diff --git a/README.md b/README.md
index d0743be..79795d9 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # DayFlow
 
-Персональный органайзер знаний: воркспейсы, карточки (заметки, ссылки, чеклисты), инструменты, трекинг обучения и прогресса.
+Персональный органайзер знаний: воркспейсы, карточки (заметки, ссылки, чеклисты), роадмапы, инструменты, совместное редактирование, трекинг обучения и прогресса.
 
 ## Стек
 
@@ -10,40 +10,84 @@
 
 ## Возможности
 
-- **Воркспейсы** — доски для тем/проектов с колонками и беклогом
-- **Карточки** — три типа: заметка, ссылка (с превью), чеклист
-- **Хаб (библиотека)** — все карточки пользователя без привязки к воркспейсу
-- **Инструменты** — ссылки/ресурсы, привязанные к воркспейсу или хабу; поиск по названию и тегам
+### Воркспейсы
+- Доски для тем/проектов с колонками и беклогом
+- Эмодзи-иконка для каждого воркспейса
+- Два режима: **Доска** и **Роадмап** (табы)
+- Цвет колонок (хедер + бордер)
+- Скрытие выполненных карточек (кнопка-глазик, состояние в БД)
+- Пин (закрепление воркспейсов)
+
+### Карточки
+- Три типа: **заметка**, **ссылка**, **чеклист**
+- Теги, статус обучения, порядок (drag & drop между колонками)
+- **Конспект** — markdown-конспект в каждой карточке (все типы), редактор через модалку
+- **AI-промпт** — генерация промпта для ИИ по содержимому карточки
+- Модалка «Все конспекты» — просмотр и экспорт в `.md`
+
+### Роадмап
+- Один роадмап на воркспейс — дерево узлов (до 4 уровней вложенности)
+- Создание из вложенного текста (вставка + парсинг отступов)
+- Добавление / редактирование / удаление / реордер узлов
+- Прогресс-бар (done/total)
+- LLM-промпт для генерации роадмапа и промпт по конкретному узлу
+
+### Совместное редактирование
+- **Приглашения** — владелец генерирует invite-ссылку (`/invite/:token`), другие принимают
+- **Участники** — список членов воркспейса, удаление участника (только владелец)
+- **Блокировка редактирования** — один редактирует, остальные в read-only; heartbeat каждые 15с
+- **Передача лока** — передать права редактирования другому участнику
+- **Индикатор** — замочек + аватар редактирующего в хедере
+- **Smart-синхронизация** — фоновый poll каждые 10с с точечным патчем изменившихся полей (без полного ре-рендера)
+
+### Хаб (библиотека)
+- Все карточки пользователя без привязки к воркспейсу
+- Пагинация, фильтры, сортировка
+
+### Инструменты
+- Ссылки/ресурсы, привязанные к воркспейсу или хабу
+- Иконка, описание, теги
+- Поиск и фильтрация по названию и тегам
+
+### Обучение
+- Три статуса: «повторить», «остались вопросы», «углубить»
+- Вью с группировкой по воркспейсам, сворачиваемые секции
+
+### Прочее
 - **Теги** — фильтрация и навигация по тегам карточек
-- **Обучение** — три статуса: «повторить», «остались вопросы», «углубить»; отдельные вью с группировкой по воркспейсам
-- **Drag & Drop** — перетаскивание карточек между колонками
 - **Поиск** — по заголовкам и тегам (Ctrl+K — быстрое добавление)
-- **Скрытие выполненных** — кнопка-глазик в колонке, состояние хранится в БД
-- **Сворачивание секций** — в обучении и инструментах секции по воркспейсам сворачиваются
+- **Drag & Drop** — перетаскивание карточек между колонками и беклогом
 - **Статистика** — публичная страница `/user/:id` с прогрессом по воркспейсам
-- **7 тем оформления** — Light, Dark, Old Money, Nord, Solarized Dark, Full Moon, Old Money 2
-- **Авторизация** — email + пароль, httpOnly cookie сессия
+- **Профиль** — смена аватара (URL)
+- **7 тем оформления** — Light, Dark (Obsidian), Old Money, Old Money II, Nord, Solarized Dark, Full Moon; переключение light/dark с запоминанием предпочтений
+- **Авторизация** — email + пароль (argon2), httpOnly cookie сессия
+- **Rate limiting** — ограничение запросов по IP/пользователю
 
 ## Структура
 
 ```
 ├── client/          # Vue 3 SPA
 │   ├── src/
-│   │   ├── components/   # card/, common/, workspace/, toolbox/
-│   │   ├── views/        # Home, Auth, Library, Workspace, Profile,
-│   │   │                 # UserStats, Tags, Tools, Learning
-│   │   ├── composables/  # useCardActions, useCardForm, useInlineEdit
-│   │   ├── stores/       # Pinia: auth, workspace, cards, theme
+│   │   ├── components/   # card/, common/, workspace/, toolbox/, roadmap/
+│   │   ├── views/        # Home, Auth, Library, Workspace (Board + Roadmap),
+│   │   │                 # Profile, UserStats, Tags, Tools, Learning, Invite
+│   │   ├── composables/  # useCardActions, useCardForm, useInlineEdit,
+│   │   │                 # useCardGrouping
+│   │   ├── stores/       # Pinia: auth, workspace, roadmap, cards, theme
 │   │   ├── graphql/      # queries, mutations, types
-│   │   └── lib/          # apollo, graphql-error, constants, utils
+│   │   └── lib/          # apollo, graphql-error, constants, utils,
+│   │                     # patch-workspace, card-payload
 │   └── public/
 ├── server/          # GraphQL API
 │   ├── src/
-│   │   ├── resolvers/    # auth, workspace, column, card, tool, user-stats
+│   │   ├── resolvers/    # auth, workspace, column, card, tool,
+│   │   │                 # roadmap, user-stats
 │   │   ├── schema/       # schema.graphql
-│   │   └── lib/          # prisma, auth, context, errors, constants
+│   │   └── lib/          # prisma, auth, context, errors, constants,
+│   │                     # lock-middleware, workspace-access, rate-limiter,
+│   │                     # dataloaders
 │   └── prisma/           # schema.prisma
-└── shared/          # Общие типы и ErrorCodes (dayflow-shared)
+└── shared/          # Общие типы, ErrorCodes, лимиты (dayflow-shared)
 ```
 
 ## Модели данных
@@ -52,10 +96,13 @@
 |--------|----------|
 | **User** | email, пароль (argon2), аватар |
 | **Session** | httpOnly cookie сессии |
-| **Workspace** | доска с колонками, карточками и инструментами; пин |
-| **Column** | колонка воркспейса; порядок, скрытие выполненных |
-| **Card** | заметка / ссылка / чеклист; теги, статус обучения, порядок |
+| **Workspace** | доска с колонками, карточками, инструментами; пин, иконка (эмодзи), invite-токен, editingBy (лок) |
+| **WorkspaceMember** | участник воркспейса (userId, joinedAt) |
+| **Column** | колонка воркспейса; порядок, скрытие выполненных, цвет |
+| **Card** | заметка / ссылка / чеклист; теги, статус обучения, порядок, конспект (в payload) |
 | **Tool** | инструмент (ссылка + описание + иконка + теги) |
+| **Roadmap** | роадмап воркспейса (один на воркспейс); title, sourceText |
+| **RoadmapNode** | узел роадмапа; parent/children, order, done |
 
 ## Обработка ошибок
 
diff --git a/TODO.md b/TODO.md
index 32fe321..4cb49da 100644
--- a/TODO.md
+++ b/TODO.md
@@ -25,7 +25,6 @@
 - загрузка фото из буфера в виде карточки (яндекс диск)
 - AI-саммари — автоматическое резюме по карточке
   - AI-саммари конкретно по ссылке пишет в конспект (карточка типа ссылка) кнопка получить краткую выжимку
-- совместный доступ к воркспейсам
 - Новый вью (пространство как в миро)
 - Отображать превью ссылок (если тип ссылка)
 
diff --git a/client/package-lock.json b/client/package-lock.json
index 86a7c40..abc03ee 100644
--- a/client/package-lock.json
+++ b/client/package-lock.json
@@ -98,6 +98,7 @@
       "resolved": "https://registry.npmjs.org/@apollo/client/-/client-3.14.0.tgz",
       "integrity": "sha512-0YQKKRIxiMlIou+SekQqdCo0ZTHxOcES+K8vKB53cIDpwABNR0P0yRzPgsbgcj3zRJniD93S/ontsnZsCLZrxQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@graphql-typed-document-node/core": "^3.1.1",
         "@wry/caches": "^1.0.0",
@@ -191,6 +192,7 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -4408,6 +4410,7 @@
       "integrity": "sha512-5jsi0wpncvTD33Sh1UCgacK37FFwDn+EG7wCmEvs62fCvBL+n8/76cAYDok21NF6+jaVWIqKwCZyX7Vbu8eB3A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -4480,6 +4483,7 @@
       "integrity": "sha512-BtE0k6cjwjLZoZixN0t5AKP0kSzlGu7FctRXYuPAm//aaiZhmfq1JwdYpYr1brzEspYyFeF+8XF5j2VK6oalrA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.54.0",
         "@typescript-eslint/types": "8.54.0",
@@ -5457,6 +5461,7 @@
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5694,6 +5699,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -6491,6 +6497,7 @@
       "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -7017,6 +7024,7 @@
       "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.12.0.tgz",
       "integrity": "sha512-DKKrynuQRne0PNpEbzuEdHlYOMksHSUI8Zc9Unei5gTsMNA2/vMpoMz/yKba50pejK56qj98qM0SjYxAKi13gQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": "^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0"
       }
@@ -7110,6 +7118,7 @@
       "integrity": "sha512-yoLRW+KRlDmnnROdAu7sX77VNLC0bsFoZyGQJLy1cF+X/SkLg/fWkRGrEEYQK8o2cafJ2wmEaMqMEZB3U3DYDg==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=20"
       },
@@ -7478,6 +7487,7 @@
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -8855,6 +8865,7 @@
       "integrity": "sha512-oQL6lgK3e2QZeQ7gcgIkS2YZPg5slw37hYufJ3edKlfQSGGm8ICoxswK15ntSzF/a8+h7ekRy7k7oWc3BQ7y8A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/estree": "1.0.8"
       },
@@ -9317,6 +9328,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -9435,6 +9447,7 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -9684,6 +9697,7 @@
       "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "^0.21.3",
         "postcss": "^8.4.43",
@@ -9750,6 +9764,7 @@
       "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.27.tgz",
       "integrity": "sha512-aJ/UtoEyFySPBGarREmN4z6qNKpbEguYHMmXSiOGk69czc+zhs0NF6tEFrY8TZKAl8N/LYAkd4JHVd5E/AsSmw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vue/compiler-dom": "3.5.27",
         "@vue/compiler-sfc": "3.5.27",
@@ -9997,6 +10012,7 @@
       "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10.0.0"
       },
diff --git a/client/src/components/card/CardItem.vue b/client/src/components/card/CardItem.vue
index b4d3dd3..459198f 100644
--- a/client/src/components/card/CardItem.vue
+++ b/client/src/components/card/CardItem.vue
@@ -23,8 +23,10 @@ const props = withDefaults(
     isBacklog?: boolean;
     /** Отключить drag-курсор (для Tags view и т.п.) */
     static?: boolean;
+    /** Режим только чтение (чужой лок) */
+    readOnly?: boolean;
   }>(),
-  { isBacklog: false, static: false }
+  { isBacklog: false, static: false, readOnly: false }
 );
 
 const emit = defineEmits<{
@@ -173,6 +175,7 @@ function copyAiPrompt() {
 <template>
   <div class="card-item relative group" :data-card-id="card.id">
     <button
+      v-if="!readOnly"
       type="button"
       class="absolute -top-2 right-[9px] z-10 icon-btn-edit rounded-full bg-surface border border-border shadow-sm card-action transition-colors duration-150 pointer-events-none group-hover:pointer-events-auto"
       title="Редактировать"
@@ -194,13 +197,14 @@ function copyAiPrompt() {
       <div class="flex items-center gap-2 p-3 pb-0">
         <button
           type="button"
-          @click="cardActions.toggleDone()"
+          @click="!readOnly && cardActions.toggleDone()"
           class="w-4 h-4 rounded flex-center border transition-colors shrink-0"
-          :class="
+          :class="[
+            readOnly ? 'pointer-events-none' : '',
             card.done
               ? 'bg-success border-success text-on-primary'
-              : 'border-border hover:border-success'
-          "
+              : 'border-border hover:border-success',
+          ]"
         >
           <span v-if="card.done" class="i-lucide-check text-xs" />
         </button>
@@ -215,9 +219,10 @@ function copyAiPrompt() {
 
         <div
           ref="titleContainerRef"
-          class="flex-1 min-w-0 flex items-center cursor-text overflow-hidden"
+          class="flex-1 min-w-0 flex items-center overflow-hidden"
+          :class="readOnly ? 'cursor-default' : 'cursor-text'"
           :title="card.title || '(без названия)'"
-          @dblclick.prevent="startEditTitle()"
+          @dblclick.prevent="!readOnly && startEditTitle()"
         >
           <template v-if="isEditingTitle">
             <input
@@ -251,6 +256,7 @@ function copyAiPrompt() {
         <CardChecklist
           v-else-if="parsed.type === CARD_TYPES.CHECKLIST"
           :payload="parsed.payload"
+          :disabled="readOnly"
           @toggle-item="cardActions.toggleChecklistItem"
         />
       </template>
@@ -267,6 +273,7 @@ function copyAiPrompt() {
             <p v-else class="text-xs text-muted/50 italic leading-5">Конспект...</p>
           </div>
           <CardActionBtn
+            v-if="!readOnly"
             icon="i-lucide-pencil"
             title="Редактировать конспект"
             @click="showSummaryModal = true"
@@ -289,6 +296,7 @@ function copyAiPrompt() {
         </a>
         <span class="flex-1" />
         <CardActionBtn
+          v-if="!readOnly"
           :icon="promptCopied ? 'i-lucide-check' : 'i-lucide-sparkles'"
           title="Промпт для ИИ: разобраться в теме"
           :active="promptCopied"
diff --git a/client/src/components/card/CardNote.vue b/client/src/components/card/CardNote.vue
index 649d248..2edd1c3 100644
--- a/client/src/components/card/CardNote.vue
+++ b/client/src/components/card/CardNote.vue
@@ -2,8 +2,8 @@
 import { ref, computed } from 'vue';
 import type { NotePayload } from '@/lib/card-payload';
 import { linkify } from '@/lib/utils';
-import { toast } from 'vue-sonner';
 import CardActionBtn from './CardActionBtn.vue';
+import CopyButton from '@/components/common/CopyButton.vue';
 import {
   DialogRoot,
   DialogPortal,
@@ -18,18 +18,9 @@ const props = defineProps<{
 }>();
 
 const showContentModal = ref(false);
-const copied = ref(false);
 
 const contentHtml = computed(() => linkify(props.payload.content ?? ''));
 const hasLongContent = computed(() => (props.payload.content?.length ?? 0) > 100);
-
-function copyContent() {
-  navigator.clipboard.writeText(props.payload.content ?? '').then(() => {
-    copied.value = true;
-    toast.success('Текст скопирован');
-    setTimeout(() => (copied.value = false), 2000);
-  });
-}
 </script>
 
 <template>
@@ -60,16 +51,11 @@ function copyContent() {
           <div class="dialog-header">
             <DialogTitle class="dialog-title">Текст заметки</DialogTitle>
             <div class="flex items-center gap-1">
-              <button
-                type="button"
-                class="icon-btn-ghost transition-colors"
-                :class="copied && 'text-success!'"
+              <CopyButton
+                :text="payload.content ?? ''"
+                success-message="Текст скопирован"
                 title="Скопировать текст"
-                @click="copyContent"
-              >
-                <span v-if="copied" class="i-lucide-check" />
-                <span v-else class="i-lucide-copy" />
-              </button>
+              />
               <DialogClose class="icon-btn-close">
                 <span class="i-lucide-x" />
               </DialogClose>
diff --git a/client/src/components/common/CopyButton.vue b/client/src/components/common/CopyButton.vue
new file mode 100644
index 0000000..ac86af8
--- /dev/null
+++ b/client/src/components/common/CopyButton.vue
@@ -0,0 +1,46 @@
+<script setup lang="ts">
+import { ref } from 'vue';
+import { toast } from 'vue-sonner';
+
+const props = withDefaults(
+  defineProps<{
+    /** Text to copy to clipboard */
+    text: string;
+    /** Toast message on success */
+    successMessage?: string;
+    /** Button title attribute */
+    title?: string;
+  }>(),
+  {
+    successMessage: 'Скопировано',
+    title: 'Копировать',
+  },
+);
+
+const copied = ref(false);
+
+function copy() {
+  navigator.clipboard.writeText(props.text).then(
+    () => {
+      copied.value = true;
+      toast.success(props.successMessage);
+      setTimeout(() => (copied.value = false), 2000);
+    },
+    () => toast.error('Не удалось скопировать'),
+  );
+}
+
+defineExpose({ copied });
+</script>
+
+<template>
+  <button
+    type="button"
+    class="icon-btn-ghost transition-colors"
+    :class="copied && 'text-success!'"
+    :title="title"
+    @click.stop="copy"
+  >
+    <span :class="copied ? 'i-lucide-check' : 'i-lucide-copy'" />
+  </button>
+</template>
diff --git a/client/src/components/roadmap/RoadmapNodeItem.vue b/client/src/components/roadmap/RoadmapNodeItem.vue
index 98c1dac..a9f917c 100644
--- a/client/src/components/roadmap/RoadmapNodeItem.vue
+++ b/client/src/components/roadmap/RoadmapNodeItem.vue
@@ -5,6 +5,7 @@ import type { RoadmapNode } from '@/graphql/types';
 const props = defineProps<{
   node: RoadmapNode;
   depth?: number;
+  readOnly?: boolean;
 }>();
 
 const emit = defineEmits<{
@@ -50,6 +51,7 @@ const hasChildren = computed(() => sortedChildren.value.length > 0);
         type="checkbox"
         :checked="node.done"
         class="checkbox shrink-0"
+        :disabled="readOnly"
         @click.stop
         @change="emit('toggle-done', node)"
       />
@@ -58,13 +60,13 @@ const hasChildren = computed(() => sortedChildren.value.length > 0);
       <span
         class="flex-1 text-sm select-none"
         :class="node.done ? 'line-through text-muted' : 'text-fg'"
-        @dblclick="emit('edit-node', node)"
+        @dblclick="!readOnly && emit('edit-node', node)"
       >
         {{ node.title }}
       </span>
 
