Settle who a published share is for
Changes who may read a conversation that has already been published, without republishing it. The share keeps its id, its expiry and its position: this is the audience and nothing else.
A REPLACEMENT, which is what makes adding and removing ONE act. The list sent is the list the share names afterwards, so a colleague added and a colleague dropped happen in one request and the two can never disagree about who is on it. Absent or empty hands the share back to the whole organisation, which is the ordinary publish.
WHOEVER ENTERS RECEIVES THE WHOLE CONVERSATION, from its first entry: the organisation’s home holds the copy as it has been delivered, so a colleague added today opens everything sent before today. WHOEVER LEAVES LOSES IT AT ONCE — the next read answers 404 exactly as it answers a share id nobody minted, and the live view stops being written to them, because both ask the audience of the share as it stands rather than as it stood when they connected.
WHO MAY CHANGE IT: the person who published the share, or a member carrying members:manage. Everybody else is answered 403 NRY-0028, the holder of sessions:read-private included — being able to read a conversation is not being able to decide who else may.
A REVOKED OR EXPIRED SHARE IS OVER AND IS NOT RETARGETED. Its entries have been deleted, so an audience written onto it would describe a conversation that no longer exists.
IT TRAVELS TO THE ORGANISATION’S HOME AND ANSWERS AFTER IT HAS, for the reason a revocation does: the home that decides who opens the copy is the home that holds it, so a change recorded only here is a colleague still reading a conversation they were taken off. 503 NRY-0029 means the local record is settled and this machine has told nobody. Asking again re-attempts the organisation’s home and is what completes it — the same request carrying the same list is sent on again rather than recognised as already done here, because what this home holds says nothing about what the other one holds. Served AT the organisation’s home — which is where the copy is — it is the local write alone, and there is nowhere further for it to go.
Authorizations
Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation.
Path Parameters
The share's id, as SessionShare.shareId reports it: 26 characters of RFC 4648 base32 drawn from a cryptographic source, carrying no encoding of anything. It is NOT a uuid and is deliberately unrelated to the session id it was published from — a share id travels, so an id derived from a session would make every leaked link a statement about the machine it came from.
26^[A-Z2-7]{26}$Body
Who a published share is for, after this request. THE WHOLE LIST AND NOT A CHANGE TO ONE. What is sent is what the share names afterwards, so adding a colleague and removing another is a single act with a single answer — a body that carried "add these, remove those" would be two lists that can contradict each other and a third rule for what happens when they do. ABSENT OR EMPTY IS THE WHOLE ORGANISATION, the ordinary publish and the default — never "a share nobody may read". It is how a share narrowed by mistake is widened again without republishing the conversation. Naming somebody twice is the same grant said twice and is kept once. A value no sign-in could report — a blank, a pasted line — is refused by name with 422, because a share addressed to a typo is a share readable by nobody answered with a success.
The subjects of the colleagues this share is for. They are members of the same organisation: there is no cross-organisation share, because one organisation is one home and a token for another is refused before any handler runs.
Response
The share is for exactly the colleagues named, at this home and at the organisation's.

