Deploy AIOS web (React glide grid + FastAPI slice)

api/deps.py

@@ -27,6 +27,7 @@ if str(_RI) not in sys.path:
     sys.path.insert(0, str(_RI))
 
 import core.perms as perms      # noqa: E402
+import core.store as store       # noqa: E402
 import core.users as users      # noqa: E402
 from harness import runtime     # noqa: E402
 
@@ -663,6 +664,25 @@ def require_session(request: Request, response: Response) -> Session:
     return Session(tenant=claims["t"], user=user, claims=claims, runtime=rt)
 
 
+def require_changes_session(request: Request, response: Response) -> Session | None:
+    """Authenticate the passive Pg change endpoint without reopening the database.
+
+    Pg change tokens are intentionally disabled: a current client refreshes the data it is viewing
+    on focus, while an already-open legacy client may still call this route every ten seconds. A
+    verified signed cookie is enough to return that no-data response; resolving the account record
+    would itself turn those legacy requests into a permanent Neon keepalive.
+    """
+    if store.backend() != "pg":
+        return require_session(request, response)
+    if request.headers.get("x-aios-change-check") == "focus-v1":
+        return require_session(request, response)
+    raw = request.cookies.get(aios_session.COOKIE_NAME)
+    claims = aios_session.read(raw) if raw else None
+    if not claims or not str(claims.get("t") or "").strip() or not str(claims.get("u") or "").strip():
+        raise err(401, "invalid_session", "your session has expired — sign in again")
+    return None
+
+
 def module_gate(module_key):
     """A dependency that 401s without a session and 403s without the grant for `module_key`."""
     def _dep(session: Session = Depends(require_session)) -> Session:

api/main.py

@@ -1083,13 +1083,12 @@ def _store_resync_loop():
 def _prewarm():
     import time as _t
     t0 = _t.time()
-    # ⚠ The store sync runs in its OWN thread, never ahead of the pool warm: a stale seed can
-    # take many minutes of XML-RPC to close, and the first live probe of this arrangement
-    # showed the pool warm (42s) silently queued behind it — the whole app cold for every
-    # visitor while a background column channel caught up. Measure cells retry via the
-    # transient rule until the sync lands; nothing else waits on it.
-    import threading as _th
-    _th.Thread(target=_seed_and_sync_store, daemon=True, name="store-seed-sync").start()
+    # The Odoo seed/sync can run for minutes and is separate from the finite cache warm below.
+    # Keep it opt-in: Live Pg serves its seeded analytical mirror at boot and lets explicit
+    # workers perform real sync work, so a routine restart can still scale Neon back to zero.
+    if os.environ.get("AIOS_BOOT_SYNC") == "1":
+        import threading as _th
+        _th.Thread(target=_seed_and_sync_store, daemon=True, name="store-seed-sync").start()
     try:
         from harness import runtime as _runtime
         rt = _runtime.get_runtime("royal-imports")
@@ -1220,6 +1219,11 @@ if (os.environ.get("AIOS_ENABLE_QA_TENANT") == "1"
                          name="qa-sandbox-schema").start()
 
 if os.environ.get("AIOS_PREWARM") == "1":
-    import threading as _threading
-    _threading.Thread(target=_prewarm, daemon=True, name="prewarm").start()
-    _threading.Thread(target=_store_resync_loop, daemon=True, name="store-resync").start()
+    import threading as _threading
+    _threading.Thread(target=_prewarm, daemon=True, name="prewarm").start()
+
+# A boot prewarm is finite; the Odoo/store resync loop is resident work.  Keep the latter
+# opt-in so a Pg-backed Live Space can scale its Neon compute to zero between real requests.
+if os.environ.get("AIOS_STORE_RESYNC") == "1":
+    import threading as _threading_resync
+    _threading_resync.Thread(target=_store_resync_loop, daemon=True, name="store-resync").start()

api/routes_automation.py

@@ -5,11 +5,9 @@ cron, a URL the SSRF rail refuses, a key field that is not one of the mapped col
 in `automation_engine`, which is a pure-ish module a gate can drive without a server. This file
 does auth, shape and status codes.
 
-⛔ THE TICK ENDPOINT IS THE ONE UNAUTHENTICATED ROUTE, AND IT IS FAIL-CLOSED TWICE OVER. It takes
-no session (an external cron has no cookie), so it is gated on a shared secret in
-`X-AIOS-TICK-TOKEN`; and when `AIOS_AUTOMATION_TICK_TOKEN` is UNSET the route refuses everything
-rather than admitting everyone. A "no token configured means no check" default is how an internal
-trigger becomes a public one — the same class of mistake as an empty-200 permission answer.
+The former unauthenticated tick endpoint is permanently retired and returns HTTP 410. Production
+definitions now reconcile exact native schedules through `automation_control`; direct events start
+one finite worker immediately. No shared tick secret or polling clock remains.
 """
 import os
 import re
@@ -1878,10 +1876,10 @@ def run_rows(auto_id: str, session: Session = Depends(_GATE)):
 # The loop also SLEEPS FIRST (`engine.scheduler_loop`) — defence in depth, proven in
 # verify_automation.py section T rather than assumed.
 #
-# ⛔ THE DEPLOY MUST SET `AIOS_AUTOMATIONS=1` (with `AIOS_AUTOMATION_TICK_TOKEN`) or schedules
-# only ever fire from the external cron POSTing /automations/tick. Both paths work; neither is
-# implicit. Booked in the session-D mailbox.
-engine.start_scheduler()
+# Production Pg refuses this resident path even if `AIOS_AUTOMATIONS` drifts on. Exact AWS
+# schedules and direct dispatch use `automation_control`; this call survives only for isolated
+# local/HF development fixtures that explicitly opt in.
+engine.start_scheduler()
 
