Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,6 +1,12 @@
 {
- "current": "240caca",
+ "current": "v53 (89ed2cb)",
  "releases": [
+  {
+   "version": "v53",
+   "sha": "89ed2cb",
+   "date": "2026-08-24",
+   "subject": "release v53"
+  },
   {
    "version": "v52",
    "sha": "8263493",

VERSION

@@ -1 +1 @@
-240caca
+v53 (89ed2cb)

api/routes_shares.py

@@ -1,627 +1,789 @@
-"""routes_shares.py — the manage-access surface (wave 20, owner ruling R10, contract C-SHARE).
-
-    GET  /api/v1/share/{kind}/{oid}      -> {owner, entries:[{user,role}], mayAdminister, people}
-    PUT  /api/v1/share/{kind}/{oid}      <- {entries:[{user,role}]}   (REPLACES the set)
-    GET  /api/v1/share/mine              -> {view:[id], folder:[id], database:[id]}
-
-`kind` ∈ view | folder | database | field. Roles are `view` | `edit` — the same two words the
-view rail already speaks, now extended to folders, databases and COLUMNS so there is ONE
-vocabulary in the UI (R10: "the same picker views use").
-
-⭐⭐ **W38-T16 — `field` IS THE FOURTH KIND, AND ITS `oid` IS TOPIC-QUALIFIED: `"<table_key>:<field_key>"`**
-(`shares.field_oid`). A bare column key repeats across databases — `notes` exists on a dozen —
-so a grant stored under one would admit the grantee to every `notes` column in the tenant at
-once. ⛔ THREE functions in this file branch on kind and ALL THREE need the new one, which is not
-obvious because only two of them fail loudly: `_owns_object` (without it a column's own creator
-is 404'd trying to share the thing they just made) and `_object_ref` (without it `route` is None,
-`_notify_new_grantees` returns early, and the grantee is **granted and never told** — owner item
-18's silent half, reopened one kind over). `_can_see_object` stays deliberately CLOSED for
-anything that is not a view.
-
-⭐⭐ **A "Can edit" GRANTEE MAY RE-SHARE A VIEW — OWNER RULING R4, BUILT AS W40-T02** (instruction
-4: *"Edit View so a member can share a View as well, not just an admin"*). This REVERSES the flat
-owner-or-admin sentence that stood here, and the reversal is bounded three ways, all enforced HERE
-and not in the client:
-
-  1. **ONLY `kind='view'`.** `shares.RESHARE_KINDS` is the one spelling of that. `folder`,
-     `database` and `field` still require the owner or an admin, and the paragraph below is why
-     the `database` kind in particular was never a candidate: a `ut_*` grant's blast radius is a
-     whole table, where a view is one saved SELECTION over rows the receiver's own wall governs.
-  2. **A RE-SHARE MAY NEVER EXCEED THE RE-SHARER'S OWN ROLE**, and the strict reading ships: an
-     `edit` grantee may hand out `view` and NEVER `edit`. `shares.max_grantable_role` answers the
-     ceiling, `put_share` enforces it on the DELTA (a name arriving at `edit`, or one raised to
-     it) — never on every row of the body, because the `PUT` REPLACES and `ShareDialog.save`
-     therefore re-sends the whole list with the re-sharer's own `edit` row inside it. Conferring
-     `edit` stays the owner's alone.
-  3. **OWNERSHIP NEVER MOVES.** A caller re-sharing rather than owning passes the EXISTING owner
-     straight through (`put_share` below, stated rather than incidental).
-
-⛔ **SO OF THE TWO FEARS THE OLD SENTENCE NAMED, ONE IS ANSWERED AND ONE IS PRICED.** *"Grant
-themselves ownership and lock you out"* is closed by (3) and by `set_grants`' sticky owner: there
-is no path here by which a grantee becomes an owner. *"Widen a users-scoped view to everyone"* is
-NOT closed — an `edit` grantee may add `*` — it is CAPPED by (2) at `Can view`, on a surface where
-`require_session` plus the topic's own gate plus the receiver's row scope all still run first. That
-is the capability R4 asked for, stated as a cost rather than left as a surprise. A `view` grantee
-still cannot share at all, and still gets `403`. The client greys the editor for non-administrators
-and offers "Can edit" to anyone it greys in; that is a courtesy, and these checks are the wall.
-
-⚠ **THE GRANT NEVER WIDENS PAST THE MODULE WALL — ON A GOVERNED MODULE.** `*` ("everyone") means
-every account that can already open the surface: `require_session` plus the topic's own gate run
-first, and for `customer_data` / `product_data` the receiver's own row scope and hidden-field
-closure run BEFORE any foreign view is merged. Sharing there can only narrow-or-equal the set that
-could already reach the data ([[aios-permissioning]]).
-
-⛔⛔ **AND THAT SENTENCE IS FALSE FOR `kind='database'`, WHICH IS WHY IT NOW SAYS "ON A GOVERNED
-MODULE" (W32-T26, audit S-8).** `routes_admin._PERM_MODULES` is `("customer_data","product_data")`
-and `_clean_perms` **400s** on anything else, so **no row filter and no hidden field can even be
-DECLARED for a `ut_*` database** — `routes_tables.py` makes zero `perm_scope` calls and passes
-`hidden_keys=frozenset()`. There is no module wall behind a user table for a grant to be bounded
-by: **this registry IS the wall.** So a `database` grant is ALL-OR-NOTHING — every row, every
-column — and an `*` database grant admits every account in the tenant to all of it.
-That is a real capability, deliberately kept; what was wrong was a docstring promising a second
-wall that does not exist for this kind. Scoping user tables is booked, not done
-(`waves/wave32/sharing-audit.md` S-8).
-
-⚠ **TWO SYSTEMS ANSWER "IS THIS SHARED", AND THEY ARE NOT THE SAME ONE (audit S-4).** THIS
-registry decides who appears in *"Shared with me"* and who may re-share. **`table_store.is_shared`
-— the view's own `permissions` — is what actually decides who may OPEN a view.** A grant here
-whose object is invisible under that one is a row in a list that opens a refusal, which is what
-made item 18 worth auditing. `_entries_or_400` closes the common cause (a name nobody has), but
-the two vocabularies are still two.
-"""
-from fastapi import APIRouter, Body, Depends
-
-import core.shares as shares
-import core.users as users
-from deps import Session, err, require_session
-# ⭐ W32-T28 (C3) — the SHARE notification's topic word, imported from the module that CLASSIFIES
-# it (`routes_alerts.notification_view`) rather than typed again here. The producer and the
-# reader agreeing about one string is the whole difference between an Inbox row that opens the
-# shared database and one that is quietly unclickable.
-from routes_alerts import SHARE_TOPIC as _SHARE_TOPIC
-
-router = APIRouter(prefix="/api/v1")
-
-
-def _kind_or_400(raw):
-    try:
-        return shares._check_kind(raw)
-    except ValueError as e:
-        raise err(400, "bad_kind", str(e))
-
-
-# ── ⭐⭐ WAVE 32 · T26 (owner item 18, ruling R12) — THE WALL THIS FILE SAID IT HAD ─────────────
-#
-# `put_share`'s comment used to justify the first-claim rule with *"reaching this route at all
-# means passing the surface's own wall"*. **There was no such wall.** `kind` and `oid` are free
-# strings off the URL and the only dependency was `require_session`, so any signed-in account
-# could `PUT` a grant on an id it had never seen. Because the 403 sat behind `if rec["owner"]`,
-# an object with no grant record skipped the check entirely and the caller was stamped OWNER —
-# sticky, so **the real creator was then refused on their own view, permanently.** Driven, not
-# argued: `waves/wave32/sharing-audit.md` S-1 carries the four-step transcript.
-#
-# ⚠ AND IT WAS SILENT ON BOTH SIDES. The claimant does not even see the object in their own
-# "Shared with me" (`shared_with` excludes what you own), so nothing appears anywhere until the
-# victim next opens the dialog.
-
-#: The built-in grid topics. A view or folder lives in `{topic}_table_workspace`, and the share
-#: route is not told which topic — so resolving one means asking each.
-_BUILTIN_TOPICS = ("customer", "product")
-
-
-def _field_storage_keys(table_key):
-    """Resolve the client-facing field topic to its durable stores and grant topic."""
-    raw = str(table_key or "").strip()
-    if raw in ("customer_data", "customer_table_workspace"):
-        return "customer_table_workspace", "customer_table_workspace", "customer_data"
-    if raw in ("product_data", "product_table_workspace"):
-        return "product_table_workspace", "product_table_workspace", "product_data"
-    if raw.startswith("ut_"):
-        bare = raw[:-len("_table_workspace")] if raw.endswith("_table_workspace") else raw
-        return f"{bare}_table_workspace", bare, bare
-    workspace = raw if raw.endswith("_table_workspace") else f"{raw}_table_workspace"
-    shared = raw[:-len("_table_workspace")] if raw.endswith("_table_workspace") else raw
-    return workspace, shared, shared
-
-
-def _field_definition(session, table_key, field_key):
-    """Return the shared/private definition and the keys used by its write paths."""
-    workspace_key, shared_key, grant_topic = _field_storage_keys(table_key)
-    try:
-        from core import shared_overlay
-        shared = (shared_overlay.fields(shared_key, st=session.runtime) or {}).get(field_key)
-        if isinstance(shared, dict):
-            return shared, True, workspace_key, shared_key, grant_topic
-        import core.table_store as table_store
-        private = (table_store.make(workspace_key, st=session.runtime)
-                   .workspace(session.uname).get("fields") or {}).get(field_key)
-        if isinstance(private, dict):
-            return private, False, workspace_key, shared_key, grant_topic
-    except Exception:                                       # noqa: BLE001
-        pass
-    return None, False, workspace_key, shared_key, grant_topic
-
-
-def _field_owner(session, definition, already_shared):
-    """Resolve the creator for the share claim wall.
-
-    A private field is already namespaced by the caller's own workspace.  Older field records
-    from before the host-side creator stamp therefore remain safely claimable by that workspace
-    owner, while a shared definition with no creator stays admin-only because its storage is
-    tenant-wide and cannot identify an owner from residency alone.
-    """
-    owner = str((definition or {}).get("createdBy") or "").strip()
-    if owner:
-        return owner
-    return str(session.uname or "").strip() if not already_shared else ""
-
-
-def _topics(session):
-    """Every topic whose workspace could hold a view or folder for this tenant.
-
-    ⚠ `all_defs`, never `all_tables` — the latter is the whole 28.6 MB row payload (~703 ms on
-    tenant #0) to answer a question about KEYS (D-185).
-    """
-    try:
-        import core.user_tables as ut
-        return (*_BUILTIN_TOPICS, *(ut.all_defs(st=session.runtime) or {}))
-    except Exception:                                       # noqa: BLE001
-        return _BUILTIN_TOPICS
-
-
-def _owns_object(session, kind, oid):
-    """May this caller CLAIM an object that has no grant record yet — i.e. do they own it?
-
-    ⛔ THIS GUARDS THE CLAIM, NOT THE READ, AND THAT IS DELIBERATE. Resolving a view means asking
-    each topic's workspace in turn, which is N store reads; making every share call pay that
-    would put a loop on a route the manage-access dialog opens. The dangerous path is the one
-    where a caller is about to be stamped OWNER of something nobody owns — so the resolution runs
-    exactly there, and the common path (a record exists, `may_administer` decides) is untouched.
-    """
-    if session.admin:
-        return True
-    if kind == "field":
-        # ⭐⭐ W38-T16 — A COLUMN'S OWNER IS ITS `createdBy`, WHICH THE CREATE DOOR ALREADY STAMPS
-        # (`routes_tables.patch_shared_cell`) and the DELETE door already reads as its wall (R8 /
-        # D-172: creator-or-admin). Read from the same place by all three, so a column cannot be
-        # deletable by one person and shareable by another.
-        # ⚠ THIS BRANCH IS NOT OPTIONAL AND ITS ABSENCE FAILS SILENTLY IN THE WORST DIRECTION:
-        # a brand-new column has no grant record, so `put_share` falls to this predicate — and
-        # without it the column's own creator is answered `404 no_object` on the first attempt to
-        # share the thing they just made.
-        table_key, field_key = shares.split_field_oid(oid)
-        if not table_key:
-            return False
-        defn, _shared, _workspace, _shared_key, _grant_topic = _field_definition(
-            session, table_key, field_key)
-        owner = _field_owner(session, defn, _shared)
-        return bool(defn) and owner.lower() == str(session.uname).strip().lower()
-    if kind == "database":
-        # ⚠ `may_open` is THE resolver for a user table (its own docstring says so) and already
-        # admits creator, admin, or a `database` grantee. Re-implementing "who owns a table"
-        # here would be the second definition this wave keeps finding.
-        try:
-            import core.user_tables as ut
-            return bool(ut.may_open(oid, session.uname, is_admin=session.admin,
-                                    st=session.runtime))
-        except Exception:                                   # noqa: BLE001
-            return False
-    try:
-        import core.table_store as table_store
-    except Exception:                                       # noqa: BLE001
-        return False
-    for topic in _topics(session):
-        try:
-            ops = table_store.make(f"{topic}_table_workspace", st=session.runtime)
-            hit = ops.find_view(oid) if kind == "view" else ops.find_folder(oid)
-        except Exception:                                   # noqa: BLE001
-            continue
-        if hit:
-            # `find_view`/`find_folder` answer `(owner_username, …)`. The claim belongs to the
-            # person whose personal stratum holds it — anybody else reaching this line is
-            # exactly the case S-1 describes.
-            return str(hit[0]) == str(session.uname)
-    return False
-
-
-def _can_see_object(session, kind, oid):
-    """May this caller READ an object's grant list — i.e. can they reach the object at all?
-
-    ⛔⛔ THIS IS DELIBERATELY WIDER THAN {@link _owns_object}, AND CONFLATING THE TWO IS A
-    REGRESSION I SHIPPED AND CAUGHT. The first version of T26 guarded BOTH doors with the
-    ownership test, which reads sensibly and is wrong for the read, because **`find_view` searches
-    PERSONAL STRATA ONLY** (its own docstring says so). So a view living in alice's stratum with
-    `permissions.edit = "collaborative"` and no grant record yet — a view bob **can open and edit
-    in the grid** — answered `404` when bob opened its manage-access dialog. Measured before
-    fixing: `table_store._may_see(view, "bob") is True` while `GET /share/view/vc` said
-    `404 no_object`.
-    ⚠ THAT IS THE AUDIT'S OWN S-4 BITING THE AUDIT'S OWN FIX: two systems answer "is this shared",
-    and the wall consulted the grant registry (system A) plus stratum ownership, never the view's
-    `permissions` (system B) — which is the one that actually decides who may OPEN it.
-    ⚠ And it hides the ANSWER, not just the editor. `ViewSidebar`'s Share row is deliberately not
-    gated on edit rights because *"hiding the row from everyone else would hide the ANSWER too —
-    'who has this?' is a fair question for anyone the view was shared with"*. A 404 there tells a
-    legitimate collaborator their view does not exist.
-
-    ⛔ THE CLAIM KEEPS THE NARROW TEST. Being able to SEE an object must not let you become its
-    owner — that is S-1, and widening this predicate onto `put_share` would re-open it.
-    """
-    if _owns_object(session, kind, oid):
-        return True
-    if kind != "view":
-        # A folder carries no per-object visibility flag of its own, and a database's `may_open`
-        # (inside `_owns_object`) already admits grantees. Nothing wider to ask.
-        # ⭐ W38-T16 — AND `field` KEEPS THIS CLOSED, DELIBERATELY. A grantee never reaches here:
-        # `get_share` tests `role is None` first and a grant answers a role, so the only caller
-        # left is an account with no relationship to the column at all. Widening it would let any
-        # signed-in session enumerate who holds which column on a database they cannot open.
-        return False
-    try:
-        import core.table_store as table_store
-        for topic in _topics(session):
-            hit = table_store.make(f"{topic}_table_workspace", st=session.runtime).find_view(oid)
-            if hit:
-                return bool(table_store._may_see(hit[1] if len(hit) > 1 else {},
-                                                 session.uname, is_admin=session.admin))
-    except Exception:                                       # noqa: BLE001
-        return False
-    return False
-
-
-def _entries_or_400(session, entries):
-    """Validate a grant list against the tenant's REAL, ACTIVE accounts — and refuse BY NAME.
-
-    ⛔ `core.shares._clean_entries` silently drops junk, and its docstring argues that correctly:
-    a UI mid-save must not lose the whole list to one malformed row. **But it validates the SHAPE
-    of a string and the role word — never that the user EXISTS, is ACTIVE, or is in this tenant**,
-    so a typo'd name is stored, reported as a successful save, and never reaches anybody. The
-    sharer believes the person has access. That is item 18's plain reading.
-    ⚠ The correct population is computed THREE FUNCTIONS BELOW and served to the picker
-    (`_people`). One route, two populations, and the write door was the permissive one.
-    ⚠ `*` (everyone) is not a user and is admitted deliberately — it is R10's vocabulary for
-    "every account that can already open the surface".
-    """
-    known = {p["username"].strip().lower() for p in _people(session.tenant)}
-    unknown = []
-    for e in entries or ():
-        if not isinstance(e, dict):
-            continue
-        user = str(e.get("user") or "").strip().lower()
-        if user and user != shares.EVERYONE and user not in known:
-            unknown.append(user)
-    if unknown:
-        raise err(400, "unknown_people",
-                  "no active account in this workspace is named "
-                  + ", ".join(sorted(set(unknown)))
-                  + ". Nothing was shared. Pick people from the list rather than typing a name.")
