Deploy AIOS web (React glide grid + FastAPI slice)

api/routes_customers.py

@@ -164,16 +164,17 @@ def _shared_key():
     return cl.TABLE_KEY
 
 
-def shared_fields(st=None):
+def shared_fields(st=None):
     """`{field_key: Field}` — the columns this topic shares tenant-wide.
 
     Unscoped on purpose, exactly as `shared_overlay.fields` is: a shared column's EXISTENCE is
     tenant-wide by definition. WHO MAY SEE IT is a separate question, answered one layer up by
     `perm_scope.hidden_keys` (the per-field grant wall T16 landed), and WHOSE ROWS by `cells`.
     """
-    from core import shared_overlay
-    try:
-        return shared_overlay.fields(_shared_key(), st=st)
+    from core import field_permissions, shared_overlay
+    try:
+        field_permissions.migrate_legacy_fields(_shared_key(), st=st)
+        return shared_overlay.fields(_shared_key(), st=st)
     except Exception:                                       # noqa: BLE001
         # Lenient like every other display read: an unreachable store degrades to "nothing is
         # shared yet", never to a 500 on a grid that would otherwise render. The WALL does not
@@ -211,8 +212,8 @@ def _merge_shared_fields(fields, defs):
     if not defs:
         return fields
     have = {f.get("key") for f in (fields or ()) if isinstance(f, dict)}
-    return list(fields or ()) + [dict(f, source="overlay")
-                                 for k, f in defs.items() if k not in have]
+    return list(fields or ()) + [dict(f, source="overlay", shared=True)
+                                 for k, f in defs.items() if k not in have]
 
 
 def grid_assembly(session: Session, scope: str = "customer", storage_key: str = "",

api/routes_grid.py

@@ -176,13 +176,15 @@ def workspace(scope: str = "customer",
         workspace["viewer"] = {"name": session.uname, "isAdmin": bool(session.admin)}
         try:
             from core import users as _users
-            workspace["userOptions"] = _users.assignable_people(tenant=session.tenant)
+            workspace["userOptions"] = _users.assignable_people(tenant=session.tenant)
+            workspace["permissionUserOptions"] = _users.assignable_identities(tenant=session.tenant)
             workspace["userAvatars"] = {k: v for k, v in
                                         _users.avatar_map(tenant=session.tenant).items()
                                         if str(v).startswith("data:image/")}
-        except Exception:
-            workspace["userOptions"] = []
-            workspace["userAvatars"] = {}
+        except Exception:
+            workspace["userOptions"] = []
+            workspace["permissionUserOptions"] = []
+            workspace["userAvatars"] = {}
         workspace["scopeKey"] = scope
         # ⭐ W31-T20 — R6's SECOND SENTENCE REACHES THE BROWSER. On a read-through grid too large
         # for one window the pid set is empty, so cohort membership and a shared view's
@@ -225,13 +227,15 @@ def workspace(scope: str = "customer",
         workspace["viewer"] = {"name": session.uname, "isAdmin": bool(session.admin)}
         try:
             from core import users as _users
-            workspace["userOptions"] = _users.assignable_people(tenant=session.tenant)
+            workspace["userOptions"] = _users.assignable_people(tenant=session.tenant)
+            workspace["permissionUserOptions"] = _users.assignable_identities(tenant=session.tenant)
             workspace["userAvatars"] = {k: v for k, v in
                                         _users.avatar_map(tenant=session.tenant).items()
                                         if str(v).startswith("data:image/")}
-        except Exception:
-            workspace["userOptions"] = []
-            workspace["userAvatars"] = {}
+        except Exception:
+            workspace["userOptions"] = []
+            workspace["permissionUserOptions"] = []
+            workspace["userAvatars"] = {}
         workspace["scopeKey"] = scope
         return {"workspace": workspace}
 
@@ -296,16 +300,18 @@ def workspace(scope: str = "customer",
     workspace["viewer"] = {"name": session.uname, "isAdmin": bool(session.admin)}
     try:
         from core import users as _users
-        workspace["userOptions"] = _users.assignable_people(tenant=session.tenant)
+        workspace["userOptions"] = _users.assignable_people(tenant=session.tenant)
+        workspace["permissionUserOptions"] = _users.assignable_identities(tenant=session.tenant)
         # Wave 14 C-AVATAR — the options vocabulary's companion: display name -> data URL.
         # Absent entries fall back to the client's initials disc; a non-data: value is
         # dropped (defence in depth beside the write-side wall in routes_auth).
         workspace["userAvatars"] = {k: v for k, v in
                                     _users.avatar_map(tenant=session.tenant).items()
                                     if str(v).startswith("data:image/")}
-    except Exception:
-        workspace["userOptions"] = []
-        workspace["userAvatars"] = {}
+    except Exception:
+        workspace["userOptions"] = []
+        workspace["permissionUserOptions"] = []
+        workspace["userAvatars"] = {}
 
     # THE SURFACE STAMP — a MIRROR of the host's own (`_table_grid`'s hide/cohort stamps).
     # ⚠ Deliberately NOT `hideViews`: `cohortMode` is what swaps the Views panel for the cohort

api/routes_products.py

@@ -336,10 +336,11 @@ def product_assembly(session: Session, scope: str = "product", storage_key: str
     from core import grid_events
 
     pids, team_id, rows_src, fields_base = scoped_pool(session)
+    shared_defs = pd.shared_fields(st=session.runtime)
 
     ctx = grid_events.EventCtx(
         uname=session.uname, allowed_pids=pids, fields=[],
-        hidden_keys=perm_scope.hidden_keys(session.user, MODULE, fields_base),
+        hidden_keys=perm_scope.hidden_keys(session.user, MODULE, fields_base, st=session.runtime),
         admin=session.admin, fallback_ws=None, seen_ids={},
         scope_key="product", table=pd.table_ops(session.runtime))
     ws = grid_events.table_workspace(ctx, allowed_pids=pids,
@@ -364,10 +365,18 @@ def product_assembly(session: Session, scope: str = "product", storage_key: str
         ws, session.uname, set(pids), defs={}, scope_key=scope, storage_key=storage_key,
         fields_base=fields_base)
 