 # C3 (wave 22): register the trigger listener onto the platform's row-event seam. THIS module
 # is where the registration belongs — it is the one place that already imports both sides, so

api/routes_changes.py

@@ -63,7 +63,7 @@ import core.user_tables as user_tables
 import modules.customer_data as customer_data
 import modules.product_data as product_data
 
-from deps import Session, err, require_session
+from deps import Session, err, require_changes_session, require_session
 
 router = APIRouter(prefix="/api/v1")
 
@@ -198,16 +198,20 @@ def _may_watch(session, scope):
 
 
 @router.get("/changes")
-def changes(scope: str = "", session: Session = Depends(require_session)):
-    """One tiny read per tab per interval. The response is small, uncacheable and boring."""
+def changes(scope: str = "", session: Session | None = Depends(require_changes_session)):
+    """Serve legacy change checks without making Pg a resident client."""
     names = buckets_for(scope)
     if names is None:
         raise err(400, "bad_scope", "name the table you are watching, e.g. ?scope=customer")
+    # Pg clients refresh data on user focus. Returning null tokens is database-free so an old
+    # browser bundle cannot keep Neon awake while the current no-poll bundle rolls out.
+    if names and store.backend() == "pg" and session is None:
+        return {"scope": _clean_scope(scope), "tokens": {label: None for label in names}, "backend": "pg"}
     # ⛔ W29-T82 — THE SAME REFUSAL EVERY SIBLING DOOR GIVES, word for word. A session that may
     # not open this table must not be able to tell whether it exists, and "404 unknown_table" is
     # the sentence the other five row doors answer with. A different code here would itself be
     # the tell.
-    if names and not _may_watch(session, _clean_scope(scope)):
+    if names and (session is None or not _may_watch(session, _clean_scope(scope))):
         raise err(404, "unknown_table", f"no database {_clean_scope(scope)!r} here")
     if not names:
         # ⛔ A well-formed scope this map does not know is a 404, NOT an empty `tokens` object.

api/routes_forms.py

@@ -231,7 +231,15 @@ def _public_form(rt, table_key: str, spec: dict) -> dict:
     import aios_grid
     import core.user_tables as user_tables
 
-    defn = user_tables.get(table_key, st=rt) or {}
+    # A public form renders its declared fields only; no submitted table row belongs on this
+    # path.  In production `rt` is tenant-bound, so lend the rows-free projection.  The `None`
+    # fallback preserves the isolated helper fixture used by the form verifier.
+    lend_defs = getattr(user_tables, 'lend_defs', None)
+    # Some isolated route verifiers supply a deliberately tiny `user_tables` double.  Production
+    # always has `lend_defs`; preserving the double's direct handle keeps that fixture focused on
+    # its public-form contract rather than forcing it to impersonate the entire store API.
+    definitions = lend_defs(rt) if rt is not None and callable(lend_defs) else rt
+    defn = user_tables.get(table_key, st=definitions) or {}
     by_key = {f.get("key"): f for f in (defn.get("fields") or []) if isinstance(f, dict)}
     required = {str(k) for k in (spec.get("required") or [])}
     out = []

api/routes_nav.py

@@ -764,10 +764,14 @@ def save_nav_meta(body: dict = Body(default=None),
     #     because a user table is not a module. Same split `/nav/schema/{key}` makes.
     #   · everything else — admin only, and icon only. There is no owner of `customer_data` to
     #     defer to, and its label is a compiled registry literal (refused below regardless).
-    if key.startswith("ut_"):
-        import core.user_tables as user_tables
-        if not user_tables.get(key, st=session.runtime) or not user_tables.may_open(
-                key, session.uname, session.admin, st=session.runtime):
+    if key.startswith("ut_"):
+        import core.user_tables as user_tables
+        # This write edits metadata, never a record.  The table wall therefore needs its
+        # definition only; lending the rows-free JSONB projection keeps a rename/icon click from
+        # copying every table row just to prove the caller owns this database.
+        definitions = user_tables.lend_defs(session.runtime)
+        if not user_tables.get(key, st=definitions) or not user_tables.may_open(
+                key, session.uname, session.admin, st=definitions):
             raise err(403, "forbidden", "that database belongs to another user")
     else:
         if not session.admin:
@@ -886,11 +890,14 @@ def nav_schema(key: str, session: Session = Depends(require_session)):
     # Wave 18 C3-UT: a user table's schema is its own definition, walled by ITS predicate
     # (`may_open`) rather than the module grant machinery — `session.require` would 403 every
     # ut key because a user table is deliberately not a module.
-    if key.startswith("ut_"):
-        import core.user_tables as user_tables
-        defn = user_tables.get(key, st=session.runtime)
-        if not defn or not user_tables.may_open(key, session.uname, session.admin,
-                                                st=session.runtime):
+    if key.startswith("ut_"):
+        import core.user_tables as user_tables
+        # Schema is definition-only by contract.  Do not pay a whole `user_tables` read merely
+        # to open the drawer; the rows-free projection is also lent to the canonical wall.
+        definitions = user_tables.lend_defs(session.runtime)
+        defn = user_tables.get(key, st=definitions)
+        if not defn or not user_tables.may_open(key, session.uname, session.admin,
+                                                st=definitions):
             raise err(403, "forbidden", "that database belongs to another user")
         # ⭐⭐ W38-T18 — THE FIELD WALL ON A `ut_*` DATABASE, WHICH THIS DOOR HAS NEVER RUN.
         # `may_open` answers *IF* you reach the database and says nothing about WHICH COLUMNS, so

api/routes_odoo_tables.py

@@ -153,15 +153,33 @@ def refresh_odoo_tables(session: Session = Depends(require_session)):
 
 
 @router.get("/odoo-tables/status")
-def odoo_tables_status(session: Session = Depends(require_session)):
+def odoo_tables_status(brief: bool = Query(False),
+                       session: Session = Depends(require_session)):
     """Row counts + the newest `refreshed` stamp per table.
 
