Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,5 +1,5 @@
 {
- "current": "b89a27e",
+ "current": "57896aa",
  "releases": [
   {
    "version": "v53",

VERSION

@@ -1 +1 @@
-b89a27e
+57896aa

api/automation_engine.py

@@ -1685,7 +1685,7 @@ def clean_config(kind, raw, previous=None):
                 seen.add(pid)
         if not recipient:
             return None, "choose the Inbox recipient for this route"
-        if not source_view or not revision:
+        if not source_view or source_view == "map-current" or not revision:
             return None, "a scheduled route needs the source View and its frozen revision"
         if len(ordered) < 2:
             return None, "a scheduled route needs at least two ordered stops"

api/routes_customers.py

@@ -463,6 +463,10 @@ def grid_assembly(session: Session, scope: str = "customer", storage_key: str =
             on_error=_measure_err) if may_metrics else {}).items():
         derived.setdefault(pid, {}).update(cells)
 
+    # Zones are table-scoped tenant data, surfaced as the established comma-joined multiselect
+    # contract so saved Views and FilterBuilder evaluate them like every other membership field.
+    from core import user_tables as _zones
+    fields = _zones.with_zone_field("customer_data", fields, st=rt)
     return {"rows_src": rows_src, "pids": pids, "ws": ws, "workspace": workspace,
             "fields": fields, "views": views, "lists": lists, "derived": derived,
             "measures": measures, "measure_sets": measure_sets, "today": today,
@@ -486,6 +490,9 @@ def _payload(session: Session):
     g = grid_assembly(session)
     rows = aios_grid.rows_from_pool(
         g["rows_src"], g["fields"], g["ws"].get("overlays"), derived=g["derived"])
+    from core import user_tables as _zones
+    rows = _zones.zone_cells("customer_data", rows, allowed_row_ids=g["pids"],
+                             st=session.runtime)
     # ⭐ C4 / D-138 (W30-T37) — THE DOCUMENTS PRODUCER FOR THE CUSTOMER SCOPE. The write door
     # (`doc_add`/`doc_fetch`/`doc_delete`) never stopped working and every client half is
     # complete; what vanished with `app.py` at EXIT-6 was the only thing that ever set this key.
@@ -1621,11 +1628,22 @@ def route_delivery_create(body: dict = Body(default=None),
     body = body if isinstance(body, dict) else {}
     recipient = _route_delivery_recipient_or_400(body.get("recipient"))
     snapshot = body.get("routeSnapshot") if isinstance(body.get("routeSnapshot"), dict) else {}
-    # View IDs are usually supplied by the host.  MapView cannot own generic View persistence, so
-    # its explicit snapshot fingerprint is accepted as the revision when the host has not supplied
-    # a persisted view id yet; it still makes the scheduled contents immutable and inspectable.
-    source_view_id = str(snapshot.get("sourceViewId") or "map-current").strip()
-    source_revision = str(snapshot.get("sourceViewRevision") or body.get("inputsHash") or "").strip()
+    # A route snapshot is allowed to freeze its *stops*, never to invent its View provenance.
+    # `map-current`/a route-plan fingerprint were a synthetic fallback that made an automation
+    # impossible to audit back to the actual filtered View.  Resolve the submitted id against
+    # this reader's visible View contract and retain the supplied canonical config revision.
+    source_view_id = str(snapshot.get("sourceViewId") or "").strip()
+    source_revision = str(snapshot.get("sourceViewRevision") or "").strip()
+    if not source_view_id or source_view_id == "map-current" or not source_revision:
+        raise err(400, "invalid_route_source_view",
+                  "choose an active saved View and include its frozen revision")
+    source_views = {str(view.get("id") or ""): view for view in
+                    (grid_assembly(session, consume_corrections=False).get("views") or [])
+                    if isinstance(view, dict) and view.get("id")}
+    source_view = source_views.get(source_view_id)
+    if source_view is None:
+        raise err(400, "unknown_route_source_view",
+                  "the route source View is no longer visible to this account")
     raw = {
         "name": " ".join(str(body.get("name") or snapshot.get("sourceViewName") or "Scheduled route").split())[:120],
         "kind": "route_delivery",
@@ -1638,6 +1656,7 @@ def route_delivery_create(body: dict = Body(default=None),
                 **snapshot,
                 "sourceViewId": source_view_id,
                 "sourceViewRevision": source_revision,
+                "sourceViewName": str(source_view.get("name") or source_view_id),
                 "mapsPerLink": snapshot.get("mapsPerLink", body.get("mapsPerLink", 10)),
             },
         },

api/routes_geo.py

@@ -45,7 +45,7 @@ import time
 from collections import OrderedDict
 
 import requests
-from fastapi import APIRouter, Body, Depends
+from fastapi import APIRouter, Body, Depends, Query
 
 from deps import Session, err, require_session
 
@@ -210,13 +210,47 @@ def _clean_zone(raw, previous=None, *, zone_id=""):
 
 
 def _zone_wire(zone):
-    return {key: zone.get(key) for key in ("id", "name", "color", "geometryGeoJson", "visible",
+    wire = {key: zone.get(key) for key in ("id", "name", "color", "geometryGeoJson", "visible",
                                             "geographicField", "memberships", "createdBy", "createdAt")}
-
-
-def _zone_subject(session, zone_id):
-    zones = session.runtime.get(ZONES_KEY) or {}
-    zone = zones.get(str(zone_id)) if isinstance(zones, dict) else None
+    # Storage keeps ids as strings because table records may originate in several backends; Map
+    # selection is numeric `pid`s.  The wire performs that one boundary conversion explicitly.
+    members = []
+    for raw in zone.get("memberships") or ():
+        try:
+            pid = int(raw)
+        except (TypeError, ValueError):
+            continue
+        if pid > 0:
+            members.append(pid)
+    wire["memberships"] = members
+    return wire
+
+
+def _zone_context(session, raw_table_key):
+    """One table-scoped Zone context, using the existing grid assemblies as permission walls."""
+    table_key = str(raw_table_key or "").strip()
+    if table_key == "customer_data":
+        from routes_customers import MODULE as customer_module, grid_assembly
+        session.require(customer_module)
+        grid = grid_assembly(session, consume_corrections=False)
+    elif table_key == "product_data":
+        from routes_products import MODULE as product_module, product_assembly
+        session.require(product_module)
+        grid = product_assembly(session, consume_corrections=False)
+    elif table_key.startswith("ut_"):
+        from routes_tables import ut_assembly
+        grid = ut_assembly(session, table_key, consume_corrections=False, with_rows=False)
+    else:
+        raise err(400, "invalid_zone_table", "choose a database before working with Zones")
+    fields = {str(field.get("key") or "") for field in (grid.get("fields") or [])
+              if isinstance(field, dict) and field.get("key")}
+    return table_key, fields, set(grid.get("pids") or ())
+
+
+def _zone_subject(session, table_key, zone_id):
+    from core import user_tables
+    zone = next((item for item in user_tables.zones(table_key, st=session.runtime)
+                 if str(item.get("id") or "") == str(zone_id)), None)
     if not isinstance(zone, dict):
         raise err(404, "unknown_zone", "no Zone with that id")
     if not session.admin and str(zone.get("createdBy") or "") != session.uname:
@@ -394,15 +428,13 @@ def geo_providers(session: Session = Depends(require_session)):
 
 
 @router.get("/geo/zones")
-def geo_zones(session: Session = Depends(require_session)):
-    """The C3 Zone DTOs this tenant may draw and choose on its Map Views."""
-    try:
-        raw = session.runtime.get(ZONES_KEY) or {}
-    except Exception:
-        raw = {}
-    zones = [zone for zone in raw.values() if isinstance(zone, dict)] if isinstance(raw, dict) else []
-    # Visibility is a display choice carried by the durable zone itself.  Creators and admins keep
-    # seeing an invisible zone in the chooser so it can be restored or edited rather than orphaned.
+def geo_zones(tableKey: str = Query(default=""), session: Session = Depends(require_session)):
+    """The canonical table-scoped Zone DTOs a Map may draw or filter by."""
+    from core import user_tables
+    table_key, _fields, _pids = _zone_context(session, tableKey)
+    zones = user_tables.zones(table_key, st=session.runtime)
+    # A hidden Zone remains recoverable to its creator/admin, but cannot become visible through a
+    # second table simply because row ids happen to collide there.
     visible = [zone for zone in zones if zone.get("visible", True)
                or session.admin or str(zone.get("createdBy") or "") == session.uname]
     return {"zones": [_zone_wire(zone) for zone in sorted(visible,
@@ -411,71 +443,57 @@ def geo_zones(session: Session = Depends(require_session)):
 
 @router.post("/geo/zones")
 def geo_zone_create(body: dict = Body(default=None), session: Session = Depends(require_session)):
-    """Persist one drawn Zone as C3's tenant record; no table-field writer is involved."""
+    """Persist one Zone in the existing table-scoped Zone store and field/filter contract."""
+    from core import user_tables
     body = body if isinstance(body, dict) else {}
+    table_key, field_keys, pids = _zone_context(session, body.get("tableKey"))
     try:
         zone = _clean_zone(body)
     except ValueError as exc:
         raise err(400, "invalid_zone", str(exc))
     if not zone["id"]:
         raise err(400, "invalid_zone", "name this Zone")
-    created = {}
-
-    def _write(current):
-        current = current if isinstance(current, dict) else {}
-        if zone["id"] in current:
-            raise ValueError("a Zone with that name already exists")
-        if len(current) >= MAX_ZONES:
-            raise ValueError(f"this tenant has reached the {MAX_ZONES}-Zone limit")
-        item = {**zone, "createdBy": session.uname, "createdAt": time.strftime("%Y-%m-%dT%H:%M:%S")}
-        current[zone["id"]] = item
-        created.update(item)
-        return current
-    try:
-        session.runtime.update(ZONES_KEY, _write, flush="async")
-    except ValueError as exc:
-        raise err(409, "zone_exists", str(exc))
-    return {"zone": _zone_wire(created)}
+    if any(str(item.get("id") or "") == zone["id"]
+           for item in user_tables.zones(table_key, st=session.runtime)):
+        raise err(409, "zone_exists", "a Zone with that name already exists")
+    saved = user_tables.upsert_zone(table_key, zone, field_keys=field_keys,
+                                    allowed_row_ids=pids, st=session.runtime,
+                                    created_by=session.uname)
+    if saved is None:
+        raise err(400, "invalid_zone", "the Zone does not match this database's fields and records")
+    return {"zone": _zone_wire(saved)}
 
 
 @router.patch("/geo/zones/{zone_id}")
 def geo_zone_update(zone_id: str, body: dict = Body(default=None),
                     session: Session = Depends(require_session)):
-    """Edit geometry, membership, geographic source or visibility of a stored Zone."""
-    previous = _zone_subject(session, zone_id)
+    """Edit a table-scoped Zone while retaining creator, geometry and membership invariants."""
+    from core import user_tables
+    body = body if isinstance(body, dict) else {}
+    table_key, field_keys, pids = _zone_context(session, body.get("tableKey"))
+    previous = _zone_subject(session, table_key, zone_id)
     try:
         zone = _clean_zone(body, previous, zone_id=str(zone_id))
     except ValueError as exc:
         raise err(400, "invalid_zone", str(exc))
-    updated = {}
-
-    def _write(current):
-        current = current if isinstance(current, dict) else {}
-        old = current.get(str(zone_id))
-        if not isinstance(old, dict):
-            raise KeyError(zone_id)
-        item = {**zone, "createdBy": old.get("createdBy") or session.uname,
-                "createdAt": old.get("createdAt") or time.strftime("%Y-%m-%dT%H:%M:%S")}
-        current[str(zone_id)] = item
-        updated.update(item)
-        return current
-    try:
-        session.runtime.update(ZONES_KEY, _write, flush="async")
-    except KeyError:
-        raise err(404, "unknown_zone", "no Zone with that id")
-    return {"zone": _zone_wire(updated)}
+    saved = user_tables.upsert_zone(table_key, zone, field_keys=field_keys,
+                                    allowed_row_ids=pids, st=session.runtime,
+                                    created_by=session.uname)
+    if saved is None:
+        raise err(400, "invalid_zone", "the Zone does not match this database's fields and records")
+    return {"zone": _zone_wire(saved)}
 
 
 @router.delete("/geo/zones/{zone_id}")
-def geo_zone_delete(zone_id: str, session: Session = Depends(require_session)):
-    """Delete exactly one Zone, leaving records and generic fields untouched."""
-    _zone_subject(session, zone_id)
-
-    def _write(current):
-        current = current if isinstance(current, dict) else {}
-        current.pop(str(zone_id), None)
-        return current
-    session.runtime.update(ZONES_KEY, _write, flush="async")
+def geo_zone_delete(zone_id: str, body: dict = Body(default=None),
+                    session: Session = Depends(require_session)):
+    """Delete exactly one table-scoped Zone; record values are never mutated here."""
+    body = body if isinstance(body, dict) else {}
+    table_key, _fields, _pids = _zone_context(session, body.get("tableKey"))
+    _zone_subject(session, table_key, zone_id)
+    from core import user_tables
+    if not user_tables.delete_zone(table_key, zone_id, st=session.runtime):
+        raise err(404, "unknown_zone", "no Zone with that id")
     return {"deleted": str(zone_id)}
 
 

api/routes_grid.py

@@ -840,6 +840,28 @@ def bulk_cells(body: dict = Body(default=None),
     return out
 
 
+@router.post("/grid/recurrence-preview")
+def recurrence_preview(body: dict = Body(default=None),
+                       session: Session = Depends(require_session)):
+    """Validate and preview a Date-field recurrence before the user saves it.
+
+    A preview is not a client-side convenience calculation: holiday relations and ordinal-month
+    rules must be evaluated by the same server normaliser that persists the field.  This endpoint
+    is read-only and session-scoped only because it has no table or row to disclose.
+    """
+    import aios_grid
+
+    raw = (body or {}).get("recurrence")
+    clean = aios_grid.clean_date_recurrence(raw)
+    if clean is None:
+        raise err(400, "bad_recurrence",
+                  "recurrence needs a start date and at least one supported repeat rule")
+    return {
+        "recurrence": aios_grid.recurrence_payload(clean, today=time.strftime("%Y-%m-%d")),
+        "calendars": list(aios_grid.PUBLIC_HOLIDAY_CALENDARS),
+    }
+
+
 @router.post("/grid/events")
 def grid_events_route(body: dict = Body(default=None),
                       session: Session = Depends(require_session)):

api/routes_odoo_tables.py

@@ -18,9 +18,13 @@ and deletes the rows that left the population. That is an operator action.
 READ-THROUGH WINDOW. The two above operate on the materialised copy; `/{table_key}/rows` does not
 read the copy at all. See the block above `GRID_SOURCES` for why that had to change.
 """
+import base64
+import hashlib
+import hmac
 import json
+import time
 
-from fastapi import Depends
+from fastapi import Body, Depends
 from fastapi import APIRouter, Query
 
 from deps import Session, err, require_session
@@ -780,6 +784,14 @@ def _source_for(cur, table_key):
 #: the person BEFORE the wait rather than after it.
 _DEEP_PAGE = 100_000
 
+# A filtered "select all" is a WRITE precursor, not a normal source read.  The source itself is
+# intentionally uncapped, but this descriptor is later used to write one shared field to every
+# selected row in one durable overlay transaction.  Keep the existing bulk-write ceiling explicit
+# and report it before minting a descriptor; never turn a 34,000-row filter into an unannounced
+# first-page selection.
+MAX_FILTERED_SELECTION_ROWS = 10_000
+FILTERED_SELECTION_SECONDS = 5 * 60
+
 
 #: `filter_sql` speaks the CLIENT's type vocabulary (`types.ts isNumericType`), and two of our
 #: field kinds are spelled differently there. Mapped in one place so the pushdown and the grid
@@ -831,6 +843,210 @@ def _json_arg(raw, what):
     return val
 
