Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,5 +1,5 @@
 {
- "current": "0cf3d4c",
+ "current": "e43869a",
  "releases": [
   {
    "version": "v24",

VERSION

@@ -1 +1 @@
-0cf3d4c
+e43869a

api/automation_engine.py

@@ -1233,9 +1233,9 @@ def clean_config(kind, raw, previous=None):
 
     ⚠ THE NODE-SWITCH FLAGS FALL BACK TO `previous` WHEN THE KEY IS ABSENT, and that is a rail
     rather than a nicety. `patch` replaces the whole config, and the canvas's config panels do not
-    edit `tier` / `noFallback` / `dryRun` — those are node SWITCHES. So a plain "Save" from a
-    panel that never knew about them would silently reset the paid rung to `anonymous` and turn
-    off the dry run: a save that quietly changes what the automation costs. Absent ⇒ keep;
+    edit `postMetrics` / `commentMetrics` / `dryRun` — those are node SWITCHES. So a plain "Save"
+    from a panel that never knew about them would silently turn off the dry run, or turn ON a
+    per-post purchase: a save that quietly changes what the automation costs. Absent ⇒ keep;
     present ⇒ take it, including `false`.
     """
     raw = raw if isinstance(raw, dict) else {}
@@ -1292,13 +1292,17 @@ def clean_config(kind, raw, previous=None):
         fkey = _s(raw.get("fieldKey"), 80).strip()
         if not fkey:
             return None, "pick the automation column this run writes into"
-        # ⚠ UNKNOWN TIERS FALL BACK TO `anonymous`, NOT to the paid rung. A typo must never be
-        # the thing that starts spending money. An ABSENT tier keeps the one already stored (see
-        # the `flag` note above), and a stored `hiker` is carried FORWARD to the new vendor
-        # rather than silently demoted — see `TIER_ALIASES`.
-        tier = clean_tier(raw["tier"]) if "tier" in raw else ""
-        if not tier and "tier" not in raw:
-            tier = clean_tier(prev.get("tier"))
+        # ⛔⛔ `tier` AND `noFallback` ARE ACCEPTED AND IGNORED (wave 28 / R5, contract C2).
+        # They are read from nothing and written to nothing: a stored definition carrying either
+        # still SAVES — it simply loses them on the next write — and neither is ever a reason to
+        # refuse. That asymmetry is D-65's law and it is not squeamishness: refusing an unknown
+        # key would 400 every automation a tenant stored before this wave, forever, on a screen
+        # that gives them no way to remove it. Dropping a retired key is a migration; refusing it
+        # is an outage.
+        # ⚠ `clean_tier`/`TIERS`/`bd_ready` KEEP THEIR NAMES. They are VENDOR vocabulary
+        # (`brightdata` is a provider, and `verify_automation` fences the name), not the retired
+        # USER concept — renaming them would be a second, unrelated change wearing this one's
+        # justification.
         # C5: absent ⇒ keep whatever is stored, like every other switch in this branch — a panel
         # that does not edit the post count must not reset it to the default on Save. And an
         # INHERITED value is clamped rather than refused; see `clean_max_posts`.
@@ -1309,8 +1313,6 @@ def clean_config(kind, raw, previous=None):
             return None, perr
         return {"targetTable": table, "fieldKey": fkey,
                 "urlField": _s(raw.get("urlField"), 80).strip(),
-                "tier": tier or "anonymous",
-                "noFallback": flag("noFallback"),
                 # ⛔ THE ONE FLAG THAT MULTIPLIES THE BILL BY THE POST COUNT. Off unless asked
                 # for: the Profiles row carries post IDENTITY for free but NO engagement
                 # (measured 2026-08-05), so likes/comments cost one extra vendor record PER POST.
@@ -1515,8 +1517,7 @@ def _ensure_enrich_step(flow_raw):
     # with only step 1 lands this at the end, which IS step 2.
     seeded.insert(1, {
         "id": "act_enrich", "kind": "enrich_instagram", "enabled": True, "when": None,
-        "config": {"tier": "anonymous", "noFallback": False, "postMetrics": False,
-                   "commentMetrics": False,
+        "config": {"postMetrics": False, "commentMetrics": False,
                    "dryRun": False, "maxPosts": DEFAULT_POSTS_PER_PULL,
                    "fromView": "", "sortField": DEFAULT_ENRICH_SORT, "sortDir": "desc",
                    "limit": DEFAULT_ENRICH_LIMIT, "skipRecent": True,
@@ -2593,7 +2594,7 @@ from connectors_ig import (                                        # noqa: E402
     _first, _ig_int,
     bd_call, bd_filter_rows, bd_filter_start, bd_filter_status, bd_ready,
     bd_snapshot_progress, depth_refusal,
-    ig_handle, pull_profile,
+    ig_handle, pull_profile, top_up_views,
 )
 
 
@@ -4620,22 +4621,24 @@ def preset_cells(res, pulled):
 
 def run_field_instagram(rt, defn, username="automation", log=print, step=_no_step,
                         rows=None):
-    """Automation #2 (R7 + R1's hybrid): for every row of a blank database that carries a profile
-    URL, pull the public profile — the PAID rung first when the tier says so, the anonymous
-    ladder underneath it — write a status string into the automation column, and append a
-    timestamped row to each of the three IG tables."""
+    """Automation #2 (R7): for every row of a database that carries a profile URL, pull the public
+    profile through the paid capability chain, write a status string into the automation column,
+    and append a timestamped row to each of the three IG tables.
+
+    ⭐ WAVE 28 / R5 — there is no tier and no rung choice here any more. `pull_profile` routes per
+    CAPABILITY and reports `blocked` rather than downgrading to an approximate row, so the two
+    "which rung answered" counters this function used to keep have nothing left to distinguish."""
     cfg = defn.get("config") or {}
     table_key, fkey = cfg.get("targetTable"), cfg.get("fieldKey")
-    tier = clean_tier(cfg.get("tier")) or "anonymous"
-    paid = tier == "brightdata"
-    fallback = not cfg.get("noFallback")
     post_metrics = bool(cfg.get("postMetrics"))
     comment_metrics = bool(cfg.get("commentMetrics"))
     dry = bool(cfg.get("dryRun"))
-    steps = {"trigger": "ok", "source": "idle", "capture": "idle",
-             "capture_paid": "idle" if paid else "skipped",
-             "capture_anon": "idle" if (not paid or fallback) else "skipped",
-             "capture_metrics": "idle" if post_metrics else "skipped",
+    # ⚠ THE STEP KEYS ARE THE CANVAS NODE IDS (contract C3) and the two must move together — a
+    # status written under a node id `graph()` no longer emits is a dot nothing renders, which is
+    # indistinguishable from a step that never ran.
+    steps = {"trigger": "ok", "source": "idle",
+             "capture_posts": "idle" if post_metrics else "skipped",
+             "capture_comments": "idle" if comment_metrics else "skipped",
              "write": "idle"}
     t = ut_get(rt, table_key)
     if not t:
@@ -4673,7 +4676,6 @@ def run_field_instagram(rt, defn, username="automation", log=print, step=_no_ste
     # `MAX_UT_IG_ROWS` makes the same loop hundreds of millions of dict copies, i.e. an automation
     # that no longer finishes. **Raising a cap and batching its writer are ONE change.** (W19-C.)
     in_snaps, in_posts, in_psnaps, in_comments = [], [], [], []
-    paid_tried = paid_answered = anon_tried = anon_answered = False
     targets = [(rid, str(r.get(url_field, "") or "").strip())
                for rid, r in rows.items() if str(r.get(url_field, "") or "").strip()]
     for i, (rid, url) in enumerate(targets):
@@ -4685,24 +4687,17 @@ def run_field_instagram(rt, defn, username="automation", log=print, step=_no_ste
         step(f"Capturing profile {i + 1} of {len(targets)}")
         counts["profiles"] += 1
         res = pull_profile(url, max_posts=cfg.get("maxPosts") or DEFAULT_POSTS_PER_PULL, log=log,
-                           tier=tier, fallback=fallback, post_metrics=post_metrics,
-                           comment_metrics=comment_metrics,
+                           post_metrics=post_metrics, comment_metrics=comment_metrics,
                            pending_metrics=(pending_metrics if not dry else None))
         pulled = _iso()
         via = res.get("via") or ""
         read_ok = res["state"] in ("ok", "partial")
-        # WHICH RUNG ANSWERED — tracked per profile so the canvas's rung dots are a measurement.
-        if paid:
-            paid_tried = True
-            if via == "brightdata" and read_ok:
-                paid_answered = True
-                counts["paid"] += 1
-            elif fallback:
-                anon_tried = True
-                anon_answered = anon_answered or read_ok
-        else:
-            anon_tried = True
-            anon_answered = anon_answered or read_ok
+        # ⚠ `counts["paid"]` SURVIVES R5 AND IT IS NOT THE RETIRED TIER. It counts profiles a PAID
+        # vendor actually answered, which is the run's spend report — the thing the owner reads to
+        # reconcile a bill. What died is the free rung it used to be contrasted with, so the test
+        # is now simply "did a vendor answer" rather than "did the vendor we were told to try".
+        if read_ok and via in ("brightdata", "apify"):
+            counts["paid"] += 1
         if read_ok:
             counts["ok" if res["state"] == "ok" else "partial"] += 1
             prof = res["profile"]
@@ -4803,21 +4798,24 @@ def run_field_instagram(rt, defn, username="automation", log=print, step=_no_ste
     else:
         cap_state = "partial" if (counts["blocked"] or counts["error"]
                                   or counts["partial"]) else "ok"
-    steps["capture"] = cap_state
-    steps["capture_paid"] = ("ok" if paid_answered
-                             else "blocked" if paid_tried else "skipped")
-    steps["capture_anon"] = ("ok" if anon_answered
-                             else "blocked" if anon_tried else "skipped")
+    # ⭐ C3 — THE CAPTURE FORK IS GONE, SO ITS OUTCOME LANDS ON `source`. There is one way to
+    # read a profile now, and the node that names the profile set is the honest owner of "did
+    # reading them work". The old `capture`/`capture_paid`/`capture_anon` trio described a branch
+    # that no longer exists in behaviour OR on screen.
+    steps["source"] = cap_state if targets else steps["source"]
     # ⚠ MEASURED, LIKE EVERY OTHER DOT: it is `ok` only if an engagement row was actually
     # appended. "It was switched on" is not the same fact as "it answered", and painting the
     # second from the first is the fabrication `node_status` refuses to make.
     # ⚠ AND `blocked` IS A CLAIM ABOUT THE VENDOR, so it needs something to have been ASKED. A
     # run that found no posts to enrich did not have a rung refuse it — nothing was requested —
     # so that reads `skipped`, the same word an off switch earns.
-    steps["capture_metrics"] = ("ok" if counts["metrics"]
-                                else "partial" if counts.get("metric_batches_pending")
-                                else "blocked" if (post_metrics and counts["posts"])
-                                else "skipped")
+    steps["capture_posts"] = ("ok" if counts["metrics"]
+                              else "partial" if counts.get("metric_batches_pending")
+                              else "blocked" if (post_metrics and counts["posts"])
+                              else "skipped")
+    steps["capture_comments"] = ("ok" if counts.get("comments")
+                                 else "blocked" if (comment_metrics and counts["posts"])
+                                 else "skipped")
 
     summary = (f"{read}/{counts['profiles']} profiles read, {counts['posts']} posts "
                f"({counts['new_posts']} new)")
@@ -5351,17 +5349,23 @@ NODE_STATES = ("idle", "ok", "partial", "error", "blocked", "skipped")
 #: deliberate answer rather than an omission: a "Fetch the page" step that can be turned off is
 #: not an automation with a disabled step, it is a broken automation with a lie on it. The ones
 #: here are all REAL — each changes what the next run does:
-#:   schedule     the trigger fires on its cron, or only by hand
-#:   paid         the paid rung is reached for, or it is not (this is the one that spends money)
-#:   fallback     the anonymous ladder catches a refused paid rung, or the run says `blocked`
-#:                instead of quietly writing an approximate number
-#:   postMetrics  likes/comments per post are bought, or the engagement series does not grow —
-#:                the expensive one, because it costs a vendor record PER POST rather than per
-#:                profile (measured: the profile row carries post identity and no engagement)
-#:   write        DRY RUN — read everything, compute the counts, write nothing anywhere
-NODE_TOGGLES = {"trigger": "schedule", "capture_paid": "paid",
-                "capture_anon": "fallback", "capture_metrics": "postMetrics",
-                "write": "write"}
+#:   schedule        the trigger fires on its cron, or only by hand
+#:   postMetrics     likes/comments per post are bought, or the engagement series does not grow —
+#:                   it costs a vendor record PER POST rather than per profile (measured: the
+#:                   profile row carries post identity and no engagement)
+#:   commentMetrics  the Comments dataset is bought, which can bill many rows per post
+#:   write           DRY RUN — read everything, compute the counts, write nothing anywhere
+#:
+#: ⭐⭐ WAVE 28 / R5+R6 (contract C3) — `paid` AND `fallback` ARE GONE, and what replaced them is
+#: the point of the ruling: the money switches used to be "which rung do we try" (a question about
+#: our plumbing), and they are now "what do you want captured" (a question about the user's data).
+#: Profile is always captured and has no switch — an automation that fetches nothing is not an
+#: automation with a step turned off, it is a broken one with a lie on it.
+#: ⚠ `trigger: "schedule"` IS NOT PART OF THAT COLLAPSE. It is the trigger card's own on/off and
+#: has its own branch in `toggle_node` (event triggers flip themselves, not the cron); C3's "the
+#: three toggles" names the CAPTURE ladder it is reshaping.
+NODE_TOGGLES = {"trigger": "schedule", "capture_posts": "postMetrics",
+                "capture_comments": "commentMetrics", "write": "write"}
 
 
 def _cron_label(cron):
@@ -5445,56 +5449,46 @@ def graph(defn):
     edges = []
 