       <!-- Actions (hover) -->
-      <div class="flex gap-0.5 opacity-0 group-hover:opacity-100 transition-opacity shrink-0" @click.stop>
+      <div v-if="!readOnly" class="flex gap-0.5 opacity-0 group-hover:opacity-100 transition-opacity shrink-0" @click.stop>
         <button class="icon-btn-ghost !p-1" title="Промпт для AI" @click="emit('copy-ai-prompt', node)">
           <span class="i-lucide-sparkles text-xs" />
         </button>
@@ -91,6 +93,7 @@ const hasChildren = computed(() => sortedChildren.value.length > 0);
         :key="child.id"
         :node="child"
         :depth="depth + 1"
+        :read-only="readOnly"
         @toggle-done="emit('toggle-done', $event)"
         @edit-node="emit('edit-node', $event)"
         @add-child="emit('add-child', $event)"
diff --git a/client/src/components/workspace/WorkspaceCard.vue b/client/src/components/workspace/WorkspaceCard.vue
new file mode 100644
index 0000000..e025ede
--- /dev/null
+++ b/client/src/components/workspace/WorkspaceCard.vue
@@ -0,0 +1,80 @@
+<script setup lang="ts">
+import type { Workspace } from '@/graphql/types';
+
+defineProps<{
+  workspace: Workspace;
+  shared?: boolean;
+}>();
+
+defineEmits<{
+  click: [];
+  togglePinned: [e: Event];
+}>();
+
+const STAR_PATH =
+  'M12 2l3.09 6.26L22 9.27l-5 4.87 1.18 6.88L12 17.77l-6.18 3.25L7 14.14 2 9.27l6.91-1.01L12 2z';
+</script>
+
+<template>
+  <div
+    class="card-hover text-left p-5 group relative cursor-pointer border-l-3"
+    :class="shared ? 'border-primary/30' : 'border-transparent'"
+    @click="$emit('click')"
+  >
+    <!-- Pin / Unpin button -->
+    <button
+      v-if="workspace.pinned"
+      type="button"
+      class="absolute top-3 right-3 icon-btn-ghost text-yellow-500 group/star"
+      title="Открепить"
+      @click="$emit('togglePinned', $event)"
+    >
+      <svg
+        class="w-[18px] h-[18px] group-hover/star:opacity-0 absolute"
+        viewBox="0 0 24 24"
+        fill="currentColor"
+      >
+        <path :d="STAR_PATH" />
+      </svg>
+      <span class="i-lucide-star-off opacity-0 group-hover/star:opacity-100" />
+    </button>
+    <button
+      v-else
+      type="button"
+      class="absolute top-3 right-3 icon-btn-ghost opacity-0 group-hover:opacity-100 transition-opacity text-muted hover:text-yellow-500"
+      title="Закрепить"
+      @click="$emit('togglePinned', $event)"
+    >
+      <svg class="w-[18px] h-[18px]" viewBox="0 0 24 24" fill="currentColor">
+        <path :d="STAR_PATH" />
+      </svg>
+    </button>
+
+    <!-- Icon -->
+    <div
+      class="w-10 h-10 rounded-xl flex-center mb-3 text-2xl transition-colors bg-fg/5 group-hover:bg-fg/8"
+    >
+      <span v-if="workspace.icon">{{ workspace.icon }}</span>
+      <span v-else class="i-lucide-layout-grid text-lg text-muted" />
+    </div>
+
+    <!-- Title -->
+    <h3 :title="workspace.title" class="font-semibold text-fg mb-1.5 truncate text-base">
+      {{ workspace.title }}
+    </h3>
+
+    <!-- Description -->
+    <p v-if="workspace.description" class="text-sm text-muted line-clamp-2 mb-3">
+      {{ workspace.description }}
+    </p>
+
+    <!-- Footer: owner email for shared, date for own -->
+    <div v-if="shared" class="flex items-center gap-2 text-xs text-muted">
+      <span class="i-lucide-user text-[10px]" />
+      <span>{{ workspace.owner?.email }}</span>
+    </div>
+    <p v-else class="text-xs text-muted">
+      {{ new Date(workspace.updatedAt).toLocaleDateString('ru-RU') }}
+    </p>
+  </div>
+</template>
diff --git a/client/src/components/workspace/WorkspaceColumn.vue b/client/src/components/workspace/WorkspaceColumn.vue
index 15d0005..6383307 100644
--- a/client/src/components/workspace/WorkspaceColumn.vue
+++ b/client/src/components/workspace/WorkspaceColumn.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref, computed, onMounted, onUnmounted } from 'vue';
+import { ref, computed, onMounted, onUnmounted, watch } from 'vue';
 import Sortable from 'sortablejs';
 import { useWorkspaceStore } from '@/stores/workspace';
 import type { Column, CardGql } from '@/graphql/types';
@@ -31,15 +31,36 @@ const props = withDefaults(
     isFirst?: boolean;
     /** Это последняя колонка */
     isLast?: boolean;
+    /** Режим только чтение */
+    readOnly?: boolean;
   }>(),
-  { backlogCards: () => [], isBacklogColumn: false, searchQuery: '', isFirst: false, isLast: false }
+  {
+    backlogCards: () => [],
+    isBacklogColumn: false,
+    searchQuery: '',
+    isFirst: false,
+    isLast: false,
+    readOnly: false,
+  }
 );
 
 const COLUMN_COLORS = [
-  '#ef4444', '#f97316', '#f59e0b', '#eab308',
-  '#84cc16', '#22c55e', '#14b8a6', '#06b6d4',
-  '#3b82f6', '#6366f1', '#8b5cf6', '#a855f7',
-  '#d946ef', '#ec4899', '#f43f5e', '#78716c',
+  '#ef4444',
+  '#f97316',
+  '#f59e0b',
+  '#eab308',
+  '#84cc16',
+  '#22c55e',
+  '#14b8a6',
+  '#06b6d4',
+  '#3b82f6',
+  '#6366f1',
+  '#8b5cf6',
+  '#a855f7',
+  '#d946ef',
+  '#ec4899',
+  '#f43f5e',
+  '#78716c',
 ];
 
 const workspaceStore = useWorkspaceStore();
@@ -149,10 +170,18 @@ onMounted(() => {
     animation: 150,
     ghostClass: 'opacity-50',
     filter: '.sortable-no-drag',
+    disabled: props.readOnly,
     onEnd: handleDragEnd,
   });
 });
 
+watch(
+  () => props.readOnly,
+  (ro) => {
+    if (sortable) sortable.option('disabled', ro);
+  }
+);
+
 onUnmounted(() => {
   sortable?.destroy();
   sortable = null;
@@ -218,12 +247,17 @@ async function moveRight() {
 <template>
   <div
     class="flex-shrink-0 w-72 flex flex-col rounded-xl"
-    :style="column.color
-      ? { background: `color-mix(in srgb, ${column.color} 6%, rgb(var(--bg)))`, borderTop: `2px solid color-mix(in srgb, ${column.color} 40%, transparent)` }
-      : { background: 'rgb(var(--fg) / 0.05)', borderTop: '2px solid transparent' }"
+    :style="
+      column.color
+        ? {
+            background: `color-mix(in srgb, ${column.color} 6%, rgb(var(--bg)))`,
+            borderTop: `2px solid color-mix(in srgb, ${column.color} 40%, transparent)`,
+          }
+        : { background: 'rgb(var(--fg) / 0.05)', borderTop: '2px solid transparent' }
+    "
   >
     <div ref="headerRef" class="group h-12 px-3 flex-between">
-      <div v-if="!isBacklog && isEditing" class="flex-1 mr-2 min-w-0">
+      <div v-if="!isBacklog && !readOnly && isEditing" class="flex-1 mr-2 min-w-0">
         <input
           ref="inputRef"
           v-model="editTitle"
@@ -236,21 +270,31 @@ async function moveRight() {
       <h3
         v-else
         class="flex items-baseline min-w-0 leading-none flex-1"
-        :class="{ 'cursor-text': !isBacklog }"
+        :class="{ 'cursor-text': !isBacklog && !readOnly }"
       >
         <span
           class="font-medium text-fg truncate"
           :title="column.title"
-          @dblclick="!isBacklog && startEdit()"
-        >{{ column.title || '!?' }}</span>
-        <span class="text-xs text-muted font-normal ml-1 tabular-nums shrink-0">{{ isBacklog ? filteredBacklogCards.length : filteredCards.length }}<template v-if="hideCompleted || searchQuery">/{{ isBacklog ? (backlogCards ?? []).length : cards.length }}</template></span>
+          @dblclick="!isBacklog && !readOnly && startEdit()"
+          >{{ column.title || '!?' }}</span
+        >
+        <span class="text-xs text-muted font-normal ml-1 tabular-nums shrink-0"
+          >{{ isBacklog ? filteredBacklogCards.length : filteredCards.length
+          }}<template v-if="hideCompleted || searchQuery"
+            >/{{ isBacklog ? (backlogCards ?? []).length : cards.length }}</template
+          ></span
+        >
       </h3>
 
-      <div class="flex items-center gap-0.5 shrink-0 leading-none">
+      <div v-if="!readOnly" class="flex items-center gap-0.5 shrink-0 leading-none">
         <button
           v-if="completedCount > 0"
           type="button"
-          @click="isBacklog ? (backlogHideCompleted = !backlogHideCompleted) : workspaceStore.toggleHideCompleted(column.id)"
+          @click="
+            isBacklog
+              ? (backlogHideCompleted = !backlogHideCompleted)
+              : workspaceStore.toggleHideCompleted(column.id)
+          "
           class="icon-btn-ghost"
           :class="{ 'text-primary': hideCompleted }"
           :title="hideCompleted ? `Показать выполненные (${completedCount})` : 'Скрыть выполненные'"
@@ -288,14 +332,31 @@ async function moveRight() {
       </div>
     </div>
 
+    <div v-if="!readOnly" class="px-2 pb-2 shrink-0">
+      <button
+        type="button"
+        @click="showAddCard = true"
+        class="w-full h-10 border border-dashed border-border rounded-[var(--r)] text-sm text-muted hover:text-fg hover:border-fg/30 flex-center gap-1.5 leading-none transition-colors"
+      >
+        <span class="i-lucide-plus" />
+        <span>Добавить карточку</span>
+      </button>
+    </div>
+
     <div
       ref="cardsListRef"
-      class="flex-1 overflow-y-auto px-2 py-2 flex flex-col gap-2 min-h-[2rem]"
+      class="flex-1 overflow-y-auto scrollbar-hide px-2 py-2 flex flex-col gap-2 min-h-[2rem]"
       :data-column-id="isBacklog ? undefined : column.id"
       :data-backlog="isBacklog ? true : undefined"
     >
       <template v-if="isBacklog">
-        <CardItem v-for="c in filteredBacklogCards" :key="c.id" :card="c" :is-backlog="true" />
+        <CardItem
+          v-for="c in filteredBacklogCards"
+          :key="c.id"
+          :card="c"
+          :is-backlog="true"
+          :read-only="readOnly"
+        />
       </template>
       <template v-else>
         <CardItem
@@ -303,21 +364,11 @@ async function moveRight() {
           :key="card.id"
           :card="card"
           :column-id="column.id"
+          :read-only="readOnly"
         />
       </template>
     </div>
 
-    <div class="px-2 pb-2 shrink-0">
-      <button
-        type="button"
-        @click="showAddCard = true"
-        class="w-full h-10 border border-dashed border-border rounded-[var(--r)] text-sm text-muted hover:text-fg hover:border-fg/30 flex-center gap-1.5 leading-none transition-colors"
-      >
-        <span class="i-lucide-plus" />
-        <span>Добавить карточку</span>
-      </button>
-    </div>
-
     <CreateCardDialog
       :open="showAddCard"
       :column-id="isBacklog ? undefined : column.id"
@@ -330,7 +381,11 @@ async function moveRight() {
     <DialogRoot v-model:open="showEditModal">
       <DialogPortal>
         <DialogOverlay class="dialog-overlay" @click="showEditModal = false" />
-        <DialogContent :aria-describedby="undefined" class="dialog-content" @escape-key-down="showEditModal = false">
+        <DialogContent
+          :aria-describedby="undefined"
+          class="dialog-content"
+          @escape-key-down="showEditModal = false"
+        >
           <div class="dialog-header">
             <DialogTitle class="dialog-title">Настройки колонки</DialogTitle>
             <DialogClose class="icon-btn-close">
@@ -346,7 +401,11 @@ async function moveRight() {
                 <button
                   type="button"
                   class="w-7 h-7 rounded-full border-2 flex-center transition-all"
-                  :class="editColor === null ? 'border-primary scale-110' : 'border-border hover:border-fg/30'"
+                  :class="
+                    editColor === null
+                      ? 'border-primary scale-110'
+                      : 'border-border hover:border-fg/30'
+                  "
                   title="Без цвета"
                   @click="selectColor(null)"
                 >
@@ -357,7 +416,11 @@ async function moveRight() {
                   :key="c"
                   type="button"
                   class="w-7 h-7 rounded-full border-2 transition-all"
-                  :class="editColor === c ? 'border-primary scale-110' : 'border-transparent hover:scale-110'"
+                  :class="
+                    editColor === c
+                      ? 'border-primary scale-110'
+                      : 'border-transparent hover:scale-110'
+                  "
                   :style="{ background: c }"
                   @click="selectColor(c)"
                 />
diff --git a/client/src/generated/graphql.ts b/client/src/generated/graphql.ts
index bc3e8b4..75f5a8e 100644
--- a/client/src/generated/graphql.ts
+++ b/client/src/generated/graphql.ts
@@ -99,6 +99,10 @@ export type LearningStatus =
 
 export type Mutation = {
   __typename?: 'Mutation';
+  /** Принять приглашение по токену. Возвращает воркспейс. */
+  acceptInvite: Workspace;
+  /** Захватить лок на редактирование воркспейса. */
+  acquireWorkspaceLock: Workspace;
   createCard: Card;
   createColumn: Column;
   createRoadmap: Roadmap;
@@ -111,13 +115,23 @@ export type Mutation = {
   deleteRoadmapNode: Scalars['Boolean']['output'];
   deleteTool: Scalars['Boolean']['output'];
   deleteWorkspace: Scalars['Boolean']['output'];
+  /** Сгенерировать (или перегенерировать) пригласительную ссылку. */
+  generateInviteToken: Workspace;
+  /** Heartbeat — продлить лок (вызывать каждые ~15с). */
+  heartbeatWorkspaceLock: Workspace;
   moveCard: Card;
+  /** Отпустить лок. */
+  releaseWorkspaceLock: Workspace;
+  /** Удалить участника из воркспейса (только владелец). */
+  removeWorkspaceMember: Scalars['Boolean']['output'];
   reorderColumns: Array<Column>;
   reorderRoadmapNodes: Array<RoadmapNode>;
   signIn: AuthPayload;
   signOut: Scalars['Boolean']['output'];
   signUp: AuthPayload;
   toggleWorkspacePinned: Workspace;
+  /** Передать права редактирования другому участнику. */
+  transferWorkspaceLock: Workspace;
   updateCard: Card;
   updateColumn: Column;
   updateProfile: User;
@@ -127,6 +141,16 @@ export type Mutation = {
 };
 
 
+export type MutationAcceptInviteArgs = {
+  token: Scalars['String']['input'];
+};
+
+
+export type MutationAcquireWorkspaceLockArgs = {
+  workspaceId: Scalars['ID']['input'];
+};
+
+
 export type MutationCreateCardArgs = {
   input: CreateCardInput;
 };
@@ -192,6 +216,16 @@ export type MutationDeleteWorkspaceArgs = {
 };
 
 
+export type MutationGenerateInviteTokenArgs = {
+  workspaceId: Scalars['ID']['input'];
+};
+
+
+export type MutationHeartbeatWorkspaceLockArgs = {
+  workspaceId: Scalars['ID']['input'];
+};
+
+
 export type MutationMoveCardArgs = {
   columnId?: InputMaybe<Scalars['ID']['input']>;
   id: Scalars['ID']['input'];
@@ -199,6 +233,17 @@ export type MutationMoveCardArgs = {
 };
 
 
+export type MutationReleaseWorkspaceLockArgs = {
+  workspaceId: Scalars['ID']['input'];
+};
+
+
+export type MutationRemoveWorkspaceMemberArgs = {
+  userId: Scalars['ID']['input'];
+  workspaceId: Scalars['ID']['input'];
+};
+
+
 export type MutationReorderColumnsArgs = {
   columnIds: Array<Scalars['ID']['input']>;
   workspaceId: Scalars['ID']['input'];
@@ -229,6 +274,12 @@ export type MutationToggleWorkspacePinnedArgs = {
 };
 
 
+export type MutationTransferWorkspaceLockArgs = {
+  toUserId: Scalars['ID']['input'];
+  workspaceId: Scalars['ID']['input'];
+};
+
+
 export type MutationUpdateCardArgs = {
   id: Scalars['ID']['input'];
   input: UpdateCardInput;
@@ -417,8 +468,16 @@ export type Workspace = {
   columns: Array<Column>;
   createdAt: Scalars['DateTime']['output'];
   description?: Maybe<Scalars['String']['output']>;
+  /** Кто сейчас редактирует воркспейс (userId). */
+  editingBy?: Maybe<Scalars['ID']['output']>;
+  /** Email/имя того, кто редактирует (resolved). */
+  editingUser?: Maybe<User>;
   icon?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
+  /** Токен пригласительной ссылки (виден только владельцу). */
+  inviteToken?: Maybe<Scalars['String']['output']>;
+  /** Участники воркспейса (кроме владельца). */
+  members: Array<WorkspaceMember>;
   owner: User;
   pinned: Scalars['Boolean']['output'];
   /** Роадмап воркспейса (один на воркспейс). */
@@ -429,6 +488,14 @@ export type Workspace = {
   updatedAt: Scalars['DateTime']['output'];
 };
 
+export type WorkspaceMember = {
+  __typename?: 'WorkspaceMember';
+  id: Scalars['ID']['output'];
+  joinedAt: Scalars['DateTime']['output'];
+  user: User;
+  userId: Scalars['ID']['output'];
+};
+
 /** Воркспейс с агрегатами: выполнено / всего карточек. */
 export type WorkspaceStatsItem = {
   __typename?: 'WorkspaceStatsItem';
@@ -473,7 +540,7 @@ export type CreateWorkspaceMutationVariables = Exact<{
 }>;
 
 
-export type CreateWorkspaceMutation = { __typename?: 'Mutation', createWorkspace: { __typename?: 'Workspace', id: string, title: string, description?: string | null, icon?: string | null, pinned: boolean, createdAt: any, updatedAt: any } };
+export type CreateWorkspaceMutation = { __typename?: 'Mutation', createWorkspace: { __typename?: 'Workspace', id: string, title: string, description?: string | null, icon?: string | null, pinned: boolean, createdAt: any, updatedAt: any, owner: { __typename?: 'User', id: string, email: string } } };
 
 export type UpdateWorkspaceMutationVariables = Exact<{
   id: Scalars['ID']['input'];
@@ -633,6 +700,57 @@ export type ReorderRoadmapNodesMutationVariables = Exact<{
 
 export type ReorderRoadmapNodesMutation = { __typename?: 'Mutation', reorderRoadmapNodes: Array<{ __typename?: 'RoadmapNode', id: string, order: number }> };
 
+export type GenerateInviteTokenMutationVariables = Exact<{
+  workspaceId: Scalars['ID']['input'];
+}>;
+
+
+export type GenerateInviteTokenMutation = { __typename?: 'Mutation', generateInviteToken: { __typename?: 'Workspace', id: string, inviteToken?: string | null } };
+
+export type AcceptInviteMutationVariables = Exact<{
+  token: Scalars['String']['input'];
+}>;
+
+
+export type AcceptInviteMutation = { __typename?: 'Mutation', acceptInvite: { __typename?: 'Workspace', id: string, title: string, icon?: string | null } };
+
+export type RemoveWorkspaceMemberMutationVariables = Exact<{
+  workspaceId: Scalars['ID']['input'];
+  userId: Scalars['ID']['input'];
+}>;
+
+
+export type RemoveWorkspaceMemberMutation = { __typename?: 'Mutation', removeWorkspaceMember: boolean };
+
+export type AcquireWorkspaceLockMutationVariables = Exact<{
+  workspaceId: Scalars['ID']['input'];
+}>;
+
+
+export type AcquireWorkspaceLockMutation = { __typename?: 'Mutation', acquireWorkspaceLock: { __typename?: 'Workspace', id: string, editingBy?: string | null, editingUser?: { __typename?: 'User', id: string, email: string, avatarUrl?: string | null } | null } };
+
+export type ReleaseWorkspaceLockMutationVariables = Exact<{
+  workspaceId: Scalars['ID']['input'];
+}>;
+
+
+export type ReleaseWorkspaceLockMutation = { __typename?: 'Mutation', releaseWorkspaceLock: { __typename?: 'Workspace', id: string, editingBy?: string | null } };
+
+export type HeartbeatWorkspaceLockMutationVariables = Exact<{
+  workspaceId: Scalars['ID']['input'];
+}>;
+
+
+export type HeartbeatWorkspaceLockMutation = { __typename?: 'Mutation', heartbeatWorkspaceLock: { __typename?: 'Workspace', id: string, editingBy?: string | null } };
+
+export type TransferWorkspaceLockMutationVariables = Exact<{
+  workspaceId: Scalars['ID']['input'];
+  toUserId: Scalars['ID']['input'];
+}>;
+
+
+export type TransferWorkspaceLockMutation = { __typename?: 'Mutation', transferWorkspaceLock: { __typename?: 'Workspace', id: string, editingBy?: string | null, editingUser?: { __typename?: 'User', id: string, email: string, avatarUrl?: string | null } | null } };
+
 export type MeQueryVariables = Exact<{ [key: string]: never; }>;
 
 
@@ -641,14 +759,14 @@ export type MeQuery = { __typename?: 'Query', me?: { __typename?: 'User', id: st
 export type MyWorkspacesQueryVariables = Exact<{ [key: string]: never; }>;
 
 
-export type MyWorkspacesQuery = { __typename?: 'Query', myWorkspaces: Array<{ __typename?: 'Workspace', id: string, title: string, description?: string | null, icon?: string | null, pinned: boolean, createdAt: any, updatedAt: any }> };
+export type MyWorkspacesQuery = { __typename?: 'Query', myWorkspaces: Array<{ __typename?: 'Workspace', id: string, title: string, description?: string | null, icon?: string | null, pinned: boolean, createdAt: any, updatedAt: any, owner: { __typename?: 'User', id: string, email: string } }> };
 
 export type WorkspaceQueryVariables = Exact<{
   id: Scalars['ID']['input'];
 }>;
 