-
-
-@router.get("/share/mine")
-def my_shares(session: Session = Depends(require_session)):
-    """Everything shared WITH me, by kind — the "Shared with me" rail section (R10).
-
-    Registered before `/share/{kind}/{oid}` so the literal path wins the match; FastAPI resolves
-    in declaration order and `mine` would otherwise be read as a `kind`, answering 400 for a URL
-    that is not malformed at all.
-    """
-    return shares.shared_with(session.uname, st=session.runtime)
-
-
-@router.get("/share/{kind}/{oid}")
-def get_share(kind: str, oid: str, session: Session = Depends(require_session)):
-    kind = _kind_or_400(kind)
-    if kind == "field":
-        table_key, field_key = shares.split_field_oid(oid)
-        if table_key and field_key:
-            oid = shares.field_oid(_field_storage_keys(table_key)[2], field_key)
-    rec = shares.grants(kind, oid, st=session.runtime)
-    role = shares.role_for(kind, oid, session.uname, is_admin=session.admin, st=session.runtime)
-    may_admin = shares.may_administer(kind, oid, session.uname, is_admin=session.admin,
-                                      st=session.runtime)
-    # W39-T29 — the dialog opens with GET before its first PUT.  Until that PUT exists the grant
-    # registry has no owner to return from `may_administer`, even though the same caller may safely
-    # claim their own object through the PUT path below.  Reflect that exact claim predicate here:
-    # a Member who owns an unshared View receives the people picker; a collaborator still does not.
-    if not rec["owner"] and not may_admin and _owns_object(session, kind, oid):
-        may_admin = True
-    # ⭐ W32-T26 (audit S-3) — A STRANGER LEARNS NOTHING. This route used to answer for ANY id:
-    # who owns it, everyone it is granted to, and the tenant's whole username↔name directory —
-    # to any signed-in session, about objects it cannot open. Now a caller with no role on an
-    # object must prove they can reach it, and gets a 404 otherwise: the same answer a
-    # non-existent id gives, so the route cannot be used to probe which ids are real.
-    # ⚠ `role is None` is the cheap pre-test, so the N-topic resolution below runs only for a
-    # caller who has no relationship with the object at all.
-    if role is None and not _can_see_object(session, kind, oid):
-        raise err(404, "no_object", "no such item, or it is not shared with this account")
-    return {
-        **rec,
-        "role": role,
-        "mayAdminister": may_admin,
-        # ⚠ WAVE 21 (C1 identity fix): grant entries BIND on USERNAMES, so the picker must carry
-        # them. `assignable_people` serves bare display names because `user`-kind CELLS store
-        # display names — that list's shape cannot change without migrating cell values — so
-        # this route serves objects of its own. Existing grants that were written as lowercased
-        # display names are normalised by the wave-21 cleanup script.
-        # ⭐ W32-T26 (audit S-3) — the roster is the EDITOR's data, so it rides only for a caller
-        # who may open the editor. A read-only grantee gets the grant list (their fair question is
-        # "who else has this?") and not a directory of every account in the workspace.
-        # ⭐⭐ W40-T02 / R4 — AND THAT RULE IS WHY THIS LINE NEEDED NO EDIT. `may_administer` now
-        # answers True for an `edit` grantee on a VIEW, which MOVES that account into "may open
-        # the editor" — so the picker they need arrives by the roster riding on the same flag it
-        # always did. Gating it on anything else (owner, `role == 'owner'`, a fresh predicate)
-        # would be a second answer to a question this file already answers once, and would leave
-        # the new grantee with an editor and no people to put in it. A `view` grantee is still
-        # `may_admin=False` here and still gets `[]`.
-        "people": _people(session.tenant) if may_admin else [],
-    }
-
-
-def _people(tenant):
-    """[{username, name}] for this tenant — same population as `assignable_people`, with the
-    BINDING identity alongside the display one."""
-    try:
-        reg = users.registry() or {}
-    except Exception:
-        return []
-    want = str(tenant or '').strip().lower()
-    out = []
-    for uname, u in reg.items():
-        if not isinstance(u, dict) or u.get('active') is False:
-            continue
-        if want and str(u.get('tenant') or 'royal-imports').strip().lower() != want:
-            continue
-        out.append({"username": str(uname), "name": str(u.get('name') or uname)})
-    return sorted(out, key=lambda p: p["name"].lower())
-
-
-@router.put("/share/{kind}/{oid}")
-def put_share(kind: str, oid: str, body: dict = Body(default=None),
-              session: Session = Depends(require_session)):
-    kind = _kind_or_400(kind)
-    if kind == "field":
-        table_key, field_key = shares.split_field_oid(oid)
-        if table_key and field_key:
-            oid = shares.field_oid(_field_storage_keys(table_key)[2], field_key)
-    body = body or {}
-    rec = shares.grants(kind, oid, st=session.runtime)
-    # `claiming` is the "no owner yet, and this caller may become one" branch, hoisted to a name
-    # because TWO decisions below need it: the ceiling (a claimant is about to be the owner, so
-    # their ceiling is an owner's) and the owner written back (D3 — see `set_grants` at the end).
-    claiming = False
-    # An object with NO grant record yet has no owner — the first person to share it claims it.
-    # That is safe because reaching this route at all means passing the surface's own wall, and
-    # the alternative (refusing until somebody seeds an owner) would make a brand-new folder
-    # unshareable by the person who just made it.
-    if rec["owner"]:
-        if not shares.may_administer(kind, oid, session.uname, is_admin=session.admin,
-                                     st=session.runtime):
-            # ⭐ R4 / W40-T02 — `may_administer` now also admits an `edit` grantee on a VIEW, so
-            # the population refused here is narrower than the code word `not_owner` suggests: a
-            # `view` grantee, or an account with an `edit` role on a kind outside
-            # `shares.RESHARE_KINDS`. The code string is kept because clients match on it.
-            raise err(403, "not_owner",
-                      "only the owner of this item (or an administrator) can change who it is "
-                      "shared with")
-    # ⛔⛔ W32-T26 (audit S-1) — THE CLAIM NOW HAS A PRECONDITION. An object with no grant record
-    # is still claimed by the first person to share it — that rule is right, and refusing until
-    # somebody seeds an owner would make a brand-new folder unshareable by the person who just
-    # made it. What was missing is the half the old comment ASSERTED and the code never did: the
-    # claimant has to be able to reach the object. Without this, any signed-in account could
-    # stamp itself owner of an id it had never seen and lock the real creator out for good.
-    elif not _owns_object(session, kind, oid):
-        raise err(404, "no_object", "no such item, or it is not shared with this account")
-    else:
-        claiming = True
-    entries = body.get("entries")
-    if not isinstance(entries, list):
-        raise err(400, "bad_entries",
-                  "entries must be a list of {user, role}. Send [] to un-share, which is how "
-                  "revoking is expressed")
-    _entries_or_400(session, entries)
-    # ⭐⭐ R4 / W40-T02 — THE CEILING. `may_administer` above now opens this door to an `edit`
-    # grantee on a VIEW, so R4's other half ("a re-share may never exceed the role the re-sharer
-    # holds") needs a check of its own: that caller may hand out `view`, and conferring `edit`
-    # stays the owner's or an administrator's.
-    #
-    # ⛔ AFTER THE ADMISSION, NEVER BEFORE, AND THAT ORDER IS A SECURITY PROPERTY. A caller with
-    # no role at all must keep receiving `404 no_object` (audit S-1/S-3: a stranger learns
-    # nothing, so this route cannot be used to probe which ids are real). A ceiling raised first
-    # would answer that caller `403` and turn the one route hardened against id-probing back into
-    # an oracle that confirms an id exists. It also runs before the `field` promotion below, so a
-    # refusal cannot leave a column promoted with no grant written.
-    #
-    # ⛔ AND IT IS THE DELTA, NOT EVERY ROW OF THE BODY — read off the shipped client, not
-    # assumed. `ShareDialog.save` PUTs the WHOLE list every time ("a body assembled from a delta
-    # would revoke everyone it failed to mention"), so the re-sharer's OWN `{user, role: "edit"}`
-    # row rides in every payload they are able to produce. Refusing per-entry would `403` the
-    # exact re-share this ticket exists to enable, and the only body that would pass is one that
-    # revokes the re-sharer. So what is refused is edit access this caller is CREATING: a name
-    # arriving at `edit`, or an existing `view` grantee raised to it. A row that already stood at
-    # `edit` was the OWNER's decision, and is not this caller's to be refused for.
-    #
-    # ⚠ A CLAIMANT IS AN OWNER. The branch above admits a Member who owns an object that has no
-    # grant record yet, and `set_grants` is about to stamp them owner — asking the registry for
-    # their role here would answer `None` (no record exists to hold one) and refuse the first
-    # `edit` grant on every newly created view. Same predicate as the door, one line apart.
-    ceiling = "edit" if claiming else shares.max_grantable_role(
-        kind, oid, session.uname, is_admin=session.admin, st=session.runtime)
-    if ceiling != "edit":
-        held = {e.get("user"): e.get("role") for e in (rec["entries"] or ())}
-        raised = set()
-        for e in entries:
-            if not isinstance(e, dict):
-                continue
-            who = str(e.get("user") or "").strip().lower()
-            if who and str(e.get("role") or "").strip().lower() == "edit" \
-                    and held.get(who) != "edit":
-                raised.add(who)
-        if raised:
-            noun = {"view": "view", "folder": "folder",
-                    "database": "database", "field": "column"}.get(kind, "item")
-            named = ", ".join("everyone in this workspace" if w == shares.EVERYONE else w
-                              for w in sorted(raised))
-            raise err(403, "grant_exceeds_role",
-                      "you can share this " + noun + " at Can view, which is as far as your own "
-                      "access reaches. Only its owner (or an administrator) can give somebody "
-                      "Can edit, so nothing was saved. Set " + named
-                      + " to Can view and save again.")
-    if kind == "field":
-        # A field grant is a visibility and edit wall. Promote a private custom
-        # field exactly once, then keep the requested Share field role as the
-        # authoritative override for the legacy permissions bag.
-        from core import field_permissions, shared_overlay
-        table_key, field_key = shares.split_field_oid(oid)
-        defn, already_shared, workspace_key, shared_key, grant_topic = _field_definition(
-            session, table_key, field_key)
-        if not isinstance(defn, dict):
-            raise err(404, "no_object", "no such field, or it is not shared with this account")
-        if not already_shared:
-            defn = field_permissions.promote_field(
-                workspace_key, shared_key, grant_topic,
-                session.uname, defn, st=session.runtime)
-        stamped = dict(defn)
-        stamped["shared"] = True
-        stamped["granted"] = True
-        shared_overlay.put_field(shared_key, field_key, stamped, st=session.runtime)
-        oid = shares.field_oid(grant_topic, field_key)
-    # ⭐⭐ R4 / W40-T02 (D3) — OWNERSHIP NEVER MOVES ON A RE-SHARE, AND IT IS SAID HERE RATHER
-    # THAN LEFT TO FALL OUT. `set_grants`' owner is sticky, so the old `rec["owner"] or
-    # session.uname` already happened not to transfer ownership — incidentally, as a property of
-    # the callee. R4 names ownership transfer as one of the two halves of the old protection that
-    # SURVIVES the widening, and a rule that survives by accident is one the next edit deletes
-    # without noticing. So the branch is explicit: a claimant becomes the owner, and everybody
-    # else — an owner re-saving, an admin, and now an `edit` grantee re-sharing — passes the
-    # EXISTING owner straight back through. `claiming` is the same flag the admission set, so
-    # there is no second answer to "is this person taking ownership".
-    out = shares.set_grants(kind, oid, entries,
-                            owner=session.uname if claiming else rec["owner"],
-                            st=session.runtime)
-    _notify_new_grantees(session, kind, oid, before=rec["entries"], after=out.get("entries") or [])
-    return out
-
-
-def _notify_new_grantees(session, kind, oid, before, after):
-    """⭐⭐ W32-T28 (owner item 18's last clause, contract C3) — tell the RECEIVER, in their Inbox.
-
-    Owner item 18 ends *"being shared a database notifies the receiver"*. Until now sharing was
-    silent: the grant landed in a rail section the receiver had to notice on their own, which is
-    why "I shared it with you" and "I never saw it" were both true.
-
-    ⛔ WRITTEN ON THE SHARE, NEVER POLLED. `/notifications` re-evaluates view-ALERTS on read
-    because an alert is a live question about rows; a share is an EVENT that happened once, and
-    polling for it would mean re-deriving "was this new?" on every inbox open — the diff below
-    only exists here, at the moment the set changes.
-
-    ⚠ ONLY THE NEWLY ADDED. `PUT` REPLACES the whole entry set (revoking is expressed by absence),
-    so every save re-sends everyone who was already there. Diffing against `before` is what stops
-    a rename or a role change from ringing the bell for people whose access did not change.
-    ⚠ `*` IS NOT NOTIFIED: there is no user to name, and minting one notification per account in
-    the tenant on a single click is a broadcast nobody asked for. The rail still shows it.
-    ⚠ IT NEVER RAISES. A notification that fails must not fail the share that triggered it — the
-    grant is the user's actual intent, and `core.alerts.notify` writes with `flush='async'`.
-    """
-    try:
-        was = {e.get("user") for e in (before or ()) if isinstance(e, dict)}
-        fresh = [str(e.get("user")) for e in (after or ())
-                 if isinstance(e, dict) and e.get("user") not in was
-                 and e.get("user") != shares.EVERYONE]
-        if not fresh:
-            return
-        import core.alerts as alerts
-
-        label, route, view_id = _object_ref(session, kind, oid)
-        if not route:
-            # ⛔ NO ROUTE, NO NOTIFICATION — the receiver would get a row that opens nothing, and
-            # `notification_view` would have to invent a target. Silence is the honest answer
-            # here; the rail still shows the grant under "Shared with me".
-            return
-        sharer = str(session.user.get("name") or session.uname)
-        for user in fresh:
-            # ⚠ THE SHAPE IS `routes_alerts.notification_view`'s SHARE BRANCH, and the two must
-            # agree or the Inbox row is unclickable: `topic` selects the branch and `key` becomes
-            # `alertId`, which that branch reads as the id to open. Both constants are IMPORTED
-            # from there rather than typed again — one vocabulary, one owner.
-            # ⭐⭐ W33-T28 (`ASK C-14`, answered) — `actor` IS THE SENDER, AND IT IS THE ONLY WAY
-            # THE INBOX CAN NAME ONE. An alert and an automation have no person behind them and
-            # are honestly named by their machine; a SHARE has a real person, and only this call
-            # site knows who. ⛔ It is passed as its OWN field rather than recovered from the
-            # `detail` prose below: a sender parsed out of "<name> shared this with you" breaks
-            # the first time the sentence is reworded, silently, in the header
-            # [[grep-output-is-not-source]]. The prose stays as the body; this is the From.
-            alerts.notify(user, label, topic=_SHARE_TOPIC, key=route, row_id=view_id,
-                          detail=f"{sharer} shared this with you", actor=sharer,
-                          st=session.runtime)
-    except Exception:                                       # noqa: BLE001
-        return
-
-
-def _object_ref(session, kind, oid):
-    """`(label, route, view_id)` — what to CALL the shared thing, and where it OPENS.
-
-    ⛔ THE ROUTE IS RESOLVED HERE, NOT SHAPED IN THE CONSUMER, AND THE FIRST VERSION GOT IT
-    WRONG: it put the raw `oid` in the notification's key, so a shared VIEW produced
-    `target: {module: "database", id: "view_42"}` — an instruction to open a database named
-    `view_42`. It read perfectly in the payload and would have opened nothing. **A view is not
-    addressable on its own; it is a SELECTION inside a topic's grid**, so the pair is what has to
-    travel. Caught by looking at the notification the driver actually produced, not by reading
-    the code back.
-
-    ⚠ `label` never falls back to a raw id. A notification headed `ut_leads_3f2a` tells the
-    receiver nothing they can act on, and the id is already in the target.
-    ⚠ An unresolvable object answers `route=None`, and the caller then sends NOTHING rather than
-    a row that opens nowhere.
-    """
-    try:
-        if kind == "field":
-            # ⭐⭐ W38-T16 — A COLUMN IS NOT ADDRESSABLE ON ITS OWN, exactly as a view is not: it
-            # is a column INSIDE a database, so the target that travels is the DATABASE. Without
-            # this branch the function falls through to the view/folder loop, finds nothing,
-            # answers `route=None` — and `_notify_new_grantees` returns EARLY. The grant lands and
-            # the receiver is never told, which is the silent half of owner item 18 reopened one
-            # kind over.
-            from routes_alerts import route_for_topic
-            table_key, field_key = shares.split_field_oid(oid)
-            if not table_key:
-                return ("A column", None, "")
-            try:
-                defn, _shared, _workspace, shared_key, _grant_topic = _field_definition(
-                    session, table_key, field_key)
-            except Exception:                               # noqa: BLE001
-                defn = None
-            label = str((defn or {}).get("label") or "").strip() or field_key
-            # ⚠ TWO SPELLINGS REACH THIS LINE AND ONE MAP ANSWERS BOTH. `shared_overlay` is keyed
-            # by whatever the calling door already held: a `ut_*` database uses its bare key,
-            # while a registry topic uses `<topic>_table_workspace` (`product_data.TABLE_KEY`).
