Read-only scope audit at main `6dc0f1c`, linked to dogfooding #5 and distributed-work meta #58. These are code-path findings, not new runtime acceptance.

**Missing path:** all four terminal operations are owner-only ([gateway.ts](https://github.com/githubnext/ace2/blob/6dc0f1c881983718d00b042f4018f3ad6e535bdd/apps/host/src/gateway.ts#L193-L213)); terminal open requires a local catalog record and has no peer/workspace forwarding ([handler](https://github.com/githubnext/ace2/blob/6dc0f1c881983718d00b042f4018f3ad6e535bdd/apps/host/src/gateway.ts#L352-L368)). The existing code does permit the owner's direct tailnet browser and hosted channels opened on their workspace host. Another gateway reaching that workspace remains unsupported; the hosted cell itself has no shell.

**Design required before implementation:**

- Creating a new shell in a teammate's checkout differs from discovering/attaching to their existing terminal. IDs currently live in client layouts; there is no session-discovery protocol. - Direct PTY access runs as the host OS user. Read, input, resize, and close rights are not defined by the existing switch, which controls only new agent invocations ([team semantics](https://github.com/githubnext/ace2/blob/6dc0f1c881983718d00b042f4018f3ad6e535bdd/docs/architecture.md#L359-L367)). Preserve the tailnet trust model; don't silently broaden that flag. - Reattach and continuation operations currently trust terminal IDs. Peer exposure needs channel/participant binding and explicit existing-session semantics ([terminal manager](https://github.com/githubnext/ace2/blob/6dc0f1c881983718d00b042f4018f3ad6e535bdd/apps/host/src/terminals.ts#L48-L69)). - Define output/exit forwarding, reconnect/replay, simultaneous input/resize, close versus detach, orphan timeout, and kill/archive/delete behavior.

Recommendation: no straight-proxy patch. An owner-only route through their other machines is a smaller possible first slice; teammate session access needs the decisions above. Validate the owner route on two machines and teammate rights with two people. #159 addresses transcript watches, while #53 addresses agent jobs; neither implements this terminal feature.