Spaces:

fsanyoto
/

loopable

Running

@@ -10,6 +10,7 @@ epoch-revoked, or naming an unknown tenant → **401**. Authenticated but not gr
 **403**. Never an empty 200: an empty list is a legitimate answer meaning "no rows", and using it
 to mean "you are not allowed" is how a permission bug becomes invisible.
 """
 import os
 import sys
 import time
@@ -68,6 +69,382 @@ class Session:
                       f"this workspace does not include {module_key}")
 def _user_for(claims):
     """The account named by a verified cookie, or None — with the epoch check that makes a
     stateless cookie revocable.

 **403**. Never an empty 200: an empty list is a legitimate answer meaning "no rows", and using it
 to mean "you are not allowed" is how a permission bug becomes invisible.
 """
+import copy
 import os
 import sys
 import time
                       f"this workspace does not include {module_key}")
+# ── Assistant: app-stored, permissioned snapshot boundary (W33-T71 / C8) ───────────────────────
+#
+# This is deliberately an ordinary function rather than a route.  E owns the Assistant's tool
+# routes and model/provider choices; every one of those tools must come through this one boundary
+# before it can see a database.  Keeping it here gives the reader the already-verified Session and
+# prevents Query's schema-only `_target` helper from becoming an accidental data authority.
+#
+# The important absence is as much part of the contract as the code below: this module never calls
+# the Customer/Product pool builders, connector routes, provider routes, Odoo, or an environment
+# lookup from this boundary.  A cache miss is a named refusal, never permission to refresh from the
+# source of truth.  That is what "data the app already stores or serves" means in executable form.
+_ASSISTANT_BUILT_INS = {
+    "customer_data": {"label": "Odoo customers", "cache_prefix": "pool"},
+    "product_data": {"label": "Odoo products", "cache_prefix": "product_pool"},
+}
+def _assistant_refuse(status, code, message):
+    """Raise the public error shape without exposing a source implementation detail."""
+    raise err(status, code, message)
+def _assistant_tenant_allows(session: Session, database: str) -> bool:
+    """Read the served tenant catalogue without reusing the legacy account gate."""
+    tenant = getattr(getattr(session, "runtime", None), "tenant", None)
+    config = getattr(tenant, "config", None) or {}
+    modules = config.get("modules", "all") if isinstance(config, dict) else "all"
+    return modules == "all" or str(database) in {str(key) for key in (modules or ())}
+def _assistant_preflight_request(session: Session, database: str, canonical_fields,
+                                 requested_fields, filters, *, require_explicit_grant: bool):
+    """Refuse an unresolved grant, field or filter before a stored record is touched."""
+    import core.perm_scope as perm_scope
+    grant = perm_scope.assistant_entry(session.user, database)
+    if require_explicit_grant and grant is None:
+        _assistant_refuse(403, "assistant_forbidden",
+                          "your current permissions do not allow this database")
+    visible = (perm_scope.assistant_visible_fields(canonical_fields, session.user, database)
+               if grant is not None else list(canonical_fields or ()))
+    try:
+        perm_scope.validate_assistant_filter((grant or {}).get("filter"), canonical_fields)
+        _assistant_requested_fields(requested_fields, visible)
+        perm_scope.validate_assistant_filter(filters, visible)
+    except ValueError as exc:
+        _assistant_refuse(400, "assistant_bad_filter", str(exc))
+    return grant, visible
+def _assistant_cached_builtin(session: Session, database: str, requested_fields=None, filters=None):
+    """The exact in-process snapshot for one built-in database, or a loud cache-miss refusal.
+    This intentionally reads `runtime.pool_cache` directly.  Calling either route's `_pool_for`
+    would make a first Assistant request call Odoo; calling a cache helper would make a stale entry
+    refresh.  Neither is data already stored/served by this process.
+    """
+    import core.perm_scope as perm_scope
+    # Unlike an interactive grid, the Assistant has no legacy-grant compatibility path: the
+    # caller needs a declared, migrated database grant.  `may_access` retains the old wall for
+    # the grid rollout, so it is necessary but not sufficient at this boundary.
+    declared_access = perm_scope.assistant_entry(session.user, database) is not None
+    if not _assistant_tenant_allows(session, database) or not declared_access:
+        _assistant_refuse(403, "assistant_forbidden",
+                          "your current permissions do not allow this database")
+    # These are static field contracts, not the route assemblies: route assemblies can add
+    # per-user workspace state and can call a source builder.  The Assistant begins with the
+    # already-stored base rows only; resolve their grant/field/filter contract *before* the cache
+    # read so a denied field or malformed operand cannot touch a stored record.
+    import aios_grid
+    fields = aios_grid.FIELDS if database == "customer_data" else aios_grid.product_fields()
+    _assistant_preflight_request(session, database, fields, requested_fields, filters,
+                                 require_explicit_grant=True)
+    team_id, agent = perm_scope.derive_pool_scope(session.user, database)
+    cache_key = (("pool", team_id, agent) if database == "customer_data"
+                 else ("product_pool", team_id))
+    cache = getattr(session.runtime, "pool_cache", None)
+    entry = cache.get(cache_key) if isinstance(cache, dict) else None
+    if (not isinstance(entry, tuple) or len(entry) < 2
+            or not isinstance(entry[1], (list, tuple))
+            or any(not isinstance(row, dict) for row in entry[1])):
+        _assistant_refuse(409, "assistant_snapshot_unavailable",
+                          "this database has no app-stored snapshot for your current scope")
+    return list(entry[1]), [dict(field) for field in fields if isinstance(field, dict)], entry[0]
+def _assistant_user_table(session: Session, database: str, requested_fields=None, filters=None):
+    """Read a materialised user-table document after a rows-free database grant check."""
+    from core import user_tables
+    # A guessed `ut_*` key must never make `user_tables.get()` copy the tenant's rows before the
+    # table resolver refuses it.  `all_defs` can fall back to a whole-document read for older
+    # stores, so use the runtime's projection primitive directly and fail closed if it is absent.
+    # The existing `may_open` remains THE resolver; it is lent this rows-dropped document.
+    try:
+        definitions = session.runtime.get_projection('user_tables', drop=('rows',))
+    except Exception:
+        _assistant_refuse(409, "assistant_snapshot_unavailable",
+                          "this database has no readable definition snapshot")
+    if not isinstance(definitions, dict):
+        _assistant_refuse(409, "assistant_snapshot_unavailable",
+                          "this database has no readable definition snapshot")
+    definition = definitions.get(database)
+    if not isinstance(definition, dict):
+        _assistant_refuse(404, "assistant_unknown_database", "that database is not available")
+    definition_runtime = user_tables.lend(session.runtime, user_tables=definitions)
+    if not user_tables.may_open(database, session.uname, session.admin, st=definition_runtime):
+        # Deliberately no label/owner in this response: knowing a key must not become an oracle
+        # for somebody else's database.
+        _assistant_refuse(403, "assistant_forbidden",
+                          "your current permissions do not allow this database")
+    fields = [dict(field) for field in (definition.get("fields") or [])
+              if isinstance(field, dict) and field.get("key")]
+    _assistant_preflight_request(session, database, fields, requested_fields, filters,
+                                 require_explicit_grant=False)
+    # Only an admitted table may now cross the app-stored record seam.  This call still has no
+    # upstream fallback: it is the tenant's materialised document already held by the runtime.
+    table = user_tables.get(database, st=session.runtime)
+    if not isinstance(table, dict):
+        _assistant_refuse(409, "assistant_snapshot_unavailable",
+                          "this database changed before its stored snapshot could be read")
+    if not user_tables.materialises(database, st=session.runtime, defn=table):
+        # Read-through rows belong to the app's DuckDB mirror, but this fence does not own its
+        # tenant-checked query binding.  Returning an empty table would be a false answer; E must
+        # consume the mirror through its own `runtime.mirror_cursor`-guarded seam.
+        _assistant_refuse(409, "assistant_snapshot_unavailable",
+                          "this database is mirror-served and needs its materialised reader")
+    # A table's field contract was authorized from the rows-free definition.  If it changed while
+    # the materialised document was fetched, fail rather than projecting a schema that was never
+    # checked.
+    actual_fields = [dict(field) for field in (table.get("fields") or [])
+                     if isinstance(field, dict) and field.get("key")]
+    if actual_fields != fields:
+        _assistant_refuse(409, "assistant_snapshot_unavailable",
+                          "this database changed before its stored snapshot could be read")
+    raw_rows = table.get("rows") or {}
+    if not isinstance(raw_rows, dict):
+        _assistant_refuse(409, "assistant_snapshot_unavailable",
+                          "this database does not have a readable stored snapshot")
+    keys = {field["key"] for field in fields}
+    rows = []
+    for record_id, raw in raw_rows.items():
+        if not str(record_id).isdigit() or not isinstance(raw, dict):
+            continue
+        # Matches `routes_tables.scoped_pool`: user-table permission is table-level, and only
+        # declared fields cross this boundary.  `pid` is the opaque record identity required to
+        # bind a returned record to a single-source Query artefact; it is not a selectable field.
+        rows.append({"pid": int(record_id),
+                     **{key: raw.get(key) for key in keys if key in raw}})
+    rows.sort(key=lambda row: row["pid"])
+    return rows, fields, (table.get("updated") or table.get("created")), table.get("label") or database
+def _assistant_requested_fields(fields, visible_fields):
+    """Resolve an explicit field selection without turning an unknown key into an omission."""
+    by_key = {str(field.get("key")): field for field in visible_fields
+              if isinstance(field, dict) and field.get("key")}
+    if fields is None:
+        return list(by_key)
+    if not isinstance(fields, (list, tuple)):
+        _assistant_refuse(400, "assistant_bad_fields", "fields must be a list of field keys")
+    out = []
+    for raw in fields:
+        key = raw.strip() if isinstance(raw, str) else ""
+        if not key or key not in by_key or key in out:
+            _assistant_refuse(400, "assistant_unknown_field",
+                              "every requested field must be visible in this database")
+        out.append(key)
+    return out
+def assistant_read_scope(session: Session, database, fields=None, filters=None):
+    """Return a detached, permissioned snapshot for one Assistant tool call.
+    Signature (the C8 contract for E):
+        assistant_read_scope(session, database, fields, filters) -> {
+            database, label, source_kind, source_version, retrieved_at,
+            permission_scope_applied, fields, filters, records
+        }
+    `database` is exactly one source.  `fields` is an explicit list of visible field keys (or
+    ``None`` for every visible field).  `filters` is ``None`` or the strict tree accepted by
+    `core.perm_scope.validate_assistant_filter`; it rejects unknown, hidden, inactive and
+    unsupported operands before a row is read.  The returned dictionaries are deep copies, never
+    a live cache/store object, cursor, connector, route, provider, or credential.
+    """
+    import core.perm_scope as perm_scope
+    from harness import filter_eval
+    key = str(database or "").strip()
+    if key in _ASSISTANT_BUILT_INS:
+        rows, canonical_fields, source_version = _assistant_cached_builtin(session, key, fields, filters)
+        label = _ASSISTANT_BUILT_INS[key]["label"]
+        source_kind = "runtime_cache"
+    elif key.startswith("ut_"):
+        rows, canonical_fields, source_version, label = _assistant_user_table(session, key, fields, filters)
+        source_kind = "materialised_user_table"
+    else:
+        _assistant_refuse(404, "assistant_unknown_database", "that database is not available")
+    # Permanent permissions run against the full source contract.  A permission filter may name
+    # a field that is intentionally hidden from the returned schema; resolving it after the field
+    # projection would make that filter unanswerable and (depending on the evaluator) could widen.
+    # Validate even that grant before evaluating it: `permits` would deny an unknown operand row
+    # by row, but the Assistant contract requires an explicit refusal for unresolved grants.
+    grant = perm_scope.assistant_entry(session.user, key)
+    if source_kind != "materialised_user_table" and grant is None:
+        # `_assistant_cached_builtin` already made this decision before touching its cache.  Keep
+        # this guard adjacent to the field/row projection so a future source cannot forget it.
+        _assistant_refuse(403, "assistant_forbidden",
+                          "your current permissions do not allow this database")
+    try:
+        perm_scope.validate_assistant_filter((grant or {}).get("filter"), canonical_fields)
+    except ValueError as exc:
+        _assistant_refuse(400, "assistant_bad_filter", str(exc))
+    permitted_rows = (perm_scope.assistant_apply_row_scope(rows, session.user, key, canonical_fields)
+                      if grant is not None else list(rows or ()))
+    visible = (perm_scope.assistant_visible_fields(canonical_fields, session.user, key)
+               if grant is not None else list(canonical_fields))
+    selected_keys = _assistant_requested_fields(fields, visible)
+    try:
+        requested_filter = perm_scope.validate_assistant_filter(filters, visible)
+    except ValueError as exc:
+        _assistant_refuse(400, "assistant_bad_filter", str(exc))
+    if requested_filter is not None:
+        permitted_rows = [row for row in permitted_rows
+                          if filter_eval.permits(requested_filter, row, visible)]
+    records = []
+    for row in permitted_rows:
+        if not isinstance(row, dict) or row.get("pid") is None:
+            continue
+        records.append({"pid": copy.deepcopy(row["pid"]),
+                        **{field: copy.deepcopy(row.get(field)) for field in selected_keys}})
+    return {
+        "database": key,
+        "label": str(label),
+        "source_kind": source_kind,
+        "source_version": copy.deepcopy(source_version),
+        "retrieved_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+        "permission_scope_applied": True,
+        "fields": [copy.deepcopy(field) for field in visible
+                   if field.get("key") in selected_keys],
+        "filters": copy.deepcopy(requested_filter),
+        "records": records,
+    }
+def assistant_permitted_sources(session: Session, databases):
+    """Which of `databases` the caller may still read — WITHOUT reading one record.
+    ⛔ THIS EXISTS BECAUSE `GET /query` LISTS ARTEFACTS, AND AN ARTEFACT IS NOT A READ.
+    `routes_query._public_state` has to drop every saved view whose source the caller has since
+    lost.  The obvious way to ask that question is `assistant_read_scope(..., fields=[])` — and it
+    is the wrong one: for a `ut_*` source that call runs `user_tables.get()`, i.e. a WHOLE-DOCUMENT
+    read of the tenant store (measured at **28.6 MB / 703 ms warm on tenant #0**, and 99.9% of those
+    bytes are `rows` this question does not look at), then projects every row down to its `pid` and
+    throws the result away.  Once per saved view, up to `MAX_ARTIFACTS = 200` of them, on a route
+    that BOTH the Assistant and Query call on mount.  That is `/nav`'s old 1+N whole-document read
+    (D-175, an 11.0 s median) rebuilt inside a new route, and every fixture with two artefacts
+    passes it [[measure-the-real-call]].
+    So this asks the permission question and ONLY the permission question:
+      * the rows-free `user_tables` projection is read at most ONCE for the whole batch, and lent
+        to `may_open` exactly as `_assistant_user_table` lends it;
+      * a built-in resolves from the tenant catalogue and the declared grant, with no `pool_cache`
+        read — a cache MISS is a data-availability fact, not a permission one, and refusing to list
+        an artefact because its snapshot is cold would silently delete the user's history from the
+        rail every time the process restarted [[empty-answer-vs-unfinished-answer]].
+    ⚠ It is deliberately NOT a second permission wall. Every predicate here is the same call
+    `assistant_read_scope` makes for the same source; nothing may be admitted here that the read
+    boundary would refuse, which is what `verify_query.py` asserts in both directions.
+    """
+    return {key for key, row in assistant_source_status(session, databases).items()
+            if row["permitted"]}
+def assistant_source_status(session: Session, databases=None):
+    """`{key: {permitted, answerable, reason}}` — WITHOUT reading one record.
+    ⭐⭐ `answerable` EXISTS BECAUSE `permitted` IS NOT THE QUESTION THE READER IS ASKING.
+    Measured on tenant #0, signed in, 2026-08-15: the Assistant offered **twelve** source chips
+    and could answer for **two**. The other ten are the `ut_odoo_*` grids, and
+    `_assistant_user_table` refuses every one of them — *"this database is mirror-served and needs
+    its materialised reader"* — because their rows live UNCAPPED in the DuckDB mirror and are read
+    through it (W30/R6 is exactly why). The refusal is correct, named and fail-closed. The defect
+    is that it arrives one spent prompt at a time: a picker that offers ten doors which cannot
+    open is the same shape as the rail that painted two rows differently from five.
+    ⚠ It is R6's SECOND SENTENCE, in the family that rule was written for — a limit that cannot be
+    removed must be REPORTED with its cause, never silently enforced.
+    ⛔ AND IT COSTS NOTHING, WHICH IS WHY IT IS HERE RATHER THAN IN THE REGISTER.
+    `user_tables.materialises()` reads the `readThrough` flag off the DEFINITION, and the
+    rows-free projection this function already reads carries it. So the batch that answers
+    "may they?" answers "can it?" in the same pass, with no extra store read.
+    ⚠ `databases=None` enumerates every source this tenant HAS (the two built-ins plus every
+    `ut_*` in the projection) rather than taking a caller-supplied list. A client list would make
+    the answer depend on what the caller thought to ask about, and the nav has already told them
+    what they hold.
+    """
+    import core.perm_scope as perm_scope
+    from core import user_tables
+    definitions = None
+    read_definitions = False
+    def _definitions():
+        nonlocal definitions, read_definitions
+        if not read_definitions:
+            read_definitions = True
+            try:
+                candidate = session.runtime.get_projection('user_tables', drop=('rows',))
+            except Exception:
+                candidate = None
+            definitions = candidate if isinstance(candidate, dict) else None
+        return definitions
+    if databases is None:
+        wanted = list(_ASSISTANT_BUILT_INS) + [
+            key for key in sorted((_definitions() or {}))
+            if isinstance(key, str) and key.startswith("ut_")
+        ]
+    else:
+        wanted = [str(key or "").strip() for key in (databases or ())]
+        wanted = list(dict.fromkeys(key for key in wanted if key))
+    out = {}
+    for key in wanted:
+        row = {"permitted": False, "answerable": False, "reason": ""}
+        out[key] = row
+        if key in _ASSISTANT_BUILT_INS:
+            if not (_assistant_tenant_allows(session, key)
+                    and perm_scope.assistant_entry(session.user, key) is not None):
+                continue
+            row["permitted"] = True
+            # ⚠ A CACHE MISS IS A DATA-AVAILABILITY FACT, NOT A PERMISSION ONE, and it must not
+            # drop the source from the list — an artefact already built on it stays listed. It is
+            # reported as not-yet-answerable, with the action that fixes it. MEASURED: the pool is
+            # filled by a grid REQUEST, not by `AIOS_PREWARM` — a fresh process refuses until
+            # somebody opens the database once.
+            team_id, agent = perm_scope.derive_pool_scope(session.user, key)
+            cache_key = (("pool", team_id, agent) if key == "customer_data"
+                         else ("product_pool", team_id))
+            cache = getattr(session.runtime, "pool_cache", None)
+            entry = cache.get(cache_key) if isinstance(cache, dict) else None
+            if isinstance(entry, tuple) and len(entry) >= 2 and isinstance(entry[1], (list, tuple)):
+                row["answerable"] = True
+            else:
+                row["reason"] = "no snapshot loaded yet — open this database once, then ask"
+            continue
+        if not key.startswith("ut_"):
+            continue
+        defs = _definitions()
+        definition = (defs or {}).get(key)
+        if not isinstance(definition, dict):
+            continue
+        lent = user_tables.lend(session.runtime, user_tables=defs)
+        if not user_tables.may_open(key, session.uname, session.admin, st=lent):
+            continue
+        row["permitted"] = True
+        if user_tables.materialises(key, st=lent, defn=definition):
+            row["answerable"] = True
+        else:
+            row["reason"] = "served live from its connector mirror — the assistant cannot read it yet"
+    return out
 def _user_for(claims):
     """The account named by a verified cookie, or None — with the epoch check that makes a
     stateless cookie revocable.