 
+# ---------------------------------------------------------------- filtered selection / bulk overlay writes
+
+def _selection_query(body):
+    """The exact client predicate a server-windowed selection represents.
+
+    The normal rows route owns the SQL compiler, row wall and hidden-field closure.  This helper
+    only validates the wire shape and preserves it verbatim so both descriptor minting and the
+    later write can call that same door.  Falling back to an empty filter here would widen a bulk
+    write, which is worse than refusing a malformed request.
+    """
+    body = body if isinstance(body, dict) else {}
+    filters = body.get("filters", [])
+    sorts = body.get("sorts", [])
+    if filters is None:
+        filters = []
+    if sorts is None:
+        sorts = []
+    if not isinstance(filters, list):
+        raise err(400, "bad_selection", "filters must be a list")
+    if not isinstance(sorts, list):
+        raise err(400, "bad_selection", "sorts must be a list")
+    filter_conj = str(body.get("filterConj") or "and").lower()
+    if filter_conj not in ("and", "or"):
+        raise err(400, "bad_selection", "filterConj must be 'and' or 'or'")
+    search = body.get("search", "")
+    if search is None:
+        search = ""
+    if not isinstance(search, str) or len(search) > 1_000:
+        raise err(400, "bad_selection", "search must be text no longer than 1,000 characters")
+    return {"filters": filters, "filterConj": filter_conj, "sorts": sorts, "search": search}
+
+
+def _selection_rows_args(query, *, offset, limit):
+    """Turn a canonical descriptor predicate back into `odoo_table_rows` query arguments."""
+    return {
+        "offset": offset,
+        "limit": limit,
+        "filters": json.dumps(query["filters"], separators=(",", ":")),
+        "filterConj": query["filterConj"],
+        "sorts": json.dumps(query["sorts"], separators=(",", ":")),
+        "search": query["search"],
+    }
+
+
+def _pid_fingerprint(pids):
+    """Stable set fingerprint for a descriptor; duplicate/non-integer IDs are an internal refusal."""
+    try:
+        ordered = sorted(int(pid) for pid in pids)
+    except (TypeError, ValueError):
+        raise ValueError("the connected rows route returned a non-integer record id")
+    if len(set(ordered)) != len(ordered):
+        raise ValueError("the connected rows route returned a duplicate record id")
+    return hashlib.sha256(",".join(str(pid) for pid in ordered).encode("ascii")).hexdigest()
+
+
+def _all_filtered_pids(table_key, query, session):
+    """Read every permitted ID through the existing read compiler, with an explicit write bound."""
+    from harness import datastore
+
+    first = odoo_table_rows(table_key, session=session,
+                            **_selection_rows_args(query, offset=0,
+                                                   limit=datastore.WINDOW_MAX))
+    total = int(first.get("total") or 0)
+    if total > MAX_FILTERED_SELECTION_ROWS:
+        raise err(400, "selection_too_large",
+                  f"this filter matches {total:,} records; bulk updates allow at most "
+                  f"{MAX_FILTERED_SELECTION_ROWS:,}. Narrow the filter and select all again")
+    if total == 0:
+        return [], 0
+
+    pages = [first]
+    for offset in range(datastore.WINDOW_MAX, total, datastore.WINDOW_MAX):
+        page = odoo_table_rows(table_key, session=session,
+                               **_selection_rows_args(query, offset=offset,
+                                                      limit=datastore.WINDOW_MAX))
+        if int(page.get("total") or 0) != total:
+            raise err(409, "selection_stale",
+                      "the filtered result changed while it was being selected; review and select all again")
+        pages.append(page)
+    pids = [row.get("pid") for page in pages for row in (page.get("rows") or [])]
+    try:
+        fingerprint = _pid_fingerprint(pids)
+    except ValueError as exc:
+        raise err(409, "selection_stale", str(exc))
+    if len(pids) != total:
+        raise err(409, "selection_stale",
+                  "the filtered result changed while it was being selected; review and select all again")
+    return pids, fingerprint
+
+
+def _mint_selection_token(claims):
+    """A short, signed opaque descriptor; it carries no authority across user/tenant/table."""
+    import aios_session
+
+    raw = json.dumps(claims, separators=(",", ":"), sort_keys=True).encode("utf-8")
+    body = base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
+    # Domain separation prevents an otherwise valid selection descriptor being confused with a
+    # session signature anywhere else in the process.
+    signature = aios_session._sign(b"filtered-selection:v1:" + raw)
+    return f"{body}.{signature}"
+
+
+def _read_selection_token(token):
+    """Parse/verify an opaque descriptor without revealing which attacker-controlled part failed."""
+    import aios_session
+
+    if not isinstance(token, str) or len(token) > 16_384 or token.count(".") != 1:
+        return None
+    body, signature = token.split(".", 1)
+    try:
+        raw = base64.urlsafe_b64decode(body + "=" * (-len(body) % 4))
+    except Exception:                                                   # noqa: BLE001
+        return None
+    if not hmac.compare_digest(signature, aios_session._sign(b"filtered-selection:v1:" + raw)):
+        return None
+    try:
+        claims = json.loads(raw.decode("utf-8"))
+    except Exception:                                                   # noqa: BLE001
+        return None
+    return claims if isinstance(claims, dict) else None
+
+
+@router.post("/odoo-tables/{table_key}/filtered-selection")
+def create_filtered_selection(table_key: str, body: dict = Body(default=None),
+                              session: Session = Depends(require_session)):
+    """Mint an opaque all-matching descriptor for a windowed grid.
+
+    The response count is the rows route's server count, and the descriptor fingerprints every
+    matching permitted PID.  The browser never gets a fabricated set from its loaded page.
+    """
+    query = _selection_query(body)
+    pids, matched_or_fingerprint = _all_filtered_pids(table_key, query, session)
+    if not pids:
+        return {"ok": True, "selection": None, "matched": 0, "expiresAt": None}
+    now = int(time.time())
+    claims = {
+        "v": 1, "tenant": session.tenant, "user": session.uname, "table": table_key,
+        "query": query, "matched": len(pids), "fingerprint": matched_or_fingerprint,
+        "exp": now + FILTERED_SELECTION_SECONDS,
+    }
+    return {"ok": True, "selection": _mint_selection_token(claims), "matched": len(pids),
+            "expiresAt": claims["exp"]}
+
+
+@router.post("/odoo-tables/{table_key}/filtered-bulk")
+def apply_filtered_bulk(table_key: str, body: dict = Body(default=None),
+                        session: Session = Depends(require_session)):
+    """Revalidate an all-matching descriptor and write one existing shared field atomically."""
+    import core.perm_scope as perm_scope
+    import core.shared_overlay as shared_overlay
+    import core.shares as shares
+    from routes_tables import _defn_or_refuse
+
+    body = body if isinstance(body, dict) else {}
+    claims = _read_selection_token(body.get("selection"))
+    if not claims:
+        raise err(400, "bad_selection", "the filtered selection is invalid; select all again")
+    if (claims.get("v") != 1 or claims.get("tenant") != session.tenant
+            or claims.get("user") != session.uname or claims.get("table") != table_key):
+        raise err(403, "selection_forbidden",
+                  "that filtered selection belongs to a different account, tenant, or database")
+    if int(claims.get("exp") or 0) <= int(time.time()):
+        raise err(409, "selection_stale", "the filtered selection expired; select all again")
+    query = claims.get("query")
+    try:
+        query = _selection_query(query)
+    except Exception:
+        raise err(400, "bad_selection", "the filtered selection is invalid; select all again")
+
+    # Reuse the same compiler/walls and compare the actual matching set before touching a cell.
+    pids, fingerprint = _all_filtered_pids(table_key, query, session)
+    if (len(pids) != int(claims.get("matched") or -1)
+            or fingerprint != claims.get("fingerprint")):
+        raise err(409, "selection_stale",
+                  "the filtered result changed before this bulk update; review and select all again")
+
+    key = str(body.get("field") or "").strip()
+    if not key:
+        raise err(400, "bad_request", "a field key is required")
+    # `_all_filtered_pids` already ran the read wall.  This second, write-shaped check keeps a
+    # projected definition from leaking into a write path and makes the capability explicit.
+    _defn_or_refuse(session, table_key)
+    if not shares.may_edit("database", table_key, session.uname, is_admin=session.admin,
+                           st=session.runtime):
+        raise err(403, "forbidden",
+                  "an edit share on this database is required to update its shared field")
+    definitions = shared_overlay.fields(table_key, st=session.runtime)
+    if key not in definitions:
+        raise err(400, "field_not_shared", "bulk updates on connected data require an existing shared field")
+    if key in perm_scope.hidden_keys(session.user, table_key, list(definitions.values())):
+        raise err(403, "field_hidden", "you do not have access to that field")
+    value = body.get("value")
+    if isinstance(value, (dict, list, tuple, set)):
+        raise err(400, "bad_value", "a bulk value must be a scalar")
+    try:
+        written = shared_overlay.put_rows(table_key, {pid: {key: value} for pid in pids},
+                                          st=session.runtime)
+    except ValueError as exc:
+        raise err(400, "bad_value", str(exc))
+    return {"ok": True, "matched": len(pids), "rows_requested": len(pids),
+            "rows_written": len(written),
+            "cells_written": sum(len(cells) for cells in written.values())}
+
+
 @router.get("/odoo-tables/{table_key}/rows")
 def odoo_table_rows(table_key: str,
                     offset: int = Query(default=0, ge=0),

api/routes_products.py

@@ -372,6 +372,11 @@ def product_assembly(session: Session, scope: str = "product", storage_key: str
         ws, session.uname, set(pids), defs={}, scope_key=scope, storage_key=storage_key,
         fields_base=fields_base)
 
+    # W43: source-backed Product choices learn values in the shared overlay schema.  Apply that
+    # durable vocabulary before the payload is served, so "Add option: et" is still available
+    # after a refresh and for collaborators, while canonical JSON choices retain their order.
+    fields = aios_grid.apply_choice_overrides(fields, shared_defs)
+
     have = {field.get("key") for field in fields if isinstance(field, dict)}
     projected = []
     from core import shares
@@ -415,6 +420,8 @@ def product_assembly(session: Session, scope: str = "product", storage_key: str
     # would trade one honest absence for a spinner that never resolves.
     measure_sets = _measure_condition_sets(views, measures, rows_src, team_id, today)
 
+    from core import user_tables as _zones
+    fields = _zones.with_zone_field("product_data", fields, st=session.runtime)
     return {"rows_src": rows_src, "pids": pids, "ws": ws, "workspace": workspace,
             "fields": fields, "views": views, "lists": lists,
             "derived": derived,
@@ -439,6 +446,9 @@ def products(session: Session = Depends(module_gate(MODULE))):
     rows = aios_grid.rows_from_pool(
         g["rows_src"], g["fields"], g["ws"].get("overlays"), derived=g["derived"])
     rows = _seed_image(_seed_shared(rows, g["rows_src"], g["fields"]), g["fields"])
+    from core import user_tables as _zones
+    rows = _zones.zone_cells("product_data", rows, allowed_row_ids=g["pids"],
+                             st=session.runtime)
     # ⭐⭐ W41-T17 (owner instruction 25) — THE IDENTITY REPORT RIDES THE ENVELOPE, because a
     # report nothing reads is not a report. `product_data.identity_report` is standing rule 1's
     # second sentence as data for this grid's two identity columns: `product_id` (the Odoo

api/routes_tables.py

@@ -1340,6 +1340,9 @@ def ut_assembly(session: Session, table_key: str, storage_key: str = "",
     # ⭐⭐ W36-T21 / R6 — the READ half, in `grid_assembly`'s own position: after `workspace_wire`,
     # so the closure covers this user's `custom_` and `measure_` columns too.
     fields, rows_src, hidden = _ut_field_wall(session, table_key, fields, rows_src, st=st)
+    # The canonical Zone field is derived from the same table-scoped store as the map DTO, so
+    # FilterBuilder and saved Views use their ordinary multiselect path rather than a map-only one.
+    fields = _ut().with_zone_field(table_key, fields, st=st)
     if hidden and shared_cells:
         # ⛔ BOTH WIRES, AND THE SHARED STRATUM IS A THIRD ONE. `strip_row` above cleaned the
         # DEFINITION rows; these cells arrived by a different door and one narrowing cannot speak
@@ -2111,6 +2114,7 @@ def table_rows(table_key: str, session: Session = Depends(require_session)):
     # so a tenant using `json` for a short config sees no change at all.
     rows = aios_grid.rows_from_pool(
         g["rows_src"], g["fields"], _thin_json(g["fields"], merged, table_key), derived=g["derived"])
+    rows = _ut().zone_cells(table_key, rows, allowed_row_ids=g["pids"], st=_lent)
     # ⭐⭐ WAVE-34 (R13) — the per-cell enrichment STATE rides the row, beside `_created`/`lat`/
     # `lon`. See `_stamp_ai_states` for why it is a row key rather than a map beside `rows`.
     _stamp_ai_states(table_key, g["fields"], rows, st=_lent)

platform/aios_grid.py

@@ -242,6 +242,47 @@ def _clean_options(raw):
     return out[:MAX_FIELD_OPTIONS]
 
 
+def merge_choice_options(*sources):
+    """One canonical choice vocabulary from ordered option sources.
+
+    A source-backed column may learn values through an overlay while retaining contract choices.
+    Keeping the merge beside `_clean_options` makes the case-folding, 120-character label, and
+    `MAX_FIELD_OPTIONS` rules identical on the persistence and payload paths.  The first spelling
+    wins: a later ``et`` therefore resolves to an existing ``ET`` rather than producing a second
+    visibly identical choice.
+    """
+    merged = []
+    for source in sources:
+        merged.extend(list(source or []))
+    return _clean_options(merged)
+
+
+def apply_choice_overrides(fields, overrides):
+    """Return field copies with durable select-family option overrides applied.
+
+    `overrides` is deliberately only a field-key map, so a product route can use the tenant-wide
+    shared schema and a normal table workspace can use its personal source-column annotations.
+    It never changes a non-choice field, and it never replaces canonical choices with a stale
+    annotation: both vocabularies are merged through the one cleaner above.
+    """
+    saved = overrides if isinstance(overrides, dict) else {}
+    out = []
+    for raw in fields or []:
+        field = dict(raw) if isinstance(raw, dict) else raw
+        if not isinstance(field, dict) or field.get("type") not in ("select", "multiselect"):
+            out.append(field)
+            continue
+        extra = saved.get(field.get("key"))
+        if not isinstance(extra, dict) or "options" not in extra:
+            out.append(field)
+            continue
+        options = merge_choice_options(field.get("options"), extra.get("options"))
+        field["options"] = options
+        field.update(_choice_appearance(extra, options))
+        out.append(field)
+    return out
+
+
 def _clean_option_colors(raw, options):
     """Choice-label -> #RRGGBB, limited to the field's canonical option vocabulary."""
     if not isinstance(raw, dict):
@@ -500,7 +541,14 @@ def _clean_geocode(raw):
 # would make an identical record mean different things to two hosts.  The host computes the
 # next occurrence and preview at projection time from this compact, durable shape.
 _RECURRENCE_KINDS = frozenset({'daily', 'weekly', 'monthly', 'yearly', 'holiday'})
-_PUBLIC_HOLIDAY_CALENDARS = frozenset({'US'})
+# A calendar appears here only when the server really evaluates it.  The Date picker reads this
+# same registry, so a selector cannot promise a country whose recurrence becomes a no-op later.
+PUBLIC_HOLIDAY_CALENDARS = (
+    {'code': 'US', 'label': 'United States federal holidays'},
+    {'code': 'CA', 'label': 'Canada federal public holidays'},
+)
+_PUBLIC_HOLIDAY_CALENDARS = frozenset(item['code'] for item in PUBLIC_HOLIDAY_CALENDARS)
+_HOLIDAY_RELATIONS = {'day_before': -1, 'day_on': 0, 'day_after': 1}
 
 
 def _iso_day(value):
@@ -539,17 +587,63 @@ def _last_weekday(year, month, weekday):
     return day - _dt.timedelta(days=(day.weekday() - weekday) % 7)
 
 
+def _easter_sunday(year):
+    """Gregorian computus, kept local so a recurrence preview needs no network."""
+    a = year % 19
+    b, c = divmod(year, 100)
+    d, e = divmod(b, 4)
+    f = (b + 8) // 25
+    g = (b - f + 1) // 3
+    h = (19 * a + b - d - g + 15) % 30
+    i, k = divmod(c, 4)
+    l = (32 + 2 * e + 2 * i - h - k) % 7
+    m = (a + 11 * h + 22 * l) // 451
+    month = (h + l - 7 * m + 114) // 31
+    day = (h + l - 7 * m + 114) % 31 + 1
+    return _dt.date(year, month, day)
+
+
+def _canada_public_holidays(year):
+    """Canada's federal public-service holiday schedule, deterministically calculated.
+
+    This is deliberately not a claim about every provincial observance.  Weekend fixed holidays
+    move to the next available weekday, including the Christmas/Boxing-Day collision.
+    """
+    days = {
+        _easter_sunday(year) - _dt.timedelta(days=2),  # Good Friday
+        _last_weekday(year, 5, 0) - _dt.timedelta(days=7),  # Monday before May 25
+        _nth_weekday(year, 9, 0, 1),                  # Labour Day
+        _nth_weekday(year, 10, 0, 2),                 # Thanksgiving
+    }
+    fixed = [_dt.date(year, 1, 1), _dt.date(year, 7, 1),
+             _dt.date(year, 11, 11), _dt.date(year, 12, 25), _dt.date(year, 12, 26)]
+    if year >= 2021:
+        fixed.append(_dt.date(year, 9, 30))           # Truth and Reconciliation
+    for holiday in fixed:
+        observed = holiday
+        if observed.weekday() == 5:
+            observed += _dt.timedelta(days=2)
+        elif observed.weekday() == 6:
+            observed += _dt.timedelta(days=1)
+        while observed in days:
+            observed += _dt.timedelta(days=1)
+        days.add(observed)
+    return frozenset(days)
+
+
 def public_holidays(calendar, year):
-    """The supported public holiday calendar, returned as deterministic ISO-day objects.
+    """A supported public holiday calendar, returned as deterministic ISO-day objects.
 
