Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -0,0 +1,23 @@
+{
+ "current": "v3 (6b9fa62)",
+ "releases": [
+  {
+   "version": "v3",
+   "sha": "6b9fa62",
+   "date": "2026-08-05",
+   "subject": "release v3"
+  },
+  {
+   "version": "v2",
+   "sha": "fd05861",
+   "date": "2026-08-04",
+   "subject": "release v2"
+  },
+  {
+   "version": "v1",
+   "sha": "5b4e2c4",
+   "date": "2026-08-04",
+   "subject": "release v1"
+  }
+ ]
+}

VERSION

@@ -1 +1 @@
-v2 (fd05861)
+v3 (6b9fa62)

api/main.py

@@ -55,6 +55,7 @@ from starlette.exceptions import HTTPException as StarletteHTTPException  # noqa
 
 import aios_session  # noqa: E402
 import routes_admin  # noqa: E402
+import routes_alerts  # noqa: E402  (wave 20 item 25 — the Alerts inbox)
 import routes_assets  # noqa: E402  (wave 18 C2-ASSET — catalog product imagery)
 import routes_auth  # noqa: E402
 import routes_automation  # noqa: E402  (wave 18 C4-AUTO — SESSION D's router, mounted by A)
@@ -67,6 +68,7 @@ import routes_pages  # noqa: E402
 import routes_platform_admin  # noqa: E402  (wave 19 R3/R4 — the Loopable cross-tenant plane)
 import routes_products  # noqa: E402  (wave 15 C-TOPIC — gated, not yet in the nav)
 import routes_records  # noqa: E402
+import routes_shares  # noqa: E402  (wave 20 R10 — grants for views, folders and databases)
 import routes_tables  # noqa: E402  (wave 18 C3-UT — user-created databases over the wire)
 from core import grid_events  # noqa: E402
 from deps import Session, module_gate  # noqa: E402
@@ -193,6 +195,11 @@ app.include_router(routes_statements.router)
 # platform-operator route ever shadowing each other. Every path it declares is gated by
 # `core.platform_admin.is_platform_admin`, and `verify_api` enumerates this router to prove it.
 app.include_router(routes_platform_admin.router)
+# Wave 20 (owner items 25 + 18/23/26): the Alerts inbox and the manage-access surface. Both are
+# session-gated rather than admin-gated — an alert is a person's own subscription, and sharing is
+# something every user does with their own views/folders/databases.
+app.include_router(routes_alerts.router)
+app.include_router(routes_shares.router)
 
 
 # --- DEPRECATED ALIASES (removed when S2's shell flips; kept so the current bundle keeps working)

api/routes_alerts.py

@@ -0,0 +1,233 @@
+"""routes_alerts.py — the Alerts module (wave 20, owner item 25, contract C-ALERT).
+
+    GET    /api/v1/alerts                  -> {alerts:[...]}
+    POST   /api/v1/alerts                  <- {viewId, topic, label?}
+    DELETE /api/v1/alerts/{alert_id}
+    POST   /api/v1/alerts/{alert_id}/run   -> evaluate now (the pane's manual refresh)
+    GET    /api/v1/notifications           -> {unread, items:[...]}
+    POST   /api/v1/notifications/read      <- {ids:[...]|null, read?:bool}
+
+The semantics — an alert is a view plus a remembered matched set, a notification is a NEW
+ENTRANT, and the first evaluation seeds silently — live in `core.alerts` with the reasoning.
+This file owns the two things a route must: WHO may do it, and HOW the view gets evaluated.
+
+⭐ **THE EVALUATION RUNS AS THE ALERT'S OWNER, NOT AS THE CALLER.** `_run_alert` builds the pool
+for `rec['owner']`, never for whoever tripped the write hook. Any other choice leaks: a
+full-access admin editing a cell would otherwise evaluate a BU-scoped user's alert over the whole
+book, and the notification would name customers that user may not see — a permission leak wearing
+a notification's clothes. The owner's own scope is the only correct basis for their alert.
+
+⚠ **AN ALERT IS NOT A SECOND READ PATH.** It resolves rows through the same
+`routes_customers.grid_assembly` / `routes_tables.ut_assembly` the grid uses, so a row that an
+alert can see is by construction a row its owner could open. Re-implementing the filter here
+would be a second definition of "matches", and those two would drift.
+"""
+from fastapi import APIRouter, Body, Depends
+
+import core.alerts as alerts
+from deps import Session, err, require_session
+
+router = APIRouter(prefix="/api/v1")
+
+#: The alert-bearing surfaces. `ut_` tables are admitted by prefix, like everywhere else.
+_TOPICS = ("customer", "product")
+
+
+def _topic_or_400(raw):
+    topic = str(raw or "").strip().lower()
+    if topic.startswith("ut_") or topic in _TOPICS:
+        return topic
+    raise err(400, "bad_topic", f"topic must be one of {', '.join(_TOPICS)} or a ut_ table")
+
+
+def _owner_session(session: Session, owner: str):
+    """A `Session` for the alert's OWNER (see the module note on why the owner, not the caller).
+
+    ⚠ `Session` exposes `uname`/`admin` as PROPERTIES derived from `user`, not as fields — so an
+    owner session is built by swapping the `user` RECORD and letting both derive themselves. An
+    earlier version passed `uname=`/`admin=` to the constructor, which would have raised on the
+    first write hook of the wave; the properties are the single definition of who a session is,
+    and going around them is how a session with an admin flag and a non-admin record exists.
+
+    Returns None when the owner is gone or deactivated — their alerts then stop evaluating rather
+    than evaluating as somebody else, which is the fail-closed direction.
+    """
+    import core.users as users
+
+    if str(owner) == str(session.uname):
+        return session
+    rec = (users.registry() or {}).get(str(owner))
+    if not isinstance(rec, dict) or not rec.get("active", True):
+        return None
+    # `_public` is THE definition of what a session may know about its own account (never a hash
+    # or a salt) — the same one `routes_auth` uses. Building the dict by hand here would be a
+    # second definition, and the one that leaks is always the copy.
+    return Session(tenant=session.tenant, user=users._public(str(owner), rec),
+                   claims=session.claims, runtime=session.runtime)
+
+
+def _evaluate(session: Session, rec: dict):
+    """Resolve `rec`'s view over its topic AS THE ALERT'S OWNER, then fold the result in."""
+    import aios_grid
+    from harness import filter_eval
+
+    owner_sess = _owner_session(session, rec.get("owner"))
+    if owner_sess is None:
+        return {"skipped": "owner_unavailable"}
+    topic = str(rec.get("topic") or "")
+    try:
+        if topic.startswith("ut_"):
+            from routes_tables import ut_assembly
+            g = ut_assembly(owner_sess, topic,
+                            storage_key=f"{owner_sess.tenant}:{topic}:{owner_sess.uname}")
+        else:
+            from routes_customers import grid_assembly
+            g = grid_assembly(owner_sess, scope=topic, consume_corrections=False)
+    except Exception as e:                                  # noqa: BLE001
+        return {"skipped": "unavailable", "detail": type(e).__name__}
+
+    view = (g.get("views") or {}).get(str(rec.get("viewId")))
+    if not isinstance(view, dict):
+        # Deleted, or un-shared out from under the alert. Say so on the RECORD rather than
+        # deleting the alert: an alert that silently vanishes is indistinguishable from one that
+        # never fires, and the user cannot debug what is not there.
+        return {"skipped": "view_missing"}
+
+    # The SAME row build the grid and `/customers` use — `rows_from_pool` is what puts derived
+    # and overlay values on a row. Evaluating a filter against raw pool dicts would silently
+    # never match any condition on a user-created or measure column.
+    rows = aios_grid.rows_from_pool(g["rows_src"], g["fields"], g["ws"].get("overlays"),
+                                    derived=g.get("derived"))
+    config = view.get("config") or view
+    ctx = filter_eval.EvalCtx(
+        cohort_sets={str(k): {str(p) for p in (v.get("memberPids") or ())}
+                     for k, v in (g.get("lists") or {}).items() if isinstance(v, dict)},
+        measure_sets=g.get("measure_sets") or {},
+        today=g.get("today"))
+    pids = filter_eval.visible_pids(config.get("filters") or [], rows, g["fields"], ctx,
+                                    member_pids=config.get("memberPids"))
+    labels = {str(r.get("pid")): str(r.get("name") or r.get("pid")) for r in rows}
+    return alerts.evaluate(rec.get("id"), [str(p) for p in pids],
+                           labels=labels, partial=False, st=session.runtime)
+
+
+@router.get("/alerts")
+def list_alerts(session: Session = Depends(require_session)):
+    return {"alerts": alerts.list_alerts(user=session.uname, is_admin=session.admin,
+                                         st=session.runtime)}
+
+
+@router.post("/alerts")
+def create_alert(body: dict = Body(default=None), session: Session = Depends(require_session)):
+    body = body or {}
+    view_id = str(body.get("viewId") or "").strip()
+    if not view_id:
+        raise err(400, "bad_view", "an alert needs the id of the view it watches")
+    topic = _topic_or_400(body.get("topic"))
+    _require_filtered_view(session, topic, view_id)
+    import uuid
+    aid = f"al_{uuid.uuid4().hex[:12]}"
+    rec = alerts.create(aid, view_id=view_id, topic=topic, owner=session.uname,
+                        label=body.get("label") or "", st=session.runtime)
+    # SEED IMMEDIATELY, so the alert starts from "everything currently matching is old news".
+    # Deferring this to the first write hook would mean the next edit announces the whole view.
+    outcome = _evaluate(session, rec)
+    return {"alert": {**rec, "seeded": True}, "first": outcome}
+
+
+def _require_filtered_view(session: Session, topic: str, view_id: str):
+    """400 unless `view_id` exists on `topic` AND actually narrows something.
+
+    ⛔ AN ALERT ON AN UNFILTERED VIEW IS SILENTLY INCAPABLE OF ALERTING, which is worse than one
+    that is refused. `filter_eval` treats an inactive tree as "no narrowing, every row shows"
+    (`visible_pids`'s own rule), so such an alert seeds with the entire table and can never see an
+    entrant again — there is nothing left to enter. The owner's words are *"when a Record gets
+    into that Filter's criteria"*: no criteria, no alert, and said at creation rather than
+    discovered by never being notified.
+
+    `is_rule_active` is the SAME activeness predicate the engine and the column tints use — a
+    half-typed rule is not a filter, and this must agree with what actually narrows or it would
+    accept a view whose one rule the engine then ignores.
+    """
+    from harness import filter_eval
+
+    try:
+        if topic.startswith("ut_"):
+            from routes_tables import ut_assembly
+            g = ut_assembly(session, topic,
+                            storage_key=f"{session.tenant}:{topic}:{session.uname}")
+        else:
+            from routes_customers import grid_assembly
+            g = grid_assembly(session, scope=topic, consume_corrections=False)
+    except Exception:                                       # noqa: BLE001
+        raise err(503, "unavailable", "the table is unavailable — try again in a moment")
+    view = (g.get("views") or {}).get(str(view_id))
+    if not isinstance(view, dict):
+        raise err(404, "no_view", "that view does not exist on this table")
+    nodes, _conj = filter_eval.tree_parts((view.get("config") or view).get("filters") or [])
+
+    def _any_active(ns):
+        for n in ns or ():
+            if isinstance(n, dict) and isinstance(n.get("children"), list):
+                if _any_active(n["children"]):
+                    return True
+            elif filter_eval.is_rule_active(n):
+                return True
+        return False
+
+    if not _any_active(nodes):
+        raise err(400, "no_filter",
+                  "this view has no active filter, so no record can ever ENTER it — add a "
+                  "condition to the view first, then create the alert")
+
+
+@router.delete("/alerts/{alert_id}")
+def delete_alert(alert_id: str, session: Session = Depends(require_session)):
+    rec = next((r for r in alerts.list_alerts(st=session.runtime)
+                if str(r.get("id")) == str(alert_id)), None)
+    if rec is None:
+        raise err(404, "no_alert", "that alert does not exist")
+    if str(rec.get("owner")) != str(session.uname) and not session.admin:
+        raise err(403, "not_yours", "only the alert's owner (or an administrator) can delete it")
+    alerts.delete(alert_id, st=session.runtime)
+    return {"ok": True}
+
+
+@router.post("/alerts/{alert_id}/run")
+def run_alert(alert_id: str, session: Session = Depends(require_session)):
+    rec = next((r for r in alerts.list_alerts(user=session.uname, is_admin=session.admin,
+                                              st=session.runtime)
+                if str(r.get("id")) == str(alert_id)), None)
+    if rec is None:
+        raise err(404, "no_alert", "that alert does not exist")
+    return _evaluate(session, rec)
+
+
+@router.get("/notifications")
+def notifications(session: Session = Depends(require_session)):
+    return alerts.inbox(session.uname, st=session.runtime)
+
+
+@router.post("/notifications/read")
+def read_notifications(body: dict = Body(default=None),
+                       session: Session = Depends(require_session)):
+    body = body or {}
+    ids = body.get("ids")
+    if ids is not None and not isinstance(ids, list):
+        raise err(400, "bad_ids", "ids must be a list, or null to mark every notification")
+    return alerts.mark_read(session.uname, ids, read=bool(body.get("read", True)),
+                            st=session.runtime)
+
+
+def after_write(session: Session, topic_key: str):
+    """THE WRITE HOOK — call after a write that could change what a view matches.
+
+    Exported as a plain function (not a route) so `core.grid_events`' callers and S2's automation
+    upserts reach it the same way. It never raises: an alert evaluation failing must not fail the
+    edit that triggered it.
+    """
+    try:
+        return alerts.after_write(topic_key, st=session.runtime,
+                                  runner=lambda rec: _evaluate(session, rec))
+    except Exception:                                       # noqa: BLE001
+        return {"evaluated": 0}

api/routes_automation.py

@@ -64,16 +64,43 @@ def list_automations(session: Session = Depends(_GATE)):
              sorted(defs.items(), key=lambda kv: (kv[1].get("name") or "").lower())]
     return {"automations": items,
             "kinds": [{"key": "scrape_db", "label": "Web page to database"},
-                      {"key": "field_instagram", "label": "Instagram profile column"}],
+                      {"key": "field_instagram", "label": "Instagram profile column"},
+                      {"key": "discover_instagram", "label": "Find Instagram profiles"}],
             "cronPresets": engine.CRON_PRESETS,
             # ⚠ A BOOLEAN, NEVER THE KEY. The surface needs to say "the paid rung is not
             # configured" honestly instead of offering a tier that will silently refuse — and
             # that needs exactly one bit. Shipping the key itself to a browser would put a
             # billable secret in every user's devtools.
-            "hikerReady": engine.hiker_ready(),
+            "paidReady": engine.bd_ready(),
+            # THE SOURCE REGISTRY (D-9's seam), on the wire for the same reason `cronPresets` is:
+            # the module that RUNS a source is the only thing entitled to say what it can do, and
+            # a client copy of "Instagram can discover, TikTok cannot" goes stale in silence.
+            "sources": engine.source_status(),
+            # The discovery vocabulary, likewise server-owned: every name here is MEASURED-
+            # accepted by the vendor's own validator, so a client that invented one would build a
+            # query the API rejects. `lead` is the subset seen carrying VALUES on real rows.
+            "discover": {"fields": list(engine.BD_FILTER_FIELDS),
+                         "lead": list(engine.BD_FILTER_LEAD),
+                         "operators": list(engine.BD_FILTER_OPS),
+                         "nullaryOperators": list(engine.BD_NULLARY_OPS),
+                         "maxRecords": engine.BD_MAX_RECORDS,
+                         "table": engine.DISCOVER_TABLE},
             "storeAvailable": bool(session.runtime.available())}
 
 
+@router.post("/automations/discover/estimate")
+def discover_estimate(body: dict = Body(default=None), session: Session = Depends(_GATE)):
+    """What would this search cost? Shown BEFORE the run, never after.
+
+    ⚠ THE ANSWER IS AN ESTIMATE AND SAYS SO IN ITS OWN PAYLOAD (`basis: "SPEC"`). Bright Data
+    never returns a price before a run — the funds gate fires first and `price: 0` means "not
+    priced", not "free" — and this account's token cannot read a balance (`/customer/balance`
+    answers 403). A number presented as billed would be the invented measurement this whole
+    module refuses to make.
+    """
+    return engine.discover_estimate((body or {}).get("recordsLimit"))
+
+
 @router.get("/automations/tables")
 def automation_tables(session: Session = Depends(_GATE)):
     """The blank databases an automation can target, with their fields.
@@ -82,13 +109,21 @@ def automation_tables(session: Session = Depends(_GATE)):
     two can never collide. It exists because the automation editor needs the table+field list to
     build a config at all, and D must not block on A's route landing. When C3-UT is live this
     keeps working (same bucket) — it is a duplicate reader, never a second writer.
+
+    ⛔ WAVE 20, item 3 — IT NO LONGER MIRRORS THE WALL, IT CALLS IT. This route re-implemented
+    `may_open` and got it WIDER: it also admitted `createdBy in ('automation', 'scheduler')`, so
+    a non-admin saw automation-created databases here and was refused the moment they opened,
+    edited or deleted one. A duplicate READER is fine; a duplicate WALL is not, because the two
+    only disagree in front of a user. One resolver now, and the engine stamps a human owner so
+    the merge takes nothing legitimate away (`ut_ensure`, `MACHINE_OWNERS`).
     """
+    import core.user_tables as user_tables
+
     out = []
     for key, t in sorted(engine.ut_all(session.runtime).items(),
                          key=lambda kv: (kv[1].get("label") or "").lower()):
-        if not (session.admin or t.get("createdBy") in (session.uname, "automation",
-                                                        "scheduler")):
-            continue                       # user_tables.may_open's rule, mirrored fail-closed
+        if not user_tables.may_open(key, session.uname, session.admin, st=session.runtime):
+            continue
         out.append({"key": key, "label": t.get("label") or key,
                     "source": t.get("source") or "Blank",
                     "rowCount": len(t.get("rows") or {}),

