Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,5 +1,5 @@
 {
- "current": "v49 (9a14c01)",
+ "current": "e6e361c",
  "releases": [
   {
    "version": "v49",

VERSION

@@ -1 +1 @@
-v49 (9a14c01)
+e6e361c

api/routes_customers.py

@@ -883,6 +883,50 @@ def _route_defs(session: Session):
     return {k: v for k, v in defs.items() if k not in hide}
 
 
+def _own_route_fork(session: Session, key: str):
+    """This caller's PRIVATE copy of a route column, if a per-user write ever forked one.
+
+    ⛔⛔ THE FORK IS REAL, AND IT IS WHAT BROKE DELETE. Traced through `grid_events.field_upsert`
+    rather than assumed: `shared_field` is `bool(shared_prior.get('custom'))` and a route
+    definition carries no `custom` key, so the shared branch does not take it; the key is neither
+    `custom_` nor `measure_`; it IS in the merged contract, so the `key in field_by_key` branch
+    does — and that branch's own body is what writes `note`, `format` and `agg`, landing them in
+    THIS USER'S field definitions through `TableStore.save_field`. `_merge_shared_fields` then
+    SKIPS the tenant-wide definition, because a key the contract already declares wins, and from
+    that moment the person is reading a private copy of a shared column.
+
+    ⚠ WHICH DOORS STILL FORK, AS OF 2026-08-23, because "the fork is fixed" would be too broad.
+    The Description and the Name are CLOSED: owner item 6 routed `onNote` and `onRename` to
+    `route_order_rename` below. The Edit-field pane's **Format** row (`onFormat`, unconditional)
+    and its **Summary** row (`onAggregate`, whose `isUserTable` arm is false on this registry
+    topic) both still reach `saveField`, so either one still mints a fork. They are left open on
+    purpose: closing them needs this door to accept `format` and `agg`, which is a wider change
+    than the delete the owner reported. This function is what keeps that recoverable rather than
+    permanent.
+
+    ⛔ WHY THAT MADE THE DELETE 404 RATHER THAN MERELY MISBEHAVE. The first delete found the
+    tenant-wide definition, dropped it and answered 200 — and the column came straight back on the
+    next read, because the fork was still declaring it. The second attempt found nothing in
+    `shared_fields` and answered *"that column is not a route order column on this database"*
+    about a column sitting on screen. Owner, 2026-08-23: *"I can't even delete the Field route
+    now?"* Both halves are answered here: a fork is FOUND, and `route_order_delete` drops it WITH
+    the definition rather than leaving it to redeclare the column.
+
+    ⚠ `kind` IS THE TEST, NEVER MERE PRESENCE. `TableStore.workspace` merges the tenant-wide
+    column summary over this stratum and will mint a bare `{'agg': ...}` entry for a key the user
+    has never touched (W36-T25, whose own comment says it must be able to CREATE an entry).
+    Reading presence would call that stub a fork and scrub a column nobody had forked.
+    """
+    try:
+        ws = _customer_table(session).workspace(session.uname, consume_corrections=False)
+    except Exception:                                       # noqa: BLE001
+        return None
+    entry = (ws.get("fields") or {}).get(key)
+    if not isinstance(entry, dict) or entry.get("kind") != ROUTE_KIND:
+        return None
+    return entry
+
+
 @router.get("/customers/route-order")
 def route_order_list(session: Session = Depends(module_gate(MODULE))):
     """The route-order columns this session may see, with the fingerprint each was solved from.
@@ -1087,6 +1131,36 @@ def route_order_write(body: dict = Body(default=None),
         "source": "overlay",
         "shared": True,
         "kind": ROUTE_KIND,
+        # ⭐⭐ OWNER, 2026-08-23 — A NEW ROUTE READS AS **PRIVATE**, NEVER "Shared with everyone".
+        #
+        # Owner: *"Right now the Route is 'Shared with everyone' in terms of the Field status when
+        # i check the Route Field. It should always default to private first."*
+        #
+        # ⛔ A CLASSIFICATION FIX, NOT A TIGHTENING, AND THE DIFFERENCE IS THE WHOLE POINT. This
+        # column was ALREADY private in the only sense that governs a reader: `FIELD_GRANT_MARK`
+        # plus the empty-entry grant claimed below means creator-and-admin and nobody else. What
+        # was wrong was the WORD ON SCREEN. `FieldsHidePanel` sections the field list by
+        # `types.fieldEditMode`, which is `cleanFieldPermissions(field.permissions,
+        # "collaborative")` — so a definition carrying NO permissions bag fell to that fallback
+        # and was filed under "Shared with everyone" while being shared with nobody at all.
+        #
+        # ⚠ AND IT MOVES NO WALL, CHECKED RATHER THAN REASONED. `grid_events._may_edit_field_value`
+        # short-circuits on `definition.get('shared') or definition.get('granted')` BEFORE it reads
+        # `stored_permissions`, so the creator's own rank edits and `_patch_route_ranks`' swap are
+        # decided by `_field_share_role` and not by this bag; the client twin `mayEditField` takes
+        # the same branch in the same order. `field_permissions.migrate_legacy_fields` only ever
+        # rewrites a PER-USER field carrying `custom: True`, which a route definition is not, so it
+        # leaves this key alone. `fieldEditMode` has exactly one other consumer: none.
+        #
+        # ⛔ NO MIGRATION, AND IT IS THE SAME DELIBERATE CHOICE `_next_route_label` MAKES ABOUT
+        # `Destination N`. This dict is rebuilt whole on every write, so a column minted before
+        # today gains the bag on its next RE-SOLVE and not one moment sooner — until then it
+        # keeps reading "Shared with everyone" in the Hide fields panel while being shared with
+        # nobody. Backfilling every stored route definition on a read is a write nobody asked
+        # for, on a tenant-wide stratum, triggered by opening a page; re-solving is one click and
+        # it is the click the owner is already making. Stated here rather than left to be
+        # rediscovered as "the fix did not work".
+        "permissions": {"edit": "personal"},
         # ⭐⭐ THE PER-FIELD GRANT MARKER (T16). It is an EXPLICIT write-once declaration and it is
         # what makes the wall fail CLOSED: a grant wall has the opposite absence-polarity to a
         # deny wall, so keying visibility on "does a grant record exist" would publish this column
@@ -1171,35 +1245,61 @@ def route_order_delete(field_key: str,
     """
     from core import shared_overlay
     import core.perm_scope as perm_scope
+    import core.table_store as table_store
     import aios_grid
 
