Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,6 +1,12 @@
 {
- "current": "v11 (3126617)",
+ "current": "v12 (4908f39)",
  "releases": [
+  {
+   "version": "v12",
+   "sha": "4908f39",
+   "date": "2026-08-06",
+   "subject": "release v12"
+  },
   {
    "version": "v11",
    "sha": "3126617",

VERSION

@@ -1 +1 @@
-v11 (3126617)
+v12 (4908f39)

api/ai_review.py

@@ -0,0 +1,207 @@
+"""AI REVIEW — let a model decide which stage a card moves to (wave 23, owner ruling R4/R14).
+
+⭐ WHAT THIS IS. A review stage holds a record until somebody decides where it goes next. R4 made
+that somebody optionally a MODEL: the engine hands over the record's own values, the review's
+prompt, and the list of stages the review is allowed to send a card to, and gets back ONE of
+those stage labels plus a one-line reason. Every decision is written to the same `reviews` audit
+log a human click writes to, tagged `by: "ai"` with the provider and model that made it.
+
+⛔ FAIL-CLOSED IN EVERY DIRECTION, and this is the whole safety story. No key configured, a
+network failure, a slow answer, a malformed answer, or an answer naming a stage the review does
+not offer — all return `("", {...})`, and the caller leaves the card exactly where a human would
+have found it. The feature can be absent, broken or wrong and the worst outcome is a person doing
+the work. Nothing here can move a card somewhere the review does not already permit.
+
+⭐ CHEAP FIRST (owner R14, verbatim: *"Claude is a bit too expensive"*). The ladder is
+`groq → cerebras → openrouter → anthropic`; the first CONFIGURED provider wins, and Anthropic is
+last rather than absent — it is the quality backstop, not the default. `AIOS_AI_REVIEW_PROVIDER`
+pins one; `AIOS_AI_MODEL` overrides the model.
+
+⚠ WHY RAW HTTP RATHER THAN THE `anthropic` SDK, stated because it is a deliberate deviation from
+the /claude-api skill's default and not an oversight. Three of the four legs are OpenAI-chat-shaped
+endpoints with no shared SDK, so a ladder built on the SDK would be one SDK leg beside three
+hand-rolled ones — two implementations of the same call, the seam this repo keeps closing. And
+`aios-web/api/requirements.txt` is PINNED to what the verify battery proves ([[pin-deps-space-
+rebuilds]]): adding a dependency there rebuilds the container, which is a real deploy risk to take
+for one leg of an optional feature. `requests` is already a dependency and `harness/analyst.py`
+established per-provider raw HTTP as the house pattern. Booked as a DEBT line so the integrator
+can overturn it deliberately rather than by drift.
+
+The Messages shape below is the current one: `x-api-key` + `anthropic-version: 2023-06-01`, and
+`stop_reason: "refusal"` is checked BEFORE reading `content` — a refusal answers HTTP 200 with an
+empty content list, so code that indexes `content[0]` unconditionally breaks on it.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+
+import requests
+
+#: The ladder. Order IS the policy (R14) — cheapest capable first, Anthropic last.
+PROVIDERS = [
+    {"name": "groq", "env": "GROQ_API_KEY", "shape": "openai",
+     "url": "https://api.groq.com/openai/v1/chat/completions",
+     "model": "llama-3.3-70b-versatile"},
+    {"name": "cerebras", "env": "CEREBRAS_API_KEY", "shape": "openai",
+     "url": "https://api.cerebras.ai/v1/chat/completions",
+     "model": "gpt-oss-120b"},
+    {"name": "openrouter", "env": "OPENROUTER_API_KEY", "shape": "openai",
+     "url": "https://openrouter.ai/api/v1/chat/completions",
+     "model": "openai/gpt-4o-mini"},
+    # ⚠ haiku-class DELIBERATELY, not the default Opus tier: R14 put Anthropic on this ladder as
+    # the backstop for a one-line classification, and this is the cheapest current Claude that
+    # does it well. A bigger model here would be spending the owner's money to pick between two
+    # labels it already has in front of it.
+    {"name": "anthropic", "env": "ANTHROPIC_API_KEY", "shape": "anthropic",
+     "url": "https://api.anthropic.com/v1/messages",
+     "model": "claude-haiku-4-5"},
+]
+ANTHROPIC_VERSION = "2023-06-01"
+TIMEOUT_SECONDS = float(os.environ.get("AIOS_AI_REVIEW_TIMEOUT") or 20)
+MAX_FIELD_CHARS = 200          # per value handed to the model
+MAX_FIELDS = 30                # columns handed to the model
+MAX_REASON = 200
+
+
+def ladder():
+    """The providers that are actually usable here, in order. Empty = the feature is off."""
+    pin = (os.environ.get("AIOS_AI_REVIEW_PROVIDER") or "").strip().lower()
+    live = [p for p in PROVIDERS if (os.environ.get(p["env"]) or "").strip()]
+    if pin:
+        live = [p for p in live if p["name"] == pin]
+    return live
+
+
+def configured():
+    return bool(ladder())
+
+
+def _record_text(row, fields):
+    """The record, as the model sees it. Values are truncated and the column set is bounded —
+    an automation table can carry a 32 KB JSON blob per row (C7) and a review decision does not
+    need it. Machine bookkeeping columns are dropped: a stage cell naming the stage the card is
+    sitting at would be the model reading its own question back."""
+    keys = [k for k in (fields or list((row or {}).keys()))
+            if not str(k).startswith("stage_")][:MAX_FIELDS]
+    lines = []
+    for k in keys:
+        v = (row or {}).get(k)
+        if v is None or str(v).strip() == "":
+            continue
+        lines.append(f"{k}: {str(v)[:MAX_FIELD_CHARS]}")
+    return "\n".join(lines) or "(this record has no filled-in values)"
+
+
+def _instruction(prompt, options, label):
+    return (
+        f"You are deciding what happens to one record waiting at a review step called "
+        f"{label!r} in a workflow.\n\n"
+        f"The person who built this workflow told you: {prompt}\n\n"
+        f"Choose EXACTLY ONE of these next steps, by its exact name:\n"
+        + "\n".join(f"- {o}" for o in options)
+        + "\n\nAnswer with one line of JSON and nothing else:\n"
+          '{"choice": "<one name from the list above>", "reason": "<one short sentence>"}\n'
+          "If the record does not give you enough to decide, answer "
+          '{"choice": "", "reason": "why not"} and a person will decide instead.'
+    )
+
+
+def _parse(text, options):
+    """The model's line → `(choice, reason)`. A choice that is not one of the offered stages is
+    DISCARDED, not fuzzy-matched: the offered list is a permission boundary, and a near-miss
+    resolved by string distance is how a card ends up somewhere nobody authorised."""
+    raw = str(text or "").strip()
+    obj = None
+    m = re.search(r"\{.*\}", raw, re.S)
+    if m:
+        try:
+            obj = json.loads(m.group(0))
+        except (ValueError, TypeError):
+            obj = None
+    if not isinstance(obj, dict):
+        return "", ""
+    choice = str(obj.get("choice") or "").strip()
+    reason = str(obj.get("reason") or "").strip()[:MAX_REASON]
+    for opt in options:
+        if choice.lower() == str(opt).lower():
+            return str(opt), reason           # the OFFERED spelling wins, never the model's
+    return "", reason
+
+
+def _call_openai(p, model, system, user, timeout):
+    r = requests.post(p["url"], timeout=timeout,
+                      headers={"Authorization": f"Bearer {os.environ[p['env']].strip()}",
+                               "Content-Type": "application/json"},
+                      json={"model": model, "max_tokens": 300, "temperature": 0,
+                            "messages": [{"role": "system", "content": system},
+                                         {"role": "user", "content": user}]})
+    if r.status_code >= 400:
+        return "", f"{p['name']} answered {r.status_code}"
+    body = r.json()
+    choices = body.get("choices") or []
+    if not choices:
+        return "", f"{p['name']} returned no choices"
+    return str(((choices[0] or {}).get("message") or {}).get("content") or ""), ""
+
+
+def _call_anthropic(p, model, system, user, timeout):
+    r = requests.post(p["url"], timeout=timeout,
+                      headers={"x-api-key": os.environ[p["env"]].strip(),
+                               "anthropic-version": ANTHROPIC_VERSION,
+                               "content-type": "application/json"},
+                      json={"model": model, "max_tokens": 300, "system": system,
+                            "messages": [{"role": "user", "content": user}]})
+    if r.status_code >= 400:
+        return "", f"anthropic answered {r.status_code}"
+    body = r.json()
+    # ⛔ stop_reason FIRST. A safety refusal is a successful 200 with an EMPTY content list, so
+    # reading content[0] before this check turns a refusal into an IndexError inside a run.
+    if body.get("stop_reason") == "refusal":
+        return "", "anthropic declined to answer this record"
+    parts = [b.get("text") or "" for b in (body.get("content") or [])
+             if isinstance(b, dict) and b.get("type") == "text"]
+    if not parts:
+        return "", "anthropic returned no text"
+    return "".join(parts), ""
+
+
+def decide(*, prompt, options, row, fields=(), label="Review", timeout=None):
+    """Pick this record's next stage. Returns `(choice, meta)`.
+
+    `choice` is "" whenever a person should decide — which is every failure mode there is.
+    `meta` carries `provider`, `model`, `reason` on success, and `problem` on refusal to answer.
+    """
+    opts = [str(o) for o in (options or []) if str(o).strip()]
+    if not opts:
+        return "", {"problem": "the review offers no next stages"}
+    if not str(prompt or "").strip():
+        return "", {"problem": "the review has no prompt for the model to follow"}
+    live = ladder()
+    if not live:
+        return "", {"problem": "no AI provider is configured on this deployment"}
+    system = _instruction(prompt, opts, label)
+    user = "Here is the record:\n\n" + _record_text(row, fields)
+    tmo = float(timeout or TIMEOUT_SECONDS)
+    override = (os.environ.get("AIOS_AI_MODEL") or "").strip()
+    problems = []
+    for p in live:
+        model = override or p["model"]
+        try:
+            text, err = (_call_anthropic if p["shape"] == "anthropic" else _call_openai)(
+                p, model, system, user, tmo)
+        except Exception as e:                                        # noqa: BLE001
+            text, err = "", f"{p['name']} failed: {type(e).__name__}"
+        if err:
+            problems.append(err)
+            continue                      # ladder: a dead provider degrades to the next one
+        choice, reason = _parse(text, opts)
+        if not choice:
+            # The provider ANSWERED and declined (or answered unusably). That is a decision about
+            # this record, not a fault in the provider, so it does NOT fall through to a more
+            # expensive one — the card goes to a human, which is what the model just asked for.
+            return "", {"provider": p["name"], "model": model,
+                        "problem": reason or "the model did not choose one of the stages"}
+        return choice, {"provider": p["name"], "model": model, "reason": reason}
+    return "", {"problem": "; ".join(problems)[:300] or "no provider answered"}

api/automation_engine.py

@@ -24,6 +24,7 @@ the skill version takes a URL from a developer on a CLI; this takes one from a r
 from __future__ import annotations
 
 import datetime as _dt
+import hmac
 import ipaddress
 import json
 import os
@@ -949,6 +950,59 @@ def clean_schedule(raw, previous=None):
     return out
 
 
+# ── WAVE 23 · C5 — the ENDING, and the cycle counter that makes a loop countable. ─────────────
+# The owner's words: "we can make this automation a loop, so the ending should always be defined,
+# either it ends somewhere deterministic like Closed/Failed, or it goes to reset automatically,
+# or the user have to click a button to reset, or after a certain amount of time it can
+# automatically reset to first cycle."
+#
+# ⛔ `terminal` IS THE DEFAULT and every existing automation gets it, because a stored definition
+# that predates this field must not start moving records on its own the day the code ships. A
+# loop is a thing somebody turns on.
+ENDING_MODES = ("terminal", "auto_reset", "manual_reset", "timed_reset")
+MAX_RESET_HOURS = 720                       # 30 days; past that "it resets eventually" is a lie
+#: The per-record cycle counter's cell suffix, beside `stage_<id>` and `stage_<id>_at`.
+CYCLES_SUFFIX = "_cycles"
+
+
+def cycles_field_key(auto_id):
+    return stage_field_key(auto_id) + CYCLES_SUFFIX
+
+
+def clean_ending(raw, previous=None):
+    """Validate `{mode, hours?}`. Returns `(ending, error)`."""
+    raw = raw if isinstance(raw, dict) else {}
+    prev = previous if isinstance(previous, dict) else {}
+    mode = _s(raw.get("mode") or prev.get("mode"), 20).strip() or "terminal"
+    if mode not in ENDING_MODES:
+        return None, f"{mode!r} is not one of: " + ", ".join(ENDING_MODES)
+    out = {"mode": mode}
+    if mode == "timed_reset":
+        try:
+            hours = int(raw.get("hours") if raw.get("hours") is not None else prev.get("hours")
+                        or 24)
+        except (TypeError, ValueError):
+            return None, "the reset delay must be a whole number of hours"
+        if hours < 1 or hours > MAX_RESET_HOURS:
+            return None, f"the reset delay is between 1 and {MAX_RESET_HOURS} hours"
+        out["hours"] = hours
+    return out, None
+
+
+def clean_flow(raw, previous=None):
+    """Validate `{actions, ending}` — the builder's half of a definition. `(flow, error)`."""
+    raw = raw if isinstance(raw, dict) else {}
+    prev = previous if isinstance(previous, dict) else {}
+    actions, err = clean_actions(raw.get("actions") if "actions" in raw else prev.get("actions"))
+    if err:
+        return None, err
+    ending, err = clean_ending(raw.get("ending") if "ending" in raw else prev.get("ending"),
+                              prev.get("ending"))
+    if err:
+        return None, err
+    return {"actions": actions, "ending": ending}, None
+
+
 def clean_definition(raw, previous=None, username=""):
     """Whole-definition validation. Returns `(defn, error)`."""
     raw = raw if isinstance(raw, dict) else {}
@@ -973,10 +1027,19 @@ def clean_definition(raw, previous=None, username=""):
                                   else prev.get("trigger"), prev.get("trigger"))
     if terr:
         return None, terr
+    flow, ferr = clean_flow(raw.get("flow") if "flow" in raw else prev.get("flow"),
+                            prev.get("flow"))
+    if ferr:
+        return None, ferr
     return {
         "id": _s(prev.get("id") or raw.get("id"), 40),
         "name": name, "kind": kind, "config": config, "schedule": schedule,
         "trigger": trigger,
+        # WAVE 23 · C4/C5 — the BUILDER's half: the ordered actions a record walks and what
+        # happens when it reaches the end. Absent on every definition written before this wave,
+        # which is exactly why `clean_flow` defaults it to "no actions, terminal ending": the
+        # code shipping must not put existing automations into a loop.
+        "flow": flow,
         "status": prev.get("status") or {"state": "idle", "lastRunAt": "", "lastSummary": ""},
         "runs": list(prev.get("runs") or [])[:MAX_RUNS],
         # C3-A2(5): the review-decision audit survives a Save the way `state` does — an
@@ -1027,10 +1090,61 @@ def _new_id(existing):
     return f"auto_{n}"
 
 
+#: C2's three answers to "which database does this automation work on?" — the FIRST question the
+#: create wizard asks (owner item 3: the kind is not the first thing a person picks, the data is).
+TARGET_MODES = ("existing", "new", "automated")
+
+
+def resolve_target(rt, raw, username=""):
+    """C2: turn the wizard's `target` into a bound table key. Returns `(config_patch, error)`.
+
+    - `existing` — bind a database that is already there.
+    - `new` — mint a blank one now, so the automation has somewhere to write before its first
+      run instead of conjuring a table the person never agreed to.
+    - `automated` — leave it to the runner: a scraping automation MINTS its target on first run
+      (`ut_ensure`), stamped `source: "Automation"`, which is what makes it a machine database.
+      Nothing is created here, deliberately — an empty table created up front for a scrape that
+      never runs is litter nobody can explain.
+    """
+    if not isinstance(raw, dict) or not raw:
+        return {}, None                                  # no target block = the pre-wizard shape
+    mode = _s(raw.get("mode"), 20).strip() or "existing"
+    if mode not in TARGET_MODES:
+        return None, f"{mode!r} is not one of: " + ", ".join(TARGET_MODES)
+    if mode == "automated":
+        label = " ".join(_s(raw.get("label"), 60).split())
+        return ({"targetLabel": label} if label else {}), None
+    if mode == "existing":
+        key = _s(raw.get("table"), 60).strip()
+        if not key:
+            return None, "choose the database this automation works on"
+        t = ut_get(rt, key)
+        if t is None:
+            return None, f"{key!r} is not a database in this workspace"
+        return {"targetTable": key, "targetLabel": t.get("label") or key}, None
+    label = " ".join(_s(raw.get("label"), 60).split())
+    if not label:
+        return None, "name the new database"
+    import core.user_tables as _ut_new
+    key = _ut_new.create(label, username or "automation", st=rt)
+    if not key:
+        return None, ("the database could not be created — this workspace may be at its table "
+                      "limit")
+    return {"targetTable": key, "targetLabel": label}, None
+
+
 def create(rt, raw, username=""):
     existing = all_definitions(rt)
     if len(existing) >= MAX_AUTOMATIONS:
         return None, f"this workspace is at the {MAX_AUTOMATIONS}-automation limit"
+    raw = dict(raw or {})
+    # C2 runs BEFORE validation so a `new` target's freshly-minted key is part of the config
+    # `clean_definition` sees — one write, not a create-then-patch the client has to sequence.
+    patch_cfg, terr = resolve_target(rt, raw.pop("target", None), username)
+    if terr:
+        return None, terr
+    if patch_cfg:
+        raw["config"] = {**(raw.get("config") or {}), **patch_cfg}
     defn, err = clean_definition(raw, None, username)
     if err:
         return None, err
@@ -1054,7 +1168,12 @@ def patch(rt, auto_id, raw, username=""):
     if prev is None:
         return None, "no such automation"
     merged = dict(prev)
-    for k in ("name", "config", "schedule", "kind", "trigger"):
+    # ⚠ A HAND-MAINTAINED PATCHABLE-KEY LIST, and it is the silent-drop seat of this module: a
+    # key missing here is accepted by the route, validated by `clean_definition`, and then
+    # DISCARDED — the client shows a saved flow that the store never received, and nothing goes
+    # red. `flow` joined it in the same edit that created `flow` (wave 23), which is the only
+    # ordering that never has a window where the bug exists.
+    for k in ("name", "config", "schedule", "kind", "trigger", "flow"):
         if k in (raw or {}):
             merged[k] = raw[k]
     defn, err = clean_definition(merged, prev, username)
@@ -3082,15 +3201,27 @@ def graph(defn):
 
     on = bool(sched.get("enabled"))
     trg = defn.get("trigger") or {}
-    if trg.get("key") in ("event_field", "record_created", "webhook", "email"):
+    if trg.get("key") in TRIGGER_KEYS and trg.get("key") not in ("manual", "schedule"):
         # C3 (wave 22): the trigger node SAYS which trigger this flow has — the board and rail
-        # read the same node, so an event-triggered flow must not read "Schedule".
+        # read the same node, so an event-triggered flow must not read "Schedule". The membership
+        # test is the KEY SET, not a hand-listed tuple: wave 23 added four triggers and the old
+        # tuple would have quietly rendered every one of them as "Schedule" (they are stored, so
+        # the else-branch was reachable) — green, compiling, and wrong on screen.
         t_on = bool(trg.get("enabled", True)) and not trg.get("paused")
         sub = TRIGGER_LABELS.get(trg["key"], trg["key"])
-        det = {"event_field": f"{trg.get('table', '')}.{trg.get('field', '')}",
+        watched = ", ".join(trg.get("fields") or []) or "any field"
+        det = {"event_field": (f"{trg.get('table', '')}"
+                               + (f".{trg.get('field')}" if trg.get("field") else "")
+                               + (f" — {_lane_sentence(trg.get('when'))}"
+                                  if trg.get("when") else "")),
+               "record_updated": f"{trg.get('table', '')} — {watched}",
                "record_created": str(trg.get("table") or ""),
+               "enters_view": f"{trg.get('table', '')} — view {trg.get('viewId') or 'unset'}",
+               "form_submitted": str(trg.get("table") or ""),
                "webhook": "POST the hook URL to fire it",
                "email": str(trg.get("query") or "")}.get(trg["key"], "")
+        if not trg.get("configured", True):
+            det = "Finish setting this trigger up before it can fire"
         if trg.get("paused"):
             det = str(defn.get("statusNote") or "paused")
         nodes = [node("trigger", "trigger", sub,
@@ -3279,6 +3410,91 @@ MAX_LANES = 6
 LANE_OPS = ("=", "!=", ">", ">=", "<", "<=", "includes", "not_includes",
             "is_empty", "is_not_empty")
 LANE_NULLARY_OPS = ("is_empty", "is_not_empty")
+
+# ─────────────────────────────────────────────────────────────────────────────────────────────
+# WAVE 23 · C4 — CONDITION TREES. `Cond = leaf | {all: [Cond…]} | {any: [Cond…]}`
+#
+# A leaf is exactly what wave 22 called a lane condition (`{field, op, value?}`), which is why
+# this generalisation needed no migration: a stored leaf IS a valid tree, `cond_match` dispatches
+# on shape, and nothing at rest is rewritten until the owner saves that automation. (The doc
+# calls this "legacy single-condition lanes auto-wrap as {all:[leaf]} on read" — wrapping is the
+# same function applied one level up, so the cheaper honest version is to evaluate the leaf where
+# it lies and never touch the bytes.)
+#
+# ⛔ DEPTH IS BOUNDED AND THE BOUND IS ENFORCED AT WRITE TIME, not at evaluation time. An
+# unbounded tree is an unbounded evaluation on a hook that runs inside somebody's keystroke, and
+# "the server got slow" is the failure nobody traces back to a filter somebody nested 40 deep.
+# ⛔ REFUSE-NEVER-COERCE all the way down (`clean_predicates`' discipline): an empty group, an
+# unknown comparison, a valueless compare are all REFUSED with the reason named. A group that
+# quietly dropped its unanswerable leaf would WIDEN — the tri-state scar the filter engine
+# carries ([[cg-filter-engine-sql-port]]), reproduced here where nothing would report it.
+MAX_COND_DEPTH = 3
+MAX_COND_CHILDREN = 12
+COND_GROUP_KEYS = ("all", "any")
+
+
+def clean_cond(raw, depth=0, where=""):
+    """Validate one condition TREE. Returns `(cond|None, error)`; `(None, None)` means "no
+    condition", which is legal everywhere a condition is optional (the catch-all lane, an
+    unconditioned trigger, an action group that always runs)."""
+    if raw in (None, "", {}):
+        return None, None
+    at = f" on {where}" if where else ""
+    if not isinstance(raw, dict):
+        return None, f"the condition{at} must be an object"
+    conj = [k for k in COND_GROUP_KEYS if k in raw]
+    if len(conj) > 1:
+        return None, (f"the condition{at} sets both 'all' and 'any' — a group is one or the "
+                      f"other")
+    if conj:
+        key = conj[0]
+        if depth + 1 > MAX_COND_DEPTH:
+            return None, (f"conditions nest at most {MAX_COND_DEPTH} levels deep — "
+                          f"the group{at} is deeper")
+        kids_raw = raw.get(key)
+        if not isinstance(kids_raw, list) or not kids_raw:
+            return None, f"the '{key}' group{at} needs at least one condition inside it"
+        if len(kids_raw) > MAX_COND_CHILDREN:
+            return None, (f"a group holds at most {MAX_COND_CHILDREN} conditions — "
+                          f"the '{key}' group{at} has {len(kids_raw)}")
+        kids = []
+        for child in kids_raw:
+            c, err = clean_cond(child, depth + 1, where)
+            if err:
+                return None, err
+            if c is None:
+                return None, (f"an empty condition sits inside the '{key}' group{at} — "
+                              f"finish it or remove it")
+            kids.append(c)
+        return {key: kids}, None
+    field = _s(raw.get("field"), 80).strip()
+    op = _s(raw.get("op") or raw.get("operator"), 20).strip()
+    if not field:
+        return None, f"the condition{at} names no field"
+    if op not in LANE_OPS:
+        return None, f"{op or 'that comparison'!r} is not one of: " + ", ".join(LANE_OPS)
+    cond = {"field": field, "op": op}
+    if op not in LANE_NULLARY_OPS:
+        v = raw.get("value")
+        if v is None or (isinstance(v, str) and not v.strip()):
+            return None, f"give a value to compare {field!r} against{at}"
+        cond["value"] = v.strip() if isinstance(v, str) else v
+    return cond, None
+
+
+def cond_fields(cond):
+    """Every field name a tree reads — the set a caller must have on the row image before the
+    answer means anything."""
+    if not isinstance(cond, dict):
+        return set()
+    for key in COND_GROUP_KEYS:
+        if key in cond:
+            out = set()
+            for child in cond.get(key) or []:
+                out |= cond_fields(child)
+            return out
+    f = cond.get("field")
+    return {f} if f else set()
 #: Lane labels a flow already uses for its fixed stages. A lane literally called "Review" would
 #: collide with the stage the label is a choice FOR, and the board could no longer tell a
 #: routed card from a gated one.
@@ -3319,25 +3535,10 @@ def clean_lanes(raw):
             lid = f"{base}_{n}"
             n += 1
         seen_ids.add(lid)
-        cond_raw = entry.get("when")
-        cond = None
-        if cond_raw not in (None, ""):
-            if not isinstance(cond_raw, dict):
-                return None, f"the condition on {label!r} must be an object"
-            field = _s(cond_raw.get("field"), 80).strip()
-            op = _s(cond_raw.get("op") or cond_raw.get("operator"), 20).strip()
-            if not field:
-                return None, f"the condition on {label!r} names no field"
-            if op not in LANE_OPS:
-                return None, (f"{op or 'that comparison'!r} is not one of: "
-                              + ", ".join(LANE_OPS))
-            cond = {"field": field, "op": op}
-            if op not in LANE_NULLARY_OPS:
-                v = cond_raw.get("value")
-                if v is None or (isinstance(v, str) and not v.strip()):
-                    return None, f"give a value to compare {field!r} against on {label!r}"
-                cond["value"] = v.strip() if isinstance(v, str) else v
-        else:
+        cond, cerr = clean_cond(entry.get("when"), where=repr(label))
+        if cerr:
+            return None, cerr
+        if cond is None:
             defaults += 1
             if defaults > 1:
                 return None, ("only one lane may have no condition — it is the catch-all, "
@@ -3354,7 +3555,11 @@ def _lane_num(v):
 
 
 def lane_match(cond, row):
-    """Does `row` satisfy one lane condition? None-condition matches everything (the catch-all).
+    """Does `row` satisfy this condition TREE? None matches everything (the catch-all).
+
+    Named for the lane that first needed it; it is now C4's whole evaluator, and every wave-22
+    caller (`route_record`, `_settle_eval`, `_seed_event_state`) gained tree support by keeping
+    this name rather than growing a second entry point that could disagree with it.
 
     ⛔ REFUSE-NEVER-COERCE, per record: an ordering comparison whose either side does not parse
     as a number answers False — the record simply does not enter the lane — never "treat blank
@@ -3363,6 +3568,11 @@ def lane_match(cond, row):
     """
     if cond is None:
         return True
+    if isinstance(cond, dict):
+        if "all" in cond:
+            return all(lane_match(c, row) for c in cond.get("all") or [])
+        if "any" in cond:
+            return any(lane_match(c, row) for c in cond.get("any") or [])
     raw = (row or {}).get(cond.get("field"))
     op = cond.get("op")
     if op == "is_empty":
@@ -3398,6 +3608,219 @@ def route_record(lanes, row):
     return ""
 
 
+# ─────────────────────────────────────────────────────────────────────────────────────────────
+# WAVE 23 · C4 — ACTIONS (owner ruling R3). The half of the Airtable builder that DOES things.
+#
+# `flow.actions` is an ordered list walked per RECORD, after the flow's machine steps have run.
+# A `group` holds nested actions behind a condition — Airtable's "conditional action group",
+# which the owner explicitly asked to be NESTABLE (R3 supersedes the wave-22 research brief's
+# rec-8 "no nesting" verdict; that recommendation was about keeping a CANVAS legible, and this
+# builder is a column, not a canvas).
+#
+# ⛔ THE CATALOG IS SERVER-OWNED AND INCLUDES WHAT WE HAVE NOT BUILT. `ACTION_CATALOG` carries a
+# `ready` flag per kind, so the "+ Add advanced logic or action" menu paints Send email / Slack /
+# Run script / Generate with AI faded with a reason instead of omitting them — the same honesty
+# rule the trigger list follows, and the same enforcement: `clean_actions` REFUSES an unready
+# kind with a sentence, so the faded state is a wall and not a styling choice.
+MAX_ACTIONS = 20               # per automation, counting nested ones
+MAX_GROUP_DEPTH = 2            # a group inside a group inside a group is a flowchart, not a flow
+MAX_ACTION_VALUES = 20         # cells one update/create action may write
+FIND_LIMIT_MAX = 100
+ACTION_KINDS = ("group", "update_record", "create_record", "find_records", "review")
+ACTION_CATALOG = [
+    {"kind": "group", "label": "Conditional logic", "group": "Advanced logic", "ready": True,
+     "detail": "Run different actions based off a certain condition"},
+    {"kind": "update_record", "label": "Update record", "group": "Actions", "ready": True,
+     "detail": "Write values onto the record walking the flow"},
+    {"kind": "create_record", "label": "Create record", "group": "Actions", "ready": True,
+     "detail": "Add a row to another database"},
+    {"kind": "find_records", "label": "Find records", "group": "Actions", "ready": True,
+     "detail": "Look rows up by condition; the run log opens them"},
+    {"kind": "review", "label": "Manual review", "group": "Advanced logic", "ready": True,
+     "detail": "Hold the record for a person — or an AI — to decide where it goes next"},
+    {"kind": "repeating_group", "label": "Repeating group", "group": "Advanced logic",
+     "ready": False, "detail": "Run the same actions on every item in a list"},
+    {"kind": "send_email", "label": "Send email", "group": "Actions", "ready": False,
+     "detail": "Needs a send scope on the Gmail connection"},
+    {"kind": "slack", "label": "Send Slack message", "group": "Actions", "ready": False,
+     "detail": "Needs the Slack connector"},
+    {"kind": "run_script", "label": "Run script", "group": "Actions", "ready": False,
+     "detail": "Not built — a sandbox is its own decision"},
+    {"kind": "generate_ai", "label": "Generate with AI", "group": "Actions", "ready": False,
+     "detail": "Review stages can already be decided by AI"},
+]
+REVIEW_DECIDERS = ("user", "ai")
+MAX_AI_PROMPT = 600
+
+
+def action_catalog():
+    """The catalog as the wire carries it — a copy, because a caller that mutated the module
+    constant would change every later reader's answer."""
+    return [dict(a) for a in ACTION_CATALOG]
+
+
+def _action_label(act):
+    for row in ACTION_CATALOG:
+        if row["kind"] == act.get("kind"):
+            return row["label"]
+    return str(act.get("kind") or "Action")
+
+
+def clean_actions(raw, depth=0, _seen=None, _count=None):
+    """Validate `flow.actions`. Returns `(actions, error)` — refuses, never coerces.
+
+    Ids are STABLE: a caller's well-formed `id` is kept, so selecting an action in the builder
+    survives a Save. A missing or colliding one is minted `act_<n>`; minting on every clean would
+    move the selection under the person editing it.
+    """
+    if raw in (None, ""):
+        return [], None
+    if not isinstance(raw, list):
+        return None, "actions must be a list"
+    seen = _seen if _seen is not None else set()
+    count = _count if _count is not None else [0]
+    out = []
+    for entry in raw:
+        if not isinstance(entry, dict):
+            return None, "each action must be an object with a kind"
+        kind = _s(entry.get("kind"), 30).strip()
+        row = next((r for r in ACTION_CATALOG if r["kind"] == kind), None)
+        if row is None:
+            return None, (f"{kind or 'that action'!r} is not one of: "
+                          + ", ".join(a["kind"] for a in ACTION_CATALOG))
+        if not row["ready"]:
+            return None, (f"{row['label']!r} is on the menu but not built yet — "
+                          f"{row['detail'][0].lower()}{row['detail'][1:]}")
+        count[0] += 1
+        if count[0] > MAX_ACTIONS:
+            return None, f"an automation runs at most {MAX_ACTIONS} actions"
+        aid = _s(entry.get("id"), 40).strip()
+        if not re.fullmatch(r"act_[a-z0-9_]{1,32}", aid or "") or aid in seen:
+            n = 1
+            while f"act_{n}" in seen:
+                n += 1
+            aid = f"act_{n}"
+        seen.add(aid)
+        when, cerr = clean_cond(entry.get("when"), where=f"action {aid}")
+        if cerr:
+            return None, cerr
+        cfg_raw = entry.get("config") if isinstance(entry.get("config"), dict) else {}
+        cfg, cerr = _clean_action_config(kind, cfg_raw, depth, seen, count)
+        if cerr:
+            return None, cerr
+        out.append({"id": aid, "kind": kind,
+                    "enabled": bool(entry.get("enabled", True)),
+                    "when": when, "config": cfg})
+    return out, None
+
+
+def _clean_action_config(kind, cfg, depth, seen, count):
+    """One action's `config`, per kind. Returns `(config, error)`."""
+    if kind == "group":
+        if depth + 1 > MAX_GROUP_DEPTH:
+            return None, (f"conditional groups nest at most {MAX_GROUP_DEPTH} deep — "
+                          f"past that a flow is a flowchart and belongs on the board")
+        cond, cerr = clean_cond(cfg.get("cond"), where="the group")
+        if cerr:
+            return None, cerr
+        kids, kerr = clean_actions(cfg.get("actions"), depth + 1, seen, count)
+        if kerr:
+            return None, kerr
+        if not kids:
+            return None, "a conditional group with no actions inside it does nothing"
+        return {"cond": cond, "actions": kids}, None
+    if kind in ("update_record", "create_record"):
+        values = cfg.get("values")
+        if not isinstance(values, dict) or not values:
+            return None, f"the {kind.replace('_', ' ')} action writes no values"
+        if len(values) > MAX_ACTION_VALUES:
+            return None, f"one action writes at most {MAX_ACTION_VALUES} cells"
+        clean_vals = {}
+        for k, v in values.items():
+            key = _s(k, 80).strip()
+            if not key:
+                return None, "a value is written to a field with no name"
+            if v is not None and not isinstance(v, (str, int, float, bool)):
+                return None, (f"the value for {key!r} must be text or a number — "
+                              f"an automation writes cells, not objects")
+            clean_vals[key] = _s(v, 500) if isinstance(v, str) else v
+        out = {"values": clean_vals}
+        if kind == "create_record":
+            table = _s(cfg.get("table"), 60).strip()
+            if not table:
+                return None, "the create record action names no database"
+            if not table.startswith(UT_PREFIX):
+                return None, (f"actions write to blank databases (ut_*) this wave — "
+                              f"{table!r} is not one")
+            out["table"] = table
+        return out, None
+    if kind == "find_records":
+        table = _s(cfg.get("table"), 60).strip()
+        if not table:
+            return None, "the find records action names no database"
+        cond, cerr = clean_cond(cfg.get("cond"), where="the find")
+        if cerr:
+            return None, cerr
+        try:
+            limit = int(cfg.get("limit") or 25)
+        except (TypeError, ValueError):
+            return None, "the find records limit must be a whole number"
+        if limit < 1 or limit > FIND_LIMIT_MAX:
+            return None, f"the find records limit is between 1 and {FIND_LIMIT_MAX}"
+        return {"table": table, "cond": cond, "limit": limit}, None
+    if kind == "review":
+        by = _s(cfg.get("decidedBy"), 10).strip() or "user"
+        if by not in REVIEW_DECIDERS:
+            return None, f"a review is decided by one of: {', '.join(REVIEW_DECIDERS)}"
+        label = " ".join(_s(cfg.get("label"), 60).split()) or "Review"
+        if label.strip().lower() in _RESERVED_STAGE_LABELS and label != "Review":
+            return None, f"{label!r} is the name of a fixed stage — name the review something else"
+        nxt = cfg.get("next")
+        outs = []
+        if isinstance(nxt, list):
+            for entry in nxt[:MAX_LANES]:
+                lbl = " ".join(_s(entry, 60).split())
+                if lbl and lbl not in outs:
+                    outs.append(lbl)
+        if not outs:
+            outs = ["Approved", "Declined"]
+        prompt = _s(cfg.get("prompt"), MAX_AI_PROMPT).strip()
+        if by == "ai" and not prompt:
+            return None, ("an AI review needs a prompt — tell it what to decide, or set the "
+                          "review back to a person")
+        return {"decidedBy": by, "label": label, "next": outs, "prompt": prompt}, None
+    return {}, None
+
+
+def walk_actions(actions):
+    """Every action in the tree, depth-first, groups included. One walker, so "how many actions
+    does this flow have" and "which review stages exist" cannot answer differently."""
+    for act in actions or []:
+        yield act
+        if act.get("kind") == "group":
+            for kid in walk_actions((act.get("config") or {}).get("actions")):
+                yield kid
+
+
+def review_actions(defn):
+    """The review actions of one definition, in flow order — the stages a card can REST at."""
+    flow = (defn or {}).get("flow") or {}
+    return [a for a in walk_actions(flow.get("actions")) if a.get("kind") == "review"
+            and a.get("enabled", True)]
+
+
+def interpolate(text, row):
+    """`{{field_key}}` → the record's value. Unknown keys resolve to EMPTY, deliberately: an
+    action that wrote the literal `{{status}}` into a cell because somebody typo'd the key would
+    put template syntax in front of a customer, and a blank is the visible failure."""
+    if not isinstance(text, str) or "{{" not in text:
+        return text
+    def _sub(m):
+        v = (row or {}).get(m.group(1).strip())
+        return "" if v is None else str(v)
+    return re.sub(r"\{\{([^}]{1,80})\}\}", _sub, text)
+
+
 def stages_for(defn):
     """One automation → `(stages, routes)` — C1's vocabulary, derived from `graph()` so the
     board can never disagree with the runner about what the flow does.
@@ -3475,12 +3898,335 @@ def stages_for(defn):
             routes.append({"from": "write", "to": lane["id"],
                            "label": lane["label"] if cond is None else _lane_sentence(cond),
                            "condition": dict(cond) if cond else None})
+
+    # ── WAVE 23 · C4/C6 — REVIEW ACTIONS ARE STAGES. ─────────────────────────────────────────
+    # A review action is the one action kind that HOLDS a record rather than doing something to
+    # it, so it has to exist on the board: a flow whose review lived only in the builder would
+    # gate records at a place the kanban cannot show, which is the whole complaint the board was
+    # built to answer. Its declared exits become assignable stages too — a gate with nowhere to
+    # go is a hole records fall into.
+    tail = max((s["col"] for s in stages), default=0)
+    for i, act in enumerate(review_actions(defn)):
+        acfg = act.get("config") or {}
+        rid = act["id"]
+        stages.append({"id": rid, "label": acfg.get("label") or "Review", "kind": "review",
+                       "col": tail + 1 + (i * 2), "row": 0, "enabled": True, "toggle": "",
+                       "status": "idle", "panel": "review_action", "posture": "strict",
+                       "record": True, "assignable": True, "actionId": rid,
+                       "decidedBy": acfg.get("decidedBy") or "user",
+                       "detail": ("An AI decides where each card goes — a person can override it"
+                                  if acfg.get("decidedBy") == "ai"
+                                  else "Cards wait here for a person to move them on")})
+        for j, label in enumerate(acfg.get("next") or []):
+            oid = f"{rid}_out_{j}"
+            stages.append({"id": oid, "label": label, "kind": "action",
+                           "col": tail + 2 + (i * 2), "row": j, "enabled": True, "toggle": "",
+                           "status": "idle", "panel": "review_action", "posture": "auto",
+                           "record": True, "assignable": True, "actionId": rid,
+                           "detail": f"Where {acfg.get('label') or 'Review'} sends a card"})
+            routes.append({"from": rid, "to": oid, "label": label, "condition": None})
     return stages, routes
 
 
-def _lane_sentence(cond):
+def terminal_stage_ids(stages, routes):
+    """Stages a record can REST at with nowhere further to go — the ends C5's `ending` acts on.
+    Derived from the routes rather than declared, so a flow cannot gain an exit without this
+    noticing (and a lane that stops being terminal stops being reset)."""
+    assignable = {s["id"] for s in stages if s.get("assignable")}
+    onward = {r["from"] for r in routes if r["to"] in assignable and r["to"] != r["from"]}
+    return [sid for sid in assignable if sid not in onward]
+
+
+def _stage_of(stages, sid):
+    for s in stages:
+        if s["id"] == sid:
+            return s
+    return None
+
+
+# ─────────────────────────────────────────────────────────────────────────────────────────────
+# WAVE 23 · C4/C5/C6 — THE ACTION RUNNER. One record at a time, actions in declared order.
+#
+# ⛔ ONE COALESCED WRITE PER TABLE PER RUN. The runner accumulates patches in memory and commits
+# them once at the end (the 256-commits/hr budget every writer in this module respects). A
+# per-action `rt.update` would be correct and would also spend the tenant's whole commit budget
+# on one busy flow.
+# ⛔ A REVIEW SUSPENDS THAT RECORD AND NOTHING ELSE. When a card reaches a review action the
+# runner stamps its stage and stops walking THAT record — later actions belong to the branch a
+# human (or the AI) has not chosen yet. Other records keep going; a gate is not a global pause.
+# ⛔ EVERY WRITE HERE IS MACHINE-ORIGIN and goes through this module's own writers, never the
+# human doors — which is exactly what keeps A2(2)'s loop prevention structural: an action's write
+# cannot fire an event trigger, its own or a sibling's.
+
+def _act_row_patch(patches, table, rid, values):
+    patches.setdefault(table, {}).setdefault(str(rid), {}).update(values)
+
+
+def _flow_table(defn):
+    """The database a flow's actions and ending operate on: the automation's own target, or the
+    table its event trigger watches when the flow has no target of its own."""
+    cfg = (defn or {}).get("config") or {}
+    if defn.get("kind") == "discover_instagram":
+        return cfg.get("targetTable") or DISCOVER_TABLE
+    return cfg.get("targetTable") or ((defn.get("trigger") or {}).get("table") or "")
+
+
+def apply_actions(rt, defn, table_key, row_ids, username="automation", log=print):
+    """Walk `flow.actions` for each of `row_ids`, then apply the ENDING. Returns the run counts.
+
+    ⚠ The ending runs even when there are NO actions, and that is not a detail: a discovery
+    automation's terminal stages (`tracked`/`declined`) come from `stages_for`, not from actions,
+    so an early return on an empty action list would have silently disabled the owner's loop
+    feature on the flagship flow — the one kind most likely to want `auto_reset`. Caught in
+    review; the tests all happened to pass a non-empty action list, which is why it was green.
+    """
+    flow = (defn or {}).get("flow") or {}
+    actions = flow.get("actions") or []
+    counts = {"actionsRun": 0, "updated": 0, "created": 0, "found": 0, "review": 0,
+              "aiDecided": 0, "cycles": 0}
+    if not table_key:
+        return counts
+    table = str(table_key)
+    rows = dict((ut_get(rt, table) or {}).get("rows") or {})
+    if not rows:
+        return counts
+    stages, routes = stages_for(defn)
+    skey = stage_field_key(defn.get("id"))
+    stamp = _iso()
+    patches, creates, ai_budget = {}, {}, [AI_DECISIONS_PER_RUN]
+
+    def _walk(acts, row, rid, depth=0):
+        """Returns True when the record was SUSPENDED (a review holds it)."""
+        for act in acts:
+            if not act.get("enabled", True):
+                continue
+            if not lane_match(act.get("when"), row):
+                continue
+            kind = act.get("kind")
+            cfg = act.get("config") or {}
+            counts["actionsRun"] += 1
+            if kind == "group":
+                if not lane_match(cfg.get("cond"), row):
+                    continue
+                if _walk(cfg.get("actions") or [], row, rid, depth + 1):
+                    return True
+            elif kind == "update_record":
+                vals = {k: interpolate(v, row) for k, v in (cfg.get("values") or {}).items()}
+                row.update(vals)                      # later actions see the write, as they must
+                _act_row_patch(patches, table, rid, vals)
+                counts["updated"] += 1
+            elif kind == "create_record":
+                target = str(cfg.get("table") or "")
+                vals = {k: interpolate(v, row) for k, v in (cfg.get("values") or {}).items()}
+                creates.setdefault(target, []).append(vals)
+                counts["created"] += 1
+            elif kind == "find_records":
+                found = find_records(rt, cfg.get("table"), cfg.get("cond"),
+                                     int(cfg.get("limit") or 25))
+                counts["found"] += len(found)
+            elif kind == "review":
+                label = cfg.get("label") or "Review"
+                at = str(row.get(skey) or "").strip()
+                if at == label:
+                    return True                       # already waiting here — do not re-stamp
+                if at and at in (cfg.get("next") or []):
+                    # ⛔ ALREADY DECIDED — the card went through this gate on an earlier run, so
+                    # the flow continues past it. Without this the next run would stamp a
+                    # finished card back to the review gate and hold it there again, forever:
+                    # a card could never leave a flow that runs on a schedule. Found by this
+                    # wave's own terminal-ending negative control, which is the argument for
+                    # writing the NC in the same change as the feature.
+                    continue
+                decided = ""
+                if cfg.get("decidedBy") == "ai" and ai_budget[0] > 0:
+                    ai_budget[0] -= 1
+                    decided = ai_decide(rt, defn, act, row, rid, log=log)
+                    if decided:
+                        counts["aiDecided"] += 1
+                        _act_row_patch(patches, table, rid,
+                                       {skey: decided, skey + "_at": stamp})
+                        row[skey] = decided
+                        continue                      # the AI moved it on — keep walking
+                _act_row_patch(patches, table, rid, {skey: label, skey + "_at": stamp})
+                row[skey] = label
+                counts["review"] += 1
+                return True
+        return False
+
+    held = []
+    if actions:
+        for rid in list(row_ids or [])[:FLOOD_LIMIT]:
+            row = dict(rows.get(str(rid)) or {})
+            if not row:
+                continue
+            if _walk(actions, row, str(rid)):
+                held.append(str(rid))
+    counts["cycles"] = _apply_ending(rt, defn, table, rows, patches, stages, routes, stamp)
+    _commit_action_writes(rt, table, patches, creates, username, log)
+    if held:
+        notify_review(rt, defn, held, log=log)
+    return counts
+
+
+#: C6 cap: AI decisions ONE run may make. A flow that suddenly matches 500 records must not turn
+#: into 500 paid calls before anybody notices — the rest simply wait for a human, which is the
+#: behaviour the feature degrades to everywhere else too.
+AI_DECISIONS_PER_RUN = 25
+
+
+def ai_decide(rt, defn, act, row, row_id="", log=print):
+    """R4/C6: let the model pick this card's next stage. Returns the chosen stage LABEL, or ""
+    to leave the card for a person.
+
+    ⛔ FAIL-CLOSED IN EVERY DIRECTION: no provider configured, a network failure, a malformed
+    answer, or a label the review does not offer all return "" — and "" means the card sits at
+    the review gate exactly as it would with no AI at all. The feature can be broken, absent or
+    wrong and the worst outcome is a human doing the work.
+    """
+    cfg = act.get("config") or {}
+    options = list(cfg.get("next") or [])
+    if not options:
+        return ""
+    try:
+        import ai_review
+    except Exception as e:                                            # noqa: BLE001
+        log(f"[aios-auto] ai review unavailable: {type(e).__name__}: {e}")
+        return ""
+    fields = [f.get("key") for f in
+              (ut_get(rt, ((defn.get("config") or {}).get("targetTable")
+                           or (defn.get("trigger") or {}).get("table") or "")) or {}
+               ).get("fields") or []]
+    choice, meta = ai_review.decide(prompt=cfg.get("prompt") or "", options=options,
+                                    row=row, fields=[f for f in fields if f],
+                                    label=cfg.get("label") or "Review")
+    if not choice:
+        if meta.get("problem"):
+            log(f"[aios-auto] ai review declined to answer: {meta['problem']}")
+        return ""
+    review_audit(rt, defn.get("id"), row_id, cfg.get("label") or "Review",
+                 choice, meta.get("provider") or "ai", by="ai",
+                 note=meta.get("reason") or "", model=meta.get("model") or "")
+    return choice
+
+
+def notify_review(rt, defn, row_ids, log=print):
+    """C6: one notification per RUN naming the count — never one per record.
+
+    A discovery pass that gates 300 candidates would otherwise put 300 rows in somebody's inbox
+    and the inbox would stop being read, which costs more than the notification gains. The board
+    is where the individual cards live; the bell says "there is work", once.
+    """
+    if not row_ids:
+        return
+    owner = str((defn or {}).get("createdBy") or "").strip()
+    if not owner:
+        return
+    n = len(row_ids)
+    try:
+        import core.alerts as alerts
+        alerts.notify(owner,
+                      f"{defn.get('name') or 'An automation'} — {n} "
+                      f"record{'' if n == 1 else 's'} waiting for review",
+                      topic="automation", key=str(defn.get("id") or ""), st=rt)
+    except Exception as e:                                            # noqa: BLE001
+        log(f"[aios-auto] review notification failed: {type(e).__name__}: {e}")
+
+
+def find_records(rt, table_key, cond, limit=25):
+    """The `find_records` action's read: matching row ids, bounded and DISCLOSED (the caller puts
+    the count in the run log, where it drills — [[no-unverifiable-aggregates]])."""
+    rows = (ut_get(rt, str(table_key or "")) or {}).get("rows") or {}
+    out = []
+    for rid, row in rows.items():
+        if lane_match(cond, row or {}):
+            out.append(str(rid))
+            if len(out) >= max(1, min(int(limit or 25), FIND_LIMIT_MAX)):
+                break
+    return out
+
+
+def _apply_ending(rt, defn, table, rows, patches, stages, routes, stamp):
+    """C5: send terminal cards back round, per the ending mode. Returns cycles started.
+
+    A RESET CLEARS THE STAMP rather than writing a start stage, so the card falls back to the
+    DERIVED bucket `_card_stage` would give a record that had never been stamped at all — which
+    is what "back to the first cycle" means, and it needs no opinion about which stage is first.
+    """
+    ending = ((defn or {}).get("flow") or {}).get("ending") or {}
+    mode = ending.get("mode") or "terminal"
+    if mode in ("terminal", "manual_reset"):
+        return 0
+    terminals = set(terminal_stage_ids(stages, routes))
+    if not terminals:
+        return 0
+    labels = {s["label"] for s in stages if s["id"] in terminals}
+    skey = stage_field_key(defn.get("id"))
+    cutoff = None
+    if mode == "timed_reset":
+        cutoff = _now() - _dt.timedelta(hours=int(ending.get("hours") or 24))
+    started = 0
+    for rid, row in rows.items():
+        merged = {**(row or {}), **((patches.get(table) or {}).get(str(rid)) or {})}
+        if str(merged.get(skey) or "").strip() not in labels:
+            continue
+        if cutoff is not None:
+            at = _parse_iso(str(merged.get(skey + "_at") or ""))
+            if at is None or at > cutoff:
+                continue
+        n = (_ig_int(merged.get(cycles_field_key(defn.get("id")))) or 0) + 1
+        _act_row_patch(patches, table, rid,
+                       {skey: "", skey + "_at": stamp,
+                        cycles_field_key(defn.get("id")): n})
+        started += 1
+    return started
+
+
+def _commit_action_writes(rt, table, patches, creates, username, log):
+    """The ONE write. Row patches merge into the target's rows; creates append to their own
+    tables through the ordinary cap-respecting path."""
+    if not patches and not creates:
+        return
+    for tkey, rowpatch in (patches or {}).items():
+        cur = dict((ut_get(rt, tkey) or {}).get("rows") or {})
+        for rid, vals in rowpatch.items():
+            cur[str(rid)] = {**(cur.get(str(rid)) or {}), **vals}
+        ut_write_rows(rt, tkey, cur)
+    for tkey, new_rows in (creates or {}).items():
+        t = ut_get(rt, tkey)
+        if t is None:
+            log(f"[aios-auto] create_record: {tkey} no longer exists — {len(new_rows)} skipped")
+            continue
+        cur = dict(t.get("rows") or {})
+        nxt = max([int(r) for r in cur if str(r).isdigit()] or [0]) + 1
+        cap = row_cap(tkey)
+        for vals in new_rows:
+            if len(cur) >= cap:
+                log(f"[aios-auto] create_record: {tkey} at its {cap}-row cap")
+                break
+            cur[str(nxt)] = dict(vals)
+            nxt += 1
+        ut_write_rows(rt, tkey, cur)
+
+
+def _lane_sentence(cond, top=True):
+    """One condition tree → the sentence the board and the field definition carry.
+
+    C4: a GROUP renders as its children joined by "and"/"or" and parenthesised when nested, so a
+    lane label never claims a flat comparison the tree does not make. The server composes it for
+    the same reason it composes every other stage `detail` — a client paraphrase of a structure
+    the engine evaluates is a second implementation of the same sentence, free to drift from it.
+    """
     if cond is None:
-        return "Everything else"
+        return "Everything else" if top else ""
+    if isinstance(cond, dict):
+        for key, joiner in (("all", " and "), ("any", " or ")):
+            if key in cond:
+                parts = [_lane_sentence(c, False) for c in cond.get(key) or []]
+                parts = [p for p in parts if p]
+                if not parts:
+                    return ""
+                inner = joiner.join(parts)
+                return inner if top or len(parts) == 1 else f"({inner})"
     v = cond.get("value")
     return f"{cond.get('field')} {cond.get('op')}" + ("" if v is None else f" {v}")
 
@@ -3527,14 +4273,27 @@ def ensure_stage_field(rt, table_key, defn, username="automation"):
                           "Declined": {"tracked": ""}}
     field = {"key": fkey, "label": f"Stage — {defn.get('name') or defn.get('id')}"[:80],
              "type": "select", "source": "overlay", "options": choices, "automation": auto}
-
-    have = None
+    # ⭐ WAVE 23 (C5, D-35's minimum) — THE CYCLE COLUMN, created beside the stage field when
+    # the flow can loop. The owner asked to SEE how many times a record has been round, and
+    # `_apply_ending` was writing the cell without anything ever declaring the column: the value
+    # would sit in the row, correct and invisible, because a ut grid renders the DEFINITION's
+    # fields. A machine-written cell with no field definition is the shape of a number nobody
+    # can find. Tagged `automation` so it greys out and refuses human writes like every other
+    # machine column (item 4 / R9).
+    cyc_key = cycles_field_key(defn.get("id"))
+    loops = (((defn.get("flow") or {}).get("ending") or {}).get("mode") or "terminal") != \
+        "terminal"
+    cyc_field = {"key": cyc_key, "label": "Cycles"[:80], "type": "int", "source": "overlay",
+                 "automation": {"flowId": str(defn.get("id") or ""), "cyclesField": True}}
+
+    have, have_cyc = None, False
     for f in (ut_get(rt, key) or {}).get("fields") or []:
         if f.get("key") == fkey:
             have = f
-            break
+        if f.get("key") == cyc_key:
+            have_cyc = True
     if have is not None and have.get("options") == choices and \
-            (have.get("automation") or {}) == auto:
+            (have.get("automation") or {}) == auto and have_cyc == loops:
         return fkey                                    # nothing would change — save the commit
 
     def _up(cur):
@@ -3547,8 +4306,14 @@ def ensure_stage_field(rt, table_key, defn, username="automation"):
                 f["options"] = choices
                 f["automation"] = auto
                 f["type"] = "select"
-                return cur
-        t["fields"].append(field)
+                break
+        else:
+            t["fields"].append(field)
+        if loops and not any(f.get("key") == cyc_key for f in t["fields"]):
+            t["fields"].append(cyc_field)
+        # ⚠ A flow switched BACK to `terminal` keeps its cycle column rather than dropping it:
+        # the counts already in those cells are a record of work that really happened, and a
+        # schema change must not be a way to lose data nobody asked to delete.
         return cur
 
     rt.update(UT_STORE_KEY, _up, flush="sync")
@@ -3732,12 +4497,24 @@ def move_card(rt, auto_id, row_id, to, username="", admin=False):
 MAX_REVIEWS = 100
 
 
-def review_audit(rt, auto_id, row_id, from_label, to_label, username):
+def review_audit(rt, auto_id, row_id, from_label, to_label, username,
+                 by="user", note="", model=""):
     """C3-A2(5): a review decision is AUDITED — who moved which card where, when. Appended to
     the definition (newest first, bounded) by BOTH doors: `move_card` here, and the grid door
-    in `core.grid_events`, which writes the same shape mechanically off the field's `flowId`."""
+    in `core.grid_events`, which writes the same shape mechanically off the field's `flowId`.
+
+    ⭐ WAVE 23 (R4/C6): an AI decision writes THE SAME ROW with `by: "ai"` plus the model that
+    made it and the one-line reason it gave. One audit log, not two — a reader asking "who
+    decided this card" must not have to know there are two places to look, and the moment an
+    AI decision is invisible beside a human one the log stops being an audit.
+    """
     entry = {"ts": _iso(), "user": _s(username, 80), "rowId": str(row_id),
-             "from": _s(from_label, 60), "to": _s(to_label, 60)}
+             "from": _s(from_label, 60), "to": _s(to_label, 60),
+             "by": "ai" if by == "ai" else "user"}
+    if note:
+        entry["note"] = _s(note, 300)
+    if model:
+        entry["model"] = _s(model, 60)
 
     def _up(cur):
         cur = cur if isinstance(cur, dict) else {}
@@ -3972,12 +4749,45 @@ def purge_subject(rt, handle):
 #     EVER (a high-water mark over row ids, so an undo-restored row cannot re-fire);
 #     event_field fires every transition.
 