     if defn.get("kind") == "field_instagram":
-        paid = clean_tier(cfg.get("tier")) == "brightdata"
-        fb = not cfg.get("noFallback")
-        anon_on = (not paid) or fb
+        # ⭐⭐ WAVE 28 / CONTRACT C3 — FOUR NODES, THREE OF THEM SWITCHES OVER WHAT IS CAPTURED.
+        # This branch used to draw a FORK: `Capture` splitting into `Exact counts` (paid) and
+        # `Estimated counts` (the free anonymous ladder), rejoining at `Post engagement`. R5
+        # deleted the ladder, so the fork had one arm; keeping it would have drawn a decision the
+        # engine no longer makes, with a switch (`fallback`) flipping a config key the cleaners
+        # now discard. A canvas that offers a choice the runtime ignores is worse than no canvas.
+        # ⚠ `Profile set` STILL CARRIES NO SWITCH, and now that is the whole ruling rather than an
+        # implementation detail: the profile is always captured (R6), Posts and Comments are the
+        # opt-ins, and both are OFF until asked for.
         metrics_on = bool(cfg.get("postMetrics"))
+        comments_on = bool(cfg.get("commentMetrics"))
         max_posts = cfg.get("maxPosts") or DEFAULT_POSTS_PER_PULL
         nodes += [
             node("source", "source", "Profile set", cfg.get("targetTable") or "No database", 1,
                  panel="source",
                  detail=f"URL column: {cfg.get('urlField')}" if cfg.get("urlField")
                         else "URL column: the one the field is bound to"),
-            node("capture", "branch", "Capture",
-                 "Exact counts, then estimates" if paid else "Estimated counts only", 2, panel="capture",
-                 detail=f"Up to {max_posts} posts per profile"),
-            node("capture_paid", "capture", "Exact counts",
-                 "Exact followers and top posts" if paid else "Off",
-                 3, row=-1, panel="capture", on=paid,
-                 detail="" if bd_ready() else "Not set up yet"),
-            node("capture_anon", "capture", "Estimated counts",
-                 "Free, rounded numbers" if anon_on else "Off",
-                 3, row=1, panel="capture", on=anon_on,
-                 detail="Rounded to the nearest thousand"),
             # ⚠ ITS OWN NODE BECAUSE IT IS ITS OWN BILL. The profile row carries post IDENTITY
             # and no engagement (measured), so likes/comments are a SECOND vendor call per post.
             # A switch that multiplies a run's cost by the post count deserves to be visible on
             # the canvas rather than buried in a config panel.
-            node("capture_metrics", "capture", "Post engagement",
-                 "Likes and comments per post" if metrics_on
-                 else "Off — no likes/comments are bought",
-                 4, panel="capture", on=metrics_on,
-                 detail=(f"~{max_posts}x the records of a profile-only run"
-                         if metrics_on else
+            node("capture_posts", "capture", "Post data",
+                 "Likes and comments per post" if metrics_on else "Off",
+                 2, panel="capture", on=metrics_on,
+                 detail=(f"Up to {max_posts} posts per profile" if metrics_on else
                          "ut_ig_post_snapshots only grows while this is on")),
+            node("capture_comments", "capture", "Comment data",
+                 "Comments on those posts" if comments_on else "Off",
+                 3, panel="capture", on=comments_on,
+                 detail=("The full comments dataset — many rows per post" if comments_on else
+                         "Comments already embedded in a paid post row are kept either way")),
             node("write", "write", "Write",
-                 cfg.get("targetTable") or "No database", 5, panel="write",
+                 cfg.get("targetTable") or "No database", 4, panel="write",
                  on=not cfg.get("dryRun"),
                  detail="+ ut_ig_snapshots · ut_ig_posts · ut_ig_post_snapshots"),
         ]
         edges = [{"from": "trigger", "to": "source", "label": ""},
-                 {"from": "source", "to": "capture", "label": ""},
-                 {"from": "capture", "to": "capture_paid", "label": "paid"},
-                 {"from": "capture", "to": "capture_anon", "label": "fallback"},
-                 {"from": "capture_paid", "to": "capture_metrics", "label": ""},
-                 {"from": "capture_anon", "to": "capture_metrics", "label": ""},
-                 {"from": "capture_metrics", "to": "write", "label": ""}]
-        # When there is no paid rung the anonymous one is the ONLY rung, so it must not carry a
-        # switch that would leave the automation with nothing to run.
-        if not paid:
-            for n in nodes:
-                if n["id"] == "capture_anon":
-                    n["toggle"] = ""
+                 {"from": "source", "to": "capture_posts", "label": ""},
+                 {"from": "capture_posts", "to": "capture_comments", "label": ""},
+                 {"from": "capture_comments", "to": "write", "label": ""}]
     elif defn.get("kind") == "discover_instagram":
         limit = int(cfg.get("recordsLimit") or 0)
         est = discover_estimate(limit)
@@ -5583,13 +5577,10 @@ def toggle_node(rt, auto_id, node_id):
         return patch(rt, auto_id, {"trigger": trg})
     if which == "schedule":
         sched["enabled"] = not sched.get("enabled")
-    elif which == "paid":
-        cfg["tier"] = ("anonymous" if clean_tier(cfg.get("tier")) == "brightdata"
-                       else "brightdata")
-    elif which == "fallback":
-        cfg["noFallback"] = not cfg.get("noFallback")
     elif which == "postMetrics":
         cfg["postMetrics"] = not cfg.get("postMetrics")
+    elif which == "commentMetrics":
+        cfg["commentMetrics"] = not cfg.get("commentMetrics")
     elif which == "write":
         cfg["dryRun"] = not cfg.get("dryRun")
     return patch(rt, auto_id, {"config": cfg, "schedule": sched})
@@ -6137,10 +6128,10 @@ def _clean_action_config(kind, cfg, depth, seen, count):
                 "limit": min(e_limit, MAX_ENRICH_PER_RUN),
                 "skipRecent": bool(cfg.get("skipRecent")),
                 "skipRecentDays": max(1, e_days),
-                # An unknown tier falls back to `anonymous`, never to the paid rung — a typo must
-                # not be the thing that starts spending money (the `clean_config` rule, verbatim).
-                "tier": clean_tier(cfg.get("tier")) or "anonymous",
-                "noFallback": bool(cfg.get("noFallback")),
+                # ⛔ `tier`/`noFallback` are ACCEPTED AND IGNORED here for the same reason as in
+                # `clean_config` (R5 / C2): a stored action carrying them still saves and simply
+                # loses them, because refusing a retired key 400s every definition written before
+                # this wave (D-65).
                 # ⛔ THE FLAG THAT MULTIPLIES THE BILL BY THE POST COUNT. Off unless asked for.
                 "postMetrics": bool(cfg.get("postMetrics")),
                 # The separate Comments dataset is more granular than a post read and stays off
@@ -6292,13 +6283,21 @@ DEFAULT_ENRICH_SORT = "first_found"
 #: an underscore — `COUNT_LABELS` on the client is an allow-list and cannot pick it up by
 #: accident, and `_commit_run`'s numeric filter is the second net under it.
 RUN_NOTES_KEY = "_notes"
-#: How long a handle a VENDOR SAID DOES NOT EXIST is left alone before it is tried again.
-#: ⚠ NOT permanent, and not the success cooldown either. Permanent would be wrong — a handle can
-#: be renamed back or a suspension lifted — but re-buying a dead account every morning is what
-#: the owner reported ("blocked AGAIN"), so the floor is one paid attempt per handle per month
-#: instead of one per day. Editing the handle changes the key and retries immediately, which is
-#: the behaviour someone correcting a typo expects.
-NOT_FOUND_RETRY_DAYS = 30
+#: ⭐⭐ WAVE 28 / OWNER RULING R9 — `NOT_FOUND_RETRY_DAYS` IS RETIRED. A handle a VENDOR SAID DOES
+#: NOT EXIST is now a TOMBSTONE: never auto-retried, at any interval.
+#: ⛔ THE 30-DAY BACKOFF WAS THE DEFENSIBLE ANSWER AND IT WAS STILL WRONG, which is the sentence
+#: worth keeping. Its argument was that a handle can be renamed back or a suspension lifted, so
+#: the verdict should expire. But nothing about US changes on day 31 — the only new information
+#: is a guess that the world moved — so the timer buys one paid vendor call per dead handle per
+#: month, forever, on a row nobody is looking at, and reports it as "1 blocked". A tenant with a
+#: hundred stale handles pays a hundred times a month to be told the same thing.
+#: ⭐ WHAT RE-ARMS IT IS A HUMAN, and there are two doors:
+#:   1. the KEY is `(platform, handle)` — so correcting a typo re-arms IMMEDIATELY, with no
+#:      wiring at all, because the corrected handle simply is not the one we recorded; and
+#:   2. `clear_gone()` — called when the profile CELL is written, so re-typing the SAME handle
+#:      (a person saying "try it again") also re-arms.
+#: ⚠ The run keeps NAMING the skipped handles every time, not only on the run that discovered
+#: them: a tombstone the owner cannot see is just a disappearance.
 #: A queued profile snapshot the vendor never finishes is dropped after this, with a note. An
 #: unbounded pending list is the forever-loop this whole change exists to remove, wearing the
 #: opposite mask ([[gate-answers-the-wrong-question]]).
@@ -6375,6 +6374,48 @@ def _gone_key(row, handle):
     return f"{plat}:{str(handle or '').strip().lstrip('@').lower()}"
 
 
+def clear_gone(rt, table_key, handle, row=None):
+    """R9's re-arm door: forget the "this account does not exist" verdict for ONE handle.
+
+    Returns the number of automations whose memory was changed — 0 is the ordinary answer and is
+    not an error, because most cell edits are not on a dead handle.
+
+    ⭐⭐ WHY THIS IS A PUBLIC FUNCTION IN THE ENGINE RATHER THAN A LOOKUP IN THE ROW WRITER.
+    The verdict lives on the AUTOMATION (`state.enrichNotFound`), not on the row — it has to,
+    because it is a fact about what a run learned and paid for. But the thing that re-arms it is a
+    ROW event, and the row writer must not need to know the shape of an automation's state to
+    trigger it. So the seam is one call with the three things the writer already has, and every
+    walk of `all_definitions` stays on this side of the fence.
+    ⚠ IT MATCHES THE SAME WAY THE SKIP DOES. `_gone_key` is the one implementation of "which
+    handle is this", so a verdict can never be recorded under a key this cannot find
+    ([[one-evaluator-per-question]]).
+
+    ⛔ WITHOUT ITS CALLER THIS IS INERT, AND THAT IS RECORDED RATHER THAN ASSUMED. R9's first
+    door — correcting a typo — works with no wiring at all, because the key IS the handle and a
+    different handle is simply not the one we recorded. This second door only opens when the row
+    write path calls it, which lives in `routes_tables.patch_row` (another session's fence).
+    Until that line lands, re-typing the SAME dead handle stays skipped
+    ([[flag-shipped-without-its-writer]] — named on purpose, so it is not discovered later).
+    """
+    key = _gone_key(row or {}, handle)
+    if not str(handle or "").strip():
+        return 0
+    changed = 0
+    for auto_id, defn in (all_definitions(rt) or {}).items():
+        if str((defn.get("config") or {}).get("targetTable") or "") != str(table_key):
+            continue
+        known = dict(((defn.get("state") or {}).get("enrichNotFound")) or {})
+        if key not in known:
+            continue
+        known.pop(key, None)
+        # ⚠ `or None` — an empty dict must clear the key rather than store `{}`, which is what
+        # every other state writer here does and what keeps a definition from growing a graveyard
+        # of empty maps.
+        set_state(rt, str(auto_id), {"enrichNotFound": known or None})
+        changed += 1
+    return changed
+
+
 def enrich_selection(rt, table_key, cfg, profile_key, today=None, gone=None):
     """⭐ 2026-08-07 (owner ruling) — WHICH records this enrich step spends on, in order.
 
@@ -6512,12 +6553,12 @@ def enrich_selection(rt, table_key, cfg, profile_key, today=None, gone=None):
         if not raw_handle:
             blank_handle += 1
             continue
-        verdict = (gone or {}).get(_gone_key(r, raw_handle))
-        if isinstance(verdict, dict):
-            since_gone = _days_since(verdict.get("at"), today=today)
-            if since_gone is None or since_gone < NOT_FOUND_RETRY_DAYS:
-                skipped_gone.append(raw_handle)
-                continue
+        # ⛔ R9 — NO EXPIRY. There is deliberately no date arithmetic here any more: a verdict is
+        # a verdict until a human edits the cell. An `at` stamp is still STORED (it is what the
+        # owner reads to know when we last paid to be told this), it is simply not a clock.
+        if isinstance((gone or {}).get(_gone_key(r, raw_handle)), dict):
+            skipped_gone.append(raw_handle)
+            continue
         if cooling:
             since = _days_since(r.get("enriched_at"), today=today)
             if since is not None and since < days:
@@ -6532,9 +6573,12 @@ def enrich_selection(rt, table_key, cfg, profile_key, today=None, gone=None):
         notes.append(f"{cooled} skipped as enriched in the last {days} days")
     if skipped_gone:
         shown = ", ".join(f"@{h}" for h in skipped_gone[:5])
+        # ⚠ THE SENTENCE IS THE FEATURE. It must name the handles AND the two things a person can
+        # do, because nothing else will ever retry them — under R9 this note is the only path
+        # back from a tombstone, so a vaguer version would strand the row permanently.
         notes.append(f"{len(skipped_gone)} skipped because Instagram has no such account "
                      f"({shown}{', …' if len(skipped_gone) > 5 else ''}) — delete the row or "
-                     f"correct the handle; it is retried after {NOT_FOUND_RETRY_DAYS} days")
+                     f"correct the handle; they are not retried automatically")
     if blank_handle:
         notes.append(f"{blank_handle} skipped with no handle")
     if len(picked) < quota and (cooled or blank_handle or skipped_gone or ordered):
@@ -6770,8 +6814,6 @@ def apply_actions(rt, defn, table_key, row_ids, username="automation", log=print
                 res = pull_profile(handle_raw,
                                    max_posts=cfg.get("maxPosts") or DEFAULT_POSTS_PER_PULL,
                                    log=log,
-                                   tier=clean_tier(cfg.get("tier")) or "anonymous",
-                                   fallback=not cfg.get("noFallback"),
                                    post_metrics=bool(cfg.get("postMetrics")),
                                    comment_metrics=bool(cfg.get("commentMetrics")),
                                    pending_metrics=(enrich["pending"]
@@ -6886,8 +6928,6 @@ def migrate_field_instagram(rt, defn):
         max_posts = 24
     act = {"id": "act_enrich", "kind": "enrich_instagram", "enabled": True, "when": None,
            "config": {"profileField": bound,
-                      "tier": clean_tier(cfg.get("tier")) or "anonymous",
-                      "noFallback": bool(cfg.get("noFallback")),
                       "postMetrics": bool(cfg.get("postMetrics")),
                       "commentMetrics": bool(cfg.get("commentMetrics")),
                       "dryRun": bool(cfg.get("dryRun")),
@@ -7177,7 +7217,7 @@ def collect_pending_profile_snapshots(rt, defn, username="automation", log=print
     """
     tasks = _pending_profile_tasks(defn)
     if not tasks:
-        return ("ok", "No pending profile reads.", {}, [], {"capture_paid": "idle"})
+        return ("ok", "No pending profile reads.", {}, [], {"source": "idle"})
     step(f"Collecting {len(tasks)} deferred profile read{'' if len(tasks) == 1 else 's'}")
     remaining, patches, affected, notes = [], {}, [], []
     acc = {"snaps": [], "posts": [], "psnaps": [], "comments": [], "pending": [],
@@ -7196,7 +7236,8 @@ def collect_pending_profile_snapshots(rt, defn, username="automation", log=print
             acc["notes"].append(note)
             # ⭐ `failed` = the vendor finished, collected nothing, and blamed the TARGET. On a
             # profile request that means the account could not be reached at all, so the verdict
-            # is remembered and the selection stops re-buying it (`NOT_FOUND_RETRY_DAYS`).
+            # is remembered and the selection stops re-buying it (R9: permanently, until a
+            # human edits the handle cell — see `clear_gone`).
             # ⚠ `done`-with-zero is NOT remembered: "we found no matches" is a statement about
             # the query, and turning it into "this account does not exist" would silently retire
             # live handles.
@@ -7268,7 +7309,7 @@ def collect_pending_profile_snapshots(rt, defn, username="automation", log=print
                     f"; {waiting} still building" if waiting else ""])
     state = "ok" if ready and not closed else "partial"
     return (state, head + tail, counts, affected,
-            {"capture_paid": "ok" if ready else "partial", "write": "ok" if ready else "idle"})
+            {"source": "ok" if ready else "partial", "write": "ok" if ready else "idle"})
 
 
 def _write_collected_metric_rows(rt, defn, username, idents, snapshots, comments, log):
@@ -7318,10 +7359,10 @@ def collect_pending_metric_snapshots(rt, defn, username="automation", log=print,
     """Collect deferred paid Post/Reel/Comment snapshots; never launches a new scrape request."""
     tasks = _pending_metric_tasks(defn)
     if not tasks:
-        return ("ok", "No pending post-engagement snapshots.", {}, [], {"capture_metrics": "idle"})
+        return ("ok", "No pending post-engagement snapshots.", {}, [], {"capture_posts": "idle"})
     step(f"Collecting {len(tasks)} post-engagement batch{'' if len(tasks) == 1 else 'es'}")
     remaining, idents, snapshots, comments = [], [], [], []
-    ready, waiting, closed, closed_notes = 0, 0, 0, []
+    ready, waiting, closed, run_notes = 0, 0, 0, []
     for task in tasks:
         # ⭐⭐ 2026-08-09 — ASK THE STATUS DOCUMENT, NOT THE ROWS. `building` used to be
         # `not rows or …`, so a snapshot the vendor had FINISHED with zero records was re-queued
@@ -7333,7 +7374,7 @@ def collect_pending_metric_snapshots(rt, defn, username="automation", log=print,
             # ⛔ CLOSED, NOT RE-QUEUED. The vendor is finished and there is nothing to collect;
             # keeping the entry would be a pending task that can never resolve.
             closed += 1
-            closed_notes.append(f"{task['influencer']}: {_s(empty_note, 160)}")
+            run_notes.append(f"{task['influencer']}: {_s(empty_note, 160)}")
             continue
         payload, note = bd_call(f"{BD_PATH_SNAPSHOT}/{task['snapshotId']}", {"format": "json"})
         rows = _bd_rows(payload) if not note else []
@@ -7357,6 +7398,23 @@ def collect_pending_metric_snapshots(rt, defn, username="automation", log=print,
                     post["influencer_key"] = task["influencer"]
                     mapped_posts.append(post)
             if mapped_posts:
+                # ⭐⭐ 2026-08-09 — THE VIEWS TOP-UP RUNS HERE TOO, and its absence is why the
+                # owner's `theresalearns` run filled every column except Views.
+                #
+                # ⛔ Bright Data is DECLARED INCAPABLE of `ig_post_views` (`providers.py`), so a
+                # Posts row physically cannot carry a view count — MEASURED on the stored
+                # payloads: 12 rows, `content_type: "Reel"`, and no view/play key in any of them.
+                # Views only ever comes from the Apify capability. That top-up lived INSIDE
+                # `pull_profile_bd`, so it ran only when the Posts scrape answered within the wait
+                # budget; when the batch deferred — which is routine, and what happened here — the
+                # rows came back through THIS function and Apify was never asked.
+                # ⇒ `top_up_views` is now one function with two callers rather than a copy, so
+                # the inline and deferred paths cannot answer this differently again.
+                # ⚠ It mutates `mapped_posts` in place and must run BEFORE `capture_rows`, which
+                # is what freezes the values into the post + snapshot rows.
+                v_note = top_up_views(mapped_posts, log=log)
+                if v_note:
+                    run_notes.append(f"@{task['influencer']}: {v_note}")
                 _unused, post_rows, metric_rows, embedded = capture_rows(
                     {"state": "ok", "profile": {"username": task["influencer"]},
                      "posts": mapped_posts, "comments": [], "via": "brightdata:deferred"}, pulled)
@@ -7381,8 +7439,8 @@ def collect_pending_metric_snapshots(rt, defn, username="automation", log=print,
     # other call sites disagree about the shape of a run — and `_commit_run` already drops
     # non-numeric count values, so a pop that is ever missed degrades to today's behaviour rather
     # than to a crash.
-    if closed_notes:
-        counts[RUN_NOTES_KEY] = closed_notes
+    if run_notes:
+        counts[RUN_NOTES_KEY] = run_notes
     # ⚠ THE EMPTY ONES ARE NAMED, not silently dropped. A batch that finished with no records is
     # a real outcome the tenant paid for and it must read as an answer, not as a disappearance.
     tail = (f"; {closed} finished with nothing to collect" if closed else "")
@@ -7390,9 +7448,9 @@ def collect_pending_metric_snapshots(rt, defn, username="automation", log=print,
         return ("partial",
                 f"{ready} post-engagement batch{'' if ready == 1 else 'es'} collected; "
                 f"{waiting} still building and will be collected automatically{tail}",
-                counts, [], {"capture_metrics": "partial", "write": "ok"})
+                counts, [], {"capture_posts": "partial", "write": "ok"})
     return ("ok", f"{ready} post-engagement batch{'' if ready == 1 else 'es'} collected{tail}",
-            counts, [], {"capture_metrics": "ok", "write": "ok"})
+            counts, [], {"capture_posts": "ok", "write": "ok"})
 
 
 def ai_decide(rt, defn, act, row, row_id="", log=print):
@@ -7781,8 +7839,25 @@ def _ut():
 