     ⚠ The stamp is the whole point while the resync wiring is outstanding: a locked collections
     worklist that quietly stopped updating is a worklist that lies, so its age must be readable
     without anybody running a refresh to find out.
+
+    `brief=1` is the grid's one question at open time: which declared tables read through the
+    mirror?  It deliberately does not borrow the tenant document, take a mirror cursor, or count
+    rows.  Those would be work solely for metadata the client never reads.  The source registry
+    remains the authority, so a future conversion is still discovered server-side rather than by
+    a client-side key list.
     """
-    rel, out = _rel(), {}
+    rel = _rel()
+    if brief:
+        sources = _sources()
+        return {"ok": True, "tables": {
+            key: {"readThrough": key in sources}
+            for _bucket, key, _label, _fields in rel.TABLES
+        }}
+
     import core.user_tables as user_tables
+    # The detailed operator view genuinely needs rows to report counts/freshness, but it needs
+    # them ONCE.  Repeated `get()` calls each copy the same tenant document under the store lock.
+    tables = user_tables.all_tables(st=session.runtime)
+    out = {}
     # ⭐ W30-T31 — THE ELIGIBILITY PASS RUNS HERE TOO, and the mirror cursor is taken best-effort:
     # the freshness surface must answer on a box with no mirror (that is what it is FOR), so a
     # store that is not ready costs the size half of the question, never the whole endpoint.
@@ -187,7 +205,7 @@ def odoo_tables_status(session: Session = Depends(require_session)):
     # hard-coded list here would have reported "everything is fine" over two databases it had
     # stopped knowing about ([[gate-answers-the-wrong-question]] — the hard-coded count).
     for _bucket, key, _label, _fields in rel.TABLES:
-        table = user_tables.get(key, st=session.runtime) or {}
+        table = tables.get(key) or {}
         rows = (table.get("rows") or {})
         stamps = [str((r or {}).get("refreshed") or "") for r in rows.values()]
         # ⛔⛔ A FRESHNESS SURFACE THAT LIES IS WORSE THAN NO FRESHNESS SURFACE, and this endpoint
@@ -196,7 +214,7 @@ def odoo_tables_status(session: Session = Depends(require_session)):
         # operator would see a database that looks EMPTY and STALE on a route whose own docstring
         # says a worklist that quietly stopped updating must be legible without a refresh. So a
         # read-through table is counted from the MIRROR and says where its count came from.
-        materialised = user_tables.materialises(key, st=session.runtime)
+        materialised = user_tables.materialises(key, defn=table)
         if not materialised:
             try:
                 rows = {}

api/routes_platform_admin.py

@@ -251,15 +251,18 @@ def _connector_rows(slug, rt):
 
 # ══════════════════════════════════════════════════════════════════════════ automations + cost
 
-#: THE UNIT MODEL, from `ops/provision_automation_cron.py` (its cost note at :25-28 and the
-#: function it actually provisions at :211 / :269). Restated as constants rather than as prose so
-#: the arithmetic below is re-checkable against the thing that was really deployed:
-#: EventBridge Scheduler `rate(15 minutes)` → a 128 MB, 30 s-timeout Lambda that POSTs the tick.
-TICK_CADENCE = "rate(15 minutes)"
-TICK_PER_DAY = 96                       # 1440 / 15
-LAMBDA_MB = 128
-FREE_LAMBDA_REQUESTS = 1_000_000        # AWS always-free, per month
-FREE_SCHEDULER_INVOCATIONS = 14_000_000
+#: 2026-08-21 public us-east-2 Linux/x86 rates for the deployed 0.25-vCPU / 1-GiB task.
+#: This is a recurring-run FLOOR, not an invoice: Linux Fargate has a 60-second minimum and the
+#: task receives one public IPv4 address while it runs. The measured `/aws` report is authoritative.
+#: Sources: https://aws.amazon.com/fargate/pricing/ and https://aws.amazon.com/vpc/pricing/
+FARGATE_VCPU_USD_HOUR = 0.04048
+FARGATE_GB_USD_HOUR = 0.004445
+PUBLIC_IPV4_USD_HOUR = 0.005
+TASK_VCPU = 0.25
+TASK_GB = 1.0
+MIN_BILLED_SECONDS = 60
+MIN_RUN_USD = ((TASK_VCPU * FARGATE_VCPU_USD_HOUR + TASK_GB * FARGATE_GB_USD_HOUR
+                + PUBLIC_IPV4_USD_HOUR) * MIN_BILLED_SECONDS / 3600.0)
 DAYS_PER_MONTH = 30.4
 
 
@@ -299,6 +302,7 @@ def _runs_per_day(cron):
 def _automation_rows(slug, rt):
     """A tenant's automations, their schedules, and their retained run history."""
     try:
+        import automation_control as control
         import automation_engine as engine
         defs = engine.all_definitions(rt) or {}
         max_runs = int(getattr(engine, "MAX_RUNS", 20))
@@ -309,18 +313,33 @@ def _automation_rows(slug, rt):
         if not isinstance(d, dict):
             continue
         sched = d.get("schedule") or {}
+        trigger = d.get("trigger") or {}
         status = d.get("status") or {}
         runs = list(d.get("runs") or [])
         cron = sched.get("cron") or ""
-        per_day = _runs_per_day(cron) if sched.get("enabled") else 0.0
+        schedule_per_day = _runs_per_day(cron) if sched.get("enabled") else 0.0
+        email_enabled = (trigger.get("key") == "email" and trigger.get("enabled", True)
+                         and not trigger.get("paused") and trigger.get("configured", True))
+        per_day = (None if schedule_per_day is None
+                   else schedule_per_day + (96.0 if email_enabled else 0.0))
+        specs_error = False
+        try:
+            specs = control.recurring_specs(slug, d)
+        except Exception:
+            # A stored legacy/custom cron must read as unknown, never as zero cost.
+            specs = []
+            specs_error = True
+            per_day = None
         rows.append({
             "tenant": slug,
             "id": auto_id,
             "name": d.get("name") or auto_id,
             "kind": d.get("kind") or "",
-            "enabled": bool(sched.get("enabled")),
+            "enabled": bool(specs) or specs_error,
             "cron": cron,
             "runsPerDay": round(per_day, 2) if per_day is not None else None,
+            "nativeSchedules": None if specs_error else len(specs),
+            "scheduleModes": sorted({str(s.get("mode") or "") for s in specs}),
             "state": status.get("state") or "idle",
             "lastRunAt": status.get("lastRunAt") or "",
             "lastSummary": status.get("lastSummary") or "",
@@ -334,40 +353,34 @@ def _automation_rows(slug, rt):
 
