Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,5 +1,5 @@
 {
- "current": "bf8387b",
+ "current": "5d8aacc",
  "releases": [
   {
    "version": "v53",

VERSION

@@ -1 +1 @@
-bf8387b
+5d8aacc

api/routes_odoo_tables.py

@@ -831,6 +831,24 @@ def _json_arg(raw, what):
     return val
 
 
+def _clean_include_pids(raw):
+    """Bounded existing Link choices, or a named bad-argument refusal.
+
+    A picker condition narrows what a person may add. It never rewrites existing links, so a
+    read-through window carries those ids as an explicit exception. The normal table and row wall
+    remains outside that exception in `odoo_table_rows` below.
+    """
+    if raw is None:
+        return []
+    if not isinstance(raw, list):
+        raise ValueError("includePids must be a JSON list of record ids")
+    if len(raw) > 500:
+        raise ValueError("includePids may name at most 500 existing linked records")
+    if any(type(pid) is not int or pid <= 0 for pid in raw):
+        raise ValueError("includePids must contain positive integer record ids")
+    return sorted(set(raw))
+
+
 @router.get("/odoo-tables/{table_key}/rows")
 def odoo_table_rows(table_key: str,
                     offset: int = Query(default=0, ge=0),
@@ -839,6 +857,7 @@ def odoo_table_rows(table_key: str,
                     filterConj: str = Query(default="and"),
                     sorts: str = Query(default=None),
                     search: str = Query(default=None),
+                    includePids: str = Query(default=None),
                     session: Session = Depends(require_session)):
     """ONE WINDOW over a connected grid, read straight from the mirror (contract C2).
 
@@ -985,6 +1004,10 @@ def odoo_table_rows(table_key: str,
     base_where = (f'({spec["where"]}) AND {wall_sql}'
                   if (spec["where"] and wall_sql) else (wall_sql or spec["where"]))
     limits, tree = [], _json_arg(filters, "filters")
+    try:
+        include_pids = _clean_include_pids(_json_arg(includePids, "includePids"))
+    except ValueError as e:
+        raise err(400, "bad_argument", str(e))
     sort_spec = _json_arg(sorts, "sorts") or []
 
     # R6's SECOND SENTENCE, ON THE WALL ITSELF. The precision note further down covers the
@@ -1046,7 +1069,7 @@ def odoo_table_rows(table_key: str,
             "recommendation": "compare against a whole number, or use a range that does not sit "
                               "on a fractional boundary"})
 
-    where, params = base_where, list(wall_params)
+    predicate_sql, predicate_params = None, []
     try:
         pred = _fs().compile_filter_tree(
             tree, conj=(filterConj if filterConj in ("and", "or") else "and"), columns=cols,
@@ -1060,13 +1083,25 @@ def odoo_table_rows(table_key: str,
             raise err(400, "filter_unsupported",
                       "a condition on an aggregate column belongs in HAVING, and that path is "
                       "deliberately not built for windowed grids")
-        where = f"({where}) AND {pred.sql}" if where else pred.sql
-        params.extend(pred.params)
+        predicate_sql = pred.sql
+        predicate_params.extend(pred.params)
     if str(search or "").strip():
         got = _fs().compile_search(search.strip(), cols)
         if got is not None:
-            where = f"({where}) AND {got.sql}" if where else got.sql
-            params.extend(got.params)
+            predicate_sql = (f"({predicate_sql}) AND {got.sql}"
+                             if predicate_sql else got.sql)
+            predicate_params.extend(got.params)
+
+    # Existing choices survive a new picker condition, but the table's permanent wall stays
+    # outside this OR. A caller cannot use an old link id to reveal a record the database wall
+    # would otherwise deny.
+    if include_pids and predicate_sql:
+        slots = ", ".join("?" for _ in include_pids)
+        predicate_sql = f"(({predicate_sql}) OR ({spec['id']} IN ({slots})))"
+        predicate_params.extend(include_pids)
+    where = (f"({base_where}) AND ({predicate_sql})" if base_where and predicate_sql
+             else (predicate_sql or base_where))
+    params = [*wall_params, *predicate_params]
 
     # ── the order, made TOTAL ─────────────────────────────────────────────────────────────────
     # ⛔ `tiebreak_sql` is not optional here: without a total order, LIMIT/OFFSET may return one

api/routes_shares.py

@@ -878,6 +878,39 @@ def get_share(kind: str, oid: str, session: Session = Depends(require_session)):
     }
 
 
+@router.delete("/share/field/{oid}/mine")
+def remove_my_field_share(oid: str, session: Session = Depends(require_session)):
+    """Remove only this session's direct grant on one shared field.
+
+    This is deliberately not a shortened form of the replacing PUT route.  A grantee may leave
+    a column shared to them, but may not submit a list that can revoke anybody else.  A wildcard
+    grant is also not removable here: deleting it would remove the column from everybody.
+    """
+    table_key, field_key = shares.split_field_oid(oid)
+    if not table_key or not field_key:
+        raise err(404, "no_object", "no such column, or it is not shared with this account")
+    oid = shares.field_oid(_field_storage_keys(table_key)[2], field_key)
+    rec = shares.grants("field", oid, st=session.runtime)
+    uname = str(session.uname or "").strip().lower()
+    direct = [entry for entry in rec["entries"] if entry.get("user") == uname]
+    if not direct:
+        if shares.role_for("field", oid, uname, is_admin=session.admin, st=session.runtime):
+            raise err(409, "not_direct_grant",
+                      "this column is shared with everyone in this workspace, so there is no "
+                      "personal grant to remove. Nothing was changed.")
+        raise err(404, "no_object", "no such column, or it is not shared with this account")
+    if shares.role_for("field", oid, uname, is_admin=session.admin, st=session.runtime) == "owner":
+        raise err(409, "owner_cannot_leave",
+                  "you own this column. Reassign or delete it instead of removing yourself from it.")
+    kept = [entry for entry in rec["entries"] if entry.get("user") != uname]
+    try:
+        shares.set_grants("field", oid, kept, owner=rec["owner"], st=session.runtime,
+                          expect=rec["entries"])
+    except shares.GrantsChanged as exc:
+        raise err(409, "grants_changed", str(exc))
+    return {"removed": True, "field": field_key}
+
+
 def _people(tenant):
     """[{username, name}] for this tenant — same population as `assignable_people`, with the
     BINDING identity alongside the display one."""

api/routes_tables.py

@@ -2491,6 +2491,11 @@ def _with_dropped(ut, out, body):
 def _refusal_sentence(ut, session, body, table_key="", fkey=""):
     """Why was this column refused? The specific reason when we can name one, the general list
     otherwise — never a specific-sounding guess."""
+    # W42-T36: the validator returns only ``None``.  Keep the option-cap wording in its
+    # single owner so both add and patch tell the person exactly what was refused.
+    option_refusal = ut.option_cap_refusal((body or {}).get("options"))
+    if option_refusal:
+        return option_refusal
     # ⭐ WAVE-34 (R13): the enrichment column's own sentence, named BEFORE the automation bag
     # below. `_clean_field` DERIVES `field.automation` for this kind, so a refused enrichment
     # column would otherwise be explained by the flow law -- "pick a flow, or make this an
@@ -2569,7 +2574,11 @@ def patch_field(table_key: str, fkey: str, body: dict = Body(default=None),
                 migrated = dict(migrated or {}, workspace=True)
         except Exception:                                         # noqa: BLE001
             migrated = dict(migrated or {}, workspace=False)
-    field = ut.patch_field(table_key, fkey, body, st=session.runtime)
+    # A type change can clear values that no longer have a meaning in the target column.  Keep
+    # that report separate from the field itself: callers that only need the field retain the
+    # established shape, while a future editor can state the consequence from the same response.
+    retype = {}
+    field = ut.patch_field(table_key, fkey, body, st=session.runtime, preview=retype)
     if not field:
         # C3: the same narrator as `add_field`. Flagging a SECOND column is the same act as
         # adding one, so it must get the same sentence naming the column that already holds the
@@ -2581,6 +2590,8 @@ def patch_field(table_key: str, fkey: str, body: dict = Body(default=None),
     field = synced.get("field") or field
     _refresh_relations(session)
     out = {"field": field}
+    if retype:
+        out["retype"] = retype
     # ⭐⭐ W41-T15 / C5 — the same report `add_field` carries, on the door that RETARGETS a link.
     # This one matters more: pointing an existing link at `customer_data` deletes the backlink the
     # old target held (the stale-inverse sweep) and cannot make a new one, so the column silently

platform/core/store.py

@@ -656,13 +656,15 @@ class Store:
     def upload_bytes(self, path_in_repo, data, message=None):
         """Persist RAW BYTES at an arbitrary path in the tenant dataset (wave-8 C5, documents).
         Bytes are never cached in-process: large, cold, fetched on explicit user action."""
+        # Refusal dominates availability: an uncredentialed staging process must still learn that
+        # it is forbidden from targeting production, rather than receive a generic token error.
+        data_binding.check_write(self.repo, f'write bytes {path_in_repo!r}')
         if not self.available():
             raise RuntimeError('No HF_TOKEN configured — persistence is unavailable.')
         # D-315: a blob is still this tenant's data. ⚠ No `parent_commit` here and that is correct,
         # not an omission: a blob is written at its own path and read whole, so two writers cannot
         # silently merge into one damaged document the way `{name}.json` can. The concurrency
         # hazard D-305 describes is specific to the shared JSON blob.
-        data_binding.check_write(self.repo, f'write bytes {path_in_repo!r}')
         with self._lock:
             self._ensure_repo()
             HfApi(token=_token()).upload_file(
@@ -693,9 +695,9 @@ class Store:
         tolerable no-op. "You are not allowed to touch this store" is not a no-op — it is the
         thing the operator has to be told.
         """
+        data_binding.check_write(self.repo, f'delete {path_in_repo!r}')
         if not self.available():
             return False
-        data_binding.check_write(self.repo, f'delete {path_in_repo!r}')
         try:
             HfApi(token=_token()).delete_file(
                 path_in_repo=path_in_repo, repo_id=self.repo, repo_type='dataset',
@@ -729,9 +731,9 @@ class Store:
         have actually SEEN — and that any `update` queued behind it replays on top — instead of
         being uploaded over an hour of unseen work.
         """
+        data_binding.check_write(self.repo, f'put {name!r}')
         if not self.available():
             raise RuntimeError('No HF_TOKEN configured — persistence is unavailable.')
-        data_binding.check_write(self.repo, f'put {name!r}')
         with self._key_lock(name):
             def _replace(_current):
                 return json.loads(json.dumps(data))

platform/core/user_tables.py

@@ -940,7 +940,9 @@ def checkbox_mark(field):
     """
     f = field if isinstance(field, dict) else {}
     return {'icon': f.get('icon') or CHECKBOX_ICON_DEFAULT,
-            'color': f.get('color') or CHECKBOX_COLOR_DEFAULT}
+            # ``colour`` was accepted by an earlier field-editor draft.  Read it for
+            # old definitions, but keep the product wire canonical as ``color``.
+            'color': f.get('color') or f.get('colour') or CHECKBOX_COLOR_DEFAULT}
 
 
 def rating_symbol(field):
@@ -1209,7 +1211,7 @@ def clean_fields(raw):
             icon = str(f.get('icon') or '').strip().lower()
             if icon in CHECKBOX_ICONS:
                 entry['icon'] = icon
-            cb_color = str(f.get('color') or '').strip().upper()
+            cb_color = str(f.get('color') or f.get('colour') or '').strip().upper()
             if _OPTION_COLOR_RE.fullmatch(cb_color):
                 entry['color'] = cb_color
         if f.get('default') is True:
@@ -3066,7 +3068,14 @@ def _clean_field(raw, previous=None):
                    or '').strip().lower()
         if icon in CHECKBOX_ICONS:
             out['icon'] = icon
-        color_raw = raw.get('color') if 'color' in raw else prev.get('color')
+        # Accept the editor's British-spelling draft key as input as well as the
+        # established API spelling, then persist one canonical ``color`` key.
+        if 'color' in raw:
+            color_raw = raw.get('color')
+        elif 'colour' in raw:
+            color_raw = raw.get('colour')
+        else:
+            color_raw = prev.get('color') or prev.get('colour')
         color = str(color_raw or '').strip().upper()
         if _OPTION_COLOR_RE.fullmatch(color):
             out['color'] = color

platform/harness/measure_filter.py

@@ -559,6 +559,12 @@ def resolve_pair(rule, today, team_id=None, allowed_pids=None):
             f"question, and both look like they work.")
     cmp = _CMP[op]
 
+    # Validate BOTH windows before touching the store.  Otherwise a malformed right-hand
+    # condition can be hidden by an unrelated cache-warming error from the left-hand query,
+    # leaving the caller with neither its refusal nor a safe answer.
+    _query_parts(lkey, rule.get('window'), today, team_id)
+    _query_parts(rkey, rhs.get('window'), today, team_id)
+
     pool = _pool_of(allowed_pids)
     con = _sem._store_con()
     try:

platform/harness/runtime.py

@@ -267,7 +267,11 @@ class TenantRuntime:
         first_odoo = next((e["id"] for e in entries if e.get("type") == "odoo"), None)
         if first_odoo and keychain.unlocked():
             return first_odoo
-        if self.key == "royal-imports" and os.environ.get("ODOO_URL"):
+        # Tenant #0's compiled connector is the ENV fallback.  Its presence is the
+        # capability contract for the system card; consulting ODOO_URL here instead
+        # makes the card (and its pause address) depend on the host process rather
+        # than the same source that odoo_source() resolves.
+        if self.key == "royal-imports" and self.odoo_source() is not None:
             return ENV_ODOO_FLAG_KEY
         return None
 