 
 #: The fns by family — how a value is folded, and what a blank means in each.
-_ROLLUP_NUM_FNS = frozenset({"sum", "average", "min", "max"})
+_ROLLUP_NUM_FNS = frozenset({"sum", "average", "stdev", "min", "max"})
 _ROLLUP_BOOL_FNS = frozenset({"and", "or", "xor"})
+#: The count/order family — folded by their own arms above the lanes.
+_ROLLUP_SEQ_FNS = frozenset({"countall", "counta", "count", "latest"})
+#: The text family. ⛔ IT IS A NAMED SET NOW AND IT USED TO BE THE FALL-THROUGH, which is how
+#: wave 28 nearly shipped a wrong number that looked like data: `stdev` validated and STORED
+#: (`core.user_tables.ROLLUP_FNS`) a commit before this function learned it, and an fn no arm
+#: claims fell past both lanes into the join below — so a "Std deviation" column rendered
+#: `"137684, 19561, 8123"`. Filled, plausible, and not a statistic. An unrecognised fn now
+#: returns `""` ([[gate-answers-the-wrong-question]]: blank is the honest answer to a question
+#: nothing can answer; a comma-joined list is a different question's answer wearing this label).
+_ROLLUP_TEXT_FNS = frozenset({"concatenate", "arrayjoin", "arraycompact", "arrayunique"})
+#: ⭐⭐ WHAT THIS FOLD ACTUALLY IMPLEMENTS, DERIVED FROM THE ARMS RATHER THAN RESTATED.
+#: `verify_automation` asserts this is IDENTICAL to `core.user_tables.ROLLUP_FNS` name for name
+#: (contract C1's parity leg), so the validator can never again accept a function the fold cannot
+#: compute — in EITHER direction. A hand-listed copy in the gate would have gone green on the
+#: defect above, because the defect was that the two lists already disagreed.
+ROLLUP_FOLD_FNS = frozenset(_ROLLUP_NUM_FNS | _ROLLUP_BOOL_FNS | _ROLLUP_SEQ_FNS
+                            | _ROLLUP_TEXT_FNS)
 _ROLLUP_TEXT_FNS = frozenset({"concatenate", "arrayjoin", "arraycompact", "arrayunique"})
 #: What `arrayjoin` puts between values. Airtable uses ", "; `concatenate` uses nothing.
 _ROLLUP_JOIN = ", "
@@ -7826,6 +7901,46 @@ def _sort_key(value, ftype):
     return (raw.lower(),)
 
 
+def _sample_stdev(nums):
+    """SAMPLE standard deviation (n-1) of `nums`, or None under two values.
+
+    ⭐ ONE IMPLEMENTATION, TWO READERS, and that is the point of lifting four lines into a
+    function: `_rollup_fold` RENDERS this number into a "Std deviation" column and
+    `_rollup_ref_threshold` COMPARES rows against it inside a `sigmas` condition. A second copy
+    would let a column and the filter beside it disagree about the same word on the same set —
+    the exact drift `top_up_views` was extracted to prevent one module over
+    ([[one-evaluator-per-question]]).
+    ⛔ None means UNANSWERABLE and no caller may read it as 0.
+    """
+    if len(nums) < 2:
+        return None
+    mean = sum(nums) / len(nums)
+    return (sum((n - mean) ** 2 for n in nums) / (len(nums) - 1)) ** 0.5
+
+
+def _rollup_ref_threshold(rows, field, sigmas):
+    """`mean + sigmas*stdev` of `field` over `rows` — a statistic OF THE SCOPED SET (contract C1).
+
+    ⛔ `rows` MUST already be the scoped window: ranked by `sortBy`, deduped, and cut by `limit`,
+    and NOT yet filtered by the conditions this threshold feeds. That order is the contract
+    (`core.user_tables.ROLLUP_REF_OPS`'s note says so in as many words) and both other orders
+    produce a plausible number: computing it before `limit` answers "2 sigma of everything this
+    account ever posted" under a column that says "of the last 10", and computing it after the
+    filter makes the threshold depend on the rows it is choosing — a definition that chases
+    itself.
+
+    Returns None when the window cannot answer — fewer than two numeric values in `field`.
+    ⛔ THE CALLER MUST DROP THE ROW, NOT KEEP IT. "Beyond 2 sigma of one post" is not a question
+    with a permissive answer; letting an unanswerable leaf pass everything would silently turn
+    "the outliers" into "all of them", which is this module's worst failure mode wearing a filter.
+    """
+    nums = [n for n in (_lane_num((r or {}).get(field)) for r in rows) if n is not None]
+    sd = _sample_stdev(nums)
+    if sd is None:
+        return None
+    return (sum(nums) / len(nums)) + float(sigmas) * sd
+
+
 def _rollup_fold(fn, values):
     """`values` (raw cells, in the order the window kept them) → the aggregate, as a STRING.
 
@@ -7853,8 +7968,24 @@ def _rollup_fold(fn, values):
         nums = [n for n in (_lane_num(v) for v in values) if n is not None]
         if not nums:
             return ""
-        out = (sum(nums) if fn == "sum" else min(nums) if fn == "min"
-               else max(nums) if fn == "max" else sum(nums) / len(nums))
+        if fn == "stdev":
+            # ⭐⭐ SAMPLE standard deviation (n-1), and the divisor is a ruling, not a preference
+            # (C1 / `core.user_tables.ROLLUP_FNS`'s note): a rollup folds the rows that happen to
+            # be LINKED, which is a sample of an account's posting history and not its entirety.
+            # ⚠ Fixture to check a refactor against: [2,4,4,4,5,5,7,9] -> 2.14. The POPULATION
+            # form gives 2.00 on the same input, so a test that ever reads 2.00 has silently
+            # switched divisors.
+            # ⛔ FEWER THAN TWO VALUES IS "" AND NEVER "0". n-1 = 0 would divide by zero, but the
+            # honest reason is upstream of the arithmetic: one measurement has no spread to
+            # report, and a 0 in a "Std deviation" column reads as PERFECT CONSISTENCY — the
+            # single most confident thing this column can say, asserted from a single row. Same
+            # law as the blank `sum`, and it bites harder here.
+            out = _sample_stdev(nums)
+            if out is None:
+                return ""
+        else:
+            out = (sum(nums) if fn == "sum" else min(nums) if fn == "min"
+                   else max(nums) if fn == "max" else sum(nums) / len(nums))
         return f"{out:.0f}" if float(out).is_integer() else f"{out:.2f}"
     if fn in _ROLLUP_BOOL_FNS:
         # A checkbox cell is '1'/'' in this product, so truth is "non-blank and not a zero".
@@ -7864,7 +7995,11 @@ def _rollup_fold(fn, values):
         hit = (all(flags) if fn == "and" else any(flags) if fn == "or"
                else sum(1 for f in flags if f) % 2 == 1)
         return "1" if hit else ""
-    # --- the text family
+    # --- the text family. ⛔ CLAIMED BY NAME, NEVER BY FALL-THROUGH — see `_ROLLUP_TEXT_FNS`.
+    # An fn no arm above recognises returns "" rather than a comma-joined dump of every value,
+    # which is the shape a not-yet-implemented aggregate wore for one commit of wave 28.
+    if fn not in _ROLLUP_TEXT_FNS:
+        return ""
     vals = [str(v).strip() for v in values if str(v or "").strip() != ""]
     if fn == "arrayunique":
         seen, uniq = set(), []
@@ -7912,8 +8047,17 @@ def _linked_rows_by_join(linked, on_key):
     return idx
 
 
-def _rollup_condition_matches(row, condition, field_types):
-    """Evaluate one Airtable-style linked-record condition against a candidate row."""
+def _rollup_condition_matches(row, condition, field_types, ref_value=None):
+    """Evaluate one Airtable-style linked-record condition against a candidate row.
+
+    `ref_value` is the threshold a `ref: {sigmas}` leaf compares against, already computed by the
+    caller over the SCOPED set (`_rollup_ref_threshold`). ⛔ It is passed IN rather than computed
+    here because this function sees one row and the statistic is a property of the whole window —
+    a version that reached for the set from inside would be recomputing the same mean once per
+    row, and would have to be handed the window anyway.
+    ⚠ `None` means the window could not answer, and the leaf then matches NOTHING. See the
+    threshold helper for why the permissive reading is the dangerous one.
+    """
     field = str((condition or {}).get("field") or "")
     op = str((condition or {}).get("op") or "")
     raw = (row or {}).get(field)
@@ -7922,6 +8066,18 @@ def _rollup_condition_matches(row, condition, field_types):
         return text == ""
     if op == "is_not_empty":
         return text != ""
+    if (condition or {}).get("ref") is not None:
+        # ⛔ NUMERIC LANE ONLY, BOTH SIDES. The validator already restricts `ref` to the ordering
+        # ops, and a row whose cell is blank or unparseable has no position relative to a computed
+        # threshold — it is not "below" it. Dropping it is the same partition law `_sort_key`
+        # follows: unrankable is not a rank ([[sentinel-in-a-sort-key]]).
+        left_num = _lane_num(text)
+        if ref_value is None or left_num is None:
+            return False
+        return ((op == "gt" and left_num > ref_value)
+                or (op == "gte" and left_num >= ref_value)
+                or (op == "lt" and left_num < ref_value)
+                or (op == "lte" and left_num <= ref_value))
     wanted = str((condition or {}).get("value") or "").strip()
     if op == "contains":
         return wanted.casefold() in text.casefold()
@@ -8021,16 +8177,21 @@ def compute_relation_cells(rt, table_key, tables=None):
             # ⚠ A rollup whose link field does not exist (renamed, deleted) resolves to NOTHING
             # and therefore to a blank cell — never to a stale number. A column that keeps
             # printing yesterday's answer after its input is gone is the worst of the options.
-            conditions = list(bag.get("conditions") or [])
-            if conditions:
-                matches = lambda pair: [
-                    _rollup_condition_matches(pair[1], condition,
-                                               linked_types.get(lk_key) or {})
-                    for condition in conditions]
-                if str(bag.get("conditionConj") or "and") == "or":
-                    hits = [pair for pair in hits if any(matches(pair))]
-                else:
-                    hits = [pair for pair in hits if all(matches(pair))]
+            # ⭐⭐ WAVE 28 / CONTRACT C1 — SCOPE FIRST, FILTER SECOND, AND THE TWO USED TO BE THE
+            # OTHER WAY ROUND. The conditions block stood HERE, above the ranking, so
+            # "last 10 posts where views > X" meant *the 10 most recent of the posts over X*
+            # rather than *the ones over X among the last 10* — two different windows wearing one
+            # sentence. Harmless while a threshold was a literal; incoherent the moment a
+            # threshold is a statistic OF the window, because the set being described and the set
+            # doing the describing would be different sets.
+            # ⛔ THIS ORDER IS THE CONTRACT, not an implementation choice: `core.user_tables`'s
+            # `ROLLUP_REF_OPS` note states it ("the scope picks the window, THEN the threshold is
+            # computed over that window, THEN the conditions filter it") and the validator half
+            # was written against it.
+            # ⚠ IT IS A BEHAVIOUR CHANGE FOR EXACTLY ONE SHAPE: a stored rollup carrying BOTH
+            # `conditions` AND `limit`. No shipped preset does (measured across `odoo_relational`
+            # and the IG presets — the one preset with conditions, `_OPEN_ONLY`, is a `countall`
+            # with no limit), so the blast radius is user-built rollups only.
             sort_by = str(bag.get("sortBy") or "")
             if sort_by:
                 ftype = (linked_types.get(lk_key) or {}).get(sort_by, "text")
@@ -8060,6 +8221,30 @@ def compute_relation_cells(rt, table_key, tables=None):
             limit = int(bag.get("limit") or 0)
             if limit:
                 hits = hits[:limit]
+            # --- the window is now FIXED, so a set-statistic threshold has a set to be about.
+            conditions = list(bag.get("conditions") or [])
+            if conditions:
+                # ⚠ RESOLVED ONCE PER LEAF, NOT ONCE PER ROW. The threshold is a property of the
+                # window; computing it inside `matches` would recompute the same mean for every
+                # candidate and — worse — would invite computing it over a set that the filter is
+                # already shrinking underneath it.
+                # ⚠ `.get("sigmas", 0.0)`, never `... or 0.0` — a legitimate `sigmas: 0` ("beyond
+                # the mean") is falsy, and the `or` spelling would silently rewrite it to the same
+                # number by accident. It reads identically and is right for the wrong reason,
+                # which is how it survives a review.
+                refs = [_rollup_ref_threshold(
+                            [r for _i, r in hits], str(c.get("field") or ""),
+                            (c.get("ref") or {}).get("sigmas", 0.0))
+                        if isinstance(c, dict) and c.get("ref") is not None else None
+                        for c in conditions]
+                matches = lambda pair: [
+                    _rollup_condition_matches(pair[1], condition,
+                                              linked_types.get(lk_key) or {}, ref_value=ref)
+                    for condition, ref in zip(conditions, refs)]
+                if str(bag.get("conditionConj") or "and") == "or":
+                    hits = [pair for pair in hits if any(matches(pair))]
+                else:
+                    hits = [pair for pair in hits if all(matches(pair))]
             src = str(bag.get("field") or "")
             want = _rollup_fold(str(bag.get("fn") or ""),
                                 [r.get(src) for _i, r in hits] if src else [1] * len(hits))
@@ -9068,9 +9253,9 @@ def compose_sentence(defn):
         host = urlparse(str(cfg.get("url") or "")).hostname or "the page"
         body = f"read {host} and upsert rows into {cfg.get('targetTable') or 'a new database'}"
     elif kind == "field_instagram":
-        body = (f"capture Instagram profiles for {cfg.get('targetTable') or 'the database'}"
-                + (", exact counts first" if clean_tier(cfg.get("tier")) == "brightdata"
-                   else ", anonymous only"))
+        # ⚠ NO RUNG CLAUSE (R5). There is one way to capture a profile now, so ", exact counts
+        # first" / ", anonymous only" described a choice that no longer exists.
+        body = f"capture Instagram profiles for {cfg.get('targetTable') or 'the database'}"
     elif kind == "discover_instagram":
         body = (f"search Instagram for up to {cfg.get('recordsLimit') or 0} profiles into "
                 f"{cfg.get('targetTable') or DISCOVER_TABLE}")

api/connectors_ig.py

@@ -34,8 +34,8 @@ a caller reached first. The server imports the engine first and would have worke
 probe doing `import connectors_ig` would have got a half-built engine and an AttributeError from
 inside a vendor call. **An intermittent-by-import-order failure is the worst shape available**, so
 every reach-back is a `from automation_engine import …` INSIDE the function that needs it, where
-the module is always fully built. There are exactly eight — `_ig_get`, `_bd_why`, `bd_call`,
-`apify_posts`, `_tag_metric_deferrals`, `pull_profile_bd`, `pull_profile`, `_paginate` — each
+the module is always fully built. There are exactly seven — `_bd_why`, `bd_call`,
+`apify_posts`, `apify_profile`, `_tag_metric_deferrals`, `pull_profile_bd`, `pull_profile` — each
 marked `# lazy — see the module header`, and they reach for four kinds of thing:
 
     fetch / fetch_json / Refused   the SSRF-guarded HTTP rail (the scrape runner shares it)
@@ -54,7 +54,6 @@ allowed to know.
 """
 from __future__ import annotations
 
-import datetime as _dt
 import hashlib
 import json
 import os
@@ -68,11 +67,16 @@ import providers
 
 
 # ---------------------------------------------------------------------------------------------
-# THE ANONYMOUS LADDER'S READERS ($0, no key of any kind)
+# HANDLE + COUNT READERS (no vendor, no key — pure parsing)
 # ---------------------------------------------------------------------------------------------
-
-IG_APP_ID = "936619743392459"          # the public web client id the browser itself sends
-IG_MAX_RETRIES = 2
+# ⛔ THE ANONYMOUS LADDER THAT USED TO LIVE HERE IS DELETED (wave 28, owner ruling R5), and this
+# note is the reason it must not come back on a "we could read this for free" impulse. Its two
+# rungs — Instagram's `web_profile_info` endpoint and the profile HTML's `og:description` —
+# returned counts the PAGE had already rounded ("204K"), which landed in the same `followers`
+# column as a measured 204,318 under an `approx: "1"` flag nobody sees until after they have
+# averaged it. Free was never the problem; a column you cannot do arithmetic on was.
+# Gone with it: `_ig_get`, `IG_APP_ID`, `IG_MEDIA_QUERY_HASH`, `_paginate`, `_posts_from_edges`,
+# `_profile_from_web_api`, `_OG_COUNTS`, `_loose_count`.
 
 def ig_handle(url):
     """The handle out of a profile URL (or a bare handle). '' when it is not one."""
@@ -90,25 +94,6 @@ def ig_handle(url):
     return re.sub(r"[^A-Za-z0-9._]", "", first)[:40]
 
 
-def _ig_get(url, headers=None, timeout=20.0):
-    """One anonymous GET with 429 backoff. Returns `(status, body_bytes, note)`."""
-    from automation_engine import PACE_SECONDS, Refused, fetch   # lazy — see the module header
-    delay = PACE_SECONDS
-    for attempt in range(IG_MAX_RETRIES + 1):
-        try:
-            status, _final, body = fetch(url, timeout=timeout, headers=headers, max_kb=4096)
-        except Refused:
-            raise
-        except Exception as e:                                    # noqa: BLE001
-            return 0, b"", f"{type(e).__name__}: {str(e)[:120]}"
-        if status == 429 and attempt < IG_MAX_RETRIES:
-            time.sleep(delay)
-            delay *= 2                       # exponential, never a tight retry
-            continue
-        return status, body, ""
-    return 429, b"", "rate limited after retries"
-
-
 def _ig_int(v):
     try:
         return int(v)
@@ -131,104 +116,6 @@ def _ig_zero_is_blank(v):
     return None if n == 0 else n
 
