row 206 (193b2, #1704 ): sage-2818 rulings, only a human principal matches a share

#readable returns false for an agent session, so a `*` share no longer shows a user's message in an agent's trail. New tests: a sharee's session.list refuses (Q1), and an agent bound to the shared thread, a chief run and the tester match no share (Q2). BUILD.md records the Q1 follow-up, Q2-Q4 and the live --migrate as Mos's go under Q173. README names the agent rule.
row 206 (193b2, #1704 ): thread shares, schema 3l→3m
2026-10-22 11:53:19 -05:00 · 2026-10-22 11:46:10 -05:00
26 changed files with 1285 additions and 401 deletions
@@ -0,0 +1,132 @@
+# Row 206 build notes (Launchpad): 193b2, thread shares (#1704)
+
+Brief: docs/plans/2026-10-20_human-users-build.md, "Brief: 193b2, thread shares (schema 3l)"
+(blob de3a6310b). Design: agents/morgana/work/queue-193/DESIGN.md at e2d161e2e (sha256 dd7fcb41…),
+sections 4.3, 5.2-5.6 and 8. Reviewer: Duckworth. Assignment: sage-2789.
+
+## Base and chain
+
+- Started on aca16404c (sage-2789) on branch launchpad/row206.
+- 206 chains on 275 (193b1b, viewer verbs and board refusals), which Morgana is building. I rebase
+  onto Morgana's 275 sha when it comes, and onto 253's landing under a new branch name.
+- At this base a user binds only with a collaborator grant (`#userGrants`, USER_LEVEL). Viewer
+  sessions arrive with 275, so the viewer column of design 4.3 is not testable here (sage-2818
+  Q4: the viewer column waits on the 275 rebase; 275 moves once more for Duckworth's B1,
+  duckworth-0166). On the 275
+  rebase, USER_VERBS and the viewer gate merge with the three share verbs, and the share verbs
+  must refuse a viewer (design 4.3: share, unshare and shares are "refused" for viewers).
+
+- The live `--migrate` (3l→3m on the running bus) is not part of this build. It is Mos's go under
+  Q173, with a backup first and a STATE report after (mos-1310 item 4).
+
+## What changed
+
+- Schema 3l→3m. `thread_shares` as design 5.2, its index and three append-only triggers, in
+  schema.sql and in the new step `src/migrations/3l-3m.sql` with the same SQL text. SCHEMA_SHA256
+  d5ca9bb9268994b175ac79d38939be4bb7f2e80bc0d9ea273eedaae50c29b8a9, SCHEMA_VERSION 3m.
+  `tests/fixtures/schema-3l.sql` is the 3l schema.sql (sha256 cd68512212ce…).
+- `thread_shares` joins `timedTables` (store.mjs), the broker's clock list, `COUNTED` in
+  scripts/stack-release.sh and `LISTED` in stack-release.test (T46). It has `at`, so it goes in
+  the counted list, not the untimed one.
+- broker.mjs:
+  - `#readable(s, t)` holds rules 1-4 of design 5.4. `#shared` reads the latest row per thread and
+    target. `#covered` reads the access document once per call and covers nothing on a read
+    failure, as `#userGrants` does.
+  - `#threadRead` admits the owner (with `#grantedThread`) or `#readable`, and serves only
+    `thread.messages`. `#thread` keeps the owner check for every write verb.
+  - `thread.share`, `thread.unshare`, `thread.shares` (design 5.3). `thread.list {shared:true}`
+    adds `owner`; the plain list keeps its shape (5.5).
+  - `replies` leaves out user thread messages except those in threads `#readable` admits.
+    `trail` needed no change: it already filters through `#hiddenMessage`, which calls `#readable`.
+  - USER_VERBS gains the three share verbs. `thread.shares` joins `#processingGate`'s read list.
+- packages/bus/README.md: the verb rows, a "Thread shares" section, and the schema line (v3m, the
+  new sha, 23 tables, 90 triggers). schema.test counts 89 triggers because it drops one first.
+
+## Choices and departures (for Sage and Duckworth)
+
+1. Label 3l→3m, not 3i-3j (design) or 3l (brief title). 264a took 3k-3l, and labels go by
+   landing order (sage-2789).
+2. A share covers every session of the thread, and `session.list` stays owner-only (sage-2818
+   Q1, from Sage's Q7 ruling, agents/sage/work/queue-264/RULINGS.md:72-77). broker.mjs keeps its
+   "no shares (Q7)" refusal: a sharee reads any session it can name but can't list them. A test
+   holds the refusal (human `thread-not-owned`, reader `read-only`, user `access-refused`).
+   **Follow-up**, bound to whichever of row 193 or the share wiring lands second: wire the sharee's
+   `session.list`. The bar is T1 sessions line 7 and REQ-USER-4 (candidate PRD 1509c7cc5,
+   docs/prd/mosaic-stack.md:1027-1052): read-only, and it needs current grants, the thread
+   owner's included.
+3. A reader session matches shares as the business human (sage-2818 Q2: accepted, for the human
+   principal only). Design 4.3 says reader sessions "stay owner-only", and 5.5 says "messages in
+   other users' unshared threads hidden" for human, reader and tester. The reader sees what the
+   owner sees, shares to the owner included. Q2 also found a gap in the first tip (16b9c6df6): an
+   agent session has no owner, but it matched a `*` share, so a shared user message showed in an
+   agent's trail. `#readable` now returns false unless the session is the business human, a
+   reader or a user. A test binds an assistant run to the shared thread and a chief run with no
+   thread, and checks that neither (nor the tester) sees the message after a `*` share and a share
+   to the owner.
+4. Access is read per request (sage-2818 Q3). Design 5.6's "30 s timer" and `access.reload` have
+   no path at this base: runtime.mjs:263 passes `access: () => loadAccess(file, context)`, read on
+   every request. The tests cover the per-request read (removed, expired, out of scope and
+   unreadable), which is the stricter case.
+5. Rule 3 asks the owner's grant for any level, like rule 2 (design: "still has a live grant
+   covering t"). A user owner lowered to viewer keeps the thread readable to its sharees.
+6. An unshare checks no coverage, so an owner can end a share whose target lost its grant.
+7. `thread.shares` for a user goes through `#grantedThread`, so it needs the collaborator grant
+   to still cover the thread, like share and unshare. Design 4.3 says "own threads" with no grant
+   note; at this base every user is a collaborator, so the two agree until 275.
+
+## Tests
+
+New: tests/thread-shares.test.mjs, 15 tests: the read flow and the write refusals, `*`, rule 2,
+rule 3 (with trail for human and reader), latest-row state, share-not-covered, target checks,
+lost owner coverage, tester and reader refusals (18 `action.refused` events, no rows), trail and
+replies, sessions, the sharee's `session.list` refusal (Q1), agents and the tester matching no
+share (Q2), the 3l→3m migration and the 3l engine's refusal of a 3m store.
+
+Pins moved 3l→3m: account-, chief-of-staff, comment-, gitea-, grant-, name-, spec-, usage- and
+thread-migration, sessions, schema (23 tables, 89 triggers) and user-principal (USER_VERBS).
+The engine copies in account-, gitea-, grant- and comment-migration gain 3l-3m.sql;
+comment-migration's future step becomes 3m→3n. `later3l` in account-, gitea- and grant-migration
+also leaves out `thread_shares` objects, and the gitea and grant `rows()` lists leave out the
+table, since each compares a store migrated through 3m against an older one.
+
+## Mutants (design section 8 numbers)
+
+Each runs on a copy of the candidate tree with one edit, under `timeout -k 10 300`. The named
+test must fail on an assertion; a thrown error or a refusal before the assertion doesn't count.
+
+- M2. In `#readable`, delete the rule 2 line (`if (s.user && !this.#covered(s.user, ...)) return
+  false;`). Killed by "mutant 2: a share never widens a grant" (bob reads after his grant moves to
+  p2) and by the `*` test (carol reads).
+- M3. In `#readable`, delete the rule 3 line. Killed by "mutant 3" (the human reads A after
+  alice's grant is removed).
+- M4. In `#shared`, replace the latest-row lookup with any share row:
+  `SELECT op FROM thread_shares WHERE thread=? AND target=? AND op='share' LIMIT 1`. Killed by
+  "mutant 4" (bob still reads after the unshare).
+- M7. In `thread.send`, replace `this.#thread(s, a.thread)` with `this.#threadRead(s, a.thread)`.
+  Killed by the first test (bob's send to A must refuse `thread-not-owned`).
+- M8. In `thread.share`, delete the `share-not-covered` line. Killed by "mutant 8" (the share
+  to user:carol must refuse).
+- M9. In `thread.share`/`thread.unshare`, replace `this.#thread(s, a.thread)` with
+  `this.#threadRow(s, a.thread)`. Killed by the first test (bob's share of A to `*` must refuse).
+- Q2 probe (not a design mutant). In `#readable`, delete the human-principal line
+  (`if (!s.human && !s.reader && !s.user) return false;`). Killed by "only a human principal
+  matches a share" (the agent's trail shows the message after the `*` share).
+
+## Run limits
+
+From 264's table (agents/gizmoduck/work/queue-264/BUILD.md, Run limits), each at least 3x the
+longest recorded run. A timeout with no failed test goes to Sage first; a timeout in the shell
+phase goes to Mos unplaced (mos-1275).
+
+| Run | LIMIT |
+|---|---|
+| stack-release.test alone | 1800 s |
+| each other touched file alone | 300 s |
+| bus suite | 900 s |
+| cli suite | 1800 s |
+| each scripts/test-*.sh | 900 s |
+| each mutant probe | 300 s |
+
+## Runs
+
+None yet. Node and https git wait for Sage's CLEAR (Gander holds the slot for row 253 run 5).
@@ -1,138 +0,0 @@
-# Row 207 build notes: 193c, `mosaic access user` verbs and `--level viewer` (#1705)
-
-Builder Megavolt, reviewer Duckworth, gate owner Sage (sage-2790, Q220, mos-1301). Branch megavolt/row207 off
-aca16404c. The brief is "Brief: 193c, mosaic access user verbs and --level viewer" in
-docs/plans/2026-10-20_human-users-build.md (blob c74af2510). Its gate: Duckworth approves the manifest, the cli
-suite and every `scripts/test-*.sh` are green on Sage's gate, and the mutants are killed.
-
-## Sources
-
- The brief, quoted: "`mosaic access user add/remove` and `grant --level viewer`, only where R5 lacks them. They
-  refuse tester and agent callers, write a receipt line and call `access.reload` (section 8, CLI). If R5 already
-  has all of them, this row records that and closes with no code."
- Morgana's row 193 design, section 4.5 and section 8 (agents/morgana/work/queue-193/DESIGN.md at e2d161e2e on
-  morgana/row193): `user add <id> --home local --subject <provider>:<sub>`, `user remove <id>`, `--level viewer`
-  on `grant`, a receipt line in `<dataRoot>/state/access-log.jsonl` and the `access.reload` call.
- R5 as it stands at aca16404c: packages/cli/src/access.mjs, packages/cli/tests/access.test.mjs,
-  packages/business/src/access.mjs (checkAccess, read only here), packages/bus/src/broker.mjs and runtime.mjs.
-
-## 1. What R5 already has
-
- `grant --level viewer`: present. LEVELS is `["collaborator", "viewer"]` (packages/business/src/vocabulary.mjs),
-  grant checks `--level` against it, and access.test.mjs already grants at viewer. This row adds no code for it
-  and records it here.
- `user add` and `user remove`: absent. accessVerb takes only list, grant and revoke, and the only way to add a
-  user today is to hand-edit access.json. This row adds them.
- `access.reload`: absent everywhere. No bus verb has that name. The R5 brief says "R4 later makes these verbs
-  call `access.reload`, so R5 leaves no other reload path", FED R3's brief leaves it to R4, and access.mjs's
-  proveHuman says "Row R4 swaps this call for access.reload". FED R4 is not filed.
-
-## 2. Decisions (Q items for Sage and Duckworth, stated as assumptions, not blockers)
-
- Q1, the reload call. 193c adds no `access.reload` call, because there is no verb to call. The user verbs take
-  R5's path exactly: the same `project.list` human proof, and R4 swaps the proof for `access.reload` on all five
-  verbs at once. Nothing is lost meanwhile: runtime.mjs hands the broker `() => loadAccess(...)`, and the broker
-  reads the file once per user request (broker.mjs:384), so a written change acts on the next request. If Sage
-  or Duckworth reads the brief as "add `access.reload` here", that is R4's bus verb and a scope change.
- Q2, remove with grants. `user remove` refuses with `user-has-grants`, exit 2, naming the grant ids, while any
-  grant at any business names the user. The other reading drops the user's grants in the same revision. Refusing
-  is the smaller, fail-closed choice: nothing disappears that the owner did not name, and the help text already
-  says to revoke first. checkAccess would also refuse the file (a grant naming a missing user), but with a key
-  path, not a reason, and exit 3.
- Q3, the subject. `--subject PROVIDER:SUB` splits at the first colon, so a sub may hold colons. One subject per
-  add, because parse keeps one value per flag. A second subject is a later row if anyone needs it; checkAccess
-  allows several.
- Q4, `--business`. Required on the user verbs too. The user list is instance-wide, but the human proof runs
-  through one business's bus, and the receipt names it.
- Q5, the receipt. `{at, verb: "user.add" | "user.remove", business, user, actor: "human", revisionBefore,
-  revisionAfter, grants: []}`: grant and revoke's shape, with an empty grants list.
- `user remove` of an id not in the file refuses, exit 2, and writes nothing, as revoke of nothing does.
- `user add` of a duplicate id, a reserved id (human, tester), a business's human, an unknown provider, a
-  non-local home, an owner sso subject or a subject another user holds refuses through checkAccess, exit 3,
-  before any write. The verb does not repeat those checks.
-
-### Rulings (sage-2810, 16:40Z, cc Duckworth)
-
- Q1 agreed: no reload call. The reason is broker.mjs:384-386, the `#access` field's comment: "() => the checked
-  access document (R1's loadAccess), read once per user request", wired in runtime.mjs:263 as
-  `() => loadAccess(access.file, access.context)`. A write acts on the next request. FED R4 owns any reload verb.
- Q2 agreed: `user remove` refuses with `user-has-grants`, exit 2, naming the grant ids, and writes nothing.
-  Dropping the grants silently would make removal revoke access without saying so.
- Usage and help pins: grep the tests for the changed strings, sha256 and snapshot pins included, and run every
-  reader whole (section 6).
- Row 203 (Quackerjack) does not touch access.mjs; its stale help lines stay a follow-up, so no overlap.
-
-### The usage and help pin sweep (sage-2810), on aca16404c plus this row
-
- Source readers of ACCESS_USAGE and ACCESS_HELP: packages/cli/src/access.mjs only (cli.mjs imports
-  accessCommand and accessContextFor, not the strings).
- `git grep` over 'packages/*/tests/*' and 'scripts/*' for ACCESS_USAGE, ACCESS_HELP, "mosaic access",
-  "access list", "access grant", "access revoke", "Access (FED" and the help's "revoke them here first": the only
-  hits are packages/cli/tests/access.test.mjs (positive control: `accessCommand` hits it twice).
- Hash pins: no test file names packages/cli/README.md or packages/cli/src/access.mjs next to a sha256 or a
-  64-hex value. The one 64-hex file that mentions a README (packages/queue/tests/fixtures/queue-marked.md) names
-  packages/queue/README.md and packages/ledger/README.md, not this one. scripts/stack-copy.sh copies
-  packages/cli/README.md; stack-copy.test.mjs builds its own fake repo and is in the cli package, run whole.
- packages/business/tests/access*.test.mjs import packages/business/src/access.mjs, a different file, unchanged.
- So the readers are access.test.mjs, run whole in step 1, and the cli package whole in step 2.
-
-## 3. The change (code and docs)
-
- packages/cli/src/access.mjs: two ACCESS_USAGE lines and one help line; accessVerb accepts `user add ID` and
-  `user remove ID` (three positionals) and hands off to `userVerb` after the shared checks (tester, business,
-  proof, file, context, revision). `userVerb` takes the lock, checks the revision, builds the new users list,
-  runs checkAccess on the whole document, writes atomically and appends the receipt.
- packages/cli/README.md: the usage block and one paragraph.
- No change to packages/business, packages/bus or cli.mjs (it already routes `access` to accessCommand).
-
-## 4. Tests (packages/cli/tests/access.test.mjs, whole file)
-
-Manifest check against Morgana's row 275 (sage-2790), 10-22: morgana/row275 has no commits past aca16404c, and
-row 275's brief ("193b1b, viewer verbs and board refusals") is bus only: the viewer verb list, `covers` level
-checks and board refusals, gated on the bus suite. This row touches only packages/cli (access.mjs, README,
-access.test.mjs) and this file, so no path is shared on the briefs. I recheck the paths when Morgana pushes.
-
- T1 `user add` writes the user (id, home, one subject), bumps the revision by one, prints the line and appends
-  one receipt with verb `user.add` and `grants: []`. A sub with a colon (`authentik:bob:x`) keeps `bob:x`.
