start.
+function viewers(t) {
+  const ctx = setup(t);
+  const p1 = ctx.call('human', 'project.create', { name: 'shared' }).id;
+  const p2 = ctx.call('human', 'project.create', { name: 'private' }).id;
+  ctx.access.doc.grants = [grant({ projects: [p1] })];
+  ctx.user('alice');
+  const A = ctx.call('alice', 'thread.create', { project: p1, name: 'alice work' }).id;
+  const sent = ctx.call('alice', 'thread.send', { thread: A, body: 'hello' }).id;
+  ctx.access.doc.grants = [
+    grant({ projects: [p1], level: 'viewer' }),
+    grant({ id: 'g-b', user: 'bob', projects: [p1], level: 'viewer' }),
+  ];
+  ctx.user('bob');
+  return { ...ctx, p1, p2, A, sent };
+}
+
+test('275: VIEWER_VERBS is the ruled read list, inside USER_VERBS', () => {
+  assert.deepEqual(VIEWER_VERBS, ['project.list', 'thread.list', 'thread.messages', 'names']);
+  for (const v of VIEWER_VERBS) assert.ok(USER_VERBS.includes(v), v);
+});
+
+test('275: a viewer binds, and each viewer verb answers with what its grant covers', (t) => {
+  const { call, p1, A, sent } = viewers(t);
+  call('human', 'name.set', { instance: 'assistant', name: 'ada' });
+  call('human', 'name.set', { instance: 'chief', name: 'cleo' });
+  for (const who of ['alice', 'bob']) {
+    assert.deepEqual(call(who, 'project.list').map((p) => p.id), [p1], who);
+    assert.deepEqual(call(who, 'names').map((n) => n.instance), ['assistant'], who);
+  }
+  // Alice's own old thread still lists and reads; bob has none.
+  assert.deepEqual(call('alice', 'thread.list').map((x) => x.id), [A]);
+  assert.deepEqual(call('alice', 'thread.messages', { thread: A }).map((m) => m.id), [sent]);
+  assert.deepEqual(call('bob', 'thread.list'), []);
+});
+
+// Mutant 6 (row 193 design 8): a viewer allowed thread.send. This test kills it.
+test('275: a viewer is refused thread.create, thread.open and thread.send access-refused, and nothing is stored', (t) => {
+  const { store, code, p1, A } = viewers(t);
+  const counts = () => ['messages', 'threads', 'thread_opens'].map((x) => store.get(`SELECT count(*) n FROM ${x}`).n);
+  const before = counts();
+  for (const who of ['alice', 'bob'])
+    assert.equal(code(who, 'thread.create', { project: p1, name: `${who} new` }), 'access-refused', `${who} create`);
+  // Only alice owns a thread: #thread refuses a non-owner thread-not-owned before the level check
+  // (duckworth-0166 B1), so open and send are asked on her own A.
+  assert.equal(code('alice', 'thread.open', { thread: A }), 'access-refused', 'alice open');
+  assert.equal(code('alice', 'thread.send', { thread: A, body: 'still here?' }), 'access-refused', 'alice send');
+  assert.deepEqual(counts(), before);
+});
+
+test('275: every verb off the user list refuses a viewer access-refused before its own checks', (t) => {
+  const { b, caps } = viewers(t);
+  const others = new Set([...ACTIONS, ...TESTER_VERBS, ...TESTER_ORGANIZATION_VERBS, ...PROJECT_FILE_VERBS, ...BOARD_VERBS, 'no.such.verb']);
+  for (const v of USER_VERBS) others.delete(v);
+  assert.ok(others.size > 40);
+  for (const verb of others)
+    assert.throws(() => b.request(caps.bob, { verb, args: { junk: true } }), { code: 'access-refused' }, verb);
+});
+
+test('275: mixed grants, collaborator on one project and viewer on another, take the level per project', (t) => {
+  const { call, code, access, user } = setup(t);
+  const pa = call('human', 'project.create', { name: 'a' }).id;
+  const pb = call('human', 'project.create', { name: 'b' }).id;
+  access.doc.grants = [grant({ projects: [pa] }), grant({ id: 'g-2', projects: [pb] })];
+  user('alice');
+  const B = call('alice', 'thread.create', { project: pb, name: 'b work' }).id;
+  const inB = call('alice', 'thread.send', { thread: B, body: 'in b, before' }).id;
+  access.doc.grants = [grant({ projects: [pa] }), grant({ id: 'g-2', projects: [pb], level: 'viewer' })];
+  const A = call('alice', 'thread.create', { project: pa, name: 'a work' }).id;
+  assert.ok(A, 'create in the collaborator project works');
+  assert.equal(code('alice', 'thread.create', { project: pb, name: 'b more' }), 'access-refused', 'create in the viewer project');
+  assert.deepEqual(call('alice', 'project.list').map((p) => p.id), [pa, pb]);
+  assert.deepEqual(call('alice', 'thread.list').map((x) => x.id), [B, A]);
+  assert.ok(call('alice', 'thread.send', { thread: A, body: 'in a' }).id);
+  assert.equal(code('alice', 'thread.send', { thread: B, body: 'in b' }), 'access-refused');
+  assert.equal(code('alice', 'thread.open', { thread: B }), 'access-refused');
+  assert.deepEqual(call('alice', 'thread.messages', { thread: B }).map((m) => m.id), [inB]);
+});
+
+// Mutant 10 (row 193 design 8): a user allowed `trail`. This test kills it; R3's exact USER_VERBS
+// pin in user-principal.test.mjs fails too. Carol is a collaborator, so the refusal isn't the level's.
+test('275: board reads refuse users and viewers access-refused', (t) => {
+  const { code, access, user, p1, A } = viewers(t);
+  assert.deepEqual(BOARD_VERBS, ['inbox', 'agents', 'thread.claims', 'tasks', 'trail', 'decisions', 'credentials', 'replies', 'messages', 'state', 'usage']);
+  access.doc.grants = [...access.doc.grants, grant({ id: 'g-c', user: 'carol', projects: [p1] })];
+  user('carol');
+  for (const who of ['alice', 'bob', 'carol']) {
+    for (const verb of [...BOARD_VERBS, ...PROJECT_FILE_VERBS, 'limits', 'plugins', 'instances', 'routes'])
+      assert.equal(code(who, verb, verb === 'trail' ? { subject: A } : {}), 'access-refused', `${who} ${verb}`);
+  }
+});
+
+// Row 193's user sentence, from the user's side (mos-1023 item 2, design 8): "The business owner sees
+// your thread's agent's decisions, inbox entries, claims, tasks and project files, but not your
+// messages." The owner side is message-filter.test.mjs's pin. Here each item the owner sees is a
+// board read the user is refused, at either level, while the user still reads its own thread.
+test('governance pin, user side: decisions, inbox entries, claims, tasks and project files are the owner\'s, the user reads its messages', (t) => {
+  const { call, code, access, user, launch, p1 } = viewers(t);
+  access.doc.grants = [...access.doc.grants, grant({ id: 'g-c', user: 'carol', projects: [p1] })];
+  user('carol');
+  const C = call('carol', 'thread.create', { project: p1, name: 'carol work' }).id;
+  const sent = call('carol', 'thread.send', { thread: C, body: 'please plan it' }).id;
+  launch('a', C);
+  const d = call('a', 'decision.raise', { action: 'deploy', question: 'Ship?', options, recommendation: 'yes', blocking: false }).id;
+  assert.ok(call('human', 'inbox').some((x) => x.id === d), 'the owner sees the raise');
+  const items = [
+    ['decisions', 'decisions', { list: 'recent' }],
+    ['inbox entries', 'inbox', {}],
+    ['claims', 'agents', {}],
+    ['claims', 'thread.claims', {}],
+    ['tasks', 'tasks', {}],
+    ['tasks', 'state', {}],
+    ['project files', 'project.files', { project: 'stack' }],
+    ['project files', 'project.file', { project: 'stack', path: 'docs/plan.md' }],
+  ];
+  for (const who of ['carol', 'bob'])
+    for (const [item, verb, args] of items) assert.equal(code(who, verb, args), 'access-refused', `${item}: ${who} ${verb}`);
+  assert.deepEqual(call('carol', 'thread.messages', { thread: C }).map((m) => m.id), [sent], 'messages: the user reads its own');
+});