web/src/customer-grid/ColumnMenu.tsx

@@ -6,7 +6,7 @@ import { FieldAgentChat } from "./FieldAgentChat";
 import type { FieldProposal } from "./fieldAgent";
 import { AnchoredOverlay } from "./OverlaySurface";
 import type { AnchorRect } from "./OverlaySurface";
-import { FieldTypeIcon, MenuLabel } from "./icons";
+import { FieldTypeIcon, InfoMark, MenuLabel } from "./icons";
 import { FieldSelectButton } from "./FieldSelect";
 // ⭐⭐ W40-T24 — the pre-set definition lock. It lives in `display.ts` rather than here because a
 // rule stated inside JSX cannot be LOADED by a node gate; `display.ts`'s header carries the full
@@ -106,7 +106,13 @@ interface FieldConfigExtra {
    *  None for a link with no bag, so a create without this is a column that never appears. */
   /** ⭐⭐ W42-T08 (R1, C1) — plus, OPTIONALLY, the two-hop `via`. Absent is today's one-hop
    *  join, byte-identical to what this menu emitted before the hop existed. */
-  link?: { table: string; single?: boolean; via?: HopViaBag };
+  link?: {
+    table: string;
+    single?: boolean;
+    via?: HopViaBag;
+    conditions?: RollupCondition[];
+    conditionConj?: "and" | "or";
+  };
   /** ⭐ 2026-08-07 — a `rollup` column's aggregate. Same requirement, same reason.
    *  ⭐ 2026-08-09 — or, INSTEAD, a `source` binding: the read-through kind, which summarises
    *  rows that were never copied into the workspace. The host's `_clean_rollup` reads `source`
@@ -324,20 +330,11 @@ interface ColumnMenuProps {
    * DIFFERENT ACT from `onDelete`, and therefore a different door: it destroys no definition and
    * no values, and pointing "Remove from my fields" at the delete handler would be a benign word
    * on a destructive action.
-   * ⭐⭐ W42-T13 (instruction 2, D-485) — REQUIRED NOW, AND THAT IS THE WHOLE TICKET. It shipped
-   * OPTIONAL and unwired, and the control below is gated on the handler's own presence
-   * (`canRemoveFromMine && onRemoveFromMine`), so with no host feeding it the row did not render
-   * at all: on screen, indistinguishable from a feature nobody built. Required means an unfed
-   * mount stops compiling instead of quietly offering nothing.
-   *
-   * ⛔ WHAT IT MAY NOT BE IS A SILENT NO-OP. No server door drops you off a field's own grant
-   * list: `PUT /share/{kind}/{oid}` needs `may_administer`, which a plain grantee does not hold,
-   * and sending `entries: []` there is the OWNER revoking everyone, a different act. So the host
-   * hands this the same refusal `useFieldBulkDoors::onRemoveField` already speaks for the Fields
-   * manager, which says so in one sentence. A button that renders, is pressed, and does nothing
-   * is strictly worse than a button that is absent.
+   * A host supplies this only when it has a real self-removal server door.  The current API does
+   * not permit a grantee to withdraw only themself, so the grid intentionally leaves the row
+   * absent instead of wiring it to a toast or a destructive share rewrite.
    */
-  onRemoveFromMine: () => void;
+  onRemoveFromMine?: () => void;
   /** ⭐⭐ Wave-34 (R13) — run this AI enrichment column over many rows.
    *  `scope` is `"blank"` (only cells still empty) or `"always"` (every row the AI
    *  wrote). OPTIONAL for `onDelete`'s reason: a host that has not wired the door shows
@@ -1147,6 +1144,8 @@ function TypePicker({
                 type="button"
                 role="option"
                 aria-selected={value === r.value}
+                aria-label={r.label}
+                aria-describedby={`cg-type-description-${r.value}`}
                 className={"cg-type-row" + (value === r.value ? " is-on" : "")}
                 onClick={() => onPick(r.value)}
               >
@@ -1162,30 +1161,19 @@ function TypePicker({
                   }
                   size={16}
                 />
-                {/* ⭐⭐ W42-T37 (R24) — THE LABEL AND THE LINE THAT SAYS WHAT IT DOES.
-                    ⛔ INSIDE the button, not a sibling of it: arrow-key navigation collects
-                    `button.cg-type-row`, so a description outside would be a row the keyboard
-                    walks past and a screen reader reads detached from its option.
-                    ⚠ The layout is stated here rather than in index.css because that stylesheet
-                    belongs to another fence this wave; `.cg-type-label` keeps its own `flex: 1`
-                    and only its single-line clamp is lifted, which is the property a second line
-                    needs. */}
+                {/* The type name is all this dense picker needs to scan. R24's load-bearing
+                    explanation lives on the compact (i): native title makes it discoverable on
+                    hover, while aria-describedby keeps it attached to the focused option. */}
+                <span className="cg-type-label">{r.label}</span>
                 <span
-                  className="cg-type-label"
-                  style={{
-                    display: "flex", flexDirection: "column", gap: 1,
-                    whiteSpace: "normal", overflow: "visible", minWidth: 0,
-                  }}
+                  className="cg-type-info"
+                  title={TYPE_DESCRIPTIONS[r.value]}
+                  aria-hidden="true"
                 >
-                  <span>{r.label}</span>
-                  <span
-                    style={{
-                      fontSize: "var(--lp-fs-3xs)", color: "var(--lp-muted)",
-                      fontWeight: 400, lineHeight: 1.3,
-                    }}
-                  >
-                    {TYPE_DESCRIPTIONS[r.value]}
-                  </span>
+                  <InfoMark />
+                </span>
+                <span id={`cg-type-description-${r.value}`} className="cg-sr-only">
+                  {TYPE_DESCRIPTIONS[r.value]}
                 </span>
                 {value === r.value && (
                   <svg
@@ -1556,6 +1544,10 @@ function ExtraTypeEditor({
   onLinkTable,
   linkSingle = false,
   onLinkSingle,
+  linkConditions = [],
+  onLinkConditions,
+  linkConditionConj = "and",
+  onLinkConditionConj,
   hop,
   rollupPreset = null,
   rollupMode = "link",
@@ -1624,6 +1616,10 @@ function ExtraTypeEditor({
   onLinkTable?: (v: string) => void;
   linkSingle?: boolean;
   onLinkSingle?: (v: boolean) => void;
+  linkConditions?: RollupCondition[];
+  onLinkConditions?: (v: RollupCondition[]) => void;
+  linkConditionConj?: "and" | "or";
+  onLinkConditionConj?: (v: "and" | "or") => void;
   /**
    * ⭐⭐ W42-T08 (R1, C1 + C2) — the HOP question, and it is REQUIRED at every mount on purpose.
    *
@@ -2045,6 +2041,19 @@ function ExtraTypeEditor({
           />
           <span>Allow only one linked record</span>
         </label>
+        {linkTable ? (
+          <RollupConditionList
+            idPrefix={`${idPrefix}-link-condition`}
+            title="Offer only"
+            hint="Applied when choosing records. Links already saved in this column stay visible."
+            conditions={linkConditions}
+            onConditions={(value) => onLinkConditions?.(value)}
+            conj={linkConditionConj}
+            onConj={(value) => onLinkConditionConj?.(value)}
+            targetFields={hopTargetFields}
+            allowRef={false}
+          />
+        ) : null}
         {/* ⛔⛔ THIS SENTENCE IS FALSE ONCE A HOP IS SET, so it is not shown then. With a hop the
             cell does not hold "the records you pick": it holds the records the middle step
             resolves, and a panel asserting otherwise beside the control that changed it is the
@@ -2812,6 +2821,8 @@ export default function ColumnMenu({
    */
   const [linkTable, setLinkTable] = useState("");
   const [linkSingle, setLinkSingle] = useState(false);
+  const [linkConditions, setLinkConditions] = useState<RollupCondition[]>([]);
+  const [linkConditionConj, setLinkConditionConj] = useState<"and" | "or">("and");
   // ⭐⭐ W42-T08 (R1, C1) — the HOP draft for the create pane. `topic: ""` is "no hop", and it is
   // the default, so a Link field created without touching this question emits exactly the bag it
   // emitted before this existed.
@@ -2976,6 +2987,12 @@ export default function ColumnMenu({
     });
   const [editLinkTable, setEditLinkTable] = useState(() => field.link?.table ?? "");
   const [editLinkSingle, setEditLinkSingle] = useState(() => field.link?.single === true);
+  const [editLinkConditions, setEditLinkConditions] = useState<RollupCondition[]>(
+    () => field.link?.conditions ?? []
+  );
+  const [editLinkConditionConj, setEditLinkConditionConj] = useState<"and" | "or">(
+    () => field.link?.conditionConj ?? "and"
+  );
   // ⛔⛔ W42-T08 — SEEDED FROM THE STORED BAG, and this is not a nicety. The relational save
   // below is a REBUILD: it re-emits the whole `link` bag, so a hop the pane never read would be
   // DELETED by the one click meant to rename the column. Round-tripping it is what makes the
@@ -3173,6 +3190,9 @@ export default function ColumnMenu({
         link: {
           table: linkTable,
           ...(linkSingle ? { single: true } : {}),
+          ...(linkConditions.length
+            ? { conditions: linkConditions, conditionConj: linkConditionConj }
+            : {}),
           ...(via ? { via } : {}),
         },
       };
@@ -3420,6 +3440,8 @@ export default function ColumnMenu({
       ? JSON.stringify(editRollup) !== JSON.stringify(field.rollup ?? {})
       : editLinkTable !== (field.link?.table ?? "") ||
         editLinkSingle !== (field.link?.single === true) ||
+        JSON.stringify(editLinkConditions) !== JSON.stringify(field.link?.conditions ?? []) ||
+        editLinkConditionConj !== (field.link?.conditionConj ?? "and") ||
         // ⚠ COMPARED AS THE BAG, NOT AS THE DRAFT. `hopDraftFrom` normalises an absent `via` and
         // an absent `window` to the same seeded draft the empty one produces, so comparing the
         // drafts by `JSON.stringify` would report a hop change on a pane nobody touched, which is
@@ -3510,6 +3532,10 @@ export default function ColumnMenu({
           // refuses the second.
           : { link: { table: editLinkTable,
                       ...(editLinkSingle ? { single: true } : {}),
+                      ...(editLinkConditions.length
+                        ? { conditions: editLinkConditions,
+                            conditionConj: editLinkConditionConj }
+                        : {}),
                       ...(hopVia(editHopDraft, hopScopeKey)
                         ? { via: hopVia(editHopDraft, hopScopeKey)! }
                         : {}) } }),
@@ -3872,9 +3898,16 @@ export default function ColumnMenu({
             onAutomationUrlField={setAutomationUrlField}
             linkTargets={linkTargets}
             linkTable={linkTable}
-            onLinkTable={setLinkTable}
+            onLinkTable={(value) => {
+              setLinkTable(value);
+              setLinkConditions([]);
+            }}
             linkSingle={linkSingle}
             onLinkSingle={setLinkSingle}
+            linkConditions={linkConditions}
+            onLinkConditions={setLinkConditions}
+            linkConditionConj={linkConditionConj}
+            onLinkConditionConj={setLinkConditionConj}
             hop={{
               topics: hopTopics,
               // The hop travels through a governed topic, so its window vocabulary is the one the
@@ -4192,9 +4225,16 @@ export default function ColumnMenu({
                 onCodeLanguage={setEditCodeLanguage}
                 idPrefix="cg-edit"
                 linkTable={editLinkTable}
-                onLinkTable={setEditLinkTable}
+                onLinkTable={(value) => {
+                  setEditLinkTable(value);
+                  setEditLinkConditions([]);
+                }}
                 linkSingle={editLinkSingle}
                 onLinkSingle={setEditLinkSingle}
+                linkConditions={editLinkConditions}
+                onLinkConditions={setEditLinkConditions}
+                linkConditionConj={editLinkConditionConj}
+                onLinkConditionConj={setEditLinkConditionConj}
                 hop={{
                   topics: hopTopics,
                   windows: rollupSourceOffer.windows,

web/src/customer-grid/CustomerGrid.tsx

@@ -70,8 +70,8 @@ import {
 } from "./scriptViews";
 import type { ScriptRun, ScriptView as ScriptViewRecord, ScriptViewRow } from "./scriptViews";
 import { defaultViewConfig, headerMarksFor, useGridColumns } from "./useGridColumns";
-import { activeMeasureRuleIds, pendingMeasures, runPipeline, sliceForDisplay,
-  unresolvedConditions, useVisibleRows } from "./useVisibleRows";
+import { activeMeasureRuleIds, matchFilterTree, pendingMeasures, runPipeline, sliceForDisplay,
+  unresolvedConditionReasons, useVisibleRows } from "./useVisibleRows";
 import { computeAggs } from "./aggregations";
 import type { CohortSets } from "./useVisibleRows";
 import type { MeasureSets } from "./useVisibleRows";
@@ -82,6 +82,8 @@ import JsonViewer from "./JsonViewer";
 import RecordDetail from "./RecordDetail";
 import ViewSidebar from "./ViewSidebar";
 import ColumnMenu from "./ColumnMenu";
+import FieldBatchAccessDialog from "./FieldBatchAccessDialog";
+import type { FieldBatchAccessAction } from "./FieldBatchAccessDialog";
 import type { ColumnMenuState, HopTopic } from "./ColumnMenu";
 import { HEADER_ICONS } from "./iconShapes";
 import { emitHostEvent, eventId } from "./hostBridge";
@@ -173,7 +175,7 @@ import { ALL_VIEW_ID, MAX_CALENDAR_METRICS, allViewName,
   viewDisplayName,
   /* ⭐ W37-T26 (C4) — the view-membership leaf's two pure helpers. `viewRefsOf` is the ONE walk
      the resolver, the cycle detector and the gate share; `viewFilterCycle` is the refusal. */
-  viewFilterCycle, viewRefsOf } from "./types";
+  viewFilterCycle, viewRefsOf, linkPickerFilterNodes } from "./types";
 /* ⭐⭐ W41-T42 (owner instruction 23) — the pivot's whole vocabulary is DECLARED in `types.ts`
    and only consumed here, because W41-T43 (this file) and W41-T44 (`RecordDetail.tsx`) open the
    same feature through other doors and neither of them may edit `types.ts`. */
@@ -193,6 +195,7 @@ import type {
   PivotWindow,
   Row,
   RowHeightMode,
+  RollupCondition,
   SavedView,
   ViewConfig,
 } from "./types";
@@ -735,18 +738,10 @@ export function fieldDeleteDoor(
  * would take the column off the screen while it still exists in the store, so the refusal would
  * read as a success until the next workspace fetch put the column back.
  *
- * ⛔⛔ SHARE, REASSIGN AND REMOVE REFUSE OUT LOUD RATHER THAN DOING NOTHING, and that is the
- * whole point of wiring them at all (D-485: a control that silently no-ops is worse than one
- * that is absent). The server doors for the first two exist and are per object
- * (`PUT /share/field/{oid}` and `PUT /share/field/{oid}/owner`), but both need a PERSON picked,
- * and the only opener this tree may reach is the `aios:share-open` event, which carries ONE oid.
- * Firing it five times is exactly the five-dialog experience R3 asked to be replaced, so these
- * say so in one sentence instead. `onRemoveField` has no door at all: dropping yourself from a
- * colleague's grant list needs `may_administer`, which a plain grantee does not hold.
- *
- * ⚠ NOT CALLED FROM THIS COMPONENT YET, and that is a fence, not an oversight:
- * `customer-grid/Toolbar.tsx` declares none of the five props and is the only thing standing
- * between these doors and the panel. Wiring it is the next ticket's; see the handoff.
+ * Share, reassign, and self-removal deliberately have no bulk door here.  The first two APIs are
+ * per field and require a person picker; the last has no safe server operation for a grantee.
+ * Passing a toast callback would render a button that does not perform its named action, so the
+ * Toolbar receives `null` for all three until their real contracts exist.
  */
 export interface FieldBulkDoorDeps {
   config: ViewConfig;
@@ -765,10 +760,7 @@ export interface FieldBulkDoorDeps {
 
 export interface FieldBulkDoors {
   onSetFieldsHidden: (keys: string[], hidden: boolean) => void;
-  onShareFields: (keys: string[]) => void;
-  onReassignFields: (keys: string[]) => void;
   onDeleteFields: (keys: string[]) => void;
-  onRemoveField: (key: string) => void;
 }
 
 /**
@@ -900,30 +892,9 @@ export function useFieldBulkDoors(deps: FieldBulkDoorDeps): FieldBulkDoors {
       stampFieldDelete, updateConfig, visible]
   );
 
-  const onShareFields = useCallback((keys: string[]) => {
-    if (keys.length === 0) return;
-    signal(TOAST_EVENT,
-      "Sharing several fields in one go is not available yet, so share them one at a time from " +
-      "each column's own menu.");
-  }, []);
-
-  const onReassignFields = useCallback((keys: string[]) => {
-    if (keys.length === 0) return;
-    signal(TOAST_EVENT,
-      "Handing several fields to a new owner in one go is not available yet, so change the " +
-      "owner one column at a time from its share panel.");
-  }, []);
-
-  const onRemoveField = useCallback((key: string) => {
-    if (!key) return;
-    signal(TOAST_EVENT,
-      "Taking a shared field off your own list is not available yet, so hide it or ask the " +
-      "person who owns it to withdraw it.");
-  }, []);
-
   return useMemo(
-    () => ({ onSetFieldsHidden, onShareFields, onReassignFields, onDeleteFields, onRemoveField }),
-    [onDeleteFields, onReassignFields, onRemoveField, onSetFieldsHidden, onShareFields]
+    () => ({ onSetFieldsHidden, onDeleteFields }),
+    [onDeleteFields, onSetFieldsHidden]
   );
 }
 
@@ -1235,6 +1206,9 @@ interface CustomerGridProps {
   /** W42-T29 — the SOURCE record, withheld from its own candidate list so a record cannot be
    *  offered as a link to itself. Applied on top of any projection above. */
   embeddedExcludeRecordId?: number;
+  /** W42-T35 — static conditions narrow candidates only; saved links are never rewritten. */
+  embeddedLinkConditions?: readonly RollupCondition[];
+  embeddedLinkConditionConj?: "and" | "or";
 }
 
 /**
@@ -1275,10 +1249,17 @@ export function scopeForLinkTable(table: unknown): SurfaceScope | undefined {
   return table as `ut_${string}`;
 }
 