     key = str(field_key or "").strip()
     all_defs = shared_fields(st=session.runtime) or {}
     defn = all_defs.get(key) if isinstance(all_defs.get(key), dict) else None
+    # ⭐⭐ OWNER, 2026-08-23 — A PRIVATE FORK IS ALSO A COLUMN TO DELETE. See `_own_route_fork`
+    # above: once any per-user write has forked this key, the fork is what the person is looking
+    # at and it OUTLIVES a drop of the tenant-wide definition. Answering 404 about a column that
+    # is on screen is exactly the refusal the owner hit.
+    fork = _own_route_fork(session, key)
+    subject = defn or fork
     unknown = err(404, "unknown_field",
                   "that column is not a route order column on this database")
-    if not defn:
+    if not subject:
         raise unknown
     # The wall FIRST, so a hidden column is indistinguishable from an absent one.
-    if key in perm_scope.hidden_keys(
+    # ⚠ ASKED ABOUT THE TENANT-WIDE DEFINITION ONLY, and that is not a hole. The wall reads
+    # `FIELD_GRANT_MARK` off the MERGED contract; with the definition already gone there is no
+    # marked column left for it to hide, and a fork lives in this caller's OWN stratum, which no
+    # grant has ever governed. Not asking when there is nothing to ask about beats asking of a
+    # contract that no longer carries the key and reading the empty answer as "not hidden".
+    if defn and key in perm_scope.hidden_keys(
             session.user, MODULE,
             _merge_shared_fields(list(aios_grid.FIELDS), all_defs), st=session.runtime):
         raise unknown
     # ⛔ KIND-CHECKED, NOT PREFIX-CHECKED. `ROUTE_KEY_PREFIX` is a naming convention and a
     # convention is not a declaration (the comment on `ROUTE_KIND` says so); a door that deleted
     # by prefix would happily drop a shared column somebody else's feature owns.
-    if defn.get("kind") != ROUTE_KIND:
+    if subject.get("kind") != ROUTE_KIND:
         raise err(400, "not_a_route_column",
                   "that column is shared but it is not a route order column, so this door will "
                   "not remove it")
-    owner = str(defn.get("createdBy") or "")
+    owner = str(subject.get("createdBy") or "")
     if not session.admin and owner != session.uname:
         raise err(403, "forbidden",
                   f"a route order column can be removed by the person who planned it or by an "
                   f"administrator. This one was planned by {owner or 'somebody else'}, and "
                   f"removing it would delete the visit numbers for every account at once")
 