packages/cli/tests/stack-release.test.mjs

@@ -858,7 +858,7 @@ const COUNTED=/^COUNTED="([^"]*)"$/m.exec(srText)[1].split(' ');
 const STORE_JS=/^STORE_JS='([\s\S]*?)'$/m.exec(srText)[1];
 // sage-1163's list 2, written out so that a table dropped from the script's COUNTED fails T45 as
 // well as T46.
-const LISTED=['role_claims','thread_claims','decision_events','messages','deliveries','task_snapshots','projects','threads','sessions','session_defaults','thread_opens','instance_names','usage_records'];
+const LISTED=['role_claims','thread_claims','decision_events','messages','deliveries','task_snapshots','projects','threads','sessions','session_defaults','thread_opens','thread_shares','instance_names','usage_records'];
 const LATE='2999-01-01T00:00:00.000Z';
 const addRow=(file,table,at=LATE)=>{const db=new DatabaseSync(file);db.exec(`CREATE TABLE IF NOT EXISTS ${table} (seq INTEGER PRIMARY KEY, at TEXT NOT NULL)`);db.prepare(`INSERT INTO ${table} (at) VALUES (?)`).run(at);db.close()};
 

scripts/stack-release.sh

@@ -417,7 +417,7 @@ plugin_checks() {
 # Row 181: the tables a bus writer fills without an event in the same transaction, in schema
 # order. A restore drops their rows after STAMP as it drops events, so the guard counts them too.
 # BUILD.md for row 181 names each writer; the T46 guard classifies every table in the schema.
-COUNTED="role_claims thread_claims decision_events messages deliveries task_snapshots projects threads sessions session_defaults thread_opens instance_names usage_records"
+COUNTED="role_claims thread_claims decision_events messages deliveries task_snapshots projects threads sessions session_defaults thread_opens thread_shares instance_names usage_records"
 
 STORE_JS='
 const {DatabaseSync}=require("node:sqlite");const {pathToFileURL}=require("node:url");