-    hidden = perm_scope.hidden_keys(session.user, MODULE, fields)
+    have = {field.get("key") for field in fields if isinstance(field, dict)}
+    fields = list(fields) + [dict(field, source="overlay", shared=True)
+                             for key, field in shared_defs.items() if key not in have]
+
+    hidden = perm_scope.hidden_keys(session.user, MODULE, fields, st=session.runtime)
     if hidden:
         fields = [f for f in fields if f.get("key") not in hidden]
         rows_src = [perm_scope.strip_row(r, hidden) for r in rows_src]
+        ws["overlays"] = {
+            str(pid): {key: value for key, value in (row or {}).items() if key not in hidden}
+            for pid, row in (ws.get("overlays") or {}).items()
+        }
 
     today = time.strftime("%Y-%m-%d")
     stamp = _measure_stamp(session.runtime, team_id)
@@ -440,8 +449,7 @@ def patch_product(pid: int, body: dict = Body(default=None),
         uname=session.uname, allowed_pids=g["pids"], fields=g["fields"],
         admin=session.admin, fallback_ws=None, seen_ids={},
         hidden_keys=perm_scope.hidden_keys(
-            session.user, MODULE,
-            pd_fields(consolidated=g["team_id"] is None, st=session.runtime)),
+            session.user, MODULE, g["fields"], st=session.runtime),
         scope_key="product", table=pd.table_ops(session.runtime))
     try:
         grid_events.handle_one(
@@ -572,6 +580,9 @@ def pd_fields(consolidated=True, st=None):
     import aios_grid
     import modules.product_data as pd
 
+    if st is not None:
+        pd.shared_fields(st=st)
+
     doc = json.loads((Path(aios_grid.__file__).resolve().parent /
                       "aios_grid_fields.json").read_text(encoding="utf-8"))
     fields = list((doc.get("product_data") or {}).get("fields") or [])
@@ -589,7 +600,7 @@ def pd_fields(consolidated=True, st=None):
             "key": PRODUCT_IMAGE_KEY, "label": "Image", "type": "image",
             "source": "overlay", "default": True, "custom": True,
             "preset": False, "shared": True, "createdBy": pd.IMAGE_FIELD_CREATOR,
-            "permissions": {"edit": "everyone"},
+            "permissions": {"edit": "collaborative"},
             "note": "The product's picture. Empty shows the SKU's own master image; upload one "
                     "from the record panel to override it.",
         }

api/routes_tables.py

@@ -736,13 +736,16 @@ def _ut_shared_fields(session, table_key, fields):
     ⚠ A key the definition already declares WINS. A shared column is an addition to a database's
     contract, never a redefinition of a column that database already has.
     """
-    from core import shared_overlay
-    defs = shared_overlay.fields(table_key, st=session.runtime) or {}
+    from core import field_permissions, shared_overlay
+    field_permissions.migrate_legacy_fields(
+        f"{table_key}_table_workspace", st=session.runtime,
+        grant_topic=table_key, shared_key=table_key)
+    defs = shared_overlay.fields(table_key, st=session.runtime) or {}
     if not defs:
         return fields
     have = {f.get("key") for f in (fields or ()) if isinstance(f, dict)}
-    return list(fields or ()) + [dict(f, source="overlay")
-                                 for k, f in defs.items() if k not in have]
+    return list(fields or ()) + [dict(f, source="overlay", shared=True)
+                                 for k, f in defs.items() if k not in have]
 
 
 def _ut_shared_cells(session, table_key, pids):

platform/aios_grid.py

@@ -314,13 +314,12 @@ def _clean_format(raw, ftype):
     return out or None
 
 
-def _clean_permissions(raw):
-    """`{edit: 'everyone' | 'creator' | 'admins'}` or None (wave-5 item 1). WHO may set it is
-    the host handler's business (creator/admin, enforced fail-closed there); this validates
-    only the shape, like every other property here."""
-    if isinstance(raw, dict) and raw.get("edit") in ("everyone", "creator", "admins"):
-        return {"edit": raw["edit"]}
-    return None
+def _clean_permissions(raw):
+    """Canonical field edit permissions; legacy values remain readable during migration."""
+    from core.field_permissions import clean_permissions
+    if not isinstance(raw, dict):
+        return None
+    return clean_permissions(raw, fallback="personal")
 
 
 #: ⛔ THE CHARSET MUST ADMIT EVERY TOKEN THE CLIENT ENGINE PARSES, or a legal formula is