-    dropped = shared_overlay.drop_field(_shared_key(), key, st=session.runtime)
+    dropped = bool(defn) and shared_overlay.drop_field(_shared_key(), key, st=session.runtime)
+    # ⛔⛔ AND THE FORK GOES IN THE SAME CALL. Dropping only the tenant-wide definition is what
+    # made the first delete look like it had worked and then undo itself: the fork still declares
+    # the column, `_merge_shared_fields` still yields to it, and the next paint brings it back.
+    # `delete_field` scrubs this user's overlay values under the key too, which is right: the
+    # tenant-wide cells went with `drop_field` above, and a private leftover would resurface under
+    # whatever column later took the key.
+    if fork is not None:
+        try:
+            table_store.make(_shared_key(), st=session.runtime).delete_field(session.uname, key)
+        except Exception:                                   # noqa: BLE001
+            # The definition is already gone, so a failed fork scrub must not turn a delete that
+            # succeeded into a 500. Worst case the column lingers for this one account until its
+            # next write, which is recoverable; a 500 over completed work is not.
+            pass
     # ⭐⭐ THE GRANT DIES WITH THE COLUMN. `route_order_write` claims
     # `shares.field_oid(SHARE_TOPIC, key)` on create, so skipping this would leave a grant record
     # pointing at nothing — a ghost in every receiver's "Shared with me" that 404s on open, and
@@ -1212,7 +1312,7 @@ def route_order_delete(field_key: str,
         shares.drop_objects([("field", shares.field_oid(SHARE_TOPIC, key))], st=session.runtime)
     except Exception:                                       # noqa: BLE001
         pass
-    return {"ok": True, "field": key, "dropped": bool(dropped)}
+    return {"ok": True, "field": key, "dropped": bool(dropped or fork is not None)}
 
 
 @router.patch("/customers/route-order/{field_key}")

