Deploy AIOS web (React glide grid + FastAPI slice)

.gitattributes

@@ -33,3 +33,5 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+web/_qa_live_rail/1_before.png filter=lfs diff=lfs merge=lfs -text
+web/_qa_live_rail/debug.png filter=lfs diff=lfs merge=lfs -text

api/routes_grid.py

@@ -134,9 +134,18 @@ def workspace(scope: str = "customer",
             raise err(503, "store_unavailable", "the tenant store is unavailable")
         workspace = g["workspace"]
         workspace["overlays"] = g["ws"].get("overlays") or {}
+        # The field contract rides the cheap re-read on EVERY topic — see the customer branch
+        # below for why (a user table's first cohort changes its contract too: `_cohorts(ctx)`
+        # is scope-parameterized, so `ut_` surfaces have their own sets).
+        workspace["fields"] = g["fields"]
         workspace["measures"] = g["measures"]
         workspace["measureSets"] = g["measure_sets"]
-        workspace["derived"] = {}
+        # ⚠ `g["derived"]`, NOT `{}` (2026-08-04). R9 gave every topic its own cohort sets, and
+        # `ut_assembly` has been building this topic's cohort CELLS since — but this route threw
+        # them away, so the Locked-views column arrived on the cheap re-read with permanently
+        # empty values. A column that exists and can never have one is worse than an absent
+        # column: it reads as "this record is in no locked view", which is a claim.
+        workspace["derived"] = {str(pid): cells for pid, cells in (g["derived"] or {}).items()}
         workspace["viewer"] = {"name": session.uname, "isAdmin": bool(session.admin)}
         try:
             from core import users as _users
@@ -169,11 +178,18 @@ def workspace(scope: str = "customer",
             raise err(503, "store_unavailable", "the tenant store is unavailable")
         workspace = g["workspace"]
         workspace["overlays"] = g["ws"].get("overlays") or {}
+        # R9 made cohorts per-topic, so the PRODUCT surface has its own sets and its own
+        # first-cohort contract change. Same reason as the customer branch below.
+        workspace["fields"] = g["fields"]
         # The measure channel is EMPTY on this topic (customer-grain descope) — stated
         # explicitly so the client's pickers grey rather than guess.
         workspace["measures"] = g["measures"]
         workspace["measureSets"] = g["measure_sets"]
-        workspace["derived"] = {}
+        # `g["derived"]` — the same correction as the user-table branch above, for the same
+        # reason: `product_assembly` builds this topic's cohort cells and this route discarded
+        # them. The measure half stays empty on this topic by descope, which is a different
+        # statement and one the offer already makes.
+        workspace["derived"] = {str(pid): cells for pid, cells in (g["derived"] or {}).items()}
         workspace["viewer"] = {"name": session.uname, "isAdmin": bool(session.admin)}
         try:
             from core import users as _users
@@ -217,6 +233,21 @@ def workspace(scope: str = "customer",
     # (verify_api's overlay probe) without paying the pool call. Per-user by construction —
     # `table_workspace` is this session's workspace.
     workspace["overlays"] = g["ws"].get("overlays") or {}
+    # ⭐ THE FIELD CONTRACT, 2026-08-04 — and it is NOT decoration.
+    #
+    # `fields_from_workspace(ws, cohorts=bool(cohort_lists))` appends the derived "Locked
+    # views" column ONLY when the caller owns at least one cohort. So a user's FIRST cohort
+    # CHANGES THE FIELD CONTRACT — and the rows call that used to be the only carrier of
+    # `fields` is deliberately never re-fetched on a write (it is a 15-minute-cached Odoo
+    # pull; this route is the cheap re-read). The client therefore had no way to learn about
+    # that column short of a remount, which is the second half of the owner's "it only shows
+    # up when I switch modules and come back".
+    #
+    # ⚠ `g["fields"]` is the SAME list `_payload` serves on `/customers` — same assembly,
+    # same permission wall (`hidden_keys` already applied) — so the two wires cannot disagree
+    # about what a column is. Taking it from anywhere else would fork the contract that
+    # verify_fields_contract.py exists to keep single-sourced.
+    workspace["fields"] = g["fields"]
     # ── the STANDALONE measure channel (owner item 1, 2026-07-31) ────────────────────────────
     # The embed receives these as top-level render args; standalone lifts them off THIS route
     # (useCustomerData merges them into the payload slots the grid already reads). They ride

platform/core/store_pg.py

@@ -10,9 +10,11 @@ Same names, same signatures, same return types, same failure semantics — so sw
 an env var (`STORE_BACKEND=hf|pg`) and not a rewrite of every caller. `core/store_backend.py`
 does the selection; nothing above it needs to know which store it is talking to.
 