api/routes_platform_admin.py

@@ -1,593 +1,618 @@
-"""routes_platform_admin.py — THE LOOPABLE ADMIN PLANE (wave 19, owner item 13 / R3+R4).
-
-Every other admin surface in this product answers questions about ONE tenant. This one answers
-questions about the PLATFORM: who our customers are, what they are running, whether their data
-sources are alive, and what the automation fleet costs. It is the first cross-tenant reader that
-has ever existed here, which is why it is also the most carefully walled.
-
-⛔ THE WALL. `padmin_gate` is `core.platform_admin.is_platform_admin` — a DOUBLE lock (the record
-flag AND the `loopable` tenant), fail-closed, applied to every single route in this file through
-one dependency. A tenant admin is NOT admitted: `role: 'admin'` is Royal's or Nurilab's authority
-over their own workspace and it must never widen into a view of each other. `verify_api.py`'s
-W19-ADMIN section proves that by ENUMERATING this router and having a tenant admin try every path
-it declares, so a route added later cannot quietly ship without the wall.
-
-⛔ CROSS-TENANT READS GO THROUGH EACH TENANT'S OWN RUNTIME. `runtime.get_runtime(slug)` per tenant,
-then `rt.get(...)` — never `core.store.get("<raw key>")`. The runtime is what applies the store
-NAMESPACE (`t/<slug>/…`) or binds the tenant's OWN dataset repo (R2), so reading raw keys would
-silently return tenant #0's data labelled as somebody else's — a wrong answer that looks right,
-which is the worst failure this plane could have.
-
-HONEST DEGRADATION IS THE WHOLE DESIGN, NOT AN ERROR PATH. This plane reads six subsystems across
-N tenants; on any given day one of them can be unreachable (a suspended tenant record, a locked
-keychain, an HF repo hiccup, no AWS credentials in this container). A 500 would take the entire
-dashboard down because one cell could not be filled. So every collector catches, and every row can
-carry an `error` string that the pane RENDERS — "unknown" is a real answer and it is never
-rendered as a zero. ([[gate-can-report-green-on-nothing]]: a fabricated 0 and a true 0 must not
-look alike.)
-
-EVERY COUNT DRILLS TO ROWS. `/overview`'s per-tenant counts are computed by the SAME collector
-functions the `/users`, `/databases`, `/connectors` and `/automations` routes serve rows from, so
-a number and its drill-down cannot disagree — they are one computation, projected twice
-([[no-unverifiable-aggregates]]).
-"""
-import os
-import subprocess
-import sys
-import time
-from pathlib import Path
-
-from fastapi import APIRouter, Depends
-
-import core.platform_admin as platform_admin
-import core.store as store
-from deps import Session, err, require_session, users
-
-router = APIRouter(prefix="/api/v1/platform-admin")
-
-
-def _now_iso():
-    """UTC, offset-bearing — the one stamp format anything client-side may subtract from."""
-    import datetime as _dt
-    return _dt.datetime.now(_dt.timezone.utc).isoformat(timespec="seconds")
-
-
-def padmin_gate(session: Session = Depends(require_session)) -> Session:
-    """401 without a session, 403 unless this account is a Loopable platform operator.
-
-    ONE dependency for the whole router. A per-route check is a per-route chance to forget, and
-    the thing being forgotten here would be every customer's data at once.
-
-    The message deliberately does not confirm that a platform plane exists for somebody else —
-    a tenant admin who pokes at this URL learns only that their account cannot open it.
-    """
-    if not platform_admin.is_platform_admin(session.user):
-        raise err(403, "forbidden", "your account does not have access to this surface")
-    return session
-
-
-# ══════════════════════════════════════════════════════════════════════════ tenants
-
-
-def _tenant_bucket():
-    """The control-plane `tenants` records, or {} — a platform fact, in the DEFAULT store."""
-    from harness import runtime
-    try:
-        recs = store.get(runtime.TENANTS_KEY) or {}
-        return {str(k).strip().lower(): v for k, v in recs.items() if isinstance(v, dict)}
-    except Exception:
-        return {}
-
-
-def _slugs():
-    """Every tenant this deployment knows: compiled builders + control-plane records.
-
-    `runtime.known_tenants()` is the union and it is the same list login resolves against, so
-    this plane cannot show a customer the door does not recognise (or miss one it does).
-    """
-    from harness import runtime
-    try:
-        return list(runtime.known_tenants())
-    except Exception:
-        return sorted(_tenant_bucket())
-
-
-def _runtime_for(slug):
-    """(runtime, error). A tenant whose runtime will not build is a ROW WITH A NOTE, never a 500.
-
-    Two real cases produce one: a SUSPENDED record (`get_runtime` raises KeyError by design —
-    "which tenants exist" is not a question the login path answers), and tenant #0's builder,
-    which makes a LIVE Odoo call (`harness.tenants.royal_imports` → `excluded_customer_ids`) and
-    therefore fails on a box that cannot reach the ERP. Neither may take the dashboard down.
-    """
-    from harness import runtime
-    try:
-        return runtime.get_runtime(slug), ""
-    except KeyError:
-        return None, "not resolvable (suspended, or no builder and no active record)"
-    except Exception as e:                                        # noqa: BLE001
-        return None, f"runtime unavailable ({type(e).__name__})"
-
-
-def _scan(want=""):
-    """[(row, runtime)] — every tenant (or one), with its runtime RESOLVED EXACTLY ONCE.
-
-    The one-resolution rule is not tidiness. `get_runtime` is LRU-cached on success, but a tenant
-    that FAILS to build is not cached, and tenant #0's builder makes a live Odoo call — so a route
-    that asked twice would pay the timeout twice, and `/overview` (which asks about six
-    subsystems) would pay it six times. Resolve once, pass the handle down.
-    """
-    bucket = _tenant_bucket()
-    want = str(want or "").strip().lower()
-    out = []
-    for slug in _slugs():
-        if want and slug != want:
-            continue
-        rec = bucket.get(slug) or {}
-        rt, error = _runtime_for(slug)
-        out.append(({
-            "slug": slug,
-            # The record's name, else the built runtime's, else the slug. Tenant #0 is compiled
-            # and has no record, so without the runtime fallback it would render as "royal-imports".
-            "name": str(rec.get("name") or (getattr(rt, "name", "") if rt else "") or slug),
-            "source": "record" if rec else "compiled",
-            "status": str(rec.get("status") or ("active" if rt else "unknown")),
-            "domains": list(rec.get("domains") or []),
-            "modules": rec.get("modules", "all" if not rec else []),
-            # R2: the isolation shape. "own repo" and "shared repo + prefix" are genuinely
-            # different blast radii and an operator should be able to see which is which.
-            "storeRepo": rec.get("store_repo") or ("shared (tenant #0 repo)" if not rec else ""),
-            "storePrefix": getattr(rt, "store_namespace", "") if rt else "",
-            "error": error,
-        }, rt))
-    return out
-
-
-# ══════════════════════════════════════════════════════════════════════════ users
-
-
-def _user_rows(tenant=None):
-    """Accounts across every tenant, from the GLOBAL registry (`users.json` is control-plane).
-
-    ⛔ NEVER `salt` OR `hash`. This projection is the only one these routes use, mirroring
-    `routes_admin._view`'s discipline: one function that can leak, and it does not.
-
-    R4's two new fields ride here — `lastLogin` / `lastActive`, absent on every pre-wave record,
-    rendered as "never" rather than as a fabricated date.
-    """
-    try:
-        reg = users.registry() or {}
-    except Exception:
-        return []
-    want = str(tenant or "").strip().lower()
-    rows = []
-    for uname, rec in sorted(reg.items()):
-        if not isinstance(rec, dict):
-            continue
-        slug = str(rec.get("tenant") or "royal-imports").strip().lower()
-        if want and slug != want:
-            continue
-        rows.append({
-            "username": uname,
-            "name": rec.get("name") or uname,
-            "email": rec.get("email") or "",
-            "tenant": slug,
-            "role": rec.get("role", "user"),
-            "active": bool(rec.get("active", True)),
-            "lastLogin": rec.get("last_login") or "",
-            "lastActive": rec.get("last_active") or "",
-            "platformAdmin": rec.get("platform_admin") is True,
-        })
-    return rows
-
-
-# ══════════════════════════════════════════════════════════════════════════ databases
-
-
-def _database_rows(slug, rt):
-    """A tenant's user-created databases (`ut_*`) with their row counts.
-
-    Via `core.user_tables.all_tables(st=rt)` — the TenantRuntime, never the module-global, which
-    the engine's own header (`automation_engine.py:49-52`) flags as a cross-tenant defect for
-    every R2 tenant. That booked defect is exactly the mistake a cross-tenant reader would make
-    most easily, so it is stated at the call site too.
-    """
-    try:
-        import core.user_tables as ut
-        tables = ut.all_tables(st=rt) or {}
-    except Exception as e:                                        # noqa: BLE001
-        return [], f"databases unreadable ({type(e).__name__})"
-    rows = []
-    for key, t in sorted(tables.items(), key=lambda kv: (kv[1].get("label") or "").lower()):
-        if not isinstance(t, dict):
-            continue
-        rows.append({
-            "tenant": slug,
-            "key": key,
-            "label": t.get("label") or key,
-            "source": t.get("source") or "Blank",
-            "createdBy": t.get("createdBy") or "",
-            "created": t.get("created") or "",
-            "fields": len(t.get("fields") or []),
-            "rowCount": len(t.get("rows") or {}),
-        })
-    return rows, ""
-
-
-# ══════════════════════════════════════════════════════════════════════════ connectors
-
-
-def _connector_rows(slug, rt):
-    """A tenant's data sources and which one is actually RESOLVED (i.e. would serve a query).
-
-    `_resolved_odoo_key` is imported from `routes_keychain` rather than re-derived. It is the
-    route-level mirror of `TenantRuntime.odoo_source()`, it takes a runtime (not a session), and
-    a second copy of that resolution here would be a copy that drifts — at which point this plane
-    would confidently name the wrong live connector. Reused, not restated.
-    """
-    try:
-        import core.keychain as keychain
-        from routes_keychain import _CONNECTOR_FLAGS_KEY, _resolved_odoo_key
-        entries = keychain.list_entries(rt)
-        locked = not keychain.unlocked()
-        resolved, _flag = _resolved_odoo_key(rt)
-        flags = rt.get(_CONNECTOR_FLAGS_KEY) or {}
-    except Exception as e:                                        # noqa: BLE001
-        return [], f"connectors unreadable ({type(e).__name__})", False
-
-    rows = []
-    if slug == "royal-imports" and os.environ.get("ODOO_URL"):
-        rows.append({"tenant": slug, "key": "odoo-env", "label": "Odoo (environment)",
-                     "type": "odoo", "source": "env", "active": resolved == "env",
-                     "paused": bool((flags.get("odoo-env") or {}).get("paused"))})
-    for e in entries:
-        rows.append({"tenant": slug, "key": e["id"], "label": e["label"], "type": e["type"],
-                     "source": "keychain",
-                     "active": e["type"] == "odoo" and resolved == f"keychain:{e['id']}",
-                     "paused": bool((flags.get(e["id"]) or {}).get("paused"))})
-    return rows, "", locked
-
-
-# ══════════════════════════════════════════════════════════════════════════ automations + cost
-
-#: THE UNIT MODEL, from `ops/provision_automation_cron.py` (its cost note at :25-28 and the
-#: function it actually provisions at :211 / :269). Restated as constants rather than as prose so
-#: the arithmetic below is re-checkable against the thing that was really deployed:
-#: EventBridge Scheduler `rate(15 minutes)` → a 128 MB, 30 s-timeout Lambda that POSTs the tick.
-TICK_CADENCE = "rate(15 minutes)"
-TICK_PER_DAY = 96                       # 1440 / 15
-LAMBDA_MB = 128
-FREE_LAMBDA_REQUESTS = 1_000_000        # AWS always-free, per month
-FREE_SCHEDULER_INVOCATIONS = 14_000_000
-DAYS_PER_MONTH = 30.4
-
-
-def _runs_per_day(cron):
-    """Scheduled runs/day for the five-field crons this product offers, or None.
-
-    ⚠ DELIBERATELY NARROW. It answers exactly the shapes `automation_engine.CRON_PRESETS` can
-    produce (every-N-minutes, hourly, daily, weekly, monthly) and returns None for anything else
-    — an unparsed cadence is reported as "custom", never as a guessed number that would then be
-    multiplied into a cost. A wrong denominator is worse than an absent one.
-
-    ⚠ AND IT IS NOT MEASURED FROM HISTORY, on purpose: `automation_engine.MAX_RUNS` trims run
-    history to 20 entries, so a 15-minute automation retains ~5 hours of it. Deriving runs/day
-    from that window would understate by ~5x. History is reported as what it is — the last N runs.
-    """
-    parts = str(cron or "").split()
-    if len(parts) != 5:
-        return None
-    minute, hour, dom, _mon, dow = parts
-    if minute.startswith("*/") and hour == "*":
-        try:
-            step = int(minute[2:])
-        except ValueError:
-            return None
-        return (1440.0 / step) if step > 0 else None
-    if minute.isdigit() and hour == "*":
-        return 24.0
-    if minute.isdigit() and hour.isdigit():
-        if dom.isdigit():
-            return 1.0 / DAYS_PER_MONTH          # monthly
-        if dow.isdigit():
-            return 1.0 / 7.0                     # weekly
-        return 1.0                               # daily
-    return None
-
-
-def _automation_rows(slug, rt):
-    """A tenant's automations, their schedules, and their retained run history."""
-    try:
-        import automation_engine as engine
-        defs = engine.all_definitions(rt) or {}
-        max_runs = int(getattr(engine, "MAX_RUNS", 20))
-    except Exception as e:                                        # noqa: BLE001
-        return [], f"automations unreadable ({type(e).__name__})", 20
-    rows = []
-    for auto_id, d in sorted(defs.items(), key=lambda kv: (kv[1].get("name") or "").lower()):
-        if not isinstance(d, dict):
-            continue
-        sched = d.get("schedule") or {}
-        status = d.get("status") or {}
-        runs = list(d.get("runs") or [])
-        cron = sched.get("cron") or ""
-        per_day = _runs_per_day(cron) if sched.get("enabled") else 0.0
-        rows.append({
-            "tenant": slug,
-            "id": auto_id,
-            "name": d.get("name") or auto_id,
-            "kind": d.get("kind") or "",
-            "enabled": bool(sched.get("enabled")),
-            "cron": cron,
-            "runsPerDay": round(per_day, 2) if per_day is not None else None,
-            "state": status.get("state") or "idle",
-            "lastRunAt": status.get("lastRunAt") or "",
-            "lastSummary": status.get("lastSummary") or "",
-            # The retained window, named as such — see `_runs_per_day`'s second warning.
-            "runsRetained": len(runs),
-            "failedRetained": sum(1 for r in runs if isinstance(r, dict) and not r.get("ok")),
-            "createdBy": d.get("createdBy") or "",
-            "created": d.get("created") or "",
-        })
-    return rows, "", max_runs
-
-
-def _automation_cost(auto_rows):
-    """The estimated monthly cost of running the automation fleet — and the honest shape of it.
-
-    THE POINT THIS BLOCK EXISTS TO MAKE, which is not intuitive: **the external cron does not
-    scale with automations or tenants.** One EventBridge schedule fires one Lambda, which POSTs
-    one tick, and that tick runs every DUE automation for every tenant (`provision_automation_cron`
-    states this as the reason it stays $0 "at ten tenants"). So the AWS bill is a function of the
-    CADENCE alone — the fleet below adds work inside the API container, which is already paid for.
-
-    WHAT IS NOT COMPUTED HERE, deliberately: Lambda GB-seconds. That needs the real average
-    duration of the function, which only CloudWatch knows; assuming one would be inventing the
-    larger half of the free-tier calculation. `/aws` reports the measured figure when credentials
-    are available, and this block says so rather than filling the gap with a plausible number.
-    """
-    invocations = TICK_PER_DAY * DAYS_PER_MONTH
-    fleet_runs = sum(r["runsPerDay"] or 0 for r in auto_rows if r.get("enabled"))
-    unknown_cadence = sum(1 for r in auto_rows if r.get("enabled") and r.get("runsPerDay") is None)
-    return {
-        "cadence": TICK_CADENCE,
-        "invocationsPerMonth": int(round(invocations)),
-        "freeRequestsPct": round(100.0 * invocations / FREE_LAMBDA_REQUESTS, 3),
-        "freeSchedulerPct": round(100.0 * invocations / FREE_SCHEDULER_INVOCATIONS, 4),
-        "lambdaMb": LAMBDA_MB,
-        "usd": 0.0,
-        "fleetRunsPerDay": round(fleet_runs, 2),
-        "unknownCadence": unknown_cadence,
-        "basis": (
-            f"One EventBridge schedule ({TICK_CADENCE}) fires one {LAMBDA_MB} MB Lambda that "
-            f"POSTs the tick; that ONE tick runs every due automation for every tenant, so the "
-            f"AWS cost is set by the cadence and does not grow with the fleet. "
-            f"{int(round(invocations)):,} invocations/month is "
-            f"{round(100.0 * invocations / FREE_LAMBDA_REQUESTS, 3)}% of the 1,000,000-request "
-            f"always-free tier, so the marginal cost of the automations below is $0.00. "
-            f"Compute (GB-seconds) depends on measured durations and is NOT estimated here — "
-            f"the AWS report reads the real figure when credentials are available."
-        ),
-    }
-
-
-# ══════════════════════════════════════════════════════════════════════════ the AWS report
-
-#: `ops/aws_usage_report.py`, relative to this file: aios-web/api/ -> repo root -> ops/.
-_AWS_REPORT = Path(__file__).resolve().parents[2] / "ops" / "aws_usage_report.py"
-_AWS_TIMEOUT = 60
-
-
-def _aws_report(days=7):
-    """The AWS usage report as text, or an honest block saying why there is none.
-
-    ⛔ SUBPROCESS, NEVER `import`. Two concrete reasons, both found by reading that file rather
-    than by running it:
-      * it reassigns `sys.stdout` to a UTF-8 wrapper AT MODULE IMPORT (a cp1252 fix for this
-        box) — importing it would mutate the API process's stdout as a side effect;
-      * its `main()` calls `argparse.parse_args()` with no argv, so inside a server it would
-        parse UVICORN's arguments and can `sys.exit(2)` — and `SystemExit` is a `BaseException`,
-        which `except Exception` does not catch. A route that "cannot crash" would crash.
-
-    ⚠ ON THE SPACE THIS IS THE NORMAL PATH, NOT THE ERROR PATH. `deploy_web.py` ships `api/*.py`
-    and `web/`; `ops/` is not in the image, and AWS credentials live in a local `.env` that is
-    never deployed. So the honest block below is what the deployed plane shows, and it is written
-    to be read by an operator as information ("run it here") rather than as a fault.
-    """
-    if not _AWS_REPORT.is_file():
-        return {"available": False, "text": "",
-                "note": ("The AWS usage report is not part of this deployment — `ops/` ships "
-                         "with the repository, not with the container image. Run "
-                         "`python ops/aws_usage_report.py` locally for the live figures.")}
-    try:
-        proc = subprocess.run(
-            [sys.executable, str(_AWS_REPORT), "--days", str(int(days))],
-            capture_output=True, text=True, timeout=_AWS_TIMEOUT,
-            cwd=str(_AWS_REPORT.parent.parent))
-    except subprocess.TimeoutExpired:
-        return {"available": False, "text": "",
-                "note": (f"The AWS report did not answer within {_AWS_TIMEOUT}s — CloudWatch may "
-                         f"be unreachable from here. Nothing was assumed about usage.")}
-    except Exception as e:                                        # noqa: BLE001
-        return {"available": False, "text": "",
-                "note": f"The AWS report could not be run here ({type(e).__name__})."}
-    out = (proc.stdout or "").strip()
-    if proc.returncode != 0 or not out:
-        detail = (proc.stderr or "").strip().splitlines()
-        return {"available": False, "text": out,
-                "note": ("AWS credentials are not available here, or boto3 is not installed — "
-                         "no usage could be read, and none is guessed. "
-                         + (detail[-1][:200] if detail else ""))}
-    return {"available": True, "text": out, "note": ""}
-
-
-# ══════════════════════════════════════════════════════════════════════════ routes
-
-
-@router.get("/overview")
-def overview(session: Session = Depends(padmin_gate)):
-    """THE PLANE'S ONE TABLE: every tenant, with the counts that drill to the rows below.
-
-    Each count is produced by the same collector its `/…` route serves, so the number and its
-    drill-down are one computation projected twice. A subsystem that cannot be read contributes
-    an `errors` entry on that tenant's row and a NULL count — never a zero, which would read as
-    "this customer has no databases" when the truth is "we could not look".
-    """
-    t0 = time.time()
-    all_users = _user_rows()
-    users_by_tenant = {}
-    for u in all_users:
-        users_by_tenant.setdefault(u["tenant"], []).append(u)
-
-    rows = []
-    for t, rt in _scan():
-        slug = t["slug"]
-        row = dict(t)
-        row["users"] = len(users_by_tenant.get(slug, []))
-        row["admins"] = sum(1 for u in users_by_tenant.get(slug, []) if u["role"] == "admin")
-        errors = [t["error"]] if t["error"] else []
-        if rt is None:
-            # An unresolvable tenant still shows its ACCOUNTS (they live in the global registry,
-            # which is readable regardless) — everything tenant-store-shaped is honestly unknown.
-            row.update({"databases": None, "rows": None, "connectors": None,
-                        "automations": None, "keychainLocked": None, "errors": errors})
-            rows.append(row)
-            continue
-        dbs, db_err = _database_rows(slug, rt)
-        conns, conn_err, locked = _connector_rows(slug, rt)
-        autos, auto_err, _mr = _automation_rows(slug, rt)
-        errors += [e for e in (db_err, conn_err, auto_err) if e]
-        row.update({
-            "databases": None if db_err else len(dbs),
-            "rows": None if db_err else sum(d["rowCount"] for d in dbs),
-            "connectors": None if conn_err else len(conns),
-            "connectorsPaused": None if conn_err else sum(1 for c in conns if c["paused"]),
-            "automations": None if auto_err else len(autos),
-            "automationsEnabled": None if auto_err else sum(1 for a in autos if a["enabled"]),
-            "keychainLocked": None if conn_err else locked,
-            "errors": errors,
-        })
-        rows.append(row)
-
-    return {
-        "tenants": rows,
-        "totals": {
-            "tenants": len(rows),
-            # EVERY account, not the sum of the rows: an account whose `tenant` names a slug this
-            # deployment no longer knows belongs in the platform total and would vanish from a
-            # per-row sum. `orphanUsers` names that gap instead of hiding it.
-            "users": len(all_users),
-            "orphanUsers": len(all_users) - sum(r["users"] for r in rows),
-            # Sums SKIP unknowns rather than treating them as 0, and say how many were skipped —
-            # a total that silently absorbs an unreadable tenant is a fabricated total.
-            "databases": sum(r["databases"] or 0 for r in rows),
-            "rows": sum(r["rows"] or 0 for r in rows),
-            "automations": sum(r["automations"] or 0 for r in rows),
-            "unknownTenants": sum(1 for r in rows if r["databases"] is None),
-        },
-        "storeAvailable": bool(_store_ok()),
-        # ⚠ OFFSET-BEARING, and that is not pedantry. The client renders this as "read 2 minutes
-        # ago" via `Date.parse`, which reads a NAIVE stamp as browser-local — so a UTC container
-        # and a US viewer would turn "just now" into "5 hours ago", or into a future date that
-        # renders as "just now" forever. The stamps written by `core.users` carry an offset for
-        # the same reason; anything a browser subtracts from `Date.now()` must say what zone it
-        # is in. `verify_api` asserts the offset so this cannot regress to `strftime`.
-        "generatedAt": _now_iso(),
-        "tookMs": int((time.time() - t0) * 1000),
-    }
-
-
-def _store_ok():
-    try:
-        return store.available()
-    except Exception:
-        return False
-
-
-@router.get("/users")
-def platform_users(tenant: str = "", session: Session = Depends(padmin_gate)):
-    """Every account on the platform, or one tenant's — the drill behind the Users count.
-
-    R4's stamps are the columns that did not exist before this wave: `lastLogin` is written by
-    `routes_auth.login`, `lastActive` by `deps.require_session` (throttled to once an hour per
-    account per process). Absent means never seen, and the pane renders it as "never".
-    """
-    rows = _user_rows(tenant)
-    return {"users": rows, "count": len(rows),
-            "stampsNote": ("Login and activity stamps started with this release — accounts that "
-                           "have not signed in since show no date rather than an invented one. "
-                           "Activity is recorded at most once an hour per account.")}
-
-
-@router.get("/databases")
-def platform_databases(tenant: str = "", session: Session = Depends(padmin_gate)):
-    """Every tenant's user-created databases and row counts — the drill behind Databases/Rows."""
-    out, errors = [], {}
-    for t, rt in _scan(tenant):
-        slug = t["slug"]
-        if rt is None:
-            errors[slug] = t["error"]
-            continue
-        rows, err = _database_rows(slug, rt)
-        if err:
-            errors[slug] = err
-            continue
-        out += rows
-    return {"databases": out, "count": len(out),
-            "rows": sum(d["rowCount"] for d in out), "errors": errors}
-
-
-@router.get("/connectors")
-def platform_connectors(tenant: str = "", session: Session = Depends(padmin_gate)):
-    """Every tenant's data sources, which one is live, and which are paused.
-
-    METADATA ONLY — `keychain.list_entries` never decrypts, so no credential, and no masked
-    preview either: a platform operator needs to know a source EXISTS and whether it serves, not
-    what the secret looks like. The tenant's own admin surface is where previews belong.
-    """
-    out, errors, locked_any = [], {}, {}
-    for t, rt in _scan(tenant):
-        slug = t["slug"]
-        if rt is None:
-            errors[slug] = t["error"]
-            continue
-        rows, err, locked = _connector_rows(slug, rt)
-        if err:
-            errors[slug] = err
-            continue
-        locked_any[slug] = locked
-        out += rows
-    return {"connectors": out, "count": len(out), "keychainLocked": locked_any,
-            "errors": errors,
-            "note": ("A locked keychain means this container has no `AIOS_KEYCHAIN_KEY` — stored "
-                     "credentials cannot be read, so a tenant's sources fail closed rather than "
-                     "falling back to anyone else's.")}
-
-
-@router.get("/automations")
-def platform_automations(tenant: str = "", session: Session = Depends(padmin_gate)):
-    """Every tenant's automations, their schedules and run history, plus the fleet cost model."""
-    out, errors, retained = [], {}, 20
-    for t, rt in _scan(tenant):
-        slug = t["slug"]
-        if rt is None:
-            errors[slug] = t["error"]
-            continue
-        rows, err, max_runs = _automation_rows(slug, rt)
-        if err:
-            errors[slug] = err
-            continue
-        retained = max_runs
-        out += rows
-    return {"automations": out, "count": len(out),
-            "enabled": sum(1 for a in out if a["enabled"]),
-            "historyRetained": retained,
-            "cost": _automation_cost(out), "errors": errors,
-            "tickEnabled": os.environ.get("AIOS_AUTOMATIONS") == "1"}
-
-
-@router.get("/aws")
-def platform_aws(days: int = 7, session: Session = Depends(padmin_gate)):
-    """The AWS cron's usage report, verbatim, or an honest note explaining its absence."""
-    days = max(1, min(int(days or 7), 90))
-    return {"days": days, "report": _aws_report(days)}
+"""routes_platform_admin.py — THE LOOPABLE ADMIN PLANE (wave 19, owner item 13 / R3+R4).
+
+Every other admin surface in this product answers questions about ONE tenant. This one answers
+questions about the PLATFORM: who our customers are, what they are running, whether their data
+sources are alive, and what the automation fleet costs. It is the first cross-tenant reader that
+has ever existed here, which is why it is also the most carefully walled.
+
+⛔ THE WALL. `padmin_gate` is `core.platform_admin.is_platform_admin` — a DOUBLE lock (the record
+flag AND the `loopable` tenant), fail-closed, applied to every single route in this file through
+one dependency. A tenant admin is NOT admitted: `role: 'admin'` is Royal's or Nurilab's authority
+over their own workspace and it must never widen into a view of each other. `verify_api.py`'s
+W19-ADMIN section proves that by ENUMERATING this router and having a tenant admin try every path
+it declares, so a route added later cannot quietly ship without the wall.
+
+⛔ CROSS-TENANT READS GO THROUGH EACH TENANT'S OWN RUNTIME. `runtime.get_runtime(slug)` per tenant,
+then `rt.get(...)` — never `core.store.get("<raw key>")`. The runtime is what applies the store
+NAMESPACE (`t/<slug>/…`) or binds the tenant's OWN dataset repo (R2), so reading raw keys would
+silently return tenant #0's data labelled as somebody else's — a wrong answer that looks right,
+which is the worst failure this plane could have.
+
+HONEST DEGRADATION IS THE WHOLE DESIGN, NOT AN ERROR PATH. This plane reads six subsystems across
+N tenants; on any given day one of them can be unreachable (a suspended tenant record, a locked
+keychain, an HF repo hiccup, no AWS credentials in this container). A 500 would take the entire
+dashboard down because one cell could not be filled. So every collector catches, and every row can
+carry an `error` string that the pane RENDERS — "unknown" is a real answer and it is never
+rendered as a zero. ([[gate-can-report-green-on-nothing]]: a fabricated 0 and a true 0 must not
+look alike.)
+
+EVERY COUNT DRILLS TO ROWS. `/overview`'s per-tenant counts are computed by the SAME collector
+functions the `/users`, `/databases`, `/connectors` and `/automations` routes serve rows from, so
+a number and its drill-down cannot disagree — they are one computation, projected twice
+([[no-unverifiable-aggregates]]).
+"""
+import json
+import os
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+from fastapi import APIRouter, Depends
+
+import core.platform_admin as platform_admin
+import core.store as store
+from deps import Session, err, require_session, users
+
+router = APIRouter(prefix="/api/v1/platform-admin")
+
+
+def _now_iso():
+    """UTC, offset-bearing — the one stamp format anything client-side may subtract from."""
+    import datetime as _dt
+    return _dt.datetime.now(_dt.timezone.utc).isoformat(timespec="seconds")
+
+
+def padmin_gate(session: Session = Depends(require_session)) -> Session:
+    """401 without a session, 403 unless this account is a Loopable platform operator.
+
+    ONE dependency for the whole router. A per-route check is a per-route chance to forget, and
+    the thing being forgotten here would be every customer's data at once.
+
+    The message deliberately does not confirm that a platform plane exists for somebody else —
+    a tenant admin who pokes at this URL learns only that their account cannot open it.
+    """
+    if not platform_admin.is_platform_admin(session.user):
+        raise err(403, "forbidden", "your account does not have access to this surface")
+    return session
+
+
+# ══════════════════════════════════════════════════════════════════════════ tenants
+
+
+def _tenant_bucket():
+    """The control-plane `tenants` records, or {} — a platform fact, in the DEFAULT store."""
+    from harness import runtime
+    try:
+        recs = store.get(runtime.TENANTS_KEY) or {}
+        return {str(k).strip().lower(): v for k, v in recs.items() if isinstance(v, dict)}
+    except Exception:
+        return {}
+
+
+def _slugs():
+    """Every tenant this deployment knows: compiled builders + control-plane records.
+
+    `runtime.known_tenants()` is the union and it is the same list login resolves against, so
+    this plane cannot show a customer the door does not recognise (or miss one it does).
+    """
+    from harness import runtime
+    try:
+        return list(runtime.known_tenants())
+    except Exception:
+        return sorted(_tenant_bucket())
+
+
+def _runtime_for(slug):
+    """(runtime, error). A tenant whose runtime will not build is a ROW WITH A NOTE, never a 500.
+
+    Two real cases produce one: a SUSPENDED record (`get_runtime` raises KeyError by design —
+    "which tenants exist" is not a question the login path answers), and tenant #0's builder,
+    which makes a LIVE Odoo call (`harness.tenants.royal_imports` → `excluded_customer_ids`) and
+    therefore fails on a box that cannot reach the ERP. Neither may take the dashboard down.
+    """
+    from harness import runtime
+    try:
+        return runtime.get_runtime(slug), ""
+    except KeyError:
+        return None, "not resolvable (suspended, or no builder and no active record)"
+    except Exception as e:                                        # noqa: BLE001
+        return None, f"runtime unavailable ({type(e).__name__})"
+
+
+def _scan(want=""):
+    """[(row, runtime)] — every tenant (or one), with its runtime RESOLVED EXACTLY ONCE.
+
+    The one-resolution rule is not tidiness. `get_runtime` is LRU-cached on success, but a tenant
+    that FAILS to build is not cached, and tenant #0's builder makes a live Odoo call — so a route
+    that asked twice would pay the timeout twice, and `/overview` (which asks about six
+    subsystems) would pay it six times. Resolve once, pass the handle down.
+    """
+    bucket = _tenant_bucket()
+    want = str(want or "").strip().lower()
+    out = []
+    for slug in _slugs():
+        if want and slug != want:
+            continue
+        rec = bucket.get(slug) or {}
+        rt, error = _runtime_for(slug)
+        out.append(({
+            "slug": slug,
+            # The record's name, else the built runtime's, else the slug. Tenant #0 is compiled
+            # and has no record, so without the runtime fallback it would render as "royal-imports".
+            "name": str(rec.get("name") or (getattr(rt, "name", "") if rt else "") or slug),
+            "source": "record" if rec else "compiled",
+            "status": str(rec.get("status") or ("active" if rt else "unknown")),
+            "domains": list(rec.get("domains") or []),
+            "modules": rec.get("modules", "all" if not rec else []),
+            # R2: the isolation shape. "own repo" and "shared repo + prefix" are genuinely
+            # different blast radii and an operator should be able to see which is which.
+            "storeRepo": rec.get("store_repo") or ("shared (tenant #0 repo)" if not rec else ""),
+            "storePrefix": getattr(rt, "store_namespace", "") if rt else "",
+            "error": error,
+        }, rt))
+    return out
+
+
+# ══════════════════════════════════════════════════════════════════════════ users
+
+
+def _user_rows(tenant=None):
+    """Accounts across every tenant, from the GLOBAL registry (`users.json` is control-plane).
+
+    ⛔ NEVER `salt` OR `hash`. This projection is the only one these routes use, mirroring
+    `routes_admin._view`'s discipline: one function that can leak, and it does not.
+
+    R4's two new fields ride here — `lastLogin` / `lastActive`, absent on every pre-wave record,
+    rendered as "never" rather than as a fabricated date.
+    """
+    try:
+        reg = users.registry() or {}
+    except Exception:
+        return []
+    want = str(tenant or "").strip().lower()
+    rows = []
+    for uname, rec in sorted(reg.items()):
+        if not isinstance(rec, dict):
+            continue
+        slug = str(rec.get("tenant") or "royal-imports").strip().lower()
+        if want and slug != want:
+            continue
+        rows.append({
+            "username": uname,
+            "name": rec.get("name") or uname,
+            "email": rec.get("email") or "",
+            "tenant": slug,
+            "role": rec.get("role", "user"),
+            "active": bool(rec.get("active", True)),
+            "lastLogin": rec.get("last_login") or "",
+            "lastActive": rec.get("last_active") or "",
+            "platformAdmin": rec.get("platform_admin") is True,
+        })
+    return rows
+
+
+# ══════════════════════════════════════════════════════════════════════════ databases
+
+
+def _database_rows(slug, rt):
+    """A tenant's user-created databases (`ut_*`) with their row counts.
+
+    Via `core.user_tables.all_tables(st=rt)` — the TenantRuntime, never the module-global, which
+    the engine's own header (`automation_engine.py:49-52`) flags as a cross-tenant defect for
+    every R2 tenant. That booked defect is exactly the mistake a cross-tenant reader would make
+    most easily, so it is stated at the call site too.
+    """
+    try:
+        import core.user_tables as ut
+        tables = ut.all_tables(st=rt) or {}
+    except Exception as e:                                        # noqa: BLE001
+        return [], f"databases unreadable ({type(e).__name__})"
+    rows = []
+    for key, t in sorted(tables.items(), key=lambda kv: (kv[1].get("label") or "").lower()):
+        if not isinstance(t, dict):
+            continue
+        rows.append({
+            "tenant": slug,
+            "key": key,
+            "label": t.get("label") or key,
+            "source": t.get("source") or "Blank",
+            "createdBy": t.get("createdBy") or "",
+            "created": t.get("created") or "",
+            "fields": len(t.get("fields") or []),
+            "rowCount": len(t.get("rows") or {}),
+        })
+    return rows, ""
+
+
+# ════════════════════���═════════════════════════════════════════════════════ connectors
+
+
+def _connector_rows(slug, rt):
+    """A tenant's data sources and which one is actually RESOLVED (i.e. would serve a query).
+
+    `_resolved_odoo_key` is imported from `routes_keychain` rather than re-derived. It is the
+    route-level mirror of `TenantRuntime.odoo_source()`, it takes a runtime (not a session), and
+    a second copy of that resolution here would be a copy that drifts — at which point this plane
+    would confidently name the wrong live connector. Reused, not restated.
+    """
+    try:
+        import core.keychain as keychain
+        from routes_keychain import _CONNECTOR_FLAGS_KEY, _resolved_odoo_key
+        entries = keychain.list_entries(rt)
+        locked = not keychain.unlocked()
+        resolved, _flag = _resolved_odoo_key(rt)
+        flags = rt.get(_CONNECTOR_FLAGS_KEY) or {}
+    except Exception as e:                                        # noqa: BLE001
+        return [], f"connectors unreadable ({type(e).__name__})", False
+
+    rows = []
+    if slug == "royal-imports" and os.environ.get("ODOO_URL"):
+        rows.append({"tenant": slug, "key": "odoo-env", "label": "Odoo (environment)",
+                     "type": "odoo", "source": "env", "active": resolved == "env",
+                     "paused": bool((flags.get("odoo-env") or {}).get("paused"))})
+    for e in entries:
+        rows.append({"tenant": slug, "key": e["id"], "label": e["label"], "type": e["type"],
+                     "source": "keychain",
+                     "active": e["type"] == "odoo" and resolved == f"keychain:{e['id']}",
+                     "paused": bool((flags.get(e["id"]) or {}).get("paused"))})
+    return rows, "", locked
+
+
+# ══════════════════════════════════════════════════════════════════════════ automations + cost
+
+#: THE UNIT MODEL, from `ops/provision_automation_cron.py` (its cost note at :25-28 and the
+#: function it actually provisions at :211 / :269). Restated as constants rather than as prose so
+#: the arithmetic below is re-checkable against the thing that was really deployed:
+#: EventBridge Scheduler `rate(15 minutes)` → a 128 MB, 30 s-timeout Lambda that POSTs the tick.
+TICK_CADENCE = "rate(15 minutes)"
+TICK_PER_DAY = 96                       # 1440 / 15
+LAMBDA_MB = 128
+FREE_LAMBDA_REQUESTS = 1_000_000        # AWS always-free, per month
+FREE_SCHEDULER_INVOCATIONS = 14_000_000
+DAYS_PER_MONTH = 30.4
+
+
+def _runs_per_day(cron):
+    """Scheduled runs/day for the five-field crons this product offers, or None.
+
+    ⚠ DELIBERATELY NARROW. It answers exactly the shapes `automation_engine.CRON_PRESETS` can
+    produce (every-N-minutes, hourly, daily, weekly, monthly) and returns None for anything else
+    — an unparsed cadence is reported as "custom", never as a guessed number that would then be
+    multiplied into a cost. A wrong denominator is worse than an absent one.
+
+    ⚠ AND IT IS NOT MEASURED FROM HISTORY, on purpose: `automation_engine.MAX_RUNS` trims run
+    history to 20 entries, so a 15-minute automation retains ~5 hours of it. Deriving runs/day
+    from that window would understate by ~5x. History is reported as what it is — the last N runs.
+    """
+    parts = str(cron or "").split()
+    if len(parts) != 5:
+        return None
+    minute, hour, dom, _mon, dow = parts
+    if minute.startswith("*/") and hour == "*":
+        try:
+            step = int(minute[2:])
+        except ValueError:
+            return None
+        return (1440.0 / step) if step > 0 else None
+    if minute.isdigit() and hour == "*":
+        return 24.0
+    if minute.isdigit() and hour.isdigit():
+        if dom.isdigit():
+            return 1.0 / DAYS_PER_MONTH          # monthly
+        if dow.isdigit():
+            return 1.0 / 7.0                     # weekly
+        return 1.0                               # daily
+    return None
+
+
+def _automation_rows(slug, rt):
+    """A tenant's automations, their schedules, and their retained run history."""
+    try:
+        import automation_engine as engine
+        defs = engine.all_definitions(rt) or {}
+        max_runs = int(getattr(engine, "MAX_RUNS", 20))
+    except Exception as e:                                        # noqa: BLE001
+        return [], f"automations unreadable ({type(e).__name__})", 20
+    rows = []
+    for auto_id, d in sorted(defs.items(), key=lambda kv: (kv[1].get("name") or "").lower()):
+        if not isinstance(d, dict):
+            continue
+        sched = d.get("schedule") or {}
+        status = d.get("status") or {}
+        runs = list(d.get("runs") or [])
+        cron = sched.get("cron") or ""
+        per_day = _runs_per_day(cron) if sched.get("enabled") else 0.0
+        rows.append({
+            "tenant": slug,
+            "id": auto_id,
+            "name": d.get("name") or auto_id,
+            "kind": d.get("kind") or "",
+            "enabled": bool(sched.get("enabled")),
+            "cron": cron,
+            "runsPerDay": round(per_day, 2) if per_day is not None else None,
+            "state": status.get("state") or "idle",
+            "lastRunAt": status.get("lastRunAt") or "",
+            "lastSummary": status.get("lastSummary") or "",
+            # The retained window, named as such — see `_runs_per_day`'s second warning.
+            "runsRetained": len(runs),
+            "failedRetained": sum(1 for r in runs if isinstance(r, dict) and not r.get("ok")),
+            "createdBy": d.get("createdBy") or "",
+            "created": d.get("created") or "",
+        })
+    return rows, "", max_runs
+
+
+def _automation_cost(auto_rows):
+    """The estimated monthly cost of running the automation fleet — and the honest shape of it.
+
+    THE POINT THIS BLOCK EXISTS TO MAKE, which is not intuitive: **the external cron does not
+    scale with automations or tenants.** One EventBridge schedule fires one Lambda, which POSTs
+    one tick, and that tick runs every DUE automation for every tenant (`provision_automation_cron`
+    states this as the reason it stays $0 "at ten tenants"). So the AWS bill is a function of the
+    CADENCE alone — the fleet below adds work inside the API container, which is already paid for.
+
+    WHAT IS NOT COMPUTED HERE, deliberately: Lambda GB-seconds. That needs the real average
+    duration of the function, which only CloudWatch knows; assuming one would be inventing the
+    larger half of the free-tier calculation. `/aws` reports the measured figure when credentials
+    are available, and this block says so rather than filling the gap with a plausible number.
+    """
+    invocations = TICK_PER_DAY * DAYS_PER_MONTH
+    fleet_runs = sum(r["runsPerDay"] or 0 for r in auto_rows if r.get("enabled"))
+    unknown_cadence = sum(1 for r in auto_rows if r.get("enabled") and r.get("runsPerDay") is None)
+    return {
+        "cadence": TICK_CADENCE,
+        "invocationsPerMonth": int(round(invocations)),
+        "freeRequestsPct": round(100.0 * invocations / FREE_LAMBDA_REQUESTS, 3),
+        "freeSchedulerPct": round(100.0 * invocations / FREE_SCHEDULER_INVOCATIONS, 4),
+        "lambdaMb": LAMBDA_MB,
+        "usd": 0.0,
+        "fleetRunsPerDay": round(fleet_runs, 2),
+        "unknownCadence": unknown_cadence,
+        "basis": (
+            f"One EventBridge schedule ({TICK_CADENCE}) fires one {LAMBDA_MB} MB Lambda that "
+            f"POSTs the tick; that ONE tick runs every due automation for every tenant, so the "
+            f"AWS cost is set by the cadence and does not grow with the fleet. "
+            f"{int(round(invocations)):,} invocations/month is "
+            f"{round(100.0 * invocations / FREE_LAMBDA_REQUESTS, 3)}% of the 1,000,000-request "
+            f"always-free tier, so the marginal cost of the automations below is $0.00. "
+            f"Compute (GB-seconds) depends on measured durations and is NOT estimated here — "
+            f"the AWS report reads the real figure when credentials are available."
+        ),
+    }
+
+
+# ══════════════════════════════════════════════════════════════════════════ the AWS report
+
+#: `ops/aws_usage_report.py`, relative to this file: aios-web/api/ -> repo root -> ops/.
+_AWS_REPORT = Path(__file__).resolve().parents[2] / "ops" / "aws_usage_report.py"
+_AWS_TIMEOUT = 60
+
+
+def _aws_report(days=7):
+    """The AWS usage report as text, or an honest block saying why there is none.
+
+    ⛔ SUBPROCESS, NEVER `import`. Two concrete reasons, both found by reading that file rather
+    than by running it:
+      * it reassigns `sys.stdout` to a UTF-8 wrapper AT MODULE IMPORT (a cp1252 fix for this
+        box) — importing it would mutate the API process's stdout as a side effect;
+      * its `main()` calls `argparse.parse_args()` with no argv, so inside a server it would
+        parse UVICORN's arguments and can `sys.exit(2)` — and `SystemExit` is a `BaseException`,
+        which `except Exception` does not catch. A route that "cannot crash" would crash.
+
+    ⚠ ON THE SPACE THIS IS THE NORMAL PATH, NOT THE ERROR PATH. `deploy_web.py` ships `api/*.py`
+    and `web/`; `ops/` is not in the image, and AWS credentials live in a local `.env` that is
+    never deployed. So the honest block below is what the deployed plane shows, and it is written
+    to be read by an operator as information ("run it here") rather than as a fault.
+    """
+    if not _AWS_REPORT.is_file():
+        return {"available": False, "text": "",
+                "note": ("The AWS usage report is not part of this deployment — `ops/` ships "
+                         "with the repository, not with the container image. Run "
+                         "`python ops/aws_usage_report.py` locally for the live figures.")}
+    try:
+        proc = subprocess.run(
+            [sys.executable, str(_AWS_REPORT), "--days", str(int(days))],
+            capture_output=True, text=True, timeout=_AWS_TIMEOUT,
+            cwd=str(_AWS_REPORT.parent.parent))
+    except subprocess.TimeoutExpired:
+        return {"available": False, "text": "",
+                "note": (f"The AWS report did not answer within {_AWS_TIMEOUT}s — CloudWatch may "
+                         f"be unreachable from here. Nothing was assumed about usage.")}
+    except Exception as e:                                        # noqa: BLE001
+        return {"available": False, "text": "",
+                "note": f"The AWS report could not be run here ({type(e).__name__})."}
+    out = (proc.stdout or "").strip()
+    if proc.returncode != 0 or not out:
+        detail = (proc.stderr or "").strip().splitlines()
+        return {"available": False, "text": out,
+                "note": ("AWS credentials are not available here, or boto3 is not installed — "
+                         "no usage could be read, and none is guessed. "
+                         + (detail[-1][:200] if detail else ""))}
+    return {"available": True, "text": out, "note": ""}
+
+
+# ══════════════════════════════════════════════════════════════════════════ routes
+
+
+@router.get("/overview")
+def overview(session: Session = Depends(padmin_gate)):
+    """THE PLANE'S ONE TABLE: every tenant, with the counts that drill to the rows below.
+
+    Each count is produced by the same collector its `/…` route serves, so the number and its
+    drill-down are one computation projected twice. A subsystem that cannot be read contributes
+    an `errors` entry on that tenant's row and a NULL count — never a zero, which would read as
+    "this customer has no databases" when the truth is "we could not look".
+    """
+    t0 = time.time()
+    all_users = _user_rows()
+    users_by_tenant = {}
+    for u in all_users:
+        users_by_tenant.setdefault(u["tenant"], []).append(u)
+
+    rows = []
+    for t, rt in _scan():
+        slug = t["slug"]
+        row = dict(t)
+        row["users"] = len(users_by_tenant.get(slug, []))
+        row["admins"] = sum(1 for u in users_by_tenant.get(slug, []) if u["role"] == "admin")
+        errors = [t["error"]] if t["error"] else []
+        if rt is None:
+            # An unresolvable tenant still shows its ACCOUNTS (they live in the global registry,
+            # which is readable regardless) — everything tenant-store-shaped is honestly unknown.
+            row.update({"databases": None, "rows": None, "connectors": None,
+                        "automations": None, "keychainLocked": None, "errors": errors})
+            rows.append(row)
+            continue
+        dbs, db_err = _database_rows(slug, rt)
+        conns, conn_err, locked = _connector_rows(slug, rt)
+        autos, auto_err, _mr = _automation_rows(slug, rt)
+        errors += [e for e in (db_err, conn_err, auto_err) if e]
+        row.update({
+            "databases": None if db_err else len(dbs),
+            "rows": None if db_err else sum(d["rowCount"] for d in dbs),
+            "connectors": None if conn_err else len(conns),
+            "connectorsPaused": None if conn_err else sum(1 for c in conns if c["paused"]),
+            "automations": None if auto_err else len(autos),
+            "automationsEnabled": None if auto_err else sum(1 for a in autos if a["enabled"]),
+            "keychainLocked": None if conn_err else locked,
+            "errors": errors,
+        })
+        rows.append(row)
+
+    return {
+        "tenants": rows,
+        "totals": {
+            "tenants": len(rows),
+            # EVERY account, not the sum of the rows: an account whose `tenant` names a slug this
+            # deployment no longer knows belongs in the platform total and would vanish from a
+            # per-row sum. `orphanUsers` names that gap instead of hiding it.
+            "users": len(all_users),
+            "orphanUsers": len(all_users) - sum(r["users"] for r in rows),
+            # Sums SKIP unknowns rather than treating them as 0, and say how many were skipped —
+            # a total that silently absorbs an unreadable tenant is a fabricated total.
+            "databases": sum(r["databases"] or 0 for r in rows),
+            "rows": sum(r["rows"] or 0 for r in rows),
+            "automations": sum(r["automations"] or 0 for r in rows),
+            "unknownTenants": sum(1 for r in rows if r["databases"] is None),
+        },
+        "storeAvailable": bool(_store_ok()),
+        # ⚠ OFFSET-BEARING, and that is not pedantry. The client renders this as "read 2 minutes
+        # ago" via `Date.parse`, which reads a NAIVE stamp as browser-local — so a UTC container
+        # and a US viewer would turn "just now" into "5 hours ago", or into a future date that
+        # renders as "just now" forever. The stamps written by `core.users` carry an offset for
+        # the same reason; anything a browser subtracts from `Date.now()` must say what zone it
+        # is in. `verify_api` asserts the offset so this cannot regress to `strftime`.
+        "generatedAt": _now_iso(),
+        "tookMs": int((time.time() - t0) * 1000),
+    }
+
+
+def _store_ok():
+    try:
+        return store.available()
+    except Exception:
+        return False
+
+
+@router.get("/users")
+def platform_users(tenant: str = "", session: Session = Depends(padmin_gate)):
+    """Every account on the platform, or one tenant's — the drill behind the Users count.
+
+    R4's stamps are the columns that did not exist before this wave: `lastLogin` is written by
+    `routes_auth.login`, `lastActive` by `deps.require_session` (throttled to once an hour per
+    account per process). Absent means never seen, and the pane renders it as "never".
+    """
+    rows = _user_rows(tenant)
+    return {"users": rows, "count": len(rows),
+            "stampsNote": ("Login and activity stamps started with this release — accounts that "
+                           "have not signed in since show no date rather than an invented one. "
+                           "Activity is recorded at most once an hour per account.")}
+
+
+@router.get("/databases")
+def platform_databases(tenant: str = "", session: Session = Depends(padmin_gate)):
+    """Every tenant's user-created databases and row counts — the drill behind Databases/Rows."""
+    out, errors = [], {}
+    for t, rt in _scan(tenant):
+        slug = t["slug"]
+        if rt is None:
+            errors[slug] = t["error"]
+            continue
+        rows, err = _database_rows(slug, rt)
+        if err:
+            errors[slug] = err
+            continue
+        out += rows
+    return {"databases": out, "count": len(out),
+            "rows": sum(d["rowCount"] for d in out), "errors": errors}
+
+
+@router.get("/connectors")
+def platform_connectors(tenant: str = "", session: Session = Depends(padmin_gate)):
+    """Every tenant's data sources, which one is live, and which are paused.
+
+    METADATA ONLY — `keychain.list_entries` never decrypts, so no credential, and no masked
+    preview either: a platform operator needs to know a source EXISTS and whether it serves, not
+    what the secret looks like. The tenant's own admin surface is where previews belong.
+    """
+    out, errors, locked_any = [], {}, {}
+    for t, rt in _scan(tenant):
+        slug = t["slug"]
+        if rt is None:
+            errors[slug] = t["error"]
+            continue
+        rows, err, locked = _connector_rows(slug, rt)
+        if err:
+            errors[slug] = err
+            continue
+        locked_any[slug] = locked
+        out += rows
+    return {"connectors": out, "count": len(out), "keychainLocked": locked_any,
+            "errors": errors,
+            "note": ("A locked keychain means this container has no `AIOS_KEYCHAIN_KEY` — stored "
+                     "credentials cannot be read, so a tenant's sources fail closed rather than "
+                     "falling back to anyone else's.")}
+
+
+@router.get("/automations")
+def platform_automations(tenant: str = "", session: Session = Depends(padmin_gate)):
+    """Every tenant's automations, their schedules and run history, plus the fleet cost model."""
+    out, errors, retained = [], {}, 20
+    for t, rt in _scan(tenant):
+        slug = t["slug"]
+        if rt is None:
+            errors[slug] = t["error"]
+            continue
+        rows, err, max_runs = _automation_rows(slug, rt)
+        if err:
+            errors[slug] = err
+            continue
+        retained = max_runs
+        out += rows
+    return {"automations": out, "count": len(out),
+            "enabled": sum(1 for a in out if a["enabled"]),
+            "historyRetained": retained,
+            "cost": _automation_cost(out), "errors": errors,
+            "tickEnabled": os.environ.get("AIOS_AUTOMATIONS") == "1"}
+
+
+@router.get("/aws")
+def platform_aws(days: int = 7, session: Session = Depends(padmin_gate)):
+    """The AWS cron's usage report, verbatim, or an honest note explaining its absence."""
+    days = max(1, min(int(days or 7), 90))
+    return {"days": days, "report": _aws_report(days)}
+
+
+@router.get("/releases")
+def platform_releases(session: Session = Depends(padmin_gate)):
+    """⭐ WAVE 20 (owner item 12, ruling R6) — WHAT IS RUNNING WHERE, and what else could be.
+
+    Owner: *"Make this part of the deploy skill. Also ability to revert to any version we want.
+    Make sure App versioning is something that our company admin (loopable, non-tenant) can
+    easily see."* This is the SEEING half; promoting stays a CLI command by R6, so nothing here
+    writes and no web session can move production.
+
+    ⛔ THE HUB READS LIVE IN `core/releases.py`, NOT HERE. `ops/verify_portability.py` B2 forbids
+    the HuggingFace SDK anywhere under `aios-web/api/` — the API process is host-agnostic by
+    design — and it caught this endpoint's first draft doing exactly that. Same delegation shape
+    as `routes_assets` -> `core/assets.py`.
+    """
+    import core.releases as releases
+
+    return {"here": os.environ.get("AIOS_VERSION") or "unknown",
+            "environments": releases.environments(),
+            "releases": releases.history(),
+            # The runbook, in the payload, because the panel is read-only BY DESIGN and a user
+            # looking at it is exactly the person who needs to know how to move a version.
+            "promote": "python aios-web/deploy_web.py --promote=vN   (or --promote=staging)"}

api/routes_shares.py

@@ -0,0 +1,87 @@
+"""routes_shares.py — the manage-access surface (wave 20, owner ruling R10, contract C-SHARE).
+
+    GET  /api/v1/share/{kind}/{oid}      -> {owner, entries:[{user,role}], mayAdminister, people}
+    PUT  /api/v1/share/{kind}/{oid}      <- {entries:[{user,role}]}   (REPLACES the set)
+    GET  /api/v1/share/mine              -> {view:[id], folder:[id], database:[id]}
+
+`kind` ∈ view | folder | database. Roles are `view` | `edit` — the same two words the view rail
+already speaks, now extended to folders and databases so there is ONE vocabulary in the UI
+(R10: "the same picker views use").
+
+⛔ **RE-SHARING IS THE OWNER'S, AND THAT IS ENFORCED HERE, NOT IN THE CLIENT.** `PUT` requires
+`shares.may_administer` (owner or admin). A collaborator with `edit` may change an object's
+CONTENT and may not change who else can reach it — otherwise anyone you shared a view with could
+widen it to everyone, or grant themselves ownership and lock you out. The client greys the editor
+for non-administrators; that is a courtesy, and this check is the wall.
+
+⚠ **THE GRANT NEVER WIDENS PAST THE MODULE WALL.** `*` ("everyone") means every account that can
+already open the surface — `require_session` plus the topic's own gate run first and are
+unaffected by anything here. Sharing can only ever narrow-or-equal the set that could already
+reach the data ([[aios-permissioning]]).
+"""
+from fastapi import APIRouter, Body, Depends
+
+import core.shares as shares
+import core.users as users
+from deps import Session, err, require_session
+
+router = APIRouter(prefix="/api/v1")
+
+
+def _kind_or_400(raw):
+    try:
+        return shares._check_kind(raw)
+    except ValueError as e:
+        raise err(400, "bad_kind", str(e))
+
+
+@router.get("/share/mine")
+def my_shares(session: Session = Depends(require_session)):
+    """Everything shared WITH me, by kind — the "Shared with me" rail section (R10).
+
+    Registered before `/share/{kind}/{oid}` so the literal path wins the match; FastAPI resolves
+    in declaration order and `mine` would otherwise be read as a `kind`, answering 400 for a URL
+    that is not malformed at all.
+    """
+    return shares.shared_with(session.uname, st=session.runtime)
+
+
+@router.get("/share/{kind}/{oid}")
+def get_share(kind: str, oid: str, session: Session = Depends(require_session)):
+    kind = _kind_or_400(kind)
+    rec = shares.grants(kind, oid, st=session.runtime)
+    return {
+        **rec,
+        "role": shares.role_for(kind, oid, session.uname, is_admin=session.admin,
+                                st=session.runtime),
+        "mayAdminister": shares.may_administer(kind, oid, session.uname, is_admin=session.admin,
+                                               st=session.runtime),
+        # The people this account may share WITH — reusing the ONE definition of an assignable
+        # person (`core.users.assignable_people`, the same list the `user` field kind offers), so
+        # the share picker and the assignee picker can never disagree about who exists.
+        "people": users.assignable_people(tenant=session.tenant),
+    }
+
+
+@router.put("/share/{kind}/{oid}")
+def put_share(kind: str, oid: str, body: dict = Body(default=None),
+              session: Session = Depends(require_session)):
+    kind = _kind_or_400(kind)
+    body = body or {}
+    rec = shares.grants(kind, oid, st=session.runtime)
+    # An object with NO grant record yet has no owner — the first person to share it claims it.
+    # That is safe because reaching this route at all means passing the surface's own wall, and
+    # the alternative (refusing until somebody seeds an owner) would make a brand-new folder
+    # unshareable by the person who just made it.
+    if rec["owner"] and not shares.may_administer(kind, oid, session.uname,
+                                                  is_admin=session.admin, st=session.runtime):
+        raise err(403, "not_owner",
+                  "only the owner of this item (or an administrator) can change who it is "
+                  "shared with")
+    entries = body.get("entries")
+    if not isinstance(entries, list):
+        raise err(400, "bad_entries",
+                  "entries must be a list of {user, role} — send [] to un-share, which is how "
+                  "revoking is expressed")
+    return shares.set_grants(kind, oid, entries, owner=rec["owner"] or session.uname,
+                             st=session.runtime)

api/routes_tables.py

@@ -107,16 +107,42 @@ def ut_assembly(session: Session, table_key: str, storage_key: str = "",
             "defn": defn}
 
 
+def ut_label(defn, key, meta=None):
+    """THE name of a user table, resolved ONCE (wave 20, item 6a).
+
+    `nav_meta`'s rename wins, then the definition's own label, then the key. Every surface that
+    shows a database name reads through here, because the alternative is what wave 20 found: the
+    rail showed the renamed name (it reads `nav_meta`) while the automation editor's picker
+    showed the original (it reads the definition), and neither looked broken.
+
+    ⚠ `set_label` now writes the DEFINITION too, so the two agree at the source. This resolver
+    stays because it makes every row already stored — renamed before that fix landed — read
+    correctly today, without a migration.
+    """
+    return ((meta or {}).get(key, {}).get("name")
+            or (defn or {}).get("label") or key)
+
+
+def nav_meta(session):
+    """The tenant's nav_meta bucket, read defensively. A store blip must not take a list down."""
+    try:
+        got = session.runtime.get("nav_meta")
+        return got if isinstance(got, dict) else {}
+    except Exception:                                             # noqa: BLE001
+        return {}
+
+
 @router.get("/tables")
 def list_tables(session: Session = Depends(require_session)):
     """This session's user tables — the list the '+ New database' surface renders."""
     ut = _ut()
+    meta = nav_meta(session)
     out = []
     for key, t in sorted(ut.all_tables(st=session.runtime).items(),
-                         key=lambda kv: (kv[1].get("label") or "").lower()):
+                         key=lambda kv: (ut_label(kv[1], kv[0], meta) or "").lower()):
         if not ut.may_open(key, session.uname, session.admin, st=session.runtime):
             continue
-        out.append({"key": key, "label": t.get("label") or key,
+        out.append({"key": key, "label": ut_label(t, key, meta),
                     "source": t.get("source") or "Blank",
                     "createdBy": t.get("createdBy") or "",
                     "created": t.get("created") or "",
@@ -150,10 +176,40 @@ def create_table(body: dict = Body(default=None),
     return {"key": key}
 
 
+@router.patch("/tables/{table_key}")
+def patch_table(table_key: str, body: dict = Body(default=None),
+                session: Session = Depends(require_session)):
+    """Rename a database — IN ITS DEFINITION (wave 20, item 6a).
+
+    ⚠ THE RENAME DOOR IN THE NAV WRITES `nav_meta` AND MUST ALSO CALL THIS. `nav_meta` is the
+    nav's display layer; the definition is what the automation editor's database picker, the
+    schema drawer and every future reader see. A rename that lands in only one of them leaves a
+    picker that is confidently wrong rather than obviously stale. Posted to the wave doc as an
+    amendment for whoever owns that door.
+    """
+    defn = _defn_or_refuse(session, table_key)
+    ut = _ut()
+    if not (session.admin or defn.get("createdBy") == session.uname):
+        raise err(403, "forbidden", "only the database's creator or an admin can rename it")
+    label = ut.set_label(table_key, (body or {}).get("label"), st=session.runtime)
+    if not label:
+        raise err(400, "bad_label", "give the database a name")
+    return {"key": table_key, "label": label}
+
+
 @router.delete("/tables/{table_key}")
 def delete_table(table_key: str, session: Session = Depends(require_session)):
     """Creator or admin only — the same actors `may_open` admits, and deletion is the one
-    operation the client must confirm explicitly (the server cannot tell a click from a plan)."""
+    operation the client must confirm explicitly (the server cannot tell a click from a plan).
+
+    ⚠ WAVE 20, item 3 — THE OWNER'S "an admin cannot delete a database" IS NOT A WALL BUG HERE.
+    Measured: **no client calls this route at all.** The React shell POSTs `/tables` to create
+    one and has no delete affordance anywhere, so the endpoint is live, correct and unreachable.
+    The wall's real defect was next door and is fixed: `routes_automation` carried a SECOND,
+    wider ownership rule, and the engine stamped `createdBy: "scheduler"` on tables a cron
+    created first — which made a table's owner depend on a race, and left it admin-only forever
+    after. See `user_tables.MACHINE_OWNERS` and `automation_engine.ut_ensure`.
+    """
     _defn_or_refuse(session, table_key)
     try:
         _ut().delete(table_key, st=session.runtime)
@@ -194,13 +250,20 @@ def table_rows(table_key: str, session: Session = Depends(require_session)):
 @router.post("/tables/{table_key}/rows", status_code=201)
 def add_row(table_key: str, body: dict = Body(default=None),
             session: Session = Depends(require_session)):
+    """Append a row — or RESTORE one under its old id (contract C-ADDROW / C-UNDO).
+
+    ⚠ THE ANSWER IS ALWAYS THE ID THAT WAS STORED, never the one that was asked for. An undo
+    that requested `rid: 7` and got 12 because 7 had been re-used must find that out from the
+    response rather than assume; the client re-anchors on what came back.
+    """
     _defn_or_refuse(session, table_key)
     ut = _ut()
     values = (body or {}).get("values") or {}
     if not isinstance(values, dict):
         raise err(400, "bad_values", "values must be an object of {fieldKey: value}")
     try:
-        rid = ut.add_row(table_key, values, session.uname, st=session.runtime)
+        rid = ut.add_row(table_key, values, session.uname, st=session.runtime,
+                         rid=(body or {}).get("rid"))
     except Exception:
         raise err(503, "store_unavailable", "the row was not saved — the store refused")
     if rid is None:
@@ -209,6 +272,100 @@ def add_row(table_key: str, body: dict = Body(default=None),
     return {"rid": rid, "pid": int(rid)}
 
 
+# ---------------------------------------------------------------------------------------------
+# THE SHARED FIELD SCHEMA (contract C-FIELD, owner ruling R2)
+# ---------------------------------------------------------------------------------------------
+# R2: a `ut_*` table's fields are the TABLE'S schema — everyone with access sees the same
+# columns, the creator or an admin edits them, and a per-field `editRole` can open ONE column's
+# definition to everyone without handing over the table. This supersedes wave 17's "fields are
+# per-user" law for this path only; the connector scopes keep their own model.
+#
+# ⚠ WHY IT MATTERS BEYOND TIDINESS: a grid add-field on a `ut_` scope used to land in the
+# per-user workspace overlay, which is why the automation editor's "Automation column" picker
+# could not see a column the user had just created — it reads the DEFINITION. Same defect shape
+# as the rename (item 6a): two places to look, and the surfaces disagreed silently.
+
+def _field_or_refuse(session, table_key, fkey=""):
+    """The schema wall. `_defn_or_refuse` first (404/403 on the table), then the per-field rule."""
+    defn = _defn_or_refuse(session, table_key)
+    ut = _ut()
+    if not ut.is_user_table(table_key, st=session.runtime):
+        raise err(400, "not_a_user_table",
+                  "only a user-created database has an editable schema — a connected source "
+                  "owns its own columns")
+    if fkey and not ut.may_edit_field(table_key, fkey, session.uname, session.admin,
+                                      st=session.runtime):
+        raise err(403, "forbidden", "that column can only be changed by the database's creator "
+                                    "or an admin")
+    if not fkey and not (session.admin or defn.get("createdBy") == session.uname):
+        raise err(403, "forbidden", "only the database's creator or an admin can add a column")
+    return defn
+
+
+@router.post("/tables/{table_key}/fields", status_code=201)
+def add_field(table_key: str, body: dict = Body(default=None),
+              session: Session = Depends(require_session)):
+    _field_or_refuse(session, table_key)
+    ut = _ut()
+    field = ut.add_field(table_key, body or {}, st=session.runtime)
+    if not field:
+        raise err(400, "refused",
+                  f"the column was refused — check the name and type, or the table may be at "
+                  f"its {ut.MAX_FIELDS}-column cap (types: "
+                  f"{', '.join(sorted(ut.UT_FIELD_TYPES))})")
+    return {"field": field}
+
+
+@router.patch("/tables/{table_key}/fields/{fkey}")
+def patch_field(table_key: str, fkey: str, body: dict = Body(default=None),
+                session: Session = Depends(require_session)):
+    """Edit one column's definition, and MIGRATE its values when options are renamed.
+
+    ⛔ A CHOICE RENAME IS AN EXPLICIT MAPPING, NEVER A DIFF (contract C-RENAME). `{renames:
+    [{from, to}]}` arrives alongside the new options list, because a diff cannot tell "renamed
+    Blue to Navy" from "deleted Blue, added Navy" — and guessing wrong empties the column and
+    every saved view that filtered on it.
+    """
+    _field_or_refuse(session, table_key, fkey)
+    ut = _ut()
+    body = body or {}
+    migrated = None
+    renames = body.get("renames")
+    if renames:
+        try:
+            migrated = ut.rename_choice_values(table_key, fkey, renames, st=session.runtime)
+        except Exception:
+            raise err(503, "store_unavailable", "the rename did not land — try again")
+        # The per-user workspace strata and any view filter naming the old value are the OTHER
+        # half of C-RENAME and belong to `core.table_store`. Called only if it is there: an
+        # enumerator's mirror waits for its counterpart rather than guessing at its shape, and a
+        # missing counterpart must not lose the half that DID land.
+        try:
+            import core.table_store as table_store
+            fn = getattr(table_store, "rename_choice_values", None)
+            if callable(fn):
+                fn(table_key, fkey, renames, st=session.runtime)
+                migrated = dict(migrated or {}, workspace=True)
+        except Exception:                                         # noqa: BLE001
+            migrated = dict(migrated or {}, workspace=False)
+    field = ut.patch_field(table_key, fkey, body, st=session.runtime)
+    if not field:
+        raise err(400, "refused", "that column could not be changed — check the name and type")
+    out = {"field": field}
+    if migrated is not None:
+        out["migrated"] = migrated
+    return out
+
+
+@router.delete("/tables/{table_key}/fields/{fkey}")
+def delete_field(table_key: str, fkey: str, session: Session = Depends(require_session)):
+    _field_or_refuse(session, table_key, fkey)
+    if not _ut().delete_field(table_key, fkey, st=session.runtime):
+        raise err(400, "refused",
+                  "that column could not be removed — a database must keep at least one")
+    return {"deleted": fkey}
+
+
 @router.delete("/tables/{table_key}/rows/{rid}")
 def delete_row(table_key: str, rid: str, session: Session = Depends(require_session)):
     _defn_or_refuse(session, table_key)

platform/core/alerts.py

@@ -0,0 +1,241 @@
+"""core/alerts.py — "tell me when a record ENTERS this view" (wave 20, owner item 25).
+
+THE OWNER'S SHAPE, verbatim: *"a user click a view and click 'Create alert'. This way when a
+Record gets into that Filter's criteria, a user gets notified in that module … Read/Unread like an
+inbox type of thing so they can confirm whether they have seen the Record that got filtered in."*
+
+So an alert is **a view plus a remembered MATCHED SET**, and a notification is a **new entrant** —
+a pid that matches now and did not last time. That definition is the whole design, and it is what
+makes the module trustworthy rather than noisy:
+
+  * a record already in the view when the alert is created is NOT news. The first evaluation
+    SEEDS the set silently (`seed=True`); without that, creating an alert on a 400-row view
+    would announce 400 "new" records, and the user would turn the feature off in one click;
+  * a record that leaves and comes back IS news again — it re-entered the criteria, which is the
+    event the owner described;
+  * a record that merely CHANGES while staying in the view is not an entrant. "Still matching" is
+    not an event. (An on-change alert is a different feature with a different noise budget; it is
+    NOT smuggled in here under the same name.)
+
+⚠ **WHY THE MATCHED SET IS STORED AND NOT RECOMPUTED FROM HISTORY.** There is no row-level audit
+log to diff against — `store` holds current state, and Odoo is read-only. The remembered set IS
+the history, so it is written on every evaluation, in the same transaction that queues the
+notifications. Losing that write while keeping the notifications would re-announce the same
+records forever.
+
+⚠ **WHAT AN UNANSWERABLE LEAF ACTUALLY DOES HERE — CHECKED, NOT ASSUMED.** `harness.filter_eval`'s
+`EvalCtx` is explicit that each of its four members "absent, the condition matches NOTHING rather
+than everything" — the engine NARROWS on an unresolved measure/cohort/rank set rather than
+widening. So the failure mode is not a false alert; it is a **missed** one, and a missed entrant
+is re-detected on the next evaluation because `matched` only ever records what genuinely matched.
+
+That is the safe direction, and it is why `partial` is a caller-supplied flag rather than
+something inferred in here: the caller (`routes_alerts`) is the only layer that knows whether it
+could BUILD a complete context. When it says so, `evaluate()` records the attempt and changes
+nothing — updating `matched` from a narrowed evaluation would drop rows out of the remembered set
+and then re-announce every one of them as an "entrant" on the next complete pass. That is the
+real hazard: not a phantom alert, but a storm of stale ones.
+
+⚠ **EVERY STAMP CARRIES A UTC OFFSET** (DEBT D-18). A browser can only render a timestamp
+relatively if it can subtract it from `now`, and a naive container-local stamp is unsubtractable —
+it renders VERBATIM or, worse, silently as the reader's own zone. `_now_iso()` is the one place
+that is decided.
+"""
+import datetime as _dt
+
+import core.store as store
+
+#: Alert DEFINITIONS, per tenant: {alert_id: {...}}. Separate from the notifications bucket so a
+#: busy inbox never rewrites the definitions (and a definition edit never rewrites the inbox).
+ALERTS_KEY = 'alerts'
+#: The inbox: {username: [notification, ...]}, newest last.
+NOTIFICATIONS_KEY = 'alert_notifications'
+
+#: Per user. An inbox is a WORKING queue, not an archive — the store is a JSON blob read whole on
+#: every request, so an unbounded inbox is a payload that grows without limit for a user who
+#: never clicks. Oldest READ entries are dropped first; unread ones survive the cap because the
+#: whole point is that the user has not seen them yet.
+MAX_NOTIFICATIONS = 200
+
+
+def _now_iso():
+    """UTC, WITH the offset — `2026-08-05T09:41:07.123456+00:00`. See the module note (D-18)."""
+    return _dt.datetime.now(_dt.timezone.utc).isoformat()
+
+
+def _st(st):
+    return st if st is not None else store
+
+
+def list_alerts(user=None, st=None, is_admin=False):
+    """Alert definitions this user may see: their own. Admins see all (they support them)."""
+    try:
+        recs = _st(st).get(ALERTS_KEY) or {}
+    except Exception:
+        return []
+    out = []
+    for aid, rec in recs.items():
+        if not isinstance(rec, dict):
+            continue
+        if user and not is_admin and str(rec.get('owner') or '') != str(user):
+            continue
+        out.append({**rec, 'id': str(aid)})
+    return sorted(out, key=lambda r: str(r.get('createdAt') or ''))
+
+
+def create(alert_id, *, view_id, topic, owner, label='', st=None):
+    """Register an alert on a view. Returns the record.
+
+    The view is stored BY ID, never by a copy of its filter tree. An alert whose criteria were
+    snapshotted at creation would silently stop matching the view the moment its owner edited it —
+    and the user's mental model is "alert me on THIS VIEW", not "on this view as it was in
+    August".
+    """
+    rec = {'id': str(alert_id), 'viewId': str(view_id), 'topic': str(topic),
+           'owner': str(owner), 'label': str(label or '')[:160],
+           'createdAt': _now_iso(), 'matched': [], 'seeded': False,
+           'lastRunAt': None, 'lastError': None}
+
+    def _apply(data):
+        data[str(alert_id)] = rec
+        return data
+
+    _st(st).update(ALERTS_KEY, _apply, flush='sync')
+    return rec
+
+
+def delete(alert_id, st=None):
+    def _apply(data):
+        data.pop(str(alert_id), None)
+        return data
+
+    _st(st).update(ALERTS_KEY, _apply, flush='sync')
+    return True
+
+
+def evaluate(alert_id, matching_pids, *, labels=None, partial=False, st=None):
+    """Fold a fresh evaluation of one alert's view into its state; queue any NEW entrants.
+
+    `matching_pids` is what the view matches NOW — the caller owns running the filter, because
+    only it knows the topic's rows and the reader's scope. `partial` says the evaluation could not
+    answer every leaf; see the module note on why that suppresses everything.
+
+    Returns `{'new': [...], 'seeded': bool}` or `{'skipped': 'partial'|'missing'}`.
+    """
+    now_set = {str(p) for p in (matching_pids or ())}
+    outcome = {}
+
+    def _apply(data):
+        rec = data.get(str(alert_id))
+        if not isinstance(rec, dict):
+            outcome['skipped'] = 'missing'
+            return data
+        if partial:
+            # Record the ATTEMPT (so "last checked" is honest) but change nothing else. Writing
+            # `matched` here would bake a widened set in as truth, and the next COMPLETE
+            # evaluation would then report every genuinely-absent row as an entrant.
+            rec['lastRunAt'] = _now_iso()
+            rec['lastError'] = ('the view could not be fully evaluated (a filter leaf was '
+                                'unanswerable); no alert was raised')
+            outcome['skipped'] = 'partial'
+            data[str(alert_id)] = rec
+            return data
+        prior = {str(p) for p in (rec.get('matched') or ())}
+        seeding = not rec.get('seeded')
+        entrants = [] if seeding else sorted(now_set - prior, key=lambda s: (len(s), s))
+        rec['matched'] = sorted(now_set, key=lambda s: (len(s), s))
+        rec['seeded'] = True
+        rec['lastRunAt'] = _now_iso()
+        rec['lastError'] = None
+        data[str(alert_id)] = rec
+        outcome['new'] = entrants
+        outcome['seeded'] = seeding
+        outcome['_rec'] = rec
+        return data
+
+    _st(st).update(ALERTS_KEY, _apply, flush='sync')
+    if outcome.get('skipped'):
+        return {'skipped': outcome['skipped']}
+    rec = outcome.pop('_rec', {}) or {}
+    if outcome.get('new'):
+        _queue(rec, outcome['new'], labels or {}, st=st)
+    return outcome
+
+
+def _queue(rec, pids, labels, st=None):
+    """Append one notification per entrant to the alert owner's inbox."""
+    at = _now_iso()
+    items = [{'id': f"{rec.get('id')}:{pid}:{at}",
+              'alertId': str(rec.get('id')), 'viewId': str(rec.get('viewId')),
+              'topic': str(rec.get('topic')), 'rowId': str(pid),
+              'label': str(labels.get(str(pid)) or labels.get(pid) or pid),
+              'alertLabel': str(rec.get('label') or ''),
+              'at': at, 'read': False}
+             for pid in pids]
+    owner = str(rec.get('owner') or '')
+
+    def _apply(data):
+        inbox = list(data.get(owner) or [])
+        inbox.extend(items)
+        if len(inbox) > MAX_NOTIFICATIONS:
+            # Drop READ entries oldest-first; keep every unread one. A cap that dropped unread
+            # notifications would silently lose exactly the records the user has not confirmed —
+            # the one thing this module promises not to do.
+            unread = [n for n in inbox if not n.get('read')]
+            read = [n for n in inbox if n.get('read')]
+            keep_read = read[max(0, len(unread) + len(read) - MAX_NOTIFICATIONS):]
+            inbox = sorted(unread + keep_read, key=lambda n: str(n.get('at') or ''))
+        data[owner] = inbox
+        return data
+
+    _st(st).update(NOTIFICATIONS_KEY, _apply, flush='async')
+
+
+def inbox(user, st=None, limit=100):
+    """`{'unread': int, 'items': [...]}` — newest first, for the badge and the pane."""
+    try:
+        items = list((_st(st).get(NOTIFICATIONS_KEY) or {}).get(str(user)) or [])
+    except Exception:
+        return {'unread': 0, 'items': []}
+    items = [n for n in items if isinstance(n, dict)]
+    items.sort(key=lambda n: str(n.get('at') or ''), reverse=True)
+    return {'unread': sum(1 for n in items if not n.get('read')), 'items': items[:max(0, limit)]}
+
+
+def mark_read(user, ids, read=True, st=None):
+    """Mark specific notifications read/unread. `ids=None` marks every one (mark-all-read)."""
+    want = None if ids is None else {str(i) for i in ids}
+
+    def _apply(data):
+        inbox_ = [dict(n) for n in (data.get(str(user)) or []) if isinstance(n, dict)]
+        for n in inbox_:
+            if want is None or str(n.get('id')) in want:
+                n['read'] = bool(read)
+        data[str(user)] = inbox_
+        return data
+
+    _st(st).update(NOTIFICATIONS_KEY, _apply, flush='async')
+    return inbox(user, st=st)
+
+
+def after_write(topic_key, st=None, runner=None):
+    """The write-path HOOK: re-evaluate every alert whose view belongs to `topic_key`.
+
+    ⚠ CALLED FROM A WRITE PATH, SO IT MUST NOT RAISE AND MUST NOT BLOCK ON A FULL POOL BUILD.
+    A failed alert evaluation must never fail the edit that triggered it — the user typed into a
+    cell; whether an alert fires is not their problem. `runner` is injected by the caller
+    (`routes_alerts` passes one that can resolve the topic's rows for the alert's owner), so this
+    module never reaches for a pool itself and stays unit-testable with a fake.
+    """
+    if runner is None:
+        return {'evaluated': 0}
+    n = 0
+    for rec in list_alerts(st=st):
+        if str(rec.get('topic')) != str(topic_key):
+            continue
+        try:
+            runner(rec)
+            n += 1
+        except Exception:                      # noqa: BLE001 — see the docstring
+            continue
+    return {'evaluated': n}

platform/core/grid_events.py

@@ -1063,7 +1063,7 @@ def handle_one(event, ctx):
         return True
 
     if kind in ('folder_create', 'folder_rename', 'folder_delete', 'folder_duplicate',
-                'item_move'):
+                'item_move', 'folder_reorder'):
         # FOLDERS over the Views / Cohorts sidebars (owner item 11, contract C4). All five
         # events touch ONE home — the table workspace's `folders` + `itemFolders` — so a cohort
         # can be filed without the cohort STORE learning about folders at all.
@@ -1123,6 +1123,37 @@ def handle_one(event, ctx):
                 # an item with no placement renders at the top level.
                 placed[surface] = {k: v for k, v in (placed.get(surface) or {}).items()
                                    if v != fid}
+            elif kind == 'folder_reorder':
+                # ⭐ WAVE 20 (owner item 19, contract C-FOLDER-REORDER) — the user's own folder
+                # ORDER in the rail. Views could already be dragged between folders; the folders
+                # themselves could not be dragged past each other.
+                #
+                # THE WIRE CARRIES THE FULL ORDER, NEVER A DELTA, and that is the contract's
+                # doing: a partial list cannot say where an UNNAMED folder went, so a "moved B
+                # after C" message would leave every other folder's position to be re-derived by
+                # two sides that can disagree. The client sends the list it is looking at.
+                #
+                # ⚠ IDS THIS USER DOES NOT OWN ARE IGNORED, NOT REJECTED. A stale tab can emit an
+                # order containing a folder that has since been deleted; dropping the whole event
+                # would make the rail un-reorderable until reload, while dropping the unknown id
+                # reorders exactly what still exists. Anything the payload omits keeps its
+                # relative position AFTER the named ones — an order that silently deleted a
+                # folder it merely failed to mention would be a data loss dressed as a sort.
+                order = [str(i).strip()[:80] for i in (event.get('order') or [])]
+                if not order:
+                    return None
+                known = {f['id']: f for f in lst}
+                seen, ranked = set(), []
+                for fid_ in order:
+                    if fid_ in known and fid_ not in seen:
+                        seen.add(fid_)
+                        ranked.append(known[fid_])
+                ranked.extend(f for f in lst if f['id'] not in seen)
+                if len(ranked) != len(lst):          # cannot happen; refuse rather than truncate
+                    return None
+                for i, f in enumerate(ranked):
+                    f['order'] = i
+                lst = ranked
             elif kind == 'folder_duplicate':
                 new_id = str(event.get('newId') or '').strip()[:80]
                 src = next((f for f in lst if f['id'] == fid), None)
@@ -1193,6 +1224,125 @@ def handle_one(event, ctx):
         # invisible to the next render (the values leave WITH the column).
         return False
 
+    if kind == 'choice_rename':
+        # ⭐ WAVE 20 (owner item 15, contract C-RENAME) — RENAMING AN OPTION CARRIES ITS VALUES.
+        #
+        # Owner: *"if I change the option from 'Aaron' to 'Aron' the existing field that has the
+        # Selected 'Aaron' doesn't change to 'Aron'."* Correct, and it is a data-model fact rather
+        # than an oversight: a select cell stores the option's LABEL, so renaming the option in
+        # the field definition orphans every cell holding the old string. They do not render as
+        # the new name; they render as a value that is no longer an option.
+        #
+        # ⛔ THE WIRE CARRIES AN EXPLICIT {from, to} MAPPING, NEVER A DIFF OF THE CHOICE LISTS.
+        # Diffing is what makes this unsafe: rename A→B while also DELETING C and adding D, and a
+        # differ sees two removals and two additions with no way to know which pairs up. It would
+        # cheerfully rewrite every C cell to D. The client knows which row of its editor the user
+        # typed in; that intent travels, and nothing here has to guess it.
+        #
+        # THREE PLACES HOLD THE OLD STRING, and missing any one is its own visible bug:
+        #   1. the CELLS (`overlays`) — the owner's complaint;
+        #   2. the FIELD's own `choices` list — else the picker still offers the old name;
+        #   3. every VIEW that FILTERS or COLOURS BY that value — a saved view filtering
+        #      `Agent is "Aaron"` silently matches NOTHING the moment the value moves, which is
+        #      the failure that looks like data loss ([[aios-shared-views]]).
+        key = str(event.get('key') or '')[:80]
+        pairs = []
+        for r in (event.get('renames') or ()):
+            if not isinstance(r, dict):
+                continue
+            a, b = str(r.get('from') or '')[:200], str(r.get('to') or '')[:200]
+            if a and b and a != b:
+                pairs.append((a, b))
+        field = field_by_key.get(key)
+        if not key or not pairs or not isinstance(field, dict):
+            return False
+        if str(field.get('type') or '') not in ('select', 'multiselect', 'status'):
+            return False
+        # Only a field this caller may edit. A rename is a write to the field CONTRACT, so it
+        # rides the same wall `field_upsert` does rather than a looser one of its own.
+        if key in (ctx.hidden_keys or frozenset()):
+            return False
+        mapping = dict(pairs)
+
+        def _rename_in(ws_):
+            fields_ = ws_.setdefault('fields', {})
+            fld = fields_.get(key)
+            if isinstance(fld, dict) and isinstance(fld.get('choices'), list):
+                seen, out = set(), []
+                for c in fld['choices']:
+                    if isinstance(c, dict):
+                        nm = mapping.get(str(c.get('name') or ''), None)
+                        if nm is not None:
+                            c = {**c, 'name': nm}
+                        ident = str(c.get('name') or '')
+                    else:
+                        c = mapping.get(str(c), str(c))
+                        ident = str(c)
+                    # A rename ONTO an existing option MERGES rather than duplicating it: the
+                    # user typed a name that already exists, and two identical options is a
+                    # picker bug. Their cells merge too, which is what the value rewrite below
+                    # does anyway.
+                    if ident in seen:
+                        continue
+                    seen.add(ident)
+                    out.append(c)
+                fld['choices'] = out
+                fields_[key] = fld
+            for row in (ws_.get('overlays') or {}).values():
+                if not isinstance(row, dict) or key not in row:
+                    continue
+                val = row[key]
+                if isinstance(val, list):        # multiselect
+                    merged, out2 = set(), []
+                    for v in val:
+                        nv = mapping.get(str(v), str(v))
+                        if nv not in merged:
+                            merged.add(nv)
+                            out2.append(nv)
+                    row[key] = out2
+                elif isinstance(val, str) and val in mapping:
+                    row[key] = mapping[val]
+            # Views: filter rule values + colour-by keys naming the old option.
+            for view in (ws_.get('views') or {}).values():
+                if not isinstance(view, dict):
+                    continue
+                cfg = view.get('config') if isinstance(view.get('config'), dict) else view
+
+                def _walk(nodes):
+                    for n in nodes or ():
+                        if not isinstance(n, dict):
+                            continue
+                        if isinstance(n.get('children'), list):
+                            _walk(n['children'])
+                            continue
+                        if str(n.get('colId') or '') != key:
+                            continue
+                        v = n.get('value')
+                        if isinstance(v, str) and v in mapping:
+                            n['value'] = mapping[v]
+                        elif isinstance(v, list):
+                            n['value'] = [mapping.get(str(x), x) for x in v]
+
+                _walk(cfg.get('filters') or [])
+                # ⚠ `colorBy` NEEDS NO REWRITE, and the reason is worth stating because the
+                # opposite looks obvious: it stores a COLUMN KEY (a string, validated against
+                # `valid_keys` at `view_upsert`), not a {value: colour} map. Per-value colours
+                # ride the CHOICE OBJECTS themselves, which this function renames in place —
+                # `{**c, 'name': nm}` keeps every other key on the choice, colour included — so
+                # a renamed option keeps its swatch for free. An earlier version of this handler
+                # tried to rewrite `colorBy['rules']` and crashed the whole event pipeline with
+                # `TypeError: unhashable type: 'dict'` on the FIRST view it touched.
+            return ws_
+
+        if store.available():
+            _tops(ctx).rename_choice_values(uname, _rename_in)
+        else:
+            _session_ready()
+            _rename_in(ws)
+        # True = the host must re-read: the client dropped its optimistic copy of the CHOICES,
+        # but the rewritten cells and view filters only exist server-side until the next payload.
+        return True
+
     if kind == 'field_duplicate':
         # Wave-5 item 1. The DESTINATION key is client-generated (the established pattern —
         # the client must know it synchronously to place the clone right of the source), and

platform/core/releases.py

@@ -0,0 +1,94 @@
+"""core/releases.py — what each deployed environment is RUNNING (wave 20, owner item 12 / R6).
+
+⛔ **THIS MODULE EXISTS BECAUSE OF `ops/verify_portability.py` B2**, and the reason is worth
+stating rather than inferring: the API process must stay HOST-AGNOSTIC. The releases panel was
+first written with `HfApi`/`hf_hub_download` inside `routes_platform_admin.py`, and the gate
+turned red on the first run — correctly. A hub client in a request handler couples the runtime to
+HuggingFace, in the one process whose design promise is that moving hosts is a config change.
+
+So the route DELEGATES here, exactly as `routes_assets` delegates to `core/assets.py` (the same
+rule, the same shape, and that module's own note says so). The SDK import is LAZY and every path
+is gated on a token being configured, so a deployment with no hub credential simply reports
+nothing rather than failing to import.
+
+⚠ **WHAT THIS READS IS EACH SPACE'S OWN CLAIM ABOUT ITSELF.** `VERSION` is written INTO the Space
+by `deploy_web.py` at deploy time, so "what is LIVE running" is a lookup, not an inference from
+timestamps — `last_modified` moves when a SECRET is pushed, which would report a deploy that never
+happened. An unreachable environment yields a NOTE, never a blank: about a production environment,
+"no version" reads as "nothing is deployed", which is the worst available way to be wrong.
+"""
+import json
+import os
+
+
+def _token():
+    """The credential that can read the Spaces. `AIOS_HF_TOKEN` is the personal (fsanyoto) token
+    that owns the staging Space; `HF_TOKEN` is the org-scoped one. Either can read."""
+    return os.environ.get('AIOS_HF_TOKEN') or os.environ.get('HF_TOKEN') or None
+
+
+#: The two environments, by Space id. ⚠ These are REPO IDENTIFIERS, not host literals — no URL is
+#: built anywhere in this module (portability C1). Mirrors `deploy_web.STAGING`/`LIVE`, which
+#: cannot be imported here: it lives outside the container's tree.
+ENVIRONMENTS = (('staging', 'fsanyoto/loopable'), ('live', 'royal-imports/cfo-os'))
+
+
+def environments():
+    """[{env, space, version, note, stage}] — one row per deployed environment.
+
+    Never raises: every failure becomes a `note` on its own row. A panel that 500s because one
+    Space was briefly unreachable tells the operator less than a row saying so.
+    """
+    tok = _token()
+    out = []
+    for name, repo in ENVIRONMENTS:
+        row = {'env': name, 'space': repo, 'version': None, 'note': None, 'stage': None}
+        if not tok:
+            row['note'] = ('no hub credential is configured on this deployment, so other '
+                           'environments cannot be read from here')
+            out.append(row)
+            continue
+        try:
+            from huggingface_hub import hf_hub_download          # noqa: PLC0415 — lazy, see header
+            p = hf_hub_download(repo, 'VERSION', repo_type='space', token=tok)
+            with open(p, encoding='utf-8') as f:
+                row['version'] = f.read().strip().splitlines()[0]
+        except Exception as e:                                   # noqa: BLE001
+            row['note'] = f'could not read this Space\'s VERSION ({type(e).__name__})'
+        try:
+            from huggingface_hub import HfApi                    # noqa: PLC0415
+            row['stage'] = str(HfApi(token=tok).space_info(repo).runtime.stage)
+        except Exception:                                        # noqa: BLE001
+            pass
+        out.append(row)
+    return out
+
+
+def history():
+    """Every `vN` ever cut: [{version, sha, date, subject}], newest first.
+
+    Read from `RELEASES.json`, which `deploy_web.py` ships INTO the Space beside `VERSION` — the
+    history has to travel with the build because the container has no git checkout to derive it
+    from. Tries the local filesystem FIRST (this deployment's own copy, no network at all) and
+    only then asks the hub, so the common case costs nothing.
+    """
+    from pathlib import Path
+
+    for p in (Path('RELEASES.json'), Path(__file__).resolve().parents[2] / 'RELEASES.json'):
+        try:
+            if p.is_file():
+                return (json.loads(p.read_text(encoding='utf-8')) or {}).get('releases') or []
+        except Exception:                                        # noqa: BLE001
+            pass
+    tok = _token()
+    if not tok:
+        return []
+    for _name, repo in ENVIRONMENTS:
+        try:
+            from huggingface_hub import hf_hub_download          # noqa: PLC0415
+            q = hf_hub_download(repo, 'RELEASES.json', repo_type='space', token=tok)
+            with open(q, encoding='utf-8') as f:
+                return (json.load(f) or {}).get('releases') or []
+        except Exception:                                        # noqa: BLE001
+            continue
+    return []

platform/core/shares.py

@@ -0,0 +1,200 @@
+"""core/shares.py — ONE grant registry for every shareable object (wave 20, owner ruling R10).
+
+WHAT R10 ASKED FOR: folders and databases share with the **same two-role vocabulary views
+already use** (specific users or everyone; role = view | edit), plus one manage-access editor
+that can add or revoke people later, on any of the three.
+
+WHY A REGISTRY RATHER THAN A FIELD ON EACH OBJECT. A view already carries its own `permissions`
+(`core/table_store.py`) and that stays — moving it would rewrite every stored view for no gain.
+But a FOLDER is a value inside one user's workspace blob and a DATABASE is a `user_tables`
+definition; giving each its own grant field would put the same three-line permission decision in
+three files owned by two sessions, which is how the three drift. One registry, one predicate,
+three callers.
+
+    shares.set_grants(kind, oid, entries, owner=…, st=…)   # replaces the whole grant set
+    shares.grants(kind, oid, st=…)                         # -> {'owner': str, 'entries': [...]}
+    shares.role_for(kind, oid, user, is_admin=…, st=…)     # -> 'owner'|'edit'|'view'|None
+    shares.shared_with(user, kind=…, st=…)                 # -> [oid] this user was granted
+
+THE ROLE VOCABULARY IS TWO WORDS AND THE DEFAULT IS THE NARROW ONE. `view` = may open and read;
+`edit` = may also change the object's CONTENT. Neither ever means "may re-share": changing grants
+is the OWNER's (or an admin's), which is `table_store._may_administer`'s existing rule promoted to
+every kind. A collaborator who could rewrite grants could grant themselves sole ownership of
+somebody else's object, or quietly widen a users-scoped share to everyone.
+
+⛔ AN UNREADABLE GRANT IS NO GRANT. Every path here fails closed — junk in the bucket, a missing
+owner, an unknown role string all resolve to None rather than to a default that opens something.
+[[aios-permissioning]]: no fail-open defaults, ever.
+
+⚠ THE BUCKET IS TENANT-SCOPED THROUGH `st`, like every other product-data write. Passing the
+session's `TenantRuntime` is what keeps Nurilab's grants in Nurilab's store; the module default
+(`core.store`) is tenant #0 and exists for the same reason it does everywhere else — the ~28
+callers that predate multi-tenancy. (This is the D-5/D-16 residency shape, and this module does
+NOT repeat their mistake: `st` is threaded from the first line rather than retrofitted.)
+"""
+import core.store as store
+
+#: The store key. One bucket per tenant holds every kind's grants, because "what am I shared on"
+#: is a question across kinds — the "Shared with me" folder (R10) is exactly that query, and
+#: three separate buckets would make it three reads that can disagree about what a user can see.
+SHARES_KEY = 'object_shares'
+
+#: The shareable kinds. A CLOSED vocabulary: an unknown kind raises rather than creating a new
+#: namespace by typo, which would silently grant nothing to nobody and read as "sharing is broken".
+KINDS = ('view', 'folder', 'database')
+
+#: `*` is "everyone who can already open the surface". It is NOT "every account on the platform" —
+#: the module/table wall runs FIRST and this never widens past it. Spelled as a single character
+#: so it can never collide with a username (usernames are lower-case and non-empty by
+#: `core/users.py`, and are checked against this explicitly below).
+EVERYONE = '*'
+
+ROLES = ('view', 'edit')
+
+
+def _st(st):
+    return st if st is not None else store
+
+
+def _check_kind(kind):
+    k = str(kind or '').strip().lower()
+    if k not in KINDS:
+        raise ValueError(f'{kind!r} is not a shareable kind. Use one of {", ".join(KINDS)} — '
+                         f'refusing to invent a namespace from a typo.')
+    return k
+
+
+def _clean_entries(entries):
+    """Normalise + REJECT junk, returning [{'user': str, 'role': 'view'|'edit'}].
+
+    Silently dropping a malformed entry is right here and wrong elsewhere: the caller is a UI
+    that just listed the people it is about to grant, so a rejected row must not abort the whole
+    save — but an entry with an unknown ROLE must not be stored as something else's default
+    either. Dropped, never coerced.
+    """
+    out, seen = [], set()
+    for e in entries or ():
+        if not isinstance(e, dict):
+            continue
+        user = str(e.get('user') or '').strip().lower()
+        role = str(e.get('role') or '').strip().lower()
+        if not user or role not in ROLES or user in seen:
+            continue
+        seen.add(user)
+        out.append({'user': user, 'role': role})
+    return out
+
+
+def grants(kind, oid, st=None):
+    """`{'owner': str|None, 'entries': [{'user','role'}]}` — never raises on a junk bucket."""
+    kind = _check_kind(kind)
+    try:
+        bucket = (_st(st).get(SHARES_KEY) or {}).get(kind) or {}
+        rec = bucket.get(str(oid)) or {}
+    except Exception:
+        return {'owner': None, 'entries': []}
+    if not isinstance(rec, dict):
+        return {'owner': None, 'entries': []}
+    return {'owner': (str(rec.get('owner')).strip().lower() if rec.get('owner') else None),
+            'entries': _clean_entries(rec.get('entries'))}
+
+
+def set_grants(kind, oid, entries, owner=None, st=None):
+    """REPLACE the grant set for one object. Returns the stored record.
+
+    ⚠ REPLACE, NOT MERGE, and that is the contract the UI needs: revoking is expressed by an
+    entry's ABSENCE. A merge-only API cannot remove anybody without a second verb, and the
+    manage-access editor R10 asks for is exactly "here is the list now".
+    """
+    kind = _check_kind(kind)
+    oid = str(oid)
+    clean = _clean_entries(entries)
+    owner_l = str(owner).strip().lower() if owner else None
+
+    def _apply(data):
+        by_kind = dict(data.get(kind) or {})
+        prior = by_kind.get(oid) if isinstance(by_kind.get(oid), dict) else {}
+        # The owner is STICKY: set once, and a later save that omits it must not orphan the
+        # object. An ownerless grant record cannot answer "who may re-share this", so every
+        # administer check would fail closed and the object would become unmanageable.
+        keep_owner = owner_l or (str(prior.get('owner')).strip().lower()
+                                 if prior.get('owner') else None)
+        if not clean and not keep_owner:
+            by_kind.pop(oid, None)          # fully un-shared and unowned: leave no empty husk
+        else:
+            by_kind[oid] = {'owner': keep_owner, 'entries': clean}
+        data[kind] = by_kind
+        return data
+
+    _st(st).update(SHARES_KEY, _apply, flush='async')
+    return grants(kind, oid, st=st)
+
+
+def role_for(kind, oid, user, is_admin=False, st=None):
+    """`'owner'` | `'edit'` | `'view'` | `None` — the caller's effective role, fail-closed.
+
+    An ADMIN reads as `'owner'`: an admin who could not administer an object could not
+    administer the tenant either, which is `table_store._may_administer`'s existing rule and is
+    kept identical here so the two cannot disagree about the same view.
+    """
+    user = str(user or '').strip().lower()
+    if not user:
+        return None
+    rec = grants(kind, oid, st=st)
+    if is_admin or (rec['owner'] and rec['owner'] == user):
+        return 'owner'
+    best = None
+    for e in rec['entries']:
+        if e['user'] == user or e['user'] == EVERYONE:
+            # The STRONGER of the two wins when both a personal and an everyone grant exist:
+            # naming somebody explicitly is how you RAISE them above the room, so an
+            # everyone-view + alice-edit pair must leave alice editing.
+            if e['role'] == 'edit':
+                return 'edit'
+            best = best or 'view'
+    return best
+
+
+def may_see(kind, oid, user, is_admin=False, st=None):
+    return role_for(kind, oid, user, is_admin=is_admin, st=st) is not None
+
+
+def may_edit(kind, oid, user, is_admin=False, st=None):
+    return role_for(kind, oid, user, is_admin=is_admin, st=st) in ('owner', 'edit')
+
+
+def may_administer(kind, oid, user, is_admin=False, st=None):
+    """Only the owner or an admin may change grants or delete. See the module note on why this
+    is deliberately narrower than `may_edit`."""
+    return role_for(kind, oid, user, is_admin=is_admin, st=st) == 'owner'
+
+
+def shared_with(user, kind=None, st=None):
+    """Every object id this user has been granted (excluding what they own).
+
+    This is the "Shared with me" query (R10). It EXCLUDES owned objects deliberately: a folder
+    you made is not something shared *with* you, and listing it there would make the system
+    folder a duplicate of the rail above it.
+    """
+    user = str(user or '').strip().lower()
+    if not user:
+        return {}
+    try:
+        data = _st(st).get(SHARES_KEY) or {}
+    except Exception:
+        return {}
+    out = {}
+    for k in ([_check_kind(kind)] if kind else KINDS):
+        hits = []
+        for oid, rec in (data.get(k) or {}).items():
+            if not isinstance(rec, dict):
+                continue
+            owner = str(rec.get('owner') or '').strip().lower()
+            if owner == user:
+                continue
+            for e in _clean_entries(rec.get('entries')):
+                if e['user'] in (user, EVERYONE):
+                    hits.append(str(oid))
+                    break
+        out[k] = sorted(hits)
+    return out if kind is None else {_check_kind(kind): out[_check_kind(kind)]}

platform/core/store.py

@@ -304,8 +304,15 @@ _INSTANCES_LOCK = threading.RLock()
 
 
 def for_repo(repo_id):
-    """The Store bound to `repo_id` — one instance per repo per process (each with its own
-    cache and flush state). The default instance IS `for_repo(REPO)`."""
+    """The HF Store bound to `repo_id` — one instance per repo per process (each with its own
+    cache and flush state).
+
+    ⚠ WAVE 20: this is now the HF-SPECIFIC factory. Callers that want "the right store for this
+    tenant, whatever the backend is" call `handle()` below. `for_repo` keeps its exact old
+    behaviour because the seed/migration tooling has to be able to name the FILE store
+    explicitly while the app runs on Postgres — a migration that could only reach the active
+    backend could not copy between them.
+    """
     rid = str(repo_id or '').strip() or REPO
     with _INSTANCES_LOCK:
         inst = _INSTANCES.get(rid)
@@ -315,47 +322,119 @@ def for_repo(repo_id):
         return inst
 
 
+# =============================================================================================
+# WAVE 20 (owner ruling R1, closes DEBT D-4) — THE BACKEND SEAM.
+#
+# `core/store_backend.py` has carried this warning since EXIT-2b, and it was correct at the time:
+#
+#     "Flipping STORE_BACKEND=pg does NOT redirect the ~40 existing callers that say
+#      `import core.store as store` — they are bound to the HF module directly. Rewiring them is
+#      task C-4 … THE DEFAULT IS `hf` AND STAYS `hf` until C-4 says otherwise."
+#
+# **R1 IS C-4.** The owner ruled the cutover on 2026-08-05 (the D-4 trigger that fired: a SECOND
+# server process — `royal-imports/cfo-os` came back as a pinned LIVE environment beside staging,
+# and two containers on one last-write-wins file store is the race B-3 was always about).
+#
+# THE REWIRE IS HERE RATHER THAN IN 28 FILES, and that is a deliberate choice over the obvious
+# alternative of `sed`-ing every `import core.store as store` to `import core.store_backend`:
+#   * every one of those callers means "the store for the tenant I am serving", which is exactly
+#     what this module has always meant. The BACKEND is not their concern and making it their
+#     concern is how one of them gets missed;
+#   * a missed caller under a search-and-replace does not fail — it silently keeps writing to the
+#     file store while everything else writes to Postgres. That is the split-brain this whole
+#     ruling exists to end, reintroduced by the fix for it;
+#   * `store_backend.py`'s stated reason for refusing to do it this way — "no dual-read window and
+#     no way to compare the two stores' contents first" — is satisfied: `ops/seed_pg_from_hf.py`
+#     copies, then `--verify` diffs the two stores key-by-key before anything flips.
+#
+# ⛔ THE IMPORT IS LAZY AND MUST STAY LAZY. `core/store_pg.py` imports psycopg only inside
+# `_pool()`, so an `hf` deployment installs no driver; importing it at module scope here would
+# undo that and make the default backend depend on the optional dependency.
+# =============================================================================================
+
+def backend():
+    """`'hf'` | `'pg'` — validated, resolved per call so a test can flip the env var.
+
+    Mirrors `core.store_backend.name()` deliberately rather than importing it: that module
+    imports THIS one, so reaching back would be a cycle. `verify_store_pg` asserts the two agree
+    on every value, which is the guard against them drifting apart.
+    """
+    raw = (os.environ.get('STORE_BACKEND') or 'hf').strip().lower()
+    if raw not in ('hf', 'pg'):
+        raise RuntimeError(
+            f"STORE_BACKEND={raw!r} is not a backend. Use 'hf' (the HF Dataset store) or 'pg' "
+            f"(Postgres, needs DATABASE_URL). Refusing to guess: a typo that silently served the "
+            f"other store is how data ends up in two places.")
+    return raw
+
+
+def handle(repo_id=None, slug=None):
+    """THE tenant-bound store handle for the ACTIVE backend — the one seam every caller crosses.
+
+    `repo_id` addresses the HF backend (a dataset repo); `slug` addresses Postgres (a schema).
+    Both are passed by `harness.runtime.get_runtime`, which knows both facts, so flipping the
+    backend never needs a lookup table between them — and neither identifier has to be invented
+    for the backend that does not use it.
+    """
+    if backend() == 'pg':
+        import core.store_pg as _pg          # noqa: PLC0415 — lazy: see the banner above
+        return _pg.PgStore(slug or os.environ.get('AIOS_TENANT') or 'royal-imports')
+    return for_repo(repo_id)
+
+
+#: The HF default instance. Kept as a module global (not a property) because the seed/migration
+#: tooling and `_flush_all_at_exit` both need the FILE store by name even when pg is active.
 _DEFAULT = for_repo(REPO)
 
 
+def _d():
+    """The default tenant's store on the active backend — what every module function below uses.
+
+    ⚠ Resolved PER CALL, never cached. A cached default would freeze the backend at import time,
+    and import order is exactly what nobody controls: `api/main.py` imports half the platform
+    before it has read a single environment variable it did not inherit.
+    """
+    return handle() if backend() == 'pg' else _DEFAULT
+
+
 def available():
-    return _DEFAULT.available()
+    return _d().available()
 
 
 def get(name, fresh=False):
-    return _DEFAULT.get(name, fresh=fresh)
+    return _d().get(name, fresh=fresh)
 
 
 def _read_strict(name):
-    return _DEFAULT._read_strict(name)
+    return _d()._read_strict(name)
 
 
 def exists(name):
-    return _DEFAULT.exists(name)
+    return _d().exists(name)
 
 
 def upload_bytes(path_in_repo, data, message=None):
-    return _DEFAULT.upload_bytes(path_in_repo, data, message=message)
+    return _d().upload_bytes(path_in_repo, data, message=message)
 
 
 def download_bytes(path_in_repo):
-    return _DEFAULT.download_bytes(path_in_repo)
+    return _d().download_bytes(path_in_repo)
 
 
 def delete_path(path_in_repo):
-    return _DEFAULT.delete_path(path_in_repo)
+    return _d().delete_path(path_in_repo)
 
 
 def put(name, data):
-    return _DEFAULT.put(name, data)
+    return _d().put(name, data)
 
 
 def flush(name=None, timeout=30.0):
-    return _DEFAULT.flush(name=name, timeout=timeout)
+    return _d().flush(name=name, timeout=timeout)
 
 
 def update(name, fn, flush='sync'):
-    return _DEFAULT.update(name, fn, flush=flush)
+    return _d().update(name, fn, flush=flush)
 
 
 def _flush_all_at_exit():

platform/core/store_backend.py

@@ -3,21 +3,30 @@
     import core.store_backend as store        # new code
     store.get('users')                        # goes to whichever backend is selected
 
-⛔ WHAT THIS DOES **NOT** DO, stated first because assuming otherwise would be a silent data
-split. Flipping `STORE_BACKEND=pg` does NOT redirect the ~40 existing callers that say
-`import core.store as store` — they are bound to the HF module directly. Rewiring them is task
-**C-4** (the HF→Postgres cutover with its dual-read window), and C-4 cannot start until the
-database exists (owner blocker **B-3**). Until then this selector is the SEAM, exercised by new
-code and by the gate, and the default is `hf`, which is exactly today's behaviour.
-
-Doing it any other way would be worse. The tempting shortcut — have `core/store.py` itself
-delegate — would mean every existing caller silently changes backend the moment an env var is set
-in some shell, with no dual-read window and no way to compare the two stores' contents first.
-"One store" is the goal; getting there through a flag nobody audited would produce two.
-
-THE DEFAULT IS `hf` AND STAYS `hf` until C-4 says otherwise. An unrecognised value is a
-configuration error and RAISES rather than falling back — a typo'd backend name that quietly
-served the old store would be discovered by data going missing.
+⭐ **C-4 HAPPENED — WAVE 20, 2026-08-05 (owner ruling R1, DEBT D-4).** This header used to say,
+in bold, that flipping `STORE_BACKEND=pg` did NOT redirect the ~28 callers that say
+`import core.store as store`, and that "the tempting shortcut — have `core/store.py` itself
+delegate" would be worse because there was "no dual-read window and no way to compare the two
+stores' contents first".
+
+Both halves of that objection were ANSWERED rather than ignored, which is the only reason the
+shortcut became the design:
+  * the comparison exists — `ops/seed_pg_from_hf.py --verify` diffs the two stores key-by-key
+    (and value-by-value) and is run BEFORE any environment flips;
+  * the "silently changes backend the moment an env var is set in some shell" risk is why the
+    flip is fail-closed and loud: no `DATABASE_URL` under `pg` RAISES, it never falls back to the
+    file store. A misconfigured process refuses to serve instead of quietly writing to the wrong
+    place — which is the failure mode the original warning actually cared about.
+
+So **`core/store.py::handle()` is now the seam**, and it is the one every caller crosses:
+module-level functions resolve it per call via `_d()`, and `harness.runtime.get_runtime` binds a
+per-TENANT handle (a dataset repo on `hf`, a `t_<slug>` schema on `pg`). THIS module remains the
+by-name selector for code that wants a specific backend's module rather than the active handle —
+the migration tooling, and `verify_store_pg`, which asserts `store.backend()` and `name()` agree
+on every value so the two entry points cannot drift.
+
+An unrecognised value is a configuration error and RAISES rather than falling back — a typo'd
+backend name that quietly served the old store would be discovered by data going missing.
 """
 import os
 

platform/core/store_pg.py

@@ -249,3 +249,77 @@ def close():
                 _POOL['pool'] = None
                 _POOL['url'] = None
                 _POOL.pop('ok', None)
+
+
+# ---------------------------------------------------------------------------------------------
+# WAVE 20 (R1 / D-4) — THE TENANT-BOUND HANDLE. This is what made the cutover a small change.
+#
+# `core/store.py` grew a CLASS in wave 18 because a tenant can own its own dataset REPO, and
+# `harness.runtime.TenantRuntime` carries one bound instance per tenant. Postgres isolates by
+# SCHEMA instead (`t_<slug>`, see harness/pg/schema.sql's own argument for schema-over-RLS), so
+# the two models meet here: one object, bound to one slug, exposing `core.store.Store`'s methods.
+#
+# ⚠ THE BINDING IS THE POINT. The module functions above default their schema from `AIOS_TENANT`,
+# which is a PROCESS-wide answer to a PER-REQUEST question — correct for a single-tenant worker,
+# wrong for the shared API that serves four tenants from one process. A handle carries its slug
+# explicitly, so a write cannot land in another tenant's schema because some env var was right
+# for the last request. That is the same property `TenantRuntime.store_handle` already gives the
+# HF backend (EXIT-4b proof #3), reached a different way.
+# ---------------------------------------------------------------------------------------------
+class PgStore:
+    """`core.store.Store`'s interface for ONE tenant's schema.
+
+    Deliberately a thin binder over the module functions rather than a reimplementation: every
+    behaviour argument (FOR UPDATE in `update`, absent-is-success in `delete_path`, `fresh`
+    ignored because a SELECT has no cache to bypass) is stated once, up there, and cannot drift
+    between the two entry points.
+    """
+
+    def __init__(self, tenant_slug):
+        self.tenant_slug = str(tenant_slug or '').strip().lower() or 'royal-imports'
+        #: Kept so `Store`-shaped debugging (`repr`, telemetry, the admin panes) reads the same
+        #: on both backends. There is no repo here; the schema is the address.
+        self.repo = f'pg:{_schema_for(self.tenant_slug)}'
+
+    def __repr__(self):
+        return f'<PgStore {self.repo}>'
+
+    def available(self):
+        return available()
+
+    def get(self, name, fresh=False):
+        return get(name, fresh=fresh, tenant_slug=self.tenant_slug)
+
+    def _read_strict(self, name):
+        """Interface parity with the HF Store. There, `get` is lenient (swallows a transient
+        failure) and `_read_strict` opts out so a failed read ABORTS a read-modify-write instead
+        of merging into `{}`. Here `get` ALREADY raises — the leniency it opts out of does not
+        exist — so the strict read is the ordinary one, and saying so beats a second code path."""
+        return get(name, tenant_slug=self.tenant_slug)
+
+    def exists(self, name):
+        return exists(name, tenant_slug=self.tenant_slug)
+
+    def put(self, name, data):
+        return put(name, data, tenant_slug=self.tenant_slug)
+
+    def update(self, name, fn, flush='sync'):
+        return update(name, fn, flush=flush, tenant_slug=self.tenant_slug)
+
+    def upload_bytes(self, path_in_repo, data, message=None):
+        return upload_bytes(path_in_repo, data, message=message, tenant_slug=self.tenant_slug)
+
+    def download_bytes(self, path_in_repo):
+        return download_bytes(path_in_repo, tenant_slug=self.tenant_slug)
+
+    def delete_path(self, path_in_repo):
+        return delete_path(path_in_repo, tenant_slug=self.tenant_slug)
+
+    def flush(self, name=None, timeout=30.0):
+        return True
+
+    def _flush_now_at_exit(self):
+        """The atexit hook `core.store` registers for its instances. Nothing is buffered here —
+        every write above committed before it returned — so this is honestly a no-op rather than
+        an unimplemented method that would raise during interpreter shutdown."""
+        return True

platform/core/table_store.py

@@ -199,6 +199,21 @@ class TableStore:
         # coalesces in the background. Registry/auth writes elsewhere stay flush='sync'.
         return self._st.update(self.table_key, _up, flush='async')
 
+    def rename_choice_values(self, username, change):
+        """Apply an arbitrary workspace rewrite (wave 20, item 15 / C-RENAME).
+
+        ⚠ NAMED FOR ITS ONE CALLER RATHER THAN EXPOSED AS A GENERIC `mutate`, deliberately. A
+        public "do anything to the workspace" method is an invitation to put write logic in
+        callers instead of here, and every OTHER method on this class exists precisely because
+        that logic belongs in one place. Renaming a choice is the one operation that must touch
+        three strata AT ONCE — the field's `choices`, the cells in `overlays`, and the views that
+        filter or colour by the old value — inside a SINGLE transaction, because a rename that
+        updated the cells and not the filters would leave a saved view matching nothing.
+
+        `change(ws)` receives the whole workspace with every stratum pre-created (see `_update`).
+        """
+        return self._update(username, change)
+
     def save_active_view(self, username, view_id):
         """Remember which view this user last opened (owner item 3, 2026-07-31).
 

platform/core/user_tables.py

@@ -178,15 +178,26 @@ def set_fields(table_key, fields, st=None):
     return True
 
 
-def add_row(table_key, values=None, username=None, st=None):
-    """Append one row. Returns the new row id, or None if refused."""
+def add_row(table_key, values=None, username=None, st=None, rid=None):
+    """Append one row. Returns the new row id, or None if refused.
+
+    `rid` RESTORES A ROW UNDER ITS OLD ID (contract C-ADDROW / C-UNDO). Undo has to put a deleted
+    row back where it was: a restore under a fresh id would break every cohort, comment and view
+    filter that named the original, so the id is part of what is being undone. It is honoured
+    only when that id is FREE — an undo can never overwrite a row somebody has since created in
+    the gap, and it never invents a non-numeric id, because `scoped_pool` reads row ids as ints.
+    """
     if not is_user_table(table_key, st):
         return None                            # ⚠ never on a connector-backed table
     defn = get(table_key, st) or {}
     rows = defn.get('rows') or {}
     if len(rows) >= MAX_ROWS:
         return None
-    rid = str(max((int(r) for r in rows if str(r).isdigit()), default=0) + 1)
+    want = str(rid or '').strip()
+    if want and want.isdigit() and want not in rows:
+        rid = want
+    else:
+        rid = str(max((int(r) for r in rows if str(r).isdigit()), default=0) + 1)
     valid = {f['key'] for f in (defn.get('fields') or [])}
     clean = {k: str(v) for k, v in (values or {}).items() if k in valid}
 
@@ -200,45 +211,244 @@ def add_row(table_key, values=None, username=None, st=None):
     return rid
 
 
-def upsert_rows(table_key, rows_by_key, key_field, username=None, st=None):
-    """Bulk UPSERT for the automation engine (wave 18 C4-AUTO): match on `key_field`'s value,
-    update matched rows, insert the rest. Returns `{'updated': n, 'inserted': n, 'orphans': n}`
-    where orphans = existing rows whose key value did not appear this run — COUNTED, never
-    deleted (the contract's no-silent-delete rule). Refuses on a non-user table."""
+# ⛔ `upsert_rows` USED TO LIVE HERE, AND DELETING IT IS THE FIX (DEBT D-6, wave 20).
+#
+# There were TWO bulk-upsert implementations — this one and `automation_engine.upsert_rows` —
+# with different counts (`{updated, inserted, orphans}` vs the engine's seven, including the
+# `capped` count that makes a full table LOUD), a different signature (a dict keyed by value vs
+# a list of rows) and a different cap story. D-6 called it a "silent drift risk"; the honest
+# measurement is worse and simpler: **this one had zero callers, anywhere in the repo.** It was
+# not drifting from the engine, it was a second answer nobody had ever asked.
+#
+# So there is now one implementation because there is one implementation — no parity gate to
+# maintain, no second definition to keep in step. If a host-side bulk upsert is ever wanted, the
+# engine's is the one that has been exercised (verify_automation section B) and it is PURE:
+# `(existing, incoming, key_field, cap) -> (rows, counts)`, so it can be lifted here without its
+# store half coming along. Do not re-derive a new one.
+
+
+def set_label(table_key, label, st=None):
+    """Rename a table IN ITS DEFINITION. Returns the stored label, or None if refused.
+
+    ⚠ WAVE 20, item 6a — THE RENAME USED TO WRITE ONLY `nav_meta`. That bucket is the nav's
+    display layer, so the rail showed the new name while everything reading the DEFINITION —
+    the automation editor's database picker above all — went on showing the old one. A rename
+    that only some surfaces can see is worse than no rename: the picker was not stale-looking,
+    it was confidently wrong, and a user choosing "Influencers" there could be choosing the
+    table they had renamed to something else months earlier.
+    """
+    label = ' '.join(str(label or '').split())[:MAX_LABEL]
+    if not label or not is_user_table(table_key, st):
+        return None
+
+    def _set(cur):
+        t = cur.get(str(table_key))
+        if t is not None:
+            t['label'] = label
+        return cur
+
+    _st(st).update(STORE_KEY, _set, flush='sync')
+    return label
+
+
+# ---------------------------------------------------------------------------------------------
+# THE SHARED FIELD SCHEMA (contract C-FIELD, owner ruling R2)
+# ---------------------------------------------------------------------------------------------
+# R2 reverses wave 17's "fields are per-user" law FOR THIS PATH: a `ut_*` table's fields are the
+# TABLE'S SCHEMA, the way they are in Airtable — everyone with access to the database sees the
+# same columns, and the creator or an admin edits them. Per-field `editRole` narrows or widens
+# who may edit ONE column's definition without handing over the whole table.
+#
+# ⚠ `editRole` GOVERNS THE SCHEMA, NEVER THE VALUES. 'everyone' means anybody with access may
+# rename this column or change its options; it does not decide who may type in its cells. Those
+# are different questions and conflating them would let a column's own settings quietly become a
+# data-permission system nobody wrote.
+
+#: Who may edit ONE field's definition. Fail-closed default: admins (= creator or admin).
+FIELD_EDIT_ROLES = ('admins', 'everyone')
+
+
+def _clean_field(raw, previous=None):
+    """One field dict → the stored shape, or None. The single validator for create AND patch, so
+    a column cannot be typed one way on the way in and another on the way back."""
+    prev = previous or {}
+    raw = raw if isinstance(raw, dict) else {}
+    label = ' '.join(str(raw.get('label') or prev.get('label') or '').split())[:80]
+    key = re.sub(r'[^a-z0-9_]+', '_',
+                 str(raw.get('key') or prev.get('key') or _slug(label)).strip().lower())
+    key = key.strip('_')[:60]
+    ftype = str(raw.get('type') or prev.get('type') or 'text').strip().lower()
+    if not key or not label or ftype not in UT_FIELD_TYPES:
+        return None
+    out = {'key': key, 'label': label, 'type': ftype, 'source': 'overlay'}
+    opts_raw = raw.get('options') if 'options' in raw else prev.get('options')
+    if ftype in ('select', 'multiselect'):
+        opts = [' '.join(str(o).split())[:60] for o in (opts_raw or []) if str(o).strip()][:50]
+        if opts:
+            out['options'] = opts
+    role = str(raw.get('editRole') or prev.get('editRole') or 'admins').strip().lower()
+    out['editRole'] = role if role in FIELD_EDIT_ROLES else 'admins'
+    if prev.get('default') is True or raw.get('default') is True:
+        out['default'] = True
+    # An automation column carries the binding the engine reads; it is preserved across a patch
+    # rather than re-declared, because the automation editor owns it and this route does not.
+    auto = raw.get('automation') if 'automation' in raw else prev.get('automation')
+    if isinstance(auto, dict):
+        out['automation'] = auto
+    return out
+
+
+def may_edit_field(table_key, fkey, viewer, is_admin=False, st=None):
+    """May `viewer` change THIS column's definition? Creator/admin always; others only when the
+    field itself says `editRole: 'everyone'`. Fail-closed on an unknown field."""
+    if may_open(table_key, viewer, is_admin, st) and (
+            bool(is_admin) or (get(table_key, st) or {}).get('createdBy') == viewer):
+        return True
+    for f in ((get(table_key, st) or {}).get('fields') or []):
+        if f.get('key') == str(fkey):
+            return f.get('editRole') == 'everyone'
+    return False
+
+
+def add_field(table_key, raw, st=None):
+    """Append one column to the shared schema. Returns the stored field, or None if refused."""
     if not is_user_table(table_key, st):
         return None
     defn = get(table_key, st) or {}
-    valid = {f['key'] for f in (defn.get('fields') or [])}
-    if key_field not in valid:
+    have = [f for f in (defn.get('fields') or [])]
+    if len(have) >= MAX_FIELDS:
+        return None
+    field = _clean_field(raw)
+    if not field or any(f.get('key') == field['key'] for f in have):
+        return None
+
+    def _add(cur):
+        t = cur.get(str(table_key))
+        if t is not None:
+            t.setdefault('fields', []).append(field)
+        return cur
+
+    _st(st).update(STORE_KEY, _add, flush='sync')
+    return field
+
+
+def patch_field(table_key, fkey, raw, st=None):
+    """Edit one column's definition IN PLACE. Returns the stored field, or None if refused.
+
+    ⚠ THE KEY NEVER MOVES. A field's key is what every stored cell is filed under, so accepting
+    a new one here would orphan every value in the column while looking like a rename. The
+    LABEL is the renameable thing; the key is identity.
+    """
+    if not is_user_table(table_key, st):
+        return None
+    fields = [dict(f) for f in ((get(table_key, st) or {}).get('fields') or [])]
+    idx = next((i for i, f in enumerate(fields) if f.get('key') == str(fkey)), -1)
+    if idx < 0:
+        return None
+    merged = dict(raw or {})
+    merged['key'] = str(fkey)
+    field = _clean_field(merged, fields[idx])
+    if not field:
         return None
-    incoming = {}
-    for kv, vals in (rows_by_key or {}).items():
-        kv = str(kv).strip()
-        if kv:
-            incoming[kv] = {k: str(v) for k, v in (vals or {}).items() if k in valid}
-    counts = {'updated': 0, 'inserted': 0, 'orphans': 0}
+
+    def _set(cur):
+        t = cur.get(str(table_key))
+        if t is not None:
+            for i, f in enumerate(t.get('fields') or []):
+                if f.get('key') == str(fkey):
+                    t['fields'][i] = field
+                    break
+        return cur
+
+    _st(st).update(STORE_KEY, _set, flush='sync')
+    return field
+
+
+def delete_field(table_key, fkey, st=None):
+    """Drop one column from the shared schema. Refuses to leave a table fieldless.
+
+    ⚠ THE CELLS ARE LEFT IN THE ROWS ON PURPOSE. A deleted column whose values were also
+    scrubbed makes an accidental delete unrecoverable; the values are invisible without a field
+    declaring them, and re-adding the column with the same key brings them back. Same reasoning
+    as `routes_tables.delete_table` leaving the workspace bucket in place. Booked, not hidden.
+    """
+    if not is_user_table(table_key, st):
+        return False
+    fields = (get(table_key, st) or {}).get('fields') or []
+    if len(fields) <= 1 or not any(f.get('key') == str(fkey) for f in fields):
+        return False
+
+    def _drop(cur):
+        t = cur.get(str(table_key))
+        if t is not None:
+            t['fields'] = [f for f in (t.get('fields') or []) if f.get('key') != str(fkey)]
+        return cur
+
+    _st(st).update(STORE_KEY, _drop, flush='sync')
+    return True
+
+
+def rename_choice_values(table_key, fkey, renames, st=None):
+    """Rename select/multiselect OPTIONS **and migrate every stored cell** (contract C-RENAME).
+
+    `renames` = `[{'from': old, 'to': new}, …]` — an EXPLICIT MAPPING, never a diff. A diff
+    cannot tell "renamed Blue to Navy" from "deleted Blue and added Navy", and guessing wrong
+    empties a column silently.
+
+    Returns `{'options': n, 'cells': n}`. This is the DEFINITION half — the base options list and
+    the base row values. A user's per-user overlay stratum and any view filter naming the old
+    value are `core.table_store`'s half of the same contract; the caller runs both.
+    """
+    pairs = []
+    for r in (renames or [])[:50]:
+        if not isinstance(r, dict):
+            continue
+        a = ' '.join(str(r.get('from') or '').split())[:60]
+        b = ' '.join(str(r.get('to') or '').split())[:60]
+        if a and b and a != b:
+            pairs.append((a, b))
+    if not pairs or not is_user_table(table_key, st):
+        return {'options': 0, 'cells': 0}
+    mapping = dict(pairs)
+    counts = {'options': 0, 'cells': 0}
 
     def _apply(cur):
         t = cur.get(str(table_key))
         if t is None:
             return cur
-        rows = t.setdefault('rows', {})
-        by_val = {}
-        for rid, row in rows.items():
-            v = str((row or {}).get(key_field) or '').strip()
-            if v and v not in by_val:
-                by_val[v] = rid
-        next_id = max((int(r) for r in rows if str(r).isdigit()), default=0)
-        for kv, vals in incoming.items():
-            rid = by_val.get(kv)
-            if rid is not None:
-                rows[rid].update(vals)
-                counts['updated'] += 1
-            elif len(rows) < MAX_ROWS:
-                next_id += 1
-                rows[str(next_id)] = vals
-                counts['inserted'] += 1
-        counts['orphans'] = sum(1 for v in by_val if v not in incoming)
+        multi = False
+        for f in (t.get('fields') or []):
+            if f.get('key') != str(fkey):
+                continue
+            multi = f.get('type') == 'multiselect'
+            opts = f.get('options') or []
+            new_opts, seen = [], set()
+            for o in opts:
+                v = mapping.get(o, o)
+                if v not in seen:          # a rename ONTO an existing option merges them
+                    seen.add(v)
+                    new_opts.append(v)
+                if o in mapping:
+                    counts['options'] += 1
+            if opts:
+                f['options'] = new_opts
+        for row in (t.get('rows') or {}).values():
+            if not isinstance(row, dict) or str(fkey) not in row:
+                continue
+            cell = str(row.get(str(fkey)) or '')
+            if not cell:
+                continue
+            if multi:
+                # ⚠ MULTISELECT CELLS ARE COMMA-JOINED LABEL STRINGS, so a rename has to walk the
+                # parts. Rewriting the whole string would only ever hit a single-value cell.
+                parts = [p.strip() for p in cell.split(',')]
+                nxt = [mapping.get(p, p) for p in parts]
+                if nxt != parts:
+                    row[str(fkey)] = ', '.join(dict.fromkeys(nxt))
+                    counts['cells'] += 1
+            elif cell in mapping:
+                row[str(fkey)] = mapping[cell]
+                counts['cells'] += 1
         return cur
 
     _st(st).update(STORE_KEY, _apply, flush='sync')
@@ -259,8 +469,15 @@ def delete_row(table_key, row_id, st=None):
     return True
 
 
+#: Names the ENGINE uses for itself when no human is on the other end of a run. ⛔ A table
+#: stamped with one of these has NO HUMAN OWNER, so `may_open` can only admit an admin — which
+#: is why the automation engine must never mint one (see `ut_ensure`'s owner rule, wave 20).
+#: Named here rather than inline so the two modules that care about it read the SAME list.
+MACHINE_OWNERS = ('automation', 'scheduler')
+
+
 def may_open(table_key, viewer, is_admin=False, st=None):
-    """FAIL-CLOSED visibility: the creator, or an admin. Nothing else.
+    """FAIL-CLOSED visibility: the creator, or an admin. Nothing else. **THE one resolver.**
 
     A user table cannot be gated by `allowed_modules` — a module grant written last month cannot
     describe a table created this morning — so it needs its own rule, and the safe rule is the
@@ -268,6 +485,14 @@ def may_open(table_key, viewer, is_admin=False, st=None):
     a BU-scoped sales agent) could open a table somebody else created just by knowing its key.
     Sharing a user table with named colleagues is a follow-on, and it should reuse the shared-
     VIEW vocabulary rather than inventing a second one.
+
+    ⛔ WAVE 20 — THERE WAS A SECOND, WIDER RULE, AND THE TWO DISAGREED. `routes_automation`'s
+    table picker admitted `createdBy in (uname, 'automation', 'scheduler')`, so a non-admin could
+    SEE an automation-created database in the picker and then be refused when they opened it,
+    edited it, or tried to delete it. Two ideas of who owns a table is the same defect class as
+    the two ideas of an agent's book (D-30): both surfaces look right in isolation and only
+    disagree in front of a user. The picker now calls THIS function, and the engine stamps a
+    real owner (see `MACHINE_OWNERS`) so nothing legitimate is narrowed by the merge.
     """
     t = get(table_key, st)
     if not t:

platform/harness/runtime.py

@@ -250,11 +250,27 @@ def get_runtime(tenant_key):
         # R2: a tenant with its OWN repo gets a bound Store instance and an EMPTY prefix (the
         # repo boundary is the namespace); everyone else keeps the t/<slug>/ prefix in the
         # shared repo. Tenant #0 keeps both defaults — empty prefix, shared repo.
+        #
+        # ⭐ WAVE 20 (R1 / D-4): under Postgres the address is a SCHEMA, so `store.handle()` is
+        # asked for one by SLUG and the namespace prefix goes to EMPTY for EVERY tenant —
+        # `t_<slug>.store_kv` already isolates, and prefixing keys inside an isolated schema
+        # would namespace them twice. That is not a cosmetic difference: a `t/nurilab/`-prefixed
+        # key written into `t_nurilab` is a key the migration did not copy and no reader looks
+        # for, i.e. a silent empty workspace.
+        #
+        # ⚠ NOTHING ELSE IN THIS FILE CHANGES, and that is the design working. Every product-data
+        # read/write already goes through `rt.get/put/update/exists` (the `st=` handle threaded
+        # through the modules), so binding the handle correctly here IS the cutover for the
+        # tenant-aware paths — the module-level `core.store` functions cover the rest via `_d()`.
         repo = (getattr(tenant, "config", {}) or {}).get("store_repo")
-        rt = TenantRuntime(
-            key=key, tenant=tenant,
-            store_namespace=("" if (key == "royal-imports" or repo) else f"t/{key}/"),
-            store_handle=(store.for_repo(repo) if repo else None))
+        if store.backend() == "pg":
+            rt = TenantRuntime(key=key, tenant=tenant, store_namespace="",
+                               store_handle=store.handle(slug=key))
+        else:
+            rt = TenantRuntime(
+                key=key, tenant=tenant,
+                store_namespace=("" if (key == "royal-imports" or repo) else f"t/{key}/"),
+                store_handle=(store.for_repo(repo) if repo else None))
         _CACHE[key] = rt
         while len(_CACHE) > _MAX_RUNTIMES:
             _CACHE.popitem(last=False)       # evict least recently used

platform/modules/customer_data.py

@@ -272,6 +272,94 @@ def _dba_attrs(pids, t):
         return {}
 
 
+def _book_pids(team_id=None, agent_pids=None):
+    """⭐ WAVE 20 (owner items 8 + 27, ruling R3) — THE WHOLE BOOK, not just who bought recently.
+
+    Owner: *"Martin Pasternak showing only 313 accounts when I filter agent, whereas in Odoo it is
+    494 … I want our App to show complete source of truth, even if no sale.order at all or not.
+    Its important to see what customer is getting assigned to Martin or whether we can retarget
+    them."* The pool was a 24-MONTH SALES universe (YTD ∪ LY-YTD ∪ cadence-window buyers), so a
+    customer assigned to an agent who has never ordered — precisely a retargeting target — did not
+    exist in the app at all.
+
+    R3's definition, MEASURED against live Odoo 2026-08-05:
+        customer_rank>0 active .............. 3,614
+        ever ordered (confirmed, team 5/6) ...  1,748
+        UNION ............................... 3,723   (vs 1,555 in the old 24-month pool)
+    Martin's book under this rule is **494** — the owner's Odoo number, to the account.
+
+    ⛔ **THE "agent-assigned" LEG OF R3 IS DELIBERATELY NOT A THIRD TERM, and that is a
+    measurement, not a shortcut.** Taken literally it added 174 partners and pushed Martin to 503;
+    every one of the 9 extras on his book was an ODOO ADDRESS RECORD rather than an account —
+    `type` in (`delivery`, `other`), most carrying a `parent_id`, and TWO with `name: False`.
+    Shipping them would have put nameless rows in the customer table and made "how many customers
+    does Martin have" answer 503 against an Odoo screen that says 494.
+    Excluding address types wholesale is also wrong (`type not in (delivery, invoice, other,
+    private)` measured **488** — it drops 6 genuine accounts that happen to carry a delivery
+    type). `customer_rank > 0` is the predicate that means "this partner is a customer record",
+    it reproduces the owner's number exactly, and every agent-assigned ACCOUNT already satisfies
+    it — so the leg is subsumed rather than dropped. Item 27's actual ask (the 126 assigned
+    partners with no `sale.order` at all) is fully served: they are rank>0 and they are in.
+
+    ⚠ ACTIVE ONLY. Archived partners stay out (R3): they are ex-customers, and putting them in
+    every count would make "how many customers do we have" unanswerable. The agent-LOGIN scope
+    (`customers.agent_partner_ids`) deliberately still includes archived — an agent's own book is
+    their whole history — and the two remain compatible because that set is INTERSECTED with this
+    pool, so archived rows drop out of the table without narrowing the agent's own permissions.
+
+    ⚠ BU SCOPE IS APPLIED THROUGH ORDERS, NOT THROUGH THE PARTNER. `res.partner` carries no team,
+    so a BU-scoped caller gets the partners who have ORDERED in that BU (plus their own agent
+    book). Widening it to every partner for a scoped user would cross the BU isolation rule that
+    the whole permissioning model rests on.
+    """
+    try:
+        if team_id:
+            # Scoped: partners with confirmed orders in THIS BU, ever. `read_group` on partner_id
+            # rather than a search_read of orders — the group is the distinct set, and it is one
+            # round trip instead of paging tens of thousands of order rows.
+            rows = O.read_group('sale.order',
+                                [('state', 'in', ('sale', 'done')), ('team_id', '=', team_id)],
+                                ['partner_id'], ['partner_id'], lazy=False)
+            book = {O.m2o_id(r.get('partner_id')) for r in rows}
+            book.discard(None)
+        else:
+            rank = O.search_read('res.partner',
+                                 [('customer_rank', '>', 0), ('active', '=', True)],
+                                 ['id'], limit=200000)
+            # `ever` is NOT redundant with rank>0: a partner can be archived-then-reactivated, or
+            # have had its rank reset, and an account that demonstrably bought from us belongs in
+            # the book whatever its flags say now. An ORDER is a fact; a rank is a setting.
+            rows = O.read_group('sale.order',
+                                [('state', 'in', ('sale', 'done')), ('team_id', 'in', (5, 6))],
+                                ['partner_id'], ['partner_id'], lazy=False)
+            ever = {O.m2o_id(r.get('partner_id')) for r in rows}
+            ever.discard(None)
+            book = {r['id'] for r in rank} | ever
+        # An agent filter NARROWS the book to that agent's partners — never widens it. The
+        # intersection is what keeps an agent-login user inside their own book while still
+        # gaining every no-order account assigned to them, which is the whole point of item 27.
+        return (book & set(agent_pids)) if agent_pids is not None else book
+    except Exception as e:
+        # Degrade to the sales-derived universe rather than failing the page — but LOUDLY.
+        #
+        # ⛔ THIS DEGRADATION IS NOT LIKE THE OTHERS IN THIS MODULE, and the difference is what
+        # makes silence wrong here. Every other family (`_ar_attrs`, `_mix_attrs`, …) degrades to
+        # a blank COLUMN, which is visible: the user sees an empty column and asks why. This one
+        # degrades to absent ROWS. The pool still builds from the sales legs, so the page renders
+        # perfectly, the counts look plausible, and Martin is quietly back at 313 with nothing
+        # anywhere saying the book leg failed. An invisible degradation of a COUNT is the failure
+        # mode this codebase keeps writing rules against ([[no-unverifiable-aggregates]]).
+        try:
+            import harness.telemetry as _tel
+            _tel.error('customer_data:_book_pids', e, fallback='sales-derived pool only')
+        except Exception:
+            pass
+        print(f"[aios] WARNING customer_data._book_pids failed ({type(e).__name__}: {e}) - the "
+              f"customer pool is falling back to the 24-month SALES universe, so accounts with "
+              f"no recent orders (owner item 27) are MISSING from this build.")
+        return set()
+
+
 def _pool_build(agent_name, team_id, limit, fast=False):
     t = P.today()
     yf, yt = P.ytd(t)
@@ -282,7 +370,7 @@ def _pool_build(agent_name, team_id, limit, fast=False):
     last = cust._cust_rev(lf, lt, team_id, pids)
     ltm = cust._cust_rev(mf, mt, team_id, pids)
     cad = cust._cadence_bulk(t, team_id, agent_pids=pids)
-    all_pids = set(this) | set(last) | set(cad)
+    all_pids = set(this) | set(last) | set(cad) | _book_pids(team_id, pids)
     total = len(all_pids)
     if limit is not None and total > limit:
         # the SAME ordering the assembled pool ships (see the sort below) — the slice must be

platform/modules/customers.py

@@ -89,11 +89,30 @@ def agent_options(t=None, team_id=None):
     return [r['group'] for r in by_dimension('agent', t, team_id=team_id)]
 
 
-def agent_partner_ids(agent_name):
+def agent_partner_ids(agent_name, customers_only=False):
     """frozenset of partner ids assigned to `agent_name` via res.partner.agent_ids. None when no
     agent is selected ('All agents'); an EMPTY frozenset (matches nobody) when the agent has no
     customers. '(none)' resolves to customers with no agent assigned.
 
+    ⭐ WAVE 20 (R3, DEBT D-30) — `customers_only` IS THE EXPLICIT POLICY THIS FUNCTION WAS
+    MISSING, and the two callers genuinely want different answers:
+
+      * **Permission scope (default, `False`)** — an agent-LOGIN user's whole app is bounded by
+        this set, so it must be GENEROUS: archived accounts and Odoo address records included.
+        Narrowing it would hide an agent's own data from them, and the fails-closed trap in the
+        note below is what that costs.
+      * **Display/reporting (`True`)** — "how many accounts does Martin have" must answer what
+        Odoo answers. MEASURED 2026-08-05: the generous set is 503 for Martin and the honest one
+        is **494**, the owner's number; the 9-row gap is entirely `type in (delivery, other)`
+        ADDRESS records that ride the pool because they appear on orders, two of them with no
+        name at all.
+
+    Both are the SAME m2m-contains resolver — which is D-30's actual requirement. The bug was
+    never the generosity; it was that the Agent COLUMN used a THIRD rule (`agent_ids[0]`, first
+    agent only) that agreed with neither, so an admin filtering `Agent = X` and X's own login saw
+    different books. The column now lists every agent on the partner and this states its policy
+    out loud, so the two can be reconciled by reading them instead of by measuring them.
+
     INCLUDES INACTIVE/archived partners (active in [True,False]) — the agent's book is the whole
     book (dormant + archived accounts too), which is what the Agents page promises AND what an
     AGENT-LOGIN user must see as their complete, isolated book. Active-only used to drop archived
@@ -103,6 +122,9 @@ def agent_partner_ids(agent_name):
     if not agent_name or agent_name in ('All agents', 'All'):
         return None
     _all = [('active', 'in', [True, False])]
+    # The display policy: a real customer record, still active. See the docstring for the
+    # measured 503-vs-494 this closes.
+    _qual = [('customer_rank', '>', 0), ('active', '=', True)] if customers_only else _all
     if agent_name == '(none)':
         rows = O.search_read('res.partner', [('customer_rank', '>', 0),
                                              ('agent_ids', '=', False)] + _all, ['id'], limit=100000)
@@ -110,7 +132,7 @@ def agent_partner_ids(agent_name):
     ag = O.search_read('res.partner', [('name', '=', agent_name)] + _all, ['id'], limit=10)
     if not ag:
         return frozenset()
-    rows = O.search_read('res.partner', [('agent_ids', 'in', [a['id'] for a in ag])] + _all,
+    rows = O.search_read('res.partner', [('agent_ids', 'in', [a['id'] for a in ag])] + _qual,
                          ['id'], limit=100000)
     return frozenset(r['id'] for r in rows)
 