web/src/customer-grid/CustomerGrid.tsx

@@ -94,7 +94,8 @@ import { NAV_MINIMIZE_EVENT, ROWS_STALE_EVENT, TOAST_EVENT, VIEW_OPEN_EVENT,
   WORKSPACE_STALE_EVENT, signal }
   from "../apiContract";
 import type { ViewOpenDetail } from "../apiContract";
-import { addTableField, addTableRow, deleteRouteOrderField, deleteTableField, deleteTableRow, fetchLinkTargets,
+import { addTableField, addTableRow, clearTopicRowsCache, deleteRouteOrderField, deleteTableField,
+  deleteTableRow, fetchLinkTargets,
   fetchRollupSources, patchRouteOrderField, patchTableField, enrichField } from "./apiBridge";
 import type { LinkTarget, RollupSourceOffer } from "./apiBridge";
 import SelectFromFile from "./SelectFromFile";
@@ -1658,11 +1659,58 @@ function CustomerGridSurface({
     setColumnVisible,
     insertColumn,
   } = useGridColumns(fields, config, updateConfig);
+  /**
+   * ⭐⭐ OWNER, 2026-08-23 — A SAVED ROUTE'S COLUMN LANDS WHERE THE PERSON IS LOOKING.
+   *
+   * Owner: *"when I save a route, the route does not immediately show in the Field under Grid
+   * view. I need it to immediately populate."*
+   *
+   * ⛔⛔ IT WAS `setColumnVisible`, AND THAT WRITES ONLY `config.visible`. The new key never
+   * reached `config.order`, so `useGridColumns.reconcileOrder` fell through to its catch-all
+   * (*"for every field not in `kept`, push"*) and APPENDED it — last, behind every Odoo column on
+   * the customers grid. The column was created, visible and correct, and sat off the right edge
+   * of a horizontal scroll nobody had a reason to make. Indistinguishable from hidden, which is
+   * why the next thing the owner said was *"unhide the Route we just made"*.
+   * `insertColumn` is the primitive that writes BOTH halves, and CustomerGrid's own note at the
+   * "Insert left / right" branch already says so — this call site simply used the wrong one.
+   *
+   * ⛔ AND IT IS DEFERRED UNTIL `fields` ACTUALLY CARRIES THE KEY. `onRouteFieldCreated` fires
+   * the instant the POST returns, which is BEFORE the workspace re-read this function asks for
+   * has landed — so at that moment the field does not exist on the client, and `insertColumn`
+   * would compute its slot from an `order` reconciled against a field list without it. The ref
+   * holds the ask; the effect below spends it on the render where the field arrives.
+   * [[mount-time-read-cannot-see-an-arrival]]
+   *
+   * ⚠ POSITION 1, NOT THE END. `insertColumn(key, lockedKey, "right")` puts it immediately after
+   * the identity column, which is where a person who just planned a route is already looking.
+   */
+  const pendingRouteRevealRef = useRef<string | null>(null);
   const revealRouteField = useCallback((key: string) => {
-    setColumnVisible(key, true);
+    if (fieldByKey.has(key)) {
+      pendingRouteRevealRef.current = null;
+      insertColumn(key, lockedKey, "right");
+    } else {
+      pendingRouteRevealRef.current = key;
+    }
+    // ⛔⛔ THE CACHE IS DROPPED BEFORE THE SIGNAL, AND THIS IS THE OTHER HALF OF "IT DOES NOT
+    // POPULATE". `fetchTopicRows` holds one cached payload per topic, and `useCustomerData`'s own
+    // note states the contract: *"Senders clear the rows cache first, so the refetch cannot be
+    // served from the memo."* This sender did not — so `ROWS_STALE_EVENT` re-ran the load effect,
+    // the load effect was answered out of the pre-save window, and the freshly revealed column
+    // painted EMPTY over rows that had never seen a visit number. The workspace half was always
+    // fine (`reread()` passes no `allowCached`); it is the ROWS that were a window behind.
+    // ⚠ The same three lines `patchTopicRow` already runs when a rank SWAP moves another row,
+    // for the same reason, which is why the drop belongs at the sender rather than in the hook.
+    clearTopicRowsCache(topic.rowsPath);
     signal(WORKSPACE_STALE_EVENT);
     signal(ROWS_STALE_EVENT);
-  }, [setColumnVisible]);
+  }, [fieldByKey, insertColumn, lockedKey, topic.rowsPath]);
+  useEffect(() => {
+    const key = pendingRouteRevealRef.current;
+    if (!key || !fieldByKey.has(key)) return;
+    pendingRouteRevealRef.current = null;
+    insertColumn(key, lockedKey, "right");
+  }, [fieldByKey, insertColumn, lockedKey]);
   // W39-T22 — the transit link is an action, so it is appended to what Glide paints without
   // joining the saved-view column contract. `onCellClicked` below is the one tap door.
   const gridColumns = useMemo(
@@ -5495,11 +5543,15 @@ function CustomerGridSurface({
           groupBy: config.groupBy === key ? null : config.groupBy,
           colorBy: config.colorBy === key ? null : config.colorBy,
         });
+        // ⛔ AND THE ROWS CACHE, for the reason `revealRouteField` states above: the values went
+        // with the definition (`shared_overlay.drop_field` scrubs the cells), so a refetch served
+        // from the pre-delete window would repaint the numbers of a column that no longer exists.
+        clearTopicRowsCache(topic.rowsPath);
         signal(WORKSPACE_STALE_EVENT);
         signal(ROWS_STALE_EVENT);
       });
     },
-    [lockedKey, config, order, visible, updateConfig, setFields]
+    [lockedKey, config, order, visible, updateConfig, setFields, topic.rowsPath]
   );
 