-⛔ NOT VERIFIED AGAINST A REAL SERVER — owner blocker **B-3** (choose + provision managed
-Postgres, US-region, co-located with Ashburn). `verify_store_pg.py` is written and it SKIPS LOUDLY
-without `DATABASE_URL`; it is not reported as passing, and this module is not the default backend.
+✅ VERIFIED against a real managed Postgres 2026-08-04 (W19: Neon us-east-2; `verify_store_pg.py`
+80/80 INCLUDING the integration half — schema apply, tenant provisioning, jsonb/bytea round-trips,
+80 concurrent FOR-UPDATE writes — run from HF egress; the owner's local network resets TLS:5432).
+The CUTOVER remains parked behind C1e's triggers and this module is not the default backend.
+Without `DATABASE_URL` the gate still SKIPS its integration half LOUDLY, never silently.
 The schema is `harness/pg/schema.sql`. Sequenced around the blocker, never stubbed past it.
 
 WHAT POSTGRES FIXES, precisely (C1c — these are the reasons, not a preference):

platform/harness/pg/schema.sql

@@ -8,11 +8,11 @@
 -- billing mirror) is transactional and needs joins; the ANALYTICAL mirror stays in DuckDB,
 -- one file per tenant, because file-per-tenant IS the isolation model there.
 --
--- ⛔ NOT YET RUN AGAINST A REAL SERVER. Owner blocker **B-3** (choose + provision managed
--- Postgres, US-region, co-located with Ashburn). This file and `core/store_pg.py` are the
--- sequenced-around work; the integration test is written but PENDING and is NOT reported as
--- passing. Nothing here is claimed to be verified beyond "it parses and the shapes match the
--- interface `core/store.py` already exposes".
+-- ✅ RUN AGAINST A REAL SERVER 2026-08-04 (W19): applied end-to-end by verify_store_pg's
+-- integration half against the owner's Neon (psycopg executes everything ABOVE the
+-- "-- Optional:" marker; the tail below it is psql-variable syntax). Tenant provisioning,
+-- jsonb/bytea round-trips and 80 concurrent FOR-UPDATE writes all proven. The CUTOVER remains
+-- parked behind C1e's triggers; `STORE_BACKEND` still defaults to hf.
 --
 -- ⚠ CO-LOCATE (C1b). An Ashburn app with a European database adds ~90ms to every query and undoes
 -- the reason the market pivot happened.

web/src/customer-grid/OverlaySurface.tsx

@@ -80,7 +80,24 @@ export function OverlayProvider({ children }: { children: ReactNode }) {
   );
 }
 
-function anchorRect(anchor: Anchor): AnchorRect {
+/**
+ * ⚠ NULL IS A REACHABLE VALUE HERE, and it must not be fatal.
+ *
+ * Half the call sites pass `someRef.current`, which is legitimately null on the render
+ * before the ref attaches, and `Anchor` does not include null — so every one of them was
+ * one ordering accident away from `"getBoundingClientRect" in null`, a TypeError thrown
+ * during RENDER, which unmounts the whole tree. That is not a hypothetical: it is what
+ * `_qa_live_rail.py` reproduced on the shipped build when the saved-view menu's anchor
+ * came back null (2026-08-04).
+ *
+ * A missing anchor is a positioning problem, not a reason to lose the application. The
+ * panel degrades to a zero-rect at the viewport origin — visible, dismissible, obviously
+ * wrong — while the root causes stay fixable at their own call sites.
+ */
+const NO_RECT: AnchorRect = { left: 0, top: 0, right: 0, bottom: 0, width: 0, height: 0 };
+
+function anchorRect(anchor: Anchor | null | undefined): AnchorRect {
+  if (!anchor) return NO_RECT;
   if ("getBoundingClientRect" in anchor) {
     const rect = anchor.getBoundingClientRect();
     return {
@@ -109,10 +126,10 @@ interface OverlayLayerOptions {
   panelRef: RefObject<HTMLElement | null>;
   onDismiss: () => void;
   dismissOnOutside?: boolean;
-  initialFocus?: "first" | "none" | string;
-  restoreFocus?: boolean;
-  trapFocus?: boolean;
-  outsideElements?: Array<HTMLElement | null>;
+  initialFocus?: "first" | "none" | string;
+  restoreFocus?: boolean;
+  trapFocus?: boolean;
+  outsideElements?: Array<HTMLElement | null>;
 }
 
 /** Shared dismissal/focus contract for anchored menus and fixed drawers. */
@@ -121,10 +138,10 @@ export function useOverlayLayer({
   panelRef,
   onDismiss,
   dismissOnOutside = true,
-  initialFocus = "first",
-  restoreFocus = true,
-  trapFocus = false,
-  outsideElements = [],
+  initialFocus = "first",
+  restoreFocus = true,
+  trapFocus = false,
+  outsideElements = [],
 }: OverlayLayerOptions): void {
   const id = useId();
   const stack = useContext(OverlayStackContext);
@@ -147,47 +164,47 @@ export function useOverlayLayer({
       )
         document.activeElement.blur();
       dismissRef.current();
-    };
-    const onKeyDown = (event: KeyboardEvent) => {
-      if (stack && !stack.isTop(id)) return;
-      if (event.key === "Escape") {
-        event.preventDefault();
-        event.stopPropagation();
-        if (
-          document.activeElement instanceof HTMLElement &&
-          panelRef.current?.contains(document.activeElement)
-        )
-          document.activeElement.blur();
-        dismissRef.current();
-        return;
-      }
-      if (event.key !== "Tab" || !trapFocus) return;
-      const focusable = Array.from(
-        panelRef.current?.querySelectorAll<HTMLElement>(FOCUSABLE) ?? []
-      ).filter((element) => element.getClientRects().length > 0);
-      if (!focusable.length) {
-        event.preventDefault();
-        panelRef.current?.focus();
-        return;
-      }
-      const first = focusable[0];
-      const last = focusable.at(-1)!;
-      const active = document.activeElement;
-      if (event.shiftKey && (active === first || !panelRef.current?.contains(active))) {
-        event.preventDefault();
-        last.focus();
-      } else if (!event.shiftKey && active === last) {
-        event.preventDefault();
-        first.focus();
-      }
-    };
+    };
+    const onKeyDown = (event: KeyboardEvent) => {
+      if (stack && !stack.isTop(id)) return;
+      if (event.key === "Escape") {
+        event.preventDefault();
+        event.stopPropagation();
+        if (
+          document.activeElement instanceof HTMLElement &&
+          panelRef.current?.contains(document.activeElement)
+        )
+          document.activeElement.blur();
+        dismissRef.current();
+        return;
+      }
+      if (event.key !== "Tab" || !trapFocus) return;
+      const focusable = Array.from(
+        panelRef.current?.querySelectorAll<HTMLElement>(FOCUSABLE) ?? []
+      ).filter((element) => element.getClientRects().length > 0);
+      if (!focusable.length) {
+        event.preventDefault();
+        panelRef.current?.focus();
+        return;
+      }
+      const first = focusable[0];
+      const last = focusable.at(-1)!;
+      const active = document.activeElement;
+      if (event.shiftKey && (active === first || !panelRef.current?.contains(active))) {
+        event.preventDefault();
+        last.focus();
+      } else if (!event.shiftKey && active === last) {
+        event.preventDefault();
+        first.focus();
+      }
+    };
     document.addEventListener("pointerdown", onPointerDown, true);
     document.addEventListener("keydown", onKeyDown, true);
     return () => {
       document.removeEventListener("pointerdown", onPointerDown, true);
       document.removeEventListener("keydown", onKeyDown, true);
     };
-  }, [dismissOnOutside, id, panelRef, stack, trapFocus]);
+  }, [dismissOnOutside, id, panelRef, stack, trapFocus]);
 
   useLayoutEffect(() => {
     const previous =
@@ -210,7 +227,10 @@ export function BodyPortal({ children }: { children: ReactNode }) {
 }
 
 interface AnchoredOverlayProps {
-  anchor: Anchor;
+  /** ⚠ Nullable BY DECLARATION as of 2026-08-04. Several call sites pass `ref.current`,
+   *  which is null before the ref attaches, and the old non-null type made that a
+   *  render-time TypeError instead of a type error. See `anchorRect`. */
+  anchor: Anchor | null | undefined;
   className: string;
   children: ReactNode;
   onDismiss: () => void;
@@ -248,7 +268,7 @@ export function AnchoredOverlay({
     top: 0,
     visibility: "hidden",
   });
-  const anchorElement = "getBoundingClientRect" in anchor ? anchor : null;
+  const anchorElement = anchor && "getBoundingClientRect" in anchor ? anchor : null;
 
