Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,5 +1,5 @@
 {
- "current": "cb05235",
+ "current": "2b8e675",
  "releases": [
   {
    "version": "v25",

VERSION

@@ -1 +1 @@
-cb05235
+2b8e675

api/ai_enrich.py

@@ -205,19 +205,16 @@ def _usage_tokens(body):
     ⚠ RETURNS None WHEN THE PROVIDER DID NOT SAY, and the caller treats that as a real unknown
     rather than as zero. A ledger that silently books an unmeasured call at 0 reports a cheaper
     run than happened, which is exactly the cost-surprise complaint R13 cites.
+
+    ⭐⭐ W35-T41 / C7 — THE READER MOVED AND THIS IS NOW ONE LINE OVER IT. `usage_ledger.total_from`
+    is the same logic, in the module that owns the meter; the alternative was a second reader in a
+    second file answering the same question about the same key, which is the shape this repo pays
+    for most often ([[one-question-two-normalizers]]). ⚠ The NAME and the None-semantics stay
+    exactly as wave 34 wrote them, because `run_field`'s ceiling arithmetic reads this and a gate
+    injects against its shape — lifting the body, not the signature.
     """
-    usage = (body or {}).get('usage')
-    if not isinstance(usage, dict):
-        return None
-    for key in ('total_tokens', 'totalTokens'):
-        got = usage.get(key)
-        if isinstance(got, int) and not isinstance(got, bool):
-            return got
-    ins = usage.get('prompt_tokens', usage.get('input_tokens'))
-    outs = usage.get('completion_tokens', usage.get('output_tokens'))
-    if isinstance(ins, int) and isinstance(outs, int):
-        return ins + outs
-    return None
+    import usage_ledger
+    return usage_ledger.total_from(body)
 
 
 #: R6's subject: the em dash (U+2014) and the en dash (U+2013), as a regex character class.
@@ -372,7 +369,7 @@ def scheduled_fields(defn):
 
 
 def run_field(table_key, col_id, *, st, rows=None, manual=False, policy=None, budget=None,
-              timeout=None, ask=None):
+              timeout=None, ask=None, user=''):
     """Fill one `ai_enrich` column over the rows an automatic run is allowed to touch.
 
     Returns a REPORT and never raises for a vendor problem:
@@ -391,9 +388,17 @@ def run_field(table_key, col_id, *, st, rows=None, manual=False, policy=None, bu
 
     ⚠ `ask` is injectable so a gate can exercise the ledger, the ceiling and every failure path
     with no network and no vendor bill. It defaults to the real `_ask`.
+
+    ⭐⭐ W35-T41 / C7 — ONE USAGE-LEDGER LINE PER RUN, NOT PER ROW, and the arithmetic is the reason:
+    this loop makes one LLM call per row, so a ledger write per call would be hundreds of store
+    writes for one click. The run already accumulates `report['tokens']`; `calls` and `unmeasured`
+    join it so the meter can say "40 calls, 12,000 tokens, 3 of them unmeasured" instead of a total
+    with an unknown shortfall. `user` is the ledger's attribution and is passed by this file's own
+    callers in `routes_tables`.
     """
     import ai_review
     import core.user_tables as ut
+    import usage_ledger
 
     defn = ut.get(table_key, st=st) or {}
     field = next((f for f in ut.ai_enrich_fields(defn) if f.get('key') == str(col_id)), None)
@@ -440,7 +445,11 @@ def run_field(table_key, col_id, *, st, rows=None, manual=False, policy=None, bu
     keys = [f.get('key') for f in (defn.get('fields') or []) if f.get('key')]
     report = {'planned': len(plan['run']), 'filled': 0, 'failed': 0,
               'skipped': dict(plan['skipped']), 'tokens': 0, 'errors': [], 'limit': None,
-              'provider': '', 'model': '', 'problem': ''}
+              'provider': '', 'model': '', 'problem': '',
+              # ⭐ C7's two counters. `calls` is what the meter bills; `unmeasured` is how many of
+              # them the provider declined to report tokens for, so a total is never presented as
+              # complete when it is a floor.
+              'calls': 0, 'unmeasured': 0}
     if not plan['run']:
         return report
 
@@ -485,8 +494,14 @@ def run_field(table_key, col_id, *, st, rows=None, manual=False, policy=None, bu
             continue
         answer, tokens, problem = caller(provider, model, text[:MAX_CELL_CHARS * 8],
                                          int(cfg.get('maxTokens') or 300), tmo)
+        # ⚠ COUNTED HERE, ON EVERY OUTCOME — before the `problem` branch below, because a call that
+        # errored or answered UNKNOWN still reached the vendor and is still billed. A meter that
+        # counts only filled cells reports a cheap run for one that spent its whole budget failing.
+        report['calls'] += 1
         if isinstance(tokens, int) and not isinstance(tokens, bool):
             report['tokens'] += tokens
+        else:
+            report['unmeasured'] += 1
         if problem or not answer or answer.strip().upper() == 'UNKNOWN':
             # ⛔ THE CELL IS LEFT ALONE. An errored row keeps whatever it held; only the MARK
             # changes, so a failed run never destroys a value it could not replace.
@@ -517,4 +532,19 @@ def run_field(table_key, col_id, *, st, rows=None, manual=False, policy=None, bu
     if report['limit'] is None and ceiling and report['tokens'] >= ceiling:
         report['limit'] = ceiling_report(report['tokens'], ceiling,
                                          report['filled'], report['planned'])
+    # ⭐⭐ C7's LEDGER LINE — one per run, after both store writes, and only when the run actually
+    # called something. `total=` rather than a split: `_ask`'s contract returns a total and a gate
+    # injects against that shape, so splitting it here would mean inventing two numbers from one.
+    #
+    # ⚠ TWO LINES WHEN A RUN HAS BOTH KINDS, and it is not tidiness. `record` marks a line
+    # `unmeasured` only when its total is None, so ONE line carrying 40 calls and a partial total
+    # would book all forty as measured and lose the shortfall — a total presented as complete when
+    # it is a floor, which is the exact failure `_usage_tokens`' None-semantics exists to prevent.
+    _measured = report['calls'] - report['unmeasured']
+    if _measured > 0:
+        usage_ledger.record('field_agent', report['provider'], report['model'],
+                            total=report['tokens'], calls=_measured, st=st, user=user)
+    if report['unmeasured'] > 0:
+        usage_ledger.record('field_agent', report['provider'], report['model'],
+                            total=None, calls=report['unmeasured'], st=st, user=user)
     return report

api/ai_review.py

@@ -130,6 +130,17 @@ def _parse(text, options):
     return "", reason
 
 
+# ⭐⭐ WAVE 35 · W35-T41 / C7 — THE TWO TRANSPORTS RETURN THE RESPONSE BODY'S `usage`.
+#
+# ⛔ THIS FILE'S OWN HEADER USED TO BE THE PRODUCT'S CONFESSION THAT NOTHING COUNTED: `ai_enrich`'s
+# docstring says *"`ai_review.decide` -- the product's only other LLM entry -- has no token
+# accounting of ANY kind"*. R9 asks for ONE meter for every AI surface, so the counting has to reach
+# this transport rather than be bolted onto its caller — the caller never sees the body.
+#
+# ⚠ A THIRD RETURN VALUE, NOT A MUTATED ARGUMENT, and both call sites are in `decide` below. The
+# tuple grew from `(text, err)` to `(text, err, usage)`; `usage` is the raw `usage` OBJECT (or None),
+# because reading it is `usage_ledger`'s job and a second reader here would be the two-normalizers
+# shape this repo keeps paying for.
 def _call_openai(p, model, system, user, timeout):
     r = requests.post(p["url"], timeout=timeout,
                       headers={"Authorization": f"Bearer {os.environ[p['env']].strip()}",
@@ -138,12 +149,14 @@ def _call_openai(p, model, system, user, timeout):
                             "messages": [{"role": "system", "content": system},
                                          {"role": "user", "content": user}]})
     if r.status_code >= 400:
-        return "", f"{p['name']} answered {r.status_code}"
+        # ⚠ NO BODY ON A 4xx/5xx: an error envelope carries no usage, and a provider that refused
+        # before running the model has nothing to bill. The call is still COUNTED by `decide`.
+        return "", f"{p['name']} answered {r.status_code}", None
     body = r.json()
     choices = body.get("choices") or []
     if not choices:
-        return "", f"{p['name']} returned no choices"
-    return str(((choices[0] or {}).get("message") or {}).get("content") or ""), ""
+        return "", f"{p['name']} returned no choices", body
+    return str(((choices[0] or {}).get("message") or {}).get("content") or ""), "", body
 
 
 def _call_anthropic(p, model, system, user, timeout):
@@ -154,25 +167,34 @@ def _call_anthropic(p, model, system, user, timeout):
                       json={"model": model, "max_tokens": 300, "system": system,
                             "messages": [{"role": "user", "content": user}]})
     if r.status_code >= 400:
-        return "", f"anthropic answered {r.status_code}"
+        return "", f"anthropic answered {r.status_code}", None
     body = r.json()
     # ⛔ stop_reason FIRST. A safety refusal is a successful 200 with an EMPTY content list, so
     # reading content[0] before this check turns a refusal into an IndexError inside a run.
+    # ⚠ A refusal IS billed and its body carries `usage`, so the body rides back on this branch too.
     if body.get("stop_reason") == "refusal":
-        return "", "anthropic declined to answer this record"
+        return "", "anthropic declined to answer this record", body
     parts = [b.get("text") or "" for b in (body.get("content") or [])
              if isinstance(b, dict) and b.get("type") == "text"]
     if not parts:
-        return "", "anthropic returned no text"
-    return "".join(parts), ""
+        return "", "anthropic returned no text", body
+    return "".join(parts), "", body
 
 
-def decide(*, prompt, options, row, fields=(), label="Review", timeout=None):
+def decide(*, prompt, options, row, fields=(), label="Review", timeout=None, st=None, user=""):
     """Pick this record's next stage. Returns `(choice, meta)`.
 
     `choice` is "" whenever a person should decide — which is every failure mode there is.
     `meta` carries `provider`, `model`, `reason` on success, and `problem` on refusal to answer.
+
+    ⭐ W35-T41 / C7 — `st` and `user` are the USAGE LEDGER's target. Both default to absent because
+    this function's caller is `automation_engine.ai_decide(rt, ...)`, in another lane's fence: it
+    HAS the runtime and does not pass it yet, so until it does, a review's tokens are counted as
+    unattributed and REPORTED by `GET /usage` rather than dropped. See `usage_ledger`'s header for
+    why they cannot be resolved implicitly (measured: a contextvar does not survive a FastAPI
+    dependency).
     """
+    import usage_ledger                                                 # noqa: PLC0415
     opts = [str(o) for o in (options or []) if str(o).strip()]
     if not opts:
         return "", {"problem": "the review offers no next stages"}
@@ -188,11 +210,22 @@ def decide(*, prompt, options, row, fields=(), label="Review", timeout=None):
     problems = []
     for p in live:
         model = override or p["model"]
+        body = None
         try:
-            text, err = (_call_anthropic if p["shape"] == "anthropic" else _call_openai)(
+            text, err, body = (_call_anthropic if p["shape"] == "anthropic" else _call_openai)(
                 p, model, system, user, tmo)
         except Exception as e:                                        # noqa: BLE001
             text, err = "", f"{p['name']} failed: {type(e).__name__}"
+        # ⭐⭐ C7 — THE LEDGER LINE, BEFORE ANY BRANCH BELOW READS THE ANSWER.
+        # ⛔ IT IS WRITTEN ON EVERY OUTCOME THAT REACHED A PROVIDER, including a refusal and an
+        # unusable answer. A meter that books only successes reports a cheap week for a run that
+        # spent its budget being declined — and a declined call is billed. The only path that does
+        # NOT record is a transport that never reached the vendor (`body is None`), which spent
+        # nothing.
+        if body is not None:
+            ins, outs = usage_ledger.tokens_from(body)
+            usage_ledger.record("ai_review", p["name"], model, ins, outs,
+                                total=usage_ledger.total_from(body), st=st, user=user)
         if err:
             problems.append(err)
             continue                      # ladder: a dead provider degrades to the next one
@@ -387,12 +420,19 @@ def _flow_from_tool_call(obj):
             "actions": out}, ""
 
 
-def draft_flow(*, prompt, catalog, required, triggers, tables, chat=None, timeout=None):
+def draft_flow(*, prompt, catalog, required, triggers, tables, chat=None, timeout=None,
+               st=None, user=""):
     """A sentence -> `(draft, refusal_sentence, provider)`. ⛔ NOTHING IS SAVED HERE.
 
     Exactly one of `draft` and `refusal_sentence` is truthy — the same contract
     `web_agent.run_step` keeps, so a caller has no third case to get wrong.
+
+    ⭐ W35-T41 / C7 — `st`/`user` are the usage ledger's target, exactly as on `decide` above and for
+    the same reason: both of this function's callers (`automation_engine._ai_agent_plan` and
+    `routes_automation`'s draft door) are in lane D's fence. C7 says E adds the ledger line here and
+    D asserts it; the two keywords are what D has to pass for the line to be attributable.
     """
+    import usage_ledger                                                 # noqa: PLC0415
     text = str(prompt or "").strip()[:MAX_PROMPT_CHARS]
     if not text:
         return None, "type what you want the automation to do", None
@@ -444,12 +484,22 @@ def draft_flow(*, prompt, catalog, required, triggers, tables, chat=None, timeou
             problems.append(f"{p['name']}: HTTP {r.status_code}")
             continue
         try:
-            calls = (((r.json().get("choices") or [{}])[0].get("message") or {})
+            body = r.json()
+            calls = (((body.get("choices") or [{}])[0].get("message") or {})
                      .get("tool_calls") or [])
             args = json.loads(calls[0]["function"]["arguments"]) if calls else None
         except Exception as e:                                    # noqa: BLE001
             problems.append(f"{p['name']}: unreadable answer ({type(e).__name__})")
             continue
+        # ⭐⭐ C7 — THE LEDGER LINE. Placed after the parse rather than before it so an UNREADABLE
+        # answer is not double-counted by the `continue` above... ⚠ which means an unreadable answer
+        # is NOT counted at all, and that is a deliberate, disclosed loss: a body this code cannot
+        # parse is a body whose `usage` it also cannot trust, and `body` is out of scope in that
+        # branch by construction. The 200-with-junk case is rare and named here rather than
+        # silently rounded to zero.
+        ins, outs = usage_ledger.tokens_from(body)
+        usage_ledger.record("automation_draft", p["name"], p["model"], ins, outs,
+                            total=usage_ledger.total_from(body), st=st, user=user)
         draft, refusal = _flow_from_tool_call(args)
         if draft is None and isinstance(args, dict) and str(args.get("kind")) == "refused":
             # ⛔ A REFUSAL IS AN ANSWER, NOT A FAULT, so it does NOT fall through to a more

api/automation_engine.py

@@ -1782,12 +1782,15 @@ def clean_schedule(raw, previous=None):
 # ⛔ `terminal` IS THE DEFAULT and every existing automation gets it, because a stored definition
 # that predates this field must not start moving records on its own the day the code ships. A
 # loop is a thing somebody turns on.
-def clean_flow(raw, previous=None, notes=None):
-    """Validate the builder's ordered action list. `(flow, error)`."""
+def clean_flow(raw, previous=None, notes=None, rt=None):
+    """Validate the builder's ordered action list. `(flow, error)`.
+
+    ⚠ `rt` is the tenant wall for gated action kinds (W35-T35 / C8) and is simply forwarded.
+    """
     raw = raw if isinstance(raw, dict) else {}
     prev = previous if isinstance(previous, dict) else {}
     actions, err = clean_actions(
-        raw.get("actions") if "actions" in raw else prev.get("actions"), notes=notes)
+        raw.get("actions") if "actions" in raw else prev.get("actions"), notes=notes, rt=rt)
     if err:
         return None, err
     return {"actions": actions}, None
@@ -2062,7 +2065,7 @@ def ig_action_pinned(defn, index):
     return (defn or {}).get("kind") in DISCOVERY_KINDS and index == 0
 
 
-def clean_definition(raw, previous=None, username="", notes=None):
+def clean_definition(raw, previous=None, username="", notes=None, rt=None):
     """Whole-definition validation. Returns `(defn, error)`."""
     raw = raw if isinstance(raw, dict) else {}
     prev = previous or {}
@@ -2239,7 +2242,7 @@ def clean_definition(raw, previous=None, username="", notes=None):
         _prev_table, _prev_enrich = discovery_seed_spec(prev.get("kind"))
         flow_raw = _drop_ig_seeds(
             flow_raw, (prev.get("config") or {}).get("targetTable") or _prev_table, _prev_enrich)
-    flow, ferr = clean_flow(flow_raw, prev.get("flow"), notes=notes)
+    flow, ferr = clean_flow(flow_raw, prev.get("flow"), notes=notes, rt=rt)
     if ferr:
         return None, ferr
     # ⭐ WAVE 30 — widened with the seeder above: TikTok now HAS a pinned step 1, so the rule that
@@ -2315,6 +2318,22 @@ def clean_definition(raw, previous=None, username="", notes=None):
         "state": dict(prev.get("state") or {}),
         "created": prev.get("created") or _iso(),
         "createdBy": prev.get("createdBy") or username,
+        # ⭐⭐ WAVE 35 · T37 — `system` IS STICKY ACROSS A PATCH, AND IT IS **NEVER READ FROM `raw`**.
+        #
+        # ⛔ THE BUG THIS CLOSES WAS ALREADY WRITTEN AND WOULD HAVE SHIPPED. `routes_automation.
+        # delete_automation` refuses any stored row carrying `system`, which is what makes a seeded
+        # system agent undeletable — and this function is a WHITELIST that did not carry the key, so
+        # the FIRST EDIT of such an agent silently stripped its marker and made it deletable. The
+        # seed would then mint it again on the next list call: a delete that appears to work and
+        # undoes itself. Found by asserting the round trip rather than by reading the code.
+        #
+        # ⛔ FROM `prev` ONLY. Reading it from `raw` would let ANY caller POST
+        # `{"system": "anything"}` and mint themselves an automation nobody can delete — a
+        # privilege escalation through a field nobody validates. The flag is granted by the seeder
+        # and inherited from the stored row, never asserted by a payload.
+        # ⚠ Same shape and same reason as the pre-set FIELD flag, which DESIGN.md §4 already
+        # describes as "sticky across a PATCH". One idea, one behaviour, two objects.
+        **({"system": _s(prev.get("system"), 40)} if prev.get("system") else {}),
     }, None
 
 
@@ -2616,7 +2635,9 @@ def create(rt, raw, username="", notes=None):
     # has, instead of letting the pure validator mint a second empty one. See
     # `discover_default_table`; a target the caller named is never rewritten.
     raw = _apply_discover_default(rt, raw)
-    defn, err = clean_definition(raw, None, username, notes=notes)
+    # W35-T35 (C8): `rt=` is the tenant wall for gated action kinds. Both doors pass it; a door
+    # that forgot would REFUSE the kind, not admit it (`TENANT_GATED_ACTIONS` is fail-closed).
+    defn, err = clean_definition(raw, None, username, notes=notes, rt=rt)
     if err:
         _unmint(rt, minted)
         return None, err
@@ -2671,7 +2692,7 @@ def patch(rt, auto_id, raw, username="", notes=None):
     # config that has never carried a target through the pure validator, which mints the empty
     # `ut_ig_candidates`. `create` alone would have left the commonest path untouched.
     merged = _apply_discover_default(rt, merged)
-    defn, err = clean_definition(merged, prev, username, notes=notes)
+    defn, err = clean_definition(merged, prev, username, notes=notes, rt=rt)
     if err:
         return None, err
     defn["id"] = str(auto_id)
@@ -2987,6 +3008,21 @@ def remove(rt, auto_id):
     # that belongs to the WRITE and cannot be removed from here. What is gone is the expensive one.
     # ⚠ AND THE FALLBACK IS DELIBERATE: `all_defs` degrades to the whole read on any failure, so a
     # store that cannot project still deletes correctly, only slower.
+    #
+    # ⭐⭐ WAVE 35 · T34 — THE RESIDUAL IS NOW MEASURED RATHER THAN ASSERTED, and the count is
+    # better than the paragraph above claims. Whole `user_tables` reads per delete, against a
+    # runtime that has production's `get_projection`:
+    #     TAGGED (a discovery flow that spawned columns) → 1 whole + 1 projected
+    #     UNTAGGED (a `plain` flow)                      → 0 whole + 1 projected
+    # The untagged case pays NONE because `if not plan: return` fires before the write. The
+    # tagged case's ONE is `rt.update`'s own strict read, and it is a FLOOR, not a choice:
+    # `core/store.py::get_projection` states that a write must always read whole, because a
+    # read-modify-write handed a rows-less document would upload the tenant with its rows deleted.
+    # ⛔ Reaching ZERO needs D-179's `{flowId: [(table_key, field_key)]}` index, written where the
+    # presets are spawned — a feature, not an edit to this function. Nothing here can do better.
+    # ⚠ THOSE NUMBERS WERE UNOBSERVABLE UNTIL W35-T34: `verify_automation`'s delete-speed double
+    # had no `get_projection`, so `all_defs` fell back and the gate measured 2 and 1 — the
+    # PRE-WAVE-33 path — for two waves. The double is producer-faithful now and asserts the counts.
     try:
         import core.user_tables as _ut_defs                        # noqa: PLC0415
         _scan = dict(_ut_defs.all_defs(rt) or {})
@@ -7864,6 +7900,288 @@ def _flow_cap_reason(table_key, rt=None):
     return f". {cause}." + (f" To walk them all: {fix}." if fix else "")
 
 
+# ---------------------------------------------------------------------------------------------
+# WAVE 35 · T36 / CONTRACT C8 / OWNER RULING R10 — THE STATEMENTS BATCH: ASSEMBLE, PARK, NEVER SEND
+#
+# ⛔⛔ THE TICKET'S `how:` SAID TO USE "the board's strict review posture (wave 22)". THAT POSTURE
+# DOES NOT EXIST, and rebuilding it would REVERSE AN OWNER RULING rather than merely miss a symbol.
+# Wave 27 R3 deleted `board()`, `move_card()`, `stages_for()`, `ensure_stage_field()` and the review
+# branch of the action walk (the tombstone is above `LANE_OPS`), and its reason is a DATA reason,
+# verbatim: *"the board wrote MACHINE COLUMNS INTO A TENANT'S OWN TABLE — a stage select, an `_at`
+# stamp and a `_cycles` counter per automation — to render a view of state the RUN LOG already
+# holds."* `retire_automation_stage_fields` and `migrate_ig_tables` still DROP those columns, so a
+# batch parked in a stage field would be deleted by our own migration.
+# ⇒ The batch parks on the AUTOMATION DEFINITION, the shape `runs` and `reviews` already use. Zero
+#   machine columns on a customer's database, and the migration has nothing to take away.
+#
+# ⛔ A STATEMENTS FLOW IS **BATCH**-SCOPED, NOT RECORD-SCOPED, and that is why it does not go
+# through `apply_actions` at all. `run_plain` walks every row of the flow's bound table, so a
+# per-record arm would assemble the whole worklist once per record; and a statements agent binds NO
+# table (its customers come from the Odoo AR worklist, not a `ut_*` grid), so `run_plain` would
+# have answered `partial: "no database is bound yet"` and the step would NEVER HAVE RUN. The
+# precedent for a kind that defines its own scope is already here: the enrich-only branch below,
+# whose saved View "ARE the set of records the automation was asked to process".
+# ⚠ The `_walk` arm for this kind therefore stays a REFUSAL, not a duplicate: a `send_statement`
+# dropped into an ordinary record-walking flow must say it did nothing, never half-send.
+#
+# ⛔⛔ AND NOTHING HERE SENDS. Not one function in this section imports the mail path. The send door
+# is `routes_statements`, behind `admin_gate` + `_royal_only`, calling `collections_send.
+# queue_statement`, whose SAFE_MODE guardrail lives in the DATA LAYER where no route, payload or UI
+# can bypass it. This module ASSEMBLES and PARKS. A person clicks Send.
+
+#: How many statements one parked batch holds. Bounded for the reason `MAX_RUNS` and `MAX_REVIEWS`
+#: are: this rides inside the automation DEFINITION, and an unbounded list is a serialisation cost
+#: on every read of the automations bucket.
+#: ⚠ WHEN IT BITES IT IS DISCLOSED, never a silent `[:N]` — R6's second sentence, and
+#: [[no-unverifiable-aggregates]]. `assemble_statements` appends a note naming the number left out.
+MAX_STATEMENT_BATCH = 200
+
+#: The collection worklist loader, injectable so a gate can drive this without Odoo credentials.
+#: Production leaves it None and the real data layer answers. Same shape as `_DRAFT_CHAT`.
+_STATEMENT_ROWS = [None]
+
+
+def _collections():
+    """`modules.collections_send`, imported lazily — `platform/` is not on the path at import time
+    for every consumer of this module, and this is the only section that needs it."""
+    import modules.collections_send as cs                            # noqa: PLC0415
+    return cs
+
+
+def statement_steps(defn):
+    """The ENABLED `send_statement` actions of this flow, top level only.
+
+    ⚠ Top level only, deliberately, and `is_statement_flow` is what makes that safe: a batch flow
+    is exactly one enabled action. A `send_statement` nested inside an If is NOT a batch flow, so
+    it falls to the ordinary record walk and is refused there with a sentence.
+    """
+    return [a for a in (((defn or {}).get("flow") or {}).get("actions") or [])
+            if isinstance(a, dict) and a.get("kind") == "send_statement"
+            and a.get("enabled", True)]
+
+
+def is_statement_flow(defn):
+    """Is this automation a statements BATCH rather than a record walk?
+
+    ⛔ EXACTLY ONE ENABLED ACTION, AND IT IS THIS KIND. The narrowness is the safety: a flow that
+    also updates records has record semantics that the batch path would silently drop, so it keeps
+    the ordinary walk (where the arm refuses and says so). This mirrors the enrich-only branch in
+    `run_plain`, which is narrow for the same stated reason.
+    """
+    enabled = [a for a in (((defn or {}).get("flow") or {}).get("actions") or [])
+               if isinstance(a, dict) and a.get("enabled", True)]
+    return len(enabled) == 1 and enabled[0].get("kind") == "send_statement"
+
+
+def assemble_statements(defn, log=print):
+    """`(batch, notes)` — the statements this configuration WOULD send, rendered, plus why anybody
+    was left out. **Reads Odoo read-only. Sends nothing. Writes nothing.**
+
+    Each entry is `{customer, to, subject, html, tier, overdue}`. `html` is rendered by the SAME
+    `render_statement_html` the send door uses, so what a person approves is what goes out — a
+    review screen rendering its own approximation of the mail is a review of the wrong thing.
+
+    ⚠ A CUSTOMER WITH NO EMAIL IS *SKIPPED AND NAMED*, never dropped. `routes_statements.send`
+    already separates "we could not" from "there was nowhere to send"; this keeps that distinction
+    at the assembly end, because a batch that silently shrinks is one nobody can reconcile.
+    """
+    cfg = (statement_steps(defn) or [{}])[0].get("config") or {}
+    cs = _collections()
+    notes = []
+    loader = _STATEMENT_ROWS[0]
+    rows = list(loader() if loader else cs.load_collection_list(cs.Odoo()))
+    tier = str(cfg.get("tier") or "").strip()
+    if tier:
+        before = len(rows)
+        rows = [r for r in rows if str(r.get("Tier") or "") == tier]
+        log(f"[aios-auto] statements: {len(rows)} of {before} customers are in tier {tier}")
+    subject_tpl = str(cfg.get("subject") or "") or cs.DEFAULT_SUBJECT
+    intro_tpl = str(cfg.get("intro") or "") or cs.DEFAULT_INTRO
+    footer_tpl = str(cfg.get("footer") or "") or cs.DEFAULT_FOOTER
+    month = _dt.date.today().strftime("%B %Y")
+    batch, no_email = [], []
+    for row in rows:
+        if len(batch) >= MAX_STATEMENT_BATCH:
+            break
+        name = str(row.get("Customer") or "")
+        to = str(row.get("Email") or "").strip()
+        if not to:
+            no_email.append(name)
+            continue
+        try:
+            subject = subject_tpl.format(customer=name, company=cs.COMPANY, month=month)
+        except (KeyError, IndexError):
+            # An unknown placeholder is the person's typo, not a crash. Show what they typed —
+            # the same choice `routes_statements.preview` already makes.
+            subject = subject_tpl
+        batch.append({"customer": name, "to": to, "subject": _s(subject, 200),
+                      "html": _s(cs.render_statement_html(row, intro_tpl, footer_tpl), 40000),
+                      "tier": str(row.get("Tier") or ""), "overdue": row.get("Overdue")})
+    if no_email:
+        shown = ", ".join(no_email[:5])
+        one = len(no_email) == 1
+        notes.append(f"{len(no_email)} customer{'' if one else 's'} "
+                     f"{'has' if one else 'have'} no email address on their record and "
+                     f"{'is' if one else 'are'} not in this batch "
+                     f"({shown}{', and others' if len(no_email) > 5 else ''}). "
+                     f"Add an address in Odoo and run it again")
+    left = len(rows) - len(batch) - len(no_email)
+    if left > 0:
+        # R6's second sentence: a limit that bites is REPORTED, with its cause and what to do.
+        notes.append(f"{left} more customers matched but one batch holds "
+                     f"{MAX_STATEMENT_BATCH}. Send this batch, then run it again for the rest, or "
+                     f"narrow the tier filter")
+    return batch, notes
+
+
+def park_statements(rt, auto_id, batch, notes):
+    """Write the assembled batch onto the DEFINITION as `pendingStatements`. Replaces, never
+    appends: a batch is THIS run's worklist, and two runs' statements merged into one list is a
+    customer invoiced twice.
+
+    ⚠ `flush="async"` for the reason every writer in this module gives — the read-your-writes
+    contract means the next `GET /automations` already sees it, and only the upload is deferred.
+    """
+    entry = {"ts": _iso(), "count": len(batch), "sent": False,
+             "items": list(batch)[:MAX_STATEMENT_BATCH],
+             "notes": [_s(n, 300) for n in (notes or [])][:25]}
+
+    def _up(cur):
+        cur = cur if isinstance(cur, dict) else {}
+        d = cur.get(str(auto_id))
+        if d is not None:
+            d["pendingStatements"] = entry
+        return cur
+
+    _store_update(rt, _up, flush="async")
+    return entry
+
+
+def clear_statements(rt, auto_id):
+    """Drop a parked batch — after it is sent, or when somebody discards it."""
+    def _up(cur):
+        cur = cur if isinstance(cur, dict) else {}
+        d = cur.get(str(auto_id))
+        if d is not None:
+            d.pop("pendingStatements", None)
+        return cur
+
+    _store_update(rt, _up, flush="async")
+
+
+def run_statements(rt, defn, username="automation", log=print, step=_no_step):
+    """The batch runner: assemble, park, tell somebody. Returns `run_plain`'s 5-tuple.
+
+    ⛔ THE STATE IS `partial`, NEVER `ok`, AND THAT IS DELIBERATE. `ok` would put a green dot over
+    a job that is only half done — the statements exist and NOBODY HAS SENT THEM. `partial` is this
+    module's honest-progress state and the summary says exactly what is waiting, which is what makes
+    the run notification (`_notify_run`) read as "come and look" rather than "done".
+    """
+    if not is_statement_tenant(rt):
+        # Belt and braces behind `clean_actions`' wall: a definition stored before the wall, or
+        # copied between tenants, must not assemble another company's customer list.
+        return ("error", "statements are not configured for this workspace", {}, [], {})
+    step("reading the collection list")
+    try:
+        batch, notes = assemble_statements(defn, log=log)
+    except Exception as exc:                                          # noqa: BLE001
+        return ("error", f"the collection list could not be read: {str(exc)[:200]}", {}, [], {})
+    step("rendering statements")
+    park_statements(rt, defn.get("id"), batch, notes)
+    counts = {"statements": len(batch)}
+    if not batch:
+        return ("partial", "no customers matched, so there is nothing to review", counts, [], {})
+    one = len(batch) == 1
+    return ("partial",
+            f"{len(batch)} statement{'' if one else 's'} "
+            f"{'is' if one else 'are'} ready for review. Nothing has been sent. Open this agent "
+            f"and click Send to release them",
+            counts, [], {})
+
+
+#: ⭐⭐ WAVE 35 · T37 — THE SEEDED ROYAL IMPORTS STATEMENTS AGENT.
+#: A FIXED id, because the row's own EXISTENCE is the idempotency key (see `seed_statements_agent`).
+STATEMENTS_AGENT_ID = "system:statements"
+SYSTEM_STATEMENTS = "statements"
+#: First of the month, 06:00. A monthly statement run is what the collections worklist is for, and
+#: the hour matches the Odoo sync default so the numbers it reads are the night's.
+STATEMENTS_DEFAULT_CRON = "0 6 1 * *"
+
+
+def seed_statements_agent(rt, username="system"):
+    """Mint Royal Imports' "Monthly statements" agent ONCE, **switched OFF**. Returns the
+    definition if it wrote one, else None.
+
+    ⛔⛔ IT ARRIVES `enabled: False` AND THAT IS THE TICKET'S OWN TRAP, not a preference. An agent
+    that ships enabled has scheduled itself against real customers before a single person has read
+    its configuration — and this one's action queues mail to the tenant's actual debtors.
+
+    ⭐ WHY STORED, WHEN WAVE 34's SYSTEM AGENT IS DERIVED. `_odoo_sync_row` gives three reasons for
+    deriving and only one survives contact with THIS agent (raised as `ASK D-11`):
+      · "two copies of one cadence" — does not apply: Odoo's cadence already lives in the connector
+        config, so a stored copy could drift; a statements schedule has no other home to drift from.
+      · "stored means the failure-pause can disable it" — INVERTS: auto-pausing statements after K
+        consecutive failures is correct (a dead credential should stop it), where pausing the Odoo
+        cadence would silently break infrastructure.
+      · "nothing can seed it" — real, and answered here: ONE write per tenant ever, by the
+        CONTAINER (which is what D-195 asks for; what it forbids is a CLI writing while the Space
+        is up), behind the existence check below.
+    And deriving cannot meet T37 anyway: a derived row is not in the automations bucket, so edit,
+    toggle, schedule and run would each need a bespoke door — four new mechanisms to avoid one
+    guarded write. The Odoo agent escapes that only because a separate resync loop already does its
+    work.
+
+    ⛔ THE EXISTENCE CHECK IS THE WHOLE IDEMPOTENCY STORY, AND IT IS SAFE ONLY BECAUSE THE ROW
+    CANNOT BE DELETED. `routes_automation.delete_automation` refuses any stored row carrying
+    `system` (409, with a sentence), so "the row is present" can never become false behind our
+    back. If that refusal is ever relaxed, THIS FUNCTION NEEDS A SEPARATE DURABLE FLAG — otherwise
+    deleting the agent resurrects it on the next list call, which is a delete that undoes itself.
+    ⚠ And `system` is STICKY through `clean_definition` (see its return) for the same reason: an
+    edit that stripped the marker would make the row deletable and re-open exactly that hole.
+    """
+    if not is_statement_tenant(rt):
+        return None
+    existing = all_definitions(rt) or {}
+    if STATEMENTS_AGENT_ID in existing:
+        return None
+    raw = {
+        "name": "Monthly statements",
+        "kind": "plain",
+        # ⚠ A SCHEDULE THAT IS OFF, not an absent schedule: the cron is the CONFIGURATION T37 asks
+        # a person to open and read, and a blank one would make them invent it before they could
+        # judge it.
+        "schedule": {"cron": STATEMENTS_DEFAULT_CRON, "enabled": False},
+        "trigger": {"key": "schedule"},
+        "flow": {"actions": [{
+            "id": "act_1", "kind": "send_statement",
+            # ⚠ TIER BLANK = every tier, which is the honest default: narrowing to "A-Urgent" would
+            # be us deciding who gets chased, and the blank is the value the config panel shows as
+            # "all of them" rather than an empty box.
+            "config": {"tier": "", "subject": "", "intro": "", "footer": ""},
+        }]},
+    }
+    defn, err = clean_definition(raw, None, username, rt=rt)
+    if err:
+        return None
+    defn["id"] = STATEMENTS_AGENT_ID
+    # Stamped AFTER the clean, because `clean_definition` reads this key from `prev` only — a
+    # payload may never assert it (see that function's note).
+    defn["system"] = SYSTEM_STATEMENTS
+
+    def _up(cur):
+        cur = cur if isinstance(cur, dict) else {}
+        # ⚠ RE-CHECKED INSIDE THE MUTATION. Two concurrent list calls can both pass the read above;
+        # the store applies mutations under its own lock, so this is where "only once" is actually
+        # decided. Without it the second writer would overwrite a row a person may already have
+        # edited, silently resetting their schedule and template.
+        if STATEMENTS_AGENT_ID not in cur:
+            cur[STATEMENTS_AGENT_ID] = defn
+        return cur
+
+    _store_update(rt, _up, flush="async")
+    return defn
+
+
 def run_plain(rt, defn, username="automation", log=print, step=_no_step, rows=None):
     """⭐ WAVE 24 / R6 — the runner for an automation with NO machine step: its flow IS the whole
     automation. Returns the same 5-tuple every other runner does, so `run_now` needs no special
@@ -7878,6 +8196,14 @@ def run_plain(rt, defn, username="automation", log=print, step=_no_step, rows=No
     exact defect this module names in three other places. It reports the honest state and says
     which fact is missing.
     """
+    # ⭐⭐ WAVE 35 · T36 — THE BATCH FLOW BRANCHES BEFORE THE TABLE CHECK, and the ORDER is the
+    # whole of it. A statements agent binds no `ut_*` table (its customers come from the Odoo AR
+    # worklist), so leaving this below the `if not table` return would answer "no database is bound
+    # yet" and the step would never run — a feature that is whole, gated and unreachable, which is
+    # this repo's most-repeated failure. See the section above `run_plain` for why it is not an
+    # `apply_actions` arm.
+    if is_statement_flow(defn):
+        return run_statements(rt, defn, username=username, log=log, step=step)
     table = _flow_table(defn)
     if not table:
         return ("partial",
@@ -8617,7 +8943,7 @@ AI_AGENT_MAX_STEPS = 12
 _AI_AGENT_CHAT = [None]
 
 
-def _ai_agent_plan(cfg, row, log=print):
+def _ai_agent_plan(cfg, row, log=print, st=None, user=""):
     """A description + one record -> `(steps, "")` for `run_plan`, or `(None, sentence)`.
 
     ⭐⭐ W33-T56. This is the whole of the fuzzy step: the instruction and the record's own values
@@ -8646,6 +8972,10 @@ def _ai_agent_plan(cfg, row, log=print):
         catalog=web_only,
         required={k: v for k, v in ACTION_REQUIRED.items() if k in WEB_KINDS},
         triggers=[], tables=[],
+        # ⭐ W35 · C7 (`NOTE E-16`) — threaded IN from `_walk` rather than resolved here: this
+        # function is pure over `(cfg, row)` by design and giving it a store handle of its own
+        # would be a second way to reach the tenant.
+        st=st, user=user,
         chat=_AI_AGENT_CHAT[0])
     if why or not draft:
         return None, (why or "the assistant produced no steps for that instruction")
@@ -8865,6 +9195,30 @@ ACTION_CATALOG = [
                "history"},
     {"kind": "send_email", "label": "Send email", "group": "Connected", "ready": False,
      "detail": "Needs a send scope on the Gmail connection"},
+    # ⭐⭐ WAVE 35 · T35 / CONTRACT C8 / OWNER RULING R10 — STATEMENTS BECOME AN AGENT STEP.
+    #
+    # Owner item 14: move Statements out of Settings and into the agent automation, "templatic and
+    # easily toggleable". R10 is the half that decides the shape: the step ASSEMBLES and PARKS a
+    # batch in a review stage, and **nothing sends without a human click**. So this row's promise
+    # is deliberately "prepares", not "sends" — the label a person reads must not describe an act
+    # the step does not perform.
+    #
+    # ⛔ ADDED BESIDE `send_email`, NEVER BY REPURPOSING IT (the ticket's own trap, D-295): a
+    # stored automation naming a kind that no longer exists is refused FOREVER rather than dropped
+    # with a reason, so adding a kind is cheap and re-pointing one is not.
+    #
+    # ⛔ `ready: True` IS WHAT MAKES IT STORABLE — `clean_actions` refuses any row whose `ready` is
+    # false — and the note at `enrich_tiktok` above is the reason the RUNNER ARM lands in the same
+    # wave rather than after it: `_walk` has no terminal `else`, so a catalog row ahead of its arm
+    # is addable, storable and SILENTLY INERT, which is worse than not existing. T35 lands an arm
+    # that reports it is not configured; T36 makes it park a real batch.
+    #
+    # ⚠ TENANT-GATED, not `ready: False`: `TENANT_GATED_ACTIONS` withholds this row from every
+    # tenant but #0, because the send client behind it is env-credentialed and is tenant #0's.
+    {"kind": "send_statement", "label": "Prepare customer statements", "group": "Connected",
+     "ready": True,
+     "detail": "Assemble this month's statements and park them for review. Nothing is sent until "
+               "somebody opens the batch and clicks Send"},
     {"kind": "slack", "label": "Send Slack message", "group": "Connected", "ready": False,
      "detail": "Needs the Slack connector"},
     # ── 4. ADVANCED LOGIC ────────────────────────────────────────────────────────────────────
@@ -8905,10 +9259,63 @@ def _connector_meta(key):
     return next((dict(v) for v in TRIGGER_CONNECTOR.values() if v.get("key") == key), None)
 
 
-def action_catalog():
+#: ⭐⭐ WAVE 35 · T35 / CONTRACT C8 — THE TENANT PREDICATE `routes_statements._royal_only` USES,
+#: LIFTED SO THERE IS EXACTLY ONE COPY OF IT. C8's words are "the predicate is imported, never
+#: re-expressed", and this is the direction that import can run: `automation_engine` imports no
+#: route module and no FastAPI (checked), and breaking that to reach `_royal_only` would drag
+#: `deps` + `routes_admin` into the engine. So the ENGINE holds the test and the ROUTE calls it.
+#:
+#: ⛔⛔ THIS IS NOT `odoo_relational.is_royal`, AND THE DIFFERENCE IS A SEND. That one asks "is this
+#: tenant ENTITLED to Odoo databases" over `RI_SLUGS = ("", "royal-imports")` — it answers TRUE for
+#: the EMPTY slug and lower-cases its input. This one is `_royal_only`'s exact test: the runtime's
+#: own `key`, matched exactly. A tenant whose key never got set would pass `is_royal("")` and then
+#: queue statements THROUGH TENANT #0'S ENV-CREDENTIALED SEND CLIENT, i.e. email another company's
+#: customers over Royal Imports' name. Entitlement to READ is not authority to SEND, and the two
+#: questions keep their two predicates on purpose. Do not "unify" them.
+ROYAL_TENANT_KEY = "royal-imports"
+
+
+def is_statement_tenant(rt):
+    """Exactly `routes_statements._royal_only`'s test, as a boolean over the RUNTIME.
+
+    Keyed on the runtime, never on a request field: a tenant is a property of the SESSION, so a
+    payload cannot argue its way into another company's sender.
+    """
+    return getattr(rt, "key", None) == ROYAL_TENANT_KEY
+
+
+#: Kinds only SOME tenants may see or store, as `{kind: predicate(rt) -> bool}`.
+#:
+#: ⛔ FAIL-CLOSED ON `rt=None`, AND THAT IS THE WHOLE SAFETY ARGUMENT. Every reader below treats an
+#: absent runtime as "not allowed", so a call site that forgets to pass one makes the action VANISH
+#: rather than become universal. The opposite default would mean any future caller of
+#: `action_catalog()` or `clean_actions()` silently offers tenant #0's send door to every tenant —
+#: an omission that is invisible in review and loud only in production [[default-must-pass-its-own-guard]].
+TENANT_GATED_ACTIONS = {"send_statement": is_statement_tenant}
+
+#: The dunning buckets a statements step may filter on. ⚠ ONE LITERAL, TWO READERS: this and
+#: `routes_statements.statements()`'s `"tiers"` field are the same four strings, and a step
+#: configured against a tier the sender's worklist does not produce would filter to nothing and
+#: report success. `routes_statements` imports this rather than repeating it.
+STATEMENT_TIERS = ("A-Urgent", "B-Active", "C-Light", "Monitor")
+
+
+def _tenant_may_use(kind, rt):
+    """May this runtime see/store this action kind? Ungated kinds are always yes."""
+    gate = TENANT_GATED_ACTIONS.get(str(kind or ""))
+    return True if gate is None else bool(rt is not None and gate(rt))
+
+
+def action_catalog(rt=None):
     """The catalog as the wire carries it — a copy, because a caller that mutated the module
     constant would change every later reader's answer.
 
+    ⭐⭐ WAVE 35 · T35 (C8): `rt` filters TENANT-GATED rows out entirely — not `ready: False`, not
+    `menu: False`, but ABSENT. A tenant that may not send statements should not learn that the
+    capability exists, and `ready: False` renders as "coming soon", which is a promise we are not
+    making to them. ⚠ Called with no `rt` the gated rows are withheld (fail-closed): see
+    `TENANT_GATED_ACTIONS`.
+
     ⭐ WAVE 24 (C-ACT): each row is stamped with its `groupOrder`, DERIVED from
     `ACTION_GROUP_ORDER` rather than hand-written per row, so a group cannot be given two
     different orders by two rows that claim to be in it. A group nobody has ordered sorts LAST
@@ -8933,6 +9340,8 @@ def action_catalog():
     last = max(ACTION_GROUP_ORDER.values()) + 1
     out = []
     for a in ACTION_CATALOG:
+        if not _tenant_may_use(a.get("kind"), rt):
+            continue
         row = {**a, "groupOrder": ACTION_GROUP_ORDER.get(a.get("group"), last),
                "menu": bool(a.get("menu", True))}
         conn = _connector_meta(a.get("connector"))
@@ -9024,9 +9433,17 @@ def _action_label(act):
     return str(act.get("kind") or "Action")
 
 
-def clean_actions(raw, depth=0, _seen=None, _count=None, notes=None):
+def clean_actions(raw, depth=0, _seen=None, _count=None, notes=None, rt=None):
     """Validate `flow.actions`. Returns `(actions, error)` — refuses, never coerces.
 
+    ⭐⭐ WAVE 35 · T35 (C8) — `rt` IS THE TENANT WALL ON THE STORE SIDE, and it is a separate wall
+    from `action_catalog(rt)`'s. Withholding a row from the MENU stops it being offered; it does
+    not stop a hand-written body naming the kind, and the picker is not a security boundary
+    [[opening-a-route-widens-every-field]]. ⚠ Keyword-only in effect and defaulting to None, so
+    every existing caller is untouched by construction — the same shape `notes` used, for the
+    reason this docstring already gives about a signature change failing at RUN, not at import.
+    ⛔ `rt=None` REFUSES a gated kind rather than allowing it (`TENANT_GATED_ACTIONS`).
+
     Ids are STABLE: a caller's well-formed `id` is kept, so selecting an action in the builder
     survives a Save. A missing or colliding one is minted `act_<n>`; minting on every clean would
     move the selection under the person editing it.
@@ -9064,6 +9481,15 @@ def clean_actions(raw, depth=0, _seen=None, _count=None, notes=None):
         if not row["ready"]:
             return None, (f"{row['label']!r} is on the menu but not built yet. "
                           f"{row['detail'][0].lower()}{row['detail'][1:]}")
+        # ⭐⭐ W35-T35 (C8) — THE TENANT WALL. Refused, not dropped, and this is the one place in
+        # this function where a refusal is right: D-65's "drop, never refuse" protects a stored
+        # automation from becoming permanently unsavable, and NO tenant this can refuse has ever
+        # been able to store one — the kind is withheld from their catalog, so there is no legacy
+        # body to strand. Dropping it silently would instead let a flow save, look saved, and never
+        # do the step the person configured.
+        if not _tenant_may_use(kind, rt):
+            return None, (f"{row['label']!r} is not available in this workspace. It sends as "
+                          f"Royal Imports, using Royal Imports' own mail credentials")
         count[0] += 1
         if count[0] > MAX_ACTIONS:
             return None, f"an automation runs at most {MAX_ACTIONS} actions"
@@ -9105,7 +9531,7 @@ def clean_actions(raw, depth=0, _seen=None, _count=None, notes=None):
             if cerr:
                 return None, cerr
         cfg_raw = entry.get("config") if isinstance(entry.get("config"), dict) else {}
-        cfg, cerr = _clean_action_config(kind, cfg_raw, depth, seen, count, notes=notes)
+        cfg, cerr = _clean_action_config(kind, cfg_raw, depth, seen, count, notes=notes, rt=rt)
         if cerr:
             return None, cerr
         # ⛔ D-75 — THE ALLOWLIST'S OWN DROPS, DIFFED HERE RATHER THAN REPORTED BY EACH ARM. Every
@@ -9125,8 +9551,14 @@ def clean_actions(raw, depth=0, _seen=None, _count=None, notes=None):
     return out, None
 
 
-def _clean_action_config(kind, cfg, depth, seen, count, notes=None):
-    """One action's `config`, per kind. Returns `(config, error)`."""
+def _clean_action_config(kind, cfg, depth, seen, count, notes=None, rt=None):
+    """One action's `config`, per kind. Returns `(config, error)`.
+
+    ⚠ `rt` is threaded ONLY so the `group` arm can hand it back to `clean_actions` for the branch
+    recursion (W35-T35 / C8). Without it a tenant-gated kind is refused at the top level and
+    ACCEPTED inside an If, which is the half of a flow `_walk_actions`' own docstring says people
+    cannot see.
+    """
     if kind == "group":
         # ⭐ WAVE 24 · C-FORK (owner ruling R8) — a group is a FORK now: `{branches: [...]}`,
         # each `{id, label, cond, actions}`. It was one condition with one action list, i.e. an
@@ -9164,7 +9596,7 @@ def _clean_action_config(kind, cfg, depth, seen, count, notes=None):
             # D-75: threaded into the branch too — an unconfigured step inside an If is
             # exactly the one a person cannot see, which is `_walk_actions`' own argument.
             kids, kerr = clean_actions(br.get("actions"), depth + 1, seen, count,
-                                       notes=notes)
+                                       notes=notes, rt=rt)
             if kerr:
                 return None, kerr
             if not kids:
@@ -9229,6 +9661,34 @@ def _clean_action_config(kind, cfg, depth, seen, count, notes=None):
                               f"unique on it. It writes: " + ", ".join(sorted(clean_vals)))
             out["uniqueOn"] = unique
         return out, None
+    if kind == "send_statement":
+        # ⭐⭐ WAVE 35 · T35 / R10 — WHAT A STATEMENTS STEP IS CONFIGURED WITH: a customer filter
+        # and a template. Both are the SENDER's own vocabulary (`routes_statements.send` passes
+        # `templates: {subject, intro, footer}` straight to `collections_send.queue_statement`),
+        # so this arm names no field the send door does not already take.
+        #
+        # ⚠ EVERY TEMPLATE FIELD IS OPTIONAL AND EMPTY MEANS "THE DEFAULT", which is exactly how
+        # the send door already reads them (`t.get("subject") or cs.DEFAULT_SUBJECT`). Storing our
+        # own copy of the default instead would freeze today's wording into every stored agent and
+        # silently stop tracking `collections_send`'s.
+        out = {}
+        tier = _s(cfg.get("tier"), 40).strip()
+        # ⛔ REFUSED, NOT COERCED, AND THE ANSWER LISTS THE REAL ONES — the same shape the connector
+        # cadence uses. A tier nobody sends to would filter the batch to zero customers and report
+        # a successful run: a silent no-op is the worst outcome available here, because the person
+        # believes their customers were invoiced.
+        # ⚠ `""` IS LEGAL and means EVERY tier. It is the stored default, so an agent saved before
+        # anybody picks a filter does not change meaning the day this key arrives (D-65's rule).
+        if tier and tier not in STATEMENT_TIERS:
+            return None, (f"{tier!r} is not a collection tier. Pick one of: "
+                          + ", ".join(STATEMENT_TIERS) + ", or leave it blank for all of them")
+        out["tier"] = tier
+        for key, cap in (("subject", 200), ("intro", 4000), ("footer", 4000)):
+            out[key] = _s(cfg.get(key), cap)
+        lbl = " ".join(_s(cfg.get("label"), 60).split())
+        if lbl:
+            out["label"] = lbl
+        return out, None
     if kind in ENRICH_KINDS:
         # ⭐ WAVE 30 · T08 — BOTH networks share this branch. See `ENRICH_KINDS`: the selection, the
         # cooldown, the limit clamps and their reasons are network-agnostic, and a second copy for
@@ -10348,6 +10808,29 @@ def apply_actions(rt, defn, table_key, row_ids, username="automation", log=print
                 # the table would silently apply one action's uniqueness rule to the other's rows.
                 creates.setdefault((target, str(cfg.get("uniqueOn") or "")), []).append(vals)
                 counts["created"] += 1
+            elif kind == "send_statement":
+                # ⭐⭐ WAVE 35 · T35 / R10 — THE ARM LANDS WITH THE CATALOG ROW, ON PURPOSE.
+                #
+                # `_walk` has no terminal `else` (see the note on `enrich_tiktok` in the catalog):
+                # an unknown kind is walked, COUNTED, reports the run `ok` and writes nothing. So a
+                # catalog row whose arm arrives in a later ticket is addable, storable and silently
+                # inert — a step a person configured, that reports success and does nothing. This
+                # arm exists so that window never opens.
+                #
+                # ⛔ T35 DOES NOT SEND AND DOES NOT PARK. R10's review stage is W35-T36; until it
+                # lands this says so out loud and counts the record as blocked, which is the same
+                # shape `ai_agent` uses for a step it cannot perform. It must never fall through to
+                # "ok".
+                # ⛔ AND IT NEVER SENDS FROM HERE, in this wave or any later one. The send door is
+                # `routes_statements`, behind SAFE_MODE + `admin_gate` + the tenant gate, reached by
+                # a human click on the review batch. This arm's whole job is to PREPARE.
+                if "send_statement_pending" not in web_notes:
+                    web_notes.append("send_statement_pending")
+                    log("[aios-auto] send_statement: statements are assembled for review, not "
+                        "sent. The review batch is not configured yet, so nothing was prepared "
+                        "and nothing was sent.")
+                counts["webBlocked"] += 1
+                continue
             elif kind == "ai_agent":
                 # ⭐⭐ W33-T56 (owner item 7, ruling R3) — THE FUZZY STEP, AT RUN TIME.
                 #
@@ -10378,7 +10861,9 @@ def apply_actions(rt, defn, table_key, row_ids, username="automation", log=print
                             f"browser jobs of about 10-30 seconds each.")
                     counts["webBlocked"] += 1
                     continue
-                _plan, _why = _ai_agent_plan(cfg, row, log)
+                # W35 · C7: `st` + `user` so the model spend is attributed (`NOTE E-16`).
+                _plan, _why = _ai_agent_plan(cfg, row, log, st=rt,
+                                             user=str(defn.get("createdBy") or ""))
                 if _why:
                     # ⛔ NAMED, NEVER OPAQUE — the second half of the `done-when`. "The assistant
                     # could not work out how to do that" with the reason attached is actionable;
@@ -11770,9 +12255,16 @@ def ai_decide(rt, defn, act, row, row_id="", log=print):
               (ut_get(rt, ((defn.get("config") or {}).get("targetTable")
                            or (defn.get("trigger") or {}).get("table") or "")) or {}
                ).get("fields") or []]
+    # ⭐ W35 · CONTRACT C7 (`NOTE E-16`) — ATTRIBUTE THE SPEND. `st=` is what lets the ledger write
+    # to the right tenant's store and `user=` is who it is billed to; without them the call is
+    # counted as UNATTRIBUTED, which is a meter that reports a total nobody can act on.
+    # ⚠ `createdBy` is the honest actor here: an AI review decision is made ON BEHALF of the
+    # automation, by a scheduler, with no person at the keyboard. Naming whoever last edited it
+    # would attribute a nightly run to an editor who was asleep.
     choice, meta = ai_review.decide(prompt=cfg.get("prompt") or "", options=options,
                                     row=row, fields=[f for f in fields if f],
-                                    label=cfg.get("label") or "Review")
+                                    label=cfg.get("label") or "Review",
+                                    st=rt, user=str(defn.get("createdBy") or ""))
     if not choice:
         if meta.get("problem"):
             log(f"[aios-auto] ai review declined to answer: {meta['problem']}")

api/main.py

@@ -82,6 +82,9 @@ import routes_query  # noqa: E402  (wave 32 R1/C5 — the Query module; E's rout
 import routes_publish  # noqa: E402  (wave 33 R5/C2 — the publish door; C's router, A's line)
 import routes_brand  # noqa: E402  (wave 33 R4/C2/C6 — connector brand marks; G's router, A's line)
 import routes_slack  # noqa: E402  (wave 33 R4/C2 — Manage agent + the Slack door; D's router, A's line)
+import routes_starred  # noqa: E402  (wave 35 R4/C2/C3/C5 — the star; E's router, E's line)
+import routes_usage  # noqa: E402  (wave 35 R9/C7 — the AI usage meter; E's router, E's line)
+import routes_feedback  # noqa: E402  (wave 35 R8/C6 — feedback to the operator plane; E's router)
 from core import grid_events  # noqa: E402
 from deps import Session, module_gate  # noqa: E402
 
@@ -310,6 +313,22 @@ app.include_router(routes_brand.router)       # R4 / C2 / C6 — G's router, A's
 # file to register them in: "public" here IS the absence of `Depends(require_session)`, which is why
 # `verify_api` asserts the absence rather than an entry in a list that does not exist.
 app.include_router(routes_slack.router)       # R4 / C2 — D's router, A's line (Manage agent + Slack)
+# ⭐⭐ WAVE 35 (R4/R5/R7, contracts C2/C3/C5) — THE STAR. Mounted in the SAME change that created
+# `routes_starred.py`, which is the seventh consecutive wave in which this block is the artefact the
+# protocol nearly loses — and the first in which the router's own lane also owns `main.py`, so there
+# is no ask/mount pair to drop. `W35-T46` asserts every one of this wave's paths in
+# `app.openapi()["paths"]` and CALLS one route from each.
+# ⚠ Same placement rule as every line above: ABOVE `app.mount("/", _AppStatic(...), html=True)`, or
+# the router answers 404 on GET and 405 on POST while every one of its own tests passes.
+app.include_router(routes_starred.router)     # R4 / C2 — the star, counts, and record stars
+# ⛔ R9 SAYS THIS ROUTE REPORTS AND NEVER ENFORCES, so mounting it cannot cut anybody off — there is
+# no ceiling anywhere behind it (`usage_ledger` has no refusal in it). The one AI limit the product
+# enforces is per COLUMN and is unchanged (`ai_enrich.ceiling_report`).
+app.include_router(routes_usage.router)       # R9 / C7 — GET /usage, the one AI meter
+# ⛔ ITS TWO DOORS CARRY DIFFERENT WALLS ON PURPOSE (R8, and D-221 is the booked precedent): the
+# POST is any authenticated session's own act, the GET is `is_platform_admin` only. Mounting it does
+# not widen anything a tenant admin can reach — `verify_api` proves that by having one try.
+app.include_router(routes_feedback.router)    # R8 / C6 — feedback to the operator plane
 
 
 # --- DEPRECATED ALIASES (removed when S2's shell flips; kept so the current bundle keeps working)
@@ -472,6 +491,12 @@ def _seed_and_sync_store():
         # is D-107's own hypothesis 3: a partial population trips `MAX_SHRINK` and the rebuild
         # refuses — correctly, but for a reason that reads like a data loss scare.
         # ⚠ Same thread on purpose: it is already a daemon and nothing serves requests behind it.
+        # ⭐⭐ W35-T45 / R11 — TENANT #0'S ODOO CREDENTIAL MOVES ONTO ITS KEYCHAIN, IN THE CONTAINER.
+        # ⚠ BEFORE the relational rebuild, deliberately: the rebuild resolves its connector through
+        # `rt.odoo_source()`, so running the migration first means the very next read already goes
+        # through the keychain branch and a broken migration is visible in THIS boot's log rather
+        # than in tomorrow's. It is idempotent, so every later boot is one `list_entries` read.
+        _migrate_env_odoo("boot")
         _pull_meta("boot")
         _rebuild_odoo_relational("boot")
         # ⭐⭐ W32-T07 — owner items 13 and 15, DELIVERED. See `_sweep_automation_schemas`.
@@ -483,6 +508,35 @@ def _seed_and_sync_store():
         print(f"[aios-api] datastore seed/sync skipped: {e}")
 
 
+def _migrate_env_odoo(why):
+    """⭐⭐ W35-T45 / R11 — move tenant #0's environment Odoo credential onto its keychain.
+
+    ⛔⛔ IN THE CONTAINER, WHICH IS THE WHOLE REASON THIS IS A BOOT LINE AND NOT A SCRIPT. D-195,
+    measured three times: a developer's CLI write to the tenant store is reverted by the running
+    Space within a minute (download-modify-upload, last-write-wins) — and the write REPORTS SUCCESS
+    every time, then a fresh read confirms it, and it is gone by the next poll. A CLI migration would
+    be a dry run that lies, and what it would lie about here is a credential.
+
+    ⚠ IDEMPOTENT AND SCOPED TO TENANT #0 by `routes_keychain.env_odoo_available`, so on every other
+    tenant and on every later boot this is one `list_entries` read and a line.
+    ⚠ FAIL-QUIET: this must never take a boot down. But it is never SILENT — a skip prints its reason,
+    because "already migrated", "no keychain key on this deployment" and "the env is incomplete" are
+    three different operator actions and a blank Keychain page cannot tell them apart.
+    """
+    try:
+        import routes_keychain as _kc_routes
+        from harness import runtime as _runtime
+        rep = _kc_routes.migrate_env_odoo(_runtime.get_runtime("royal-imports"))
+        if rep.get("done"):
+            print(f"[aios-api] odoo credential migrated onto the keychain ({why}): "
+                  f"entry={rep['entry']} carried_pause={rep['carried_pause']}"
+                  + (f" PROBLEM: {rep['why']}" if rep.get("why") else ""))
+        else:
+            print(f"[aios-api] odoo keychain migration skipped ({why}): {rep.get('why')}")
+    except Exception as e:                                    # noqa: BLE001
+        print(f"[aios-api] odoo keychain migration FAILED ({why}): {type(e).__name__}: {e}")
+
+
 def _pull_meta(why):
     """Pull Meta Ads into THIS container's mirror, before the relational rebuild reads it.
 

api/routes_automation.py

@@ -91,6 +91,27 @@ def _wire(defn, tenant):
         # C3 (wave 22): the trigger config rides whole — the webhook token included, because
         # the person configuring the external caller has to be shown the URL somewhere, and
         # this payload is session-gated behind the same wall as everything else here.
+        # ⭐⭐ WAVE 35 · T36 / R10 — THE PARKED BATCH, SUMMARISED. Without this line the whole
+        # ticket would be unreachable: `_wire` is a WHITELIST, so a key the engine parks on the
+        # definition simply never arrives, and the detail pane could not know a batch was waiting
+        # ([[reachable-is-not-the-same-as-built]] — the exact shape `flow` was caught in above).
+        # ⚠ COUNT AND NOTES ONLY, NEVER `items`. A 200-statement batch carries 200 rendered HTML
+        # mails; this payload rides on the automations LIST, which every rail paint reads.
+        # `GET /admin/statements/agent/{id}` serves the detail when somebody opens the batch.
+        "pendingStatements": ({
+            "count": int((defn.get("pendingStatements") or {}).get("count") or 0),
+            "ts": (defn.get("pendingStatements") or {}).get("ts") or "",
+            "notes": list((defn.get("pendingStatements") or {}).get("notes") or [])[:25],
+        } if isinstance(defn.get("pendingStatements"), dict) else None),
+        # ⭐⭐ WAVE 35 · T37 — `system` FOR A **STORED** ROW. Until now only SYNTHETIC rows carried
+        # it, stamped by their builders AFTER this function (`_odoo_sync_row`, `_field_agent_rows`),
+        # so a stored row with the marker had it enforced on the server (`delete_automation` 409s)
+        # and INVISIBLE to the client — which paints a live-looking Delete that answers with a
+        # refusal. `AutomationDetail` already reads `automation.system` to disable that button and
+        # explain why; this is the line that lets it.
+        # ⚠ Absent stays absent rather than becoming `""`: every ordinary automation is not-a-system
+        # -agent, and an empty string is a value a client could accidentally treat as one.
+        **({"system": str(defn.get("system") or "")} if defn.get("system") else {}),
         "trigger": defn.get("trigger") or None,
         "statusNote": defn.get("statusNote") or "",
         # The one-sentence summary (airtable-brief rec 7), composed from the definition so it
@@ -550,6 +571,13 @@ def _tick_state():
 #: or delete — a new database cannot contain the legacy stage cells this retires.
 _BOARD_RETIRED = set()
 
+#: ⭐ WAVE 35 · T37 — tenants whose statements agent has been considered THIS PROCESS. Same shape as
+#: `_BOARD_RETIRED` and, like it, purely a cost saver: the DURABLE idempotency is the row's own
+#: existence, which `engine.seed_statements_agent` re-checks inside its own store mutation.
+#: ⚠ SO A RESTART RE-CHECKING IS HARMLESS BY CONSTRUCTION, which is the property to preserve. If
+#: this set were ever the only guard, a process restart would mint a second agent.
+_STATEMENTS_SEEDED = set()
+
 #: ⭐⭐ WAVE 30 · T12 — THE PICKER DEFAULT, MEMOISED. `{tenant: (stamp, table_key)}`, the shape
 #: `scope_cache` stores.
 #:
@@ -702,6 +730,20 @@ def list_automations(session: Session = Depends(_GATE)):
         # Idempotent Board retirement removes only engine-marked stage fields and legacy Board
         # state. User-created Status/Stage columns remain intact.
         engine.retire_automation_board_state(session.runtime, tables=tables)
+    # ⭐⭐ WAVE 35 · T37 / OWNER RULING R10 — ROYAL IMPORTS' STATEMENTS AGENT EXISTS BEFORE ANYBODY
+    # ASKS FOR IT. It is minted ONCE, by the container, SWITCHED OFF; every subsequent call finds
+    # it present and returns immediately. See `engine.seed_statements_agent` for why this one is
+    # STORED where wave 34's Odoo agent is derived, and why the row's existence is a sufficient
+    # idempotency key (it cannot be deleted).
+    # ⚠ GUARDED SO IT CAN NEVER TAKE THE RAIL DOWN. A tenant with no Odoo, a store mid-outage or a
+    # validator change must degrade to "no statements agent", never to a 500 on the one route the
+    # whole Agents surface polls. The same posture `_odoo_sync_row` takes for the same reason.
+    if session.tenant not in _STATEMENTS_SEEDED:
+        try:
+            engine.seed_statements_agent(session.runtime, username=session.uname or "system")
+        except Exception:                                             # noqa: BLE001
+            pass
+        _STATEMENTS_SEEDED.add(session.tenant)
     defs = engine.all_definitions(session.runtime)
     items = [_wire(d, session.tenant) for _, d in
              sorted(defs.items(), key=lambda kv: (kv[1].get("name") or "").lower())]
@@ -801,7 +843,11 @@ def list_automations(session: Session = Depends(_GATE)):
             # own reason instead of omitting them — the owner asked for Airtable's full menu, and
             # a shorter list would imply those actions do not exist. `clean_actions` REFUSES an
             # unready kind, so the faded state is a wall rather than a styling choice.
-            "actionsCatalog": engine.action_catalog(),
+            # ⭐ W35-T35 (C8): `session.runtime` is what withholds a TENANT-GATED row. Passing it
+            # here is the whole of "the menu does not offer Send statements to another tenant";
+            # the STORE-side wall is `clean_actions(rt=)`, deliberately separate, because a picker
+            # is not a security boundary [[opening-a-route-widens-every-field]].
+            "actionsCatalog": engine.action_catalog(session.runtime),
             # The builder's own vocabulary: how deep a condition tree may nest, how deep groups
             # may nest, and the ceilings. B reads these instead of hard-coding the same numbers
             # into its "+ Add condition" affordance.
@@ -1109,7 +1155,10 @@ def draft_automation(body: dict = Body(default=None), session: Session = Depends
     # filtering one and not the other describes settings for kinds the model cannot choose. That is
     # not merely untidy: it spends prompt on unreachable options and invites the model to reach for
     # one. `_ai_agent_plan` already narrows both in exactly this way; this follows it.
-    menu_catalog = [r for r in engine.action_catalog() if r.get("menu") is not False]
+    # W35-T35 (C8): tenant-gated rows are withheld here too, or the DRAFTER would offer a kind
+    # the same tenant's own save door then refuses — a flow the assistant proposes and the product
+    # will not accept.
+    menu_catalog = [r for r in engine.action_catalog(session.runtime) if r.get("menu") is not False]
     _offered = {r["kind"] for r in menu_catalog}
     draft, refusal, provider = ai_review.draft_flow(
         prompt=prompt,
@@ -1117,14 +1166,21 @@ def draft_automation(body: dict = Body(default=None), session: Session = Depends
         required={k: v for k, v in engine.ACTION_REQUIRED.items() if k in _offered},
         triggers=_triggers_vocab(session),
         tables=tables,
+        # ⭐ W35 · CONTRACT C7 (`NOTE E-16`) — the spend is ATTRIBUTED. Unlike the two engine call
+        # sites, this one has a real person behind it: somebody typed the sentence, so `user` is
+        # the caller rather than the automation's owner.
+        st=session.runtime, user=getattr(session, "uname", "") or "",
         chat=_DRAFT_CHAT[0])
     if refusal or not draft:
         raise err(400, "draft_refused", refusal or "no automation could be drafted from that")
 