 
 def _automation_cost(auto_rows):
-    """The estimated monthly cost of running the automation fleet — and the honest shape of it.
-
-    THE POINT THIS BLOCK EXISTS TO MAKE, which is not intuitive: **the external cron does not
-    scale with automations or tenants.** One EventBridge schedule fires one Lambda, which POSTs
-    one tick, and that tick runs every DUE automation for every tenant (`provision_automation_cron`
-    states this as the reason it stays $0 "at ten tenants"). So the AWS bill is a function of the
-    CADENCE alone — the fleet below adds work inside the API container, which is already paid for.
-
-    WHAT IS NOT COMPUTED HERE, deliberately: Lambda GB-seconds. That needs the real average
-    duration of the function, which only CloudWatch knows; assuming one would be inventing the
-    larger half of the free-tier calculation. `/aws` reports the measured figure when credentials
-    are available, and this block says so rather than filling the gap with a plausible number.
+    """Minimum scheduled-run estimate for the exact-schedule, finite-worker architecture.
+
+    It includes the 60-second Fargate floor plus one temporary public IPv4 allocation. It excludes
+    unknown direct/manual events, one-shot vendor collections, Step Functions transitions above
+    its free allowance, task runtime beyond 60 seconds, and Neon compute/transfer. `/aws` is the
+    measured source of truth; this is only a transparent planning floor.
     """
-    invocations = TICK_PER_DAY * DAYS_PER_MONTH
     fleet_runs = sum(r["runsPerDay"] or 0 for r in auto_rows if r.get("enabled"))
     unknown_cadence = sum(1 for r in auto_rows if r.get("enabled") and r.get("runsPerDay") is None)
+    native_schedules = sum(int(r.get("nativeSchedules") or 0) for r in auto_rows)
+    invocations = fleet_runs * DAYS_PER_MONTH
+    minimum_usd = invocations * MIN_RUN_USD
     return {
-        "cadence": TICK_CADENCE,
+        "mode": "exact-schedules-fargate",
+        "cadence": "per automation",
+        "nativeSchedules": native_schedules,
         "invocationsPerMonth": int(round(invocations)),
-        "freeRequestsPct": round(100.0 * invocations / FREE_LAMBDA_REQUESTS, 3),
-        "freeSchedulerPct": round(100.0 * invocations / FREE_SCHEDULER_INVOCATIONS, 4),
-        "lambdaMb": LAMBDA_MB,
-        "usd": 0.0,
+        "perRunMinimumUsd": round(MIN_RUN_USD, 8),
+        "usd": round(minimum_usd, 4),
         "fleetRunsPerDay": round(fleet_runs, 2),
         "unknownCadence": unknown_cadence,
         "basis": (
-            f"One EventBridge schedule ({TICK_CADENCE}) fires one {LAMBDA_MB} MB Lambda that "
-            f"POSTs the tick; that ONE tick runs every due automation for every tenant, so the "
-            f"AWS cost is set by the cadence and does not grow with the fleet. "
-            f"{int(round(invocations)):,} invocations/month is "
-            f"{round(100.0 * invocations / FREE_LAMBDA_REQUESTS, 3)}% of the 1,000,000-request "
-            f"always-free tier, so the marginal cost of the automations below is $0.00. "
-            f"Compute (GB-seconds) depends on measured durations and is NOT estimated here — "
-            f"the AWS report reads the real figure when credentials are available."
+            f"{native_schedules} exact native schedule(s) imply about "
+            f"{int(round(invocations)):,} finite run(s)/month. At the 60-second Fargate plus "
+            f"public-IPv4 minimum (${MIN_RUN_USD:.8f}/run), the recurring floor is "
+            f"about ${minimum_usd:.4f}/month. There is no resident ECS service. Direct/manual "
+            f"runs, one-shot vendor collection, longer tasks, paid Step Functions transitions "
+            f"and Neon are excluded; the AWS report shows measured cost."
         ),
     }
 
@@ -581,18 +594,24 @@ def platform_automations(tenant: str = "", session: Session = Depends(padmin_gat
             continue
         retained = max_runs
         out += rows
-    scheduler = engine.scheduler_status()
+    import automation_control as control
+    resident = engine.scheduler_status()
+    exact_enabled = control.configured()
     return {"automations": out, "count": len(out),
             "enabled": sum(1 for a in out if a["enabled"]),
             "historyRetained": retained,
             "cost": _automation_cost(out), "errors": errors,
-            "tickEnabled": bool(scheduler.get("enabled")),
-            "scheduler": scheduler}
+            "tickEnabled": False,
+            "controlEnabled": exact_enabled,
+            "executionMode": "exact-aws" if exact_enabled else "local-disabled",
+            "scheduler": {"enabled": exact_enabled,
+                          "source": "exact-aws" if exact_enabled else "",
+                          "resident": resident}}
 
 
 @router.get("/aws")
 def platform_aws(days: int = 7, session: Session = Depends(padmin_gate)):
-    """The AWS cron's usage report, verbatim, or an honest note explaining its absence."""
+    """AWS automation usage, verbatim, or an honest note explaining its absence."""
     days = max(1, min(int(days or 7), 90))
     return {"days": days, "report": _aws_report(days)}
 

api/routes_tables.py

@@ -39,7 +39,7 @@ import threading
 import json
 import time
 
-from fastapi import Body, Depends
+from fastapi import Body, Depends, Query
 from fastapi import APIRouter
 
 from deps import Session, err, require_session
@@ -1073,9 +1073,10 @@ def nav_meta(session):
         return {}
 
 
-@router.get("/tables")
-def list_tables(session: Session = Depends(require_session)):
-    """This session's user tables — the list the '+ New database' surface renders.
+@router.get("/tables")
+def list_tables(brief: bool = Query(False),
+                session: Session = Depends(require_session)):
+    """This session's user tables — the list the '+ New database' surface renders.
 