   /**
@@ -6427,8 +6479,19 @@ function CustomerGridSurface({
   // column can only be deleted through the column menu, which offers it for `link`/`rollup`/
   // `formula` alone (D-114's deliberate narrowness — every other kind holds real values). Booked
   // as pending work rather than fixed by handing a type-blind delete to a panel.
+  /**
+   * ⭐ OWNER, 2026-08-23 — A ROUTE COLUMN IS DELETABLE FROM **HERE** TOO, not only from the
+   * column menu. Owner: *"I can't even delete the Field route now?"* The column menu has carried
+   * the route branch since owner item 3, but a route order carries no `custom` flag (see
+   * `route_order_write`'s definition), so this set never held one and the Hide-fields panel —
+   * the surface a person opens when a column is missing — showed no delete affordance at all.
+   * ⚠ MATCHED ON THE DECLARED `kind`, never on the `route_` prefix, exactly as the column menu's
+   * branch and the server door both are.
+   */
   const deletableKeys = new Set(
-    fields.filter((f) => f.custom && f.key !== lockedKey).map((f) => f.key)
+    fields
+      .filter((f) => (f.custom || (f.shared && f.kind === "route_order")) && f.key !== lockedKey)
+      .map((f) => f.key)
   );
   const menuField = columnMenu ? fieldByKey.get(columnMenu.fieldKey) : undefined;
   // Wave-5 item 3 — what the CURRENT VIEW does with the menu's field, so the conditional
@@ -6886,7 +6949,16 @@ function CustomerGridSurface({
           orderedFields={orderedFields}
           onFieldOrder={(keys) => updateConfig({ ...config, order: keys })}
           deletableKeys={deletableKeys}
-          onDeleteField={deleteField}
+          /* ⛔ TWO STRATA, TWO DOORS, dispatched on the same declared `kind` the column menu
+             uses. `deleteField` emits a per-user `field_delete`, which `grid_events` would
+             accept for a route key and apply to a bucket the shared definition never reads —
+             the column would blink out for one paint and be back on the next fetch. That is the
+             failure `deleteDefinitionField`'s own note records, one stratum over. */
+          onDeleteField={(key) => {
+            const target = fieldByKey.get(key);
+            if (target && target.shared && target.kind === "route_order") deleteRouteField(key);
+            else deleteField(key);
+          }}
           /* ⭐⭐ W38-T07 (owner instruction 12) — THE ONE COLOUR CONTROL. This was `colorOn` plus a
              boolean toggle whose `true` arm guessed the column: `fields.find(type === "status")`,
              so on a table with two status columns the person got the first one and had no way to