     # ── C7: run the real save-door validator and DIFF it ──────────────────────────────────
     wrote = draft.get("actions") or []
+    # W35-T35 (C8): the SAME `rt` the menu was built with. Without it this validator would refuse
+    # a tenant-gated kind it had just offered the model — the draft door disagreeing with the save
+    # door about one tenant, which reads as "the assistant produced an invalid flow".
     cleaned, why = engine.clean_actions([{"kind": a.get("kind"), "config": a.get("config") or {}}
-                                         for a in wrote])
+                                         for a in wrote], rt=session.runtime)
     if why or cleaned is None:
         raise err(400, "draft_invalid",
                   f"the assistant produced a flow this deployment will not accept: {why}")

api/routes_feedback.py

@@ -0,0 +1,168 @@
+"""routes_feedback.py — WAVE 35 (ruling R8, contract C6): FEEDBACK GOES TO THE OPERATOR PLANE.
+
+R8: *"Feedback goes to the platform-wide `loopable` operator plane. No tenant sees another's, and
+the submitting tenant cannot edit or delete what it sent."*
+
+⛔⛔ TWO DOORS, TWO DIFFERENT WALLS, AND THAT ASYMMETRY IS THE WHOLE TICKET. D-221 is already on the
+register for a cross-tenant WRITE gated on `admin_gate` alone, so getting this backwards is a repeat
+rather than a novelty:
+
+    POST /feedback   ANY authenticated session, any tenant.  It is the TENANT'S OWN ACT.
+    GET  /feedback   `core.platform_admin.is_platform_admin` ONLY.  It is the OPERATOR'S read.
+
+A single wall cannot express that. Gating the write on the operator predicate would mean nobody can
+send feedback; gating the read on `admin_gate` would hand every tenant admin every other tenant's
+words. So the walls are declared per route, and `verify_api` drives BOTH from a tenant admin, a
+plain user and a platform admin rather than asserting the source.
+
+⛔ THE PROVENANCE IS STAMPED SERVER-SIDE AND NEVER READ FROM THE BODY. `tenant`, `user` and `ts`
+come from the verified session and the clock. A body-supplied tenant would let any account file
+words against another company's name, in a store only the operator reads and therefore only the
+operator could ever be misled by.
+
+⛔ NO EDIT AND NO DELETE EXIST AT ALL — not for the tenant (R8 says so) and not for the operator
+either. R8 grants the operator a READ; a delete door is a capability nobody asked for on a store
+whose whole value is that it is append-only. There is nothing here to forget to wall.
+
+⚠ ONE STORE, AND WHERE IT PHYSICALLY LIVES IS STATED RATHER THAN IMPLIED. This uses `core.store`
+with a raw key, which is the same thing `routes_platform_admin` does for `runtime.TENANTS_KEY` and
+for the same reason: a platform fact belongs in the default store, not inside any tenant's
+namespace. ⚠ That default is currently tenant #0's dataset repo (`OS_DATA_REPO`), so "the platform
+store" and "tenant #0's repo" are the same bucket today. That is pre-existing (the control plane's
+tenant records are already there) and it is a hosting fact, not a permission one — no tenant route
+can read this key, because none of them names it.
+"""
+import time
+
+from fastapi import APIRouter, Body, Depends
+
+import core.platform_admin as platform_admin
+import core.store as store
+from deps import Session, err, require_session
+
+router = APIRouter(prefix="/api/v1")
+
+#: The platform-wide bucket. `{"rows": [ {id, tenant, user, category, text, ts} ]}` — newest LAST
+#: in the store, newest FIRST on the wire.
+STORE_KEY = "platform_feedback"
+
+#: ⭐ THE CATEGORY VOCABULARY IS SERVER-OWNED AND SERVED (B's `ASK B-1 (3)`, agreed). A client
+#: constant beside a server enum drifts, and the drift shows up as a dropdown offering a value the
+#: door refuses. B renders exactly this list; the door accepts exactly these keys.
+CATEGORIES = (
+    {"key": "bug", "label": "Something is broken"},
+    {"key": "idea", "label": "An idea or a request"},
+    {"key": "data", "label": "The numbers look wrong"},
+    {"key": "speed", "label": "Something is slow"},
+    {"key": "other", "label": "Something else"},
+)
+
+MAX_CHARS = 4000
+
+#: A ceiling on the whole store. ⛔ REPORTED AT BOTH ENDS, never a silent drop: the submitter is
+#: refused with the cause, and the operator's own payload says the store is full so they can act.
+#: Dropping the OLDEST rows instead would delete the operator's earliest feedback to make room for
+#: the newest, which is the one direction this store must never move in.
+MAX_ROWS = 5000
+
+
+def _rows():
+    try:
+        raw = store.get(STORE_KEY) or {}
+    except Exception:
+        return []
+    rows = raw.get("rows") if isinstance(raw, dict) else None
+    return [r for r in rows if isinstance(r, dict)] if isinstance(rows, list) else []
+
+
+@router.get("/feedback/form")
+def feedback_form(session: Session = Depends(require_session)):
+    """What the composer renders. Any session — every account may send feedback.
+
+    ⚠ It deliberately returns NO submissions. R8 gives the tenant no read of what it sent, so a
+    "your feedback" list would be a second door to a thing the ruling closed. The 201 is the receipt.
+    """
+    return {"categories": [dict(c) for c in CATEGORIES], "maxChars": MAX_CHARS}
+
+
+@router.post("/feedback", status_code=201)
+def submit_feedback(body: dict = Body(default=None),
+                    session: Session = Depends(require_session)):
+    """Send one piece of feedback to the operator plane. `{"category": key, "text": str}`.
+
+    ⚠ ANY authenticated session, deliberately — see the header. The provenance is stamped from the
+    VERIFIED session, never from the body.
+    """
+    body = body if isinstance(body, dict) else {}
+    category = str(body.get("category") or "").strip()
+    text = str(body.get("text") or "").strip()
+    if category not in {c["key"] for c in CATEGORIES}:
+        # Named, and it names the fix: a client whose dropdown has drifted from this list is a
+        # client whose user is about to lose what they typed.
+        raise err(400, "unknown_category",
+                  "that is not one of the feedback categories. Reload the page and try again")
+    if not text:
+        raise err(400, "bad_request", "type what you want to tell us")
+    if len(text) > MAX_CHARS:
+        raise err(400, "too_long",
+                  f"feedback is limited to {MAX_CHARS:,} characters. Yours is {len(text):,}")
+    if not store.available():
+        raise err(503, "store_unavailable",
+                  "feedback could not be sent right now. Nothing was saved.")
+    if len(_rows()) >= MAX_ROWS:
+        raise err(503, "feedback_full",
+                  "the feedback store is full and we have been told. Nothing was saved, so please "
+                  "send this again later")
+    row = {
+        # ⛔ EVERY ONE OF THESE FOUR IS SERVER-SIDE. A body-supplied tenant or user would let any
+        # account file words against somebody else's name in a store only the operator reads.
+        "tenant": str(session.tenant),
+        "user": str(session.uname),
+        "ts": int(time.time()),
+        "category": category,
+        "text": text,
+    }
+    row["id"] = f"fb_{row['ts']}_{abs(hash((row['tenant'], row['user'], text))) % 10**8:08d}"
+
+    def _up(data):
+        data = data if isinstance(data, dict) else {}
+        rows = data.get("rows")
+        data["rows"] = (rows if isinstance(rows, list) else []) + [row]
+        return data
+
+    try:
+        # `flush='sync'`: a person pressed Send and is being told it landed. The coalescing mode is
+        # for autosaves nobody is waiting on.
+        store.update(STORE_KEY, _up)
+    except Exception:
+        raise err(503, "store_unavailable",
+                  "feedback could not be sent right now. Nothing was saved.")
+    return {"ok": True, "id": row["id"]}
+
+
+@router.get("/feedback")
+def list_feedback(tenant: str = "", session: Session = Depends(require_session)):
+    """R8's operator read: every tenant's feedback, newest first. PLATFORM ADMIN ONLY.
+
+    ⛔ THE WALL IS `core.platform_admin.is_platform_admin`, IMPORTED AND CALLED — the double lock
+    (the record flag AND the `loopable` tenant), never re-expressed here. A tenant admin is not
+    admitted: `role: 'admin'` is one company's authority over its own workspace, and this is every
+    company's words in one list.
+    ⚠ `?tenant=` NARROWS an already-admitted operator's view. It is a convenience, not a wall, and
+    it is applied after the gate so it can never be the thing that admits anybody.
+    """
+    if not platform_admin.is_platform_admin(session.user):
+        raise err(403, "forbidden", "this is a Loopable operator surface")
+    rows = _rows()
+    if tenant:
+        want = str(tenant).strip().lower()
+        rows = [r for r in rows if str(r.get("tenant") or "").lower() == want]
+    rows = sorted(rows, key=lambda r: int(r.get("ts") or 0), reverse=True)
+    out = {"rows": [dict(r) for r in rows], "total": len(rows), "capacity": MAX_ROWS,
+           "tenants": sorted({str(r.get("tenant") or "") for r in _rows() if r.get("tenant")})}
+    if len(_rows()) >= MAX_ROWS:
+        # R6's second sentence, aimed at the person who can act: submissions are being REFUSED right
+        # now, and the operator is the only one who can see that from here.
+        out["note"] = ("the feedback store is at capacity, so new submissions are being refused. "
+                       "Archive what you have read")
+    return out

api/routes_keychain.py

@@ -296,6 +296,114 @@ def _rel_reconnect(rt):
     return True
 
 
+# ══════════════════════════════════════════════════ W35-T45 / R11: THE ENV -> KEYCHAIN MIGRATION
+#
+# R11: *"Tenant #0's Odoo credential MIGRATES onto the keychain, with the environment kept as
+# fallback."* The owner chose this over a read-only display row WITH THE MIGRATION RISK STATED, so
+# the risk is what this block is mostly about.
+#
+# ⭐ WHAT WAS ALREADY TRUE, CHECKED BEFORE ANY OF IT WAS WRITTEN: the keychain-first-then-env
+# RESOLVER has existed since the 2026-08-04 cutover. `harness/runtime.py::odoo_source` is already
+# (1) a keychain `odoo` entry, (2) tenant #0's compiled env connector, (3) None for anybody else,
+# and `visible_entries` already serves a non-admin the row WITHOUT a preview. So R11 is not "build
+# a resolver" — it is "give tenant #0 the ROW", which is the only reason its Keychain page looks
+# empty while its Odoo grids work.
+#
+# ⛔⛔ AND THE ONE REAL HAZARD IS NOT THE CREDENTIAL, IT IS THE PAUSE FLAG. `odoo_flag_key()` returns
+# the first keychain `odoo` entry id when one exists and `ENV_ODOO_FLAG_KEY` ("odoo-env") otherwise —
+# so CREATING THE ENTRY MOVES THE ADDRESS THE PAUSE FLAG LIVES AT. A tenant #0 that was paused under
+# `odoo-env` would come back UNPAUSED, silently, at the first boot after this ships: the connector
+# resumes pulling live Odoo because a migration changed which key the freeze was stored under. That
+# is D-259's exact shape (a pause written under one key and read under another) and
+# [[a-guard-bound-to-a-role-stops-guarding-when-the-role-moves]]. The flag is carried across in the
+# SAME pass, and the carry is asserted.
+
+
+def _env_odoo_fields():
+    """The four env values `odoo_client` reads, or `(None, why)` when they are not all present.
+
+    ⛔ ALL FOUR OR NOTHING, and this completeness check is load-bearing rather than defensive.
+    Creating the entry makes `odoo_source` resolve through branch 1 INSTEAD of the env — so a
+    PARTIAL migration would hand the connector `{url, db}` and no key and take tenant #0's Odoo
+    offline, on a deployment where it had been working. The env fallback cannot save it, because the
+    entry's existence is what turns the fallback off.
+    ⚠ The names are `odoo_client.py`'s own (`ODOO_URL`/`ODOO_DB`/`ODOO_USER`/`ODOO_API_KEY`) and the
+    field names are `harness/connectors/odoo.py`'s stored shape (`{url, db, user, api_key}`). Two
+    vocabularies meet here; nowhere else.
+    """
+    want = (("url", "ODOO_URL"), ("db", "ODOO_DB"),
+            ("user", "ODOO_USER"), ("api_key", "ODOO_API_KEY"))
+    got = {field: (os.environ.get(env) or "").strip() for field, env in want}
+    missing = sorted(env for field, env in want if not got[field])
+    if missing:
+        return None, (f"the environment is missing {', '.join(missing)}, and a partial credential "
+                      f"would take this tenant's Odoo offline rather than migrate it")
+    return got, ""
+
+
+def migrate_env_odoo(rt):
+    """R11 — put tenant #0's environment Odoo credential on its keychain, once. Returns a report.
+
+    `{"done": bool, "entry": id|"", "carried_pause": bool, "why": str}` — `why` is filled on every
+    path including the skips, because "already migrated", "no keychain key on this deployment" and
+    "the env is incomplete" are three different operator actions.
+
+    ⛔⛔ IT MUST RUN IN THE CONTAINER, WHICH IS WHY `main.py` CALLS IT AND NO SCRIPT DOES. D-195,
+    measured three times: a developer's CLI write to the tenant store is reverted by the running
+    Space within a minute (download-modify-upload, last-write-wins) — and **the write reports success
+    every time**, then a fresh read confirms it, and it is gone by the next poll. A CLI migration here
+    would be a dry run that lies, and the thing it would lie about is a credential.
+
+    ⚠ FAIL-QUIET AND IDEMPOTENT. It runs on EVERY boot; the second one must be a no-op and a
+    third-party failure must not take the boot down.
+    """
+    out = {"done": False, "entry": "", "carried_pause": False, "why": ""}
+    if not env_odoo_available(rt):
+        # Not tenant #0, or this deployment has no env Odoo at all. Both are normal states.
+        out["why"] = "this tenant has no environment Odoo credential to migrate"
+        return out
+    fields, why = _env_odoo_fields()
+    if not fields:
+        out["why"] = why
+        return out
+    # ⛔ READ THE PAUSE FLAG BEFORE THE WRITE. After the entry exists, `odoo_flag_key()` answers the
+    # NEW key and the old one is unreachable through the resolver — so the only moment this fact can
+    # be observed is now. [[undo-capture-before-the-write]] applied to a guard rather than to data.
+    try:
+        was_paused = bool(((rt.get(_CONNECTOR_FLAGS_KEY) or {})
+                           .get(_ENV_ODOO_FLAG_KEY) or {}).get("paused"))
+    except Exception:                                                 # noqa: BLE001
+        was_paused = False
+    row, why = _kc().ensure_entry_of_type(
+        rt, "odoo", "Odoo (migrated from this deployment)", fields, "system")
+    if row is None:
+        out["why"] = why
+        return out
+    out["done"], out["entry"] = True, row["id"]
+    if was_paused:
+        # The freeze followed the credential. Without this the connector silently RESUMES pulling
+        # live Odoo at the first boot after the migration.
+        def _up(cur):
+            cur = cur if isinstance(cur, dict) else {}
+            entry = dict(cur.get(row["id"]) or {})
+            entry["paused"] = True
+            entry["pausedBy"] = "system"
+            entry["pausedNote"] = ("carried over from the environment source when the credential "
+                                   "was migrated onto the keychain")
+            cur[row["id"]] = entry
+            return cur
+
+        try:
+            rt.update(_CONNECTOR_FLAGS_KEY, _up, flush="sync")
+            out["carried_pause"] = True
+        except Exception as exc:                                      # noqa: BLE001
+            # ⛔ SAID OUT LOUD. A migration that moved the credential and lost the freeze is worse
+            # than one that did not run, so this is the one failure that must never be silent.
+            out["why"] = (f"the credential migrated but the PAUSE could not be carried over "
+                          f"({type(exc).__name__}), so this tenant's Odoo is no longer frozen")
+    return out
+
+
 def _own_row(session, entry_id):
     """The visible row for `entry_id`, or a 404. ⛔ A 404 rather than a 403 for an entry the
     caller cannot see: telling a member that somebody else's personal credential EXISTS is the

api/routes_query.py

@@ -355,13 +355,24 @@ def _from_chat(answer, provider):
     return answer, None, provider, None
 
 
-def _call_model(question, snapshot, model=MODEL_AUTO, chat=None, history=None):
+def _call_model(question, snapshot, model=MODEL_AUTO, chat=None, history=None, session=None):
     """Return ``(spec, said, provider, reason)`` without any source-data fallback.
 
     ``said`` is what the assistant SAID: the whole answer when it did not build a view, and the
     sentence beside the view when it built one and talked as well. ``reason`` is set only when
     something went wrong, so a prose ANSWER and a transport FAILURE are distinguishable one layer
     up rather than both arriving as a bare sentence.
+
+    ⭐⭐ W35-T31 · CONTRACT C7 (R9) — ``session`` IS HERE ONLY SO THE METER CAN BE TOLD WHOSE CALL
+    THIS WAS, and PRD amendment A1 is why it is an argument rather than ambient state: a
+    ``ContextVar`` bound in ``deps.require_session`` reads back ``None`` inside this function on the
+    SAME thread, so a ledger built on one would have recorded nothing and shown a dashboard of
+    zeros indistinguishable from a quiet week.
+
+    ⚠ OPTIONAL, DELIBERATELY. ``verify_query`` calls this function directly with an injected
+    ``chat`` and no session, and a required argument would have made every one of those calls a
+    signature change. An omitted session is COUNTED in ``usage_ledger.UNATTRIBUTED`` and reported
+    to an admin, never dropped.
     """
     requested = str(model or MODEL_AUTO).strip().lower()
     if requested not in model_choices():
@@ -384,6 +395,27 @@ def _call_model(question, snapshot, model=MODEL_AUTO, chat=None, history=None):
         return None, sentence, None, "model_unavailable" if requested != MODEL_AUTO else "not_configured"
 
     import requests
+
+    import usage_ledger
+
+    def _book(provider, body):
+        """⭐⭐ C7 — ONE LEDGER LINE PER PROVIDER RESPONSE THIS FUNCTION READS.
+
+        ⛔ HERE, INSIDE THE LADDER, AND NOT AT THE RETURN. The ladder tries providers in order and
+        a failed one has already SPENT tokens at that vendor; booking only the winner would report
+        a week cheaper than it was, which is the cost-surprise R13 cited. Every 200 this loop reads
+        gets a line, including the one whose answer turned out to be empty.
+        ⚠ `tokens_from` returns `(None, None)` when the provider did not say, and `None` is carried
+        through rather than coerced to 0 — a call booked at zero is an unmeasured call presented as
+        a free one. `usage_ledger` counts it as UNMEASURED so the total reads as a floor.
+        ⚠ `record` never raises, by its own contract, so this cannot break the assistant.
+        """
+        ins, outs = usage_ledger.tokens_from(body)
+        usage_ledger.record(
+            "assistant", provider["name"], provider["model"], ins, outs,
+            total=usage_ledger.total_from(body),
+            st=getattr(session, "runtime", None), user=getattr(session, "uname", ""))
+
     last = None
     for provider in providers:
         try:
@@ -417,7 +449,12 @@ def _call_model(question, snapshot, model=MODEL_AUTO, chat=None, history=None):
             last = f"{provider['name']}: HTTP {response.status_code}"
             continue
         try:
-            answer = response.json()["choices"][0]["message"]
+            body = response.json()
+            # C7: booked from the RAW body, before anything below can raise on its shape. A
+            # provider that answered 200 and billed for it has spent tokens whether or not this
+            # function can read what it said.
+            _book(provider, body)
+            answer = body["choices"][0]["message"]
             said = _said(answer.get("content"))
             calls = answer.get("tool_calls") or []
             if calls:
@@ -667,6 +704,11 @@ def _citation_complete(citation):
 
 def _public_view(view):
     source = view["source"]
+    # ⭐⭐ W35-T25 · CONTRACT C4 — `edited` IS DERIVED, NEVER STORED, and that is deliberate.
+    # A stored boolean beside two specs is a third source of truth that can disagree with both;
+    # the only honest answer to "has this been changed" is "compare it". It also means a Revert
+    # that restores the spec clears the badge by construction rather than by remembering to.
+    original = view.get("original_spec")
     return {
         "id": view["id"], "viewId": view["id"], "scope": source["database"],
         "name": view["name"], "description": str(view.get("description") or ""),
@@ -674,6 +716,12 @@ def _public_view(view):
         "explain": view["explain"], "threadId": view["threadId"], "createdAt": view["createdAt"],
         "virtual": True, "source": _safe(source), "view": _safe(view["view"]),
         "citationIds": list(view["citationIds"]), "numeric": _safe(view["numeric"]),
+        # ⚠ AN ARTEFACT MADE BEFORE THIS WAVE HAS NO ORIGINAL, so it reports `edited: false` and
+        # sends no `original_spec` — and the client shows neither the badge nor Revert. C4 is
+        # explicit that this is the right answer: a Revert with nothing to revert to is worse
+        # than an absent one, and it is the case an NC in `verify_query` covers.
+        "original_spec": _safe(original) if isinstance(original, dict) else None,
+        "edited": bool(isinstance(original, dict) and _safe(view["view"]) != _safe(original)),
     }
 
 
@@ -744,14 +792,88 @@ def list_queries(session: Session = Depends(require_session)):
     return _public_state(_state(session), session)
 
 
+# ⭐⭐ W35-T25 · CONTRACT C4 (owner item 4 / R3) — WHICH SPEC MEMBERS AN EDIT MAY MOVE.
+#
+# ⛔ AN ALLOW-LIST, AND IT IS THE SECURITY BOUNDARY OF THIS WHOLE TICKET. The client sends a
+# `SavedView`, a shape it composes itself, and merging it wholesale would let a caller rewrite
+# `kind` (which decides the renderer and the citation's own claim), `aggregation` (the number this
+# artefact CITED) or `name`. R3 opens the view SPEC: *"filters, sort, group, visible columns,
+# widths"*, plus the row height and column order that carry them. Nothing else.
+#
+# ⚠ `aggregation` IS DELIBERATELY ABSENT even though a person can change it on an ordinary grid.
+# The artefact's citation records `contributing_record_count` and an op computed from THIS
+# aggregation; letting an edit move it would leave a cited number describing a calculation the
+# artefact no longer performs, which is the one thing every provenance rule in this module exists
+# to prevent.
+#
+# ⚠ A COMMENT, NOT A BARE MODULE-LEVEL STRING. `verify_prose` reads a free-floating string literal
+# as candidate copy, so writing this as a `"""..."""` above the constant put an em dash into the
+# gate's own census as a 296th finding. A `#` block is out of scope by construction.
+QUERY_EDITABLE_SPEC = ("visible", "order", "widths", "filters", "filterConj", "sorts",
+                       "groupBy", "rowHeightMode", "frozenCount", "colorBy", "display")
+
+
+def _clean_spec_edit(config, spec, fields):
+    """Merge a client view config onto the artefact's spec, cleaned against ITS OWN fields.
+
+    ⛔ THE FIELD KEYS COME FROM THE STORED SOURCE, never from the request. The artefact carries
+    the snapshot's field list, so this needs no database read and cannot be widened by a caller
+    naming a column the snapshot did not have.
+    """
+    keys = {str(field.get("key")) for field in (fields or []) if isinstance(field, dict)}
+    out = copy.deepcopy(spec) if isinstance(spec, dict) else {}
+    if not isinstance(config, dict):
+        return out
+    for member in QUERY_EDITABLE_SPEC:
+        if member not in config:
+            continue
+        value = config[member]
+        if member in ("visible", "order"):
+            cleaned = [str(key) for key in value if str(key) in keys] if isinstance(value, list) else []
+            # ⚠ An EMPTY visible list is refused rather than stored: `_validate` already treats
+            # "no columns" as a refusal at creation, and a grid showing nothing is not an edit
+            # somebody meant to make.
+            if member == "visible" and not cleaned:
+                continue
+            out[member] = cleaned[:MAX_VISIBLE]
+        elif member == "widths":
+            out[member] = {str(key): int(width) for key, width in value.items()
+                           if str(key) in keys and isinstance(width, (int, float))
+                           and 0 < float(width) <= 2000} if isinstance(value, dict) else {}
+        elif member == "filters":
+            out[member] = _grid().clean_filter_tree(
+                [item for item in value if isinstance(item, dict)], keys) if isinstance(value, list) else []
+        elif member == "filterConj":
+            out[member] = "or" if value == "or" else "and"
+        elif member == "sorts":
+            out[member] = [{"colId": item["colId"], "dir": "desc" if item.get("dir") == "desc" else "asc"}
+                           for item in value if isinstance(item, dict) and item.get("colId") in keys][:3] \
+                if isinstance(value, list) else []
+        elif member in ("groupBy", "colorBy"):
+            out[member] = value if value in keys else None
+        elif member == "rowHeightMode":
+            out[member] = value if value in ("short", "medium", "tall", "extra") else None
+        elif member == "frozenCount":
+            out[member] = max(0, min(6, int(value))) if isinstance(value, (int, float)) else 0
+        elif member == "display":
+            out[member] = _grid()._clean_display(value, keys) if isinstance(value, dict) else out.get("display")
+    return out
+
+
 @router.post("/query/{qid}/events")
 def mutate_query_workspace(qid: str, body: dict = Body(default=None),
                            session: Session = Depends(require_session)):
     """The only grid-mutation transport for a virtual Query workspace.
 
-    Query artefacts are immutable snapshots: creation and changes belong to an Assistant prompt,
-    never a source-native grid workspace.  Deleting the caller's personal artefact is the one
-    permitted mutation.  The binding key, not a client-supplied source scope, identifies it.
+    ⭐⭐ W35-T25 (owner item 4 / R2) — `view_upsert` ON THE ARTEFACT ITSELF IS NOW ACCEPTED. It
+    used to 409 `query_workspace_immutable` for everything but a delete, on the reading that an AI
+    artefact is a snapshot. R2 replaces that reading: the SPEC is the reader's to shape, the
+    CITATION and the numbers behind it are not. `QUERY_EDITABLE_SPEC` above is where that line is
+    drawn, and `original_spec` is what makes the change undoable.
+
+    Creating a SECOND view inside the workspace is still refused — an artefact holds exactly one —
+    and deleting the caller's personal artefact still removes it. The binding key, not a
+    client-supplied source scope, identifies it.
     """
     qid = str(qid)
     body = body if isinstance(body, dict) else {}
@@ -772,9 +894,40 @@ def mutate_query_workspace(qid: str, body: dict = Body(default=None),
         raise err(404, "unknown_query", "that Query artefact does not exist")
 
     event_type = str(event["type"])
+    if event_type == "view_upsert":
+        sent = event.get("view")
+        sent = sent if isinstance(sent, dict) else {}
+        # ⛔ THE ID IS CHECKED THE SAME WAY THE DELETE'S IS. An upsert naming a different view is
+        # a create wearing an update's name, and a Query workspace holds exactly one view.
+        if str(sent.get("id") or "") != qid:
+            raise err(400, "query_workspace_mismatch",
+                      "a Query view edit must name the same virtual artefact as its binding")
+        spec = _clean_spec_edit(sent.get("config"), view.get("view"), (view.get("source") or {}).get("fields"))
+
+        def apply_edit(raw):
+            current = copy.deepcopy(raw) if isinstance(raw, dict) else _blank_state()
+            row = (current.get("views") or {}).get(qid)
+            if not isinstance(row, dict):
+                return current
+            # ⚠ BACKFILLED HERE, and only when absent: an artefact created before this wave has no
+            # original, and the FIRST edit is the last moment its pre-edit spec still exists. Not
+            # backfilling would leave it permanently unrevertable; backfilling unconditionally
+            # would make Revert restore the latest edit.
+            if not isinstance(row.get("original_spec"), dict):
+                row["original_spec"] = _safe(row.get("view"))
+            row["view"] = _safe(spec)
+            current["views"][qid] = row
+            return current
+
+        if not session.runtime.available():
+            raise err(503, "store_unavailable", "the tenant store is unavailable; nothing was saved")
+        session.runtime.update(_namespace_key(session), apply_edit, flush="async")
+        return {"workspaceBinding": {"kind": "query", "key": qid}, "event": event_type,
+                "view": _public_view(apply_edit(_state(session))["views"][qid])}
+
     if event_type != "view_delete":
         raise err(409, "query_workspace_immutable",
-                  "AI-created Query views change only through a new Assistant prompt")
+                  "a Query workspace holds one view, so it cannot take another")
     if str(event.get("viewId") or "") != qid:
         raise err(400, "query_workspace_mismatch",
                   "a Query delete must name the same virtual artefact as its binding")
@@ -784,6 +937,43 @@ def mutate_query_workspace(qid: str, body: dict = Body(default=None),
             "event": event_type, **deleted}
 
 
+@router.post("/query/{qid}/revert")
+def revert_query(qid: str, session: Session = Depends(require_session)):
+    """⭐⭐ CONTRACT C4 (R3) — restore the AI's original SPEC, and only the spec.
+
+    ⛔ WHAT THIS DOES NOT DO, which the client's confirm says out loud BEFORE it acts: it does not
+    undo anything the reader changed in the SOURCE database. A Query view is live now, so a cell
+    edit made through it is a real write to a real record — reverting a view's filters cannot and
+    must not walk those back. R3 is explicit that the dialog states this before it acts, because a
+    Revert that silently leaves data changed is worse than one that never offered.
+
+    ⚠ 409, not 404, when there is no original: the artefact exists and is readable, and the caller
+    asked for something that does not exist FOR IT. A 404 would say the artefact is gone.
+    """
+    qid = str(qid)
+    # ⚠ `_artifact_or_404` returns `(state, row)`, not the row. Read it as a pair.
+    _state_now, view = _artifact_or_404(session, qid)
+    original = view.get("original_spec")
+    if not isinstance(original, dict):
+        raise err(409, "no_original_spec",
+                  "this view was created before the assistant kept an original, so there is "
+                  "nothing to revert to")
+
+    def restore(raw):
+        current = copy.deepcopy(raw) if isinstance(raw, dict) else _blank_state()
+        row = (current.get("views") or {}).get(qid)
+        if not isinstance(row, dict):
+            return current
+        row["view"] = _safe(row.get("original_spec"))
+        current["views"][qid] = row
+        return current
+
+    if not session.runtime.available():
+        raise err(503, "store_unavailable", "the tenant store is unavailable; nothing was reverted")
+    session.runtime.update(_namespace_key(session), restore, flush="async")
+    return _public_view(restore(_state(session))["views"][qid])
+
+
 def _sources(body, target, session):
     raw = body.get("sources") if isinstance(body, dict) else None
     sources = [str(item).strip() for item in raw] if isinstance(raw, list) else []
@@ -826,8 +1016,10 @@ def _submit(body, session, chat=None):
     assistant_message_id = _new_id("message")
     # R16: the turns already on screen go with the question. `state` was read above, BEFORE this
     # turn's own messages exist, so the replay is strictly the prior conversation.
+    # ⭐ C7/T31: `session` rides along so the meter can attribute this call. See `_call_model`'s
+    # docstring for why it is an argument and not ambient state (PRD amendment A1).
     spec, said, provider, reason = _call_model(question, snapshot, model=selected_model, chat=chat,
-                                               history=_history(state, thread_id))
+                                               history=_history(state, thread_id), session=session)
     view, refusal, refusal_code = _validate(spec, snapshot["fields"]) if spec is not None else (None, said, reason)
 
     artifact = None
@@ -850,6 +1042,15 @@ def _submit(body, session, chat=None):
                     "question": question,
                     "explain": _explain(view, snapshot["fields"]), "createdAt": now, "source": source,
                     "view": _safe(view), "citationIds": [citation_id], "numeric": numeric,
+                    # ⭐⭐ W35-T25 · CONTRACT C4 (R3) — THE AI'S OWN SPEC, WRITTEN ONCE, HERE.
+                    # R2 makes a Query view editable, so `view` moves from now on. This is the copy
+                    # "Revert to AI original" restores, and the thing `edited` is measured against.
+                    # ⛔ WRITTEN AT CREATE AND NOWHERE ELSE. Re-stamping it on any later write would
+                    # make Revert restore the most recent edit — a Revert that reverts to nothing,
+                    # which C4 names as worse than no Revert at all.
+                    # ⚠ `_safe(view)` twice, not the same object twice: `view` is mutable and a
+                    # shared reference would let an edit rewrite the original through the alias.
+                    "original_spec": _safe(view),
                     "model": provider, "requestedModel": selected_model}
 
     assistant_message = {

api/routes_starred.py

@@ -0,0 +1,828 @@
+"""routes_starred.py — WAVE 35 (rulings R4/R5/R6/R7, contracts C2/C3/C5): THE STAR.
+
+Owner items 8, 9 and 12. **Star and "mark important" are ONE idea and ONE flag** (R4): on screen
+the word is Star, and starring an object lands it on Home and in the new Starred module. Four
+kinds are starrable — `database`, `agent`, `query`, `view` — and RECORDS get their own door
+(C5, `/starred/records`), because a record's identity is `(database, pid)` rather than a bare id.
+
+⛔⛔ THE ONE DESIGN RULE THAT DECIDES EVERYTHING BELOW: **A VIEW'S STAR IS NOT STORED HERE.**
+C2 is explicit — `kind: "view"` writes the EXISTING `config.important` in that database's own
+`<key>_table_workspace`, and never a second store. R4 says star and mark-important are one flag;
+two stores for one flag is two flags that can disagree, and the badge inside the database and the
+row on Home would then answer differently about the same view. So this file keeps THREE id lists
+(`databases`, `agents`, `queries`) in its own per-user bucket, and for views it is a READER and a
+WRITER of somebody else's bucket rather than an owner of anything.
+
+⚠ WHICH IS WHY `GET /starred` IS NOT FREE, AND EVERY CALLER MUST KNOW. Finding the starred views
+means reading each visible database's view bucket — the same N reads `routes_nav._important_counts`
+did before W35-T43 deleted it. Measured on tenant #0 (2026-08-16, recorded on that constant):
+twelve buckets cost **6.2 ms WARM in total** and **7,331 ms of first fetch COLD**. So the scan is
+budgeted, it is spent in the caller's own RECENTS order (a mark lives on a database somebody works
+in), and a database it could not reach is named in `degraded` rather than quietly carrying no star.
+That is R6's second sentence applied to a list: a limit that cannot be removed is REPORTED with its
+cause, never silently enforced. **Call this AFTER first paint.**
+
+⚠ NO INDEX, DELIBERATELY. The obvious fix for the scan is a `starred.views` id list written beside
+the three above. That is the second store C2 forbids: the moment the flag and the index can
+disagree — a view deleted, a view unmarked from inside the database, a store write that lands on one
+and not the other — the product has two answers to one question and no way to tell which is right.
+The scan is the price of one flag, and it is paid off the critical path.
+"""
+import time
+
+from fastapi import APIRouter, Body, Depends
+
+import routes_nav
+from deps import Session, err, require_session
+
+router = APIRouter(prefix="/api/v1")
+
+#: The per-user bucket holding the three ID-LIST kinds. `{username: {databases, agents, queries}}`
+#:
+#: ⚠ PER USER (R6), like `nav_recents` and unlike `nav_meta`: what I care about is not a fact about
+#: the object, so a tenant-wide star would put one person's shortlist on everybody's Home.
+_STARRED_KEY = "starred"
+
+#: The four kinds C2 declares. `view` is the odd one out — see the header.
+KINDS = ("database", "agent", "query", "view")
+
+#: The three kinds this file's own bucket holds, and the payload key each answers under.
+_LIST_KINDS = {"database": "databases", "agent": "agents", "query": "queries"}
+
+#: A bound on each id list. ⛔ REPORTED, NEVER SILENT: a POST that would cross it is refused with
+#: the cause and the action (unstar something), rather than being accepted and truncated. A star
+#: silently dropped is a star the user believes they set.
+MAX_PER_KIND = 200
+
+#: An id is a store key, a view id or an automation id — all of which are short. Bounded so a
+#: hostile client cannot grow one user's document with one very long string.
+_MAX_ID = 120
+
+#: The wall-clock ceiling on the WHOLE view scan, checked between databases — the same number and
+#: the same reason as the `_IMPORTANT_BUDGET_S` this replaces. It bounds the FIRST request after a
+#: container starts; warm it is not reached.
+VIEW_SCAN_BUDGET_S = 2.5
+
+
+def _clean_id(raw):
+    """One id, or "" — the only shape this file stores."""
+    return str(raw or "").strip()[:_MAX_ID]
+
+
+def _clean_list(raw):
+    """A stored id list, validated on the way OUT as well as in.
+
+    Re-validating a read is not redundant: the bucket outlives this code and an older build (or a
+    hand edit) could have written a shape this one does not accept. Prune, never invent — the
+    posture `_clean_nav_prefs` takes one file over.
+    """
+    if not isinstance(raw, list):
+        return []
+    out, seen = [], set()
+    for item in raw[:MAX_PER_KIND]:
+        got = _clean_id(item)
+        if got and got not in seen:
+            seen.add(got)
+            out.append(got)
+    return out
+
+
+def _read_lists(session):
+    """This caller's three id lists. A store blip answers empty rather than taking the page down."""
+    try:
+        mine = (session.runtime.get(_STARRED_KEY) or {}).get(session.uname) or {}
+    except Exception:
+        return {name: [] for name in _LIST_KINDS.values()}
+    if not isinstance(mine, dict):
+        return {name: [] for name in _LIST_KINDS.values()}
+    return {name: _clean_list(mine.get(name)) for name in _LIST_KINDS.values()}
+
+
+def _database_keys(session):
+    """`(keys, enumerated)` — every database this session may open that has a view bucket.
+
+    ⚠ `routes_nav._visible_database_keys` IS REUSED RATHER THAN RE-DERIVED, and that is not
+    tidiness: it merges the compiled registry (behind the account grant AND the tenant catalogue)
+    with `user_tables.nav_entries`, the `may_open`-filtered listing over the rows-free projection.
+    Writing a second enumeration here is how the folder-drop defect happened (wave 27, item 6): one
+    door knew about `ut_*` keys and the other did not, and the disagreeing door answered 200 while
+    storing nothing.
+    ⛔ AND IT IS NOT `_placeable_top_keys`, WHICH NEVER APPLIES THE TENANT CATALOGUE — right for a
+    cosmetic folder placement, wrong for a scan that then opens each database's view bucket. See
+    that helper's own note for the second difference (module surfaces have no views to star).
+    """
+    return routes_nav._visible_database_keys(session)
+
+
+def _scan_order(session, keys):
+    """`keys`, RECENTS-FIRST — the order the scan budget is spent in.
+
+    ⛔ THE ORDER IS LOAD-BEARING AND W34-T10 LEARNED IT THE EXPENSIVE WAY. A budget spent in
+    whatever order the keys happen to arrive is a lottery: measured cold on tenant #0, that block
+    spent all of its first draft's budget on ten EMPTY Odoo buckets and was cut off two rows before
+    `customer_data`, which holds the only marked view in the tenant. The feature would have been
+    correct and shown nothing. A star lives on a database somebody works in, and `nav_recents` is
+    exactly that list, newest first.
+    """
+    recents = routes_nav._read_recents(session.runtime, session.uname, keys)
+    order = [r["key"] for r in recents]
+    seen = set(order)
+    order += [k for k in sorted(keys) if k not in seen]
+    return order
+
+
+def _view_docs(session, order):
+    """`({key: workspace_doc}, unread)` — each database's view bucket, PROJECTED, within budget.
+
+    ⛔ PROJECTED, and the two dropped keys are what makes this affordable: `overlays` is per-record
+    cell values and `fields` is the schema stratum, neither of which says anything about a view. On
+    `customer_data` they are most of the bucket.
+    ⚠ `unread` is a store blip OR the budget — reported, never a confident absence.
+    """
+    import core.view_templates as view_templates
+    docs, unread = {}, []
+    started = time.perf_counter()
+    for key in order:
+        ws_key = view_templates.workspace_key(key)
+        if not ws_key:
+            continue                 # a module surface or a folder head, not a table at all
+        if time.perf_counter() - started > VIEW_SCAN_BUDGET_S:
+            unread.append(key)
+            continue
+        try:
+            docs[key] = session.runtime.get_projection(ws_key,
+                                                       drop=("overlays", "fields")) or {}
+        except Exception:
+            unread.append(key)
+    return docs, unread
+
+
+def _refresh_one(session, cache, key):
+    """Re-read ONE database's bucket inside a cache the caller already holds.
+
+    ⛔ THIS IS WHY A WRITE MAY REUSE A SCAN AT ALL. The star write changes exactly one bucket, so
+    every OTHER document in the cache is still true — but the one just written is stale by
+    definition, and serving it back would answer the POST with the flag's OLD value. That is a lost
+    write wearing the face of a failed read ([[refetch-eats-its-own-write]] in reverse), and it is
+    the trap that makes "just reuse the cache" wrong without this function.
+    """
+    import core.view_templates as view_templates
+    order, docs, unread = cache
+    ws_key = view_templates.workspace_key(key)
+    if not ws_key:
+        return cache
+    try:
+        docs[key] = session.runtime.get_projection(ws_key, drop=("overlays", "fields")) or {}
+    except Exception:
+        docs.pop(key, None)
+        if key not in unread:
+            unread.append(key)
+    return (order, docs, unread)
+
+
+def _scan_starred_views(session, keys=None, cache=None):
+    """`(rows, unread)` — every view this caller has starred, newest-worked database first.
+
+    A row is `{"id", "database", "name", "config"}`. ⚠ `config` is carried so the COUNTS route does
+    not have to read every bucket a second time: `_view_docs` is the expensive half of this file
+    (7,331 ms cold for twelve buckets) and two consumers asking the same question twice per request
+    is the 1+N shape D-175 spent a wave removing from `/nav`. `_starred_views` below drops it for the
+    wire.
+
+    ⛔ `cache` IS `(order, docs, unread)` FROM AN EARLIER PASS IN THE SAME REQUEST, and it exists
+    because the view-star WRITE otherwise scanned every bucket TWICE: once in `_find_view` to locate
+    the view, then again to build the answer. That is the same 1+N shape, in the same file, on the
+    same expensive read — introduced an hour after it was removed one function away. A caller that
+    has written must `_refresh_one` the database it wrote before passing its cache.
+    """
+    if cache is not None:
+        order, docs, unread = cache
+    else:
+        if keys is None:
+            keys, _ = _database_keys(session)
+        order = _scan_order(session, keys)
+        docs, unread = _view_docs(session, order)
+    granted = routes_nav._granted_view_ids(session)
+    out = []
+    for key in order:
+        doc = docs.get(key)
+        if doc is None:
+            continue
+        for vid, view in routes_nav._visible_views(doc, session.uname, session.admin,
+                                                   granted).items():
+            cfg = view.get("config") or {}
+            if cfg.get("important") is True:
+                out.append({"id": vid, "database": key,
+                            "name": str(view.get("name") or vid)[:120], "config": cfg})
+    return out, unread
+
+
+def _starred_views(session, keys=None, cache=None):
+    """The C2 wire rows — `{"id", "database", "name"}`, with the config dropped.
+
+    ⭐ `name` is a SUPERSET of C2, published to B as `NOTE E-1`: the scan already holds the record,
+    so the name is free, and without it Home would render a starred view as a bare id.
+    ⛔ THE CONFIG DOES NOT GO ON THE WIRE. It carries `memberPids` (a curated view's whole pid list)
+    and every filter leaf, which is somebody's row set travelling to a client that asked for a label.
+    """
+    rows, unread = _scan_starred_views(session, keys, cache=cache)
+    return ([{"id": r["id"], "database": r["database"], "name": r["name"]} for r in rows],
+            unread)
+
+
+def _query_names(session, qids):
+    """`({qid: name}, resolved)` for the caller's own Query artefacts.
+
+    ⭐ ANSWERS `ASK B-1 (2)`. C2 declares `queries: [qid]` and there is no view/query id -> label map
+    anywhere in the client, so Home and Starred would render a starred Query as a bare id. B's only
+    alternative was `GET /query`, which drags threads, messages, citations and every saved view
+    across the wire to render two strings.
+
+    ⚠ IT READS LANE C's BUCKET AND CALLS LANE C's HELPERS, WITHOUT EDITING LANE C's FILE. Query
+    state is ONE small per-user document (`query_user_<hash>`: threads, messages, citations, views —
+    no grid rows), and `_namespace_key`/`_state` are pure functions of the session. Re-deriving the
+    key here would be a second spelling of a hash, which is the one thing guaranteed to drift.
+
+    ⛔ `resolved` IS FALSE WHEN THE READ FAILED, and the caller must not prune on it — a store blip
+    would otherwise delete somebody's whole starred-query list. Same posture as
+    `_clean_nav_prefs(keep_unknown_ut=...)`.
+    """
+    if not qids:
+        return {}, True
+    try:
+        import routes_query
+        views = (routes_query._state(session) or {}).get("views") or {}
+    except Exception:
+        return {}, False
+    out = {}
+    for qid in qids:
+        row = views.get(qid)
+        if isinstance(row, dict):
+            out[qid] = str(row.get("name") or qid)[:120]
+    return out, True
+
+
+def _payload(session, keys=None, cache=None):
+    """The C2 answer: the three id lists, the starred views, and what could not be read.
+
+    ⚠ `degraded` SHIPS AS `[]` RATHER THAN BEING OMITTED WHEN EMPTY — the same rule `/nav`'s
+    `omitted`/`degraded` follow, for the same reason: a key a consumer has to test for is a key a
+    consumer forgets to test for.
+    ⚠ `cache` is a scan an earlier pass in THIS request already paid for — see `_scan_starred_views`.
+    """
+    lists = _read_lists(session)
+    if keys is None:
+        keys, _ = _database_keys(session)
+    # ⚠ PRUNED ON READ, NEVER ON WRITE — `_read_recents`' posture, and both halves are deliberate.
+    # A database whose grant was revoked must stop being offered without anybody running a
+    # migration, and must come back if the grant does. A key that is not visible therefore reaches
+    # the store and never reaches a screen.
+    # ⚠ ONLY `databases` is pruned. An agent id or a query id would each cost another store read to
+    # validate, and pruning them here buys nothing: this list is the CALLER'S OWN writes, so it can
+    # disclose nothing they did not already know, and B/C render only objects they can already see
+    # (the way `groupRecents` drops an unreachable recent). Said out loud rather than left as a gap.
+    lists["databases"] = [k for k in lists["databases"] if k in keys]
+    # ⭐ ASK B-1 (2): the names, and — because the read that answers "what is it called" also answers
+    # "does it still exist" — the same prune the databases get. ⛔ ONLY WHEN THE READ SUCCEEDED: a
+    # store blip that returned no artefacts must not delete the whole starred-query list.
+    qnames, qresolved = _query_names(session, lists["queries"])
+    if qresolved:
+        lists["queries"] = [q for q in lists["queries"] if q in qnames]
+    views, unread = _starred_views(session, keys, cache=cache)
+    out = {"databases": lists["databases"], "agents": lists["agents"],
+           "queries": lists["queries"], "queryNames": qnames,
+           "views": views, "degraded": unread}
+    if unread:
+        # R6's second sentence, in the payload: the CAUSE and what it means, not a bare list.
+        out["note"] = (f"{len(unread)} database(s) could not be read in time, so a view you "
+                       f"starred there is missing from this list. Open one of them once and the "
+                       f"next load will include it")
+    return out
+
+
+@router.get("/starred")
+def starred(session: Session = Depends(require_session)):
+    """C2 — everything this caller has starred.
+
+    ⚠ NOT ON `/nav`'s PATH, and R7 is the ruling: `/nav` is a rows-free projection whose budget was
+    already the subject of D-175/D-185/D-288. This route is called AFTER Home/Starred paint.
+    """
+    return _payload(session)
+
+
+def _find_view(session, vid, database=""):
+    """`(key, ws_key, stratum, view, cache)` for a view this caller can SEE, else None.
+
+    `stratum` is the username whose block holds it, or `table_store.SHARED_KEY`. `cache` is the
+    `(order, docs, unread)` this call paid for — but **only when it scanned everything**. With a
+    `database` hint it read ONE bucket, which is not a complete answer for the caller's whole
+    starred list, so it hands back None and the caller pays for a full pass. Handing back a partial
+    cache would silently drop every starred view on every OTHER database.
+
+    ⚠ `database` IS AN OPTIONAL FAST PATH (a superset of C2, published to B and C): the client
+    almost always knows which database the view belongs to, and naming it turns an N-bucket scan
+    into one read. Absent, the scan runs — because C2's body carries only `kind`/`id`/`on`, and a
+    door that REQUIRED the hint would break the contract two lanes are building against.
+    """
+    import core.table_store as table_store
+    import core.view_templates as view_templates
+
+    keys, _ = _database_keys(session)
+    if database:
+        # An unknown or invisible key must not become a wider scan. It answers "not found", which
+        # is the same answer an id nobody holds gets — see the write door's note on why.
+        if database not in keys:
+            return None
+        order, cache = [database], None
+    else:
+        order = _scan_order(session, keys)
+    docs, unread = _view_docs(session, order)
+    if not database:
+        cache = (order, docs, unread)
+    granted = routes_nav._granted_view_ids(session)
+    for key in order:
+        doc = docs.get(key)
+        if doc is None:
+            continue
+        if str(vid) not in routes_nav._visible_views(doc, session.uname, session.admin, granted):
+            continue
+        ws_key = view_templates.workspace_key(key)
+        # WHICH stratum holds it decides the WALL, so it is resolved here rather than guessed.
+        # Personal first: a caller's own block is the common case and needs no grant.
+        if isinstance(doc.get(session.uname), dict) and \
+                str(vid) in ((doc[session.uname].get("views") or {})):
+            return (key, ws_key, session.uname, doc[session.uname]["views"][str(vid)], cache)
+        shared = (doc.get(table_store.SHARED_KEY) or {}).get("views") or {}
+        if str(vid) in shared:
+            return (key, ws_key, table_store.SHARED_KEY, shared[str(vid)], cache)
+        for stratum, blob in doc.items():
+            if stratum == session.uname or not isinstance(blob, dict):
+                continue
+            if str(vid) in (blob.get("views") or {}):
+                return (key, ws_key, str(stratum), blob["views"][str(vid)], cache)
+    return None
+
+
+def _may_star_view(session, stratum, view):
+    """May this caller WRITE the star on this view? Fail-closed.
+
+    ⛔ A VIEW ID THE CALLER CANNOT WRITE MUST REFUSE **LOUDLY**, and this is a standing scar:
+    `view_upsert` answers **200 while writing nothing** when the id belongs to a view the caller
+    cannot see, so a pinned id is effectively tenant-scoped and every symptom of it is silent
+    ([[a-view-id-another-user-holds-refuses-silently]]). This function is the reason the write door
+    below raises instead of shrugging.
+
+    THREE HOMES, THREE WALLS:
+      · the caller's OWN stratum — theirs, no further question;
+      · `__shared__` — `table_store._may_edit`, which is the predicate the view door itself uses;
+      · another user's stratum, reached by a wave-21 grant — the grant must be `edit` or `owner`.
+        ⚠ A `view` ROLE IS NOT A WRITE GRANT. `_granted_view_ids` admits both roles because it
+        answers "can they SEE it"; this answers "may they CHANGE it", and collapsing the two would
+        let a read-only grantee mark somebody else's shared view.
+    """
+    import core.shares as shares
+    import core.table_store as table_store
+    if stratum == session.uname:
+        return True
+    if stratum == table_store.SHARED_KEY:
+        return bool(table_store._may_edit(view, session.uname, session.admin))
+    return shares.role_for("view", str((view or {}).get("id") or ""), session.uname,
+                           is_admin=session.admin,
+                           st=session.runtime) in ("edit", "owner")
+
+
+def _write_view_star(session, ws_key, stratum, vid, on):
+    """Set `config.important` IN PLACE, in the view's own bucket. Returns True when it landed.
+
+    ⛔⛔ IN PLACE, AND **NOT** THROUGH `grid_events.view_upsert` OR `table_store.save_view` — three
+    separate reasons, each of which has cost this repo something:
+
+      1. `view_upsert` REBUILDS `config` from a literal allowlist and filters `memberPids` against
+         `allowed_pids` and `cohortLock` against `cohort_ids`. Routing a flag toggle through it
+         means a cohort view whose pool this request did not assemble comes back with its curated
+         row set pruned — "the 40 accounts we agreed to call" quietly becoming fewer, under the
+         same name, with nothing going red.
+      2. `table_store.save_view` re-runs `_unique_name` against every view name in the document.
+         A star has no business re-allocating a name; a collision would RENAME the starred view.
+      3. Both are "write the whole view" doors. This writes one boolean.
+
+    ⚠ SET UNCONDITIONALLY, never "only when True" — `grid_events` records the same rule beside its
+    own `important` line: a key written only when present means unstarring is silently a no-op and
+    the stored `true` survives, i.e. a mark you can set and never clear.
+    ⚠ `bool(on)`, so a JSON `"false"` cannot become a star.
+    ⚠ FLUSH IS THE DEFAULT (sync). This is a deliberate one-at-a-time act like a folder rename, not
+    the autosave hot path `table_store` uses `async` for — and a coalesced write is exactly what
+    made eighteen 200s land zero rows in wave 33.
+    """
+    landed = {"ok": False}
+
+    def _up(data):
+        data = data if isinstance(data, dict) else {}
+        block = data.get(stratum)
+        if not isinstance(block, dict):
+            return data
+        views = block.get("views")
+        if not isinstance(views, dict) or str(vid) not in views:
+            return data
+        view = views[str(vid)]
+        if not isinstance(view, dict):
+            return data
+        cfg = view.get("config")
+        if not isinstance(cfg, dict):
+            cfg = {}
+            view["config"] = cfg
+        cfg["important"] = bool(on)
+        landed["ok"] = True
+        return data
+
+    session.runtime.update(ws_key, _up)
+    return landed["ok"]
+
+
+@router.post("/starred")
+def set_starred(body: dict = Body(default=None),
+                session: Session = Depends(require_session)):
+    """C2 — star or unstar ONE object, and answer with the caller's whole new list.
+
+    Body: `{"kind": "database"|"agent"|"query"|"view", "id": str, "on": bool}`, plus an OPTIONAL
+    `"database"` when `kind` is `view` (the fast path — see `_find_view`).
+
+    ⚠ THE WHOLE LIST COMES BACK, not an ack, because the client is optimistic-then-reconciled
+    (T15): an ack would leave the browser as the only place that knows what the new state is.
+    """
+    body = body if isinstance(body, dict) else {}
+    kind = str(body.get("kind") or "").strip()
+    oid = _clean_id(body.get("id"))
+    if kind not in KINDS:
+        raise err(400, "bad_request",
+                  f"kind must be one of {', '.join(KINDS)}")
+    if not oid:
+        raise err(400, "bad_request", "no object was named")
+    if "on" not in body or not isinstance(body.get("on"), bool):
+        # Explicit rather than defaulted: a toggle whose default is "star" turns a malformed
+        # unstar into a star, which is the one direction a user cannot undo by repeating it.
+        raise err(400, "bad_request", "`on` must be true or false")
+    on = bool(body["on"])
+    if not session.runtime.available():
+        raise err(503, "store_unavailable",
+                  "the tenant store is unavailable. Nothing was saved.")
+
+    if kind == "view":
+        found = _find_view(session, oid, _clean_id(body.get("database")))
+        if not found:
+            # ⛔ 404 FOR BOTH "no such view" AND "not yours to see", deliberately: a distinct answer
+            # would turn this route into an oracle that sorts real view ids from invented ones.
+            raise err(404, "unknown_view", "that view is not available")
+        db_key, ws_key, stratum, view, cache = found
+        if not _may_star_view(session, stratum, view):
+            raise err(403, "forbidden",
+                      "that view belongs to somebody else and you have read access only")
+        try:
+            landed = _write_view_star(session, ws_key, stratum, oid, on)
+        except Exception:
+            raise err(503, "store_unavailable",
+                      "the star was not saved: the store refused the write.")
+        if not landed:
+            # The view moved between the read and the write (deleted, shared, unshared). Loud,
+            # because a 200 over a write that changed nothing is the defect this file's own
+            # `_may_star_view` note is about.
+            raise err(409, "view_moved",
+                      "that view changed while the star was being saved. Try again")
+        # ⛔ REUSE THE SCAN, REFRESH THE ONE BUCKET WE WROTE. Without this the POST scans every view
+        # bucket TWICE — once to find the view, once to build the answer — which is the 1+N shape
+        # this file removed from `/starred/counts` an hour earlier, reintroduced by the write path.
+        # ⚠ `_refresh_one` is not optional: the written document is stale by definition and serving
+        # it back would answer the POST with the flag's OLD value.
+        if cache is not None:
+            cache = _refresh_one(session, cache, db_key)
+        return _payload(session, cache=cache)
+
+    field = _LIST_KINDS[kind]
+    uname = session.uname
+    # ⛔ THE CAP IS ENFORCED INSIDE THE TRANSACTION, NOT BY A READ BEFORE IT, AND THAT IS NOT
+    # PEDANTRY. A pre-flight `len(current) >= MAX_PER_KIND` check is advisory: two concurrent stars
+    # both pass it, both append, and the document ends up at MAX+1 — where `_clean_list`'s
+    # `raw[:MAX_PER_KIND]` then drops one **on the next read**. That is a star the user set, saw
+    # confirmed, and cannot find, which is exactly the silent truncation R6's second sentence
+    # forbids. Refusing inside the read-modify-write makes the ceiling true rather than likely.
+    # ⚠ IT RECORDS THE REFUSAL RATHER THAN RAISING FROM INSIDE `_up`: an exception thrown through
+    # `store.update` would surface as this route's own 503 "the store refused the write", which is a
+    # different and wrong story about a limit the caller can act on.
+    refused = {"full": False}
+
+    def _up(data):
+        data = data if isinstance(data, dict) else {}
+        mine = dict(data.get(uname) or {}) if isinstance(data.get(uname), dict) else {}
+        ids = _clean_list(mine.get(field))
+        if on:
+            if oid not in ids:
+                if len(ids) >= MAX_PER_KIND:
+                    refused["full"] = True
+                    return data
+                ids.append(oid)
+        else:
+            ids = [i for i in ids if i != oid]
+        if ids:
+            mine[field] = ids
+        else:
+            mine.pop(field, None)
+        # A user with nothing starred is REMOVED rather than stored empty — a bucket that
+        # accumulates `{}` per account is a document that grows forever and says nothing.
+        if mine:
+            data[uname] = mine
+        else:
+            data.pop(uname, None)
+        return data
+
+    try:
+        session.runtime.update(_STARRED_KEY, _up)
+    except Exception:
+        raise err(503, "store_unavailable",
+                  "the star was not saved: the store refused the write.")
+    if refused["full"]:
+        # R6's second sentence: the cause and the action, never a 200 over a star that was dropped.
+        raise err(400, "starred_full",
+                  f"you have starred the maximum of {MAX_PER_KIND} items of this kind. "
+                  f"Unstar one to make room")
+    return _payload(session)
+
+
+# ══════════════════════════════════════════════════════════════════ STARRED COUNTS (R7, C3)
+#
+# ⭐ R7: *"Row counts come from a NEW on-demand endpoint called after Home/Starred paint, never from
+# `/nav`. A view whose count is not free shows the CAUSE, never an invented number."*
+#
+# ⛔ SO EVERY VID LANDS IN EXACTLY ONE OF `counts` AND `notes`, AND THAT IS THE CONTRACT (C3). A vid
+# in neither is a client rendering nothing with no idea why; a vid in both is two answers to one
+# question. `notes` is not a fallback for "we did not get round to it" — it is the CAUSE, in a
+# sentence, with what to do about it, which is R6's second sentence applied to a badge.
+
+
+def _cohort_sizes(session, key, cache):
+    """`{cohort_id: size}` for THIS caller's own cohorts on `key`'s topic. Memoised per request.
+
+    ⛔ THIS CALLER'S OWN COHORTS ONLY, and the consequence is deliberate: a SHARED view locked to a
+    cohort somebody else owns finds no id here, so it is reported UNCOUNTED with that cause rather
+    than counted out of a stratum this session cannot see. Widening the read would make the number
+    disclose the SIZE of another person's private list, which is a leak wearing a bug fix.
+    ⚠ Read through `session.runtime`, NOT `modules.cohort`'s module-level helpers: those call
+    `core.store` directly and carry no tenant namespace. The MODULE is asked for the bucket NAME (it
+    owns that rule) and this route does the reading, which is the only tenant-correct combination.
+    """
+    import core.view_templates as view_templates
+    import modules.cohort as cohort_mod
+    ws_key = view_templates.workspace_key(key) or ""
+    suffix = "_table_workspace"
+    scope = ws_key[:-len(suffix)] if ws_key.endswith(suffix) else key
+    if scope in cache:
+        return cache[scope]
+    try:
+        bucket = session.runtime.get(cohort_mod.key_for(scope)) or {}
+        mine = bucket.get(session.uname) or {}
+        cache[scope] = {str(cid): len(c.get("members") or [])
+                        for cid, c in mine.items() if isinstance(c, dict)}
+    except Exception:
+        cache[scope] = {}
+    return cache[scope]
+
+
+def _count_note(cfg, cohorts):
+    """WHY this view's size is not free, as one sentence naming a cause AND a next step.
+
+    ⛔ R6's SECOND SENTENCE IS THE SPEC HERE, and a bare dash is the thing it forbids. D-253 was
+    booked once already for a limit whose explanation was hover-only, so this has to be a real
+    sentence a client can put in a `title` AND an `aria-label`.
+    ⚠ THREE DIFFERENT CAUSES, not one generic apology. A view locked to somebody else's list, a
+    filtered view and a whole-table view are three different facts, and only one of them is
+    something the reader can act on.
+    """
+    cfg = cfg if isinstance(cfg, dict) else {}
+    lock = str(cfg.get("cohortLock") or "").strip()
+    if lock:
+        return ("This view is locked to a list owned by somebody else, so its size is not "
+                "something your account can read. Ask whoever shared it.")
+    if cfg.get("filters"):
+        return ("Counting a filtered view means reading every record, which this page does not "
+                "do. Open the database and the number is beside the view.")
+    return ("This view covers the whole database, so its size is the record count. Open the "
+            "database to see it.")
+
+
+@router.get("/starred/counts")
+def starred_counts(session: Session = Depends(require_session)):
+    """C3 — `{"counts": {vid: int}, "notes": {vid: str}, "degraded": [key]}`.
+
+    ⛔ CALLED AFTER THE PAGE PAINTS, NEVER FROM `/nav` (R7). `/nav` is a rows-free projection whose
+    budget was the subject of D-175, D-185, D-288 and D-289; W35-T43 takes the last of that off it,
+    and putting a counting pass back on the nav's path would undo the whole point.
+
+    ⚠ THE COUNTER IS `routes_nav._view_record_count`, CALLED — not a second implementation. It is the
+    one function that knows which shapes are free (a cohort lock resolves to a stored member list; a
+    curated `memberPids` carries its own length) and returns None for everything else. A second
+    counter here would be free to disagree with the badge inside the database.
+    """
+    rows, unread = _scan_starred_views(session)
+    cache, counts, notes = {}, {}, {}
+    for row in rows:
+        cfg, key, vid = row["config"], row["database"], row["id"]
+        sizes = _cohort_sizes(session, key, cache)
+        n = routes_nav._view_record_count(cfg, sizes)
+        # ⛔ EXACTLY ONE OF THE TWO MAPS (C3). The `if/else` is what makes that structural rather
+        # than a rule somebody has to remember: there is no path that writes both and none that
+        # writes neither.
+        if isinstance(n, int):
+            counts[vid] = n
+        else:
+            notes[vid] = _count_note(cfg, sizes)
+    return {"counts": counts, "notes": notes, "degraded": unread}
+
+
+# ══════════════════════════════════════════════════════════════════ RECORD STARS (R5/R6, C5)
+#
+# ⭐ R5: *"Records get their own star, feeding an undeletable 'Starred records' view beside
+# 'All records' on every database."* R6: *"Record stars are PER USER, in the same per-username
+# stratum views already live in."*
+#
+# ⛔⛔ THE ID LIST IS ITS OWN KEY IN THAT STRATUM AND IT DOES NOT TRAVEL THROUGH THE VIEW DOOR.
+# D-170, measured: on a read-through grid a VIEW WRITE answers **409 `window_required`** —
+# `/grid/events` -> `routes_tables.ut_write_ctx` -> `scoped_pids` -> `scoped_pool` ->
+# `routes_odoo_tables.whole_pool` raises `TooBigToMaterialise`, because the shared read/write
+# assembly insists on the pid set. `ut_odoo_order_lines` (255,286 rows) and `ut_odoo_gl_lines`
+# (971,034) serve rows through a window correctly and refuse every view-config write. A record star
+# stored inside a view record would therefore be IMPOSSIBLE on exactly the two biggest databases in
+# the tenant. This writes one key in the workspace bucket and touches no pid set, so it answers 200
+# there.
+#
+# ⚠ AND FOR THE SAME REASON IT DOES NOT VALIDATE THE ID AGAINST THE ROW SET. Checking that a pid
+# exists means materialising the pool, which is the 409 again. `/nav/opened` takes the identical
+# posture and says why: the WRITE is cheap and unvalidated, the READ is what prunes — a client
+# intersects `memberPids` with the rows it can see, exactly as a cohort already does
+# (`aios_grid.workspace_wire` drops absent members and reports `missing`).
+
+#: The per-user key inside `<database>_table_workspace`. BESIDE `views`, never inside one (R6).
+_RECORDS_KEY = "starredRecords"
+
+#: The pinned id of the projected view. ⚠ C's rail pins this too (W35-T30) — it is a WIRE constant,
+#: so it is exported rather than spelled twice.
+STARRED_VIEW_ID = "starred-records"
+STARRED_VIEW_NAME = "Starred records"
+
+#: A bound per (user, database). Reported on overflow, never silently enforced.
+MAX_STARRED_RECORDS = 500
+
+
+def _record_ids(doc, uname):
+    """This caller's starred record ids on ONE database, validated on the way out.
+
+    ⛔ INTS, AND A NON-DIGIT ID IS NOT STORED. Every record identity in this product is a digit
+    string — a pool `pid` is an int and a `ut_*` row key is `str(record_id).isdigit()` — and the
+    CLIENT's view engine reads `memberPids` as numbers (a cohort's members are ints). A mixed list
+    would make the projection match nothing on the rows it was built for, silently.
+    """
+    raw = (doc.get(uname) or {}).get(_RECORDS_KEY) if isinstance(doc.get(uname), dict) else None
+    if not isinstance(raw, list):
+        return []
+    out, seen = [], set()
+    for item in raw[:MAX_STARRED_RECORDS]:
+        try:
+            pid = int(item)
+        except (TypeError, ValueError):
+            continue
+        if pid not in seen:
+            seen.add(pid)
+            out.append(pid)
+    return out
+
+
+def records_view(ids):
+    """The **"Starred records"** view, as a SavedView — or None when nothing is starred.
+
+    ⭐ THE SERVER HANDS C THE WHOLE OBJECT (C5) rather than a bare id list, so the rail cannot grow
+    a second idea of what this view is. `kind: 'system'` and `locked: True` are what make it
+    undeletable, the same two facts that protect `all-customers`.
+
+    ⛔ `memberPids` IS THE WHOLE MECHANISM: it makes this a CURATED ROW SET, which is the one shape
+    `routes_nav._view_record_count` can count for FREE — no rows read, no filter run. That is why C3
+    can put a real number beside it and why R7's counts endpoint costs nothing here.
+    ⚠ None WHEN EMPTY, not an empty view: a view listing zero records under a name promising some is
+    the shape D-229 was booked for. C shows the row only when there is something in it.
+    """
+    pids = [int(p) for p in (ids or [])]
+    if not pids:
+        return None
+    return {
+        "id": STARRED_VIEW_ID,
+        "name": STARRED_VIEW_NAME,
+        "kind": "system",
+        "locked": True,
+        "note": "The records you starred on this database. Only you can see this list.",
+        "config": {"filters": [], "filterConj": "and", "sorts": [], "groupBy": None,
+                   "colorBy": None, "rowHeightMode": "short", "order": [], "visible": [],
+                   "widths": {}, "memberPids": pids},
+    }
+
+
+def _database_or_refuse(session, key):
+    """The workspace bucket for a database this caller may OPEN, or a refusal.
+
+    ⚠ THE SPLIT IS `routes_nav.nav_schema`'s, COPIED IN SHAPE RATHER THAN INVENTED: a `ut_*`
+    database is walled by `user_tables.may_open` (its creator or an admin or a grantee), and a
+    built-in module by `session.require`, which would 403 every `ut_` key because a user table is
+    deliberately not a module.
+    """
+    import core.view_templates as view_templates
+    ws_key = view_templates.workspace_key(key)
+    if not ws_key:
+        raise err(404, "unknown_database", "that database is not available")
+    if key.startswith("ut_"):
+        import core.user_tables as user_tables
+        if not user_tables.may_open(key, session.uname, session.admin, st=session.runtime):
+            raise err(403, "forbidden", "that database belongs to another user")
+    else:
+        session.require(key)
+    return ws_key
+
+
+def _records_payload(session, key, ws_key):
+    try:
+        doc = session.runtime.get_projection(ws_key, drop=("overlays", "fields")) or {}
+    except Exception:
+        doc = {}
+    ids = _record_ids(doc, session.uname)
+    return {"database": key, "ids": ids, "count": len(ids), "view": records_view(ids)}
+
+
+@router.get("/starred/records")
+def starred_records(database: str = "", session: Session = Depends(require_session)):
+    """C5 — the record ids THIS caller starred on ONE database, plus the view to render.
+
+    ⚠ ONE DATABASE PER CALL, deliberately. Answering "every database" would be the N-bucket scan
+    the view half already pays for, on a route a grid calls every time it opens.
+    """
+    key = _clean_id(database)
+    if not key:
+        raise err(400, "bad_request", "no database was named")
+    return _records_payload(session, key, _database_or_refuse(session, key))
+
+
+@router.post("/starred/records")
+def set_starred_record(body: dict = Body(default=None),
+                       session: Session = Depends(require_session)):
+    """C5 — star or unstar ONE record. Body `{"database": key, "id": str, "on": bool}`.
+
+    ⛔ PER USER, IN THE PER-USERNAME STRATUM, AND IT MUST NEVER FALL BACK TO A TENANT-WIDE LIST
+    (R6). One person's stars becoming everyone's is the failure mode a shared column has here — a
+    custom field on these grids is written through a per-username stratum anyway, so a "shared"
+    answer would be a deliberate widening, not a shortcut.
+    """
+    body = body if isinstance(body, dict) else {}
+    key = _clean_id(body.get("database"))
+    raw_id = _clean_id(body.get("id"))
+    if not key:
+        raise err(400, "bad_request", "no database was named")
+    if not raw_id.isdigit():
+        # Named rather than coerced: see `_record_ids` on why a non-numeric id cannot be stored.
+        raise err(400, "bad_request", "a record id is a number")
+    if "on" not in body or not isinstance(body.get("on"), bool):
+        raise err(400, "bad_request", "`on` must be true or false")
+    pid, on = int(raw_id), bool(body["on"])
+    ws_key = _database_or_refuse(session, key)
+    if not session.runtime.available():
+        raise err(503, "store_unavailable",
+                  "the tenant store is unavailable. Nothing was saved.")
+    current = _records_payload(session, key, ws_key)["ids"]
+    if on and pid not in current and len(current) >= MAX_STARRED_RECORDS:
+        raise err(400, "starred_full",
+                  f"you have starred the maximum of {MAX_STARRED_RECORDS} records on this "
+                  f"database. Unstar one to make room")
+    uname = session.uname
+
+    def _up(data):
+        data = data if isinstance(data, dict) else {}
+        block = data.get(uname)
+        block = dict(block) if isinstance(block, dict) else {}
+        ids = _record_ids({uname: block}, uname)
+        if on:
+            if pid not in ids:
+                ids.append(pid)
+        else:
+            ids = [i for i in ids if i != pid]
+        if ids:
+            block[_RECORDS_KEY] = ids
+        else:
+            block.pop(_RECORDS_KEY, None)
+        # ⚠ THE STRATUM IS KEPT WHEN IT STILL HOLDS ANYTHING ELSE. Popping a username whose views
+        # and overlays live in the same block would delete somebody's whole workspace to clear one
+        # star — which is why this writes `block` back rather than replacing it.
+        if block:
+            data[uname] = block
+        else:
+            data.pop(uname, None)
+        return data
+
+    try:
+        session.runtime.update(ws_key, _up)
+    except Exception:
+        raise err(503, "store_unavailable",
+                  "the star was not saved: the store refused the write.")
+    return _records_payload(session, key, ws_key)

api/routes_statements.py

@@ -31,6 +31,10 @@ from fastapi import APIRouter, Body, Depends
 from deps import Session, err
 from routes_admin import admin_gate
 
+# W35-T35 (C8): the tenant predicate, held once. See `_royal_only` for why the import runs this
+# way round. `main.py` already imports both modules, so this adds no load.
+import automation_engine as engine
+
 router = APIRouter(prefix="/api/v1")
 
 #: Cache the Odoo follow-up pull briefly. The Streamlit page used `@st.cache_data(ttl=1800)`; the
@@ -48,8 +52,17 @@ def _royal_only(session: Session) -> Session:
     """⛔ See the module docstring, guardrail 3. The send client is env-credentialed, so it is
     tenant #0's and only tenant #0's. Refuse for anyone else rather than send as the wrong company.
 