-TRIGGER_KEYS = ("manual", "schedule", "event_field", "record_created", "webhook", "email")
+# ── WAVE 23 · C3 — the trigger vocabulary v2 (owner ruling R2). ───────────────────────────────
+# Airtable's phrasing, because the owner asked for Airtable's builder and a trigger list that
+# renames the same events is a second vocabulary to learn for no gain.
+#
+# ⚠ `event_field` KEPT ITS KEY and changed its LABEL to "When a record matches conditions".
+# Renaming the key would have orphaned every stored trigger in production for a caption; the key
+# is the contract with the store, the label is the contract with the reader, and they are allowed
+# to disagree. What genuinely widened is its SHAPE: the watched field is now OPTIONAL, so the
+# trigger covers Airtable's condition-only form (any write to the table, evaluated against a C4
+# tree) as well as wave 22's watch-one-field form. Both are the same edge rule underneath.
+#
+# ⛔ PLANNED ≠ STORABLE. `button_clicked` / `comment_added` ride the wire so the picker can show
+# them faded with a reason (R2: "never a dead control") — and `clean_trigger` REFUSES them with a
+# sentence. A vocabulary that renders an option the validator rejects is the wave-9 silent-drop
+# class wearing a friendlier face; here the two lists are separate on purpose and the refusal
+# names the state rather than pretending the key is unknown.
+TRIGGER_KEYS = ("manual", "schedule", "event_field", "record_updated", "record_created",
+                "enters_view", "webhook", "email", "form_submitted")
+TRIGGER_PLANNED = ("button_clicked", "comment_added")
 TRIGGER_LABELS = {
-    "manual": "Manual", "schedule": "On a schedule",
-    "event_field": "When a field changes", "record_created": "When a record is created",
-    "webhook": "When the webhook is called", "email": "When an email arrives",
+    "manual": "Manual",
+    "schedule": "At a scheduled time",
+    "event_field": "When a record matches conditions",
+    "record_updated": "When a record is updated",
+    "record_created": "When a record is created",
+    "enters_view": "When a record enters a view",
+    "webhook": "When a webhook is received",
+    "email": "When an email arrives",
+    "form_submitted": "When a form is submitted",
+    "button_clicked": "When a button is clicked",
+    "comment_added": "When a comment is added",
 }
+#: Triggers that watch a database and therefore need one named before they can fire.
+TRIGGER_TABLE_KEYS = ("event_field", "record_updated", "record_created", "enters_view",
+                      "form_submitted")
+#: Triggers the ROW HOOKS drive (as opposed to the tick, or an inbound HTTP call). Named once so
+#: `grid_hook` and the gates read the same list instead of two matching `in (...)` tuples.
+TRIGGER_ROW_KEYS = ("event_field", "record_updated", "record_created", "enters_view")
+MAX_WATCH_FIELDS = 12
 #: The settle window for field-change bursts (A2(1)). 0 evaluates INLINE — the gates run there,
 #: and so would a deployment that prefers immediacy over coalescing.
 EVENT_SETTLE_SECONDS = float(os.environ.get("AIOS_EVENT_SETTLE_SECONDS") or 15)
@@ -4016,6 +4826,11 @@ def clean_trigger(raw, previous=None):
     prev = previous if isinstance(previous, dict) else {}
     key = _s(raw.get("key") or raw.get("kind") or prev.get("key") or prev.get("kind"),
              30).strip()
+    if key in TRIGGER_PLANNED:
+        # Declared on the wire, refused at the door — see the TRIGGER_PLANNED note. The sentence
+        # says WHY rather than "unknown trigger", because the picker legitimately showed it.
+        return None, (f"{TRIGGER_LABELS[key]!r} is on the list but not built yet — "
+                      f"it renders so you can see it is coming, and it cannot be saved")
     if key not in TRIGGER_KEYS:
         return None, (f"{key or 'that trigger'!r} is not one of: " + ", ".join(TRIGGER_KEYS))
     if key in ("manual", "schedule"):
@@ -4026,40 +4841,51 @@ def clean_trigger(raw, previous=None):
            "enabled": bool(raw["enabled"]) if "enabled" in raw else
            bool(prev.get("enabled", True)),
            "paused": bool(raw["paused"]) if "paused" in raw else bool(prev.get("paused"))}
-    if key in ("event_field", "record_created"):
+    if key in TRIGGER_TABLE_KEYS:
         table = _s(raw.get("table") if "table" in raw else prev.get("table"), 60).strip()
         if table and not table.startswith(UT_PREFIX):
             return None, ("event triggers watch blank databases (ut_*) this wave — "
                           f"{table!r} is not one")
         out["table"] = table
     if key == "event_field":
-        fkey = _s(raw.get("field") if "field" in raw else prev.get("field"), 80).strip()
-        out["field"] = fkey
-        when_raw = raw.get("when") if "when" in raw else prev.get("when")
-        if when_raw in (None, ""):
-            out["when"] = None
+        # The watched field is OPTIONAL now (C3-v2): named ⇒ "when THIS field changes and the
+        # record matches"; unnamed ⇒ Airtable's plain "when a record matches conditions",
+        # evaluated on any write to the table. The condition is a C4 TREE over the WHOLE row —
+        # wave 22 could only test the written value, so it refused a condition on any other
+        # field; `_settle_eval` now reads the row itself, which is what lifted that restriction.
+        out["field"] = _s(raw.get("field") if "field" in raw else prev.get("field"), 80).strip()
+        cond, cerr = clean_cond(raw.get("when") if "when" in raw else prev.get("when"),
+                                where="the trigger")
+        if cerr:
+            return None, cerr
+        out["when"] = cond
+    if key == "record_updated":
+        # Airtable's shape: watch named fields, or leave the list empty for "any field". Empty
+        # is the WIDER reading and it is the default there too, so it stays the default here.
+        watch_raw = raw.get("fields") if "fields" in raw else prev.get("fields")
+        if watch_raw in (None, ""):
+            watch = []
+        elif not isinstance(watch_raw, list):
+            return None, "the watched-field list must be a list of field keys"
         else:
-            if not isinstance(when_raw, dict):
-                return None, "the trigger condition must be an object"
-            if not fkey:
-                return None, "name the watched field before adding a condition on it"
-            cf = _s(when_raw.get("field"), 80).strip() or fkey
-            if cf != fkey:
-                # The edge is evaluated over the WRITTEN value (see the section header); a
-                # condition on a different field would need a row image this evaluation does
-                # not have — refused with the reason, never quietly evaluated wrong.
-                return None, ("this wave a trigger condition tests the WATCHED field itself — "
-                              f"the condition names {cf!r} but the trigger watches {fkey!r}")
-            op = _s(when_raw.get("op") or when_raw.get("operator"), 20).strip()
-            if op not in LANE_OPS:
-                return None, f"{op or 'that comparison'!r} is not one of: " + ", ".join(LANE_OPS)
-            cond = {"field": fkey, "op": op}
-            if op not in LANE_NULLARY_OPS:
-                v = when_raw.get("value")
-                if v is None or (isinstance(v, str) and not v.strip()):
-                    return None, f"give a value to compare {fkey!r} against"
-                cond["value"] = v.strip() if isinstance(v, str) else v
-            out["when"] = cond
+            watch = [_s(f, 80).strip() for f in watch_raw if _s(f, 80).strip()]
+            if len(watch) > MAX_WATCH_FIELDS:
+                return None, (f"a record-updated trigger watches at most {MAX_WATCH_FIELDS} "
+                              f"fields — leave the list empty to watch every field")
+        out["fields"] = watch
+        cond, cerr = clean_cond(raw.get("when") if "when" in raw else prev.get("when"),
+                                where="the trigger")
+        if cerr:
+            return None, cerr
+        out["when"] = cond
+    if key == "enters_view":
+        out["viewId"] = _s(raw.get("viewId") if "viewId" in raw else prev.get("viewId"),
+                           80).strip()
+    if key == "form_submitted":
+        # Blank = any form on that database. Naming one narrows to it, which is what a table
+        # carrying an intake form AND a correction form needs.
+        out["formToken"] = _s(raw.get("formToken") if "formToken" in raw
+                              else prev.get("formToken"), 64).strip()
     if key == "webhook":
         # The token is MINTED here, once, and survives every later patch — rotating it on
         # every Save would silently break the external caller the URL was given to.
@@ -4067,12 +4893,26 @@ def clean_trigger(raw, previous=None):
     if key == "email":
         out["query"] = _s(raw.get("query") if "query" in raw else prev.get("query"),
                           200).strip() or "in:inbox is:unread"
-    out["configured"] = bool(
-        out.get("table")) if key == "record_created" else bool(
-        out.get("table") and out.get("field")) if key == "event_field" else True
+    out["configured"] = _trigger_configured(out)
     return out, None
 
 
+def _trigger_configured(trg):
+    """Is this trigger complete enough to fire? One reader, because "configured" is asserted in
+    three places (the wire, the graph node, the hooks) and three copies of a boolean is how a
+    surface says "ready" about a trigger the engine skips."""
+    key = str((trg or {}).get("key") or "")
+    if key in TRIGGER_TABLE_KEYS and not trg.get("table"):
+        return False
+    if key == "event_field":
+        # Neither a watched field nor a condition = "fire on anything, ever" — which is not a
+        # trigger, it is a description of the table. Refuse to call that configured.
+        return bool(trg.get("field") or trg.get("when"))
+    if key == "enters_view":
+        return bool(trg.get("viewId"))
+    return True
+
+
 def _secrets_token():
     import secrets as _sec
     return _sec.token_urlsafe(24)
@@ -4126,17 +4966,31 @@ _SETTLE = {}
 _SETTLE_LOCK = threading.Lock()
 
 
-def _settle_buffer(rt, tenant, auto_id, row_id, after, log=print):
+def _settle_buffer(rt, tenant, auto_id, row_id, field="", after=None, log=print):
+    """Buffer ONE touched row for a coalesced evaluation, carrying the written cell.
+
+    ⚠ WAVE 23 — THE WRITTEN VALUE IS STILL LOAD-BEARING, and an earlier draft of this wave
+    dropped it on the theory that `_settle_eval` could just read the row. It cannot, and the
+    reason is worth stating because it is invisible from this file: an ordinary ut cell typed at
+    the grid door lands in the editor's PER-USER OVERLAY stratum
+    (`grid_events.overlay_patch` → `table_store.patch_overlay`), not in the `user_tables`
+    definition rows. Only stage-field writes go through `patch_cells` to the shared rows. So for
+    the common case the value that just changed exists ONLY in this event, and a definition-row
+    read sees the pre-write value — the trigger would evaluate stale and never fire.
+    `_settle_eval` therefore MERGES: the definition row underneath (which is what lets a C4 tree
+    read the record's other columns) with the written cells on top.
+    """
     key = (tenant, str(auto_id))
+    cell = {str(field): after} if field else {}
     if EVENT_SETTLE_SECONDS <= 0:
         with _SETTLE_LOCK:
             buf = _SETTLE.setdefault(key, {"rows": {}})
-            buf["rows"][str(row_id)] = after
+            buf["rows"].setdefault(str(row_id), {}).update(cell)
         _settle_eval(rt, tenant, auto_id, log=log)
         return
     with _SETTLE_LOCK:
         buf = _SETTLE.setdefault(key, {"rows": {}})
-        buf["rows"][str(row_id)] = after
+        buf["rows"].setdefault(str(row_id), {}).update(cell)
         timer = buf.get("timer")
         if timer is not None:
             timer.cancel()                      # the burst continues — push the window out
@@ -4147,24 +5001,88 @@ def _settle_buffer(rt, tenant, auto_id, row_id, after, log=print):
         timer.start()
 
 
+def view_filter(rt, table_key, view_id):
+    """`(tree, fields, problem)` for one saved view on a user table — the substrate the
+    `enters_view` trigger tests membership against (C3-v2 / owner R2).
+
+    Personal strata first (`find_view`), then the shared bucket, because a view somebody shared
+    is exactly the kind an automation gets pointed at. A view that has been deleted answers a
+    PROBLEM rather than an empty tree: an empty tree matches everything, so degrading to one
+    would turn "when a record enters Overdue" into "on every write", which is the widening this
+    module refuses everywhere else.
+    """
+    key = str(table_key or "")
+    vid = str(view_id or "").strip()
+    if not key or not vid:
+        return None, [], "the trigger names no view"
+    try:
+        import core.table_store as table_store
+        tops = table_store.make(f"{key}_table_workspace", st=rt)
+        found = tops.find_view(vid)
+        view = (found[1] if found else None) or tops.shared_view(vid)
+    except Exception as e:                                            # noqa: BLE001
+        return None, [], f"the view could not be read ({type(e).__name__})"
+    if not isinstance(view, dict):
+        return None, [], f"view {vid!r} no longer exists on {key}"
+    cfg = view.get("config") or {}
+    tree = {"nodes": cfg.get("filters") or [], "conj": cfg.get("filterConj") or "and"}
+    return tree, list((ut_get(rt, key) or {}).get("fields") or []), ""
+
+
+def _row_gate(rt, defn, trg):
+    """The MATCH gate for a row-event trigger: `(row -> bool) | None`, plus a problem string.
+
+    None means the trigger has NO match gate — the write itself is the event (wave 22's "the
+    field changed", and `record_updated` over any field). A problem means the gate cannot be
+    built, and the caller must then fire NOTHING: a gate we cannot evaluate is not a gate that
+    passes.
+    """
+    key = trg.get("key")
+    if key == "enters_view":
+        tree, fields, problem = view_filter(rt, trg.get("table"), trg.get("viewId"))
+        if problem:
+            return None, problem
+        import harness.filter_eval as filter_eval
+        return (lambda row: filter_eval.matches(tree, row, fields)), ""
+    when = trg.get("when")
+    if when:
+        return (lambda row: lane_match(when, row)), ""
+    return None, ""
+
+
 def _settle_eval(rt, tenant, auto_id, log=print):
     """Evaluate one settled burst: edge over per-record armed state, flood hold, then fire."""
     with _SETTLE_LOCK:
         buf = _SETTLE.pop((tenant, str(auto_id)), None)
-    rows = (buf or {}).get("rows") or {}
-    if not rows:
+    written = dict((buf or {}).get("rows") or {})
+    touched = list(written)
+    if not touched:
         return
     d = all_definitions(rt).get(str(auto_id))
     trg = (d or {}).get("trigger") or {}
-    if trg.get("key") != "event_field" or trg.get("paused") or not trg.get("enabled", True):
+    if trg.get("key") not in ("event_field", "record_updated", "enters_view") \
+            or trg.get("paused") or not trg.get("enabled", True) \
+            or not trg.get("configured", True):
+        return
+    gate, problem = _row_gate(rt, d, trg)
+    if problem:
+        # LOUD, once, and it does not fire. A trigger pointed at a deleted view is a broken
+        # automation, not a quiet no-op — the note is what the surface shows instead of "On".
+        if (d.get("statusNote") or "") != problem:
+            _pause_trigger(rt, auto_id, problem)
+        log(f"[aios-auto] trigger gate: {auto_id} {problem}")
         return
-    when = trg.get("when")
     fired = []
-    if when:
+    if gate is not None:
+        rows = (ut_get(rt, trg.get("table") or "") or {}).get("rows") or {}
         disarmed = set((d.get("state") or {}).get("eventDisarmed") or [])
         nxt = set(disarmed)
-        for rid, after in rows.items():
-            if lane_match(when, {when.get("field"): after}):
+        for rid in touched:
+            # The merge (see `_settle_buffer`): the shared definition row underneath so a C4
+            # tree can read the record's other columns, the just-written cells on top because
+            # for an ordinary ut column this event is the ONLY place that value exists yet.
+            if gate({**(rows.get(rid) or rows.get(str(rid)) or {}),
+                     **(written.get(rid) or {})}):
                 if rid not in disarmed:
                     fired.append(rid)           # false→true THIS evaluation: the edge
                     nxt.add(rid)
@@ -4175,7 +5093,7 @@ def _settle_eval(rt, tenant, auto_id, log=print):
         if not fired:
             return
     else:
-        fired = list(rows)                       # "the field changed" — the burst is the edge
+        fired = list(touched)                    # "the field changed" — the burst is the edge
     if len(fired) > FLOOD_LIMIT:
         _commit_run(rt, auto_id, "partial",
                     f"the trigger matched {len(fired)} records in one evaluation — more than "
@@ -4188,14 +5106,21 @@ def _settle_eval(rt, tenant, auto_id, log=print):
 def _seed_event_state(rt, defn):
     """A2(1)'s enable rule: records ALREADY matching when the trigger is set start DISARMED, so
     turning the trigger on fires nothing — the first fire needs a real false→true transition.
-    Evaluated over the definition rows (the machine-written truth this trigger class watches)."""
+    Evaluated over the definition rows (the machine-written truth this trigger class watches).
+
+    Wave 23: one seeder for all three gated triggers, reading the SAME `_row_gate` the evaluation
+    reads. Two implementations of "does this row match" is how a seed disagrees with the edge it
+    is supposed to arm, and the symptom would be a flood of fires the moment somebody enables it.
+    """
     trg = (defn or {}).get("trigger") or {}
-    if trg.get("key") != "event_field" or not trg.get("when") or not trg.get("configured"):
+    if trg.get("key") not in ("event_field", "record_updated", "enters_view") \
+            or not trg.get("configured"):
         return
-    when = trg.get("when")
-    t = ut_get(rt, trg.get("table") or "")
-    matching = sorted(str(rid) for rid, row in ((t or {}).get("rows") or {}).items()
-                      if lane_match(when, {when.get("field"): (row or {}).get(trg.get("field"))}))
+    gate, problem = _row_gate(rt, defn, trg)
+    if gate is None or problem:
+        return                    # no match gate ⇒ nothing to arm; a broken gate seeds nothing
+    rows = (ut_get(rt, trg.get("table") or "") or {}).get("rows") or {}
+    matching = sorted(str(rid) for rid, row in rows.items() if gate(row or {}))
     set_state(rt, defn.get("id"), {"eventDisarmed": matching[:5000]})
 
 
@@ -4212,27 +5137,76 @@ def grid_hook(evt):
         table = str(evt.get("table") or "")
         kind = str(evt.get("type") or "")
         defs = all_definitions(st)
+        field = str(evt.get("field") or "")
+        rid = str(evt.get("rowId") or "")
         for aid, d in defs.items():
             trg = (d or {}).get("trigger") or {}
-            if trg.get("paused") or not trg.get("enabled", True):
+            key = str(trg.get("key") or "")
+            if trg.get("paused") or not trg.get("enabled", True) \
+                    or not trg.get("configured", True) \
+                    or key not in TRIGGER_ROW_KEYS \
+                    or str(trg.get("table") or "") != table:
                 continue
-            if kind == "record_created" and trg.get("key") == "record_created" \
-                    and str(trg.get("table") or "") == table:
-                rid = str(evt.get("rowId") or "")
+            if kind == "record_created" and key == "record_created":
                 hw = _ig_int((d.get("state") or {}).get("rcHighwater")) or 0
                 ridn = int(rid) if rid.isdigit() else None
                 if ridn is None or ridn <= hw:
                     continue                     # once per record EVER (A2(4)) — undo-proof
                 set_state(st, aid, {"rcHighwater": ridn})
                 trigger_fire(st, tenant, aid)
-            elif kind == "event_field" and trg.get("key") == "event_field" \
-                    and str(trg.get("table") or "") == table \
-                    and str(trg.get("field") or "") == str(evt.get("field") or ""):
-                _settle_buffer(st, tenant, aid, str(evt.get("rowId") or ""), evt.get("after"))
+            elif kind == "event_field" and key == "event_field" and (
+                    not trg.get("field") or str(trg.get("field")) == field):
+                # A NAMED field narrows to writes on it (wave 22's shape); an unnamed one is
+                # Airtable's plain condition trigger and watches every column.
+                _settle_buffer(st, tenant, aid, rid, field, evt.get("after"))
+            elif kind == "event_field" and key == "record_updated" and (
+                    not (trg.get("fields") or []) or field in (trg.get("fields") or [])):
+                _settle_buffer(st, tenant, aid, rid, field, evt.get("after"))
+            elif key == "enters_view":
+                # BOTH kinds feed it: a row can enter a view by being edited into its filter or
+                # by being CREATED already inside it. Listening only to edits would silently miss
+                # every new record — the half of the definition a reader assumes is covered.
+                _settle_buffer(st, tenant, aid, rid, field, evt.get("after"))
     except Exception as e:                                        # noqa: BLE001
         print(f"[aios-auto] trigger hook failed: {type(e).__name__}: {e}")
 
 
+def form_fired(rt, table_key, row_id, values=None, form_token=""):
+    """⭐ THE FROZEN SIGNATURE session D calls from the public form door (contract C9/W23-W7).
+
+    One submitted form row → every `form_submitted` automation watching that database fires.
+    Returns the list of automation ids that started, so the door can log what it set off (and so
+    the gate can assert it, rather than asserting a side effect nobody can see).
+
+    ⛔ THIS IS A HUMAN DOOR, deliberately: an anonymous submission is a person filling in a form,
+    so it fires triggers exactly like typing into a cell does. The loop-prevention law is not
+    weakened by that — the engine's own writers still never reach here (only `routes_forms` calls
+    it), so an automation cannot create a form row and re-fire itself.
+
+    `values` is accepted and unused today: the row is already written when this is called, and
+    the flow reads it from the table. It stays in the signature because the caller HAS it and a
+    later refire policy ("only when field X was submitted") needs it — a parameter added later
+    would mean changing D's call site in a wave that does not own it.
+    """
+    started, table = [], str(table_key or "")
+    if not table:
+        return started
+    tenant = str(getattr(rt, "key", "") or "royal-imports")
+    for aid, d in all_definitions(rt).items():
+        trg = (d or {}).get("trigger") or {}
+        if trg.get("key") != "form_submitted" or trg.get("paused") \
+                or not trg.get("enabled", True) or not trg.get("configured", True):
+            continue
+        if str(trg.get("table") or "") != table:
+            continue
+        want = str(trg.get("formToken") or "")
+        if want and not hmac.compare_digest(want, str(form_token or "")):
+            continue                    # this automation watches a DIFFERENT form on that table
+        if trigger_fire(rt, tenant, aid):
+            started.append(aid)
+    return started
+
+
 def hook_fire(rt, tenant, auto_id, token):
     """The webhook trigger's decision, separated from FastAPI so the gate can drive it.
     Returns `(status, payload)` — 404 unknown, 403 wrong/missing token or wrong trigger kind,
@@ -4393,6 +5367,27 @@ def run_now(rt, tenant, auto_id, username="automation", log=print):
             log(f"[aios-auto] run {auto_id} failed: {type(e).__name__}: {e}")
             return _commit_run(rt, auto_id, "error",
                                f"{type(e).__name__}: {str(e)[:200]}", {}, False)
+        # ⭐ WAVE 23 (C4/C5) — THE FLOW RUNS HERE, after the machine steps and before the run is
+        # committed, over the records this run actually touched. ONE call site rather than three
+        # inside the runners: every kind gets actions and endings for free, and a fourth runner
+        # cannot forget to opt in.
+        #
+        # ⚠ Its absence was the wave's most expensive near-miss: actions were stored, validated,
+        # wired to the wire and covered by twelve gate checks that all called `apply_actions`
+        # DIRECTLY — so the whole feature was green and unreachable. A person would have built a
+        # flow, pressed Run now, and watched nothing happen. The gate now drives `run_now`.
+        #
+        # A failing action must not fail the RUN: the machine steps already wrote their rows and
+        # reporting that as an error would misdescribe what happened. It degrades to `partial`
+        # with the reason in the summary — the cap_note discipline.
+        try:
+            a_counts = apply_actions(rt, defn, _flow_table(defn), affected or [],
+                                     username=username, log=log)
+            counts = {**(counts or {}), **{k: v for k, v in a_counts.items() if v}}
+        except Exception as e:                                    # noqa: BLE001
+            log(f"[aios-auto] actions on {auto_id} failed: {type(e).__name__}: {e}")
+            state = "partial" if state != "error" else state
+            summary = f"{summary} — the actions did not finish ({type(e).__name__})"
         return _commit_run(rt, auto_id, state, summary, counts, state != "error", affected,
                            steps)
     finally:

api/main.py

@@ -71,6 +71,9 @@ import routes_records  # noqa: E402
 import routes_shares  # noqa: E402  (wave 20 R10 — grants for views, folders and databases)
 import routes_uploads  # noqa: E402  (wave 21 C5 — tabular preview for Select-from-file)
 import routes_tables  # noqa: E402  (wave 18 C3-UT — user-created databases over the wire)
+import routes_connectors  # noqa: E402  (wave 23 C11 — the connectors directory; SESSION A's router)
+import routes_forms  # noqa: E402  (wave 23 C9 — the PUBLIC form door; SESSION D's router)
+import routes_templates  # noqa: E402  (wave 23 C12 — template apply doors; SESSION E's router)
 from core import grid_events  # noqa: E402
 from deps import Session, module_gate  # noqa: E402
 
@@ -202,6 +205,24 @@ app.include_router(routes_platform_admin.router)
 app.include_router(routes_alerts.router)
 app.include_router(routes_shares.router)
 app.include_router(routes_uploads.router)
+# ⭐ WAVE 23 — THE THREE NEW ROUTERS. Mounted here, above the static catch-all at the bottom of this
+# file, because `app.mount("/", _AppStatic(...), html=True)` swallows everything it is reached by:
+# a router included AFTER it answers 404 forever while importing fine, type-checking fine and
+# passing its own gate. That is the wave-20 declared-but-unmounted shape with a different cause.
+#
+# ⛔ ALL THREE EXISTED, COMPLETE AND GATED, WITH NO MOUNT until the close-out audit — three finished
+# features that would have shipped dead. The workers each posted a mount ask and said they would
+# signal "ready" first; C waited for a signal that never came while the files landed anyway. **The
+# lesson is not "read the mailbox harder": `verify_api`'s enumeration is what caught it, so the
+# control is that the enumeration must NAME every router in this file.**
+app.include_router(routes_templates.router)   # item 7 / C12 — template registry, session-gated
+app.include_router(routes_connectors.router)  # item 10 / C11 — the connectors directory
+# ⚠ routes_forms is the FIRST NEW PUBLIC DOOR since the `_DEV_FIXTURES` scar (see :257 below). Its
+# two paths are DELIBERATELY unauthenticated — a form is filled in by someone with no account — so
+# it joins `/api/health`, the automation hook and the tick on the exempt list. It resolves a token
+# by scanning tenants with a constant-time compare and answers a uniform 403, so a bad token cannot
+# distinguish "no such form" from "not yours", and it never echoes a tenant, table or slug.
+app.include_router(routes_forms.router)       # item 8 / C9 — the PUBLIC form door
 
 
 # --- DEPRECATED ALIASES (removed when S2's shell flips; kept so the current bundle keeps working)

api/routes_automation.py

@@ -26,6 +26,11 @@ router = APIRouter(prefix="/api/v1")
 # C5 (wave 22): the OAuth connector surface rides INSIDE this router — main.py belongs to no
 # session this wave, and this router is already mounted there. `/api/v1` + `/oauth/...`.
 router.include_router(routes_oauth.router)
+# ⭐ WAVE 23 (C11): the connectors directory rides this router for the same reason the OAuth
+# routes do — it is mounted already, so E's page needs no main.py change to reach it. (C still
+# owns main.py; this avoids an unnecessary ask across a fence.)
+import routes_connectors                                             # noqa: E402
+router.include_router(routes_connectors.router)
 
 #: The registry key this surface carries (C-AUTONAV — A adds the row; the gate is live now, so
 #: the day the row lands the wall is already the one that was tested).
@@ -66,13 +71,27 @@ def _wire(defn, tenant):
         # client, for the same reason `cronPresets` does: the engine that RUNS the steps is the
         # only thing entitled to say what the steps are.
         "graph": engine.graph(defn),
+        # ⭐ WAVE 23 (C4/C5) — THE BUILDER'S OWN STATE, and its absence here was a silent-drop
+        # bug caught in review rather than by a gate: `flow` was stored, patchable and validated,
+        # but never sent back. B would have saved a flow through PATCH, got a 200, and watched
+        # every action vanish on reload — the classic "it didn't save" with nothing red anywhere.
+        # Defaulted rather than conditional so a pre-wave definition reads as an empty flow with
+        # a terminal ending instead of `undefined`, which the client would have to special-case.
+        "flow": defn.get("flow") or {"actions": [], "ending": {"mode": "terminal"}},
     }
 
 
 def _triggers_vocab(session):
-    """C3's server-owned trigger list: `[{key, label, ready, needs}]`, keys EXACTLY
-    `engine.TRIGGER_KEYS`. `ready:false` + `needs` renders as a not-configured state — never a
-    dead control, never a client-side union."""
+    """C3's server-owned trigger list: `[{key, label, ready, needs, planned}]`, keys EXACTLY
+    `engine.TRIGGER_KEYS` + `engine.TRIGGER_PLANNED`. `ready:false` + `needs` renders as a
+    not-configured state — never a dead control, never a client-side union.
+
+    ⭐ WAVE 23 (R2): the list is the WHOLE Airtable-parity vocabulary, and the two triggers we
+    have not built ride it with `planned: true`. That is the honest version of "show all, wire
+    eight": the picker paints them faded with a reason instead of a shorter list that quietly
+    implies the missing ones do not exist. `clean_trigger` refuses them, so the faded state is
+    enforced at the door and not merely in the client's `disabled` attribute.
+    """
     tick_on = _tick_state()["enabled"]
     g = oauth_connect.status(session.runtime, session.uname).get("google") or {}
     email_ready = bool(g.get("configured")) and bool(g.get("connected")) \
@@ -83,14 +102,18 @@ def _triggers_vocab(session):
         "manual": (True, ""),
         "schedule": (tick_on, "" if tick_on else "arm_tick"),
         "event_field": (True, ""),
+        "record_updated": (True, ""),
         "record_created": (True, ""),
+        "enters_view": (True, ""),
         "webhook": (True, ""),
         "email": (email_ready, email_needs),
+        "form_submitted": (True, ""),
     }
     out = []
     for k in engine.TRIGGER_KEYS:
         ready, needs = per[k]
         row = {"key": k, "label": engine.TRIGGER_LABELS[k], "ready": ready, "needs": needs,
+               "planned": False,
                # A3(3): the connect affordance is SERVER-COMPOSED — the client never maps a
                # `needs` token to a route, so B's CONNECT_PROVIDERS shim deletes itself.
                "connect": None}
@@ -98,9 +121,23 @@ def _triggers_vocab(session):
             row["connect"] = {"provider": "google",
                               "startUrl": "/api/v1/oauth/google/start"}
         out.append(row)
+    for k in engine.TRIGGER_PLANNED:
+        out.append({"key": k, "label": engine.TRIGGER_LABELS[k], "ready": False,
+                    "needs": "coming_soon", "planned": True, "connect": None})
     return out
 
 
+def _ai_ready():
+    """Can an AI review actually decide on this deployment? (C6/R14.) A boolean, never the
+    provider list and never a key — the surface needs to say "not configured" honestly, and that
+    needs exactly one bit."""
+    try:
+        import ai_review
+        return bool(ai_review.configured())
+    except Exception:                                             # noqa: BLE001
+        return False
+
+
 def _tick_state():
     """⭐ WAVE 21 (C6 amendment A1) — can a SCHEDULE fire on this deployment?
 
@@ -167,6 +204,28 @@ def list_automations(session: Session = Depends(_GATE)):
                       "nullaryLaneOps": list(engine.LANE_NULLARY_OPS),
                       "maxLanes": engine.MAX_LANES,
                       "cardCap": engine.BOARD_CARD_CAP},
+            # ⭐ WAVE 23 C4 (R3) — the ACTION MENU, including what we have not built. Each row
+            # carries `ready`, so B paints "Send email" and "Run script" faded with the server's
+            # own reason instead of omitting them — the owner asked for Airtable's full menu, and
+            # a shorter list would imply those actions do not exist. `clean_actions` REFUSES an
+            # unready kind, so the faded state is a wall rather than a styling choice.
+            "actionsCatalog": engine.action_catalog(),
+            # The builder's own vocabulary: how deep a condition tree may nest, how deep groups
+            # may nest, and the ceilings. B reads these instead of hard-coding the same numbers
+            # into its "+ Add condition" affordance.
+            "flow": {"condOps": list(engine.LANE_OPS),
+                     "nullaryCondOps": list(engine.LANE_NULLARY_OPS),
+                     "maxCondDepth": engine.MAX_COND_DEPTH,
+                     "maxCondChildren": engine.MAX_COND_CHILDREN,
+                     "maxGroupDepth": engine.MAX_GROUP_DEPTH,
+                     "maxActions": engine.MAX_ACTIONS,
+                     "endingModes": list(engine.ENDING_MODES),
+                     "maxResetHours": engine.MAX_RESET_HOURS,
+                     "reviewDeciders": list(engine.REVIEW_DECIDERS),
+                     # Honest, per-deployment: with no LLM key configured the AI-review option
+                     # renders as not-configured rather than as a control that silently holds
+                     # every card for a human (C6's fail-closed path, made visible).
+                     "aiReady": _ai_ready()},
             # Wave 21 C6-A1: {"enabled": bool, "source": "in-process"|"external"|""} — see
             # `_tick_state` for why one boolean off AIOS_AUTOMATIONS alone would lie.
             "tick": _tick_state()}
@@ -244,6 +303,10 @@ def get_automation(auto_id: str, session: Session = Depends(_GATE)):
 
 @router.post("/automations")
 def create_automation(body: dict = Body(default=None), session: Session = Depends(_GATE)):
+    """Create an automation. ⭐ WAVE 23 (C2): the body may carry
+    `target: {mode: "existing"|"new"|"automated", table?, label?}` — the wizard's FIRST question,
+    answered before the kind. `new` mints the blank database in the same call, so the automation
+    is never saved pointing at a table that does not exist yet."""
     if not session.runtime.available():
         raise err(503, "store_unavailable", "the tenant store is unavailable — nothing was saved")
     defn, error = engine.create(session.runtime, body or {}, username=session.uname)

api/routes_connectors.py

@@ -0,0 +1,176 @@
+"""THE CONNECTORS DIRECTORY (wave 23, contract C11 / owner ruling R8).
+
+⭐ WHAT THE OWNER ASKED FOR, verbatim: *"Build a connector module where it stores everything… BUT
+if its not yet integrated make it faded grey or something so i can use it as a to-do list for
+integrations."* So this endpoint deliberately answers with things we have NOT built. A directory
+that listed only working connectors would be honest about each row and dishonest about the shape
+of the product — the owner wants to see the map, including the empty parts.
+
+⛔ THE ROW SET IS COMPOSED HERE, ONCE, FROM THE REGISTRIES THAT ALREADY EXIST — the OAuth
+provider registry (`oauth_connect.PROVIDERS`), the keychain's entry types, the automation source
+registry, and the env-configured built-ins. It is NOT a hand-written list of cards. That matters
+because the alternative rots in a specific way: a provider gets wired up somewhere and the
+directory keeps calling it "planned" for a wave or two, which is exactly the misinformation this
+surface exists to prevent. The only hand-written part is `PLANNED` — the things that have no
+registry entry anywhere yet, which is precisely what "not yet integrated" means.
+
+⚠ STATE IS PER-READER. `connected` is a fact about THIS user for a per-user credential (OAuth
+slots are per-user by R7) and about the tenant for a shared one (Odoo, Bright Data). A directory
+that reported another user's Gmail as "connected" would be both wrong and a small disclosure.
+"""
+from __future__ import annotations
+
+import os
+
+from fastapi import APIRouter, Depends
+
+import oauth_connect
+from deps import Session, require_session
+
+# ⛔ THE PREFIX IS LOAD-BEARING AND IT WAS MISSING (found at the wave-23 close-out audit).
+# This router declared a bare `APIRouter()`, so its one path was served at `/connectors/directory`
+# while `ConnectorsPage.tsx` fetches `${API_V1}/connectors/directory` — the directory would have
+# 404'd in production with every gate green. Every other router in this package self-declares
+# `prefix="/api/v1"`; this was the only one that did not.
+#
+# ⚠ AND THE WIRING GATE COULD NOT SEE IT. `verify_wiring`'s W23-W4 row matches the SERVER side on
+# the substring `connectors/directory` and the CLIENT side on `${API_V1}/connectors/directory` —
+# both matched, both sides "wired", prefixes disagreeing. A cross-fence row that greps each side
+# independently proves the two files mention the same path SEGMENT, never that they agree on the
+# same URL. `verify_api` now asserts the prefix on every mounted router instead.
+router = APIRouter(prefix="/api/v1")
+
+#: The to-do list (R8). Order is the owner's reading order, not alphabetical: the things most
+#: likely to come next first. `queue` mirrors the standing provider queue in wave22-split C5-A2
+#: so the two cannot drift into disagreeing about what is coming.
+PLANNED = [
+    {"key": "slack", "label": "Slack", "kind": "oauth",
+     "desc": "Send messages into a channel when an automation reaches a step."},
+    {"key": "airtable", "label": "Airtable", "kind": "oauth",
+     "desc": "Import an existing base as a database."},
+    {"key": "outlook", "label": "Microsoft Outlook", "kind": "oauth",
+     "desc": "The Outlook half of the email trigger."},
+    {"key": "quickbooks", "label": "QuickBooks", "kind": "oauth",
+     "desc": "Accounting actuals beside the Odoo sales data."},
+    {"key": "xero", "label": "Xero", "kind": "oauth",
+     "desc": "Accounting actuals for tenants who do not use QuickBooks."},
+    {"key": "google_sheets", "label": "Google Sheets", "kind": "oauth",
+     "desc": "Read a sheet as a database; the Google connection already exists."},
+    {"key": "google_drive", "label": "Google Drive", "kind": "oauth",
+     "desc": "Attach files from Drive to records."},
+    {"key": "google_calendar", "label": "Google Calendar", "kind": "oauth",
+     "desc": "Turn dated records into calendar entries."},
+    {"key": "tiktok", "label": "TikTok", "kind": "token",
+     "desc": "The second social source beside Instagram."},
+    {"key": "meta", "label": "WhatsApp and Instagram (Meta)", "kind": "oauth",
+     "desc": "Blocked on Meta business verification; Instagram data comes via Bright Data."},
+]
+
+#: Token connectors an admin can wire up TODAY by pasting a key — no OAuth client, no app review.
+TOKEN_CONNECTORS = [
+    {"key": "stripe", "label": "Stripe", "entry": "stripe",
+     "desc": "Payments and payouts against your customer records.",
+     "hint": "Create a restricted key with read access in the Stripe dashboard."},
+    {"key": "shopify", "label": "Shopify", "entry": "shopify",
+     "desc": "Orders and products from a Shopify storefront.",
+     "hint": "Create a custom app in your store admin and copy its Admin API token."},
+]
+
+
+def _entry_types(rt):
+    """Which keychain entry types this tenant has actually stored. One read, and it never raises
+    — a LOCKED keychain must degrade to "nothing connected", never to a 500 on a page whose whole
+    job is to tell you what is connected."""
+    try:
+        import core.keychain as kc
+        return {str(e.get("type") or "") for e in (kc.list_entries(rt) or [])}
+    except Exception:                                             # noqa: BLE001
+        return set()
+
+
+def directory(rt, uname, is_admin=False):
+    """The composed row set. Pure over the session, so the gate drives it without a request."""
+    rows = []
+    have = _entry_types(rt)
+
+    # --- Odoo: the reference connector. Env credentials are tenant #0's only (the R3 rule), so
+    # a stored keychain entry is what makes it connected for anybody else.
+    rows.append({
+        "key": "odoo", "label": "Odoo", "kind": "builtin",
+        "desc": "Sales, invoices, products and customers from your Odoo ERP.",
+        "state": "connected" if ("odoo" in have or os.environ.get("ODOO_URL")) else "available",
+        "manage": "keychain" if is_admin else "",
+    })
+
+    # --- OAuth providers, straight off the registry (so a new entry appears here for free).
+    st = oauth_connect.status(rt, uname)
+    for slug, meta in oauth_connect.PROVIDERS.items():
+        row_st = st.get(slug) or {}
+        rows.append({
+            "key": slug, "label": meta.get("label") or slug.title(), "kind": "oauth",
+            "desc": "Gmail for the email trigger; the same connection unlocks Sheets, Drive "
+                    "and Calendar later." if slug == "google" else "",
+            # THREE distinct states, and the distinction is the point: a provider nobody has
+            # configured on this deployment is not the same as one this user has not connected,
+            # and until now both rendered identically (the C11 status() gap).
+            "state": ("connected" if row_st.get("connected") and not row_st.get("reconnect")
+                      else "reconnect" if row_st.get("reconnect")
+                      else "available" if row_st.get("configured")
+                      else "unconfigured"),
+            "connectedAs": row_st.get("email") or "",
+            "startUrl": f"/api/v1/oauth/{slug}/start",
+            "manage": "oauth",
+            "needs": "" if row_st.get("configured") else "the owner registers the client",
+        })
+
+    # --- Token connectors (R8): connectable today, and honest that data flows arrive later.
+    for t in TOKEN_CONNECTORS:
+        rows.append({
+            "key": t["key"], "label": t["label"], "kind": "token", "desc": t["desc"],
+            "hint": t["hint"],
+            "state": "connected" if t["entry"] in have else "available",
+            "manage": "keychain" if is_admin else "",
+            # Said once, on the row, rather than in a paragraph somewhere (R13): storing the key
+            # is real and useful, and it is not the same as the data being on screen.
+            "note": "Storing the key connects the account; reading its data lands in a later "
+                    "release.",
+        })
+
+    # --- Built-ins that are configuration, not credentials.
+    import automation_engine as _eng
+    rows.append({
+        "key": "brightdata", "label": "Bright Data", "kind": "builtin",
+        "desc": "Instagram profile and post capture for the discovery automations.",
+        "state": "connected" if _eng.bd_ready() else "unconfigured",
+        "needs": "" if _eng.bd_ready() else "AIOS_BRIGHTDATA_KEY is not set on this deployment",
+        "manage": "",
+    })
+    rows.append({
+        "key": "webhooks", "label": "Webhooks", "kind": "builtin",
+        "desc": "Let another system start an automation by calling a URL.",
+        "state": "connected", "manage": "automation",
+    })
+
+    for p in PLANNED:
+        rows.append({**p, "state": "planned",
+                     "needs": "not built yet", "manage": ""})
+    return rows
+
+
+@router.get("/connectors/directory")
+def connectors_directory(session: Session = Depends(require_session)):
+    """C11: every connector this platform knows about, with its state for THIS reader.
+
+    Session-gated rather than admin-gated on purpose: a non-admin should be able to see what the
+    workspace is connected to (and connect their OWN per-user accounts, which is the whole point
+    of R7's per-user slots). `manage` is what carries admin-ness — it is empty for a non-admin,
+    so the client renders the card without an action rather than offering a door that 403s.
+    """
+    # ⚠ `session.admin`, NOT `is_admin`. A `getattr(session, "is_admin", False)` here reads as
+    # careful and is silently False for every admin on earth — the manage actions would simply
+    # never appear, with nothing to catch it. Attribute name checked against `deps.Session`.
+    rows = directory(session.runtime, session.uname, bool(session.admin))
+    return {"connectors": rows,
+            "counts": {"connected": sum(1 for r in rows if r["state"] == "connected"),
+                       "available": sum(1 for r in rows if r["state"] == "available"),
+                       "planned": sum(1 for r in rows if r["state"] == "planned")}}

api/routes_forms.py

@@ -0,0 +1,399 @@
+"""routes_forms.py — ⭐ wave-23 item 8 (contract W23-C9): THE PUBLIC FORM DOOR.
+
+⛔ BOTH ROUTES HERE ARE UNAUTHENTICATED, AND THAT IS THE POINT. A form link goes to somebody who
+has no account — a supplier, a lead, a warehouse hand with a phone — so `Depends(require_session)`
+is exactly what must NOT be on them. Everything that would normally be decided by a session is
+therefore decided by the TOKEN, and this file is the whole of that decision:
+
+  * the token is minted server-side (`secrets.token_urlsafe(24)` — 192 bits) and stored on ONE
+    view. There is no enumeration to brute-force and no id in the URL to increment.
+  * a wrong token answers ONE thing for every tenant, every table and every typo: 403
+    `bad_form_token`. It never leaks whether a form exists, whether a tenant exists, or which of
+    the two you got wrong — the automation-hook pattern (`routes_automation.py:359-381`) one
+    level up, because a public door that answers 404-vs-403 is an oracle.
+  * the payload a valid token buys is the SMALLEST thing that can render a form: title,
+    description, submit label, and the fields with their labels, types and options. No tenant
+    slug, no table key, no row count, no field key that is not on the form, no username.
+
+WHAT AN ATTACKER WITH A VALID TOKEN CAN DO, stated plainly because it is the honest boundary:
+append rows to ONE user table, up to the per-token daily cap, with values that pass this file's
+validation. They cannot read a row, cannot see any other field, cannot reach another table, and
+cannot cause an automation to run as anybody (`form_fired` is a HUMAN door by A's design — see
+its contract note in the split doc).
+
+⚠ THE `_DEV_FIXTURES` AUDIT (main.py:257-295) applied to this router, because that scar is
+exactly "a thing became publicly reachable and nobody looked": the only bytes these routes can
+return are the ones assembled in `_public_form` below, field by field. There is no passthrough of
+a stored dict anywhere in this file — every response is built from named keys.
+
+⚠ PROTECTIONS ARE IN-PROCESS AND THEREFORE PER WORKER. One Space process today, so the sliding
+window is real; the day there are two, both halves of a limit are halved-per-worker rather than
+bypassed. Booked as DEBT rather than described as a guarantee — a rate limit that quietly stops
+being one is worse than none.
+"""
+import hmac
+import secrets
+import time
+
+from fastapi import APIRouter, Request
+
+from deps import err
+
+router = APIRouter(prefix="/api/v1")
+
+#: The mint. 24 bytes url-safe = 32 characters, 192 bits — the same shape the automation hook's
+#: per-automation token uses, so there is ONE token strength in the product rather than two.
+TOKEN_BYTES = 24
+
+#: The honeypot's field name. It is rendered by `FormPublic.tsx` as a real input, visually
+#: hidden and `autocomplete="off"` + `tabIndex={-1}` — a human never sees it and a keyboard user
+#: never lands on it, so anything that fills it is a script walking the DOM. ⚠ Named for
+#: something a bot WANTS to fill; a field called `honeypot` is one `if` away from being skipped.
+HONEYPOT_FIELD = "website_url"
+
+#: v1 request protections (contract C9). Per IP and per token respectively.
+RATE_WINDOW_S = 60
+RATE_PER_WINDOW = 30
+DAILY_PER_TOKEN = 500
+MAX_BODY_BYTES = 16 * 1024
+#: One text answer's ceiling. Generous for a paragraph, far below the body cap, and it exists so
+#: a single 15 KB answer cannot be smuggled past a body check that only measures the whole.
+MAX_VALUE_LEN = 4000
+
+#: `{ip: [timestamps]}` and `{token: (day, count)}`. Module-level and unbounded-by-design within
+#: a day: an IP list is pruned to the window on every touch, and the token map holds one small
+#: tuple per form that was submitted to today.
+_HITS: dict = {}
+_DAILY: dict = {}
+
+
+def _rate_ok(ip: str, now: float) -> bool:
+    """A sliding window, not a fixed bucket. A fixed one lets a caller spend the whole allowance
+    at 11:59:59 and the whole next allowance at 12:00:00 — double the rate at the boundary,
+    which is the moment a script is most likely to be hammering."""
+    seen = [t for t in _HITS.get(ip, ()) if now - t < RATE_WINDOW_S]
+    seen.append(now)
+    _HITS[ip] = seen
+    # ⚠ Prune the WHOLE map occasionally, or a process that has served a million IPs holds a
+    # million lists forever. Cheap and amortised: only when the map is already large.
+    if len(_HITS) > 4096:
+        for k in [k for k, v in _HITS.items() if not v or now - v[-1] > RATE_WINDOW_S]:
+            _HITS.pop(k, None)
+    return len(seen) <= RATE_PER_WINDOW
+
+
+def _daily_ok(token: str, now: float) -> bool:
+    day = int(now // 86400)
+    d, n = _DAILY.get(token, (day, 0))
+    if d != day:
+        d, n = day, 0
+    n += 1
+    _DAILY[token] = (d, n)
+    return n <= DAILY_PER_TOKEN
+
+
+def _client_ip(request: Request) -> str:
+    """⚠ `X-Forwarded-For`'s FIRST entry, and only because this app runs behind exactly one
+    proxy (the HF Space router). It is caller-controlled, so it is a rate-limit key and NOTHING
+    else — never a permission input. Falls back to the socket peer."""
+    fwd = request.headers.get("x-forwarded-for") or ""
+    first = fwd.split(",")[0].strip()
+    return first or (request.client.host if request.client else "?")
+
+
+def _refuse():
+    """THE ONE REFUSAL. Every failure to resolve a token answers this — wrong token, disabled
+    form, deleted view, deleted table, a tenant whose store is down. Callers must not branch a
+    more specific message out of it: the difference between "no such form" and "that form is
+    disabled" tells an enumerator which tokens are real."""
+    return err(403, "bad_form_token", "that form link is not valid")
+
+
+def _same(a: str, b: str) -> bool:
+    """Constant-time. A `==` here leaks a token's prefix through timing, one character at a
+    time, which is the whole reason the automation hook compares this way too."""
+    return hmac.compare_digest(str(a or ""), str(b or ""))
+
+
+# --- resolution ------------------------------------------------------------------------------
+#
+# ⚠ A FULL SCAN, deliberately, and its cost is BOOKED (DEBT — "the form-token index"). The
+# automation hook resolves the same way (`routes_automation.py:370` walks `known_tenants()`)
+# because the alternative — a global token→tenant map — is a second index that has to be written
+# on every mint, regenerate, view delete and table delete, and an index that misses one of those
+# is a live form that answers 403 or, far worse, a dead token that still resolves. With one
+# process, a handful of tenants and a 30/min ceiling in front of it, the scan is affordable; the
+# index becomes worth its risk when either number grows.
+
+
+def _iter_form_views(rt):
+    """Yield `(table_key, view_id, form_spec)` for every form-enabled view in one tenant.
+
+    A form spec lives at `view.config.display.form` and carries the token — see W23-C9. Reads
+    only; nothing here writes, so a malformed stratum is skipped rather than repaired.
+    """
+    import core.user_tables as user_tables
+
+    try:
+        tables = user_tables.all_tables(st=rt) or {}
+    except Exception:                                             # noqa: BLE001
+        return
+    for key in list(tables):
+        try:
+            bucket = rt.get(f"{key}_table_workspace") or {}
+        except Exception:                                         # noqa: BLE001
+            continue
+        if not isinstance(bucket, dict):
+            continue
+        for ws in bucket.values():
+            if not isinstance(ws, dict):
+                continue
+            for view_id, view in (ws.get("views") or {}).items():
+                if not isinstance(view, dict):
+                    continue
+                display = ((view.get("config") or {}).get("display") or {})
+                spec = display.get("form")
+                if isinstance(spec, dict) and spec.get("token"):
+                    yield str(key), str(view_id), spec
+
+
+def _resolve(token: str):
+    """`(runtime, tenant_slug, table_key, form_spec)` for a token, or None.
+
+    ⚠ THE LOOP DOES NOT SHORT-CIRCUIT ON THE TENANT, only on the match. A `break` on the first
+    tenant whose store answered would make "the third tenant's form" depend on the first two
+    being healthy, and a form that stops working because somebody else's store blipped is the
+    kind of failure nobody can reproduce.
+    """
+    from harness import runtime as _rt
+
+    if not token or len(token) < 16:
+        return None
+    for slug in _rt.known_tenants():
+        try:
+            rt = _rt.get_runtime(slug)
+        except Exception:                                         # noqa: BLE001
+            continue
+        for table_key, _view_id, spec in _iter_form_views(rt):
+            if _same(str(spec.get("token") or ""), token):
+                return rt, slug, table_key, spec
+    return None
+
+
+# --- the public shape -------------------------------------------------------------------------
+
+
+def _public_form(rt, table_key: str, spec: dict) -> dict:
+    """The ONLY bytes a valid token buys. Built key by key — there is no `**stored` anywhere in
+    this function, which is what makes "nothing else leaks" a property of the code rather than a
+    promise about what happens to be in the bag today.
+
+    ⚠ The field ORDER is the form's own (`spec['fields']`), not the table's: the builder let
+    somebody arrange these questions, and re-deriving the order from the schema would silently
+    rearrange a form every time a column was added.
+    """
+    import core.user_tables as user_tables
+
+    defn = user_tables.get(table_key, st=rt) or {}
+    by_key = {f.get("key"): f for f in (defn.get("fields") or []) if isinstance(f, dict)}
+    required = {str(k) for k in (spec.get("required") or [])}
+    out = []
+    for key in (spec.get("fields") or []):
+        f = by_key.get(str(key))
+        # A field deleted since the form was built is DROPPED, never rendered as a dead input —
+        # and never an error: losing one column must not take a live form offline.
+        if not f or f.get("source") not in (None, "overlay"):
+            continue
+        row = {"key": str(f.get("key")), "label": str(f.get("label") or f.get("key")),
+               "type": str(f.get("type") or "text"), "required": str(key) in required}
+        options = f.get("options")
+        if isinstance(options, list) and options:
+            row["options"] = [str(o) for o in options][:200]
+        if f.get("type") == "rating":
+            row["max"] = int(f.get("max") or 5)
+        out.append(row)
+    return {
+        "title": str(spec.get("title") or "")[:200],
+        "desc": str(spec.get("desc") or "")[:1000],
+        "submitLabel": str(spec.get("submitLabel") or "")[:60] or "Submit",
+        "fields": out,
+        "honeypot": HONEYPOT_FIELD,
+    }
+
+
+# --- validation -------------------------------------------------------------------------------
+
+
+def _clean_values(fields: list, raw: dict):
+    """`(values, error_sentence)` — REFUSE, NEVER COERCE (C9, and the engine's own law).
+
+    The temptation with a public form is to be forgiving: read "12 units" as 12, "yes" as
+    checked, "tomorrow" as a date. Every one of those writes a number nobody typed into somebody
+    else's database, and the person who submitted the form is not there to see it happen. So a
+    value that does not answer its own field's question is refused with a sentence naming the
+    FIELD LABEL — the only name the submitter has ever seen.
+    """
+    out = {}
+    for f in fields:
+        key, label, ftype = f["key"], f["label"], f["type"]
+        v = raw.get(key)
+        text = "" if v is None else str(v)
+        text = text.strip() if isinstance(v, str) else text
+        if len(text) > MAX_VALUE_LEN:
+            return None, f"“{label}” is too long — {MAX_VALUE_LEN} characters at most."
+        if text == "":
+            if f.get("required"):
+                return None, f"“{label}” is required."
+            continue
+        if ftype in ("int", "currency", "pct", "rating"):
+            try:
+                num = float(text.replace(",", ""))
+            except ValueError:
+                return None, f"“{label}” must be a number."
+            if ftype == "rating":
+                top = int(f.get("max") or 5)
+                if not (1 <= num <= top) or num != int(num):
+                    return None, f"“{label}” must be a whole number from 1 to {top}."
+            text = str(int(num)) if ftype in ("int", "rating") else str(num)
+        elif ftype == "checkbox":
+            # The storage contract is '1' or blank (types.ts). Anything a checkbox can actually
+            # send is one of these four spellings; anything else is not a checkbox answer.
+            if text.lower() not in ("1", "true", "on", "yes", "0", "false", "off", "no"):
+                return None, f"“{label}” must be checked or unchecked."
+            text = "1" if text.lower() in ("1", "true", "on", "yes") else ""
+        elif ftype in ("select", "status"):
+            options = f.get("options") or []
+            if options and text not in options:
+                return None, f"“{label}” must be one of the listed choices."
+        elif ftype == "multiselect":
+            options = f.get("options") or []
+            parts = [p.strip() for p in text.split(",") if p.strip()]
+            if options and any(p not in options for p in parts):
+                return None, f"“{label}” must be chosen from the listed choices."
+            text = ", ".join(parts)
+        elif ftype == "date":
+            # ISO only. A public form has no timezone, no locale and no user to ask, so
+            # "03/04/2026" is genuinely ambiguous and guessing it wrong is a silent data error.
+            if len(text) != 10 or text[4] != "-" or text[7] != "-":
+                return None, f"“{label}” must be a date."
+            try:
+                time.strptime(text, "%Y-%m-%d")
+            except ValueError:
+                return None, f"“{label}” must be a real date."
+        elif ftype == "email":
+            if "@" not in text or text.startswith("@") or text.endswith("@"):
+                return None, f"“{label}” must be an email address."
+        out[key] = text
+    return out, ""
+
+
+# --- the routes -------------------------------------------------------------------------------
+
+
+@router.get("/forms/{token}")
+def get_form(token: str, request: Request):
+    """Render-time payload for a public form. Rate-limited like the POST: an unauthenticated GET
+    that walks every tenant's workspace is the cheapest way to make this process do work."""
+    if not _rate_ok(_client_ip(request), time.time()):
+        raise err(429, "too_many_requests", "too many requests — wait a moment and try again")
+    found = _resolve(token)
+    if not found:
+        raise _refuse()
+    rt, _slug, table_key, spec = found
+    return _public_form(rt, table_key, spec)
+
+
+async def _bounded_body(request: Request) -> dict:
+    """The request body, READ WITH A BOUND — never `Body(...)`, never `await request.body()`.
+
+    ⛔ THE FIRST VERSION OF THIS ROUTE TOOK `body: dict = Body(default=None)` AND ITS 16 KB CAP
+    CAPPED NOTHING. FastAPI reads and JSON-parses the WHOLE body before the handler's first line
+    runs, so a `content-length` check inside the handler is inspected after the allocation it
+    claims to prevent — and `content-length` is caller-supplied anyway, so omitting it or sending
+    chunked left no bound at all. On the one unauthenticated write path in the product.
+
+    ⚠ It was GREEN, and that is the part worth remembering: the gate leg set the header itself,
+    so it only ever exercised the honest path. A protection whose test supplies the very value it
+    is protecting against is testing its own politeness.
+
+    Streaming with a running total is the actual bound: the read STOPS at the ceiling rather than
+    discovering afterwards that it should have.
+    """
+    size, chunks = 0, []
+    async for chunk in request.stream():
+        size += len(chunk)
+        if size > MAX_BODY_BYTES:
+            raise err(413, "body_too_large", "that submission is too large")
+        chunks.append(chunk)
+    import json
+    try:
+        parsed = json.loads(b"".join(chunks) or b"{}")
+    except ValueError:
+        raise err(400, "no_values", "that submission could not be read")
+    return parsed if isinstance(parsed, dict) else {}
+
+
+@router.post("/forms/{token}")
+async def submit_form(token: str, request: Request):
+    """One submission: validate, append the row, fire `form_submitted`.
+
+    ⚠ THE ORDER IS LOAD-BEARING. The row is written FIRST and the trigger fired second, off the
+    id the write returned — so an automation can never run against a record that does not exist,
+    and a trigger that raises cannot cost the submitter the answer they just typed.
+    """
+    now = time.time()
+    if not _rate_ok(_client_ip(request), now):
+        raise err(429, "too_many_requests", "too many requests — wait a moment and try again")
+    body = await _bounded_body(request)
+    found = _resolve(token)
+    if not found:
+        raise _refuse()
+    rt, _slug, table_key, spec = found
+
+    values = (body or {}).get("values")
+    if not isinstance(values, dict):
+        raise err(400, "no_values", "that submission was empty")
+
+    # ⛔ THE HONEYPOT ANSWERS 200 AND WRITES NOTHING. A 403 would tell the script it was
+    # detected, and the next version of it simply stops filling the field. A success it can
+    # never verify is the only answer that costs the operator nothing to give.
+    if str(values.get(HONEYPOT_FIELD) or "").strip():
+        return {"ok": True}
+
+    form = _public_form(rt, table_key, spec)
+    if not form["fields"]:
+        raise _refuse()
+    clean, problem = _clean_values(form["fields"], values)
+    if problem:
+        raise err(400, "invalid_submission", problem)
+
+    # ⚠ THE DAILY CAP IS SPENT ON A WRITE, NOT ON A REQUEST, and the order is the whole point.
+    # Counted before validation — where it was first — 500 malformed POSTs take a LIVE form
+    # offline for 24 hours, and one address can send them in about 17 minutes under the per-IP
+    # window. The cap exists to bound what reaches the tenant's table; pacing abuse is the
+    # window's job, and a refusal costs the attacker the same either way.
+    if not _daily_ok(token, time.time()):
+        raise err(429, "form_daily_cap",
+                  "this form has reached today's submission limit — try again tomorrow")
+
+    import core.user_tables as user_tables
+
+    # ⚠ THE STAMP. `user_tables.add_row` filters values to the table's own field keys, so a
+    # `created_by` pair passed in `values` would simply be dropped — the row itself has no meta
+    # slot today. The `username` argument is the channel that DOES survive: it rides the
+    # `record_created` row event, so every trigger and audit downstream sees `form:<prefix>`
+    # rather than a blank actor. Booked as a dated amendment in the split doc; a persistent
+    # per-row stamp needs `add_row` to grow one, which is SESSION A's file.
+    actor = f"form:{token[:8]}"
+    row_id = user_tables.add_row(table_key, clean, username=actor, st=rt)
+    if not row_id:
+        raise err(409, "not_accepted", "that submission could not be saved — try again later")
+
+    # W23-W7 — A's FROZEN signature, called verbatim (CP1-a). Failure here must not turn a
+    # SAVED row into an error for the submitter: the answer is theirs and it is already stored.
+    try:
+        import automation_engine as engine
+        engine.form_fired(rt, table_key, row_id, values=clean, form_token=token)
+    except Exception:                                             # noqa: BLE001
+        pass
+    return {"ok": True}

api/routes_nav.py

@@ -10,6 +10,8 @@ The full rule set — archived is invisible to everyone, `group_only` rows are e
 `prefs.json` Library preference is deliberately NOT applied — is documented on
 `core.perms.nav_pages`, which is where it belongs: one place, both callers.
 """
+import time
+
 from fastapi import APIRouter, Body, Depends
 
 from deps import Session, err, perms, require_session
@@ -50,6 +52,33 @@ _ICON_SHAPES = frozenset({"folder", "star", "flag", "tag", "bookmark", "grid",
 _ICON_TONES = frozenset({"neutral", "blue", "green", "yellow", "red"})
 _MAX_NAV_NAME = 60
 
+#: WAVE 23 (contract C10 / ruling R7) — the Home landing's RECENTS.
+#:
+#: PER-USER, like `nav_prefs` two buckets up and unlike `nav_meta`: what I opened last is
+#: nobody else's business, and a tenant-wide "recently opened" would be a surveillance feature
+#: rather than a convenience one.
+#:
+#: ⛔ A MAP KEYED BY PAGE, NOT AN APPEND LOG, and the difference is the whole feature.
+#: `{username: {pageKey: <epoch seconds>}}` — re-opening a database OVERWRITES its stamp. An
+#: append-only list capped at 50 fills with fifty copies of the same ten databases inside one
+#: working session, and the cap then evicts OLDEST-FIRST: the tenth database you touched falls
+#: off the list while forty slots hold repeat visits to the first. Keying by page makes
+#: "recent" mean what the word means, and makes the cap bound the number of DATABASES
+#: remembered rather than the number of clicks.
+_NAV_RECENTS_KEY = "nav_recents"
+_MAX_RECENTS = 50
+
+#: ⚠ EPOCH SECONDS (UTC by definition), never a formatted stamp — and this is a correction of a
+#: precedent, not a preference. `user_tables.create` writes
+#: `datetime.now().strftime('%Y-%m-%dT%H:%M:%S')`: naive LOCAL time, no offset. A browser parses
+#: that string as its OWN local time, so on a UTC host read by a non-UTC reader "opened 30
+#: minutes ago" renders as "opened 7 hours ago" and the Today / Past-7-days buckets misfile —
+#: with nothing to go red, because both ends are internally consistent. An integer instant has
+#: no such reading. (D-18 made the same correction for notification stamps AFTER the defect
+#: shipped; this is that lesson applied before it.)
+def _now() -> int:
+    return int(time.time())
+
 
 def _clean_nav_prefs(raw, page_keys):
     """Validated wholesale replacement, the `clean_folders` posture: prune, never invent.
@@ -131,6 +160,43 @@ def _read_nav_meta(runtime):
     return out
 
 
+def _read_recents(runtime, uname, allowed):
+    """This user's recents, newest first, PRUNED to what they may currently see.
+
+    ⚠ PRUNED ON READ, never on write, and both halves of that are deliberate:
+
+      · the WRITE happens on every route open — it is the one hot path this file has — so it
+        must not build the whole nav to validate one key;
+      · a key whose grant was REVOKED must stop being offered without anyone running a
+        migration, and must come back if the grant does. That is `_clean_nav_prefs`' own
+        prune-never-invent posture, applied to a second bucket for the same reason.
+
+    A key that is not in `allowed` therefore reaches the store and never reaches a screen —
+    which also means a stuffed key cannot be used to discover what exists: it comes back only
+    if the session could already see it.
+    """
+    try:
+        stored = (runtime.get(_NAV_RECENTS_KEY) or {}).get(uname) or {}
+    except Exception:
+        return []                      # a store blip must not take the nav down with it
+    if not isinstance(stored, dict):
+        return []
+    out = []
+    for key, at in stored.items():
+        key = str(key)
+        if allowed is not None and key not in allowed:
+            continue
+        try:
+            at = int(at)
+        except (TypeError, ValueError):
+            continue                   # a stamp this build cannot read is not a stamp
+        if at <= 0:
+            continue
+        out.append({"key": key, "at": at})
+    out.sort(key=lambda r: r["at"], reverse=True)
+    return out[:_MAX_RECENTS]
+
+
 @router.get("/nav")
 def nav(session: Session = Depends(require_session)):
     """`{pages: [{key,label,source?,chrome}], landing}`.
@@ -220,7 +286,72 @@ def nav(session: Session = Depends(require_session)):
     landing = perms.landing_page(session.user)
     if landing and not any(p.get("key") == landing for p in pages):
         landing = pages[0].get("key")
-    return {"pages": pages, "landing": landing}
+    # WAVE 23 (C10 / R7) — the Home landing's recents, on the payload the client already asks
+    # for. A second round trip for a list this short, computed from a bucket this route is
+    # already holding the store open for, would be a request per page load for no gain.
+    #
+    # ⛔ `allowed` IS THE ASSEMBLED PAGE LIST, not `_visible_top_keys`. The latter reads
+    # `perms.nav_pages` alone, which does NOT include this tenant's `ut_*` databases — those are
+    # merged into `pages` above, by this route, after the permission wall. Pruning against the
+    # narrower set would have silently dropped every user database from Home's recents: the
+    # exact surface R7 is about, invisible, with every gate green.
+    recents = _read_recents(session.runtime, session.uname,
+                            {str(p.get("key", "")) for p in pages})
+    return {"pages": pages, "landing": landing, "recents": recents}
+
+
+@router.post("/nav/opened")
+def nav_opened(body: dict = Body(default=None),
+               session: Session = Depends(require_session)):
+    """WAVE 23 (C10) — stamp a page as JUST OPENED. Fire-and-forget from the client.
+
+    The client calls this on every route commit, so this is the only write in this file on a
+    hot path, and three things follow from that:
+
+      · `flush='async'` — the coalescing mode ([[store-async-flush]]). A blocking upload per
+        page open against an HF-Dataset-backed store would put a network round trip inside every
+        navigation. `nav_prefs`/`nav_meta` stay `sync` because a folder rename is not a hot path;
+        this is.
+      · NO VALIDATION OF THE KEY against the nav. Building the page list to check one string
+        would make the stamp cost more than the navigation that triggered it — and it would buy
+        nothing, because the READ prunes to what the session may currently see. An unknown or
+        revoked key is stored and never served back.
+      · THE MAP IS CAPPED HERE TOO. Read-side capping alone would let a hostile or buggy client
+        grow one user's document without bound; `_MAX_RECENTS` entries survive, oldest first to
+        go, which is the same rule the read applies.
+    """
+    body = body if isinstance(body, dict) else {}
+    key = str(body.get("key") or "").strip()[:60]
+    if not key:
+        raise err(400, "bad_request", "no page was named")
+    if not session.runtime.available():
+        raise err(503, "store_unavailable",
+                  "the tenant store is unavailable — nothing was recorded")
+    stamp, uname = _now(), session.uname
+
+    def _up(data):
+        data = data if isinstance(data, dict) else {}
+        mine = dict(data.get(uname) or {}) if isinstance(data.get(uname), dict) else {}
+        mine[key] = stamp
+        if len(mine) > _MAX_RECENTS:
+            # Oldest first. `int(v)` guarded: a stamp an older build wrote in another shape
+            # sorts as 0 and is the first thing evicted, which is the right answer for a value
+            # this route can no longer read.
+            def _at(item):
+                try:
+                    return int(item[1])
+                except (TypeError, ValueError):
+                    return 0
+            mine = dict(sorted(mine.items(), key=_at, reverse=True)[:_MAX_RECENTS])
+        data[uname] = mine
+        return data
+
+    try:
+        session.runtime.update(_NAV_RECENTS_KEY, _up, flush='async')
+    except Exception:
+        raise err(503, "store_unavailable",
+                  "the tenant store refused the write — nothing was recorded")
+    return {"key": key, "at": stamp}
 