platform/core/field_permissions.py

@@ -0,0 +1,218 @@
+"""Canonical permissions and migration for user-created field definitions.
+
+Field definitions used to carry ``everyone|creator|admins`` while their definitions and
+values remained in one user's workspace.  That combination made "Everyone" a visual promise
+that could never be true.  This module is the single normalization point for the new model:
+personal, collaborative, or specific users.
+"""
+
+import core.shared_overlay as shared_overlay
+import core.shares as shares
+
+
+FIELD_EDIT_MODES = ("personal", "collaborative", "users")
+MAX_FIELD_USERS = 50
+_ALIASES = {"everyone": "collaborative", "creator": "personal", "admins": "personal"}
+
+
+def clean_permissions(raw, fallback="personal", known_users=None):
+    """Return a small, canonical field permission bag or ``None`` for malformed input."""
+    if fallback not in FIELD_EDIT_MODES:
+        fallback = "personal"
+    if not isinstance(raw, dict):
+        return {"edit": fallback}
+    edit = _ALIASES.get(str(raw.get("edit") or "").strip().lower(),
+                       str(raw.get("edit") or "").strip().lower())
+    if edit not in FIELD_EDIT_MODES:
+        edit = fallback
+    if edit != "users":
+        return {"edit": edit}
+    allowed = None if known_users is None else {str(u).strip().lower() for u in known_users if str(u).strip()}
+    result = []
+    seen = set()
+    for value in (raw.get("users") if isinstance(raw.get("users"), list) else [])[:MAX_FIELD_USERS]:
+        user = str(value or "").strip().lower()
+        if not user or user in seen or (allowed is not None and user not in allowed):
+            continue
+        seen.add(user)
+        result.append(user)
+    return {"edit": "users", "users": result} if result else {"edit": "personal"}
+
+
+def stored_permissions(field, fallback="collaborative", known_users=None):
+    """Read a stored field without retroactively making old fields private."""
+    if not isinstance(field, dict):
+        return {"edit": fallback}
+    return clean_permissions(field.get("permissions"), fallback=fallback,
+                             known_users=known_users)
+
+
+def grant_entries(permissions):
+    """Translate the field model into the registry's explicit edit grants."""
+    mode = (permissions or {}).get("edit")
+    if mode == "collaborative":
+        return [{"user": shares.EVERYONE, "role": "edit"}]
+    if mode == "users":
+        return [{"user": user, "role": "edit"}
+                for user in (permissions.get("users") or [])]
+    return []
+
+
+def _field_is_migratable(field):
+    return (isinstance(field, dict) and field.get("custom") is True
+            and field.get("source") == "overlay")
+
+
+def migrate_legacy_fields(table_key, st=None, known_users=None, grant_topic=None, shared_key=None):
+    """Promote legacy shared-looking custom fields into the shared field stratum.
+
+    The operation is intentionally idempotent and copy-before-remove.  A failed request can
+    therefore leave a private shadow behind, but it cannot lose the creator's values.  The next
+    read retries the promotion and the shared definition wins.
+    """
+    key = str(table_key or "").strip()
+    grant_key = str(grant_topic or key).strip()
+    shared_key = str(shared_key or key).strip()
+    if not key or st is None:
+        return {"promoted": 0, "normalized": 0}
+    try:
+        document = st.get(key) or {}
+    except Exception:
+        return {"promoted": 0, "normalized": 0}
+    if not isinstance(document, dict):
+        return {"promoted": 0, "normalized": 0}
+
+    promoted = 0
+    normalized = 0
+    remove = {}
+    for owner, workspace in document.items():
+        if owner == "__shared__" or not isinstance(workspace, dict):
+            continue
+        fields = workspace.get("fields") or {}
+        if not isinstance(fields, dict):
+            continue
+        for field_key, original in list(fields.items()):
+            if not _field_is_migratable(original):
+                continue
+            permissions = stored_permissions(original, fallback="collaborative",
+                                             known_users=known_users)
+            if permissions["edit"] == "personal":
+                if original.get("permissions") != permissions:
+                    def _stamp(data, owner=owner, field_key=field_key, permissions=permissions):
+                        ws = data.get(owner) or {}
+                        field = (ws.get("fields") or {}).get(field_key)
+                        if isinstance(field, dict):
+                            field["permissions"] = permissions
+                        return data
+                    st.update(key, _stamp, flush="sync")
+                    normalized += 1
+                continue
+
+            existing = shared_overlay.fields(shared_key, st=st).get(field_key)
+            if isinstance(existing, dict):
+                # A completed promotion is authoritative.  Remove a duplicate personal copy
+                # only when it has the same creator; a collision from another owner fails closed.
+                if str(existing.get("createdBy") or "").lower() != str(original.get("createdBy") or owner).lower():
+                    continue
+                shared = existing
+            else:
+                shared = dict(original)
+                shared.update({"shared": True, "granted": True,
+                               "permissions": permissions,
+                               "createdBy": original.get("createdBy") or owner,
+                               "source": "overlay", "custom": True})
+                shared_overlay.put_field(shared_key, field_key, shared, st=st)
+                promoted += 1
+
+            rows = {}
+            overlays = workspace.get("overlays") or {}
+            if isinstance(overlays, dict):
+                for pid, values in overlays.items():
+                    if isinstance(values, dict) and field_key in values:
+                        rows[str(pid)] = {field_key: values[field_key]}
+            if rows:
+                shared_overlay.put_rows(shared_key, rows, st=st)
+            shares.set_grants("field", shares.field_oid(grant_key, field_key),
+                              grant_entries(permissions),
+                              owner=str(shared.get("createdBy") or owner), st=st)
+            remove.setdefault(owner, set()).add(field_key)
+
+    if remove:
+        def _remove(data):
+            for owner, keys in remove.items():
+                ws = data.get(owner) or {}
+                field_defs = ws.get("fields") or {}
+                overlays = ws.get("overlays") or {}
+                for field_key in keys:
+                    field_defs.pop(field_key, None)
+                    if isinstance(overlays, dict):
+                        for values in overlays.values():
+                            if isinstance(values, dict):
+                                values.pop(field_key, None)
+                return data
+        st.update(key, _remove, flush="sync")
+    return {"promoted": promoted, "normalized": normalized}
+
+
+def promote_field(workspace_key, shared_key, grant_topic, owner, field, st=None):
+    """Move one personal field and its values into the shared stratum."""
+    owner = str(owner or "").strip().lower()
+    key = str(field.get("key") or "").strip()
+    if not owner or not key or st is None:
+        return dict(field)
+    shared = dict(field)
+    shared.update({"shared": True, "granted": True, "source": "overlay", "custom": True})
+    permissions = stored_permissions(shared, fallback="collaborative")
+    shared["permissions"] = permissions
+    shared["createdBy"] = str(shared.get("createdBy") or owner).strip().lower()
+    shared_overlay.put_field(shared_key, key, shared, st=st)
+    document = st.get(workspace_key) or {}
+    workspace = document.get(owner) if isinstance(document, dict) else {}
+    rows = {}
+    for pid, values in ((workspace or {}).get("overlays") or {}).items():
+        if isinstance(values, dict) and key in values:
+            rows[str(pid)] = {key: values[key]}
+    if rows:
+        shared_overlay.put_rows(shared_key, rows, st=st)
+    shares.set_grants("field", shares.field_oid(grant_topic, key),
+                      grant_entries(permissions), owner=shared["createdBy"], st=st)
+
+    def _remove(data):
+        ws = data.get(owner) or {}
+        (ws.get("fields") or {}).pop(key, None)
+        for values in (ws.get("overlays") or {}).values():
+            if isinstance(values, dict):
+                values.pop(key, None)
+        return data
+    st.update(workspace_key, _remove, flush="sync")
+    return shared
+
+
+def demote_field(workspace_key, shared_key, grant_topic, field, st=None):
+    """Move one shared field back to its creator's personal workspace."""
+    if not isinstance(field, dict) or st is None:
+        return dict(field or {})
+    key = str(field.get("key") or "").strip()
+    owner = str(field.get("createdBy") or "").strip().lower()
+    if not key or not owner:
+        return dict(field)
+    personal = dict(field)
+    personal.pop("shared", None)
+    personal.pop("granted", None)
+    personal["permissions"] = {"edit": "personal"}
+    personal["createdBy"] = owner
+    document = st.get(workspace_key) or {}
+    shared_values = shared_overlay._read(shared_key, st=st).get("cells") or {}
+
+    def _add(data):
+        ws = data.setdefault(owner, {})
+        ws.setdefault("fields", {})[key] = personal
+        overlays = ws.setdefault("overlays", {})
+        for pid, values in shared_values.items():
+            if isinstance(values, dict) and key in values:
+                overlays.setdefault(str(pid), {})[key] = values[key]
+        return data
+    st.update(workspace_key, _add, flush="sync")
+    shared_overlay.drop_field(shared_key, key, st=st)
+    shares.drop_objects([("field", shares.field_oid(grant_topic, key))], st=st)
+    return personal