 
-export type WorkspaceQuery = { __typename?: 'Query', workspace?: { __typename?: 'Workspace', id: string, title: string, description?: string | null, icon?: string | null, createdAt: any, updatedAt: any, tools: Array<{ __typename?: 'Tool', id: string, createdAt: any, updatedAt: any, ownerId: string, workspaceId?: string | null, title: string, link?: string | null, description?: string | null, icon?: string | null, tags: Array<string> }>, columns: Array<{ __typename?: 'Column', id: string, title: string, order: number, hideCompleted: boolean, color?: string | null, cards: Array<{ __typename?: 'Card', id: string, createdAt: any, updatedAt: any, ownerId: string, workspaceId?: string | null, columnId?: string | null, order?: number | null, type: CardType, title?: string | null, done: boolean, payload: string, tags: Array<string>, learningStatus?: LearningStatus | null }> }>, backlog: Array<{ __typename?: 'Card', id: string, createdAt: any, updatedAt: any, ownerId: string, workspaceId?: string | null, columnId?: string | null, order?: number | null, type: CardType, title?: string | null, done: boolean, payload: string, tags: Array<string>, learningStatus?: LearningStatus | null }> } | null };
+export type WorkspaceQuery = { __typename?: 'Query', workspace?: { __typename?: 'Workspace', id: string, title: string, description?: string | null, icon?: string | null, inviteToken?: string | null, editingBy?: string | null, createdAt: any, updatedAt: any, editingUser?: { __typename?: 'User', id: string, email: string, avatarUrl?: string | null } | null, owner: { __typename?: 'User', id: string, email: string, avatarUrl?: string | null }, members: Array<{ __typename?: 'WorkspaceMember', id: string, userId: string, joinedAt: any, user: { __typename?: 'User', id: string, email: string, avatarUrl?: string | null } }>, tools: Array<{ __typename?: 'Tool', id: string, createdAt: any, updatedAt: any, ownerId: string, workspaceId?: string | null, title: string, link?: string | null, description?: string | null, icon?: string | null, tags: Array<string> }>, columns: Array<{ __typename?: 'Column', id: string, title: string, order: number, hideCompleted: boolean, color?: string | null, cards: Array<{ __typename?: 'Card', id: string, createdAt: any, updatedAt: any, ownerId: string, workspaceId?: string | null, columnId?: string | null, order?: number | null, type: CardType, title?: string | null, done: boolean, payload: string, tags: Array<string>, learningStatus?: LearningStatus | null }> }>, backlog: Array<{ __typename?: 'Card', id: string, createdAt: any, updatedAt: any, ownerId: string, workspaceId?: string | null, columnId?: string | null, order?: number | null, type: CardType, title?: string | null, done: boolean, payload: string, tags: Array<string>, learningStatus?: LearningStatus | null }> } | null };
 
 export type CardsQueryVariables = Exact<{
   filter?: InputMaybe<CardFilter>;
diff --git a/client/src/graphql/mutations.ts b/client/src/graphql/mutations.ts
index 786b83b..fdd0dd7 100644
--- a/client/src/graphql/mutations.ts
+++ b/client/src/graphql/mutations.ts
@@ -55,6 +55,10 @@ export const CREATE_WORKSPACE_MUTATION = gql`
       pinned
       createdAt
       updatedAt
+      owner {
+        id
+        email
+      }
     }
   }
 `;
@@ -265,3 +269,70 @@ export const REORDER_ROADMAP_NODES_MUTATION = gql`
     }
   }
 `;
+
+// Workspace sharing
+
+export const GENERATE_INVITE_TOKEN_MUTATION = gql`
+  mutation GenerateInviteToken($workspaceId: ID!) {
+    generateInviteToken(workspaceId: $workspaceId) {
+      id
+      inviteToken
+    }
+  }
+`;
+
+export const ACCEPT_INVITE_MUTATION = gql`
+  mutation AcceptInvite($token: String!) {
+    acceptInvite(token: $token) {
+      id
+      title
+      icon
+    }
+  }
+`;
+
+export const REMOVE_WORKSPACE_MEMBER_MUTATION = gql`
+  mutation RemoveWorkspaceMember($workspaceId: ID!, $userId: ID!) {
+    removeWorkspaceMember(workspaceId: $workspaceId, userId: $userId)
+  }
+`;
+
+// Workspace editing lock
+
+export const ACQUIRE_WORKSPACE_LOCK_MUTATION = gql`
+  mutation AcquireWorkspaceLock($workspaceId: ID!) {
+    acquireWorkspaceLock(workspaceId: $workspaceId) {
+      id
+      editingBy
+      editingUser { id email avatarUrl }
+    }
+  }
+`;
+
+export const RELEASE_WORKSPACE_LOCK_MUTATION = gql`
+  mutation ReleaseWorkspaceLock($workspaceId: ID!) {
+    releaseWorkspaceLock(workspaceId: $workspaceId) {
+      id
+      editingBy
+    }
+  }
+`;
+
+export const HEARTBEAT_WORKSPACE_LOCK_MUTATION = gql`
+  mutation HeartbeatWorkspaceLock($workspaceId: ID!) {
+    heartbeatWorkspaceLock(workspaceId: $workspaceId) {
+      id
+      editingBy
+    }
+  }
+`;
+
+export const TRANSFER_WORKSPACE_LOCK_MUTATION = gql`
+  mutation TransferWorkspaceLock($workspaceId: ID!, $toUserId: ID!) {
+    transferWorkspaceLock(workspaceId: $workspaceId, toUserId: $toUserId) {
+      id
+      editingBy
+      editingUser { id email avatarUrl }
+    }
+  }
+`;
diff --git a/client/src/graphql/queries.ts b/client/src/graphql/queries.ts
index d38fee6..f9ceeef 100644
--- a/client/src/graphql/queries.ts
+++ b/client/src/graphql/queries.ts
@@ -21,6 +21,10 @@ export const MY_WORKSPACES_QUERY = gql`
       pinned
       createdAt
       updatedAt
+      owner {
+        id
+        email
+      }
     }
   }
 `;
@@ -32,8 +36,30 @@ export const WORKSPACE_QUERY = gql`
       title
       description
       icon
+      inviteToken
+      editingBy
+      editingUser {
+        id
+        email
+        avatarUrl
+      }
       createdAt
       updatedAt
+      owner {
+        id
+        email
+        avatarUrl
+      }
+      members {
+        id
+        userId
+        joinedAt
+        user {
+          id
+          email
+          avatarUrl
+        }
+      }
       tools {
         id
         createdAt
diff --git a/client/src/graphql/types.ts b/client/src/graphql/types.ts
index ae2aae5..16afb54 100644
--- a/client/src/graphql/types.ts
+++ b/client/src/graphql/types.ts
@@ -8,6 +8,7 @@ export type {
   LearningStatus,
   User,
   Workspace,
+  WorkspaceMember,
   Column,
   Tool,
   Roadmap,
diff --git a/client/src/lib/patch-workspace.ts b/client/src/lib/patch-workspace.ts
new file mode 100644
index 0000000..437a1df
--- /dev/null
+++ b/client/src/lib/patch-workspace.ts
@@ -0,0 +1,189 @@
+/**
+ * Smart workspace patching utility.
+ *
+ * Instead of replacing `currentWorkspace` wholesale (which causes every
+ * component to re-render), this utility diffs the incoming server snapshot
+ * against the current local state and mutates only the properties that
+ * actually changed. Vue's reactivity then fires only for touched paths.
+ */
+
+import type { Workspace, Column, Tool, CardGql } from '@/graphql/types';
+
+// ─── helpers ────────────────────────────────────────────────────────────────
+
+/** Deep-clone a value. Used to avoid assigning frozen Apollo objects into mutable state. */
+const clone = <T>(v: T): T => structuredClone(v);
+
+/** Shallow-compare two values (handles primitives, null, arrays of primitives). */
+function same(a: unknown, b: unknown): boolean {
+  if (a === b) return true;
+  if (a == null || b == null) return a === b;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    return a.every((v, i) => v === b[i]);
+  }
+  return false;
+}
+
+/** Patch scalar fields from `remote` onto `local` in-place. */
+function patchScalars(local: any, remote: any, fields: readonly string[]): void {
+  for (const key of fields) {
+    if (!same(local[key], remote[key])) {
+      local[key] = remote[key];
+    }
+  }
+}
+
+/**
+ * Sort `local` array in-place to match `remote` id order.
+ * Only sorts when the ids are the same set but in different order.
+ */
+function alignOrder<T extends { id: string }>(local: T[], remote: T[]): void {
+  if (local.length !== remote.length) return;
+  const remoteIds = remote.map((r) => r.id);
+  const needsSort = local.some((item, i) => item.id !== remoteIds[i]);
+  if (!needsSort) return;
+  const idxMap = new Map(remoteIds.map((id, i) => [id, i]));
+  local.sort((a, b) => (idxMap.get(a.id) ?? 0) - (idxMap.get(b.id) ?? 0));
+}
+
+/**
+ * Generic reconcile: remove items not in remote, patch existing via callback,
+ * insert new items, then fix order.
+ */
+function reconcileById<T extends { id: string }>(
+  local: T[],
+  remote: T[],
+  patchItem: (l: T, r: T) => void,
+): void {
+  const remoteMap = new Map(remote.map((r) => [r.id, r]));
+  const localMap = new Map(local.map((l) => [l.id, l]));
+
+  // Remove items not in remote
+  for (let i = local.length - 1; i >= 0; i--) {
+    if (!remoteMap.has(local[i].id)) local.splice(i, 1);
+  }
+
+  // Patch existing & collect new
+  const toInsert: { index: number; item: T }[] = [];
+  for (let i = 0; i < remote.length; i++) {
+    const r = remote[i];
+    const l = localMap.get(r.id);
+    if (l) {
+      patchItem(l, r);
+    } else {
+      toInsert.push({ index: i, item: r });
+    }
+  }
+
+  for (const { index, item } of toInsert) {
+    local.splice(index, 0, clone(item));
+  }
+
+  alignOrder(local, remote);
+}
+
+// ─── field lists ────────────────────────────────────────────────────────────
+
+const CARD_FIELDS = [
+  'title', 'done', 'payload', 'type', 'order',
+  'learningStatus', 'columnId', 'workspaceId', 'ownerId',
+  'createdAt', 'updatedAt',
+] as const;
+
+const WS_FIELDS = [
+  'title', 'description', 'icon', 'inviteToken',
+  'editingBy', 'createdAt', 'updatedAt', 'pinned',
+] as const;
+
+const COLUMN_FIELDS = ['title', 'order', 'hideCompleted', 'color'] as const;
+
+const TOOL_FIELDS = [
+  'title', 'link', 'description', 'icon',
+  'ownerId', 'workspaceId', 'createdAt', 'updatedAt',
+] as const;
+
+// ─── item patchers ──────────────────────────────────────────────────────────
+
+function patchCard(local: CardGql, remote: CardGql): void {
+  patchScalars(local, remote, CARD_FIELDS);
+  if (!same(local.tags, remote.tags)) local.tags = [...remote.tags];
+}
+
+function patchColumn(local: Column, remote: Column): void {
+  patchScalars(local, remote, COLUMN_FIELDS);
+  if (remote.cards && local.cards) {
+    reconcileById(local.cards, remote.cards, patchCard);
+  } else if (remote.cards) {
+    (local as any).cards = clone(remote.cards);
+  }
+}
+
+function patchTool(local: Tool, remote: Tool): void {
+  patchScalars(local, remote, TOOL_FIELDS);
+  if (!same(local.tags, remote.tags)) local.tags = [...remote.tags];
+}
+
+// ─── sub-object patchers ────────────────────────────────────────────────────
+
+function patchEditingUser(local: any, remote: any): void {
+  const le = local.editingUser;
+  const re = remote.editingUser;
+  if (le?.id !== re?.id || le?.email !== re?.email || le?.avatarUrl !== re?.avatarUrl) {
+    local.editingUser = re ? { ...re } : re;
+  }
+}
+
+function patchOwner(local: any, remote: any): void {
+  if (local.owner?.id !== remote.owner?.id) {
+    local.owner = remote.owner ? { ...remote.owner } : remote.owner;
+  }
+}
+
+const MEMBER_FIELDS = ['userId', 'joinedAt'] as const;
+
+function patchMember(local: any, remote: any): void {
+  patchScalars(local, remote, MEMBER_FIELDS);
+  const lu = local.user;
+  const ru = remote.user;
+  if (lu?.id !== ru?.id || lu?.email !== ru?.email || lu?.avatarUrl !== ru?.avatarUrl) {
+    local.user = ru ? { ...ru } : ru;
+  }
+}
+
+function patchMembers(local: any, remote: any): void {
+  if (remote.members && local.members) {
+    reconcileById(local.members, remote.members, patchMember);
+  } else if (remote.members) {
+    local.members = clone(remote.members);
+  }
+}
+
+/** Reconcile a named array field (columns / backlog / tools). */
+function patchList<T extends { id: string }>(
+  local: any, remote: any, key: string,
+  patcher: (l: T, r: T) => void,
+): void {
+  if (remote[key] && local[key]) {
+    reconcileById(local[key], remote[key], patcher);
+  } else if (remote[key]) {
+    local[key] = clone(remote[key]);
+  }
+}
+
+// ─── main entry ─────────────────────────────────────────────────────────────
+
+/**
+ * Patch `local` workspace in-place with data from `remote`.
+ * Only mutates fields/items that actually differ.
+ * Vue's reactivity will only fire for touched properties.
+ */
+export function patchWorkspace(local: Workspace, remote: Workspace): void {
+  patchScalars(local, remote, WS_FIELDS);
+  patchEditingUser(local, remote);
+  patchOwner(local, remote);
+  patchMembers(local, remote);
+  patchList<Column>(local, remote, 'columns', patchColumn);
+  patchList<CardGql>(local, remote, 'backlog', patchCard);
+  patchList<Tool>(local, remote, 'tools', patchTool);
+}
diff --git a/client/src/router/index.ts b/client/src/router/index.ts
index 24e4405..18bce4c 100644
--- a/client/src/router/index.ts
+++ b/client/src/router/index.ts
@@ -8,7 +8,7 @@ const router = createRouter({
     {
       path: '/',
       name: 'home',
-      component: () => import('@/views/HomeView.vue'),
+      component: () => import('@/views/workspace/WorkspacesView.vue'),
     },
     {
       path: '/auth',
@@ -91,6 +91,12 @@ const router = createRouter({
       component: () => import('@/views/LearningView.vue'),
       meta: { requiresAuth: true, status: LEARNING_STATUSES.DEEPEN_KNOWLEDGE },
     },
+    {
+      path: '/invite/:token',
+      name: 'invite',
+      component: () => import('@/views/InviteView.vue'),
+      // No requiresAuth — component handles redirect itself to preserve token
+    },
   ],
 });
 
diff --git a/client/src/stores/roadmap.ts b/client/src/stores/roadmap.ts
index 9a52160..cd8d7e8 100644
--- a/client/src/stores/roadmap.ts
+++ b/client/src/stores/roadmap.ts
@@ -27,7 +27,7 @@ export const useRoadmapStore = defineStore('roadmap', () => {
         variables: { workspaceId },
         fetchPolicy: 'network-only',
       });
-      currentRoadmap.value = data.roadmap ?? null;
+      currentRoadmap.value = data.roadmap ? structuredClone(data.roadmap) : null;
       return data.roadmap;
     } catch (e: unknown) {
       error.value = getGraphQLErrorMessage(e);
@@ -37,6 +37,29 @@ export const useRoadmapStore = defineStore('roadmap', () => {
     }
   }
 
+  /**
+   * Background-friendly fetch: only replaces currentRoadmap if the data
+   * actually changed (JSON comparison). No loading flag → no spinner flash.
+   */
+  async function softFetchRoadmap(workspaceId: string) {
+    try {
+      const { data } = await apolloClient.query({
+        query: ROADMAP_QUERY,
+        variables: { workspaceId },
+        fetchPolicy: 'network-only',
+      });
+      const incoming = data.roadmap ?? null;
+      // Only replace if something actually changed
+      if (JSON.stringify(currentRoadmap.value) !== JSON.stringify(incoming)) {
+        currentRoadmap.value = incoming ? structuredClone(incoming) : null;
+      }
+      return incoming;
+    } catch (e: unknown) {
+      error.value = getGraphQLErrorMessage(e);
+      throw e;
+    }
+  }
+
   async function createRoadmap(workspaceId: string, title: string, sourceText?: string) {
     try {
       error.value = null;
@@ -145,6 +168,7 @@ export const useRoadmapStore = defineStore('roadmap', () => {
     loading,
     error,
     fetchRoadmap,
+    softFetchRoadmap,
     createRoadmap,
     deleteRoadmap,
     createNode,
diff --git a/client/src/stores/workspace.ts b/client/src/stores/workspace.ts
index 3643ce6..c020e25 100644
--- a/client/src/stores/workspace.ts
+++ b/client/src/stores/workspace.ts
@@ -3,6 +3,7 @@ import { ref } from 'vue';
 import { apolloClient } from '@/lib/apollo';
 import { getGraphQLErrorMessage } from '@/lib/graphql-error';
 import { MY_WORKSPACES_QUERY, WORKSPACE_QUERY } from '@/graphql/queries';
+import { patchWorkspace } from '@/lib/patch-workspace';
 import {
   CREATE_WORKSPACE_MUTATION,
   UPDATE_WORKSPACE_MUTATION,
@@ -92,7 +93,9 @@ export const useWorkspaceStore = defineStore('workspace', () => {
         variables: { id },
         fetchPolicy: 'network-only',
       });
-      currentWorkspace.value = data.workspace;
+      // structuredClone: Apollo returns frozen objects; we need a mutable copy
+      // so that softFetchWorkspace can patch fields in-place later.
+      currentWorkspace.value = structuredClone(data.workspace);
       return data.workspace;
     } catch (e: unknown) {
       error.value = getGraphQLErrorMessage(e);
@@ -102,6 +105,38 @@ export const useWorkspaceStore = defineStore('workspace', () => {
     }
   }
 
+  /**
+   * Fetch workspace from server and patch only changed fields in-place.
+   * Unlike fetchWorkspace(), this does NOT replace the entire object reference,
+   * so Vue only re-renders components whose specific data actually changed.
+   * Use for background polling (lock poll, etc.).
+   */
+  async function softFetchWorkspace(id: string) {
+    try {
+      const { data } = await apolloClient.query({
+        query: WORKSPACE_QUERY,
+        variables: { id },
+        fetchPolicy: 'network-only',
+      });
+
+      // Access revoked (kicked/deleted) — clear local state
+      if (!data.workspace) {
+        currentWorkspace.value = null;
+        return null;
+      }
+
+      if (currentWorkspace.value && currentWorkspace.value.id === id) {
+        patchWorkspace(currentWorkspace.value, data.workspace);
+      } else {
+        currentWorkspace.value = structuredClone(data.workspace);
+      }
+      return data.workspace;
+    } catch (e: unknown) {
+      error.value = getGraphQLErrorMessage(e);
+      throw e;
+    }
+  }
+
   async function createWorkspace(input: CreateWorkspaceInput) {
     try {
       loading.value = true;
@@ -937,6 +972,7 @@ export const useWorkspaceStore = defineStore('workspace', () => {
     lastDeletedColumn,
     fetchWorkspaces,
     fetchWorkspace,
+    softFetchWorkspace,
     createWorkspace,
     updateWorkspace,
     deleteWorkspace,
diff --git a/client/src/views/InviteView.vue b/client/src/views/InviteView.vue
new file mode 100644
index 0000000..d53b4cb
--- /dev/null
+++ b/client/src/views/InviteView.vue
@@ -0,0 +1,63 @@
+<script setup lang="ts">
+import { ref, onMounted } from 'vue';
+import { useRoute, useRouter } from 'vue-router';
+import { useAuthStore } from '@/stores/auth';
+import { apolloClient } from '@/lib/apollo';
+import { ACCEPT_INVITE_MUTATION } from '@/graphql/mutations';
+import { toast } from 'vue-sonner';
+import { getGraphQLErrorMessage } from '@/lib/graphql-error';
+
+const route = useRoute();
+const router = useRouter();
+const authStore = useAuthStore();
+
+const loading = ref(true);
+const error = ref('');
+
+onMounted(async () => {
+  const token = route.params.token as string;
+  if (!token) {
+    error.value = 'Некорректная ссылка';
+    loading.value = false;
+    return;
+  }
+
+  // Wait for auth init
+  if (!authStore.initialized) {
+    await authStore.fetchMe();
+  }
+
+  if (!authStore.user) {
+    // Redirect to auth with return URL
+    router.replace({ name: 'auth', query: { redirect: route.fullPath } });
+    return;
+  }
+
+  try {
+    const { data } = await apolloClient.mutate({
+      mutation: ACCEPT_INVITE_MUTATION,
+      variables: { token },
+    });
+    const ws = data.acceptInvite;
+    toast.success(`Вы присоединились к «${ws.title}»`);
+    router.replace(`/workspace/${ws.id}`);
+  } catch (e) {
+    error.value = getGraphQLErrorMessage(e);
+    loading.value = false;
+  }
+});
+</script>
+
+<template>
+  <div class="flex-1 flex-center flex-col gap-4 pt-32">
+    <template v-if="loading && !error">
+      <span class="i-lucide-loader-2 animate-spin text-2xl text-muted" />
+      <p class="text-muted">Присоединяемся к воркспейсу…</p>
+    </template>
+    <template v-else-if="error">
+      <span class="i-lucide-alert-circle text-4xl text-danger" />
+      <p class="text-danger">{{ error }}</p>
+      <RouterLink to="/" class="btn-primary">На главную</RouterLink>
+    </template>
+  </div>
+</template>
diff --git a/client/src/views/workspace/BoardView.vue b/client/src/views/workspace/BoardView.vue
index fb1eb1b..74895b9 100644
--- a/client/src/views/workspace/BoardView.vue
+++ b/client/src/views/workspace/BoardView.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { computed, ref, inject, type Ref } from 'vue';
+import { computed, ref, inject, type Ref, type ComputedRef } from 'vue';
 import { useWorkspaceStore } from '@/stores/workspace';
 import { LIMITS } from 'dayflow-shared';
 import WorkspaceColumn from '@/components/workspace/WorkspaceColumn.vue';
@@ -11,6 +11,7 @@ const workspaceStore = useWorkspaceStore();
 
 const columnsContainer = ref<HTMLElement | null>(null);
 const cardSearch = inject<Ref<string>>('cardSearch', ref(''));
+const isReadOnly = inject<ComputedRef<boolean>>('isReadOnly', computed(() => false));
 
 function handleWheel(e: WheelEvent) {
   const target = e.target as HTMLElement;
@@ -60,6 +61,7 @@ async function addColumn() {
           :backlog-cards="backlogCards"
           :is-backlog-column="true"
           :search-query="cardSearch"
+          :read-only="isReadOnly"
         />
 