@@ -591,7 +613,18 @@ def _partner_attrs(pids):
             'city': city.title() if city else '(none)',
             'state': O.m2o_name(r.get('state_id')) or '(none)',
             'country': O.m2o_name(r.get('country_id')) or '(none)',
-            'agent': (anames.get(ag[0]) or '(none)') if ag else '(none)',
+            # ⭐ WAVE 20 (R3, closes DEBT D-30) — EVERY agent on the partner, not just the first.
+            #
+            # This was `anames.get(ag[0])`, and it made TWO definitions of "an agent's book" that
+            # disagreed: `agent_partner_ids()` (which scopes an agent-LOGIN user's whole app) is
+            # m2m-CONTAINS, while this column named only `agent_ids[0]`. So an admin filtering
+            # `Agent = X` and X's own login saw different sets — MEASURED book-wide 2026-08-05:
+            # Tara Devon Gallager 9 rows, Sang Ching 6, Moishe Rubenstein 1, Martin Pasternak 1.
+            #
+            # Joined with ', ' rather than kept as a list because the column is a TEXT field the
+            # grid groups and filters on; `contains` then matches any agent on a shared account,
+            # which is the m2m question asked in the vocabulary the column already speaks.
+            'agent': ', '.join(n for n in (anames.get(a) for a in ag) if n) or '(none)',
             'zip': (r.get('zip') or '').strip() or '(none)',
             'payment_terms': O.m2o_name(r.get('property_payment_term_id')) or '(none)',
             'customer_since': str(since)[:10] if since else '',

requirements.txt

@@ -24,3 +24,14 @@ pillow>=10.0
 beautifulsoup4>=4.12
 lxml>=5.0
 cryptography>=42.0
+# ⭐ WAVE 20 (R1 / D-4) — THE POSTGRES DRIVER, AND IT IS LOAD-BEARING IN THIS FILE SPECIFICALLY.
+# `core/store_pg.py` is the store backend from this wave on, and it is deliberately FAIL-CLOSED:
+# `_pool()` raises rather than falling back to the HF file store, so a container that gets
+# `STORE_BACKEND=pg` without this line does not degrade — it refuses every request that touches
+# the store, which is every authenticated request.
+#
+# ⛔ AND THIS IS THE FILE THAT MATTERS: the Dockerfile does `COPY requirements.txt` from the
+# Space root, i.e. THIS manifest, not `api/requirements.txt`. That header's own streamlit story
+# is the same defect in the other direction — the pinned intent and the shipped manifest are two
+# documents. psycopg is now in BOTH, and `ops/verify_portability.py` gates the pair.
+psycopg[binary,pool]>=3.2

web/src/alerts/AlertsPane.tsx

@@ -0,0 +1,261 @@
+// ---------------------------------------------------------------------------
+// alerts/AlertsPane.tsx — WAVE 20 item 25 (C-ALERT): the inbox.
+//
+// Two lists, one panel, and the order is the point: what HAPPENED first, what is
+// WATCHING second. An inbox that opens on its own configuration is a settings
+// screen wearing a bell.
+//
+// A drawer rather than a route, for the same reason the AI note is a modal: the
+// nav is server-filtered and an undeclared surface is denied by design (this
+// shell has no client-invented pages). Alerts are not a granted module — they
+// are this account's own inbox over its own views.
+// ---------------------------------------------------------------------------
+
+import { useCallback, useEffect, useState } from "react";
+import {
+  deleteAlert,
+  fetchAlerts,
+  fetchInbox,
+  markRead,
+  runAlert,
+} from "./alertsApi";
+import { EMPTY_INBOX, applyRead, inboxOrder, routeForTopic, stampText } from "./alertsModel";
+import type { Alert, Inbox, Notification } from "./alertsModel";
+
+/** The clock face this pane uses for its one glyph — drawn, never an emoji. */
+function BellIcon() {
+  return (
+    <svg className="alerts-bell" viewBox="0 0 16 16" aria-hidden="true">
+      <path d="M8 2.2a3.6 3.6 0 0 1 3.6 3.6v2.4l1.2 2H3.2l1.2-2V5.8A3.6 3.6 0 0 1 8 2.2Z" />
+      <path d="M6.6 12.6a1.5 1.5 0 0 0 2.8 0" />
+    </svg>
+  );
+}
+
+export default function AlertsPane({
+  onClose,
+  onOpenView,
+  onInbox,
+  onToast,
+}: {
+  onClose: () => void;
+  /** Navigate to the alert's view. The FRAME owns routing; this pane owns the row. */
+  onOpenView: (topic: string, viewId: string) => void;
+  /** Hand the freshly-read inbox back so the nav badge and the pane agree. */
+  onInbox: (inbox: Inbox) => void;
+  onToast: (message: string) => void;
+}) {
+  const [inbox, setInbox] = useState<Inbox>(EMPTY_INBOX);
+  const [alerts, setAlerts] = useState<Alert[]>([]);
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState(false);
+
+  const publish = useCallback(
+    (next: Inbox) => {
+      setInbox(next);
+      onInbox(next);
+    },
+    [onInbox]
+  );
+
+  const load = useCallback(async () => {
+    const [inboxRes, alertRes] = await Promise.all([fetchInbox(), fetchAlerts()]);
+    if (inboxRes.ok) publish(inboxRes.value);
+    else setError(inboxRes.message);
+    if (alertRes.ok) setAlerts(alertRes.value);
+  }, [publish]);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  // ⛔ Escape closes it, like every other panel in this shell — a scrim with no
+  // keyboard way out is a trap (the wave-18 lesson, kept).
+  useEffect(() => {
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") onClose();
+    };
+    window.addEventListener("keydown", onKey);
+    return () => window.removeEventListener("keydown", onKey);
+  }, [onClose]);
+
+  const toggleRead = useCallback(
+    (n: Notification) => {
+      // Optimistic, with the server's own convention (`ids`, `read`) sent
+      // explicitly — and reverted out loud if the write is refused, because a
+      // badge that silently disagrees with the list is how a reader learns to
+      // stop trusting it.
+      const before = inbox;
+      publish(applyRead(inbox, [n.id], !n.read));
+      void markRead([n.id], !n.read).then((r) => {
+        if (!r.ok) {
+          publish(before);
+          onToast(r.message);
+        }
+      });
+    },
+    [inbox, publish, onToast]
+  );
+
+  const markAll = useCallback(() => {
+    const before = inbox;
+    publish(applyRead(inbox, null, true));
+    void markRead(null, true).then((r) => {
+      if (!r.ok) {
+        publish(before);
+        onToast(r.message);
+      }
+    });
+  }, [inbox, publish, onToast]);
+
+  const open = useCallback(
+    (n: Notification) => {
+      if (!n.read) {
+        publish(applyRead(inbox, [n.id], true));
+        void markRead([n.id], true);
+      }
+      // A route this client cannot resolve opens NOTHING and says so — alerts
+      // outlive the surfaces they were made from.
+      if (!routeForTopic(n.topic)) {
+        onToast("That alert's table is no longer available to this account.");
+        return;
+      }
+      onOpenView(n.topic, n.viewId);
+      onClose();
+    },
+    [inbox, publish, onOpenView, onClose, onToast]
+  );
+
+  const rows = inboxOrder(inbox.items);
+
+  return (
+    <div className="shell-newdb-scrim" onClick={onClose}>
+      <aside
+        className="alerts-pane"
+        role="dialog"
+        aria-label="Alerts"
+        onClick={(e) => e.stopPropagation()}
+      >
+        <header className="alerts-head">
+          <h2>
+            <BellIcon /> Alerts
+          </h2>
+          <button
+            type="button"
+            className="alerts-markall"
+            disabled={inbox.unread === 0}
+            onClick={markAll}
+          >
+            Mark all read
+          </button>
+        </header>
+
+        {error ? <p className="shell-newdb-err">{error}</p> : null}
+
+        <div className="alerts-scroll">
+          {rows.length === 0 ? (
+            <p className="alerts-empty">
+              Nothing new. An alert watches ONE view and tells you when a record it had
+              never matched arrives in it — make one from a view's ··· menu.
+            </p>
+          ) : (
+            <ul className="alerts-list">
+              {rows.map((n) => (
+                <li key={n.id} className={"alerts-row" + (n.read ? "" : " is-unread")}>
+                  <button
+                    type="button"
+                    className="alerts-row-main"
+                    onClick={() => open(n)}
+                    title={`Open ${n.alertLabel || "the alert's view"}`}
+                  >
+                    <span className="alerts-row-label">{n.label}</span>
+                    <span className="alerts-row-meta">
+                      {n.alertLabel ? `${n.alertLabel} · ` : ""}
+                      {/* Readable, but never re-derived: `stampText` is string surgery
+                          over the server's own UTC-with-offset stamp (D-18). Parsing it
+                          into a browser Date is how a tenant a day ahead gets told an
+                          event happened tomorrow. */}
+                      {stampText(n.at)}
+                    </span>
+                  </button>
+                  <button
+                    type="button"
+                    className="alerts-row-toggle"
+                    aria-label={n.read ? `Mark ${n.label} unread` : `Mark ${n.label} read`}
+                    title={n.read ? "Mark unread" : "Mark read"}
+                    onClick={() => toggleRead(n)}
+                  >
+                    {/* The ACTION, not the state: "Read" beside an unread row reads as
+                        a label for the row itself. */}
+                    {n.read ? "Mark unread" : "Mark read"}
+                  </button>
+                </li>
+              ))}
+            </ul>
+          )}
+
+          {alerts.length > 0 ? (
+            <section className="alerts-watching">
+              <h3>Watching</h3>
+              {alerts.map((a) => (
+                <div key={a.id} className="alerts-watch-row">
+                  <span className="alerts-watch-label">{a.label}</span>
+                  <span className="alerts-watch-meta">
+                    {/* The remembered set's SIZE, which is what "no news" means here:
+                        an alert with 40 matches and nothing new is working. */}
+                    {a.matched.toLocaleString()} matched
+                    {a.lastError ? ` · ${a.lastError}` : ""}
+                  </span>
+                  <button
+                    type="button"
+                    className="alerts-watch-run"
+                    disabled={busy}
+                    onClick={() => {
+                      setBusy(true);
+                      void runAlert(a.id).then((r) => {
+                        setBusy(false);
+                        if (!r.ok) return onToast(r.message);
+                        const v = r.value as { new?: unknown[]; skipped?: string };
+                        onToast(
+                          v?.skipped
+                            ? `Skipped: ${v.skipped}`
+                            : `${(v?.new ?? []).length} new since the last check.`
+                        );
+                        void load();
+                      });
+                    }}
+                  >
+                    Check now
+                  </button>
+                  <button
+                    type="button"
+                    className="alerts-watch-del"
+                    disabled={busy}
+                    aria-label={`Delete the alert ${a.label}`}
+                    onClick={() => {
+                      setBusy(true);
+                      void deleteAlert(a.id).then((r) => {
+                        setBusy(false);
+                        if (!r.ok) return onToast(r.message);
+                        setAlerts((cur) => cur.filter((x) => x.id !== a.id));
+                        void load();
+                      });
+                    }}
+                  >
+                    Delete
+                  </button>
+                </div>
+              ))}
+            </section>
+          ) : null}
+        </div>
+
+        <div className="shell-newdb-actions alerts-foot">
+          <button type="button" className="login-submit" onClick={onClose}>
+            Close
+          </button>
+        </div>
+      </aside>
+    </div>
+  );
+}

web/src/alerts/alertsApi.ts

@@ -0,0 +1,93 @@
+// ---------------------------------------------------------------------------
+// alerts/alertsApi.ts — WAVE 20 item 25 (C-ALERT): the seven calls, and nothing
+// else. Every one carries the session cookie and fails CLOSED: an unreadable
+// answer is an empty inbox, never a half-parsed one.
+//
+// Shaped like `shell/session.ts` on purpose — the same `{ok}` result type, the
+// same 4xx/5xx message policy — because the failure that matters is identical:
+// a wrong `credentials` word produces no client-side symptom at all, just a 401
+// from a server that never saw a session.
+// ---------------------------------------------------------------------------
+
+import { API_V1, CREDENTIALS } from "../apiContract";
+import { EMPTY_INBOX, parseAlerts, parseInbox } from "./alertsModel";
+import type { Alert, Inbox } from "./alertsModel";
+
+export type Result<T> =
+  | { ok: true; value: T }
+  | { ok: false; status: number; message: string };
+
+/** 4xx text is POLICY the reader needs ("this view has no filter"); a 5xx's text
+ *  is the server's internals and is never shown. Same split as session.ts. */
+export function errorMessage(status: number, message?: string): string {
+  if (status >= 500 || !message) {
+    return status >= 500
+      ? "Something went wrong on our side. Try again in a moment."
+      : `The server answered ${status}.`;
+  }
+  return message;
+}
+
+async function call<T>(
+  path: string,
+  init: RequestInit,
+  read: (body: unknown) => T
+): Promise<Result<T>> {
+  let res: Response;
+  try {
+    res = await fetch(`${API_V1}${path}`, { credentials: CREDENTIALS, ...init });
+  } catch {
+    return { ok: false, status: 0, message: "Cannot reach the server." };
+  }
+  const body = (await res.json().catch(() => null)) as unknown;
+  if (!res.ok) {
+    const detail = (body as { error?: { message?: string } } | null)?.error?.message;
+    return { ok: false, status: res.status, message: errorMessage(res.status, detail) };
+  }
+  return { ok: true, value: read(body) };
+}
+
+const json = (data: unknown): RequestInit => ({
+  method: "POST",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify(data),
+});
+
+export function fetchInbox(): Promise<Result<Inbox>> {
+  return call("/notifications", {}, parseInbox);
+}
+
+/** `ids: null` marks EVERYTHING — the API's own convention, not a shortcut. */
+export function markRead(ids: string[] | null, read = true): Promise<Result<true>> {
+  return call("/notifications/read", json({ ids, read }), () => true as const);
+}
+
+export function fetchAlerts(): Promise<Result<Alert[]>> {
+  return call("/alerts", {}, parseAlerts);
+}
+
+/**
+ * `POST /alerts`. ⚠ 400 `no_filter` is a REAL ANSWER, not a failure to handle:
+ * a view with no active filter matches every row, so an alert on it would seed
+ * with the whole table and could never see an entrant again. The message rides
+ * back to the caller verbatim — that is the difference between "refused" and
+ * "silently incapable".
+ */
+export function createAlert(
+  viewId: string,
+  topic: string,
+  label?: string
+): Promise<Result<unknown>> {
+  return call("/alerts", json({ viewId, topic, ...(label ? { label } : {}) }), (b) => b);
+}
+
+export function deleteAlert(id: string): Promise<Result<true>> {
+  return call(`/alerts/${encodeURIComponent(id)}`, { method: "DELETE" }, () => true as const);
+}
+
+/** Run one alert now. Answers `{new:[rowId], seeded}` or `{skipped:"<reason>"}`. */
+export function runAlert(id: string): Promise<Result<unknown>> {
+  return call(`/alerts/${encodeURIComponent(id)}/run`, { method: "POST" }, (b) => b);
+}
+
+export { EMPTY_INBOX };

web/src/alerts/alertsModel.ts

@@ -0,0 +1,218 @@
+// ---------------------------------------------------------------------------
+// alerts/alertsModel.ts — WAVE 20 item 25 (contract C-ALERT): the inbox's PURE
+// half. React-free and fetch-free, so `verify_alerts.py` runs it under node.
+//
+// An alert says "tell me when a record ENTERS this view". The client half is
+// small, and every part of it fails silently when it is wrong:
+//
+//   · an unread count taken from `items.length` rather than from the server's
+//     own `unread` disagrees with the badge the moment a page is capped or a
+//     read lands in another tab — and a badge that says 3 when the list shows 9
+//     teaches the reader to ignore the badge;
+//   · a notification whose `viewId` no longer resolves must open NOTHING rather
+//     than a wrong view — alerts outlive the views they were made from;
+//   · `topic` is the surface's scope key ("customer", "product", "ut_…"), and
+//     the ROUTE is a registry key ("customer_data") — mapping one to the other
+//     by guesswork sends every click to a page that does not exist.
+// ---------------------------------------------------------------------------
+
+/** One notification, as `GET /api/v1/notifications` sends it. */
+export interface Notification {
+  id: string;
+  alertId: string;
+  viewId: string;
+  topic: string;
+  rowId: string;
+  /** What entered — the record's own label. */
+  label: string;
+  /** What the alert is called, so a row reads without opening anything. */
+  alertLabel: string;
+  /** UTC WITH OFFSET (D-18). Kept as the server's STRING: re-formatting it here
+   *  would re-introduce the browser-clock drift the offset exists to remove. */
+  at: string;
+  read: boolean;
+}
+
+/** One alert, as `GET /api/v1/alerts` sends it. */
+export interface Alert {
+  id: string;
+  viewId: string;
+  topic: string;
+  owner: string;
+  label: string;
+  createdAt: string;
+  /** How many records are in its remembered set right now. */
+  matched: number;
+  seeded: boolean;
+  lastRunAt: string;
+  lastError: string;
+}
+
+export interface Inbox {
+  unread: number;
+  items: Notification[];
+}
+
+export const EMPTY_INBOX: Inbox = { unread: 0, items: [] };
+
+const str = (v: unknown): string => (typeof v === "string" ? v : "");
+const num = (v: unknown): number => (typeof v === "number" && isFinite(v) ? v : 0);
+
+/**
+ * `GET /notifications` → the inbox, fail-closed.
+ *
+ * ⚠ `unread` COMES FROM THE SERVER, and is not recounted from `items`. The two
+ * can legitimately differ — the list is what this page holds, the count is what
+ * the account has — and recomputing it here would make the badge a function of
+ * whatever the last fetch happened to include.
+ */
+export function parseInbox(body: unknown): Inbox {
+  const b = (body && typeof body === "object" ? body : {}) as Record<string, unknown>;
+  const raw = Array.isArray(b.items) ? b.items : [];
+  const items: Notification[] = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const n = item as Record<string, unknown>;
+    const id = str(n.id);
+    // An id-less notification cannot be marked read, so it would sit unread for
+    // ever and hold the badge up. Dropped, not rendered.
+    if (!id) continue;
+    items.push({
+      id,
+      alertId: str(n.alertId),
+      viewId: str(n.viewId),
+      topic: str(n.topic),
+      rowId: String(n.rowId ?? ""),
+      label: str(n.label) || String(n.rowId ?? ""),
+      alertLabel: str(n.alertLabel),
+      at: str(n.at),
+      read: n.read === true,
+    });
+  }
+  return { unread: Math.max(0, num(b.unread)), items };
+}
+
+/** `GET /alerts` → the alert list, fail-closed. */
+export function parseAlerts(body: unknown): Alert[] {
+  const b = (body && typeof body === "object" ? body : {}) as Record<string, unknown>;
+  const raw = Array.isArray(b.alerts) ? b.alerts : [];
+  const out: Alert[] = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const a = item as Record<string, unknown>;
+    const id = str(a.id);
+    if (!id) continue;
+    out.push({
+      id,
+      viewId: str(a.viewId),
+      topic: str(a.topic),
+      owner: str(a.owner),
+      label: str(a.label) || "Untitled alert",
+      createdAt: str(a.createdAt),
+      matched: num(a.matched),
+      seeded: a.seeded === true,
+      lastRunAt: str(a.lastRunAt),
+      lastError: str(a.lastError),
+    });
+  }
+  return out;
+}
+
+/**
+ * A topic (the grid's scope key) → the hash route that renders it.
+ *
+ * The two built-ins are the only pair that differ, and they differ because the
+ * REGISTRY names the surface while the GRID names the scope; a user table is its
+ * own key in both. `null` for anything else: a notification for a topic this
+ * client cannot route to must do nothing, not navigate somewhere plausible.
+ */
+export function routeForTopic(topic: string): string | null {
+  const t = str(topic).trim();
+  if (t === "customer") return "customer_data";
+  if (t === "product") return "product_data";
+  if (/^ut_[A-Za-z0-9_]+$/.test(t)) return t;
+  return null;
+}
+
+/** Newest first, and unread before read at the same instant — the inbox order.
+ *  Stable: two notifications from one write keep the server's order. */
+export function inboxOrder(items: Notification[]): Notification[] {
+  return [...items].sort((a, b) => {
+    if (a.read !== b.read) return a.read ? 1 : -1;
+    return a.at < b.at ? 1 : a.at > b.at ? -1 : 0;
+  });
+}
+
+/**
+ * The stamp, made readable WITHOUT touching a clock.
+ *
+ * ⛔ NO `new Date()`, NO `toLocaleString()`, and that is the whole design. The
+ * server sends UTC WITH ITS OFFSET (D-18) precisely so every reader sees the
+ * same instant; parsing it into a browser Date and formatting it back would
+ * re-introduce the drift the offset exists to remove — a tenant a day ahead
+ * being told an event happened tomorrow ([[date-window-vocabulary]]). This is
+ * STRING SURGERY: keep the date and the minutes, drop the seconds and the `T`.
+ * Anything that does not look like an ISO stamp passes through untouched, so a
+ * format this function has never seen is shown as sent rather than mangled.
+ */
+export function stampText(at: string): string {
+  const m = /^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2})/.exec(str(at));
+  return m ? `${m[1]} ${m[2]}` : str(at);
+}
+
+/**
+ * The badge's text. Never the raw number past 99: a nav row is 236px wide and a
+ * four-digit badge pushes the label out of it.
+ */
+export function badgeText(unread: number): string {
+  const n = Math.max(0, Math.floor(unread));
+  if (n <= 0) return "";
+  return n > 99 ? "99+" : String(n);
+}
+
+/**
+ * Apply a read/unread change LOCALLY, mirroring what the server just stored, and
+ * return the new inbox with the count corrected.
+ *
+ * `ids === null` is "all of them" (the API's own convention for mark-all). The
+ * count is derived from the ITEMS here — deliberately, and it is the one place
+ * that is right to do so: the server's answer is in flight, and the alternative
+ * is a badge that keeps its old number until the refetch lands.
+ */
+export function applyRead(inbox: Inbox, ids: string[] | null, read: boolean): Inbox {
+  const wanted = ids === null ? null : new Set(ids);
+  const items = inbox.items.map((n) =>
+    wanted === null || wanted.has(n.id) ? { ...n, read } : n
+  );
+  const seenUnread = items.filter((n) => !n.read).length;
+  // A page can hold fewer notifications than the account has, so a partial read
+  // must SUBTRACT from the server's count rather than replace it with this
+  // page's tally — except when marking everything, where zero is the answer.
+  if (wanted === null) return { unread: read ? 0 : items.length, items };
+  const changed = inbox.items.filter(
+    (n) => wanted.has(n.id) && n.read !== read
+  ).length;
+  const delta = read ? -changed : changed;
+  return { unread: Math.max(seenUnread, inbox.unread + delta), items };
+}
+
+/**
+ * The shell↔rail channel for "make an alert out of this view" — the view rail
+ * raises it, the frame (which knows the current route, and therefore the topic)
+ * answers. Same reason as C-SHARE's event: the rail is host-neutral and cannot
+ * import the shell, and it does not know its own scope key.
+ */
+export const ALERT_CREATE_EVENT = "aios:alert-create";
+
+export interface AlertCreateRequest {
+  viewId: string;
+  label: string;
+}
+
+export function parseAlertCreate(detail: unknown): AlertCreateRequest | null {
+  if (!detail || typeof detail !== "object") return null;
+  const d = detail as Record<string, unknown>;
+  const viewId = str(d.viewId).trim();
+  if (!viewId) return null;
+  return { viewId, label: str(d.label).trim() || viewId };
+}

web/src/automation/AutomationCreate.tsx

@@ -104,7 +104,19 @@ export default function AutomationCreate({ kinds, onCreated, onCancel }: Props)
         config:
           kind === "scrape_db"
             ? { url, extract, tableIndex, fieldMap, keyField, targetLabel }
-            : { targetTable, fieldKey, urlField, maxPosts: 24, tier: "anonymous" },
+            : kind === "discover_instagram"
+              ? {
+                  // A search is created with a SMALL, NARROW default and no schedule, then
+                  // widened on the canvas where the cost estimate is. The one shape that must
+                  // never be the default is the expensive one.
+                  recordsLimit: 25,
+                  operator: "and",
+                  predicates: [
+                    { name: "followers", operator: ">=", value: 10000 },
+                    { name: "biography", operator: "includes", value: "" },
+                  ],
+                }
+              : { targetTable, fieldKey, urlField, maxPosts: 24, tier: "anonymous" },
       });
       await onCreated(res.automation.id);
     } catch (e) {
@@ -118,7 +130,9 @@ export default function AutomationCreate({ kinds, onCreated, onCancel }: Props)
     !!name.trim() &&
     (kind === "scrape_db"
       ? !!url.trim() && plan.some((c) => c.include && c.key === keyField)
-      : !!targetTable && !!fieldKey);
+      : kind === "discover_instagram"
+        ? true
+        : !!targetTable && !!fieldKey);
 
   return (
     <div className="auto-create-pane">
@@ -164,7 +178,21 @@ export default function AutomationCreate({ kinds, onCreated, onCancel }: Props)
           ))}
         </div>
 
-        {kind === "scrape_db" ? (
+        {kind === "discover_instagram" ? (
+          <>
+            <p className="auto-hint">
+              It searches a corpus of pre-collected public Instagram profiles for accounts you
+              have never heard of, and collects the matches into a candidates database. You set
+              the conditions and how many profiles to fetch on the canvas, where the cost
+              estimate is — searching is the one thing this workspace does that spends money per
+              run.
+            </p>
+            <p className="auto-hint">
+              It starts with a narrow default and no schedule. Nothing it finds is ever tracked
+              automatically; you tick the accounts you want.
+            </p>
+          </>
+        ) : kind === "scrape_db" ? (
           <>
             <div className="auto-field">
               <label htmlFor="auto-new-url">Page URL</label>
@@ -363,8 +391,11 @@ export default function AutomationCreate({ kinds, onCreated, onCancel }: Props)
               </div>
             </div>
             <p className="auto-hint">
-              It starts on the free anonymous rung. The canvas&rsquo;s HikerAPI step turns on the
-              paid one, which returns exact counts and full post data and works from a datacenter.
+              It starts on the free anonymous rung. The canvas&rsquo;s Bright Data step turns on
+              the paid one, which returns exact counts and the profile&rsquo;s top posts, and
+              works from a datacenter. Likes and comments per post are a separate step again —
+              they cost one record per post rather than one per profile, so they are off until
+              you turn them on.
             </p>
             {table && !(table.fields || []).some((f) => f.type === "automation") ? (
               <p className="auto-note">

web/src/automation/AutomationDetail.tsx

@@ -27,6 +27,8 @@ import type {
   GraphNode,
   RunEntry,
   RunRows,
+  DiscoverEstimate,
+  DiscoverVocab,
   SourcePreview,
   UserTable,
 } from "./automationApi";
@@ -34,6 +36,7 @@ import {
   AutomationError,
   COUNT_LABELS,
   deleteAutomation,
+  discoverEstimate,
   fieldKeyFor,
   listTables,
   patchAutomation,
@@ -47,7 +50,9 @@ interface Props {
   automation: Automation;
   kinds: { key: AutomationKind; label: string }[];
   cronPresets: { cron: string; label: string }[];
-  hikerReady: boolean;
+  paidReady: boolean;
+  /** The server-declared discovery vocabulary (absent until the list loads). */
+  discover?: DiscoverVocab;
   onSaved: (id?: string) => void | Promise<void>;
   onDeleted: () => void | Promise<void>;
 }
@@ -58,11 +63,19 @@ interface ColumnPlan {
   key: string;
 }
 
+/** One condition of a corpus search. Mirrors the server's `clean_predicates`. */
+interface Predicate {
+  name: string;
+  operator: string;
+  value?: string | number;
+}
+
 export default function AutomationDetail({
   automation,
   kinds,
   cronPresets,
-  hikerReady,
+  paidReady,
+  discover,
   onSaved,
   onDeleted,
 }: Props) {
@@ -98,6 +111,17 @@ export default function AutomationDetail({
   const [urlField, setUrlField] = useState(String(cfg.urlField || ""));
   const [maxPosts, setMaxPosts] = useState(Number(cfg.maxPosts || 24));
 
+  // --- discover_instagram half (R7)
+  const [recordsLimit, setRecordsLimit] = useState(Number(cfg.recordsLimit || 25));
+  const [joinOp, setJoinOp] = useState(String(cfg.operator || "and"));
+  const [preds, setPreds] = useState<Predicate[]>(() => {
+    const stored = (automation.config as { predicates?: Predicate[] })?.predicates;
+    return stored && stored.length
+      ? stored.map((p) => ({ ...p }))
+      : [{ name: "followers", operator: ">=", value: 10000 }];
+  });
+  const [estimate, setEstimate] = useState<DiscoverEstimate | null>(null);
+
   // --- run history drill
   const [drill, setDrill] = useState<RunRows | null>(null);
   const [drillFor, setDrillFor] = useState("");
@@ -179,6 +203,14 @@ export default function AutomationDetail({
         targetLabel,
       };
     }
+    if (kind === "discover_instagram") {
+      return {
+        recordsLimit,
+        operator: joinOp,
+        predicates: preds.filter((p) => p.name && p.operator),
+        targetTable: String(cfg.targetTable || ""),
+      };
+    }
     return { targetTable, fieldKey, urlField, maxPosts };
   };
 