+/**
+ * W42-T35 — Link conditions deliberately use the server's Rollup vocabulary while the grid
+ * evaluator speaks the view vocabulary. This is the sole adapter: a picker condition is static,
+ * flat and has no rank, view, cohort or dynamic-field arm.
+ */
 interface LinkGridModalProps {
   label: string;
   table: SurfaceScope;
   recordIds: readonly number[];
+  conditions?: readonly RollupCondition[];
+  conditionConj?: "and" | "or";
   editable?: boolean;
   single?: boolean;
   /** The source record, when this picker draws the source record's OWN database. */
@@ -1287,8 +1268,8 @@ interface LinkGridModalProps {
   onClose: () => void;
 }
 
-function LinkGridModal({ label, table, recordIds, editable = false, single = false,
-  excludeRecordId, onSave, onClose }: LinkGridModalProps) {
+function LinkGridModal({ label, table, recordIds, conditions = [], conditionConj = "and",
+  editable = false, single = false, excludeRecordId, onSave, onClose }: LinkGridModalProps) {
   const panelRef = useRef<HTMLDivElement>(null);
   const [selectedIds, setSelectedIds] = useState<number[]>(() => [...recordIds]);
   const changeSelectedIds = useCallback((ids: number[]) => {
@@ -1348,6 +1329,8 @@ function LinkGridModal({ label, table, recordIds, editable = false, single = fal
               embedded
               embeddedRecordIds={editable ? undefined : recordIds}
               embeddedExcludeRecordId={editable ? excludeRecordId : undefined}
+              embeddedLinkConditions={editable ? conditions : undefined}
+              embeddedLinkConditionConj={conditionConj}
               embeddedSelectable={editable}
               embeddedSelectedIds={selectedIds}
               onEmbeddedSelectionChange={changeSelectedIds}
@@ -1425,6 +1408,8 @@ function CustomerGridSurface({
   embeddedSelectedIds = [],
   onEmbeddedSelectionChange,
   embeddedExcludeRecordId,
+  embeddedLinkConditions = [],
+  embeddedLinkConditionConj = "and",
 }: CustomerGridProps = {}) {
   const isQueryPreview = queryBinding !== undefined;
   /**
@@ -1822,6 +1807,19 @@ function CustomerGridSurface({
     ? `query:${queryBinding.workspaceBinding.key}`
     : payload?.workspace?.storageKey ?? `${LOCAL_KEY_PREFIX}${scope}`;
 
+  /** The field-share route speaks this durable surface key, never a browser cache key. */
+  const fieldGrantTableKey = isQueryPreview
+    ? null
+    : scope === "product"
+      ? "product_data"
+      : scope.startsWith("ut_")
+        ? scope
+        : "customer_data";
+  const [fieldBatchAccess, setFieldBatchAccess] = useState<{
+    action: FieldBatchAccessAction;
+    keys: string[];
+  } | null>(null);
+
   // Initialize once per permission/data scope. Host state wins; local state
   // fills only missing objects and keeps the standalone path useful.
   useEffect(() => {
@@ -2256,6 +2254,45 @@ function CustomerGridSurface({
   const isUserTable = !embedded && scope.startsWith("ut_");
   const recordsMutable = payload?.recordsMutable !== false;
   const canMutateRecords = isUserTable && recordsMutable;
+  const batchAccessFields = useMemo(
+    () => (fieldBatchAccess?.keys ?? [])
+      .map((key) => fieldByKey.get(key))
+      .filter((field): field is Field => !!field)
+      .map((field) => ({ key: field.key, label: field.label })),
+    [fieldBatchAccess, fieldByKey]
+  );
+  const openFieldBatchAccess = useCallback((action: FieldBatchAccessAction, keys: string[]) => {
+    if (!fieldGrantTableKey) {
+      signal(TOAST_EVENT, "Field access is unavailable on this preview.");
+      return;
+    }
+    setFieldBatchAccess({ action, keys: [...new Set(keys)] });
+  }, [fieldGrantTableKey]);
+  const removeFieldFromMine = useCallback((field: Field) => {
+    if (!fieldGrantTableKey) return;
+    void (async () => {
+      const path = `${API_V1}/share/field/${encodeURIComponent(`${fieldGrantTableKey}:${field.key}`)}/mine`;
+      const res = await fetch(path, { method: "DELETE", credentials: CREDENTIALS }).catch(() => null);
+      if (!res) {
+        signal(TOAST_EVENT, "Cannot reach the server.");
+        return;
+      }
+      if (!res.ok) {
+        const body = (await res.json().catch(() => null)) as { error?: { message?: unknown } } | null;
+        const message = body?.error?.message;
+        signal(TOAST_EVENT, typeof message === "string" && message.trim()
+          ? message.trim()
+          : `The server answered ${res.status}.`);
+        return;
+      }
+      setFields((current) => current.filter((item) => item.key !== field.key));
+      updateConfig(configWithoutFields({ ...config, order, visible: [...visible] }, [field.key]));
+      clearTopicRowsCache(topic.rowsPath);
+      signal(WORKSPACE_STALE_EVENT);
+      signal(ROWS_STALE_EVENT);
+      signal(TOAST_EVENT, `${field.label} was removed from your fields.`);
+    })();
+  }, [config, fieldGrantTableKey, order, setFields, topic.rowsPath, updateConfig, visible]);
   /**
    * ⭐⭐ W42-T12 (D-485, amendment A20) — THE FIELD MANAGER'S FIVE DOORS, CALLED AT LAST.
    *
@@ -2590,6 +2627,24 @@ function CustomerGridSurface({
     if (displayMode !== "map") setRoutePanelOpen(false);
   }, [displayMode]);
 
+  // W42-T35: the same static Link condition must reach the server when the target table is
+  // windowed. Filtering only the loaded page would make matching records outside that page
+  // unreachable. Existing selections remain exceptions so a new condition never erases a link.
+  const embeddedLinkFilterNodes = useMemo(
+    () => linkPickerFilterNodes(embeddedLinkConditions),
+    [embeddedLinkConditions]
+  );
+  const linkPickerFilters = embeddedSelectable && embeddedLinkFilterNodes.length > 0
+    ? embeddedLinkFilterNodes
+    : config.filters;
+  const linkPickerFilterConj = embeddedSelectable && embeddedLinkFilterNodes.length > 0
+    ? embeddedLinkConditionConj
+    : config.filterConj;
+  const embeddedLinkSelectionKey = embeddedSelectedIds.join(",");
+  const linkPickerPreservedIds = embeddedSelectable && embeddedLinkFilterNodes.length > 0
+    ? embeddedSelectedIds
+    : [];
+
   // ═══════════════════════════════════════════════════════════════════════════════════════
   // ⭐⭐ WAVE 30 · W30-T42 (contract C2) — PAGING A READ-THROUGH GRID.
   // ═══════════════════════════════════════════════════════════════════════════════════════
@@ -2601,20 +2656,22 @@ function CustomerGridSurface({
   // question. So the predicate has to reach the evaluator that CAN answer it, which is SQL.
   //
   // ⛔ THE SAVED VIEW'S OWN OBJECTS GO ON THE WIRE, UNTRANSLATED (see `windowRowsPath`).
-  const windowPredicate = useMemo(
-    () => windowPredicateKey(config.filters, config.filterConj, config.sorts, search),
-    [config.filters, config.filterConj, config.sorts, search]
-  );
+  const windowPredicate = useMemo(() => {
+    const base = windowPredicateKey(linkPickerFilters, linkPickerFilterConj, config.sorts, search);
+    return linkPickerPreservedIds.length ? `${base}|link:${embeddedLinkSelectionKey}` : base;
+  }, [linkPickerFilters, linkPickerFilterConj, config.sorts, search, linkPickerPreservedIds,
+      embeddedLinkSelectionKey]);
   const windowRequest = useCallback(
     (offset: number) => ({
       offset,
       limit: WINDOW_ROWS,
-      filters: config.filters,
-      filterConj: config.filterConj,
+      filters: linkPickerFilters,
+      filterConj: linkPickerFilterConj,
       sorts: config.sorts,
       search,
+      includePids: linkPickerPreservedIds,
     }),
-    [config.filters, config.filterConj, config.sorts, search]
+    [linkPickerFilters, linkPickerFilterConj, config.sorts, search, linkPickerPreservedIds]
   );
   const sentPredicate = useRef<string | null>(null);
   useEffect(() => {
@@ -2775,6 +2832,23 @@ function CustomerGridSurface({
     });
   }, [rawRows, overlayEdits, formulaAsts, createdTimeKeys, payload?.today]);
 
+  // W42-T35 — a link filter constrains the records an editor may ADD, not the relationships that
+  // already exist. The latter remain in the modal so a new rule cannot erase an older choice.
+  const embeddedLinkEligibleIds = useMemo(() => {
+    if (!embeddedSelectable || embeddedLinkFilterNodes.length === 0)
+      return new Set(computedRows.map((row) => row.pid));
+    return new Set(computedRows.filter((row) => matchFilterTree(
+      embeddedLinkFilterNodes, embeddedLinkConditionConj, row, fieldByKey, { today, strict: true }
+    )).map((row) => row.pid));
+  }, [computedRows, embeddedSelectable, embeddedLinkFilterNodes, embeddedLinkConditionConj,
+      fieldByKey, today]);
+  const linkCandidateRows = useMemo(() => {
+    if (!embeddedSelectable || embeddedLinkFilterNodes.length === 0) return computedRows;
+    const saved = new Set(embeddedSelectedIds);
+    return computedRows.filter((row) => saved.has(row.pid) || embeddedLinkEligibleIds.has(row.pid));
+  }, [computedRows, embeddedSelectable, embeddedLinkFilterNodes, embeddedLinkEligibleIds,
+      embeddedLinkSelectionKey]);
+
   /**
    * ⭐⭐ W37-T26 / CONTRACT C4 — `view id -> the pids that view resolves to`, for the VIEW
    * MEMBERSHIP leaf (`Where View is [some view]`).
@@ -2872,16 +2946,17 @@ function CustomerGridSurface({
     [activeViewId, views, config, updateConfig]
   );
 
-  const unresolvedCount = useMemo(
+  const unresolvedReasons = useMemo(
     // ⭐ W37-T26 (C4) — `viewSets` rides this context too. Without it a view leaf would ALWAYS
     // count as unresolved (the chip would cry wolf on a working filter) and, worse, a leaf naming
     // a DELETED view would look identical to one naming a live one.
     // ⭐⭐ D-229 — `fieldByKey` rides this context so a condition naming a column this table no
     // longer has is COUNTED. `evalNode` ignores such a leaf (correctly), which means the grid was
     // showing MORE rows than the filter panel claimed with nothing on screen saying so.
-    () => unresolvedConditions(config.filters, { cohortSets, viewSets, fieldByKey, today }),
+    () => unresolvedConditionReasons(config.filters, { cohortSets, viewSets, fieldByKey, today }),
     [config.filters, cohortSets, viewSets, fieldByKey, today]
   );
+  const unresolvedCount = unresolvedReasons.length;
 
   // Wave-2 item 2c — COHORT MODE (the Cohort page). The host serves the WHOLE pool (rows +
   // derived values over the pool); the ACTIVE cohort scopes the table to its pids CLIENT-side.
@@ -2905,9 +2980,9 @@ function CustomerGridSurface({
   const scopedRows = useMemo(
     () =>
       cohortMode
-        ? computedRows.filter((r) => cohortMemberSet.has(r.pid))
-        : computedRows,
-    [cohortMode, computedRows, cohortMemberSet]
+        ? linkCandidateRows.filter((r) => cohortMemberSet.has(r.pid))
+        : linkCandidateRows,
+    [cohortMode, linkCandidateRows, cohortMemberSet]
   );
 
   const { visibleRows, pidToIndex } = useVisibleRows(
@@ -3400,7 +3475,7 @@ function CustomerGridSurface({
       embeddedSelectable ? embeddedSelectedIds : [],
       !embedded ? `aios:grid-selection:${scope}` : undefined
     );
-  const embeddedSelectedKey = embeddedSelectedIds.join(",");
+  const embeddedSelectedKey = embeddedLinkSelectionKey;
   const selectedPidKey = [...selectedPids].join(",");
   useEffect(() => {
     if (!embeddedSelectable) return;
@@ -3409,8 +3484,13 @@ function CustomerGridSurface({
   }, [embeddedSelectable, embeddedSelectedKey, embeddedSelectedIds, selectedPidKey, selectPids]);
   useEffect(() => {
     if (!embeddedSelectable) return;
-    onEmbeddedSelectionChange?.([...selectedPids]);
-  }, [embeddedSelectable, onEmbeddedSelectionChange, selectedPids]);
+    const previous = new Set(embeddedSelectedIds);
+    const next = [...selectedPids].filter((pid) =>
+      embeddedLinkFilterNodes.length === 0 || embeddedLinkEligibleIds.has(pid) || previous.has(pid)
+    );
+    onEmbeddedSelectionChange?.(next);
+  }, [embeddedSelectable, onEmbeddedSelectionChange, selectedPids, embeddedSelectedIds,
+      embeddedLinkFilterNodes, embeddedLinkEligibleIds]);
   /* ════════════════════════ owner item 16 / R4 / C-UNDO ════════════════════════
      THE RECORDING LAYER. `undoStack.ts` owns the stack and every inverse; this owns the one
      thing it cannot: reading the value a cell held BEFORE the write, which only exists at the
@@ -8258,18 +8338,21 @@ function CustomerGridSurface({
             if (target && target.shared && target.kind === "route_order") deleteRouteField(key);
             else deleteField(key);
           }}
-          /* ⭐⭐ W42-T12 (D-485, amendment A20) — THE FIELD MANAGER'S FIVE DOORS AND WHO IS
-             LOOKING. This is the mount that renders the manager, so this is the mount that has
-             to feed it: a ticked selection with Hide, Show, Share, Reassign or Delete behind it
-             now reaches `useFieldBulkDoors`, which batches each act into a single config write.
-             `viewer` is what lets contract C2's rights pair be asked per row, so a colleague's
-             shared column offers "Remove from my fields" and never a delete. */
           viewer={viewer}
           onSetFieldsHidden={fieldBulkDoors.onSetFieldsHidden}
-          onShareFields={fieldBulkDoors.onShareFields}
-          onReassignFields={fieldBulkDoors.onReassignFields}
+          onShareFields={fieldGrantTableKey
+            ? (keys) => openFieldBatchAccess("share", keys)
+            : null}
+          onReassignFields={fieldGrantTableKey
+            ? (keys) => openFieldBatchAccess("reassign", keys)
+            : null}
           onDeleteFields={fieldBulkDoors.onDeleteFields}
-          onRemoveField={fieldBulkDoors.onRemoveField}
+          onRemoveField={fieldGrantTableKey
+            ? (key) => {
+                const field = fieldByKey.get(key);
+                if (field) removeFieldFromMine(field);
+              }
+            : null}
           /* ⭐⭐ W38-T07 (owner instruction 12) — THE ONE COLOUR CONTROL. This was `colorOn` plus a
              boolean toggle whose `true` arm guessed the column: `fields.find(type === "status")`,
              so on a table with two status columns the person got the first one and had no way to
@@ -8295,6 +8378,7 @@ function CustomerGridSurface({
           statusValues={statusValues}
           measures={measures}
           unresolvedCount={unresolvedCount}
+          unresolvedReasons={unresolvedReasons}
           lists={lists}
           /* ⭐⭐ W37-T26 (C4) — the views this database's conditions may name: every SAVED view
              except the one being edited (a view naming itself is the cycle a person reaches most
@@ -9597,34 +9681,14 @@ function CustomerGridSurface({
                 }
               : undefined
           }
-          /**
-           * ⭐⭐ W42-T13 (instruction 2, D-485) — "Remove from my fields" GETS ITS HOST.
-           *
-           * W41-T29 built the row in `ColumnMenu.tsx` and gated it on the handler's own presence
-           * (`canRemoveFromMine && onRemoveFromMine`), with the prop OPTIONAL and nobody passing
-           * it. So the row never rendered, at either mount, and the shipped feature looked exactly
-           * like a feature nobody built. The prop is required now; this is the feed.
-           *
-           * ⛔⛔ IT REFUSES OUT LOUD, AND THAT IS DELIBERATE, NOT A STUB. There is no server door
-           * for the act: `PUT /share/{kind}/{oid}` refuses anyone without `may_administer`, which
-           * a plain grantee (the only person who ever sees this row) does not hold, and its
-           * `entries: []` body is the OWNER revoking everyone, which is a different act with a
-           * different blast radius. `useFieldBulkDoors::onRemoveField` already speaks the one
-           * sentence that says so for the Fields manager's copy of this control, so both surfaces
-           * say the same thing rather than drifting into two wordings of one refusal.
-           * ⛔ NOT `deleteField`, and not the definition or route doors either. Dropping a share
-           * destroys nothing, so pointing this at a delete would put a benign word on a
-           * destructive act — the one failure W41-T29's note says must not ship.
-           *
-           * ⛔⛔ PASSED AT BOTH `<ColumnMenu>` MOUNTS. This file's own history is the reason the
-           * rule keeps being restated beside each prop: a prop fed at the full column menu and
-           * not at its "+" twin is the half-landing that `linkTargets` and `hopTopics` both
-           * carry warnings about, caught by grepping and never by the build.
-           */
-          onRemoveFromMine={() => {
-            fieldBulkDoors.onRemoveField(menuField.key);
-            setColumnMenu(null);
-          }}
+          onRemoveFromMine={
+            menuField.shared && menuField.sharedRole !== "owner"
+              ? () => {
+                  removeFieldFromMine(menuField);
+                  setColumnMenu(null);
+                }
+              : undefined
+          }
           onDuplicate={
             // Creatable strata only — a base Odoo field offers no Duplicate (contract).
             menuField.custom && !menuField.shared ? () => duplicateField(menuField) : undefined
@@ -9732,28 +9796,8 @@ function CustomerGridSurface({
           onNote={() => undefined}
           onHide={() => undefined}
           onCreate={createField}
-          /**
-           * ⭐⭐ W42-T13 — THE SECOND MOUNT, and it takes the REAL door rather than an inert
-           * `() => undefined` like the action handlers above it. The row is not reachable here
-           * today (this mount opens straight into the create form, its nominal field is the
-           * locked identity column, and `locked` plus `mayRemoveField`'s refusals stand between
-           * it and the screen), and that is precisely why an inert stub would be so cheap to
-           * write and so expensive later: the
-           * moment anything makes it reachable, a silent no-op is D-485 restored at one door with
-           * the twin working. The two doors say the same sentence or neither does.
-           *
-           * ⚠ `lockedKey` and not `menuField.key`: this mount's `field` IS the locked identity
-           * column, so the twin's `menuField` does not exist in this scope. Copying the sibling
-           * body verbatim would have compiled against the wrong identifier or not at all.
-           */
-          onRemoveFromMine={() => {
-            fieldBulkDoors.onRemoveField(lockedKey);
-            setPlusMenu(null);
-          }}
-          /* The SAME answer as the sibling instance above, stated rather than defaulted: this is
-             the "+" menu and it creates through the identical `createField`, so a different value
-             here would mean one door offers the kind and its twin does not. The note above the
-             other instance carries the reasoning, including why it is now unconditional. */
+          /* Keep the twin aligned: no self-removal affordance without a safe server door. */
+          onRemoveFromMine={undefined}
           geocodable={true}
           onChangeField={() => undefined}
           onCreateAndSwap={() => undefined}
@@ -10030,11 +10074,27 @@ function CustomerGridSurface({
           onClose={closeJson}
         />
       )}
+      {fieldBatchAccess && fieldGrantTableKey && batchAccessFields.length > 0 ? (
+        <FieldBatchAccessDialog
+          action={fieldBatchAccess.action}
+          tableKey={fieldGrantTableKey}
+          fields={batchAccessFields}
+          onClose={() => setFieldBatchAccess(null)}
+          onComplete={(message) => {
+            clearTopicRowsCache(topic.rowsPath);
+            signal(WORKSPACE_STALE_EVENT);
+            signal(ROWS_STALE_EVENT);
+            signal(TOAST_EVENT, message);
+          }}
+        />
+      ) : null}
       {linkField && linkTargetScope && linkAt && (
         <LinkGridModal
           label={linkField.label}
           table={linkTargetScope}
           recordIds={linkedRecordIds}
+          conditions={linkField.link?.conditions}
+          conditionConj={linkField.link?.conditionConj}
           editable={canEditField(linkField) && !isDerivedLink(linkField)}
           single={linkField.link?.single === true}
           excludeRecordId={linkTargetScope === scope ? linkAt.pid : undefined}