platform/core/grid_events.py

@@ -1186,17 +1186,26 @@ def handle_one(event, ctx):
                            'the event carried no field object')
         key = str(raw.get('key') or '')[:80]
         import aios_grid as _ag2
+        from core import field_permissions as _fp
         # Runtime-created tenant-wide fields have a definition outside the
         # per-user workspace.  Product Image is the first such editable field;
         # keep the opt-in marker so existing shared schema fields retain their
         # own definition doors.
         shared_prior = None
         shared_field = False
+        shared_storage_key = None
+        grant_topic = None
         if ctx.table is not None:
             try:
                 import core.shared_overlay as _shared_overlay
+                table_key = str(ctx.table.table_key)
+                shared_storage_key = (table_key[:-len('_table_workspace')]
+                                      if table_key.endswith('_table_workspace') else table_key)
+                grant_topic = ('product_data' if table_key == 'product_table_workspace'
+                               else 'customer_data' if table_key == 'customer_data'
+                               else shared_storage_key)
                 shared_prior = (_shared_overlay.fields(
-                    ctx.table.table_key, st=ctx.table.st) or {}).get(key)
+                    shared_storage_key, st=ctx.table.st) or {}).get(key)
                 shared_field = bool(isinstance(shared_prior, dict)
                                     and shared_prior.get('custom'))
             except Exception:
@@ -1404,17 +1413,20 @@ def handle_one(event, ctx):
                 # existing field between scopes.
                 if prior.get('scope') == 'cohort':
                     field['scope'] = 'cohort'
-            want = _ag2._clean_permissions(raw.get('permissions'))
-            have = _ag2._clean_permissions((prior or {}).get('permissions'))
+            has_permission_request = isinstance(raw.get('permissions'), dict)
+            have = (_fp.stored_permissions(prior, fallback='collaborative')
+                    if prior is not None else {'edit': 'personal'})
+            want = (_fp.clean_permissions(raw.get('permissions'), fallback=have['edit'])
+                    if has_permission_request else have)
             owner = field.get('createdBy')
-            if want is not None and (admin or (owner and owner == uname)):
+            may_change_permissions = bool(admin or (owner and owner.lower() == uname.lower()))
+            if may_change_permissions:
                 field['permissions'] = want
             else:
-                if have is not None:
-                    field['permissions'] = have
+                field['permissions'] = have
                 # Asked for a permissions change and did not get it: the client's
                 # optimistic copy is a lie that must be repainted (wave-6 item 3).
-                refused_perms = want is not None and want != have
+                refused_perms = has_permission_request and want != have
             # A NEW measure column, or an existing one whose window moved: the VALUES
             # are host-computed, so the next render genuinely differs.
             if key.startswith(_ag2.MEASURE_FIELD_PREFIX):
@@ -1427,14 +1439,31 @@ def handle_one(event, ctx):
             if (candidate_key != key and candidate_key not in _workspace_field_keys
                 and isinstance(value, dict))
         ]
+        desired_shared = field.get('permissions', {}).get('edit') in ('collaborative', 'users')
+        if shared_field and not desired_shared and shared_storage_key:
+            # Demotion is a real data move: restore the creator's private definition and values
+            # before dropping the tenant-wide copy, then remove its grant record.
+            field = _fp.demote_field(ctx.table.table_key, shared_storage_key, grant_topic,
+                                     field, st=ctx.table.st)
+            shared_field = False
+        if not shared_field and desired_shared and shared_storage_key and ctx.table is not None:
+            # Promotion makes the permission choice true for the whole tenant, rather than merely
+            # storing a collaborative label in Anna's private workspace.
+            field = _fp.promote_field(ctx.table.table_key, shared_storage_key, grant_topic,
+                                      field.get('createdBy') or uname, field, st=ctx.table.st)
+            shared_field = True
         if shared_field:
             # A shared definition is the source of truth for every tenant
             # member.  Persisting this through TableStore.save_field would put
             # the permission back into the creator's private stratum and make
             # the successful UI save invisible to everybody else.
             import core.shared_overlay as _shared_overlay
-            field = _shared_overlay.put_field(ctx.table.table_key, key, field,
+            field = _shared_overlay.put_field(shared_storage_key, key, field,
                                               st=ctx.table.st)
+            import core.shares as _shares
+            _shares.set_grants('field', _shares.field_oid(grant_topic, key),
+                               _fp.grant_entries(field.get('permissions')),
+                               owner=field.get('createdBy') or uname, st=ctx.table.st)
         elif _store_of(ctx).available():
             field = (_tops(ctx).save_field(
                 uname, field, reserved_names=_reserved_field_names,
@@ -2090,13 +2119,14 @@ def handle_one(event, ctx):
             # Wave-5 item 1: `permissions.edit` is enforced HERE, per key — the client hiding
             # its editor is courtesy, this is the wall. Fail-closed: a restricted field with
             # no readable createdBy admits only admins.
-            perms = (field_by_key.get(key) or {}).get('permissions') or {}
+            from core import field_permissions as _fp_patch
+            definition = field_by_key.get(key) or {}
+            perms = _fp_patch.stored_permissions(definition, fallback='collaborative')
             edit = perms.get('edit')
-            if edit == 'admins' and not admin:
-                refused = True
-                continue
-            if edit == 'creator' and not (
-                    admin or (field_by_key.get(key) or {}).get('createdBy') == uname):
+            owner = str(definition.get('createdBy') or '').strip().lower()
+            permitted = (admin or (owner and owner == uname) or edit == 'collaborative' or
+                         (edit == 'users' and uname in (perms.get('users') or [])))
+            if not permitted:
                 refused = True
                 continue
             # C5-AUTOFIELD (wave 18): an automation cell is MACHINE-WRITTEN. The client marks

platform/core/users.py

@@ -486,7 +486,7 @@ def allowed_bus_labels(user):
     return (['All'] + labels) if len(labels) > 1 else labels
 