         <WorkspaceColumn
@@ -70,11 +72,12 @@ async function addColumn() {
           :column="column"
           :workspace-id="workspace.id"
           :search-query="cardSearch"
+          :read-only="isReadOnly"
         />
 
         <!-- Add Column Button -->
         <button
-          v-if="columns.length < LIMITS.MAX_COLUMNS_PER_WORKSPACE"
+          v-if="!isReadOnly && columns.length < LIMITS.MAX_COLUMNS_PER_WORKSPACE"
           @click="addColumn"
           class="shrink-0 w-72 h-32 border-2 border-dashed border-border rounded-[var(--r)] flex-center flex-col gap-2 text-muted hover:text-fg hover:border-fg/30 transition-colors"
         >
diff --git a/client/src/views/workspace/RoadmapView.vue b/client/src/views/workspace/RoadmapView.vue
index d5f543c..1051edc 100644
--- a/client/src/views/workspace/RoadmapView.vue
+++ b/client/src/views/workspace/RoadmapView.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref, computed, watch } from 'vue';
+import { ref, computed, watch, inject, type ComputedRef } from 'vue';
 import { useRoute } from 'vue-router';
 import { useRoadmapStore } from '@/stores/roadmap';
 import { useWorkspaceStore } from '@/stores/workspace';
@@ -24,6 +24,7 @@ const workspaceStore = useWorkspaceStore();
 const workspaceId = computed(() => route.params.id as string);
 const roadmap = computed(() => roadmapStore.currentRoadmap);
 const loading = computed(() => roadmapStore.loading);
+const isReadOnly = inject<ComputedRef<boolean>>('isReadOnly', computed(() => false));
 
 // Paste modal
 const showPasteModal = ref(false);
@@ -342,7 +343,7 @@ function copyPrompt() {
           <span class="i-lucide-map text-4xl mb-3 block mx-auto opacity-40" />
           <p class="mb-6">Роадмап ещё не создан</p>
 
-          <div class="flex gap-2 justify-center">
+          <div v-if="!isReadOnly" class="flex gap-2 justify-center">
             <button class="btn-ghost" @click="showPasteModal = true">
               <span class="i-lucide-clipboard-paste" />
               <span>Вставить текст</span>
@@ -364,7 +365,7 @@ function copyPrompt() {
         <!-- Title + Actions -->
         <div class="flex items-center gap-3 mb-4">
           <h2 class="text-lg font-bold flex-1 truncate">{{ roadmap.title }}</h2>
-          <button class="icon-btn-ghost" title="Изменить роадмап" @click="openEditRoadmap">
+          <button v-if="!isReadOnly" class="icon-btn-ghost" title="Изменить роадмап" @click="openEditRoadmap">
             <span class="i-lucide-pencil" />
           </button>
         </div>
@@ -390,6 +391,7 @@ function copyPrompt() {
             :key="node.id"
             :node="node"
             :depth="0"
+            :read-only="isReadOnly"
             @toggle-done="toggleNodeDone"
             @edit-node="openEditNode"
             @add-child="startAddChild"
@@ -403,7 +405,7 @@ function copyPrompt() {
         </div>
 
         <!-- Inline add child (triggered by + on a node) -->
-        <div v-if="addingParentId !== null" class="mt-4 flex gap-2 items-center">
+        <div v-if="!isReadOnly && addingParentId !== null" class="mt-4 flex gap-2 items-center">
           <input
             v-model="newNodeTitle"
             class="input flex-1 text-sm"
diff --git a/client/src/views/workspace/WorkspaceLayout.vue b/client/src/views/workspace/WorkspaceLayout.vue
index 5b3d3be..8fb31a0 100644
--- a/client/src/views/workspace/WorkspaceLayout.vue
+++ b/client/src/views/workspace/WorkspaceLayout.vue
@@ -1,10 +1,22 @@
 <script setup lang="ts">
-import { computed, ref, watch, nextTick, provide } from 'vue';
-import { useRoute, useRouter, RouterLink, RouterView } from 'vue-router';
+import { computed, ref, watch, nextTick, provide, onBeforeUnmount } from 'vue';
+import { useRoute, useRouter, RouterLink, RouterView, onBeforeRouteLeave } from 'vue-router';
 import { useWorkspaceStore } from '@/stores/workspace';
+import { useRoadmapStore } from '@/stores/roadmap';
+import { useAuthStore } from '@/stores/auth';
+import { apolloClient } from '@/lib/apollo';
+import {
+  GENERATE_INVITE_TOKEN_MUTATION,
+  REMOVE_WORKSPACE_MEMBER_MUTATION,
+  ACQUIRE_WORKSPACE_LOCK_MUTATION,
+  RELEASE_WORKSPACE_LOCK_MUTATION,
+  HEARTBEAT_WORKSPACE_LOCK_MUTATION,
+  TRANSFER_WORKSPACE_LOCK_MUTATION,
+} from '@/graphql/mutations';
 import EmojiPickerPopover from '@/components/common/EmojiPickerPopover.vue';
 import ToolboxPanel from '@/components/toolbox/ToolboxPanel.vue';
 import SearchInput from '@/components/common/SearchInput.vue';
+import CopyButton from '@/components/common/CopyButton.vue';
 import { toast } from 'vue-sonner';
 import { getGraphQLErrorMessage } from '@/lib/graphql-error';
 import {
@@ -19,6 +31,8 @@ import {
 const route = useRoute();
 const router = useRouter();
 const workspaceStore = useWorkspaceStore();
+const roadmapStore = useRoadmapStore();
+const authStore = useAuthStore();
 
 const isEditing = ref(false);
 const editTitle = ref('');
@@ -60,6 +74,133 @@ watch(
   { immediate: true }
 );
 
+// ── Editing lock ─────────────────────────────────────────────────────────────
+
+const lockHeld = ref(false);
+let heartbeatTimer: ReturnType<typeof setInterval> | null = null;
+
+const lockedByOther = computed(() => {
+  const ws = workspace.value;
+  if (!ws?.editingBy) return false;
+  return ws.editingBy !== authStore.user?.id;
+});
+
+const lockUser = computed(() => workspace.value?.editingUser ?? null);
+
+const isReadOnly = computed(() => lockedByOther.value);
+
+// Provide read-only flag to child routes
+provide('isReadOnly', isReadOnly);
+
+async function acquireLock() {
+  if (!workspace.value) return;
+  try {
+    await apolloClient.mutate({
+      mutation: ACQUIRE_WORKSPACE_LOCK_MUTATION,
+      variables: { workspaceId: workspace.value.id },
+    });
+    lockHeld.value = true;
+    startHeartbeat();
+  } catch {
+    // Lock held by someone else — soft-refresh to update lock state
+    await workspaceStore.softFetchWorkspace(workspace.value.id);
+  }
+}
+
+async function releaseLock() {
+  stopHeartbeat();
+  if (!lockHeld.value || !workspace.value) return;
+  lockHeld.value = false;
+  try {
+    await apolloClient.mutate({
+      mutation: RELEASE_WORKSPACE_LOCK_MUTATION,
+      variables: { workspaceId: workspace.value.id },
+    });
+  } catch {
+    // best-effort
+  }
+}
+
+function startHeartbeat() {
+  stopHeartbeat();
+  heartbeatTimer = setInterval(async () => {
+    if (!lockHeld.value || !workspace.value) return;
+    try {
+      await apolloClient.mutate({
+        mutation: HEARTBEAT_WORKSPACE_LOCK_MUTATION,
+        variables: { workspaceId: workspace.value.id },
+      });
+    } catch {
+      // lost lock
+      lockHeld.value = false;
+      stopHeartbeat();
+    }
+  }, 15_000);
+}
+
+function stopHeartbeat() {
+  if (heartbeatTimer) {
+    clearInterval(heartbeatTimer);
+    heartbeatTimer = null;
+  }
+}
+
+// Background sync — always runs while workspace is open (every 10s)
+// Keeps members, tools, columns, etc. in sync for all users
+let syncTimer: ReturnType<typeof setInterval> | null = null;
+
+watch(
+  workspace,
+  () => {
+    if (syncTimer) {
+      clearInterval(syncTimer);
+      syncTimer = null;
+    }
+    if (workspace.value) {
+      syncTimer = setInterval(async () => {
+        if (!workspace.value) return;
+        await workspaceStore.softFetchWorkspace(workspace.value.id);
+        // Access revoked — redirect home
+        if (!workspace.value) {
+          toast.error('Доступ к воркспейсу отозван');
+          router.replace('/');
+          return;
+        }
+        // Also sync roadmap if on that route
+        if (currentMode.value === 'roadmap') {
+          await roadmapStore.softFetchRoadmap(workspace.value.id);
+        }
+        // Auto-acquire lock if freed and we don't hold it
+        if (!lockHeld.value && !workspace.value.editingBy) {
+          await acquireLock();
+        }
+      }, 10_000);
+    }
+  },
+  { immediate: true }
+);
+
+// Acquire lock when workspace loads
+watch(
+  workspace,
+  (ws) => {
+    if (ws && !lockHeld.value && !lockedByOther.value) {
+      acquireLock();
+    }
+  },
+  { immediate: true }
+);
+
+// Release lock on leave
+onBeforeRouteLeave(() => {
+  releaseLock();
+});
+
+onBeforeUnmount(() => {
+  releaseLock();
+  if (syncTimer) clearInterval(syncTimer);
+});
+
 async function startEditTitle() {
   if (!workspace.value) return;
   editTitle.value = workspace.value.title;
@@ -133,6 +274,72 @@ async function deleteWorkspace() {
   }
 }
 
+// ── Sharing ──────────────────────────────────────────────────────────────────
+
+const showShareModal = ref(false);
+const generatingToken = ref(false);
+
+const isOwner = computed(() => workspace.value?.owner?.id === authStore.user?.id);
+
+const inviteUrl = computed(() => {
+  const token = workspace.value?.inviteToken;
+  if (!token) return '';
+  return `${window.location.origin}/invite/${token}`;
+});
+
+async function generateInviteToken() {
+  if (!workspace.value) return;
+  try {
+    generatingToken.value = true;
+    const { data } = await apolloClient.mutate({
+      mutation: GENERATE_INVITE_TOKEN_MUTATION,
+      variables: { workspaceId: workspace.value.id },
+    });
+    // Apply token directly — no refetch needed
+    if (workspace.value && data?.generateInviteToken?.inviteToken != null) {
+      workspace.value.inviteToken = data.generateInviteToken.inviteToken;
+    }
+    toast.success('Ссылка сгенерирована');
+  } catch (e) {
+    toast.error(getGraphQLErrorMessage(e));
+  } finally {
+    generatingToken.value = false;
+  }
+}
+
+async function removeMember(userId: string) {
+  if (!workspace.value) return;
+  try {
+    await apolloClient.mutate({
+      mutation: REMOVE_WORKSPACE_MEMBER_MUTATION,
+      variables: { workspaceId: workspace.value.id, userId },
+    });
+    // Remove from local members list — no full refetch
+    if (workspace.value.members) {
+      workspace.value.members = workspace.value.members.filter((m) => m.userId !== userId);
+    }
+    toast.success('Участник удалён');
+  } catch (e) {
+    toast.error(getGraphQLErrorMessage(e));
+  }
+}
+
+async function transferLock(toUserId: string) {
+  if (!workspace.value) return;
+  try {
+    await apolloClient.mutate({
+      mutation: TRANSFER_WORKSPACE_LOCK_MUTATION,
+      variables: { workspaceId: workspace.value.id, toUserId },
+    });
+    lockHeld.value = false;
+    stopHeartbeat();
+    await workspaceStore.softFetchWorkspace(workspace.value.id);
+    toast.success('Права редактирования переданы');
+  } catch (e) {
+    toast.error(getGraphQLErrorMessage(e));
+  }
+}
+
 // Summaries (board-specific but in header)
 const allSummaries = computed(() => {
   if (!workspace.value) return [];
@@ -169,13 +376,6 @@ const summariesText = computed(() => {
   return text.trim();
 });
 
-function copySummaries() {
-  navigator.clipboard.writeText(summariesText.value).then(
-    () => toast.success('Конспекты скопированы'),
-    () => toast.error('Не удалось скопировать')
-  );
-}
-
 function downloadSummaries() {
   if (!workspace.value) return;
   const blob = new Blob([summariesText.value], { type: 'text/markdown;charset=utf-8' });
@@ -200,7 +400,7 @@ function downloadSummaries() {
 
     <!-- Workspace Content -->
     <template v-else-if="workspace">
-      <!-- Original Header (untouched) -->
+      <!-- Header -->
       <div class="flex-shrink-0 px-6 py-2">
         <div class="flex items-center gap-4">
           <div class="flex items-center gap-4 shrink-0">
@@ -215,7 +415,11 @@ function downloadSummaries() {
 
             <!-- Workspace icon (click to change) -->
             <div class="relative shrink-0">
-              <EmojiPickerPopover :model-value="workspace.icon || ''" @update:model-value="setIcon">
+              <EmojiPickerPopover
+                v-if="!isReadOnly"
+                :model-value="workspace.icon || ''"
+                @update:model-value="setIcon"
+              >
                 <button
                   type="button"
                   class="w-9 h-9 rounded-[var(--r)] flex-center text-xl bg-fg/5 hover:bg-fg/10 transition-colors"
@@ -225,6 +429,10 @@ function downloadSummaries() {
                   <span v-else class="i-lucide-layout-grid text-base text-muted" />
                 </button>
               </EmojiPickerPopover>
+              <div v-else class="w-9 h-9 rounded-[var(--r)] flex-center text-xl bg-fg/5">
+                <span v-if="workspace.icon">{{ workspace.icon }}</span>
+                <span v-else class="i-lucide-layout-grid text-base text-muted" />
+              </div>
             </div>
           </div>
 
@@ -242,43 +450,68 @@ function downloadSummaries() {
             <h1
               v-else
               :title="workspace.title"
-              class="text-xl font-bold text-fg cursor-text truncate"
-              @dblclick="startEditTitle"
+              class="text-xl font-bold text-fg truncate"
+              :class="{ 'cursor-text': !isReadOnly }"
+              @dblclick="!isReadOnly && startEditTitle()"
             >
               {{ workspace.title }}
             </h1>
           </div>
 
+          <!-- Lock indicator: avatar + lock icon -->
+          <div
+            v-if="lockedByOther && lockUser"
+            class="flex items-center gap-1.5 px-2 py-1 rounded-[var(--r)] bg-primary/10 text-primary"
+            :title="`Редактирует ${lockUser.email}`"
+          >
+            <span class="i-lucide-lock text-sm" />
+            <img
+              v-if="lockUser.avatarUrl"
+              :src="lockUser.avatarUrl"
+              :alt="lockUser.email"
+              class="w-5 h-5 rounded-full object-cover"
+            />
+            <span
+              v-else
+              class="w-5 h-5 rounded-full bg-primary/20 flex-center text-[10px] i-lucide-user"
+            />
+          </div>
+
           <!-- Search + Actions (same as original) -->
           <div class="flex items-center gap-3">
             <template v-if="isBoardRoute">
-              <SearchInput
-                v-model="cardSearch"
-                placeholder="Поиск карточек..."
-                class="w-48"
-              />
-              <button
-                v-if="allSummaries.length > 0"
-                @click="showSummariesModal = true"
-                class="btn-ghost"
-                title="Все конспекты"
-              >
-                <span class="i-lucide-book-open" />
-                <span>Конспекты</span>
-              </button>
+              <SearchInput v-model="cardSearch" placeholder="Поиск карточек..." class="w-48" />
+              <template v-if="!isReadOnly">
+                <button
+                  v-if="allSummaries.length > 0"
+                  @click="showSummariesModal = true"
+                  class="btn-ghost"
+                  title="Все конспекты"
+                >
+                  <span class="i-lucide-book-open" />
+                  <span>Конспекты</span>
+                </button>
 
-              <button
-                @click.stop="showToolbox = !showToolbox"
-                @mousedown.stop
-                class="btn-ghost"
-                :class="{ 'text-primary bg-primary/10': showToolbox }"
-                title="Инструменты"
-              >
-                <span class="i-lucide-box" />
-              </button>
+                <button
+                  @click.stop="showToolbox = !showToolbox"
+                  @mousedown.stop
+                  class="btn-ghost"
+                  :class="{ 'text-primary bg-primary/10': showToolbox }"
+                  title="Инструменты"
+                >
+                  <span class="i-lucide-box" />
+                </button>
+              </template>
             </template>
-
-            <button @click="openEditModal" class="btn-ghost" title="Настройки воркспейса">
+            <button @click="showShareModal = true" class="btn-ghost" title="Совместный доступ">
+              <span class="i-lucide-share-2" />
+            </button>
+            <button
+              v-if="!isReadOnly"
+              @click="openEditModal"
+              class="btn-ghost"
+              title="Настройки воркспейса"
+            >
               <span class="i-lucide-settings" />
             </button>
           </div>
@@ -367,10 +600,11 @@ function downloadSummaries() {
           </div>
 
           <div class="flex justify-end gap-2 pt-4 border-t border-border mt-4">
-            <button type="button" class="btn-ghost" @click="copySummaries">
-              <span class="i-lucide-copy" />
-              <span>Копировать</span>
-            </button>
+            <CopyButton
+              :text="summariesText"
+              success-message="Конспекты скопированы"
+              title="Копировать"
+            />
             <button type="button" class="btn-primary" @click="downloadSummaries">
               <span class="i-lucide-download" />
               <span>Скачать .md</span>
@@ -380,6 +614,134 @@ function downloadSummaries() {
       </DialogPortal>
     </DialogRoot>
 