- T2 `user add` refusals before any write, file and receipts unchanged: missing `--home` or `--subject`, a
-  subject with no colon, an empty provider or sub (exit 4); an unknown provider, a duplicate id, `tester`, the
-  business's human, an owner sso subject, a subject alice already holds, a non-local home (exit 3).
- T3 `user remove` of a user with no grants drops them, bumps the revision, receipt `user.remove`.
- T4 `user remove` of a user with a grant refuses `user-has-grants` naming the grant id, exit 2, nothing written.
- T5 `user remove` of an id not in the file refuses, exit 2, nothing written.
- T6 a stale `--revision` refuses `revision-conflict` on both user verbs, exit 3.
- T7 `--tester` and an agent env (MOSAIC_RUN_ID) refuse both user verbs, exit 3, and the fake human CLI is never
-  called.
- T8 a bad shape (`user`, `user add`, `user list x`, `user add a b`) prints the help, exit 4.
- T9 a bus that refuses the human proof (the fixture's `mode: "refuse"`) blocks both user verbs: exit 3, the
-  file and receipts unchanged.
-
-## 5. Mutants
-
-Each runs the whole access.test.mjs and counts as killed only on an assertion in the named test.
-
- M1 drop the `user-has-grants` refusal. Second fence: checkAccess then refuses the file with exit 3, so T4 must
-  assert the `user-has-grants` text and exit 2, not only "nothing written". Killed by T4.
- M2 drop the "no user to remove" check. The write then lands with an unchanged user list. Killed by T5.
- M3 split the subject at the last colon. Killed by T1's colon case.
- M4 skip checkAccess in userVerb (write the unchecked document). Killed by T2's exit-3 cases.
- M5 drop the receipt in userVerb. Killed by T1 and T3.
- M6 drop the revision check in userVerb. Killed by T6.
- M7 exempt the user verbs from the `--tester` check (`&& sub !== "user"`). Killed by T7's tester case.
- M8 skip proveHuman for the user verbs (`if (sub !== "user")`). Killed by T9. T7's agent case does not reach it: accessCommand
-  calls refuseInsideAgent before accessVerb, so an agent env is refused whatever the order inside.
-
-## 6. Gate plan (mos-1275)
-
-On Sage's CLEAR, from a rebase onto 253's landing under a new branch name, stopping at the first red:
-
-1. access.test.mjs whole, then M1-M8, each under `timeout -k 10 180`.
-2. The cli package whole.
-3. Every `scripts/test-*.sh` as `timeout -k 10 LIMIT bash scripts/test-X.sh`, no script edited. LIMIT is row
-   281's table (Gander's row 278 limits, 3x the longest of three records plus 120 s): auth 126, conductor 145,
-   config 130, discord 147, extension-package 130, foundation 240, land-work 158, queue 191, release 157,
-   task 231 seconds. The base has the same ten scripts. Any timeout goes to Sage, then Mos, unplaced.
-
-## Runs
-
-Filled in after the runs.
@@ -240,10 +240,12 @@ a receipt with empty `changes`. A refusal is `action.refused` with its code alon
 | `project.create` | `{name,repo?}`; human sessions only (row 121, #1615). `repo` must name one of the business's `projects` (`unknown-repo`); a second project with the same name refuses `project-exists`. Returns `{id}`. |
 | `project.list` | No args; human sessions only. The business's projects, oldest first. |
 | `thread.create` | `{project,name}`; human sessions only. The thread belongs to the caller and to the business's one thread instance (Projects and threads, below). Returns `{id,instance}`. Refuses `project-not-found`, `thread-exists`, `thread-instance-missing` or `thread-instance-ambiguous`. |
-| `thread.list` | `{project?}`; human sessions only. The caller's own threads, oldest first. |
+| `thread.list` | `{project?,shared?}`; human sessions only. The caller's own threads, oldest first. With `shared: true` (row 206), the threads others own that the caller may read (Thread shares, below), each row adding `owner`. |
 | `thread.open` | `{thread,session?}`; human sessions only. Records a `thread_opens` row, which asks the launcher to start the thread's session. Returns `{opened}`. |
 | `thread.send` | `{thread,session?,body,class?}`; human sessions only. A message to the thread's instance, in that thread, with its `human.input` event as `request`. Returns `{id,request}`. |
-| `thread.messages` | `{thread,session?,after?,limit?}`; human sessions only. The session's messages oldest first, after the message `after` names (`message-not-found` when it isn't in the session), at most `limit` (default 50, 1 to 200). Writes nothing. |
+| `thread.messages` | `{thread,session?,after?,limit?}`; human sessions only. The session's messages oldest first, after the message `after` names (`message-not-found` when it isn't in the session), at most `limit` (default 50, 1 to 200). A thread shared with the caller reads too, any session of it (row 206). Writes nothing. |
+| `thread.share`, `thread.unshare` | `{thread,to}`; the thread's owner only (row 206, #1704). `to` is `user:<id>`, the business human's name or `*`; yourself refuses `invalid-request`. A share refuses `share-exists` when one is in force, and `share-not-covered` when a `user:` target has no live grant covering the thread. An unshare refuses `share-not-found` when none is. Each writes one `thread_shares` row. Returns `{thread,to,op}`. |
+| `thread.shares` | `{thread}`; the thread's owner only. The shares in force, `[{to,at,by}]`, oldest first. Writes nothing. |
 | `session.list` | `{thread}`; human and tester sessions (row 264a, #1769). The thread's sessions oldest first, `[{id,at,name,predecessor,default}]`. Writes nothing. |
 | `session.create` | `{thread,name,op}`; human and tester sessions. A new session of the thread, metadata only. A retry with the same `op` and name returns the first row; another name under that `op` refuses `session-op-conflict`, and a taken name `session-exists`. Returns `{id,thread,name}`. |

@@ -283,7 +285,31 @@ any run but the thread's current holder.

 A user reaches only their own threads (REQ-USER-2): `thread.open`, `thread.send` and
 `thread.messages` refuse `thread-not-found` for an unknown id and `thread-not-owned` for
-another user's thread.
+another user's thread, unless it is shared with them (Thread shares, below).
+
+### Thread shares (row 206, #1704)
+
+Schema `3m` adds `thread_shares`, append-only: one row per `share` or `unshare`, and the latest
+row per thread and target is the share's state. A thread's owner shares it read-only with a
+user (`user:<id>`), the business human or everyone (`*`). The 3l→3m step only adds the table,
+so every existing thread stays private to its owner.
+
+A session may read a thread it doesn't own only when all four hold (row 193 design 5.4):
+
+1. a share is in force to the caller's owner string or to `*`;
+2. a user caller has a live grant, of any level, covering the thread's project and instance;
+3. a thread owned by a user is still covered by that user's grant;
+4. neither the caller nor the owner is the tester.
+
+Only a human principal matches a share: the business human, a reader session as that human, or
+a user. An agent session matches none, `*` included, even when it is bound to the thread.
+A reader session reads as the business human. A sharee can't call `session.list` on the
+thread; it stays owner-only until row 193's share wiring. The check runs on every request against the
+access document the broker reads then, so a removed, expired or unreadable grant or an
+unshare ends reads on the next request. Only `thread.messages` admits a sharee; `thread.open`,
+`thread.send` and the share verbs refuse it `thread-not-owned`. `trail` and `replies` show a
+user's thread messages to the owner and readers while the check holds. The tester can't call
+the share verbs (`tester-refused`). Tests: `tests/thread-shares.test.mjs`.

 `threadsState(business)` is a trusted launcher API, like `bindLaunch`, not a socket verb.
 Per thread it returns `{thread,instance,pending,unread,lastMessage,lastOpen,lastClaim,holder}`:
@@ -766,10 +792,10 @@ scope probes and rotation/expiry notifications; S2 never probes real services.

 ## Schema and verification

-`schema.sql` is v3l, SHA-256
-`cd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a`.
-It has 22 tables, 87 triggers and five views. Source digest and a trusted full
-sqlite_master digest are checked at open, alongside schema version `3l`, WAL,
+`schema.sql` is v3m, SHA-256
+`d5ca9bb9268994b175ac79d38939be4bb7f2e80bc0d9ea273eedaae50c29b8a9`.
+It has 23 tables, 90 triggers and five views. Source digest and a trusted full
+sqlite_master digest are checked at open, alongside schema version `3m`, WAL,
 quick_check and foreign-key integrity. Missing metadata refuses; it never
 reinitializes an existing file. Full synchronous WAL transactions either commit
 or roll back. SQL UPDATE, DELETE and INSERT OR REPLACE refuse on evidence tables.
@@ -478,3 +478,18 @@ CREATE TABLE gitea_grants (
  PRIMARY KEY (business, agent),
  FOREIGN KEY (business, agent) REFERENCES gitea_users(business, agent)
 ) STRICT;
+-- Row 206 (193b2, #1704, row 193 design 5.2): a thread owner's read-only shares. The latest row per
+-- (thread, target) is the share's state. Append-only.
+CREATE TABLE thread_shares (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  op TEXT NOT NULL CHECK (op IN ('share','unshare')),
+  target TEXT NOT NULL,
+  by TEXT NOT NULL
+) STRICT;
+CREATE INDEX thread_shares_thread ON thread_shares (thread, target, seq);
+CREATE TRIGGER thread_shares_no_update BEFORE UPDATE ON thread_shares BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
+CREATE TRIGGER thread_shares_no_delete BEFORE DELETE ON thread_shares BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
+CREATE TRIGGER thread_shares_no_replace BEFORE INSERT ON thread_shares WHEN EXISTS (SELECT 1 FROM thread_shares WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
@@ -131,7 +131,9 @@ export const TESTER_VERBS = Object.freeze(['message.send', 'message.receive', 'm
 // FED R3 (#414, federation design 3.5): the collaborator level is this exact list. Every other verb
 // refuses a user access-refused before its own checks: owner verbs, board reads, message.*,
 // decision.*, project files, spec.read, assistant.stop, launch.*, name.set and usage.*.
-export const USER_VERBS = Object.freeze(['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names']);
+// Row 206 (193b2, row 193 design 4.3): and the share verbs on a user's own threads.
+export const USER_VERBS = Object.freeze(['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names',
+  'thread.share', 'thread.unshare', 'thread.shares']);
 // The level a user's grant must reach for USER_VERBS (R1's covers, morgana-0005).
 const USER_LEVEL = 'collaborator';
 // Row 175: the organization verbs a tester may call. Its writes run every check the human's do
@@ -466,6 +468,7 @@ export class Broker {
      'session_defaults',
      'thread_claims',
      'thread_opens',
+      'thread_shares',
    ]) {
      const at = store.get(`SELECT max(at) at FROM ${table}`).at;
      if (at) {
@@ -511,7 +514,7 @@ export class Broker {
    if (s.human || s.reader || s.tester) return;
    if (!['inbox', 'agents', 'tasks', 'trail', 'decisions', 'replies', 'messages', 'state', 'usage',
      'requirements', 'spec.read', 'project.list', 'project.files', 'project.file', 'library.file', 'library.status',
-      'thread.list', 'thread.messages', 'names', 'instances', 'routes', 'hosts.status', 'grants.status',
+      'thread.list', 'thread.messages', 'thread.shares', 'names', 'instances', 'routes', 'hosts.status', 'grants.status',
      'processing.status', 'role.release', 'usage.end'].includes(verb)) this.#processingWork();
  }
  reconcileProcessing() { this.#processingMirror(this.#processingState()); }
@@ -753,12 +756,22 @@ export class Broker {
    return thread;
  }
  #thread(s, id) {
-    const t = this.#store.get('SELECT * FROM threads WHERE id=? AND business=?', identifier(id), s.business);
-    if (!t) fail('thread-not-found');
+    const t = this.#threadRow(s, id);
    // REQ-USER-2: a user reaches only their own threads.
    if (t.owner !== this.#owner(s)) fail('thread-not-owned');
    return t;
  }
+  #threadRow(s, id) {
+    return this.#store.get('SELECT * FROM threads WHERE id=? AND business=?', identifier(id), s.business) ?? fail('thread-not-found');
+  }
+  // Row 206 (193b2, design 5.4): the thread a read verb names, the caller's own or one #readable
+  // admits. Only thread.messages takes it; every write verb keeps #thread's owner check.
+  #threadRead(s, id) {
+    const t = this.#threadRow(s, id);
+    if (t.owner === this.#owner(s)) return this.#grantedThread(s, t);
+    if (!this.#readable(s, t)) fail('thread-not-owned');
+    return t;
+  }
  // Row 177 (#1675): who owns the threads a session makes. A tester's are `tester`'s, never the human's.
  #owner(s) {
    return s.tester ? 'tester' : s.user ? 'user:' + s.user : s.human;
@@ -802,10 +815,62 @@ export class Broker {
    );
    return Boolean(t) && t.owner.startsWith('user:') && t.owner !== this.#owner(s) && !this.#readable(s, t);
  }
-  // Row 193 design 5.4. Rule 1 needs a share in force, and there is no thread_shares table before
-  // 193b2 (schema 3j), so nobody reads another's thread yet. 193b2 adds the share rule and rules 2-4.
+  // Row 206 (193b2, design 5.4): may a session read thread `t` it doesn't own? Rule 4 first: a
+  // tester's thread is never shared, and a tester is never a share's target and holds no grant. A
+  // reader session is the owner's board view, so it reads what is shared with the owner. Only a
+  // human principal (the business human, a reader as that human, a user) matches a share: an agent
+  // session, even one bound to the thread, matches none, `*` included (sage-2818 Q2).
  #readable(s, t) {
-    return false;
+    if (s.tester || t.owner === 'tester') return false;
+    if (!s.human && !s.reader && !s.user) return false;
+    const me = s.reader ? this.#business(s.business).human : this.#owner(s);
+    // Rule 1: a share in force to the caller or to everyone.
+    if (!this.#shared(t.id, me) && !this.#shared(t.id, '*')) return false;
+    // Rule 2: a share never widens a grant. The owner needs none.
+    if (s.user && !this.#covered(s.user, s.business, t)) return false;
+    // Rule 3: a thread whose user owner has lost coverage is hidden from its sharees too.
+    if (t.owner.startsWith('user:') && !this.#covered(t.owner.slice(5), s.business, t)) return false;
+    return true;
+  }
+  // A share's state is its latest row for the thread and target (design 5.2, Duckworth N12).
+  #shared(thread, target) {
+    return this.#store.get('SELECT op FROM thread_shares WHERE thread=? AND target=? ORDER BY seq DESC LIMIT 1', thread, target)?.op === 'share';
+  }
+  // Does a live grant of any level cover thread `t` for `user`? One read of the access file, as
+  // #userGrants does; any failure to read covers nothing (design 5.6, H3).
+  #covered(user, business, t) {
+    let doc = null;
+    try {
+      doc = this.#access?.() ?? null;
+    } catch {
+      doc = null;
+    }
+    const now = new Date();
+    return (doc?.grants ?? []).some((g) => g.user === user &&
+      covers(g, { business, project: t.project, instance: t.instance }, now, { level: 'viewer' }));
+  }
+  // The threads another principal owns that the session may read, oldest first.
+  #readableThreads(s, project) {
+    const me = s.reader ? this.#business(s.business).human : this.#owner(s);
+    return this.#store.all(
+      "SELECT t.* FROM threads t WHERE t.business=? AND t.owner IS NOT ? AND (? IS NULL OR t.project=?) AND EXISTS(SELECT 1 FROM thread_shares x WHERE x.thread=t.id AND x.target IN (?,'*')) ORDER BY t.seq",
+      s.business,
+      this.#owner(s) || null,
+      project ?? null,
+      project ?? null,
+      me || null,
+    ).filter((t) => this.#readable(s, t));
+  }
+  // Row 206 (design 5.3): a share's target, an owner string: `user:<id>`, the business human's
+  // name or `*`. A share with yourself is invalid.
+  #shareTarget(s, to) {
+    const b = this.#business(s.business);
+    if (typeof to !== 'string') fail('invalid-request');
+    const user = to.startsWith('user:') ? to.slice(5) : null;
+    if (!(to === '*' || to === b.human || (user !== null && ID_PATTERN.test(user) && !['human', 'tester', 'user', b.human].includes(user))))
+      fail('invalid-request');
+    if (to === this.#owner(s)) fail('invalid-request');
+    return to;
  }
  #agent(s) {
    if (s.tester) fail('tester-refused');
@@ -5749,8 +5814,13 @@ export class Broker {
      // and the tester's lists only its own (row 175 listed it the business human's).
      case 'thread.list': {
        if (!s.tester && !s.user) this.#human(s);
-        keys(a, ['project']);
+        keys(a, ['project', 'shared']);
        if (a.project !== undefined) identifier(a.project);
+        if (a.shared !== undefined && a.shared !== true) fail('invalid-request');
+        // Row 206 (193b2, design 4.3): another's threads shared with the caller, each naming its
+        // owner. The plain list keeps its shape.
+        if (a.shared)
+          return this.#readableThreads(s, a.project).map((t) => ({ id: t.id, at: t.at, project: t.project, instance: t.instance, name: t.name, owner: t.owner }));
        // FED R3 (design 3.5): a user's own threads that its grants still cover.
        return this.#store.all(
          'SELECT id,at,project,instance,name FROM threads WHERE business=? AND owner=?' +
@@ -5801,11 +5871,12 @@ export class Broker {
        // A user's message, like a tester's, is never the owner's authority evidence (design 3.5).
        return { id: mid, request: s.tester || s.user ? null : this.#event(s, 'human.input', { kind: 'instruction', message: mid }, mid) };
      }
-      // The thread's history, oldest first. Reading writes nothing.
+      // The thread's history, oldest first. Reading writes nothing. Row 206 (193b2): a thread shared
+      // with the caller reads too, every session of it, since a share is the whole thread's.
      case 'thread.messages': {
        if (!s.tester && !s.user) this.#human(s);
        keys(a, ['thread', 'session', 'after', 'limit'], ['thread']);
-        const t = this.#grantedThread(s, this.#thread(s, a.thread));
+        const t = this.#threadRead(s, a.thread);
        const session = this.#threadSession(t, a.session);
        const limit = a.limit ?? THREAD_PAGE;
        if (!Number.isInteger(limit) || limit < 1 || limit > THREAD_PAGE_MAX) fail('invalid-request');
@@ -5824,6 +5895,34 @@ export class Broker {
          after,
        );
      }
+      // Row 206 (193b2, #1704, design 5.3): the owner of a thread shares it read-only, or ends a share.
+      // A user's collaborator grant must still cover the thread, and a user target needs a live grant
+      // of any level that covers it. Each writes one row; the latest row per target is the state.
+      case 'thread.share':
+      case 'thread.unshare': {
+        if (!s.user) this.#human(s);
+        keys(a, ['thread', 'to'], ['thread', 'to']);
+        const t = this.#grantedThread(s, this.#thread(s, a.thread));
+        const to = this.#shareTarget(s, a.to);
+        const op = verb === 'thread.share' ? 'share' : 'unshare';
+        if (op === 'unshare' && !this.#shared(t.id, to)) fail('share-not-found');
+        if (op === 'share') {
+          if (to.startsWith('user:') && !this.#covered(to.slice(5), s.business, t)) fail('share-not-covered');
+          if (this.#shared(t.id, to)) fail('share-exists');
+        }
+        this.#store.run('INSERT INTO thread_shares(at,business,thread,op,target,by) VALUES(?,?,?,?,?,?)', this.#now(), s.business, t.id, op, to, this.#owner(s));
+        return { thread: t.id, to, op };
+      }
+      // The shares in force on the caller's own thread, oldest first.
+      case 'thread.shares': {
+        if (!s.user) this.#human(s);
+        keys(a, ['thread'], ['thread']);
+        const t = this.#grantedThread(s, this.#thread(s, a.thread));
+        return this.#store.all(
+          "SELECT target AS \"to\",at,by FROM thread_shares x WHERE thread=? AND op='share' AND seq=(SELECT max(seq) FROM thread_shares WHERE thread=x.thread AND target=x.target) ORDER BY seq",
+          t.id,
+        );
+      }
      // Row 264a (#1769, T1 item 7): a thread's sessions, oldest first, and which one is the default.
      // Each user reaches only their own threads' sessions (REQ-USER-2); there are no shares (Q7).
      case 'session.list': {
@@ -5859,14 +5958,15 @@ export class Broker {
        if (!this.#store.get('SELECT id FROM messages WHERE id=? AND business=?', a.id, s.business))
          fail('message-not-found');
        // Row 205 (design 5.7): a hidden id fails as an unknown one does. Hidden replies are left out
-        // in the query, so a page of them doesn't come back short; #readable is false until 193b2,
-        // which adds the share exception to this clause too.
+        // in the query, so a page of them doesn't come back short. Row 206 (193b2): the threads
+        // #readable admits are the share exception.
        if (this.#hiddenMessage(s, a.id)) fail('message-not-found');
        return this.#store.all(
-          `SELECT * FROM messages m WHERE business=? AND in_reply_to=? AND NOT EXISTS(SELECT 1 FROM message_threads mt JOIN threads t ON t.id=mt.thread WHERE mt.message=m.id AND substr(t.owner,1,5)='user:' AND t.owner IS NOT ?) ORDER BY seq LIMIT ${REPLIES}`,
+          `SELECT * FROM messages m WHERE business=? AND in_reply_to=? AND NOT EXISTS(SELECT 1 FROM message_threads mt JOIN threads t ON t.id=mt.thread WHERE mt.message=m.id AND substr(t.owner,1,5)='user:' AND t.owner IS NOT ? AND t.id NOT IN (SELECT value FROM json_each(?))) ORDER BY seq LIMIT ${REPLIES}`,
          s.business,
          a.id,
          this.#owner(s) || null,
+          JSON.stringify(this.#readableThreads(s).map((t) => t.id)),
        );
      }
      default:
@@ -0,0 +1,15 @@
+-- Row 206 (193b2, #1704, row 193 design 5.2): thread shares. Only a new table, its index and its
+-- append-only triggers; no existing row changes, so every thread stays private to its owner.
+CREATE TABLE thread_shares (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  op TEXT NOT NULL CHECK (op IN ('share','unshare')),
+  target TEXT NOT NULL,
+  by TEXT NOT NULL
+) STRICT;
+CREATE INDEX thread_shares_thread ON thread_shares (thread, target, seq);
+CREATE TRIGGER thread_shares_no_update BEFORE UPDATE ON thread_shares BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
+CREATE TRIGGER thread_shares_no_delete BEFORE DELETE ON thread_shares BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
+CREATE TRIGGER thread_shares_no_replace BEFORE INSERT ON thread_shares WHEN EXISTS (SELECT 1 FROM thread_shares WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_shares is append-only'); END;
@@ -13,8 +13,8 @@ import { join, isAbsolute } from 'node:path';
 import { createHash } from 'node:crypto';

 const ddl = readFileSync(new URL('../schema.sql', import.meta.url), 'utf8');
-export const SCHEMA_SHA256 = 'cd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a';
-export const SCHEMA_VERSION = '3l';
+export const SCHEMA_SHA256 = 'd5ca9bb9268994b175ac79d38939be4bb7f2e80bc0d9ea273eedaae50c29b8a9';
+export const SCHEMA_VERSION = '3m';
 // Ordered, named offline steps. New schema changes append a step and keep prior DDL pinned.
 const legacyDDL = readFileSync(new URL('./migrations/3b.sql', import.meta.url), 'utf8');
 const LEGACY_SHA256 = '179ffe356d4ff19a49b5ebad39b6c6bfd7771deb8e1b7c55b5e746f039d69e65';
@@ -72,6 +72,11 @@ const migrations = [{
  from: '3k',
  to: '3l',
  sql: readFileSync(new URL('./migrations/3k-3l.sql', import.meta.url), 'utf8'),
+}, {
+  // Row 206 (193b2, #1704): thread shares. Only a new table; no existing row changes.
+  from: '3l',
+  to: '3m',
+  sql: readFileSync(new URL('./migrations/3l-3m.sql', import.meta.url), 'utf8'),
 }];
 const timedTables = [
  'events',
@@ -87,6 +92,7 @@ const timedTables = [
  'session_defaults',
  'thread_claims',
  'thread_opens',
+  'thread_shares',
  'instance_names',
  'usage_records',
 ];
@@ -17,7 +17,8 @@ const ddl3h = readFileSync(new URL('./fixtures/schema-3h.sql', import.meta.url),
 const here = (p) => new URL(p, import.meta.url);
 // Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
 const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
-const later3l = (r) => SESSIONS_3L.includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
+// Row 206 (#1704): and the 3l→3m step's thread_shares. thread-shares.test.mjs tests it.
+const later3l = (r) => [...SESSIONS_3L, 'thread_shares'].includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
 function source3h(t) {
  const root = mkdtempSync(join(tmpdir(), 'account-migrate-'));
  t.after(() => rmSync(root, { recursive: true, force: true }));
@@ -84,6 +85,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
  copyFileSync(here('../src/migrations/3i-3j.sql'), join(moduleRoot, 'src/migrations/3i-3j.sql'));
  copyFileSync(here('../src/migrations/3j-3k.sql'), join(moduleRoot, 'src/migrations/3j-3k.sql'));
  copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
+  copyFileSync(here('../src/migrations/3l-3m.sql'), join(moduleRoot, 'src/migrations/3l-3m.sql'));
  return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }

@@ -91,7 +93,7 @@ test('REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence
  const { root, path } = source3h(t), before = snapshot(path), was = master(path);
  assert.throws(() => new Store(root), /schema-mismatch/);
  new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
  // Every table's rows as they were, usage_records with its seq values and sqlite_sequence with 50.
  assert.deepEqual(migrated3l(snapshot(path, before.columns).rows), before.rows);
  assert.deepEqual(before.rows.usage_records.map(r => r.seq), [1, 2, 3]);
@@ -141,7 +143,7 @@ test('REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with
  assert.deepEqual(snapshot(path, before.columns).rows, before.rows);
  // Still a whole 3h store: the real step migrates it.
  new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
  assert.deepEqual(migrated3l(snapshot(path, before.columns).rows), before.rows);
 });

@@ -153,14 +155,14 @@ test('REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and
    schema: ddl3h,
    store: (source) => source
      .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3h).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3h';")
+      .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3h';")
      .replace(/\}, \{\n {2}\/\/ Row 126 \(#1620\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
  });
  const pinned = readFileSync(join(root, 'engine-3h/src/store.mjs'), 'utf8');
  assert.ok(pinned.includes("export const SCHEMA_VERSION = '3h';") && !pinned.includes('3h-3i'), 'the 3h engine has no 3h→3i step');
  assert.throws(() => new Store3h(root), /schema-mismatch/);
  assert.throws(() => new Store3h(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
  assert.deepEqual(master(path), was);
  assert.deepEqual(snapshot(path, after.columns).rows, after.rows);
 });
@@ -614,7 +614,7 @@ async function database3c(t) {
  let source = readFileSync(here('../src/store.mjs'), 'utf8');
  const pinned = source
    .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3c).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3c';")
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3c';")
    .replace(/\}, \{\n {2}from: '3c',[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
  assert.notEqual(pinned, source);
  assert.ok(!pinned.includes('3c-3d'), 'the 3c engine has no 3c→3d step');
@@ -638,7 +638,7 @@ test('REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  t.after(() => store.close());
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
  assert.equal(store.get("SELECT body FROM events WHERE id='preserved'").body, '{"fixture":true}');
  assert.equal(store.get("SELECT holder_run FROM role_claims WHERE role='coder'").holder_run, 'coder-run');
  const b = new Broker({ store, businesses: demo(), organization: null });
@@ -33,7 +33,7 @@ test('explicit 3b copy migration preserves evidence and opens as 3g; normal star
  const original = readFileSync(source);
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
  assert.equal(store.get("SELECT body FROM events WHERE id='preserved'").body, '{"fixture":true}');
  assert.equal(store.get('SELECT count(*) n FROM task_comment_cursors').n, 0);
  const epoch = store.get("SELECT value FROM meta WHERE key='comment_cursor_epoch'").value;
@@ -75,15 +75,15 @@ test('named migration registry chains 3b through 3g to a fixture-only future ver
  const sha = createHash('sha256').update(futureDDL).digest('hex');
  let source = readFileSync(new URL('../src/store.mjs', import.meta.url), 'utf8');
  source = source.replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${sha}';`)
-    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3m';")
-    .replace('}];\nconst timedTables', `}, { from: '3l', to: '3m', sql: ${JSON.stringify(futureSQL)} }];\nconst timedTables`);
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3n';")
+    .replace('}];\nconst timedTables', `}, { from: '3m', to: '3n', sql: ${JSON.stringify(futureSQL)} }];\nconst timedTables`);
  writeFileSync(join(moduleRoot, 'src/store.mjs'), source);
  writeFileSync(join(moduleRoot, 'schema.sql'), futureDDL);
-  for (const name of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql', '3j-3k.sql', '3k-3l.sql'])
+  for (const name of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql', '3j-3k.sql', '3k-3l.sql', '3l-3m.sql'])
    copyFileSync(new URL('../src/migrations/' + name, import.meta.url), join(moduleRoot, 'src/migrations', name));
  const { Store: FutureStore } = await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')));
  const future = new FutureStore(root, { migrateSchema: true });
-  assert.equal(future.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
+  assert.equal(future.get("SELECT value FROM meta WHERE key='schema_version'").value, '3n');
  assert.equal(future.get("SELECT name FROM sqlite_master WHERE name='future_fixture'").name, 'future_fixture');
  assert.equal(future.get("SELECT count(*) n FROM task_comment_cursors").n, 0);
  assert.equal(future.get("SELECT id FROM events").id, 'preserved');
@@ -109,7 +109,7 @@ test('offline command migrates only the supplied fixture root and reports usage
  const command = new URL('../src/migrate-schema.mjs', import.meta.url).pathname;
  const migrated = spawnSync(process.execPath, [command, root], { encoding: 'utf8' });
  assert.equal(migrated.status, 0, migrated.stderr);
-  assert.match(migrated.stdout, /bus schema 3l ready/);
+  assert.match(migrated.stdout, /bus schema 3m ready/);
  new Store(root).close();
  const usage = spawnSync(process.execPath, [command], { encoding: 'utf8' });
  assert.equal(usage.status, 2);
@@ -0,0 +1,480 @@
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
+CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL) STRICT;
+CREATE TABLE events (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN (
+    'session.launched',
+    'session.ended',
+    'action.allowed',
+    'action.refused',
+    'task.created',
+    'task.assigned',
+    'task.state',
+    'task.closed',
+    'task.changed.external',
+    'task.conflict',
+    'task.missing',
+    'review.requested',
+    'review.verdict',
+    'human.input',
+    'config.refused',
+    'credential.expiring',
+    'credential.expired',
+    'credential.changed',
+    'launch.revoked',
+    'launch.restored',
+    'digest.sent')),
+  actor_role TEXT, actor_run TEXT,
+  subject TEXT,
+  corrects TEXT REFERENCES events(id),
+  body TEXT NOT NULL CHECK (json_valid(body))
+) STRICT;
+CREATE TABLE role_claims (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL, role TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
+  holder_run TEXT NOT NULL,
+  harness TEXT NOT NULL, address TEXT,
+  by TEXT NOT NULL, reason TEXT,
+  decision TEXT
+) STRICT;
+CREATE TABLE decisions (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL, project TEXT,
+  raised_by_role TEXT NOT NULL, raised_by_run TEXT NOT NULL,
+  class TEXT NOT NULL CHECK (class IN ('routine','within-role','cross-role','gated')),
+  action TEXT NOT NULL,
+  route_to TEXT NOT NULL,
+  question TEXT NOT NULL,
+  options TEXT NOT NULL CHECK (json_valid(options) AND json_array_length(options) BETWEEN 2 AND 9),
+  recommendation TEXT NOT NULL,
+  task_ref TEXT CHECK (task_ref IS NULL OR (task_ref GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(task_ref, 9) GLOB '*[^0-9/]*' AND NOT substr(task_ref, 9) GLOB '*/*/*')), requirement_ref TEXT,
+  blocking INTEGER NOT NULL CHECK (blocking IN (0,1)),
+  supersedes TEXT REFERENCES decisions(id)
+, spec_path TEXT, spec_commit TEXT) STRICT;
+CREATE TABLE decision_events (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  at TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('seen','resolved','withdrawn','expired')),
+  by TEXT NOT NULL,
+  choice TEXT, note TEXT, via TEXT
+) STRICT;
+CREATE TABLE messages (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  from_role TEXT NOT NULL, from_run TEXT NOT NULL,
+  to_role TEXT NOT NULL,
+  class TEXT NOT NULL,
+  in_reply_to TEXT REFERENCES messages(id),
+  decision TEXT REFERENCES decisions(id),
+  corrects TEXT REFERENCES messages(id),
+  body TEXT NOT NULL
+, to_name TEXT) STRICT;
+CREATE TABLE deliveries (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  message TEXT NOT NULL REFERENCES messages(id),
+  at TEXT NOT NULL,
+  op TEXT NOT NULL CHECK (op IN ('routed','delivered','failed','read')),
+  holder_run TEXT, transport TEXT, address TEXT, detail TEXT
+) STRICT;
+CREATE TABLE task_snapshots (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  task_ref TEXT NOT NULL CHECK (task_ref GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(task_ref, 9) GLOB '*[^0-9/]*' AND NOT substr(task_ref, 9) GLOB '*/*/*'),
+  updated TEXT NOT NULL,
+  etag TEXT,
+  digest TEXT NOT NULL CHECK (length(digest) = 64 AND NOT digest GLOB '*[^0-9a-f]*'),
+  fields TEXT NOT NULL CHECK (json_valid(fields)),
+  source TEXT NOT NULL CHECK (source IN ('self','poll')),
+  via TEXT CHECK (via IN ('board','cursor','task','reconcile')),
+  read_at TEXT,
+  role TEXT, run TEXT,
+  CHECK ((source = 'self') = (role IS NOT NULL AND run IS NOT NULL)),
+  CHECK ((source = 'poll') = (via IS NOT NULL AND read_at IS NOT NULL)),
+  CHECK (json_type(fields, '$.bucket') IS 'integer'
+         OR (source IS 'poll' AND via IS 'task' AND json_type(fields, '$.gone') IS 'text'))
+) STRICT;
+CREATE INDEX task_snapshots_ref ON task_snapshots (business, task_ref, seq);
+CREATE TRIGGER decisions_resolve_once BEFORE INSERT ON decision_events
+  WHEN NEW.op IN ('resolved','withdrawn','expired') AND EXISTS (
+    SELECT 1 FROM decision_events WHERE decision = NEW.decision AND op IN ('resolved','withdrawn','expired'))
+  BEGIN SELECT RAISE(ABORT, 'decision already closed'); END;
+CREATE TRIGGER decisions_resolved_choice BEFORE INSERT ON decision_events
+  WHEN NEW.op = 'resolved' AND (NEW.choice IS NULL OR NOT EXISTS (
+    SELECT 1 FROM decisions d, json_each(d.options) o WHERE d.id = NEW.decision AND json_extract(o.value,'$.key') = NEW.choice))
+  BEGIN SELECT RAISE(ABORT, 'resolution must name one of the options'); END;
+CREATE TRIGGER role_one_holder BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'claim' AND (SELECT op FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'role already held'); END;
+CREATE TRIGGER role_release_by_holder BEFORE INSERT ON role_claims
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'role is not held'); END;
+CREATE TRIGGER role_release_same_run BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM role_claims WHERE business = NEW.business AND role = NEW.role ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER role_revoke_needs_decision BEFORE INSERT ON role_claims
+  WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
+  BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