 
-def assignable_people(tenant=None):
+def assignable_people(tenant=None):
     """Display names for `user`-typed overlay columns — the tenant's ACTIVE accounts.
 
     Moved from app.py (2026-07-31) so both hosts serve the same choices. Resolved on every
@@ -509,7 +509,14 @@ def assignable_people(tenant=None):
     changes — and a future caller that forgets gets an empty picker somebody notices instead of a
     leak nobody does.
     """
-    return sorted({str(u.get('name') or n) for n, u in _tenant_accounts(tenant)})
+    return sorted({str(u.get('name') or n) for n, u in _tenant_accounts(tenant)})
+
+
+def assignable_identities(tenant=None):
+    """Canonical username/display-name pairs for durable permission pickers."""
+    return [{"username": str(username).strip().lower(),
+             "name": str(record.get("name") or username)}
+            for username, record in sorted(_tenant_accounts(tenant), key=lambda item: item[0])]
 
 
 def set_avatar(username, data_url):

platform/modules/product_data.py

@@ -194,7 +194,7 @@ def image_field_definition(st=None):
         'preset': False,
         'shared': True,
         'createdBy': IMAGE_FIELD_CREATOR,
-        'permissions': {'edit': 'everyone'},
+        'permissions': {'edit': 'collaborative'},
         'note': "The product's picture. Empty shows the SKU's own master image; upload one "
                 'from the record panel to override it.',
     }
@@ -202,11 +202,19 @@ def image_field_definition(st=None):
     if isinstance(existing, dict):
         merged = dict(default)
         merged.update(existing)
+        merged['permissions'] = {'edit': 'collaborative'}
         # Old deployments may have a stored Image definition without the
         # creator/custom markers. Repair the metadata without disturbing
         # existing permissions, grants, or cells.
         if merged != existing:
             shared_overlay.put_field(TABLE_KEY, IMAGE_FIELD_KEY, merged, st=st)
+        try:
+            import core.shares as shares
+            shares.set_grants('field', shares.field_oid('product_data', IMAGE_FIELD_KEY),
+                              [{'user': shares.EVERYONE, 'role': 'edit'}],
+                              owner=IMAGE_FIELD_CREATOR, st=st)
+        except Exception:
+            pass
         return merged
 
     stored = shared_overlay.put_field(TABLE_KEY, IMAGE_FIELD_KEY, default, st=st)
@@ -215,7 +223,8 @@ def image_field_definition(st=None):
         record = shares.grants('field', shares.field_oid('product_data', IMAGE_FIELD_KEY),
                                st=st)
         if not record.get('owner'):
-            shares.set_grants('field', shares.field_oid('product_data', IMAGE_FIELD_KEY), [],
+            shares.set_grants('field', shares.field_oid('product_data', IMAGE_FIELD_KEY),
+                              [{'user': shares.EVERYONE, 'role': 'edit'}],
                               owner=IMAGE_FIELD_CREATOR, st=st)
     except Exception:
         # The definition is already safe and owner-stamped.  A missing grant
@@ -286,6 +295,14 @@ TABLE_OPS = _ProductTableStore(TABLE_KEY)
 def table_ops(st=None):
     """Bind product workspace operations to the caller's tenant runtime."""
     return _ProductTableStore(TABLE_KEY, st=st if st is not None else TABLE_OPS.st)
+
+
+def shared_fields(st=None):
+    """Return and lazily migrate tenant-wide product field definitions."""
+    from core import field_permissions
+    field_permissions.migrate_legacy_fields(TABLE_KEY, st=st, grant_topic='product_data')
+    image_field_definition(st=st)
+    return shared_overlay.fields(TABLE_KEY, st=st if st is not None else TABLE_OPS.st)
 
 
 def shared_cells(pids, st=None):

web/src/customer-grid/ColumnMenu.tsx

@@ -11,19 +11,35 @@ import { FieldSelectButton } from "./FieldSelect";
 import { CODE_LANGUAGE_LABELS, CODE_LANGUAGES, CREATABLE_TYPES, choiceOptions, choiceRenames,
   codeLanguageOf, directionLabel, isDerivedLink, isMachineOwned,
   isProfileField, parseOptions, ratingMax, ROLLUP_FN_LABELS, ROLLUP_FNS,
-  ROLLUP_REF_OPS } from "./types";
+  ROLLUP_REF_OPS, FIELD_EDIT_BLURBS, FIELD_EDIT_LABELS, FIELD_EDIT_MODES,
+  cleanFieldPermissions } from "./types";
 import type { AggName, Field, FieldFormat, FieldScope, FieldType, Measure, RollupCondition, RollupFn,
-  RollupRefOp, RollupSource, Viewer } from "./types";
+  RollupRefOp, RollupSource, Viewer, FieldEditMode, FieldPermissions } from "./types";
 import type { LinkTarget, RollupSourceOffer } from "./apiBridge";
 import type { WindowSpec } from "./windows";
 import { normalizeWindow, windowLabel } from "./windows";
 import { WindowPicker } from "../filter-kit";
-import { TYPE_LABELS } from "./iconShapes";
+import { FOLDER_TONE_PAINT, TYPE_LABELS } from "./iconShapes";
 import { AGG_LABELS, aggOptions } from "./aggregations";
 import { validateFormula } from "./formulaEngine";
 import { BRAND_SWATCHES, defaultOptionColor, nearestSwatch, normalizeOptionColor,
   OPTION_PALETTE } from "./choiceColors";
 