web/src/customer-grid/FieldBatchAccessDialog.tsx

@@ -0,0 +1,233 @@
+// ---------------------------------------------------------------------------
+// customer-grid / FieldBatchAccessDialog.tsx
+//
+// One small access editor for the Field manager's plural Share and Reassign
+// actions.  It deliberately uses the existing field-share routes rather than
+// inventing a second permissions model: every selected field keeps its own
+// grants, and the server remains the authority for each individual refusal.
+// ---------------------------------------------------------------------------
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { API_V1, CREDENTIALS } from "../apiContract";
+
+export type FieldBatchAccessAction = "share" | "reassign";
+
+interface Person {
+  user: string;
+  name: string;
+}
+
+interface Entry {
+  user: string;
+  role: "view" | "edit";
+}
+
+function asPeople(raw: unknown): Person[] {
+  if (!Array.isArray(raw)) return [];
+  const seen = new Set<string>();
+  const people: Person[] = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const candidate = item as Record<string, unknown>;
+    const user = typeof candidate.username === "string" ? candidate.username.trim().toLowerCase() : "";
+    const name = typeof candidate.name === "string" ? candidate.name.trim() : "";
+    if (!user || seen.has(user)) continue;
+    seen.add(user);
+    people.push({ user, name: name || user });
+  }
+  return people;
+}
+
+function asEntries(raw: unknown): Entry[] {
+  if (!Array.isArray(raw)) return [];
+  const seen = new Set<string>();
+  const entries: Entry[] = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const candidate = item as Record<string, unknown>;
+    const user = typeof candidate.user === "string" ? candidate.user.trim().toLowerCase() : "";
+    const role = candidate.role === "view" || candidate.role === "edit" ? candidate.role : null;
+    if (!user || !role || seen.has(user)) continue;
+    seen.add(user);
+    entries.push({ user, role });
+  }
+  return entries;
+}
+
+async function replyMessage(res: Response): Promise<string> {
+  const body = (await res.json().catch(() => null)) as { error?: { message?: unknown } } | null;
+  const message = body?.error?.message;
+  return typeof message === "string" && message.trim() ? message.trim() : `The server answered ${res.status}.`;
+}
+
+export default function FieldBatchAccessDialog({
+  action,
+  tableKey,
+  fields,
+  onClose,
+  onComplete,
+}: {
+  action: FieldBatchAccessAction;
+  tableKey: string;
+  fields: readonly { key: string; label: string }[];
+  onClose: () => void;
+  onComplete: (message: string) => void;
+}) {
+  const [people, setPeople] = useState<Person[]>([]);
+  const [person, setPerson] = useState("");
+  const [role, setRole] = useState<Entry["role"]>("view");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+  const [result, setResult] = useState("");
+  const first = fields[0];
+  const title = action === "share" ? "Share fields" : "Reassign fields";
+  const subject = fields.length === 1 ? `“${first?.label ?? "field"}”` : `${fields.length} fields`;
+
+  const pathFor = useCallback(
+    (key: string) => `${API_V1}/share/field/${encodeURIComponent(`${tableKey}:${key}`)}`,
+    [tableKey]
+  );
+
+  useEffect(() => {
+    let alive = true;
+    if (!first) return () => { alive = false; };
+    void (async () => {
+      const res = await fetch(pathFor(first.key), { credentials: CREDENTIALS }).catch(() => null);
+      if (!alive) return;
+      if (!res) {
+        setError("Cannot reach the server.");
+        return;
+      }
+      if (!res.ok) {
+        setError(await replyMessage(res));
+        return;
+      }
+      const body = (await res.json().catch(() => null)) as Record<string, unknown> | null;
+      const offered = asPeople(body?.people);
+      setPeople(offered);
+      if (offered.length === 0) setError("No eligible people were returned for this workspace.");
+    })();
+    return () => { alive = false; };
+  }, [first, pathFor]);
+
+  useEffect(() => {
+    const onKey = (event: KeyboardEvent) => {
+      if (event.key === "Escape" && !busy) onClose();
+    };
+    window.addEventListener("keydown", onKey);
+    return () => window.removeEventListener("keydown", onKey);
+  }, [busy, onClose]);
+
+  const canApply = !!person && !busy && !result;
+  const buttonText = action === "share" ? "Share" : "Reassign";
+  const personLabel = useMemo(
+    () => people.find((item) => item.user === person)?.name ?? person,
+    [people, person]
+  );
+
+  const apply = useCallback(() => {
+    if (!canApply) return;
+    void (async () => {
+      setBusy(true);
+      setError("");
+      let changed = 0;
+      const refused: string[] = [];
+      for (const field of fields) {
+        const path = pathFor(field.key);
+        const read = await fetch(path, { credentials: CREDENTIALS }).catch(() => null);
+        if (!read) {
+          refused.push(`${field.label}: Cannot reach the server.`);
+          continue;
+        }
+        if (!read.ok) {
+          refused.push(`${field.label}: ${await replyMessage(read)}`);
+          continue;
+        }
+        const current = (await read.json().catch(() => null)) as Record<string, unknown> | null;
+        const response = action === "share"
+          ? await fetch(path, {
+              method: "PUT",
+              credentials: CREDENTIALS,
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({
+                entries: [
+                  ...asEntries(current?.entries).filter((entry) => entry.user !== person),
+                  { user: person, role },
+                ],
+              }),
+            }).catch(() => null)
+          : await fetch(`${path}/owner`, {
+              method: "PUT",
+              credentials: CREDENTIALS,
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ owner: person }),
+            }).catch(() => null);
+        if (!response) {
+          refused.push(`${field.label}: Cannot reach the server.`);
+        } else if (!response.ok) {
+          refused.push(`${field.label}: ${await replyMessage(response)}`);
+        } else {
+          changed += 1;
+        }
+      }
+      const noun = changed === 1 ? "field" : "fields";
+      const verb = action === "share" ? "shared with" : "reassigned to";
+      const message = changed > 0
+        ? `${changed} ${noun} ${verb} ${personLabel}.`
+        : "No selected fields were changed.";
+      setResult(message);
+      if (refused.length > 0) setError(refused.join(" "));
+      if (changed > 0) onComplete(message);
+      setBusy(false);
+    })();
+  }, [action, canApply, fields, onComplete, pathFor, person, personLabel, role]);
+
+  return (
+    <div className="shell-newdb-scrim" onClick={() => (busy ? null : onClose())}>
+      <section
+        className="shell-newdb shell-share"
+        role="dialog"
+        aria-modal="true"
+        aria-label={`${title} ${subject}`}
+        onClick={(event) => event.stopPropagation()}
+      >
+        <h2>{title}</h2>
+        <p className="shell-newdb-sub">
+          {action === "share"
+            ? `Give ${personLabel || "someone"} access to ${subject}. Existing access on each field stays in place.`
+            : `Make ${personLabel || "someone"} the owner of ${subject}. A field must already be shared before it can be reassigned.`}
+        </p>
+        <div className="shell-share-add">
+          <select
+            className="shell-share-select"
+            aria-label="Person"
+            value={person}
+            disabled={busy || !!result}
+            onChange={(event) => setPerson(event.target.value)}
+          >
+            <option value="">Choose a person</option>
+            {people.map((item) => <option key={item.user} value={item.user}>{item.name}</option>)}
+          </select>
+          {action === "share" ? (
+            <select
+              className="shell-share-select"
+              aria-label="Access level"
+              value={role}
+              disabled={busy || !!result}
+              onChange={(event) => setRole(event.target.value === "edit" ? "edit" : "view")}
+            >
+              <option value="view">Can view</option>
+              <option value="edit">Can edit</option>
+            </select>
+          ) : null}
+        </div>
+        {result ? <p className="shell-share-summary">{result}</p> : null}
+        {error ? <p className="shell-newdb-err">{error}</p> : null}
+        <div className="shell-newdb-actions">
+          <button type="button" disabled={busy} onClick={onClose}>{result ? "Done" : "Cancel"}</button>
+          {!result ? <button type="button" className="login-submit" disabled={!canApply} onClick={apply}>{busy ? "Applying..." : buttonText}</button> : null}
+        </div>
+      </section>
+    </div>
+  );
+}

web/src/customer-grid/MapView.tsx

@@ -511,6 +511,8 @@ export function MapView({
   const [routeCols, setRouteCols] = useState<
     (RouteNavRoute & { inputsHash: string; depot?: RouteDepot | null })[] | null
   >(null);
+  /** A failed route-list read is not an empty route list. */
+  const [routeListError, setRouteListError] = useState<string | null>(null);
   /**
    * ⭐⭐ W42-T24 (contract C6) — THIS READER'S ROUTE FOLDERS, and they ride the SAME listing.
    *
@@ -1175,20 +1177,36 @@ export function MapView({
    * the only way the STALE marker can exist at all.
    */
   const loadRouteCols = useCallback(async () => {
+    setRouteListError(null);
     try {
       const res = await fetch("/api/v1/customers/route-order", { credentials: "same-origin" });
-      const body = res.ok ? await res.json().catch(() => null) : null;
-      setRouteCols(Array.isArray(body?.fields) ? body.fields : []);
+      const body = await res.json().catch(() => null);
+      if (!res.ok || !Array.isArray(body?.fields)) {
+        const detail = body?.detail?.message || body?.detail || body?.error?.message;
+        setRouteListError(typeof detail === "string" && detail.trim()
+          ? detail
+          : "Saved routes could not be loaded. Retry to see them.");
+        setRouteCols([]);
+        setRouteFolders([]);
+        setNextLabel("");
+        return;
+      }
+      setRouteCols(body.fields);
       // W42-T23 / C6 — the rail's own folder ROWS travel with the listing.
       setRouteFolders(Array.isArray(body?.folders) ? (body.folders as GridFolder[]) : []);
       setNextLabel(typeof body?.nextLabel === "string" ? body.nextLabel : "");
     } catch {
-      // A listing that cannot be fetched is "none known", not an error banner over the map: the
-      // planner still works, and the save below reports its own failure in its own words.
+      setRouteListError("Saved routes could not be loaded. Retry to see them.");
       setRouteCols([]);
+      setRouteFolders([]);
+      setNextLabel("");
     }
   }, []);
 
+  const retryRouteList = useCallback(() => {
+    void loadRouteCols();
+  }, [loadRouteCols]);
+
   // ⭐ OWNER, 2026-08-23 — `routePanelOpen`, NOT `routeOn`. The saved-route picker is the first
   // control in the panel and it is how a person reaches somebody's plan without solving one of
   // their own, so the listing has to be in hand the moment the panel opens rather than after a
@@ -2499,6 +2517,8 @@ export function MapView({
               openKey={openedRoute}
               busyKey={routeBusyKey}
               notice={railNotice}
+              listError={routeListError}
+              onListRetry={retryRouteList}
               onOpenRoute={openSavedRoute}
               onCreateRoute={startNewRoute}
               onRenameRoute={renameRoute}

web/src/customer-grid/RouteNav.tsx

@@ -155,6 +155,9 @@ export interface RouteNavProps {
    * row (standing rule 1's second sentence: reported, never silent).
    */
   notice: string;
+  /** A failed listing is distinct from the honest empty state and offers an immediate retry. */
+  listError: string | null;
+  onListRetry: () => void;
   /** ONE CLICK OPENS A ROUTE. There is no second gesture and no confirm step. */
   onOpenRoute: (key: string) => void;
   /** CREATING IS A SEPARATE AFFORDANCE, never a row in the list of what exists. */
@@ -196,6 +199,8 @@ export function RouteNav({
   openKey,
   busyKey,
   notice,
+  listError,
+  onListRetry,
   onOpenRoute,
   onCreateRoute,
   onRenameRoute,
@@ -482,7 +487,12 @@ export function RouteNav({
       ) : null}
 
