diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 1bb0750..f194e3f 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -19,6 +19,7 @@ reverse.
 
 ## 2026-08-27
 
+- An owner password for shared plans recorded as planned: creating a document returns it once, management will bind to it, an admin can reclaim
 - Shared documents are left, not deleted: their row shows a leave action with its own icon and wording — the document stays on the server, and its link lands on the clipboard
 - The document menu's groups are named Included, Local and Shared now — "yours" and "sources" said less than where a document lives
 - Documents are stored one key each now, with a small index: a full storage no longer blocks every save, and one corrupted entry costs one document instead of all
diff --git a/docs/examples/werkbaum.werkbaum b/docs/examples/werkbaum.werkbaum
index b560258..3919834 100644
--- a/docs/examples/werkbaum.werkbaum
+++ b/docs/examples/werkbaum.werkbaum
@@ -153,6 +153,7 @@
       - [^] #col.live.ask: On a real overlap, ask whose version wins (S)
       - [^] #col.live.upload: Share: put a local plan on the server (S)  %% a button in the editor title bar, see D81
       - [?] #col.live.cursors: Cursors and who else is here (S)
+      - [ ] #col.live.owner: An owner password guards managing a shared plan (M)  %% returned once on creation, admin can reclaim
       - [-] #col.live.ws: Transport over a websocket (S)  %% plain HTTP turned out to be enough
       - [-] #col.live.own: A merge algorithm of our own (XL)  %% solved problem, do not reinvent
   - [?] #mmd: Mermaid plugin (XL)
@@ -910,6 +911,13 @@
   their only copy to a server should not lose it in the act. The picker names
   the host beside a server document, so the two entries are told apart.
 
+#col.live.owner
+  Today the unguessable link is the only guard, so holding it means holding
+  everything, delete included. Creating a document shall return an owner
+  password once — save it, the browser keeps a copy, there is no recovery on
+  another browser. Management actions bind to it; an admin with the master
+  password can still reclaim a document.
+
 #col.live.cursors
   Seeing where the others are. A by-product of the merge layer rather than a
   feature in its own right.