+const FIELD_PERM_MARK: Record<FieldEditMode, string[]> = {
+  personal: ["M8 7.4a2 2 0 1 0 0-4 2 2 0 0 0 0 4ZM4.8 12.6c0-1.9 1.4-3.1 3.2-3.1s3.2 1.2 3.2 3.1"],
+  collaborative: ["M5.9 7.4a2 2 0 1 0 0-4 2 2 0 0 0 0 4Z", "M10.6 7.4a2 2 0 1 0 0-4 2 2 0 0 0 0 4Z"],
+  users: ["M6 7.4a2 2 0 1 0 0-4 2 2 0 0 0 0 4Z", "M2.8 12.6c0-1.9 1.4-3.1 3.2-3.1s3.2 1.2 3.2 3.1", "M10.6 9.4l1.5 1.6 2.6-3"],
+};
+function FieldPermMark({ mode }: { mode: FieldEditMode }) {
+  const tone = mode === "personal" ? "neutral" : mode === "collaborative" ? "blue" : "green";
+  return <svg className="cg-perm-mark" width={16} height={16} viewBox="0 0 16 16" aria-hidden>
+    {FIELD_PERM_MARK[mode].map((d, i) => (
+      <path key={i} d={d} fill="none" stroke={FOLDER_TONE_PAINT[tone].stroke}
+        strokeWidth={1.35} strokeLinecap="round" strokeLinejoin="round" />
+    ))}
+  </svg>;
+}
+
 export interface ColumnMenuState {
   fieldKey: string;
   anchor: AnchorRect;
@@ -261,7 +277,7 @@ interface ColumnMenuProps {
   onDuplicate?: () => void;
   /** Wave-5 item 1 — save a permissions change. Supplied iff the VIEWER may change them
    *  (isAdmin || createdBy === viewer.name, and only on creatable strata). */
-  onPermissions?: (edit: "everyone" | "creator" | "admins") => void;
+  onPermissions?: (permissions: FieldPermissions) => void;
   /** Wave-5 item 10 — save a display format. Supplied for number/currency/formula and
    *  date/created_time fields. */
   onFormat?: (format: FieldFormat) => void;
@@ -280,6 +296,9 @@ interface ColumnMenuProps {
   /** Assignable people, from the host's real user list. Empty = the host did not supply one,
    *  and "Assignee" is offered without choices rather than with invented ones. */
   userOptions?: string[];
+  /** Account identities used by field permissions. This is deliberately separate from
+   * user-valued cell choices, which are display labels rather than durable usernames. */
+  permissionUserOptions?: { username: string; name: string }[];
   /**
    * CG-8's measures, reused as the vocabulary of a FORMULA-MEASURE column (owner item 7):
    * `Sales · the last 90 days` as a column the user creates. Empty = the semantic store is
@@ -2039,6 +2058,7 @@ export default function ColumnMenu({
   onGroupByField,
   onClearGroup,
   userOptions = [],
+  permissionUserOptions = [],
   measures = [],
   tableKey,
 }: ColumnMenuProps) {
@@ -2153,9 +2173,9 @@ export default function ColumnMenu({
    *  time, and each emit is a full host round trip that would repaint the column half-ready. */
   const [periodDraft, setPeriodDraft] = useState<WindowSpec | null>(null);
   /** Permissions pane draft. */
-  const [permDraft, setPermDraft] = useState<"everyone" | "creator" | "admins">(
-    field.permissions?.edit ?? "everyone"
-  );
+  const initialFieldPermissions = cleanFieldPermissions(field.permissions, "collaborative");
+  const [permDraft, setPermDraft] = useState<FieldEditMode>(initialFieldPermissions.edit);
+  const [permUsers, setPermUsers] = useState<string[]>(initialFieldPermissions.users ?? []);
   /** Format pane draft — seeded from the field, saved whole. */
   const [fmtDraft, setFmtDraft] = useState<FieldFormat>(() => ({ ...(field.format ?? {}) }));
   /** Item 9c — the create forms' Scope draft. 'cohort' is the DEFAULT per the contract. */
@@ -3622,34 +3642,54 @@ export default function ColumnMenu({
       >
         <PaneHead title="Edit field permissions" sub={field.label} onClose={onClose} />
         <div className="cg-column-create">
-          <div className="cg-field-hint">
-            Who can edit this field's values{field.createdBy ? ` (created by ${field.createdBy})` : ""}.
+          <div className="cg-perm" role="radiogroup" aria-label="Who can edit this field">
+            <span className="cg-perm-title">Who can edit</span>
+            {FIELD_EDIT_MODES.map((mode) => (
+              <label key={mode} className="cg-radio-row cg-perm-row">
+                <input
+                  type="radio"
+                  name="cg-field-perm"
+                  data-overlay-autofocus={mode === "personal" ? true : undefined}
+                  checked={permDraft === mode}
+                  onChange={() => setPermDraft(mode)}
+                />
+                <FieldPermMark mode={mode} />
+                <span className="cg-perm-label">
+                  {FIELD_EDIT_LABELS[mode]}
+                  <span className="cg-perm-blurb">{FIELD_EDIT_BLURBS[mode]}</span>
+                </span>
+              </label>
+            ))}
+            {permDraft === "users" && (
+              <div className="cg-perm-users">
+                {permissionUserOptions.length === 0 ? (
+                  <span className="cg-perm-empty">No other accounts to pick. This will save as Personal.</span>
+                ) : permissionUserOptions.map((person) => (
+                  <label key={person.username} className="cg-perm-user">
+                    <input
+                      type="checkbox"
+                      checked={permUsers.includes(person.username.toLowerCase())}
+                      onChange={(event) => setPermUsers((current) => event.target.checked
+                        ? [...current, person.username.toLowerCase()].slice(0, 50)
+                        : current.filter((user) => user !== person.username.toLowerCase()))}
+                    />
+                    <span>{person.name || person.username}</span>
+                  </label>
+                ))}
+                {permissionUserOptions.length > 0 && permUsers.length === 0 && (
+                  <span className="cg-perm-empty">Pick at least one person, or this saves as Personal.</span>
+                )}
+              </div>
+            )}
           </div>
-          {(
-            [
-              ["everyone", "Everyone"],
-              ["creator", "Only the creator"],
-              ["admins", "Only admins"],
-            ] as const
-          ).map(([value, text]) => (
-            <label key={value} className="cg-radio-row">
-              <input
-                type="radio"
-                name="cg-perm"
-                data-overlay-autofocus={value === "everyone" ? true : undefined}
-                checked={permDraft === value}
-                onChange={() => setPermDraft(value)}
-              />
-              <span>{text}</span>
-            </label>
-          ))}
           <div className="cg-form-actions">
             <button
               type="button"
               className="cg-btn cg-btn--primary"
-              disabled={permDraft === (field.permissions?.edit ?? "everyone")}
+              disabled={JSON.stringify({ edit: permDraft, users: permDraft === "users" ? permUsers : undefined }) ===
+                JSON.stringify(cleanFieldPermissions(field.permissions, "collaborative"))}
               onClick={() => {
-                onPermissions?.(permDraft);
+                onPermissions?.(cleanFieldPermissions({ edit: permDraft, users: permUsers }, "personal"));
                 onClose();
               }}
             >