       <div className="cg-route-nav-list" {...sectionDrop(ROOT_FOLDER_ID)}>
-        {routes.length === 0 ? (
+        {listError ? (
+          <div className="cg-route-nav-notice" role="alert">
+            <span>{listError}</span>
+            <button type="button" className="cg-link-btn" onClick={onListRetry}>Retry</button>
+          </div>
+        ) : routes.length === 0 ? (
           <div className="cg-fold-empty">
             No routes yet. Plan one on the map, then save it to keep it here.
           </div>

web/src/customer-grid/SwipeView.tsx

@@ -1,586 +1,586 @@
-// ---------------------------------------------------------------------------
-// customer-grid / SwipeView.tsx
-// ⭐ WAVE-27 item 8 (owner ruling R2, contract C3) — the SWIPE deck.
-//
-// One record at a time, decided left or right into two options of ONE
-// single-select. R2 fixes the shape and it is narrow on purpose:
-//   · SINGLE-SELECT ONLY, one field, two of its options. No checkbox binding.
-//   · the deck holds only the records whose bound field is EMPTY — a record
-//     that already has a value has been decided, and re-asking is not triage.
-//   · a swipe writes through the NORMAL cell door (`onSwipe`, which the host
-//     maps to the same `patchAndRecord` a kanban card move uses), so undo,
-//     echo-suppression and the permission wall all hold without being
-//     re-implemented here.
-//
-// Honesty rules carried from the other modes:
-//   · nothing is silently hidden — the deck states what is left, and the
-//     empty state names the bound field rather than saying "all done".
-//   · a lost binding is SHOWN, never repaired by guessing. `_clean_display`
-//     validates that `fieldKey` names a field the table HAS and stops there;
-//     it cannot know the field is still a select, or that the two options are
-//     still in its vocabulary (its docstring draws that line explicitly). So
-//     those three losses land here, and each one says what happened and
-//     re-opens the picker — the `viewModes.tsx:190-194` rule, which exists
-//     because the wave-7 trap was a picker silently falling back to its first
-//     option.
-// ---------------------------------------------------------------------------
-
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-// ⭐⭐ W41-T48 (owner instruction 22) — opening a record from the swipe deck folds the shell's
-// navigation rail exactly as a grid cell click does. Guard rationale: `MapView.tsx:2755`.
-import { NAV_MINIMIZE_EVENT, signal } from "../apiContract";
-import { choiceOptions } from "./types";
-import type { CustomerDoc, DisplaySpec, Field, Row, Viewer } from "./types";
-// ⚠ `SurfaceScope` is `apiBridge`'s (a TYPE-only import, so nothing of that module is
-//   loaded here) — the same import `RecordComments` takes for the same prop.
-import type { SurfaceScope } from "./apiBridge";
-import RecordComments from "./RecordComments";
-import { Documents } from "./Documents";
-import { formatDisplay } from "./cells";
-import { actionHref } from "./display";
-import { optionTint } from "./choiceColors";
-import { ModeIcon } from "./icons";
-// ⭐ W29-T73 — the line its three siblings all have, and the one this file shipped without.
-// `SwipeView.css` had ZERO references anywhere in `src/`, so T26's two new sections rendered
-// unstyled while `.cg-swipe-card` (which lives in `index.css`) kept the card looking right —
-// a partially-styled surface reads as a design choice, which is why nobody reported it and no
-// gate could see it: a side-effect import references no symbol ([[artifact-with-no-importer]]).
-import "./SwipeView.css";
-
-export type SwipeSpec = NonNullable<DisplaySpec["swipe"]>;
-
-/** The three ways a stored binding can rot that the host cannot see (see the header note). */
-type BindingFault =
-  | { kind: "unbound" }
-  | { kind: "field-gone"; fieldKey: string }
-  | { kind: "not-select"; field: Field }
-  | { kind: "option-gone"; field: Field; missing: string[] };
-
-function readBinding(spec: SwipeSpec | undefined, fieldByKey: Map<string, Field>):
-  { ok: true; field: Field; spec: SwipeSpec } | { ok: false; fault: BindingFault } {
-  if (!spec) return { ok: false, fault: { kind: "unbound" } };
-  const field = fieldByKey.get(spec.fieldKey);
-  if (!field) return { ok: false, fault: { kind: "field-gone", fieldKey: spec.fieldKey } };
-  // R2 — SINGLE-select only. `multiselect` is deliberately not accepted: its cell holds a SET,
-  // so "write this option" would mean append-or-replace, and a triage gesture that sometimes
-  // adds and sometimes overwrites is two gestures wearing one button.
-  if (field.type !== "select") return { ok: false, fault: { kind: "not-select", field } };
-  const options = choiceOptions(field);
-  const has = new Set(options.map((o) => o.toLowerCase()));
-  const missing = [spec.leftOption, spec.rightOption].filter((o) => !has.has(o.toLowerCase()));
-  if (missing.length) return { ok: false, fault: { kind: "option-gone", field, missing } };
-  return { ok: true, field, spec };
-}
-
-/** The bound cell is EMPTY — the one predicate that decides deck membership (R2). */
-const isUndecided = (row: Row, key: string): boolean =>
-  String(row[key] ?? "").trim() === "";
-
-export function SwipeView({
-  rows,
-  fields,
-  fieldByKey,
-  spec,
-  cardKeys,
-  detailKeys,
-  scope,
-  viewer,
-  docs,
-  docPayload,
-  onDocAdd,
-  onDocFetch,
-  onDocDelete,
-  titleKey,
-  canWrite,
-  readOnlyReason,
-  canBind,
-  onSpec,
-  onSwipe,
-  onOpen,
-}: {
-  /** DISTINCT data rows from the full pipeline, overlay edits layered — the kanban's contract.
-   *  The deck re-derives from these, so a written record leaves it as soon as the optimistic
-   *  patch lands; there is no local cursor to drift out of step with the data. */
-  rows: Row[];
-  /** Every field, for the picker's field list. */
-  fields: Field[];
-  fieldByKey: Map<string, Field>;
-  /** The stored binding, or undefined for a deck nobody has configured yet. */
-  spec: SwipeSpec | undefined;
-  /** The handful of visible fields the card lists under its title. */
-  cardKeys: string[];
-  titleKey: string;
-  /** May this viewer write the BOUND field's value? (the kanban's `canMove`) */
-  canWrite: boolean;
-  /** Stated when the deck cannot be decided — permissions, or a computed column. */
-  readOnlyReason: string | null;
-  /** May this viewer change what the deck is bound TO? A VIEW-config act, so it is the
-   *  view-editing permission and NOT `canWrite` — conflating the two is
-   *  [[schema-role-is-not-a-value-wall]]. REQUIRED, because a picker that silently does
-   *  nothing is worse than no picker ([[wrong-parent-not-broken-control]]). */
-  canBind: boolean;
-  /** `undefined` DELETES the binding — absent is the honest unconfigured state, and storing a
-   *  half-binding is what `cleanDisplay` drops on both engines (the `kanbanClamp` law). */
-  onSpec: (next: SwipeSpec | undefined) => void;
-  onSwipe: (pid: number, value: string) => void;
-  onOpen: (pid: number) => void;
-  /**
-   * ⭐⭐ WAVE-29 T26 (owner R9) — WHAT MAKES THE CARD A RECORD RATHER THAN A SUMMARY.
-   *
-   * R9: *"the swipe CARD itself renders the record detail inline — fields, comments and
-   * attachments — so a reviewer decides without leaving the deck."* Everything below is that,
-   * and every one of them is OPTIONAL for one reason: this deck runs on hosts that supply
-   * different amounts. A card must render with none of them rather than throw — the standalone
-   * embed has no `scope`, and a deployment with no document storage serves no handlers.
-   */
-  /** Every field the VIEW shows, in its order — not the three-key card summary. */
-  detailKeys?: string[];
-  /** The surface these records live on. Comments are keyed by it; absent ⇒ no comments section,
-   *  which is the pre-existing precondition `RecordDetail` already carries. */
-  scope?: SurfaceScope;
-  viewer?: Viewer;
-  /** This record's attachments, and the plumbing. Handlers absent ⇒ the section is not rendered
-   *  at all, exactly as `RecordDetail` decides it (a dead upload control is a promise the app
-   *  cannot keep). */
-  /** Keyed by pid, because a deck shows many records — `RecordDetail` takes ONE record's list
-   *  and that shape cannot serve a deck. */
-  docs?: Record<string, CustomerDoc[]>;
-  docPayload?: { pid: number; docId: string; name: string; mime: string; data_b64: string };
-  /** ⚠ EVERY HANDLER TAKES THE PID, unlike `RecordDetail`'s, whose host closes over the ONE
-   *  open record. A deck paints many records at once, so a handler bound to a single pid would
-   *  attach every reviewer's upload to whichever card happened to be open. */
-  onDocAdd?: (
-    pid: number,
-    file: { name: string; mime: string; size: number; data_b64: string }
-  ) => void;
-  onDocFetch?: (pid: number, docId: string) => void;
-  onDocDelete?: (pid: number, docId: string) => void;
-}) {
-  // "Later" — session-only, never stored. A deck with no way past a record you cannot decide
-  // blocks on that record forever, so this is navigation WITHIN the deck rather than a third
-  // gesture: it writes nothing, survives no reload, and the count is disclosed in the empty
-  // state rather than quietly shrinking the deck (rule 8b).
-  const [later, setLater] = useState<Set<number>>(new Set());
-  const deckRef = useRef<HTMLDivElement>(null);
-
-  const binding = useMemo(() => readBinding(spec, fieldByKey), [spec, fieldByKey]);
-  const boundKey = binding.ok ? binding.field.key : null;
-
-  const undecided = useMemo(
-    () => (boundKey ? rows.filter((r) => isUndecided(r, boundKey)) : []),
-    [rows, boundKey]
-  );
-  const deck = useMemo(() => undecided.filter((r) => !later.has(r.pid)), [undecided, later]);
-  const card = deck[0];
-
-  // A record decided elsewhere (the grid, another user's echo) must not stay "later" forever —
-  // otherwise the disclosed skip count drifts away from what is actually on the deck.
-  useEffect(() => {
-    setLater((prev) => {
-      if (prev.size === 0) return prev;
-      const live = new Set(undecided.map((r) => r.pid));
-      const next = new Set([...prev].filter((pid) => live.has(pid)));
-      return next.size === prev.size ? prev : next;
-    });
-  }, [undecided]);
-
-  const decide = useCallback(
-    (value: string) => {
-      if (!card || !canWrite) return;
-      onSwipe(card.pid, value);
-    },
-    [card, canWrite, onSwipe]
-  );
-
-  // ← / → decide, and they are the SAME two actions the buttons are rather than a second code
-  // path: the whole point of the mode is that one hand can clear a queue.
-  useEffect(() => {
-    if (!binding.ok || !canWrite || !card) return;
-    const onKey = (e: KeyboardEvent) => {
-      if (e.key !== "ArrowLeft" && e.key !== "ArrowRight") return;
-      const el = document.activeElement as HTMLElement | null;
-      // Never steal an arrow key from a text field or a native control the user is inside.
-      if (el && (el.tagName === "INPUT" || el.tagName === "SELECT" || el.tagName === "TEXTAREA"))
-        return;
-      if (!deckRef.current?.contains(el ?? null) && el !== document.body) return;
-      e.preventDefault();
-      decide(e.key === "ArrowLeft" ? binding.spec.leftOption : binding.spec.rightOption);
-    };
-    window.addEventListener("keydown", onKey);
-    return () => window.removeEventListener("keydown", onKey);
-  }, [binding, canWrite, card, decide]);
-
-  if (!binding.ok) {
-    return (
-      <div className="cg-swipe" ref={deckRef}>
-        <SwipeBinder
-          fault={binding.fault}
-          fields={fields}
-          fieldByKey={fieldByKey}
-          spec={spec}
-          canBind={canBind}
-          onSpec={onSpec}
-        />
-      </div>
-    );
-  }
-
-  const { field } = binding;
-  const leftTint = optionTint(field, binding.spec.leftOption);
-  const rightTint = optionTint(field, binding.spec.rightOption);
-
-  return (
-    <div className="cg-swipe" ref={deckRef} tabIndex={-1}>
-      <div className="cg-swipe-bar">
-        <span className="cg-swipe-bound">
-          <ModeIcon mode="swipe" />
-          Sorting into <strong>{field.label}</strong>
-        </span>
-        <span className="cg-swipe-left">
-          {deck.length.toLocaleString()} {deck.length === 1 ? "record" : "records"} to sort
-        </span>
-        {canBind && (
-          <button
-            type="button"
-            className="cg-link-btn"
-            onClick={() => onSpec(undefined)}
-            title="Choose a different field or different options for this deck"
-          >
-            Change
-          </button>
-        )}
-      </div>
-      {readOnlyReason && <div className="cg-kb-note">{readOnlyReason}</div>}
-      {card ? (
-        <div className="cg-swipe-deck">
-          <button
-            type="button"
-            className="cg-swipe-side cg-swipe-side--left"
-            disabled={!canWrite}
-            style={leftTint ? { background: leftTint.bg, color: leftTint.fg } : undefined}
-            onClick={() => decide(binding.spec.leftOption)}
-            title={`Set ${field.label} to ${binding.spec.leftOption} (left arrow key)`}
-          >
-            <span aria-hidden className="cg-swipe-arrow">
-              <svg width="16" height="16" viewBox="0 0 16 16">
-                <path
-                  d="M11 3.2 6.2 8l4.8 4.8"
-                  fill="none"
-                  stroke="currentColor"
-                  strokeWidth="1.6"
-                  strokeLinecap="round"
-                  strokeLinejoin="round"
-                />
-              </svg>
-            </span>
-            {binding.spec.leftOption}
-          </button>
-          <article
-            className="cg-swipe-card"
-            role="button"
-            tabIndex={0}
-            onClick={(e) => {
-              // ⭐ W41-T48 — the card IS the deck's record open, so it folds the rail.
-              // ⚠ Nothing that is NOT an open can reach this line: every control inside the
-              // card (a url cell, the comments box, the document tray) already stops its own
-              // click, and the left/right decision buttons are siblings of the card, not
-              // children of it. The deck also has no pointer drag to disambiguate — its swipe
-              // is the two buttons and the arrow keys, neither of which opens anything.
-              // ⚠ `<article role="button">`, not a native button, so a keyboard activation
-              // never arrives here as a synthetic click; the keydown path below is the whole
-              // keyboard story and the two cannot both fire for one gesture.
-              if (e.detail <= 1) signal(NAV_MINIMIZE_EVENT);
-              onOpen(card.pid);
-            }}
-            onKeyDown={(e) => {
-              if (e.key !== "Enter" && e.key !== " ") return;
-              e.preventDefault();
-              // W41-T48 — `!e.repeat` is this path's `e.detail <= 1`: a HELD Enter or Space
-              // auto-repeats keydown, and every one of those repeats is the SAME gesture.
-              if (!e.repeat) signal(NAV_MINIMIZE_EVENT);
-              onOpen(card.pid);
-            }}
-          >
-            <h3 className="cg-swipe-title">{String(card[titleKey] ?? "")}</h3>
-            <div className="cg-swipe-cells">
-              {/* ⭐ WAVE-29 T26 (R9) — the RECORD's visible fields, not the three-key summary the
-                  kanban card lends. `detailKeys` falls back to `cardKeys` so a host that has not
-                  been widened yet renders exactly what it rendered before. */}
-              {(detailKeys && detailKeys.length ? detailKeys : cardKeys).map((k) => {
-                const f = fieldByKey.get(k);
-                if (!f) return null;
-                const text = formatDisplay(f, card[k]);
-                if (!text) return null;
-                // A url cell is a LINK here too (wave-26 item 11), through `display.ts`'s one
-                // scheme guard — and every gesture that reaches it must be stopped from also
-                // reaching the card, which is a button (the kanban card's note, same trap).
-                const href = actionHref(f, card[k]);
-                return (
-                  <div key={k} className="cg-swipe-cell">
-                    <span className="cg-lv-k">{f.label}</span>
-                    {href ? (
-                      <a
-                        className="cg-lv-v"
-                        href={href}
-                        target="_blank"
-                        rel="noopener noreferrer"
-                        title={text}
-                        onClick={(e) => e.stopPropagation()}
-                        onKeyDown={(e) => e.stopPropagation()}
-                      >
-                        {text}
-                      </a>
-                    ) : (
-                      <span className="cg-lv-v">{text}</span>
-                    )}
-                  </div>
-                );
-              })}
-            </div>
-            {/* ⭐ R9's other two thirds. Both stop their own events: the card is a `role="button"`
-                that opens the record, and a click on a comment box or an upload control must not
-                also open the modal it exists to make unnecessary (the kanban card's link trap,
-                one surface over). */}
-            {onDocAdd && onDocFetch && onDocDelete && (
-              <div
