feat(share): terminal-only sharing, bigger + full-screen — 0.25.0

Scope M12 down to a single shared-terminal mode (D23, amends D16):
- Share page rewritten terminal-only: host shares their PTY/shell; guest watches
  and may type only if the host ticks "Allow the guest to type" (read-only
  otherwise — the D9 consent exception). Terminal is larger; either side can pop
  it full-screen (Esc to exit).
- Removed the read-only stats view + HTTP server (core/share.py) and the
  `rigdoctor share serve` CLI; deleted their tests.
- Docs: D23 added; SPEC/MODULES/ROADMAP updated (M12 → done, terminal-only).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/DECISIONS.md

@@ -239,9 +239,19 @@ consent." That milestone lands here, **scoped tightly to stay safe**:
   the apply UI is an additive convenience in the GUI, not the only path. Installing optional
   tools (GameMode/MangoHud/cpupower) reuses the M9 installer and is likewise one-click.
 
+### D23 — Session sharing scoped to a shared terminal only — *DECIDED 2026-05-22; amends D16*
+D16's escalating ladder (export → read-only stats view → terminal) is **cut down to just the
+shared terminal.** Rationale: the terminal is the only mode the owner wants; the stats view
+duplicated what the GUI already shows and added surface area. Concretely:
+- **Removed:** the read-only stats view + its HTTP server (`core/share.py`, `rigdoctor share
+  serve`) and the (never-built) bundle export. The `share` CLI command is gone.
+- **Kept & finished:** the relay **shared terminal** (host PTY of `$SHELL`) — now color-rendered
+  (preserves fish/ls/git theming), full-screen-able, with the guest read-only unless the host
+  ticks "Allow the guest to type" (the D9 consent exception). Account-gated by the Gitea token.
+
 ## Open
 
-None currently — all tracked decisions (D1–D22) are resolved. New questions will be added
+None currently — all tracked decisions (D1–D23) are resolved. New questions will be added
 here as they arise. Remaining detail to flesh out during build: the tray's supporting-action
 set (D13), per-module apt package names, M12's tunnel/token specifics, and M13's
 update mechanism (APT repo vs. self-installed `.deb`).

docs/MODULES.md

@@ -18,7 +18,7 @@ Status: ⬜ not started · 🟦 designing · 🟨 in progress · ✅ done
 | M10 | Desktop GUI | Desktop UI | **python3-pyside6** | all | P2 | ✅ |
 | M11 | Tray / menu-bar applet | Desktop UI | **python3-pyside6** (+ AppIndicator on GNOME) | all | P2 | ✅ |
 | M9 | Installer | (meta) | none | all | P1 | 🟨 |
-| M12 | Session sharing / remote assist | Sharing | none (Tier 3: tmate/sshx) | all | P3 | 🟨 |
+| M12 | Session sharing (shared terminal) | Sharing | none (relay) | all | P3 | ✅ |
 | M13 | Auto-update | (core) | none (stdlib; user-local file swap) | all | P3 | ✅ |
 | ~~M7~~ | ~~Stress / repro~~ | — | — | — | — | ❌ dropped (D7) |
 
@@ -96,12 +96,13 @@ Status: ⬜ not started · 🟦 designing · 🟨 in progress · ✅ done
   **`.run`** (pure-Python self-extractor, `packaging/make_run.py`, built by CI). *Pending:*
   config/module selection + `systemd --user`
   service enable.
-- **M12 Session sharing / remote assist** (D16) — let a helper inspect a user's machine, in
-  an escalating ladder: (1) **diagnostic bundle export** (inventory + recent log + report,
-  one-way), (2) **live read-only view** over a user-chosen tunnel (Tailscale/cloudflared/SSH,
-  no hosted relay), (3) **gated interactive terminal** wrapping tmate/sshx (read-only by
-  default; read-write only on explicit consent — a deliberate exception to D9). Per-session
-  consent, ephemeral revocable tokens, audit log.
+- **M12 Session sharing / remote assist** (D16, scoped to terminal-only by **D23**) — a single
+  mode: a **host-consented shared terminal** over the relay. The host shares a real PTY running
+  their `$SHELL` (colors/theming preserved — fish etc.); the guest watches live and can type
+  **only if the host allows it** (otherwise read-only) — a deliberate, consent-gated exception
+  to D9. The host reads along and can type too (e.g. a sudo password, which stays local). Either
+  side can pop the terminal **full-screen**. Account-gated by the Gitea token. *The earlier
+  read-only stats view and `share serve` (Tier 1/2) were removed.*
 - **M13 Auto-update** (D18) — *check + auth implemented:* updates are **gated to Gitea account
   holders** via a Personal Access Token, stored **encrypted in the OS keyring** (`secret-tool`)
   with a 0600-file fallback (`config.load_token`/`save_token`/`token_backend`). `core/updates`