-            # `route_for_topic` speaks the GRID SCOPE vocabulary (`customer`, not
-            # `customer_data`), so the suffix comes off before it is asked — rather than a second
-            # route table being written here, which is how the two come apart.
-            _WS = "_table_workspace"
-            scope = {"customer_data": "customer", "product_data": "product"}.get(table_key)
-            if scope is None:
-                scope = table_key[:-len(_WS)] if table_key.endswith(_WS) else table_key
-            return (label, route_for_topic(scope) or None, "")
-        if kind == "database":
-            import core.user_tables as ut
-            defn = (ut.all_defs(st=session.runtime) or {}).get(str(oid)) or {}
-            # A user table IS its own route key in both vocabularies (`route_for_topic`).
-            return (str(defn.get("label") or "").strip() or "A database", str(oid), "")
-        import core.table_store as table_store
-        from routes_alerts import route_for_topic
-        for topic in _topics(session):
-            ops = table_store.make(f"{topic}_table_workspace", st=session.runtime)
-            hit = ops.find_view(oid) if kind == "view" else ops.find_folder(oid)
-            if not hit:
-                continue
-            route = route_for_topic(topic)
-            if not route:
-                break
-            row = hit[1] if len(hit) > 1 else {}
-            name = str((row or {}).get("name") or "").strip()
-            # ⚠ Only a VIEW carries a selection. A folder is a rail grouping, so the target opens
-            # the grid and stops there rather than naming a view the receiver did not get.
-            return (name or ("A view" if kind == "view" else "A folder"),
-                    route, str(oid) if kind == "view" else "")
-    except Exception:                                       # noqa: BLE001
-        pass
-    return ({"view": "A view", "folder": "A folder",
-             "field": "A column"}.get(kind, "An item"), None, "")
+"""routes_shares.py — the manage-access surface (wave 20, owner ruling R10, contract C-SHARE).
+
+    GET  /api/v1/share/{kind}/{oid}      -> {owner, entries:[{user,role}], mayAdminister, people}
+    PUT  /api/v1/share/{kind}/{oid}      <- {entries:[{user,role}]}   (REPLACES the set)
+    GET  /api/v1/share/mine              -> {view:[id], folder:[id], database:[id]}
+
+`kind` ∈ view | folder | database | field. Roles are `view` | `edit` — the same two words the
+view rail already speaks, now extended to folders, databases and COLUMNS so there is ONE
+vocabulary in the UI (R10: "the same picker views use").
+
+⭐⭐ **W38-T16 — `field` IS THE FOURTH KIND, AND ITS `oid` IS TOPIC-QUALIFIED: `"<table_key>:<field_key>"`**
+(`shares.field_oid`). A bare column key repeats across databases — `notes` exists on a dozen —
+so a grant stored under one would admit the grantee to every `notes` column in the tenant at
+once. ⛔ THREE functions in this file branch on kind and ALL THREE need the new one, which is not
+obvious because only two of them fail loudly: `_owns_object` (without it a column's own creator
+is 404'd trying to share the thing they just made) and `_object_ref` (without it `route` is None,
+`_notify_new_grantees` returns early, and the grantee is **granted and never told** — owner item
+18's silent half, reopened one kind over). `_can_see_object` stays deliberately CLOSED for
+anything that is not a view.
+
+⭐⭐ **A "Can edit" GRANTEE MAY RE-SHARE A VIEW — OWNER RULING R4, BUILT AS W40-T02** (instruction
+4: *"Edit View so a member can share a View as well, not just an admin"*). This REVERSES the flat
+owner-or-admin sentence that stood here, and the reversal is bounded three ways, all enforced HERE
+and not in the client:
+
+  1. **ONLY `kind='view'`.** `shares.RESHARE_KINDS` is the one spelling of that. `folder`,
+     `database` and `field` still require the owner or an admin, and the paragraph below is why
+     the `database` kind in particular was never a candidate: a `ut_*` grant's blast radius is a
+     whole table, where a view is one saved SELECTION over rows the receiver's own wall governs.
+  2. **A RE-SHARE MAY NEVER EXCEED THE RE-SHARER'S OWN ROLE**, and the strict reading ships: an
+     `edit` grantee may hand out `view` and NEVER `edit`. `shares.max_grantable_role` answers the
+     ceiling, `put_share` enforces it on the DELTA (a name arriving at `edit`, or one raised to
+     it) — never on every row of the body, because the `PUT` REPLACES and `ShareDialog.save`
+     therefore re-sends the whole list with the re-sharer's own `edit` row inside it. Conferring
+     `edit` stays the owner's alone.
+  3. **OWNERSHIP NEVER MOVES.** A caller re-sharing rather than owning passes the EXISTING owner
+     straight through (`put_share` below, stated rather than incidental).
+
+⭐⭐ **AND R4 BOUNDED ONLY THE ROLE. TWO MORE BOUNDS ARRIVED WITH THE OWNER'S RULING OF
+2026-08-24, BECAUSE THE GAPS WERE MEASURED ON THE SHIPPED BUILD:**
+
+  4. **A RE-SHARER MAY SHARE ONLY WITH SPECIFIC PEOPLE (D-473).** Owner: *"a re-sharer can only
+     share to specific people"*. Before this, `[fisch:edit, *:view]` from an `edit` grantee was a
+     `200` — the role ceiling could not see it, because `*` at `view` never exceeds a `view`
+     ceiling. `_audience_added` refuses an `EVERYONE` entry this caller is ADDING, and lets one
+     the OWNER already placed ride along untouched, for the same delta reason as (2).
+  5. **A RE-SHARER MAY UN-SHARE ONLY THE PEOPLE THEY SHARED TO (D-474).** Owner: *"a re-sharer
+     can only unshare the people it shared to"*. Before this, an `edit` grantee PUTting a list
+     that omitted another grantee got `200` and that person's access was gone; `PUT []` left the
+     view shared with nobody. Answering this needs a fact the registry did not store, so each
+     entry now carries `by` — who placed it — stamped by `shares.set_grants(granter=…)` and
+     consulted by `_unremovable`. ⛔ An entry with NO `by` (every grant predating the change) is
+     the owner's or an admin's to revoke and nobody else's: fail-closed, because from the door
+     "unstamped" and "somebody else's" are the same observation.
+
+⛔ **SO BOTH FEARS THE OLD SENTENCE NAMED ARE NOW ANSWERED, AND THE PARAGRAPH THAT PRICED THE
+SECOND ONE IS GONE RATHER THAN SOFTENED.** It read *"'Widen a users-scoped view to everyone' is
+NOT closed — an `edit` grantee may add `*` — it is CAPPED at Can view"*, and that was an accurate
+account of R4 that the owner overruled the moment it was put in front of them. *"Grant themselves
+ownership and lock you out"* stays closed by (3) and `set_grants`' sticky owner. A `view` grantee
+still cannot share at all, and still gets `403`. The client greys the editor for
+non-administrators and offers "Can edit" to anyone it greys in; that is a courtesy, and these
+checks are the wall.
+
+⚠ **WHAT `GET` NOW DISCLOSES.** The grant record carries `by`, and this route returns the record
+verbatim — so anybody who may read a view's grant list also learns who added each person, a
+`view` grantee included. Accepted deliberately (the alternative is a second, stripped read path
+and therefore a second answer to one question), and stated here because this file states costs
+rather than leaving them to be discovered.
+
+⚠ **THE GRANT NEVER WIDENS PAST THE MODULE WALL — ON A GOVERNED MODULE.** `*` ("everyone") means
+every account that can already open the surface: `require_session` plus the topic's own gate run
+first, and for `customer_data` / `product_data` the receiver's own row scope and hidden-field
+closure run BEFORE any foreign view is merged. Sharing there can only narrow-or-equal the set that
+could already reach the data ([[aios-permissioning]]).
+
+⛔⛔ **AND THAT SENTENCE IS FALSE FOR `kind='database'`, WHICH IS WHY IT NOW SAYS "ON A GOVERNED
+MODULE" (W32-T26, audit S-8).** `routes_admin._PERM_MODULES` is `("customer_data","product_data")`
+and `_clean_perms` **400s** on anything else, so **no row filter and no hidden field can even be
+DECLARED for a `ut_*` database** — `routes_tables.py` makes zero `perm_scope` calls and passes
+`hidden_keys=frozenset()`. There is no module wall behind a user table for a grant to be bounded
+by: **this registry IS the wall.** So a `database` grant is ALL-OR-NOTHING — every row, every
+column — and an `*` database grant admits every account in the tenant to all of it.
+That is a real capability, deliberately kept; what was wrong was a docstring promising a second
+wall that does not exist for this kind. Scoping user tables is booked, not done
+(`waves/wave32/sharing-audit.md` S-8).
+
+⚠ **TWO SYSTEMS ANSWER "IS THIS SHARED", AND THEY ARE NOT THE SAME ONE (audit S-4).** THIS
+registry decides who appears in *"Shared with me"* and who may re-share. **`table_store.is_shared`
+— the view's own `permissions` — is what actually decides who may OPEN a view.** A grant here
+whose object is invisible under that one is a row in a list that opens a refusal, which is what
+made item 18 worth auditing. `_entries_or_400` closes the common cause (a name nobody has), but
+the two vocabularies are still two.
+"""
+from fastapi import APIRouter, Body, Depends
+
+import core.shares as shares
+import core.users as users
+from deps import Session, err, require_session
+# ⭐ W32-T28 (C3) — the SHARE notification's topic word, imported from the module that CLASSIFIES
+# it (`routes_alerts.notification_view`) rather than typed again here. The producer and the
+# reader agreeing about one string is the whole difference between an Inbox row that opens the
+# shared database and one that is quietly unclickable.
+from routes_alerts import SHARE_TOPIC as _SHARE_TOPIC
+
+router = APIRouter(prefix="/api/v1")
+
+
+def _kind_or_400(raw):
+    try:
+        return shares._check_kind(raw)
+    except ValueError as e:
+        raise err(400, "bad_kind", str(e))
+
+
+# ── ⭐⭐ WAVE 32 · T26 (owner item 18, ruling R12) — THE WALL THIS FILE SAID IT HAD ─────────────
+#
+# `put_share`'s comment used to justify the first-claim rule with *"reaching this route at all
+# means passing the surface's own wall"*. **There was no such wall.** `kind` and `oid` are free
+# strings off the URL and the only dependency was `require_session`, so any signed-in account
+# could `PUT` a grant on an id it had never seen. Because the 403 sat behind `if rec["owner"]`,
+# an object with no grant record skipped the check entirely and the caller was stamped OWNER —
+# sticky, so **the real creator was then refused on their own view, permanently.** Driven, not
+# argued: `waves/wave32/sharing-audit.md` S-1 carries the four-step transcript.
+#
+# ⚠ AND IT WAS SILENT ON BOTH SIDES. The claimant does not even see the object in their own
+# "Shared with me" (`shared_with` excludes what you own), so nothing appears anywhere until the
+# victim next opens the dialog.
+
+#: The built-in grid topics. A view or folder lives in `{topic}_table_workspace`, and the share
+#: route is not told which topic — so resolving one means asking each.
+_BUILTIN_TOPICS = ("customer", "product")
+
+
+def _field_storage_keys(table_key):
+    """Resolve the client-facing field topic to its durable stores and grant topic."""
+    raw = str(table_key or "").strip()
+    if raw in ("customer_data", "customer_table_workspace"):
+        return "customer_table_workspace", "customer_table_workspace", "customer_data"
+    if raw in ("product_data", "product_table_workspace"):
+        return "product_table_workspace", "product_table_workspace", "product_data"
+    if raw.startswith("ut_"):
+        bare = raw[:-len("_table_workspace")] if raw.endswith("_table_workspace") else raw
+        return f"{bare}_table_workspace", bare, bare
+    workspace = raw if raw.endswith("_table_workspace") else f"{raw}_table_workspace"
+    shared = raw[:-len("_table_workspace")] if raw.endswith("_table_workspace") else raw
+    return workspace, shared, shared
+
+
+def _field_definition(session, table_key, field_key):
+    """Return the shared/private definition and the keys used by its write paths."""
+    workspace_key, shared_key, grant_topic = _field_storage_keys(table_key)
+    try:
+        from core import shared_overlay
+        shared = (shared_overlay.fields(shared_key, st=session.runtime) or {}).get(field_key)
+        if isinstance(shared, dict):
+            return shared, True, workspace_key, shared_key, grant_topic
+        import core.table_store as table_store
+        private = (table_store.make(workspace_key, st=session.runtime)
+                   .workspace(session.uname).get("fields") or {}).get(field_key)
+        if isinstance(private, dict):
+            return private, False, workspace_key, shared_key, grant_topic
+    except Exception:                                       # noqa: BLE001
+        pass
+    return None, False, workspace_key, shared_key, grant_topic
+
+
+def _field_owner(session, definition, already_shared):
+    """Resolve the creator for the share claim wall.
+
+    A private field is already namespaced by the caller's own workspace.  Older field records
+    from before the host-side creator stamp therefore remain safely claimable by that workspace
+    owner, while a shared definition with no creator stays admin-only because its storage is
+    tenant-wide and cannot identify an owner from residency alone.
+    """
+    owner = str((definition or {}).get("createdBy") or "").strip()
+    if owner:
+        return owner
+    return str(session.uname or "").strip() if not already_shared else ""
+
+
+def _topics(session):
+    """Every topic whose workspace could hold a view or folder for this tenant.
+
+    ⚠ `all_defs`, never `all_tables` — the latter is the whole 28.6 MB row payload (~703 ms on
+    tenant #0) to answer a question about KEYS (D-185).
+    """
+    try:
+        import core.user_tables as ut
+        return (*_BUILTIN_TOPICS, *(ut.all_defs(st=session.runtime) or {}))
+    except Exception:                                       # noqa: BLE001
+        return _BUILTIN_TOPICS
+
+
+def _owns_object(session, kind, oid):
+    """May this caller CLAIM an object that has no grant record yet — i.e. do they own it?
+
+    ⛔ THIS GUARDS THE CLAIM, NOT THE READ, AND THAT IS DELIBERATE. Resolving a view means asking
+    each topic's workspace in turn, which is N store reads; making every share call pay that
+    would put a loop on a route the manage-access dialog opens. The dangerous path is the one
+    where a caller is about to be stamped OWNER of something nobody owns — so the resolution runs
+    exactly there, and the common path (a record exists, `may_administer` decides) is untouched.
+    """
+    if session.admin:
+        return True
+    if kind == "field":
+        # ⭐⭐ W38-T16 — A COLUMN'S OWNER IS ITS `createdBy`, WHICH THE CREATE DOOR ALREADY STAMPS
+        # (`routes_tables.patch_shared_cell`) and the DELETE door already reads as its wall (R8 /
+        # D-172: creator-or-admin). Read from the same place by all three, so a column cannot be
+        # deletable by one person and shareable by another.
+        # ⚠ THIS BRANCH IS NOT OPTIONAL AND ITS ABSENCE FAILS SILENTLY IN THE WORST DIRECTION:
+        # a brand-new column has no grant record, so `put_share` falls to this predicate — and
+        # without it the column's own creator is answered `404 no_object` on the first attempt to
+        # share the thing they just made.
+        table_key, field_key = shares.split_field_oid(oid)
+        if not table_key:
+            return False
+        defn, _shared, _workspace, _shared_key, _grant_topic = _field_definition(
+            session, table_key, field_key)
+        owner = _field_owner(session, defn, _shared)
+        return bool(defn) and owner.lower() == str(session.uname).strip().lower()
+    if kind == "database":
+        # ⚠ `may_open` is THE resolver for a user table (its own docstring says so) and already
+        # admits creator, admin, or a `database` grantee. Re-implementing "who owns a table"
+        # here would be the second definition this wave keeps finding.
+        try:
+            import core.user_tables as ut
+            return bool(ut.may_open(oid, session.uname, is_admin=session.admin,
+                                    st=session.runtime))
+        except Exception:                                   # noqa: BLE001
+            return False
+    try:
+        import core.table_store as table_store
+    except Exception:                                       # noqa: BLE001
+        return False
+    for topic in _topics(session):
+        try:
+            ops = table_store.make(f"{topic}_table_workspace", st=session.runtime)
+            hit = ops.find_view(oid) if kind == "view" else ops.find_folder(oid)
+        except Exception:                                   # noqa: BLE001
+            continue
+        if hit:
+            # `find_view`/`find_folder` answer `(owner_username, …)`. The claim belongs to the
+            # person whose personal stratum holds it — anybody else reaching this line is
+            # exactly the case S-1 describes.
+            return str(hit[0]) == str(session.uname)
+    return False
+
+
+def _can_see_object(session, kind, oid):
+    """May this caller READ an object's grant list — i.e. can they reach the object at all?
+
+    ⛔⛔ THIS IS DELIBERATELY WIDER THAN {@link _owns_object}, AND CONFLATING THE TWO IS A
+    REGRESSION I SHIPPED AND CAUGHT. The first version of T26 guarded BOTH doors with the
+    ownership test, which reads sensibly and is wrong for the read, because **`find_view` searches
+    PERSONAL STRATA ONLY** (its own docstring says so). So a view living in alice's stratum with
+    `permissions.edit = "collaborative"` and no grant record yet — a view bob **can open and edit
+    in the grid** — answered `404` when bob opened its manage-access dialog. Measured before
+    fixing: `table_store._may_see(view, "bob") is True` while `GET /share/view/vc` said
+    `404 no_object`.