+CREATE TRIGGER meta_no_update BEFORE UPDATE ON meta BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER meta_no_delete BEFORE DELETE ON meta BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER events_no_update BEFORE UPDATE ON events BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER events_no_delete BEFORE DELETE ON events BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER role_claims_no_update BEFORE UPDATE ON role_claims BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER role_claims_no_delete BEFORE DELETE ON role_claims BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER decisions_no_update BEFORE UPDATE ON decisions BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decisions_no_delete BEFORE DELETE ON decisions BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decision_events_no_update BEFORE UPDATE ON decision_events BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER decision_events_no_delete BEFORE DELETE ON decision_events BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER messages_no_update BEFORE UPDATE ON messages BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER messages_no_delete BEFORE DELETE ON messages BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER deliveries_no_update BEFORE UPDATE ON deliveries BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER deliveries_no_delete BEFORE DELETE ON deliveries BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER meta_no_replace BEFORE INSERT ON meta WHEN EXISTS (SELECT 1 FROM meta WHERE key = NEW.key) BEGIN SELECT RAISE(ABORT, 'meta is append-only'); END;
+CREATE TRIGGER events_no_replace BEFORE INSERT ON events WHEN EXISTS (SELECT 1 FROM events WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'events is append-only'); END;
+CREATE TRIGGER role_claims_no_replace BEFORE INSERT ON role_claims WHEN EXISTS (SELECT 1 FROM role_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'role_claims is append-only'); END;
+CREATE TRIGGER decisions_no_replace BEFORE INSERT ON decisions WHEN EXISTS (SELECT 1 FROM decisions WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'decisions is append-only'); END;
+CREATE TRIGGER decision_events_no_replace BEFORE INSERT ON decision_events WHEN EXISTS (SELECT 1 FROM decision_events WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'decision_events is append-only'); END;
+CREATE TRIGGER messages_no_replace BEFORE INSERT ON messages WHEN EXISTS (SELECT 1 FROM messages WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'messages is append-only'); END;
+CREATE TRIGGER deliveries_no_replace BEFORE INSERT ON deliveries WHEN EXISTS (SELECT 1 FROM deliveries WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'deliveries is append-only'); END;
+CREATE TRIGGER task_snapshots_no_update BEFORE UPDATE ON task_snapshots BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER task_snapshots_no_delete BEFORE DELETE ON task_snapshots BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER task_snapshots_no_replace BEFORE INSERT ON task_snapshots WHEN EXISTS (SELECT 1 FROM task_snapshots WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'task_snapshots is append-only'); END;
+CREATE TRIGGER decisions_blocking_needs_task BEFORE INSERT ON decisions
+  WHEN NEW.blocking = 1 AND NEW.task_ref IS NULL
+  BEGIN SELECT RAISE(ABORT, 'a blocking decision cites the task it blocks'); END;
+CREATE TRIGGER events_launch_by_human BEFORE INSERT ON events
+  WHEN NEW.kind IN ('launch.revoked','launch.restored') AND (NEW.actor_role IS NOT NULL OR NEW.actor_run IS NOT NULL)
+  BEGIN SELECT RAISE(ABORT, 'only the human revokes or restores launching'); END;
+CREATE TRIGGER events_credential_body BEFORE INSERT ON events
+  WHEN NEW.kind GLOB 'credential.*' AND (
+    json_extract(NEW.body, '$.service') IS NULL OR json_extract(NEW.body, '$.service') NOT IN ('gitea','vikunja')
+    OR json_extract(NEW.body, '$.instance') IS NULL)
+  BEGIN SELECT RAISE(ABORT, 'credential events name a service and a role instance'); END;
+CREATE TRIGGER events_task_missing_body BEFORE INSERT ON events
+  WHEN NEW.kind = 'task.missing' AND (
+    json_extract(NEW.body, '$.reason') IS NULL OR json_extract(NEW.body, '$.reason') NOT IN ('moved','not-found','no-access')
+    OR (json_extract(NEW.body, '$.reason') = 'moved' AND json_type(NEW.body, '$.project') IS NOT 'integer'))
+  BEGIN SELECT RAISE(ABORT, 'task.missing carries a reason, and the new project when moved'); END;
+CREATE TRIGGER events_task_subject BEFORE INSERT ON events
+  WHEN NEW.kind GLOB 'task.*' AND (NEW.subject IS NULL OR NOT (NEW.subject GLOB 'vikunja:[1-9]*/[1-9]*' AND NOT substr(NEW.subject, 9) GLOB '*[^0-9/]*' AND NOT substr(NEW.subject, 9) GLOB '*/*/*'))
+  BEGIN SELECT RAISE(ABORT, 'a task event names its task in subject'); END;
+CREATE TRIGGER events_task_created_body BEFORE INSERT ON events
+  WHEN NEW.kind = 'task.created' AND (
+    json_type(NEW.body, '$.request') IS NOT 'text'
+    OR NOT EXISTS (SELECT 1 FROM events WHERE id = json_extract(NEW.body, '$.request')
+                   AND kind = 'human.input' AND business = NEW.business)
+    OR json_type(NEW.body, '$.requirement') IS NOT 'text'
+    OR NOT json_extract(NEW.body, '$.requirement') GLOB 'REQ-[A-Z]*-[1-9]*'
+    OR json_extract(NEW.body, '$.requirement') GLOB 'REQ-*[^A-Z0-9-]*')
+  BEGIN SELECT RAISE(ABORT, 'task.created cites the human.input that asked for it and a requirement id'); END;
+CREATE VIEW launch_state AS
+  SELECT business, CASE kind WHEN 'launch.revoked' THEN 'revoked' ELSE 'allowed' END AS state, at
+  FROM events e WHERE kind IN ('launch.revoked','launch.restored')
+    AND seq = (SELECT max(seq) FROM events WHERE business = e.business AND kind IN ('launch.revoked','launch.restored'));
+CREATE VIEW task_external_changes AS
+  SELECT p.business, p.task_ref, p.seq, p.via, p.updated, p.digest, ls.digest AS self_digest
+  FROM task_snapshots p
+  LEFT JOIN task_snapshots ls ON ls.seq = (SELECT max(seq) FROM task_snapshots
+                                           WHERE business = p.business AND task_ref = p.task_ref AND source = 'self')
+  WHERE p.source = 'poll'
+    AND p.seq = (SELECT max(seq) FROM task_snapshots WHERE business = p.business AND task_ref = p.task_ref)
+    AND (ls.seq IS NULL OR (p.updated >= ls.updated AND p.read_at > ls.at AND p.digest <> ls.digest));
+CREATE VIEW task_current AS
+  SELECT s.seq, s.at, s.business, s.task_ref, s.updated, s.etag, s.digest, s.fields, s.source, s.via, s.read_at, s.role, s.run
+  FROM task_snapshots s
+  WHERE s.seq = (SELECT max(c.seq) FROM task_snapshots c
+                 WHERE c.business = s.business AND c.task_ref = s.task_ref
+                   AND (c.source = 'self'
+                        OR c.read_at > coalesce((SELECT ls.at FROM task_snapshots ls
+                                                 WHERE ls.business = c.business AND ls.task_ref = c.task_ref AND ls.source = 'self'
+                                                 ORDER BY ls.seq DESC LIMIT 1), '')));
+CREATE VIEW tasks_open AS
+  SELECT s.business, s.task_ref, json_extract(s.fields, '$.bucket') AS bucket, s.seq
+  FROM task_current s
+  WHERE json_type(s.fields, '$.gone') IS NULL
+    AND json_extract(s.fields, '$.done') = 0;
+CREATE VIEW urgent_inbox AS
+  SELECT d.id, d.business, d.task_ref, d.question, d.at
+  FROM decisions d
+  WHERE d.class = 'gated' AND d.blocking = 1
+    AND NOT EXISTS (SELECT 1 FROM decision_events x WHERE x.decision = d.id AND x.op IN ('resolved','withdrawn','expired'));
+CREATE TABLE task_comment_cursors (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  business TEXT NOT NULL,
+  task_id INTEGER NOT NULL CHECK (task_id > 0),
+  last_comment INTEGER NOT NULL CHECK (last_comment > 0)
+) STRICT;
+CREATE INDEX task_comment_cursors_latest ON task_comment_cursors (business, task_id, seq);
+CREATE TRIGGER task_comment_cursors_no_update BEFORE UPDATE ON task_comment_cursors
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_no_delete BEFORE DELETE ON task_comment_cursors
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_no_replace BEFORE INSERT ON task_comment_cursors
+  WHEN EXISTS (SELECT 1 FROM task_comment_cursors WHERE seq = NEW.seq)
+  BEGIN SELECT RAISE(ABORT, 'task_comment_cursors is append-only'); END;
+CREATE TRIGGER task_comment_cursors_forward BEFORE INSERT ON task_comment_cursors
+  WHEN NEW.last_comment <= COALESCE((SELECT last_comment FROM task_comment_cursors
+    WHERE business = NEW.business AND task_id = NEW.task_id ORDER BY seq DESC LIMIT 1), 0)
+  BEGIN SELECT RAISE(ABORT, 'comment cursor must advance'); END;
+CREATE TABLE projects (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  name TEXT NOT NULL,
+  repo TEXT,
+  created_by TEXT NOT NULL,
+  UNIQUE (business, name)
+) STRICT;
+CREATE TABLE threads (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  project TEXT NOT NULL REFERENCES projects(id),
+  instance TEXT NOT NULL,
+  owner TEXT NOT NULL,
+  name TEXT NOT NULL,
+  UNIQUE (project, name)
+) STRICT;
+CREATE TABLE sessions (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  id TEXT NOT NULL UNIQUE,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  instance TEXT NOT NULL,
+  owner TEXT NOT NULL,
+  name TEXT NOT NULL,
+  op TEXT NOT NULL,
+  predecessor TEXT REFERENCES sessions(id),
+  UNIQUE (thread, name),
+  UNIQUE (thread, op)
+) STRICT;
+CREATE TABLE session_defaults (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  by TEXT NOT NULL
+) STRICT;
+CREATE TABLE thread_claims (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  generation INTEGER NOT NULL CHECK (generation >= 1),
+  op TEXT NOT NULL CHECK (op IN ('claim','release','revoke')),
+  holder_run TEXT NOT NULL,
+  harness TEXT NOT NULL, address TEXT,
+  by TEXT NOT NULL, reason TEXT,
+  decision TEXT
+) STRICT;
+CREATE TABLE message_threads (
+  message TEXT PRIMARY KEY REFERENCES messages(id),
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id)
+) STRICT;
+CREATE TABLE thread_opens (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  thread TEXT NOT NULL REFERENCES threads(id),
+  session TEXT NOT NULL REFERENCES sessions(id),
+  by TEXT NOT NULL
+) STRICT;
+CREATE INDEX thread_claims_thread ON thread_claims (thread, seq);
+CREATE INDEX thread_claims_session ON thread_claims (session, seq);
+CREATE INDEX message_threads_thread ON message_threads (thread);
+CREATE INDEX message_threads_session ON message_threads (session);
+CREATE INDEX session_defaults_thread ON session_defaults (thread, seq);
+CREATE TRIGGER threads_project_business BEFORE INSERT ON threads
+  WHEN (SELECT business FROM projects WHERE id = NEW.project) IS NOT NEW.business
+  BEGIN SELECT RAISE(ABORT, 'a thread belongs to its project''s business'); END;
+CREATE TRIGGER sessions_thread_match BEFORE INSERT ON sessions
+  WHEN NOT EXISTS (SELECT 1 FROM threads t WHERE t.id = NEW.thread AND t.business = NEW.business AND t.instance = NEW.instance AND t.owner = NEW.owner)
+  BEGIN SELECT RAISE(ABORT, 'a session has its thread''s business, instance and owner'); END;
+CREATE TRIGGER sessions_predecessor BEFORE INSERT ON sessions
+  WHEN NEW.predecessor IS NOT NULL AND (SELECT thread FROM sessions WHERE id = NEW.predecessor) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a session''s predecessor is in its thread'); END;
+CREATE TRIGGER sessions_id_not_thread BEFORE INSERT ON sessions
+  WHEN NEW.id IS NOT NEW.thread AND EXISTS (SELECT 1 FROM threads WHERE id = NEW.id)
+  BEGIN SELECT RAISE(ABORT, 'a session id names another thread'); END;
+CREATE TRIGGER threads_id_not_session BEFORE INSERT ON threads
+  WHEN EXISTS (SELECT 1 FROM sessions WHERE id = NEW.id)
+  BEGIN SELECT RAISE(ABORT, 'a thread id names a session'); END;
+CREATE TRIGGER session_defaults_match BEFORE INSERT ON session_defaults
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a default session is in its thread'); END;
+CREATE TRIGGER thread_one_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND (SELECT op FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) = 'claim'
+  BEGIN SELECT RAISE(ABORT, 'session already held'); END;
+CREATE TRIGGER thread_one_per_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'claim' AND EXISTS (SELECT 1 FROM thread_claims c WHERE c.holder_run = NEW.holder_run AND c.business = NEW.business
+    AND c.seq = (SELECT max(seq) FROM thread_claims WHERE session = c.session) AND c.op = 'claim')
+  BEGIN SELECT RAISE(ABORT, 'run already holds a session'); END;
+CREATE TRIGGER thread_release_by_holder BEFORE INSERT ON thread_claims
+  WHEN NEW.op IN ('release','revoke') AND COALESCE((SELECT op FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1),'') <> 'claim'
+  BEGIN SELECT RAISE(ABORT, 'session is not held'); END;
+CREATE TRIGGER thread_release_same_run BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'release' AND (SELECT holder_run FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) <> NEW.holder_run
+  BEGIN SELECT RAISE(ABORT, 'only the holder releases; others revoke'); END;
+CREATE TRIGGER thread_claim_generation BEFORE INSERT ON thread_claims
+  WHEN NEW.generation IS NOT (CASE WHEN NEW.op = 'claim'
+    THEN 1 + (SELECT count(*) FROM thread_claims WHERE session = NEW.session AND op = 'claim')
+    ELSE (SELECT generation FROM thread_claims WHERE session = NEW.session ORDER BY seq DESC LIMIT 1) END)
+  BEGIN SELECT RAISE(ABORT, 'a claim row names its session''s generation'); END;
+CREATE TRIGGER thread_revoke_needs_decision BEFORE INSERT ON thread_claims
+  WHEN NEW.op = 'revoke' AND NEW.decision IS NULL AND NEW.reason IS NULL
+  BEGIN SELECT RAISE(ABORT, 'revoke needs a resolved decision or a reason'); END;
+CREATE TRIGGER thread_claims_business BEFORE INSERT ON thread_claims
+  WHEN (SELECT business FROM threads WHERE id = NEW.thread) IS NOT NEW.business
+  BEGIN SELECT RAISE(ABORT, 'a thread claim names the thread''s business'); END;
+CREATE TRIGGER thread_claims_session BEFORE INSERT ON thread_claims
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a claim''s session is in its thread'); END;
+CREATE TRIGGER message_threads_match BEFORE INSERT ON message_threads
+  WHEN NOT EXISTS (SELECT 1 FROM messages m JOIN threads t ON t.id = NEW.thread
+    WHERE m.id = NEW.message AND m.business = t.business AND t.instance IN (m.to_role, m.from_role))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message is to or from the thread''s instance'); END;
+CREATE TRIGGER message_threads_session BEFORE INSERT ON message_threads
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'a threaded message''s session is in its thread'); END;
+CREATE TRIGGER thread_opens_session BEFORE INSERT ON thread_opens
+  WHEN (SELECT thread FROM sessions WHERE id = NEW.session) IS NOT NEW.thread
+  BEGIN SELECT RAISE(ABORT, 'an open''s session is in its thread'); END;
+CREATE TRIGGER delivery_same_session BEFORE INSERT ON deliveries
+  WHEN NEW.op IN ('routed','delivered') AND (NEW.op = 'delivered' OR NEW.holder_run IS NOT NULL)
+    AND EXISTS (SELECT 1 FROM message_threads mt JOIN messages m ON m.id = mt.message JOIN threads t ON t.id = mt.thread
+      WHERE mt.message = NEW.message AND m.to_role = t.instance
+        AND NOT EXISTS (SELECT 1 FROM thread_claims c WHERE c.seq = (SELECT max(seq) FROM thread_claims WHERE session = mt.session)
+          AND c.op = 'claim' AND c.holder_run IS NEW.holder_run))
+  BEGIN SELECT RAISE(ABORT, 'a threaded message goes only to its session''s holder'); END;
+CREATE TRIGGER projects_no_update BEFORE UPDATE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER projects_no_delete BEFORE DELETE ON projects BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER projects_no_replace BEFORE INSERT ON projects WHEN EXISTS (SELECT 1 FROM projects WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'projects is append-only'); END;
+CREATE TRIGGER threads_no_update BEFORE UPDATE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER threads_no_delete BEFORE DELETE ON threads BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER threads_no_replace BEFORE INSERT ON threads WHEN EXISTS (SELECT 1 FROM threads WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'threads is append-only'); END;
+CREATE TRIGGER sessions_no_update BEFORE UPDATE ON sessions BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER sessions_no_delete BEFORE DELETE ON sessions BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER sessions_no_replace BEFORE INSERT ON sessions WHEN EXISTS (SELECT 1 FROM sessions WHERE seq = NEW.seq OR id = NEW.id) BEGIN SELECT RAISE(ABORT, 'sessions is append-only'); END;
+CREATE TRIGGER session_defaults_no_update BEFORE UPDATE ON session_defaults BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER session_defaults_no_delete BEFORE DELETE ON session_defaults BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER session_defaults_no_replace BEFORE INSERT ON session_defaults WHEN EXISTS (SELECT 1 FROM session_defaults WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'session_defaults is append-only'); END;
+CREATE TRIGGER thread_claims_no_update BEFORE UPDATE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_delete BEFORE DELETE ON thread_claims BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER thread_claims_no_replace BEFORE INSERT ON thread_claims WHEN EXISTS (SELECT 1 FROM thread_claims WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_claims is append-only'); END;
+CREATE TRIGGER message_threads_no_update BEFORE UPDATE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_delete BEFORE DELETE ON message_threads BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER message_threads_no_replace BEFORE INSERT ON message_threads WHEN EXISTS (SELECT 1 FROM message_threads WHERE message = NEW.message) BEGIN SELECT RAISE(ABORT, 'message_threads is append-only'); END;
+CREATE TRIGGER thread_opens_no_update BEFORE UPDATE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_delete BEFORE DELETE ON thread_opens BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TRIGGER thread_opens_no_replace BEFORE INSERT ON thread_opens WHEN EXISTS (SELECT 1 FROM thread_opens WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'thread_opens is append-only'); END;
+CREATE TABLE instance_names (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  instance TEXT NOT NULL,
+  name TEXT NOT NULL,
+  by TEXT NOT NULL
+) STRICT;
+CREATE TRIGGER instance_names_unique BEFORE INSERT ON instance_names
+  WHEN EXISTS (SELECT 1 FROM instance_names n WHERE n.business = NEW.business AND n.name = NEW.name
+    AND n.instance <> NEW.instance
+    AND n.seq = (SELECT max(seq) FROM instance_names WHERE business = n.business AND instance = n.instance))
+  BEGIN SELECT RAISE(ABORT, 'an instance name is unique in its business'); END;
+CREATE TRIGGER instance_names_no_update BEFORE UPDATE ON instance_names BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+CREATE TRIGGER instance_names_no_delete BEFORE DELETE ON instance_names BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+CREATE TRIGGER instance_names_no_replace BEFORE INSERT ON instance_names WHEN EXISTS (SELECT 1 FROM instance_names WHERE seq = NEW.seq) BEGIN SELECT RAISE(ABORT, 'instance_names is append-only'); END;
+-- Row 124 (#1618): immutable source snapshots and turn outcomes, never transcript text.
