@@ -39,7 +39,9 @@ asyncio.run(main())
 ## PEP 249 Compliance
 
 - `apilevel = "2.0"`
-- `threadsafety = 1`
+- `threadsafety = 2` (capability ceiling; default `check_same_thread=True`
+  enforces strict per-thread — matches stdlib sqlite3's "advertise
+  ceiling, default to floor" pattern)
 - `paramstyle = "qmark"`
 
 ## Transactions
@@ -206,10 +208,16 @@ borrowed from one.
   stdlib silently accepts empty / whitespace-only / comment-only SQL
   as a no-op; the driver pre-flight rejects per PEP 249 §7 to surface
   caller bugs at the call site.
-- **`threadsafety = 1`** (stdlib reports `3`). Each Connection is
-  thread-affine: methods called from a foreign thread raise
-  `ProgrammingError`. Use one Connection per thread or use the async
-  surface for a single-thread-per-loop model.
+- **`threadsafety = 2`** (stdlib reports `3` — we don't claim Tier 3
+  because cursors aren't shareable per the documented "share
+  connections, not cursors" contract). Tier 2 = "threads may share
+  the module AND connections"; matches the dbapi's
+  ``check_same_thread=False`` opt-in behaviour. Default
+  ``check_same_thread=True`` enforces strict per-thread; methods
+  called from a foreign thread on a default-mode Connection raise
+  ``ProgrammingError``. Tier 3 (cursor sharing) is tracked as
+  future work in
+  ``issues/dbapi-threadsafety-tier-3-cursor-sharing-stdlib-parity.md``.
 - **No `executescript` / `create_function` / `create_aggregate` /
   `create_window_function` / `iterdump` / `backup` / `set_authorizer`
   / `serialize` / `blobopen`.** stdlib-specific APIs that have no
 
@@ -107,14 +107,38 @@ class aliases as in stdlib ``sqlite3.dbapi2``), so they raise PEP
 
 # PEP 249 module-level attributes
 apilevel: _Final[_Literal["2.0"]] = "2.0"
-# PEP 249 value 1: threads may share the module.
+# PEP 249 value 2: threads may share the module and connections.
 #
-# This driver is stricter than the PEP minimum: each Connection is
-# bound to the thread that created it. Any method call from a
-# different thread raises ProgrammingError. Use one Connection per
-# thread, or use the async API (dqlitedbapi.aio.aconnect) for a
-# single-thread-per-loop model.
-threadsafety: _Final[_Literal[1]] = 1
+# This declares the driver's CAPABILITY ceiling: connections are
+# safe to share across threads once the user opts in via
+# ``check_same_thread=False`` at ``connect()`` (matches stdlib
+# sqlite3's convention — stdlib advertises ``threadsafety = 3``
+# while defaulting ``check_same_thread=True`` to enforce strict
+# per-thread at the Python layer). Cursors are explicitly NOT
+# shareable across threads — the documented contract is "share
+# connections, not cursors" (see ``Connection`` docstring); the
+# ceiling stays at PEP 249 tier 2 for that reason. Tier 3 (cursors
+# shareable too) is tracked as future work in
+# ``issues/dbapi-threadsafety-tier-3-cursor-sharing-stdlib-parity.md``.
+#
+# DEFAULT enforcement is still per-thread: ``check_same_thread``
+# defaults to ``True`` and ``Connection._check_thread()`` raises
+# ``ProgrammingError`` on cross-thread method calls. Pass
+# ``check_same_thread=False`` to use the connection sharing
+# advertised here. The wire is always serialised by ``_op_lock``;
+# the Phase 2 hardening (``_state_lock`` for transaction owner
+# read-check-reserve, ``_cursors`` WeakSet add/discard) closes
+# the cross-thread correctness gaps for the connection-shared
+# path.
+#
+# This declaration uses the "advertise ceiling, default to floor"
+# pattern stdlib sqlite3 established since CPython 3.11
+# (bpo-45613 / gh-31464 made ``sqlite3.threadsafety`` dynamic via
+# ``SQLITE_THREADSAFE`` mode; serialized = tier 3). The pattern
+# describes capability rather than default enforcement;
+# capability-detection libraries reading this value learn the
+# safe-with-opt-in ceiling.
+threadsafety: _Final[_Literal[2]] = 2
 paramstyle: _Final[_Literal["qmark"]] = "qmark"  # Question mark style: WHERE name=?
 
