Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,6 +1,12 @@
 {
- "current": "v30 (71776ca)",
+ "current": "v31 (8880a49)",
  "releases": [
+  {
+   "version": "v31",
+   "sha": "8880a49",
+   "date": "2026-08-21",
+   "subject": "v31: Wave 39 staging candidate"
+  },
   {
    "version": "v30",
    "sha": "71776ca",

VERSION

@@ -1 +1 @@
-v30 (71776ca)
+v31 (8880a49)

api/deps.py

@@ -515,6 +515,13 @@ def _user_for(claims):
     if not uname:
         return None
     claim_tenant = str(claims.get("t") or "").strip().lower()
+    # W39-T28 / A62.  This MUST precede the registry read: qa-runner is specifically a
+    # zero-touch qa-b identity, not an account in tenant #0's `users` document.  The helper
+    # rechecks both non-production deployment flags, so removing either invalidates its cookie.
+    qa = users.qa_identity(uname)
+    if (qa and claim_tenant == qa.get("tenant")
+            and int(claims.get("e") or 0) == int(qa.get("epoch") or 0)):
+        return qa
     try:
         reg = users.registry() or {}
     except Exception:
@@ -649,7 +656,10 @@ def require_session(request: Request, response: Response) -> Session:
     response.headers[_TENANT_HEADER] = str(claims["t"])
     # R4: last AFTER the session is fully resolved — a stamp is only true of a request that was
     # actually admitted, and putting it here means no failed-auth path can ever write one.
-    _touch_active(user.get("username"))
+    # qa-runner has no global account record.  Never let the normal activity telemetry create or
+    # touch one through the default tenant-#0 users store.
+    if not user.get("qa_runner"):
+        _touch_active(user.get("username"))
     return Session(tenant=claims["t"], user=user, claims=claims, runtime=rt)
 
 

api/main.py

@@ -636,7 +636,7 @@ def _pull_meta(why):
         if not _meta.token():
             print(f"[aios-api] meta sync skipped ({why}): no META_ADS_ACCESS_TOKEN in this "
                   f"deployment - the connector is idle, not broken")
-            return
+            return False
         # ⛔ PASSED, NOT SET IN THE ENVIRONMENT. `meta_store.INSIGHTS_DAYS` binds at
         # IMPORT, so an `os.environ.setdefault` here executed after the module was
         # already loaded and changed NOTHING: every boot pulled 90 days instead of 7,
@@ -647,11 +647,13 @@ def _pull_meta(why):
             print(f"[aios-api] meta sync PROBLEM ({why}): {p}")
         print(f"[aios-api] meta sync done ({why}): "
               + ", ".join(f"{k}={v['in_mirror']}" for k, v in sorted(rep["tables"].items())))
+        return True
     except Exception as e:                                    # noqa: BLE001
         print(f"[aios-api] meta sync FAILED ({why}): {type(e).__name__}: {e}")
+        return False
 
 
-def _rebuild_meta_relational(why, rt):
+def _rebuild_meta_relational(why, rt, previous_fingerprint=None, force_relations=False):
     """Spawn/refresh the `ut_meta_*` locked databases off the SAME mirror the Odoo half just used.
 
     ⭐ CALLED FROM INSIDE `_rebuild_odoo_relational`, ON PURPOSE, and the reason is D-29 rather than
@@ -668,17 +670,24 @@ def _rebuild_meta_relational(why, rt):
     """
     try:
         import meta_relational as _meta
-        counts = _meta.refresh(rt, why)
+        state = _meta.refresh_state(rt, why, previous_fingerprint=previous_fingerprint)
+        counts = state["written"]
         if counts:
             print(f"[aios-api] meta relational rebuild done ({why}): "
                   + ", ".join(f"{k}={v}" for k, v in sorted(counts.items())))
+        # An Odoo refresh retains the established relation pass even when Meta is unchanged.
+        # The zero-Odoo path uses the default and skips only after Meta's exact-plan match.
+        if state["present"] and (state["changed"] or force_relations):
             try:
                 import automation_engine as _engine
                 _engine.refresh_relations(rt, log=lambda *_a: None)
             except Exception as e:                            # noqa: BLE001
                 print(f"[aios-api] meta relation cells failed ({why}): {type(e).__name__}: {e}")
+        return state
     except Exception as e:                                    # noqa: BLE001
         print(f"[aios-api] meta relational rebuild FAILED ({why}): {type(e).__name__}: {e}")
+        return {"present": False, "known": False, "fingerprint": None,
+                "changed": True, "applied": False, "written": {}}
 
 
 def _sweep_automation_schemas(why):
@@ -800,7 +809,7 @@ def _sweep_automation_schemas(why):
     print(f"[aios-api] schema sweep ({why}) done over {len(tenants)} tenant(s)")
 
 
-def _rebuild_odoo_relational(why):
+def _rebuild_odoo_relational(why, previous_meta_fingerprint=None, meta_state_out=None):
     """Spawn/refresh the four locked Odoo databases, then compute their cells. `why` is 'boot' or
     'resync' and rides every log line, because "it failed" and "it failed at boot, before anyone
     could have asked" are different diagnoses.
@@ -821,7 +830,7 @@ def _rebuild_odoo_relational(why):
         import odoo_relational as _rel
         from harness import runtime as _runtime
         if not _rel.is_royal("royal-imports"):
-            return
+            return False
         _rt = _runtime.get_runtime("royal-imports")
         counts = _rel.refresh(_rt, "royal-imports")
         # ⭐⭐ AND THEN COMPUTE THE CELLS, which `refresh` does NOT do.
@@ -853,13 +862,75 @@ def _rebuild_odoo_relational(why):
             print(f"[aios-api] odoo source rollups failed ({why}): {type(e).__name__}: {e}")
         print(f"[aios-api] odoo relational rebuild done ({why}): "
               + ", ".join(f"{k}={v}" for k, v in sorted((counts or {}).items())))
-        _rebuild_meta_relational(why, _rt)
+        meta_state = _rebuild_meta_relational(
+            why, _rt, previous_fingerprint=previous_meta_fingerprint, force_relations=True)
+        if isinstance(meta_state_out, dict):
+            meta_state_out.update(meta_state)
+        # The isolated cells/rollups/meta handlers above are deliberately allowed to report and
+        # continue. This return value answers the narrower resync-policy question: did the Odoo
+        # table refresh itself complete, so a confirmed zero-change pass may be skipped?
+        return True
     except Exception as e:                                    # noqa: BLE001
         # ⚠ The TYPE is named here as it is in the two inner handlers. The original printed only
         # `{e}`, and a bare message is exactly what made D-107 unreadable from the outside: a
         # `BinderException` about a missing column is a different action from a timeout or an auth
         # failure, and the text alone often does not say which it was.
         print(f"[aios-api] odoo relational rebuild failed ({why}): {type(e).__name__}: {e}")
+        return False
+
+
+# W39-T31 / A63. `sync_all` already knows whether Odoo supplied any change, but this loop used to
+# rebuild every relational table (and its large `user_tables` document) after every poll anyway.
+# A nonempty all-live zero report is the only evidence strong enough to skip that Odoo half. An
+# absent report is not zero: it means manual mode, paused source, or a failed/unknown sync, all of
+# which force the pre-existing rebuild path. `delete_report=None` is one of the ordinary passes
+# between delete reconciliations; it is unknown, not falsely claimed clean.
+_RESYNC_REBUILD_MAX_AGE_SECONDS = 24 * 60 * 60
+
+
+def _resync_rebuild_reason(sync_report, delete_report, last_success_at, now):
+    """Return a fail-safe Odoo-rebuild reason, or ``None`` for a proven no-op.
+
+    The policy stays pure so it can be tested without Odoo, DuckDB, or PostgreSQL. Hard deletes
+    are noticed by the existing every-fourth-pass reconciliation; an intervening pass does not
+    pretend that it checked them, preserving the old visibility bound.
+    """
+    if not isinstance(sync_report, dict) or not sync_report:
+        return "sync-unconfirmed"
+    for report in sync_report.values():
+        if not isinstance(report, dict) or report.get("phase") != "live":
+            return "sync-unconfirmed"
+        try:
+            if int(report.get("pulled") or 0) > 0:
+                return "source-change"
+        except (TypeError, ValueError):
+            return "sync-unconfirmed"
+    if delete_report is not None:
+        if not isinstance(delete_report, dict):
+            return "sync-unconfirmed"
+        try:
+            if any(int(count or 0) > 0 for count in delete_report.values()):
+                return "delete-change"
+        except (TypeError, ValueError):
+            return "sync-unconfirmed"
+    if last_success_at is None or now - last_success_at >= _RESYNC_REBUILD_MAX_AGE_SECONDS:
+        return "daily-recovery"
+    return None
+
+
+def _meta_rebuild_force_reason(pull_confirmed, last_fingerprint, last_applied_at, now):
+    """Return why Meta must apply, or ``None`` when its exact plan may skip the write.
+
+    Graph reports fetched rows rather than changed rows. The fingerprint in `meta_relational`
+    proves equality later; this helper only expires stale/unknown permission to use it.
+    """
+    if pull_confirmed is not True:
+        return "meta-unconfirmed"
+    if not isinstance(last_fingerprint, str) or not last_fingerprint:
+        return "meta-first"
+    if last_applied_at is None or now - last_applied_at >= _RESYNC_REBUILD_MAX_AGE_SECONDS:
+        return "meta-daily"
+    return None
 
 
 def _store_resync_loop():
@@ -868,6 +939,9 @@ def _store_resync_loop():
     refreshed pool re-reads the freshly synced store."""
     import time as _t
     passes = 0
+    last_relational_success_at = None
+    last_meta_fingerprint = None
+    last_meta_applied_at = None
     while True:
         # ⭐⭐ WAVE 32 · OWNER ITEM 11 / R11 — THE TENANT'S OWN CADENCE, NOT A HARDCODED 1800.
         #
@@ -918,6 +992,8 @@ def _store_resync_loop():
             pass
         _t.sleep(_every)
         passes += 1
+        sync_report = None
+        delete_report = None
         try:
             from harness import datastore as _ds
             import core.odoo as _odoo
@@ -930,24 +1006,26 @@ def _store_resync_loop():
             # setting a person chose into a recurring error in the log; a `continue` would skip
             # the Meta pull and the relational rebuild below, which `manual` says nothing about.
             if not _manual:
-                _ds.sync_all(log=lambda *a, **k: None)
+                sync_report = _ds.sync_all(log=lambda *a, **k: None)
                 # Wave 21 — every 4th pass (~2h): purge hard-deleted rows the cursor sync cannot
                 # see (the boot pass's comment has the measured case). Cheap id-sweep per entity;
                 # without it deleted Odoo lines inflate every sum on the mirror FOREVER.
                 # ⚠ INSIDE the branch: a reconcile is a pass over the mirror this loop was just
                 # told not to advance.
                 if passes % 4 == 0:
-                    _ds.reconcile_deletes(log=lambda *a, **k: None)
+                    delete_report = _ds.reconcile_deletes(log=lambda *a, **k: None)
         except Exception as e:                                # noqa: BLE001
+            # A partial report must never be mistaken for a confirmed zero-change pass.
+            sync_report = None
             print(f"[aios-api] store resync failed: {e}")
-        # ⭐ WAVE 27 item 17 (E's ASK ->A, resolved): the Odoo RELATIONAL tables are rebuilt
-        # AFTER the mirror they are derived from, in the same pass and in that order — deriving
-        # from a mirror this loop is about to advance would publish a worklist one cycle stale
-        # every single time.
+        # ⭐ WAVE 27 item 17 (E's ASK ->A, resolved): whenever the Odoo RELATIONAL tables need
+        # refreshing, they run AFTER the mirror they derive from. A confirmed zero-change report
+        # is the W39 exception; deriving before a changed mirror advances would publish a one-cycle
+        # stale worklist every single time.
         #
         # ⛔ OUTSIDE the try/except above, NOT folded into it. A failing relational rebuild must
-        # not swallow the sync's error message, and — worse the other way — a sync failure must
-        # not skip a rebuild that had nothing wrong with it. Two independent failures, two
+        # not swallow the sync's error message, and — worse the other way — a sync failure becomes
+        # unconfirmed evidence and forces a recovery rebuild. Two independent failures, two
         # independent logs. (`_rebuild_odoo_relational` carries its own handlers.)
         #
         # ⚠ THE REBUILD IS NOT THE FRESHNESS GUARANTEE — the rows carry a visible `_refreshed`
@@ -970,8 +1048,36 @@ def _store_resync_loop():
         # correctly. A connector that can only ever be established at boot is one bad boot away
         # from being permanently absent.
         # ⚠ Cheap when there is nothing to do: no token => one line and return.
-        _pull_meta("resync")
-        _rebuild_odoo_relational("resync")
+        _meta_pull_confirmed = _pull_meta("resync")
+        _meta_now = _t.time()
+        _meta_reason = _meta_rebuild_force_reason(
+            _meta_pull_confirmed, last_meta_fingerprint, last_meta_applied_at, _meta_now)
+        _meta_previous = last_meta_fingerprint if _meta_reason is None else None
+        _reason = _resync_rebuild_reason(sync_report, delete_report,
+                                          last_relational_success_at, _meta_now)
+        _meta_state = {}
+        if _reason is not None:
+            print(f"[aios-api] odoo relational rebuild required ({_reason})")
+            if _rebuild_odoo_relational("resync", _meta_previous, _meta_state):
+                last_relational_success_at = _t.time()
+        else:
+            # A zero Odoo report says nothing about Meta. Its exact-plan fingerprint decides
+            # whether this cadence may skip both the full-document write and relation pass.
+            try:
+                from harness import runtime as _runtime
+                _meta_state = _rebuild_meta_relational(
+                    "resync", _runtime.get_runtime("royal-imports"), _meta_previous)
+            except Exception as e:                            # noqa: BLE001
+                print(f"[aios-api] meta relational refresh failed (resync): "
+                      f"{type(e).__name__}: {e}")
+        if _meta_state.get("known"):
+            last_meta_fingerprint = _meta_state["fingerprint"]
+            if _meta_state.get("applied"):
+                last_meta_applied_at = _t.time()
+        else:
+            # Unknown is never carried forward as equality evidence.
+            last_meta_fingerprint = None
+            last_meta_applied_at = None
 
 
 def _prewarm():
@@ -1066,6 +1172,34 @@ def _seed_mirror_if_absent():
     return False
 
 
+def _provision_qa_sandbox(pg=None):
+    """Idempotently create the *Staging-only* qa-b schema after its write wall has allowed it.
+
+    This must stay separate from normal tenant provisioning: qa-b is an intentionally empty
+    runtime fixture, not a customer.  The guard runs before `_pool()` so a missing/revoked grant
+    does not open a PostgreSQL connection merely to learn it should refuse.  Live has neither
+    deployment flag and returns before importing the PostgreSQL backend.
+    """
+    if os.environ.get("AIOS_ENABLE_QA_TENANT") != "1":
+        return False
+    granted = {s.strip().lower() for s in
+               str(os.environ.get("AIOS_SANDBOX_TENANTS") or "").split(",") if s.strip()}
+    if "qa-b" not in granted or os.environ.get("STORE_BACKEND") != "pg":
+        return False
+    try:
+        if pg is None:
+            import core.store_pg as pg
+        # ⛔ BEFORE `_pool`: a refused deploy never wakes Neon or gets as far as DDL.
+        pg.check_write("qa-b", operation="qa schema provisioning")
+        with pg._pool().connection() as con:
+            con.execute("SELECT control.provision_tenant_schema(%s)", ("qa-b",))
+        print("[aios-api] qa-b sandbox schema provisioned")
+        return True
+    except Exception as e:                                    # noqa: BLE001 — boot must not die
+        print(f"[aios-api] qa-b sandbox schema not provisioned: {type(e).__name__}: {e}")
+        return False
+
+
 try:
     from harness import datastore as _ds_boot
     if not _ds_boot.DB_PATH.exists():
@@ -1075,6 +1209,16 @@ try:
 except Exception as e:                                        # noqa: BLE001
     print(f"[aios-api] mirror seed not scheduled: {e}")
 
+# W39-T28 / A62.  The deployment code hands these two flags only to an explicitly granted
+# non-public target (Staging today).  Running this in a daemon means an unavailable QA schema
+# never blocks health/readiness; the SQL procedure is idempotent, and `_provision_qa_sandbox`
+# itself refuses before opening a pool on every other environment.
+if (os.environ.get("AIOS_ENABLE_QA_TENANT") == "1"
+        and os.environ.get("STORE_BACKEND") == "pg"):
+    import threading as _threading_qa
+    _threading_qa.Thread(target=_provision_qa_sandbox, daemon=True,
+                         name="qa-sandbox-schema").start()
+
 if os.environ.get("AIOS_PREWARM") == "1":
     import threading as _threading
     _threading.Thread(target=_prewarm, daemon=True, name="prewarm").start()

api/meta_relational.py

@@ -29,6 +29,8 @@ scale is 1 account · 55 campaigns · 115 ad sets · 227 ads · creatives · ~90
 `ut_*` tables like `ut_odoo_agents`. ⛔ If a bigger account ever crosses the cap, `plan()` says so
 out loud rather than truncating: R6's second sentence, and the check is at the bottom of `plan`.
 """
+import hashlib
+import json
 import os
 import sys
 from pathlib import Path
@@ -213,6 +215,27 @@ def plan(cur, rt=None):
     return built
 
 
+def plan_fingerprint(cur, built):
+    """Digest the exact derived Meta content that would be published.
+
+    `meta_store.sync()` counts fetched rows, not changed rows, so it is not equality evidence.
+    This includes source-table absence, derived field definitions and every row, while treating
+    DuckDB's arbitrary row order as non-semantic.  Callers fail safe to a refresh if it raises.
+    """
+    tables = []
+    for key in SOURCE:
+        rows = built.get(key) or []
+        canonical_rows = sorted(
+            rows,
+            key=lambda row: json.dumps(row, sort_keys=True, ensure_ascii=True,
+                                       separators=(",", ":"), allow_nan=False),
+        )
+        tables.append({"key": key, "fields": _fields_for(cur, key), "rows": canonical_rows})
+    payload = json.dumps(tables, sort_keys=True, ensure_ascii=True,
+                         separators=(",", ":"), allow_nan=False)
+    return hashlib.sha256(payload.encode("utf-8")).hexdigest()
+
+
 def apply_plan(rt, built, username="meta", today=None):
     """Create-or-merge every table in `built`, in ONE `flush="sync"` write.
 
@@ -240,12 +263,14 @@ def apply_plan(rt, built, username="meta", today=None):
     return written
 
 
-def refresh(rt, why="boot", tenant_key=None, log=print):
-    """The one call a caller wants: open this tenant's mirror, plan, apply. -> written counts.
+def refresh_state(rt, why="boot", tenant_key=None, previous_fingerprint=None, log=print):
+    """Open, plan and conditionally apply the Meta mirror.
 
     Returns `{}` and says why when the mirror has no Meta tables — a tenant that never connected
     Meta is a normal state, not a failure.
     """
+    state = {"present": False, "known": False, "fingerprint": None,
+             "changed": False, "applied": False, "written": {}}
     tenant = tenant_key or getattr(getattr(rt, "tenant", None), "key", None) or "royal-imports"
     path = datastore.path_for(tenant)
     if Path(datastore.DB_PATH) != Path(path):
@@ -254,16 +279,34 @@ def refresh(rt, why="boot", tenant_key=None, log=print):
     if not any(mirror_columns(cur, t) for t in SOURCE.values()):
         log(f"[meta_relational] {why}: no Meta tables in {tenant}'s mirror — nothing to spawn "
             f"(run `python platform/harness/meta_store.py --sync --tenant {tenant}` first)")
-        return {}
+        return state
+    state["present"] = True
     built = plan(cur, rt)
-    for p in built.get("problems") or []:
+    problems = built.get("problems") or []
+    for p in problems:
         log(f"[meta_relational] PROBLEM {p}")
-    if built.get("problems"):
-        built = {k: v for k, v in built.items() if k != "problems"}
-    written = apply_plan(rt, built)
-    for key, counts in written.items():
+    applicable = {k: v for k, v in built.items() if k != "problems"}
+    if not problems:
+        try:
+            state["fingerprint"] = plan_fingerprint(cur, applicable)
+            state["known"] = True
+        except Exception as e:                                # noqa: BLE001
+            log(f"[meta_relational] {why}: plan fingerprint unavailable; forcing refresh "
+                f"({type(e).__name__}: {e})")
+    if state["known"] and state["fingerprint"] == previous_fingerprint:
+        log(f"[meta_relational] {why}: Meta plan unchanged; skipped full user_tables write")
+        return state
+    state["changed"] = True
+    state["written"] = apply_plan(rt, applicable)
+    state["applied"] = True
+    for key, counts in state["written"].items():
         log(f"[meta_relational] {why}: {key:<24} {counts}")
-    return written
+    return state
+
+
+def refresh(rt, why="boot", tenant_key=None, log=print):
+    """Backward-compatible facade. Use `refresh_state` for egress-aware state."""
+    return refresh_state(rt, why, tenant_key, log=log)["written"]
 
 
 def main(argv=None):

api/odoo_relational.py

@@ -399,6 +399,13 @@ def order_fields():
          "default": False},
         {"key": "order_date", "label": "Order date", "type": "date", "source": "overlay",
          "default": True},
+        {"key": "commitment_date", "label": "Delivery date", "type": "date",
+         "source": "overlay", "default": True,
+         "description": "Odoo's promised customer delivery date. Blank only when no promise was entered."},
+        {"key": "delivery_status", "label": "Delivery status", "type": "select",
+         "source": "overlay", "default": True,
+         "options": ["pending", "started", "partial", "full"],
+         "description": "Odoo's fulfilment status: pending, started, partial, or full."},
         {"key": "amount_untaxed", "label": "Order $", "type": "currency", "source": "overlay",
          "default": True, "agg": "sum"},
         {"key": "team", "label": "Business unit", "type": "select", "source": "overlay",
@@ -890,11 +897,12 @@ def read_orders(cur, excluded=None):
     excluded = excluded if excluded is not None else excluded_ids(cur)
     have = columns(cur, "sale_order")
     sql = (f"SELECT id, name, date_order, partner_id, partner_name, {_col(have, 'team_name')}, "
-           f"       state, amount_untaxed, {_col(have, 'invoice_status')} "
+           f"       state, amount_untaxed, {_col(have, 'invoice_status')}, "
+           f"       {_col(have, 'commitment_date')}, {_col(have, 'delivery_status')} "
            f"FROM sale_order WHERE {_CONFIRMED} AND partner_id IS NOT NULL")
     out = []
     for r in cur.execute(sql).fetchall():
-        (oid, name, when, pid, pname, team, state, untaxed, inv_status) = r
+        (oid, name, when, pid, pname, team, state, untaxed, inv_status, commitment, delivery) = r
         out.append({
             "_id": str(oid),
             "order_no": str(name or ""),
@@ -906,6 +914,8 @@ def read_orders(cur, excluded=None):
             "team": str(team or ""),
             "state": str(state or ""),
             "invoice_status": str(inv_status or ""),
+            "commitment_date": _as_date(commitment),
+            "delivery_status": str(delivery or ""),
             "wholesale_scope": _in_scope(pid, excluded),
         })
     return out

api/routes_auth.py

@@ -152,7 +152,13 @@ def login(request: Request, response: Response, body: dict = Body(default=None))
         raise err(429, "too_many_attempts",
                   f"too many failed attempts — try again in {wait} seconds")
 
-    user = users.verify(uname, pw) if (uname and pw) else None
+    # W39-T28 / A62.  Resolve this synthetic identity FIRST.  The normal account registry is
+    # tenant #0's document on the PostgreSQL path, so even a harmless `verify()` read would make
+    # a qa-b proof touch the wrong schema.  `qa_identity` is inert unless both staging flags and
+    # APP_PASSWORD are present; every ordinary username falls straight through to `verify()`.
+    user = users.qa_identity(uname, pw) if (uname and pw) else None
+    if not user:
+        user = users.verify(uname, pw) if (uname and pw) else None
     if not user:
         # CONSTANT-TIME-ISH 401. `users.verify` returns immediately for an unknown username (no
         # record, no PBKDF2) and burns ~200k iterations for a known one, so the response time
@@ -181,12 +187,16 @@ def login(request: Request, response: Response, body: dict = Body(default=None))
     # stamping what was typed would write onto a key that does not exist. Fail-silent inside
     # `touch_login` and a no-op for the emergency-master identity (which has no record to stamp),
     # so the one thing this cannot do is turn a good credential into a failed sign-in.
-    users.touch_login(user["username"])
+    # The synthetic QA identity has no normal account record to stamp.  More importantly, a
+    # registry stamp here would default to tenant #0 and make a qa-b proof touch the wrong schema.
+    if not user.get("qa_runner"):
+        users.touch_login(user["username"])
     # `touch_login` also sets `last_active`, so tell the session resolver it has been seen —
     # otherwise the very next request stamps it again and the hourly throttle is off by one write
     # per sign-in.
     import deps as _deps
-    _deps.note_active(user["username"])
+    if not user.get("qa_runner"):
+        _deps.note_active(user["username"])
     return {"user": _public_user(user)}
 
 

api/routes_customers.py

@@ -21,6 +21,7 @@ SOURCE OF TRUTH; it does not make the two runtimes coherent. The fix is X4/Postg
 owner-blocked on B-3), and no test here may claim read-your-writes ACROSS runtimes — a TestClient
 proof is single-process and would report green on exactly the thing that is still broken.
 """
+import math
 import time
 
 from fastapi import APIRouter, Body, Depends
@@ -591,6 +592,23 @@ def _route_slug(label):
     return f"{ROUTE_KEY_PREFIX}{slug[:48]}" if slug else ""
 
 
+def _clean_route_depot(raw):
+    """The optional origin stored once on a route-order definition, never on a customer cell."""
+    if raw is None:
+        return None
+    if not isinstance(raw, dict):
+        raise err(400, "bad_depot", "a depot is an address with latitude and longitude, or null")
+    address = " ".join(str(raw.get("address") or "").split())[:200]
+    lat, lon = raw.get("lat"), raw.get("lon")
+    if (not address or isinstance(lat, bool) or isinstance(lon, bool) or
+            not isinstance(lat, (int, float)) or not isinstance(lon, (int, float))):
+        raise err(400, "bad_depot", "a depot needs an address and numeric latitude and longitude")
+    lat, lon = float(lat), float(lon)
+    if not (math.isfinite(lat) and math.isfinite(lon) and abs(lat) <= 90 and abs(lon) <= 180):
+        raise err(400, "bad_depot", "the depot latitude or longitude is outside the map")
+    return {"address": address, "lat": lat, "lon": lon}
+
+
 def _route_defs(session: Session):
     """This topic's route-order columns MINUS the ones this session was not granted.
 
@@ -634,6 +652,7 @@ def route_order_list(session: Session = Depends(module_gate(MODULE))):
             "roundTrip": bool(route.get("roundTrip")),
             "startPid": route.get("startPid"),
             "stops": route.get("stops"),
+            "depot": route.get("depot") if isinstance(route.get("depot"), dict) else None,
             "solvedAt": route.get("solvedAt") or "",
             "solvedBy": defn.get("createdBy") or "",
             # Who may re-solve it. The same creator-or-admin wall the write door enforces, said on
@@ -649,7 +668,7 @@ def route_order_write(body: dict = Body(default=None),
                       session: Session = Depends(module_gate(MODULE))):
     """Create (or re-solve) a tenant-wide route-order column and fill it, in ONE call.
 
-    `{label, field?, ranks: {"<pid>": <int>}, inputsHash, roundTrip?, startPid?, stops?}`
+    `{label, field?, ranks: {"<pid>": <int>}, inputsHash, roundTrip?, startPid?, depot?}`
 
     ⛔ THE DEFINITION IS WRITTEN FIRST AND THE GRANT CLAIMED SECOND, which is `patch_shared_cell`'s
     order and it is deliberate: the window where a column is MARKED and UNCLAIMED fails CLOSED
@@ -705,6 +724,12 @@ def route_order_write(body: dict = Body(default=None),
                       f"administrator. This one was planned by {owner or 'somebody else'}, and "
                       f"re-solving it would change the visit numbers for every account at once")
 
+    if "depot" in body:
+        depot = _clean_route_depot(body.get("depot"))
+    else:
+        prior_route = (existing or {}).get("route") if isinstance(existing, dict) else {}
+        depot = prior_route.get("depot") if isinstance(prior_route, dict) else None
+
     raw = body.get("ranks")
     if not isinstance(raw, dict) or not raw:
         raise err(400, "bad_ranks", 'expected {ranks: {"<pid>": <visit number>}}')
@@ -790,6 +815,7 @@ def route_order_write(body: dict = Body(default=None),
             "startPid": int(body["startPid"]) if isinstance(body.get("startPid"), int)
                         and not isinstance(body.get("startPid"), bool) else None,
             "stops": len(ranks),
+            "depot": depot,
             "solvedAt": stamp,
         },
     }
@@ -830,5 +856,6 @@ def route_order_write(body: dict = Body(default=None),
     out = {"ok": True, "field": key, "label": defn["label"], "type": "int",
            "stops": len(ranks), "cleared": len(stale),
            "rows_written": len(written), "inputsHash": defn["route"]["inputsHash"],
+           "depot": defn["route"]["depot"],
            "solvedAt": stamp}
     return out

api/routes_odoo_tables.py

@@ -418,6 +418,8 @@ def _odoo_sources():
             "customer": ("partner_name", _s),
             rel.JOIN_KEY: ("partner_id", _i),
             "order_date": ("date_order", rel._as_date),
+            "commitment_date": ("commitment_date", rel._as_date),
+            "delivery_status": ("delivery_status", _s),
             "amount_untaxed": ("amount_untaxed", _n),
             "team": ("team_name", _s),
             "state": ("state", _s),

api/routes_tables.py

@@ -428,6 +428,11 @@ def patch_shared_cell(table_key: str, pid: int, body: dict = Body(default=None),
     if not key:
         raise err(400, "bad_request", "a field key is required")
     _defn_or_refuse(session, table_key)
+    import core.shares as shares
+    if not shares.may_edit("database", table_key, session.uname, is_admin=session.admin,
+                           st=session.runtime):
+        raise err(403, "forbidden",
+                  "an edit share on this database is required to write a tenant-wide cell")
     from core import shared_overlay
     import core.perm_scope as perm_scope
     if not shared_overlay.is_shared(table_key, key, st=session.runtime):

platform/aios_grid.py

@@ -26,6 +26,7 @@ Design notes:
 import json
 import math
 import re
+from decimal import Decimal, ROUND_HALF_EVEN, localcontext
 from pathlib import Path
 
 _HERE = Path(__file__).resolve().parent
@@ -103,7 +104,22 @@ def _round2(v):
     FLOAT where `round(v)` returns an INT, so every integer column's wire shape would change under
     an edit that looks purely cosmetic.
     """
-    return round(v, 2) if isinstance(v, (int, float)) and not isinstance(v, bool) else v
+    if not isinstance(v, (int, float)) or isinstance(v, bool):
+        return v
+    if not math.isfinite(v):
+        return v
+
+    # `round(12.345, 2)` is 12.35 because its binary float is just above the decimal tie, while
+    # DuckDB's `round_even(..., 2)` (the filter and sort expression) correctly yields 12.34.
+    # Quantizing the user-visible decimal spelling preserves banker's rounding at cents in both
+    # engines. Keep an int an int: a currency value can be integral without changing its wire type.
+    decimal = Decimal(str(v))
+    # Decimal's default precision is 28 digits; keep the prior `round` behavior for an unusual
+    # but valid large finite float instead of making it an InvalidOperation at the payload edge.
+    with localcontext() as context:
+        context.prec = max(context.prec, decimal.adjusted() + 3)
+        rounded = decimal.quantize(Decimal("0.01"), rounding=ROUND_HALF_EVEN)
+    return int(rounded) if isinstance(v, int) else float(rounded)
 
 
 # Types a USER may create from the column menu (owner item 7, 2026-07-26). Mirrors

platform/aios_grid_fields.json

@@ -387,18 +387,60 @@
         "description": "Royal 2 pricelist price for this SKU. Blank when that list prices it nowhere."
       },
       {
-        "key": "tier_prices",
-        "label": "Tier prices",
-        "type": "json",
+        "key": "price_1",
+        "label": "Price 1",
+        "type": "currency",
+        "source": "odoo",
+        "description": "Cheapest live price for this SKU, across active pricelists."
+      },
+      {
+        "key": "unit_1",
+        "label": "Unit 1",
+        "type": "text",
+        "source": "odoo",
+        "description": "Package label for Price 1. Blank means Odoo has no package reference for that price."
+      },
+      {
+        "key": "price_2",
+        "label": "Price 2",
+        "type": "currency",
+        "source": "odoo",
+        "description": "Second-cheapest live price for this SKU."
+      },
+      {
+        "key": "unit_2",
+        "label": "Unit 2",
+        "type": "text",
         "source": "odoo",
-        "description": "Every live pricelist that prices this SKU today, as [{pricelist, unit_price}] at qty 1. Blank when no list prices it. This is the honest SET; the three Fisch/Royal columns beside it are the DECLARED subset and cannot show a price on a list the contract does not name."
+        "description": "Package label for Price 2."
       },
       {
-        "key": "units",
-        "label": "Units",
-        "type": "json",
+        "key": "price_3",
+        "label": "Price 3",
+        "type": "currency",
+        "source": "odoo",
+        "description": "Third-cheapest live price for this SKU."
+      },
+      {
+        "key": "unit_3",
+        "label": "Unit 3",
+        "type": "text",
+        "source": "odoo",
+        "description": "Package label for Price 3."
+      },
+      {
+        "key": "pre_book_qty",
+        "label": "Pre-book qty",
+        "type": "int",
+        "source": "odoo",
+        "description": "Units on confirmed, not-fully-delivered wholesale orders promised after today. Delivery-charge service lines are excluded."
+      },
+      {
+        "key": "open_backlog_qty",
+        "label": "Open backlog qty",
+        "type": "int",
         "source": "odoo",
-        "description": "The units of measure this SKU is really sold in, as [{name, qty}] where qty is in the product's own unit. Blank means it is sold in ONE unit, not that data is missing - only 1,150 of 5,873 active SKUs (19.6%) carry a unit tier."
+        "description": "Units still owed on confirmed, not-fully-delivered wholesale goods orders, including already-due promises. Delivery-charge service lines are excluded."
       },
       {
         "key": "rev_ytd",

platform/core/store_pg.py

@@ -107,9 +107,11 @@ def _schema_for(tenant_slug=None):
 # `get_projection`, `exists`, `download_bytes` and `revision` are deliberately unguarded.
 #
 # ⛔ WHAT THIS DOES NOT COVER, said here rather than discovered later: raw SQL through `_pool()`.
-# `ops/seed_pg_from_hf.py` opens a connection directly to apply the DDL, and any future tool can.
-# The guard is on the STORE INTERFACE — the four functions every product write crosses — not on
-# the database handle. A caller that reaches past the interface reaches past the guard.
+# `ops/seed_pg_from_hf.py` now calls `check_write(slug, operation="schema provisioning")` for
+# every requested tenant before it opens its migration connection (D-462), but that is an explicit
+# caller-side boundary, not a property of the handle. The guard remains on the STORE INTERFACE —
+# the four functions every product write crosses — so any future raw-SQL writer must make the same
+# explicit decision before it touches `_pool()`; it must not widen the low-level handle's contract.
 # =============================================================================================
 
 #: The tenant slugs whose `t_<slug>` schema holds REAL customer data.
@@ -293,16 +295,36 @@ def get(name, fresh=False, tenant_slug=None):
 
 
 def get_projection(name, drop=(), tenant_slug=None):
-    """`core.store.get_projection`'s twin — see `PgStore.get_projection` for why the saving does
-    NOT transfer and why that is stated rather than implied.
-
-    ⛔ Present because `verify_store_pg.IFACE` names it, which is the mechanism working as designed:
-    a capability only the HF backend had would 500 on `/nav` at the cutover instead of failing here,
-    at review, with no database attached.
+    """`core.store.get_projection` with the DROP performed inside Postgres.
+
+    `user_tables` is one JSONB value, and tenant #0's stored ``rows`` have measured at 28.6 MB
+    while the definitions a navigation or permission read needs are about 31 KB.  Calling
+    :func:`get` and then projecting in Python therefore preserves the HF return shape but sends
+    all 28.6 MB through Neon's public proxy first — exactly the egress this operation exists to
+    avoid.  The nested ``jsonb_each`` / ``jsonb_object_agg`` expression removes each requested
+    key from EVERY top-level table definition before the value leaves Postgres.
+
+    `_project` still owns the returned `_Projected` stamps and their loud ``KeyError`` semantics;
+    applying the same drop a second time is idempotent.  Keeping that one owner means callers
+    retain identical behaviour on both backends.  The ``CASE`` retains the generic store contract:
+    non-object JSON values are returned untouched rather than making ``jsonb_each`` error.
     """
     import core.store as _hf              # noqa: PLC0415 — lazy: _project lives with the class
-    return _hf._project(get(name, tenant_slug=tenant_slug),
-                        frozenset(str(d) for d in drop))
+
+    drops = tuple(str(d) for d in drop)
+    with _pool().connection() as con:
+        row = con.execute(
+            _q('SELECT CASE '
+               "WHEN jsonb_typeof(kv.value) = 'object' THEN "
+               "COALESCE((SELECT jsonb_object_agg(e.entry_key, "
+               "CASE WHEN jsonb_typeof(e.entry_value) = 'object' "
+               'THEN e.entry_value - %s::text[] ELSE e.entry_value END) '
+               'FROM jsonb_each(kv.value) AS e(entry_key, entry_value)), '
+               "'{}'::jsonb) ELSE kv.value END FROM {tbl} AS kv WHERE kv.key = %s",
+               'store_kv', tenant_slug),
+            (list(drops), str(name))).fetchone()
+    data = dict(row[0]) if row and isinstance(row[0], dict) else (row[0] if row else {})
+    return _hf._project(data, frozenset(drops))
 
 
 def exists(name, tenant_slug=None):
@@ -509,17 +531,11 @@ class PgStore:
         is exactly what `revision()`'s docstring means by *"a capability only the HF store had would
         have 500'd at the cutover instead of at review"*, and this is the review.
 
-        ⚠ **The saving does NOT transfer, and pretending otherwise would be the lie.** On HF the
-        whole tenant document is one JSON blob in memory and the cost is the 28.6 MB deep copy this
-        skips. Here `get` is a SELECT that has already materialised the row, so projecting after the
-        fact saves the copy of the dropped keys and nothing on the wire. It is correct, not fast.
-        A cheaper pg projection is a `jsonb` column list in the SELECT itself — a real optimisation,
-        for the day D-4 actually flips, and not something to build blind against a database that
-        does not exist yet (blocker B-3).
+        On Postgres, this method delegates to the module-level JSONB query above. The requested
+        nested keys are removed before the value crosses the database connection; keeping the
+        tenant binding here ensures request-scoped callers receive that egress-saving path too.
         """
-        import core.store as _hf          # noqa: PLC0415 — lazy: _project lives with the class
-        return _hf._project(get(name, tenant_slug=self.tenant_slug),
-                            frozenset(str(d) for d in drop))
+        return get_projection(name, drop=drop, tenant_slug=self.tenant_slug)
 
     def _read_strict(self, name):
         """Interface parity with the HF Store. There, `get` is lenient (swallows a transient

platform/core/users.py

@@ -22,6 +22,50 @@ _ITER = 200_000
 PERMS_VERSION = 1
 
 
+# W39-T28 / A62.  This is deliberately NOT another record in ``users``.  The registry is the
+# product's normal account plane and, on Postgres, tenant #0's schema; using it to mint a test
+# identity would make a staging QA check depend on (and potentially mutate) a production-shaped
+# account document.  The identity exists only on an explicitly-granted non-production build.
+_QA_TENANT = 'qa-b'
+_QA_USERNAME = 'qa-runner'
+_QA_TENANT_GRANT = 'AIOS_SANDBOX_TENANTS'
+
+
+def qa_identity(username, pw=None):
+    """Return the strictly staging-only QA runner, or ``None``.
+
+    Both deployment knobs are required: registration without a schema grant may not authenticate
+    a writer, and a typed grant without the registration flag may not mint an identity.  The
+    helper intentionally does not read or write the ordinary user registry.  Live deployments
+    remove both flags, so even possession of ``APP_PASSWORD`` cannot turn this into a live login.
+
+    ``pw=None`` is the session-resolution form: the signed cookie was authenticated at login;
+    the same deployment guards still have to hold when it is read back.
+    """
+    uname = (username or '').strip().lower()
+    if uname != _QA_USERNAME:
+        return None
+    if os.environ.get('AIOS_ENABLE_QA_TENANT') != '1':
+        return None
+    granted = {s.strip().lower() for s in
+               str(os.environ.get(_QA_TENANT_GRANT) or '').split(',') if s.strip()}
+    if _QA_TENANT not in granted:
+        return None
+    master = os.environ.get('APP_PASSWORD', '')
+    if not master:
+        return None
+    if pw is not None and not hmac.compare_digest(str(pw), master):
+        return None
+    # ``user`` is intentional: this runner can create its own scratch database and field, but
+    # has no administration or account-enumeration capability.  Its epoch is derived without
+    # exposing the secret; rotating APP_PASSWORD invalidates outstanding QA cookies just as an
+    # account-record epoch bump would, while still doing zero registry I/O.
+    qa_epoch = int.from_bytes(hashlib.sha256(master.encode('utf-8')).digest()[:4], 'big')
+    return {'username': _QA_USERNAME, 'name': 'QA Runner', 'role': 'user',
+            'bus': 'all', 'modules': ['customers'], 'tenant': _QA_TENANT,
+            'epoch': qa_epoch, 'qa_runner': True}
+
+
 def _hash(pw, salt):
     return hashlib.pbkdf2_hmac('sha256', str(pw).encode('utf-8'), bytes.fromhex(salt), _ITER).hex()
 

platform/harness/datastore.py

@@ -156,8 +156,12 @@ def use_path(path):
 ENTITIES = {
     "sale_order": {
         "model": "sale.order", "archivable": False,
-        "fields": ["name", "date_order", "partner_id", "team_id", "user_id", "state",
-                   "amount_untaxed", "invoice_status", "write_date"],
+        "fields": ["name", "date_order", "commitment_date", "delivery_status", "partner_id",
+                   "team_id", "user_id", "state", "amount_untaxed", "invoice_status",
+                   "write_date"],
+        # Existing orders do not receive a new write_date when our schema grows.  Without this
+        # declared, resumable pass the two ALTERed columns remain NULL on every old order.
+        "backfill_fields": ["commitment_date", "delivery_status"],
     },
     "sale_order_line": {
         "model": "sale.order.line", "archivable": False,

platform/harness/filter_sql.py

@@ -195,10 +195,12 @@ def _value_sql(spec):
     comparison but ordered by the raw timestamp is the obvious way to get that wrong), so the
     next sort key would break the tie in one engine and not the other.
 
-    numeric: `round_even(x, 0)` reproduces `aios_grid._round`, which is Python's round() =
-    BANKER'S rounding. DuckDB's plain ROUND() rounds half AWAY from zero, so ROUND(1234.5)=1235
-    while the grid shows 1234 — `eq 1234` would then match on screen and miss in SQL. The grid
-    displays rounded values; filters must agree with what is on screen.
+    numeric: `round_even(x, places)` reproduces the displayed banker's rounding: `_round` at
+    zero decimal places, and `_round2` (Decimal quantization) for currency/pct at two. DuckDB's
+    plain ROUND() rounds half AWAY from zero, so ROUND(1234.5)=1235 while the grid shows 1234 —
+    `eq 1234` would then match on screen and miss in SQL. The grid displays rounded values;
+    filters and sort keys must agree with what is on screen. Currency and percentages retain two
+    decimal places; integral types retain zero.
     date: truncate to the 10-char ISO shape the payload carries, so lexical compare is
     chronological and a timestamp column cannot smuggle ' 00:00:00' into the comparison.
     text: lowercased, matching `String(raw ?? "").toLowerCase()`.
@@ -206,7 +208,8 @@ def _value_sql(spec):
     e = spec['sql']
     t = spec['type']
     if t in NUMERIC_TYPES:
-        return f"COALESCE(round_even(TRY_CAST({e} AS DOUBLE), 0), 0)"
+        places = 2 if t in {'currency', 'pct'} else 0
+        return f"COALESCE(round_even(TRY_CAST({e} AS DOUBLE), {places}), 0)"
     if t == 'date':
         return f"COALESCE(SUBSTR(CAST({e} AS VARCHAR), 1, 10), '')"
     return f"LOWER(COALESCE(CAST({e} AS VARCHAR), ''))"

platform/harness/pg/schema.sql

@@ -9,10 +9,19 @@
 -- one file per tenant, because file-per-tenant IS the isolation model there.
 --
 -- ✅ RUN AGAINST A REAL SERVER 2026-08-04 (W19): applied end-to-end by verify_store_pg's
--- integration half against the owner's Neon (psycopg executes everything ABOVE the
--- "-- Optional:" marker; the tail below it is psql-variable syntax). Tenant provisioning,
--- jsonb/bytea round-trips and 80 concurrent FOR-UPDATE writes all proven. The CUTOVER remains
--- parked behind C1e's triggers; `STORE_BACKEND` still defaults to hf.
+-- integration half against the owner's Neon (psycopg executes everything ABOVE the psql-only
+-- TAIL SENTINEL near the bottom of this file; the tail beneath it is psql-variable syntax that
+-- no driver can run). Tenant provisioning, jsonb/bytea round-trips and 80 concurrent FOR-UPDATE
+-- writes all proven. The CUTOVER remains parked behind C1e's triggers; `STORE_BACKEND` still
+-- defaults to hf.
+--
+-- ⛔ D-461 — THIS PARAGRAPH QUOTES THE SENTINEL ("-- Optional:"), AND THAT ONCE COST US THE
+-- SCHEMA. The seeder split on that marker as a bare SUBSTRING, matched the quotation here
+-- instead of the real one 160 lines below, and applied 916 of these ~10,000 characters:
+-- comments, zero executable SQL, no provisioning function. The splitter is now LINE-ANCHORED
+-- and asserts what it hands over, so the quotation above is deliberate and stays: it is the
+-- standing proof, in the shipping file, that a prose mention no longer truncates anything.
+-- What no line may do is BEGIN with the marker. Only the sentinel does.
 --
 -- ⚠ CO-LOCATE (C1b). An Ashburn app with a European database adds ~90ms to every query and undoes
 -- the reason the market pivot happened.
@@ -163,18 +172,31 @@ BEGIN
 END;
 $$;
 
--- Tenant #0, always. Its slug is the one the session cookie already carries.
-INSERT INTO control.tenants (slug, name)
-VALUES ('royal-imports', 'Royal Imports')
-ON CONFLICT (slug) DO NOTHING;
-SELECT control.provision_tenant_schema('royal-imports');
-
--- Optional: `psql -v slug=<a-slug>` provisions one more tenant schema in the same transaction.
--- `:'slug'` is unset in the plain invocation, so this block is skipped there.
+-- ═══════════════════════════════════════════════════════════════════════════════════════════
+-- ⛔⛔ THE NEXT LINE IS THE TAIL SENTINEL. IT IS AN INTERFACE, NOT A COMMENT.
+--
+-- Every driver-based reader of this file (`ops/seed_pg_from_hf.py`, and verify_store_pg's
+-- integration half through the same helper) truncates HERE, because everything below is psql
+-- meta-syntax that psycopg cannot execute. The contract is exact: the reader cuts at the first
+-- line that BEGINS, at column 0, with "-- Optional:".
+--
+-- ⛔ SO: never start a line in this file with that marker except the one below, and never move
+-- the sentinel above the provisioning function. Discussing the marker mid-line is fine and this
+-- comment does it deliberately, because D-461 was a bare substring split matching a quotation
+-- 160 lines above the real thing. The seeder now asserts the surviving body still creates that
+-- function and ABORTS otherwise, but an abort is a cutover that did not run.
+-- ═══════════════════════════════════════════════════════════════════════════════════════════
+-- Optional: `psql -v slug=<a-slug>` provisions that tenant schema in the same transaction.
+-- With no `slug`, plain psql retains the default tenant #0 provisioning below. Driver users stop
+-- before this psql-only tail: the seeder provisions only the explicitly guarded tenant rows.
 \if :{?slug}
 INSERT INTO control.tenants (slug, name) VALUES (:'slug', :'slug')
 ON CONFLICT (slug) DO NOTHING;
 SELECT control.provision_tenant_schema(:'slug');
+\else
+INSERT INTO control.tenants (slug, name) VALUES ('royal-imports', 'Royal Imports')
+ON CONFLICT (slug) DO NOTHING;
+SELECT control.provision_tenant_schema('royal-imports');
 \endif
 
 COMMIT;

platform/harness/semantic.py

@@ -617,9 +617,31 @@ def store_columns(topic, include_measures=True, grain="aggregate"):
 MAX_GROUPS = 200_000
 
 
+def _scope_for_binding(store, scope_variant=None):
+    """The effective store scope for one ENTITY measure binding.
+
+    Most callers use a FACT topic's declared `scope_sql` unchanged. An entity can instead opt
+    into one of this deliberately closed set of variants in its *binding* (not in the source
+    topic): W39-T11's Odoo-product movement columns include Amazon, while the `sales_lines`
+    topic remains the wholesale truth for customer grain, Analyst, saved views, and rollups.
+
+    `all_channels` is intentionally defined as confirmed sales only. It drops BOTH wholesale
+    fences (team and GIFTWARE partner) but does not broaden the fact to quotes/cancellations.
+    A BU argument must likewise be ignored under this variant: filtering team 5 or 6 after
+    opening the scope would silently throw Amazon (team 7) back out.
+    """
+    if scope_variant is None:
+        return render_scope(store["scope_sql"].strip())
+    if scope_variant == "all_channels":
+        if store.get("table") != "sale_order_line":
+            raise ModelError("scope_variant 'all_channels' is only defined for sale_order_line")
+        return "o.state IN ('sale','done')"
+    raise ModelError(f"unknown entity-measure scope_variant {scope_variant!r}")
+
+
 def store_query(topic, measures, group_by=None, grain=None, date_from=None, date_to=None,
                 team_id=None, filters=None, sort=None, limit=1000, exclude_services=False,
-                filter_tree=None, filter_conj="and", today=None):
+                filter_tree=None, filter_conj="and", today=None, scope_variant=None):
     """The semantic query over the tenant store — the engine behind the Analyst's
     run_semantic_query tool and the saved-view re-runner. All keys whitelisted against the model."""
     t = _model()["topics"].get(topic)
@@ -685,7 +707,7 @@ def store_query(topic, measures, group_by=None, grain=None, date_from=None, date
     for k in base_keys:
         select.append(f"{_measure_sql(_model()['metrics'][k], alias)} AS {k}")
 
-    where = [render_scope(s["scope_sql"].strip())]
+    where = [_scope_for_binding(s, scope_variant)]
     # TYPE-CORRECT date bounds (the 2025-07-01 lesson): columns hold ISO strings in TWO shapes —
     # datetimes ('YYYY-MM-DD HH:MM:SS', sale date_order) and bare dates ('YYYY-MM-DD', GL date).
     # Lexical string comparison EXCLUDES the window's first day for bare dates ('2025-07-01' <
@@ -696,7 +718,7 @@ def store_query(topic, measures, group_by=None, grain=None, date_from=None, date
     if date_to:
         where.append(f"CAST({s['date_col']} AS TIMESTAMP) <= ?")
         params.append(f"{date_to} 23:59:59")
-    if team_id:
+    if team_id and scope_variant != "all_channels":
         if not s.get("team_col"):
             raise ModelError(f"topic {topic!r} is company-level — it has no business-unit filter")
         where.append(f"{s['team_col']} = ?"); params.append(int(team_id))
@@ -971,7 +993,8 @@ def topic_for_grid(grid_key):
 
 
 def entity_measure_bindings(topic):
-    """`[{source, dim, keys, not_yet}, …]` — every FACT topic this entity draws columns from.
+    """`[{source, dim, keys, scope_variant, not_yet}, …]` — every FACT topic this entity draws
+    columns from.
 
     ⭐⭐ A LIST, NOT ONE BINDING, since W37-T13. An entity's columns legitimately come from more
     than one fact topic: the product grid takes revenue/units/margin from `sales_lines` and stock
@@ -997,7 +1020,9 @@ def entity_measure_bindings(topic):
     for b in raw:
         if not isinstance(b, dict) or not b.get("source") or not b.get("dim"):
             continue
+        variant = b.get("scope_variant")
         out.append({"source": str(b["source"]), "dim": str(b["dim"]),
+                    "scope_variant": str(variant) if variant is not None else None,
                     "keys": list(b.get("keys") or []), "not_yet": list(b.get("not_yet") or [])})
     return out
 
@@ -1135,6 +1160,9 @@ def _one_binding_offer(topic, b, strict=False):
         raise _EntityMeasureError(
             f"{topic}: measure dim {b['dim']!r} is not a dim of {b['source']!r} "
             f"(allowed: {sorted(dims)})")
+    # Validate the declared variant at OFFER time. An unanswerable binding must be refused
+    # before the UI promises a metric column that only errors when its first cell is fetched.
+    _scope_for_binding(src["store"], b.get("scope_variant"))
     # ⛔ THE TABLE CHECK, before any key is offered from this binding.
     _tbl = (src["store"] or {}).get("table")
     _rdy = _source_ready(_tbl) if _tbl else True
@@ -1215,6 +1243,9 @@ def _one_binding_offer(topic, b, strict=False):
             "description": m.get("description") or "",
             "topic": b["source"],
             "dim": b["dim"],
+            # The resolver carries this alongside source/dim so a second binding to the same
+            # fact topic cannot accidentally borrow the source topic's default scope.
+            "scope_variant": b.get("scope_variant"),
         })
     return out, refused
 
@@ -1255,23 +1286,25 @@ def entity_measure_values(topic, keys, date_from=None, date_to=None, team_id=Non
     want = [k for k in keys if k in by_key]
     if not want:
         return {}
-    # ⭐ ONE QUERY PER SOURCE TOPIC (W37-T13). Keys from `sales_lines` and keys from `stock_moves`
+    # ⭐ ONE QUERY PER SOURCE TOPIC *and binding scope* (W37-T13/W39-T11). Keys from `sales_lines` and keys from `stock_moves`
     # are different tables joined by different dims, so they cannot ride one scan — but every key
     # WITHIN a source still does, which is the whole reason the six product metrics cost one query.
     groups = {}
     for k in want:
-        groups.setdefault((by_key[k]["topic"], by_key[k]["dim"]), []).append(k)
+        groups.setdefault((by_key[k]["topic"], by_key[k]["dim"],
+                           by_key[k].get("scope_variant")), []).append(k)
     if len(groups) > 1:
         merged = {}
-        for (src_, dim_), ks in groups.items():
+        for (_src, _dim, _variant), ks in groups.items():
             for gk, cell in entity_measure_values(
                     topic, ks, date_from=date_from, date_to=date_to, team_id=team_id,
                     exclude_services=exclude_services, offer=offer).items():
                 merged.setdefault(gk, {}).update(cell)
         return merged
-    (src, dim), want = next(iter(groups.items()))
+    (src, dim, scope_variant), want = next(iter(groups.items()))
     res = store_query(src, want, group_by=[dim], date_from=date_from, date_to=date_to,
-                      team_id=team_id, exclude_services=exclude_services, limit=MAX_GROUPS)
+                      team_id=team_id, exclude_services=exclude_services, limit=MAX_GROUPS,
+                      scope_variant=scope_variant)
     # ⛔ A TRUNCATED GROUP SET IS A WRONG ANSWER PER ROW, not a short list — the same refusal
     # `rollup_sql.group_values` makes, for the same reason. Never write cells from one.
     if res.get("truncated"):
@@ -1372,7 +1405,11 @@ def entity_measure_sets(topic, rules, today, team_id=None, keys_by_id=None, offe
     def values_for(mkey, window):
         """`{group key: value}` for one (measure, window), memoised within this call."""
         w = _wn.normalize(window)
-        sig = (mkey, None if w is None else tuple(sorted(w.items())))
+        # The same resolver serves both Metric CELLS and Metric FILTERS. Keep the binding
+        # scope in this cache identity so a future duplicate key cannot make conditions answer
+        # against a differently scoped value than the cells render.
+        sig = (mkey, by_key[mkey].get("scope_variant"),
+               None if w is None else tuple(sorted(w.items())))
         if sig not in cache:
             rng = _wn.resolve(window, today)
             if rng is None:

platform/model/topics/odoo_products.yml

@@ -50,6 +50,12 @@ store:
 measures:
 - source: sales_lines
   dim: product_code
+  # W39-T11 / R4: this is deliberately a BINDING choice, not a change to sales_lines'
+  # wholesale scope. Product movement must include Amazon; the same sales_lines topic also
+  # drives customer/Analyst work, which remains wholesale-only. semantic.py owns the small,
+  # closed vocabulary of variants and suppresses a caller's BU fence for all_channels too:
+  # crm.team 7 is not part of either wholesale BU.
+  scope_variant: all_channels
   # ⭐ The SHIP-FIRST six of `proto/P3-metric-catalog.md`, and they cost ONE grouped query
   # together (measured 0.22 s over 1,670 groups against the mirror; 2.55 s live).
   keys: [units, revenue, margin, cogs, margin_pct, asp]
@@ -131,6 +137,46 @@ fields:
     type: currency
     kind: data
     means: "Royal 2 pricelist price for this SKU. Blank when that list prices it nowhere."
+  - key: price_1
+    label: "Price 1"
+    type: currency
+    kind: data
+    means: "Cheapest live package price for this SKU across active pricelists."
+  - key: unit_1
+    label: "Unit 1"
+    type: text
+    kind: data
+    means: "Package label for Price 1; blank means Odoo has no package reference for that price."
+  - key: price_2
+    label: "Price 2"
+    type: currency
+    kind: data
+    means: "Second-cheapest live package price for this SKU."
+  - key: unit_2
+    label: "Unit 2"
+    type: text
+    kind: data
+    means: "Package label for Price 2."
+  - key: price_3
+    label: "Price 3"
+    type: currency
+    kind: data
+    means: "Third-cheapest live package price for this SKU."
+  - key: unit_3
+    label: "Unit 3"
+    type: text
+    kind: data
+    means: "Package label for Price 3."
+  - key: pre_book_qty
+    label: "Pre-book qty"
+    type: int
+    kind: data
+    means: "Units on confirmed, not-fully-delivered wholesale orders promised after today. Delivery-charge service lines are excluded."
+  - key: open_backlog_qty
+    label: "Open backlog qty"
+    type: int
+    kind: data
+    means: "Units still owed on confirmed, not-fully-delivered wholesale goods orders, including already-due promises. Delivery-charge service lines are excluded."
   - key: rev_ytd
     label: "Revenue YTD"
     type: currency

platform/modules/backorders.py

@@ -41,6 +41,78 @@ def _open_pickings():
     return picks, sched
 
 
+def sku_backlog(t=None, team_id=None):
+    """`(pre_book_by_code, open_backlog_by_code, report)` for the product catalogue.
+
+    This is deliberately NOT `board()`'s ``not due`` bucket.  That board enters through open
+    pickings and substitutes a picking scheduled date when an order has no commitment date;
+    pre-book means the stricter, stored-order fact ``commitment_date > end of t``.  Both measures
+    are confirmed wholesale goods that Odoo still calls pending, started, or partial.  Their
+    quantity is the positive part of ordered minus delivered, grouped by product and then by the
+    catalogue's code.
+    """
+    t = t or P.today()
+    if isinstance(t, dt.datetime):
+        t = t.date()
+    end_of_day = f"{t.isoformat()} 23:59:59"
+    teams = [team_id] if team_id is not None else O.active_team_ids()
+    common = [
+        ('state', 'in', ['sale', 'done']),
+        ('product_id', '!=', False),
+        ('order_id.delivery_status', 'in', ['pending', 'started', 'partial']),
+        ('product_id.type', '!=', 'service'),
+    ]
+    if teams:
+        common.append(('order_id.team_id', 'in', teams))
+    excluded = O.excluded_partner_ids()
+    if excluded:
+        common.append(('order_partner_id', 'not in', list(excluded)))
+
+    def _by_product(domain):
+        groups = O.read_group('sale.order.line', domain,
+                              ['product_uom_qty:sum', 'qty_delivered:sum'], ['product_id'],
+                              lazy=False)
+        out = {}
+        for group in groups:
+            pid = O.m2o_id(group.get('product_id'))
+            if not pid:
+                continue
+            open_qty = max(0.0, float(group.get('product_uom_qty') or 0.0)
+                           - float(group.get('qty_delivered') or 0.0))
+            if open_qty > 1e-9:
+                out[pid] = open_qty
+        return out
+
+    open_by_pid = _by_product(list(common))
+    pre_by_pid = _by_product(list(common) + [('order_id.commitment_date', '>', end_of_day)])
+    pids = sorted(set(open_by_pid) | set(pre_by_pid))
+    codes = {}
+    for ch in _chunk(pids, 500):
+        for product in O.search_read('product.product',
+                                     [('id', 'in', ch), ('active', 'in', [True, False])],
+                                     ['default_code']):
+            pid = product.get('id')
+            codes[pid] = str(product.get('default_code') or f"pid:{pid}").strip()
+
+    def _by_code(by_pid):
+        out = {}
+        for pid, qty in by_pid.items():
+            code = codes.get(pid, f"pid:{pid}")
+            out[code] = out.get(code, 0.0) + qty
+        return out
+
+    pre_by_code, open_by_code = _by_code(pre_by_pid), _by_code(open_by_pid)
+    report = {
+        'as_of': t.isoformat(),
+        'team_ids': teams,
+        'pre_book_qty': round(sum(pre_by_code.values()), 2),
+        'pre_book_skus': len(pre_by_code),
+        'open_backlog_qty': round(sum(open_by_code.values()), 2),
+        'open_backlog_skus': len(open_by_code),
+    }
+    return pre_by_code, open_by_code, report
+
+
 def board(team_id=None, t=None):
     """The full open-line board + bucket rollup. Returns dict(rows, buckets, orders, coverage)."""
     t = t or P.today()

platform/modules/inventory.py

@@ -39,9 +39,16 @@ def _build(t=None):
     prods = o.search_read('product.product', [('default_code', '!=', False)], fields)
     catmap = _cat_main_map()
 
-    # LTM sales per product (line level, RI+FFS scope)
+    # ⭐⭐ W39-T10 — LTM sales per product, ALL CHANNELS (line level). Owner instruction 1 of
+    # wave 39: *"Metrics under Odoo products MUST include EVERYTHING, not just Royal and Fisch DBA,
+    # but also Amazon."* THIS LINE IS WHERE `qty_ltm` COMES FROM — `sku_inventory` groups it by SKU
+    # code and `product_data._inventory_by_code` puts it on the product grid, so a wholesale-only
+    # read here under-states velocity (and over-states days-of-supply) for every SKU Amazon moves.
+    # ⚠ Consolidated by construction: the shelf is one warehouse and carries no team. The BU
+    # re-scoping happens downstream in `product_data._rescope_inventory`, against a share whose
+    # DENOMINATOR was widened to match this read — see `product_data._bu_ltm_share`.
     lf, lt = P.ltm(t)
-    s = o.read_group('sale.order.line', O.sale_line_domain(lf, lt),
+    s = o.read_group('sale.order.line', O.sale_line_domain(lf, lt, all_channels=True),  # W39-T10
                      ['product_id', 'price_subtotal:sum', 'product_uom_qty:sum'],
                      ['product_id'], lazy=False)
     rev = {O.m2o_id(r['product_id']): (r.get('price_subtotal') or 0.0) for r in s if r.get('product_id')}

platform/modules/product_data.py

@@ -61,6 +61,7 @@ import core.odoo as O
 import core.periods as P
 import core.shared_overlay as shared_overlay
 import core.table_store as table_store
+import modules.backorders as backorders
 import modules.products as products
 
 #: POOL-ROW KEYS that exist ONLY on a consolidated pull. See decision 2.
@@ -292,8 +293,35 @@ def _bu_ltm_share(t, team_id):
     """
     try:
         f, to = P.ltm(t)
+        # ⛔⛔ W39-T10 — THE DENOMINATOR WIDENS, THE NUMERATOR DOES NOT, AND THE ASYMMETRY IS THE
+        # WHOLE POINT. `inventory._build` now reads ALL CHANNELS, so `consolidated qty_ltm` counts
+        # Amazon. `_rescope_inventory` computes a BU's units as `consolidated × share`, so `share`
+        # must be measured against THE SAME universe or the multiplication is mixed-scope.
+        #   allq  DENOMINATOR — consolidated, no explicit team -> all_channels=True
+        #   buq   NUMERATOR   — explicit team 5|6, wholesale    -> UNCHANGED, deliberately
+        # Amazon is crm.team 7. A Fisch or Royal numerator that counted team-7 units would claim
+        # units that unit never sold; a FLAT Fisch/Royal result after this change is the CORRECT
+        # answer, not a broken flag.
+        # ⛔ AND `share <= 1` IS STILL STRUCTURAL, NOT MERELY ARGUED — which is what lets this
+        # change keep the guarantee the docstring above was written to protect. The numerator's
+        # DOMAIN is a strict subset of the denominator's: `sale_line_domain(f, to, team_id)` is
+        # `sale_line_domain(f, to, None, all_channels=True)` plus an `order_id.team_id = N` clause
+        # plus an `order_partner_id not in (excluded)` clause. Same reader, same fields, same
+        # grouping, same `_NO_SVC` filter, nested domains — so `buq[code] <= allq[code]` cannot be
+        # violated, and the `min(1.0, ...)` clamp below is dead code kept as a belt.
+        # ⚠ THE OTHER DIRECTION IS NOT SAFE, and that is why the numerator must stay put: widening
+        # it (explicit team + `all_channels=True`) drops the excluded-partner clause from the
+        # NUMERATOR ONLY, which un-nests the domains and can push the share above 1 — re-opening
+        # the measured defect this docstring records, Fisch's LTM units exceeding the company's on
+        # 5 SKUs of 5,871.
+        # ⛔ THE DETECTING INVARIANT IS THE SUM: `share(5) + share(6) <= 1.0` per code, because
+        # `buq5 + buq6` IS the active-team universe. The per-share clamp cannot detect anything and
+        # a check written against it is green by construction. Gated, with the pro-ration defect
+        # reproduced as a negative control, in `verify_product_pool.py::section_amazon_all_channels`.
+        # MEASURED 2026-08-20 (2,852 codes): sum > 1.0 on ZERO codes; sum < 1.0 on 918 (was 71);
+        # e.g. VCAND10-WH-PK72 1.0 -> 0.002891 == 45 wholesale units / 15,566.7 all-channel.
         allq = {code: (r.get('qty') or 0.0)
-                for code, r in (products._sku_rev(f, to, None) or {}).items()}
+                for code, r in (products._sku_rev(f, to, None, all_channels=True) or {}).items()}
         buq = {code: (r.get('qty') or 0.0)
                for code, r in (products._sku_rev(f, to, team_id) or {}).items()}
     except Exception:
@@ -437,7 +465,7 @@ def pool(team_id=None, t=None):
     except Exception:                                                  # noqa: BLE001
         _prods = None
     tiers, _tier_report = products.tier_prices_by_code(_prods)
-    packs, _pack_report = products.packagings_by_code(_prods)
+    pre_book, open_backlog, _backlog_report = backorders.sku_backlog(t=t, team_id=team_id)
     cat = _catalogue_by_code()
     # ⭐ THE BUY LIST'S DEMAND HORIZON (owner ruling 2026-08-19). BU-shaped through `team_id`, the
     # same way the revenue columns are: a Fisch reader's reorder quantity must answer what FISCH
@@ -507,10 +535,15 @@ def pool(team_id=None, t=None):
         # as something `grid_events` refuses to re-parse.
         # ⚠ BLANK, NOT "[]" — an empty cell reads as "sold in one unit / not priced on any list",
         # and an empty JSON array on screen reads as a bug.
-        _tiers = tiers.get(code)
-        row["tier_prices"] = json.dumps(_tiers, ensure_ascii=False) if _tiers else None
-        _units = packs.get(code)
-        row["units"] = json.dumps(_units, ensure_ascii=False) if _units else None
+        _tiers = tiers.get(code) or []
+        for _n in range(1, 4):
+            _tier = _tiers[_n - 1] if len(_tiers) >= _n else None
+            row[f"price_{_n}"] = _tier.get("unit_price") if _tier else None
+            row[f"unit_{_n}"] = _tier.get("unit") if _tier else None
+        # W39-T14: these are open customer promises, not sales velocity.  A missing code is an
+        # observed zero in the grouped backlog read, so 0.0 is the honest cell rather than blank.
+        row["pre_book_qty"] = pre_book.get(code, 0.0)
+        row["open_backlog_qty"] = open_backlog.get(code, 0.0)
         # Wave 17 R3 — the supplier master, on every pull (it is catalogue data, not stock).
         s = sup.get(code) or {}
         row.update({
@@ -719,7 +752,11 @@ def validate(team_id=None, t=None):
     }]
 
     yf, yt = P.ytd(t)
-    sku_rev = products._sku_rev(yf, yt, team_id) or {}
+    # ⛔ W39-T10 — ALL CHANNELS, BECAUSE THE THING IT RECONCILES IS. `pool()`'s revenue columns
+    # come from `products.directory()`, which reads all channels since this ticket. This oracle
+    # re-asks the same window; leaving it wholesale-only would put the whole Amazon delta into
+    # "revenue the grid dropped" and red a leg that is measuring nothing wrong.
+    sku_rev = products._sku_rev(yf, yt, team_id, all_channels=True) or {}
     in_pool = {r["code"] for r in rows}
     outside = {c: v for c, v in sku_rev.items() if c not in in_pool}
     ours = round(sum(r["rev_ytd"] or 0.0 for r in rows), 2)
@@ -1191,42 +1228,37 @@ def validate_stock_measures(t=None, days=90, sample=4):
 
 
 def validate_price_and_unit_cells(rows, sample=6):
-    """⭐⭐ W37-T14 / T15 — the `Tier prices` and `Units` cells, against a FRESH Odoo read.
+    """Reconcile typed Price 1..3 / Unit 1..3 cells to a fresh, per-SKU Odoo read.
 
-    ⛔ THE ORACLE IS ASKED PER SKU, not in bulk, and deliberately so: the builders group a
-    bulk read in Python, so re-running the same bulk read would re-run the same grouping and
-    could only ever agree with itself. Asking Odoo for ONE SKU's price rules is a different
-    question shape and can actually disagree ([[no-unverifiable-aggregates]]).
-
-    ⚠ WHAT IS NOT PROVEN HERE, said rather than implied: that a PERSON sees the cell. These are
-    `json` columns on the product grid and the render is the client's; the data half is what a
-    module `validate()` can reach.
+    The pool groups price rules in bulk. This asks Odoo per SKU so a wrong grouping, a lost
+    package price, or a missing unit has an oracle which cannot agree by reusing that grouping.
+    The contract ships only the cheapest three pairs; duplicate SKU codes may make the pool a
+    legitimate superset of a single product's rules.
     """
     checks = []
-    priced = [r for r in rows if r.get("tier_prices")]
-    united = [r for r in rows if r.get("units")]
+    priced = [r for r in rows if r.get("price_1") is not None]
+    with_first_pair = [r for r in rows if "price_1" in r and "unit_1" in r]
     checks.append({
-        "check": "the product grid serves a Tier-prices cell (W37-T14) and a Units cell (T15); "
-                 "a DECLARED column that is never filled is the defect these replace",
-        "ours": {"with_tier_prices": len(priced), "with_units": len(united), "rows": len(rows)},
-        "theirs": ">0 each",
-        # ⚠ Units are legitimately sparse (19.6% measured), so the floor is existence, not a rate.
-        "ok": bool(priced) and bool(united),
-        "detail": {"multi_price_skus": sum(1 for r in priced
-                                           if len(json.loads(r["tier_prices"])) > 1)},
+        "check": "the product grid serves typed Price 1..3 and Unit 1..3 cells, not JSON cells",
+        "ours": {"with_price_1": len(priced), "with_first_pair": len(with_first_pair),
+                 "rows": len(rows)},
+        "theirs": {"price_1": ">0", "typed_first_pair": len(rows)},
+        "ok": bool(priced) and len(with_first_pair) == len(rows)
+              and not any("tier_prices" in r or "units" in r for r in rows),
+        "detail": {"two_or_more_prices": sum(1 for r in rows if r.get("price_2") is not None),
+                   "three_prices": sum(1 for r in rows if r.get("price_3") is not None)},
     })
     if not priced:
         return checks
     o = O.get_odoo()
-    pls = {p["id"]: str(p.get("name") or "").strip()
-           for p in O.search_read("product.pricelist", [], ["id", "name"])}
     today = P.today().isoformat()
-    # Prefer SKUs that carry MORE THAN ONE price — the ticket's own subject.
-    cand = sorted(priced, key=lambda r: -len(json.loads(r["tier_prices"])))[:sample]
+    # Prefer SKUs that carry more than one price, the ticket's own subject.
+    cand = sorted(priced,
+                  key=lambda r: -sum(r.get(f"price_{n}") is not None for n in range(1, 4)))[:sample]
     bad = []
     for r in cand:
-        mine = sorted((t["pricelist"], round(float(t["unit_price"]), 2))
-                      for t in json.loads(r["tier_prices"]))
+        mine = sorted((round(float(r[f"price_{n}"]), 2), str(r.get(f"unit_{n}") or "").strip())
+                      for n in range(1, 4) if r.get(f"price_{n}") is not None)
         pid = r.get("product_id")
         tmpl = None
         if pid:
@@ -1235,24 +1267,31 @@ def validate_price_and_unit_cells(rows, sample=6):
         dom = [("compute_price", "=", "fixed"),
                "|", ("date_start", "=", False), ("date_start", "<=", today),
                "|", ("date_end", "=", False), ("date_end", ">=", today),
+               ("applied_on", "in", ["0_product_variant", "1_product"]),
                ("fixed_price", ">", 0),
                "|", ("product_id", "=", pid), ("product_tmpl_id", "=", tmpl)]
         live = o.search_read("product.pricelist.item", dom,
-                             ["pricelist_id", "fixed_price", "min_quantity", "applied_on"])
-        best = {}
+                             ["pricelist_id", "product_id", "product_tmpl_id", "fixed_price",
+                              "packaging_price", "packaging_id", "applied_on"])
+        by_variant, by_template = {}, {}
         for it in live:
-            nm = pls.get(O.m2o_id(it.get("pricelist_id")), "?")
-            q = it.get("min_quantity") or 0.0
-            if nm not in best or q < best[nm][0]:
-                best[nm] = (q, round(it.get("fixed_price") or 0.0, 2))
-        theirs = sorted((nm, v) for nm, (q, v) in best.items())
+            plid = O.m2o_id(it.get("pricelist_id"))
+            if it.get("applied_on") == "0_product_variant" and O.m2o_id(it.get("product_id")) == pid:
+                by_variant.setdefault(plid, []).append(it)
+            elif O.m2o_id(it.get("product_tmpl_id")) == tmpl:
+                by_template.setdefault(plid, []).append(it)
+        picked = [it for plid in sorted(set(by_variant) | set(by_template))
+                  for it in (by_variant.get(plid) or by_template.get(plid) or [])]
+        theirs = sorted((round(float(it.get("packaging_price") or it.get("fixed_price") or 0.0), 2),
+                          str(O.m2o_name(it.get("packaging_id")) or "").strip())
+                         for it in picked)[:3]
         # ⚠ A code carried by TWO active products legitimately holds MORE entries than a single
         # product's rules (D-309 / `2112-12`), so ours is a SUPERSET, never an equality.
         if not set(theirs) <= set(mine):
             bad.append({"sku": r.get("code"), "ours": mine, "odoo": theirs})
     checks.append({
-        "check": f"each sampled SKU's Tier prices contain every live Odoo price for it "
-                 f"({len(cand)} SKUs, chosen for having the MOST prices)",
+        "check": f"each sampled SKU's typed Price/Unit pairs contain every live Odoo pair "
+                 f"({len(cand)} SKUs, chosen for the most prices)",
         "ours": len(bad), "theirs": 0, "ok": not bad,
         "detail": {"mismatches": bad[:3],
                    "sampled": [r.get("code") for r in cand]},
@@ -1365,7 +1404,14 @@ def validate_measures(t=None, team_id=None, days=90, pool_codes=None):
     o = O.get_odoo()
     # ⛔ ASKED OF ODOO DIRECTLY, grouped by Odoo's OWN product id — deliberately NOT by the SKU
     # code the mirror joins on, so the oracle cannot inherit our join key.
-    g = o.read_group('sale.order.line', O.sale_line_domain(DF, DT),
+    # ⭐ W39-T11 deliberately widens only this ENTITY binding. `odoo_products.yml` opts its
+    # sales_lines binding into semantic's `all_channels` variant: confirmed Amazon lines belong
+    # in a SKU-shaped product measure, while the source topic itself stays wholesale-only for
+    # customer grain / Analyst. There are THREE scopes here, and all have to move together:
+    # (i) the semantic entity binding, (ii) the DuckDB mirror oracle below, and (iii) direct
+    # Odoo's `sale_line_domain(..., all_channels=True)` reads. Leaving either oracle narrow
+    # would make a correct all-channel cell look like an unexplained reconciliation failure.
+    g = o.read_group('sale.order.line', O.sale_line_domain(DF, DT, all_channels=True),
                      ['product_id', 'price_subtotal:sum', 'product_uom_qty:sum', 'margin:sum'],
                      ['product_id'], lazy=False)
     live_tot = {"revenue": round(sum(r['price_subtotal'] for r in g), 2),
@@ -1383,20 +1429,19 @@ def validate_measures(t=None, team_id=None, days=90, pool_codes=None):
         rows = con.execute(
             "SELECT l.id, l.price_subtotal FROM sale_order_line l "
             "JOIN sale_order o ON o.id = l.order_id "
-            "WHERE o.state IN ('sale','done') AND o.team_id IN (5,6) "
+            "WHERE o.state IN ('sale','done') "
             "  AND l.product_id IS NOT NULL "
-            "  AND l.order_partner_id NOT IN "
-            "      (SELECT id FROM res_partner WHERE name LIKE 'GIFTWARE%') "
             "  AND CAST(o.date_order AS TIMESTAMP) >= ? AND CAST(o.date_order AS TIMESTAMP) <= ?",
             [f"{DF} 00:00:00", f"{DT} 23:59:59"]).fetchall()
     finally:
         con.close()
     mine = {r[0]: (r[1] or 0.0) for r in rows}
     theirs = {r['id']: (r['price_subtotal'] or 0.0) for r in
-              o.search_read('sale.order.line', O.sale_line_domain(DF, DT),
+              o.search_read('sale.order.line', O.sale_line_domain(DF, DT, all_channels=True),
                             ['id', 'price_subtotal', 'write_date'])}
     wd = {r['id']: str(r['write_date']) for r in
-          o.search_read('sale.order.line', O.sale_line_domain(DF, DT), ['id', 'write_date'])}
+          o.search_read('sale.order.line', O.sale_line_domain(DF, DT, all_channels=True),
+                        ['id', 'write_date'])}
     discrepant = [i for i, v in theirs.items()
                   if i not in mine or abs(mine[i] - v) >= 0.005]
     unexplained = [i for i in discrepant if not wm or wd.get(i, '') <= str(wm)]

platform/modules/products.py

@@ -7,7 +7,11 @@ Basket / co-purchase (MBA) is intentionally deferred — the existing client app
 runtime-side, and a local co-occurrence pull over 74k LTM lines is the kind of heavy job the
 project guardrails keep off the local PC. (See BACKLOG.)
 
-All line-level (sale.order.line), RI+FFS scope, excluded accounts removed — reusing sale_line_domain.
+All line-level (sale.order.line), reusing `sale_line_domain`. ⭐ W39-T10: the SKU-shaped
+readers here run ALL CHANNELS (`all_channels=True`) — owner: *"Metrics under Odoo products
+MUST include EVERYTHING, not just Royal and Fisch DBA, but also Amazon."* The excluded
+house accounts and the crm.team fence are therefore NOT applied on those reads; an
+explicit `team_id` (a BU-scoped caller) still narrows to that one unit.
 Coverage (distinct customers per SKU) uses a 2-level read_group and is a touch slow (~15s/
 window), so it's its own function the app calls lazily and caches.
 """
@@ -43,8 +47,20 @@ def _sku_rev(date_from, date_to, team_id=None, all_channels=False):
     """{sku_code: {'name','rev','qty','orders'}} over a window (services excluded,
     duplicate product records merged by SKU code).
 
-    ⚠ `all_channels=True` keeps the excluded house accounts (GIFTWARE DEALS, the Amazon channel)
-    IN the read. Only the replenishment caller wants that; see `sale_line_domain`'s own note."""
+    ⭐⭐ `all_channels=True` KEEPS THE AMAZON CHANNEL IN, and since W39-T10 that is what EVERY
+    SKU-shaped caller in this module passes. Owner, instruction 1 of wave 39: *"Metrics under Odoo
+    products MUST include EVERYTHING, not just Royal and Fisch DBA, but also Amazon. Applies to
+    everything in the Odoo product database."* It drops BOTH fences — the `crm.team` one (Amazon
+    sits on team 7) and the excluded-partner one; see `sale_line_domain`'s own note for why missing
+    the first makes the flag a silent no-op.
+
+    ⛔ THE PARAMETER STAYS, AND THE DEFAULT STAYS `False`. Flipping the default would widen every
+    reader that imports this module, including money-to-the-books ones — and R4 fences this ruling
+    to SKU-shaped surfaces: AR, collections and FP&A stay wholesale-only because Amazon settles
+    differently. The widening is therefore stated at each CALL SITE, where it is greppable.
+
+    ⚠ AN EXPLICIT `team_id` STILL WINS: a Fisch or Royal caller keeps getting its own unit, because
+    `sale_line_domain` re-adds the explicit team after dropping the fence."""
     g = O.read_group('sale.order.line',
                      O.sale_line_domain(date_from, date_to, team_id, extra=_NO_SVC,
                                         all_channels=all_channels),
@@ -136,8 +152,8 @@ def yoy_movers(t=None, limit=20, team_id=None):
     t = t or P.today()
     yf, yt = P.ytd(t)
     lf, lt = P.ytd_last_year(t)
-    this = _sku_rev(yf, yt, team_id)
-    last = _sku_rev(lf, lt, team_id)
+    this = _sku_rev(yf, yt, team_id, all_channels=True)  # W39-T10
+    last = _sku_rev(lf, lt, team_id, all_channels=True)  # W39-T10
     rows = []
     for pid in set(this) | set(last):
         tr = this.get(pid, {'rev': 0.0, 'name': last.get(pid, {}).get('name', '')})
@@ -155,8 +171,8 @@ def zombie_skus(t=None, limit=30, min_prior=1500.0, team_id=None):
     t = t or P.today()
     yf, yt = P.ytd(t)
     lf, lt = P.ytd_last_year(t)
-    this = _sku_rev(yf, yt, team_id)
-    last = _sku_rev(lf, lt, team_id)
+    this = _sku_rev(yf, yt, team_id, all_channels=True)  # W39-T10
+    last = _sku_rev(lf, lt, team_id, all_channels=True)  # W39-T10
     rows = []
     for pid, lr in last.items():
         if lr['rev'] < min_prior:
@@ -175,8 +191,8 @@ def new_winners(t=None, limit=20, min_this=1500.0, team_id=None):
     t = t or P.today()
     yf, yt = P.ytd(t)
     lf, lt = P.ytd_last_year(t)
-    this = _sku_rev(yf, yt, team_id)
-    last = _sku_rev(lf, lt, team_id)
+    this = _sku_rev(yf, yt, team_id, all_channels=True)  # W39-T10
+    last = _sku_rev(lf, lt, team_id, all_channels=True)  # W39-T10
     rows = []
     for pid, tr in this.items():
         if tr['rev'] < min_this:
@@ -194,7 +210,7 @@ def velocity_leaders(t=None, limit=25, team_id=None):
     """Top SKUs by LTM unit velocity (units/month) and revenue."""
     t = t or P.today()
     lf, lt = P.ltm(t)
-    sku = _sku_rev(lf, lt, team_id)
+    sku = _sku_rev(lf, lt, team_id, all_channels=True)  # W39-T10
     rows = [{'code': k, 'product': v['name'], 'units_ltm': v['qty'], 'units_per_mo': v['qty'] / 12.0,
              'rev_ltm': v['rev'], 'orders_ltm': v['orders']} for k, v in sku.items()]
     rows.sort(key=lambda x: -x['units_ltm'])
@@ -220,8 +236,8 @@ def directory(t=None, team_id=None):
     t = t or P.today()
     yf, yt = P.ytd(t)
     lf, lt = P.ytd_last_year(t)
-    this = _sku_rev(yf, yt, team_id)
-    last = _sku_rev(lf, lt, team_id)
+    this = _sku_rev(yf, yt, team_id, all_channels=True)  # W39-T10
+    last = _sku_rev(lf, lt, team_id, all_channels=True)  # W39-T10
     code_cat = _code_category()
     rows = []
     for code in set(this) | set(last):
@@ -581,12 +597,14 @@ def active_products(limit=50000):
 
 
 def tier_prices_by_code(prods=None):
-    """`({code: [{pricelist, unit_price}]}, report)` — EVERY live price a SKU really has.
+    """`({code: [{pricelist, unit_price, unit}]}, report)` — EVERY live price a SKU really has.
 
     ⭐⭐ W37-T14 (owner: multiple prices per SKU). `pricelist_by_code` above answers a DIFFERENT
     question and both are needed: it fills three DECLARED columns (`price_fisch`, `price_royal_1`,
     `price_royal_2`) and therefore cannot show a price on a list the contract does not name. This
-    one is the honest set — one entry per pricelist that actually prices this SKU today.
+    one is the honest set — one entry per PRICE RULE that actually prices this SKU today. One
+    pricelist can carry Pack, Sleeve and Master rows for the same SKU; collapsing those rows to
+    a single base price loses the unit-specific prices the catalogue needs to show.
 
     ⛔ IT READS EVERY LIVE PRICELIST, not `PRICELIST_COLUMNS`. Hardcoding this tenant's three list
     names into "how many prices does a SKU have" is exactly what the ticket forbids, and it is what
@@ -600,15 +618,16 @@ def tier_prices_by_code(prods=None):
     ⛔ FILTER BY `pricelist_id`, NEVER BY `active`: the default `product.pricelist.item` count hides
     2,580 archived items, so an `active` filter reads as a smaller, plausible, wrong set.
 
-    ⚠ THE BASE TIER, at qty 1, for the same reason `pricelist_by_code` gives: a catalogue cell has
-    no quantity in hand. Measured: only 10 of 10,468 items carry a quantity break at all, so this
-    is very nearly the whole story rather than a simplification.
-    ⚠ CARDINALITY 1..3 TODAY, mode 3 — and `Royal 2` carries 2,605 price rows against **0 customers
-    and 0 orders**, so a SKU reading "3 tiers" is catalogue-true and commercially misleading. The
-    entry keeps the list NAME so a reader can see which tier it is rather than a bare count.
+    ⚠ GRAIN IS THE CONTRACT. `min_quantity` is not a packaging quantity here: Pack, Sleeve and
+    Master can all have the same quantity break while `packaging_price` carries 5.00, 50.00 and
+    2,500.00 respectively. Keep every candidate row and order the result by the actual price.
+    ⚠ CARDINALITY is therefore a count of PRICE/UNIT pairs, not pricelists. `Royal 2` carries
+    2,605 price rows against **0 customers and 0 orders**, so a SKU reading several pairs is
+    catalogue-true and commercially misleading. The entry keeps the list NAME for provenance.
     """
     report = {"lists": [], "rules_total": 0, "rules_not_fixed": 0, "rules_out_of_date": 0,
-              "rules_global": 0, "skus_with_no_price": 0, "identity_breaks": 0}
+              "rules_global": 0, "skus_with_no_price": 0, "identity_breaks": 0,
+              "rules_with_packaging": 0}
     try:
         pls = {p['id']: str(p.get('name') or '').strip()
                for p in O.search_read('product.pricelist', [], ['id', 'name'])}
@@ -621,7 +640,8 @@ def tier_prices_by_code(prods=None):
                ('fixed_price', '>', 0)]
         rules = O.search_read('product.pricelist.item', dom,
                               ['pricelist_id', 'product_id', 'product_tmpl_id', 'applied_on',
-                               'fixed_price', 'min_quantity'])
+                               'fixed_price', 'min_quantity', 'packaging_id', 'packaging_price'])
+        report["rules_with_packaging"] = sum(1 for r in rules if r.get("packaging_id"))
 
         # R6's second sentence: what this reader cannot see is COUNTED, never dropped.
         def _n(extra):
@@ -657,8 +677,12 @@ def tier_prices_by_code(prods=None):
             cands = by_var.get((plid, p['id'])) or by_tmpl.get((plid, tmpl))
             if not cands:
                 continue
-            base = min(cands, key=lambda r: r.get('min_quantity') or 0.0)
-            tiers.append({"pricelist": name, "unit_price": round(base.get('fixed_price') or 0.0, 2)})
+            for rule in cands:
+                # `packaging_price` is the price OF this package (not the base-unit fixed price).
+                # An orphaned package still has a useful price; it carries an honest blank unit.
+                price = rule.get("packaging_price") or rule.get("fixed_price") or 0.0
+                tiers.append({"pricelist": name, "unit_price": round(price, 2),
+                              "unit": str(O.m2o_name(rule.get("packaging_id")) or "").strip()})
         if tiers:
             # ⚠ A code carried by TWO active products (D-309: `2112-12`) MERGES here, because the
             # grid is keyed by code and one code is one row. The prices are UNIONED rather than
@@ -668,13 +692,17 @@ def tier_prices_by_code(prods=None):
             if prior is None:
                 out[code] = tiers
             else:
-                seen = {(t["pricelist"], t["unit_price"]) for t in prior}
+                seen = {(t["pricelist"], t["unit_price"], t["unit"]) for t in prior}
                 for t in tiers:
-                    if (t["pricelist"], t["unit_price"]) not in seen:
+                    ident = (t["pricelist"], t["unit_price"], t["unit"])
+                    if ident not in seen:
                         prior.append(t)
+                        seen.add(ident)
                         report["identity_breaks"] += 1
         else:
             report["skus_with_no_price"] += 1
+    for tiers in out.values():
+        tiers.sort(key=lambda t: (t["unit_price"], t["unit"].lower(), t["pricelist"].lower()))
     return out, report
 
 
@@ -752,7 +780,9 @@ def _coverage(date_from, date_to, team_id=None):
     """{sku_code: distinct_customer_count} via 2-level read_group (slow-ish), merged by code.
     (A customer buying two records sharing a code can count twice; duplicates are rare, and
     code-level avoids the bigger error of a re-SKUed product reading as full coverage loss.)"""
-    g = O.read_group('sale.order.line', O.sale_line_domain(date_from, date_to, team_id, extra=_NO_SVC),
+    g = O.read_group('sale.order.line',
+                     O.sale_line_domain(date_from, date_to, team_id, extra=_NO_SVC,
+                                        all_channels=True),  # W39-T10
                      ['__count'], ['product_id', 'order_partner_id'], lazy=False)
     codes = _code_map()
     cov = {}
@@ -797,7 +827,11 @@ def _sku_product_ids(code):
 
 
 def _sku_dom(pids, date_from, date_to, team_id=None):
-    return O.sale_line_domain(date_from, date_to, team_id, extra=[('product_id', 'in', pids)] + _NO_SVC)
+    # ⭐ W39-T10 — ALL CHANNELS, and it MUST move with `_sku_rev`. The drawer's buyer bridge is
+    # reconciled against the SKU's directory revenue in `validate()`; widening one reader and not
+    # the other turns that leg red while both numbers are individually defensible.
+    return O.sale_line_domain(date_from, date_to, team_id, extra=[('product_id', 'in', pids)] + _NO_SVC,
+                              all_channels=True)
 
 
 def _sku_name_category(pids):
@@ -866,7 +900,7 @@ def sku_detail(code, t=None, team_id=None, n_months=13, allsku=None):
         monthly.append({'month': ym, 'revenue': mrev.get(ym, 0.0),
                         'revenue_ly': mrev.get(f'{y:04d}-{m:02d}', 0.0)})
 
-    allsku = allsku if allsku is not None else _sku_rev(yf, yt, team_id)
+    allsku = allsku if allsku is not None else _sku_rev(yf, yt, team_id, all_channels=True)  # W39-T10
     total = sum(v['rev'] for v in allsku.values()) or 1.0
     rank = next((i + 1 for i, (c, _v) in enumerate(sorted(allsku.items(), key=lambda kv: -kv[1]['rev']))
                  if c == code), None)
@@ -1046,10 +1080,15 @@ def validate(t=None, team_id=None):
     t = t or P.today()
     yf, yt = P.ytd(t)
     checks = []
-    sku = _sku_rev(yf, yt, team_id)
+    # ⛔⛔ W39-T10 — BOTH SIDES OF EVERY LEG MOVED TOGETHER. These legs reconcile a per-SKU sum
+    # against an ungrouped Odoo total over THE SAME DOMAIN. Widening the readers above without
+    # widening the oracles here would print a ~$1.3M gap and read as a data defect rather than as
+    # a scope change — the "disagree in opposite directions" failure.
+    sku = _sku_rev(yf, yt, team_id, all_channels=True)  # W39-T10
     sku_sum = sum(v['rev'] for v in sku.values())
     line_total = O.sum_field('sale.order.line',
-                             O.sale_line_domain(yf, yt, team_id, extra=_NO_SVC), 'price_subtotal')
+                             O.sale_line_domain(yf, yt, team_id, extra=_NO_SVC,
+                                                all_channels=True), 'price_subtotal')  # W39-T10
     checks.append({'check': 'SKU rev: Σ(per-SKU) == total line revenue, ex-services (YTD)',
                    'a': round(sku_sum, 2), 'b': round(line_total, 2),
                    'gap': round(sku_sum - line_total, 2),
@@ -1059,7 +1098,8 @@ def validate(t=None, team_id=None):
     movers_sum = sum(r['change'] for r in m['risers']) + sum(r['change'] for r in m['decliners'])
     lf, lt = P.ytd_last_year(t)
     last_total = O.sum_field('sale.order.line',
-                             O.sale_line_domain(lf, lt, team_id, extra=_NO_SVC), 'price_subtotal')
+                             O.sale_line_domain(lf, lt, team_id, extra=_NO_SVC,
+                                                all_channels=True), 'price_subtotal')  # W39-T10
     checks.append({'check': 'SKU movers: Σ(Δ) == (YTD − LY) total',
                    'a': round(movers_sum, 2), 'b': round(line_total - last_total, 2),
                    'gap': round(movers_sum - (line_total - last_total), 2),

web/src/customer-grid/ColumnMenu.tsx

@@ -296,6 +296,28 @@ interface ColumnMenuProps {
    * `offerGeocode` doc for why the two questions currently differ.
    */
   geocodable: boolean;
+  /**
+   * ⭐⭐ W39-T17 — THE SERVER-ISSUED TABLE KEY, and the ONLY reason "Share field" needs a prop at
+   * all: a column is not addressable on its own. A field share's oid is
+   * `"<table_key>:<field_key>"` (`core.shares.field_oid`), and nothing else in this file knows
+   * which database the column lives on — the only `topic` here belongs to the rollup source
+   * offer, which is a rollup's TARGET topic, not this column's table.
+   *
+   * ⛔⛔ IT MUST BE `payload.workspace.storageKey` AND NOTHING ELSE, and a near-miss fails
+   * SILENTLY. `core.shares.split_field_oid` fails closed to `(None, None)` on any id it cannot
+   * split; `routes_shares._object_ref` then answers `route=None` and `_notify_new_grantees`
+   * returns EARLY, so the grant is written and NOBODY IS TOLD. The host's local fallback
+   * (`${LOCAL_KEY_PREFIX}${scope}`) is, in `CustomerGrid`'s own words, "a key the server never
+   * issues" — a share built on one is junk that looks like it worked.
+   *
+   * ⚠ ABSENT IS A REAL STATE AND IT WITHDRAWS THE ROW. A workspace read that 403s leaves no
+   * storageKey, and a query PREVIEW's columns are a projection rather than the database's own;
+   * both pass nothing, and the menu then offers no Share entry rather than one that cannot
+   * resolve. `shared_overlay` is keyed by exactly this spelling on both sides
+   * (`product_table_workspace` for a registry topic, the bare key for a `ut_*` database) and
+   * `_object_ref` strips the `_table_workspace` suffix itself, so it travels UNMODIFIED.
+   */
+  tableKey?: string;
 }
 
 type CreatePosition = "left" | "right" | "end";
@@ -2018,6 +2040,7 @@ export default function ColumnMenu({
   onClearGroup,
   userOptions = [],
   measures = [],
+  tableKey,
 }: ColumnMenuProps) {
   const [pane, setPane] = useState<MenuPane>(schemaLocked ? "menu" : initialPane ?? "menu");
   const [note, setNote] = useState(field.note ?? "");
@@ -3817,6 +3840,73 @@ export default function ColumnMenu({
     !!viewer &&
     (viewer.isAdmin || (field.createdBy != null && field.createdBy === viewer.name));
 
+  /**
+   * ⭐⭐ W39-T17 — THE SHARE ID FOR THIS COLUMN, or `null` if one cannot honestly be built.
+   *
+   * ⛔ THREE WAYS IT REFUSES, and every one of them would otherwise produce an id the server
+   * accepts and then cannot resolve:
+   *   · no `tableKey` — the host has no SERVER-issued key (see that prop's note: the local
+   *     fallback is a key the server never issues, and a grant on one notifies nobody);
+   *   · an empty one — `shares.field_oid` raises on a blank half, so the row must not offer it;
+   *   · a field key containing `:` — `split_field_oid` refuses any oid whose FIELD half carries
+   *     the separator, so such a column is not shareable and saying so by omission beats a row
+   *     that 404s.
+   */
+  const shareTable = (tableKey ?? "").trim();
+  const shareOid =
+    shareTable && field.key && !field.key.includes(":") ? `${shareTable}:${field.key}` : null;
+
+  /**
+   * Open the SHELL's access editor for this column — the same dialog, roles and people picker a
+   * view or a folder gets (W39-T17's done-when; `shell/ShareDialog.tsx` renders all four kinds).
+   *
+   * ⛔⛔ THE EVENT NAME IS A HARD-CODED LITERAL AND MUST STAY ONE. `customer-grid/**` MUST NOT
+   * import `shell/**` (this tree is host-neutral — the same rule `ViewSidebar.tsx::openShare`
+   * states and obeys), so `shareModel.SHARE_OPEN_EVENT` is unreachable from here by design.
+   * The literal is spelled once there and once here, and `verify_wiring.py`'s W39-W1 row pins
+   * BOTH ENDS precisely because no shared constant can keep them in step.
+   * ⛔ It degrades to NOTHING when no shell is listening: an event nobody hears opens no dialog
+   * and throws no error, which is the right failure for a frame-level surface reached from a
+   * column menu.
+   */
+  const openFieldShare = () => {
+    if (!shareOid) return;
+    window.dispatchEvent(
+      new CustomEvent("aios:share-open", {
+        detail: { kind: "field", id: shareOid, label: field.label },
+      })
+    );
+  };
+
+  /**
+   * ⭐⭐ W39-T17 / R8 — MAY THIS VIEWER DELETE THIS COLUMN? The client half of the server's wall,
+   * spelled with the SAME comparison `canPermissions` above already uses rather than a second
+   * one: `createdBy` is a login username while the people picker deals in display names
+   * ([[login-resolves-email-writes-do-not]]), and one spelling means a mismatch lands identically
+   * in both places instead of differently in each.
+   *
+   * ⛔ THE UNSTAMPED CASE ANSWERS "YES" ON PURPOSE, and it is a deliberate under-reach.
+   * `routes_tables.delete_shared_field` reads `owner = str(defn.get("createdBy") or "")` and
+   * refuses a non-admin when it is blank, so an UNSTAMPED shared column is really admin-only. But
+   * the client cannot tell one from a base Odoo column, which carries no `createdBy` either and
+   * is deletable by nobody at all — firing there would put a refusal on every source field on the
+   * grid. So the sentence appears only where the client can NAME the person, which is the only
+   * shape in which it is useful.
+   * ⚠ IT DOES NOT DISABLE THE DELETE BUTTON, AND THE REASON IS THE `viewer === undefined` LEG,
+   * not the stratum. The predicate can only fire where `createdBy` is stamped and differs from
+   * the viewer, which IS the server-walled path — so "a `custom_` delete is client-side" would be
+   * a rationale describing a case that never reaches here. What does reach here is a host that
+   * supplied no `viewer` (the payload's field is optional): `mayDeleteField` then answers false
+   * for the column's OWN CREATOR, and a disable on that would take a delete away from the one
+   * person who certainly has it. Fail-closed is right for a SENTENCE and wrong for a CONTROL.
+   * ⚠ So a `ut_*` link/rollup/formula created by somebody else shows this line WITH a live Delete
+   * button beside it, and that button 403s. Stated rather than hidden: the server is the wall,
+   * this is the courtesy half, and narrowing the button is a separate decision.
+   */
+  const deleteOwner = (field.createdBy ?? "").trim();
+  const mayDeleteField =
+    !deleteOwner || (!!viewer && (viewer.isAdmin || deleteOwner === viewer.name));
+
   return (
     <AnchoredOverlay
       anchor={state.anchor}
@@ -3865,6 +3955,52 @@ export default function ColumnMenu({
           </button>
         )}
 
+        {/* ⭐⭐ W39-T17 — SHARE FIELD, directly beneath Edit field, and it opens the SAME dialog
+            views and folders already use (one editor, one vocabulary: the R10 ruling behind
+            `shell/ShareDialog.tsx`). NOT gated on `schemaLocked`: sharing a column changes no
+            schema, it decides who can SEE it, which is the same reason Summary, Sort and Filter
+            sit below without that gate.
+            ⛔ NO `data-overlay-autofocus` HERE. The overlay's `initialFocus` selector is exactly
+            that attribute, and a second row wearing it makes the opening focus ambiguous.
+            ⛔ NOT GATED ON THE VIEWER EITHER, deliberately. The dialog itself states the refusal
+            when `mayAdminister` is false ("NOT A HIDDEN EDITOR — a stated refusal"), and a hidden
+            row would leave a collaborator guessing why the column they can see is not theirs to
+            pass on. The one thing that DOES withdraw it is a missing server table key, because
+            without one the id cannot be built. */}
+        {shareOid && (
+          <button
+            type="button"
+            onClick={() => {
+              openFieldShare();
+              onClose();
+            }}
+          >
+            {/* ⛔ AN INLINE NODE, NOT A `MenuIcon` NAME, and that is forced rather than chosen.
+                `MenuLabel`'s prop is `MenuIconName | ReactNode` and `ReactNode` admits any
+                string, so `icon="share"` would COMPILE and paint an empty 16px box forever
+                (`MENU_ICONS` has no such key, and `icons.tsx` is not this ticket's file). The
+                three-node graph is the mark every product uses for this verb; borrowing the
+                padlock that "Edit field permissions" already wears below would put two identical
+                glyphs on two different questions. */}
+            <MenuLabel
+              icon={
+                <svg width={16} height={16} viewBox="0 0 16 16" fill="none" aria-hidden>
+                  <circle cx="12" cy="3.6" r="1.9" stroke="currentColor" strokeWidth={1.3} />
+                  <circle cx="4" cy="8" r="1.9" stroke="currentColor" strokeWidth={1.3} />
+                  <circle cx="12" cy="12.4" r="1.9" stroke="currentColor" strokeWidth={1.3} />
+                  <path
+                    d="m5.75 7.1 4.5-2.6M5.75 8.9l4.5 2.6"
+                    stroke="currentColor"
+                    strokeWidth={1.3}
+                    strokeLinecap="round"
+                  />
+                </svg>
+              }
+              text="Share field"
+            />
+          </button>
+        )}
+
         <div className="cg-menu-sep" role="separator" aria-hidden />
 