   useOverlayLayer({
     panelRef,

web/src/customer-grid/ViewSidebar.tsx

@@ -717,13 +717,15 @@ export default function ViewSidebar({
                 className="cg-view-more"
                 aria-label={`Actions for folder ${group.folder.name}`}
                 aria-haspopup="menu"
-                onClick={(e) =>
+                onClick={(e) => {
+                  // ⛔ HOISTED OUT OF THE UPDATER — see the view menu's twin below. React
+                  // nulls `currentTarget` when the handler returns, and a functional
+                  // updater can be re-invoked AFTER that.
+                  const anchor = e.currentTarget;
                   setFolderMenu((cur) =>
-                    cur?.id === group.folder!.id
-                      ? null
-                      : { id: group.folder!.id, anchor: e.currentTarget }
-                  )
-                }
+                    cur?.id === group.folder!.id ? null : { id: group.folder!.id, anchor }
+                  );
+                }}
               >
                 ···
               </button>
@@ -850,13 +852,29 @@ export default function ViewSidebar({
                 aria-label={`Actions for ${view.name}`}
                 aria-haspopup="menu"
                 aria-expanded={menu?.viewId === view.id}
-                onClick={(event) =>
+                onClick={(event) => {
+                  /**
+                   * ⛔ THE ANCHOR IS READ HERE, NOT INSIDE THE UPDATER — and that one line
+                   * is the difference between this rail working and the whole app going
+                   * white. Found by _qa_live_rail.py on 2026-08-04, reproduced on the
+                   * shipped build.
+                   *
+                   * React sets `event.currentTarget = null` the moment this handler
+                   * returns (`executeDispatch`'s finally). A FUNCTIONAL updater is not
+                   * guaranteed to run inside the handler: the eager-state path evaluates
+                   * it once, synchronously, while `currentTarget` is still the button —
+                   * but React re-invokes it when it processes the queue for real, and by
+                   * then it is null. The menu therefore opened correctly and only died
+                   * later, on a re-render triggered by something else entirely — which is
+                   * why a white screen appeared one interaction AFTER the click that
+                   * caused it. `AnchoredOverlay` then did `"getBoundingClientRect" in
+                   * null` and took the tree down with it.
+                   */
+                  const anchor = event.currentTarget;
                   setMenu((current) =>
-                    current?.viewId === view.id
-                      ? null
-                      : { viewId: view.id, anchor: event.currentTarget }
-                  )
-                }
+                    current?.viewId === view.id ? null : { viewId: view.id, anchor }
+                  );
+                }}
               >
                 ···
               </button>