-    Keyed on the runtime, never on a request field: a tenant is a property of the SESSION."""
-    if getattr(session.runtime, "key", None) != "royal-imports":
+    Keyed on the runtime, never on a request field: a tenant is a property of the SESSION.
+
+    ⭐⭐ WAVE 35 · T35 / CONTRACT C8 — THE TEST ITSELF NOW LIVES IN ONE PLACE. Statements became an
+    agent step this wave, so the automation engine has to answer the same question at two more
+    doors (which tenants see the action, which tenants may store it). C8's words are "the predicate
+    is imported, never re-expressed", and this is the direction that import can run: the engine
+    imports no route module and no FastAPI, so reaching `_royal_only` FROM it would drag `deps` and
+    `routes_admin` into a route-free module. The engine holds the boolean; this holds the refusal.
+    ⚠ WHAT STAYS HERE IS THE HTTP SHAPE, and that is deliberate — a 404 rather than a 403, so the
+    surface is invisible rather than forbidden. The engine must not know about status codes."""
+    if not engine.is_statement_tenant(session.runtime):
         raise err(404, "not_found", "statements are not configured for this workspace")
     return session
 
@@ -91,7 +104,9 @@ def statements(refresh: int = 0, session: Session = Depends(_gate)):
                    "replyTo": cs.REPLY_TO, "company": cs.COMPANY},
         "templates": {"subject": cs.DEFAULT_SUBJECT, "intro": cs.DEFAULT_INTRO,
                       "footer": cs.DEFAULT_FOOTER},
-        "tiers": ["A-Urgent", "B-Active", "C-Light", "Monitor"],
+        # W35-T35: ONE literal, read from the engine, so the sender's worklist and a statements
+        # agent's tier filter cannot come to mean different things.
+        "tiers": list(engine.STATEMENT_TIERS),
     }
 
 
@@ -166,3 +181,89 @@ def send(body: dict = Body(default=None), session: Session = Depends(_gate)):
             failed.append({"customer": name, "error": str(e)[:200]})
     return {"sent": sent, "failed": failed, "skipped": skipped,
             "safeMode": bool(cs.SAFE_MODE), "test": bool(override)}
+
+
+# ---------------------------------------------------------------------------------------------
+# WAVE 35 · T36 / CONTRACT C8 / OWNER RULING R10 — THE AGENT'S PARKED BATCH.
+#
+# ⛔⛔ THE AGENT ASSEMBLES; A PERSON CLICKS SEND. `automation_engine.run_statements` renders a batch
+# and parks it on the automation definition, and it imports no mail path at all. THIS is the only
+# door that releases one, and it is deliberately built out of the parts already here:
+#   · `_gate` — `admin_gate` THEN `_royal_only`, byte-for-byte the dependency the other three
+#     endpoints use. Not a copy of the checks: the same object.
+#   · `cs.queue_statement` — the same call `send()` above makes, so SAFE_MODE's allow-list refusal
+#     happens in the DATA LAYER, where no route, payload or UI can reach around it.
+# ⇒ Nothing about the guardrails is re-expressed here, which is what makes "unchanged" checkable.
+#
+# ⚠ WHY THE BATCH IS RE-RENDERED FROM THE LIVE WORKLIST RATHER THAN SENT AS STORED. The parked
+# `html` is what a person APPROVED and is what the review screen shows; but a balance can move
+# between the parking and the click, and mailing a figure we know to be stale is worse than mailing
+# a fresh one. So the parked batch decides WHO and WITH WHAT WORDS, and the live row decides the
+# NUMBERS — the same split `preview` already makes. A customer who has left the worklist entirely
+# (they paid) is reported as skipped rather than invoiced.
+
+@router.get("/admin/statements/agent/{auto_id}")
+def agent_batch(auto_id: str, session: Session = Depends(_gate)):
+    """What is parked and waiting for a click, for ONE agent. `null` when nothing is."""
+    defn = (engine.all_definitions(session.runtime) or {}).get(str(auto_id)) or {}
+    pending = defn.get("pendingStatements")
+    if not isinstance(pending, dict):
+        return {"pending": None}
+    # ⚠ The rendered `html` is NOT returned in the list — a 200-statement batch of rendered mail is
+    # megabytes, and the review screen needs the count and the names to decide. `preview` already
+    # renders ONE on demand.
+    return {"pending": {
+        "ts": pending.get("ts"), "count": int(pending.get("count") or 0),
+        "notes": list(pending.get("notes") or []),
+        "items": [{k: v for k, v in it.items() if k != "html"}
+                  for it in (pending.get("items") or [])],
+        "safeMode": bool(_cs().SAFE_MODE)}}
+
+
+@router.post("/admin/statements/agent/{auto_id}/send")
+def agent_send(auto_id: str, body: dict = Body(default=None),
+               session: Session = Depends(_gate)):
+    """Release a parked batch. THE CLICK R10 REQUIRES — nothing else in the system calls this.
+
+    ⛔ IT REFUSES AN EMPTY OR MISSING BATCH rather than answering 200 with nothing sent: a send
+    that reports success and mails nobody is the `view_upsert` failure mode (200 OK, zero writes)
+    arriving on the one route in this system that talks to a mail server.
+    """
+    cs = _cs()
+    defn = (engine.all_definitions(session.runtime) or {}).get(str(auto_id)) or {}
+    pending = defn.get("pendingStatements")
+    items = list((pending or {}).get("items") or []) if isinstance(pending, dict) else []
+    if not items:
+        raise err(404, "no_batch", "there is nothing parked for this agent to send")
+    # ⚠ An explicit subset is allowed (a person unticking a customer on the review screen) but it
+    # may only NARROW the parked batch. A name that was never parked cannot be introduced by the
+    # payload, or the review stops being what authorised the send.
+    want = {str(n) for n in (body or {}).get("customers") or []}
+    if want:
+        items = [it for it in items if str(it.get("customer")) in want]
+        if not items:
+            raise err(400, "bad_request", "none of those customers are in the parked batch")
+    rows, _ = _rows()
+    sent, failed, skipped = [], [], []
+    for it in items:
+        name = str(it.get("customer") or "")
+        row = _find(rows, name)
+        if row is None:
+            skipped.append({"customer": name,
+                            "reason": "no longer on the collection list, so nothing is owed"})
+            continue
+        try:
+            # ⛔ THE SAME DATA-LAYER CALL `send()` MAKES. SafeModeBlocked is raised INSIDE
+            # `queue_statement`, so the guardrail cannot be argued with from here.
+            mid = cs.queue_statement(cs.Odoo(), row,
+                                     str(it.get("subject") or "") or cs.DEFAULT_SUBJECT,
+                                     cs.DEFAULT_INTRO, cs.DEFAULT_FOOTER)
+            sent.append({"customer": name, "to": row.get("Email"), "mailId": mid})
+        except Exception as e:                                        # noqa: BLE001
+            failed.append({"customer": name, "error": str(e)[:200]})
+    # ⚠ CLEARED ONLY WHEN NOTHING IS LEFT TO RETRY. A batch dropped while some of it failed would
+    # lose the list of who still needs a statement, and nobody would know to look.
+    if sent and not failed:
+        engine.clear_statements(session.runtime, auto_id)
+    return {"sent": sent, "failed": failed, "skipped": skipped,
+            "safeMode": bool(cs.SAFE_MODE), "cleared": bool(sent and not failed)}

api/routes_tables.py

@@ -1406,7 +1406,11 @@ def _fire_on_change(table_key, pid, changed, session):
         defn = _ut().get(table_key, st=session.runtime) or {}
         wanted = _ae.on_change_fields(defn, changed.keys())
         for field in wanted:
-            _ae.run_field(table_key, field["key"], st=session.runtime, rows=[str(pid)])
+            # ⭐ W35-T41 / C7 — `user` is the usage ledger's attribution. An on-change run is still
+            # somebody's edit spending somebody's tokens, so it is booked against the person who
+            # typed rather than left unattributed.
+            _ae.run_field(table_key, field["key"], st=session.runtime, rows=[str(pid)],
+                          user=session.uname)
     except Exception:                                              # noqa: BLE001
         pass
 
@@ -1450,7 +1454,9 @@ def enrich_field(table_key: str, fkey: str, body: dict = Body(default=None),
     report = _ae.run_field(table_key, fkey, st=session.runtime, rows=rows,
                            policy=str((body or {}).get("scope") or "") or None,
                            # A named row set through THIS door is a person asking.
-                           manual=rows is not None)
+                           manual=rows is not None,
+                           # ⭐ W35-T41 / C7 — the usage ledger's attribution.
+                           user=session.uname)
     if report.get("problem"):
         # A run that could not start at all is not a 200: nothing was attempted, nothing was
         # spent, and the reason is actionable (no provider configured, or the wrong column).

api/routes_usage.py

@@ -0,0 +1,51 @@
+"""routes_usage.py — WAVE 35 (ruling R9, contract C7): `GET /api/v1/usage`, the AI meter.
+
+Owner item 13's second door. R9: the dashboard REPORTS weekly usage per surface against an
+allowance and does **not** cut anyone off this wave; over the allowance the product still works and
+the bar is red.
+
+⛔ THIS ROUTE ENFORCES NOTHING AND MUST NOT START. It is the only reader of `usage_ledger`, and the
+ledger has no ceiling in it (see that module's header). A `403 over_allowance` here would turn a
+reporting feature into a wall the owner explicitly did not ask for this wave.
+
+⚠ TWO SCOPES, AND THE WIDER ONE IS ADMIN-ONLY. `?scope=me` (the default) is the caller's own week;
+`?scope=tenant` folds every account and is refused for a non-admin — how much AI another employee
+used is not a fact this product hands out sideways.
+"""
+from fastapi import APIRouter, Depends
+
+import usage_ledger
+from deps import Session, err, require_session
+
+router = APIRouter(prefix="/api/v1")
+
+
+@router.get("/usage")
+def usage(scope: str = "me", session: Session = Depends(require_session)):
+    """`{week, resets, allowance, total, over, calls, unmeasured, scope, surfaces: [...]}`.
+
+    Every one of the four surfaces is present whether or not it was used — see
+    `usage_ledger.usage`'s note on why a missing row and a quiet week must not look the same.
+    """
+    wanted = str(scope or "me").strip().lower()
+    if wanted not in ("me", "tenant"):
+        raise err(400, "bad_request", "scope must be me or tenant")
+    if wanted == "tenant" and not session.admin:
+        raise err(403, "forbidden",
+                  "only an administrator can see the whole workspace's AI usage")
+    out = usage_ledger.usage(session.runtime, session.uname,
+                            tenant_wide=(wanted == "tenant"))
+    if session.admin and usage_ledger.UNATTRIBUTED["calls"]:
+        # ⛔ THE METER REPORTS ITS OWN BLIND SPOT (R6's second sentence). A call `record()` could not
+        # attribute — no store handle reached it, or the store refused — is absent from every number
+        # above, and an operator has to be able to see that rather than infer it.
+        # ⚠ ADMIN ONLY, and labelled as a PROCESS figure rather than a tenant one: the counter is a
+        # module global in this container, so it spans every tenant this process has served and is
+        # not a fact about the workspace being asked about.
+        out["unattributed"] = {
+            "calls": usage_ledger.UNATTRIBUTED["calls"],
+            "surfaces": dict(usage_ledger.UNATTRIBUTED["surfaces"]),
+            "note": ("these AI calls reached no ledger target in this container and are missing "
+                     "from every figure above. It is a wiring gap, not usage"),
+        }
+    return out

api/usage_ledger.py

@@ -0,0 +1,281 @@
+"""usage_ledger.py — WAVE 35 (ruling R9, contract C7): ONE METER FOR EVERY AI SURFACE.
+
+R9: *"ONE meter for every AI surface. The dashboard REPORTS weekly usage against an allowance and
+does NOT cut anyone off this wave; over the allowance it still works, shown red."*
+
+⛔ SO THIS FILE MEASURES AND NEVER ENFORCES. There is no ceiling here, no refusal, and no caller of
+this module may branch on its answer. The one limit the product does enforce is per COLUMN and lives
+where it was built (`ai_enrich.ceiling_report`); this is the tenant-wide REPORT, and mixing the two
+would make an over-allowance week silently stop somebody's enrichment run.
+
+**THE FOUR SURFACES.** `assistant` (a person asking the Assistant a question) · `field_agent` (an AI
+enrichment column filling cells) · `ai_review` (a model deciding a review stage) · `automation_draft`
+(a sentence becoming a draft flow). They are the four LLM entry points the product has, and the gate
+in `verify_api.py` DERIVES them from the code rather than reading this list, so a fifth entry point
+is caught by the gate and not by somebody remembering to edit a tuple.
+
+⛔⛔ **`record()` MUST BE HANDED ITS TARGET, AND THAT IS A MEASUREMENT, NOT A STYLE CHOICE.** The
+obvious design is to bind `(runtime, username)` into a `contextvars.ContextVar` inside
+`deps.require_session` — every session-authed request passes through it — so `record()` could take
+C7's five arguments and resolve the rest itself. **It does not work here and it fails SILENTLY.**
+Measured 2026-08-17 with a FastAPI `TestClient`: a `ContextVar` set inside a sync dependency reads
+back `None` in the handler *and in every function the handler calls*, on the SAME OS thread (17820
+both sides) — anyio copies the context per callable, so a `.set()` in the dependency's copy is
+invisible to the endpoint's. An async endpoint reads `None` too. A ledger built that way would have
+recorded nothing, answered no error, and shown a dashboard of zeros that looks exactly like a quiet
+week ([[flag-shipped-without-its-writer]]).
+
+⚠ THEREFORE `st` AND `user` ARE KEYWORD ARGUMENTS AFTER C7'S FIVE, and a call that omits them is
+COUNTED as unattributed and REPORTED rather than dropped — R6's second sentence applied to the meter
+itself. A surface whose caller cannot reach a store handle is a gap somebody has to close; a meter
+that hides the gap is worse than one that admits it.
+"""
+from __future__ import annotations
+
+import os
+import time
+
+#: The store bucket. Small by construction — counters only, never a per-call log: a log would grow
+#: without bound on a route that runs per row, and nothing in R9 asks a question a log answers.
+STORE_KEY = "ai_usage"
+
+#: The four AI surfaces (C7). ⚠ A surface this list does not name is REFUSED rather than stored under
+#: whatever string arrived, because a typo'd surface is a meter that reads low forever with a second
+#: row nobody looks at.
+SURFACES = ("assistant", "field_agent", "ai_review", "automation_draft")
+
+#: The weekly allowance the dashboard measures against (R9). ⛔ IT IS A REPORTING LINE, NOT A GATE.
+#: Env-tunable so a deployment can set a real number without a release.
+WEEKLY_ALLOWANCE = int(os.environ.get("AIOS_AI_WEEKLY_TOKENS") or 1_000_000)
+
+#: How many weeks stay in the bucket. A meter is about this week and the trend behind it; keeping
+#: every week forever turns a counter document into an append-only log by another route.
+MAX_WEEKS = 8
+
+#: Calls this PROCESS could not attribute to a store and a user — see the header. Reported to an
+#: admin by `GET /usage`, never silently zero.
+UNATTRIBUTED = {"calls": 0, "surfaces": {}}
+
+
+def week_of(when=None):
+    """The ISO week this instant belongs to, as `"2026-W33"`.
+
+    ⚠ UTC, EXPLICITLY, and never a naive local stamp. `routes_nav` records the same correction for
+    its own stamps: a naive local time written on a UTC host and parsed by a non-UTC browser misfiles
+    into the wrong bucket with nothing to go red. `%G`/`%V` are the ISO year and ISO week, which is
+    the only pair that agrees with itself across a year boundary (`%Y-%W` does not).
+    """
+    return time.strftime("%G-W%V", time.gmtime(when if when is not None else time.time()))
+
+
+def resets_at(when=None):
+    """The UTC date the CURRENT week's counters roll over, as `"YYYY-MM-DD"`.
+
+    R9 asks the page to state when the allowance resets, so the server answers it — a client that
+    computed "next Monday" itself would be a second implementation of the week boundary, and the two
+    would disagree for anybody whose clock is not UTC ([[one-question-two-normalizers]]).
+    """
+    now = when if when is not None else time.time()
+    tm = time.gmtime(now)
+    # `tm_wday` is 0 for Monday, so days-until-next-Monday is 7 minus however far in we are.
+    return time.strftime("%Y-%m-%d", time.gmtime(now + (7 - tm.tm_wday) * 86400))
+
+
+def tokens_from(body):
+    """`(tokens_in, tokens_out)` for one provider response. Either may be None.
+
+    ⛔ `None` MEANS THE PROVIDER DID NOT SAY, AND IT IS NOT ZERO. A ledger that books an unmeasured
+    call at zero reports a cheaper week than happened, which is exactly the cost-surprise complaint
+    R13 cited when the first token accounting was built. `ai_enrich._usage_tokens` has said this
+    since wave 34; this is that reader SPLIT, because C7 asks for input and output separately.
+
+    ⚠ THE TOTAL-ONLY SHAPE IS REAL AND IS NOT A SPLIT. Some providers answer only `total_tokens`.
+    That is reported by `record(total=...)` rather than by inventing a split, because halving a
+    total would put two numbers on a dashboard that were never measured.
+    """
+    usage = (body or {}).get("usage")
+    if not isinstance(usage, dict):
+        return (None, None)
+
+    def _int(*keys):
+        for key in keys:
+            got = usage.get(key)
+            if isinstance(got, int) and not isinstance(got, bool):
+                return got
+        return None
+
+    return (_int("prompt_tokens", "input_tokens"),
+            _int("completion_tokens", "output_tokens"))
+
+
+def total_from(body):
+    """One call's TOTAL tokens, or None — the shape a caller with no use for the split wants.
+
+    ⚠ Prefers the provider's own `total_tokens` over a sum, because a provider that reports both may
+    count cached or reasoning tokens in the total and in neither half.
+    """
+    usage = (body or {}).get("usage")
+    if isinstance(usage, dict):
+        for key in ("total_tokens", "totalTokens"):
+            got = usage.get(key)
+            if isinstance(got, int) and not isinstance(got, bool):
+                return got
+    ins, outs = tokens_from(body)
+    if ins is None and outs is None:
+        return None
+    return (ins or 0) + (outs or 0)
+
+
+def _int_or_none(value):
+    if isinstance(value, int) and not isinstance(value, bool):
+        return max(0, value)
+    return None
+
+
+def record(surface, provider, model, tokens_in=None, tokens_out=None, *,
+           total=None, calls=1, st=None, user=""):
+    """Book ONE AI call. Returns True when the line landed durably, False when it could not.
+
+    C7's signature is the five positional parameters; everything after `*` is this module's own
+    extension and each one has a reason:
+
+      · `total` — for a caller that knows the total and not the split (`ai_enrich.run_field`
+        accumulates a per-run total through an `_ask` contract a gate injects against, and changing
+        that contract to carry a split would break the injected shape for no gain here).
+      · `calls` — so a RUN over many rows books one line with its real call count instead of one
+        store write per row.
+      · `st` / `user` — the target. Required in practice; see this module's header for the measured
+        reason a contextvar cannot supply them.
+
+    ⛔ IT NEVER RAISES. A meter that can break the feature it measures is worse than no meter: a
+    store blip during an enrichment run would abort the run and lose the cells.
+    ⛔ AND IT NEVER SILENTLY SUCCEEDS. A call it cannot attribute increments `UNATTRIBUTED`, which
+    `GET /usage` shows an admin.
+    """
+    key = str(surface or "").strip()
+    if key not in SURFACES:
+        # Refused rather than stored: a surface nobody named is a row nobody reads, and the meter
+        # would read low forever with no sign of why.
+        return False
+    ins, outs = _int_or_none(tokens_in), _int_or_none(tokens_out)
+    tot = _int_or_none(total)
+    if tot is None and (ins is not None or outs is not None):
+        tot = (ins or 0) + (outs or 0)
+    n = max(0, int(calls) if isinstance(calls, int) and not isinstance(calls, bool) else 1)
+    if not n:
+        return False
+    uname = str(user or "").strip().lower()
+    if st is None:
+        UNATTRIBUTED["calls"] += n
+        UNATTRIBUTED["surfaces"][key] = UNATTRIBUTED["surfaces"].get(key, 0) + n
+        return False
+    week = week_of()
+    prov, mdl = str(provider or "")[:40], str(model or "")[:80]
+
+    def _up(data):
+        data = data if isinstance(data, dict) else {}
+        weeks = {w: v for w, v in data.items() if isinstance(v, dict)}
+        row = ((weeks.setdefault(week, {})
+                .setdefault(uname or "-", {}))
+               .setdefault(key, {}))
+        row["calls"] = int(row.get("calls") or 0) + n
+        if tot is None:
+            # ⛔ "the call happened, the tokens are unknown" IS A STATE, and it has to be
+            # representable or the meter quietly under-reports. The dashboard shows it as a count of
+            # unmeasured calls beside the token total.
+            row["unmeasured"] = int(row.get("unmeasured") or 0) + n
+        else:
+            row["tokens"] = int(row.get("tokens") or 0) + tot
+            if ins is not None:
+                row["tokens_in"] = int(row.get("tokens_in") or 0) + ins
+            if outs is not None:
+                row["tokens_out"] = int(row.get("tokens_out") or 0) + outs
+        if prov:
+            row["provider"] = prov
+        if mdl:
+            row["model"] = mdl
+        # Oldest weeks first to go. Sorting ISO week strings sorts chronologically by construction,
+        # which is the second reason `%G-W%V` is the format rather than a prettier one.
+        for stale in sorted(weeks)[:-MAX_WEEKS]:
+            weeks.pop(stale, None)
+        return weeks
+
+    try:
+        # ⚠ `flush='async'` — the coalescing mode ([[store-async-flush]]). This is the hot path of
+        # every AI surface in the product (an enrichment run books one line per RUN, but the
+        # assistant books one per question), and a blocking hub upload per call would put a network
+        # round trip inside the answer a person is waiting for. The mutation applies to the
+        # in-process cache immediately, so `GET /usage` reads its own writes.
+        st.update(STORE_KEY, _up, flush="async")
+        return True
+    except Exception:                                             # noqa: BLE001
+        UNATTRIBUTED["calls"] += n
+        UNATTRIBUTED["surfaces"][key] = UNATTRIBUTED["surfaces"].get(key, 0) + n
+        return False
+
+
+def _blank_row():
+    return {"calls": 0, "tokens": 0, "tokens_in": 0, "tokens_out": 0, "unmeasured": 0}
+
+
+def _fold(rows):
+    out = _blank_row()
+    for row in rows:
+        if not isinstance(row, dict):
+            continue
+        for field in ("calls", "tokens", "tokens_in", "tokens_out", "unmeasured"):
+            got = row.get(field)
+            if isinstance(got, int) and not isinstance(got, bool):
+                out[field] += max(0, got)
+    return out
+
+
+def usage(st, user="", *, tenant_wide=False, week=None):
+    """This week's meter. `{week, resets, allowance, total, over, surfaces: [...], ...}`.
+
+    `tenant_wide=True` folds every account in the tenant — the admin view. Otherwise only `user`.
+
+    ⛔ EVERY SURFACE IS PRESENT WHETHER OR NOT IT WAS USED, at zero. A surface a consumer has to test
+    for is a surface a consumer forgets to test for, and R9 says ONE meter for every AI surface: a
+    missing row and a quiet week would render identically, and only one of them is true.
+    ⛔ NOTHING HERE IS ESTIMATED. A surface with no ledger line reports zero, never a guess
+    ([[no-unverifiable-aggregates]]).
+    """
+    wk = str(week or week_of())
+    try:
+        stored = st.get(STORE_KEY) or {}
+    except Exception:                                             # noqa: BLE001
+        stored = {}
+    by_week = stored.get(wk) if isinstance(stored, dict) else {}
+    by_week = by_week if isinstance(by_week, dict) else {}
+    uname = str(user or "").strip().lower()
+    if tenant_wide:
+        buckets = [b for b in by_week.values() if isinstance(b, dict)]
+    else:
+        buckets = [by_week.get(uname or "-")] if isinstance(by_week.get(uname or "-"), dict) else []
+    surfaces = []
+    for key in SURFACES:
+        folded = _fold([b.get(key) for b in buckets])
+        folded["surface"] = key
+        surfaces.append(folded)
+    total = sum(s["tokens"] for s in surfaces)
+    unmeasured = sum(s["unmeasured"] for s in surfaces)
+    out = {
+        "week": wk,
+        "resets": resets_at(),
+        "allowance": WEEKLY_ALLOWANCE,
+        "total": total,
+        # R9: over the allowance the product STILL WORKS and the bar goes red. This flag is the
+        # colour, never a wall — nothing in the API reads it.
+        "over": bool(WEEKLY_ALLOWANCE and total > WEEKLY_ALLOWANCE),
+        "calls": sum(s["calls"] for s in surfaces),
+        "unmeasured": unmeasured,
+        "scope": "tenant" if tenant_wide else "me",
+        "surfaces": surfaces,
+    }
+    if unmeasured:
+        # R6's second sentence: the number is short by an unknown amount and the payload says so
+        # rather than presenting a confident total.
+        out["note"] = (f"{unmeasured} call(s) this week did not report a token count, so the total "
+                       f"above is a floor. The provider decides whether to report usage")
+    return out

platform/core/keychain.py

@@ -166,6 +166,52 @@ def read_fields(rt, entry_id):
         return None
 
 
+def first_entry_of_type(rt, etype):
+    """The metadata row of the FIRST entry of `etype`, or None. Never decrypts anything.
+
+    ⭐ W35-T45 — the same "first, by insertion-id sort" rule `_first_creds` resolves on, exposed as
+    an IDENTITY question rather than a credential one. `ensure_entry_of_type` needs to know whether
+    an entry exists WITHOUT unlocking it, and `list_entries` + a hand-rolled `next()` at each caller
+    is how two places come to disagree about which entry is "the" one.
+    """
+    return next((e for e in list_entries(rt) if e.get('type') == str(etype or '')), None)
+
+
+def ensure_entry_of_type(rt, etype, label, fields, username):
+    """Create ONE entry of `etype` only if the tenant has none. `(row, why)`; `row` is None on skip.
+
+    ⭐ W35-T45 / R11 — the primitive tenant #0's env-to-keychain migration is built from, and the
+    reason it lives here is that only this module knows what "already has one" means: `odoo_creds`
+    resolves to the FIRST entry of a type, so a second one would be stored, invisible in every
+    resolver, and impossible to tell from the one that serves.
+
+    ⛔ IDEMPOTENT BY TYPE, NOT BY A FLAG. A migration that keys idempotency on a marker it writes
+    itself is one lost marker away from running twice ([[a-migration-that-runs-on-the-next-write]]);
+    keying it on the thing it would create cannot double-apply, whatever else fails.
+
+    ⛔ AND IT REFUSES ON A LOCKED KEYCHAIN RATHER THAN STORING A SECRET IN THE CLEAR. `add_entry`
+    would raise `KeychainLocked`; this answers with a REASON instead, because "there is no Fernet key
+    on this deployment" is an operator fact to report, not an exception to propagate out of a boot
+    thread where nobody reads it.
+
+    ⚠ `why` IS RETURNED EVEN ON SUCCESS-BY-SKIP. "Already migrated" and "could not migrate" are
+    different operator actions and a bare None cannot tell them apart.
+    """
+    etype = str(etype or '').strip().lower()
+    if etype not in ENTRY_TYPES:
+        return None, f'{etype!r} is not a keychain entry type'
+    existing = first_entry_of_type(rt, etype)
+    if existing:
+        return None, f'this tenant already has a {etype} entry ({existing["id"]})'
+    if not unlocked():
+        return None, ('this deployment has no keychain key, and a credential must never be stored '
+                      'in the clear')
+    try:
+        return add_entry(rt, label, etype, fields, username), ''
+    except Exception as exc:                                          # noqa: BLE001
+        return None, f'{type(exc).__name__}: {exc}'
+
+
 def odoo_creds(rt):
     """R3's resolver seam: the FIRST odoo-type entry's fields, else None (the caller falls
     back to the environment). Deterministic order = insertion-id sort, so 'first' is stable."""

web/src/account/FeedbackPage.tsx

@@ -0,0 +1,246 @@
+// ---------------------------------------------------------------------------
+// account/FeedbackPage.tsx — WAVE 35 · W35-T18 (owner item 13, ruling R8, C6).
+//
+// One composer, one category, one send. R8 puts every submission on the
+// platform-wide operator plane: no tenant sees another's, and the submitting
+// tenant cannot edit or delete what it sent — so there is deliberately no "my
+// feedback" list here, and the 201 IS the receipt.
+//
+// ⛔ THE SHAPE IS THE ASSISTANT'S CENTRED COLUMN, READ AND NOT IMPORTED.
+// `assistant/assistant.css` belongs to another session this wave, so the anatomy
+// is borrowed (a measure-bounded column; a rounded field with the control row
+// inside it; a round send button that goes dark when there is something to send)
+// while every rule here is `.acct-*` in this module's own stylesheet. Same system
+// to the eye, no shared file to collide over.
+//
+// ⛔ FOUR STATES, AND THE FIRST TWO ARE THE ONES THAT GET SKIPPED. The category
+// list is the SERVER'S (B-1/E-9) — there is no local copy to fall back to — so
+// while it is in flight there is no form, and if it FAILS there is a sentence and
+// a retry, never an empty dropdown and never an invented list. A page that offers
+// a category the door refuses is worse than a page that says it cannot load.
+//
+// ⚠ THE SURFACE IS SPLIT FROM THE READ, and the reason is evidence rather than
+// taste: `renderToStaticMarkup` never runs an effect, so a shot of the fetching
+// component can only photograph its own spinner. With the whole state as ONE
+// prop, every state this page has — loading, failed, ready, sending, sent,
+// refused — can be rendered and looked at without a server, which is the only
+// evidence a lane with no server can produce.
+// ---------------------------------------------------------------------------
+
+import { useCallback, useEffect, useRef, useState } from "react";
+
+import { loadFeedbackForm, sendFeedback } from "./accountApi";
+import type { FeedbackForm } from "./accountApi";
+import "./account.css";
+
+/** The send arrow, in the same stroke vocabulary as the rest of the app's small glyphs. */
+function SendIcon() {
+  return (
+    <svg viewBox="0 0 16 16" width="15" height="15" aria-hidden="true" className="acct-send-icon">
+      <path d="M8 13.2V3.1" />
+      <path d="M3.8 7.3 8 3.1l4.2 4.2" />
+    </svg>
+  );
+}
+
+export type FeedbackLoad =
+  | { phase: "loading" }
+  | { phase: "ready"; form: FeedbackForm }
+  | { phase: "failed"; message: string };
+
+/** Everything this page holds, in one value, so the surface below is a function of it. */
+export interface FeedbackState {
+  load: FeedbackLoad;
+  category: string;
+  text: string;
+  sending: boolean;
+  /** The last send SUCCEEDED. Cleared the moment the person types again. */
+  sent: boolean;
+  /** The last send was REFUSED, and this is the server's own sentence. */
+  error: string;
+}
+
+export const EMPTY_FEEDBACK: FeedbackState = {
+  load: { phase: "loading" },
+  category: "",
+  text: "",
+  sending: false,
+  sent: false,
+  error: "",
+};
+
+export function FeedbackSurface({
+  state,
+  onText,
+  onCategory,
+  onSend,
+  onRetry,
+}: {
+  state: FeedbackState;
+  onText: (text: string) => void;
+  onCategory: (key: string) => void;
+  onSend: () => void;
+  onRetry: () => void;
+}) {
+  const { load, category, text, sending, sent, error } = state;
+  const form = load.phase === "ready" ? load.form : null;
+  const tooLong = !!form && form.maxChars > 0 && text.length > form.maxChars;
+  const canSend = !!form && !!category && text.trim() !== "" && !tooLong && !sending;
+
+  return (
+    <div className="acct-page">
+      <h1 className="acct-title">Feedback</h1>
+      <div className="acct-col">
+        {load.phase === "loading" ? (
+          <div className="acct-loading">
+            <span className="lp-spin lp-spin--lg" role="status" aria-label="Loading" />
+          </div>
+        ) : load.phase === "failed" ? (
+          // ⛔ NOT AN EMPTY FORM. The categories are the server's and there is no local copy, so
+          // a failed read means there is nothing to offer; drawing the composer anyway would
+          // invite somebody to write a paragraph into a control that cannot send it.
+          <div className="acct-failed">
+            <p className="acct-note">{load.message}</p>
+            <button type="button" className="acct-retry" onClick={onRetry}>
+              Try again
+            </button>
+          </div>
+        ) : (
+          <>
+            {sent ? (
+              // The confirmation. It sits ABOVE the composer rather than replacing it, because
+              // the next thought is often the same person's, and a page that has to be navigated
+              // back to is a page that collects less of what R8 exists to collect.
+              <p className="acct-ok" role="status">
+                Thanks. That went to the Loopable team.
+              </p>
+            ) : null}
+            {error ? (
+              <p className="acct-error" role="alert">
+                {error}
+              </p>
+            ) : null}
+
+            <div className="acct-field">
+              <textarea
+                className="acct-prompt"
+                rows={5}
+                value={text}
+                placeholder="What is working, and what is not?"
+                aria-label="Your feedback"
+                onChange={(e) => onText(e.currentTarget.value)}
+              />
+              <div className="acct-field-foot">
+                {/* ⛔ ONE dropdown, and its options are the SERVER'S list (B-1/E-9). A client
+                    constant beside a server enum is two lists that drift, and the day they do
+                    this control offers a value the door refuses. */}
+                <label className="acct-pick">
+                  <span className="acct-pick-label">About</span>
+                  <select
+                    className="acct-select"
+                    value={category}
+                    aria-label="Category"
+                    onChange={(e) => onCategory(e.currentTarget.value)}
+                  >
+                    {form?.categories.map((c) => (
+                      <option key={c.key} value={c.key}>
+                        {c.label}
+                      </option>
+                    ))}
+                  </select>
+                </label>
+                {/* The count appears only once there is something to count, and turns red only
+                    when the limit is actually passed. A counter sitting at 0 on an empty field
+                    is chrome describing itself. */}
+                {text.length > 0 && form && form.maxChars > 0 ? (
+                  <span className={"acct-count" + (tooLong ? " is-over" : "")}>
+                    {text.length} / {form.maxChars}
+                  </span>
+                ) : null}
+                <button
+                  type="button"
+                  className="acct-send"
+                  disabled={!canSend}
+                  aria-label="Send feedback"
+                  title="Send feedback"
+                  onClick={onSend}
+                >
+                  {sending ? (
+                    <span className="lp-spin" role="status" aria-label="Sending" />
+                  ) : (
+                    <SendIcon />
+                  )}
+                </button>
+              </div>
+            </div>
+          </>
+        )}
+      </div>
+    </div>
+  );
+}
+
+export default function FeedbackPage() {
+  const [state, setState] = useState<FeedbackState>(EMPTY_FEEDBACK);
+  const gen = useRef(0);
+
+  const read = useCallback(() => {
+    const mine = gen.current + 1;
+    gen.current = mine;
+    setState((s) => ({ ...s, load: { phase: "loading" }, error: "" }));
+    void loadFeedbackForm().then((r) => {
+      if (gen.current !== mine) return;
+      if (!r.ok) {
+        setState((s) => ({ ...s, load: { phase: "failed", message: r.message } }));
+        return;
+      }
+      setState((s) => ({
+        ...s,
+        load: { phase: "ready", form: r.value },
+        // The first category is selected rather than a "Choose one" placeholder: every category
+        // is a legitimate answer, so an unselected state would be a required field pretending to
+        // be a choice. ⚠ Only if the server sent one; an empty list selects nothing and the send
+        // refuses, which is honest rather than a submit that 400s.
+        category: r.value.categories[0]?.key ?? "",
+      }));
+    });
+  }, []);
+
+  useEffect(() => {
+    read();
+    return () => {
+      gen.current += 1;
+    };
+  }, [read]);
+
+  // ⚠ THE FETCH IS FIRED HERE, NEVER INSIDE A `setState` UPDATER. React may call an updater more
+  // than once for one dispatch (StrictMode does, deliberately), and a POST living in there would
+  // send the same feedback twice with nothing on screen saying so. The updater stays pure; the
+  // effectful call reads the state it already has.
+  const send = () => {
+    if (state.load.phase !== "ready" || state.sending) return;
+    const body = state.text.trim();
+    if (!state.category || body === "") return;
+    setState((s) => ({ ...s, sending: true, error: "" }));
+    void sendFeedback(state.category, body).then((r) => {
+      // ⛔ THE COMPOSER IS NOT CLEARED ON A REFUSAL. Clearing it would destroy what the person
+      // wrote and leave them holding a sentence about why it did not arrive, which is the worst
+      // possible pair. The text stays exactly where it is and the reason goes above it.
+      setState((cur) =>
+        r.ok
+          ? { ...cur, sending: false, sent: true, error: "", text: "" }
+          : { ...cur, sending: false, sent: false, error: r.message }
+      );
+    });
+  };
+
+  return (
+    <FeedbackSurface
+      state={state}
+      onText={(text) => setState((s) => ({ ...s, text, sent: false }))}
+      onCategory={(category) => setState((s) => ({ ...s, category }))}
+      onSend={send}
+      onRetry={read}
+    />
+  );
+}

web/src/account/SubscriptionPage.tsx

@@ -0,0 +1,47 @@
+// ---------------------------------------------------------------------------
+// account/SubscriptionPage.tsx — WAVE 35 · W35-T20 (owner item 13, contract C6).
+//
+// Owner item 13, verbatim: *"add below settings the following button: Feedback …,
+// Usage credits …, and a Subscription module … Specialized for the Royal Imports
+// tenant, do not show it."*
+//
+// This is the third of those three, and the only one with nothing behind it yet.
+// So it says so, in the words this app already uses for a boarded door
+// (`Shell.tsx`'s templates note: "Under construction. … will open here in a later
+// release."). One voice for one state — DESIGN.md 1's "variety is a defect".
+//
+// ⛔ THIS PAGE DOES NOT HIDE ITSELF, AND THAT IS THE TICKET'S OWN TRAP.
+// C6 puts the Royal Imports rule in TWO places that are both the frame's: the
+// account MENU does not draw the row, and the ROUTE refuses. A third opinion here
+// would be a third thing to keep in step, and the day they disagree the reader
+// gets a menu row that opens a page which says it does not exist. The page renders
+// the same for every tenant that can reach it, because reaching it IS the decision.
+//
+// ⛔ AND IT TAKES NO PROPS, WHICH IS ALSO A DECISION rather than an omission.
+// The wave's rule is that a prop must be REQUIRED, never optional — an optional one
+// degrades to "the page does not exist", which is indistinguishable from never
+// built. That rule constrains the props that EXIST; it does not ask for a prop that
+// carries nothing. There is nothing this page needs from the frame: it holds no
+// state, makes no call, and takes no decision the frame has already taken. A
+// `tenant` prop here would be exactly the second opinion the paragraph above
+// refuses. The mount is proven by A's `verify_wiring` row (W2), not by a signature.
+// ---------------------------------------------------------------------------
+
+import "./account.css";
+
+export default function SubscriptionPage() {
+  return (
+    <div className="acct-page">
+      <h1 className="acct-title">Subscription</h1>
+      <div className="acct-col">
+        {/* ⚠ TWO SHORT SENTENCES AND NO TOUR (DESIGN.md 4 / wave-22 R13: the app does not
+            narrate itself). The reader arrived here on purpose and wants one fact: is there
+            anything to do? There is not, and every further word would be spent on someone
+            who is already leaving. No feature list, no roadmap, no "in the meantime". */}
+        <p className="acct-note">
+          Under construction. Plans, billing and invoices will open here in a later release.
+        </p>
+      </div>
+    </div>
+  );
+}

web/src/account/UsagePage.tsx

@@ -0,0 +1,297 @@
+// ---------------------------------------------------------------------------
+// account/UsagePage.tsx — WAVE 35 · W35-T19 (owner item 13, ruling R9, C6/C7).
+//
+// R9: ONE meter for every AI surface. It REPORTS weekly usage against an
+// allowance and does not cut anyone off this wave; over the allowance the
+// product still works and the bar is red.
+//
+// ⛔⛔ THIS PAGE MAY NOT INVENT A FIGURE, AND THAT IS THE WHOLE TICKET.
+// Every number here comes off `GET /usage` — the week, the reset date, the
+// allowance, each surface's tokens and calls. Nothing is derived from a clock,
+// nothing is estimated, and a surface with no ledger lines shows **0**, not a
+// blank and not an omission (E-9 guarantees all four surfaces are always
+// present, so there is no missing-row branch to get wrong).
+// [[no-unverifiable-aggregates]]
+//
+// ⛔ AND `unmeasured` IS RENDERED, NOT SWALLOWED. Those are real calls whose
+// provider declined to report a token count, so the total beside them is a
+// FLOOR. A page that hides them presents the floor as a complete figure, which
+// is the cost-surprise failure one step removed — the same reason
+// `usage_ledger` books an unmeasured call as unknown rather than as zero.
+//
+// ⚠ SURFACE/READ SPLIT, as on Home and Starred: `renderToStaticMarkup` runs no
+// effect, so a shot of the fetching component photographs only its spinner.
+// ---------------------------------------------------------------------------
+
+import { useCallback, useEffect, useRef, useState } from "react";
+
+import { fmt } from "../ui/fmt";
+import { loadUsage } from "./accountApi";
+import type { Usage, UsageSurface } from "./accountApi";
+import "./account.css";
+
+/**
+ * The four surfaces C7 names, in the order R9 lists them.
+ *
+ * ⚠ AN UNKNOWN KEY IS HUMANISED, NEVER DROPPED. Dropping it would hide real usage from a meter
+ * whose whole job is to account for it, and printing the raw key would put an internal identifier
+ * on screen. The day a fifth LLM entry point lands (this product added two in one wave) it shows
+ * up here as a readable name with the right number beside it, and somebody can then decide what
+ * to call it.
+ */
+const SURFACE_LABEL: Record<string, string> = {
+  assistant: "Assistant",
+  field_agent: "Field agents",
+  ai_review: "Reviews",
+  automation_draft: "Drafting",
+};
+const ORDER = ["assistant", "field_agent", "ai_review", "automation_draft"];
+
+export function surfaceLabel(key: string): string {
+  const known = SURFACE_LABEL[key];
+  if (known) return known;
+  const words = key.replace(/[_-]+/g, " ").trim();
+  return words ? words.charAt(0).toUpperCase() + words.slice(1) : key;
+}
+
+/** C7's order first, then anything the server added, alphabetically. */
+export function orderSurfaces(surfaces: UsageSurface[]): UsageSurface[] {
+  const rank = (s: UsageSurface) => {
+    const i = ORDER.indexOf(s.surface);
+    return i === -1 ? ORDER.length : i;
+  };
+  return [...surfaces].sort(
+    (a, b) => rank(a) - rank(b) || surfaceLabel(a.surface).localeCompare(surfaceLabel(b.surface))
+  );
+}
+
+/**
+ * The bar's fill, as a percentage, CLAMPED to 100.
+ *
+ * ⚠ The clamp is what keeps "over the allowance" a COLOUR rather than a bar that overflows its
+ * own track and paints across the page. The number above the bar is unclamped and is where the
+ * overage is actually read.
+ * ⚠ An allowance of 0 (unset) yields 0 rather than a division by zero: no allowance means the
+ * meter has nothing to measure against, and a full red bar would be an assertion nobody made.
+ */
+export function barPct(value: number, of: number): number {
+  if (!(of > 0)) return 0;
+  return Math.max(0, Math.min(100, (value / of) * 100));
+}
+
+export type UsageLoad =
+  | { phase: "loading" }
+  | { phase: "ready"; usage: Usage }
+  | { phase: "failed"; message: string };
+
+function Bar({ pct, over }: { pct: number; over: boolean }) {
+  return (
+    <span className="acct-bar" aria-hidden="true">
+      <span className={"acct-bar-fill" + (over ? " is-over" : "")} style={{ width: `${pct}%` }} />
+    </span>
+  );
+}
+
+export function UsageSurfaceRows({ usage }: { usage: Usage }) {
+  // ⚠ SCALED TO THE LARGEST SURFACE, NOT TO THE WEEK'S TOTAL, and the difference is legibility
+  // rather than accuracy. `total` is the week's whole figure and can legitimately exceed the sum
+  // of these four (unattributed calls are counted there and belong to nobody), so scaling to it
+  // shrinks every bar by an amount the reader cannot see the cause of. Scaled to the biggest row,
+  // the bars answer the question a row of bars is actually asked: which surface is spending most.
+  // The absolute number sits beside each one, so nothing here is only readable as a shape.
+  const biggest = usage.surfaces.reduce((m, s) => Math.max(m, s.tokens), 0);
+  return (
+    <div className="acct-rows">
+      {orderSurfaces(usage.surfaces).map((s) => (
+        <div key={s.surface} className="acct-row">
+          <span className="acct-row-name">{surfaceLabel(s.surface)}</span>
+          <Bar pct={barPct(s.tokens, biggest)} over={false} />
+          <span className="acct-row-num">{fmt.int(s.tokens)}</span>
+          <span className="acct-row-sub">
+            {fmt.int(s.calls)} {s.calls === 1 ? "call" : "calls"}
+            {/* ⛔ NOT HOVER-ONLY. A surface whose provider declined to report tokens has a
+                token number that is a floor, and D-253 is a booked defect whose entire content
+                is "the explanation was satisfied only on hover". */}
+            {s.unmeasured > 0 ? `, ${fmt.int(s.unmeasured)} not measured` : ""}
+          </span>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+export function UsageView({
+  load,
+  scope,
+  canSeeTenant,
+  onScope,
+  onRetry,
+}: {
+  load: UsageLoad;
+  scope: "me" | "tenant";
+  /**
+   * Whether the workspace view is reachable AT ALL for this account.
+   *
+   * ⛔ THE TOGGLE IS NOT DRAWN WHEN IT IS NOT, and that is R8's fake-affordance rule applied to a
+   * permission: `?scope=tenant` is admin-only and 403s for everybody else, so an always-visible
+   * control would be a button most accounts can only be refused by.
+   */
+  canSeeTenant: boolean;
+  onScope: (scope: "me" | "tenant") => void;
+  onRetry: () => void;
+}) {
+  return (
+    <div className="acct-page">
+      <h1 className="acct-title">Usage credits</h1>
+      <div className="acct-col">
+        {canSeeTenant ? (
+          <div className="acct-scope" role="group" aria-label="Whose usage">
+            {(["me", "tenant"] as const).map((key) => (
+              <button
+                key={key}
+                type="button"
+                className={"acct-scope-btn" + (scope === key ? " is-on" : "")}
+                aria-pressed={scope === key}
+                onClick={() => onScope(key)}
+              >
+                {key === "me" ? "You" : "Workspace"}
+              </button>
+            ))}
+          </div>
+        ) : null}
+        {load.phase === "loading" ? (
+          <div className="acct-loading">
+            <span className="lp-spin lp-spin--lg" role="status" aria-label="Loading" />
+          </div>
+        ) : load.phase === "failed" ? (
+          // ⛔ NOT A ZERO METER. A failed read and a quiet week look identical on screen unless
+          // this branch exists, and a meter reading zero is the most reassuring possible lie.
+          <div className="acct-failed">
+            <p className="acct-note">{load.message}</p>
+            <button type="button" className="acct-retry" onClick={onRetry}>
+              Try again
+            </button>
+          </div>
+        ) : (
+          <>
+            <div className="acct-meter">
+              {/* ⛔ THE METER SAYS WHOSE USAGE IT IS, IN WORDS, and that is not decoration. The
+                  allowance is a WORKSPACE number; the total beside it is this account's own
+                  unless the scope says otherwise. A meter that shows a personal figure against a
+                  shared limit without saying so is a ratio nobody can read correctly, and it is
+                  the one way this page can be wrong while every number on it is right. */}
+              <div className="acct-meter-head">
+                <span className="acct-meter-who">
+                  {load.usage.scope === "tenant" ? "This workspace" : "You"}, this week
+                </span>
+              </div>
+              <div className="acct-meter-head">
+                <span className={"acct-meter-value" + (load.usage.over ? " is-over" : "")}>
+                  {fmt.int(load.usage.total)}
+                </span>
+                <span className="acct-meter-of">
+                  of {fmt.int(load.usage.allowance)} tokens
+                </span>
+              </div>
+              <Bar pct={barPct(load.usage.total, load.usage.allowance)} over={load.usage.over} />
+              <div className="acct-meter-foot">
+                {/* Both facts are the SERVER'S: the week it counted and the date it rolls over.
+                    A week boundary computed in the browser can disagree with the bucketing that
+                    produced the number above it, and then the page states a period nobody
+                    measured. */}
+                <span>
+                  Week {load.usage.week}. Resets {fmt.date(load.usage.resets)}.
+                </span>
+                <span className="acct-meter-calls">
+                  {fmt.int(load.usage.calls)} {load.usage.calls === 1 ? "call" : "calls"}
+                </span>
+              </div>
+            </div>
+
+            {/* ⛔ R9's whole point, in one line: over the allowance it STILL WORKS. The bar is
+                red, nothing is cut off, and the sentence says which of those two is true so
+                nobody has to infer it from a colour. */}
+            {load.usage.over ? (
+              <p className="acct-error" role="status">
+                This workspace is over its weekly allowance. Nothing is cut off; the AI surfaces
+                keep working.
+              </p>
+            ) : null}
+
+            {/* The server's own sentence, present only when something really was unmeasured. */}
+            {load.usage.note ? <p className="acct-note acct-note--inline">{load.usage.note}</p> : null}
+
+            <h2 className="acct-section">By surface</h2>
+            <UsageSurfaceRows usage={load.usage} />
+
+            {load.usage.unattributed > 0 ? (
+              // ⚠ LABELLED A WIRING GAP, NOT USAGE (E-9). These are AI calls this container could
+              // not attribute to an account. Folding them into somebody's total would be an
+              // invented attribution, and leaving them out entirely would understate the week.
+              <p className="acct-note acct-note--inline">
+                {fmt.int(load.usage.unattributed)} tokens this week could not be attributed to an
+                account. That is a wiring gap in the meter, not somebody's usage.
+              </p>
+            ) : null}
+          </>
+        )}
+      </div>
+    </div>
+  );
+}
+
+export default function UsagePage() {
+  const [load, setLoad] = useState<UsageLoad>({ phase: "loading" });
+  const [scope, setScope] = useState<"me" | "tenant">("me");
+  /**
+   * Whether the workspace view exists for this account, ANSWERED BY ASKING ONCE.
+   *
+   * ⛔ WHY A PROBE RATHER THAN A ROLE CHECK. The frame knows the role, but these pages take no
+   * props by contract (C6's trap: a page that decides its own visibility is a second opinion that
+   * will one day disagree with the route). The route itself is the authority, so the page asks it
+   * once: a 200 means the door is open and the toggle is real; a 403 means it is not and no
+   * control is drawn. ⚠ That 403 is an ANSWER, not an error — it is never shown to the reader.
+   * ⭐ AND IT IS WHAT GIVES `?scope=tenant` A DOOR. E built it admin-only; without this it would
+   * be a finished capability with no caller, which is this repo's most-repeated failure
+   * [[reachable-is-not-the-same-as-built]].
+   */
+  const [canSeeTenant, setCanSeeTenant] = useState(false);
+  const gen = useRef(0);
+
+  const read = useCallback((which: "me" | "tenant") => {
+    const mine = gen.current + 1;
+    gen.current = mine;
+    setLoad({ phase: "loading" });
+    void loadUsage(which === "tenant" ? "tenant" : undefined).then((r) => {
+      if (gen.current !== mine) return;
+      setLoad(r.ok ? { phase: "ready", usage: r.value } : { phase: "failed", message: r.message });
+    });
+  }, []);
+
+  useEffect(() => {
+    read(scope);
+    return () => {
+      gen.current += 1;
+    };
+  }, [read, scope]);
+
+  useEffect(() => {
+    let live = true;
+    void loadUsage("tenant").then((r) => {
+      if (live) setCanSeeTenant(r.ok);
+    });
+    return () => {
+      live = false;
+    };
+  }, []);
+
+  return (
+    <UsageView
+      load={load}
+      scope={scope}
+      canSeeTenant={canSeeTenant}
+      onScope={setScope}
+      onRetry={() => read(scope)}
+    />
+  );
+}

web/src/account/account.css

@@ -0,0 +1,372 @@
+/* ─────────────────────────────────────────────────────────────────────────────────────────
+   account/account.css — WAVE 35, owner item 13: the three surfaces that hang off the
+   account button (Feedback, Usage credits, Subscription).
+
+   ⛔ ITS OWN STYLESHEET, NOT index.css. That file belongs to the INTEGRATOR for the whole
+   wave, and the wave's own rule is that a new surface brings its own sheet. Every selector
+   here is .acct-*; nothing in this file redefines a .home-*, .shell-* or .cg-* rule, so
+   nothing here can win or lose a source-order fight with the shared sheet.
+
+   ⚠ .acct-page RESTATES .shell-home's five box declarations rather than reusing that class,
+   and that is deliberate rather than lazy. .shell-home is Home's box by name and by its own
+   region header; borrowing it would make every future Home layout change silently a change
+   to three account pages. The VALUES are copied on purpose — DESIGN.md 2's sibling rule
+   ("a panel matches its sibling's rendered values, not merely the scale") is what makes the
+   account pages read as the same system as Home, and .shell-main is overflow:hidden, so a
+   page that does not own its own scroll box simply loses everything below the fold.
+
+   ⚠ EVERY font-size IS A --lp-fs-* TOKEN. verify_ui globs src/**.css (every stylesheet in
+   the tree, not just index.css) and goes RED on a literal — wave-21 R5.
+   ───────────────────────────────────────────────────────────────────────────────────────── */
+
+.acct-page {
+  height: 100%;
+  overflow-y: auto;
+  padding: 34px 44px 56px;
+  box-sizing: border-box;
+  background: var(--lp-wash);
+}
+
+/* A short plain noun, same size and weight as .home-title, because it is the same role on a
+   sibling surface. DESIGN.md 2: headers are 1 to 3 words, never a sentence. */
+.acct-title {
+  margin: 0 0 20px;
+  font-size: var(--lp-fs-lg);
+  font-weight: 650;
+  color: var(--lp-ink);
+}
+
+/* THE ONE COLUMN. Every account surface is a reading-width column, not a full-bleed page:
+   a composer, a meter list and a note are all narrow objects, and stretching them to a
+   1600px window is how a page stops looking like it was designed. The reference the owner
+   gave for the assistant uses the same centred column for the same reason. */
+.acct-col {
+  max-width: 640px;
+}
+
+/* ── the honest note (Subscription today; any boarded account surface tomorrow) ─────────
+   ONE containment layer: a hairline panel on the wash, no card inside a card, no shadow
+   (DESIGN.md 4). It is a panel rather than a bare paragraph so the emptiness reads as
+   deliberate instead of as a page that failed to load. */
+.acct-note {
+  margin: 0;
+  padding: 16px 18px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  background: var(--lp-surface);
+  font-size: var(--lp-fs-xs);
+  line-height: var(--lp-lh);
+  color: var(--lp-muted);
+}
+
+/* ── loading, and the way back from a failed read ─────────────────────────────────────────── */
+.acct-loading {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  min-height: 180px;
+}
+.acct-failed {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+/* DESIGN.md 4's quiet button, with the UA chrome reset explicitly (the wave-19 "mystery outer
+   lines and tinted fill" rule). */
+.acct-retry {
+  flex: 0 0 auto;
+  padding: 6px 12px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  background: var(--lp-surface);
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  cursor: pointer;
+}
+.acct-retry:hover {
+  background: var(--lp-surface-2);
+  border-color: var(--lp-blue-deep);
+}
+
+/* ── the two answers a write can give ─────────────────────────────────────────────────────
+   Green = positive, red = negative: the fixed semantics (DESIGN.md 3), on the DEEP companions
+   because a pastel on white is not a light aesthetic, it is an unreadable one. */
+.acct-ok,
+.acct-error {
+  margin: 0 0 12px;
+  padding: 9px 12px;
+  border-radius: var(--lp-r-md);
+  font-size: var(--lp-fs-2xs);
+  line-height: var(--lp-lh);
+}
+.acct-ok {
+  border: 1px solid var(--lp-green);
+  background: var(--lp-green-tint);
+  color: var(--lp-green-deep);
+}
+.acct-error {
+  border: 1px solid var(--lp-red);
+  background: var(--lp-red-tint);
+  color: var(--lp-red-deep);
+}
+
+/* ── the composer ──────────────────────────────���──────────────────────────────────────────
+   The ASSISTANT'S anatomy in this module's own rules: one rounded field that contains its own
+   control row, so the category and the send button read as part of the thing being written
+   rather than as chrome around it. `assistant.css` is another session's file this wave and is
+   deliberately not imported; the shape is borrowed, the rules are local.
+   ⚠ The radius is smaller than the assistant's 22px pill on purpose: this field is a paragraph
+   box, not a one-line prompt, and a heavily rounded tall box reads as a speech bubble. */
+.acct-field {
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-lg);
+  background: var(--lp-surface);
+  padding: 12px 10px 10px 14px;
+}
+.acct-field:focus-within {
+  border-color: var(--lp-blue-solid);
+}
+.acct-prompt {
+  display: block;
+  width: 100%;
+  border: 0;
+  outline: none;
+  padding: 0 6px 0 0;
+  background: transparent;
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-sm);
+  line-height: var(--lp-lh);
+  resize: vertical;
+  box-sizing: border-box;
+}
+.acct-prompt::placeholder {
+  color: var(--lp-muted);
+}
+.acct-field-foot {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-top: 10px;
+}
+.acct-pick {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  min-width: 0;
+}
+.acct-pick-label {
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+}
+.acct-select {
+  max-width: 220px;
+  padding: 4px 8px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-surface);
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  cursor: pointer;
+}
+/* Tabular figures so the count does not jitter as it climbs. Red only once the limit is actually
+   passed: a counter that warns before anything is wrong trains people to ignore it. */
+.acct-count {
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-3xs);
+  font-variant-numeric: tabular-nums;
+}
+.acct-count.is-over {
+  color: var(--lp-red-deep);
+  font-weight: 600;
+}
+/* The send button takes the ink fill when it can send and the wash when it cannot, which is the
+   assistant's own rule: the control says whether there is anything to send before it is pressed. */
+.acct-send {
+  flex: 0 0 auto;
+  margin-left: auto;
+  width: 30px;
+  height: 30px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+  border-radius: var(--lp-r-pill);
+  background: var(--lp-ink);
+  color: var(--lp-surface);
+  font: inherit;
+  cursor: pointer;
+}
+.acct-send:disabled {
+  background: var(--lp-surface-2);
+  color: var(--lp-muted);
+  cursor: default;
+}
+.acct-send-icon {
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.7;
+  stroke-linecap: round;
+  stroke-linejoin: round;
+}
+
+/* ── the usage meter (R9) ─────────────────────────────────────────────────────────────────
+   One containment layer, hairline, no shadow. The bar is the only new SHAPE on these pages, and
+   the ticket asks for it by name ("over the allowance the bar is red"). */
+.acct-note--inline {
+  margin: 12px 0 0;
+  padding: 9px 12px;
+  font-size: var(--lp-fs-2xs);
+}
+.acct-scope {
+  display: inline-flex;
+  gap: 2px;
+  margin-bottom: 14px;
+  padding: 2px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  background: var(--lp-surface);
+}
+/* Selection is TINT plus WEIGHT with the ink left alone, which is `.shell-nav-item.is-active`'s
+   rule. ⚠ NOT `--lp-blue-deep` on `--lp-blue-tint`: that pair measures 2.96:1, under the 4.5:1
+   text bar and under the 3:1 graphical one, and this control holds words. */
+.acct-scope-btn {
+  padding: 4px 12px;
+  border: 0;
+  border-radius: var(--lp-r-sm);
+  background: transparent;
+  color: var(--lp-muted);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  cursor: pointer;
+}
+.acct-scope-btn:hover {
+  background: var(--lp-surface-2);
+}
+.acct-scope-btn.is-on {
+  background: var(--lp-blue-tint);
+  color: var(--lp-ink);
+}
+
+.acct-meter {
+  padding: 16px 18px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  background: var(--lp-surface);
+}
+.acct-meter-head {
+  display: flex;
+  align-items: baseline;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+.acct-meter-who {
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  color: var(--lp-muted);
+  margin-bottom: 4px;
+}
+/* Tabular figures on every financial-grade number (DESIGN.md 2), so a total that climbs does not
+   make the label beside it dance. Weight 650, never a display weight. */
+.acct-meter-value {
+  font-size: var(--lp-fs-xl);
+  font-weight: 650;
+  color: var(--lp-ink);
+  font-variant-numeric: tabular-nums;
+}
+/* Red = negative/over, the fixed semantic, on the deep companion. */
+.acct-meter-value.is-over {
+  color: var(--lp-red-deep);
+}
+.acct-meter-of {
+  font-size: var(--lp-fs-xs);
+  color: var(--lp-muted);
+  font-variant-numeric: tabular-nums;
+}
+.acct-meter-foot {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 12px;
+  margin-top: 8px;
+  font-size: var(--lp-fs-2xs);
+  color: var(--lp-muted);
+}
+.acct-meter-calls {
+  flex: 0 0 auto;
+  font-variant-numeric: tabular-nums;
+}
+
+/* The track is the wash so an empty meter still reads as a meter rather than as a missing
+   element; the fill is the brand at rest and red once the allowance is passed. */
+.acct-bar {
+  display: block;
+  width: 100%;
+  height: 8px;
+  margin-top: 10px;
+  border-radius: var(--lp-r-pill);
+  background: var(--lp-wash);
+  overflow: hidden;
+}
+.acct-bar-fill {
+  display: block;
+  height: 100%;
+  border-radius: var(--lp-r-pill);
+  background: var(--lp-primary);
+  transition: width 0.18s var(--lp-fold-e);
+}
+.acct-bar-fill.is-over {
+  background: var(--lp-red-deep);
+}
+
+/* A short plain noun, muted, sentence case, matching `.home-section-title` exactly: the same role
+   on a sibling surface takes the same rendered values (DESIGN.md 2). */
+.acct-section {
+  margin: 22px 0 9px;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  color: var(--lp-muted);
+}
+.acct-rows {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+/* One row per surface: name, share bar, tokens, calls. Fixed columns so the four numbers form a
+   column a reader can scan rather than four numbers at four different left edges. */
+.acct-row {
+  display: grid;
+  grid-template-columns: 120px 1fr 92px 150px;
+  align-items: center;
+  gap: 12px;
+  padding: 8px 2px;
+  border-bottom: 1px solid var(--lp-line);
+}
+.acct-row:last-child {
+  border-bottom: 0;
+}
+.acct-row-name {
+  font-size: var(--lp-fs-xs);
+  font-weight: 600;
+  color: var(--lp-ink);
+}
+/* Numbers right-aligned, text left (DESIGN.md 2), tabular so the column lines up digit for digit. */
+.acct-row-num {
+  text-align: right;
+  font-size: var(--lp-fs-xs);
+  color: var(--lp-ink);
+  font-variant-numeric: tabular-nums;
+}
+.acct-row-sub {
+  font-size: var(--lp-fs-2xs);
+  color: var(--lp-muted);
+  font-variant-numeric: tabular-nums;
+}
+.acct-row .acct-bar {
+  margin-top: 0;
+  height: 6px;
+}

web/src/account/accountApi.ts

@@ -0,0 +1,188 @@
+// ---------------------------------------------------------------------------
+// account/accountApi.ts — WAVE 35, owner item 13: the wire behind the two account
+// surfaces that have one (Feedback, contract C6/R8; Usage credits, C7/R9).
+//
+// ⛔ THE CATEGORY VOCABULARY IS THE SERVER'S AND IS FETCHED, NOT DECLARED HERE.
+// That is a decision, not an omission: a client constant beside a server enum is
+// two lists that drift, and the day they do the dropdown offers a value the door
+// refuses. Asked and settled in mailbox B-1 / E-9 — the server serves the list,
+// this file renders it, and there is no local fallback to drift TO.
+//
+// ⛔ AND THERE IS NO TENANT-SIDE READ OF A SUBMISSION AT ALL (R8). No "my
+// feedback" list, no edit, no delete: the operator plane is the only reader. The
+// 201 is the receipt. If that ever feels like a gap, it is R8, not a missing
+// endpoint.
+//
+// ⚠ NOTHING ON THE USAGE SIDE IS COMPUTED HERE. The allowance, the week and the
+// reset date all ride the payload (E-9), because a week boundary computed in the
+// browser can disagree with the server's own bucketing — and then the page shows
+// a number that traces to no ledger line, which is exactly what R9's meter must
+// never do.
+// ---------------------------------------------------------------------------
+
+import { API_V1, CREDENTIALS, UNAUTHORIZED_EVENT, checkTenant, signal } from "../apiContract";
+
+/** The same discriminated result the other feature modules use. */
+export type Result<T> =
+  | { ok: true; value: T }
+  | { ok: false; status: number; message: string };
+
+async function call<T>(
+  path: string,
+  init: RequestInit,
+  read: (body: unknown) => T
+): Promise<Result<T>> {
+  let res: Response;
+  try {
+    res = await fetch(`${API_V1}${path}`, { credentials: CREDENTIALS, ...init });
+  } catch {
+    return { ok: false, status: 0, message: "Cannot reach the server." };
+  }
+  if (checkTenant(res)) return { ok: false, status: 0, message: "Reloading." };
+  if (res.status === 401) signal(UNAUTHORIZED_EVENT);
+  const body = (await res.json().catch(() => null)) as unknown;
+  if (!res.ok) {
+    // ⚠ A 4xx MESSAGE IS POLICY AND IS SHOWN; a 5xx message is an internal detail and is not.
+    // `session.ts` states the same rule for sign-in, and E names each 400 case ("unknown
+    // category", "empty text", "over maxChars"), so the server's sentence is the useful one.
+    const detail = (body as { error?: { message?: string } } | null)?.error?.message;
+    return {
+      ok: false,
+      status: res.status,
+      message:
+        res.status >= 500 || !detail
+          ? res.status >= 500
+            ? "Something went wrong on our side. Try again in a moment."
+            : `The server answered ${res.status}.`
+          : detail,
+    };
+  }
+  return { ok: true, value: read(body) };
+}
+
+const row = (v: unknown): Record<string, unknown> =>
+  v && typeof v === "object" && !Array.isArray(v) ? (v as Record<string, unknown>) : {};
+const str = (v: unknown): string => (typeof v === "string" ? v : "");
+const int = (v: unknown): number =>
+  typeof v === "number" && Number.isFinite(v) && v >= 0 ? Math.floor(v) : 0;
+
+// ── FEEDBACK (R8, C6) ───────────────────────────────────────────────────────────────────────
+
+export interface FeedbackCategory {
+  key: string;
+  label: string;
+}
+
+export interface FeedbackForm {
+  categories: FeedbackCategory[];
+  maxChars: number;
+}
+
+/**
+ * `GET /api/v1/feedback/form` — the category list and the length limit, both the server's.
+ *
+ * ⛔ A CATEGORY WITH NO LABEL IS DROPPED, never rendered as its key: an internal identifier in a
+ * dropdown is the same defect `parsePages` refuses one layer up ("a nav row with no name is a
+ * door with no sign on it"). And an EMPTY list is a real answer the caller must handle, not a
+ * reason to invent one.
+ */
+export function parseFeedbackForm(body: unknown): FeedbackForm {
+  const r = row(body);
+  const categories = (Array.isArray(r.categories) ? r.categories : [])
+    .map(row)
+    .filter((c) => str(c.key) !== "" && str(c.label) !== "")
+    .map((c) => ({ key: str(c.key), label: str(c.label) }));
+  return { categories, maxChars: int(r.maxChars) };
+}
+
+export function loadFeedbackForm(): Promise<Result<FeedbackForm>> {
+  return call("/feedback/form", {}, parseFeedbackForm);
+}
+
+export function sendFeedback(category: string, text: string): Promise<Result<{ id: string }>> {
+  return call(
+    "/feedback",
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ category, text }),
+    },
+    (b) => ({ id: str(row(b).id) })
+  );
+}
+
+// ── USAGE (R9, C7) ────────────────────────────────────────────────────────────────────��─────
+
+/** One AI surface's week. Every surface is present at zero when unused (E-9), so nothing here
+ *  branches on a missing row. */
+export interface UsageSurface {
+  surface: string;
+  calls: number;
+  tokens: number;
+  tokensIn: number;
+  tokensOut: number;
+  /**
+   * Calls whose provider declined to report a token count.
+   *
+   * ⛔ NOT ZERO-PADDING. These are real calls with an UNKNOWN cost, which is why the total beside
+   * them is a FLOOR rather than a figure. A page that hides this presents the floor as complete,
+   * and that is the cost-surprise failure one step removed.
+   */
+  unmeasured: number;
+}
+
+export interface Usage {
+  /** ISO year-week, UTC. A string that sorts chronologically, so nothing here parses a date. */
+  week: string;
+  /** The UTC date the counters roll over, as the server states it. */
+  resets: string;
+  allowance: number;
+  total: number;
+  over: boolean;
+  calls: number;
+  unmeasured: number;
+  /** `"me"` or `"tenant"`. Which question the numbers answer, decided by the server. */
+  scope: string;
+  surfaces: UsageSurface[];
+  /** The server's own sentence about `unmeasured`. Empty when there is nothing unmeasured. */
+  note: string;
+  /**
+   * Admin only: AI calls this container could not attribute to an account.
+   *
+   * ⚠ LABEL IT A WIRING GAP, NOT USAGE (E-9). It is the meter reporting on ITSELF, and folding it
+   * into somebody's total would be an invented attribution.
+   */
+  unattributed: number;
+}
+
+export function parseUsage(body: unknown): Usage {
+  const r = row(body);
+  const surfaces = (Array.isArray(r.surfaces) ? r.surfaces : [])
+    .map(row)
+    .filter((s) => str(s.surface) !== "")
+    .map((s) => ({
+      surface: str(s.surface),
+      calls: int(s.calls),
+      tokens: int(s.tokens),
+      tokensIn: int(s.tokens_in),
+      tokensOut: int(s.tokens_out),
+      unmeasured: int(s.unmeasured),
+    }));
+  return {
+    week: str(r.week),
+    resets: str(r.resets),
+    allowance: int(r.allowance),
+    total: int(r.total),
+    over: r.over === true,
+    calls: int(r.calls),
+    unmeasured: int(r.unmeasured),
+    scope: str(r.scope) || "me",
+    surfaces,
+    note: str(r.note),
+    unattributed: int(r.unattributed),
+  };
+}
+
+export function loadUsage(scope?: "tenant"): Promise<Result<Usage>> {
+  return call(scope === "tenant" ? "/usage?scope=tenant" : "/usage", {}, parseUsage);
+}

web/src/apiContract.ts

@@ -228,6 +228,24 @@ export interface QueryOpenDetail {
  */
 export const AUTOMATION_OPEN_EVENT = "aios:automation-open";
 