         {/* Group 1 — Duplicate · Insert left · Insert right (+ Add at end, same family). */}
@@ -4062,6 +4198,30 @@ export default function ColumnMenu({
             />
           </button>
         )}
+        {/* ⭐⭐ W39-T17 / R8 — A FIELD YOU CANNOT DELETE SAYS WHO CAN, which nothing in this menu
+            did: the only place a creator was ever named is the permissions pane's parenthetical
+            `(created by X)`, which a person has to open a different window to read.
+            `routes_tables.delete_shared_field` refuses everyone but the stamped `createdBy` and
+            an admin, and it refuses at the SERVER — so without this the menu either hides the row
+            with no reason given or offers a button whose only outcome is a 403.
+            ⛔ NOT A `MenuLabel` ROW, and the reason is measured in `index.css`:
+            `.cg-column-actions button` is `white-space: nowrap` and `.cg-mi-text` ellipsises, so
+            a sentence in a menu row would render as "Only alice or an administr…" — the half that
+            names the person is exactly the half that gets cut. `.cg-field-hint` is this file's
+            existing wrapping prose class (36 uses), so no rule is owed in a stylesheet this
+            ticket does not own.
+            ⛔ NO DASH IN IT (standing rule 2): the nearest precedent, `ShareDialog`'s own
+            refusal, carried two em dashes, and copying its shape is how the dash travels. */}
+        {!mayDeleteField && (
+          /* ⚠ The 8px inset is INLINE because it is the only thing this row needs from a
+             stylesheet and `index.css` is not this ticket's file. `.cg-column-actions` has no
+             horizontal padding of its own (its BUTTONS carry `0 8px`), so a bare hint would sit
+             8px left of every label above it and read as belonging to the panel rather than to
+             the Delete row it explains. */
+          <p className="cg-field-hint" style={{ padding: "2px 8px 4px" }}>
+            Only {deleteOwner} or an administrator can delete this field.
+          </p>
+        )}
       </div>
     </AnchoredOverlay>
   );

web/src/customer-grid/CustomerGrid.tsx

@@ -12,6 +12,8 @@ import type {
   CellClickedEventArgs,
   DataEditorRef,
   EditableGridCell,
+  GridCell,
+  GridColumn,
   GridKeyEventArgs,
   GridMouseEventArgs,
   GridSelection,
@@ -131,6 +133,7 @@ import { DashboardView } from "../viz/DashboardView";
 import { cleanCharts } from "../viz/chartData";
 import type { ChartSpec } from "../viz/chartData";
 import { MapView } from "./MapView";
+import { googleDirectionsUrl, isPlottable } from "./mapProjection";
 /* ═══ W18-C CATALOG ═══ (owner item 4, contract C6) */
 import { CatalogView } from "./CatalogView";
 import { CATALOG_CODE_FIELD } from "./catalogData";
@@ -212,6 +215,24 @@ export const GRID_CHAT_OPEN_EVENT = "aios:grid-chat-open";
 
 const ROW_PX: Record<RowHeightMode, number> = { short: 28, medium: 34, tall: 48 };
 
+/**
+ * W39-T22 — a transport action, not a stored field. Coordinates already travel on every
+ * customer row for MapView, but deliberately are not columns. Keeping this synthetic column out
+ * of the workspace means a person cannot hide, reorder, rename, or accidentally persist it as
+ * though it were customer data.
+ */
+const DIRECTIONS_COLUMN_ID = "__directions__";
+const DIRECTIONS_COLUMN: GridColumn = { id: DIRECTIONS_COLUMN_ID, title: "Go", width: 46 };
+
+/** `null` means there is no honest Google destination, including a blank-address row. */
+function directionsFor(row: Row): { lat: number; lon: number } | null {
+  const lat = row.lat;
+  const lon = row.lon;
+  return typeof lat === "number" && typeof lon === "number" && isPlottable(lat, lon)
+    ? { lat, lon }
+    : null;
+}
+
 /**
  * Wave-14 R7 — **a button label is ONE LINE.** Every button row in this file is a flex row with
  * no width reservation, so on a narrow grid box the items shrink and their labels wrap:
@@ -1637,6 +1658,12 @@ function CustomerGridSurface({
     setColumnVisible,
     insertColumn,
   } = useGridColumns(fields, config, updateConfig);
+  // W39-T22 — the transit link is an action, so it is appended to what Glide paints without
+  // joining the saved-view column contract. `onCellClicked` below is the one tap door.
+  const gridColumns = useMemo(
+    () => scope === "customer" ? [...visibleCols, DIRECTIONS_COLUMN] : visibleCols,
+    [scope, visibleCols]
+  );
 
   /**
    * ⭐ Wave-20 owner item 4 (ruling R8, contract C-ADDROW) — **THE GHOST ROW.**
@@ -2653,7 +2680,7 @@ function CustomerGridSurface({
     return () => window.clearInterval(id);
   }, [pendingMeasureKeys]);
   const activePendingKeys = pendingGaveUp ? NO_PENDING_KEYS : pendingMeasureKeys;
-  const getCellContent = useGetCellContent(
+  const baseGetCellContent = useGetCellContent(
     displayRows,
     visibleCols,
     fieldByKey,
@@ -2666,12 +2693,39 @@ function CustomerGridSurface({
     activePendingKeys,
     pulse
   );
+  const getCellContent = useCallback(
+    (cell: Item): GridCell => {
+      if (scope !== "customer" || cell[0] !== visibleCols.length) return baseGetCellContent(cell);
+      const row = displayRows[cell[1]];
+      const at = row?.kind === "data" ? directionsFor(row.record) : null;
+      // A blank cell is deliberately not a disabled-looking `Go`: there is no destination to
+      // offer, and a row whose address is blank must not acquire a plausible link to nowhere.
+      if (!at) {
+        return {
+          kind: GridCellKind.Text,
+          data: "",
+          displayData: "",
+          allowOverlay: false,
+          readonly: true,
+        };
+      }
+      return {
+        kind: GridCellKind.Uri,
+        data: googleDirectionsUrl(at.lat, at.lon),
+        displayData: "Go",
+        allowOverlay: false,
+        readonly: true,
+        hoverEffect: true,
+      };
+    },
+    [baseGetCellContent, displayRows, scope, visibleCols.length]
+  );
   const { gridSelection, selectedPids, onGridSelectionChange, selectPids, togglePid,
           setActiveCell, clearSelection } =
     useGridSelection(
       displayRows,
       displayPidToIndex,
-      visibleCols.length,
+      gridColumns.length,
       embeddedSelectable ? embeddedSelectedIds : []
     );
   const embeddedSelectedKey = embeddedSelectedIds.join(",");
@@ -3721,6 +3775,16 @@ function CustomerGridSurface({
         });
         return;
       }
+      // W39-T22 — Glide paints links on its canvas, so this handler is the ACTUAL touch door.
+      // The Go cell is virtual and always trails the persisted columns; no address-derived string
+      // is used here because coordinates, not an address search, are what the map plotted.
+      if (scope === "customer" && row.kind === "data" && cell[0] === visibleCols.length) {
+        const at = directionsFor(row.record);
+        if (!at) return;
+        event.preventDefault();
+        window.open(googleDirectionsUrl(at.lat, at.lon), "_blank", "noopener,noreferrer");
+        return;
+      }
       const column = visibleCols[cell[0]];
       const field = column ? fieldByKey.get(column.id!) : undefined;
       // A picked field (select / assignee) opens its choices where the cell is. It cannot use
@@ -3785,7 +3849,7 @@ function CustomerGridSurface({
               : null;
           if (href) {
             event.preventDefault();
-            window.open(href, "_blank", "noopener");
+            window.open(href, "_blank", "noopener,noreferrer");
             return;
           }
         }
@@ -3809,7 +3873,7 @@ function CustomerGridSurface({
       // open a record; the hover Expand button below is its replacement, and half of this
       // change is a table whose records cannot be opened at all.
     },
-    [displayRows, visibleCols, fieldByKey, canEditField, overlayEdits, lockedKey, togglePid,
+    [displayRows, visibleCols, scope, fieldByKey, canEditField, overlayEdits, lockedKey, togglePid,
      setActiveCell]
   );
   /**
@@ -3931,6 +3995,25 @@ function CustomerGridSurface({
     },
     [embedded, visibleCols]
   );
+  const onGridColumnResize = useCallback(
+    (column: GridColumn, newSize: number) => {
+      if (column.id === DIRECTIONS_COLUMN_ID) return;
+      onColumnResize(column, newSize);
+    },
+    [onColumnResize]
+  );
+  const onGridColumnMoved = useCallback(
+    (from: number, to: number) => {
+      if (from >= visibleCols.length || to >= visibleCols.length) return;
+      onColumnMoved(from, to);
+    },
+    [onColumnMoved, visibleCols.length]
+  );
+  const onGridColumnProposeMove = useCallback(
+    (from: number, to: number) =>
+      from < visibleCols.length && to < visibleCols.length && onColumnProposeMove(from, to),
+    [onColumnProposeMove, visibleCols.length]
+  );
   const onHeaderClicked = useCallback(
     (column: number, event: HeaderClickedEventArgs) => {
       if (event.isEdge) return;
@@ -6802,7 +6885,7 @@ function CustomerGridSurface({
             <>
             <DataEditor
               ref={gridRef}
-              columns={visibleCols}
+              columns={gridColumns}
               getCellContent={getCellContent}
               rows={displayRows.length}
               theme={lightTheme}
@@ -6863,9 +6946,9 @@ function CustomerGridSurface({
               // `false` from here takes the write over from glide's per-cell path.
               onDelete={onGridDelete}
               validateCell={validateCell}
-              onColumnResize={onColumnResize}
-              onColumnMoved={onColumnMoved}
-              onColumnProposeMove={onColumnProposeMove}
+              onColumnResize={onGridColumnResize}
+              onColumnMoved={onGridColumnMoved}
+              onColumnProposeMove={onGridColumnProposeMove}
               drawHeader={drawGridHeader}
               onHeaderMenuClick={(column, bounds) => openHeaderMenu(column, bounds)}
               onHeaderClicked={onHeaderClicked}
@@ -7804,6 +7887,21 @@ function CustomerGridSurface({
           onClearGroup={() => updateConfig({ ...config, groupBy: null })}
           userOptions={payload?.userOptions ?? []}
           measures={measures}
+          /* ⭐⭐ W39-T17 — THE TABLE HALF OF A FIELD SHARE'S OID, and it is deliberately NOT the
+             `storageKey` const above. That one carries two spellings the share door cannot use:
+             the query-preview key (`query:<binding>`, a projection rather than this database's
+             own columns) and the local fallback `${LOCAL_KEY_PREFIX}${scope}`, which this file's
+             own note at the declaration calls "a key the server never issues".
+             ⛔ AND THE FALLBACK IS THE DANGEROUS ONE, not merely the untidy one:
+             `core.shares.split_field_oid` fails closed on an id it cannot resolve,
+             `routes_shares._object_ref` answers `route=None`, and `_notify_new_grantees` returns
+             early — the grant lands and the receiver is NEVER TOLD. So this reads the SERVER's
+             key directly and passes `undefined` when there is none, which withdraws the Share
+             row rather than offering one that resolves to nothing.
+             ⚠ Only this instance takes it. The "+" render below opens straight into the create
+             form and never paints the action list, so the row it feeds is unreachable there —
+             unlike `linkTargets`, which both create paths genuinely need. */
+          tableKey={isQueryPreview ? undefined : payload?.workspace?.storageKey}
         />
       )}
 

web/src/customer-grid/MapView.tsx

@@ -144,6 +144,14 @@ const R_MIN = 3.2;
 const R_MAX = 15;
 const R_PLAIN = 4.5;
 const R_NULL = 2.6;
+/** A synthetic route-only id. Odoo record ids are positive, so zero cannot become a customer. */
+const DEPOT_PID = 0;
+
+interface RouteDepot {
+  address: string;
+  lat: number;
+  lon: number;
+}
 
 /**
  * The pin palette: C1's cycle (blue -> green -> yellow -> red) then its
@@ -258,6 +266,9 @@ export function MapView({
    * hands it back. Kept as pids rather than indices because the selection can change underneath it.
    */
   const [routeOrder, setRouteOrder] = useState<number[] | null>(null);
+  /** The optional origin belongs to a saved visit-order field, never to a customer row. */
+  const [depotAddress, setDepotAddress] = useState("");
+  const [depot, setDepot] = useState<RouteDepot | null>(null);
   /**
    * W37-T36 — the ROAD answer, which is the half arithmetic cannot produce.
    *
@@ -286,7 +297,7 @@ export function MapView({
    * must not render "no saved orders".
    */
   const [routeCols, setRouteCols] = useState<
-    { key: string; label: string; inputsHash: string; mine: boolean }[] | null
+    { key: string; label: string; inputsHash: string; mine: boolean; depot?: RouteDepot | null }[] | null
   >(null);
   /** Which saved column a save writes to. `""` = a new one, named by `saveName`. */
   const [saveTarget, setSaveTarget] = useState("");
@@ -560,7 +571,7 @@ export function MapView({
 
   /** Selected pins that can actually be routed, in a STABLE order (by pid) —
    *  a Set's iteration order must not be what decides a route. */
-  const routable = useMemo(
+  const customerRoutable = useMemo(
     () =>
       selectedPids.size < 2
         ? []
@@ -569,9 +580,28 @@ export function MapView({
             .sort((a, b) => a.pid - b.pid),
     [points, selectedPids]
   );
+  /** The depot joins BOTH index-parallel arrays below at position zero, and only there. */
+  const depotPoint = useMemo((): MapPoint | null => {
+    if (!depot || !isPlottable(depot.lat, depot.lon)) return null;
+    return {
+      pid: DEPOT_PID,
+      title: "Depot",
+      p: project(depot.lat, depot.lon),
+      lat: depot.lat,
+      lon: depot.lon,
+      colorKey: null,
+      size: null,
+      colorVal: null,
+      sizeVal: null,
+    };
+  }, [depot]);
+  const routable = useMemo(
+    () => depotPoint ? [depotPoint, ...customerRoutable] : customerRoutable,
+    [depotPoint, customerRoutable]
+  );
   /** Selected records with no usable coordinate. Counted and shown, never
    *  folded silently into the stop total ([[no-unverifiable-aggregates]]). */
-  const unroutable = selectedPids.size - routable.length;
+  const unroutable = selectedPids.size - customerRoutable.length;
 
   /** Selected records with no usable coordinate, BY NAME. W37-T36: the chip used to give a bare
    *  count, which tells you that something is missing and not which visit you are about to fail to
@@ -581,24 +611,26 @@ export function MapView({
     // ⚠ Read from `rows` and NOT from `points`: a record with no coordinate never becomes a point
     // in the first place, so filtering the pin list for unplottable pins finds exactly nothing.
     // That mistake would have shipped a chip whose count said 4 and whose names said none.
-    const ok = new Set(routable.map((p) => p.pid));
+    const ok = new Set(customerRoutable.map((p) => p.pid));
     return rows
       .filter((r) => selectedPids.has(r.pid) && !ok.has(r.pid))
       .map((r) => String(r[field.key] ?? "").trim() || `#${r.pid}`);
-  }, [rows, field.key, selectedPids, routable]);
+  }, [rows, field.key, selectedPids, customerRoutable]);
 
   const plan = useMemo(() => {
-    if (!routeOn || routable.length < 2) return null;
+    if (!routeOn || customerRoutable.length < 2) return null;
     const stops: GeoStop[] = routable.map((p) => ({ lat: p.lat, lon: p.lon }));
     // Default origin: the WESTERNMOST stop. Deterministic, stable while the user
     // pans, and sayable out loud — unlike "whatever ended up at index 0". The
     // picker below overrides it.
     let start = 0;
-    for (let i = 1; i < routable.length; i++)
-      if (routable[i].lon < routable[start].lon) start = i;
-    if (routeStartPid != null) {
-      const i = routable.findIndex((p) => p.pid === routeStartPid);
-      if (i >= 0) start = i;
+    if (!depotPoint) {
+      for (let i = 1; i < routable.length; i++)
+        if (routable[i].lon < routable[start].lon) start = i;
+      if (routeStartPid != null) {
+        const i = routable.findIndex((p) => p.pid === routeStartPid);
+        if (i >= 0) start = i;
+      }
     }
     const { order, km } = planRoute(stops, haversineKm, { start, roundTrip });
     // ⭐⭐ W38-T20 — THE HAND-REORDER STAYS IN **INDEX** SPACE, and that is a deliberate change of
@@ -616,12 +648,18 @@ export function MapView({
     // selected. Anything the user has since deselected drops out; anything newly selected is
     // appended in the planner's own order rather than being silently left off the route.
     if (routeOrder) {
-      const idxByPid = new Map(routable.map((p, i) => [p.pid, i]));
+      const idxByPid = new Map(
+        routable.filter((p) => p.pid !== DEPOT_PID).map((p, i) => [p.pid, depotPoint ? i + 1 : i])
+      );
       const picked = routeOrder
         .map((pid) => idxByPid.get(pid))
         .filter((i) => i !== undefined) as number[];
       const seen = new Set(picked);
-      seq = [...picked, ...order.filter((i) => !seen.has(i))];
+      seq = [
+        ...(depotPoint ? [0] : []),
+        ...picked,
+        ...order.filter((i) => !seen.has(i) && (!depotPoint || i !== 0)),
+      ];
     }
     const ordered = seq.map((i) => routable[i]);
     // ⛔⛔ THE PERMUTATION IS NOT THE RANK (A25 / A44). `seq[i]` is WHICH STOP is visited i-th;
@@ -636,7 +674,7 @@ export function MapView({
       /** `{pid: visit number}` — what the route-order COLUMN stores, one integer per record. */
       ranksByPid: routable.reduce((acc, p, i) => {
         const n = ranks[i];
-        if (n != null) acc[p.pid] = n;
+        if (p.pid !== DEPOT_PID && n != null) acc[p.pid] = depotPoint ? n - 1 : n;
         return acc;
       }, {} as Record<number, number>),
       /**
@@ -650,20 +688,24 @@ export function MapView({
         // default applies, so keying on it would report STALE the moment somebody explicitly
         // selects the stop that was ALREADY the origin — the numbers unchanged, the marker on.
         // What the answer depends on is which stop the planner was actually given.
-        { roundTrip, startPid: routable[start].pid, handOrder: routeOrder }
+        { roundTrip, startPid: depotPoint ? null : routable[start].pid, handOrder: routeOrder }
       ),
       /** The origin the planner was given, so the saved column records the same one the
        *  fingerprint was taken over. */
-      startPid: routable[start].pid,
+      startPid: depotPoint ? null : routable[start].pid,
       link: googleRouteUrl(
         ordered.map((p) => ({ lat: p.lat, lon: p.lon })),
         { roundTrip, coarsePointer }
       ),
       /** The identity of THIS set of stops in THIS order. The road answer is only about the plan
        *  whose key it carries; anything else on screen makes it stale rather than wrong. */
-      key: ordered.map((p) => p.pid).join(",") + (roundTrip ? "|rt" : ""),
+      key: ordered.map((p) => `${p.pid}@${p.lat.toFixed(6)},${p.lon.toFixed(6)}`).join(",") +
+        (roundTrip ? "|rt" : ""),
+      depot: depotPoint ? depot : null,
+      customerStops: customerRoutable.length,
     };
-  }, [routeOn, routable, roundTrip, routeStartPid, coarsePointer, routeOrder]);
+  }, [routeOn, routable, customerRoutable.length, depotPoint, depot, roundTrip, routeStartPid,
+      coarsePointer, routeOrder]);
 
   const roadStale = !!road && !!plan && road.key !== plan.key;
 