 
 @router.post("/nav/meta")

api/routes_tables.py

@@ -375,13 +375,37 @@ def add_field(table_key: str, body: dict = Body(default=None),
     ut = _ut()
     field = ut.add_field(table_key, body or {}, st=session.runtime)
     if not field:
-        raise err(400, "refused",
-                  f"the column was refused — check the name and type, or the table may be at "
-                  f"its {ut.MAX_FIELDS}-column cap (types: "
-                  f"{', '.join(sorted(ut.UT_FIELD_TYPES))})")
+        # ⭐ D-46 CLOSED (wave 23) — the C8 flow law gets its OWN sentence. `add_field` answers
+        # None for every refusal, so this route said "check the name and type" to somebody whose
+        # name and type were fine and whose automation column named a flow that does not exist.
+        # A refusal that misdirects is worse than a bare 400: it sends the reader to look at the
+        # one thing that was never wrong. Checked HERE, in the route's own words, because the
+        # law itself stays enforced in `user_tables.flow_bound` — this narrates it, never
+        # re-implements it (a second copy of the rule is how two doors start disagreeing).
+        raise err(400, "refused", _refusal_sentence(ut, session, body or {}))
     return {"field": field}
 
 
+def _refusal_sentence(ut, session, body):
+    """Why was this column refused? The specific reason when we can name one, the general list
+    otherwise — never a specific-sounding guess."""
+    bag = (body or {}).get("automation")
+    if isinstance(bag, dict):
+        flow = str(bag.get("flowId") or "").strip()
+        if not flow:
+            return ("an automation column has to name the automation that fills it — pick a "
+                    "flow, or make this an ordinary column")
+        if not ut.flow_bound(bag, st=session.runtime):
+            return (f"this column names automation {flow!r}, which does not exist in this "
+                    f"workspace — it may have been deleted; pick a flow that is still there")
+    kind = str((body or {}).get("type") or "").strip()
+    if kind and kind not in ut.UT_FIELD_TYPES:
+        return (f"{kind!r} is not a column type here (types: "
+                f"{', '.join(sorted(ut.UT_FIELD_TYPES))})")
+    return (f"the column was refused — check the name and type, or the table may be at its "
+            f"{ut.MAX_FIELDS}-column cap (types: {', '.join(sorted(ut.UT_FIELD_TYPES))})")
+
+
 @router.patch("/tables/{table_key}/fields/{fkey}")
 def patch_field(table_key: str, fkey: str, body: dict = Body(default=None),
                 session: Session = Depends(require_session)):

api/routes_templates.py

@@ -0,0 +1,148 @@
+"""routes_templates.py — WAVE 23 item 7 (ruling R10, contract C12): the template doors.
+
+    GET  /api/v1/templates?table=<page key>   what can be applied HERE
+    POST /api/v1/templates/{key}/apply {table}  apply it, to the CALLING USER's own views
+
+Both session-gated. Neither is public and neither is admin-only: applying a template writes the
+caller's PERSONAL saved views, which is something every user does to their own workspace all day
+(`table_store.save_view(..., shared=False)`). The registry itself is platform-curated code
+(`platform/core/view_templates.py`) — R10 explicitly rules out an end-user authoring UI this
+wave, so there is no write door for the registry at all.
+
+⛔ THE WALL IS THE SAME PREDICATE THE NAV USES, per topic, and it is applied before anything is
+read or written:
+  · `ut_*` — `user_tables.may_open` (creator, admin, or a share grant), exactly as
+    `routes_tables._defn_or_refuse` does. `session.require` would 403 every ut key, because a
+    user table is deliberately not a module (the split `/nav/schema/{key}` already makes).
+  · a built-in topic — `session.require(key)`, the module grant.
+A key that is neither is a 404 with the same sentence for both: this route is not a directory of
+what exists.
+
+⚠ REFUSE, NEVER PARTIALLY APPLY. `view_templates.missing_columns` runs against the TARGET's live
+contract, and a template naming a column the target does not have comes back 400 with the
+columns listed. The alternative — writing the views anyway — is the `_seed_wave17` failure
+verbatim: `clean_filter_tree` DROPS a leaf on an unknown column, and a view whose only condition
+was dropped shows EVERY row under a name that promises a shortlist.
+"""
+import uuid
+
+from fastapi import APIRouter, Body, Depends
+
+from deps import Session, err, perms, require_session
+
+router = APIRouter(prefix="/api/v1")
+
+
+def _templates():
+    import core.view_templates as view_templates
+    return view_templates
+
+
+def _target_or_refuse(session, table_key):
+    """`(field_keys, source_label)` for a table this session may open — or a refusal.
+
+    The field keys are the LIVE contract, read the same way each topic's own reader reads it, so
+    a template can never be offered against a column list this end assembled by hand.
+    """
+    key = str(table_key or '').strip()
+    if not key:
+        raise err(400, "bad_request", "no database was named")
+    if key.startswith('ut_'):
+        import core.user_tables as user_tables
+        defn = user_tables.get(key, st=session.runtime)
+        if not defn:
+            raise err(404, "unknown_table", "that database does not exist")
+        if not user_tables.may_open(key, session.uname, session.admin, st=session.runtime):
+            raise err(403, "forbidden", "that database belongs to another user")
+        fields = [str(f.get('key')) for f in (defn.get('fields') or []) if f.get('key')]
+        # A user table has no fixed topic. Its SOURCE label is left blank so `offer` gates on
+        # columns alone — which is the honest answer for a table whose shape its owner decides,
+        # and is exactly why the column test is the real contract (view_templates' own note).
+        return fields, ''
+    if key not in ('customer_data', 'product_data'):
+        raise err(404, "unknown_table", "that database does not exist")
+    session.require(key)
+    import aios_grid
+    if key == 'product_data':
+        return [f['key'] for f in aios_grid.product_fields()], 'odoo_product'
+    return [f['key'] for f in aios_grid.FIELDS], 'odoo_customer'
+
+
+@router.get("/templates")
+def list_templates(table: str = "", session: Session = Depends(require_session)):
+    """What can be applied to THIS database. `{table, templates: [...]}`.
+
+    Filtered by the target's real columns, so the picker cannot offer something the apply door
+    would refuse — one predicate, two callers (`view_templates.offer` wraps
+    `missing_columns`, which is the same function the POST below re-runs).
+    """
+    fields, source = _target_or_refuse(session, table)
+    vt = _templates()
+    return {"table": table, "templates": vt.offer(fields, source or None)}
+
+
+@router.post("/templates/{key}/apply")
+def apply_template(key: str, body: dict = Body(default=None),
+                   session: Session = Depends(require_session)):
+    """Apply a template to a database, as the CALLING USER's own saved views.
+
+    IDEMPOTENT BY PINNED VIEW ID (`tpl_<template>_<suffix>`): a second click updates the same
+    views rather than minting "Past due 2". ⚠ That matters more than it sounds — `save_view`
+    de-duplicates NAMES by appending a number, so an unpinned id would make every re-apply a
+    fresh copy and the store would fill with numbered near-duplicates nobody asked for.
+    """
+    body = body if isinstance(body, dict) else {}
+    fields, _source = _target_or_refuse(session, body.get("table"))
+    vt = _templates()
+    tpl = vt.get(key)
+    if not tpl:
+        raise err(404, "unknown_template", "that template does not exist")
+    missing = vt.missing_columns(tpl, fields)
+    if missing:
+        # NAMED, not counted. "3 columns are missing" is a sentence the reader cannot act on;
+        # the column keys are what tells them this is the wrong database for this template.
+        raise err(400, "missing_columns",
+                  "this database does not have the columns that template needs: "
+                  + ", ".join(missing))
+    ws_key = vt.workspace_key(body.get("table"))
+    if not ws_key:
+        raise err(404, "unknown_table", "that database does not exist")
+    if not session.runtime.available():
+        raise err(503, "store_unavailable",
+                  "the tenant store is unavailable — nothing was applied")
+    import core.table_store as table_store
+    ops = table_store.make(ws_key, st=session.runtime)
+    applied = []
+    for view in tpl.get('views') or ():
+        # ⛔ A COPY PER APPLY, and `createdBy` STAMPED HERE. The registry's dicts are module-level
+        # — mutating one would write this caller's username into the template every other tenant
+        # then reads, which is a cross-tenant leak with no symptom until two people apply the
+        # same template. Same invariant `routes_nav`'s in-place merge documents from the other
+        # side.
+        payload = dict(view)
+        payload['config'] = dict(view.get('config') or {})
+        payload['createdBy'] = session.uname
+        saved = ops.save_view(session.uname, payload, shared=False)
+        applied.append({"id": payload['id'], "name": saved.get('name') or payload['name']})
+
+    alert_id = None
+    if tpl.get('alert') and applied:
+        # The template's own view, watched. `core.alerts.create` stores the view BY ID rather
+        # than a copy of its filter tree, so an alert made here keeps meaning "tell me about
+        # this view" even after its owner edits it.
+        topic = ('product' if body.get("table") == 'product_data'
+                 else 'customer' if body.get("table") == 'customer_data'
+                 else str(body.get("table")))
+        try:
+            import core.alerts as alerts
+            alert_id = f"al_{uuid.uuid4().hex[:12]}"
+            alerts.create(alert_id, view_id=applied[0]["id"], topic=topic,
+                          owner=session.uname, label=applied[0]["name"],
+                          st=session.runtime)
+        except Exception:
+            # ⚠ THE VIEWS ARE ALREADY WRITTEN AND THAT IS THE POINT: a failed alert must not
+            # un-apply a template that worked. The response says which half landed rather than
+            # reporting a total failure over a partial success.
+            alert_id = None
+    return {"key": key, "table": body.get("table"), "views": applied,
+            "alert": alert_id, "alerted": bool(alert_id)}

platform/aios_grid.py

@@ -109,9 +109,15 @@ def _round(v):
 #: megabyte-per-row tax on the whole store. Editable by NATURE (deliberately NOT in
 #: `READONLY_CUSTOM_TYPES`): the ref is what the upload endpoint hands back, and the client PATCHes
 #: it through the ordinary overlay wall rather than the asset route writing cells behind it.
+#: ⭐ WAVE 23 (C7) — `json` joined: a cell holding a whole DOCUMENT (an Instagram comment thread,
+#: a webhook payload, a scraped blob) that opens in its own viewer instead of being flattened
+#: into one unreadable line. It is EDITABLE by nature, like `image`: the value is still a plain
+#: string on the wire, so it rides the ordinary overlay wall — what makes it a json field is that
+#: `grid_events` REFUSES a write that does not parse (a column promising structure must not
+#: silently hold something that isn't).
 CUSTOM_FIELD_TYPES = {"text", "select", "multiselect", "user", "int", "currency", "pct", "date",
                       "checkbox", "phone", "email", "url", "rating", "created_time", "formula",
-                      "automation", "image"}
+                      "automation", "image", "json"}
 #: User-created types whose CELLS are read-only: their values are computed (formula — client
 #: side, any error degrades to BLANK) or system-owned (created_time = the row's `_created`).
 #: Emitted with the cohort column's read-only mechanism — `source: 'odoo'` + `derived` — so

platform/core/alerts.py

@@ -209,6 +209,44 @@ def _queue(rec, pids, labels, st=None):
     _st(st).update(NOTIFICATIONS_KEY, _apply, flush='async')
 
 
+def notify(owner, label, *, topic='automation', key='', row_id='', detail='', st=None):
+    """⭐ WAVE 23 (C6) — put ONE notification in a named user's inbox, for a producer that is not
+    a view-alert evaluation.
+
+    The automation engine needs the bell to ring when records arrive at a review gate, and that
+    is not an alert over a view: there is no filter tree, no `matched` set, no entrant diff. It
+    reached for `_queue` directly during the wave, which would have made a private function a
+    cross-module contract — so this is the public door instead, and `_queue` stays the internal
+    half of `evaluate()`.
+
+    The inbox shape is UNCHANGED, deliberately: `AlertsPane` reads one list, and a second row
+    shape would mean a client that must branch on where a notification came from. `alertId`
+    carries the producer's key so a click-through can route (W23-W5).
+    """
+    owner = str(owner or '').strip()
+    if not owner or not label:
+        return None
+    at = _now_iso()
+    item = {'id': f"{key or topic}:{row_id or 'n'}:{at}",
+            'alertId': str(key or ''), 'viewId': '', 'topic': str(topic),
+            'rowId': str(row_id or ''), 'label': str(detail or label),
+            'alertLabel': str(label), 'at': at, 'read': False}
+
+    def _apply(data):
+        box = list(data.get(owner) or [])
+        box.append(item)
+        if len(box) > MAX_NOTIFICATIONS:
+            unread = [n for n in box if not n.get('read')]
+            read = [n for n in box if n.get('read')]
+            keep_read = read[max(0, len(unread) + len(read) - MAX_NOTIFICATIONS):]
+            box = sorted(unread + keep_read, key=lambda n: str(n.get('at') or ''))
+        data[owner] = box
+        return data
+
+    _st(st).update(NOTIFICATIONS_KEY, _apply, flush='async')
+    return item
+
+
 def inbox(user, st=None, limit=100):
     """`{'unread': int, 'items': [...]}` — newest first, for the badge and the pane."""
     try:

platform/core/grid_events.py

@@ -38,11 +38,13 @@ so the import stays and the violation is RECORDED rather than hidden. It is the
 down, and this note is the marker for that work.
 """
 import datetime as dt
+import json as _json_ev                 # wave 23 (C7): the json field's parse wall
 from dataclasses import dataclass, field
 from typing import MutableMapping, Optional
 
 import core.store as store
 import core.table_store as _tstore     # wave-9 I17: the shared-view authorisation predicates
+import core.user_tables as _ut_limits  # wave 23 (C7): MAX_JSON_CELL — one ceiling, one definer
 import core.users as users
 import harness.telemetry as _tel       # _tel.error() = THE error sink (all caught errors log)
 import modules.cohort as cohort_mod
@@ -1703,6 +1705,26 @@ def handle_one(event, ctx):
                     else:
                         refused = True
                     continue
+            # ⭐ WAVE 23 (C7) — the json wall, BEFORE the generic 10 000-char truncation, which
+            # would otherwise cut a document in half and store the halves as valid text. A json
+            # column promises its readers a parseable document; a write that is not one is
+            # REFUSED with the cell unchanged rather than silently kept as a string nothing can
+            # open. Blank stays legal — an empty cell is "no document", not a malformed one.
+            if (field_by_key.get(key) or {}).get('type') == 'json':
+                raw_j = value if isinstance(value, str) else _json_ev.dumps(value)
+                if not str(raw_j).strip():
+                    updates[key] = ''
+                    continue
+                if len(str(raw_j)) > _ut_limits.MAX_JSON_CELL:
+                    refused = True
+                    continue
+                try:
+                    _json_ev.loads(raw_j)
+                except (ValueError, TypeError):
+                    refused = True
+                    continue
+                updates[key] = str(raw_j)
+                continue
             clean = str(value)[:10000]
             if isinstance(value, str) and clean != value:
                 # Truncated: the stored truth is shorter than the client's copy. (An

platform/core/keychain.py

@@ -27,7 +27,13 @@ import os
 import secrets as _secrets
 
 KEY = 'keychain'
-ENTRY_TYPES = {'odoo', 'generic'}
+#: ⭐ WAVE 23 (C11/R8) — `stripe` and `shopify` joined. They are TOKEN connectors, not OAuth
+#: ones, and that is the whole reason they could ship in this wave: both issue a long-lived
+#: restricted key / custom-app token an admin pastes in, so they need no OAuth client, no
+#: consent screen and no app review — the three things that make every other provider on the
+#: standing queue a multi-week errand. A type here is what lets the connectors directory show
+#: them as CONNECTABLE rather than as another faded to-do.
+ENTRY_TYPES = {'odoo', 'generic', 'stripe', 'shopify'}
 #: which stored field feeds the masked preview, per type (first present wins)
 _PREVIEW_FIELDS = ('api_key', 'value', 'password', 'token')
 MAX_ENTRIES = 40

platform/core/user_tables.py

@@ -58,8 +58,15 @@ KEY_PREFIX = 'ut_'
 #: landed in the per-user workspace stratum and the picker could not see them — the owner's
 #: "Choose a column..." stays empty. Local literal rather than an aios_grid import so this
 #: module stays dependency-light for the API's boot path.
+#: ⭐ `json` JOINED IN WAVE 23 (C7) — and it belongs here rather than staying grid-only the way
+#: `image` did, because the databases that need it are exactly these: a scrape lands a comment
+#: thread or a webhook payload against a row, and the automation engine writes those cells.
 UT_FIELD_TYPES = {'text', 'select', 'multiselect', 'user', 'int', 'currency', 'pct', 'date',
-                  'checkbox', 'phone', 'email', 'url', 'rating', 'automation'}
+                  'checkbox', 'phone', 'email', 'url', 'rating', 'automation', 'json'}
+#: C7's ceiling. A cell is still a scalar on the wire (`Row` values are strings/numbers) — what
+#: this bounds is the DOCUMENT inside it. 32 KB holds a long comment thread and refuses a payload
+#: somebody meant to store as a file.
+MAX_JSON_CELL = 32 * 1024
 
 
 def _st(st):
@@ -186,8 +193,8 @@ def delete(table_key, st=None):
     is no longer optional. Cleaned here, in one place: definition (`user_tables`) · the
     workspace bucket (`<key>_table_workspace`, every stratum incl. `__shared__` — views,
     custom fields, overlays, folders) · cohorts (`<key>_cohorts`) · record comments
-    (`<key>_record_comments`) · docs metadata (`<key>_docs`; dataset BYTES under
-    `docs/<key>/…` become unreachable and are left to storage — disclosed, not hidden) ·
+    (`<key>_record_comments`) · docs metadata (`<key>_docs`) AND the dataset BYTES each
+    metadata row names (D-36, closed wave 23 — wave 21 left those unreachable-but-present) ·
     `nav_meta[<key>]` · share grants (the database grant plus a view grant per view that
     lived in this bucket, via `shares.drop_objects`) · alert definitions on this topic.
     Bound AUTOMATIONS are the API layer's to disable (platform must not import the engine).
@@ -210,11 +217,34 @@ def delete(table_key, st=None):
                 view_ids |= set((ws.get('views') or {}).keys())
     except Exception:
         pass
+    # ⭐ D-36 CLOSED (wave 23) — the document BYTES, not just their metadata. Wave 21 cleaned
+    # `<key>_docs` and disclosed that the blobs under `docs/<key>/…` were left on the dataset;
+    # "unreachable" is not "deleted", and for a tenant asking us to delete a database the
+    # difference is the whole promise. Read the metadata FIRST (it carries each blob's exact
+    # stored `path`, so nothing is guessed from a naming convention that could drift), then
+    # clear the bucket, then delete the blobs. Best-effort per file: a storage blip must not
+    # resurrect the table or abort the rest of the sweep — an undeleted blob is residue we can
+    # sweep again, an aborted delete is a table the user asked to be gone.
+    doc_paths = []
+    try:
+        for _pid, _rows in (s.get(f'{key}_docs') or {}).items():
+            for _doc in (_rows or []):
+                p = str((_doc or {}).get('path') or '')
+                if p:
+                    doc_paths.append(p)
+    except Exception:
+        pass
     for b in (ws_key, f'{key}_cohorts', f'{key}_record_comments', f'{key}_docs'):
         try:
             s.update(b, lambda cur: {}, flush='async')
         except Exception:
             pass
+    for p in doc_paths:
+        try:
+            import core.store as _store_bytes
+            _store_bytes.delete_path(p)
+        except Exception:
+            pass
 
     def _drop_meta(cur):
         if isinstance(cur, dict):

platform/core/view_templates.py

@@ -0,0 +1,296 @@
+"""view_templates.py — WAVE 23 item 7 (ruling R10, contract C12): the PLATFORM-CURATED
+template registry.
+
+WHAT A TEMPLATE IS, precisely, because the word is overloaded: a named bundle of SAVED VIEWS
+that a user applies to a database they already have. It does NOT create a table, it does not add
+columns, and it does not connect anything. It is the answer to "this database has 30 columns and
+I do not know which twelve matter for chasing money" — a starting layout, authored once by the
+platform, applied by whoever wants it.
+
+⛔ THE ONE RULE THAT DECIDES EVERY DESIGN CHOICE HERE — `_seed_wave17.py`'s :9-20 law:
+**only VIEWS are shared; `fields` and `overlays` are strictly per-user.** So a SHARED view that
+filtered on a user-created column would, for every other account, name a column that does not
+exist — and an unknown column is an INACTIVE leaf in the tri-state filter engine, which is
+IGNORED, which WIDENS. A "Collections focus" that quietly showed the whole customer book to
+everyone but its author, with nothing going red.
+
+Two consequences, both load-bearing:
+
+  1. **Applying writes the CALLING USER's own views** (`save_view(..., shared=False)`), never
+     shared ones. A template is a convenience, not an administrative act, and the moment it
+     wrote into the shared bucket it would need an admin wall and a name-collision policy across
+     the tenant.
+  2. **Every column a template names is checked against the TARGET's live contract before
+     anything is written**, and a template whose columns are missing is REFUSED with them named
+     — never applied partially, never applied with the offending leaf dropped. That check is
+     also what makes eligibility honest: `source` below is a label for grouping, the COLUMNS are
+     the gate, and the two cannot disagree because only one of them is consulted.
+
+IDEMPOTENT BY PINNED ID. Every view carries `tpl_<template>_<suffix>`, so re-applying updates
+the same views instead of minting "Collections focus 2". `save_view` renames on collision, which
+would otherwise turn a second click into a second copy.
+
+Pure-ish by construction: `TEMPLATES` and every builder are data, so `verify_home.py` can assert
+their shape without a store.
+"""
+
+#: The topic a template is FOR. A coarse grouping label used to filter the picker's list; the
+#: real gate is `missing_columns` below (a table whose contract has the columns can take the
+#: template, whatever we called its source).
+SOURCES = ('odoo_customer', 'odoo_product', 'instagram', 'any')
+
+#: The workspace bucket a topic's views live in. `<key>_table_workspace` for user tables
+#: (`core/user_tables.py:211` builds the same string when it deletes them), and the two built-ins
+#: keep the names their modules have always used.
+_WS_KEYS = {
+    'customer_data': 'customer_table_workspace',
+    'product_data': 'product_table_workspace',
+}
+
+
+def workspace_key(table_key):
+    """The `core.table_store` key for a page key, or None if it is not a table at all."""
+    key = str(table_key or '')
+    if key in _WS_KEYS:
+        return _WS_KEYS[key]
+    if key.startswith('ut_'):
+        return f'{key}_table_workspace'
+    return None
+
+
+def _view(view_id, name, note, visible, *, mode='grid', stack_field=None, sorts=(),
+          filters=(), group_by=None, conj='and'):
+    """One saved view, in the shape `table_store.save_view` stores and the grid reads.
+
+    ⚠ THE SHAPE IS COPIED FROM `_seed_wave17._view` ON PURPOSE, field for field, including the
+    keys that look inert (`widths`, `memberPids`, `rowHeightMode`). The grid's own cleaner fills
+    defaults for what is missing, but a view assembled from a DIFFERENT skeleton is a second
+    definition of what a view is — and the two drift on the day one of them gains a key.
+
+    `permissions.edit` is absent: `table_store.is_shared` reads it, and a view with no
+    permissions block is PERSONAL, which is the only thing this file is allowed to write.
+
+    ⛔ THE MODE LIVES AT `config.display.mode`, AND THE FIRST DRAFT PUT IT AT
+    `config.displayMode` — A KEY NOTHING READS. The gate caught nothing, because it asserted the
+    VALUE against `aios_grid.DISPLAY_MODES` and never the PATH: `"kanban" in DISPLAY_MODES` is
+    true wherever you happen to have written it. The Instagram "Review board" would have been
+    created as a plain GRID under a name promising a board — the view exists, the filter works,
+    the kanban never happens, and nothing goes red. Exactly the silent-drop class as a dropped
+    filter leaf, one field over. Corrected against `aios_grid._clean_display`, which is now RUN
+    over every template in `verify_home` rather than consulted for a vocabulary.
+
+    ⚠ AND `grid` STORES NOTHING. `_clean_display` returns None for it by design ("grid is the
+    absent default, so storing it would be a second way to say nothing"), so writing
+    `display: {'mode': 'grid'}` would be a key the cleaner strips on the next save — a value that
+    exists until something touches it.
+    """
+    display = None
+    if mode != 'grid':
+        display = {'mode': mode}
+        if stack_field:
+            # The kanban lane column. `_clean_display` accepts any ref that NAMES a real field
+            # and leaves what the mode means to the client, which degrades a wrong-typed ref to
+            # its own default rather than erroring.
+            display['stackField'] = stack_field
+    return {
+        'id': view_id, 'name': name, 'kind': 'custom', 'locked': False, 'note': note,
+        'config': {
+            'filters': list(filters), 'filterConj': conj, 'sorts': list(sorts),
+            'groupBy': group_by, 'colorBy': None, 'rowHeightMode': 'short',
+            'order': list(visible), 'visible': list(visible), 'widths': {},
+            'memberPids': [], **({'display': display} if display else {}),
+        },
+    }
+
+
+# ── THE REGISTRY ────────────────────────────────────────────────────────────────────────────
+#
+# ⚠ FIRST BATCH (C12). Every column named below was checked against the live contract when this
+# file was written — `aios_grid_fields.json` for customer, `aios_grid.product_fields()` for
+# product, `automation_engine.CANDIDATE_FIELDS` for the Instagram candidate pool — but the check
+# that MATTERS runs at apply time, against the target the user actually picked, because a
+# contract can move and a ut_ table's columns are whatever its owner made.
+
+TEMPLATES = [
+    {
+        'key': 'collections_focus',
+        'label': 'Collections focus',
+        'desc': 'Everyone with money past due, largest first, with the aging buckets beside it.',
+        'source': 'odoo_customer',
+        'views': [
+            _view(
+                'tpl_collections_focus_overdue', 'Past due',
+                'Customers with an overdue balance, largest first. The four aging columns sum '
+                'to AR overdue; a balance inside the grace period counts as open, not overdue.',
+                ['customer', 'agent', 'ar_overdue', 'ar_aged_1_30', 'ar_aged_31_60',
+                 'ar_aged_61_90', 'ar_aged_90_plus', 'ar_open', 'days_to_pay',
+                 'payment_terms', 'last_order'],
+                sorts=[{'colId': 'ar_overdue', 'dir': 'desc'}],
+                filters=[{'colId': 'ar_overdue', 'op': 'gt', 'value': '0'}],
+            ),
+            _view(
+                'tpl_collections_focus_worst', 'Over 90 days',
+                'The part of the book that is no longer a payment-terms conversation.',
+                ['customer', 'agent', 'ar_aged_90_plus', 'ar_overdue', 'ar_exposure',
+                 'days_to_pay', 'last_order'],
+                sorts=[{'colId': 'ar_aged_90_plus', 'dir': 'desc'}],
+                filters=[{'colId': 'ar_aged_90_plus', 'op': 'gt', 'value': '0'}],
+            ),
+        ],
+    },
+    {
+        'key': 'dba_missing',
+        'label': 'DBA is empty',
+        # The owner's own example (C12). One view, one job, and it is a DATA-QUALITY view: the
+        # brand a customer buys from decides which BU-scoped account can see them at all, so a
+        # blank DBA is a customer nobody's book contains.
+        'desc': 'Customers with no brand recorded — they fall outside every scoped book.',
+        'source': 'odoo_customer',
+        'alert': True,
+        'views': [
+            _view(
+                'tpl_dba_missing_blank', 'DBA is empty',
+                'Customers whose DBA is blank. The brand decides which scoped account sees a '
+                'customer, so a blank one is invisible to every book except an unscoped view.',
+                # ⚠ SORTED BY OPEN RECEIVABLE, NOT BY SALES. This view first named `sales_ltm`,
+                # which DOES NOT EXIST — the customer contract carries no LTM sales column (the
+                # 32 keys in `aios_grid_fields.json`; `verify_home` caught it against the live
+                # contract on the first run). `ar_open` is the nearest real column that answers
+                # the same question — "which of these matters most" — and it answers it in
+                # money that is actually outstanding rather than in history.
+                ['customer', 'dba', 'agent', 'ar_open', 'last_order', 'days_since'],
+                sorts=[{'colId': 'ar_open', 'dir': 'desc'}],
+                # ⚠ `isEmpty`, and it is the one op that is safe here. A `select` column's blank
+                # is not the empty string in every row shape, and `eq ''` would miss the nulls —
+                # `isEmpty`/`isNotEmpty` are evaluated type-independently BEFORE any coercion
+                # (the same reason `_seed_wave17`'s buy list leans on them).
+                filters=[{'colId': 'dba', 'op': 'isEmpty'}],
+            ),
+        ],
+    },
+    {
+        'key': 'buy_list_companion',
+        'label': 'Buy-list companion',
+        'desc': 'What is running out, and what it costs to bring in — beside the buy list.',
+        'source': 'odoo_product',
+        'views': [
+            _view(
+                'tpl_buy_list_companion_cover', 'Cover gap',
+                'SKUs whose days of supply is already shorter than their supplier lead time. '
+                'Stock columns are consolidated across the one physical warehouse, so this is '
+                'empty for a BU-scoped account.',
+                ['code', 'product', 'cover_gap_d', 'dos', 'lead_days', 'supplier', 'on_hand',
+                 'qty_ltm', 'first_cost', 'origin_country'],
+                sorts=[{'colId': 'cover_gap_d', 'dir': 'asc'}],
+                # The same four leaves the wave-17 seed uses, and for the same reason: a bare
+                # `dos < lead_days` reads a SKU with NO days-of-supply as `0 < 30` (the client
+                # engine's `toNum(null)` is 0) and puts every never-selling product on the list.
+                filters=[{'colId': 'dos', 'op': 'isNotEmpty'},
+                         {'colId': 'lead_days', 'op': 'isNotEmpty'},
+                         {'colId': 'lead_days', 'op': 'gt', 'value': '0'},
+                         {'colId': 'dos', 'op': 'lt',
+                          'rhs': {'kind': 'field', 'colId': 'lead_days'}}],
+            ),
+            _view(
+                'tpl_buy_list_companion_nosupplier', 'No supplier on file',
+                'SKUs we cannot reorder because nobody is recorded as selling them to us.',
+                ['code', 'product', 'supplier', 'on_hand', 'qty_ltm', 'first_cost'],
+                sorts=[{'colId': 'qty_ltm', 'dir': 'desc'}],
+                filters=[{'colId': 'supplier', 'op': 'isEmpty'}],
+            ),
+        ],
+    },
+    {
+        'key': 'ig_candidates',
+        'label': 'Candidates review',
+        'desc': 'Discovered profiles as a review board, plus the ones worth reading first.',
+        'source': 'instagram',
+        'views': [
+            _view(
+                'tpl_ig_candidates_board', 'Review board',
+                'Discovered profiles grouped by category. Tick "Tracked" on the ones worth '
+                'keeping — that column is written by a person, never by the automation.',
+                ['handle', 'full_name', 'followers', 'avg_engagement', 'verified', 'category',
+                 'tracked', 'profile_url'],
+                # `stackField`, NOT `groupBy` — the kanban lane column is a `display` ref, while
+                # `groupBy` is the GRID's row grouping. They are two different features that both
+                # sound like "group by", and only one of them makes lanes.
+                mode='kanban', stack_field='category',
+                sorts=[{'colId': 'followers', 'dir': 'desc'}],
+            ),
+            _view(
+                'tpl_ig_candidates_engaged', 'High engagement',
+                'Profiles whose audience actually responds, biggest first. Engagement, not '
+                'follower count, is what a small account can be good at.',
+                ['handle', 'full_name', 'avg_engagement', 'followers', 'category', 'bio',
+                 'external_url', 'tracked'],
+                sorts=[{'colId': 'avg_engagement', 'dir': 'desc'}],
+                filters=[{'colId': 'avg_engagement', 'op': 'gt', 'value': '0'}],
+            ),
+        ],
+    },
+]
+
+
+def get(key):
+    """One template by key, or None."""
+    return next((t for t in TEMPLATES if t['key'] == str(key)), None)
+
+
+def columns_named(template):
+    """Every column key a template's views reference — visible, filtered, sorted, grouped, and
+    the right-hand side of a field-vs-field comparison.
+
+    ⛔ THE `rhs` IS THE ONE PEOPLE FORGET, and `_seed_wave17` learned it the expensive way:
+    `clean_filter_tree` KEEPS a leaf whose rhs names an unknown column — it drops the rhs and
+    leaves the rule — so `dos < lead_days` silently becomes `dos < ""`. The leaf count is
+    unchanged, so a check that counted leaves would pass while the view answered a different
+    question. Naming the rhs here is what makes the eligibility test see it.
+    """
+    out = set()
+    for view in template.get('views') or ():
+        cfg = view.get('config') or {}
+        out.update(cfg.get('visible') or ())
+        for s in cfg.get('sorts') or ():
+            if isinstance(s, dict) and s.get('colId'):
+                out.add(s['colId'])
+        if cfg.get('groupBy'):
+            out.add(cfg['groupBy'])
+        for f in cfg.get('filters') or ():
+            if not isinstance(f, dict):
+                continue
+            if f.get('colId'):
+                out.add(f['colId'])
+            rhs = f.get('rhs')
+            if isinstance(rhs, dict) and rhs.get('colId'):
+                out.add(rhs['colId'])
+    return out
+
+
+def missing_columns(template, field_keys):
+    """The columns this template needs that the target does not have. Empty ⇒ it can be applied.
+
+    THE ELIGIBILITY TEST AND THE REFUSAL TEST ARE THE SAME FUNCTION, deliberately: a picker that
+    offered a template the apply door would then refuse is a control that lies, and two separate
+    predicates is how those two answers drift apart.
+    """
+    return sorted(columns_named(template) - set(field_keys or ()))
+
+
+def offer(field_keys, source=None):
+    """Every template that CAN be applied to a target with these columns.
+
+    `source` narrows further when the caller knows it (the picker passes the target's own), but
+    a template whose columns are all present is offered regardless of label — the columns are
+    the contract and the label is a grouping.
+    """
+    out = []
+    for t in TEMPLATES:
+        if missing_columns(t, field_keys):
+            continue
+        if source and t['source'] not in ('any', source):
+            continue
+        out.append({'key': t['key'], 'label': t['label'], 'desc': t['desc'],
+                    'source': t['source'], 'views': len(t.get('views') or ()),
+                    'alert': bool(t.get('alert'))})
+    return out

web/src/alerts/AlertsPane.tsx

@@ -19,7 +19,14 @@ import {
   markRead,
   runAlert,
 } from "./alertsApi";
-import { EMPTY_INBOX, applyRead, inboxOrder, routeForTopic, stampText } from "./alertsModel";
+import {
+  EMPTY_INBOX,
+  applyRead,
+  inboxOrder,
+  isAutomationReview,
+  routeForTopic,
+  stampText,
+} from "./alertsModel";
 import type { Alert, Inbox, Notification } from "./alertsModel";
 
 /** The clock face this pane uses for its one glyph — drawn, never an emoji. */
@@ -35,12 +42,23 @@ function BellIcon() {
 export default function AlertsPane({
   onClose,
   onOpenView,
+  onOpenAutomation,
   onInbox,
   onToast,
 }: {
   onClose: () => void;
   /** Navigate to the alert's view. The FRAME owns routing; this pane owns the row. */
   onOpenView: (topic: string, viewId: string) => void;
+  /**
+   * WAVE 23 (C6, wiring W23-W5) — the same division for a REVIEW notification: the frame routes
+   * to `#/automation` and asks the surface to select this automation.
+   *
+   * ⛔ REQUIRED, NOT OPTIONAL, and that is the wave-20 lesson written into a type. An optional
+   * callback the frame forgot to pass degrades to "clicking a review notification does nothing",
+   * which is indistinguishable from "the feature was never built" and goes red in no gate. A
+   * required prop fails `tsc` the moment it is unmounted.
+   */
+  onOpenAutomation: (autoId: string, stageId?: string) => void;
   /** Hand the freshly-read inbox back so the nav badge and the pane agree. */
   onInbox: (inbox: Inbox) => void;
   onToast: (message: string) => void;
@@ -114,6 +132,16 @@ export default function AlertsPane({
         publish(applyRead(inbox, [n.id], true));
         void markRead([n.id], true);
       }
+      // ⛔ WAVE 23 C6 — THE KIND BRANCH COMES FIRST, AND ITS ORDER IS THE WHOLE FIX. A review
+      // notification has no `topic` a grid could render, so the view guard below would have
+      // caught every one of them and told the reader their table was "no longer available" —
+      // a confidently wrong sentence about a feature that is working. The destination decides
+      // which guard applies, so the destination is decided first.
+      if (isAutomationReview(n)) {
+        onOpenAutomation(n.autoId!, n.stageId);
+        onClose();
+        return;
+      }
       // A route this client cannot resolve opens NOTHING and says so — alerts
       // outlive the surfaces they were made from.
       if (!routeForTopic(n.topic)) {
@@ -123,7 +151,7 @@ export default function AlertsPane({
       onOpenView(n.topic, n.viewId);
       onClose();
     },
-    [inbox, publish, onOpenView, onClose, onToast]
+    [inbox, publish, onOpenView, onOpenAutomation, onClose, onToast]
   );
 
   const rows = inboxOrder(inbox.items);
@@ -166,7 +194,14 @@ export default function AlertsPane({
                     type="button"
                     className="alerts-row-main"
                     onClick={() => open(n)}
-                    title={`Open ${n.alertLabel || "the alert's view"}`}
+                    // The hover names the DESTINATION, which is now two different places.
+                    // "Open the alert's view" over a review notification described a journey
+                    // the click does not take.
+                    title={
+                      isAutomationReview(n)
+                        ? "Open the automation"
+                        : `Open ${n.alertLabel || "the alert's view"}`
+                    }
                   >
                     <span className="alerts-row-label">{n.label}</span>
                     <span className="alerts-row-meta">

web/src/alerts/alertsModel.ts

@@ -31,6 +31,29 @@ export interface Notification {
    *  would re-introduce the browser-clock drift the offset exists to remove. */
   at: string;
   read: boolean;
+  /**
+   * WAVE 23 (contract C6) — WHAT KIND of notification this is.
+   *
+   * Absent (and every notification written before this wave) means the original one: a record
+   * ENTERED a watched view, routed by `topic` + `viewId`. `"automation_review"` means a card
+   * arrived at a review stage and routes by `autoId` instead — a different destination reached
+   * from the same list.
+   *
+   * ⛔ A STRING, NEVER A UNION, and that is the wave-9 law rather than laziness: the vocabulary
+   * is the SERVER's, and a client union over it turns "the server grew a kind" into "the client
+   * silently drops the row". Unknown kinds fall through to the view route, which is exactly what
+   * they did before this field existed.
+   */
+  kind?: string;
+  /** `automation_review` only: the automation whose review stage a card reached. Absent on
+   *  every other kind — and an `automation_review` row that arrives WITHOUT one opens nothing
+   *  rather than guessing, the same posture `viewId` gets. */
+  autoId?: string;
+  /** Advisory. A surface that does not scroll to a stage simply selects the automation. */
+  stageId?: string;
+  /** How many cards arrived in the batch. C6 queues ONE notification per run naming the count,
+   *  never one per record — so this is the number the row's own text is built from. */
+  count?: number;
 }
 
 /** One alert, as `GET /api/v1/alerts` sends it. */
@@ -87,6 +110,14 @@ export function parseInbox(body: unknown): Inbox {
       alertLabel: str(n.alertLabel),
       at: str(n.at),
       read: n.read === true,
+      // WAVE 23 C6 — ADDITIVE and spread-conditional, exactly like `NavPage`'s flags: a payload
+      // that predates this wave keeps today's shape rather than gaining four `undefined` keys,
+      // and an `automation_review` row missing its `autoId` is left WITHOUT one rather than
+      // with an empty string that would render as a real destination.
+      ...(str(n.kind) ? { kind: str(n.kind) } : {}),
+      ...(str(n.autoId) ? { autoId: str(n.autoId) } : {}),
+      ...(str(n.stageId) ? { stageId: str(n.stageId) } : {}),
+      ...(num(n.count) > 0 ? { count: num(n.count) } : {}),
     });
   }
   return { unread: Math.max(0, num(b.unread)), items };
@@ -134,6 +165,24 @@ export function routeForTopic(topic: string): string | null {
   return null;
 }
 
+/** WAVE 23 C6 — the kind literal the server queues for a card reaching a review stage.
+ *  ONE place, so the pane's branch and the gate's fixture cannot disagree about the word. */
+export const AUTOMATION_REVIEW_KIND = "automation_review";
+
+/**
+ * Does this notification route to an AUTOMATION rather than to a view?
+ *
+ * ⛔ BOTH HALVES ARE REQUIRED, and the second is the one that matters. A row whose kind says
+ * `automation_review` but whose `autoId` never arrived (a server mid-deploy, a truncated
+ * payload) would otherwise take the automation branch and dispatch an open request naming
+ * nothing — a click that appears to work and silently does not. Failing this test sends it down
+ * the view branch, where `routeForTopic` refuses out loud. Fail-closed in the direction that
+ * still says something.
+ */
+export function isAutomationReview(n: Notification): boolean {
+  return n.kind === AUTOMATION_REVIEW_KIND && !!str(n.autoId).trim();
+}
+
 /** Newest first, and unread before read at the same instant — the inbox order.
  *  Stable: two notifications from one write keep the server's order. */
 export function inboxOrder(items: Notification[]): Notification[] {

web/src/apiContract.ts

@@ -101,3 +101,49 @@ export interface ViewOpenDetail {
   topic: string;
   viewId: string;
 }
+
+/**
+ * WAVE 23 (contract C6, wiring W23-W5) — the shell→automation channel for a review
+ * notification's click-through.
+ *
+ * ⛔ THE SAME SHAPE AS `VIEW_OPEN_EVENT` ABOVE, FOR THE SAME REASON, and wave 20 is why both
+ * exist as constants in this leaf rather than as a string typed twice. A card arriving at a
+ * review stage queues an `automation_review` notification naming `{autoId, stageId, count}`;
+ * clicking it has to do TWO things that live on opposite sides of an ownership fence — route to
+ * `#/automation` (the SHELL's hash) and select that automation in the rail (`AutomationSurface`'s
+ * own `activeId`, which the shell cannot see and must not learn). So the frame navigates and
+ * then ASKS, and the surface answers if it can.
+ *
+ * ⚠ THE LISTENER IS THE HALF THAT CAN BE ABSENT. Wave 20 shipped item 25's click-through with
+ * this exact shape and NO listener — the event was dispatched into nothing, every gate green,
+ * the notification landing the reader on the right table and doing nothing else. Declared here
+ * on the wave's first day precisely so the surface can wire the listener while it is being
+ * built rather than at close-out; the wiring row (W23-W5) asserts both ends.
+ *
+ * An automation the reader can no longer open must do NOTHING rather than throw — the listener
+ * checks its own list first, exactly as the grid does for a view it cannot see.
+ */
+export const AUTOMATION_OPEN_EVENT = "aios:automation-open";
+
+/** `detail` of {@link AUTOMATION_OPEN_EVENT}. `stageId` is advisory — a surface that does not
+ *  scroll to a stage simply selects the automation. */
+export interface AutomationOpenDetail {
+  autoId: string;
+  stageId?: string;
+}
+
+/**
+ * WAVE 23 (contracts C2 + C10) — "create an AUTOMATED database", asked from outside the
+ * automation surface.
+ *
+ * R7 puts an "Automated database" door on Home and in the Database flyout, and C2 makes the
+ * automation create wizard the thing behind it — because an automated database is created BY
+ * the automation that fills it, not by a name box that then needs one. The shell cannot open
+ * that wizard directly (it is the surface's own state), so it routes to `#/automation` and
+ * raises this; the surface opens its create flow.
+ *
+ * ⚠ NO DETAIL, deliberately. "Open the create wizard" is the whole message. Anything more —
+ * a preselected kind, a name — would be the shell deciding what the wizard's first step says,
+ * which is the surface's contract (C2's three cards), not the frame's.
+ */
+export const AUTOMATION_CREATE_EVENT = "aios:automation-create";

web/src/automation/AutomationBoard.tsx

@@ -176,7 +176,25 @@ export default function AutomationBoard({
           }, 0);
         }}
       >
-        <span className="autob-card-title">{card.title}</span>
+        <span className="autob-card-title">
+          {card.title}
+          {/*
+            ⭐ C5's CYCLE BADGE. A record that has been round the flow more than once is a
+            different fact from a record on its first pass — on a reset-mode automation it is
+            the difference between "working" and "looping" — so the card says so.
+            ⚠ FROM 2 UPWARDS ONLY, and that is what makes an ABSENT count safe: every card
+            would otherwise wear "x1", which is noise on the common case and, worse, a claim
+            about a number the server has not sent yet (see `BoardCard.cycles`).
+          */}
+          {typeof card.cycles === "number" && card.cycles >= 2 ? (
+            <span
+              className="autob-card-cycles"
+              title={`This record has been round this flow ${card.cycles} times`}
+            >
+              &times;{card.cycles}
+            </span>
+          ) : null}
+        </span>
         {card.sub ? <span className="autob-card-sub">{card.sub}</span> : null}
         {card.movedAt ? (
           <span className="autob-card-when">{whenText(card.movedAt)}</span>