web/src/customer-grid/liveWorkspace.ts

@@ -0,0 +1,153 @@
+// ---------------------------------------------------------------------------
+// customer-grid / liveWorkspace.ts
+// The workspace that arrives AFTER mount — pure and React-free, so
+// verify_live_workspace.py can run it under node.
+//
+// ⛔ THE DEFECT THIS EXISTS FOR (owner, 2026-08-04). "Creating a new Cohort or
+// Locked list under Product/Customer only shows up when I click a different
+// module first and come back."
+//
+// It was exact. `CustomerGrid`'s init effect is gated on
+// `initializedKey.current === storageKey`, so it reads `payload.workspace`
+// EXACTLY ONCE per mount. Under Streamlit that was invisible — a rerun replaces
+// the iframe, so every host round trip WAS a remount and init ran again. The
+// standalone shell has no rerun: `CustomerGrid` stays mounted, and the only
+// thing that remounts it is `key={active.key}` in Shell.tsx — i.e. switching
+// modules, which is precisely the workaround the owner found.
+//
+// So the write path was complete and the READ path stopped at the door:
+// `add_to_list` → the host creates the set → `rerender: true` →
+// WORKSPACE_STALE_EVENT → `reread()` → `payload.workspace` genuinely carries the
+// new locked view (wave 17 R1 projects every cohort as a view) — and `views`
+// state, seeded once at init, never heard about it.
+//
+// TWO STRATA GO STALE TOGETHER, and fixing only the first would have looked
+// fixed while staying broken:
+//   views   the projected locked view = the rail row the owner is looking for.
+//   fields  `fields_from_workspace(ws, cohorts=bool(cohort_lists))` — the
+//           derived "Locked views" column EXISTS ONLY ONCE A COHORT DOES. The
+//           user's FIRST cohort therefore changes the field contract, and an
+//           init-once `fields` would have left that column out of the Fields
+//           menu until the very remount we are removing the need for.
+//
+// ⭐ ADD-ONLY, AND THAT IS A DESIGN DECISION, NOT AN OMISSION. Everything the
+// user already holds is left BY IDENTITY: an in-flight filter tree, a config
+// mid-autosave (420 ms debounce), a rename waiting on its echo. This module is
+// the answer to "what has APPEARED since we mounted", and nothing else. Taking
+// host copies of things we already hold would re-introduce every blip
+// optimism.ts / viewEcho.ts / folders.ts were written to remove — the whole
+// no-blip layer rests on "this browser's copy is the newest truth".
+//
+// ⚠ TOMBSTONES ARE NOT OPTIONAL HERE, and an add-only merge without them is
+// WORSE than the bug it fixes. The event queue sends ONE batch at a time
+// (apiBridge `drain`), so this interleaving is ordinary:
+//     batch 1 [add_to_list]  in flight
+//     user deletes a view    → removed optimistically, queued behind batch 1
+//     batch 1 answers        → rerender → reread → the workspace STILL lists
+//                              the deleted view (its delete has not been sent)
+// Without a tombstone the row comes back — and since this merge never removes,
+// it would stay back until a remount. That is a delete that visibly failed.
+// Same window and same rule as folders.ts and optimism.ts: ECHO_RECENT_MS, and
+// anything past it yields to the host, because divergence is not an echo.
+// ---------------------------------------------------------------------------
+
+import { ECHO_RECENT_MS } from "./viewEcho";
+import type { Field, SavedView, ViewConfig } from "./types";
+
+/** id -> when THIS browser deleted it. Browser-clock arithmetic on purpose:
+ *  both sides of the comparison come from this machine, so this is not the
+ *  tenant-day contract ([[date-window-vocabulary]]) — that one is about two
+ *  ENGINES agreeing on a date. */
+export type Tombstones = Record<string, number>;
+
+/** Upper bound on a tombstone map, matching FOLDER_STAMP_MAX. A long-lived tab
+ *  must not accumulate an archive of everything it ever deleted. */
+export const TOMBSTONE_MAX = 64;
+
+const isRecent = (t: number | undefined, now: number): boolean =>
+  typeof t === "number" && now - t <= ECHO_RECENT_MS;
+
+/** Drop entries past the echo window. Called at every stamp AND before every
+ *  persist, so the blob stays a recent window rather than a growing log. */
+export function pruneTombstones(stamps: Tombstones | undefined, now: number): Tombstones {
+  const kept = Object.entries(stamps ?? {}).filter(
+    ([, t]) => typeof t === "number" && isRecent(t, now)
+  );
+  return Object.fromEntries(kept.slice(-TOMBSTONE_MAX));
+}
+
+/** Record one deletion. Pure so the caller's ref update stays a one-liner. */
+export function stampTombstone(stamps: Tombstones | undefined, id: string, now: number): Tombstones {
+  return pruneTombstones({ ...(stamps ?? {}), [id]: now }, now);
+}
+
+/**
+ * Views that have APPEARED on the host since this browser last looked.
+ *
+ * Returns `current` BY IDENTITY when there is nothing to adopt — which is the
+ * load-bearing half of the contract, not an optimisation. `withWorkspace` mints
+ * a fresh payload object on every re-read, so `hostViews` changes identity each
+ * time whether or not its contents did; a merge that always returned a new
+ * array would re-render the grid (and re-write localStorage) on every echo.
+ *
+ * `normalize` is injected rather than imported because it needs the FIELD LIST
+ * the caller is about to commit — a locked view's projected `config.order` names
+ * the derived cohort column, and normalizing against a stale field array would
+ * quietly drop the very key that arrived with it. The caller therefore adopts
+ * fields FIRST and hands the result down (see CustomerGrid's live effect).
+ */
+export function adoptNewViews(
+  current: SavedView[],
+  hostViews: SavedView[] | undefined,
+  tombstones: Tombstones | undefined,
+  now: number,
+  normalize: (config: Partial<ViewConfig> | undefined) => ViewConfig
+): SavedView[] {
+  if (!Array.isArray(hostViews) || hostViews.length === 0) return current;
+  const held = new Set(current.map((v) => v.id));
+  const fresh: SavedView[] = [];
+  for (const view of hostViews) {
+    if (!view || typeof view.id !== "string" || view.id === "") continue;
+    if (held.has(view.id)) continue;
+    // Deleted here seconds ago and the echo has not caught up. Resurrecting it —
+    // even for one round trip — is the delete blip, and this merge never removes,
+    // so it would be a permanent one.
+    if (isRecent(tombstones?.[view.id], now)) continue;
+    held.add(view.id);                    // a host list with a duplicate id adds once
+    fresh.push({ ...view, config: normalize(view.config) });
+  }
+  return fresh.length === 0 ? current : [...current, ...fresh];
+}
+
+/**
+ * Fields that have APPEARED on the host since this browser last looked — in
+ * practice the derived "Locked views" column, which the server emits only once
+ * the user owns at least one cohort.
+ *
+ * Appended in host order at the END, which is where `fields_from_workspace`
+ * puts the derived column anyway, and `reconcileOrder` folds any key missing
+ * from a saved `config.order` in for us — so nothing has to touch a stored view
+ * for the new column to become togglable in the Fields menu.
+ *
+ * ⚠ The tombstone map here is `FieldStamps.deleted`, the SAME one
+ * `reconcileFields` consults at mount, for the same reason: a column this
+ * browser dropped must not walk back in through a lagged echo.
+ */
+export function adoptNewFields(
+  current: Field[],
+  hostFields: Field[] | undefined,
+  tombstones: Tombstones | undefined,
+  now: number
+): Field[] {
+  if (!Array.isArray(hostFields) || hostFields.length === 0) return current;
+  const held = new Set(current.map((f) => f.key));
+  const fresh: Field[] = [];
+  for (const field of hostFields) {
+    if (!field || typeof field.key !== "string" || field.key === "") continue;
+    if (held.has(field.key)) continue;
+    if (isRecent(tombstones?.[field.key], now)) continue;
+    held.add(field.key);
+    fresh.push(field);
+  }
+  return fresh.length === 0 ? current : [...current, ...fresh];
+}