+    ⚠ THAT IS THE AUDIT'S OWN S-4 BITING THE AUDIT'S OWN FIX: two systems answer "is this shared",
+    and the wall consulted the grant registry (system A) plus stratum ownership, never the view's
+    `permissions` (system B) — which is the one that actually decides who may OPEN it.
+    ⚠ And it hides the ANSWER, not just the editor. `ViewSidebar`'s Share row is deliberately not
+    gated on edit rights because *"hiding the row from everyone else would hide the ANSWER too —
+    'who has this?' is a fair question for anyone the view was shared with"*. A 404 there tells a
+    legitimate collaborator their view does not exist.
+
+    ⛔ THE CLAIM KEEPS THE NARROW TEST. Being able to SEE an object must not let you become its
+    owner — that is S-1, and widening this predicate onto `put_share` would re-open it.
+    """
+    if _owns_object(session, kind, oid):
+        return True
+    if kind != "view":
+        # A folder carries no per-object visibility flag of its own, and a database's `may_open`
+        # (inside `_owns_object`) already admits grantees. Nothing wider to ask.
+        # ⭐ W38-T16 — AND `field` KEEPS THIS CLOSED, DELIBERATELY. A grantee never reaches here:
+        # `get_share` tests `role is None` first and a grant answers a role, so the only caller
+        # left is an account with no relationship to the column at all. Widening it would let any
+        # signed-in session enumerate who holds which column on a database they cannot open.
+        return False
+    try:
+        import core.table_store as table_store
+        for topic in _topics(session):
+            hit = table_store.make(f"{topic}_table_workspace", st=session.runtime).find_view(oid)
+            if hit:
+                return bool(table_store._may_see(hit[1] if len(hit) > 1 else {},
+                                                 session.uname, is_admin=session.admin))
+    except Exception:                                       # noqa: BLE001
+        return False
+    return False
+
+
+def _entries_or_400(session, entries):
+    """Validate a grant list against the tenant's REAL, ACTIVE accounts — and refuse BY NAME.
+
+    ⛔ `core.shares._clean_entries` silently drops junk, and its docstring argues that correctly:
+    a UI mid-save must not lose the whole list to one malformed row. **But it validates the SHAPE
+    of a string and the role word — never that the user EXISTS, is ACTIVE, or is in this tenant**,
+    so a typo'd name is stored, reported as a successful save, and never reaches anybody. The
+    sharer believes the person has access. That is item 18's plain reading.
+    ⚠ The correct population is computed THREE FUNCTIONS BELOW and served to the picker
+    (`_people`). One route, two populations, and the write door was the permissive one.
+    ⚠ `*` (everyone) is not a user and is admitted deliberately — it is R10's vocabulary for
+    "every account that can already open the surface".
+    """
+    known = {p["username"].strip().lower() for p in _people(session.tenant)}
+    unknown = []
+    for e in entries or ():
+        if not isinstance(e, dict):
+            continue
+        user = str(e.get("user") or "").strip().lower()
+        if user and user != shares.EVERYONE and user not in known:
+            unknown.append(user)
+    if unknown:
+        raise err(400, "unknown_people",
+                  "no active account in this workspace is named "
+                  + ", ".join(sorted(set(unknown)))
+                  + ". Nothing was shared. Pick people from the list rather than typing a name.")
+
+
+def _named(who):
+    """The people in a refusal, in the words the person reading it uses.
+
+    ONE spelling, used by all three re-share refusals below. `*` is never printed raw: the store's
+    wildcard is a single character, and a 403 reading *"set * to Can view"* names nothing a person
+    can find in the dialog they are looking at.
+    """
+    return ", ".join("everyone in this workspace" if w == shares.EVERYONE else w
+                     for w in sorted(who))
+
+
+def _audience_added(entries, held):
+    """⭐⭐ D-473 — the `EVERYONE` grant this caller is ADDING, or the empty set.
+
+    OWNER RULING 2026-08-24, verbatim: *"a re-sharer can only share to specific people"*. R4's
+    ceiling bounded the ROLE a re-sharer may hand out and said nothing about the AUDIENCE, and the
+    gap was measured rather than argued: an `edit` grantee PUTting `[fisch:edit, *:view]` was
+    answered `200`, widening a two-person view to the whole tenant at `Can view`. The role check
+    could not catch it, because `*` at `view` never exceeds a `view` ceiling.
+
+    ⛔ IT IS THE ADDITION THAT IS REFUSED, NOT THE PRESENCE, and that is the same shape as the
+    role check one arm above, for the same reason: the `PUT` REPLACES, so `ShareDialog.save`
+    re-sends the WHOLE list every time. An `*` the OWNER placed rides along in every payload the
+    re-sharer is able to produce, and refusing on presence would `403` every save on a view the
+    owner had already opened to everyone — a re-sharer locked out of a list they may legitimately
+    edit, with a message about a row they did not touch.
+
+    ⛔ ROLE IS NOT CONSULTED HERE, DELIBERATELY. This answers "may this caller widen the
+    AUDIENCE", and `*` held at `view` and resubmitted at `edit` is a ROLE escalation that the
+    check above already refuses, by name. Two questions, two predicates
+    ([[one-evaluator-per-question]]) — and separable is also what lets a gate disarm one of them
+    in memory and prove the other still fires.
+
+    ⚠ `_clean_entries`, NEVER THE RAW BODY: an entry with a junk role is dropped by the writer,
+    so reading the raw list would refuse a widening that was never going to be stored.
+    """
+    if shares.EVERYONE in (held or {}):
+        return set()
+    return {e["user"] for e in shares._clean_entries(entries) if e["user"] == shares.EVERYONE}
+
+
+def _unremovable(held_rows, entries, uname):
+    """⭐⭐ D-474 — the people this caller is dropping from the list but may NOT revoke.
+
+    OWNER RULING 2026-08-24, verbatim: *"a re-sharer can only unshare the people it shared to"*.
+    R4 bounded what a re-sharer may HAND OUT and left what they may TAKE AWAY unbounded, and both
+    halves of that were measured: an `edit` grantee PUTting a list that omits another grantee was
+    answered `200` and that person's access was gone; `PUT []` left the view shared with nobody.
+
+    ⛔⛔ AN ENTRY WITH NO `by` IS NOT REMOVABLE BY A RE-SHARER — ONLY BY THE OWNER OR AN ADMIN,
+    AND THAT IS THE FAIL-CLOSED DIRECTION RATHER THAN AN OVERSIGHT. Every grant written before
+    provenance existed carries no stamp, so "no `by`" and "granted by somebody else" are
+    indistinguishable from here. Reading absence as *"nobody claims it, so anyone may take it"*
+    would hand every re-sharer the power to revoke the entire pre-existing grant set on day one
+    of this change, which is the exact capability the ruling withholds. A re-sharer must not be
+    able to revoke a grant they cannot PROVE they made [[aios-permissioning]].
+
+    ⚠ SO A RE-SHARER CANNOT REMOVE THEMSELVES EITHER, AND THAT IS STATED BECAUSE IT LOOKS LIKE A
+    BUG. Their own row was placed by the owner, so it carries the owner's `by` and lands in this
+    set. Read literally, the ruling says a re-sharer unshares only who THEY shared to, and their
+    own grant is not one of those. Leaving the view is the owner's to do, like every other
+    revocation of an owner-placed grant. ⛔ Do not carve an exception here without a ruling: the
+    carve-out is indistinguishable from "a re-sharer may revoke any row whose `by` names the
+    owner", which is the wall itself.
+
+    ⚠ `_clean_entries`, NEVER THE RAW BODY, AND THIS IS THE HOLE THAT SHAPE CLOSES. A role the
+    writer rejects is a row that will NOT be stored, so `{user: victim, role: "nonsense"}` looks
+    present in the raw payload and is a silent REVOCATION once written. Asking the same
+    normaliser the store uses is what makes "submitted" mean the same thing at both ends.
+    """
+    me = str(uname or "").strip().lower()
+    submitted = {e["user"] for e in shares._clean_entries(entries)}
+    stuck = set()
+    for user, row in (held_rows or {}).items():
+        if user in submitted:
+            continue
+        stamp = str((row or {}).get("by") or "").strip().lower()
+        if not me or not stamp or stamp != me:
+            stuck.add(user)
+    return stuck
+
+
+@router.get("/share/mine")
+def my_shares(session: Session = Depends(require_session)):
+    """Everything shared WITH me, by kind — the "Shared with me" rail section (R10).
+
+    Registered before `/share/{kind}/{oid}` so the literal path wins the match; FastAPI resolves
+    in declaration order and `mine` would otherwise be read as a `kind`, answering 400 for a URL
+    that is not malformed at all.
+    """
+    return shares.shared_with(session.uname, st=session.runtime)
+
+
+@router.get("/share/{kind}/{oid}")
+def get_share(kind: str, oid: str, session: Session = Depends(require_session)):
+    kind = _kind_or_400(kind)
+    if kind == "field":
+        table_key, field_key = shares.split_field_oid(oid)
+        if table_key and field_key:
+            oid = shares.field_oid(_field_storage_keys(table_key)[2], field_key)
+    rec = shares.grants(kind, oid, st=session.runtime)
+    role = shares.role_for(kind, oid, session.uname, is_admin=session.admin, st=session.runtime)
+    may_admin = shares.may_administer(kind, oid, session.uname, is_admin=session.admin,
+                                      st=session.runtime)
+    # W39-T29 — the dialog opens with GET before its first PUT.  Until that PUT exists the grant
+    # registry has no owner to return from `may_administer`, even though the same caller may safely
+    # claim their own object through the PUT path below.  Reflect that exact claim predicate here:
+    # a Member who owns an unshared View receives the people picker; a collaborator still does not.
+    if not rec["owner"] and not may_admin and _owns_object(session, kind, oid):
+        may_admin = True
+    # ⭐ W32-T26 (audit S-3) — A STRANGER LEARNS NOTHING. This route used to answer for ANY id:
+    # who owns it, everyone it is granted to, and the tenant's whole username↔name directory —
+    # to any signed-in session, about objects it cannot open. Now a caller with no role on an
+    # object must prove they can reach it, and gets a 404 otherwise: the same answer a
+    # non-existent id gives, so the route cannot be used to probe which ids are real.
+    # ⚠ `role is None` is the cheap pre-test, so the N-topic resolution below runs only for a
+    # caller who has no relationship with the object at all.
+    if role is None and not _can_see_object(session, kind, oid):
+        raise err(404, "no_object", "no such item, or it is not shared with this account")
+    return {
+        **rec,
+        "role": role,
+        "mayAdminister": may_admin,
+        # ⚠ WAVE 21 (C1 identity fix): grant entries BIND on USERNAMES, so the picker must carry
+        # them. `assignable_people` serves bare display names because `user`-kind CELLS store
+        # display names — that list's shape cannot change without migrating cell values — so
+        # this route serves objects of its own. Existing grants that were written as lowercased
+        # display names are normalised by the wave-21 cleanup script.
+        # ⭐ W32-T26 (audit S-3) — the roster is the EDITOR's data, so it rides only for a caller
+        # who may open the editor. A read-only grantee gets the grant list (their fair question is
+        # "who else has this?") and not a directory of every account in the workspace.
+        # ⭐⭐ W40-T02 / R4 — AND THAT RULE IS WHY THIS LINE NEEDED NO EDIT. `may_administer` now
+        # answers True for an `edit` grantee on a VIEW, which MOVES that account into "may open
+        # the editor" — so the picker they need arrives by the roster riding on the same flag it
+        # always did. Gating it on anything else (owner, `role == 'owner'`, a fresh predicate)
+        # would be a second answer to a question this file already answers once, and would leave
+        # the new grantee with an editor and no people to put in it. A `view` grantee is still
+        # `may_admin=False` here and still gets `[]`.
+        "people": _people(session.tenant) if may_admin else [],
+    }
+
+
+def _people(tenant):
+    """[{username, name}] for this tenant — same population as `assignable_people`, with the
+    BINDING identity alongside the display one."""
+    try:
+        reg = users.registry() or {}
+    except Exception:
+        return []
+    want = str(tenant or '').strip().lower()
+    out = []
+    for uname, u in reg.items():
+        if not isinstance(u, dict) or u.get('active') is False:
+            continue
+        if want and str(u.get('tenant') or 'royal-imports').strip().lower() != want:
+            continue
+        out.append({"username": str(uname), "name": str(u.get('name') or uname)})
+    return sorted(out, key=lambda p: p["name"].lower())
+
+
+@router.put("/share/{kind}/{oid}")
+def put_share(kind: str, oid: str, body: dict = Body(default=None),
+              session: Session = Depends(require_session)):
+    kind = _kind_or_400(kind)
+    if kind == "field":
+        table_key, field_key = shares.split_field_oid(oid)
+        if table_key and field_key:
+            oid = shares.field_oid(_field_storage_keys(table_key)[2], field_key)
+    body = body or {}
+    rec = shares.grants(kind, oid, st=session.runtime)
+    # `claiming` is the "no owner yet, and this caller may become one" branch, hoisted to a name
+    # because TWO decisions below need it: the ceiling (a claimant is about to be the owner, so
+    # their ceiling is an owner's) and the owner written back (D3 — see `set_grants` at the end).
+    claiming = False
+    # An object with NO grant record yet has no owner — the first person to share it claims it.
+    # That is safe because reaching this route at all means passing the surface's own wall, and
+    # the alternative (refusing until somebody seeds an owner) would make a brand-new folder
+    # unshareable by the person who just made it.
+    if rec["owner"]:
+        if not shares.may_administer(kind, oid, session.uname, is_admin=session.admin,
+                                     st=session.runtime):
+            # ⭐ R4 / W40-T02 — `may_administer` now also admits an `edit` grantee on a VIEW, so
+            # the population refused here is narrower than the code word `not_owner` suggests: a
+            # `view` grantee, or an account with an `edit` role on a kind outside
+            # `shares.RESHARE_KINDS`. The code string is kept because clients match on it.
+            raise err(403, "not_owner",
+                      "only the owner of this item (or an administrator) can change who it is "
+                      "shared with")
+    # ⛔⛔ W32-T26 (audit S-1) — THE CLAIM NOW HAS A PRECONDITION. An object with no grant record
+    # is still claimed by the first person to share it — that rule is right, and refusing until
+    # somebody seeds an owner would make a brand-new folder unshareable by the person who just
+    # made it. What was missing is the half the old comment ASSERTED and the code never did: the
+    # claimant has to be able to reach the object. Without this, any signed-in account could
+    # stamp itself owner of an id it had never seen and lock the real creator out for good.
+    elif not _owns_object(session, kind, oid):
+        raise err(404, "no_object", "no such item, or it is not shared with this account")
+    else:
+        claiming = True
+    entries = body.get("entries")
+    if not isinstance(entries, list):
+        raise err(400, "bad_entries",
+                  "entries must be a list of {user, role}. Send [] to un-share, which is how "
+                  "revoking is expressed")
+    _entries_or_400(session, entries)
+    # ⭐⭐ R4 / W40-T02 — THE CEILING. `may_administer` above now opens this door to an `edit`
+    # grantee on a VIEW, so R4's other half ("a re-share may never exceed the role the re-sharer
+    # holds") needs a check of its own: that caller may hand out `view`, and conferring `edit`
+    # stays the owner's or an administrator's.
+    #
+    # ⛔ AFTER THE ADMISSION, NEVER BEFORE, AND THAT ORDER IS A SECURITY PROPERTY. A caller with
+    # no role at all must keep receiving `404 no_object` (audit S-1/S-3: a stranger learns
+    # nothing, so this route cannot be used to probe which ids are real). A ceiling raised first
+    # would answer that caller `403` and turn the one route hardened against id-probing back into
+    # an oracle that confirms an id exists. It also runs before the `field` promotion below, so a
+    # refusal cannot leave a column promoted with no grant written.
+    #
+    # ⛔ AND IT IS THE DELTA, NOT EVERY ROW OF THE BODY — read off the shipped client, not
+    # assumed. `ShareDialog.save` PUTs the WHOLE list every time ("a body assembled from a delta
+    # would revoke everyone it failed to mention"), so the re-sharer's OWN `{user, role: "edit"}`
+    # row rides in every payload they are able to produce. Refusing per-entry would `403` the
+    # exact re-share this ticket exists to enable, and the only body that would pass is one that
+    # revokes the re-sharer. So what is refused is edit access this caller is CREATING: a name
+    # arriving at `edit`, or an existing `view` grantee raised to it. A row that already stood at
+    # `edit` was the OWNER's decision, and is not this caller's to be refused for.
+    #
+    # ⚠ A CLAIMANT IS AN OWNER. The branch above admits a Member who owns an object that has no
+    # grant record yet, and `set_grants` is about to stamp them owner — asking the registry for
+    # their role here would answer `None` (no record exists to hold one) and refuse the first
+    # `edit` grant on every newly created view. Same predicate as the door, one line apart.
+    ceiling = "edit" if claiming else shares.max_grantable_role(
+        kind, oid, session.uname, is_admin=session.admin, st=session.runtime)
+    #
+    # ⭐⭐ OWNER RULING 2026-08-24 (D-473 + D-474) — AND THE CEILING IS NOW ONE OF THREE WALLS IN
+    # THIS BLOCK, NOT THE WALL. R4 bounded the ROLE a re-sharer may hand out and was silent on the
+    # other two questions a re-share asks, so both gaps shipped and both were measured on the
+    # build: an `edit` grantee could PUT `[fisch:edit, *:view]` and widen a two-person view to the
+    # whole tenant (200), and could PUT a list omitting another grantee — or `[]` — and revoke
+    # people they never granted (200). The owner's answer settles both in one sentence: *"no a
+    # re-sharer can only share to specific people and a re-sharer can only unshare the people it
+    # shared to"*.