+/**
+ * ⭐⭐ WAVE 35 · T08 (owner item 11, wiring W6) — "the agent list CHANGED". Owner: *"When I delete
+ * an Agent, it doesn't sync to the Home at all … fix this for everything we display twice in Home."*
+ *
+ * ⛔ THE CAUSE IS AN OWNERSHIP SPLIT, NOT A MISSING REFETCH. The FRAME fetches the agent tiles Home
+ * draws, while `AutomationSurface` is "props-free by contract" and fetches its OWN list — so a
+ * delete inside the module updates the module and nothing tells the frame its copy is stale. Two
+ * readers of one server fact, and only one of them was told.
+ *
+ * ⚠ NO `detail`, DELIBERATELY. This says "your copy is stale", not "here is the new list": a
+ * payload would be a THIRD copy of the same fact, and the frame re-asking is one request against a
+ * route measured at ~360 ms. The emitter (D, `AutomationSurface`) must dispatch it for delete,
+ * rename AND create.
+ * ⚠ It is deliberately NOT a `navEpoch` bump: that would re-fetch `/nav`, a whole-document read of
+ * a 28.6 MB store (D-175/D-185), to refresh a list of agent tiles.
+ */
+export const AGENTS_CHANGED = "aios:agents-changed";
+
 /** `detail` of {@link AUTOMATION_OPEN_EVENT}. `stageId` is advisory — a surface that does not
  *  scroll to a stage simply selects the automation. */
 export interface AutomationOpenDetail {

web/src/assistant/AssistantPage.tsx

@@ -675,6 +675,15 @@ export default function AssistantPage({ granted }: AssistantPageProps) {
               <QueryWorkspace granted={granted} hostedRail refreshToken={queryRefresh}
                 selectedId={activeQuery} />
             </Suspense>
+          ) : !loaded ? (
+            /* ⛔ W35-T22, the SECOND state that paints something untrue for a frame. `queryList` is
+               empty until `GET /query` lands, so arriving here — a `#/query` link, a bookmark, a
+               reload — asserted "No Query views yet" to somebody who has twenty, then replaced it.
+               `loaded` is the flag the chat history one screen down already waits on; the two
+               empty states now agree about when they are entitled to speak. */
+            <p className="as-working" role="status" aria-label="Loading your Query views">
+              <span className="lp-spin" aria-hidden="true" />
+            </p>
           ) : (
             <div className="as-opening">
               <h1 className="as-opening-h">No Query views yet</h1>

web/src/automation/AutomationDetail.tsx

@@ -50,6 +50,7 @@ import type {
   DiscoverEstimate,
   DiscoverVocab,
   SourcePreview,
+  StatementBatch,
   TickState,
   TriggerOption,
   UserTable,
@@ -60,6 +61,7 @@ import {
   deleteAutomation,
   discoverEstimate,
   fieldKeyFor,
+  getAutomation,
   listTables,
   oauthStatus,
   patchAutomation,
@@ -67,6 +69,8 @@ import {
   runAutomation,
   runBlock,
   runRows,
+  sendStatementBatch,
+  statementBatch,
   toggleNode,
 } from "./automationApi";
 
@@ -235,6 +239,18 @@ export default function AutomationDetail({
   const [touched, setTouched] = useState(false);
   const [triggerBusy, setTriggerBusy] = useState(false);
   const [oauth, setOauth] = useState<OAuthStatus | null>(null);
+  /**
+   * ⭐⭐ WAVE 35 · T36 / OWNER RULING R10 — THE PARKED STATEMENTS BATCH.
+   *
+   * ⚠ TWO PIECES OF STATE FOR TWO DIFFERENT FACTS, and collapsing them would lose one. The
+   * automation's own `pendingStatements` (count + notes) rides on the LIST and is already here on
+   * first paint, so the panel can say "12 statements are ready" with no round trip. `batch` is the
+   * per-customer detail, fetched only when a batch exists, because that call reads the live Odoo
+   * worklist and a rail paint must never pay for it.
+   */
+  const [batch, setBatch] = useState<StatementBatch | null>(null);
+  const [sending, setSending] = useState(false);
+  const parked = automation.pendingStatements || null;
   /**
    * ⚠ "SHOW ME THE CRON" IS A VIEW CHOICE, NOT A SCHEDULE CHANGE — and forgetting that once
    * made the Custom option DEAD. Everything else on the trigger face is derived from the
@@ -431,6 +447,29 @@ export default function AutomationDetail({
     return () => ac.abort();
   }, []);
 
+  /**
+   * ⭐ W35-T36 — fetch the per-customer detail ONLY when a batch is actually parked.
+   *
+   * ⚠ THE GUARD IS THE POINT. This call reads the live Odoo collection worklist, so firing it on
+   * every automation anybody opens would put a multi-model Odoo read behind an ordinary click.
+   * `parked` comes free with the list payload, so the cheap fact gates the expensive one.
+   * ⚠ Keyed on the COUNT as well as the id: sending part of a batch changes what is parked, and a
+   * key of `id` alone would leave the review list showing customers who have just been invoiced.
+   */
+  useEffect(() => {
+    if (!parked || !parked.count) {
+      setBatch(null);
+      return undefined;
+    }
+    const ac = new AbortController();
+    statementBatch(automation.id, ac.signal)
+      .then((r) => setBatch(r.pending))
+      // A batch we cannot read is not an error banner over the whole agent: the count and the
+      // notes are already on screen from the list payload, and they are the actionable half.
+      .catch(() => setBatch(null));
+    return () => ac.abort();
+  }, [automation.id, parked?.count]);
+
   const table = tables.find((t) => t.key === targetTable) || null;
 
   /** ITEM 22 / D-70 / R12 — may Run be pressed, and what does it say if not. One definition,
@@ -881,6 +920,42 @@ export default function AutomationDetail({
     }
   };
 
+  /**
+   * ⭐⭐ WAVE 35 · T36 / R10 — THE CLICK THAT SENDS, and the only one in the client.
+   *
+   * ⛔ IT SENDS WHAT WAS PARKED, and passes no customer list: the review is what authorised the
+   * batch, so the payload must not be able to widen it. The server refuses a name that was not
+   * parked for the same reason from the other side.
+   * ⚠ THE OUTCOME IS REPORTED PER BUCKET, never as a bare count. `failed` and `skipped` are
+   * different facts — a guardrail refusal and "they already paid" are both "this one did not go"
+   * and only one of them is a problem — and a summary that added them together would hide which.
+   */
+  const releaseBatch = async () => {
+    setProblem("");
+    setMessage("");
+    setSending(true);
+    try {
+      const out = await sendStatementBatch(automation.id);
+      const parts = [`${out.sent.length} sent`];
+      if (out.failed.length) parts.push(`${out.failed.length} failed`);
+      if (out.skipped.length) parts.push(`${out.skipped.length} skipped`);
+      setMessage(parts.join(", "));
+      /* ⛔ HANDS ON A FRESH DEFINITION RATHER THAN RELOADING THE LIST — the wave-31 T31 rule that
+         every other write door here follows, and `verify_automation_ui` counts the two shapes
+         exactly so a new door cannot quietly regress to a re-read. The definition really did
+         change (the batch is cleared when nothing is left to retry), so the panel MUST be
+         corrected; this reads ONE automation to learn it instead of the whole rail payload.
+         ⚠ The read is deliberately AFTER the outcome message is set: a send that worked followed
+         by a read that failed is still a send that worked, and the person must be told so. */
+      const { automation: fresh } = await getAutomation(automation.id);
+      await onSaved(fresh.id, fresh);
+    } catch (e) {
+      setProblem(e instanceof AutomationError ? e.message : "Those statements were not sent.");
+    } finally {
+      setSending(false);
+    }
+  };
+
   const openDrill = async (entry: RunEntry) => {
     if (drillFor === entry.ts) {
       setDrill(null);
@@ -1432,6 +1507,72 @@ export default function AutomationDetail({
         </div>
       ) : null}
 
+      {/*
+        ⭐⭐ WAVE 35 · T36 / OWNER RULING R10 — "N STATEMENTS READY", AND THE ONLY SEND CONTROL.
+        Owner item 14 moves Statements out of Settings and into the agent; R10 decides the shape:
+        the run assembles and PARKS, and a person clicks Send.
+
+        ⛔ THE PANEL IS HERE, ABOVE THE WORK AREA, BECAUSE IT IS THE ONE THING THAT NEEDS DOING.
+        The wave-22 board would have been the natural home and it does not exist (wave 27 R3
+        deleted it, and its reason was that it wrote machine columns into a customer's own table).
+        This is the first thing on the agent instead, which is where the eye already is.
+
+        ⚠ IT RENDERS OFF `parked`, NOT off `batch`. The count arrives with the list payload, so
+        the panel is on screen at first paint; the per-customer list fills in behind it. Gating
+        the whole panel on the second fetch would make the thing a person must act on the thing
+        that appears last.
+      */}
+      {parked && parked.count > 0 ? (
+        <section className="auto-batch" aria-label="Statements waiting for review">
+          <div className="auto-batch-head">
+            <span className="auto-batch-count">
+              {parked.count} {parked.count === 1 ? "statement is" : "statements are"} ready
+            </span>
+            {/* ⛔ THE SENTENCE IS NOT DECORATION. A person about to email real customers must be
+                told, before they click, that nothing has gone out yet. */}
+            <span className="auto-batch-note">
+              Nothing has been sent. Review the list, then release them.
+            </span>
+          </div>
+          {batch && batch.safeMode ? (
+            /* ⚠ SAFE_MODE IS REPORTED, NEVER DECIDED, HERE — the data layer owns it
+               (`collections_send.queue_statement` raises inside the send). Saying so on the
+               button's own panel is what stops a test send reading as a delivery failure. */
+            <p className="auto-batch-safe" role="status">
+              The email guardrail is on, so these go to the allow list rather than to customers.
+            </p>
+          ) : null}
+          {(parked.notes || []).map((n) => (
+            <p className="auto-batch-line" key={n}>{n}</p>
+          ))}
+          {batch && batch.items.length ? (
+            <ul className="auto-batch-list">
+              {batch.items.slice(0, 8).map((it) => (
+                <li key={it.customer}>
+                  <span className="auto-batch-cust">{it.customer}</span>
+                  <span className="auto-batch-to">{it.to}</span>
+                </li>
+              ))}
+              {batch.items.length > 8 ? (
+                <li className="auto-batch-more">
+                  and {batch.items.length - 8} more
+                </li>
+              ) : null}
+            </ul>
+          ) : null}
+          <div className="auto-batch-actions">
+            <button
+              type="button"
+              className="auto-btn is-primary"
+              disabled={sending}
+              onClick={() => void releaseBatch()}
+            >
+              {sending ? "Sending…" : `Send ${parked.count}`}
+            </button>
+          </div>
+        </section>
+      ) : null}
+
       <div className="auto-work">
         {/*
           ⛔ THE VIEW IS CHOSEN, NEVER INFERRED (C14 leg 1). This block used to be

web/src/automation/automation.css

@@ -174,3 +174,71 @@
   outline: 2px solid var(--lp-blue-deep);
   outline-offset: 1px;
 }
+
+/* ── the parked statements batch (W35-T36 / owner ruling R10) ─────────────── */
+
+/* ⭐⭐ "N STATEMENTS ARE READY", with the ONLY Send control in the product.
+   It sits above `.auto-work`, in the banner band, because it is the one thing on this agent that
+   needs a person — R10's whole shape is that the run assembles and PARKS, and somebody releases.
+
+   ⚠ IT IS DELIBERATELY NOT A WARNING COLOUR. A parked batch is the system working as designed, and
+   painting it amber would teach people to dismiss the panel that guards a real mail send. It is
+   the blue tint every other "here is something to look at" surface uses. */
+.auto-batch {
+  flex: 0 0 auto;
+  margin: 12px 24px 0;
+  padding: 12px 14px;
+  border: 1px solid var(--lp-blue);
+  border-radius: var(--lp-r-md);
+  background: var(--lp-blue-tint);
+  font-size: var(--lp-fs-sm);
+}
+.auto-batch-head {
+  display: flex;
+  align-items: baseline;
+  flex-wrap: wrap;
+  gap: 4px 10px;
+}
+.auto-batch-count {
+  font-weight: 650;
+  color: var(--lp-ink);
+}
+.auto-batch-note { color: var(--lp-muted); }
+
+/* The guardrail line. Same size as a note, because it IS one: the data layer decides, this
+   reports (R6's second sentence). */
+.auto-batch-safe,
+.auto-batch-line {
+  margin: 6px 0 0;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-xs);
+  line-height: 1.5;
+  max-width: 70ch;
+}
+
+/* Who is about to be emailed. ⚠ Bounded in the MARKUP at 8 rows with an "and N more" line rather
+   than scrolled here: a 200-row list inside a banner pushes the work area off the screen, and the
+   panel's job is to say who and how many, not to be the worklist. */
+.auto-batch-list {
+  margin: 8px 0 0;
+  padding: 0;
+  list-style: none;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  font-size: var(--lp-fs-xs);
+}
+.auto-batch-list li {
+  display: flex;
+  gap: 10px;
+  align-items: baseline;
+}
+.auto-batch-cust { color: var(--lp-ink); }
+.auto-batch-to { color: var(--lp-muted); overflow-wrap: anywhere; }
+.auto-batch-more { color: var(--lp-muted); }
+
+.auto-batch-actions {
+  margin-top: 10px;
+  display: flex;
+  gap: 8px;
+}

web/src/automation/automationApi.ts

@@ -14,7 +14,14 @@
 // of the preset list is a list that can offer a schedule the server rejects,
 // and the user would see the refusal as "it just doesn't save".
 // ---------------------------------------------------------------------------
-import { API_V1, CREDENTIALS, UNAUTHORIZED_EVENT, checkTenant, signal } from "../apiContract";
+import {
+  AGENTS_CHANGED,
+  API_V1,
+  CREDENTIALS,
+  UNAUTHORIZED_EVENT,
+  checkTenant,
+  signal,
+} from "../apiContract";
 
 /**
  * ⭐ WAVE 24 / R6 — `plain` IS A REAL KIND, and it is the default for every new automation.
@@ -194,6 +201,24 @@ export interface Automation {
    * full and the field should go — the difference between the two cases is entirely that ratchet.
    */
   awaitingResults: boolean;
+  /**
+   * ⭐⭐ WAVE 35 · T36 / OWNER RULING R10 — A BATCH OF STATEMENTS IS ASSEMBLED AND WAITING FOR A
+   * HUMAN CLICK. `null` when nothing is parked, which is every automation but a statements agent
+   * that has run.
+   *
+   * ⛔ `null` AND NOT AN EMPTY OBJECT, deliberately: "no batch" and "a batch of zero" are
+   * different facts and only one of them is worth putting a panel on screen for.
+   *
+   * ⚠ COUNT AND NOTES ONLY — the rendered mail is NOT here. This type rides on the automations
+   * LIST, which every rail paint reads, and a 200-statement batch carries 200 HTML documents.
+   * `GET /admin/statements/agent/{id}` serves the per-customer detail when somebody opens it.
+   *
+   * ⚠ OPTIONAL rather than required, and this is the ONE place that is right in this file: every
+   * automation that is not a statements agent legitimately has no such key, so requiring it would
+   * make the common case the exception. Contrast `awaitingResults` and `unconfigured` above, which
+   * are facts about EVERY automation and are required for exactly that reason.
+   */
+  pendingStatements?: { count: number; ts: string; notes: string[] } | null;
   /**
    * ⭐⭐ WAVE 32 · T45 (owner item 10) — WHICH ACTIONS CANNOT RUN, AND WHAT EACH ONE IS MISSING.
    *
@@ -1009,8 +1034,62 @@ export function listTables(abort?: AbortSignal): Promise<{ tables: UserTable[] }
   return send<{ tables: UserTable[] }>("/automations/tables", { signal: abort });
 }
 
+/**
+ * ⭐⭐ WAVE 35 · T33 / WIRING W6 (owner item 11) — "WHEN I DELETE AN AGENT, IT DOESN'T SYNC TO HOME".
+ *
+ * ⛔ EMITTED FROM THIS MODULE, NOT FROM `AutomationSurface`, AND THAT IS THE WHOLE DESIGN CHOICE.
+ * Every mutation of an agent passes through one of the three doors below, so this is the ONE choke
+ * point a fourth caller cannot forget. The surface has three call sites for the same three writes
+ * and a fourth would arrive with no dispatch and no type error — the exact shape of the defect
+ * being fixed, which is two readers of one fact and only one of them told.
+ *
+ * ⚠ THE CONSTANT, NEVER THE STRING (A's `NOTE A-9`): a second spelling is a dispatch into an empty
+ * room, and TypeScript cannot see it. ⚠ And NO `detail`: this means "your copy is stale", not
+ * "here is the new list" — a payload would be a third copy of one fact.
+ *
+ * ⚠ FIRED ON SUCCESS ONLY. A failed write changed nothing, and telling the frame to re-read after
+ * a 400 would spend a request to learn the list it already has.
+ */
+function agentsChanged(): void {
+  // `window` is always present in this bundle; the guard is for the gate's module-level import,
+  // which evaluates this file outside a DOM.
+  if (typeof window !== "undefined") window.dispatchEvent(new CustomEvent(AGENTS_CHANGED));
+}
+
+/**
+ * ⭐⭐ WAVE 35 · T33 — DROP ONE ROW FROM THE MEMO.
+ *
+ * ⛔ THE HOLE THIS FILLS, AND IT IS A REAL ONE: `rememberAutomation` maps and appends but has NEVER
+ * REMOVED. So after a delete the memo is correct only because `AutomationSurface.onDeleted` happens
+ * to call `load()` — a CONVENTION, not a structure. Any future delete path that skips the reload
+ * would leave `cachedAutomations()` seeding the next mount with a row the server no longer has: a
+ * deleted agent reappearing on navigation, which is owner item 11 wearing a different coat.
+ *
+ * ⛔ AND IT IS AN EVICTION, NOT `forgetAutomations()`. Dropping the WHOLE memo would force
+ * `data === null` on the next visit to Agents — the cold skeleton W29-T01 exists to prevent and
+ * that wave-31's `rememberAutomation` spends thirty lines of rationale avoiding. One row leaves;
+ * the rest of the paint accelerator stays.
+ * ⚠ `at` is NOT refreshed, for the same reason `rememberAutomation` does not touch it: removing a
+ * row does not make the list newly fetched.
+ */
+export function forgetAutomation(id: string): AutomationList | null {
+  if (!listMemo || !id) return null;
+  const prev = listMemo.data;
+  const kept = prev.automations.filter((a) => a.id !== id);
+  if (kept.length === prev.automations.length) return null;
+  const data: AutomationList = { ...prev, automations: kept };
+  listMemo = { at: listMemo.at, data };
+  return data;
+}
+
 export function createAutomation(body: unknown): Promise<{ automation: Automation }> {
-  return send("/automations", { method: "POST", body: JSON.stringify(body) });
+  return send<{ automation: Automation }>("/automations", {
+    method: "POST",
+    body: JSON.stringify(body),
+  }).then((r) => {
+    agentsChanged();
+    return r;
+  });
 }
 
 /**
@@ -1077,14 +1156,29 @@ export function patchAutomation(
   id: string,
   body: unknown
 ): Promise<{ automation: Automation }> {
-  return send(`/automations/${encodeURIComponent(id)}`, {
+  return send<{ automation: Automation }>(`/automations/${encodeURIComponent(id)}`, {
     method: "PATCH",
     body: JSON.stringify(body),
+  }).then((r) => {
+    // ⚠ A RENAME IS THE CASE THAT MAKES THIS NECESSARY (owner item 11 says "fix this for everything
+    // we display twice in Home"): Home draws the agent's NAME, so a patch that only the module
+    // hears leaves the tile reading the old one. A toggle emits too — harmless, and cheaper than a
+    // rule about which fields Home happens to draw today.
+    agentsChanged();
+    return r;
   });
 }
 
 export function deleteAutomation(id: string): Promise<{ deleted: string }> {
-  return send(`/automations/${encodeURIComponent(id)}`, { method: "DELETE" });
+  return send<{ deleted: string }>(`/automations/${encodeURIComponent(id)}`, {
+    method: "DELETE",
+  }).then((r) => {
+    // BOTH halves, and neither is the other's substitute: the eviction keeps THIS module's memo
+    // honest whoever deleted the row, and the event tells the FRAME its separate copy is stale.
+    forgetAutomation(id);
+    agentsChanged();
+    return r;
+  });
 }
 
 export function runAutomation(id: string): Promise<{ started: string }> {
@@ -1118,6 +1212,48 @@ export function runRows(id: string): Promise<RunRows> {
   return send(`/automations/${encodeURIComponent(id)}/rows`);
 }
 
+/** One parked statement, as the review list shows it. The rendered mail is NOT here. */
+export type StatementItem = {
+  customer: string;
+  to: string;
+  subject: string;
+  tier: string;
+  overdue?: number;
+};
+
+export type StatementBatch = {
+  ts: string;
+  count: number;
+  notes: string[];
+  items: StatementItem[];
+  safeMode: boolean;
+};
+
+/**
+ * ⭐⭐ WAVE 35 · T36 / R10 — the parked batch, per agent.
+ *
+ * ⚠ THESE TWO CALLS DO NOT GO TO `/automations`. The statements doors live on
+ * `routes_statements`, behind `admin_gate` + the Royal Imports tenant gate, because that is where
+ * the send guardrails already are and R10's whole point is that they do not move.
+ */
+export function statementBatch(autoId: string, abort?: AbortSignal):
+    Promise<{ pending: StatementBatch | null }> {
+  return send(`/admin/statements/agent/${encodeURIComponent(autoId)}`, { signal: abort });
+}
+
+/**
+ * ⛔ THE CLICK R10 REQUIRES, and the ONLY caller of the send door in the whole client. Nothing
+ * schedules this, nothing retries it, and the agent's own run cannot reach it: a person opens the
+ * batch and presses the button. `customers` may only NARROW what was parked.
+ */
+export function sendStatementBatch(autoId: string, customers?: string[]):
+    Promise<{ sent: unknown[]; failed: unknown[]; skipped: unknown[]; cleared: boolean }> {
+  return send(`/admin/statements/agent/${encodeURIComponent(autoId)}/send`, {
+    method: "POST",
+    body: JSON.stringify(customers && customers.length ? { customers } : {}),
+  });
+}
+
 /** Is a connector connected for THIS user? (C5 — per-user keychain slots, R7's seam.) */
 export function oauthStatus(abort?: AbortSignal): Promise<OAuthStatus> {
   return send("/oauth/status", { signal: abort });

web/src/customer-grid/CustomerGrid.tsx

@@ -33,9 +33,18 @@ import { acceptsQueryPreview, routeQueryViewMutation } from "./queryPreview";
 // only its own source text could otherwise be checked.
 import { WINDOW_ROWS } from "./apiBridge";
 import {
-  EMPTY_WINDOW_PREDICATE, limitSummary, nextWindowOffset, windowedCapabilityNote,
-  windowedFoldNote, windowPredicateKey,
+  EMPTY_WINDOW_PREDICATE, limitSummary, lockedRecordsNote, nextWindowOffset,
+  windowedCapabilityNote, windowedFoldNote, windowPredicateKey,
 } from "./counts";
+// ⭐ W35-T29/T30 (C5) — the record star's client, and its own stylesheet imported HERE, by the
+// module that renders its classes. W35-T22 in this same wave was the cost of doing otherwise.
+import { useRecordStars } from "./recordStars";
+// ⚠ ALIASED, and the collision is worth naming: `./Stars`'s `StarIcon` is the RATING atom (a
+// 5-point star for a 1..5 field) and this one is the record MARK. Two different meanings, one
+// noun, already both in this file — importing the second under its own name would have shadowed
+// the first and silently repainted every rating picker.
+import { StarIcon as RecordStarMark } from "../ui/icons";
+import "./rowStar.css";
 import { defaultViewConfig, useGridColumns } from "./useGridColumns";
 import { activeMeasureRuleIds, pendingMeasures, runPipeline, sliceForDisplay,
   unresolvedConditions, useVisibleRows } from "./useVisibleRows";
@@ -114,7 +123,8 @@ import {
   planFieldPaste,
   pasteRowCount,
 } from "./clipboard";
-import { cellTipText, expandButtonRect, GROUP_HEADER_FONT, GROUP_LABEL_PAD, headerMarkLayout,
+import { cellTipText, expandButtonRect, starButtonRect,
+  GROUP_HEADER_FONT, GROUP_LABEL_PAD, headerMarkLayout,
   headerMarkSizes, tipLeft } from "./overlayPlacement";
 import { AnchoredOverlay, BodyPortal, useOverlayLayer } from "./OverlaySurface";
 import type { AnchorRect } from "./OverlaySurface";
@@ -378,6 +388,32 @@ function queryPreviewView(binding: QueryVirtualBinding, fields: Field[]): SavedV
     : [];
   config.groupBy = typeof raw.groupBy === "string" && keys.has(raw.groupBy) ? raw.groupBy : null;
   if (raw.display && typeof raw.display === "object") config.display = raw.display as DisplaySpec;
+  /**
+   * ⭐⭐ W35-T25 — THE MEMBERS AN EDIT CAN MOVE, READ BACK FROM THE SERVER'S COPY.
+   *
+   * R2 made the spec editable and `routes_query.QUERY_EDITABLE_SPEC` is the allow-list it may
+   * move. Every one of them has to be read HERE too, or the round trip is one-directional: the
+   * edit posts, the server stores it, and the next mount rebuilds the view from the AI's members
+   * alone — so a resize would survive a reload on THIS browser (the local bucket) and vanish on
+   * any other, which is the worst of the three possible behaviours because it looks like it works.
+   *
+   * ⚠ Each is validated against the CURRENT field list, exactly like the members above: the
+   * server cleans on write, this cleans on read, and neither trusts the other's vintage.
+   */
+  if (Array.isArray(raw.order)) {
+    const order = raw.order.filter((key): key is string => typeof key === "string" && keys.has(key));
+    if (order.length) config.order = [...order, ...config.order.filter((key) => !order.includes(key))];
+  }
+  if (raw.widths && typeof raw.widths === "object") {
+    const widths: Record<string, number> = {};
+    for (const [key, width] of Object.entries(raw.widths as Record<string, unknown>))
+      if (keys.has(key) && typeof width === "number" && width > 0) widths[key] = width;
+    config.widths = widths;
+  }
+  if (typeof raw.colorBy === "string" && keys.has(raw.colorBy)) config.colorBy = raw.colorBy;
+  if (typeof raw.rowHeightMode === "string")
+    config.rowHeightMode = raw.rowHeightMode as ViewConfig["rowHeightMode"];
+  if (typeof raw.frozenCount === "number") config.frozenCount = clampFrozenCount(raw.frozenCount);
   return {
     id: binding.artifactId,
     name: typeof raw.name === "string" && raw.name ? raw.name : binding.source.label,
@@ -747,7 +783,31 @@ function CustomerGridSurface({
   onEmbeddedSelectionChange,
 }: CustomerGridProps = {}) {
   const isQueryPreview = queryBinding !== undefined;
-  const previewReadOnly = embedded || isQueryPreview;
+  /**
+   * ⭐⭐ W35-T23 (owner item 4 / R2) — **`previewReadOnly` IS GONE, AND THE SPLIT IS THE TICKET.**
+   *
+   * It used to be `embedded || isQueryPreview`: ONE flag switching off view persistence, field
+   * editing, add-row and the toolbar's right element for two surfaces that are not the same
+   * thing. Owner: *"I should be able to interact in each of the View under Query as well, exactly
+   * like how I would be able to interact with it under Database view."* R2 makes Query views
+   * live — resize, sort, group, hide, row height, export, edit a cell, add a row — **subject to
+   * the SOURCE database's own locks**, which is the predicate that does the work now.
+   *
+   * ⛔ TWO QUESTIONS, NOT ONE, AND CONFLATING THEM IS WHAT MADE THE SINGLE FLAG WRONG:
+   *   · **`embedded`** — *may this surface WRITE anything at all?* A linked-record grid inside a
+   *     modal may not, and keeps every refusal it has today. Unchanged, deliberately.
+   *   · **`hostWorkspace`** — *does this surface own the SOURCE DATABASE's workspace?* Its views,
+   *     its `storageKey`, its view rail, its alert list. **A Query surface does NOT**, and that
+   *     has nothing to do with read-only: the artefact has its own single view, its own storage
+   *     key (`query:<qid>`) and its own transport. Opening `includeWorkspace` for Query would
+   *     load the source's view list into a Query surface — two surfaces sharing one view list,
+   *     which is the trap this ticket names by name.
+   *
+   * ⚠ SO A QUERY SURFACE IS `!embedded && !hostWorkspace`: it writes, and it writes somewhere
+   * else. Any new guard added below has to answer WHICH of the two questions it is asking; if
+   * the answer is "both", it is probably asking the wrong one.
+   */
+  const hostWorkspace = !embedded && !isQueryPreview;
   // Wave 16 C-TOPIC: which TABLE this tree is drawing, derived from the one scope prop.
   const topic = topicForScope(scope);
   const {
@@ -760,9 +820,15 @@ function CustomerGridSurface({
     patchOverlay,
     requestWindow,
   } = useCustomerData(scope, {
-    bindSurface: !previewReadOnly,
-    includeWorkspace: !previewReadOnly,
-    writable: !previewReadOnly,
+    // ⚠ `bindSurface` is the MODULE-scope write target every emitted event carries. A Query
+    // surface's cell edits belong to the SOURCE database, so it must bind — the linked-record
+    // grid must not, because its parent still owns that scope.
+    bindSurface: !embedded,
+    // ⛔ The one flag that stays on the WIDE predicate: neither surface reads the source
+    // database's own saved views.
+    includeWorkspace: hostWorkspace,
+    // `writable: false` blocks `patchOverlay`, i.e. every cell edit. R2 wants them in Query.
+    writable: !embedded,
   });
   const embeddedIdsKey = embeddedRecordIds?.join(",") ?? "";
   /**
@@ -862,9 +928,26 @@ function CustomerGridSurface({
    * ⚠ EMBEDDED GRIDS DO NOT ASK. A linked-record grid inside a modal is not a table anyone
    * alerts on, and a second fetch per relation cell would be a workspace read per click.
    */
+  /**
+   * ⭐⭐ W35-T29 + T30 · CONTRACT C5 (R5, R6) — the RECORD stars for this database.
+   *
+   * ⛔ PER USER, unlike every other star in the product. A database, an agent or a Query view is
+   * starred through `config.important` on ONE record, so starring a SHARED view stars it for
+   * everybody who can see it; a record star lives in the caller's own per-username stratum and two
+   * accounts see two different sets. One word on screen, two scopes underneath (mailbox E-3).
+   * ⛔ AND IT IS ITS OWN DOOR, NOT A VIEW WRITE (D-170): a view write on a read-through grid 409s
+   * because it materialises the pool, and this must work on `ut_odoo_gl_lines`.
+   *
+   * ⚠ OFF FOR AN EMBEDDED GRID. A linked-record picker inside a modal is not a table anybody keeps
+   * marks on, and the read would be one request per relation cell.
+   */
+  const recordStars = useRecordStars(scope, !embedded);
   const [alerted, setAlerted] = useState<string[]>([]);
   useEffect(() => {
-    if (previewReadOnly) return;
+    // `hostWorkspace`, not `embedded`: the alert badges paint on the SOURCE database's view rail,
+    // which a Query surface does not render at all (`hideViews`). Fetching them would be a
+    // workspace read whose answer has nowhere to go.
+    if (!hostWorkspace) return;
     let live = true;
     const pull = () => {
       void fetchAlerts().then((r) => {
@@ -878,7 +961,7 @@ function CustomerGridSurface({
       live = false;
       window.removeEventListener("focus", pull);
     };
-  }, [previewReadOnly, scope]);
+  }, [hostWorkspace, scope]);
 
   const [fields, setFields] = useState<Field[]>([]);
   const [views, setViews] = useState<SavedView[]>([]);
@@ -901,6 +984,15 @@ function CustomerGridSurface({
   const [expandAt, setExpandAt] = useState<
     { pid: number; x: number; y: number; size: number } | null
   >(null);
+  /**
+   * ⭐ W35-T29 — the same idea at the other end of the same cell: which record the hovered star
+   * belongs to, and where it sits. A separate state from `expandAt` because the two have
+   * different minimum row heights (this mark is smaller), so a compact row can carry one and not
+   * the other, and a shared state would have to pick.
+   */
+  const [starHover, setStarHover] = useState<
+    { pid: number; x: number; y: number; size: number } | null
+  >(null);
   const [detailPid, setDetailPid] = useState<number | null>(null);
   const [columnMenu, setColumnMenu] = useState<ColumnMenuState | null>(null);
   /** Open choice list for a `select` / `user` cell — see onCellClicked. */
@@ -1056,11 +1148,32 @@ function CustomerGridSurface({
   useEffect(() => {
     if (!payload || payloadFields.length === 0 || initializedKey.current === storageKey) return;
     if (isQueryPreview && queryBinding) {
-      const virtual = queryPreviewView(queryBinding, payloadFields);
+      /**
+       * ⭐⭐ W35-T23 + T25 (R2/R3) — THE SERVER OWNS A QUERY ARTEFACT'S SPEC, AND THIS SURFACE
+       * KEEPS NO SECOND COPY. That is the whole of "a resize survives a reload" now.
+       *
+       * `binding.view` IS the stored spec (`routes_query` accepts a `view_upsert` of the
+       * artefact's own view and `queryPreviewView` reads every editable member back off it), so a
+       * width dragged on one device is there on the next, on any device, without a local bucket.
+       *
+       * ⛔⛔ THE FIRST DRAFT SEEDED FROM `readLocal(storageKey)` AND IT WAS WRONG IN THE WORST
+       * SHAPE THIS REPO CATALOGUES — works, then does not, then works again. The local copy had to
+       * be gated on `binding.edited` so a Revert was not silently undone on that device; but
+       * `binding` is memoised on `active`, and NOTHING in the autosave path refetches the artefact
+       * — so after the FIRST edit in a session the flag was still `false`, and navigating away and
+       * back inside that session dropped the width while a full reload brought it back. A second
+       * store for one spec, plus a flag to arbitrate between them, is the shape R4 forbids one
+       * ruling over. There is one store now and nothing to arbitrate.
+       *
+       * ⚠ THE COST, STATED: an edit whose POST fails is lost at the next mount, and the reader is
+       * TOLD (the autosave toasts the failure). That is the honest trade against a local copy that
+       * can disagree with the server about what the artefact is.
+       */
+      const view = queryPreviewView(queryBinding, payloadFields);
       setFields(payloadFields);
-      setViews([virtual]);
-      setActiveViewId(virtual.id);
-      setConfig(virtual.config);
+      setViews([view]);
+      setActiveViewId(view.id);
+      setConfig(view.config);
       setWorkspaceReady(true);
       initializedKey.current = storageKey;
       return;
@@ -1158,7 +1271,7 @@ function CustomerGridSurface({
      * the config the client is actually filtering with, and sending anything else would ask the
      * host to resolve a question nobody on screen is asking.
      */
-    if (!previewReadOnly && reemit.size > 0) {
+    if (hostWorkspace && reemit.size > 0) {
       const stamped = { ...(local?.reemitted ?? {}) };
       for (const view of initialViews) {
         const key = reemit.get(view.id);
@@ -1173,10 +1286,15 @@ function CustomerGridSurface({
     } else {
       reemittedRef.current = { ...(local?.reemitted ?? {}) };
     }
-  }, [payload, payloadFields, storageKey, previewReadOnly, scope, isQueryPreview, queryBinding]);
+  }, [payload, payloadFields, storageKey, hostWorkspace, scope, isQueryPreview, queryBinding]);
 
   useEffect(() => {
-    if (!workspaceReady || previewReadOnly) return;
+    // ⛔ `hostWorkspace`, and a Query surface is deliberately EXCLUDED (W35-T23 + T25). Its spec
+    // lives on the server, which is the only copy — writing a second one here would be a store
+    // with no reader, and gating a read on which of the two is fresher is the bug the init
+    // effect's note above describes. A LOCKED source's own workspace is a different question and
+    // is unaffected: that is `hostWorkspace` true, `recordsMutable` false.
+    if (!workspaceReady || !hostWorkspace) return;
     writeLocal(storageKey, {
       fields,
       views,
@@ -1193,7 +1311,7 @@ function CustomerGridSurface({
       // drop a view this browser created seconds ago.
       viewWrites: pruneTombstones(viewWritesRef.current, Date.now()),
     });
-  }, [workspaceReady, storageKey, fields, views, activeViewId, previewReadOnly]);
+  }, [workspaceReady, storageKey, fields, views, activeViewId, hostWorkspace]);
 
   /**
    * ⭐ THE LIVE WORKSPACE (owner report, 2026-08-04) — what has APPEARED since we mounted.
@@ -1218,7 +1336,9 @@ function CustomerGridSurface({
    */
   const hostWorkspaceViews = payload?.workspace?.views;
   useEffect(() => {
-    if (!workspaceReady || previewReadOnly) return;
+    // `hostWorkspace`: this adopts views out of `payload.workspace`, which a Query surface never
+    // fetches. Keyed on `embedded` it would read a workspace that is not there.
+    if (!workspaceReady || !hostWorkspace) return;
     const now = Date.now();
     const nextFields = adoptNewFields(
       fields, payloadFields, fieldStampsRef.current.deleted, now
@@ -1228,7 +1348,7 @@ function CustomerGridSurface({
       adoptNewViews(current, hostWorkspaceViews, viewTombstonesRef.current, now,
                     (config) => normalizeConfig(config, nextFields))
     );
-  }, [workspaceReady, hostWorkspaceViews, payloadFields, fields, previewReadOnly]);
+  }, [workspaceReady, hostWorkspaceViews, payloadFields, fields, hostWorkspace]);
 
   /** Item 3c — stamp a def write / a delete. Pruned at every touch so the persisted blob
    *  stays a recent window, never an archive. */
@@ -1293,7 +1413,7 @@ function CustomerGridSurface({
    * this resolves, the appended row does not exist yet, so "bottom" would land on the last OLD
    * row.
    */
-  const isUserTable = !previewReadOnly && scope.startsWith("ut_");
+  const isUserTable = !embedded && scope.startsWith("ut_");
   const recordsMutable = payload?.recordsMutable !== false;
   const canMutateRecords = isUserTable && recordsMutable;
   /**
@@ -1451,7 +1571,8 @@ function CustomerGridSurface({
 
   // Airtable behavior: configuration changes to the active view autosave.
   useEffect(() => {
-    if (!workspaceReady || previewReadOnly) return;
+    // ⭐⭐ W35-T23 — a Query view AUTOSAVES like any other view; only its TRANSPORT differs.
+    if (!workspaceReady || embedded) return;
     const active = views.find((view) => view.id === activeViewId);
     if (!active || sameConfig(active.config, config)) {
       setSaveState("saved");
@@ -1466,14 +1587,31 @@ function CustomerGridSurface({
       );
       viewWritesRef.current = stampTombstone(viewWritesRef.current, updated.id,
                                              Date.now());
-      emitHostEvent({ id: eventId("view"), type: "view_upsert", view: updated });
+      // ⛔ THE ROUTER, NEVER A BARE `emitHostEvent`. A raw host event carries the MODULE write
+      // scope, which for a Query surface is the SOURCE database — so autosaving a resize would
+      // have written a view into the source's own workspace under the artefact's id. The router
+      // is what keeps "which store does this spec belong to" answered in one place.
+      const routed = routeQueryViewMutation(queryBinding, scope, {
+        id: eventId(queryBinding ? "query-view-update" : "view"),
+        type: "view_upsert",
+        view: updated as unknown as Record<string, unknown>,
+      }, { query: mutateQueryWorkspace, native: emitHostEvent });
+      if (routed.channel === "refused")
+        signal(TOAST_EVENT, routed.refusal?.message ?? "That view change could not be saved.");
+      // ⚠ REPORTED, not swallowed. A write that fails in silence reads exactly like a read that
+      // never happened [[lost-write-looks-like-failed-read]], and this is the one path a person
+      // triggers by dragging a column edge.
+      else if (routed.channel === "query")
+        void routed.result.then((result) => {
+          if (!result.ok) signal(TOAST_EVENT, result.message);
+        });
       setSaveState("saved");
       saveTimer.current = null;
     }, 420);
     return () => {
       if (saveTimer.current !== null) window.clearTimeout(saveTimer.current);
     };
-  }, [workspaceReady, activeViewId, config, views, previewReadOnly]);
+  }, [workspaceReady, activeViewId, config, views, embedded, queryBinding, scope]);
 
   // Numeric dimensions force a glide relayout when either the component frame
   // or Streamlit's main column changes width (notably sidebar collapse).
@@ -1504,7 +1642,7 @@ function CustomerGridSurface({
   const mode = tableMode(payload?.counts);
   const serverWindowed = mode === "server-windowed";
   // Owner items 4+6 — the Cohort page's grid renders without the Views sidebar.
-  const hideViews = previewReadOnly || payload?.workspace?.hideViews === true;
+  const hideViews = !hostWorkspace || payload?.workspace?.hideViews === true;
   // Wave-6 item 10 — how this view displays. A WINDOWED table is always the grid: list/
   // calendar/kanban compute over the whole matched set, and one page is not it (CG-3's rule,
   // the same reason grouping is off there).
@@ -1642,8 +1780,8 @@ function CustomerGridSurface({
   // permissions vs the viewer, fail-closed on restricted fields when the viewer is unknown.
   const viewer = payload?.viewer;
   const canEditField = useCallback(
-    (f: Field): boolean => !previewReadOnly && recordsMutable && mayEditField(f, viewer),
-    [previewReadOnly, recordsMutable, viewer]
+    (f: Field): boolean => !embedded && recordsMutable && mayEditField(f, viewer),
+    [embedded, recordsMutable, viewer]
   );
   const unresolvedCount = useMemo(
     () => unresolvedConditions(config.filters, { cohortSets, today }),
@@ -1848,6 +1986,37 @@ function CustomerGridSurface({
     () => (serverWindowed ? windowedCapabilityNote(payload?.counts?.matched ?? 0) : null),
     [serverWindowed, payload?.counts?.matched]
   );
+  /**
+   * ⭐⭐ W35-T24 (owner item 4 / R2, R6's second sentence) — WHY THERE IS NO TRAILING "+".
+   *
+   * ⛔ NOT SCOPED TO QUERY, DELIBERATELY, AND THAT IS WIDER THAN THE TICKET ASKED. The predicate
+   * is the SOURCE's (`records_mutable`, DESIGN.md §4's locked-database vocabulary), so the answer
+   * belongs to the database rather than to the surface looking at it. Scoping the sentence to
+   * Query would make one database say two different things depending on which door you opened it
+   * through, which is the failure a shared predicate exists to prevent.
+   *
+   * ⚠ `embedded` IS EXEMPT. A linked-record grid inside a modal has no "+" because it is a
+   * picker, not a table, and a footnote apologising for that would be chrome in a dialog.
+   */
+  /**
+   * ⭐ W35-T30 (C5) — the list the RAIL renders: this workspace's views, plus the server's
+   * "Starred records" projection when there is one. See the `views=` prop below for why it is
+   * appended here and not merged into `views`.
+   */
+  const railViews = useMemo(() => {
+    const projection = recordStars.stars.view;
+    if (!projection || views.some((view) => view.id === projection.id)) return views;
+    return [...views, projection];
+  }, [views, recordStars.stars.view]);
+  const lockedNote = useMemo(
+    // ⚠ The label is the ARTEFACT's source name when there is one, and otherwise nothing: the
+    // payload carries no database name, and "This database" is unambiguous on a surface whose
+    // header already says which one it is. Guessing a name from the scope key would print
+    // `ut_odoo_customers` at somebody.
+    () => (embedded ? null
+      : lockedRecordsNote(recordsMutable, isUserTable, queryBinding?.source.label)),
+    [embedded, recordsMutable, isUserTable, queryBinding]
+  );
   const displayRows = useMemo(() => {
     const shown = capped ? sliceForDisplay(visibleRows, displayCap) : visibleRows;
     // ⚠ APPENDED AFTER THE SLICE, so the cap can never eat the totals row itself — and it is the
@@ -2553,9 +2722,19 @@ function CustomerGridSurface({
         // and a `position: fixed` button with no clamp would paint over the chrome on a row
         // nobody can see. The horizontal legs are now defence in depth (a column drag, a box
         // narrower than the frozen strip) rather than the everyday case.
-        const at = b
-          ? expandButtonRect(b, gridBoxRef.current?.getBoundingClientRect())
-          : null;
+        const boxRect = gridBoxRef.current?.getBoundingClientRect();
+        const at = b ? expandButtonRect(b, boxRect) : null;
+        // W35-T29 — the star book-ends the same cell the Expand does, from the SAME bounds. It
+        // has its own minima (smaller mark, left end), so a compact row that cannot carry the
+        // Expand can still carry this one.
+        const starAt = b ? starButtonRect(b, boxRect) : null;
+        setStarHover((prev) =>
+          !starAt
+            ? null
+            : prev && prev.pid === pid && prev.x === starAt.x && prev.y === starAt.y
+              ? prev
+              : { pid, x: starAt.x, y: starAt.y, size: starAt.size }
+        );
         // Recomputed EVERY move, not memoised on the pid: a scroll can leave the pointer over
         // the same record at a new y, and a button that keeps the pid but not the position
         // floats over the wrong row. Referential stability is preserved by comparing values,
@@ -3172,26 +3351,40 @@ function CustomerGridSurface({
      visibleCols, fieldByKey, canEditField]
   );
 
+  /**
+   * ⭐⭐ W35-T23 (R2) — ONE BODY FOR BOTH SURFACES, and the branch that used to sit here is why.
+   *
+   * It had a `if (queryBinding) { ...refuse; return; }` prologue that never touched `views`, so a
+   * Query surface could not change its own spec at all. R2 makes it live, and the ONLY difference
+   * left is which transport the router picks — which is `routeQueryViewMutation`'s whole job, so
+   * asking the question twice (once here, once inside it) was the duplication that made the two
+   * paths drift.
+   *
+   * ⚠ THE STATE UPDATE MUST HAPPEN FOR BOTH. Without it the autosave effect compares `config`
+   * against a `views` entry that never moved, `sameConfig` stays false, and the effect re-fires
+   * every render — a POST per frame for the life of the surface.
+   *
+   * ⚠ A view whose id is NOT the artefact's is still refused by the router (a Query workspace
+   * holds exactly one view), so Duplicate cannot smuggle a second one in.
+   */
   const persistView = useCallback((view: SavedView) => {
-    if (queryBinding) {
-      const routed = routeQueryViewMutation(queryBinding, scope, {
-        id: eventId("query-view-update"),
-        type: "view_upsert",
-        view: view as unknown as Record<string, unknown>,
-      }, { query: mutateQueryWorkspace, native: emitHostEvent });
-      if (routed.channel === "refused")
-        signal(TOAST_EVENT, routed.refusal?.message ?? "This Query binding cannot write a source view.");
-      return;
-    }
     setViews((current) => {
       const found = current.some((item) => item.id === view.id);
       return found
         ? current.map((item) => (item.id === view.id ? view : item))
         : [...current, view];
     });
-    routeQueryViewMutation(undefined, scope, {
-      id: eventId("view"), type: "view_upsert", view: view as unknown as Record<string, unknown>,
+    const routed = routeQueryViewMutation(queryBinding, scope, {
+      id: eventId(queryBinding ? "query-view-update" : "view"),
+      type: "view_upsert",
+      view: view as unknown as Record<string, unknown>,
     }, { query: mutateQueryWorkspace, native: emitHostEvent });
+    if (routed.channel === "refused")
+      signal(TOAST_EVENT, routed.refusal?.message ?? "That view change could not be saved.");
+    else if (routed.channel === "query")
+      void routed.result.then((result) => {
+        if (!result.ok) signal(TOAST_EVENT, result.message);
+      });
   }, [queryBinding, scope]);
 
   /**
@@ -3231,7 +3424,19 @@ function CustomerGridSurface({
       const current = views.find((view) => view.id === activeViewId);
       if (current && !sameConfig(current.config, config))
         persistView({ ...current, config });
-      const next = views.find((view) => view.id === id);
+      /**
+       * ⭐⭐ W35-T30 (C5) — "Starred records" IS SELECTABLE AND IS NOT IN `views`, DELIBERATELY.
+       *
+       * ⛔ IT IS THE SERVER'S PROJECTION, NOT A WORKSPACE VIEW. Half this component keys off
+       * `views`: the autosave, the echo reconcile, `writeLocal`, `uniqueDisplayName`. Merging a
+       * server-owned object into that state would put it into the autosave's comparison and this
+       * browser would start writing a view it does not own — the shape D-170 refuses on a
+       * read-through grid, arriving from the client side instead. So it joins the RAIL's list
+       * (see `railViews`) and is resolved here by name, which is the same split the comment on
+       * `applyViewOrder` makes for view ORDER: a rendering fact about one surface.
+       */
+      const next = views.find((view) => view.id === id)
+        ?? (id === recordStars.stars.view?.id ? recordStars.stars.view : undefined);
       if (!next) return;
       setActiveViewId(id);
       setConfig(normalizeConfig(next.config, fields));
@@ -3246,7 +3451,7 @@ function CustomerGridSurface({
       // Owner item 10: opening a view is "I am working now" — the frame folds its nav rail.
       signal(NAV_MINIMIZE_EVENT);
     },
-    [views, activeViewId, config, persistView, fields, isQueryPreview]
+    [views, activeViewId, config, persistView, fields, isQueryPreview, recordStars.stars.view]
   );
 
   /**
@@ -3650,44 +3855,18 @@ function CustomerGridSurface({
    * order — two lists that decide "is there a number here" by different rules would drift, and
    * the drift would show as a row wearing both a count and an excuse.
    */
-  /**
-   * ⭐⭐ WAVE 33 · T16 (owner item 5) — THE DATABASE'S OWN TOTAL.
-   *
-   * Owner, verbatim: *"Let's also mark important the database, meaning that the database should
-   * have the sum number of all the views with mark important numbers whenever a minimum of 1
-   * view is marked important in a database."*
-   *
-   * ⛔ SUMMED OVER `importantIds`, NOT OVER `alertCounts`, and that is the whole correctness of
-   * this memo. `alertCounts` is keyed by `alerted ∪ important` — a view can be in it because
-   * somebody set a server-side ALERT on it, which is a different feature. Summing the map
-   * wholesale would answer "alerts plus marks" under a label that says marks, and the two sets
-   * overlap, so the error would be invisible on any table where they happen to coincide.
+  /*
+   * ⛔⛔ `importantTotal` IS DELETED (W35-T27, owner item 9 / R4).
    *
-   * ⛔ `partial` IS PART OF THE ANSWER, not a nicety. A marked view gets NO count on a
-   * server-windowed grid or while a measure is unresolved (see `countNotes` below), and a sum
-   * that silently skipped those would render a confident total that is short by an unknown
-   * amount — the exact silent-absence D-205 exists to end, arriving one level up. So the total
-   * carries how many of its views it could not count, and the rail says so.
+   * W33-T16 built it to answer *"the database should have the sum number of all the views with
+   * mark important numbers"*, and W34-T20 stripped its label. Owner item 9 removes the count
+   * from every surface EXCEPT the view itself, so the rail badge it fed is gone and this memo
+   * had no reader. Deleted rather than left computing a value nobody renders
+   * [[artifact-with-no-importer]].
    *
-   * ⚠ IT IS A SUM OF PER-VIEW COUNTS, WHICH IS WHAT WAS ASKED — a record matching three marked
-   * views contributes three. That is "the sum of the views' numbers"; a DISTINCT-record total
-   * would be a different (and more expensive) question, and would disagree with the per-view
-   * badges the user can see and add up themselves.
-   * ⚠ NO NEW QUERY (R8): this folds over `alertCounts`, which the grid has already computed.
+   * ⚠ `importantIds` SURVIVES — it also feeds the `alerted ∪ important` union just above, which
+   * is what decides which views get counted at all. This deletion is the SUM, not the set.
    */
-  const importantTotal = useMemo(() => {
-    if (!importantIds.length) return null;
-    let sum = 0;
-    let counted = 0;
-    for (const id of importantIds) {
-      const n = alertCounts[id];
-      if (typeof n === "number") {
-        sum += n;
-        counted += 1;
-      }
-    }
-    return { sum, counted, marked: importantIds.length };
-  }, [importantIds, alertCounts]);
 
   const countNotes = useMemo(() => {
     const out: Record<string, string> = {};
@@ -5252,7 +5431,7 @@ function CustomerGridSurface({
   const menuVisIndex = menuField ? visibleKeys.indexOf(menuField.key) : -1;
   const menuPinnedTo = menuVisIndex >= 0 && frozenN > 1 && menuVisIndex + 1 === frozenN;
   // Item 10 — the toolbar's mode switcher (grid-only on windowed tables, see displayMode).
-  const modeControl = serverWindowed || previewReadOnly ? undefined : (
+  const modeControl = serverWindowed || embedded || isQueryPreview ? undefined : (
     <ModeSwitch
       mode={displayMode}
       onMode={setDisplayMode}
@@ -5386,10 +5565,25 @@ function CustomerGridSurface({
              * fact about ONE surface; folding it into the state would make every consumer's
              * behaviour depend on a drag, and the drag's whole scope is which row sits where.
              */
-            views={applyViewOrder(views, folderStamps, Date.now())}
+            /**
+             * ⭐⭐ W35-T30 · CONTRACT C5 (R5) — "Starred records" JOINS THE RAIL, NOT THE STATE.
+             *
+             * The server hands back the WHOLE view object (`kind: "system"`, `locked: true`,
+             * `config.memberPids`), so this side never mints a second idea of what it is, and
+             * `types.UNDELETABLE_VIEW_IDS` carries its id beside `all-customers` — the same two
+             * facts that make that one undeletable make this one.
+             *
+             * ⛔ `view` IS `null` UNTIL SOMETHING IS STARRED, and the row is not drawn then. A
+             * view promising starred records and listing none is the D-229 shape: a name that
+             * asserts a set, over an empty one.
+             * ⛔ AND IT IS APPENDED HERE rather than merged into `views` for the reason
+             * `applyViewOrder` states one comment up: `views` is the workspace's list and the
+             * autosave, the echo reconcile and `writeLocal` all key off it. A server-owned object
+             * in that state means this browser starts writing a view it does not own.
+             */
+            views={applyViewOrder(railViews, folderStamps, Date.now())}
             alertCounts={alertCounts}
             countNotes={countNotes}
-            importantTotal={importantTotal}
             activeViewId={activeViewId}
             saveState={saveState}
             onSelect={selectView}
@@ -5655,7 +5849,16 @@ function CustomerGridSurface({
           // canvas, so reaching for it IS an out-of-bounds event and dismissing there would
           // unmount the control under the arriving pointer. Leaving the whole grid box is the
           // honest "you are done with this row".
-          onMouseLeave={() => setExpandAt((prev) => (prev === null ? prev : null))}
+          onMouseLeave={() => {
+            setExpandAt((prev) => (prev === null ? prev : null));
+            // W35-T29: the star control is dismissed with the Expand, and it is HOVER-SCOPED —
+            // say so rather than implying otherwise. It is how you SET a star, and it shows
+            // whether the row under the pointer has one. The persistent answer to "which records
+            // are starred" is R5's own design: the undeletable "Starred records" view beside "All
+            // records" (W35-T30). Marking every starred row in the canvas as well would need a
+            // `getBounds` per visible row on every repaint, for a fact the view already answers.
+            setStarHover((prev) => (prev === null ? prev : null));
+          }}
         >
           {displayMode === "grid" && (
             <>
@@ -5739,7 +5942,7 @@ function CustomerGridSurface({
               height={gridSize.height}
               customRenderers={[ratingCellRenderer, userCellRenderer, imageCellRenderer]}
               headerIcons={HEADER_ICONS}
-              rightElement={previewReadOnly ? undefined : (
+              rightElement={embedded ? undefined : (
                 // Wave-6 item 4 — the "+" of the header row: the create-field form,
                 // insert-at-end.
                 //
@@ -5933,7 +6136,7 @@ function CustomerGridSurface({
               docs={payload?.docs}
               docPayload={payload?.docPayload}
               onDocAdd={
-                !previewReadOnly && payload?.docs
+                !embedded && payload?.docs
                   ? (pid, file) =>
                       emitHostEvent({
                         id: eventId("docadd"),
@@ -5945,13 +6148,13 @@ function CustomerGridSurface({
                   : undefined
               }
               onDocFetch={
-                !previewReadOnly && payload?.docs
+                !embedded && payload?.docs
                   ? (pid, docId) =>
                       emitHostEvent({ id: eventId("docget"), type: "doc_fetch", pid, docId })
                   : undefined
               }
               onDocDelete={
-                !previewReadOnly && payload?.docs
+                !embedded && payload?.docs
                   ? (pid, docId) =>
                       emitHostEvent({ id: eventId("docdel"), type: "doc_delete", pid, docId })
                   : undefined
@@ -6119,6 +6322,43 @@ function CustomerGridSurface({
               </svg>
             </button>
           )}
+          {/* ⭐⭐ W35-T29 (R5, R6) — THE RECORD STAR, at the LEFT end of the row's primary cell,
+              book-ending the Expand at its right end. A real DOM button over the canvas, at
+              glide's own bounds, so the rect IS the hit test and there is no drawn affordance
+              whose click target can drift from its paint ([[ui-invisible-to-assertions]]).
+
+              ⚠ HOVER-SCOPED, AND THAT IS STATED RATHER THAN IMPLIED. This is how you SET a star
+              and it reports whether the row under the pointer has one. "Which records are
+              starred" is answered by the undeletable "Starred records" view beside "All records"
+              (W35-T30), which is R5's own design and costs no per-row bounds call.
+
+              ⚠ `recordStars.ready` gates it: before the read answers, this client does not know
+              the current value, and a control drawn on a guess would flip the wrong way. */}
+          {!embedded && displayMode === "grid" && starHover && recordStars.ready && (
+            <button
+              type="button"
+              className={"cg-row-star" + (recordStars.starred(starHover.pid) ? " is-on" : "")}
+              style={{
+                left: starHover.x,
+                top: starHover.y,
+                width: starHover.size,
+                height: starHover.size,
+              }}
+              aria-pressed={recordStars.starred(starHover.pid)}
+              title={recordStars.starred(starHover.pid) ? "Unstar this record" : "Star this record"}
+              aria-label={
+                recordStars.starred(starHover.pid) ? "Unstar this record" : "Star this record"
+              }
+              // The same `preventDefault` the Expand needs: mousedown would otherwise reach the
+              // canvas underneath, move the selection and repaint the row a frame before the
+              // click lands, which reads as a flicker on every star.
+              onMouseDown={(event) => event.preventDefault()}
+              onClick={() =>
+                recordStars.toggle(starHover.pid, !recordStars.starred(starHover.pid))}
+            >
+              <RecordStarMark size={13} filled={recordStars.starred(starHover.pid)} />
+            </button>
+          )}
           {/* Wave-5 item 6 — the header description tip. pointer-events:none + aria-hidden:
               it can never become a click target, so the control under it stays clickable
               (the tooltip-swallows-the-next-click trap, paid for once already). */}
@@ -6259,7 +6499,7 @@ function CustomerGridSurface({
             ⚠ The display cap and the server's limits are INDEPENDENT FACTS about one grid: one is
             how much we are painting, the other is what the server could not do. They belong in
             the same strip and neither may suppress the other. */}
-        {(foldNote || limitNote || capabilityNote) && (
+        {(foldNote || limitNote || capabilityNote || lockedNote) && (
           <div className="cg-more">
             {foldNote && <span className="cg-more-note">{foldNote}</span>}
             {limitNote && (
@@ -6270,6 +6510,15 @@ function CustomerGridSurface({
                 {capabilityNote.short}
               </span>
             )}
+            {/* ⭐⭐ W35-T24 — WHY THERE IS NO "+", in the strip that already answers "why is this
+                grid not doing what I expected". ⚠ BOTH `title` AND `aria-label`, because D-253
+                booked "explains why it cannot, on hover only" as a defect once already: a title
+                is not announced and an aria-label does not hover. */}
+            {lockedNote && (
+              <span className="cg-more-note" title={lockedNote.full} aria-label={lockedNote.full}>
+                {lockedNote.short}
+              </span>
+            )}
           </div>
         )}
         {capped && (displayMode === "grid" || displayMode === "list") && (
@@ -7037,6 +7286,13 @@ function CustomerGridSurface({
           fields={fields}
           record={detailRecord}
           titleKey={lockedKey}
+          // ⭐ W35-T29 — the SAME star state the row control uses, never a second client. An
+          // embedded grid has neither: `recordStars` is disabled there, so `ready` is false and
+          // the drawer draws no control rather than a dead one.
+          starred={recordStars.starred(detailPid)}
+          {...(recordStars.ready
+            ? { onStar: (on: boolean) => recordStars.toggle(detailPid, on) }
+            : {})}
           positionLabel={`Record ${dataPosition.toLocaleString()} of ${recordCount.toLocaleString()}`}
           canPrev={neighborExists(-1)}
           canNext={neighborExists(1)}
@@ -7057,7 +7313,7 @@ function CustomerGridSurface({
           // on the NEXT render via `payload.docPayload`; Documents.tsx matches it
           // to its own pending request before touching it.
           onDocAdd={
-            !previewReadOnly && payload?.docs
+            !embedded && payload?.docs
               ? (file) =>
                   emitHostEvent({
                     id: eventId("docadd"),
@@ -7069,7 +7325,7 @@ function CustomerGridSurface({
               : undefined
           }
           onDocFetch={
-            !previewReadOnly && payload?.docs
+            !embedded && payload?.docs
               ? (docId) =>
                   emitHostEvent({
                     id: eventId("docget"),
@@ -7080,7 +7336,7 @@ function CustomerGridSurface({
               : undefined
           }
           onDocDelete={
-            !previewReadOnly && payload?.docs
+            !embedded && payload?.docs
               ? (docId) =>
                   emitHostEvent({
                     id: eventId("docdel"),

web/src/customer-grid/RecordDetail.tsx

@@ -102,7 +102,13 @@ import { Documents } from "./Documents";
 import { FIELD_DRAG_TYPE, moveKey, nudgeKey, resolveFieldOrder } from "./recordLayout";
 import RecordComments from "./RecordComments";
 import { isStreamlitComponent } from "./hostBridge";
+// ⚠ ALIASED for the same reason `CustomerGrid` aliases it: `./Stars`'s `StarIcon` is the RATING
+// atom and this one is the record MARK. Two meanings, one noun, both reachable in this tree.
+import { StarIcon as RecordStarMark } from "../ui/icons";
 import "./RecordDetail.css";
+// The drawer's star wears `.cg-detail-star`, which lives beside the grid's own row star — one
+// sheet for one idea, imported by both modules that render its classes (W35-T22's lesson).
+import "./rowStar.css";
 