web/src/customer-grid/MapView.tsx

@@ -486,6 +486,23 @@ export function MapView({
   >(null);
   /** Which saved column a save writes to. `""` = a new field, named in the prompt below. */
   const [saveTarget, setSaveTarget] = useState("");
+  /**
+   * ⭐⭐ OWNER, 2026-08-23 — WHICH SAVED ROUTE IS BEING **SHOWN**, which is not the same
+   * question as which column a save WRITES TO.
+   *
+   * Owner: *"when I click the Route navigation button. I should be able to choose any Route
+   * field I want to see the Routes."* Before this the only route control was `saveTarget`: it
+   * appeared behind `plan &&` (so you could not reach it until you had already solved something
+   * else), it listed `mine` columns only, and picking one changed nothing on the map because it
+   * named a WRITE destination. Reading a colleague's plan was not expressible at all.
+   *
+   * ⛔ TWO STATES BECAUSE THEY ARE TWO PERMISSIONS. Anyone the column was shared with may OPEN
+   * it; only its planner or an admin may re-solve it (`route_order_write`'s creator-or-admin
+   * wall, reported as `mine`). Collapsing them into one control would either offer a Save that
+   * earns a 403 or hide a route the person is allowed to read.
+   */
+  const [openedRoute, setOpenedRoute] = useState("");
+  const [openErr, setOpenErr] = useState<string | null>(null);
   /**
    * ⭐⭐ OWNER ITEM 5 (2026-08-23) — THE NAME IS ASKED FOR, AND ITS DEFAULT COMES FROM THE SERVER.
    *
@@ -1104,9 +1121,84 @@ export function MapView({
     }
   }, []);
 
+  // ⭐ OWNER, 2026-08-23 — `routePanelOpen`, NOT `routeOn`. The saved-route picker is the first
+  // control in the panel and it is how a person reaches somebody's plan without solving one of
+  // their own, so the listing has to be in hand the moment the panel opens rather than after a
+  // solve. Still a READ of our own store and still once per mount (`routeCols === null` is the
+  // not-asked-yet state), so R3 is untouched: no routing request is spent by opening a panel.
   useEffect(() => {
-    if (routeOn && routeCols === null) void loadRouteCols();
-  }, [routeOn, routeCols, loadRouteCols]);
+    if ((routePanelOpen || routeOn) && routeCols === null) void loadRouteCols();
+  }, [routePanelOpen, routeOn, routeCols, loadRouteCols]);
+
+  /**
+   * ⭐⭐ OWNER, 2026-08-23 — **OPEN A SAVED ROUTE AND SEE IT ON THE MAP.**
+   *
+   * ⛔ THE VISIT NUMBERS ARE ALREADY ON THE ROWS, so this needs no new door and no fetch.
+   * `grid_assembly` merges `shared_cells` into `ws["overlays"]` and `rows_from_pool` iterates the
+   * MERGED field list, so a route column's rank rides every row the reader may see, exactly like
+   * any other cell. `GET /customers/route-order` deliberately serves only the DEFINITION (the
+   * input fingerprint, the stop count, who planned it); asking it for ranks would be a second
+   * answer to a question the grid payload already answers.
+   *
+   * ⛔ IT READS `allRows`, NOT `rows`, AND THAT IS THE WHOLE POINT OF OPENING A SAVED ROUTE. A
+   * plan made on Tuesday was solved over Tuesday's cohort; today's view may filter half of it
+   * out. `allRows` is the book AFTER the row wall and BEFORE the view's filters (see the prop's
+   * own note), so opening a route shows the stops it was saved with and never a silent subset,
+   * and the pids join `addedPids` so each one earns a pin the way a hand-added record does.
+   *
+   * ⚠ A RANK IS READ AS A NUMBER, NEVER AS A STRING. `shared_overlay` stores cells as strings
+   * (`put_rows` sends `str(v)`), so sorting the raw values would order 10 before 2 and hand back
+   * a plausible day in the wrong sequence.
+   */
+  const openSavedRoute = useCallback((key: string) => {
+    setOpenedRoute(key);
+    setOpenErr(null);
+    if (!key) return;
+    const book = allRows && allRows.length ? allRows : rows;
+    const ranked: { pid: number; rank: number }[] = [];
+    for (const r of book) {
+      const raw = r[key];
+      if (raw === null || raw === undefined || raw === "") continue;
+      const rank = Number(raw);
+      if (!Number.isFinite(rank)) continue;
+      ranked.push({ pid: r.pid, rank });
+    }
+    // ⛔ REPORTED, NEVER SILENT (standing rule 1's second sentence). A route whose stops are all
+    // outside this account's book is a real state — a colleague planned it over the other
+    // business unit — and drawing nothing while the picker says a route is open would read as a
+    // broken map rather than as a wall doing its job.
+    if (ranked.length < 2) {
+      setOpenErr(
+        "That route has fewer than two stops in your book, so there is nothing to draw. The " +
+        "records it was planned over may sit outside the rows you are permitted to see."
+      );
+      return;
+    }
+    ranked.sort((a, b) => a.rank - b.rank);
+    const pids = ranked.map((x) => x.pid);
+    setAddedPids((prev) => {
+      const next = new Set(prev);
+      for (const pid of pids) next.add(pid);
+      return next;
+    });
+    onSelectPids(pids, "replace");
+    setRouteOrder(pids);
+    setRouteStartPid(null);
+    setRouteOn(true);
+    // ⚠ THE ROAD IS NOT RE-ASKED (R3). The stops and their order have changed, so the drawn
+    // geometry is stale by `plan.key` and the panel already offers "Update the route"; spending a
+    // provider request on a dropdown change is the thing R3 forbids.
+    setSaveMsg(null);
+    setSaveErr(null);
+    // Only a route this account may re-solve becomes the SAVE target. Pointing Save at somebody
+    // else's column would offer a button whose only possible answer is the 403 the server owes.
+    const col = (routeCols || []).find((f) => f.key === key);
+    setSaveTarget(col && col.mine ? key : "");
+    // ⭐ AND THE COLUMN IS REVEALED IN THE GRID. The host callback is `revealRouteField`: opening
+    // a route is an explicit ask to look at it, so the column it lives in stops being one of the
+    // hidden ones. This is the same door a fresh save takes, for the same reason.
+    onRouteFieldCreated?.(key);
+  }, [allRows, rows, onSelectPids, routeCols, onRouteFieldCreated]);
 