     US federal holidays are intentionally calculated locally rather than fetched from a public
     endpoint during a render: a recurrence must keep its answer during an outage and historical
-    previews must not move when a third party updates a feed.  The field accepts other ISO
-    country codes for forward compatibility, but an unavailable calendar yields no candidates
-    rather than pretending it is the US calendar.
+    previews must not move when a third party updates a feed.  Unsupported calendars are
+    refused at the field door; the empty result here protects old malformed stored data.
     """
-    if str(calendar or '').upper() not in _PUBLIC_HOLIDAY_CALENDARS:
+    calendar = str(calendar or '').upper()
+    if calendar not in _PUBLIC_HOLIDAY_CALENDARS:
         return frozenset()
+    if calendar == 'CA':
+        return _canada_public_holidays(year)
     days = {
         _observed(_dt.date(year, 1, 1)),
         _nth_weekday(year, 1, 0, 3),             # Martin Luther King Jr. Day
@@ -598,10 +692,21 @@ def clean_date_recurrence(raw):
                                and 0 <= day <= 6})
             rule['weekdays'] = weekdays or [start.weekday()]
         elif kind == 'monthly':
-            day = raw_rule.get('day', start.day)
-            if not isinstance(day, int) or isinstance(day, bool) or not 1 <= day <= 31:
-                continue
-            rule['day'] = day
+            # ``day: 1`` means the first of every N months.  ``ordinal`` + ``weekday`` adds
+            # Google-Calendar-style first Monday / last Friday without a competing model.
+            if 'ordinal' in raw_rule or 'weekday' in raw_rule:
+                ordinal, weekday = raw_rule.get('ordinal'), raw_rule.get('weekday')
+                if (not isinstance(ordinal, int) or isinstance(ordinal, bool)
+                        or ordinal not in (-1, 1, 2, 3, 4, 5)
+                        or not isinstance(weekday, int) or isinstance(weekday, bool)
+                        or not 0 <= weekday <= 6):
+                    continue
+                rule.update({'ordinal': ordinal, 'weekday': weekday})
+            else:
+                day = raw_rule.get('day', start.day)
+                if not isinstance(day, int) or isinstance(day, bool) or not 1 <= day <= 31:
+                    continue
+                rule['day'] = day
         elif kind == 'yearly':
             month, day = raw_rule.get('month', start.month), raw_rule.get('day', start.day)
             if (not isinstance(month, int) or isinstance(month, bool) or not 1 <= month <= 12
@@ -615,9 +720,11 @@ def clean_date_recurrence(raw):
             rule.update({'month': month, 'day': day})
         elif kind == 'holiday':
             calendar = str(raw_rule.get('calendar') or 'US').strip().upper()
-            if not re.fullmatch(r'[A-Z]{2}', calendar):
+            if calendar not in _PUBLIC_HOLIDAY_CALENDARS:
                 continue
-            offset = raw_rule.get('offset', 0)
+            relation = raw_rule.get('relation')
+            offset = (_HOLIDAY_RELATIONS.get(str(relation).strip().lower())
+                      if relation is not None else raw_rule.get('offset', 0))
             if not isinstance(offset, int) or isinstance(offset, bool) or offset not in (-1, 0, 1):
                 continue
             rule.update({'calendar': calendar, 'offset': offset})
@@ -642,7 +749,14 @@ def _recurrence_matches(day, start, rule):
         return ((day - start).days // 7) % interval == 0 and day.weekday() in rule['weekdays']
     if kind == 'monthly':
         months = (day.year - start.year) * 12 + day.month - start.month
-        return months >= 0 and months % interval == 0 and day.day == rule['day']
+        if months < 0 or months % interval:
+            return False
+        if 'ordinal' not in rule:
+            return day.day == rule['day']
+        match = (_last_weekday(day.year, day.month, rule['weekday'])
+                 if rule['ordinal'] == -1
+                 else _nth_weekday(day.year, day.month, rule['weekday'], rule['ordinal']))
+        return match.month == day.month and match == day
     if kind == 'yearly':
         return (day.year - start.year) % interval == 0 and day.month == rule['month'] and day.day == rule['day']
     return False
@@ -667,12 +781,15 @@ def recurrence_preview(raw, today=None, count=None):
         if any(_recurrence_matches(day, start, rule) for rule in ordinary_rules):
             found.add(day)
         for rule in holiday_rules:
-            if (day.year - start.year) % rule['interval']:
-                continue
-            for holiday in public_holidays(rule['calendar'], day.year):
-                occurrence = holiday + _dt.timedelta(days=rule['offset'])
-                if occurrence == day and occurrence >= start:
-                    found.add(day)
+            # Day-before next New Year's Day belongs to the following holiday year.  Looking at
+            # adjacent years makes those boundary dates real rather than silently absent.
+            for holiday_year in (day.year - 1, day.year, day.year + 1):
+                if holiday_year < start.year or (holiday_year - start.year) % rule['interval']:
+                    continue
+                for holiday in public_holidays(rule['calendar'], holiday_year):
+                    occurrence = holiday + _dt.timedelta(days=rule['offset'])
+                    if occurrence == day and occurrence >= start:
+                        found.add(day)
         day += _dt.timedelta(days=1)
     return [item.isoformat() for item in sorted(found)[:want]]
 
@@ -923,6 +1040,22 @@ def fields_from_workspace(workspace=None, cohorts=False, scope_key=None, fields_
                 field["measure"] = {"key": base["measure"]["key"], "window": window}
                 if isinstance(meta.get("label"), str) and meta["label"].strip():
                     field["label"] = meta["label"][:120]
+        # A source-backed choice field can learn vocabulary from accepted values.  The annotation
+        # is not a replacement for contract choices: an old workspace cannot make a currently
+        # declared option disappear.  This is the read half of TableStore's atomic overlay +
+        # choice write, so an "Add option" survives a fresh payload rather than existing only in
+        # the optimistic cell editor.
+        if base.get("type") in ("select", "multiselect") and "options" in meta:
+            options = merge_choice_options(base.get("options"), meta.get("options"))
+            field["options"] = options
+            field.update(_choice_appearance(meta, options))
+        # Recurrence belongs to the Date FIELD, not to an individual ISO date cell.  Source
+        # fields need this explicit read half because their override is otherwise rebuilt from
+        # the immutable contract on every workspace projection.
+        if base.get("type") == "date" and "recurrence" in meta:
+            recurrence = recurrence_payload(meta.get("recurrence"))
+            if recurrence:
+                field["recurrence"] = recurrence
         out.append(field)
     for key, field in saved.items():
         if key in base_keys or not isinstance(field, dict):

platform/core/grid_events.py

@@ -73,7 +73,8 @@ _DOC_MAX_PER_ROW = 50
 #: Host-only stamps (createdBy, permissions) are deliberately absent: the client renders
 #: nothing from its own copy of those, and a permissions refusal is answered explicitly.
 _FIELD_ECHO_PROPS = ('label', 'type', 'note', 'options', 'colorCodeOptions',
-                     'optionColors', 'max', 'formula', 'agg', 'scope', 'format', 'measure')
+                     'optionColors', 'max', 'formula', 'agg', 'scope', 'format', 'measure',
+                     'recurrence')
 
 
 class StoreUnavailable(RuntimeError):
@@ -1236,6 +1237,29 @@ def handle_one(event, ctx):
             seen.pop(stale, None)
     kind = event.get('type')
     field_by_key = {f['key']: f for f in fields}
+    # A Product shared-select option can have been admitted by an earlier event while this
+    # EventCtx remains alive.  The renderer gets the persisted choice projection on refresh,
+    # but this write wall also has to learn it *before* it canonicalises a later paste/API
+    # patch; otherwise ``ET`` followed by ``et`` sees an empty contract again and overwrites
+    # the first spelling.  This is intentionally a narrow vocabulary merge, never a second
+    # field-definition reader: visibility, type and permissions remain the caller's served
+    # schema.
+    try:
+        from core import shared_overlay as _shared_choices
+        import aios_grid as _ag_choices
+        _choice_table_key = getattr(getattr(ctx, 'table', None), 'table_key', None)
+        if _choice_table_key:
+            _stored_choices = _shared_choices.fields(_choice_table_key, st=_store_of(ctx)) or {}
+            for _choice_key, _stored_def in _stored_choices.items():
+                _served_def = field_by_key.get(_choice_key)
+                if (_served_def and _served_def.get('type') in ('select', 'multiselect')
+                        and isinstance(_stored_def, dict)):
+                    _served_def['options'] = _ag_choices.merge_choice_options(
+                        _served_def.get('options'), _stored_def.get('options'))
+    except Exception:
+        # Field writes must not become unavailable merely because an optional shared-overlay
+        # vocabulary is absent (ordinary customer and legacy in-memory contexts have none).
+        pass
     valid_keys = set(field_by_key)
     overlay_keys = {f['key'] for f in fields if f.get('source') == 'overlay'}
     # Event validation is not a render payload. It must not consume a one-shot label
@@ -1906,6 +1930,22 @@ def handle_one(event, ctx):
         # with no createdBy is admin-only (fail closed, both directions). The table workspace
         # is per-user today, so this wall becomes load-bearing when sharing arrives — but the
         # admin path and the legacy path are enforceable (and NC'd) right now.
+        # W43: recurrence is configuration on a scalar Date field.  The DatePicker sends the
+        # complete server-shaped bag; an older field editor that omits it preserves the existing
+        # setting rather than deleting a schedule merely by changing the note.
+        if field.get('type') == 'date':
+            recurrence_raw = raw.get('recurrence') if 'recurrence' in raw else field.get('recurrence')
+            # An omitted recurrence is an older editor changing another Date property, so it
+            # preserves the stored schedule. An explicit JSON null is the DatePicker's clear
+            # command and must not fall through to that preservation branch.
+            if 'recurrence' not in raw and recurrence_raw is None and not shared_field:
+                previous = (ws.get('fields') or {}).get(key)
+                recurrence_raw = previous.get('recurrence') if isinstance(previous, dict) else None
+            recurrence = _ag2.clean_date_recurrence(recurrence_raw)
+            if recurrence:
+                field['recurrence'] = recurrence
+            else:
+                field.pop('recurrence', None)
         needs_values = False
         refused_perms = False
         permission_sync = False
@@ -2851,6 +2891,11 @@ def handle_one(event, ctx):
         refused = False
         stage_moved = False
         row_events = []            # C3 (wave 22): admitted writes, emitted AFTER they apply
+        # W43: labels learned from a normal cell edit are persisted with that cell.  The actual
+        # residency transaction belongs to TableStore / shared_overlay below; this map carries
+        # only NEW canonical labels, after this wall has applied the same permission, case and cap
+        # rules as every other choice write.
+        choice_additions = {}
         raw_updates = event.get('updates') if isinstance(event.get('updates'), dict) else {}
         for key, value in raw_updates.items():
             if key not in overlay_keys or not isinstance(value, (str, int, float)):
@@ -3010,32 +3055,49 @@ def handle_one(event, ctx):
                 refused = True
             definition = field_by_key.get(key) or {}
             if definition.get('type') in ('select', 'multiselect') and clean:
-                options = [str(v) for v in definition.get('options') or []]
-                canonical = {v.strip().lower(): v for v in options}
-                if definition.get('type') == 'select':
-                    normalized = canonical.get(clean.strip().lower())
-                    if normalized is None:
-                        refused = True
-                        continue
-                else:
-                    normalized_parts = []
-                    seen = set()
-                    invalid = False
-                    for part in clean.split(','):
-                        match = canonical.get(part.strip().lower())
-                        if match is None:
+                # A choice value is DATA, not a precondition the field editor must have visited.
+                # Pasted/imported/API values therefore mint an option through this same write
+                # door.  It is deliberately still bounded and case-canonical: "ET" then "et"
+                # is one option, and the 51st distinct label is refused rather than creating a
+                # picker the contract cannot represent.
+                import aios_grid as _ag_choices
+                options = _ag_choices.merge_choice_options(definition.get('options'))
+                canonical = {v.strip().casefold(): v for v in options}
+                raw_parts = ([clean] if definition.get('type') == 'select'
+                             else clean.split(','))
+                normalized_parts = []
+                additions = []
+                seen = set()
+                invalid = False
+                for part in raw_parts:
+                    candidate = _ag_choices._clean_options([part])
+                    if len(candidate) != 1:
+                        invalid = True
+                        break
+                    label = candidate[0]
+                    folded = label.casefold()
+                    match = canonical.get(folded)
+                    if match is None:
+                        if len(options) >= _ag_choices.MAX_FIELD_OPTIONS:
                             invalid = True
                             break
-                        if match.lower() not in seen:
-                            seen.add(match.lower())
-                            normalized_parts.append(match)
-                    if invalid:
-                        refused = True
-                        continue
-                    normalized = ','.join(normalized_parts)
+                        match = label
+                        options.append(match)
+                        canonical[folded] = match
+                        additions.append(match)
+                    if folded not in seen:
+                        seen.add(folded)
+                        normalized_parts.append(match)
+                if invalid:
+                    refused = True
+                    continue
+                normalized = (normalized_parts[0] if definition.get('type') == 'select'
+                              else ','.join(normalized_parts))
                 if normalized != clean:
                     refused = True
                     clean = normalized
+                if additions:
+                    choice_additions[key] = additions
             updates[key] = clean
         if updates:
             if str(ctx.scope_key or '').startswith('ut_') and ctx.table is not None:
@@ -3045,10 +3107,29 @@ def handle_one(event, ctx):
                 import core.user_tables as _ut_values
                 _ut_values.patch_cells(ctx.scope_key, pid, updates, st=ctx.table.st)
             elif _store_of(ctx).available():
-                _tops(ctx).patch_overlay(uname, pid, updates)
+                _tops(ctx).patch_overlay_with_choice_options(
+                    uname, pid, updates, choice_additions)
             else:
                 _session_ready()
                 ws['overlays'].setdefault(str(pid), {}).update(updates)
+                if choice_additions:
+                    import aios_grid as _ag_choices
+                    for _key, _values in choice_additions.items():
+                        _prior = ws['fields'].get(_key)
+                        _entry = dict(_prior) if isinstance(_prior, dict) else {}
+                        _entry['options'] = _ag_choices.merge_choice_options(
+                            _entry.get('options'), _values)
+                        ws['fields'][_key] = _entry
+            # Keep this long-lived event context in sync too.  The following event may be a
+            # paste/API retry before the next field projection is fetched, and it must retain
+            # the original option's casing rather than treating it as another new choice.
+            if choice_additions:
+                import aios_grid as _ag_choices
+                for _key, _values in choice_additions.items():
+                    _definition = field_by_key.get(_key)
+                    if _definition is not None:
+                        _definition['options'] = _ag_choices.merge_choice_options(
+                            _definition.get('options'), _values)
         # C3 (wave 22): the admitted writes become ROW EVENTS — emitted AFTER they applied, on
         # the ut scopes the event triggers watch this wave, through the seam in user_tables so
         # this module never imports the engine. Human door only, which IS the loop law.

platform/core/shared_overlay.py

@@ -101,7 +101,7 @@ ALLOWED_FIELD_KEYS = frozenset({
     'note', 'description', '_note',
     # display and behaviour
     'format', 'agg', 'options', 'optionColors', 'colorCodeOptions', 'default', 'pinned',
-    'filterable', 'multi', 'max', 'derived', 'preset', 'custom', 'profile', 'link',
+    'filterable', 'multi', 'max', 'derived', 'preset', 'custom', 'profile', 'link', 'recurrence',
     # the created strata's computation bags
     'formula', 'measure', 'metric', 'rollup', 'geocode', 'code', 'automation', 'aiEnrich',
     'scope',
@@ -449,6 +449,39 @@ def put_cells(table_key, pid, values, st=None):
     return clean
 
 
+def put_cells_and_choice_options(table_key, pid, values, choice_values, st=None):
+    """Write shared cells plus their newly admitted choice labels in ONE mutation.
+
+    Product contract columns such as ``sub_category`` have shared values and therefore need their
+    learned vocabulary in this same shared schema document.  A separate `put_cells` then
+    `put_field` sequence could leave a durable value that no fresh picker recognises if the second
+    write fails.  The caller has already validated the labels; this function only merges them
+    atomically with the values using the canonical choice cleaner.
+    """
+    row_id = _pid(pid)
+    clean = {str(k): _value(v) for k, v in dict(values or {}).items() if str(k)}
+    additions = {str(key): list(labels or ()) for key, labels in
+                 (choice_values or {}).items() if str(key) and labels}
+    if not clean:
+        return {}
+
+    def _patch(data):
+        data['cells'].setdefault(row_id, {}).update(clean)
+        if not additions:
+            return
+        # `aios_grid` deliberately has no app-internal imports; this core persistence layer can
+        # consume its pure normaliser to keep case folding and the 50-option cap identical.
+        from aios_grid import merge_choice_options
+        for key, labels in additions.items():
+            prior = data['fields'].get(key)
+            entry = dict(prior) if isinstance(prior, dict) else {'key': key}
+            entry['options'] = merge_choice_options(entry.get('options'), labels)
+            data['fields'][key] = entry
+
+    _write(table_key, _patch, st)
+    return clean
+
+
 def put_rows(table_key, rows, st=None):
     """Write shared cells on MANY rows in ONE store update. Returns `{row_id: {key: value}}`.
 

platform/core/table_store.py

@@ -189,7 +189,15 @@ def source_override_is_empty(payload):
     return (not str(payload.get('note') or '').strip()
             and not isinstance(payload.get('measure'), dict)
             and not isinstance(payload.get('format'), dict)
-            and not str(payload.get('agg') or '').strip())
+            and not str(payload.get('agg') or '').strip()
+            # W43: a learned source-column vocabulary is durable field state.  Dropping an
+            # otherwise-empty override here made a successfully added option disappear on the
+            # next payload, which is indistinguishable from an input that never saved.
+            and not isinstance(payload.get('options'), list)
+            # A source Date field owns recurrence metadata.  It is durable configuration just
+            # like display format, not a generated cell value, so a note-less field must retain
+            # the override that carries it.
+            and not isinstance(payload.get('recurrence'), dict))
 
 
 def _unique_name(wanted, existing, *, fallback='Untitled', max_len=120):
@@ -1138,6 +1146,36 @@ class TableStore:
 
         self._update(username, _patch)
 
+    def patch_overlay_with_choice_options(self, username, pid, updates, choice_values):
+        """Persist cell updates and newly admitted choice labels in one workspace update.
+
+        The event wall has already checked field visibility, edit permission, label size, and the
+        50-choice cap.  This method owns only residency and atomicity: an overlay value must never
+        commit while the field vocabulary remains stale, because a refresh would render a cell the
+        picker cannot select.
+        """
+        clean = dict(updates or {})
+        additions = {str(key): list(values or ()) for key, values in
+                     (choice_values or {}).items() if str(key) and values}
+        if not clean:
+            return
+
+        def _patch(ws):
+            ws['overlays'].setdefault(str(int(pid)), {}).update(clean)
+            if not additions:
+                return
+            # Import here rather than at module load: `aios_grid` is intentionally independent
+            # of `core`, while this lower persistence layer may use its pure canonical cleaner.
+            from aios_grid import merge_choice_options
+            fields = ws.setdefault('fields', {})
+            for key, values in additions.items():
+                prior = fields.get(key)
+                entry = dict(prior) if isinstance(prior, dict) else {}
+                entry['options'] = merge_choice_options(entry.get('options'), values)
+                fields[key] = entry
+
+        self._update(username, _patch)
+
 
 def make(table_key, st=None):
     return TableStore(table_key, st=st)

platform/core/user_tables.py

@@ -55,6 +55,9 @@ import core.store as store
 
 STORE_KEY = 'user_tables'
 ZONE_STORE_KEY = 'table_zones'
+# A reserved, derived multi-select field.  It is table data backed by durable Zone membership,
+# not a user-editable column and therefore cannot collide with a field a user creates.
+ZONE_FIELD_KEY = '__zone__'
 MAX_TABLES = 40
 MAX_LABEL = 60
 
@@ -1198,7 +1201,9 @@ def clean_zone(raw, field_keys=None, allowed_row_ids=None):
     """One exact durable Zone shape, or ``None``.  Unknown keys never reach the store."""
     if not isinstance(raw, dict):
         return None
-    name = ' '.join(str(raw.get('name') or '').split())[:120]
+    # A multiselect cell is comma-delimited across the whole grid/filter contract, so commas
+    # cannot be legal inside one Zone label without making one Zone appear as two filter choices.
+    name = ' '.join(str(raw.get('name') or '').replace(',', ' ').split())[:120]
     geometry = _clean_zone_geometry(raw.get('geometryGeoJson'))
     if not name or geometry is None:
         return None
@@ -1229,6 +1234,12 @@ def clean_zone(raw, field_keys=None, allowed_row_ids=None):
         seen.add(pid)
         memberships.append(pid)
     out['memberships'] = memberships
+    creator = str(raw.get('createdBy') or '').strip()[:120]
+    created_at = str(raw.get('createdAt') or '').strip()[:64]
+    if creator:
+        out['createdBy'] = creator
+    if created_at:
+        out['createdAt'] = created_at
     return out
 
 
@@ -1249,7 +1260,8 @@ def zones(table_key, st=None):
     return out
 
 
-def upsert_zone(table_key, raw, field_keys=None, allowed_row_ids=None, st=None):
+def upsert_zone(table_key, raw, field_keys=None, allowed_row_ids=None, st=None,
+                created_by=None):
     """Create/update a zone by id; the returned object is the exact persisted wire shape."""
     key = str(table_key or '').strip()
     if not key:
@@ -1267,22 +1279,69 @@ def upsert_zone(table_key, raw, field_keys=None, allowed_row_ids=None, st=None):
         next_zones = []
         for zone in existing[:200]:
             if isinstance(zone, dict) and zone.get('id') == clean['id']:
-                next_zones.append(dict(clean))
+                next_zones.append({**clean,
+                                   'createdBy': zone.get('createdBy') or str(created_by or ''),
+                                   'createdAt': zone.get('createdAt') or _dt.datetime.utcnow().isoformat()})
                 replaced = True
             else:
                 next_zones.append(zone)
         if not replaced:
             if len(next_zones) >= 200:
                 return current
-            next_zones.append(dict(clean))
+            next_zones.append({**clean,
+                               'createdBy': str(created_by or ''),
+                               'createdAt': _dt.datetime.utcnow().isoformat()})
         bucket[key] = next_zones
-        result.update(clean)
+        persisted = next((zone for zone in next_zones
+                          if isinstance(zone, dict) and zone.get('id') == clean['id']), clean)
+        result.update(persisted)
         return bucket
 
     _st(st).update(ZONE_STORE_KEY, _save, flush='sync')
     return result or None
 
 
+def zone_field(table_key, st=None):
+    """The canonical derived multi-select Field for one table's durable Zones."""
+    names, seen = [], set()
+    for zone in zones(table_key, st=st):
+        name = str(zone.get('name') or '').strip()
+        if name and name not in seen:
+            names.append(name)
+            seen.add(name)
+    return {'key': ZONE_FIELD_KEY, 'label': 'Zone', 'type': 'multiselect', 'source': 'odoo',
+            'derived': True, 'multi': True, 'default': True, 'options': names,
+            'colorCodeOptions': True}
+
+
+def with_zone_field(table_key, fields, st=None):
+    """Append the table's derived Zone field once, without mutating a shared field list."""
+    base = [dict(field) if isinstance(field, dict) else field for field in (fields or ())
+            if not (isinstance(field, dict) and field.get('key') == ZONE_FIELD_KEY)]
+    return base + [zone_field(table_key, st=st)]
+
+
+def zone_cells(table_key, rows, allowed_row_ids=None, st=None):
+    """Layer canonical Zone memberships into ordinary row cells for FilterBuilder/evaluator use."""
+    allowed = ({str(pid) for pid in allowed_row_ids} if allowed_row_ids is not None else None)
+    labels_by_pid = {}
+    for zone in zones(table_key, st=st):
+        name = str(zone.get('name') or '').strip()
+        if not name:
+            continue
+        for pid in zone.get('memberships') or ():
+            key = str(pid)
+            if allowed is not None and key not in allowed:
+                continue
+            labels_by_pid.setdefault(key, []).append(name)
+    out = []
+    for row in rows or ():
+        item = dict(row)
+        item[ZONE_FIELD_KEY] = ', '.join(labels_by_pid.get(str(item.get('pid')), ()))
+        out.append(item)
+    return out
+
+
 def delete_zone(table_key, zone_id, st=None):
     """Delete only this named zone; no prefix/glob deletion exists in this contract."""
     key, zid = str(table_key or '').strip(), str(zone_id or '').strip()

platform/modules/product_data.py

@@ -288,6 +288,32 @@ class _ProductTableStore(table_store.TableStore):
         if personal:
             super().patch_overlay(username, pid, personal)
 
+    def patch_overlay_with_choice_options(self, username, pid, updates, choice_values):
+        """Keep a Product cell and its select vocabulary in the same residency transaction.
+
+        `sub_category` is a contract-declared shared overlay column.  Its values cannot go into a
+        person's workspace, and its options cannot either: a colleague must see the newly added
+        option after refreshing.  Personal Product fields still use TableStore's one-workspace
+        transaction through the parent implementation.
+        """
+        clean = dict(updates or {})
+        additions = {str(key): list(values or ()) for key, values in
+                     (choice_values or {}).items() if str(key) and values}
+        if not clean:
+            return
+        keys = set(SHARED_KEYS())
+        keys.update(shared_overlay.fields(self.table_key, st=self.st) or {})
+        shared = {k: v for k, v in clean.items() if k in keys}
+        personal = {k: v for k, v in clean.items() if k not in keys}
+        shared_choices = {k: v for k, v in additions.items() if k in keys}
+        personal_choices = {k: v for k, v in additions.items() if k not in keys}
+        if shared:
+            shared_overlay.put_cells_and_choice_options(
+                TABLE_KEY, pid, shared, shared_choices, st=self.st)
+        if personal:
+            super().patch_overlay_with_choice_options(
+                username, pid, personal, personal_choices)
+
 
 TABLE_OPS = _ProductTableStore(TABLE_KEY)
 

web/src/customer-grid/ColumnMenu.tsx

@@ -100,7 +100,7 @@ interface FieldConfigExtra {
   geocode?: { addressField: string; country?: string };
   /** ⭐ 2026-08-07 — a `link` column's target. REQUIRED for the type: `_clean_field` returns
    *  None for a link with no bag, so a create without this is a column that never appears. */
-  link?: { table: string; single?: boolean };
+  link?: { table: string; single?: boolean; selectionMode?: "manual" | "automatic" };
   /** ⭐ 2026-08-07 — a `rollup` column's aggregate. Same requirement, same reason.
    *  ⭐ 2026-08-09 — or, INSTEAD, a `source` binding: the read-through kind, which summarises
    *  rows that were never copied into the workspace. The host's `_clean_rollup` reads `source`
@@ -1242,6 +1242,8 @@ function ExtraTypeEditor({
   onLinkTable,
   linkSingle = false,
   onLinkSingle,
+  linkSelectionMode = "manual",
+  onLinkSelectionMode,
   rollupMode = "link",
   onRollupMode,
   rollupSourceOffer = { topics: [], windows: [] },
@@ -1308,6 +1310,8 @@ function ExtraTypeEditor({
   onLinkTable?: (v: string) => void;
   linkSingle?: boolean;
   onLinkSingle?: (v: boolean) => void;
+  linkSelectionMode?: "manual" | "automatic";
+  onLinkSelectionMode?: (v: "manual" | "automatic") => void;
   /** ⭐ 2026-08-09 — which KIND of rollup is being built. `"link"` folds workspace rows;
    *  `"source"` reads through to a governed Odoo topic without copying a row into the store. */
   rollupMode?: "link" | "source";
@@ -1678,11 +1682,28 @@ function ExtraTypeEditor({
             There is no other database to link to yet. Create one first, then come back.
           </div>
         ) : null}
+        <label>
+          <span>How links are chosen</span>
+          <select
+            id={`${idPrefix}-link-selection-mode`}
+            className="cg-input"
+            value={linkSelectionMode}
+            aria-label="How linked records are selected"
+            onPointerDown={(event) => event.stopPropagation()}
+            onChange={(event) => onLinkSelectionMode?.(
+              event.target.value === "automatic" ? "automatic" : "manual"
+            )}
+          >
+            <option value="manual">Nothing, I will pick the records myself</option>
+            <option value="automatic">Set links automatically</option>
+          </select>
+        </label>
         <label className="cg-cond-line">
           <input
             type="checkbox"
             checked={linkSingle}
             aria-label="Allow only one linked record"
+            onPointerDown={(event) => event.stopPropagation()}
             onChange={(event) => onLinkSingle?.(event.target.checked)}
           />
           <span>Allow only one linked record</span>
@@ -2237,6 +2258,7 @@ export default function ColumnMenu({
    */
   const [linkTable, setLinkTable] = useState("");
   const [linkSingle, setLinkSingle] = useState(false);
+  const [linkSelectionMode, setLinkSelectionMode] = useState<"manual" | "automatic">("manual");
   /** ⭐ 2026-08-09 — the read-through half. `rollupMode` decides which bag `extraFor` builds;
    *  the two are mutually exclusive because the host's `_clean_rollup` returns the `source`
    *  shape before it ever reads `link`. */
@@ -2355,6 +2377,9 @@ export default function ColumnMenu({
     });
   const [editLinkTable, setEditLinkTable] = useState(() => field.link?.table ?? "");
   const [editLinkSingle, setEditLinkSingle] = useState(() => field.link?.single === true);
+  const [editLinkSelectionMode, setEditLinkSelectionMode] = useState<"manual" | "automatic">(
+    () => field.link?.selectionMode === "automatic" ? "automatic" : "manual"
+  );
 
   const swapToNewType = swapTo.startsWith(NEW_PREFIX)
     ? (swapTo.slice(NEW_PREFIX.length) as FieldType)
@@ -2512,7 +2537,8 @@ export default function ColumnMenu({
     // picks records). The DERIVED mode is the automation's, spawned with its join declared —
     // offering "join on a column of the other table" here would be a second, harder mental
     // model for the same button.
-    if (t === "link") return { link: { table: linkTable, ...(linkSingle ? { single: true } : {}) } };
+    if (t === "link") return { link: { table: linkTable, selectionMode: linkSelectionMode,
+      ...(linkSingle ? { single: true } : {}) } };
     if (t === "rollup" && rollupMode === "source")
       // ⛔ THE SOURCE BAG TRAVELS ALONE. `_clean_rollup` reads `source` first and returns
       // immediately, so sending `link`/`fn` alongside it would ship keys the store drops —
@@ -2748,7 +2774,8 @@ export default function ColumnMenu({
     (field.type === "rollup"
       ? JSON.stringify(editRollup) !== JSON.stringify(field.rollup ?? {})
       : editLinkTable !== (field.link?.table ?? "") ||
-        editLinkSingle !== (field.link?.single === true));
+        editLinkSingle !== (field.link?.single === true) ||
+        editLinkSelectionMode !== (field.link?.selectionMode === "automatic" ? "automatic" : "manual"));
   const canSaveEdit =
     /**
      * ⭐ W41-T31 — THE DESCRIPTION-ONLY PANE'S WHOLE SAVE CONDITION, and it is one dirty flag
@@ -2821,6 +2848,7 @@ export default function ColumnMenu({
         ...(field.type === "rollup"
           ? { rollup: editRollup as Record<string, unknown> }
           : { link: { table: editLinkTable,
+                      selectionMode: editLinkSelectionMode,
                       ...(editLinkSingle ? { single: true } : {}) } }),
       });
       if (editNoteDirty) onNote(note);
@@ -3179,6 +3207,8 @@ export default function ColumnMenu({
             onLinkTable={setLinkTable}
             linkSingle={linkSingle}
             onLinkSingle={setLinkSingle}
+            linkSelectionMode={linkSelectionMode}
+            onLinkSelectionMode={setLinkSelectionMode}
             rollupMode={rollupMode}
             onRollupMode={setRollupMode}
             rollupSourceOffer={rollupSourceOffer}
@@ -3488,6 +3518,8 @@ export default function ColumnMenu({
                 onLinkTable={setEditLinkTable}
                 linkSingle={editLinkSingle}
                 onLinkSingle={setEditLinkSingle}
+                linkSelectionMode={editLinkSelectionMode}
+                onLinkSelectionMode={setEditLinkSelectionMode}
                 rollupSourceOffer={rollupSourceOffer}
                 rollupMode={editRollup.source ? "source" : "link"}
                 // ⛔ A MODE SWITCH REPLACES THE BAG, it does not merge into it. `_clean_rollup`

web/src/customer-grid/CustomerGrid.tsx

@@ -94,7 +94,7 @@ import { API_V1, CREDENTIALS, NAV_MINIMIZE_EVENT, ROWS_STALE_EVENT, TOAST_EVENT,
   from "../apiContract";
 import type { ViewOpenDetail } from "../apiContract";
 import { addTableField, addTableRow, clearTopicRowsCache, deleteRouteOrderField, deleteTableField,
-  deleteTableRow, fetchLinkTargets,
+  deleteTableRow, dropTableRowsCache, fetchLinkTargets, refusalMessage,
   fetchRollupSources, patchRouteOrderField, patchTableField, enrichField } from "./apiBridge";
 import type { LinkTarget, RollupSourceOffer } from "./apiBridge";
 import SelectFromFile from "./SelectFromFile";
@@ -133,6 +133,7 @@ import { DashboardView } from "../viz/DashboardView";
 import { cleanCharts } from "../viz/chartData";
 import type { ChartSpec } from "../viz/chartData";
 import { MapView } from "./MapView";
+import type { RouteSourceView } from "./MapView";
 /* ═══ W18-C CATALOG ═══ (owner item 4, contract C6) */
 import { CatalogView } from "./CatalogView";
 import { CATALOG_CODE_FIELD } from "./catalogData";
@@ -166,6 +167,7 @@ import { ALL_VIEW_ID, MAX_CALENDAR_METRICS, allViewName,
   isPickType, mayEditField,
   isModeFrozen, isUndeletableView, mayEditView, mayToggleViewLock,
   measureColumnIndex, ratingMax, ruleColumnKeys,
+  shouldAdoptEmbeddedSelection,
   tableMode, uniqueDisplayName,
   /* ⭐ W41-T38 — the rail's OWN name resolver, so a collision test compares what the reader
      actually sees. The rail has always drawn `viewDisplayName(view)`; `renameView` was testing
@@ -264,6 +266,29 @@ const ONE_LINE = { whiteSpace: "nowrap" } as const;
 function frozenCountOf(config: ViewConfig): number {
   return Math.min(MAX_FROZEN, Math.max(1, config.frozenCount ?? 1));
 }
+
+/**
+ * A View has a durable id but no server-side revision counter on this wire.  A key-sorted,
+ * deterministic configuration fingerprint is therefore the actual revision of the View state
+ * that produced a frozen route snapshot.  It is provenance, not a permission token.
+ */
+function routeViewRevision(viewId: string, config: ViewConfig): string {
+  const canonical = (value: unknown): unknown => {
+    if (Array.isArray(value)) return value.map(canonical);
+    if (value && typeof value === "object") {
+      const out: Record<string, unknown> = {};
+      for (const key of Object.keys(value as Record<string, unknown>).sort())
+        out[key] = canonical((value as Record<string, unknown>)[key]);
+      return out;
+    }
+    return value;
+  };
+  const text = JSON.stringify(canonical({ viewId, config }));
+  let hash = 0x811c9dc5;
+  for (let index = 0; index < text.length; index += 1)
+    hash = Math.imul(hash ^ text.charCodeAt(index), 0x01000193);
+  return `view-config-v1-${(hash >>> 0).toString(36)}`;
+}
 /* WAVE 21 item 3 (R6): the id and the NAME both moved to `types.ts` — the id because a second
    copy of a pinned literal is the drift class this repo gates against, the name because it is
    now topic-derived and the host mints the same string. */
@@ -1357,7 +1382,14 @@ function CustomerGridSurface({
   const [bulkUpdateOpen, setBulkUpdateOpen] = useState(false);
   const [bulkFieldKey, setBulkFieldKey] = useState("");
   const [bulkValue, setBulkValue] = useState("");
+  const [serverBulkPending, setServerBulkPending] = useState(false);
   const bulkUpdateRef = useRef<HTMLButtonElement>(null);
+  /** A windowed "all filtered" selection lives on the server: a signed descriptor represents
+   * every matching record, not the rows currently loaded in Glide. */
+  const [serverFilteredSelection, setServerFilteredSelection] = useState<{
+    token: string;
+    matched: number;
+  } | null>(null);
   /** Owner item 4 / C-ADDROW — the pid the trailing "+" just created, so the cursor can land on
    *  it once the re-read actually brings it back (the row does not exist locally before that). */
   const [newRowPid, setNewRowPid] = useState<number | null>(null);
@@ -2972,17 +3004,69 @@ function CustomerGridSurface({
       embeddedSelectable ? embeddedSelectedIds : [],
       !embedded ? `aios:grid-selection:${scope}` : undefined
     );
-  const embeddedSelectedKey = embeddedSelectedIds.join(",");
-  const selectedPidKey = [...selectedPids].join(",");
+  // A Link picker is controlled by its modal parent.  Do not treat the parent's PREVIOUS prop as
+  // a new command after the child has just ticked a row: doing that reset the checkbox before the
+  // child effect could report the new selection upward, so it visibly flickered.  Only a prop
+  // value that actually changed since the last render is an external selection to apply.
+  const embeddedSelectedKey = [...embeddedSelectedIds].sort((a, b) => a - b).join(",");
+  const selectedPidKey = [...selectedPids].sort((a, b) => a - b).join(",");
+  const embeddedPropKeyRef = useRef(embeddedSelectedKey);
   useEffect(() => {
-    if (!embeddedSelectable) return;
-    if (selectedPidKey !== embeddedSelectedKey)
+    if (!embeddedSelectable) {
+      embeddedPropKeyRef.current = embeddedSelectedKey;
+      return;
+    }
+    const priorParentKey = embeddedPropKeyRef.current;
+    if (embeddedSelectedKey === priorParentKey) return;
+    embeddedPropKeyRef.current = embeddedSelectedKey;
+    if (shouldAdoptEmbeddedSelection(priorParentKey, embeddedSelectedKey, selectedPidKey))
       selectPids(embeddedSelectedIds as number[], "replace");
   }, [embeddedSelectable, embeddedSelectedKey, embeddedSelectedIds, selectedPidKey, selectPids]);
   useEffect(() => {
     if (!embeddedSelectable) return;
     onEmbeddedSelectionChange?.([...selectedPids]);
   }, [embeddedSelectable, onEmbeddedSelectionChange, selectedPids]);
+  // A descriptor binds the exact filter/search/sort at the time the person chose "Select all".
+  // Do not let it survive a predicate change and silently mean a different population.
+  useEffect(() => {
+    setServerFilteredSelection(null);
+  }, [serverWindowed, windowPredicate]);
+  const selectAllServerFiltered = useCallback(async () => {
+    if (!serverWindowed) return;
+    try {
+      const response = await fetch(
+        `${API_V1}/odoo-tables/${encodeURIComponent(scope)}/filtered-selection`,
+        {
+          method: "POST",
+          credentials: CREDENTIALS,
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            filters: config.filters,
+            filterConj: config.filterConj,
+            sorts: config.sorts,
+            search,
+          }),
+        }
+      );
+      const payload = await response.json().catch(() => null) as {
+        selection?: unknown; matched?: unknown; error?: { message?: unknown };
+      } | null;
+      if (!response.ok) {
+        signal(TOAST_EVENT, refusalMessage(payload, response.status));
+        return;
+      }
+      const token = typeof payload?.selection === "string" ? payload.selection : "";
+      const matched = typeof payload?.matched === "number" ? payload.matched : 0;
+      if (!token || matched <= 0) {
+        setServerFilteredSelection(null);
+        signal(TOAST_EVENT, "No records match this filtered view.");
+        return;
+      }
+      setServerFilteredSelection({ token, matched });
+    } catch {
+      signal(TOAST_EVENT, "Could not select all filtered records. Try again.");
+    }
+  }, [serverWindowed, scope, config.filters, config.filterConj, config.sorts, search]);
   /* ════════════════════════ owner item 16 / R4 / C-UNDO ════════════════════════
      THE RECORDING LAYER. `undoStack.ts` owns the stack and every inverse; this owns the one
      thing it cannot: reading the value a cell held BEFORE the write, which only exists at the
@@ -3205,16 +3289,61 @@ function CustomerGridSurface({
     [currentValue, patchOverlay, recordCells]
   );
   const bulkEditableFields = useMemo(
-    () => fields.filter((field) => canEditField(field) && field.type !== "rating"),
-    [fields, canEditField]
+    () => fields.filter((field) => (
+      serverWindowed
+        // Connected records themselves are source-owned.  Only an already-declared shared
+        // overlay field is writable through the server descriptor, with the usual field grant.
+        ? field.shared === true && mayEditField(field, viewer)
+        : canEditField(field)
+    ) && field.type !== "rating"),
+    [fields, serverWindowed, viewer, canEditField]
   );
   const bulkField = bulkEditableFields.find((field) => field.key === bulkFieldKey) ?? bulkEditableFields[0];
-  const applyBulkUpdate = useCallback(() => {
-    if (!bulkField || selectedPids.size === 0) return;
+  const bulkSelectedCount = serverFilteredSelection?.matched ?? selectedPids.size;
+  const applyBulkUpdate = useCallback(async () => {
+    if (!bulkField || bulkSelectedCount === 0 || serverBulkPending) return;
     const value = bulkField.type === "checkbox" ? (bulkValue === "1" ? "1" : "") : bulkValue;
+    if (serverFilteredSelection) {
+      setServerBulkPending(true);
+      try {
+        const response = await fetch(
+          `${API_V1}/odoo-tables/${encodeURIComponent(scope)}/filtered-bulk`,
+          {
+            method: "POST",
+            credentials: CREDENTIALS,
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ selection: serverFilteredSelection.token, field: bulkField.key, value }),
+          }
+        );
+        const payload = await response.json().catch(() => null) as {
+          rows_written?: unknown; matched?: unknown; error?: { message?: unknown };
+        } | null;
+        if (!response.ok) {
+          signal(TOAST_EVENT, refusalMessage(payload, response.status));
+          return;
+        }
+        const written = typeof payload?.rows_written === "number" ? payload.rows_written : 0;
+        const matched = typeof payload?.matched === "number" ? payload.matched : bulkSelectedCount;
+        // Do not paint loaded rows as though they were the whole update.  Invalidate every cached
+        // window and request a fresh one, then state exactly what the server says it wrote.
+        dropTableRowsCache(scope);
+        requestWindow(windowRequest(0));
+        signal(ROWS_STALE_EVENT);
+        setServerFilteredSelection(null);
+        clearSelection();
+        setBulkUpdateOpen(false);
+        signal(TOAST_EVENT, `Updated ${written.toLocaleString()} of ${matched.toLocaleString()} filtered records.`);
+      } catch {
+        signal(TOAST_EVENT, "Could not update the filtered records. Try again.");
+      } finally {
+        setServerBulkPending(false);
+      }
+      return;
+    }
     patchManyAndRecord([...selectedPids].map((pid) => ({ pid, updates: { [bulkField.key]: value } })), "a bulk update");
     setBulkUpdateOpen(false);
-  }, [bulkField, bulkValue, patchManyAndRecord, selectedPids]);
+  }, [bulkField, bulkSelectedCount, bulkValue, clearSelection, dropTableRowsCache, patchManyAndRecord,
+      requestWindow, scope, selectedPids, serverBulkPending, serverFilteredSelection, windowRequest]);
 
   /**
    * Apply one stack entry in one direction. The INVERSE lives in `undoStack.directed` — this
@@ -7066,6 +7195,13 @@ function CustomerGridSurface({
   }
 
   const activeView = views.find((view) => view.id === activeViewId);
+  const routeSourceView: RouteSourceView | null = activeView
+    ? {
+        id: activeView.id,
+        name: viewDisplayName(activeView),
+        revision: routeViewRevision(activeView.id, config),
+      }
+    : null;
   // Cohort mode's toolbar control (rendered by Toolbar via the `cohortAction` slot; the popover
   // it opens is with the other overlays at the bottom). Disabled without an active cohort —
   // zero cohorts is the host page's near-empty state, not this button's error to explain.
@@ -8671,6 +8807,8 @@ function CustomerGridSurface({
               }}
               onRouteFieldCreated={revealRouteField}
               routePanelOpen={routePanelOpen}
+              activeView={routeSourceView}
+              tableKey={topic.key}
               /* ⭐ OWNER ITEM 9 — the route's "Add a record" search reaches PAST the view's own
                  filter, so it is handed `scopedRows`: the book after the row wall (`allowed_pids`
                  plus the business-unit scope) and before `useVisibleRows` applies filters, search
@@ -8799,6 +8937,42 @@ function CustomerGridSurface({
               broke this gate's own coordinate math before it broke a user). It states the
               count and offers "Add to cohort" over exactly the checked pids — the same guarded
               add_to_list event the view menu uses, so the host treats both alike. */}
+          {!embedded && serverWindowed &&
+            (selectedPids.size > 0 || serverFilteredSelection !== null) &&
+            displayMode === "grid" && (
+            <div className="cg-selbar" data-kind="server-filtered-selection">
+              <span className="cg-selbar-count">
+                {bulkSelectedCount.toLocaleString()} selected
+              </span>
+              {!serverFilteredSelection && (payload?.counts?.matched ?? 0) > 0 && (
+                <button
+                  type="button"
+                  className="cg-btn cg-selbar-all"
+                  style={ONE_LINE}
+                  onClick={() => void selectAllServerFiltered()}
+                >
+                  Select all {(payload?.counts?.matched ?? 0).toLocaleString()} filtered
+                </button>
+              )}
+              {bulkEditableFields.length > 0 && (
+                <button
+                  ref={bulkUpdateRef}
+                  type="button"
+                  className="cg-btn cg-selbar-update"
+                  style={ONE_LINE}
+                  aria-expanded={bulkUpdateOpen}
+                  aria-haspopup="dialog"
+                  onClick={() => setBulkUpdateOpen((open) => !open)}
+                >
+                  Update field
+                </button>
+              )}
+              <button type="button" className="cg-btn" style={ONE_LINE}
+                      onClick={() => { setServerFilteredSelection(null); clearSelection(); }}>
+                Clear
+              </button>
+            </div>
+          )}
           {!embedded && selectedPids.size > 0 && !serverWindowed &&
             (displayMode === "grid" || displayMode === "map") && (
             <div className="cg-selbar">
@@ -9456,7 +9630,7 @@ function CustomerGridSurface({
       {/* ⭐ Owner item 9 — the remove picker. Every row states how many of the CHECKED rows it
           would take out ("3 of 4"), because the selection and the cohort are two different sets
           and the difference is the whole reason this needs a picker rather than a button. */}
-      {bulkUpdateOpen && bulkUpdateRef.current && selectedPids.size > 0 && bulkField && (
+      {bulkUpdateOpen && bulkUpdateRef.current && bulkSelectedCount > 0 && bulkField && (
         <AnchoredOverlay
           anchor={bulkUpdateRef.current}
           className="cg-pop cg-bulk-update-pop"
@@ -9467,7 +9641,7 @@ function CustomerGridSurface({
           dataKind="filtered-bulk-update"
         >
           <div className="cg-pop-title">Update field</div>
-          <div className="cg-pop-note">Updates all {selectedPids.size.toLocaleString()} selected records in this filtered view.</div>
+          <div className="cg-pop-note">Updates all {bulkSelectedCount.toLocaleString()} selected records in this filtered view.</div>
           <select className="cg-select" aria-label="Field to update" value={bulkFieldKey || bulkField.key} onChange={(event) => { setBulkFieldKey(event.target.value); setBulkValue(""); }}>
             {bulkEditableFields.map((field) => <option key={field.key} value={field.key}>{field.label}</option>)}
           </select>
@@ -9479,7 +9653,10 @@ function CustomerGridSurface({
             <input className="cg-input" aria-label="New value" value={bulkValue} onChange={(event) => setBulkValue(event.target.value)} />
           )}
           <div className="cg-form-actions">
-            <button type="button" className="cg-btn cg-btn--primary" style={ONE_LINE} onClick={applyBulkUpdate}>Update records</button>
+            <button type="button" className="cg-btn cg-btn--primary" style={ONE_LINE}
+                    disabled={serverBulkPending} onClick={() => void applyBulkUpdate()}>
+              {serverBulkPending ? "Updating records…" : "Update records"}
+            </button>
             <button type="button" className="cg-btn" style={ONE_LINE} onClick={() => setBulkUpdateOpen(false)}>Cancel</button>
           </div>
         </AnchoredOverlay>
@@ -9640,7 +9817,7 @@ function CustomerGridSurface({
           value={dateValue}
           today={today}
           onChange={(value) => patchAndRecord(datePicker.pid, { [dateField.key]: value }, "a date")}
-          onRecurrence={(recurrence, nextDate) => saveField({ ...dateField, recurrence, nextDate })}
+          onRecurrence={(recurrence) => saveField({ ...dateField, recurrence: recurrence ?? null })}
           onClose={() => {
             setDatePicker(null);
             requestAnimationFrame(() => gridRef.current?.focus());

web/src/customer-grid/DatePicker.tsx

@@ -1,165 +1,106 @@
-import { useMemo, useState } from "react";
-import type { Field } from "./types";
+import { useEffect, useMemo, useState } from "react";
+import { API_V1, CREDENTIALS } from "../apiContract";
+import type { DateRecurrence, DateRecurrenceRule, Field } from "./types";
 import { AnchoredOverlay } from "./OverlaySurface";
 import type { AnchorRect } from "./OverlaySurface";
 
-type Frequency = NonNullable<Field["recurrence"]>["frequency"];
-
-const MONTHS = [
-  "January", "February", "March", "April", "May", "June",
-  "July", "August", "September", "October", "November", "December",
-];
+const MONTHS = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
 const WEEKDAYS = ["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"];
+const ORDINALS: ReadonlyArray<readonly [DateRecurrenceRule["ordinal"], string]> = [[1, "First"], [2, "Second"], [3, "Third"], [4, "Fourth"], [5, "Fifth"], [-1, "Last"]];
+const DEFAULT_CALENDARS = [{ code: "US" as const, label: "United States federal holidays" }, { code: "CA" as const, label: "Canada federal public holidays" }];
+type RuleKind = DateRecurrenceRule["kind"] | "monthly_ordinal";
+type CalendarOption = { code: "US" | "CA"; label: string };
 
 function parseIso(value: unknown): Date | null {
   if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(value)) return null;
   const [year, month, day] = value.split("-").map(Number);
   const date = new Date(Date.UTC(year, month - 1, day));
-  return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day
-    ? date
-    : null;
-}
-
-function iso(date: Date): string {
-  return date.toISOString().slice(0, 10);
-}
-
-function addMonths(date: Date, amount: number): Date {
-  const out = new Date(date);
-  out.setUTCMonth(out.getUTCMonth() + amount);
-  return out;
-}
-
-function isUsHoliday(date: Date): boolean {
-  const month = date.getUTCMonth();
-  const day = date.getUTCDate();
-  // Fixed federal holidays plus the common observed weekday. The API remains the authority for
-  // an exact calendar; this prevents the local preview from presenting a known holiday as a work day.
-  if ((month === 0 && day === 1) || (month === 6 && day === 4) || (month === 11 && day === 25)) return true;
-  const weekday = date.getUTCDay();
-  if (month === 0 && day === 1 && weekday === 6) return true;
-  if (month === 0 && day === 2 && weekday === 1) return true;
-  if (month === 6 && day === 3 && weekday === 5) return true;
-  if (month === 6 && day === 5 && weekday === 1) return true;
-  if (month === 11 && day === 24 && weekday === 5) return true;
-  if (month === 11 && day === 26 && weekday === 1) return true;
-  // MLK, Memorial, Labor and Thanksgiving.
-  if (month === 0 && weekday === 1 && day >= 15 && day <= 21) return true;
-  if (month === 4 && weekday === 1 && day + 7 > 31) return true;
-  if (month === 8 && weekday === 1 && day <= 7) return true;
-  return month === 10 && weekday === 4 && day >= 22 && day <= 28;
+  return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day ? date : null;
 }
-
-export function nextRecurringDates(
-  start: string,
-  recurrence: Field["recurrence"],
-  count = 6,
-): string[] {
-  const seed = parseIso(start);
-  const frequency: Frequency = recurrence?.frequency ?? "none";
-  if (!seed || frequency === "none") return seed ? [iso(seed)] : [];
-  const interval = Math.max(1, Math.min(365, Math.round(recurrence?.interval ?? 1)));
-  const out: string[] = [];
-  let candidate = new Date(seed);
-  let guard = 0;
-  while (out.length < count && guard++ < count * 400) {
-    if (guard > 1) {
-      if (frequency === "daily") candidate.setUTCDate(candidate.getUTCDate() + interval);
-      else if (frequency === "weekly") candidate.setUTCDate(candidate.getUTCDate() + 7 * interval);
-      else if (frequency === "monthly") candidate = addMonths(candidate, interval);
-      else candidate.setUTCFullYear(candidate.getUTCFullYear() + interval);
-    }
-    const weekday = candidate.getUTCDay();
-    const allowedWeekday = !recurrence?.weekdays?.length || recurrence.weekdays.includes(weekday);
-    const holiday = recurrence?.skipHolidays && recurrence.holidayCalendar === "us" && isUsHoliday(candidate);
-    if (allowedWeekday && !holiday) out.push(iso(candidate));
-  }
-  return out;
+function iso(date: Date): string { return date.toISOString().slice(0, 10); }
+function addMonths(date: Date, amount: number): Date { const out = new Date(date); out.setUTCMonth(out.getUTCMonth() + amount); return out; }
+function bounded(value: unknown, lower: number, upper: number, fallback: number): number { const number = Math.round(Number(value)); return Number.isFinite(number) ? Math.max(lower, Math.min(upper, number)) : fallback; }
+function ruleKind(rule: DateRecurrenceRule): RuleKind { return rule.kind === "monthly" && rule.ordinal !== undefined ? "monthly_ordinal" : rule.kind; }
+function newRule(kind: RuleKind, selected: Date): DateRecurrenceRule {
+  if (kind === "weekly") return { kind, interval: 1, weekdays: [((selected.getUTCDay() + 6) % 7)] };
+  if (kind === "monthly_ordinal") return { kind: "monthly", interval: 1, ordinal: 1, weekday: 0 };
+  if (kind === "monthly") return { kind, interval: 1, day: selected.getUTCDate() };
+  if (kind === "yearly") return { kind, interval: 1, month: selected.getUTCMonth() + 1, day: selected.getUTCDate() };
+  if (kind === "holiday") return { kind, interval: 1, calendar: "US", offset: 0 };
+  return { kind, interval: 1 };
 }
+function labelForKind(kind: RuleKind): string { return ({ daily: "Every N days", weekly: "Every N weeks", monthly: "Day of every N months", monthly_ordinal: "Ordinal weekday of every N months", yearly: "Every N years", holiday: "Public holiday" } as Record<RuleKind, string>)[kind]; }
 
-export function DatePicker({
-  anchor,
-  field,
-  value,
-  today,
-  onChange,
-  onRecurrence,
-  onClose,
-}: {
-  anchor: AnchorRect;
-  field: Field;
-  value: unknown;
-  today?: string;
-  onChange: (value: string) => void;
-  onRecurrence: (recurrence: NonNullable<Field["recurrence"]>, nextDate: string | undefined) => void;
-  onClose: () => void;
+export function DatePicker({ anchor, field, value, today, onChange, onRecurrence, onClose }: {
+  anchor: AnchorRect; field: Field; value: unknown; today?: string; onChange: (value: string) => void;
+  onRecurrence: (recurrence: DateRecurrence | null) => void; onClose: () => void;
 }) {
   const selected = parseIso(value) ?? parseIso(today) ?? new Date();
+  const selectedIso = iso(selected);
   const [cursor, setCursor] = useState(() => new Date(Date.UTC(selected.getUTCFullYear(), selected.getUTCMonth(), 1)));
-  const [frequency, setFrequency] = useState<Frequency>(field.recurrence?.frequency ?? "none");
-  const [interval, setInterval] = useState(field.recurrence?.interval ?? 1);
-  const [skipHolidays, setSkipHolidays] = useState(!!field.recurrence?.skipHolidays);
-  const recurrence = useMemo<NonNullable<Field["recurrence"]>>(
-    () => ({
-      ...field.recurrence,
-      frequency,
-      interval: Math.max(1, Math.min(365, Math.round(Number(interval) || 1))),
-      skipHolidays,
-      holidayCalendar: skipHolidays ? "us" : undefined,
-    }),
-    [field.recurrence, frequency, interval, skipHolidays],
-  );
-  const next = useMemo(
-    () => nextRecurringDates(iso(selected), recurrence),
-    [recurrence, selected],
-  );
+  const [rules, setRules] = useState<DateRecurrenceRule[]>(() => field.recurrence?.rules ?? []);
+  const [previewCount, setPreviewCount] = useState(() => field.recurrence?.previewCount ?? 10);
+  const [preview, setPreview] = useState<string[]>(() => field.recurrence?.preview ?? []);
+  const [nextDate, setNextDate] = useState<string | null | undefined>(() => field.recurrence?.nextDate);
+  const [calendars, setCalendars] = useState<CalendarOption[]>(DEFAULT_CALENDARS);
+  const [previewError, setPreviewError] = useState("");
+  const recurrence = useMemo<DateRecurrence | null>(() => rules.length ? ({ startDate: selectedIso, rules, previewCount: bounded(previewCount, 1, 50, 10) }) : null, [previewCount, rules, selectedIso]);
+
+  // Server-evaluated preview: the exact payload saved below is sent here, so edited previews
+  // cannot differ from the default next date after refresh because of timezone/holiday drift.
+  useEffect(() => {
+    if (!recurrence) { setPreview([]); setNextDate(undefined); setPreviewError(""); return; }
+    const controller = new AbortController();
+    void fetch(`${API_V1}/grid/recurrence-preview`, { method: "POST", credentials: CREDENTIALS, signal: controller.signal,
+      headers: { "Content-Type": "application/json" }, body: JSON.stringify({ recurrence })
+    }).then(async (response) => {
+      const data = await response.json().catch(() => ({}));
+      if (!response.ok) throw new Error(String(data?.detail?.message ?? "Could not preview recurrence"));
+      return data as { recurrence?: DateRecurrence; calendars?: CalendarOption[] };
+    }).then((data) => {
+      if (controller.signal.aborted) return;
+      if (data.recurrence) { setPreview(data.recurrence.preview ?? []); setNextDate(data.recurrence.nextDate); }
+      if (Array.isArray(data.calendars) && data.calendars.length) setCalendars(data.calendars);
+      setPreviewError("");
+    }).catch((error: unknown) => { if (!controller.signal.aborted) setPreviewError(error instanceof Error ? error.message : "Could not preview recurrence"); });
+    return () => controller.abort();
+  }, [recurrence]);
+
+  const updateRule = (index: number, patch: Partial<DateRecurrenceRule>) => setRules((current) => current.map((rule, item) => item === index ? { ...rule, ...patch } : rule));
+  const replaceKind = (index: number, kind: RuleKind) => setRules((current) => current.map((rule, item) => item === index ? newRule(kind, selected) : rule));
+  const toggleWeekday = (index: number, weekday: number, checked: boolean) => setRules((current) => current.map((rule, item) => {
+    if (item !== index) return rule;
+    const existing = rule.weekdays ?? [];
+    const weekdays = checked ? [...new Set([...existing, weekday])].sort() : existing.filter((day) => day !== weekday);
+    return { ...rule, weekdays: weekdays.length ? weekdays : existing };
+  }));
   const monthStart = new Date(Date.UTC(cursor.getUTCFullYear(), cursor.getUTCMonth(), 1));
   const leading = (monthStart.getUTCDay() + 6) % 7;
   const days = new Date(Date.UTC(cursor.getUTCFullYear(), cursor.getUTCMonth() + 1, 0)).getUTCDate();
   const cells = Array.from({ length: Math.ceil((leading + days) / 7) * 7 }, (_, index) => index - leading + 1);
-  const selectedIso = iso(selected);
 
-  return (
-    <AnchoredOverlay
-      anchor={anchor}
-      className="cg-date-picker"
-      placement="bottom-start"
-      onDismiss={onClose}
-      role="dialog"
-      ariaLabel={`Choose a date for ${field.label}`}
-      dataKind="date-picker"
-    >
-      <div className="cg-date-picker-head">
-        <button type="button" className="cg-icon-button" aria-label="Previous month" onClick={() => setCursor(addMonths(cursor, -1))}>‹</button>
-        <strong>{MONTHS[cursor.getUTCMonth()]} {cursor.getUTCFullYear()}</strong>
-        <button type="button" className="cg-icon-button" aria-label="Next month" onClick={() => setCursor(addMonths(cursor, 1))}>›</button>
-      </div>
-      <div className="cg-date-weekdays">{WEEKDAYS.map((day) => <span key={day}>{day}</span>)}</div>
-      <div className="cg-date-grid">
-        {cells.map((day, index) => {
-          if (day < 1 || day > days) return <span key={`blank-${index}`} aria-hidden />;
-          const date = new Date(Date.UTC(cursor.getUTCFullYear(), cursor.getUTCMonth(), day));
-          const dateIso = iso(date);
-          return <button key={dateIso} type="button" className={"cg-date-day" + (dateIso === selectedIso ? " is-selected" : "")} aria-pressed={dateIso === selectedIso} onClick={() => onChange(dateIso)}>{day}</button>;
-        })}
-      </div>
-      <div className="cg-date-recurrence">
-        <div className="cg-pop-title">Repeat</div>
-        <label>Every <input className="cg-input cg-date-interval" min="1" max="365" type="number" value={interval} onChange={(event) => setInterval(Number(event.target.value))} /></label>
-        <select className="cg-select" value={frequency} aria-label="Recurrence frequency" onChange={(event) => setFrequency(event.target.value as Frequency)}>
-          <option value="none">Does not repeat</option>
-          <option value="daily">day</option>
-          <option value="weekly">week</option>
-          <option value="monthly">month</option>
-          <option value="yearly">year</option>
-        </select>
-        {frequency !== "none" && <label className="cg-date-holidays"><input type="checkbox" checked={skipHolidays} onChange={(event) => setSkipHolidays(event.target.checked)} /> Skip US public holidays</label>}
-        {frequency !== "none" && <button type="button" className="cg-link-btn" onClick={() => onRecurrence(recurrence, next[0])}>Save recurrence</button>}
-      </div>
-      <div className="cg-date-preview" aria-live="polite">
-        <div className="cg-pop-title">Next dates</div>
-        {next.slice(0, 6).map((date) => <span key={date}>{date}</span>)}
-      </div>
-    </AnchoredOverlay>
-  );
+  return <AnchoredOverlay anchor={anchor} className="cg-date-picker" placement="bottom-start" onDismiss={onClose} role="dialog" ariaLabel={`Choose a date for ${field.label}`} dataKind="date-picker">
+    <div className="cg-date-picker-head"><button type="button" className="cg-icon-button" aria-label="Previous month" onClick={() => setCursor(addMonths(cursor, -1))}>‹</button><strong>{MONTHS[cursor.getUTCMonth()]} {cursor.getUTCFullYear()}</strong><button type="button" className="cg-icon-button" aria-label="Next month" onClick={() => setCursor(addMonths(cursor, 1))}>›</button></div>
+    <div className="cg-date-weekdays">{WEEKDAYS.map((day) => <span key={day}>{day}</span>)}</div>
+    <div className="cg-date-grid">{cells.map((day, index) => {
+      if (day < 1 || day > days) return <span key={`blank-${index}`} aria-hidden />;
+      const dateIso = iso(new Date(Date.UTC(cursor.getUTCFullYear(), cursor.getUTCMonth(), day)));
+      return <button key={dateIso} type="button" className={"cg-date-day" + (dateIso === selectedIso ? " is-selected" : "")} aria-pressed={dateIso === selectedIso} onClick={() => onChange(dateIso)}>{day}</button>;
+    })}</div>
+    <div className="cg-date-recurrence"><div className="cg-pop-title">Repeat rules</div>
+      {rules.map((rule, index) => <div className="cg-date-rule" key={`${rule.kind}-${index}`}>
+        <select className="cg-select" value={ruleKind(rule)} aria-label={`Repeat rule ${index + 1}`} onChange={(event) => replaceKind(index, event.target.value as RuleKind)}>{(["daily", "weekly", "monthly", "monthly_ordinal", "yearly", "holiday"] as RuleKind[]).map((kind) => <option key={kind} value={kind}>{labelForKind(kind)}</option>)}</select>
+        <label>Every <input className="cg-input cg-date-interval" min="1" max="366" type="number" value={rule.interval ?? 1} onChange={(event) => updateRule(index, { interval: bounded(event.target.value, 1, 366, 1) })} /></label>
+        {rule.kind === "weekly" && <div className="cg-date-holidays" aria-label="Weekdays">{WEEKDAYS.map((day, weekday) => <label key={day}><input type="checkbox" checked={(rule.weekdays ?? []).includes(weekday)} onChange={(event) => toggleWeekday(index, weekday, event.target.checked)} />{day}</label>)}</div>}
+        {rule.kind === "monthly" && rule.ordinal === undefined && <label>Day <input className="cg-input cg-date-interval" min="1" max="31" type="number" value={rule.day ?? 1} onChange={(event) => updateRule(index, { day: bounded(event.target.value, 1, 31, 1) })} /></label>}
+        {rule.kind === "monthly" && rule.ordinal !== undefined && <div className="cg-date-holidays"><select className="cg-select" value={rule.ordinal} aria-label="Month ordinal" onChange={(event) => updateRule(index, { ordinal: Number(event.target.value) as DateRecurrenceRule["ordinal"] })}>{ORDINALS.map(([value, label]) => <option key={value} value={value}>{label}</option>)}</select><select className="cg-select" value={rule.weekday ?? 0} aria-label="Month weekday" onChange={(event) => updateRule(index, { weekday: Number(event.target.value) })}>{WEEKDAYS.map((day, weekday) => <option key={day} value={weekday}>{day}</option>)}</select></div>}
+        {rule.kind === "yearly" && <div className="cg-date-holidays"><label>Month <input className="cg-input cg-date-interval" min="1" max="12" type="number" value={rule.month ?? 1} onChange={(event) => updateRule(index, { month: bounded(event.target.value, 1, 12, 1) })} /></label><label>Day <input className="cg-input cg-date-interval" min="1" max="31" type="number" value={rule.day ?? 1} onChange={(event) => updateRule(index, { day: bounded(event.target.value, 1, 31, 1) })} /></label></div>}
+        {rule.kind === "holiday" && <div className="cg-date-holidays"><select className="cg-select" value={rule.calendar ?? "US"} aria-label="Public calendar" onChange={(event) => updateRule(index, { calendar: event.target.value as "US" | "CA" })}>{calendars.map((calendar) => <option key={calendar.code} value={calendar.code}>{calendar.label}</option>)}</select><select className="cg-select" value={rule.offset ?? 0} aria-label="Holiday relation" onChange={(event) => updateRule(index, { offset: Number(event.target.value) as -1 | 0 | 1 })}><option value={-1}>Day before</option><option value={0}>Day on</option><option value={1}>Day after</option></select></div>}
+        <button type="button" className="cg-link-btn" onClick={() => setRules((current) => current.filter((_, item) => item !== index))}>Remove rule</button>
+      </div>)}
+      <button type="button" className="cg-link-btn" onClick={() => setRules((current) => [...current, newRule("daily", selected)])}>+ Add repeat rule</button>
+      {rules.length > 0 && <><label>Show next <select className="cg-select" value={previewCount} aria-label="Number of preview dates" onChange={(event) => setPreviewCount(bounded(event.target.value, 1, 50, 10))}>{[3, 5, 10, 20, 50].map((count) => <option key={count} value={count}>{count}</option>)}</select> dates</label><div className="cg-date-holidays"><button type="button" className="cg-link-btn" onClick={() => recurrence && onRecurrence(recurrence)}>Save recurrence</button><button type="button" className="cg-link-btn" onClick={() => onRecurrence(null)}>Clear recurrence</button></div></>}
+    </div>
+    <div className="cg-date-preview" aria-live="polite"><div className="cg-pop-title">Next dates{nextDate ? ` · next ${nextDate}` : ""}</div>{preview.map((date) => <span key={date}>{date}</span>)}{rules.length > 0 && !preview.length && !previewError && <span>Calculating the server preview…</span>}{previewError && <span role="status">{previewError}</span>}</div>
+  </AnchoredOverlay>;
 }

web/src/customer-grid/MapView.tsx

@@ -326,6 +326,22 @@ type ZoneGeometry = {
   coordinates: number[][][] | number[][][][];
 };
 
+/** Move a durable GeoJSON boundary without changing its topology or membership snapshot. */
+export function translateZoneGeometry(
+  geometry: ZoneGeometry, delta: { lon: number; lat: number }
+): ZoneGeometry {
+  const point = (pair: number[]) => [
+    Math.max(-180, Math.min(180, pair[0] + delta.lon)),
+    Math.max(-90, Math.min(90, pair[1] + delta.lat)),
+  ];
+  if (geometry.type === "Polygon") {
+    return { type: "Polygon", coordinates: (geometry.coordinates as number[][][])
+      .map((ring) => ring.map(point)) };
+  }
+  return { type: "MultiPolygon", coordinates: (geometry.coordinates as number[][][][])
+    .map((polygon) => polygon.map((ring) => ring.map(point))) };
+}
+
 /** C3's durable map-domain DTO. Zones are not generic fields: geometry, visibility and the
  * membership snapshot only make sense to this projection. */
 interface MapZone {
@@ -340,6 +356,11 @@ interface MapZone {
   createdAt?: string;
 }
 
+interface ZoneMove {
+  zone: MapZone;
+  start: Pt;
+}
+
 interface RouteDelivery {
   id: string;
   name: string;
@@ -356,6 +377,13 @@ interface RouteDelivery {
   };
 }
 