 export interface RecordDetailProps {
   fields: Field[];
@@ -116,6 +122,18 @@ export interface RecordDetailProps {
   onClose: () => void;
   onNotesChange: (key: string, value: string) => void;
   onNotesCommit: (key: string, value: string) => void;
+  /**
+   * ⭐ W35-T29 (C5, R5/R6) — this record's star, and the two halves travel TOGETHER.
+   *
+   * ⛔ BOTH OPTIONAL AND BOTH FROM THE GRID'S OWN `useRecordStars`, never a second client here:
+   * one list, one answer. An embedded grid passes neither and the control is ABSENT rather than
+   * disabled — a dead star is worse than no star.
+   * ⚠ `starred` alone would render a control that cannot be changed, and `onStar` alone would
+   * render one that cannot say what it currently is; the JSX gates on `onStar` so the pair is
+   * effectively all-or-nothing.
+   */
+  starred?: boolean;
+  onStar?: (on: boolean) => void;
   /** Wave-5 item 1 — the permissions courtesy check rides into the drawer too: a field the
    *  viewer may not edit renders read-only here, exactly as its cells do. */
   viewer?: Viewer;
@@ -286,6 +304,8 @@ export default function RecordDetail({
   onClose,
   onNotesChange,
   onNotesCommit,
+  starred = false,
+  onStar,
   viewer,
   docs,
   docPayload,
@@ -1133,6 +1153,25 @@ export default function RecordDetail({
             </button>
             <span className="cg-detail-pos">{positionLabel}</span>
           </div>
+          {/* ⭐⭐ W35-T29 (R5, R6) — THE SAME RECORD STAR AS THE GRID'S, in the drawer.
+              ⛔ THE SAME STATE, NOT A SECOND ONE: `starred`/`onStar` come from the grid's own
+              `useRecordStars`, so starring here and starring in the row are one act on one list.
+              A drawer with its own client would answer the same question twice and disagree the
+              moment either wrote [[one-evaluator-per-question]].
+              ⚠ ABSENT, not disabled, when the caller passes no handler — an embedded grid has no
+              record stars at all, and a dead control is worse than none. */}
+          {onStar && (
+            <button
+              type="button"
+              className={"cg-detail-star" + (starred ? " is-on" : "")}
+              aria-pressed={starred}
+              aria-label={starred ? "Unstar this record" : "Star this record"}
+              title={starred ? "Unstar this record" : "Star this record"}
+              onClick={() => onStar(!starred)}
+            >
+              <RecordStarMark size={16} filled={starred} />
+            </button>
+          )}
           <button
             type="button"
             className="cg-detail-close"

web/src/customer-grid/ViewSidebar.tsx

@@ -234,13 +234,10 @@ interface ViewSidebarProps {
   /** ⭐ WAVE 33 · T14 (D-205) — for a counted view that got NO number, the sentence saying why.
    *  Never both: a row carries a count or a note, and `alertCounts` is checked first. */
   countNotes?: Record<string, string>;
-  /**
-   * ⭐ WAVE 33 · T16 (owner item 5) — THIS DATABASE'S total across its MARKED views.
-   * `null` when nothing here is marked (item 5's "a minimum of 1 view" clause, as data rather
-   * than as a render condition). `counted < marked` means some marked view had no countable
-   * number, and the rail must say so rather than present a short total as a whole one.
-   */
-  importantTotal?: { sum: number; counted: number; marked: number } | null;
+  /* ⛔ `importantTotal` IS GONE (W35-T27, owner item 9). It carried W33-T16's summed badge at the
+     top of this rail; the owner removed the count from everywhere except the view itself, so the
+     prop has no reader and its memo in `CustomerGrid` went with it rather than being left to
+     compute a value nobody renders [[artifact-with-no-importer]]. */
   /**
    * C4 as AMENDED 2026-07-28 — the folder-level bulk "Add to cohort". The caller
    * owns the arithmetic (it holds the engine); the rail owns the confirm.
@@ -307,7 +304,6 @@ export default function ViewSidebar({
   onViewReorder,
   alertCounts,
   countNotes,
-  importantTotal,
   folderAddPreview,
   onFolderAddToList,
   viewer,
@@ -623,47 +619,20 @@ export default function ViewSidebar({
   const noteView = noteFor
     ? views.find((view) => view.id === noteFor.viewId)
     : undefined;
-  /**
-   * ⭐⭐ WAVE 34 · T20 (R1, contract C1) — THE SENTENCE THE BARE NUMBER CANNOT CARRY.
-   *
-   * R1 drops the word "Important" from this badge, so what is left on screen is a figure with
-   * no noun. W33-T16's own note argued the opposite ("an unlabelled figure at the top of a list
-   * of views reads as a count OF VIEWS") and it was right about the risk; the owner's ruling
-   * settles the pixels, and this is where the meaning goes instead. Hover and screen reader get
-   * the whole fact, in one string, on the one element.
+  /*
+   * ⛔⛔ `importantNote` IS DELETED WITH THE BADGE IT LABELLED (W35-T27, owner item 9 / R4).
    *
-   * ⛔ THE `counted === 0` BRANCH IS D-252, NOT A TIDY-UP. On a fully server-windowed database
-   * every marked view returns no number, so `importantTotal` is `{sum: 0, counted: 0, marked: N}`
-   * — TRUTHY — and the rail painted "Important 0+". Drop the word and that becomes a bare "0+",
-   * which is strictly worse: a real zero and an unknown are the same three pixels. So a total
-   * that could count NOTHING wears the same is-unknown mark a single uncountable view wears
-   * (T14), and never a manufactured 0.
+   * It existed because W34-T20's ruling took the WORD off the rail's summed badge and left a
+   * figure with no noun, so the whole sentence moved into that one element's `title` and
+   * `aria-label`. Item 9 removes the badge itself, so there is no element left to label. The
+   * per-view badges keep their own `countNotes` sentence (see the view row below) — that
+   * derivation is separate and is untouched.
    *
-   * ⚠ THE CAUSE IS QUOTED, NOT INVENTED. The two reasons a count is missing (a windowed grid, an
-   * unresolved measure) produce different sentences and this rail cannot tell them apart, so it
-   * reads the FIRST marked view's own `countNotes` entry rather than asserting one of them. No
-   * note at all still gets a sentence with a next step, never silence — R6's second half.
+   * ⚠ D-252's lesson does NOT die here, it moves: "a total that could count nothing must not
+   * paint a manufactured 0" now lives entirely in the per-view badge and in E's
+   * `GET /starred/counts`, whose `notes` map carries the cause for a view whose count is not
+   * free (contract C3). Nothing about it is now stated in two places.
    */
-  let importantNote = "";
-  if (importantTotal) {
-    const { sum, counted, marked } = importantTotal;
-    const nViews = `${marked} view${marked === 1 ? "" : "s"} marked important in this database`;
-    if (counted === 0) {
-      const cause = views
-        .filter((v) => v.config?.important)
-        .map((v) => countNotes?.[v.id])
-        .find(Boolean);
-      importantNote =
-        `No number yet for the ${nViews}. `
-        + (cause || "Open a marked view to see why its own count is missing.");
-    } else if (counted < marked) {
-      importantNote =
-        `${sum.toLocaleString()} records across ${counted} of the ${nViews}. `
-        + `The rest cannot be counted in the browser, so this total is lower than the real one.`;
-    } else {
-      importantNote = `${sum.toLocaleString()} records across the ${nViews}.`;
-    }
-  }
 
   const create = () => {
     const value = name.trim();
@@ -796,64 +765,19 @@ export default function ViewSidebar({
             />
           </svg>
         </button>
-        {/* ⭐⭐ WAVE 33 · T16 (owner item 5) — THE DATABASE'S OWN TOTAL, at the top of its rail.
-            Owner: the database should carry the SUM of its marked views' numbers, whenever at
-            least one view in it is marked.
-            ⛔ HERE, and not in the shell's database header, DELIBERATELY: this rail belongs to
-            the OPEN database, so a total in it needs no database name to be unambiguous.
-            ⚠ `counted < marked` is a PARTIAL total: some marked view could not be counted (a
-            windowed grid, an unresolved measure). It says so instead of presenting a short sum
-            as a whole one, which is D-205's rule one level up.
-
-            ⭐⭐ WAVE 34 · T20 (R1) REVERSED THE LABEL DECISION, AND THE REVERSAL IS THE OWNER'S.
-            T16 shipped this as the word "Important" plus a badge, on the argument recorded in
-            its own note: "an unlabelled figure at the top of a list of views reads as a count OF
-            VIEWS". R1 answers that directly, in the owner's words: the count belongs in the
-            database NAVIGATION (B's flyout, contract C1), and what stays here is the number
-            alone, smaller, with no word. The risk T16 named is real and is answered by
-            `importantNote` rather than by a label: the badge carries the whole sentence in its
-            `title` AND its `aria-label`, so hover and screen reader both get the noun the pixels
-            gave up. ⛔ Do not re-add the word to satisfy the old note; `verify_grid_ux`'s
-            `[VIEWS RAIL]` scan reds on it, with a control that reproduces the regression. */}
-        {importantTotal && (
-          <span
-            className={
-              "cg-views-important" +
-              // ⚠ PARTIAL means "the number you can see is real and short". A total that counted
-              // NOTHING has no number to be short, so it must not wear the dashed-purple partial
-              // mark as well as the is-unknown one — two statements about one absence.
-              (importantTotal.counted > 0 && importantTotal.counted < importantTotal.marked
-                ? " is-partial"
-                : "")
-            }
-          >
-            {/* ⚠ `role="img"` ON BOTH, and it is not decoration. An `aria-label` on a plain
-                roleless inline `<span>` is not reliably exposed by assistive technology, and
-                this badge is now the ONLY carrier of a noun the pixels no longer say. `img` is
-                the correct role for "a graphic whose whole meaning is its label", and it also
-                stops a screen reader announcing the bare digits as loose text. */}
-            {importantTotal.counted === 0 ? (
-              <span
-                className="cg-view-count is-unknown"
-                role="img"
-                title={importantNote}
-                aria-label={importantNote}
-              >
-                -
-              </span>
-            ) : (
-              <span
-                className="cg-view-count"
-                role="img"
-                title={importantNote}
-                aria-label={importantNote}
-              >
-                {importantTotal.sum.toLocaleString()}
-                {importantTotal.counted < importantTotal.marked ? "+" : ""}
-              </span>
-            )}
-          </span>
-        )}
+        {/* ⛔⛔ THE DATABASE'S OWN TOTAL IS DELETED FROM THIS ROW (W35-T27, owner item 9 / R4).
+            Owner, verbatim: *"remove [the important count] anywhere else but the View itself."*
+            W33-T16 put a summed badge here and W34-T20 stripped its label; item 9 removes the
+            badge outright. **The PER-VIEW badge on each view row is untouched** — that is what
+            "the View itself" means, and it is the half that survives.
+            ⚠ THE ROW IS NOT EMPTY: `.cg-views-top` still carries the minimize toggle, which is
+            now its ONLY child and therefore genuinely first (W35-T28). A's W35-T11 flipped this
+            row to `justify-content: flex-start` and deleted all four `.cg-views-important*`
+            rules; the badge's `margin-left: auto` had been OUTRANKING that flex rule, which is
+            why the toggle sat left on a database with a marked view and right on one without.
+            ⛔ `verify_grid_ux.py`'s `[VIEWS RAIL]` scan is INVERTED, not deleted: it asserts the
+            badge's ABSENCE from this row and its PRESENCE on the view rows, so re-adding one
+            reds it. */}
       </div>
       {/*
         I13 — the "Views / All changes saved" header block is GONE and everything moved up.
@@ -1499,10 +1423,13 @@ export default function ViewSidebar({
                       // same place), so a single sentence about alerting would tell a reader who
                       // marked a view that they had created an alert they did not create. The
                       // number is the same fact; the promise attached to it is not.
+                      // ⭐ W35-T26 (R4): the word on screen is STAR. The stored key is still
+                      // `config.important` — R4 makes them ONE flag, so renaming the key would
+                      // create the second store the ruling forbids.
                       title={
                         view.config?.important
                           ? `${alertCounts[view.id].toLocaleString()} records match this view. `
-                            + `You marked it important.`
+                            + `You starred it.`
                           : `${alertCounts[view.id].toLocaleString()} records match this `
                             + `view. You are alerted when a new one arrives.`
                       }
@@ -2069,16 +1996,25 @@ export default function ViewSidebar({
               holds views; the scope key belongs to the route) — and because the server
               refuses a view with no active filter, which is a message the frame is
               already in the business of showing. */}
-          {/* ⭐⭐ WAVE 32 · T24 (owner item 17, ruling R5, contract C4) — "Mark important".
+          {/* ⭐⭐ WAVE 32 · T24 (owner item 17, ruling R5, contract C4) — the one mark.
               ⛔ ABOVE the alert row, which is the done-when's own word and not a nicety: the two
               rows produce THE SAME red pill in the rail, and the cheap, private, instantly
               reversible one has to be reachable before the one that creates a stored server-side
               alert. Offered first, a user who only wanted to keep an eye on a number never has
               to make an alert to get one.
-              ⛔ ONE MARK. R5 is explicit: no second severity, no colour variants —
-              `verify_icons` asserts the absence of the word so a second one cannot arrive by
+              ⛔ ONE MARK. W32-R5 is explicit: no second severity, no colour variants —
+              `verify_icons` asserts the absence of a second one so it cannot arrive by
               copy-paste from this very row. The label FLIPS rather than the state being implied,
-              because "Mark important" on an already-marked view reads as a label for the view. */}
+              because a "star this" label on an already-starred view reads as a label for the view.
+
+              ⭐⭐ W35-T26 (owner item 9 / R4) — THE LABEL IS "STAR" NOW, AND ONLY THE LABEL.
+              Owner: star and mark-important are ONE idea and ONE flag, and the word on screen is
+              **Star**. So this pair reads Star / Unstar, the glyph was ALREADY a star (W33-T15),
+              and the STORED key stays `config.important` — renaming the key would create exactly
+              the second store R4 forbids, and would 400 every view already marked.
+              ⚠ `verify_icons.py`'s T24 leg PINS these two strings and is A's file, so it reds on
+              this rename until A retargets it at the CLAIM (one mark, above the alert row) rather
+              than the spelling [[a-gate-that-pins-a-spelling-not-a-claim]]. Raised as `ASK C-10`. */}
           {onToggleImportant && (
             <button
               type="button"
@@ -2099,11 +2035,11 @@ export default function ViewSidebar({
                   `MenuLabel` takes `MenuIconName | ReactNode`, so a glyph no other menu row needs
                   costs the shared `MENU_ICONS` vocabulary nothing.
                   ⚠ `filled` is what says the view IS marked, so the pair still reads mark/unmark.
-                  ⚠ `verify_icons`'s T24 leg pins the two LABEL strings and this row's position
-                  above the alert row — neither moves here. */}
+                  ⚠ `verify_icons`'s T24 leg pins this row's position above the alert row, which
+                  does not move here; W35-T26 changes only the two LABEL strings. */}
               <MenuLabel
                 icon={<StarIcon size={16} filled={!!menuView.config?.important} />}
-                text={menuView.config?.important ? "Unmark important" : "Mark important"}
+                text={menuView.config?.important ? "Unstar" : "Star"}
               />
             </button>
           )}

web/src/customer-grid/counts.ts

@@ -317,6 +317,55 @@ export function windowedCapabilityNote(matched: number): { short: string; full:
   };
 }
 
+/**
+ * ⭐⭐ W35-T24 (owner item 4 / R2, and R6's SECOND SENTENCE) — WHY THIS GRID HAS NO "+".
+ *
+ * ⛔ THE DEFECT THIS EXISTS FOR IS AN ABSENCE, WHICH IS WHY NOTHING CAUGHT IT. A grid whose source
+ * cannot take a record simply has no trailing row: correct, and indistinguishable from a table
+ * that has not loaded, from a permission the reader lacks, and from a bug. D-258 is the same
+ * shape one column over (ten blank columns on a locked connected-source grid with nothing in the
+ * payload saying why) and it was booked as a defect, not as restraint. R6's rule is that a limit
+ * which cannot be removed must be REPORTED with its cause and a recommended next step.
+ *
+ * ⚠ TWO DIFFERENT CAUSES, TWO DIFFERENT SENTENCES, because only one of them has a next step:
+ *   · a LOCKED database (`recordsMutable === false`) — rows arrive from a connector and are
+ *     replaced by it, so adding one here would be overwritten. The next step is real: add it in
+ *     the system that owns the records, and it appears here on the next sync.
+ *   · a BUILT-IN database (not `ut_*`) — there is no rows endpoint to POST to at all. The next
+ *     step is a different door, not this one.
+ * Collapsing them into "you cannot add records here" would tell the first reader nothing they can
+ * act on, which is the half of R6 that gets dropped.
+ *
+ * ⚠ THE SHORT FORM IS A SENTENCE, NOT A LABEL. D-253 booked "explains why it cannot, on hover
+ * only" as a defect once already; the caller puts `full` in BOTH `title` and `aria-label`, and
+ * `short` has to stand alone for a reader who never hovers.
+ */
+export function lockedRecordsNote(
+  recordsMutable: boolean,
+  isUserTable: boolean,
+  label?: string,
+): { short: string; full: string } | null {
+  if (recordsMutable && isUserTable) return null;
+  const name = (label || "").trim() || "This database";
+  if (!recordsMutable) {
+    return {
+      short: "Records here come from a connected source",
+      full:
+        `${name} is kept in step with a connected system, so records cannot be added, deleted `
+        + `or removed from this grid: the next sync would replace them. Columns you add here are `
+        + `yours and are kept. To add a record, add it in the system the data comes from and it `
+        + `arrives here on the next sync.`,
+    };
+  }
+  return {
+    short: "This database does not take new records here",
+    full:
+      `${name} is built from data this product assembles rather than from rows people type, so `
+      + `there is no place for this grid to put a new record. Everything else works: filter, `
+      + `sort, group, add columns and edit the cells you own.`,
+  };
+}
+
 /**
  * The predicate this browser has asked the SERVER to evaluate, as one comparable string.
  *

web/src/customer-grid/overlayPlacement.ts

@@ -423,6 +423,52 @@ export function expandButtonRect(
   return { x, y, size };
 }
 
+// ------------------------------------------------ W35-T29 (R5): the record star, on the row
+
+/** Smaller than the Expand button: a mark, not an action with a destination. */
+export const STAR_BTN_SIZE = 18;
+/** From the LEFT edge of the primary cell, mirroring `EXPAND_BTN_INSET` at the other end. */
+export const STAR_BTN_INSET = 4;
+
+/**
+ * ⭐⭐ W35-T29 (R5) — where the row's star sits: **at the LEFT end of the primary cell**, which is
+ * the gutter position in this product. Airtable puts the row's own marks there; our Expand button
+ * already occupies the RIGHT end of the same cell (`expandButtonRect`), so the two book-end the
+ * primary cell and neither can land on the other.
+ *
+ * ⛔ THE SAME BOUNDS, FROM THE SAME SOURCE. `primary` is glide's own `getBounds(0, row)`, so
+ * freeze, horizontal scroll and row-height mode are handled by the component that owns them
+ * rather than re-derived here — and because the button is a real `<button>` over the canvas, this
+ * rect IS the hit test. A canvas-DRAWN star would need a second copy of this arithmetic for its
+ * click target, which is the shape [[ui-invisible-to-assertions]] names.
+ *
+ * ⚠ ITS MINIMA ARE ITS OWN AND ARE LOWER THAN THE EXPAND'S. This mark is smaller and sits where
+ * the text starts rather than where it ends, so a row that cannot carry the Expand can still
+ * carry this. Sharing `EXPAND_BTN_MIN_ROW` would have hidden the star on exactly the compact row
+ * heights a long list is read at.
+ *
+ * `null` when the row is too short, or when the rect would fall outside the grid's own box —
+ * absent rather than clamped, for the same reason the Expand is: a clamped `position: fixed`
+ * button sits at the edge pointing at a row whose cell is somewhere else.
+ */
+export function starButtonRect(
+  primary: { x: number; y: number; width: number; height: number },
+  box?: { x: number; y: number; width: number; height: number },
+  size = STAR_BTN_SIZE,
+  inset = STAR_BTN_INSET
+): { x: number; y: number; size: number } | null {
+  if (primary.height < size + 2) return null;
+  // It must leave room for a readable label beside it, or the mark covers the name it marks.
+  if (primary.width < size + inset * 2 + EXPAND_BTN_MIN_LABEL) return null;
+  const x = Math.round(primary.x + inset);
+  const y = Math.round(primary.y + (primary.height - size) / 2);
+  if (box) {
+    if (x < box.x || x + size > box.x + box.width) return null;
+    if (y < box.y || y + size > box.y + box.height) return null;
+  }
+  return { x, y, size };
+}
+
 /**
  * Where a panel of `panel` size should sit relative to `target`, inside `viewport`.
  *

web/src/customer-grid/queryPreview.ts

@@ -48,9 +48,23 @@ export type QueryViewMutationRoute<T> =
   | { channel: "native" };
 
 /**
- * The sole bridge between existing view callbacks and a virtual Query artefact.  Query owns
- * the mutation policy: creates and updates are refused locally, while a matching delete travels
- * only to E's Query transport.  A denied/mismatched binding cannot fall through to `native`.
+ * The sole bridge between existing view callbacks and a virtual Query artefact.  Query owns the
+ * routing policy: every mutation of the artefact's OWN view travels on E's Query transport and
+ * nothing else may.  A denied/mismatched binding cannot fall through to `native`.
+ *
+ * ⭐⭐ W35-T23 (owner item 4 / R2) — **`view_upsert` ON THE ARTEFACT ITSELF NOW ROUTES INSTEAD OF
+ * BEING REFUSED.** Owner: *"I should be able to interact in each of the View under Query as well,
+ * exactly like how I would be able to interact with it under Database view."* Resizing a column,
+ * sorting, grouping, hiding and row height are all one thing to this function — a view spec being
+ * written — so making them work is a routing change, not a permission change.
+ *
+ * ⛔ TWO REFUSALS SURVIVE ON PURPOSE, AND THEY ARE THE ONES THAT ARE NOT ABOUT READ-ONLY:
+ *   · **`view_create` stays refused.** A Query workspace holds EXACTLY ONE view, the artefact. A
+ *     second one would have no artefact behind it, no citations, and no id the server could route.
+ *   · **an upsert naming a DIFFERENT id stays refused.** Duplicate-view mints a new id and calls
+ *     the same door; without this clause it would create that second view by another name.
+ * The delete rule is unchanged, and all three now read the same way: the artefact's own id is the
+ * only thing this transport will carry.
  */
 export function routeQueryViewMutation<T>(
   binding: QueryVirtualBinding | undefined,
@@ -65,6 +79,12 @@ export function routeQueryViewMutation<T>(
     if (!acceptsQueryPreview(binding, scope)) return { channel: "refused", refusal: null };
     if (event.type === "view_delete" && event.viewId === binding.artifactId)
       return { channel: "query", result: sinks.query(binding, event) };
+    // ⚠ The id is read off the VIEW here, not off `event.viewId` — an upsert carries its subject
+    // in the payload, and a caller that set neither must not be treated as naming the artefact.
+    if (event.type === "view_upsert"
+        && typeof (event.view as { id?: unknown } | undefined)?.id === "string"
+        && (event.view as { id: string }).id === binding.artifactId)
+      return { channel: "query", result: sinks.query(binding, event) };
     return {
       channel: "refused",
       refusal: refuseQueryMutation(binding, event.type === "view_create" ? "create" : "update"),

web/src/customer-grid/recordStars.ts

@@ -0,0 +1,187 @@
+// ---------------------------------------------------------------------------
+// customer-grid / recordStars.ts — W35-T29 + W35-T30, CONTRACT C5 (rulings R5, R6).
+//
+// ⭐⭐ THE RECORD STAR IS A DIFFERENT SCOPE FROM EVERY OTHER STAR IN THIS PRODUCT, and that is
+// the one thing to carry away from this file. A star on a DATABASE, an AGENT or a QUERY is
+// `config.important` on one record, so starring a SHARED view stars it for everybody who can see
+// it (mailbox E-3). A RECORD star is PER USER (R6): it lives in the same per-username stratum
+// views already live in, and two accounts looking at one row see two different answers. One word
+// on screen, two scopes underneath.
+//
+// ⛔ WHY THIS IS ITS OWN DOOR AND NOT A VIEW WRITE (D-170). A view write on a read-through grid
+// answers 409 `window_required`: `/grid/events` → `ut_write_ctx` → `scoped_pids` materialises the
+// whole pool, and on `ut_odoo_gl_lines` that is 971,034 rows. E's route writes a `starredRecords`
+// key in the per-user stratum and asks for no pid set, so it answers 200 on the big grids — proven
+// on a seeded read-through table, with the store showing `['starredRecords']` and NO `views` key.
+//
+// ⚠ AND IT DELIBERATELY DOES NOT VALIDATE THE ID against the row set, for the same reason:
+// checking that a pid exists means materialising the pool, i.e. the 409 again. The READ prunes —
+// `memberPids` is intersected with the rows the caller can see, exactly as a cohort already is.
+// ---------------------------------------------------------------------------
+
+import { useCallback, useEffect, useRef, useState } from "react";
+
+import { API_V1, CREDENTIALS, TOAST_EVENT, signal } from "../apiContract";
+import type { SavedView } from "./types";
+import { topicForScope } from "./types";
+
+/**
+ * ⛔ E's CONSTANTS, IMPORTED IN SPIRIT AND RESTATED HERE BECAUSE THE WIRE IS THE CONTRACT.
+ * `routes_starred.STARRED_VIEW_ID` is `"starred-records"` and `STARRED_VIEW_NAME` is
+ * `"Starred records"`. This client never MINTS the view — the server hands the whole object back
+ * — so these exist only to recognise it and to keep it undeletable (`types.UNDELETABLE_VIEW_IDS`).
+ */
+export const STARRED_VIEW_ID = "starred-records";
+
+export interface RecordStars {
+  /** The database key the answer is about, echoed so a late response cannot be misfiled. */
+  database: string;
+  count: number;
+  ids: number[];
+  /**
+   * ⭐ THE WHOLE VIEW OBJECT, NOT AN ID LIST, and E published it that way on purpose: the rail
+   * would otherwise have to mint a second idea of what this view is, and the two would drift.
+   * ⚠ `null` WHEN NOTHING IS STARRED. A view promising starred records and listing none is the
+   * D-229 shape, so the row is not drawn at all until there is something in it.
+   */
+  view: SavedView | null;
+}
+
+export const NO_RECORD_STARS: RecordStars =
+  { database: "", count: 0, ids: [], view: null };
+
+/**
+ * The database key C5's door takes, from the grid's SCOPE.
+ *
+ * ⛔ THESE ARE TWO DIFFERENT SPELLINGS AND CONFLATING THEM IS A BOOKED DEFECT. A grid scope is
+ * `customer`; the registry key is `customer_data`. Wave 33 found three inline copies of that map
+ * and one of them filed an alert against the wrong topic, 200 OK and silent. `topicForScope` is
+ * the one answer, so this file asks it rather than adding a fourth copy.
+ */
+export function starDatabaseKey(scope: string): string {
+  return topicForScope(scope).key;
+}
+
+function parse(body: unknown, fallbackDatabase: string): RecordStars {
+  const row = (body ?? {}) as Record<string, unknown>;
+  const view = row.view && typeof row.view === "object" ? (row.view as SavedView) : null;
+  return {
+    database: typeof row.database === "string" && row.database ? row.database : fallbackDatabase,
+    count: typeof row.count === "number" ? row.count : 0,
+    // PRUNE, NEVER INVENT — the same discipline `parseStarred` and `parseNavImportant` follow.
+    ids: Array.isArray(row.ids)
+      ? row.ids.filter((id): id is number => typeof id === "number" && Number.isFinite(id))
+      : [],
+    view: view && typeof (view as { id?: unknown }).id === "string" ? view : null,
+  };
+}
+
+async function callStars(path: string, init: RequestInit, database: string):
+Promise<{ ok: true; value: RecordStars } | { ok: false; message: string }> {
+  let res: Response;
+  try {
+    res = await fetch(`${API_V1}${path}`, { credentials: CREDENTIALS, ...init });
+  } catch {
+    return { ok: false, message: "Cannot reach the server." };
+  }
+  const body = (await res.json().catch(() => null)) as unknown;
+  if (!res.ok) {
+    const detail = (body as { error?: { message?: string } } | null)?.error?.message;
+    return {
+      ok: false,
+      message: detail && res.status < 500
+        ? detail
+        : "Something went wrong on our side. The star was not saved.",
+    };
+  }
+  return { ok: true, value: parse(body, database) };
+}
+
+export function loadRecordStars(database: string) {
+  return callStars(`/starred/records?database=${encodeURIComponent(database)}`, {}, database);
+}
+
+export function setRecordStar(database: string, id: number, on: boolean) {
+  return callStars("/starred/records", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    // ⚠ THE ID GOES AS A STRING OF DIGITS. C5 names a NON-NUMERIC id as a 400, and a pid is a
+    // number here — `String(id)` is the conversion, not `id.toString(36)` or a template with a
+    // prefix. The route's own 400 is the wall; this is just not asking for it.
+    body: JSON.stringify({ database, id: String(id), on }),
+  }, database);
+}
+
+/**
+ * ⭐ The grid's record stars, read once per database open.
+ *
+ * ⛔ IT IS NOT MOUNT-BLOCKING AND IT MUST NOT BECOME SO. This is one small read, unlike
+ * `GET /starred` (E measured that one at 7,331 ms cold because it scans every visible database's
+ * view bucket) — but the grid paints rows long before this answers, and gating the table on it
+ * would trade a real table for a spinner over a decoration.
+ *
+ * ⚠ THE GENERATION GUARD IS NOT OPTIONAL. Two clicks in quick succession, or a database switch
+ * mid-flight, leave two responses racing and the slower one wins; the counter is what makes the
+ * last INTENT win instead of the last packet. Same shape `useStarred` uses, for the same reason.
+ */
+export function useRecordStars(scope: string, enabled: boolean): {
+  stars: RecordStars;
+  ready: boolean;
+  starred: (pid: number) => boolean;
+  toggle: (pid: number, on: boolean) => void;
+} {
+  const database = starDatabaseKey(scope);
+  const [stars, setStars] = useState<RecordStars>(NO_RECORD_STARS);
+  const [ready, setReady] = useState(false);
+  const gen = useRef(0);
+
+  useEffect(() => {
+    if (!enabled) return;
+    const mine = gen.current + 1;
+    gen.current = mine;
+    setReady(false);
+    void loadRecordStars(database).then((result) => {
+      if (gen.current !== mine) return;
+      // ⛔ A FAILED READ IS NOT AN EMPTY LIST, but here it degrades to one DELIBERATELY and
+      // silently: a toast on every grid open because a decoration could not load would be worse
+      // than the missing stars. `ready` stays false, so no control is drawn and nobody is told
+      // something is starred when we do not know. A failed WRITE is loud — see `toggle`.
+      if (result.ok) {
+        setStars(result.value);
+        setReady(true);
+      }
+    });
+  }, [database, enabled]);
+
+  const toggle = useCallback((pid: number, on: boolean) => {
+    const mine = gen.current + 1;
+    gen.current = mine;
+    // Optimistic, then reconciled from the server's own answer — which is also what carries the
+    // updated projection view, so the rail row appears on the first star with no second request.
+    setStars((cur) => ({
+      ...cur,
+      ids: on ? [...cur.ids, pid] : cur.ids.filter((id) => id !== pid),
+      count: on ? cur.count + 1 : Math.max(0, cur.count - 1),
+    }));
+    void setRecordStar(database, pid, on).then((result) => {
+      if (gen.current !== mine) return;
+      if (result.ok) {
+        setStars(result.value);
+        return;
+      }
+      // ⛔ A REFUSED WRITE SAYS SO AND PUTS THE LIST BACK. Leaving the optimistic flip on screen is
+      // the worst of the three options: the reader believes a star was saved that was not, and
+      // finds out on their next reload [[lost-write-looks-like-failed-read]]. The 400 this most
+      // often carries is `starred_full` past 500, whose message names its own cause.
+      signal(TOAST_EVENT, result.message);
+      void loadRecordStars(database).then((again) => {
+        if (again.ok) setStars(again.value);
+      });
+    });
+  }, [database]);
+
+  const starred = useCallback(
+    (pid: number) => stars.ids.includes(pid), [stars.ids]);
+
+  return { stars, ready, starred, toggle };
+}

web/src/customer-grid/rowStar.css

@@ -0,0 +1,76 @@
+/* ---------------------------------------------------------------------------
+   customer-grid / rowStar.css — W35-T29 (rulings R5, R6), the record star.
+
+   ⛔ ITS OWN SHEET, AND THE REASON IS OWNERSHIP RATHER THAN TIDINESS. `.cg-row-expand`, the hover
+   control this one sits beside, lives in `index.css`, which belongs to another lane this wave. A
+   new surface brings its own stylesheet (the wave's own rule) and a change to an existing
+   `.cg-*` rule is that lane's ticket.
+
+   ⚠ IMPORTED BY `CustomerGrid.tsx`, the module that RENDERS these classes — never by a lazy
+   parent. W35-T22 in this same wave was exactly that mistake one directory over: `query.css` was
+   imported only by a `lazy()` page while the component drawing its classes shipped in another
+   chunk, so the rail painted unstyled for a network round trip.
+   --------------------------------------------------------------------------- */
+
+/* The hover control at the LEFT end of the primary cell, mirroring the Expand button at its
+   right end. Both are real DOM buttons laid over the canvas at glide's own bounds, so the rect
+   IS the hit test and there is no second copy of the geometry to drift from the drawing. */
+.cg-row-star {
+  position: fixed;
+  z-index: 55;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0;
+  border: 1px solid transparent;
+  border-radius: var(--lp-r-sm);
+  background: transparent;
+  color: var(--lp-muted);
+  cursor: pointer;
+}
+
+/* ⛔ A STARRED ROW'S MARK IS NOT HOVER-ONLY. The hover control is how you SET one; a row that is
+   already starred has to say so while the pointer is elsewhere, or the grid cannot answer the
+   question the feature exists for. D-253 is a booked defect whose whole content is "satisfied
+   only on hover" — this is that lesson applied to a mark rather than to an explanation.
+   The always-on mark is drawn by the same button with `is-on`; the caller keeps it mounted for a
+   starred row whether or not the pointer is over it. */
+.cg-row-star.is-on {
+  color: var(--lp-yellow-deep);
+}
+
+.cg-row-star:hover {
+  border-color: var(--lp-line);
+  background: var(--cg-white);
+  color: var(--lp-yellow-deep);
+}
+
+.cg-row-star:focus-visible {
+  outline: 2px solid var(--lp-blue-deep);
+  outline-offset: 1px;
+}
+
+.cg-row-star:disabled {
+  cursor: default;
+  opacity: 0.55;
+}
+
+/* The drawer's own copy of the control (`RecordDetail`), which is in the flow rather than over a
+   canvas — so it takes the colour rules above and none of the positioning. */
+.cg-detail-star {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 28px;
+  height: 28px;
+  padding: 0;
+  border: 1px solid transparent;
+  border-radius: var(--lp-r-sm);
+  background: transparent;
+  color: var(--lp-muted);
+  cursor: pointer;
+}
+
+.cg-detail-star.is-on { color: var(--lp-yellow-deep); }
+.cg-detail-star:hover { border-color: var(--lp-line); color: var(--lp-yellow-deep); }
+.cg-detail-star:disabled { cursor: default; opacity: 0.55; }

web/src/customer-grid/types.ts

@@ -2772,11 +2772,24 @@ export interface ViewConfig {
    */
   cohortLock?: string;
   /**
-   * ⭐⭐ WAVE 32 · T24 · CONTRACT C4 (owner item 17, ruling R5) — **"Mark important".**
+   * ⭐⭐ WAVE 32 · T24 · CONTRACT C4 (owner item 17, W32 ruling R5) — **the star.**
    *
    * The view carries a live count of its own matching records, in the red accent, beside its
    * name in the rail.
    *
+   * ⛔⛔ **THE KEY IS `important` AND THE WORD ON SCREEN IS "STAR", AND THAT MISMATCH IS
+   * DELIBERATE (W35-T26, owner item 9 / R4).** Owner: star and mark-important are ONE idea and
+   * ONE flag; the label retires, the flag does not. Renaming this key would create exactly the
+   * second store R4 forbids, and every view already marked would lose its star silently — the
+   * server's allowlist reads `cfg.get('important')` by name.
+   * ⚠ So `POST /api/v1/starred {kind: "view"}` (contract C2) resolves to THIS key rather than to
+   * a store of its own, and E asserts that in `api_api` with a control that looks for a second
+   * one. If you are about to add a `starred?: boolean` beside this, stop and re-read R4.
+   * ⚠ AND THE SCOPE IS NOT WHAT THE SCREEN SUGGESTS: this flag lives on the VIEW RECORD, and a
+   * SHARED view has exactly one record — so starring a shared view stars it for everybody who can
+   * see it, and any collaborator can clear it (mailbox E-3). A RECORD star is per user; a shared
+   * view's star is tenant-wide. Two scopes behind one word.
+   *
    * ⛔ **ONE MARK. There is no `critical`, no severity and no colour variants** — R5 is explicit,
    * and `verify_icons`' view-menu scan asserts the absence of the word so a second severity
    * cannot arrive by copy-paste. It is a legibility mark, not a lock: it says "keep this number
@@ -2936,7 +2949,22 @@ export function allViewName(scope: string): string {
  */
 export const IG_OVERVIEW_VIEW_ID = "tpl_overview";
 
-export const UNDELETABLE_VIEW_IDS = new Set([ALL_VIEW_ID, IG_OVERVIEW_VIEW_ID]);
+/**
+ * ⭐⭐ W35-T30 · CONTRACT C5 (R5) — the per-user "Starred records" projection.
+ *
+ * ⛔ THE SERVER MINTS IT AND THIS SIDE ONLY RECOGNISES IT. `routes_starred.STARRED_VIEW_ID`
+ * carries the same literal and hands back the WHOLE view object (id, name, `kind: "system"`,
+ * `locked: true`, `config.memberPids`), so the rail never builds a second idea of what this view
+ * is. The constant is here because the UNDELETABLE set below is what makes it undeletable, on the
+ * same two facts that protect `all-customers`.
+ *
+ * ⚠ ITS ROW SET IS CURATED (`memberPids`), which is also the ONE shape
+ * `routes_nav._view_record_count` counts for FREE — so a real number can sit beside it on Home
+ * and in Starred for nothing, rather than a dash and an excuse (contract C3).
+ */
+export const STARRED_VIEW_ID = "starred-records";
+
+export const UNDELETABLE_VIEW_IDS = new Set([ALL_VIEW_ID, IG_OVERVIEW_VIEW_ID, STARRED_VIEW_ID]);
 
 // ─────────────────────────────────────────────── wave 16 C-TOPIC: the grid's TOPIC
 /**

web/src/home/HomePage.tsx

@@ -31,6 +31,13 @@ import { AGENTS_MODULE_LABEL } from "../inbox/inboxModel";
 import { Mark } from "../shell/Brand";
 import { dbChipClass } from "../shell/nav";
 import type { DatabaseEntry, Recent } from "../shell/nav";
+// ⭐ WAVE 35 · W35-T15 (R4, C2) — ONE STAR CONTROL, drawn in the module that owns the concept and
+// worn by both surfaces. R4 makes star and "mark important" one idea and one flag; a second star
+// component here would be the "one mark, one meaning" failure DESIGN.md 4 names, and `useStarred`
+// is what keeps Home and Starred from ending up with different ideas of what is starred.
+import { StarButton, Tile } from "../starred/StarredPage";
+import { shapeStarred, useStarred, viewCount } from "../starred/starredApi";
+import type { StarKind, Starred, StarredCounts, StarredLoad } from "../starred/starredApi";
 import {
   HOME_LAYOUT_KEY,
   allDatabases,
@@ -82,13 +89,26 @@ function NewDbIcon() {
  * silently painted LAST WAVE'S BRAND while a comment claimed parity.
  */
 
-/** Connect a source — two links of a chain, which is what a connector is. */
+/**
+ * Connect a source — a two-prong plug with a cord, which is the thing you put in an outlet.
+ *
+ * ⭐ WAVE 35 · W35-T15 (owner item 5): *"change the Icon for the connector to look like the cable
+ * head that you would put in an electrical outlet."* It drew two links of a CHAIN until now, and
+ * so does its twin on the rail (`shell/Shell.tsx::PlugIcon`, whose NAME has been wrong since wave
+ * 23). The prongs are the load-bearing part of the drawing; the cord is what stops it reading as
+ * a padlock at 16px.
+ *
+ * ⛔ THE TWO COPIES MUST NOT DIVERGE and they are in two different fences, so the geometry below
+ * was published in mailbox B-5 as an ASK to the session that owns the rail (W35-T04) rather than
+ * changed here and hoped about. One glyph, one meaning; two plugs that disagree is worse than the
+ * chain, because at least the chain was wrong in both places identically.
+ */
 function ConnectIcon() {
   return (
     <svg className="home-card-icon" viewBox="0 0 16 16" aria-hidden="true">
-      <path d="M6.7 9.3 9.3 6.7" />
-      <path d="M7.6 4.6 9.1 3.1a2.7 2.7 0 0 1 3.8 3.8l-1.5 1.5" />
-      <path d="M8.4 11.4l-1.5 1.5a2.7 2.7 0 0 1-3.8-3.8l1.5-1.5" />
+      <path d="M6.1 5.2V2.1M9.9 5.2V2.1" />
+      <path d="M12.1 5.2v3.1a2.7 2.7 0 0 1-2.7 2.7H6.6a2.7 2.7 0 0 1-2.7-2.7V5.2Z" />
+      <path d="M8 11v1.6a1.6 1.6 0 0 0 1.6 1.6h1.5" />
     </svg>
   );
 }
@@ -144,15 +164,9 @@ function QuickCard({
   );
 }
 
-export default function HomePage({
-  entries,
-  recents,
-  automations,
-  onTemplates,
-  onNewDatabase,
-  onConnectors,
-  onOpenAutomation,
-}: {
+/** What the FRAME hands Home. Unchanged by the wave-35 split, and named so both halves take
+ *  exactly the same shape rather than drifting. */
+export interface HomeProps {
   /**
    * The SHAPED, server-filtered nav. The only thing a tile may be drawn from.
    *
@@ -183,6 +197,54 @@ export default function HomePage({
   onConnectors: () => void;
   /** Open one automation: the frame owns the hash, the surface owns which one is selected. */
   onOpenAutomation: (id: string) => void;
+  /**
+   * ⭐ WAVE 35 · W35-T16 (owner item 9) — open a starred VIEW inside its database.
+   *
+   * ⛔ REQUIRED, and the frame's, for the same two reasons `onOpenAutomation` is. Optional would
+   * degrade to "clicking a starred view does nothing", indistinguishable from the section never
+   * having been built and red in no gate. And the act is a hash change PLUS a request to the grid
+   * for which view is selected: the grid's listener DROPS a viewId it has not loaded yet with no
+   * acknowledgement, so the emit needs the frame's bounded retry ladder against a MEASURED worst
+   * case, not a single hopeful dispatch.
+   * ⚠ `Shell.tsx` passes the IDENTICAL handler to Home and to Starred (mailbox A, `DONE B-8`), so
+   * a view opened from one cannot behave differently from the same view opened from the other.
+   */
+  onOpenView: (database: string, viewId: string) => void;
+}
+
+/**
+ * ⭐ WAVE 35 · W35-T15 — THE PURE HALF, AND IT EXISTS SO HOME CAN BE LOOKED AT.
+ *
+ * Home held no state that could not be rendered until the star list arrived. `renderToStaticMarkup`
+ * never runs an effect, so a static render of the fetching component can only ever photograph the
+ * state where the stars are still unknown, i.e. the one state with no star in it. Splitting the
+ * read off is what makes "hover reveals an outline star, a starred tile shows a filled one" a thing
+ * a person can SEE without a server. `inbox/_inbox_shot.tsx` paid for this lesson first; the same
+ * split is now on `StarredSurface`.
+ *
+ * ⚠ THE DEFAULT EXPORT'S PROPS ARE UNCHANGED, so the frame's mount is untouched by this.
+ */
+export function HomeSurface({
+  entries,
+  recents,
+  automations,
+  onTemplates,
+  onNewDatabase,
+  onConnectors,
+  onOpenAutomation,
+  onOpenView,
+  starLoad,
+  starred,
+  busy,
+  counts,
+  toggle,
+}: HomeProps & {
+  starLoad: StarredLoad;
+  starred: Starred;
+  busy: boolean;
+  /** C3's row counts, or `null` while the second read is in flight (R7: after paint, never on nav). */
+  counts: StarredCounts | null;
+  toggle: (kind: StarKind, id: string, on: boolean, database?: string) => void;
 }) {
   const [layout, setLayout] = useState<HomeLayout>(() => {
     try {
@@ -208,6 +270,23 @@ export default function HomePage({
   const now = Math.floor(Date.now() / 1000);
   const databases = allDatabases(entries, recents, now);
 
+  // ⛔ THE STAR CONTROL IS ABSENT UNTIL THE LIST ARRIVES, deliberately. Drawing an empty star
+  // before the list is known would STATE that nothing is starred and then flip under the reader
+  // once it lands. An affordance that appears a moment later is a smaller cost than a control
+  // that was wrong for a moment, and this one is revealed on hover anyway.
+  const known = starLoad.phase === "ready";
+  const dbStarred = new Set(starred.databases);
+  const agentStarred = new Set(starred.agents);
+
+  // ⭐ WAVE 35 · W35-T16 (owner item 9) — the starred VIEWS, resolved by the SAME function
+  // Starred uses. Item 9 asks for these views on Home and under Starred; running them through one
+  // resolver is what stops the two lists disagreeing about which views exist or what they are
+  // called, which is item 11's complaint applied before it can happen.
+  // ⛔ AND THE DROP RULE COMES WITH IT: `shapeStarred` refuses a view whose database is not in
+  // `entries`, so a star that outlived its database (deleted, or a grant revoked) draws NOTHING
+  // rather than a tile that lands the reader in a 403.
+  const starredViews = shapeStarred(starred, entries, automations).views;
+
   return (
     <div className="shell-home">
       <h1 className="home-title">Home</h1>
@@ -306,8 +385,12 @@ export default function HomePage({
             <h2 className="home-section-title">{section.title}</h2>
             <div className={"home-tiles is-" + layout}>
               {section.tiles.map((tile) => (
+                // ⚠ THE WRAPPER IS ALWAYS PRESENT, star or no star, so the grid cell is the same
+                // box in both states and the page does not re-lay-itself out when the star list
+                // lands. `.st-tilewrap` is a NEW rule in `starred/starred.css` scoped to itself;
+                // `.home-tile`'s own rule in `index.css` is untouched (that file is A's).
+                <div key={tile.key} className="st-tilewrap">
                 <a
-                  key={tile.key}
                   className="home-tile"
                   href={tile.href}
                   {...(tile.external ? { target: "_blank", rel: "noreferrer" } : {})}
@@ -342,6 +425,15 @@ export default function HomePage({
                     {tile.ago ? <span className="home-tile-ago">{tile.ago}</span> : null}
                   </span>
                 </a>
+                {known ? (
+                  <StarButton
+                    on={dbStarred.has(tile.key)}
+                    label={tile.label}
+                    busy={busy}
+                    onToggle={() => toggle("database", tile.key, !dbStarred.has(tile.key))}
+                  />
+                ) : null}
+                </div>
               ))}
             </div>
           </section>
@@ -382,8 +474,8 @@ export default function HomePage({
           <h2 className="home-section-title">{AGENTS_MODULE_LABEL}</h2>
           <div className={"home-tiles is-" + layout}>
             {automations.map((a) => (
+              <div key={a.id} className="st-tilewrap">
               <button
-                key={a.id}
                 type="button"
                 className="home-tile home-tile-auto"
                 onClick={() => onOpenAutomation(a.id)}
@@ -400,6 +492,53 @@ export default function HomePage({
                   {a.sub ? <span className="home-tile-ago">{a.sub}</span> : null}
                 </span>
               </button>
+              {known ? (
+                <StarButton
+                  on={agentStarred.has(a.id)}
+                  label={a.name}
+                  busy={busy}
+                  onToggle={() => toggle("agent", a.id, !agentStarred.has(a.id))}
+                />
+              ) : null}
+              </div>
+            ))}
+          </div>
+        </section>
+      ) : null}
+
+      {/* ⭐ WAVE 35 · W35-T16 (owner item 9) — THE STARRED VIEWS.
+          Owner: *"remove [the important count] anywhere else but the View itself … Instead, let's
+          add these Views under 'Home' and … under 'Starred' module as well."* So the badge leaves
+          the rail and the flyout (A's W35-T07, E's W35-T43) and the VIEWS themselves arrive here.
+
+          ⛔ IT IS THE SAME `Tile` COMPONENT `StarredPage` DRAWS, not a copy that agrees today.
+          Item 11's complaint is that what is shown twice goes out of step, and two renderers for
+          one object is how that starts. The chip, the two lines and the star are one piece of code.
+
+          ⚠ EMPTY RENDERS NOTHING, like every other section here: no starred views is a real
+          answer, and a heading over nothing says "there should be something here", which is a
+          different and false statement. */}
+      {starredViews.length ? (
+        <section className="home-section">
+          <h2 className="home-section-title">Starred views</h2>
+          <div className={"home-tiles is-" + layout}>
+            {starredViews.map((row) => (
+              <Tile
+                key={row.id}
+                row={row}
+                count={viewCount(row.id, counts)}
+                star={
+                  known ? (
+                    <StarButton
+                      on
+                      label={row.label}
+                      busy={busy}
+                      onToggle={() => toggle("view", row.id, false, row.database)}
+                    />
+                  ) : undefined
+                }
+                onOpen={() => onOpenView(row.database, row.id)}
+              />
             ))}
           </div>
         </section>
@@ -407,3 +546,28 @@ export default function HomePage({
     </div>
   );
 }
+
+/**
+ * The page the frame mounts. Its props are exactly what they were before wave 35.
+ *
+ * ⭐ THE ONE READ HOME MAKES, and it is deliberately the SAME hook Starred uses. Two copies of
+ * "flip it, post it, take the server's answer, put it back if it was refused" is
+ * [[one-question-two-normalizers]] with the divergence on screen: one surface optimistic, the
+ * other reconciled, and the two disagreeing about what is starred.
+ * ⚠ It reads AFTER PAINT (the hook's own `useEffect`, never `useLayoutEffect`), because
+ * `GET /starred` scans a view bucket per database — C2 forbids a second store for the flag — and
+ * was measured at 6.2 ms warm and 7,331 ms COLD on tenant #0 (mailbox E-2).
+ */
+export default function HomePage(props: HomeProps) {
+  const { load: starLoad, starred, busy, counts, toggle } = useStarred();
+  return (
+    <HomeSurface
+      {...props}
+      starLoad={starLoad}
+      starred={starred}
+      busy={busy}
+      counts={counts}
+      toggle={toggle}
+    />
+  );
+}

web/src/index.css

@@ -317,12 +317,21 @@ body {
 /* Item 5 — the rail's head is the shared top band: same height as the shell head and the
    toolbar, closed by the same hairline. The negative margin bleeds the line to the rail's
    true edges past the container padding (overflow:hidden clips the collapsed overshoot). */
+/* ⭐⭐ WAVE 35 · T11 (owner item 1, R1) — THE FOLD CONTROL LIVES ON THE LEFT EDGE NOW, in every
+   rail the product draws (the shell's, this one, and `.auto-rail-top`). The owner's word is that
+   the "III" belongs on the edge the navigation OPENS from, not the edge it ends at.
+   ⚠ THE OLD `flex-end` WAS ONLY HALF OF WHAT PLACED THIS BUTTON, which is why flipping it alone
+   is not the whole change: the toggle is already `.cg-views-top`'s FIRST child, and the important
+   total that used to follow it carried `margin-left: auto`. An auto margin outranks
+   `justify-content` entirely, so on a database with a marked view the toggle was ALREADY hard
+   left and on every other database it sat right — one control, two positions, depending on data.
+   With the badge gone (W35-T27) and this at `flex-start` there is one position. */
 .cg-views-top {
   flex: 0 0 var(--lp-rail-head-h);
   height: var(--lp-rail-head-h);
   display: flex;
   align-items: center;
-  justify-content: flex-end;
+  justify-content: flex-start;
   margin: 0 -8px;
   padding: 0 8px;
   border-bottom: 1px solid var(--lp-line);
@@ -2947,8 +2956,15 @@ body {
 }
 
 /* ---- the frame ----------------------------------------------------------- */
+/* ⭐⭐ WAVE 35 · T01 (owner item 1, R1, contract C1) — `.shell-root` IS A COLUMN NOW: the top strip,
+   then the rail-and-content row. It was a plain flex ROW (rail | main) and the strip has to span
+   the whole window, so the row it used to be is now `.shell-frame` one level down.
+   ⚠ The overlay children that follow `.shell-frame` (`.shell-toast`, `.shell-newdb-scrim`) stay
+   correct through this because both are `position: fixed` and therefore out of flow — checked, not
+   assumed; a STATIC sibling would have become a third row in this column and eaten height. */
 .shell-root {
   display: flex;
+  flex-direction: column;
   width: 100%;
   height: 100vh;
   overflow: hidden;
@@ -2956,6 +2972,51 @@ body {
   color: var(--lp-ink);
   background: var(--lp-surface);
 }
+/* C1: the ONE persistent band. Full window width, on every module, and nothing in it moves when
+   you navigate — which is the whole of ruling R1. */
+.shell-topbar {
+  flex: 0 0 var(--lp-rail-head-h);
+  height: var(--lp-rail-head-h);
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 0 10px 0 12px;
+  background: var(--lp-surface);
+  border-bottom: 1px solid var(--lp-line);
+}
+/* ⛔ `min-height: 0` is load-bearing, not tidiness. A flex ITEM defaults to `min-height: auto`,
+   which refuses to shrink below its content — so without this the rail's own scroll box and the
+   grid host would size to their content and push the page past 100vh instead of scrolling inside
+   it. The symptom is a page that scrolls as a whole and a grid with no internal scrollbar. */
+.shell-frame {
+  flex: 1 1 auto;
+  min-height: 0;
+  display: flex;
+  width: 100%;
+}
+.shell-topbar-toggle {
+  flex: 0 0 28px;
+  width: 28px;
+  height: 28px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+  border-radius: var(--lp-r-md);
+  background: transparent;
+  color: var(--lp-muted);
+  cursor: pointer;
+}
+.shell-topbar-toggle:hover { background: var(--lp-surface-2); color: var(--lp-ink); }
+.shell-topbar-toggle:focus-visible {
+  outline: 2px solid var(--lp-blue-deep);
+  outline-offset: 1px;
+}
+.shell-topbar-brand {
+  display: inline-flex;
+  align-items: center;
+  min-width: 0;
+}
 
 /* WHITE, like the host's `[theme.sidebar]` (owner 2026-07-23: "slick, visible
    light-grey borders") — the wash belongs to page bodies, not the rail.
@@ -2975,51 +3036,31 @@ body {
     flex-basis var(--lp-fold-t) var(--lp-fold-e);
 }
 
-/* Item 5 — the rail head IS the shared top band (--lp-rail-head-h + the same hairline the
-   views rail and the toolbar close with). Item 11's minimize control lives in it, beside the
-   brand. Collapsed, the rail is the slim strip: mark, icons, avatar — the toggle goes
-   (item 2: the logo is the way back), labels fold away smoothly. */
+/* ⭐ WAVE 35 · T02 — WHAT THIS BAND IS NOW. It held the brand and the minimize control; both live
+   in `.shell-topbar` (C1). It survives, empty, ONLY as an alignment band: `DbHead` and
+   `.cg-views-top` are each one `--lp-rail-head-h` tall, so removing it would raise the rail's first
+   nav row a header above the grid beside it on every database page. Same height, same hairline,
+   no contents — `justify-content` and the fold `transition` went with the children they positioned. */
 .shell-side-head {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
   flex: 0 0 var(--lp-rail-head-h);
   height: var(--lp-rail-head-h);
-  padding: 0 10px 0 16px;
   border-bottom: 1px solid var(--lp-line);
-  transition: padding var(--lp-fold-t) var(--lp-fold-e);
-}
-.shell-rail-toggle {
-  width: 28px;
-  height: 28px;
-  flex: 0 0 28px;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  border: none;
-  border-radius: var(--lp-r-md);
-  background: transparent;
-  color: var(--lp-muted);
-  cursor: pointer;
-}
-.shell-rail-toggle:hover {
-  background: var(--lp-surface-2);
-  color: var(--lp-ink);
-}
-.shell-rail-toggle:focus-visible {
-  outline: 2px solid var(--lp-blue-deep);
-  outline-offset: 1px;
 }
+/* ⛔⛔ DELETED WITH T02, AND THIS NOTE IS THE POINT OF THE DELETION: `.shell-rail-toggle` (its base,
+   hover and focus rules) and `.shell-side.is-collapsed .shell-rail-toggle { display: none }`.
+   That last rule is what made wave-20 R9 necessary — the toggle vanished when collapsed, so the
+   LOGO had to become the way back. Both the toggle and the logo now sit in the top strip, OUTSIDE
+   `.shell-side`, so the collapsed selector could no longer reach them and the rule would have been
+   an inert line that still reads as load-bearing to the next person. The way back is now simply
+   that the toggle never leaves. Its styling lives on `.shell-topbar-toggle` above.
+   ⚠ `.cg-rail-toggle` is a DIFFERENT control (the views/agents sub-rail) and is untouched. */
 .shell-side.is-collapsed {
   width: var(--lp-rail-min);
   flex-basis: var(--lp-rail-min);
 }
-/* Item 2 — collapsed, the three-bars control disappears; clicking the logo expands. */
-.shell-side.is-collapsed .shell-rail-toggle { display: none; }
-/* Geometry note (item 1): nothing re-centers on collapse — paddings are tuned so the mark
-   and the icons SLIDE to the strip's center as the width animates (a justify-content flip
-   would snap them at t=0). Mark 26px → (48-26)/2 = 11; icon x: 6 + 10 = 16 = (48-16)/2. */
-.shell-side.is-collapsed .shell-side-head { padding: 0 11px; }
+/* Geometry note (item 1): nothing re-centers on collapse — paddings are tuned so the icons SLIDE
+   to the strip's center as the width animates (a justify-content flip would snap them at t=0).
+   Icon x: 6 + 10 = 16 = (48-16)/2. */
 .shell-side.is-collapsed .shell-brand { gap: 0; }
 .shell-side.is-collapsed .lp-wordmark,
 .shell-side.is-collapsed .shell-nav-label,
@@ -3039,33 +3080,35 @@ body {
   gap: 0;
 }
 .shell-side.is-collapsed .shell-nav-item.is-child { padding-left: 10px; }
+/* ⭐ WAVE 35 · T05 (owner item 6) — the Templates row sits in the rail's bottom band, above the
+   account button, so it takes the band's own gutter rather than the nav list's. It is a
+   `.shell-nav-item`, so weight, height, hover and the fold all come from the rail's shared rule
+   and this adds only the placement. */
+.shell-nav-templates {
+  margin: 0 8px 2px;
+  width: calc(100% - 16px);
+}
+/* ⛔ W33-T75's law reaches this row too. `.shell-nav.is-rail-loading > *` cannot select it — this
+   button is a SIBLING of `.shell-nav`, not a child — so while `/nav` is in flight it would paint in
+   ink under six skeleton bars. HIDDEN, not unmounted, for the same reason the nav rows are: the
+   node stays in the tree so nothing hanging off it is torn down for the length of a fetch. */
+.shell-nav-templates.is-rail-hidden { display: none; }
+.shell-side.is-collapsed .shell-nav-templates {
+  margin: 0 6px 2px;
+  width: calc(100% - 12px);
+  padding: 7px 10px;
+}
 .shell-side.is-collapsed .shell-side-bottom { padding: 8px 2px 10px; }
 .shell-side.is-collapsed .shell-account {
   padding: 7px 8px;
   gap: 0;
 }
 
-/* Item 2 — the brand is a BUTTON: disabled while expanded (brand, not control), the way
-   back while collapsed. One stable element in both states, so the fold can animate it. */
-.shell-brand-btn {
-  display: flex;
-  align-items: center;
-  padding: 0;
-  margin: 0;
-  border: none;
-  background: none;
-  color: inherit;
-  font: inherit;
-  cursor: pointer;
-  min-width: 0;
-}
-.shell-brand-btn:disabled { cursor: default; }
-.shell-brand-btn:not(:disabled):hover { opacity: 0.8; }
-.shell-brand-btn:focus-visible {
-  outline: 2px solid var(--lp-blue-deep);
-  outline-offset: 2px;
-  border-radius: var(--lp-r-sm);
-}
+/* ⭐ WAVE 35 · T02 — `.shell-brand-btn` IS DELETED, and it is the wave-20 R9 decision being
+   retired rather than a style being tidied. The brand was a `<button>` at all only so it could be
+   the way back from a collapsed rail; it is a plain `<div class="shell-topbar-brand">` in the top
+   strip now, and the toggle beside it is the way back in both states. Keeping the button rules
+   would leave the app describing the logo as a control that no longer does anything. */
 .shell-brand { display: flex; align-items: center; gap: 9px; min-width: 0; }
 /* ⚠ DELIBERATELY OFF THE TYPE SCALE. The wordmark is BRAND, not UI text: 17px is what the app's
    own nav wordmark resolves to (1.02rem against its 17px base), and matching the sibling door
@@ -3174,7 +3217,12 @@ body {
 /* ⚠ NOT in the shared rule above: `.shell-nav-group` is a LABEL, not a control
    ("quieter, no hover, no cursor" — its own rule below), and a pointer cursor
    on a row that cannot be clicked promises a destination that does not exist. */
-.shell-nav-item { cursor: pointer; }
+/* `position: relative` is for W35-T03's left marker (`.is-active::before`). ⚠ It is safe on EVERY
+   row, checked rather than assumed: the only absolutely-positioned descendant in this subtree is
+   `.shell-side.is-collapsed .shell-nav-badge`, and its containing block is already
+   `.shell-side.is-collapsed .shell-nav-alerts` — which IS a `.shell-nav-item`. So the badge keeps
+   the same anchor and does not move; that older rule is now redundant rather than contradicted. */
+.shell-nav-item { cursor: pointer; position: relative; }
 .shell-nav-item:hover { background: var(--lp-surface-2); }
 .shell-nav-item.is-child { padding-left: 30px; }
 /* The current row is marked the way the host marks it: the selected-row tint,
@@ -3186,9 +3234,47 @@ body {
    never had that, because there the ROW carries the tint. It does here now
    (`.shell-nav-row.is-active`, navExtras.css). What stays here is everything
    that genuinely belongs to the LINK: its weight, and the icon below. */
-.shell-nav-item.is-active {
+/* ⭐⭐ WAVE 35 · T03 (owner item 7) — "there should be a highlight so user know what module they
+   are in". THE SCOUTED PREMISE WAS HALF TRUE AND THAT IS WHY THIS LOOKED LIKE A NO-OP: the blue
+   tint lives on `.shell-nav-row.is-active` (navExtras.css), and a `.shell-nav-row` only wraps a
+   DATABASE row. A bare MODULE row — Home, Inbox, Assistant, Agents, Database, Connectors, and now
+   Starred — is an unwrapped `.shell-nav-item`, so all it ever got was `font-weight: 600` and a
+   full-strength icon. Weight alone is the one signal that disappears at a glance, which is exactly
+   the owner's complaint. The tint moves here so a module is marked the way a database already is,
+   and a 3px left marker carries the distinction at the edge of vision.
+   ⛔ THE `:hover` DUPLICATE IS LOAD-BEARING, NOT BELT-AND-BRACES. `.shell-nav-item:hover` and
+   `.shell-nav-item.is-active` have the SAME specificity (0,2,0), so at rest the active row wins
+   only because it is declared later — the source-order luck navExtras.css's own comment warns
+   about, and this nav has lost a rule to source order before. `.is-active:hover` is (0,3,0) and
+   settles it by specificity instead.
+   ⚠ A DATABASE row is unaffected on purpose: its `.shell-nav-row` still paints the same tint
+   underneath, so the two surfaces agree rather than double-painting a different colour. */
+.shell-nav-item.is-active,
+.shell-nav-item.is-active:hover {
+  background: var(--lp-blue-tint);
   font-weight: 600;
 }
+/* ⚠ `--lp-primary`, NOT `--lp-blue-deep`, AND THE REASON IS MEASURED. Session B measured
+   `--lp-blue-deep` (#768fb6) on `--lp-blue-tint` (#edf3fd) at **2.96:1**, under WCAG's 3:1 bar for
+   a graphical object; I reproduced it and checked the neighbours, because the obvious substitute is
+   not one: `--lp-blue-solid` is **2.95:1**, no better. `--lp-primary` (#5433cc) is **6.92:1** on the
+   same tint. ⛔ Nothing in the battery measures a contrast ratio — `verify_ui` checks that font
+   sizes are TOKENS, not that anything is legible — so this class of defect is found by measuring or
+   not at all, and this note is the measurement.
+   ⚠ DESIGN.md 3's "blue = selected" is untouched: the ROW TINT is still blue and still carries the
+   meaning. This is the brand accent marking the edge, which is what needs to survive peripheral
+   vision. */
+.shell-nav-item.is-active::before {
+  content: "";
+  position: absolute;
+  left: 0;
+  top: 50%;
+  transform: translateY(-50%);
+  width: 3px;
+  height: 18px;
+  border-radius: 0 var(--lp-r-sm) var(--lp-r-sm) 0;
+  background: var(--lp-primary);
+}
 .shell-nav-item:focus-visible { outline: 2px solid var(--lp-blue-deep); outline-offset: -2px; }
 
 .shell-nav-icon {
@@ -7352,18 +7438,20 @@ a.cg-map-ctl-b { text-decoration: none; }
    It had the height and nothing else: the fold control sat LEFT while the Views rail's sits
    right, and there was no hairline at all — so the automation page's top band simply stopped
    halfway across the screen while every database page's ran edge to edge. The three things
-   `.cg-views-top` does and this did not: `justify-content: flex-end`, the closing hairline,
+   `.cg-views-top` does and this did not: a shared `justify-content`, the closing hairline,
    and the negative margin that bleeds that line past the rail's own gutter to its true edges
    (`overflow: hidden` on the rail clips the collapsed overshoot, exactly as it does there).
    ⚠ THE BLEED IS THIS RAIL'S OWN GUTTER, not a copied number: `.cg-views` pads 8px and bleeds
    -8px; this rail pads 10px, so it bleeds -10px. Copying the -8 would leave a 2px gap at each
-   end — the same defect in a more convincing disguise. */
+   end — the same defect in a more convincing disguise.
+   ⭐ WAVE 35 · T11 (owner item 1, R1) — and the shared value is `flex-start` now. This rail holds
+   ONLY the toggle, so the flip is the whole change here; no TSX moves. */
 .auto-rail-top {
   flex: 0 0 var(--lp-rail-head-h);
   height: var(--lp-rail-head-h);
   display: flex;
   align-items: center;
-  justify-content: flex-end;
+  justify-content: flex-start;
   margin: 0 -10px;
   padding: 0 10px;
   border-bottom: 1px solid var(--lp-line);
@@ -10667,7 +10755,11 @@ a.cg-map-ctl-b { text-decoration: none; }
 /* ── Item 7 (R9) — the collapsed rail expands from its own background ───────
    The strip's blank area is now a click target, so it says so. Interactive
    children keep their own cursor (the UA default for a link/button is already
-   `pointer`), and `.shell-brand-btn` keeps the explicit one it had. */
+   `pointer`).
+   ⚠ WAVE 35 · T02 corrected this note: it used to end "and `.shell-brand-btn` keeps the explicit
+   one it had", naming a rule that no longer exists — the brand left the rail for the top strip and
+   its button rules were deleted with it. This background click is now a CONVENIENCE rather than
+   the accessible route back, because the toggle in the strip is present in both states. */
 .shell-side.is-collapsed { cursor: pointer; }
 