+CREATE TABLE usage_records (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  at TEXT NOT NULL,
+  business TEXT NOT NULL,
+  run TEXT NOT NULL,
+  instance TEXT NOT NULL,
+  provider TEXT,
+  model TEXT,
+  account TEXT,
+  turn TEXT NOT NULL,
+  source TEXT NOT NULL,
+  phase TEXT NOT NULL CHECK (phase IN ('begin','end')),
+  status TEXT NOT NULL CHECK (status IN ('known','unknown')),
+  code TEXT,
+  cursor TEXT CHECK (cursor IS NULL OR json_valid(cursor)),
+  input INTEGER,
+  output INTEGER,
+  cache_write INTEGER,
+  cache_read INTEGER,
+  UNIQUE (business,run,turn,source,phase),
+  CHECK ((status='unknown' AND input IS NULL AND output IS NULL AND cache_write IS NULL AND cache_read IS NULL)
+    OR (status='known' AND input >= 0 AND output >= 0 AND cache_write >= 0 AND cache_read >= 0
+      AND input IS NOT NULL AND output IS NOT NULL AND cache_write IS NOT NULL AND cache_read IS NOT NULL))
+) STRICT;
+CREATE TRIGGER usage_records_no_update BEFORE UPDATE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TRIGGER usage_records_no_delete BEFORE DELETE ON usage_records BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TRIGGER usage_records_no_replace BEFORE INSERT ON usage_records WHEN EXISTS (SELECT 1 FROM usage_records WHERE seq=NEW.seq OR (business=NEW.business AND run=NEW.run AND turn=NEW.turn AND source=NEW.source AND phase=NEW.phase)) BEGIN SELECT RAISE(ABORT, 'usage_records is append-only'); END;
+CREATE TABLE hosts (
+  business TEXT NOT NULL,
+  host TEXT NOT NULL,
+  address TEXT NOT NULL,
+  port INTEGER NOT NULL CHECK (port BETWEEN 1 AND 65535),
+  user TEXT NOT NULL,
+  sudo INTEGER NOT NULL CHECK (sudo IN (0,1)),
+  host_keys TEXT NOT NULL CHECK (json_valid(host_keys) AND json_type(host_keys) = 'array' AND json_array_length(host_keys) > 0),
+  installer_fingerprint TEXT,
+  state TEXT NOT NULL CHECK (state IN ('pending-install','ready')),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  checked_at TEXT,
+  PRIMARY KEY (business, host),
+  CHECK (state = 'pending-install' OR (installer_fingerprint IS NOT NULL AND checked_at IS NOT NULL))
+) STRICT;
+CREATE TABLE host_grants (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  host TEXT NOT NULL,
+  commands TEXT NOT NULL CHECK (json_valid(commands) AND json_type(commands) = 'array' AND json_array_length(commands) > 0),
+  rotate_by TEXT NOT NULL,
+  tag TEXT NOT NULL CHECK (length(tag) = 39 AND tag GLOB 'mosaic-*' AND NOT substr(tag, 8) GLOB '*[^0-9a-f]*'),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent, host),
+  FOREIGN KEY (business, host) REFERENCES hosts(business, host)
+) STRICT;
+CREATE TRIGGER events_grant_actor BEFORE INSERT ON events
+  WHEN NEW.kind = 'action.allowed'
+    AND (json_extract(NEW.body, '$.action') GLOB 'grant.*' OR json_extract(NEW.body, '$.operation') GLOB 'grant.*')
+    AND NOT (NEW.actor_role IS NULL AND NEW.actor_run IS 'grant')
+  BEGIN SELECT RAISE(ABORT, 'only the grant writer records grant events'); END;
+CREATE TABLE gitea_users (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  user TEXT NOT NULL,
+  id INTEGER NOT NULL CHECK (id > 0),
+  nonce TEXT NOT NULL CHECK (length(nonce) = 16 AND NOT nonce GLOB '*[^0-9a-f]*'),
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent)
+) STRICT;
+CREATE TABLE gitea_grants (
+  business TEXT NOT NULL,
+  agent TEXT NOT NULL,
+  user TEXT NOT NULL,
+  token_id INTEGER NOT NULL CHECK (token_id > 0),
+  token_name TEXT NOT NULL,
+  projects TEXT NOT NULL CHECK (json_valid(projects) AND json_type(projects) = 'array' AND json_array_length(projects) > 0),
+  rotate_by TEXT NOT NULL,
+  decision TEXT NOT NULL REFERENCES decisions(id),
+  PRIMARY KEY (business, agent),
+  FOREIGN KEY (business, agent) REFERENCES gitea_users(business, agent)
+) STRICT;
@@ -34,11 +34,12 @@ function source3j(t) {
 }
 // Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
 const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
-const later3l = (r) => SESSIONS_3L.includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
+// Row 206 (#1704): and the 3l→3m step's thread_shares. thread-shares.test.mjs tests it.
+const later3l = (r) => [...SESSIONS_3L, 'thread_shares'].includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
 function rows(path) {
  const db = new DatabaseSync(path, { readOnly: true });
  try {
-    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('gitea_users','gitea_grants','sessions','session_defaults')").all()
+    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('gitea_users','gitea_grants','sessions','session_defaults','thread_shares')").all()
      .map(({ name }) => [name, db.prepare(`SELECT * FROM ${name} ORDER BY rowid`).all()
        .filter(r => name !== 'meta' || !['schema_version', 'schema_digest'].includes(r.key)).map(r => ({ ...r }))]));
  } finally { db.close(); }
@@ -74,6 +75,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
    copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
  writeFileSync(join(moduleRoot, 'src/migrations/3j-3k.sql'), step(readFileSync(here('../src/migrations/3j-3k.sql'), 'utf8')));
  copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
+  copyFileSync(here('../src/migrations/3l-3m.sql'), join(moduleRoot, 'src/migrations/3l-3m.sql'));
  return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }
 function fresh(t) {
@@ -95,7 +97,7 @@ test('3j copy migrates to 3k: every row kept, and sqlite_master gains only the t
  const { root, path } = source3j(t), before = rows(path), was = master(path);
  assert.throws(() => new Store(root), /schema-mismatch/);
  new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
  assert.deepEqual(migrated3l(rows(path)), before);
  const now = master(path);
  assert.deepEqual(now.filter(r => !NEW.includes(r.name) && !later3l(r)), was.filter(r => !later3l(r)));
@@ -121,7 +123,7 @@ test('a 3j→3k step that fails partway leaves the store at 3j with every row an
  assert.deepEqual(master(path), was);
  assert.deepEqual(rows(path), before);
  new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
 });

 test('the 3j engine refuses a migrated store, migrating or not, and leaves it as it was', async t => {
@@ -132,14 +134,14 @@ test('the 3j engine refuses a migrated store, migrating or not, and leaves it as
    schema: ddl3j,
    store: (source) => source
      .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3j).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3j';")
+      .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3j';")
      .replace(/\}, \{\n {2}\/\/ Row 236 \(#1742[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
  });
  const pinned = readFileSync(join(root, 'engine-3j/src/store.mjs'), 'utf8');
  assert.ok(pinned.includes("export const SCHEMA_VERSION = '3j';") && !pinned.includes('3j-3k'), 'the 3j engine has no 3j→3k step');
  assert.throws(() => new Store3j(root), /schema-mismatch/);
  assert.throws(() => new Store3j(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
  assert.deepEqual(master(path), was);
  assert.deepEqual(rows(path), after);
 });
@@ -20,7 +20,8 @@ const NEW = ['hosts', 'host_grants', 'events_grant_actor', 'sqlite_autoindex_hos
 const LATER = ['gitea_users', 'gitea_grants', 'sqlite_autoindex_gitea_users_1', 'sqlite_autoindex_gitea_grants_1'];
 // Row 264a (#1769): what the 3k→3l step rebuilds or adds. sessions.test.mjs tests those objects.
 const SESSIONS_3L = ['sessions', 'session_defaults', 'thread_claims', 'message_threads', 'thread_opens'];
-const later3l = (r) => SESSIONS_3L.includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
+// Row 206 (#1704): and the 3l→3m step's thread_shares. thread-shares.test.mjs tests it.
+const later3l = (r) => [...SESSIONS_3L, 'thread_shares'].includes(r.tbl_name) || ['delivery_same_thread', 'delivery_same_session', 'threads_id_not_session'].includes(r.name);
 function source3i(t) {
  const root = mkdtempSync(join(tmpdir(), 'grant-migrate-'));
  t.after(() => rmSync(root, { recursive: true, force: true }));
@@ -40,7 +41,7 @@ function source3i(t) {
 function rows(path) {
  const db = new DatabaseSync(path, { readOnly: true });
  try {
-    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('hosts','host_grants','gitea_users','gitea_grants','sessions','session_defaults')").all()
+    return Object.fromEntries(db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('hosts','host_grants','gitea_users','gitea_grants','sessions','session_defaults','thread_shares')").all()
      .map(({ name }) => [name, db.prepare(`SELECT * FROM ${name} ORDER BY rowid`).all()
        .filter(r => name !== 'meta' || !['schema_version', 'schema_digest'].includes(r.key)).map(r => ({ ...r }))]));
  } finally { db.close(); }
@@ -77,6 +78,7 @@ async function engine(root, name, { store, schema, step = (s) => s }) {
  writeFileSync(join(moduleRoot, 'src/migrations/3i-3j.sql'), step(readFileSync(here('../src/migrations/3i-3j.sql'), 'utf8')));
  copyFileSync(here('../src/migrations/3j-3k.sql'), join(moduleRoot, 'src/migrations/3j-3k.sql'));
  copyFileSync(here('../src/migrations/3k-3l.sql'), join(moduleRoot, 'src/migrations/3k-3l.sql'));
+  copyFileSync(here('../src/migrations/3l-3m.sql'), join(moduleRoot, 'src/migrations/3l-3m.sql'));
  return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
 }
 function fresh(t) {
@@ -100,7 +102,7 @@ test('3i copy migrates to 3j: every row kept, and sqlite_master gains only the t
  const { root, path } = source3i(t), before = rows(path), was = master(path);
  assert.throws(() => new Store(root), /schema-mismatch/);
  new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
  assert.deepEqual(migrated3l(rows(path)), before);
  const now = master(path).filter(r => !LATER.includes(r.name));
  assert.deepEqual(now.filter(r => !NEW.includes(r.name) && !later3l(r)), was.filter(r => !later3l(r)));
@@ -125,7 +127,7 @@ test('a 3i→3j step that fails partway leaves the store at 3i with every row an
  assert.deepEqual(master(path), was);
  assert.deepEqual(rows(path), before);
  new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
 });

 test('the 3i engine refuses a migrated store, migrating or not, and leaves it as it was', async t => {
@@ -136,14 +138,14 @@ test('the 3i engine refuses a migrated store, migrating or not, and leaves it as
    schema: ddl3i,
    store: (source) => source
      .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3i).digest('hex')}';`)
-      .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3i';")
+      .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3i';")
      .replace(/\}, \{\n {2}\/\/ Row 234 \(#1740\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables'),
  });
  const pinned = readFileSync(join(root, 'engine-3i/src/store.mjs'), 'utf8');
  assert.ok(pinned.includes("export const SCHEMA_VERSION = '3i';") && !pinned.includes('3i-3j'), 'the 3i engine has no 3i→3j step');
  assert.throws(() => new Store3i(root), /schema-mismatch/);
  assert.throws(() => new Store3i(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
  assert.deepEqual(master(path), was);
  assert.deepEqual(rows(path), after);
 });
@@ -65,7 +65,7 @@ test('3f copy migrates to 3g preserving every old column/row, with an empty inst
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
    assert.deepEqual({ ...store.get('SELECT to_name FROM messages') }, { to_name: null });
    assert.equal(store.get('SELECT count(*) AS n FROM instance_names').n, 0);
    assert.deepEqual({ ...store.get('SELECT spec_path,spec_commit FROM decisions') }, { spec_path: 'docs/spec.md', spec_commit: 'c'.repeat(40) });
@@ -522,7 +522,8 @@ test('v3b prototype refusals, views and append-only mutations', (t) => {
  // Row 234 (#1740) adds hosts, host_grants and the events_grant_actor guard; grant-migration.test.mjs tests them.
  // Row 236 (#1742) adds gitea_users and gitea_grants; gitea-migration.test.mjs tests them.
  // Row 264a (#1769) adds sessions, session_defaults and 15 triggers; sessions.test.mjs tests them.
-  assert.equal(count('table') - 1, 22);
-  assert.equal(count('trigger'), 86);
+  // Row 206 (#1704) adds thread_shares and its 3 append-only triggers; thread-shares.test.mjs tests them.
+  assert.equal(count('table') - 1, 23);
+  assert.equal(count('trigger'), 89);
  assert.equal(count('view'), 5);
 });
@@ -374,7 +374,7 @@ test('T7: a 3k store migrates to 3l, each thread\'s default session has the thre
  const { root, path } = source3k(t);
  assert.throws(() => new Store(root), /schema-mismatch/);
  new Store(root, { migrateSchema: true }).close();
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
  // The migrated schema is the fresh one, object for object.
  const freshRoot = mkdtempSync(join(tmpdir(), 'sessions-fresh-'));
  t.after(() => rmSync(freshRoot, { recursive: true, force: true }));
@@ -430,7 +430,7 @@ async function engine3k(root) {
  const source = readFileSync(here('../src/store.mjs'), 'utf8');
  const edited = source
    .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3k).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3k';")
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3k';")
    .replace(/\}, \{\n {2}\/\/ Row 264a \(#1769\)[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
  assert.ok(edited.includes("export const SCHEMA_VERSION = '3k';") && edited.includes('3j-3k') && !edited.includes('3k-3l'), 'the 3k engine has no 3k→3l step');
  writeFileSync(join(moduleRoot, 'src/store.mjs'), edited);
@@ -447,7 +447,7 @@ test('T7 D9: the 3k engine refuses a 3l store, migrating or not, and leaves it a
  const Store3k = await engine3k(root);
  assert.throws(() => new Store3k(root), /schema-mismatch/);
  assert.throws(() => new Store3k(root, { migrateSchema: true }), /schema-mismatch/);
-  assert.equal(version(path), '3l');
+  assert.equal(version(path), '3m');
  assert.deepEqual(master(path), was);
  assert.deepEqual(rows(path), before);
  // The same engine opens a fresh 3k store, so the refusal is the version's and not a broken copy.
@@ -63,7 +63,7 @@ test('3e copy migrates through 3f to 3g preserving every old column/row and addi
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
    assert.deepEqual({ ...store.get('SELECT spec_path,spec_commit FROM decisions') }, { spec_path: null, spec_commit: null });
    assert.equal(store.get('PRAGMA quick_check').quick_check, 'ok');
    assert.deepEqual(store.all('PRAGMA foreign_key_check'), []);
@@ -49,7 +49,7 @@ async function database3d(t) {
  const source = readFileSync(here('../src/store.mjs'), 'utf8');
  const pinned = source
    .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3d).digest('hex')}';`)
-    .replace("export const SCHEMA_VERSION = '3l';", "export const SCHEMA_VERSION = '3d';")
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3d';")
    .replace(/\}, \{\n {2}from: '3d',[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
  assert.ok(!pinned.includes('3d-3e'), 'the 3d engine has no 3d→3e step');
  writeFileSync(join(moduleRoot, 'src/store.mjs'), pinned);
@@ -101,7 +101,7 @@ test('REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and l
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  t.after(() => store.close());
-  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+  assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
  for (const table of ['projects', 'threads', 'thread_claims', 'message_threads', 'thread_opens'])
    assert.equal(store.get(`SELECT count(*) n FROM ${table}`).n, 0, table);
  // Parked: the undelivered ones are counted per business and role, and none is changed or given a thread.
@@ -161,5 +161,5 @@ test('REQ-THREAD-1: the offline command prints the kept-message counts before th
  const command = new URL('../src/migrate-schema.mjs', import.meta.url).pathname;
  const migrated = spawnSync(process.execPath, [command, root], { encoding: 'utf8' });
  assert.equal(migrated.status, 0, migrated.stderr);
-  assert.equal(migrated.stdout, [...REPORT, 'bus schema 3l ready', ''].join('\n'));
+  assert.equal(migrated.stdout, [...REPORT, 'bus schema 3m ready', ''].join('\n'));
 });
@@ -0,0 +1,439 @@
+// Row 206 (193b2, #1704, row 193 design 5.2-5.6): a thread owner's read-only shares. The owner shares
+// a thread with a user, the business human or everyone; #readable lets a sharee read it while the
+// share is in force, the sharee's grant still covers it and a user owner's grant does too. Every
+// write verb keeps the owner check. Mutants 2, 3, 4, 7, 8 and 9 of design section 8 die here.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { DatabaseSync } from 'node:sqlite';
+import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { Store, schemaDigest } from '../src/store.mjs';
+import { Broker } from '../src/broker.mjs';
+
+const shipped = (name) =>
+  JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), 'utf8'));
+const here = (p) => new URL(p, import.meta.url);
+const grant = (over = {}) => ({
+  id: 'g-1', user: 'alice', business: 'demo', projects: ['*'], instances: ['assistant'], level: 'collaborator', ...over,
+});
+
+// As user-principal.test.mjs: the access document is a function each test edits between requests.
+function setup(t) {
+  const root = mkdtempSync(join(tmpdir(), 'bus-thread-shares-'));
+  const store = new Store(root);
+  t.after(() => {
+    store.close();
+    rmSync(root, { recursive: true, force: true });
+  });
+  const access = { doc: { accessVersion: 1, revision: 1, users: [], grants: [] }, fail: false };
+  const b = new Broker({
+    store,
+    businesses: {
+      demo: {
+        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
+        roles: {
+          chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+          assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
+        },
+        definitions: { 'chief-of-staff': {}, assistant: { messaging: shipped('assistant').messaging } },
+      },
+    },
+    access: () => {
+      if (access.fail) throw new Error('access file refused');
+      return access.doc;
+    },
+  });
+  const caps = {
+    human: b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }),
+    reader: b.bindReader({ business: 'demo' }),
+    tester: b.bindTester({ business: 'demo' }),
+  };
+  const call = (who, verb, args = {}) => b.request(caps[who], { verb, args });
+  const code = (who, verb, args = {}) => {
+    try {
+      call(who, verb, args);
+    } catch (e) {
+      return e.code;
+    }
+    return null;
+  };
+  const p1 = call('human', 'project.create', { name: 'shared' }).id;
+  const p2 = call('human', 'project.create', { name: 'private' }).id;
+  // alice and bob hold collaborator grants on p1, carol on p2 only.
+  const base = () => [grant({ projects: [p1] }), grant({ id: 'g-2', user: 'bob', projects: [p1] }), grant({ id: 'g-3', user: 'carol', projects: [p2] })];
+  access.doc.grants = base();
+  for (const name of ['alice', 'bob', 'carol']) caps[name] = b.bindUser({ business: 'demo', user: name });
+  const A = call('alice', 'thread.create', { project: p1, name: 'alice work' }).id;
+  const sent = call('alice', 'thread.send', { thread: A, body: 'alice: hello' }).id;
+  const H = call('human', 'thread.create', { project: p1, name: 'owner work' }).id;
+  call('human', 'thread.send', { thread: H, body: 'jason: hello' });
+  const rows = () => store.get('SELECT count(*) n FROM thread_shares').n;
+  const read = (who, thread) => call(who, 'thread.messages', { thread }).map((m) => m.body);
+  return { b, store, access, caps, call, code, p1, p2, base, A, sent, H, rows, read };
+}
+
+test('a share lets the sharee read the thread and nothing else: every write verb stays the owner\'s (mutants 7, 9)', (t) => {
+  const { call, code, A, p1, rows, read } = setup(t);
+  assert.equal(code('bob', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('bob', 'thread.list', { shared: true }), []);
+  assert.deepEqual(call('alice', 'thread.share', { thread: A, to: 'user:bob' }), { thread: A, to: 'user:bob', op: 'share' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  const [listed] = call('bob', 'thread.list', { shared: true });
+  assert.deepEqual(Object.keys(listed), ['id', 'at', 'project', 'instance', 'name', 'owner']);
+  assert.deepEqual({ ...listed, at: null }, { id: A, at: null, project: p1, instance: 'assistant', name: 'alice work', owner: 'user:alice' });
+  // The plain list keeps its shape and holds only bob's own threads.
+  assert.deepEqual(call('bob', 'thread.list'), []);
+  assert.deepEqual(Object.keys(call('alice', 'thread.list')[0]), ['id', 'at', 'project', 'instance', 'name']);
+  // Mutant 7 (#threadRead for thread.send) and mutant 9 (no owner check on thread.share) die here.
+  for (const [verb, args] of [
+    ['thread.send', { body: 'bob was here' }],
+    ['thread.open', {}],
+    ['thread.share', { to: '*' }],
+    ['thread.share', { to: 'jason' }],
+    ['thread.unshare', { to: 'user:bob' }],
+    ['thread.shares', {}],
+  ]) assert.equal(code('bob', verb, { thread: A, ...args }), 'thread-not-owned', verb);
+  assert.equal(rows(), 1);
+  assert.deepEqual(read('alice', A), ['alice: hello']);
+  // The share is bob's alone: the owner and carol still can't read.
+  assert.equal(code('human', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('human', 'thread.list', { shared: true }), []);
+  assert.equal(code('carol', 'thread.messages', { thread: A }), 'thread-not-owned');
+});
+
+test('the business human shares too, and a `*` share reaches every covered principal but the tester', (t) => {
+  const { call, code, A, H, rows, read } = setup(t);
+  assert.deepEqual(call('human', 'thread.share', { thread: H, to: 'user:alice' }), { thread: H, to: 'user:alice', op: 'share' });
+  assert.deepEqual(read('alice', H), ['jason: hello']);
+  assert.equal(code('bob', 'thread.messages', { thread: H }), 'thread-not-owned');
+  assert.deepEqual(call('alice', 'thread.share', { thread: A, to: '*' }), { thread: A, to: '*', op: 'share' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  assert.deepEqual(read('human', A), ['alice: hello']);
+  assert.deepEqual(call('human', 'thread.list', { shared: true }).map((x) => x.id), [A]);
+  // Rule 2: carol's grant doesn't cover p1, so `*` doesn't reach her. Rule 4: nor the tester.
+  assert.equal(code('carol', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('carol', 'thread.list', { shared: true }), []);
+  assert.equal(code('tester', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('tester', 'thread.list', { shared: true }), []);
+  assert.deepEqual(call('alice', 'thread.shares', { thread: A }).map((x) => [x.to, x.by]), [['*', 'user:alice']]);
+  assert.deepEqual(call('human', 'thread.shares', { thread: H }).map((x) => [x.to, x.by]), [['user:alice', 'jason']]);
+  assert.equal(rows(), 2);
+});
+
+test('mutant 2: a share never widens a grant; when the sharee\'s grant stops covering the thread, its reads end', (t) => {
+  const { access, call, code, base, A, p2, read } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'user:bob' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  // bob keeps a collaborator grant, so the user gate passes, but it now covers p2 only.
+  access.doc.grants = base().map((g) => (g.user === 'bob' ? { ...g, projects: [p2] } : g));
+  assert.equal(code('bob', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('bob', 'thread.list', { shared: true }), []);
+  // A grant on another instance is the same.
+  access.doc.grants = base().map((g) => (g.user === 'bob' ? { ...g, instances: ['chief'] } : g));
+  assert.equal(code('bob', 'thread.messages', { thread: A }), 'thread-not-owned');
+  access.doc.grants = base();
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  // Removed, expired or an unreadable file: the gate refuses bob's next request.
+  for (const [what, change] of [
+    ['removed', () => { access.doc.grants = base().filter((g) => g.user !== 'bob'); }],
+    ['expired', () => { access.doc.grants = base().map((g) => (g.user === 'bob' ? { ...g, expires: '2000-01-01T00:00:00Z' } : g)); }],
+    ['unreadable', () => { access.fail = true; }],
+  ]) {
+    change();
+    assert.equal(code('bob', 'thread.messages', { thread: A }), 'access-revoked', what);
+    access.doc.grants = base();
+    access.fail = false;
+    assert.deepEqual(read('bob', A), ['alice: hello'], what);
+  }
+});
+
+test('mutant 3: a thread whose user owner has lost coverage is hidden from its sharees, the owner\'s board included', (t) => {
+  const { access, call, code, base, A, sent, read } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'jason' });
+  assert.deepEqual(read('human', A), ['alice: hello']);
+  assert.ok(call('human', 'trail', { subject: sent }).some((r) => r.table === 'messages' && r.id === sent));
+  assert.ok(call('reader', 'trail', { subject: sent }).some((r) => r.table === 'messages' && r.id === sent));
+  for (const [what, change] of [
+    ['removed', () => { access.doc.grants = base().filter((g) => g.user !== 'alice'); }],
+    ['expired', () => { access.doc.grants = base().map((g) => (g.user === 'alice' ? { ...g, expires: '2000-01-01T00:00:00Z' } : g)); }],
+    ['out of scope', () => { access.doc.grants = base().map((g) => (g.user === 'alice' ? { ...g, projects: ['none'] } : g)); }],
+    ['unreadable', () => { access.fail = true; }],
+  ]) {
+    change();
+    assert.equal(code('human', 'thread.messages', { thread: A }), 'thread-not-owned', what);
+    assert.deepEqual(call('human', 'thread.list', { shared: true }), [], what);
+    for (const who of ['human', 'reader']) assert.deepEqual(call(who, 'trail', { subject: sent }), [], `${who} ${what}`);
+    access.doc.grants = base();
+    access.fail = false;
+    assert.deepEqual(read('human', A), ['alice: hello'], what);
+  }
+  // A viewer grant still covers: rule 3 asks for any level.
+  access.doc.grants = base().map((g) => (g.user === 'alice' ? { ...g, level: 'viewer' } : g));
+  assert.deepEqual(read('human', A), ['alice: hello']);
+});
+
+test('mutant 4: a share\'s state is its latest row, so an unshare ends it and a share after it starts it again', (t) => {
+  const { store, call, code, A, rows, read } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'user:bob' });
+  assert.equal(code('alice', 'thread.share', { thread: A, to: 'user:bob' }), 'share-exists');
+  assert.deepEqual(call('alice', 'thread.unshare', { thread: A, to: 'user:bob' }), { thread: A, to: 'user:bob', op: 'unshare' });
+  assert.equal(code('bob', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.deepEqual(call('bob', 'thread.list', { shared: true }), []);
+  assert.deepEqual(call('alice', 'thread.shares', { thread: A }), []);
+  assert.equal(code('alice', 'thread.unshare', { thread: A, to: 'user:bob' }), 'share-not-found');
+  assert.equal(code('alice', 'thread.unshare', { thread: A, to: '*' }), 'share-not-found');
+  call('alice', 'thread.share', { thread: A, to: 'user:bob' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  assert.deepEqual(call('alice', 'thread.shares', { thread: A }).map((x) => x.to), ['user:bob']);
+  assert.deepEqual(store.all('SELECT op,target,by FROM thread_shares ORDER BY seq').map((r) => ({ ...r })), [
+    { op: 'share', target: 'user:bob', by: 'user:alice' },
+    { op: 'unshare', target: 'user:bob', by: 'user:alice' },
+    { op: 'share', target: 'user:bob', by: 'user:alice' },
+  ]);
+  // An unshare of `*` leaves bob's own share in force.
+  call('alice', 'thread.share', { thread: A, to: '*' });
+  call('alice', 'thread.unshare', { thread: A, to: '*' });
+  assert.deepEqual(read('bob', A), ['alice: hello']);
+  assert.equal(code('human', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.equal(rows(), 5);
+});
+
+test('mutant 8: a user target needs a live grant of any level covering the thread, else share-not-covered', (t) => {
+  const { access, call, code, base, A, p1, rows } = setup(t);
+  // carol's grant covers p2 only; dave has none; erin's is expired.
+  access.doc.grants = [...base(), grant({ id: 'g-4', user: 'erin', projects: [p1], expires: '2000-01-01T00:00:00Z' })];
+  for (const to of ['user:carol', 'user:dave', 'user:erin'])
+    assert.equal(code('alice', 'thread.share', { thread: A, to }), 'share-not-covered', to);
+  assert.equal(rows(), 0);
+  // A viewer grant is enough to be shared with, though at this base it can't bind a session.
+  access.doc.grants = [...base(), grant({ id: 'g-5', user: 'vic', projects: [p1], level: 'viewer' })];
+  assert.deepEqual(call('alice', 'thread.share', { thread: A, to: 'user:vic' }), { thread: A, to: 'user:vic', op: 'share' });
+  // An unshare checks no coverage: an uncovered target's share can still be ended.