+/** Immutable provenance supplied by the host grid for a scheduled route snapshot. */
+export interface RouteSourceView {
+  id: string;
+  name: string;
+  revision: string;
+}
+
 interface MapPoint {
   pid: number;
   title: string;
@@ -400,6 +428,8 @@ export function MapView({
   onRouteFieldCreated,
   routePanelOpen,
   allRows,
+  activeView,
+  tableKey,
 }: {
   /** DISTINCT data rows from the full pipeline, overlay edits layered — the
    *  calendar/kanban contract, verbatim. */
@@ -437,6 +467,10 @@ export function MapView({
   onGeocoded?: (writes: { pid: number; value: string }[]) => void;
   onRouteFieldCreated?: (key: string) => void;
   routePanelOpen: boolean;
+  /** The real active View driving this map, never a map-local synthetic id. */
+  activeView: RouteSourceView | null;
+  /** Canonical database identity for durable, table-scoped Zones. */
+  tableKey: string;
   /**
    * ⭐⭐ OWNER ITEM 9 — THE WHOLE BOOK, so a stop can be added that the VIEW filtered out.
    *
@@ -499,12 +533,15 @@ export function MapView({
    * array is an honest, editable no-Zones state. */
   const [zones, setZones] = useState<MapZone[] | null>(null);
   const [activeZoneIds, setActiveZoneIds] = useState<ReadonlySet<string>>(new Set());
+  const [zoneChooserOpen, setZoneChooserOpen] = useState(false);
   const [zoneEditorId, setZoneEditorId] = useState("");
   const [zoneName, setZoneName] = useState("");
   const [zoneColor, setZoneColor] = useState(ZONE_COLOR_CHOICES[0].value);
   const [zoneGeographicField, setZoneGeographicField] = useState("");
   const [zoneGeographicValue, setZoneGeographicValue] = useState("");
   const [drawnZoneGeometry, setDrawnZoneGeometry] = useState<ZoneGeometry | null>(null);
+  const [zoneMove, setZoneMove] = useState<ZoneMove | null>(null);
+  const [zoneGeometryDraft, setZoneGeometryDraft] = useState<{ id: string; geometry: ZoneGeometry } | null>(null);
   const [zoneBusy, setZoneBusy] = useState(false);
   const [zoneErr, setZoneErr] = useState<string | null>(null);
   /**
@@ -788,13 +825,15 @@ export function MapView({
 
   const loadZones = useCallback(async () => {
     try {
-      const res = await fetch("/api/v1/geo/zones", { credentials: "same-origin" });
+      const res = await fetch(`/api/v1/geo/zones?tableKey=${encodeURIComponent(tableKey)}`, {
+        credentials: "same-origin",
+      });
       const body = res.ok ? await res.json().catch(() => null) : null;
       setZones(Array.isArray(body?.zones) ? body.zones : []);
     } catch {
       setZones([]);
     }
-  }, []);
+  }, [tableKey]);
   useEffect(() => { void loadZones(); }, [loadZones]);
 
   const activeZones = useMemo(
@@ -810,8 +849,36 @@ export function MapView({
     () => (zones || []).find((zone) => zone.id === zoneEditorId) || null,
     [zones, zoneEditorId]
   );
+  /**
+   * Zone visibility is a checkbox chooser, not a ctrl-click native multi-select.  A toggle also
+   * immediately projects the Zone's durable membership onto the grid selection; removing one
+   * Zone preserves records that are still held by another checked Zone.
+   */
+  const toggleZone = useCallback((zone: MapZone, checked: boolean) => {
+    const next = new Set(activeZoneIds);
+    if (checked) next.add(zone.id);
+    else next.delete(zone.id);
+    const stillHeld = new Set<number>();
+    for (const item of zones || []) {
+      if (!next.has(item.id)) continue;
+      for (const pid of item.memberships || []) stillHeld.add(pid);
+    }
+    const selection = new Set(selectedPids);
+    if (checked) for (const pid of zone.memberships || []) selection.add(pid);
+    else for (const pid of zone.memberships || []) if (!stillHeld.has(pid)) selection.delete(pid);
+    onSelectPids([...selection], "replace");
+    setActiveZoneIds(next);
+    if (checked) {
+      setZoneEditorId(zone.id);
+      setZoneName(zone.name);
+      setZoneColor(zone.color);
+      setZoneGeographicField(zone.geographicField || "");
+    }
+  }, [activeZoneIds, zones, selectedPids, onSelectPids]);
   const zonePolygons = useMemo(() => activeZones.flatMap((zone) => {
-    const geometry = zone.geometryGeoJson;
+    const geometry = zoneGeometryDraft?.id === zone.id
+      ? zoneGeometryDraft.geometry
+      : zone.geometryGeoJson;
     const polygons = geometry?.type === "Polygon"
       ? [geometry.coordinates as number[][][]]
       : geometry?.type === "MultiPolygon"
@@ -824,7 +891,7 @@ export function MapView({
         .filter((pair) => Array.isArray(pair) && Number.isFinite(pair[0]) && Number.isFinite(pair[1]))
         .map((pair) => project(pair[0], pair[1])),
     })).filter((ring) => ring.points.length >= 4));
-  }), [activeZones]);
+  }), [activeZones, zoneGeometryDraft]);
 
   const selectionZoneGeometry = useCallback((): ZoneGeometry | null => {
     if (drawnZoneGeometry) return drawnZoneGeometry;
@@ -858,6 +925,7 @@ export function MapView({
         credentials: "same-origin",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
+          tableKey,
           name,
           color: zoneColor || existing?.color || ZONE_COLOR_CHOICES[0].value,
           geometryGeoJson,
@@ -886,11 +954,7 @@ export function MapView({
     } finally {
       setZoneBusy(false);
     }
-  }, [selectionZoneGeometry, zoneName, zoneColor, zoneGeographicField, selectedPids]);
-
-  const selectActiveZoneRecords = useCallback(() => {
-    if (activeZonePids.size) onSelectPids([...activeZonePids], "replace");
-  }, [activeZonePids, onSelectPids]);
+  }, [selectionZoneGeometry, zoneName, zoneColor, zoneGeographicField, selectedPids, tableKey]);
 
   const setZoneVisible = useCallback(async (zone: MapZone, visible: boolean) => {
     setZoneBusy(true);
@@ -900,7 +964,7 @@ export function MapView({
         method: "PATCH",
         credentials: "same-origin",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ visible }),
+        body: JSON.stringify({ tableKey, visible }),
       });
       const body = await res.json().catch(() => null);
       if (!res.ok) {
@@ -914,7 +978,32 @@ export function MapView({
     } finally {
       setZoneBusy(false);
     }
-  }, []);
+  }, [tableKey]);
+
+  /** Persist a direct boundary drag without re-deriving membership from the current selection. */
+  const persistZoneGeometry = useCallback(async (zone: MapZone, geometryGeoJson: ZoneGeometry) => {
+    setZoneBusy(true);
+    setZoneErr(null);
+    try {
+      const res = await fetch(`/api/v1/geo/zones/${encodeURIComponent(zone.id)}`, {
+        method: "PATCH",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ tableKey, geometryGeoJson }),
+      });
+      const body = await res.json().catch(() => null);
+      if (!res.ok) {
+        setZoneErr(body?.error?.message || "The Zone boundary could not be saved.");
+        return;
+      }
+      const saved = body?.zone as MapZone | undefined;
+      if (saved) setZones((current) => (current || []).map((item) => item.id === saved.id ? saved : item));
+    } catch {
+      setZoneErr("The Zone boundary could not be saved.");
+    } finally {
+      setZoneBusy(false);
+    }
+  }, [tableKey]);
 
   // The fit is the INITIAL view, not the projection (see mapProjection.ts).
   const fit = useMemo(
@@ -1118,26 +1207,21 @@ export function MapView({
    * this component through `useVisibleRows`' filter -> search -> SORT -> group pipeline, so
    * "the first N" means the first N as the view is sorted -- the user's own ranking, which is
    * the only ranking this surface has. The owner asked for "the top SKU"; the map has no SKU,
-   * and inventing one would be a plausible order nobody chose. `autoCapped` carries what was
-   * left out so the panel can report it rather than quietly routing a subset.
+   * and inventing one would be a plausible order nobody chose. Bulk selection now remains an
+   * explicit action, so simply opening the route rail cannot alter the current selection.
    */
-  const autoRouteRef = useRef(false);
-  const [autoCapped, setAutoCapped] = useState(0);
-  useEffect(() => {
-    if (!routePanelOpen || !routeCreateOpen) {
-      autoRouteRef.current = false;
-      setAutoCapped(0);
-      return;
-    }
-    if (autoRouteRef.current || points.length < 2) return;
-    autoRouteRef.current = true;
-    if (selectedPids.size >= 2) return;
-    const take = points.slice(0, ROUTE_STOP_CAP);
-    setAutoCapped(points.length - take.length);
-    onSelectPids(take.map((p) => p.pid), "replace");
+  /**
+   * Opening Routes is intentionally inert.  This explicitly labelled control is the sole bulk
+   * selection door: it takes every record matched by the current View (never a hidden cap of
+   * mapped pins) and then starts the local planner.
+   */
+  const selectFilteredRouteRecords = useCallback(() => {
+    const pids = rows.map((row) => row.pid).filter((pid) => Number.isFinite(pid) && pid > 0);
+    if (!pids.length) return;
+    onSelectPids(pids, "replace");
     setRouteOn(true);
     setRouteOrder(null);
-  }, [routePanelOpen, routeCreateOpen, points, selectedPids, onSelectPids]);
+  }, [rows, onSelectPids]);
 
   /** The depot joins BOTH index-parallel arrays below at position zero, and only there. */
   const depotPoint = useMemo((): MapPoint | null => {
@@ -1428,6 +1512,10 @@ export function MapView({
 
   const scheduleRouteDelivery = useCallback(async () => {
     if (!plan || !routeRecipient.trim()) return;
+    if (!activeView?.id || !activeView.revision) {
+      setRouteScheduleErr("Open a saved View before scheduling a route.");
+      return;
+    }
     const orderedStopIds = plan.ordered.map((point) => point.pid).filter((pid) => pid > 0);
     if (orderedStopIds.length < 2) return;
     setRouteScheduleBusy(true);
@@ -1446,11 +1534,11 @@ export function MapView({
           recipient: routeRecipient.trim(),
           schedule: { cron: "0 8 * * *", enabled: true },
           routeSnapshot: {
-            // MapView deliberately consumes C2's snapshot seam rather than persisting anything
-            // through View/field machinery it does not own. The fingerprint is the frozen revision.
-            sourceViewId: "map-current",
-            sourceViewRevision: plan.fingerprint,
-            sourceViewName: `${field.label} map route`,
+            // This route's stop ids are frozen below. The View tuple is provenance, supplied by
+            // CustomerGrid from the actual active View and its canonical configuration revision.
+            sourceViewId: activeView.id,
+            sourceViewRevision: activeView.revision,
+            sourceViewName: activeView.name,
             timezone,
             routeField: saveTarget || openedRoute,
             orderedStopIds,
@@ -1473,7 +1561,7 @@ export function MapView({
     } finally {
       setRouteScheduleBusy(false);
     }
-  }, [plan, routeRecipient, openedRoute, routeCols, field.label, saveTarget, mapsPerLink]);
+  }, [plan, routeRecipient, openedRoute, routeCols, activeView, saveTarget, mapsPerLink]);
 
   /**
    * ⭐⭐ OWNER, 2026-08-23 — **OPEN A SAVED ROUTE AND SEE IT ON THE MAP.**
@@ -1994,6 +2082,21 @@ export function MapView({
 
   const onPointerMove = useCallback(
     (e: ReactPointerEvent<SVGSVGElement>) => {
+      const { x, y } = localPoint(e.clientX, e.clientY);
+      if (zoneMove && view) {
+        if (Math.abs(x - zoneMove.start.x) + Math.abs(y - zoneMove.start.y) <= 2) return;
+        movedRef.current = true;
+        const origin = unproject(fromScreen(zoneMove.start, view));
+        const current = unproject(fromScreen({ x, y }, view));
+        setZoneGeometryDraft({
+          id: zoneMove.zone.id,
+          geometry: translateZoneGeometry(zoneMove.zone.geometryGeoJson, {
+            lon: current.lon - origin.lon,
+            lat: current.lat - origin.lat,
+          }),
+        });
+        return;
+      }
       // ⭐⭐ THE LAZY CAPTURE (W38-T09's fix). A gesture only becomes a drag once it has TRAVELLED,
       // so the capture is taken here rather than on pointerdown. A zero-movement click therefore
       // never captures and reaches the pin it was aimed at; a pan or a marquee captures the
@@ -2009,7 +2112,6 @@ export function MapView({
       if (dn && dn.id === e.pointerId && !e.currentTarget.hasPointerCapture(e.pointerId)
           && Math.abs(e.clientX - dn.cx) + Math.abs(e.clientY - dn.cy) > 3)
         e.currentTarget.setPointerCapture(e.pointerId);
-      const { x, y } = localPoint(e.clientX, e.clientY);
       if (drag) {
         // ⚠ W37-T30: this used to set `movedRef` UNCONDITIONALLY, and that is what swallowed a
         // shift-CLICK. Holding shift starts a marquee on pointerdown, so a shift-click is a
@@ -2040,7 +2142,7 @@ export function MapView({
       touchedRef.current = true;
       setView((v) => (v ? { ...v, tx: pan.tx + (x - pan.x), ty: pan.ty + (y - pan.y) } : v));
     },
-    [drag, localPoint]
+    [drag, localPoint, zoneMove, view]
   );
 
   /**
@@ -2095,6 +2197,17 @@ export function MapView({
 
   const onPointerUp = useCallback(
     (e: ReactPointerEvent<SVGSVGElement>) => {
+      if (zoneMove) {
+        const geometry = zoneGeometryDraft?.id === zoneMove.zone.id
+          ? zoneGeometryDraft.geometry
+          : null;
+        setZoneMove(null);
+        setZoneGeometryDraft(null);
+        if (geometry) void persistZoneGeometry(zoneMove.zone, geometry);
+        if (e.currentTarget.hasPointerCapture(e.pointerId))
+          e.currentTarget.releasePointerCapture(e.pointerId);
+        return;
+      }
       if (drag && view) {
         // A gesture smaller than a few px is a mis-click, not a selection —
         // clearing the user's set on a stray shift-click would be its own bug.
@@ -2137,7 +2250,7 @@ export function MapView({
       if (e.currentTarget.hasPointerCapture(e.pointerId))
         e.currentTarget.releasePointerCapture(e.pointerId);
     },
-    [drag, view, points, onSelectPids]
+    [drag, view, points, onSelectPids, zoneMove, zoneGeometryDraft, persistZoneGeometry]
   );
 