     ⭐⭐ W31-T12 (contract C1, D-175's third instance) — ONE DOCUMENT READ, NOT `1 + 2N`. This
     route was never ticketed and has the same shape `/nav` and `/automations` were fixed for:
@@ -1083,26 +1084,34 @@ def list_tables(session: Session = Depends(require_session)):
     tenant #0 measured, 703 ms warm) and `records_mutable` per key on top of that — so a tenant
     with ten databases paid twenty-one copies to list them. The wall is UNCHANGED and still asked
     about every table; it is handed the document this function already holds. See
-    `user_tables.lend`'s own note for why inlining the predicate is the one fix that is not
-    available.
-    """
-    ut = _ut()
-    meta = nav_meta(session)
-    out = []
-    tables = ut.all_tables(st=session.runtime)
-    lent = ut.lend(session.runtime, **{ut.STORE_KEY: tables})
-    for key, t in sorted(tables.items(),
-                         key=lambda kv: (ut_label(kv[1], kv[0], meta) or "").lower()):
-        if not ut.may_open(key, session.uname, session.admin, st=lent):
-            continue
-        out.append({"key": key, "label": ut_label(t, key, meta),
-                    "source": t.get("source") or "Blank",
-                    "recordsMutable": ut.records_mutable(key, st=lent),
-                    "createdBy": t.get("createdBy") or "",
-                    "created": t.get("created") or "",
-                    "fields": [dict(f) for f in (t.get("fields") or [])],
-                    "rowCount": len(t.get("rows") or {})})
-    return {"tables": out}
+    `user_tables.lend`'s own note for why inlining the predicate is the one fix that is not
+    available.
+
+    `brief=1` is for a link-field picker.  It needs the tables it may target and their schemas,
+    not row counts or record mutability.  Reading a full tenant document to decorate that one
+    field editor would move every stored row through Neon for no visible result, so this branch
+    keeps the server-side permission wall but lends its rows-free projection instead.
+    """
+    ut = _ut()
+    meta = nav_meta(session)
+    out = []
+    tables = (ut.all_defs(st=session.runtime) if brief
+              else ut.all_tables(st=session.runtime))
+    lent = ut.lend(session.runtime, **{ut.STORE_KEY: tables})
+    for key, t in sorted(tables.items(),
+                         key=lambda kv: (ut_label(kv[1], kv[0], meta) or "").lower()):
+        if not ut.may_open(key, session.uname, session.admin, st=lent):
+            continue
+        row = {"key": key, "label": ut_label(t, key, meta),
+               "fields": [dict(f) for f in (t.get("fields") or [])]}
+        if not brief:
+            row.update({"source": t.get("source") or "Blank",
+                        "recordsMutable": ut.records_mutable(key, st=lent),
+                        "createdBy": t.get("createdBy") or "",
+                        "created": t.get("created") or "",
+                        "rowCount": len(t.get("rows") or {})})
+        out.append(row)
+    return {"tables": out}
 
 
 #: ⭐⭐ THE ROLLUP SOURCE OFFER — what makes the read-through rollup a FEATURE rather than a

api/routes_templates.py

@@ -49,10 +49,13 @@ def _target_or_refuse(session, table_key):
         raise err(400, "bad_request", "no database was named")
     if key.startswith('ut_'):
         import core.user_tables as user_tables
-        defn = user_tables.get(key, st=session.runtime)
+        # A template negotiates a field contract, never record values.  Keep the table wall on
+        # the same rows-free projection as navigation rather than copying the tenant document.
+        definitions = user_tables.lend_defs(session.runtime)
+        defn = user_tables.get(key, st=definitions)
         if not defn:
             raise err(404, "unknown_table", "that database does not exist")
-        if not user_tables.may_open(key, session.uname, session.admin, st=session.runtime):
+        if not user_tables.may_open(key, session.uname, session.admin, st=definitions):
             raise err(403, "forbidden", "that database belongs to another user")
         fields = [str(f.get('key')) for f in (defn.get('fields') or []) if f.get('key')]
         # A user table has no fixed topic. Its SOURCE label is left blank so `offer` gates on

platform/aios_grid.py

@@ -1918,11 +1918,14 @@ MAX_FOLDER_NAME = 80
 #: 12-shape guess of mine that contained shapes the client cannot draw). Do not extend this set
 #: without the matching client geometry: an unknown shape falls back to the default folder mark,
 #: which is also I14's "existing folders get the folder icon" for every pre-wave-9 folder.
-FOLDER_ICON_SHAPES = {"folder", "star", "flag", "tag", "bookmark", "box", "circle", "square"}
-#: Tones are the C1 pastels — FILLS ONLY, never text (the standing palette rule). 'grey' is the
-#: default, and is CLIENT's key name: not 'neutral', which is what HOST first guessed.
-FOLDER_ICON_TONES = {"blue", "green", "yellow", "red", "grey"}
-FOLDER_ICON_DEFAULT_TONE = "grey"
+FOLDER_ICON_SHAPES = {
+    "folder", "star", "flag", "tag", "bookmark", "grid", "chart", "map", "users",
+    "clock", "heart", "bolt",
+}
+#: Tones are the C1 pastels — FILLS ONLY, never text. This mirrors the current client vocabulary;
+#: the old host spelling `grey` is accepted as a read/write migration alias for `neutral` below.
+FOLDER_ICON_TONES = {"neutral", "blue", "green", "yellow", "red"}
+FOLDER_ICON_DEFAULT_TONE = "neutral"
 