+  access.doc.grants = base();
+  assert.deepEqual(call('alice', 'thread.unshare', { thread: A, to: 'user:vic' }), { thread: A, to: 'user:vic', op: 'unshare' });
+  assert.equal(rows(), 2);
+});
+
+test('a share target is `user:<id>`, the business human or `*`, and never the sharer', (t) => {
+  const { call, code, A, H, rows } = setup(t);
+  for (const to of ['user:alice', 'bob', 'tester', 'user:tester', 'user:human', 'user:user', 'user:jason', 'user:', 'user:Bad Name', '', 42, null, ['*']])
+    assert.equal(code('alice', 'thread.share', { thread: A, to }), 'invalid-request', JSON.stringify(to));
+  for (const to of ['jason', 'user:x y'])
+    assert.equal(code('human', 'thread.share', { thread: H, to }), 'invalid-request', to);
+  assert.equal(code('alice', 'thread.share', { thread: A }), 'invalid-request');
+  assert.equal(code('alice', 'thread.share', { thread: A, to: '*', extra: 1 }), 'invalid-request');
+  assert.equal(code('alice', 'thread.shares', { thread: A, to: '*' }), 'invalid-request');
+  assert.equal(code('alice', 'thread.share', { thread: randomUUID(), to: '*' }), 'thread-not-found');
+  assert.equal(code('alice', 'thread.list', { shared: false }), 'invalid-request');
+  assert.equal(code('alice', 'thread.list', { shared: 'yes' }), 'invalid-request');
+  assert.equal(rows(), 0);
+  // The owner shares its own threads only; a user's thread refuses the business human too.
+  assert.equal(code('human', 'thread.share', { thread: A, to: '*' }), 'thread-not-owned');
+  assert.equal(code('alice', 'thread.share', { thread: H, to: '*' }), 'thread-not-owned');
+  assert.equal(rows(), 0);
+  assert.deepEqual(call('human', 'thread.share', { thread: H, to: '*' }).op, 'share');
+});
+
+test('a user whose collaborator grant no longer covers its own thread can\'t share, unshare or list its shares', (t) => {
+  const { access, call, code, base, A, p2, rows } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'user:bob' });
+  access.doc.grants = base().map((g) => (g.user === 'alice' ? { ...g, projects: [p2] } : g));
+  for (const [verb, to] of [['thread.share', '*'], ['thread.unshare', 'user:bob'], ['thread.shares', undefined]])
+    assert.equal(code('alice', verb, { thread: A, ...(to ? { to } : {}) }), 'access-refused', verb);
+  assert.equal(rows(), 1);
+});
+
+test('the tester and a reader session never share: each verb refuses and writes nothing', (t) => {
+  const { store, call, code, A, H, rows } = setup(t);
+  const refusals = () => store.get("SELECT count(*) n FROM events WHERE kind='action.refused'").n;
+  const T = call('tester', 'thread.create', { project: call('human', 'project.list')[0].id, name: 'tester work' }).id;
+  const was = refusals();
+  for (const verb of ['thread.share', 'thread.unshare', 'thread.shares'])
+    for (const thread of [T, H, A]) {
+      assert.equal(code('tester', verb, { thread, to: '*' }), 'tester-refused', `${verb} ${thread}`);
+      assert.equal(code('reader', verb, { thread, to: '*' }), 'read-only', `${verb} ${thread}`);
+    }
+  // Each refusal is recorded, as every refused request is.
+  assert.equal(refusals() - was, 18);
+  assert.equal(rows(), 0);
+  // A share with `*` of the owner's thread doesn't reach the tester's reads.
+  call('human', 'thread.share', { thread: H, to: '*' });
+  assert.equal(code('tester', 'thread.messages', { thread: H }), 'thread-not-owned');
+});
+
+test('the owner\'s trail and replies show a user\'s message only while that user\'s thread is shared with the owner', (t) => {
+  const { store, call, code, A, sent } = setup(t);
+  // The run's reply to alice, as R3's `to: 'user'` path writes it.
+  const reply = randomUUID();
+  store.run(
+    'INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,in_reply_to,decision,corrects,body) VALUES(?,?,?,?,?,?,?,?,?,?,?)',
+    reply, new Date().toISOString(), 'demo', 'assistant', 'assistant-run', 'user', 'INFO', sent, null, null, 'hello alice',
+  );
+  store.run('INSERT INTO message_threads(message,thread,session) VALUES(?,?,?)', reply, A, A);
+  for (const who of ['human', 'reader']) {
+    assert.deepEqual(call(who, 'trail', { subject: sent }), [], who);
+    assert.equal(code(who, 'replies', { id: sent }), 'message-not-found', who);
+  }
+  call('alice', 'thread.share', { thread: A, to: 'jason' });
+  for (const who of ['human', 'reader']) {
+    assert.ok(call(who, 'trail', { subject: sent }).some((r) => r.table === 'messages' && r.id === sent), who);
+    assert.deepEqual(call(who, 'replies', { id: sent }).map((m) => m.id), [reply], who);
+  }
+  // The tester never reads another's thread (rule 4).
+  assert.deepEqual(call('tester', 'trail', { subject: sent }), []);
+  assert.equal(code('tester', 'replies', { id: sent }), 'message-not-found');
+  call('alice', 'thread.unshare', { thread: A, to: 'jason' });
+  for (const who of ['human', 'reader']) {
+    assert.deepEqual(call(who, 'trail', { subject: sent }), [], who);
+    assert.equal(code(who, 'replies', { id: sent }), 'message-not-found', who);
+  }
+});
+
+test('a share covers every session of the thread', (t) => {
+  const { store, call, code, H, read } = setup(t);
+  call('human', 'session.create', { thread: H, name: 'second', op: 'op-second' });
+  const S = store.get("SELECT id FROM sessions WHERE thread=? AND name='second'", H).id;
+  call('human', 'thread.send', { thread: H, session: S, body: 'jason: second' });
+  call('human', 'thread.share', { thread: H, to: 'user:alice' });
+  assert.deepEqual(read('alice', H), ['jason: hello']);
+  assert.deepEqual(call('alice', 'thread.messages', { thread: H, session: S }).map((m) => m.body), ['jason: second']);
+  assert.equal(code('alice', 'thread.messages', { thread: H, session: randomUUID() }), 'session-not-found');
+  assert.equal(code('bob', 'thread.messages', { thread: H, session: S }), 'thread-not-owned');
+});
+
+test('a sharee can\'t list the thread\'s sessions: session.list stays owner-only (Q7, sage-2818 Q1)', (t) => {
+  const { call, code, A, H } = setup(t);
+  call('alice', 'thread.share', { thread: A, to: 'jason' });
+  call('human', 'thread.share', { thread: H, to: '*' });
+  assert.equal(code('human', 'session.list', { thread: A }), 'thread-not-owned');
+  assert.equal(code('reader', 'session.list', { thread: A }), 'read-only');
+  for (const who of ['alice', 'bob']) assert.equal(code(who, 'session.list', { thread: H }), 'access-refused', who);
+  // The owners still list their own.
+  assert.equal(call('human', 'session.list', { thread: H }).length, 1);
+});
+
+test('only a human principal matches a share: an agent bound to the thread and the tester match none (sage-2818 Q2)', (t) => {
+  const { b, caps, call, code, A, H, sent } = setup(t);
+  // The assistant run serving alice's thread, and a chief run with no thread.
+  caps.agent = b.bindLaunch({ business: 'demo', role: 'assistant', run: 'assistant-run', harness: 'pi', thread: A });
+  caps.chief = b.bindLaunch({ business: 'demo', role: 'chief', run: 'chief-run', harness: 'pi' });
+  for (const who of ['agent', 'chief']) call(who, 'role.claim');
+  const seen = (who) => call(who, 'trail', { subject: sent }).some((r) => r.table === 'messages' && r.id === sent);
+  for (const who of ['agent', 'chief', 'tester']) assert.equal(seen(who), false, `${who} before`);
+  call('alice', 'thread.share', { thread: A, to: '*' });
+  call('alice', 'thread.share', { thread: A, to: 'jason' });
+  // The human principals now read it; the agents and the tester see what they saw before.
+  for (const who of ['human', 'reader']) assert.equal(seen(who), true, who);
+  for (const who of ['agent', 'chief', 'tester']) assert.equal(seen(who), false, `${who} after`);
+  for (const who of ['agent', 'chief']) {
+    assert.equal(code(who, 'thread.messages', { thread: A }), 'human-required', who);
+    assert.equal(code(who, 'replies', { id: sent }), 'human-required', who);
+  }
+  assert.equal(code('tester', 'thread.messages', { thread: A }), 'thread-not-owned');
+  assert.equal(code('tester', 'replies', { id: sent }), 'message-not-found');
+  call('human', 'thread.share', { thread: H, to: '*' });
+  assert.equal(code('tester', 'thread.messages', { thread: H }), 'thread-not-owned');
+});
+
+// The 3l→3m step. A 3l store from fixtures/schema-3l.sql, with one row in each thread table.
+const AT = '2026-10-22T00:00:00.000Z';
+const ddl3l = readFileSync(here('./fixtures/schema-3l.sql'), 'utf8');
+function source3l(t) {
+  const root = mkdtempSync(join(tmpdir(), 'thread-shares-migrate-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  mkdirSync(join(root, 'bus'), { mode: 0o700 });
+  const path = join(root, 'bus/bus.sqlite'), db = new DatabaseSync(path);
+  assert.equal(createHash('sha256').update(ddl3l).digest('hex'), 'cd68512212ce8bf8f5631138b2e63a340fa7b940088430649bb7784af7df162a');
+  db.exec(ddl3l);
+  const run = (sql, ...args) => db.prepare(sql).run(...args);
+  run('INSERT INTO meta VALUES (?,?)', 'schema_version', '3l');
+  run('INSERT INTO meta VALUES (?,?)', 'schema_digest', schemaDigest(db));
+  run('INSERT INTO meta VALUES (?,?)', 'comment_cursor_epoch', AT);
+  run('INSERT INTO projects(id,at,business,name,repo,created_by) VALUES(?,?,?,?,?,?)', 'p-1', AT, 'demo', 'stack work', 'stack', 'jason');
+  for (const [id, owner] of [['t1', 'jason'], ['t2', 'user:alice']]) {
+    run('INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)', id, AT, 'demo', 'p-1', 'assistant', owner, id);
+    run("INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) VALUES(?,?,?,?,?,?,'default','legacy-3l')", AT, 'demo', id, id, 'assistant', owner);
+    run("INSERT INTO session_defaults(at,thread,session,by) VALUES(?,?,?,'migration-3l')", AT, id, id);
+  }
+  run('INSERT INTO messages(id,at,business,from_role,from_run,to_role,class,body) VALUES(?,?,?,?,?,?,?,?)', 'm-1', AT, 'demo', 'user', 'user:alice', 'assistant', 'INFO', 'm-1');
+  run('INSERT INTO message_threads VALUES(?,?,?)', 'm-1', 't2', 't2');
+  run('INSERT INTO thread_opens(seq,at,thread,session,by) VALUES(?,?,?,?,?)', 7, AT, 't2', 't2', 'user:alice');
+  db.close();
+  chmodSync(path, 0o600);
+  return { root, path };
+}
+const open = (path, fn) => {
+  const db = new DatabaseSync(path, { readOnly: true });
+  try { return fn(db); } finally { db.close(); }
+};
+const master = (path) => open(path, (db) => db.prepare('SELECT type,name,tbl_name,sql FROM sqlite_master ORDER BY type,name').all().map((r) => ({ ...r })));
+// Every table's rows but meta's, whose version and digest the step changes.
+const tables = (path) => open(path, (db) => Object.fromEntries(
+  db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT IN ('meta') ORDER BY name").all()
+    .map(({ name }) => [name, db.prepare(`SELECT * FROM "${name}" ORDER BY rowid`).all().map((r) => ({ ...r }))]),
+));
+const version = (path) => open(path, (db) => db.prepare("SELECT value FROM meta WHERE key='schema_version'").get().value);
+
+test('a 3l store migrates to 3m: thread_shares is new and empty, and every other row stays as it was', (t) => {
+  const { root, path } = source3l(t);
+  const before = tables(path);
+  assert.throws(() => new Store(root), /schema-mismatch/);
+  new Store(root, { migrateSchema: true }).close();
+  assert.equal(version(path), '3m');
+  const after = tables(path);
+  assert.deepEqual(after.thread_shares, []);
+  delete after.thread_shares;
+  assert.deepEqual(after, before);
+  // The migrated schema is the fresh one, object for object.
+  const freshRoot = mkdtempSync(join(tmpdir(), 'thread-shares-fresh-'));
+  t.after(() => rmSync(freshRoot, { recursive: true, force: true }));
+  new Store(freshRoot).close();
+  assert.deepEqual(master(path), master(join(freshRoot, 'bus/bus.sqlite')));
+  // No existing thread is shared: each stays private to its owner.
+  const store = new Store(root);
+  t.after(() => store.close());
+  store.run('INSERT INTO thread_shares(at,business,thread,op,target,by) VALUES(?,?,?,?,?,?)', AT, 'demo', 't2', 'share', 'jason', 'user:alice');
+  for (const [sql, args] of [
+    ["UPDATE thread_shares SET target='*'", []],
+    ['DELETE FROM thread_shares', []],
+    ['INSERT OR REPLACE INTO thread_shares(seq,at,business,thread,op,target,by) VALUES(?,?,?,?,?,?,?)', [1, AT, 'demo', 't2', 'unshare', 'jason', 'user:alice']],
+  ]) assert.throws(() => store.run(sql, ...args), /thread_shares is append-only/, sql);
+  assert.throws(() => store.run('INSERT INTO thread_shares(at,business,thread,op,target,by) VALUES(?,?,?,?,?,?)', AT, 'demo', 't2', 'grant', '*', 'user:alice'), /CHECK/);
+  assert.throws(() => store.run('INSERT INTO thread_shares(at,business,thread,op,target,by) VALUES(?,?,?,?,?,?)', AT, 'demo', 'no-such', 'share', '*', 'jason'), /FOREIGN KEY/);
+  assert.deepEqual(store.all('SELECT seq,thread,op,target FROM thread_shares').map((r) => ({ ...r })), [{ seq: 1, thread: 't2', op: 'share', target: 'jason' }]);
+});
+
+// The 3l engine is store.mjs at this change with the 3l schema and version and no 3l→3m step.
+async function engine3l(root) {
+  const moduleRoot = join(root, 'engine-3l');
+  mkdirSync(join(moduleRoot, 'src/migrations'), { recursive: true });
+  const source = readFileSync(here('../src/store.mjs'), 'utf8');
+  const edited = source
+    .replace(/export const SCHEMA_SHA256 = '[a-f0-9]+';/, `export const SCHEMA_SHA256 = '${createHash('sha256').update(ddl3l).digest('hex')}';`)
+    .replace("export const SCHEMA_VERSION = '3m';", "export const SCHEMA_VERSION = '3l';")
+    .replace(/\}, \{\n {2}\/\/ Row 206 \(193b2[\s\S]*?\}\];\nconst timedTables/, '}];\nconst timedTables');
+  assert.ok(edited.includes("export const SCHEMA_VERSION = '3l';") && edited.includes('3k-3l') && !edited.includes('3l-3m'), 'the 3l engine has no 3l→3m step');
+  writeFileSync(join(moduleRoot, 'src/store.mjs'), edited);
+  writeFileSync(join(moduleRoot, 'schema.sql'), ddl3l);
+  for (const file of ['3b.sql', '3b-3c.sql', '3c-3d.sql', '3d-3e.sql', '3e-3f.sql', '3f-3g.sql', '3g-3h.sql', '3h-3i.sql', '3i-3j.sql', '3j-3k.sql', '3k-3l.sql'])
+    copyFileSync(here('../src/migrations/' + file), join(moduleRoot, 'src/migrations', file));
+  return (await import(pathToFileURL(join(moduleRoot, 'src/store.mjs')))).Store;
+}
+
+test('the 3l engine refuses a 3m store, migrating or not, and leaves it as it was', async (t) => {
+  const { root, path } = source3l(t);
+  new Store(root, { migrateSchema: true }).close();
+  const was = master(path), before = tables(path);
+  const Store3l = await engine3l(root);
+  assert.throws(() => new Store3l(root), /schema-mismatch/);
+  assert.throws(() => new Store3l(root, { migrateSchema: true }), /schema-mismatch/);
+  assert.equal(version(path), '3m');
+  assert.deepEqual(master(path), was);
+  assert.deepEqual(tables(path), before);
+  // The same engine opens a fresh 3l store, so the refusal is the version's and not a broken copy.
+  const { root: old } = source3l(t);
+  new Store3l(old).close();
+});
@@ -68,7 +68,7 @@ test('REQ-LIMIT-4 3g copy migrates through 3h, 3i, 3j and 3k to 3l preserving ev
  assert.throws(() => new Store(root), /schema-mismatch/);
  const store = new Store(root, { migrateSchema: true });
  try {
-    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3l');
+    assert.equal(store.get("SELECT value FROM meta WHERE key='schema_version'").value, '3m');
    assert.deepEqual({ ...store.get('SELECT to_name FROM messages') }, { to_name: null });
    assert.equal(store.get('SELECT count(*) AS n FROM usage_records').n, 0);
    assert.equal(store.get('SELECT name FROM instance_names').name, 'Builder');
@@ -139,7 +139,9 @@ test('R3: every verb off the collaborator list refuses a user access-refused bef
  ]);
  // R3 r6 (sage-2576): the collaborator list as ruled, written out, so a widened USER_VERBS fails here
  // rather than leaving the set below with the verb it added (M3x, M6x).
-  assert.deepEqual(USER_VERBS, ['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names']);
+  assert.deepEqual(USER_VERBS, ['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names',
+    // Row 206 (193b2): the share verbs, owner only (thread-shares.test.mjs).