 /* ==== /wave20:S4 ==== */
@@ -10993,9 +11085,24 @@ a.cg-map-ctl-b { text-decoration: none; }
 /* ── C10 — HOME ───────────────────────────────────────────────────────────────────────────
    `reference/Airtable Home.png`'s anatomy, our tokens. `.shell-main` is `overflow: hidden`, so
    the page owns its own scroll or a tenant with forty recents can reach none of them. */
+/* ⭐⭐ WAVE 35 · T10 (owner item 16) — "when I toggle between List and Gallery view under Home, the
+   web width itself shift". THE CAUSE IS THIS SCROLLBAR, and it is fixed here rather than by padding
+   the tiles, because padding hides a shift and leaves it.
+   MEASURED on the live build, which is what identifies the container: in GALLERY the content fits
+   and nothing here scrolls (the walk up from `.home-tiles` reaches `html`); in LIST the tiles
+   stack one per row, `.shell-home` overflows and becomes the scroller. So a classic scrollbar
+   appears in exactly one of the two layouts and takes its width out of the content box.
+   `scrollbar-gutter: stable` reserves that space in BOTH, so the column is the same width either
+   way and nothing moves.
+   ⚠ THE PIXEL DELTA DOES NOT REPRODUCE IN HEADLESS CHROMIUM and that is a property of the
+   instrument, not evidence against the diagnosis: headless paints OVERLAY scrollbars, which take
+   no layout width, so the measured delta there is 0 while the owner sees ~15px on Windows Chrome.
+   What the headless run DOES prove is the mechanism — the scroller identity flips between the two
+   layouts. */
 .shell-home {
   height: 100%;
   overflow-y: auto;
+  scrollbar-gutter: stable;
   padding: 34px 44px 56px;
   box-sizing: border-box;
   background: var(--lp-wash);
@@ -11069,12 +11176,17 @@ a.cg-map-ctl-b { text-decoration: none; }
   border-radius: var(--lp-r-md);
   background: var(--lp-surface);
 }
+/* ⭐ WAVE 35 · T10 (owner item 10) — "that button toggle to be larger". MEASURED at 26x22 before
+   this, which is under every common 32px minimum-target guideline in BOTH axes; it is now 36x32,
+   so the smaller side clears 32. The icon grows with the box (14 -> 16px) or a larger button just
+   frames the same small mark in more empty space, which reads as a bigger gap rather than a bigger
+   control. */
 .home-layout-btn {
   display: inline-flex;
   align-items: center;
   justify-content: center;
-  width: 26px;
-  height: 22px;
+  width: 36px;
+  height: 32px;
   border: 0;
   border-radius: var(--lp-r-sm);
   background: transparent;
@@ -11084,11 +11196,18 @@ a.cg-map-ctl-b { text-decoration: none; }
   cursor: pointer;
 }
 .home-layout-btn:hover { background: var(--lp-surface-2); }
-/* Blue = selected/active, the fixed semantic (DESIGN.md §3). */
-.home-layout-btn.is-on { background: var(--lp-blue-tint); color: var(--lp-blue-deep); }
+/* Blue = selected/active, the fixed semantic (DESIGN.md §3) — the TINT still carries that meaning.
+   ⚠ THE INK MOVED OFF `--lp-blue-deep`, AND IT IS A MEASUREMENT, NOT A PREFERENCE. Session B
+   measured this exact pair off a real render at **2.96:1** — under the 4.5:1 text bar and under the
+   3:1 graphical bar — and raised it because this button is where they copied it FROM. ⛔ The obvious
+   substitute is not one: `--lp-blue-solid` is **2.95:1**. `--lp-primary` is **6.92:1** on the same
+   tint. This button's whole content is a 16px icon, so its contrast IS its legibility.
+   ⚠ Nothing in the battery measures a contrast ratio — `verify_ui` checks that sizes are TOKENS,
+   not that anything is readable — so this class of defect is found by measuring or not at all. */
+.home-layout-btn.is-on { background: var(--lp-blue-tint); color: var(--lp-primary); }
 .home-layout-icon {
-  width: 14px;
-  height: 14px;
+  width: 16px;
+  height: 16px;
   fill: none;
   stroke: currentColor;
   stroke-width: 1.35;
@@ -12258,50 +12377,24 @@ textarea.cg-json-raw:focus {
   text-align: center;
   line-height: 1;
 }
+/* ⛔⛔ WAVE 35 · T11 (owner item 9, R4) — THE DATABASE-LEVEL TOTAL IS GONE, AND SO IS EVERY RULE
+   THAT DRESSED IT. Owner item 9: the count belongs to the VIEW itself and nowhere else. Wave 33's
+   T16 put a per-database total at the top of this rail and wave 34's T20 stripped its label; both
+   notes are now history and live in `.claude/wiki/waves/wave35/` rather than here.
+   ⚠ FOUR RULES DIED TOGETHER ON PURPOSE, and this note is what stops one of them coming back
+   alone: `.cg-views-important` (the wrapper's `margin-left: auto`, which outranked
+   `.cg-views-top`'s `justify-content` and is why the fold toggle sat left on a database with a
+   marked view and right on one without), the two `.cg-views-important .cg-view-count` size rules,
+   and the `.is-partial` dashed mark. The ELEMENT they styled leaves in W35-T27 (`ViewSidebar.tsx`,
+   session C).
+   ⭐ WHAT SURVIVES, AND IT IS NOT THE SAME THING: `.cg-view-count` and `.cg-view-count.is-unknown`
+   below are the PER-VIEW badges on each view row. Owner item 9 keeps those. */
 /* ⭐ WAVE-33 T14 (D-205) — the same mark, saying "no number here, and here is why" (its `title`).
    ⛔ NOT the solid purple: a filled badge is the product's word for "this many", and wearing it
    over a dash would state a count of nothing. Outlined and muted says "the slot exists, the
    number does not" — which is exactly the distinction an ABSENT badge could not draw, and the
    whole of D-205. Same box, so a rail of marked views does not jump when one of them cannot be
    counted. */
-/* ⭐ WAVE-33 T16 (owner item 5) — the DATABASE-level important total, at the top of its own rail.
-   Sits beside the minimize toggle in `.cg-views-top`, which held only that button. `margin-left:
-   auto` pushes it to the right edge so the badge lines up with the per-view badges directly
-   below it — the total and its parts read as one column, which is the whole point of putting it
-   here rather than in the shell's database header. */
-/* ⭐⭐ WAVE 34 · T20 (R1, contract C1) — THE WORD IS GONE, SO ITS TYPOGRAPHY GOES WITH IT.
-   `gap`, `font-size`, `font-weight` and `color` here only ever painted the literal "Important";
-   with the label removed they style nothing (the badge sets its own), and left in place they are
-   the kind of inert rule a later reader restores a label to fit. What survives is the LAYOUT this
-   wrapper is actually for: `margin-left: auto` pushes it to the right edge so the total lines up
-   with the per-view badges directly below it, and the class name itself is contract C1's hook
-   (`.cg-views-important.is-partial` hangs the dashed-purple partial mark off it, and B's flyout
-   row is named against it). */
-.cg-views-important {
-  margin-left: auto;
-  display: inline-flex;
-  align-items: center;
-  white-space: nowrap;
-}
-/* R1's "SMALLER", as a box rather than as type. ⛔ THE FONT CANNOT SHRINK AND THAT IS A REAL
-   CONSTRAINT, NOT AN OMISSION: `--lp-fs-3xs` (11px) is the smallest size the scale declares, and
-   `verify_ui`'s R5 leg reds ANY literal `font-size` in `web/src` CSS, so the only way to go below
-   it is to add a fourth micro size to the type scale for one badge. 20x20 -> 16x16 is a 36% cut
-   in area on top of losing the label, which is what the ruling asked for; inventing a 10px step
-   under the scale's own floor is not. ⚠ SCOPED BY PARENT on purpose: `.cg-view-count` is shared
-   with the per-view badges (and with `.is-unknown`), and shrinking it unscoped would resize every
-   count in the rail from a ruling about the header. */
-.cg-views-important .cg-view-count {
-  min-width: 16px;
-  height: 16px;
-  padding: 0 2px;
-}
-/* A PARTIAL total wears the same purple as a whole one — the number it shows IS real, it is just
-   not all of them — and says so with a `+` and its title. Muting it would read as "less
-   important" rather than "less complete". */
-.cg-views-important.is-partial .cg-view-count {
-  border: 1px dashed var(--lp-purple-deep);
-}
 .cg-view-count.is-unknown {
   background: transparent;
   color: var(--lp-muted);

web/src/query/QueryPage.tsx

@@ -4,13 +4,12 @@ import type { QueryOpenDetail } from "../apiContract";
 import { QUERY_OPEN_EVENT } from "../apiContract";
 import CustomerGrid from "../customer-grid/CustomerGrid";
 import { OverlayProvider } from "../customer-grid/OverlaySurface";
-import { queryCitationLabel } from "../customer-grid/queryPreview";
 import { DbHead, gridScopeFor } from "../shell/dbFrame";
 import { databaseEntries } from "../shell/nav";
 import type { NavEntry } from "../shell/nav";
 import { bindingFor, deleteQuery, fetchQueries, QUERY_BINDING_EVENT } from "./queryApi";
 import type { QueryCitation, SavedQuery } from "./queryApi";
-import { QueryEmpty, queryGroups, QueryProvenance, QueryRail } from "./queryParts";
+import { QueryEmpty, queryGroups, QueryRail } from "./queryParts";
 import type { QueryGroup } from "./queryParts";
 import "./query.css";
 
@@ -134,9 +133,6 @@ export default function QueryPage({ granted, hostedRail, refreshToken, selectedI
 
   if (!active) return <QueryEmpty loaded={loaded} unnamed={views.length - known.length} />;
   const entry = entryOf(active.source.database);
-  const cited = citations.filter((citation) => active.citationIds.includes(citation.id));
-  const provenance = cited.map(queryCitationLabel).join(" · ")
-    || `${active.source.label} · snapshot ${String(active.source.source_version)} · retrieved ${active.source.retrieved_at}`;
   return (
     <div className="shell-db-frame">
       <DbHead label={active.source.label} {...(entry?.icon ? { icon: entry.icon } : {})} />
@@ -146,8 +142,15 @@ export default function QueryPage({ granted, hostedRail, refreshToken, selectedI
             <QueryRail groups={groups} activeId={active.id} onSelect={setActiveId}
               onDelete={(id) => void remove(id)} onChanged={upsert} />
           )}
+          {/* ⛔ NO PROVENANCE ROW HERE (W35-T21, owner item 4 / R2). The "Sources" disclosure and
+              the snapshot line it opened are deleted; a Query view is a database view now, and a
+              database view carries no banner. The citations still travel — `binding` above is
+              built from this artefact AND the fetched citation list — and the reader still SEES
+              them in the chat, under the answer that used them (`AssistantPage::CitationLine`).
+              ⚠ Do NOT paste that builder call into a comment: `verify_grid_ux.py`'s NC mutates the
+              FIRST occurrence of it, so a second copy in prose keeps the scan green over a page
+              that stopped binding citations [[prose-that-becomes-its-own-marker]]. */}
           <div className="qy-surface">
-            <QueryProvenance view={active} detail={provenance} />
             <div className="qy-grid-host">
               <OverlayProvider>
                 <CustomerGrid key={gridScopeFor(active.source.database)}

web/src/query/query.css

@@ -250,10 +250,53 @@
 .qy-rail-row.is-active .qy-rail-name { font-weight: 600; }
 
 .qy-rail-kind {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  min-width: 0;
   color: var(--lp-muted);
   font-size: var(--lp-fs-2xs);
 }
 
+/* ⭐ W35-T25 (R3) — the Edited mark. Quiet on purpose: it reports a state the reader created
+   themselves, so it belongs beside the kind rather than competing with the view's name. */
+.qy-rail-edited {
+  flex: 0 0 auto;
+  padding: 0 5px;
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-surface-2);
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  line-height: 15px;
+}
+
+.qy-rail-row.is-active .qy-rail-edited { background: var(--lp-surface); }
+
+/* ── ⭐⭐ W35-T47 (R4, C2) — the SHARED star button, re-placed for a rail row ─────────────────
+ *
+ * ⛔ GEOMETRY ONLY. `StarButton` is B's component and `starred.css` owns everything about how it
+ * looks; overriding its colour or its glyph here would be a second opinion about one mark. What a
+ * rail row genuinely needs different is placement: the shared rule is `position: absolute` on a
+ * TILE wrapper, and this row is a flex list whose right end already holds the actions button, so
+ * an absolutely positioned star would sit on top of it.
+ *
+ * ⚠ AND THE REVEAL RULE HAS TO BE RESTATED, not inherited. The shared sheet reveals the star with
+ * `.st-tilewrap:hover`, a wrapper that does not exist here — so without the row's own hover rule
+ * the button would be `opacity: 0` forever except when starred or focused, i.e. a control you can
+ * only find by tabbing to it. `.is-on` and `:focus-visible` keep working from the shared sheet.
+ */
+.qy-rail-row .st-star {
+  position: static;
+  transform: none;
+  flex: 0 0 auto;
+  width: 22px;
+  height: 22px;
+  margin-right: 2px;
+}
+
+.qy-rail-row:hover .st-star { opacity: 1; }
+
 /* Hover-revealed, like the grid rail's own row menu — visible on focus so it is
    reachable from the keyboard rather than only from a pointer. */
 .qy-rail-del {
@@ -311,7 +354,8 @@
 
 .qy-rail-ask:hover { background: var(--lp-surface-2); }
 
-/* ── the surface: provenance line, then the grid ──────────────────────────── */
+/* ── the surface: the grid, and nothing above it ──────────────────────────── */
+/* W35-T21 (owner item 4 / R2): the `.qy-prov*` family is deleted with the component. */
 
 .qy-surface {
   flex: 1 1 auto;
@@ -328,50 +372,6 @@
   overflow: hidden;
 }
 
-.qy-prov {
-  flex: 0 0 auto;
-  border-bottom: 1px solid var(--lp-line);
-  background: var(--lp-surface);
-}
-
-.qy-prov-btn {
-  display: flex;
-  align-items: baseline;
-  gap: 10px;
-  width: 100%;
-  padding: 7px 14px;
-  border: 0;
-  background: transparent;
-  font: inherit;
-  text-align: left;
-  cursor: pointer;
-}
-
-.qy-prov-q {
-  flex: 1 1 auto;
-  min-width: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  color: var(--lp-muted);
-  font-size: var(--lp-fs-xs);
-}
-
-.qy-prov-toggle {
-  flex: 0 0 auto;
-  color: var(--lp-blue-solid);
-  font-size: var(--lp-fs-2xs);
-  font-weight: 600;
-}
-
-.qy-prov-detail {
-  margin: 0;
-  padding: 0 14px 9px;
-  color: var(--lp-muted);
-  font-size: var(--lp-fs-2xs);
-  line-height: var(--lp-lh);
-  word-break: break-word;
-}
 
 /* ── the empty state ──────────────────────────────────────────────────────── */
 

web/src/query/queryApi.ts

@@ -47,6 +47,21 @@ export interface SavedQuery {
   view: Record<string, unknown>;
   citationIds: string[];
   numeric: { label: string; value: number | null; contributing_record_count: number };
+  /**
+   * ⭐⭐ W35-T25 · CONTRACT C4 (R3) — THE AI'S OWN SPEC, AND WHETHER THIS ONE STILL MATCHES IT.
+   *
+   * `original_spec` is written ONCE, at creation, and is what "Revert to AI original" restores.
+   * `edited` is DERIVED on the server by comparing the two, never stored — so a revert clears the
+   * badge by construction rather than by remembering to.
+   *
+   * ⛔ `null` IS A REAL ANSWER AND THE CLIENT MUST HONOUR IT. An artefact created before this wave
+   * has no original: it reports `edited: false` and offers no Revert. C4 is explicit that a Revert
+   * with nothing to revert to is worse than an absent one.
+   * ⚠ The snake_case key is contract C4's own spelling, not a slip. It is the wire name both
+   * halves were specified against and renaming it here would be a silent one-sided change.
+   */
+  original_spec: Record<string, unknown> | null;
+  edited: boolean;
 }
 
 export interface QueryThread {
@@ -133,13 +148,32 @@ export interface QueryVirtualBinding {
   source: QuerySource;
   view: Record<string, unknown>;
   citationIds: string[];
-  /** Complete, clickable provenance for this exact immutable virtual artefact. */
+  /** Complete, clickable provenance for this exact virtual artefact. */
   citations: QueryCitation[];
+  /*
+   * ⛔ NO `edited` HERE, AND THE ABSENCE IS THE DESIGN (W35-T23 + T25).
+   *
+   * A draft of this carried one, because the grid kept the reader's spec in a local bucket and
+   * needed a flag to decide whether that copy or the server's was current. That flag went stale
+   * inside a session — `binding` is memoised on the artefact and nothing refetches it after an
+   * autosave — so the first edit of a session survived a full reload and vanished on an in-session
+   * remount. The fix was to delete the second store, not to freshen the flag: `view` above IS the
+   * artefact's spec, and it is the only copy. The `edited` a reader SEES lives on `SavedQuery`,
+   * where the rail reads it, and the renderer has no business asking.
+   */
 }
 
 /**
- * Grid previews cannot mutate Query artefacts. A new Assistant prompt creates a new immutable
- * artefact; the existing DELETE endpoint is Query-history removal, never a grid event transport.
+ * The Query workspace's mutation policy.
+ *
+ * ⭐⭐ W35-T23 (owner item 4 / R2) — `update` NO LONGER MEANS "REFUSED", and this block is the
+ * contract, so the change is stated here rather than only where it is enforced. A Query view is a
+ * live view of its source database: resize, sort, group, hide and row height all write its spec,
+ * through `POST /query/{qid}/events` and nowhere else. `create` is still refused — an artefact
+ * holds exactly one view — and `delete` still removes the artefact itself.
+ * ⚠ `QUERY_MUTATION_POLICY.update` is kept in the shape because the wire contract has three
+ * readers and dropping a member is a breaking change; what it describes is now the refusal a
+ * mismatched id gets, not every edit.
  */
 export type QueryMutationOperation = "create" | "update" | "delete";
 export interface QueryMutationRefusal {
@@ -169,9 +203,18 @@ const IMMUTABLE_MUTATION: QueryMutationRefusal = {
   durable: false,
   transport: "none",
   code: "query_view_immutable",
+  // ⭐⭐ W35-T23 (R2) — THE SENTENCE MOVED WITH THE RULE. It read *"This Query view is immutable.
+  // Ask the Assistant to create a revised view."* and that is no longer true: a Query view's
+  // spec is editable now, and the reader who resized a column would have been told to go and ask
+  // a chatbot. What this refusal still covers is the ONE thing R2 did not open — a SECOND view
+  // inside an artefact that holds exactly one.
+  // ⚠ The CODE is unchanged (`query_view_immutable`): it is the wire contract three gates and
+  // the server's own refusal key on, and the reason for the refusal did not change, only its
+  // scope. Renaming it would be a protocol change dressed as a copy edit.
   // "the Assistant" — the rail's own word since W34-T13. Copy that names a module must name it
   // the way the reader sees it, or the sentence sends them looking for a door that is not there.
-  message: "This Query view is immutable. Ask the Assistant to create a revised view.",
+  message: "A Query view holds one saved answer, so it cannot take a second view. "
+    + "Ask the Assistant for another one.",
 };
 export const QUERY_MUTATION_POLICY: QueryMutationPolicy = {
   create: IMMUTABLE_MUTATION,
@@ -283,6 +326,12 @@ function saved(value: unknown): SavedQuery | null {
     view: (row.view && typeof row.view === "object" ? row.view : {}) as Record<string, unknown>,
     citationIds: (row.citationIds as unknown[] || []).filter((id): id is string => typeof id === "string"),
     numeric: ((row.numeric && typeof row.numeric === "object" ? row.numeric : {}) as SavedQuery["numeric"]),
+    // ⚠ ABSENT ⇒ NOT EDITED AND NOT REVERTABLE, which is the safe direction: an older server that
+    // sends neither key leaves the badge off and the control hidden, rather than offering a Revert
+    // whose endpoint will 409.
+    original_spec: (row.original_spec && typeof row.original_spec === "object"
+      ? row.original_spec : null) as Record<string, unknown> | null,
+    edited: row.edited === true,
   };
 }
 
@@ -392,6 +441,18 @@ export function duplicateQuery(id: string): Promise<Result<SavedQuery>> {
   return call(`/query/${encodeURIComponent(id)}/duplicate`, json({}), (raw) => saved(raw) as SavedQuery);
 }
 
+/**
+ * ⭐⭐ W35-T25 · CONTRACT C4 (R3) — "Revert to AI original".
+ *
+ * ⛔ IT RESTORES THE VIEW SPEC AND NOTHING ELSE, and the caller must SAY so before it acts. A
+ * Query view is live now, so a cell the reader changed through it is a real write to a real
+ * record in the source database; putting the filters back cannot walk that back. R3 requires the
+ * confirm to state that BEFORE the click, not after.
+ */
+export function revertQuery(id: string): Promise<Result<SavedQuery>> {
+  return call(`/query/${encodeURIComponent(id)}/revert`, json({}), (raw) => saved(raw) as SavedQuery);
+}
+
 /**
  * A DOWNLOAD, not a fetch: an ordinary same-origin link carries the session cookie, and the server
  * names the file through `Content-Disposition`. Building a Blob here would mean holding the whole

web/src/query/queryParts.tsx

@@ -1,23 +1,63 @@
-import { useState } from "react";
+import { useState } from "react";
 
 import { FolderMark } from "../customer-grid/icons";
 import { DbIcon } from "../shell/dbFrame";
 import { ASSISTANT_ROUTE } from "../shell/nav";
 import type { NavEntry } from "../shell/nav";
-import { duplicateQuery, exportQueryHref, renameQuery, saveQueryToDatabase } from "./queryApi";
+/**
+ * ⭐⭐ W35-T47 (R4, contract C2) — ONE STAR, AND THE BEHAVIOUR IS BORROWED WHOLE.
+ *
+ * `useStarred` is B's: the read, the optimistic flip, the reconcile, the toast on refusal, the
+ * generation guard against two writes racing. R4 makes star and "mark important" ONE idea, so a
+ * second client for it here would be the drift that ruling exists to prevent.
+ *
+ * ⛔ THE BUTTON'S MARKUP IS INLINE AND THAT IS NOT LAZINESS — IMPORTING `StarButton` BREAKS A's
+ * GATE. `StarredPage.tsx` imports `shell/Brand`, which reads `import.meta.env.BASE_URL`, and
+ * `verify_wiring.py` COMPILES AND RUNS `query/_test/queryRender.test.tsx` under node as CommonJS:
+ * `import.meta` is ESM-only syntax, node flips the emitted module to ESM, and the run dies with
+ * `ReferenceError: exports is not defined in ES module scope`. Reproduced here first, which is the
+ * only reason it is not a red `web_wiring` in somebody else's lane.
+ * ⚠ SO WHAT IS COPIED IS EIGHT LINES OF MARKUP, using B's own `.st-star` classes and the shared
+ * `StarIcon`, and `query.css` restyles nothing except placement. Posted to B as `NOTE C-16`: if
+ * `StarButton` moves into `starredApi`, this becomes an import.
+ */
+import { StarIcon } from "../ui/icons";
+import { useStarred } from "../starred/starredApi";
+import { duplicateQuery, exportQueryHref, renameQuery, revertQuery, saveQueryToDatabase } from "./queryApi";
 import type { SavedQuery } from "./queryApi";
+/**
+ * ⭐⭐ W35-T22 (owner item 3) — THE STYLESHEET BELONGS TO THE MODULE THAT RENDERS THE CLASSES, AND
+ * THAT IS THE WHOLE FIX. Owner, verbatim: *"When I click 'Query' toggle, before it loads, it shows
+ * a really ugly outdated format, fix it."*
+ *
+ * â›” MEASURED, not guessed, on a production build. `query.css` was imported ONLY by `QueryPage`,
+ * which the Assistant loads with `lazy()`. Vite splits an async chunk's CSS into its own file, so
+ * all 44 `.qy-rail*` rules landed in `QueryPage-*.css` and the boot stylesheet carried ZERO of
+ * them. But this module — which renders every one of those classes — is imported STATICALLY by
+ * `AssistantPage`, and the rail it exports sits OUTSIDE the `<Suspense>` boundary the workspace is
+ * behind. So flipping the toggle committed the rail in the same frame while its stylesheet was
+ * still one network round trip away: browser-default buttons, default `<p>` margins, a blue
+ * underlined link. That is the "outdated format".
+ *
+ * âš  It is NOT the Suspense fallback (a bare spinner) and NOT the empty state, the two candidates
+ * the wave listed. Capture of both states: `.claude/wiki/waves/wave35/proto/T22-query-flash/`.
+ *
+ * âš  KEEP THE TWIN IMPORT IN `QueryPage.tsx`. Vite emits one stylesheet either way, and the
+ * standalone `#/query` host reaches the page without passing through here.
+ */
+import "./query.css";
 
 /** Which label of which row is being typed into. One at a time, by construction. */
 interface Editing { id: string; field: "name" | "description"; value: string; }
 
 /**
- * ⛔ THE MENU IS `position: fixed`, AND THAT IS NOT A STYLE PREFERENCE. Its natural home,
+ * â›” THE MENU IS `position: fixed`, AND THAT IS NOT A STYLE PREFERENCE. Its natural home,
  * `.qy-rail-scroll`, is `overflow-y: auto`, which clips BOTH axes: an absolutely positioned menu
  * on a row near the bottom of the list renders cut off or not at all, so the reader clicks and
  * nothing appears. It fails worst on the rows most likely to be used, the ones you scrolled to.
  * Fixed positioning takes it out of the scroll box entirely, which costs one measurement.
  *
- * ⚠ `MENU_H` is an estimate used ONLY to decide whether to flip upward near the viewport floor. It
+ * âš  `MENU_H` is an estimate used ONLY to decide whether to flip upward near the viewport floor. It
  * does not size anything, so being a little wrong shifts the menu rather than breaking it.
  */
 const MENU_H = 190;
@@ -51,7 +91,7 @@ export function QueryEmpty({ loaded, unnamed = 0 }: { loaded: boolean; unnamed?:
   );
 }
 
-/** The kind glyph a Query row wears — the same vocabulary the grid's own view rail uses. */
+/** The kind glyph a Query row wears — the same vocabulary the grid's own view rail uses. */
 const KIND_MARK: Record<string, string> = {
   grid: "Table", list: "List", chart: "Chart", kanban: "Board",
   calendar: "Calendar", timeseries: "Time series", map: "Map",
@@ -65,17 +105,17 @@ export interface QueryGroup {
 }
 
 /**
- * ⚠ GROUPED IN THE ORDER THE DATABASES ARE GRANTED, not by artefact age. The rail is a list of
+ * âš  GROUPED IN THE ORDER THE DATABASES ARE GRANTED, not by artefact age. The rail is a list of
  * DATABASES first (owner: "each View correspond to the relevant database"), so a new answer about
- * Customers must not move the Customers heading — it appears under it. Within a database the
+ * Customers must not move the Customers heading — it appears under it. Within a database the
  * newest is first, which is the order the server already sends.
  *
- * ⭐ R14 GAVE THIS LIST A SECOND HOST, which is why the loop is a function and lives HERE rather
+ * ⭐ R14 GAVE THIS LIST A SECOND HOST, which is why the loop is a function and lives HERE rather
  * than inside `QueryPage`. The merged Assistant surface renders the same rail in its own left
  * panel; two hosts computing "which views belong to which database" from two copies of one loop
  * is one question with two normalizers, and the copy that drifts is the one nobody is looking at.
  * It sits beside `QueryGroup`, the type it builds, and in a module that does NOT import the grid
- * — a static import from `QueryPage.tsx` would pull `CustomerGrid` into the chat bundle and undo
+ * — a static import from `QueryPage.tsx` would pull `CustomerGrid` into the chat bundle and undo
  * the lazy boundary the Assistant keeps around it.
  *
  * A view whose source database is not in `entries` is dropped: the caller's grant is the wall.
@@ -102,21 +142,21 @@ export function queryGroups(views: SavedQuery[], entries: NavEntry[]): QueryGrou
 }
 
 /**
- * ⭐⭐ OWNER ITEM 3 (2026-08-15) — GROUPED BY SOURCE DATABASE, WHICH IS THE WHOLE INSTRUCTION.
+ * ⭐⭐ OWNER ITEM 3 (2026-08-15) — GROUPED BY SOURCE DATABASE, WHICH IS THE WHOLE INSTRUCTION.
  * Verbatim: *"these AI generated query should live under the query module. And that each View
  * correspond to the relevant database. So we need to remove that dumb dropdown that suddenly
  * appears at the top right of the Database when the AI does query. That's not how we should do
  * the navigation."*
  *
- * ⛔ THE DROPDOWN WAS NOT THE DEFECT — THE ABSENCE OF NAVIGATION WAS. Deleting it (which the
+ * ⛔ THE DROPDOWN WAS NOT THE DEFECT — THE ABSENCE OF NAVIGATION WAS. Deleting it (which the
  * previous pass did) left Query with no way to move between artefacts at all: the page picked
  * `known[0]` and every other view the assistant had ever built was unreachable. A surface with
  * one implicit selection is not "no dropdown", it is no navigation, and the owner asked for the
  * navigation to be done differently rather than removed.
  *
- * ⚠ AND THIS IS WHERE A DATABASE PUTS ITS VIEWS. `dbFrame.tsx` carries the owner's earlier
- * sentence — *"the query module should exactly BE looking like the database module, COMPLETELY,
- * with all the views etc."* — so the rail sits in the slot `CustomerGrid`'s own `ViewSidebar`
+ * âš  AND THIS IS WHERE A DATABASE PUTS ITS VIEWS. `dbFrame.tsx` carries the owner's earlier
+ * sentence — *"the query module should exactly BE looking like the database module, COMPLETELY,
+ * with all the views etc."* — so the rail sits in the slot `CustomerGrid`'s own `ViewSidebar`
  * occupies on every other database, at the same `--lp-rail-w`. It is a separate component only
  * because THIS list spans several databases and the grid's rail, by construction, cannot: the
  * grid is mounted at one scope.
@@ -127,7 +167,7 @@ export function QueryRail({ groups, activeId, onSelect, onDelete, onChanged }: {
   onSelect: (id: string) => void;
   onDelete: (id: string) => void;
   /**
-   * ⭐ The rail OWNS the rename/duplicate calls and hands the host the resulting artefact to
+   * ⭐ The rail OWNS the rename/duplicate calls and hands the host the resulting artefact to
    * upsert. Two hosts render this list (the standalone page and the merged Assistant surface), so
    * putting the calls in the hosts would be one question with two implementations, and the copy
    * that drifts is the one nobody is looking at.
@@ -140,10 +180,19 @@ export function QueryRail({ groups, activeId, onSelect, onDelete, onChanged }: {
   const [menuFor, setMenuFor] = useState("");
   const [anchor, setAnchor] = useState<{ top: number; right: number } | null>(null);
   const [editing, setEditing] = useState<Editing | null>(null);
-  // ⚠ TWO STATES, NOT ONE. A refusal and a confirmation read differently and are coloured
+  // âš  TWO STATES, NOT ONE. A refusal and a confirmation read differently and are coloured
   // differently; sharing one slot painted "Saved as ..." in the refusal red.
   const [problem, setProblem] = useState("");
   const [notice, setNotice] = useState("");
+  /**
+   * ⭐ C2's star list, read AFTER PAINT and never blocking the rail (E-2: `GET /starred` scans
+   * every visible database's view bucket and was MEASURED at 7,331 ms on a cold container). The
+   * hook fires in an effect and reports `phase`, so the control simply is not drawn until the
+   * answer arrives — a star toggled from a list nobody has read would be a guess at its own
+   * current value.
+   */
+  const stars = useStarred();
+  const starred = new Set(stars.starred.queries);
   const said = (message: string) => { setNotice(message); setProblem(""); };
   const failed = (message: string) => { setProblem(message); setNotice(""); };
 
@@ -159,7 +208,7 @@ export function QueryRail({ groups, activeId, onSelect, onDelete, onChanged }: {
   };
 
   /**
-   * ⚠ THE REPLY IS SHOWN WHETHER OR NOT ANYTHING WAS DROPPED, and the dropped half is the useful
+   * âš  THE REPLY IS SHOWN WHETHER OR NOT ANYTHING WAS DROPPED, and the dropped half is the useful
    * one: a database view carries no aggregation, so "sum of deal value" lands as the rows and not
    * the sum. Saying so beats a view that looks complete and answers a different question.
    */
@@ -171,9 +220,36 @@ export function QueryRail({ groups, activeId, onSelect, onDelete, onChanged }: {
       : `Saved as "${result.value.name}" in this database's own views.`);
   };
 
+  /**
+   * ⭐⭐ W35-T25 · CONTRACT C4 (R3) — "Revert to AI original", and the sentence comes FIRST.
+   *
+   * ⛔ THE CONFIRM SAYS WHAT REVERT DOES **NOT** DO, BEFORE IT ACTS, AND R3 REQUIRES THAT WORDING
+   * RATHER THAN SUGGESTING IT. A Query view is live since R2, so a cell somebody changed through
+   * it is a real write to a real record in the source database. Putting the filters back cannot
+   * walk that back, and a reader who assumed otherwise has been told the opposite of the truth at
+   * the one moment they could still have chosen differently.
+   *
+   * ⚠ `window.confirm`, deliberately, and this is the one place in this module that uses it. Every
+   * other destructive door here is a two-click in the row, which works because those are cheap and
+   * reversible (a rename, a delete of one saved answer). This one is neither: it discards work with
+   * no undo, and a two-click cannot carry a sentence.
+   */
+  const revert = async (view: SavedQuery) => {
+    setMenuFor("");
+    const ok = window.confirm(
+      `Revert "${view.name}" to the version the assistant built?\n\n`
+      + "This restores the filters, sorting, grouping, visible columns and column widths.\n\n"
+      + "It does NOT undo any record you changed in the source database. Those edits stay.");
+    if (!ok) return;
+    const result = await revertQuery(view.id);
+    if (!result.ok) { failed(result.message); return; }
+    said(`"${result.value.name}" is back to the assistant's version.`);
+    onChanged?.(result.value);
+  };
+
   const duplicate = async (id: string) => {
     const result = await duplicateQuery(id);
-    // ⚠ The refusal is the useful half: MAX_ARTIFACTS names its cause and the remedy, and a copy
+    // âš  The refusal is the useful half: MAX_ARTIFACTS names its cause and the remedy, and a copy
     // that silently did not happen is the failure mode this whole module is written against.
     if (!result.ok) { failed(result.message); return; }
     said("");
@@ -221,9 +297,41 @@ export function QueryRail({ groups, activeId, onSelect, onDelete, onChanged }: {
                     title={view.description || view.question}
                   >
                     <span className="qy-rail-name">{view.name}</span>
-                    <span className="qy-rail-kind">{KIND_MARK[view.kind] ?? view.kind}</span>
+                    <span className="qy-rail-kind">
+                      {KIND_MARK[view.kind] ?? view.kind}
+                      {/* ⭐⭐ W35-T25 (R3) — THE EDITED MARK, ON THE ROW THAT NAMES THE VIEW.
+                          R3 says "its header"; since owner item 3 replaced the top-right dropdown
+                          with this rail, this row IS a Query view's header, and owner item 4 has
+                          just deleted the only strip above the grid. Putting the badge back up
+                          there would re-grow the row the same wave removed.
+                          ⚠ Absent, not false, for an artefact with no `original_spec`: `edited` is
+                          derived server-side by comparing against it, so a pre-wave artefact
+                          reports `false` and shows neither this nor the Revert row (C4). */}
+                      {view.edited ? (
+                        <span className="qy-rail-edited"
+                          title="You changed this view. Revert to AI original is in its menu.">
+                          Edited
+                        </span>
+                      ) : null}
+                    </span>
                   </button>
                 )}
+                {/* ⭐ W35-T47 — the star, on the row, in BOTH hosts (this rail is the only place a
+                    Query view is listed, and the standalone page and the Assistant's Query mode
+                    both render it). Not drawn until `/starred` has answered: see `stars` above. */}
+                {stars.load.phase === "ready" ? (
+                  <button
+                    type="button"
+                    className={"st-star" + (starred.has(view.id) ? " is-on" : "")}
+                    aria-pressed={starred.has(view.id)}
+                    aria-label={(starred.has(view.id) ? "Unstar " : "Star ") + view.name}
+                    title={(starred.has(view.id) ? "Unstar " : "Star ") + view.name}
+                    disabled={stars.busy}
+                    onClick={() => stars.toggle("query", view.id, !starred.has(view.id))}
+                  >
+                    <StarIcon size={15} filled={starred.has(view.id)} />
+                  </button>
+                ) : null}
                 {confirming === view.id ? (
                   <button type="button" className="qy-rail-confirm"
                     onClick={() => { setConfirming(""); onDelete(view.id); }}>
@@ -266,6 +374,15 @@ export function QueryRail({ groups, activeId, onSelect, onDelete, onChanged }: {
                     </button>
                     <button type="button" className="qy-rail-item" role="menuitem"
                       onClick={() => { setMenuFor(""); void duplicate(view.id); }}>Duplicate</button>
+                    {/* ⭐ R3: armed only when there IS an original AND the view has moved from it.
+                        A Revert that reverts to nothing is worse than an absent one (C4), and a
+                        Revert on an unedited view is a control that does nothing. */}
+                    {view.edited && view.original_spec ? (
+                      <button type="button" className="qy-rail-item" role="menuitem"
+                        onClick={() => { void revert(view); }}>
+                        Revert to AI original
+                      </button>
+                    ) : null}
                     {/* R20's one difference from a database view's menu: this one can BECOME one. */}
                     <button type="button" className="qy-rail-item" role="menuitem"
                       onClick={() => { setMenuFor(""); void saveToDatabase(view); }}>
@@ -288,21 +405,16 @@ export function QueryRail({ groups, activeId, onSelect, onDelete, onChanged }: {
   );
 }
 
-/**
- * The provenance R9 requires, in one readable line rather than a JSON dump.
+/*
+ * ⛔⛔ `QueryProvenance` IS DELETED (W35-T21, owner item 4 / R2), AND WHAT WENT WITH IT MATTERS.
+ * Owner, verbatim: *"there is a 'Source' button under Query as well. The end user doesn't need to
+ * see this so delete it."* R2 retires the snapshot framing with it, because the two were one
+ * control: the button read "Sources" and the row beside it read the snapshot version.
  *
- * ⚠ It is a DISCLOSURE, not a banner: shut by default, so a surface whose job is to look like a
- * database looks like one, and one click away for the reader who wants to audit the number.
+ * âš  THE CITATIONS DID NOT GO. They still reach the grid through `bindingFor(active, citations)`
+ * in `QueryPage`, and they are still RENDERED for a reader in the surface that owns the claim —
+ * the chat, where `AssistantPage::CitationLine` prints one clickable line per citation under the
+ * answer that used it. What R2 removed is a second provenance surface above a grid, not the
+ * auditability R9 asked for. `verify_grid_ux.py::query_preview_shape` asserts exactly that pair:
+ * no provenance chrome on this page, citations still bound.
  */
-export function QueryProvenance({ view, detail }: { view: SavedQuery; detail: string }) {
-  const [open, setOpen] = useState(false);
-  return (
-    <div className={"qy-prov" + (open ? " is-open" : "")}>
-      <button type="button" className="qy-prov-btn" aria-expanded={open} onClick={() => setOpen(!open)}>
-        <span className="qy-prov-q">{view.question}</span>
-        <span className="qy-prov-toggle">{open ? "Hide sources" : "Sources"}</span>
-      </button>
-      {open ? <p className="qy-prov-detail">{detail}</p> : null}
-    </div>
-  );
-}

web/src/settings/AdminPane.tsx

@@ -1,646 +1,646 @@
-// ---------------------------------------------------------------------------
-// settings / AdminPane.tsx — THE LOOPABLE ADMIN PLANE (wave 19, owner item 13 /
-// R3+R4, contract C2).
-//
-// The one surface in this product that looks ACROSS tenants: who our customers
-// are, how many people use each workspace, what they have built in it, whether
-// their data sources are alive, and what the automation fleet costs.
-//
-// SELF-CONTAINED BY CONTRACT (C2). It fetches its own data via
-// `platformAdminApi` and takes ONE prop, so mounting it is a rail entry plus a
-// line in the pane switch — `SettingsModal.tsx` is another session's file this
-// wave and must not have to learn anything about this pane's data.
-//
-// ⚠ THE PROP IS TYPED STRUCTURALLY, not as `SessionUser` from `../shell/session`.
-// The mount site passes the shell's session user (a wider object), which
-// satisfies this shape by structural typing — and this pane therefore imports
-// nothing from the shell, which is what the wave's cross-fence rule asks for
-// while `session.ts` is open on another desk.
-//
-// ⛔ EVERY NUMBER HERE IS THE SERVER'S, AND EVERY NUMBER DRILLS. Clicking a count
-// opens the rows it was computed from — the same collector, projected twice
-// ([[no-unverifiable-aggregates]]). A count that could not be READ renders as an
-// em dash with the reason, never as a zero: "this customer has no databases" and
-// "we could not look" are different facts and the pane refuses to conflate them.
-//
-// DESIGN: sentence-case micro-labels (R6 — no caps in app chrome), short noun
-// headers, tabular figures right-aligned, hairlines not shadows, tokens only,
-// no emojis (DESIGN.md §2–§4).
-// ---------------------------------------------------------------------------
-
-import { useCallback, useEffect, useState } from "react";
-import type {
-  AutomationRow,
-  ConnectorRow,
-  DatabaseRow,
-  FleetCost,
-  Overview,
-  PlatformUser,
-  ReleasesPayload,
-} from "./platformAdminApi";
-import {
-  getAutomations,
-  getAws,
-  getReleases,
-  getConnectors,
-  getDatabases,
-  getOverview,
-  getUsers,
-} from "./platformAdminApi";
-
-// --- formatting -------------------------------------------------------------
-
-const int = (n: number) => n.toLocaleString();
-
-/** A count that may be unknown. `null` is NOT zero — see the api module's header. */
-function Count({ n, why }: { n: number | null | undefined; why?: string }) {
-  if (n === null || n === undefined)
-    return (
-      <span className="padmin-unknown" title={why || "This could not be read just now"}>
-        —
-      </span>
-    );
-  return <>{int(n)}</>;
-}
-
-/** "3 days ago" for a stamp, "never" for an absent one. Never a fabricated date.
- *
- *  ⛔ ONLY FOR OFFSET-BEARING STAMPS. `Date.parse` reads a stamp with no zone as
- *  BROWSER-LOCAL, so running a container-local timestamp through this reports the
- *  viewer's UTC offset as elapsed time — hours of error in a column people scan,
- *  and a future-dated stamp that renders as "just now" indefinitely. Everything
- *  this pane passes here (`last_login`, `last_active`, `generatedAt`) is written
- *  with an explicit offset; the automation engine's `lastRunAt` is NOT, so it is
- *  rendered verbatim instead. */
-function ago(stamp: string): string {
-  if (!stamp) return "never";
-  const t = Date.parse(stamp.includes("T") ? stamp : stamp.replace(" ", "T"));
-  if (Number.isNaN(t)) return stamp;
-  const mins = Math.floor((Date.now() - t) / 60000);
-  if (mins < 2) return "just now";
-  if (mins < 60) return `${mins} minutes ago`;
-  const hours = Math.floor(mins / 60);
-  if (hours < 24) return `${hours} hour${hours === 1 ? "" : "s"} ago`;
-  const days = Math.floor(hours / 24);
-  if (days < 60) return `${days} day${days === 1 ? "" : "s"} ago`;
-  return `${Math.floor(days / 30)} months ago`;
-}
-
-type DrillKind = "users" | "databases" | "connectors" | "automations";
-
-const DRILL_NOUN: Record<DrillKind, string> = {
-  users: "People",
-  databases: "Databases",
-  connectors: "Data sources",
-  automations: "Automations",
-};
-
-/** The loading shape — a skeleton, not a spinner (DESIGN.md §4). */
-function Skeleton({ rows = 3 }: { rows?: number }) {
-  return (
-    <div className="padmin-skel" aria-hidden="true">
-      {Array.from({ length: rows }, (_, i) => (
-        <div key={i} className="padmin-skel-row" />
-      ))}
-    </div>
-  );
-}
-
-// --- the pane ---------------------------------------------------------------
-
-export function AdminPane({ user }: { user: { username: string; name: string; role: string } }) {
-  const [ov, setOv] = useState<Overview | null>(null);
-  const [err, setErr] = useState("");
-  const [fleet, setFleet] = useState<{ rows: AutomationRow[]; cost: FleetCost } | null>(null);
-
-  const [drill, setDrill] = useState<{ kind: DrillKind; tenant: string } | null>(null);
-  const [drillRows, setDrillRows] = useState<unknown[] | null>(null);
-  const [drillNote, setDrillNote] = useState("");
-
-  const [aws, setAws] = useState<{ text: string; note: string; available: boolean } | null>(null);
-  // Wave 20 (R6): the releases panel. Loaded with the overview rather than on demand — it is
-  // two small Hub reads and the first question an operator opens this pane to answer.
-  const [rel, setRel] = useState<ReleasesPayload | null>(null);
-  const [awsBusy, setAwsBusy] = useState(false);
-
-  const load = useCallback(() => {
-    setOv(null);
-    void getOverview().then((r) => {
-      if (r.ok) {
-        setOv(r.data);
-        setErr("");
-      } else setErr(r.message);
-    });
-    void getAutomations().then((r) => {
-      if (r.ok) setFleet({ rows: r.data.automations, cost: r.data.cost });
-    });
-    void getReleases().then((r) => {
-      if (r.ok) setRel(r.data);
-    });
-  }, []);
-  useEffect(load, [load]);
-
-  const openDrill = useCallback((kind: DrillKind, tenant: string) => {
-    setDrill({ kind, tenant });
-    setDrillRows(null);
-    setDrillNote("");
-    const fetcher =
-      kind === "users"
-        ? getUsers
-        : kind === "databases"
-          ? getDatabases
-          : kind === "connectors"
-            ? getConnectors
-            : getAutomations;
-    void fetcher(tenant || undefined).then((r) => {
-      if (!r.ok) {
-        setDrillRows([]);
-        setDrillNote(r.message);
-        return;
-      }
-      const d = r.data as Record<string, unknown>;
-      setDrillRows((d[kind] as unknown[]) ?? []);
-      // The server's own honest note travels with the rows rather than being
-      // re-invented here: it is the one that knows WHY a tenant is missing.
-      const errors = (d.errors as Record<string, string>) ?? {};
-      const words = Object.entries(errors).map(([t, e]) => `${t}: ${e}`);
-      setDrillNote(
-        [typeof d.stampsNote === "string" ? d.stampsNote : "", ...words]
-          .filter(Boolean)
-          .join(" · ")
-      );
-    });
-  }, []);
-
-  const loadAws = useCallback(() => {
-    setAwsBusy(true);
-    void getAws(7).then((r) => {
-      setAwsBusy(false);
-      if (r.ok) setAws(r.data.report);
-      else setAws({ text: "", note: r.message, available: false });
-    });
-  }, []);
-
-  return (
-    <div className="set-pane">
-      <h3 className="set-h">Loopable admin</h3>
-      <p className="set-help set-pane-intro">
-        Every workspace on the platform, signed in as {user.name}. Counts open the rows they were
-        computed from; anything that could not be read shows a dash and says why, rather than a
-        zero.
-      </p>
-      {err ? <p className="set-error">{err}</p> : null}
-
-      {!ov ? (
-        <Skeleton rows={4} />
-      ) : (
-        <>
-          <div className="padmin-totals">
-            <Total label="Workspaces" value={int(ov.totals.tenants)} />
-            <Total label="People" value={int(ov.totals.users)} />
-            <Total label="Databases" value={int(ov.totals.databases)} />
-            <Total label="Records" value={int(ov.totals.rows)} />
-            <Total
-              label="Automation cost"
-              value={fleet ? `$${fleet.cost.usd.toFixed(2)}` : "—"}
-              hint={fleet?.cost.basis}
-            />
-          </div>
-          {ov.totals.unknownTenants > 0 ? (
-            <p className="set-help padmin-caveat">
-              {ov.totals.unknownTenants} workspace
-              {ov.totals.unknownTenants === 1 ? "" : "s"} could not be read, so the totals above
-              exclude {ov.totals.unknownTenants === 1 ? "it" : "them"}.
-            </p>
-          ) : null}
-
-          <div className="padmin-tablewrap">
-            <table className="padmin-table">
-              <thead>
-                <tr>
-                  <th>Workspace</th>
-                  <th>Storage</th>
-                  <th className="padmin-num">People</th>
-                  <th className="padmin-num">Databases</th>
-                  <th className="padmin-num">Records</th>
-                  <th className="padmin-num">Sources</th>
-                  <th className="padmin-num">Automations</th>
-                </tr>
-              </thead>
-              <tbody>
-                {ov.tenants.map((t) => (
-                  <tr key={t.slug}>
-                    <td>
-                      <span className="padmin-name">{t.name}</span>
-                      <span className="padmin-meta">
-                        {t.slug}
-                        {t.status !== "active" ? ` · ${t.status}` : ""}
-                        {t.errors && t.errors.length ? ` · ${t.errors[0]}` : ""}
-                      </span>
-                    </td>
-                    <td>
-                      <span className="padmin-meta">
-                        {t.storeRepo && t.storeRepo.includes("/")
-                          ? "own repository"
-                          : t.storePrefix
-                            ? "shared repository"
-                            : "tenant #0 repository"}
-                        {t.keychainLocked ? " · keychain locked" : ""}
-                      </span>
-                    </td>
-                    <DrillCell
-                      n={t.users}
-                      onOpen={() => openDrill("users", t.slug)}
-                      title={`${t.admins} administrator${t.admins === 1 ? "" : "s"}`}
-                    />
-                    <DrillCell
-                      n={t.databases}
-                      onOpen={() => openDrill("databases", t.slug)}
-                      why={t.errors?.[0]}
-                    />
-                    <DrillCell
-                      n={t.rows}
-                      onOpen={() => openDrill("databases", t.slug)}
-                      why={t.errors?.[0]}
-                    />
-                    <DrillCell
-                      n={t.connectors}
-                      onOpen={() => openDrill("connectors", t.slug)}
-                      why={t.errors?.[0]}
-                      title={
-                        t.connectorsPaused ? `${t.connectorsPaused} paused` : "none paused"
-                      }
-                    />
-                    <DrillCell
-                      n={t.automations}
-                      onOpen={() => openDrill("automations", t.slug)}
-                      why={t.errors?.[0]}
-                      title={
-                        t.automationsEnabled != null
-                          ? `${t.automationsEnabled} scheduled`
-                          : undefined
-                      }
-                    />
-                  </tr>
-                ))}
-              </tbody>
-            </table>
-          </div>
-
-          <p className="set-help padmin-caveat">
-            Read {ago(ov.generatedAt)} in {ov.tookMs} ms.{" "}
-            {ov.totals.orphanUsers > 0
-              ? `${ov.totals.orphanUsers} account${
-                  ov.totals.orphanUsers === 1 ? "" : "s"
-                } belong to a workspace this deployment no longer knows. `
-              : ""}
-            <button type="button" className="padmin-link" onClick={load}>
-              Refresh
-            </button>
-          </p>
-
-          {drill ? (
-            <section className="padmin-drill">
-              <div className="padmin-drill-head">
-                <h4 className="padmin-h4">
-                  {DRILL_NOUN[drill.kind]}
-                  {drill.tenant ? ` — ${drill.tenant}` : ""}
-                </h4>
-                <button type="button" className="padmin-link" onClick={() => setDrill(null)}>
-                  Close
-                </button>
-              </div>
-              {drillRows === null ? (
-                <Skeleton rows={2} />
-              ) : drillRows.length === 0 ? (
-                <p className="set-help">Nothing here yet.</p>
-              ) : (
-                <DrillTable kind={drill.kind} rows={drillRows} />
-              )}
-              {drillNote ? <p className="set-help padmin-caveat">{drillNote}</p> : null}
-            </section>
-          ) : null}
-
-          {fleet ? (
-            <section className="padmin-block">
-              {/* Named for what it SHOWS. The fleet's rows live one level down,
-                  behind the Automations count — this section is the cost and the
-                  reasoning behind it, so calling it "fleet" would promise a
-                  table that is deliberately not here. */}
-              <h4 className="padmin-h4">Automation cost</h4>
-              <p className="set-help">
-                {fleet.rows.filter((a) => a.enabled).length} scheduled of {fleet.rows.length}
-                {fleet.cost.fleetRunsPerDay
-                  ? `, about ${fleet.cost.fleetRunsPerDay} runs a day`
-                  : ""}
-                {fleet.cost.unknownCadence
-                  ? ` (${fleet.cost.unknownCadence} on a custom cadence, not counted)`
-                  : ""}
-                . {fleet.cost.basis}
-              </p>
-            </section>
-          ) : null}
-
-          {/* ── Wave 20 (owner item 12 / R6): what is running where ──────────────────
-              READ-ONLY BY RULING. The operator sees both environments and every cut
-              release; moving one is a CLI command, printed below rather than wired to
-              a button, so no browser session can rewrite production. */}
-          <section className="padmin-block">
-            <h4 className="padmin-h4">Releases</h4>
-            {!rel ? (
-              <Skeleton rows={2} />
-            ) : (
-              <>
-                <table className="padmin-table">
-                  <thead>
-                    <tr>
-                      <th>Environment</th>
-                      <th>Version</th>
-                      <th>Stage</th>
-                      <th>Space</th>
-                    </tr>
-                  </thead>
-                  <tbody>
-                    {rel.environments.map((e) => (
-                      <tr key={e.env}>
-                        <td>{e.env === "live" ? "Live (pinned)" : "Staging (follows the tree)"}</td>
-                        {/* ⚠ An unreadable version is a NOTE, never a blank. A blank cell in a
-                            column headed "Version" reads as "nothing is deployed", which about a
-                            production environment is the worst available way to be wrong. */}
-                        <td>{e.version || <span className="set-help">{e.note || "unknown"}</span>}</td>
-                        <td>{e.stage || "—"}</td>
-                        {/* The Space ID as TEXT, not a link: the server deliberately builds no
-                            URL (portability C1 — a host literal in runtime code hard-codes the
-                            current host into a process designed to move). */}
-                        <td>{e.space}</td>
-                      </tr>
-                    ))}
-                  </tbody>
-                </table>
-                {rel.releases.length ? (
-                  <table className="padmin-table">
-                    <thead>
-                      <tr>
-                        <th>Release</th>
-                        <th>Commit</th>
-                        <th>Cut</th>
-                        <th>What shipped</th>
-                      </tr>
-                    </thead>
-                    <tbody>
-                      {rel.releases.map((r) => (
-                        <tr key={r.version}>
-                          <td>{r.version}</td>
-                          <td>{r.sha}</td>
-                          <td>{r.date}</td>
-                          <td>{r.subject}</td>
-                        </tr>
-                      ))}
-                    </tbody>
-                  </table>
-                ) : (
-                  <p className="set-help">
-                    No tagged releases were readable from either Space.
-                  </p>
-                )}
-                <p className="set-help">
-                  To move Live to another version, or roll it back, run:{" "}
-                  <code>{rel.promote}</code>
-                </p>
-              </>
-            )}
-          </section>
-
-          <section className="padmin-block">
-            <h4 className="padmin-h4">AWS cron</h4>
-            {!aws ? (
-              <p className="set-help">
-                The external tick that wakes this app on schedule. Reading its usage runs a live
-                CloudWatch query and takes a few seconds.{" "}
-                <button
-                  type="button"
-                  className="padmin-link"
-                  onClick={loadAws}
-                  disabled={awsBusy}
-                >
-                  {awsBusy ? "Reading…" : "Check usage"}
-                </button>
-              </p>
-            ) : aws.available ? (
-              <pre className="padmin-pre">{aws.text}</pre>
-            ) : (
-              <p className="set-help">{aws.note}</p>
-            )}
-          </section>
-        </>
-      )}
-    </div>
-  );
-}
-
-function Total({ label, value, hint }: { label: string; value: string; hint?: string }) {
-  // A tooltip nobody can see is a tooltip nobody reads: the label carries a
-  // dotted underline exactly when there is something behind it.
-  return (
-    <div className={"padmin-total" + (hint ? " has-hint" : "")} title={hint || undefined}>
-      <span className="padmin-total-label">{label}</span>
-      <span className="padmin-total-value">{value}</span>
-    </div>
-  );
-}
-
-/** A numeric cell that opens its own rows. Unknown counts are not clickable —
- *  there is nothing to drill INTO when the read failed, and a button that opens
- *  an empty table would read as "none". */
-function DrillCell({
-  n,
-  onOpen,
-  why,
-  title,
-}: {
-  n: number | null | undefined;
-  onOpen: () => void;
-  why?: string;
-  title?: string;
-}) {
-  if (n === null || n === undefined)
-    return (
-      <td className="padmin-num">
-        <Count n={n} why={why} />
-      </td>
-    );
-  return (
-    <td className="padmin-num">
-      <button type="button" className="padmin-drill-btn" onClick={onOpen} title={title}>
-        {int(n)}
-      </button>
-    </td>
-  );
-}
-
-function DrillTable({ kind, rows }: { kind: DrillKind; rows: unknown[] }) {
-  if (kind === "users") {
-    const rs = rows as PlatformUser[];
-    return (
-      <div className="padmin-tablewrap">
-        <table className="padmin-table">
-          <thead>
-            <tr>
-              <th>Person</th>
-              <th>Workspace</th>
-              <th>Role</th>
-              <th>Last sign-in</th>
-              <th>Last active</th>
-            </tr>
-          </thead>
-          <tbody>
-            {rs.map((u) => (
-              <tr key={`${u.tenant}/${u.username}`}>
-                <td>
-                  <span className="padmin-name">{u.name}</span>
-                  <span className="padmin-meta">
-                    {u.username}
-                    {u.email ? ` · ${u.email}` : ""}
-                    {u.active ? "" : " · deactivated"}
-                  </span>
-                </td>
-                <td>{u.tenant}</td>
-                <td>
-                  {u.role}
-                  {u.platformAdmin ? " · platform" : ""}
-                </td>
-                <td>{ago(u.lastLogin)}</td>
-                <td>{ago(u.lastActive)}</td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
-      </div>
-    );
-  }
-  if (kind === "databases") {
-    const rs = rows as DatabaseRow[];
-    return (
-      <div className="padmin-tablewrap">
-        <table className="padmin-table">
-          <thead>
-            <tr>
-              <th>Database</th>
-              <th>Workspace</th>
-              <th>Built from</th>
-              <th className="padmin-num">Fields</th>
-              <th className="padmin-num">Records</th>
-            </tr>
-          </thead>
-          <tbody>
-            {rs.map((d) => (
-              <tr key={`${d.tenant}/${d.key}`}>
-                <td>
-                  <span className="padmin-name">{d.label}</span>
-                  <span className="padmin-meta">
-                    {d.key}
-                    {d.createdBy ? ` · ${d.createdBy}` : ""}
-                  </span>
-                </td>
-                <td>{d.tenant}</td>
-                <td>{d.source}</td>
-                <td className="padmin-num">{int(d.fields)}</td>
-                <td className="padmin-num">{int(d.rowCount)}</td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
-      </div>
-    );
-  }
-  if (kind === "connectors") {
-    const rs = rows as ConnectorRow[];
-    return (
-      <div className="padmin-tablewrap">
-        <table className="padmin-table">
-          <thead>
-            <tr>
-              <th>Source</th>
-              <th>Workspace</th>
-              <th>Kind</th>
-              <th>Status</th>
-            </tr>
-          </thead>
-          <tbody>
-            {rs.map((c) => (
-              <tr key={`${c.tenant}/${c.key}`}>
-                <td>
-                  <span className="padmin-name">{c.label}</span>
-                  <span className="padmin-meta">
-                    {c.source === "env" ? "environment credentials" : "keychain"}
-                  </span>
-                </td>
-                <td>{c.tenant}</td>
-                <td>{c.type}</td>
-                <td>
-                  <span
-                    className={
-                      "padmin-dot " +
-                      (c.paused ? "is-paused" : c.active ? "is-live" : "is-idle")
-                    }
-                  />
-                  {c.paused ? "paused" : c.active ? "serving" : "stored"}
-                </td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
-      </div>
-    );
-  }
-  const rs = rows as AutomationRow[];
-  return (
-    <div className="padmin-tablewrap">
-      <table className="padmin-table">
-        <thead>
-          <tr>
-            <th>Automation</th>
-            <th>Workspace</th>
-            <th>Schedule</th>
-            <th className="padmin-num">Runs a day</th>
-            <th>Last run</th>
-          </tr>
-        </thead>
-        <tbody>
-          {rs.map((a) => (
-            <tr key={`${a.tenant}/${a.id}`}>
-              <td>
-                <span className="padmin-name">{a.name}</span>
-                <span className="padmin-meta">
-                  {a.kind}
-                  {a.failedRetained
-                    ? ` · ${a.failedRetained} of the last ${a.runsRetained} runs failed`
-                    : ""}
-                </span>
-              </td>
-              <td>{a.tenant}</td>
-              <td>{a.enabled ? a.cron || "scheduled" : "paused"}</td>
-              <td className="padmin-num">
-                {a.enabled ? (a.runsPerDay === null ? "custom" : a.runsPerDay) : "—"}
-              </td>
-              <td>
-                <span
-                  className={
-                    "padmin-dot " +
-                    (a.state === "error" ? "is-error" : a.state === "ok" ? "is-live" : "is-idle")
-                  }
-                />
-                {/* Verbatim, not relative: the engine writes this stamp with no
-                    zone (`automation_engine._iso()` is naive local-to-container),
-                    so "x hours ago" would be wrong by the viewer's offset. */}
-                {a.lastRunAt ? a.lastRunAt.replace("T", " ") : "never"}
-              </td>
-            </tr>
-          ))}
-        </tbody>
-      </table>
-    </div>
-  );
-}
-
-export default AdminPane;
+// ---------------------------------------------------------------------------
+// settings / AdminPane.tsx — THE LOOPABLE ADMIN PLANE (wave 19, owner item 13 /
+// R3+R4, contract C2).
+//
+// The one surface in this product that looks ACROSS tenants: who our customers
+// are, how many people use each workspace, what they have built in it, whether
+// their data sources are alive, and what the automation fleet costs.
+//
+// SELF-CONTAINED BY CONTRACT (C2). It fetches its own data via
+// `platformAdminApi` and takes ONE prop, so mounting it is a rail entry plus a
+// line in the pane switch — `SettingsModal.tsx` is another session's file this
+// wave and must not have to learn anything about this pane's data.
+//
+// ⚠ THE PROP IS TYPED STRUCTURALLY, not as `SessionUser` from `../shell/session`.
+// The mount site passes the shell's session user (a wider object), which
+// satisfies this shape by structural typing — and this pane therefore imports
+// nothing from the shell, which is what the wave's cross-fence rule asks for
+// while `session.ts` is open on another desk.
+//
+// ⛔ EVERY NUMBER HERE IS THE SERVER'S, AND EVERY NUMBER DRILLS. Clicking a count
+// opens the rows it was computed from — the same collector, projected twice
+// ([[no-unverifiable-aggregates]]). A count that could not be READ renders as an
+// em dash with the reason, never as a zero: "this customer has no databases" and
+// "we could not look" are different facts and the pane refuses to conflate them.
+//
+// DESIGN: sentence-case micro-labels (R6 — no caps in app chrome), short noun
+// headers, tabular figures right-aligned, hairlines not shadows, tokens only,
+// no emojis (DESIGN.md §2–§4).
+// ---------------------------------------------------------------------------
+
+import { useCallback, useEffect, useState } from "react";
+import type {
+  AutomationRow,
+  ConnectorRow,
+  DatabaseRow,
+  FleetCost,
+  Overview,
+  PlatformUser,
+  ReleasesPayload,
+} from "./platformAdminApi";
+import {
+  getAutomations,
+  getAws,
+  getReleases,
+  getConnectors,
+  getDatabases,
+  getOverview,
+  getUsers,
+} from "./platformAdminApi";
+
+// --- formatting -------------------------------------------------------------
+
+const int = (n: number) => n.toLocaleString();
+
+/** A count that may be unknown. `null` is NOT zero — see the api module's header. */
+function Count({ n, why }: { n: number | null | undefined; why?: string }) {
+  if (n === null || n === undefined)
+    return (
+      <span className="padmin-unknown" title={why || "This could not be read just now"}>
+        —
+      </span>
+    );
+  return <>{int(n)}</>;
+}
+
+/** "3 days ago" for a stamp, "never" for an absent one. Never a fabricated date.
+ *
+ *  ⛔ ONLY FOR OFFSET-BEARING STAMPS. `Date.parse` reads a stamp with no zone as
+ *  BROWSER-LOCAL, so running a container-local timestamp through this reports the
+ *  viewer's UTC offset as elapsed time — hours of error in a column people scan,
+ *  and a future-dated stamp that renders as "just now" indefinitely. Everything
+ *  this pane passes here (`last_login`, `last_active`, `generatedAt`) is written
+ *  with an explicit offset; the automation engine's `lastRunAt` is NOT, so it is
+ *  rendered verbatim instead. */
+function ago(stamp: string): string {
+  if (!stamp) return "never";
+  const t = Date.parse(stamp.includes("T") ? stamp : stamp.replace(" ", "T"));
+  if (Number.isNaN(t)) return stamp;
+  const mins = Math.floor((Date.now() - t) / 60000);
+  if (mins < 2) return "just now";
+  if (mins < 60) return `${mins} minutes ago`;
+  const hours = Math.floor(mins / 60);
+  if (hours < 24) return `${hours} hour${hours === 1 ? "" : "s"} ago`;
+  const days = Math.floor(hours / 24);
+  if (days < 60) return `${days} day${days === 1 ? "" : "s"} ago`;
+  return `${Math.floor(days / 30)} months ago`;
+}
+
+type DrillKind = "users" | "databases" | "connectors" | "automations";
+
+const DRILL_NOUN: Record<DrillKind, string> = {
+  users: "People",
+  databases: "Databases",
+  connectors: "Data sources",
+  automations: "Automations",
+};
+
+/** The loading shape — a skeleton, not a spinner (DESIGN.md §4). */
+function Skeleton({ rows = 3 }: { rows?: number }) {
+  return (
+    <div className="padmin-skel" aria-hidden="true">
+      {Array.from({ length: rows }, (_, i) => (
+        <div key={i} className="padmin-skel-row" />
+      ))}
+    </div>
+  );
+}
+
+// --- the pane ---------------------------------------------------------------
+
+export function AdminPane({ user }: { user: { username: string; name: string; role: string } }) {
+  const [ov, setOv] = useState<Overview | null>(null);
+  const [err, setErr] = useState("");
+  const [fleet, setFleet] = useState<{ rows: AutomationRow[]; cost: FleetCost } | null>(null);
+
+  const [drill, setDrill] = useState<{ kind: DrillKind; tenant: string } | null>(null);
+  const [drillRows, setDrillRows] = useState<unknown[] | null>(null);
+  const [drillNote, setDrillNote] = useState("");
+
+  const [aws, setAws] = useState<{ text: string; note: string; available: boolean } | null>(null);
+  // Wave 20 (R6): the releases panel. Loaded with the overview rather than on demand — it is
+  // two small Hub reads and the first question an operator opens this pane to answer.
+  const [rel, setRel] = useState<ReleasesPayload | null>(null);
+  const [awsBusy, setAwsBusy] = useState(false);
+
+  const load = useCallback(() => {
+    setOv(null);
+    void getOverview().then((r) => {
+      if (r.ok) {
+        setOv(r.data);
+        setErr("");
+      } else setErr(r.message);
+    });
+    void getAutomations().then((r) => {
+      if (r.ok) setFleet({ rows: r.data.automations, cost: r.data.cost });
+    });
+    void getReleases().then((r) => {
+      if (r.ok) setRel(r.data);
+    });
+  }, []);
+  useEffect(load, [load]);
+
+  const openDrill = useCallback((kind: DrillKind, tenant: string) => {
+    setDrill({ kind, tenant });
+    setDrillRows(null);
+    setDrillNote("");
+    const fetcher =
+      kind === "users"
+        ? getUsers
+        : kind === "databases"
+          ? getDatabases
+          : kind === "connectors"
+            ? getConnectors
+            : getAutomations;
+    void fetcher(tenant || undefined).then((r) => {
+      if (!r.ok) {
+        setDrillRows([]);
+        setDrillNote(r.message);
+        return;
+      }
+      const d = r.data as Record<string, unknown>;
+      setDrillRows((d[kind] as unknown[]) ?? []);
+      // The server's own honest note travels with the rows rather than being
+      // re-invented here: it is the one that knows WHY a tenant is missing.
+      const errors = (d.errors as Record<string, string>) ?? {};
+      const words = Object.entries(errors).map(([t, e]) => `${t}: ${e}`);
+      setDrillNote(
+        [typeof d.stampsNote === "string" ? d.stampsNote : "", ...words]
+          .filter(Boolean)
+          .join(" · ")
+      );
+    });
+  }, []);
+
+  const loadAws = useCallback(() => {
+    setAwsBusy(true);
+    void getAws(7).then((r) => {
+      setAwsBusy(false);
+      if (r.ok) setAws(r.data.report);
+      else setAws({ text: "", note: r.message, available: false });
+    });
+  }, []);
+
+  return (
+    <div className="set-pane">
+      <h3 className="set-h">Loopable admin</h3>
+      <p className="set-help set-pane-intro">
+        Every workspace on the platform, signed in as {user.name}. Counts open the rows they were
+        computed from; anything that could not be read shows a dash and says why, rather than a
+        zero.
+      </p>
+      {err ? <p className="set-error">{err}</p> : null}
+
+      {!ov ? (
+        <Skeleton rows={4} />
+      ) : (
+        <>
+          <div className="padmin-totals">
+            <Total label="Workspaces" value={int(ov.totals.tenants)} />
+            <Total label="People" value={int(ov.totals.users)} />
+            <Total label="Databases" value={int(ov.totals.databases)} />
+            <Total label="Records" value={int(ov.totals.rows)} />
+            <Total
+              label="Automation cost"
+              value={fleet ? `$${fleet.cost.usd.toFixed(2)}` : "—"}
+              hint={fleet?.cost.basis}
+            />
+          </div>
+          {ov.totals.unknownTenants > 0 ? (
+            <p className="set-help padmin-caveat">
+              {ov.totals.unknownTenants} workspace
+              {ov.totals.unknownTenants === 1 ? "" : "s"} could not be read, so the totals above
+              exclude {ov.totals.unknownTenants === 1 ? "it" : "them"}.
+            </p>
+          ) : null}
+
+          <div className="padmin-tablewrap">
+            <table className="padmin-table">
+              <thead>
+                <tr>
+                  <th>Workspace</th>
+                  <th>Storage</th>
+                  <th className="padmin-num">People</th>
+                  <th className="padmin-num">Databases</th>
+                  <th className="padmin-num">Records</th>
+                  <th className="padmin-num">Sources</th>
+                  <th className="padmin-num">Automations</th>
+                </tr>
+              </thead>
+              <tbody>
+                {ov.tenants.map((t) => (
+                  <tr key={t.slug}>
+                    <td>
+                      <span className="padmin-name">{t.name}</span>
+                      <span className="padmin-meta">
+                        {t.slug}
+                        {t.status !== "active" ? ` · ${t.status}` : ""}
+                        {t.errors && t.errors.length ? ` · ${t.errors[0]}` : ""}
+                      </span>
+                    </td>
+                    <td>
+                      <span className="padmin-meta">
+                        {t.storeRepo && t.storeRepo.includes("/")
+                          ? "own repository"
+                          : t.storePrefix
+                            ? "shared repository"
+                            : "tenant #0 repository"}
+                        {t.keychainLocked ? " · keychain locked" : ""}
+                      </span>
+                    </td>
+                    <DrillCell
+                      n={t.users}
+                      onOpen={() => openDrill("users", t.slug)}
+                      title={`${t.admins} administrator${t.admins === 1 ? "" : "s"}`}
+                    />
+                    <DrillCell
+                      n={t.databases}
+                      onOpen={() => openDrill("databases", t.slug)}
+                      why={t.errors?.[0]}
+                    />
+                    <DrillCell
+                      n={t.rows}
+                      onOpen={() => openDrill("databases", t.slug)}
+                      why={t.errors?.[0]}
+                    />
+                    <DrillCell
+                      n={t.connectors}
+                      onOpen={() => openDrill("connectors", t.slug)}
+                      why={t.errors?.[0]}
+                      title={
+                        t.connectorsPaused ? `${t.connectorsPaused} paused` : "none paused"
+                      }
+                    />
+                    <DrillCell
+                      n={t.automations}
+                      onOpen={() => openDrill("automations", t.slug)}
+                      why={t.errors?.[0]}
+                      title={
+                        t.automationsEnabled != null
+                          ? `${t.automationsEnabled} scheduled`
+                          : undefined
+                      }
+                    />
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+
+          <p className="set-help padmin-caveat">
+            Read {ago(ov.generatedAt)} in {ov.tookMs} ms.{" "}
+            {ov.totals.orphanUsers > 0
+              ? `${ov.totals.orphanUsers} account${
+                  ov.totals.orphanUsers === 1 ? "" : "s"
+                } belong to a workspace this deployment no longer knows. `
+              : ""}
+            <button type="button" className="padmin-link" onClick={load}>
+              Refresh
+            </button>
+          </p>
+
+          {drill ? (
+            <section className="padmin-drill">
+              <div className="padmin-drill-head">
+                <h4 className="padmin-h4">
+                  {DRILL_NOUN[drill.kind]}
+                  {drill.tenant ? `: ${drill.tenant}` : ""}
+                </h4>
+                <button type="button" className="padmin-link" onClick={() => setDrill(null)}>
+                  Close
+                </button>
+              </div>
+              {drillRows === null ? (
+                <Skeleton rows={2} />
+              ) : drillRows.length === 0 ? (
+                <p className="set-help">Nothing here yet.</p>
+              ) : (
+                <DrillTable kind={drill.kind} rows={drillRows} />
+              )}
+              {drillNote ? <p className="set-help padmin-caveat">{drillNote}</p> : null}
+            </section>
+          ) : null}
+
+          {fleet ? (
+            <section className="padmin-block">
+              {/* Named for what it SHOWS. The fleet's rows live one level down,
+                  behind the Automations count — this section is the cost and the
+                  reasoning behind it, so calling it "fleet" would promise a
+                  table that is deliberately not here. */}
+              <h4 className="padmin-h4">Automation cost</h4>
+              <p className="set-help">
+                {fleet.rows.filter((a) => a.enabled).length} scheduled of {fleet.rows.length}
+                {fleet.cost.fleetRunsPerDay
+                  ? `, about ${fleet.cost.fleetRunsPerDay} runs a day`
+                  : ""}
+                {fleet.cost.unknownCadence
+                  ? ` (${fleet.cost.unknownCadence} on a custom cadence, not counted)`
+                  : ""}
+                . {fleet.cost.basis}
+              </p>
+            </section>
+          ) : null}
+
+          {/* ── Wave 20 (owner item 12 / R6): what is running where ──────────────────
+              READ-ONLY BY RULING. The operator sees both environments and every cut
+              release; moving one is a CLI command, printed below rather than wired to
+              a button, so no browser session can rewrite production. */}
+          <section className="padmin-block">
+            <h4 className="padmin-h4">Releases</h4>
+            {!rel ? (
+              <Skeleton rows={2} />
+            ) : (
+              <>
+                <table className="padmin-table">
+                  <thead>
+                    <tr>
+                      <th>Environment</th>
+                      <th>Version</th>
+                      <th>Stage</th>
+                      <th>Space</th>
+                    </tr>
+                  </thead>
+                  <tbody>
+                    {rel.environments.map((e) => (
+                      <tr key={e.env}>
+                        <td>{e.env === "live" ? "Live (pinned)" : "Staging (follows the tree)"}</td>
+                        {/* ⚠ An unreadable version is a NOTE, never a blank. A blank cell in a
+                            column headed "Version" reads as "nothing is deployed", which about a
+                            production environment is the worst available way to be wrong. */}
+                        <td>{e.version || <span className="set-help">{e.note || "unknown"}</span>}</td>
+                        <td>{e.stage || "—"}</td>
+                        {/* The Space ID as TEXT, not a link: the server deliberately builds no
+                            URL (portability C1 — a host literal in runtime code hard-codes the
+                            current host into a process designed to move). */}
+                        <td>{e.space}</td>
+                      </tr>
+                    ))}
+                  </tbody>
+                </table>
+                {rel.releases.length ? (
+                  <table className="padmin-table">
+                    <thead>
+                      <tr>
+                        <th>Release</th>
+                        <th>Commit</th>
+                        <th>Cut</th>
+                        <th>What shipped</th>
+                      </tr>
+                    </thead>
+                    <tbody>
+                      {rel.releases.map((r) => (
+                        <tr key={r.version}>
+                          <td>{r.version}</td>
+                          <td>{r.sha}</td>
+                          <td>{r.date}</td>
+                          <td>{r.subject}</td>
+                        </tr>
+                      ))}
+                    </tbody>
+                  </table>
+                ) : (
+                  <p className="set-help">
+                    No tagged releases were readable from either Space.
+                  </p>
+                )}
+                <p className="set-help">
+                  To move Live to another version, or roll it back, run:{" "}
+                  <code>{rel.promote}</code>
+                </p>
+              </>
+            )}
+          </section>
+
+          <section className="padmin-block">
+            <h4 className="padmin-h4">AWS cron</h4>
+            {!aws ? (
+              <p className="set-help">
+                The external tick that wakes this app on schedule. Reading its usage runs a live
+                CloudWatch query and takes a few seconds.{" "}
+                <button
+                  type="button"
+                  className="padmin-link"
+                  onClick={loadAws}
+                  disabled={awsBusy}
+                >
+                  {awsBusy ? "Reading…" : "Check usage"}
+                </button>
+              </p>
+            ) : aws.available ? (
+              <pre className="padmin-pre">{aws.text}</pre>
+            ) : (
+              <p className="set-help">{aws.note}</p>
+            )}
+          </section>
+        </>
+      )}
+    </div>
+  );
+}
+
+function Total({ label, value, hint }: { label: string; value: string; hint?: string }) {
+  // A tooltip nobody can see is a tooltip nobody reads: the label carries a
+  // dotted underline exactly when there is something behind it.
+  return (
+    <div className={"padmin-total" + (hint ? " has-hint" : "")} title={hint || undefined}>
+      <span className="padmin-total-label">{label}</span>
+      <span className="padmin-total-value">{value}</span>
+    </div>
+  );
+}
+
+/** A numeric cell that opens its own rows. Unknown counts are not clickable —
+ *  there is nothing to drill INTO when the read failed, and a button that opens
+ *  an empty table would read as "none". */
+function DrillCell({
+  n,
+  onOpen,
+  why,
+  title,
+}: {
+  n: number | null | undefined;
+  onOpen: () => void;
+  why?: string;
+  title?: string;
+}) {
+  if (n === null || n === undefined)
+    return (
+      <td className="padmin-num">
+        <Count n={n} why={why} />
+      </td>
+    );
+  return (
+    <td className="padmin-num">
+      <button type="button" className="padmin-drill-btn" onClick={onOpen} title={title}>
+        {int(n)}
+      </button>
+    </td>
+  );
+}
+
+function DrillTable({ kind, rows }: { kind: DrillKind; rows: unknown[] }) {
+  if (kind === "users") {
+    const rs = rows as PlatformUser[];
+    return (
+      <div className="padmin-tablewrap">
+        <table className="padmin-table">
+          <thead>
+            <tr>
+              <th>Person</th>
+              <th>Workspace</th>
+              <th>Role</th>
+              <th>Last sign-in</th>
+              <th>Last active</th>
+            </tr>
+          </thead>
+          <tbody>
+            {rs.map((u) => (
+              <tr key={`${u.tenant}/${u.username}`}>
+                <td>
+                  <span className="padmin-name">{u.name}</span>
+                  <span className="padmin-meta">
+                    {u.username}
+                    {u.email ? ` · ${u.email}` : ""}
+                    {u.active ? "" : " · deactivated"}
+                  </span>
+                </td>
+                <td>{u.tenant}</td>
+                <td>
+                  {u.role}
+                  {u.platformAdmin ? " · platform" : ""}
+                </td>
+                <td>{ago(u.lastLogin)}</td>
+                <td>{ago(u.lastActive)}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    );
+  }
+  if (kind === "databases") {
+    const rs = rows as DatabaseRow[];
+    return (
+      <div className="padmin-tablewrap">
+        <table className="padmin-table">
+          <thead>
+            <tr>
+              <th>Database</th>
+              <th>Workspace</th>
+              <th>Built from</th>
+              <th className="padmin-num">Fields</th>
+              <th className="padmin-num">Records</th>
+            </tr>
+          </thead>
+          <tbody>
+            {rs.map((d) => (
+              <tr key={`${d.tenant}/${d.key}`}>
+                <td>
+                  <span className="padmin-name">{d.label}</span>
+                  <span className="padmin-meta">
+                    {d.key}
+                    {d.createdBy ? ` · ${d.createdBy}` : ""}
+                  </span>
+                </td>
+                <td>{d.tenant}</td>
+                <td>{d.source}</td>
+                <td className="padmin-num">{int(d.fields)}</td>
+                <td className="padmin-num">{int(d.rowCount)}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    );
+  }
+  if (kind === "connectors") {
+    const rs = rows as ConnectorRow[];
+    return (
+      <div className="padmin-tablewrap">
+        <table className="padmin-table">
+          <thead>
+            <tr>
+              <th>Source</th>
+              <th>Workspace</th>
+              <th>Kind</th>
+              <th>Status</th>
+            </tr>
+          </thead>
+          <tbody>
+            {rs.map((c) => (
+              <tr key={`${c.tenant}/${c.key}`}>
+                <td>
+                  <span className="padmin-name">{c.label}</span>
+                  <span className="padmin-meta">
+                    {c.source === "env" ? "environment credentials" : "keychain"}
+                  </span>
+                </td>
+                <td>{c.tenant}</td>
+                <td>{c.type}</td>
+                <td>
+                  <span
+                    className={
+                      "padmin-dot " +
+                      (c.paused ? "is-paused" : c.active ? "is-live" : "is-idle")
+                    }
+                  />
+                  {c.paused ? "paused" : c.active ? "serving" : "stored"}
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    );
+  }
+  const rs = rows as AutomationRow[];
+  return (
+    <div className="padmin-tablewrap">
+      <table className="padmin-table">
+        <thead>
+          <tr>
+            <th>Automation</th>
+            <th>Workspace</th>
+            <th>Schedule</th>
+            <th className="padmin-num">Runs a day</th>
+            <th>Last run</th>
+          </tr>
+        </thead>
+        <tbody>
+          {rs.map((a) => (
+            <tr key={`${a.tenant}/${a.id}`}>
+              <td>
+                <span className="padmin-name">{a.name}</span>
+                <span className="padmin-meta">
+                  {a.kind}
+                  {a.failedRetained
+                    ? ` · ${a.failedRetained} of the last ${a.runsRetained} runs failed`
+                    : ""}
+                </span>
+              </td>
+              <td>{a.tenant}</td>
+              <td>{a.enabled ? a.cron || "scheduled" : "paused"}</td>
+              <td className="padmin-num">
+                {a.enabled ? (a.runsPerDay === null ? "custom" : a.runsPerDay) : "—"}
+              </td>
+              <td>
+                <span
+                  className={
+                    "padmin-dot " +
+                    (a.state === "error" ? "is-error" : a.state === "ok" ? "is-live" : "is-idle")
+                  }
+                />
+                {/* Verbatim, not relative: the engine writes this stamp with no
+                    zone (`automation_engine._iso()` is naive local-to-container),
+                    so "x hours ago" would be wrong by the viewer's offset. */}
+                {a.lastRunAt ? a.lastRunAt.replace("T", " ") : "never"}
+              </td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+export default AdminPane;