   /**
@@ -2310,6 +2423,7 @@ export function MapView({
                 className="cg-route-index-create"
                 onClick={() => {
                   setOpenedRoute("");
+                  setSaveTarget("");
                   setRouteOn(false);
                   setRouteOrder(null);
                   setRouteCreateOpen(true);
@@ -2431,7 +2545,7 @@ export function MapView({
                   ⛔ EVERY route this account may see, `mine` or not — `GET /customers/route-order`
                   has already applied the per-field wall, so what is listed here is exactly what
                   the grid would show. Whether you may RE-SOLVE one is a different question, and
-                  it is answered by the Visit order field select further down. */}
+                  it is answered by the saved route's own edit flow, never by a second selector. */}
               {(routeCols || []).length > 0 && (
                 <>
                   <label className="cg-map-route-opt cg-route-field">
@@ -2588,21 +2702,6 @@ export function MapView({
                   ⚠ NOT a `cg-cal-nodate` (the red one). Neither of these is an error: the first
                   says what the panel took on the user's behalf, the second warns about a click
                   that has not been spent yet. */}
-              {/* ⚠ THE FIRST NOTE RETIRES ITSELF THE MOMENT IT STOPS BEING TRUE. `autoCapped` is
-                  what the auto-fill left out, and it stays set for as long as the panel is open
-                  -- but the sentence it prints is about the CURRENT cohort, and a person who
-                  then deselects half the pins is no longer routing "the first 100". Gated on the
-                  selection still being exactly the slice that was taken, so the disclosure
-                  disappears with the situation it describes rather than becoming a small lie in
-                  the corner of the panel. */}
-              {autoCapped > 0 && customerRoutable.length === ROUTE_STOP_CAP && (
-                <span className="cg-map-route-note">
-                  Routing the first {ROUTE_STOP_CAP.toLocaleString()} pins in this view, in the
-                  order the view is sorted. {autoCapped.toLocaleString()} more are mapped here:
-                  the routing service takes {ROUTE_STOP_CAP.toLocaleString()} stops in one
-                  request, so sort or filter the view to choose which ones travel.
-                </span>
-              )}
               {customerRoutable.length > ROUTE_STOP_CAP && (
                 <span className="cg-map-route-note">
                   {customerRoutable.length.toLocaleString()} stops selected. The routing service
@@ -2624,6 +2723,15 @@ export function MapView({
                   Splitting them here to leave Save at the bottom would break the older instruction
                   while honouring the newer one. ══ */}
               {/* ── ITEM 9: add a record the view is not showing ────────────────────────────── */}
+              <button
+                type="button"
+                className="cg-btn"
+                disabled={rows.length === 0}
+                onClick={selectFilteredRouteRecords}
+                title="Select every record currently matched by this View and plan the route"
+              >
+                Select all {rows.length.toLocaleString()} filtered records
+              </button>
               {allRows && allRows.length > 0 && (
                 <RecordPicker
                   label="Add a record"
@@ -2645,29 +2753,11 @@ export function MapView({
                   vocabulary a person has to translate. The SERVER key is untouched. */}
               {plan && (
                 <>
-                  <label className="cg-map-route-opt cg-route-field">
-                    Visit order field
-                    <select
-                      className="cg-route-select"
-                      value={saveTarget}
-                      aria-label="Which visit order field to write"
-                      onChange={(e) => {
-                        setSaveTarget(e.target.value);
-                        setRouteStartPid(null);
-                        setSaveMsg(null);
-                        setSaveErr(null);
-                      }}
-                    >
-                      <option value="">New field</option>
-                      {(routeCols || [])
-                        .filter((f) => f.mine)
-                        .map((f) => (
-                          <option key={f.key} value={f.key}>
-                            {f.label}
-                          </option>
-                        ))}
-                    </select>
-                  </label>
+                  <span className="cg-map-route-note">
+                    {saveTarget
+                      ? `Updating ${(routeCols || []).find((route) => route.key === saveTarget)?.label || "this route"}.`
+                      : "Save this plan as a new route."}
+                  </span>
                   {/* ⚠ THIS NOTE STAYS WITH THE SELECT, while items 8 and 9 send the Save
                       button and the Google links to the foot. It is a statement about what
                       the LIST ABOVE does not contain ("not listed above"), so it is the one
@@ -3078,32 +3168,34 @@ export function MapView({
         {geoControl}
         {zones !== null && (
           <div className="cg-map-zones" role="group" aria-label="Map Zones">
-            <label className="cg-map-zone-control">
-              Zones
-              <select
-                className="cg-route-select"
-                multiple
-                value={[...activeZoneIds]}
-                aria-label="Visible map Zones"
-                onChange={(event) => {
-                  const ids = [...event.currentTarget.selectedOptions].map((option) => option.value);
-                  setActiveZoneIds(new Set(ids));
-                  const chosenZone = (zones || []).find((zone) => zone.id === ids[0]);
-                  setZoneEditorId(chosenZone?.id || "");
-                  if (chosenZone) {
-                    setZoneName(chosenZone.name);
-                    setZoneColor(chosenZone.color);
-                    setZoneGeographicField(chosenZone.geographicField || "");
-                  }
-                }}
+            <div className="cg-map-zone-chooser">
+              <button
+                type="button"
+                className="cg-btn"
+                aria-expanded={zoneChooserOpen}
+                aria-controls="cg-map-zone-choices"
+                onClick={() => setZoneChooserOpen((open) => !open)}
               >
-                {(zones || []).map((zone) => (
-                  <option key={zone.id} value={zone.id}>
-                    {zone.visible ? zone.name : `${zone.name} (hidden)`}
-                  </option>
-                ))}
-              </select>
-            </label>
+                Zones{activeZoneIds.size ? ` (${activeZoneIds.size.toLocaleString()})` : ""}
+              </button>
+              {zoneChooserOpen && (
+                <div id="cg-map-zone-choices" className="cg-map-zone-choices" role="group" aria-label="Visible map Zones">
+                  {(zones || []).length === 0 ? (
+                    <span className="cg-map-zone-empty">No Zones yet.</span>
+                  ) : (zones || []).map((zone) => (
+                    <label className="cg-map-zone-choice" key={zone.id}>
+                      <input
+                        type="checkbox"
+                        checked={activeZoneIds.has(zone.id)}
+                        onChange={(event) => toggleZone(zone, event.target.checked)}
+                      />
+                      <span className="cg-map-zone-swatch" style={{ backgroundColor: zone.color }} aria-hidden="true" />
+                      <span>{zone.visible ? zone.name : `${zone.name} (hidden)`}</span>
+                    </label>
+                  ))}
+                </div>
+              )}
+            </div>
             <button
               type="button"
               className="cg-btn"
@@ -3116,21 +3208,11 @@ export function MapView({
             >
               New Zone
             </button>
-            <button
-              type="button"
-              className="cg-btn"
-              disabled={activeZonePids.size === 0}
-              onClick={selectActiveZoneRecords}
-              title="Select records in the chosen visible Zones"
-            >
-              Select Zone records
-            </button>
             <button
               type="button"
               className="cg-btn"
               disabled={activeZonePids.size < 2}
               onClick={() => {
-                selectActiveZoneRecords();
                 setRouteCreateOpen(true);
                 setRouteOn(false);
                 setRouteOrder(null);
@@ -3216,7 +3298,9 @@ export function MapView({
               className="cg-btn"
               disabled={zoneBusy}
               onClick={() => void saveZone(zoneEditor || undefined)}
-              title={drawnZoneGeometry ? "Save the drawn Zone" : "Save a Zone around the selected records"}
+              title={drawnZoneGeometry
+                ? (zoneEditor ? "Replace this Zone boundary with the drawn shape" : "Save the drawn Zone")
+                : "Save a Zone around the selected records"}
             >
               {zoneBusy ? "Saving Zone" : zoneEditor ? "Update Zone" : "Save Zone"}
             </button>
@@ -3326,12 +3410,28 @@ export function MapView({
                 fill={ring.zone.color}
                 stroke={ring.zone.color}
                 strokeWidth={hair(1.4)}
+                onPointerDown={(event) => {
+                  if (event.button !== 0 || !view) return;
+                  event.stopPropagation();
+                  movedRef.current = false;
+                  const svg = event.currentTarget.ownerSVGElement;
+                  svg?.setPointerCapture(event.pointerId);
+                  setZoneMove({
+                    zone: ring.zone,
+                    start: localPoint(event.clientX, event.clientY),
+                  });
+                }}
                 onClick={(event) => {
                   event.stopPropagation();
-                  onSelectPids(ring.zone.memberships, "replace");
+                  if (movedRef.current) {
+                    movedRef.current = false;
+                    return;
+                  }
+                  if (!activeZoneIds.has(ring.zone.id)) toggleZone(ring.zone, true);
+                  else onSelectPids(ring.zone.memberships, "replace");
                 }}
               >
-                <title>{`${ring.zone.name}: select Zone records`}</title>
+                <title>{`${ring.zone.name}: click to select records, drag to move boundary`}</title>
               </polygon>
             ))}
             {/* The planned path, UNDER the pins so it never hides a stop. Inside

web/src/customer-grid/map.css

@@ -255,7 +255,55 @@
   font: 500 var(--lp-fs-3xs)/1.35 Inter, system-ui, sans-serif;
 }
 
-.cg-map-zone-control select[multiple] { min-height: 52px; }
+.cg-map-zone-chooser {
+  position: relative;
+}
+
+.cg-map-zone-choices {
+  position: absolute;
+  z-index: 4;
+  top: calc(100% + 4px);
+  left: 0;
+  display: grid;
+  width: min(280px, calc(100vw - 32px));
+  max-height: 248px;
+  overflow-y: auto;
+  padding: 5px;
+  border: 1px solid var(--lp-line);
+  border-radius: 6px;
+  background: var(--lp-panel, #fff);
+  box-shadow: 0 8px 20px rgba(24, 39, 55, 0.14);
+}
+
+.cg-map-zone-choice {
+  display: grid;
+  grid-template-columns: 14px 10px minmax(0, 1fr);
+  align-items: center;
+  gap: 7px;
+  min-height: 28px;
+  padding: 3px 5px;
+  border-radius: 4px;
+  color: var(--lp-ink);
+  cursor: pointer;
+  font: 500 var(--lp-fs-2xs)/1.35 Inter, system-ui, sans-serif;
+}
+
+.cg-map-zone-choice:hover { background: var(--lp-hover, #f3f6f9); }
+
+.cg-map-zone-choice input { margin: 0; }
+
+.cg-map-zone-swatch {
+  width: 9px;
+  height: 9px;
+  border: 1px solid color-mix(in srgb, var(--lp-ink) 30%, transparent);
+  border-radius: 50%;
+}
+
+.cg-map-zone-empty {
+  padding: 7px 6px;
+  color: var(--lp-muted);
+  font: 400 var(--lp-fs-2xs)/1.35 Inter, system-ui, sans-serif;
+}
 
 /* --- the address lookup (T37) ---------------------------------------------
  *

web/src/customer-grid/types.ts

@@ -104,6 +104,33 @@ export type AiCellState = "agent" | "human" | "stale" | "error";
 
 export type FieldSource = "odoo" | "overlay";
 
+/** The durable Date-field schedule. The API owns validation and every preview calculation. */
+export type DateRecurrenceRule = {
+  kind: "daily" | "weekly" | "monthly" | "yearly" | "holiday";
+  interval?: number;
+  /** Monday = 0, matching the server's ISO weekday contract. */
+  weekdays?: number[];
+  /** Monthly day (1..31), or yearly month/day. */
+  day?: number;
+  month?: number;
+  /** Monthly first..fifth (1..5), or last (-1), plus an ISO weekday. */
+  ordinal?: -1 | 1 | 2 | 3 | 4 | 5;
+  weekday?: number;
+  /** Only an API-supplied public calendar can be saved. */
+  calendar?: "US" | "CA";
+  /** -1 = day before, 0 = day on, 1 = day after. */
+  offset?: -1 | 0 | 1;
+};
+
+export type DateRecurrence = {
+  startDate: string;
+  rules: DateRecurrenceRule[];
+  previewCount?: number;
+  /** Derived by the server; never written as an independent schedule value. */
+  nextDate?: string | null;
+  preview?: string[];
+};
+
 /**
  * R13 — the languages a `code` column may declare. Mirrors `aios_grid.CODE_LANGUAGES`
  * name-for-name; the fields-contract gate diffs the two, because a language the client offers
@@ -2150,17 +2177,8 @@ export interface Field {
    * The host may add calendar-specific keys over time; this small, forward-compatible core is
    * enough for the editor to describe the next occurrence without inventing a second cell value.
    */
-  recurrence?: {
-    frequency?: "none" | "daily" | "weekly" | "monthly" | "yearly";
-    interval?: number;
-    weekdays?: number[];
-    skipHolidays?: boolean;
-    holidayCalendar?: "us";
-    /** Server-computed next dates win over the browser preview when supplied. */
-    preview?: string[];
-  };
-  /** The server-authoritative next date for a recurring Date field. */
-  nextDate?: string;
+  /** `null` is an explicit clear in a field-upsert request; persisted payloads omit it. */
+  recurrence?: DateRecurrence | null;
   /**
    * Whether select-family choices render with coloured pills. Absent means true so legacy
    * fields keep their existing appearance; an explicit false is the user's opt-out.
@@ -2409,6 +2427,9 @@ export interface Field {
     reciprocal?: string;
     /** Airtable's `prefersSingleRecordLink` */
     single?: boolean;
+    /** W43: how the relation is populated. Manual keeps the ordinary record picker available;
+     * automatic is retained as schema state for a configured/engine-driven relation. */
+    selectionMode?: "manual" | "automatic";
   };
   /**
    * ⭐ 2026-08-07 — an AGGREGATE over the rows a `link` column resolves (Airtable's `rollup`).
@@ -3179,6 +3200,23 @@ export function rowsAuthoritative(sel: {
   return sel.current === undefined || sel.rows.length > 0;
 }
 
+
+/**
+ * Whether an embedded Link picker should adopt its parent's selection command.
+ *
+ * A parent prop that has not changed is merely the stale value from before the user's checkbox
+ * click; applying it would erase that click before the child reports upward.  The pure predicate
+ * lives here so the controlled-selection race has a node-runnable regression rather than a JSX
+ * comment that can drift.
+ */
+export function shouldAdoptEmbeddedSelection(
+  priorParentKey: string,
+  parentKey: string,
+  localKey: string
+): boolean {
+  return priorParentKey !== parentKey && localKey !== parentKey;
+}
+
 /**
  * ⭐ Wave-20 owner item 2 — **WHICH COLUMN A FILTER RULE IS ABOUT, and it is not always
  * `rule.colId`.**

web/src/shell/Shell.tsx

@@ -1136,10 +1136,6 @@ function ShellFrame() {
   const expandRail = useCallback(() => {
     setNavCollapsed(false);
   }, []);
-  /** …and every deliberate fold through here. The AUTOMATIC fold has its own handler, below. */
-  const collapseRail = useCallback(() => {
-    setNavCollapsed(true);
-  }, []);
   // Owner item 3 (2026-07-31) — the collapsed strip names its icons on hover. A real DOM
   // tooltip positioned FIXED beside the rail: the rail scrolls and clips (overflow), so a
   // CSS ::after inside it could never escape; and it is pointer-events:none by standing rule
@@ -1224,6 +1220,11 @@ function ShellFrame() {
     setRail((s) => ({ ...s, at: 0 }));
     setDbQuery("");
   }, []);
+  /** A folded rail is always the global rail, never a squeezed database path. */
+  const collapseRail = useCallback(() => {
+    closeDbFly();
+    setNavCollapsed(true);
+  }, [closeDbFly]);
   /** Drill into the database list. RESUMES the walk rather than restarting it — see `closeDbFly`. */
   const openData = useCallback(() => {
     setRail((s) =>
@@ -1292,13 +1293,13 @@ function ShellFrame() {
     const onToast = (e: Event) => setToast(String((e as CustomEvent).detail ?? ""));
     // ⭐⭐ W38-T04 (R9) — THE AUTOMATIC FOLD IS UNCONDITIONAL, AND THAT IS THE WHOLE RULE.
     // `NAV_MINIMIZE_EVENT` fires from `CustomerGrid` on EVERY cell click and EVERY view switch;
-    // this is its only listener, and it sets, every time, with nothing in front of it. W34-T12's
+    // this is its only listener, and it folds, every time, with nothing in front of it. W34-T12's
     // `railHeldOpen` guard stood here and is deleted (see the block by `expandRail` for why the
     // ref went with it). ⛔ ANY early return, condition or stored preference added between this
-    // line and the setter re-creates the behaviour owner item 3 asked to be fixed FOREVER — and
+    // line and the fold re-creates the behaviour owner item 3 asked to be fixed FOREVER — and
     // `verify_ui.py`'s `W38-T04 unconditional` leg exists to go red the moment one appears.
     const onNavMinimize = () => {
-      setNavCollapsed(true);
+      collapseRail();
     };
     // C-SHARE: the rail asks, the frame opens. A malformed detail opens NOTHING —
     // `parseShareRequest` fail-closes on an unknown kind rather than launching a
@@ -1317,7 +1318,7 @@ function ShellFrame() {
       window.removeEventListener(NAV_MINIMIZE_EVENT, onNavMinimize);
       window.removeEventListener(SHARE_OPEN_EVENT, onShareOpen);
     };
-  }, []);
+  }, [collapseRail]);
 
   // The toast clears itself; nothing else depends on it having been seen.
   useEffect(() => {
@@ -2272,7 +2273,7 @@ function ShellFrame() {
             ⚠ THE TWO CLASSES COMPOSE, in the right order: while `/nav` is in flight the skeleton
             rule hides `.shell-level` too, so a rail cannot paint a database list over a loading
             frame. */}
-        <nav className={"shell-nav" + (railLoading ? " is-rail-loading" : "") + (dbAt ? " is-datalevel" : "")}>
+        <nav className={"shell-nav" + (railLoading ? " is-rail-loading" : "") + (!navCollapsed && dbAt ? " is-datalevel" : "")}>
           {/* ⭐⭐ W33-T75 — THE ONE IN-FLIGHT STATE. `is-rail-loading` hides every sibling below
               (`navExtras.css`), so a row cannot paint ahead of its neighbours. Rendering the rows
               and hiding them — rather than not rendering them — is deliberate: the flyout portal,
@@ -2609,7 +2610,7 @@ function ShellFrame() {
               spells the string it is retiring can hold a grep-gate green over an empty file.
               `verify_home` strips comments before it looks, so this one could have quoted them
               safely today; the next gate to read this file may not. */}
-          {dbAt ? (
+          {!navCollapsed && dbAt ? (
                 <div className="shell-level">
                   {/* ⭐ THE PATH HEADER (owner instruction 29) — *"a back '<' and forward '>'
                       button so we can go to the previous path or next path that we have already

web/wiring_rows/wave43_shell_repair.py

@@ -0,0 +1,25 @@
+"""Wave 43 continuation shell-repair — DatePicker consumer wiring.
+
+The DatePicker implementation and CustomerGrid mount are owned by the grid lane. This module
+records their completed cross-fence contract in the shared WIRINGS map, so the coverage ratchet
+cannot mistake a mounted calendar for an unowned component again.
+"""
+from __future__ import annotations
+
+
+ROWS: list[tuple[str, str, str, str, str]] = [
+    ("W43C-T02 DatePicker is DECLARED and MOUNTED by the grid",
+     "customer-grid/DatePicker.tsx", r"export function DatePicker\(",
+     "customer-grid/CustomerGrid.tsx", r"<DatePicker"),
+    ("W43C-T02 a picked date writes through the grid's ordinary record patch door",
+     "customer-grid/DatePicker.tsx", r"onChange: \(value: string\) => void;",
+     "customer-grid/CustomerGrid.tsx",
+     r'onChange=\{\(value\) => patchAndRecord\(datePicker\.pid, \{ \[dateField\.key\]: value \}, "a date"\)\}'),
+    ("W43C-T02 recurrence is a required DatePicker contract and persists the field definition",
+     "customer-grid/DatePicker.tsx",
+     r'onRecurrence: \(recurrence: NonNullable<Field\["recurrence"\]>, nextDate: string \| undefined\) => void;',
+     "customer-grid/CustomerGrid.tsx",
+     r'onRecurrence=\{\(recurrence, nextDate\) => saveField\(\{ \.\.\.dateField, recurrence, nextDate \}\)\}'),
+]
+
+DELETIONS: list[tuple[str, str, str, str]] = []