 
 #: Wave-9 I17 (contract C4) — who may EDIT a saved view.
@@ -1982,9 +1985,14 @@ def clean_folder_icon(raw):
     shape = raw.get("shape")
     if shape not in FOLDER_ICON_SHAPES:
         return None
-    tone = raw.get("tone")
-    return {"shape": shape,
-            "tone": tone if tone in FOLDER_ICON_TONES else FOLDER_ICON_DEFAULT_TONE}
+    tone = raw.get("tone")
+    # The first host implementation called the neutral tone `grey`. Accept that legacy value so
+    # an existing folder cannot crash a newer client, but canonicalise it on the next workspace
+    # write/read to the current shared vocabulary.
+    if tone == "grey":
+        tone = FOLDER_ICON_DEFAULT_TONE
+    return {"shape": shape,
+            "tone": tone if tone in FOLDER_ICON_TONES else FOLDER_ICON_DEFAULT_TONE}
 
 
 def clean_folders(raw):

platform/core/store_pg.py

@@ -230,7 +230,12 @@ def _pool():
                 pass
         # min_size=0 so a process that never touches the store opens no connection at all — the
         # shared API serves plenty of requests (health, static, a cached payload) that never read.
-        _POOL['pool'] = ConnectionPool(url, min_size=0, max_size=8, open=True, timeout=10.0)
+        # Returned connections are deliberately short-lived: Neon's compute should suspend between
+        # real requests, not be held awake by this process's idle pool for psycopg's 10-minute
+        # default. Thirty seconds still reuses a normal request burst without creating a resident
+        # database client.
+        _POOL['pool'] = ConnectionPool(url, min_size=0, max_size=8, open=True, timeout=10.0,
+                                       max_idle=30.0)
         _POOL['url'] = url
         return _POOL['pool']
 

web/src/customer-grid/apiBridge.ts

@@ -52,9 +52,9 @@ import {
   checkTenant,
   signal,
 } from "../apiContract";
-import { setStandaloneSink } from "./hostBridge";
-import { changedBuckets } from "./liveWorkspace";
-import type { ChangeTokens } from "./liveWorkspace";
+import { setStandaloneSink } from "./hostBridge";
+import { changedBuckets } from "./liveWorkspace";
+import type { ChangeTokens } from "./liveWorkspace";
 import { CUSTOMER_TOPIC } from "./types";
 import type { CustomersPayload, Field, FilterNode, GridLimit, GridWorkspace, HostEvent, Row,
   SortSpec, TopicConfig } from "./types";
@@ -439,7 +439,9 @@ export function readThroughTables(): Promise<Set<string>> {
   if (!readThroughMemo) {
     readThroughMemo = (async () => {
       try {
-        const res = await fetch(`${API_V1}/odoo-tables/status`, { credentials: CREDENTIALS });
+        // The grid needs only the read-through flag, never the operator status's counts/stamps.
+        // `brief=1` is server-derived from the connected-grid registry and reads no table rows.
+        const res = await fetch(`${API_V1}/odoo-tables/status?brief=1`, { credentials: CREDENTIALS });
         if (handledSession(res) || !res.ok) {
           readThroughMemo = null;
           return new Set<string>();
@@ -594,8 +596,10 @@ export async function fetchWorkspace(
 export async function fetchChangeTokens(scope: string): Promise<ChangeTokens | null> {
   let res: Response;
   try {
-    res = await fetch(`${API_V1}/changes?scope=${encodeURIComponent(scope)}`,
-                      { credentials: CREDENTIALS });
+    res = await fetch(`${API_V1}/changes?scope=${encodeURIComponent(scope)}`,
+                      // This header marks a current, user-return check. Legacy bundles lack it,
+                      // so their former 10-second requests remain database-free on Pg.
+                      { credentials: CREDENTIALS, headers: { "X-AIOS-Change-Check": "focus-v1" } });
   } catch {
     return null;
   }
@@ -610,89 +614,83 @@ export async function fetchChangeTokens(scope: string): Promise<ChangeTokens | n
   return out;
 }
 
-/** ~10 s. The owner's ask is "a new record shows up in about ten seconds", and the request it
- *  costs is a dict read server-side — see `routes_changes.py` for why that is the whole design. */
-export const CHANGE_POLL_MS = 10_000;
-
-interface ChangeWatch {
-  timer: ReturnType<typeof setInterval> | null;
-  tokens: ChangeTokens | null;
-  listeners: Set<(changed: string[]) => void>;
-  inFlight: boolean;
+/**
+ * A grid reloads only when the person returns to the tab or window. There is no timer and no
+ * background token request.
+ */
+
+interface ChangeWatch {
+  listeners: Set<(changed: string[]) => void>;
+  tokens: ChangeTokens | null;
+  inFlight: boolean;
+  refresh: () => Promise<void>;
   /** ⭐ ONE poll implementation per watch, held here so the interval and the visibility handler
    *  call the SAME function. The visibility handler used to re-inline the body, which quietly
    *  skipped `inFlight` — so returning to a tab whose poll was still outstanding stacked a second
    *  request on top of it, exactly what that guard exists to prevent. */
-  poll: () => Promise<void>;
 }
 
-const changeWatches = new Map<string, ChangeWatch>();
-let visibilityBound = false;
+const changeWatches = new Map<string, ChangeWatch>();
+let visibilityBound = false;
+function refreshVisibleChanges(): void {
+  if (document.visibilityState !== "visible") return;
+  for (const watched of changeWatches.values())
+    void watched.refresh();
+}
 