   /**
    * Write the visit numbers on screen into a tenant-wide column.
@@ -1333,14 +1425,37 @@ export function MapView({
    * hiding it here would make a customer the user can name simply absent from the search, with no
    * sentence anywhere saying why.
    */
+  /**
+   * ⛔⛔ OWNER, 2026-08-23 — NAMED RECORDS FIRST, UNNAMED LAST, AND THAT IS WHY THE LIST
+   * LOOKED EMPTY OF ANYTHING USEFUL UNTIL YOU TYPED.
+   *
+   * Owner: *"when I click the 'search the database' under the routes, the dropdown shows ??? for
+   * populating the route. Only when I search and type something does it show something."*
+   *
+   * This built EVERY title as `name || "#" + pid` and then sorted the whole mixed list with
+   * `localeCompare`, which files punctuation ahead of letters. `PICKER_LIST_CAP` then takes the
+   * first 40 — so with an unsearched query the panel showed forty rows of `#12345` and not one
+   * customer name, and typing anything at all filtered those placeholder titles away and revealed
+   * the real records underneath. The bug was never the search; it was the ORDER the cap sliced.
+   *
+   * ⚠ THE UNNAMED ARE NOT DROPPED, THEY ARE MOVED. A record with no value in the identity column
+   * is still addable — it may be exactly the stop somebody is looking for — and hiding it would
+   * make a record the user can see in the grid simply absent from the search with nothing saying
+   * why. It sorts last and says what it is instead of wearing a bare id.
+   */
   const addableRecords = useMemo(() => {
     if (!allRows || allRows.length === 0) return [];
-    const out: { pid: number; title: string }[] = [];
+    const named: { pid: number; title: string }[] = [];
+    const unnamed: { pid: number; title: string }[] = [];
     for (const r of allRows) {
       if (selectedPids.has(r.pid)) continue;
-      out.push({ pid: r.pid, title: String(r[field.key] ?? "").trim() || `#${r.pid}` });
+      const title = String(r[field.key] ?? "").trim();
+      if (title) named.push({ pid: r.pid, title });
+      else unnamed.push({ pid: r.pid, title: `Unnamed record ${r.pid}` });
     }
-    return out.sort((a, b) => a.title.localeCompare(b.title));
+    named.sort((a, b) => a.title.localeCompare(b.title));
+    unnamed.sort((a, b) => a.pid - b.pid);
+    return [...named, ...unnamed];
   }, [allRows, selectedPids, field.key]);
 