web/src/customer-grid/CustomerGrid.tsx

@@ -7831,7 +7831,7 @@ function CustomerGridSurface({
           onPermissions={
             // Creatable strata only; ColumnMenu further gates on the viewer (creator/admin).
             menuField.custom
-              ? (edit) => saveField({ ...menuField, permissions: { edit } })
+              ? (permissions) => saveField({ ...menuField, permissions })
               : undefined
           }
           onFormat={(format) => saveField({ ...menuField, format })}
@@ -7885,7 +7885,8 @@ function CustomerGridSurface({
           }
           onGroupByField={() => updateConfig({ ...config, groupBy: menuField.key })}
           onClearGroup={() => updateConfig({ ...config, groupBy: null })}
-          userOptions={payload?.userOptions ?? []}
+            userOptions={payload?.userOptions ?? []}
+            permissionUserOptions={payload?.permissionUserOptions ?? []}
           measures={measures}
           /* ⭐⭐ W39-T17 — THE TABLE HALF OF A FIELD SHARE'S OID, and it is deliberately NOT the
              `storageKey` const above. That one carries two spellings the share door cannot use:

web/src/customer-grid/types.ts

@@ -1566,10 +1566,50 @@ export function clampFrozenCount(n: unknown): number | undefined {
  * Wave-5 item 1 — who is looking. Host-computed; a payload without one behaves as before for
  * unrestricted fields, and FAIL-CLOSED for anything permission-restricted.
  */
-export interface Viewer {
-  name: string;
-  isAdmin: boolean;
-}
+export interface Viewer {
+  name: string;
+  isAdmin: boolean;
+}
+
+export const FIELD_EDIT_MODES = ["personal", "collaborative", "users"] as const;
+export type FieldEditMode = (typeof FIELD_EDIT_MODES)[number];
+export interface FieldPermissions {
+  edit: FieldEditMode;
+  users?: string[];
+}
+export type StoredFieldPermissions = {
+  edit: FieldEditMode | "everyone" | "creator" | "admins";
+  users?: string[];
+};
+export const FIELD_EDIT_LABELS: Record<FieldEditMode, string> = {
+  personal: "Personal",
+  collaborative: "Collaborative",
+  users: "Specific",
+};
+export const FIELD_EDIT_BLURBS: Record<FieldEditMode, string> = {
+  personal: "Only you can change this field.",
+  collaborative: "Anyone who can see this table can change it.",
+  users: "Only the people you pick can change it.",
+};
+
+export function cleanFieldPermissions(raw: unknown, fallback: FieldEditMode): FieldPermissions {
+  const bag = raw && typeof raw === "object" && !Array.isArray(raw)
+    ? raw as Record<string, unknown> : {};
+  const aliases: Record<string, FieldEditMode> = {
+    everyone: "collaborative", creator: "personal", admins: "personal",
+    personal: "personal", collaborative: "collaborative", users: "users",
+  };
+  const edit = aliases[String(bag.edit ?? "").toLowerCase()] ?? fallback;
+  if (edit !== "users") return { edit };
+  const users = Array.isArray(bag.users)
+    ? [...new Set(bag.users.map((u) => String(u ?? "").trim().toLowerCase()).filter(Boolean))].slice(0, 50)
+    : [];
+  return users.length ? { edit, users } : { edit: "personal" };
+}
+
+export function fieldEditMode(field: Pick<Field, "permissions">): FieldEditMode {
+  return cleanFieldPermissions(field.permissions, "collaborative").edit;
+}
 
 /**
  * May this viewer EDIT this field's cell values? The client-side COURTESY check — it decides
@@ -1595,11 +1635,15 @@ export function mayEditField(field: Field, viewer: Viewer | undefined): boolean
   // the VALUES stayed open to anyone with grid access. The stage and profile columns are
   // excluded inside `isMachineWritten` — both are cells a human is *supposed* to drive.
   if (isMachineWritten(field)) return false;
-  const edit = field.permissions?.edit ?? "everyone";
-  if (edit === "everyone") return true;
-  if (!viewer) return false;
-  if (viewer.isAdmin) return true;
-  return edit === "creator" && field.createdBy === viewer.name;
+  const permissions = cleanFieldPermissions(field.permissions, "collaborative");
+  const edit = permissions.edit;
+  if (!viewer) return false;
+  if (viewer.isAdmin) return true;
+  if (edit === "collaborative") return true;
+  return field.createdBy === viewer.name ||
+    (edit === "users" && (permissions.users ?? []).some(
+      (user) => user.toLowerCase() === viewer.name.toLowerCase()
+    ));
 }
 
 /**
@@ -2073,7 +2117,7 @@ export interface Field {
    * everyone. The client HIDES what the viewer may not do (menu entries, editable cells); the
    * HOST check is the wall — fail-closed, enforced on overlay_patch and field_upsert.
    */
-  permissions?: { edit: "everyone" | "creator" | "admins" };
+  permissions?: StoredFieldPermissions;
   /**
    * Wave-5 item 10 — display format, fail-closed per type (unknown keys dropped host-side):
    *   number/currency: { thousands, decimals (0..4), abbrev ("34.0M") }
@@ -3582,11 +3626,11 @@ export interface ViewPermissions {
   users?: string[];
 }
 
