- domain: Garden gains a computed MyRole ("owner"/"editor"/"viewer"); new
  ShareWithUser (share + recipient identity); sentinels ErrShareUserNotFound,
  ErrCannotShareWithSelf, ErrShareExists.
- store/shares.go: GetShareRole, ListSharesForGarden (joined with users),
  CreateShare (UNIQUE → ErrShareExists), UpdateShareRole, DeleteShare.
- store/gardens.go: ListGardensForActor returns owned + shared-with-me gardens,
  each carrying my_role (replaces the owner-only list).
- service: requireGardenRole now consults garden_shares (owner implicit, else the
  share's role, else masked ErrNotFound) and stamps MyRole on every read-through.
  UpdateGarden tightened to OWNER-only (editors edit contents, not the garden).
  UpdatePlanting only re-checks plant visibility when the plant is CHANGED, so a
  shared editor can edit a plop that uses the owner's private plant.
- service/shares.go: ListShares/AddShare/UpdateShareRole (owner only), RemoveShare
  (owner or a recipient leaving). AddShare targets an existing account by exact
  email; unknown → 404, self → 400, duplicate → 409.
- api: GET,POST /gardens/:id/shares and PATCH,DELETE /gardens/:id/shares/:userId.

Tests: the full {owner, editor, viewer, stranger} × {read, mutate object, mutate
planting, edit garden, delete garden, manage shares} ACL matrix; shared gardens
carry my_role; AddShare error cases; role upgrade + self-leave; plus a two-user
HTTP flow. The matrix caught the editor-cannot-edit-owner's-plant bug above.

GOWORK=off go build/vet/test ./internal/... green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

@@ -35,0 +36,4 @@
+func (r gardenRole) String() string {
+	switch r {
+	case roleOwner:
+		return "owner"

@@ -110,1 +149,3 @@
-	return s.store.UpdateGarden(ctx, g)
+	updated, err := s.store.UpdateGarden(ctx, g)
+	if updated != nil {
+		updated.MyRole = roleOwner.String() // only the owner reaches here

@@ -127,0 +126,4 @@
+	// existing plop may reference a plant the actor can't see (e.g. a shared
+	// editor working in the owner's garden with the owner's private plant), and
+	// editing its radius/label/date must still work.
+	if patch.PlantID != nil {

@@ -127,0 +131,4 @@
+			return nil, err
+		}
+	}
+	plant, err := s.store.GetPlant(ctx, pl.PlantID) // for the derived count

@@ -0,0 +27,4 @@
+// exact email of an existing account (v1 has no invitation emails). Owner only.
+// Unknown email → ErrShareUserNotFound; the owner's own email →
+// ErrCannotShareWithSelf; an already-shared user → ErrShareExists.
+func (s *Service) AddShare(ctx context.Context, actorID, gardenID int64, email, role string) (*domain.GardenShare, error) {

@@ -0,0 +36,4 @@
+	}
+	target, err := s.store.GetUserByEmail(ctx, strings.TrimSpace(email))
+	if errors.Is(err, domain.ErrNotFound) {
+		return nil, domain.ErrShareUserNotFound

@@ -0,0 +63,4 @@
+// RemoveShare revokes a share. The garden owner may remove anyone; a recipient
+// may remove themselves ("leave garden"). Any other actor gets the garden's
+// masked ErrNotFound (existence isn't revealed to non-participants).
+func (s *Service) RemoveShare(ctx context.Context, actorID, gardenID, targetUserID int64) error {

@@ -0,0 +68,4 @@
+	if err != nil {
+		return err // ErrNotFound
+	}
+	if g.OwnerID != actorID && actorID != targetUserID {

@@ -0,0 +9,4 @@
+)
+
+// wantErr asserts err matches want (nil = expected success, else errors.Is).
+func wantErr(t *testing.T, name string, err, want error) {

@@ -64,2 +77,2 @@
-		`SELECT `+gardenColumns+` FROM gardens WHERE owner_id = ? ORDER BY created_at DESC, id DESC LIMIT ?`,
-		ownerID, maxGardensListed,
+		`SELECT `+gardenColumns+`, my_role FROM (
+		     SELECT `+gardenColumns+`, 'owner' AS my_role FROM gardens WHERE owner_id = ?

@@ -0,0 +43,4 @@
+// ListSharesForGarden returns a garden's shares joined with each recipient's
+// email and display name, for the sharing UI. Always a non-nil slice.
+func (d *DB) ListSharesForGarden(ctx context.Context, gardenID int64) ([]domain.ShareWithUser, error) {
+	rows, err := d.sql.QueryContext(ctx,

@@ -0,0 +58,4 @@
+	shares := []domain.ShareWithUser{}
+	for rows.Next() {
+		var sh domain.ShareWithUser
+		if err := rows.Scan(