[LiranCohen]

Shared contexts currently survive only in one agent's local storage, forcing dapps to maintain synchronized bookmark records and reconciliation loops. Make contexts.follow() and invitation acceptance save encrypted recipient-owned choices, and restore them through the existing context APIs after verifying current membership and keys.

defineProtocol() adds the private, immutable enboxContextFollow journal alongside the managed invitation inbox. One internal module defines both paths with separate access rules. Follow decisions contain owner DID, context ID, and a declared role-group name; forget decisions need only the coordinates and following: false. The latest signed timestamp and record ID win. A newer choice remains authoritative even when the current app cannot execute its group.

contexts.forget({ ownerDid, id }) can clear a choice without a live acceptance, including after revocation or on a fresh device. Handle-level forgetting stays fenced to its exact acceptance. leave() withdraws the owner role before saving the forget; these writes are not atomic, and coordinate-based forgetting can complete the saved choice after a partial failure. Retired leave/follow operations expose ContextRetiredError.

Observation restores choices in the background without blocking known contexts. Recipient sync and matching owner-context recovery events retry unavailable choices; ordinary owner currentness probes do not trigger retries. Superseded follows cannot return a conflicting role policy. Rollback re-verifies the current saved choice instead of reinstalling captured authority. Per-owner restoration failures retain choices and available contexts, with unexpected failures logged.

Protocol-write delegates act for the identity and can change its shared choices; remote access is always verified independently. Permissions are not widened. The docs describe one-shot list latency, partial leave recovery, and retained journal history. No migration, local-only fallback, outbox, or additional polling timer is introduced.

The paired Notesd adoption #152 removes its bookmark controller, schema, store property, startup wiring, and redundant tests: 362 production lines and 498 test lines. Notesd keeps its sharing presentation and CRDT repair policy. It remains a draft until the SDK is published and its dependencies are pinned.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
98.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud