Deploy AIOS web (React glide grid + FastAPI slice)

api/main.py

@@ -61,6 +61,7 @@ import routes_automation  # noqa: E402  (wave 18 C4-AUTO — SESSION D's router,
 import routes_customers  # noqa: E402
 import routes_grid  # noqa: E402
 import routes_keychain  # noqa: E402  (wave 18 C7 — keychain + connectors admin surfaces)
+import routes_statements  # noqa: E402  (EXIT-6 — the statement sender, off Streamlit)
 import routes_nav  # noqa: E402
 import routes_pages  # noqa: E402
 import routes_platform_admin  # noqa: E402  (wave 19 R3/R4 — the Loopable cross-tenant plane)
@@ -179,6 +180,7 @@ app.include_router(routes_pages.router)
 app.include_router(routes_admin.router)
 app.include_router(routes_automation.router)
 app.include_router(routes_keychain.router)
+app.include_router(routes_statements.router)
 # Wave 19 (owner item 13, R3): the LOOPABLE admin plane — the platform's own cross-tenant view.
 # Its own prefix (`/api/v1/platform-admin`), never nested under `/admin`, so there is no path
 # ambiguity with `routes_admin`'s `{username}` params and no chance of a tenant-admin route and a

api/routes_statements.py

@@ -0,0 +1,168 @@
+"""routes_statements.py — the statement-of-account sender, ported off Streamlit (EXIT-6).
+
+⛔ THIS IS THE ONE SANCTIONED ODOO WRITER IN THE ENTIRE SYSTEM. Everything else in AIOS is
+read-only on Odoo by hard block. `modules/collections_send.py` owns a narrow client that whitelists
+exactly `mail.mail create` (queueing an outbound email) and nothing else; these routes call it and
+add no write of their own.
+
+WHY IT EXISTS SEPARATELY FROM THE COLLECTIONS PAGE. Owner ruling wave-17 item 15 retired the
+Collections *dashboard* — the worklist is the shared "Collections" view on the Customer grid, from
+the same reconciled blocks. What that ruling explicitly left "untouched" is this send workflow, so
+when `app.py` is deleted it is the ONLY live Streamlit-only feature, and it moves here rather than
+dying with the host. Ported faithfully: same tiers, same filters, same template placeholders, same
+preview, same test-send, same two-step confirm.
+
+THE THREE GUARDRAILS, and where each is enforced:
+  1. SAFE_MODE (default ON) — in the DATA LAYER (`collections_send.queue_statement`), so no route,
+     payload or UI can bypass it. These routes only REPORT it; they never re-implement the check.
+  2. Admin only — `admin_gate` (role, fail-closed), mirroring the Streamlit `if not is_admin()`.
+  3. ⭐ TENANT — NEW HERE, and it did not exist in Streamlit because it could not. `cs_mod.Odoo()`
+     reads Odoo credentials from the ENVIRONMENT, which after the keychain cutover belongs to
+     TENANT #0 ALONE. On the multi-tenant API an unguarded route would let a nurilab or gtmlab
+     admin queue mail from Royal Imports' Odoo, as Royal Imports. `_royal_only` closes that; the
+     single-tenant Streamlit host never had the exposure, so this is a port that must ADD a wall
+     rather than copy one.
+
+NOTHING SENDS ON A GET. The send route requires an explicit customer list in the body; there is no
+"send all" parameter, deliberately — the confirm step is a product requirement, not a formality.
+"""
+from fastapi import APIRouter, Body, Depends
+
+from deps import Session, err
+from routes_admin import admin_gate
+
+router = APIRouter(prefix="/api/v1")
+
+#: Cache the Odoo follow-up pull briefly. The Streamlit page used `@st.cache_data(ttl=1800)`; the
+#: list moves slowly (it is a dunning worklist, not a live feed) and the pull is a multi-model read.
+_TTL = 1800
+_cache = {"at": 0.0, "rows": None}
+
+
+def _cs():
+    import modules.collections_send as cs
+    return cs
+
+
+def _royal_only(session: Session) -> Session:
+    """⛔ See the module docstring, guardrail 3. The send client is env-credentialed, so it is
+    tenant #0's and only tenant #0's. Refuse for anyone else rather than send as the wrong company.
+
+    Keyed on the runtime, never on a request field: a tenant is a property of the SESSION."""
+    if getattr(session.runtime, "key", None) != "royal-imports":
+        raise err(404, "not_found", "statements are not configured for this workspace")
+    return session
+
+
+def _gate(session: Session = Depends(admin_gate)) -> Session:
+    return _royal_only(session)
+
+
+def _rows(force=False):
+    import time
+    cs = _cs()
+    if force or _cache["rows"] is None or (time.time() - _cache["at"]) > _TTL:
+        _cache["rows"] = cs.load_collection_list(cs.Odoo())
+        _cache["at"] = time.time()
+    return _cache["rows"], time.strftime("%Y-%m-%d %H:%M", time.localtime(_cache["at"]))
+
+
+def _public(row):
+    """Strip the internals the Streamlit grid also hid (`_`-prefixed + partner_id is kept, because
+    the client needs a stable row identity that is not the display name)."""
+    return {k: v for k, v in row.items() if not str(k).startswith("_")}
+
+
+@router.get("/admin/statements")
+def statements(refresh: int = 0, session: Session = Depends(_gate)):
+    """The worklist + everything the sender UI needs to render itself honestly."""
+    cs = _cs()
+    try:
+        rows, loaded_at = _rows(force=bool(refresh))
+    except Exception as e:
+        raise err(502, "odoo_unavailable", f"could not load the collection list: {str(e)[:200]}")
+    return {
+        "rows": [_public(r) for r in rows],
+        "loadedAt": loaded_at,
+        # The guardrail is reported, never decided, here — the data layer owns it.
+        "safeMode": bool(cs.SAFE_MODE),
+        "safeRecipients": sorted(cs.SAFE_RECIPIENTS),
+        "sender": {"name": cs.SENDER_NAME, "email": cs.SENDER_EMAIL,
+                   "replyTo": cs.REPLY_TO, "company": cs.COMPANY},
+        "templates": {"subject": cs.DEFAULT_SUBJECT, "intro": cs.DEFAULT_INTRO,
+                      "footer": cs.DEFAULT_FOOTER},
+        "tiers": ["A-Urgent", "B-Active", "C-Light", "Monitor"],
+    }
+
+
+def _find(rows, customer):
+    return next((r for r in rows if r.get("Customer") == customer), None)
+
+
+@router.post("/admin/statements/preview")
+def preview(body: dict = Body(default=None), session: Session = Depends(_gate)):
+    """Render ONE customer's statement exactly as the send path would."""
+    cs = _cs()
+    body = body or {}
+    rows, _ = _rows()
+    row = _find(rows, body.get("customer"))
+    if row is None:
+        raise err(404, "not_found", "no such customer on the collection list")
+    t = body.get("templates") or {}
+    import datetime as dt
+    month = dt.date.today().strftime("%B %Y")
+    subject = (t.get("subject") or cs.DEFAULT_SUBJECT)
+    try:
+        subject = subject.format(customer=row["Customer"], company=cs.COMPANY, month=month)
+    except (KeyError, IndexError):
+        # An unknown placeholder is the user's typo, not a 500. Show the template verbatim so they
+        # can see what they typed rather than getting an opaque error.
+        pass
+    return {
+        "html": cs.render_statement_html(row, t.get("intro") or cs.DEFAULT_INTRO,
+                                         t.get("footer") or cs.DEFAULT_FOOTER),
+        "to": row.get("Email") or "",
+        "subject": subject,
+    }
+
+
+@router.post("/admin/statements/send")
+def send(body: dict = Body(default=None), session: Session = Depends(_gate)):
+    """Queue statements. Returns per-customer outcomes — NEVER a bare count.
+
+    `overrideTo` is the test-send path: one customer, one address. SAFE_MODE still applies (the
+    data layer refuses an address outside the allow-list), which is why the route does not check it.
+    """
+    cs = _cs()
+    body = body or {}
+    names = [str(n) for n in (body.get("customers") or []) if str(n).strip()]
+    if not names:
+        raise err(400, "bad_request", "name at least one customer")
+    override = (body.get("overrideTo") or "").strip() or None
+    if override and len(names) != 1:
+        raise err(400, "bad_request", "a test send takes exactly one customer")
+    t = body.get("templates") or {}
+    rows, _ = _rows()
+
+    sent, failed, skipped = [], [], []
+    for name in names:
+        row = _find(rows, name)
+        if row is None:
+            failed.append({"customer": name, "error": "not on the current collection list"})
+            continue
+        if not override and not row.get("Email"):
+            # The Streamlit page warned and skipped these. Reporting them SEPARATELY from failures
+            # keeps "we could not" distinct from "there was nowhere to send".
+            skipped.append({"customer": name, "reason": "no email address on the customer record"})
+            continue
+        try:
+            mid = cs.queue_statement(cs.Odoo(), row, t.get("subject") or cs.DEFAULT_SUBJECT,
+                                     t.get("intro") or cs.DEFAULT_INTRO,
+                                     t.get("footer") or cs.DEFAULT_FOOTER, override_to=override)
+            sent.append({"customer": name, "to": override or row.get("Email"), "mailId": mid})
+        except Exception as e:
+            # SafeModeBlocked lands here too, and that is correct: to the caller a guardrail refusal
+            # and an Odoo error are both "this one did not go", each with its own honest message.
+            failed.append({"customer": name, "error": str(e)[:200]})
+    return {"sent": sent, "failed": failed, "skipped": skipped,
+            "safeMode": bool(cs.SAFE_MODE), "test": bool(override)}

platform/core/grid_events.py

@@ -13,13 +13,17 @@ Streamlit couplings the contract names:
     is_admin()  (the bare call inside doc_delete, and _cl_table_workspace's admin=None default)
                                             -> ctx.admin
 
-There is NO `import streamlit` in this file and there must never be one — `verify_seam.py`
+There is NO `import streamlit` in this file and there must never be one — `verify_no_streamlit.py`
 enforces that with a `sys.meta_path` block, which is the only proof that survives refactoring.
-
-TWO ADAPTERS, ONE HANDLER:
-  * the Streamlit adapter — app.py keeps `_cl_handle_grid_event(event, uname, allowed_pids, …)`
-    with its old name and signature, builds an EventCtx whose `seen_ids` and `fallback_ws` are
-    session-state-backed dicts, and applies the Result to session state.
+(That gate was `verify_seam.py` until EXIT-6 retired it with `app.py`; the block, its negative
+control and the AST walk moved over intact.)
+
+ONE ADAPTER, ONE HANDLER — it was TWO until 2026-08-04:
+  * ⛔ the Streamlit adapter is GONE. `app.py::_cl_handle_grid_event` built an EventCtx whose
+    `seen_ids` and `fallback_ws` were session-state-backed dicts and applied the Result to session
+    state. EXIT-6 deleted it. The host-neutrality this file was written for is what let that
+    happen without touching a line of the handler — which is the argument for the design, recorded
+    at the moment it paid out.
   * the HTTP adapter — `aios-web/api` builds an EventCtx with `fallback_ws=None`. A None
     fallback with the store unavailable is a **503**, never a silent in-memory workspace: an
     API request has no durable session dict to fall back to, so pretending to persist would

requirements.txt

@@ -1,16 +1,26 @@
-# AIOS web API — the FastAPI backend + the platform data-layer deps it reuses.
-# (streamlit is included only because the shared modules/core may import it at load; it is never
-# run here. No altair/plotly/openpyxl/reportlab — those are Streamlit-UI/export only.)
-fastapi>=0.139
-uvicorn[standard]>=0.30
-python-dotenv>=1.0
-pandas>=2.0
-requests>=2.28
-huggingface_hub>=0.20
-duckdb>=1.0
-pyyaml>=6.0
-streamlit==1.58.0
-pillow>=10.0
-beautifulsoup4>=4.12
-lxml>=5.0
-cryptography>=42.0
+# AIOS web API — the FastAPI backend + the platform data-layer deps it reuses.
+#
+# ⛔ STREAMLIT IS GONE (EXIT-6, 2026-08-04) — do not add it back. The line here read
+# `streamlit==1.58.0` with the comment "included only because the shared modules/core may import
+# it at load; it is never served". That stopped being true when the shared layer was cleaned, and
+# it stayed in THIS file — the one the Dockerfile actually installs — while `api/requirements.txt`
+# had already dropped it and a gate reported the omission "verified". ~250 MB of image for a
+# package nothing imported.
+#
+# The lesson is the file, not the package: the PINNED intent and the SHIPPED manifest are two
+# different documents, and checking only the one you wrote is how the other rots.
+# `api/verify_no_streamlit.py` now checks BOTH, and proves the API imports with streamlit,
+# plotly, altair, openpyxl, reportlab and jinja2 all blocked at sys.meta_path.
+# No altair/plotly/openpyxl/reportlab either — those were Streamlit UI/export only.
+fastapi>=0.139
+uvicorn[standard]>=0.30
+python-dotenv>=1.0
+pandas>=2.0
+requests>=2.28
+huggingface_hub>=0.20
+duckdb>=1.0
+pyyaml>=6.0
+pillow>=10.0
+beautifulsoup4>=4.12
+lxml>=5.0
+cryptography>=42.0

web/src/index.css

@@ -8199,3 +8199,106 @@ a.cg-map-ctl-b { text-decoration: none; }
   }
 }
 /* == /W19-D == */
+
+/* == EXIT-6 STATEMENTS == */
+/* `settings/StatementsPane.tsx` — the statement-of-account sender, ported off
+   `app.py::_collections_statements` when Streamlit was deleted.
+
+   ⛔ WHY THE TABLE RULES ARE `stmt-` AND NOT `set-table`. The accounts table was
+   removed in wave 17 (R7) and its rules deliberately went with it, with a note
+   in this file saying a dead rule with a plausible name is worse than no rule
+   because the next thing needing a table adopts decisions nobody made for it.
+   This IS that next thing, so it declares its own, named for its one purpose.
+
+   Quiet by intent: this pane ends in a control that emails real customers, so
+   nothing here competes with the confirm block for attention. */
+.stmt-row { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin: 12px 0 0; }
+.stmt-row .set-input { width: auto; min-width: 180px; flex: 1 1 180px; }
+.stmt-small { margin-top: 6px; }
+.stmt-stack { display: flex; flex-direction: column; gap: 10px; margin-top: 12px; }
+.stmt-wide { width: 100%; }
+.stmt-link {
+  margin-top: 14px;
+  padding: 0;
+  border: 0;
+  background: none;
+  color: var(--lp-blue-deep);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  cursor: pointer;
+  text-align: left;
+}
+.stmt-textarea {
+  width: 100%;
+  padding: 8px 10px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-surface);
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  line-height: var(--lp-lh);
+  resize: vertical;
+}
+/* The worklist scrolls INSIDE its own box. A dunning list is hundreds of rows and
+   the settings modal must not grow a second scrollbar for it. */
+.stmt-tablewrap {
+  margin-top: 12px;
+  max-height: 340px;
+  overflow: auto;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+}
+.stmt-tablewrap--short { max-height: 200px; }
+.stmt-table { width: 100%; border-collapse: collapse; font-size: var(--lp-fs-2xs); }
+.stmt-table th,
+.stmt-table td { padding: 6px 10px; text-align: left; border-bottom: 1px solid var(--lp-line); }
+/* Sticky head: scrolling 400 dunning rows without column labels is unreadable. */
+.stmt-table thead th {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  background: var(--lp-surface-2);
+  font-weight: 620;
+}
+.stmt-table tbody tr:last-child td { border-bottom: 0; }
+.stmt-table tbody tr.is-picked { background: var(--lp-blue-tint); }
+/* Money aligns right, everywhere in this product. */
+.stmt-num { text-align: right; font-variant-numeric: tabular-nums; }
+.stmt-table th.stmt-num { text-align: right; }
+/* ⚠ AMBER, NOT `.set-notice` (green) AND NOT `.set-error` (red). The SAFE_MODE
+   banner is neither success nor failure — it is a live restriction, and dressing
+   a guardrail in green is how somebody reads "ON" as "you are clear to send". */
+.stmt-warn {
+  margin: 0 0 12px;
+  padding: 9px 12px;
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-yellow-tint);
+  color: var(--lp-yellow-deep);
+  font-size: var(--lp-fs-2xs);
+  line-height: var(--lp-lh);
+}
+.stmt-details { margin-top: 10px; font-size: var(--lp-fs-2xs); }
+.stmt-details summary { cursor: pointer; font-weight: 600; }
+/* The rendered statement is OUR html from OUR template, but it is still foreign
+   markup inside a pane: box it so its own font sizes cannot reflow the modal. */
+.stmt-preview {
+  margin-top: 10px;
+  padding: 12px;
+  max-height: 320px;
+  overflow: auto;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-surface);
+}
+.stmt-preview img { max-width: 100%; }
+/* The confirm block is the loudest thing on the pane, on purpose. */
+.stmt-confirm {
+  margin-top: 16px;
+  padding: 12px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-surface-2);
+}
+.stmt-confirm .stmt-row { margin-top: 12px; }

web/src/settings/SettingsModal.tsx

@@ -56,6 +56,7 @@ import type { ConnectorRow, KeyEntry, UnsyncedInfo } from "./settingsApi";
 import { PermsEditor } from "./PermsEditor";
 // Wave 19 contract C2 — session D's self-contained plane; see the mount below.
 import { AdminPane } from "./AdminPane";
+import { StatementsPane } from "./StatementsPane";
 import { moduleSummary, parseEntry, reachableSection } from "./permsModel";
 
 // The vocabulary lives beside the rule that gates it (permsModel), and is
@@ -139,6 +140,14 @@ const IconKey = (
   </RailIcon>
 );
 /** Connectors — two links joined: where the data comes from. */
+/** Statements — an envelope. The one room in here that sends something OUT of
+ *  the building, so it wears the only outbound-shaped mark on the rail. */
+const IconMail = (
+  <RailIcon>
+    <path d="M2 4.5h12v7H2z" />
+    <path d="M2.4 5 8 9l5.6-4" />
+  </RailIcon>
+);
 const IconPlug = (
   <RailIcon>
     <path d="M6.6 9.4 4.5 11.5a2.6 2.6 0 0 1-3.7-3.7l2.1-2.1" />
@@ -717,6 +726,10 @@ export function SettingsModal({
           // Wave 18 (C7): the tenant's credential store + data-source status board.
           ["keychains", "Keychains", IconKey],
           ["connectors", "Connectors", IconPlug],
+          // EXIT-6: the statement sender, ported off app.py. Admin-only, and the
+          // server ALSO refuses it to any tenant but Royal (the send client is
+          // env-credentialed) — this entry is the courtesy, not the wall.
+          ["statements", "Statements", IconMail],
         ] as Array<[SettingsSection, string, ReactNode]>)
       : []),
     // Wave 19 (R3 / C2): the Loopable admin plane. Gated on the SERVER's
@@ -781,6 +794,7 @@ export function SettingsModal({
 
           {active === "keychains" ? <KeychainPane /> : null}
           {active === "connectors" ? <ConnectorsPane /> : null}
+          {active === "statements" ? <StatementsPane /> : null}
           {/* Wave 19 contract C2 — the wiring record, verified at the MOUNT SITE
               (the wave-14 lesson: an occurrence-grep proves an import, not a
               render): `settings/AdminPane.tsx → SettingsModal.tsx pane switch →

web/src/settings/StatementsPane.tsx

@@ -0,0 +1,392 @@
+// ---------------------------------------------------------------------------
+// settings / StatementsPane.tsx — the statement-of-account sender (EXIT-6).
+//
+// Ported off `app.py::_collections_statements` when Streamlit was deleted. Owner
+// ruling wave-17 item 15 retired the Collections DASHBOARD (it is the shared
+// "Collections" view on the Customer grid) but explicitly left this workflow
+// untouched — so it is the last live surface that had nowhere else to go.
+//
+// ⛔ THIS IS THE ONE SANCTIONED ODOO WRITER. Queueing these emails is the only
+// write the product performs, so the original's shape is preserved deliberately
+// rather than modernised: review → tick → preview → test → CONFIRM → send. The
+// confirm step is a product requirement, not a formality, and the send button is
+// disabled while SAFE_MODE is on exactly as the Streamlit page had it.
+//
+// ⚠ THE GUARDRAIL IS THE SERVER'S. Everything this file does with `safeMode` is
+// presentation: disabling a control and explaining why. `collections_send`
+// refuses an out-of-allow-list recipient in the data layer, which is what makes
+// the guarantee real. Never read the disabled button as the enforcement.
+// ---------------------------------------------------------------------------
+import { useCallback, useEffect, useMemo, useState } from "react";
+
+import {
+  loadStatements,
+  previewStatement,
+  sendStatements,
+  type SendOutcome,
+  type StatementRow,
+  type StatementTemplates,
+  type StatementsPayload,
+} from "./statementsApi";
+
+const money = (n: number) =>
+  `$${Math.round(Number(n) || 0).toLocaleString("en-US")}`;
+
+/** The tiers the original defaulted ON. "Monitor" = open receivable but nothing
+ *  overdue, and the Streamlit page excluded it by default for that reason. */
+const DEFAULT_TIERS = ["A-Urgent", "B-Active", "C-Light"];
+
+export function StatementsPane() {
+  const [data, setData] = useState<StatementsPayload | null>(null);
+  const [err, setErr] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [tiers, setTiers] = useState<string[]>(DEFAULT_TIERS);
+  const [emailOnly, setEmailOnly] = useState(true);
+  const [search, setSearch] = useState("");
+  const [picked, setPicked] = useState<Set<string>>(new Set());
+  const [tpl, setTpl] = useState<StatementTemplates | null>(null);
+  const [showTpl, setShowTpl] = useState(false);
+  const [previewOf, setPreviewOf] = useState("");
+  const [preview, setPreview] = useState<{ html: string; to: string; subject: string } | null>(null);
+  const [testTo, setTestTo] = useState("");
+  const [confirming, setConfirming] = useState(false);
+  const [result, setResult] = useState<SendOutcome | null>(null);
+
+  const reload = useCallback(async (refresh = false) => {
+    setBusy(true);
+    const r = await loadStatements(refresh);
+    setBusy(false);
+    if (!r.ok) { setErr(r.message); return; }
+    setErr("");
+    setData(r.data);
+    setTpl((t) => t ?? r.data.templates);
+    setTestTo((v) => v || (r.data.safeMode ? (r.data.safeRecipients[0] ?? "") : ""));
+  }, []);
+
+  useEffect(() => { void reload(false); }, [reload]);
+
+  const view = useMemo(() => {
+    if (!data) return [] as StatementRow[];
+    const s = search.trim().toLowerCase();
+    return data.rows.filter(
+      (r) =>
+        tiers.includes(r.Tier) &&
+        (!emailOnly || !!r.Email) &&
+        (!s || r.Customer.toLowerCase().includes(s)),
+    );
+  }, [data, tiers, emailOnly, search]);
+
+  // The selection follows the FILTER: a customer ticked and then filtered out
+  // must not ride along invisibly into a send. Intersecting here (rather than
+  // pruning on every filter change) keeps that true without fighting the user's
+  // ticks when they widen the filter again.
+  const selected = useMemo(
+    () => view.filter((r) => picked.has(r.Customer)),
+    [view, picked],
+  );
+  const sendable = useMemo(() => selected.filter((r) => r.Email), [selected]);
+  const noEmail = useMemo(() => selected.filter((r) => !r.Email), [selected]);
+
+  const previewRow = previewOf || selected[0]?.Customer || view[0]?.Customer || "";
+
+  useEffect(() => {
+    if (!previewRow || !tpl) { setPreview(null); return; }
+    let live = true;
+    void previewStatement(previewRow, tpl).then((r) => {
+      if (live) setPreview(r.ok ? r.data : null);
+    });
+    return () => { live = false; };
+  }, [previewRow, tpl]);
+
+  const toggle = (name: string) =>
+    setPicked((p) => {
+      const n = new Set(p);
+      if (n.has(name)) n.delete(name); else n.add(name);
+      return n;
+    });
+
+  const doSend = async (customers: string[], overrideTo?: string) => {
+    if (!tpl || !customers.length) return;
+    setBusy(true);
+    const r = await sendStatements(customers, tpl, overrideTo);
+    setBusy(false);
+    setConfirming(false);
+    if (!r.ok) { setErr(r.message); return; }
+    setErr("");
+    setResult(r.data);
+    if (!overrideTo) setPicked(new Set());
+  };
+
+  if (!data && !err) return <p className="set-help">Loading the collection list…</p>;
+
+  return (
+    <div className="set-pane">
+      <h3 className="set-h">Statements</h3>
+      <p className="set-pane-intro set-help">
+        Queue per-customer statement-of-account emails. The list is the Odoo follow-up filter
+        (Reminders = Automatic, receivable over $1, GIFTWARE excluded), tiered by urgency.
+        Statements send as <b>{data?.sender.name}</b> through the Odoo mail queue (Office 365
+        relay, ~15 min); every send is logged on the customer chatter in Odoo. Queueing these
+        emails is the only write this app can perform, and nothing sends without the confirm step.
+      </p>
+
+      {data?.safeMode ? (
+        <div className="stmt-warn">
+          <b>Testing guardrail is ON</b> — email can only go to{" "}
+          {data.safeRecipients.join(", ")}. Bulk send to customers is disabled. This is enforced
+          in the data layer, not by this screen; set the Space secret <code>SAFE_MODE=0</code> to
+          go live.
+        </div>
+      ) : null}
+      {err ? <div className="set-error">{err}</div> : null}
+
+      {data ? (
+        <>
+          <div className="stmt-row">
+            {data.tiers.map((t) => (
+              <label key={t} className="set-chip">
+                <input
+                  type="checkbox"
+                  checked={tiers.includes(t)}
+                  onChange={() =>
+                    setTiers((cur) =>
+                      cur.includes(t) ? cur.filter((x) => x !== t) : [...cur, t],
+                    )
+                  }
+                />
+                {t}
+              </label>
+            ))}
+            <label className="set-chip">
+              <input
+                type="checkbox"
+                checked={emailOnly}
+                onChange={(e) => setEmailOnly(e.currentTarget.checked)}
+              />
+              Has email only
+            </label>
+            <input
+              className="set-input"
+              placeholder="Search customer"
+              value={search}
+              onChange={(e) => setSearch(e.currentTarget.value)}
+            />
+            <button className="set-secondary" disabled={busy} onClick={() => void reload(true)}>
+              Refresh from Odoo
+            </button>
+          </div>
+          <p className="set-help stmt-small">
+            Data as of {data.loadedAt}. “Monitor” customers have open receivables but nothing
+            overdue — usually excluded from monthly statements.
+          </p>
+
+          <button className="stmt-link" onClick={() => setShowTpl((v) => !v)}>
+            {showTpl ? "Hide" : "Show"} statement template (applies to every send below)
+          </button>
+          {showTpl && tpl ? (
+            <div className="stmt-stack">
+              <label className="set-label">
+                Subject <span className="set-help">— placeholders: {"{customer} {company} {month}"}</span>
+                <input
+                  className="set-input stmt-wide"
+                  value={tpl.subject}
+                  onChange={(e) => setTpl({ ...tpl, subject: e.currentTarget.value })}
+                />
+              </label>
+              <label className="set-label">
+                Intro (HTML ok)
+                <textarea
+                  className="stmt-textarea"
+                  rows={4}
+                  value={tpl.intro}
+                  onChange={(e) => setTpl({ ...tpl, intro: e.currentTarget.value })}
+                />
+              </label>
+              <label className="set-label">
+                Footer (HTML ok)
+                <textarea
+                  className="stmt-textarea"
+                  rows={4}
+                  value={tpl.footer}
+                  onChange={(e) => setTpl({ ...tpl, footer: e.currentTarget.value })}
+                />
+              </label>
+            </div>
+          ) : null}
+
+          <div className="stmt-tablewrap">
+            <table className="stmt-table">
+              <thead>
+                <tr>
+                  <th style={{ width: 44 }}>Send</th>
+                  <th>Customer</th>
+                  <th>Email</th>
+                  <th>Tier</th>
+                  <th className="stmt-num">Overdue</th>
+                  <th className="stmt-num">Receivable</th>
+                </tr>
+              </thead>
+              <tbody>
+                {view.map((r) => (
+                  <tr key={r.Customer} className={picked.has(r.Customer) ? "is-picked" : undefined}>
+                    <td>
+                      <input
+                        type="checkbox"
+                        aria-label={`Send to ${r.Customer}`}
+                        checked={picked.has(r.Customer)}
+                        onChange={() => toggle(r.Customer)}
+                      />
+                    </td>
+                    <td>{r.Customer}</td>
+                    <td className={r.Email ? undefined : "set-muted"}>{r.Email || "(no email)"}</td>
+                    <td>{r.Tier}</td>
+                    <td className="stmt-num">{money(r.Overdue)}</td>
+                    <td className="stmt-num">{money(r.Receivable)}</td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+            {/* Owner rule [[no-unverifiable-aggregates]]: state the denominator, always. */}
+            <p className="set-help stmt-small">
+              Showing {view.length} of {data.rows.length} customers · {selected.length} selected ·
+              combined overdue {money(selected.reduce((a, r) => a + (Number(r.Overdue) || 0), 0))}.
+            </p>
+          </div>
+
+          {view.length ? (
+            <div className="stmt-stack">
+              <label className="set-label">
+                Preview customer
+                <select
+                  className="set-input"
+                  value={previewRow}
+                  onChange={(e) => setPreviewOf(e.currentTarget.value)}
+                >
+                  {(selected.length ? selected : view).map((r) => (
+                    <option key={r.Customer} value={r.Customer}>{r.Customer}</option>
+                  ))}
+                </select>
+              </label>
+              {preview ? (
+                <>
+                  <p className="set-help stmt-small">
+                    From: {data.sender.name} &lt;{data.sender.email}&gt; · reply-to{" "}
+                    {data.sender.replyTo} · To: {preview.to || "(no email)"} · Subject:{" "}
+                    {preview.subject}
+                  </p>
+                  <details className="stmt-details">
+                    <summary>Preview statement</summary>
+                    {/* Server-rendered from our own template + our own Odoo rows — the same
+                        HTML the send path posts. */}
+                    <div
+                      className="stmt-preview"
+                      dangerouslySetInnerHTML={{ __html: preview.html }}
+                    />
+                  </details>
+                </>
+              ) : null}
+
+              <div className="stmt-row">
+                <label className="set-label">
+                  Test address (sends the preview customer’s statement here)
+                  <input
+                    className="set-input stmt-wide"
+                    value={testTo}
+                    disabled={data.safeMode}
+                    title={data.safeMode ? "Locked to the guardrail address while testing." : undefined}
+                    onChange={(e) => setTestTo(e.currentTarget.value)}
+                  />
+                </label>
+                <button
+                  className="set-secondary"
+                  disabled={busy || !previewRow || !testTo.includes("@")}
+                  onClick={() => void doSend([previewRow], testTo)}
+                >
+                  Send test email
+                </button>
+              </div>
+            </div>
+          ) : (
+            <p className="set-help">No customers match the current filters.</p>
+          )}
+
+          {noEmail.length ? (
+            <div className="stmt-warn">
+              {noEmail.length} selected {noEmail.length === 1 ? "customer has" : "customers have"} no
+              email and will be skipped: {noEmail.slice(0, 5).map((r) => r.Customer).join(", ")}
+              {noEmail.length > 5 ? "…" : ""}
+            </div>
+          ) : null}
+
+          {result ? (
+            <div className={result.failed.length ? "set-warn" : "set-ok"}>
+              <b>
+                {result.sent.length} statement{result.sent.length === 1 ? "" : "s"} queued
+                {result.test ? " (test)" : ""} in Odoo
+              </b>{" "}
+              — delivery within ~15 min via the Office 365 relay; each send is logged on the
+              customer record.
+              {result.skipped.length ? (
+                <div>Skipped: {result.skipped.map((s) => `${s.customer} (${s.reason})`).join(" · ")}</div>
+              ) : null}
+              {result.failed.length ? (
+                <div>Failed: {result.failed.map((f) => `${f.customer}: ${f.error}`).join(" | ")}</div>
+              ) : null}
+            </div>
+          ) : null}
+
+          {/* ── the confirm flow ─────────────────────────────────────────── */}
+          {!confirming ? (
+            <button
+              className="set-primary"
+              disabled={busy || !sendable.length || data.safeMode}
+              title={data.safeMode ? "Disabled while the testing guardrail is on." : undefined}
+              onClick={() => { setResult(null); setConfirming(true); }}
+            >
+              Send {sendable.length} statement{sendable.length === 1 ? "" : "s"}…
+            </button>
+          ) : (
+            <div className="stmt-confirm">
+              <div className="stmt-warn">
+                About to queue <b>{sendable.length}</b> statements as {data.sender.name} (
+                {data.sender.email}), replies to {data.sender.replyTo} — combined overdue{" "}
+                {money(sendable.reduce((a, r) => a + (Number(r.Overdue) || 0), 0))}.{" "}
+                <b>This cannot be undone from here.</b>
+              </div>
+              <div className="stmt-tablewrap stmt-tablewrap--short">
+                <table className="stmt-table">
+                  <thead>
+                    <tr><th>Customer</th><th>Email</th><th className="stmt-num">Overdue</th></tr>
+                  </thead>
+                  <tbody>
+                    {sendable.map((r) => (
+                      <tr key={r.Customer}>
+                        <td>{r.Customer}</td>
+                        <td>{r.Email}</td>
+                        <td className="stmt-num">{money(r.Overdue)}</td>
+                      </tr>
+                    ))}
+                  </tbody>
+                </table>
+              </div>
+              <div className="stmt-row">
+                <button
+                  className="set-primary"
+                  disabled={busy}
+                  onClick={() => void doSend(sendable.map((r) => r.Customer))}
+                >
+                  {busy ? "Queueing…" : "Confirm and send"}
+                </button>
+                <button className="set-secondary" disabled={busy} onClick={() => setConfirming(false)}>
+                  Cancel
+                </button>
+              </div>
+            </div>
+          )}
+        </>
+      ) : null}
+    </div>
+  );
+}
+
+export default StatementsPane;

web/src/settings/permsModel.ts

@@ -44,6 +44,10 @@ export type SettingsSection =
   // Wave 18 (C7): the tenant's credential store and its data-source status board.
   | "keychains"
   | "connectors"
+  /** EXIT-6: the statement-of-account sender, ported off `app.py` when Streamlit
+   *  was deleted. Admin-only for the same reason the Streamlit section was —
+   *  it is THE one sanctioned Odoo writer in the product. */
+  | "statements"
   /**
    * Wave 19 (R3 / contract C2): the Loopable admin plane — the cross-TENANT
    * console, visible only to a `platform_admin` account.
@@ -75,7 +79,13 @@ export type SettingsSection =
 export function reachableSection(section: SettingsSection, admin: boolean): SettingsSection {
   // Wave 18 (C7): keychains + connectors are admin rooms for the same reason users is —
   // every control inside them would 403 a member.
-  const adminOnly = section === "users" || section === "keychains" || section === "connectors";
+  const adminOnly =
+    section === "users" ||
+    section === "keychains" ||
+    section === "connectors" ||
+    // EXIT-6: every control in the statements room would 403 a member, and the
+    // one at the bottom sends customer email. It belongs in this list twice over.
+    section === "statements";
   return adminOnly && !admin ? "account" : section;
 }
 

web/src/settings/statementsApi.ts

@@ -0,0 +1,94 @@
+// ---------------------------------------------------------------------------
+// settings / statementsApi.ts — the statement sender's wire (EXIT-6).
+//
+// ⛔ THE ONLY WRITE PATH IN THIS PRODUCT THAT LEAVES THE BUILDING. Everything
+// else AIOS does to Odoo is read-only by hard block; `/admin/statements/send`
+// queues real email to real customers. Three consequences for this file:
+//
+//   1. **No convenience wrapper sends anything.** There is no `sendAll()`, no
+//      default argument that could become a send. The caller names every
+//      customer explicitly, every time.
+//   2. **SAFE_MODE is REPORTED here, never decided here.** The server's data
+//      layer refuses an out-of-allow-list address. If this file ever grows a
+//      `if (safeMode) return` it would look like the guardrail while the real
+//      one silently rotted — a hidden button is a courtesy, never the check
+//      ([[aios-permissioning]]).
+//   3. **Outcomes are per-customer.** `sent` / `failed` / `skipped` come back as
+//      lists, not counts, because "37 queued" is unverifiable and this is mail.
+// ---------------------------------------------------------------------------
+
+import { API_V1, CREDENTIALS } from "../apiContract";
+
+export interface StatementRow {
+  Customer: string;
+  Email: string;
+  Tier: string;
+  Overdue: number;
+  Receivable: number;
+  [k: string]: unknown;
+}
+
+export interface StatementTemplates {
+  subject: string;
+  intro: string;
+  footer: string;
+}
+
+export interface StatementsPayload {
+  rows: StatementRow[];
+  loadedAt: string;
+  safeMode: boolean;
+  safeRecipients: string[];
+  sender: { name: string; email: string; replyTo: string; company: string };
+  templates: StatementTemplates;
+  tiers: string[];
+}
+
+export interface SendOutcome {
+  sent: Array<{ customer: string; to: string; mailId: number }>;
+  failed: Array<{ customer: string; error: string }>;
+  skipped: Array<{ customer: string; reason: string }>;
+  safeMode: boolean;
+  test: boolean;
+}
+
+type Res<T> = { ok: true; data: T } | { ok: false; message: string };
+
+async function call<T>(path: string, init?: RequestInit): Promise<Res<T>> {
+  try {
+    const r = await fetch(`${API_V1}${path}`, { credentials: CREDENTIALS, ...init });
+    const body = await r.json().catch(() => null);
+    if (!r.ok) {
+      const msg = body?.error?.message || `request failed (${r.status})`;
+      return { ok: false, message: msg };
+    }
+    return { ok: true, data: body as T };
+  } catch (e) {
+    return { ok: false, message: e instanceof Error ? e.message : "network error" };
+  }
+}
+
+export function loadStatements(refresh = false) {
+  return call<StatementsPayload>(`/admin/statements${refresh ? "?refresh=1" : ""}`);
+}
+
+export function previewStatement(customer: string, templates: StatementTemplates) {
+  return call<{ html: string; to: string; subject: string }>("/admin/statements/preview", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ customer, templates }),
+  });
+}
+
+/** Queue statements. `overrideTo` is the TEST path and takes exactly one customer. */
+export function sendStatements(
+  customers: string[],
+  templates: StatementTemplates,
+  overrideTo?: string,
+) {
+  return call<SendOutcome>("/admin/statements/send", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ customers, templates, overrideTo: overrideTo || undefined }),
+  });
+}