-export const VIEW_EDIT_LABELS: Record<ViewEditMode, string> = {
-  personal: "Personal",
-  collaborative: "Collaborative",
-  users: "Specific users",
-};
+export const VIEW_EDIT_LABELS: Record<ViewEditMode, string> = {
+  personal: "Personal",
+  collaborative: "Collaborative",
+  users: "Specific",
+};
 
 /** What each choice actually means, in the create prompt. A permission the user cannot
  *  predict the effect of is a permission they will set wrong. */
@@ -3892,7 +3936,8 @@ export interface GridWorkspace {
   measureSets?: Record<string, number[]>;
   derived?: Record<string, Record<string, string | number | null>>;
   viewer?: Viewer;
-  userOptions?: string[];
+  userOptions?: string[];
+  permissionUserOptions?: { username: string; name: string }[];
   /**
    * C-AVATAR (wave 14, item 11) — username → avatar data URL, served BESIDE `userOptions` so the
    * grid's `user` cells, the record modal and every people picker read one map rather than three
@@ -3974,7 +4019,8 @@ export interface CustomersPayload {
   limits?: GridLimit[];
   /** Assignable people for `user` fields — supplied by the host from the tenant's real user
    *  list, never invented client-side, so an assignee is always someone who can log in. */
-  userOptions?: string[];
+  userOptions?: string[];
+  permissionUserOptions?: { username: string; name: string }[];
   /**
    * The TENANT'S today, as an ISO date — the anchor every relative date resolves against.
    *

web/src/customer-grid/useCustomerData.ts

@@ -111,8 +111,9 @@ function withWorkspace(payload: CustomersPayload, ws: GridWorkspace): CustomersP
     const extra = ws.limits.filter((l) => l && l.subject && !seen.has(l.subject));
     if (extra.length) out.limits = [...(payload.limits ?? []), ...extra];
   }
-  if (ws.viewer && typeof ws.viewer.name === "string") out.viewer = ws.viewer;
-  if (Array.isArray(ws.userOptions)) out.userOptions = ws.userOptions;
+  if (ws.viewer && typeof ws.viewer.name === "string") out.viewer = ws.viewer;
+  if (Array.isArray(ws.userOptions)) out.userOptions = ws.userOptions;
+  if (Array.isArray(ws.permissionUserOptions)) out.permissionUserOptions = ws.permissionUserOptions;
   const derived = ws.derived;
   if (derived && typeof derived === "object" && Object.keys(derived).length > 0) {
     out.rows = payload.rows.map((r) => {

web/src/filter-kit/FieldsHidePanel.tsx

@@ -25,7 +25,7 @@ import type { Field } from "../customer-grid/types";
 // miniature, where what a user searches and what they read answer the same question
 // differently. It lives in `types.ts` so the node harness can run it: this panel is JSX and
 // its search path only fires once somebody types, which no static render can do.
-import { fieldLabel, isPresetField } from "../customer-grid/types";
+import { fieldEditMode, fieldLabel, isPresetField } from "../customer-grid/types";
 import { FieldTypeIcon } from "../customer-grid/icons";
 import { TYPE_LABELS } from "../customer-grid/iconShapes";
 
@@ -85,6 +85,14 @@ export function FieldsHidePanel({
   const [overKey, setOverKey] = useState<string | null>(null);
   const q = query.trim().toLowerCase();
   const shown = q ? fields.filter((f) => fieldLabel(f).toLowerCase().includes(q)) : fields;
+  const sections = [
+    { key: "personal", title: "", fields: shown.filter((field) =>
+      (!field.custom && !field.shared) || fieldEditMode(field) === "personal") },
+    { key: "me", title: "Shared with me", fields: shown.filter((field) =>
+      (field.custom || field.shared) && fieldEditMode(field) === "users") },
+    { key: "everyone", title: "Shared with everyone", fields: shown.filter((field) =>
+      (field.custom || field.shared) && fieldEditMode(field) === "collaborative") },
+  ];
   /**
    * Item 23 — reorder is OFF while a search is narrowing the list. Dropping "City" above
    * "State" in a list that is hiding the eight fields between them means nothing the user can
@@ -134,7 +142,10 @@ export function FieldsHidePanel({
         onChange={(e) => setQuery(e.target.value)}
       />
       <div className="cg-pop-list">
-        {shown.map((f) => {
+        {sections.map((section) => (
+          <div key={section.key} className="cg-fields-section">
+            {section.title && <div className="cg-fields-section-title">{section.title}</div>}
+            {section.fields.map((f) => {
           const locked = lockedKey !== undefined && f.key === lockedKey;
           const on = !hidden.has(f.key);
           const deletable = !!onDeleteField && !!deletableKeys?.has(f.key);
@@ -303,7 +314,9 @@ export function FieldsHidePanel({
               )}
             </label>
           );
-        })}
+            })}
+          </div>
+        ))}
         {shown.length === 0 && (
           <div className="cg-builder-empty">No field matches your search.</div>
         )}

web/src/index.css

@@ -1911,13 +1911,26 @@ body > .cg-overlay {
   border-radius: var(--lp-r-md);
   background: var(--lp-surface-2);
 }
-.cg-fields-footer .cg-link-btn:hover {
+.cg-fields-footer .cg-link-btn:hover {
   /* on the grey tray the blue-tint hover reads as a selection; white reads as "this is the
      button", which is what a hover on a tray needs to say. */
-  background: var(--lp-surface);
-}
-
-/* search */
+  background: var(--lp-surface);
+}
+.cg-fields-section + .cg-fields-section {
+  margin-top: 10px;
+  padding-top: 8px;
+  border-top: 1px solid var(--lp-line);
+}
+.cg-fields-section-title {
+  padding: 0 10px 5px;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-3xs);
+  font-weight: 700;
+  letter-spacing: .04em;
+  text-transform: uppercase;
+}
+
+/* search */
 .cg-search {
   position: relative;
   display: inline-flex;