api/routes_query.py CHANGED Viewed

@@ -1,713 +1,666 @@
-"""routes_query.py — WAVE 32 item 7 (ruling R1, contract C5): the Query module's doors.
-    POST /api/v1/query/build   {question, scope}  -> {spec, explain, refused}   WRITES NOTHING
-    POST /api/v1/query/save    {question, scope, spec} -> the saved view
-    GET  /api/v1/query                            -> the AI-built views this caller may open
-    DELETE /api/v1/query/{qid}                    -> forget one
-**The AI turns a question about ONE granted database into a view SPEC. It may only build what the
-backend already supports** (R1), and the wall on which database it may name is the EXISTING one.
-⛔ THE FOUNDATION IS NOT `harness/semantic.py` — MEASURED, W32-T50
-(`.claude/wiki/waves/wave32/proto/query-spike/README.md`). That layer is bound to 8 hand-authored
-YAML topics over Odoo mirror tables: **0** are `ut_`-bound, and a `ut_` key answers
-`ModelError: topic 'ut_…' has no store binding` from both `store_columns` and `store_query`. Its
-own `save_view` writes `platform/data/store/views.json`, a chart workspace the product's grid
-cannot read. What it lends this file is its POSTURE, quoted from its system prompt: *the model
-never writes SQL and never invents a field name — it only picks registry keys.*
-The real foundation is the view stack that already ships, and this module is `routes_templates.py`
-with a model where the curated registry used to be:
-  · the wall            `routes_templates._target_or_refuse`   (imported, never re-implemented)
-  · the column contract `core.view_templates.columns_named` / `missing_columns`
-  · the view skeleton   `core.view_templates._view`            (one definition of what a view is)
-  · the validators      `aios_grid._clean_display` / `clean_filter_tree`
-  · the writer          `core.table_store.make(ws).save_view(..., shared=False)`
-⛔⛔ THE VALIDATORS DROP; THEY DO NOT REFUSE — and C5 requires a REFUSAL. `_clean_display` returns
-None for an unknown mode, and a view with no display block IS A GRID; `clean_filter_tree` drops a
-leaf naming an unknown column, and a view whose only condition was dropped SHOWS EVERY ROW under a
-name promising a shortlist (`view_templates`' own scar, and `_seed_wave17`'s before it). So
-membership is tested HERE, first and explicitly, and the cleaners run second as a belt. They are
-the vocabulary ORACLE, never the refusal.
-⛔ THE REFUSAL PATH IS A MODEL PROPERTY, so this module declares its OWN provider order rather than
-inheriting `analyst.available_providers()`' cheap-first one. Measured over 4 arms x 9 questions
-(`proto/query-spike/refusal-arms.json`): `cerebras/gpt-oss-120b` refuses 4/4 unanswerable questions
-with a usable sentence; `groq/llama-3.3-70b` refuses **0/4** and instead emits a fully valid spec
-answering a different question ("Revenue by Creator" against a database holding no revenue).
-Changing refusal from an enum value to its own tool changed cerebras not at all and made groq
-worse.
-⚠ AND THE LADDER STILL FALLS THROUGH ON A 429, WHICH IS A COMPROMISE, NOT AN OVERSIGHT — stated
-here because the first draft of this header claimed the opposite. A door that dies whenever one
-free tier rate-limits is worse than one that answers with a weaker model behind the SAME validator
-and the SAME human read-back. What "fail closed" means precisely: when the whole ladder is
-unreachable the answer is a sentence and never a view. Which provider answered rides back in the
-response so a wrong answer stays diagnosable (`_call_model`'s note).
-⛔ AND A PROVIDER `400` CAN BE THE MODEL'S REFUSAL. Groq validates the model's tool arguments
-against the tool schema server-side and answers `400 tool_use_failed` carrying the model's real
-output in `failed_generation` — so a refusal that omits a `required` property arrives as an HTTP
-error. `analyst._live_chat` calls `raise_for_status()` and discards that body, which is why this
-file has its own small ladder: `required` is `["kind"]` ALONE (a refusal must be a legal argument
-object), and a 400 body is READ before it is treated as transport.
-⚠ WHAT NO VALIDATOR CAN SEE, stated so nobody thinks the gate covers it: a spec whose every column
-is real, every op legal, kind in the vocabulary and target granted, which answers a DIFFERENT
-QUESTION. That class is invisible to server-side validation. The mechanism against it is C5's own
-shape — `build` returns `{spec, explain}` and WRITES NOTHING, `explain` is DERIVED from the
-validated spec (never asked of the model, which would let it flatter its own output), and saving is
-a second, explicit call. The person is the last validator, by design.
-"""
-import datetime as _dt
-import hashlib
-import json
-import os
-import re
-from fastapi import APIRouter, Body, Depends
-from deps import Session, err, require_session
-router = APIRouter(prefix="/api/v1")
-#: The store key holding the REGISTRY of AI-built views, per tenant: {qid: {...}}. The view itself
-#: is a real saved view in its target's own workspace — this is only the index, so listing the
-#: Query module never has to read every granted table's workspace to find them. Same split
-#: `core/alerts.py` draws between definitions and the inbox.
-QUERY_KEY = 'query_views'
-MAX_QUESTION = 500
-MAX_VISIBLE = 24
-MAX_REGISTRY = 200          #: a working list, not an archive (alerts' MAX_NOTIFICATIONS rule)
-#: ⭐ THE KINDS THE AI MAY EMIT. Held here as a NAMED SET, and `verify_query.py` asserts it is a
-#: subset of BOTH `aios_grid.DISPLAY_MODES` (the stored vocabulary) and the client's
-#: `CREATABLE_MODES` (which means "has a mounted renderer" — `verify_icons::mode_parity` enforces
-#: that both ways), AND that the excluded remainder is exactly `QUERY_EXCLUDED`. So a mode that
-#: lands in `CREATABLE_MODES` later REDS the gate instead of being silently un-offered — the
-#: `swipe`/`form` failure ("whole, correct and unreachable") in reverse.
-QUERY_KINDS = ('grid', 'chart', 'calendar', 'kanban', 'timeseries', 'map', 'list')
-#: Creatable modes the AI deliberately may NOT emit, each with the reason it cannot be derived
-#: from a question about existing records. A reason per member, because "excluded" with no cause
-#: is how a hold outlives its own justification.
-QUERY_EXCLUDED = {
-    'form': "a form is a door records come IN through and shows none — a question about existing "
-            "records cannot describe one, and its spec carries emails and a public token",
-    'catalog': "a catalog is a published artifact needing page authoring and product codes "
-               "(MAX_CATALOG_CODES is spent in page order), not a shape of the current rows",
-    'swipe': "a swipe deck needs an empty single-select plus a chosen option per direction — two "
-             "product decisions a question does not contain",
-}
-#: Mode-required refs, and the field FAMILY each one demands. ⚠ STRICTER THAN `_clean_display` ON
-#: PURPOSE. That function accepts any ref naming a real field and leaves the meaning to the client,
-#: which "degrades a wrong-typed ref to that surface's default rather than to an error" — correct
-#: for a person clicking a picker who SEES the result, wrong for a generated spec nobody has looked
-#: at yet. Measured: a free model stacked a kanban on `category` (a text column) for a contract
-#: with ZERO select columns, and every validator passed it.
-_MODE_REFS = {
-    'kanban': [('stackField', ('select',), True)],
-    'calendar': [('dateField', ('date',), True)],
-    'timeseries': [('dateField', ('date',), True)],
-    'map': [('colorField', ('select',), False), ('sizeField', ('int', 'currency', 'pct'), False)],
-}
-def _now_iso():
-    """UTC WITH the offset — a naive stamp is unsubtractable in a browser (D-18, alerts' rule)."""
-    return _dt.datetime.now(_dt.timezone.utc).isoformat()
-def _grid():
-    import aios_grid
-    return aios_grid
-def _templates():
-    import core.view_templates as view_templates
-    return view_templates
-def _target(session, scope):
-    """`(fields, source)` for a database this session may open — or a refusal.
-    ⛔ THE WALL IS `routes_templates._target_or_refuse`, IMPORTED AND NOT COPIED. It is the same
-    predicate the nav uses, per topic (`ut_*` -> `user_tables.may_open`; a built-in -> the module
-    grant `session.require`; anything else a 404 that is not a directory of what exists), and T51's
-    instruction is explicit that the wall is re-used, never re-implemented beside itself. The
-    private name is deliberate: an alias would mean editing a file no lane's fence covers.
-    It returns field KEYS; this door also needs each field's TYPE (for the prompt and for
-    `_MODE_REFS`), so the types are read from the same source the wall consulted — never from a
-    list assembled here.
-    """
-    import routes_templates
-    keys, source = routes_templates._target_or_refuse(session, scope)
-    key = str(scope or '').strip()
-    defs = []
-    if key.startswith('ut_'):
-        import core.user_tables as user_tables
-        defn = user_tables.get(key, st=session.runtime) or {}
-        by_key = {str(f.get('key')): f for f in (defn.get('fields') or []) if f.get('key')}
-    else:
-        g = _grid()
-        raw = g.product_fields() if key == 'product_data' else g.FIELDS
-        by_key = {str(f.get('key')): f for f in raw if f.get('key')}
-    for k in keys:
-        f = by_key.get(k) or {}
-        defs.append({'key': k, 'label': str(f.get('label') or k)[:80],
-                     'type': str(f.get('type') or 'text')})
-    return defs, source
-# ── the model ───────────────────────────────────────────────────────────────────────────────
-#: This module's OWN provider order — cerebras first. See the header: the refusal is a model
-#: property, and the ladder's cheap-first order is exactly wrong for a contract that includes one.
-#: Override with `AIOS_QUERY_PROVIDER`. The credentials themselves stay in ONE place
-#: (`analyst.PROVIDERS`), so a rotated key or a new model reaches this file too.
-QUERY_PROVIDER_ORDER = ('cerebras', 'groq', 'openrouter')
-def _providers():
-    import harness.analyst as analyst
-    pin = os.environ.get("AIOS_QUERY_PROVIDER")
-    by_name = {p["name"]: p for p in analyst.PROVIDERS}
-    order = [pin] if pin else list(QUERY_PROVIDER_ORDER)
-    return [by_name[n] for n in order
-            if n in by_name and os.environ.get(by_name[n]["env"])]
-def _spec_schema(field_keys):
-    """The tool schema the model fills. ⛔ `required` IS `["kind"]` ALONE — see the header: a
-    refusal carries no name, and groq rejects a schema-violating refusal with a 400 that reads
-    exactly like a transport failure."""
-    ops = sorted(_grid().FILTER_OPS)
-    col = {"type": "string", "enum": sorted(field_keys)}
-    return {
-        "type": "object",
-        "properties": {
-            "kind": {"type": "string", "enum": list(QUERY_KINDS) + ["refused"],
-                     "description": "refused = this database cannot answer the question"},
-            "name": {"type": "string", "description": "a short title for the view"},
-            "refusal": {"type": "string",
-                        "description": "when kind=refused: ONE plain sentence naming what is "
-                                       "missing"},
-            "visible": {"type": "array", "items": col},
-            "filters": {"type": "array", "items": {
-                "type": "object",
-                "properties": {"colId": col, "op": {"type": "string", "enum": ops},
-                               "value": {"type": "string"}},
-                "required": ["colId", "op"]}},
-            "filterConj": {"type": "string", "enum": ["and", "or"]},
-            "sorts": {"type": "array", "items": {
-                "type": "object",
-                "properties": {"colId": col,
-                               "dir": {"type": "string", "enum": ["asc", "desc"]}},
-                "required": ["colId", "dir"]}},
-            "groupBy": col,
-            "stackField": col,
-            "dateField": col,
-            "colorField": col,
-            "sizeField": col,
-        },
-        "required": ["kind"],
-    }
-def _system_prompt(fields):
-    """The standing instructions. The vocabulary is DERIVED (the kinds set, `FILTER_OPS`, the
-    target's own columns) — the model is never told about a key this server cannot honour."""
-    cols = json.dumps([{"key": f["key"], "label": f["label"], "type": f["type"]}
-                       for f in fields], separators=(",", ":"))
-    kinds = ", ".join(QUERY_KINDS)
-    ops = ", ".join(sorted(_grid().FILTER_OPS))
-    selects = [f["key"] for f in fields if f["type"] in ('select', 'multiselect')] or ["(none)"]
-    dates = [f["key"] for f in fields if f["type"] == 'date'] or ["(none)"]
-    return f"""You turn a question about ONE database into a VIEW SPEC. You never write SQL and you
-never invent a column or a kind of view.
-THE DATABASE ({len(fields)} columns) — you may name ONLY these column keys:
-{cols}
-VIEW KINDS you may name, and nothing else: {kinds}
-FILTER OPS you may name, and nothing else: {ops}
-The only select-type columns (a kanban MUST stack on one of these): {", ".join(selects)}
-The only date columns (a calendar or timeseries MUST use one of these): {", ".join(dates)}
-RULES:
-1. Emit ONE call to build_view. Every colId in visible/filters/sorts/groupBy and every field ref
-   MUST be one of the keys above.
-2. Pick the kind by what the question asks for: a list of records -> grid (or list); totals or
-   counts by a category -> chart with groupBy; cards by a stage -> kanban (stackField REQUIRED,
-   and it must be a select column); something over time -> calendar or timeseries (dateField
-   REQUIRED, and it must be a date column); geography -> map.
-3. `visible` is the columns the question is about, most important first — not every column.
-4. Set kind="refused" and put ONE plain sentence in `refusal` when the question needs a column
-   this database does not have, a number it does not store, or a picture that is not in the kind
-   list. REFUSING IS A CORRECT ANSWER. A view that answers a DIFFERENT question than the one
-   asked is the worst possible answer — worse than saying you cannot build it. When in doubt,
-   refuse.
-5. Every `value` is a string."""
-def _call_model(question, fields, chat=None):
-    """`(spec, error_sentence, provider)` — one bounded call down THIS module's ladder.
-    `chat` is injectable so `verify_query.py` proves this door end to end with no key and no
-    tokens (`analyst.ask`'s own posture, and the reason its loop is testable offline).
-    ⚠ THE LADDER IS A DELIBERATE COMPROMISE, AND THE PROVIDER RIDES BACK BECAUSE OF IT. Only the
-    FIRST provider is measured to refuse honestly (README section 4b); the ones below it answer
-    unanswerable questions with plausible specs. Falling through on a 429 is still the right call —
-    a Query module that dies whenever one free tier rate-limits is worse than one that answers with
-    a weaker model behind the same validator and the same human read-back — but *which* model
-    answered must be knowable, or a wrong answer is undiagnosable after the fact. Failing closed is
-    what happens when the whole ladder is unreachable, not when the best rung is.
-    """
-    tools = [{"type": "function", "function": {
-        "name": "build_view",
-        "description": "Emit the view spec, or refuse.",
-        "parameters": _spec_schema([f["key"] for f in fields])}}]
-    messages = [{"role": "system", "content": _system_prompt(fields)},
-                {"role": "user", "content": question}]
-    if chat is not None:
-        return chat(messages, tools), None, "injected"
-    provs = _providers()
-    if not provs:
-        # No key at all: say so. An AI feature that silently does nothing is indistinguishable
-        # from one that was never built ([[flag-shipped-without-its-writer]]).
-        return None, ("the assistant is not configured on this deployment, so a view cannot be "
-                      "built from a question yet"), None
-    import requests
-    last = None
-    for p in provs:
-        try:
-            r = requests.post(p["url"], timeout=60,
-                              headers={"Authorization": f"Bearer {os.environ[p['env']]}"},
-                              json={"model": p["model"], "messages": messages, "tools": tools,
-                                    "tool_choice": "required", "temperature": 0.1,
-                                    "max_tokens": 1200})
-        except Exception as e:                       # network blip — try the next provider
-            last = f"{p['name']}: {type(e).__name__}"
-            continue
-        if r.status_code == 400:
-            # ⛔ THE MODEL'S ANSWER CAN BE IN HERE. Groq validates tool arguments against the
-            # schema and returns the generation it rejected. Reading it turns a "transport
-            # failure" back into the refusal it actually was.
-            spec = _spec_from_400(r.text)
-            if spec is not None:
-                return spec, None, p["name"]
-            last = f"{p['name']}: 400"
-            continue
-        if r.status_code != 200:
-            last = f"{p['name']}: HTTP {r.status_code}"
-            continue                                 # 429 included: the NEXT provider, not a sleep
-        try:
-            msg = r.json()["choices"][0]["message"]
-            calls = msg.get("tool_calls") or []
-            if not calls:
-                last = f"{p['name']}: no tool call"
-                continue
-            return json.loads(calls[0]["function"].get("arguments") or "{}"), None, p["name"]
-        except Exception as e:
-            last = f"{p['name']}: unreadable answer ({type(e).__name__})"
-            continue
-    # ⛔ FAIL CLOSED. The first provider in the order is the one measured to refuse honestly; if it
-    # is rate-limited and the rest are too, the answer is a sentence, never a fabricated view.
-    return None, ("the assistant could not be reached just now (" + (last or "no provider") +
-                  ") — try the question again in a moment"), None
-_FAILED_GEN = re.compile(r'<function=build_view>(\{.*?\})\s*</function>', re.S)
-def _spec_from_400(body):
-    """The spec out of a `tool_use_failed` body's `failed_generation`, or None."""
-    try:
-        err_obj = (json.loads(body) or {}).get("error") or {}
-    except Exception:
-        return None
-    gen = str(err_obj.get("failed_generation") or "")
-    if not gen:
-        return None
-    m = _FAILED_GEN.search(gen)
-    raw = m.group(1) if m else gen.strip()
-    try:
-        spec = json.loads(raw)
-    except Exception:
-        return None
-    return spec if isinstance(spec, dict) else None
-# ── validation: the REFUSAL this contract promises ───────────────────────────────────────────
-def _validate(spec, fields):
-    """`(clean, refusal, code)` — exactly one of `clean` / `refusal` is set.
-    Membership FIRST and explicitly (the header's whole subject), then the product's own cleaners
-    as a belt. A refusal is a SENTENCE, because C5's user-facing promise is a plain sentence and
-    never a broken view.
-    """
-    g = _grid()
-    if not isinstance(spec, dict):
-        return None, "the assistant did not answer with a view", "no_spec"
-    by_key = {f['key']: f['type'] for f in fields}
-    keys = set(by_key)
-    kind = spec.get('kind')
-    if kind == 'refused':
-        return None, (str(spec.get('refusal') or '').strip()
-                      or "this database cannot answer that question"), "model_refused"
-    if kind in QUERY_EXCLUDED:
-        return None, (f"a {kind} view cannot be built from a question — "
-                      + QUERY_EXCLUDED[kind]), "unsupported_kind"
-    if kind not in QUERY_KINDS:
-        # ⛔ NOT `_clean_display`'s job: it would DROP this and hand back a grid under a name
-        # promising something else.
-        return None, (f"{kind!r} is not a kind of view this product can build"
-                      if kind else "the assistant did not name a kind of view"), "unsupported_kind"
-    named = set(spec.get('visible') or ())
-    for s in spec.get('sorts') or ():
-        if isinstance(s, dict) and s.get('colId'):
-            named.add(str(s['colId']))
-    for f in spec.get('filters') or ():
-        if isinstance(f, dict) and f.get('colId'):
-            named.add(str(f['colId']))
-    if spec.get('groupBy'):
-        named.add(str(spec['groupBy']))
-    for ref in ('stackField', 'dateField', 'colorField', 'sizeField'):
-        if spec.get(ref):
-            named.add(str(spec[ref]))
-    missing = sorted(named - keys)
-    if missing:
-        # NAMED, not counted (`routes_templates`' rule): the column keys are what tell the reader
-        # this is the wrong database for this question.
-        return None, ("this database does not have the columns that answer needs: "
-                      + ", ".join(missing)), "unknown_columns"
-    visible = [k for k in (spec.get('visible') or ()) if k in keys][:MAX_VISIBLE]
-    if not visible:
-        # An empty projection is not a view. `_default_view_config` would fill one in, which is
-        # how a question about two columns becomes a 285-column wall.
-        return None, ("that question did not name anything to show — try naming the columns you "
-                      "want to see"), "no_columns"
-    # ⛔ D-137, GUARDED WHERE IT REACHES THIS FEATURE. "The chart cannot key a SET-LIKE or CHECKBOX
-    # column the way the grid does" — a set row lands in several buckets, so a sum means something
-    # else, and a checkbox reads "(blank)". The defect lives in the CLIENT's `chartData` bucket
-    # keying, which is in no lane's fence this wave (booked, with that reason). What IS in this
-    # lane's power is refusing to GENERATE the broken case: the AI must only build what the backend
-    # and the renderer already support, which is R1's own sentence. Delete this guard when D-137
-    # closes — the refusal names the debt so the reader knows it is a limit, not a rule.
-    if kind == 'chart' and by_key.get(spec.get('groupBy')) in ('multiselect', 'checkbox'):
-        return None, (f"a chart cannot group by {spec.get('groupBy')!r} yet — a column that holds "
-                      f"several values at once, or a tick box, does not bucket the way a chart "
-                      f"needs. Try a table grouped by it instead"), "chart_key_unsupported"
-    for ref, families, required in _MODE_REFS.get(kind, ()):
-        val = spec.get(ref)
-        if val and by_key.get(val) not in families:
-            return None, (f"a {kind} view needs {ref[:-5]} to be a "
-                          f"{' or '.join(families)} column, and {val!r} is a "
-                          f"{by_key.get(val)} column"), "wrong_ref_type"
-        if required and not val:
-            return None, (f"a {kind} view needs a {' or '.join(families)} column and this "
-                          f"database has none that fits"), "missing_ref"
-    raw_filters = [f for f in (spec.get('filters') or ()) if isinstance(f, dict)]
-    filters = g.clean_filter_tree(raw_filters, keys)
-    if len(filters) != len(raw_filters):
-        # The belt caught something membership did not — an unknown op. Refuse rather than save a
-        # view whose condition was silently dropped (the widening this file exists to prevent).
-        return None, ("part of that filter is not something this product can express — try "
-                      "asking it more simply"), "filter_dropped"
-    display = {'mode': kind}
-    for ref, _families, _req in _MODE_REFS.get(kind, ()):
-        if spec.get(ref):
-            display[ref] = spec[ref]
-    cleaned_display = g._clean_display(display, keys) if kind != 'grid' else None
-    if kind != 'grid' and not cleaned_display:
-        return None, (f"this product could not build a {kind} view from that question"
-                      ), "display_dropped"
-    clean = {
-        'kind': kind,
-        'name': ' '.join(str(spec.get('name') or 'Query').split())[:60] or 'Query',
-        'visible': visible,
-        'filters': filters,
-        'filterConj': 'or' if spec.get('filterConj') == 'or' else 'and',
-        'sorts': [{'colId': s['colId'], 'dir': 'desc' if s.get('dir') == 'desc' else 'asc'}
-                  for s in (spec.get('sorts') or ()) if isinstance(s, dict)
-                  and s.get('colId') in keys][:3],
-        'groupBy': spec['groupBy'] if spec.get('groupBy') in keys else None,
-        'display': cleaned_display,
-    }
-    return clean, None, None
-def _explain(clean, fields):
-    """A plain-language read-back of what the view WILL do — DERIVED from the validated spec.
-    ⛔ NEVER ASKED OF THE MODEL. A model describing its own output describes what it MEANT, which
-    is precisely the failure this sentence exists to expose: a spec whose every column is real and
-    which answers a different question is invisible to validation, so the only thing that catches
-    it is a person reading an honest description of the spec that was actually accepted.
-    """
-    label = {f['key']: f['label'] for f in fields}
-    ops = {'eq': 'is', 'neq': 'is not', 'gt': 'is over', 'gte': 'is at least',
-           'lt': 'is under', 'lte': 'is at most', 'contains': 'contains',
-           'doesNotContain': 'does not contain', 'isEmpty': 'is empty',
-           'isNotEmpty': 'is not empty', 'between': 'is between', 'within': 'is within',
-           'topN': 'is in the top', 'bottomN': 'is in the bottom'}
-    kinds = {'grid': 'a table', 'list': 'a list', 'chart': 'a chart', 'kanban': 'a board',
-             'calendar': 'a calendar', 'timeseries': 'a time series', 'map': 'a map'}
-    parts = [f"{kinds.get(clean['kind'], clean['kind'])} of "
-             + ", ".join(label.get(k, k) for k in clean['visible'][:6])
-             + (f" and {len(clean['visible']) - 6} more columns"
-                if len(clean['visible']) > 6 else "")]
-    if clean['filters']:
-        joiner = " or " if clean['filterConj'] == 'or' else " and "
-        parts.append("showing only records where " + joiner.join(
-            f"{label.get(f['colId'], f['colId'])} {ops.get(f['op'], f['op'])}"
-            + (f" {f['value']}" if f.get('value') else "")
-            for f in clean['filters'] if isinstance(f, dict) and f.get('colId')))
-    else:
-        parts.append("showing every record")
-    if clean['groupBy']:
-        parts.append(f"grouped by {label.get(clean['groupBy'], clean['groupBy'])}")
-    if clean['sorts']:
-        s = clean['sorts'][0]
-        parts.append(f"sorted by {label.get(s['colId'], s['colId'])}"
-                     + (" (highest first)" if s['dir'] == 'desc' else " (lowest first)"))
-    for ref, word in (('stackField', 'in columns by'), ('dateField', 'placed in time by'),
-                      ('colorField', 'coloured by'), ('sizeField', 'sized by')):
-        val = (clean.get('display') or {}).get(ref)
-        if val:
-            parts.append(f"{word} {label.get(val, val)}")
-    return ", ".join(parts) + "."
-# ── the registry ────────────────────────────────────────────────────────────────────────────
-def _qid(scope, question):
-    """PINNED per (database, question), the `view_templates` discipline: asking the same thing
-    twice UPDATES one view instead of minting "Query 2" — `save_view` de-duplicates NAMES by
-    appending a number, so an unpinned id fills the store with numbered near-duplicates."""
-    h = hashlib.sha1(f"{scope}|{' '.join(str(question).split()).lower()}".encode("utf-8"))
-    return "q_" + h.hexdigest()[:12]
-def _registry(session):
-    try:
-        recs = session.runtime.get(QUERY_KEY) or {}
-    except Exception:
-        return {}
-    return recs if isinstance(recs, dict) else {}
-def _mine(session, rec):
-    return session.admin or str(rec.get('createdBy') or '') == session.uname
-#: The BUILT-IN topics `routes_templates._target_or_refuse` accepts beside any `ut_*` key. ⛔ THE
-#: CLIENT'S PICKER MUST MIRROR THIS, and `GET /query` publishes it (`builtins`) rather than leaving
-#: the page to re-derive it: the nav hands `QueryPage` every granted entry, which is a WIDER set
-#: than this door accepts, so a picker filtered on "not a surface" alone would offer a database the
-#: build door 404s. `view_templates`' own rule — "a picker that offered a template the apply door
-#: would then refuse is a control that lies" — and it is the same predicate twice, published once.
-BUILTIN_SCOPES = ('customer_data', 'product_data')
-@router.get("/query")
-def list_queries(session: Session = Depends(require_session)):
-    """The AI-built views this caller may open: their own, still-granted, still-existing.
-    ⚠ PRUNED ON READ against the CURRENT wall, never merely on write — a grant can be withdrawn
-    and a database deleted after a view was saved, and the Query module is chrome: it may render
-    nothing the server would not grant today (`nav.ts`'s chrome law).
-    """
-    import routes_templates
-    out = []
-    for qid, rec in sorted(_registry(session).items(),
-                           key=lambda kv: str((kv[1] or {}).get('createdAt') or ''),
-                           reverse=True):
-        if not isinstance(rec, dict) or not _mine(session, rec):
-            continue
-        try:
-            routes_templates._target_or_refuse(session, rec.get('scope'))
-        except Exception:
-            continue                                  # no longer granted, or gone
-        out.append({"id": qid, "scope": rec.get('scope'), "viewId": rec.get('viewId'),
-                    "name": rec.get('name'), "kind": rec.get('kind'),
-                    "question": rec.get('question'), "explain": rec.get('explain'),
-                    "createdAt": rec.get('createdAt')})
-    return {"views": out, "kinds": list(QUERY_KINDS), "builtins": list(BUILTIN_SCOPES)}
-@router.post("/query/build")
-def build_query(body: dict = Body(default=None),
-                session: Session = Depends(require_session)):
-    """A question + a granted database -> `{spec, explain, refused}`. **WRITES NOTHING.**
-    A refusal is a 200 carrying a sentence, not a 5xx: "this database cannot answer that" is a
-    successful answer to the person asking, and an error envelope would paint the error page R1
-    forbids. The 4xx cases are the ones that ARE the caller's fault — an unnamed database, an
-    over-long question, a database this session may not open.
-    ⛔ THE MODEL SEAM IS **NOT** ON THIS SIGNATURE, AND THAT IS A CORRECTION. The first draft took
-    `chat=None` as a parameter of the ROUTE — and FastAPI reads an un-annotated defaulted argument
-    as a **QUERY PARAMETER**, so `chat` appeared in `openapi()["paths"]` (measured) and
-    `POST /query/build?chat=x` would have reached `_call_model(..., chat="x")` and 500'd on
-    `"x"(messages, tools)`. The gate never saw it because the gate calls the handler directly —
-    which is exactly the shape of a test seam that becomes an input. The seam now lives on the
-    module-level `_build` below: the gate calls that, and the wire cannot.
-    """
-    body = body if isinstance(body, dict) else {}
-    return _build(body.get("question"), body.get("scope"), session)
-def _build(question, scope, session, chat=None):
-    """`build_query`'s body, with the model injectable — see that route's note on why the seam is
-    here and not on the signature FastAPI reads."""
-    question = ' '.join(str(question or "").split())
-    if not question:
-        raise err(400, "bad_request", "no question was asked")
-    if len(question) > MAX_QUESTION:
-        raise err(400, "question_too_long",
-                  f"a question must be under {MAX_QUESTION} characters")
-    fields, _source = _target(session, scope)
-    if not fields:
-        raise err(400, "no_columns", "that database has no columns to build a view from")
-    spec, transport, provider = _call_model(question, fields, chat=chat)
-    if transport:
-        return {"spec": None, "explain": None, "refused": transport, "provider": provider}
-    clean, refusal, code = _validate(spec, fields)
-    if refusal:
-        return {"spec": None, "explain": None, "refused": refusal, "reason": code,
-                "provider": provider}
-    return {"spec": clean, "explain": _explain(clean, fields),
-            "refused": None, "scope": scope,
-            "id": _qid(scope, question), "provider": provider,
-            "fallback": _is_fallback(provider)}
-def _is_fallback(provider):
-    """True when the answer came from a rung BELOW the top of this module's ladder.
-    ⛔ THIS IS THE HALF THAT WAS MISSING, AND IT IS A READER, NOT A WRITER. `_call_model` has
-    always returned WHICH provider answered, and its own docstring says exactly why that matters:
-    *"Only the FIRST provider is measured to refuse honestly … the ones below it answer
-    unanswerable questions with plausible specs."* So on a 429 the ladder falls through — correctly,
-    a Query module that dies when one free tier rate-limits is worse — and the person then reads a
-    confident, well-formed view spec built by a model that does not know how to say "this database
-    cannot answer that". **Nothing on the wire told them.** The value existed and had no consumer.
-    ⚠ `injected` (the gate's stubbed chat) is NOT a fallback: it is the test seam, and reporting it
-    as a degraded answer would make every gate assertion about this flag meaningless.
-    """
-    if not provider or provider == "injected":
-        return False
-    order = [p["name"] for p in _providers()]
-    return bool(order) and provider != order[0]
-@router.post("/query/save")
-def save_query(body: dict = Body(default=None), session: Session = Depends(require_session)):
-    """Save an accepted spec as the CALLING USER's own view, and index it under Query.
-    ⛔ THE SPEC IS RE-VALIDATED HERE, against the target's contract as it is NOW. The build door
-    wrote nothing, so this is the first write and it is the only place authorisation and validity
-    have to hold together — and a client is not a wall. An unsupported kind or an unknown column
-    is a **400 with a named code** on this door (the caller sent it), where the same fact is a
-    plain sentence on `build` (the model produced it).
-    """
-    body = body if isinstance(body, dict) else {}
-    scope = str(body.get("scope") or '').strip()
-    question = ' '.join(str(body.get("question") or "").split())[:MAX_QUESTION]
-    fields, _source = _target(session, scope)
-    clean, refusal, code = _validate(body.get("spec"), fields)
-    if refusal:
-        raise err(400, code or "bad_spec", refusal)
-    if not session.runtime.available():
-        raise err(503, "store_unavailable", "the tenant store is unavailable — nothing was saved")
-    vt = _templates()
-    ws_key = vt.workspace_key(scope)
-    if not ws_key:
-        raise err(404, "unknown_table", "that database does not exist")
-    qid = _qid(scope, question) if question else _qid(scope, clean['name'])
-    # ⛔ THE SKELETON IS `view_templates._view`, NOT A SECOND ONE. "A view assembled from a
-    # DIFFERENT skeleton is a second definition of what a view is — and the two drift on the day
-    # one of them gains a key." It also puts the mode at `config.display.mode`, which is the key
-    # the grid actually reads (`config.displayMode` was the first draft, and nothing reads it).
-    payload = vt._view(qid, clean['name'], f"Built by the assistant from: {question}"[:300],
-                       clean['visible'], mode=clean['kind'],
-                       sorts=clean['sorts'], filters=clean['filters'],
-                       group_by=clean['groupBy'], conj=clean['filterConj'])
-    if clean.get('display'):
-        payload['config']['display'] = dict(clean['display'])
-    payload['createdBy'] = session.uname
-    # ⛔ THE CAP REFUSES; IT DOES NOT EVICT — and the first draft evicted. Dropping the oldest entry
-    # would leave its saved VIEW behind in the table's own workspace: "stranded in the target's view
-    # list with no way back to the question that made it", which is the thing `delete_query` below
-    # exists to prevent. And an eviction nobody was told about is W30/R6's second sentence broken —
-    # a limit that cannot be removed must be REPORTED with its cause. So the 201st is a refusal
-    # naming the number and the way out, checked BEFORE the view is written.
-    existing = _registry(session)
-    if qid not in existing and len(existing) >= MAX_REGISTRY:
-        raise err(400, "query_limit",
-                  f"you already have {len(existing)} saved questions, which is the limit "
-                  f"({MAX_REGISTRY}). Delete one you no longer need and save this again.")
-    import core.table_store as table_store
-    ops = table_store.make(ws_key, st=session.runtime)
-    saved = ops.save_view(session.uname, payload, shared=False)
-    entry = {"scope": scope, "viewId": qid, "name": saved.get('name') or clean['name'],
-             "kind": clean['kind'], "question": question,
-             "explain": _explain(clean, fields), "createdBy": session.uname,
-             "createdAt": _now_iso()}
-    def _up(data):
-        data = data if isinstance(data, dict) else {}
-        data[qid] = entry
-        return data
-    session.runtime.update(QUERY_KEY, _up, flush='async')
-    return {"id": qid, **entry}
-@router.delete("/query/{qid}")
-def delete_query(qid: str, session: Session = Depends(require_session)):
-    """Forget an AI-built view — the index entry AND the view itself.
-    Leaving the view behind would strand it in the target's view list with no way back to the
-    question that made it ([[a-record-can-outlive-its-subject]]).
-    """
-    rec = _registry(session).get(str(qid))
-    if not isinstance(rec, dict) or not _mine(session, rec):
-        raise err(404, "unknown_query", "that view does not exist")
-    _target(session, rec.get('scope'))                # the wall, again, on the write path
-    vt = _templates()
-    ws_key = vt.workspace_key(rec.get('scope'))
-    if ws_key and session.runtime.available():
-        import core.table_store as table_store
-        table_store.make(ws_key, st=session.runtime).delete_view(
-            session.uname, rec.get('viewId') or str(qid))
-    def _up(data):
-        data = data if isinstance(data, dict) else {}
-        data.pop(str(qid), None)
-        return data
-    session.runtime.update(QUERY_KEY, _up, flush='async')
-    return {"deleted": str(qid)}

+"""Assistant chat and Query-owned virtual artefacts (W33-T72 / C8).
+Query reads only the detached, permission-filtered snapshot from
+``deps.assistant_read_scope``.  It owns a separate per-user namespace for threads, messages,
+citations and virtual views; it never opens or mutates a source workspace.
+"""
+import copy
+import datetime as _dt
+import hashlib
+import json
+import os
+import re
+import uuid
+from fastapi import APIRouter, Body, Depends
+from deps import (Session, assistant_read_scope, assistant_source_status, err,
+                  require_session)
+router = APIRouter(prefix="/api/v1")
+MAX_QUESTION = 500
+MAX_VISIBLE = 24
+MAX_ARTIFACTS = 200
+MODEL_AUTO = "auto"
+QUERY_PROVIDER_ORDER = ("cerebras", "groq", "openrouter")
+QUERY_KINDS = ("grid", "chart", "calendar", "kanban", "timeseries", "map", "list")
+QUERY_WORKSPACE_EVENTS = {"view_create", "view_upsert", "view_delete"}
+QUERY_EXCLUDED = {
+    "form": "Forms collect new data and are not a read-only Query artefact.",
+    "catalog": "Catalog is a source-native presentation that Query cannot safely mutate.",
+    "swipe": "Swipe is an interactive source-native presentation, not an Assistant output.",
+}
+_MODE_REFS = {
+    "kanban": [("stackField", ("select",), True)],
+    "calendar": [("dateField", ("date",), True)],
+    "timeseries": [("dateField", ("date",), True)],
+    "map": [("colorField", ("select",), False), ("sizeField", ("int", "currency", "pct"), False)],
+}
+def _now_iso():
+    return _dt.datetime.now(_dt.timezone.utc).isoformat()
+def _grid():
+    import aios_grid
+    return aios_grid
+def _safe(value):
+    """Detach values before they enter a durable Query object or an API reply."""
+    return json.loads(json.dumps(value, default=str))
+def _namespace_key(session):
+    """A tenant runtime has one isolated key for each user's Query-owned objects."""
+    principal = f"{session.tenant}:{session.uname}".encode("utf-8")
+    return "query_user_" + hashlib.sha256(principal).hexdigest()[:24]
+def _blank_state():
+    return {"version": 1, "threads": {}, "messages": {}, "citations": {}, "views": {}}
+def _state(session):
+    try:
+        raw = session.runtime.get(_namespace_key(session)) or {}
+    except Exception:
+        raw = {}
+    if not isinstance(raw, dict):
+        return _blank_state()
+    out = _blank_state()
+    for key in out:
+        if key == "version":
+            continue
+        if isinstance(raw.get(key), dict):
+            out[key] = copy.deepcopy(raw[key])
+    return out
+def _new_id(prefix):
+    return f"{prefix}_{uuid.uuid4().hex[:16]}"
+def model_choices():
+    """Choices are stable even when one is not configured, so explicit means explicit."""
+    return [MODEL_AUTO, *QUERY_PROVIDER_ORDER]
+def _providers(model=MODEL_AUTO):
+    """Auto returns the permitted ladder; an explicit choice returns at most one provider."""
+    import harness.analyst as analyst
+    requested = str(model or MODEL_AUTO).strip().lower()
+    by_name = {p["name"]: p for p in analyst.PROVIDERS}
+    names = list(QUERY_PROVIDER_ORDER) if requested == MODEL_AUTO else [requested]
+    return [by_name[name] for name in names
+            if name in by_name and os.environ.get(by_name[name]["env"])]
+def _spec_schema(field_keys):
+    col = {"type": "string", "enum": sorted(field_keys)}
+    return {
+        "type": "object",
+        "properties": {
+            "kind": {"type": "string", "enum": [*QUERY_KINDS, "refused"]},
+            "name": {"type": "string"},
+            "refusal": {"type": "string"},
+            "visible": {"type": "array", "items": col},
+            "filters": {"type": "array", "items": {"type": "object", "properties": {
+                "colId": col, "op": {"type": "string", "enum": sorted(_grid().FILTER_OPS)},
+                "value": {"type": "string"},
+            }, "required": ["colId", "op"]}},
+            "filterConj": {"type": "string", "enum": ["and", "or"]},
+            "sorts": {"type": "array", "items": {"type": "object", "properties": {
+                "colId": col, "dir": {"type": "string", "enum": ["asc", "desc"]},
+            }, "required": ["colId", "dir"]}},
+            "groupBy": col,
+            "aggregation": {"type": "object", "properties": {
+                "op": {"type": "string", "enum": ["count", "sum", "avg", "min", "max"]},
+                "field": col,
+            }, "required": ["op"]},
+            "stackField": col,
+            "dateField": col,
+            "colorField": col,
+            "sizeField": col,
+        },
+        "required": ["kind"],
+    }
+def _system_prompt(snapshot):
+    fields = snapshot["fields"]
+    cols = json.dumps([{"key": field["key"], "label": field.get("label", field["key"]),
+                        "type": field.get("type", "text")} for field in fields], separators=(",", ":"))
+    return f"""You turn a question about exactly one permitted database into a virtual view.
+Never write SQL, invent fields, or name another database.
+DATABASE: {snapshot['database']}
+SNAPSHOT VERSION: {json.dumps(snapshot['source_version'], default=str)}
+PERMISSION-FILTERED RECORD COUNT: {len(snapshot['records'])}
+FIELDS: {cols}
+VIEW KINDS: {", ".join(QUERY_KINDS)}
+Choose visible fields, supported filters and an optional aggregation. Use count for record counts;
+sum, avg, min and max require one numeric field. The server computes and cites every number from
+this exact snapshot. Return kind=refused with one plain sentence if the database cannot answer."""
+_FAILED_GEN = re.compile(r"<function=build_view>(\{.*?\})\s*</function>", re.S)
+def _spec_from_400(body):
+    try:
+        value = ((json.loads(body) or {}).get("error") or {}).get("failed_generation") or ""
+        raw = (_FAILED_GEN.search(str(value)) or [str(value).strip()])[1]
+        result = json.loads(raw)
+        return result if isinstance(result, dict) else None
+    except Exception:
+        return None
+def _call_model(question, snapshot, model=MODEL_AUTO, chat=None):
+    """Return ``(spec, sentence, provider, reason)`` without any source-data fallback."""
+    requested = str(model or MODEL_AUTO).strip().lower()
+    if requested not in model_choices():
+        return None, f"the selected model ({requested or model}) is unavailable", None, "model_unavailable"
+    tools = [{"type": "function", "function": {
+        "name": "build_view", "description": "Emit a virtual-view spec or a refusal.",
+        "parameters": _spec_schema([field["key"] for field in snapshot["fields"]]),
+    }}]
+    messages = [{"role": "system", "content": _system_prompt(snapshot)},
+                {"role": "user", "content": question}]
+    if chat is not None:
+        provider = requested if requested != MODEL_AUTO else "injected"
+        return chat(messages, tools), None, provider, None
+    providers = _providers(requested)
+    if not providers:
+        sentence = (f"the selected model ({requested}) is unavailable" if requested != MODEL_AUTO
+                    else "the assistant is not configured on this deployment")
+        return None, sentence, None, "model_unavailable" if requested != MODEL_AUTO else None
+    import requests
+    last = None
+    for provider in providers:
+        try:
+            response = requests.post(
+                provider["url"], timeout=60,
+                headers={"Authorization": f"Bearer {os.environ[provider['env']]}"},
+                json={"model": provider["model"], "messages": messages, "tools": tools,
+                      "tool_choice": "required", "temperature": 0.1, "max_tokens": 1200},
+            )
+        except Exception as exc:
+            last = f"{provider['name']}: {type(exc).__name__}"
+            continue
+        if response.status_code == 400:
+            spec = _spec_from_400(response.text)
+            if spec is not None:
+                return spec, None, provider["name"], None
+            last = f"{provider['name']}: 400"
+            continue
+        if response.status_code != 200:
+            last = f"{provider['name']}: HTTP {response.status_code}"
+            continue
+        try:
+            call = (response.json()["choices"][0]["message"].get("tool_calls") or [])[0]
+            spec = json.loads(call["function"].get("arguments") or "{}")
+            return spec, None, provider["name"], None
+        except Exception as exc:
+            last = f"{provider['name']}: unreadable answer ({type(exc).__name__})"
+    if requested != MODEL_AUTO:
+        return None, f"the selected model ({requested}) is unavailable", None, "model_unavailable"
+    return None, "the assistant could not be reached just now (" + (last or "no provider") + ")", None, None
+def _validate(spec, fields):
+    """Return a cleaned, source-independent virtual-view config or a named refusal."""
+    if not isinstance(spec, dict):
+        return None, "the assistant did not answer with a view", "no_spec"
+    by_key = {str(field.get("key")): str(field.get("type") or "text") for field in fields}
+    keys = set(by_key)
+    kind = spec.get("kind")
+    if kind == "refused":
+        return None, str(spec.get("refusal") or "this database cannot answer that question"), "model_refused"
+    if kind in QUERY_EXCLUDED or kind not in QUERY_KINDS:
+        return None, "that kind of view cannot be built from this question", "unsupported_kind"
+    named = set(spec.get("visible") or ())
+    for item in spec.get("filters") or ():
+        if isinstance(item, dict) and item.get("colId"):
+            named.add(str(item["colId"]))
+    for item in spec.get("sorts") or ():
+        if isinstance(item, dict) and item.get("colId"):
+            named.add(str(item["colId"]))
+    for key in ("groupBy", "stackField", "dateField", "colorField", "sizeField"):
+        if spec.get(key):
+            named.add(str(spec[key]))
+    raw_aggregation = spec.get("aggregation") or {"op": "count"}
+    if isinstance(raw_aggregation, dict) and raw_aggregation.get("field"):
+        named.add(str(raw_aggregation["field"]))
+    missing = sorted(named - keys)
+    if missing:
+        return None, "this database does not have: " + ", ".join(missing), "unknown_columns"
+    visible = [str(key) for key in (spec.get("visible") or ()) if str(key) in keys][:MAX_VISIBLE]
+    if not visible:
+        return None, "that question did not name any fields to show", "no_columns"
+    raw_filters = [item for item in (spec.get("filters") or ()) if isinstance(item, dict)]
+    filters = _grid().clean_filter_tree(raw_filters, keys)
+    if len(filters) != len(raw_filters):
+        return None, "part of that filter is unsupported", "filter_dropped"
+    aggregation = raw_aggregation if isinstance(raw_aggregation, dict) else {}
+    op = str(aggregation.get("op") or "").lower()
+    field = aggregation.get("field")
+    if op not in {"count", "sum", "avg", "min", "max"}:
+        return None, "the assistant gave an unsupported aggregation", "bad_aggregation"
+    if op == "count":
+        field = None
+    elif field not in keys or by_key.get(field) not in {"int", "currency", "pct"}:
+        return None, "that aggregation needs one visible numeric field", "bad_aggregation"
+    display = {"mode": kind}
+    for ref, families, required in _MODE_REFS.get(kind, ()):
+        value = spec.get(ref)
+        if required and not value:
+            return None, f"a {kind} view needs {ref}", "missing_ref"
+        if value and by_key.get(value) not in families:
+            return None, f"{ref} has the wrong field type", "wrong_ref_type"
+        if value:
+            display[ref] = value
+    cleaned_display = _grid()._clean_display(display, keys) if kind != "grid" else None
+    if kind != "grid" and not cleaned_display:
+        return None, f"this product could not build a {kind} view", "display_dropped"
+    return {
+        "kind": kind,
+        "name": " ".join(str(spec.get("name") or "Query").split())[:60] or "Query",
+        "visible": visible,
+        "filters": filters,
+        "filterConj": "or" if spec.get("filterConj") == "or" else "and",
+        "sorts": [{"colId": item["colId"], "dir": "desc" if item.get("dir") == "desc" else "asc"}
+                  for item in (spec.get("sorts") or []) if isinstance(item, dict)
+                  and item.get("colId") in keys][:3],
+        "groupBy": spec.get("groupBy") if spec.get("groupBy") in keys else None,
+        "aggregation": {"op": op, "field": field},
+        "display": cleaned_display,
+    }, None, None
+def _explain(view, fields):
+    label = {field["key"]: str(field.get("label") or field["key"]) for field in fields}
+    visible = ", ".join(label.get(key, key) for key in view["visible"][:6])
+    result = f"{view['kind']} view of {visible}"
+    if view["filters"]:
+        result += "; filtered records only"
+    if view.get("groupBy"):
+        result += f"; grouped by {label.get(view['groupBy'], view['groupBy'])}"
+    agg = view["aggregation"]
+    if agg["op"] != "count":
+        result += f"; {agg['op']} of {label.get(agg['field'], agg['field'])}"
+    return result + "."
+def _numeric_result(view, records):
+    aggregation = view["aggregation"]
+    if aggregation["op"] == "count":
+        return {"label": "Matching records", "value": len(records), "contributing_record_count": len(records)}
+    values = []
+    for record in records:
+        try:
+            value = record.get(aggregation["field"])
+            if value is not None and not isinstance(value, bool):
+                values.append(float(value))
+        except (TypeError, ValueError):
+            continue
+    if not values:
+        return {"label": aggregation["op"], "value": None, "contributing_record_count": 0}
+    op = aggregation["op"]
+    value = {"sum": sum(values), "avg": sum(values) / len(values), "min": min(values), "max": max(values)}[op]
+    return {"label": f"{op.title()} of {aggregation['field']}", "value": value,
+            "contributing_record_count": len(values)}
+def _referenced_fields(view):
+    """The citation names every source field that affected the displayed result."""
+    out = list(view.get("visible") or ())
+    for node in view.get("filters") or ():
+        if isinstance(node, dict) and node.get("colId"):
+            out.append(str(node["colId"]))
+    for node in view.get("sorts") or ():
+        if isinstance(node, dict) and node.get("colId"):
+            out.append(str(node["colId"]))
+    for key in ("groupBy",):
+        if view.get(key):
+            out.append(str(view[key]))
+    aggregation = view.get("aggregation") or {}
+    if aggregation.get("field"):
+        out.append(str(aggregation["field"]))
+    return list(dict.fromkeys(out))
+def _effective_filters(snapshot, view):
+    """Keep the source request and generated-view predicates distinct in provenance."""
+    return {
+        "source": _safe(snapshot.get("filters")),
+        "view": {"conj": view.get("filterConj", "and"),
+                 "nodes": _safe(view.get("filters") or [])},
+    }
+def _view_records(snapshot, view):
+    """Apply the exact validated virtual-view filter before calculating a cited number."""
+    nodes = view.get("filters") or []
+    if not nodes:
+        return list(snapshot["records"])
+    from harness import filter_eval
+    tree = {"conj": view.get("filterConj", "and"), "nodes": nodes}
+    return [row for row in snapshot["records"]
+            if filter_eval.matches(tree, row, snapshot["fields"])]
+def _citation(citation_id, snapshot, view, numeric, view_id):
+    return {
+        "id": citation_id,
+        "href": f"#/query?view={view_id}&citation={citation_id}",
+        "database": snapshot["database"],
+        "snapshot": {"kind": snapshot["source_kind"], "version": _safe(snapshot["source_version"])},
+        "fields": [field["key"] for field in snapshot["fields"]
+                   if field.get("key") in set(_referenced_fields(view))],
+        "filters": _effective_filters(snapshot, view),
+        "permission_scope_applied": snapshot["permission_scope_applied"],
+        "aggregation": _safe(view["aggregation"]),
+        "contributing_record_count": numeric["contributing_record_count"],
+        "retrieved_at": snapshot["retrieved_at"],
+    }
+def _citation_complete(citation):
+    """A numeric result is not publishable without complete provenance."""
+    required = {"database", "snapshot", "fields", "filters", "aggregation",
+                "contributing_record_count", "retrieved_at", "href"}
+    snapshot = citation.get("snapshot") if isinstance(citation, dict) else None
+    return (isinstance(citation, dict) and required <= set(citation)
+            and bool(citation["database"]) and isinstance(snapshot, dict)
+            and "version" in snapshot and bool(citation["retrieved_at"])
+            and isinstance(citation["fields"], list)
+            and isinstance(citation["aggregation"], dict))
+def _public_view(view):
+    source = view["source"]
+    return {
+        "id": view["id"], "viewId": view["id"], "scope": source["database"],
+        "name": view["name"], "kind": view["view"]["kind"], "question": view["question"],
+        "explain": view["explain"], "threadId": view["threadId"], "createdAt": view["createdAt"],
+        "virtual": True, "source": _safe(source), "view": _safe(view["view"]),
+        "citationIds": list(view["citationIds"]), "numeric": _safe(view["numeric"]),
+    }
+def _source_still_permitted(session, source, permitted=None):
+    """A persisted artefact never outlives the caller's current data permission.
+    ⚠ `permitted` is the BATCH answer from `deps.assistant_source_status` — one rows-free
+    resolution for every source at once, rather than one whole-document read per saved view. That
+    function's docstring carries the measurement. The single-source path below stays for callers
+    holding exactly one artefact (the workspace-event door), and asks the same helper.
+    ⛔ `permitted`, NEVER `answerable`. A source whose rows are served through the connector mirror
+    cannot be ASKED and can still be SEEN: the artefact was built from a snapshot that was legal
+    when it was taken, and hiding it because the reader can no longer make a NEW one would read as
+    deletion. The two verdicts are separate for that reason.
+    """
+    database = (source or {}).get("database") if isinstance(source, dict) else None
+    if not database:
+        return False
+    if permitted is None:
+        permitted = {key for key, row in assistant_source_status(session, [database]).items()
+                     if row["permitted"]}
+    return database in permitted
+def _public_state(state, session):
+    # ONE rows-free batch answers both questions: which sources this caller may still see (which
+    # artefacts stay listed) and which of them can actually be asked (which chips are live).
+    status = assistant_source_status(session)
+    for row in state["views"].values():
+        key = (row.get("source") or {}).get("database") if isinstance(row.get("source"), dict) else None
+        if key and key not in status:
+            # An artefact whose source is no longer enumerable still gets a verdict rather than a
+            # KeyError — it resolves to "not permitted" and the artefact drops out, which is the
+            # same answer the per-view wall gave.
+            status.update(assistant_source_status(session, [key]))
+    permitted = {key for key, row in status.items() if row["permitted"]}
+    allowed_views = [row for row in state["views"].values()
+                     if _source_still_permitted(session, row.get("source"), permitted)]
+    allowed_ids = {row["id"] for row in allowed_views}
+    allowed_citations = {citation_id for row in allowed_views
+                         for citation_id in row.get("citationIds") or []}
+    threads = sorted(state["threads"].values(), key=lambda row: row.get("updatedAt", ""), reverse=True)
+    messages = sorted(state["messages"].values(), key=lambda row: row.get("createdAt", ""))
+    views = sorted((_public_view(row) for row in allowed_views), key=lambda row: row["createdAt"], reverse=True)
+    messages = [row for row in messages if not row.get("viewId") or row.get("viewId") in allowed_ids]
+    return {"threads": _safe(threads), "messages": _safe(messages), "views": views,
+            "citations": _safe([row for key, row in state["citations"].items()
+                                  if key in allowed_citations]), "models": model_choices(),
+            # The chip row's own data: a source this caller holds but cannot ask, and WHY.
+            "sources": _safe([{"database": key, "answerable": row["answerable"],
+                               "reason": row["reason"]}
+                              for key, row in sorted(status.items()) if row["permitted"]])}
+@router.get("/query")
+def list_queries(session: Session = Depends(require_session)):
+    return _public_state(_state(session), session)
+@router.post("/query/{qid}/events")
+def mutate_query_workspace(qid: str, body: dict = Body(default=None),
+                           session: Session = Depends(require_session)):
+    """The only grid-mutation transport for a virtual Query workspace.
+    Query artefacts are immutable snapshots: creation and changes belong to an Assistant prompt,
+    never a source-native grid workspace.  Deleting the caller's personal artefact is the one
+    permitted mutation.  The binding key, not a client-supplied source scope, identifies it.
+    """
+    qid = str(qid)
+    body = body if isinstance(body, dict) else {}
+    binding = body.get("workspaceBinding")
+    event = body.get("event")
+    if not (isinstance(binding, dict) and binding.get("kind") == "query"
+            and str(binding.get("key") or "") == qid):
+        raise err(400, "query_workspace_mismatch",
+                  "the Query workspace binding must name this virtual artefact")
+    if not isinstance(event, dict) or str(event.get("type") or "") not in QUERY_WORKSPACE_EVENTS:
+        raise err(400, "unsupported_query_workspace_event",
+                  "Query accepts only view_create, view_upsert, or view_delete events")
+    state = _state(session)
+    view = state["views"].get(qid)
+    if view is None or not _source_still_permitted(session, view.get("source")):
+        # A caller cannot use an opaque Query key to learn about a revoked artefact.
+        raise err(404, "unknown_query", "that Query artefact does not exist")
+    event_type = str(event["type"])
+    if event_type != "view_delete":
+        raise err(409, "query_workspace_immutable",
+                  "AI-created Query views change only through a new Assistant prompt")
+    if str(event.get("viewId") or "") != qid:
+        raise err(400, "query_workspace_mismatch",
+                  "a Query delete must name the same virtual artefact as its binding")
+    deleted = delete_query(qid, session)
+    return {"workspaceBinding": {"kind": "query", "key": qid},
+            "event": event_type, **deleted}
+def _sources(body, target, session):
+    raw = body.get("sources") if isinstance(body, dict) else None
+    sources = [str(item).strip() for item in raw] if isinstance(raw, list) else []
+    sources = list(dict.fromkeys(item for item in sources if item))
+    if target not in sources:
+        sources.insert(0, target)
+    # Source chips are a permissioned selection, not untrusted labels remembered in a thread.
+    # The model still receives ONLY `target`'s snapshot below; these calls do not pass a second
+    # source to it and D's helper refuses cache misses, mirrors and unshared databases.
+    for source in sources:
+        assistant_read_scope(session, source, fields=[], filters=None)
+    return sources
+def _submit(body, session, chat=None):
+    body = body if isinstance(body, dict) else {}
+    question = " ".join(str(body.get("question") or "").split())
+    target = str(body.get("database") or body.get("scope") or "").strip()
+    selected_model = str(body.get("model") or MODEL_AUTO).strip().lower()
+    if not question:
+        raise err(400, "bad_request", "no question was asked")
+    if len(question) > MAX_QUESTION:
+        raise err(400, "question_too_long", f"a question must be under {MAX_QUESTION} characters")
+    if not target:
+        raise err(400, "bad_request", "one target database must be selected")
+    if selected_model not in model_choices():
+        raise err(400, "unknown_model", "that model is not available in Query")
+    # This call happens before model selection and is the only permitted source-data read.
+    snapshot = assistant_read_scope(session, target, fields=None, filters=body.get("filters"))
+    sources = _sources(body, target, session)
+    state = _state(session)
+    thread_id = str(body.get("threadId") or "").strip()
+    if thread_id and thread_id not in state["threads"]:
+        raise err(404, "unknown_thread", "that chat does not exist")
+    if not thread_id:
+        thread_id = _new_id("thread")
+    now = _now_iso()
+    user_message_id = _new_id("message")
+    assistant_message_id = _new_id("message")
+    spec, sentence, provider, reason = _call_model(question, snapshot, model=selected_model, chat=chat)
+    view, refusal, refusal_code = _validate(spec, snapshot["fields"]) if spec is not None else (None, sentence, reason)
+    artifact = None
+    citation = None
+    if view is not None:
+        if len(state["views"]) >= MAX_ARTIFACTS:
+            raise err(400, "query_limit", f"you already have {len(state['views'])} Query artefacts")
+        view_id = _new_id("query")
+        citation_id = _new_id("citation")
+        numeric = _numeric_result(view, _view_records(snapshot, view))
+        citation = _citation(citation_id, snapshot, view, numeric, view_id)
+        if not _citation_complete(citation):
+            raise RuntimeError("Query refused to persist an incomplete numeric citation")
+        source = {"database": snapshot["database"], "label": snapshot["label"],
+                  "source_kind": snapshot["source_kind"], "source_version": _safe(snapshot["source_version"]),
+                  "retrieved_at": snapshot["retrieved_at"],
+                  "fields": _safe(snapshot["fields"]), "filters": _safe(snapshot["filters"]),
+                  "permission_scope_applied": snapshot["permission_scope_applied"]}
+        artifact = {"id": view_id, "threadId": thread_id, "name": view["name"], "question": question,
+                    "explain": _explain(view, snapshot["fields"]), "createdAt": now, "source": source,
+                    "view": _safe(view), "citationIds": [citation_id], "numeric": numeric,
+                    "model": provider, "requestedModel": selected_model}
+    assistant_message = {
+        "id": assistant_message_id, "threadId": thread_id, "role": "assistant", "createdAt": now,
+        "content": artifact["explain"] if artifact else (refusal or "the assistant could not answer"),
+        "targetDatabase": target, "requestedModel": selected_model, "model": provider,
+        "reason": refusal_code, "viewId": artifact["id"] if artifact else None,
+        "citationIds": artifact["citationIds"] if artifact else [], "numeric": artifact["numeric"] if artifact else None,
+    }
+    user_message = {"id": user_message_id, "threadId": thread_id, "role": "user", "createdAt": now,
+                    "content": question, "sources": sources, "targetDatabase": target,
+                    "requestedModel": selected_model}
+    def update(raw):
+        current = _blank_state()
+        if isinstance(raw, dict):
+            for key in ("threads", "messages", "citations", "views"):
+                if isinstance(raw.get(key), dict):
+                    current[key] = copy.deepcopy(raw[key])
+        thread = current["threads"].get(thread_id) or {"id": thread_id, "createdAt": now}
+        thread.update({"updatedAt": now, "title": question[:80], "sources": sources,
+                       "model": selected_model, "activeViewId": artifact["id"] if artifact else thread.get("activeViewId")})
+        current["threads"][thread_id] = thread
+        current["messages"][user_message_id] = user_message
+        current["messages"][assistant_message_id] = assistant_message
+        if artifact:
+            current["views"][artifact["id"]] = artifact
+            current["citations"][citation["id"]] = citation
+        return current
+    if not session.runtime.available():
+        raise err(503, "store_unavailable", "the tenant store is unavailable; no chat was saved")
+    session.runtime.update(_namespace_key(session), update, flush="async")
+    return {"thread": _safe(update(state)["threads"][thread_id]), "userMessage": _safe(user_message),
+            "message": _safe(assistant_message),
+            "view": _public_view(artifact) if artifact else None, "citations": [citation] if citation else []}
+@router.post("/query/chat")
+def submit_chat(body: dict = Body(default=None), session: Session = Depends(require_session)):
+    return _submit(body, session)
+@router.delete("/query/threads/{tid}")
+def delete_thread(tid: str, session: Session = Depends(require_session)):
+    """Remove one of the caller's own chats, and only the chat.
+    ⛔ THE ARTEFACTS SURVIVE, AND THAT IS THE POINT. A Query view is a durable object in its own
+    right — it appears in Query's rail, other people's links can point at it, and the owner's
+    instruction was that AI views LIVE THERE rather than inside the conversation that happened to
+    produce them. Cascading the delete would make tidying up a chat silently destroy work. Views
+    are deleted from Query's own rail, one at a time, by `delete_query` below.
+    ⚠ It exists because the history had no prune. `delete_query` removed a view and left its
+    thread, so the panel could only ever grow — a navigation you cannot manage is half a
+    navigation, and a person clearing test chats found that out first.
+    """
+    tid = str(tid)
+    state = _state(session)
+    if tid not in state["threads"]:
+        raise err(404, "unknown_thread", "that chat does not exist")
+    def update(raw):
+        current = _blank_state()
+        if isinstance(raw, dict):
+            for key in ("threads", "messages", "citations", "views"):
+                if isinstance(raw.get(key), dict):
+                    current[key] = copy.deepcopy(raw[key])
+        current["threads"].pop(tid, None)
+        for message_id in [key for key, row in current["messages"].items()
+                           if (row or {}).get("threadId") == tid]:
+            current["messages"].pop(message_id, None)
+        # ⚠ THE VIEWS' `threadId` IS LEFT EXACTLY AS IT WAS, dangling. Blanking it looks tidier and
+        # is a data-loss bug: `queryApi.saved()` refuses a row with an empty `threadId`, so every
+        # artefact built in the deleted chat would silently vanish from Query's rail — the exact
+        # "tidying up destroys work" outcome this door is written not to have
+        # [[a-record-can-outlive-its-subject]]. Nothing resolves the id but the chat panel, which
+        # only ever looks up the thread it is showing.
+        return current
+    session.runtime.update(_namespace_key(session), update, flush="async")
+    return {"deleted": tid}
+@router.delete("/query/{qid}")
+def delete_query(qid: str, session: Session = Depends(require_session)):
+    qid = str(qid)
+    state = _state(session)
+    if qid not in state["views"]:
+        raise err(404, "unknown_query", "that Query artefact does not exist")
+    def update(raw):
+        current = _blank_state()
+        if isinstance(raw, dict):
+            for key in ("threads", "messages", "citations", "views"):
+                if isinstance(raw.get(key), dict):
+                    current[key] = copy.deepcopy(raw[key])
+        view = current["views"].pop(qid, None)
+        for citation_id in (view or {}).get("citationIds") or []:
+            current["citations"].pop(citation_id, None)
+        return current
+    session.runtime.update(_namespace_key(session), update, flush="async")
+    return {"deleted": qid}

platform/core/perm_scope.py CHANGED Viewed

@@ -87,6 +87,22 @@ def may_access(user, module):
     return perms.may_open(user, module)          # legacy record: the old grant wall
 # ── FIELDS ───────────────────────────────────────────────────────────────────────────────────
 def hidden_keys(user, module, fields):
     """The TRANSITIVE closure of hidden field keys (C-PERM amendment 5).
@@ -143,6 +159,37 @@ def visible_fields(fields, user, module):
             if not (isinstance(f, dict) and f.get('key') in hide)]
 def strip_row(row, hide):
     """Drop hidden keys from ONE assembled row. Cheap enough to run per row, and it must run
     per row: the field list and the row payload are two different wires, and stripping only the
@@ -170,6 +217,89 @@ def apply_row_scope(rows, user, module, fields, ctx=None):
     return [r for r in (rows or ()) if fe.permits(tree, r, fields, ctx)]
 # ── THE PUSHDOWN ─────────────────────────────────────────────────────────────────────────────
 #: `dba` value sets that pin a BU, and the Odoo team they pin. `_dba_attrs` emits exactly
 #: {'Fisch','Royal','Both'} (blank for "no brand attributable in 24 months"), so a permission

     return perms.may_open(user, module)          # legacy record: the old grant wall
+def assistant_entry(user, module):
+    """The explicit database grant an Assistant snapshot may rely on, else ``None``.
+    The interactive application retains an admin break-glass path and a temporary legacy-grant
+    compatibility path.  Neither is an answer at the Assistant's app-stored data boundary:
+    that reader must be able to name the migrated grant that admitted a database.  In particular,
+    a store-outage admin identity with no ``perms`` document is not an unresolved permission that
+    may be widened into data access.
+    """
+    e = entry(user, module)
+    if (not is_migrated(user) or not isinstance(e, dict)
+            or not bool(e.get('access', True)) or not may_access(user, module)):
+        return None
+    return e
 # ── FIELDS ───────────────────────────────────────────────────────────────────────────────────
 def hidden_keys(user, module, fields):
     """The TRANSITIVE closure of hidden field keys (C-PERM amendment 5).
             if not (isinstance(f, dict) and f.get('key') in hide)]
+def assistant_visible_fields(fields, user, module):
+    """Visible closure under one explicit Assistant grant, including for an admin caller."""
+    e = assistant_entry(user, module)
+    if e is None:
+        return []
+    # `hidden_keys` deliberately preserves the interactive admin break-glass behaviour.  The
+    # Assistant uses its explicit grant instead, but shares the same transitive formula closure.
+    hidden = {str(k) for k in (e.get('hiddenFields') or ()) if k}
+    if not hidden:
+        return list(fields or ())
+    refs = {}
+    for field in fields or ():
+        if not isinstance(field, dict) or not field.get('key'):
+            continue
+        expr = field.get('formula')
+        if isinstance(expr, str) and expr:
+            refs[field['key']] = {match.strip() for match in _FORMULA_REF.findall(expr)
+                                  if match.strip()}
+    for _ in range(12):
+        grew = False
+        for key, deps in refs.items():
+            if key not in hidden and deps & hidden:
+                hidden.add(key)
+                grew = True
+        if not grew:
+            break
+    return [field for field in (fields or ())
+            if not (isinstance(field, dict) and field.get('key') in hidden)]
 def strip_row(row, hide):
     """Drop hidden keys from ONE assembled row. Cheap enough to run per row, and it must run
     per row: the field list and the row payload are two different wires, and stripping only the
     return [r for r in (rows or ()) if fe.permits(tree, r, fields, ctx)]
+def assistant_apply_row_scope(rows, user, module, fields, ctx=None):
+    """Apply an explicit Assistant grant's permanent filter without an admin bypass."""
+    e = assistant_entry(user, module)
+    if e is None:
+        return []
+    tree = e.get('filter')
+    if not tree:
+        return list(rows or ())
+    from harness import filter_eval as fe
+    return [row for row in (rows or ()) if fe.permits(tree, row, fields, ctx)]
+def validate_assistant_filter(tree, fields):
+    """Return a strict, detached Assistant filter tree or raise ``ValueError``.
+    The display filter cleaner is intentionally permissive: it drops a stale column or leaves an
+    inactive condition alone so an old saved view can still open.  An Assistant data reader cannot
+    inherit that behaviour — dropping a predicate turns a request for a subset into a wider read.
+    This validator therefore admits only visible field operands that the existing evaluator can
+    answer from one stored row.  Cohort, measure and rank conditions need separate materialised
+    set resolvers and are refused here rather than guessed.
+    """
+    if tree is None:
+        return None
+    from harness import filter_eval as fe
+    by_key = {str(field.get('key')): field for field in (fields or ())
+              if isinstance(field, dict) and field.get('key')}
+    if not by_key:
+        raise ValueError('assistant filter has no visible field contract')
+    def _leaf(raw):
+        if not isinstance(raw, dict):
+            raise ValueError('assistant filter leaf must be an object')
+        allowed = {'id', 'colId', 'op', 'value', 'value2', 'rhs'}
+        if set(raw) - allowed:
+            raise ValueError('assistant filter carries an unsupported operand')
+        col = raw.get('colId')
+        op = raw.get('op')
+        if not isinstance(col, str) or col not in by_key:
+            raise ValueError('assistant filter names an unknown or hidden field')
+        if (not isinstance(op, str) or op not in fe.FILTER_OPS or op in fe.RANK_OPS
+                or op in {'between', 'within'} or col == fe.COHORT_FIELD):
+            raise ValueError('assistant filter uses an unsupported operator')
+        rhs = raw.get('rhs')
+        if rhs is not None:
+            if (not isinstance(rhs, dict) or rhs.get('kind') != 'field'
+                    or set(rhs) - {'kind', 'colId'}
+                    or not isinstance(rhs.get('colId'), str)
+                    or rhs['colId'] not in by_key):
+                raise ValueError('assistant filter names an unknown or hidden right-hand field')
+        out = {name: raw[name] for name in ('id', 'colId', 'op', 'value', 'value2')
+               if name in raw}
+        if rhs is not None:
+            out['rhs'] = {'kind': rhs.get('kind'), 'colId': rhs['colId']}
+        if not fe.is_rule_active(out, by_key):
+            raise ValueError('assistant filter is inactive or unanswerable')
+        return out
+    def _node(raw):
+        if not isinstance(raw, dict):
+            raise ValueError('assistant filter node must be an object')
+        if 'children' not in raw:
+            return _leaf(raw)
+        if set(raw) - {'conj', 'children'}:
+            raise ValueError('assistant filter group carries an unsupported operand')
+        children = raw.get('children')
+        if raw.get('conj') not in ('and', 'or') or not isinstance(children, list) or not children:
+            raise ValueError('assistant filter group must be a non-empty and/or group')
+        return {'conj': raw['conj'], 'children': [_node(child) for child in children]}
+    if isinstance(tree, list):
+        if not tree:
+            raise ValueError('assistant filter list must not be empty')
+        return {'conj': 'and', 'nodes': [_node(node) for node in tree]}
+    if not isinstance(tree, dict) or set(tree) - {'conj', 'nodes'}:
+        raise ValueError('assistant filters must be a tree with nodes')
+    nodes = tree.get('nodes')
+    if tree.get('conj') not in ('and', 'or') or not isinstance(nodes, list) or not nodes:
+        raise ValueError('assistant filter tree must be a non-empty and/or tree')
+    return {'conj': tree['conj'], 'nodes': [_node(node) for node in nodes]}
 # ── THE PUSHDOWN ─────────────────────────────────────────────────────────────────────────────
 #: `dba` value sets that pin a BU, and the Odoo team they pin. `_dba_attrs` emits exactly
 #: {'Fisch','Royal','Both'} (blank for "no brand attributable in 24 months"), so a permission