 /**
  * Watch one scope for server-side changes. Returns its unsubscribe.
  *
- * ⭐ ONE TIMER PER SCOPE, REFCOUNTED, and that is a budget rather than tidiness. A linked-record
- * grid mounts a second `useCustomerData` on the same surface, and a per-hook interval would double
- * the poll rate for a table the user opened once. The done-when is "roughly 6 tiny calls per minute
- * per tab" — per TAB, not per component.
- *
- * ⛔ IT DOES NOT POLL A HIDDEN TAB, and it polls IMMEDIATELY on becoming visible again. A background
- * tab left open overnight would otherwise spend the night asking a question nobody can see the
- * answer to, and the one moment its answer certainly matters is the moment you look at it.
- * `visibilitychange` had zero listeners in this client before this.
+ * ⭐ ONE WATCH PER SCOPE, REFCOUNTED. A linked-record grid can mount a second `useCustomerData` on
+ * the same surface, and both listeners share one mount baseline and one return-to-tab refresh.
+ *
+ * ⛔ IT NEVER POLLS. Own writes update the current tab from their response; a change made elsewhere
+ * is checked when the person returns to this tab or focuses its window. A forgotten tab left open
+ * overnight creates no database traffic.
  */
 export function subscribeChanges(scope: string,
                                  onChange: (changed: string[]) => void): () => void {
   if (typeof window === "undefined") return () => {};
   let watch = changeWatches.get(scope);
   if (!watch) {
-    const w0: ChangeWatch = {
-      timer: null, tokens: null, listeners: new Set(), inFlight: false,
-      poll: async () => {
-        // A slow answer must not queue a second request behind itself: on a cold Space the first
-        // poll can outlive the interval, and without this the backlog grows while it stays slow.
-        if (w0.inFlight || document.visibilityState !== "visible") return;
-        w0.inFlight = true;
-        try {
-          const next = await fetchChangeTokens(scope);
-          const changed = changedBuckets(w0.tokens, next);
-          if (next) w0.tokens = next;
-          if (changed.length) for (const fn of [...w0.listeners]) fn(changed);
-        } finally {
-          w0.inFlight = false;
-        }
-      },
-    };
+    const w0: ChangeWatch = {
+      listeners: new Set(), tokens: null, inFlight: false,
+      refresh: async () => {
+        if (w0.inFlight || document.visibilityState !== "visible") return;
+        w0.inFlight = true;
+        try {
+          const next = await fetchChangeTokens(scope);
+          const changed = changedBuckets(w0.tokens, next);
+          if (next) w0.tokens = next;
+          if (changed.length)
+            for (const listener of [...w0.listeners]) listener(changed);
+        } finally {
+          w0.inFlight = false;
+        }
+      },
+    };
     watch = w0;
     changeWatches.set(scope, w0);
   }
-  const w = watch;
-  w.listeners.add(onChange);
-
-  if (!w.timer) {
-    void w.poll();                            // take the baseline now, not in ten seconds
-    w.timer = setInterval(() => { void w.poll(); }, CHANGE_POLL_MS);
-  }
-  if (!visibilityBound) {
-    visibilityBound = true;
-    window.addEventListener("visibilitychange", () => {
-      if (document.visibilityState !== "visible") return;
-      for (const watched of changeWatches.values())
-        if (watched.timer) void watched.poll();
-    });
-  }
+  const w = watch;
+  w.listeners.add(onChange);
+
+  // One tiny revision baseline after the necessary initial data load lets later user returns
+  // preserve the browser cache when nothing changed. It is never an interval.
+  if (w.tokens === null && !w.inFlight) void w.refresh();
+
+  if (!visibilityBound) {
+    visibilityBound = true;
+    window.addEventListener("visibilitychange", refreshVisibleChanges);
+    window.addEventListener("focus", refreshVisibleChanges);
+  }
 
   return () => {
     w.listeners.delete(onChange);
-    if (w.listeners.size === 0 && w.timer) {
-      clearInterval(w.timer);
-      w.timer = null;
+    if (w.listeners.size === 0) {
       // ⚠ The tokens are DROPPED with the last listener. A remount must re-baseline rather than
-      // compare against a token from before it was unmounted: the payload it is about to fetch is
-      // fresh by definition, so treating the interval it missed as "a change" would cost a second
-      // full read of what it just read.
-      w.tokens = null;
+      // compare against a token from before it was unmounted.
+      changeWatches.delete(scope);
     }
   };
 }
@@ -872,9 +870,11 @@ export async function addTableRow(
  * and an unreachable server — and a create pane that explodes because a picker could not fetch
  * is worse than one that says it has nothing to offer.
  */
-export async function fetchLinkTargets(): Promise<LinkTarget[]> {
-  try {
-    const res = await fetch(`${API_V1}/tables`, { credentials: CREDENTIALS });
+export async function fetchLinkTargets(): Promise<LinkTarget[]> {
+  try {
+    // A link picker uses only key/label/schema. `brief=1` keeps the server's table wall but does
+    // not transfer row counts or the row-bearing `user_tables` document for this one field menu.
+    const res = await fetch(`${API_V1}/tables?brief=1`, { credentials: CREDENTIALS });
     if (handledSession(res) || !res.ok) return [];
     const body = (await readJson(res)) as { tables?: LinkTarget[] } | null;
     return Array.isArray(body?.tables) ? body.tables : [];