+    #
+    # ⛔ THREE PREDICATES, THREE FUNCTIONS, ONE ORDER: role, then audience, then revocation. They
+    # are separate because they answer separate questions and because a wall that cannot be
+    # disarmed ALONE cannot be proven alone — `verify_scopes.section_reshare_bounds` patches each
+    # one in memory and requires exactly its own leg to go red, which a single fused `if` would
+    # make impossible ([[a-declared-gate-is-an-unchecked-claim]]).
+    # ⚠ ROLE AND AUDIENCE COMPOSE, AND THE ORDER DECIDES WHICH REFUSAL A PERSON READS. `*`
+    # submitted at `edit` while held at `view` is BOTH an escalation and (if unheld) a widening;
+    # the role check runs first and names the fix that is actually available to this caller
+    # ("set it to Can view"), which is the more useful of the two sentences.
+    if ceiling != "edit":
+        # The prior ROWS, not just their roles: the revocation wall needs each entry's `by`, and
+        # reading it from a second place would be a second answer to "what does the store hold".
+        held_rows = {e.get("user"): e for e in (rec["entries"] or ())
+                     if isinstance(e, dict) and e.get("user")}
+        held = {u: e.get("role") for u, e in held_rows.items()}
+        noun = {"view": "view", "folder": "folder",
+                "database": "database", "field": "column"}.get(kind, "item")
+        raised = set()
+        for e in entries:
+            if not isinstance(e, dict):
+                continue
+            who = str(e.get("user") or "").strip().lower()
+            if who and str(e.get("role") or "").strip().lower() == "edit" \
+                    and held.get(who) != "edit":
+                raised.add(who)
+        if raised:
+            raise err(403, "grant_exceeds_role",
+                      "you can share this " + noun + " at Can view, which is as far as your own "
+                      "access reaches. Only its owner (or an administrator) can give somebody "
+                      "Can edit, so nothing was saved. Set " + _named(raised)
+                      + " to Can view and save again.")
+        # ⭐⭐ D-473 — THE AUDIENCE. A re-sharer names PEOPLE; reaching "everyone" is the owner's.
+        if _audience_added(entries, held):
+            raise err(403, "grant_exceeds_audience",
+                      "you can share this " + noun + " with specific people, which is as far as "
+                      "your own access reaches. Only its owner (or an administrator) can open it "
+                      "to everyone in this workspace, so nothing was saved. Remove Everyone from "
+                      "the list, add the people you meant by name, and save again.")
+        # ⭐⭐ D-474 — THE REVOCATION. An omission IS a revocation on a replacing PUT, so this is
+        # the only place a removal can be refused. ⛔ REFUSED WHOLE: `set_grants` has not run, so
+        # a payload carrying a legitimate addition ALONGSIDE a forbidden removal saves neither.
+        # That is deliberate and it is what the message promises ("nothing was saved") — a
+        # half-applied permission change is worse than a refused one, because the person reading
+        # the toast has no way to tell which half took.
+        stuck = _unremovable(held_rows, entries, session.uname)
+        if stuck:
+            raise err(403, "revoke_not_yours",
+                      "you can remove the people you shared this " + noun + " with, and this "
+                      "workspace has no record of you sharing it with " + _named(stuck)
+                      + ". Only its owner (or an administrator) can remove them, so nothing was "
+                      "saved. Put them back on the list and save again.")
+    if kind == "field":
+        # A field grant is a visibility and edit wall. Promote a private custom
+        # field exactly once, then keep the requested Share field role as the
+        # authoritative override for the legacy permissions bag.
+        from core import field_permissions, shared_overlay
+        table_key, field_key = shares.split_field_oid(oid)
+        defn, already_shared, workspace_key, shared_key, grant_topic = _field_definition(
+            session, table_key, field_key)
+        if not isinstance(defn, dict):
+            raise err(404, "no_object", "no such field, or it is not shared with this account")
+        if not already_shared:
+            defn = field_permissions.promote_field(
+                workspace_key, shared_key, grant_topic,
+                session.uname, defn, st=session.runtime)
+        stamped = dict(defn)
+        stamped["shared"] = True
+        stamped["granted"] = True
+        shared_overlay.put_field(shared_key, field_key, stamped, st=session.runtime)
+        oid = shares.field_oid(grant_topic, field_key)
+    # ⭐⭐ R4 / W40-T02 (D3) — OWNERSHIP NEVER MOVES ON A RE-SHARE, AND IT IS SAID HERE RATHER
+    # THAN LEFT TO FALL OUT. `set_grants`' owner is sticky, so the old `rec["owner"] or
+    # session.uname` already happened not to transfer ownership — incidentally, as a property of
+    # the callee. R4 names ownership transfer as one of the two halves of the old protection that
+    # SURVIVES the widening, and a rule that survives by accident is one the next edit deletes
+    # without noticing. So the branch is explicit: a claimant becomes the owner, and everybody
+    # else — an owner re-saving, an admin, and now an `edit` grantee re-sharing — passes the
+    # EXISTING owner straight back through. `claiming` is the same flag the admission set, so
+    # there is no second answer to "is this person taking ownership".
+    # ⭐⭐ D-474 — `granter` IS THIS SESSION, ON EVERY SAVE INCLUDING THE OWNER'S. Provenance is
+    # recorded for whoever adds a person, not only for a re-sharer: an owner-placed grant carrying
+    # NO stamp is indistinguishable from a pre-provenance one, and `_unremovable` would then be
+    # deciding on the store's AGE rather than on who granted what. `set_grants` stamps only
+    # entries that are NEW to the record and never re-stamps an existing one, so an owner
+    # re-saving a list does not quietly take provenance off the re-sharer who built it.
+    # ⛔⛔ THE THREE REFUSALS ABOVE WERE DECIDED AGAINST `rec`, WHICH WAS READ AT THE TOP OF
+    # THIS FUNCTION. Handing `expect` to the writer is what makes them true at the moment of the
+    # write rather than at the moment of the read: a concurrent save lands between the two, and
+    # a wave-40 adversarial probe drove a re-sharer's PUT being ACCEPTED while the grant the
+    # owner had just added disappeared. See `shares.set_grants`' own note.
+    try:
+        out = shares.set_grants(kind, oid, entries,
+                                owner=session.uname if claiming else rec["owner"],
+                                granter=session.uname,
+                                st=session.runtime,
+                                expect=rec["entries"])
+    except shares.GrantsChanged as exc:
+        raise err(409, "grants_changed", str(exc))
+    _notify_new_grantees(session, kind, oid, before=rec["entries"], after=out.get("entries") or [])
+    return out
+
+
+def _notify_new_grantees(session, kind, oid, before, after):
+    """⭐⭐ W32-T28 (owner item 18's last clause, contract C3) — tell the RECEIVER, in their Inbox.
+
+    Owner item 18 ends *"being shared a database notifies the receiver"*. Until now sharing was
+    silent: the grant landed in a rail section the receiver had to notice on their own, which is
+    why "I shared it with you" and "I never saw it" were both true.
+
+    ⛔ WRITTEN ON THE SHARE, NEVER POLLED. `/notifications` re-evaluates view-ALERTS on read
+    because an alert is a live question about rows; a share is an EVENT that happened once, and
+    polling for it would mean re-deriving "was this new?" on every inbox open — the diff below
+    only exists here, at the moment the set changes.
+
+    ⚠ ONLY THE NEWLY ADDED. `PUT` REPLACES the whole entry set (revoking is expressed by absence),
+    so every save re-sends everyone who was already there. Diffing against `before` is what stops
+    a rename or a role change from ringing the bell for people whose access did not change.
+    ⚠ `*` IS NOT NOTIFIED: there is no user to name, and minting one notification per account in
+    the tenant on a single click is a broadcast nobody asked for. The rail still shows it.
+    ⚠ IT NEVER RAISES. A notification that fails must not fail the share that triggered it — the
+    grant is the user's actual intent, and `core.alerts.notify` writes with `flush='async'`.
+    """
+    try:
+        was = {e.get("user") for e in (before or ()) if isinstance(e, dict)}
+        fresh = [str(e.get("user")) for e in (after or ())
+                 if isinstance(e, dict) and e.get("user") not in was
+                 and e.get("user") != shares.EVERYONE]
+        if not fresh:
+            return
+        import core.alerts as alerts
+
+        label, route, view_id = _object_ref(session, kind, oid)
+        if not route:
+            # ⛔ NO ROUTE, NO NOTIFICATION — the receiver would get a row that opens nothing, and
+            # `notification_view` would have to invent a target. Silence is the honest answer
+            # here; the rail still shows the grant under "Shared with me".
+            return
+        sharer = str(session.user.get("name") or session.uname)
+        for user in fresh:
+            # ⚠ THE SHAPE IS `routes_alerts.notification_view`'s SHARE BRANCH, and the two must
+            # agree or the Inbox row is unclickable: `topic` selects the branch and `key` becomes
+            # `alertId`, which that branch reads as the id to open. Both constants are IMPORTED
+            # from there rather than typed again — one vocabulary, one owner.
+            # ⭐⭐ W33-T28 (`ASK C-14`, answered) — `actor` IS THE SENDER, AND IT IS THE ONLY WAY
+            # THE INBOX CAN NAME ONE. An alert and an automation have no person behind them and
+            # are honestly named by their machine; a SHARE has a real person, and only this call
+            # site knows who. ⛔ It is passed as its OWN field rather than recovered from the
+            # `detail` prose below: a sender parsed out of "<name> shared this with you" breaks
+            # the first time the sentence is reworded, silently, in the header
+            # [[grep-output-is-not-source]]. The prose stays as the body; this is the From.
+            alerts.notify(user, label, topic=_SHARE_TOPIC, key=route, row_id=view_id,
+                          detail=f"{sharer} shared this with you", actor=sharer,
+                          st=session.runtime)
+    except Exception:                                       # noqa: BLE001
+        return
+
+
+def _object_ref(session, kind, oid):
+    """`(label, route, view_id)` — what to CALL the shared thing, and where it OPENS.
+
+    ⛔ THE ROUTE IS RESOLVED HERE, NOT SHAPED IN THE CONSUMER, AND THE FIRST VERSION GOT IT
+    WRONG: it put the raw `oid` in the notification's key, so a shared VIEW produced
+    `target: {module: "database", id: "view_42"}` — an instruction to open a database named
+    `view_42`. It read perfectly in the payload and would have opened nothing. **A view is not
+    addressable on its own; it is a SELECTION inside a topic's grid**, so the pair is what has to
+    travel. Caught by looking at the notification the driver actually produced, not by reading
+    the code back.
+
+    ⚠ `label` never falls back to a raw id. A notification headed `ut_leads_3f2a` tells the
+    receiver nothing they can act on, and the id is already in the target.
+    ⚠ An unresolvable object answers `route=None`, and the caller then sends NOTHING rather than
+    a row that opens nowhere.
+    """
+    try:
+        if kind == "field":
+            # ⭐⭐ W38-T16 — A COLUMN IS NOT ADDRESSABLE ON ITS OWN, exactly as a view is not: it
+            # is a column INSIDE a database, so the target that travels is the DATABASE. Without
+            # this branch the function falls through to the view/folder loop, finds nothing,
+            # answers `route=None` — and `_notify_new_grantees` returns EARLY. The grant lands and
+            # the receiver is never told, which is the silent half of owner item 18 reopened one
+            # kind over.
+            from routes_alerts import route_for_topic
+            table_key, field_key = shares.split_field_oid(oid)
+            if not table_key:
+                return ("A column", None, "")
+            try:
+                defn, _shared, _workspace, shared_key, _grant_topic = _field_definition(
+                    session, table_key, field_key)
+            except Exception:                               # noqa: BLE001
+                defn = None
+            label = str((defn or {}).get("label") or "").strip() or field_key
+            # ⚠ TWO SPELLINGS REACH THIS LINE AND ONE MAP ANSWERS BOTH. `shared_overlay` is keyed
+            # by whatever the calling door already held: a `ut_*` database uses its bare key,
+            # while a registry topic uses `<topic>_table_workspace` (`product_data.TABLE_KEY`).
+            # `route_for_topic` speaks the GRID SCOPE vocabulary (`customer`, not
+            # `customer_data`), so the suffix comes off before it is asked — rather than a second
+            # route table being written here, which is how the two come apart.
+            _WS = "_table_workspace"
+            scope = {"customer_data": "customer", "product_data": "product"}.get(table_key)
+            if scope is None:
+                scope = table_key[:-len(_WS)] if table_key.endswith(_WS) else table_key
+            return (label, route_for_topic(scope) or None, "")
+        if kind == "database":
+            import core.user_tables as ut
+            defn = (ut.all_defs(st=session.runtime) or {}).get(str(oid)) or {}
+            # A user table IS its own route key in both vocabularies (`route_for_topic`).
+            return (str(defn.get("label") or "").strip() or "A database", str(oid), "")
+        import core.table_store as table_store
+        from routes_alerts import route_for_topic
+        for topic in _topics(session):
+            ops = table_store.make(f"{topic}_table_workspace", st=session.runtime)
+            hit = ops.find_view(oid) if kind == "view" else ops.find_folder(oid)
+            if not hit:
+                continue
+            route = route_for_topic(topic)
+            if not route:
+                break
+            row = hit[1] if len(hit) > 1 else {}
+            name = str((row or {}).get("name") or "").strip()
+            # ⚠ Only a VIEW carries a selection. A folder is a rail grouping, so the target opens
+            # the grid and stops there rather than naming a view the receiver did not get.
+            return (name or ("A view" if kind == "view" else "A folder"),
+                    route, str(oid) if kind == "view" else "")
+    except Exception:                                       # noqa: BLE001
+        pass
+    return ({"view": "A view", "folder": "A folder",
+             "field": "A column"}.get(kind, "An item"), None, "")

platform/core/shares.py

@@ -1,414 +1,560 @@
-"""core/shares.py — ONE grant registry for every shareable object (wave 20, owner ruling R10).
-
-WHAT R10 ASKED FOR: folders and databases share with the **same two-role vocabulary views
-already use** (specific users or everyone; role = view | edit), plus one manage-access editor
-that can add or revoke people later, on any of the three.
-
-WHY A REGISTRY RATHER THAN A FIELD ON EACH OBJECT. A view already carries its own `permissions`
-(`core/table_store.py`) and that stays — moving it would rewrite every stored view for no gain.
-But a FOLDER is a value inside one user's workspace blob and a DATABASE is a `user_tables`
-definition; giving each its own grant field would put the same three-line permission decision in
-three files owned by two sessions, which is how the three drift. One registry, one predicate,
-three callers.
-
-    shares.set_grants(kind, oid, entries, owner=…, st=…)   # replaces the whole grant set
-    shares.grants(kind, oid, st=…)                         # -> {'owner': str, 'entries': [...]}
-    shares.role_for(kind, oid, user, is_admin=…, st=…)     # -> 'owner'|'edit'|'view'|None
-    shares.max_grantable_role(kind, oid, user, …)          # -> 'edit'|'view'|None (R4's ceiling)
-    shares.shared_with(user, kind=…, st=…)                 # -> [oid] this user was granted
-
-THE ROLE VOCABULARY IS TWO WORDS AND THE DEFAULT IS THE NARROW ONE. `view` = may open and read;
-`edit` = may also change the object's CONTENT.
-
-⭐⭐ AND ON A VIEW, `edit` NOW ALSO MEANS "MAY RE-SHARE" — OWNER RULING R4, instruction 4 (*"Edit
-View so a member can share a View as well, not just an admin"*), built as W40-T02. This REVERSES
-the flat owner-or-admin rule this paragraph used to state, and it reverses it for ONE kind:
-`RESHARE_KINDS` below is where the widening is spelled, once, and `folder` / `database` / `field`
-are untouched — still the owner's or an admin's, for the reason given at that constant.
-
-⛔ WHICH HALF OF THE OLD PROTECTION SURVIVES, BECAUSE THE FEAR IT NAMED WAS REAL AND ONLY HALF OF
-IT IS ANSWERED. The sentence here used to be *"a collaborator who could rewrite grants could grant
-themselves sole ownership of somebody else's object, or quietly widen a users-scoped share to
-everyone"*. Taking those one at a time:
-  * **SOLE OWNERSHIP IS BLOCKED — and now stated rather than incidental.** The owner is STICKY in
-    `set_grants` and `routes_shares.put_share` passes the EXISTING owner straight back through, so
-    a re-share cannot transfer ownership and no grantee can lock the creator out of their own view.
-    Ownership moves for nobody, by any path this registry offers.
-  * **WIDENING IS BOUNDED, NOT BLOCKED, AND THAT IS R4's DELIBERATE COST.** A re-share may never
-    exceed the role the re-sharer holds, and the STRICTER reading of that ships: an `edit` grantee
-    may add somebody — `*` included — at `view`, and can never mint `edit` access for anyone.
-    Handing out `edit` stays the owner's (or an admin's) alone. A `view` grantee still cannot share
-    at all. `max_grantable_role` is that ceiling, and `routes_shares.put_share` is where it bites.
-
-⛔ AN UNREADABLE GRANT IS NO GRANT. Every path here fails closed — junk in the bucket, a missing
-owner, an unknown role string all resolve to None rather than to a default that opens something.
-[[aios-permissioning]]: no fail-open defaults, ever.
-
-⚠ THE BUCKET IS TENANT-SCOPED THROUGH `st`, like every other product-data write. Passing the
-session's `TenantRuntime` is what keeps Nurilab's grants in Nurilab's store; the module default
-(`core.store`) is tenant #0 and exists for the same reason it does everywhere else — the ~28
-callers that predate multi-tenancy. (This is the D-5/D-16 residency shape, and this module does
-NOT repeat their mistake: `st` is threaded from the first line rather than retrofitted.)
-"""
-import core.store as store
-
-#: The store key. One bucket per tenant holds every kind's grants, because "what am I shared on"
-#: is a question across kinds — the "Shared with me" folder (R10) is exactly that query, and
-#: three separate buckets would make it three reads that can disagree about what a user can see.
-SHARES_KEY = 'object_shares'
-
-#: The shareable kinds. A CLOSED vocabulary: an unknown kind raises rather than creating a new
-#: namespace by typo, which would silently grant nothing to nobody and read as "sharing is broken".
-#:
-#: ⭐⭐ W38-T16 — `field` IS THE FOURTH, AND NOTHING IN THIS FILE BRANCHES ON IT. Every function
-#: below treats `kind` as an opaque bucket key (`_check_kind / grants / set_grants / role_for /
-#: may_see / may_edit / may_administer / shared_with / drop_objects`), so the kind's whole cost
-#: here is this tuple member. That is the point of one registry: the new object's WALL is written
-#: once in `core.perm_scope`, and its DOORS once in `routes_shares.py` — never a fourth
-#: permission decision in a fourth file ([[one-evaluator-per-question]]).
-KINDS = ('view', 'folder', 'database', 'field')
-
-#: `*` is "everyone who can already open the surface". It is NOT "every account on the platform".
-#: Spelled as a single character so it can never collide with a username (usernames are lower-case
-#: and non-empty by `core/users.py`, and are checked against this explicitly below).
-#:
-#: ⛔⛔ **AND WHAT THAT MEANS DEPENDS ON THE KIND — THE LINE THIS NOTE USED TO CARRY WAS FALSE FOR
-#: ONE OF THE THREE** (W33-T30, `waves/wave32/sharing-audit.md` S-8). It read *"the module/table
-#: wall runs FIRST and this never widens past it"*, flatly, and the audit's own words for that are
-#: *"the third docstring in this audit describing a check that is not on the path"*. Corrected
-#: here rather than deleted, because the sentence is TRUE of two kinds and the difference is the
-#: whole point:
-#:   * `kind='view'` / `kind='folder'` on a GOVERNED module (`customer_data`, `product_data`) —
-#:     the sentence holds. `require_session` plus the topic's own gate run first, and the
-#:     receiver's row scope and hidden-field closure are applied BEFORE any foreign view is
-#:     merged, so a grant can only narrow-or-equal what that account could already reach.
-#:   * `kind='database'` on a `ut_*` table — ⭐⭐ **THE SENTENCE HOLDS HERE TOO NOW, AND THAT IS
-#:     W36-T21 / OWNER RULING R6 (audit S-8, CLOSED).** It did not until wave 36, and the reason
-#:     is worth keeping: `routes_admin._clean_perms` 400'd any key outside
-#:     `("customer_data", "product_data")`, so no row filter and no hidden field could even be
-#:     DECLARED for a user table, `routes_tables.py` made zero `perm_scope` calls, and it passed
-#:     `hidden_keys=frozenset()`. A `database` grant was therefore ALL-OR-NOTHING — every row,
-#:     every column — and this registry was the only wall behind it.
-#:
-#: ⭐ WHAT CHANGED: `perm_scope.scoped_table` (contract C1) is the ONE door to any database's
-#: rows. `routes_tables` applies the permanent filter before `pids` is taken and the transitive
-#: hidden-field closure after `workspace_wire`, on EVERY `ut_*` read — the same code that walls
-#: `customer_data` — and a door that cannot apply them REFUSES rather than serving the lot. So a
-#: `database` grant is once again bounded by a second wall: it decides WHETHER an account reaches
-#: the database, and C1 decides WHICH rows and columns it then sees. An `*` grant still admits
-#: every account in the tenant, and each of them still only sees what their own wall allows.
-#:
-#: ⚠ `routes_shares.py`'s module docstring carries the OLD sentence at the other door and is in
-#: no wave-36 fence — the audit's own fix was "say so at both", so one of the two is now stale.
-#: Booked in `mailbox/C.md` (C-14) rather than edited across a fence
-#: [[two-gates-can-assert-opposite-things]].
-EVERYONE = '*'
-
-ROLES = ('view', 'edit')
-
-#: ⭐⭐ THE KINDS AN `edit` GRANTEE MAY RE-SHARE — R4 / W40-T02, and it is `view` ALONE.
-#:
-#: R4's words are "may re-share **A VIEW**", and the widening goes no further than the ruling
-#: names. That restraint is the whole reason this is a tuple rather than a bare `role == 'edit'`
-#: arm inside `may_administer`: every predicate in this file treats `kind` as an opaque bucket key
-#: (see the note on `KINDS`), so an UNGATED widening would reach `folder`, `database` and `field`
-#: in the same line — handing an `edit` grantee on a `ut_*` DATABASE the power to re-share the
-#: whole table. The asymmetry is one of blast radius: a view is one saved SELECTION, opened through
-#: the receiver's own module wall and row scope; a database grant admits an account to a database.
-#: `routes_shares.py`'s module docstring carries that argument at the door where it is enforced.
-#:
-#: ⚠ ONE SPELLING, DELIBERATELY. `may_administer` and `max_grantable_role` both consult this, so
-#: "who may open the editor" and "what may they hand out" cannot come apart about the same kind.
-RESHARE_KINDS = ('view',)
-
-#: ⛔⛔ A FIELD's OBJECT ID IS TOPIC-QUALIFIED, AND THE SEPARATOR IS DECLARED HERE SO THERE IS ONE
-#: SPELLING OF IT. A bare field key is NOT unique: `notes` exists on a dozen databases, and a
-#: grant stored under it would admit a grantee to every `notes` column in the tenant at once —
-#: the widening direction, silently, forever. `table_key` is the qualifier because it is the same
-#: identifier `shared_overlay.bucket()` already keys the values by, so the grant and the data it
-#: governs are named by the same string ([[one-question-two-normalizers]]).
-#:
-#: ⚠ A `ut_*` key and a registry topic key both match `[a-z0-9_]+` and neither can contain `:`,
-#: so the split below is unambiguous in both directions.
-FIELD_OID_SEP = ':'
-
-
-def field_oid(table_key, field_key):
-    """`"<table_key>:<field_key>"` — the share id of ONE column on ONE database."""
-    table = str(table_key or '').strip()
-    field = str(field_key or '').strip()
-    if not table or not field:
-        raise ValueError('shares.field_oid: a field share names BOTH a database and a column. '
-                         'A bare field key repeats across tables and would grant all of them')
-    return f'{table}{FIELD_OID_SEP}{field}'
-
-
-def split_field_oid(oid):
-    """`(table_key, field_key)` or `(None, None)` for anything that is not a field oid.
-
-    ⛔ FAIL-CLOSED ON JUNK, like every other read here: a caller that cannot learn WHICH database
-    an id names must not fall back to "the one I happen to be looking at", which is how a grant
-    on somebody else's column would be read as a grant on this one.
-    """
-    raw = str(oid or '')
-    table, sep, field = raw.partition(FIELD_OID_SEP)
-    if not sep or not table.strip() or not field.strip() or FIELD_OID_SEP in field:
-        return (None, None)
-    return (table.strip(), field.strip())
-
-
-def _st(st):
-    return st if st is not None else store
-
-
-def _check_kind(kind):
-    k = str(kind or '').strip().lower()
-    if k not in KINDS:
-        raise ValueError(f'{kind!r} is not a shareable kind. Use one of {", ".join(KINDS)}. '
-                         f'This door refuses to invent a namespace from a typo.')
-    return k
-
-
-def _clean_entries(entries):
-    """Normalise + REJECT junk, returning [{'user': str, 'role': 'view'|'edit'}].
-
-    Silently dropping a malformed entry is right here and wrong elsewhere: the caller is a UI
-    that just listed the people it is about to grant, so a rejected row must not abort the whole
-    save — but an entry with an unknown ROLE must not be stored as something else's default
-    either. Dropped, never coerced.
-    """
-    out, seen = [], set()
-    for e in entries or ():
-        if not isinstance(e, dict):
-            continue
-        user = str(e.get('user') or '').strip().lower()
-        role = str(e.get('role') or '').strip().lower()
-        if not user or role not in ROLES or user in seen:
-            continue
-        seen.add(user)
-        out.append({'user': user, 'role': role})
-    return out
-
-
-def grants(kind, oid, st=None):
-    """`{'owner': str|None, 'entries': [{'user','role'}]}` — never raises on a junk bucket."""
-    kind = _check_kind(kind)
-    try:
-        bucket = (_st(st).get(SHARES_KEY) or {}).get(kind) or {}
-        rec = bucket.get(str(oid)) or {}
-    except Exception:
-        return {'owner': None, 'entries': []}
-    if not isinstance(rec, dict):
-        return {'owner': None, 'entries': []}
-    return {'owner': (str(rec.get('owner')).strip().lower() if rec.get('owner') else None),
-            'entries': _clean_entries(rec.get('entries'))}
-
-
-def set_grants(kind, oid, entries, owner=None, st=None):
-    """REPLACE the grant set for one object. Returns the stored record.
-
-    ⚠ REPLACE, NOT MERGE, and that is the contract the UI needs: revoking is expressed by an
-    entry's ABSENCE. A merge-only API cannot remove anybody without a second verb, and the
-    manage-access editor R10 asks for is exactly "here is the list now".
-    """
-    kind = _check_kind(kind)
-    oid = str(oid)
-    clean = _clean_entries(entries)
-    owner_l = str(owner).strip().lower() if owner else None
-
-    def _apply(data):
-        by_kind = dict(data.get(kind) or {})
-        prior = by_kind.get(oid) if isinstance(by_kind.get(oid), dict) else {}
-        # The owner is STICKY: set once, and a later save that omits it must not orphan the
-        # object. An ownerless grant record cannot answer "who may re-share this", so every
-        # administer check would fail closed and the object would become unmanageable.
-        keep_owner = owner_l or (str(prior.get('owner')).strip().lower()
-                                 if prior.get('owner') else None)
-        if not clean and not keep_owner:
-            by_kind.pop(oid, None)          # fully un-shared and unowned: leave no empty husk
-        else:
-            by_kind[oid] = {'owner': keep_owner, 'entries': clean}
-        data[kind] = by_kind
-        return data
-
-    _st(st).update(SHARES_KEY, _apply, flush='async')
-    return grants(kind, oid, st=st)
-
-
-def role_for(kind, oid, user, is_admin=False, st=None):
-    """`'owner'` | `'edit'` | `'view'` | `None` — the caller's effective role, fail-closed.
-
-    An ADMIN reads as `'owner'`: an admin who could not administer an object could not
-    administer the tenant either, which is `table_store._may_administer`'s existing rule and is
-    kept identical here so the two cannot disagree about the same view.
-    """
-    user = str(user or '').strip().lower()
-    if not user:
-        return None
-    rec = grants(kind, oid, st=st)
-    if is_admin or (rec['owner'] and rec['owner'] == user):
-        return 'owner'
-    best = None
-    for e in rec['entries']:
-        if e['user'] == user or e['user'] == EVERYONE:
-            # The STRONGER of the two wins when both a personal and an everyone grant exist:
-            # naming somebody explicitly is how you RAISE them above the room, so an
-            # everyone-view + alice-edit pair must leave alice editing.
-            if e['role'] == 'edit':
-                return 'edit'
-            best = best or 'view'
-    return best
-
-
-def may_see(kind, oid, user, is_admin=False, st=None):
-    return role_for(kind, oid, user, is_admin=is_admin, st=st) is not None
-
-
-def may_edit(kind, oid, user, is_admin=False, st=None):
-    return role_for(kind, oid, user, is_admin=is_admin, st=st) in ('owner', 'edit')
-
-
-def may_administer(kind, oid, user, is_admin=False, st=None):
-    """May this caller change WHO ELSE reaches the object, and revoke them?
-
-    ⭐⭐ R4 / W40-T02 — AN `edit` GRANTEE ANSWERS TRUE, ON A `RESHARE_KINDS` KIND. Owner
-    instruction 4: *"Edit View so a member can share a View as well, not just an admin"*. That
-    reverses this function's old owner-or-admin rule for exactly one kind; the module note says
-    which half of the protection survives and `RESHARE_KINDS` says why it stops at `view`.
-
-    ⛔ ADMINISTERING IS NOT GRANTING, AND THE SECOND QUESTION HAS ITS OWN PREDICATE. True here
-    means "may open the editor and rewrite the list"; it does NOT mean every role is theirs to
-    hand out. `max_grantable_role` is the ceiling, and R4's two halves are only both honoured if
-    a caller consults both ([[one-evaluator-per-question]]).
-
-    ⛔ THE GATE IS THE KIND, NOT THE ROLE ALONE. `role_for` is deliberately kind-agnostic, so
-    testing `== 'edit'` without `RESHARE_KINDS` would widen all four kinds in one line.
-    """
-    role = role_for(kind, oid, user, is_admin=is_admin, st=st)
-    if role == 'owner':
-        return True
-    return role == 'edit' and _check_kind(kind) in RESHARE_KINDS
-
-
-def max_grantable_role(kind, oid, user, is_admin=False, st=None):
-    """The STRONGEST role this caller may hand SOMEBODY ELSE on this object, fail-closed.
-
-    `'edit'` for the owner or an admin · `'view'` for an `edit` grantee on a `RESHARE_KINDS` kind
-    · `None` for anybody who may not administer the object at all.
-
-    ⭐⭐ WHY A SECOND PREDICATE RATHER THAN A FLAG ON `may_administer` (R4 / W40-T02). R4 grants an
-    `edit` holder the right to re-share and caps it in the same breath: *"a re-share may never
-    exceed the role the re-sharer holds"*. Those are two different questions, and a single boolean
-    answering both is exactly how the cap gets dropped by the next caller that only needs the door.
-
-    ⛔ THE NARROWER OF R4's TWO READINGS SHIPS, AND ON PURPOSE. "Never exceed the role you hold"
-    reads either as *may grant up to and including `edit`* (an edit holder confers edit) or as *may
-    confer strictly less than the owner can*. This returns `'view'` — the second — because it is the
-    FAIL-CLOSED direction. A wrong `'view'` costs the owner one click to raise somebody; a wrong
-    `'edit'` lets a chain of collaborators propagate edit access the owner never approved, with
-    nothing in the store recording who widened it. W40-T02's `done-when` pins the same reading.
-
-    ⚠ THIS CAPS WHAT A CALLER GRANTS, NOT WHAT THE STORED SET ALREADY HOLDS, and the difference is
-    load-bearing. `routes_shares.put_share` enforces it against the DELTA — a name arriving at
-    `edit`, or an existing `view` grantee raised to it — never against every row of a body, because
-    the PUT REPLACES and the client therefore re-sends the whole list, the re-sharer's own `edit`
-    row included. The evidence for that is at the call site, where the body is.
-    """
-    role = role_for(kind, oid, user, is_admin=is_admin, st=st)
-    if role == 'owner':
-        return 'edit'
-    if role == 'edit' and _check_kind(kind) in RESHARE_KINDS:
-        return 'view'
-    return None
-
-
-def shared_with(user, kind=None, st=None):
-    """Every object id this user has been granted (excluding what they own).
-
-    This is the "Shared with me" query (R10). It EXCLUDES owned objects deliberately: a folder
-    you made is not something shared *with* you, and listing it there would make the system
-    folder a duplicate of the rail above it.
-    """
-    user = str(user or '').strip().lower()
-    if not user:
-        return {}
-    try:
-        data = _st(st).get(SHARES_KEY) or {}
-    except Exception:
-        return {}
-    out = {}
-    for k in ([_check_kind(kind)] if kind else KINDS):
-        hits = []
-        for oid, rec in (data.get(k) or {}).items():
-            if not isinstance(rec, dict):
-                continue
-            owner = str(rec.get('owner') or '').strip().lower()
-            if owner == user:
-                continue
-            for e in _clean_entries(rec.get('entries')):
-                if e['user'] in (user, EVERYONE):
-                    hits.append(str(oid))
-                    break
-        out[k] = sorted(hits)
-    return out if kind is None else {_check_kind(kind): out[_check_kind(kind)]}
-
-
-def granted_oids(kind, st=None):
-    """Every object id of one `kind` that carries AT LEAST ONE grant entry — in ONE bucket read.
-
-    ⭐ W40-T01 / OWNER INSTRUCTION 2 ("a shared View must show the shared icon in EVERY account,
-    not only the recipient's"). `shared_with` answers *what was granted TO me* and deliberately
-    EXCLUDES what the caller owns — so it structurally cannot answer the other question a share
-    mark asks: *does this object have grants at all*. That question has no viewer in it, which is
-    why this is a separate function rather than a flag bolted onto `shared_with`.
-
-    ⚠ ONE READ, NOT N — and that is the whole reason this exists rather than a loop at the caller.
-    The obvious spelling is `grants(kind, oid)` per view, and `grants` re-reads the WHOLE bucket
-    on every call; a busy rail carries dozens of views, so painting one icon would cost dozens of
-    full reads of the tenant's entire grant registry. This reads the bucket once and hands back a
-    set the caller tests in O(1).