@@ -790,6 +832,7 @@ export function MapView({
           inputsHash: plan.fingerprint,
           roundTrip,
           startPid: plan.startPid,
+          depot: plan.depot,
         }),
       });
       const body = await res.json().catch(() => null);
@@ -916,10 +959,52 @@ export function MapView({
     }
   }, [coordField, onGeocoded, geocodable, geoBatch]);
 
+  /** The depot has no row, so it uses the address-list form of the same bounded lookup and wait. */
+  const runDepotGeocode = useCallback(async () => {
+    const address = depotAddress.trim();
+    if (!address) return;
+    setGeo({ busy: true, done: 0, total: 1, found: 0, error: null });
+    setSaveErr(null);
+    try {
+      const res = await fetch("/api/v1/geo/geocode", {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          addresses: [{ key: "depot", address }],
+          country: coordField?.geocode?.country,
+        }),
+      });
+      const body = await res.json().catch(() => null);
+      if (!res.ok) {
+        setGeo((g) => ({
+          ...g,
+          busy: false,
+          error: (body && body.detail && body.detail.error && body.detail.error.message) ||
+            "The depot address lookup did not answer.",
+        }));
+        return;
+      }
+      const result = (body?.results || []).find(
+        (r: { key?: string; found?: boolean; lat?: number; lon?: number }) => r?.key === "depot"
+      );
+      if (result?.found && isPlottable(Number(result.lat), Number(result.lon))) {
+        setDepot({ address, lat: Number(result.lat), lon: Number(result.lon) });
+        setGeo({ busy: false, done: 1, total: 1, found: 1, error: null });
+      } else {
+        setDepot(null);
+        setGeo({ busy: false, done: 1, total: 1, found: 0, error: null });
+        setSaveErr("The depot address could not be located. Check it and try again.");
+      }
+    } catch {
+      setGeo((g) => ({ ...g, busy: false, error: "The depot address lookup could not be reached." }));
+    }
+  }, [depotAddress, coordField]);
+
   const moveStop = useCallback(
     (pid: number, delta: number) => {
-      if (!plan) return;
-      const ids = plan.ordered.map((p) => p.pid);
+      if (!plan || pid === DEPOT_PID) return;
+      const ids = plan.ordered.filter((p) => p.pid !== DEPOT_PID).map((p) => p.pid);
       const at = ids.indexOf(pid);
       const to = at + delta;
       if (at < 0 || to < 0 || to >= ids.length) return;
@@ -1357,20 +1442,21 @@ export function MapView({
                   setRouteOrder(null);
                   askRoadRef.current = true;
                 }}
-                disabled={routable.length < 2}
+                disabled={customerRoutable.length < 2}
                 title={
-                  routable.length < 2
+                  customerRoutable.length < 2
                     ? "At least two selected records need a location to plan a route"
                     : "Order these stops into a route"
                 }
               >
-                Plan route ({routable.length.toLocaleString()} stops)
+                Plan route ({customerRoutable.length.toLocaleString()} stops)
               </button>
             ) : (
               plan && (
                 <>
                   <span className="cg-map-route-sum">
-                    <strong>{plan.ordered.length.toLocaleString()}</strong> stops ·{" "}
+                    <strong>{plan.customerStops.toLocaleString()}</strong> visits
+                    {plan.depot ? " + depot" : ""} ·{" "}
                     {/* ⭐ W37-T36 — THE ROAD ANSWER REPLACES THE STRAIGHT LINE WHEN WE HAVE ONE,
                         and the old caveat goes with it. The note underneath used to read
                         "straight-line, not driving distance", which was the honest thing to say
@@ -1408,6 +1494,33 @@ export function MapView({
                     </button>
                   )}
                   {roadErr && <span className="cg-cal-nodate">{roadErr}</span>}
+                  <label className="cg-map-route-opt">
+                    Depot address
+                    <input
+                      type="text"
+                      className="cg-map-route-start"
+                      value={depotAddress}
+                      placeholder="Optional route start"
+                      aria-label="Depot address for this visit order"
+                      maxLength={200}
+                      onChange={(e) => {
+                        setDepotAddress(e.target.value);
+                        setDepot(null);
+                        setRouteStartPid(null);
+                      }}
+                    />
+                  </label>
+                  <button
+                    type="button"
+                    className="cg-map-route-go"
+                    disabled={geo.busy || !depotAddress.trim()}
+                    onClick={() => void runDepotGeocode()}
+                    title="Look up this depot once before saving the visit order"
+                  >
+                    {geo.busy ? `Looking up depot: ${geo.done} of ${geo.total}` : "Look up depot"}
+                  </button>
+                  {depot && <span className="cg-map-route-note">Starts at the saved depot.</span>}
+                  {!plan.depot && (
                   <label className="cg-map-route-opt">
                     Start
                     {/* ⚠ `value` is always set — a <select> without one renders its
@@ -1425,6 +1538,8 @@ export function MapView({
                       ))}
                     </select>
                   </label>
+                  )}
+                  {plan.depot && <span className="cg-map-route-note">Start: depot</span>}
                   <label className="cg-map-route-opt">
                     <input
                       type="checkbox"
@@ -1444,7 +1559,9 @@ export function MapView({
                       {/* The free URL takes 9 waypoints on desktop and 3 on a
                           phone. When the route is longer, SAY which part rides. */}
                       {plan.link.used < plan.ordered.length &&
-                        ` (first ${plan.link.used} of ${plan.ordered.length})`}
+                        (plan.depot
+                          ? ` (depot plus first ${plan.link.used - 1} of ${plan.customerStops} visits)`
+                          : ` (first ${plan.link.used} of ${plan.customerStops} visits)`)}
                     </a>
                   )}
                   {/* ⭐ W37-T36 — THE ORDER IS CHANGEABLE, and it has to be more than the Start
@@ -1455,12 +1572,15 @@ export function MapView({
                   <span className="cg-map-stoplist">
                     {plan.ordered.map((p, i) => (
                       <span className="cg-map-stopitem" key={p.pid}>
-                        <span className="cg-map-stopn">{i + 1}</span>
+                        <span className="cg-map-stopn">
+                          {p.pid === DEPOT_PID ? "" : i + 1 - (plan.depot ? 1 : 0)}
+                        </span>
                         <span className="cg-map-stopname">{p.title || `#${p.pid}`}</span>
+                        {p.pid !== DEPOT_PID && <>
                         <button
                           type="button"
                           className="cg-map-stopmove"
-                          disabled={i === 0}
+                          disabled={i === (plan.depot ? 1 : 0)}
                           aria-label={`Move ${p.title || `#${p.pid}`} earlier`}
                           title="Visit this stop earlier"
                           onClick={() => moveStop(p.pid, -1)}
@@ -1477,6 +1597,7 @@ export function MapView({
                         >
                           <svg viewBox="0 0 16 16" aria-hidden="true"><path d="M5.5 3.5 10.5 8l-5 4.5" /></svg>
                         </button>
+                        </>}
                       </span>
                     ))}
                   </span>
@@ -1504,7 +1625,12 @@ export function MapView({
                       value={saveTarget}
                       aria-label="Which visit order column to write"
                       onChange={(e) => {
-                        setSaveTarget(e.target.value);
+                        const next = e.target.value;
+                        const configured = (routeCols || []).find((f) => f.key === next)?.depot || null;
+                        setSaveTarget(next);
+                        setDepot(configured);
+                        setDepotAddress(configured?.address || "");
+                        setRouteStartPid(null);
                         setSaveMsg(null);
                         setSaveErr(null);
                       }}
@@ -1537,7 +1663,8 @@ export function MapView({
                   <button
                     type="button"
                     className="cg-map-route-go"
-                    disabled={saveBusy || (!saveTarget && !saveName.trim())}
+                    disabled={saveBusy || (!!depotAddress.trim() && !plan.depot) ||
+                      (!saveTarget && !saveName.trim())}
                     onClick={() => void saveRouteOrder()}
                     title={
                       saveTarget
@@ -1827,6 +1954,7 @@ export function MapView({
               picker's job, where it is visible and reversible. */}
           {plan &&
             plan.ordered.map((p, i) => {
+              if (p.pid === DEPOT_PID) return null;
               const s = toScreen(p.p, view);
               return (
                 <g
@@ -1835,7 +1963,7 @@ export function MapView({
                   transform={`translate(${s.x.toFixed(2)} ${(s.y - 13).toFixed(2)})`}
                 >
                   <circle r={7.5} />
-                  <text textAnchor="middle" dy="3.4">{i + 1}</text>
+                  <text textAnchor="middle" dy="3.4">{i + 1 - (plan.depot ? 1 : 0)}</text>
                 </g>
               );
             })}

web/src/shell/ShareDialog.tsx

@@ -26,10 +26,17 @@ import {
 } from "./shareModel";
 import type { ShareEntry, ShareKind, ShareRole, ShareState } from "./shareModel";
 
+/**
+ * ⛔⛔ W39-T17 — THIS MAP DOES NOT DEGRADE, IT PRINTS THE WORD `undefined`. A kind with no entry
+ * renders "Share undefined" in the heading AND "no longer has this undefined" in the revoke toast:
+ * two live strings, not one. `Record<ShareKind, string>` is what stops that being a discovery —
+ * add a member to `SHARE_KINDS` without one here and `tsc` names this line.
+ */
 const KIND_WORD: Record<ShareKind, string> = {
   view: "view",
   folder: "folder",
   database: "database",
+  field: "field",
 };
 
 /** What each role MEANS on each kind, in the reader's own terms. A role picker
@@ -49,6 +56,22 @@ const ROLE_BLURB: Record<ShareKind, Record<ShareRole, string>> = {
     view: "Can open this database and read its records.",
     edit: "Can add, edit and delete its records.",
   },
+  /**
+   * ⭐⭐ W39-T17 — A COLUMN GRANT IS A VISIBILITY GRANT, AND THE BLURBS SAY ONLY THAT.
+   *
+   * ⛔ MEASURED IN THE SERVER, NOT ASSUMED. `core.perm_scope.field_grant_hidden` is the ONLY
+   * consumer of a `field`-kind grant, and it tests `role is None` — nothing else. So `view` and
+   * `edit` are the SAME capability on a column today: both lift the column out of the hidden set
+   * and neither confers value editing, which `types.mayEditField` decides from the field's OWN
+   * `permissions.edit` (everyone / creator / admins). A blurb promising "can change its values"
+   * would be a sentence the product does not honour, so the `edit` line names the real wall
+   * instead. Booked as a finding; the picker is the shared one and narrowing it is not this
+   * ticket's mandate.
+   */
+  field: {
+    view: "Can see this column on the records they can already open.",
+    edit: "Can see this column. Changing its values still follows the field's own permissions.",
+  },
 };
 
 export default function ShareDialog({
@@ -199,10 +222,23 @@ export default function ShareDialog({
             `_clean_perms` 400s the rest), so the grant registry IS the only wall and the grant
             is all-or-nothing. The audit's fix is "say so at BOTH doors"; `core/shares.py` and
             `routes_shares.py` are the other two, and this is the one a PERSON reads. */}
+        {/* ⛔ STANDING RULE 2 (D-490, W39-T17) — THIS LINE CARRIED AN EM DASH TO THE SCREEN AND
+            `verify_prose.py` SCORED THE FILE ZERO. The prose run WRAPS, and the gate's JSX pass
+            skips any run containing a newline [[web-prose-blind-to-wrapped-jsx]] — the same blind
+            spot already recorded twenty lines below. REWRITTEN, not stripped: the question the
+            dialog answers is now the sentence's subject, which needs no dash at all. */}
         <p className="shell-newdb-sub">
-          <strong>{label}</strong> — who can reach it, and what they can do with it.{" "}
+          Who can reach <strong>{label}</strong>, and what they can do with it.{" "}
           {kind === "database"
             ? "Sharing a database shares all of it: every record and every column. There is no per-row or per-column limit on a database grant."
+            : kind === "field"
+            /* ⭐⭐ W39-T17 — A COLUMN'S OWN SENTENCE, because the general one is BACKWARDS for it.
+               "Everyone here can already open the surface it lives on" is true of the DATABASE and
+               false of the column: `routes_tables.patch_shared_cell` stamps every grid-created
+               shared column `granted: True`, and `perm_scope.field_grant_hidden` then strips it
+               from every payload but its creator's and an admin's. So this door is not a widening
+               of something already visible, it is the ONLY way anybody else sees the column. */
+            ? "A shared column starts out hidden from everybody else on this database. This is what lets the people you choose see it and its values."
             : "Sharing never widens past this workspace: everyone here can already open the surface it lives on."}
         </p>
 
@@ -313,7 +349,21 @@ export default function ShareDialog({
                     setEntries(next);
                     void save(next).then((ok) => {
                       if (ok) {
-                        onToast(`${nameOf(pick)} can now ${pickRole} this ${KIND_WORD[kind]}.`);
+                        onToast(
+                          /* ⛔⛔ W39-T17 — THE ROLE MUST NOT BE READ BACK AS A CAPABILITY ON A
+                             COLUMN. Interpolated blind, this said "alice can now edit this
+                             field", and that is false: `core.perm_scope.field_grant_hidden` is
+                             the only consumer of a field grant and it tests `role is None`, so
+                             both roles buy the SAME thing (the column stops being hidden) and
+                             neither one lets anybody write a cell — `types.mayEditField` decides
+                             that from the field's own `permissions.edit`. A toast is the one
+                             sentence a person reads after granting, so it is the worst place to
+                             promise a capability the product does not honour. It names the
+                             visibility that actually changed instead. See `ROLE_BLURB.field`. */
+                          kind === "field"
+                            ? `${nameOf(pick)} can now see this field.`
+                            : `${nameOf(pick)} can now ${pickRole} this ${KIND_WORD[kind]}.`
+                        );
                         setPick("");
                       }
                     });
@@ -351,8 +401,13 @@ export default function ShareDialog({
               // change this object's CONTENT still cannot change who else reaches
               // it (the server's rule; this is the courtesy half). Saying why beats
               // greying three controls and letting the reader guess.
+              // ⛔ STANDING RULE 2 (W39-T17) — TWO em dashes, live on screen, and `verify_prose`
+              // green over both for the wrapped-JSX reason recorded above. NOT a pre-existing
+              // violation this ticket may leave alone: adding `field` to `KIND_WORD` is what
+              // brings this sentence to a NEW surface, so it ships the dash rather than merely
+              // inheriting it. Rewritten with the owner in the subject, so no aside is needed.
               <p className="shell-share-note">
-                Only the owner of this {KIND_WORD[kind]} — or an administrator — can change who
+                Only this {KIND_WORD[kind]}'s owner and workspace administrators can change who
                 it is shared with. You can still use it as your role allows.
               </p>
             )}

web/src/shell/shareModel.ts

@@ -20,8 +20,22 @@
 // dialog is a renderer over these functions and decides nothing.
 // ---------------------------------------------------------------------------
 
-/** The three shareable kinds. Closed vocabulary: the server 400s anything else. */
-export const SHARE_KINDS = ["view", "folder", "database"] as const;
+/**
+ * The FOUR shareable kinds. Closed vocabulary: the server 400s anything else — and
+ * `parseShareRequest` below fail-closes on a kind this tuple does not carry, so a missing member
+ * is a dialog that NEVER OPENS rather than one that opens and then 400s on save.
+ *
+ * ⭐⭐ W39-T17 — `field` IS THE FOURTH, mirroring `core.shares.KINDS` (the server grew it in
+ * W38-T16; `routes_shares._owns_object` and `._object_ref` both carry the branch already).
+ *
+ * ⛔⛔ A FIELD OID IS `"<table_key>:<field_key>"`, NEVER A BARE COLUMN KEY, and getting that wrong
+ * is SILENT. `core.shares.split_field_oid` fails closed to `(None, None)` on a bare key;
+ * `routes_shares._object_ref` then answers `route=None` and `_notify_new_grantees` RETURNS EARLY —
+ * so the grant lands and nobody is ever told about it. The emitter (`customer-grid/ColumnMenu.tsx`)
+ * builds the pair from the SERVER-issued `workspace.storageKey` and renders no Share row at all
+ * when it has none, because the local fallback key is one the server never issued.
+ */
+export const SHARE_KINDS = ["view", "folder", "database", "field"] as const;
 export type ShareKind = (typeof SHARE_KINDS)[number];
 
 /** The two roles, the same two words the view rail already speaks (R10). */