-                className="cg-swipe-docs"
-                onClick={(e) => e.stopPropagation()}
-                onKeyDown={(e) => e.stopPropagation()}
-                role="presentation"
-              >
-                <Documents
-                  pid={Number(card.pid)}
-                  docs={docs?.[String(card.pid)] ?? []}
-                  docPayload={docPayload}
-                  onAdd={(file) => onDocAdd(card.pid, file)}
-                  onFetch={(docId) => onDocFetch(card.pid, docId)}
-                  onDelete={(docId) => onDocDelete(card.pid, docId)}
-                />
-              </div>
-            )}
-            {scope != null && (
-              <div
-                className="cg-swipe-comments"
-                onClick={(e) => e.stopPropagation()}
-                onKeyDown={(e) => e.stopPropagation()}
-                role="presentation"
-              >
-                {/* ⚠ KEYED ON scope+pid, the same key `RecordDetail` uses: without it React
-                    reuses the mounted instance across a card change and paints one record's
-                    comments under another's name until the fetch returns. */}
-                <RecordComments
-                  key={`${scope}:${Number(card.pid)}`}
-                  scope={scope}
-                  pid={Number(card.pid)}
-                  viewer={viewer}
-                />
-              </div>
-            )}
-            {canWrite && (
-              <button
-                type="button"
-                className="cg-link-btn cg-swipe-later"
-                onClick={(e) => {
-                  e.stopPropagation();
-                  setLater((prev) => new Set(prev).add(card.pid));
-                }}
-              >
-                Decide later
-              </button>
-            )}
-          </article>
-          <button
-            type="button"
-            className="cg-swipe-side cg-swipe-side--right"
-            disabled={!canWrite}
-            style={rightTint ? { background: rightTint.bg, color: rightTint.fg } : undefined}
-            onClick={() => decide(binding.spec.rightOption)}
-            title={`Set ${field.label} to ${binding.spec.rightOption} (right arrow key)`}
-          >
-            {binding.spec.rightOption}
-            <span aria-hidden className="cg-swipe-arrow">
-              <svg width="16" height="16" viewBox="0 0 16 16">
-                <path
-                  d="M5 3.2 9.8 8 5 12.8"
-                  fill="none"
-                  stroke="currentColor"
-                  strokeWidth="1.6"
-                  strokeLinecap="round"
-                  strokeLinejoin="round"
-                />
-              </svg>
-            </span>
-          </button>
-        </div>
-      ) : (
-        // The empty state NAMES the bound field (C3), because "nothing to sort" is ambiguous
-        // between "the deck is finished" and "the filter hid everything", and the two want
-        // different next actions. `later` is disclosed rather than quietly subtracted.
-        <div className="cg-mode-empty cg-swipe-empty">
-          {later.size > 0 ? (
-            <>
-              <p>
-                {later.size.toLocaleString()}{" "}
-                {later.size === 1 ? "record is" : "records are"} set aside for later. Nothing else
-                in this view is missing a <strong>{field.label}</strong>.
-              </p>
-              <button type="button" className="cg-btn" onClick={() => setLater(new Set())}>
-                Bring them back
-              </button>
-            </>
-          ) : (
-            <p>
-              Every record in this view already has a <strong>{field.label}</strong>. Widen the
-              view's filters to sort more.
-            </p>
-          )}
-        </div>
-      )}
-    </div>
-  );
-}
-
-/**
- * The binding picker: field + two options. It is also the surface every LOST binding lands on,
- * with the loss stated above it — one place that answers "what is this deck for", rather than an
- * error screen beside a separate setup screen.
- */
-function SwipeBinder({
-  fault,
-  fields,
-  fieldByKey,
-  spec,
-  canBind,
-  onSpec,
-}: {
-  fault: BindingFault;
-  fields: Field[];
-  fieldByKey: Map<string, Field>;
-  spec: SwipeSpec | undefined;
-  canBind: boolean;
-  onSpec: (next: SwipeSpec | undefined) => void;
-}) {
-  const selects = useMemo(
-    () => fields.filter((f) => f.type === "select" && choiceOptions(f).length >= 2),
-    [fields]
-  );
-  const [fieldKey, setFieldKey] = useState<string>(() => {
-    if (spec && fieldByKey.get(spec.fieldKey)?.type === "select") return spec.fieldKey;
-    return selects[0]?.key ?? "";
-  });
-  const chosen = fieldByKey.get(fieldKey);
-  const options = useMemo(() => (chosen ? choiceOptions(chosen) : []), [chosen]);
-  const [left, setLeft] = useState<string>("");
-  const [right, setRight] = useState<string>("");
-
-  // The two option selects follow the FIELD. Kept in an effect rather than derived so the user's
-  // pick survives re-renders, and reset whenever the field changes — carrying an option from the
-  // previous field would offer a value the new field cannot hold.
-  useEffect(() => {
-    setLeft(options[0] ?? "");
-    setRight(options.find((o) => o !== options[0]) ?? "");
-  }, [options]);
-
-  const message = ((): string => {
-    switch (fault.kind) {
-      case "field-gone":
-        return "The field this deck sorted into has been deleted. Pick another one.";
-      case "not-select":
-        return `“${fault.field.label}” is no longer a single-select, so it has no options to`
-          + " sort into. Pick another field.";
-      case "option-gone":
-        return `${fault.missing.map((m) => `“${m}”`).join(" and ")} ${
-          fault.missing.length === 1 ? "is" : "are"
-        } no longer ${fault.missing.length === 1 ? "an option" : "options"} on “${
-          fault.field.label
-        }”. Pick the sides again.`;
-      default:
-        return "Sort records one at a time into two options of a single-select field.";
-    }
-  })();
-
-  if (!canBind) {
-    return (
-      <div className="cg-mode-empty">
-        <p>{message}</p>
-        <p>Its creator or an admin can set this view up.</p>
-      </div>
-    );
-  }
-  if (selects.length === 0) {
-    // Honest and specific: the mode is not broken, the TABLE has nothing to bind to. Naming the
-    // requirement is what turns a dead end into a next action.
-    return (
-      <div className="cg-mode-empty">
-        <p>
-          A swipe deck sorts into a single-select field with at least two options. This database
-          does not have one yet — add a single-select column, then come back.
-        </p>
-      </div>
-    );
-  }
-  const ready = !!chosen && !!left && !!right && left.toLowerCase() !== right.toLowerCase();
-  return (
-    <div className="cg-swipe-setup">
-      <p className="cg-swipe-setup-note">{message}</p>
-      <label className="cg-swipe-setup-row">
-        <span>Sort into</span>
-        <select
-          className="cg-select"
-          value={fieldKey}
-          onChange={(e) => setFieldKey(e.target.value)}
-        >
-          {/* Every option carries an explicit `value`: a <select> whose value names nothing
-              renders its FIRST option and reports a choice the user never made
-              ([[cg-condition-builder-items]]). */}
-          {selects.map((f) => (
-            <option key={f.key} value={f.key}>
-              {f.label}
-            </option>
-          ))}
-        </select>
-      </label>
-      <div className="cg-swipe-setup-sides">
-        <label className="cg-swipe-setup-row">
-          <span>Swipe left</span>
-          <select className="cg-select" value={left} onChange={(e) => setLeft(e.target.value)}>
-            {options.map((o) => (
-              <option key={o} value={o}>
-                {o}
-              </option>
-            ))}
-          </select>
-        </label>
-        <label className="cg-swipe-setup-row">
-          <span>Swipe right</span>
-          <select className="cg-select" value={right} onChange={(e) => setRight(e.target.value)}>
-            {options.map((o) => (
-              <option key={o} value={o}>
-                {o}
-              </option>
-            ))}
-          </select>
-        </label>
-      </div>
-      {!ready && left && right && (
-        // Stated, not silently refused: both engines DROP a binding whose sides are the same
-        // option, so a Save that looked like it worked would simply not persist.
-        <p className="cg-swipe-setup-warn">
-          The two sides must be different options — otherwise both gestures do the same thing.
-        </p>
-      )}
-      <button
-        type="button"
-        className="cg-btn cg-btn--primary"
-        disabled={!ready}
-        onClick={() =>
-          chosen && onSpec({ fieldKey: chosen.key, leftOption: left, rightOption: right })
-        }
-      >
-        Start sorting
-      </button>
-    </div>
-  );
-}
-
-export default SwipeView;
+// ---------------------------------------------------------------------------
+// customer-grid / SwipeView.tsx
+// ⭐ WAVE-27 item 8 (owner ruling R2, contract C3) — the SWIPE deck.
+//
+// One record at a time, decided left or right into two options of ONE
+// single-select. R2 fixes the shape and it is narrow on purpose:
+//   · SINGLE-SELECT ONLY, one field, two of its options. No checkbox binding.
+//   · the deck holds only the records whose bound field is EMPTY — a record
+//     that already has a value has been decided, and re-asking is not triage.
+//   · a swipe writes through the NORMAL cell door (`onSwipe`, which the host
+//     maps to the same `patchAndRecord` a kanban card move uses), so undo,
+//     echo-suppression and the permission wall all hold without being
+//     re-implemented here.
+//
+// Honesty rules carried from the other modes:
+//   · nothing is silently hidden — the deck states what is left, and the
+//     empty state names the bound field rather than saying "all done".
+//   · a lost binding is SHOWN, never repaired by guessing. `_clean_display`
+//     validates that `fieldKey` names a field the table HAS and stops there;
+//     it cannot know the field is still a select, or that the two options are
+//     still in its vocabulary (its docstring draws that line explicitly). So
+//     those three losses land here, and each one says what happened and
+//     re-opens the picker — the `viewModes.tsx:190-194` rule, which exists
+//     because the wave-7 trap was a picker silently falling back to its first
+//     option.
+// ---------------------------------------------------------------------------
+
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+// ⭐⭐ W41-T48 (owner instruction 22) — opening a record from the swipe deck folds the shell's
+// navigation rail exactly as a grid cell click does. Guard rationale: `MapView.tsx:2755`.
+import { NAV_MINIMIZE_EVENT, signal } from "../apiContract";
+import { choiceOptions } from "./types";
+import type { CustomerDoc, DisplaySpec, Field, Row, Viewer } from "./types";
+// ⚠ `SurfaceScope` is `apiBridge`'s (a TYPE-only import, so nothing of that module is
+//   loaded here) — the same import `RecordComments` takes for the same prop.
+import type { SurfaceScope } from "./apiBridge";
+import RecordComments from "./RecordComments";
+import { Documents } from "./Documents";
+import { formatDisplay } from "./cells";
+import { actionHref } from "./display";
+import { optionTint } from "./choiceColors";
+import { ModeIcon } from "./icons";
+// ⭐ W29-T73 — the line its three siblings all have, and the one this file shipped without.
+// `SwipeView.css` had ZERO references anywhere in `src/`, so T26's two new sections rendered
+// unstyled while `.cg-swipe-card` (which lives in `index.css`) kept the card looking right —
+// a partially-styled surface reads as a design choice, which is why nobody reported it and no
+// gate could see it: a side-effect import references no symbol ([[artifact-with-no-importer]]).
+import "./SwipeView.css";
+
+export type SwipeSpec = NonNullable<DisplaySpec["swipe"]>;
+
+/** The three ways a stored binding can rot that the host cannot see (see the header note). */
+type BindingFault =
+  | { kind: "unbound" }
+  | { kind: "field-gone"; fieldKey: string }
+  | { kind: "not-select"; field: Field }
+  | { kind: "option-gone"; field: Field; missing: string[] };
+
+function readBinding(spec: SwipeSpec | undefined, fieldByKey: Map<string, Field>):
+  { ok: true; field: Field; spec: SwipeSpec } | { ok: false; fault: BindingFault } {
+  if (!spec) return { ok: false, fault: { kind: "unbound" } };
+  const field = fieldByKey.get(spec.fieldKey);
+  if (!field) return { ok: false, fault: { kind: "field-gone", fieldKey: spec.fieldKey } };
+  // R2 — SINGLE-select only. `multiselect` is deliberately not accepted: its cell holds a SET,
+  // so "write this option" would mean append-or-replace, and a triage gesture that sometimes
+  // adds and sometimes overwrites is two gestures wearing one button.
+  if (field.type !== "select") return { ok: false, fault: { kind: "not-select", field } };
+  const options = choiceOptions(field);
+  const has = new Set(options.map((o) => o.toLowerCase()));
+  const missing = [spec.leftOption, spec.rightOption].filter((o) => !has.has(o.toLowerCase()));
+  if (missing.length) return { ok: false, fault: { kind: "option-gone", field, missing } };
+  return { ok: true, field, spec };
+}
+
+/** The bound cell is EMPTY — the one predicate that decides deck membership (R2). */
+const isUndecided = (row: Row, key: string): boolean =>
+  String(row[key] ?? "").trim() === "";
+
+export function SwipeView({
+  rows,
+  fields,
+  fieldByKey,
+  spec,
+  cardKeys,
+  detailKeys,
+  scope,
+  viewer,
+  docs,
+  docPayload,
+  onDocAdd,
+  onDocFetch,
+  onDocDelete,
+  titleKey,
+  canWrite,
+  readOnlyReason,
+  canBind,
+  onSpec,
+  onSwipe,
+  onOpen,
+}: {
+  /** DISTINCT data rows from the full pipeline, overlay edits layered — the kanban's contract.
+   *  The deck re-derives from these, so a written record leaves it as soon as the optimistic
+   *  patch lands; there is no local cursor to drift out of step with the data. */
+  rows: Row[];
+  /** Every field, for the picker's field list. */
+  fields: Field[];
+  fieldByKey: Map<string, Field>;
+  /** The stored binding, or undefined for a deck nobody has configured yet. */
+  spec: SwipeSpec | undefined;
+  /** The handful of visible fields the card lists under its title. */
+  cardKeys: string[];
+  titleKey: string;
+  /** May this viewer write the BOUND field's value? (the kanban's `canMove`) */
+  canWrite: boolean;
+  /** Stated when the deck cannot be decided — permissions, or a computed column. */
+  readOnlyReason: string | null;
+  /** May this viewer change what the deck is bound TO? A VIEW-config act, so it is the
+   *  view-editing permission and NOT `canWrite` — conflating the two is
+   *  [[schema-role-is-not-a-value-wall]]. REQUIRED, because a picker that silently does
+   *  nothing is worse than no picker ([[wrong-parent-not-broken-control]]). */
+  canBind: boolean;
+  /** `undefined` DELETES the binding — absent is the honest unconfigured state, and storing a
+   *  half-binding is what `cleanDisplay` drops on both engines (the `kanbanClamp` law). */
+  onSpec: (next: SwipeSpec | undefined) => void;
+  onSwipe: (pid: number, value: string) => void;
+  onOpen: (pid: number) => void;
+  /**
+   * ⭐⭐ WAVE-29 T26 (owner R9) — WHAT MAKES THE CARD A RECORD RATHER THAN A SUMMARY.
+   *
+   * R9: *"the swipe CARD itself renders the record detail inline — fields, comments and
+   * attachments — so a reviewer decides without leaving the deck."* Everything below is that,
+   * and every one of them is OPTIONAL for one reason: this deck runs on hosts that supply
+   * different amounts. A card must render with none of them rather than throw — the standalone
+   * embed has no `scope`, and a deployment with no document storage serves no handlers.
+   */
+  /** Every field the VIEW shows, in its order — not the three-key card summary. */
+  detailKeys?: string[];
+  /** The surface these records live on. Comments are keyed by it; absent ⇒ no comments section,
+   *  which is the pre-existing precondition `RecordDetail` already carries. */
+  scope?: SurfaceScope;
+  viewer?: Viewer;
+  /** This record's attachments, and the plumbing. Handlers absent ⇒ the section is not rendered
+   *  at all, exactly as `RecordDetail` decides it (a dead upload control is a promise the app
+   *  cannot keep). */
+  /** Keyed by pid, because a deck shows many records — `RecordDetail` takes ONE record's list
+   *  and that shape cannot serve a deck. */
+  docs?: Record<string, CustomerDoc[]>;
+  docPayload?: { pid: number; docId: string; name: string; mime: string; data_b64: string };
+  /** ⚠ EVERY HANDLER TAKES THE PID, unlike `RecordDetail`'s, whose host closes over the ONE
+   *  open record. A deck paints many records at once, so a handler bound to a single pid would
+   *  attach every reviewer's upload to whichever card happened to be open. */
+  onDocAdd?: (
+    pid: number,
+    file: { name: string; mime: string; size: number; data_b64: string }
+  ) => void;
+  onDocFetch?: (pid: number, docId: string) => void;
+  onDocDelete?: (pid: number, docId: string) => void;
+}) {