-
-    ⛔ AN ENTRY IS WHAT COUNTS, NOT A RECORD. `set_grants` keeps an owner-only HUSK after a full
-    revoke — the owner is sticky, deliberately, see its own note — so testing for the record's
-    mere EXISTENCE would leave the mark lit forever after the last person was removed. That is
-    exactly the revoke case, so it is the difference between this being right and being decorative
-    noise. `_clean_entries` is the same normaliser every other read here uses, so a junk entry
-    cannot mark an object either.
-
-    ⛔ FAIL-CLOSED like the rest of this module: an unreadable bucket answers the EMPTY set — no
-    marks — never a default that claims something is shared. An unknown KIND still RAISES, exactly
-    as `grants` / `shared_with` / `drop_objects` do: that is a typo in a caller, not junk in the
-    store, and swallowing it into "nothing is shared" would hide a caller that never works.
-    """
-    kind = _check_kind(kind)
-    try:
-        by_kind = (_st(st).get(SHARES_KEY) or {}).get(kind) or {}
-        rows = list(by_kind.items())
-    except Exception:
-        return set()
-    return {str(oid) for oid, rec in rows
-            if isinstance(rec, dict) and _clean_entries(rec.get('entries'))}
-
-
-def drop_objects(pairs, st=None):
-    """Remove whole grant RECORDS, owner husk included — wave 21, item 6a (C3).
-
-    A deleted object's grants must die with it: `shared_with` would otherwise serve ghost ids
-    into every receiver's "Shared with me" forever, and the ghost would 404 on open. One
-    transaction for the whole sweep — a table delete drops its database grant plus a view
-    grant per view that lived in its bucket."""
-    want = {}
-    for kind, oid in pairs or ():
-        want.setdefault(_check_kind(kind), set()).add(str(oid))
-    if not want:
-        return
-
-    def _apply(data):
-        for kind, oids in want.items():
-            by_kind = data.get(kind)
-            if isinstance(by_kind, dict):
-                for oid in oids:
-                    by_kind.pop(oid, None)
-        return data
-
-    _st(st).update(SHARES_KEY, _apply, flush='async')
+"""core/shares.py — ONE grant registry for every shareable object (wave 20, owner ruling R10).
+
+WHAT R10 ASKED FOR: folders and databases share with the **same two-role vocabulary views
+already use** (specific users or everyone; role = view | edit), plus one manage-access editor
+that can add or revoke people later, on any of the three.
+
+WHY A REGISTRY RATHER THAN A FIELD ON EACH OBJECT. A view already carries its own `permissions`
+(`core/table_store.py`) and that stays — moving it would rewrite every stored view for no gain.
+But a FOLDER is a value inside one user's workspace blob and a DATABASE is a `user_tables`
+definition; giving each its own grant field would put the same three-line permission decision in
+three files owned by two sessions, which is how the three drift. One registry, one predicate,
+three callers.
+
+    shares.set_grants(kind, oid, entries, owner=…, granter=…, st=…)   # replaces the whole set
+    shares.grants(kind, oid, st=…)                         # -> {'owner': str, 'entries': [...]}
+    shares.role_for(kind, oid, user, is_admin=…, st=…)     # -> 'owner'|'edit'|'view'|None
+    shares.max_grantable_role(kind, oid, user, …)          # -> 'edit'|'view'|None (R4's ceiling)
+    shares.shared_with(user, kind=…, st=…)                 # -> [oid] this user was granted
+
+THE ROLE VOCABULARY IS TWO WORDS AND THE DEFAULT IS THE NARROW ONE. `view` = may open and read;
+`edit` = may also change the object's CONTENT.
+
+⭐⭐ AND ON A VIEW, `edit` NOW ALSO MEANS "MAY RE-SHARE" — OWNER RULING R4, instruction 4 (*"Edit
+View so a member can share a View as well, not just an admin"*), built as W40-T02. This REVERSES
+the flat owner-or-admin rule this paragraph used to state, and it reverses it for ONE kind:
+`RESHARE_KINDS` below is where the widening is spelled, once, and `folder` / `database` / `field`
+are untouched — still the owner's or an admin's, for the reason given at that constant.
+
+⛔ WHICH HALF OF THE OLD PROTECTION SURVIVES, BECAUSE THE FEAR IT NAMED WAS REAL AND ONLY HALF OF
+IT IS ANSWERED. The sentence here used to be *"a collaborator who could rewrite grants could grant
+themselves sole ownership of somebody else's object, or quietly widen a users-scoped share to
+everyone"*. Taking those one at a time:
+  * **SOLE OWNERSHIP IS BLOCKED — and now stated rather than incidental.** The owner is STICKY in
+    `set_grants` and `routes_shares.put_share` passes the EXISTING owner straight back through, so
+    a re-share cannot transfer ownership and no grantee can lock the creator out of their own view.
+    Ownership moves for nobody, by any path this registry offers.
+  * **WIDENING IS NOW BLOCKED TOO — OWNER RULING 2026-08-24, D-473.** ⛔ THE SENTENCE HERE USED
+    TO PRICE THIS AS A COST R4 ACCEPTED: *"an `edit` grantee may add somebody — `*` included — at
+    `view`"*. Measured and reported as such, and the owner's answer was *"no a re-sharer can only
+    share to specific people"*. So a re-sharer may name PEOPLE and may not reach `EVERYONE`, and
+    the second half of the old fear is closed rather than merely capped. The ROLE ceiling below
+    still stands beside it — they are two different questions and both are asked.
+  * **THE ROLE CEILING SURVIVES UNCHANGED.** A re-share may never exceed the role the re-sharer
+    holds, and the STRICTER reading of that ships: an `edit` grantee may add somebody at `view`,
+    and can never mint `edit` access for anyone. Handing out `edit` stays the owner's (or an
+    admin's) alone. A `view` grantee still cannot share at all. `max_grantable_role` is that
+    ceiling, and `routes_shares.put_share` is where it bites.
+  * **AND REVOCATION IS BOUNDED BY PROVENANCE — OWNER RULING 2026-08-24, D-474.** *"a re-sharer
+    can only unshare the people it shared to"*. R4 bounded the role a re-sharer may HAND OUT and
+    said nothing about what they may TAKE AWAY, so an `edit` grantee could `PUT []` and leave the
+    view shared with nobody. Answering that needs a fact the record did not carry, which is what
+    the `by` member on each entry is (`_clean_entries` / `set_grants`' `granter`). ⛔ An entry
+    with NO `by` — every grant written before this change — is the OWNER's to revoke and nobody
+    else's: a re-sharer must never revoke a grant they cannot prove they made.
+
+⛔ AN UNREADABLE GRANT IS NO GRANT. Every path here fails closed — junk in the bucket, a missing
+owner, an unknown role string all resolve to None rather than to a default that opens something.
+[[aios-permissioning]]: no fail-open defaults, ever.
+
+⚠ THE BUCKET IS TENANT-SCOPED THROUGH `st`, like every other product-data write. Passing the
+session's `TenantRuntime` is what keeps Nurilab's grants in Nurilab's store; the module default
+(`core.store`) is tenant #0 and exists for the same reason it does everywhere else — the ~28
+callers that predate multi-tenancy. (This is the D-5/D-16 residency shape, and this module does
+NOT repeat their mistake: `st` is threaded from the first line rather than retrofitted.)
+"""
+import core.store as store
+
+#: The store key. One bucket per tenant holds every kind's grants, because "what am I shared on"
+#: is a question across kinds — the "Shared with me" folder (R10) is exactly that query, and
+#: three separate buckets would make it three reads that can disagree about what a user can see.
+SHARES_KEY = 'object_shares'
+
+#: The shareable kinds. A CLOSED vocabulary: an unknown kind raises rather than creating a new
+#: namespace by typo, which would silently grant nothing to nobody and read as "sharing is broken".
+#:
+#: ⭐⭐ W38-T16 — `field` IS THE FOURTH, AND NOTHING IN THIS FILE BRANCHES ON IT. Every function
+#: below treats `kind` as an opaque bucket key (`_check_kind / grants / set_grants / role_for /
+#: may_see / may_edit / may_administer / shared_with / drop_objects`), so the kind's whole cost
+#: here is this tuple member. That is the point of one registry: the new object's WALL is written
+#: once in `core.perm_scope`, and its DOORS once in `routes_shares.py` — never a fourth
+#: permission decision in a fourth file ([[one-evaluator-per-question]]).
+KINDS = ('view', 'folder', 'database', 'field')
+
+#: `*` is "everyone who can already open the surface". It is NOT "every account on the platform".
+#: Spelled as a single character so it can never collide with a username (usernames are lower-case
+#: and non-empty by `core/users.py`, and are checked against this explicitly below).
+#:
+#: ⛔⛔ **AND WHAT THAT MEANS DEPENDS ON THE KIND — THE LINE THIS NOTE USED TO CARRY WAS FALSE FOR
+#: ONE OF THE THREE** (W33-T30, `waves/wave32/sharing-audit.md` S-8). It read *"the module/table
+#: wall runs FIRST and this never widens past it"*, flatly, and the audit's own words for that are
+#: *"the third docstring in this audit describing a check that is not on the path"*. Corrected
+#: here rather than deleted, because the sentence is TRUE of two kinds and the difference is the
+#: whole point:
+#:   * `kind='view'` / `kind='folder'` on a GOVERNED module (`customer_data`, `product_data`) —
+#:     the sentence holds. `require_session` plus the topic's own gate run first, and the
+#:     receiver's row scope and hidden-field closure are applied BEFORE any foreign view is
+#:     merged, so a grant can only narrow-or-equal what that account could already reach.
+#:   * `kind='database'` on a `ut_*` table — ⭐⭐ **THE SENTENCE HOLDS HERE TOO NOW, AND THAT IS
+#:     W36-T21 / OWNER RULING R6 (audit S-8, CLOSED).** It did not until wave 36, and the reason
+#:     is worth keeping: `routes_admin._clean_perms` 400'd any key outside
+#:     `("customer_data", "product_data")`, so no row filter and no hidden field could even be
+#:     DECLARED for a user table, `routes_tables.py` made zero `perm_scope` calls, and it passed
+#:     `hidden_keys=frozenset()`. A `database` grant was therefore ALL-OR-NOTHING — every row,
+#:     every column — and this registry was the only wall behind it.
+#:
+#: ⭐ WHAT CHANGED: `perm_scope.scoped_table` (contract C1) is the ONE door to any database's
+#: rows. `routes_tables` applies the permanent filter before `pids` is taken and the transitive
+#: hidden-field closure after `workspace_wire`, on EVERY `ut_*` read — the same code that walls
+#: `customer_data` — and a door that cannot apply them REFUSES rather than serving the lot. So a
+#: `database` grant is once again bounded by a second wall: it decides WHETHER an account reaches
+#: the database, and C1 decides WHICH rows and columns it then sees. An `*` grant still admits
+#: every account in the tenant, and each of them still only sees what their own wall allows.
+#:
+#: ⚠ `routes_shares.py`'s module docstring carries the OLD sentence at the other door and is in
+#: no wave-36 fence — the audit's own fix was "say so at both", so one of the two is now stale.
+#: Booked in `mailbox/C.md` (C-14) rather than edited across a fence
+#: [[two-gates-can-assert-opposite-things]].
+EVERYONE = '*'
+
+ROLES = ('view', 'edit')
+
+#: ⭐⭐ THE KINDS AN `edit` GRANTEE MAY RE-SHARE — R4 / W40-T02, and it is `view` ALONE.
+#:
+#: R4's words are "may re-share **A VIEW**", and the widening goes no further than the ruling
+#: names. That restraint is the whole reason this is a tuple rather than a bare `role == 'edit'`
+#: arm inside `may_administer`: every predicate in this file treats `kind` as an opaque bucket key
+#: (see the note on `KINDS`), so an UNGATED widening would reach `folder`, `database` and `field`
+#: in the same line — handing an `edit` grantee on a `ut_*` DATABASE the power to re-share the
+#: whole table. The asymmetry is one of blast radius: a view is one saved SELECTION, opened through
+#: the receiver's own module wall and row scope; a database grant admits an account to a database.
+#: `routes_shares.py`'s module docstring carries that argument at the door where it is enforced.
+#:
+#: ⚠ ONE SPELLING, DELIBERATELY. `may_administer` and `max_grantable_role` both consult this, so
+#: "who may open the editor" and "what may they hand out" cannot come apart about the same kind.
+RESHARE_KINDS = ('view',)
+
+
+class GrantsChanged(Exception):
+    """A grant write was decided against a record that is no longer the stored one.
+
+    Raised by `set_grants` when its `expect` does not match what is in the store at write time.
+    The door turns it into a 409 rather than a 500: it is not an error in the request, it is two
+    people editing the same sharing list at once, and the honest answer is to say so.
+    """
+
+
+#: ⛔⛔ A FIELD's OBJECT ID IS TOPIC-QUALIFIED, AND THE SEPARATOR IS DECLARED HERE SO THERE IS ONE
+#: SPELLING OF IT. A bare field key is NOT unique: `notes` exists on a dozen databases, and a
+#: grant stored under it would admit a grantee to every `notes` column in the tenant at once —
+#: the widening direction, silently, forever. `table_key` is the qualifier because it is the same
+#: identifier `shared_overlay.bucket()` already keys the values by, so the grant and the data it
+#: governs are named by the same string ([[one-question-two-normalizers]]).
+#:
+#: ⚠ A `ut_*` key and a registry topic key both match `[a-z0-9_]+` and neither can contain `:`,
+#: so the split below is unambiguous in both directions.
+FIELD_OID_SEP = ':'
+
+
+def field_oid(table_key, field_key):
+    """`"<table_key>:<field_key>"` — the share id of ONE column on ONE database."""
+    table = str(table_key or '').strip()
+    field = str(field_key or '').strip()
+    if not table or not field:
+        raise ValueError('shares.field_oid: a field share names BOTH a database and a column. '
+                         'A bare field key repeats across tables and would grant all of them')
+    return f'{table}{FIELD_OID_SEP}{field}'
+
+
+def split_field_oid(oid):
+    """`(table_key, field_key)` or `(None, None)` for anything that is not a field oid.
+
+    ⛔ FAIL-CLOSED ON JUNK, like every other read here: a caller that cannot learn WHICH database
+    an id names must not fall back to "the one I happen to be looking at", which is how a grant
+    on somebody else's column would be read as a grant on this one.
+    """
+    raw = str(oid or '')
+    table, sep, field = raw.partition(FIELD_OID_SEP)
+    if not sep or not table.strip() or not field.strip() or FIELD_OID_SEP in field:
+        return (None, None)
+    return (table.strip(), field.strip())
+
+
+def _st(st):
+    return st if st is not None else store
+
+
+def _check_kind(kind):
+    k = str(kind or '').strip().lower()
+    if k not in KINDS:
+        raise ValueError(f'{kind!r} is not a shareable kind. Use one of {", ".join(KINDS)}. '
+                         f'This door refuses to invent a namespace from a typo.')
+    return k
+
+
+def _clean_entries(entries):
+    """Normalise + REJECT junk, returning [{'user': str, 'role': 'view'|'edit'}] — plus an
+    OPTIONAL `'by'`, present only when the record already carried one.
+
+    Silently dropping a malformed entry is right here and wrong elsewhere: the caller is a UI
+    that just listed the people it is about to grant, so a rejected row must not abort the whole
+    save — but an entry with an unknown ROLE must not be stored as something else's default
+    either. Dropped, never coerced.
+
+    ⭐⭐ D-474 — `by` IS PROVENANCE: THE USERNAME OF WHOEVER PLACED THIS GRANT. Owner ruling
+    2026-08-24: *"a re-sharer can only unshare the people it shared to"*. That question has no
+    answer in a record that stores only WHO HOLDS the grant, so the record grew a third member and
+    this normaliser is where it survives the round trip (`grants` reads every stored entry back
+    through here, so a member this function drops is a member the door can never consult).
+
+    ⛔⛔ AND THIS FUNCTION STAYS A PURE NORMALISER: IT NEVER INVENTS A `by`, AND IT NEVER
+    VALIDATES ONE. That is not tidiness, it is the whole security property. `set_grants` is handed
+    a caller-supplied list, so a `by` arriving HERE may be forged — and the merge inside
+    `set_grants._apply` therefore OVERWRITES it in both directions from the PRIOR record and the
+    `granter`, never from the payload. Were this function to treat a submitted `by` as
+    authoritative, a re-sharer could PUT `{user: victim, role: view, by: <themselves>}` to
+    re-stamp somebody else's grant as their own, then PUT again omitting the victim, and the wall
+    at the door would be decoration. Normalise the SHAPE here; decide the VALUE there.
+
+    ⚠ KEY ORDER IS `user, role, by` AND `by` IS ABSENT RATHER THAN `None` WHEN THERE IS NONE.
+    Absence is what keeps every pre-existing record byte-identical after this change (an added
+    `by: None` would rewrite the whole bucket on the next save, for nothing), and it is what
+    `aios-web/api/verify_field_permissions.py` reads when it compares `tuple(entry.values())`
+    against a 2-tuple.
+    """
+    out, seen = [], set()
+    for e in entries or ():
+        if not isinstance(e, dict):
+            continue
+        user = str(e.get('user') or '').strip().lower()
+        role = str(e.get('role') or '').strip().lower()
+        if not user or role not in ROLES or user in seen:
+            continue
+        seen.add(user)
+        row = {'user': user, 'role': role}
+        by = str(e.get('by') or '').strip().lower()
+        if by:
+            row['by'] = by
+        out.append(row)
+    return out
+
+
+def grants(kind, oid, st=None):
+    """`{'owner': str|None, 'entries': [{'user','role','by'?}]}` — never raises on a junk bucket.