 # SQLite compatibility attributes (for SQLAlchemy).
 
@@ -120,12 +120,20 @@
 logger = logging.getLogger(__name__)
 
 apilevel: _Final[_Literal["2.0"]] = "2.0"
-# PEP 249 value 1: threads may share the module.
+# PEP 249 value 2: threads may share the module and connections.
 #
-# The async API is further restricted: each AsyncConnection is bound
-# to the event loop it was first used on (see dqlitedbapi.aio.connection).
-# Use one AsyncConnection per loop.
-threadsafety: _Final[_Literal[1]] = 1
+# Mirrors the sync surface declaration (see ``dqlitedbapi.__init__``
+# for the full rationale on the "advertise ceiling, default to
+# floor" convention). The sync ``Connection`` opts into cross-
+# thread sharing via ``check_same_thread=False``; the async
+# ``AsyncConnection`` is bound to its event loop by asyncio's
+# structured-concurrency contract (cross-loop use raises via
+# ``_check_loop_binding``), so for the async surface the tier-2
+# advertisement is informational — the actual capability is
+# "share connection across tasks within the same event loop."
+# Cursors are NOT shareable across threads/tasks (see
+# ``AsyncConnection`` docstring).
+threadsafety: _Final[_Literal[2]] = 2
 paramstyle: _Final[_Literal["qmark"]] = "qmark"  # Question mark style: WHERE name=?
 
 # SQLite compatibility attributes (for SQLAlchemy).
 
@@ -11,7 +11,10 @@ def test_apilevel(self) -> None:
         assert aio.apilevel == "2.0"
 
     def test_threadsafety(self) -> None:
-        assert aio.threadsafety == 1
+        # 2 = threads may share the module AND connections — mirrors
+        # the sync surface bump (see test_module_attributes.py for
+        # the full rationale).
+        assert aio.threadsafety == 2
 
     def test_paramstyle(self) -> None:
         assert aio.paramstyle == "qmark"
 
@@ -8,8 +8,20 @@ def test_apilevel(self) -> None:
         assert dqlitedbapi.apilevel == "2.0"
 
     def test_threadsafety(self) -> None:
-        # 1 = threads may share the module, but not connections
-        assert dqlitedbapi.threadsafety == 1
+        # 2 = threads may share the module AND connections (cursors
+        # remain per-thread per the documented contract). The
+        # declaration is the CAPABILITY ceiling: connections become
+        # safe to share once the user opts in via
+        # ``check_same_thread=False``. Default enforcement remains
+        # strict per-thread. Matches stdlib sqlite3's "advertise
+        # ceiling, default to floor" convention (stdlib reports 3
+        # since CPython 3.11 / bpo-45613 while still defaulting
+        # ``check_same_thread=True``). See ``__init__.py:108-149``
+        # for the full rationale and
+        # ``issues/dbapi-threadsafety-tier-3-cursor-sharing-stdlib-parity.md``
+        # for the future-work proposal that would lift the ceiling
+        # to 3.
+        assert dqlitedbapi.threadsafety == 2
 
     def test_paramstyle(self) -> None:
         assert dqlitedbapi.paramstyle == "qmark"
 
@@ -1,8 +1,16 @@
-"""Tests for thread safety enforcement and close() hardening.
-
-The package declares threadsafety=1, meaning connections must not be
-shared between threads. Like sqlite3 stdlib, we enforce this with a
-thread identity check that raises ProgrammingError.
+"""Tests for thread safety DEFAULT enforcement and close() hardening.
+
+The package declares ``threadsafety=2`` (capability ceiling: threads
+may share module + connections), but the DEFAULT ``check_same_thread
+=True`` enforces strict per-thread connection use via
+``_check_thread()``. These tests pin the strict default; the
+relaxation under ``check_same_thread=False`` is tested in
+``test_check_same_thread_kwarg.py``.
+
+Like stdlib sqlite3 (which advertises ``threadsafety=3`` while
+defaulting ``check_same_thread=True``), the capability ceiling
+describes what the driver SUPPORTS once the user opts in; default
+enforcement is the Python-layer safety net.
 """
 
 import threading
@@ -121,11 +129,14 @@ def wrong_thread() -> None:
 
     def test_row_factory_setter_from_wrong_thread_raises(self) -> None:
         """Setting Connection.row_factory from a different thread must raise
-        ProgrammingError. The class docstring claims every public method
-        enforces threadsafety=1; the row_factory setter mutates state and
+        ProgrammingError under default ``check_same_thread=True``. The
+        class docstring claims every public method enforces the per-
+        thread default; the row_factory setter mutates state and
         must follow the same discipline. Cross-thread mutation could
         otherwise let a foreign thread override the row_factory used by
-        cursors created on the creator thread."""
+        cursors created on the creator thread. (Under
+        ``check_same_thread=False`` this restriction relaxes — the
+        module's ``threadsafety=2`` ceiling allows the sharing.)"""
         conn = Connection("localhost:9001")
         error: Exception | None = None