docs/ROADMAP.md

@@ -79,14 +79,12 @@ Ubuntu + NVIDIA first; `.deb` distribution (see `DECISIONS.md`).
       NVIDIA persistence, PCIe ASPM, swappiness, THP) via a single pkexec prompt, no reboot.
       GRUB-based fixes + CPU mitigations remain suggestion-only.
 
-## Phase 6 — Session sharing / remote assist  (M12, D16)
-Escalating ladder, built in order:
-- [ ] Tier 1: `share export` — diagnostic bundle (inventory + recent log + report); B opens
-      it in RigDoctor. One-way, safest.
-- [x] Tier 2: live read-only view — `rigdoctor share serve` (stdlib HTTP, token-gated:
-      sensors + health + inventory). Remote = user-chosen tunnel; GUI controls still to add.
-- [x] Tier 3: host-consented interactive terminal — a real PTY shell shared over the relay
-      (own `pty`, pyte-rendered guest), off by default; host reads along + can type (sudo).
+## Phase 6 — Session sharing / remote assist  (M12, D16 → scoped to terminal-only by D23)
+- [x] **Shared terminal** — a real PTY (host's `$SHELL`) shared over the relay, color-rendered
+      (pyte), full-screen-able; the guest watches and may type only on host consent (D9
+      exception); host reads along + can type (sudo). The single share mode.
+- [removed] The read-only stats view (`share serve`) and bundle export — dropped per D23; the
+      shared terminal is the only sharing mode.
 
 > **Out of scope:** stress/repro module (D7); multi-distro support and packaging beyond
 > Ubuntu/apt + `.deb` (D15) — a thin seam is kept but not built out.

docs/SPEC.md

@@ -144,15 +144,13 @@ bundles with descriptions and the exact packages each needs → resolve & instal
 mode. Delivered with the user-local install (and the optional `.deb`) (D8). Module
 list/bundling is final per D14.
 
-### M12 — Session sharing / remote assist (D16)
-Lets a user (A) grant a helper (B) inspection access, as an escalating, consent-driven
-ladder: (1) **diagnostic bundle export** (inventory + recent capture log + report, one-way);
-(2) **live read-only view** of the dashboard + logs over a user-chosen tunnel
-(Tailscale/cloudflared/SSH — no RigDoctor-hosted relay); (3) **gated interactive terminal**
-wrapping an existing tool (tmate/sshx), read-only by default, read-write only on explicit
-consent. Per-session consent, ephemeral revocable tokens, permission escalation (view ≠
-shell), and a session audit log. Tier 3 is a deliberate, consent-gated exception to the
-read-only stance (D9). Built in Phase 6.
+### M12 — Session sharing / remote assist (D16, scoped to terminal-only by D23)
+Lets a user (A) grant a helper (B) a **shared terminal** over the relay: A shares a real PTY
+running their shell; B watches live and may type **only if A allows it** (otherwise read-only)
+— a deliberate, consent-gated exception to the read-only stance (D9). A reads along and can
+type too (e.g. a sudo password, which stays local and is never sent to B). Account-gated by the
+Gitea token; per-session share code. The shared terminal preserves colors/theming and can be
+viewed full-screen. *(The earlier read-only stats view / bundle export were dropped — D23.)*
 
 ## 5. Non-functional requirements
 - **Zero hard deps for the core/CLI/daemon** — Python stdlib + tools already present. **Qt