web/src/customer-grid/types.ts

@@ -2109,6 +2109,17 @@ export interface GridWorkspace {
   storageKey: string;
   views: SavedView[];
   activeViewId?: string;
+  /**
+   * 2026-08-04 — the FIELD CONTRACT, so it rides the cheap re-read a durable write triggers
+   * (WORKSPACE_STALE) instead of the heavy rows call, which is deliberately never refetched.
+   *
+   * ⚠ This is not a convenience copy. `fields_from_workspace(ws, cohorts=…)` emits the derived
+   * "Locked views" column only once a cohort EXISTS, so a user's FIRST cohort changes the
+   * contract — and before this key the client could not learn that without a remount. Same
+   * list the rows route serves, from the same assembly, with the same permission wall applied.
+   * Absent = an older host: the client keeps the fields it already has (`withWorkspace`).
+   */
+  fields?: Field[];
   /** C4 — the view rail's folders. Absent = no folders, the pre-wave-8 shape. */
   folders?: GridFolder[];
   /** C4 — the cohort rail's folders (the cohort page's workspace). */

web/src/customer-grid/useCustomerData.ts

@@ -64,6 +64,17 @@ function readHostPayload(): CustomersPayload | null {
  */
 function withWorkspace(payload: CustomersPayload, ws: GridWorkspace): CustomersPayload {
   const out: CustomersPayload = { ...payload, workspace: ws };
+  // 2026-08-04 — the FIELD CONTRACT rides this cheap call too. The derived "Locked views"
+  // column exists only once the caller owns a cohort, so creating the first one changes the
+  // contract; the rows call that used to be its only carrier is never refetched on a write.
+  //
+  // ⚠ IDENTITY IS PRESERVED WHEN NOTHING CHANGED. `payload.fields` is a hook dependency
+  // downstream (CustomerGrid's live adopt), and a fresh array on every echo would re-run
+  // that effect for no reason. An empty/absent list keeps what we already have rather than
+  // blanking the table — absent means "an older host", never "this table has no columns".
+  if (Array.isArray(ws.fields) && ws.fields.length > 0 &&
+      JSON.stringify(ws.fields) !== JSON.stringify(payload.fields))
+    out.fields = ws.fields;
   if (Array.isArray(ws.measures)) out.measures = ws.measures;
   if (ws.measureSets && typeof ws.measureSets === "object") out.measureSets = ws.measureSets;
   if (ws.viewer && typeof ws.viewer.name === "string") out.viewer = ws.viewer;