docs(sharing): the booster needs two sections, and the guide promised it at one level

The write-level row listed "a vaccination dose and the booster reminder it
suggests" three paragraphs under a section table that puts the vaccination
record in Health background. Read together, that tells a self-hoster a
health-background WRITE grant can plan a booster — which the route beside it
now refuses, because the reminder it mints lives under Readings. The row lists
the dose alone, and the exceptions paragraph, which is where a reader looks for
exactly this, carries the two-section case and says the dose logs either way.

With it, the small things the same pass turned up:

The cycle-insights fixture asserted a property it could not show. Its docblock
claims the cycle-native answer survives the fence, and it seeded no symptom at
all, so `symptomPatterns` was empty in every leg and a regression that emptied
it along with the foreign columns would have passed green. One catalogue
symptom on the luteal days, asserted on the owner leg and on the cycle-only
one.

The immunization rows matched on a bare `role="button"`, which passes vacuously
the day the card becomes a real button and fails for the wrong reason if
anything else in the subtree grows one. They carry the same stable marker the
visit card took.

`/api/cycle/calendar` reads the same wrist-temperature channel the crosstab
does and is deliberately not fenced, and it was the only one of the pair with
nothing saying why: no value from it reaches the response.

The encrypted export's new 403 documented the switch refusal and not the
narrow-scope one it answers first, unlike the two settings operations beside
it. Both sheets say at the top that their Save and Delete are gated at the
caller, so a third mount reads the constraint before it violates it. And one
docblock line ran past the wrap.

docs/api/openapi.yaml

@@ -1765,10 +1765,15 @@ paths:
                 format: binary
         "401": *a1
         "403":
-          description: "Refused: the request was made while the session is acting on another account (`meta.errorCode` =
+          description: >-
+            The Bearer token carries a narrow scope. The encrypted archive needs a cookie session or a full-access
+            token; the refusal happens before any second-factor proof is looked at.
+
+
+            Refused: the request was made while the session is acting on another account (`meta.errorCode` =
             `sharing.not_permitted`). This operation resolves the CALLER and never a named record, so under a switch it
             refuses instead of quietly answering with the caller's own — leave the shared record first. No grant at any
-            level opens it."
+            level opens it.
           content:
             application/json:
               schema:

docs/self-hosting/account-sharing.md

@@ -84,11 +84,11 @@ Three levels, fixed when the invitation is written. Raising one means
 revoking and inviting again, because widening a grant in place would carry
 a consent the other person never gave.
 
-| Level  | Adds                                                                                                                                                                                                                                                           |
-| ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Read   | Read what the grant opens, and change nothing.                                                                                                                                                                                                                 |
-| Write  | Add entries: a reading, a lab result, an analyte, an illness entry, a side effect, a medication, marking a dose taken or skipped, a visit, a practice, a vaccination dose and the booster reminder it suggests. Editing, deleting and restoring stay with you. |
-| Manage | Change and remove entries, including ones the owner wrote; record the health background; read the insights generated from the record. Always the entire record.                                                                                                |
+| Level  | Adds                                                                                                                                                                                                                          |
+| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Read   | Read what the grant opens, and change nothing.                                                                                                                                                                                |
+| Write  | Add entries: a reading, a lab result, an analyte, an illness entry, a side effect, a medication, marking a dose taken or skipped, a visit, a practice, and a vaccination dose. Editing, deleting and restoring stay with you. |
+| Manage | Change and remove entries, including ones the owner wrote; record the health background; read the insights generated from the record. Always the entire record.                                                               |
 
 Some entries are creates only **manage** reaches, and the split runs by
 entry rather than by section: an allergy, a family-history entry, a mood
@@ -96,6 +96,13 @@ entry, a screener, a cycle day, a water entry and a preventive-care
 reminder are all created at manage, in sections a write grant can
 otherwise add to. Nothing in the document vault is writable at any level.
 
+One entry needs two sections rather than a higher level. Planning the
+booster a vaccination suggests files it as a preventive-care reminder,
+which lives under Readings, so a grant that opens Health background alone
+logs the dose and is refused the booster. Logging the dose is unaffected
+either way, and the app does not offer the booster to a grant that cannot
+plan it.
+
 Offering **manage** asks the owner for a fresh second factor if they have
 one enrolled, which makes it a browser-only act either way: a Bearer
 caller is refused before anything else happens and told to use a browser.