 
-def _profile_from_web_api(node, handle):
-    return {
-        "username": node.get("username") or handle,
-        "full_name": node.get("full_name") or "",
-        "bio": node.get("biography") or "",
-        "followers": _ig_int((node.get("edge_followed_by") or {}).get("count")),
-        "following": _ig_int((node.get("edge_follow") or {}).get("count")),
-        "posts_count": _ig_int((node.get("edge_owner_to_timeline_media") or {}).get("count")),
-        "verified": "1" if node.get("is_verified") else "",
-    }
-
-
-def _posts_from_edges(edges):
-    out = []
-    for e in edges or []:
-        n = (e or {}).get("node") or {}
-        code = n.get("shortcode")
-        if not code:
-            continue
-        caption = ""
-        for ce in ((n.get("edge_media_to_caption") or {}).get("edges") or []):
-            caption = ((ce or {}).get("node") or {}).get("text") or ""
-            break
-        ts = n.get("taken_at_timestamp")
-        out.append({
-            "shortcode": code,
-            "posted_at": (_dt.datetime.fromtimestamp(ts).strftime("%Y-%m-%d %H:%M")
-                          if isinstance(ts, (int, float)) else ""),
-            "type": ("video" if n.get("is_video") else
-                     "carousel" if n.get("__typename") == "GraphSidecar" else "image"),
-            "caption": caption,
-            "url": f"https://www.instagram.com/p/{code}/",
-            "likes": _ig_int((n.get("edge_liked_by") or n.get("edge_media_preview_like")
-                              or {}).get("count")),
-            "comments": _ig_int((n.get("edge_media_to_comment") or {}).get("count")),
-        })
-    return out
-
-
-_OG_COUNTS = re.compile(
-    r"([\d.,KMkm]+)\s+Followers?,\s*([\d.,KMkm]+)\s+Following,\s*([\d.,KMkm]+)\s+Posts?")
-
-
-def _loose_count(txt):
-    """'1.2M' / '12,345' -> int. IG's og:description abbreviates, so the snapshot is honest
-    about being approximate rather than pretending to a precision it does not have."""
-    t = str(txt or "").strip().replace(",", "")
-    mult = 1
-    if t[-1:].lower() == "k":
-        mult, t = 1_000, t[:-1]
-    elif t[-1:].lower() == "m":
-        mult, t = 1_000_000, t[:-1]
-    try:
-        return int(float(t) * mult)
-    except Exception:
-        return None
-
-# ---------------------------------------------------------------------------------------------
-# BRIGHT DATA — THE PAID RUNG (owner ruling R1 / wave-20 D-21, contract C4)
-# ---------------------------------------------------------------------------------------------
-# WHY A VENDOR AT ALL, stated once so nobody re-opens it: the anonymous ladder above is honest but
-# it is ALSO geographically fenced — Instagram blocks datacenter egress, so from the HF Space or a
-# Lambda the ladder degrades to `blocked` and the whole automation becomes a thing that only works
-# on the owner's desk. The vendor takes the egress risk, returns EXACT counts (not
-# og:description's "204K") and reaches post-level data the anonymous surface has closed.
-#
-# ⚠ WHY THIS VENDOR AND NOT THE PREVIOUS ONE. HikerAPI was crypto-only with no legal entity —
-# no invoice, no counterparty, nothing that can go on a subprocessor list at the EU/enterprise
-# gates. Bright Data is nameable, litigated Meta and won on logged-off public scraping, and runs
-# KYC. That is a POSTURE purchase, not a feature one; the price is ~2.5× and it is the right
-# trade. Full comparison: `.claude/wiki/research/instagram-capture.md` §2a.
-#
-# ⛔ THE FOUR RAILS TRANSFER UNCHANGED (contract C4 — they were written vendor-agnostic):
-#   1. **FAIL-CLOSED on the key.** No `AIOS_BRIGHTDATA_KEY` ⇒ this rung refuses with an honest
-#      blocked ATTEMPT and the anonymous ladder still runs. Never a crash, never a silent skip.
-#   2. **The key is never logged, never in a URL, never in an exception.** It travels in the
-#      `Authorization: Bearer` header only, and every error below quotes a STATUS, never the
-#      request. A secret that reaches a log line has leaked to everyone who can read logs.
-#   3. **The base URL is guarded like any other.** `AIOS_BRIGHTDATA_BASE` is env-provided, so it
-#      goes through the same SSRF rail — an env var pointed at the metadata endpoint would
-#      otherwise be a credential-bearing request to it.
-#   4. **A rung failure is a RUNG failure.** `bd_call` swallows its own `Refused`/transport
-#      errors, because `run_now` turns a `Refused` into a whole-run error — and a mistyped base
-#      URL must not kill a run whose anonymous rung would have answered.
-#   5. **Exact ⇒ NO `approx` TAG.** That tag is the anonymous rung's rounding disclosure.
-#
-# ⚠ THE KEY IS READ LAZILY, INSIDE THE CALL. A module-level snapshot would be taken at import,
-# which makes the "key absent ⇒ blocked, not crash" gate untestable (nothing could flip it between
-# checks) and would also mean a deploy that sets the secret after import silently has no key.
-#
-# ⛔ TWO SNAPSHOT NAMESPACES THAT 404 EACH OTHER (measured; the trap that costs an hour):
-#     the SCRAPER  `/datasets/v3/trigger` + `/v3/scrape`   -> `sd_…`   read at `/datasets/v3/…`
-#     the CORPUS   `/datasets/filter`  (⚠ NO `/v3/`)       -> `snap_…` read at `/datasets/…`
-# Cross them and you get a flat "404 Snapshot does not exist" about a snapshot that is alive.
-
-#: Pinned from live probes against `api.brightdata.com` (2026-08-04 and 2026-08-05) — see
-#: `.claude/wiki/research/instagram-capture.md` §2c/§2d for the recipe and its provenance tags.
-#: They live in ONE named block so a vendor rename is a one-line fix rather than a hunt.
 BD_BASE_DEFAULT = "https://api.brightdata.com"
 BD_DS_PROFILES = "gd_l1vikfch901nx3by4"       # Instagram – Profiles. 36 fields, 620M records
 BD_DS_POSTS = "gd_lk5ns7kz21pck8jpis"         # Instagram – Posts. 43 fields
@@ -1213,6 +1100,83 @@ def _tag_metric_deferrals(items, start, kind, influencer_key):
             item["requestedAt"] = _iso()
 
 
+def top_up_views(posts, log=print):
+    """Fill `views` on video posts from the `ig_post_views` capability. MUTATES `posts`; returns
+    a note for the run (`""` when there was nothing to do).
+
+    ⭐⭐ CAPABILITY ROUTING, NOT PROVIDER FAILOVER (owner ruling 2026-08-08, `providers.py`).
+    Bright Data answers profile + likes + comments and is declared INCAPABLE of `ig_post_views`,
+    so the chain for that ONE capability resolves to Apify and only the video permalinks are
+    re-bought. Re-running the whole profile on the second vendor would pay twice for the 90% that
+    already worked, which at thousands of tenants x twelve posts is the entire bill.
+
+    ⛔⛔ WHY THIS IS A FUNCTION AND NOT INLINE, which is the whole point of the 2026-08-09 fix.
+    It used to live inside `pull_profile_bd`'s post-metrics block, so it ran ONLY when the Posts
+    scrape answered within the wait budget. When that batch DEFERRED — routine, and the normal
+    outcome on a busy account — the posts came back through
+    `automation_engine.collect_pending_metric_snapshots` instead, which never called it. MEASURED
+    on nurilab's `theresalearns`: profile, 12 posts and 154 comments all landed, and **every
+    Views cell was blank**, because the deferred path never asked Apify at all. One capability,
+    two collection paths, one of them wired: the same shape as the `ig_profile` rung that was
+    declared and never called ([[flag-shipped-without-its-writer]]).
+    ⇒ ONE implementation, TWO callers. A copy in the collector would have been a second thing to
+    keep in step, and the two would drift on the next ruling.
+
+    ⚠ VIDEO ONLY. A carousel or image has no view count, so sending it would buy a record that
+    can only come back blank.
+    """
+    video_urls = [p["url"] for p in (posts or [])
+                  if p.get("type") == "video" and p.get("url")]
+    if not video_urls:
+        return ""
+
+    def _views_work(prov, _urls=tuple(video_urls)):
+        if prov.key == "apify":
+            return apify_posts(list(_urls))
+        # A provider in the chain with no runner here is a configuration error, not a vendor
+        # outage — say so rather than returning an empty list that reads as "the vendor had
+        # nothing".
+        return None, f"no {prov.key} runner is wired for ig_post_views"
+
+    got_views, attempts = providers.run(
+        "ig_post_views", _views_work,
+        # ⛔ THE SATISFIED PREDICATE IS THE FALLBACK TRIGGER. Rows that come back with every
+        # `views` blank are a FAILURE for this capability even at HTTP 200 — which is exactly how
+        # Bright Data behaves, and why a chain that only caught exceptions would never have
+        # reached a second provider.
+        satisfied=lambda rows: bool(rows) and any(r.get("views") for r in rows),
+        log=log)
+    for row in (got_views or []):
+        target = next((p for p in posts
+                       if p.get("shortcode") == row.get("shortcode")), None)
+        # ⛔ TAKE ONLY THE CAPABILITY THAT WAS ASKED FOR. This provider also returns
+        # likes/comments/caption, and letting them land would silently switch the source of
+        # columns Bright Data already answered — the schema would be stable but the PROVENANCE
+        # would flip halfway through a row.
+        if target and row.get("views") not in (None, ""):
+            target["views"] = row["views"]
+        # ⭐ LOCATION RIDES ALONG FOR FREE, AND ONLY INTO A GAP (2026-08-08).
+        # MEASURED: Bright Data's `location_details` is RICHER when present — it carries real
+        # coordinates (`lat -6.9246, lng 106.9292, name "Sukabumi"`) which Apify does not return
+        # at all — but it is populated on only 44 of 227 posts, and on `DblAkEbv0ry` it returned
+        # nothing while Apify returned "Jakarta, Indonesia". So Bright Data stays the source and
+        # this fills only what it left BLANK.
+        # ⛔ THE COST ARGUMENT IS WHY IT IS HERE AND NOT ITS OWN CAPABILITY: this Apify record has
+        # ALREADY been bought for the view count and carries `locationName` in the same payload.
+        # Routing location as a separate capability would buy a second record for a field that is
+        # already sitting in this response.
+        if target and not str(target.get("tagged_location") or "").strip() \
+                and str(row.get("tagged_location") or "").strip():
+            target["tagged_location"] = row["tagged_location"]
+    used = next((a.provider for a in attempts if a.ok), "")
+    if used:
+        return f"view counts via {used}"
+    if attempts:
+        return ("no provider could supply view counts: "
+                + "; ".join(f"{a.provider} {a.note}" for a in attempts))
+    return ""
+
+
 def pull_profile_bd(url, max_posts=None, post_metrics=False,
                     comment_metrics=False, log=print, pending_metrics=None,
                     pending_profile=None):
@@ -1380,61 +1344,7 @@ def pull_profile_bd(url, max_posts=None, post_metrics=False,
             elif metric_notes:
                 note = f"some post metrics were unavailable: {'; '.join(metric_notes)}"
 
-        # ⭐⭐ THE VIEWS TOP-UP — capability routing, not provider failover (owner ruling
-        # 2026-08-08, `providers.py`). Bright Data has already answered profile + likes + comments
-        # above and is declared INCAPABLE of `ig_post_views`, so the chain for that ONE capability
-        # resolves to Apify and only the video permalinks are re-bought. Re-running the whole
-        # profile on the second vendor would pay twice for the 90% that already worked, which at
-        # thousands of tenants x twelve posts is the entire bill.
-        # ⚠ VIDEO ONLY. A carousel or image has no view count, so sending it would buy a record
-        # that can only come back blank.
-        video_urls = [p["url"] for p in posts
-                      if p.get("type") == "video" and p.get("url")]
-        if video_urls:
-            def _views_work(prov, _urls=tuple(video_urls)):
-                if prov.key == "apify":
-                    return apify_posts(list(_urls))
-                # A provider in the chain with no runner here is a configuration error, not a
-                # vendor outage — say so rather than returning an empty list that reads as "the
-                # vendor had nothing".
-                return None, f"no {prov.key} runner is wired for ig_post_views"
-
-            got_views, attempts = providers.run(
-                "ig_post_views", _views_work,
-                # ⛔ THE SATISFIED PREDICATE IS THE FALLBACK TRIGGER. Rows that come back with
-                # every `views` blank are a FAILURE for this capability even at HTTP 200 — which
-                # is exactly how Bright Data behaves, and why a chain that only caught exceptions
-                # would never have reached a second provider.
-                satisfied=lambda rows: bool(rows) and any(r.get("views") for r in rows),
-                log=log)
-            for row in (got_views or []):
-                target = next((p for p in posts
-                               if p.get("shortcode") == row.get("shortcode")), None)
-                # ⛔ TAKE ONLY THE CAPABILITY THAT WAS ASKED FOR. This provider also returns
-                # likes/comments/caption, and letting them land would silently switch the source
-                # of columns Bright Data already answered — the schema would be stable but the
-                # PROVENANCE would flip halfway through a row.
-                if target and row.get("views") not in (None, ""):
-                    target["views"] = row["views"]
-                # ⭐ LOCATION RIDES ALONG FOR FREE, AND ONLY INTO A GAP (2026-08-08).
-                # MEASURED: Bright Data's `location_details` is RICHER when present — it carries
-                # real coordinates (`lat -6.9246, lng 106.9292, name "Sukabumi"`) which Apify does
-                # not return at all — but it is populated on only 44 of 227 posts, and on
-                # `DblAkEbv0ry` it returned nothing while Apify returned "Jakarta, Indonesia".
-                # So Bright Data stays the source and this fills only what it left BLANK.
-                # ⛔ THE COST ARGUMENT IS WHY IT IS HERE AND NOT ITS OWN CAPABILITY: this Apify
-                # record has ALREADY been bought for the view count and carries `locationName` in
-                # the same payload. Routing location as a separate capability would buy a second
-                # record for a field that is already sitting in this response.
-                if target and not str(target.get("tagged_location") or "").strip()                         and str(row.get("tagged_location") or "").strip():
-                    target["tagged_location"] = row["tagged_location"]
-            used = next((a.provider for a in attempts if a.ok), "")
-            if used:
-                note = "; ".join(x for x in (note, f"view counts via {used}") if x)
-            elif attempts:
-                note = "; ".join(x for x in (
-                    note, "no provider could supply view counts: "
-                          + "; ".join(f"{a.provider} {a.note}" for a in attempts)) if x)
+        note = "; ".join(x for x in (note, top_up_views(posts, log=log)) if x)
 
     # ⭐⭐ DEBT D-82 (owner ruling R12: *"price, then wire the Posts-dataset call so posts_count
     # fills with the true value"*). The Profiles dataset's `posts_count: 0` is discarded as the
@@ -1744,32 +1654,36 @@ def bd_filter_rows(snapshot_id):
     return rows, ""
 
 
-def pull_profile(url, max_posts=None, log=print, tier="anonymous",
-                 fallback=True,
+def pull_profile(url, max_posts=None, log=print,
                  post_metrics=False, comment_metrics=False, pending_metrics=None,
                  pending_profile=None):
-    """Everything readable about one public profile, cheapest-honest rung last.
+    """Everything readable about one public profile — EXACT NUMBERS OR NOTHING.
 
     Returns `{state, profile, posts, via, note}` with state ∈ ok | partial | blocked | error.
-    `partial` means the identity was read but the media was not — which is the outcome the
-    anonymous surface most often gives, and saying so is the point.
-
-    **RUNG 0 IS THE PAID ONE (R1's hybrid).** With `tier="brightdata"` the vendor is tried FIRST
-    and, when it answers, this returns exact counts with no `approx` tag. When it does not answer
-    the attempt is RECORDED and the anonymous ladder runs underneath it — that is what
-    "fail-closed on the key, and the anonymous rung still works" means in C4.
-
-    `fallback=False` turns that safety net off on purpose: it means *"exact numbers or nothing"*.
-    An influencer table where some rows are exact and some are `og:description` roundings, with
-    no way to tell them apart at a glance, is a table you cannot do arithmetic on — so a user who
-    needs the guarantee can have it, and gets an honest `blocked` instead of a quiet downgrade.
-    (The `source`/`approx` columns tell them apart anyway; this makes it impossible to forget.)
+    `partial` means the identity was read but the media was not.
+
+    ⭐⭐ WAVE 28 / OWNER RULING R5 — THE FREE ANONYMOUS LADDER IS RETIRED, AND THE REASON IS WHAT
+    IT PUT IN THE COLUMN, not what it cost. Two rungs used to sit under the paid one: Instagram's
+    own `web_profile_info` endpoint, and the profile HTML's `og:description`, which carries
+    "204K Followers, 5,245 Following, 750 Posts". That last one is the page's OWN ROUNDING, and it
+    landed in the same `followers` column as a measured 204,318, stamped `approx: "1"` — a flag
+    that tells you the number is an abbreviation only AFTER you have already averaged it, sorted
+    on it, or filtered a shortlist by it. A table where some rows are measurements and some are
+    the page's shorthand is a table you cannot do arithmetic on.
+    ⇒ A vendor refusal now returns `blocked` and the row KEEPS WHAT IT LAST KNEW, instead of being
+    overwritten with a rounder number. The user-facing tier/fallback choice is gone with the
+    rungs; there is one behaviour and it is this one.
+
+    ⛔ THIS IS STILL CAPABILITY ROUTING, NOT A SINGLE VENDOR. `ig_profile` is declared on Bright
+    Data AND Apify (`providers.py`), so a profile Bright Data cannot read is asked of Apify before
+    anything reports blocked. What was retired is the FREE approximate rung, not the second
+    opinion — the fallback that costs money and answers exactly is the one worth having.
 