web/src/automation/AutomationBuilder.tsx

@@ -0,0 +1,1558 @@
+// ---------------------------------------------------------------------------
+// automation/AutomationBuilder.tsx — the BUILDER (owner item 3b, contracts
+// C1/C2/C4, ruling R1: "exact layout, Loopable skin").
+//
+// THE ANATOMY IS AIRTABLE'S, 1:1, and it is the owner's reference (images 1-9):
+// a centre column of TRIGGER → ACTIONS with a spine down the left carrying each
+// step's status chip, dashed add-boxes at the end of each section, and a
+// Properties panel on the right whose sections are Trigger details /
+// Configuration / Test step. Every colour, size and weight is OURS (R1,
+// DESIGN.md) — no Airtable blue, no caps micro-labels (R6: "TRIGGER" is
+// "Trigger" here, and de-capping takes the letter-spacing with it).
+//
+// ⛔ IT RENDERS SYNCHRONOUSLY FROM WHAT IT WAS HANDED (C14 leg 1). No fetch, no
+// effect, no second frame: the trigger comes from `automation.trigger`, the
+// actions from `automation.flow`, the machine steps from `automation.graph` —
+// all three already on the list payload the rail used to draw the row you
+// clicked. THIS IS THE GHOST FIX. The old detail rendered Steps, then swapped to
+// the Board when `/board` answered, so switching automations painted the
+// PREVIOUS one's shape inside the new one's frame for as long as a fetch takes.
+// A view that cannot be in two shapes cannot show you the wrong one.
+//
+// ⛔ NO CLIENT UNION OVER A SERVER VOCABULARY, anywhere. Trigger keys, action
+// kinds, comparison operators, ending modes, review deciders and every ceiling
+// ride `GET /automations`. What this file owns is pixels and wording.
+//
+// WHAT PERSISTS WHEN. A discrete choice writes immediately — picking a trigger,
+// adding an action, flipping a switch — because a control you have to remember
+// to Save is not a control (R9). FREE TEXT does not: a value, a prompt or a name
+// commits on BLUR, or every keystroke would PATCH a half-typed condition and the
+// server would refuse most of them out loud (the cron-string precedent in
+// AutomationTrigger).
+// ---------------------------------------------------------------------------
+import type { ReactNode } from "react";
+import { useState } from "react";
+
+import type {
+  Action,
+  ActionCatalogRow,
+  Automation,
+  Cond,
+  FlowVocab,
+  GraphNode,
+  OAuthStatus,
+  TriggerOption,
+  UserTable,
+} from "./automationApi";
+import CondBuilder, { condComplete } from "./CondBuilder";
+
+interface Props {
+  automation: Automation;
+  /** The server's trigger vocabulary (C3). Absent is a state this file states, never fills in. */
+  triggers?: TriggerOption[];
+  catalog: ActionCatalogRow[];
+  vocab?: FlowVocab;
+  tables: UserTable[];
+  oauth: OAuthStatus | null;
+  /** True while a write is in flight — drives the "All changes saved" stamp and disables edits. */
+  busy: boolean;
+  /** Write a partial definition. The caller owns the request and prints the refusal verbatim. */
+  onPatch: (body: Record<string, unknown>) => void;
+  onToggleNode: (nodeId: string) => void;
+  /**
+   * ⛔ CHOOSING A TRIGGER IS NOT A `{trigger:{key}}` PATCH, and getting that wrong is invisible.
+   * `schedule` is what today's engine actually READS, so a pick has to write BOTH halves or
+   * "At a scheduled time" would store a key and leave the cron switched off — a trigger that
+   * says it is scheduled and never fires. The detail already owns that two-write shape
+   * (`pickTrigger`); the builder calls it rather than composing a second copy of it.
+   */
+  onPickTrigger: (key: string) => void;
+  onRunNow: () => void;
+  /**
+   * The MACHINE steps' config bodies (source / columns / capture / find / write). They live in
+   * `AutomationDetail` and are unchanged by this wave, so they are passed IN rather than moved:
+   * a builder that re-implemented them would be a second copy of five panels whose only job is
+   * to agree with the engine.
+   */
+  renderNodePanel: (node: GraphNode) => ReactNode;
+  /**
+   * The SCHEDULE half of the trigger face (`AutomationTrigger` with its picker hidden). Passed
+   * in for the same reason the node panels are: the cron round-trip, the server's preset list
+   * and the tick-honesty note exist exactly once, and both this view and the board render the
+   * same element rather than two copies of three things that go wrong invisibly.
+   */
+  scheduleFace: ReactNode;
+}
+
+type Sel = { kind: "trigger" | "action" | "node"; id: string };
+
+/** Airtable phrases the empty state's shortcuts; ours come from the SERVER's own list (image 1). */
+const SUGGESTED = 6;
+
+/**
+ * A trigger's icon, PER KIND. Drawn, never an emoji (owner constant).
+ *
+ * ⚠ THE FIRST VERSION DREW ONE GLYPH FOR ALL ELEVEN, and reading the suggested list settled it:
+ * six identical arrows down the left edge is decoration, not information — the eye learns
+ * nothing and the column just gets wider. Airtable differentiates them (images 1/2) for the
+ * same reason. Unknown keys keep the neutral arrow, so a trigger the engine adds tomorrow
+ * renders plainly rather than not at all (the silent-drop rule, applied to icons).
+ */
+function TriggerMark({ kind = "" }: { kind?: string }) {
+  const common = {
+    width: 15, height: 15, viewBox: "0 0 16 16", fill: "none", stroke: "currentColor",
+    strokeWidth: 1.4, strokeLinecap: "round" as const, strokeLinejoin: "round" as const,
+    "aria-hidden": true,
+  };
+  if (kind === "schedule")
+    return (
+      <svg {...common}>
+        <circle cx="8" cy="8" r="5.6" />
+        <path d="M8 5.2V8l2 1.4" />
+      </svg>
+    );
+  if (kind === "event_field")
+    return (
+      <svg {...common}>
+        <path d="M2.8 3.4h10.4l-4 4.6v4.2l-2.4 1.2V8z" />
+      </svg>
+    );
+  if (kind === "record_created")
+    return (
+      <svg {...common}>
+        <rect x="3" y="2.6" width="10" height="10.8" rx="1.8" />
+        <path d="M8 5.8v4.4M5.8 8h4.4" />
+      </svg>
+    );
+  if (kind === "record_updated")
+    return (
+      <svg {...common}>
+        <rect x="3" y="2.6" width="10" height="10.8" rx="1.8" />
+        <path d="M5.8 6.4h4.4M5.8 9.2h2.6" />
+      </svg>
+    );
+  if (kind === "enters_view")
+    return (
+      <svg {...common}>
+        <path d="M1.8 8s2.4-4 6.2-4 6.2 4 6.2 4-2.4 4-6.2 4-6.2-4-6.2-4z" />
+        <circle cx="8" cy="8" r="1.7" />
+      </svg>
+    );
+  if (kind === "webhook")
+    return (
+      <svg {...common}>
+        <path d="M6.6 9.4 4.9 11a2.6 2.6 0 1 1-1.5-4.4" />
+        <path d="M9.4 6.6 11.1 5a2.6 2.6 0 1 1 1.5 4.4" />
+        <path d="M6.2 8h3.6" />
+      </svg>
+    );
+  if (kind === "email")
+    return (
+      <svg {...common}>
+        <rect x="2.2" y="3.6" width="11.6" height="8.8" rx="1.6" />
+        <path d="m2.6 4.6 5.4 3.8 5.4-3.8" />
+      </svg>
+    );
+  if (kind === "form_submitted")
+    return (
+      <svg {...common}>
+        <rect x="3" y="2.6" width="10" height="10.8" rx="1.8" />
+        <path d="M5.8 6h4.4M5.8 8.6h2.2M9 11l1.2 1.2L12.6 9.8" />
+      </svg>
+    );
+  if (kind === "button_clicked")
+    return (
+      <svg {...common}>
+        <path d="M6 3.2v6.2l1.6-1.4 1.4 3 1.6-.8-1.4-2.8 2.2-.2z" />
+      </svg>
+    );
+  if (kind === "comment_added")
+    return (
+      <svg {...common}>
+        <path d="M13.4 9.4a1.6 1.6 0 0 1-1.6 1.6H5.4L2.6 13.4V4.2a1.6 1.6 0 0 1 1.6-1.6h7.6a1.6 1.6 0 0 1 1.6 1.6z" />
+      </svg>
+    );
+  return (
+    <svg {...common}>
+      <path d="M3 3v6.2a2 2 0 0 0 2 2h7.4" />
+      <path d="M10.2 9.2 12.8 11.2 10.2 13.2" />
+    </svg>
+  );
+}
+
+function ActionMark({ kind }: { kind: string }) {
+  const common = {
+    width: 15, height: 15, viewBox: "0 0 16 16", fill: "none", stroke: "currentColor",
+    strokeWidth: 1.4, strokeLinecap: "round" as const, strokeLinejoin: "round" as const,
+    "aria-hidden": true,
+  };
+  if (kind === "group")
+    return (
+      <svg {...common}>
+        <path d="M2.6 8h3l2.6-3.6h5M8.2 11.6H5.6m2.6 0h5" />
+        <path d="M11.6 2.6 13.4 4.4 11.6 6.2M11.6 9.8l1.8 1.8-1.8 1.8" />
+      </svg>
+    );
+  if (kind === "review")
+    return (
+      <svg {...common}>
+        <circle cx="8" cy="5.6" r="2.6" />
+        <path d="M3 13.4c.7-2.3 2.6-3.6 5-3.6s4.3 1.3 5 3.6" />
+      </svg>
+    );
+  if (kind === "create_record")
+    return (
+      <svg {...common}>
+        <rect x="2.6" y="2.6" width="10.8" height="10.8" rx="2" />
+        <path d="M8 5.6v4.8M5.6 8h4.8" />
+      </svg>
+    );
+  if (kind === "find_records")
+    return (
+      <svg {...common}>
+        <circle cx="7.2" cy="7.2" r="4" />
+        <path d="m10.2 10.2 3.2 3.2" />
+      </svg>
+    );
+  /*
+    ⚠ THE MACHINE KINDS ARE HERE TOO, and leaving them out was a real defect for one render:
+    the engine's nodes are `source | capture | branch | write`, none of which matched above, so
+    "Write to the database" and "Fetch the page" both drew the PENCIL — an edit glyph on a step
+    that reads a web page and a step that writes a database. Caught by reading the screenshot,
+    not by a gate ([[ui-invisible-to-assertions]]): the icon was present, legible and wrong.
+    These are the shapes the retired `AutomationSteps.KindMark` used, kept with their meanings.
+  */
+  if (kind === "source")
+    return (
+      <svg {...common}>
+        <circle cx="8" cy="8" r="5.6" />
+        <path d="M2.6 8h10.8M8 2.4c1.5 1.7 2.2 3.6 2.2 5.6S9.5 12.3 8 13.6C6.5 12.3 5.8 10 5.8 8s.7-3.9 2.2-5.6z" />
+      </svg>
+    );
+  if (kind === "write")
+    return (
+      <svg {...common}>
+        <ellipse cx="8" cy="4.2" rx="4.8" ry="1.9" />
+        <path d="M3.2 4.2v7.6c0 1 2.1 1.9 4.8 1.9s4.8-.9 4.8-1.9V4.2M3.2 8c0 1 2.1 1.9 4.8 1.9s4.8-.9 4.8-1.9" />
+      </svg>
+    );
+  if (kind === "capture")
+    return (
+      <svg {...common}>
+        <path d="M8 2.6v7.2M5.2 7l2.8 2.8L10.8 7M3 12.4h10" />
+      </svg>
+    );
+  if (kind === "branch")
+    return (
+      <svg {...common}>
+        <path d="M2.6 8h3.2l2.6-3.6h5M8.4 11.6H5.8m2.6 0h5" />
+        <path d="M11.6 2.6 13.4 4.4 11.6 6.2M11.6 9.8l1.8 1.8-1.8 1.8" />
+      </svg>
+    );
+  if (kind === "update_record")
+    return (
+      <svg {...common}>
+        <path d="M11.4 2.8 13.2 4.6 6 11.8l-2.6.8.8-2.6z" />
+        <path d="M3 13.6h10" />
+      </svg>
+    );
+  if (kind === "send_email")
+    return (
+      <svg {...common}>
+        <rect x="2.2" y="3.6" width="11.6" height="8.8" rx="1.6" />
+        <path d="m2.6 4.6 5.4 3.8 5.4-3.8" />
+      </svg>
+    );
+  if (kind === "slack")
+    return (
+      <svg {...common}>
+        <path d="M13.4 9.4a1.6 1.6 0 0 1-1.6 1.6H5.4L2.6 13.4V4.2a1.6 1.6 0 0 1 1.6-1.6h7.6a1.6 1.6 0 0 1 1.6 1.6z" />
+      </svg>
+    );
+  if (kind === "run_script")
+    return (
+      <svg {...common}>
+        <path d="M5.6 5.4 3 8l2.6 2.6M10.4 5.4 13 8l-2.6 2.6M9 3.4 7 12.6" />
+      </svg>
+    );
+  if (kind === "generate_ai")
+    return (
+      <svg {...common}>
+        <path d="M8 2.4l1.5 3.4 3.4 1.5-3.4 1.5L8 12.2 6.5 8.8 3.1 7.3l3.4-1.5z" />
+      </svg>
+    );
+  if (kind === "repeating_group")
+    return (
+      <svg {...common}>
+        <path d="M3 8a5 5 0 0 1 5-5c2 0 3.4 1 4.3 2.4M13 8a5 5 0 0 1-5 5c-2 0-3.4-1-4.3-2.4" />
+        <path d="M12.4 2.6v2.9h-2.9M3.6 13.4v-2.9h2.9" />
+      </svg>
+    );
+  /*
+    ⛔ THE FALLBACK IS NEUTRAL, and it was not the first time round. The default used to BE the
+    pencil — a real member of the set (`update_record`) — so every kind with no arm silently
+    borrowed "edit": `send_email`, `run_script` and `repeating_group` all drew it in the action
+    menu, which reads as three actions that modify a record. A fallback that is a real member
+    cannot be told apart from a match; this one can.
+  */
+  return (
+    <svg {...common}>
+      <rect x="3.2" y="3.2" width="9.6" height="9.6" rx="2.2" />
+      <circle cx="8" cy="8" r="1.4" />
+    </svg>
+  );
+}
+
+/** The label a table key reads as. A raw `ut_9f3a…` on a card is a key, not a subtitle. */
+function tableLabel(tables: UserTable[], key: string): string {
+  if (!key) return "";
+  return tables.find((t) => t.key === key)?.label || key;
+}
+
+export default function AutomationBuilder({
+  automation,
+  triggers,
+  catalog,
+  vocab,
+  tables,
+  oauth,
+  busy,
+  onPatch,
+  onToggleNode,
+  onPickTrigger,
+  onRunNow,
+  renderNodePanel,
+  scheduleFace,
+}: Props) {
+  const [sel, setSel] = useState<Sel>({ kind: "trigger", id: "" });
+  const [picking, setPicking] = useState(false);
+  const [adding, setAdding] = useState(false);
+  /** The trigger key awaiting confirmation (image 6) — a change that can invalidate config. */
+  const [confirmKey, setConfirmKey] = useState("");
+
+  const trigger = automation.trigger || null;
+  const triggerKey = trigger?.key || (automation.schedule?.enabled ? "schedule" : "manual");
+  const options = triggers || [];
+  const picked = options.find((t) => t.key === triggerKey) || null;
+  const actions = automation.flow?.actions || [];
+  const nodes = (automation.graph?.nodes || []).filter((n) => n.kind !== "trigger");
+  const ops = vocab?.condOps || [];
+  const nullaryOps = vocab?.nullaryCondOps || [];
+  const table = tables.find((t) => t.key === (trigger?.table || "")) || null;
+
+  /**
+   * ⛔ HAS ANYTHING BEEN CHOSEN? — and the first version of this line was wrong in a way only
+   * a screenshot showed.
+   *
+   * It read `!!trigger || key === "schedule" || key === "manual"`, and `triggerKey` DERIVES
+   * "manual" whenever nothing is stored — so it was true for every automation ever, and the
+   * Airtable empty state (image 1) was unreachable code that every gate was happy with.
+   *
+   * The honest test is what the DEFINITION holds, not what the picker displays: the engine
+   * deliberately stores no trigger for manual/schedule ("`schedule` already owns the cron"), so
+   * `trigger === null && !schedule.enabled` IS "nobody has decided yet". Manual is what that
+   * state DOES, not a thing you pick out of it — which is why the suggested list below omits
+   * it: an option whose selection stores nothing would bounce straight back to this state on
+   * the next reload, and a control that undoes itself is worse than no control.
+   */
+  const chosen = !!trigger || !!automation.schedule?.enabled;
+  const configured = !trigger || trigger.configured !== false;
+
+  /** Write one key of the trigger, keeping the rest — the engine merges against `previous`. */
+  const patchTrigger = (patch: Record<string, unknown>) =>
+    onPatch({ trigger: { key: triggerKey, ...patch } });
+
+  const patchFlow = (next: Action[]) =>
+    onPatch({ flow: { actions: next, ending: automation.flow?.ending || { mode: "terminal" } } });
+
+  /** Replace one action anywhere in the tree, groups included — ids are stable server-side. */
+  const editAction = (id: string, change: (a: Action) => Action) => {
+    const walk = (list: Action[]): Action[] =>
+      list.map((a) => {
+        if (a.id === id) return change(a);
+        const kids = (a.config as { actions?: Action[] })?.actions;
+        if (a.kind === "group" && Array.isArray(kids))
+          return { ...a, config: { ...a.config, actions: walk(kids) } };
+        return a;
+      });
+    patchFlow(walk(actions));
+  };
+
+  const dropAction = (id: string) => {
+    const walk = (list: Action[]): Action[] =>
+      list
+        .filter((a) => a.id !== id)
+        .map((a) => {
+          const kids = (a.config as { actions?: Action[] })?.actions;
+          return a.kind === "group" && Array.isArray(kids)
+            ? { ...a, config: { ...a.config, actions: walk(kids) } }
+            : a;
+        });
+    patchFlow(walk(actions));
+    if (sel.kind === "action" && sel.id === id) setSel({ kind: "trigger", id: "" });
+  };
+
+  /**
+   * ⛔ A NEW ACTION'S CONFIG MUST BE ONE THE SERVER ACCEPTS — and the first version of this
+   * function got it wrong for FOUR of the five kinds, which is worth writing down because every
+   * gate was green and the harness could not see it (SSR renders no click).
+   *
+   * MEASURED against `clean_actions` itself (`python -c` over the engine module, no server):
+   *   `{values:{"":""}}`      -> "a value is written to a field with no name"
+   *   `{table:"",values:…}`   -> the same, twice
+   *   `{table:""}` (find)     -> "the find records action names no database"
+   *   `{cond:…,actions:[]}`   -> "a conditional group with no actions inside it does nothing"
+   * So clicking "Add → Update record" would have produced a red banner and NO CARD. This is the
+   * wave-22 discovery-predicate scar reproduced exactly ([[cg-condition-builder-items]] — every
+   * default must be one the server takes), in a file whose own comment cites it.
+   *
+   * The seeds below are built from data this component already holds, and `seedFor` returns
+   * NULL when it cannot build a legal one. A kind with no legal seed is offered DISABLED with
+   * the reason, rather than offered and refused: the two states look identical to a user and
+   * only one of them is honest.
+   */
+  const walkFields = table?.fields || [];
+  const firstField = walkFields[0]?.key || "";
+  const firstTable = tables[0] || null;
+  const firstTableField = firstTable?.fields?.[0]?.key || "";
+
+  const seedFor = (kind: string): Record<string, unknown> | null => {
+    if (kind === "review")
+      return { decidedBy: "user", label: "Review", next: ["Approved", "Declined"], prompt: "" };
+    if (kind === "update_record")
+      return firstField ? { values: { [firstField]: "" } } : null;
+    if (kind === "create_record")
+      return firstTable && firstTableField
+        ? { table: firstTable.key, values: { [firstTableField]: "" } }
+        : null;
+    if (kind === "find_records")
+      return firstTable ? { table: firstTable.key, cond: null, limit: 25 } : null;
+    if (kind === "group")
+      // A group with no children "does nothing" and is refused, so it is born with one — the
+      // cheapest legal child, not a review, because a review would also mint a board stage that
+      // nobody asked for by clicking "Conditional logic".
+      return firstField
+        ? { cond: null,
+            actions: [{ id: "", kind: "update_record", enabled: true, when: null,
+              config: { values: { [firstField]: "" } } }] }
+        : null;
+    return null;
+  };
+
+  /** Why a kind cannot be added yet — the server's own precondition, said before the click. */
+  const seedBlock = (kind: string): string => {
+    if (kind === "update_record" || kind === "group")
+      return "Name the trigger's database first — this needs a column to write.";
+    if (kind === "create_record" || kind === "find_records")
+      return "There is no blank database to point at yet.";
+    return "";
+  };
+
+  const addAction = (kind: string, into?: string) => {
+    const seed = seedFor(kind);
+    if (!seed) return;
+    const fresh: Action = { id: "", kind, enabled: true, when: null, config: seed };
+    if (!into) {
+      patchFlow([...actions, fresh]);
+    } else {
+      editAction(into, (a) => ({
+        ...a,
+        config: {
+          ...a.config,
+          actions: [...(((a.config as { actions?: Action[] }).actions) || []), fresh],
+        },
+      }));
+    }
+    setAdding(false);
+  };
+
+  // ── the centre column ────────────────────────────────────────────────────────────────────
+  const chip = () => {
+    if (!chosen) return null;
+    if (!configured)
+      return (
+        <span className="autox-chip is-warn" title="This trigger cannot fire until it is finished">
+          Finish configuration
+        </span>
+      );
+    if (trigger?.paused)
+      return <span className="autox-chip is-warn">Paused</span>;
+    if (picked && picked.ready === false)
+      return <span className="autox-chip is-warn">Not set up</span>;
+    const last = automation.runs?.[0];
+    if (last)
+      return (
+        <span className="autox-chip is-ok" title={last.summary}>
+          {last.ok ? "Last run succeeded" : "Last run failed"}
+        </span>
+      );
+    return null;
+  };
+
+  const actionCard = (a: Action, depth: number): ReactNode => {
+    const row = catalog.find((c) => c.kind === a.kind);
+    const kids = ((a.config as { actions?: Action[] }).actions) || [];
+    const isGroup = a.kind === "group";
+    return (
+      <div className="autox-actionwrap" key={a.id}>
+        <div
+          className={
+            "autox-card" +
+            (sel.kind === "action" && sel.id === a.id ? " is-selected" : "") +
+            (a.enabled ? "" : " is-off") +
+            (isGroup ? " is-group" : "")
+          }
+        >
+          <button
+            type="button"
+            className="autox-card-hit"
+            aria-pressed={sel.kind === "action" && sel.id === a.id}
+            onClick={() => setSel({ kind: "action", id: a.id })}
+          >
+            <span className="autox-card-mark">
+              <ActionMark kind={a.kind} />
+            </span>
+            <span className="autox-card-text">
+              <span className="autox-card-title">
+                {isGroup ? "If conditions are met" : row?.label || a.kind}
+              </span>
+              {isGroup ? null : (
+                <span className="autox-card-sub">{actionSub(a, tables)}</span>
+              )}
+            </span>
+          </button>
+          <button
+            type="button"
+            className="autox-card-drop"
+            disabled={busy}
+            aria-label={`Remove ${row?.label || a.kind}`}
+            title={`Remove ${row?.label || a.kind}`}
+            onClick={() => dropAction(a.id)}
+          >
+            <svg width="12" height="12" viewBox="0 0 16 16" fill="none" aria-hidden="true">
+              <path d="M4 4l8 8M12 4l-8 8" stroke="currentColor" strokeWidth="1.5"
+                strokeLinecap="round" />
+            </svg>
+          </button>
+        </div>
+
+        {/* A GROUP HOLDS ITS OWN COLUMN (image 9) — nested cards and their own dashed add. The
+            nesting ceiling is the SERVER's `maxGroupDepth`, so this affordance disappears at
+            exactly the depth `clean_actions` refuses. */}
+        {isGroup ? (
+          <div className="autox-nest">
+            {kids.map((k) => actionCard(k, depth + 1))}
+            {depth + 1 < (vocab?.maxGroupDepth ?? 2) || !kids.length ? (
+              <button
+                type="button"
+                className="autox-add is-nested"
+                disabled={busy || !seedFor("update_record")}
+                title={seedFor("update_record") ? undefined : seedBlock("update_record")}
+                onClick={() => addAction("update_record", a.id)}
+              >
+                + Add an action in this group
+              </button>
+            ) : null}
+          </div>
+        ) : null}
+      </div>
+    );
+  };
+
+  return (
+    <>
+      <div className="autox-flow">
+        {/* ── TRIGGER ─────────────────────────────────────────────────────────────────── */}
+        <div className="autox-step">
+          <div className="autox-side">
+            <span className="autox-tag">Trigger</span>
+            {chip()}
+          </div>
+          <div className="autox-main">
+            {chosen && options.length ? (
+              <div
+                className={
+                  "autox-card is-trigger" + (sel.kind === "trigger" ? " is-selected" : "")
+                }
+              >
+                <button
+                  type="button"
+                  className="autox-card-hit"
+                  aria-pressed={sel.kind === "trigger"}
+                  onClick={() => setSel({ kind: "trigger", id: "" })}
+                >
+                  <span className="autox-card-mark">
+                    <TriggerMark kind={triggerKey} />
+                  </span>
+                  <span className="autox-card-text">
+                    <span className="autox-card-title">
+                      {picked?.label || triggerKey}
+                    </span>
+                    {trigger?.table ? (
+                      <span className="autox-card-sub">
+                        In {tableLabel(tables, trigger.table)}
+                      </span>
+                    ) : null}
+                  </span>
+                </button>
+              </div>
+            ) : (
+              /*
+                THE EMPTY STATE (image 1): a dashed add-box and the server's own suggested
+                triggers. One line of chrome, no tour (R13) — the list IS the explanation, and
+                it is the server's list so it cannot describe a trigger we removed.
+              */
+              <>
+                <button
+                  type="button"
+                  className="autox-add is-empty"
+                  disabled={busy || !options.length}
+                  onClick={() => setPicking(true)}
+                >
+                  + Add trigger
+                </button>
+                {options.length ? (
+                  <div className="autox-suggest">
+                    <p className="autox-suggest-head">Suggested triggers</p>
+                    {options
+                      .filter((t) => t.ready !== false && !t.planned && t.key !== "manual")
+                      .slice(0, SUGGESTED)
+                      .map((t) => (
+                        <button
+                          key={t.key}
+                          type="button"
+                          className="autox-suggest-row"
+                          disabled={busy}
+                          onClick={() => onPickTrigger(t.key)}
+                        >
+                          <span className="autox-card-mark">
+                            <TriggerMark kind={t.key} />
+                          </span>
+                          {t.label}
+                        </button>
+                      ))}
+                  </div>
+                ) : (
+                  <p className="auto-note">This server did not offer a trigger list.</p>
+                )}
+                {/* ONE LINE (R13), and it is what is TRUE of this state rather than a caption
+                    for the box above it: with nothing chosen, Run now is the only thing that
+                    starts this automation. Airtable's empty state means "it cannot run"; ours
+                    does not, and saying so is the difference between a screen that is honest
+                    and one that merely looks the same. */}
+                <p className="auto-hint">Until then, only Run now starts it.</p>
+              </>
+            )}
+          </div>
+        </div>
+
+        {/* ── ACTIONS ─────────────────────────────────────────────────────────────────── */}
+        <div className="autox-step">
+          <div className="autox-side">
+            <span className="autox-tag">Actions</span>
+          </div>
+          <div className="autox-main">
+            {actions.map((a) => actionCard(a, 0))}
+
+            {/* THE MACHINE STEPS (C1) — engine-derived, read-only cards. They are what this
+                automation IS (fetch a page, write a database); the flow's actions are what the
+                owner adds on top. Rendering them from `graph()` is the same law the numbered
+                steps were built on: the surface cannot show a step the engine stopped running. */}
+            {nodes.map((n) => (
+              <div
+                key={n.id}
+                className={
+                  "autox-card is-machine" +
+                  (sel.kind === "node" && sel.id === n.id ? " is-selected" : "") +
+                  (n.enabled ? "" : " is-off")
+                }
+              >
+                <button
+                  type="button"
+                  className="autox-card-hit"
+                  aria-pressed={sel.kind === "node" && sel.id === n.id}
+                  title={n.detail || n.subtitle}
+                  onClick={() => setSel({ kind: "node", id: n.id })}
+                >
+                  <span className="autox-card-mark">
+                    <ActionMark kind={n.kind} />
+                  </span>
+                  <span className="autox-card-text">
+                    <span className="autox-card-title">{n.title}</span>
+                    <span className="autox-card-sub">{n.subtitle}</span>
+                  </span>
+                  <span className={`auto-dot is-${n.status}`} aria-label={`Last run: ${n.status}`} />
+                </button>
+                {n.toggle ? (
+                  <button
+                    type="button"
+                    className={"auto-step-switch" + (n.enabled ? " is-on" : "")}
+                    disabled={busy}
+                    aria-pressed={n.enabled}
+                    aria-label={`${n.enabled ? "Turn off" : "Turn on"} ${n.title}`}
+                    title={`${n.enabled ? "Turn off" : "Turn on"} ${n.title}`}
+                    onClick={() => onToggleNode(n.id)}
+                  >
+                    <span className="auto-step-switch-knob" />
+                  </button>
+                ) : null}
+              </div>
+            ))}
+
+            <button
+              type="button"
+              className="autox-add"
+              disabled={busy || !catalog.length}
+              onClick={() => setAdding((v) => !v)}
+            >
+              + Add advanced logic or action
+            </button>
+
+            {/* THE ACTION MENU (images 7/8): the server's catalog, grouped by its own `group`
+                key, with `ready:false` rows faded and carrying the server's reason. A shorter
+                menu would imply those actions do not exist — the owner asked to see all of
+                them, and `clean_actions` refuses the unready ones at the door, so faded is a
+                wall rather than a decoration. */}
+            {adding ? (
+              <div className="autox-menu" role="menu">
+                {[...new Set(catalog.map((c) => c.group))].map((group) => (
+                  <div className="autox-menu-group" key={group}>
+                    <p className="autox-menu-head">{group}</p>
+                    {catalog
+                      .filter((c) => c.group === group)
+                      .map((c) => (
+                        <button
+                          key={c.kind}
+                          type="button"
+                          className={
+                            "autox-menu-row" +
+                            (c.ready && seedFor(c.kind) ? "" : " is-planned")
+                          }
+                          disabled={!c.ready || busy || !seedFor(c.kind)}
+                          title={
+                            c.ready && !seedFor(c.kind) ? seedBlock(c.kind) : c.detail
+                          }
+                          onClick={() => addAction(c.kind)}
+                        >
+                          <span className="autox-card-mark">
+                            <ActionMark kind={c.kind} />
+                          </span>
+                          <span className="autox-menu-text">
+                            <span className="autox-menu-label">
+                              {c.label}
+                              {!c.ready ? (
+                                <span className="autox-soon">Coming soon</span>
+                              ) : !seedFor(c.kind) ? (
+                                /* NOT the same state as "coming soon", so not the same word:
+                                   this one is built and waiting on THIS automation, and the
+                                   title says exactly what is missing. */
+                                <span className="autox-soon">Needs a database</span>
+                              ) : null}
+                            </span>
+                            <span className="autox-menu-detail">{c.detail}</span>
+                          </span>
+                        </button>
+                      ))}
+                  </div>
+                ))}
+              </div>
+            ) : null}
+          </div>
+        </div>
+      </div>
+
+      {/* ── PROPERTIES ──────────────────────────────────────────────────────────────────── */}
+      <aside className="auto-panel autox-props" aria-label="Properties">
+        <div className="auto-panel-head">
+          <h2>Properties</h2>
+          <span className={"autox-saved" + (busy ? " is-busy" : "")}>
+            {busy ? "Saving…" : "All changes saved"}
+          </span>
+        </div>
+
+        {sel.kind === "trigger" ? (
+          <TriggerProps
+            automation={automation}
+            triggerKey={triggerKey}
+            options={options}
+            picked={picked}
+            table={table}
+            tables={tables}
+            ops={ops}
+            nullaryOps={nullaryOps}
+            vocab={vocab}
+            oauth={oauth}
+            busy={busy}
+            onAskChange={setConfirmKey}
+            onPatchTrigger={patchTrigger}
+            onPickTrigger={onPickTrigger}
+            onRunNow={onRunNow}
+            scheduleFace={scheduleFace}
+          />
+        ) : sel.kind === "action" ? (
+          <ActionProps
+            action={findAction(actions, sel.id)}
+            catalog={catalog}
+            tables={tables}
+            walkFields={walkFields}
+            ops={ops}
+            nullaryOps={nullaryOps}
+            vocab={vocab}
+            busy={busy}
+            onEdit={(change) => editAction(sel.id, change)}
+          />
+        ) : (
+          nodePanel(nodes, sel.id, renderNodePanel)
+        )}
+      </aside>
+
+      {/* THE CONFIRM (image 6). A trigger change can invalidate the configuration under it, so
+          it ASKS — and it says what it will cost rather than "are you sure". */}
+      {confirmKey ? (
+        <div className="autox-confirm" role="dialog" aria-label="Change the trigger">
+          <p className="autox-confirm-title">Change the trigger?</p>
+          <p className="autox-confirm-body">
+            Anything configured for {picked?.label || triggerKey} is dropped.
+          </p>
+          <div className="autox-confirm-acts">
+            <button type="button" className="auto-btn" onClick={() => setConfirmKey("")}>
+              Cancel
+            </button>
+            <button
+              type="button"
+              className="auto-btn is-danger"
+              onClick={() => {
+                onPickTrigger(confirmKey);
+                setConfirmKey("");
+              }}
+            >
+              Change trigger
+            </button>
+          </div>
+        </div>
+      ) : null}
+
+      {/* The picker, opened from the empty state's dashed box (image 2). */}
+      {picking ? (
+        <div className="autox-menu is-trigger" role="menu">
+          {options.map((t) => (
+            <button
+              key={t.key}
+              type="button"
+              className={"autox-menu-row" + (t.planned ? " is-planned" : "")}
+              disabled={!!t.planned || busy}
+              onClick={() => {
+                onPickTrigger(t.key);
+                setPicking(false);
+              }}
+            >
+              <span className="autox-card-mark">
+                <TriggerMark kind={t.key} />
+              </span>
+              <span className="autox-menu-text">
+                <span className="autox-menu-label">
+                  {t.label}
+                  {t.planned ? <span className="autox-soon">Coming soon</span> : null}
+                  {!t.planned && t.ready === false ? (
+                    <span className="autox-soon">Needs setting up</span>
+                  ) : null}
+                </span>
+              </span>
+            </button>
+          ))}
+        </div>
+      ) : null}
+    </>
+  );
+}
+
+/** One action's subtitle — what it will DO, composed from its own config. */
+function actionSub(a: Action, tables: UserTable[]): string {
+  const cfg = a.config || {};
+  if (a.kind === "update_record") {
+    const keys = Object.keys((cfg as { values?: Record<string, unknown> }).values || {})
+      .filter(Boolean);
+    return keys.length ? `Sets ${keys.join(", ")}` : "No values yet";
+  }
+  if (a.kind === "create_record") {
+    const t = String((cfg as { table?: string }).table || "");
+    return t ? `Into ${tableLabel(tables, t)}` : "No database yet";
+  }
+  if (a.kind === "find_records") {
+    const t = String((cfg as { table?: string }).table || "");
+    return t ? `In ${tableLabel(tables, t)}` : "No database yet";
+  }
+  if (a.kind === "review") {
+    const by = String((cfg as { decidedBy?: string }).decidedBy || "user");
+    return by === "ai" ? "Decided by AI" : "Decided by a person";
+  }
+  return "";
+}
+
+function findAction(list: Action[], id: string): Action | null {
+  for (const a of list) {
+    if (a.id === id) return a;
+    const kids = (a.config as { actions?: Action[] })?.actions;
+    if (a.kind === "group" && Array.isArray(kids)) {
+      const hit = findAction(kids, id);
+      if (hit) return hit;
+    }
+  }
+  return null;
+}
+
+function nodePanel(
+  nodes: GraphNode[],
+  id: string,
+  render: (node: GraphNode) => ReactNode
+): ReactNode {
+  const node = nodes.find((n) => n.id === id);
+  if (!node) return <p className="auto-note">That step is no longer part of this automation.</p>;
+  return (
+    <>
+      <h3>{node.title}</h3>
+      {node.detail ? <p className="auto-hint">{node.detail}</p> : null}
+      {render(node)}
+    </>
+  );
+}
+
+// ── the Properties panel's two faces ─────────────────────────────────────────────────────────
+
+function TriggerProps({
+  automation,
+  triggerKey,
+  options,
+  picked,
+  table,
+  tables,
+  ops,
+  nullaryOps,
+  vocab,
+  oauth,
+  busy,
+  onAskChange,
+  onPatchTrigger,
+  onPickTrigger,
+  onRunNow,
+  scheduleFace,
+}: {
+  automation: Automation;
+  triggerKey: string;
+  options: TriggerOption[];
+  picked: TriggerOption | null;
+  table: UserTable | null;
+  tables: UserTable[];
+  ops: string[];
+  nullaryOps: string[];
+  vocab?: FlowVocab;
+  oauth: OAuthStatus | null;
+  busy: boolean;
+  /** Ask before a trigger change that can invalidate the config under it (image 6). */
+  onAskChange: (key: string) => void;
+  onPatchTrigger: (patch: Record<string, unknown>) => void;
+  onPickTrigger: (key: string) => void;
+  onRunNow: () => void;
+  scheduleFace: ReactNode;
+}) {
+  const trigger = automation.trigger || null;
+  const provider = picked?.connect?.provider || "";
+  const connected = !!(provider && oauth?.[provider]?.connected);
+  const startUrl = picked?.connect?.startUrl || "";
+  const needsTable = !!trigger && "table" in trigger;
+  const last = automation.runs?.[0];
+
+  return (
+    <>
+      <h3>Trigger details</h3>
+      <div className="auto-field">
+        <label htmlFor="autox-tkind">Trigger type</label>
+        <select
+          id="autox-tkind"
+          className="auto-input"
+          value={triggerKey}
+          disabled={busy}
+          onChange={(e) => {
+            const next = e.target.value;
+            if (next === triggerKey) return;
+            // A change that can invalidate the configuration under it ASKS FIRST (image 6);
+            // one that cannot — there is nothing configured yet — just happens.
+            if (trigger && trigger.configured !== false) onAskChange(next);
+            else onPickTrigger(next);
+          }}
+        >
+          {triggerKey && !options.some((t) => t.key === triggerKey) ? (
+            <option value={triggerKey}>{triggerKey} (not offered here)</option>
+          ) : null}
+          {options.map((t) => (
+            <option key={t.key} value={t.key} disabled={!!t.planned}>
+              {t.planned
+                ? `${t.label} — coming soon`
+                : t.ready === false
+                  ? `${t.label} — needs setting up`
+                  : t.label}
+            </option>
+          ))}
+        </select>
+      </div>
+      {/*
+        ⛔ NO DESCRIPTION PARAGRAPH HERE, and its absence is deliberate. Airtable prints two
+        sentences under this select (image 3). Ours would be a CLIENT paraphrase of a server
+        vocabulary — the thing DESIGN.md 4 calls a hand copy of a registry that goes stale in
+        silence the day the engine changes what a trigger does. A one-line `detail` on the
+        server's own `TriggerOption` is asked for in the wave mailbox; when it rides, it renders
+        here and cannot disagree with the engine.
+      */}
+      {picked && picked.ready === false && !picked.planned ? (
+        <div className="autob-needs">
+          <span className="autob-needs-text">
+            {connected
+              ? "Connected — this trigger is still being switched on for this deployment."
+              : "This trigger is not set up yet."}
+          </span>
+          {!connected && startUrl ? (
+            <a className="auto-btn is-primary autob-connect" href={startUrl}>
+              Connect
+            </a>
+          ) : null}
+        </div>
+      ) : null}
+
+      <h3>Configuration</h3>
+      {needsTable ? (
+        <div className="auto-field">
+          <label htmlFor="autox-ttable">
+            <span className="autox-req">*</span> Database
+          </label>
+          <select
+            id="autox-ttable"
+            className="auto-input"
+            value={trigger?.table || ""}
+            disabled={busy}
+            onChange={(e) => onPatchTrigger({ table: e.target.value })}
+          >
+            <option value="">Select a database…</option>
+            {trigger?.table && !tables.some((t) => t.key === trigger.table) ? (
+              <option value={trigger.table}>{trigger.table} (not visible to you)</option>
+            ) : null}
+            {tables.map((t) => (
+              <option key={t.key} value={t.key}>
+                {t.label}
+              </option>
+            ))}
+          </select>
+        </div>
+      ) : null}
+
+      {triggerKey === "event_field" ? (
+        <>
+          <div className="auto-field">
+            <label htmlFor="autox-tfield">Watched column</label>
+            <select
+              id="autox-tfield"
+              className="auto-input"
+              value={trigger?.field || ""}
+              disabled={busy}
+              onChange={(e) => onPatchTrigger({ field: e.target.value })}
+            >
+              {/* EMPTY IS A REAL CHOICE, not a missing one: unnamed means "any column", which is
+                  Airtable's plain condition trigger and the engine's own default. */}
+              <option value="">Any column</option>
+              {(table?.fields || []).map((f) => (
+                <option key={f.key} value={f.key}>
+                  {f.label}
+                </option>
+              ))}
+            </select>
+          </div>
+          <p className="auto-field-label">
+            <span className="autox-req">*</span> Conditions
+          </p>
+          <CondBuilder
+            cond={trigger?.when || null}
+            onChange={(next) => onPatchTrigger({ when: next })}
+            fields={table?.fields || []}
+            ops={ops}
+            nullaryOps={nullaryOps}
+            maxDepth={vocab?.maxCondDepth ?? 3}
+            maxChildren={vocab?.maxCondChildren ?? 12}
+            disabled={busy}
+          />
+        </>
+      ) : null}
+
+      {triggerKey === "record_updated" ? (
+        <div className="auto-field">
+          <label htmlFor="autox-twatch">Watched columns</label>
+          <select
+            id="autox-twatch"
+            className="auto-input"
+            multiple
+            size={5}
+            value={trigger?.fields || []}
+            disabled={busy}
+            onChange={(e) =>
+              onPatchTrigger({
+                fields: Array.from(e.target.selectedOptions).map((o) => o.value),
+              })
+            }
+          >
+            {(table?.fields || []).map((f) => (
+              <option key={f.key} value={f.key}>
+                {f.label}
+              </option>
+            ))}
+          </select>
+          <p className="auto-hint">Select none to fire on any column.</p>
+        </div>
+      ) : null}
+
+      {triggerKey === "enters_view" ? (
+        <div className="auto-field">
+          <label htmlFor="autox-tview">
+            <span className="autox-req">*</span> View
+          </label>
+          {table?.views?.length ? (
+            <select
+              id="autox-tview"
+              className="auto-input"
+              value={trigger?.viewId || ""}
+              disabled={busy}
+              onChange={(e) => onPatchTrigger({ viewId: e.target.value })}
+            >
+              <option value="">Select a view…</option>
+              {table.views.map((v) => (
+                <option key={v.id} value={v.id}>
+                  {v.label}
+                </option>
+              ))}
+            </select>
+          ) : (
+            /*
+              ⚠ ABSENT IS A STATE, NOT AN EMPTY PICKER. `GET /automations/tables` does not carry
+              views yet (asked of the engine session in the wave mailbox). An empty dropdown here
+              would read as "this database has no views", which is a claim nobody measured — so
+              the surface says what is actually true and the control lights up the day the list
+              rides, with no change on this side.
+            */
+            <p className="auto-note">
+              {table
+                ? "This server did not offer a view list for that database yet."
+                : "Choose a database first."}
+            </p>
+          )}
+        </div>
+      ) : null}
+
+      {triggerKey === "email" ? (
+        <div className="auto-field">
+          <label htmlFor="autox-tquery">Gmail search</label>
+          <input
+            id="autox-tquery"
+            className="auto-input"
+            defaultValue={trigger?.query || ""}
+            disabled={busy}
+            placeholder="from:orders@example.com"
+            // FREE TEXT COMMITS ON BLUR — per-keystroke would PATCH a half-typed query.
+            onBlur={(e) => onPatchTrigger({ query: e.target.value })}
+          />
+        </div>
+      ) : null}
+
+      {triggerKey === "webhook" && trigger?.token ? (
+        <div className="auto-field">
+          <label htmlFor="autox-thook">Hook URL</label>
+          <input
+            id="autox-thook"
+            className="auto-input is-mono"
+            readOnly
+            value={`/api/v1/automations/hook/${trigger.token}`}
+          />
+          <p className="auto-hint">Minted once. It survives every other change to this trigger.</p>
+        </div>
+      ) : null}
+
+      {/* THE SCHEDULE, rendered by the one component that owns the cron round-trip. */}
+      {triggerKey === "schedule" ? scheduleFace : null}
+      {triggerKey === "manual" ? (
+        <p className="auto-hint">
+          It runs when you press Run once now, and nothing else starts it.
+        </p>
+      ) : null}
+
+      <h3>Test step</h3>
+      {/*
+        ⛔ HONEST TO OUR SEMANTICS, not to Airtable's. Airtable's "Test step" replays one step
+        against a chosen record. Ours has no step-replay: the engine runs a whole automation. So
+        the control says what it actually does — RUN IT — and the results below are the last
+        real run's, from the run log, rather than a rehearsal nobody performed.
+      */}
+      <button type="button" className="auto-btn" disabled={busy || !!automation.running}
+        onClick={onRunNow}>
+        {automation.running ? "Running…" : "Run once now"}
+      </button>
+      {last ? (
+        <>
+          <p className={"autox-result is-" + (last.ok ? "ok" : "bad")}>
+            {last.ok ? "Last run succeeded" : "Last run failed"}
+          </p>
+          <p className="auto-hint">
+            {last.ts.replace("T", " ").slice(0, 16)} — {last.summary}
+          </p>
+        </>
+      ) : (
+        <p className="auto-hint">It has not run yet.</p>
+      )}
+    </>
+  );
+}
+
+function ActionProps({
+  action,
+  catalog,
+  tables,
+  walkFields,
+  ops,
+  nullaryOps,
+  vocab,
+  busy,
+  onEdit,
+}: {
+  action: Action | null;
+  catalog: ActionCatalogRow[];
+  tables: UserTable[];
+  /**
+   * ⛔ THE WALKING RECORD'S COLUMNS — the trigger's database, resolved by the builder.
+   *
+   * These three surfaces were built with `fields={[]}` and it made R3's headline feature
+   * unauthorable: a conditional group's condition, an action's `when`, and `update_record`'s
+   * column picker all offered "Choose a field…" and nothing else. An empty list is not a
+   * neutral default here — it is a picker with no options, which reads as "this database has
+   * no columns".
+   */
+  walkFields: { key: string; label: string; type: string }[];
+  ops: string[];
+  nullaryOps: string[];
+  vocab?: FlowVocab;
+  busy: boolean;
+  onEdit: (change: (a: Action) => Action) => void;
+}) {
+  if (!action) return <p className="auto-note">That action is no longer part of this flow.</p>;
+  const row = catalog.find((c) => c.kind === action.kind);
+  const cfg = action.config || {};
+  const setCfg = (patch: Record<string, unknown>) =>
+    onEdit((a) => ({ ...a, config: { ...a.config, ...patch } }));
+  const values = (cfg as { values?: Record<string, string | number> }).values || {};
+  const target = tables.find((t) => t.key === String((cfg as { table?: string }).table || ""));
+  const valueFields = action.kind === "create_record" ? target?.fields || [] : walkFields;
+
+  return (
+    <>
+      <h3>{row?.label || action.kind}</h3>
+      {row?.detail ? <p className="auto-hint">{row.detail}</p> : null}
+
+      <h3>Configuration</h3>
+
+      {action.kind === "group" ? (
+        <>
+          <p className="auto-field-label">Run these actions if…</p>
+          <CondBuilder
+            cond={(cfg as { cond?: Cond | null }).cond || null}
+            onChange={(next) => setCfg({ cond: next })}
+            fields={walkFields}
+            ops={ops}
+            nullaryOps={nullaryOps}
+            maxDepth={vocab?.maxCondDepth ?? 3}
+            maxChildren={vocab?.maxCondChildren ?? 12}
+            lead=""
+            disabled={busy}
+          />
+          {/* ⚠ THE FIELD LIST IS THE WALKING RECORD'S, and this panel does not know which
+              database that is — the trigger decides it and a group can sit under any of them.
+              So the field picker offers the stored key rather than a list it would have to
+              guess at; a wrong list is worse than a typed key, because it looks authoritative.
+              Booked for the wave that gives an action its own resolved table. */}
+        </>
+      ) : null}
+
+      {action.kind === "create_record" ? (
+        <div className="auto-field">
+          <label htmlFor="autox-atable">
+            <span className="autox-req">*</span> Database
+          </label>
+          <select
+            id="autox-atable"
+            className="auto-input"
+            value={String((cfg as { table?: string }).table || "")}
+            disabled={busy}
+            onChange={(e) => setCfg({ table: e.target.value })}
+          >
+            <option value="">Select a database…</option>
+            {tables.map((t) => (
+              <option key={t.key} value={t.key}>
+                {t.label}
+              </option>
+            ))}
+          </select>
+        </div>
+      ) : null}
+
+      {action.kind === "update_record" || action.kind === "create_record" ? (
+        <>
+          <p className="auto-field-label">
+            <span className="autox-req">*</span> Values
+          </p>
+          {Object.entries(values).map(([key, val], i) => (
+            <div className="autoc-row" key={i}>
+              <button
+                type="button"
+                className="autoc-drop"
+                disabled={busy}
+                aria-label="Remove this value"
+                onClick={() => {
+                  const next = { ...values };
+                  delete next[key];
+                  setCfg({ values: next });
+                }}
+              >
+                <svg width="12" height="12" viewBox="0 0 16 16" fill="none" aria-hidden="true">
+                  <path d="M4 4l8 8M12 4l-8 8" stroke="currentColor" strokeWidth="1.5"
+                    strokeLinecap="round" />
+                </svg>
+              </button>
+              <select
+                className="auto-input is-tiny"
+                value={key}
+                disabled={busy}
+                aria-label="Column"
+                onChange={(e) => {
+                  const next: Record<string, string | number> = {};
+                  for (const [k, v] of Object.entries(values))
+                    next[k === key ? e.target.value : k] = v;
+                  setCfg({ values: next });
+                }}
+              >
+                <option value="">Choose a column…</option>
+                {/* ⚠ WHICH RECORD'S COLUMNS depends on the action: `create_record` writes into
+                    the database it NAMES, `update_record` writes onto the record walking the
+                    flow — the trigger's. Offering the target's columns for both would list the
+                    wrong database's columns for every update action. */}
+                {key && !valueFields.some((f) => f.key === key) ? (
+                  <option value={key}>{key}</option>
+                ) : null}
+                {valueFields.map((f) => (
+                  <option key={f.key} value={f.key}>
+                    {f.label}
+                  </option>
+                ))}
+              </select>
+              <input
+                className="auto-input is-tiny autoc-value"
+                defaultValue={String(val ?? "")}
+                disabled={busy}
+                aria-label="Value"
+                placeholder="Value or {{column}}"
+                onBlur={(e) => setCfg({ values: { ...values, [key]: e.target.value } })}
+              />
+            </div>
+          ))}
+          <button
+            type="button"
+            className="autoc-add"
+            disabled={busy}
+            onClick={() => setCfg({ values: { ...values, "": "" } })}
+          >
+            + Add a value
+          </button>
+          <p className="auto-hint">
+            <code>{"{{column_key}}"}</code> reads that column off the record walking the flow.
+          </p>
+        </>
+      ) : null}
+
+      {action.kind === "find_records" ? (
+        <>
+          <div className="auto-field">
+            <label htmlFor="autox-ftable">
+              <span className="autox-req">*</span> Database
+            </label>
+            <select
+              id="autox-ftable"
+              className="auto-input"
+              value={String((cfg as { table?: string }).table || "")}
+              disabled={busy}
+              onChange={(e) => setCfg({ table: e.target.value })}
+            >
+              <option value="">Select a database…</option>
+              {tables.map((t) => (
+                <option key={t.key} value={t.key}>
+                  {t.label}
+                </option>
+              ))}
+            </select>
+          </div>
+          <p className="auto-field-label">Conditions</p>
+          <CondBuilder
+            cond={(cfg as { cond?: Cond | null }).cond || null}
+            onChange={(next) => setCfg({ cond: next })}
+            fields={target?.fields || []}
+            ops={ops}
+            nullaryOps={nullaryOps}
+            maxDepth={vocab?.maxCondDepth ?? 3}
+            maxChildren={vocab?.maxCondChildren ?? 12}
+            disabled={busy}
+          />
+          <div className="auto-field">
+            <label htmlFor="autox-flimit">How many at most</label>
+            <input
+              id="autox-flimit"
+              className="auto-input"
+              type="number"
+              min={1}
+              defaultValue={Number((cfg as { limit?: number }).limit || 25)}
+              disabled={busy}
+              onBlur={(e) => setCfg({ limit: Number(e.target.value) || 25 })}
+            />
+          </div>
+          <p className="auto-hint">
+            What it found opens from the run log. Piping the rows into a later step is not built
+            yet.
+          </p>
+        </>
+      ) : null}
+
+      {action.kind === "review" ? (
+        <ReviewProps
+          cfg={cfg as Record<string, unknown>}
+          vocab={vocab}
+          busy={busy}
+          setCfg={setCfg}
+        />
+      ) : null}
+
+      {/* EVERY action can be conditional, not just a group — `Action.when` is the engine's own
+          field and a card with no way to set it would be a stored value the UI cannot reach. */}
+      <h3>Run this only when</h3>
+      <CondBuilder
+        cond={action.when || null}
+        onChange={(next) => onEdit((a) => ({ ...a, when: next }))}
+        fields={walkFields}
+        ops={ops}
+        nullaryOps={nullaryOps}
+        maxDepth={vocab?.maxCondDepth ?? 3}
+        maxChildren={vocab?.maxCondChildren ?? 12}
+        disabled={busy}
+      />
+      {!condComplete(action.when || null, nullaryOps) ? null : (
+        <p className="auto-hint">Leave empty to run it every time.</p>
+      )}
+    </>
+  );
+}
+
+function ReviewProps({
+  cfg,
+  vocab,
+  busy,
+  setCfg,
+}: {
+  cfg: Record<string, unknown>;
+  vocab?: FlowVocab;
+  busy: boolean;
+  setCfg: (patch: Record<string, unknown>) => void;
+}) {
+  const by = String(cfg.decidedBy || "user");
+  const next = Array.isArray(cfg.next) ? (cfg.next as string[]) : [];
+  const aiReady = vocab?.aiReady !== false;
+  return (
+    <>
+      <div className="auto-field">
+        <label htmlFor="autox-rby">Decided by</label>
+        <select
+          id="autox-rby"
+          className="auto-input"
+          value={by}
+          disabled={busy}
+          onChange={(e) => setCfg({ decidedBy: e.target.value })}
+        >
+          {(vocab?.reviewDeciders || ["user"]).map((d) => (
+            <option key={d} value={d}>
+              {d === "ai" ? "AI" : "A person"}
+            </option>
+          ))}
+        </select>
+      </div>
+      {/*
+        ⚠ `aiReady` IS A MEASUREMENT OF THIS DEPLOYMENT, and it is stated rather than styled
+        around. With no LLM key the engine holds every card for a human — so an AI review that
+        looked configured would promise a decision nothing will make (C6's fail-closed path).
+      */}
+      {by === "ai" && !aiReady ? (
+        <p className="auto-note">
+          No AI provider is configured here, so these cards wait for a person.
+        </p>
+      ) : null}
+      {by === "ai" ? (
+        <div className="auto-field">
+          <label htmlFor="autox-rprompt">What should it decide?</label>
+          <textarea
+            id="autox-rprompt"
+            className="auto-input"
+            rows={3}
+            defaultValue={String(cfg.prompt || "")}
+            disabled={busy}
+            placeholder="Approve suppliers with a UK address and more than 20 reviews."
+            onBlur={(e) => setCfg({ prompt: e.target.value })}
+          />
+        </div>
+      ) : null}
+      <div className="auto-field">
+        <label htmlFor="autox-rlabel">Stage name</label>
+        <input
+          id="autox-rlabel"
+          className="auto-input"
+          defaultValue={String(cfg.label || "Review")}
+          disabled={busy}
+          onBlur={(e) => setCfg({ label: e.target.value })}
+        />
+      </div>
+      <p className="auto-field-label">Where it can go next</p>
+      {next.map((n, i) => (
+        <div className="autoc-row" key={i}>
+          <button
+            type="button"
+            className="autoc-drop"
+            disabled={busy}
+            aria-label={`Remove ${n}`}
+            onClick={() => setCfg({ next: next.filter((_x, j) => j !== i) })}
+          >
+            <svg width="12" height="12" viewBox="0 0 16 16" fill="none" aria-hidden="true">
+              <path d="M4 4l8 8M12 4l-8 8" stroke="currentColor" strokeWidth="1.5"
+                strokeLinecap="round" />
+            </svg>
+          </button>
+          <input
+            className="auto-input is-tiny"
+            defaultValue={n}
+            disabled={busy}
+            aria-label="Stage this review can send a record to"
+            onBlur={(e) =>
+              setCfg({ next: next.map((x, j) => (j === i ? e.target.value : x)) })
+            }
+          />
+        </div>
+      ))}
+      <button
+        type="button"
+        className="autoc-add"
+        disabled={busy}
+        onClick={() => setCfg({ next: [...next, ""] })}
+      >
+        + Add an exit
+      </button>
+      <p className="auto-hint">
+        Each exit is a lane on the board. A card waits here until it is moved to one of them.
+      </p>
+    </>
+  );
+}

web/src/automation/AutomationCreate.tsx

@@ -34,7 +34,35 @@ interface ColumnPlan {
   key: string;
 }
 
+/**
+ * C2's THREE CARDS — the wizard's first question, asked before the kind.
+ *
+ * ⛔ ONE LINE EACH (R13). The temptation here is to explain what a "machine database" is; the
+ * person reading has already decided to make an automation and every extra word is spent on
+ * someone who is leaving. What each mode DOES is visible one screen later, where the choice
+ * has consequences.
+ */
+const TARGET_MODES: { mode: string; label: string; line: string }[] = [
+  { mode: "existing", label: "Use an existing database",
+    line: "It works on rows that are already there." },
+  { mode: "new", label: "Create a new database",
+    line: "An empty one, made now, named by you." },
+  { mode: "automated", label: "Create an automated database",
+    line: "The automation makes it on its first run." },
+];
+
 export default function AutomationCreate({ kinds, onCreated, onCancel }: Props) {
+  /**
+   * ⚠ TWO STEPS, NOT A WIZARD WITH A BACK STACK. The first answers "what does it work on", the
+   * second "what does it do" — and the second is the form this file has always been, because
+   * the engine still requires one of its three machine KINDS (`clean_definition` refuses an
+   * automation without one). C2 anticipates trigger-and-actions-only automations for the
+   * `existing`/`new` modes; there is no server kind for that yet, so the kind question stays
+   * and the wave mailbox carries the ask. When a plain kind exists, step 2 collapses for those
+   * two modes and nothing else here changes.
+   */
+  const [mode, setMode] = useState("");
+  const [newLabel, setNewLabel] = useState("");
   const [name, setName] = useState("");
   const [kind, setKind] = useState<AutomationKind>("scrape_db");
   const [problem, setProblem] = useState("");
@@ -100,6 +128,16 @@ export default function AutomationCreate({ kinds, onCreated, onCancel }: Props)
       const res = await createAutomation({
         name,
         kind,
+        // C2's target, resolved SERVER-SIDE in the same call that creates the automation
+        // (`resolve_target` runs before validation), so a `new` database is never a
+        // create-then-patch this client has to sequence — and an automation is never saved
+        // pointing at a table that does not exist yet.
+        target:
+          mode === "existing"
+            ? { mode, table: targetTable }
+            : mode === "new"
+              ? { mode, label: newLabel }
+              : { mode: "automated", label: targetLabel },
         schedule: { cron: "0 6 * * *", enabled: false },
         config:
           kind === "scrape_db"
@@ -133,19 +171,95 @@ export default function AutomationCreate({ kinds, onCreated, onCancel }: Props)
 
   const canCreate =
     !!name.trim() &&
+    // The MODE's own question has to be answered too — `resolve_target` refuses a blank one
+    // with its own sentence ("choose the database this automation works on"), and offering a
+    // Create button that can only produce that refusal is a control that lies.
+    (mode === "existing" ? !!targetTable : mode === "new" ? !!newLabel.trim() : true) &&
     (kind === "scrape_db"
       ? !!url.trim() && plan.some((c) => c.include && c.key === keyField)
       : kind === "discover_instagram"
         ? true
         : !!targetTable && !!fieldKey);
 
+  /* ── STEP 1: what does it work on? (C2, images 1-3's front door) ───────────────────────── */
+  if (!mode) {
+    return (
+      <div className="auto-create-pane">
+        <div className="auto-create-card">
+          <h1>New automation</h1>
+          <div className="autox-modes">
+            {TARGET_MODES.map((m) => (
+              <button
+                key={m.mode}
+                type="button"
+                className="autox-mode"
+                onClick={() => setMode(m.mode)}
+              >
+                <span className="autox-mode-label">{m.label}</span>
+                <span className="autox-mode-line">{m.line}</span>
+              </button>
+            ))}
+          </div>
+          <div className="auto-head-actions">
+            <button type="button" className="auto-btn" onClick={onCancel}>
+              Cancel
+            </button>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
   return (
     <div className="auto-create-pane">
       <div className="auto-create-card">
         <h1>New automation</h1>
-        <p className="auto-hint">
-          Pick what it does. Once it exists you configure it one step at a time.
-        </p>
+
+        {/* STEP 2's answer, and a way back to change it. A chosen mode that cannot be unchosen
+            is a dead end one click deep. */}
+        <div className="autox-modeback">
+          <span className="autox-mode-label">
+            {TARGET_MODES.find((m) => m.mode === mode)?.label || mode}
+          </span>
+          <button type="button" className="autoc-add" onClick={() => setMode("")}>
+            Change
+          </button>
+        </div>
+
+        {mode === "existing" ? (
+          <div className="auto-field">
+            <label htmlFor="auto-new-target">Database</label>
+            <select
+              id="auto-new-target"
+              className="auto-input"
+              value={targetTable}
+              onChange={(e) => {
+                setTargetTable(e.target.value);
+                setFieldKey("");
+                setUrlField("");
+              }}
+            >
+              <option value="">Choose a database…</option>
+              {tables.map((t) => (
+                <option key={t.key} value={t.key}>
+                  {t.label} ({t.rowCount} {t.rowCount === 1 ? "row" : "rows"})
+                </option>
+              ))}
+            </select>
+          </div>
+        ) : mode === "new" ? (
+          <div className="auto-field">
+            <label htmlFor="auto-new-dblabel">Name the new database</label>
+            <input
+              id="auto-new-dblabel"
+              className="auto-input"
+              value={newLabel}
+              placeholder="Supplier leads"
+              onChange={(e) => setNewLabel(e.target.value)}
+            />
+            <p className="auto-hint">It is created empty, with this automation.</p>
+          </div>
+        ) : null}
 
         {problem ? (
           <div className="auto-banner is-error" role="alert">
@@ -340,6 +454,11 @@ export default function AutomationCreate({ kinds, onCreated, onCancel }: Props)
         ) : (
           <>
             <div className="auto-field-row">
+              {/* ⚠ ONE CONTROL PER FACT. Step 2 already asked which database for the
+                  `existing`/`new` modes and binds the SAME state — two selects for one value
+                  is how a form starts disagreeing with itself. Only the `automated` mode,
+                  which asks nothing up front, needs this one. */}
+              {mode === "automated" ? (
               <div className="auto-field">
                 <label htmlFor="auto-new-table">Database</label>
                 <select
@@ -360,6 +479,7 @@ export default function AutomationCreate({ kinds, onCreated, onCancel }: Props)
                   ))}
                 </select>
               </div>
+              ) : null}
               <div className="auto-field">
                 <label htmlFor="auto-new-fieldkey">Automation column</label>
                 <select

web/src/automation/AutomationSurface.tsx

@@ -16,6 +16,8 @@
 import type { KeyboardEvent as ReactKeyboardEvent } from "react";
 import { useCallback, useEffect, useRef, useState } from "react";
 
+import type { AutomationOpenDetail } from "../apiContract";
+import { AUTOMATION_OPEN_EVENT } from "../apiContract";
 import AutomationCreate from "./AutomationCreate";
 import AutomationDetail from "./AutomationDetail";
 import type { Automation, AutomationList } from "./automationApi";
@@ -55,6 +57,39 @@ function railSubtitle(a: Automation): string {
   return last ? `Last run ${last}` : "Manual only";
 }
 
+/*
+ * ⛔ W23-W5's LISTENER IS AT MODULE SCOPE, AND THAT IS THE POINT — not a stylistic choice.
+ *
+ * The frame's click-through sets `window.location.hash = "#/automation"` and signals on the
+ * VERY NEXT LINE (Shell.tsx:1647-1650, and its comment is right that the order matters). But a
+ * hash write does not mount anything synchronously: `hashchange` is delivered as a task, the
+ * router state then updates, React renders, and only THEN does a component effect subscribe.
+ * A listener registered in `useEffect` therefore misses every click that arrives from another
+ * page — which is every click, since a reader looking at Alerts is by definition not already
+ * on this surface. The event would dispatch into nothing and every gate would stay green:
+ * exactly the wave-20 item-25 failure the contract's own note describes, reproduced one layer
+ * down.
+ *
+ * This module is imported statically by the shell, so this listener exists from app start. It
+ * LATCHES the request; the component consumes the latch when it mounts and hears live events
+ * while it is mounted. A request nobody claims is dropped on the next one — the latch is a
+ * one-slot mailbox, never a queue.
+ */
+let pendingOpen: AutomationOpenDetail | null = null;
+const openSubscribers = new Set<(detail: AutomationOpenDetail) => void>();
+
+if (typeof window !== "undefined") {
+  window.addEventListener(AUTOMATION_OPEN_EVENT, (event) => {
+    const detail = (event as CustomEvent<AutomationOpenDetail>).detail;
+    if (!detail?.autoId) return;
+    if (openSubscribers.size) {
+      for (const notify of openSubscribers) notify(detail);
+      return;
+    }
+    pendingOpen = detail;
+  });
+}
+
 export default function AutomationSurface() {
   const [data, setData] = useState<AutomationList | null>(null);
   const [error, setError] = useState("");
@@ -62,21 +97,66 @@ export default function AutomationSurface() {
   const [creating, setCreating] = useState(false);
   const [railShut, setRailShut] = useState(false);
   const [busy, setBusy] = useState("");
+  /** W23-W5's advisory half: which stage's panel the click-through asked for, if any. */
+  const [openStage, setOpenStage] = useState("");
+  /** An open request waiting for the list to arrive (see the resolver below). */
+  const [openRequest, setOpenRequest] = useState<AutomationOpenDetail | null>(null);
   const listRef = useRef<HTMLDivElement | null>(null);
 
+  /**
+   * ⛔ C14 LEG 2 — THE ID THE USER LAST ASKED FOR, and it is a ref because it has to be
+   * written SYNCHRONOUSLY, inside the click, before any promise that was already in flight
+   * can resolve. State would not do: a resolution racing React's commit would read the
+   * previous value, which is the exact window this guard exists to close.
+   */
+  const wantedId = useRef("");
+
+  /**
+   * ⭐ THE ONLY PLACE THE RAIL'S SELECTION MOVES ON PURPOSE. Every deliberate change of
+   * automation — a rail click, a create, a delete — goes through here, so "what the user
+   * asked for" and "what is on screen" are written in one statement and cannot drift apart.
+   * A resolution that wants to steer the rail compares itself against `wantedId` instead.
+   */
+  const select = useCallback((id: string, stage = "") => {
+    wantedId.current = id;
+    setActiveId(id);
+    // The stage hint belongs to THIS selection and no other. Every ordinary caller passes
+    // nothing, which clears it — so a review notification cannot leave a stage open on the
+    // next automation the reader clicks by hand.
+    setOpenStage(stage);
+  }, []);
+
+  /**
+   * ⛔ C14 LEG 3 (the paint half) — A STALE READ MAY NOT REPAINT.
+   *
+   * Every call takes the next generation; only the newest one is allowed to `setData`. The
+   * defect this closes is not cosmetic: a poll issued BEFORE a delete resolves AFTER it, and
+   * a list that still contains the deleted automation puts a row back in the rail that the
+   * user has just watched disappear. Same for a toggle, and same for a create.
+   *
+   * ⚠ THE RETURN VALUE IS NOT GUARDED, deliberately. The caller asked a question and gets
+   * its own answer — coupling the two would mean a create whose `load()` was overtaken by a
+   * poll silently failed to select the automation it had just made.
+   */
+  const gen = useRef(0);
+
   const load = useCallback(async (abort?: AbortSignal) => {
+    const mine = ++gen.current;
     try {
       const next = await listAutomations(abort);
-      setData(next);
-      setError("");
+      if (mine === gen.current) {
+        setData(next);
+        setError("");
+      }
       return next;
     } catch (e) {
       if ((e as Error)?.name === "AbortError") return null;
-      setError(
-        e instanceof AutomationError
-          ? e.message
-          : "The automation service did not answer."
-      );
+      if (mine === gen.current)
+        setError(
+          e instanceof AutomationError
+            ? e.message
+            : "The automation service did not answer."
+        );
       return null;
     }
   }, []);
@@ -91,13 +171,57 @@ export default function AutomationSurface() {
   // finished. Polling only while something is actually running keeps an idle surface
   // silent — a fixed interval would be a request every few seconds forever, for a page
   // whose contents change a handful of times a day.
+  //
+  // ⛔ C14 LEG 3 (the abort half). It used to call `load()` bare — no signal, nothing to
+  // cancel — so a request the interval had already issued kept going after the effect that
+  // owned it was gone. One controller per effect run, aborted with the interval, means a poll
+  // cannot outlive the condition that justified it. The generation guard inside `load` covers
+  // the rest: a response that survives the abort still cannot repaint over a newer one.
   const anyRunning = (data?.automations || []).some((a) => a.running);
   useEffect(() => {
     if (!anyRunning) return undefined;
-    const t = window.setInterval(() => void load(), 2500);
-    return () => window.clearInterval(t);
+    const ac = new AbortController();
+    const t = window.setInterval(() => void load(ac.signal), 2500);
+    return () => {
+      window.clearInterval(t);
+      ac.abort();
+    };
   }, [anyRunning, load]);
 
+  // ── W23-W5, the surface's half: hear the request, then answer it when we CAN ──────────
+  useEffect(() => {
+    const notify = (detail: AutomationOpenDetail) => setOpenRequest(detail);
+    openSubscribers.add(notify);
+    if (pendingOpen) {
+      const latched = pendingOpen;
+      pendingOpen = null;
+      setOpenRequest(latched);
+    }
+    return () => {
+      openSubscribers.delete(notify);
+    };
+  }, []);
+
+  /**
+   * ⚠ THE REQUEST OUTLIVES THE FETCH, and it has to. The reader clicks a notification from
+   * another page, so this surface is mounting WITH AN EMPTY LIST — "select it if it is in the
+   * list" would drop every real click and keep only the one case where the reader was already
+   * here. So the request is held until `data` exists, and only then answered.
+   *
+   * An automation the reader can no longer open does NOTHING (the contract's own words): the
+   * request is cleared either way, so a stale id cannot sit here re-firing against every
+   * subsequent list.
+   */
+  useEffect(() => {
+    if (!openRequest || !data) return;
+    const found = (data.automations || []).some((a) => a.id === openRequest.autoId);
+    if (found) {
+      setCreating(false);
+      select(openRequest.autoId, openRequest.stageId || "");
+    }
+    setOpenRequest(null);
+  }, [openRequest, data, select]);
+
   const items = data?.automations || [];
   const active = items.find((a) => a.id === activeId) || null;
 
@@ -162,7 +286,7 @@ export default function AutomationSurface() {
             className="auto-create-btn"
             onClick={() => {
               setCreating(true);
-              setActiveId("");
+              select("");
             }}
           >
             <svg width="14" height="14" viewBox="0 0 16 16" fill="none" aria-hidden="true">
@@ -189,7 +313,7 @@ export default function AutomationSurface() {
                   type="button"
                   className="auto-row-main"
                   onClick={() => {
-                    setActiveId(a.id);
+                    select(a.id);
                     setCreating(false);
                   }}
                 >
@@ -248,8 +372,11 @@ export default function AutomationSurface() {
             kinds={data?.kinds || []}
             onCreated={async (id) => {
               setCreating(false);
+              // THE CREATE FLOW IS THE ONE CALLER ALLOWED TO NAME A DIFFERENT ID (C14 leg 2),
+              // and it is a different PROP for exactly that reason — the guard below does not
+              // have to make an exception it could get wrong.
               const next = await load();
-              if (id && next) setActiveId(id);
+              if (id && next) select(id);
             }}
             onCancel={() => setCreating(false)}
           />
@@ -265,16 +392,42 @@ export default function AutomationSurface() {
             // trigger face can tell "the server offered nothing" from "the server offered
             // an empty list" rather than collapsing both into a picker with no options.
             triggers={data?.triggers}
+            // C4's action menu + the builder's ceilings. Forwarded as-is for the same reason
+            // `triggers` is: absent must stay absent, so the builder can tell "the server
+            // offered nothing" from "the server offered an empty list".
+            catalog={data?.actionsCatalog}
+            vocab={data?.flow}
             // `?? null` and never `|| {enabled:false}`: an absent tick bit is "the server did
             // not say", which Step 1 prints as its own sentence. Defaulting it here would
             // turn a missing field into a claim about production (C6 amendment #1).
             tick={data?.tick ?? null}
+            // W23-W5's advisory half. A review notification names the stage its cards are
+            // waiting at, and landing on the automation with that stage's panel already open
+            // is the difference between "here is the thing" and "here is the thing you were
+            // told about". Absent for every other way of arriving.
+            initialStage={openStage}
+            /*
+             * ⛔ C14 LEG 2 — THE STALE-ID WRITE-BACK, and this is the ghost's second cause.
+             *
+             * The detail calls `onSaved(automation.id)` from six places (save, the trigger
+             * picker, a schedule change, a node switch, a card move, a run). Each closure
+             * captures the automation it was mounted for, so a save that resolves AFTER the
+             * user has clicked a different row used to call `setActiveId(the OLD id)` — the
+             * rail jumped back, the detail remounted, and what the user saw was the previous
+             * automation reappearing over the one they had just opened. It looked like a
+             * rendering bug; it was a resolution steering the selection.
+             *
+             * A resolution may no longer steer anything. It reloads the list — that part was
+             * always right — and it re-asserts the selection ONLY when its id is still the one
+             * the user asked for, which makes the write a no-op in the good case and nothing
+             * at all in the bad one.
+             */
             onSaved={async (id) => {
               const next = await load();
-              if (id && next) setActiveId(id);
+              if (id && next && id === wantedId.current) select(id);
             }}
             onDeleted={async () => {
-              setActiveId("");
+              select("");
               await load();
             }}
           />
@@ -296,7 +449,16 @@ export default function AutomationSurface() {
            * paragraph, spent differently.
            */
           <div className="autob-empty">
-            <h1 className="autob-empty-title">Automations</h1>
+            {/*
+              ⛔ NO TITLE HERE ANY MORE (C13, owner item 2). This pane carried an `h1`
+              reading "Automations" at 20px/600 — a THIRD title treatment on a page that
+              also had the header's editable 16px/700 input, against every database page's
+              single 16px/650 `shell-db-name`. The shell now wraps this branch in the same
+              `shell-db-frame` + `DbHead` a database gets (wiring W23-W1), so the page's name
+              is drawn once, by the one component that draws every other page's name. A
+              stand-in restyled to match would have been a second copy of the same fact,
+              free to drift the day the header moves.
+            */}
             <p className="autob-empty-line">
               A job this workspace runs for you, on demand or on a schedule.
             </p>
@@ -305,7 +467,7 @@ export default function AutomationSurface() {
               className="auto-btn is-primary"
               onClick={() => {
                 setCreating(true);
-                setActiveId("");
+                select("");
               }}
             >
               New automation

web/src/automation/AutomationTrigger.tsx

@@ -24,7 +24,6 @@
 // nothing and gets asked again.
 // ---------------------------------------------------------------------------
 import type { OAuthStatus, TickState, TriggerOption } from "./automationApi";
-import { oauthProviderFor, oauthStartUrlFor } from "./automationApi";
 import { WEEKDAYS, readCron, writeCron } from "./steps";
 
 interface Props {
@@ -54,20 +53,27 @@ interface Props {
   /** True when the raw cron face is open — a VIEW choice, not a schedule change. */
   showCron: boolean;
   onShowCron: (v: boolean) => void;
+  /**
+   * WAVE 23 — the BUILDER supplies its own "Trigger type" select (Properties → Trigger details),
+   * so this face drops its picker and contributes only the schedule half. It is a prop rather
+   * than a second component because the thing worth having exactly once is what sits BELOW the
+   * picker: the cron round-trip, the preset list and the tick-honesty note, three things that go
+   * wrong invisibly. Two pickers for one fact is the defect this file's header forbids.
+   */
+  hidePicker?: boolean;
 }
 
-/**
- * ⚠ THE FALLBACK, AND IT IS TEMPORARY BY CONSTRUCTION. Until `triggers` rides,
- * these are the only two shapes the stored definition can express — the engine
- * has exactly one trigger node and `schedule.enabled` decides it — so this is a
- * description of what the server can do today, not a second vocabulary. It is
- * NEVER consulted once the list arrives; when C3 lands, deleting this constant
- * changes nothing on screen.
+/*
+ * ⛔ `FALLBACK_TRIGGERS` IS GONE (D-43, wave 23). It described the only two shapes a stored
+ * definition could express before C3 shipped (manual / on a schedule), and its own note set
+ * the deletion condition: "NEVER consulted once the list arrives; when C3 lands, deleting this
+ * constant changes nothing on screen." C3 has been live for two releases and the vocabulary is
+ * now nine keys plus two planned, so the fallback could only ever have been WRONG — a server
+ * hiccup would have painted a two-option picker that looks authoritative.
+ *
+ * The absent case is a STATE now, not a substitute list: no `triggers` means the surface says
+ * so in one line (below) rather than quietly offering a vocabulary of its own.
  */
-const FALLBACK_TRIGGERS: TriggerOption[] = [
-  { key: "manual", label: "Manual only", ready: true },
-  { key: "schedule", label: "On a schedule", ready: true },
-];
 
 /** The one-line next step a not-ready trigger carries. Server words where there are any. */
 function needsLabel(needs: string): string {
@@ -77,6 +83,16 @@ function needsLabel(needs: string): string {
   return needs.replace(/_/g, " ");
 }
 
