Deploy AIOS web (React glide grid + FastAPI slice)

api/routes_customers.py

@@ -93,60 +93,99 @@ def warm_default(rt):
     _pool_for(rt, None, None)
 
 
+def _team_agent(session: Session):
+    return perms.scope_team_id(session.user), perms.scope_agent(session.user)
+
+
+def _pool_stamp(rt, team_id, agent):
+    """The cached pool's build timestamp — the DATA STAMP in every measure-memo key, so a pool
+    refresh invalidates the memoised answers exactly when the underlying rows changed."""
+    entry = rt.pool_cache.get(("pool", team_id, agent))
+    return entry[0] if isinstance(entry, tuple) and entry else 0
+
+
+def _measure_err(tag, e):
+    try:
+        import harness.telemetry as _tel
+        _tel.error(f"api:{tag}", e)
+    except Exception:
+        pass
+
+
+def grid_assembly(session: Session, scope: str = "customer", storage_key: str = ""):
+    """ONE assembly of this session's grid state, shared by `/customers`, `/workspace` and the
+    events route (2026-07-31 — the standalone measure gap, owner item 1).
+
+    What it adds over the pre-wave hand-rolled `_payload` loop, and why it replaced it:
+
+      * rows go through `aios_grid.rows_from_pool` — the SAME builder the embedded host uses,
+        so `lat`/`lon` (the Map view's data), `_created` and every derived column ride each row
+        by construction instead of by a second loop that drifts. The hand loop was written to
+        mirror the pre-Map contract and silently dropped the coordinates: the shell's Map view
+        had nothing to plot ("the Map no longer works").
+      * `derived` carries the cohort column's cells AND the measure columns' values, resolved
+        through `core.measure_resolve` (EXIT-5's extraction of the `_cl_measure_*` family).
+        Without them every measure column the owner built rendered BLANK in the shell.
+      * `measures` (the offer) and `measure_sets` (condition answers) are computed here so the
+        events route can finally validate measure fields/conditions instead of refusing them
+        (an empty `measure_offer` made `clean_measure_field` reject every create over HTTP).
+
+    Memos live on the TENANT RUNTIME (`rt.measure_memo` / `rt.mset_memo`) — bounded by the
+    module's own clear-past-cap rule, keyed on (stamp, scope, pool identity, question), nothing
+    user-shaped in them.
+    """
+    import aios_grid
+    from core import grid_events, measure_resolve
+
+    rt = session.runtime
+    team_id, agent = _team_agent(session)
+    rows_src = _pool_for(rt, team_id, agent)
+    pids = frozenset(r["pid"] for r in rows_src if r.get("pid") is not None)
+    ws = grid_events.table_workspace(_ctx_for(session, pids), allowed_pids=pids)
+    workspace, fields, views, lists = aios_grid.workspace_wire(
+        ws, session.uname, set(pids), defs={}, scope_key=scope, storage_key=storage_key)
+
+    today = time.strftime("%Y-%m-%d")
+    stamp = _pool_stamp(rt, team_id, agent)
+    measures = measure_resolve.offer(team_id, on_error=_measure_err)
+    measure_sets = measure_resolve.condition_sets(
+        [v.get("config") or {} for v in (views or [])], None, team_id, pids, today, stamp,
+        rt.mset_memo, on_error=_measure_err)
+    # The derived channel: cohort membership cells + measure column values, ONE dict — the
+    # same read-only channel the embed host hands to rows_from_pool.
+    derived = aios_grid.cohort_cells(lists)
+    for pid, cells in measure_resolve.column_values(
+            fields, team_id, pids, today, stamp, rt.measure_memo,
+            on_error=_measure_err).items():
+        derived.setdefault(pid, {}).update(cells)
+
+    return {"rows_src": rows_src, "pids": pids, "ws": ws, "workspace": workspace,
+            "fields": fields, "views": views, "lists": lists, "derived": derived,
+            "measures": measures, "measure_sets": measure_sets, "today": today,
+            "team_id": team_id}
+
+
 def _payload(session: Session):
-    """`{fields, rows, today, pulled_at}` — X2 fixes this at the EXACT shape the pre-wave
-    `/api/customers` served, which `verify_fields_contract.py` referees.
+    """`{fields, rows, today, pulled_at}` — X2's shape, which `verify_fields_contract.py`
+    referees. Rows are now built by `aios_grid.rows_from_pool` (embed == standalone by
+    construction); see `grid_assembly` for what that fixed.
 
-    The per-USER half (this user's field list, this user's overlay cells) is assembled fresh on
-    every request from one workspace read. That read is a single store `get`, which is cheap next
-    to the pool build — and it is the only arrangement in which nothing user-shaped can outlive
-    the request that asked for it. See `_pool_rows` for what the cache holds and why.
+    ⚠ `rows_src` is the SHARED cached list — `rows_from_pool` reads it and builds NEW dicts,
+    never mutating a cached row (the same-scope-second-user leak rule).
     """
     import aios_grid
-    from core import grid_events
 
-    rows_src = _pool_rows(session)
-
-    # ONE workspace read serves both the field list and the overlay values (doing it per stratum
-    # would triple the store reads per request).
-    ws = grid_events.table_workspace(_ctx_for(session, []), allowed_pids=None)
-    fields = aios_grid.fields_from_workspace(ws)
-    odoo_keys = [f["key"] for f in fields if f.get("source") == "odoo"]
-    overlay_keys = [f["key"] for f in fields if f.get("source") == "overlay"]
-    passthrough = {f["key"] for f in fields
-                   if f.get("source") == "odoo" and f.get("type") in ("text", "status", "date")}
-    overlays = ws.get("overlays") or {}
-
-    # ⚠ `rows_src` IS THE SHARED CACHED LIST — read it, never mutate it. Every row below is a NEW
-    # dict; writing an overlay value onto `r` instead of `row` would put one user's private cell
-    # into the copy the next same-scope user is served, which is the leak this split exists to
-    # prevent, re-introduced one line lower down.
-    rows = []
-    for r in rows_src:
-        pid = r.get("pid")
-        row = {"pid": pid, "_created": r.get("_created") or ""}
-        for k in odoo_keys:
-            v = r.get(k)
-            row[k] = v if k in passthrough else _round(v)
-        stored = overlays.get(str(pid)) or {}
-        for k in overlay_keys:
-            row[k] = stored.get(k, "")
-        rows.append(row)
-
-    return {"fields": fields, "rows": rows,
+    g = grid_assembly(session)
+    rows = aios_grid.rows_from_pool(
+        g["rows_src"], g["fields"], g["ws"].get("overlays"), derived=g["derived"])
+    return {"fields": g["fields"], "rows": rows,
             # `today` rides the payload because every relative date condition must resolve against
             # the TENANT's day, never the browser's — a client that falls back to its own clock
             # disagrees with the server for everyone west of it.
-            "today": time.strftime("%Y-%m-%d"),
+            "today": g["today"],
             "pulled_at": time.strftime("%Y-%m-%d %H:%M")}
 
 
-def _round(v):
-    # bool is a subclass of int — guard it so True/False never becomes 1/0. Mirrors
-    # royalimports_os/aios_grid.py._round exactly (embed == standalone on boolean-valued fields).
-    return round(v) if isinstance(v, (int, float)) and not isinstance(v, bool) else v
-
-
 def _ctx_for(session: Session, pids):
     """An EventCtx for the READ path — no fallback workspace, so a store outage is a 503 rather
     than a phantom in-memory workspace an API request cannot persist."""

api/routes_grid.py

@@ -76,23 +76,10 @@ def workspace(scope: str = "customer",
     wave-9 leak rule. Omitting it would hand a Fisch-scoped user a member list built by a
     full-access user.
     """
-    import aios_grid
     from core import grid_events
-    from routes_customers import allowed_pids
+    from routes_customers import grid_assembly
 
     scope = _scope_or_400(scope)
-    try:
-        pids = allowed_pids(session)
-        ws = grid_events.table_workspace(_ctx(session, [], pids), allowed_pids=pids)
-    except grid_events.StoreUnavailable:
-        raise err(503, "store_unavailable", "the tenant store is unavailable")
-
-    # ⛔ THE WIRE SHAPE IS THE SHARED PROJECTION (`aios_grid.workspace_wire`), not the store
-    # shape. The first version returned the store dict with no `storageKey` — and the client
-    # validator requires one, so the standalone shell DISCARDED the whole workspace: saved views
-    # never rendered, `cohortMode` never arrived, and the Cohort route silently drew the Customer
-    # surface. One projection for both servers is the fix that cannot drift.
-    #
     # The storage key mirrors the host's own convention byte-for-byte (app.py's `_table_grid`
     # call sites) with the session's TENANT in the host's hardcoded slot, so localStorage state
     # carries across embed ⇄ standalone on the same browser.
@@ -104,13 +91,40 @@ def workspace(scope: str = "customer",
     else:
         storage_key = f"{session.tenant}:customer-list:{session.uname}:{bu}:{agent or 'all'}"
 
-    workspace, _fields, _views, _lists = aios_grid.workspace_wire(
-        ws, session.uname, pids, defs={}, scope_key=scope, storage_key=storage_key)
+    # ⛔ THE WIRE SHAPE IS THE SHARED PROJECTION (`aios_grid.workspace_wire`), not the store
+    # shape. The first version returned the store dict with no `storageKey` — and the client
+    # validator requires one, so the standalone shell DISCARDED the whole workspace: saved views
+    # never rendered, `cohortMode` never arrived, and the Cohort route silently drew the Customer
+    # surface. One projection for both servers is the fix that cannot drift.
+    try:
+        g = grid_assembly(session, scope=scope, storage_key=storage_key)
+    except grid_events.StoreUnavailable:
+        raise err(503, "store_unavailable", "the tenant store is unavailable")
+    workspace = g["workspace"]
     # ADDITIVE to the wire: the caller's own overlay cells. The grid reads overlays from the
     # /customers rows, but this route is the cheap read-back a write can be verified against
     # (verify_api's overlay probe) without paying the pool call. Per-user by construction —
     # `table_workspace` is this session's workspace.
-    workspace["overlays"] = ws.get("overlays") or {}
+    workspace["overlays"] = g["ws"].get("overlays") or {}
+    # ── the STANDALONE measure channel (owner item 1, 2026-07-31) ────────────────────────────
+    # The embed receives these as top-level render args; standalone lifts them off THIS route
+    # (useCustomerData merges them into the payload slots the grid already reads). They ride
+    # the workspace rather than /customers because a durable write re-reads exactly this route
+    # (WORKSPACE_STALE), so a new measure column populates without refetching the heavy pool.
+    workspace["measures"] = g["measures"]
+    workspace["measureSets"] = g["measure_sets"]
+    # Derived cells (cohort column + measure columns), keyed by pid. JSON object keys are
+    # strings; the client indexes with String(pid).
+    workspace["derived"] = {str(pid): cells for pid, cells in g["derived"].items()}
+    # Who is looking (permissions verdicts) + the assignee choices for `user`-typed columns —
+    # the two other host-only render args the shell was missing (fail-closed without them:
+    # restricted fields uneditable, assignee picker empty).
+    workspace["viewer"] = {"name": session.uname, "isAdmin": bool(session.admin)}
+    try:
+        from core import users as _users
+        workspace["userOptions"] = _users.assignable_people()
+    except Exception:
+        workspace["userOptions"] = []
 
     # THE SURFACE STAMP — a MIRROR of the host's own (`_table_grid`'s hide/cohort stamps).
     # ⚠ Deliberately NOT `hideViews`: `cohortMode` is what swaps the Views panel for the cohort
@@ -128,7 +142,7 @@ def grid_events_route(body: dict = Body(default=None),
                       session: Session = Depends(module_gate(MODULE))):
     """`{events: [<component event objects, verbatim>]}` → `{results, doc?, toast?}`."""
     from core import grid_events
-    from routes_customers import _payload, allowed_pids
+    from routes_customers import grid_assembly
 
     events = (body or {}).get("events")
     if events is None and isinstance(body, dict) and body.get("type"):
@@ -139,14 +153,23 @@ def grid_events_route(body: dict = Body(default=None),
         raise err(400, "too_many_events",
                   f"at most {_MAX_EVENTS} events per request (the client's resend window)")
 
-    payload = _payload(session)
-    pids = frozenset(r["pid"] for r in payload["rows"] if r.get("pid") is not None)
     # Validated with the SAME predicate as the read route. An unrecognised scopeKey used to be
     # passed through verbatim, and `core.grid_events` only ever compares it to 'cohort' — so a
     # typo degraded silently to customer-scope behaviour on a WRITE. Read and write must agree on
     # what a scope is, or the surface you read is not the surface you wrote.
-    ctx = _ctx(session, payload["fields"], pids,
-               scope_key=_scope_or_400((body or {}).get("scopeKey")))
+    scope = _scope_or_400((body or {}).get("scopeKey"))
+    g = grid_assembly(session, scope=scope)
+    # ⚠ THE MEASURE CONTEXT IS NOT OPTIONAL (2026-07-31). Without `measure_offer`,
+    # `clean_measure_field` had an empty admission list and every measure-column create over
+    # HTTP was silently refused; without `measure_keys`, `clean_filter_tree` stripped every
+    # measure CONDITION out of a saved view. The embed always passed these; the API adapter
+    # simply had not been given them — the standalone shell could read measures it could
+    # never write.
+    ctx = _ctx(session, g["fields"], g["pids"], scope_key=scope,
+               measure_keys=frozenset(m["key"] for m in g["measures"]),
+               resolved_ids=frozenset(g["measure_sets"]),
+               cohort_ids=frozenset(c["id"] for c in g["lists"]),
+               measure_offer=tuple(g["measures"]))
 
     # Per-event results so the client can tell which of a batch landed — the component's own
     # bridge has no response channel at all, so this is strictly more than the embed gets.

royalimports_os/aios_grid.py

@@ -1137,6 +1137,11 @@ def workspace_wire(ws, uname, pool_pids, defs=None, scope_key='customer', storag
     fields = fields_from_workspace(ws, cohorts=bool(cohort_lists), scope_key=scope_key)
     views = views_from_defs(defs or {}, ws.get('views'), fields)
     workspace = {'storageKey': storage_key, 'views': views, 'lists': cohort_lists}
+    # Owner item 3 (2026-07-31): where this user left off. The client's own localStorage copy
+    # wins when present; this is the server's answer for a FRESH browser, which used to fall
+    # all the way to the system default view (and whatever display mode was stored on it).
+    if ws.get('activeViewId'):
+        workspace['activeViewId'] = str(ws['activeViewId'])
 