web/src/assistant/AssistantPage.tsx CHANGED Viewed

@@ -1,394 +1,409 @@
-// ---------------------------------------------------------------------------
-// assistant/AssistantPage.tsx — THE AI ASSISTANT (owner item 2, 2026-08-14).
-//
-// Owner, verbatim: *"the query module should exactly BE looking like the database
-// module, COMPLETELY, with all the views etc. The only difference is that user isn't
-// the one creating the view, it's the AI that they prompt in the AI assistant module.
-// So now yes, you can unblock user from accessing the AI assistant, in staging only so
-// that we can see if the prompt to query data works."*
-//
-// That sentence splits one workflow across two routes, and this is the FIRST half:
-// you ask here, you read the answer back here, you keep it here — and then you LOOK at
-// it in Query, which is the database frame. The ask box used to live on `QueryPage`,
-// where it sat above a list of rows; a page with a question field on top of it is not a
-// page that "exactly looks like the database module", so the box moved to the surface
-// that is actually about asking.
-//
-// ⛔ THIS IS ALSO THE `ai-agent` MODULE'S REPLACEMENT, and the two are one row now.
-// Owner: *"AI assistant module IS AI agent module. So no need to separate it like
-// that. Just remove that AI agent module completely."* Wave 33 shipped an `#/ai-agent`
-// route beside an "AI assistant" row whose click opened an under-construction note for
-// an Analyst deleted at EXIT-6 — two AI doors, one of them apologising. There is one.
-//
-// ⛔ THE SENTENCE UNDER THE ANSWER IS THE LOAD-BEARING PART OF THIS PAGE, and it came
-// here from `QueryPage` intact. Measured in the prototype (W32-T50 section 4d): a free
-// model produced a spec whose every column was real, every op legal, kind in the
-// vocabulary and target granted — and which answered a different question ("Revenue by
-// Creator" against a database holding no revenue). No server-side validation can see
-// that class. So the server DERIVES a read-back from the spec it accepted, this page
-// shows it, and nothing is saved until a person says so. Never shorten `explain` away
-// to make the page tidier.
-//
-// ⛔ CHROME, NOT A REGISTRY MODULE, and `granted` is why that is allowed. `nav.ts`'s law
-// for this set is one sentence — "A CHROME ROUTE RENDERS NOTHING THE SERVER DID NOT
-// ALREADY GRANT" — so the database picker is the nav's OWN entries, handed down by the
-// Shell, never a directory this page fetches. It matters more here than on any other
-// chrome route, because this is the surface that NAMES a database to a model. (The
-// build door re-checks with the same wall regardless: `routes_query._target` →
-// `routes_templates._target_or_refuse`. This is what stops the picker offering what the
-// wall would then refuse.)
-//
-// ⚠ NO CLIENT UNION OVER `kind` — the server's vocabulary arrives as a string (the
-// wave-9 law), so a kind we do not have a label for renders as itself rather than
-// dropping the row.
-// ---------------------------------------------------------------------------
-import { useCallback, useEffect, useRef, useState } from "react";
 import { QUERY_OPEN_EVENT, signal } from "../apiContract";
 import { retryEmit } from "../inbox/inboxModel";
-import { buildQuery, deleteQuery, fetchQueries, saveQuery } from "../query/queryApi";
-import type { BuildResult, SavedQuery } from "../query/queryApi";
-import { QUERY_ROUTE, databaseEntries } from "../shell/nav";
 import type { NavEntry } from "../shell/nav";
 import "./assistant.css";
-export interface AssistantPageProps {
-  /**
-   * ⛔ REQUIRED, and it is the nav's own entries. An optional prop here would degrade to
-   * "the feature does not exist" the first time a mount forgot it, which is
-   * indistinguishable from never having been built. The Shell already holds these —
-   * passing them is also what keeps the chrome law true by construction rather than by
-   * promise.
-   */
-  granted: NavEntry[];
-}
-/** Human words for a kind. A kind absent from here renders as itself, never dropped. */
 const KIND_LABEL: Record<string, string> = {
-  grid: "Table",
-  list: "List",
-  chart: "Chart",
-  kanban: "Board",
-  calendar: "Calendar",
-  timeseries: "Time series",
-  map: "Map",
 };
-/** The sparkle, co-located rather than imported: `Shell.tsx`'s copy is private to it, and
- *  importing the shell from a lazily-imported route surface is a cycle for one glyph. */
-function SparkMark() {
-  return (
-    <svg className="shell-nav-icon is-spark" viewBox="0 0 16 16" aria-hidden="true">
-      <path d="M6.2 2.2 7.5 5.5l3.3 1.3-3.3 1.3-1.3 3.3-1.3-3.3-3.3-1.3 3.3-1.3z" />
-      <path d="M12.2 9.4l.8 2 2 .8-2 .8-.8 2-.8-2-2-.8 2-.8z" />
-    </svg>
-  );
-}
 /**
- * Route to the Query module and ask it to show this saved query.
  *
- * ⛔ THE LADDER IS NOT DEFENSIVE PROGRAMMING, IT IS THE ONLY CORRECT SHAPE. `QueryPage`
- * mounts on the hash change and then fetches `GET /query`; until that answers it cannot
- * know the qid exists, so it DROPS the event — and there is no acknowledgement to wait
- * on. `retryEmit` is the shell's own bounded ladder (5 attempts over 0–2,600 ms), reused
- * rather than re-written, and selecting a query twice is a no-op.
  */
 export function openBuiltView(qid: string): () => void {
   if (typeof window === "undefined") return () => {};
-  if (window.location.hash.replace(/^#\/?/, "") !== QUERY_ROUTE) {
-    window.location.hash = `#/${QUERY_ROUTE}`;
-  }
-  return retryEmit(() => {
-    signal(QUERY_OPEN_EVENT, { qid });
-  });
 }
 /**
- * The answer block: a refusal, or the read-back plus the two ways out.
- *
- * ⚠ A NAMED EXPORT ON PURPOSE, so `verify_query`'s render leg can paint the three states
- * directly. `renderToString` does not run effects, so the states this page reaches only
- * AFTER a fetch would otherwise be unprovable without a browser — and the read-back and
- * the refusal sentence are precisely the parts that must not quietly stop rendering
- * ([[ui-invisible-to-assertions]]).
  */
-export function QueryAnswer({ result, saving, onKeep, onDiscard }: {
-  result: BuildResult;
-  saving?: boolean;
-  onKeep: () => void;
-  onDiscard: () => void;
 }) {
-  if (result.refused) {
     return (
-      <section className="as-answer is-refused" role="status">
-        <p className="as-answer-head">That is not a view this database can draw</p>
-        <p className="as-answer-body">{result.refused}</p>
-      </section>
     );
   }
-  if (!result.spec) return null;
   return (
-    <section className="as-answer">
-      <p className="as-answer-head">Here is what that view would do</p>
-      {/* ⛔ THE READ-BACK. Derived by the SERVER from the spec it accepted, so it
-          describes what will be built rather than what the model meant. */}
-      {result.explain ? <p className="as-answer-body">{result.explain}</p> : null}
-      {/* ⛔ THE FALLBACK NOTICE. Not decoration: the top rung of the server's ladder is the only
-          one measured to REFUSE an unanswerable question honestly, so a spec built by a lower
-          rung can be well-formed, plausible and about a different question entirely — and the
-          read-back above describes what the spec DOES, which is exactly as convincing either
-          way. This is the one signal that tells the reader to look harder before keeping it.
-          ⚠ It never blocks the save: the person is the check, and taking the control away
-          because the model was second-choice would be a worse product than saying so. */}
-      {result.fallback ? (
-        <p className="as-answer-note" role="status">
-          Built by a backup model — the usual one was busy. Read this back carefully before
-          keeping it.
         </p>
       ) : null}
-      <div className="as-answer-acts">
-        <button type="button" className="as-btn as-btn--primary" disabled={saving}
-                onClick={onKeep}>
-          {saving ? "Saving…" : "Keep this view"}
         </button>
-        <button type="button" className="as-btn" onClick={onDiscard}>
-          Discard
-        </button>
-      </div>
-    </section>
   );
 }
-/** One view the assistant has built. Named for the same reason as {@link QueryAnswer}. */
-export function SavedQueryRow({ view, dbLabel, onOpen, onDelete }: {
-  view: SavedQuery;
-  dbLabel: string;
-  onOpen: () => void;
-  onDelete: () => void;
-}) {
-  return (
-    <li className="as-row">
-      <div className="as-row-main">
-        <button type="button" className="as-row-open" onClick={onOpen}>
-          {view.name}
-        </button>
-        <span className="as-row-meta">
-          {KIND_LABEL[view.kind] ?? view.kind} · {dbLabel}
-        </span>
-      </div>
-      {view.question ? <p className="as-row-q">“{view.question}”</p> : null}
-      {view.explain ? <p className="as-row-explain">{view.explain}</p> : null}
-      <div className="as-row-acts">
-        <button type="button" className="as-btn" onClick={onOpen}>
-          Open in Query
-        </button>
-        <button type="button" className="as-btn as-btn--quiet" onClick={onDelete}>
-          Delete
-        </button>
-      </div>
-    </li>
-  );
 }
 export default function AssistantPage({ granted }: AssistantPageProps) {
-  const [scope, setScope] = useState<string>("");
   const [question, setQuestion] = useState("");
   const [busy, setBusy] = useState(false);
-  const [result, setResult] = useState<BuildResult | null>(null);
   const [problem, setProblem] = useState("");
-  const [saved, setSaved] = useState<SavedQuery[]>([]);
-  const [builtins, setBuiltins] = useState<string[]>([]);
-  const [saving, setSaving] = useState(false);
   const [loaded, setLoaded] = useState(false);
   const openCancel = useRef<(() => void) | null>(null);
   /**
-   * The databases this page may ASK ABOUT.
-   *
-   * `databaseEntries` drops SURFACE rows (that fact is decided where rows are built, not
-   * re-derived here) and a group head has no destination. ⛔ BUT "granted and not a surface" is
-   * WIDER THAN THE BUILD DOOR ACCEPTS: it takes any `ut_*` key plus the built-in topics it
-   * publishes as `builtins`. Offering anything else would be a control that lies — the picker
-   * would list a database and the build call would 404 on it. So the server's own accepted set is
-   * mirrored, never guessed, and until it arrives only `ut_*` keys are offered (fail NARROW).
    */
-  const databases = databaseEntries(granted).filter(
-    (e) => e.kind !== "group" && (e.key.startsWith("ut_") || builtins.includes(e.key))
-  );
-  // Keep the picker on a database that still exists: a grant can be withdrawn while
-  // this page is open, and the server prunes on read, so the client must not pin a key
-  // the payload no longer carries.
-  useEffect(() => {
-    if (databases.length && !databases.some((d) => d.key === scope)) {
-      setScope(databases[0].key);
-    }
-  }, [databases, scope]);
-  // Cancel any open-ladder still running when this page unmounts — a timer firing into a
-  // surface nobody is looking at is the cheap half of a leak, and cancelling is one line.
-  useEffect(() => () => openCancel.current?.(), []);
   const reload = useCallback(async () => {
-    const res = await fetchQueries();
     setLoaded(true);
-    if (res.ok) {
-      setSaved(res.value.views);
-      setBuiltins(res.value.builtins);
     }
   }, []);
   useEffect(() => {
-    void reload();
-  }, [reload]);
   const ask = useCallback(async () => {
-    const q = question.trim();
-    if (!q || !scope || busy) return;
-    setBusy(true);
-    setProblem("");
-    setResult(null);
-    const res = await buildQuery(q, scope);
     setBusy(false);
-    if (!res.ok) {
-      setProblem(res.message);
-      return;
-    }
-    setResult(res.value);
-  }, [busy, question, scope]);
-  const keep = useCallback(async () => {
-    if (!result?.spec || saving) return;
-    setSaving(true);
-    const res = await saveQuery(question.trim(), scope, result.spec);
-    setSaving(false);
-    if (!res.ok) {
-      setProblem(res.message);
-      return;
-    }
-    setResult(null);
     setQuestion("");
-    await reload();
-  }, [question, reload, result, saving, scope]);
-  const forget = useCallback(async (id: string) => {
-    const res = await deleteQuery(id);
-    if (!res.ok) {
-      setProblem(res.message);
-      return;
-    }
-    await reload();
-  }, [reload]);
-  const open = useCallback((qid: string) => {
     openCancel.current?.();
     openCancel.current = openBuiltView(qid);
   }, []);
-  const labelOf = (key: string) =>
-    databases.find((d) => d.key === key)?.label ?? key;
-  return (
-    <div className="as-page">
-      <h1 className="as-title">
-        <SparkMark /> AI assistant
-      </h1>
-      <p className="as-lede">
-        Ask about one of your databases. You get a view you can read before you keep it — and a
-        plain answer when the question is not one this product can draw. Everything you keep
-        opens in Query.
-      </p>
-      {databases.length === 0 ? (
-        // ⚠ TWO DIFFERENT FACTS, TWO DIFFERENT SENTENCES. Before the index arrives the offerable
-        // set is deliberately narrow (see `databases`), so "you have no database" would be a claim
-        // this page cannot yet make.
-        <p className="as-note">
-          {loaded
-            ? "You do not have a database to ask about yet. Create one from the Database menu, "
-              + "then come back and ask about it."
-            : "Loading your databases…"}
-        </p>
-      ) : (
-        <section className="as-ask">
-          <label className="as-field">
-            <span className="as-label">Database</span>
-            <select
-              className="as-select"
-              value={scope}
-              onChange={(e) => setScope(e.currentTarget.value)}
-            >
-              {databases.map((d) => (
-                <option key={d.key} value={d.key}>
-                  {d.label}
-                </option>
               ))}
             </select>
           </label>
-          <label className="as-field as-field--grow">
-            <span className="as-label">Question</span>
-            <input
-              className="as-input"
-              value={question}
-              placeholder="Everyone with more than 50,000 followers, biggest first"
-              onChange={(e) => setQuestion(e.currentTarget.value)}
-              onKeyDown={(e) => {
-                if (e.key === "Enter") void ask();
-              }}
-            />
-          </label>
-          <button
-            type="button"
-            className="as-btn as-btn--primary"
-            disabled={busy || !question.trim()}
-            onClick={() => void ask()}
-          >
-            {busy ? "Working…" : "Build a view"}
           </button>
-        </section>
-      )}
-      {problem ? (
-        <p className="as-note is-warn" role="status">
-          {problem}
-        </p>
-      ) : null}
-      {/* A REFUSAL IS AN ANSWER, and it gets the same weight as a success — a sentence,
-          never an error page (R1's own words). Both states live in `QueryAnswer`. */}
-      {result ? (
-        <QueryAnswer
-          result={result}
-          saving={saving}
-          onKeep={() => void keep()}
-          onDiscard={() => setResult(null)}
-        />
-      ) : null}
-      <h2 className="as-sub">Views I have built for you</h2>
-      {!loaded ? (
-        <p className="as-note">
-          <span className="lp-spin" role="status" aria-label="Loading" />
-        </p>
-      ) : saved.length === 0 ? (
-        <p className="as-note">
-          Nothing yet. A view you keep lands in Query, and in the database it was built from.
-        </p>
-      ) : (
-        <ul className="as-list">
-          {saved.map((v) => (
-            <SavedQueryRow
-              key={v.id}
-              view={v}
-              dbLabel={labelOf(v.scope)}
-              onOpen={() => open(v.id)}
-              onDelete={() => void forget(v.id)}
-            />
           ))}
-        </ul>
-      )}
     </div>
   );
 }

+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { QUERY_OPEN_EVENT, signal } from "../apiContract";
+import { FolderMark } from "../customer-grid/icons";
+import { queryCitationLabel } from "../customer-grid/queryPreview";
 import { retryEmit } from "../inbox/inboxModel";
+import { DbIcon } from "../shell/dbFrame";
+import { databaseEntries, QUERY_ROUTE } from "../shell/nav";
 import type { NavEntry } from "../shell/nav";
+import {
+  deleteThread, fetchQueries, submitChat, type QueryCitation, type QueryIndex,
+  type QueryMessage, type SavedQuery,
+} from "../query/queryApi";
 import "./assistant.css";
+export interface AssistantPageProps { granted: NavEntry[]; }
 const KIND_LABEL: Record<string, string> = {
+  grid: "table", list: "list", chart: "chart", kanban: "board", calendar: "calendar",
+  timeseries: "time series", map: "map",
 };
 /**
+ * ⭐⭐ THE MODEL NAMES THE OWNER PICKS FROM (owner item 2, 2026-08-15). Verbatim: *"the user can
+ * choose which model to use since we have a selections of them."*
  *
+ * ⛔ THE WIRE VALUE IS THE PROVIDER KEY AND MUST STAY THE PROVIDER KEY. `routes_query.model_choices`
+ * derives the list from `QUERY_PROVIDER_ORDER`, and `_call_model` looks the choice up in
+ * `harness.analyst.PROVIDERS` by that exact name. This map is a DISPLAY name only, applied to
+ * whatever the server sent — an unknown key falls through to itself rather than being hidden, so a
+ * provider added server-side appears here the day it is added instead of the day someone
+ * remembers to edit this file [[a-flag-can-ship-without-its-writer]].
  */
+const MODEL_LABEL: Record<string, string> = {
+  auto: "Auto", cerebras: "Cerebras", groq: "Groq", openrouter: "OpenRouter",
+  anthropic: "Claude", openai: "OpenAI",
+};
+const modelLabel = (key: string) => MODEL_LABEL[key] ?? key;
+/** Route to the exact Query-owned artefact. C owns the destination wiring, not this page. */
 export function openBuiltView(qid: string): () => void {
   if (typeof window === "undefined") return () => {};
+  if (window.location.hash.replace(/^#\/?/, "") !== QUERY_ROUTE) window.location.hash = `#/${QUERY_ROUTE}`;
+  return retryEmit(() => signal(QUERY_OPEN_EVENT, { qid }));
 }
 /**
+ * R9's provenance, as a DISCLOSURE. Every clause the ruling requires is present — sources,
+ * fields, filters, aggregation, contributing record count, retrieval time, each a link to the
+ * exact artefact — but shut by default, because a chat that prints its own audit trail under
+ * every sentence is not the "plain look" the owner asked for and is not readable as an answer.
  */
+export function CitationLine({ citation }: { citation: QueryCitation }) {
+  return <a className="as-citation" href={citation.href}>{queryCitationLabel(citation)}</a>;
+}
+export function AssistantMessage({ message, view, citations, onPreview }: {
+  message: QueryMessage; view?: SavedQuery; citations: QueryCitation[]; onPreview: (id: string) => void;
 }) {
+  const [openSources, setOpenSources] = useState(false);
+  const matching = citations.filter((citation) => (message.citationIds || []).includes(citation.id));
+  if (message.role === "user") {
     return (
+      <article className="as-message as-message--user">
+        <p className="as-bubble">{message.content}</p>
+      </article>
     );
   }
+  const numeric = message.numeric;
   return (
+    <article className={"as-message as-message--assistant" + (message.reason ? " is-refusal" : "")}>
+      <p className="as-message-text">{message.content}</p>
+      {numeric && numeric.value !== null && numeric.value !== undefined ? (
+        <p className="as-numeric">
+          <span className="as-numeric-label">{numeric.label}</span>
+          <strong className="as-numeric-value">{numeric.value.toLocaleString()}</strong>
         </p>
       ) : null}
+      {view ? (
+        <button type="button" className="as-preview" onClick={() => onPreview(view.id)}>
+          <span className="as-preview-name">{view.name}</span>
+          {/* ⚠ ONE expression, not three text nodes. `Open the {x} in Query` renders under SSR as
+              `Open the<!-- -->table<!-- --> in Query`, so a check reading the sentence back sees
+              a string nobody wrote [[ui-invisible-to-assertions]]. */}
+          <span className="as-preview-meta">{`Open the ${KIND_LABEL[view.kind] ?? view.kind} in Query`}</span>
         </button>
+      ) : null}
+      {matching.length ? (
+        <div className="as-sources">
+          <button type="button" className="as-sources-btn" aria-expanded={openSources}
+            onClick={() => setOpenSources(!openSources)}>
+            {openSources ? "Hide sources" : "Sources"}
+          </button>
+          {openSources ? (
+            <div className="as-sources-list">
+              {matching.map((citation) => <CitationLine key={citation.id} citation={citation} />)}
+            </div>
+          ) : null}
+        </div>
+      ) : null}
+    </article>
   );
 }
+function initialIndex(): QueryIndex {
+  return { threads: [], messages: [], views: [], citations: [], models: ["auto"], sources: [] };
 }
+/**
+ * ⭐⭐ OWNER ITEM 2 (2026-08-15) — A PLAIN CHATBOT, IN THREE BORROWED SHAPES.
+ *
+ * Verbatim: *"AI assistant module should be a plain chatbot interface where the user can choose
+ * which model to use… I really like the plain look for Glean… Notice how the database you can
+ * select is at the bottom there with all the logos, that's how we should allow user to select
+ * databases too… The interface should exactly be like ChatGPT… ALSO I want a navigation for the
+ * chat EXACTLY like how Airtable does it."*
+ *
+ * So the surface is assembled from the three references the owner supplied, each for the part it
+ * is actually about:
+ *   · `reference/ChatGPT 1.png` — the CONVERSATION: one centred column, the question as a bubble
+ *     on the right, the answer as plain flowing text with no label and no bubble, the composer
+ *     pinned to the bottom with its controls INSIDE the field.
+ *   · `reference/Glean 1.png` — the SOURCES: a row of chips carrying each source's own mark,
+ *     directly under the composer. Not a dropdown, not a settings panel.
+ *   · `reference/Airtable AI 1.png` — the NAVIGATION: "New chat" at the top of a left panel, the
+ *     thread list under it, and a centred "How can I help?" when the thread is empty.
+ *
+ * ⛔ WHAT IS DELIBERATELY NOT COPIED: ChatGPT's dark canvas and Glean's vendor logos. The palette
+ * is Loopable's own (`DESIGN.md`, and the font-token rule is gated app-wide over every CSS file
+ * in this tree), and the chips wear `FolderMark` — the SAME mark the nav rail draws for that
+ * database — because a brand logo for someone else's product is what those references have and
+ * this product's databases are not brands. "Exactly like" is about the interaction shape.
+ *
+ * ⚠ AND THE TOOL BOUNDARY IS NARROWER THAN THE SENTENCE "the chatbot can basically call the tools
+ * in our App". Under ruling R1 the assistant operates the caller's permitted database/view tools
+ * and nothing else: server-side there is exactly ONE tool, `build_view`. It cannot run an
+ * automation, touch a connector, or change a setting, and no part of this page implies it can.
+ */
 export default function AssistantPage({ granted }: AssistantPageProps) {
+  const [index, setIndex] = useState<QueryIndex>(initialIndex);
+  const [activeThread, setActiveThread] = useState("");
+  const [selected, setSelected] = useState<string[]>([]);
+  const [target, setTarget] = useState("");
+  const [model, setModel] = useState("auto");
   const [question, setQuestion] = useState("");
   const [busy, setBusy] = useState(false);
   const [problem, setProblem] = useState("");
   const [loaded, setLoaded] = useState(false);
+  const [confirmThread, setConfirmThread] = useState("");
   const openCancel = useRef<(() => void) | null>(null);
+  const foot = useRef<HTMLDivElement | null>(null);
+  const databases = useMemo(() => databaseEntries(granted).filter((entry) => entry.kind !== "group"), [granted]);
+  const labels = useMemo(() => new Map(databases.map((entry) => [entry.key, entry.label])), [databases]);
   /**
+   * ⭐⭐ WHICH CHIPS CAN ACTUALLY BE ASKED, and why the ones that cannot say so.
+   * The nav grants twelve databases on tenant #0 and the read boundary can answer for two: the
+   * ten `ut_odoo_*` grids are served through the connector mirror, which the Assistant refuses by
+   * design. Offering ten doors that cannot open — and letting the reader discover it one spent
+   * prompt at a time — is the same defect shape as a rail that paints two rows differently from
+   * five. ⚠ Absent from the map ⇒ TREATED AS ANSWERABLE: the server is the authority and its
+   * refusal is still the wall; a client that greyed out everything it had not heard about would
+   * hide a working source the moment this field failed to arrive.
    */
+  const sourceStatus = useMemo(
+    () => new Map(index.sources.map((row) => [row.database, row])), [index.sources]);
+  const blockedReason = useCallback(
+    (key: string) => (sourceStatus.get(key)?.answerable === false
+      ? sourceStatus.get(key)?.reason || "this database cannot be asked yet" : ""),
+    [sourceStatus]);
+  const messages = index.messages.filter((row) => row.threadId === activeThread);
+  const viewById = useMemo(() => new Map(index.views.map((view) => [view.id, view])), [index.views]);
   const reload = useCallback(async () => {
+    const result = await fetchQueries();
     setLoaded(true);
+    if (result.ok) {
+      setIndex(result.value);
+      setModel((current) => result.value.models.includes(current) ? current : "auto");
     }
   }, []);
+  useEffect(() => { void reload(); }, [reload]);
+  useEffect(() => () => openCancel.current?.(), []);
   useEffect(() => {
+    const permitted = databases.map((entry) => entry.key);
+    setSelected((current) => current.filter((key) => permitted.includes(key)));
+    setTarget((current) => permitted.includes(current) ? current : "");
+  }, [databases]);
+  // The conversation reads bottom-up, like every chat the owner named.
+  useEffect(() => { foot.current?.scrollIntoView({ block: "end" }); }, [messages.length, busy]);
+  const newChat = useCallback(() => {
+    setActiveThread(""); setQuestion(""); setProblem("");
+  }, []);
+  /** Opening a past chat restores the sources and the model it ran with (R6). */
+  const openThread = useCallback((id: string) => {
+    setActiveThread(id); setProblem("");
+    const row = index.threads.find((thread) => thread.id === id);
+    if (!row) return;
+    const permitted = databases.map((entry) => entry.key);
+    const sources = (row.sources || []).filter((key) => permitted.includes(key));
+    if (sources.length) { setSelected(sources); setTarget(sources[0]); }
+    if (row.model && index.models.includes(row.model)) setModel(row.model);
+  }, [databases, index.models, index.threads]);
+  const toggleSource = useCallback((key: string) => {
+    if (blockedReason(key)) return;
+    setSelected((current) => {
+      const next = current.includes(key) ? current.filter((item) => item !== key) : [...current, key];
+      setTarget((currentTarget) => next.includes(currentTarget) ? currentTarget : next[0] || "");
+      return next;
+    });
+  }, [blockedReason]);
   const ask = useCallback(async () => {
+    const text = question.trim();
+    if (!text || !target || !selected.includes(target) || busy) return;
+    setBusy(true); setProblem("");
+    const result = await submitChat({ question: text, database: target, sources: selected,
+      ...(activeThread ? { threadId: activeThread } : {}), model });
     setBusy(false);
+    if (!result.ok) { setProblem(result.message); return; }
     setQuestion("");
+    setActiveThread(result.value.thread.id);
+    setIndex((current) => ({
+      ...current,
+      threads: [result.value.thread, ...current.threads.filter((row) => row.id !== result.value.thread.id)],
+      messages: [...current.messages, result.value.userMessage, result.value.message],
+      views: result.value.view ? [result.value.view, ...current.views.filter((row) => row.id !== result.value.view?.id)] : current.views,
+      citations: [...current.citations, ...result.value.citations],
+    }));
+  }, [activeThread, busy, model, question, selected, target]);
+  /** ⛔ The chat goes; the views it built STAY (they live in Query). Two-click, in the row. */
+  const removeThread = useCallback(async (id: string) => {
+    const result = await deleteThread(id);
+    if (!result.ok) { setProblem(result.message); return; }
+    setIndex((current) => ({
+      ...current,
+      threads: current.threads.filter((row) => row.id !== id),
+      messages: current.messages.filter((row) => row.threadId !== id),
+    }));
+    setActiveThread((current) => (current === id ? "" : current));
+    setConfirmThread("");
+  }, []);
+  const preview = useCallback((qid: string) => {
     openCancel.current?.();
     openCancel.current = openBuiltView(qid);
   }, []);
+  const empty = messages.length === 0;
+  const composer = (
+    <div className="as-composer">
+      <div className="as-field">
+        <textarea
+          className="as-prompt"
+          value={question}
+          rows={1}
+          placeholder={target ? `Ask about ${labels.get(target) || target}…` : "Pick a database below, then ask…"}
+          aria-label="Ask the assistant"
+          onChange={(event) => setQuestion(event.currentTarget.value)}
+          onKeyDown={(event) => {
+            if (event.key === "Enter" && !event.shiftKey) { event.preventDefault(); void ask(); }
+          }}
+        />
+        <div className="as-field-foot">
+          {/* ChatGPT puts its model control inside the field, as text rather than a boxed
+              form control. A native `select` keeps the keyboard and screen-reader behaviour
+              a hand-rolled popover would have to re-earn. */}
+          <label className="as-pick">
+            <span className="as-pick-label">Model</span>
+            <select className="as-pick-select" value={model} aria-label="Model"
+              onChange={(event) => setModel(event.currentTarget.value)}>
+              {index.models.map((choice) => (
+                <option key={choice} value={choice}>{modelLabel(choice)}</option>
               ))}
             </select>
           </label>
+          {/* ⚠ ONLY WHEN THE ANSWER IS AMBIGUOUS. Every generated view names ONE database (R3);
+              with a single source selected that database is not a question, so asking it would
+              be chrome for its own sake. */}
+          {selected.length > 1 ? (
+            <label className="as-pick">
+              <span className="as-pick-label">Build on</span>
+              <select className="as-pick-select" value={target} aria-label="Target database"
+                onChange={(event) => setTarget(event.currentTarget.value)}>
+                {selected.map((key) => <option key={key} value={key}>{labels.get(key) || key}</option>)}
+              </select>
+            </label>
+          ) : null}
+          <button type="button" className="as-send" aria-label="Send"
+            disabled={busy || !question.trim() || !target} onClick={() => void ask()}>
+            <svg viewBox="0 0 16 16" aria-hidden="true" width="15" height="15">
+              <path d="M8 13V3.6M4 7.4 8 3.4l4 4" />
+            </svg>
           </button>
+        </div>
+      </div>
+      {/* Glean's row: the sources, with their marks, under the field. */}
+      <div className="as-chips" role="group" aria-label="Databases the assistant may read">
+        {databases.map((database) => {
+          const on = selected.includes(database.key);
+          const blocked = blockedReason(database.key);
+          return (
+            <button type="button" key={database.key}
+              className={"as-chip" + (on ? " is-selected" : "")
+                + (database.key === target ? " is-target" : "") + (blocked ? " is-blocked" : "")}
+              aria-pressed={on}
+              aria-disabled={blocked ? true : undefined}
+              title={blocked || undefined}
+              onClick={() => toggleSource(database.key)}>
+              <span className="as-chip-mark" aria-hidden="true">
+                {database.icon ? <FolderMark icon={database.icon} size={14} /> : <DbIcon />}
+              </span>
+              <span className="as-chip-name">{database.label}</span>
+            </button>
+          );
+        })}
+        {/* ⚠ ONE sentence for the whole row, not one per chip: with ten blocked sources the
+            per-chip copy would be the loudest thing on a surface whose whole instruction was
+            "plain". The chip carries the exact cause in its `title`. */}
+        {databases.some((database) => blockedReason(database.key)) ? (
+          <p className="as-chips-note">
+            Greyed databases are served live from a connector and cannot be asked yet.
+          </p>
+        ) : null}
+        {databases.length === 0 && loaded ? (
+          <p className="as-chips-empty">No databases are shared with your account yet.</p>
+        ) : null}
+      </div>
+    </div>
+  );
+  return (
+    <div className="as-chat" aria-label="AI assistant">
+      {/* Airtable's panel: one door to a new chat, then the history. */}
+      <aside className="as-history">
+        <button type="button" className="as-new" onClick={newChat}>
+          <svg viewBox="0 0 16 16" aria-hidden="true" width="14" height="14">
+            <path d="M8 3.5v9M3.5 8h9" />
+          </svg>
+          New chat
+        </button>
+        <nav className="as-thread-list" aria-label="Chat history">
+          {index.threads.map((row) => (
+            <div className={"as-thread-row" + (row.id === activeThread ? " is-active" : "")} key={row.id}>
+              <button type="button" className="as-thread"
+                onClick={() => { setConfirmThread(""); openThread(row.id); }}
+                title={row.title}>{row.title}</button>
+              {confirmThread === row.id ? (
+                <button type="button" className="as-thread-confirm"
+                  onClick={() => void removeThread(row.id)}>Delete</button>
+              ) : (
+                <button type="button" className="as-thread-del" aria-label={`Delete chat: ${row.title}`}
+                  onClick={() => setConfirmThread(row.id)}>
+                  <svg viewBox="0 0 16 16" aria-hidden="true" width="13" height="13">
+                    <path d="M3.5 4.5h9M6.5 4.5V3.2h3v1.3M5 4.5l.6 8h4.8l.6-8" />
+                  </svg>
+                </button>
+              )}
+            </div>
           ))}
+          {loaded && index.threads.length === 0 ? (
+            <p className="as-thread-empty">No chats yet.</p>
+          ) : null}
+        </nav>
+      </aside>
+      <main className="as-conversation">
+        {empty ? (
+          <div className="as-opening">
+            <h1 className="as-opening-h">How can I help?</h1>
+            <p className="as-opening-p">
+              Ask about a database you can already open. The answer arrives as a view in Query.
+            </p>
+            {composer}
+            {problem ? <p className="as-problem" role="status">{problem}</p> : null}
+          </div>
+        ) : (
+          <>
+            <div className="as-stream">
+              <div className="as-column">
+                {messages.map((message) => (
+                  <AssistantMessage key={message.id} message={message}
+                    view={message.viewId ? viewById.get(message.viewId) : undefined}
+                    citations={index.citations} onPreview={preview} />
+                ))}
+                {busy ? (
+                  <p className="as-working" role="status">
+                    <span className="lp-spin" aria-hidden="true" />
+                  </p>
+                ) : null}
+                <div ref={foot} />
+              </div>
+            </div>
+            <div className="as-dock">
+              <div className="as-column">
+                {problem ? <p className="as-problem" role="status">{problem}</p> : null}
+                {composer}
+              </div>
+            </div>
+          </>
+        )}
+      </main>
     </div>
   );
 }

web/src/assistant/assistant.css CHANGED Viewed

@@ -1,280 +1,486 @@
 /* ---------------------------------------------------------------------------
-   assistant/assistant.css — the AI assistant's own stylesheet (owner item 2,
-   2026-08-14).
-   ⭐ THESE RULES ARE `query.css`'s ASK/ANSWER/LIST RULES, MOVED — not copied and
-   not re-invented. The ask box left the Query module when Query became the
-   database frame the owner asked for, and the styling went with the markup it
-   styles. `query.css` keeps only what the new Query page still draws. A copy in
-   both files would be two places for one look to drift.
-   Shipped BESIDE its component (the `FormInterface.css` / `query.css`
-   precedent) rather than added to `index.css`. Vite carries the import;
-   `verify_ui`'s node shim already stubs the CSS require for exactly this shape.
-   ⛔ EVERY FONT SIZE IS A `--lp-fs-*` TOKEN AND EVERY COLOUR A `--lp-*` TOKEN.
    Wave-21 R5 is gated app-wide over every CSS file under src, and a literal
    here reds `web_ui` for the whole tree. No emojis, no ALL-CAPS chrome
    (DESIGN.md R6).
-   ⛔⛔ AND DO NOT WRITE A GLOB IN THIS COMMENT. A star-star followed by a slash
-   spells the CSS COMMENT TERMINATOR, so the comment would end mid-sentence,
-   every line after it would become stray tokens, and `lightningcss` dies on the
-   first backtick it then meets. `tsc` passes and `vite` transforms every module
-   — the build fails in the MINIFIER, nowhere near the sentence that caused it.
-   That cost wave 32 a deploy.
 --------------------------------------------------------------------------- */
-.as-page {
   height: 100%;
-  overflow-y: auto;
-  padding: 34px 44px 56px;
-  box-sizing: border-box;
-  background: var(--lp-wash);
 }
-.as-title {
-  display: flex;
-  align-items: center;
-  gap: 9px;
-  margin: 0 0 6px;
-  font-size: var(--lp-fs-lg);
-  font-weight: 650;
-  color: var(--lp-ink);
-}
-.as-lede {
-  margin: 0 0 22px;
-  max-width: 62ch;
-  font-size: var(--lp-fs-sm);
-  line-height: var(--lp-lh);
-  color: var(--lp-muted);
 }
-.as-sub {
-  margin: 30px 0 12px;
-  font-size: var(--lp-fs-md);
-  font-weight: 650;
   color: var(--lp-ink);
 }
-/* ── the ask row ─────────────────────────────────────────────────────────── */
-.as-ask {
-  display: flex;
-  flex-wrap: wrap;
-  align-items: flex-end;
-  gap: 12px;
-  max-width: 940px;
 }
-.as-field {
   display: flex;
   flex-direction: column;
-  gap: 5px;
-  min-width: 180px;
-}
-.as-field--grow {
-  flex: 1 1 380px;
-}
-.as-label {
-  font-size: var(--lp-fs-2xs);
-  font-weight: 600;
-  color: var(--lp-muted);
 }
-.as-select,
-.as-input {
-  box-sizing: border-box;
-  width: 100%;
-  padding: 8px 11px;
-  border: 1px solid var(--lp-line);
   border-radius: var(--lp-r-md);
-  background: var(--lp-surface);
-  color: var(--lp-ink);
-  font-size: var(--lp-fs-sm);
-  font-family: inherit;
 }
-.as-select:focus-visible,
-.as-input:focus-visible {
-  outline: 2px solid var(--lp-blue-solid);
-  outline-offset: 1px;
-}
-/* ── buttons ─────────────────────────────────────────────────────────────── */
-.as-btn {
-  padding: 8px 14px;
-  border: 1px solid var(--lp-line);
   border-radius: var(--lp-r-md);
-  background: var(--lp-surface);
   color: var(--lp-ink);
-  font-size: var(--lp-fs-sm);
-  font-family: inherit;
-  font-weight: 600;
   cursor: pointer;
 }
-.as-btn:hover:not(:disabled) {
-  background: var(--lp-surface-2);
 }
-.as-btn:disabled {
-  opacity: 0.55;
-  cursor: default;
 }
-.as-btn--primary {
-  border-color: transparent;
-  background: var(--lp-blue-solid);
   color: var(--lp-surface);
 }
-.as-btn--primary:hover:not(:disabled) {
-  background: color-mix(in srgb, var(--lp-blue-solid) 82%, #000);
 }
-.as-btn--quiet {
-  border-color: transparent;
-  background: transparent;
-  color: var(--lp-muted);
-  font-weight: 500;
 }
-.as-btn--quiet:hover {
-  color: var(--lp-red-deep);
-  background: transparent;
 }
-/* ── the answer, and the read-back that is the point of it ───────────────── */
-.as-answer {
-  max-width: 940px;
-  margin: 20px 0 0;
-  padding: 16px 18px;
-  border: 1px solid var(--lp-line);
-  border-left: 3px solid var(--lp-blue-solid);
-  border-radius: var(--lp-r-md);
   background: var(--lp-surface);
 }
-.as-answer.is-refused {
-  border-left-color: var(--lp-yellow-deep);
 }
-.as-answer-head {
   margin: 0 0 6px;
-  font-size: var(--lp-fs-2xs);
   font-weight: 650;
-  color: var(--lp-muted);
 }
-.as-answer-body {
-  margin: 0;
-  max-width: 78ch;
   font-size: var(--lp-fs-sm);
   line-height: var(--lp-lh);
-  color: var(--lp-ink);
 }
-/* The backup-model notice (W33-T50). ⚠ Deliberately a CAUTION and not an alarm: the answer is
-   usable, it just deserves a closer read, and `is-refused` one rule up already owns the stronger
-   voice with the same yellow. Sized down and muted so it reads as a footnote to the read-back
-   rather than competing with it — DESIGN.md's "never over-explain" applied to a warning. */
-.as-answer-note {
-  margin: 8px 0 0;
-  max-width: 78ch;
-  font-size: var(--lp-fs-2xs);
-  line-height: var(--lp-lh);
-  color: var(--lp-yellow-deep);
 }
-.as-answer-acts {
   display: flex;
-  gap: 10px;
-  margin-top: 14px;
 }
-/* ── the list of what the assistant has built ────────────────────────────── */
-.as-note {
-  max-width: 62ch;
-  margin: 14px 0 0;
   font-size: var(--lp-fs-sm);
   line-height: var(--lp-lh);
-  color: var(--lp-muted);
 }
-.as-note.is-warn {
-  color: var(--lp-red-deep);
 }
-.as-list {
   display: flex;
   flex-direction: column;
-  gap: 10px;
-  max-width: 940px;
-  margin: 0;
   padding: 0;
-  list-style: none;
 }
-.as-row {
-  padding: 14px 16px;
   border: 1px solid var(--lp-line);
-  border-radius: var(--lp-r-md);
   background: var(--lp-surface);
 }
-.as-row-main {
   display: flex;
-  flex-wrap: wrap;
-  align-items: baseline;
-  gap: 10px;
 }
-.as-row-open {
-  padding: 0;
   border: 0;
   background: transparent;
-  color: var(--lp-blue-solid);
-  font-size: var(--lp-fs-md);
-  font-family: inherit;
-  font-weight: 650;
   cursor: pointer;
-  text-align: left;
 }
-.as-row-open:hover {
-  text-decoration: underline;
 }
-.as-row-meta {
   font-size: var(--lp-fs-2xs);
   color: var(--lp-muted);
 }
-.as-row-q {
-  margin: 6px 0 0;
-  max-width: 78ch;
-  font-size: var(--lp-fs-sm);
-  font-style: italic;
-  color: var(--lp-ink);
 }
-.as-row-explain {
-  margin: 4px 0 0;
-  max-width: 78ch;
-  font-size: var(--lp-fs-2xs);
-  line-height: var(--lp-lh);
   color: var(--lp-muted);
 }
-.as-row-acts {
-  display: flex;
-  gap: 8px;
-  margin-top: 12px;
 }

 /* ---------------------------------------------------------------------------
+   assistant/assistant.css — the AI assistant's chat surface (owner item 2).
+   The shape is borrowed, reference by reference: ChatGPT's centred column and
+   in-field composer, Glean's source chips under the field, Airtable's "New
+   chat" panel. The PALETTE is Loopable's own — see AssistantPage.tsx's note on
+   why the dark canvas and the vendor logos are the parts not copied.
+   EVERY FONT SIZE IS A `--lp-fs-*` TOKEN AND EVERY COLOUR A `--lp-*` TOKEN.
    Wave-21 R5 is gated app-wide over every CSS file under src, and a literal
    here reds `web_ui` for the whole tree. No emojis, no ALL-CAPS chrome
    (DESIGN.md R6).
+   AND DO NOT WRITE A GLOB IN THIS COMMENT: a star-star followed by a slash is
+   the CSS comment terminator, and `lightningcss` then dies far from the cause.
 --------------------------------------------------------------------------- */
+.as-chat {
+  display: flex;
+  width: 100%;
   height: 100%;
+  min-width: 0;
+  overflow: hidden;
+  background: var(--lp-surface);
 }
+/* ── Airtable's panel: New chat, then the history ─────────────────────────── */
+.as-history {
+  flex: 0 0 var(--lp-rail-w);
+  width: var(--lp-rail-w);
+  min-width: var(--lp-rail-w);
+  height: 100%;
+  box-sizing: border-box;
+  display: flex;
+  flex-direction: column;
+  padding: 10px 8px;
+  border-right: 1px solid var(--lp-line);
+  background: var(--lp-surface);
+  overflow: hidden;
 }
+.as-new {
+  flex: 0 0 auto;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-height: 34px;
+  padding: 7px 10px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  background: var(--lp-surface);
   color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  font-weight: 600;
+  text-align: left;
+  cursor: pointer;
 }
+.as-new:hover { background: var(--lp-surface-2); }
+.as-new svg {
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.6;
+  stroke-linecap: round;
 }
+.as-thread-list {
+  flex: 1 1 auto;
+  min-height: 0;
+  margin-top: 10px;
+  overflow-y: auto;
   display: flex;
   flex-direction: column;
+  gap: 1px;
 }
+.as-thread-row {
+  display: flex;
+  align-items: center;
+  min-width: 0;
   border-radius: var(--lp-r-md);
 }
+.as-thread-row:hover { background: var(--lp-surface-2); }
+.as-thread-row.is-active { background: var(--lp-blue-tint); }
+.as-thread-row.is-active .as-thread { font-weight: 600; }
+.as-thread {
+  flex: 1 1 auto;
+  min-width: 0;
+  min-height: 30px;
+  padding: 6px 10px;
+  border: 0;
   border-radius: var(--lp-r-md);
+  background: transparent;
   color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  text-align: left;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
   cursor: pointer;
 }
+.as-thread-del {
+  flex: 0 0 auto;
+  width: 24px;
+  height: 24px;
+  margin-right: 4px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+  border-radius: 6px;
+  background: transparent;
+  color: var(--lp-muted);
+  opacity: 0;
+  cursor: pointer;
 }
+.as-thread-del svg {
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.3;
+  stroke-linecap: round;
+  stroke-linejoin: round;
 }
+.as-thread-row:hover .as-thread-del,
+.as-thread-row.is-active .as-thread-del,
+.as-thread-del:focus-visible { opacity: 1; }
+.as-thread-confirm {
+  flex: 0 0 auto;
+  margin-right: 4px;
+  padding: 3px 8px;
+  border: 0;
+  border-radius: 6px;
+  background: var(--lp-red-deep);
   color: var(--lp-surface);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  cursor: pointer;
 }
+.as-thread-empty {
+  margin: 8px 10px 0;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
 }
+/* ── ChatGPT's column ─────────────────────────────────────────────────────── */
+.as-conversation {
+  flex: 1 1 auto;
+  min-width: 0;
+  height: 100%;
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
 }
+/* One measure, used by the stream, the dock and the opening state, so the
+   composer does not shift sideways when the first answer arrives. */
+.as-column {
+  width: 100%;
+  max-width: 760px;
+  margin: 0 auto;
+  padding: 0 24px;
+  box-sizing: border-box;
 }
+.as-stream {
+  flex: 1 1 auto;
+  min-height: 0;
+  overflow-y: auto;
+  padding: 26px 0 8px;
+}
+.as-dock {
+  flex: 0 0 auto;
+  padding: 6px 0 18px;
   background: var(--lp-surface);
 }
+.as-opening {
+  flex: 1 1 auto;
+  min-height: 0;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  padding: 24px;
+  box-sizing: border-box;
+  text-align: center;
 }
+.as-opening-h {
   margin: 0 0 6px;
+  color: var(--lp-ink);
+  font-size: var(--lp-fs-lg);
   font-weight: 650;
 }
+.as-opening-p {
+  max-width: 52ch;
+  margin: 0 0 20px;
+  color: var(--lp-muted);
   font-size: var(--lp-fs-sm);
   line-height: var(--lp-lh);
 }
+.as-opening .as-composer {
+  width: 100%;
+  max-width: 700px;
+  text-align: left;
 }
+/* ── the messages ─────────────────────────────────────────────────────────── */
+.as-message { margin: 0 0 22px; }
+.as-message--user {
   display: flex;
+  justify-content: flex-end;
 }
+.as-bubble {
+  max-width: 78%;
+  margin: 0;
+  padding: 9px 14px;
+  border-radius: 18px;
+  background: var(--lp-surface-2);
+  color: var(--lp-ink);
+  font-size: var(--lp-fs-sm);
+  line-height: var(--lp-lh);
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+/* No bubble and no "Assistant" label: the reference prints the answer as the
+   page's own prose, and a role label on every turn is the thing that makes a
+   chat read like a transcript instead of a reply. */
+.as-message-text {
+  margin: 0;
+  color: var(--lp-ink);
   font-size: var(--lp-fs-sm);
   line-height: var(--lp-lh);
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
 }
+.as-message--assistant.is-refusal .as-message-text { color: var(--lp-muted); }
+.as-numeric {
+  display: flex;
+  align-items: baseline;
+  gap: 8px;
+  margin: 10px 0 0;
 }
+.as-numeric-label { color: var(--lp-muted); font-size: var(--lp-fs-2xs); }
+.as-numeric-value { color: var(--lp-ink); font-size: var(--lp-fs-md); font-weight: 650; }
+.as-preview {
   display: flex;
   flex-direction: column;
+  gap: 2px;
+  margin-top: 12px;
+  padding: 9px 13px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  background: var(--lp-surface);
+  font: inherit;
+  text-align: left;
+  cursor: pointer;
+}
+.as-preview:hover { background: var(--lp-surface-2); }
+.as-preview-name { color: var(--lp-ink); font-size: var(--lp-fs-xs); font-weight: 600; }
+.as-preview-meta { color: var(--lp-blue-solid); font-size: var(--lp-fs-2xs); font-weight: 600; }
+.as-sources { margin-top: 8px; }
+.as-sources-btn {
   padding: 0;
+  border: 0;
+  background: transparent;
+  color: var(--lp-muted);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  cursor: pointer;
 }
+.as-sources-btn:hover { color: var(--lp-ink); }
+.as-sources-list {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  margin-top: 6px;
+}
+.as-citation {
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+  line-height: var(--lp-lh);
+  text-decoration: none;
+  overflow-wrap: anywhere;
+}
+.as-citation:hover { color: var(--lp-blue-solid); text-decoration: underline; }
+.as-working { margin: 0 0 22px; }
+.as-problem {
+  margin: 0 0 10px;
+  color: var(--lp-red-deep);
+  font-size: var(--lp-fs-2xs);
+}
+/* ── the composer ─────────────────────────────────────────────────────────── */
+.as-field {
   border: 1px solid var(--lp-line);
+  border-radius: 22px;
   background: var(--lp-surface);
+  padding: 10px 8px 8px 16px;
+  box-shadow: 0 1px 2px rgba(20, 24, 40, 0.05);
+}
+.as-field:focus-within { border-color: var(--lp-blue-solid); }
+.as-prompt {
+  display: block;
+  width: 100%;
+  max-height: 180px;
+  border: 0;
+  outline: none;
+  padding: 0 8px 0 0;
+  background: transparent;
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-sm);
+  line-height: var(--lp-lh);
+  resize: none;
+  box-sizing: border-box;
 }
+.as-prompt::placeholder { color: var(--lp-muted); }
+.as-field-foot {
   display: flex;
+  align-items: center;
+  gap: 12px;
+  margin-top: 8px;
 }
+.as-pick {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+  min-width: 0;
+}
+.as-pick-label { color: var(--lp-muted); font-size: var(--lp-fs-2xs); }
+/* Text, not a boxed control — ChatGPT's "Instant" reads as part of the field. */
+.as-pick-select {
+  max-width: 150px;
   border: 0;
   background: transparent;
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  cursor: pointer;
+}
+.as-send {
+  flex: 0 0 auto;
+  margin-left: auto;
+  width: 30px;
+  height: 30px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+  border-radius: 999px;
+  background: var(--lp-ink);
+  color: var(--lp-surface);
   cursor: pointer;
 }
+.as-send svg { fill: none; stroke: currentColor; stroke-width: 1.7; stroke-linecap: round; stroke-linejoin: round; }
+.as-send:disabled { background: var(--lp-surface-2); color: var(--lp-muted); cursor: default; }
+/* ── Glean's chips ────────────────────────────────────────────────────────── */
+.as-chips {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  margin-top: 10px;
+  padding: 0 6px;
 }
+.as-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  max-width: 220px;
+  padding: 5px 11px;
+  border: 1px solid transparent;
+  border-radius: 999px;
+  background: var(--lp-surface-2);
+  color: var(--lp-ink);
+  font: inherit;
   font-size: var(--lp-fs-2xs);
+  font-weight: 500;
+  cursor: pointer;
+}
+.as-chip:hover { border-color: var(--lp-line); }
+.as-chip.is-selected { background: var(--lp-blue-tint); border-color: var(--lp-blue-tint); font-weight: 600; }
+/* The one the answer will be built on, when more than one is picked (R3). */
+.as-chip.is-target { border-color: var(--lp-blue-solid); }
+.as-chip-mark {
+  flex: 0 0 auto;
+  display: inline-flex;
+  width: 14px;
+  height: 14px;
   color: var(--lp-muted);
 }
+.as-chip-mark svg {
+  width: 14px;
+  height: 14px;
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.4;
+  stroke-linecap: round;
+  stroke-linejoin: round;
 }
+.as-chip.is-selected .as-chip-mark { color: var(--lp-blue-solid); }
+.as-chip-name {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+/* A source this caller holds and cannot ask (see AssistantPage's note): still visible, because
+   an artefact already built on it stays listed — but plainly not a door. */
+.as-chip.is-blocked {
   color: var(--lp-muted);
+  background: transparent;
+  border-color: var(--lp-line);
+  border-style: dashed;
+  cursor: default;
 }
+.as-chip.is-blocked .as-chip-mark { opacity: 0.5; }
+.as-chip.is-blocked:hover { border-color: var(--lp-line); }
+.as-chips-note {
+  flex: 1 0 100%;
+  margin: 2px 0 0;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+}
+.as-chips-empty {
+  margin: 2px 0 0;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
 }

web/src/customer-grid/CustomerGrid.tsx CHANGED Viewed

@@ -25,6 +25,9 @@ import "@glideapps/glide-data-grid/dist/index.css";
 import { useCustomerData } from "./useCustomerData";
 import type { SurfaceScope } from "./apiBridge";
 // ⭐ WAVE 30 · W30-T42 (contract C2) — the WINDOWED grid's arithmetic, pure and node-run in
 // `verify_grid_ux.py`, because every one of these decisions is taken inside a callback where
 // only its own source text could otherwise be checked.
@@ -353,6 +356,37 @@ function allRecordsView(fields: Field[], scope: string): SavedView {
   };
 }
 function readLocal(storageKey: string): LocalWorkspace | null {
   try {
     const raw = localStorage.getItem(`aios-grid:${storageKey}`);
@@ -559,6 +593,8 @@ function buildOverlayField(
  *  re-renders for its own state (edits, resize) and remounts on route change via `key`. */
 interface CustomerGridProps {
   scope?: SurfaceScope;
   /** Read-only Grid view embedded in a linked-record modal. It keeps the standard
    * filter/sort/search toolbar while withdrawing schema and row mutations. */
   embedded?: boolean;
@@ -656,14 +692,62 @@ function LinkGridModal({ label, table, recordIds, editable = false, single = fal
   );
 }
-function CustomerGrid({
   scope = "customer",
   embedded = false,
   embeddedRecordIds,
   embeddedSelectable = false,
   embeddedSelectedIds = [],
   onEmbeddedSelectionChange,
 }: CustomerGridProps = {}) {
   // Wave 16 C-TOPIC: which TABLE this tree is drawing, derived from the one scope prop.
   const topic = topicForScope(scope);
   const {
@@ -676,9 +760,9 @@ function CustomerGrid({
     patchOverlay,
     requestWindow,
   } = useCustomerData(scope, {
-    bindSurface: !embedded,
-    includeWorkspace: !embedded,
-    writable: !embedded,
   });
   const embeddedIdsKey = embeddedRecordIds?.join(",") ?? "";
   /**
@@ -780,7 +864,7 @@ function CustomerGrid({
    */
   const [alerted, setAlerted] = useState<string[]>([]);
   useEffect(() => {
-    if (embedded) return;
     let live = true;
     const pull = () => {
       void fetchAlerts().then((r) => {
@@ -794,7 +878,7 @@ function CustomerGrid({
       live = false;
       window.removeEventListener("focus", pull);
     };
-  }, [embedded, scope]);
   const [fields, setFields] = useState<Field[]>([]);
   const [views, setViews] = useState<SavedView[]>([]);
@@ -963,12 +1047,24 @@ function CustomerGrid({
    * ⚠ Existing browsers lose the contents of the old shared bucket. That is the point: every
    * byte in it is a workspace some other surface persisted, and there is no way to tell whose.
    */
-  const storageKey = payload?.workspace?.storageKey ?? `local:${scope}`;
   // Initialize once per permission/data scope. Host state wins; local state
   // fills only missing objects and keeps the standalone path useful.
   useEffect(() => {
     if (!payload || payloadFields.length === 0 || initializedKey.current === storageKey) return;
     const local = embedded ? null : readLocal(storageKey);
     // Item 3c: the def half of the no-blip layer. A RECENT local stamp beats a
     // lagged host echo (rename survives, retype holds, a delete stays deleted);
@@ -1062,7 +1158,7 @@ function CustomerGrid({
      * the config the client is actually filtering with, and sending anything else would ask the
      * host to resolve a question nobody on screen is asking.
      */
-    if (!embedded && reemit.size > 0) {
       const stamped = { ...(local?.reemitted ?? {}) };
       for (const view of initialViews) {
         const key = reemit.get(view.id);
@@ -1077,10 +1173,10 @@ function CustomerGrid({
     } else {
       reemittedRef.current = { ...(local?.reemitted ?? {}) };
     }
-  }, [payload, payloadFields, storageKey, embedded, scope]);
   useEffect(() => {
-    if (!workspaceReady || embedded) return;
     writeLocal(storageKey, {
       fields,
       views,
@@ -1097,7 +1193,7 @@ function CustomerGrid({
       // drop a view this browser created seconds ago.
       viewWrites: pruneTombstones(viewWritesRef.current, Date.now()),
     });
-  }, [workspaceReady, storageKey, fields, views, activeViewId, embedded]);
   /**
    * ⭐ THE LIVE WORKSPACE (owner report, 2026-08-04) — what has APPEARED since we mounted.
@@ -1122,7 +1218,7 @@ function CustomerGrid({
    */
   const hostWorkspaceViews = payload?.workspace?.views;
   useEffect(() => {
-    if (!workspaceReady || embedded) return;
     const now = Date.now();
     const nextFields = adoptNewFields(
       fields, payloadFields, fieldStampsRef.current.deleted, now
@@ -1132,7 +1228,7 @@ function CustomerGrid({
       adoptNewViews(current, hostWorkspaceViews, viewTombstonesRef.current, now,
                     (config) => normalizeConfig(config, nextFields))
     );
-  }, [workspaceReady, hostWorkspaceViews, payloadFields, fields, embedded]);
   /** Item 3c — stamp a def write / a delete. Pruned at every touch so the persisted blob
    *  stays a recent window, never an archive. */
@@ -1155,10 +1251,14 @@ function CustomerGrid({
   const updateConfig = useCallback(
     (next: ViewConfig) => {
       if (next.groupBy !== config.groupBy) setCollapsed(new Set());
       setConfig(next);
     },
-    [config.groupBy]
   );
   const {
@@ -1193,7 +1293,7 @@ function CustomerGrid({
    * this resolves, the appended row does not exist yet, so "bottom" would land on the last OLD
    * row.
    */
-  const isUserTable = !embedded && scope.startsWith("ut_");
   const recordsMutable = payload?.recordsMutable !== false;
   const canMutateRecords = isUserTable && recordsMutable;
   /**
@@ -1351,7 +1451,7 @@ function CustomerGrid({
   // Airtable behavior: configuration changes to the active view autosave.
   useEffect(() => {
-    if (!workspaceReady || embedded) return;
     const active = views.find((view) => view.id === activeViewId);
     if (!active || sameConfig(active.config, config)) {
       setSaveState("saved");
@@ -1373,7 +1473,7 @@ function CustomerGrid({
     return () => {
       if (saveTimer.current !== null) window.clearTimeout(saveTimer.current);
     };
-  }, [workspaceReady, activeViewId, config, views, embedded]);
   // Numeric dimensions force a glide relayout when either the component frame
   // or Streamlit's main column changes width (notably sidebar collapse).
@@ -1404,7 +1504,7 @@ function CustomerGrid({
   const mode = tableMode(payload?.counts);
   const serverWindowed = mode === "server-windowed";
   // Owner items 4+6 — the Cohort page's grid renders without the Views sidebar.
-  const hideViews = embedded || payload?.workspace?.hideViews === true;
   // Wave-6 item 10 — how this view displays. A WINDOWED table is always the grid: list/
   // calendar/kanban compute over the whole matched set, and one page is not it (CG-3's rule,
   // the same reason grouping is off there).
@@ -1542,8 +1642,8 @@ function CustomerGrid({
   // permissions vs the viewer, fail-closed on restricted fields when the viewer is unknown.
   const viewer = payload?.viewer;
   const canEditField = useCallback(
-    (f: Field): boolean => !embedded && recordsMutable && mayEditField(f, viewer),
-    [embedded, recordsMutable, viewer]
   );
   const unresolvedCount = useMemo(
     () => unresolvedConditions(config.filters, { cohortSets, today }),
@@ -3073,14 +3173,26 @@ function CustomerGrid({
   );
   const persistView = useCallback((view: SavedView) => {
     setViews((current) => {
       const found = current.some((item) => item.id === view.id);
       return found
         ? current.map((item) => (item.id === view.id ? view : item))
         : [...current, view];
     });
-    emitHostEvent({ id: eventId("view"), type: "view_upsert", view });
-  }, []);
   /**
    * Item 12 (C-LOCK) — set or clear a view's cohort lock, from the rail's menu.
@@ -3115,6 +3227,7 @@ function CustomerGrid({
   const selectView = useCallback(
     (id: string) => {
       const current = views.find((view) => view.id === activeViewId);
       if (current && !sameConfig(current.config, config))
         persistView({ ...current, config });
@@ -3133,7 +3246,7 @@ function CustomerGrid({
       // Owner item 10: opening a view is "I am working now" — the frame folds its nav rail.
       signal(NAV_MINIMIZE_EVENT);
     },
-    [views, activeViewId, config, persistView, fields]
   );
   /**
@@ -3157,6 +3270,14 @@ function CustomerGrid({
   }, [scope, views, selectView]);
   const createView = useCallback(
     (name: string, mode: DisplayMode, permissions: ViewPermissions) => {
       const acceptedName = uniqueDisplayName(name, views.map((view) => view.name));
       /**
        * ⭐⭐ WAVE 27 · OWNER ITEM 9 / RULING R4 — **A NEW VIEW IS BLANK. ALL OF IT.**
@@ -3214,7 +3335,7 @@ function CustomerGrid({
     },
     // `fields`, not `config` (R4): the blank is derived from the COLUMNS, and reading the live
     // config here at all is what item 9 deletes.
-    [fields, persistView, views]
   );
   const renameView = useCallback(
     (id: string, name: string) => {
@@ -3333,6 +3454,25 @@ function CustomerGrid({
   );
   const deleteView = useCallback(
     (id: string) => {
       const view = views.find((item) => item.id === id);
       // ⚠ This gate used to read `view.locked`, and the menu entry above it did too. C3
       // redefines `locked` as "the DISPLAY MODE is frozen" on ANY view, so leaving the gate
@@ -3348,14 +3488,16 @@ function CustomerGrid({
       // back and (since that merge never removes) stay back. See liveWorkspace.ts.
       viewTombstonesRef.current = stampTombstone(viewTombstonesRef.current, id, Date.now());
       setViews((current) => current.filter((item) => item.id !== id));
-      emitHostEvent({ id: eventId("view-delete"), type: "view_delete", viewId: id });
       if (activeViewId === id) {
         const all = views.find((item) => item.id === ALL_VIEW_ID) ?? allRecordsView(fields, scope);
         setActiveViewId(all.id);
         setConfig(all.config);
       }
     },
-    [views, activeViewId, fields, viewer, scope]
   );
   /**
@@ -5110,7 +5252,7 @@ function CustomerGrid({
   const menuVisIndex = menuField ? visibleKeys.indexOf(menuField.key) : -1;
   const menuPinnedTo = menuVisIndex >= 0 && frozenN > 1 && menuVisIndex + 1 === frozenN;
   // Item 10 — the toolbar's mode switcher (grid-only on windowed tables, see displayMode).
-  const modeControl = serverWindowed || embedded ? undefined : (
     <ModeSwitch
       mode={displayMode}
       onMode={setDisplayMode}
@@ -5212,6 +5354,9 @@ function CustomerGrid({
       data-today={today ?? ""}
       data-measure-rules={measureRuleKeys}
       data-measure-sets={measureSetKeys}
     >
       {/* ⭐ wave17 R1 / C-LOCKV — the COHORT SIDEBAR is gone, and with it the last surface that
           treated a cohort as its own kind of object. `CohortSidebar` was the retired `#/cohort`
@@ -5220,6 +5365,14 @@ function CustomerGrid({
           below renders every one of them and the second rail has nothing to switch between.
           ⚠ `lists` is NOT gone with it — it stays the membership channel that feeds `cohortSets`
           (C-LOCKV point 2), which is what the lock resolves against. */}
       {!hideViews && (
         <ViewSidebar
             // Item 12 (C-LOCK) — the rail's menu is the only emitter of a SAVED `cohortLock`.
@@ -5576,7 +5729,7 @@ function CustomerGrid({
               height={gridSize.height}
               customRenderers={[ratingCellRenderer, userCellRenderer, imageCellRenderer]}
               headerIcons={HEADER_ICONS}
-              rightElement={embedded ? undefined : (
                 // Wave-6 item 4 — the "+" of the header row: the create-field form,
                 // insert-at-end.
                 //
@@ -5770,7 +5923,7 @@ function CustomerGrid({
               docs={payload?.docs}
               docPayload={payload?.docPayload}
               onDocAdd={
-                payload?.docs
                   ? (pid, file) =>
                       emitHostEvent({
                         id: eventId("docadd"),
@@ -5782,13 +5935,13 @@ function CustomerGrid({
                   : undefined
               }
               onDocFetch={
-                payload?.docs
                   ? (pid, docId) =>
                       emitHostEvent({ id: eventId("docget"), type: "doc_fetch", pid, docId })
                   : undefined
               }
               onDocDelete={
-                payload?.docs
                   ? (pid, docId) =>
                       emitHostEvent({ id: eventId("docdel"), type: "doc_delete", pid, docId })
                   : undefined
@@ -6855,7 +7008,7 @@ function CustomerGrid({
           // on the NEXT render via `payload.docPayload`; Documents.tsx matches it
           // to its own pending request before touching it.
           onDocAdd={
-            payload?.docs
               ? (file) =>
                   emitHostEvent({
                     id: eventId("docadd"),
@@ -6867,7 +7020,7 @@ function CustomerGrid({
               : undefined
           }
           onDocFetch={
-            payload?.docs
               ? (docId) =>
                   emitHostEvent({
                     id: eventId("docget"),
@@ -6878,7 +7031,7 @@ function CustomerGrid({
               : undefined
           }
           onDocDelete={
-            payload?.docs
               ? (docId) =>
                   emitHostEvent({
                     id: eventId("docdel"),

 import { useCustomerData } from "./useCustomerData";
 import type { SurfaceScope } from "./apiBridge";
+import { mutateQueryWorkspace, QUERY_BINDING_EVENT, refuseQueryMutation } from "../query/queryApi";
+import type { QueryVirtualBinding } from "../query/queryApi";
+import { acceptsQueryPreview, routeQueryViewMutation } from "./queryPreview";
 // ⭐ WAVE 30 · W30-T42 (contract C2) — the WINDOWED grid's arithmetic, pure and node-run in
 // `verify_grid_ux.py`, because every one of these decisions is taken inside a callback where
 // only its own source text could otherwise be checked.
   };
 }
+/** Adapt E's already-validated Query view to the existing renderer without creating a native view. */
+function queryPreviewView(binding: QueryVirtualBinding, fields: Field[]): SavedView {
+  const raw = binding.view;
+  const keys = new Set(fields.map((field) => field.key));
+  const config = defaultViewConfig(fields);
+  const visible = Array.isArray(raw.visible)
+    ? raw.visible.filter((key): key is string => typeof key === "string" && keys.has(key))
+    : [];
+  if (visible.length) {
+    config.visible = visible;
+    config.order = [...visible, ...config.order.filter((key) => !visible.includes(key))];
+  }
+  config.filters = Array.isArray(raw.filters) ? raw.filters as FilterNode[] : [];
+  config.filterConj = raw.filterConj === "or" ? "or" : "and";
+  config.sorts = Array.isArray(raw.sorts)
+    ? raw.sorts.filter((item): item is { colId: string; dir?: unknown } =>
+        !!item && typeof item === "object" && typeof (item as { colId?: unknown }).colId === "string"
+          && keys.has((item as { colId: string }).colId)
+      ).map((item) => ({ colId: item.colId, dir: item.dir === "desc" ? "desc" : "asc" }))
+    : [];
+  config.groupBy = typeof raw.groupBy === "string" && keys.has(raw.groupBy) ? raw.groupBy : null;
+  if (raw.display && typeof raw.display === "object") config.display = raw.display as DisplaySpec;
+  return {
+    id: binding.artifactId,
+    name: typeof raw.name === "string" && raw.name ? raw.name : binding.source.label,
+    kind: "custom",
+    locked: true,
+    config,
+  };
+}
 function readLocal(storageKey: string): LocalWorkspace | null {
   try {
     const raw = localStorage.getItem(`aios-grid:${storageKey}`);
  *  re-renders for its own state (edits, resize) and remounts on route change via `key`. */
 interface CustomerGridProps {
   scope?: SurfaceScope;
+  /** A Query-owned immutable artefact. `scope` remains the renderer's mapped data scope. */
+  queryBinding?: QueryVirtualBinding;
   /** Read-only Grid view embedded in a linked-record modal. It keeps the standard
    * filter/sort/search toolbar while withdrawing schema and row mutations. */
   embedded?: boolean;
   );
 }
+function isQueryPreviewRoute(): boolean {
+  return typeof window !== "undefined" && window.location.hash.startsWith("#/query");
+}
+function CustomerGrid(props: CustomerGridProps = {}) {
+  const scope = props.scope ?? "customer";
+  const queryRoute = isQueryPreviewRoute();
+  const [eventBinding, setEventBinding] = useState<QueryVirtualBinding>();
+  const [eventRejected, setEventRejected] = useState(false);
+  useEffect(() => {
+    if (!queryRoute || props.queryBinding) return;
+    const receive = (event: Event) => {
+      const candidate = (event as CustomEvent<unknown>).detail;
+      if (!acceptsQueryPreview(candidate, scope)) {
+        setEventBinding(undefined);
+        setEventRejected(true);
+        return;
+      }
+      setEventBinding(candidate);
+      setEventRejected(false);
+    };
+    window.addEventListener(QUERY_BINDING_EVENT, receive);
+    return () => window.removeEventListener(QUERY_BINDING_EVENT, receive);
+  }, [queryRoute, props.queryBinding, scope]);
+  const queryBinding = props.queryBinding ?? eventBinding;
+  if (queryBinding && !acceptsQueryPreview(queryBinding, scope)) {
+    return (
+      <main className="cg-main" role="alert">
+        This Query preview is unavailable because its source binding is invalid.
+      </main>
+    );
+  }
+  if (queryRoute && !props.queryBinding && !queryBinding) {
+    return (
+      <main className="cg-main" role={eventRejected ? "alert" : "status"} aria-live="polite">
+        {eventRejected
+          ? "This Query preview is unavailable because its source binding was refused."
+          : "Opening Query preview…"}
+      </main>
+    );
+  }
+  return <CustomerGridSurface {...props} queryBinding={queryBinding} />;
+}
+function CustomerGridSurface({
   scope = "customer",
+  queryBinding,
   embedded = false,
   embeddedRecordIds,
   embeddedSelectable = false,
   embeddedSelectedIds = [],
   onEmbeddedSelectionChange,
 }: CustomerGridProps = {}) {
+  const isQueryPreview = queryBinding !== undefined;
+  const previewReadOnly = embedded || isQueryPreview;
   // Wave 16 C-TOPIC: which TABLE this tree is drawing, derived from the one scope prop.
   const topic = topicForScope(scope);
   const {
     patchOverlay,
     requestWindow,
   } = useCustomerData(scope, {
+    bindSurface: !previewReadOnly,
+    includeWorkspace: !previewReadOnly,
+    writable: !previewReadOnly,
   });
   const embeddedIdsKey = embeddedRecordIds?.join(",") ?? "";
   /**
    */
   const [alerted, setAlerted] = useState<string[]>([]);
   useEffect(() => {
+    if (previewReadOnly) return;
     let live = true;
     const pull = () => {
       void fetchAlerts().then((r) => {
       live = false;
       window.removeEventListener("focus", pull);
     };
+  }, [previewReadOnly, scope]);
   const [fields, setFields] = useState<Field[]>([]);
   const [views, setViews] = useState<SavedView[]>([]);
    * ⚠ Existing browsers lose the contents of the old shared bucket. That is the point: every
    * byte in it is a workspace some other surface persisted, and there is no way to tell whose.
    */
+  const storageKey = isQueryPreview && queryBinding
+    ? `query:${queryBinding.workspaceBinding.key}`
+    : payload?.workspace?.storageKey ?? `local:${scope}`;
   // Initialize once per permission/data scope. Host state wins; local state
   // fills only missing objects and keeps the standalone path useful.
   useEffect(() => {
     if (!payload || payloadFields.length === 0 || initializedKey.current === storageKey) return;
+    if (isQueryPreview && queryBinding) {
+      const virtual = queryPreviewView(queryBinding, payloadFields);
+      setFields(payloadFields);
+      setViews([virtual]);
+      setActiveViewId(virtual.id);
+      setConfig(virtual.config);
+      setWorkspaceReady(true);
+      initializedKey.current = storageKey;
+      return;
+    }
     const local = embedded ? null : readLocal(storageKey);
     // Item 3c: the def half of the no-blip layer. A RECENT local stamp beats a
     // lagged host echo (rename survives, retype holds, a delete stays deleted);
      * the config the client is actually filtering with, and sending anything else would ask the
      * host to resolve a question nobody on screen is asking.
      */
+    if (!previewReadOnly && reemit.size > 0) {
       const stamped = { ...(local?.reemitted ?? {}) };
       for (const view of initialViews) {
         const key = reemit.get(view.id);
     } else {
       reemittedRef.current = { ...(local?.reemitted ?? {}) };
     }
+  }, [payload, payloadFields, storageKey, previewReadOnly, scope, isQueryPreview, queryBinding]);
   useEffect(() => {
+    if (!workspaceReady || previewReadOnly) return;
     writeLocal(storageKey, {
       fields,
       views,
       // drop a view this browser created seconds ago.
       viewWrites: pruneTombstones(viewWritesRef.current, Date.now()),
     });
+  }, [workspaceReady, storageKey, fields, views, activeViewId, previewReadOnly]);
   /**
    * ⭐ THE LIVE WORKSPACE (owner report, 2026-08-04) — what has APPEARED since we mounted.
    */
   const hostWorkspaceViews = payload?.workspace?.views;
   useEffect(() => {
+    if (!workspaceReady || previewReadOnly) return;
     const now = Date.now();
     const nextFields = adoptNewFields(
       fields, payloadFields, fieldStampsRef.current.deleted, now
       adoptNewViews(current, hostWorkspaceViews, viewTombstonesRef.current, now,
                     (config) => normalizeConfig(config, nextFields))
     );
+  }, [workspaceReady, hostWorkspaceViews, payloadFields, fields, previewReadOnly]);
   /** Item 3c — stamp a def write / a delete. Pruned at every touch so the persisted blob
    *  stays a recent window, never an archive. */
   const updateConfig = useCallback(
     (next: ViewConfig) => {
+      if (isQueryPreview && queryBinding) {
+        signal(TOAST_EVENT, refuseQueryMutation(queryBinding, "update").message);
+        return;
+      }
       if (next.groupBy !== config.groupBy) setCollapsed(new Set());
       setConfig(next);
     },
+    [config.groupBy, isQueryPreview, queryBinding]
   );
   const {
    * this resolves, the appended row does not exist yet, so "bottom" would land on the last OLD
    * row.
    */
+  const isUserTable = !previewReadOnly && scope.startsWith("ut_");
   const recordsMutable = payload?.recordsMutable !== false;
   const canMutateRecords = isUserTable && recordsMutable;
   /**
   // Airtable behavior: configuration changes to the active view autosave.
   useEffect(() => {
+    if (!workspaceReady || previewReadOnly) return;
     const active = views.find((view) => view.id === activeViewId);
     if (!active || sameConfig(active.config, config)) {
       setSaveState("saved");
     return () => {
       if (saveTimer.current !== null) window.clearTimeout(saveTimer.current);
     };
+  }, [workspaceReady, activeViewId, config, views, previewReadOnly]);
   // Numeric dimensions force a glide relayout when either the component frame
   // or Streamlit's main column changes width (notably sidebar collapse).
   const mode = tableMode(payload?.counts);
   const serverWindowed = mode === "server-windowed";
   // Owner items 4+6 — the Cohort page's grid renders without the Views sidebar.
+  const hideViews = previewReadOnly || payload?.workspace?.hideViews === true;
   // Wave-6 item 10 — how this view displays. A WINDOWED table is always the grid: list/
   // calendar/kanban compute over the whole matched set, and one page is not it (CG-3's rule,
   // the same reason grouping is off there).
   // permissions vs the viewer, fail-closed on restricted fields when the viewer is unknown.
   const viewer = payload?.viewer;
   const canEditField = useCallback(
+    (f: Field): boolean => !previewReadOnly && recordsMutable && mayEditField(f, viewer),
+    [previewReadOnly, recordsMutable, viewer]
   );
   const unresolvedCount = useMemo(
     () => unresolvedConditions(config.filters, { cohortSets, today }),
   );
   const persistView = useCallback((view: SavedView) => {
+    if (queryBinding) {
+      const routed = routeQueryViewMutation(queryBinding, scope, {
+        id: eventId("query-view-update"),
+        type: "view_upsert",
+        view: view as unknown as Record<string, unknown>,
+      }, { query: mutateQueryWorkspace, native: emitHostEvent });
+      if (routed.channel === "refused")
+        signal(TOAST_EVENT, routed.refusal?.message ?? "This Query binding cannot write a source view.");
+      return;
+    }
     setViews((current) => {
       const found = current.some((item) => item.id === view.id);
       return found
         ? current.map((item) => (item.id === view.id ? view : item))
         : [...current, view];
     });
+    routeQueryViewMutation(undefined, scope, {
+      id: eventId("view"), type: "view_upsert", view: view as unknown as Record<string, unknown>,
+    }, { query: mutateQueryWorkspace, native: emitHostEvent });
+  }, [queryBinding, scope]);
   /**
    * Item 12 (C-LOCK) — set or clear a view's cohort lock, from the rail's menu.
   const selectView = useCallback(
     (id: string) => {
+      if (isQueryPreview) return;
       const current = views.find((view) => view.id === activeViewId);
       if (current && !sameConfig(current.config, config))
         persistView({ ...current, config });
       // Owner item 10: opening a view is "I am working now" — the frame folds its nav rail.
       signal(NAV_MINIMIZE_EVENT);
     },
+    [views, activeViewId, config, persistView, fields, isQueryPreview]
   );
   /**
   }, [scope, views, selectView]);
   const createView = useCallback(
     (name: string, mode: DisplayMode, permissions: ViewPermissions) => {
+      if (queryBinding) {
+        const routed = routeQueryViewMutation(queryBinding, scope, {
+          id: eventId("query-view-create"), type: "view_create",
+        }, { query: mutateQueryWorkspace, native: emitHostEvent });
+        if (routed.channel === "refused")
+          signal(TOAST_EVENT, routed.refusal?.message ?? "This Query binding cannot create a source view.");
+        return;
+      }
       const acceptedName = uniqueDisplayName(name, views.map((view) => view.name));
       /**
        * ⭐⭐ WAVE 27 · OWNER ITEM 9 / RULING R4 — **A NEW VIEW IS BLANK. ALL OF IT.**
     },
     // `fields`, not `config` (R4): the blank is derived from the COLUMNS, and reading the live
     // config here at all is what item 9 deletes.
+    [fields, persistView, views, queryBinding, scope]
   );
   const renameView = useCallback(
     (id: string, name: string) => {
   );
   const deleteView = useCallback(
     (id: string) => {
+      if (queryBinding) {
+        const routed = routeQueryViewMutation(queryBinding, scope, {
+          id: eventId("query-view-delete"), type: "view_delete", viewId: id,
+        }, { query: mutateQueryWorkspace, native: emitHostEvent });
+        if (routed.channel === "refused") {
+          signal(TOAST_EVENT, routed.refusal?.message ?? "This Query binding cannot delete a source view.");
+          return;
+        }
+        if (routed.channel !== "query") return;
+        void routed.result.then((result) => {
+          if (!result.ok) {
+            signal(TOAST_EVENT, result.message);
+            return;
+          }
+          setViews([]);
+          setActiveViewId("");
+        });
+        return;
+      }
       const view = views.find((item) => item.id === id);
       // ⚠ This gate used to read `view.locked`, and the menu entry above it did too. C3
       // redefines `locked` as "the DISPLAY MODE is frozen" on ANY view, so leaving the gate
       // back and (since that merge never removes) stay back. See liveWorkspace.ts.
       viewTombstonesRef.current = stampTombstone(viewTombstonesRef.current, id, Date.now());
       setViews((current) => current.filter((item) => item.id !== id));
+      routeQueryViewMutation(undefined, scope, {
+        id: eventId("view-delete"), type: "view_delete", viewId: id,
+      }, { query: mutateQueryWorkspace, native: emitHostEvent });
       if (activeViewId === id) {
         const all = views.find((item) => item.id === ALL_VIEW_ID) ?? allRecordsView(fields, scope);
         setActiveViewId(all.id);
         setConfig(all.config);
       }
     },
+    [views, activeViewId, fields, viewer, scope, queryBinding]
   );
   /**
   const menuVisIndex = menuField ? visibleKeys.indexOf(menuField.key) : -1;
   const menuPinnedTo = menuVisIndex >= 0 && frozenN > 1 && menuVisIndex + 1 === frozenN;
   // Item 10 — the toolbar's mode switcher (grid-only on windowed tables, see displayMode).
+  const modeControl = serverWindowed || previewReadOnly ? undefined : (
     <ModeSwitch
       mode={displayMode}
       onMode={setDisplayMode}
       data-today={today ?? ""}
       data-measure-rules={measureRuleKeys}
       data-measure-sets={measureSetKeys}
+      data-query-artifact={queryBinding?.artifactId ?? ""}
+      data-query-workspace={queryBinding?.workspaceBinding.key ?? ""}
+      data-query-source={queryBinding?.dataScope ?? ""}
     >
       {/* ⭐ wave17 R1 / C-LOCKV — the COHORT SIDEBAR is gone, and with it the last surface that
           treated a cohort as its own kind of object. `CohortSidebar` was the retired `#/cohort`
           below renders every one of them and the second rail has nothing to switch between.
           ⚠ `lists` is NOT gone with it — it stays the membership channel that feeds `cohortSets`
           (C-LOCKV point 2), which is what the lock resolves against. */}
+      {/* ⛔ THE QUERY PROVENANCE BLOCK WAS HERE AND MOVED TO `QueryPage` (owner item 3, 2026-08-15).
+          It was rendered as the FIRST CHILD of `.cg-shell`, which is a horizontal flex row
+          (index.css:233) holding the views rail and `.cg-main` — and it had no stylesheet rule of
+          its own anywhere in the tree. So R9's citations painted as an unstyled column of raw
+          `JSON.stringify` beside the grid, shoving the table sideways: the provenance requirement
+          met, and the surface it was on made unreadable. Chrome belongs to the page that owns the
+          artefact; the grid draws the artefact. `queryCitationLabel` still formats it, from
+          `QueryPage`. */}
       {!hideViews && (
         <ViewSidebar
             // Item 12 (C-LOCK) — the rail's menu is the only emitter of a SAVED `cohortLock`.
               height={gridSize.height}
               customRenderers={[ratingCellRenderer, userCellRenderer, imageCellRenderer]}
               headerIcons={HEADER_ICONS}
+              rightElement={previewReadOnly ? undefined : (
                 // Wave-6 item 4 — the "+" of the header row: the create-field form,
                 // insert-at-end.
                 //
               docs={payload?.docs}
               docPayload={payload?.docPayload}
               onDocAdd={
+                !previewReadOnly && payload?.docs
                   ? (pid, file) =>
                       emitHostEvent({
                         id: eventId("docadd"),
                   : undefined
               }
               onDocFetch={
+                !previewReadOnly && payload?.docs
                   ? (pid, docId) =>
                       emitHostEvent({ id: eventId("docget"), type: "doc_fetch", pid, docId })
                   : undefined
               }
               onDocDelete={
+                !previewReadOnly && payload?.docs
                   ? (pid, docId) =>
                       emitHostEvent({ id: eventId("docdel"), type: "doc_delete", pid, docId })
                   : undefined
           // on the NEXT render via `payload.docPayload`; Documents.tsx matches it
           // to its own pending request before touching it.
           onDocAdd={
+            !previewReadOnly && payload?.docs
               ? (file) =>
                   emitHostEvent({
                     id: eventId("docadd"),
               : undefined
           }
           onDocFetch={
+            !previewReadOnly && payload?.docs
               ? (docId) =>
                   emitHostEvent({
                     id: eventId("docget"),
               : undefined
           }
           onDocDelete={
+            !previewReadOnly && payload?.docs
               ? (docId) =>
                   emitHostEvent({
                     id: eventId("docdel"),

web/src/customer-grid/queryPreview.ts ADDED Viewed

	@@ -0,0 +1,131 @@

+import { refuseQueryMutation } from "../query/queryApi";
+import type { QueryCitation, QueryMutationResult, QueryVirtualBinding,
+  QueryWorkspaceEvent } from "../query/queryApi";
+import { topicForScope } from "./types";
+import type { HostEvent } from "./types";
+type NativeViewUpsert = Extract<HostEvent, { type: "view_upsert" }>;
+type NativeViewDelete = Extract<HostEvent, { type: "view_delete" }>;
+/** The native route accepts a SavedView, never an unvalidated query-shaped record. */
+function isNativeView(value: unknown): value is NativeViewUpsert["view"] {
+  if (!value || typeof value !== "object") return false;
+  const view = value as Record<string, unknown>;
+  return typeof view.id === "string"
+    && typeof view.name === "string"
+    && (view.kind === "system" || view.kind === "list" || view.kind === "custom" || view.kind === "locked")
+    && !!view.config && typeof view.config === "object";
+}
+/**
+ * Query owns the virtual artefact; the grid receives only the one source it may
+ * read.  The source key is checked here instead of reconstructing a second
+ * database-name mapping in the client.
+ */
+export function acceptsQueryPreview(
+  binding: unknown,
+  scope: string,
+): binding is QueryVirtualBinding {
+  const candidate = binding as Partial<QueryVirtualBinding> | null;
+  const source = candidate?.source;
+  const workspace = candidate?.workspaceBinding;
+  return !!candidate
+    && typeof candidate.artifactId === "string" && candidate.artifactId.length > 0
+    && workspace?.kind === "query"
+    && workspace.key === candidate.artifactId
+    && source?.permission_scope_applied === true
+    && source.database === candidate.dataScope
+    && topicForScope(scope).key === candidate.dataScope
+    && Array.isArray(candidate.citations)
+    && candidate.citations.every((citation) =>
+      citation.database === candidate.dataScope && citation.permission_scope_applied === true
+    );
+}
+export type QueryViewMutationRoute<T> =
+  | { channel: "query"; result: T }
+  | { channel: "refused"; refusal: QueryMutationResult | null }
+  | { channel: "native" };
+/**
+ * The sole bridge between existing view callbacks and a virtual Query artefact.  Query owns
+ * the mutation policy: creates and updates are refused locally, while a matching delete travels
+ * only to E's Query transport.  A denied/mismatched binding cannot fall through to `native`.
+ */
+export function routeQueryViewMutation<T>(
+  binding: QueryVirtualBinding | undefined,
+  scope: string,
+  event: QueryWorkspaceEvent,
+  sinks: {
+    query: (binding: QueryVirtualBinding, event: QueryWorkspaceEvent) => T;
+    native: (event: NativeViewUpsert | NativeViewDelete) => void;
+  },
+): QueryViewMutationRoute<T> {
+  if (binding) {
+    if (!acceptsQueryPreview(binding, scope)) return { channel: "refused", refusal: null };
+    if (event.type === "view_delete" && event.viewId === binding.artifactId)
+      return { channel: "query", result: sinks.query(binding, event) };
+    return {
+      channel: "refused",
+      refusal: refuseQueryMutation(binding, event.type === "view_create" ? "create" : "update"),
+    };
+  }
+  if (event.type === "view_upsert" && isNativeView(event.view)) {
+    sinks.native({
+      id: event.id ?? "",
+      type: "view_upsert",
+      view: event.view,
+    });
+    return { channel: "native" };
+  }
+  if (event.type === "view_delete" && event.viewId) {
+    sinks.native({ id: event.id ?? "", type: "view_delete", viewId: event.viewId });
+    return { channel: "native" };
+  }
+  return { channel: "refused", refusal: null };
+}
+/**
+ * The predicates a citation was computed under, in words.
+ *
+ * ⛔ IT WAS `JSON.stringify(citation.filters)`, ON SCREEN. A view with no predicates rendered
+ * `filters: {"source":null,"view":{"conj":"and","nodes":[]}}` — thirteen tokens of wire shape to
+ * say "none" — and a view WITH predicates rendered its internals rather than its meaning. R9 asks
+ * for provenance a reader can audit; a serialised object is only auditable by whoever wrote the
+ * serialiser. Every clause the ruling names is still here, and the empty case now says so.
+ */
+function citationFilterText(raw: unknown): string {
+  const box = (raw ?? {}) as { source?: unknown; view?: { conj?: unknown; nodes?: unknown } };
+  const node = (item: unknown): string => {
+    const row = (item ?? {}) as { colId?: unknown; op?: unknown; value?: unknown };
+    if (typeof row.colId !== "string") return "";
+    const value = row.value === undefined || row.value === null || row.value === "" ? "" : ` ${String(row.value)}`;
+    return `${row.colId} ${String(row.op ?? "")}${value}`.trim();
+  };
+  const list = (items: unknown): string[] =>
+    (Array.isArray(items) ? items : []).map(node).filter(Boolean);
+  const source = list(box.source);
+  const view = list(box.view?.nodes);
+  const conj = box.view?.conj === "or" ? " or " : " and ";
+  const parts: string[] = [];
+  if (source.length) parts.push(`source ${source.join(" and ")}`);
+  if (view.length) parts.push(view.join(conj));
+  return parts.length ? `filters: ${parts.join("; ")}` : "no filters";
+}
+/** Keep complete provenance visible without inventing a record from an opaque id. */
+export function queryCitationLabel(citation: QueryCitation): string {
+  const aggregate = citation.aggregation.field
+    ? `${citation.aggregation.op} of ${citation.aggregation.field}`
+    : citation.aggregation.op;
+  const filters = citationFilterText(citation.filters);
+  return [
+    citation.database,
+    `${citation.snapshot.kind} ${String(citation.snapshot.version)}`,
+    citation.fields.join(", ") || "no fields",
+    filters,
+    aggregate,
+    `${citation.contributing_record_count.toLocaleString()} records`,
+    citation.retrieved_at,
+  ].join(" · ");
+}

web/src/query/QueryPage.tsx CHANGED Viewed

@@ -1,222 +1,138 @@
-// ---------------------------------------------------------------------------
-// query/QueryPage.tsx — THE QUERY MODULE, which is the DATABASE MODULE (owner item 2,
-// 2026-08-14).
-//
-// Owner, verbatim: *"the query module should exactly BE looking like the database module,
-// COMPLETELY, with all the views etc. The only difference is that user isn't the one
-// creating the view, it's the AI that they prompt in the AI assistant module."*
-//
-// ⛔ "EXACTLY" AND "COMPLETELY" ARE ONLY SATISFIABLE ONE WAY: by mounting THE SAME frame
-// and THE SAME grid the database route mounts — `shell-db-frame` + `DbHead` +
-// `OverlayProvider` + `CustomerGrid` — so every view kind, the view sidebar, filters,
-// grouping, the row detail, the export, the undo stack and everything else arrive by
-// being the same component rather than by being rebuilt. A hand-rolled list of AI views
-// beside a read-only preview would satisfy the sentence's words and none of its meaning.
-// `DbHead` and `gridScopeFor` moved out of `Shell.tsx` into `shell/dbFrame.tsx` for this;
-// nothing about them changed.
-//
-// ⛔ WHAT THIS PAGE IS *NOT* ANY MORE: the ask box. It used to carry the question field,
-// the read-back and the Keep/Discard pair, above a list of rows — which is a form, not a
-// database. All of that moved to `assistant/AssistantPage.tsx`, the surface the owner
-// names as the one difference between this module and a database ("the AI that they
-// prompt in the AI assistant module"). This page reads `GET /query` only to know WHICH
-// views the assistant built and which database each belongs to.
-//
-// ⛔ THE VIEW IS SELECTED THROUGH `VIEW_OPEN_EVENT`, NOT A PROP, and that is a re-use
-// rather than a shortcut. That channel's contract: *"the SHELL routes to the table and
-// the GRID owns view selection, so neither has to learn the other's state."* Two traps
-// ride with it and both are handled here:
-//   · the listener guards on `detail.topic !== scope` — the GRID SCOPE spelling, not the
-//     registry key — and drops anything else SILENTLY. `gridScopeFor` is what makes the
-//     two agree; emitting the saved row's `scope` verbatim would select nothing on
-//     `customer_data` / `product_data` and look exactly like a click that "worked".
-//   · the listener also drops a view it has not loaded yet, and there is no ack. So the
-//     emit rides `retryEmit` on THIS module's own ladder (`VIEW_SELECT_RETRY_MS`), which is
-//     longer than the inbox's for a measured reason — see that constant.
-//
-// ⚠ NO CLIENT UNION OVER `kind` — the server's vocabulary arrives as a string (the
-// wave-9 law), so a kind we have no label for renders as itself rather than dropping the
-// row from the picker.
-// ---------------------------------------------------------------------------
-import { useCallback, useEffect, useRef, useState } from "react";
-import { VIEW_OPEN_EVENT, signal } from "../apiContract";
-import type { QueryOpenDetail } from "../apiContract";
-import { QUERY_OPEN_EVENT } from "../apiContract";
-import CustomerGrid from "../customer-grid/CustomerGrid";
-import { OverlayProvider } from "../customer-grid/OverlaySurface";
-import { retryEmit } from "../inbox/inboxModel";
-import { DbHead, gridScopeFor } from "../shell/dbFrame";
-import { databaseEntries } from "../shell/nav";
-import type { NavEntry } from "../shell/nav";
-import { fetchQueries } from "./queryApi";
-import type { SavedQuery } from "./queryApi";
-// ⛔ THE TWO PIECES THIS MODULE ADDS LIVE IN A LEAF, not here — see `queryParts.tsx`'s header.
-// This file imports `CustomerGrid`, so anything defined beside it can only be render-tested by
-// dragging the whole spreadsheet engine into plain node, which does not survive the trip.
-import { QueryEmpty, QueryPicker } from "./queryParts";
-import "./query.css";
-export interface QueryPageProps {
-  /**
-   * ⛔ REQUIRED, and it is the nav's own entries. An optional prop here would degrade to
-   * "the feature does not exist" the first time a mount forgot it, which is
-   * indistinguishable from never having been built. It is also what makes this a legal
-   * CHROME route: the labels and icons this page draws are the ones the SERVER already
-   * sent, so it renders nothing that was not already granted.
-   */
-  granted: NavEntry[];
-}
-/**
- * ⭐⭐ THIS MODULE'S OWN RE-EMIT LADDER (ms), and it is LONGER than the inbox's on purpose.
- *
- * ⛔ THE NUMBERS COME FROM A MEASUREMENT, NOT FROM CAUTION. `OPEN_RETRY_MS` ends at 2,600 ms and
- * is right for its case: a notification click into a grid that is usually already warm. This
- * module's case is the opposite — it keys `CustomerGrid` FRESH on every view switch, so the
- * workspace read is cold, and CLAUDE.md records `ut_assembly` at **799 ms warm / 20.6 s cold**
- * with live database switches at 1.8–7.3 s. A 2.6 s ladder against a 20.6 s read runs out before
- * the grid has views to select from, the listener's `views.some(...)` guard drops every attempt,
- * and there is NO ACK to notice it with.
- *
- * ⛔ THE FAILURE THAT BUYS IS WORSE THAN A SLOW PAINT, which is why the ladder is the fix rather
- * than a spinner: the header would say *"View: Big accounts"* while the grid painted its own
- * default view. A wrong claim, silently, with the picker asserting it. (Worse than the case this
- * ladder was borrowed from — there the header made no competing claim.)
- *
- * ⚠ RE-EMITTING IS FREE: `selectView` early-returns once the view is active and the listener
- * drops a duplicate, so the tail rungs cost nothing on the ordinary warm path — they are only
- * ever reached by a load that is genuinely still in flight.
- */
-export const VIEW_SELECT_RETRY_MS = [0, 250, 700, 1500, 2600, 5000, 9000, 14000, 21000] as const;
-export default function QueryPage({ granted }: QueryPageProps) {
-  const [views, setViews] = useState<SavedQuery[]>([]);
-  const [activeId, setActiveId] = useState("");
-  const [loaded, setLoaded] = useState(false);
-  const emitCancel = useRef<(() => void) | null>(null);
-  const entries = databaseEntries(granted);
-  const entryOf = (key: string) => entries.find((e) => e.key === key);
-  /**
-   * ⛔ ONLY THE VIEWS WHOSE DATABASE THE NAV NAMED. Two things depend on that entry — the
-   * header's label and the grid's icon — and without it `dbLabelOf` would fall back to the raw
-   * store key, painting `ut_leads` as the name of a database. The picker's own render test
-   * asserts against exactly that leak (*"never the raw store key"*); the header is one file over
-   * and would have been unguarded.
-   *
-   * ⚠ IT IS ALSO THE CHROME LAW, applied on this end too: *"a chrome route renders nothing the
-   * server did not already grant."* `GET /query` prunes against the wall, so this normally drops
-   * nothing at all; it bites when `/nav` came back `degraded: ["databases"]` — a 200 whose
-   * database list is missing — and rendering a grid we cannot even name from that state would be
-   * guessing. `unnamed` carries the count so the empty face can say WHICH silence this is
-   * instead of claiming the workspace has no views.
-   */
-  const known = views.filter((v) => entryOf(v.scope));
-  const unnamed = views.length - known.length;
-  // ⛔ `?? known[0]` — NOT just the find. `activeId` is seeded by the effect below, so the FIRST
-  // render after a non-empty fetch has `activeId === ""` and `loaded === true`, which painted
-  // "No views yet" for one frame at somebody who has views. That is this file's own two-facts-
-  // two-sentences rule broken by render ordering. The effect stays as the correctness guard for
-  // an id that was pruned away; this is what stops a wrong sentence reaching a screen at all.
-  const active = known.find((v) => v.id === activeId) ?? known[0] ?? null;
-  const dbLabelOf = (key: string) => entryOf(key)?.label ?? key;
-  useEffect(() => {
-    let alive = true;
-    void (async () => {
-      const res = await fetchQueries();
-      if (!alive) return;
-      setLoaded(true);
-      if (res.ok) setViews(res.value.views);
-    })();
-    return () => {
-      alive = false;
-    };
-  }, []);
-  // The first view is the landing one. ⚠ Pinned against the CURRENT list rather than set
-  // once: the index prunes on read (a grant withdrawn, a database deleted), so an id that
-  // was valid a moment ago can leave — and a header naming a view the grid is not showing
-  // is worse than no selection at all.
-  useEffect(() => {
-    if (known.length && !known.some((v) => v.id === activeId)) setActiveId(known[0].id);
-  }, [known, activeId]);
-  /**
-   * ⛔ THE EMIT, AND ITS TOPIC IS THE **GRID SCOPE**. See the header: the listener compares
-   * against its own `scope` prop, so a registry key here selects nothing and reports
-   * nothing. The ladder covers the other half — the grid drops a view it has not loaded.
-   */
-  useEffect(() => {
-    if (!active) return;
-    emitCancel.current?.();
-    const topic = gridScopeFor(active.scope);
-    emitCancel.current = retryEmit(
-      () => {
-        signal(VIEW_OPEN_EVENT, { topic, viewId: active.viewId });
-      },
-      undefined,
-      VIEW_SELECT_RETRY_MS
-    );
-    return () => emitCancel.current?.();
-  }, [active]);
-  /** The assistant's "Open in Query" click-through: route, then ASK. An event naming a
-   *  query this page does not have is DROPPED — the list prunes on read, and a stale
-   *  click must do nothing rather than select something else. */
-  useEffect(() => {
-    const onOpen = (e: Event) => {
-      const detail = (e as CustomEvent<QueryOpenDetail>).detail;
-      const qid = detail?.qid;
-      if (!qid || !views.some((v) => v.id === qid)) return;
-      setActiveId(qid);
-    };
-    window.addEventListener(QUERY_OPEN_EVENT, onOpen);
-    return () => window.removeEventListener(QUERY_OPEN_EVENT, onOpen);
-  }, [views]);
-  const pick = useCallback((qid: string) => setActiveId(qid), []);
-  if (!active) return <QueryEmpty loaded={loaded} unnamed={unnamed} />;
-  const entry = entryOf(active.scope);
-  return (
-    // ⛔ THE SAME THREE CLASSES AS THE DATABASE ROUTE (`Shell.tsx`'s native branch), in the
-    // same nesting. `.shell-db-frame > .shell-grid-host` is what gives glide its height;
-    // renaming them for tidiness would silently collapse the grid to nothing.
-    <div className="shell-db-frame">
-      <DbHead
-        label={dbLabelOf(active.scope)}
-        {...(entry?.icon ? { icon: entry.icon } : {})}
-        aside={
-          <QueryPicker
-            views={known}
-            /* ⚠ `active.id`, NOT `activeId`. They differ on exactly one render — the first after
-               a non-empty fetch, when the seeding effect has not run and `activeId` is still "".
-               A `<select>` whose value matches no option renders BLANK, so the header would show
-               an empty picker over a grid that is loading a real view. Same one-frame ordering
-               bug as the `?? known[0]` above, one control over. */
-            activeId={active.id}
-            dbLabelOf={dbLabelOf}
-            onPick={pick}
-          />
-        }
-      />
-      <div className="shell-grid-host">
-        <OverlayProvider>
-          {/* ⚠ `key` ON THE SCOPE, so switching to a view on a DIFFERENT database remounts
-              rather than re-pointing a grid that still holds the old table's rows, fields and
-              undo stack — the same reason the shell keys this component on the route. */}
-          <CustomerGrid
-            key={gridScopeFor(active.scope)}
-            scope={gridScopeFor(active.scope)}
-          />
-        </OverlayProvider>
-      </div>
-    </div>
-  );
-}