+
+    ⭐⭐ D-474 — `by` RIDES THE READ, because the DOOR is what has to consult it. The revocation
+    wall lives in `routes_shares.put_share` (it needs the session, which this layer does not
+    have), and a wall cannot read a member this function strips. `_clean_entries` carries it,
+    so every reader here sees it and no reader has to reach into the raw bucket.
+
+    ⚠ THE COST, STATED RATHER THAN DISCOVERED: `GET /api/v1/share/{kind}/{oid}` returns this
+    record verbatim, so anyone who may read a grant list now also learns WHO ADDED each person,
+    a `view` grantee included. That is a mild widening of *"who has this?"* into *"who let them
+    in?"*. It is accepted deliberately: the alternative is a second, provenance-stripped read
+    path, which is a second answer to one question and is how the two come apart
+    ([[one-evaluator-per-question]]).
+    """
+    kind = _check_kind(kind)
+    try:
+        bucket = (_st(st).get(SHARES_KEY) or {}).get(kind) or {}
+        rec = bucket.get(str(oid)) or {}
+    except Exception:
+        return {'owner': None, 'entries': []}
+    if not isinstance(rec, dict):
+        return {'owner': None, 'entries': []}
+    return {'owner': (str(rec.get('owner')).strip().lower() if rec.get('owner') else None),
+            'entries': _clean_entries(rec.get('entries'))}
+
+
+def set_grants(kind, oid, entries, owner=None, st=None, granter=None, expect=None):
+    """REPLACE the grant set for one object. Returns the stored record.
+
+    ⚠ REPLACE, NOT MERGE, and that is the contract the UI needs: revoking is expressed by an
+    entry's ABSENCE. A merge-only API cannot remove anybody without a second verb, and the
+    manage-access editor R10 asks for is exactly "here is the list now".
+
+    ⭐⭐ D-474 — `granter` IS WHO IS DOING THIS SAVE, AND IT IS THE ONLY SOURCE OF A NEW `by`.
+    Owner ruling 2026-08-24: *"a re-sharer can only unshare the people it shared to"*. The wall
+    is at the door (`routes_shares.put_share`), but the FACT it consults can only be recorded
+    here, at the write.
+
+    ⛔⛔ AND THE STAMP IS DECIDED INSIDE `_apply`, NOT ABOVE IT, BECAUSE `_apply` IS THE ONLY
+    PLACE THE PRIOR RECORD IS VISIBLE. Two rules, and the first is the one that matters:
+      * a user ALREADY in the prior record keeps their stored `by` VERBATIM. Never re-stamped —
+        a re-save would otherwise transfer provenance to whoever saved last, so every re-sharer
+        would silently inherit the right to revoke everybody the owner had ever added, simply by
+        pressing Save. That is the ruling inverted, arriving by accident.
+      * a user who is NEW to the record takes `by = granter`, or carries NO `by` at all when no
+        granter was named.
+
+    ⛔ IN BOTH ARMS THE VALUE IS OVERWRITTEN FROM (prior, granter) AND NEVER READ OFF THE
+    SUBMITTED ENTRY. `_clean_entries` preserves a submitted `by` because a STORED one has to
+    survive the read; a caller-supplied one is untrusted input. Filling in only a MISSING `by`
+    would leave the two-step forgery open: PUT `{user: victim, by: <me>}` to claim provenance,
+    then PUT again omitting the victim.
+
+    ⭐ `granter` DEFAULTS TO `None`, AND THAT IS WHAT MAKES THIS SHAPE CHANGE SAFE. Every
+    non-door caller — `core.field_permissions` (promote + reconcile), `modules.product_data`'s
+    Image field, `core.grid_events`' cleanup on delete, the gates — replaces a whole grant set
+    with no caller identity in hand, and each keeps producing EXACTLY the record it produced
+    before this change: no `by`, no new bytes, no behaviour moved. A grant with no `by` is one
+    nobody can prove they made, and the door treats it as the owner's alone to revoke
+    (fail-closed). ⚠ A future edit that defaults this to a session, or stamps it from the entry,
+    deletes that property without touching a line the compiler can complain about.
+
+    ⚠ `_apply` MAY RUN MORE THAN ONCE. `store._update_locked` re-applies the mutation on a
+    `parent_commit` rebase, so the merge builds FRESH dicts from `clean` on every invocation
+    rather than mutating it in place; a second pass must see the same untouched input, and it
+    must be free to reclassify a user who was "new" on the first pass and is "prior" on the
+    second (exactly what a rebase against another writer's save looks like).
+    """
+    kind = _check_kind(kind)
+    oid = str(oid)
+    clean = _clean_entries(entries)
+    owner_l = str(owner).strip().lower() if owner else None
+    granter_l = str(granter).strip().lower() if granter else None
+
+    def _apply(data):
+        by_kind = dict(data.get(kind) or {})
+        # ⛔⛔ COMPARE-AND-SET, AND IT IS A SECURITY BOUNDARY RATHER THAN A TIDINESS ONE.
+        # `routes_shares.put_share` reads the record ONCE, decides against it (may this caller
+        # remove that person, raise that role, add that audience), and only then calls this. The
+        # store re-reads `prior` fresh in here, so between the decision and the write another
+        # save can land and the decision is being applied to a record it never saw.
+        #
+        # Measured by a wave-40 adversarial probe, and it needs no attacker timing: the owner and
+        # a re-sharer both have Manage Access open and both press Save. The re-sharer's PUT was
+        # ACCEPTED with 200 and the grant the owner had just added was gone, with no error on
+        # either screen. That is D-474's wall failing open in the one window where two people are
+        # actually editing the same thing.
+        #
+        # ⚠ THE LOST UPDATE PREDATES THE WALL -- REPLACE semantics plus read-modify-write have
+        # always meant last-write-wins here. What is new is that a PERMISSION decision now rests
+        # on that read. So the caller states what it decided against, and a write that would land
+        # on anything else is refused rather than merged.
+        #
+        # `expect=None` keeps every existing caller byte-identical: the server-derived callers
+        # (`field_permissions`, `product_data`, the `[]` revokes) are not deciding anything about
+        # a person and have nothing to compare.
+        if expect is not None:
+            _now = [(e['user'], e['role']) for e in _clean_entries(
+                (by_kind.get(oid) or {}).get('entries') if isinstance(by_kind.get(oid), dict)
+                else [])]
+            if _now != [(e['user'], e['role']) for e in _clean_entries(expect)]:
+                raise GrantsChanged(
+                    'this item was shared with somebody else while you were editing, so nothing '
+                    'was saved. Reopen the sharing panel to see who has access now, then make '
+                    'your change again.')
+        prior = by_kind.get(oid) if isinstance(by_kind.get(oid), dict) else {}
+        # Read the prior entries through the SAME normaliser every other reader uses, so "was
+        # this user already here" cannot be answered one way by the store and another by the
+        # door ([[one-question-two-normalizers]]).
+        prior_by = {e['user']: e.get('by') for e in _clean_entries(prior.get('entries'))}
+        merged = []
+        for e in clean:
+            row = {'user': e['user'], 'role': e['role']}
+            stamp = prior_by[e['user']] if e['user'] in prior_by else granter_l
+            if stamp:
+                row['by'] = stamp
+            merged.append(row)
+        # The owner is STICKY: set once, and a later save that omits it must not orphan the
+        # object. An ownerless grant record cannot answer "who may re-share this", so every
+        # administer check would fail closed and the object would become unmanageable.
+        keep_owner = owner_l or (str(prior.get('owner')).strip().lower()
+                                 if prior.get('owner') else None)
+        if not merged and not keep_owner:
+            by_kind.pop(oid, None)          # fully un-shared and unowned: leave no empty husk
+        else:
+            by_kind[oid] = {'owner': keep_owner, 'entries': merged}
+        data[kind] = by_kind
+        return data
+
+    _st(st).update(SHARES_KEY, _apply, flush='async')
+    return grants(kind, oid, st=st)
+
+
+def role_for(kind, oid, user, is_admin=False, st=None):
+    """`'owner'` | `'edit'` | `'view'` | `None` — the caller's effective role, fail-closed.
+
+    An ADMIN reads as `'owner'`: an admin who could not administer an object could not
+    administer the tenant either, which is `table_store._may_administer`'s existing rule and is
+    kept identical here so the two cannot disagree about the same view.
+    """
+    user = str(user or '').strip().lower()
+    if not user:
+        return None
+    rec = grants(kind, oid, st=st)
+    if is_admin or (rec['owner'] and rec['owner'] == user):
+        return 'owner'
+    best = None
+    for e in rec['entries']:
+        if e['user'] == user or e['user'] == EVERYONE:
+            # The STRONGER of the two wins when both a personal and an everyone grant exist:
+            # naming somebody explicitly is how you RAISE them above the room, so an
+            # everyone-view + alice-edit pair must leave alice editing.
+            if e['role'] == 'edit':
+                return 'edit'
+            best = best or 'view'
+    return best
+
+
+def may_see(kind, oid, user, is_admin=False, st=None):
+    return role_for(kind, oid, user, is_admin=is_admin, st=st) is not None
+
+
+def may_edit(kind, oid, user, is_admin=False, st=None):
+    return role_for(kind, oid, user, is_admin=is_admin, st=st) in ('owner', 'edit')
+
+
+def may_administer(kind, oid, user, is_admin=False, st=None):
+    """May this caller change WHO ELSE reaches the object, and revoke them?
+
+    ⭐⭐ R4 / W40-T02 — AN `edit` GRANTEE ANSWERS TRUE, ON A `RESHARE_KINDS` KIND. Owner
+    instruction 4: *"Edit View so a member can share a View as well, not just an admin"*. That
+    reverses this function's old owner-or-admin rule for exactly one kind; the module note says
+    which half of the protection survives and `RESHARE_KINDS` says why it stops at `view`.
+
+    ⛔ ADMINISTERING IS NOT GRANTING, AND THE SECOND QUESTION HAS ITS OWN PREDICATE. True here
+    means "may open the editor and rewrite the list"; it does NOT mean every role is theirs to
+    hand out. `max_grantable_role` is the ceiling, and R4's two halves are only both honoured if
+    a caller consults both ([[one-evaluator-per-question]]).
+
+    ⛔ THE GATE IS THE KIND, NOT THE ROLE ALONE. `role_for` is deliberately kind-agnostic, so
+    testing `== 'edit'` without `RESHARE_KINDS` would widen all four kinds in one line.
+    """
+    role = role_for(kind, oid, user, is_admin=is_admin, st=st)
+    if role == 'owner':
+        return True
+    return role == 'edit' and _check_kind(kind) in RESHARE_KINDS
+
+
+def max_grantable_role(kind, oid, user, is_admin=False, st=None):
+    """The STRONGEST role this caller may hand SOMEBODY ELSE on this object, fail-closed.
+
+    `'edit'` for the owner or an admin · `'view'` for an `edit` grantee on a `RESHARE_KINDS` kind
+    · `None` for anybody who may not administer the object at all.
+
+    ⭐⭐ WHY A SECOND PREDICATE RATHER THAN A FLAG ON `may_administer` (R4 / W40-T02). R4 grants an
+    `edit` holder the right to re-share and caps it in the same breath: *"a re-share may never
+    exceed the role the re-sharer holds"*. Those are two different questions, and a single boolean
+    answering both is exactly how the cap gets dropped by the next caller that only needs the door.
+
+    ⛔ THE NARROWER OF R4's TWO READINGS SHIPS, AND ON PURPOSE. "Never exceed the role you hold"
+    reads either as *may grant up to and including `edit`* (an edit holder confers edit) or as *may
+    confer strictly less than the owner can*. This returns `'view'` — the second — because it is the
+    FAIL-CLOSED direction. A wrong `'view'` costs the owner one click to raise somebody; a wrong
+    `'edit'` lets a chain of collaborators propagate edit access the owner never approved, with
+    nothing in the store recording who widened it. W40-T02's `done-when` pins the same reading.
+
+    ⚠ THIS CAPS WHAT A CALLER GRANTS, NOT WHAT THE STORED SET ALREADY HOLDS, and the difference is
+    load-bearing. `routes_shares.put_share` enforces it against the DELTA — a name arriving at
+    `edit`, or an existing `view` grantee raised to it — never against every row of a body, because
+    the PUT REPLACES and the client therefore re-sends the whole list, the re-sharer's own `edit`
+    row included. The evidence for that is at the call site, where the body is.
+
+    ⛔⛔ AND IT IS ONE OF THREE BOUNDS ON A RE-SHARE, NOT THE BOUND. Owner ruling 2026-08-24 added
+    two more, and both live at the door because both need the SESSION: `_audience_added` (D-473,
+    a re-sharer may name people and may not reach `EVERYONE`) and `_unremovable` (D-474, a
+    re-sharer may revoke only what their own `by` stamp says they granted). ⚠ A reader who takes
+    this function for the whole ceiling will widen the other two by leaving them alone — which is
+    exactly how R4 shipped with an audience hole and a revocation hole under a docstring that
+    read like a complete account of the limits.
+    """
+    role = role_for(kind, oid, user, is_admin=is_admin, st=st)
+    if role == 'owner':
+        return 'edit'
+    if role == 'edit' and _check_kind(kind) in RESHARE_KINDS:
+        return 'view'
+    return None
+
+
+def shared_with(user, kind=None, st=None):
+    """Every object id this user has been granted (excluding what they own).
+
+    This is the "Shared with me" query (R10). It EXCLUDES owned objects deliberately: a folder
+    you made is not something shared *with* you, and listing it there would make the system
+    folder a duplicate of the rail above it.
+    """
+    user = str(user or '').strip().lower()
+    if not user:
+        return {}
+    try:
+        data = _st(st).get(SHARES_KEY) or {}
+    except Exception:
+        return {}
+    out = {}
+    for k in ([_check_kind(kind)] if kind else KINDS):
+        hits = []
+        for oid, rec in (data.get(k) or {}).items():
+            if not isinstance(rec, dict):
+                continue
+            owner = str(rec.get('owner') or '').strip().lower()
+            if owner == user:
+                continue
+            for e in _clean_entries(rec.get('entries')):
+                if e['user'] in (user, EVERYONE):
+                    hits.append(str(oid))
+                    break
+        out[k] = sorted(hits)
+    return out if kind is None else {_check_kind(kind): out[_check_kind(kind)]}
+
+
+def granted_oids(kind, st=None):
+    """Every object id of one `kind` that carries AT LEAST ONE grant entry — in ONE bucket read.
+
+    ⭐ W40-T01 / OWNER INSTRUCTION 2 ("a shared View must show the shared icon in EVERY account,
+    not only the recipient's"). `shared_with` answers *what was granted TO me* and deliberately
+    EXCLUDES what the caller owns — so it structurally cannot answer the other question a share
+    mark asks: *does this object have grants at all*. That question has no viewer in it, which is
+    why this is a separate function rather than a flag bolted onto `shared_with`.
+
+    ⚠ ONE READ, NOT N — and that is the whole reason this exists rather than a loop at the caller.
+    The obvious spelling is `grants(kind, oid)` per view, and `grants` re-reads the WHOLE bucket
+    on every call; a busy rail carries dozens of views, so painting one icon would cost dozens of
+    full reads of the tenant's entire grant registry. This reads the bucket once and hands back a
+    set the caller tests in O(1).
+
+    ⛔ AN ENTRY IS WHAT COUNTS, NOT A RECORD. `set_grants` keeps an owner-only HUSK after a full
+    revoke — the owner is sticky, deliberately, see its own note — so testing for the record's
+    mere EXISTENCE would leave the mark lit forever after the last person was removed. That is
+    exactly the revoke case, so it is the difference between this being right and being decorative
+    noise. `_clean_entries` is the same normaliser every other read here uses, so a junk entry
+    cannot mark an object either.
+
+    ⛔ FAIL-CLOSED like the rest of this module: an unreadable bucket answers the EMPTY set — no
+    marks — never a default that claims something is shared. An unknown KIND still RAISES, exactly
+    as `grants` / `shared_with` / `drop_objects` do: that is a typo in a caller, not junk in the
+    store, and swallowing it into "nothing is shared" would hide a caller that never works.
+    """
+    kind = _check_kind(kind)
+    try:
+        by_kind = (_st(st).get(SHARES_KEY) or {}).get(kind) or {}
+        rows = list(by_kind.items())
+    except Exception:
+        return set()
+    return {str(oid) for oid, rec in rows
+            if isinstance(rec, dict) and _clean_entries(rec.get('entries'))}
+
+
+def drop_objects(pairs, st=None):
+    """Remove whole grant RECORDS, owner husk included — wave 21, item 6a (C3).
+
+    A deleted object's grants must die with it: `shared_with` would otherwise serve ghost ids
+    into every receiver's "Shared with me" forever, and the ghost would 404 on open. One
+    transaction for the whole sweep — a table delete drops its database grant plus a view
+    grant per view that lived in its bucket."""
+    want = {}
+    for kind, oid in pairs or ():
+        want.setdefault(_check_kind(kind), set()).add(str(oid))
+    if not want:
+        return
+
+    def _apply(data):
+        for kind, oids in want.items():
+            by_kind = data.get(kind)
+            if isinstance(by_kind, dict):
+                for oid in oids:
+                    by_kind.pop(oid, None)
+        return data
+
+    _st(st).update(SHARES_KEY, _apply, flush='async')