     # FOLDERS (owner item 11, contract C4), re-validated at SERVE time: a view or cohort can be
     # deleted by a path that knows nothing about folders, and the placement map must not outlive

royalimports_os/core/grid_events.py

@@ -374,6 +374,20 @@ def handle_one(event, ctx):
         ws.setdefault('fields', {})
         ws.setdefault('overlays', {})
 
+    if kind == 'view_select':
+        # Owner item 3 (2026-07-31): remember WHERE THE USER IS so a fresh browser resumes
+        # there instead of the system default view. Presentation state only — the read side
+        # re-validates the id against what the caller may see, so nothing here needs an
+        # authorisation wall beyond the length cap. Never a re-render: the client is already
+        # on that view.
+        vid = str(event.get('viewId') or '').strip()[:120]
+        if vid and store.available():
+            try:
+                cl_mod.save_table_active_view(uname, vid)
+            except Exception as _ae:
+                _tel.error('grid:view-select', _ae)
+        return False
+
     if kind == 'view_upsert':
         raw = event.get('view')
         if not isinstance(raw, dict) or not isinstance(raw.get('config'), dict):
@@ -470,6 +484,22 @@ def handle_one(event, ctx):
             raw = dict(raw)
             raw['permissions'] = prior.get('permissions')
             raw['locked'] = prior.get('locked')
+        # ── I12/C3 BELT (2026-07-31): a LOCKED view's DISPLAY MODE is frozen HOST-SIDE too.
+        # The client's switcher already refuses (setDisplayMode), and its comment has claimed
+        # "the host refuses too" since wave 9 — this makes that claim true for direct API
+        # callers. ⚠ MIRRORS types.ts `isModeFrozen` EXACTLY: SYSTEM views and the undeletable
+        # list:/cohort: projections are EXEMPT — their `locked` is legacy "undeletable", not
+        # mode-frozen, and freezing them would trap the default view in whatever mode it last
+        # saved (the owner's stuck-in-Map report is that trap, client-made). An upsert that
+        # UNLOCKS in the same write (authorised above) may change display freely.
+        _mode_frozen = (prior.get('locked') and raw.get('locked') is not False
+                        and prior.get('kind') != 'system'
+                        and view_id != 'all-customers')
+        if _mode_frozen:
+            if prior.get('config', {}).get('display'):
+                config['display'] = dict(prior['config']['display'])
+            else:
+                config.pop('display', None)
         # ⚠ A SYSTEM VIEW IS PER-USER STATE AND MUST NEVER BE SHARED. Caught in the wave-9
         # integration pass, before deploy: `all-customers` is every user's DEFAULT view and it
         # carries their own column widths, visible fields and row height. C4's read-default

royalimports_os/core/measure_resolve.py

@@ -0,0 +1,136 @@
+"""core/measure_resolve.py — HOST-NEUTRAL measure resolution (EXIT-5, SHELL.md ladder step 3).
+
+The `_cl_measure_offer` / `_cl_resolve_measures` / `_cl_measure_columns` family, OUT of app.py:
+one implementation, two hosts. The Streamlit adapter passes its `st.session_state` memos and its
+pending-view read; the API passes runtime-level dicts and no pending view (over HTTP the
+`view_upsert` lands via `/grid/events` BEFORE the workspace re-read, so the saved views already
+carry the freshest rule — there is no mid-run component value to read).
+
+No streamlit import, no app import — harness only, so both adapters can call it.
+
+Memo discipline (unchanged from the app.py originals):
+  * keys carry (stamp, scope, POOL IDENTITY, question) — the pool's identity, never its size,
+    because Cohort passes a different pool per cohort and two same-sized cohorts must not be
+    handed each other's answers.
+  * `column_values` memoises permanent failures as None but NEVER a transient one (datastore
+    still warming after a restart) — a memoised transient means blank measure cells that stay
+    blank for the whole session long after the data landed.
+  * both memos are bounded by clearing wholesale past a cap — session/runtime-lifetime caches,
+    not leaks.
+"""
+import hashlib
+
+
+def offer(team_id=None, on_error=None):
+    """The measures the condition builder / measure columns may use, or [] if the semantic
+    store is unavailable. The caller's BU narrows the offer (a company-level measure cannot be
+    answered for one business unit)."""
+    try:
+        from harness import measure_filter as _mf
+        return _mf.measure_fields(team_id)
+    except Exception as e:                      # no store / model problem -> offer nothing
+        if on_error:
+            on_error('measures', e)
+        return []
+
+
+def _pool_key(allowed_pids):
+    """The pool's identity, hashed. Part of every ANSWER, not just the question: the zero-group
+    is reconstructed from it (a customer with no orders in the window has no row for SQL to
+    group, so `Sales < 100` would miss exactly the lapsed customers the filter is for)."""
+    return hashlib.blake2b(
+        repr(sorted(allowed_pids)).encode(), digest_size=8).hexdigest()
+
+
+def condition_sets(view_configs, pending_cfg, team_id, allowed_pids, today, stamp, memo,
+                   on_error=None):
+    """Every measure condition across `view_configs` (+ the optional pending config, which goes
+    LAST and overwrites — the freshest statement of what the user wants) -> `{ruleId: [pid,…]}`.
+
+    A rule that is incomplete (mid-edit), unresolvable, or errors is left OUT of the answer —
+    the client reads a missing id as PENDING and says "Calculating…" rather than showing a count
+    it cannot stand behind. Never resolve an incomplete rule: `to_num(None)` is 0 by the
+    engines' shared contract, so a valueless `Sales > …` would become `Sales > 0` — a wrong set
+    under a confident count.
+    """
+    from harness import measure_filter as _mf
+    by_id = {}
+    for cfg in list(view_configs or []) + [pending_cfg or {}]:
+        for rule in _mf.collect((cfg or {}).get('filters')):
+            rid = str(rule.get('id') or '')
+            if rid:
+                by_id[rid] = rule
+    rules = list(by_id.values())
+    if not rules:
+        return {}
+    pk = _pool_key(allowed_pids)
+    out = {}
+    for rule in rules:
+        if not _mf.rule_complete(rule):
+            continue
+        key = (stamp, team_id, pk, _mf.signature(rule))
+        if key not in memo:
+            try:
+                memo[key] = _mf.resolve_rule(rule, today, team_id, allowed_pids)
+            except Exception as e:
+                # An unresolvable condition must NOT become "everything" or "nothing" silently.
+                if on_error:
+                    on_error('measure-resolve', e)
+                continue
+        out[str(rule['id'])] = sorted(memo[key])
+    if len(memo) > 200:                          # a lifetime cache, not a leak
+        memo.clear()
+    return out
+
+
+def column_values(fields, team_id, allowed_pids, today, stamp, memo, on_error=None):
+    """Values for every FORMULA-MEASURE column among `fields` -> `{pid: {field key: value}}`,
+    handed to `rows_from_pool(derived=…)` beside the cohort cells.
+
+    A column that cannot be computed (store down, BU scope on a company-level measure,
+    unresolvable window) degrades to BLANK — the value dict simply omits that field key, and
+    the client renders empty cells, never $0: blank is "could not compute", 0 is a real zero.
+    """
+    mfields = [f for f in fields or [] if isinstance(f.get('measure'), dict)]
+    if not mfields:
+        return {}
+    from harness import measure_filter as _mf
+    from harness import windows as _wn
+    pk = _pool_key(allowed_pids)
+    out = {}
+    for f in mfields:
+        spec = f['measure']
+        w = _wn.normalize(spec.get('window'))
+        key = (stamp, team_id, pk, spec.get('key'),
+               None if w is None else tuple(sorted(w.items())))
+        if key not in memo:
+            try:
+                memo[key] = _mf.resolve_values(spec.get('key'), spec.get('window'),
+                                               today, team_id, allowed_pids)
+            except Exception as e:
+                if on_error:
+                    on_error('measure-column', e)
+                # ⚠ ONLY A PERMANENT FAILURE MAY BE MEMOISED. "The data cache is still warming
+                # up after a restart" is TRANSIENT and self-healing — memoising it means a user
+                # who opened the page during that window gets blank measure cells that STAY
+                # blank for the whole session. A permanent failure (an unadmitted measure, an
+                # unresolvable window) still memoises, so the retry-storm this guard was
+                # written for cannot come back.
+                transient = False
+                try:
+                    from harness import datastore as _ds
+                    transient = not _ds.ready()
+                except Exception:
+                    transient = False
+                if transient:
+                    continue                     # no memo entry -> the next call tries again
+                memo[key] = None
+        vals = memo[key]
+        if vals is None:
+            continue
+        fkey = f['key']
+        for pid, v in vals.items():
+            out.setdefault(pid, {})[fkey] = v
+    if len(memo) > 100:
+        memo.clear()
+    return out

royalimports_os/core/table_store.py

@@ -85,7 +85,7 @@ class TableStore:
             ws = (store.get(self.table_key) or {}).get(username, {}) or {}
         except Exception:
             ws = {}
-        return {
+        out = {
             'views': dict(ws.get('views') or {}),
             'fields': dict(ws.get('fields') or {}),
             'overlays': dict(ws.get('overlays') or {}),
@@ -97,6 +97,12 @@ class TableStore:
             'folders': dict(ws.get('folders') or {}),
             'itemFolders': dict(ws.get('itemFolders') or {}),
         }
+        # 2026-07-31 (owner item 3): WHERE THE USER LEFT OFF survives a new browser. The
+        # client's localStorage copy wins when present; this is the server's answer for a
+        # fresh profile, which used to fall all the way to the system default view.
+        if ws.get('activeViewId'):
+            out['activeViewId'] = str(ws['activeViewId'])
+        return out
 
     # ---------------------------------------------------------------- write
     def _update(self, username, change):
@@ -116,6 +122,21 @@ class TableStore:
         # coalesces in the background. Registry/auth writes elsewhere stay flush='sync'.
         store.update(self.table_key, _up, flush='async')
 
+    def save_active_view(self, username, view_id):
+        """Remember which view this user last opened (owner item 3, 2026-07-31).
+
+        Presentation state, not authorisation: the READ side re-validates the id against what
+        the caller may actually see, so a stale or foreign id degrades to the default view
+        rather than granting anything. Stored per user like every other stratum.
+        """
+        vid = str(view_id or '').strip()[:120]
+        if not vid or username == SHARED_KEY:
+            return
+
+        def _set(ws):
+            ws['activeViewId'] = vid
+        self._update(username, _set)
+
     def save_folders(self, username, folders, item_folders):
         """Replace the folder stratum wholesale (wave-8 I11).
 

royalimports_os/core/users.py

@@ -236,3 +236,23 @@ def allowed_bus_labels(user):
     if not labels:
         return ['All', 'Fisch', 'Royal']
     return (['All'] + labels) if len(labels) > 1 else labels
+
+
+def assignable_people():
+    """Display names for `user`-typed overlay columns — the tenant's ACTIVE accounts.
+
+    Moved from app.py (2026-07-31) so both hosts serve the same choices. Resolved on every
+    call rather than persisted with the column: a snapshot would keep offering people who
+    have left and never offer people who joined. Deactivated accounts are excluded; a value
+    already stored on a row is untouched — history should still say who owned something.
+    """
+    try:
+        reg = registry() or {}
+    except Exception:
+        return []
+    out = []
+    for username, u in reg.items():
+        if not isinstance(u, dict) or u.get('active') is False:
+            continue
+        out.append(str(u.get('name') or username))
+    return sorted(set(out))

royalimports_os/harness/runtime.py

@@ -75,6 +75,11 @@ class TenantRuntime:
     tenant: object                       # harness.base.Tenant
     store_namespace: str = ""
     pool_cache: dict = field(default_factory=dict)
+    #: EXIT-5 — the API adapter's memos for `core.measure_resolve` (the Streamlit adapter keeps
+    #: its own in st.session_state). Bounded by the module's own clear-past-cap rule; keyed on
+    #: (stamp, scope, pool identity, question) so nothing user-shaped lives in them.
+    measure_memo: dict = field(default_factory=dict)
+    mset_memo: dict = field(default_factory=dict)
     _lock: threading.RLock = field(default_factory=threading.RLock, repr=False)
 
     @property

royalimports_os/modules/customer_data.py

@@ -518,6 +518,7 @@ delete_table_field = _TSTORE.delete_field
 duplicate_table_field = _TSTORE.duplicate_field
 patch_table_overlay = _TSTORE.patch_overlay
 save_table_folders = _TSTORE.save_folders
+save_table_active_view = _TSTORE.save_active_view   # owner item 3: last-opened view, per user
 
 
 # ------------------------------------------------------------------ digest compatibility

web/src/apiContract.ts

@@ -56,6 +56,12 @@ export const TOAST_EVENT = "aios:toast";
  *  membership. A toast is a receipt, not a refresh. */
 export const WORKSPACE_STALE_EVENT = "aios:workspace-stale";
 
+/** Owner item 10 (2026-07-31): the user CLICKED INTO THE WORK SURFACE (a saved view, a grid
+ *  cell) — the frame should fold its navigation rail down to the slim strip so the table gets
+ *  the width. Raised by the grid, handled by the shell; a no-op in the embed (no listener),
+ *  which is exactly the host-neutral contract the other signals follow. */
+export const NAV_MINIMIZE_EVENT = "aios:nav-minimize";
+
 export function signal(name: string, detail?: unknown): void {
   if (typeof window === "undefined") return;
   window.dispatchEvent(new CustomEvent(name, { detail }));

web/src/customer-grid/ColumnMenu.tsx

@@ -2,6 +2,7 @@ import { useMemo, useState } from "react";
 import type { ReactNode } from "react";
 import { AnchoredOverlay } from "./OverlaySurface";
 import type { AnchorRect } from "./OverlaySurface";
+import { FieldTypeIcon } from "./icons";
 import { CREATABLE_TYPES, choiceOptions, directionLabel, parseOptions, ratingMax }
   from "./types";
 import type { Field, FieldFormat, FieldScope, FieldType, Measure, Viewer } from "./types";
@@ -293,6 +294,89 @@ function needsOptions(t: FieldType | "measure"): boolean {
  */
 type CreateKind = FieldType | "measure";
 
+/**
+ * Owner item 8 (2026-07-31) — the create pane's field-type picker: a find box over an icon
+ * listbox, replacing the icon-less native select. Each row wears the SAME mark its column
+ * header will wear (`FieldTypeIcon` ← TYPE_SHAPES), so the vocabulary teaches itself. The
+ * "measure" pseudo-kind borrows the currency mark: a measure column's real type is
+ * currency/int/pct, and inventing a 17th glyph for a pseudo-kind would put a mark on screen
+ * that no column ever wears.
+ */
+function TypePicker({
+  value,
+  onPick,
+  offerMeasure,
+}: {
+  value: CreateKind;
+  onPick: (k: CreateKind) => void;
+  offerMeasure: boolean;
+}) {
+  const [q, setQ] = useState("");
+  const needle = q.trim().toLowerCase();
+  const rows: { value: CreateKind; label: string }[] = [
+    ...FIELD_TYPES,
+    ...(offerMeasure
+      ? [{ value: "measure" as CreateKind, label: "Formula measure (over a period)" }]
+      : []),
+  ].filter((r) => !needle || r.label.toLowerCase().includes(needle));
+  return (
+    <div className="cg-type-picker">
+      <div className="cg-type-search">
+        <svg width="13" height="13" viewBox="0 0 16 16" fill="none" aria-hidden="true">
+          <circle cx="7" cy="7" r="4.4" stroke="currentColor" strokeWidth="1.35" />
+          <path
+            d="m10.4 10.4 3.1 3.1"
+            stroke="currentColor"
+            strokeWidth="1.35"
+            strokeLinecap="round"
+          />
+        </svg>
+        <input
+          type="text"
+          value={q}
+          placeholder="Find a field type"
+          aria-label="Find a field type"
+          onChange={(event) => setQ(event.target.value)}
+        />
+      </div>
+      <div className="cg-type-list" role="listbox" aria-label="Field type">
+        {rows.map((r) => (
+          <button
+            key={r.value}
+            type="button"
+            role="option"
+            aria-selected={value === r.value}
+            className={"cg-type-row" + (value === r.value ? " is-on" : "")}
+            onClick={() => onPick(r.value)}
+          >
+            <FieldTypeIcon type={r.value === "measure" ? "currency" : r.value} size={16} />
+            <span className="cg-type-label">{r.label}</span>
+            {value === r.value && (
+              <svg
+                className="cg-type-check"
+                width="14"
+                height="14"
+                viewBox="0 0 16 16"
+                fill="none"
+                aria-hidden="true"
+              >
+                <path
+                  d="m3.5 8.5 3 3 6-6.5"
+                  stroke="currentColor"
+                  strokeWidth="1.6"
+                  strokeLinecap="round"
+                  strokeLinejoin="round"
+                />
+              </svg>
+            )}
+          </button>
+        ))}
+        {rows.length === 0 && <div className="cg-pop-note">No matching type.</div>}
+      </div>
+    </div>
+  );
+}
+
 /** The Change-field dropdown's "New field" entries. A colon cannot occur in a real field key
  *  (keys are slugs), so the prefix cannot collide with one. */
 const NEW_PREFIX = "new:";
@@ -395,9 +479,9 @@ function ExtraTypeEditor({
   idPrefix: string;
 }) {
   if (kind === "formula") {
-    const referencable = fields.filter(
-      (f) => f.type !== "formula" && f.key !== "__proto__"
-    );
+    // 2026-07-31 (owner item 2): other FORMULA fields are referencable now — evaluation is
+    // topological and a cycle is refused at validation, so the old exclusion is gone.
+    const referencable = fields.filter((f) => f.key !== "__proto__");
     return (
       <>
         <label>
@@ -435,7 +519,10 @@ function ExtraTypeEditor({
           <div className="cg-field-hint cg-formula-error">{formulaError}</div>
         ) : (
           <div className="cg-field-hint">
-            Numbers, {"{field}"} references, + − × ÷ ( ), ABS, ROUND, MIN, MAX and IF.
+            Excel-style: numbers, text in quotes, {"{field}"} references, + − × ÷ ^ &amp; ( ),
+            IF · AND · OR · SUM · AVERAGE · COUNT · MIN · MAX · ROUND(UP/DOWN) · ABS · MOD ·
+            SQRT · CONCATENATE · LEFT · RIGHT · MID · LEN · TRIM · UPPER · LOWER · PROPER ·
+            TEXT · VALUE · TODAY · DAYS · YEAR · MONTH · DAY · IFERROR · ISBLANK.
             Errors show a blank cell.
           </div>
         )}
@@ -578,30 +665,37 @@ export default function ColumnMenu({
     ? parseOptions(cleanOptionText(retypeOptionText, retypeTo))
     : [];
 
-  // Wave-5 item 9 — live formula validation for BOTH create surfaces. Refs must name real,
-  // non-formula fields (the evaluator reads raw row values, so formula-over-formula would
-  // silently be blank — refused at authoring time instead).
+  // Wave-5 item 9, amended 2026-07-31 (owner item 2) — live formula validation for BOTH
+  // create surfaces. Refs may now name OTHER formula fields (evaluation is topological);
+  // what is refused is a CYCLE, checked against every formula's SOURCE. Both surfaces here
+  // CREATE a field, so no cycle is possible yet and no selfKey is passed — the retype path
+  // (in-place formula edit) would pass the edited field's key.
   const knownKeys = useMemo(
     () => new Set(fields.filter((f) => f.type !== "formula").map((f) => f.key)),
     [fields]
   );
-  const formulaKeys = useMemo(
-    () => new Set(fields.filter((f) => f.type === "formula").map((f) => f.key)),
-    [fields]
-  );
+  const formulaSources = useMemo(() => {
+    const out = new Map<string, string>();
+    for (const f of fields) {
+      if (f.type !== "formula") continue;
+      const src = typeof f.formula === "string" ? f.formula : "";
+      if (src) out.set(f.key, src);
+    }
+    return out;
+  }, [fields]);
   const formulaCheck = useMemo(
     () =>
       formulaText.trim() === ""
         ? { ok: false, error: "Type a formula", refs: [] as string[] }
-        : validateFormula(formulaText, knownKeys, formulaKeys),
-    [formulaText, knownKeys, formulaKeys]
+        : validateFormula(formulaText, knownKeys, formulaSources),
+    [formulaText, knownKeys, formulaSources]
   );
   const swapFormulaCheck = useMemo(
     () =>
       swapFormulaText.trim() === ""
         ? { ok: false, error: "Type a formula", refs: [] as string[] }
-        : validateFormula(swapFormulaText, knownKeys, formulaKeys),
-    [swapFormulaText, knownKeys, formulaKeys]
+        : validateFormula(swapFormulaText, knownKeys, formulaSources),
+    [swapFormulaText, knownKeys, formulaSources]
   );
 
   const chosenMeasure = measures.find((m) => m.key === measureKey);
@@ -778,25 +872,19 @@ export default function ColumnMenu({
               onKeyDown={(event) => event.key === "Enter" && create()}
             />
           </label>
-          <label>
-            <span>Field type</span>
-            <select
-              className="cg-select"
+          <div className="cg-type-block">
+            <span className="cg-type-title">Field type</span>
+            {/* Owner item 8 (2026-07-31): every type wears its own mark — the same TYPE_SHAPES
+                glyph its column header wears. A native <option> cannot hold an SVG (the ruling
+                iconShapes.ts records), so the control is a find box over a listbox of real
+                rows, Airtable-style. The measure row appears exactly when the host offers
+                measures — the same availability rule as the filter's measure conditions. */}
+            <TypePicker
               value={kind}
-              onChange={(event) => setKind(event.target.value as CreateKind)}
-            >
-              {FIELD_TYPES.map((option) => (
-                <option value={option.value} key={option.value}>
-                  {option.label}
-                </option>
-              ))}
-              {/* Offered exactly when the host offers measures — the same availability rule as
-                  the filter's measure conditions, because it is the same machinery. */}
-              {measures.length > 0 && (
-                <option value="measure">Formula measure (over a period)</option>
-              )}
-            </select>
-          </label>
+              onPick={setKind}
+              offerMeasure={measures.length > 0}
+            />
+          </div>
           {kind === "measure" && (
             <>
               <label>

web/src/customer-grid/CustomerGrid.tsx

@@ -38,6 +38,7 @@ import ColumnMenu from "./ColumnMenu";
 import type { ColumnMenuState } from "./ColumnMenu";
 import { HEADER_ICONS } from "./iconShapes";
 import { emitHostEvent, eventId } from "./hostBridge";
+import { NAV_MINIMIZE_EVENT, signal } from "../apiContract";
 import { runExport } from "./export";
 import type { ExportFormat } from "./export";
 import { echoReemit, reconcileEchoView } from "./viewEcho";
@@ -46,7 +47,7 @@ import { newFolderId, pruneFolderStamps, reconcileFolders, resolveFolderId } fro
 import type { FolderStamps } from "./folders";
 import type { GridFolder, ViewPermissions } from "./types";
 import type { FieldStamps } from "./optimism";
-import { evalFormula, parseFormula } from "./formulaEngine";
+import { evalFormula, orderFormulas, parseFormula } from "./formulaEngine";
 import type { FormulaAst } from "./formulaEngine";
 import { CalendarView, KanbanView, ListView, ModeSwitch } from "./viewModes";
 // The chart engine lives in `viz/` since EXIT wave 2 (W2-5/Y3) — the grid is now
@@ -328,6 +329,12 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
     fieldKey: string;
     anchor: AnchorRect;
   } | null>(null);
+  /** Owner item 5 (2026-07-31) — closing a picker RETURNS FOCUS TO THE GRID, so Enter keeps
+   *  navigating (pick → Enter → next record) instead of stranding focus on a dead overlay. */
+  const closePicker = useCallback(() => {
+    setPicker(null);
+    requestAnimationFrame(() => gridRef.current?.focus());
+  }, []);
   /** The selection bar's "Add to cohort" popover (owner item 2's purpose for the checkboxes). */
   const [selAddOpen, setSelAddOpen] = useState(false);
   const [selListName, setSelListName] = useState("");
@@ -654,14 +661,23 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
   // row WITH this session's overlay edits layered, so editing a referenced field recomputes
   // live. A formula that does not parse, or errors on a row, yields BLANK — never a wrong
   // number (formulaEngine.ts). `created_time` copies the row's `_created`.
+  // 2026-07-31 (owner item 2): formulas may reference OTHER formulas now, so parse order is
+  // TOPOLOGICAL (orderFormulas) — a formula runs after the formulas it reads, cycle members
+  // never run (blank, never a stale number), and each row's results feed the next formula
+  // through a per-row scope.
   const formulaAsts = useMemo(() => {
-    const out: { key: string; ast: FormulaAst }[] = [];
+    const sources = new Map<string, string>();
     for (const f of fields) {
       if (f.type !== "formula") continue;
       const src = formulaOf(f);
-      if (!src) continue;
-      const p = parseFormula(src);
-      if (p.ok) out.push({ key: f.key, ast: p.ast });
+      if (src) sources.set(f.key, src);
+    }
+    const { order, cyclic } = orderFormulas(sources);
+    const out: { key: string; ast: FormulaAst }[] = [];
+    for (const key of order) {
+      if (cyclic.has(key)) continue;
+      const p = parseFormula(sources.get(key)!);
+      if (p.ok) out.push({ key, ast: p.ast });
     }
     return out;
   }, [fields]);
@@ -671,17 +687,23 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
   );
   const computedRows = useMemo(() => {
     if (formulaAsts.length === 0 && createdTimeKeys.length === 0) return rawRows;
+    const env = { today: payload?.today };
     return rawRows.map((r) => {
       const edits = overlayEdits[r.pid];
-      const base = edits ? { ...r, ...edits } : r;
+      const scope: Row = edits ? { ...r, ...edits } : { ...r };
       const out: Row = { ...r };
-      for (const k of createdTimeKeys)
+      for (const k of createdTimeKeys) {
         out[k] = (r._created as string | undefined) ?? null;
-      for (const { key, ast } of formulaAsts)
-        out[key] = evalFormula(ast, (k) => base[k]);
+        scope[k] = out[k];
+      }
+      for (const { key, ast } of formulaAsts) {
+        const v = evalFormula(ast, (k) => scope[k], env);
+        out[key] = v;
+        scope[key] = v; // later formulas read this one's result — the topo order above
+      }
       return out;
     });
-  }, [rawRows, overlayEdits, formulaAsts, createdTimeKeys]);
+  }, [rawRows, overlayEdits, formulaAsts, createdTimeKeys, payload?.today]);
 