+    <!-- Share Modal -->
+    <DialogRoot v-model:open="showShareModal">
+      <DialogPortal>
+        <DialogOverlay class="dialog-overlay" @click="showShareModal = false" />
+        <DialogContent
+          :aria-describedby="undefined"
+          class="dialog-content max-w-md"
+          @escape-key-down="showShareModal = false"
+        >
+          <div class="dialog-header">
+            <DialogTitle class="dialog-title">Совместный доступ</DialogTitle>
+            <DialogClose class="icon-btn-close">
+              <span class="i-lucide-x" />
+            </DialogClose>
+          </div>
+
+          <div class="space-y-5">
+            <!-- Invite link -->
+            <template v-if="isOwner">
+              <div>
+                <p class="text-sm font-medium mb-2">Пригласительная ссылка</p>
+                <div v-if="inviteUrl" class="flex items-center gap-2">
+                  <input
+                    type="text"
+                    :value="inviteUrl"
+                    readonly
+                    class="input flex-1 text-xs font-mono select-all"
+                    @focus="($event.target as HTMLInputElement).select()"
+                  />
+                  <CopyButton :text="inviteUrl" success-message="Ссылка скопирована" />
+                </div>
+                <p v-else class="text-xs text-muted mb-2">Ссылка ещё не создана</p>
+                <button
+                  type="button"
+                  class="btn-ghost mt-2"
+                  :disabled="generatingToken"
+                  @click="generateInviteToken"
+                >
+                  <span v-if="generatingToken" class="i-lucide-loader-2 animate-spin" />
+                  <span class="i-lucide-refresh-cw" v-else />
+                  <span>{{ inviteUrl ? 'Перегенерировать' : 'Создать ссылку' }}</span>
+                </button>
+              </div>
+            </template>
+
+            <!-- Members list -->
+            <div>
+              <p class="text-sm font-medium mb-2">Участники</p>
+              <div class="space-y-2">
+                <!-- Owner -->
+                <div
+                  v-if="workspace?.owner"
+                  class="flex items-center gap-3 p-2 rounded-[var(--r)] bg-fg/3"
+                >
+                  <img
+                    v-if="workspace.owner.avatarUrl"
+                    :src="workspace.owner.avatarUrl"
+                    class="w-7 h-7 rounded-full object-cover"
+                    alt=""
+                  />
+                  <span
+                    v-else
+                    class="w-7 h-7 rounded-full bg-fg/10 flex-center text-muted i-lucide-user text-sm"
+                  />
+                  <div class="flex-1 min-w-0">
+                    <p class="text-sm text-fg truncate">{{ workspace.owner.email }}</p>
+                  </div>
+                  <button
+                    v-if="lockHeld && workspace.owner.id !== authStore.user?.id"
+                    type="button"
+                    class="icon-btn-ghost text-primary"
+                    title="Передать редактирование"
+                    @click="transferLock(workspace.owner.id)"
+                  >
+                    <span class="i-lucide-arrow-right-left" />
+                  </button>
+                  <span class="text-xs text-muted shrink-0">Владелец</span>
+                </div>
+
+                <!-- Members -->
+                <div
+                  v-for="m in workspace?.members ?? []"
+                  :key="m.id"
+                  class="flex items-center gap-3 p-2 rounded-[var(--r)] bg-fg/3"
+                >
+                  <img
+                    v-if="m.user.avatarUrl"
+                    :src="m.user.avatarUrl"
+                    class="w-7 h-7 rounded-full object-cover"
+                    alt=""
+                  />
+                  <span
+                    v-else
+                    class="w-7 h-7 rounded-full bg-fg/10 flex-center text-muted i-lucide-user text-sm"
+                  />
+                  <div class="flex-1 min-w-0">
+                    <p class="text-sm text-fg truncate">{{ m.user.email }}</p>
+                  </div>
+                  <button
+                    v-if="lockHeld && m.userId !== authStore.user?.id"
+                    type="button"
+                    class="icon-btn-ghost text-primary"
+                    title="Передать редактирование"
+                    @click="transferLock(m.userId)"
+                  >
+                    <span class="i-lucide-arrow-right-left" />
+                  </button>
+                  <button
+                    v-if="isOwner"
+                    type="button"
+                    class="icon-btn-ghost text-danger"
+                    title="Удалить участника"
+                    @click="removeMember(m.userId)"
+                  >
+                    <span class="i-lucide-user-x" />
+                  </button>
+                </div>
+
+                <p v-if="!workspace?.members?.length" class="text-xs text-muted italic">
+                  Пока нет участников
+                </p>
+              </div>
+            </div>
+          </div>
+        </DialogContent>
+      </DialogPortal>
+    </DialogRoot>
+
     <!-- Edit Workspace Modal -->
     <DialogRoot v-model:open="showEditModal">
       <DialogPortal>
@@ -417,19 +779,22 @@ function downloadSummaries() {
               />
             </div>
             <div class="flex justify-between items-center gap-3 pt-4">
-              <div v-if="confirmDelete" class="flex items-center gap-2">
-                <span class="text-sm text-danger">Это необратимо! Удалить?</span>
-                <button type="button" class="btn-delete" @click="deleteWorkspace">
-                  <span>Да</span>
-                </button>
-                <button type="button" class="btn-ghost" @click="confirmDelete = false">
-                  <span>Нет</span>
+              <template v-if="isOwner">
+                <div v-if="confirmDelete" class="flex items-center gap-2">
+                  <span class="text-sm text-danger">Это необратимо! Удалить?</span>
+                  <button type="button" class="btn-delete" @click="deleteWorkspace">
+                    <span>Да</span>
+                  </button>
+                  <button type="button" class="btn-ghost" @click="confirmDelete = false">
+                    <span>Нет</span>
+                  </button>
+                </div>
+                <button v-else type="button" class="btn-delete" @click="confirmDelete = true">
+                  <span class="i-lucide-trash-2" />
+                  <span>Удалить</span>
                 </button>
-              </div>
-              <button v-else type="button" class="btn-delete" @click="confirmDelete = true">
-                <span class="i-lucide-trash-2" />
-                <span>Удалить</span>
-              </button>
+              </template>
+              <span v-else /><!-- spacer for non-owner -->
               <button type="submit" class="btn-primary" :disabled="editModalLoading">
                 <span v-if="editModalLoading" class="i-lucide-loader-2 animate-spin" />
                 <span>Сохранить</span>
diff --git a/client/src/views/HomeView.vue b/client/src/views/workspace/WorkspacesView.vue
similarity index 56%
rename from client/src/views/HomeView.vue
rename to client/src/views/workspace/WorkspacesView.vue
index 7f04c92..4375f01 100644
--- a/client/src/views/HomeView.vue
+++ b/client/src/views/workspace/WorkspacesView.vue
@@ -4,6 +4,7 @@ import { useRouter } from 'vue-router';
 import { useAuthStore } from '@/stores/auth';
 import { useWorkspaceStore } from '@/stores/workspace';
 import CreateWorkspaceDialog from '@/components/workspace/CreateWorkspaceDialog.vue';
+import WorkspaceCard from '@/components/workspace/WorkspaceCard.vue';
 import SearchInput from '@/components/common/SearchInput.vue';
 import type { Workspace } from '@/graphql/types';
 
@@ -21,21 +22,34 @@ const filteredWorkspaces = computed(() => {
   const q = workspaceSearch.value.trim().toLowerCase();
   if (!q) return list;
   return list.filter(
-    (w: Workspace) => w.title?.toLowerCase().includes(q) || w.description?.toLowerCase().includes(q)
+    (w: Workspace) =>
+      w.title?.toLowerCase().includes(q) || w.description?.toLowerCase().includes(q),
   );
 });
 
-const pinnedWorkspaces = computed(() => filteredWorkspaces.value.filter((w) => w.pinned));
-const unpinnedWorkspaces = computed(() => filteredWorkspaces.value.filter((w) => !w.pinned));
+const myWorkspaces = computed(() =>
+  filteredWorkspaces.value.filter((w) => w.owner?.id === authStore.user?.id),
+);
+const sharedWorkspaces = computed(() =>
+  filteredWorkspaces.value.filter((w) => w.owner?.id && w.owner.id !== authStore.user?.id),
+);
+
+const pinnedOwn = computed(() => myWorkspaces.value.filter((w) => w.pinned));
+const unpinnedOwn = computed(() => myWorkspaces.value.filter((w) => !w.pinned));
+const pinnedShared = computed(() => sharedWorkspaces.value.filter((w) => w.pinned));
+const unpinnedShared = computed(() => sharedWorkspaces.value.filter((w) => !w.pinned));
+
+// All pinned (own + shared) for the top section
+const allPinned = computed(() => [...pinnedOwn.value, ...pinnedShared.value]);
 
-const canCreateWorkspace = computed(() => workspaceStore.workspaces.length < 20);
+const canCreateWorkspace = computed(() => myWorkspaces.value.length < 20);
 
 watch(
   () => authStore.user,
   (u) => {
     if (u && workspaceStore.workspaces.length === 0) workspaceStore.fetchWorkspaces();
   },
-  { immediate: true }
+  { immediate: true },
 );
 
 function navigateToWorkspace(id: string) {
@@ -85,7 +99,7 @@ function togglePinned(e: Event, id: string) {
     <template v-else>
       <div class="flex flex-wrap items-end justify-between gap-4 mb-8 cursor-default">
         <div>
-          <h1 class="page-title">Мои воркспейсы</h1>
+          <h1 class="page-title">Воркспейсы</h1>
           <p class="page-desc">Доски для тем и проектов</p>
         </div>
         <div v-if="workspaceStore.workspaces.length > 0" class="flex items-center gap-3">
@@ -112,8 +126,8 @@ function togglePinned(e: Event, id: string) {
 
       <!-- Workspaces Grid -->
       <template v-else-if="workspaceStore.workspaces.length > 0">
-        <!-- Pinned -->
-        <template v-if="pinnedWorkspaces.length > 0">
+        <!-- ── Pinned (own + shared) ─────────────────────────────────── -->
+        <template v-if="allPinned.length > 0">
           <h2 class="text-sm font-medium text-muted mb-3 flex items-center gap-1.5">
             <svg class="w-4 h-4 text-yellow-500" viewBox="0 0 24 24" fill="currentColor">
               <path
@@ -123,90 +137,60 @@ function togglePinned(e: Event, id: string) {
             <span>Закреплённые</span>
           </h2>
           <div class="grid md:grid-cols-2 lg:grid-cols-3 gap-5">
-            <div
-              v-for="workspace in pinnedWorkspaces"
-              :key="workspace.id"
-              @click="navigateToWorkspace(workspace.id)"
-              class="card-hover text-left p-5 group relative cursor-pointer"
-            >
-              <button
-                type="button"
-                class="absolute top-3 right-3 icon-btn-ghost text-yellow-500 group/star"
-                title="Открепить"
-                @click="togglePinned($event, workspace.id)"
-              >
-                <svg
-                  class="w-[18px] h-[18px] group-hover/star:opacity-0 absolute"
-                  viewBox="0 0 24 24"
-                  fill="currentColor"
-                >
-                  <path
-                    d="M12 2l3.09 6.26L22 9.27l-5 4.87 1.18 6.88L12 17.77l-6.18 3.25L7 14.14 2 9.27l6.91-1.01L12 2z"
-                  />
-                </svg>
-                <span class="i-lucide-star-off opacity-0 group-hover/star:opacity-100" />
-              </button>
-              <div
-                class="w-10 h-10 rounded-xl flex-center mb-3 text-2xl transition-colors bg-fg/5 group-hover:bg-fg/8"
-              >
-                <span v-if="workspace.icon">{{ workspace.icon }}</span>
-                <span v-else class="i-lucide-layout-grid text-lg text-muted" />
-              </div>
-              <h3 :title="workspace.title" class="font-semibold text-fg mb-1.5 truncate text-base">
-                {{ workspace.title }}
-              </h3>
-              <p v-if="workspace.description" class="text-sm text-muted line-clamp-2 mb-3">
-                {{ workspace.description }}
-              </p>
-              <p class="text-xs text-muted">
-                {{ new Date(workspace.updatedAt).toLocaleDateString('ru-RU') }}
-              </p>
-            </div>
+            <WorkspaceCard
+              v-for="ws in allPinned"
+              :key="ws.id"
+              :workspace="ws"
+              :shared="ws.owner?.id !== authStore.user?.id"
+              @click="navigateToWorkspace(ws.id)"
+              @toggle-pinned="togglePinned($event, ws.id)"
+            />
           </div>
           <hr class="border-border my-10" />
         </template>
 
-        <!-- Unpinned -->
-        <div class="grid md:grid-cols-2 lg:grid-cols-3 gap-5">
-          <div
-            v-for="workspace in unpinnedWorkspaces"
-            :key="workspace.id"
-            @click="navigateToWorkspace(workspace.id)"
-            class="card-hover text-left p-5 group relative cursor-pointer"
+        <!-- ── My workspaces: Unpinned ───────────────────────────────── -->
+        <template v-if="unpinnedOwn.length > 0">
+          <h2
+            v-if="allPinned.length > 0 || sharedWorkspaces.length > 0"
+            class="text-sm font-medium text-muted mb-3 flex items-center gap-1.5"
           >
-            <button
-              type="button"
-              class="absolute top-3 right-3 icon-btn-ghost opacity-0 group-hover:opacity-100 transition-opacity text-muted hover:text-yellow-500"
-              title="Закрепить"
-              @click="togglePinned($event, workspace.id)"
-            >
-              <svg class="w-[18px] h-[18px]" viewBox="0 0 24 24" fill="currentColor">
-                <path
-                  d="M12 2l3.09 6.26L22 9.27l-5 4.87 1.18 6.88L12 17.77l-6.18 3.25L7 14.14 2 9.27l6.91-1.01L12 2z"
-                />
-              </svg>
-            </button>
-            <div
-              class="w-10 h-10 rounded-xl flex-center mb-3 text-2xl transition-colors bg-fg/5 group-hover:bg-fg/8"
-            >
-              <span v-if="workspace.icon">{{ workspace.icon }}</span>
-              <span v-else class="i-lucide-layout-grid text-lg text-muted" />
-            </div>
-            <h3 :title="workspace.title" class="font-semibold text-fg mb-1.5 truncate text-base">
-              {{ workspace.title }}
-            </h3>
-            <p v-if="workspace.description" class="text-sm text-muted line-clamp-2 mb-3">
-              {{ workspace.description }}
-            </p>
-            <p class="text-xs text-muted">
-              {{ new Date(workspace.updatedAt).toLocaleDateString('ru-RU') }}
-            </p>
+            <span class="i-lucide-folder" />
+            <span>Мои</span>
+          </h2>
+          <div class="grid md:grid-cols-2 lg:grid-cols-3 gap-5">
+            <WorkspaceCard
+              v-for="ws in unpinnedOwn"
+              :key="ws.id"
+              :workspace="ws"
+              @click="navigateToWorkspace(ws.id)"
+              @toggle-pinned="togglePinned($event, ws.id)"
+            />
           </div>
+        </template>
 
-          <template v-if="filteredWorkspaces.length === 0 && workspaceSearch.trim()">
-            <p class="col-span-full text-sm text-muted py-4">По запросу ничего не найдено</p>
-          </template>
-        </div>
+        <!-- ── Shared workspaces: Unpinned ───────────────────────────── -->
+        <template v-if="unpinnedShared.length > 0">
+          <hr v-if="unpinnedOwn.length > 0 || allPinned.length > 0" class="border-border my-10" />
+          <h2 class="text-sm font-medium text-muted mb-3 flex items-center gap-1.5">
+            <span class="i-lucide-users" />
+            <span>Доступные мне</span>
+          </h2>
+          <div class="grid md:grid-cols-2 lg:grid-cols-3 gap-5">
+            <WorkspaceCard
+              v-for="ws in unpinnedShared"
+              :key="ws.id"
+              :workspace="ws"
+              shared
+              @click="navigateToWorkspace(ws.id)"
+              @toggle-pinned="togglePinned($event, ws.id)"
+            />
+          </div>
+        </template>
+
+        <template v-if="filteredWorkspaces.length === 0 && workspaceSearch.trim()">
+          <p class="text-sm text-muted py-4">По запросу ничего не найдено</p>
+        </template>
       </template>
 
       <!-- Empty State -->
diff --git a/server/package-lock.json b/server/package-lock.json
index e13ef00..4157034 100644
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -97,6 +97,7 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -3317,6 +3318,7 @@
       "integrity": "sha512-5jsi0wpncvTD33Sh1UCgacK37FFwDn+EG7wCmEvs62fCvBL+n8/76cAYDok21NF6+jaVWIqKwCZyX7Vbu8eB3A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -3748,6 +3750,7 @@
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -3954,6 +3957,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -4623,6 +4627,7 @@
       "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -5235,6 +5240,7 @@
       "resolved": "https://registry.npmjs.org/graphql/-/graphql-16.12.0.tgz",
       "integrity": "sha512-DKKrynuQRne0PNpEbzuEdHlYOMksHSUI8Zc9Unei5gTsMNA2/vMpoMz/yKba50pejK56qj98qM0SjYxAKi13gQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": "^12.22.0 || ^14.16.0 || ^16.0.0 || >=17.0.0"
       }
@@ -5276,7 +5282,6 @@
       "resolved": "https://registry.npmjs.org/graphql-middleware/-/graphql-middleware-6.1.35.tgz",
       "integrity": "sha512-azawK7ApUYtcuPGRGBR9vDZu795pRuaFhO5fgomdJppdfKRt7jwncuh0b7+D3i574/4B+16CNWgVpnGVlg3ZCg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@graphql-tools/delegate": "^8.8.1",
         "@graphql-tools/schema": "^8.5.1"
@@ -5290,7 +5295,6 @@
       "resolved": "https://registry.npmjs.org/@graphql-tools/batch-execute/-/batch-execute-8.5.1.tgz",
       "integrity": "sha512-hRVDduX0UDEneVyEWtc2nu5H2PxpfSfM/riUlgZvo/a/nG475uyehxR5cFGvTEPEQUKY3vGIlqvtRigzqTfCew==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@graphql-tools/utils": "8.9.0",
         "dataloader": "2.1.0",
@@ -5306,7 +5310,6 @@
       "resolved": "https://registry.npmjs.org/@graphql-tools/delegate/-/delegate-8.8.1.tgz",
       "integrity": "sha512-NDcg3GEQmdEHlnF7QS8b4lM1PSF+DKeFcIlLEfZFBvVq84791UtJcDj8734sIHLukmyuAxXMfA1qLd2l4lZqzA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@graphql-tools/batch-execute": "8.5.1",
         "@graphql-tools/schema": "8.5.1",
@@ -5324,7 +5327,6 @@
       "resolved": "https://registry.npmjs.org/@graphql-tools/merge/-/merge-8.3.1.tgz",
       "integrity": "sha512-BMm99mqdNZbEYeTPK3it9r9S6rsZsQKtlqJsSBknAclXq2pGEfOxjcIZi+kBSkHZKPKCRrYDd5vY0+rUmIHVLg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@graphql-tools/utils": "8.9.0",
         "tslib": "^2.4.0"
@@ -5338,7 +5340,6 @@
       "resolved": "https://registry.npmjs.org/@graphql-tools/schema/-/schema-8.5.1.tgz",
       "integrity": "sha512-0Esilsh0P/qYcB5DKQpiKeQs/jevzIadNTaT0jeWklPMwNbT7yMX4EqZany7mbeRRlSRwMzNzL5olyFdffHBZg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@graphql-tools/merge": "8.3.1",
         "@graphql-tools/utils": "8.9.0",
@@ -5354,7 +5355,6 @@
       "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-8.9.0.tgz",
       "integrity": "sha512-pjJIWH0XOVnYGXCqej8g/u/tsfV4LvLlj0eATKQu5zwnxd/TiTHq7Cg313qUPTFFHZ3PP5wJ15chYVtLDwaymg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "tslib": "^2.4.0"
       },
@@ -5366,15 +5366,13 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/dataloader/-/dataloader-2.1.0.tgz",
       "integrity": "sha512-qTcEYLen3r7ojZNgVUaRggOI+KM7jrKxXeSHhogh/TWxYMeONEMqY+hmkobiYQozsGIyg9OYVzO4ZIfoB4I0pQ==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/graphql-middleware/node_modules/tslib": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.4.1.tgz",
       "integrity": "sha512-tGyy4dAjRIEwI7BzsB0lynWgOpfqjUdq91XXAlIWD2OwKBH7oCl/GZG/HT4BOHrTlPMOASlMQ7veyTqpmRcrNA==",
-      "license": "0BSD",
-      "peer": true
+      "license": "0BSD"
     },
     "node_modules/graphql-scalars": {
       "version": "1.25.0",
@@ -6796,6 +6794,7 @@
       "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
+      "peer": true,
       "dependencies": {
         "@prisma/engines": "5.22.0"
       },
@@ -7398,6 +7397,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -7492,6 +7492,7 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -7559,6 +7560,7 @@
       "integrity": "sha512-BtE0k6cjwjLZoZixN0t5AKP0kSzlGu7FctRXYuPAm//aaiZhmfq1JwdYpYr1brzEspYyFeF+8XF5j2VK6oalrA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.54.0",
         "@typescript-eslint/types": "8.54.0",
@@ -7840,7 +7842,6 @@
       "resolved": "https://registry.npmjs.org/value-or-promise/-/value-or-promise-1.0.11.tgz",
       "integrity": "sha512-41BrgH+dIbCFXClcSapVs5M6GkENd3gQOJpEfPDNa71LsUGMXDL0jMWpI/Rh7WhX+Aalfz2TTS3Zt5pUsbnhLg==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       }
@@ -7933,6 +7934,7 @@
       "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10.0.0"
       },
diff --git a/server/prisma/schema.prisma b/server/prisma/schema.prisma
index fbe5367..744fb3c 100644
--- a/server/prisma/schema.prisma
+++ b/server/prisma/schema.prisma
@@ -8,17 +8,19 @@ datasource db {
 }
 
 model User {
-  id           String    @id @default(cuid())
-  email        String    @unique
+  id           String   @id @default(cuid())
+  email        String   @unique
   passwordHash String
-  avatarUrl    String?   // null = нет аватара
-  createdAt    DateTime  @default(now())
-
-  sessions   Session[]
-  workspaces Workspace[]
-  cards      Card[]
-  tools      Tool[]
-  roadmaps   Roadmap[]
+  avatarUrl    String? // null = нет аватара
+  createdAt    DateTime @default(now())
+
+  sessions             Session[]
+  workspaces           Workspace[]
+  workspaceMemberships WorkspaceMember[]
+  workspacePins        UserWorkspacePin[]
+  cards                Card[]
+  tools                Tool[]
+  roadmaps             Roadmap[]
 }
 
 model Session {
@@ -32,24 +34,54 @@ model Session {
 }
 
 model Workspace {
-  id          String   @id @default(cuid())
+  id          String    @id @default(cuid())
   title       String
-  description String?  @db.Text
-  icon        String?  // один эмодзи, например "📁"
-  pinned      Boolean  @default(false)
-  createdAt   DateTime @default(now())
-  updatedAt   DateTime @updatedAt
+  description String?   @db.Text
+  icon        String? // один эмодзи, например "📁"
+  inviteToken String?   @unique // секретный токен для пригласительной ссылки
+  editingBy   String? // userId того, кто сейчас редактирует
+  editingAt   DateTime? // время последнего heartbeat
+  createdAt   DateTime  @default(now())
+  updatedAt   DateTime  @updatedAt
   ownerId     String
 
-  owner    User      @relation(fields: [ownerId], references: [id], onDelete: Cascade)
-  columns  Column[]
-  cards    Card[]
-  tools    Tool[]
+  owner   User               @relation(fields: [ownerId], references: [id], onDelete: Cascade)
+  members WorkspaceMember[]
+  pins    UserWorkspacePin[]
+  columns Column[]
+  cards   Card[]
+  tools   Tool[]
   roadmap Roadmap?
 
   @@index([ownerId])
 }
 
+model WorkspaceMember {
+  id          String   @id @default(cuid())
+  workspaceId String
+  userId      String
+  joinedAt    DateTime @default(now())
+
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  user      User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([workspaceId, userId])
+  @@index([workspaceId])
+  @@index([userId])
+}
+
+model UserWorkspacePin {
+  id          String @id @default(cuid())
+  userId      String
+  workspaceId String
+
+  user      User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, workspaceId])
+  @@index([userId])
+}
+
 model Column {
   id            String  @id @default(cuid())
   title         String
@@ -65,21 +97,21 @@ model Column {
 }
 
 model Card {
-  id          String   @id @default(cuid())
-  createdAt   DateTime @default(now())
-  updatedAt   DateTime @updatedAt
+  id        String   @id @default(cuid())
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
 
   ownerId     String
-  workspaceId String?  // null => "хаб" пользователя
-  columnId    String?  // null => не на доске (хаб или backlog)
-  order       Int?     // имеет смысл только если columnId != null
+  workspaceId String? // null => "хаб" пользователя
+  columnId    String? // null => не на доске (хаб или backlog)
+  order       Int? // имеет смысл только если columnId != null
 
-  type    CardType
-  title   String?
-  done    Boolean @default(false)
+  type  CardType
+  title String?
+  done  Boolean  @default(false)
 
   payload Json
-  tags    Json    @default("[]") // MySQL: массив строк как JSON
+  tags    Json @default("[]") // MySQL: массив строк как JSON
 
   learningStatus LearningStatus? // Новое поле: статус обучения
 
@@ -96,9 +128,9 @@ model Card {
 }
 
 model Tool {
-  id          String   @id @default(cuid())
-  createdAt   DateTime @default(now())
-  updatedAt   DateTime @updatedAt
+  id        String   @id @default(cuid())
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
 
   ownerId     String
   workspaceId String? // null => "хаб" (общий toolbox)
@@ -117,15 +149,15 @@ model Tool {
 }
 
 model Roadmap {
-  id          String   @id @default(cuid())
-  createdAt   DateTime @default(now())
-  updatedAt   DateTime @updatedAt
+  id        String   @id @default(cuid())
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
 
   ownerId     String
-  workspaceId String   @unique
+  workspaceId String @unique
 
-  title       String
-  sourceText  String?  @db.LongText
+  title      String
+  sourceText String? @db.LongText
 
   owner     User          @relation(fields: [ownerId], references: [id], onDelete: Cascade)
   workspace Workspace     @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
@@ -140,11 +172,11 @@ model RoadmapNode {
   updatedAt DateTime @updatedAt
 
   roadmapId String
-  parentId  String?  // null => root node
+  parentId  String? // null => root node
 
-  order     Int      @default(0)
-  title     String
-  done      Boolean  @default(false)
+  order Int     @default(0)
+  title String
+  done  Boolean @default(false)
 
   roadmap  Roadmap       @relation(fields: [roadmapId], references: [id], onDelete: Cascade)
   parent   RoadmapNode?  @relation("NodeTree", fields: [parentId], references: [id], onDelete: Cascade)
diff --git a/server/src/generated/types.ts b/server/src/generated/types.ts
index 8bcb503..57f43df 100644
--- a/server/src/generated/types.ts
+++ b/server/src/generated/types.ts
@@ -104,6 +104,10 @@ export type LearningStatus =
 
 export type Mutation = {
   __typename?: 'Mutation';
+  /** Принять приглашение по токену. Возвращает воркспейс. */
+  acceptInvite: Workspace;
+  /** Захватить лок на редактирование воркспейса. */
+  acquireWorkspaceLock: Workspace;
   createCard: Card;
   createColumn: Column;
   createRoadmap: Roadmap;
@@ -116,13 +120,23 @@ export type Mutation = {
   deleteRoadmapNode: Scalars['Boolean']['output'];
   deleteTool: Scalars['Boolean']['output'];
   deleteWorkspace: Scalars['Boolean']['output'];
+  /** Сгенерировать (или перегенерировать) пригласительную ссылку. */
+  generateInviteToken: Workspace;
+  /** Heartbeat — продлить лок (вызывать каждые ~15с). */
+  heartbeatWorkspaceLock: Workspace;
   moveCard: Card;
+  /** Отпустить лок. */
+  releaseWorkspaceLock: Workspace;
+  /** Удалить участника из воркспейса (только владелец). */
+  removeWorkspaceMember: Scalars['Boolean']['output'];
   reorderColumns: Array<Column>;
   reorderRoadmapNodes: Array<RoadmapNode>;
   signIn: AuthPayload;
   signOut: Scalars['Boolean']['output'];
   signUp: AuthPayload;
   toggleWorkspacePinned: Workspace;
+  /** Передать права редактирования другому участнику. */
+  transferWorkspaceLock: Workspace;
   updateCard: Card;
   updateColumn: Column;
   updateProfile: User;
@@ -132,6 +146,16 @@ export type Mutation = {
 };
 
 
+export type MutationAcceptInviteArgs = {
+  token: Scalars['String']['input'];
+};
+
+
+export type MutationAcquireWorkspaceLockArgs = {
+  workspaceId: Scalars['ID']['input'];
+};
+
+
 export type MutationCreateCardArgs = {
   input: CreateCardInput;
 };
@@ -197,6 +221,16 @@ export type MutationDeleteWorkspaceArgs = {
 };
 
 
+export type MutationGenerateInviteTokenArgs = {
+  workspaceId: Scalars['ID']['input'];
+};
+
+
+export type MutationHeartbeatWorkspaceLockArgs = {
+  workspaceId: Scalars['ID']['input'];
+};
+
+
 export type MutationMoveCardArgs = {
   columnId?: InputMaybe<Scalars['ID']['input']>;
   id: Scalars['ID']['input'];
@@ -204,6 +238,17 @@ export type MutationMoveCardArgs = {
 };
 
 
+export type MutationReleaseWorkspaceLockArgs = {
+  workspaceId: Scalars['ID']['input'];
+};
+
+
+export type MutationRemoveWorkspaceMemberArgs = {
+  userId: Scalars['ID']['input'];
+  workspaceId: Scalars['ID']['input'];
+};
+
+
 export type MutationReorderColumnsArgs = {
   columnIds: Array<Scalars['ID']['input']>;
   workspaceId: Scalars['ID']['input'];
@@ -234,6 +279,12 @@ export type MutationToggleWorkspacePinnedArgs = {
 };
 
 
+export type MutationTransferWorkspaceLockArgs = {
+  toUserId: Scalars['ID']['input'];
+  workspaceId: Scalars['ID']['input'];
+};
+
+
 export type MutationUpdateCardArgs = {
   id: Scalars['ID']['input'];
   input: UpdateCardInput;
@@ -422,8 +473,16 @@ export type Workspace = {
   columns: Array<Column>;
   createdAt: Scalars['DateTime']['output'];
   description?: Maybe<Scalars['String']['output']>;
+  /** Кто сейчас редактирует воркспейс (userId). */
+  editingBy?: Maybe<Scalars['ID']['output']>;
+  /** Email/имя того, кто редактирует (resolved). */
+  editingUser?: Maybe<User>;
   icon?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
+  /** Токен пригласительной ссылки (виден только владельцу). */
+  inviteToken?: Maybe<Scalars['String']['output']>;
+  /** Участники воркспейса (кроме владельца). */
+  members: Array<WorkspaceMember>;
   owner: User;
   pinned: Scalars['Boolean']['output'];
   /** Роадмап воркспейса (один на воркспейс). */
@@ -434,6 +493,14 @@ export type Workspace = {
   updatedAt: Scalars['DateTime']['output'];
 };
 
+export type WorkspaceMember = {
+  __typename?: 'WorkspaceMember';
+  id: Scalars['ID']['output'];
+  joinedAt: Scalars['DateTime']['output'];
+  user: User;
+  userId: Scalars['ID']['output'];
+};
+
 /** Воркспейс с агрегатами: выполнено / всего карточек. */
 export type WorkspaceStatsItem = {
   __typename?: 'WorkspaceStatsItem';
@@ -544,6 +611,7 @@ export type ResolversTypes = ResolversObject<{
   User: ResolverTypeWrapper<UserModel>;
   UserStats: ResolverTypeWrapper<UserStats>;
   Workspace: ResolverTypeWrapper<WorkspaceModel>;
+  WorkspaceMember: ResolverTypeWrapper<Omit<WorkspaceMember, 'user'> & { user: ResolversTypes['User'] }>;
   WorkspaceStatsItem: ResolverTypeWrapper<WorkspaceStatsItem>;
 }>;
 
@@ -572,6 +640,7 @@ export type ResolversParentTypes = ResolversObject<{
   User: UserModel;
   UserStats: UserStats;
   Workspace: WorkspaceModel;
+  WorkspaceMember: Omit<WorkspaceMember, 'user'> & { user: ResolversParentTypes['User'] };
   WorkspaceStatsItem: WorkspaceStatsItem;
 }>;
 
@@ -614,6 +683,8 @@ export interface DateTimeScalarConfig extends GraphQLScalarTypeConfig<ResolversT
 }
 
 export type MutationResolvers<ContextType = Context, ParentType extends ResolversParentTypes['Mutation'] = ResolversParentTypes['Mutation']> = ResolversObject<{
+  acceptInvite?: Resolver<ResolversTypes['Workspace'], ParentType, ContextType, RequireFields<MutationAcceptInviteArgs, 'token'>>;
+  acquireWorkspaceLock?: Resolver<ResolversTypes['Workspace'], ParentType, ContextType, RequireFields<MutationAcquireWorkspaceLockArgs, 'workspaceId'>>;
   createCard?: Resolver<ResolversTypes['Card'], ParentType, ContextType, RequireFields<MutationCreateCardArgs, 'input'>>;
   createColumn?: Resolver<ResolversTypes['Column'], ParentType, ContextType, RequireFields<MutationCreateColumnArgs, 'title' | 'workspaceId'>>;
   createRoadmap?: Resolver<ResolversTypes['Roadmap'], ParentType, ContextType, RequireFields<MutationCreateRoadmapArgs, 'title' | 'workspaceId'>>;
@@ -626,13 +697,18 @@ export type MutationResolvers<ContextType = Context, ParentType extends Resolver
   deleteRoadmapNode?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<MutationDeleteRoadmapNodeArgs, 'id'>>;
   deleteTool?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<MutationDeleteToolArgs, 'id'>>;
   deleteWorkspace?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<MutationDeleteWorkspaceArgs, 'id'>>;
+  generateInviteToken?: Resolver<ResolversTypes['Workspace'], ParentType, ContextType, RequireFields<MutationGenerateInviteTokenArgs, 'workspaceId'>>;
+  heartbeatWorkspaceLock?: Resolver<ResolversTypes['Workspace'], ParentType, ContextType, RequireFields<MutationHeartbeatWorkspaceLockArgs, 'workspaceId'>>;
   moveCard?: Resolver<ResolversTypes['Card'], ParentType, ContextType, RequireFields<MutationMoveCardArgs, 'id' | 'order'>>;
+  releaseWorkspaceLock?: Resolver<ResolversTypes['Workspace'], ParentType, ContextType, RequireFields<MutationReleaseWorkspaceLockArgs, 'workspaceId'>>;
+  removeWorkspaceMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<MutationRemoveWorkspaceMemberArgs, 'userId' | 'workspaceId'>>;
   reorderColumns?: Resolver<Array<ResolversTypes['Column']>, ParentType, ContextType, RequireFields<MutationReorderColumnsArgs, 'columnIds' | 'workspaceId'>>;
   reorderRoadmapNodes?: Resolver<Array<ResolversTypes['RoadmapNode']>, ParentType, ContextType, RequireFields<MutationReorderRoadmapNodesArgs, 'nodeIds' | 'roadmapId'>>;
   signIn?: Resolver<ResolversTypes['AuthPayload'], ParentType, ContextType, RequireFields<MutationSignInArgs, 'email' | 'password'>>;
   signOut?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
   signUp?: Resolver<ResolversTypes['AuthPayload'], ParentType, ContextType, RequireFields<MutationSignUpArgs, 'email' | 'password'>>;
   toggleWorkspacePinned?: Resolver<ResolversTypes['Workspace'], ParentType, ContextType, RequireFields<MutationToggleWorkspacePinnedArgs, 'id'>>;
+  transferWorkspaceLock?: Resolver<ResolversTypes['Workspace'], ParentType, ContextType, RequireFields<MutationTransferWorkspaceLockArgs, 'toUserId' | 'workspaceId'>>;
   updateCard?: Resolver<ResolversTypes['Card'], ParentType, ContextType, RequireFields<MutationUpdateCardArgs, 'id' | 'input'>>;
   updateColumn?: Resolver<ResolversTypes['Column'], ParentType, ContextType, RequireFields<MutationUpdateColumnArgs, 'id'>>;
   updateProfile?: Resolver<ResolversTypes['User'], ParentType, ContextType, Partial<MutationUpdateProfileArgs>>;
@@ -713,8 +789,12 @@ export type WorkspaceResolvers<ContextType = Context, ParentType extends Resolve
   columns?: Resolver<Array<ResolversTypes['Column']>, ParentType, ContextType>;
   createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
   description?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  editingBy?: Resolver<Maybe<ResolversTypes['ID']>, ParentType, ContextType>;
+  editingUser?: Resolver<Maybe<ResolversTypes['User']>, ParentType, ContextType>;
   icon?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
   id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  inviteToken?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  members?: Resolver<Array<ResolversTypes['WorkspaceMember']>, ParentType, ContextType>;
   owner?: Resolver<ResolversTypes['User'], ParentType, ContextType>;
   pinned?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
   roadmap?: Resolver<Maybe<ResolversTypes['Roadmap']>, ParentType, ContextType>;
@@ -723,6 +803,13 @@ export type WorkspaceResolvers<ContextType = Context, ParentType extends Resolve
   updatedAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
 }>;
 
+export type WorkspaceMemberResolvers<ContextType = Context, ParentType extends ResolversParentTypes['WorkspaceMember'] = ResolversParentTypes['WorkspaceMember']> = ResolversObject<{
+  id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  joinedAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
+  user?: Resolver<ResolversTypes['User'], ParentType, ContextType>;
+  userId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+}>;
+
 export type WorkspaceStatsItemResolvers<ContextType = Context, ParentType extends ResolversParentTypes['WorkspaceStatsItem'] = ResolversParentTypes['WorkspaceStatsItem']> = ResolversObject<{
   completedCards?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
   description?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
@@ -745,6 +832,7 @@ export type Resolvers<ContextType = Context> = ResolversObject<{
   User?: UserResolvers<ContextType>;
   UserStats?: UserStatsResolvers<ContextType>;
   Workspace?: WorkspaceResolvers<ContextType>;
+  WorkspaceMember?: WorkspaceMemberResolvers<ContextType>;
   WorkspaceStatsItem?: WorkspaceStatsItemResolvers<ContextType>;
 }>;
 
diff --git a/server/src/lib/constants.ts b/server/src/lib/constants.ts
index 6b0acb0..d9e0acc 100644
--- a/server/src/lib/constants.ts
+++ b/server/src/lib/constants.ts
@@ -16,6 +16,9 @@ export const MAX_CARDS_PER_USER = LIMITS.MAX_CARDS_PER_USER;
 export const MAX_TOOLS_PER_WORKSPACE = LIMITS.MAX_TOOLS_PER_WORKSPACE;
 export const MAX_COLUMNS_PER_WORKSPACE = LIMITS.MAX_COLUMNS_PER_WORKSPACE;
 