web/src/customer-grid/iconShapes.ts

@@ -350,13 +350,24 @@ export const FOLDER_SHAPE_PATHS: Record<FolderShape, IconShape[]> = {
  * the two ends, so the name matters more than the word: a tone the host does not recognise
  * degrades to the default and the user's choice silently disappears on reload.
  */
-export const FOLDER_TONE_PAINT: Record<FolderTone, { fill: string; stroke: string }> = {
-  neutral: { fill: LP_LINE, stroke: LP_MUTED },
-  blue: { fill: LP_BLUE, stroke: LP_BLUE_DEEP },
-  green: { fill: LP_GREEN, stroke: LP_GREEN_DEEP },
-  yellow: { fill: LP_YELLOW, stroke: LP_YELLOW_DEEP },
-  red: { fill: LP_RED, stroke: LP_RED_DEEP },
-};
+export const FOLDER_TONE_PAINT: Record<FolderTone, { fill: string; stroke: string }> = {
+  neutral: { fill: LP_LINE, stroke: LP_MUTED },
+  blue: { fill: LP_BLUE, stroke: LP_BLUE_DEEP },
+  green: { fill: LP_GREEN, stroke: LP_GREEN_DEEP },
+  yellow: { fill: LP_YELLOW, stroke: LP_YELLOW_DEEP },
+  red: { fill: LP_RED, stroke: LP_RED_DEEP },
+};
+
+/**
+ * The tone is persisted data, not a compile-time fact. Older hosts used `grey` for the neutral
+ * tone, and a stale workspace can still carry it after the palette was renamed. Every painter
+ * must degrade to the neutral ink rather than dereferencing an absent paint record and taking the
+ * whole React tree down while drawing an otherwise healthy database.
+ */
+export function folderTonePaint(tone: unknown): { fill: string; stroke: string } {
+  return (typeof tone === "string" ? FOLDER_TONE_PAINT[tone as FolderTone] : undefined)
+    ?? FOLDER_TONE_PAINT.neutral;
+}
 
 export const FOLDER_TONE_LABELS: Record<FolderTone, string> = {
   neutral: "Neutral",

web/src/customer-grid/icons.tsx

@@ -22,7 +22,7 @@ import {
   CHART_KIND_SHAPES,
   CHART_KIND_TONE,
   FOLDER_SHAPE_PATHS,
-  FOLDER_TONE_PAINT,
+  folderTonePaint,
   MODE_SHAPES,
   TYPE_SHAPES,
 } from "./iconShapes";
@@ -130,7 +130,7 @@ export function ToneModeIcon({
   tone: FolderTone;
   size?: number;
 }) {
-  const paint = FOLDER_TONE_PAINT[tone];
+  const paint = folderTonePaint(tone);
   return (
     <svg
       className="cg-mode-icon cg-tone-icon"
@@ -178,7 +178,7 @@ export function ChartKindIcon({
   kind: ChartKindKey;
   size?: number;
 }) {
-  const paint = FOLDER_TONE_PAINT[CHART_KIND_TONE[kind]];
+  const paint = folderTonePaint(CHART_KIND_TONE[kind]);
   return (
     <svg
       className="cg-mode-icon cg-tone-icon"
@@ -483,7 +483,7 @@ export function FolderMark({
   size?: number;
 }) {
   const shape = icon?.shape ?? DEFAULT_FOLDER_SHAPE;
-  const paint = FOLDER_TONE_PAINT[icon?.tone ?? DEFAULT_FOLDER_TONE];
+  const paint = folderTonePaint(icon?.tone ?? DEFAULT_FOLDER_TONE);
   return (
     <svg
       className="cg-folder-mark"

web/src/settings/AdminPane.tsx

@@ -200,10 +200,10 @@ export function AdminPane({ user }: { user: { username: string; name: string; ro
             <Total label="People" value={int(ov.totals.users)} />
             <Total label="Databases" value={int(ov.totals.databases)} />
             <Total label="Records" value={int(ov.totals.rows)} />
-            <Total
-              label="Automation cost"
-              value={fleet ? `$${fleet.cost.usd.toFixed(2)}` : "—"}
-              hint={fleet?.cost.basis}
+            <Total
+              label="Automation floor"
+              value={fleet ? (fleet.cost.usd === 0 ? "$0.00 idle" : `~$${fleet.cost.usd.toFixed(2)}`) : "—"}
+              hint={fleet?.cost.basis}
             />
           </div>
           {ov.totals.unknownTenants > 0 ? (
@@ -329,8 +329,9 @@ export function AdminPane({ user }: { user: { username: string; name: string; ro
                   table that is deliberately not here. */}
               <h4 className="padmin-h4">Automation cost</h4>
               <p className="set-help">
-                {fleet.rows.filter((a) => a.enabled).length} scheduled of {fleet.rows.length}
-                {fleet.cost.fleetRunsPerDay
+                {fleet.rows.filter((a) => a.enabled).length} recurring of {fleet.rows.length}
+                {`, ${fleet.cost.nativeSchedules} exact schedule${fleet.cost.nativeSchedules === 1 ? "" : "s"}`}
+                {fleet.cost.fleetRunsPerDay
                   ? `, about ${fleet.cost.fleetRunsPerDay} runs a day`
                   : ""}
                 {fleet.cost.unknownCadence

web/src/settings/platformAdminApi.ts

@@ -136,6 +136,8 @@ export interface AutomationRow {
   cron: string;
   /** null = a cadence the server would not parse; shown as "custom", never as a number. */
   runsPerDay: number | null;
+  nativeSchedules: number | null;
+  scheduleModes: string[];
   state: string;
   lastRunAt: string;
   lastSummary: string;
@@ -146,11 +148,11 @@ export interface AutomationRow {
 }
 
 export interface FleetCost {
+  mode: "exact-schedules-fargate";
   cadence: string;
+  nativeSchedules: number;
   invocationsPerMonth: number;
-  freeRequestsPct: number;
-  freeSchedulerPct: number;
-  lambdaMb: number;
+  perRunMinimumUsd: number;
   usd: number;
   fleetRunsPerDay: number;
   unknownCadence: number;
@@ -214,6 +216,8 @@ export function getAutomations(
     cost: FleetCost;
     errors: Record<string, string>;
     tickEnabled: boolean;
+    controlEnabled: boolean;
+    executionMode: "exact-aws" | "local-disabled";
   }>
 > {
   return call(`/automations${q(tenant)}`);