     ⚠ `max_posts=None` means the default — see `pull_profile_bd` for why the constant cannot be
     named in the signature any more.
     """
     from automation_engine import (DEFAULT_POSTS_PER_PULL, PACE_SECONDS,  # lazy — module header
-                                   _s, clean_tier)
+                                   _s)
     max_posts = DEFAULT_POSTS_PER_PULL if max_posts is None else max_posts
     handle = ig_handle(url)
     if not handle:
@@ -1781,173 +1695,55 @@ def pull_profile(url, max_posts=None, log=print, tier="anonymous",
     # inferred from a mere failure, only from a vendor stating it.
     gone = ""
 
-    if clean_tier(tier) == "brightdata":
-        paid = pull_profile_bd(url, max_posts=max_posts, post_metrics=post_metrics,
-                               comment_metrics=comment_metrics, log=log,
-                               pending_metrics=pending_metrics,
-                               pending_profile=pending_profile)
-        if paid["state"] in ("ok", "partial"):
-            return paid
-        # ⚠ 200, NOT 90. This string is the ONLY account of what the vendor said, and at 90 the
-        # measured sentence truncated to *"…was not ready within"* — mid-clause, with the budget
-        # and the snapshot id cut off. A reason nobody can read is the reason being discarded
-        # with extra steps (D-103).
-        attempts.append(f"brightdata:{_s(paid.get('note'), 200)}")
-        # ⭐ THE APIFY RUNG (owner report 2026-08-09: "both Bright Data and Apify working in
-        # tandem"). `providers.py` has declared `ig_profile -> ("brightdata", "apify")` since
-        # 2026-08-08 and nothing ever walked it: Bright Data failing went straight to the
-        # anonymous rungs, past a configured provider declared capable of exactly this.
-        #
-        # ⚠ IT RUNS ONLY AFTER BRIGHT DATA HAS ACTUALLY FAILED, never as a top-up. Bright Data
-        # answers profile+likes+comments correctly and far more cheaply; re-buying a profile from
-        # a second vendor on every read is the expensive mistake the capability split exists to
-        # prevent. This is a fallback, and the `attempts` trail records that it was needed.
-        #
-        # ⚠ AND IT IS GATED ON `configured()`, not merely on being in the chain — an unconfigured
-        # provider must read as a rung that was never tried, not as one that refused.
-        if providers.PROVIDERS["apify"].can("ig_profile"):
-            a_prof, a_note = apify_profile(handle)
-            if a_prof and a_prof.get("followers") is not None:
-                log(f"  apify: profile ok ({a_prof.get('followers')} followers)")
-                return {"state": "ok", "profile": a_prof, "posts": [], "comments": [],
-                        "via": "apify",
-                        "note": ("Bright Data could not read this profile "
-                                 f"({_s(paid.get('note'), 90)}), so it came from Apify")}
-            # ⭐ A VENDOR SAYING *not found* IS THE ANSWER, NOT A FAILED ATTEMPT. Recorded here
-            # and carried to whichever return this walk reaches, so the run can say the one thing
-            # that ends the loop instead of the fourth variation on "we could not read it".
-            if a_note == ACCOUNT_GONE_NOTE:
-                gone = a_note
-            attempts.append(f"apify:{_s(a_note or 'answered without follower counts', 200)}")
-            time.sleep(PACE_SECONDS)
-        if not fallback:
-            return {"state": "blocked", "profile": {}, "posts": [], "comments": [],
-                    "via": "brightdata", "gone": bool(gone),
-                    "note": (gone + " (the anonymous fallback is turned off for this automation)"
-                             if gone else
-                             "the paid rungs did not answer and the anonymous fallback is turned "
-                             f"off for this automation ({'; '.join(attempts) or 'blocked'})")}
+    paid = pull_profile_bd(url, max_posts=max_posts, post_metrics=post_metrics,
+                           comment_metrics=comment_metrics, log=log,
+                           pending_metrics=pending_metrics,
+                           pending_profile=pending_profile)
+    if paid["state"] in ("ok", "partial"):
+        return paid
+    # ⚠ 200, NOT 90. This string is the ONLY account of what the vendor said, and at 90 the
+    # measured sentence truncated to *"…was not ready within"* — mid-clause, with the budget and
+    # the snapshot id cut off. A reason nobody can read is the reason being discarded with extra
+    # steps (D-103).
+    attempts.append(f"brightdata:{_s(paid.get('note'), 200)}")
+    # ⭐ THE APIFY RUNG (owner report 2026-08-09: "both Bright Data and Apify working in tandem").
+    # `providers.py` has declared `ig_profile -> ("brightdata", "apify")` since 2026-08-08 and
+    # nothing ever walked it: Bright Data failing went straight to the anonymous rungs, past a
+    # configured provider declared capable of exactly this.
+    #
+    # ⚠ IT RUNS ONLY AFTER BRIGHT DATA HAS ACTUALLY FAILED, never as a top-up. Bright Data answers
+    # profile+likes+comments correctly and far more cheaply; re-buying a profile from a second
+    # vendor on every read is the expensive mistake the capability split exists to prevent. This
+    # is a fallback, and the `attempts` trail records that it was needed.
+    #
+    # ⚠ AND IT IS GATED ON `configured()`, not merely on being in the chain — an unconfigured
+    # provider must read as a rung that was never tried, not as one that refused.
+    if providers.PROVIDERS["apify"].can("ig_profile"):
+        a_prof, a_note = apify_profile(handle)
+        if a_prof and a_prof.get("followers") is not None:
+            log(f"  apify: profile ok ({a_prof.get('followers')} followers)")
+            return {"state": "ok", "profile": a_prof, "posts": [], "comments": [],
+                    "via": "apify",
+                    "note": ("Bright Data could not read this profile "
+                             f"({_s(paid.get('note'), 90)}), so it came from Apify")}
+        # ⭐ A VENDOR SAYING *not found* IS THE ANSWER, NOT A FAILED ATTEMPT. Recorded here and
+        # carried to the return below, so the run can say the one thing that ends the loop
+        # instead of the fourth variation on "we could not read it".
+        if a_note == ACCOUNT_GONE_NOTE:
+            gone = a_note
+        attempts.append(f"apify:{_s(a_note or 'answered without follower counts', 200)}")
         time.sleep(PACE_SECONDS)
 
-    # RUNG 1 — the web client's own profile endpoint. Public, no cookie; the one that used to
-    # carry both the profile AND the first page of media in a single answer.
-    api = f"https://www.instagram.com/api/v1/users/web_profile_info/?username={handle}"
-    status, body, note = _ig_get(api, headers={
-        "X-IG-App-ID": IG_APP_ID, "Accept": "*/*",
-        "Referer": f"https://www.instagram.com/{handle}/"})
-    attempts.append(f"web_profile_info:{status or note}")
-    if 200 <= status < 300 and body:
-        try:
-            node = ((json.loads(body.decode("utf-8", "replace")) or {})
-                    .get("data") or {}).get("user") or {}
-        except Exception:
-            node = {}
-        if node:
-            profile = _profile_from_web_api(node, handle)
-            media = node.get("edge_owner_to_timeline_media") or {}
-            posts = _posts_from_edges(media.get("edges"))[:max_posts]
-            page = media.get("page_info") or {}
-            if page.get("has_next_page") and page.get("end_cursor") and len(posts) < max_posts:
-                more, pnote = _paginate(node.get("id"), page.get("end_cursor"),
-                                        max_posts - len(posts), log)
-                posts.extend(more)
-                if pnote:
-                    attempts.append(pnote)
-            state = "ok" if posts else "partial"
-            return {"state": state, "profile": profile, "posts": posts,
-                    "via": "web_profile_info",
-                    "note": "" if posts else "profile read; media edges empty ("
-                                             + ", ".join(attempts) + ")"}
-
-    time.sleep(PACE_SECONDS)
-
-    # RUNG 2 — the profile HTML. Its og:description carries the three counts even when every
-    # JSON surface refuses, so it is the honest floor: identity without media.
-    status, body, note = _ig_get(f"https://www.instagram.com/{handle}/")
-    attempts.append(f"html:{status or note}")
-    if 200 <= status < 300 and body:
-        text = body.decode("utf-8", "replace")
-        if "/accounts/login" in text[:4000] and "og:description" not in text:
-            return {"state": "blocked", "profile": {}, "posts": [], "via": "html",
-                    "note": "Instagram served the login wall (" + ", ".join(attempts) + ")"}
-        desc = ""
-        m = re.search(r'<meta[^>]+property="og:description"[^>]+content="([^"]*)"', text)
-        if m:
-            desc = m.group(1)
-        counts = _OG_COUNTS.search(desc or "")
-        title = ""
-        mt = re.search(r'<meta[^>]+property="og:title"[^>]+content="([^"]*)"', text)
-        if mt:
-            title = mt.group(1)
-        if counts:
-            profile = {
-                "username": handle, "full_name": title.split("(")[0].strip(),
-                # ⚠ NO BIO. `og:description` on a profile page is
-                # "204K Followers, 5,245 Following, 750 Posts - See Instagram photos and videos
-                # from Inayma (@inayma)" — the tail is Instagram's own boilerplate, not the
-                # person's biography. Storing it would fill a Bio column with the same sentence
-                # for every influencer, which reads as data and is not. Measured 2026-08-04.
-                "bio": "",
-                "followers": _loose_count(counts.group(1)),
-                "following": _loose_count(counts.group(2)),
-                "posts_count": _loose_count(counts.group(3)),
-                "verified": "",
-                # The page abbreviates ("204K"), so the number is the page's rounding, not a
-                # count we read. Recorded on the row rather than left for someone to discover
-                # when 204,000 fails to reconcile with anything.
-                "approx": "1",
-            }
-            return {"state": "partial", "profile": profile, "posts": [], "via": "og:description",
-                    "note": "counts are the page's own abbreviations; media is not anonymously "
-                            "readable (" + ", ".join(attempts) + ")"}
-    # ⭐⭐ THE DEFINITIVE ANSWER WINS OVER THE LAST RUNG'S SHRUG. If a vendor said the account does
-    # not exist and the free rungs then also found nothing, the honest report is *"this account
-    # does not exist"* — not *"nothing anonymously readable"*, which is a statement about US.
-    # ⚠ It is checked HERE, after the free rungs have run, and not as an early return: an
-    # anonymous read that DOES succeed above proves the vendor wrong and returns `ok`/`partial`
-    # on its own. A vendor's not-found is strong evidence, never a reason to stop looking.
-    if gone:
-        return {"state": "blocked", "profile": {}, "posts": [], "via": "", "gone": True,
-                "note": f"{gone}. Nothing else could read it either ({', '.join(attempts)})"}
-    if status in (401, 403, 429) or status == 0:
-        return {"state": "blocked", "profile": {}, "posts": [], "via": "",
-                "note": f"Instagram refused the anonymous read ({', '.join(attempts)})"}
-    return {"state": "error", "profile": {}, "posts": [], "via": "",
-            "note": f"nothing anonymously readable ({', '.join(attempts)})"}
-
-
-#: The historical anonymous media query. Kept because trying it and RECORDING the refusal is
-#: what makes "as deep as anonymously accessible" (R7) a measurement instead of an assumption.
-IG_MEDIA_QUERY_HASH = "e769aa130647d2354c40ea6a439bfc08"
-
-
-def _paginate(user_id, cursor, want, log=print):
-    """Walk further back through the media edges while the anonymous surface allows it."""
-    from automation_engine import PACE_SECONDS                   # lazy — see the module header
-    out, note = [], ""
-    while user_id and cursor and len(out) < want:
-        time.sleep(PACE_SECONDS)
-        variables = json.dumps({"id": str(user_id), "first": min(50, want - len(out)),
-                                "after": cursor}, separators=(",", ":"))
-        url = (f"https://www.instagram.com/graphql/query/?query_hash={IG_MEDIA_QUERY_HASH}"
-               f"&variables={requests.utils.quote(variables)}")
-        status, body, err = _ig_get(url, headers={"X-IG-App-ID": IG_APP_ID})
-        if not (200 <= status < 300) or not body:
-            note = f"graphql:{status or err}"
-            break
-        try:
-            media = (((json.loads(body.decode("utf-8", "replace")) or {}).get("data") or {})
-                     .get("user") or {}).get("edge_owner_to_timeline_media") or {}
-        except Exception:
-            note = "graphql:unparseable"
-            break
-        edges = media.get("edges") or []
-        if not edges:
-            note = "graphql:empty"
-            break
-        out.extend(_posts_from_edges(edges))
-        page = media.get("page_info") or {}
-        if not page.get("has_next_page"):
-            break
-        cursor = page.get("end_cursor")
-    return out[:want], note
+    # ⛔⛔ THE END OF THE WALK (R5). There were two more rungs here — `web_profile_info` and the
+    # profile HTML's `og:description` — and they are DELETED, not disabled. What they returned was
+    # a `partial` carrying `approx: "1"` and counts rounded by Instagram's own page furniture; the
+    # docstring says why that is worse than nothing. `blocked` keeps the row's last real values.
+    # ⚠ `via` STAYS "brightdata" on this path rather than "" — it names the chain that was walked,
+    # which is what a person reading a blocked row needs in order to know who to ask.
+    return {"state": "blocked", "profile": {}, "posts": [], "comments": [],
+            "via": "brightdata", "gone": bool(gone),
+            "note": (gone if gone else
+                     "no provider could read this profile "
+                     f"({'; '.join(attempts) or 'blocked'})")}
+
+

api/odoo_relational.py

@@ -54,11 +54,29 @@ INVOICES_KEY = "ut_odoo_invoices"
 CUSTOMERS_KEY = "ut_odoo_customers"
 ORDERS_KEY = "ut_odoo_orders"
 PRODUCTS_KEY = "ut_odoo_products"
+#: ⭐ WAVE 28 (owner R1): *"ALL of Unique ID in Odoo is a database e.g. Customers/Products/Agents,
+#: etc. Including expenses and GL codes."* Four more DOCUMENT/REGISTRY grains, each measured to
+#: fit far inside `MAX_ROWS` (19 / 192 / 6,538 / 393 against 60,000).
+#: ⛔ THE LINE GRAINS ARE DELIBERATELY NOT HERE and this is R2, not an omission: 256,810 order
+#: lines, 154,917 expense GL lines and 311,140 commission lines cannot live in a `ut_*` document
+#: at any cap (63.9 MB / 2.57 s per copy for the order lines alone). "Expenses" as a BROWSABLE
+#: LEDGER is a read-through mirror grid; "expenses" as a NUMBER is a rollup on the GL account row.
+AGENTS_KEY = "ut_odoo_agents"
+ACCOUNTS_KEY = "ut_odoo_accounts"
+BILLS_KEY = "ut_odoo_bills"
+VENDORS_KEY = "ut_odoo_vendors"
 
 #: The join column the partner-grain tables carry. Derived links resolve through it (`on`/`from`).
 JOIN_KEY = "partner_id"
 #: The product-grain equivalent.
 PRODUCT_JOIN_KEY = "product_id"
+#: ⚠ AN AGENT IS A `res.partner`, so its id shares the partner namespace with a customer's — but
+#: it is a DIFFERENT COLUMN on the customer row (`agent_id`, the customer's assigned agent) and the
+#: two must never be joined through `JOIN_KEY`, which would link every customer to itself.
+AGENT_JOIN_KEY = "agent_id"
+#: A vendor is also a `res.partner`; same reasoning, its own column.
+VENDOR_JOIN_KEY = "vendor_id"
+ACCOUNT_JOIN_KEY = "account_code"
 
 #: The oracle's own predicate — `modules/ar._open_docs`, copied rather than re-derived so the two
 #: cannot drift. It now selects a SUBSET of the invoices table rather than defining it.
@@ -119,6 +137,134 @@ def _refreshed_field():
             "default": False, "description": "When this row was last reconciled against Odoo."}
 
 
+def agent_fields():
+    """One row per SALES AGENT, keyed on the `res.partner` id.
+
+    ⭐ THE POPULATION IS A UNION OF TWO DISAGREEING SOURCES, and the disagreement is the reason it
+    is a union rather than a pick. MEASURED 2026-08-09: 16 partners carry commission lines, 17
+    carry `res_partner.agent = TRUE`, and the union is 19 — so **2 agents earn commission without
+    the flag and 3 are flagged with no commission yet**. Either source alone silently drops real
+    agents. Same shape as `read_customers`' two document universes, for the same reason.
+    """
+    return [_preset(f) for f in (
+        {"key": "agent", "label": "Agent", "type": "text", "source": "overlay",
+         "default": True, "pinned": True},
+        {"key": "odoo_id", "label": "Odoo ID", "type": "int", "source": "overlay",
+         "default": False, "description": "The `res.partner` id. Also this row's id."},
+        {"key": AGENT_JOIN_KEY, "label": "Odoo agent id", "type": "int", "source": "overlay",
+         "default": False},
+        {"key": "flagged", "label": "Flagged in Odoo", "type": "checkbox", "source": "overlay",
+         "default": True,
+         "description": "Ticked = `res.partner.agent` is set. Unticked agents were found by "
+                        "their commission lines instead - both are real, which is why this "
+                        "table is the union of the two."},
+        {"key": "commissioned", "label": "Has commission lines", "type": "checkbox",
+         "source": "overlay", "default": True},
+        # ⭐ THE INVERSE HALF: the customers whose `agent_id` names this agent. MEASURED: 2,093
+        # customers carry one and ALL 2,093 resolve to a row in this table (zero dangling).
+        {"key": "customers", "label": "Customers", "type": "link", "source": "overlay",
+         "default": True,
+         "link": {"table": CUSTOMERS_KEY, "on": AGENT_JOIN_KEY, "from": AGENT_JOIN_KEY}},
+        _refreshed_field(),
+    )]
+
+
+def account_fields():
+    """One row per `account.account` — the GL chart, the owner's "GL codes".
+
+    ⚠ NO LINK COLUMN, and that is a finding rather than an omission. A GL account meets the rest
+    of this schema only at LINE grain (963,783 `account_move_line` rows, 154,917 of them on
+    expense-type accounts), and a `ut_*` link folds rows that live in the store. The honest
+    binding is a read-through rollup naming a governed topic, or the mirror grid (R2) — never a
+    link into a table that does not exist. Declaring one here would render a permanently blank
+    column, which is the exact trap D-87 warns about from the value site.
+    """
+    return [_preset(f) for f in (
+        {"key": "account_code", "label": "Code", "type": "text", "source": "overlay",
+         "default": True, "pinned": True},
+        {"key": "account_name", "label": "Account", "type": "text", "source": "overlay",
+         "default": True},
+        {"key": "odoo_id", "label": "Odoo ID", "type": "int", "source": "overlay",
+         "default": False, "description": "The `account.account` id. Also this row's id."},
+        # ⚠ 15 DISTINCT VALUES MEASURED IN THE MIRROR, all declared. A `select` storing a value its
+        # options omit is wave-26 item 24: the filter panel answers with a list that cannot match
+        # what is stored.
+        {"key": "account_type", "label": "Type", "type": "select", "source": "overlay",
+         "default": True,
+         "options": ["expense", "expense_direct_cost", "expense_depreciation", "income",
+                     "income_other", "asset_cash", "asset_current", "asset_receivable",
+                     "asset_fixed", "asset_non_current", "asset_prepayments",
+                     "liability_current", "liability_payable", "liability_credit_card",
+                     "liability_non_current", "equity", "equity_unaffected", "off_balance"]},
+        {"key": "is_expense", "label": "Expense account", "type": "checkbox", "source": "overlay",
+         "default": True,
+         "description": "Ticked for the expense family - the same predicate the semantic layer's "
+                        "gl_lines topic uses, so this column and that topic cannot disagree."},
+        _refreshed_field(),
+    )]
+
+
+def vendor_fields():
+    """One row per partner we have POSTED a vendor bill to, keyed on the `res.partner` id.
+
+    ⚠ A VENDOR IS NOT A CUSTOMER TABLE ROW, even though both are `res.partner`. MEASURED: 393
+    vendors, of which only 9 also appear in the customer population. Pointing bills at
+    `ut_odoo_customers` would have dangled 384 of 393 links — the failure would have been a mostly
+    empty column, not an error.
+    """
+    return [_preset(f) for f in (
+        {"key": "vendor", "label": "Vendor", "type": "text", "source": "overlay",
+         "default": True, "pinned": True},
+        {"key": "odoo_id", "label": "Odoo ID", "type": "int", "source": "overlay",
+         "default": False, "description": "The `res.partner` id. Also this row's id."},
+        {"key": VENDOR_JOIN_KEY, "label": "Odoo vendor id", "type": "int", "source": "overlay",
+         "default": False},
+        {"key": "country", "label": "Country", "type": "text", "source": "overlay",
+         "default": True},
+        {"key": "bills", "label": "Bills", "type": "link", "source": "overlay", "default": True,
+         "link": {"table": BILLS_KEY, "on": VENDOR_JOIN_KEY, "from": VENDOR_JOIN_KEY}},
+        _refreshed_field(),
+    )]
+
+
+def bill_fields():
+    """One row per POSTED vendor bill or refund — the owner's "expenses", at DOCUMENT grain.
+
+    ⚠ DOCUMENT GRAIN IS A CHOICE AND IT IS THE ONLY ONE THAT FITS: 6,538 bills against 154,917
+    expense GL lines. What a person calls "expenses" is both, and they are different tables - the
+    bill is what you pay, the line is what it was coded to. This is the payable; the line ledger
+    is the read-through mirror grid (R2).
+    """
+    return [_preset(f) for f in (
+        {"key": "bill_no", "label": "Bill", "type": "text", "source": "overlay",
+         "default": True, "pinned": True},
+        {"key": "odoo_id", "label": "Odoo ID", "type": "int", "source": "overlay",
+         "default": False, "description": "The `account.move` id. Also this row's id."},
+        {"key": "vendor", "label": "Vendor", "type": "text", "source": "overlay", "default": True},
+        {"key": VENDOR_JOIN_KEY, "label": "Odoo vendor id", "type": "int", "source": "overlay",
+         "default": False},
+        {"key": "invoice_date", "label": "Bill date", "type": "date", "source": "overlay",
+         "default": True},
+        {"key": "due_date", "label": "Due date", "type": "date", "source": "overlay",
+         "default": True},
+        # ⚠ SIGNED, like the customer side: Odoo's `_signed` fields already carry the refund's
+        # direction, so a refund reduces a total without anybody re-deriving a sign here.
+        {"key": "amount_untaxed", "label": "Billed $", "type": "currency", "source": "overlay",
+         "default": True, "agg": "sum"},
+        {"key": "residual", "label": "Outstanding $", "type": "currency", "source": "overlay",
+         "default": True, "agg": "sum"},
+        {"key": "payment_state", "label": "Payment state", "type": "select", "source": "overlay",
+         "default": True,
+         "options": ["not_paid", "partial", "in_payment", "paid", "reversed"]},
+        {"key": "move_type", "label": "Document", "type": "select", "source": "overlay",
+         "default": False, "options": ["in_invoice", "in_refund"]},
+        {"key": "vendor_link", "label": "Vendor record", "type": "link", "source": "overlay",
+         "default": False,
+         "link": {"table": VENDORS_KEY, "on": VENDOR_JOIN_KEY, "from": VENDOR_JOIN_KEY}},
+        _refreshed_field(),
+    )]
+
+
 def invoice_fields():
     """One row per POSTED customer invoice or refund — the full history, not just what is open."""
     return [_preset(f) for f in (
@@ -155,6 +301,19 @@ def invoice_fields():
         {"key": "customer_link", "label": "Customer record", "type": "link", "source": "overlay",
          "default": False,
          "link": {"table": CUSTOMERS_KEY, "on": JOIN_KEY, "from": JOIN_KEY}},
+        # ⭐ DEBT D-88, closed 2026-08-09. `invoice_origin` carries the ORDER NAME an invoice was
+        # raised from, and the mirror did not sync it until this wave — so order->invoice was a
+        # two-hop join through 963,783 `account_move_line` rows and wave 27 shipped no link at all.
+        # ⚠ IT IS A NAME, NOT AN ID, and Odoo writes free text there (a manual invoice can hold
+        # anything; a merged one can hold several origins space-separated). The link resolves
+        # against `order_no` and finds nothing when the text is not an order name — the honest
+        # outcome, and the reason this is a join HINT rather than a foreign key.
+        {"key": "origin_order", "label": "Source order", "type": "text", "source": "overlay",
+         "default": False,
+         "description": "Odoo's `invoice_origin` - usually the order name, sometimes blank."},
+        {"key": "order_link", "label": "Order record", "type": "link", "source": "overlay",
+         "default": False,
+         "link": {"table": ORDERS_KEY, "on": "order_no", "from": "origin_order"}},
         _refreshed_field(),
     )]
 