+/**
+ * What an option says about itself. THREE states, and they are not the same fact:
+ * ready (nothing), waiting on a connection the USER can make ("needs setting up"), and
+ * declared-but-not-built ("coming soon", R2) which is waiting on us.
+ */
+function optionLabel(t: TriggerOption): string {
+  if (t.planned) return `${t.label} — coming soon`;
+  return t.ready === false ? `${t.label} — needs setting up` : t.label;
+}
+
 /**
  * What the deployment will actually do with a schedule.
  *
@@ -128,20 +144,23 @@ export default function AutomationTrigger({
   oauth,
   showCron,
   onShowCron,
+  hidePicker,
 }: Props) {
-  const options = triggers && triggers.length ? triggers : FALLBACK_TRIGGERS;
+  // ⛔ THE SERVER'S LIST OR NOTHING (D-43). An empty array is not a fallback trigger to
+  // invent — it is the one honest thing to say, and it is said below.
+  const options = triggers || [];
   const picked = options.find((t) => t.key === current) || null;
   const isSchedule = current === "schedule";
   const shape = readCron(cron);
   const note = tickNote(tick);
   const every = showCron ? "custom" : shape.every;
-  // The connector this trigger is waiting on, resolved from the SERVER's `needs`
-  // token. Empty provider = we cannot name a route for it, which is a state the
-  // block below states in words instead of drawing a button that goes nowhere.
-  const waiting = !!picked && picked.ready === false && !!picked.needs;
-  const provider = waiting ? oauthProviderFor(picked.needs as string) : "";
+  // The connector this trigger is waiting on, and the route to it, BOTH COMPOSED BY THE
+  // SERVER (`TriggerOption.connect`). No `connect` = we cannot name a route, which is a state
+  // the block below states in words instead of drawing a button that goes nowhere.
+  const waiting = !!picked && picked.ready === false && !picked.planned && !!picked.needs;
+  const provider = picked?.connect?.provider || "";
   const connected = !!(provider && oauth?.[provider]?.connected);
-  const startUrl = waiting ? oauthStartUrlFor(picked.needs as string) : "";
+  const startUrl = picked?.connect?.startUrl || "";
 
   const pickEvery = (next: string) => {
     onShowCron(next === "custom");
@@ -152,6 +171,10 @@ export default function AutomationTrigger({
   return (
     <>
       <div className="auto-field-row">
+        {/* ⚠ CONDITIONALLY RENDERED, never `hidden` — `.auto-field` sets `display: flex`, which
+            beats the `hidden` attribute's UA `display: none`, so the attribute would have left
+            a second trigger picker on screen looking exactly as if it had been asked for. */}
+        {hidePicker ? null : (
         <div className="auto-field">
           <label htmlFor="auto-trigger-kind">When it runs</label>
           <select
@@ -171,14 +194,22 @@ export default function AutomationTrigger({
               <option value={current}>{current} (not offered here)</option>
             ) : null}
             {options.map((t) => (
-              <option key={t.key} value={t.key}>
-                {/* Not-ready is stated ON the option rather than by disabling it: the
-                    option is pickable, and picking it shows what it is waiting for. */}
-                {t.ready === false ? `${t.label} — needs setting up` : t.label}
+              /*
+                Not-ready is stated ON the option rather than by disabling it: the option is
+                pickable, and picking it shows what it is waiting for.
+                ⚠ PLANNED IS THE ONE EXCEPTION, and it is not the same fact (R2). The server
+                REFUSES a planned key at the door, so leaving it pickable would offer a
+                control whose only possible outcome is a refusal. It still renders — the
+                question "can it run when a button is clicked" has an answer — it just is not
+                an offer.
+              */
+              <option key={t.key} value={t.key} disabled={!!t.planned}>
+                {optionLabel(t)}
               </option>
             ))}
           </select>
         </div>
+        )}
 
         {isSchedule ? (
           <>
@@ -269,6 +300,16 @@ export default function AutomationTrigger({
         ) : null}
       </div>
 
+      {/*
+        THE ABSENT LIST, SAID OUT LOUD (D-43). With the fallback deleted there is no
+        client-side vocabulary left to fall back TO, and that is the point: a picker that
+        quietly offers two options because a payload was short is a surface stating something
+        nobody measured. One line, no paragraph (R13).
+      */}
+      {!options.length && !hidePicker ? (
+        <p className="auto-note">This server did not offer a trigger list.</p>
+      ) : null}
+
       {/* NOT CONFIGURED IS A STATE WITH A NEXT STEP, never a dead control (C3). */}
       {waiting ? (
         <div className="autob-needs">

web/src/automation/CondBuilder.tsx

@@ -0,0 +1,344 @@
+// ---------------------------------------------------------------------------
+// automation/CondBuilder.tsx — the condition TREE editor (contract C4).
+//
+// ONE editor, three callers: the trigger's "when a record matches conditions"
+// (image 4), a conditional group's "Run actions in this group if…" (image 9),
+// and a Find records step. They are the same shape (`Cond`) evaluated by the
+// same engine function, so a second implementation would be a second set of
+// bugs — and the one that matters is silent: a tree the editor can BUILD but
+// the server refuses reads to the user as "it just doesn't save".
+//
+// ⛔ THE VOCABULARY IS THE SERVER'S. The operators are `flow.condOps`, the
+// value-free ones are `flow.nullaryCondOps`, and the depth/breadth ceilings are
+// `flow.maxCondDepth`/`maxCondChildren` — all off `GET /automations`. This file
+// holds NO list of operators. It holds a WORDING for the ones it recognises and
+// falls through to the raw key for anything it does not, which is visible and
+// therefore reportable; a `switch` with no arm for a new op would render the row
+// as nothing at all (the wave-9 silent-drop class).
+//
+// ⛔ IT NEVER PREDICTS A REFUSAL. `clean_cond` refuses an empty group, an
+// unknown op, a valueless compare and an over-deep tree, each with a sentence.
+// This editor SAYS a condition is incomplete — the red line Airtable shows — and
+// still lets the save happen, so the authority on legality stays in one place.
+// A client that blocked Save on its own arithmetic can block a tree the server
+// would have taken, and the user cannot tell which of the two is wrong
+// (`DiscoverGuard`'s note in automationApi states the same rule for the corpus
+// filter, and it is the same rule).
+// ---------------------------------------------------------------------------
+import type { Cond } from "./automationApi";
+import { groupParts, isCondGroup } from "./automationApi";
+
+interface Field {
+  key: string;
+  label: string;
+  type?: string;
+}
+
+interface Props {
+  /** The stored tree. `null` = no conditions yet, which is a legal state, not an empty one. */
+  cond: Cond | null;
+  onChange: (next: Cond | null) => void;
+  fields: Field[];
+  /** `flow.condOps` — the comparisons the engine can answer. */
+  ops: string[];
+  /** `flow.nullaryCondOps` — the ones that take no value. */
+  nullaryOps: string[];
+  maxDepth: number;
+  maxChildren: number;
+  /** Prefix on the first row. Airtable says "When" at a trigger and nothing inside a group. */
+  lead?: string;
+  disabled?: boolean;
+}
+
+/**
+ * The WORDING of an operator, never the LIST of them.
+ *
+ * ⚠ The keys are the engine's `LANE_OPS` and the fallback is the key itself: an operator this
+ * table has not heard of renders as `>=` rather than as a blank cell. Ugly beats invisible —
+ * a blank is indistinguishable from a bug and nobody reports the row they cannot see.
+ * (Booked in the B mailbox as a small ask: `condOpLabels` on the wire would delete this map.)
+ */
+const OP_WORDS: Record<string, string> = {
+  "=": "is",
+  "!=": "is not",
+  ">": "is greater than",
+  ">=": "is at least",
+  "<": "is less than",
+  "<=": "is at most",
+  includes: "contains",
+  not_includes: "does not contain",
+  is_empty: "is empty",
+  is_not_empty: "is not empty",
+};
+
+export function opWord(op: string): string {
+  return OP_WORDS[op] || op;
+}
+
+/** A fresh leaf, using the FIRST operator the server offered rather than a hard-coded "=". */
+function newLeaf(ops: string[]): Cond {
+  return { field: "", op: ops[0] || "", value: "" };
+}
+
+/**
+ * ⭐ ONE CHILD IS STORED AS A BARE LEAF, not as a group of one.
+ *
+ * Both are legal (`cond_match` dispatches on shape), and the engine's own note says a stored
+ * leaf is never rewritten at rest. Emitting the leaf keeps a one-condition trigger byte-identical
+ * to what wave 22 wrote, so opening an old automation in this editor and saving it unchanged
+ * does not produce a diff — a save that silently reshapes stored data is how "I only looked at
+ * it" turns into a migration nobody reviewed.
+ */
+function pack(join: "all" | "any", children: Cond[]): Cond | null {
+  if (!children.length) return null;
+  if (children.length === 1 && !isCondGroup(children[0])) return children[0];
+  return join === "all" ? { all: children } : { any: children };
+}
+
+/** Is every leaf in this tree answerable? Drives the red line, never the Save button. */
+export function condComplete(cond: Cond | null | undefined, nullaryOps: string[]): boolean {
+  if (!cond) return true;
+  if (isCondGroup(cond)) {
+    const { children } = groupParts(cond);
+    return children.length > 0 && children.every((c) => condComplete(c, nullaryOps));
+  }
+  const leaf = cond as { field: string; op: string; value?: string | number };
+  if (!leaf.field || !leaf.op) return false;
+  if (nullaryOps.includes(leaf.op)) return true;
+  return leaf.value !== undefined && String(leaf.value).trim() !== "";
+}
+
+export default function CondBuilder({
+  cond,
+  onChange,
+  fields,
+  ops,
+  nullaryOps,
+  maxDepth,
+  maxChildren,
+  lead = "When",
+  disabled,
+}: Props) {
+  // The editor always works on a GROUP even when one leaf is stored — a list of one is still a
+  // list, and `pack` puts it back the way it was found.
+  const { join, children } = isCondGroup(cond)
+    ? groupParts(cond)
+    : { join: "all" as const, children: cond ? [cond] : [] };
+
+  const emit = (nextJoin: "all" | "any", next: Cond[]) => onChange(pack(nextJoin, next));
+  const replace = (i: number, next: Cond) =>
+    emit(join, children.map((c, j) => (j === i ? next : c)));
+
+  return (
+    <div className="autoc-tree">
+      {children.map((child, i) => (
+        /*
+          ⚠ THE KEY CARRIES THE ROW COUNT, and that is what makes the uncontrolled value input
+          above safe. Keyed by index alone, removing row 0 would REUSE row 0's DOM node for what
+          used to be row 1 — and an uncontrolled input keeps its own DOM value, so the reader
+          would be looking at the deleted row's text under the surviving row's field. Changing
+          the count remounts the whole list, which discards every stale DOM value at exactly the
+          moment the structure changes.
+        */
+        <div className="autoc-row" key={`${children.length}:${i}`}>
+          <button
+            type="button"
+            className="autoc-drop"
+            disabled={disabled}
+            aria-label="Remove this condition"
+            title="Remove this condition"
+            onClick={() => emit(join, children.filter((_c, j) => j !== i))}
+          >
+            <svg width="12" height="12" viewBox="0 0 16 16" fill="none" aria-hidden="true">
+              <path
+                d="M4 4l8 8M12 4l-8 8"
+                stroke="currentColor"
+                strokeWidth="1.5"
+                strokeLinecap="round"
+              />
+            </svg>
+          </button>
+
+          {/*
+            THE JOIN IS THE GROUP'S, AND IT IS EDITED IN EXACTLY ONE PLACE. Row 2 carries the
+            dropdown; every later row prints the word it chose. Giving each row its own
+            and/or select would offer a mixed tree the shape cannot express — `{all: […]}` has
+            one join — and the user would discover that only when their third row silently
+            behaved like the second's.
+          */}
+          <span className="autoc-join">
+            {i === 0 ? (
+              lead
+            ) : i === 1 ? (
+              <select
+                className="auto-input is-tiny"
+                value={join}
+                disabled={disabled}
+                aria-label="Match all or any of these conditions"
+                onChange={(e) => emit(e.target.value === "any" ? "any" : "all", children)}
+              >
+                <option value="all">and</option>
+                <option value="any">or</option>
+              </select>
+            ) : (
+              <span className="autoc-join-word">{join === "all" ? "and" : "or"}</span>
+            )}
+          </span>
+
+          {isCondGroup(child) ? (
+            <div className="autoc-nest">
+              <CondBuilder
+                cond={child}
+                onChange={(next) =>
+                  next
+                    ? replace(i, next)
+                    : emit(join, children.filter((_c, j) => j !== i))
+                }
+                fields={fields}
+                ops={ops}
+                nullaryOps={nullaryOps}
+                maxDepth={maxDepth - 1}
+                maxChildren={maxChildren}
+                lead=""
+                {...(disabled ? { disabled: true } : {})}
+              />
+            </div>
+          ) : (
+            <Leaf
+              leaf={child as { field: string; op: string; value?: string | number }}
+              fields={fields}
+              ops={ops}
+              nullaryOps={nullaryOps}
+              {...(disabled ? { disabled: true } : {})}
+              onChange={(next) => replace(i, next)}
+            />
+          )}
+        </div>
+      ))}
+
+      <div className="autoc-adds">
+        <button
+          type="button"
+          className="autoc-add"
+          disabled={disabled || children.length >= maxChildren}
+          title={
+            children.length >= maxChildren
+              ? `This group holds at most ${maxChildren} conditions.`
+              : undefined
+          }
+          onClick={() => emit(join, [...children, newLeaf(ops)])}
+        >
+          + Add condition
+        </button>
+        {/* Nesting is offered only while the SERVER's depth allows it — the ceiling rides the
+            payload, so this control disappears at the same depth `clean_cond` refuses. */}
+        {maxDepth > 1 ? (
+          <button
+            type="button"
+            className="autoc-add"
+            disabled={disabled || children.length >= maxChildren}
+            onClick={() => emit(join, [...children, { all: [newLeaf(ops)] }])}
+          >
+            + Add condition group
+          </button>
+        ) : null}
+      </div>
+
+      {/* THE RED LINE (image 4). A statement about the tree, not a wall in front of Save. */}
+      {!condComplete(pack(join, children), nullaryOps) ? (
+        <p className="autoc-bad">A condition is incomplete or invalid.</p>
+      ) : null}
+    </div>
+  );
+}
+
+function Leaf({
+  leaf,
+  fields,
+  ops,
+  nullaryOps,
+  disabled,
+  onChange,
+}: {
+  leaf: { field: string; op: string; value?: string | number };
+  fields: Field[];
+  ops: string[];
+  nullaryOps: string[];
+  disabled?: boolean;
+  onChange: (next: Cond) => void;
+}) {
+  const nullary = nullaryOps.includes(leaf.op);
+  return (
+    <>
+      <select
+        className="auto-input is-tiny"
+        value={leaf.field}
+        disabled={disabled}
+        aria-label="Field"
+        onChange={(e) => onChange({ ...leaf, field: e.target.value })}
+      >
+        <option value="">Choose a field…</option>
+        {/*
+          ⚠ THE STORED VALUE IS ALWAYS AN OPTION. A <select> whose `value` matches no <option>
+          renders the FIRST one, so a condition on a column this list has not caught up with
+          would LOOK like a condition on a different column — and the next Save would write that
+          different column without anybody choosing it. This repo has paid for that twice
+          ([[cg-condition-builder-items]]).
+        */}
+        {leaf.field && !fields.some((f) => f.key === leaf.field) ? (
+          <option value={leaf.field}>{leaf.field} (not in this database)</option>
+        ) : null}
+        {fields.map((f) => (
+          <option key={f.key} value={f.key}>
+            {f.label}
+          </option>
+        ))}
+      </select>
+
+      <select
+        className="auto-input is-tiny"
+        value={leaf.op}
+        disabled={disabled}
+        aria-label="Comparison"
+        onChange={(e) => {
+          const op = e.target.value;
+          // Moving to a value-free comparison DROPS the value rather than keeping it out of
+          // sight: a stored `value` under `is_empty` is a fact the sentence does not show and
+          // the next operator change would silently resurrect.
+          onChange(nullaryOps.includes(op) ? { field: leaf.field, op } : { ...leaf, op });
+        }}
+      >
+        {leaf.op && !ops.includes(leaf.op) ? (
+          <option value={leaf.op}>{opWord(leaf.op)} (not offered here)</option>
+        ) : null}
+        {ops.map((op) => (
+          <option key={op} value={op}>
+            {opWord(op)}
+          </option>
+        ))}
+      </select>
+
+      {nullary ? null : (
+        /*
+          ⛔ FREE TEXT COMMITS ON BLUR, like every other free-text field in this builder — and
+          the controlled version this replaced was worse than merely chatty. `onChange` reached
+          `patchTrigger` → PATCH, so typing "New" fired THREE requests; the displayed value
+          could not advance until each round-trip landed; and `disabled={busy}` disabled the
+          input under the typist's fingers. The two selects beside it stay controlled because
+          each is ONE discrete decision, which is exactly the distinction the cron field made
+          (AutomationTrigger's note) and the reason this input is not one.
+        */
+        <input
+          className="auto-input is-tiny autoc-value"
+          defaultValue={leaf.value === undefined ? "" : String(leaf.value)}
+          disabled={disabled}
+          aria-label="Value"
+          placeholder="Value"
+          onBlur={(e) => {
+            if (e.target.value !== String(leaf.value ?? "")) onChange({ ...leaf, value: e.target.value });
+          }}
+        />
+      )}
+    </>
+  );
+}

web/src/automation/automationApi.ts

@@ -100,7 +100,31 @@ export interface Automation {
    * definition can express are `schedule.enabled` true/false, and the picker
    * derives those rather than inventing a third answer.
    */
-  trigger?: { key: string; ready?: boolean; needs?: string };
+  trigger?: {
+    key: string;
+    ready?: boolean;
+    needs?: string;
+    /** ⚠ STORED INERT, NOT REFUSED (A3): the picker writes `{key}` first and the table/field
+     *  after, so an unfinished trigger is a STATE the builder finishes — never a snap-back to
+     *  Manual. It cannot fire while incomplete, which is the fail-closed direction. */
+    configured?: boolean;
+    paused?: boolean;
+    enabled?: boolean;
+    table?: string;
+    field?: string;
+    fields?: string[];
+    viewId?: string;
+    query?: string;
+    token?: string;
+    formToken?: string;
+    when?: Cond | null;
+  };
+  /**
+   * WAVE 23 / C4 — the ACTIONS this automation runs, and how it ends (C5). Defaulted
+   * server-side to `{actions: [], ending: {mode: "terminal"}}`, so an automation written before
+   * this wave reads as "no actions, stops at the end" rather than as a missing key.
+   */
+  flow?: Flow;
   /**
    * The review gate's decisions, newest first (<=100). A promotion is a person's
    * judgement written into a record, so it says WHO — the same reason every count in
@@ -158,6 +182,13 @@ export interface AutomationList {
    * controls that already exist rather than rendering an empty dropdown.
    */
   triggers?: TriggerOption[];
+  /**
+   * WAVE 23 / C4 — the action menu and the builder's ceilings. OPTIONAL for the reason every
+   * other server vocabulary here is: absent is a third state (a server older than this client),
+   * and the builder prints what it has rather than inventing a menu.
+   */
+  actionsCatalog?: ActionCatalogRow[];
+  flow?: FlowVocab;
   storeAvailable: boolean;
 }
 
@@ -173,6 +204,111 @@ export interface TriggerOption {
   ready: boolean;
   /** What it is waiting for, e.g. `"connect_gmail"`. Rendered as a next step, never as an error. */
   needs?: string;
+  /**
+   * WAVE 23 / R2 — DECLARED BUT NOT BUILT (`button_clicked`, `comment_added`). Distinct from
+   * `ready:false`, and the difference is what the user can DO about it: a not-ready trigger is
+   * waiting on a connection THEY can make, a planned one is waiting on us. Both render; only
+   * the first offers an action. The server refuses a planned key at the door
+   * (`clean_trigger`), so the faded state is enforced rather than merely displayed.
+   */
+  planned?: boolean;
+  /**
+   * ⭐ THE CONNECT AFFORDANCE, SERVER-COMPOSED (A3(3), wave 23). This replaced a client table
+   * that mapped a `needs` token to a provider and hand-built the start URL — two facts the
+   * OAuth registry already owns, kept in a second place that could disagree with it. `null`
+   * (or absent) means there is no route to offer, which the trigger face states in words
+   * instead of drawing a button that goes nowhere.
+   */
+  connect?: { provider: string; startUrl: string } | null;
+}
+
+// ── WAVE 23 / contracts C4 + C5: CONDITION TREES, ACTIONS, ENDINGS ───────────────────────────
+//
+// ⛔ EVERY VOCABULARY BELOW IS `string`, for the reason C1 and C3 already give: a client union
+// over a server enumeration is a list that can go stale, and it goes stale SILENTLY. The engine
+// ships `flow.condOps`, `flow.endingModes`, `flow.reviewDeciders` and `actionsCatalog` on
+// `GET /automations`; the builder renders whatever rides and never a list of its own.
+
+/**
+ * ONE condition, as a TREE (C4). A leaf is wave 22's lane condition unchanged — which is why
+ * nothing migrated: a stored leaf IS a valid tree, and the engine dispatches on shape.
+ * Depth and breadth are the SERVER's numbers (`flow.maxCondDepth` / `maxCondChildren`), read
+ * from the payload rather than repeated here.
+ */
+export type Cond =
+  | { field: string; op: string; value?: string | number }
+  | { all: Cond[] }
+  | { any: Cond[] };
+
+export function isCondGroup(c: Cond | null | undefined): c is { all: Cond[] } | { any: Cond[] } {
+  return !!c && (Array.isArray((c as { all?: Cond[] }).all)
+    || Array.isArray((c as { any?: Cond[] }).any));
+}
+
+/** A group's join word and its children, without the caller re-testing both keys every time. */
+export function groupParts(c: Cond): { join: "all" | "any"; children: Cond[] } {
+  const all = (c as { all?: Cond[] }).all;
+  return Array.isArray(all) ? { join: "all", children: all }
+    : { join: "any", children: (c as { any: Cond[] }).any || [] };
+}
+
+/**
+ * One step of a flow (C4). `config` is per-kind and deliberately loose here — the engine
+ * validates it and REFUSES rather than coercing, so a client-side shape would be a second
+ * validator free to disagree with the one that decides.
+ */
+export interface Action {
+  id: string;
+  kind: string;
+  enabled: boolean;
+  /** Run this action only when the walking record matches. `null` = always. */
+  when?: Cond | null;
+  config: Record<string, unknown>;
+}
+
+/** `flow.ending` (C5) — what happens to a record that reaches the end. */
+export interface FlowEnding {
+  mode: string;
+  hours?: number;
+}
+
+export interface Flow {
+  actions: Action[];
+  ending: FlowEnding;
+}
+
+/**
+ * A row of the ACTION MENU (image 7/8's grouped list). `group` is the section heading and
+ * `ready:false` paints the card faded WITH the server's own reason — the owner asked for the
+ * full menu, and a shorter one would imply the missing actions do not exist. `clean_actions`
+ * refuses an unready kind, so faded is a wall rather than a styling choice.
+ */
+export interface ActionCatalogRow {
+  kind: string;
+  label: string;
+  group: string;
+  ready: boolean;
+  detail: string;
+}
+
+/** The builder's own ceilings, server-declared so the client never hard-codes the same numbers. */
+export interface FlowVocab {
+  condOps: string[];
+  nullaryCondOps: string[];
+  maxCondDepth: number;
+  maxCondChildren: number;
+  maxGroupDepth: number;
+  maxActions: number;
+  endingModes: string[];
+  maxResetHours: number;
+  reviewDeciders: string[];
+  /**
+   * ⚠ PER-DEPLOYMENT, AND HONEST RATHER THAN DECORATIVE. With no LLM key configured the engine
+   * holds every card for a human — so an enabled-looking "decided by AI" control would promise
+   * a decision nothing will make. False renders it as not-configured (C6's fail-closed path,
+   * made visible).
+   */
+  aiReady: boolean;
 }
 
 export interface OAuthConnection {
@@ -190,28 +326,19 @@ export interface OAuthConnection {
  */
 export type OAuthStatus = Record<string, OAuthConnection | undefined>;
 
-/**
- * A trigger's `needs` token → the connector it is waiting on.
+/*
+ * ⛔ `CONNECT_PROVIDERS` / `oauthProviderFor` / `oauthStartUrlFor` ARE GONE (D-43, wave 23).
  *
- * ⚠ THE ONE PLACE A SERVER TOKEN BECOMES A ROUTE, and it is deliberately tiny and
- * deliberately FAIL-QUIET-BUT-VISIBLE: an unknown token resolves to "", the connect
- * BUTTON is not drawn, and the not-configured state is still stated in words. A
- * button that navigates nowhere is worse than no button — it reads as a broken
- * product rather than an unfinished one.
+ * They were a client table mapping a server `needs` token ("connect_gmail") to a provider
+ * ("google") and composing `/oauth/google/start` by hand — a second copy of the OAuth
+ * registry, booked as debt on the day it shipped with the resolution written into it: "this
+ * table disappears the day a `TriggerOption` carries its own provider or start URL." It does
+ * now (`TriggerOption.connect`, composed by `routes_automation._triggers_vocab`), so the copy
+ * is deleted rather than left to drift the first time a second provider lands.
  *
- * DEBT: this table disappears the day a `TriggerOption` carries its own provider or
- * start URL. Booked in the wave-22 mailbox as a question for the engine session.
+ * The FAIL-QUIET-BUT-VISIBLE behaviour it was built for is unchanged and now belongs to the
+ * server: no `connect` means no button, and the not-configured state is still said in words.
  */
-const CONNECT_PROVIDERS: Record<string, string> = { connect_gmail: "google" };
-
-export function oauthProviderFor(needs: string): string {
-  return CONNECT_PROVIDERS[String(needs || "")] || "";
-}
-
-export function oauthStartUrlFor(needs: string): string {
-  const provider = oauthProviderFor(needs);
-  return provider ? `${API_V1}/oauth/${provider}/start` : "";
-}
 
 export interface TickState {
   enabled: boolean;
@@ -312,6 +439,13 @@ export interface UserTable {
   source: string;
   rowCount: number;
   fields: { key: string; label: string; type: string; automation?: unknown }[];
+  /**
+   * The table's saved views — what `enters_view` names (C3). ABSENT until the server sends it,
+   * and absent is a third state, not an empty list: the trigger's view control says the list was
+   * not offered rather than rendering an empty picker that looks like "this table has no views".
+   * (Asked of session A in the wave mailbox; the control reads this key the day it rides.)
+   */
+  views?: { id: string; label: string }[];
 }
 
 export interface SourcePreview {
@@ -422,6 +556,16 @@ export interface BoardCard {
   /** The SERVER's answer to "may this move", not a permission the client derives. */
   canAdvance: boolean;
   next: string[];
+  /**
+   * WAVE 23 / C5 — how many times this record has been round the flow. The count lives in the
+   * machine cell `stage_<autoId>_cycles` and the engine increments it on every reset.
+   *
+   * ⚠ NOT ON THE CARD WIRE YET (asked of session A in the wave mailbox). Absent means "not
+   * reported", NOT "once": the badge only draws from 2 upwards, so a missing key renders
+   * nothing at all rather than a claim that every record is on its first pass — which is
+   * exactly the measurement nobody made. It lights up the day the key rides.
+   */
+  cycles?: number;
 }
 
 export interface Board {
@@ -444,13 +588,25 @@ export interface Board {
   truncated?: string[];
 }
 
-/** One human decision at a review gate — R7's approval posture, audited (A2(5)). */
+/**
+ * One decision at a review gate — R7's approval posture, audited (A2(5)).
+ *
+ * ⭐ WAVE 23 / C6 (R4/R14): a decision may now be made by a MODEL, and the audit says so. One
+ * log, not two — a reader asking "who decided this" gets one answer whether it was a person or
+ * a provider, which is the only version that can be trusted at all.
+ */
 export interface ReviewEntry {
   ts: string;
   user: string;
   rowId: string;
   from: string;
   to: string;
+  /** `"user"` | `"ai"`. Absent on entries written before this wave — render as a person. */
+  by?: string;
+  /** The one-line reason. On an AI decision it is the model's own; never invented here. */
+  note?: string;
+  /** Which model decided. Present only on AI entries, and shown so the reason has provenance. */
+  model?: string;
 }
 
 export class AutomationError extends Error {

web/src/connectors/ConnectorsPage.tsx

@@ -0,0 +1,274 @@
+// ---------------------------------------------------------------------------
+// connectors/ConnectorsPage.tsx — WAVE 23 item 10 (ruling R8, contract C11).
+//
+// The Claude-style directory: a search box and a card grid, laid out from
+// `reference/Claude Connectors.png` and painted in OUR tokens. Every card is a
+// row of `GET /api/v1/connectors/directory` (SESSION A's route) — this page
+// invents nothing, which is what lets `#/connectors` be a CHROME route without
+// touching the shell's "an undeclared surface is denied" law (nav.ts'
+// `CHROME_ROUTES` note carries the full argument).
+//
+// ⛔ NO THIRD-PARTY LOGOS AND NO EMOJIS (R8 + DESIGN.md §4). A connector's mark is
+// a two-letter tile in the chip family every database already wears, so the
+// directory reads as part of this product rather than as a wall of other
+// companies' branding — and nobody has to ship, license or update an icon set.
+//
+// ⚠ NO CLIENT UNION OVER `state` OR `kind`. They are the server's vocabulary and
+// arrive as strings (the wave-9 law): a client `type State = "connected" | …`
+// turns "the server added a state" into "the client drops the card".
+// ---------------------------------------------------------------------------
+
+import { useEffect, useState } from "react";
+import { API_V1, CREDENTIALS } from "../apiContract";
+
+/** One row of the directory. Everything optional but `key` + `label` is genuinely optional on
+ *  the wire — a builtin has no provider, a planned connector has no `connectedAs`. */
+export interface ConnectorRow {
+  key: string;
+  label: string;
+  desc: string;
+  /** `connected` | `available` | `planned` — read as a STRING, never a union. */
+  state: string;
+  /** `builtin` | `oauth` | `token`. */
+  kind: string;
+  provider?: string;
+  /** What is missing before it can connect — shown on the card, never invented here. */
+  needs?: string;
+  /** The account the connection is made as, when the server chooses to say. */
+  connectedAs?: string;
+  /**
+   * ⛔ A DESTINATION WORD, NOT A URL — `"keychain" | "oauth" | "automation" | ""`.
+   *
+   * This page was first written against C11's prose, which reads as though `manage` were a link,
+   * and it rendered `<a href={row.manage}>` — i.e. `href="keychain"`, a relative link to a page
+   * that does not exist, on every Odoo and token card. It compiled, it looked right, and it went
+   * nowhere. Corrected against the real payload (`routes_connectors.directory`): the server
+   * names WHERE the action lives and this page decides how to open it, which is the right split —
+   * the door for a keychain entry is a modal the shell owns and no URL could express it.
+   *
+   * Empty for a NON-ADMIN, deliberately (the route's own note): the card renders without an
+   * action rather than offering a door that would 403.
+   */
+  manage?: string;
+  /** OAuth only: the URL that starts the flow. This IS a link, and it is a different field. */
+  startUrl?: string;
+  /** A token connector's honest one-liner: the key is stored, the data arrives later (R13). */
+  note?: string;
+  /** What the admin will be asked for — shown where the decision is made, not in a tour. */
+  hint?: string;
+}
+
+type Load =
+  | { phase: "loading" }
+  | { phase: "ready"; rows: ConnectorRow[] }
+  | { phase: "error"; message: string };
+
+const str = (v: unknown): string => (typeof v === "string" ? v : "");
+
+export function parseDirectory(body: unknown): ConnectorRow[] {
+  const raw = (body as { connectors?: unknown } | null)?.connectors;
+  if (!Array.isArray(raw)) return [];
+  const out: ConnectorRow[] = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const c = item as Record<string, unknown>;
+    const key = str(c.key).trim();
+    const label = str(c.label).trim();
+    // A card with no name is a tile with no sign on it — dropped rather than rendered from its
+    // key, which would put an internal identifier on screen (`parsePages`' own rule).
+    if (!key || !label) continue;
+    out.push({
+      key,
+      label,
+      desc: str(c.desc),
+      state: str(c.state) || "available",
+      kind: str(c.kind),
+      ...(str(c.provider) ? { provider: str(c.provider) } : {}),
+      ...(str(c.needs) ? { needs: str(c.needs) } : {}),
+      ...(str(c.connectedAs) ? { connectedAs: str(c.connectedAs) } : {}),
+      ...(str(c.manage) ? { manage: str(c.manage) } : {}),
+      ...(str(c.startUrl) ? { startUrl: str(c.startUrl) } : {}),
+      ...(str(c.note) ? { note: str(c.note) } : {}),
+      ...(str(c.hint) ? { hint: str(c.hint) } : {}),
+    });
+  }
+  return out;
+}
+
+/** The card's mark: two letters from the connector's own name, in the database chip family.
+ *  Unicode-aware for the same reason the account monogram is (`Shell.tsx:299`). */
+export function tileText(label: string): string {
+  const chars = String(label ?? "").match(/[\p{L}\p{N}]/gu) ?? [];
+  return chars.slice(0, 2).join("").toUpperCase();
+}
+
+/** Search over the two things a person actually reads. Case-folded substring: this list is a
+ *  couple of dozen rows, and a ranking function over a set you can see all of is noise. */
+export function matches(row: ConnectorRow, query: string): boolean {
+  const q = query.trim().toLowerCase();
+  if (!q) return true;
+  return (
+    row.label.toLowerCase().includes(q) ||
+    row.desc.toLowerCase().includes(q) ||
+    row.key.toLowerCase().includes(q)
+  );
+}
+
+/**
+ * The chip's tone for a state.
+ *
+ * ⚠ FIVE STATES ARRIVE, NOT THREE. C11's prose names `connected | available | planned`; the real
+ * payload also sends `reconnect` (the token expired) and `unconfigured` (nobody registered the
+ * client on this deployment) — a distinction the route's own comment calls the point of the
+ * change. Read as strings and mapped here, so a SIXTH state renders in the neutral tone rather
+ * than dropping the card (the wave-9 law: no client union over a server vocabulary).
+ */
+export function stateTone(state: string): string {
+  if (state === "connected") return " is-on";
+  if (state === "available" || state === "reconnect") return " is-open";
+  return "";                       // planned, unconfigured, and anything new
+}
+
+export default function ConnectorsPage({
+  onKeychain,
+}: {
+  /**
+   * `manage: "keychain"` — open Settings on the Keychains tab.
+   *
+   * ⛔ A CALLBACK, NOT A LINK, because the destination is a MODAL the shell owns and no URL can
+   * express it. REQUIRED rather than optional: an optional handler the frame forgot to pass
+   * degrades to "the Connect button does nothing", which is indistinguishable from a feature
+   * that was never built and goes red in no gate (this repo's most expensive lesson).
+   */
+  onKeychain: () => void;
+}) {
+  const [load, setLoad] = useState<Load>({ phase: "loading" });
+  const [query, setQuery] = useState("");
+
+  useEffect(() => {
+    let dead = false;
+    void (async () => {
+      try {
+        const res = await fetch(`${API_V1}/connectors/directory`, {
+          credentials: CREDENTIALS,
+        });
+        const body = (await res.json().catch(() => null)) as
+          | { error?: { message?: string } }
+          | null;
+        if (dead) return;
+        if (!res.ok) {
+          setLoad({
+            phase: "error",
+            message: body?.error?.message || `The server answered ${res.status}.`,
+          });
+          return;
+        }
+        setLoad({ phase: "ready", rows: parseDirectory(body) });
+      } catch {
+        if (!dead) setLoad({ phase: "error", message: "Cannot reach the server." });
+      }
+    })();
+    return () => {
+      dead = true;
+    };
+  }, []);
+
+  const rows = load.phase === "ready" ? load.rows.filter((r) => matches(r, query)) : [];
+
+  return (
+    <div className="shell-conn">
+      <h1 className="conn-title">Connectors</h1>
+
+      <input
+        className="conn-search"
+        placeholder="Search connectors"
+        value={query}
+        maxLength={60}
+        onChange={(e) => setQuery(e.target.value)}
+      />
+
+      {load.phase === "loading" ? (
+        <div className="shell-loading">
+          <span className="lp-spin lp-spin--lg" role="status" aria-label="Loading" />
+        </div>
+      ) : null}
+      {load.phase === "error" ? (
+        // Honest, and it names the retry. Never a hard-coded list of connectors as a fallback:
+        // that would put sources on screen this workspace may not have (the nav's own rule,
+        // applied to a second server-composed payload).
+        <p className="conn-note">{load.message}</p>
+      ) : null}
+      {load.phase === "ready" && rows.length === 0 ? (
+        <p className="conn-note">
+          {query ? "No connector matches that." : "No connectors are available yet."}
+        </p>
+      ) : null}
+
+      <div className="conn-grid">
+        {rows.map((row) => {
+          const planned = row.state === "planned";
+          const connected = row.state === "connected";
+          return (
+            <div
+              key={row.key}
+              className={"conn-card" + (planned ? " is-planned" : "")}
+              // ⛔ `aria-disabled`, NOT `inert`/`pointer-events` alone. A planned card is
+              // non-interactive by R8, and a card that merely LOOKS faded while still taking a
+              // click is the painted-but-unclickable failure in reverse
+              // ([[ui-invisible-to-assertions]]). It carries no controls at all, so there is
+              // nothing to disable — the attribute is what says so to a screen reader.
+              {...(planned ? { "aria-disabled": true } : {})}
+            >
+              <div className="conn-card-head">
+                <span className="shell-db-chip conn-tile" aria-hidden="true">
+                  {tileText(row.label)}
+                </span>
+                <span className="conn-card-name">{row.label}</span>
+                <span className={"conn-state" + stateTone(row.state)}>
+                  {/* The server's own word, sentence-cased by CSS never by `toUpperCase` — R6
+                      bans caps in app chrome, and a chip is chrome. */}
+                  {row.state}
+                </span>
+              </div>
+              <p className="conn-card-desc">{row.desc}</p>
+              {connected && row.connectedAs ? (
+                <p className="conn-card-meta">Connected as {row.connectedAs}</p>
+              ) : null}
+              {/* ⚠ `needs` IS SHOWN WHATEVER THE STATE, and that is a correction: gating it on
+                  "not connected" hid the one line that explains an `unconfigured` row, which is
+                  the state it exists for ("the owner registers the client"). Only `planned`
+                  suppresses it, because "not built yet" beside a card already marked planned is
+                  the same sentence twice. */}
+              {!planned && row.needs ? (
+                <p className="conn-card-meta">{row.needs}</p>
+              ) : null}
+              {/* R13's honesty line for a token connector: the key is stored, the data arrives
+                  later. Shown ON the card where the decision is, never in a paragraph. */}
+              {!planned && row.note ? <p className="conn-card-meta">{row.note}</p> : null}
+              {/* ── the ACTION. `manage` names WHERE it lives; this decides how to open it.
+                  Every door here already existed — an OAuth start URL, the keychain dialog,
+                  the automation surface — which is exactly why this page can be chrome: it
+                  mints no new credential path (C11). An empty `manage` (a non-admin) renders
+                  NO control rather than one that would 403. */}
+              {!planned && row.manage === "oauth" && row.startUrl ? (
+                <a className="conn-card-go" href={row.startUrl}>
+                  {row.state === "reconnect" ? "Reconnect" : "Connect"}
+                </a>
+              ) : null}
+              {!planned && row.manage === "keychain" ? (
+                <button type="button" className="conn-card-go" onClick={onKeychain}>
+                  {connected ? "Manage keys" : "Add keys"}
+                </button>
+              ) : null}
+              {!planned && row.manage === "automation" ? (
+                <a className="conn-card-go" href="#/automation">
+                  Open automations
+                </a>
+              ) : null}
+            </div>
+          );
+        })}
+      </div>
+    </div>
+  );
+}

web/src/customer-grid/ColumnMenu.tsx

@@ -3,8 +3,8 @@ import { AnchoredOverlay } from "./OverlaySurface";
 import type { AnchorRect } from "./OverlaySurface";
 import { FieldTypeIcon, MenuLabel } from "./icons";
 import { FieldSelectButton } from "./FieldSelect";
-import { CREATABLE_TYPES, choiceOptions, choiceRenames, directionLabel, parseOptions, ratingMax }
-  from "./types";
+import { CREATABLE_TYPES, choiceOptions, choiceRenames, directionLabel, isMachineOwned,
+  parseOptions, ratingMax } from "./types";
 import type { Field, FieldFormat, FieldScope, FieldType, Measure, Viewer } from "./types";
 import type { WindowSpec } from "./windows";
 import { normalizeWindow, windowLabel } from "./windows";
@@ -1235,7 +1235,16 @@ export default function ColumnMenu({
   // Item 8c — the period draft is valid when it normalizes and differs from what the field
   // already has. Compared through normalizeWindow so `{kind:'ltm'}` and `{kind:'ltm', n:undefined}`
   // read as the same window.
-  const typeLineBase = field.measure
+  // ⭐ Wave-23 C8 (owner item 4 / R9) — FIRST in the chain, because it is the most specific true
+  // thing about the column and the branches below it were saying something false. An
+  // `automation` or `metric` column, and every column an automation SPAWNED (the `automation`
+  // tag), is overlay-sourced and non-derived, so it fell through to "Editable overlay field" —
+  // which is what the wash now visibly contradicts. ONE line, no second sentence about what an
+  // automation is (R13 / DESIGN.md §4): the person reading a column menu is deciding whether to
+  // type in it, and "filled by automation" is the whole answer.
+  const typeLineBase = isMachineOwned(field)
+    ? "Filled by automation"
+    : field.measure
     ? "Metric, read-only"
     : field.type === "formula"
       ? "Formula field, computed"

web/src/customer-grid/CustomerGrid.tsx

@@ -33,6 +33,7 @@ import type { MeasureSets } from "./useVisibleRows";
 import { useGetCellContent } from "./useGetCellContent";
 import { useGridSelection } from "./useGridSelection";
 import Toolbar from "./Toolbar";
+import JsonViewer from "./JsonViewer";
 import RecordDetail from "./RecordDetail";
 import ViewSidebar from "./ViewSidebar";
 import ColumnMenu from "./ColumnMenu";
@@ -537,6 +538,14 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
     setPicker(null);
     requestAnimationFrame(() => gridRef.current?.focus());
   }, []);
+  /** ⭐ Wave-23 C7 — which `json` cell the big viewer is open on. NOT anchored like the picker
+   *  above: a document is not a choice list, so it opens as a centred modal (the record drawer's
+   *  surface) rather than a popover the size of the cell it came from. */
+  const [jsonAt, setJsonAt] = useState<{ pid: number; fieldKey: string } | null>(null);
+  const closeJson = useCallback(() => {
+    setJsonAt(null);
+    requestAnimationFrame(() => gridRef.current?.focus());
+  }, []);
   /** WAVE 21 item 11 (R10) — is "Select records from a list" open? Opened from the view
    *  rail's "…" and closed by the dialog; the SELECTION it produces outlives it. */
   const [selectFromFile, setSelectFromFile] = useState(false);
@@ -1910,6 +1919,18 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
         });
         return;
       }
+      // ⭐ Wave-23 C7 — a JSON cell opens the big viewer. It is the ONLY door: the cell carries
+      // `allowOverlay:false`, because glide's overlay is a one-line box and one keystroke in the
+      // wrong place inside a 32 KB document turns a well-formed payload into an unparseable one,
+      // saved. Opened for EVERY reader (a document you may not edit is still one you must be
+      // able to read) — the viewer takes `onSave` only when the permission verdict allows it,
+      // and the host's write wall is the real one either way.
+      if (row.kind === "data" && field?.type === "json") {
+        event.preventDefault();
+        setActiveCell(cell[0], cell[1]);
+        setJsonAt({ pid: row.record.pid, fieldKey: field.key });
+        return;
+      }
       // Wave-5 item 11 — a URL cell opens its link on click (scheme-guarded: http/https only,
       // a bare domain gets https://). Editing stays with glide's overlay (Enter/double-click).
       if (row.kind === "data" && field?.type === "url") {
@@ -3640,6 +3661,17 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
       onCalendarMetrics={setCalendarMetrics}
     />
   );
+  // ⭐ Wave-23 C7 — the open document, resolved exactly like the picker's value below it:
+  // the OPTIMISTIC edit wins over the raw record, so a save the server has not echoed yet is
+  // what re-opening the cell shows (the echo-suppression law — reading the raw row here would
+  // make a just-saved document appear to revert).
+  const jsonField = jsonAt ? fieldByKey.get(jsonAt.fieldKey) : undefined;
+  const jsonRow = jsonAt ? rawRows.find((r) => r.pid === jsonAt.pid) : undefined;
+  const jsonValue = String(
+    (jsonAt && overlayEdits[jsonAt.pid]?.[jsonAt.fieldKey])
+    ?? (jsonField && jsonRow ? jsonRow[jsonField.key] : "")
+    ?? ""
+  );
   const pickerField = picker ? fieldByKey.get(picker.fieldKey) : undefined;
   // A `user` field's choices come from the HOST's real user list, a `select`'s from its own
   // definition — so an assignee is always someone who can log in, and a status is always one of
@@ -4691,6 +4723,21 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
         </AnchoredOverlay>
       )}
 
+      {/* ⭐ Wave-23 C7 — the document viewer. `onSave` is OMITTED, not disabled, when the reader
+          may not edit: an absent handler is what makes the raw tab a `<pre>` instead of a
+          textarea, so there is no editor to be refused by. */}
+      {jsonField && jsonAt && (
+        <JsonViewer
+          label={jsonField.label}
+          value={jsonValue}
+          onSave={
+            canEditField(jsonField)
+              ? (next) => patchAndRecord(jsonAt.pid, { [jsonField.key]: next }, "a document")
+              : undefined
+          }
+          onClose={closeJson}
+        />
+      )}
       {pickerField && picker && (
         <AnchoredOverlay
           anchor={picker.anchor}

web/src/customer-grid/JsonViewer.tsx

@@ -0,0 +1,361 @@
+// ---------------------------------------------------------------------------
+// customer-grid / JsonViewer.tsx — ⭐ wave-23 C7 (owner item 5 / ruling R5).
+//
+// THE BIG VIEWER a json cell opens on click. One component, reached from two
+// places (the grid cell's click path and the record drawer's value slot), for
+// the reason `assetUrl` is one resolver: two readers of the same document that
+// disagree about how it folds is a bug nobody can see in either one alone.
+//
+// The document is a STRING at rest (the scalar Row contract — see the `json`
+// note in types.ts), so everything here is text in and text out. Nothing in
+// this file ever writes a parsed OBJECT back.
+//
+// THREE decisions worth stating, because each has a plausible alternative:
+//
+//  1. THE RAW TAB IS THE EDITOR, and there is no field-by-field one. A form
+//     over a document whose shape nobody declared would have to invent that
+//     shape from the current value — so adding a key would mean editing the
+//     form's idea of the schema, and the first machine write with a different
+//     shape would silently drop what it did not recognise.
+//  2. PARSE ON SAVE, REFUSE WITH A SENTENCE. Never repair, never re-indent on
+//     the way in: `{a:1}` is not JSON and quietly "fixing" it to `{"a":1}`
+//     teaches a person their typo was fine, until the day a value cannot be
+//     guessed. The host applies the same rule at the write wall (C7), so a
+//     refusal here says the same thing the server would.
+//  3. THE TREE IS READ-ONLY and collapses by DEPTH, not by hand-kept state per
+//     node beyond what the reader opens. A 200-key payload that arrives fully
+//     expanded is a scroll bar, not a document.
+// ---------------------------------------------------------------------------
+
+import { useEffect, useId, useMemo, useRef, useState } from "react";
+import type { ReactNode } from "react";
+import { BodyPortal, useOverlayLayer } from "./OverlaySurface";
+import { jsonParse, jsonPretty, MAX_JSON_BYTES } from "./display";
+
+/** Bytes, not characters — the host's cap is on the stored UTF-8, and a
+ *  document of 20,000 emoji is 80 KB. Counting `length` would let a value
+ *  through here that the server then refuses, which is the one refusal a user
+ *  cannot act on (nothing on screen said it was too big). */
+export function jsonByteLength(text: string): number {
+  return typeof TextEncoder === "undefined"
+    ? text.length
+    : new TextEncoder().encode(text).length;
+}
+
+/** The one-line summary in the modal's header: what this document IS. */
+export function jsonSummary(text: string): string {
+  const parsed = jsonParse(text);
+  const bytes = jsonByteLength(text);
+  const size = bytes < 1024 ? `${bytes} bytes` : `${(bytes / 1024).toFixed(1)} KB`;
+  if (String(text ?? "").trim() === "") return "Empty";
+  if (!parsed.ok) return `Not valid JSON · ${size}`;
+  const v = parsed.value;
+  if (Array.isArray(v)) return `${v.length} item${v.length === 1 ? "" : "s"} · ${size}`;
+  if (v !== null && typeof v === "object") {
+    const n = Object.keys(v as object).length;
+    return `${n} key${n === 1 ? "" : "s"} · ${size}`;
+  }
+  return `${v === null ? "null" : typeof v} · ${size}`;
+}
+
+// --- the tree ---------------------------------------------------------------
+
+/** How deep a node is open when the viewer mounts. Two levels shows the shape
+ *  of every payload this product actually receives (an object of objects) and
+ *  stops before the leaf spam of a scraped array. */
+const OPEN_TO_DEPTH = 2;
+
+function isBranch(v: unknown): v is Record<string, unknown> | unknown[] {
+  return v !== null && typeof v === "object";
+}
+
+/** The value's own text, in its own ink class. Strings keep their quotes: a
+ *  bare `12` and a `"12"` are different documents and the tree is where that
+ *  difference has to be visible. */
+function Leaf({ v }: { v: unknown }): ReactNode {
+  if (v === null) return <span className="cg-json-null">null</span>;
+  if (typeof v === "string") return <span className="cg-json-str">&quot;{v}&quot;</span>;
+  if (typeof v === "number") return <span className="cg-json-num">{String(v)}</span>;
+  if (typeof v === "boolean") return <span className="cg-json-bool">{String(v)}</span>;
+  return <span className="cg-json-str">{String(v)}</span>;
+}
+
+function Node({
+  name,
+  value,
+  depth,
+  last,
+}: {
+  name: string | null;
+  value: unknown;
+  depth: number;
+  last: boolean;
+}) {
+  const [open, setOpen] = useState(depth < OPEN_TO_DEPTH);
+  if (!isBranch(value))
+    return (
+      <div className="cg-json-row" style={{ paddingLeft: depth * 14 }}>
+        {name !== null && <span className="cg-json-key">{name}</span>}
+        {name !== null && <span className="cg-json-punct">: </span>}
+        <Leaf v={value} />
+        {!last && <span className="cg-json-punct">,</span>}
+      </div>
+    );
+
+  const array = Array.isArray(value);
+  const entries: [string, unknown][] = array
+    ? (value as unknown[]).map((v, i) => [String(i), v])
+    : Object.entries(value as Record<string, unknown>);
+  const openMark = array ? "[" : "{";
+  const closeMark = array ? "]" : "}";
+
+  return (
+    <>
+      <div className="cg-json-row" style={{ paddingLeft: depth * 14 }}>
+        <button
+          type="button"
+          className={"cg-json-twist" + (open ? " is-open" : "")}
+          onClick={() => setOpen((o) => !o)}
+          aria-expanded={open}
+          aria-label={`${open ? "Collapse" : "Expand"} ${name ?? "the document"}`}
+        >
+          <svg viewBox="0 0 16 16" width="10" height="10" aria-hidden>
+            <path
+              d="M6 4l4 4-4 4"
+              fill="none"
+              stroke="currentColor"
+              strokeWidth="1.6"
+              strokeLinecap="round"
+              strokeLinejoin="round"
+            />
+          </svg>
+        </button>
+        {name !== null && <span className="cg-json-key">{name}</span>}
+        {name !== null && <span className="cg-json-punct">: </span>}
+        <span className="cg-json-punct">{openMark}</span>
+        {/* Collapsed, the count IS the content — a bare `{…}` tells a reader
+            nothing about whether opening it is worth the click. */}
+        {!open && (
+          <span className="cg-json-count">
+            {entries.length} {array ? (entries.length === 1 ? "item" : "items")
+              : entries.length === 1 ? "key" : "keys"}
+          </span>
+        )}
+        {!open && <span className="cg-json-punct">{closeMark}{last ? "" : ","}</span>}
+      </div>
+      {open &&
+        entries.map(([k, v], i) => (
+          <Node
+            key={k}
+            name={array ? null : k}
+            value={v}
+            depth={depth + 1}
+            last={i === entries.length - 1}
+          />
+        ))}
+      {open && (
+        <div className="cg-json-row" style={{ paddingLeft: depth * 14 }}>
+          <span className="cg-json-punct">
+            {closeMark}
+            {last ? "" : ","}
+          </span>
+        </div>
+      )}
+    </>
+  );
+}
+
+// --- the modal --------------------------------------------------------------
+
+export interface JsonViewerProps {
+  /** The column's own label — the modal's title. */
+  label: string;
+  /** The stored document, as a string. */
+  value: string;
+  /** Absent = read-only (the field is machine-owned, Odoo-sourced, or this
+   *  viewer permits the reader nothing). Present = the raw tab is an editor. */
+  onSave?: (next: string) => void;
+  onClose: () => void;
+}
+
+export default function JsonViewer({ label, value, onSave, onClose }: JsonViewerProps) {
+  const panelRef = useRef<HTMLDivElement>(null);
+  const titleId = useId();
+  const tabsId = useId();
+  const [tab, setTab] = useState<"tree" | "raw">("tree");
+  const [draft, setDraft] = useState(value);
+  const [error, setError] = useState("");
+  const [copied, setCopied] = useState(false);
+
+  // ⚠ The draft re-seeds when the CELL changes underneath (a machine write
+  // landing while the viewer is open), and only then — keying on `value` alone
+  // would also stamp on every keystroke's re-render if a parent echoed it back.
+  useEffect(() => {
+    setDraft(value);
+    setError("");
+  }, [value]);
+
+  useOverlayLayer({
+    panelRef,
+    onDismiss: onClose,
+    dismissOnOutside: true,
+    initialFocus: "[data-overlay-autofocus]",
+    trapFocus: true,
+  });
+
+  const parsed = useMemo(() => jsonParse(draft), [draft]);
+  const dirty = draft !== value;
+
+  const save = () => {
+    const text = draft.trim();
+    // Blank is a legal edit: it clears the cell, which is how a document is
+    // removed. Everything else must parse before it is allowed to leave here.
+    if (text !== "") {
+      if (!jsonParse(text).ok) {
+        setError("That is not valid JSON — nothing was saved. Check for a trailing comma, a "
+          + "single quote, or an unquoted key.");
+        return;
+      }
+      const bytes = jsonByteLength(text);
+      if (bytes > MAX_JSON_BYTES) {
+        setError(`That document is ${(bytes / 1024).toFixed(1)} KB and the limit is 32 KB — `
+          + "nothing was saved.");
+        return;
+      }
+    }
+    setError("");
+    onSave?.(text);
+    onClose();
+  };
+
+  const copy = () => {
+    void navigator.clipboard?.writeText(draft).then(
+      () => {
+        setCopied(true);
+        window.setTimeout(() => setCopied(false), 1400);
+      },
+      () => setError("The browser refused clipboard access — select the raw text and copy it.")
+    );
+  };
+
+  return (
+    <BodyPortal>
+      <div className="cg-record-backdrop">
+        <div
+          className="cg-json-modal"
+          ref={panelRef}
+          role="dialog"
+          aria-modal="true"
+          aria-labelledby={titleId}
+          data-overlay-kind="json-viewer"
+          tabIndex={-1}
+        >
+          <div className="cg-json-head">
+            <div>
+              <div className="cg-json-title" id={titleId}>{label}</div>
+              {/* The summary is the ONE explanatory line (DESIGN.md §4): what
+                  this document is, not what a JSON field is for. */}
+              <div className="cg-json-sub">{jsonSummary(draft)}</div>
+            </div>
+            <div className="cg-json-headacts">
+              <button type="button" className="cg-json-btn" onClick={copy}>
+                {copied ? "Copied" : "Copy"}
+              </button>
+              <button
+                type="button"
+                className="cg-icon-btn"
+                onClick={onClose}
+                aria-label="Close viewer"
+              >
+                ×
+              </button>
+            </div>
+          </div>
+
+          <div className="cg-record-tabs" role="tablist" aria-label="Document view">
+            {(["tree", "raw"] as const).map((k) => (
+              <button
+                key={k}
+                type="button"
+                role="tab"
+                id={`${tabsId}-${k}`}
+                aria-selected={tab === k}
+                aria-controls={`${tabsId}-panel`}
+                className={"cg-record-tab" + (tab === k ? " is-on" : "")}
+                onClick={() => setTab(k)}
+                data-overlay-autofocus={k === "tree" ? true : undefined}
+              >
+                {k === "tree" ? "Tree" : "Raw"}
+              </button>
+            ))}
+          </div>
+
+          <div
+            className="cg-json-body"
+            id={`${tabsId}-panel`}
+            role="tabpanel"
+            aria-labelledby={`${tabsId}-${tab}`}
+          >
+            {tab === "tree" ? (
+              parsed.ok ? (
+                <div className="cg-json-tree">
+                  <Node name={null} value={parsed.value} depth={0} last />
+                </div>
+              ) : (
+                // ⛔ NOT an empty tree and NOT a repaired one. A document the app
+                // cannot open is a fact about the value, and the raw tab is where
+                // it gets read — so the empty state POINTS THERE rather than
+                // describing what JSON is.
+                <p className="cg-json-empty">
+                  {draft.trim() === ""
+                    ? "Nothing here yet."
+                    : "This value is not valid JSON — read it on the Raw tab."}
+                </p>
+              )
+            ) : onSave ? (
+              <textarea
+                className="cg-json-raw"
+                value={draft}
+                spellCheck={false}
+                onChange={(e) => {
+                  setDraft(e.target.value);
+                  if (error) setError("");
+                }}
+                aria-label={`${label} raw JSON`}
+              />
+            ) : (
+              <pre className="cg-json-raw cg-json-raw--ro">{jsonPretty(draft)}</pre>
+            )}
+          </div>
+
+          {(error || (onSave && dirty)) && (
+            <div className="cg-json-foot">
+              {error ? (
+                <span className="cg-json-err">{error}</span>
+              ) : (
+                <span className="cg-json-hint">Unsaved changes</span>
+              )}
+              {onSave && (
+                <span className="cg-json-footacts">
+                  <button
+                    type="button"
+                    className="cg-json-btn"
+                    onClick={() => {
+                      setDraft(value);
+                      setError("");
+                    }}
+                  >
+                    Revert
+                  </button>
+                  <button type="button" className="cg-json-btn cg-json-btn--primary" onClick={save}>
+                    Save
+                  </button>
+                </span>
+              )}
+            </div>
+          )}
+        </div>
+      </div>
+    </BodyPortal>
+  );
+}

web/src/customer-grid/RecordDetail.css

@@ -146,6 +146,25 @@
   line-height: 1.45;
 }
 
+/* ⭐ Wave-23 C8 (owner item 4 / ruling R9) — a MACHINE-OWNED field's value slot.
+
+   `--lp-machine-tint` is EXACTLY what the canvas wash (`theme.MACHINE_CELL`,
+   `washOf(LP_MACHINE_DEEP, 0.12)`) composites to over white, so the drawer slot
+   and the grid cell are one grey rather than two that were each picked to look
+   right on their own — the sibling-panel rule (DESIGN.md §2) applied across two
+   rendering technologies instead of two panes.
+
+   THE VALUE KEEPS ITS INK, deliberately, on both surfaces. The wash is the whole
+   signal; dimming the number as well would say the figure matters less, and an
+   automation-written follower count is the entire reason its column exists.
+
+   Background only — no border change, no second marker. The column menu already
+   says "Filled by automation" once, and DESIGN.md §4 is that the app does not
+   narrate itself twice. */
+.cg-record-main .cg-detail-field.is-machine .cg-detail-value {
+  background: var(--lp-machine-tint);
+}
+
 /* A rating's marks are 18px inline SVG; on the text baseline they hang their
    descender space below the line box and grow the slot past every neighbour. */
 .cg-record-main .cg-detail-value .cg-stars {
@@ -451,6 +470,33 @@
   font-size: var(--lp-fs-2xs);
 }
 
+/* ⭐ Wave-23 C7 (owner item 5) — a `json` field's row: the same compact preview the grid cell
+   paints, plus the door to the viewer. Reuses `.cg-detail-imagebtn` rather than minting a
+   second quiet-button shape (DESIGN.md §4) — the two rows are doing the same job, showing a
+   value too big for a slot and offering the surface that owns it. */
+.cg-record-main .cg-detail-jsonslot {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+}
+
+/* ⚠ `min-width: 0` is what lets the ellipsis happen at all: a flex item's default
+   `min-width: auto` refuses to shrink below its content, so the preview would push the Open
+   button out of the panel instead of truncating. Monospace because the preview is a fragment
+   of a document — `{handle: "royalimports"}` reads as code, and setting it in Inter beside the
+   viewer's monospace tree would make one value look like two different things. */
+.cg-record-main .cg-detail-jsonpreview {
+  flex: 1 1 auto;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: var(--lp-fs-2xs);
+  color: var(--lp-ink);
+}
+
 /* Rating: the stars ARE the picker. Clicking the lit star clears the value —
    without it a rating could be changed here but never removed. */
 .cg-record-main .cg-detail-stars {

web/src/customer-grid/RecordDetail.tsx

@@ -7,9 +7,11 @@ import {
   automationStateLabel,
   checkboxOn,
   formatDisplay,
+  jsonPreview,
 } from "./cells";
+import JsonViewer from "./JsonViewer";
 import { StarRow, StarIcon } from "./Stars";
-import { isPickType, mayEditField, ratingMax } from "./types";
+import { isMachineOwned, isPickType, mayEditField, ratingMax } from "./types";
 import type { CustomerDoc, DisplaySpec, Field, Row, Viewer } from "./types";
 // Item 9 (wave 14) — the pure value round-trip. Everything that could silently
 // LOSE a stored value moving it into an editor and back lives there, gated by
@@ -269,6 +271,10 @@ export default function RecordDetail({
   // reachable second case.
   const [imageBusy, setImageBusy] = useState("");
   const [imageError, setImageError] = useState("");
+  /** ⭐ Wave-23 C7 — which json field's viewer is open, by KEY. One at a time for the same
+   *  reason `imageBusy` is one pair: a record has a handful of document columns and only one
+   *  modal can be on screen. */
+  const [jsonKey, setJsonKey] = useState<string | null>(null);
   const overlayFields = fields.filter((field) => field.source === "overlay");
   // ⚠ These five buckets are the DEFAULT ORDER of the interleaved list (C-LAYOUT) and NOTHING
   // ELSE. They used to double as the editability split — picked/rating fields rendered
@@ -475,12 +481,24 @@ export default function RecordDetail({
       // somebody to type `rec:` by hand at a picture that does not exist. Its slot is a
       // thumbnail plus an upload control, so it joins the constrained-control family.
       field.type !== "image" &&
+      // ⭐ Wave-23 C7 — a `json` value is NEVER edited through a free textarea, here or in the
+      // grid. `AutoTextarea` commits on blur straight through `onNotesCommit`, so this branch
+      // would be a door that saves an unparseable document with no check at all — the exact
+      // thing the viewer's parse-on-save exists to prevent, sitting one panel away from it.
+      // It joins the constrained-control family: preview + "Open", and the viewer owns the edit.
+      field.type !== "json" &&
       field.type !== "pct";
     const isControl = editable && !isEdit;
     const cls =
       "cg-detail-field" +
       (isEdit ? " cg-detail-field--edit" : "") +
       (isControl ? " cg-detail-field--control" : "") +
+      // ⭐ Wave-23 C8 (R9) — the SAME claim the grid cell makes, on the DOM side. A machine-owned
+      // column is grey in the table; opening the record must not present the identical value in
+      // an ordinary editable-looking slot, because the drawer is where somebody would try to type
+      // in it. `RecordDetail.css` paints the pair (`--lp-machine-tint` background, the measured
+      // `--lp-machine-deep` ink) at the value slot, not the row, so the label keeps its rhythm.
+      (isMachineOwned(field) ? " is-machine" : "") +
       (dropKey === field.key ? " is-dropzone" : "") +
       (dragKey === field.key ? " is-dragging" : "");
 
@@ -802,6 +820,28 @@ export default function RecordDetail({
           <StarRow value={ratingValue(field, record[field.key])} max={ratingMax(field)} />
         </span>
       );
+    } else if (field.type === "json") {
+      // ⭐ Wave-23 C7 — the drawer shows the same compact preview the grid cell does and hands
+      // the document to the SAME viewer, because two readers of one document that fold it
+      // differently is a disagreement nobody can see in either one alone. The button is the
+      // whole affordance: a `<pre>` of 32 KB inside a field row would push every column below
+      // it off the panel.
+      const raw = rawText(record[field.key]);
+      slot = (
+        <span className="cg-detail-value cg-detail-jsonslot">
+          <span className="cg-detail-jsonpreview">{jsonPreview(raw) || "—"}</span>
+          <button
+            type="button"
+            className="cg-detail-imagebtn"
+            onClick={() => setJsonKey(field.key)}
+          >
+            {/* "Open" for a reader, "Open" for an editor — the viewer decides what it offers
+                once it is open, and a button that says "Edit" to somebody who then cannot would
+                be the painted-but-inert control the standing rule is about. */}
+            Open
+          </button>
+        </span>
+      );
     } else if (field.type === "automation") {
       // C5-AUTOFIELD (wave 18). It has to be its OWN branch and not the read-only fallback
       // below, because that branch explains read-only-ness as a PERMISSION ("You do not have
@@ -1042,6 +1082,25 @@ export default function RecordDetail({
           </div>
         </div>
       </div>
+      {/* ⭐ Wave-23 C7 — the document viewer, INSIDE this portal and therefore stacked above
+          this modal. `useOverlayLayer`'s stack is what makes that work: it registers on top, so
+          Escape closes the viewer and leaves the record open rather than dismissing both. */}
+      {jsonKey && (() => {
+        const field = fields.find((f) => f.key === jsonKey);
+        if (!field) return null;
+        return (
+          <JsonViewer
+            label={field.label}
+            value={rawText(record[field.key])}
+            onSave={
+              mayEditField(field, viewer)
+                ? (next) => onNotesCommit(field.key, next)
+                : undefined
+            }
+            onClose={() => setJsonKey(null)}
+          />
+        );
+      })()}
     </BodyPortal>
   );
 }

web/src/customer-grid/cells.ts

@@ -34,7 +34,7 @@ import type {
 } from "@glideapps/glide-data-grid";
 import { assetUrl } from "./catalogData";
 import type { Field } from "./types";
-import { ratingMax } from "./types";
+import { isMachineOwned, ratingMax } from "./types";
 import {
   LP_BLUE_TEXT,
   LP_BLUE_TINT,
@@ -44,6 +44,7 @@ import {
   LP_RED_TINT,
   LP_YELLOW_DEEP,
   LP_YELLOW_TINT,
+  machineCellTheme,
   STATUS_BUBBLE,
 } from "./theme";
 // ⚠ ALIASED: this module has its own `pickTint` (the bubble table above) and choiceColors has
@@ -51,7 +52,7 @@ import {
 // distinguishable at the call site rather than one silently shadowing the other.
 import { optionTint, pickTint as choicePickTint } from "./choiceColors";
 import { automationState, avatarInitials, avatarSize, checkboxOn, dateTimeText, formulaIsBlank,
-  formulaIsText, num, numberText, userCellPayload } from "./display";
+  formulaIsText, jsonPreview, num, numberText, userCellPayload } from "./display";
 import type { AutomationState, CellValue, UserCellData } from "./display";
 
 // Wave-7 (item W2): the pure display-string half moved to display.ts so the
@@ -66,6 +67,9 @@ export type { UserCellData } from "./display";
 // gate can hold it); only the canvas tint table below needs this module.
 export { automationDetail, automationState, automationStateLabel } from "./display";
 export type { AutomationState } from "./display";
+// Wave-23 C7 — same arrangement again: the parse, the preview and the pretty-printer are pure
+// (`verify_grid_ux` drives them under node); only the canvas cell below needs this module.
+export { jsonParse, jsonPretty, jsonPreview, MAX_JSON_BYTES } from "./display";
 
 /**
  * Wave-18 C5-AUTOFIELD — the cell tint per automation state.
@@ -393,6 +397,37 @@ export function makeCell(
   /** C-AVATAR — username → data URL, straight off `GridWorkspace.userAvatars`. Absent, or a
    *  username absent from it, paints the initials fallback. */
   userAvatars?: Record<string, string>
+): GridCell {
+  const cell = baseCell(field, v, editable, userAvatars);
+  return isMachineOwned(field) ? withMachineWash(cell) : cell;
+}
+
+/**
+ * ⭐ Wave-23 C8 (owner item 4 / R9) — the grey wash on a MACHINE-OWNED cell.
+ *
+ * A per-CELL override rather than a per-column one (`useGridColumns.columnTheme`), following the
+ * `AUTOMATION_TINT` precedent directly below: the column path returns one of three SHARED
+ * `COLUMN_TONE_THEME` references, so forking it per column would both break that sharing and put
+ * the wash on the HEADER, which R9 does not ask for — an involved column's filter/sort/group tone
+ * keeps winning its header.
+ *
+ * The PRECEDENCE (state tint over wash, bubble tint alongside it) is `theme.machineCellTheme` —
+ * it lives there because this module imports glide and therefore cannot be driven by a gate,
+ * and precedence is the half of this that can be silently wrong. Same split as `display.ts`.
+ *
+ * ⚠ Re-built rather than mutated: glide declares every cell key `readonly`, and `baseCell`
+ * returns a fresh literal on every branch anyway. The `as GridCell` is the union-spread widening,
+ * not a claim about the shape — the object is byte-identical to the branch's own plus one key.
+ */
+function withMachineWash(cell: GridCell): GridCell {
+  return { ...cell, themeOverride: machineCellTheme(cell.themeOverride) } as GridCell;
+}
+
+function baseCell(
+  field: Field,
+  v: CellValue,
+  editable: boolean,
+  userAvatars?: Record<string, string>
 ): GridCell {
   const ro = { allowOverlay: editable, readonly: !editable };
   const blank = v == null || v === "";
@@ -508,6 +543,33 @@ export function makeCell(
         allowOverlay: false,
       };
     }
+    case "json": {
+      // ⭐ Wave-23 C7 (owner item 5) — the compact preview; the DOCUMENT lives in the viewer.
+      //
+      // `allowOverlay: false` for the same reason `select` and `image` carry it: glide's text
+      // overlay is a one-line box, and a one-line box over a 32 KB document is an editor that
+      // can only damage the value — one keystroke in the wrong place and a well-formed payload
+      // becomes unparseable, saved. CustomerGrid opens the viewer on click instead (the same
+      // `onCellClicked` path the pickers use), and THAT is where the raw text is editable, with
+      // parse-on-save.
+      //
+      // ⚠ `readonly` is NOT set, and the difference matters: `allowOverlay:false` means "no
+      // inline editor", while `readonly` would tell glide the CELL cannot change — which would
+      // also block the paste path that legitimately writes a whole document into it.
+      //
+      // ⚠ `copyData` carries the RAW document, never the preview (the lesson the image cell
+      // booked in wave 19). Copy a json column and you get the payload; copy the preview and
+      // you get the sentence "{…} 5 keys", which is not data and cannot be pasted back.
+      const raw = String(v ?? "");
+      const text = jsonPreview(raw);
+      return {
+        kind: GridCellKind.Text,
+        data: text,
+        displayData: text,
+        copyData: raw,
+        allowOverlay: false,
+      };
+    }
     case "rating": {
       const max = ratingMax(field);
       const n = Math.max(0, Math.min(max, Math.round(num(v))));

web/src/customer-grid/display.ts

@@ -228,6 +228,92 @@ export function automationStateLabel(v: CellValue): string {
   return s === "none" ? "Not run yet" : s[0].toUpperCase() + s.slice(1);
 }
 
+/**
+ * ⭐ Wave-23 C7 (owner item 5) — THE JSON PREVIEW: what a 200px cell says about a document.
+ *
+ * `MAX_JSON_BYTES` is the contract's ceiling, mirrored from the host's write validation so the
+ * viewer can refuse a paste with the same number the server would (a client that lets you type
+ * 40 KB and then shows you a server refusal has wasted the edit).
+ *
+ * The four cases, and each one is a decision rather than a formatting preference:
+ *   · **a single-pair object shows THE PAIR.** `{handle: "royalimports"}` is more useful than
+ *     "1 key" and it is the shape most machine writes actually have. Past one pair the pairs
+ *     stop fitting and the honest answer is the count.
+ *   · **many keys / many items → `{…} N keys` / `[…] N items`.** Showing the FIRST pair of a
+ *     twelve-key object would let a reader take one arbitrary value — whichever key the writer's
+ *     serializer happened to emit first — for the cell's content.
+ *   · **a bare scalar renders as itself.** `12`, `"ok"`, `true` and `null` are all valid JSON
+ *     documents, and wrapping them in braces would describe a shape they do not have.
+ *   · ⛔ **text that does not parse renders AS ITSELF, never as a shape.** The host validates on
+ *     write, so this only happens to a value that predates the validation or arrived another
+ *     way — and the one thing the preview must never do is claim a document is well-formed. The
+ *     viewer's raw tab is where such a value gets read and repaired.
+ *
+ * Blank stays blank: an empty json cell is a document nobody has written, and `{}` is a document
+ * somebody wrote that is empty. Two different facts, two different cells.
+ */
+export const MAX_JSON_BYTES = 32 * 1024;
+
+/** Does this text parse as JSON? The ONE test, shared by the preview, the cell and the viewer's
+ *  save — three copies of a try/catch is how they end up disagreeing about `""` or `NaN`. */
+export function jsonParse(v: CellValue): { ok: boolean; value?: unknown } {
+  const s = String(v ?? "").trim();
+  if (s === "") return { ok: false };
+  try {
+    return { ok: true, value: JSON.parse(s) as unknown };
+  } catch {
+    return { ok: false };
+  }
+}
+
+/** One compact line for a json cell. See the note above for why each case reads as it does. */
+export function jsonPreview(v: CellValue): string {
+  const raw = String(v ?? "").trim();
+  if (raw === "") return "";
+  const parsed = jsonParse(raw);
+  // ⚠ First line only, and clipped: an unparseable value is often a whole pasted response, and
+  // a cell is not where a 4 KB blob gets read. It is shown rather than hidden because the
+  // reader has to be able to see that the column holds something the app could not open.
+  if (!parsed.ok) return clip(raw.split("\n")[0], 60);
+  const value = parsed.value;
+  if (Array.isArray(value))
+    return value.length === 0 ? "[]" : `[…] ${value.length} item${value.length === 1 ? "" : "s"}`;
+  if (value !== null && typeof value === "object") {
+    const keys = Object.keys(value as Record<string, unknown>);
+    if (keys.length === 0) return "{}";
+    if (keys.length === 1)
+      return clip(`{${keys[0]}: ${scalarText((value as Record<string, unknown>)[keys[0]])}}`, 60);
+    return `{…} ${keys.length} keys`;
+  }
+  return clip(scalarText(value), 60);
+}
+
+/** A nested value, small enough to sit inside a one-pair preview. Objects and arrays collapse
+ *  to their own marks rather than recursing — a preview that unfolds is not a preview. */
+function scalarText(v: unknown): string {
+  if (v === null) return "null";
+  if (Array.isArray(v)) return `[…] ${v.length}`;
+  if (typeof v === "object") return `{…} ${Object.keys(v as object).length}`;
+  return typeof v === "string" ? v : String(v);
+}
+
+/** ⚠ An ellipsis CHARACTER, not three dots: the grid's canvas measures text and three periods
+ *  are three glyphs wide. Same mark the group-bar fitter uses. */
+function clip(s: string, n: number): string {
+  return s.length <= n ? s : s.slice(0, n - 1) + "…";
+}
+
+/**
+ * The document, indented for the viewer's pretty tab. Returns the RAW TEXT UNCHANGED when it
+ * does not parse — re-indenting is not repair, and handing a reader a "prettified" version of
+ * something the app could not read would hide the only thing they need to see.
+ */
+export function jsonPretty(v: CellValue): string {
+  const raw = String(v ?? "");
+  const parsed = jsonParse(raw);
+  return parsed.ok ? JSON.stringify(parsed.value, null, 2) : raw;
+}
+
 export function formatDisplay(field: Field, v: CellValue): string {
   switch (field.type) {
     case "currency":
@@ -261,6 +347,12 @@ export function formatDisplay(field: Field, v: CellValue): string {
       const n = num(v);
       return n >= 1 ? `${Math.round(n)} of ${ratingMax(field)}` : "";
     }
+    case "json":
+      // Wave-23 C7 — the SAME compact line the canvas cell paints. Explicit here rather than
+      // left to `default` for the reason the `formula` note above records: this function feeds
+      // ListView, KanbanView, the calendar, the record panel and all four EXPORT formats, and
+      // falling through would dump a whole 32 KB document into a CSV cell.
+      return jsonPreview(v);
     case "automation":
       // The machine-written line, verbatim. Explicit rather than left to the `default` branch
       // below: `formula` fell through a default once and printed every text result as `0` for

web/src/customer-grid/iconShapes.ts

@@ -1,489 +1,524 @@
-// ---------------------------------------------------------------------------
-// customer-grid / iconShapes.ts
-// Wave-8 items I18 + I20 — ONE geometry source for the grid's icon vocabulary,
-// rendered by TWO very different painters:
-//
-//   - React  <FieldTypeIcon> / <ModeIcon>  — DOM svg in panels, popovers, menus
-//   - glide  headerIcons sprites           — canvas, drawn from an SVG *string*
-//
-// Glide's sprite API takes a function returning SVG SOURCE, so a header icon can
-// never be a React component. Keeping the paths as DATA (IconShape[]) and giving
-// each painter its own thin renderer is what stops the two from drifting — the
-// alternative (hand-copying every path into a template literal) guarantees the
-// header and the panel eventually disagree about what a "date" looks like.
-//
-// Geometry rules: 16x16 viewBox, stroke-based, 1.35 stroke, round caps/joins,
-// currentColor. Vector paths only — NEVER emoji (owner constant).
-// ---------------------------------------------------------------------------
-
-import type { DisplayMode, FieldType, FolderShape, FolderTone } from "./types";
-import {
-  LP_BLUE,
-  LP_BLUE_DEEP,
-  LP_GREEN,
-  LP_GREEN_DEEP,
-  LP_LINE,
-  LP_MUTED,
-  LP_RED,
-  LP_RED_DEEP,
-  LP_YELLOW,
-  LP_YELLOW_DEEP,
-} from "./theme";
-
-/** One drawing primitive. `fill: true` fills the path instead of stroking it
- *  (the rating star is the only shape that reads better solid). */
-export type IconShape = { d: string; fill?: boolean };
-
-/** A circle as a path — two half-arcs. Sprites are SVG *source*, so every shape
- *  has to survive being serialized into a string; paths do, <circle> elements
- *  would need a second serializer branch for no benefit. */
-const circle = (cx: number, cy: number, r: number): string =>
-  `M${cx - r} ${cy}a${r} ${r} 0 1 0 ${r * 2} 0a${r} ${r} 0 1 0 ${-r * 2} 0`;
-
-const CALENDAR: IconShape[] = [
-  { d: "M3.2 4.6h9.6v8.2H3.2z" },
-  { d: "M3.2 7.2h9.6" },
-  { d: "M5.8 3v3.2" },
-  { d: "M10.2 3v3.2" },
-];
-
-/**
- * Field type → icon geometry. A TOTAL record on purpose: adding a FieldType
- * without an icon is a compile error, not a silently blank header.
- */
-export const TYPE_SHAPES: Record<FieldType, IconShape[]> = {
-  text: [{ d: "M3 5h10M3 8h10M3 11h6" }],
-  status: [{ d: "M4 13V3.5h7.6L10.1 6l1.5 2.5H4" }],
-  currency: [
-    { d: "M8 2.8v10.4" },
-    { d: "M10.6 5.4A2.6 2.6 0 0 0 8.2 4.2H7.4a2 2 0 0 0 0 4h1.2a2 2 0 0 1 0 4H7.8a2.6 2.6 0 0 1-2.4-1.4" },
-  ],
-  int: [{ d: "M6.2 3L4.8 13M11.2 3l-1.4 10M3.4 6.2h9.2M2.9 9.8h9.2" }],
-  date: CALENDAR,
-  pct: [
-    { d: circle(4.6, 4.6, 1.6) },
-    { d: circle(11.4, 11.4, 1.6) },
-    { d: "M12.2 3.9L3.8 12.3" },
-  ],
-  select: [{ d: "M3.2 3.8h9.6v8.4H3.2z" }, { d: "M6.2 7.2l1.8 1.8 1.8-1.8" }],
-  user: [
-    { d: circle(8, 6, 2.4) },
-    { d: "M3.6 13c0-2.4 2-3.8 4.4-3.8s4.4 1.4 4.4 3.8" },
-  ],
-  multiselect: [
-    { d: "M3 4.6h2.2v2.2H3zM3 9.2h2.2v2.2H3z" },
-    { d: "M7.2 5.7h6M7.2 10.3h6" },
-  ],
-  checkbox: [{ d: "M3.4 3.4h9.2v9.2H3.4z" }, { d: "M5.8 8.1l1.8 1.9 3.4-3.9" }],
-  phone: [
-    { d: "M5.1 3.2L7 5.1 5.6 7a7.2 7.2 0 0 0 3.4 3.4l1.9-1.4 1.9 1.9-1.5 1.6c-3 .5-8.3-4.8-7.8-7.8z" },
-  ],
-  email: [{ d: "M3 4.4h10v7.2H3z" }, { d: "M3 4.9l5 3.9 5-3.9" }],
-  url: [
-    { d: "M7 5.4L8.4 4a2.6 2.6 0 0 1 3.7 3.7L10.7 9" },
-    { d: "M9 10.6L7.6 12a2.6 2.6 0 0 1-3.7-3.7L5.3 7" },
-    { d: "M6.2 9.8l3.6-3.6" },
-  ],
-  rating: [
-    {
-      d: "M8 2.9l1.63 3.3 3.64.53-2.63 2.57.62 3.63L8 11.24 4.74 12.93l.62-3.63L2.73 6.73l3.64-.53z",
-      fill: true,
-    },
-  ],
-  created_time: [{ d: circle(8, 8, 5.2) }, { d: "M8 4.9v3.4l2.3 1.4" }],
-  formula: [
-    { d: "M5.6 12.8V5.4a2 2 0 0 1 3.2-1.6" },
-    { d: "M4.2 7.6h4.6" },
-    { d: "M10.2 8.4l3 3.4M13.2 8.4l-3 3.4" },
-  ],
-  // Wave-18 C5-AUTOFIELD (D's spec, applied by C as client-vocab registrar). A 290° cycle ring
-  // with an arrowhead, wrapped around a solid run-triangle: a job that runs, repeatedly.
-  // Deliberately NOT a bolt (`FOLDER_SHAPE_PATHS.bolt` already means "Priority") and not a clock
-  // (`created_time` owns the closed rim + hands).
-  automation: [
-    { d: "M10.8 4.1A4.8 4.8 0 1 1 5.3 4.1" },
-    { d: "M4.2 6L5.3 4.1 3.1 4.5" },
-    { d: "M6.9 6.1L9.8 8 6.9 9.9z", fill: true },
-  ],
-  // Wave-22 C7 (added by C as client-vocab registrar, the W18 automation precedent). A rising
-  // series on an axis: a measure OVER TIME, which is what a metric field is. Deliberately not
-  // the formula fx (that computes over the ROW) and not a bare number (int owns ##).
-  metric: [
-    { d: "M3.2 3.2v9.6h9.6" },
-    { d: "M5 10.4l2.4-2.6 1.9 1.5 3.1-3.9" },
-  ],
-  // Wave-19 R7 — a framed picture: the mount, a sun, and the hill line every photo glyph
-  // resolves to at 16px. Drawn on the same 16-unit grid as its neighbours.
-  image: [
-    { d: "M2.6 3.4h10.8v9.2H2.6z" },
-    { d: circle(6, 6.3, 1.1) },
-    { d: "M2.6 10.6L6.1 7.6l2.5 2.1 2.2-1.8 2.6 2.2" },
-  ],
-};
-
-/**
- * Display mode → icon geometry (I18). Also total: the wave-8 Dashboard mode
- * cannot land in DISPLAY_MODES without the compiler demanding its icon here.
- */
-export const MODE_SHAPES: Record<DisplayMode, IconShape[]> = {
-  grid: [
-    { d: "M2.6 3.4h10.8v9.2H2.6z" },
-    { d: "M2.6 6.5h10.8M2.6 9.5h10.8M6.4 3.4v9.2M10 3.4v9.2" },
-  ],
-  list: [{ d: "M3 4.6h1.4M6.4 4.6h6.6M3 8h1.4M6.4 8h6.6M3 11.4h1.4M6.4 11.4h6.6" }],
-  // I19c — a framed set of bars: "several charts", not "one chart".
-  chart: [
-    { d: "M2.6 3.4h10.8v9.2H2.6z" },
-    { d: "M5.4 10.6V7.2M8 10.6V5.4M10.6 10.6V8.6" },
-  ],
-  // I10 (C2) — the LEGACY key. Kept so this record stays total over DisplayMode, which is
-  // what makes "accept 'dashboard' on read forever" a compile-time guarantee rather than a
-  // promise. Same drawing: a stored 'dashboard' IS a chart.
-  dashboard: [
-    { d: "M2.6 3.4h10.8v9.2H2.6z" },
-    { d: "M5.4 10.6V7.2M8 10.6V5.4M10.6 10.6V8.6" },
-  ],
-  calendar: CALENDAR,
-  kanban: [{ d: "M2.8 3.4h3.1v9.2H2.8zM6.5 3.4h3.1v6.2H6.5zM10.2 3.4h3.1v7.6h-3.1z" }],
-  map: [
-    { d: "M8 2.6a3.6 3.6 0 0 1 3.6 3.6c0 2.7-3.6 7.2-3.6 7.2S4.4 8.9 4.4 6.2A3.6 3.6 0 0 1 8 2.6z" },
-    { d: circle(8, 6.1, 1.3) },
-  ],
-  // 2026-08-02 item 7 — the time-series view. Drawn as a framed grid with a trend running
-  // through it, because that is literally what the panel is: metric ROWS x bucket COLUMNS with
-  // a per-row line toggle. Deliberately not the plain `line` chart mark — a chart view and a
-  // time-series table must not be the same picture in the same rail.
-  timeseries: [
-    { d: "M2.6 3.4h10.8v9.2H2.6z" },
-    { d: "M2.6 6.6h10.8M6.2 3.4v9.2" },
-    { d: "M7.2 10.8l2-2.4 1.6 1.2 1.8-2.6" },
-  ],
-  // Wave-18 C6-CATALOG — an OPEN BOOK: two facing leaves with a spine between them, and a
-  // product block sitting on the left one. Every other mode in this table draws a way of
-  // arranging RECORDS; this one has to read as a printed artifact, so it is the only mark here
-  // with a spine and a gutter. Deliberately not a page-with-lines (`list` owns that reading) and
-  // not a framed grid (`grid`/`chart`/`timeseries` share the frame).
-  catalog: [
-    { d: "M2.4 4.2h4.6a1.6 1.6 0 0 1 1 .4l0 8a1.6 1.6 0 0 0-1-.4H2.4z" },
-    { d: "M13.6 4.2H9a1.6 1.6 0 0 0-1 .4l0 8a1.6 1.6 0 0 1 1-.4h4.6z" },
-    { d: "M3.9 6.4h2.3v2.8H3.9z" },
-  ],
-};
-
-/**
- * Wave-9 I16 — one mark per CHART KIND. Total over `ChartKind`, so a kind added to C2's
- * vocabulary cannot ship without a drawing.
- *
- * ⚠ The owner asked for an icon on every chart-type option, and the wave-8 ruling stands:
- * an `<option>` cannot render SVG and unicode glyphs are gate-banned, so the chart-type
- * picker is NOT a native `<select>` — it is a radio-row list like the mode switcher, which
- * is the only shape that can carry a real mark.
- *
- * The key type is a string union declared here rather than imported from chartData.ts: this
- * module is a leaf (types + theme only) and chartData imports IT, not the reverse.
- */
-export type ChartKindKey = "bar" | "line" | "area" | "donut" | "kpi" | "table";
-export const CHART_KIND_SHAPES: Record<ChartKindKey, IconShape[]> = {
-  bar: [{ d: "M3.2 12.8V7.4M6.4 12.8V4.2M9.6 12.8V8.8M12.8 12.8V5.8" }],
-  line: [
-    { d: "M2.6 11.2l3.2-3.4 2.6 2 4.9-5.2" },
-    { d: circle(5.8, 7.8, 0.9) },
-    { d: circle(8.4, 9.8, 0.9) },
-  ],
-  area: [
-    { d: "M2.6 12.4V9.2l3.2-3.2 2.6 2 4.9-4.6v9z" },
-    { d: "M2.6 9.2l3.2-3.2 2.6 2 4.9-4.6" },
-  ],
-  donut: [{ d: circle(8, 8, 5) }, { d: circle(8, 8, 2.1) }],
-  // A single big number: the KPI card. Drawn as a framed value rather than a glyph, so it
-  // reads as "one number" beside four marks that all read as "a distribution".
-  kpi: [{ d: "M2.6 3.8h10.8v8.4H2.6z" }, { d: "M5.4 9.6V6.4l1.9 3.2V6.4M9.4 6.4v3.2h1.8" }],
-  // Wave-16 C-CHARTCAP: a group-by aggregate table. Framed like the KPI (it is a card of
-  // values, not a distribution), with a header band and a column rule.
-  table: [
-    { d: "M2.6 3.4h10.8v9.2H2.6z" },
-    { d: "M2.6 6.2h10.8M7.2 6.2v6.4M2.6 9.4h10.8" },
-  ],
-};
-
-export const CHART_KIND_LABELS: Record<ChartKindKey, string> = {
-  bar: "Bar",
-  line: "Line",
-  area: "Area",
-  donut: "Donut",
-  kpi: "Single value",
-  table: "Table",
-};
-
-/** I16 — the pastel each chart kind wears, same family rule as MODE_TONE. */
-export const CHART_KIND_TONE: Record<ChartKindKey, FolderTone> = {
-  bar: "blue",
-  line: "green",
-  area: "green",
-  donut: "yellow",
-  kpi: "neutral",
-  table: "neutral",
-};
-
-/**
- * Wave-9 contract C5 (I15) — folder icon geometry. TOTAL over `FolderShape`, so a shape key
- * added to the wire contract in types.ts cannot ship without a drawing.
- *
- * Same 16x16 stroke vocabulary as everything above: these have to sit beside a mode icon in
- * the same rail and read as one family. `folder` is first because it is the default every
- * pre-wave-9 folder falls back to (I14: "existing folders get the folder icon").
- */
-export const FOLDER_SHAPE_PATHS: Record<FolderShape, IconShape[]> = {
-  folder: [{ d: "M2.4 12.6V4.2a.6.6 0 0 1 .6-.6h3.2l1.5 1.7h5.3a.6.6 0 0 1 .6.6v6.7a.6.6 0 0 1-.6.6H3a.6.6 0 0 1-.6-.6z" }],
-  star: [
-    { d: "M8 2.9l1.63 3.3 3.64.53-2.63 2.57.62 3.63L8 11.24 4.74 12.93l.62-3.63L2.73 6.73l3.64-.53z" },
-  ],
-  flag: [
-    { d: "M4.2 13.4V2.9" },
-    { d: "M4.2 3.4h7.6l-1.5 2.6 1.5 2.6H4.2z" },
-  ],
-  tag: [
-    { d: "M2.9 8.2V3.5a.6.6 0 0 1 .6-.6h4.7l5 5-5.3 5.3z" },
-    { d: circle(5.6, 5.6, 1) },
-  ],
-  bookmark: [{ d: "M4.4 2.9h7.2v10.4L8 10.7l-3.6 2.6z" }],
-  // Four of the host's shapes ALREADY exist in this file as a mode or a field-type mark.
-  // Reusing the geometry rather than drawing a second "chart" is the whole point of the
-  // one-source rule: a folder labelled Chart and the Chart view must not be two pictures.
-  grid: MODE_SHAPES.grid,
-  chart: MODE_SHAPES.dashboard,
-  map: MODE_SHAPES.map,
-  users: TYPE_SHAPES.user,
-  clock: TYPE_SHAPES.created_time,
-  heart: [{ d: "M8 13.1S2.7 9.8 2.7 6.4a2.9 2.9 0 0 1 5.3-1.6 2.9 2.9 0 0 1 5.3 1.6c0 3.4-5.3 6.7-5.3 6.7z" }],
-  bolt: [{ d: "M9.1 2.4L4.2 9.1h3.3l-.6 4.5 4.9-6.7H8.5z" }],
-};
-
-/**
- * Tone key → the pastel it FILLS with, and the -d weight it STROKES with.
- *
- * Both, not one: a folder mark is a ~14px glyph, and [[loopable-brand-palette]] is explicit
- * that a base pastel at that size smudges — LP_BLUE measures 1.88:1 on white. So the pastel
- * is the fill (a tinted body reads as "coloured") and the measured -deep variant carries the
- * outline (an outline that reads at all).
- *
- * The default tone is `neutral` — HOST's C5 key, not "grey". The whitelist is SHARED between
- * the two ends, so the name matters more than the word: a tone the host does not recognise
- * degrades to the default and the user's choice silently disappears on reload.
- */
-export const FOLDER_TONE_PAINT: Record<FolderTone, { fill: string; stroke: string }> = {
-  neutral: { fill: LP_LINE, stroke: LP_MUTED },
-  blue: { fill: LP_BLUE, stroke: LP_BLUE_DEEP },
-  green: { fill: LP_GREEN, stroke: LP_GREEN_DEEP },
-  yellow: { fill: LP_YELLOW, stroke: LP_YELLOW_DEEP },
-  red: { fill: LP_RED, stroke: LP_RED_DEEP },
-};
-
-export const FOLDER_TONE_LABELS: Record<FolderTone, string> = {
-  neutral: "Neutral",
-  blue: "Blue",
-  green: "Green",
-  yellow: "Yellow",
-  red: "Red",
-};
-
-export const FOLDER_SHAPE_LABELS: Record<FolderShape, string> = {
-  folder: "Folder",
-  star: "Star",
-  flag: "Flag",
-  tag: "Tag",
-  bookmark: "Bookmark",
-  grid: "Table",
-  chart: "Chart",
-  map: "Map",
-  users: "People",
-  clock: "Clock",
-  heart: "Heart",
-  bolt: "Priority",
-};
-
-/**
- * Wave-9 I14 — the tone each CREATABLE view type wears in the "+ Create new…" flyout.
- *
- * The owner asked for "pastel-coloured icons", and a flyout where every row is the same grey
- * is a list you read rather than scan. Assigned by family, not by rotation: the two
- * record-shaped modes (grid/list) share blue, the two time-shaped ones (calendar/kanban)
- * share yellow, chart is green because it is the analytical one, map is red because it is
- * the geographic one. Folder is grey — it is not a view, and the flyout's last row should
- * not compete with the six above it.
- */
-/**
- * Human labels for every display mode. Moved here from viewModes.tsx in wave 9 so the label
- * sits beside the geometry, the way TYPE_LABELS does — the mode switcher, the create flyout
- * and the create prompt now read ONE table instead of three. C2's "Dashboard" → "Chart"
- * rename is a single line here as a direct result.
- */
-export const MODE_LABELS: Record<DisplayMode, string> = {
-  grid: "Grid",
-  chart: "Chart",
-  // Legacy: never OFFERED (it is not in CREATABLE_MODES) but still labelled, because a view
-  // read before normalisation must never render a blank switcher chip.
-  dashboard: "Chart",
-  list: "List",
-  calendar: "Calendar",
-  kanban: "Kanban",
-  map: "Map",
-  timeseries: "Time series",
-  catalog: "Catalog",
-};
-
-/**
- * I14 — the view types the "+ Create new…" flyout OFFERS, in the order it lists them.
- *
- * Deliberately NOT `DISPLAY_MODES`, and deliberately here rather than inside ViewSidebar.tsx:
- * C2 makes `'dashboard'` a mode that stays READABLE forever (every view saved before the
- * rename sits in it) while ceasing to be OFFERABLE once `'chart'` exists — one list cannot
- * express both. Living in this pure data module means the gate can assert the offered set
- * without importing a React component, and I10 becomes a one-line edit in one file.
- */
-// 2026-08-02 item 7 — `timeseries` was deliberately held OUT of this list until the host
-// accepted the name, because a mode may be READABLE before it is OFFERABLE (the same split C2
-// wrote for 'dashboard', running forwards): `aios_grid._clean_display` drops a mode it does
-// not know, so offering it early would let a user create a view that silently reverts to a
-// grid on the next read with nothing going red. HOST posted "ACCEPTANCE LANDED" with
-// `DISPLAY_MODES += timeseries`, so it is offerable now.
-//
-// wave17 GRID, owner item 10 — THE ORDER BELOW IS THE OWNER'S, stated verbatim:
-// Grid · Chart · Calendar · Kanban · Time series · Map · List.
-//
-// ⚠ It supersedes the two orderings this list has carried before it, and the reasoning that
-// produced them is now WRONG rather than merely outranked, so it is not left here to be
-// re-applied: `timeseries` was "listed last… it belongs beside Chart", and `list` sat second
-// as the other record-shaped mode. The owner put Time series FIFTH and List LAST. An order is
-// a product decision, so it is asserted in `verify_icons` rather than left to a comment —
-// nothing else on screen would go red if a future edit re-sorted it "sensibly".
-// Wave-18 C6-CATALOG — `catalog` was held out of this list until `aios_grid.DISPLAY_MODES`
-// accepted the name, the same hold `timeseries` and `chart` served before it. SESSION A posted
-// "C6 HOST MIRROR APPLIED — you may flip CREATABLE_MODES now" (2026-08-03), so it is offerable.
-// It lands LAST by contract: the owner's seven-mode order above is a product decision and the
-// new mode joins the end of it rather than being sorted into it.
-export const CREATABLE_MODES: DisplayMode[] = [
-  "grid",
-  "chart",
-  "calendar",
-  "kanban",
-  "timeseries",
-  "map",
-  "list",
-  "catalog",
-];
-
-export const MODE_TONE: Record<DisplayMode, FolderTone> = {
-  grid: "blue",
-  list: "blue",
-  chart: "green",
-  dashboard: "green",
-  calendar: "yellow",
-  kanban: "yellow",
-  map: "red",
-  // Green with `chart`: it is the other analytical mode, and the two belong to one family.
-  timeseries: "green",
-  // Wave-18 C6-CATALOG — NEUTRAL, and it is the honest pick rather than the leftover one. The
-  // four colour tones each name a family of ways to arrange records (blue = tabular, green =
-  // analytical, yellow = board/date, red = spatial); a catalog arranges nothing — it is a
-  // published artifact. Giving it a colour would file it under a family it is not in.
-  catalog: "neutral",
-};
-
-/**
- * Human labels for every field type. Lives here beside the icons so the two
- * halves of "how a field type presents itself" stay in one file (ColumnMenu
- * imports it rather than keeping a second copy).
- */
-export const TYPE_LABELS: Record<FieldType, string> = {
-  text: "Single line text",
-  select: "Single select",
-  multiselect: "Multi select",
-  user: "Assignee",
-  int: "Number",
-  currency: "Currency",
-  pct: "Percent",
-  date: "Date",
-  checkbox: "Checkbox",
-  phone: "Phone number",
-  email: "Email",
-  url: "URL",
-  rating: "Rating",
-  created_time: "Created time",
-  formula: "Formula",
-  // Wave-18 C5-AUTOFIELD (D's spec, applied by C).
-  automation: "Automation",
-  // Wave-22 C7 — spawned by automations (not in CREATABLE_TYPES), so this label mostly shows
-  // on headers and the field gear, not the create menu.
-  metric: "Metric",
-  // Wave-19 R7 — the picture column.
-  image: "Image",
-  status: "Lifecycle status (Odoo)", // never creatable; present so the map stays total
-};
-
-
-// ------------------------------------------------------------ glide sprites
-
-/** Serialize one shape to SVG source in an explicit colour (canvas sprites get
- *  no `currentColor` — glide hands the painter the theme colours directly). */
-function shapeSource(s: IconShape, color: string): string {
-  return s.fill
-    ? `<path d="${s.d}" fill="${color}"/>`
-    : `<path d="${s.d}" fill="none" stroke="${color}" stroke-width="1.35" ` +
-        `stroke-linecap="round" stroke-linejoin="round"/>`;
-}
-
-function sprite(shapes: IconShape[]) {
-  return ({ fgColor }: { fgColor: string }) =>
-    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">` +
-    shapes.map((s) => shapeSource(s, fgColor)).join("") +
-    `</svg>`;
-}
-
-/** Glide header-icon NAME for a field type — the `icon` a GridColumn asks for. */
-export function typeIconName(type: FieldType): string {
-  return `t_${type}`;
-}
-
-/**
- * The sprite map handed to <DataEditor headerIcons>. One entry per field type
- * (I20 draws the type mark in every column header), built from the same shapes
- * the React icons use.
- *
- * Colour: glide's "normal" variant paints with `theme.fgIconHeader`, which is
- * why theme.ts must set it — the library default is #FFFFFF, i.e. invisible on
- * our header (that was I21's actual bug, not a too-pale hex of ours).
- */
-export const TYPE_SPRITES: Record<string, ({ fgColor }: { fgColor: string }) => string> =
-  Object.fromEntries(
-    (Object.keys(TYPE_SHAPES) as FieldType[]).map((t) => [typeIconName(t), sprite(TYPE_SHAPES[t])])
-  );
-
-/**
- * The header sprite map handed to <DataEditor headerIcons>. Two families:
- *
- *   t_<type>   wave-8 I20 - the field-TYPE mark, drawn in EVERY column header,
- *              from the same shapes the React icons use. Painted by glide in
- *              `theme.fgIconHeader`.
- *   aiosInfo   wave-5 item 6, restyled by wave-9 I3 - the description (i).
- *              OUTLINE ONLY: a dark-grey ring with a transparent interior, per
- *              the owner. It still deliberately IGNORES the colours glide hands
- *              it, for the reason wave-8 recorded - glide's "special" variant is
- *              accentColor behind bgHeader, which under the C1 pastels is a pale
- *              glyph on a pale disc, i.e. I21 in a new costume.
- *              ⚠ It is NO LONGER a column `overlayIcon`. Glide draws an overlay
- *              at a hard-coded offset from the TYPE mark on the far LEFT of the
- *              header (drawHeaderInner: `drawX + 9`), and I3 wants it RIGHT-
- *              aligned. It is now painted by CustomerGrid's `drawHeader`
- *              callback at `infoMarkRect()` - see overlayPlacement.ts.
- */
-export const HEADER_ICONS: Record<string, (c: { fgColor: string; bgColor: string }) => string> = {
-  ...TYPE_SPRITES,
-  aiosInfo: () =>
-    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">` +
-    `<circle cx="8" cy="8" r="6.1" fill="none" stroke="${LP_MUTED}" stroke-width="1.25"/>` +
-    `<path d="M8 7.4v3.5" fill="none" stroke="${LP_MUTED}" stroke-width="1.4" ` +
-    `stroke-linecap="round"/>` +
-    `<circle cx="8" cy="5.1" r="0.85" fill="${LP_MUTED}"/>` +
-    `</svg>`,
-};
+// ---------------------------------------------------------------------------
+// customer-grid / iconShapes.ts
+// Wave-8 items I18 + I20 — ONE geometry source for the grid's icon vocabulary,
+// rendered by TWO very different painters:
+//
+//   - React  <FieldTypeIcon> / <ModeIcon>  — DOM svg in panels, popovers, menus
+//   - glide  headerIcons sprites           — canvas, drawn from an SVG *string*
+//
+// Glide's sprite API takes a function returning SVG SOURCE, so a header icon can
+// never be a React component. Keeping the paths as DATA (IconShape[]) and giving
+// each painter its own thin renderer is what stops the two from drifting — the
+// alternative (hand-copying every path into a template literal) guarantees the
+// header and the panel eventually disagree about what a "date" looks like.
+//
+// Geometry rules: 16x16 viewBox, stroke-based, 1.35 stroke, round caps/joins,
+// currentColor. Vector paths only — NEVER emoji (owner constant).
+// ---------------------------------------------------------------------------
+
+import type { DisplayMode, FieldType, FolderShape, FolderTone } from "./types";
+import {
+  LP_BLUE,
+  LP_BLUE_DEEP,
+  LP_GREEN,
+  LP_GREEN_DEEP,
+  LP_LINE,
+  LP_MUTED,
+  LP_RED,
+  LP_RED_DEEP,
+  LP_YELLOW,
+  LP_YELLOW_DEEP,
+} from "./theme";
+
+/** One drawing primitive. `fill: true` fills the path instead of stroking it
+ *  (the rating star is the only shape that reads better solid). */
+export type IconShape = { d: string; fill?: boolean };
+
+/** A circle as a path — two half-arcs. Sprites are SVG *source*, so every shape
+ *  has to survive being serialized into a string; paths do, <circle> elements
+ *  would need a second serializer branch for no benefit. */
+const circle = (cx: number, cy: number, r: number): string =>
+  `M${cx - r} ${cy}a${r} ${r} 0 1 0 ${r * 2} 0a${r} ${r} 0 1 0 ${-r * 2} 0`;
+
+const CALENDAR: IconShape[] = [
+  { d: "M3.2 4.6h9.6v8.2H3.2z" },
+  { d: "M3.2 7.2h9.6" },
+  { d: "M5.8 3v3.2" },
+  { d: "M10.2 3v3.2" },
+];
+
+/**
+ * Field type → icon geometry. A TOTAL record on purpose: adding a FieldType
+ * without an icon is a compile error, not a silently blank header.
+ */
+export const TYPE_SHAPES: Record<FieldType, IconShape[]> = {
+  text: [{ d: "M3 5h10M3 8h10M3 11h6" }],
+  status: [{ d: "M4 13V3.5h7.6L10.1 6l1.5 2.5H4" }],
+  currency: [
+    { d: "M8 2.8v10.4" },
+    { d: "M10.6 5.4A2.6 2.6 0 0 0 8.2 4.2H7.4a2 2 0 0 0 0 4h1.2a2 2 0 0 1 0 4H7.8a2.6 2.6 0 0 1-2.4-1.4" },
+  ],
+  int: [{ d: "M6.2 3L4.8 13M11.2 3l-1.4 10M3.4 6.2h9.2M2.9 9.8h9.2" }],
+  date: CALENDAR,
+  pct: [
+    { d: circle(4.6, 4.6, 1.6) },
+    { d: circle(11.4, 11.4, 1.6) },
+    { d: "M12.2 3.9L3.8 12.3" },
+  ],
+  select: [{ d: "M3.2 3.8h9.6v8.4H3.2z" }, { d: "M6.2 7.2l1.8 1.8 1.8-1.8" }],
+  user: [
+    { d: circle(8, 6, 2.4) },
+    { d: "M3.6 13c0-2.4 2-3.8 4.4-3.8s4.4 1.4 4.4 3.8" },
+  ],
+  multiselect: [
+    { d: "M3 4.6h2.2v2.2H3zM3 9.2h2.2v2.2H3z" },
+    { d: "M7.2 5.7h6M7.2 10.3h6" },
+  ],
+  checkbox: [{ d: "M3.4 3.4h9.2v9.2H3.4z" }, { d: "M5.8 8.1l1.8 1.9 3.4-3.9" }],
+  phone: [
+    { d: "M5.1 3.2L7 5.1 5.6 7a7.2 7.2 0 0 0 3.4 3.4l1.9-1.4 1.9 1.9-1.5 1.6c-3 .5-8.3-4.8-7.8-7.8z" },
+  ],
+  email: [{ d: "M3 4.4h10v7.2H3z" }, { d: "M3 4.9l5 3.9 5-3.9" }],
+  url: [
+    { d: "M7 5.4L8.4 4a2.6 2.6 0 0 1 3.7 3.7L10.7 9" },
+    { d: "M9 10.6L7.6 12a2.6 2.6 0 0 1-3.7-3.7L5.3 7" },
+    { d: "M6.2 9.8l3.6-3.6" },
+  ],
+  rating: [
+    {
+      d: "M8 2.9l1.63 3.3 3.64.53-2.63 2.57.62 3.63L8 11.24 4.74 12.93l.62-3.63L2.73 6.73l3.64-.53z",
+      fill: true,
+    },
+  ],
+  created_time: [{ d: circle(8, 8, 5.2) }, { d: "M8 4.9v3.4l2.3 1.4" }],
+  formula: [
+    { d: "M5.6 12.8V5.4a2 2 0 0 1 3.2-1.6" },
+    { d: "M4.2 7.6h4.6" },
+    { d: "M10.2 8.4l3 3.4M13.2 8.4l-3 3.4" },
+  ],
+  // Wave-18 C5-AUTOFIELD (D's spec, applied by C as client-vocab registrar). A 290° cycle ring
+  // with an arrowhead, wrapped around a solid run-triangle: a job that runs, repeatedly.
+  // Deliberately NOT a bolt (`FOLDER_SHAPE_PATHS.bolt` already means "Priority") and not a clock
+  // (`created_time` owns the closed rim + hands).
+  automation: [
+    { d: "M10.8 4.1A4.8 4.8 0 1 1 5.3 4.1" },
+    { d: "M4.2 6L5.3 4.1 3.1 4.5" },
+    { d: "M6.9 6.1L9.8 8 6.9 9.9z", fill: true },
+  ],
+  // Wave-22 C7 (added by C as client-vocab registrar, the W18 automation precedent). A rising
+  // series on an axis: a measure OVER TIME, which is what a metric field is. Deliberately not
+  // the formula fx (that computes over the ROW) and not a bare number (int owns ##).
+  metric: [
+    { d: "M3.2 3.2v9.6h9.6" },
+    { d: "M5 10.4l2.4-2.6 1.9 1.5 3.1-3.9" },
+  ],
+  // Wave-23 C7 — TWO BRACES facing each other with a dot between them: the universal mark for
+  // "a structured document", and the one glyph in this table that draws its own SYNTAX rather
+  // than a picture of what the value means. Deliberately not a document page (nothing here owns
+  // that yet, but a page reads as a file/attachment, which a json cell is not) and not a tree
+  // of nodes (too fine to survive 16px). The centre dot is what keeps the two braces from
+  // reading as parentheses at small sizes.
+  json: [
+    { d: "M6.4 3.2c-1.5 0-1.5 3.4-1.5 3.4S4.8 8 3.4 8s1.5 1.4 1.5 1.4 0 3.4 1.5 3.4" },
+    { d: "M9.6 3.2c1.5 0 1.5 3.4 1.5 3.4s.1 1.4 1.5 1.4-1.5 1.4-1.5 1.4 0 3.4-1.5 3.4" },
+    { d: circle(8, 8, 0.85), fill: true },
+  ],
+  // Wave-19 R7 — a framed picture: the mount, a sun, and the hill line every photo glyph
+  // resolves to at 16px. Drawn on the same 16-unit grid as its neighbours.
+  image: [
+    { d: "M2.6 3.4h10.8v9.2H2.6z" },
+    { d: circle(6, 6.3, 1.1) },
+    { d: "M2.6 10.6L6.1 7.6l2.5 2.1 2.2-1.8 2.6 2.2" },
+  ],
+};
+
+/**
+ * Display mode → icon geometry (I18). Also total: the wave-8 Dashboard mode
+ * cannot land in DISPLAY_MODES without the compiler demanding its icon here.
+ */
+export const MODE_SHAPES: Record<DisplayMode, IconShape[]> = {
+  grid: [
+    { d: "M2.6 3.4h10.8v9.2H2.6z" },
+    { d: "M2.6 6.5h10.8M2.6 9.5h10.8M6.4 3.4v9.2M10 3.4v9.2" },
+  ],
+  list: [{ d: "M3 4.6h1.4M6.4 4.6h6.6M3 8h1.4M6.4 8h6.6M3 11.4h1.4M6.4 11.4h6.6" }],
+  // I19c — a framed set of bars: "several charts", not "one chart".
+  chart: [
+    { d: "M2.6 3.4h10.8v9.2H2.6z" },
+    { d: "M5.4 10.6V7.2M8 10.6V5.4M10.6 10.6V8.6" },
+  ],
+  // I10 (C2) — the LEGACY key. Kept so this record stays total over DisplayMode, which is
+  // what makes "accept 'dashboard' on read forever" a compile-time guarantee rather than a
+  // promise. Same drawing: a stored 'dashboard' IS a chart.
+  dashboard: [
+    { d: "M2.6 3.4h10.8v9.2H2.6z" },
+    { d: "M5.4 10.6V7.2M8 10.6V5.4M10.6 10.6V8.6" },
+  ],
+  calendar: CALENDAR,
+  kanban: [{ d: "M2.8 3.4h3.1v9.2H2.8zM6.5 3.4h3.1v6.2H6.5zM10.2 3.4h3.1v7.6h-3.1z" }],
+  map: [
+    { d: "M8 2.6a3.6 3.6 0 0 1 3.6 3.6c0 2.7-3.6 7.2-3.6 7.2S4.4 8.9 4.4 6.2A3.6 3.6 0 0 1 8 2.6z" },
+    { d: circle(8, 6.1, 1.3) },
+  ],
+  // 2026-08-02 item 7 — the time-series view. Drawn as a framed grid with a trend running
+  // through it, because that is literally what the panel is: metric ROWS x bucket COLUMNS with
+  // a per-row line toggle. Deliberately not the plain `line` chart mark — a chart view and a
+  // time-series table must not be the same picture in the same rail.
+  timeseries: [
+    { d: "M2.6 3.4h10.8v9.2H2.6z" },
+    { d: "M2.6 6.6h10.8M6.2 3.4v9.2" },
+    { d: "M7.2 10.8l2-2.4 1.6 1.2 1.8-2.6" },
+  ],
+  // Wave-18 C6-CATALOG — an OPEN BOOK: two facing leaves with a spine between them, and a
+  // product block sitting on the left one. Every other mode in this table draws a way of
+  // arranging RECORDS; this one has to read as a printed artifact, so it is the only mark here
+  // with a spine and a gutter. Deliberately not a page-with-lines (`list` owns that reading) and
+  // not a framed grid (`grid`/`chart`/`timeseries` share the frame).
+  catalog: [
+    { d: "M2.4 4.2h4.6a1.6 1.6 0 0 1 1 .4l0 8a1.6 1.6 0 0 0-1-.4H2.4z" },
+    { d: "M13.6 4.2H9a1.6 1.6 0 0 0-1 .4l0 8a1.6 1.6 0 0 1 1-.4h4.6z" },
+    { d: "M3.9 6.4h2.3v2.8H3.9z" },
+  ],
+  // Wave-23 C9 — a SHEET WITH A WRITING LINE: two filled answer bars and an empty rule beneath
+  // them. Every other mode here draws a way of ARRANGING records that already exist; this one
+  // has to read as a record being MADE, so it is the only mark whose bottom line is open.
+  // Deliberately not a clipboard (nothing else here has a frame with a tab) and not a pencil
+  // (an edit affordance means something else app-wide).
+  form: [
+    { d: "M3.4 2.8h9.2v10.4H3.4z" },
+    { d: "M5.6 5.6h4.8" },
+    { d: "M5.6 8h4.8" },
+    { d: "M5.6 10.6h2.6" },
+  ],
+};
+
+/**
+ * Wave-9 I16 — one mark per CHART KIND. Total over `ChartKind`, so a kind added to C2's
+ * vocabulary cannot ship without a drawing.
+ *
+ * ⚠ The owner asked for an icon on every chart-type option, and the wave-8 ruling stands:
+ * an `<option>` cannot render SVG and unicode glyphs are gate-banned, so the chart-type
+ * picker is NOT a native `<select>` — it is a radio-row list like the mode switcher, which
+ * is the only shape that can carry a real mark.
+ *
+ * The key type is a string union declared here rather than imported from chartData.ts: this
+ * module is a leaf (types + theme only) and chartData imports IT, not the reverse.
+ */
+export type ChartKindKey = "bar" | "line" | "area" | "donut" | "kpi" | "table";
+export const CHART_KIND_SHAPES: Record<ChartKindKey, IconShape[]> = {
+  bar: [{ d: "M3.2 12.8V7.4M6.4 12.8V4.2M9.6 12.8V8.8M12.8 12.8V5.8" }],
+  line: [
+    { d: "M2.6 11.2l3.2-3.4 2.6 2 4.9-5.2" },
+    { d: circle(5.8, 7.8, 0.9) },
+    { d: circle(8.4, 9.8, 0.9) },
+  ],
+  area: [
+    { d: "M2.6 12.4V9.2l3.2-3.2 2.6 2 4.9-4.6v9z" },
+    { d: "M2.6 9.2l3.2-3.2 2.6 2 4.9-4.6" },
+  ],
+  donut: [{ d: circle(8, 8, 5) }, { d: circle(8, 8, 2.1) }],
+  // A single big number: the KPI card. Drawn as a framed value rather than a glyph, so it
+  // reads as "one number" beside four marks that all read as "a distribution".
+  kpi: [{ d: "M2.6 3.8h10.8v8.4H2.6z" }, { d: "M5.4 9.6V6.4l1.9 3.2V6.4M9.4 6.4v3.2h1.8" }],
+  // Wave-16 C-CHARTCAP: a group-by aggregate table. Framed like the KPI (it is a card of
+  // values, not a distribution), with a header band and a column rule.
+  table: [
+    { d: "M2.6 3.4h10.8v9.2H2.6z" },
+    { d: "M2.6 6.2h10.8M7.2 6.2v6.4M2.6 9.4h10.8" },
+  ],
+};
+
+export const CHART_KIND_LABELS: Record<ChartKindKey, string> = {
+  bar: "Bar",
+  line: "Line",
+  area: "Area",
+  donut: "Donut",
+  kpi: "Single value",
+  table: "Table",
+};
+
+/** I16 — the pastel each chart kind wears, same family rule as MODE_TONE. */
+export const CHART_KIND_TONE: Record<ChartKindKey, FolderTone> = {
+  bar: "blue",
+  line: "green",
+  area: "green",
+  donut: "yellow",
+  kpi: "neutral",
+  table: "neutral",
+};
+
+/**
+ * Wave-9 contract C5 (I15) — folder icon geometry. TOTAL over `FolderShape`, so a shape key
+ * added to the wire contract in types.ts cannot ship without a drawing.
+ *
+ * Same 16x16 stroke vocabulary as everything above: these have to sit beside a mode icon in
+ * the same rail and read as one family. `folder` is first because it is the default every
+ * pre-wave-9 folder falls back to (I14: "existing folders get the folder icon").
+ */
+export const FOLDER_SHAPE_PATHS: Record<FolderShape, IconShape[]> = {
+  folder: [{ d: "M2.4 12.6V4.2a.6.6 0 0 1 .6-.6h3.2l1.5 1.7h5.3a.6.6 0 0 1 .6.6v6.7a.6.6 0 0 1-.6.6H3a.6.6 0 0 1-.6-.6z" }],
+  star: [
+    { d: "M8 2.9l1.63 3.3 3.64.53-2.63 2.57.62 3.63L8 11.24 4.74 12.93l.62-3.63L2.73 6.73l3.64-.53z" },
+  ],
+  flag: [
+    { d: "M4.2 13.4V2.9" },
+    { d: "M4.2 3.4h7.6l-1.5 2.6 1.5 2.6H4.2z" },
+  ],
+  tag: [
+    { d: "M2.9 8.2V3.5a.6.6 0 0 1 .6-.6h4.7l5 5-5.3 5.3z" },
+    { d: circle(5.6, 5.6, 1) },
+  ],
+  bookmark: [{ d: "M4.4 2.9h7.2v10.4L8 10.7l-3.6 2.6z" }],
+  // Four of the host's shapes ALREADY exist in this file as a mode or a field-type mark.
+  // Reusing the geometry rather than drawing a second "chart" is the whole point of the
+  // one-source rule: a folder labelled Chart and the Chart view must not be two pictures.
+  grid: MODE_SHAPES.grid,
+  chart: MODE_SHAPES.dashboard,
+  map: MODE_SHAPES.map,
+  users: TYPE_SHAPES.user,
+  clock: TYPE_SHAPES.created_time,
+  heart: [{ d: "M8 13.1S2.7 9.8 2.7 6.4a2.9 2.9 0 0 1 5.3-1.6 2.9 2.9 0 0 1 5.3 1.6c0 3.4-5.3 6.7-5.3 6.7z" }],
+  bolt: [{ d: "M9.1 2.4L4.2 9.1h3.3l-.6 4.5 4.9-6.7H8.5z" }],
+};
+
+/**
+ * Tone key → the pastel it FILLS with, and the -d weight it STROKES with.
+ *
+ * Both, not one: a folder mark is a ~14px glyph, and [[loopable-brand-palette]] is explicit
+ * that a base pastel at that size smudges — LP_BLUE measures 1.88:1 on white. So the pastel
+ * is the fill (a tinted body reads as "coloured") and the measured -deep variant carries the
+ * outline (an outline that reads at all).
+ *
+ * The default tone is `neutral` — HOST's C5 key, not "grey". The whitelist is SHARED between
+ * the two ends, so the name matters more than the word: a tone the host does not recognise
+ * degrades to the default and the user's choice silently disappears on reload.
+ */
+export const FOLDER_TONE_PAINT: Record<FolderTone, { fill: string; stroke: string }> = {
+  neutral: { fill: LP_LINE, stroke: LP_MUTED },
+  blue: { fill: LP_BLUE, stroke: LP_BLUE_DEEP },
+  green: { fill: LP_GREEN, stroke: LP_GREEN_DEEP },
+  yellow: { fill: LP_YELLOW, stroke: LP_YELLOW_DEEP },
+  red: { fill: LP_RED, stroke: LP_RED_DEEP },
+};
+
+export const FOLDER_TONE_LABELS: Record<FolderTone, string> = {
+  neutral: "Neutral",
+  blue: "Blue",
+  green: "Green",
+  yellow: "Yellow",
+  red: "Red",
+};
+
+export const FOLDER_SHAPE_LABELS: Record<FolderShape, string> = {
+  folder: "Folder",
+  star: "Star",
+  flag: "Flag",
+  tag: "Tag",
+  bookmark: "Bookmark",
+  grid: "Table",
+  chart: "Chart",
+  map: "Map",
+  users: "People",
+  clock: "Clock",
+  heart: "Heart",
+  bolt: "Priority",
+};
+
+/**
+ * Wave-9 I14 — the tone each CREATABLE view type wears in the "+ Create new…" flyout.
+ *
+ * The owner asked for "pastel-coloured icons", and a flyout where every row is the same grey
+ * is a list you read rather than scan. Assigned by family, not by rotation: the two
+ * record-shaped modes (grid/list) share blue, the two time-shaped ones (calendar/kanban)
+ * share yellow, chart is green because it is the analytical one, map is red because it is
+ * the geographic one. Folder is grey — it is not a view, and the flyout's last row should
+ * not compete with the six above it.
+ */
+/**
+ * Human labels for every display mode. Moved here from viewModes.tsx in wave 9 so the label
+ * sits beside the geometry, the way TYPE_LABELS does — the mode switcher, the create flyout
+ * and the create prompt now read ONE table instead of three. C2's "Dashboard" → "Chart"
+ * rename is a single line here as a direct result.
+ */
+export const MODE_LABELS: Record<DisplayMode, string> = {
+  grid: "Grid",
+  chart: "Chart",
+  // Legacy: never OFFERED (it is not in CREATABLE_MODES) but still labelled, because a view
+  // read before normalisation must never render a blank switcher chip.
+  dashboard: "Chart",
+  list: "List",
+  calendar: "Calendar",
+  kanban: "Kanban",
+  map: "Map",
+  timeseries: "Time series",
+  catalog: "Catalog",
+  // Wave-23 C9 — the mode that COLLECTS records. "Form", the word the whole product uses for
+  // it (the public page, the share panel, the `form_submitted` trigger); a synonym here would
+  // be the one surface calling it something else.
+  form: "Form",
+};
+
+/**
+ * I14 — the view types the "+ Create new…" flyout OFFERS, in the order it lists them.
+ *
+ * Deliberately NOT `DISPLAY_MODES`, and deliberately here rather than inside ViewSidebar.tsx:
+ * C2 makes `'dashboard'` a mode that stays READABLE forever (every view saved before the
+ * rename sits in it) while ceasing to be OFFERABLE once `'chart'` exists — one list cannot
+ * express both. Living in this pure data module means the gate can assert the offered set
+ * without importing a React component, and I10 becomes a one-line edit in one file.
+ */
+// 2026-08-02 item 7 — `timeseries` was deliberately held OUT of this list until the host
+// accepted the name, because a mode may be READABLE before it is OFFERABLE (the same split C2
+// wrote for 'dashboard', running forwards): `aios_grid._clean_display` drops a mode it does
+// not know, so offering it early would let a user create a view that silently reverts to a
+// grid on the next read with nothing going red. HOST posted "ACCEPTANCE LANDED" with
+// `DISPLAY_MODES += timeseries`, so it is offerable now.
+//
+// wave17 GRID, owner item 10 — THE ORDER BELOW IS THE OWNER'S, stated verbatim:
+// Grid · Chart · Calendar · Kanban · Time series · Map · List.
+//
+// ⚠ It supersedes the two orderings this list has carried before it, and the reasoning that
+// produced them is now WRONG rather than merely outranked, so it is not left here to be
+// re-applied: `timeseries` was "listed last… it belongs beside Chart", and `list` sat second
+// as the other record-shaped mode. The owner put Time series FIFTH and List LAST. An order is
+// a product decision, so it is asserted in `verify_icons` rather than left to a comment —
+// nothing else on screen would go red if a future edit re-sorted it "sensibly".
+// Wave-18 C6-CATALOG — `catalog` was held out of this list until `aios_grid.DISPLAY_MODES`
+// accepted the name, the same hold `timeseries` and `chart` served before it. SESSION A posted
+// "C6 HOST MIRROR APPLIED — you may flip CREATABLE_MODES now" (2026-08-03), so it is offerable.
+// It lands LAST by contract: the owner's seven-mode order above is a product decision and the
+// new mode joins the end of it rather than being sorted into it.
+export const CREATABLE_MODES: DisplayMode[] = [
+  "grid",
+  "chart",
+  "calendar",
+  "kanban",
+  "timeseries",
+  "map",
+  "list",
+  "catalog",
+];
+
+export const MODE_TONE: Record<DisplayMode, FolderTone> = {
+  grid: "blue",
+  list: "blue",
+  chart: "green",
+  dashboard: "green",
+  calendar: "yellow",
+  kanban: "yellow",
+  map: "red",
+  // Green with `chart`: it is the other analytical mode, and the two belong to one family.
+  timeseries: "green",
+  // Wave-18 C6-CATALOG — NEUTRAL, and it is the honest pick rather than the leftover one. The
+  // four colour tones each name a family of ways to arrange records (blue = tabular, green =
+  // analytical, yellow = board/date, red = spatial); a catalog arranges nothing — it is a
+  // published artifact. Giving it a colour would file it under a family it is not in.
+  catalog: "neutral",
+  // Wave-23 C9 — NEUTRAL, and for `catalog`'s reason rather than by elimination: the four tones
+  // name families of ways to ARRANGE records (blue tabular, green analytical, yellow
+  // board/date, red spatial). A form arranges nothing — it is a door records come in through —
+  // so giving it a colour would file it under a family it is not in.
+  form: "neutral",
+};
+
+/**
+ * Human labels for every field type. Lives here beside the icons so the two
+ * halves of "how a field type presents itself" stay in one file (ColumnMenu
+ * imports it rather than keeping a second copy).
+ */
+export const TYPE_LABELS: Record<FieldType, string> = {
+  text: "Single line text",
+  select: "Single select",
+  multiselect: "Multi select",
+  user: "Assignee",
+  int: "Number",
+  currency: "Currency",
+  pct: "Percent",
+  date: "Date",
+  checkbox: "Checkbox",
+  phone: "Phone number",
+  email: "Email",
+  url: "URL",
+  rating: "Rating",
+  created_time: "Created time",
+  formula: "Formula",
+  // Wave-18 C5-AUTOFIELD (D's spec, applied by C).
+  automation: "Automation",
+  // Wave-22 C7 — spawned by automations (not in CREATABLE_TYPES), so this label mostly shows
+  // on headers and the field gear, not the create menu.
+  metric: "Metric",
+  // Wave-19 R7 — the picture column.
+  image: "Image",
+  // Wave-23 C7 — the structured-document column. "JSON" rather than "Structured data": it is
+  // the word on the wire, in the viewer's raw tab and in every error the server can return, and
+  // a friendlier synonym would be the only place in the product using a different one.
+  json: "JSON",
+  status: "Lifecycle status (Odoo)", // never creatable; present so the map stays total
+};
+
+
+// ------------------------------------------------------------ glide sprites
+
+/** Serialize one shape to SVG source in an explicit colour (canvas sprites get
+ *  no `currentColor` — glide hands the painter the theme colours directly). */
+function shapeSource(s: IconShape, color: string): string {
+  return s.fill
+    ? `<path d="${s.d}" fill="${color}"/>`
+    : `<path d="${s.d}" fill="none" stroke="${color}" stroke-width="1.35" ` +
+        `stroke-linecap="round" stroke-linejoin="round"/>`;
+}
+
+function sprite(shapes: IconShape[]) {
+  return ({ fgColor }: { fgColor: string }) =>
+    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">` +
+    shapes.map((s) => shapeSource(s, fgColor)).join("") +
+    `</svg>`;
+}
+
+/** Glide header-icon NAME for a field type — the `icon` a GridColumn asks for. */
+export function typeIconName(type: FieldType): string {
+  return `t_${type}`;
+}
+
+/**
+ * The sprite map handed to <DataEditor headerIcons>. One entry per field type
+ * (I20 draws the type mark in every column header), built from the same shapes
+ * the React icons use.
+ *
+ * Colour: glide's "normal" variant paints with `theme.fgIconHeader`, which is
+ * why theme.ts must set it — the library default is #FFFFFF, i.e. invisible on
+ * our header (that was I21's actual bug, not a too-pale hex of ours).
+ */
+export const TYPE_SPRITES: Record<string, ({ fgColor }: { fgColor: string }) => string> =
+  Object.fromEntries(
+    (Object.keys(TYPE_SHAPES) as FieldType[]).map((t) => [typeIconName(t), sprite(TYPE_SHAPES[t])])
+  );
+
+/**
+ * The header sprite map handed to <DataEditor headerIcons>. Two families:
+ *
+ *   t_<type>   wave-8 I20 - the field-TYPE mark, drawn in EVERY column header,
+ *              from the same shapes the React icons use. Painted by glide in
+ *              `theme.fgIconHeader`.
+ *   aiosInfo   wave-5 item 6, restyled by wave-9 I3 - the description (i).
+ *              OUTLINE ONLY: a dark-grey ring with a transparent interior, per
+ *              the owner. It still deliberately IGNORES the colours glide hands
+ *              it, for the reason wave-8 recorded - glide's "special" variant is
+ *              accentColor behind bgHeader, which under the C1 pastels is a pale
+ *              glyph on a pale disc, i.e. I21 in a new costume.
+ *              ⚠ It is NO LONGER a column `overlayIcon`. Glide draws an overlay
+ *              at a hard-coded offset from the TYPE mark on the far LEFT of the
+ *              header (drawHeaderInner: `drawX + 9`), and I3 wants it RIGHT-
+ *              aligned. It is now painted by CustomerGrid's `drawHeader`
+ *              callback at `infoMarkRect()` - see overlayPlacement.ts.
+ */
+export const HEADER_ICONS: Record<string, (c: { fgColor: string; bgColor: string }) => string> = {
+  ...TYPE_SPRITES,
+  aiosInfo: () =>
+    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">` +
+    `<circle cx="8" cy="8" r="6.1" fill="none" stroke="${LP_MUTED}" stroke-width="1.25"/>` +
+    `<path d="M8 7.4v3.5" fill="none" stroke="${LP_MUTED}" stroke-width="1.4" ` +
+    `stroke-linecap="round"/>` +
+    `<circle cx="8" cy="5.1" r="0.85" fill="${LP_MUTED}"/>` +
+    `</svg>`,
+};

web/src/customer-grid/theme.ts

@@ -73,6 +73,30 @@ export const LP_PURPLE_DEEP = "#6B57A8"; // 5.17:1 on its own tint
  */
 export const LP_VOID = "#F6F8FC";
 
+/**
+ * ⭐ Wave-23 C8 (owner item 4 / ruling R9) — **the MACHINE-OWNED column pair.**
+ *
+ * A sixth family, and neutral rather than a hue on purpose: the four C1 pastels each mean a
+ * STATE (green positive, red negative, yellow attention, blue interactive) and purple means
+ * GROUP. "A robot fills this column" is none of those — it is a property of the column's
+ * OWNERSHIP, so it takes the grey the palette had no name for. Deliberately NOT `LP_MUTED`
+ * (#6B7280): that is chrome ink, it is warmer, and re-using it would make "muted text" and
+ * "machine-owned" one token that two unrelated rules could then drag apart.
+ *
+ *   `LP_MACHINE_TINT`  the flat wash the DOM surfaces paint (`RecordDetail.css`'s
+ *                      `.cg-detail-field.is-machine .cg-detail-value`). It is exactly what the
+ *                      canvas wash below COMPOSITES TO over white, so the drawer's value slot
+ *                      and the grid cell are the same grey rather than two greys that were each
+ *                      picked to look right alone.
+ *   `LP_MACHINE_DEEP`  its ink — 5.35:1 on the tint, 6.32:1 on white (measured, not picked) —
+ *                      and the hue `MACHINE_CELL` derives the canvas wash from.
+ *
+ * Mirrors `--lp-machine-tint` / `--lp-machine-deep` in index.css; `verify_icons`' I7c parity
+ * diffs the two files, which is why both are plain hex strings here and neither is computed.
+ */
+export const LP_MACHINE_TINT = "#EBECEE";
+export const LP_MACHINE_DEEP = "#59606E";
+
 export const LP_BLUE_DEEP = "#768FB6";   // 3.29:1 on white — rings, control borders
 /* THE PRODUCT PRIMARY — the same #5B8FD9 the host's `.streamlit/config.toml`
    paints on every primary button, so embed and standalone stop disagreeing
@@ -294,6 +318,57 @@ export const COLUMN_TONE_THEME: Record<ControlTone, Partial<Theme>> = {
   },
 };
 
+/**
+ * ⭐ Wave-23 C8 — the wash a MACHINE-OWNED cell paints (`isMachineOwned`, types.ts).
+ *
+ * **ONE SHARED REFERENCE, and that is not a micro-optimisation.** glide has no theme-merge
+ * cache, so a fresh `{bgCell}` per cell costs a ~35-key spread on every cell of every frame —
+ * the same reasoning `STATUS_ROW_THEME` and `COLUMN_TONE_THEME` state, and it bites harder here
+ * because this override is returned for a whole COLUMN of cells rather than for the few rows
+ * that carry a status.
+ *
+ * **`rgba`, NOT a hex, and it is load-bearing** (the wave-15 R5 lesson, one surface down):
+ * `mergeAndRealizeTheme` alpha-BLENDS `bgCell` and hard-replaces every other key, so an opaque
+ * grey here would ERASE whatever it landed on — a colour-by row's status wash and the
+ * hover/active row wash both, leaving a machine column as a permanent gap through every tinted
+ * row. Blending means a hovered machine cell is darker than either alone, which is exactly the
+ * reading a person expects.
+ *
+ * ⚠ **0.12, chosen against a COLLISION rather than by eye.** `ROW_HIGHLIGHT_NEUTRAL` (the
+ * hover/active row) composites to ≈#F2F2F3 — a neutral grey wash already means something on
+ * this canvas. At 0.12 this composites to `LP_MACHINE_TINT` (#EBECEE), which is visibly the
+ * stronger of the two, so "a whole column is grey" and "the row under my pointer is grey" stay
+ * two different readings. Raising it is the one knob if a machine column reads as nothing; do
+ * not switch it to a hue (R9 is explicit that this is not a state).
+ */
+export const MACHINE_CELL: Partial<Theme> = { bgCell: washOf(LP_MACHINE_DEEP, 0.12) };
+
+/**
+ * ⭐ Wave-23 C8 — a machine-owned cell's FINAL theme override, given whatever the cell already
+ * carried. **THE PRECEDENCE IS THE WHOLE FUNCTION**, so it lives here (node-reachable, under
+ * `verify_grid_ux`'s mutation harness) rather than inline in `cells.ts`, which imports glide and
+ * therefore cannot be driven by a gate at all.
+ *
+ * MERGED, with the CELL's own keys landing last — not "keep whichever exists", which was the
+ * first shape and is wrong in both directions:
+ *   · an `automation` cell that HAS run carries `AUTOMATION_TINT[state]` — a green/red/yellow
+ *     `bgCell` plus its ink. That is a STATE and it says something the wash does not, so it must
+ *     win. (A cell that has never run carries no override at all — `AUTOMATION_TINT.none` is
+ *     deliberately `undefined` — and takes the wash, which is the honest reading: machine-owned,
+ *     nothing written yet.)
+ *   · a machine-TAGGED `status`/`select`/`multiselect` cell — an automation-spawned column is an
+ *     ordinary field TYPE wearing the tag — carries a BUBBLE tint (`bgBubble`/`textBubble`),
+ *     which does not touch `bgCell` at all. "Keep whichever exists" would have silently cost
+ *     every one of those columns its wash, and a column of pills is exactly where a reader is
+ *     least able to tell who typed the value.
+ *
+ * The no-override case returns the SHARED `MACHINE_CELL` reference (see its note above); only
+ * the two merge cases allocate, and both already allocated a fresh override upstream.
+ */
+export function machineCellTheme(own: Partial<Theme> | undefined): Partial<Theme> {
+  return own ? { ...MACHINE_CELL, ...own } : MACHINE_CELL;
+}
+
 /* wave17 GRID — item 2 / owner R5: **THE ALTERNATING ROW BANDS ARE DEAD.**
  *
  * `CONTROL_BAND_THEME` stood here: a faint wash on every other data row while any control was

web/src/customer-grid/types.ts

@@ -44,6 +44,14 @@ export type FieldType =
   // menu (deliberately absent from CREATABLE_TYPES: the menu has no measure/window face yet —
   // offering the type without its config would mint permanently blank columns).
   | "metric"
+  // ⭐ Wave-23 C7 (owner item 5 / ruling R5) — `json` is a STRUCTURED DOCUMENT on a record: an
+  // API response, a webhook body, a scraped payload. The cell holds a STRING that must parse as
+  // JSON, ≤ 32 KB, validated host-side on write (refuse with a sentence, never truncate) — so
+  // the scalar `Row` contract (types.ts's Row, and `grid_events.py:1619`'s non-scalar refusal)
+  // is untouched. The grid shows a compact preview and the big viewer modal owns the document.
+  // It is NOT in `READONLY_CELL_TYPES`: the value is editable, just never through a 200px cell
+  // — the same "picked, not typed" reasoning `select` and `image` carry.
+  | "json"
   // ⭐ Wave-19 R7 / C5 — `image` is a PICTURE on a record. The cell holds a STRING REFERENCE,
   // never bytes (see `imageRef`): a SKU code, an `ed:` editorial slug, or a `rec:` upload. That
   // is what lets Royal's 1,142 existing SKU masters appear with nothing uploaded, and it keeps
@@ -56,10 +64,26 @@ export type FieldSource = "odoo" | "overlay";
 /** The types a user may create from the column menu. Odoo-sourced fields are not in this list —
  *  their type comes from the model, and `status` in particular is Odoo's lifecycle, not a
  *  user-defined set. */
+// ⚠ Wave-23 C7 — `json` is deliberately ABSENT from this list until SESSION A posts that
+// `aios_grid.CUSTOM_FIELD_TYPES` and `core.user_tables.UT_FIELD_TYPES` accept the name. It is
+// the field-kind twin of the CREATABLE_MODES hold (iconShapes.ts:344-364) and the failure is
+// worse here, because it is not a downgrade: `user_tables._clean_field` (:389) RETURNS NONE for
+// an unknown type, so a column created before the server knows the word simply does not exist
+// on the next read — created, named, configured, gone, with nothing anywhere going red. Every
+// OTHER json table below lands now, because reading a json field the server already sends is a
+// different question from offering to create one.
 export const CREATABLE_TYPES: readonly FieldType[] = [
   "text", "select", "multiselect", "user", "int", "currency", "pct", "date",
   "checkbox", "phone", "email", "url", "rating", "created_time", "formula", "automation",
   "image",
+  // ⭐ Wave-23 C7 (owner item 5) — ADDED AT THE CLOSE-OUT AUDIT, and its absence is the exact
+  // half-landing the fields contract exists to catch. `json` reached the `FieldType` union, the
+  // shape/label tables and the server's `CUSTOM_FIELD_TYPES`, but not this list — so the server
+  // would have accepted a json field that the client offered no way to create. The type would
+  // have shipped real, documented and unreachable.
+  // `verify_fields_contract` caught it by diffing the two lists; nothing else could have, because
+  // every individual file was internally consistent.
+  "json",
 ];
 
 /**
@@ -237,8 +261,16 @@ export type FieldScope = "cohort" | "global";
 // held OUT of CREATABLE_MODES until `aios_grid.DISPLAY_MODES` accepts the name, because
 // `_clean_display` drops an unknown mode and offering it first would let a user build a whole
 // catalogue that silently reverts to a grid on the next read with nothing going red.
+// ⭐ Wave-23 C9 (owner item 8): `form` joins the union — a view that COLLECTS records instead of
+// arranging them, published at a public `#/form/<token>` link. Landed here (so the type, the
+// icon table, the label table and the tone table are total over it, and a stored `form` view
+// renders rather than blanking) and held OUT of `CREATABLE_MODES` until `aios_grid.DISPLAY_MODES`
+// accepts the name — the identical hold `timeseries` and `catalog` served, for the identical
+// reason: `_clean_display` DROPS an unknown mode, so offering it early would let somebody build
+// a whole form, share its link, and have the view silently revert to a grid on the next read.
 export const DISPLAY_MODES = [
   "grid", "chart", "dashboard", "list", "calendar", "kanban", "map", "timeseries", "catalog",
+  "form",
 ] as const;
 export type DisplayMode = (typeof DISPLAY_MODES)[number];
 
@@ -946,6 +978,35 @@ export function mayEditField(field: Field, viewer: Viewer | undefined): boolean
   return edit === "creator" && field.createdBy === viewer.name;
 }
 
+/**
+ * ⭐ Wave-23 C8 (owner item 4 / ruling R9) — **is this column filled by a MACHINE?**
+ *
+ * Two clauses, and R9 is what makes it exactly two:
+ *   · `field.automation` present — the TAG the engine stamps on everything it spawns or writes:
+ *     the IG preset columns (`{flowId}`, automation_engine.py:757), the `stage_<autoId>` board
+ *     column and its cycles counter (`{flowId, stageField}`, :3600), and a user-configured
+ *     `automation` column's own gear bag. Ordinary field TYPES, machine ownership, one marker.
+ *   · `type ∈ {automation, metric}` — the two kinds that are machine-written BY DEFINITION even
+ *     when no tag reached the client (an `automation` column created before the flow that fills
+ *     it; a `metric`, which is computed server-side from the master series and never typed).
+ *
+ * ⛔ R9 DRAWS THE LINE HERE ON PURPOSE, and the two exclusions are the whole ruling: an
+ * ODOO-sourced column and a `formula`/`created_time` column **keep their current look**. All
+ * four are read-only, so "read-only" is NOT the predicate — a formula is written by the reader's
+ * own arithmetic and an Odoo column by the business, and greying either would say a robot owns
+ * a number the reader owns. This is why it is a separate function from `mayEditField` and not a
+ * branch of it.
+ *
+ * ⚠ **PAINT, NEVER PERMISSION.** `mayEditField` above stays the one edit wall (client courtesy;
+ * `grid_events.py:1608-1650` is the real one). A column can be machine-owned and editable
+ * (nothing is, today) or editable and machine-owned tomorrow, and this predicate must not be
+ * the reason a cell locks — two functions that agree today are exactly how one silently becomes
+ * the other's enforcement.
+ */
+export function isMachineOwned(field: Field): boolean {
+  return !!field.automation || field.type === "automation" || field.type === "metric";
+}
+
 /**
  * The NUMERIC and DATE families, for UI dispatch (operator lists, input kinds, sort-direction
  * wording). ONE definition here; the ENGINE (useVisibleRows) keeps its own deliberately —
@@ -1081,16 +1142,32 @@ export interface Field {
    * Wave-18 C5-AUTOFIELD — what this column's automation DOES. Absent = unconfigured (the cells
    * render "Not configured" and no run ever targets the column). Written through the field's
    * gear; validated host-side (`aios_grid._clean_automation`) exactly as `options`/`formula` are.
+   *
+   * ⭐ WIDENED wave-23 C8, because this interface described only ONE of the three writers and
+   * the other two have been shipping for a wave. `kind`/`source` are what the field GEAR writes
+   * (`_clean_automation`); the engine stamps two more bags that never carry either of them:
+   *   · a SPAWNED preset column — `{flowId}` alone (`automation_engine.py:757`);
+   *   · a STAGE column — `{flowId, stageField: true, …}` (`automation_engine.py:3600`).
+   * Nothing went red, because the wire arrives untyped: `field.automation.kind` on a stage
+   * column is a runtime `undefined` under a green `tsc`. C8 makes the TAG ITSELF load-bearing
+   * ("present ⇒ machine-owned", `isMachineOwned` above), so the shape it actually has is
+   * declared here rather than left to the one writer that happened to be typed first.
    */
   automation?: {
-    /** v1 vocabulary: 'instagram_profile'. Host-whitelisted; an unknown kind is dropped. */
-    kind: string;
-    /** where the run gets its subject. 'record_url_field' reads `urlField` off the row. */
-    source: "record_url_field" | "self";
+    /** v1 vocabulary: 'instagram_profile'. Host-whitelisted; an unknown kind is dropped.
+     *  Absent on engine-stamped bags (spawned presets, stage columns). */
+    kind?: string;
+    /** where the run gets its subject. 'record_url_field' reads `urlField` off the row.
+     *  Absent on engine-stamped bags. */
+    source?: "record_url_field" | "self";
     /** the row field holding the profile URL when source = 'record_url_field'. */
     urlField?: string;
     /** kind-specific knobs. Scalars only — the host clamps keys and value lengths. */
     settings?: Record<string, string | number | boolean>;
+    /** the automation definition that owns this column (engine-stamped; the machine marker). */
+    flowId?: string;
+    /** true on the `stage_<autoId>` column an automation board walks its records through. */
+    stageField?: boolean;
   };
   /**
    * Wave-22 C7 — a METRIC field's config bag, mirrored from `user_tables._clean_metric` (the

web/src/filter-kit/ops.ts

@@ -83,6 +83,20 @@ export function opsForType(t: FieldType): FilterOp[] {
   // by the user's own choice list. `eq` reads "is exactly": the whole set is that one choice.
   if (t === "multiselect")
     return ["contains", "doesNotContain", "eq", "neq", "isEmpty", "isNotEmpty"];
+  // ⭐ Wave-23 C7 — `json` gets EXACTLY the two value-free ops, and the omissions are the
+  // decision. `contains` over a serialized document is a substring test against punctuation and
+  // key names: `contains "12"` would match a key `id_12`, a value 12, a timestamp and a
+  // fragment of 5120, and every one of those reads as a working filter. `eq` is worse — two
+  // documents that mean the same thing differ by key order and whitespace, so "is" would answer
+  // false for a record that plainly matches. "Has anything been captured here yet" is the
+  // question a json column can answer soundly, and it is the one people actually ask.
+  //
+  // ⚠ NO NEW OPERATOR ENTERS EITHER ENGINE. `isEmpty`/`isNotEmpty` already exist in
+  // `filter_sql.py` (:76, and :112's VALUE_FREE_OPS) and `filter_eval.py` (:260-262), and both
+  // are TYPE-INDEPENDENT — they test blankness before any type dispatch — so the lock-step is
+  // untouched and nothing on the server had to move for this line. (The contract's prose spells
+  // them `is_empty`/`is_not_empty`; the runtimes do not. The names come from the code.)
+  if (t === "json") return ["isNotEmpty", "isEmpty"];
   // Wave-18 C5-AUTOFIELD — `automation` lands HERE, on the text ops, and that is the whole
   // v1 answer. Its cell is one machine-written line (`ok · 2026-08-03 14:10 · 12 posts`), so
   // `contains ok` and `contains error` are the two questions anyone actually asks of the

web/src/forms/FormPublic.tsx

@@ -0,0 +1,266 @@
+// ---------------------------------------------------------------------------
+// forms / FormPublic.tsx — ⭐ wave-23 item 8 (contract W23-C9).
+//
+// The page an ANONYMOUS person lands on at `#/form/<token>`. E mounts it in the
+// Shell BEFORE the auth wall (wiring W23-W2); everything below assumes there is
+// no session, no workspace, no nav and no viewer.
+//
+// ⛔ IT IMPORTS NOTHING FROM `customer-grid/**`, AND THAT IS A REQUIREMENT, NOT
+// A PREFERENCE. The grid bundle drags glide-data-grid — hundreds of kilobytes
+// of canvas table — into whatever chunk touches it, and this page is the one
+// surface in the product that a stranger loads cold, once, probably on a phone,
+// probably on mobile data, to type four answers. One convenience import from
+// `types.ts` would put the whole spreadsheet engine on that wire. So the field
+// vocabulary below is DECLARED HERE as plain strings rather than imported: the
+// server sends `type` as a string and this page renders a control per string,
+// which is the same "no client union over a server vocabulary" rule the rest of
+// the wave follows, arriving here for a second reason.
+//
+// ⚠ Styling reuses `.lpf-*` rules in the D REGION of index.css — the shell's
+// stylesheet is one file and already loaded; a second stylesheet for one page
+// would be a second copy of the tokens.
+// ---------------------------------------------------------------------------
+
+import { useEffect, useState } from "react";
+
+/** One field, exactly as `routes_forms._public_form` builds it. Nothing here is
+ *  optional-because-maybe: every key below is one the server always sends, and
+ *  the three that are conditional say so. */
+interface FormField {
+  key: string;
+  label: string;
+  /** The server's own word. Deliberately `string`, not a union — an unknown
+   *  type lands on the text input, which is the safe direction: a person can
+   *  always type an answer, and a control this page has never heard of would
+   *  otherwise render as nothing at all. */
+  type: string;
+  required: boolean;
+  options?: string[];
+  max?: number;
+}
+
+interface FormSpec {
+  title: string;
+  desc: string;
+  submitLabel: string;
+  fields: FormField[];
+  /** The honeypot's field name — planted, never shown. Server-named so the two
+   *  halves cannot drift into a trap nobody checks. */
+  honeypot: string;
+}
+
+type Phase = "loading" | "ready" | "sent" | "gone";
+
+const LONG_TEXT_MIN = 0;   // every text field gets a textarea when it is the only one
+
+export default function FormPublic({ token }: { token: string }) {
+  const [spec, setSpec] = useState<FormSpec | null>(null);
+  const [phase, setPhase] = useState<Phase>("loading");
+  const [values, setValues] = useState<Record<string, string>>({});
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState(false);
+
+  useEffect(() => {
+    let live = true;
+    setPhase("loading");
+    fetch(`/api/v1/forms/${encodeURIComponent(token)}`)
+      .then((r) => (r.ok ? r.json() : Promise.reject(new Error(String(r.status)))))
+      .then((data: FormSpec) => {
+        if (!live) return;
+        setSpec(data);
+        setPhase("ready");
+      })
+      // ⚠ ONE dead-end state for every failure, mirroring the server's uniform 403. Telling a
+      // visitor "this form is disabled" versus "no such form" would hand an enumerator the
+      // distinction the whole server-side refusal exists to withhold.
+      .catch(() => live && setPhase("gone"));
+    return () => {
+      live = false;
+    };
+  }, [token]);
+
+  const set = (key: string, v: string) =>
+    setValues((prev) => ({ ...prev, [key]: v }));
+
+  const submit = (event: React.FormEvent) => {
+    event.preventDefault();
+    if (busy) return;
+    setBusy(true);
+    setError("");
+    fetch(`/api/v1/forms/${encodeURIComponent(token)}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ values }),
+    })
+      .then(async (r) => {
+        if (r.ok) {
+          setPhase("sent");
+          return;
+        }
+        // The server's sentence, verbatim — it names the field by the label THIS PAGE showed,
+        // which is the only name the person has. A generic "something went wrong" here would
+        // discard the one useful thing the refusal carried.
+        const body = await r.json().catch(() => null);
+        setError(
+          String(body?.error?.message || "That could not be sent — check your answers and try again.")
+        );
+      })
+      .catch(() =>
+        setError("That could not be sent — check your connection and try again.")
+      )
+      .finally(() => setBusy(false));
+  };
+
+  if (phase === "loading")
+    return (
+      <div className="lpf-page">
+        <div className="lpf-card lpf-card--quiet" />
+      </div>
+    );
+
+  if (phase === "gone")
+    return (
+      <div className="lpf-page">
+        <div className="lpf-card">
+          <h1 className="lpf-title">This form is not available</h1>
+          {/* ONE line (DESIGN.md §4). There is nothing this person can do about it and no
+              detail we may safely give, so the page does not pretend otherwise. */}
+          <p className="lpf-desc">The link may have expired or been turned off.</p>
+        </div>
+      </div>
+    );
+
+  if (phase === "sent")
+    return (
+      <div className="lpf-page">
+        <div className="lpf-card">
+          <h1 className="lpf-title">Thank you</h1>
+          <p className="lpf-desc">Your response has been recorded.</p>
+          <button
+            type="button"
+            className="lpf-btn"
+            onClick={() => {
+              setValues({});
+              setPhase("ready");
+            }}
+          >
+            Submit another
+          </button>
+        </div>
+      </div>
+    );
+
+  if (!spec) return null;
+
+  return (
+    <div className="lpf-page">
+      <form className="lpf-card" onSubmit={submit}>
+        <h1 className="lpf-title">{spec.title || "Form"}</h1>
+        {spec.desc && <p className="lpf-desc">{spec.desc}</p>}
+
+        {spec.fields.map((f) => (
+          <label key={f.key} className="lpf-field">
+            <span className="lpf-label">
+              {f.label}
+              {f.required && <span className="lpf-req" aria-hidden> *</span>}
+            </span>
+            <FieldControl field={f} value={values[f.key] ?? ""} onChange={set} />
+          </label>
+        ))}
+
+        {/* ⛔ THE HONEYPOT. Off-screen rather than `display:none` — several bot frameworks skip
+            hidden inputs on purpose, and a trap they know to skip is not a trap. `tabIndex={-1}`
+            and `aria-hidden` keep it away from a keyboard user and a screen reader alike, and
+            `autoComplete="off"` stops a browser filling it for a real person, which would
+            silently drop their submission. */}
+        <input
+          className="lpf-hp"
+          type="text"
+          name={spec.honeypot}
+          value={values[spec.honeypot] ?? ""}
+          onChange={(e) => set(spec.honeypot, e.target.value)}
+          tabIndex={-1}
+          autoComplete="off"
+          aria-hidden
+        />
+
+        {error && <p className="lpf-err">{error}</p>}
+        <button type="submit" className="lpf-btn lpf-btn--primary" disabled={busy}>
+          {busy ? "Sending…" : spec.submitLabel || "Submit"}
+        </button>
+        <p className="lpf-brand">Loopable</p>
+      </form>
+    </div>
+  );
+}
+
+/** One control per server type string. An unrecognised type falls through to text — see the
+ *  `FormField.type` note: a stranger can always type an answer, and a blank where a control
+ *  should be is the one failure they cannot work around. */
+function FieldControl({
+  field,
+  value,
+  onChange,
+}: {
+  field: FormField;
+  value: string;
+  onChange: (key: string, v: string) => void;
+}) {
+  const common = {
+    className: "lpf-input",
+    value,
+    required: field.required,
+    onChange: (e: { target: { value: string } }) => onChange(field.key, e.target.value),
+  };
+  switch (field.type) {
+    case "checkbox":
+      return (
+        <input
+          type="checkbox"
+          className="lpf-check"
+          checked={value === "1"}
+          onChange={(e) => onChange(field.key, e.target.checked ? "1" : "")}
+        />
+      );
+    case "select":
+    case "status":
+      return (
+        <select {...common} className="lpf-input lpf-select">
+          {/* An explicit empty option, always. A `<select>` with no blank member has its first
+              choice pre-selected, so an untouched optional field silently submits a value the
+              person never picked. */}
+          <option value="">{field.required ? "Choose…" : "—"}</option>
+          {(field.options ?? []).map((o) => (
+            <option key={o} value={o}>{o}</option>
+          ))}
+        </select>
+      );
+    case "int":
+    case "currency":
+    case "pct":
+    case "rating":
+      return <input {...common} type="number" inputMode="decimal" />;
+    case "date":
+      // ⚠ `type="date"` submits ISO (`YYYY-MM-DD`) whatever the browser DISPLAYS, which is
+      // exactly what the server's refuse-never-coerce date check demands. A text input here
+      // would send whatever the locale suggested and be refused on half the planet.
+      return <input {...common} type="date" />;
+    case "email":
+      return <input {...common} type="email" inputMode="email" />;
+    case "phone":
+      return <input {...common} type="tel" inputMode="tel" />;
+    case "url":
+      return <input {...common} type="url" inputMode="url" />;
+    case "text":
+      return (
+        <textarea
+          {...common}
+          className="lpf-input lpf-textarea"
+          rows={value.length > 60 ? 4 : 2}
+          minLength={LONG_TEXT_MIN}
+        />
+      );
+    default:
+      return <input {...common} type="text" />;
+  }
+}

web/src/home/HomePage.tsx

@@ -0,0 +1,299 @@
+// ---------------------------------------------------------------------------
+// home/HomePage.tsx — WAVE 23 item 9 (ruling R7, contract C10): the landing.
+//
+// The layout is `reference/Airtable Home.png`, in OUR tokens: an `h1`, a row of
+// quick-start cards, then the recently-opened databases under Today / Past 7
+// days / Older, with a list/grid toggle. Nothing is copied but the ANATOMY —
+// every colour, size and weight is the Loopable palette (R1's rule for the
+// builder, applied here for the same reason).
+//
+// ⛔ THIS PAGE IS CHROME, NOT A GRANTED SURFACE, and the distinction is the one
+// the shell's oldest law turns on (`Shell.tsx` :1039 — "the nav is
+// server-filtered and an undeclared surface is denied"). Home does not violate
+// that law because it cannot: every database it names is resolved from the
+// `entries` the server returned (`homeModel.groupRecents` drops a recent whose
+// key is not in them), and the four cards open doors the rail already offered.
+// There is no payload here that `GET /nav` did not send.
+//
+// It holds NO state of its own beyond the layout toggle. The recents come down
+// with the nav; the four actions are the frame's, because the frame owns the
+// dialogs and the hash.
+// ---------------------------------------------------------------------------
+
+import { useEffect, useState } from "react";
+import { FolderMark } from "../customer-grid/icons";
+import { dbChipClass } from "../shell/nav";
+import type { NavEntry, Recent } from "../shell/nav";
+import {
+  HOME_LAYOUT_KEY,
+  groupRecents,
+  parseLayout,
+} from "./homeModel";
+import type { HomeLayout } from "./homeModel";
+
+// ── the four quick-start marks ───────────────────────────────────────────────────────────────
+//
+// Drawn here, in the same 16x16 stroke vocabulary as the rail's `DbIcon`/`AutoIcon`/`BellIcon`
+// — the established pattern in this tree (the shell and the alerts pane each draw their own
+// bell rather than sharing an icon module). DESIGN.md's rule is "extend the set, don't import a
+// new icon language", and these are the same language: 16x16, `currentColor` strokes, no fills,
+// no emoji.
+
+/** Templates — stacked sheets, the thing a template gives you. */
+function TemplateIcon() {
+  return (
+    <svg className="home-card-icon" viewBox="0 0 16 16" aria-hidden="true">
+      <rect x="2.2" y="4.4" width="11.6" height="9.2" rx="1.4" />
+      <path d="M4.4 4.4V2.6h9.4v9.2h-1.8M2.2 7.6h11.6" />
+    </svg>
+  );
+}
+
+/** A blank database — the rail's cylinder with the plus that makes one. */
+function NewDbIcon() {
+  return (
+    <svg className="home-card-icon" viewBox="0 0 16 16" aria-hidden="true">
+      <ellipse cx="6.6" cy="3.7" rx="4.4" ry="1.8" />
+      <path d="M2.2 3.7v6.6c0 1 2 1.8 4.4 1.8" />
+      <path d="M11 3.7v3.1" />
+      <path d="M11.6 10.4v4M9.6 12.4h4" />
+    </svg>
+  );
+}
+
+/** An automated database — two nodes and the edge between them, the rail's `AutoIcon` family. */
+function AutomatedIcon() {
+  return (
+    <svg className="home-card-icon" viewBox="0 0 16 16" aria-hidden="true">
+      <rect x="1.9" y="5.4" width="4.6" height="5.2" rx="1.1" />
+      <rect x="9.5" y="5.4" width="4.6" height="5.2" rx="1.1" />
+      <path d="M6.5 8h3" />
+    </svg>
+  );
+}
+
+/** Connect a source — two links of a chain, which is what a connector is. */
+function ConnectIcon() {
+  return (
+    <svg className="home-card-icon" viewBox="0 0 16 16" aria-hidden="true">
+      <path d="M6.7 9.3 9.3 6.7" />
+      <path d="M7.6 4.6 9.1 3.1a2.7 2.7 0 0 1 3.8 3.8l-1.5 1.5" />
+      <path d="M8.4 11.4l-1.5 1.5a2.7 2.7 0 0 1-3.8-3.8l1.5-1.5" />
+    </svg>
+  );
+}
+
+/** The two layout marks: rows, and a 2x2 of tiles. The reference pair, in our stroke weight. */
+function ListIcon() {
+  return (
+    <svg viewBox="0 0 16 16" aria-hidden="true" className="home-layout-icon">
+      <path d="M2.6 4.4h10.8M2.6 8h10.8M2.6 11.6h10.8" />
+    </svg>
+  );
+}
+
+function GridIcon() {
+  return (
+    <svg viewBox="0 0 16 16" aria-hidden="true" className="home-layout-icon">
+      <rect x="2.5" y="2.5" width="4.6" height="4.6" rx="1" />
+      <rect x="8.9" y="2.5" width="4.6" height="4.6" rx="1" />
+      <rect x="2.5" y="8.9" width="4.6" height="4.6" rx="1" />
+      <rect x="8.9" y="8.9" width="4.6" height="4.6" rx="1" />
+    </svg>
+  );
+}
+
+/**
+ * One quick-start card. A `<button>` — every one of these opens a dialog or a wizard rather
+ * than navigating, and a link that does not link is a lie the browser's status bar tells.
+ *
+ * ⚠ `type="button"` and the UA reset ride the CLASS (DESIGN.md 4's button rule: a styled
+ * `<button>` sets `border/background/font/color` in its base rule, or it leaks the user agent's
+ * chrome — the wave-19 item-3 "mystery outer lines and tinted fill").
+ */
+function QuickCard({
+  icon,
+  title,
+  detail,
+  onClick,
+}: {
+  icon: React.ReactNode;
+  title: string;
+  /** ONE line. R13: the app does not narrate itself, and this is a passing-through surface. */
+  detail: string;
+  onClick: () => void;
+}) {
+  return (
+    <button type="button" className="home-card" onClick={onClick}>
+      <span className="home-card-head">
+        {icon}
+        <span className="home-card-title">{title}</span>
+      </span>
+      <span className="home-card-detail">{detail}</span>
+    </button>
+  );
+}
+
+export default function HomePage({
+  entries,
+  recents,
+  onTemplates,
+  onNewDatabase,
+  onAutomated,
+  onConnectors,
+}: {
+  /** The SHAPED, server-filtered nav. The only thing a tile may be drawn from. */
+  entries: NavEntry[];
+  recents: Recent[];
+  onTemplates: () => void;
+  onNewDatabase: () => void;
+  onAutomated: () => void;
+  onConnectors: () => void;
+}) {
+  const [layout, setLayout] = useState<HomeLayout>(() => {
+    try {
+      return parseLayout(localStorage.getItem(HOME_LAYOUT_KEY));
+    } catch {
+      return "grid";
+    }
+  });
+  useEffect(() => {
+    try {
+      localStorage.setItem(HOME_LAYOUT_KEY, layout);
+    } catch {
+      // storage can be blocked; the toggle still works for this session
+    }
+  }, [layout]);
+
+  // ⚠ THE CLOCK IS READ ONCE, HERE, AND HANDED IN AS NUMBERS. `homeModel` is pure so a gate can
+  // assert the boundaries (23:59 vs 00:01, exactly seven days) rather than whatever today is.
+  // `todayStart` is the reader's LOCAL midnight — "Today" means the reader's today, which is the
+  // one clock this feature is allowed to consult (see the model's header note).
+  const now = Math.floor(Date.now() / 1000);
+  const midnight = new Date();
+  midnight.setHours(0, 0, 0, 0);
+  const sections = groupRecents(recents, entries, now, Math.floor(midnight.getTime() / 1000));
+
+  return (
+    <div className="shell-home">
+      <h1 className="home-title">Home</h1>
+
+      <div className="home-cards">
+        {/* ⚠ THE DETAIL LINES ARE BYTE-IDENTICAL TO THE DIALOG'S ROWS, and that is deliberate
+            rather than lazy. Each of these cards opens the same door as a row in the
+            New-database dialog, and the first draft described the same two things in four
+            slightly different sentences ("fills and keeps up to date" vs "creates and keeps up
+            to date"; "ready-made views" vs "a curated set of views"). Two words for one thing is
+            how a reader concludes they are two things — DESIGN.md 1's "variety is a defect".
+            The TITLES do differ, and that is a register difference the reference makes too: a
+            card is an invitation ("Start with templates"), a menu row is a choice ("From a
+            template"). */}
+        <QuickCard
+          icon={<TemplateIcon />}
+          title="Start with templates"
+          detail="Add a curated set of views to a database you already have."
+          onClick={onTemplates}
+        />
+        <QuickCard
+          icon={<NewDbIcon />}
+          title="New database"
+          detail="A blank database in this workspace."
+          onClick={onNewDatabase}
+        />
+        <QuickCard
+          icon={<AutomatedIcon />}
+          title="Automated database"
+          detail="A database an automation creates and keeps up to date."
+          onClick={onAutomated}
+        />
+        <QuickCard
+          icon={<ConnectIcon />}
+          title="Connect a source"
+          detail="Browse the connectors this workspace can use."
+          onClick={onConnectors}
+        />
+      </div>
+
+      <div className="home-recents-bar">
+        {/* The reference puts an "Opened anytime" filter here. We do not have one and do not
+            pretend to: a control that filters nothing is worse than no control. The toggle is
+            the real affordance, so it sits alone. */}
+        <div className="home-layout-toggle" role="group" aria-label="Layout">
+          <button
+            type="button"
+            className={"home-layout-btn" + (layout === "list" ? " is-on" : "")}
+            aria-pressed={layout === "list"}
+            aria-label="List"
+            title="List"
+            onClick={() => setLayout("list")}
+          >
+            <ListIcon />
+          </button>
+          <button
+            type="button"
+            className={"home-layout-btn" + (layout === "grid" ? " is-on" : "")}
+            aria-pressed={layout === "grid"}
+            aria-label="Grid"
+            title="Grid"
+            onClick={() => setLayout("grid")}
+          >
+            <GridIcon />
+          </button>
+        </div>
+      </div>
+
+      {sections.length === 0 ? (
+        // ⛔ ONE LINE, AND IT NAMES THE DOOR THAT FILLS IT (DESIGN.md 4 / R13). This is also
+        // where wave 18's tenant hero went: a workspace with no databases lands here, and the
+        // cards above ARE the "create your first database" affordance the hero carried. Two
+        // welcome messages on one screen is the bug Shell.tsx:1321-1326 already documents.
+        <p className="home-empty">
+          {entries.length === 0
+            ? "This workspace has no databases yet — create one above, or connect a source."
+            : "Nothing opened yet. The databases you open appear here."}
+        </p>
+      ) : (
+        sections.map((section) => (
+          <section key={section.id} className="home-section">
+            <h2 className="home-section-title">{section.title}</h2>
+            <div className={"home-tiles is-" + layout}>
+              {section.tiles.map((tile) => (
+                <a
+                  key={tile.key}
+                  className="home-tile"
+                  href={tile.href}
+                  {...(tile.external ? { target: "_blank", rel: "noreferrer" } : {})}
+                >
+                  {/* The SAME chip family as the database header and the rail row
+                      (`dbChipClass` → `.shell-db-chip` + its tone), so a database looks like
+                      itself everywhere. DESIGN.md 4: new elements join the existing rhythm,
+                      never a new control shape. The chosen mark wins when there is one; two
+                      letters otherwise, which is what the reference tiles show.
+
+                      ⛔ AND THOSE TWO BRANCHES CARRY A CONTRAST RULE — DO NOT "SIMPLIFY" THEM
+                      APART. `dbChipClass` returns a TONE class only when there IS an icon, and
+                      an icon is exactly when we draw a GLYPH. That matters because the tones are
+                      measured for a graphical object, not for text: white on `--lp-blue-deep` is
+                      3.29:1 (the stylesheet publishes every pairing beside its declaration) —
+                      over the 3:1 bar a 16px glyph must clear, UNDER the 4.5:1 bar 12px letters
+                      must. The fallback branch has no icon, so it takes the BASE chip
+                      (`--lp-primary`, 7.71:1) and that is where the letters go. Forcing a tone
+                      onto the initials, or letters onto a toned chip, would put 12px text at
+                      3.29:1 on screen. The two branches agree by construction; keep them
+                      agreeing. */}
+                  <span className={dbChipClass(tile.icon) + " home-tile-chip"} aria-hidden="true">
+                    {tile.icon ? <FolderMark icon={tile.icon} size={16} /> : tile.initials}
+                  </span>
+                  <span className="home-tile-text">
+                    <span className="home-tile-name">{tile.label}</span>
+                    <span className="home-tile-ago">{tile.ago}</span>
+                  </span>
+                </a>
+              ))}
+            </div>
+          </section>
+        ))
+      )}
+    </div>
+  );
+}

web/src/home/TemplatePicker.tsx

@@ -0,0 +1,217 @@
+// ---------------------------------------------------------------------------
+// home/TemplatePicker.tsx — WAVE 23 item 7 (R10, contract C12, wiring W23-W6).
+//
+// A template is a bundle of SAVED VIEWS applied to a database you already have —
+// it does not create a table. So the picker asks two questions in the order a
+// person actually answers them: WHICH DATABASE, then WHICH TEMPLATE. The second
+// list is a function of the first, because the server filters templates by the
+// target's real columns (`view_templates.missing_columns`), and offering one the
+// apply door would refuse is a control that lies.
+//
+// It renders inside the New-database dialog's "From a template" mode rather than
+// as a third modal: one dialog, several doors (DESIGN.md §4 — new elements join
+// the existing rhythm).
+// ---------------------------------------------------------------------------
+
+import { useEffect, useState } from "react";
+import { API_V1, CREDENTIALS } from "../apiContract";
+import type { NavEntry } from "../shell/nav";
+
+/** One row of `GET /templates?table=` — the server's vocabulary, read as strings (the wave-9
+ *  law: no client union over a server list). */
+interface TemplateRow {
+  key: string;
+  label: string;
+  desc: string;
+  source: string;
+  views: number;
+  alert: boolean;
+}
+
+type Load =
+  | { phase: "idle" }
+  | { phase: "loading" }
+  | { phase: "ready"; rows: TemplateRow[] }
+  | { phase: "error"; message: string };
+
+function parseRows(body: unknown): TemplateRow[] {
+  const raw = (body as { templates?: unknown } | null)?.templates;
+  if (!Array.isArray(raw)) return [];
+  const out: TemplateRow[] = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const t = item as Record<string, unknown>;
+    const key = typeof t.key === "string" ? t.key : "";
+    const label = typeof t.label === "string" ? t.label : "";
+    if (!key || !label) continue;
+    out.push({
+      key,
+      label,
+      desc: typeof t.desc === "string" ? t.desc : "",
+      source: typeof t.source === "string" ? t.source : "",
+      views: typeof t.views === "number" ? t.views : 0,
+      alert: t.alert === true,
+    });
+  }
+  return out;
+}
+
+export default function TemplatePicker({
+  entries,
+  onToast,
+  onDone,
+}: {
+  /** The databases this session may open — the shaped, server-filtered nav, minus Automation. */
+  entries: NavEntry[];
+  onToast: (message: string) => void;
+  /** Applied: close the dialog and open the database, where the new views now are. */
+  onDone: (tableKey: string) => void;
+}) {
+  // Only real destinations: a group head is a folder label with no table behind it.
+  const tables = entries.filter((e) => e.kind === "native");
+  const [table, setTable] = useState(tables[0]?.key ?? "");
+  const [load, setLoad] = useState<Load>({ phase: "idle" });
+  const [busy, setBusy] = useState("");
+
+  useEffect(() => {
+    if (!table) {
+      setLoad({ phase: "ready", rows: [] });
+      return;
+    }
+    let dead = false;
+    setLoad({ phase: "loading" });
+    void (async () => {
+      try {
+        const res = await fetch(
+          `${API_V1}/templates?table=${encodeURIComponent(table)}`,
+          { credentials: CREDENTIALS }
+        );
+        const body = (await res.json().catch(() => null)) as
+          | { error?: { message?: string } }
+          | null;
+        if (dead) return;
+        if (!res.ok) {
+          setLoad({
+            phase: "error",
+            message: body?.error?.message || `The server answered ${res.status}.`,
+          });
+          return;
+        }
+        setLoad({ phase: "ready", rows: parseRows(body) });
+      } catch {
+        if (!dead) setLoad({ phase: "error", message: "Cannot reach the server." });
+      }
+    })();
+    return () => {
+      dead = true;
+    };
+  }, [table]);
+
+  const apply = (key: string) => {
+    setBusy(key);
+    void (async () => {
+      try {
+        const res = await fetch(
+          `${API_V1}/templates/${encodeURIComponent(key)}/apply`,
+          {
+            method: "POST",
+            credentials: CREDENTIALS,
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ table }),
+          }
+        );
+        const body = (await res.json().catch(() => null)) as
+          | { views?: { name?: string }[]; alerted?: boolean; error?: { message?: string } }
+          | null;
+        setBusy("");
+        if (!res.ok) {
+          // ⚠ THE SERVER'S SENTENCE, VERBATIM. A refusal here names the COLUMNS the target is
+          // missing, which is the only thing that tells the reader they picked the wrong
+          // database — replacing it with "could not apply" would throw that away.
+          onToast(body?.error?.message || `The server answered ${res.status}.`);
+          return;
+        }
+        const n = (body?.views ?? []).length;
+        onToast(
+          `${n} view${n === 1 ? "" : "s"} added.` +
+            (body?.alerted ? " An alert is now watching the first one." : "")
+        );
+        onDone(table);
+      } catch {
+        setBusy("");
+        onToast("Cannot reach the server.");
+      }
+    })();
+  };
+
+  // ⛔ A WORKSPACE WITH NO DATABASES IS NOT "NO TEMPLATE FITS". Without this branch the select
+  // renders empty, `table` is "", the fetch is skipped, and the reader is told
+  // "No template fits this database's columns." about a database they do not have — a false
+  // sentence, on the FIRST thing a brand-new workspace can click (Home's "Start with templates"
+  // card sits on exactly the empty state the tenant hero used to own). The distinction is the
+  // same one the Database flyout already makes between a search that matched nothing and a
+  // workspace that holds nothing; this branch is the third place it has to be made.
+  if (tables.length === 0) {
+    return (
+      <p className="home-tpl-note">
+        A template adds views to a database. Create one first — "Blank" above.
+      </p>
+    );
+  }
+
+  return (
+    <div className="home-tpl">
+      <label className="home-tpl-target">
+        <span className="home-tpl-label">Apply to</span>
+        {/* ⚠ A `<select>` MUST CARRY ITS VALUE. A select rendered without one shows its FIRST
+            option while the state says something else — the wave-22 scar ([[cg-condition-builder-items]]);
+            the control then reads as "customer_data" and applies to whatever `table` happens to
+            hold. Bound, not defaulted. */}
+        <select
+          className="home-tpl-select"
+          value={table}
+          onChange={(e) => setTable(e.target.value)}
+        >
+          {tables.map((t) => (
+            <option key={t.key} value={t.key}>
+              {t.label}
+            </option>
+          ))}
+        </select>
+      </label>
+
+      {load.phase === "loading" ? (
+        <div className="home-tpl-note">
+          <span className="lp-spin" role="status" aria-label="Loading" />
+        </div>
+      ) : null}
+      {load.phase === "error" ? <p className="shell-newdb-err">{load.message}</p> : null}
+      {load.phase === "ready" && load.rows.length === 0 ? (
+        // ONE line (R13). And it says the RIGHT thing: nothing fits THIS database, which is not
+        // the same as "there are no templates".
+        <p className="home-tpl-note">No template fits this database's columns.</p>
+      ) : null}
+
+      {load.phase === "ready" && load.rows.length > 0 ? (
+        <ul className="home-tpl-list">
+          {load.rows.map((row) => (
+            <li key={row.key} className="home-tpl-row">
+              <span className="home-tpl-text">
+                <span className="home-tpl-name">{row.label}</span>
+                <span className="home-tpl-desc">{row.desc}</span>
+              </span>
+              <button
+                type="button"
+                className="login-submit home-tpl-apply"
+                disabled={!!busy}
+                onClick={() => apply(row.key)}
+              >
+                {busy === row.key ? "Adding…" : `Add ${row.views}`}
+              </button>
+            </li>
+          ))}
+        </ul>
+      ) : null}
+    </div>
+  );
+}

web/src/home/homeModel.ts

@@ -0,0 +1,208 @@
+// ---------------------------------------------------------------------------
+// home/homeModel.ts — WAVE 23 item 9 (ruling R7, contract C10): the Home
+// landing's PURE half. React-free and fetch-free, so `verify_home.py` can run it
+// under node the way `verify_alerts.py` runs the inbox model.
+//
+// Everything here is a function of values that were passed in — including the
+// clock. `todayStart` and `now` are PARAMETERS, never `Date.now()` calls, for two
+// reasons that pull the same way:
+//
+//   · a gate can then assert the boundary cases (23:59 vs 00:01, exactly seven
+//     days) instead of asserting whatever today happens to be;
+//   · [[date-window-vocabulary]]'s standing rule — `today` is a parameter — was
+//     written for the server's window vocabulary and holds just as well here.
+//
+// ⚠ THE ONE CLOCK THIS FEATURE MAY READ IS THE READER'S OWN, and that is not a
+// contradiction of `alertsModel.stampText`'s "never touch a clock". Two different
+// statements: a notification re-states WHEN A SERVER EVENT HAPPENED (re-deriving
+// it in the browser is how a tenant a day ahead gets told an event happened
+// tomorrow), while "Opened 30 minutes ago" states HOW LONG AGO THE READER
+// THEMSELVES DID SOMETHING, and the Today bucket means the reader's today. The
+// component reads the clock once and hands the numbers in here.
+// ---------------------------------------------------------------------------
+
+import type { NavEntry, Recent } from "../shell/nav";
+import type { FolderIcon } from "../customer-grid/types";
+
+/** One rendered recents tile: the RESOLVED database, never the raw stamp. */
+export interface RecentTile {
+  key: string;
+  label: string;
+  icon?: FolderIcon;
+  /** Epoch seconds, as stored. Kept so a tile can be re-sorted without re-fetching. */
+  at: number;
+  /** "Opened 30 minutes ago" — already assembled, so the component holds no clock logic. */
+  ago: string;
+  /** The chip's two letters. */
+  initials: string;
+  /**
+   * The entry's OWN href, carried through rather than rebuilt as `#/${key}`.
+   *
+   * ⛔ A TILE THAT REBUILDS ITS OWN LINK IS A SECOND ROUTER. `shapeNav` already decided what a
+   * key resolves to — `#/key` for a native surface, the current application's deep link for a
+   * hand-off — and a `#/${key}` assembled here would send a hand-off row to a hash this shell
+   * cannot render. Today only native keys are ever stamped (the frame stamps `active.kind ===
+   * "native"` alone), so this is defence rather than a fix; it costs one field and removes the
+   * class.
+   */
+  href: string;
+  /** A hand-off opens the current application in a new tab, and the tile says so. */
+  external: boolean;
+}
+
+/** One section of the recents list. `title` is the heading; an EMPTY section is never emitted. */
+export interface RecentSection {
+  id: "today" | "week" | "older";
+  title: string;
+  tiles: RecentTile[];
+}
+
+const SECOND = 1;
+const MINUTE = 60 * SECOND;
+const HOUR = 60 * MINUTE;
+export const DAY = 24 * HOUR;
+
+/** "Past 7 days" means the seven days BEFORE today — today has its own section above it. */
+export const WEEK_DAYS = 7;
+
+/**
+ * The chip's two letters.
+ *
+ * ⚠ `\p{L}\p{N}` AND NOT `[A-Za-z0-9]`, and this shell has already paid for that once: the
+ * account monogram at `Shell.tsx:299` carries the same note, because the Streamlit host's
+ * `_account_css` uses Python's `str.isalnum()` and an ASCII-only class here would give a
+ * non-Latin name an initial in one shell and a blank circle in the other. A database called
+ * "Клиенты" gets "КЛ", not an empty tile.
+ *
+ * Two letters, not one: the reference tiles read "Un" / "Aa", and a single letter over a 26px
+ * chip is a bullet point rather than a name.
+ */
+export function initials(label: string): string {
+  const chars = String(label ?? "").match(/[\p{L}\p{N}]/gu) ?? [];
+  return chars.slice(0, 2).join("").toUpperCase();
+}
+
+/**
+ * "Opened N ago", in the largest unit that is still true.
+ *
+ * Rounds DOWN throughout (`Math.floor`), so a tile never claims more time has passed than has:
+ * at 119 minutes this says "1 hour ago", never "2 hours ago". A stamp in the FUTURE — a clock
+ * skew between the browser and the host — clamps to "just now" rather than rendering a negative
+ * count, which is the only honest thing a relative label can say about it.
+ */
+export function agoText(at: number, now: number): string {
+  const d = Math.max(0, Math.floor(now) - Math.floor(at));
+  if (d < MINUTE) return "Opened just now";
+  const unit = (n: number, one: string) => `Opened ${n} ${one}${n === 1 ? "" : "s"} ago`;
+  if (d < HOUR) return unit(Math.floor(d / MINUTE), "minute");
+  if (d < DAY) return unit(Math.floor(d / HOUR), "hour");
+  return unit(Math.floor(d / DAY), "day");
+}
+
+/**
+ * Which section a stamp belongs to.
+ *
+ * `todayStart` is the epoch second of the reader's LOCAL midnight — computed once by the
+ * component, so the boundary is the reader's calendar day rather than UTC's. Anything at or
+ * after it is Today; the seven days before that are the week; everything else is Older.
+ */
+export function bucketOf(at: number, todayStart: number): RecentSection["id"] {
+  if (at >= todayStart) return "today";
+  if (at >= todayStart - WEEK_DAYS * DAY) return "week";
+  return "older";
+}
+
+const TITLES: Record<RecentSection["id"], string> = {
+  today: "Today",
+  week: "Past 7 days",
+  older: "Older",
+};
+
+/**
+ * ⭐ THE C10 LAW, AS CODE: Home renders ONLY what `/nav` already granted.
+ *
+ * A recent is a KEY and a TIME. Everything a tile shows — its name, its chosen mark, whether it
+ * exists at all — is resolved from `entries`, which is the shaped, server-filtered nav payload.
+ * So a database that was revoked, deleted, or never belonged to this account cannot appear on
+ * Home even though its stamp is still in the reader's own recents bucket: there is nothing here
+ * to draw it FROM.
+ *
+ * That is what makes `#/home` chrome rather than a surface. The server prunes on read as well
+ * (`routes_nav._read_recents`), so this is the second of two walls rather than the only one —
+ * but it is the one that would still hold if the payload ever widened.
+ *
+ * ⛔ GROUP HEADS ARE EXCLUDED. A `kind: "group"` entry is a folder label with no destination;
+ * a tile for one would be a card you cannot open. `defaultRoute` makes the same distinction.
+ */
+export function groupRecents(
+  recents: Recent[],
+  entries: NavEntry[],
+  now: number,
+  todayStart: number
+): RecentSection[] {
+  const byKey = new Map(entries.filter((e) => e.kind !== "group").map((e) => [e.key, e]));
+  const buckets: Record<RecentSection["id"], RecentTile[]> = { today: [], week: [], older: [] };
+  for (const r of [...recents].sort((a, b) => b.at - a.at)) {
+    const entry = byKey.get(r.key);
+    // No entry, or an entry with nowhere to go: not a tile. `href` is absent only on a group
+    // head, which the map above already excluded — this is the type-level restatement of that,
+    // and it means a tile always has a destination rather than being a card that does nothing.
+    if (!entry || !entry.href) continue;
+    buckets[bucketOf(r.at, todayStart)].push({
+      key: entry.key,
+      label: entry.label,
+      ...(entry.icon ? { icon: entry.icon } : {}),
+      at: r.at,
+      ago: agoText(r.at, now),
+      initials: initials(entry.label),
+      href: entry.href,
+      external: entry.kind === "handoff",
+    });
+  }
+  const out: RecentSection[] = [];
+  for (const id of ["today", "week", "older"] as const) {
+    // An empty section is not rendered. A heading with nothing under it says "there should be
+    // something here", which is a different (and false) statement from "you have not opened
+    // anything today".
+    if (buckets[id].length) out.push({ id, title: TITLES[id], tiles: buckets[id] });
+  }
+  return out;
+}
+
+/**
+ * The server's recents, plus the stamps THIS SESSION made since the nav was fetched.
+ *
+ * ⛔ WITHOUT THIS, HOME IS ALWAYS ONE NAVIGATION STALE — and it is the wave's headline feature
+ * that would be stale. `recents` rides the `GET /nav` payload (one round trip per sign-in, per
+ * `navEpoch` bump), while the stamp is a fire-and-forget POST that changes nothing the client
+ * holds. So: open a database, go Home, and the database you just opened is not in Today. The
+ * alternative — refetching the whole nav on every route change to pick up one integer — is a
+ * request per navigation for a decoration.
+ *
+ * LOCAL WINS ON A KEY, always: it is strictly newer by construction (it happened after the
+ * fetch). And it is deliberately NOT persisted anywhere — a reload re-asks the server, which is
+ * the only end that actually knows.
+ */
+export function mergeRecents(server: Recent[], local: Record<string, number>): Recent[] {
+  const byKey = new Map<string, number>();
+  for (const r of server) byKey.set(r.key, r.at);
+  for (const [key, at] of Object.entries(local)) {
+    const cur = byKey.get(key);
+    if (cur === undefined || at > cur) byKey.set(key, at);
+  }
+  return [...byKey.entries()]
+    .map(([key, at]) => ({ key, at }))
+    .sort((a, b) => b.at - a.at);
+}
+
+// ── the list/grid toggle ────────────────────────────────────────────────────────────────────
+
+export type HomeLayout = "grid" | "list";
+
+/** Per-browser, like the nav's collapsed state — a display preference, not account state. */
+export const HOME_LAYOUT_KEY = "aios-home-layout";
+
+/** Anything unrecognised reads as `grid`, which is the reference layout and the denser one. */
+export function parseLayout(raw: unknown): HomeLayout {
+  return raw === "list" ? "list" : "grid";
+}

web/src/settings/permsModel.ts

@@ -152,6 +152,10 @@ const FIELD_TYPE_TABLE: Record<FieldType, true> = {
   // names is a listing here. Nowhere near `SettingsSection` / the rail, which is B's half of
   // this file.
   image: true,
+  // Wave-23 C7 (added by session D — `settings/**` is frozen this wave and this ONE key is the
+  // exception the freeze cannot cover: the alarm four lines up is a COMPILE error, so the union
+  // and this listing cannot land in two different changes. Posted in D's mailbox for C.)
+  json: true,
 };
 
 export const KNOWN_FIELD_TYPES: ReadonlySet<string> = new Set(Object.keys(FIELD_TYPE_TABLE));

web/src/shell/Shell.tsx

@@ -31,21 +31,30 @@
 // ---------------------------------------------------------------------------
 
 import { useCallback, useEffect, useRef, useState } from "react";
-import type { MouseEvent as ReactMouseEvent } from "react";
+import { createPortal } from "react-dom";
+import type { MouseEvent as ReactMouseEvent, ReactNode } from "react";
 import AutomationSurface from "../automation/AutomationSurface";
 import CustomerGrid from "../customer-grid/CustomerGrid";
 import { clearCustomersCache } from "../customer-grid/apiBridge";
 import { OverlayProvider } from "../customer-grid/OverlaySurface";
 // ROWS_STALE_EVENT left with `addRecord` (wave 20 item 4): the shell no longer writes rows,
 // so it no longer has to tell the grid that it did.
-import { API_V1, CREDENTIALS, DATA_ERROR_EVENT, NAV_MINIMIZE_EVENT, TOAST_EVENT, UNAUTHORIZED_EVENT } from "../apiContract";
+import { API_V1, AUTOMATION_CREATE_EVENT, AUTOMATION_OPEN_EVENT, CREDENTIALS, DATA_ERROR_EVENT, NAV_MINIMIZE_EVENT, TOAST_EVENT, UNAUTHORIZED_EVENT, signal } from "../apiContract";
 import { PageSurface } from "../pages/PageSurface";
 import { SettingsModal } from "../settings/SettingsModal";
 import type { SettingsSection } from "../settings/SettingsModal";
 import { Brand } from "./Brand";
 import LoginPage from "./LoginPage";
-import { EMPTY_NAV_PREFS, ENVELOPE_KEYS, MAX_NAV_FOLDERS, appLink, dbChipClass, defaultRoute, deleteTable, fetchNav, fetchNavPrefs, fetchTableFootprint, foldNav, resolveRoute, saveNavMeta, saveNavPrefs, shapeNav, splitChrome } from "./nav";
-import type { NavEntry, NavMetaPatch, NavPage, NavPrefs } from "./nav";
+import { CONNECTORS_ROUTE, EMPTY_NAV_PREFS, ENVELOPE_KEYS, HOME_ROUTE, MAX_NAV_FOLDERS, appLink, dbChipClass, defaultRoute, deleteTable, fetchNav, fetchNavPrefs, fetchTableFootprint, foldNav, postOpened, resolveRoute, saveNavMeta, saveNavPrefs, shapeNav, splitChrome } from "./nav";
+import type { NavEntry, NavMetaPatch, NavPage, NavPrefs, Recent } from "./nav";
+import HomePage from "../home/HomePage";
+import TemplatePicker from "../home/TemplatePicker";
+import ConnectorsPage from "../connectors/ConnectorsPage";
+// WAVE 23 C9 (W23-W2) — SESSION D's public page. A STATIC import, not a lazy one: the wave's own
+// rule is that a required import fails the build when the file is not there, which is the whole
+// difference between a mount and an intention (verify_wiring's header).
+import FormPublic from "../forms/FormPublic";
+import { mergeRecents } from "../home/homeModel";
 import { CreateNewRow, FolderHead, RowMenu, SchemaDrawer } from "./NavExtras";
 import AlertsPane from "../alerts/AlertsPane";
 import { createAlert, fetchInbox } from "../alerts/alertsApi";
@@ -83,6 +92,71 @@ const NAV_DRAG_TYPE = "application/x-loopable-nav";
 /** A stable identity for "no nav yet" — see its use below. */
 const NO_ENTRIES: NavEntry[] = [];
 