+// Workspace editing lock
+export const WORKSPACE_LOCK_TIMEOUT_MS = 30_000;
+
 // Rate limiting
 export const RATE_LIMIT_WINDOW_MS = 60 * 1000; // 1 minute
 export const RATE_LIMIT_MAX_REQUESTS = 100; // requests per window
diff --git a/server/src/lib/lock-middleware.ts b/server/src/lib/lock-middleware.ts
new file mode 100644
index 0000000..893b3a9
--- /dev/null
+++ b/server/src/lib/lock-middleware.ts
@@ -0,0 +1,188 @@
+/**
+ * Workspace lock middleware.
+ *
+ * Wraps every Mutation resolver: before calling the original resolver,
+ * resolves workspaceId from the mutation arguments and asserts that the
+ * calling user holds a valid editing lock on that workspace.
+ *
+ * Hub-only entities (cards/tools without workspaceId) are NOT checked —
+ * they belong to a single user and don't need locking.
+ */
+
+import type { PrismaClient } from '@prisma/client';
+import { assertWorkspaceLock } from './workspace-access.js';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type ResolverFn = (...args: any[]) => any;
+type ResolverMap = Record<string, ResolverFn>;
+
+interface MutationContext {
+  user?: { id: string } | null;
+  prisma: PrismaClient;
+}
+
+/** Mutations that should NEVER be lock-checked. */
+const SKIP_LOCK_CHECK = new Set([
+  // Auth
+  'signUp',
+  'signIn',
+  'signOut',
+  'updateProfile',
+  // Workspace lifecycle (not content editing)
+  'createWorkspace',
+  'deleteWorkspace',
+  'toggleWorkspacePinned',
+  // Sharing
+  'generateInviteToken',
+  'acceptInvite',
+  'removeWorkspaceMember',
+  // Lock management itself
+  'acquireWorkspaceLock',
+  'releaseWorkspaceLock',
+  'heartbeatWorkspaceLock',
+  'transferWorkspaceLock',
+]);
+
+/**
+ * Resolve workspaceId from mutation arguments.
+ *
+ * Strategy:
+ * 1. Direct arg: `workspaceId` or `input.workspaceId`
+ * 2. Column lookup: `id` → column.workspaceId
+ * 3. Card lookup: `id` / `input` → card.workspaceId
+ * 4. Tool lookup: `id` → tool.workspaceId
+ * 5. Roadmap/node lookup: `id` / `roadmapId` → roadmap.workspaceId
+ *
+ * Returns null if the entity is hub-only (no workspace) → skip lock check.
+ */
+async function resolveWorkspaceId(
+  mutationName: string,
+  args: Record<string, unknown>,
+  prisma: PrismaClient,
+): Promise<string | null> {
+  // Direct workspaceId arg (createColumn, reorderColumns, createRoadmap, etc.)
+  if (typeof args.workspaceId === 'string') return args.workspaceId;
+
+  // Input object with workspaceId (createCard, createTool)
+  const input = args.input as Record<string, unknown> | undefined;
+  if (input?.workspaceId && typeof input.workspaceId === 'string') return input.workspaceId;
+
+  // createCard may have columnId without explicit workspaceId — resolve via column
+  if (input?.columnId && typeof input.columnId === 'string' && !input.workspaceId) {
+    const col = await prisma.column.findUnique({
+      where: { id: input.columnId as string },
+      select: { workspaceId: true },
+    });
+    return col?.workspaceId ?? null;
+  }
+
+  // updateWorkspace uses `id` which IS the workspaceId
+  if (mutationName === 'updateWorkspace' && typeof args.id === 'string') return args.id;
+
+  const id = (args.id ?? input?.id) as string | undefined;
+
+  // Roadmap mutations — check early because some have roadmapId but no id
+  if (mutationName.toLowerCase().includes('roadmap')) {
+    return resolveRoadmapWorkspaceId(mutationName, args, id, prisma);
+  }
+
+  if (!id) return null;
+
+  // Column mutations (updateColumn, deleteColumn)
+  if (mutationName.toLowerCase().includes('column')) {
+    const col = await prisma.column.findUnique({
+      where: { id },
+      select: { workspaceId: true },
+    });
+    return col?.workspaceId ?? null;
+  }
+
+  // Card mutations (updateCard, deleteCard, moveCard)
+  if (mutationName.toLowerCase().includes('card')) {
+    const card = await prisma.card.findUnique({
+      where: { id },
+      select: { workspaceId: true },
+    });
+    return card?.workspaceId ?? null; // null = hub card, skip lock
+  }
+
+  // Tool mutations (updateTool, deleteTool)
+  if (mutationName.toLowerCase().includes('tool')) {
+    const tool = await prisma.tool.findUnique({
+      where: { id },
+      select: { workspaceId: true },
+    });
+    return tool?.workspaceId ?? null; // null = hub tool, skip lock
+  }
+
+  return null;
+}
+
+/** Resolve workspaceId for roadmap-related mutations. */
+async function resolveRoadmapWorkspaceId(
+  mutationName: string,
+  args: Record<string, unknown>,
+  id: string | undefined,
+  prisma: PrismaClient,
+): Promise<string | null> {
+  // Node mutations (updateRoadmapNode, deleteRoadmapNode) — `id` is node id
+  if ((mutationName === 'updateRoadmapNode' || mutationName === 'deleteRoadmapNode') && id) {
+    const node = await prisma.roadmapNode.findUnique({
+      where: { id },
+      select: { roadmap: { select: { workspaceId: true } } },
+    });
+    return node?.roadmap?.workspaceId ?? null;
+  }
+
+  // deleteRoadmap — `id` is roadmap id
+  if (mutationName === 'deleteRoadmap' && id) {
+    const rm = await prisma.roadmap.findUnique({
+      where: { id },
+      select: { workspaceId: true },
+    });
+    return rm?.workspaceId ?? null;
+  }
+
+  // Mutations with direct roadmapId arg: createRoadmapNode, reorderRoadmapNodes
+  const roadmapId = args.roadmapId as string | undefined;
+  if (roadmapId) {
+    const rm = await prisma.roadmap.findUnique({
+      where: { id: roadmapId },
+      select: { workspaceId: true },
+    });
+    return rm?.workspaceId ?? null;
+  }
+
+  return null;
+}
+
+/**
+ * Wrap all Mutation resolvers with workspace lock checking.
+ */
+export function withLockMiddleware(mutations: ResolverMap): ResolverMap {
+  const wrapped: ResolverMap = {};
+
+  for (const [name, resolver] of Object.entries(mutations)) {
+    if (SKIP_LOCK_CHECK.has(name)) {
+      wrapped[name] = resolver;
+      continue;
+    }
+
+    wrapped[name] = async (
+      parent: unknown,
+      args: Record<string, unknown>,
+      context: MutationContext,
+      info: unknown,
+    ) => {
+      if (context.user) {
+        const workspaceId = await resolveWorkspaceId(name, args, context.prisma);
+        if (workspaceId) {
+          await assertWorkspaceLock(context.prisma, workspaceId, context.user.id);
+        }
+      }
+      return resolver(parent, args, context, info);
+    };
+  }
+
+  return wrapped;
+}
diff --git a/server/src/lib/workspace-access.ts b/server/src/lib/workspace-access.ts
new file mode 100644
index 0000000..dc8f76e
--- /dev/null
+++ b/server/src/lib/workspace-access.ts
@@ -0,0 +1,59 @@
+import type { PrismaClient } from '@prisma/client';
+import { ForbiddenError } from './errors.js';
+import { WORKSPACE_LOCK_TIMEOUT_MS } from './constants.js';
+
+/**
+ * Check if a user can access a workspace (is owner or member).
+ * Returns true if the user has access, false otherwise.
+ */
+export async function hasWorkspaceAccess(
+  prisma: PrismaClient,
+  workspaceId: string,
+  userId: string,
+): Promise<boolean> {
+  const workspace = await prisma.workspace.findUnique({
+    where: { id: workspaceId },
+    select: { ownerId: true },
+  });
+  if (!workspace) return false;
+  if (workspace.ownerId === userId) return true;
+
+  const member = await prisma.workspaceMember.findUnique({
+    where: { workspaceId_userId: { workspaceId, userId } },
+    select: { id: true },
+  });
+  return !!member;
+}
+
+/**
+ * Assert that the user currently holds a valid (non-expired) editing lock
+ * on the given workspace. Throws ForbiddenError otherwise.
+ *
+ * Call this before any workspace-mutating operation (card/column/tool/roadmap CRUD).
+ */
+export async function assertWorkspaceLock(
+  prisma: PrismaClient,
+  workspaceId: string,
+  userId: string,
+): Promise<void> {
+  const ws = await prisma.workspace.findUnique({
+    where: { id: workspaceId },
+    select: { editingBy: true, editingAt: true },
+  });
+  if (!ws) return; // workspace not found — downstream resolver will throw NotFoundError
+
+  // No lock at all — nobody can edit
+  if (!ws.editingBy || !ws.editingAt) {
+    throw ForbiddenError('Никто не удерживает блокировку — редактирование невозможно');
+  }
+
+  // Lock expired
+  if (Date.now() - ws.editingAt.getTime() >= WORKSPACE_LOCK_TIMEOUT_MS) {
+    throw ForbiddenError('Блокировка истекла — обновите страницу');
+  }
+
+  // Lock held by someone else
+  if (ws.editingBy !== userId) {
+    throw ForbiddenError('Воркспейс редактирует другой пользователь');
+  }
+}
diff --git a/server/src/resolvers/card.ts b/server/src/resolvers/card.ts
index 53397ba..f97e5db 100644
--- a/server/src/resolvers/card.ts
+++ b/server/src/resolvers/card.ts
@@ -20,6 +20,7 @@ import type {
   LearningStatus
 } from '../generated/types.js';
 import type { Context } from '../lib/types.js';
+import { hasWorkspaceAccess } from '../lib/workspace-access.js';
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
@@ -150,7 +151,13 @@ export const cardResolvers = {
     card: async (_: unknown, { id }: QueryCardArgs, context: Context) => {
       if (!context.user) throw UnauthenticatedError();
       const card = await context.prisma.card.findUnique({ where: { id } });
-      if (!card || card.ownerId !== context.user.id) throw NotFoundError('Карточка не найдена');
+      if (!card) throw NotFoundError('Карточка не найдена');
+      // Owner always has access; for workspace cards, check membership
+      if (card.ownerId !== context.user.id) {
+        if (!card.workspaceId || !(await hasWorkspaceAccess(context.prisma, card.workspaceId, context.user.id))) {
+          throw NotFoundError('Карточка не найдена');
+        }
+      }
       return card;
     },
   },
@@ -178,17 +185,18 @@ export const cardResolvers = {
       let columnId: string | null = input.columnId ?? null;
 
       if (input.workspaceId) {
-        const ws = await context.prisma.workspace.findUnique({
-          where: { id: input.workspaceId },
-        });
-        if (!ws || ws.ownerId !== context.user.id) throw NotFoundError('Рабочее пространство не найдено');
+        if (!(await hasWorkspaceAccess(context.prisma, input.workspaceId, context.user.id))) {
+          throw NotFoundError('Рабочее пространство не найдено');
+        }
       }
       if (input.columnId) {
         const col = await context.prisma.column.findUnique({
           where: { id: input.columnId },
           include: { workspace: true },
         });
-        if (!col || col.workspace.ownerId !== context.user.id) throw NotFoundError('Колонка не найдена');
+        if (!col || !(await hasWorkspaceAccess(context.prisma, col.workspaceId, context.user.id))) {
+          throw NotFoundError('Колонка не найдена');
+        }
         workspaceId = col.workspaceId;
         columnId = input.columnId;
       }
@@ -232,7 +240,13 @@ export const cardResolvers = {
       }
 
       const card = await context.prisma.card.findUnique({ where: { id } });
-      if (!card || card.ownerId !== context.user.id) throw NotFoundError('Карточка не найдена');
+      if (!card) throw NotFoundError('Карточка не найдена');
+      // Check access: owner or workspace member
+      if (card.ownerId !== context.user.id) {
+        if (!card.workspaceId || !(await hasWorkspaceAccess(context.prisma, card.workspaceId, context.user.id))) {
+          throw NotFoundError('Карточка не найдена');
+        }
+      }
 
       const data: Prisma.CardUncheckedUpdateInput = {};
       if (input.title !== undefined) data.title = input.title;
@@ -244,7 +258,9 @@ export const cardResolvers = {
             where: { id: input.columnId },
             include: { workspace: true },
           });
-          if (!col || col.workspace.ownerId !== context.user.id) throw NotFoundError('Колонка не найдена');
+          if (!col || !(await hasWorkspaceAccess(context.prisma, col.workspaceId, context.user.id))) {
+            throw NotFoundError('Колонка не найдена');
+          }
           data.columnId = input.columnId;
           data.workspaceId = col.workspaceId;
         } else {
@@ -263,7 +279,12 @@ export const cardResolvers = {
     deleteCard: async (_: unknown, { id }: MutationDeleteCardArgs, context: Context) => {
       if (!context.user) throw UnauthenticatedError();
       const card = await context.prisma.card.findUnique({ where: { id } });
-      if (!card || card.ownerId !== context.user.id) throw NotFoundError('Карточка не найдена');
+      if (!card) throw NotFoundError('Карточка не найдена');
+      if (card.ownerId !== context.user.id) {
+        if (!card.workspaceId || !(await hasWorkspaceAccess(context.prisma, card.workspaceId, context.user.id))) {
+          throw NotFoundError('Карточка не найдена');
+        }
+      }
       await context.prisma.card.delete({ where: { id } });
 
       // Reorder remaining siblings to fill the gap
@@ -288,8 +309,12 @@ export const cardResolvers = {
     moveCard: async (_: unknown, { id, columnId, order }: MutationMoveCardArgs, context: Context) => {
       if (!context.user) throw UnauthenticatedError();
       const card = await context.prisma.card.findUnique({ where: { id } });
-      if (!card || card.ownerId !== context.user.id) throw NotFoundError('Карточка не найдена');
-
+      if (!card) throw NotFoundError('Карточка не найдена');
+      if (card.ownerId !== context.user.id) {
+        if (!card.workspaceId || !(await hasWorkspaceAccess(context.prisma, card.workspaceId, context.user.id))) {
+          throw NotFoundError('Карточка не найдена');
+        }
+      }
       // Determine target columnId and workspaceId
       let targetColumnId: string | null = card.columnId;
       let targetWorkspaceId: string | null = card.workspaceId;
@@ -299,7 +324,9 @@ export const cardResolvers = {
             where: { id: columnId },
             include: { workspace: true },
           });
-          if (!col || col.workspace.ownerId !== context.user.id) throw NotFoundError('Колонка не найдена');
+          if (!col || !(await hasWorkspaceAccess(context.prisma, col.workspaceId, context.user.id))) {
+            throw NotFoundError('Колонка не найдена');
+          }
           targetColumnId = columnId;
           targetWorkspaceId = col.workspaceId;
         } else {
diff --git a/server/src/resolvers/column.ts b/server/src/resolvers/column.ts
index 44fe5bf..578c0ff 100644
--- a/server/src/resolvers/column.ts
+++ b/server/src/resolvers/column.ts
@@ -7,6 +7,7 @@ import type {
 } from '../generated/types.js';
 import { UnauthenticatedError, NotFoundError, BadRequestError } from '../lib/errors.js';
 import { MAX_TITLE_LENGTH, MAX_COLUMNS_PER_WORKSPACE } from '../lib/constants.js';
+import { hasWorkspaceAccess } from '../lib/workspace-access.js';
 
 export const columnResolvers = {
   Mutation: {
@@ -22,12 +23,8 @@ export const columnResolvers = {
         throw BadRequestError(`Название слишком длинное (макс. ${MAX_TITLE_LENGTH} символов)`);
       }
 
-      // Verify workspace ownership
-      const workspace = await context.prisma.workspace.findUnique({
-        where: { id: workspaceId },
-      });
-
-      if (!workspace || workspace.ownerId !== context.user.id) {
+      // Verify workspace access (owner or member)
+      if (!(await hasWorkspaceAccess(context.prisma, workspaceId, context.user.id))) {
         throw NotFoundError('Рабочее пространство не найдено');
       }
 
@@ -73,7 +70,7 @@ export const columnResolvers = {
         include: { workspace: true },
       });
 
-      if (!column || column.workspace.ownerId !== context.user.id) {
+      if (!column || !(await hasWorkspaceAccess(context.prisma, column.workspaceId, context.user.id))) {
         throw NotFoundError('Колонка не найдена');
       }
 
@@ -98,7 +95,7 @@ export const columnResolvers = {
         include: { workspace: true },
       });
 
-      if (!column || column.workspace.ownerId !== context.user.id) {
+      if (!column || !(await hasWorkspaceAccess(context.prisma, column.workspaceId, context.user.id))) {
         throw NotFoundError('Колонка не найдена');
       }
 
@@ -118,12 +115,7 @@ export const columnResolvers = {
         throw UnauthenticatedError();
       }
 
-      // Verify workspace ownership
-      const workspace = await context.prisma.workspace.findUnique({
-        where: { id: workspaceId },
-      });
-
-      if (!workspace || workspace.ownerId !== context.user.id) {
+      if (!(await hasWorkspaceAccess(context.prisma, workspaceId, context.user.id))) {
         throw NotFoundError('Рабочее пространство не найдено');
       }
 
diff --git a/server/src/resolvers/index.ts b/server/src/resolvers/index.ts
index 267af9e..ecd0b38 100644
--- a/server/src/resolvers/index.ts
+++ b/server/src/resolvers/index.ts
@@ -7,6 +7,7 @@ import { userStatsResolvers } from './user-stats.js';
 import { roadmapResolvers } from './roadmap.js';
 import { DateTimeResolver } from 'graphql-scalars';
 import type { Context } from '../lib/types.js';
+import { withLockMiddleware } from '../lib/lock-middleware.js';
 
 export const resolvers = {
   DateTime: DateTimeResolver,
@@ -20,14 +21,14 @@ export const resolvers = {
     ...roadmapResolvers.Query,
   },
 
-  Mutation: {
+  Mutation: withLockMiddleware({
     ...authResolvers.Mutation,
     ...workspaceResolvers.Mutation,
     ...columnResolvers.Mutation,
     ...cardResolvers.Mutation,
     ...toolResolvers.Mutation,
     ...roadmapResolvers.Mutation,
-  },
+  }),
 
   User: {
     workspaces: (parent: { id: string }, _: unknown, context: Context) =>
diff --git a/server/src/resolvers/roadmap.ts b/server/src/resolvers/roadmap.ts
index 39068e4..48d8b5f 100644
--- a/server/src/resolvers/roadmap.ts
+++ b/server/src/resolvers/roadmap.ts
@@ -10,13 +10,15 @@ import type {
 } from '../generated/types.js';
 import { UnauthenticatedError, NotFoundError, BadRequestError } from '../lib/errors.js';
 import { LIMITS } from 'dayflow-shared';
+import { hasWorkspaceAccess } from '../lib/workspace-access.js';
 
 export const roadmapResolvers = {
   Query: {
     roadmap: async (_: unknown, { workspaceId }: QueryRoadmapArgs, context: Context) => {
       if (!context.user) throw UnauthenticatedError();
-      const workspace = await context.prisma.workspace.findUnique({ where: { id: workspaceId } });
-      if (workspace?.ownerId !== context.user.id) throw NotFoundError('Рабочее пространство не найдено');
+      if (!(await hasWorkspaceAccess(context.prisma, workspaceId, context.user.id))) {
+        throw NotFoundError('Рабочее пространство не найдено');
+      }
       return context.prisma.roadmap.findUnique({ where: { workspaceId } });
     },
   },
@@ -28,9 +30,9 @@ export const roadmapResolvers = {
       context: Context,
     ) => {
       if (!context.user) throw UnauthenticatedError();
-      const workspace = await context.prisma.workspace.findUnique({ where: { id: workspaceId } });
-      if (workspace?.ownerId !== context.user.id) throw NotFoundError('Рабочее пространство не найдено');
-
+      if (!(await hasWorkspaceAccess(context.prisma, workspaceId, context.user.id))) {
+        throw NotFoundError('Рабочее пространство не найдено');
+      }
       const existing = await context.prisma.roadmap.findUnique({ where: { workspaceId } });
       if (existing) throw BadRequestError('Роадмап для этого воркспейса уже существует');
 
@@ -47,7 +49,9 @@ export const roadmapResolvers = {
     deleteRoadmap: async (_: unknown, { id }: MutationDeleteRoadmapArgs, context: Context) => {
       if (!context.user) throw UnauthenticatedError();
       const roadmap = await context.prisma.roadmap.findUnique({ where: { id } });
-      if (roadmap?.ownerId !== context.user.id) throw NotFoundError('Роадмап не найден');
+      if (!roadmap || !(await hasWorkspaceAccess(context.prisma, roadmap.workspaceId, context.user.id))) {
+        throw NotFoundError('Роадмап не найден');
+      }
       await context.prisma.roadmap.delete({ where: { id } });
       return true;
     },
@@ -59,8 +63,9 @@ export const roadmapResolvers = {
     ) => {
       if (!context.user) throw UnauthenticatedError();
       const roadmap = await context.prisma.roadmap.findUnique({ where: { id: roadmapId } });
-      if (roadmap?.ownerId !== context.user.id) throw NotFoundError('Роадмап не найден');
-
+      if (!roadmap || !(await hasWorkspaceAccess(context.prisma, roadmap.workspaceId, context.user.id))) {
+        throw NotFoundError('Роадмап не найден');
+      }
       const totalNodes = await context.prisma.roadmapNode.count({ where: { roadmapId } });
       if (totalNodes >= LIMITS.MAX_ROADMAP_NODES) {
         throw BadRequestError(`Максимум ${LIMITS.MAX_ROADMAP_NODES} узлов в роадмапе`);
@@ -90,8 +95,9 @@ export const roadmapResolvers = {
         where: { id },
         include: { roadmap: true },
       });
-      if (!node || node.roadmap.ownerId !== context.user.id) throw NotFoundError('Узел не найден');
-
+      if (!node || !(await hasWorkspaceAccess(context.prisma, node.roadmap.workspaceId, context.user.id))) {
+        throw NotFoundError('Узел не найден');
+      }
       const data: { title?: string; done?: boolean } = {};
       if (title !== undefined && title !== null) data.title = title;
       if (done !== undefined && done !== null) data.done = done;
@@ -109,8 +115,9 @@ export const roadmapResolvers = {
         where: { id },
         include: { roadmap: true },
       });
-      if (!node || node.roadmap.ownerId !== context.user.id) throw NotFoundError('Узел не найден');
-
+      if (!node || !(await hasWorkspaceAccess(context.prisma, node.roadmap.workspaceId, context.user.id))) {
+        throw NotFoundError('Узел не найден');
+      }
       await context.prisma.roadmapNode.delete({ where: { id } });
 
       await context.prisma.roadmapNode.updateMany({
@@ -132,8 +139,9 @@ export const roadmapResolvers = {
     ) => {
       if (!context.user) throw UnauthenticatedError();
       const roadmap = await context.prisma.roadmap.findUnique({ where: { id: roadmapId } });
-      if (roadmap?.ownerId !== context.user.id) throw NotFoundError('Роадмап не найден');
-
+      if (!roadmap || !(await hasWorkspaceAccess(context.prisma, roadmap.workspaceId, context.user.id))) {
+        throw NotFoundError('Роадмап не найден');
+      }
       await context.prisma.$transaction(
         nodeIds.map((nodeId, index) =>
           context.prisma.roadmapNode.update({
diff --git a/server/src/resolvers/tool.ts b/server/src/resolvers/tool.ts
index 1a15e42..fc62254 100644
--- a/server/src/resolvers/tool.ts
+++ b/server/src/resolvers/tool.ts
@@ -8,6 +8,7 @@ import type {
 } from '../generated/types.js';
 import { UnauthenticatedError, NotFoundError, ForbiddenError, BadRequestError } from '../lib/errors.js';
 import { MAX_TOOLS_PER_WORKSPACE } from '../lib/constants.js';
+import { hasWorkspaceAccess } from '../lib/workspace-access.js';
 
 export const toolResolvers = {
   Query: {
@@ -39,11 +40,9 @@ export const toolResolvers = {
       if (!context.user) throw UnauthenticatedError();
 
       if (input.workspaceId) {
-        const workspace = await context.prisma.workspace.findUnique({
-          where: { id: input.workspaceId },
-        });
-        if (!workspace) throw NotFoundError('Рабочее пространство не найдено');
-        if (workspace.ownerId !== context.user.id) throw ForbiddenError('Нет доступа');
+        if (!(await hasWorkspaceAccess(context.prisma, input.workspaceId, context.user.id))) {
+          throw NotFoundError('Рабочее пространство не найдено');
+        }
       }
 