+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import type { QueryOpenDetail } from "../apiContract";
+import { QUERY_OPEN_EVENT } from "../apiContract";
+import CustomerGrid from "../customer-grid/CustomerGrid";
+import { OverlayProvider } from "../customer-grid/OverlaySurface";
+import { queryCitationLabel } from "../customer-grid/queryPreview";
+import { retryEmit } from "../inbox/inboxModel";
+import { DbHead, gridScopeFor } from "../shell/dbFrame";
+import { databaseEntries } from "../shell/nav";
+import type { NavEntry } from "../shell/nav";
+import { bindingFor, deleteQuery, fetchQueries, QUERY_BINDING_EVENT } from "./queryApi";
+import type { QueryCitation, SavedQuery } from "./queryApi";
+import { QueryEmpty, QueryProvenance, QueryRail } from "./queryParts";
+import type { QueryGroup } from "./queryParts";
+import "./query.css";
+export interface QueryPageProps { granted: NavEntry[]; }
+/** Long enough for a cold grid, without giving the Assistant a native-view event path. */
+export const VIEW_SELECT_RETRY_MS = [0, 250, 700, 1500, 2600, 5000, 9000, 14000, 21000] as const;
+/**
+ * Query is a database frame over a virtual artefact.  Its public contract for B is the
+ * `QUERY_BINDING_EVENT`: `dataScope` reads the one source database and `workspaceBinding` names
+ * the opaque Query artefact.  The two must never be collapsed into a source-native workspace.
+ *
+ * ⭐⭐ OWNER ITEM 3 (2026-08-15) — THE RAIL IS THE NAVIGATION. See `queryParts.QueryRail`: the
+ * top-right dropdown is gone AND replaced, rather than gone and left as an implicit `views[0]`.
+ */
+export default function QueryPage({ granted }: QueryPageProps) {
+  const [views, setViews] = useState<SavedQuery[]>([]);
+  const [citations, setCitations] = useState<QueryCitation[]>([]);
+  const [activeId, setActiveId] = useState("");
+  const [loaded, setLoaded] = useState(false);
+  const emitCancel = useRef<(() => void) | null>(null);
+  const entries = databaseEntries(granted);
+  const entryOf = (key: string) => entries.find((entry) => entry.key === key);
+  const known = views.filter((view) => entryOf(view.source.database));
+  const active = known.find((view) => view.id === activeId) ?? known[0] ?? null;
+  /**
+   * ⚠ GROUPED IN THE ORDER THE DATABASES ARE GRANTED, not by artefact age. The rail is a list of
+   * DATABASES first (owner: "each View correspond to the relevant database"), so a new answer
+   * about Customers must not move the Customers heading — it appears under it. Within a database
+   * the newest is first, which is the order the server already sends.
+   */
+  const groups = useMemo<QueryGroup[]>(() => {
+    const byDatabase = new Map<string, SavedQuery[]>();
+    for (const view of known) {
+      const list = byDatabase.get(view.source.database);
+      if (list) list.push(view);
+      else byDatabase.set(view.source.database, [view]);
+    }
+    const out: QueryGroup[] = [];
+    for (const entry of entries) {
+      const list = byDatabase.get(entry.key);
+      if (!list || entry.kind === "group") continue;
+      out.push({
+        database: entry.key,
+        label: list[0].source.label || entry.label,
+        ...(entry.icon ? { icon: entry.icon } : {}),
+        views: list,
+      });
+    }
+    return out;
+  }, [known, entries]);
+  const reload = useCallback(async () => {
+    const result = await fetchQueries();
+    setLoaded(true);
+    if (result.ok) {
+      setViews(result.value.views);
+      setCitations(result.value.citations);
+    }
+  }, []);
+  useEffect(() => { void reload(); }, [reload]);
+  useEffect(() => {
+    if (known.length && !known.some((view) => view.id === activeId)) setActiveId(known[0].id);
+  }, [known, activeId]);
+  useEffect(() => {
+    if (!active) return;
+    emitCancel.current?.();
+    emitCancel.current = retryEmit(() => {
+      window.dispatchEvent(new CustomEvent(QUERY_BINDING_EVENT, { detail: bindingFor(active, citations) }));
+    }, undefined, VIEW_SELECT_RETRY_MS);
+    return () => emitCancel.current?.();
+  }, [active, citations]);
+  useEffect(() => {
+    const onOpen = (event: Event) => {
+      const qid = (event as CustomEvent<QueryOpenDetail>).detail?.qid;
+      if (!qid) return;
+      // ⛔ The assistant can hand over an artefact this page has not fetched yet — it was created
+      // seconds ago, in the OTHER surface. Selecting it optimistically and reloading is what makes
+      // "ask, then click the preview" work on a first visit; without the reload the id is unknown,
+      // the guard drops it, and the click silently does nothing [[wrong-parent-not-broken-control]].
+      setActiveId(qid);
+      if (!views.some((view) => view.id === qid)) void reload();
+    };
+    window.addEventListener(QUERY_OPEN_EVENT, onOpen);
+    return () => window.removeEventListener(QUERY_OPEN_EVENT, onOpen);
+  }, [views, reload]);
+  const remove = useCallback(async (qid: string) => {
+    const result = await deleteQuery(qid);
+    if (!result.ok) return;
+    setViews((current) => current.filter((view) => view.id !== qid));
+    setActiveId((current) => (current === qid ? "" : current));
+  }, []);
+  if (!active) return <QueryEmpty loaded={loaded} unnamed={views.length - known.length} />;
+  const entry = entryOf(active.source.database);
+  const cited = citations.filter((citation) => active.citationIds.includes(citation.id));
+  const provenance = cited.map(queryCitationLabel).join(" · ")
+    || `${active.source.label} · snapshot ${String(active.source.source_version)} · retrieved ${active.source.retrieved_at}`;
+  return (
+    <div className="shell-db-frame">
+      <DbHead label={active.source.label} {...(entry?.icon ? { icon: entry.icon } : {})} />
+      <div className="shell-grid-host">
+        <div className="qy-workspace">
+          <QueryRail groups={groups} activeId={active.id} onSelect={setActiveId} onDelete={(id) => void remove(id)} />
+          <div className="qy-surface">
+            <QueryProvenance view={active} detail={provenance} />
+            <div className="qy-grid-host">
+              <OverlayProvider>
+                <CustomerGrid key={gridScopeFor(active.source.database)} scope={gridScopeFor(active.source.database)} />
+              </OverlayProvider>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}

web/src/query/query.css CHANGED Viewed

@@ -1,101 +1,284 @@
 /* ---------------------------------------------------------------------------
    query/query.css — the Query module's own stylesheet.
-   ⭐ IT IS SHORT NOW, AND THAT IS THE POINT (owner item 2, 2026-08-14). The Query
-   module IS the database module — `shell-db-frame` + `DbHead` + `CustomerGrid` —
-   so the frame, the header, the grid and every view kind are styled by rules that
-   already existed. What is left here is the only two things this surface adds: the
-   VIEW PICKER inside the database header, and the empty state for a workspace whose
-   assistant has not built anything yet.
-   The ask/answer/list rules that used to live here MOVED to
-   `assistant/assistant.css` with the markup they style (the `as-` prefix). They were
-   not copied: one look, one place.
-   ⛔ EVERY FONT SIZE IS A `--lp-fs-*` TOKEN AND EVERY COLOUR A `--lp-*` TOKEN.
-   Wave-21 R5 is gated app-wide over every CSS file under src, not just index.css,
-   and a literal here reds `web_ui` for the whole tree. No emojis, no ALL-CAPS
-   chrome (DESIGN.md R6).
-   ⛔⛔ AND DO NOT WRITE A GLOB IN THIS COMMENT. A star-star followed by a slash
-   spells the CSS COMMENT TERMINATOR — the comment would end in the middle of its own
-   explanation, every line after it would become stray tokens, and `lightningcss`
-   would die on the first backtick it then met. `tsc` passes, `vite` transforms all
-   1,014 modules, and the build fails in the MINIFIER, nowhere near the sentence that
-   caused it. Found by `web_build` in wave 32's QA; it blocked the deploy outright.
 --------------------------------------------------------------------------- */
-/* ── the view picker, inside the database header ─────────────────────────── */
-.qy-pick {
   display: flex;
-  align-items: center;
-  gap: 8px;
-  margin-left: auto;
   min-width: 0;
 }
-.qy-pick-label {
-  font-size: var(--lp-fs-2xs);
   font-weight: 600;
   color: var(--lp-muted);
 }
-.qy-pick-select {
-  box-sizing: border-box;
-  max-width: 420px;
-  padding: 5px 9px;
-  border: 1px solid var(--lp-line);
-  border-radius: var(--lp-r-md);
-  background: var(--lp-surface);
-  color: var(--lp-ink);
-  font-size: var(--lp-fs-sm);
-  font-family: inherit;
 }
-.qy-pick-select:focus-visible {
-  outline: 2px solid var(--lp-blue-solid);
-  outline-offset: 1px;
 }
-/* ── nothing built yet ───────────────────────────────────────────────────── */
-.qy-empty {
   display: flex;
   flex-direction: column;
-  align-items: flex-start;
   justify-content: center;
-  height: 100%;
-  padding: 34px 44px;
-  box-sizing: border-box;
-  background: var(--lp-wash);
 }
-.qy-empty-h {
-  margin: 0 0 8px;
-  font-size: var(--lp-fs-lg);
-  font-weight: 650;
-  color: var(--lp-ink);
 }
-.qy-empty-p {
-  margin: 0 0 18px;
-  max-width: 58ch;
-  font-size: var(--lp-fs-sm);
-  line-height: var(--lp-lh);
   color: var(--lp-muted);
 }
-.qy-empty-go {
-  padding: 8px 14px;
-  border-radius: var(--lp-r-md);
-  background: var(--lp-blue-solid);
   color: var(--lp-surface);
-  font-size: var(--lp-fs-sm);
   font-weight: 600;
   text-decoration: none;
 }
-.qy-empty-go:hover {
-  background: color-mix(in srgb, var(--lp-blue-solid) 82%, #000);
 }

 /* ---------------------------------------------------------------------------
    query/query.css — the Query module's own stylesheet.
+   The Query module IS the database module — `shell-db-frame` + `DbHead` +
+   `CustomerGrid` — so the frame, the header, the grid and every view kind are
+   styled by rules that already exist. What is left here is what this surface
+   adds: the VIEW RAIL (owner item 3: the AI's views, grouped by the database
+   they read), a one-line provenance disclosure, and the empty state.
+   The chat rules live in `assistant/assistant.css` with the markup they style.
+   EVERY FONT SIZE IS A `--lp-fs-*` TOKEN AND EVERY COLOUR A `--lp-*` TOKEN.
+   Wave-21 R5 is gated app-wide over every CSS file under src, and a literal
+   here reds `web_ui` for the whole tree. No emojis, no ALL-CAPS chrome
+   (DESIGN.md R6).
+   AND DO NOT WRITE A GLOB IN THIS COMMENT. A star-star followed by a slash
+   spells the CSS COMMENT TERMINATOR — the comment would end in the middle of
+   its own explanation and `lightningcss` would die far from the cause. Found
+   by `web_build` in wave 32's QA; it blocked the deploy outright.
 --------------------------------------------------------------------------- */
+/* ── the workspace: rail + surface, in the database module's own geometry ─── */
+.qy-workspace {
   display: flex;
+  width: 100%;
+  height: 100%;
   min-width: 0;
+  overflow: hidden;
+  background: var(--lp-surface);
 }
+/* The same width and hairline `CustomerGrid`'s own views rail uses
+   (`.cg-views`, index.css) — this rail stands in that slot, so it has to
+   measure the same or Query stops looking like a database. */
+.qy-rail {
+  flex: 0 0 var(--lp-rail-w);
+  width: var(--lp-rail-w);
+  min-width: var(--lp-rail-w);
+  height: 100%;
+  box-sizing: border-box;
+  display: flex;
+  flex-direction: column;
+  padding: 10px 8px;
+  border-right: 1px solid var(--lp-line);
+  background: var(--lp-surface);
+  overflow: hidden;
+}
+.qy-rail-head {
+  margin: 0 0 6px;
+  padding: 0 6px;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-xs);
   font-weight: 600;
+}
+.qy-rail-scroll {
+  flex: 1 1 auto;
+  min-height: 0;
+  overflow-y: auto;
+}
+.qy-rail-group { margin-bottom: 10px; }
+.qy-rail-db {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin: 0 0 2px;
+  padding: 4px 6px;
   color: var(--lp-muted);
+  font-size: var(--lp-fs-xs);
+  font-weight: 600;
 }
+.qy-rail-db-mark {
+  flex: 0 0 auto;
+  display: inline-flex;
+  width: 14px;
+  height: 14px;
+  color: var(--lp-muted);
 }
+.qy-rail-db-mark svg {
+  width: 14px;
+  height: 14px;
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.4;
+  stroke-linecap: round;
+  stroke-linejoin: round;
 }
+.qy-rail-db-name {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.qy-rail-row {
+  position: relative;
+  display: flex;
+  align-items: center;
+  min-width: 0;
+  border-radius: var(--lp-r-md);
+}
+.qy-rail-row:hover { background: var(--lp-surface-2); }
+.qy-rail-row.is-active { background: var(--lp-blue-tint); }
+.qy-rail-view {
+  flex: 1 1 auto;
+  min-width: 0;
+  min-height: 32px;
   display: flex;
   flex-direction: column;
   justify-content: center;
+  gap: 1px;
+  padding: 5px 8px;
+  border: 0;
+  background: transparent;
+  font: inherit;
+  text-align: left;
+  color: var(--lp-ink);
+  cursor: pointer;
 }
+.qy-rail-name {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-size: var(--lp-fs-xs);
+  font-weight: 500;
 }
+.qy-rail-row.is-active .qy-rail-name { font-weight: 600; }
+.qy-rail-kind {
   color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
 }
+/* Hover-revealed, like the grid rail's own row menu — visible on focus so it is
+   reachable from the keyboard rather than only from a pointer. */
+.qy-rail-del {
+  flex: 0 0 auto;
+  width: 24px;
+  height: 24px;
+  margin-right: 4px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+  border-radius: 6px;
+  background: transparent;
+  color: var(--lp-muted);
+  opacity: 0;
+  cursor: pointer;
+}
+.qy-rail-del svg {
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.3;
+  stroke-linecap: round;
+  stroke-linejoin: round;
+}
+.qy-rail-row:hover .qy-rail-del,
+.qy-rail-row.is-active .qy-rail-del,
+.qy-rail-del:focus-visible { opacity: 1; }
+.qy-rail-confirm {
+  flex: 0 0 auto;
+  margin-right: 4px;
+  padding: 3px 8px;
+  border: 0;
+  border-radius: 6px;
+  background: var(--lp-red-deep);
   color: var(--lp-surface);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  cursor: pointer;
+}
+.qy-rail-ask {
+  flex: 0 0 auto;
+  margin-top: 8px;
+  padding: 7px 8px;
+  border-radius: var(--lp-r-md);
+  color: var(--lp-blue-solid);
+  font-size: var(--lp-fs-xs);
   font-weight: 600;
   text-decoration: none;
 }
+.qy-rail-ask:hover { background: var(--lp-surface-2); }
+/* ── the surface: provenance line, then the grid ──────────────────────────── */
+.qy-surface {
+  flex: 1 1 auto;
+  min-width: 0;
+  height: 100%;
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
+}
+.qy-grid-host {
+  flex: 1 1 auto;
+  min-height: 0;
+  overflow: hidden;
 }
+.qy-prov {
+  flex: 0 0 auto;
+  border-bottom: 1px solid var(--lp-line);
+  background: var(--lp-surface);
+}
+.qy-prov-btn {
+  display: flex;
+  align-items: baseline;
+  gap: 10px;
+  width: 100%;
+  padding: 7px 14px;
+  border: 0;
+  background: transparent;
+  font: inherit;
+  text-align: left;
+  cursor: pointer;
+}
+.qy-prov-q {
+  flex: 1 1 auto;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-xs);
+}
+.qy-prov-toggle {
+  flex: 0 0 auto;
+  color: var(--lp-blue-solid);
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+}
+.qy-prov-detail {
+  margin: 0;
+  padding: 0 14px 9px;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+  line-height: var(--lp-lh);
+  word-break: break-word;
+}
+/* ── the empty state ──────────────────────────────────────────────────────── */
+.qy-empty {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  width: 100%;
+  height: 100%;
+  min-height: 260px;
+  padding: 34px 44px;
+  box-sizing: border-box;
+  background: var(--lp-wash);
+  text-align: center;
+}
+.qy-empty-h { margin: 0 0 8px; color: var(--lp-ink); font-size: var(--lp-fs-lg); font-weight: 650; }
+.qy-empty-p { max-width: 58ch; margin: 0 0 18px; color: var(--lp-muted); font-size: var(--lp-fs-sm); line-height: var(--lp-lh); }
+.qy-empty-go { padding: 8px 14px; border-radius: var(--lp-r-md); background: var(--lp-blue-solid); color: var(--lp-surface); font-size: var(--lp-fs-sm); font-weight: 650; text-decoration: none; }
+.qy-empty-go:hover { background: var(--lp-blue-solid); }

web/src/query/queryApi.ts CHANGED Viewed

@@ -1,177 +1,361 @@
-// ---------------------------------------------------------------------------
-// query/queryApi.ts — WAVE 32 item 7 (ruling R1, contract C5): the four calls,
-// and nothing else.
-//
-// Shaped like `alerts/alertsApi.ts` — the same `Result<T>`, the same 4xx/5xx
-// message split — because the failure that matters is identical: a wrong
-// `credentials` word produces no client-side symptom at all, just a 401 from a
-// server that never saw a session.
-//
-// ⛔ A REFUSAL IS A 200 HERE, AND THAT IS THE CONTRACT, NOT A LOOSE END. C5's
-// promise is that a question the backend cannot express gets "a plain sentence,
-// not a broken view", so `build` answers `{spec: null, refused: "<sentence>"}`
-// with an OK status. Mapping it onto an error would paint the error page the
-// ruling exists to prevent. The 4xx cases are the ones that really are the
-// caller's fault: no database named, no question, a database this session may
-// not open.
-//
-// ⚠ NO CLIENT UNION OVER `kind`. It is the server's vocabulary and arrives as a
-// string (the wave-9 law): a client `type Kind = "grid" | …` turns "the server
-// added a kind" into "the client drops the view".
-// ---------------------------------------------------------------------------
-import { API_V1, CREDENTIALS } from "../apiContract";
-export type Result<T> =
-  | { ok: true; value: T }
-  | { ok: false; status: number; message: string };
-/** One saved AI-built view, as `GET /query` sends it. */
-export interface SavedQuery {
-  id: string;
-  scope: string;
-  viewId: string;
-  name: string;
-  /** A STRING, never a union — see the header. */
-  kind: string;
-  question: string;
-  explain: string;
-  createdAt?: string;
-}
-/** What `POST /query/build` answers. Exactly one of `spec` / `refused` is set. */
-export interface BuildResult {
-  spec: unknown | null;
-  explain: string | null;
-  refused: string | null;
-  /** The machine-readable cause behind `refused`, when the server names one. */
-  reason?: string;
-  id?: string;
-  /**
-   * ⛔ TRUE when the answer came from a rung BELOW the top of the server's provider ladder.
-   *
-   * The server has always known which model answered and has always sent it; nothing read it.
-   * It matters because the rungs are not interchangeable: `_call_model`'s own docstring records
-   * that only the FIRST provider is measured to refuse honestly, and *"the ones below it answer
-   * unanswerable questions with plausible specs"*. So when the top rung is rate-limited the
-   * ladder falls through — correctly, a Query module that dies whenever one free tier 429s is
-   * worse — and the person is then reading a confident, well-formed view built by a model that
-   * does not know how to say "this database cannot answer that". This flag is the only thing
-   * that distinguishes those two answers on screen.
-   */
-  fallback?: boolean;
-}
-/** 4xx text is POLICY the reader needs ("this database does not have …"); a 5xx's
- *  text is the server's internals and is never shown. Same split as alertsApi. */
-export function errorMessage(status: number, message?: string): string {
-  if (status >= 500 || !message) {
-    return status >= 500
-      ? "Something went wrong on our side. Try again in a moment."
-      : `The server answered ${status}.`;
-  }
-  return message;
-}
-async function call<T>(
-  path: string,
-  init: RequestInit,
-  read: (body: unknown) => T
-): Promise<Result<T>> {
-  let res: Response;
-  try {
-    res = await fetch(`${API_V1}${path}`, { credentials: CREDENTIALS, ...init });
-  } catch {
-    return { ok: false, status: 0, message: "Cannot reach the server." };
-  }
-  const body = (await res.json().catch(() => null)) as unknown;
-  if (!res.ok) {
-    const detail = (body as { error?: { message?: string } } | null)?.error?.message;
-    return { ok: false, status: res.status, message: errorMessage(res.status, detail) };
-  }
-  return { ok: true, value: read(body) };
-}
-const json = (data: unknown): RequestInit => ({
-  method: "POST",
-  headers: { "Content-Type": "application/json" },
-  body: JSON.stringify(data),
-});
-const str = (v: unknown): string => (typeof v === "string" ? v : "");
-/** Fails CLOSED: an unreadable answer is an empty list, never a half-parsed one. */
-export function parseSaved(body: unknown): SavedQuery[] {
-  const rows = (body as { views?: unknown[] } | null)?.views;
-  if (!Array.isArray(rows)) return [];
-  return rows
-    .map((r) => r as Record<string, unknown>)
-    .filter((r) => r && str(r.id) && str(r.scope))
-    .map((r) => ({
-      id: str(r.id),
-      scope: str(r.scope),
-      viewId: str(r.viewId) || str(r.id),
-      name: str(r.name) || "Query",
-      kind: str(r.kind) || "grid",
-      question: str(r.question),
-      explain: str(r.explain),
-      createdAt: str(r.createdAt) || undefined,
-    }));
-}
-/** `GET /query`: the saved views AND the built-in scopes the build door accepts. */
-export interface QueryIndex {
-  views: SavedQuery[];
-  /**
-   * The non-`ut_` scopes `POST /query/build` will accept, published by the server.
-   *
-   * ⛔ THE PICKER MIRRORS THIS INSTEAD OF GUESSING. The nav hands this page every granted entry,
-   * which is a WIDER set than the build door accepts — a picker filtered on "not a surface" alone
-   * offers databases that 404. `view_templates`' rule: a picker that offers what the door would
-   * refuse is a control that lies.
-   */
-  builtins: string[];
-}
-export function fetchQueries(): Promise<Result<QueryIndex>> {
-  return call("/query", {}, (b) => ({
-    views: parseSaved(b),
-    builtins: (((b as { builtins?: unknown } | null)?.builtins as unknown[]) ?? [])
-      .filter((k): k is string => typeof k === "string"),
-  }));
-}
-/**
- * Ask for a view. **This writes nothing** — the spec comes back for a person to
- * read before `saveQuery` stores it, which is the only check on the one failure
- * class no validator can see (a well-formed spec that answers a different
- * question). See `routes_query.py`'s header.
- */
-export function buildQuery(question: string, scope: string): Promise<Result<BuildResult>> {
-  return call("/query/build", json({ question, scope }), (b) => {
-    const r = (b || {}) as Record<string, unknown>;
-    return {
-      spec: r.spec ?? null,
-      explain: str(r.explain) || null,
-      refused: str(r.refused) || null,
-      reason: str(r.reason) || undefined,
-      id: str(r.id) || undefined,
-      // ⚠ `=== true`, not truthy: an absent key must read as "not a fallback", and a server that
-      // has not been redeployed yet sends nothing at all. Fail-quiet is right here — the wrong
-      // direction would be warning about every answer on an older build.
-      fallback: r.fallback === true,
-    };
-  });
-}
-export function saveQuery(
-  question: string,
-  scope: string,
-  spec: unknown
-): Promise<Result<SavedQuery>> {
-  return call("/query/save", json({ question, scope, spec }), (b) => parseSaved({ views: [b] })[0]);
-}
-export function deleteQuery(id: string): Promise<Result<true>> {
-  return call(`/query/${encodeURIComponent(id)}`, { method: "DELETE" }, () => true as const);
-}

+// Query's public contract.  Assistant owns the conversation; Query owns only the
+// immutable, per-user artefacts the conversation creates.
+import { API_V1, CREDENTIALS } from "../apiContract";
+export type Result<T> =
+  | { ok: true; value: T }
+  | { ok: false; status: number; message: string };
+export interface QuerySource {
+  database: string;
+  label: string;
+  source_kind: string;
+  source_version: unknown;
+  retrieved_at: string;
+  fields: Array<{ key: string; label?: string; type?: string }>;
+  filters: unknown;
+  permission_scope_applied: boolean;
+}
+export interface QueryCitation {
+  id: string;
+  href: string;
+  database: string;
+  snapshot: { kind: string; version: unknown };
+  fields: string[];
+  filters: unknown;
+  permission_scope_applied: boolean;
+  aggregation: { op: string; field?: string | null };
+  contributing_record_count: number;
+  retrieved_at: string;
+}
+export interface SavedQuery {
+  id: string;
+  viewId: string;
+  scope: string;
+  name: string;
+  kind: string;
+  question: string;
+  explain: string;
+  threadId: string;
+  createdAt: string;
+  virtual: true;
+  source: QuerySource;
+  view: Record<string, unknown>;
+  citationIds: string[];
+  numeric: { label: string; value: number | null; contributing_record_count: number };
+}
+export interface QueryThread {
+  id: string;
+  title: string;
+  createdAt: string;
+  updatedAt: string;
+  sources: string[];
+  model: string;
+  activeViewId?: string;
+}
+export interface QueryMessage {
+  id: string;
+  threadId: string;
+  role: "user" | "assistant";
+  content: string;
+  createdAt: string;
+  targetDatabase?: string;
+  sources?: string[];
+  requestedModel?: string;
+  model?: string | null;
+  reason?: string | null;
+  viewId?: string | null;
+  citationIds?: string[];
+  numeric?: SavedQuery["numeric"] | null;
+}
+/**
+ * A source this caller HOLDS, and whether it can actually be asked.
+ *
+ * ⭐ `permitted` and `answerable` are different questions and the picker needs the second.
+ * Measured on tenant #0: twelve chips offered, two answerable — the rest are the `ut_odoo_*`
+ * grids, whose rows live uncapped in the connector mirror and are read THROUGH it, which the
+ * Assistant's read boundary refuses by design. `reason` is what the chip says instead of making
+ * the reader spend a prompt to find out.
+ */
+export interface QuerySourceStatus {
+  database: string;
+  answerable: boolean;
+  reason: string;
+}
+export interface QueryIndex {
+  threads: QueryThread[];
+  messages: QueryMessage[];
+  views: SavedQuery[];
+  citations: QueryCitation[];
+  models: string[];
+  sources: QuerySourceStatus[];
+}
+export interface ChatResult {
+  thread: QueryThread;
+  userMessage: QueryMessage;
+  message: QueryMessage;
+  view: SavedQuery | null;
+  citations: QueryCitation[];
+}
+/** The cross-fence B contract: source reads and virtual workspace writes are separate. */
+export interface QueryVirtualBinding {
+  artifactId: string;
+  dataScope: string;
+  workspaceBinding: { kind: "query"; key: string };
+  mutation: QueryMutationPolicy;
+  source: QuerySource;
+  view: Record<string, unknown>;
+  citationIds: string[];
+  /** Complete, clickable provenance for this exact immutable virtual artefact. */
+  citations: QueryCitation[];
+}
+/**
+ * Grid previews cannot mutate Query artefacts. A new Assistant prompt creates a new immutable
+ * artefact; the existing DELETE endpoint is Query-history removal, never a grid event transport.
+ */
+export type QueryMutationOperation = "create" | "update" | "delete";
+export interface QueryMutationRefusal {
+  durable: false;
+  transport: "none";
+  code: "query_view_immutable";
+  message: string;
+}
+export interface QueryDeleteMutation {
+  durable: true;
+  transport: "query_event";
+  endpoint: "POST /query/{workspaceBinding.key}/events";
+  event: "view_delete";
+}
+export interface QueryMutationPolicy {
+  create: QueryMutationRefusal;
+  update: QueryMutationRefusal;
+  delete: QueryDeleteMutation;
+}
+export interface QueryMutationResult extends QueryMutationRefusal {
+  artifactId: string;
+  workspaceKey: string;
+  operation: "create" | "update";
+}
+const IMMUTABLE_MUTATION: QueryMutationRefusal = {
+  durable: false,
+  transport: "none",
+  code: "query_view_immutable",
+  message: "This Query view is immutable. Ask the AI assistant to create a revised view.",
+};
+export const QUERY_MUTATION_POLICY: QueryMutationPolicy = {
+  create: IMMUTABLE_MUTATION,
+  update: IMMUTABLE_MUTATION,
+  delete: {
+    durable: true,
+    transport: "query_event",
+    endpoint: "POST /query/{workspaceBinding.key}/events",
+    event: "view_delete",
+  },
+};
+/** The durable Query-only event payload; no source scope is permitted here. */
+export interface QueryWorkspaceEvent {
+  id?: string;
+  type: "view_create" | "view_upsert" | "view_delete";
+  viewId?: string;
+  view?: Record<string, unknown>;
+}
+export interface QueryWorkspaceMutation {
+  workspaceBinding: { kind: "query"; key: string };
+  event: "view_delete";
+  deleted: string;
+}
+export const QUERY_BINDING_EVENT = "aios:query-virtual-binding";
+/** The local refusal B must use for every grid create, update, or delete attempt. */
+export function refuseQueryMutation(
+  binding: Pick<QueryVirtualBinding, "artifactId" | "workspaceBinding">,
+  operation: "create" | "update",
+): QueryMutationResult {
+  return {
+    ...IMMUTABLE_MUTATION,
+    artifactId: binding.artifactId,
+    workspaceKey: binding.workspaceBinding.key,
+    operation,
+  };
+}
+export function bindingFor(view: SavedQuery, citations: QueryCitation[]): QueryVirtualBinding {
+  const ids = new Set(view.citationIds);
+  return {
+    artifactId: view.id,
+    dataScope: view.source.database,
+    workspaceBinding: { kind: "query", key: view.id },
+    mutation: QUERY_MUTATION_POLICY,
+    source: view.source,
+    view: view.view,
+    citationIds: view.citationIds,
+    citations: citations.filter((citation) => ids.has(citation.id) && citation.database === view.source.database),
+  };
+}
+export function errorMessage(status: number, message?: string): string {
+  if (status >= 500 || !message) {
+    return status >= 500
+      ? "Something went wrong on our side. Try again in a moment."
+      : `The server answered ${status}.`;
+  }
+  return message;
+}
+async function call<T>(path: string, init: RequestInit, read: (body: unknown) => T): Promise<Result<T>> {
+  let res: Response;
+  try {
+    res = await fetch(`${API_V1}${path}`, { credentials: CREDENTIALS, ...init });
+  } catch {
+    return { ok: false, status: 0, message: "Cannot reach the server." };
+  }
+  const body = (await res.json().catch(() => null)) as unknown;
+  if (!res.ok) {
+    const detail = (body as { error?: { message?: string } } | null)?.error?.message;
+    return { ok: false, status: res.status, message: errorMessage(res.status, detail) };
+  }
+  return { ok: true, value: read(body) };
+}
+const json = (data: unknown): RequestInit => ({
+  method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(data),
+});
+const str = (value: unknown): string => (typeof value === "string" ? value : "");
+const rows = (value: unknown): Record<string, unknown>[] =>
+  Array.isArray(value) ? value.filter((row): row is Record<string, unknown> => !!row && typeof row === "object") : [];
+function source(value: unknown): QuerySource | null {
+  const row = value as Record<string, unknown> | null;
+  if (!row || !str(row.database) || !str(row.label) || !str(row.retrieved_at)) return null;
+  return {
+    database: str(row.database), label: str(row.label), source_kind: str(row.source_kind),
+    source_version: row.source_version, retrieved_at: str(row.retrieved_at),
+    fields: rows(row.fields).filter((field) => !!str(field.key)).map((field) => ({
+      key: str(field.key), label: str(field.label) || undefined, type: str(field.type) || undefined,
+    })),
+    filters: row.filters, permission_scope_applied: row.permission_scope_applied === true,
+  };
+}
+function saved(value: unknown): SavedQuery | null {
+  const row = value as Record<string, unknown> | null;
+  const src = source(row?.source);
+  if (!row || !src || !str(row.id) || !str(row.viewId) || !str(row.threadId) || row.virtual !== true) return null;
+  return {
+    id: str(row.id), viewId: str(row.viewId), scope: str(row.scope) || src.database,
+    name: str(row.name) || "Query", kind: str(row.kind) || "grid",
+    question: str(row.question), explain: str(row.explain), threadId: str(row.threadId),
+    createdAt: str(row.createdAt), virtual: true, source: src,
+    view: (row.view && typeof row.view === "object" ? row.view : {}) as Record<string, unknown>,
+    citationIds: (row.citationIds as unknown[] || []).filter((id): id is string => typeof id === "string"),
+    numeric: ((row.numeric && typeof row.numeric === "object" ? row.numeric : {}) as SavedQuery["numeric"]),
+  };
+}
+function message(value: unknown): QueryMessage | null {
+  const row = value as Record<string, unknown> | null;
+  const role = str(row?.role);
+  if (!row || !str(row.id) || !str(row.threadId) || !str(row.content) || !str(row.createdAt)
+      || (role !== "user" && role !== "assistant")) return null;
+  return { id: str(row.id), threadId: str(row.threadId), role, content: str(row.content), createdAt: str(row.createdAt),
+    targetDatabase: str(row.targetDatabase) || undefined,
+    sources: (row.sources as unknown[] || []).filter((v): v is string => typeof v === "string"),
+    requestedModel: str(row.requestedModel) || undefined, model: str(row.model) || null,
+    reason: str(row.reason) || null, viewId: str(row.viewId) || null,
+    citationIds: (row.citationIds as unknown[] || []).filter((v): v is string => typeof v === "string"),
+    numeric: (row.numeric && typeof row.numeric === "object" ? row.numeric : null) as QueryMessage["numeric"],
+  };
+}
+function thread(value: unknown): QueryThread | null {
+  const row = value as Record<string, unknown> | null;
+  if (!row || !str(row.id) || !str(row.createdAt) || !str(row.updatedAt)) return null;
+  return { id: str(row.id), title: str(row.title) || "New chat", createdAt: str(row.createdAt),
+    updatedAt: str(row.updatedAt), sources: (row.sources as unknown[] || []).filter((v): v is string => typeof v === "string"),
+    model: str(row.model) || "auto", activeViewId: str(row.activeViewId) || undefined };
+}
+function citation(value: unknown): QueryCitation | null {
+  const row = value as Record<string, unknown> | null;
+  const snap = row?.snapshot as Record<string, unknown> | null;
+  if (!row || !snap || !str(row.id) || !str(row.href) || !str(row.database) || !str(row.retrieved_at)) return null;
+  return { id: str(row.id), href: str(row.href), database: str(row.database),
+    snapshot: { kind: str(snap.kind), version: snap.version },
+    fields: (row.fields as unknown[] || []).filter((v): v is string => typeof v === "string"),
+    filters: row.filters, permission_scope_applied: row.permission_scope_applied === true,
+    aggregation: (row.aggregation && typeof row.aggregation === "object" ? row.aggregation : {}) as QueryCitation["aggregation"],
+    contributing_record_count: Number(row.contributing_record_count) || 0, retrieved_at: str(row.retrieved_at) };
+}
+export function parseIndex(body: unknown): QueryIndex {
+  const row = body as Record<string, unknown> | null;
+  return {
+    threads: rows(row?.threads).map(thread).filter((v): v is QueryThread => !!v),
+    messages: rows(row?.messages).map(message).filter((v): v is QueryMessage => !!v),
+    views: rows(row?.views).map(saved).filter((v): v is SavedQuery => !!v),
+    citations: rows(row?.citations).map(citation).filter((v): v is QueryCitation => !!v),
+    models: (row?.models as unknown[] || []).filter((v): v is string => typeof v === "string"),
+    sources: rows(row?.sources).filter((item) => !!str(item.database)).map((item) => ({
+      database: str(item.database), answerable: item.answerable === true, reason: str(item.reason),
+    })),
+  };
+}
+export function fetchQueries(): Promise<Result<QueryIndex>> {
+  return call("/query", {}, parseIndex);
+}
+export function submitChat(body: {
+  question: string; database: string; sources: string[]; threadId?: string; model: string;
+}): Promise<Result<ChatResult>> {
+  return call("/query/chat", json(body), (raw) => {
+    const row = raw as Record<string, unknown> | null;
+    return {
+      thread: thread(row?.thread) as QueryThread,
+      userMessage: message(row?.userMessage) as QueryMessage,
+      message: message(row?.message) as QueryMessage,
+      view: saved(row?.view),
+      citations: rows(row?.citations).map(citation).filter((v): v is QueryCitation => !!v),
+    };
+  });
+}
+export function deleteQuery(id: string): Promise<Result<true>> {
+  return call(`/query/${encodeURIComponent(id)}`, { method: "DELETE" }, () => true as const);
+}
+/** Remove one chat. The Query views it produced SURVIVE — they live in Query, not in the chat. */
+export function deleteThread(id: string): Promise<Result<true>> {
+  return call(`/query/threads/${encodeURIComponent(id)}`, { method: "DELETE" }, () => true as const);
+}
+/**
+ * The sole mutation path for a virtual Query workspace.  This intentionally never falls through
+ * to the native grid event transport and never sends `dataScope`: the opaque Query key is the authority.
+ * The server accepts delete and explicitly refuses create/update because AI artefacts are immutable.
+ */
+export function mutateQueryWorkspace(binding: QueryVirtualBinding, event: QueryWorkspaceEvent): Promise<Result<QueryWorkspaceMutation>> {
+  const key = binding.workspaceBinding.key;
+  return call(`/query/${encodeURIComponent(key)}/events`, json({
+    workspaceBinding: binding.workspaceBinding, event,
+  }), (raw) => {
+    const row = raw as Record<string, unknown> | null;
+    return {
+      workspaceBinding: { kind: "query", key: str((row?.workspaceBinding as Record<string, unknown> | null)?.key) },
+      event: str(row?.event) as QueryWorkspaceMutation["event"],
+      deleted: str(row?.deleted),
+    };
+  });
+}