web/src/settings/PermsEditor.tsx

@@ -393,7 +393,7 @@ export function PermsEditor({
         // to believe an account is restricted when it is not.
         if (p.isAdmin) {
           notes.push(
-            "is an administrator — the rules will be stored but stay inert until the account is changed to Member"
+            "is an administrator, so the rules will be stored but stay inert until the account is changed to Member"
           );
         }
         // ⚠ A COPY MIGRATES THE TARGET. An un-migrated record runs under the
@@ -404,7 +404,7 @@ export function PermsEditor({
         // exotic one.
         if (!p.migrated) {
           notes.push(
-            "still uses the previous access model — this write moves it to the per-module model"
+            "still uses the previous access model, and this write moves it to the per-module model"
           );
         }
         // The same disclosure this page already makes for the account it has
@@ -412,7 +412,7 @@ export function PermsEditor({
         // does it to somebody the admin never opened.
         if (p.orphanModules.length) {
           notes.push(
-            `has rules for ${p.orphanModules.join(", ")}, which this deployment no longer offers — those are removed`
+            `has rules for ${p.orphanModules.join(", ")}, which this deployment no longer offers, so those are removed`
           );
         }
         // ⚠ DISCLOSED BEFORE THE WRITE, not only after it. `runCopy` also reports
@@ -489,7 +489,7 @@ export function PermsEditor({
       if (dropped.size) {
         const list = nameList([...dropped].sort());
         problems.push(
-          `${list} could not be copied — the accounts you picked do not offer ${dropped.size === 1 ? "it" : "them"}.`
+          `${list} could not be copied. The accounts you picked do not offer ${dropped.size === 1 ? "it" : "them"}.`
         );
       }
       if (problems.length) setError(problems.join(" "));
@@ -687,7 +687,7 @@ export function PermsEditor({
                 disabled={!canCopy || busy}
                 title={
                   dirty
-                    ? "Save this account's access first — a copy sends what is stored, not what is on screen."
+                    ? "Save this account's access first. A copy sends what is stored, not what is on screen."
                     : undefined
                 }
                 onClick={() => openCopy({ kind: "all" })}
@@ -709,7 +709,7 @@ export function PermsEditor({
               reader who thought to hover. */}
           {dirty && copyTargets?.length ? (
             <p className="set-help set-copy-why">
-              Copying is unavailable while there are unsaved changes — a copy sends
+              Copying is unavailable while there are unsaved changes. A copy sends
               what is stored, not what is on screen.
             </p>
           ) : null}

web/src/settings/permsModel.ts

@@ -53,10 +53,22 @@ export type SettingsSection =
   // Wave 18 (C7): the tenant's credential store and its data-source status board.
   | "keychains"
   | "connectors"
-  /** EXIT-6: the statement-of-account sender, ported off `app.py` when Streamlit
-   *  was deleted. Admin-only for the same reason the Streamlit section was —
-   *  it is THE one sanctioned Odoo writer in the product. */
-  | "statements"
+  /* ⛔⛔ `"statements"` LEFT THIS UNION (wave 35 · T38, owner item 14 / ruling R10).
+   *
+   * The statement sender is an AGENT now: `Agents -> Monthly statements`, where a scheduled run
+   * ASSEMBLES a batch and parks it, and a person releases it with a click. It was here since
+   * EXIT-6, ported off `app.py`.
+   *
+   * ⚠ THE SEND DOOR DID NOT MOVE AND DID NOT WEAKEN. `routes_statements` still holds it, still
+   * behind `admin_gate` + the Royal-Imports tenant gate, still calling
+   * `collections_send.queue_statement` whose SAFE_MODE allow-list lives in the DATA LAYER. What
+   * left is one of two front doors onto it, not a capability.
+   *
+   * ⛔ AND A STORED PREFERENCE NAMING IT DEGRADES RATHER THAN BREAKING — see `RETIRED_SECTIONS`
+   * below. Dropping a union member is a TYPE change; the values people have already saved are
+   * data, and refusing one would strand somebody on a blank pane forever (D-65's lesson: a
+   * refused stored key locks the door you need in order to fix it).
+   */
   /**
    * Wave 19 (R3 / contract C2): the Loopable admin plane — the cross-TENANT
    * console, visible only to a `platform_admin` account.
@@ -72,6 +84,21 @@ export type SettingsSection =
    */
   | "padmin";
 
+/**
+ * ⭐⭐ WAVE 35 · T38 — SECTIONS THAT ONCE EXISTED AND NO LONGER DO.
+ *
+ * ⛔ A LIST RATHER THAN A DELETION, because a stored value outlives the type that described it.
+ * `SettingsSection` is compile-time; the section somebody last had open is DATA, and a person who
+ * was in Statements when this shipped must land somewhere real. Without this they would restore
+ * into a section no branch renders — a blank modal, which reads as a broken product rather than as
+ * a room that moved.
+ *
+ * ⚠ THE ENTRY STAYS EVEN AFTER NOBODY COULD PLAUSIBLY HOLD IT. It costs one string and it is the
+ * only record, in code, that the value was ever legal — deleting it is how the next reader
+ * "cleans up" a degrade path and re-opens the blank pane.
+ */
+export const RETIRED_SECTIONS: readonly string[] = ["statements"];
+
 /**
  * A non-admin never LANDS on the users pane — and therefore never reaches the
  * permission editor, which lives inside it.
@@ -84,8 +111,22 @@ export type SettingsSection =
  * inline ternary cannot have a negative control, and "the pane a non-admin gets
  * bounced out of" is exactly the kind of rule that gets refactored away by
  * someone who does not know it is load-bearing.
+ *
+ * ⭐ WAVE 35 · T38 — it is ALSO where a RETIRED section is degraded, and the two rules live in one
+ * function on purpose: both answer "this section is not reachable, so where does this person
+ * actually land", and splitting them would give the caller two chances to forget one.
  */
-export function reachableSection(section: SettingsSection, admin: boolean): SettingsSection {
+export function reachableSection(
+  /* ⚠ WIDER THAN `SettingsSection` ON PURPOSE. The caller passes a value that may have been
+     STORED under an older build, so typing this parameter to the current union would make the
+     retired case unrepresentable — and therefore unhandleable — at exactly the callsite whose job
+     is to handle it. */
+  section: SettingsSection | string,
+  admin: boolean,
+): SettingsSection {
+  // ⛔ FIRST, before the admin rule: a retired section has no admin question to answer, and
+  // `adminOnly` below would read `false` for it and hand back a section nothing renders.
+  if (RETIRED_SECTIONS.includes(String(section))) return "account";
   // ⭐⭐ WAVE 32 · R4 — `keychains` AND `connectors` LEFT THIS LIST, and the ruling is the reason.
   //
   // Wave 18 (C7) put them here because "every control inside them would 403 a member" — which was
@@ -107,11 +148,10 @@ export function reachableSection(section: SettingsSection, admin: boolean): Sett
     // that the routes refuse — this list is what stops the EMPTY FRAME, and a new
     // admin room added to the rail without a line here is the defect this
     // function's header describes.
-    section === "agents" ||
-    // EXIT-6: every control in the statements room would 403 a member, and the
-    // one at the bottom sends customer email. It belongs in this list twice over.
-    section === "statements";
-  return adminOnly && !admin ? "account" : section;
+    section === "agents";
+  // ⚠ The cast is safe BECAUSE of the retired-section guard at the top: every value reaching here
+  // is either a current member of the union or has already been degraded to "account".
+  return adminOnly && !admin ? "account" : (section as SettingsSection);
 }
 
 // --- the wire (C-PERM) ------------------------------------------------------

web/src/shell/NavExtras.tsx

@@ -1,995 +1,986 @@
-// ---------------------------------------------------------------------------
-// shell/NavExtras.tsx — C-SCHEMA (wave 2026-08-02): the database list's
-// three-dots menu, folder heads, and the schema drawer.
-//
-// Kept out of Shell.tsx so the shell's frame stays readable: Shell owns the
-// STATE (prefs, open folders, which schema is open) and the save round-trip;
-// these components own only their own popover/drawer chrome. Menus are
-// position:fixed against the trigger — the rail scrolls and clips, so an
-// absolutely-positioned child could never escape it (the same lesson as the
-// collapsed-rail tooltip).
-// ---------------------------------------------------------------------------
-
-import { useEffect, useRef, useState } from "react";
-import type { ReactNode } from "react";
-import { fetchSchema, importantBadge } from "./nav";
-import type { NavFolder, NavImportant, SchemaPayload, TableFootprint } from "./nav";
-// ⚠ WAVE 19 R8 / C1 — IMPORTED, NEVER REDEFINED, and the contract says so in as
-// many words ("Shapes/tones = the grid's existing vocabulary verbatim (12
-// shapes, 5 tones); B imports, never redefines"). A second copy of this
-// vocabulary in the shell is a whitelist that can drift by one member from the
-// one the host validates against — and a tone the server does not recognise
-// degrades to the default, so the user's choice disappears on reload with
-// nothing on screen to say why. These are READ-ONLY imports across the session
-// fence: `customer-grid/**` is another session's tree this wave (HARD RULE 3).
-import { FolderMark } from "../customer-grid/icons";
-import { FOLDER_SHAPE_LABELS, FOLDER_TONE_LABELS } from "../customer-grid/iconShapes";
-import {
-  DEFAULT_FOLDER_SHAPE,
-  DEFAULT_FOLDER_TONE,
-  FOLDER_SHAPES,
-  FOLDER_TONES,
-} from "../customer-grid/types";
-import type { FolderIcon } from "../customer-grid/types";
-import "./navExtras.css";
-
-/**
- * WAVE 21 item 12 (ruling R11) — HORIZONTAL, and it is the same three dots turned
- * 90°, not a different mark.
- *
- * The rail and the views list are read as one surface, and they were drawing the
- * "there is a menu here" affordance two different ways: this glyph stacked its
- * circles (cx fixed, cy walking) while `ViewSidebar`'s row buttons have always
- * rendered three MIDDLE DOTs on the baseline. Same promise, two pictures — the
- * thing R11 names. Only the axis moves: radius, viewBox and the 14px box in
- * `navExtras.css` are untouched, so the hit target and the optical weight are
- * exactly what shipped.
- */
-function DotsIcon() {
-  return (
-    <svg viewBox="0 0 16 16" aria-hidden="true" className="shell-dots-icon">
-      <circle cx="3.2" cy="8" r="1.35" />
-      <circle cx="8" cy="8" r="1.35" />
-      <circle cx="12.8" cy="8" r="1.35" />
-    </svg>
-  );
-}
-
-function FolderIcon() {
-  return (
-    <svg viewBox="0 0 16 16" aria-hidden="true" className="shell-nav-icon">
-      <path d="M2.2 4.4c0-.66.54-1.2 1.2-1.2h3l1.4 1.6h4.8c.66 0 1.2.54 1.2 1.2v6c0 .66-.54 1.2-1.2 1.2H3.4c-.66 0-1.2-.54-1.2-1.2z" />
-    </svg>
-  );
-}
-
-/** A fixed-position popover anchored to a trigger rect, closed on outside
- *  click or Escape. Small on purpose — the shell does not import the grid's
- *  Popover, so the two chrome trees stay independently deletable. */
-function useMenu() {
-  const [at, setAt] = useState<{ x: number; y: number } | null>(null);
-  const ref = useRef<HTMLDivElement>(null);
-  useEffect(() => {
-    if (!at) return;
-    const onDown = (e: MouseEvent) => {
-      if (ref.current && !ref.current.contains(e.target as Node)) setAt(null);
-    };
-    const onKey = (e: KeyboardEvent) => {
-      if (e.key === "Escape") setAt(null);
-    };
-    document.addEventListener("mousedown", onDown, true);
-    document.addEventListener("keydown", onKey, true);
-    return () => {
-      document.removeEventListener("mousedown", onDown, true);
-      document.removeEventListener("keydown", onKey, true);
-    };
-  }, [at]);
-  const openFrom = (el: HTMLElement) => {
-    const r = el.getBoundingClientRect();
-    setAt({ x: Math.round(r.right + 4), y: Math.round(r.top) });
-  };
-  return { at, ref, openFrom, close: () => setAt(null) };
-}
-
-function MenuShell({
-  at,
-  menuRef,
-  wide,
-  children,
-}: {
-  at: { x: number; y: number };
-  menuRef: React.RefObject<HTMLDivElement>;
-  /** WAVE 21 item 6 — the delete confirm needs prose width; a menu of one-line
-   *  actions does not. The CLAMP moves with the class, because a wider panel
-   *  clamped at the narrow width spills off the right edge on exactly the rows
-   *  furthest from it. */
-  wide?: boolean;
-  children: ReactNode;
-}) {
-  // Clamp to the viewport so a row near the bottom does not spill the menu off it.
-  const width = wide ? 320 : 248;
-  const style = {
-    left: Math.min(at.x, Math.max(8, window.innerWidth - width)),
-    top: Math.min(at.y, Math.max(8, window.innerHeight - 260)),
-  };
-  return (
-    <div
-      className={"shell-navmenu" + (wide ? " is-wide" : "")}
-      style={style}
-      ref={menuRef}
-      role="menu"
-    >
-      {children}
-    </div>
-  );
-}
-
-/**
- * WAVE 19 R8 / C1 — the 12x5 swatch picker, the grid's own pattern
- * (`ViewSidebar.tsx`'s folder form) rendered inside the nav's popover.
- *
- * TWO ROWS, NOT A GRID OF 60. Shape and tone are independent choices, so the
- * shape row previews in the CURRENT tone and the tone row previews in the
- * CURRENT shape — every swatch shows what that one click would actually
- * produce, which is why picking is one glance rather than a search.
- */
-function IconPicker({
-  value,
-  onPick,
-  onClear,
-}: {
-  value?: FolderIcon;
-  onPick: (icon: FolderIcon) => void;
-  /** Absent ⇒ nothing to clear (the row is already on the default mark). */
-  onClear?: () => void;
-}) {
-  const shape = value?.shape ?? DEFAULT_FOLDER_SHAPE;
-  const tone = value?.tone ?? DEFAULT_FOLDER_TONE;
-  return (
-    <div className="shell-navmenu-pick" role="group" aria-label="Database icon">
-      <div className="shell-navmenu-pickrow">
-        {FOLDER_SHAPES.map((s) => (
-          <button
-            key={s}
-            type="button"
-            className={"shell-navmenu-swatch" + (value && shape === s ? " is-on" : "")}
-            aria-pressed={!!value && shape === s}
-            aria-label={FOLDER_SHAPE_LABELS[s]}
-            title={FOLDER_SHAPE_LABELS[s]}
-            onClick={() => onPick({ shape: s, tone })}
-          >
-            <FolderMark icon={{ shape: s, tone }} size={15} />
-          </button>
-        ))}
-      </div>
-      <div className="shell-navmenu-pickrow">
-        {FOLDER_TONES.map((t) => (
-          <button
-            key={t}
-            type="button"
-            className={"shell-navmenu-swatch" + (value && tone === t ? " is-on" : "")}
-            aria-pressed={!!value && tone === t}
-            aria-label={FOLDER_TONE_LABELS[t]}
-            title={FOLDER_TONE_LABELS[t]}
-            onClick={() => onPick({ shape, tone: t })}
-          >
-            <FolderMark icon={{ shape, tone: t }} size={15} />
-          </button>
-        ))}
-      </div>
-      {/* ⛔ AN EXPLICIT WAY BACK, because this picker deliberately does NOT copy
-          `cleanFolderIcon`'s "a fully-default icon is no icon" rule. That rule is
-          right for a FOLDER, whose default mark IS the folder shape; a database's
-          default mark is the cylinder, so dropping folder+neutral would answer a
-          user who picked "Folder" with a picture of a database — the silent
-          disappearance the tone whitelist's own note warns about. Absent = the
-          cylinder, chosen = exactly what was chosen, and clearing is a click that
-          says what it does. */}
-      {onClear ? (
-        <button type="button" className="shell-navmenu-item is-quiet" onClick={onClear}>
-          Use the default icon
-        </button>
-      ) : null}
-    </div>
-  );
-}
-
-export function RowMenu({
-  entryLabel,
-  canSchema,
-  onSchema,
-  canRename,
-  onRename,
-  canIcon,
-  icon,
-  onIcon,
-  onIconClear,
-  onShare,
-  canDelete,
-  onLoadFootprint,
-  onDelete,
-}: {
-  entryLabel: string;
-  canSchema: boolean;
-  onSchema: () => void;
-  /**
-   * WAVE 19 R8 — rename is `ut_*` (custom) DATABASES ONLY, and this flag is how
-   * the row says so. A built-in label is a compiled registry literal: renaming
-   * `customer_data` would mean the nav and every other reader of
-   * `core/registry.py` disagreeing about what the module is called. The SERVER
-   * refuses a `name` for a non-`ut_` key regardless (C1, fail-closed) — this
-   * only spares the user a control whose write would bounce.
-   */
-  canRename?: boolean;
-  onRename?: (name: string) => void;
-  /** Icons ride ALL databases (R8), unlike rename. */
-  canIcon?: boolean;
-  icon?: FolderIcon;
-  onIcon?: (icon: FolderIcon) => void;
-  onIconClear?: () => void;
-  /** WAVE 20 item 18 (C-SHARE) — open the access editor for THIS database.
-   *  Absent = the row does not offer sharing (a group head has nothing to share). */
-  onShare?: () => void;
-  /**
-   * ⭐ WAVE 21 item 6 (ruling R3, contract C3, wiring W-5) — may this session
-   * DELETE this database?
-   *
-   * ⛔ REQUIRED, NOT OPTIONAL, and that is the wave-20 lesson written into a type.
-   * Four features shipped dead behind 43 green gates because the prop that carried
-   * them across an ownership fence was `?`-marked: an unmounted optional prop is
-   * `undefined`, which reads as "the feature is off" and is indistinguishable from
-   * "the feature was never built". A required prop makes the unmounted case a
-   * COMPILE ERROR. The value is the server's (`NavPage.canDelete`), narrower than
-   * `manage` on purpose — see the note there.
-   */
-  canDelete: boolean;
-  /** What deleting would destroy. Resolves null when the server would not say —
-   *  the face then asks WITHOUT counts rather than inventing zeros. */
-  onLoadFootprint: () => Promise<TableFootprint | null>;
-  /** Do it. Resolves the server's own words on refusal, which the face shows in
-   *  place of the confirmation — a delete that failed must never look like one
-   *  that worked. */
-  onDelete: () => Promise<{ ok: boolean; error?: string }>;
-}) {
-  // Wave 14 C-NAVFOLD (ruling R10): the three-dots kept "View schema" ONLY.
-  // Wave 19 (R8/C1) adds Rename and Change icon — the first two things a
-  // database the USER made should have been able to do.
-  const { at, ref, openFrom, close } = useMenu();
-  // Which face the popover is showing. Reset on every open, so a menu that was
-  // left mid-rename does not reopen into somebody else's half-typed name.
-  const [mode, setMode] = useState<"menu" | "rename" | "icon" | "delete">("menu");
-  const [name, setName] = useState(entryLabel);
-  /**
-   * WAVE 21 item 6 — the delete face's own state. `footprint: undefined` means
-   * "still asking", `null` means "the server would not say" — two different
-   * things the face words differently, which is why it is not a plain object.
-   */
-  const [del, setDel] = useState<{
-    footprint?: TableFootprint | null;
-    busy: boolean;
-    error: string;
-  }>({ busy: false, error: "" });
-  const renameOn = !!canRename && !!onRename;
-  const iconOn = !!canIcon && !!onIcon;
-  if (!canSchema && !renameOn && !iconOn && !onShare && !canDelete) return null;
-  const submitRename = () => {
-    const clean = name.trim().replace(/\s+/g, " ");
-    if (clean && clean !== entryLabel) onRename?.(clean);
-    close();
-  };
-  /**
-   * ⚠ THE FOOTPRINT IS FETCHED WHEN THE FACE OPENS, NOT WHEN THE MENU DOES.
-   * Same reasoning as `PermsEditor.prepareCopy` ("the targets are fetched BEFORE
-   * the confirm"): the question has to name what is being destroyed, and a
-   * confirm written from the rail's own knowledge can only name the table. The
-   * cost is paid by the person who clicked Delete, never by everyone who opened
-   * a menu.
-   */
-  const openDelete = () => {
-    setDel({ busy: false, error: "" });
-    setMode("delete");
-    void onLoadFootprint().then((f) => setDel((cur) => ({ ...cur, footprint: f })));
-  };
-  const runDelete = () => {
-    setDel((cur) => ({ ...cur, busy: true, error: "" }));
-    void onDelete().then((r) => {
-      if (r.ok) {
-        close();
-        setDel({ busy: false, error: "" });
-        return;
-      }
-      // ⛔ THE MENU STAYS OPEN ON A REFUSAL. Closing it would leave a rail whose
-      // row is still there and no statement anywhere about why — which reads as
-      // "the click did nothing" and invites a second one.
-      setDel((cur) => ({ ...cur, busy: false, error: r.error || "It could not be deleted." }));
-    });
-  };
-  return (
-    <>
-      <button
-        type="button"
-        className="shell-dots"
-        aria-label={`Options for ${entryLabel}`}
-        aria-haspopup="menu"
-        onClick={(e) => {
-          e.preventDefault();
-          e.stopPropagation();
-          setMode("menu");
-          setName(entryLabel);
-          openFrom(e.currentTarget);
-        }}
-      >
-        <DotsIcon />
-      </button>
-      {at && (
-        <MenuShell at={at} menuRef={ref} wide={mode === "delete"}>
-          {mode === "delete" && canDelete ? (
-            <DeleteFace
-              entryLabel={entryLabel}
-              state={del}
-              onCancel={() => setMode("menu")}
-              onConfirm={runDelete}
-            />
-          ) : mode === "rename" && renameOn ? (
-            <form
-              className="shell-navmenu-form"
-              onSubmit={(e) => {
-                e.preventDefault();
-                submitRename();
-              }}
-            >
-              <input
-                className="shell-navmenu-input"
-                autoFocus
-                maxLength={60}
-                value={name}
-                aria-label={`Rename ${entryLabel}`}
-                onChange={(e) => setName(e.target.value)}
-                onKeyDown={(e) => {
-                  if (e.key === "Escape") close();
-                }}
-              />
-              <button type="submit" className="shell-navmenu-go" disabled={!name.trim()}>
-                Save
-              </button>
-            </form>
-          ) : mode === "icon" && iconOn ? (
-            /* ⚠ PICKING DOES NOT CLOSE THE MENU, and that is not a convenience.
-               Shape and tone are two independent choices: a picker that closed
-               on the first click would make "a green bolt" a two-open job, and
-               the second open would have to find the row again. Each click
-               commits (they are cheap and rare), the rail repaints from the
-               server, and the swatch marks follow what was actually stored — so
-               a refused write shows up as a mark that does not move, beside the
-               toast that says why. Clearing DOES close: "use the default" is a
-               terminal action, and the control removes itself once taken. */
-            <IconPicker
-              value={icon}
-              onPick={(next) => onIcon?.(next)}
-              {...(icon && onIconClear
-                ? {
-                    onClear: () => {
-                      close();
-                      onIconClear();
-                    },
-                  }
-                : {})}
-            />
-          ) : (
-            <>
-              {renameOn ? (
-                <button
-                  type="button"
-                  className="shell-navmenu-item"
-                  onClick={() => setMode("rename")}
-                >
-                  Rename
-                </button>
-              ) : null}
-              {iconOn ? (
-                <button
-                  type="button"
-                  className="shell-navmenu-item"
-                  onClick={() => setMode("icon")}
-                >
-                  Change icon
-                </button>
-              ) : null}
-              {canSchema ? (
-                <button
-                  type="button"
-                  className="shell-navmenu-item"
-                  onClick={() => {
-                    close();
-                    onSchema();
-                  }}
-                >
-                  View schema
-                </button>
-              ) : null}
-              {/* WAVE 20 item 18 (R10, C-SHARE) — a DATABASE shares with the same two
-                  roles a view does. Gated on `onShare`, which the Shell passes only
-                  for a real database row, so a family head or a hand-off link never
-                  offers to share something that has no id on the server. */}
-              {onShare ? (
-                <button
-                  type="button"
-                  className="shell-navmenu-item"
-                  onClick={() => {
-                    close();
-                    onShare();
-                  }}
-                >
-                  Share…
-                </button>
-              ) : null}
-              {/* ⭐ WAVE 21 item 6 (R3) — LAST, and the only destructive row in this
-                  menu. Gated on the server's `canDelete` alone: R3 scopes the verb to
-                  the CREATOR or an admin and refuses it outright for connector-backed
-                  databases, so a row that may not be deleted does not say so — it
-                  simply has nothing here to click. (An entry that explains why it is
-                  disabled is the right pattern for a thing you could earn; this one
-                  you cannot.) */}
-              {canDelete ? (
-                <button
-                  type="button"
-                  className="shell-navmenu-item is-danger"
-                  onClick={openDelete}
-                >
-                  Delete database…
-                </button>
-              ) : null}
-            </>
-          )}
-        </MenuShell>
-      )}
-    </>
-  );
-}
-
-/** One footprint line: "12 records", "1 view". Singular/plural is the whole of
- *  the formatting, because a count with the wrong noun reads as a bug in the
- *  count. */
-function countLine(n: number, one: string, many: string): string {
-  return `${n.toLocaleString()} ${n === 1 ? one : many}`;
-}
-
-/**
- * ⭐ WAVE 21 item 6 (R3, contract C3) — the confirm face: what deleting this
- * database destroys, stated before the button that does it.
- *
- * Shaped after `PermsEditor`'s confirm (`.set-confirm`, the strongest one this
- * codebase has) and not after a `window.confirm`: the browser dialog cannot say
- * anything specific, and a destructive question whose answer depends on facts
- * the asker has not been given is not really being asked.
- *
- * THREE STATES, worded differently on purpose:
- *   · footprint undefined — still asking the server. The button is disabled;
- *     confirming against numbers that have not arrived is confirming against
- *     nothing.
- *   · footprint null      — the server would not say. The question is put
- *     WITHOUT counts and says so. Inventing zeros here would be a specific,
- *     checkable claim about the user's data that nobody verified
- *     ([[no-unverifiable-aggregates]]).
- *   · footprint present   — every family it names, listed.
- *
- * ⚠ The automations line is the one that is NOT about destruction: C3 pauses
- * bound automations and stamps them "target deleted" rather than removing them,
- * so it names them (they will still be there afterwards, switched off) instead
- * of counting them away.
- */
-function DeleteFace({
-  entryLabel,
-  state,
-  onCancel,
-  onConfirm,
-}: {
-  entryLabel: string;
-  state: { footprint?: TableFootprint | null; busy: boolean; error: string };
-  onCancel: () => void;
-  onConfirm: () => void;
-}) {
-  const f = state.footprint;
-  const asking = f === undefined;
-  return (
-    <div className="shell-navconfirm" role="alertdialog" aria-modal="true"
-         aria-label={`Delete ${entryLabel}`}>
-      <h4 className="shell-navconfirm-h">Delete “{entryLabel}”?</h4>
-      {asking ? (
-        <p className="shell-navmenu-note">Checking what this database holds…</p>
-      ) : f === null ? (
-        <p className="shell-navmenu-note">
-          The server did not say what this database holds. Deleting it removes its records,
-          columns, views, comments, documents and sharing — permanently.
-        </p>
-      ) : (
-        <>
-          <p className="shell-navmenu-note">This cannot be undone. It permanently removes:</p>
-          <ul className="shell-navconfirm-list">
-            <li>{countLine(f.rows, "record", "records")}</li>
-            <li>{countLine(f.fields, "column", "columns")}</li>
-            <li>{countLine(f.views, "view", "views")}</li>
-            <li>
-              {countLine(f.sharedUsers, "person it is shared with",
-                         "people it is shared with")}
-            </li>
-          </ul>
-          {f.automations.length ? (
-            <p className="shell-navmenu-note">
-              {/* The VERB agrees too. "1 automation write here" was on screen before the
-                  first screenshot was read — the kind of thing every assertion passes. */}
-              {countLine(f.automations.length, "automation", "automations")}{" "}
-              {f.automations.length === 1 ? "writes" : "write"} here (
-              {f.automations.map((a) => a.name).join(", ")}) — {f.automations.length === 1
-                ? "it is"
-                : "they are"}{" "}
-              switched off, not deleted.
-            </p>
-          ) : null}
-        </>
-      )}
-      {state.error ? <p className="shell-navconfirm-err">{state.error}</p> : null}
-      <div className="shell-navconfirm-actions">
-        <button
-          type="button"
-          className="shell-navconfirm-go"
-          disabled={asking || state.busy}
-          onClick={onConfirm}
-        >
-          {state.busy ? "Deleting…" : "Delete"}
-        </button>
-        <button
-          type="button"
-          className="shell-navmenu-item is-quiet"
-          disabled={state.busy}
-          onClick={onCancel}
-        >
-          Keep it
-        </button>
-      </div>
-    </div>
-  );
-}
-
-function PlusIcon() {
-  return (
-    <svg viewBox="0 0 16 16" aria-hidden="true" className="shell-newthing-plus">
-      <path d="M8 3.4v9.2M3.4 8h9.2" />
-    </svg>
-  );
-}
-
-/**
- * Wave 14 C-NAVFOLD gave the list's bottom a quiet "+ New folder" (the Views-rail
- * precedent). WAVE 19 R11 made it "+ Create new…" with Folder | Database behind it.
- *
- * ⭐ WAVE 24 items 1 + 15a (ruling R9) — IT LEAVES THE RAIL AND BECOMES THE DATABASE
- * FLYOUT'S FOOTER, and it now carries the creatable things: New database ·
- * From a template · New folder. The flyout's three standalone `.shell-dbfly-make`
- * buttons are deleted; this one control replaces them.
- *
- * ⭐ WAVE 25 item 5a (ruling R8) — "AUTOMATED DATABASE" IS DELETED FROM THIS MENU,
- * so it carries THREE rows rather than four. R8: creating a database is one act and
- * pointing an automation at it is another, so the automation door lives on the
- * automation surface (its rail button and its empty state) and this menu stops
- * offering a database that is really an automation.
- * ⚠ `From a template` and `New folder` are UNTOUCHED — neither was ever an automated
- * database, and R9 keeps the template door working here (see the Home card's own note
- * on why exactly one of the two template doors is boarded).
- *
- * ⭐ AND IT IS ALSO ITEM 1's FIX, which is worth stating because it does not look
- * like a typography change. MEASURED on staging v12: the six rail rows all render
- * 13.8125px / w500 / Inter / rgb(32,36,51) — identical, `<a>` and `<button>` alike.
- * The ONE row in that band that differed was this one: `.shell-newfolder` declares
- * `--lp-fs-2xs` (12.75px) with no `font-weight` (so 400, inherited) and
- * `--lp-muted`. Taking it out of the rail is what makes the band read as one set;
- * nothing about the other six needed changing, and changing them would have been a
- * fix aimed at the wrong row.
- *
- * ⚠ THE `canFolder` GATE SURVIVES THE MOVE, and it has to. Wave 19's note: folders
- * over an empty list are an empty gesture, but a freshly provisioned tenant must
- * still be able to create a DATABASE. So with no entries the menu simply omits its
- * folder row rather than the control collapsing to a single-purpose button — inside
- * a panel there is room for a menu whatever the tenant has, which is the one thing
- * the 236px rail could not say.
- */
-export function CreateNewRow({
-  collapsed,
-  onExpand,
-  onCreateFolder,
-  onNewDatabase,
-  onFromTemplate,
-  canFolder,
-}: {
-  collapsed: boolean;
-  /** Collapsed, the row's one honest behaviour is "open the rail first". */
-  onExpand: () => void;
-  onCreateFolder: (name: string) => void;
-  onNewDatabase: () => void;
-  /** R9's second row — the template picker, over a database you already have. */
-  onFromTemplate: () => void;
-  /* ⛔ `onAutomated` LEFT WITH THE ROW IT OPENED (wave 25 item 5a, R8). */
-  /** Folders over an empty list are an empty gesture — the row is omitted, not the menu. */
-  canFolder: boolean;
-}) {
-  const { at, ref, openFrom, close } = useMenu();
-  const [naming, setNaming] = useState(false);
-  const [name, setName] = useState("");
-  const submit = () => {
-    const clean = name.trim().replace(/\s+/g, " ");
-    if (!clean) return;
-    onCreateFolder(clean);
-    setName("");
-    setNaming(false);
-  };
-  // ⛔ The 56px strip cannot hold a popover — the same reason the account row
-  // expands instead of opening its menu. Preserved from the button this row
-  // replaced, which did exactly this before opening its dialog.
-  //
-  // ⚠ WAVE 24: this branch is now UNREACHABLE FROM THE RAIL (the row is not there
-  // any more) but it is NOT dead — the flyout can be opened with the rail folded,
-  // and `collapsed` is still passed. Kept rather than deleted, because the panel's
-  // own note says the folded rail is exactly the state a user who opened it is most
-  // likely to be in.
-  if (collapsed) {
-    return (
-      <button
-        type="button"
-        className="shell-newfolder is-collapsed"
-        aria-label="Create new"
-        title="Create new"
-        onClick={onExpand}
-      >
-        <PlusIcon />
-      </button>
-    );
-  }
-  if (!naming) {
-    return (
-      <>
-        {/* THE LABEL NO LONGER FOLLOWS `canFolder`. In the rail it had to: with one
-            real branch, "+ Create new…" beside an `aria-haspopup` was a control
-            promising a choice it was not about to offer. In the footer there are
-            always at least two (database / template), so the menu is real whatever
-            the tenant has and the label can simply be true.
-            ⚠ TWO, NOT THREE, since R8 took the automated row (wave 25) — still a
-            genuine choice, which is the property the label depends on. If a future
-            ruling takes the template row as well, this reasoning inverts and the
-            control has to become a plain button again. */}
-        <button
-          type="button"
-          className="shell-newfolder"
-          aria-haspopup="menu"
-          onClick={(e) => openFrom(e.currentTarget)}
-        >
-          + Create new…
-        </button>
-        {at && (
-          <MenuShell at={at} menuRef={ref}>
-            <button
-              type="button"
-              className="shell-navmenu-item"
-              onClick={() => {
-                close();
-                onNewDatabase();
-              }}
-            >
-              New database
-            </button>
-            <button
-              type="button"
-              className="shell-navmenu-item"
-              onClick={() => {
-                close();
-                onFromTemplate();
-              }}
-            >
-              From a template
-            </button>
-            {canFolder ? (
-              <button
-                type="button"
-                className="shell-navmenu-item"
-                onClick={() => {
-                  close();
-                  setNaming(true);
-                }}
-              >
-                New folder
-              </button>
-            ) : null}
-          </MenuShell>
-        )}
-      </>
-    );
-  }
-  return (
-    <form
-      className="shell-navmenu-form shell-newfolder-form"
-      onSubmit={(e) => {
-        e.preventDefault();
-        submit();
-      }}
-    >
-      <input
-        className="shell-navmenu-input"
-        autoFocus
-        maxLength={40}
-        placeholder="Folder name"
-        value={name}
-        onChange={(e) => setName(e.target.value)}
-        onKeyDown={(e) => {
-          if (e.key === "Escape") {
-            setName("");
-            setNaming(false);
-          }
-        }}
-      />
-      <button type="submit" className="shell-navmenu-go" disabled={!name.trim()}>
-        Add
-      </button>
-    </form>
-  );
-}
-
-export function FolderHead({
-  folder,
-  count,
-  important,
-  open,
-  collapsed,
-  onToggle,
-  onRename,
-  onDelete,
-  isDrop,
-  dropProps,
-}: {
-  folder: NavFolder;
-  count: number;
-  /** ⭐⭐ WAVE 34 R1 / C1 — the SUM of this folder's members' mark-important numbers, set by
-   *  `foldNav` for a CLOSED folder only. Absent ⇒ draw nothing, which is both the open case and
-   *  the far more common "nobody marked anything in here" case. */
-  important?: NavImportant;
-  open: boolean;
-  collapsed: boolean;
-  onToggle: () => void;
-  onRename: (name: string) => void;
-  onDelete: () => void;
-  /** Wave 14 C-NAVFOLD — a database row is being dragged over this folder. */
-  isDrop?: boolean;
-  /** dragover/drop handlers, owned by the Shell (it holds the placement writer). */
-  dropProps?: React.HTMLAttributes<HTMLDivElement>;
-}) {
-  const { at, ref, openFrom, close } = useMenu();
-  const [renaming, setRenaming] = useState(false);
-  const [name, setName] = useState(folder.name);
-  const submit = () => {
-    const clean = name.trim().replace(/\s+/g, " ");
-    if (clean && clean !== folder.name) onRename(clean);
-    setRenaming(false);
-    close();
-  };
-  if (collapsed) {
-    // The folded rail has no room for folder chrome; members render flat and the
-    // folder simply waits for the rail to open again.
-    return null;
-  }
-  return (
-    <div
-      className={"shell-nav-folder" + (isDrop ? " is-drop" : "")}
-      {...(dropProps ?? {})}
-    >
-      {/* R3: no chevron — the Views-rail folder look. Open state reads from the members
-          below it (and aria-expanded says it aloud); the mark + bold label ARE the row. */}
-      <button
-        type="button"
-        className="shell-nav-folderbtn"
-        aria-expanded={open}
-        onClick={onToggle}
-      >
-        <FolderIcon />
-        <span className="shell-nav-label">{folder.name}</span>
-        <span className="shell-nav-foldercount">{count}</span>
-        {/* ⭐⭐ WAVE 34 R1 / C1 — *"a minimized folder should show the SUM of the numbers"*.
-            ⛔ BESIDE `count`, NEVER INSTEAD OF IT. `count` is how many BLOCKS the folder holds and
-            has meant that since wave 14; this is a sum of RECORDS. Collapsing them into one slot
-            would make the same numeral mean two things depending on whether anything inside had
-            ever been marked, which is worse than two numbers.
-            ⚠ The `title` is what tells them apart for a reader who sees two numerals; the glyph
-            cannot, and DESIGN.md's "never over-explain" law is about copy on screen, not about a
-            tooltip that only appears on hover. */}
-        {importantBadge(important) ? (
-          <span
-            className="shell-nav-count"
-            title={`${importantBadge(important)} in the important views inside this folder`}
-          >
-            {importantBadge(important)}
-          </span>
-        ) : null}
-      </button>
-      <button
-        type="button"
-        className="shell-dots"
-        aria-label={`Options for folder ${folder.name}`}
-        aria-haspopup="menu"
-        onClick={(e) => {
-          e.stopPropagation();
-          setName(folder.name);
-          setRenaming(false);
-          openFrom(e.currentTarget);
-        }}
-      >
-        <DotsIcon />
-      </button>
-      {at && (
-        <MenuShell at={at} menuRef={ref}>
-          {renaming ? (
-            <form
-              className="shell-navmenu-form"
-              onSubmit={(e) => {
-                e.preventDefault();
-                submit();
-              }}
-            >
-              <input
-                className="shell-navmenu-input"
-                autoFocus
-                maxLength={40}
-                value={name}
-                onChange={(e) => setName(e.target.value)}
-              />
-              <button type="submit" className="shell-navmenu-go" disabled={!name.trim()}>
-                Save
-              </button>
-            </form>
-          ) : (
-            <button
-              type="button"
-              className="shell-navmenu-item"
-              onClick={() => setRenaming(true)}
-            >
-              Rename folder
-            </button>
-          )}
-          <button
-            type="button"
-            className="shell-navmenu-item is-danger"
-            onClick={() => {
-              close();
-              onDelete();
-            }}
-          >
-            Delete folder
-          </button>
-        </MenuShell>
-      )}
-    </div>
-  );
-}
-
-export function SchemaDrawer({
-  schemaKey,
-  onClose,
-}: {
-  schemaKey: string;
-  onClose: () => void;
-}) {
-  const [state, setState] = useState<
-    { phase: "loading" } | { phase: "ready"; schema: SchemaPayload } | { phase: "error" }
-  >({ phase: "loading" });
-  useEffect(() => {
-    let cancelled = false;
-    setState({ phase: "loading" });
-    fetchSchema(schemaKey).then((schema) => {
-      if (cancelled) return;
-      setState(schema ? { phase: "ready", schema } : { phase: "error" });
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [schemaKey]);
-  useEffect(() => {
-    const onKey = (e: KeyboardEvent) => {
-      if (e.key === "Escape") onClose();
-    };
-    document.addEventListener("keydown", onKey, true);
-    return () => document.removeEventListener("keydown", onKey, true);
-  }, [onClose]);
-  return (
-    <div className="shell-schema-backdrop" onMouseDown={onClose}>
-      <aside
-        className="shell-schema"
-        role="dialog"
-        aria-label="Database schema"
-        onMouseDown={(e) => e.stopPropagation()}
-      >
-        {/* wave17 item 3 (R6) — the drawer opens on a mark, not on a sentence. */}
-        {state.phase === "loading" && (
-          <div className="shell-schema-empty is-spin">
-            <span className="lp-spin lp-spin--lg" role="status" aria-label="Loading" />
-          </div>
-        )}
-        {state.phase === "error" && (
-          <div className="shell-schema-empty">
-            The schema could not be loaded. Close this panel and try again.
-          </div>
-        )}
-        {state.phase === "ready" && (
-          <>
-            <header className="shell-schema-head">
-              <div>
-                <div className="shell-schema-title">{state.schema.label}</div>
-                {state.schema.source && (
-                  <div className="shell-schema-sub">Source · {state.schema.source}</div>
-                )}
-              </div>
-              <button
-                type="button"
-                className="shell-schema-close"
-                aria-label="Close schema"
-                onClick={onClose}
-              >
-                ×
-              </button>
-            </header>
-            <div className="shell-schema-body">
-              {state.schema.note && (
-                <div className="shell-schema-note">{state.schema.note}</div>
-              )}
-              {state.schema.fields.length > 0 && (
-                <>
-                  <div className="shell-schema-kicker">
-                    Fields · {state.schema.fields.length}
-                  </div>
-                  <table className="shell-schema-table">
-                    <thead>
-                      <tr>
-                        <th>Field</th>
-                        <th>Type</th>
-                        <th>Source</th>
-                      </tr>
-                    </thead>
-                    <tbody>
-                      {state.schema.fields.map((f) => (
-                        <tr key={f.key}>
-                          <td>
-                            <div className="shell-schema-fname">{f.label}</div>
-                            {f.description && (
-                              <div className="shell-schema-fdesc">{f.description}</div>
-                            )}
-                            {f.options && (
-                              <div className="shell-schema-fdesc">
-                                Choices: {f.options.join(" · ")}
-                              </div>
-                            )}
-                          </td>
-                          <td className="shell-schema-type">{f.type}</td>
-                          <td className="shell-schema-type">{f.source}</td>
-                        </tr>
-                      ))}
-                    </tbody>
-                  </table>
-                </>
-              )}
-              {state.schema.measures.length > 0 && (
-                <>
-                  <div className="shell-schema-kicker">
-                    Semantic measures · {state.schema.measures.length}
-                  </div>
-                  <div className="shell-schema-measures">
-                    {state.schema.measures.map((m) => (
-                      <div key={m.key} className="shell-schema-measure">
-                        <span className="shell-schema-fname">{m.label}</span>
-                        <span className="shell-schema-type">{m.type}</span>
-                      </div>
-                    ))}
-                  </div>
-                </>
-              )}
-            </div>
-          </>
-        )}
-      </aside>
-    </div>
-  );
-}
+// ---------------------------------------------------------------------------
+// shell/NavExtras.tsx — C-SCHEMA (wave 2026-08-02): the database list's
+// three-dots menu, folder heads, and the schema drawer.
+//
+// Kept out of Shell.tsx so the shell's frame stays readable: Shell owns the
+// STATE (prefs, open folders, which schema is open) and the save round-trip;
+// these components own only their own popover/drawer chrome. Menus are
+// position:fixed against the trigger — the rail scrolls and clips, so an
+// absolutely-positioned child could never escape it (the same lesson as the
+// collapsed-rail tooltip).
+// ---------------------------------------------------------------------------
+
+import { useEffect, useRef, useState } from "react";
+import type { ReactNode } from "react";
+import { fetchSchema } from "./nav";
+import type { NavFolder, SchemaPayload, TableFootprint } from "./nav";
+// ⚠ WAVE 19 R8 / C1 — IMPORTED, NEVER REDEFINED, and the contract says so in as
+// many words ("Shapes/tones = the grid's existing vocabulary verbatim (12
+// shapes, 5 tones); B imports, never redefines"). A second copy of this
+// vocabulary in the shell is a whitelist that can drift by one member from the
+// one the host validates against — and a tone the server does not recognise
+// degrades to the default, so the user's choice disappears on reload with
+// nothing on screen to say why. These are READ-ONLY imports across the session
+// fence: `customer-grid/**` is another session's tree this wave (HARD RULE 3).
+import { FolderMark } from "../customer-grid/icons";
+import { FOLDER_SHAPE_LABELS, FOLDER_TONE_LABELS } from "../customer-grid/iconShapes";
+import {
+  DEFAULT_FOLDER_SHAPE,
+  DEFAULT_FOLDER_TONE,
+  FOLDER_SHAPES,
+  FOLDER_TONES,
+} from "../customer-grid/types";
+import type { FolderIcon } from "../customer-grid/types";
+import "./navExtras.css";
+
+/**
+ * WAVE 21 item 12 (ruling R11) — HORIZONTAL, and it is the same three dots turned
+ * 90°, not a different mark.
+ *
+ * The rail and the views list are read as one surface, and they were drawing the
+ * "there is a menu here" affordance two different ways: this glyph stacked its
+ * circles (cx fixed, cy walking) while `ViewSidebar`'s row buttons have always
+ * rendered three MIDDLE DOTs on the baseline. Same promise, two pictures — the
+ * thing R11 names. Only the axis moves: radius, viewBox and the 14px box in
+ * `navExtras.css` are untouched, so the hit target and the optical weight are
+ * exactly what shipped.
+ */
+function DotsIcon() {
+  return (
+    <svg viewBox="0 0 16 16" aria-hidden="true" className="shell-dots-icon">
+      <circle cx="3.2" cy="8" r="1.35" />
+      <circle cx="8" cy="8" r="1.35" />
+      <circle cx="12.8" cy="8" r="1.35" />
+    </svg>
+  );
+}
+
+function FolderIcon() {
+  return (
+    <svg viewBox="0 0 16 16" aria-hidden="true" className="shell-nav-icon">
+      <path d="M2.2 4.4c0-.66.54-1.2 1.2-1.2h3l1.4 1.6h4.8c.66 0 1.2.54 1.2 1.2v6c0 .66-.54 1.2-1.2 1.2H3.4c-.66 0-1.2-.54-1.2-1.2z" />
+    </svg>
+  );
+}
+
+/** A fixed-position popover anchored to a trigger rect, closed on outside
+ *  click or Escape. Small on purpose — the shell does not import the grid's
+ *  Popover, so the two chrome trees stay independently deletable. */
+function useMenu() {
+  const [at, setAt] = useState<{ x: number; y: number } | null>(null);
+  const ref = useRef<HTMLDivElement>(null);
+  useEffect(() => {
+    if (!at) return;
+    const onDown = (e: MouseEvent) => {
+      if (ref.current && !ref.current.contains(e.target as Node)) setAt(null);
+    };
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") setAt(null);
+    };
+    document.addEventListener("mousedown", onDown, true);
+    document.addEventListener("keydown", onKey, true);
+    return () => {
+      document.removeEventListener("mousedown", onDown, true);
+      document.removeEventListener("keydown", onKey, true);
+    };
+  }, [at]);
+  const openFrom = (el: HTMLElement) => {
+    const r = el.getBoundingClientRect();
+    setAt({ x: Math.round(r.right + 4), y: Math.round(r.top) });
+  };
+  return { at, ref, openFrom, close: () => setAt(null) };
+}
+
+function MenuShell({
+  at,
+  menuRef,
+  wide,
+  children,
+}: {
+  at: { x: number; y: number };
+  menuRef: React.RefObject<HTMLDivElement>;
+  /** WAVE 21 item 6 — the delete confirm needs prose width; a menu of one-line
+   *  actions does not. The CLAMP moves with the class, because a wider panel
+   *  clamped at the narrow width spills off the right edge on exactly the rows
+   *  furthest from it. */
+  wide?: boolean;
+  children: ReactNode;
+}) {
+  // Clamp to the viewport so a row near the bottom does not spill the menu off it.
+  const width = wide ? 320 : 248;
+  const style = {
+    left: Math.min(at.x, Math.max(8, window.innerWidth - width)),
+    top: Math.min(at.y, Math.max(8, window.innerHeight - 260)),
+  };
+  return (
+    <div
+      className={"shell-navmenu" + (wide ? " is-wide" : "")}
+      style={style}
+      ref={menuRef}
+      role="menu"
+    >
+      {children}
+    </div>
+  );
+}
+
+/**
+ * WAVE 19 R8 / C1 — the 12x5 swatch picker, the grid's own pattern
+ * (`ViewSidebar.tsx`'s folder form) rendered inside the nav's popover.
+ *
+ * TWO ROWS, NOT A GRID OF 60. Shape and tone are independent choices, so the
+ * shape row previews in the CURRENT tone and the tone row previews in the
+ * CURRENT shape — every swatch shows what that one click would actually
+ * produce, which is why picking is one glance rather than a search.
+ */
+function IconPicker({
+  value,
+  onPick,
+  onClear,
+}: {
+  value?: FolderIcon;
+  onPick: (icon: FolderIcon) => void;
+  /** Absent ⇒ nothing to clear (the row is already on the default mark). */
+  onClear?: () => void;
+}) {
+  const shape = value?.shape ?? DEFAULT_FOLDER_SHAPE;
+  const tone = value?.tone ?? DEFAULT_FOLDER_TONE;
+  return (
+    <div className="shell-navmenu-pick" role="group" aria-label="Database icon">
+      <div className="shell-navmenu-pickrow">
+        {FOLDER_SHAPES.map((s) => (
+          <button
+            key={s}
+            type="button"
+            className={"shell-navmenu-swatch" + (value && shape === s ? " is-on" : "")}
+            aria-pressed={!!value && shape === s}
+            aria-label={FOLDER_SHAPE_LABELS[s]}
+            title={FOLDER_SHAPE_LABELS[s]}
+            onClick={() => onPick({ shape: s, tone })}
+          >
+            <FolderMark icon={{ shape: s, tone }} size={15} />
+          </button>
+        ))}
+      </div>
+      <div className="shell-navmenu-pickrow">
+        {FOLDER_TONES.map((t) => (
+          <button
+            key={t}
+            type="button"
+            className={"shell-navmenu-swatch" + (value && tone === t ? " is-on" : "")}
+            aria-pressed={!!value && tone === t}
+            aria-label={FOLDER_TONE_LABELS[t]}
+            title={FOLDER_TONE_LABELS[t]}
+            onClick={() => onPick({ shape, tone: t })}
+          >
+            <FolderMark icon={{ shape, tone: t }} size={15} />
+          </button>
+        ))}
+      </div>
+      {/* ⛔ AN EXPLICIT WAY BACK, because this picker deliberately does NOT copy
+          `cleanFolderIcon`'s "a fully-default icon is no icon" rule. That rule is
+          right for a FOLDER, whose default mark IS the folder shape; a database's
+          default mark is the cylinder, so dropping folder+neutral would answer a
+          user who picked "Folder" with a picture of a database — the silent
+          disappearance the tone whitelist's own note warns about. Absent = the
+          cylinder, chosen = exactly what was chosen, and clearing is a click that
+          says what it does. */}
+      {onClear ? (
+        <button type="button" className="shell-navmenu-item is-quiet" onClick={onClear}>
+          Use the default icon
+        </button>
+      ) : null}
+    </div>
+  );
+}
+
+export function RowMenu({
+  entryLabel,
+  canSchema,
+  onSchema,
+  canRename,
+  onRename,
+  canIcon,
+  icon,
+  onIcon,
+  onIconClear,
+  onShare,
+  canDelete,
+  onLoadFootprint,
+  onDelete,
+}: {
+  entryLabel: string;
+  canSchema: boolean;
+  onSchema: () => void;
+  /**
+   * WAVE 19 R8 — rename is `ut_*` (custom) DATABASES ONLY, and this flag is how
+   * the row says so. A built-in label is a compiled registry literal: renaming
+   * `customer_data` would mean the nav and every other reader of
+   * `core/registry.py` disagreeing about what the module is called. The SERVER
+   * refuses a `name` for a non-`ut_` key regardless (C1, fail-closed) — this
+   * only spares the user a control whose write would bounce.
+   */
+  canRename?: boolean;
+  onRename?: (name: string) => void;
+  /** Icons ride ALL databases (R8), unlike rename. */
+  canIcon?: boolean;
+  icon?: FolderIcon;
+  onIcon?: (icon: FolderIcon) => void;
+  onIconClear?: () => void;
+  /** WAVE 20 item 18 (C-SHARE) — open the access editor for THIS database.
+   *  Absent = the row does not offer sharing (a group head has nothing to share). */
+  onShare?: () => void;
+  /**
+   * ⭐ WAVE 21 item 6 (ruling R3, contract C3, wiring W-5) — may this session
+   * DELETE this database?
+   *
+   * ⛔ REQUIRED, NOT OPTIONAL, and that is the wave-20 lesson written into a type.
+   * Four features shipped dead behind 43 green gates because the prop that carried
+   * them across an ownership fence was `?`-marked: an unmounted optional prop is
+   * `undefined`, which reads as "the feature is off" and is indistinguishable from
+   * "the feature was never built". A required prop makes the unmounted case a
+   * COMPILE ERROR. The value is the server's (`NavPage.canDelete`), narrower than
+   * `manage` on purpose — see the note there.
+   */
+  canDelete: boolean;
+  /** What deleting would destroy. Resolves null when the server would not say —
+   *  the face then asks WITHOUT counts rather than inventing zeros. */
+  onLoadFootprint: () => Promise<TableFootprint | null>;
+  /** Do it. Resolves the server's own words on refusal, which the face shows in
+   *  place of the confirmation — a delete that failed must never look like one
+   *  that worked. */
+  onDelete: () => Promise<{ ok: boolean; error?: string }>;
+}) {
+  // Wave 14 C-NAVFOLD (ruling R10): the three-dots kept "View schema" ONLY.
+  // Wave 19 (R8/C1) adds Rename and Change icon — the first two things a
+  // database the USER made should have been able to do.
+  const { at, ref, openFrom, close } = useMenu();
+  // Which face the popover is showing. Reset on every open, so a menu that was
+  // left mid-rename does not reopen into somebody else's half-typed name.
+  const [mode, setMode] = useState<"menu" | "rename" | "icon" | "delete">("menu");
+  const [name, setName] = useState(entryLabel);
+  /**
+   * WAVE 21 item 6 — the delete face's own state. `footprint: undefined` means
+   * "still asking", `null` means "the server would not say" — two different
+   * things the face words differently, which is why it is not a plain object.
+   */
+  const [del, setDel] = useState<{
+    footprint?: TableFootprint | null;
+    busy: boolean;
+    error: string;
+  }>({ busy: false, error: "" });
+  const renameOn = !!canRename && !!onRename;
+  const iconOn = !!canIcon && !!onIcon;
+  if (!canSchema && !renameOn && !iconOn && !onShare && !canDelete) return null;
+  const submitRename = () => {
+    const clean = name.trim().replace(/\s+/g, " ");
+    if (clean && clean !== entryLabel) onRename?.(clean);
+    close();
+  };
+  /**
+   * ⚠ THE FOOTPRINT IS FETCHED WHEN THE FACE OPENS, NOT WHEN THE MENU DOES.
+   * Same reasoning as `PermsEditor.prepareCopy` ("the targets are fetched BEFORE
+   * the confirm"): the question has to name what is being destroyed, and a
+   * confirm written from the rail's own knowledge can only name the table. The
+   * cost is paid by the person who clicked Delete, never by everyone who opened
+   * a menu.
+   */
+  const openDelete = () => {
+    setDel({ busy: false, error: "" });
+    setMode("delete");
+    void onLoadFootprint().then((f) => setDel((cur) => ({ ...cur, footprint: f })));
+  };
+  const runDelete = () => {
+    setDel((cur) => ({ ...cur, busy: true, error: "" }));
+    void onDelete().then((r) => {
+      if (r.ok) {
+        close();
+        setDel({ busy: false, error: "" });
+        return;
+      }
+      // ⛔ THE MENU STAYS OPEN ON A REFUSAL. Closing it would leave a rail whose
+      // row is still there and no statement anywhere about why — which reads as
+      // "the click did nothing" and invites a second one.
+      setDel((cur) => ({ ...cur, busy: false, error: r.error || "It could not be deleted." }));
+    });
+  };
+  return (
+    <>
+      <button
+        type="button"
+        className="shell-dots"
+        aria-label={`Options for ${entryLabel}`}
+        aria-haspopup="menu"
+        onClick={(e) => {
+          e.preventDefault();
+          e.stopPropagation();
+          setMode("menu");
+          setName(entryLabel);
+          openFrom(e.currentTarget);
+        }}
+      >
+        <DotsIcon />
+      </button>
+      {at && (
+        <MenuShell at={at} menuRef={ref} wide={mode === "delete"}>
+          {mode === "delete" && canDelete ? (
+            <DeleteFace
+              entryLabel={entryLabel}
+              state={del}
+              onCancel={() => setMode("menu")}
+              onConfirm={runDelete}
+            />
+          ) : mode === "rename" && renameOn ? (
+            <form
+              className="shell-navmenu-form"
+              onSubmit={(e) => {
+                e.preventDefault();
+                submitRename();
+              }}
+            >
+              <input
+                className="shell-navmenu-input"
+                autoFocus
+                maxLength={60}
+                value={name}
+                aria-label={`Rename ${entryLabel}`}
+                onChange={(e) => setName(e.target.value)}
+                onKeyDown={(e) => {
+                  if (e.key === "Escape") close();
+                }}
+              />
+              <button type="submit" className="shell-navmenu-go" disabled={!name.trim()}>
+                Save
+              </button>
+            </form>
+          ) : mode === "icon" && iconOn ? (
+            /* ⚠ PICKING DOES NOT CLOSE THE MENU, and that is not a convenience.
+               Shape and tone are two independent choices: a picker that closed
+               on the first click would make "a green bolt" a two-open job, and
+               the second open would have to find the row again. Each click
+               commits (they are cheap and rare), the rail repaints from the
+               server, and the swatch marks follow what was actually stored — so
+               a refused write shows up as a mark that does not move, beside the
+               toast that says why. Clearing DOES close: "use the default" is a
+               terminal action, and the control removes itself once taken. */
+            <IconPicker
+              value={icon}
+              onPick={(next) => onIcon?.(next)}
+              {...(icon && onIconClear
+                ? {
+                    onClear: () => {
+                      close();
+                      onIconClear();
+                    },
+                  }
+                : {})}
+            />
+          ) : (
+            <>
+              {renameOn ? (
+                <button
+                  type="button"
+                  className="shell-navmenu-item"
+                  onClick={() => setMode("rename")}
+                >
+                  Rename
+                </button>
+              ) : null}
+              {iconOn ? (
+                <button
+                  type="button"
+                  className="shell-navmenu-item"
+                  onClick={() => setMode("icon")}
+                >
+                  Change icon
+                </button>
+              ) : null}
+              {canSchema ? (
+                <button
+                  type="button"
+                  className="shell-navmenu-item"
+                  onClick={() => {
+                    close();
+                    onSchema();
+                  }}
+                >
+                  View schema
+                </button>
+              ) : null}
+              {/* WAVE 20 item 18 (R10, C-SHARE) — a DATABASE shares with the same two
+                  roles a view does. Gated on `onShare`, which the Shell passes only
+                  for a real database row, so a family head or a hand-off link never
+                  offers to share something that has no id on the server. */}
+              {onShare ? (
+                <button
+                  type="button"
+                  className="shell-navmenu-item"
+                  onClick={() => {
+                    close();
+                    onShare();
+                  }}
+                >
+                  Share…
+                </button>
+              ) : null}
+              {/* ⭐ WAVE 21 item 6 (R3) — LAST, and the only destructive row in this
+                  menu. Gated on the server's `canDelete` alone: R3 scopes the verb to
+                  the CREATOR or an admin and refuses it outright for connector-backed
+                  databases, so a row that may not be deleted does not say so — it
+                  simply has nothing here to click. (An entry that explains why it is
+                  disabled is the right pattern for a thing you could earn; this one
+                  you cannot.) */}
+              {canDelete ? (
+                <button
+                  type="button"
+                  className="shell-navmenu-item is-danger"
+                  onClick={openDelete}
+                >
+                  Delete database…
+                </button>
+              ) : null}
+            </>
+          )}
+        </MenuShell>
+      )}
+    </>
+  );
+}
+
+/** One footprint line: "12 records", "1 view". Singular/plural is the whole of
+ *  the formatting, because a count with the wrong noun reads as a bug in the
+ *  count. */
+function countLine(n: number, one: string, many: string): string {
+  return `${n.toLocaleString()} ${n === 1 ? one : many}`;
+}
+
+/**
+ * ⭐ WAVE 21 item 6 (R3, contract C3) — the confirm face: what deleting this
+ * database destroys, stated before the button that does it.
+ *
+ * Shaped after `PermsEditor`'s confirm (`.set-confirm`, the strongest one this
+ * codebase has) and not after a `window.confirm`: the browser dialog cannot say
+ * anything specific, and a destructive question whose answer depends on facts
+ * the asker has not been given is not really being asked.
+ *
+ * THREE STATES, worded differently on purpose:
+ *   · footprint undefined — still asking the server. The button is disabled;
+ *     confirming against numbers that have not arrived is confirming against
+ *     nothing.
+ *   · footprint null      — the server would not say. The question is put
+ *     WITHOUT counts and says so. Inventing zeros here would be a specific,
+ *     checkable claim about the user's data that nobody verified
+ *     ([[no-unverifiable-aggregates]]).
+ *   · footprint present   — every family it names, listed.
+ *
+ * ⚠ The automations line is the one that is NOT about destruction: C3 pauses
+ * bound automations and stamps them "target deleted" rather than removing them,
+ * so it names them (they will still be there afterwards, switched off) instead
+ * of counting them away.
+ */
+function DeleteFace({
+  entryLabel,
+  state,
+  onCancel,
+  onConfirm,
+}: {
+  entryLabel: string;
+  state: { footprint?: TableFootprint | null; busy: boolean; error: string };
+  onCancel: () => void;
+  onConfirm: () => void;
+}) {
+  const f = state.footprint;
+  const asking = f === undefined;
+  return (
+    <div className="shell-navconfirm" role="alertdialog" aria-modal="true"
+         aria-label={`Delete ${entryLabel}`}>
+      <h4 className="shell-navconfirm-h">Delete “{entryLabel}”?</h4>
+      {asking ? (
+        <p className="shell-navmenu-note">Checking what this database holds…</p>
+      ) : f === null ? (
+        <p className="shell-navmenu-note">
+          The server did not say what this database holds. Deleting it removes its records,
+          columns, views, comments, documents and sharing — permanently.
+        </p>
+      ) : (
+        <>
+          <p className="shell-navmenu-note">This cannot be undone. It permanently removes:</p>
+          <ul className="shell-navconfirm-list">
+            <li>{countLine(f.rows, "record", "records")}</li>
+            <li>{countLine(f.fields, "column", "columns")}</li>
+            <li>{countLine(f.views, "view", "views")}</li>
+            <li>
+              {countLine(f.sharedUsers, "person it is shared with",
+                         "people it is shared with")}
+            </li>
+          </ul>
+          {f.automations.length ? (
+            <p className="shell-navmenu-note">
+              {/* The VERB agrees too. "1 automation write here" was on screen before the
+                  first screenshot was read — the kind of thing every assertion passes. */}
+              {countLine(f.automations.length, "automation", "automations")}{" "}
+              {f.automations.length === 1 ? "writes" : "write"} here (
+              {f.automations.map((a) => a.name).join(", ")}) — {f.automations.length === 1
+                ? "it is"
+                : "they are"}{" "}
+              switched off, not deleted.
+            </p>
+          ) : null}
+        </>
+      )}
+      {state.error ? <p className="shell-navconfirm-err">{state.error}</p> : null}
+      <div className="shell-navconfirm-actions">
+        <button
+          type="button"
+          className="shell-navconfirm-go"
+          disabled={asking || state.busy}
+          onClick={onConfirm}
+        >
+          {state.busy ? "Deleting…" : "Delete"}
+        </button>
+        <button
+          type="button"
+          className="shell-navmenu-item is-quiet"
+          disabled={state.busy}
+          onClick={onCancel}
+        >
+          Keep it
+        </button>
+      </div>
+    </div>
+  );
+}
+
+function PlusIcon() {
+  return (
+    <svg viewBox="0 0 16 16" aria-hidden="true" className="shell-newthing-plus">
+      <path d="M8 3.4v9.2M3.4 8h9.2" />
+    </svg>
+  );
+}
+
+/**
+ * Wave 14 C-NAVFOLD gave the list's bottom a quiet "+ New folder" (the Views-rail
+ * precedent). WAVE 19 R11 made it "+ Create new…" with Folder | Database behind it.
+ *
+ * ⭐ WAVE 24 items 1 + 15a (ruling R9) — IT LEAVES THE RAIL AND BECOMES THE DATABASE
+ * FLYOUT'S FOOTER, and it now carries the creatable things: New database ·
+ * From a template · New folder. The flyout's three standalone `.shell-dbfly-make`
+ * buttons are deleted; this one control replaces them.
+ *
+ * ⭐ WAVE 25 item 5a (ruling R8) — "AUTOMATED DATABASE" IS DELETED FROM THIS MENU,
+ * so it carries THREE rows rather than four. R8: creating a database is one act and
+ * pointing an automation at it is another, so the automation door lives on the
+ * automation surface (its rail button and its empty state) and this menu stops
+ * offering a database that is really an automation.
+ * ⚠ `From a template` and `New folder` are UNTOUCHED — neither was ever an automated
+ * database, and R9 keeps the template door working here (see the Home card's own note
+ * on why exactly one of the two template doors is boarded).
+ *
+ * ⭐ AND IT IS ALSO ITEM 1's FIX, which is worth stating because it does not look
+ * like a typography change. MEASURED on staging v12: the six rail rows all render
+ * 13.8125px / w500 / Inter / rgb(32,36,51) — identical, `<a>` and `<button>` alike.
+ * The ONE row in that band that differed was this one: `.shell-newfolder` declares
+ * `--lp-fs-2xs` (12.75px) with no `font-weight` (so 400, inherited) and
+ * `--lp-muted`. Taking it out of the rail is what makes the band read as one set;
+ * nothing about the other six needed changing, and changing them would have been a
+ * fix aimed at the wrong row.
+ *
+ * ⚠ THE `canFolder` GATE SURVIVES THE MOVE, and it has to. Wave 19's note: folders
+ * over an empty list are an empty gesture, but a freshly provisioned tenant must
+ * still be able to create a DATABASE. So with no entries the menu simply omits its
+ * folder row rather than the control collapsing to a single-purpose button — inside
+ * a panel there is room for a menu whatever the tenant has, which is the one thing
+ * the 236px rail could not say.
+ */
+export function CreateNewRow({
+  collapsed,
+  onExpand,
+  onCreateFolder,
+  onNewDatabase,
+  onFromTemplate,
+  canFolder,
+}: {
+  collapsed: boolean;
+  /** Collapsed, the row's one honest behaviour is "open the rail first". */
+  onExpand: () => void;
+  onCreateFolder: (name: string) => void;
+  onNewDatabase: () => void;
+  /** R9's second row — the template picker, over a database you already have. */
+  onFromTemplate: () => void;
+  /* ⛔ `onAutomated` LEFT WITH THE ROW IT OPENED (wave 25 item 5a, R8). */
+  /** Folders over an empty list are an empty gesture — the row is omitted, not the menu. */
+  canFolder: boolean;
+}) {
+  const { at, ref, openFrom, close } = useMenu();
+  const [naming, setNaming] = useState(false);
+  const [name, setName] = useState("");
+  const submit = () => {
+    const clean = name.trim().replace(/\s+/g, " ");
+    if (!clean) return;
+    onCreateFolder(clean);
+    setName("");
+    setNaming(false);
+  };
+  // ⛔ The 56px strip cannot hold a popover — the same reason the account row
+  // expands instead of opening its menu. Preserved from the button this row
+  // replaced, which did exactly this before opening its dialog.
+  //
+  // ⚠ WAVE 24: this branch is now UNREACHABLE FROM THE RAIL (the row is not there
+  // any more) but it is NOT dead — the flyout can be opened with the rail folded,
+  // and `collapsed` is still passed. Kept rather than deleted, because the panel's
+  // own note says the folded rail is exactly the state a user who opened it is most
+  // likely to be in.
+  if (collapsed) {
+    return (
+      <button
+        type="button"
+        className="shell-newfolder is-collapsed"
+        aria-label="Create new"
+        title="Create new"
+        onClick={onExpand}
+      >
+        <PlusIcon />
+      </button>
+    );
+  }
+  if (!naming) {
+    return (
+      <>
+        {/* THE LABEL NO LONGER FOLLOWS `canFolder`. In the rail it had to: with one
+            real branch, "+ Create new…" beside an `aria-haspopup` was a control
+            promising a choice it was not about to offer. In the footer there are
+            always at least two (database / template), so the menu is real whatever
+            the tenant has and the label can simply be true.
+            ⚠ TWO, NOT THREE, since R8 took the automated row (wave 25) — still a
+            genuine choice, which is the property the label depends on. If a future
+            ruling takes the template row as well, this reasoning inverts and the
+            control has to become a plain button again. */}
+        <button
+          type="button"
+          className="shell-newfolder"
+          aria-haspopup="menu"
+          onClick={(e) => openFrom(e.currentTarget)}
+        >
+          + Create new…
+        </button>
+        {at && (
+          <MenuShell at={at} menuRef={ref}>
+            <button
+              type="button"
+              className="shell-navmenu-item"
+              onClick={() => {
+                close();
+                onNewDatabase();
+              }}
+            >
+              New database
+            </button>
+            <button
+              type="button"
+              className="shell-navmenu-item"
+              onClick={() => {
+                close();
+                onFromTemplate();
+              }}
+            >
+              From a template
+            </button>
+            {canFolder ? (
+              <button
+                type="button"
+                className="shell-navmenu-item"
+                onClick={() => {
+                  close();
+                  setNaming(true);
+                }}
+              >
+                New folder
+              </button>
+            ) : null}
+          </MenuShell>
+        )}
+      </>
+    );
+  }
+  return (
+    <form
+      className="shell-navmenu-form shell-newfolder-form"
+      onSubmit={(e) => {
+        e.preventDefault();
+        submit();
+      }}
+    >
+      <input
+        className="shell-navmenu-input"
+        autoFocus
+        maxLength={40}
+        placeholder="Folder name"
+        value={name}
+        onChange={(e) => setName(e.target.value)}
+        onKeyDown={(e) => {
+          if (e.key === "Escape") {
+            setName("");
+            setNaming(false);
+          }
+        }}
+      />
+      <button type="submit" className="shell-navmenu-go" disabled={!name.trim()}>
+        Add
+      </button>
+    </form>
+  );
+}
+
+export function FolderHead({
+  folder,
+  count,
+  open,
+  collapsed,
+  onToggle,
+  onRename,
+  onDelete,
+  isDrop,
+  dropProps,
+}: {
+  folder: NavFolder;
+  count: number;
+  /* ⛔ WAVE 35 · T07 (owner item 9) — the `important?: NavImportant` prop is DELETED. It carried
+     wave-34 R1's per-folder SUM of mark-important numbers; item 9 retires that badge, and `tsc`'s
+     unused-locals check is what named this prop the moment its only reader went. */
+  open: boolean;
+  collapsed: boolean;
+  onToggle: () => void;
+  onRename: (name: string) => void;
+  onDelete: () => void;
+  /** Wave 14 C-NAVFOLD — a database row is being dragged over this folder. */
+  isDrop?: boolean;
+  /** dragover/drop handlers, owned by the Shell (it holds the placement writer). */
+  dropProps?: React.HTMLAttributes<HTMLDivElement>;
+}) {
+  const { at, ref, openFrom, close } = useMenu();
+  const [renaming, setRenaming] = useState(false);
+  const [name, setName] = useState(folder.name);
+  const submit = () => {
+    const clean = name.trim().replace(/\s+/g, " ");
+    if (clean && clean !== folder.name) onRename(clean);
+    setRenaming(false);
+    close();
+  };
+  if (collapsed) {
+    // The folded rail has no room for folder chrome; members render flat and the
+    // folder simply waits for the rail to open again.
+    return null;
+  }
+  return (
+    <div
+      className={"shell-nav-folder" + (isDrop ? " is-drop" : "")}
+      {...(dropProps ?? {})}
+    >
+      {/* R3: no chevron — the Views-rail folder look. Open state reads from the members
+          below it (and aria-expanded says it aloud); the mark + bold label ARE the row. */}
+      <button
+        type="button"
+        className="shell-nav-folderbtn"
+        aria-expanded={open}
+        onClick={onToggle}
+      >
+        <FolderIcon />
+        <span className="shell-nav-label">{folder.name}</span>
+        <span className="shell-nav-foldercount">{count}</span>
+        {/* ⛔⛔ WAVE 35 · T07 (owner item 9, R4) — THE IMPORTANT SUM IS GONE FROM HERE.
+            Owner: remove the count *"anywhere else but the View itself"*. Wave 34's R1/C1 put a
+            sum of marked RECORDS beside this folder row; item 9 is later and retires it. The star
+            count now reaches the user through Home and the Starred module instead (W35-T16/T17).
+            ⚠ `count` STAYS, and the distinction is the whole reason this note is here rather than
+            the row simply being deleted: `count` is how many BLOCKS the folder holds and has meant
+            that since wave 14 — it is not a star count and owner item 9 does not name it. Deleting
+            it would retire an unrelated wave-14 feature under cover of this ruling
+            (PRD amendment A2). */}
+      </button>
+      <button
+        type="button"
+        className="shell-dots"
+        aria-label={`Options for folder ${folder.name}`}
+        aria-haspopup="menu"
+        onClick={(e) => {
+          e.stopPropagation();
+          setName(folder.name);
+          setRenaming(false);
+          openFrom(e.currentTarget);
+        }}
+      >
+        <DotsIcon />
+      </button>
+      {at && (
+        <MenuShell at={at} menuRef={ref}>
+          {renaming ? (
+            <form
+              className="shell-navmenu-form"
+              onSubmit={(e) => {
+                e.preventDefault();
+                submit();
+              }}
+            >
+              <input
+                className="shell-navmenu-input"
+                autoFocus
+                maxLength={40}
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+              />
+              <button type="submit" className="shell-navmenu-go" disabled={!name.trim()}>
+                Save
+              </button>
+            </form>
+          ) : (
+            <button
+              type="button"
+              className="shell-navmenu-item"
+              onClick={() => setRenaming(true)}
+            >
+              Rename folder
+            </button>
+          )}
+          <button
+            type="button"
+            className="shell-navmenu-item is-danger"
+            onClick={() => {
+              close();
+              onDelete();
+            }}
+          >
+            Delete folder
+          </button>
+        </MenuShell>
+      )}
+    </div>
+  );
+}
+
+export function SchemaDrawer({
+  schemaKey,
+  onClose,
+}: {
+  schemaKey: string;
+  onClose: () => void;
+}) {
+  const [state, setState] = useState<
+    { phase: "loading" } | { phase: "ready"; schema: SchemaPayload } | { phase: "error" }
+  >({ phase: "loading" });
+  useEffect(() => {
+    let cancelled = false;
+    setState({ phase: "loading" });
+    fetchSchema(schemaKey).then((schema) => {
+      if (cancelled) return;
+      setState(schema ? { phase: "ready", schema } : { phase: "error" });
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [schemaKey]);
+  useEffect(() => {
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") onClose();
+    };
+    document.addEventListener("keydown", onKey, true);
+    return () => document.removeEventListener("keydown", onKey, true);
+  }, [onClose]);
+  return (
+    <div className="shell-schema-backdrop" onMouseDown={onClose}>
+      <aside
+        className="shell-schema"
+        role="dialog"
+        aria-label="Database schema"
+        onMouseDown={(e) => e.stopPropagation()}
+      >
+        {/* wave17 item 3 (R6) — the drawer opens on a mark, not on a sentence. */}
+        {state.phase === "loading" && (
+          <div className="shell-schema-empty is-spin">
+            <span className="lp-spin lp-spin--lg" role="status" aria-label="Loading" />
+          </div>
+        )}
+        {state.phase === "error" && (
+          <div className="shell-schema-empty">
+            The schema could not be loaded. Close this panel and try again.
+          </div>
+        )}
+        {state.phase === "ready" && (
+          <>
+            <header className="shell-schema-head">
+              <div>
+                <div className="shell-schema-title">{state.schema.label}</div>
+                {state.schema.source && (
+                  <div className="shell-schema-sub">Source · {state.schema.source}</div>
+                )}
+              </div>
+              <button
+                type="button"
+                className="shell-schema-close"
+                aria-label="Close schema"
+                onClick={onClose}
+              >
+                ×
+              </button>
+            </header>
+            <div className="shell-schema-body">
+              {state.schema.note && (
+                <div className="shell-schema-note">{state.schema.note}</div>
+              )}
+              {state.schema.fields.length > 0 && (
+                <>
+                  <div className="shell-schema-kicker">
+                    Fields · {state.schema.fields.length}
+                  </div>
+                  <table className="shell-schema-table">
+                    <thead>
+                      <tr>
+                        <th>Field</th>
+                        <th>Type</th>
+                        <th>Source</th>
+                      </tr>
+                    </thead>
+                    <tbody>
+                      {state.schema.fields.map((f) => (
+                        <tr key={f.key}>
+                          <td>
+                            <div className="shell-schema-fname">{f.label}</div>
+                            {f.description && (
+                              <div className="shell-schema-fdesc">{f.description}</div>
+                            )}
+                            {f.options && (
+                              <div className="shell-schema-fdesc">
+                                Choices: {f.options.join(" · ")}
+                              </div>
+                            )}
+                          </td>
+                          <td className="shell-schema-type">{f.type}</td>
+                          <td className="shell-schema-type">{f.source}</td>
+                        </tr>
+                      ))}
+                    </tbody>
+                  </table>
+                </>
+              )}
+              {state.schema.measures.length > 0 && (
+                <>
+                  <div className="shell-schema-kicker">
+                    Semantic measures · {state.schema.measures.length}
+                  </div>
+                  <div className="shell-schema-measures">
+                    {state.schema.measures.map((m) => (
+                      <div key={m.key} className="shell-schema-measure">
+                        <span className="shell-schema-fname">{m.label}</span>
+                        <span className="shell-schema-type">{m.type}</span>
+                      </div>
+                    ))}
+                  </div>
+                </>
+              )}
+            </div>
+          </>
+        )}
+      </aside>
+    </div>
+  );
+}