@@ -184,6 +343,11 @@ def order_fields():
         {"key": "customer_link", "label": "Customer record", "type": "link", "source": "overlay",
          "default": False,
          "link": {"table": CUSTOMERS_KEY, "on": JOIN_KEY, "from": JOIN_KEY}},
+        # The reciprocal of the invoice's `order_link` (D-88): the invoices raised from THIS
+        # order, matched on the order's own name.
+        {"key": "invoices", "label": "Invoices", "type": "link", "source": "overlay",
+         "default": True,
+         "link": {"table": INVOICES_KEY, "on": "origin_order", "from": "order_no"}},
         _refreshed_field(),
     )]
 
@@ -268,6 +432,12 @@ def customer_fields():
          "default": True,
          "description": "The customer's assigned agent (res.partner.agent_ids[0] — the "
                         "Customers-module convention)."},
+        # ⭐ WAVE 28 — the agent's ID beside its NAME, because a link joins on an id and this
+        # table carried only the display string. ⚠ It is `agent_id`, NEVER `partner_id`: both are
+        # `res.partner` ids, and joining agents through `JOIN_KEY` would link every customer to
+        # itself and look plausible doing it.
+        {"key": AGENT_JOIN_KEY, "label": "Odoo agent id", "type": "int", "source": "overlay",
+         "default": False},
         _scope_field(),
 
         # --- the relations -------------------------------------------------------------------
@@ -277,6 +447,11 @@ def customer_fields():
         {"key": "orders", "label": "Orders", "type": "link", "source": "overlay",
          "default": True,
          "link": {"table": ORDERS_KEY, "on": JOIN_KEY, "from": JOIN_KEY}},
+        # MEASURED: 2,093 customers carry an `agent_id` and all 2,093 resolve to a row in the
+        # agents table — zero dangling, which is why this ships as a link rather than a lookup.
+        {"key": "agent_link", "label": "Agent record", "type": "link", "source": "overlay",
+         "default": False,
+         "link": {"table": AGENTS_KEY, "on": AGENT_JOIN_KEY, "from": AGENT_JOIN_KEY}},
 
         # --- link rollups over the invoice history --------------------------------------------
         # ⭐ NO CONDITION, and that is measured rather than assumed: a settled document's residual
@@ -437,12 +612,19 @@ def read_invoices(cur, excluded=None, open_only=False):
     """
     excluded = excluded if excluded is not None else excluded_ids(cur)
     where = _AR_WHERE if open_only else _POSTED_DOCS
+    # ⚠ `invoice_origin` (D-88) is read through `_col` DELIBERATELY. It was added to `ENTITIES` in
+    # this same wave, so a Space whose mirror is still hydrating from a pre-wave seed snapshot does
+    # not have the column yet — and DuckDB answers a missing identifier with a Binder error that
+    # reaches the operator as a bare 500. This is the exact class `columns()` was written for: the
+    # link degrades to blank for one sync cycle instead of refusing the whole spawn.
+    have = columns(cur, "account_move")
     sql = ("SELECT id, name, partner_id, partner_name, invoice_date, invoice_date_due, "
-           "       amount_untaxed_signed, amount_residual_signed, payment_state, move_type "
+           "       amount_untaxed_signed, amount_residual_signed, payment_state, move_type, "
+           f"       {_col(have, 'invoice_origin', chr(39) + chr(39))} "
            f"FROM account_move WHERE {where} AND partner_id IS NOT NULL")
     out = []
     for r in cur.execute(sql).fetchall():
-        (mid, name, pid, pname, inv_date, due, untaxed, residual, pay_state, mtype) = r
+        (mid, name, pid, pname, inv_date, due, untaxed, residual, pay_state, mtype, origin) = r
         scope = _in_scope(pid, excluded)
         if open_only and not scope:
             continue
@@ -458,6 +640,7 @@ def read_invoices(cur, excluded=None, open_only=False):
             "amount_untaxed": float(untaxed or 0.0),
             "payment_state": str(pay_state or ""),
             "move_type": str(mtype or ""),
+            "origin_order": str(origin or "").strip(),
             "wholesale_scope": scope,
         })
     return out
@@ -547,9 +730,10 @@ def read_customers(cur, excluded=None):
     # ⚠ THE AGENT JOIN IS DROPPED WHOLE when `agent_id` is absent, not merely NULL-ed: the join
     # itself names the column, so `_col` on the SELECT list alone would still fail to bind.
     agent = ("ag.name" if "agent_id" in have else "NULL")
+    agent_id_col = ("p.agent_id" if "agent_id" in have else "NULL")
     join = ("LEFT JOIN res_partner ag ON ag.id = p.agent_id " if "agent_id" in have else "")
     sql = (f"SELECT p.id, p.name, {_col(have, 'p.city')}, {_col(have, 'p.state_name')}, "
-           f"       {_col(have, 'p.country_name')}, {agent} "
+           f"       {_col(have, 'p.country_name')}, {agent}, {agent_id_col} "
            "FROM res_partner p "
            f"{join}"
            "WHERE p.id IN ("
@@ -559,7 +743,7 @@ def read_customers(cur, excluded=None):
            f"  WHERE {_POSTED_DOCS} AND partner_id IS NOT NULL)")
     out = []
     for r in cur.execute(sql).fetchall():
-        (pid, name, city, state, country, agent) = r
+        (pid, name, city, state, country, agent, agent_id) = r
         out.append({
             "_id": str(pid),
             "customer": str(name or ""),
@@ -568,11 +752,146 @@ def read_customers(cur, excluded=None):
             "state": str(state or ""),
             "country": str(country or ""),
             "agent": str(agent or ""),
+            AGENT_JOIN_KEY: int(agent_id) if agent_id else "",
             "wholesale_scope": _in_scope(pid, excluded),
         })
     return out
 
 
+def read_agents(cur):
+    """[(row dict)] — the UNION of both agent sources, keyed on the `res.partner` id.
+
+    ⛔ `res_partner.agent` is a BOOLEAN and `datastore.BOOL_FIELDS` lists it for a measured reason:
+    Odoo returns False both for "empty" and for "boolean false", so a bool missing from that list
+    silently becomes NULL and every row would read "not an agent" indistinguishably from
+    "unknown". Read it as a truth value, never as a presence test.
+    """
+    have = columns(cur, "res_partner")
+    if "id" not in have:
+        return []
+    flagged = "p.agent" if "agent" in have else "FALSE"
+    # ⛔⛔ THE COMMISSION TABLE IS GUARDED AS A **TABLE**, not just as a column, and that
+    # distinction is the whole point of this block. `columns()` was written for a missing COLUMN
+    # (a backfill that has not run yet); `account_invoice_line_agent` is an OCA module entity that
+    # a mirror hydrated from an older seed snapshot may not have AT ALL. A SELECT naming an absent
+    # table is a DuckDB Binder error, and this reader runs inside `plan()` — so one missing table
+    # would fail the WHOLE eight-table spawn and reach the operator as a bare 500. That is
+    # precisely D-107's shape, and it would have arrived on the first deploy of this feature.
+    # ⚠ DEGRADE, NEVER REFUSE, which is the posture `columns()`'s own docstring sets: without the
+    # commission table the population falls back to the FLAGGED partners alone and `commissioned`
+    # reads blank for every row — fewer agents and an honestly empty column, rather than no spawn.
+    has_comm = bool(columns(cur, "account_invoice_line_agent"))
+    commissioned = ("(p.id IN (SELECT agent_id FROM account_invoice_line_agent "
+                    "          WHERE agent_id IS NOT NULL))" if has_comm else "FALSE")
+    union_leg = ("  SELECT agent_id FROM account_invoice_line_agent WHERE agent_id IS NOT NULL "
+                 "  UNION " if has_comm else "")
+    sql = (f"SELECT p.id, p.name, {flagged}, {commissioned} AS commissioned "
+           "FROM res_partner p WHERE p.id IN ("
+           f"{union_leg}SELECT id FROM res_partner WHERE {flagged})")
+    out = []
+    for (aid, name, flag, comm) in cur.execute(sql).fetchall():
+        out.append({
+            "_id": str(aid),
+            "agent": str(name or ""),
+            "odoo_id": int(aid),
+            AGENT_JOIN_KEY: int(aid),
+            "flagged": "1" if flag else "",
+            "commissioned": "1" if comm else "",
+        })
+    return out
+
+
+def read_accounts(cur):
+    """[(row dict)] — the whole GL chart, keyed on the `account.account` id.
+
+    ⚠ THE EXPENSE PREDICATE IS THE SEMANTIC LAYER'S, copied rather than invented:
+    `harness/semantic.py`'s `gl_lines` topic scopes expenses as
+    `account_type in ('expense','expense_depreciation')`. A second definition here is how a
+    column and a topic start disagreeing about the same word.
+    ⛔ `account.account` has NO `active` column in this Odoo version (a domain naming it 500s), so
+    there is nothing to filter and every account is a row.
+    """
+    have = columns(cur, "account_account")
+    if not have:
+        return []
+    sql = (f"SELECT id, {_col(have, 'code', chr(39) + chr(39))}, "
+           f"       {_col(have, 'name', chr(39) + chr(39))}, "
+           f"       {_col(have, 'account_type', chr(39) + chr(39))} FROM account_account")
+    out = []
+    for (aid, code, name, atype) in cur.execute(sql).fetchall():
+        t = str(atype or "")
+        out.append({
+            "_id": str(aid),
+            ACCOUNT_JOIN_KEY: str(code or ""),
+            "account_name": str(name or ""),
+            "odoo_id": int(aid),
+            "account_type": t,
+            "is_expense": "1" if t in ("expense", "expense_depreciation") else "",
+        })
+    return out
+
+
+_VENDOR_DOCS = "state = 'posted' AND move_type IN ('in_invoice','in_refund')"
+
+
+def read_bills(cur):
+    """[(row dict)] — posted vendor bills and refunds, keyed on the `account.move` id."""
+    have = columns(cur, "account_move")
+    if not have:
+        return []
+    sql = ("SELECT id, name, partner_id, partner_name, invoice_date, invoice_date_due, "
+           f"       {_col(have, 'amount_untaxed_signed', '0')}, "
+           f"       {_col(have, 'amount_residual_signed', '0')}, "
+           f"       {_col(have, 'payment_state', chr(39) + chr(39))}, move_type "
+           f"FROM account_move WHERE {_VENDOR_DOCS} AND partner_id IS NOT NULL")
+    out = []
+    for r in cur.execute(sql).fetchall():
+        (mid, name, pid, pname, when, due, untaxed, residual, pay, mtype) = r
+        out.append({
+            "_id": str(mid),
+            "bill_no": str(name or ""),
+            "odoo_id": int(mid),
+            "vendor": str(pname or ""),
+            VENDOR_JOIN_KEY: int(pid),
+            "invoice_date": _as_date(when),
+            "due_date": _as_date(due),
+            "amount_untaxed": float(untaxed or 0.0),
+            "residual": float(residual or 0.0),
+            "payment_state": str(pay or ""),
+            "move_type": str(mtype or ""),
+        })
+    return out
+
+
+def read_vendors(cur):
+    """[(row dict)] — every partner carrying a posted vendor bill, keyed on the `res.partner` id.
+
+    ⚠ DERIVED FROM THE BILLS, unlike `read_customers` which is deliberately NOT derived from its
+    invoices. The asymmetry is intentional and the reason is what that function's own comment
+    says: a customer registry sourced from receivables is what kept most Odoo ids out of the store.
+    There is no second document universe for vendors — a partner with no bill has no payable
+    history to show — so the bill IS the population, and MEASURED it dangles nothing (0 bills
+    carry a null partner; all 393 vendors resolve in `res_partner`).
+    """
+    have = columns(cur, "res_partner")
+    if not have or not columns(cur, "account_move"):
+        return []
+    sql = (f"SELECT p.id, p.name, {_col(have, 'p.country_name', chr(39) + chr(39))} "
+           "FROM res_partner p WHERE p.id IN "
+           f"  (SELECT partner_id FROM account_move WHERE {_VENDOR_DOCS} "
+           "    AND partner_id IS NOT NULL)")
+    out = []
+    for (pid, name, country) in cur.execute(sql).fetchall():
+        out.append({
+            "_id": str(pid),
+            "vendor": str(name or ""),
+            "odoo_id": int(pid),
+            VENDOR_JOIN_KEY: int(pid),
+            "country": str(country or ""),
+        })
+    return out
+
+
 def customers_from(invoice_rows):
     """The partners carrying the given invoice rows — the pre-2026-08-09 population builder.
 