   const moveStop = useCallback(
@@ -1831,6 +1946,55 @@ export function MapView({
               </span>
             </div>
             <div className="cg-map-route">
+              {/* ══ OWNER, 2026-08-23 — CHOOSE WHICH SAVED ROUTE TO LOOK AT ══════════════════
+                  Owner: *"when I click the Route navigation button. I should be able to choose any
+                  Route field I want to see the Routes."*
+                  ⛔ FIRST IN THE PANEL, AND OUTSIDE `plan &&`. Opening somebody's saved plan is
+                  how this surface starts for a rep driving a day that was planned for them; it
+                  cannot sit behind having already solved a route of your own.
+                  ⛔ EVERY route this account may see, `mine` or not — `GET /customers/route-order`
+                  has already applied the per-field wall, so what is listed here is exactly what
+                  the grid would show. Whether you may RE-SOLVE one is a different question, and
+                  it is answered by the Visit order field select further down. */}
+              {(routeCols || []).length > 0 && (
+                <>
+                  <label className="cg-map-route-opt cg-route-field">
+                    Saved route
+                    <select
+                      className="cg-route-select"
+                      value={openedRoute}
+                      aria-label="Which saved route to show on the map"
+                      onChange={(e) => openSavedRoute(e.target.value)}
+                    >
+                      <option value="">Choose a route to show</option>
+                      {(routeCols || []).map((f) => (
+                        <option key={f.key} value={f.key}>
+                          {f.label}
+                        </option>
+                      ))}
+                    </select>
+                  </label>
+                  {openErr && <span className="cg-cal-nodate">{openErr}</span>}
+                  {/* ⛔⛔ SAID OUT LOUD, BECAUSE THE FOOT BUTTON DOES SOMETHING ELSE THAN IT
+                      LOOKS LIKE HERE. Opening a route this account cannot re-solve leaves
+                      `saveTarget` empty, so the primary button at the foot reads "Save route"
+                      and mints a NEW column rather than touching the one on screen. That is a
+                      real and useful act — take a colleague's Monday, reorder it, keep your own
+                      copy — and it is the only one the server will allow (`route_order_write`
+                      is creator-or-admin for a re-solve). What would be wrong is doing it
+                      SILENTLY under a button whose position implies it acts on what is open.
+                      ⚠ Gated on a route being open AND not mine, so the sentence appears only
+                      in the situation it describes. */}
+                  {openedRoute &&
+                    (routeCols || []).some((f) => f.key === openedRoute && !f.mine) && (
+                    <span className="cg-map-route-note">
+                      You can open this route but not re-solve it, so Save route below will
+                      create a new route of your own rather than change this one.
+                    </span>
+                  )}
+                </>
+              )}
+
               {/* ── the answer, or what is still missing ───────────────────────────────────── */}
               {plan ? (
                 <span className="cg-map-route-sum">
@@ -2043,9 +2207,15 @@ export function MapView({
                       button and the Google links to the foot. It is a statement about what
                       the LIST ABOVE does not contain ("not listed above"), so it is the one
                       line in the old block that would become false the moment it travelled. */}
+                  {/* ⚠ THE OLD SENTENCE READ *"Shared orders you can read but not re-solve are
+                      not listed above"*, and the Saved route picker at the top of this panel made
+                      it false on the day it shipped: those routes ARE listed now, one control up.
+                      What is still true, and what a person needs told here, is why choosing one
+                      up there did not arm this Save. */}
                   {(routeCols || []).some((f) => !f.mine) && (
                     <span className="cg-map-route-note">
-                      Shared orders you can read but not re-solve are not listed above.
+                      A route somebody else planned can be opened under Saved route above. Only
+                      the person who planned it can re-solve it, so it is not offered here.
                     </span>
                   )}
                 </>