docs(teams): fill gaps from product overview, fix --visibility semantics

Teams about page (4.teams/1.about.md)
- Stronger intro: knowledge isn't confined to one person; teammates and
  their AI assistants share the same workspace.
- Clarify in the subscription note that joining a team doesn't change
  existing personal cloud or local setups.
- New 'Working together in real time' section: CRDT/Yjs editing,
  presence avatars with distinct colors.
- New 'AI agents as collaborators' subsection (tagged Coming soon)
  with live status indicators.
- New 'Activity feed' note.
- New 'File history -- undo on the file level' section, cross-linked
  to /cloud/file-history and /cloud/restore-lost-content.
- Rewrite 'Sharing projects' as a Standard / Shared / Private table
  using correct CLI visibility values.
- Add 14-day grace period for seat overages to Seats and billing.
- New 'Security and isolation' section: per-org isolated DB and
  storage, WorkOS AuthKit.

CLI Reference (9.reference/1.cli-reference.md)
- Fix --visibility semantics. 'workspace' is the default and is
  visible to all members; 'shared' is restricted to granted users;
  'private' is creator-only. Previous example labeled 'shared' as
  'visible to everyone,' which was the opposite of its behavior.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: phernandez

content/4.teams/1.about.md

@@ -3,10 +3,10 @@ title: Basic Memory Teams
 description: Share a cloud workspace with your team — invite members, assign roles, and collaborate on the same projects.
 ---
 
-Basic Memory Teams lets you share a cloud workspace with other people. Everyone on the team can read and write the same projects, so your AI assistant and your teammates work from one shared knowledge base instead of scattered copies.
+Basic Memory Teams gives your team a single, shared cloud workspace. Knowledge isn't confined to one person — anything a teammate writes is immediately available to everyone else and to their AI assistants. Edit a note together in real time, hand work off between humans and agents, and build one connected knowledge base instead of scattered copies.
 
 ::note{icon="i-lucide-users"}
-**Teams requires a subscription with one or more seats.** Billing is per seat. You can keep your personal and local workspaces at the same time — Teams adds a shared workspace, it doesn't replace what you already have.
+**Teams requires a subscription with one or more seats.** Billing is per seat. Joining or starting a team doesn't change anything about your existing setup — your personal cloud subscription (if you have one) and any local projects keep working exactly as before. Teams adds an organization workspace alongside them.
 ::
 
 ---
@@ -46,6 +46,32 @@ Members also have a **status**:
 
 ---
 
+## Working together in real time
+
+When two people open the same note, they see each other's edits as they happen. The editor is built on CRDTs (Yjs), so every keystroke syncs instantly across collaborators with no merge conflicts to resolve. A presence avatar appears in the note header for each active collaborator — each one gets a distinct color so you can tell at a glance who's typing where.
+
+### AI agents as collaborators
+
+::note{icon="i-lucide-sparkles"}
+**Coming soon.** AI agents will join as first-class collaborators alongside your team.
+::
+
+Once available, you'll connect an agent to a note and it shows up in the same presence list as your teammates with a live status indicator — _working_, _just updated_, or _waiting for input_. Agents read the shared knowledge graph for context and write structured observations and relations back into it, so the more your team uses Basic Memory, the better your AI gets at answering from your team's actual knowledge.
+
+### Activity feed
+
+The **Activity** view in the app keeps you aware of what's happening across the workspace. It shows operations in progress (imports, indexing, large edits) and recent completed changes — from every team member and agent — with direct links to the affected notes.
+
+---
+
+## File history — undo on the file level
+
+Every save creates a new version of a note, automatically. If a teammate overwrites something or an agent edits go sideways, open **File history** on the note to step back through the timeline, compare any version against the current one, and merge content back in. Restored content saves as a _new_ version, so nothing is ever lost.
+
+See [File History](/cloud/file-history) for the full reference, or [Restore Lost Content](/cloud/restore-lost-content) for the broader recovery decision guide (File history for a single note, Snapshots for bigger rollbacks).
+
+---
+
 ## Inviting members
 
 Owners invite people by email from **Settings → Teams**.
@@ -104,6 +130,7 @@ Teams billing is **per seat**. The number of seats on your subscription sets how
 - Deactivating a member frees their seat for someone else.
 - Reactivating a member requires an available seat.
 - Pending invitations don't consume a seat until they're accepted.
+- If your team grows past your current seat allocation, there's a **14-day grace period** before any restrictions kick in — so a new hire never gets locked out while you're adding seats.
 
 Manage seats and payment from **Settings → Billing**.
 
@@ -117,24 +144,30 @@ Track current seat usage from the same screen:
 
 ---
 
-## Sharing projects
+## Projects
 
-Within an organization workspace, projects can be shared with different levels of access:
+Team projects come in three visibilities. The right one depends on who needs to see the work:
 
-- **View** — members can read the project's notes.
-- **Edit** — members can read and write the project's notes.
+| Visibility | Who can see it | When to use |
+|------------|----------------|-------------|
+| **Standard** (`workspace`) — _default_ | Everyone in the organization, based on their workspace role (viewer/editor/owner) | Most team work — the open, shared knowledge base |
+| **Shared** (`shared`) | Only people you grant access to, each at **editor** or **viewer** level | Sensitive topics (hiring, contracts, security audits) where you want a controlled group |
+| **Private** (`private`) | Only the creator | Personal scratch space inside the team workspace |
 
-When creating a cloud project from the CLI, you can set its visibility at creation time:
+When you create a cloud project, you can set its visibility from the CLI:
 
 ```bash
-# Visible to everyone in the workspace
-bm project add team-wiki --cloud --workspace acme --visibility shared
+# Standard — visible to everyone in the team workspace (default)
+bm project add team-wiki --cloud --workspace acme --visibility workspace
 
-# Private to you
-bm project add my-notes --cloud --workspace acme --visibility private
+# Shared — only people you grant access to
+bm project add hiring-2026 --cloud --workspace acme --visibility shared
+
+# Private — just you
+bm project add my-scratch --cloud --workspace acme --visibility private
 ```
 
-Visibility values are `workspace`, `shared`, or `private`. See the [CLI Reference](/reference/cli-reference) for full `bm project add` options.
+See the [CLI Reference](/reference/cli-reference) for full `bm project add` options.
 
 ---
 
@@ -168,6 +201,12 @@ You can also target a specific workspace when creating a project, either from th
 
 ---
 
+## Security and isolation
+
+Each organization gets its **own** isolated database and file storage in the cloud — there is no shared tenancy at the data layer. Your team's knowledge is physically separated from every other team's. Authentication runs through [WorkOS AuthKit](https://workos.com/authkit) for enterprise-grade identity management.
+
+---
+
 ## Next Steps
 
 :::card-group

content/9.reference/1.cli-reference.md

@@ -219,8 +219,11 @@ bm project add research --cloud
 # Cloud project with local sync path
 bm project add research --cloud --local-path ~/docs
 
-# Cloud project in a specific workspace, shared with the team
-bm project add team-wiki --cloud --workspace acme --visibility shared
+# Cloud project in a specific team workspace, visible to all members
+bm project add team-wiki --cloud --workspace acme --visibility workspace
+
+# Cloud project restricted to specific people you grant access to
+bm project add hiring --cloud --workspace acme --visibility shared
 
 # Add and set as default
 bm project add research ~/Documents/research --default
@@ -230,7 +233,7 @@ bm project add research ~/Documents/research --default
 |------|-------------|
 | `--local-path` | Local sync path for cloud mode |
 | `--workspace` | Cloud workspace name, slug, type, or tenant ID (cloud mode only) |
-| `--visibility` | Cloud project visibility: `workspace`, `shared`, or `private` |
+| `--visibility` | Cloud project visibility: `workspace` (default — visible to all members), `shared` (restricted to granted users), or `private` (creator only) |
 | `--default` | Set as default project |
 | `--local` | Force local routing |
 | `--cloud` | Force cloud routing |