@@ -608,6 +927,13 @@ TABLES = (
     ("products", PRODUCTS_KEY, "Odoo products", product_fields),
     ("invoices", INVOICES_KEY, "Odoo invoices", invoice_fields),
     ("orders", ORDERS_KEY, "Odoo orders", order_fields),
+    # ⭐ WAVE 28 / R1. Measured populations: 19 / 192 / 6,538 / 393 — every one of them two orders
+    # of magnitude inside `MAX_ROWS`, which is why the answer to "every unique id is a database"
+    # is four more spec rows and four readers rather than a new substrate.
+    ("agents", AGENTS_KEY, "Odoo agents", agent_fields),
+    ("accounts", ACCOUNTS_KEY, "Odoo GL accounts", account_fields),
+    ("vendors", VENDORS_KEY, "Odoo vendors", vendor_fields),
+    ("bills", BILLS_KEY, "Odoo vendor bills", bill_fields),
 )
 
 
@@ -631,6 +957,10 @@ def plan(cur, rt=None):
         "products": read_products(cur),
         "invoices": read_invoices(cur, excluded=excluded),
         "orders": read_orders(cur, excluded=excluded),
+        "agents": read_agents(cur),
+        "accounts": read_accounts(cur),
+        "vendors": read_vendors(cur),
+        "bills": read_bills(cur),
     }
     problems = []
 

api/routes_tables.py

@@ -842,5 +842,29 @@ def patch_row(table_key: str, pid: int, body: dict = Body(default=None),
     cleared = sorted(k for k in also if k in _ut().PROFILE_PRESET_KEYS)
     if cleared:
         out["cleared"] = cleared
+    # ⭐⭐ R9's SECOND RE-ARM DOOR — the one call that makes `engine.clear_gone` live (wave 28,
+    # amendment A5; SESSION B built and gated the function and correctly declared it INERT until
+    # this line existed, citing [[flag-shipped-without-its-writer]]).
+    #
+    # ⛔ R9 makes a `not_found` handle a TOMBSTONE, not a 30-day backoff: nothing re-buys a dead
+    # account on a timer any more. Door 1 — correcting the handle — needs no wiring, because the
+    # verdict is keyed on `(platform, handle)` and a corrected handle simply is not the verdict we
+    # recorded. THIS is door 2: a human re-typing the SAME handle, which is how somebody says "try
+    # it again, the account is back". Without this call that person has no way back at all, and
+    # the failure costs nothing and raises nothing — so no spend-shaped test would ever find it.
+    #
+    # ⚠ GATED ON `updates`, NOT ON `accepted`: re-typing the identical value is the whole case this
+    # door exists for, and a no-op write can be filtered out of `accepted`. What matters is that a
+    # human touched the handle cell.
+    # ⚠ NOT a bare `except: pass`. A swallowed AttributeError here would be exactly the optional-
+    # prop silence this wiring exists to prevent — if the engine ever loses `clear_gone`, that must
+    # be readable in the log rather than degrade into "the re-arm quietly stopped working".
+    _pf = _ut().profile_field(table_key, st=session.runtime)
+    if _pf and _pf["key"] in updates:
+        try:
+            import automation_engine as _engine
+            _engine.clear_gone(session.runtime, table_key, stored.get(_pf["key"]))
+        except Exception as e:                                    # noqa: BLE001
+            print(f"[aios-api] clear_gone failed: {type(e).__name__}: {e}")
     _refresh_relations(session)
     return out

platform/core/user_tables.py

@@ -1047,6 +1047,21 @@ def _clean_field(raw, previous=None):
     # column it is editing. Clearing it is deliberate work, not a side effect of renaming a header.
     if prev.get('pinned') is True or raw.get('pinned') is True:
         out['pinned'] = True
+    # ⭐ 2026-08-09 (wave 28) — `agg` DECIDES WHETHER THE GRID'S TOTALS ROW SUMS THE COLUMN, and
+    # this door silently dropped it while `clean_fields` (:402) kept it. Two validators, one
+    # question, opposite answers — D-91's exact class, found from the other end: the register's row
+    # described `clean_fields` as the lax door, and by the time it was read that half had been
+    # fixed while THIS one still diverged.
+    # ⛔ THE CONSEQUENCE IS QUIET, WHICH IS WHY IT SURVIVED. Every currency and money-rollup column
+    # in the four Odoo databases declares `agg: "sum"`; the spawn writes definitions straight to
+    # the store, so the totals row worked — until anyone PATCHED one of those fields (a rename, a
+    # width, a description), at which point the column silently stopped totalling and nothing
+    # anywhere went red. Caught by a gate leg written to assert the LINK bag survives this door,
+    # which found `agg` instead.
+    # ⚠ Sticky across a patch for the same reason as `default` and `pinned`: a client PATCH that
+    # omits the key must not un-total a column as a side effect of renaming its header.
+    if str(raw.get('agg') or prev.get('agg') or '').strip() == 'sum':
+        out['agg'] = 'sum'
     # An automation column carries the binding the engine reads; it is preserved across a patch
     # rather than re-declared, because the automation editor owns it and this route does not.
     auto = raw.get('automation') if 'automation' in raw else prev.get('automation')

web/src/automation/AutomationBuilder.tsx

@@ -587,7 +587,15 @@ export default function AutomationBuilder({
     */
     if (kind === "enrich_instagram")
       return {
-        tier: "anonymous", noFallback: false, postMetrics: false, commentMetrics: false,
+        // ⭐ WAVE 28 · R5/R6 — `tier: "anonymous"` and `noFallback: false` are GONE from the seed.
+        // R5 retired the free ladder from enrichment, so a new action must not be born naming a
+        // source strategy the runner no longer consults. The server keeps ACCEPTING both keys on
+        // stored definitions and ignores them (C2, D-65's law) — but a SEED is what a new step
+        // starts with, and seeding a dead key is how a retired concept outlives its removal.
+        // ⚠ `postMetrics`/`commentMetrics` stay `false` here and that is R6's ruling verbatim
+        // ("always both off until toggled on"), matching `clean_action_config`'s reading of an
+        // absent key so the seed and the validator cannot disagree.
+        postMetrics: false, commentMetrics: false,
         dryRun: false, maxPosts: 10,
         fromView: "", sortField: "first_found", sortDir: "desc",
         // ⚠ `skipRecent: true` MATCHES `_ensure_enrich_step`'s server seed, deliberately. One
@@ -2052,7 +2060,16 @@ function NewDatabase({
   );
 }
 
-function ActionProps({
+/**
+ * ⭐ WAVE 28 — EXPORTED so the include-row render suite can mount the real panel.
+ *
+ * ⛔ THE EXPORT IS THE POINT, not a convenience. R6's three include rows are markup whose defect
+ * modes are invisible to a source grep: a row that renders with no key attached, a Profile
+ * checkbox that paints unchecked, two rows bound to the same key. `ReviewProps` below is already
+ * exported for the same reason, so this is the file's existing shape rather than a new one.
+ * `_test/` never ships (`deploy_web.py` excludes `_test/` and `_`-prefixed files both).
+ */
+export function ActionProps({
   action,
   pinned,
   catalog,
@@ -2433,35 +2450,65 @@ function ActionProps({
             </div>
           ) : null}
 
-          <div className="auto-field">
-            <label htmlFor="autox-atier">Source</label>
-            <select
-              id="autox-atier"
-              className="auto-input"
-              value={String((cfg as { tier?: string }).tier || "anonymous")}
+          {/*
+            ⭐⭐ WAVE 28 · R5 / R6 / R7 — THE SOURCE QUESTION IS GONE, AND THREE INCLUDE AXES
+            REPLACE IT. What stood here was a `Source` select writing `config.tier`
+            (Anonymous / Paid provider) plus a sibling `noFallback` checkbox — ONE control in two
+            pieces, asking the user to choose a VENDOR STRATEGY.
+
+            ⛔ R5 RETIRED THE QUESTION, not just the control. Enrichment routes per capability to
+            the paid providers and reports blocked on a refusal; there is no thin anonymous row to
+            fall back to, so "which source" and "stop if it fails" no longer have answers a person
+            could give. `tier` and `noFallback` are accepted-and-ignored in stored configs (C2,
+            and D-65's law: never 400 a definition that was legal when it was written) — which is
+            why this panel simply stops writing them rather than migrating anything.
+
+            ⛔ THE ROWS BELOW ARE A TRANSFORM, NOT AN ADDITION, and that distinction is the whole
+            defect risk in this change. `postMetrics` and `commentMetrics` ALREADY had checkboxes
+            34 lines below this point ("Also capture per-post engagement" / "…per-comment…").
+            Building three NEW rows and leaving those would have put TWO controls on each key —
+            which compiles, renders, and satisfies any check asking whether a Post-data switch
+            exists. The old pair is deleted; these carry their keys.
+
+            ⚠ KEYS UNCHANGED ON PURPOSE (C2). Every stored enrich action round-trips untouched;
+            only the labels move. R7: no cost sentence anywhere in this panel — the run log keeps
+            honest spend reporting, and a warning printed permanently is chrome the eye stops
+            reading (DESIGN.md §4).
+          */}
+          {/* ⚠ A GROUP HEADING, NOT A `<label htmlFor>`. The first cut pointed it at the Post-data
+              input, which is wrong twice over: it claims one row is "the" control for a group of
+              three, and clicking the heading would toggle Posts. `auto-field-label` is this
+              panel's own idiom for naming a group ("Records to enrich" above uses it). */}
+          <p className="auto-field-label">Include</p>
+          {/* ⛔ DISPLAY-ONLY, AND IT IS NOT DECORATION. The profile IS the unit of enrichment —
+              there is no run that skips it — so a switch here would be a control that cannot be
+              off ([[wrong-parent-not-broken-control]]). It carries NO config key: rendering it
+              as state would invent a flag no cleaner reads.
+              ⚠ `readOnly` beside `disabled`: a `checked` input with no `onChange` is a React
+              warning, and `readOnly` says the honest thing about why. */}
+          <label className="auto-check">
+            <input id="autox-inc-profile" type="checkbox" checked readOnly disabled />
+            Profile
+          </label>
+          <label className="auto-check">
+            <input
+              id="autox-inc-posts"
+              type="checkbox"
+              checked={!!(cfg as { postMetrics?: boolean }).postMetrics}
               disabled={busy}
-              onChange={(e) => setCfg({ tier: e.target.value })}
-            >
-              <option value="anonymous">Anonymous — free, best effort</option>
-              <option value="brightdata">Paid provider — costs money per profile</option>
-            </select>
-            {/* ⚠ THE MONEY SENTENCE IS ON THE MONEY OPTION. R7's rule about the machine steps'
-                switches applies to their replacement: a control whose cost is invisible is a
-                control nobody can consent to. */}
-            <p className="auto-hint">
-              {String((cfg as { tier?: string }).tier || "anonymous") === "brightdata"
-                ? "Each profile is billed by the provider."
-                : "Free, and some profiles will come back thin."}
-            </p>
-          </div>
+              onChange={(e) => setCfg({ postMetrics: e.target.checked })}
+            />
+            Post data
+          </label>
           <label className="auto-check">
             <input
+              id="autox-inc-comments"
               type="checkbox"
-              checked={!!(cfg as { noFallback?: boolean }).noFallback}
+              checked={!!(cfg as { commentMetrics?: boolean }).commentMetrics}
               disabled={busy}
-              onChange={(e) => setCfg({ noFallback: e.target.checked })}
+              onChange={(e) => setCfg({ commentMetrics: e.target.checked })}
             />
-            Stop if that source fails, rather than trying the other one
+            Comment data
           </label>
           {/*
             ⭐ WAVE 26 · ITEM 7 / R2 + C5 — TWO CONTROLS, AND THEY ARE INDEPENDENT.
@@ -2497,41 +2544,19 @@ function ActionProps({
               At most 12 — the provider returns a profile&rsquo;s top 12 posts and no more.
             </p>
           </div>
-          <label className="auto-check">
-            <input
-              type="checkbox"
-              checked={!!(cfg as { postMetrics?: boolean }).postMetrics}
-              disabled={busy}
-              onChange={(e) => setCfg({ postMetrics: e.target.checked })}
-            />
-            Also capture per-post engagement
-          </label>
-          {/* ⛔ THE ONE THAT MULTIPLIES THE BILL BY THE POST COUNT gets its own sentence, and only
-              while it is ON — a warning printed permanently is chrome the eye stops reading.
-              ⚠ IT IS THE SAME AFFORDANCE THE MONEY SWITCH ABOVE USES (C5: "the SAME affordance as
-              the existing Bright Data money switch") — a hint line under the control, naming what
-              is billed and per what. A distinct badge would read as a different KIND of warning
-              for the same kind of fact. */}
-          {(cfg as { postMetrics?: boolean }).postMetrics ? (
-            <p className="auto-hint">
-              Billed per post, not per profile — a separate scrape for each post kept above.
-            </p>
-          ) : null}
-          <label className="auto-check">
-            <input
-              type="checkbox"
-              checked={!!(cfg as { commentMetrics?: boolean }).commentMetrics}
-              disabled={busy}
-              onChange={(e) => setCfg({ commentMetrics: e.target.checked })}
-            />
-            Also capture per-comment engagement
-          </label>
-          {(cfg as { commentMetrics?: boolean }).commentMetrics ? (
-            <p className="auto-hint">
-              Billed by the separate Comments dataset. This is off by default; embedded comments
-              already returned with a paid post are retained without this additional request.
-            </p>
-          ) : null}
+          {/*
+            ⭐ WAVE 28 · R6/R7 — THE TWO CHECKBOXES THAT STOOD HERE MOVED UP INTO THE INCLUDE
+            GROUP, KEYS AND ALL (`postMetrics`, `commentMetrics`). They are not deleted features:
+            they are the SAME two switches, relabelled "Post data" and "Comment data" and grouped
+            with the always-on Profile row so the three capture axes read as one decision.
+            ⛔ THEIR CONDITIONAL COST HINTS WENT WITH THEM AND DID NOT COME BACK (R7): "Billed per
+            post, not per profile" and "Billed by the separate Comments dataset". R7 puts spend
+            reporting in the RUN LOG, where it is a measured fact about work already done, rather
+            than in the panel, where it was a permanent caption on a switch.
+            ⚠ Leaving them here as well as above is the duplicate-writer trap this wave's item 1
+            was one literal reading away from shipping — two controls on one key, both correct,
+            neither authoritative.
+          */}
           <label className="auto-check">
             <input
               type="checkbox"

web/src/automation/AutomationDetail.tsx

@@ -1076,19 +1076,42 @@ export default function AutomationDetail({
                         datacenter egress, "204K not 204,312", which rung answers when. The
                         CHOICE a person makes is exact-or-estimated and what it costs; the rest
                         was the architecture explaining itself. DESIGN.md §4. */}
-                    <h3>Exact counts</h3>
-                    <p className="auto-hint">
-                      Real follower numbers and the account&rsquo;s top posts, charged per profile.
-                      {paidReady ? "" : " Not set up on this workspace yet."}
-                    </p>
-                    <h3>Post engagement</h3>
-                    <p className="auto-hint">
-                      Likes and comments per post. Charged per post, so it is its own switch.
-                    </p>
-                    <h3>Estimated counts</h3>
+                    {/*
+                      ⭐⭐ WAVE 28 · R5 + R7 — THREE HEADINGS DESCRIBED A LADDER THAT NO LONGER
+                      EXISTS. "Exact counts" / "Post engagement" / "Estimated counts" named the
+                      capture RUNGS, and R5 retired the free anonymous rung from enrichment
+                      entirely: exact numbers or nothing, a vendor refusal reports blocked. A
+                      panel offering to "switch it off to get exact numbers or nothing" describes
+                      a choice the runner stopped having — a picture of the engine that disagrees
+                      with the engine, which is the defect this module refuses everywhere else.
+                      ⛔ THE MONEY SENTENCES WENT WITH THEM (R7): "charged per profile" and
+                      "Charged per post, so it is its own switch". Spend is reported in the RUN
+                      LOG against work already done, never as a permanent caption on a control.
+
+                      ⚠ `paidReady` SURVIVES, and R5 makes it MORE load-bearing rather than less.
+                      It is the one live reader of the flag, and with no free ladder underneath, a
+                      workspace with no provider connected gets nothing at all rather than a thin
+                      row — so the panel says so. That is a system fact, not a price.
+                    */}
+                    {/*
+                      ⛔ THE SENTENCE MAKES NO CLAIM ABOUT WHAT THE SWITCHES DO, and the first cut
+                      did: it read "post and comment data follow the switches above", which is
+                      NOT what `postMetrics` gates. Measured against the engine —
+                      `automation_engine.py:5358` ("likes/comments per post are bought, or the
+                      engagement series does not grow") and `connectors_ig.py:710` ("a separate,
+                      opt-in, ~13x-cost rung rather than a free by-product") — the profile pull
+                      keeps up to `maxPosts` posts REGARDLESS of that switch; what the switch buys
+                      is per-post ENGAGEMENT. R6 rules the LABEL ("Post data"), and the label is
+                      the owner's to set; a caption asserting a mechanism is mine, and this one
+                      would have been a picture of the engine that disagrees with the engine —
+                      the defect this module refuses in five other places.
+                      ⚠ ASK ->B is open on whether R5's reshape changes that. Until it is answered
+                      the honest panel says the one thing that is true either way.
+                    */}
+                    <h3>Included</h3>
                     <p className="auto-hint">
-                      Free, but rounded (204K rather than 204,312) and marked as estimates. Switch
-                      it off to get exact numbers or nothing.
+                      The profile is always read.
+                      {paidReady ? "" : " No provider is connected on this workspace yet."}
                     </p>
                   </>
                 ) : null}

web/src/automation/automationApi.ts

@@ -31,12 +31,17 @@ export type AutomationKind =
   | "discover_instagram"
   | "plain";
 export type RunState = "idle" | "running" | "ok" | "error" | "partial";
-/**
- * ⚠ `hiker` is NOT in this union any more (wave 20, D-21) — the vendor moved.
- * Stored configs still SAY `hiker` and the server maps them forward
- * (`TIER_ALIASES`), so nothing in this client should ever write that word.
+/*
+ * ⭐ WAVE 28 · R5 — `CaptureTier` ("anonymous" | "brightdata") IS DELETED. It was the client's
+ * name for the capture-rung choice, and R5 retired that choice: enrichment routes per capability
+ * to the paid providers and reports blocked on a refusal, so there is no tier for a client to
+ * hold. MEASURED before deleting: the type had ZERO usages anywhere under `src/` — it was already
+ * a declaration nothing read, which is what a retired concept looks like on the way out.
+ * ⛔ THE SERVER'S OWN VOCABULARY IS UNTOUCHED, deliberately. `TIERS`, `TIER_ALIASES` and the
+ * `brightdata` vendor name stay in the engine (`verify_automation.py:6510` fences them), because
+ * a stored config still carries `tier` and is accepted-and-ignored rather than refused (C2,
+ * D-65's law). What died is the USER CONCEPT, not the wire's tolerance for it.
  */
-export type CaptureTier = "anonymous" | "brightdata";
 