+  // "Later" — session-only, never stored. A deck with no way past a record you cannot decide
+  // blocks on that record forever, so this is navigation WITHIN the deck rather than a third
+  // gesture: it writes nothing, survives no reload, and the count is disclosed in the empty
+  // state rather than quietly shrinking the deck (rule 8b).
+  const [later, setLater] = useState<Set<number>>(new Set());
+  const deckRef = useRef<HTMLDivElement>(null);
+
+  const binding = useMemo(() => readBinding(spec, fieldByKey), [spec, fieldByKey]);
+  const boundKey = binding.ok ? binding.field.key : null;
+
+  const undecided = useMemo(
+    () => (boundKey ? rows.filter((r) => isUndecided(r, boundKey)) : []),
+    [rows, boundKey]
+  );
+  const deck = useMemo(() => undecided.filter((r) => !later.has(r.pid)), [undecided, later]);
+  const card = deck[0];
+
+  // A record decided elsewhere (the grid, another user's echo) must not stay "later" forever —
+  // otherwise the disclosed skip count drifts away from what is actually on the deck.
+  useEffect(() => {
+    setLater((prev) => {
+      if (prev.size === 0) return prev;
+      const live = new Set(undecided.map((r) => r.pid));
+      const next = new Set([...prev].filter((pid) => live.has(pid)));
+      return next.size === prev.size ? prev : next;
+    });
+  }, [undecided]);
+
+  const decide = useCallback(
+    (value: string) => {
+      if (!card || !canWrite) return;
+      onSwipe(card.pid, value);
+    },
+    [card, canWrite, onSwipe]
+  );
+
+  // ← / → decide, and they are the SAME two actions the buttons are rather than a second code
+  // path: the whole point of the mode is that one hand can clear a queue.
+  useEffect(() => {
+    if (!binding.ok || !canWrite || !card) return;
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key !== "ArrowLeft" && e.key !== "ArrowRight") return;
+      const el = document.activeElement as HTMLElement | null;
+      // Never steal an arrow key from a text field or a native control the user is inside.
+      if (el && (el.tagName === "INPUT" || el.tagName === "SELECT" || el.tagName === "TEXTAREA"))
+        return;
+      if (!deckRef.current?.contains(el ?? null) && el !== document.body) return;
+      e.preventDefault();
+      decide(e.key === "ArrowLeft" ? binding.spec.leftOption : binding.spec.rightOption);
+    };
+    window.addEventListener("keydown", onKey);
+    return () => window.removeEventListener("keydown", onKey);
+  }, [binding, canWrite, card, decide]);
+
+  if (!binding.ok) {
+    return (
+      <div className="cg-swipe" ref={deckRef}>
+        <SwipeBinder
+          fault={binding.fault}
+          fields={fields}
+          fieldByKey={fieldByKey}
+          spec={spec}
+          canBind={canBind}
+          onSpec={onSpec}
+        />
+      </div>
+    );
+  }
+
+  const { field } = binding;
+  const leftTint = optionTint(field, binding.spec.leftOption);
+  const rightTint = optionTint(field, binding.spec.rightOption);
+
+  return (
+    <div className="cg-swipe" ref={deckRef} tabIndex={-1}>
+      <div className="cg-swipe-bar">
+        <span className="cg-swipe-bound">
+          <ModeIcon mode="swipe" />
+          Sorting into <strong>{field.label}</strong>
+        </span>
+        <span className="cg-swipe-left">
+          {deck.length.toLocaleString()} {deck.length === 1 ? "record" : "records"} to sort
+        </span>
+        {canBind && (
+          <button
+            type="button"
+            className="cg-link-btn"
+            onClick={() => onSpec(undefined)}
+            title="Choose a different field or different options for this deck"
+          >
+            Change
+          </button>
+        )}
+      </div>
+      {readOnlyReason && <div className="cg-kb-note">{readOnlyReason}</div>}
+      {card ? (
+        <div className="cg-swipe-deck">
+          <button
+            type="button"
+            className="cg-swipe-side cg-swipe-side--left"
+            disabled={!canWrite}
+            style={leftTint ? { background: leftTint.bg, color: leftTint.fg } : undefined}
+            onClick={() => decide(binding.spec.leftOption)}
+            title={`Set ${field.label} to ${binding.spec.leftOption} (left arrow key)`}
+          >
+            <span aria-hidden className="cg-swipe-arrow">
+              <svg width="16" height="16" viewBox="0 0 16 16">
+                <path
+                  d="M11 3.2 6.2 8l4.8 4.8"
+                  fill="none"
+                  stroke="currentColor"
+                  strokeWidth="1.6"
+                  strokeLinecap="round"
+                  strokeLinejoin="round"
+                />
+              </svg>
+            </span>
+            {binding.spec.leftOption}
+          </button>
+          <article
+            className="cg-swipe-card"
+            role="button"
+            tabIndex={0}
+            onClick={(e) => {
+              // ⭐ W41-T48 — the card IS the deck's record open, so it folds the rail.
+              // ⚠ Nothing that is NOT an open can reach this line: every control inside the
+              // card (a url cell, the comments box, the document tray) already stops its own
+              // click, and the left/right decision buttons are siblings of the card, not
+              // children of it. The deck also has no pointer drag to disambiguate — its swipe
+              // is the two buttons and the arrow keys, neither of which opens anything.
+              // ⚠ `<article role="button">`, not a native button, so a keyboard activation
+              // never arrives here as a synthetic click; the keydown path below is the whole
+              // keyboard story and the two cannot both fire for one gesture.
+              if (e.detail <= 1) signal(NAV_MINIMIZE_EVENT);
+              onOpen(card.pid);
+            }}
+            onKeyDown={(e) => {
+              if (e.key !== "Enter" && e.key !== " ") return;
+              e.preventDefault();
+              // W41-T48 — `!e.repeat` is this path's `e.detail <= 1`: a HELD Enter or Space
+              // auto-repeats keydown, and every one of those repeats is the SAME gesture.
+              if (!e.repeat) signal(NAV_MINIMIZE_EVENT);
+              onOpen(card.pid);
+            }}
+          >
+            <h3 className="cg-swipe-title">{String(card[titleKey] ?? "")}</h3>
+            <div className="cg-swipe-cells">
+              {/* ⭐ WAVE-29 T26 (R9) — the RECORD's visible fields, not the three-key summary the
+                  kanban card lends. `detailKeys` falls back to `cardKeys` so a host that has not
+                  been widened yet renders exactly what it rendered before. */}
+              {(detailKeys && detailKeys.length ? detailKeys : cardKeys).map((k) => {
+                const f = fieldByKey.get(k);
+                if (!f) return null;
+                const text = formatDisplay(f, card[k]);
+                if (!text) return null;
+                // A url cell is a LINK here too (wave-26 item 11), through `display.ts`'s one
+                // scheme guard — and every gesture that reaches it must be stopped from also
+                // reaching the card, which is a button (the kanban card's note, same trap).
+                const href = actionHref(f, card[k]);
+                return (
+                  <div key={k} className="cg-swipe-cell">
+                    <span className="cg-lv-k">{f.label}</span>
+                    {href ? (
+                      <a
+                        className="cg-lv-v"
+                        href={href}
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        title={text}
+                        onClick={(e) => e.stopPropagation()}
+                        onKeyDown={(e) => e.stopPropagation()}
+                      >
+                        {text}
+                      </a>
+                    ) : (
+                      <span className="cg-lv-v">{text}</span>
+                    )}
+                  </div>
+                );
+              })}
+            </div>
+            {/* ⭐ R9's other two thirds. Both stop their own events: the card is a `role="button"`
+                that opens the record, and a click on a comment box or an upload control must not
+                also open the modal it exists to make unnecessary (the kanban card's link trap,
+                one surface over). */}
+            {onDocAdd && onDocFetch && onDocDelete && (
+              <div
+                className="cg-swipe-docs"
+                onClick={(e) => e.stopPropagation()}
+                onKeyDown={(e) => e.stopPropagation()}
+                role="presentation"
+              >
+                <Documents
+                  pid={Number(card.pid)}
+                  docs={docs?.[String(card.pid)] ?? []}
+                  docPayload={docPayload}
+                  onAdd={(file) => onDocAdd(card.pid, file)}
+                  onFetch={(docId) => onDocFetch(card.pid, docId)}
+                  onDelete={(docId) => onDocDelete(card.pid, docId)}
+                />
+              </div>
+            )}
+            {scope != null && (
+              <div
+                className="cg-swipe-comments"
+                onClick={(e) => e.stopPropagation()}
+                onKeyDown={(e) => e.stopPropagation()}
+                role="presentation"
+              >
+                {/* ⚠ KEYED ON scope+pid, the same key `RecordDetail` uses: without it React
+                    reuses the mounted instance across a card change and paints one record's
+                    comments under another's name until the fetch returns. */}
+                <RecordComments
+                  key={`${scope}:${Number(card.pid)}`}
+                  scope={scope}
+                  pid={Number(card.pid)}
+                  viewer={viewer}
+                />
+              </div>
+            )}
+            {canWrite && (
+              <button
+                type="button"
+                className="cg-link-btn cg-swipe-later"
+                onClick={(e) => {
+                  e.stopPropagation();
+                  setLater((prev) => new Set(prev).add(card.pid));
+                }}
+              >
+                Decide later
+              </button>
+            )}
+          </article>
+          <button
+            type="button"
+            className="cg-swipe-side cg-swipe-side--right"
+            disabled={!canWrite}
+            style={rightTint ? { background: rightTint.bg, color: rightTint.fg } : undefined}
+            onClick={() => decide(binding.spec.rightOption)}
+            title={`Set ${field.label} to ${binding.spec.rightOption} (right arrow key)`}
+          >
+            {binding.spec.rightOption}
+            <span aria-hidden className="cg-swipe-arrow">
+              <svg width="16" height="16" viewBox="0 0 16 16">
+                <path
+                  d="M5 3.2 9.8 8 5 12.8"
+                  fill="none"
+                  stroke="currentColor"
+                  strokeWidth="1.6"
+                  strokeLinecap="round"
+                  strokeLinejoin="round"
+                />
+              </svg>
+            </span>
+          </button>
+        </div>
+      ) : (
+        // The empty state NAMES the bound field (C3), because "nothing to sort" is ambiguous
+        // between "the deck is finished" and "the filter hid everything", and the two want
+        // different next actions. `later` is disclosed rather than quietly subtracted.
+        <div className="cg-mode-empty cg-swipe-empty">
+          {later.size > 0 ? (
+            <>
+              <p>
+                {later.size.toLocaleString()}{" "}
+                {later.size === 1 ? "record is" : "records are"} set aside for later. Nothing else
+                in this view is missing a <strong>{field.label}</strong>.
+              </p>
+              <button type="button" className="cg-btn" onClick={() => setLater(new Set())}>
+                Bring them back
+              </button>
+            </>
+          ) : (
+            <p>
+              Every record in this view already has a <strong>{field.label}</strong>. Widen the
+              view's filters to sort more.
+            </p>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
+
+/**
+ * The binding picker: field + two options. It is also the surface every LOST binding lands on,
+ * with the loss stated above it — one place that answers "what is this deck for", rather than an
+ * error screen beside a separate setup screen.
+ */
+function SwipeBinder({
+  fault,
+  fields,
+  fieldByKey,
+  spec,
+  canBind,
+  onSpec,
+}: {
+  fault: BindingFault;
+  fields: Field[];
+  fieldByKey: Map<string, Field>;
+  spec: SwipeSpec | undefined;
+  canBind: boolean;
+  onSpec: (next: SwipeSpec | undefined) => void;
+}) {
+  const selects = useMemo(
+    () => fields.filter((f) => f.type === "select" && choiceOptions(f).length >= 2),
+    [fields]
+  );
+  const [fieldKey, setFieldKey] = useState<string>(() => {
+    if (spec && fieldByKey.get(spec.fieldKey)?.type === "select") return spec.fieldKey;
+    return selects[0]?.key ?? "";
+  });
+  const chosen = fieldByKey.get(fieldKey);
+  const options = useMemo(() => (chosen ? choiceOptions(chosen) : []), [chosen]);
+  const [left, setLeft] = useState<string>("");
+  const [right, setRight] = useState<string>("");
+
+  // The two option selects follow the FIELD. Kept in an effect rather than derived so the user's
+  // pick survives re-renders, and reset whenever the field changes — carrying an option from the
+  // previous field would offer a value the new field cannot hold.
+  useEffect(() => {
+    setLeft(options[0] ?? "");
+    setRight(options.find((o) => o !== options[0]) ?? "");
+  }, [options]);
+
+  const message = ((): string => {
+    switch (fault.kind) {
+      case "field-gone":
+        return "The field this deck sorted into has been deleted. Pick another one.";
+      case "not-select":
+        return `“${fault.field.label}” is no longer a single-select, so it has no options to`
+          + " sort into. Pick another field.";
+      case "option-gone":
+        return `${fault.missing.map((m) => `“${m}”`).join(" and ")} ${
+          fault.missing.length === 1 ? "is" : "are"
+        } no longer ${fault.missing.length === 1 ? "an option" : "options"} on “${
+          fault.field.label
+        }”. Pick the sides again.`;
+      default:
+        return "Sort records one at a time into two options of a single-select field.";
+    }
+  })();
+
+  if (!canBind) {
+    return (
+      <div className="cg-mode-empty">
+        <p>{message}</p>
+        <p>Its creator or an admin can set this view up.</p>
+      </div>
+    );
+  }
+  if (selects.length === 0) {
+    // Honest and specific: the mode is not broken, the TABLE has nothing to bind to. Naming the
+    // requirement is what turns a dead end into a next action.
+    return (
+      <div className="cg-mode-empty">
+        <p>
+          A swipe deck sorts into a single-select field with at least two options. This database
+          does not have one yet — add a single-select column, then come back.
+        </p>
+      </div>
+    );
+  }
+  const ready = !!chosen && !!left && !!right && left.toLowerCase() !== right.toLowerCase();
+  return (
+    <div className="cg-swipe-setup">
+      <p className="cg-swipe-setup-note">{message}</p>
+      <label className="cg-swipe-setup-row">
+        <span>Sort into</span>
+        <select
+          className="cg-select"
+          value={fieldKey}
+          onChange={(e) => setFieldKey(e.target.value)}
+        >
+          {/* Every option carries an explicit `value`: a <select> whose value names nothing
+              renders its FIRST option and reports a choice the user never made
+              ([[cg-condition-builder-items]]). */}
+          {selects.map((f) => (
+            <option key={f.key} value={f.key}>
+              {f.label}
+            </option>
+          ))}
+        </select>
+      </label>
+      <div className="cg-swipe-setup-sides">
+        <label className="cg-swipe-setup-row">
+          <span>Swipe left</span>
+          <select className="cg-select" value={left} onChange={(e) => setLeft(e.target.value)}>
+            {options.map((o) => (
+              <option key={o} value={o}>
+                {o}
+              </option>
+            ))}
+          </select>
+        </label>
+        <label className="cg-swipe-setup-row">
+          <span>Swipe right</span>
+          <select className="cg-select" value={right} onChange={(e) => setRight(e.target.value)}>
+            {options.map((o) => (
+              <option key={o} value={o}>
+                {o}
+              </option>
+            ))}
+          </select>
+        </label>
+      </div>
+      {!ready && left && right && (
+        // Stated, not silently refused: both engines DROP a binding whose sides are the same
+        // option, so a Save that looked like it worked would simply not persist.
+        <p className="cg-swipe-setup-warn">
+          The two sides must be different options — otherwise both gestures do the same thing.
+        </p>
+      )}
+      <button
+        type="button"
+        className="cg-btn cg-btn--primary"
+        disabled={!ready}
+        onClick={() =>
+          chosen && onSpec({ fieldKey: chosen.key, leftOption: left, rightOption: right })
+        }
+      >
+        Start sorting
+      </button>
+    </div>
+  );
+}
+
+export default SwipeView;