   // Wave-2 item 2c — COHORT MODE (the Cohort page). The host serves the WHOLE pool (rows +
   // derived values over the pool); the ACTIVE cohort scopes the table to its pids CLIENT-side.
@@ -753,7 +775,8 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
     overlayEdits,
     canEditField
   );
-  const { gridSelection, selectedPids, onGridSelectionChange, selectPids, clearSelection } =
+  const { gridSelection, selectedPids, onGridSelectionChange, selectPids, togglePid,
+          setActiveCell, clearSelection } =
     useGridSelection(
       displayRows,
       displayPidToIndex,
@@ -1034,6 +1057,9 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
     (cell: Item, event: CellClickedEventArgs) => {
       const row = displayRows[cell[1]];
       if (!row) return;
+      // Owner item 10: clicking into the cells is "I am working now" — the frame folds its
+      // navigation rail to the slim strip (a no-op in the embed; the shell listens).
+      signal(NAV_MINIMIZE_EVENT);
       if (row.kind === "group-header") {
         event.preventDefault();
         setCollapsed((current) => {
@@ -1086,6 +1112,14 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
           }
         }
       }
+      // Owner item 6 (2026-07-31) — CLICKING THE CUSTOMER TICKS THE CHECKBOX. The row marker
+      // is a ~32px strip; the identity cell is the widest, most natural target on the row, so
+      // a click there toggles the same pid-anchored set the markers write ("more surface area
+      // to select individual customers into a Cohort"). No preventDefault: glide still commits
+      // the cell highlight below, so reading across the row keeps working.
+      if (row.kind === "data" && field && field.key === lockedKey) {
+        togglePid(row.record.pid);
+      }
       // Owner item 17 — A SINGLE CLICK HIGHLIGHTS. It used to open the record panel from here,
       // which meant a user could not select a cell, read across a row, or copy a value without
       // a drawer landing over the table. The highlight is glide's own doing: this handler
@@ -1097,7 +1131,7 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
       // open a record; the hover Expand button below is its replacement, and half of this
       // change is a table whose records cannot be opened at all.
     },
-    [displayRows, visibleCols, fieldByKey, canEditField, overlayEdits]
+    [displayRows, visibleCols, fieldByKey, canEditField, overlayEdits, lockedKey, togglePid]
   );
   /**
    * Double-click / Enter. KEPT as a door to the record on purpose (owner item 17 names the
@@ -1189,6 +1223,30 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
   );
   const onGridKeyDown = useCallback(
     (event: GridKeyEventArgs) => {
+      // Owner item 5 (2026-07-31) — EXCEL-GRADE ENTER. When no editor is open (an open overlay
+      // editor swallows its own keys before the canvas sees them), Enter moves the active cell
+      // DOWN one record and Shift+Enter moves UP — never opening the record drawer, which is
+      // what made keyboard runs down a column "really clunky". Glide's own overlay editor
+      // already commits-and-moves-down on Enter, so typing → Enter → typing flows like Excel;
+      // this handles the BETWEEN-edits half. Group headers are skipped in the direction of
+      // travel. The drawer stays reachable by double-click and the hover Expand button.
+      if (event.key === "Enter" && !event.ctrlKey && !event.metaKey && !event.altKey) {
+        const cur = gridSelection.current?.cell;
+        if (cur) {
+          event.preventDefault();
+          event.stopPropagation();
+          event.cancel();
+          const dir = event.shiftKey ? -1 : 1;
+          let row = cur[1] + dir;
+          while (row >= 0 && row < displayRows.length && displayRows[row]?.kind !== "data")
+            row += dir;
+          if (row >= 0 && row < displayRows.length) {
+            setActiveCell(cur[0], row);
+            gridRef.current?.scrollTo(cur[0], row, "vertical", 0, 0);
+          }
+          return;
+        }
+      }
       const contextMenu =
         event.key === "ContextMenu" || (event.key === "F10" && event.shiftKey);
       // DataEditor exposes public controlled selection without the row marker,
@@ -1212,7 +1270,7 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
         height: 36,
       });
     },
-    [gridSelection.current, openHeaderMenu]
+    [gridSelection.current, openHeaderMenu, displayRows, setActiveCell]
   );
 
   const persistView = useCallback((view: SavedView) => {
@@ -1238,6 +1296,12 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
       setSearch("");
       setDetailPid(null);
       setDisplayCap(DISPLAY_PAGE);
+      // Owner item 3 (2026-07-31): tell the host WHERE THE USER IS, so a fresh browser (no
+      // localStorage copy) resumes on this view instead of the system default. Presentation
+      // state — the host stores the id and the read side re-validates it.
+      emitHostEvent({ id: eventId("view"), type: "view_select", viewId: id });
+      // Owner item 10: opening a view is "I am working now" — the frame folds its nav rail.
+      signal(NAV_MINIMIZE_EVENT);
     },
     [views, activeViewId, config, persistView, fields]
   );
@@ -3116,7 +3180,7 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
           placement="bottom-start"
           role="listbox"
           ariaLabel={`Choose ${pickerField.label}`}
-          onDismiss={() => setPicker(null)}
+          onDismiss={closePicker}
           dataKind="cell-picker"
         >
           <div className="cg-pop-title">{pickerField.label}</div>
@@ -3138,7 +3202,7 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
                     aria-label={`${n} star${n === 1 ? "" : "s"}`}
                     onClick={() => {
                       patchOverlay(picker.pid, { [pickerField.key]: String(n) });
-                      setPicker(null);
+                      closePicker();
                     }}
                   >
                     <StarIcon on={Number(pickerValue) >= n} />
@@ -3180,7 +3244,7 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
                       return;
                     }
                     patchOverlay(picker.pid, { [pickerField.key]: choice });
-                    setPicker(null);
+                    closePicker();
                   }}
                 >
                   <span className="cg-pick-pill"
@@ -3196,7 +3260,7 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
               <button
                 type="button"
                 className="cg-btn"
-                onClick={() => setPicker(null)}
+                onClick={closePicker}
               >
                 Done
               </button>
@@ -3211,7 +3275,7 @@ export default function CustomerGrid({ scope = "customer" }: { scope?: SurfaceSc
               className="cg-pick-row cg-pick-clear"
               onClick={() => {
                 patchOverlay(picker.pid, { [pickerField.key]: "" });
-                setPicker(null);
+                closePicker();
               }}
             >
               Clear

web/src/customer-grid/ViewSidebar.tsx

@@ -211,9 +211,36 @@ export default function ViewSidebar({
   const [addAnchor, setAddAnchor] = useState<HTMLElement | null>(null);
   const [addName, setAddName] = useState("");
   const [dropTarget, setDropTarget] = useState<string | null>(null);
+  // Owner item 9 (2026-07-31) — "Find a view". Local and never persisted: a search is a
+  // moment, not a setting. Filtering runs BEFORE grouping so a folder with no matches
+  // simply drops out of the rail while the query is live.
+  const [viewQuery, setViewQuery] = useState("");
+  // Owner item 11 — this rail is the SECOND navigation bar: it folds to the same slim strip
+  // the shell nav does, remembered per browser under its own key.
+  const [railShut, setRailShut] = useState<boolean>(() => {
+    try {
+      return localStorage.getItem("aios-views-rail") === "1";
+    } catch {
+      return false;
+    }
+  });
+  const toggleRail = () =>
+    setRailShut((v) => {
+      const next = !v;
+      try {
+        localStorage.setItem("aios-views-rail", next ? "1" : "0");
+      } catch {
+        // storage can be blocked; the fold still works for the session
+      }
+      return next;
+    });
+  const viewNeedle = viewQuery.trim().toLowerCase();
+  const shownViews = viewNeedle
+    ? views.filter((v) => (v.name || "").toLowerCase().includes(viewNeedle))
+    : views;
   const foldersOn = !!folders && !!folderIdOf && !!onItemMove;
   const groups = groupByFolder(
-    views,
+    shownViews,
     foldersOn ? (folders as GridFolder[]) : [],
     (v) => (folderIdOf ? folderIdOf(v.id) : null)
   );
@@ -299,7 +326,31 @@ export default function ViewSidebar({
   };
 
   return (
-    <aside className="cg-views" aria-label="Customer views">
+    <aside
+      className={"cg-views" + (railShut ? " is-collapsed" : "")}
+      aria-label="Customer views"
+    >
+      {/* Owner item 11 — the rail's own minimize control: the same three-bars glyph as the
+          shell nav's, because the two rails are one idea ("a navigation bar folds"). */}
+      <div className="cg-views-top">
+        <button
+          type="button"
+          className="cg-rail-toggle"
+          aria-label={railShut ? "Expand views" : "Minimize views"}
+          aria-expanded={!railShut}
+          title={railShut ? "Expand views" : "Minimize views"}
+          onClick={toggleRail}
+        >
+          <svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true">
+            <path
+              d="M2.5 4.4h11M2.5 8h11M2.5 11.6h11"
+              stroke="currentColor"
+              strokeWidth="1.35"
+              strokeLinecap="round"
+            />
+          </svg>
+        </button>
+      </div>
       {/*
         I13 — the "Views / All changes saved" header block is GONE and everything moved up.
 
@@ -337,6 +388,38 @@ export default function ViewSidebar({
         </button>
       </div>
 
+      {/* Owner item 9 — "Find a view". Borderless on the white rail (no box until it is
+          being used); focus paints the brand-purple outline. Clearing the query restores
+          the full rail — filtering never persists. */}
+      <div className="cg-find-view">
+        <svg
+          className="cg-find-view-icon"
+          width="14"
+          height="14"
+          viewBox="0 0 16 16"
+          fill="none"
+          aria-hidden="true"
+        >
+          <circle cx="7" cy="7" r="4.4" stroke="currentColor" strokeWidth="1.35" />
+          <path
+            d="m10.4 10.4 3.1 3.1"
+            stroke="currentColor"
+            strokeWidth="1.35"
+            strokeLinecap="round"
+          />
+        </svg>
+        <input
+          type="text"
+          value={viewQuery}
+          placeholder="Find a view"
+          aria-label="Find a view"
+          onChange={(event) => setViewQuery(event.target.value)}
+          onKeyDown={(event) => {
+            if (event.key === "Escape") setViewQuery("");
+          }}
+        />
+      </div>
+
       {creating && (
         <div className="cg-view-create cg-create-form">
           <label htmlFor="cg-new-view">
@@ -543,9 +626,11 @@ export default function ViewSidebar({
         </AnchoredOverlay>
       )}
 
-      <div className="cg-view-list">
+      <div className="cg-view-list cg-views-scroll">
         {groups.map((group) => {
         const gid = group.folder?.id ?? null;
+        // Item 9 — while a search is live, a folder with no matches is noise, not a target.
+        if (viewNeedle && group.folder && group.items.length === 0) return null;
         const isRoot = gid === null;
         const shut = gid != null && collapsed.has(gid);
         return (

web/src/customer-grid/cells.ts

@@ -46,14 +46,17 @@ export { checkboxOn, dateTimeText, formatDisplay } from "./display";
  *  its colour across rows, sessions and users without anyone picking one — and a renamed option
  *  simply gets a new colour rather than inheriting a stale mapping. */
 const PICK_TINTS = [
-  // Wave-8 I7c: C1's cycle is blue -> green -> yellow -> red, "then 20%-darkened
-  // variants". Realised as two passes over the same four hues -- the TINTS with a
-  // measured `-deep` label, then the full PASTELS with ink. Eight stable pills,
-  // every pairing >= 4.9:1 (ink on a pastel measures 7.9-11.1).
-  { bg: "#EDF3FD", fg: "#4F6079" }, { bg: "#EBF6EF", fg: "#35754E" },
-  { bg: "#FBF4E0", fg: "#7E6428" }, { bg: "#FCEEEC", fg: "#A3453C" },
-  { bg: "#9DBFF2", fg: "#202433" }, { bg: "#A5D8B4", fg: "#202433" },
-  { bg: "#F5D989", fg: "#202433" }, { bg: "#F0A8A0", fg: "#202433" },
+  // 2026-07-31 (owner item 7): ONE construction — every pill is a `-tint` wash carrying its
+  // family's `-deep` ink, the standing brand rule ("pastels are fills; text takes the deep
+  // weight"). The old second pass (full pastel + near-black ink) is GONE: it is what read as
+  // "black font on a saturated chip". Six families now — the four C1 hues, the brand purple,
+  // and a neutral grey — all mirrored from index.css tokens; every pairing measures ≥ 5.0:1.
+  { bg: "#EDF3FD", fg: "#4F6079" },   // blue-tint  / LP_BLUE_TEXT
+  { bg: "#EBF6EF", fg: "#35754E" },   // green-tint / green-deep
+  { bg: "#FBF4E0", fg: "#7E6428" },   // yellow-tint/ yellow-deep
+  { bg: "#FCEEEC", fg: "#A3453C" },   // red-tint   / red-deep
+  { bg: "#F1EEFB", fg: "#6B57A8" },   // purple-tint/ purple-deep (--lp-purple family)
+  { bg: "#EEF1F4", fg: "#4B5563" },   // neutral wash / slate — the sixth distinct family
 ];
 
 export function pickTint(v: string): { bg: string; fg: string } {
@@ -153,17 +156,30 @@ export function makeCell(field: Field, v: CellValue, editable: boolean): GridCel
         contentAlign: "right",
         ...ro,
       };
-    case "formula":
+    case "formula": {
       // Computed client-side (formulaEngine.ts) over values ALREADY injected at this key by
       // CustomerGrid's computedRows. Read-only by nature — the caller passes editable=false.
+      // 2026-07-31 (owner item 2): a formula may now return TEXT (CONCATENATE, &, TEXT(),
+      // TRUE/FALSE) — a non-numeric result renders as a text cell, never as NaN.
+      const asNum = num(v);
+      if (!blank && typeof v === "string" && !Number.isFinite(asNum)) {
+        return {
+          kind: GridCellKind.Text,
+          data: v,
+          displayData: v,
+          allowOverlay: false,
+          readonly: true,
+        };
+      }
       return {
         kind: GridCellKind.Number,
-        data: blank ? undefined : num(v),
-        displayData: blank ? "" : numberText(num(v), field.format),
+        data: blank ? undefined : asNum,
+        displayData: blank ? "" : numberText(asNum, field.format),
         contentAlign: "right",
         allowOverlay: false,
         readonly: true,
       };
+    }
     case "pct":
       return {
         kind: GridCellKind.Number,

web/src/customer-grid/formulaEngine.ts

@@ -1,40 +1,49 @@
 // ---------------------------------------------------------------------------
 // customer-grid / formulaEngine.ts
-// Wave-5 I-B — the FORMULA field's engine. A pure module: no React, no DOM,
-// no imports from the rest of the grid, so it is testable under plain node
-// and portable into the wave-4 shell unchanged.
+// Wave-5 I-B, grown to EXCEL GRADE 2026-07-31 (owner item 2). A pure module:
+// no React, no DOM, no imports from the rest of the grid, so it is testable
+// under plain node and portable into the shell unchanged.
 //
-// GRAMMAR (v1, the shared contract — grid-wave2-split.md §WAVE 5):
+// GRAMMAR (v2 — the shared contract; v1 remains a strict subset):
 //   numbers          1  0.5  .5  1200.75          (no separators, no exponents)
+//   strings          "text"  with "" escaping a quote — Excel's own rule
+//   booleans         TRUE  FALSE                  (bare constants)
 //   field refs       {revenue_ytd}                (slug charset [A-Za-z0-9_])
-//   arithmetic       + - * / ( )                  (usual precedence, unary -)
-//   functions        ABS(x) ROUND(x[, p]) MIN(a, …) MAX(a, …) IF(c, a[, b])
-//   comparisons      < <= > >= = != (== accepted as =) — meaningful inside
-//                    IF's condition; a comparison anywhere else parses, but a
-//                    boolean is not a number, so the cell is BLANK.
+//   arithmetic       + - * / ^ ( )                (usual precedence; ^ is
+//                    right-associative and UNARY MINUS BINDS TIGHTER, Excel's
+//                    famous quirk: -2^2 = 4)
+//   text             &                            (concatenation; blank -> "")
+//   comparisons      < <= > >= = != (== and <> accepted) — numbers with
+//                    numbers, text with text (case-insensitive, Excel's rule);
+//                    a mixed or blank comparison is BLANK, never a guess.
+//   functions        numeric  ABS ROUND ROUNDUP ROUNDDOWN INT MOD SQRT POWER
+//                             EXP LN SUM AVERAGE COUNT COUNTA MIN MAX
+//                    logic    IF AND OR NOT IFERROR ISBLANK
+//                    text     CONCATENATE/CONCAT LEFT RIGHT MID LEN TRIM
+//                             UPPER LOWER PROPER VALUE TEXT
+//                    date     TODAY YEAR MONTH DAY DAYS      (ISO YYYY-MM-DD)
 //
-// THE ONE RULE, applied everywhere: **any error → BLANK, never a wrong
-// number.** A blank operand, an unknown ref, a divide-by-zero, a boolean fed
-// to arithmetic, a non-finite result — every one of them yields null, and
-// null propagates. Inventing 0 for a missing value is how a wrong number gets
-// a confident face (the falsy-`0` and NULL-sum lessons, [[cg-filter-engine-
-// sql-port]] / [[cg-measure-conditions]]); this engine refuses instead.
+// THE ONE RULE, unchanged: **any error → BLANK, never a wrong number.** An
+// unknown ref, a divide-by-zero, a boolean fed to arithmetic, an unreadable
+// date, an unknown TEXT() format — every one yields null, and null propagates
+// through ARITHMETIC. Inventing 0 for a missing value is how a wrong number
+// gets a confident face; this engine refuses instead.
 //
-// Deliberate decisions, each asserted by the gate:
-//   - BLANKS PROPAGATE: {a} + {b} with b blank is blank, and MIN/MAX with any
-//     blank argument are blank. Coercing blank to 0 would state a number
-//     nobody entered. (Airtable is looser here; we are not.)
-//   - IF IS LAZY: only the taken branch evaluates, so the guard pattern
-//     IF({x} = 0, 0, 1 / {x}) works — the whole reason IF exists in v1.
-//   - IF's condition must be a BOOLEAN. IF({x}, …) does not coerce — there is
-//     no truthiness in a financial formula.
-//   - ROUND is HALF-AWAY-FROM-ZERO (Airtable's convention): ROUND(2.5) = 3,
-//     ROUND(-2.5) = -3. This is a client-only display value with no Python
-//     mirror by design (a second engine would be filter_sql-class drift), so
-//     Airtable's convention wins over Python's banker's rounding.
-//   - No formula-over-formula: the evaluator's getter serves RAW row values,
-//     so a ref to another formula column finds nothing and the cell is blank.
-//     Cycles are impossible by construction rather than by detection.
+// Where v2 deliberately follows EXCEL rather than v1's stricter reading:
+//   - THE AGGREGATES SKIP BLANKS. SUM/AVERAGE/COUNT/COUNTA/MIN/MAX ignore
+//     blank arguments exactly as Excel ignores empty cells — that selectivity
+//     is the entire reason the aggregate forms exist beside `+`. (v1's
+//     MIN/MAX-propagate-blank rule is superseded; `+` still propagates.)
+//   - TEXT CONTEXT COERCES BLANK TO "". `{a} & {b}` with b blank is a, as in
+//     Excel. Text is display, not arithmetic — "" states nothing false.
+//   - A BOOLEAN RESULT DISPLAYS AS TRUE/FALSE (v1 blanked it). A comparison
+//     the user typed deserves its answer on screen.
+//   - FORMULA-OVER-FORMULA IS ALLOWED. Evaluation is topological
+//     (`orderFormulas`); a CYCLE refuses at authoring time and every member
+//     of one evaluates to blank — never a stale or half-updated number.
+//   - IF's condition must still be a real BOOLEAN (no numeric truthiness):
+//     this is a financial surface, and 0-means-false is a silent wrong branch.
+//   - ROUND stays HALF-AWAY-FROM-ZERO (Excel's convention too).
 // ---------------------------------------------------------------------------
 
 /** Source-length cap. The host's structural validation mirrors it; both sides
@@ -47,28 +56,75 @@ export const MAX_FORMULA_DEPTH = 24;
 
 export type FormulaAst =
   | { t: "num"; v: number }
+  | { t: "str"; v: string }
+  | { t: "bool"; v: boolean }
   | { t: "ref"; k: string }
   | { t: "neg"; e: FormulaAst }
-  | { t: "bin"; op: "+" | "-" | "*" | "/"; l: FormulaAst; r: FormulaAst }
+  | { t: "bin"; op: "+" | "-" | "*" | "/" | "^" | "&"; l: FormulaAst; r: FormulaAst }
   | { t: "cmp"; op: "<" | "<=" | ">" | ">=" | "=" | "!="; l: FormulaAst; r: FormulaAst }
   | { t: "call"; fn: FormulaFn; args: FormulaAst[] };
 
-export type FormulaFn = "ABS" | "ROUND" | "MIN" | "MAX" | "IF";
+export type FormulaFn =
+  | "ABS" | "ROUND" | "ROUNDUP" | "ROUNDDOWN" | "INT" | "MOD" | "SQRT" | "POWER"
+  | "EXP" | "LN" | "SUM" | "AVERAGE" | "COUNT" | "COUNTA" | "MIN" | "MAX"
+  | "IF" | "AND" | "OR" | "NOT" | "IFERROR" | "ISBLANK"
+  | "CONCATENATE" | "LEFT" | "RIGHT" | "MID" | "LEN" | "TRIM"
+  | "UPPER" | "LOWER" | "PROPER" | "VALUE" | "TEXT"
+  | "TODAY" | "YEAR" | "MONTH" | "DAY" | "DAYS";
+
+const MANY = 30; // variadic cap — bounded, far above any honest use
 
 const FN_ARITY: Record<FormulaFn, [number, number]> = {
   ABS: [1, 1],
   ROUND: [1, 2],
-  MIN: [1, 10],
-  MAX: [1, 10],
+  ROUNDUP: [1, 2],
+  ROUNDDOWN: [1, 2],
+  INT: [1, 1],
+  MOD: [2, 2],
+  SQRT: [1, 1],
+  POWER: [2, 2],
+  EXP: [1, 1],
+  LN: [1, 1],
+  SUM: [1, MANY],
+  AVERAGE: [1, MANY],
+  COUNT: [1, MANY],
+  COUNTA: [1, MANY],
+  MIN: [1, MANY],
+  MAX: [1, MANY],
   IF: [2, 3],
+  AND: [1, MANY],
+  OR: [1, MANY],
+  NOT: [1, 1],
+  IFERROR: [2, 2],
+  ISBLANK: [1, 1],
+  CONCATENATE: [1, MANY],
+  LEFT: [1, 2],
+  RIGHT: [1, 2],
+  MID: [3, 3],
+  LEN: [1, 1],
+  TRIM: [1, 1],
+  UPPER: [1, 1],
+  LOWER: [1, 1],
+  PROPER: [1, 1],
+  VALUE: [1, 1],
+  TEXT: [2, 2],
+  TODAY: [0, 0],
+  YEAR: [1, 1],
+  MONTH: [1, 1],
+  DAY: [1, 1],
+  DAYS: [2, 2],
 };
 
+/** Excel spells it CONCAT in modern versions; both names, one function. */
+const FN_ALIASES: Record<string, FormulaFn> = { CONCAT: "CONCATENATE" };
+
 export type ParseResult =
   | { ok: true; ast: FormulaAst; refs: string[] }
   | { ok: false; error: string };
 
 type Token =
   | { t: "num"; v: number }
+  | { t: "str"; v: string }
   | { t: "ref"; k: string }
   | { t: "ident"; v: string }
   | { t: "op"; v: string };
@@ -97,6 +153,27 @@ function tokenize(src: string): Token[] | string {
       i = end + 1;
       continue;
     }
+    // "string" — Excel's own escape: "" inside a string is one quote
+    if (c === '"') {
+      let j = i + 1;
+      let s = "";
+      for (;;) {
+        if (j >= src.length) return "a text value is missing its closing quote";
+        if (src[j] === '"') {
+          if (src[j + 1] === '"') {
+            s += '"';
+            j += 2;
+            continue;
+          }
+          break;
+        }
+        s += src[j];
+        j += 1;
+      }
+      out.push({ t: "str", v: s });
+      i = j + 1;
+      continue;
+    }
     // number: 1  1.5  .5   (a trailing dot — "5." — is refused)
     if (/[0-9]/.test(c) || (c === "." && /[0-9]/.test(src[i + 1] ?? ""))) {
       const m = /^(?:[0-9]+(?:\.[0-9]+)?|\.[0-9]+)/.exec(src.slice(i));
@@ -107,21 +184,21 @@ function tokenize(src: string): Token[] | string {
       i += m[0].length;
       continue;
     }
-    // function names
+    // function names / TRUE / FALSE
     if (/[A-Za-z_]/.test(c)) {
       const m = /^[A-Za-z_][A-Za-z0-9_]*/.exec(src.slice(i))!;
       out.push({ t: "ident", v: m[0] });
       i += m[0].length;
       continue;
     }
-    // operators — two-char first
+    // operators — two-char first. `<>` is Excel's not-equal; `==` tolerated as `=`.
     const two = src.slice(i, i + 2);
-    if (two === "<=" || two === ">=" || two === "!=" || two === "==") {
-      out.push({ t: "op", v: two === "==" ? "=" : two });
+    if (two === "<=" || two === ">=" || two === "!=" || two === "==" || two === "<>") {
+      out.push({ t: "op", v: two === "==" ? "=" : two === "<>" ? "!=" : two });
       i += 2;
       continue;
     }
-    if ("+-*/(),<>=".includes(c)) {
+    if ("+-*/^&(),<>=".includes(c)) {
       out.push({ t: "op", v: c });
       i += 1;
       continue;
@@ -133,11 +210,14 @@ function tokenize(src: string): Token[] | string {
 
 /**
  * Recursive-descent parser. Grammar, lowest binding first:
- *   expr    := additive ((< <= > >= = !=) additive)?     -- ONE comparison, no chains
+ *   expr    := concat ((< <= > >= = !=) concat)?     -- ONE comparison, no chains
+ *   concat  := additive (& additive)*                -- Excel: & binds below + -
  *   additive:= mult ((+|-) mult)*
- *   mult    := unary ((*|/) unary)*
+ *   mult    := power ((*|/) power)*
+ *   power   := unary (^ power)?                      -- right-assoc; unary minus
+ *                                                       inside, so -2^2 = (-2)^2
  *   unary   := "-" unary | primary
- *   primary := number | ref | "(" expr ")" | FN "(" expr ("," expr)* ")"
+ *   primary := number | string | TRUE | FALSE | ref | "(" expr ")" | FN "(" … ")"
  */
 export function parseFormula(src: string): ParseResult {
   if (typeof src !== "string" || src.trim() === "")
@@ -164,12 +244,12 @@ export function parseFormula(src: string): ParseResult {
 
   function parseExpr(depth: number): FormulaAst | null {
     if (depth > MAX_FORMULA_DEPTH) return fail("formula is nested too deeply");
-    const left = parseAdditive(depth);
+    const left = parseConcat(depth);
     if (!left) return null;
     const t = peek();
     if (t?.t === "op" && CMP_OPS.has(t.v)) {
       pos += 1;
-      const right = parseAdditive(depth);
+      const right = parseConcat(depth);
       if (!right) return null;
       const again = peek();
       if (again?.t === "op" && CMP_OPS.has(again.v))
@@ -179,6 +259,18 @@ export function parseFormula(src: string): ParseResult {
     return left;
   }
 
+  function parseConcat(depth: number): FormulaAst | null {
+    let node = parseAdditive(depth);
+    if (!node) return null;
+    while (isOp("&")) {
+      pos += 1;
+      const r = parseAdditive(depth);
+      if (!r) return null;
+      node = { t: "bin", op: "&", l: node, r };
+    }
+    return node;
+  }
+
   function parseAdditive(depth: number): FormulaAst | null {
     let node = parseMult(depth);
     if (!node) return null;
@@ -194,19 +286,32 @@ export function parseFormula(src: string): ParseResult {
   }
 
   function parseMult(depth: number): FormulaAst | null {
-    let node = parseUnary(depth);
+    let node = parsePower(depth);
     if (!node) return null;
     for (;;) {
       if (isOp("*") || isOp("/")) {
         const op = (peek() as { v: "*" | "/" }).v;
         pos += 1;
-        const r = parseUnary(depth);
+        const r = parsePower(depth);
         if (!r) return null;
         node = { t: "bin", op, l: node, r };
       } else return node;
     }
   }
 
+  function parsePower(depth: number): FormulaAst | null {
+    if (depth > MAX_FORMULA_DEPTH) return fail("formula is nested too deeply");
+    const base = parseUnary(depth);
+    if (!base) return null;
+    if (isOp("^")) {
+      pos += 1;
+      const exp = parsePower(depth + 1); // right-associative: 2^3^2 = 2^(3^2)
+      if (!exp) return null;
+      return { t: "bin", op: "^", l: base, r: exp };
+    }
+    return base;
+  }
+
   function parseUnary(depth: number): FormulaAst | null {
     if (depth > MAX_FORMULA_DEPTH) return fail("formula is nested too deeply");
     if (isOp("-")) {
@@ -225,6 +330,10 @@ export function parseFormula(src: string): ParseResult {
       pos += 1;
       return { t: "num", v: t.v };
     }
+    if (t.t === "str") {
+      pos += 1;
+      return { t: "str", v: t.v };
+    }
     if (t.t === "ref") {
       pos += 1;
       return { t: "ref", k: t.k };
@@ -238,9 +347,14 @@ export function parseFormula(src: string): ParseResult {
       return inner;
     }
     if (t.t === "ident") {
-      const fn = t.v.toUpperCase() as FormulaFn;
+      const upper = t.v.toUpperCase();
+      if (upper === "TRUE" || upper === "FALSE") {
+        pos += 1;
+        return { t: "bool", v: upper === "TRUE" };
+      }
+      const fn = (FN_ALIASES[upper] ?? upper) as FormulaFn;
       if (!(fn in FN_ARITY))
-        return fail(`unknown function ${t.v.toUpperCase()} — use ABS, ROUND, MIN, MAX or IF`);
+        return fail(`unknown function ${upper} — see the formula help for what is available`);
       pos += 1;
       if (!isOp("(")) return fail(`${fn} must be called with parentheses: ${fn}(…)`);
       pos += 1;
@@ -277,7 +391,7 @@ export function parseFormula(src: string): ParseResult {
     const t = toks[pos];
     return {
       ok: false,
-      error: `unexpected "${t.t === "op" || t.t === "ident" ? (t as { v: string }).v : t.t === "ref" ? `{${(t as { k: string }).k}}` : String((t as { v: number }).v)}" after the formula`,
+      error: `unexpected "${t.t === "op" || t.t === "ident" ? (t as { v: string }).v : t.t === "ref" ? `{${(t as { k: string }).k}}` : String((t as { v: unknown }).v)}" after the formula`,
     };
   }
   return { ok: true, ast, refs: collectRefs(ast) };
@@ -310,8 +424,15 @@ export function collectRefs(ast: FormulaAst): string[] {
   return out;
 }
 
-/** number | boolean | null inside the tree; the CELL result is number | null. */
-type Value = number | boolean | null;
+/** number | string | boolean | null inside the tree; the CELL result is
+ *  number | string | null (booleans display as "TRUE"/"FALSE"). */
+type Value = number | string | boolean | null;
+
+/** What TODAY() and friends resolve against. `today` is the TENANT's day
+ *  (payload `today`), never the browser clock. */
+export interface FormulaEnv {
+  today?: string;
+}
 
 /**
  * A cell value coerced for arithmetic. Strict on purpose:
@@ -334,10 +455,27 @@ export function toOperand(raw: unknown): number | null {
 }
 
 function asNumber(v: Value): number | null {
-  return typeof v === "number" && Number.isFinite(v) ? v : null;
+  if (typeof v === "number" && Number.isFinite(v)) return v;
+  if (typeof v === "string") return toOperand(v);
+  return null;
+}
+
+/** Text context: blank -> "" (Excel), numbers in General format, booleans as
+ *  their names. Text is display, not arithmetic — "" states nothing false. */
+function asText(v: Value): string {
+  if (v == null) return "";
+  if (typeof v === "string") return v;
+  if (typeof v === "boolean") return v ? "TRUE" : "FALSE";
+  return numToText(v);
+}
+
+/** Excel's "General": no separators, no trailing zeros, up to ~10 dp. */
+function numToText(n: number): string {
+  if (Number.isInteger(n)) return String(n);
+  return String(Number(n.toFixed(10)));
 }
 
-/** Airtable's ROUND: half away from zero, precision may be negative (tens). */
+/** Airtable/Excel ROUND: half away from zero, precision may be negative (tens). */
 function roundHalfAway(x: number, p: number): number | null {
   if (!Number.isInteger(p) || p < -10 || p > 10) return null;
   const m = Math.pow(10, p);
@@ -346,20 +484,87 @@ function roundHalfAway(x: number, p: number): number | null {
   return Number.isFinite(out) ? out : null;
 }
 
-function evalNode(n: FormulaAst, get: (key: string) => unknown): Value {
+/** An ISO date's parts, or null. Accepts "YYYY-MM-DD" and anything that starts
+ *  with it ("YYYY-MM-DD HH:MM:SS") — the shapes the grid's date fields hold. */
+function dateParts(v: Value): { y: number; m: number; d: number } | null {
+  if (typeof v !== "string") return null;
+  const m = /^(\d{4})-(\d{2})-(\d{2})/.exec(v.trim());
+  if (!m) return null;
+  const y = Number(m[1]);
+  const mo = Number(m[2]);
+  const d = Number(m[3]);
+  if (mo < 1 || mo > 12 || d < 1 || d > 31) return null;
+  return { y, m: mo, d };
+}
+
+function dateSerial(p: { y: number; m: number; d: number }): number {
+  return Date.UTC(p.y, p.m - 1, p.d) / 86_400_000;
+}
+
+/**
+ * TEXT(value, format) — the common Excel number formats, fail-closed:
+ *   "0"  "0.00"        fixed decimals
+ *   "#,##0"  "#,##0.00" thousands separators
+ *   "$#,##0.00" …      a literal currency prefix
+ *   "0%"  "0.0%"       percent of 1 (0.42 -> "42%")
+ * An unrecognised format is BLANK, never a guess at what it meant.
+ */
+function textFormat(n: number, fmt: string): string | null {
+  const m = /^(\$?)(#,##0|0)(?:\.(0+))?(%?)$/.exec(fmt.trim());
+  if (!m) return null;
+  const [, cur, intPart, decimals, pct] = m;
+  let x = n;
+  if (pct === "%") x *= 100;
+  const dp = decimals ? decimals.length : 0;
+  const neg = x < 0 || Object.is(x, -0) ? "-" : "";
+  const fixed = Math.abs(x).toFixed(dp);
+  let [ints, frac] = fixed.split(".");
+  if (intPart === "#,##0") ints = ints.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+  return neg + cur + ints + (dp ? "." + frac : "") + (pct === "%" ? "%" : "");
+}
+
+/** The aggregate forms: Excel-style, blanks SKIPPED (that selectivity is why
+ *  they exist beside `+`). Returns the numeric args that resolved. */
+function numericArgs(nodes: FormulaAst[], ev: (n: FormulaAst) => Value): number[] {
+  const out: number[] = [];
+  for (const a of nodes) {
+    const v = ev(a);
+    if (v == null) continue;
+    const n = asNumber(v);
+    if (n != null) out.push(n);
+  }
+  return out;
+}
+
+function evalNode(n: FormulaAst, get: (key: string) => unknown, env: FormulaEnv): Value {
+  const ev = (x: FormulaAst): Value => evalNode(x, get, env);
   switch (n.t) {
     case "num":
       return n.v;
-    case "ref":
-      return toOperand(get(n.k));
+    case "str":
+      return n.v;
+    case "bool":
+      return n.v;
+    case "ref": {
+      const raw = get(n.k);
+      // Text stays text (LEFT/&/comparisons need it); numbers stay numbers.
+      if (typeof raw === "string") return raw;
+      if (typeof raw === "number") return Number.isFinite(raw) ? raw : null;
+      if (typeof raw === "boolean") return null; // a checkbox is not a value here
+      return null;
+    }
     case "neg": {
-      const v = asNumber(evalNode(n.e, get));
+      const v = asNumber(ev(n.e));
       return v == null ? null : -v;
     }
     case "bin": {
-      const l = asNumber(evalNode(n.l, get));
+      if (n.op === "&") {
+        // Concatenation is TEXT context: blanks become "", nothing errors.
+        return asText(ev(n.l)) + asText(ev(n.r));
+      }
+      const l = asNumber(ev(n.l));
       if (l == null) return null;
-      const r = asNumber(evalNode(n.r, get));
+      const r = asNumber(ev(n.r));
       if (r == null) return null;
       let out: number;
       switch (n.op) {
@@ -370,54 +575,196 @@ function evalNode(n: FormulaAst, get: (key: string) => unknown): Value {
           if (r === 0) return null;
           out = l / r;
           break;
+        case "^":
+          out = Math.pow(l, r);
+          break;
       }
       return Number.isFinite(out) ? out : null;
     }
     case "cmp": {
-      const l = asNumber(evalNode(n.l, get));
-      if (l == null) return null;
-      const r = asNumber(evalNode(n.r, get));
-      if (r == null) return null;
-      switch (n.op) {
-        case "<": return l < r;
-        case "<=": return l <= r;
-        case ">": return l > r;
-        case ">=": return l >= r;
-        case "=": return l === r;
-        case "!=": return l !== r;
+      const lv = ev(n.l);
+      const rv = ev(n.r);
+      const ln = typeof lv === "number" ? lv : null;
+      const rn = typeof rv === "number" ? rv : null;
+      // numbers with numbers (numeric strings count as numbers, Excel's coercion)…
+      const lAsN = ln ?? (typeof lv === "string" ? toOperand(lv) : null);
+      const rAsN = rn ?? (typeof rv === "string" ? toOperand(rv) : null);
+      if (lAsN != null && rAsN != null) return cmpNums(n.op, lAsN, rAsN);
+      // …text with text, case-insensitively (Excel's rule)…
+      if (typeof lv === "string" && typeof rv === "string") {
+        const a = lv.trim().toLowerCase();
+        const b = rv.trim().toLowerCase();
+        if (a === "" || b === "") return null; // a blank comparison is not an answer
+        return cmpNums(n.op, a < b ? -1 : a > b ? 1 : 0, 0);
       }
+      // …anything mixed or blank is BLANK, never a guess.
       return null;
     }
     case "call": {
       switch (n.fn) {
         case "ABS": {
-          const v = asNumber(evalNode(n.args[0], get));
+          const v = asNumber(ev(n.args[0]));
           return v == null ? null : Math.abs(v);
         }
-        case "ROUND": {
-          const v = asNumber(evalNode(n.args[0], get));
+        case "ROUND":
+        case "ROUNDUP":
+        case "ROUNDDOWN": {
+          const v = asNumber(ev(n.args[0]));
           if (v == null) return null;
-          const p = n.args.length > 1 ? asNumber(evalNode(n.args[1], get)) : 0;
-          if (p == null) return null;
-          return roundHalfAway(v, p);
+          const p = n.args.length > 1 ? asNumber(ev(n.args[1])) : 0;
+          if (p == null || !Number.isInteger(p) || p < -10 || p > 10) return null;
+          if (n.fn === "ROUND") return roundHalfAway(v, p);
+          const m = Math.pow(10, p);
+          const scaled = v * m;
+          const r = n.fn === "ROUNDUP"
+            ? Math.sign(scaled) * Math.ceil(Math.abs(scaled))
+            : Math.sign(scaled) * Math.floor(Math.abs(scaled));
+          const out = r / m;
+          return Number.isFinite(out) ? out : null;
         }
-        case "MIN":
-        case "MAX": {
-          const vals: number[] = [];
+        case "INT": {
+          const v = asNumber(ev(n.args[0]));
+          return v == null ? null : Math.floor(v); // Excel INT floors toward -∞
+        }
+        case "MOD": {
+          const a = asNumber(ev(n.args[0]));
+          const b = asNumber(ev(n.args[1]));
+          if (a == null || b == null || b === 0) return null;
+          return a - b * Math.floor(a / b); // Excel: sign follows the divisor
+        }
+        case "SQRT": {
+          const v = asNumber(ev(n.args[0]));
+          return v == null || v < 0 ? null : Math.sqrt(v);
+        }
+        case "POWER": {
+          const a = asNumber(ev(n.args[0]));
+          const b = asNumber(ev(n.args[1]));
+          if (a == null || b == null) return null;
+          const out = Math.pow(a, b);
+          return Number.isFinite(out) ? out : null;
+        }
+        case "EXP": {
+          const v = asNumber(ev(n.args[0]));
+          if (v == null) return null;
+          const out = Math.exp(v);
+          return Number.isFinite(out) ? out : null;
+        }
+        case "LN": {
+          const v = asNumber(ev(n.args[0]));
+          return v == null || v <= 0 ? null : Math.log(v);
+        }
+        case "SUM": {
+          const vals = numericArgs(n.args, ev);
+          return vals.reduce((a, b) => a + b, 0);
+        }
+        case "AVERAGE": {
+          const vals = numericArgs(n.args, ev);
+          return vals.length === 0 ? null : vals.reduce((a, b) => a + b, 0) / vals.length;
+        }
+        case "COUNT":
+          return numericArgs(n.args, ev).length;
+        case "COUNTA": {
+          let c = 0;
           for (const a of n.args) {
-            const v = asNumber(evalNode(a, get));
-            if (v == null) return null; // blanks propagate — see the header
-            vals.push(v);
+            const v = ev(a);
+            if (v != null && v !== "") c += 1;
           }
+          return c;
+        }
+        case "MIN":
+        case "MAX": {
+          const vals = numericArgs(n.args, ev);
+          if (vals.length === 0) return null;
           return n.fn === "MIN" ? Math.min(...vals) : Math.max(...vals);
         }
         case "IF": {
-          const c = evalNode(n.args[0], get);
+          const c = ev(n.args[0]);
           if (typeof c !== "boolean") return null; // no truthiness
           // LAZY: only the taken branch runs — IF({x} = 0, 0, 1/{x}) is the
           // guard pattern this exists for.
-          if (c) return evalNode(n.args[1], get);
-          return n.args.length > 2 ? evalNode(n.args[2], get) : null;
+          if (c) return ev(n.args[1]);
+          return n.args.length > 2 ? ev(n.args[2]) : null;
+        }
+        case "AND":
+        case "OR": {
+          // Strict booleans, evaluated lazily left to right (Excel short-circuits too).
+          for (const a of n.args) {
+            const v = ev(a);
+            if (typeof v !== "boolean") return null;
+            if (n.fn === "AND" && !v) return false;
+            if (n.fn === "OR" && v) return true;
+          }
+          return n.fn === "AND";
+        }
+        case "NOT": {
+          const v = ev(n.args[0]);
+          return typeof v === "boolean" ? !v : null;
+        }
+        case "IFERROR": {
+          // Our errors ARE blanks (the one rule), so IFERROR is the blank-coalesce.
+          const v = ev(n.args[0]);
+          return v == null ? ev(n.args[1]) : v;
+        }
+        case "ISBLANK": {
+          const v = ev(n.args[0]);
+          return v == null || v === "";
+        }
+        case "CONCATENATE":
+          return n.args.map((a) => asText(ev(a))).join("");
+        case "LEFT":
+        case "RIGHT": {
+          const s = asText(ev(n.args[0]));
+          const k = n.args.length > 1 ? asNumber(ev(n.args[1])) : 1;
+          if (k == null || !Number.isInteger(k) || k < 0) return null;
+          return n.fn === "LEFT" ? s.slice(0, k) : k === 0 ? "" : s.slice(-k);
+        }
+        case "MID": {
+          const s = asText(ev(n.args[0]));
+          const start = asNumber(ev(n.args[1]));
+          const len = asNumber(ev(n.args[2]));
+          if (start == null || len == null) return null;
+          if (!Number.isInteger(start) || !Number.isInteger(len) || start < 1 || len < 0)
+            return null; // Excel: MID is 1-based and refuses a 0 start
+          return s.slice(start - 1, start - 1 + len);
+        }
+        case "LEN":
+          return asText(ev(n.args[0])).length;
+        case "TRIM":
+          return asText(ev(n.args[0])).replace(/\s+/g, " ").trim();
+        case "UPPER":
+          return asText(ev(n.args[0])).toUpperCase();
+        case "LOWER":
+          return asText(ev(n.args[0])).toLowerCase();
+        case "PROPER":
+          return asText(ev(n.args[0])).replace(
+            /[A-Za-z]+/g,
+            (w) => w[0].toUpperCase() + w.slice(1).toLowerCase()
+          );
+        case "VALUE": {
+          const v = ev(n.args[0]);
+          return asNumber(v);
+        }
+        case "TEXT": {
+          const v = asNumber(ev(n.args[0]));
+          const fmt = ev(n.args[1]);
+          if (v == null || typeof fmt !== "string") return null;
+          return textFormat(v, fmt);
+        }
+        case "TODAY":
+          return typeof env.today === "string" && dateParts(env.today) ? env.today : null;
+        case "YEAR":
+        case "MONTH":
+        case "DAY": {
+          const p = dateParts(ev(n.args[0]));
+          if (!p) return null;
+          return n.fn === "YEAR" ? p.y : n.fn === "MONTH" ? p.m : p.d;
+        }
+        case "DAYS": {
+          // Excel argument order: DAYS(end, start).
+          const end = dateParts(ev(n.args[0]));
+          const start = dateParts(ev(n.args[1]));
+          if (!end || !start) return null;
+          return Math.round(dateSerial(end) - dateSerial(start));
         }
       }
       return null;
@@ -427,46 +774,115 @@ function evalNode(n: FormulaAst, get: (key: string) => unknown): Value {
   }
 }
 
+function cmpNums(op: "<" | "<=" | ">" | ">=" | "=" | "!=", l: number, r: number): boolean {
+  switch (op) {
+    case "<": return l < r;
+    case "<=": return l <= r;
+    case ">": return l > r;
+    case ">=": return l >= r;
+    case "=": return l === r;
+    case "!=": return l !== r;
+  }
+}
+
 /**
- * Evaluate a parsed formula over one row's values. Returns a FINITE number or
- * null (blank). A boolean result is null — a comparison is a question, not a
- * cell value. NEVER throws, whatever the inputs: the belt around the whole
- * engine, because a cell renderer that throws takes the grid with it.
+ * Evaluate a parsed formula over one row's values. Returns a FINITE number, a
+ * STRING (text results, and booleans as "TRUE"/"FALSE"), or null (blank).
+ * NEVER throws, whatever the inputs: the belt around the whole engine, because
+ * a cell renderer that throws takes the grid with it.
  */
 export function evalFormula(
   ast: FormulaAst,
-  get: (key: string) => unknown
-): number | null {
+  get: (key: string) => unknown,
+  env: FormulaEnv = {}
+): number | string | null {
   try {
-    const v = evalNode(ast, get);
-    return typeof v === "number" && Number.isFinite(v) ? v : null;
+    const v = evalNode(ast, get, env);
+    if (typeof v === "number") return Number.isFinite(v) ? v : null;
+    if (typeof v === "string") return v;
+    if (typeof v === "boolean") return v ? "TRUE" : "FALSE";
+    return null;
   } catch {
     return null;
   }
 }
 
+/**
+ * Dependency order for FORMULA-OVER-FORMULA (2026-07-31). Given every formula
+ * field's source by key, returns the keys in an evaluation order where a
+ * formula runs AFTER the formulas it references, plus the set caught in a
+ * CYCLE — those evaluate to blank (their members never run), never to a stale
+ * or half-updated number. A formula depending on a cyclic one still runs; the
+ * cyclic ref simply reads blank.
+ */
+export function orderFormulas(sources: ReadonlyMap<string, string>): {
+  order: string[];
+  cyclic: Set<string>;
+} {
+  const deps = new Map<string, string[]>();
+  for (const [key, src] of sources) {
+    const p = parseFormula(src);
+    deps.set(key, p.ok ? p.refs.filter((r) => sources.has(r) && r !== key) : []);
+  }
+  const order: string[] = [];
+  const state = new Map<string, 0 | 1 | 2>(); // 0 visiting-guard absent, 1 = on stack, 2 = done
+  const cyclic = new Set<string>();
+  const visit = (key: string, stack: string[]): boolean => {
+    const s = state.get(key);
+    if (s === 2) return !cyclic.has(key);
+    if (s === 1) {
+      // Everything from the first appearance of `key` on the stack is the cycle.
+      for (let i = stack.lastIndexOf(key); i < stack.length; i += 1) cyclic.add(stack[i]);
+      return false;
+    }
+    state.set(key, 1);
+    stack.push(key);
+    for (const d of deps.get(key) ?? []) visit(d, stack);
+    stack.pop();
+    state.set(key, 2);
+    if (!cyclic.has(key)) order.push(key);
+    return !cyclic.has(key);
+  };
+  for (const key of sources.keys()) visit(key, []);
+  return { order, cyclic };
+}
+
 /**
  * Create-form validation: parse + check every ref against the fields that
- * exist. `formulaKeys` are refused outright — the evaluator reads RAW row
- * values, so a formula-over-formula would silently be blank; saying so at
- * authoring time is the honest version of that constraint.
+ * exist. Referencing ANOTHER formula is allowed (evaluation is topological);
+ * what is refused is a CYCLE — including the self-reference, its smallest
+ * case. `formulaSources` carries every formula field's source so the check
+ * can walk the graph; `selfKey` names the field being edited (absent on
+ * create, where no cycle is possible yet).
  */
 export function validateFormula(
   src: string,
   knownKeys: ReadonlySet<string>,
-  formulaKeys: ReadonlySet<string>
+  formulaSources: ReadonlyMap<string, string>,
+  selfKey?: string
 ): { ok: boolean; error?: string; refs: string[] } {
   const parsed = parseFormula(src);
   if (!parsed.ok) return { ok: false, error: parsed.error, refs: [] };
   for (const k of parsed.refs) {
-    if (formulaKeys.has(k))
+    if (!knownKeys.has(k) && !formulaSources.has(k))
+      return { ok: false, error: `{${k}} is not a field of this table`, refs: parsed.refs };
+    if (selfKey && k === selfKey)
       return {
         ok: false,
-        error: `{${k}} is another formula field — formulas may only reference data fields`,
+        error: "a formula cannot reference itself",
+        refs: parsed.refs,
+      };
+  }
+  if (selfKey) {
+    const all = new Map(formulaSources);
+    all.set(selfKey, src);
+    const { cyclic } = orderFormulas(all);
+    if (cyclic.has(selfKey))
+      return {
+        ok: false,
+        error: "this formula would create a loop between formulas",
         refs: parsed.refs,
       };
-    if (!knownKeys.has(k))
-      return { ok: false, error: `{${k}} is not a field of this table`, refs: parsed.refs };
   }
   return { ok: true, refs: parsed.refs };
 }

web/src/customer-grid/types.ts

@@ -1241,6 +1241,19 @@ export interface GridWorkspace {
    * everything created is global, exactly today's behavior.
    */
   scopeChoice?: boolean;
+  /**
+   * 2026-07-31 (owner item 1) — the STANDALONE measure channel. The embed receives these as
+   * top-level render args; over HTTP they ride `/api/v1/workspace` (re-read after every
+   * durable write), and `useCustomerData` lifts them into the payload slots the grid already
+   * reads. `derived` is keyed by String(pid) — JSON object keys — and carries the cohort
+   * column + measure-column cells to merge over the rows.
+   */
+  measures?: Measure[];
+  measureSets?: Record<string, number[]>;
+  derived?: Record<string, Record<string, string | number | null>>;
+  viewer?: Viewer;
+  userOptions?: string[];
+  overlays?: Record<string, Record<string, string>>;
 }
 
 /**
@@ -1361,6 +1374,9 @@ export function tableMode(counts: ScopeCounts | undefined): TableMode {
 
 export type HostEvent =
   | { id: string; type: "view_upsert"; view: SavedView }
+  /** Owner item 3 (2026-07-31): the user OPENED this view — presentation state the host
+   *  remembers so a fresh browser resumes there. Never a re-render; never authorisation. */
+  | { id: string; type: "view_select"; viewId: string }
   /**
    * "Add to list" (owner item 6, 2026-07-26): push the customers a VIEW currently matches into
    * a Cohort — a fixed, hand-curated set that does NOT re-populate as the data moves.

web/src/customer-grid/useCustomerData.ts

@@ -24,7 +24,7 @@
 
 import { useCallback, useEffect, useRef, useState } from "react";
 import type { Dispatch, SetStateAction } from "react";
-import type { CustomersPayload, Field, Row } from "./types";
+import type { CustomersPayload, Field, GridWorkspace, Row } from "./types";
 import { fetchCustomers, fetchWorkspace, patchCustomer, setSurfaceScope } from "./apiBridge";
 import { WORKSPACE_STALE_EVENT } from "../apiContract";
 import type { SurfaceScope } from "./apiBridge";
@@ -53,6 +53,30 @@ function readHostPayload(): CustomersPayload | null {
     : null;
 }
 
+/**
+ * 2026-07-31 (owner item 1) — the STANDALONE measure channel. In the embed the host passes
+ * `measures`/`measureSets`/`viewer`/`userOptions` as top-level payload keys and merges derived
+ * cells (cohort column + measure columns) into the rows before render. Over HTTP those ride
+ * `/api/v1/workspace` — the cheap call a durable write re-reads — so this lift is what makes
+ * a measure column populate, a measure condition resolve, and the assignee picker fill,
+ * without refetching the heavy pool. `derived` is keyed by String(pid) (JSON object keys).
+ */
+function withWorkspace(payload: CustomersPayload, ws: GridWorkspace): CustomersPayload {
+  const out: CustomersPayload = { ...payload, workspace: ws };
+  if (Array.isArray(ws.measures)) out.measures = ws.measures;
+  if (ws.measureSets && typeof ws.measureSets === "object") out.measureSets = ws.measureSets;
+  if (ws.viewer && typeof ws.viewer.name === "string") out.viewer = ws.viewer;
+  if (Array.isArray(ws.userOptions)) out.userOptions = ws.userOptions;
+  const derived = ws.derived;
+  if (derived && typeof derived === "object" && Object.keys(derived).length > 0) {
+    out.rows = payload.rows.map((r) => {
+      const cells = derived[String(r.pid)];
+      return cells ? { ...r, ...cells } : r;
+    });
+  }
+  return out;
+}
+
 function readInitialPayload(): CustomersPayload | null {
   return readHostPayload() ?? readEmbed();
 }
@@ -186,7 +210,7 @@ export function useCustomerData(scope: SurfaceScope = "customer"): CustomerData
     async function load() {
       const [payload, workspace] = await Promise.all([fetchCustomers(), fetchWorkspace(scope)]);
       if (cancelled || !payload) return;
-      setData(workspace ? { ...payload, workspace } : payload);
+      setData(workspace ? withWorkspace(payload, workspace) : payload);
     }
 
     load();
@@ -195,11 +219,13 @@ export function useCustomerData(scope: SurfaceScope = "customer"): CustomerData
     // left panel agrees with what the user just did. Only the WORKSPACE is re-read,
     // never `/customers`: the rows come from a 15-minute-cached Odoo pull and no grid
     // event can change an Odoo column (it is read-only), so refetching them would buy
-    // nothing and cost the expensive call.
+    // nothing and cost the expensive call. The measure channel rides the workspace
+    // (see `withWorkspace`), so a NEW measure column's values arrive on this cheap
+    // re-read too — no pool refetch.
     async function reread() {
       const ws = await fetchWorkspace(scope);
       if (cancelled || !ws) return;      // absent stays absent — never blank a live panel
-      setData((prev) => (prev ? { ...prev, workspace: ws } : prev));
+      setData((prev) => (prev ? withWorkspace(prev, ws) : prev));
     }
     const onStale = () => { void reread(); };
     if (typeof window !== "undefined") window.addEventListener(WORKSPACE_STALE_EVENT, onStale);

web/src/customer-grid/useGridSelection.ts

@@ -29,6 +29,12 @@ export interface GridSelectionApi {
    *  "N selected · Add to cohort" bar serves the map with no second selection
    *  model and no second cohort picker to keep in sync. */
   selectPids: (pids: number[], mode: "replace" | "add") => void;
+  /** Owner item 6 (2026-07-31) — clicking the identity cell ticks the row's checkbox: one
+   *  pid in or out of the same pid-anchored set the markers write. */
+  togglePid: (pid: number) => void;
+  /** Owner item 5 (2026-07-31) — Excel-grade Enter navigation: set the ACTIVE cell
+   *  programmatically (clamped by the caller). Positional and ephemeral, like `current`. */
+  setActiveCell: (col: number, row: number) => void;
   clearSelection: () => void;
 }
 
@@ -89,10 +95,28 @@ export function useGridSelection(
     });
   }, []);
 
+  const togglePid = useCallback((pid: number) => {
+    setSelectedPids((prev) => {
+      const next = new Set(prev);
+      if (next.has(pid)) next.delete(pid);
+      else next.add(pid);
+      return next;
+    });
+  }, []);
+
+  const setActiveCell = useCallback((col: number, row: number) => {
+    setCurrent({
+      cell: [col, row],
+      range: { x: col, y: row, width: 1, height: 1 },
+      rangeStack: [],
+    });
+  }, []);
+
   const clearSelection = useCallback(() => {
     setSelectedPids(new Set());
     setCurrent(undefined);
   }, []);
 
-  return { gridSelection, selectedPids, onGridSelectionChange, selectPids, clearSelection };
+  return { gridSelection, selectedPids, onGridSelectionChange, selectPids, togglePid,
+           setActiveCell, clearSelection };
 }

web/src/index.css

@@ -102,6 +102,11 @@
   --lp-r-md: 6px;             /* buttons, cards — the NEW default (was 4px)  */
   --lp-r-lg: 10px;            /* dialogs, panels                            */
   --lp-r-pill: 999px;
+  /* Owner item 12 (2026-07-31): ONE width for both rails — the shell navigation and the
+     views rail are the two halves of one chrome, and asymmetry read as unfinished. The
+     collapsed strip is the item-11 minimize target (both rails fold to it). */
+  --lp-rail-w: 240px;
+  --lp-rail-min: 48px;
   --lp-surface: #ffffff;
   --lp-surface-2: #f7f7f6;    /* warm-neutral; was #f4f6f9 (cool)           */
 
