Ask one of your Macs to lend a folder, a browser window, its screen or its apps and files [write]

The person's own key only (a workspace key answers 403). The ask reaches the Mac app on its next poll; the person answers there — the folder picker (they choose the folder; Cancel refuses) or Allow / Deny for the browser, the screen and host (the Mac app's local chats, call notes, uploads, saves to Downloads and local git; once granted its reads answer at once and each change asks the person again). An agent can ask; only the person grants. The optional workspace query fixes the reach's destination without changing the Mac's registration. The caller must still belong to that workspace; a workspace-scoped key cannot choose another. Caller and membership are checked again before granting and serving the reach. Answers 202 with the request and the capability URL the mount will carry; poll GET /desktop/reach-requests/{id} for the answer. Refused at once with 409: machine_offline (the app is not polling), reach_unsupported (the app is too old, or cannot lend that kind), screen_reach_off, screen_permissions_missing (only the person can grant Screen Recording and Accessibility in System Settings), reach_request_open (one ask per Mac at a time).