web/src/customer-grid/Toolbar.tsx

@@ -167,6 +167,8 @@ export interface ToolbarProps {
    * not, so the marker says something different and does not go away.
    */
   unresolvedCount?: number;
+  /** Exact reasons for unresolved conditions, shown in the marker's native hover text. */
+  unresolvedReasons?: readonly string[];
   /** Owner item 5 — the cohorts this user has, for `Where [Cohort] [is part of] […]`. */
   lists?: { id: string; name: string }[];
   /** ⭐⭐ W37-T26 (C4) — the views a `Where [View] [is] […]` condition may name. A PASS-THROUGH:
@@ -722,6 +724,7 @@ export default function Toolbar({
   measures = [],
   pendingMeasureCount = 0,
   unresolvedCount = 0,
+  unresolvedReasons = [],
   lists = [],
   viewChoices = [],
   cohortLock,
@@ -1322,9 +1325,10 @@ export default function Toolbar({
         <span
           className="cg-count cg-count-pending"
           title={
-            `${unresolvedCount} condition${unresolvedCount === 1 ? "" : "s"} cannot be ` +
-            "evaluated: a date that does not resolve, or a list this view refers to that no " +
-            "longer exists. Rows are hidden rather than shown under a count that would be wrong."
+            unresolvedReasons.length
+              ? unresolvedReasons.join("\n")
+              : `${unresolvedCount} condition${unresolvedCount === 1 ? "" : "s"} cannot be ` +
+                "evaluated. Rows are hidden rather than shown under a count that would be wrong."
           }
         >
           Filter unresolved

web/src/customer-grid/apiBridge.ts

@@ -329,6 +329,8 @@ export interface RowWindowRequest {
   filterConj?: string;
   sorts?: SortSpec | null;
   search?: string;
+  /** Existing Link choices retained when a new picker condition no longer matches them. */
+  includePids?: readonly number[];
 }
 
 /**
@@ -360,6 +362,11 @@ export function windowRowsPath(tableKey: string, req: RowWindowRequest): string
   if (req.sorts && req.sorts.length) q.set("sorts", JSON.stringify(req.sorts));
   const search = (req.search ?? "").trim();
   if (search) q.set("search", search);
+  if (req.includePids && req.includePids.length) {
+    const ids = [...new Set(req.includePids.filter((pid) => Number.isInteger(pid) && pid > 0))]
+      .sort((a, b) => a - b);
+    if (ids.length) q.set("includePids", JSON.stringify(ids));
+  }
   return `odoo-tables/${encodeURIComponent(tableKey)}/rows?${q.toString()}`;
 }
 

web/src/customer-grid/icons.tsx

@@ -104,6 +104,21 @@ export function FieldTypeIcon({
   );
 }
 
+/**
+ * The compact, outline-only information mark shared by field surfaces. Its canvas sibling is
+ * `HEADER_ICONS.aiosInfo`; keeping the same ring-and-i geometry makes an explanation read as the
+ * same affordance whether it sits in a grid header or beside a picker option.
+ */
+export function InfoMark({ size = 14 }: { size?: number }) {
+  return (
+    <svg width={size} height={size} viewBox="0 0 16 16" fill="none" aria-hidden="true">
+      <circle cx="8" cy="8" r="6.1" stroke="currentColor" strokeWidth="1.25" />
+      <path d="M8 7.4v3.5" stroke="currentColor" strokeWidth="1.4" strokeLinecap="round" />
+      <circle cx="8" cy="5.1" r="0.85" fill="currentColor" />
+    </svg>
+  );
+}
+
 /** The display-mode mark for the View switcher (I18). */
 export function ModeIcon({ mode, size = 14 }: { mode: DisplayMode; size?: number }) {
   return (

web/src/customer-grid/types.ts

@@ -2609,6 +2609,12 @@ export interface Field {
     reciprocal?: string;
     /** Airtable's `prefersSingleRecordLink` */
     single?: boolean;
+    /**
+     * W42-T35 — static conditions that narrow the records offered by an ordinary Link picker.
+     * They never rewrite existing link cells: a new filter constrains the next selection only.
+     */
+    conditions?: RollupCondition[];
+    conditionConj?: "and" | "or";
     /**
      * ⭐⭐ W42-T09 (R1, contract C1) — THE TWO-HOP JOIN, DECLARED. **Absent is today's one-hop
      * link and is byte-identical to every link stored before the hop existed**, so there is no
@@ -3362,6 +3368,23 @@ export interface FilterRule {
   id?: string;
 }
 
+/**
+ * W42-T35 — the server validates a Link's static Rollup-style conditions, while the picker
+ * reuses the grid's existing filter engine. This adapter is the one vocabulary crossing; it
+ * cannot introduce a dynamic field, a set statistic, a view, a cohort, or a rank condition.
+ */
+export function linkPickerFilterNodes(conditions: readonly RollupCondition[]): FilterRule[] {
+  return conditions.map((condition, index) => ({
+    id: `link-picker-${index}-${condition.field}`,
+    colId: condition.field,
+    op: condition.op === "not_contains" ? "doesNotContain"
+      : condition.op === "is_empty" ? "isEmpty"
+      : condition.op === "is_not_empty" ? "isNotEmpty"
+      : condition.op,
+    value: condition.value ?? "",
+  }));
+}
+
 /**
  * Is this rule doing any work? A half-typed condition is INACTIVE and gets IGNORED by the
  * combinator — not treated as `true`, which under `or` would show every record.

web/src/customer-grid/useVisibleRows.ts

@@ -620,25 +620,27 @@ export function activeMeasureRuleIds(nodes: FilterNode[]): string[] {
  * Detectable without the field map: `within` and `dateMode` are shapes only a DATE condition
  * has, and `__cohort__` is a reserved key.
  */
-export function unresolvedConditions(nodes: FilterNode[], ctx?: EvalCtx): number {
-  let n = 0;
+export function unresolvedConditionReasons(nodes: FilterNode[], ctx?: EvalCtx): string[] {
+  const reasons: string[] = [];
   for (const node of nodes ?? []) {
     if (isFilterGroup(node)) {
-      n += unresolvedConditions(node.children, ctx);
+      reasons.push(...unresolvedConditionReasons(node.children, ctx));
       continue;
     }
     if (!isRuleActive(node)) continue;
     if (isCohortRule(node)) {
       // Any unresolvable member of the set makes the whole condition unanswerable — the same
       // all-or-nothing rule evalNode applies, so the marker and the rows agree on WHY.
-      if (cohortIds(node.value).some((id) => !ctx?.cohortSets?.[id])) n += 1;
+      const unavailable = cohortIds(node.value).find((id) => !ctx?.cohortSets?.[id]);
+      if (unavailable) reasons.push(`The cohort "${unavailable}" used by this filter is unavailable.`);
       continue;
     }
     // C4 — a view leaf naming a view we cannot resolve (deleted, or not visible to this caller)
     // is unanswerable, so it is COUNTED and the toolbar says so. Without this line the grid would
     // empty with no explanation, which is D-124 exactly, arriving one leaf over.
     if (isViewRule(node)) {
-      if (!ctx?.viewSets?.[viewRuleId(node.value)]) n += 1;
+      const viewId = viewRuleId(node.value);
+      if (!ctx?.viewSets?.[viewId]) reasons.push(`The view "${viewId}" used by this filter is unavailable.`);
       continue;
     }
     // ⭐⭐ D-229 — a leaf whose COLUMN, or whose rhs COLUMN, this table no longer has. `evalNode`
@@ -648,18 +650,27 @@ export function unresolvedConditions(nodes: FilterNode[], ctx?: EvalCtx): number
     if (ctx?.fieldByKey && !isMeasureRule(node)) {
       const rhsKey = node.rhs ? rhsColId(node.rhs) ?? "" : null;
       if (!ctx.fieldByKey.has(node.colId) || (rhsKey !== null && !ctx.fieldByKey.has(rhsKey))) {
-        n += 1;
+        const missing = !ctx.fieldByKey.has(node.colId) ? node.colId : rhsKey;
+        reasons.push(`This filter uses the field "${missing}", which you cannot access.`);
         continue;
       }
     }
     if (isMeasureRule(node)) continue;              // that is `pendingMeasures`' job
     if (node.op === "within") {
-      if (!ctx?.today || !resolveWindow(node.dateWindow, ctx.today)) n += 1;
+      if (!ctx?.today || !resolveWindow(node.dateWindow, ctx.today)) {
+        reasons.push("This date-range condition cannot be resolved.");
+      }
     } else if (node.dateMode) {
-      if (!ctx?.today || resolveAnchor(node.dateMode, node.value, ctx.today) == null) n += 1;
+      if (!ctx?.today || resolveAnchor(node.dateMode, node.value, ctx.today) == null) {
+        reasons.push("This date condition cannot be resolved.");
+      }
     }
   }
-  return n;
+  return reasons;
+}
+
+export function unresolvedConditions(nodes: FilterNode[], ctx?: EvalCtx): number {
+  return unresolvedConditionReasons(nodes, ctx).length;
 }
 
 /** Root-level evaluation: the whole tree as one implicit group. Exported for

web/src/index.css

@@ -601,6 +601,18 @@ body {
   text-overflow: ellipsis;
   white-space: nowrap;
 }
+.cg-type-info {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  flex: 0 0 auto;
+  width: 16px;
+  height: 16px;
+  color: var(--lp-muted);
+  cursor: help;
+}
+.cg-type-row:hover .cg-type-info,
+.cg-type-row:focus-visible .cg-type-info { color: var(--lp-blue-deep); }
 .cg-type-check { color: var(--lp-blue-deep); flex: 0 0 auto; }
 /* W40-T29 (owner instruction 31) - the create picker's Advanced group: a hairline, then a quiet
    one-word heading, then the three kinds most people never want. Same typographic weight as

web/wiring_rows/wave42_c.py

@@ -91,22 +91,28 @@ ROWS: list[tuple[str, str, str, str, str]] = [
      "filter-kit/FieldsHidePanel.tsx",
      r"onSetFieldsHidden: \(\(keys: string\[\], hidden: boolean\) => void\) \| null;",
      "customer-grid/CustomerGrid.tsx", r"onSetFieldsHidden=\{fieldBulkDoors\.onSetFieldsHidden\}"),
-    ("W42-T12 onShareFields: one share dialog over the whole selection",
+    ("W42-T12 bulk Share opens the field access editor",
      "filter-kit/FieldsHidePanel.tsx",
      r"onShareFields: \(\(keys: string\[\]\) => void\) \| null;",
-     "customer-grid/CustomerGrid.tsx", r"onShareFields=\{fieldBulkDoors\.onShareFields\}"),
-    ("W42-T12 onReassignFields: R6(d)'s admin-only reassign has a handler",
+     "customer-grid/CustomerGrid.tsx",
+     r"onShareFields=\{fieldGrantTableKey[\s\S]*openFieldBatchAccess\(\"share\""),
+    ("W42-T12 bulk Reassign opens the field access editor",
      "filter-kit/FieldsHidePanel.tsx",
      r"onReassignFields: \(\(keys: string\[\]\) => void\) \| null;",
-     "customer-grid/CustomerGrid.tsx", r"onReassignFields=\{fieldBulkDoors\.onReassignFields\}"),
+     "customer-grid/CustomerGrid.tsx",
+     r"onReassignFields=\{fieldGrantTableKey[\s\S]*openFieldBatchAccess\(\"reassign\""),
     ("W42-T12 onDeleteFields: the batch delete door, never a loop over the per-key one",
      "filter-kit/FieldsHidePanel.tsx",
      r"onDeleteFields: \(\(keys: string\[\]\) => void\) \| null;",
      "customer-grid/CustomerGrid.tsx", r"onDeleteFields=\{fieldBulkDoors\.onDeleteFields\}"),
-    ("W42-T12 onRemoveField: R6(b)'s other door, distinct from a delete",
+    ("W42-T12 manager self-removal reaches the grantee-safe door",
      "filter-kit/FieldsHidePanel.tsx",
      r"onRemoveField: \(\(key: string\) => void\) \| null;",
-     "customer-grid/CustomerGrid.tsx", r"onRemoveField=\{fieldBulkDoors\.onRemoveField\}"),
+     "customer-grid/CustomerGrid.tsx",
+     r"onRemoveField=\{fieldGrantTableKey[\s\S]*removeFieldFromMine\(field\)"),
+    ("W42-T12 the batch editor is mounted by the only manager host",
+     "customer-grid/FieldBatchAccessDialog.tsx", r"export default function FieldBatchAccessDialog",
+     "customer-grid/CustomerGrid.tsx", r"<FieldBatchAccessDialog"),
 
     # ⭐⭐ W42-T13 (instruction 2, D-485) — THE SEVENTH HANDLER, AND IT LIVES ON A DIFFERENT
     # COMPONENT FROM T12's SIX. `onRemoveFromMine` is a `ColumnMenuProps` member, not a
@@ -139,11 +145,10 @@ ROWS: list[tuple[str, str, str, str, str]] = [
     # and does nothing when pressed — D-485 turned from an absent control into the WORSE defect of
     # a silent one, with the whole battery green. The bundle door is the only thing on this
     # surface that speaks the refusal out loud, so pinning it pins the behaviour.
-    ("W42-T13 onRemoveFromMine: R6(b)'s column-menu door is fed at BOTH ColumnMenu mounts",
-     "customer-grid/ColumnMenu.tsx", r"onRemoveFromMine: \(\) => void;",
+    ("W42-T13 a shared grantee's ColumnMenu reaches self-removal",
+     "customer-grid/ColumnMenu.tsx", r"onRemoveFromMine\?: \(\) => void;",
      "customer-grid/CustomerGrid.tsx",
-     r"onRemoveFromMine=\{\(\) => \{[\s\S]*?fieldBulkDoors\.onRemoveField\("
-     r"[\s\S]*onRemoveFromMine=\{\(\) => \{[\s\S]*?fieldBulkDoors\.onRemoveField\("),
+     r"onRemoveFromMine=\{[\s\S]*removeFieldFromMine\(menuField\)"),
 
     # ⭐⭐ W42-T58 (contract C4) — THE PER KEY VERDICT IS DECLARED IN ONE FILE AND READ IN ANOTHER.
     #

web/wiring_rows/wave42_f.py

@@ -33,6 +33,11 @@ _T24: list[tuple[str, str, str, str, str]] = [
         "customer-grid/RouteNav.tsx", r"onOpenRoute\(route\.key\)",
         "customer-grid/MapView.tsx", r"<RouteNav\b[^>]*\bonOpenRoute=\{openSavedRoute\}",
     ),
+    (
+        "route-nav list failure reaches an error and retry, never an empty state",
+        "customer-grid/RouteNav.tsx", r"listError \? \(",
+        "customer-grid/MapView.tsx", r"<RouteNav\b[^>]*\blistError=\{routeListError\}[\s\S]{0,160}?\bonListRetry=\{retryRouteList\}",
+    ),
     (
         "route-nav-create-is-its-own-affordance",
         "customer-grid/RouteNav.tsx", r"onCreateRoute\(\);",