 /**
  * A node's dot. Deliberately WIDER than `RunState` — a single step can be
@@ -1012,10 +1017,21 @@ export const COUNT_LABELS: [string, string][] = [
   // (profile read, media not anonymously readable) but this table did not, so a run whose
   // summary said "1/1 profiles read" showed a chip row reading "0 Read" — the chips
   // contradicting the sentence directly above them. A count the summary names must have a chip.
+  // ⭐ WAVE 28 · R5 — KEPT, and the label is unchanged on purpose. "Profile only" describes WHAT
+  // WAS CAPTURED (the profile answered, its media did not), which is still a state a single paid
+  // pipeline reaches; it was never tier vocabulary the way "Exact counts" was.
   ["partial", "Profile only"],
   ["blocked", "Blocked"],
   ["error", "Errors"],
-  ["paid", "Exact counts"],
+  // ⭐ WAVE 28 · R5/R7 — WAS "Exact counts", WHICH NOW DISTINGUISHES NOTHING. The word only meant
+  // anything against the free rung's "estimated" counts, and R5 retired that rung: every number a
+  // run reports is exact, so a chip claiming exactness is a label with no complement.
+  // ⛔ THE CHIP ITSELF STAYS, and R7 is why: cost prose leaves the PANEL and spend reporting lives
+  // in the RUN LOG, against work already done. This is that reporting — the count of profiles the
+  // run actually bought. Deleting it would take the honest half out with the prose.
+  // ⚠ SAFE IN BOTH DIRECTIONS if B's R5 work stops emitting the count: the renderer filters on
+  // `typeof r.counts?.[k] === "number"`, so an absent count paints no chip rather than a zero.
+  ["paid", "Paid profiles"],
   ["posts", "Posts"],
   ["new_posts", "New posts"],
   // The engagement series only grows while the per-post rung is on, so its

web/src/automation/steps.ts

@@ -85,12 +85,15 @@ export interface Step {
 /**
  * Number the server's nodes for display.
  *
- * ⭐ THE NUMBER IS `col + 1`, NOT the array index, and that is the honest one. The
- * `field_instagram` graph forks: `capture_paid` and `capture_anon` both sit at
- * `col: 3` because they are the SAME position in the flow reached two ways (the
- * paid rung answers, or the anonymous ladder does). Numbering them 4 and 5 would
- * state a sequence that never happens. They share a number and the second is
- * marked `alt`, so the list says "either of these" rather than "then".
+ * ⭐ THE NUMBER IS `col + 1`, NOT the array index, and that is the honest one. It exists
+ * because a graph can FORK: two nodes at the same `col` are the SAME position in the flow
+ * reached two ways, and numbering them 4 and 5 would state a sequence that never happens.
+ * They share a number and the second is marked `alt`, so the list reads "either of these"
+ * rather than "then".
+ * ⚠ 2026-08-09 (wave 28, R5): the fork this was WRITTEN for is gone — `capture_paid` and
+ * `capture_anon` were the paid-rung/anonymous-ladder pair, and the ladder is retired, so
+ * today's graph is linear. The `col`-based rule STAYS because it is about forks in general,
+ * not about those two nodes; this note records that no shipped graph currently exercises it.
  *
  * "Step 1 is always the Trigger" (R9) therefore falls out of the payload — the
  * trigger is the node at `col: 0` — instead of being asserted by this client. If
@@ -150,10 +153,14 @@ export interface PanelGroup {
  *
  * ⛔ GROUPED, NEVER MAPPED ONE-TO-ONE, and the difference is a defect rather than a nicety.
  * `panel` is MANY-TO-ONE over nodes, which is easy to miss because the old surface hid it: you
- * clicked ONE card and got ONE panel. `field_instagram` gives `capture`, `capture_paid`,
- * `capture_anon` AND `capture_metrics` all `panel: "capture"` (`automation_engine.py:3334-3352`),
- * and `discover_instagram` gives both of its nodes `panel: "find"` (`:3381`/`:3387`). So a body
- * rendered per NODE would print the capture prose four times over, and — the one that actually
+ * clicked ONE card and got ONE panel. `discover_instagram` gives both of its nodes
+ * `panel: "find"`, and `field_instagram` gives every capture node `panel: "capture"`.
+ * ⚠ 2026-08-09 (wave 28, R5/C3): this used to name `capture`, `capture_paid`, `capture_anon`
+ * AND `capture_metrics` with a line citation — all four ids are DELETED and the citation was
+ * stale, which is worse than vague, because a stale line number reads as authoritative. The
+ * grouping rule is unchanged: the capture nodes are now `capture_posts` + `capture_comments`.
+ * So a body rendered per NODE would print the capture prose once per node, and — the one that
+ * actually
  * loses work — mount the 21-toggle discovery filter TWICE against a single `preds` array, two
  * editors writing one piece of state where whichever blurred last silently wins.
  *

web/src/customer-grid/ColumnMenu.tsx

@@ -5,9 +5,10 @@ import { FieldTypeIcon, MenuLabel } from "./icons";
 import { FieldSelectButton } from "./FieldSelect";
 import { CODE_LANGUAGE_LABELS, CODE_LANGUAGES, CREATABLE_TYPES, choiceOptions, choiceRenames,
   codeLanguageOf, directionLabel, isMachineOwned,
-  isProfileField, parseOptions, ratingMax, ROLLUP_FN_LABELS, ROLLUP_FNS } from "./types";
+  isProfileField, parseOptions, ratingMax, ROLLUP_FN_LABELS, ROLLUP_FNS,
+  ROLLUP_REF_OPS } from "./types";
 import type { Field, FieldFormat, FieldScope, FieldType, Measure, RollupCondition, RollupFn,
-  RollupSource, Viewer } from "./types";
+  RollupRefOp, RollupSource, Viewer } from "./types";
 import type { LinkTarget, RollupSourceOffer } from "./apiBridge";
 import type { WindowSpec } from "./windows";
 import { normalizeWindow, windowLabel } from "./windows";
@@ -279,6 +280,41 @@ interface OptionDraft {
 }
 
 const DEFAULT_OPTION_LABELS = ["Not started", "In progress", "Blocked", "Done"];
+
+/**
+ * ⭐ WAVE 28 · R4 / C1 — how a SET-STATISTIC comparison reads in the operator list.
+ *
+ * ⛔ KEYED BY `RollupRefOp`, so the day `core.user_tables.ROLLUP_REF_OPS` gains or loses an
+ * operator this map fails to compile rather than rendering a bare identifier — the same
+ * discipline `ROLLUP_FN_LABELS` uses, and the reason the σ picker maps `ROLLUP_REF_OPS` instead
+ * of hand-filtering the full operator list.
+ * ⚠ The wording names the STATISTIC, not the arithmetic: "2 σ above the mean" is the sentence a
+ * person is trying to write, and "is greater than mean + k·stdev" is the implementation of it.
+ */
+/**
+ * ⭐ MIRRORS `core.user_tables.ROLLUP_MAX_SIGMAS`, and `verify_rollup_editor.py` HOLDS THE TWO IN
+ * STEP by importing the server's constant and comparing (a real enforcer this time — `types.ts`
+ * spent a wave claiming one that contained zero occurrences of the word it guarded,
+ * [[limit-with-no-enforcer]]).
+ *
+ * ⛔ WHY THE CONTROL MUST KNOW THE BOUND AT ALL. `_clean_rollup` REFUSES the whole field outside
+ * this range — not the leaf, the FIELD — so an unbounded box invites a value and then answers a
+ * 400 naming a cap the control never mentioned. That is `maxPosts` exactly: it offered 200 while
+ * the save door refused anything over 12 ([[default-must-pass-its-own-guard]]). A control must
+ * display what it will SEND.
+ */
+const MAX_SIGMAS = 10;
+
+/** The default when a σ row is born or its box is left empty — C1's worked example uses 2. */
+const DEFAULT_SIGMAS = 2;
+
+const REF_OP_LABELS: Record<RollupRefOp, string> = {
+  gt: "is more than … σ above the mean",
+  gte: "is at least … σ above the mean",
+  lt: "is less than … σ above the mean",
+  lte: "is at most … σ above the mean",
+};
+
 let optionDraftSequence = 0;
 
 function nextOptionDraftId(): string {
@@ -1234,6 +1270,37 @@ function ExtraTypeEditor({
             </select>
           </label>
         ) : null}
+        {/*
+          ⭐⭐ 2026-08-09 · D-99 — THE STATE THE OWNER'S REPORT DESCRIBES, SAID OUT LOUD.
+          Owner: *"if we want to use Rollup field to apply to the related database, it doesn't
+          work. Because the linked Field can't be selected yet."*
+
+          ⛔ WHAT IS ACTUALLY REACHABLE HERE, measured rather than guessed. The `Through` picker
+          offers EVERY link column — `linkFields` filters on `f.type === "link"` and excludes
+          nothing preset, derived or `automation:`-tagged, so the scouted hypothesis ("the picker
+          omits preset links") is refuted at source. What CAN happen is one step later: the
+          target is resolved out of `linkTargets`, which is `GET /tables` filtered by
+          `user_tables.may_open` (creator, admin, or an explicit share). An automation-OWNED child
+          dataset is stamped with a machine owner, so for a user who is neither its creator nor an
+          admin it is simply ABSENT from that list — and then `targetFields` is `[]`, this Column
+          picker holds nothing but its placeholder, and `Add condition` below is disabled.
+
+          ⚠ AND UNTIL NOW IT SAID NOTHING. An empty picker beside a dead button reads as "this
+          feature is broken"; it is in fact a permission fact about ONE database, and the fix for
+          it is a share, not a bug report. This is the absent-vs-empty third state the automation
+          panel already distinguishes ("No view list was offered for that database") — the same
+          discipline, applied to the surface that actually got reported.
+          ⛔ IT NAMES THE TABLE RATHER THAN APOLOGISING. `chosenLink.link.table` is the key the
+          bag points at, and printing it is what turns "it doesn't work" into a thing to go and
+          grant.
+        */}
+        {chosenLink && !target ? (
+          <div className="cg-field-hint">
+            This link points at <b>{chosenLink.link?.table}</b>, which is not among the databases
+            you can open — so its columns cannot be listed here and the conditions below stay
+            unavailable. Ask an admin to share that database with you, then reopen this editor.
+          </div>
+        ) : null}
         <div className="cg-rollup-conditions">
           <div className="cg-rollup-conditions__head">
             <span>Conditions</span>
@@ -1276,34 +1343,117 @@ function ExtraTypeEditor({
                   <option key={targetField.key} value={targetField.key}>{targetField.label}</option>
                 ))}
               </select>
+              {/*
+                ⭐⭐ WAVE 28 · R4 / C1 — THE THRESHOLD MAY NOW BE THE SET'S OWN STATISTICS.
+                Owner's request (Nurilab): an average of the last 10 posts with outliers trimmed —
+                "anything beyond 2 sigma". That is not a new aggregator, it is a CONDITION whose
+                threshold is computed from the scoped rows themselves: mean + k*stdev of the same
+                column, over the window `sortBy`+`limit` kept, BEFORE the conditions filter.
+
+                ⛔ ONE CONTROL, NOT TWO, AND THAT IS WHAT MAKES THE XOR SAFE. `value` and `ref` may
+                never both be present — the server refuses the whole FIELD, not just the leaf — so
+                a separate "compare against…" switch beside the operator would leave the editor
+                free to write a `ref` while a stale `value` still rode along, producing a 400 on
+                Save that names a key the user never typed. Folding the choice into the operator
+                makes the illegal state unrepresentable: picking a plain op WRITES `value` and
+                drops `ref`, picking a statistic op does the reverse, and there is no third path.
+
+                ⚠ THE OPS ARE `ROLLUP_REF_OPS`, IMPORTED, never a hand-filtered copy of the full
+                list. `eq`/`neq` against a computed float is a coin flip on binary representation
+                and `contains` against a number never matches — the server draws that line and a
+                second copy here would be free to drift from it.
+                ⚠ THE `value` IS COMPOUND (`ref:gt`) so the select always resolves to exactly one
+                option. A `<select>` whose value matches nothing renders the FIRST option while
+                the stored key says otherwise, and the next patch writes the lie back
+                ([[cg-condition-builder-items]]).
+              */}
               <select
                 className="cg-input"
                 aria-label={`Condition ${index + 1} operator`}
-                value={condition.op}
-                onChange={(event) => onRollupConditions?.(rollupConditions.map((item, i) =>
-                  i === index
-                    ? { ...item, op: event.target.value as RollupCondition["op"] }
-                    : item
-                ))}
+                value={condition.ref ? `ref:${condition.op}` : condition.op}
+                onChange={(event) => {
+                  const raw = event.target.value;
+                  const isRef = raw.startsWith("ref:");
+                  const op = (isRef ? raw.slice(4) : raw) as RollupCondition["op"];
+                  // ⛔ THE LEAF IS REBUILT, NEVER SPREAD-AND-PATCHED. `{ ...item, ref: undefined }`
+                  // leaves the key present-and-undefined; `JSON.stringify` drops it today, but the
+                  // contract is "the key is absent", and relying on a serialiser's treatment of
+                  // `undefined` to enforce a server-side XOR is a guarantee held by accident.
+                  const next: RollupCondition = isRef
+                    ? { field: condition.field, op,
+                        ref: { sigmas: condition.ref?.sigmas ?? DEFAULT_SIGMAS } }
+                    : { field: condition.field, op, value: condition.value ?? "" };
+                  onRollupConditions?.(rollupConditions.map((item, i) => (i === index ? next : item)));
+                }}
               >
-                <option value="eq">is</option>
-                <option value="neq">is not</option>
-                <option value="contains">contains</option>
-                <option value="not_contains">does not contain</option>
-                <option value="is_empty">is empty</option>
-                <option value="is_not_empty">is not empty</option>
-                <option value="gt">is greater than</option>
-                <option value="gte">is at least</option>
-                <option value="lt">is less than</option>
-                <option value="lte">is at most</option>
+                <optgroup label="Compared with a value">
+                  <option value="eq">is</option>
+                  <option value="neq">is not</option>
+                  <option value="contains">contains</option>
+                  <option value="not_contains">does not contain</option>
+                  <option value="is_empty">is empty</option>
+                  <option value="is_not_empty">is not empty</option>
+                  <option value="gt">is greater than</option>
+                  <option value="gte">is at least</option>
+                  <option value="lt">is less than</option>
+                  <option value="lte">is at most</option>
+                </optgroup>
+                <optgroup label="Compared with the set's own spread">
+                  {ROLLUP_REF_OPS.map((op) => (
+                    <option key={op} value={`ref:${op}`}>{REF_OP_LABELS[op]}</option>
+                  ))}
+                </optgroup>
               </select>
-              {!(["is_empty", "is_not_empty"] as string[]).includes(condition.op) ? (
+              {condition.ref ? (
+                <label className="cg-cond-ref">
+                  {/* ⚠ A BARE NUMBER BOX WOULD BE A CONTROL THAT WILL NOT SAY WHAT IT SETS. The
+                      unit is sigmas and the sign is meaningful (negative selects the LOW tail), so
+                      both are printed beside the input rather than left to be inferred from a
+                      placeholder. */}
+                  <input
+                    className="cg-input"
+                    type="number"
+                    step="0.5"
+                    /* ⛔ THE SERVER'S OWN BOUND, BOTH WAYS. Outside it `_clean_rollup` refuses the
+                       whole FIELD, so an unbounded box would invite a 400 naming a cap it never
+                       showed — `maxPosts`'s scar, in a control built the same day it was quoted. */
+                    min={-MAX_SIGMAS}
+                    max={MAX_SIGMAS}
+                    aria-label={`Condition ${index + 1} standard deviations from the mean`}
+                    /* ⚠ UNCONTROLLED + COMMIT ON BLUR, the idiom `maxPosts` uses and for its
+                       reason: a controlled box patching per keystroke stores "-" as 0 and "1" on
+                       the way to "1.5" as a legal value, and `Number("")` is 0 — so simply
+                       CLEARING the box would silently store "0 sigma", a real but different
+                       query, and the field could never be retyped because it snaps back. */
+                    defaultValue={String(condition.ref.sigmas)}
+                    onBlur={(event) => {
+                      const raw = Number(event.target.value);
+                      // Empty/garbage falls back to the default rather than to 0 — 0 means "at
+                      // the mean" and is a value somebody must choose, never one they land on by
+                      // deleting a character.
+                      const parsed = event.target.value.trim() === "" || !Number.isFinite(raw)
+                        ? DEFAULT_SIGMAS
+                        : raw;
+                      // CLAMPED, not refused: the box is a dial, and a dial that rejects is a
+                      // dead control. The clamp is what makes "displays what it will send" true.
+                      const sigmas = Math.max(-MAX_SIGMAS, Math.min(MAX_SIGMAS, parsed));
+                      if (String(sigmas) !== event.target.value) event.target.value = String(sigmas);
+                      onRollupConditions?.(rollupConditions.map((item, i) => (
+                        i === index
+                          ? { field: item.field, op: item.op, ref: { sigmas } }
+                          : item
+                      )));
+                    }}
+                  />
+                  <span>σ from the mean of this column (negative reads below it)</span>
+                </label>
+              ) : !(["is_empty", "is_not_empty"] as string[]).includes(condition.op) ? (
                 <input
                   className="cg-input"
                   aria-label={`Condition ${index + 1} value`}
                   value={condition.value ?? ""}
                   onChange={(event) => onRollupConditions?.(rollupConditions.map((item, i) =>
-                    i === index ? { ...item, value: event.target.value } : item
+                    i === index ? { field: item.field, op: item.op, value: event.target.value } : item
                   ))}
                 />
               ) : null}

web/src/index.css

@@ -1478,6 +1478,29 @@ body {
   width: 30px;
   height: 30px;
 }
+
+/* ── WAVE 28 · R4 / C1 (session C) — the set-statistic threshold's input ──────────────────────
+   A condition row is a 3-column grid (field, operator, remove) and the ordinary value input
+   already spans the first two on a second line. The sigma input needs the same span PLUS its
+   unit beside it: the number is meaningless alone, and the sign is load-bearing (negative reads
+   BELOW the mean), so a bare box would be a control that will not say what it sets
+   ([[wrong-parent-not-broken-control]]).
+   ⚠ `grid-column` on the LABEL, not on its input: the input is now a grandchild of the row, so
+   the `.cg-rollup-condition > input` rule above no longer reaches it — which is the trap that
+   turns an extra child into an extra column. */
+.cg-rollup-condition > .cg-cond-ref {
+  grid-column: 1 / span 2;
+  display: grid;
+  grid-template-columns: 84px minmax(0, 1fr);
+  align-items: center;
+  gap: 8px;
+}
+
+.cg-rollup-condition > .cg-cond-ref > span {
+  color: var(--cg-muted);
+  font-size: var(--lp-fs-2xs);
+  line-height: 1.35;
+}
 /* why a control is unavailable, in the place the control would have been. An empty popover
    reads as broken; a sentence reads as a decision (CG-3). */
 .cg-pop-note {