+    'thread.share', 'thread.unshare', 'thread.shares']);
  for (const v of USER_VERBS) others.delete(v);
  assert.ok(others.size > 40);
  for (const verb of others) {
@@ -1084,8 +1084,6 @@ prints a token. A usage error exits 4 and a bus refusal 2.
 mosaic access list --business ID [--json]
 mosaic access grant --business ID --user ID --projects UUID|NAME,...|* --instances NAME,...|* --level collaborator|viewer [--expires ISO] --revision N
 mosaic access revoke --business ID --user ID [--grant GID] --revision N
-mosaic access user add ID --business ID --home local --subject PROVIDER:SUB --revision N
-mosaic access user remove ID --business ID --revision N
 ```

 These edit `<configDir>/access.json` (design section 3.5). The human proof is one `project.list`
@@ -1109,14 +1107,6 @@ once. Removing a provider from `console.sso` takes effect only after a Console r
 Peer homes are not read yet, so a grant that names a peer home refuses until row 203 adds the
 federation key. A grant that names a sign-in subject needs `console.sso` in the system config.

-`user add` and `user remove` (row 193c, #1705) take the same proof, lock, revision check, file
-checks and receipt. `user add` takes one sign-in subject, `PROVIDER:SUB`, split at the first colon;
-the provider must be in `console.sso`. `user remove` refuses with `user-has-grants` while any grant,
-at any business, names the user: revoke those first. `--business` names the business whose bus
-takes the proof; the user list itself is instance-wide. Their receipt verbs are `user.add` and
-`user.remove`. The bus has no `access.reload` yet (FED R4). As with grant and revoke, the broker
-reads the file once per user request (`packages/bus/src/broker.mjs`), so the change acts at once.
-
 ## Token usage

 `mosaic usage [--business ID] [--json] [--tester]` reads the bus's accounting, without
@@ -1,5 +1,4 @@
-// `mosaic access list|grant|revoke|user` (federation design section 3.5, FED R5, #414;
-// `user add|remove`, row 193c, #1705).
+// `mosaic access list|grant|revoke` (federation design section 3.5, FED R5, #414).
 // The human edits <configDir>/access.json here. Each write is checked against the
 // instance's context before it lands, bumps the revision by one, and appends one
 // receipt line to <dataRoot>/state/access-log.jsonl. The human proof is one call
@@ -19,8 +18,6 @@ export const ACCESS_USAGE = [
  "mosaic access list --business ID [--json]",
  "mosaic access grant --business ID --user ID --projects UUID|NAME,...|* --instances NAME,...|* --level collaborator|viewer [--expires ISO] --revision N",
  "mosaic access revoke --business ID --user ID [--grant GID] --revision N",
-  "mosaic access user add ID --business ID --home local --subject PROVIDER:SUB --revision N",
-  "mosaic access user remove ID --business ID --revision N",
 ].join("\n");

 // The help text. A grant's `instances` is the real limit: the granted instance
@@ -36,7 +33,6 @@ list is the real limit: a collaborator's message drives a granted instance with
 the owner's role.
 To cut a user off, revoke them here first. It acts at once. Removing a provider
 from console.sso takes effect only after a Console restart, so do that second.
-user remove refuses while the user has a grant at any business: revoke those first.
 Peer homes are not read yet (row 203 adds the federation key), so a grant that
 names a peer home refuses. A grant that names a sign-in subject needs console.sso
 in the system config; without it every such grant refuses.
@@ -210,8 +206,7 @@ export async function accessCommand(args, io, deps) {
 async function accessVerb(args, io, deps) {
  const parsed = parse(args);
  const sub = parsed.positional[0];
-  const shape = sub === "user" ? ["add", "remove"].includes(parsed.positional[1]) && parsed.positional.length === 3 : ["list", "grant", "revoke"].includes(sub) && parsed.positional.length === 1;
-  if (!shape) throw new CliError(ACCESS_HELP, 4);
+  if (!["list", "grant", "revoke"].includes(sub) || parsed.positional.length !== 1) throw new CliError(ACCESS_HELP, 4);
  if (parsed.flags.has("--tester")) throw new CliError("refused: access writes take the human's shell, not --tester", 3);
  const business = parsed.values["--business"];
  if (!business) throw new CliError(`--business is required\n${ACCESS_USAGE}`, 4);
@@ -229,7 +224,6 @@ async function accessVerb(args, io, deps) {

  const expected = parsed.values["--revision"];
  if (!/^\d+$/.test(expected ?? "")) throw new CliError(`--revision takes the revision you read\n${ACCESS_USAGE}`, 4);
-  if (sub === "user") return userVerb(parsed, io, deps, { business, file, context, expected });
  const user = parsed.values["--user"];
  if (!user) throw new CliError(`${sub} needs --user\n${ACCESS_USAGE}`, 4);

@@ -284,53 +278,6 @@ async function accessVerb(args, io, deps) {
  io.stdout.write(`access ${sub}: ${result.touched.join(", ")} at ${business}, revision ${result.checked.revision}\n`);
 }

-// `user add ID` and `user remove ID` (row 193c): the same lock, revision check, file checks,
-// atomic write and receipt as grant and revoke. add takes one subject, PROVIDER:SUB, split at the
-// first colon, so a sub may hold colons. remove refuses while any grant names the user, at any
-// business, so a user is never removed with live grants (the owner revokes first, as the help says).
-async function userVerb(parsed, io, deps, { business, file, context, expected }) {
-  const [, action, user] = parsed.positional;
-  let entry;
-  if (action === "add") {
-    const home = parsed.values["--home"];
-    const subject = parsed.values["--subject"] ?? "";
-    const colon = subject.indexOf(":");
-    if (home === undefined || colon < 1 || colon === subject.length - 1) {
-      throw new CliError(`user add needs --home and --subject PROVIDER:SUB\n${ACCESS_USAGE}`, 4);
-    }
-    entry = { id: user, home, subjects: [{ provider: subject.slice(0, colon), sub: subject.slice(colon + 1) }] };
-  }
-  const result = withLock(file, () => {
-    const { document, revision } = readCurrent(file, context);
-    if (Number(expected) !== revision) {
-      throw new CliError(`refused: revision-conflict: the access file is at revision ${revision}, not ${expected}; run list again`, 3);
-    }
-    let users;
-    if (action === "add") users = [...document.users, entry];
-    else {
-      if (!document.users.some((u) => u.id === user)) throw new CliError(`refused: no user ${user} to remove`, 2);
-      const held = document.grants.filter((g) => g.user === user).map((g) => g.id);
-      if (held.length) throw new CliError(`refused: user-has-grants: ${user} still holds ${held.join(", ")}; revoke them first`, 2);
-      users = document.users.filter((u) => u.id !== user);
-    }
-    const checked = checkAccess({ ...document, revision: revision + 1, users }, context);
-    writeAtomic(file, `${JSON.stringify(checked, null, 2)}\n`, deps.fs);
-    return { checked, revision };
-  }, deps.fs);
-
-  receipt(deps.system.dataRoot, {
-    at: (deps.now ?? (() => new Date()))().toISOString(),
-    verb: `user.${action}`,
-    business,
-    user,
-    actor: "human",
-    revisionBefore: result.revision,
-    revisionAfter: result.checked.revision,
-    grants: [],
-  });
-  io.stdout.write(`access user ${action}: ${user}, revision ${result.checked.revision}\n`);
-}
-
 function formatList(doc) {
  const lines = [`access file revision ${doc.revision ?? "none"}`];
  for (const u of doc.users) lines.push(`user ${u.id} home ${u.home}`);
@@ -312,140 +312,3 @@ test("the real human-cli, run from agent ancestry, refuses and writes nothing",
  assert.equal(readFileSync(file, "utf8"), before);
  assert.equal(existsSync(join(f.dataRoot, "state", "access-log.jsonl")), false);
 });
-
-// Row 193c (#1705): `user add` and `user remove`. BUILD.md (agents/megavolt/work/queue-207) names
-// each test T1-T9 and the mutant it kills.
-const USER_ADD = (id, { subject = "authentik:bob-sub", home = "local", revision = "1" } = {}) => [
-  "user", "add", id, "--business", "acme", "--home", home, "--subject", subject, "--revision", revision,
-];
-const USER_REMOVE = (id, revision = "1") => ["user", "remove", id, "--business", "acme", "--revision", revision];
-
-test("T1 user add writes the user one revision up, prints it and appends a user.add receipt", async (t) => {
-  const s = setup(t);
-  const out = await run(USER_ADD("bob", { subject: "authentik:bob:x" }), s.deps);
-  assert.match(out, /access user add: bob, revision 2/);
-  const doc = s.read();
-  assert.equal(doc.revision, 2);
-  assert.deepEqual(doc.users[1], { id: "bob", home: "local", subjects: [{ provider: "authentik", sub: "bob:x" }] });
-  assert.deepEqual(doc.users[0], DOC.users[0]);
-  const lines = s.receipts().trim().split("\n").map((l) => JSON.parse(l));
-  assert.equal(lines.length, 1);
-  assert.deepEqual(lines[0], {
-    at: "2026-10-20T20:00:00.000Z", verb: "user.add", business: "acme", user: "bob", actor: "human",
-    revisionBefore: 1, revisionAfter: 2, grants: [],
-  });
-});
-
-test("T2 a bad user add refuses before any write", async (t) => {
-  const s = setup(t);
-  const before = readFileSync(s.file, "utf8");
-  const usage = [
-    ["user", "add", "bob", "--business", "acme", "--subject", "authentik:bob-sub", "--revision", "1"],
-    ["user", "add", "bob", "--business", "acme", "--home", "local", "--revision", "1"],
-    USER_ADD("bob", { subject: "authentik" }),
-    USER_ADD("bob", { subject: ":bob-sub" }),
-    USER_ADD("bob", { subject: "authentik:" }),
-  ];
-  for (const args of usage) {
-    const err = await refusal(run(args, s.deps), /user add needs --home and --subject PROVIDER:SUB/);
-    assert.equal(err.exitCode, 4, args.join(" "));
-  }
-  const checked = [
-    [USER_ADD("bob", { subject: "github:bob-sub" }), /provider must be a configured provider/],
-    [USER_ADD("alice", { subject: "authentik:alice-2" }), /duplicate user id: alice/],
-    [USER_ADD("tester"), /a bus principal/],
-    [USER_ADD("jason"), /a business's human/],
-    [USER_ADD("bob", { subject: "authentik:jason-sub" }), /owner sign-in subject/],
-    [USER_ADD("bob", { subject: "authentik:alice-sub" }), /appears more than once/],
-    [USER_ADD("bob", { home: "peer-one" }), /home must be a configured peer/],
-  ];
-  for (const [args, pattern] of checked) {
-    const err = await refusal(run(args, s.deps), pattern);
-    assert.equal(err.exitCode, 3, args.join(" "));
-  }
-  assert.equal(readFileSync(s.file, "utf8"), before);
-  assert.equal(s.receipts(), "");
-});
-
-test("T3 user remove of a user with no grant drops them one revision up, with a user.remove receipt", async (t) => {
-  const s = setup(t);
-  const out = await run(USER_REMOVE("alice"), s.deps);
-  assert.match(out, /access user remove: alice, revision 2/);
-  const doc = s.read();
-  assert.equal(doc.revision, 2);
-  assert.deepEqual(doc.users, []);
-  const [line] = s.receipts().trim().split("\n").map((l) => JSON.parse(l));
-  assert.equal(line.verb, "user.remove");
-  assert.equal(line.user, "alice");
-  assert.equal(line.revisionBefore, 1);
-  assert.equal(line.revisionAfter, 2);
-  assert.deepEqual(line.grants, []);
-});
-
-// M1's second fence: without the user-has-grants refusal, checkAccess refuses the file with exit 3
-// (a grant naming a missing user). The test pins the reason and exit 2, so only the verb's refusal passes.
-test("T4 user remove refuses with user-has-grants while the user holds a grant, and writes nothing", async (t) => {
-  const s = setup(t);
-  await run([...GRANT, "--revision", "1"], s.deps);
-  const id = s.read().grants[0].id;
-  const before = readFileSync(s.file, "utf8");
-  const err = await refusal(run(USER_REMOVE("alice", "2"), s.deps), /user-has-grants: alice still holds /);
-  assert.equal(err.exitCode, 2);
-  assert.ok(err.message.includes(id));
-  assert.equal(readFileSync(s.file, "utf8"), before);
-  assert.equal(s.receipts().trim().split("\n").length, 1);
-});
-
-test("T5 user remove of an id not in the file refuses and writes nothing", async (t) => {
-  const s = setup(t);
-  const before = readFileSync(s.file, "utf8");
-  const err = await refusal(run(USER_REMOVE("carol"), s.deps), /no user carol to remove/);
-  assert.equal(err.exitCode, 2);
-  assert.equal(readFileSync(s.file, "utf8"), before);
-  assert.equal(s.receipts(), "");
-});
-
-test("T6 a stale revision refuses both user verbs with revision-conflict", async (t) => {
-  const s = setup(t);
-  const before = readFileSync(s.file, "utf8");
-  for (const args of [USER_ADD("bob", { revision: "2" }), USER_REMOVE("alice", "5")]) {
-    const err = await refusal(run(args, s.deps), /revision-conflict/);
-    assert.equal(err.exitCode, 3);
-  }
-  assert.equal(readFileSync(s.file, "utf8"), before);
-  assert.equal(s.receipts(), "");
-});
-
-test("T7 --tester and an agent caller are refused on both user verbs before the bus is asked", async (t) => {
-  const s = setup(t);
-  const before = readFileSync(s.file, "utf8");
-  for (const args of [USER_ADD("bob"), USER_REMOVE("alice")]) {
-    const tester = await refusal(run([...args, "--tester"], s.deps), /not --tester/);
-    assert.equal(tester.exitCode, 3);
-    const agent = await refusal(run(args, s.deps, { ...humanEnv(), MOSAIC_RUN_ID: "run-1" }), /human shell/);
-    assert.equal(agent.exitCode, 3);
-  }
-  assert.equal(existsSync(s.log), false);
-  assert.equal(readFileSync(s.file, "utf8"), before);
-  assert.equal(s.receipts(), "");
-});
-
-test("T8 a user verb of the wrong shape prints the help", async (t) => {
-  const s = setup(t);
-  for (const shape of [["user"], ["user", "add"], ["user", "list", "x"], ["user", "add", "a", "b"]]) {
-    const err = await refusal(run([...shape, "--business", "acme", "--revision", "1"], s.deps), /mosaic access user add ID/);
-    assert.equal(err.exitCode, 4, shape.join(" "));
-  }
-  assert.equal(existsSync(s.log), false);
-});
-
-test("T9 a bus that refuses the human proof blocks both user verbs", async (t) => {
-  const s = setup(t, { mode: "refuse" });
-  const before = readFileSync(s.file, "utf8");
-  for (const args of [USER_ADD("bob"), USER_REMOVE("alice")]) {
-    const err = await refusal(run(args, s.deps), /human-required/);
-    assert.equal(err.exitCode, 3);
-  }
-  assert.equal(readFileSync(s.file, "utf8"), before);
-  assert.equal(s.receipts(), "");
-});
@@ -858,7 +858,7 @@ const COUNTED=/^COUNTED="([^"]*)"$/m.exec(srText)[1].split(' ');
 const STORE_JS=/^STORE_JS='([\s\S]*?)'$/m.exec(srText)[1];
 // sage-1163's list 2, written out so that a table dropped from the script's COUNTED fails T45 as
 // well as T46.
-const LISTED=['role_claims','thread_claims','decision_events','messages','deliveries','task_snapshots','projects','threads','sessions','session_defaults','thread_opens','instance_names','usage_records'];
+const LISTED=['role_claims','thread_claims','decision_events','messages','deliveries','task_snapshots','projects','threads','sessions','session_defaults','thread_opens','thread_shares','instance_names','usage_records'];
 const LATE='2999-01-01T00:00:00.000Z';
 const addRow=(file,table,at=LATE)=>{const db=new DatabaseSync(file);db.exec(`CREATE TABLE IF NOT EXISTS ${table} (seq INTEGER PRIMARY KEY, at TEXT NOT NULL)`);db.prepare(`INSERT INTO ${table} (at) VALUES (?)`).run(at);db.close()};

@@ -417,7 +417,7 @@ plugin_checks() {
 # Row 181: the tables a bus writer fills without an event in the same transaction, in schema
 # order. A restore drops their rows after STAMP as it drops events, so the guard counts them too.
 # BUILD.md for row 181 names each writer; the T46 guard classifies every table in the schema.
-COUNTED="role_claims thread_claims decision_events messages deliveries task_snapshots projects threads sessions session_defaults thread_opens instance_names usage_records"
+COUNTED="role_claims thread_claims decision_events messages deliveries task_snapshots projects threads sessions session_defaults thread_opens thread_shares instance_names usage_records"

 STORE_JS='
 const {DatabaseSync}=require("node:sqlite");const {pathToFileURL}=require("node:url");