web/src/shell/nav.ts

@@ -1148,12 +1148,50 @@ export const QUERY_ROUTE = "query";
  * layout-jump report, which is what that ticket was.
  */
 export const ASSISTANT_ROUTE = "assistant";
+
+/**
+ * ⭐⭐ WAVE 35 · T06 (owner item 13, contract C6) — the three ACCOUNT routes. Owner: *"add below
+ * settings the following button: Feedback …, Usage credits …, and a Subscription module …
+ * Specialized for the Royal Imports tenant, do not show it."*
+ *
+ * ⛔ THEY MUST JOIN `CHROME_ROUTES` OR THEY RENDER NOTHING BEHIND A 200. Shell's oldest law denies
+ * an undeclared SURFACE; these are chrome — they need no grant because they show the caller its own
+ * account, never a tenant's data.
+ * ⚠ `SUBSCRIPTION_ROUTE` is chrome for EVERY tenant here and refused for Royal Imports at the
+ * DISPATCH (C6). Excluding it from this set instead would deny it to everyone, which is a different
+ * bug wearing the same screen.
+ */
+/**
+ * ⭐⭐ WAVE 35 · T09 (owner item 8, R4) — Starred. Chrome, for the same reason Home is: the page
+ * lists only objects the caller's own nav already granted, so it renders nothing the server did not
+ * already send. A grant wall here would be a second opinion about a set the server already decided.
+ */
+export const STARRED_ROUTE = "starred";
+
+export const FEEDBACK_ROUTE = "feedback";
+export const USAGE_ROUTE = "usage";
+export const SUBSCRIPTION_ROUTE = "subscription";
+
+/**
+ * ⛔ WAVE 35 · T06 — the tenant that does NOT get a subscription page. Owner item 13, verbatim:
+ * *"Specialized for the Royal Imports tenant, do not show it."* Tenant #0 is the owner's own
+ * company and is not a paying customer of the platform.
+ * ⚠ ONE constant, read by BOTH halves of C6 (the menu row and the route), because "hidden in the
+ * menu while the route still answers" is not hidden — and two copies of a slug is how those two
+ * halves drift apart.
+ */
+export const NO_SUBSCRIPTION_TENANT = "royal-imports";
+
 export const CHROME_ROUTES: ReadonlySet<string> = new Set([
   HOME_ROUTE,
   CONNECTORS_ROUTE,
   INBOX_ROUTE,
   QUERY_ROUTE,
   ASSISTANT_ROUTE,
+  STARRED_ROUTE,
+  FEEDBACK_ROUTE,
+  USAGE_ROUTE,
+  SUBSCRIPTION_ROUTE,
 ]);
 
 /**

web/src/shell/navExtras.css

@@ -1,704 +1,676 @@
-/* shell/navExtras.css — C-SCHEMA (2026-08-02): nav folders, three-dots, schema drawer.
-   New classes only; the shell's own rail classes stay in index.css untouched. */
-
-.shell-nav-row {
-  position: relative;
-  display: flex;
-  align-items: stretch;
-  min-width: 0;
-  /* wave17 SHELL (item 12) — the row is the painted surface now, so it needs
-     the shape the `<a>` used to draw. `--lp-r-sm` and not the Views rail's
-     `--lp-r-md`: the tint must land exactly where the item's hover pill lands
-     today, and every other pill in this rail is 4px. Item 12 asks the highlight
-     to reach the ⋯; it does not ask the nav to change shape. */
-  border-radius: var(--lp-r-sm);
-}
-
-/* The ROW carries hover and current-state, exactly as `.cg-view-row` does in
-   the Views rail — which is the whole of item 12. Hovering the three-dots now
-   lights the row it belongs to instead of leaving the link beside it cold. */
-.shell-nav-row:hover {
-  background: var(--lp-surface-2);
-}
-
-.shell-nav-row.is-active {
-  background: var(--lp-blue-tint);
-}
-
-.shell-nav-row > .shell-nav-item {
-  flex: 1 1 auto;
-  min-width: 0;
-}
-
-/* ⚠ LOAD-BEARING, not tidiness. `.shell-nav-item:hover` still paints its own
-   grey — it must, because the AI-assistant row is a bare `.shell-nav-item`
-   with no row around it. Left alone inside a row it would paint that grey
-   OVER the blue of the current database the moment the pointer crossed the
-   label: the link half would go grey while the ⋯ half stayed blue. The child
-   selector outranks it (0,3,0 over 0,2,0), so this holds no matter which
-   stylesheet the bundler emits first — the nav has lost a rule to source
-   order before ([[loopable-nav-logo-toggle]]) and specificity is the fix that
-   does not depend on being lucky. */
-.shell-nav-row > .shell-nav-item:hover {
-  background: transparent;
-}
-
-.shell-nav-item.is-rail-skeleton {
-  cursor: default;
-  pointer-events: none;
-}
-
-/* ⭐⭐ W33-T75 (owner item 1) — THE RAIL'S ONE IN-FLIGHT STATE.
-   ⛔ THE POINT IS THE `:not()`, NOT THE BARS. While `/nav` is in flight EVERY real row is
-   hidden, so the rail cannot show five finished rows beside two loading ones — which is what
-   `reference/ERROR 6.png` is a picture of, and what "the navigation loads separately" has meant
-   in all four reports. They are hidden rather than unmounted because the database flyout portal,
-   the tooltips and the account menu hang off this subtree (see Shell.tsx's note).
-   ⚠ Geometry is copied from `.shell-nav-item` in index.css and must stay copied: 34 px min-height,
-   8 px gap, 7/8 padding, a 16 px mark. A skeleton row of a different height is the layout jump
-   this whole ticket is about, one step earlier. */
-.shell-nav.is-rail-loading > *:not(.shell-rail-skeleton) {
-  display: none;
-}
-
-/* ⭐ WAVE 34 R15 — "then a subtle line separation". SUBTLE is the whole specification, so this
-   is a hairline at the rail's own border token and nothing else: no margin collapse games, no
-   inset, no second colour. It groups Home+Inbox / Assistant+Agents / Database+Connectors.
-   ⚠ It is a direct child of `.shell-nav`, which is what makes the `is-rail-loading` rule above
-   hide it with the rows. Do not wrap the groups in `<div>`s to get the same look: that would put
-   the rows one level deeper and the `> *` in that selector would stop reaching them, silently
-   bringing back the two-row-states defect the whole rule exists to prevent. */
-.shell-nav-sep {
-  height: 1px;
-  margin: 6px 8px;
-  background: var(--lp-line);
-}
-
-.shell-rail-skeleton {
-  display: flex;
-  flex-direction: column;
-}
-
-.shell-rail-skeleton-row {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  min-height: 34px;
-  padding: 7px 8px;
-  box-sizing: border-box;
-}
-
-.shell-rail-skeleton-mark,
-.shell-rail-skeleton-bar {
-  /* One flat tone, no shimmer: an animated sweep is a second thing moving in a rail whose whole
-     complaint is movement, and `prefers-reduced-motion` would then need a third state. */
-  background: var(--lp-surface-2);
-  border-radius: var(--lp-r-sm);
-}
-
-.shell-rail-skeleton-mark {
-  flex: 0 0 auto;
-  width: 16px;
-  height: 16px;
-}
-
-.shell-rail-skeleton-bar {
-  flex: 0 0 auto;
-  width: 84px;
-  height: 9px;
-  border-radius: 4px;
-}
-
-/* Collapsed, the labels are gone from the real rail, so the skeleton drops its bars too —
-   otherwise the fold animation runs against a width the settled rail never has. */
-.shell-side.is-collapsed .shell-rail-skeleton-bar {
-  display: none;
-}
-
-.shell-nav-row > .shell-dots,
-.shell-nav-folder > .shell-dots {
-  flex: 0 0 auto;
-  width: 24px;
-  border: 0;
-  padding: 0;
-  margin: 2px 2px 2px 0;
-  border-radius: 6px;
-  background: transparent;
-  color: var(--lp-muted);
-  cursor: pointer;
-  opacity: 0;
-  display: grid;
-  place-items: center;
-}
-
-.shell-nav-row:hover > .shell-dots,
-.shell-nav-row:focus-within > .shell-dots,
-.shell-nav-folder:hover > .shell-dots,
-.shell-nav-folder:focus-within > .shell-dots {
-  opacity: 1;
-}
-
-.shell-nav-row > .shell-dots:hover,
-.shell-nav-folder > .shell-dots:hover {
-  background: var(--lp-wash);
-  color: var(--lp-ink);
-}
-
-.shell-dots-icon {
-  width: 14px;
-  height: 14px;
-  fill: currentColor;
-}
-
-.shell-nav-row.is-foldered > .shell-nav-item {
-  padding-left: 30px;
-}
-
-/* ── folder heads ─────────────────────────────────────────────────────────── */
-
-.shell-nav-folder {
-  display: flex;
-  align-items: stretch;
-  min-width: 0;
-}
-
-.shell-nav-folderbtn {
-  flex: 1 1 auto;
-  min-width: 0;
-  display: flex;
-  align-items: center;
-  gap: 7px;
-  border: 0;
-  background: transparent;
-  padding: 6px 8px;
-  border-radius: 7px;
-  color: var(--lp-ink);
-  font: inherit;
-  font-size: var(--lp-fs-xs);
-  /* Wave 14 R3 — the Views-rail folder look: BOLD label, no chevron. */
-  font-weight: 600;
-  cursor: pointer;
-  text-align: left;
-}
-
-.shell-nav-folderbtn:hover {
-  background: var(--lp-wash);
-}
-
-.shell-nav-foldercount {
-  margin-left: auto;
-  /* Wave 14 item 7 — the count wears the LABEL's size, muted; nothing "all over the
-     place with regards to symmetry".
-     ⚠ wave17 SHELL (item 11b) SUPERSEDES THE SIZE HALF. Wave 14 matched the count
-     to the label so the row would not look ragged; at the label's own size, next
-     to a 600-weight name, it stopped reading as an annotation and started reading
-     as a second piece of the title. Smaller is what makes it recede.
-     The COLOUR TOKEN IS UNCHANGED on purpose: `--lp-muted` already IS the grey,
-     and the same owner item asks the Views rail's `cg-fold-count` for the same
-     treatment. A lighter grey invented here would need a literal that has nowhere
-     legal to live, and would put the two rails' counts a shade apart — which is
-     the exact symmetry complaint wave 14 was answering. Shrinking the type does
-     the lightening. */
-  font-size: var(--lp-fs-3xs);
-  font-weight: 400;
-  color: var(--lp-muted);
-  /* Counts line up column-wise as folders open and close, in both rails. */
-  font-variant-numeric: tabular-nums;
-}
-
-/* ── ⭐⭐ WAVE 34 R1 / contract C1: the mark-important number, in the database list ──────────
-   Owner, 2026-08-16: *"the mark important number should be moved into the database navigation,
-   so when we click database, it shows the list of the databases, each showing their number"* and
-   *"we don't need the important word, just show the number, make it smaller"*.
-
-   Drawn by TWO callers: a database row (`Shell.tsx`'s flyout) and a COLLAPSED folder head
-   (`FolderHead` above), both through `nav.ts::importantBadge` so the "is there a number here"
-   rule is written once.
-
-   ⚠ `--lp-fs-4xs` (0.625rem = 10px against the 17px root), NOT `--lp-fs-3xs` (11.69px) which the
-   sibling `.shell-nav-foldercount` uses. Two reasons and the first is the ruling: R1 says SMALLER,
-   and a badge at the same size as the count already beside it is not smaller, it is a second copy.
-   The second is arithmetic: C1 asks for <=11px and `--lp-fs-3xs` computes to 11.69px, which is
-   over. The font gate enforces token-or-nothing, never a computed ceiling, so nothing in code
-   catches picking the wrong token; it is checked here instead.
-
-   ⚠ `margin-left: auto` ON THE ROW, RESET INSIDE A FOLDER HEAD. A database row needs the number
-   at the right edge so a list of them reads as a column; a folder head already gives `auto` to
-   `.shell-nav-foldercount`, and a SECOND `auto` there splits the free space between the two
-   numbers and pushes them apart with a gap in the middle. Hence the adjacency rule below. */
-.shell-nav-count {
-  flex: none;
-  margin-left: auto;
-  padding-left: 6px;
-  font-size: var(--lp-fs-4xs);
-  font-weight: 400;
-  color: var(--lp-muted);
-  font-variant-numeric: tabular-nums;
-  /* A row is a flex line with an ellipsised label; the number must never be the thing that
-     shrinks, or a "13" becomes a "1" with no way to tell. */
-  white-space: nowrap;
-}
-/* Inside a folder head the number follows the member count, which already holds the right edge. */
-.shell-nav-foldercount + .shell-nav-count {
-  margin-left: 0;
-}
-
-/* ── wave 14 C-NAVFOLD: drag placement (items 4/6) ───────────────────────── */
-
-.shell-nav-row.is-dragging {
-  opacity: 0.45;
-}
-
-.shell-nav-folder.is-drop {
-  background: var(--lp-blue-tint);
-  border-radius: 7px;
-  box-shadow: inset 0 0 0 1px var(--lp-blue-deep);
-}
-
-.shell-nav-list.is-drop-root {
-  border-radius: 9px;
-  box-shadow: inset 0 0 0 1px var(--lp-line);
-}
-
-.shell-newfolder {
-  display: block;
-  width: 100%;
-  border: 0;
-  background: transparent;
-  padding: 6px 8px;
-  margin-top: 2px;
-  border-radius: 7px;
-  font: inherit;
-  font-size: var(--lp-fs-2xs);
-  color: var(--lp-muted);
-  text-align: left;
-  cursor: pointer;
-  white-space: nowrap;
-}
-
-.shell-newfolder:hover {
-  background: var(--lp-wash);
-  color: var(--lp-ink);
-}
-
-/* WAVE 19 R11 — the same row in the folded rail: the "+" alone, centred in the
-   56px strip, opening the rail rather than a popover it has no room for. */
-.shell-newfolder.is-collapsed {
-  display: grid;
-  place-items: center;
-  padding: 6px 0;
-}
-
-.shell-newthing-plus {
-  width: 16px;
-  height: 16px;
-  fill: none;
-  stroke: currentColor;
-  stroke-width: 1.5;
-  stroke-linecap: round;
-}
-
-.shell-newfolder-form {
-  padding: 4px 2px 2px;
-}
-
-/* ── the fixed popover menu ───────────────────────────────────────────────── */
-
-.shell-navmenu {
-  position: fixed;
-  z-index: 80;
-  min-width: 196px;
-  max-width: 240px;
-  padding: 5px;
-  border: 1px solid var(--lp-line);
-  border-radius: 9px;
-  background: var(--lp-surface);
-  box-shadow: 0 10px 34px rgba(20, 30, 43, 0.16);
-  font-size: var(--lp-fs-xs);
-}
-
-.shell-navmenu-item {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  width: 100%;
-  border: 0;
-  background: transparent;
-  padding: 6px 8px;
-  border-radius: 6px;
-  font: inherit;
-  color: var(--lp-ink);
-  cursor: pointer;
-  text-align: left;
-  /* Wave 14 R7 — every menu action occupies ONE line, app-wide. */
-  white-space: nowrap;
-}
-
-.shell-navmenu-item:hover {
-  background: var(--lp-wash);
-}
-
-.shell-navmenu-item.is-current {
-  color: var(--lp-muted);
-  cursor: default;
-}
-
-.shell-navmenu-item.is-danger {
-  color: var(--lp-red-deep);
-}
-
-/* A secondary action inside a picker, not a menu row in its own right. */
-.shell-navmenu-item.is-quiet {
-  margin-top: 2px;
-  font-size: var(--lp-fs-3xs);
-  color: var(--lp-muted);
-}
-
-/* ── WAVE 19 R8 / C1: the database icon picker ─────────────────────────────── */
-
-.shell-navmenu-pick {
-  padding: 4px 3px 3px;
-}
-
-/* WRAPS on purpose: twelve 26px swatches is ~312px and the menu is capped at
-   240 (a popover wider than the rail it hangs off reads as a panel that has
-   come loose). Two rows of six is the shape that falls out of the cap, and the
-   tone row below it is five — so the block reads as "shape, then colour"
-   without a heading having to say so. */
-.shell-navmenu-pickrow {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 2px;
-}
-
-.shell-navmenu-pickrow + .shell-navmenu-pickrow {
-  margin-top: 4px;
-  padding-top: 5px;
-  border-top: 1px solid color-mix(in srgb, var(--lp-line) 55%, transparent);
-}
-
-.shell-navmenu-swatch {
-  flex: 0 0 auto;
-  display: grid;
-  place-items: center;
-  width: 26px;
-  height: 26px;
-  border: 1px solid transparent;
-  border-radius: 6px;
-  background: transparent;
-  padding: 0;
-  font: inherit;
-  cursor: pointer;
-}
-
-.shell-navmenu-swatch:hover {
-  background: var(--lp-wash);
-}
-
-/* The current choice is marked by its OUTLINE, never by a fill: the swatch's
-   whole job is to show the mark in its real colours, and a tinted plate behind
-   a pastel glyph changes the thing it is previewing. */
-.shell-navmenu-swatch.is-on {
-  border-color: var(--lp-blue-deep);
-}
-
-.shell-navmenu-swatch:focus-visible {
-  outline: 2px solid var(--lp-blue-deep);
-  outline-offset: -2px;
-}
-
-.shell-navmenu-tick {
-  margin-left: auto;
-  font-size: var(--lp-fs-3xs);
-  color: var(--lp-muted);
-}
-
-.shell-navmenu-kicker {
-  padding: 7px 8px 3px;
-  font-size: var(--lp-fs-3xs);
-  font-weight: 600;
-  color: var(--lp-muted);
-}
-
-.shell-navmenu-note {
-  padding: 4px 8px 6px;
-  font-size: var(--lp-fs-3xs);
-  color: var(--lp-muted);
-}
-
-.shell-navmenu-form {
-  display: flex;
-  gap: 5px;
-  padding: 5px 6px 6px;
-}
-
-.shell-navmenu-input {
-  flex: 1 1 auto;
-  min-width: 0;
-  border: 1px solid var(--lp-line);
-  border-radius: 6px;
-  padding: 4px 7px;
-  font: inherit;
-  font-size: var(--lp-fs-xs);
-  background: var(--lp-surface);
-  color: var(--lp-ink);
-}
-
-.shell-navmenu-input:focus {
-  outline: none;
-  border-color: var(--lp-blue-deep);
-}
-
-.shell-navmenu-go {
-  flex: 0 0 auto;
-  border: 1px solid var(--lp-line);
-  border-radius: 6px;
-  background: var(--lp-surface);
-  padding: 4px 9px;
-  font: inherit;
-  font-size: var(--lp-fs-xs);
-  color: var(--lp-ink);
-  cursor: pointer;
-}
-
-.shell-navmenu-go:disabled {
-  color: var(--lp-muted);
-  cursor: default;
-}
-
-/* ── WAVE 21 item 6 (R3 / C3): the delete-database confirm face ─────────────
-   Wider than the action menu, and only while it is showing: the panel's job
-   changes from "pick one of four one-line verbs" to "read what is about to be
-   destroyed", and R7's one-line law is about MENU ROWS, not about prose. The
-   width is matched in `MenuShell`'s viewport clamp — a wider panel clamped at
-   the narrow number spills off the right edge on precisely the rows nearest
-   it. */
-.shell-navmenu.is-wide {
-  max-width: 312px;
-}
-
-.shell-navconfirm {
-  padding: 3px 2px 2px;
-}
-
-.shell-navconfirm-h {
-  margin: 0;
-  padding: 5px 8px 2px;
-  font-size: var(--lp-fs-xs);
-  font-weight: 600;
-  color: var(--lp-ink);
-}
-
-/* The footprint. `disc` rather than the app's usual bare rows because these ARE
-   a list of things and reading them as one takes a mark — this is the one place
-   in the nav chrome where the user is counting. */
-.shell-navconfirm-list {
-  margin: 0;
-  padding: 0 8px 4px 24px;
-  font-size: var(--lp-fs-3xs);
-  color: var(--lp-ink);
-  line-height: 1.55;
-}
-
-.shell-navconfirm-err {
-  margin: 0;
-  padding: 2px 8px 4px;
-  font-size: var(--lp-fs-3xs);
-  color: var(--lp-red-deep);
-}
-
-.shell-navconfirm-actions {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-  padding: 4px 6px 4px;
-}
-
-/* ⚠ THE DESTRUCTIVE BUTTON IS FILLED, and the way back is the quiet one. The
-   opposite arrangement (a quiet Delete beside a filled Cancel) is the pattern
-   that makes people click twice: the eye lands on the filled control, and if
-   that control is the one that does nothing the second click goes to the one
-   that does. Weight follows CONSEQUENCE here, not safety — the safety is the
-   sentence above it. */
-.shell-navconfirm-go {
-  flex: 0 0 auto;
-  border: 1px solid var(--lp-red-deep);
-  border-radius: 6px;
-  background: var(--lp-red-deep);
-  padding: 4px 11px;
-  font: inherit;
-  font-size: var(--lp-fs-xs);
-  color: var(--lp-surface);
-  cursor: pointer;
-}
-
-.shell-navconfirm-go:disabled {
-  border-color: var(--lp-line);
-  background: var(--lp-wash);
-  color: var(--lp-muted);
-  cursor: default;
-}
-
-.shell-navconfirm-actions .shell-navmenu-item.is-quiet {
-  width: auto;
-  margin-top: 0;
-}
-
-/* ── the schema drawer ────────────────────────────────────────────────────── */
-
-.shell-schema-backdrop {
-  position: fixed;
-  inset: 0;
-  z-index: 90;
-  background: rgba(25, 34, 46, 0.28);
-}
-
-.shell-schema {
-  position: absolute;
-  top: 0;
-  right: 0;
-  bottom: 0;
-  width: min(430px, 92vw);
-  display: flex;
-  flex-direction: column;
-  background: var(--lp-surface);
-  border-left: 1px solid var(--lp-line);
-  box-shadow: -18px 0 48px rgba(20, 30, 43, 0.16);
-  animation: shell-schema-in 160ms cubic-bezier(0.2, 0, 0, 1);
-}
-
-@keyframes shell-schema-in {
-  from {
-    transform: translateX(14px);
-    opacity: 0;
-  }
-}
-
-.shell-schema-head {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 10px;
-  padding: 16px 18px 12px;
-  border-bottom: 1px solid var(--lp-line);
-}
-
-.shell-schema-title {
-  font-size: var(--lp-fs-md);
-  font-weight: 600;
-  color: var(--lp-ink);
-}
-
-.shell-schema-sub {
-  margin-top: 2px;
-  font-size: var(--lp-fs-2xs);
-  color: var(--lp-muted);
-}
-
-.shell-schema-close {
-  border: 0;
-  background: transparent;
-  font-size: var(--lp-fs-md);
-  line-height: 1;
-  color: var(--lp-muted);
-  cursor: pointer;
-  padding: 2px 6px;
-  border-radius: 6px;
-}
-
-.shell-schema-close:hover {
-  background: var(--lp-wash);
-  color: var(--lp-ink);
-}
-
-.shell-schema-body {
-  flex: 1 1 auto;
-  min-height: 0;
-  overflow-y: auto;
-  padding: 12px 18px 22px;
-}
-
-.shell-schema-empty {
-  padding: 26px 18px;
-  color: var(--lp-muted);
-  font-size: var(--lp-fs-xs);
-}
-
-/* wave17 SHELL (item 3/R6) — the same box, carrying the mark instead of a
-   sentence. Centred, because a drawer that has not loaded yet has no left edge
-   of content for it to hang off. */
-.shell-schema-empty.is-spin {
-  display: flex;
-  justify-content: center;
-  padding: 40px 18px;
-}
-
-.shell-schema-note {
-  padding: 9px 11px;
-  border: 1px solid var(--lp-line);
-  border-radius: 8px;
-  background: var(--lp-wash);
-  color: var(--lp-muted);
-  font-size: var(--lp-fs-xs);
-  margin-bottom: 12px;
-}
-
-.shell-schema-kicker {
-  margin: 14px 0 7px;
-  font-size: var(--lp-fs-2xs);
-  font-weight: 600;
-  color: var(--lp-muted);
-}
-
-.shell-schema-table {
-  width: 100%;
-  border-collapse: collapse;
-  font-size: var(--lp-fs-xs);
-}
-
-.shell-schema-table th {
-  text-align: left;
-  font-weight: 600;
-  font-size: var(--lp-fs-3xs);
-  color: var(--lp-muted);
-  padding: 4px 8px 4px 0;
-  border-bottom: 1px solid var(--lp-line);
-}
-
-.shell-schema-table td {
-  vertical-align: top;
-  padding: 7px 8px 7px 0;
-  border-bottom: 1px solid color-mix(in srgb, var(--lp-line) 55%, transparent);
-}
-
-.shell-schema-fname {
-  color: var(--lp-ink);
-}
-
-.shell-schema-fdesc {
-  margin-top: 2px;
-  font-size: var(--lp-fs-2xs);
-  color: var(--lp-muted);
-  line-height: 1.4;
-}
-
-.shell-schema-type {
-  white-space: nowrap;
-  color: var(--lp-muted);
-  font-size: var(--lp-fs-2xs);
-}
-
-.shell-schema-measures {
-  display: flex;
-  flex-direction: column;
-}
-
-.shell-schema-measure {
-  display: flex;
-  align-items: baseline;
-  justify-content: space-between;
-  gap: 10px;
-  padding: 5px 0;
-  border-bottom: 1px solid color-mix(in srgb, var(--lp-line) 55%, transparent);
-  font-size: var(--lp-fs-xs);
-}
+/* shell/navExtras.css — C-SCHEMA (2026-08-02): nav folders, three-dots, schema drawer.
+   New classes only; the shell's own rail classes stay in index.css untouched. */
+
+.shell-nav-row {
+  position: relative;
+  display: flex;
+  align-items: stretch;
+  min-width: 0;
+  /* wave17 SHELL (item 12) — the row is the painted surface now, so it needs
+     the shape the `<a>` used to draw. `--lp-r-sm` and not the Views rail's
+     `--lp-r-md`: the tint must land exactly where the item's hover pill lands
+     today, and every other pill in this rail is 4px. Item 12 asks the highlight
+     to reach the ⋯; it does not ask the nav to change shape. */
+  border-radius: var(--lp-r-sm);
+}
+
+/* The ROW carries hover and current-state, exactly as `.cg-view-row` does in
+   the Views rail — which is the whole of item 12. Hovering the three-dots now
+   lights the row it belongs to instead of leaving the link beside it cold. */
+.shell-nav-row:hover {
+  background: var(--lp-surface-2);
+}
+
+.shell-nav-row.is-active {
+  background: var(--lp-blue-tint);
+}
+
+.shell-nav-row > .shell-nav-item {
+  flex: 1 1 auto;
+  min-width: 0;
+}
+
+/* ⚠ LOAD-BEARING, not tidiness. `.shell-nav-item:hover` still paints its own
+   grey — it must, because the AI-assistant row is a bare `.shell-nav-item`
+   with no row around it. Left alone inside a row it would paint that grey
+   OVER the blue of the current database the moment the pointer crossed the
+   label: the link half would go grey while the ⋯ half stayed blue. The child
+   selector outranks it (0,3,0 over 0,2,0), so this holds no matter which
+   stylesheet the bundler emits first — the nav has lost a rule to source
+   order before ([[loopable-nav-logo-toggle]]) and specificity is the fix that
+   does not depend on being lucky. */
+.shell-nav-row > .shell-nav-item:hover {
+  background: transparent;
+}
+
+.shell-nav-item.is-rail-skeleton {
+  cursor: default;
+  pointer-events: none;
+}
+
+/* ⭐⭐ W33-T75 (owner item 1) — THE RAIL'S ONE IN-FLIGHT STATE.
+   ⛔ THE POINT IS THE `:not()`, NOT THE BARS. While `/nav` is in flight EVERY real row is
+   hidden, so the rail cannot show five finished rows beside two loading ones — which is what
+   `reference/ERROR 6.png` is a picture of, and what "the navigation loads separately" has meant
+   in all four reports. They are hidden rather than unmounted because the database flyout portal,
+   the tooltips and the account menu hang off this subtree (see Shell.tsx's note).
+   ⚠ Geometry is copied from `.shell-nav-item` in index.css and must stay copied: 34 px min-height,
+   8 px gap, 7/8 padding, a 16 px mark. A skeleton row of a different height is the layout jump
+   this whole ticket is about, one step earlier. */
+.shell-nav.is-rail-loading > *:not(.shell-rail-skeleton) {
+  display: none;
+}
+
+/* ⭐ WAVE 34 R15 — "then a subtle line separation". SUBTLE is the whole specification, so this
+   is a hairline at the rail's own border token and nothing else: no margin collapse games, no
+   inset, no second colour. It groups Home+Inbox / Assistant+Agents / Database+Connectors.
+   ⚠ It is a direct child of `.shell-nav`, which is what makes the `is-rail-loading` rule above
+   hide it with the rows. Do not wrap the groups in `<div>`s to get the same look: that would put
+   the rows one level deeper and the `> *` in that selector would stop reaching them, silently
+   bringing back the two-row-states defect the whole rule exists to prevent. */
+.shell-nav-sep {
+  height: 1px;
+  margin: 6px 8px;
+  background: var(--lp-line);
+}
+
+.shell-rail-skeleton {
+  display: flex;
+  flex-direction: column;
+}
+
+.shell-rail-skeleton-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-height: 34px;
+  padding: 7px 8px;
+  box-sizing: border-box;
+}
+
+.shell-rail-skeleton-mark,
+.shell-rail-skeleton-bar {
+  /* One flat tone, no shimmer: an animated sweep is a second thing moving in a rail whose whole
+     complaint is movement, and `prefers-reduced-motion` would then need a third state. */
+  background: var(--lp-surface-2);
+  border-radius: var(--lp-r-sm);
+}
+
+.shell-rail-skeleton-mark {
+  flex: 0 0 auto;
+  width: 16px;
+  height: 16px;
+}
+
+.shell-rail-skeleton-bar {
+  flex: 0 0 auto;
+  width: 84px;
+  height: 9px;
+  border-radius: 4px;
+}
+
+/* Collapsed, the labels are gone from the real rail, so the skeleton drops its bars too —
+   otherwise the fold animation runs against a width the settled rail never has. */
+.shell-side.is-collapsed .shell-rail-skeleton-bar {
+  display: none;
+}
+
+.shell-nav-row > .shell-dots,
+.shell-nav-folder > .shell-dots {
+  flex: 0 0 auto;
+  width: 24px;
+  border: 0;
+  padding: 0;
+  margin: 2px 2px 2px 0;
+  border-radius: 6px;
+  background: transparent;
+  color: var(--lp-muted);
+  cursor: pointer;
+  opacity: 0;
+  display: grid;
+  place-items: center;
+}
+
+.shell-nav-row:hover > .shell-dots,
+.shell-nav-row:focus-within > .shell-dots,
+.shell-nav-folder:hover > .shell-dots,
+.shell-nav-folder:focus-within > .shell-dots {
+  opacity: 1;
+}
+
+.shell-nav-row > .shell-dots:hover,
+.shell-nav-folder > .shell-dots:hover {
+  background: var(--lp-wash);
+  color: var(--lp-ink);
+}
+
+.shell-dots-icon {
+  width: 14px;
+  height: 14px;
+  fill: currentColor;
+}
+
+.shell-nav-row.is-foldered > .shell-nav-item {
+  padding-left: 30px;
+}
+
+/* ── folder heads ─────────────────────────────────────────────────────────── */
+
+.shell-nav-folder {
+  display: flex;
+  align-items: stretch;
+  min-width: 0;
+}
+
+.shell-nav-folderbtn {
+  flex: 1 1 auto;
+  min-width: 0;
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  border: 0;
+  background: transparent;
+  padding: 6px 8px;
+  border-radius: 7px;
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  /* Wave 14 R3 — the Views-rail folder look: BOLD label, no chevron. */
+  font-weight: 600;
+  cursor: pointer;
+  text-align: left;
+}
+
+.shell-nav-folderbtn:hover {
+  background: var(--lp-wash);
+}
+
+.shell-nav-foldercount {
+  margin-left: auto;
+  /* Wave 14 item 7 — the count wears the LABEL's size, muted; nothing "all over the
+     place with regards to symmetry".
+     ⚠ wave17 SHELL (item 11b) SUPERSEDES THE SIZE HALF. Wave 14 matched the count
+     to the label so the row would not look ragged; at the label's own size, next
+     to a 600-weight name, it stopped reading as an annotation and started reading
+     as a second piece of the title. Smaller is what makes it recede.
+     The COLOUR TOKEN IS UNCHANGED on purpose: `--lp-muted` already IS the grey,
+     and the same owner item asks the Views rail's `cg-fold-count` for the same
+     treatment. A lighter grey invented here would need a literal that has nowhere
+     legal to live, and would put the two rails' counts a shade apart — which is
+     the exact symmetry complaint wave 14 was answering. Shrinking the type does
+     the lightening. */
+  font-size: var(--lp-fs-3xs);
+  font-weight: 400;
+  color: var(--lp-muted);
+  /* Counts line up column-wise as folders open and close, in both rails. */
+  font-variant-numeric: tabular-nums;
+}
+
+/* ⛔⛔ WAVE 35 · T07 (owner item 9, R4) — `.shell-nav-count` AND ITS ADJACENCY RULE ARE DELETED.
+   They styled wave-34 R1's mark-important number in the database flyout and on a collapsed folder
+   head. Owner item 9 is later and explicit: the count belongs to the view itself and nowhere else;
+   the marked VIEWS reach the user through Home and the Starred module instead. Both elements are
+   gone from `Shell.tsx` and `NavExtras.tsx`, `/nav` stops computing the number at all (W35-T43),
+   and `verify_wiring`'s two W34-W1 rows are INVERTED into `DELETIONS` rather than removed.
+   ⚠ `.shell-nav-foldercount` SURVIVES and is a different thing: how many BLOCKS a folder holds,
+   since wave 14. Deleting it would retire an unrelated feature under cover of this ruling. */
+
+/* ── wave 14 C-NAVFOLD: drag placement (items 4/6) ───────────────────────── */
+
+.shell-nav-row.is-dragging {
+  opacity: 0.45;
+}
+
+.shell-nav-folder.is-drop {
+  background: var(--lp-blue-tint);
+  border-radius: 7px;
+  box-shadow: inset 0 0 0 1px var(--lp-blue-deep);
+}
+
+.shell-nav-list.is-drop-root {
+  border-radius: 9px;
+  box-shadow: inset 0 0 0 1px var(--lp-line);
+}
+
+.shell-newfolder {
+  display: block;
+  width: 100%;
+  border: 0;
+  background: transparent;
+  padding: 6px 8px;
+  margin-top: 2px;
+  border-radius: 7px;
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  color: var(--lp-muted);
+  text-align: left;
+  cursor: pointer;
+  white-space: nowrap;
+}
+
+.shell-newfolder:hover {
+  background: var(--lp-wash);
+  color: var(--lp-ink);
+}
+
+/* WAVE 19 R11 — the same row in the folded rail: the "+" alone, centred in the
+   56px strip, opening the rail rather than a popover it has no room for. */
+.shell-newfolder.is-collapsed {
+  display: grid;
+  place-items: center;
+  padding: 6px 0;
+}
+
+.shell-newthing-plus {
+  width: 16px;
+  height: 16px;
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.5;
+  stroke-linecap: round;
+}
+
+.shell-newfolder-form {
+  padding: 4px 2px 2px;
+}
+
+/* ── the fixed popover menu ───────────────────────────────────────────────── */
+
+.shell-navmenu {
+  position: fixed;
+  z-index: 80;
+  min-width: 196px;
+  max-width: 240px;
+  padding: 5px;
+  border: 1px solid var(--lp-line);
+  border-radius: 9px;
+  background: var(--lp-surface);
+  box-shadow: 0 10px 34px rgba(20, 30, 43, 0.16);
+  font-size: var(--lp-fs-xs);
+}
+
+.shell-navmenu-item {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  width: 100%;
+  border: 0;
+  background: transparent;
+  padding: 6px 8px;
+  border-radius: 6px;
+  font: inherit;
+  color: var(--lp-ink);
+  cursor: pointer;
+  text-align: left;
+  /* Wave 14 R7 — every menu action occupies ONE line, app-wide. */
+  white-space: nowrap;
+}
+
+.shell-navmenu-item:hover {
+  background: var(--lp-wash);
+}
+
+.shell-navmenu-item.is-current {
+  color: var(--lp-muted);
+  cursor: default;
+}
+
+.shell-navmenu-item.is-danger {
+  color: var(--lp-red-deep);
+}
+
+/* A secondary action inside a picker, not a menu row in its own right. */
+.shell-navmenu-item.is-quiet {
+  margin-top: 2px;
+  font-size: var(--lp-fs-3xs);
+  color: var(--lp-muted);
+}
+
+/* ── WAVE 19 R8 / C1: the database icon picker ─────────────────────────────── */
+
+.shell-navmenu-pick {
+  padding: 4px 3px 3px;
+}
+
+/* WRAPS on purpose: twelve 26px swatches is ~312px and the menu is capped at
+   240 (a popover wider than the rail it hangs off reads as a panel that has
+   come loose). Two rows of six is the shape that falls out of the cap, and the
+   tone row below it is five — so the block reads as "shape, then colour"
+   without a heading having to say so. */
+.shell-navmenu-pickrow {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 2px;
+}
+
+.shell-navmenu-pickrow + .shell-navmenu-pickrow {
+  margin-top: 4px;
+  padding-top: 5px;
+  border-top: 1px solid color-mix(in srgb, var(--lp-line) 55%, transparent);
+}
+
+.shell-navmenu-swatch {
+  flex: 0 0 auto;
+  display: grid;
+  place-items: center;
+  width: 26px;
+  height: 26px;
+  border: 1px solid transparent;
+  border-radius: 6px;
+  background: transparent;
+  padding: 0;
+  font: inherit;
+  cursor: pointer;
+}
+
+.shell-navmenu-swatch:hover {
+  background: var(--lp-wash);
+}
+
+/* The current choice is marked by its OUTLINE, never by a fill: the swatch's
+   whole job is to show the mark in its real colours, and a tinted plate behind
+   a pastel glyph changes the thing it is previewing. */
+.shell-navmenu-swatch.is-on {
+  border-color: var(--lp-blue-deep);
+}
+
+.shell-navmenu-swatch:focus-visible {
+  outline: 2px solid var(--lp-blue-deep);
+  outline-offset: -2px;
+}
+
+.shell-navmenu-tick {
+  margin-left: auto;
+  font-size: var(--lp-fs-3xs);
+  color: var(--lp-muted);
+}
+
+.shell-navmenu-kicker {
+  padding: 7px 8px 3px;
+  font-size: var(--lp-fs-3xs);
+  font-weight: 600;
+  color: var(--lp-muted);
+}
+
+.shell-navmenu-note {
+  padding: 4px 8px 6px;
+  font-size: var(--lp-fs-3xs);
+  color: var(--lp-muted);
+}
+
+.shell-navmenu-form {
+  display: flex;
+  gap: 5px;
+  padding: 5px 6px 6px;
+}
+
+.shell-navmenu-input {
+  flex: 1 1 auto;
+  min-width: 0;
+  border: 1px solid var(--lp-line);
+  border-radius: 6px;
+  padding: 4px 7px;
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  background: var(--lp-surface);
+  color: var(--lp-ink);
+}
+
+.shell-navmenu-input:focus {
+  outline: none;
+  border-color: var(--lp-blue-deep);
+}
+
+.shell-navmenu-go {
+  flex: 0 0 auto;
+  border: 1px solid var(--lp-line);
+  border-radius: 6px;
+  background: var(--lp-surface);
+  padding: 4px 9px;
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  color: var(--lp-ink);
+  cursor: pointer;
+}
+
+.shell-navmenu-go:disabled {
+  color: var(--lp-muted);
+  cursor: default;
+}
+
+/* ── WAVE 21 item 6 (R3 / C3): the delete-database confirm face ─────────────
+   Wider than the action menu, and only while it is showing: the panel's job
+   changes from "pick one of four one-line verbs" to "read what is about to be
+   destroyed", and R7's one-line law is about MENU ROWS, not about prose. The
+   width is matched in `MenuShell`'s viewport clamp — a wider panel clamped at
+   the narrow number spills off the right edge on precisely the rows nearest
+   it. */
+.shell-navmenu.is-wide {
+  max-width: 312px;
+}
+
+.shell-navconfirm {
+  padding: 3px 2px 2px;
+}
+
+.shell-navconfirm-h {
+  margin: 0;
+  padding: 5px 8px 2px;
+  font-size: var(--lp-fs-xs);
+  font-weight: 600;
+  color: var(--lp-ink);
+}
+
+/* The footprint. `disc` rather than the app's usual bare rows because these ARE
+   a list of things and reading them as one takes a mark — this is the one place
+   in the nav chrome where the user is counting. */
+.shell-navconfirm-list {
+  margin: 0;
+  padding: 0 8px 4px 24px;
+  font-size: var(--lp-fs-3xs);
+  color: var(--lp-ink);
+  line-height: 1.55;
+}
+
+.shell-navconfirm-err {
+  margin: 0;
+  padding: 2px 8px 4px;
+  font-size: var(--lp-fs-3xs);
+  color: var(--lp-red-deep);
+}
+
+.shell-navconfirm-actions {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 4px 6px 4px;
+}
+
+/* ⚠ THE DESTRUCTIVE BUTTON IS FILLED, and the way back is the quiet one. The
+   opposite arrangement (a quiet Delete beside a filled Cancel) is the pattern
+   that makes people click twice: the eye lands on the filled control, and if
+   that control is the one that does nothing the second click goes to the one
+   that does. Weight follows CONSEQUENCE here, not safety — the safety is the
+   sentence above it. */
+.shell-navconfirm-go {
+  flex: 0 0 auto;
+  border: 1px solid var(--lp-red-deep);
+  border-radius: 6px;
+  background: var(--lp-red-deep);
+  padding: 4px 11px;
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  color: var(--lp-surface);
+  cursor: pointer;
+}
+
+.shell-navconfirm-go:disabled {
+  border-color: var(--lp-line);
+  background: var(--lp-wash);
+  color: var(--lp-muted);
+  cursor: default;
+}
+
+.shell-navconfirm-actions .shell-navmenu-item.is-quiet {
+  width: auto;
+  margin-top: 0;
+}
+
+/* ── the schema drawer ────────────────────────────────────────────────────── */
+
+.shell-schema-backdrop {
+  position: fixed;
+  inset: 0;
+  z-index: 90;
+  background: rgba(25, 34, 46, 0.28);
+}
+
+.shell-schema {
+  position: absolute;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  width: min(430px, 92vw);
+  display: flex;
+  flex-direction: column;
+  background: var(--lp-surface);
+  border-left: 1px solid var(--lp-line);
+  box-shadow: -18px 0 48px rgba(20, 30, 43, 0.16);
+  animation: shell-schema-in 160ms cubic-bezier(0.2, 0, 0, 1);
+}
+
+@keyframes shell-schema-in {
+  from {
+    transform: translateX(14px);
+    opacity: 0;
+  }
+}
+
+.shell-schema-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 10px;
+  padding: 16px 18px 12px;
+  border-bottom: 1px solid var(--lp-line);
+}
+
+.shell-schema-title {
+  font-size: var(--lp-fs-md);
+  font-weight: 600;
+  color: var(--lp-ink);
+}
+
+.shell-schema-sub {
+  margin-top: 2px;
+  font-size: var(--lp-fs-2xs);
+  color: var(--lp-muted);
+}
+
+.shell-schema-close {
+  border: 0;
+  background: transparent;
+  font-size: var(--lp-fs-md);
+  line-height: 1;
+  color: var(--lp-muted);
+  cursor: pointer;
+  padding: 2px 6px;
+  border-radius: 6px;
+}
+
+.shell-schema-close:hover {
+  background: var(--lp-wash);
+  color: var(--lp-ink);
+}
+
+.shell-schema-body {
+  flex: 1 1 auto;
+  min-height: 0;
+  overflow-y: auto;
+  padding: 12px 18px 22px;
+}
+
+.shell-schema-empty {
+  padding: 26px 18px;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-xs);
+}
+
+/* wave17 SHELL (item 3/R6) — the same box, carrying the mark instead of a
+   sentence. Centred, because a drawer that has not loaded yet has no left edge
+   of content for it to hang off. */
+.shell-schema-empty.is-spin {
+  display: flex;
+  justify-content: center;
+  padding: 40px 18px;
+}
+
+.shell-schema-note {
+  padding: 9px 11px;
+  border: 1px solid var(--lp-line);
+  border-radius: 8px;
+  background: var(--lp-wash);
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-xs);
+  margin-bottom: 12px;
+}
+
+.shell-schema-kicker {
+  margin: 14px 0 7px;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  color: var(--lp-muted);
+}
+
+.shell-schema-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: var(--lp-fs-xs);
+}
+
+.shell-schema-table th {
+  text-align: left;
+  font-weight: 600;
+  font-size: var(--lp-fs-3xs);
+  color: var(--lp-muted);
+  padding: 4px 8px 4px 0;
+  border-bottom: 1px solid var(--lp-line);
+}
+
+.shell-schema-table td {
+  vertical-align: top;
+  padding: 7px 8px 7px 0;
+  border-bottom: 1px solid color-mix(in srgb, var(--lp-line) 55%, transparent);
+}
+
+.shell-schema-fname {
+  color: var(--lp-ink);
+}
+
+.shell-schema-fdesc {
+  margin-top: 2px;
+  font-size: var(--lp-fs-2xs);
+  color: var(--lp-muted);
+  line-height: 1.4;
+}
+
+.shell-schema-type {
+  white-space: nowrap;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+}
+
+.shell-schema-measures {
+  display: flex;
+  flex-direction: column;
+}
+
+.shell-schema-measure {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 10px;
+  padding: 5px 0;
+  border-bottom: 1px solid color-mix(in srgb, var(--lp-line) 55%, transparent);
+  font-size: var(--lp-fs-xs);
+}