Deploy AIOS web (React glide grid + FastAPI slice)

api/routes_customers.py

@@ -158,10 +158,15 @@ def _measure_err(tag, e):
 # `patch_shared_cell` wrote into a bucket no reader ever opened.
 
 
-def _shared_key():
+def _shared_key():
     """The store key this topic's per-user AND tenant-wide strata are both named from."""
-    import modules.customer_data as cl
-    return cl.TABLE_KEY
+    import modules.customer_data as cl
+    return cl.TABLE_KEY
+
+
+def _customer_table(session):
+    import core.table_store as table_store
+    return table_store.make(_shared_key(), st=session.runtime)
 
 
 def shared_fields(st=None):
@@ -173,7 +178,8 @@ def shared_fields(st=None):
     """
     from core import field_permissions, shared_overlay
     try:
-        field_permissions.migrate_legacy_fields(_shared_key(), st=st)
+        field_permissions.migrate_legacy_fields(
+            _shared_key(), st=st, grant_topic="customer_data", shared_key=_shared_key())
         return shared_overlay.fields(_shared_key(), st=st)
     except Exception:                                       # noqa: BLE001
         # Lenient like every other display read: an unreachable store degrades to "nothing is
@@ -197,7 +203,7 @@ def shared_cells(pids, st=None):
         return {}
 
 
-def _merge_shared_fields(fields, defs):
+def _merge_shared_fields(fields, defs, session=None):
     """`fields` PLUS the tenant-wide columns this topic declares — `routes_tables._ut_shared_fields`
     on the customer topic.
 
@@ -212,8 +218,20 @@ def _merge_shared_fields(fields, defs):
     if not defs:
         return fields
     have = {f.get("key") for f in (fields or ()) if isinstance(f, dict)}
-    return list(fields or ()) + [dict(f, source="overlay", shared=True)
-                                 for k, f in defs.items() if k not in have]
+    projected = []
+    for k, f in defs.items():
+        if k in have:
+            continue
+        item = dict(f, source="overlay", shared=True)
+        if session is not None:
+            from core import shares
+            role = shares.role_for(
+                "field", shares.field_oid("customer_data", k), session.uname,
+                is_admin=session.admin, st=session.runtime)
+            if role:
+                item["sharedRole"] = role
+        projected.append(item)
+    return list(fields or ()) + projected
 
 
 def grid_assembly(session: Session, scope: str = "customer", storage_key: str = "",
@@ -290,7 +308,7 @@ def grid_assembly(session: Session, scope: str = "customer", storage_key: str =
     # ⭐⭐ W38-T20 — AND THE COLUMN DEFINITIONS, BEFORE THE WALL. See `_merge_shared_fields`: this
     # position is load-bearing twice, once for the transitive closure and once because it is the
     # only order in which the per-field grant marker is ever presented to `hidden_keys`.
-    fields = _merge_shared_fields(fields, _defs)
+    fields = _merge_shared_fields(fields, _defs, session=session)
     # THE FIELD WALL — a TRANSITIVE closure (C-PERM amendment 5), so hiding a field also hides
     # every formula computed FROM it. Formulas evaluate in the browser from `{ref}`s, so
     # shipping a dependent formula while withholding its input either leaks the input through
@@ -420,13 +438,14 @@ def _ctx_for(session: Session, pids, defs=None):
     them; absent, they are read. One read per assembly rather than one per question asked of it.
     """
     from core import grid_events
-    return grid_events.EventCtx(
-        uname=session.uname, allowed_pids=frozenset(pids or ()), fields=[],
+    return grid_events.EventCtx(
+        uname=session.uname, allowed_pids=frozenset(pids or ()), fields=[],
         # C-PERM: the write wall's field half. Computed from the CANONICAL contract PLUS the
         # tenant-wide columns, because `fields=[]` here — the closure only needs the schema, not
         # this user's column list, and a runtime column is part of that schema now.
-        hidden_keys=_hidden_for(session, defs=defs),
-        admin=session.admin, fallback_ws=None, seen_ids={})
+        hidden_keys=_hidden_for(session, defs=defs),
+        admin=session.admin, table=_customer_table(session), st=session.runtime,
+        fallback_ws=None, seen_ids={})
 
 
 
@@ -505,10 +524,11 @@ def patch_customer(pid: int, body: dict = Body(default=None),
         # saying "no such customer" would confirm the opposite to anyone who guessed right.
         raise err(403, "out_of_scope", "that customer is not in your book")
     payload = _payload(session)
-    ctx = grid_events.EventCtx(
-        uname=session.uname, allowed_pids=pool, fields=payload["fields"],
-        admin=session.admin, fallback_ws=None, seen_ids={},
-        hidden_keys=_hidden_for(session))
+    ctx = grid_events.EventCtx(
+        uname=session.uname, allowed_pids=pool, fields=payload["fields"],
+        admin=session.admin, fallback_ws=None, seen_ids={},
+        hidden_keys=_hidden_for(session), table=_customer_table(session),
+        st=session.runtime)
     try:
         grid_events.handle_one(
             {"id": f"patch:{pid}:{time.time_ns()}", "type": "overlay_patch",

api/routes_grid.py

@@ -54,7 +54,7 @@ def _ctx(session: Session, fields, pids, **kw):
 
         module, canonical = _PMOD, pd_fields(consolidated=True, st=session.runtime)
         kw.setdefault("table", pd.table_ops(session.runtime))
-        hidden = perm_scope.hidden_keys(session.user, module, canonical)
+        hidden = perm_scope.hidden_keys(session.user, module, canonical, st=session.runtime)
     elif scope_key.startswith("ut_"):
         # Wave 18 C3-UT: a user table has no module in the permission wall (its wall is
         # `user_tables.may_open`, already applied by the assembly this route ran first), so
@@ -64,9 +64,12 @@ def _ctx(session: Session, fields, pids, **kw):
         kw.setdefault("table",
                       table_store.make(f"{scope_key}_table_workspace", st=session.runtime))
         hidden = frozenset()
-    else:
-        module, canonical = MODULE, aios_grid.FIELDS
-        hidden = perm_scope.hidden_keys(session.user, module, canonical)
+    else:
+        module, canonical = MODULE, aios_grid.FIELDS
+        import core.table_store as table_store
+        kw.setdefault("table", table_store.make(
+            "customer_table_workspace", st=session.runtime))
+        hidden = perm_scope.hidden_keys(session.user, module, canonical, st=session.runtime)
     return grid_events.EventCtx(
         uname=session.uname, allowed_pids=pids, fields=fields, admin=session.admin,
         # C-PERM: the write wall's field half, on the EVENTS transport too. This route takes the

api/routes_products.py

@@ -366,8 +366,19 @@ def product_assembly(session: Session, scope: str = "product", storage_key: str
         fields_base=fields_base)
 
     have = {field.get("key") for field in fields if isinstance(field, dict)}
-    fields = list(fields) + [dict(field, source="overlay", shared=True)
-                             for key, field in shared_defs.items() if key not in have]
+    projected = []
+    from core import shares
+    for key, field in shared_defs.items():
+        if key in have:
+            continue
+        item = dict(field, source="overlay", shared=True)
+        role = shares.role_for(
+            "field", shares.field_oid("product_data", key), session.uname,
+            is_admin=session.admin, st=session.runtime)
+        if role:
+            item["sharedRole"] = role
+        projected.append(item)
+    fields = list(fields) + projected
 
     hidden = perm_scope.hidden_keys(session.user, MODULE, fields, st=session.runtime)
     if hidden:

api/routes_shares.py

@@ -85,10 +85,57 @@ def _kind_or_400(raw):
 
 #: The built-in grid topics. A view or folder lives in `{topic}_table_workspace`, and the share
 #: route is not told which topic — so resolving one means asking each.
-_BUILTIN_TOPICS = ("customer", "product")
-
-
-def _topics(session):
+_BUILTIN_TOPICS = ("customer", "product")
+
+
+def _field_storage_keys(table_key):
+    """Resolve the client-facing field topic to its durable stores and grant topic."""
+    raw = str(table_key or "").strip()
+    if raw in ("customer_data", "customer_table_workspace"):
+        return "customer_table_workspace", "customer_table_workspace", "customer_data"
+    if raw in ("product_data", "product_table_workspace"):
+        return "product_table_workspace", "product_table_workspace", "product_data"
+    if raw.startswith("ut_"):
+        bare = raw[:-len("_table_workspace")] if raw.endswith("_table_workspace") else raw
+        return f"{bare}_table_workspace", bare, bare
+    workspace = raw if raw.endswith("_table_workspace") else f"{raw}_table_workspace"
+    shared = raw[:-len("_table_workspace")] if raw.endswith("_table_workspace") else raw
+    return workspace, shared, shared
+
+
+def _field_definition(session, table_key, field_key):
+    """Return the shared/private definition and the keys used by its write paths."""
+    workspace_key, shared_key, grant_topic = _field_storage_keys(table_key)
+    try:
+        from core import shared_overlay
+        shared = (shared_overlay.fields(shared_key, st=session.runtime) or {}).get(field_key)
+        if isinstance(shared, dict):
+            return shared, True, workspace_key, shared_key, grant_topic
+        import core.table_store as table_store
+        private = (table_store.make(workspace_key, st=session.runtime)
+                   .workspace(session.uname).get("fields") or {}).get(field_key)
+        if isinstance(private, dict):
+            return private, False, workspace_key, shared_key, grant_topic
+    except Exception:                                       # noqa: BLE001
+        pass
+    return None, False, workspace_key, shared_key, grant_topic
+
+
+def _field_owner(session, definition, already_shared):
+    """Resolve the creator for the share claim wall.
+
+    A private field is already namespaced by the caller's own workspace.  Older field records
+    from before the host-side creator stamp therefore remain safely claimable by that workspace
+    owner, while a shared definition with no creator stays admin-only because its storage is
+    tenant-wide and cannot identify an owner from residency alone.
+    """
+    owner = str((definition or {}).get("createdBy") or "").strip()
+    if owner:
+        return owner
+    return str(session.uname or "").strip() if not already_shared else ""
+
+
+def _topics(session):
     """Every topic whose workspace could hold a view or folder for this tenant.
 
     ⚠ `all_defs`, never `all_tables` — the latter is the whole 28.6 MB row payload (~703 ms on
@@ -121,15 +168,13 @@ def _owns_object(session, kind, oid):
         # a brand-new column has no grant record, so `put_share` falls to this predicate — and
         # without it the column's own creator is answered `404 no_object` on the first attempt to
         # share the thing they just made.
-        table_key, field_key = shares.split_field_oid(oid)
-        if not table_key:
-            return False
-        try:
-            import core.shared_overlay as shared_overlay
-            defn = (shared_overlay.fields(table_key, st=session.runtime) or {}).get(field_key)
-        except Exception:                                   # noqa: BLE001
-            return False
-        return bool(defn) and str(defn.get("createdBy") or "") == str(session.uname)
+        table_key, field_key = shares.split_field_oid(oid)
+        if not table_key:
+            return False
+        defn, _shared, _workspace, _shared_key, _grant_topic = _field_definition(
+            session, table_key, field_key)
+        owner = _field_owner(session, defn, _shared)
+        return bool(defn) and owner.lower() == str(session.uname).strip().lower()
     if kind == "database":
         # ⚠ `may_open` is THE resolver for a user table (its own docstring says so) and already
         # admits creator, admin, or a `database` grantee. Re-implementing "who owns a table"
@@ -242,8 +287,12 @@ def my_shares(session: Session = Depends(require_session)):
 
 
 @router.get("/share/{kind}/{oid}")
-def get_share(kind: str, oid: str, session: Session = Depends(require_session)):
-    kind = _kind_or_400(kind)
+def get_share(kind: str, oid: str, session: Session = Depends(require_session)):
+    kind = _kind_or_400(kind)
+    if kind == "field":
+        table_key, field_key = shares.split_field_oid(oid)
+        if table_key and field_key:
+            oid = shares.field_oid(_field_storage_keys(table_key)[2], field_key)
     rec = shares.grants(kind, oid, st=session.runtime)
     role = shares.role_for(kind, oid, session.uname, is_admin=session.admin, st=session.runtime)
     may_admin = shares.may_administer(kind, oid, session.uname, is_admin=session.admin,
@@ -298,10 +347,14 @@ def _people(tenant):
 
 
 @router.put("/share/{kind}/{oid}")
-def put_share(kind: str, oid: str, body: dict = Body(default=None),
-              session: Session = Depends(require_session)):
-    kind = _kind_or_400(kind)
-    body = body or {}
+def put_share(kind: str, oid: str, body: dict = Body(default=None),
+              session: Session = Depends(require_session)):
+    kind = _kind_or_400(kind)
+    if kind == "field":
+        table_key, field_key = shares.split_field_oid(oid)
+        if table_key and field_key:
+            oid = shares.field_oid(_field_storage_keys(table_key)[2], field_key)
+    body = body or {}
     rec = shares.grants(kind, oid, st=session.runtime)
     # An object with NO grant record yet has no owner — the first person to share it claims it.
     # That is safe because reaching this route at all means passing the surface's own wall, and
@@ -328,19 +381,24 @@ def put_share(kind: str, oid: str, body: dict = Body(default=None),
                   "revoking is expressed")
     _entries_or_400(session, entries)
     if kind == "field":
-        # A field grant is a visibility wall, and the wall must be declared
-        # on the stored field before the grant registry changes.  Without this
-        # marker `perm_scope.field_grant_hidden` correctly treats the field as
-        # an ungoverned legacy column and the recipient still sees it even
-        # after the dialog reports success.
-        from core import shared_overlay
+        # A field grant is a visibility and edit wall. Promote a private custom
+        # field exactly once, then keep the requested Share field role as the
+        # authoritative override for the legacy permissions bag.
+        from core import field_permissions, shared_overlay
         table_key, field_key = shares.split_field_oid(oid)
-        defn = (shared_overlay.fields(table_key, st=session.runtime) or {}).get(field_key)
+        defn, already_shared, workspace_key, shared_key, grant_topic = _field_definition(
+            session, table_key, field_key)
         if not isinstance(defn, dict):
             raise err(404, "no_object", "no such field, or it is not shared with this account")
+        if not already_shared:
+            defn = field_permissions.promote_field(
+                workspace_key, shared_key, grant_topic,
+                session.uname, defn, st=session.runtime)
         stamped = dict(defn)
+        stamped["shared"] = True
         stamped["granted"] = True
-        shared_overlay.put_field(table_key, field_key, stamped, st=session.runtime)
+        shared_overlay.put_field(shared_key, field_key, stamped, st=session.runtime)
+        oid = shares.field_oid(grant_topic, field_key)
     out = shares.set_grants(kind, oid, entries, owner=rec["owner"] or session.uname,
                             st=session.runtime)
     _notify_new_grantees(session, kind, oid, before=rec["entries"], after=out.get("entries") or [])
@@ -426,25 +484,27 @@ def _object_ref(session, kind, oid):
             # answers `route=None` — and `_notify_new_grantees` returns EARLY. The grant lands and
             # the receiver is never told, which is the silent half of owner item 18 reopened one
             # kind over.
-            from routes_alerts import route_for_topic
-            table_key, field_key = shares.split_field_oid(oid)
-            if not table_key:
-                return ("A column", None, "")
-            try:
-                import core.shared_overlay as shared_overlay
-                defn = (shared_overlay.fields(table_key, st=session.runtime) or {}).get(field_key)
-            except Exception:                               # noqa: BLE001
-                defn = None
-            label = str((defn or {}).get("label") or "").strip() or field_key
+            from routes_alerts import route_for_topic
+            table_key, field_key = shares.split_field_oid(oid)
+            if not table_key:
+                return ("A column", None, "")
+            try:
+                defn, _shared, _workspace, shared_key, _grant_topic = _field_definition(
+                    session, table_key, field_key)
+            except Exception:                               # noqa: BLE001
+                defn = None
+            label = str((defn or {}).get("label") or "").strip() or field_key
             # ⚠ TWO SPELLINGS REACH THIS LINE AND ONE MAP ANSWERS BOTH. `shared_overlay` is keyed
             # by whatever the calling door already held: a `ut_*` database uses its bare key,
             # while a registry topic uses `<topic>_table_workspace` (`product_data.TABLE_KEY`).
             # `route_for_topic` speaks the GRID SCOPE vocabulary (`customer`, not
             # `customer_data`), so the suffix comes off before it is asked — rather than a second
             # route table being written here, which is how the two come apart.
-            _WS = "_table_workspace"
-            scope = table_key[:-len(_WS)] if table_key.endswith(_WS) else table_key
-            return (label, route_for_topic(scope) or None, "")
+            _WS = "_table_workspace"
+            scope = {"customer_data": "customer", "product_data": "product"}.get(table_key)
+            if scope is None:
+                scope = table_key[:-len(_WS)] if table_key.endswith(_WS) else table_key
+            return (label, route_for_topic(scope) or None, "")
         if kind == "database":
             import core.user_tables as ut
             defn = (ut.all_defs(st=session.runtime) or {}).get(str(oid)) or {}

api/routes_tables.py

@@ -744,8 +744,19 @@ def _ut_shared_fields(session, table_key, fields):
     if not defs:
         return fields
     have = {f.get("key") for f in (fields or ()) if isinstance(f, dict)}
-    return list(fields or ()) + [dict(f, source="overlay", shared=True)
-                                 for k, f in defs.items() if k not in have]
+    from core import shares
+    projected = []
+    for k, f in defs.items():
+        if k in have:
+            continue
+        item = dict(f, source="overlay", shared=True)
+        role = shares.role_for(
+            "field", shares.field_oid(table_key, k), session.uname,
+            is_admin=session.admin, st=session.runtime)
+        if role:
+            item["sharedRole"] = role
+        projected.append(item)
+    return list(fields or ()) + projected
 
 
 def _ut_shared_cells(session, table_key, pids):

platform/core/grid_events.py

@@ -261,6 +261,77 @@ def _tops(ctx):
     return cl_mod.TABLE_OPS
 
 
+def _field_share_keys(ctx):
+    """Return (shared storage key, grant topic) for this grid's field registry."""
+    raw = str(getattr(getattr(ctx, 'table', None), 'table_key', '') or '')
+    scope = str(getattr(ctx, 'scope_key', '') or '')
+    if raw == 'product_table_workspace' or scope == 'product':
+        return 'product_table_workspace', 'product_data'
+    if raw == 'customer_table_workspace' or scope in ('customer', 'cohort'):
+        return 'customer_table_workspace', 'customer_data'
+    if raw.startswith('ut_'):
+        bare = raw[:-len('_table_workspace')] if raw.endswith('_table_workspace') else raw
+        return bare, bare
+    if raw.endswith('_table_workspace'):
+        return raw, raw[:-len('_table_workspace')]
+    return raw, raw
+
+
+def _field_share_role(ctx, key, definition):
+    """Return the specific Share field role, if this definition is governed by it."""
+    if not isinstance(definition, dict) or not (definition.get('shared') or
+                                                definition.get('granted')):
+        return None
+    try:
+        import core.shares as _shares
+        _storage_key, topic = _field_share_keys(ctx)
+        return _shares.role_for(
+            'field', _shares.field_oid(topic, key), ctx.uname,
+            is_admin=ctx.admin, st=ctx.st or getattr(ctx.table, 'st', None))
+    except Exception:
+        return None
+
+
+def _may_edit_field_definition(ctx, key, definition):
+    """The server wall for rename/type/settings edits on a field."""
+    if not isinstance(definition, dict):
+        return bool(ctx.admin)
+    if ctx.admin:
+        return True
+    owner = str(definition.get('createdBy') or '').strip().lower()
+    if owner and owner == str(ctx.uname or '').strip().lower():
+        return True
+    if definition.get('shared') or definition.get('granted'):
+        return _field_share_role(ctx, key, definition) in ('owner', 'edit')
+    if not owner:
+        return False
+    from core import field_permissions as _fp
+    perms = _fp.stored_permissions(definition, fallback='collaborative')
+    edit = perms.get('edit')
+    return edit == 'collaborative' or (
+        edit == 'users' and str(ctx.uname).lower() in {
+            str(user).lower() for user in (perms.get('users') or [])})
+
+
+def _may_edit_field_value(ctx, key, definition):
+    """The value-write wall; ordinary source-overlay fields remain collaborative by default."""
+    if not isinstance(definition, dict):
+        return bool(ctx.admin)
+    if ctx.admin:
+        return True
+    owner = str(definition.get('createdBy') or '').strip().lower()
+    if owner and owner == str(ctx.uname or '').strip().lower():
+        return True
+    if definition.get('shared') or definition.get('granted'):
+        return _field_share_role(ctx, key, definition) in ('owner', 'edit')
+    from core import field_permissions as _fp
+    perms = _fp.stored_permissions(definition, fallback='collaborative')
+    edit = perms.get('edit')
+    return edit == 'collaborative' or (
+        edit == 'users' and str(ctx.uname).lower() in {
+            str(user).lower() for user in (perms.get('users') or [])})
+
+
 def _cohorts(ctx):
     """The COHORT store this ctx operates on — `_tops`'s sibling, and here for the same reason.
 
@@ -1199,11 +1270,7 @@ def handle_one(event, ctx):
             try:
                 import core.shared_overlay as _shared_overlay
                 table_key = str(ctx.table.table_key)
-                shared_storage_key = (table_key[:-len('_table_workspace')]
-                                      if table_key.endswith('_table_workspace') else table_key)
-                grant_topic = ('product_data' if table_key == 'product_table_workspace'
-                               else 'customer_data' if table_key == 'customer_data'
-                               else shared_storage_key)
+                shared_storage_key, grant_topic = _field_share_keys(ctx)
                 shared_prior = (_shared_overlay.fields(
                     shared_storage_key, st=ctx.table.st) or {}).get(key)
                 shared_field = bool(isinstance(shared_prior, dict)
@@ -1211,6 +1278,11 @@ def handle_one(event, ctx):
             except Exception:
                 shared_prior = None
         if shared_field:
+            if not _may_edit_field_definition(ctx, key, shared_prior):
+                return _refuse(
+                    ctx, 'field_read_only',
+                    'you can only change this field if you created it or have Can edit access',
+                    key)
             # Pin the type/source/key to the stored definition.  Only the
             # user-authored settings below are allowed to change, so a browser
             # cannot turn an image field into another schema type while saving
@@ -1396,9 +1468,17 @@ def handle_one(event, ctx):
         # admin path and the legacy path are enforceable (and NC'd) right now.
         needs_values = False
         refused_perms = False
+        permission_sync = False
+        promoted_this_save = False
         if shared_field or key.startswith('custom_') or key.startswith(_ag2.MEASURE_FIELD_PREFIX):
             prior = shared_prior if shared_field else ws.get('fields', {}).get(key)
             prior = prior if isinstance(prior, dict) else None
+            if prior is not None and not shared_field \
+                    and not _may_edit_field_definition(ctx, key, prior):
+                return _refuse(
+                    ctx, 'field_read_only',
+                    'you can only change this field if you created it or have Can edit access',
+                    key)
             if prior is None and not shared_field:
                 field['createdBy'] = uname
                 # Wave-6 item 9: scope is chosen at CREATE, on the cohort page only —
@@ -1422,6 +1502,7 @@ def handle_one(event, ctx):
             may_change_permissions = bool(admin or (owner and owner.lower() == uname.lower()))
             if may_change_permissions:
                 field['permissions'] = want
+                permission_sync = has_permission_request
             else:
                 field['permissions'] = have
                 # Asked for a permissions change and did not get it: the client's
@@ -1440,18 +1521,13 @@ def handle_one(event, ctx):
                 and isinstance(value, dict))
         ]
         desired_shared = field.get('permissions', {}).get('edit') in ('collaborative', 'users')
-        if shared_field and not desired_shared and shared_storage_key:
-            # Demotion is a real data move: restore the creator's private definition and values
-            # before dropping the tenant-wide copy, then remove its grant record.
-            field = _fp.demote_field(ctx.table.table_key, shared_storage_key, grant_topic,
-                                     field, st=ctx.table.st)
-            shared_field = False
         if not shared_field and desired_shared and shared_storage_key and ctx.table is not None:
             # Promotion makes the permission choice true for the whole tenant, rather than merely
             # storing a collaborative label in Anna's private workspace.
             field = _fp.promote_field(ctx.table.table_key, shared_storage_key, grant_topic,
                                       field.get('createdBy') or uname, field, st=ctx.table.st)
             shared_field = True
+            promoted_this_save = True
         if shared_field:
             # A shared definition is the source of truth for every tenant
             # member.  Persisting this through TableStore.save_field would put
@@ -1460,10 +1536,11 @@ def handle_one(event, ctx):
             import core.shared_overlay as _shared_overlay
             field = _shared_overlay.put_field(shared_storage_key, key, field,
                                               st=ctx.table.st)
-            import core.shares as _shares
-            _shares.set_grants('field', _shares.field_oid(grant_topic, key),
-                               _fp.grant_entries(field.get('permissions')),
-                               owner=field.get('createdBy') or uname, st=ctx.table.st)
+            if permission_sync or promoted_this_save:
+                import core.shares as _shares
+                _shares.set_grants('field', _shares.field_oid(grant_topic, key),
+                                   _fp.grant_entries(field.get('permissions')),
+                                   owner=field.get('createdBy') or uname, st=ctx.table.st)
         elif _store_of(ctx).available():
             field = (_tops(ctx).save_field(
                 uname, field, reserved_names=_reserved_field_names,
@@ -2116,16 +2193,11 @@ def handle_one(event, ctx):
             if key in (ctx.hidden_keys or frozenset()):
                 refused = True
                 continue
-            # Wave-5 item 1: `permissions.edit` is enforced HERE, per key — the client hiding
-            # its editor is courtesy, this is the wall. Fail-closed: a restricted field with
-            # no readable createdBy admits only admins.
-            from core import field_permissions as _fp_patch
+            # Wave-5 item 1 plus Share field precedence: the client hiding its editor is
+            # courtesy, this is the wall. A shared field's registry role overrides the legacy
+            # permissions bag, so Can view remains read-only inside an editable view.
             definition = field_by_key.get(key) or {}
-            perms = _fp_patch.stored_permissions(definition, fallback='collaborative')
-            edit = perms.get('edit')
-            owner = str(definition.get('createdBy') or '').strip().lower()
-            permitted = (admin or (owner and owner == uname) or edit == 'collaborative' or
-                         (edit == 'users' and uname in (perms.get('users') or [])))
+            permitted = _may_edit_field_value(ctx, key, definition)
             if not permitted:
                 refused = True
                 continue

platform/core/user_tables.py

@@ -2467,9 +2467,11 @@ def clean_machine_fields(fields):
     return clean, refused
 
 
-def may_edit_field(table_key, fkey, viewer, is_admin=False, st=None):
-    """May `viewer` change THIS column's definition? Creator/admin always; others only when the
-    field itself says `editRole: 'everyone'`. Fail-closed on an unknown field."""
+def may_edit_field(table_key, fkey, viewer, is_admin=False, st=None):
+    """May `viewer` change THIS column's definition? Creator/admin always; others only when the
+    field itself says `editRole: 'everyone'`, unless Share field has a specific role. The
+    field-specific share role is authoritative for shared fields. Fail-closed on an unknown
+    field."""
     table = get(table_key, st) or {}
     field = next((f for f in (table.get('fields') or []) if f.get('key') == str(fkey)), None)
     # Instagram's pre-set schema is product contract, not tenant configuration. Even an admin
@@ -2479,12 +2481,21 @@ def may_edit_field(table_key, fkey, viewer, is_admin=False, st=None):
             and field['automation'].get('preset') is True \
             and not preset_editable(field):
         return False
-    if may_open(table_key, viewer, is_admin, st) and (
-            bool(is_admin) or table.get('createdBy') == viewer):
-        return True
-    for f in (table.get('fields') or []):
-        if f.get('key') == str(fkey):
-            return f.get('editRole') == 'everyone'
+    if may_open(table_key, viewer, is_admin, st) and (
+            bool(is_admin) or table.get('createdBy') == viewer):
+        return True
+    for f in (table.get('fields') or []):
+        if f.get('key') == str(fkey):
+            try:
+                import core.shares as shares
+                role = shares.role_for(
+                    'field', shares.field_oid(table_key, fkey), viewer,
+                    is_admin=is_admin, st=st)
+                if role is not None:
+                    return role in ('owner', 'edit')
+            except Exception:
+                pass
+            return f.get('editRole') == 'everyone'
     return False
 
 

web/src/customer-grid/ColumnMenu.tsx

@@ -11,35 +11,19 @@ import { FieldSelectButton } from "./FieldSelect";
 import { CODE_LANGUAGE_LABELS, CODE_LANGUAGES, CREATABLE_TYPES, choiceOptions, choiceRenames,
   codeLanguageOf, directionLabel, isDerivedLink, isMachineOwned,
   isProfileField, parseOptions, ratingMax, ROLLUP_FN_LABELS, ROLLUP_FNS,
-  ROLLUP_REF_OPS, FIELD_EDIT_BLURBS, FIELD_EDIT_LABELS, FIELD_EDIT_MODES,
-  cleanFieldPermissions } from "./types";
+  ROLLUP_REF_OPS, mayEditFieldDefinition } from "./types";
 import type { AggName, Field, FieldFormat, FieldScope, FieldType, Measure, RollupCondition, RollupFn,
-  RollupRefOp, RollupSource, Viewer, FieldEditMode, FieldPermissions } from "./types";
+  RollupRefOp, RollupSource, Viewer } from "./types";
 import type { LinkTarget, RollupSourceOffer } from "./apiBridge";
 import type { WindowSpec } from "./windows";
 import { normalizeWindow, windowLabel } from "./windows";
 import { WindowPicker } from "../filter-kit";
-import { FOLDER_TONE_PAINT, TYPE_LABELS } from "./iconShapes";
+import { TYPE_LABELS } from "./iconShapes";
 import { AGG_LABELS, aggOptions } from "./aggregations";
 import { validateFormula } from "./formulaEngine";
 import { BRAND_SWATCHES, defaultOptionColor, nearestSwatch, normalizeOptionColor,
   OPTION_PALETTE } from "./choiceColors";
 
-const FIELD_PERM_MARK: Record<FieldEditMode, string[]> = {
-  personal: ["M8 7.4a2 2 0 1 0 0-4 2 2 0 0 0 0 4ZM4.8 12.6c0-1.9 1.4-3.1 3.2-3.1s3.2 1.2 3.2 3.1"],
-  collaborative: ["M5.9 7.4a2 2 0 1 0 0-4 2 2 0 0 0 0 4Z", "M10.6 7.4a2 2 0 1 0 0-4 2 2 0 0 0 0 4Z"],
-  users: ["M6 7.4a2 2 0 1 0 0-4 2 2 0 0 0 0 4Z", "M2.8 12.6c0-1.9 1.4-3.1 3.2-3.1s3.2 1.2 3.2 3.1", "M10.6 9.4l1.5 1.6 2.6-3"],
-};
-function FieldPermMark({ mode }: { mode: FieldEditMode }) {
-  const tone = mode === "personal" ? "neutral" : mode === "collaborative" ? "blue" : "green";
-  return <svg className="cg-perm-mark" width={16} height={16} viewBox="0 0 16 16" aria-hidden>
-    {FIELD_PERM_MARK[mode].map((d, i) => (
-      <path key={i} d={d} fill="none" stroke={FOLDER_TONE_PAINT[tone].stroke}
-        strokeWidth={1.35} strokeLinecap="round" strokeLinejoin="round" />
-    ))}
-  </svg>;
-}
-
 export interface ColumnMenuState {
   fieldKey: string;
   anchor: AnchorRect;
@@ -275,9 +259,6 @@ interface ColumnMenuProps {
   /** Wave-5 item 1 — Duplicate field. Supplied for creatable strata only (base Odoo fields
    *  offer no Duplicate — cloning the source of truth into an editable copy is out of scope). */
   onDuplicate?: () => void;
-  /** Wave-5 item 1 — save a permissions change. Supplied iff the VIEWER may change them
-   *  (isAdmin || createdBy === viewer.name, and only on creatable strata). */
-  onPermissions?: (permissions: FieldPermissions) => void;
   /** Wave-5 item 10 — save a display format. Supplied for number/currency/formula and
    *  date/created_time fields. */
   onFormat?: (format: FieldFormat) => void;
@@ -296,9 +277,6 @@ interface ColumnMenuProps {
   /** Assignable people, from the host's real user list. Empty = the host did not supply one,
    *  and "Assignee" is offered without choices rather than with invented ones. */
   userOptions?: string[];
-  /** Account identities used by field permissions. This is deliberately separate from
-   * user-valued cell choices, which are display labels rather than durable usernames. */
-  permissionUserOptions?: { username: string; name: string }[];
   /**
    * CG-8's measures, reused as the vocabulary of a FORMULA-MEASURE column (owner item 7):
    * `Sales · the last 90 days` as a column the user creates. Empty = the semantic store is
@@ -355,7 +333,7 @@ type CreatePosition = "left" | "right" | "end";
  * choices/stars/formula config), and the Change-field control that swaps the column to show
  * another field.
  */
-type MenuPane = "menu" | "note" | "edit" | "permissions" | "format" | "summary";
+type MenuPane = "menu" | "edit" | "format" | "summary";
 
 /**
  * How each creatable type reads in the menu. DERIVED from CREATABLE_TYPES rather than listed
@@ -2048,7 +2026,6 @@ export default function ColumnMenu({
   onDelete,
   onEnrich,
   onDuplicate,
-  onPermissions,
   onFormat,
   onAggregate,
   onSort,
@@ -2058,11 +2035,15 @@ export default function ColumnMenu({
   onGroupByField,
   onClearGroup,
   userOptions = [],
-  permissionUserOptions = [],
   measures = [],
   tableKey,
 }: ColumnMenuProps) {
-  const [pane, setPane] = useState<MenuPane>(schemaLocked ? "menu" : initialPane ?? "menu");
+  const canEditDefinition = !schemaLocked && mayEditFieldDefinition(field, viewer);
+  const [pane, setPane] = useState<MenuPane>(
+    schemaLocked || (initialPane === "edit" && !canEditDefinition)
+      ? "menu"
+      : initialPane ?? "menu"
+  );
   const [note, setNote] = useState(field.note ?? "");
   const [position, setPosition] = useState<CreatePosition | null>(initialPosition ?? null);
   /** Delete is DESTRUCTIVE (a custom field's stored values go with it) — first click arms,
@@ -2172,10 +2153,6 @@ export default function ColumnMenu({
    *  behind an Apply rather than emitted per keystroke: a custom range is typed one date at a
    *  time, and each emit is a full host round trip that would repaint the column half-ready. */
   const [periodDraft, setPeriodDraft] = useState<WindowSpec | null>(null);
-  /** Permissions pane draft. */
-  const initialFieldPermissions = cleanFieldPermissions(field.permissions, "collaborative");
-  const [permDraft, setPermDraft] = useState<FieldEditMode>(initialFieldPermissions.edit);
-  const [permUsers, setPermUsers] = useState<string[]>(initialFieldPermissions.users ?? []);
   /** Format pane draft — seeded from the field, saved whole. */
   const [fmtDraft, setFmtDraft] = useState<FieldFormat>(() => ({ ...(field.format ?? {}) }));
   /** Item 9c — the create forms' Scope draft. 'cohort' is the DEFAULT per the contract. */
@@ -2560,6 +2537,7 @@ export default function ColumnMenu({
   // not. Both ride the same PATCH; the label is part of the definition either way.
   const editNameDirty =
     (!!onRename || !!onFieldConfig) && cleanRename !== "" && cleanRename !== field.label;
+  const editNoteDirty = note !== (field.note ?? "");
   const editOptionsChanged =
     needsOptions(editType) &&
     editOptions.join("\n") !== choiceOptions(field).join("\n");
@@ -2643,11 +2621,11 @@ export default function ColumnMenu({
     // is refused by the server, so Save is refused here instead: a 400 arriving after the click
     // is the same "named, configured, gone" surprise one layer later.
     (editType !== "ai_enrich" || aiEnrich.prompt.trim() !== "") &&
-    (editingRelational
-      ? (editRollupValid && (editRelationalTouched || editNameDirty) &&
-         (field.type !== "link" || editLinkTable !== ""))
-      : (editNameDirty || editRetypeTouched || editFormulaTouched ||
-         (canPeriod && periodChanged)));
+      (editingRelational
+       ? (editRollupValid && (editRelationalTouched || editNameDirty || editNoteDirty) &&
+          (field.type !== "link" || editLinkTable !== ""))
+       : (editNameDirty || editRetypeTouched || editFormulaTouched ||
+          (canPeriod && periodChanged) || editNoteDirty));
   /**
    * Item 15 — the renames, by ROW IDENTITY. A row that kept its id and changed its label was
    * renamed; a row with an id nobody has seen is new; an id that is gone was deleted. Empty
@@ -2664,7 +2642,7 @@ export default function ColumnMenu({
       : [];
   const applyEdit = () => {
     if (!canSaveEdit) return;
-    if (editingRelational && onFieldConfig) {
+    if (editingRelational && onFieldConfig && (editRelationalTouched || editNameDirty)) {
       // ⛔ THE WHOLE BAG, EVERY SAVE. `_clean_rollup` is a pure cleaner over what it receives —
       // it does not merge with the stored bag — so a partial patch is a REBUILD, and an omitted
       // `limit` would silently become "no limit" rather than "unchanged".
@@ -2675,6 +2653,7 @@ export default function ColumnMenu({
           : { link: { table: editLinkTable,
                       ...(editLinkSingle ? { single: true } : {}) } }),
       });
+      if (editNoteDirty) onNote(note);
       onClose();
       return;
     }
@@ -2740,6 +2719,7 @@ export default function ColumnMenu({
     // instead of it: renaming "Sales YTD" to "Sales" and re-pointing it at the last 90 days
     // is one edit to the user and must not silently drop half of itself.
     if (canPeriod && periodChanged && draftWindow) onPeriod!(draftWindow);
+    if (editNoteDirty) onNote(note);
     onClose();
   };
 
@@ -3118,7 +3098,7 @@ export default function ColumnMenu({
         dataKind="column-menu"
       >
         <PaneHead title="Edit field" sub={typeLine} onClose={onClose} />
-        <div className="cg-column-create">
+        <div className="cg-column-create cg-field-edit">
           {onRename || editingRelational ? (
             <label>
               <span>Name</span>
@@ -3145,6 +3125,25 @@ export default function ColumnMenu({
               </span>
             </label>
           )}
+          <label className="cg-edit-description">
+            <span>Description</span>
+            {field.description && (
+              <span className="cg-field-hint cg-desc-default">
+                Default description: {field.description}
+              </span>
+            )}
+            <textarea
+              className="cg-input"
+              rows={3}
+              value={note}
+              placeholder={
+                field.description
+                  ? "Write your own to replace the default…"
+                  : "Explain how this field should be used…"
+              }
+              onChange={(event) => setNote(event.target.value)}
+            />
+          </label>
           {/* C5-AUTOFIELD — an EXISTING automation column edits its CONFIG, not its type.
               ⚠ This guard is load-bearing, not tidiness. `automation` is excluded from
               RETYPE_TYPES (see its note), so rendering the picker for one would show a
@@ -3570,140 +3569,6 @@ export default function ColumnMenu({
     );
   }
 
-  // ------------------------------------------------------------------ NOTE pane (item 2)
-  // "Edit field description" edits the USER's note — the canonical `description` is the
-  // contract's default and is shown as context, never written from here.
-  if (pane === "note") {
-    return (
-      <AnchoredOverlay
-        anchor={state.anchor}
-        className="cg-column-menu"
-        onDismiss={onClose}
-        role="dialog"
-        ariaLabel={`Edit description for ${field.label}`}
-        initialFocus="[data-overlay-autofocus]"
-        dataKind="column-menu"
-      >
-        <PaneHead title="Edit field description" sub={field.label} onClose={onClose} />
-        <div className="cg-column-create">
-          {field.description && (
-            <div className="cg-field-hint cg-desc-default">
-              Default description: {field.description}
-            </div>
-          )}
-          <label>
-            <span>Your description</span>
-            <textarea
-              className="cg-input"
-              data-overlay-autofocus
-              autoFocus
-              rows={4}
-              value={note}
-              placeholder={
-                field.description
-                  ? "Write your own to replace the default…"
-                  : "Explain how this field should be used…"
-              }
-              onChange={(event) => setNote(event.target.value)}
-            />
-          </label>
-          <div className="cg-form-actions">
-            <button
-              type="button"
-              className="cg-btn cg-btn--primary"
-              disabled={note === (field.note ?? "")}
-              onClick={() => {
-                onNote(note);
-                onClose();
-              }}
-            >
-              Save
-            </button>
-            <button type="button" className="cg-btn" onClick={() => setPane("menu")}>
-              Back
-            </button>
-          </div>
-        </div>
-      </AnchoredOverlay>
-    );
-  }
-
-  // ------------------------------------------------------------- PERMISSIONS pane (item 1)
-  if (pane === "permissions") {
-    return (
-      <AnchoredOverlay
-        anchor={state.anchor}
-        className="cg-column-menu"
-        onDismiss={onClose}
-        role="dialog"
-        ariaLabel={`Edit permissions for ${field.label}`}
-        initialFocus="[data-overlay-autofocus]"
-        dataKind="column-menu"
-      >
-        <PaneHead title="Edit field permissions" sub={field.label} onClose={onClose} />
-        <div className="cg-column-create">
-          <div className="cg-perm" role="radiogroup" aria-label="Who can edit this field">
-            <span className="cg-perm-title">Who can edit</span>
-            {FIELD_EDIT_MODES.map((mode) => (
-              <label key={mode} className="cg-radio-row cg-perm-row">
-                <input
-                  type="radio"
-                  name="cg-field-perm"
-                  data-overlay-autofocus={mode === "personal" ? true : undefined}
-                  checked={permDraft === mode}
-                  onChange={() => setPermDraft(mode)}
-                />
-                <FieldPermMark mode={mode} />
-                <span className="cg-perm-label">
-                  {FIELD_EDIT_LABELS[mode]}
-                  <span className="cg-perm-blurb">{FIELD_EDIT_BLURBS[mode]}</span>
-                </span>
-              </label>
-            ))}
-            {permDraft === "users" && (
-              <div className="cg-perm-users">
-                {permissionUserOptions.length === 0 ? (
-                  <span className="cg-perm-empty">No other accounts to pick. This will save as Personal.</span>
-                ) : permissionUserOptions.map((person) => (
-                  <label key={person.username} className="cg-perm-user">
-                    <input
-                      type="checkbox"
-                      checked={permUsers.includes(person.username.toLowerCase())}
-                      onChange={(event) => setPermUsers((current) => event.target.checked
-                        ? [...current, person.username.toLowerCase()].slice(0, 50)
-                        : current.filter((user) => user !== person.username.toLowerCase()))}
-                    />
-                    <span>{person.name || person.username}</span>
-                  </label>
-                ))}
-                {permissionUserOptions.length > 0 && permUsers.length === 0 && (
-                  <span className="cg-perm-empty">Pick at least one person, or this saves as Personal.</span>
-                )}
-              </div>
-            )}
-          </div>
-          <div className="cg-form-actions">
-            <button
-              type="button"
-              className="cg-btn cg-btn--primary"
-              disabled={JSON.stringify({ edit: permDraft, users: permDraft === "users" ? permUsers : undefined }) ===
-                JSON.stringify(cleanFieldPermissions(field.permissions, "collaborative"))}
-              onClick={() => {
-                onPermissions?.(cleanFieldPermissions({ edit: permDraft, users: permUsers }, "personal"));
-                onClose();
-              }}
-            >
-              Save
-            </button>
-            <button type="button" className="cg-btn" onClick={() => setPane("menu")}>
-              Back
-            </button>
-          </div>
-        </div>
-      </AnchoredOverlay>
-    );
-  }
-
   // ------------------------------------------------------------------ FORMAT pane (item 10)
   /**
    * ⭐⭐ WAVE-29 T33 (owner item 17) — THE COLUMN SUMMARY PANE.
@@ -3875,11 +3740,6 @@ export default function ColumnMenu({
   // ------------------------------------------------------------------ the MENU pane
   // Wave-5 items 1/2/3: a flat action list. Editors open their OWN windows (the panes above);
   // nothing edits inline here. Conditional entries render IFF they apply to the current view.
-  const canPermissions =
-    !!onPermissions &&
-    !!viewer &&
-    (viewer.isAdmin || (field.createdBy != null && field.createdBy === viewer.name));
-
   /**
    * ⭐⭐ W39-T17 — THE SHARE ID FOR THIS COLUMN, or `null` if one cannot honestly be built.
    *
@@ -3922,7 +3782,7 @@ export default function ColumnMenu({
 
   /**
    * ⭐⭐ W39-T17 / R8 — MAY THIS VIEWER DELETE THIS COLUMN? The client half of the server's wall,
-   * spelled with the SAME comparison `canPermissions` above already uses rather than a second
+   * spelled with the same creator/admin identity rule as the server rather than a second
    * one: `createdBy` is a login username while the people picker deals in display names
    * ([[login-resolves-email-writes-do-not]]), and one spelling means a mismatch lands identically
    * in both places instead of differently in each.
@@ -3966,7 +3826,7 @@ export default function ColumnMenu({
           is one line that STATES the period and opens that pane, because the window is the
           first thing you want to know about a metric column and the menu had become the only
           place it was written down. A row, not a control: the menu pane edits nothing inline. */}
-      {canPeriod && !schemaLocked && (
+      {canPeriod && canEditDefinition && !schemaLocked && (
         <button
           type="button"
           className="cg-column-periodline"
@@ -3988,7 +3848,7 @@ export default function ColumnMenu({
             the one window for the field's name, type (with per-type choices/stars/formula)
             and the Change-field control. Offered on EVERY field — what a read-only field
             cannot change, the pane says honestly instead of hiding the door. */}
-        {!schemaLocked && (
+        {canEditDefinition && (
           <button type="button" data-overlay-autofocus onClick={() => {
             setRenameDraft(field.label);
             setPane("edit");
@@ -4018,12 +3878,11 @@ export default function ColumnMenu({
             }}
           >
             {/* ⛔ AN INLINE NODE, NOT A `MenuIcon` NAME, and that is forced rather than chosen.
-                `MenuLabel`'s prop is `MenuIconName | ReactNode` and `ReactNode` admits any
-                string, so `icon="share"` would COMPILE and paint an empty 16px box forever
-                (`MENU_ICONS` has no such key, and `icons.tsx` is not this ticket's file). The
-                three-node graph is the mark every product uses for this verb; borrowing the
-                padlock that "Edit field permissions" already wears below would put two identical
-                glyphs on two different questions. */}
+                 `MenuLabel`'s prop is `MenuIconName | ReactNode` and `ReactNode` admits any
+                 string, so `icon="share"` would COMPILE and paint an empty 16px box forever
+                 (`MENU_ICONS` has no such key, and `icons.tsx` is not this ticket's file). The
+                 three-node graph is the mark every product uses for this verb; it keeps sharing
+                 visually distinct from field editing. */}
             <MenuLabel
               icon={
                 <svg width={16} height={16} viewBox="0 0 16 16" fill="none" aria-hidden>
@@ -4063,19 +3922,8 @@ export default function ColumnMenu({
 
         <div className="cg-menu-sep" role="separator" aria-hidden />
 
-        {/* Group 2 — the rest of the def-editing family: description · permissions · format.
-            Rename and Change field live INSIDE Edit field now (owner item 8) — their old
-            rows are gone, not duplicated. */}
-        {!schemaLocked && (
-          <button type="button" onClick={() => setPane("note")}>
-            <MenuLabel icon="description" text="Edit field description" />
-          </button>
-        )}
-        {!schemaLocked && canPermissions && (
-          <button type="button" onClick={() => setPane("permissions")}>
-            <MenuLabel icon="permissions" text="Edit field permissions" />
-          </button>
-        )}
+        {/* Group 2 — display format. Description now lives in Edit field directly below Name,
+            so there is one definition editor instead of two nearby doors. */}
         {!schemaLocked && formatKind && (
           <button type="button" onClick={() => setPane("format")}>
             <MenuLabel icon="format" text="Field format" />

web/src/customer-grid/CustomerGrid.tsx

@@ -6739,7 +6739,6 @@ function CustomerGridSurface({
             viewer={viewer}
             onToggleLock={toggleViewLock}
             onToggleImportant={toggleViewImportant}
-            userOptions={payload?.userOptions}
         />
       )}
       {/* ⭐⭐ W37-T29 / CONTRACT C6 (rulings R2, R10) — E's CHAT, DOCKED AND OPENABLE.
@@ -7828,12 +7827,6 @@ function CustomerGridSurface({
             // Creatable strata only — a base Odoo field offers no Duplicate (contract).
             menuField.custom && !menuField.shared ? () => duplicateField(menuField) : undefined
           }
-          onPermissions={
-            // Creatable strata only; ColumnMenu further gates on the viewer (creator/admin).
-            menuField.custom
-              ? (permissions) => saveField({ ...menuField, permissions })
-              : undefined
-          }
           onFormat={(format) => saveField({ ...menuField, format })}
           /**
            * ⭐ WAVE-29 T33 (owner item 17) — the column summary, through whichever door owns this
@@ -7886,23 +7879,20 @@ function CustomerGridSurface({
           onGroupByField={() => updateConfig({ ...config, groupBy: menuField.key })}
           onClearGroup={() => updateConfig({ ...config, groupBy: null })}
             userOptions={payload?.userOptions ?? []}
-            permissionUserOptions={payload?.permissionUserOptions ?? []}
           measures={measures}
-          /* ⭐⭐ W39-T17 — THE TABLE HALF OF A FIELD SHARE'S OID, and it is deliberately NOT the
-             `storageKey` const above. That one carries two spellings the share door cannot use:
-             the query-preview key (`query:<binding>`, a projection rather than this database's
-             own columns) and the local fallback `${LOCAL_KEY_PREFIX}${scope}`, which this file's
-             own note at the declaration calls "a key the server never issues".
-             ⛔ AND THE FALLBACK IS THE DANGEROUS ONE, not merely the untidy one:
-             `core.shares.split_field_oid` fails closed on an id it cannot resolve,
-             `routes_shares._object_ref` answers `route=None`, and `_notify_new_grantees` returns
-             early — the grant lands and the receiver is NEVER TOLD. So this reads the SERVER's
-             key directly and passes `undefined` when there is none, which withdraws the Share
-             row rather than offering one that resolves to nothing.
-             ⚠ Only this instance takes it. The "+" render below opens straight into the create
-             form and never paints the action list, so the row it feeds is unreachable there —
-             unlike `linkTargets`, which both create paths genuinely need. */
-          tableKey={isQueryPreview ? undefined : payload?.workspace?.storageKey}
+           /* ⭐⭐ W39-T17 — field shares use the registry's canonical topic key, not the
+              per-user browser storage key carried by `workspace.storageKey`. These are the same
+              server-issued names used by the field-grant wall and the shared overlay write path.
+              Query previews have no durable field share target, so the action is omitted. */
+           tableKey={
+             isQueryPreview
+               ? undefined
+               : scope === "product"
+                 ? "product_data"
+                 : scope?.startsWith("ut_")
+                   ? scope
+                   : "customer_data"
+           }
         />
       )}
 

web/src/customer-grid/ViewSidebar.tsx

@@ -9,7 +9,6 @@ import type {
   FolderIcon,
   GridFolder,
   SavedView,
-  ViewEditMode,
   ViewPermissions,
   Viewer,
 } from "./types";
@@ -18,12 +17,7 @@ import {
   DEFAULT_FOLDER_TONE,
   FOLDER_SHAPES,
   FOLDER_TONES,
-  MAX_VIEW_USERS,
-  VIEW_EDIT_BLURBS,
-  VIEW_EDIT_LABELS,
-  VIEW_EDIT_MODES,
   cleanFolderIcon,
-  cleanViewPermissions,
   isModeFrozen,
   isUndeletableView,
   mayEditView,
@@ -37,7 +31,6 @@ import {
   MODE_LABELS,
   MODE_TONE,
 } from "./iconShapes";
-import { FOLDER_TONE_PAINT } from "./iconShapes";
 import { FolderMark, LockMark, MenuLabel, ModeIcon, ToneModeIcon } from "./icons";
 import { ROOT_FOLDER_ID } from "./folders";
 // ⭐ W32-T23 (owner item 17) — THE BELL, from the shared layer rather than redrawn here.
@@ -59,12 +52,10 @@ import {
 } from "./folders";
 
 /* ─────────────────────────────────────────────────────────────────────────────────────────
-   ⭐ WAVE 27 · OWNER ITEM 1 — a MARK on each "Who can edit" row.
+   Share-view ownership note for the create door.
 
-   The three choices used to be three radio buttons and three sentences, which is a wall of
-   prose at the exact moment a user is deciding who else can change their work. A mark is the
-   part you recognise on the second visit, and Airtable's own share step leads every row with
-   one.
+   View creation now stays private and delegates audience/edit choices to the single Share view
+   dialog. Keep this note aligned with that ownership boundary if the sharing surface changes.
 
    ⛔ WHY THE PATHS LIVE HERE AND NOT IN `icons.tsx`, stated so a later wave does not "tidy" it
    back: `icons.tsx` renders `MODE_SHAPES` from `iconShapes.ts`, which the glide CANVAS also
@@ -80,46 +71,8 @@ import {
    never a literal, so these can never be the one place in the product with its own colours.
    Outline-only, the register the owner set in 2026-07-29: "it doesn't have a full color, only
    the linings". */
-const PERM_TONE: Record<ViewEditMode, "neutral" | "blue" | "green"> = {
-  personal: "neutral",
-  collaborative: "blue",
-  users: "green",
-};
-
 /** head + shoulders, at `x`. One drawing, three uses — a second hand-drawn person is how two
  *  marks in one panel end up different heights. */
-const person = (x: number) =>
-  `M${x} 7.4a2 2 0 1 0 0-4 2 2 0 0 0 0 4Z` +
-  `M${x - 3.2} 12.6c0-1.9 1.4-3.1 3.2-3.1s3.2 1.2 3.2 3.1`;
-
-const PERM_MARK: Record<ViewEditMode, string[]> = {
-  // One person: only you.
-  personal: [person(8)],
-  // Two, side by side and overlapping: anyone who can see the table.
-  collaborative: [person(5.9), person(10.6)],
-  // One person and a tick: the people you picked.
-  users: [person(6), "M10.6 9.4l1.5 1.6 2.6-3"],
-};
-
-function PermMark({ mode }: { mode: ViewEditMode }) {
-  const paint = FOLDER_TONE_PAINT[PERM_TONE[mode]];
-  return (
-    <svg className="cg-perm-mark" width={16} height={16} viewBox="0 0 16 16" aria-hidden>
-      {PERM_MARK[mode].map((d, i) => (
-        <path
-          key={i}
-          d={d}
-          fill="none"
-          stroke={paint.stroke}
-          strokeWidth={1.35}
-          strokeLinecap="round"
-          strokeLinejoin="round"
-        />
-      ))}
-    </svg>
-  );
-}
-
 /* WAVE 20 item 18 (C-SHARE) — the system folder every view shared WITH you lands in until
    you file it somewhere of your own. It is the only folder id this component recognises by
    name, and as of wave 21 (item 9) it is DECLARED IN `folders.ts` beside the synthesis that
@@ -131,9 +84,7 @@ interface ViewSidebarProps {
   activeViewId: string;
   saveState: "saved" | "saving";
   onSelect: (id: string) => void;
-  /** I14 + I17 — the flyout names the display mode and the prompt names who may edit, so
-   *  creation carries both. `permissions` is always explicit (C4: absent on create means
-   *  personal, so an omission would silently contradict the form). */
+  /** The create door persists a private default; Share view owns audience and edit choices. */
   onCreate: (name: string, mode: DisplayMode, permissions: ViewPermissions) => void;
   /**
    * ⭐⭐ W37-T41 — may this surface hold a CUSTOM VIEW? The row is dropped when it cannot.
@@ -284,10 +235,6 @@ interface ViewSidebarProps {
      surface. They carried the transient-lock selection for the retired Cohorts section; a
      locked view is now an ordinary member of `views` and is selected by `onSelect` like any
      other, which is the whole point of R1. */
-  /** I17 (C4) — the tenant's real account list, for the "Specific users" picker. The HOST
-   *  re-validates every name against core/users.py and drops what it cannot resolve, so this
-   *  list is a convenience, never the authority. */
-  userOptions?: string[];
   /**
    * ⭐⭐ W36-T05 (owner item 6 · R3 · R14) — THE VIEW AGENT, to the LEFT of this rail.
    *
@@ -358,7 +305,6 @@ export default function ViewSidebar({
   viewer,
   onToggleLock,
   onToggleImportant,
-  userOptions = [],
 }: ViewSidebarProps) {
   /**
    * I14 — creating a view now always knows WHICH KIND of view is being created, because the
@@ -368,10 +314,6 @@ export default function ViewSidebar({
   /** I14 — the "+ Create new…" flyout's anchor. */
   const [createMenu, setCreateMenu] = useState<HTMLButtonElement | null>(null);
   const [name, setName] = useState("");
-  /** I17 (C4) — the create prompt's who-can-edit draft. Seeded PERSONAL, matching the host's
-   *  create-side default, so the form and the store agree before the user touches anything. */
-  const [permEdit, setPermEdit] = useState<ViewEditMode>("personal");
-  const [permUsers, setPermUsers] = useState<string[]>([]);
   const [menu, setMenu] = useState<{
     viewId: string;
     anchor: HTMLButtonElement;
@@ -686,16 +628,10 @@ export default function ViewSidebar({
   const create = () => {
     const value = name.trim();
     if (!value || !creating) return;
-    // C4: permissions are sent EXPLICITLY on create. Omitting them means 'personal'
-    // host-side, so a user who picked "Collaborative" and got a personal view would have no
-    // way to tell — the form said one thing and the store did the other.
-    // Cleaned through the same rules the host applies, so an empty "Specific users" grant
-    // collapses to 'personal' HERE too and the confirmation the user sees is the truth.
-    onCreate(value, creating, cleanViewPermissions(
-      { edit: permEdit, users: permUsers }, "personal", userOptions));
+    // Views start private. The Share view dialog is the single place where people choose the
+    // audience and whether each recipient can view or edit, so creation and sharing cannot drift.
+    onCreate(value, creating, { edit: "personal" });
     setName("");
-    setPermEdit("personal");
-    setPermUsers([]);
     setCreating(null);
     // WAVE 20 item 20 — the two steps share ONE panel, so the anchor outlives step 1 and
     // has to be released here. Left set, the flyout would spring back to the type chooser
@@ -712,8 +648,6 @@ export default function ViewSidebar({
     setCreating(null);
     setCreateMenu(null);
     setName("");
-    setPermEdit("personal");
-    setPermUsers([]);
   };
 
   const createFolder = () => {
@@ -1091,65 +1025,10 @@ export default function ViewSidebar({
                   if (event.key === "Escape") closeCreate();
                 }}
               />
-              {/* I17 (C4) — the owner's prompt ORDER: type (picked in step 1, named above)
-                  → who can edit → the user picker, and the picker only when it applies. */}
-              <div className="cg-perm" role="radiogroup" aria-label="Who can edit this view">
-                <span className="cg-perm-title">Who can edit</span>
-                {VIEW_EDIT_MODES.map((m) => (
-                  <label key={m} className="cg-radio-row cg-perm-row">
-                    <input
-                      type="radio"
-                      name="cg-view-perm"
-                      checked={permEdit === m}
-                      onChange={() => setPermEdit(m)}
-                    />
-                    {/* ⭐ ITEM 1 — the mark is its OWN COLUMN, between the radio and the words.
-                        ⚠ Not inside `.cg-perm-label`: that element is a flex COLUMN (title over
-                        blurb), so a mark placed in it becomes a THIRD ROW under the sentence
-                        rather than a leading glyph — the wrong-parent trap
-                        ([[wrong-parent-not-broken-control]]) in its cheapest form. */}
-                    <PermMark mode={m} />
-                    <span className="cg-perm-label">
-                      {VIEW_EDIT_LABELS[m]}
-                      <span className="cg-perm-blurb">{VIEW_EDIT_BLURBS[m]}</span>
-                    </span>
-                  </label>
-                ))}
-                {permEdit === "users" && (
-                  <div className="cg-perm-users">
-                    {userOptions.length === 0 ? (
-                      // Never a silent empty box: an empty grant collapses to Personal
-                      // host-side, so say that rather than letting the user think they
-                      // shared it.
-                      <span className="cg-perm-empty">
-                        No other accounts to pick. This will save as Personal.
-                      </span>
-                    ) : (
-                      userOptions.map((u) => (
-                        <label key={u} className="cg-perm-user">
-                          <input
-                            type="checkbox"
-                            checked={permUsers.includes(u)}
-                            onChange={(e) =>
-                              setPermUsers((cur) =>
-                                e.target.checked
-                                  ? [...cur, u].slice(0, MAX_VIEW_USERS)
-                                  : cur.filter((x) => x !== u)
-                              )
-                            }
-                          />
-                          <span>{u}</span>
-                        </label>
-                      ))
-                    )}
-                    {userOptions.length > 0 && permUsers.length === 0 && (
-                      <span className="cg-perm-empty">
-                        Pick at least one person, or this saves as Personal.
-                      </span>
-                    )}
-                  </div>
-                )}
-              </div>
+              <p className="cg-create-share-note">
+                This view starts private. After you create it, use Share view to choose who can
+                view or edit it.
+              </p>
               <div className="cg-form-actions">
                 <button
                   type="button"
@@ -2128,8 +2007,8 @@ export default function ViewSidebar({
             >
               {/* ⭐ WAVE 33 · T15 (D-206) — A STAR, NOT A PADLOCK.
                   ⛔ This row shipped wearing MenuIcon `permissions` / `unlock` — a padlock that
-                  "Share view", "Share folder", "Lock to a locked view" and "Edit field
-                  permissions" ALSO wear, untitled, in these same menus. Marking a view important
+                  "Share view", "Share folder" and "Lock to a locked view" ALSO wear, untitled,
+                  in these same menus. Marking a view important
                   is none of the three locks (DESIGN.md §4): it freezes no record, no column and
                   no row set. So the answer is to drop the lock, not to title it — a title naming
                   a lock that does not exist would be believed.

web/src/customer-grid/types.ts

@@ -1581,6 +1581,7 @@ export type StoredFieldPermissions = {
   edit: FieldEditMode | "everyone" | "creator" | "admins";
   users?: string[];
 };
+export type FieldShareRole = "view" | "edit" | "owner";
 export const FIELD_EDIT_LABELS: Record<FieldEditMode, string> = {
   personal: "Personal",
   collaborative: "Collaborative",
@@ -1617,12 +1618,14 @@ export function fieldEditMode(field: Pick<Field, "permissions">): FieldEditMode
  * the wall. Rules, in order:
  *   - a cell that is read-only by NATURE (formula/created_time) or by stratum (source odoo)
  *     is not editable for anyone;
- *   - permissions absent = everyone (every pre-wave-5 field);
+ *   - permissions absent = everyone (every pre-wave-5 field);
+ *   - a field Share role is the field-specific override: `view` blocks edits and `edit` permits
+ *     them for a shared field. This is deliberately evaluated before the legacy permission bag.
  *   - a RESTRICTED field with no viewer info fails CLOSED;
  *   - 'admins' = isAdmin; 'creator' = the stamped creator, plus admins (an admin locked out
  *     of a leaver's field would need a database edit to fix anything).
  */
-export function mayEditField(field: Field, viewer: Viewer | undefined): boolean {
+export function mayEditField(field: Field, viewer: Viewer | undefined): boolean {
   if (field.source !== "overlay" || READONLY_CELL_TYPES.has(field.type)) return false;
   // ⭐ 2026-08-07 — the DERIVED half of `link`. Read per-field rather than by type, because the
   // other half of the same type is a relation a person builds by hand. The host wall is
@@ -1639,6 +1642,12 @@ export function mayEditField(field: Field, viewer: Viewer | undefined): boolean
   const edit = permissions.edit;
   if (!viewer) return false;
   if (viewer.isAdmin) return true;
+  if (field.shared) {
+    // A view can be editable while one of its fields is intentionally view-only. The field's
+    // own Share field role is the narrower, more specific rule and therefore wins here.
+    if (field.createdBy && field.createdBy.toLowerCase() === viewer.name.toLowerCase()) return true;
+    return field.sharedRole === "edit" || field.sharedRole === "owner";
+  }
   if (edit === "collaborative") return true;
   return field.createdBy === viewer.name ||
     (edit === "users" && (permissions.users ?? []).some(
@@ -1692,7 +1701,27 @@ export function isMachineOwned(field: Field): boolean {
  * always did — a column YOU added beside the Odoo ones is yours even though its neighbours are not.
  */
 export function isPresetField(field: Field): boolean {
-  return field.preset === true || (field.source === "odoo" && !field.custom) || isMachineOwned(field);
+  if (field.preset === true) return true;
+  return (field.source === "odoo" && !field.custom) || isMachineOwned(field);
+}
+
+/**
+ * May this viewer open the field-definition editor? This is separate from cell editability:
+ * formula, rollup and other computed fields can have an editable definition even though their
+ * values are not human-writable. Shared fields use the same specific Share field role as
+ * `mayEditField`; legacy permission bags remain a compatibility fallback for old private fields.
+ */
+export function mayEditFieldDefinition(field: Field, viewer: Viewer | undefined): boolean {
+  if (!viewer) return false;
+  if (viewer.isAdmin) return true;
+  if (field.createdBy && field.createdBy.toLowerCase() === viewer.name.toLowerCase()) return true;
+  if (field.shared) return field.sharedRole === "edit" || field.sharedRole === "owner";
+  if (!field.createdBy) return false;
+  const permissions = cleanFieldPermissions(field.permissions, "collaborative");
+  return permissions.edit === "collaborative" ||
+    (permissions.edit === "users" && (permissions.users ?? []).some(
+      (user) => user.toLowerCase() === viewer.name.toLowerCase()
+    ));
 }
 
 /**
@@ -2008,6 +2037,8 @@ export interface Field {
   custom?: boolean;
   /** True when the definition and its cell values live in the tenant-wide field stratum. */
   shared?: boolean;
+  /** Host-computed effective Share field role for this viewer. */
+  sharedRole?: FieldShareRole;
   /**
    * Owner item 8 (2026-07-27): a PRE-SET measure field — the canonical contract converted a
    * frozen derived column (`revenue_ytd`, `revenue_ly`, `orders_24m`) into a measure whose
@@ -2100,9 +2131,9 @@ export interface Field {
   max?: number;
   /**
    * Wave-5 items 6/7 — the CANONICAL default description (ships with the contract,
-   * aios_grid_fields.json). The user's per-field `note` OVERRIDES it: the header (i) and every
-   * hover show `note || description`, and "Edit field description" edits the NOTE (user
-   * stratum) — the canonical default is never writable from the client.
+   * aios_grid_fields.json). The user's per-field `note` OVERRIDES it: the header (i) and every
+   * hover show `note || description`, and the Description control in Edit field edits the NOTE
+   * (user stratum) — the canonical default is never writable from the client.
    */
   description?: string;
   /**
@@ -2113,9 +2144,10 @@ export interface Field {
    */
   createdBy?: string;
   /**
-   * Wave-5 item 1 — who may EDIT this field's values (and change these permissions). Absent =
-   * everyone. The client HIDES what the viewer may not do (menu entries, editable cells); the
-   * HOST check is the wall — fail-closed, enforced on overlay_patch and field_upsert.
+   * Legacy Wave-5 compatibility bag for who may edit this field's values. New Share field
+   * grants are authoritative when present; this bag remains only for older private fields.
+   * The client HIDES what the viewer may not do (menu entries, editable cells); the HOST check
+   * is the wall — fail-closed, enforced on overlay_patch and field_upsert.
    */
   permissions?: StoredFieldPermissions;
   /**

web/src/index.css

@@ -1155,10 +1155,22 @@ body {
 .cg-column-create label + label {
   margin-top: 7px;
 }
-.cg-column-create .cg-input,
-.cg-column-create .cg-select {
-  width: 100%;
-}
+.cg-column-create .cg-input,
+.cg-column-create .cg-select {
+  width: 100%;
+}
+/* The definition editor mixes labels, type blocks and toggle rows. A label-to-label rule is
+   not enough here: the type picker is a block, so it used to sit directly against the first
+   toggle below it. Keep every top-level editor section visibly separated while leaving nested
+   option controls to their own layout rules. */
+.cg-field-edit > * + * { margin-top: 10px; }
+.cg-field-edit > .cg-form-actions { margin-top: 2px; }
+.cg-field-edit > .cg-edit-swap { margin-top: 14px; }
+.cg-field-edit .cg-type-block { gap: 7px; }
+.cg-field-edit .cg-edit-description textarea {
+  min-height: 76px;
+  resize: vertical;
+}
 
 /* glide-data-grid mounts overlay editors into this portal. */
 #portal {
@@ -1848,15 +1860,12 @@ body > .cg-overlay {
   padding: 2px 0 0;
   max-width: 220px;
 }
-/* R7 (2026-08-02) — the RADIO rows never got the treatment their checkbox twins have had
-   since wave 2, and they are the ones that list FIELD LABELS (the Group-by popover): a
-   two-line "Estimated missed revenue, last 12 months" pushed the row below it out of the
-   rhythm and made the radio look mis-aligned with its own text.
-   ⚠ `:not([class])` is load-bearing, not tidiness. `.cg-radio-row > span` alone is (0,1,1)
-   and therefore OUTRANKS `.cg-perm-label` (0,1,0) — the view-permission rows whose span
-   deliberately stacks a LABEL over a two-line blurb. That rule would have clipped every
-   explanation in the permissions pane to one ellipsised line. Caught by walking every
-   `cg-radio-row` call site rather than by an assertion; all eleven others are bare spans. */
+/* R7 (2026-08-02) — the RADIO rows never got the treatment their checkbox twins have had
+   since wave 2, and they are the ones that list FIELD LABELS (the Group-by popover): a
+   two-line "Estimated missed revenue, last 12 months" pushed the row below it out of the
+   rhythm and made the radio look mis-aligned with its own text.
+   ⚠ `:not([class])` is load-bearing, not tidiness. It keeps this rule scoped to the simple
+   field-label rows; richer controls own their own layout. */
 .cg-radio-row > span:not([class]) {
   flex: 1 1 auto;
   min-width: 0;
@@ -5386,9 +5395,8 @@ a.cg-map-ctl-b { text-decoration: none; }
    guessed: that flyout is ~215px wide on a ~31px row pitch with ~16px marks, against our
    178px / 30px / 15px. The type stays `--lp-fs-xs`: the owner asked for room, not for a
    larger font, and SC-1 fixes this surface's size. Room comes from the box, not the text. */
-/* [W27-C] ⭐ WAVE 27 · OWNER ITEM 1 — WIDE ENOUGH FOR THE LONGEST BLURB, ON ONE LINE.
-   The owner's complaint was step 2: each "Who can edit" choice carries a sentence saying what it
-   does, and at 212px all three wrapped, so a three-choice question read as six lines of grey.
+/* Share-view follow-up guidance. The create step is intentionally private; audience and edit
+   choices belong to the Share view dialog rather than to this flyout.
 
    ⛔ MEASURED, NOT GUESSED. Advance widths summed from the EMBEDDED Inter (the `@font-face`
    data URI at the top of this file — the font users actually see, which is the whole reason it
@@ -5399,8 +5407,8 @@ a.cg-map-ctl-b { text-decoration: none; }
    The box has to carry 235.40px of text plus everything left of it:
        10 flyout padding + 2 border + 4 form padding + 16 row padding
        + 15 radio + 9 gap + 16 mark + 9 gap  =  81px
-   235.40 + 81 = 316.4, taken to 320 for subpixel accumulation. Re-measure if a blurb changes;
-   `VIEW_EDIT_BLURBS` in types.ts is the source of all three strings.
+   235.40 + 81 = 316.4, taken to 320 for subpixel accumulation. The flyout remains roomy for
+   the type picker and its private-first follow-up note.
 
    ⛔ `max-width` IS RESTATED AND THAT IS LOAD-BEARING, not tidiness: `.cg-view-menu` (the class
    this panel also wears) caps every menu at 260px, so `width: 320px` ALONE would have been
@@ -5520,59 +5528,6 @@ a.cg-map-ctl-b { text-decoration: none; }
 .cg-modes-locked .cg-mode-icon,
 .cg-modes-locked .cg-lock-mark { flex: 0 0 auto; }
 
-/* I17 (C4) — the "Who can edit" step of the create prompt. Each choice carries what it
-   actually DOES: a permission whose effect the user cannot predict is one they will set
-   wrong, and this one defaults to the restrictive option. */
-.cg-perm {
-  display: flex;
-  flex-direction: column;
-  gap: 2px;
-  margin: 6px 0 2px;
-}
-.cg-perm-title {
-  font-size: var(--lp-fs-2xs);
-  font-weight: 600;
-  color: var(--lp-muted);
-  padding-bottom: 2px;
-}
-.cg-perm-row { align-items: flex-start; }
-.cg-perm-label {
-  display: flex;
-  flex-direction: column;
-  gap: 1px;
-  font-size: var(--lp-fs-2xs);
-}
-.cg-perm-blurb {
-  color: var(--lp-muted);
-  font-size: var(--lp-fs-3xs);
-  line-height: 1.35;
-}
-.cg-perm-users {
-  display: flex;
-  flex-direction: column;
-  gap: 2px;
-  max-height: 148px;
-  overflow-y: auto;
-  margin: 2px 0 0 18px;
-  padding: 4px 6px;
-  border: 1px solid var(--lp-line);
-  border-radius: var(--lp-r-md);
-}
-.cg-perm-user {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-  font-size: var(--lp-fs-2xs);
-  cursor: pointer;
-}
-/* Stated in the yellow-deep weight, not a pastel: this is a warning that what you picked is
-   NOT what will be saved, and a 1.9:1 pastel would make it decorative. */
-.cg-perm-empty {
-  color: var(--lp-yellow-deep);
-  font-size: var(--lp-fs-3xs);
-  line-height: 1.35;
-}
-
 /* I2 — the cell hover tip. Inherits everything from `.cg-header-tip` (including
    `pointer-events: none`, which is the CONTRACT and not a style: a tip that can take the
    pointer swallows the next click). Only the wrapping differs: a cut-off Note is one long
@@ -10715,13 +10670,19 @@ a.cg-map-ctl-b { text-decoration: none; }
   border: 0;
   background: transparent;
 }
-.cg-create-flyout .cg-create-form > label:first-child {
-  display: block;
-  margin-bottom: 4px;
-  font-size: var(--lp-fs-3xs);
-  font-weight: 600;
-  color: var(--lp-muted);
-}
+.cg-create-flyout .cg-create-form > label:first-child {
+  display: block;
+  margin-bottom: 4px;
+  font-size: var(--lp-fs-3xs);
+  font-weight: 600;
+  color: var(--lp-muted);
+}
+.cg-create-share-note {
+  margin: 9px 0 2px;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-3xs);
+  line-height: 1.45;
+}
 /* ⚠ THE PANEL IS A MENU, AND `.cg-view-menu button` (0,1,1) OUT-RANKS `.cg-btn` (0,1,0).
    Moving the form inside the flyout therefore repainted its Create/Cancel as full-width,
    left-aligned, borderless MENU ROWS — the panel's own row style applied to a form's
@@ -10750,36 +10711,6 @@ a.cg-map-ctl-b { text-decoration: none; }
 .cg-create-flyout .cg-create-form .cg-btn--primary:hover:not(:disabled) {
   background: var(--lp-primary-hover);
 }
-/* The who-can-edit rows are `<label>`s, and `.cg-view-create label` (0,1,1) stacks every
-   label in a create form into a COLUMN — so the radio sat above its own words rather than
-   beside them. Pre-dates this wave (the same two rules met in the rail-inline form), but
-   item 20 makes these three rows the whole content of a small panel, where a radio floating
-   over its label is the first thing you see. Scoped to the flyout: nothing else that reads
-   `.cg-view-create label` moves. */
-.cg-create-flyout .cg-perm-row {
-  flex-direction: row;
-  align-items: flex-start;
-  gap: 9px;
-}
-
-/* [W27-C] ⭐ WAVE 27 · OWNER ITEM 1 — the permission MARK's column.
-   The row is a flex line: radio | mark | (label over blurb). `flex: 0 0 auto` is the same rule
-   the create rows' own marks carry two hundred lines up — without it a long blurb shrinks the
-   ICON before it wraps the text, and a 9px person is a smudge.
-   The 1px nudge lands the 16px mark on the cap-height of the 12px label beside it; `flex-start`
-   on the row aligns it to the TOP, which is where it belongs when the blurb is under the name. */
-.cg-perm-mark {
-  flex: 0 0 auto;
-  margin-top: 1px;
-}
-/* The user list belongs to the row above it, and it says so by indenting past the controls
-   rather than by drawing a second box. It was 18px, measured against a row that started
-   `radio | label`; item 1 inserts a 16px mark and a 9px gap between those two, so the same
-   visual relationship is 18 + 25. Left as an indent rather than an exact alignment to the text
-   column (57px): at that depth the checkbox list starts closer to the middle of the panel than
-   to its left edge, which reads as a different section rather than a continuation of one. */
-.cg-create-flyout .cg-perm-users { margin-left: 43px; }
-
 /* ── Item 19 (C-FOLDER-REORDER) — dragging a FOLDER to reorder ──────────────
    A private drag MIME (`application/x-loopable-fold`) keeps this apart from the
    view drag, which carries `text/plain`; the indicator is an insertion RULE at

web/src/shell/ShareDialog.tsx

@@ -39,10 +39,14 @@ const KIND_WORD: Record<ShareKind, string> = {
   field: "field",
 };
 
+// A newly-created field is posted through the standalone event queue. The
+// share dialog can open before that POST reaches the API, so give field lookups
+// a short, bounded chance to observe the definition before showing a 404.
+const FIELD_SHARE_RETRY_MS = [150, 300, 600, 1000] as const;
+
 /** What each role MEANS on each kind, in the reader's own terms. A role picker
- *  whose options are two nouns makes the reader guess; these are the sentences
- *  the view rail already uses ("Anyone who can see this table can change it"),
- *  extended to the two new kinds rather than re-invented for them. */
+ * whose options are two nouns makes the reader guess; these sentences describe
+ * the effective capability at the point where the role is chosen. */
 const ROLE_BLURB: Record<ShareKind, Record<ShareRole, string>> = {
   view: {
     view: "Can open this view. Cannot rename, refilter or delete it.",
@@ -56,21 +60,9 @@ const ROLE_BLURB: Record<ShareKind, Record<ShareRole, string>> = {
     view: "Can open this database and read its records.",
     edit: "Can add, edit and delete its records.",
   },
-  /**
-   * ⭐⭐ W39-T17 — A COLUMN GRANT IS A VISIBILITY GRANT, AND THE BLURBS SAY ONLY THAT.
-   *
-   * ⛔ MEASURED IN THE SERVER, NOT ASSUMED. `core.perm_scope.field_grant_hidden` is the ONLY
-   * consumer of a `field`-kind grant, and it tests `role is None` — nothing else. So `view` and
-   * `edit` are the SAME capability on a column today: both lift the column out of the hidden set
-   * and neither confers value editing, which `types.mayEditField` decides from the field's OWN
-   * `permissions.edit` (everyone / creator / admins). A blurb promising "can change its values"
-   * would be a sentence the product does not honour, so the `edit` line names the real wall
-   * instead. Booked as a finding; the picker is the shared one and narrowing it is not this
-   * ticket's mandate.
-   */
   field: {
-    view: "Can see this column on the records they can already open.",
-    edit: "Can see this column. Changing its values still follows the field's own permissions.",
+    view: "Can see this column. Cannot change its values or field settings.",
+    edit: "Can change this column's values and field settings when the view is editable.",
   },
 };
 
@@ -116,7 +108,21 @@ export default function ShareDialog({
     setError("");
     void (async () => {
       try {
-        const res = await fetch(path, { credentials: CREDENTIALS });
+        let res: Response;
+        for (let attempt = 0; ; attempt += 1) {
+          res = await fetch(path, { credentials: CREDENTIALS });
+          if (
+            res.status !== 404 ||
+            kind !== "field" ||
+            attempt >= FIELD_SHARE_RETRY_MS.length
+          ) {
+            break;
+          }
+          await new Promise<void>((resolve) => {
+            window.setTimeout(resolve, FIELD_SHARE_RETRY_MS[attempt]);
+          });
+          if (dead) return;
+        }
         if (!res.ok) {
           // 4xx text is policy the reader needs; a 5xx's internals are not theirs.
           if (!dead) setError(res.status >= 500
@@ -231,16 +237,21 @@ export default function ShareDialog({
           Who can reach <strong>{label}</strong>, and what they can do with it.{" "}
           {kind === "database"
             ? "Sharing a database shares all of it: every record and every column. There is no per-row or per-column limit on a database grant."
-            : kind === "field"
-            /* ⭐⭐ W39-T17 — A COLUMN'S OWN SENTENCE, because the general one is BACKWARDS for it.
-               "Everyone here can already open the surface it lives on" is true of the DATABASE and
-               false of the column: `routes_tables.patch_shared_cell` stamps every grid-created
-               shared column `granted: True`, and `perm_scope.field_grant_hidden` then strips it
-               from every payload but its creator's and an admin's. So this door is not a widening
-               of something already visible, it is the ONLY way anybody else sees the column. */
-            ? "A shared column starts out hidden from everybody else on this database. This is what lets the people you choose see it and its values."
-            : "Sharing never widens past this workspace: everyone here can already open the surface it lives on."}
+             : kind === "field"
+             ? "A shared column starts out hidden from everybody else on this database. This is what lets the people you choose see it and its values."
+             : "Sharing never widens past this workspace: everyone here can already open the surface it lives on."}
         </p>
+        {kind === "view" ? (
+          <p className="shell-share-note">
+            View access is the general rule. A field's own Share field access takes precedence, so
+            a field shared as Can view stays read-only even inside an editable view.
+          </p>
+        ) : kind === "field" ? (
+          <p className="shell-share-note">
+            Field access takes precedence over the view. Can view keeps values and field settings
+            read-only; Can edit allows changes when the view is editable.
+          </p>
+        ) : null}
 
         {!state && !error ? (
           <div className="shell-share-wait">
@@ -350,19 +361,9 @@ export default function ShareDialog({
                     void save(next).then((ok) => {
                       if (ok) {
                         onToast(
-                          /* ⛔⛔ W39-T17 — THE ROLE MUST NOT BE READ BACK AS A CAPABILITY ON A
-                             COLUMN. Interpolated blind, this said "alice can now edit this
-                             field", and that is false: `core.perm_scope.field_grant_hidden` is
-                             the only consumer of a field grant and it tests `role is None`, so
-                             both roles buy the SAME thing (the column stops being hidden) and
-                             neither one lets anybody write a cell — `types.mayEditField` decides
-                             that from the field's own `permissions.edit`. A toast is the one
-                             sentence a person reads after granting, so it is the worst place to
-                             promise a capability the product does not honour. It names the
-                             visibility that actually changed instead. See `ROLE_BLURB.field`. */
-                          kind === "field"
-                            ? `${nameOf(pick)} can now see this field.`
-                            : `${nameOf(pick)} can now ${pickRole} this ${KIND_WORD[kind]}.`
+                           kind === "field"
+                             ? `${nameOf(pick)} can now ${pickRole === "edit" ? "edit" : "view"} this field.`
+                             : `${nameOf(pick)} can now ${pickRole} this ${KIND_WORD[kind]}.`
                         );
                         setPick("");
                       }

web/src/ui/icons.tsx

@@ -98,7 +98,7 @@ export function BellIcon({ size = 16, className }: { size?: number; className?:
  *
  * ⛔ WHAT D-206 IS ACTUALLY ABOUT, corrected against the source before this was drawn: the row does
  * NOT render `LockMark`. It renders `MenuIcon "permissions"` — a *different* padlock — and so do
- * "Share view", "Share folder", "Lock to a locked view" and "Edit field permissions". Five rows,
+ * "Share view", "Share folder" and "Lock to a locked view". Four rows,
  * one padlock, five meanings, no titles, in menus a person reads at a glance. All three real
  * `LockMark` sites already name their lock in a `title` (DESIGN.md §4), so the offending row was
  * outside that rule's literal scope while breaking exactly the thing it protects.