@@ -215,18 +220,173 @@ body {
   font-size: var(--lp-fs-sm);
 }
 
-/* Saved-view rail */
+/* Saved-view rail — the SECOND navigation bar (owner items 10/11/12, 2026-07-31): same
+   width as the shell nav, same white surface, same fold-to-strip minimize. */
 .cg-views {
-  flex: 0 0 188px;
-  width: 188px;
-  min-width: 188px;
+  flex: 0 0 var(--lp-rail-w);
+  width: var(--lp-rail-w);
+  min-width: var(--lp-rail-w);
   height: 100%;
-  padding: 10px 8px;
+  padding: 6px 8px 10px;
   border-right: 1px solid var(--lp-line);
-  background: var(--cg-panel);
+  background: var(--lp-surface);
   color: var(--cg-text);
   user-select: none;
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
+}
+.cg-views.is-collapsed {
+  flex-basis: var(--lp-rail-min);
+  width: var(--lp-rail-min);
+  min-width: var(--lp-rail-min);
+  padding: 6px 6px 10px;
+}
+.cg-views.is-collapsed > :not(.cg-views-top) {
+  display: none;
+}
+.cg-views-top {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  padding: 0 0 2px;
+}
+.cg-rail-toggle {
+  width: 28px;
+  height: 28px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: none;
+  border-radius: var(--lp-r-md);
+  background: transparent;
+  color: var(--lp-muted);
+  cursor: pointer;
+}
+.cg-rail-toggle:hover {
+  background: var(--lp-surface-2);
+  color: var(--lp-ink);
+}
+.cg-rail-toggle:focus-visible {
+  outline: 2px solid var(--lp-blue-deep);
+  outline-offset: 1px;
+}
+/* Owner item 9 — "Find a view": borderless on the white rail; the outline appears only on
+   focus, and it is the brand purple by the owner's explicit ask. The 8-state discipline
+   holds — no border at rest means no border-width change on focus; state is the outline. */
+.cg-find-view {
+  position: relative;
+  margin: 0 2px 6px;
+}
+.cg-find-view-icon {
+  position: absolute;
+  left: 8px;
+  top: 50%;
+  transform: translateY(-50%);
+  color: var(--lp-muted);
+  pointer-events: none;
+}
+.cg-find-view input {
+  width: 100%;
+  height: 28px;
+  padding: 0 8px 0 28px;
+  border: none;
+  border-radius: var(--lp-r-md);
+  background: transparent;
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+}
+.cg-find-view input::placeholder {
+  color: var(--lp-muted);
+}
+.cg-find-view input:focus-visible {
+  outline: 2px solid var(--lp-purple-deep);
+  outline-offset: -1px;
+}
+.cg-views-scroll {
+  flex: 1 1 auto;
+  min-height: 0;
+  overflow-y: auto;
+}
+
+/* Owner item 8 — the create pane's field-type picker: a find box over an icon listbox.
+   The rows reuse the type marks the column headers already wear (FieldTypeIcon). */
+.cg-type-block { display: flex; flex-direction: column; gap: 4px; }
+.cg-type-title { font-size: var(--lp-fs-2xs); color: var(--lp-muted); }
+.cg-type-picker {
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  overflow: hidden;
+  background: var(--lp-surface);
+}
+.cg-type-search {
+  position: relative;
+  border-bottom: 1px solid var(--lp-line);
+}
+.cg-type-search svg {
+  position: absolute;
+  left: 8px;
+  top: 50%;
+  transform: translateY(-50%);
+  color: var(--lp-muted);
+  pointer-events: none;
+}
+.cg-type-search input {
+  width: 100%;
+  height: 30px;
+  border: none;
+  background: transparent;
+  padding: 0 8px 0 27px;
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  color: var(--lp-ink);
+}
+.cg-type-search input::placeholder { color: var(--lp-muted); }
+.cg-type-search input:focus-visible {
+  outline: 2px solid var(--lp-purple-deep);
+  outline-offset: -2px;
+  border-radius: var(--lp-r-sm);
+}
+.cg-type-list {
+  max-height: 218px;
+  overflow-y: auto;
+  padding: 4px;
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+}
+.cg-type-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  width: 100%;
+  min-height: 30px;
+  padding: 4px 8px;
+  border: none;
+  border-radius: var(--lp-r-sm);
+  background: transparent;
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  text-align: left;
+  cursor: pointer;
+}
+.cg-type-row:hover { background: var(--lp-surface-2); }
+.cg-type-row.is-on { background: var(--lp-blue-tint); font-weight: 600; }
+.cg-type-row:focus-visible {
+  outline: 2px solid var(--lp-blue-deep);
+  outline-offset: -2px;
+}
+.cg-type-row .cg-type-icon { color: var(--lp-muted); flex: 0 0 auto; }
+.cg-type-row.is-on .cg-type-icon { color: var(--lp-blue-deep); }
+.cg-type-label {
+  flex: 1 1 auto;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
 }
+.cg-type-check { color: var(--lp-blue-deep); flex: 0 0 auto; }
 .cg-views-head {
   min-height: 44px;
   display: flex;
@@ -281,7 +441,7 @@ body {
   border-radius: var(--lp-r-md);
 }
 .cg-view-row:hover {
-  background: #eef1f4;
+  background: var(--lp-surface-2);
 }
 .cg-view-row.is-active {
   background: var(--lp-blue-tint);
@@ -2096,11 +2256,72 @@ body {
 .shell-side {
   display: flex;
   flex-direction: column;
-  width: 254px;
-  flex: 0 0 254px;
+  width: var(--lp-rail-w);
+  flex: 0 0 var(--lp-rail-w);
   background: var(--lp-surface);
   border-right: 1px solid var(--lp-line);
   overflow-y: auto;
+  overflow-x: hidden;
+}
+
+/* Owner item 11 — the minimize control lives in the rail head, beside the brand. Collapsed,
+   the rail is the slim strip: mark, toggle, icons, avatar — labels and badges go, widths come
+   from the shared tokens so both rails fold identically. */
+.shell-side-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding-right: 10px;
+}
+.shell-rail-toggle {
+  width: 28px;
+  height: 28px;
+  flex: 0 0 28px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: none;
+  border-radius: var(--lp-r-md);
+  background: transparent;
+  color: var(--lp-muted);
+  cursor: pointer;
+}
+.shell-rail-toggle:hover {
+  background: var(--lp-surface-2);
+  color: var(--lp-ink);
+}
+.shell-rail-toggle:focus-visible {
+  outline: 2px solid var(--lp-blue-deep);
+  outline-offset: 1px;
+}
+.shell-side.is-collapsed {
+  width: var(--lp-rail-min);
+  flex-basis: var(--lp-rail-min);
+}
+.shell-side.is-collapsed .shell-side-head {
+  flex-direction: column;
+  gap: 6px;
+  padding: 12px 0 4px;
+}
+.shell-side.is-collapsed .shell-brand { padding: 0; }
+.shell-side.is-collapsed .lp-wordmark,
+.shell-side.is-collapsed .shell-nav-label,
+.shell-side.is-collapsed .shell-nav-badge,
+.shell-side.is-collapsed .shell-nav-open,
+.shell-side.is-collapsed .shell-nav-group,
+.shell-side.is-collapsed .shell-account-who,
+.shell-side.is-collapsed .shell-account-dots {
+  display: none;
+}
+.shell-side.is-collapsed .shell-nav { padding: 0 6px; }
+.shell-side.is-collapsed .shell-nav-item {
+  justify-content: center;
+  padding: 7px 0;
+}
+.shell-side.is-collapsed .shell-nav-item.is-child { padding-left: 0; }
+.shell-side.is-collapsed .shell-account {
+  justify-content: center;
+  padding: 8px 0;
 }
 
 .shell-brand { display: flex; align-items: center; gap: 9px; padding: 18px 16px 14px; }
@@ -3406,13 +3627,15 @@ a.cg-map-ctl-b { text-decoration: none; }
 /* I14 — the two create doors, stacked and LEFT-ALIGNED (the owner's word). `.cg-link-btn`
    is a <button>, so it centres its label by default; every other use of that class sits in
    a centred footer, which is why the alignment is set here and not on the shared class. */
-.cg-create-new { padding: 2px 8px 2px; }
+/* Owner item 9 (2026-07-31): the create row is a QUIET affordance, not a headline — regular
+   weight, flush-left with the search and the view names under it. */
+.cg-create-new { padding: 2px 2px 0; }
 .cg-create-btn {
   width: 100%;
   text-align: left;
-  padding: 0 6px;
+  padding: 0 8px;
   color: var(--lp-ink);
-  font-weight: 550;
+  font-weight: 400;
 }
 /* Wave-10 item 13 — the trigger stays HELD while its flyout is open. Driven off the
    `aria-expanded` the button already publishes, so the visual state cannot drift from the

web/src/shell/Shell.tsx

@@ -34,7 +34,7 @@ import { useCallback, useEffect, useRef, useState } from "react";
 import CustomerGrid from "../customer-grid/CustomerGrid";
 import { clearCustomersCache } from "../customer-grid/apiBridge";
 import { OverlayProvider } from "../customer-grid/OverlaySurface";
-import { DATA_ERROR_EVENT, TOAST_EVENT, UNAUTHORIZED_EVENT } from "../apiContract";
+import { DATA_ERROR_EVENT, NAV_MINIMIZE_EVENT, TOAST_EVENT, UNAUTHORIZED_EVENT } from "../apiContract";
 import { PageSurface } from "../pages/PageSurface";
 import { SettingsModal } from "../settings/SettingsModal";
 import type { SettingsSection } from "../settings/SettingsModal";
@@ -141,6 +141,21 @@ function DotsIcon() {
   );
 }
 
+/** Owner item 11 — the rail toggle: three horizontal bars. One glyph for both rails (the
+ *  views rail draws the same geometry), so "minimize a panel" reads as one idea. */
+function RailToggleIcon() {
+  return (
+    <svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true">
+      <path
+        d="M2.5 4.4h11M2.5 8h11M2.5 11.6h11"
+        stroke="currentColor"
+        strokeWidth="1.35"
+        strokeLinecap="round"
+      />
+    </svg>
+  );
+}
+
 /**
  * The account corner: ONE line (monogram + name + role, the host's
  * `_account_css` card) that opens a small menu, instead of three buttons
@@ -276,22 +291,42 @@ export default function Shell() {
   // "Users" are one component reached two ways rather than two dialogs.
   const [settings, setSettings] = useState<SettingsSection | null>(null);
   const route = useHashRoute();
+  // Owner items 10/11 — the navigation folds to a slim strip: by the toggle in the rail head,
+  // or automatically when the user clicks into the work surface (NAV_MINIMIZE_EVENT from the
+  // grid). Remembered per browser; expanding is always one click on the same toggle.
+  const [navCollapsed, setNavCollapsed] = useState<boolean>(() => {
+    try {
+      return localStorage.getItem("aios-nav-collapsed") === "1";
+    } catch {
+      return false;
+    }
+  });
+  useEffect(() => {
+    try {
+      localStorage.setItem("aios-nav-collapsed", navCollapsed ? "1" : "0");
+    } catch {
+      // storage can be blocked; the toggle still works for the session
+    }
+  }, [navCollapsed]);
 
-  // The three signals the data layer raises on the window (apiContract.ts). It
-  // talks to the frame this way because `customer-grid/**` is host-neutral —
-  // the same tree the Streamlit embed ships — and must not import a shell.
+  // The window signals the data layer raises (apiContract.ts). It talks to the
+  // frame this way because `customer-grid/**` is host-neutral — the same tree
+  // the Streamlit embed ships — and must not import a shell.
   useEffect(() => {
     const onUnauthorized = () => setSession({ phase: "anon" });
     const onDataError = (e: Event) =>
       setDataError(String((e as CustomEvent).detail ?? "") || "The data could not be loaded.");
     const onToast = (e: Event) => setToast(String((e as CustomEvent).detail ?? ""));
+    const onNavMinimize = () => setNavCollapsed(true);
     window.addEventListener(UNAUTHORIZED_EVENT, onUnauthorized);
     window.addEventListener(DATA_ERROR_EVENT, onDataError);
     window.addEventListener(TOAST_EVENT, onToast);
+    window.addEventListener(NAV_MINIMIZE_EVENT, onNavMinimize);
     return () => {
       window.removeEventListener(UNAUTHORIZED_EVENT, onUnauthorized);
       window.removeEventListener(DATA_ERROR_EVENT, onDataError);
       window.removeEventListener(TOAST_EVENT, onToast);
+      window.removeEventListener(NAV_MINIMIZE_EVENT, onNavMinimize);
     };
   }, []);
 
@@ -401,11 +436,23 @@ export default function Shell() {
 
   return (
     <div className="shell-root">
-      <aside className="shell-side">
+      <aside className={"shell-side" + (navCollapsed ? " is-collapsed" : "")}>
         {/* The PRODUCT brand — the same mark the Streamlit host paints, from the
             same generated file, so the two shells cannot drift. "Royal Imports"
             stays on business documents only. */}
-        <Brand size={26} className="shell-brand" />
+        <div className="shell-side-head">
+          <Brand size={26} className="shell-brand" />
+          <button
+            type="button"
+            className="shell-rail-toggle"
+            aria-label={navCollapsed ? "Expand navigation" : "Minimize navigation"}
+            aria-expanded={!navCollapsed}
+            title={navCollapsed ? "Expand navigation" : "Minimize navigation"}
+            onClick={() => setNavCollapsed((v) => !v)}
+          >
+            <RailToggleIcon />
+          </button>
+        </div>
 
         <nav className="shell-nav">
           {/* The Analyst slot, above the database list — the host's own IA
@@ -474,7 +521,21 @@ export default function Shell() {
           ) : null}
         </nav>
 
-        <div className="shell-side-bottom">
+        <div
+          className="shell-side-bottom"
+          // Collapsed, the 56px strip cannot hold the account POPOVER — so the row's one
+          // honest behaviour is "expand me first". Capture-phase, so the menu never opens
+          // half-clipped behind the grid.
+          onClickCapture={
+            navCollapsed
+              ? (e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                  setNavCollapsed(false);
+                }
+              : undefined
+          }
+        >
           <AccountMenu
             user={session.user}
             utility={utility}