       // Check tool limit
@@ -76,8 +75,11 @@ export const toolResolvers = {
 
       const tool = await context.prisma.tool.findUnique({ where: { id } });
       if (!tool) throw NotFoundError('Инструмент не найден');
-      if (tool.ownerId !== context.user.id) throw ForbiddenError('Нет доступа');
-
+      if (tool.ownerId !== context.user.id) {
+        if (!tool.workspaceId || !(await hasWorkspaceAccess(context.prisma, tool.workspaceId, context.user.id))) {
+          throw ForbiddenError('Нет доступа');
+        }
+      }
       const data: Prisma.ToolUpdateInput = {};
       if (input.title !== undefined) data.title = input.title ?? undefined;
       if (input.link !== undefined) data.link = input.link;
@@ -96,8 +98,11 @@ export const toolResolvers = {
 
       const tool = await context.prisma.tool.findUnique({ where: { id } });
       if (!tool) throw NotFoundError('Инструмент не найден');
-      if (tool.ownerId !== context.user.id) throw ForbiddenError('Нет доступа');
-
+      if (tool.ownerId !== context.user.id) {
+        if (!tool.workspaceId || !(await hasWorkspaceAccess(context.prisma, tool.workspaceId, context.user.id))) {
+          throw ForbiddenError('Нет доступа');
+        }
+      }
       await context.prisma.tool.delete({ where: { id } });
       return true;
     },
diff --git a/server/src/resolvers/workspace.ts b/server/src/resolvers/workspace.ts
index b0f6620..a6f6590 100644
--- a/server/src/resolvers/workspace.ts
+++ b/server/src/resolvers/workspace.ts
@@ -1,3 +1,5 @@
+import { randomBytes } from 'crypto';
+import type { Workspace } from '@prisma/client';
 import type { Context } from '../lib/types.js';
 import type {
   MutationCreateWorkspaceArgs,
@@ -7,23 +9,60 @@ import type {
   QueryWorkspaceArgs,
 } from '../generated/types.js';
 import { UnauthenticatedError, NotFoundError, BadRequestError } from '../lib/errors.js';
-import { MAX_TITLE_LENGTH, MAX_WORKSPACES_PER_USER } from '../lib/constants.js';
+import { MAX_TITLE_LENGTH, MAX_WORKSPACES_PER_USER, WORKSPACE_LOCK_TIMEOUT_MS } from '../lib/constants.js';
+
+/** Check if user is owner or member of workspace */
+async function canAccess(
+  prisma: Context['prisma'],
+  workspaceId: string,
+  userId: string,
+): Promise<Workspace | null> {
+  const workspace = await prisma.workspace.findUnique({ where: { id: workspaceId } });
+  if (!workspace) return null;
+  if (workspace.ownerId === userId) return workspace;
+  const membership = await prisma.workspaceMember.findUnique({
+    where: { workspaceId_userId: { workspaceId, userId } },
+  });
+  return membership ? workspace : null;
+}
+
+function generateToken(): string {
+  return randomBytes(24).toString('base64url');
+}
 
 export const workspaceResolvers = {
   Query: {
     workspace: async (_: unknown, { id }: QueryWorkspaceArgs, context: Context) => {
       if (!context.user) throw UnauthenticatedError();
-      const workspace = await context.prisma.workspace.findUnique({ where: { id } });
-      if (!workspace || workspace.ownerId !== context.user.id) return null;
-      return workspace;
+      return canAccess(context.prisma, id, context.user.id);
     },
 
     myWorkspaces: async (_: unknown, __: unknown, context: Context) => {
       if (!context.user) throw UnauthenticatedError();
-      return context.prisma.workspace.findMany({
-        where: { ownerId: context.user.id },
-        orderBy: { createdAt: 'desc' },
-      });
+      const userId = context.user.id;
+
+      // Own workspaces + workspaces where user is a member + per-user pins
+      const [owned, memberships, pins] = await Promise.all([
+        context.prisma.workspace.findMany({
+          where: { ownerId: userId },
+          orderBy: { createdAt: 'desc' },
+        }),
+        context.prisma.workspaceMember.findMany({
+          where: { userId },
+          include: { workspace: true },
+        }),
+        context.prisma.userWorkspacePin.findMany({
+          where: { userId },
+          select: { workspaceId: true },
+        }),
+      ]);
+
+      const pinnedIds = new Set(pins.map((p) => p.workspaceId));
+      const memberWorkspaces = memberships.map((m) => m.workspace);
+      const ownedIds = new Set(owned.map((w) => w.id));
+      const all = [...owned, ...memberWorkspaces.filter((w) => !ownedIds.has(w.id))];
+      // Annotate _pinnedByUser so the field resolver can skip a DB query
+      return all.map((w) => ({ ...w, _pinnedByUser: pinnedIds.has(w.id) }));
     },
   },
 
@@ -31,14 +70,13 @@ export const workspaceResolvers = {
     createWorkspace: async (
       _: unknown,
       { input }: MutationCreateWorkspaceArgs,
-      context: Context
+      context: Context,
     ) => {
       if (!context.user) throw UnauthenticatedError();
       if (input.title && input.title.length > MAX_TITLE_LENGTH) {
         throw BadRequestError(`Название слишком длинное (макс. ${MAX_TITLE_LENGTH} символов)`);
       }
 
-      // Check workspace limit
       const workspaceCount = await context.prisma.workspace.count({
         where: { ownerId: context.user.id },
       });
@@ -63,14 +101,15 @@ export const workspaceResolvers = {
     updateWorkspace: async (
       _: unknown,
       { id, input }: MutationUpdateWorkspaceArgs,
-      context: Context
+      context: Context,
     ) => {
       if (!context.user) throw UnauthenticatedError();
       if (input.title && input.title.length > MAX_TITLE_LENGTH) {
         throw BadRequestError(`Название слишком длинное (макс. ${MAX_TITLE_LENGTH} символов)`);
       }
       const workspace = await context.prisma.workspace.findUnique({ where: { id } });
-      if (!workspace || workspace.ownerId !== context.user.id) throw NotFoundError('Рабочее пространство не найдено');
+      if (!workspace || workspace.ownerId !== context.user.id)
+        throw NotFoundError('Рабочее пространство не найдено');
       const data: { title?: string; description?: string | null; icon?: string | null } = {};
       if (input.title != null) data.title = input.title;
       if (input.description !== undefined) data.description = input.description ?? null;
@@ -78,54 +117,278 @@ export const workspaceResolvers = {
       return context.prisma.workspace.update({ where: { id }, data });
     },
 
-    deleteWorkspace: async (_: unknown, { id }: MutationDeleteWorkspaceArgs, context: Context) => {
+    deleteWorkspace: async (
+      _: unknown,
+      { id }: MutationDeleteWorkspaceArgs,
+      context: Context,
+    ) => {
       if (!context.user) throw UnauthenticatedError();
       const workspace = await context.prisma.workspace.findUnique({ where: { id } });
-      if (!workspace || workspace.ownerId !== context.user.id) throw NotFoundError('Рабочее пространство не найдено');
+      if (!workspace || workspace.ownerId !== context.user.id)
+        throw NotFoundError('Рабочее пространство не найдено');
       await context.prisma.workspace.delete({ where: { id } });
       return true;
     },
 
-    toggleWorkspacePinned: async (_: unknown, { id }: MutationToggleWorkspacePinnedArgs, context: Context) => {
+    toggleWorkspacePinned: async (
+      _: unknown,
+      { id }: MutationToggleWorkspacePinnedArgs,
+      context: Context,
+    ) => {
       if (!context.user) throw UnauthenticatedError();
-      const workspace = await context.prisma.workspace.findUnique({ where: { id } });
-      if (!workspace || workspace.ownerId !== context.user.id) throw NotFoundError('Рабочее пространство не найдено');
+      const ws = await canAccess(context.prisma, id, context.user.id);
+      if (!ws) throw NotFoundError('Рабочее пространство не найдено');
+
+      const userId = context.user.id;
+      const existing = await context.prisma.userWorkspacePin.findUnique({
+        where: { userId_workspaceId: { userId, workspaceId: id } },
+      });
+
+      if (existing) {
+        await context.prisma.userWorkspacePin.delete({
+          where: { id: existing.id },
+        });
+      } else {
+        await context.prisma.userWorkspacePin.create({
+          data: { userId, workspaceId: id },
+        });
+      }
+
+      // Return workspace — pinned will be resolved per-user by the field resolver
+      return ws;
+    },
+
+    // ── Sharing ────────────────────────────────────────────────────────────────
+
+    generateInviteToken: async (
+      _: unknown,
+      { workspaceId }: { workspaceId: string },
+      context: Context,
+    ) => {
+      if (!context.user) throw UnauthenticatedError();
+      const workspace = await context.prisma.workspace.findUnique({
+        where: { id: workspaceId },
+      });
+      if (!workspace || workspace.ownerId !== context.user.id)
+        throw NotFoundError('Рабочее пространство не найдено');
+
       return context.prisma.workspace.update({
-        where: { id },
-        data: { pinned: !workspace.pinned },
+        where: { id: workspaceId },
+        data: { inviteToken: generateToken() },
+      });
+    },
+
+    acceptInvite: async (
+      _: unknown,
+      { token }: { token: string },
+      context: Context,
+    ) => {
+      if (!context.user) throw UnauthenticatedError();
+
+      const workspace = await context.prisma.workspace.findUnique({
+        where: { inviteToken: token },
+      });
+      if (!workspace) throw NotFoundError('Ссылка недействительна');
+
+      // Owner doesn't need to join
+      if (workspace.ownerId === context.user.id) return workspace;
+
+      // Upsert membership (idempotent)
+      await context.prisma.workspaceMember.upsert({
+        where: {
+          workspaceId_userId: {
+            workspaceId: workspace.id,
+            userId: context.user.id,
+          },
+        },
+        create: { workspaceId: workspace.id, userId: context.user.id },
+        update: {},
+      });
+
+      return workspace;
+    },
+
+    removeWorkspaceMember: async (
+      _: unknown,
+      { workspaceId, userId }: { workspaceId: string; userId: string },
+      context: Context,
+    ) => {
+      if (!context.user) throw UnauthenticatedError();
+      const workspace = await context.prisma.workspace.findUnique({
+        where: { id: workspaceId },
+      });
+      if (!workspace || workspace.ownerId !== context.user.id)
+        throw NotFoundError('Рабочее пространство не найдено');
+
+      await context.prisma.workspaceMember.deleteMany({
+        where: { workspaceId, userId },
+      });
+      return true;
+    },
+
+    // ── Editing lock ──────────────────────────────────────────────────────────
+
+    acquireWorkspaceLock: async (
+      _: unknown,
+      { workspaceId }: { workspaceId: string },
+      context: Context,
+    ) => {
+      if (!context.user) throw UnauthenticatedError();
+      const ws = await canAccess(context.prisma, workspaceId, context.user.id);
+      if (!ws) throw NotFoundError('Рабочее пространство не найдено');
+
+      const userId = context.user.id;
+      const now = new Date();
+      const expiredBefore = new Date(Date.now() - WORKSPACE_LOCK_TIMEOUT_MS);
+
+      // Atomic conditional update: succeed only if lock is free, expired, or already ours
+      const result = await context.prisma.workspace.updateMany({
+        where: {
+          id: workspaceId,
+          OR: [
+            { editingBy: null },                         // no lock
+            { editingBy: userId },                       // already ours
+            { editingAt: { lt: expiredBefore } },        // expired lock
+          ],
+        },
+        data: { editingBy: userId, editingAt: now },
+      });
+
+      if (result.count === 0) {
+        throw BadRequestError('Воркспейс сейчас редактирует другой пользователь');
+      }
+
+      return context.prisma.workspace.findUnique({ where: { id: workspaceId } });
+    },
+
+    releaseWorkspaceLock: async (
+      _: unknown,
+      { workspaceId }: { workspaceId: string },
+      context: Context,
+    ) => {
+      if (!context.user) throw UnauthenticatedError();
+      const ws = await canAccess(context.prisma, workspaceId, context.user.id);
+      if (!ws) throw NotFoundError('Рабочее пространство не найдено');
+
+      // Only the lock holder can release
+      if (ws.editingBy !== context.user.id) return ws;
+
+      return context.prisma.workspace.update({
+        where: { id: workspaceId },
+        data: { editingBy: null, editingAt: null },
+      });
+    },
+
+    transferWorkspaceLock: async (
+      _: unknown,
+      { workspaceId, toUserId }: { workspaceId: string; toUserId: string },
+      context: Context,
+    ) => {
+      if (!context.user) throw UnauthenticatedError();
+      const ws = await canAccess(context.prisma, workspaceId, context.user.id);
+      if (!ws) throw NotFoundError('Рабочее пространство не найдено');
+
+      // Only the current lock holder can transfer
+      if (ws.editingBy !== context.user.id) {
+        throw BadRequestError('Вы не удерживаете блокировку');
+      }
+
+      // Verify target user has access
+      const targetAccess = await canAccess(context.prisma, workspaceId, toUserId);
+      if (!targetAccess) {
+        throw NotFoundError('Целевой пользователь не имеет доступа к воркспейсу');
+      }
+
+      return context.prisma.workspace.update({
+        where: { id: workspaceId },
+        data: { editingBy: toUserId, editingAt: new Date() },
+      });
+    },
+
+    heartbeatWorkspaceLock: async (
+      _: unknown,
+      { workspaceId }: { workspaceId: string },
+      context: Context,
+    ) => {
+      if (!context.user) throw UnauthenticatedError();
+      const ws = await canAccess(context.prisma, workspaceId, context.user.id);
+      if (!ws) throw NotFoundError('Рабочее пространство не найдено');
+
+      // Only extend if we hold the lock
+      if (ws.editingBy !== context.user.id) return ws;
+
+      return context.prisma.workspace.update({
+        where: { id: workspaceId },
+        data: { editingAt: new Date() },
       });
     },
   },
 
   Workspace: {
-    owner: (parent: { ownerId: string }, _: unknown, context: Context) =>
+    // Per-user pinned: use annotation from myWorkspaces, or query DB for single fetch
+    pinned: async (parent: Workspace & { _pinnedByUser?: boolean }, _: unknown, context: Context) => {
+      if (typeof parent._pinnedByUser === 'boolean') return parent._pinnedByUser;
+      if (!context.user) return false;
+      const pin = await context.prisma.userWorkspacePin.findUnique({
+        where: { userId_workspaceId: { userId: context.user.id, workspaceId: parent.id } },
+      });
+      return !!pin;
+    },
+    owner: (parent: Workspace, _: unknown, context: Context) =>
       context.loaders.userById.load(parent.ownerId),
-    columns: (parent: { id: string }, _: unknown, context: Context) =>
+    // inviteToken: only visible to owner
+    inviteToken: (parent: Workspace, _: unknown, context: Context) => {
+      if (!context.user || parent.ownerId !== context.user.id) return null;
+      return parent.inviteToken;
+    },
+    // Resolve editingBy: clear expired locks transparently
+    editingBy: (parent: Workspace) => {
+      if (
+        parent.editingBy &&
+        parent.editingAt &&
+        Date.now() - parent.editingAt.getTime() < WORKSPACE_LOCK_TIMEOUT_MS
+      ) {
+        return parent.editingBy;
+      }
+      return null;
+    },
+    editingUser: async (parent: Workspace, _: unknown, context: Context) => {
+      if (
+        !parent.editingBy ||
+        !parent.editingAt ||
+        Date.now() - parent.editingAt.getTime() >= WORKSPACE_LOCK_TIMEOUT_MS
+      ) {
+        return null;
+      }
+      return context.loaders.userById.load(parent.editingBy);
+    },
+    members: (parent: Workspace, _: unknown, context: Context) =>
+      context.prisma.workspaceMember.findMany({
+        where: { workspaceId: parent.id },
+        include: { user: true },
+      }),
+    columns: (parent: Workspace, _: unknown, context: Context) =>
       context.loaders.columnsByWorkspaceId.load(parent.id),
-    cards: (parent: { id: string }, _: unknown, context: Context) =>
+    cards: (parent: Workspace, _: unknown, context: Context) =>
       context.loaders.cardsByWorkspaceId.load(parent.id),
-    backlog: async (parent: { id: string }, _: unknown, context: Context) => {
+    backlog: async (parent: Workspace, _: unknown, context: Context) => {
       if (!context.user) return [];
       return context.prisma.card.findMany({
         where: {
           workspaceId: parent.id,
           columnId: null,
-          ownerId: context.user.id,
         },
         orderBy: [{ order: 'asc' }, { createdAt: 'desc' }],
       });
     },
-    tools: async (parent: { id: string }, _: unknown, context: Context) => {
+    tools: async (parent: Workspace, _: unknown, context: Context) => {
       if (!context.user) return [];
       return context.prisma.tool.findMany({
-        where: {
-          workspaceId: parent.id,
-          ownerId: context.user.id,
-        },
+        where: { workspaceId: parent.id },
         orderBy: { createdAt: 'desc' },
       });
     },
-    roadmap: async (parent: { id: string }, _: unknown, context: Context) => {
+    roadmap: async (parent: Workspace, _: unknown, context: Context) => {
       if (!context.user) return null;
       return context.prisma.roadmap.findUnique({
         where: { workspaceId: parent.id },
diff --git a/server/src/schema/schema.graphql b/server/src/schema/schema.graphql
index df044ff..8e3df3c 100644
--- a/server/src/schema/schema.graphql
+++ b/server/src/schema/schema.graphql
@@ -14,9 +14,17 @@ type Workspace {
   description: String
   icon: String
   pinned: Boolean!
+  """Токен пригласительной ссылки (виден только владельцу)."""
+  inviteToken: String
+  """Кто сейчас редактирует воркспейс (userId)."""
+  editingBy: ID
+  """Email/имя того, кто редактирует (resolved)."""
+  editingUser: User
   createdAt: DateTime!
   updatedAt: DateTime!
   owner: User!
+  """Участники воркспейса (кроме владельца)."""
+  members: [WorkspaceMember!]!
   columns: [Column!]!
   cards: [Card!]!
   """Карточки воркспейса без колонки (backlog)."""
@@ -27,6 +35,13 @@ type Workspace {
   roadmap: Roadmap
 }
 
+type WorkspaceMember {
+  id: ID!
+  userId: ID!
+  user: User!
+  joinedAt: DateTime!
+}
+
 type Column {
   id: ID!
   title: String!
@@ -229,6 +244,24 @@ type Mutation {
   deleteWorkspace(id: ID!): Boolean!
   toggleWorkspacePinned(id: ID!): Workspace!
 
+  # Workspace sharing
+  """Сгенерировать (или перегенерировать) пригласительную ссылку."""
+  generateInviteToken(workspaceId: ID!): Workspace!
+  """Принять приглашение по токену. Возвращает воркспейс."""
+  acceptInvite(token: String!): Workspace!
+  """Удалить участника из воркспейса (только владелец)."""
+  removeWorkspaceMember(workspaceId: ID!, userId: ID!): Boolean!
+
+  # Workspace editing lock
+  """Захватить лок на редактирование воркспейса."""
+  acquireWorkspaceLock(workspaceId: ID!): Workspace!
+  """Отпустить лок."""
+  releaseWorkspaceLock(workspaceId: ID!): Workspace!
+  """Heartbeat — продлить лок (вызывать каждые ~15с)."""
+  heartbeatWorkspaceLock(workspaceId: ID!): Workspace!
+  """Передать права редактирования другому участнику."""
+  transferWorkspaceLock(workspaceId: ID!, toUserId: ID!): Workspace!
+
   # Column
   createColumn(workspaceId: ID!, title: String!): Column!
   updateColumn(id: ID!, title: String, hideCompleted: Boolean, color: String): Column!