web/src/query/queryParts.tsx CHANGED Viewed

@@ -1,116 +1,135 @@
-// ---------------------------------------------------------------------------
-// query/queryParts.tsx — the two pieces the Query module ADDS to the database frame,
-// in a file that drags no grid behind it.
-//
-// ⛔ WHY THEY ARE NOT IN `QueryPage.tsx`. That file imports `CustomerGrid`, which is
-// the whole spreadsheet engine (glide, the formula parser, the view modes). The render
-// leg compiles a test file with bare `npx tsc --ignoreConfig` and runs it under plain
-// node with CSS stubbed — no bundler, no browser, no DOM — so a test importing
-// `QueryPage` would pull that graph in and die on the first thing that expects a
-// window. The parts that a person actually needs to SEE painted (the picker that says
-// which view you are looking at, and the empty state that names where views come from)
-// therefore live in a leaf with no heavy imports, and BOTH `QueryPage` and the render
-// test import them from here.
-//
-// ⚠ This is the same shape `verify_ui.render_smoke` already relies on elsewhere: the
-// testable surface is the leaf, and the mount is proved by the wiring gate instead.
-// ---------------------------------------------------------------------------
 import { ASSISTANT_ROUTE } from "../shell/nav";
 import type { SavedQuery } from "./queryApi";
-/**
- * Human words for a view kind.
- *
- * ⚠ NO CLIENT UNION OVER `kind` — it is the server's vocabulary and arrives as a string
- * (the wave-9 law). A kind absent from here renders AS ITSELF; dropping the row instead
- * would make "the server added a kind" look like "the assistant lost my view".
- */
-export const KIND_LABEL: Record<string, string> = {
-  grid: "Table",
-  list: "List",
-  chart: "Chart",
-  kanban: "Board",
-  calendar: "Calendar",
-  timeseries: "Time series",
-  map: "Map",
 };
 /**
- * The picker that sits INSIDE the database header.
  *
- * ⛔ INSIDE `DbHead`, NOT IN A STRIP ABOVE IT. The owner's instruction is that this module
- * *"exactly BE looking like the database module, COMPLETELY"*; you cannot look at a
- * database without saying which one, and a second bar above the header is the difference
- * between "the same frame" and "the frame with something bolted on".
  */
-export function QueryPicker({ views, activeId, dbLabelOf, onPick }: {
-  views: SavedQuery[];
   activeId: string;
-  dbLabelOf: (key: string) => string;
-  onPick: (qid: string) => void;
 }) {
   return (
-    <label className="qy-pick">
-      <span className="qy-pick-label">View</span>
-      <select
-        className="qy-pick-select"
-        value={activeId}
-        onChange={(e) => onPick(e.currentTarget.value)}
-      >
-        {views.map((v) => (
-          <option key={v.id} value={v.id}>
-            {v.name} — {KIND_LABEL[v.kind] ?? v.kind} · {dbLabelOf(v.scope)}
-          </option>
         ))}
-      </select>
-    </label>
   );
 }
 /**
- * Nothing to show — and WHICH nothing.
- *
- * ⛔ IT NAMES THE ONE PLACE VIEWS COME FROM, because that IS this module's whole
- * difference from a database (owner: *"the user isn't the one creating the view, it's the
- * AI that they prompt in the AI assistant module"*). A bare "no views" would leave a
- * person hunting for a create button this surface deliberately does not have.
  *
- * ⛔⛔ THREE FACTS, THREE SENTENCES, and the third is the one that is easy to lose. "Still
- * asking", "you have none", and "you have some and this page could not name their databases"
- * are different states, and collapsing the last into the middle would tell somebody their work
- * is gone because `/nav` came back `degraded`. That degraded 200 is a REAL state this shell
- * already handles elsewhere; it must not read as deletion here.
- *
- * ⚠ The spinner is the shared `lp-spin` mark — R6 forbids load TEXT, and `verify_icons`
- * asserts it across every source file.
  */
-export function QueryEmpty({ loaded, unnamed = 0 }: { loaded: boolean; unnamed?: number }) {
   return (
-    <div className="qy-empty">
-      {!loaded ? (
-        <span className="lp-spin lp-spin--lg" role="status" aria-label="Loading" />
-      ) : unnamed > 0 ? (
-        <>
-          <h1 className="qy-empty-h">Your views could not be opened</h1>
-          <p className="qy-empty-p">
-            The assistant has built {unnamed === 1 ? "a view" : `${unnamed} views`}, but this
-            workspace’s database list did not load, so there is nothing to open them against.
-            Nothing has been lost — reload to try again.
-          </p>
-        </>
-      ) : (
-        <>
-          <h1 className="qy-empty-h">No views yet</h1>
-          <p className="qy-empty-p">
-            Views here are built by the assistant, not by hand. Ask it a question about one of
-            your databases and keep the answer — it opens here, as an ordinary database.
-          </p>
-          <a className="qy-empty-go" href={`#/${ASSISTANT_ROUTE}`}>
-            Open the AI assistant
-          </a>
-        </>
-      )}
     </div>
   );
 }

+import { useState } from "react";
+import { FolderMark } from "../customer-grid/icons";
+import { DbIcon } from "../shell/dbFrame";
 import { ASSISTANT_ROUTE } from "../shell/nav";
+import type { NavEntry } from "../shell/nav";
 import type { SavedQuery } from "./queryApi";
+/** Query has no top-right view dropdown: the rail below IS the navigation (owner item 3). */
+export function QueryEmpty({ loaded, unnamed = 0 }: { loaded: boolean; unnamed?: number }) {
+  return (
+    <div className="qy-empty">
+      {!loaded ? <span className="lp-spin lp-spin--lg" role="status" aria-label="Loading" /> : unnamed > 0 ? (
+        <>
+          <h1 className="qy-empty-h">Your views could not be opened</h1>
+          <p className="qy-empty-p">The source database is no longer in your current permission scope. Nothing was changed.</p>
+        </>
+      ) : (
+        <>
+          <h1 className="qy-empty-h">No Query views yet</h1>
+          <p className="qy-empty-p">Ask the assistant for a table or chart. It creates the Query view immediately.</p>
+          <a className="qy-empty-go" href={`#/${ASSISTANT_ROUTE}`}>Open the AI assistant</a>
+        </>
+      )}
+    </div>
+  );
+}
+/** The kind glyph a Query row wears — the same vocabulary the grid's own view rail uses. */
+const KIND_MARK: Record<string, string> = {
+  grid: "Table", list: "List", chart: "Chart", kanban: "Board",
+  calendar: "Calendar", timeseries: "Time series", map: "Map",
 };
+export interface QueryGroup {
+  database: string;
+  label: string;
+  icon?: NavEntry["icon"];
+  views: SavedQuery[];
+}
 /**
+ * ⭐⭐ OWNER ITEM 3 (2026-08-15) — GROUPED BY SOURCE DATABASE, WHICH IS THE WHOLE INSTRUCTION.
+ * Verbatim: *"these AI generated query should live under the query module. And that each View
+ * correspond to the relevant database. So we need to remove that dumb dropdown that suddenly
+ * appears at the top right of the Database when the AI does query. That's not how we should do
+ * the navigation."*
+ *
+ * ⛔ THE DROPDOWN WAS NOT THE DEFECT — THE ABSENCE OF NAVIGATION WAS. Deleting it (which the
+ * previous pass did) left Query with no way to move between artefacts at all: the page picked
+ * `known[0]` and every other view the assistant had ever built was unreachable. A surface with
+ * one implicit selection is not "no dropdown", it is no navigation, and the owner asked for the
+ * navigation to be done differently rather than removed.
  *
+ * ⚠ AND THIS IS WHERE A DATABASE PUTS ITS VIEWS. `dbFrame.tsx` carries the owner's earlier
+ * sentence — *"the query module should exactly BE looking like the database module, COMPLETELY,
+ * with all the views etc."* — so the rail sits in the slot `CustomerGrid`'s own `ViewSidebar`
+ * occupies on every other database, at the same `--lp-rail-w`. It is a separate component only
+ * because THIS list spans several databases and the grid's rail, by construction, cannot: the
+ * grid is mounted at one scope.
  */
+export function QueryRail({ groups, activeId, onSelect, onDelete }: {
+  groups: QueryGroup[];
   activeId: string;
+  onSelect: (id: string) => void;
+  onDelete: (id: string) => void;
 }) {
+  // Two-click delete, in the row. A modal for "remove one of my own saved answers" is heavier
+  // than the act; a single click with no confirm loses work to a mis-click on a hover control.
+  const [confirming, setConfirming] = useState("");
   return (
+    <aside className="qy-rail" aria-label="Query views">
+      <p className="qy-rail-head">Views</p>
+      <div className="qy-rail-scroll">
+        {groups.map((group) => (
+          <section className="qy-rail-group" key={group.database}>
+            <p className="qy-rail-db">
+              <span className="qy-rail-db-mark" aria-hidden="true">
+                {group.icon ? <FolderMark icon={group.icon} size={14} /> : <DbIcon />}
+              </span>
+              <span className="qy-rail-db-name">{group.label}</span>
+            </p>
+            {group.views.map((view) => (
+              <div className={"qy-rail-row" + (view.id === activeId ? " is-active" : "")} key={view.id}>
+                <button
+                  type="button"
+                  className="qy-rail-view"
+                  aria-current={view.id === activeId ? "true" : undefined}
+                  onClick={() => { setConfirming(""); onSelect(view.id); }}
+                  title={view.question}
+                >
+                  <span className="qy-rail-name">{view.name}</span>
+                  <span className="qy-rail-kind">{KIND_MARK[view.kind] ?? view.kind}</span>
+                </button>
+                {confirming === view.id ? (
+                  <button type="button" className="qy-rail-confirm"
+                    onClick={() => { setConfirming(""); onDelete(view.id); }}>
+                    Delete
+                  </button>
+                ) : (
+                  <button type="button" className="qy-rail-del" aria-label={`Delete ${view.name}`}
+                    onClick={() => setConfirming(view.id)}>
+                    <svg viewBox="0 0 16 16" aria-hidden="true" width="13" height="13">
+                      <path d="M3.5 4.5h9M6.5 4.5V3.2h3v1.3M5 4.5l.6 8h4.8l.6-8" />
+                    </svg>
+                  </button>
+                )}
+              </div>
+            ))}
+          </section>
         ))}
+      </div>
+      <a className="qy-rail-ask" href={`#/${ASSISTANT_ROUTE}`}>Ask the assistant</a>
+    </aside>
   );
 }
 /**
+ * The provenance R9 requires, in one readable line rather than a JSON dump.
  *
+ * ⚠ It is a DISCLOSURE, not a banner: shut by default, so a surface whose job is to look like a
+ * database looks like one, and one click away for the reader who wants to audit the number.
  */
+export function QueryProvenance({ view, detail }: { view: SavedQuery; detail: string }) {
+  const [open, setOpen] = useState(false);
   return (
+    <div className={"qy-prov" + (open ? " is-open" : "")}>
+      <button type="button" className="qy-prov-btn" aria-expanded={open} onClick={() => setOpen(!open)}>
+        <span className="qy-prov-q">{view.question}</span>
+        <span className="qy-prov-toggle">{open ? "Hide sources" : "Sources"}</span>
+      </button>
+      {open ? <p className="qy-prov-detail">{detail}</p> : null}
     </div>
   );
 }

web/src/shell/Shell.tsx CHANGED Viewed

@@ -327,31 +327,55 @@ const findAutomation = (entries: NavEntry[]) =>
  * original defect. Only a remembered, explicit `false` suppresses the placeholder. Same on a
  * blocked/parse-failed storage: fall back to reserving.
  */
-const RAIL_MEMORY_KEY = "aios-rail-slots";
-function railMemory(who: string | null): Record<string, boolean> {
-  if (!who) return {};
-  try {
-    const all = JSON.parse(localStorage.getItem(RAIL_MEMORY_KEY) || "{}");
-    const mine = all && typeof all === "object" ? all[who] : null;
-    return mine && typeof mine === "object" ? (mine as Record<string, boolean>) : {};
-  } catch {
-    return {};
-  }
-}
-function rememberRail(who: string | null, slots: Record<string, boolean>) {
-  if (!who) return;
-  try {
-    const raw = localStorage.getItem(RAIL_MEMORY_KEY);
-    const parsed = raw ? JSON.parse(raw) : {};
-    const all = parsed && typeof parsed === "object" ? parsed : {};
-    all[who] = slots;
-    localStorage.setItem(RAIL_MEMORY_KEY, JSON.stringify(all));
-  } catch {
-    // Storage can be blocked. The rail then falls back to reserving the slot, which is the
-    // safe direction: a placeholder that turns into a row beats a row that appears from nowhere.
-  }
 }
 function useHashRoute(): string {
@@ -1001,14 +1025,6 @@ function ShellFrame() {
    * recording "absent" from a failed read would suppress the placeholder on the next load for a
    * row the user actually has [[empty-answer-vs-unfinished-answer]].
    */
-  useEffect(() => {
-    if (nav.phase !== "ready") return;
-    rememberRail(who, {
-      analyst: !!findAnalyst(nav.utility),
-      automation: !!findAutomation(nav.entries),
-    });
-  }, [nav, who]);
   // NO_ENTRIES, not a fresh `[]`: a new array identity on every render would
   // re-run the hash effect below on every render for no reason.
   const entries = nav.phase === "ready" ? nav.entries : NO_ENTRIES;
@@ -1654,31 +1670,28 @@ function ShellFrame() {
    * on one row; a second copy is how the two rows start disagreeing about what `degraded` means
    * [[one-question-two-normalizers]]. `present` is the ONLY per-row input.
    *
-   * ⛔ WHAT THIS DOES NOT CLAIM. `silent` still collapses the slot, and it must: reserving space
-   * for a surface the server did not grant is a hard-coded row this frame refuses to have
-   * (see the file header). So an account that lacks Automation or the Analyst grant still sees
-   * ONE reflow when `/nav` lands — down from every account seeing one, every load.
    */
-  type RailSlot = "row" | "pending" | "unavailable" | "silent";
-  const railWas = railMemory(who);
-  const railSlot = (present: boolean, remembered: string): RailSlot =>
     present
       ? "row"
-      : nav.phase === "loading" || nav.phase === "idle"
-        ? // ⭐ THE MEMORY, and it only ever SUPPRESSES. `false` means "this account did not have
-          // this row last time", which is the one case where reserving a slot creates the flash
-          // -then-collapse a reviewer caught in the first version of this fix. Unknown, or any
-          // other value, reserves — see `railMemory`'s note on why unknown is not false.
-          railWas[remembered] === false
-          ? "silent"
-          : "pending"
-        : nav.phase === "error"
           ? "unavailable"
-          : nav.phase === "ready" && (nav.degraded?.length ?? 0) > 0
-            ? "unavailable"
-            : "silent";
-  const automationSlot: RailSlot = railSlot(!!automation, "automation");
-  const analystSlot: RailSlot = railSlot(!!analyst, "analyst");
   const dbEntries = databaseEntries(entries);
   // WAVE 23 C10 — the flyout's search. A plain label substring, case-folded: this list is at
   // most a few dozen rows, so anything cleverer (fuzzy, ranked) would be a scoring function
@@ -1735,7 +1748,13 @@ function ShellFrame() {
           </button>
         </div>
-        <nav className="shell-nav">
           {/* ⭐ WAVE 23 item 9 (R7, contract C10) — HOME, the new landing, at the top of the rail.
               An `<a>` to a CHROME route: it needs no grant because it renders nothing the server
               did not already send (nav.ts' `CHROME_ROUTES` note carries the full argument, and
@@ -1784,25 +1803,6 @@ function ShellFrame() {
               <SparkIcon />
               <span className="shell-nav-label">AI assistant</span>
             </button>
-          ) : analystSlot === "pending" ? (
-            /* ⭐⭐ W33-T22 (owner item 1) — THE ASSISTANT'S OWN SLOT, held from first paint.
-               ⛔ THIS IS THE ROW THE OWNER WAS ACTUALLY REPORTING. Without it, `/nav` landing
-               INSERTED ~34 px here and pushed Query / Inbox / Automation / Database / Connectors
-               down — so the row a reader sees "load separately" is the one with NO gate at all
-               (Connectors, `:1765`), which cannot arrive late and therefore must have MOVED.
-               ⚠ Same classes as Automation's pending arm on purpose: `.shell-nav-item.is-pending`
-               and `.shell-nav-item.is-pending .lp-spin{16px}` are GENERIC rules in index.css, and
-               `.shell-nav-assist` applies by class, so this placeholder is the same 34 px box the
-               real row will be. A new modifier class would need an index.css rule (B's file, C4)
-               and would render at a different height until it got one — which is the jump again. */
-            <div
-              className="shell-nav-item shell-nav-assist is-pending"
-              aria-busy="true"
-              aria-label="AI assistant is loading"
-            >
-              <span className="lp-spin" aria-hidden="true" />
-              <span className="shell-nav-label shell-nav-label--muted">AI assistant</span>
-            </div>
           ) : analystSlot === "unavailable" ? (
             /* ⛔ The payload never came, or came back `degraded`. Silence here is a claim that this
                workspace has no assistant, and we do not know that — same argument as W31-T11's
@@ -1819,6 +1819,8 @@ function ShellFrame() {
               <span className="shell-nav-label shell-nav-label--muted">AI assistant</span>
               <span className="shell-nav-note-dot" aria-hidden="true" />
             </div>
           ) : null}
           {/* ⛔ THE "AI agent" ROW WAS HERE AND IS DELETED (owner, 2026-08-14): *"AI assistant
@@ -1924,19 +1926,6 @@ function ShellFrame() {
               )}
               <span className="shell-nav-label">{automation.label}</span>
             </a>
-          ) : automationSlot === "pending" ? (
-            /* ⭐ W31-T11 — THE PENDING STATE, IN AUTOMATION'S OWN SLOT. The shared spinner mark
-               (R6: the mark, never the word "Loading…", which `verify_icons` enforces), on a row
-               that occupies the space the real one will. `aria-busy` is what makes it a pending
-               ROW to a screen reader rather than a decorative glyph. */
-            <div
-              className="shell-nav-item shell-nav-auto is-pending"
-              aria-busy="true"
-              aria-label="Automation is loading"
-            >
-              <span className="lp-spin" aria-hidden="true" />
-              <span className="shell-nav-label shell-nav-label--muted">Automation</span>
-            </div>
           ) : automationSlot === "unavailable" ? (
             /* ⛔ W31-T11 — NOT LOADING, AND NOT ABSENT-ON-PURPOSE: the server said this payload
                is incomplete (`degraded`), or it never answered. The row states that rather than
@@ -1953,6 +1942,8 @@ function ShellFrame() {
               <span className="shell-nav-label shell-nav-label--muted">Automation</span>
               <span className="shell-nav-note-dot" aria-hidden="true" />
             </div>
           ) : null}
           {/* ⭐ WAVE 23 item 9 (R7) — THE DATABASE BUTTON, and the end of the always-on band.
@@ -2345,14 +2336,8 @@ function ShellFrame() {
                 document.body
               )
             : null}
-          {/* Wave 17 item 3 (R6) — the mark, never the word. "Loading…" under an
-              empty rail told the reader what they could already see, and it read
-              as a nav ITEM for the beat before it vanished. */}
-          {nav.phase === "loading" ? (
-            <div className="shell-nav-note is-spin">
-              <span className="lp-spin" role="status" aria-label="Loading" />
-            </div>
-          ) : null}
           {/* Honest, and it names the fix. Inventing a nav here would show
               surfaces the server never granted. */}
           {nav.phase === "error" ? (

  * original defect. Only a remembered, explicit `false` suppresses the placeholder. Same on a
  * blocked/parse-failed storage: fall back to reserving.
  */
+// W33-T75 supersedes the T22 account-memory approach above.  A fresh account has no remembered
+// row set, so optional destinations retain an inert final skeleton rather than collapsing after
+// `/nav` resolves.  The skeleton has no label, route, focus target, or source of permission.
+/**
+ * ⭐⭐ W33-T75 (owner item 1, `reference/ERROR 6.png`) — THE RAIL PAINTS ONCE.
+ *
+ * ⛔ THE ACCEPTANCE TEST IS NOT "THE SPINNER IS GONE", IT IS "NO ROW IS EVER IN A DIFFERENT
+ * STATE FROM ITS SIBLINGS." The owner has reported this four times. Every previous answer kept
+ * the same shape — five finished rows plus one or two rows wearing a *distinguishable* loading
+ * state — and shrank the difference: `/nav` went 11.0 s → 26 ms (still two paints, because
+ * `:911` makes `entries` `NO_ENTRIES` until `nav.phase === "ready"`, so first paint happens
+ * while "does this workspace have Automation / an Analyst?" is unknown at ANY speed); then W31-T11
+ * gave Automation a spinner slot; then W33-T22 gave the Assistant one too. `ERROR 6.png` is the
+ * result: Home / Query / Inbox / Database / Connectors drawn in ink, **AI assistant and Automation
+ * drawn as spinners**, and a sixth spinner below Connectors. Two states in one list is exactly
+ * what "the navigation loads separately" describes, and a placeholder that ANNOUNCES itself as
+ * pending is a second state however tall it is.
+ *
+ * ⛔ SO THE FIX IS AT THE OTHER END: while `/nav` is in flight the rail draws THIS and no rows at
+ * all. One skeleton, seven identical bars, nothing claiming to be a destination — then the real
+ * rail arrives in a single paint. There is no frame in which one row is further along than
+ * another, which is the only form of the sentence that cannot come back a fifth time.
+ *
+ * ⚠ WHAT IT COSTS, STATED RATHER THAN DISCOVERED: Home / Query / Inbox / Database / Connectors
+ * are not clickable for the length of the `/nav` round trip, where before they were. That is a
+ * real trade and it is the owner's own priority — measured, `/nav` is **0.77 s cold on the
+ * deployed build and 26 ms warm** (wave 33 close record), so the window is short; and the four
+ * waves of reports are about the rail's shape, never about waiting for it. `phase: "error"` and
+ * `degraded` are UNCHANGED: they draw the real rows with their unavailable arms, because there
+ * the answer has arrived and is bad news, which is a fact worth showing rather than a wait.
+ *
+ * ⚠ The count is the rail's own maximum (7), not a guess: Home · AI assistant · Query · Inbox ·
+ * Automation · Database · Connectors. A skeleton one bar taller than the settled rail is a
+ * shrink, never the appear-from-nowhere shove W33-T22 was written about.
+ */
+const RAIL_SKELETON_ROWS = 7;
+function RailSkeleton() {
+  return (
+    <div className="shell-rail-skeleton" role="status" aria-label="Loading navigation">
+      {Array.from({ length: RAIL_SKELETON_ROWS }, (_, i) => (
+        <div className="shell-rail-skeleton-row" key={i} aria-hidden="true">
+          <span className="shell-rail-skeleton-mark" />
+          <span className="shell-rail-skeleton-bar" />
+        </div>
+      ))}
+    </div>
+  );
 }
 function useHashRoute(): string {
    * recording "absent" from a failed read would suppress the placeholder on the next load for a
    * row the user actually has [[empty-answer-vs-unfinished-answer]].
    */
   // NO_ENTRIES, not a fresh `[]`: a new array identity on every render would
   // re-run the hash effect below on every render for no reason.
   const entries = nav.phase === "ready" ? nav.entries : NO_ENTRIES;
    * on one row; a second copy is how the two rows start disagreeing about what `degraded` means
    * [[one-question-two-normalizers]]. `present` is the ONLY per-row input.
    *
+   * ⭐⭐ W33-T75 SUPERSEDES BOTH, AND DELETES THE `pending` STATE ENTIRELY. See `RailSkeleton`:
+   * while `/nav` is in flight this rail draws NO rows, so there is no in-flight row state left
+   * to name. What remains is what the ANSWER says — the row, an `unavailable` arm when the
+   * answer was bad, and an inert `silent` box when the answer was "this workspace does not have
+   * it" (which keeps the geometry identical either way, T22's own finding).
+   *
+   * ⛔ `railLoading` IS THE SAME PREDICATE, WRITTEN ONCE. It is what the rail renders the
+   * skeleton on AND what makes the slot function unreachable, so the two cannot come to disagree
+   * about when the nav is settled [[one-question-two-normalizers]].
    */
+  type RailSlot = "row" | "unavailable" | "silent";
+  const railLoading = nav.phase === "loading" || nav.phase === "idle";
+  const railSlot = (present: boolean): RailSlot =>
     present
       ? "row"
+      : nav.phase === "error"
+        ? "unavailable"
+        : nav.phase === "ready" && (nav.degraded?.length ?? 0) > 0
           ? "unavailable"
+          : "silent";
+  const automationSlot: RailSlot = railSlot(!!automation);
+  const analystSlot: RailSlot = railSlot(!!analyst);
   const dbEntries = databaseEntries(entries);
   // WAVE 23 C10 — the flyout's search. A plain label substring, case-folded: this list is at
   // most a few dozen rows, so anything cleverer (fuzzy, ranked) would be a scoring function
           </button>
         </div>
+        <nav className={"shell-nav" + (railLoading ? " is-rail-loading" : "")}>
+          {/* ⭐⭐ W33-T75 — THE ONE IN-FLIGHT STATE. `is-rail-loading` hides every sibling below
+              (`navExtras.css`), so a row cannot paint ahead of its neighbours. Rendering the rows
+              and hiding them — rather than not rendering them — is deliberate: the flyout portal,
+              the tooltips and the account menu all hang off this subtree, and unmounting them for
+              the length of a fetch would tear down state that has nothing to do with the nav. */}
+          {railLoading ? <RailSkeleton /> : null}
           {/* ⭐ WAVE 23 item 9 (R7, contract C10) — HOME, the new landing, at the top of the rail.
               An `<a>` to a CHROME route: it needs no grant because it renders nothing the server
               did not already send (nav.ts' `CHROME_ROUTES` note carries the full argument, and
               <SparkIcon />
               <span className="shell-nav-label">AI assistant</span>
             </button>
           ) : analystSlot === "unavailable" ? (
             /* ⛔ The payload never came, or came back `degraded`. Silence here is a claim that this
                workspace has no assistant, and we do not know that — same argument as W31-T11's
               <span className="shell-nav-label shell-nav-label--muted">AI assistant</span>
               <span className="shell-nav-note-dot" aria-hidden="true" />
             </div>
+          ) : analystSlot === "silent" ? (
+            <div className="shell-nav-item shell-nav-assist is-rail-skeleton" aria-hidden="true" />
           ) : null}
           {/* ⛔ THE "AI agent" ROW WAS HERE AND IS DELETED (owner, 2026-08-14): *"AI assistant
               )}
               <span className="shell-nav-label">{automation.label}</span>
             </a>
           ) : automationSlot === "unavailable" ? (
             /* ⛔ W31-T11 — NOT LOADING, AND NOT ABSENT-ON-PURPOSE: the server said this payload
                is incomplete (`degraded`), or it never answered. The row states that rather than
               <span className="shell-nav-label shell-nav-label--muted">Automation</span>
               <span className="shell-nav-note-dot" aria-hidden="true" />
             </div>
+          ) : automationSlot === "silent" ? (
+            <div className="shell-nav-item shell-nav-auto is-rail-skeleton" aria-hidden="true" />
           ) : null}
           {/* ⭐ WAVE 23 item 9 (R7) — THE DATABASE BUTTON, and the end of the always-on band.
                 document.body
               )
             : null}
+          {/* W33-T75: loading is represented only by the two row-local slots above. A separate
+              nav-level spinner here sat beneath Connectors and looked like a late eighth row. */}
           {/* Honest, and it names the fix. Inventing a nav here would show
               surfaces the server never granted. */}
           {nav.phase === "error" ? (

web/src/shell/navExtras.css CHANGED Viewed

@@ -43,6 +43,65 @@
   background: transparent;
 }
 .shell-nav-row > .shell-dots,
 .shell-nav-folder > .shell-dots {
   flex: 0 0 auto;

   background: transparent;
 }
+.shell-nav-item.is-rail-skeleton {
+  cursor: default;
+  pointer-events: none;
+}
+/* ⭐⭐ W33-T75 (owner item 1) — THE RAIL'S ONE IN-FLIGHT STATE.
+   ⛔ THE POINT IS THE `:not()`, NOT THE BARS. While `/nav` is in flight EVERY real row is
+   hidden, so the rail cannot show five finished rows beside two loading ones — which is what
+   `reference/ERROR 6.png` is a picture of, and what "the navigation loads separately" has meant
+   in all four reports. They are hidden rather than unmounted because the database flyout portal,
+   the tooltips and the account menu hang off this subtree (see Shell.tsx's note).
+   ⚠ Geometry is copied from `.shell-nav-item` in index.css and must stay copied: 34 px min-height,
+   8 px gap, 7/8 padding, a 16 px mark. A skeleton row of a different height is the layout jump
+   this whole ticket is about, one step earlier. */
+.shell-nav.is-rail-loading > *:not(.shell-rail-skeleton) {
+  display: none;
+}
+.shell-rail-skeleton {
+  display: flex;
+  flex-direction: column;
+}
+.shell-rail-skeleton-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-height: 34px;
+  padding: 7px 8px;
+  box-sizing: border-box;
+}
+.shell-rail-skeleton-mark,
+.shell-rail-skeleton-bar {
+  /* One flat tone, no shimmer: an animated sweep is a second thing moving in a rail whose whole
+     complaint is movement, and `prefers-reduced-motion` would then need a third state. */
+  background: var(--lp-surface-2);
+  border-radius: var(--lp-r-sm);
+}
+.shell-rail-skeleton-mark {
+  flex: 0 0 auto;
+  width: 16px;
+  height: 16px;
+}
+.shell-rail-skeleton-bar {
+  flex: 0 0 auto;
+  width: 84px;
+  height: 9px;
+  border-radius: 4px;
+}
+/* Collapsed, the labels are gone from the real rail, so the skeleton drops its bars too —
+   otherwise the fold animation runs against a width the settled rail never has. */
+.shell-side.is-collapsed .shell-rail-skeleton-bar {
+  display: none;
+}
 .shell-nav-row > .shell-dots,
 .shell-nav-folder > .shell-dots {
   flex: 0 0 auto;