+/**
+ * WAVE 23 C10 — the Database flyout's anchor, CLAMPED to the viewport.
+ *
+ * ⛔ `NavExtras.MenuShell` clamps both axes and this panel first did not, which is the same
+ * omission with a bigger blast radius: the Database button sits ~200px down the rail and the
+ * panel is up to 560px tall, so on a short laptop viewport its create footer — the three rows
+ * that are the whole point of the redesign — lands below the fold with no way to scroll to it
+ * (the panel's own scroll is INSIDE the list, deliberately, so the footer stays put).
+ *
+ * The height here is the CSS `max-height: min(70vh, 560px)`, restated. Two copies of one number
+ * is a real cost; the alternative is measuring the panel after it mounts, which means rendering
+ * it in the wrong place for a frame. Named and kept beside the rule it mirrors.
+ */
+const DBFLY_MAX_H = 560;
+
+export function flyoutAt(rect: { right: number; top: number }, vw: number, vh: number) {
+  const h = Math.min(Math.round(vh * 0.7), DBFLY_MAX_H);
+  return {
+    x: Math.min(Math.round(rect.right + 6), Math.max(8, vw - 268 - 8)),
+    y: Math.max(8, Math.min(Math.round(rect.top), vh - h - 8)),
+  };
+}
+
+/**
+ * ⭐ THE ONE PLACE the Database flyout's position is measured off its button (wave-23 close-out).
+ *
+ * Two open-paths grew this wave — the button's own click, and "+ Create new…" opening the panel so
+ * a just-named folder is visible — and each measured the element itself. That is the shape D-20
+ * exists to prevent, one pattern over: **the null case and the measurement should live in exactly
+ * one place**, or the second caller is one refactor away from forgetting the guard.
+ *
+ * ⚠ Honest note on the gate, because the fix should not be mistaken for a rename. `verify_overlay`
+ * greps for a LITERAL token — a variable named `anchor`, followed by a measure call — so the
+ * click-path (which reads `e.currentTarget`) always passed while the ref-path failed. The needle
+ * is a proxy for "a call site measured its own anchor", and a proxy can be satisfied by renaming a
+ * variable. This change satisfies it STRUCTURALLY instead: there is now one measurement, one null
+ * guard, and no second call site to keep honest. Booked as DEBT (D-49) so the gate's real subject
+ * (anchor-rect logic outside the overlay layer) can be tightened deliberately rather than by grep.
+ *
+ * ⛔ AND DO NOT SPELL THE TOKEN OUT IN THIS COMMENT. The first draft of this note quoted the exact
+ * string it was describing, and the gate — which greps raw file text — matched the explanation and
+ * went red on a file with no defect in it. Prose about a pattern IS the pattern to a text scan;
+ * the same trap as a marker comment placed mid-selector (verify_catalog, wave 21).
+ */
+export function flyoutFrom(el: HTMLElement | null) {
+  if (!el) return null;
+  return flyoutAt(el.getBoundingClientRect(), window.innerWidth, window.innerHeight);
+}
+
+/**
+ * WAVE 23 C9 (wiring W23-W2) — the PUBLIC form route: `#/form/<token>`.
+ *
+ * ⛔ THE TOKEN IS WHITELISTED, NOT SLICED. `secrets.token_urlsafe` mints `[A-Za-z0-9_-]`, so
+ * anything else in that position is not a token this product issued — and passing it through
+ * would let a crafted hash decide what `FormPublic` puts in a URL. Refusing here means the frame
+ * falls through to its normal routing (and the visitor meets the login page), which is the
+ * correct answer for a link that is not one of ours.
+ *
+ * `null` for every other route, so the branch that reads it is a single truthiness test.
+ */
+export function formTokenOf(route: string): string | null {
+  const m = /^form\/([A-Za-z0-9_-]{8,128})$/.exec(route);
+  return m ? m[1] : null;
+}
+
 type Session =
   | { phase: "checking" }
   | { phase: "anon" }
@@ -91,10 +165,19 @@ type Session =
 type Nav =
   | { phase: "idle" }
   | { phase: "loading" }
-  | { phase: "ready"; entries: NavEntry[]; utility: NavPage[]; empty?: string }
+  | {
+      phase: "ready";
+      entries: NavEntry[];
+      utility: NavPage[];
+      /** WAVE 23 C10 — the Home landing's recently-opened list, per user, off the nav payload. */
+      recents: Recent[];
+      empty?: string;
+    }
   | { phase: "error" };
 
 const NO_UTILITY: NavPage[] = [];
+/** Stable identity, like `NO_ENTRIES` — a fresh `[]` per render would re-run Home's memo. */
+const NO_RECENTS: Recent[] = [];
 
 function useHashRoute(): string {
   const read = () => window.location.hash.replace(/^#\/?/, "");
@@ -173,7 +256,7 @@ function ExtIcon() {
  * The chip is decorative and says so: the name beside it is real text, so a
  * second announcement of the same fact is noise to a screen reader.
  */
-function DbHead({ label, icon }: { label: string; icon?: FolderIcon }) {
+function DbHead({ label, icon, glyph }: { label: string; icon?: FolderIcon; glyph?: ReactNode }) {
   return (
     <div className="shell-db-head">
       <span className={dbChipClass(icon)} aria-hidden="true">
@@ -181,8 +264,15 @@ function DbHead({ label, icon }: { label: string; icon?: FolderIcon }) {
             the same pair the rail row draws, so the header and the nav agree. Both
             paint in the chip's ink (the stylesheet's two overrides): `FolderMark`
             would otherwise stroke its pastel `-deep`, which is measured against the
-            WHITE rail and disappears on its own tone. */}
-        {icon ? <FolderMark icon={icon} size={16} /> : <DbIcon />}
+            WHITE rail and disappears on its own tone.
+
+            WAVE 23 C13 — `glyph` overrides only the FALLBACK, never a chosen mark, and
+            that ordering is the contract. Automation is not a database and must not wear
+            the cylinder; but it CAN wear a `nav_meta` icon (the rail already draws one,
+            Shell:1026), and a header that ignored it would be the one surface where the
+            rail and the frame disagreed about the same row. So: chosen icon > caller's
+            glyph > the cylinder. */}
+        {icon ? <FolderMark icon={icon} size={16} /> : (glyph ?? <DbIcon />)}
       </span>
       {/* An `h1`, not a styled span: this is the first time the work surface has NAMED itself,
           and the name of the thing you are looking at is what a heading is for. Every other
@@ -242,6 +332,50 @@ function BellIcon() {
   );
 }
 
+/** WAVE 23 R7 — Home's mark. A house, in the same 16x16 stroke vocabulary as its neighbours;
+ *  the reference rail uses one and there is no more literal glyph for "the landing". */
+function HomeIcon() {
+  return (
+    <svg className="shell-nav-icon" viewBox="0 0 16 16" aria-hidden="true">
+      <path d="M2.4 7.2 8 2.6l5.6 4.6" />
+      <path d="M3.9 8.2v5.2h8.2V8.2" />
+    </svg>
+  );
+}
+
+/** WAVE 23 R8 — Connectors: two links of a chain, which is exactly what a connector is. The
+ *  same glyph the Home card draws, so the nav row and the card that leads to it agree. */
+function PlugIcon() {
+  return (
+    <svg className="shell-nav-icon" viewBox="0 0 16 16" aria-hidden="true">
+      <path d="M6.7 9.3 9.3 6.7" />
+      <path d="M7.6 4.6 9.1 3.1a2.7 2.7 0 0 1 3.8 3.8l-1.5 1.5" />
+      <path d="M8.4 11.4l-1.5 1.5a2.7 2.7 0 0 1-3.8-3.8l1.5-1.5" />
+    </svg>
+  );
+}
+
+/** WAVE 23 C10 — the flyout footer's plus. Same geometry as `NavExtras`' own `PlusIcon` (which
+ *  is private to that file); drawn rather than imported, the way this tree already draws two
+ *  bells. */
+function PlusMark() {
+  return (
+    <svg className="shell-dbfly-plus" viewBox="0 0 16 16" aria-hidden="true">
+      <path d="M8 3.4v9.2M3.4 8h9.2" />
+    </svg>
+  );
+}
+
+/** WAVE 23 R7 — the disclosure caret on the "Database" row: this opens a panel, and the mark
+ *  says so before the click does (the same job `ExtIcon` does for a hand-off). */
+function CaretIcon() {
+  return (
+    <svg className="shell-nav-open shell-nav-caret" viewBox="0 0 12 12" aria-hidden="true">
+      <path d="M4.4 2.6 8 6l-3.6 3.4" />
+    </svg>
+  );
+}
+
 /** Owner item 11 — the rail toggle: three horizontal bars. One glyph for both rails (the
  *  views rail draws the same geometry), so "minimize a panel" reads as one idea. */
 function RailToggleIcon() {
@@ -435,6 +569,10 @@ export default function Shell() {
   const [alertsOpen, setAlertsOpen] = useState(false);
   const [inbox, setInbox] = useState<Inbox>(EMPTY_INBOX);
   const route = useHashRoute();
+  // WAVE 23 C9 — non-null on `#/form/<token>` only. Computed here rather than inside the render
+  // branch because the hash normaliser below has to read it too, and two copies of "is this the
+  // public form?" is how one of them ends up answering differently.
+  const formToken = formTokenOf(route);
   // Owner items 10/11 — the navigation folds to a slim strip: by the toggle in the rail head,
   // or automatically when the user clicks into the work surface (NAV_MINIMIZE_EVENT from the
   // grid). Remembered per browser; expanding is always one click on the same toggle.
@@ -490,6 +628,75 @@ export default function Shell() {
     setNavCollapsed(false);
   }, []);
 
+  // ── WAVE 23 items 9/10 (R7/R8, contract C10): the DATABASE FLYOUT ──────────────────────────
+  //
+  // R7 takes the databases OUT of the rail: the always-on `.shell-nav-list` band becomes a panel
+  // behind a "Database" button, so the rail is a fixed set of destinations instead of a list
+  // whose height is a function of how many tables the tenant made.
+  //
+  // `dbAt` is the anchor rect (null = shut), `dbQuery` the search. The panel renders OUTSIDE the
+  // `<aside>` and `position: fixed`, for the same reason `shell-nav-tip` does: the rail scrolls
+  // and clips, so anything that must escape it cannot be its descendant.
+  const [dbAt, setDbAt] = useState<{ x: number; y: number } | null>(null);
+  const [dbQuery, setDbQuery] = useState("");
+  const dbPanel = useRef<HTMLDivElement | null>(null);
+  const dbButton = useRef<HTMLButtonElement | null>(null);
+  const closeDbFly = useCallback(() => {
+    setDbAt(null);
+    setDbQuery("");
+  }, []);
+  // ⚠ Declared here and READ inside the close effect below, because that effect must not
+  // re-subscribe on every drag state change — and because the guard it needs is "a drag is in
+  // flight", which is state this component already holds (`dragKey`, declared further down with
+  // the other prefs state). A ref keeps the effect's dependency list honest.
+  const draggingRef = useRef(false);
+
+  /**
+   * ⛔ THREE WAYS OUT, AND ONE THING THAT MUST NOT CLOSE IT.
+   *
+   * Out: an outside mousedown, Escape, or a database link (handled at the link — a click on the
+   * row's ⋯ must NOT close the panel the menu is anchored inside).
+   *
+   * NOT out: a DRAG. This panel carries the folder drag-and-drop the rail used to (`NAV_DRAG_TYPE`,
+   * the `__root__` drop target, `draggable` rows). A pointer that leaves the panel mid-drag would
+   * otherwise trip the outside-click rule and unmount the drop target under the cursor — the
+   * folder move silently fails and the panel vanishes, which reads as a crash. The wirings this
+   * wave must keep green (W-3/W-5 live on these rows) would still pass, because a gate cannot
+   * see a drop that never lands.
+   *
+   * And NOT the trigger button: without that exemption the mousedown closes the panel and the
+   * button's own click immediately reopens it, so the control could never be used to shut the
+   * thing it opened. (`useMenu` in NavExtras has this quirk; a rail button is used far more often
+   * than a row's ⋯, so it is worth the ref here.)
+   */
+  useEffect(() => {
+    if (!dbAt) return;
+    const onDown = (e: MouseEvent) => {
+      if (draggingRef.current) return;
+      const t = e.target as Node | null;
+      if (dbPanel.current?.contains(t as Node)) return;
+      if (dbButton.current?.contains(t as Node)) return;
+      closeDbFly();
+    };
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") closeDbFly();
+    };
+    document.addEventListener("mousedown", onDown, true);
+    document.addEventListener("keydown", onKey, true);
+    return () => {
+      document.removeEventListener("mousedown", onDown, true);
+      document.removeEventListener("keydown", onKey, true);
+    };
+  }, [dbAt, closeDbFly]);
+
+  // ── WAVE 23 C10: the recents stamp ────────────────────────────────────────────────────────
+  //
+  // `opened` mirrors the stamps this session made, so Home shows the database you opened one
+  // click ago rather than the state of the world at sign-in (`mergeRecents`' own note). It is
+  // NOT persisted: a reload re-asks the server, which is the only end that knows.
+  const [opened, setOpened] = useState<Record<string, number>>({});
+  const lastStamped = useRef("");
+
   // The window signals the data layer raises (apiContract.ts). It talks to the
   // frame this way because `customer-grid/**` is host-neutral — the same tree
   // the Streamlit embed ships — and must not import a shell.
@@ -589,6 +796,7 @@ export default function Shell() {
         // the host does (`core.perms.nav_pages`' own contract).
         const { main, utility } = splitChrome(r.pages);
         setNav({ phase: "ready", entries: shapeNav(main, APP_BASE), utility,
+                 recents: r.recents,
                  ...(r.empty ? { empty: r.empty } : {}) });
       }
       // 401 is not "the nav is broken", it is "the session died under us" —
@@ -687,6 +895,10 @@ export default function Shell() {
   // scar); `dropTarget` is a folder id or "__root__" (drag out = drop on the list itself).
   const [dragKey, setDragKey] = useState<string | null>(null);
   const [dropTarget, setDropTarget] = useState<string | null>(null);
+  // WAVE 23 C10 — read by the flyout's outside-click rule, which must NOT fire mid-drag (see
+  // its note). Assigned during render like `navPrefsRef` above: the effect keeps a stable
+  // dependency list and still sees the current answer.
+  draggingRef.current = dragKey !== null;
   const createFolder = useCallback(
     (name: string) => {
       const cur = navPrefsRef.current;
@@ -696,6 +908,14 @@ export default function Shell() {
       }
       const id = `nf_${Date.now().toString(36)}${Math.floor(Math.random() * 1e6).toString(36)}`;
       commitPrefs({ folders: [...cur.folders, { id, name }], placement: cur.placement });
+      // ⭐ WAVE 23 C10 — SHOW THE THING THAT WAS JUST MADE. "+ Create new…" stayed in the RAIL
+      // while the folders it creates moved into the FLYOUT, so naming a folder produced no
+      // visible result at all: the only surface that draws one was a closed panel. The
+      // affordance and its effect ended up in different places, which is the class of defect
+      // this rework was supposed to remove rather than introduce. Opening the panel is the
+      // smaller of the two fixes and keeps C10's rail order exactly as ruled.
+      const at = flyoutFrom(dbButton.current);
+      if (at) setDbAt(at);
     },
     [commitPrefs]
   );
@@ -809,12 +1029,59 @@ export default function Shell() {
 
   // Keep the URL honest in both directions: an anonymous shell sits on
   // `#/login`, and a signed-in one never does.
+  //
+  // ⭐ WAVE 23 C10 — THE LANDING MOVED, AND ALL THREE SITES MOVED TOGETHER. `LANDING_PREFERENCE`
+  // and `defaultRoute` are the other two (nav.ts); this is the redirect a fresh sign-in takes.
+  // C10's own warning is that a half-move strands logins on a dead hash, so:
+  //
+  //   · the `entries.length` gate is GONE. It existed because `defaultRoute([])` was `""` — a
+  //     redirect to `#/` — so the frame had to wait for the nav before it could name a landing.
+  //     `home` is chrome and needs no entry, so there is nothing left to wait for, and the
+  //     tenant whose nav is legitimately empty (a fresh workspace, wave 18) now lands somewhere
+  //     real instead of sitting on the login hash until a database exists.
+  //   · an EMPTY hash normalises to the landing too. `removeDatabase` sets `hash = ""` after a
+  //     delete and relies on this; before, an empty hash silently rendered `customer_data` while
+  //     the URL said nothing.
   useEffect(() => {
+    // ⛔ WAVE 23 C9 — THE PUBLIC FORM IS EXEMPT FROM BOTH DIRECTIONS. Without the first
+    // exemption an anonymous visitor at `#/form/<token>` is bounced to `#/login` before the
+    // render branch is ever reached, and the public door is public only to people who already
+    // have an account. Without the second, a SIGNED-IN person testing their own form link is
+    // yanked to Home mid-read.
+    if (formToken) return;
     if (session.phase === "anon" && route !== LOGIN_ROUTE) {
       window.location.hash = `#/${LOGIN_ROUTE}`;
-    } else if (session.phase === "authed" && route === LOGIN_ROUTE && entries.length) {
+    } else if (session.phase === "authed" && (route === LOGIN_ROUTE || route === "")) {
       window.location.hash = `#/${defaultRoute(entries)}`;
     }
+  }, [session.phase, route, entries, formToken]);
+
+  // WAVE 23 C10 — stamp the route as opened, for Home's recents.
+  //
+  // ⚠ ABOVE THE EARLY RETURNS with every other hook (the React #310 scar at the block below),
+  // so it re-resolves the route itself rather than reading the `active` computed after them.
+  //
+  // THREE THINGS IT DELIBERATELY DOES NOT STAMP: a chrome route (Home and Connectors resolve to
+  // no entry, so `hit` is undefined); a route the nav has not answered for yet (same reason —
+  // `entries` is empty in flight, and stamping an unresolved key would record a page that may
+  // not exist); and a hand-off, which opens the current application in another tab and is not a
+  // surface this shell can put a recents tile back into.
+  //
+  // `lastStamped` suppresses the REPEAT write a `navEpoch` bump would otherwise cause (new
+  // `entries` identity, same route) — and clears whenever the route resolves to nothing, so
+  // leaving a table and coming back to it does re-stamp, which is what makes the ordering on
+  // Home mean "most recently opened".
+  useEffect(() => {
+    if (session.phase !== "authed") return;
+    const hit = resolveRoute(entries, route);
+    if (!hit || hit.kind !== "native") {
+      lastStamped.current = "";
+      return;
+    }
+    if (lastStamped.current === hit.key) return;
+    lastStamped.current = hit.key;
+    postOpened(hit.key);
+    setOpened((cur) => ({ ...cur, [hit.key]: Math.floor(Date.now() / 1000) }));
   }, [session.phase, route, entries]);
 
   const signOut = useCallback(() => {
@@ -849,26 +1116,55 @@ export default function Shell() {
     return () => window.removeEventListener("keydown", onKey);
   });
   // (C3-UT): "+ New database" + the user-table Add-record bar.
-  const [newDb, setNewDb] = useState<null | { name: string; busy: boolean; err: string }>(null);
+  //
+  // WAVE 23 C10 — the dialog grew a `mode`: the three-way choice R7 asks for (blank / from a
+  // template / automated). `automated` never persists in this state — picking it closes the
+  // dialog and hands off — so it exists in the union only because the CHOOSER offers it.
+  const [newDb, setNewDb] = useState<null | {
+    mode: "blank" | "template";
+    name: string;
+    busy: boolean;
+    err: string;
+  }>(null);
   const newDbOpenRef = useRef(false);
   newDbOpenRef.current = newDb !== null;
+  const openNewDb = useCallback((mode: "blank" | "template") => {
+    setNewDb({ mode, name: "", busy: false, err: "" });
+  }, []);
+  /**
+   * WAVE 23 C2/C10 — the "automated database" door. Route, then ASK, exactly as the review
+   * click-through does: the create wizard is `AutomationSurface`'s own state and this frame
+   * neither holds it nor should learn to.
+   */
+  const openAutomated = useCallback(() => {
+    setNewDb(null);
+    window.location.hash = "#/automation";
+    signal(AUTOMATION_CREATE_EVENT);
+  }, []);
   const createDb = useCallback(async () => {
     setNewDb((cur) => {
       if (!cur || cur.busy || !cur.name.trim()) return cur;
       const name = cur.name;
       void (async () => {
         try {
+          // WAVE 23 C10 — `source` rides the body the route ALREADY forwards
+          // (`routes_tables.py:192` passes it to `user_tables.create`). It is the literal
+          // `"Blank"` because that is the enum member the server accepts; ⚠ an unknown source is
+          // SILENTLY DOWNGRADED to Blank there (user_tables.py:165), so a third literal invented
+          // here would create a table that quietly disagrees with the word the dialog used.
+          // "Automated" is not one of these values by design — that path is the automation
+          // wizard's (`openAutomated`), and the engine stamps the source itself.
           const res = await fetch(`${API_V1}/tables`, {
             method: "POST",
             credentials: CREDENTIALS,
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ label: name.trim() }),
+            body: JSON.stringify({ label: name.trim(), source: "Blank" }),
           });
           const body = (await res.json().catch(() => null)) as
             | { key?: string; error?: { message?: string } }
             | null;
           if (!res.ok || !body?.key) {
-            setNewDb({ name, busy: false,
+            setNewDb({ mode: "blank", name, busy: false,
                        err: body?.error?.message || `The server answered ${res.status}.` });
             return;
           }
@@ -876,7 +1172,7 @@ export default function Shell() {
           setNavEpoch((e) => e + 1);
           window.location.hash = `#/${body.key}`;
         } catch {
-          setNewDb({ name, busy: false, err: "Cannot reach the server." });
+          setNewDb({ mode: "blank", name, busy: false, err: "Cannot reach the server." });
         }
       })();
       return { ...cur, busy: true, err: "" };
@@ -889,6 +1185,34 @@ export default function Shell() {
   // trailing "+" row (S3's half), where the row it adds is the row you are looking at, so
   // the shell stops being a second writer of table data.
 
+  // ⭐ WAVE 23 C9 (SESSION D's page, E's mount — wiring W23-W2) — THE PUBLIC FORM, BEFORE THE
+  // AUTH WALL.
+  //
+  // ⛔ THE POSITION IS THE ENTIRE CONTRACT. It sits above BOTH early returns: above `anon`,
+  // obviously, but also above `checking` — a person filling in a public form should not watch a
+  // brand mark while `me()` resolves a session they do not have. It is below every hook, which
+  // is the other half of the rule (the React #310 scar the block at :828 documents): the hook
+  // count may not change between renders, and this branch would be the shortest possible path
+  // to breaking that.
+  //
+  // ⚠ THE SMALLEST POSSIBLE BRANCH, deliberately (C9's own words). It reads a token out of the
+  // hash and renders D's page; it does not fetch, does not touch the session, does not import
+  // anything of the grid's. Nothing else in this frame is reachable from it.
+  //
+  // ⛔ AND THE HASH NORMALISER HAS TO KNOW. The effect at :812 pins an anonymous shell to
+  // `#/login` — which would have bounced every anonymous form visitor to a login screen before
+  // this branch ever rendered. `isPublicForm` is read there too; a mount without that exemption
+  // is a public door that only signed-in people can reach.
+  //
+  // ⚠ The SERVER side of this is genuinely public (D's `routes_forms.py`, the automation-hook
+  // pattern — uniform 403, constant-time compare). This branch adds no new public SURFACE: the
+  // SPA bundle is already served unauthenticated (main.py:257-295, `_DEV_FIXTURES` guard), so
+  // `#/form/<token>` has always loaded for free. What it adds is a client route that renders
+  // something there instead of the login page.
+  if (formToken) {
+    return <FormPublic token={formToken} />;
+  }
+
   if (session.phase === "checking") {
     // Deliberately wordless. A "Loading…" line here would flash for one round
     // trip on every load, and the mark says everything the moment needs.
@@ -935,6 +1259,20 @@ export default function Shell() {
   // only granted surface is Automation that it has no surfaces at all.
   const automation = entries.find((e) => e.key === "automation" && e.kind === "native");
   const dbEntries = automation ? entries.filter((e) => e.key !== "automation") : entries;
+  // WAVE 23 C10 — the flyout's search. A plain label substring, case-folded: this list is at
+  // most a few dozen rows, so anything cleverer (fuzzy, ranked) would be a scoring function
+  // nobody can predict over a set small enough to read.
+  //
+  // ⚠ SEARCHING RENDERS FLAT. `foldNav` is called with EMPTY prefs while a query is live,
+  // because a folder head whose members were filtered out would report a count it is not
+  // showing — the same "count derived from one list, rows from another" defect the R10
+  // relocation note two blocks up already documents.
+  const dbQ = dbQuery.trim().toLowerCase();
+  const shownEntries = dbQ
+    ? dbEntries.filter((e) => e.label.toLowerCase().includes(dbQ))
+    : dbEntries;
+  // WAVE 23 C10 — what Home draws: the server's recents plus this session's own stamps.
+  const recents = mergeRecents(nav.phase === "ready" ? nav.recents : NO_RECENTS, opened);
 
   return (
     <div className="shell-root">
@@ -977,6 +1315,20 @@ export default function Shell() {
         </div>
 
         <nav className="shell-nav">
+          {/* ⭐ WAVE 23 item 9 (R7, contract C10) — HOME, the new landing, at the top of the rail.
+              An `<a>` to a CHROME route: it needs no grant because it renders nothing the server
+              did not already send (nav.ts' `CHROME_ROUTES` note carries the full argument, and
+              the :1039 law below is unchanged — an undeclared SURFACE is still denied). */}
+          <a
+            className={"shell-nav-item shell-nav-home" + (route === HOME_ROUTE ? " is-active" : "")}
+            href={`#/${HOME_ROUTE}`}
+            onMouseEnter={navCollapsed ? tipEnter("Home") : undefined}
+            onMouseLeave={navCollapsed ? tipLeave : undefined}
+          >
+            <HomeIcon />
+            <span className="shell-nav-label">Home</span>
+          </a>
+
           {/* The Analyst slot, above the database list — the host's own IA
               (app.py:8166 pins "AI assistant" over the nav tree, same label,
               same sparkle). Wave 18 (owner item 3): the hand-off into Streamlit
@@ -1065,7 +1417,97 @@ export default function Shell() {
             ) : null}
           </button>
 
-          <div
+          {/* ⭐ WAVE 23 item 10 (R8, contract C11, wiring W23-W3) — CONNECTORS, directly below
+              Alerts, exactly where R8 puts it. A chrome route like Home: the DIRECTORY it renders
+              is composed by the server and session-gated, so this row can no more invent a
+              connector than Home can invent a database. */}
+          <a
+            className={
+              "shell-nav-item shell-nav-connectors" +
+              (route === CONNECTORS_ROUTE ? " is-active" : "")
+            }
+            href={`#/${CONNECTORS_ROUTE}`}
+            onMouseEnter={navCollapsed ? tipEnter("Connectors") : undefined}
+            onMouseLeave={navCollapsed ? tipLeave : undefined}
+          >
+            <PlugIcon />
+            <span className="shell-nav-label">Connectors</span>
+          </a>
+
+          {/* ⭐ WAVE 23 item 9 (R7) — THE DATABASE BUTTON, and the end of the always-on band.
+              R7: "databases LEAVE the always-on rail; a 'Database' nav button opens the flyout".
+              The rail is now a fixed set of destinations whose height does not depend on how many
+              tables the tenant made — which is the actual complaint behind the ruling.
+              ⛔ A BUTTON, NOT A ROUTE, and for the same reason Alerts is one (:1039): there is no
+              `#/databases` surface and inventing one would be the hard-coded page this frame
+              refuses to have. It opens a panel over the list the server already sent. */}
+          <button
+            type="button"
+            ref={dbButton}
+            className={"shell-nav-item shell-nav-db" + (dbAt ? " is-active" : "")}
+            aria-haspopup="dialog"
+            aria-expanded={!!dbAt}
+            onMouseEnter={navCollapsed ? tipEnter("Database") : undefined}
+            onMouseLeave={navCollapsed ? tipLeave : undefined}
+            onClick={(e) => {
+              if (dbAt) {
+                closeDbFly();
+                return;
+              }
+              const at = flyoutFrom(e.currentTarget);
+              if (at) setDbAt(at);
+            }}
+          >
+            <DbIcon />
+            <span className="shell-nav-label">Database</span>
+            <CaretIcon />
+          </button>
+
+          {/* Wave 14 C-NAVFOLD / WAVE 19 R11 — "+ Create new…", now a RAIL row rather than the
+              foot of a list that no longer lives here. C10 pins it between Database and the
+              account corner, which is where R11 always meant it to read: the last thing in the
+              rail is the thing that adds to it. */}
+          {nav.phase === "ready" ? (
+            <CreateNewRow
+              collapsed={navCollapsed}
+              onExpand={() => setNavCollapsed(false)}
+              onCreateFolder={createFolder}
+              onNewDatabase={() => openNewDb("blank")}
+              canFolder={entries.length > 0}
+            />
+          ) : null}
+
+          {/* ── THE DATABASE FLYOUT (C10) ────────────────────────────────────────────────────
+              ⛔ PORTALLED TO `<body>`, and it has to be. Left inside the `<aside>` it would be a
+              descendant of `.shell-side.is-collapsed`, whose rules hide `.shell-nav-label`,
+              `.shell-nav-badge` and `.shell-nav-open` — so with the rail folded the panel would
+              render a column of unlabelled icons, which is the one state this control exists to
+              rescue the user from. `createPortal` is already this tree's answer for exactly this
+              (OverlaySurface, CatalogView); the panel is not part of the rail, it only points at
+              it. */}
+          {dbAt
+            ? createPortal(
+                <div
+                  className="shell-dbfly"
+                  ref={dbPanel}
+                  role="dialog"
+                  aria-label="Databases"
+                  style={{ left: dbAt.x, top: dbAt.y }}
+                >
+                  <div className="shell-dbfly-head">
+                    <input
+                      autoFocus
+                      className="shell-dbfly-search"
+                      placeholder="Search databases"
+                      value={dbQuery}
+                      maxLength={60}
+                      onChange={(e) => setDbQuery(e.target.value)}
+                      onKeyDown={(e) => {
+                        if (e.key === "Escape") closeDbFly();
+                      }}
+                    />
+                  </div>
+                  <div
             className={
               "shell-nav-list" + (dropTarget === "__root__" ? " is-drop-root" : "")
             }
@@ -1088,10 +1530,13 @@ export default function Shell() {
               movePage(key, null);
             }}
           >
-            {/* C-SCHEMA: the list folds under the user's folders. The collapsed
-                rail renders FLAT (folder chrome has no room at 44px) — members
-                stay reachable, the folders wait for the rail to open. */}
-            {foldNav(dbEntries, navCollapsed ? EMPTY_NAV_PREFS : navPrefs, closedFolders).map(
+            {/* C-SCHEMA: the list folds under the user's folders.
+                ⭐ WAVE 23 C10 — the `navCollapsed ? EMPTY_NAV_PREFS :` gate is GONE with the band
+                it belonged to. It existed because the 44px strip had no room for folder chrome;
+                this panel is 268px wide whatever the rail is doing, so the folders always render
+                and the reason for the gate no longer exists. A SEARCH still flattens (see
+                `shownEntries`) — that is a different fact about a different state. */}
+            {foldNav(shownEntries, dbQ ? EMPTY_NAV_PREFS : navPrefs, closedFolders).map(
               (row) => {
                 if (row.kind === "folder") {
                   return (
@@ -1100,7 +1545,9 @@ export default function Shell() {
                       folder={row.folder}
                       count={row.count}
                       open={row.open}
-                      collapsed={navCollapsed}
+                      // WAVE 23 C10 — always false in the flyout: the panel has full width in
+                      // either rail state, so folder chrome is never the thing being squeezed.
+                      collapsed={false}
                       onToggle={() => toggleFolder(row.folder.id)}
                       onRename={(name) => renameFolder(row.folder.id, name)}
                       onDelete={() => deleteFolder(row.folder.id)}
@@ -1171,16 +1618,18 @@ export default function Shell() {
                     </div>
                   );
                 }
-                // Owner item 3 — collapsed, the icon names its database on hover.
-                const tip = navCollapsed
-                  ? {
-                      onMouseEnter: tipEnter(item.label),
-                      onMouseLeave: tipLeave,
-                    }
-                  : {};
+                // ⭐ WAVE 23 C10 — the collapsed-rail hover tip is GONE from these rows, with
+                // the band it belonged to. It named a database whose LABEL was hidden at 44px;
+                // inside the flyout the label is always on screen, so the tip would have been a
+                // second copy of the word beside itself. `tipEnter`/`tipLeave` still serve the
+                // rail's own rows above.
+                //
+                // Clicking a database CLOSES the panel: you asked for it, you got it. The
+                // handler is on the LINK and not on the list, deliberately — a click on the
+                // row's ⋯ must leave the panel open, because that menu is anchored inside it.
                 const link =
                   item.kind === "native" ? (
-                    <a className={cls} href={item.href} {...tip}>
+                    <a className={cls} href={item.href} onClick={closeDbFly}>
                       {inner}
                     </a>
                   ) : (
@@ -1189,7 +1638,7 @@ export default function Shell() {
                       href={item.href}
                       target="_blank"
                       rel="noreferrer"
-                      {...tip}
+                      onClick={closeDbFly}
                     >
                       {inner}
                     </a>
@@ -1206,7 +1655,13 @@ export default function Shell() {
                       (row.folderId ? " is-foldered" : "") +
                       (dragKey === item.key ? " is-dragging" : "")
                     }
-                    draggable={!navCollapsed && item.depth === 0}
+                    // WAVE 23 C10 — `!navCollapsed &&` dropped from both gates below: the panel
+                    // is the same width in either rail state, so the two things that gate
+                    // referred to (no horizontal room for a ⋯, no room to drag) are no longer
+                    // true. The folder-reorder drag and the row menu therefore keep working with
+                    // the rail folded, which is the state a user who opened this panel is most
+                    // likely to be in.
+                    draggable={item.depth === 0}
                     onDragStart={(e) => {
                       e.dataTransfer.setData(NAV_DRAG_TYPE, item.key);
                       e.dataTransfer.effectAllowed = "move";
@@ -1218,7 +1673,7 @@ export default function Shell() {
                     }}
                   >
                     {link}
-                    {!navCollapsed && item.depth === 0 && (
+                    {item.depth === 0 && (
                       <RowMenu
                         entryLabel={item.label}
                         canSchema
@@ -1287,24 +1742,60 @@ export default function Shell() {
                 );
               }
             )}
-            {/* Wave 14 C-NAVFOLD — the folder creator moved here from the row menu (R10).
-                WAVE 19 R11 — and "+ New database" moved INTO it: one "+ Create new…" row
-                offering Folder | Database, replacing two affordances that sat in different
-                places and looked like different kinds of thing.
-                ⚠ The `entries.length > 0` gate that used to guard this row is now the
-                `canFolder` PROP, not a reason to hide the row: a tenant with no databases
-                has nothing to file in a folder but is exactly the tenant who needs to make
-                a database. It renders whenever the nav has answered. */}
-            {nav.phase === "ready" ? (
-              <CreateNewRow
-                collapsed={navCollapsed}
-                onExpand={() => setNavCollapsed(false)}
-                onCreateFolder={createFolder}
-                onNewDatabase={() => setNewDb({ name: "", busy: false, err: "" })}
-                canFolder={entries.length > 0}
-              />
-            ) : null}
-          </div>
+                    {/* The panel's own empty state: ONE line, and it is different from "this
+                        workspace has none" — a search that matched nothing is not a workspace
+                        with nothing in it, and saying the second when the first is true is how a
+                        reader concludes their data is gone. */}
+                    {shownEntries.length === 0 ? (
+                      <p className="shell-dbfly-empty">
+                        {dbQuery ? "No database matches that." : "No databases yet."}
+                      </p>
+                    ) : null}
+                  </div>
+                  {/* ── the create footer (C10) — three doors, ONE dialog ──────────────────
+                      Blank and template open the same New-database dialog with the choice
+                      pre-selected; automated hands off to the automation wizard, because an
+                      automated database is CREATED BY the automation that fills it (C2's
+                      `target.mode`), not by a name box that then needs one. */}
+                  <div className="shell-dbfly-foot">
+                    <button
+                      type="button"
+                      className="shell-dbfly-make"
+                      onClick={() => {
+                        closeDbFly();
+                        openNewDb("blank");
+                      }}
+                    >
+                      <PlusMark />
+                      Blank database
+                    </button>
+                    <button
+                      type="button"
+                      className="shell-dbfly-make"
+                      onClick={() => {
+                        closeDbFly();
+                        openNewDb("template");
+                      }}
+                    >
+                      <PlusMark />
+                      From a template
+                    </button>
+                    <button
+                      type="button"
+                      className="shell-dbfly-make"
+                      onClick={() => {
+                        closeDbFly();
+                        openAutomated();
+                      }}
+                    >
+                      <PlusMark />
+                      Automated database
+                    </button>
+                  </div>
+                </div>,
+                document.body
+              )
+            : null}
           {/* Wave 17 item 3 (R6) — the mark, never the word. "Loading…" under an
               empty rail told the reader what they could already see, and it read
               as a nav ITEM for the beat before it vanished. */}
@@ -1320,22 +1811,13 @@ export default function Shell() {
           ) : null}
           {/* ⚠ Wave 18: this line is for a MISCONFIGURED ACCOUNT — one whose grants give it
               nothing — and it must not fire for a freshly provisioned TENANT, which has no
-              modules by design and is being welcomed by the hero in the main pane. Both at
-              once said "something is wrong here" and "welcome, start here" in one screen
-              (caught in the close-out visual pass, not by any gate). The rail's own "New
-              database" button below is the honest affordance in the tenant case. */}
+              modules by design and is being welcomed on Home. Both at once said "something is
+              wrong here" and "welcome, start here" in one screen (caught in the close-out
+              visual pass, not by any gate). "+ Create new…" above is the honest affordance in
+              the tenant case. */}
           {nav.phase === "ready" && entries.length === 0 && !tenantEmptyState ? (
             <div className="shell-nav-note">No surfaces are available to this account.</div>
           ) : null}
-          {/* ⛔ THE STANDALONE "+ New database" BUTTON WAS HERE, AND WAVE 19 R11 FOLDED
-              IT INTO "+ Create new…" at the bottom of the database list above. It was the
-              louder half of the owner's complaint about this rail: a `<button>` wearing the
-              user agent's border and grey fill (this class never reset either — see the
-              index.css note), sitting BELOW the list's own quiet "+ New folder" and offering
-              a sibling action in a completely different visual register. One row, one place,
-              two things to create. The collapsed-rail behaviour it carried survives inside
-              `CreateNewRow`: from the 56px strip the "+" opens the rail rather than a
-              popover that would read as coming from nowhere. */}
         </nav>
 
         <div
@@ -1397,7 +1879,39 @@ export default function Shell() {
         ) : active?.kind === "native" && active.key === "automation" ? (
           // Wave 18 (C-AUTONAV): the Automation surface — its OWN secondary rail + editor,
           // props-free by contract (it fetches /api/v1/automations itself). SESSION D's tree.
-          <AutomationSurface />
+          //
+          // ⭐ WAVE 23 C13 (owner item 2), wiring W23-W1 — THE SAME FRAME AS EVERY DATABASE.
+          //
+          // This branch used to mount the surface BARE: no `shell-db-frame`, no `DbHead`. So
+          // the one page in the product that is not a database was also the one page whose
+          // name was drawn by its own component, at its own size and weight — three title
+          // treatments (the surface's 16px/700 editable input, its 20px/600 empty-state h1,
+          // and the frame's 16px/650 `shell-db-name`) against the grid's one. The fix is not
+          // to restyle the stand-in but to delete the reason it exists: one title system,
+          // owned by the shell, mounted here.
+          //
+          // ⚠ THE LABEL COMES OFF THE PAYLOAD, exactly as the rail's does (:1006). C13 words
+          // it "label 'Automation'" and that IS `active.label` — the registry's literal, or a
+          // tenant's `nav_meta` override of it. Hard-coding the word here would put the same
+          // surface's name in two places and let them drift on the day someone renames it.
+          //
+          // ⛔ THE HEIGHT CHAIN. `.auto-surface` is `height: 100%`, so dropping it straight
+          // into the frame's flex column would size it against the WHOLE frame and push its
+          // rail a header's height below the fold. `.shell-auto-host` is the same `flex: 1 1
+          // auto; min-height: 0` link `.shell-grid-host` is for glide — and it is the shell's
+          // OWN class rather than a `.shell-db-frame > .auto-surface` rule, because
+          // `.auto-*` is SESSION B's CSS region this wave and a frame has no business
+          // reaching into its child's namespace to make itself fit.
+          <div className="shell-db-frame">
+            <DbHead
+              label={active.label}
+              glyph={<AutoIcon />}
+              {...(active.icon ? { icon: active.icon } : {})}
+            />
+            <div className="shell-auto-host">
+              <AutomationSurface />
+            </div>
+          </div>
         ) : active?.kind === "native" ? (
           // The native grid surfaces — ONE component, topic decided by the route. Wave 16:
           // the `#/cohort` route left with the cohort registry row (cohorts are LOCKED VIEWS
@@ -1432,42 +1946,54 @@ export default function Shell() {
           </div>
         ) : active ? (
           <StranglerPage entry={active} />
-        ) : nav.phase === "ready" || nav.phase === "error" ? (
-          // ⚠ WAVE 17 ITEM 4 (R6) — THIS BRANCH IS ONLY REACHED HONESTLY ONCE
-          // THE NAV HAS ANSWERED. `active` is resolved from `entries`, which is
-          // empty while the nav is in flight, so every first login used to land
-          // here and be told "This account has access to no surfaces yet" —
-          // stating, as fact, the single worst thing this frame could say to a
-          // new user, for as long as the round trip took. The sentence is
-          // RIGHT for a nav that came back empty and WRONG for one that has not
-          // come back, and those two were indistinguishable. They are not now.
-          nav.phase === "ready" ? (
-            // Wave 18 (C1-TENANT, R4): a READY nav with zero entries is a freshly provisioned
-            // tenant (the server says so explicitly — a misconfigured account 403s and lands
-            // on the error branch instead). The honest next step is the empty state's whole
-            // content: create the first database.
-            <div className="shell-placeholder shell-tenant-hero">
-              <h1>Welcome</h1>
-              <p>
-                {/* WAVE 19 R12 — the pointer follows the rename. A sentence naming a
-                    door by its old label is a wrong instruction, not a stale comment. */}
-                This workspace has no databases yet. Create your first one below, or store a
-                data source's keys under Settings → Keychains to connect one later.
-              </p>
-              <button
-                className="login-submit shell-hero-create"
-                type="button"
-                onClick={() => setNewDb({ name: "", busy: false, err: "" })}
-              >
-                Create your first database
-              </button>
-            </div>
-          ) : (
-            <div className="shell-placeholder">
-              <h1>Nothing to show</h1>
-              <p>The navigation service did not answer. Reload to retry.</p>
-            </div>
-          )
+        ) : route === CONNECTORS_ROUTE ? (
+          // ⭐ WAVE 23 item 10 (R8, C11, wiring W23-W3) — the connectors directory.
+          //
+          // The one action the page cannot perform itself: a `manage: "keychain"` row opens
+          // Settings on the Keychains tab, and the Settings MODAL is the frame's. Same division
+          // as every other panel here — the page knows what it wants, the frame owns the door.
+          <ConnectorsPage onKeychain={() => setSettings("keychains")} />
+        ) : nav.phase === "ready" ? (
+          // ⭐ WAVE 23 item 9 (R7, C10) — HOME, AND IT IS THE FALLBACK RATHER THAN A ROUTE MATCH.
+          //
+          // ⛔ WHY `!active` AND NOT `route === HOME_ROUTE`. Three states have to land here and
+          // only one of them is the literal hash: `#/home`, an EMPTY hash, and a route that no
+          // longer resolves (a deleted table, a stale bookmark, a hand-typed key). `resolveRoute`
+          // already funnels all three to "no entry" now that `defaultRoute` returns a chrome
+          // route, so testing the literal would have left the other two on the "Nothing to show"
+          // branch — a shell that looks broken as the reward for deleting a database, which is
+          // the exact failure `removeDatabase`'s own note warns about from the other side.
+          //
+          // ⚠ AND THIS BRANCH ABSORBED WAVE 18's TENANT HERO (R4), which used to live below.
+          // That hero said "Welcome — this workspace has no databases yet" plus one create
+          // button, on precisely the state Home now owns: a ready nav with zero entries. Leaving
+          // both reachable would put two welcome messages on one screen, which is the defect the
+          // rail's own note at the empty-nav line already documents. Home's four cards ARE the
+          // hero's create door, and its empty line carries the hero's sentence (HomePage's
+          // `home-empty`, which branches on `entries.length === 0` for exactly this reason).
+          // Booked as a dated amendment in the wave doc, since it moves an R4 surface.
+          <HomePage
+            entries={entries}
+            recents={recents}
+            onTemplates={() => openNewDb("template")}
+            onNewDatabase={() => openNewDb("blank")}
+            onAutomated={openAutomated}
+            onConnectors={() => {
+              window.location.hash = `#/${CONNECTORS_ROUTE}`;
+            }}
+          />
+        ) : nav.phase === "error" ? (
+          // ⚠ WAVE 17 ITEM 4 (R6) — THE ERROR AND THE EMPTY ARE DIFFERENT SENTENCES, and this
+          // branch is what keeps them apart. `active` resolves from `entries`, which is empty
+          // while the nav is IN FLIGHT, so every first login used to land on a pane stating the
+          // single worst thing this frame could say to a new user for as long as a round trip
+          // took. WAVE 23 keeps that separation and simplifies its shape: `ready` now goes to
+          // Home above (which welcomes an empty workspace properly), so this is only ever the
+          // nav that FAILED, and the nested ternary that used to sort the two is gone.
+          <div className="shell-placeholder">
+            <h1>Nothing to show</h1>
+            <p>The navigation service did not answer. Reload to retry.</p>
+          </div>
         ) : (
           // Still asking (`loading`, or the `idle` beat before the effect runs).
           <div className="shell-loading">
@@ -1519,41 +2045,104 @@ export default function Shell() {
             onClick={(e) => e.stopPropagation()}
           >
             <h2>New database</h2>
-            <p className="shell-newdb-sub">
-              A blank database in this workspace. Add fields and records once it opens —
-              nothing here connects to a source.
-            </p>
-            <input
-              autoFocus
-              className="shell-newdb-input"
-              placeholder="Database name"
-              value={newDb.name}
-              maxLength={60}
-              disabled={newDb.busy}
-              onChange={(e) => setNewDb({ ...newDb, name: e.target.value })}
-              onKeyDown={(e) => {
-                if (e.key === "Enter") void createDb();
-                if (e.key === "Escape" && !newDb.busy) setNewDb(null);
-              }}
-            />
-            {newDb.err ? <p className="shell-newdb-err">{newDb.err}</p> : null}
-            <div className="shell-newdb-actions">
+            {/* ⭐ WAVE 23 C10 — THE THREE-WAY CHOICE. Three one-line rows, not three paragraphs:
+                the explanation lives where the DECISION is made and stops there (R13). The
+                dialog's old sub-line ("a blank database… nothing here connects to a source")
+                said one of these three things as if it were the only one, so it moved onto the
+                row it actually describes. */}
+            <div className="shell-newdb-kinds" role="radiogroup" aria-label="What to create">
               <button
                 type="button"
-                onClick={() => setNewDb(null)}
+                role="radio"
+                aria-checked={newDb.mode === "blank"}
+                className={"shell-newdb-kind" + (newDb.mode === "blank" ? " is-on" : "")}
                 disabled={newDb.busy}
+                onClick={() => setNewDb({ ...newDb, mode: "blank", err: "" })}
               >
-                Cancel
+                <span className="shell-newdb-kind-name">Blank</span>
+                <span className="shell-newdb-kind-detail">
+                  An empty database — add fields and records once it opens.
+                </span>
               </button>
               <button
                 type="button"
-                className="login-submit"
-                onClick={() => void createDb()}
-                disabled={newDb.busy || !newDb.name.trim()}
+                role="radio"
+                aria-checked={newDb.mode === "template"}
+                className={"shell-newdb-kind" + (newDb.mode === "template" ? " is-on" : "")}
+                disabled={newDb.busy}
+                onClick={() => setNewDb({ ...newDb, mode: "template", err: "" })}
               >
-                {newDb.busy ? "Creating…" : "Create database"}
+                <span className="shell-newdb-kind-name">From a template</span>
+                <span className="shell-newdb-kind-detail">
+                  Add a curated set of views to a database you already have.
+                </span>
+              </button>
+              {/* ⚠ NOT A RADIO — it LEAVES. Picking it hands off to the automation wizard
+                  rather than selecting a state in this dialog, so it must not sit in the
+                  radiogroup pretending to be a third selectable option (`role="radio"` with
+                  `aria-checked` it can never wear is a control that lies to a screen reader). */}
+              <button
+                type="button"
+                className="shell-newdb-kind"
+                disabled={newDb.busy}
+                onClick={openAutomated}
+              >
+                <span className="shell-newdb-kind-name">
+                  Automated
+                  <ExtIcon />
+                </span>
+                <span className="shell-newdb-kind-detail">
+                  A database an automation creates and keeps up to date.
+                </span>
               </button>
             </div>
+            {newDb.mode === "template" ? (
+              // WAVE 23 C12 (wiring W23-W6) — the picker. It applies views to an EXISTING
+              // database rather than making one, which is what a platform-curated template is:
+              // a set of saved views, not a table (R10).
+              <TemplatePicker
+                entries={dbEntries}
+                onToast={setToast}
+                onDone={(tableKey) => {
+                  setNewDb(null);
+                  window.location.hash = `#/${tableKey}`;
+                }}
+              />
+            ) : (
+              <>
+                <input
+                  autoFocus
+                  className="shell-newdb-input"
+                  placeholder="Database name"
+                  value={newDb.name}
+                  maxLength={60}
+                  disabled={newDb.busy}
+                  onChange={(e) => setNewDb({ ...newDb, name: e.target.value })}
+                  onKeyDown={(e) => {
+                    if (e.key === "Enter") void createDb();
+                    if (e.key === "Escape" && !newDb.busy) setNewDb(null);
+                  }}
+                />
+                {newDb.err ? <p className="shell-newdb-err">{newDb.err}</p> : null}
+                <div className="shell-newdb-actions">
+                  <button
+                    type="button"
+                    onClick={() => setNewDb(null)}
+                    disabled={newDb.busy}
+                  >
+                    Cancel
+                  </button>
+                  <button
+                    type="button"
+                    className="login-submit"
+                    onClick={() => void createDb()}
+                    disabled={newDb.busy || !newDb.name.trim()}
+                  >
+                    {newDb.busy ? "Creating…" : "Create database"}
+                  </button>
+                </div>
+              </>
+            )}
           </div>
         </div>
       ) : null}
@@ -1594,6 +2183,21 @@ export default function Shell() {
               new CustomEvent("aios:view-open", { detail: { topic, viewId } })
             );
           }}
+          // ⭐ WAVE 23 C6 (wiring W23-W5) — the review notification's click-through.
+          //
+          // THE SAME TWO-PART MOVE the view click-through makes, and for the same reason: the
+          // frame owns the hash, the automation SURFACE owns which automation is selected
+          // (`activeId` is its own state, seeded from its own list — this frame cannot see it
+          // and must not learn to). So: route, then ASK.
+          //
+          // ⚠ THE ORDER IS LOAD-BEARING. The hash is set FIRST so the surface is mounting (or
+          // already mounted) when the event arrives; dispatching first would fire into a route
+          // that does not exist yet. `signal` is `apiContract`'s helper — the same channel the
+          // grid's own listeners use, rather than a second hand-rolled `dispatchEvent` here.
+          onOpenAutomation={(autoId, stageId) => {
+            window.location.hash = "#/automation";
+            signal(AUTOMATION_OPEN_EVENT, { autoId, ...(stageId ? { stageId } : {}) });
+          }}
         />
       ) : null}
 

web/src/shell/nav.ts

@@ -188,15 +188,70 @@ export function splitChrome(pages: NavPage[]): { main: NavPage[]; utility: NavPa
   return { main, utility };
 }
 
+/**
+ * WAVE 23 (C10 / R7) — one entry of the Home landing's recents.
+ *
+ * `at` is EPOCH SECONDS, and the type says so because the alternative bit this product once:
+ * a formatted naive-local stamp read by a browser in another zone (D-18). An integer instant
+ * has one reading everywhere, and the two things Home renders from it — "Opened N minutes ago"
+ * and the Today / Past 7 days / Older bucket — are both statements about THE READER'S OWN
+ * CLOCK, which is the one case where using it is correct rather than forbidden (contrast
+ * `alertsModel.stampText`, which must NOT touch a clock because it re-states a server event).
+ */
+export interface Recent {
+  key: string;
+  at: number;
+}
+
 /** `empty` (wave 18): the SERVER's reason for an empty page list. `"no_databases"` means a
  *  freshly provisioned tenant with no modules and no databases YET — a legitimate starting
  *  state, not a broken account. Absent means "no reason given", which the shell reads as the
  *  misconfigured-account case it always did. Distinguishing them is what stops the rail saying
  *  "no surfaces are available" beside a hero saying "welcome, create your first database". */
 export type NavResult =
-  | { ok: true; pages: NavPage[]; empty?: string }
+  | { ok: true; pages: NavPage[]; recents: Recent[]; empty?: string }
   | { ok: false; status: number };
 
+/**
+ * `{recents:[…]}` → the list, fail-closed. An entry with no key or an unreadable stamp is
+ * DROPPED rather than rendered at the epoch, which would file it under "Older" for ever and
+ * put a tile on Home for something nobody opened.
+ */
+export function parseRecents(body: unknown): Recent[] {
+  const raw = (body as { recents?: unknown } | null)?.recents;
+  if (!Array.isArray(raw)) return [];
+  const out: Recent[] = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const r = item as Record<string, unknown>;
+    const key = typeof r.key === "string" ? r.key.trim() : "";
+    const at = typeof r.at === "number" && isFinite(r.at) ? Math.floor(r.at) : 0;
+    if (!key || at <= 0) continue;
+    out.push({ key, at });
+  }
+  return out;
+}
+
+/**
+ * WAVE 23 (C10) — stamp a page as opened. FIRE AND FORGET, by design.
+ *
+ * ⛔ IT RETURNS `void` AND SWALLOWS EVERYTHING. A recents stamp is the least important write in
+ * the product: it decorates a landing page. Nothing the user is doing may wait on it, and no
+ * failure of it may reach a screen — a toast saying "we could not record that you opened this
+ * table" is noise about a feature nobody asked for, printed over the table they successfully
+ * opened. The server answers 503 honestly when the store is down; this end simply does not
+ * care, which is the only correct posture for telemetry-shaped state.
+ */
+export function postOpened(key: string): void {
+  if (!key) return;
+  void fetch(`${API_V1}/nav/opened`, {
+    method: "POST",
+    credentials: CREDENTIALS,
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ key }),
+  }).catch(() => {});
+}
+
 /**
  * X2 `GET /api/v1/nav`. `status` rides the failure so the caller can tell the
  * two apart that must not be conflated: **401 means the session is gone** (drop
@@ -210,7 +265,12 @@ export async function fetchNav(): Promise<NavResult> {
     if (!res.ok) return { ok: false, status: res.status };
     const body = await res.json();
     const empty = typeof body?.empty === "string" ? body.empty : undefined;
-    return { ok: true, pages: parsePages(body), ...(empty ? { empty } : {}) };
+    return {
+      ok: true,
+      pages: parsePages(body),
+      recents: parseRecents(body),
+      ...(empty ? { empty } : {}),
+    };
   } catch {
     return { ok: false, status: 0 };
   }
@@ -702,10 +762,62 @@ export function shapeNav(pages: NavPage[], appBase: string): NavEntry[] {
  * can read, not in whatever the registry happens to order first.
  */
 // (`cohort` left the list with its NATIVE_KEYS exit, wave 16 — a landing must be drawable.)
-export const LANDING_PREFERENCE: readonly string[] = ["customer_data"];
+//
+// ⭐ WAVE 23 (contract C10, ruling R7) — THE LANDING IS NOW `#/home`.
+//
+// ⛔ CHROME ROUTES ARE NOT GRANTED PAGES, AND THE :1039 LAW SURVIVES INTACT. This shell's
+// oldest rule is that the nav is server-filtered and an undeclared surface is denied — which is
+// why Alerts is a PANEL and not a route. Home and Connectors are routes, and they do not
+// violate that rule for one reason that has to be true of every future member of this set:
+//
+//     A CHROME ROUTE RENDERS NOTHING THE SERVER DID NOT ALREADY GRANT.
+//
+// Home shows the entries `/nav` returned (its recents are RESOLVED against those entries and a
+// key absent from them is dropped, `homeModel.groupRecents`) plus create affordances that were
+// already in the rail. Connectors renders a SERVER-COMPOSED directory (`GET /connectors/
+// directory`, session-gated) — it is a window onto a payload, not a surface with its own data.
+// Neither can show a database, a module or a connector this session may not see; adding a route
+// that could would be the hard-coded surface the frame refuses to have.
+export const HOME_ROUTE = "home";
+export const CONNECTORS_ROUTE = "connectors";
+export const CHROME_ROUTES: ReadonlySet<string> = new Set([HOME_ROUTE, CONNECTORS_ROUTE]);
+
+export const LANDING_PREFERENCE: readonly string[] = [HOME_ROUTE];
 
+/**
+ * The surface the shell lands on.
+ *
+ * ⚠ THE THREE LANDING SITES MOVE TOGETHER OR LOGINS STRAND (C10's own warning): this function,
+ * `LANDING_PREFERENCE` above, and the post-login redirect in `Shell.tsx`. Half a move leaves a
+ * signed-in user on a hash nothing renders.
+ *
+ * A chrome route needs no entry to be reachable — that is what makes it chrome — so the loop
+ * below returns it without consulting `entries`, and the old preference chain survives beneath
+ * it for the day a granted page becomes the landing again. `entries` stays a parameter for the
+ * same reason: the fallback is still a real answer about a real payload.
+ */
 export function defaultRoute(entries: NavEntry[]): string {
-  for (const key of LANDING_PREFERENCE) {
+  return firstDestination(entries, LANDING_PREFERENCE);
+}
+
+/**
+ * The landing rule itself, over an arbitrary preference list.
+ *
+ * ⚠ EXTRACTED (wave 23) SO THE FALLBACK CHAIN STAYS UNDER TEST. Before C10 the chain WAS
+ * `defaultRoute`, so `shell.test.ts` asserted it by calling that. With `home` at the head of the
+ * preference the function now returns on its first line, and the whole "preferred native entry →
+ * any native entry → any destination" ladder became unreachable from the outside — three checks
+ * would have had to be deleted rather than retargeted, which is how a gate quietly stops
+ * asserting the thing it was written for ([[gate-can-report-green-on-nothing]]). It is one
+ * function called two ways instead.
+ */
+export function firstDestination(
+  entries: NavEntry[],
+  preference: readonly string[]
+): string {
+  for (const key of preference) {
+    // A chrome route needs no entry to be reachable — that is what makes it chrome.
+    if (CHROME_ROUTES.has(key)) return key;
     const hit = entries.find((e) => e.key === key && e.kind === "native");
     if (hit) return hit.key;
   }
@@ -725,6 +837,13 @@ export function defaultRoute(entries: NavEntry[]): string {
  * member"). An unknown route falls to the default. Both fall back rather than
  * erroring, because a URL is something a person can type or a bookmark can
  * outlive.
+ *
+ * ⭐ WAVE 23 (C10): the fallback is now `#/home`, which is CHROME and therefore matches no
+ * entry — so this returns `undefined` for an unknown route, and the frame reads "no entry" as
+ * "render Home". One behaviour change, stated plainly: `#/deleted_table` used to open the
+ * Customer grid and now opens Home. That is the better answer (the reader asked for something
+ * that is gone; the landing is where you choose again) and it is the SAME answer an empty hash
+ * gets — which is what "Home is the default" has to mean in order to be true.
  */
 export function resolveRoute(entries: NavEntry[], route: string): NavEntry | undefined {
   const i = entries.findIndex((e) => e.key === route);

web/src/viz/seriesData.ts

@@ -40,6 +40,11 @@ export const VIZ_FIELD_TYPES: ReadonlySet<string> = new Set([
   // report the column as `text`, and the one thing a viz field type decides is what the surface
   // is allowed to claim about the column.
   "image",
+  // Wave 23 C7 — `json`. THE BATCH LINE the union's own comment names: a `Set` is not a
+  // `Record`, so the compiler stays green when this goes stale and `asFields` silently reports
+  // a json column as `text`. Same reasoning as `image` — the type is categorical either way,
+  // and what listing it buys is that the surface stops mis-naming the column.
+  "json",
 ]);
 
 /**

web/src/viz/types.ts

@@ -47,7 +47,15 @@ export type FieldType =
   // picture (it is a reference string, so `isNumericFieldType` leaves it categorical and the
   // shared formatter prints the ref) — the vocabulary has to know the word regardless, or the
   // grid cannot hand its own fields to `<DashboardView>` at all.
-  | "image";
+  | "image"
+  // Wave-23 C7 — `json`, and it is COERCED TO TEXT for charting by construction rather than by
+  // a branch: `isNumericFieldType` does not name it, so the engine groups it as a category and
+  // the shared formatter prints the stored string. Grouping a table by a whole document is a
+  // question nobody asks, but the vocabulary has to know the word or the grid cannot hand its
+  // own fields to DashboardView at all — which is the alarm two rules below going off. KEEP
+  // THIS COMMENT FREE OF THE STATEMENT-TERMINATOR CHARACTER, exactly as the metric note above
+  // says: verify_ui parses this union up to the first one it meets
+  | "json";
 
 export type FieldSource = "odoo" | "overlay";