Deploy AIOS web (React glide grid + FastAPI slice)

web/src/customer-grid/FieldBatchAccessDialog.tsx

@@ -183,7 +183,7 @@ export default function FieldBatchAccessDialog({
   }, [action, canApply, fields, onComplete, pathFor, person, personLabel, role]);
 
   return (
-    <div className="shell-newdb-scrim" onClick={() => (busy ? null : onClose())}>
+    <div className="shell-newdb-scrim cg-field-access-scrim" onClick={() => (busy ? null : onClose())}>
       <section
         className="shell-newdb shell-share"
         role="dialog"

web/src/index.css

@@ -110,6 +110,10 @@
      paint underneath its own dialog — which is precisely the failure the paragraph above
      records, re-created one modal later. */
   --cg-z-overlay: 110;
+  /* Field-access is a true modal opened FROM the Fields portal overlay. It is the one
+     intentional exception to the usual "overlay over dialog" order: it must cover the
+     picker it was opened from, or its own controls are visible but unreachable. */
+  --cg-z-dialog: 120;
 
   /* --- Loopable C1 tokens (wave-8 I7c) ------------------------------------
      ADDITIVE on purpose. The `--cg-*` tokens above are NOT redefined because
@@ -10650,6 +10654,11 @@ a.cg-map-ctl-b { text-decoration: none; }
   padding-top: 18vh;
   z-index: 80;
 }
+/* Do not raise every shell confirmation. Only field access is opened from the
+   body-portal'd Fields panel and therefore has to sit above that panel. */
+.cg-field-access-scrim {
+  z-index: var(--cg-z-dialog);
+}
 .shell-newdb {
   width: 400px;
   max-width: calc(100vw - 48px);