@@ -545,6 +577,9 @@ export default function AutomationDetail({
                       }}
                     >
                       <option value="">Choose a database…</option>
+                      {targetTable && !tables.some((t) => t.key === targetTable) ? (
+                        <option value={targetTable}>{targetTable} (not visible to you)</option>
+                      ) : null}
                       {tables.map((t) => (
                         <option key={t.key} value={t.key}>
                           {t.label} ({t.rowCount} {t.rowCount === 1 ? "row" : "rows"})
@@ -577,6 +612,18 @@ export default function AutomationDetail({
                       onChange={(e) => edit(setFieldKey)(e.target.value)}
                     >
                       <option value="">Choose a column…</option>
+                      {/*
+                        ⚠ THE STORED VALUE IS ALWAYS AN OPTION, even when the list
+                        below does not contain it. A <select> whose `value` matches
+                        no <option> renders the FIRST one — so a column the server
+                        knows about but this list has not caught up with would look
+                        like a DIFFERENT column, and the next Save would write that
+                        different column without anybody choosing it. Showing it as
+                        "(not in this database)" is the honest version.
+                      */}
+                      {fieldKey && !(table?.fields || []).some((f) => f.key === fieldKey) ? (
+                        <option value={fieldKey}>{fieldKey} (not in this database)</option>
+                      ) : null}
                       {(table?.fields || [])
                         .filter((f) => f.type === "automation")
                         .map((f) => (
@@ -609,14 +656,22 @@ export default function AutomationDetail({
                       onChange={(e) => edit(setMaxPosts)(Number(e.target.value) || 24)}
                     />
                   </div>
-                  <h3>HikerAPI — the paid rung</h3>
+                  <h3>Bright Data — the paid rung</h3>
                   <p className="auto-hint">
-                    Exact follower counts and post-level data, and it works from a datacenter.
-                    Roughly $0.0006 a request. Its node&rsquo;s switch turns it on.
-                    {hikerReady
+                    Exact follower counts and the profile&rsquo;s top posts, and it works from a
+                    datacenter. Its node&rsquo;s switch turns it on.
+                    {paidReady
                       ? " A key is configured on this deployment."
                       : " No key is configured on this deployment yet, so it will report itself blocked and the anonymous rung will answer instead."}
                   </p>
+                  <h3>Post engagement — the per-post rung</h3>
+                  <p className="auto-hint">
+                    Likes and comments for each post. It is a separate step because it is a
+                    separate bill: the profile read costs one record, and engagement costs{" "}
+                    <strong>one record per post</strong>. With it off, the posts database still
+                    grows but the engagement series does not — and no empty rows are appended to
+                    stand in for the numbers nobody bought.
+                  </p>
                   <h3>Anonymous — the free rung</h3>
                   <p className="auto-hint">
                     No login and no credentials. Instagram blocks datacenter addresses and has
@@ -634,6 +689,181 @@ export default function AutomationDetail({
                 </>
               ) : null}
 
+              {node.panel === "find" ? (
+                <>
+                  <div className="auto-field">
+                    <label htmlFor="auto-records">How many profiles to fetch</label>
+                    <input
+                      id="auto-records"
+                      className="auto-input"
+                      type="number"
+                      min={1}
+                      max={discover?.maxRecords || 1000}
+                      value={recordsLimit}
+                      onChange={(e) => {
+                        edit(setRecordsLimit)(Number(e.target.value) || 1);
+                        setEstimate(null);
+                      }}
+                    />
+                  </div>
+                  <p className="auto-hint">
+                    A search must be bounded. An unbounded one matches a share of a corpus of
+                    hundreds of millions of profiles, and the vendor refuses it outright rather
+                    than delivering it.
+                  </p>
+
+                  <h3>Conditions</h3>
+                  {preds.map((pr, i) => (
+                    <div className="auto-field-row" key={i}>
+                      <div className="auto-field">
+                        <label htmlFor={"auto-pred-f-" + i}>Field</label>
+                        <select
+                          id={"auto-pred-f-" + i}
+                          className="auto-input"
+                          value={pr.name}
+                          onChange={(e) =>
+                            edit(setPreds)(
+                              preds.map((q, j) => (j === i ? { ...q, name: e.target.value } : q))
+                            )
+                          }
+                        >
+                          {/*
+                            The stored value is ALWAYS an option — see the note on the
+                            automation-column picker. A select whose value matches no option
+                            renders the first one, which silently changes what a Save writes.
+                          */}
+                          {pr.name && !(discover?.fields || []).includes(pr.name) ? (
+                            <option value={pr.name}>{pr.name}</option>
+                          ) : null}
+                          {(discover?.fields || []).map((f) => (
+                            <option key={f} value={f}>
+                              {f}
+                              {(discover?.lead || []).includes(f) ? "  (has values)" : ""}
+                            </option>
+                          ))}
+                        </select>
+                      </div>
+                      <div className="auto-field">
+                        <label htmlFor={"auto-pred-o-" + i}>Comparison</label>
+                        <select
+                          id={"auto-pred-o-" + i}
+                          className="auto-input"
+                          value={pr.operator}
+                          onChange={(e) =>
+                            edit(setPreds)(
+                              preds.map((q, j) =>
+                                j === i ? { ...q, operator: e.target.value } : q
+                              )
+                            )
+                          }
+                        >
+                          {pr.operator && !(discover?.operators || []).includes(pr.operator) ? (
+                            <option value={pr.operator}>{pr.operator}</option>
+                          ) : null}
+                          {(discover?.operators || []).map((o) => (
+                            <option key={o} value={o}>
+                              {o}
+                            </option>
+                          ))}
+                        </select>
+                      </div>
+                      {(discover?.nullaryOperators || []).includes(pr.operator) ? null : (
+                        <div className="auto-field">
+                          <label htmlFor={"auto-pred-v-" + i}>Value</label>
+                          <input
+                            id={"auto-pred-v-" + i}
+                            className="auto-input"
+                            value={pr.value === undefined ? "" : String(pr.value)}
+                            onChange={(e) =>
+                              edit(setPreds)(
+                                preds.map((q, j) => (j === i ? { ...q, value: e.target.value } : q))
+                              )
+                            }
+                          />
+                        </div>
+                      )}
+                      <div className="auto-field">
+                        <label htmlFor={"auto-pred-x-" + i}>&nbsp;</label>
+                        <button
+                          id={"auto-pred-x-" + i}
+                          type="button"
+                          className="auto-btn"
+                          disabled={preds.length < 2}
+                          onClick={() => edit(setPreds)(preds.filter((_q, j) => j !== i))}
+                        >
+                          Remove
+                        </button>
+                      </div>
+                    </div>
+                  ))}
+                  <div className="auto-head-actions">
+                    <button
+                      type="button"
+                      className="auto-btn"
+                      onClick={() =>
+                        edit(setPreds)([
+                          ...preds,
+                          { name: "biography", operator: "includes", value: "" },
+                        ])
+                      }
+                    >
+                      Add a condition
+                    </button>
+                    <div className="auto-field">
+                      <label htmlFor="auto-joinop">Match</label>
+                      <select
+                        id="auto-joinop"
+                        className="auto-input"
+                        value={joinOp}
+                        onChange={(e) => edit(setJoinOp)(e.target.value)}
+                      >
+                        <option value="and">All of them</option>
+                        <option value="or">Any of them</option>
+                      </select>
+                    </div>
+                  </div>
+                  <p className="auto-hint">
+                    Fields marked <em>has values</em> are the ones we have actually seen carrying
+                    data. The others can be searched, but were empty on every profile we have
+                    looked at — and a condition on an empty field returns nothing while looking
+                    exactly like &ldquo;no such accounts exist&rdquo;.
+                  </p>
+                  <p className="auto-hint">
+                    Narrow conditions matter more than a small limit. The search reads the whole
+                    corpus either way, so a broad condition is slow and expensive however few rows
+                    you ask to keep. A search normally takes about twenty minutes; a run that
+                    finds one still going says so and the next run collects it.
+                  </p>
+
+                  <h3>What it costs</h3>
+                  <div className="auto-head-actions">
+                    <button
+                      type="button"
+                      className="auto-btn"
+                      onClick={() => {
+                        void discoverEstimate(recordsLimit)
+                          .then(setEstimate)
+                          .catch(() => setEstimate(null));
+                      }}
+                    >
+                      Estimate this search
+                    </button>
+                  </div>
+                  {estimate ? (
+                    <p className="auto-hint">
+                      About <strong>${estimate.usd}</strong> for {estimate.records} profiles, at $
+                      {estimate.unitUsd} each.{" "}
+                      {/*
+                        THE CAVEAT IS NOT OPTIONAL. The vendor never quotes a price before a run
+                        and this deployment cannot read its own balance, so presenting this as a
+                        billed figure would be inventing a measurement.
+                      */}
+                      <strong>This is an estimate</strong> — {estimate.note}.
+                    </p>
+                  ) : null}
+                </>
+              ) : null}
+
               {node.panel === "write" ? (
                 <>
                   {kind === "scrape_db" ? (
@@ -647,11 +877,20 @@ export default function AutomationDetail({
                         onChange={(e) => edit(setTargetLabel)(e.target.value)}
                       />
                     </div>
+                  ) : kind === "discover_instagram" ? (
+                    <p className="auto-hint">
+                      Matches are collected into{" "}
+                      <code>{discover?.table || "ut_ig_candidates"}</code>, upserted by handle — so
+                      re-finding an account costs nothing and its <em>Times found</em> count grows.{" "}
+                      <strong>Nothing found is ever tracked automatically.</strong> Tick the ones
+                      you want; a later search can never un-tick them.
+                    </p>
                   ) : (
                     <p className="auto-hint">
-                      Each pull appends a timestamped row to <code>ut_ig_snapshots</code> and, for
-                      every post, to <code>ut_ig_post_snapshots</code> — so the history is a time
-                      series you can filter by date rather than a single current value.{" "}
+                      Each pull appends a timestamped row to <code>ut_ig_snapshots</code> and, when
+                      the post-engagement step is on, one per post to{" "}
+                      <code>ut_ig_post_snapshots</code> — so the history is a time series you can
+                      filter by date rather than a single current value.{" "}
                       <code>ut_ig_posts</code> holds one row per post, ever.
                     </p>
                   )}
@@ -660,6 +899,20 @@ export default function AutomationDetail({
                     reads everything and reports exactly what it would have written, without
                     creating or changing a single row.
                   </p>
+                  {kind === "field_instagram" ? (
+                    <p className="auto-hint">
+                      {/*
+                        ⚠ "Writes nothing" and "costs nothing" are DIFFERENT CLAIMS, and only the
+                        first one is true. A dry run still READS — so with the paid steps on it
+                        bills exactly what a real run bills. Saying so here is the only place a
+                        user finds out before the invoice.
+                      */}
+                      A dry run still <strong>reads</strong>. With the Bright Data step on it
+                      costs what a real run costs, and with post engagement on that is one
+                      charged record per post. Turn those steps off too if you want a free
+                      rehearsal.
+                    </p>
+                  ) : null}
                   <p className="auto-hint">
                     A row that stops appearing at the source is counted and kept, never deleted.
                   </p>

web/src/automation/AutomationSurface.tsx

@@ -257,7 +257,8 @@ export default function AutomationSurface() {
             automation={active}
             kinds={data?.kinds || []}
             cronPresets={data?.cronPresets || []}
-            hikerReady={!!data?.hikerReady}
+            paidReady={!!data?.paidReady}
+            discover={data?.discover}
             onSaved={async (id) => {
               const next = await load();
               if (id && next) setActiveId(id);
@@ -284,10 +285,18 @@ export default function AutomationSurface() {
               </li>
               <li>
                 <strong>Instagram profile column.</strong> For every record carrying a
-                public profile URL, read the profile — exactly, through HikerAPI, or
+                public profile URL, read the profile — exactly, through Bright Data, or
                 approximately on the free anonymous rung — and append a timestamped row per
-                pull, so followers and post engagement become a series you can filter by
-                date rather than a single current number.
+                pull, so followers become a series you can filter by date rather than a
+                single current number.
+              </li>
+              <li>
+                <strong>Find Instagram profiles.</strong> Search a corpus of pre-collected
+                public profiles for accounts you have never heard of — a follower band, a
+                phrase in the bio, an engagement floor — and collect the matches into a
+                candidates database. Searching costs money, so every run is bounded by a
+                profile count you set and shows an estimate first. Nothing found is ever
+                tracked automatically; you tick the ones you want.
               </li>
             </ul>
           </div>

web/src/automation/automationApi.ts

@@ -16,9 +16,14 @@
 // ---------------------------------------------------------------------------
 import { API_V1, CREDENTIALS, UNAUTHORIZED_EVENT, signal } from "../apiContract";
 
-export type AutomationKind = "scrape_db" | "field_instagram";
+export type AutomationKind = "scrape_db" | "field_instagram" | "discover_instagram";
 export type RunState = "idle" | "running" | "ok" | "error" | "partial";
-export type CaptureTier = "anonymous" | "hiker";
+/**
+ * ⚠ `hiker` is NOT in this union any more (wave 20, D-21) — the vendor moved.
+ * Stored configs still SAY `hiker` and the server maps them forward
+ * (`TIER_ALIASES`), so nothing in this client should ever write that word.
+ */
+export type CaptureTier = "anonymous" | "brightdata";
 
 /**
  * A node's dot. Deliberately WIDER than `RunState` — a single step can be
@@ -92,14 +97,60 @@ export interface AutomationList {
   kinds: { key: AutomationKind; label: string }[];
   cronPresets: { cron: string; label: string }[];
   /**
-   * Is `AIOS_HIKERAPI_KEY` configured on the server? A BOOLEAN, never the key —
+   * Is `AIOS_BRIGHTDATA_KEY` configured on the server? A BOOLEAN, never the key —
    * the surface needs to say "the paid rung is not configured" honestly rather
    * than offering a tier that will silently refuse.
    */
-  hikerReady: boolean;
+  paidReady: boolean;
+  /**
+   * THE SOURCE REGISTRY (DEBT D-9's seam). Server-declared, for the reason
+   * `cronPresets` is: the module that RUNS a source is the only thing entitled
+   * to say what it can do, and a client copy of "Instagram can discover,
+   * TikTok cannot" goes stale in silence. `canDiscover: false` is an honest
+   * statement, not a gap — offering the button anyway offers a refusal.
+   */
+  sources: SourceStatus[];
+  /** The discovery vocabulary — every name MEASURED-accepted by the vendor. */
+  discover: DiscoverVocab;
   storeAvailable: boolean;
 }
 
+export interface SourceStatus {
+  key: string;
+  label: string;
+  vendor: string;
+  ready: boolean;
+  canDiscover: boolean;
+}
+
+export interface DiscoverVocab {
+  fields: string[];
+  /**
+   * The subset seen carrying VALUES on real corpus rows. The others are
+   * filterable and were null on every row measured — and a filter on an
+   * unpopulated field returns nothing while looking exactly like "no such
+   * influencers exist".
+   */
+  lead: string[];
+  operators: string[];
+  nullaryOperators: string[];
+  maxRecords: number;
+  table: string;
+}
+
+/**
+ * ⚠ AN ESTIMATE, AND IT CARRIES ITS OWN CAVEAT (`basis: "SPEC"`). Bright Data
+ * never quotes a price before a run, and this account's token cannot read a
+ * balance — so no surface may present this as a billed figure.
+ */
+export interface DiscoverEstimate {
+  records: number;
+  usd: number;
+  unitUsd: number;
+  basis: string;
+  note: string;
+}
+
 export interface UserTable {
   key: string;
   label: string;
@@ -198,9 +249,10 @@ export function runAutomation(id: string): Promise<{ started: string }> {
  * Flip one canvas node's switch.
  *
  * The client says WHICH NODE was clicked and nothing else — the server owns what
- * each switch means (`engine.NODE_TOGGLES`). A client that knew "the HikerAPI
+ * each switch means (`engine.NODE_TOGGLES`). A client that knew "the Bright Data
  * node writes config.tier" would be a second copy of that knowledge, free to
- * drift from the engine that reads it.
+ * drift from the engine that reads it — and it would have had to be rewritten
+ * when the vendor changed. It did not.
  */
 export function toggleNode(
   id: string,
@@ -220,6 +272,14 @@ export function runRows(id: string): Promise<RunRows> {
   return send(`/automations/${encodeURIComponent(id)}/rows`);
 }
 
+/** What would a search of this size cost? Asked BEFORE the run, never after. */
+export function discoverEstimate(recordsLimit: number): Promise<DiscoverEstimate> {
+  return send("/automations/discover/estimate", {
+    method: "POST",
+    body: JSON.stringify({ recordsLimit }),
+  });
+}
+
 export function previewSource(
   url: string,
   extract: string,
@@ -278,7 +338,20 @@ export const COUNT_LABELS: [string, string][] = [
   ["partial", "Profile only"],
   ["blocked", "Blocked"],
   ["error", "Errors"],
-  ["paid", "Exact via HikerAPI"],
+  ["paid", "Exact via Bright Data"],
   ["posts", "Posts"],
   ["new_posts", "New posts"],
+  // The engagement series only grows while the per-post rung is on, so its
+  // count is its own chip — "12 posts" and "0 engagement snapshots" together
+  // are the honest picture of a profile-only run.
+  ["metrics", "Engagement snapshots"],
+  // Discovery.
+  ["asked", "Asked for"],
+  ["found", "Profiles found"],
+  ["new", "New to us"],
+  ["seen_again", "Seen before"],
+  ["dropped", "Returned but unusable (no handle)"],
+  // ⚠ Its own chip for the same reason `capped` has one: a database that could
+  // not be CREATED is a system fact, and the run that hit it wrote nothing.
+  ["missing_tables", "Databases that could not be created"],
 ];

web/src/customer-grid/CustomerGrid.tsx

@@ -14,6 +14,7 @@ import type {
   EditableGridCell,
   GridKeyEventArgs,
   GridMouseEventArgs,
+  GridSelection,
   DrawHeaderCallback,
   HeaderClickedEventArgs,
   Item,
@@ -38,7 +39,11 @@ import ColumnMenu from "./ColumnMenu";
 import type { ColumnMenuState } from "./ColumnMenu";
 import { HEADER_ICONS } from "./iconShapes";
 import { emitHostEvent, eventId } from "./hostBridge";
-import { NAV_MINIMIZE_EVENT, TOAST_EVENT, signal } from "../apiContract";
+import { NAV_MINIMIZE_EVENT, ROWS_STALE_EVENT, TOAST_EVENT, signal } from "../apiContract";
+import { addTableRow, deleteTableRow } from "./apiBridge";
+// Owner item 16 / R4 / C-UNDO — the stack and every inverse. Pure, so a node gate can run it.
+import { describe, directed, popRedo, popUndo, pushUndo, stackFor } from "./undoStack";
+import type { CellChange, UndoBook, UndoEntry, UndoValue } from "./undoStack";
 import { exportFilename, runExport, triggerDownload } from "./export";
 import type { ExportFormat } from "./export";
 // owner item 3 (2026-08-03) — a time-series view exports its SHEET, not the rows under it.
@@ -48,7 +53,8 @@ import { echoReemit, reconcileEchoView } from "./viewEcho";
 import { pruneStamps, reconcileFields } from "./optimism";
 import { newFolderId, pruneFolderStamps, reconcileFolders, resolveFolderId } from "./folders";
 import type { FolderStamps } from "./folders";
-import { adoptNewFields, adoptNewViews, pruneTombstones, stampTombstone } from "./liveWorkspace";
+import { adoptNewFields, adoptNewViews, pruneTombstones, seedLocalViews, stampTombstone }
+  from "./liveWorkspace";
 import type { Tombstones } from "./liveWorkspace";
 import type { GridFolder, ViewPermissions } from "./types";
 import type { FieldStamps } from "./optimism";
@@ -87,7 +93,7 @@ import { MAX_CALENDAR_METRICS,
   MAX_FROZEN, choiceOptions, clampFrozenCount, cleanDisplay, formulaOf, topicForScope,
   isDateFamilyType, isFilterGroup, isGroupableField, isNumericFieldType, isPickType, mayEditField,
   isModeFrozen, isUndeletableView, mayEditView, mayToggleViewLock,
-  ratingMax,
+  measureColumnIndex, ratingMax, ruleColumnKeys,
   tableMode, uniqueDisplayName } from "./types";
 import type {
   DisplayMode,
@@ -259,6 +265,11 @@ interface LocalWorkspace {
    *  after mount (liveWorkspace.ts). Persisted, not a ref, because a remount inside the
    *  echo window would otherwise re-adopt a view the user deleted a second ago. */
   viewTombstones?: Tombstones;
+  /** D-19 (wave 20) — viewId → when THIS browser last WROTE it. The counterpart of the
+   *  tombstones above: they stop a deleted view coming back, this stops a just-created one
+   *  being dropped by the host-list rule at init, before its upsert has round-tripped.
+   *  Same window, same prune, same browser-clock caveat. */
+  viewWrites?: Tombstones;
 }
 
 function sameConfig(a: ViewConfig, b: ViewConfig): boolean {
@@ -329,26 +340,41 @@ function splitMulti(v: string): string[] {
     .filter((s) => s !== "");
 }
 
-/** Wave-5 item 3 — does any leaf of the filter tree name this column? Measure leaves carry
- *  measure keys, which are never field keys, so they cannot false-positive here. */
-function treeNamesField(nodes: FilterNode[], key: string): boolean {
+/** Wave-5 item 3 — does any leaf of the filter tree name this column?
+ *
+ *  ⚠ Wave-20 item 2 RETARGETED the note that stood here ("measure leaves carry measure keys,
+ *  which are never field keys, so they cannot false-positive"). True about false POSITIVES,
+ *  and precisely why it was a false NEGATIVE: a measure column's own condition names the
+ *  MEASURE, so this answered "not filtered" for a column the user had visibly filtered, and
+ *  the menu never offered "Don't filter by this field" on it. Both doors now go through
+ *  `ruleColumnKeys` — the same resolution the tint uses, so the menu and the colour can never
+ *  disagree about which columns a filter is about. */
+function treeNamesField(
+  nodes: FilterNode[],
+  key: string,
+  measureCols: Map<string, string[]>
+): boolean {
   for (const n of nodes) {
     if (isFilterGroup(n)) {
-      if (treeNamesField(n.children, key)) return true;
-    } else if ((n as FilterRule).colId === key) return true;
+      if (treeNamesField(n.children, key, measureCols)) return true;
+    } else if (ruleColumnKeys(n as FilterRule, measureCols).includes(key)) return true;
   }
   return false;
 }
 
 /** Wave-5 item 3 — "Don't filter by this field": drop every leaf naming the column, prune
  *  groups that end up empty. Returns new arrays throughout (the config is state). */
-function dropFieldFromTree(nodes: FilterNode[], key: string): FilterNode[] {
+function dropFieldFromTree(
+  nodes: FilterNode[],
+  key: string,
+  measureCols: Map<string, string[]>
+): FilterNode[] {
   const out: FilterNode[] = [];
   for (const n of nodes) {
     if (isFilterGroup(n)) {
-      const children = dropFieldFromTree(n.children, key);
+      const children = dropFieldFromTree(n.children, key, measureCols);
       if (children.length) out.push({ ...n, children });
-    } else if ((n as FilterRule).colId !== key) {
+    } else if (!ruleColumnKeys(n as FilterRule, measureCols).includes(key)) {
       out.push(n);
     }
   }
@@ -376,6 +402,10 @@ interface FieldBuildExtra {
   label?: string;
   colorCodeOptions?: boolean;
   optionColors?: Record<string, string>;
+  /** Item 15 (C-RENAME) — the option renames this save carries, by row identity. Consumed by
+   *  `retypeField` (which emits `choice_rename`) and ignored by every create path: a field
+   *  being CREATED has no values to migrate. */
+  renames?: { from: string; to: string }[];
 }
 
 /**
@@ -498,6 +528,12 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
   const [selAddOpen, setSelAddOpen] = useState(false);
   const [selListName, setSelListName] = useState("");
   const selAddRef = useRef<HTMLButtonElement>(null);
+  /** Owner item 9 (wave 20) — its counterpart: "Remove from cohort…", in ORDINARY views. */
+  const [selRemoveOpen, setSelRemoveOpen] = useState(false);
+  const selRemoveRef = useRef<HTMLButtonElement>(null);
+  /** Owner item 4 / C-ADDROW — the pid the trailing "+" just created, so the cursor can land on
+   *  it once the re-read actually brings it back (the row does not exist locally before that). */
+  const [newRowPid, setNewRowPid] = useState<number | null>(null);
   /** Wave-2 item 2c — cohort mode: the active cohort and the "+ Add customers" picker. Picks
    *  ACCUMULATE across searches (search, tick, search again, confirm once). */
   const [activeCohortId, setActiveCohortId] = useState<string | null>(null);
@@ -540,6 +576,8 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
    *  init, so the mount path and the after-mount path answer "was this deleted here?" the
    *  same way. Persisted with the local workspace for the same reason `reemitted` is. */
   const viewTombstonesRef = useRef<Tombstones>({});
+  /** D-19 — viewId → when this browser last wrote it (see LocalWorkspace.viewWrites). */
+  const viewWritesRef = useRef<Tombstones>({});
   const initializedKey = useRef<string | null>(null);
   const saveTimer = useRef<number | null>(null);
   const gridRef = useRef<DataEditorRef>(null);
@@ -591,7 +629,13 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
     const hostViews = payload.workspace?.views ?? [];
     const byId = new Map<string, SavedView>();
     byId.set(ALL_VIEW_ID, allCustomersView(initialFields));
-    for (const view of local?.views ?? []) byId.set(view.id, view);
+    // D-19 — the HOST'S LIST DECIDES WHICH VIEWS EXIST. A local copy the host no longer
+    // names is a ghost (deleted elsewhere, share revoked, store moved) and is dropped here,
+    // guarded by this browser's own recent writes so an optimistic create survives.
+    viewWritesRef.current = pruneTombstones(local?.viewWrites, Date.now());
+    for (const view of seedLocalViews(local?.views ?? [], hostViews, viewWritesRef.current,
+                                      Date.now(), payload.workspace != null))
+      byId.set(view.id, view);
     // Host state wins — EXCEPT when it is a lagged echo of this browser's own
     // in-flight edit, where taking it would turn a just-completed measure rule
     // valueless: inactive, no pending marker, whole-book count. A rerun replaces
@@ -664,7 +708,10 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
       for (const view of initialViews) {
         const key = reemit.get(view.id);
         if (key === undefined) continue;
-        emitHostEvent({ id: eventId("view"), type: "view_upsert", view });
+        viewWritesRef.current = stampTombstone(viewWritesRef.current, view.id,
+                                               Date.now());
+        viewWritesRef.current = stampTombstone(viewWritesRef.current, view.id, Date.now());
+    emitHostEvent({ id: eventId("view"), type: "view_upsert", view });
         stamped[view.id] = key;
       }
       reemittedRef.current = stamped;
@@ -687,6 +734,9 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
       // Pruned on the way out, like every other stamp map here: the persisted blob is a
       // recent window, never an archive of everything this tab ever deleted.
       viewTombstones: pruneTombstones(viewTombstonesRef.current, Date.now()),
+      // D-19's other half — without persisting these, a reload inside the echo window would
+      // drop a view this browser created seconds ago.
+      viewWrites: pruneTombstones(viewWritesRef.current, Date.now()),
     });
   }, [workspaceReady, storageKey, fields, views, activeViewId]);
 
@@ -765,6 +815,50 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
     insertColumn,
   } = useGridColumns(fields, config, updateConfig);
 
+  /**
+   * ⭐ Wave-20 owner item 4 (ruling R8, contract C-ADDROW) — **THE GHOST ROW.**
+   *
+   * A trailing "+" row at the bottom of the grid, the way Airtable grows a table, replacing the
+   * "Add record" button that used to sit in the shell's header bar (S4 deleted it this wave).
+   *
+   * ⛔ USER DATABASES ONLY. A connector's rows are read-synced from Odoo; a "+" there could only
+   * refuse, and R8 names that a fake affordance. The test is the SCOPE (`ut_*`), which is also
+   * the only scope with a rows endpoint to POST to — so the affordance and the capability come
+   * from the same fact rather than from two lists that can drift.
+   *
+   * ⚠ THE ROW IS NOT ADDED LOCALLY. `rawRows` is the server's answer, and a client-invented row
+   * would have no rid, no defaults and no place in anyone else's copy. The POST clears the rows
+   * cache and fires `ROWS_STALE_EVENT`, `useCustomerData` re-reads, and the row arrives with the
+   * id the store gave it. The cursor then follows it (`newRowPid` + the effect below) — which is
+   * why the pid is remembered instead of glide's `"bottom"` being returned here: at the moment
+   * this resolves, the appended row does not exist yet, so "bottom" would land on the last OLD
+   * row.
+   */
+  const isUserTable = scope.startsWith("ut_");
+  const appendRow = useCallback(async (): Promise<undefined> => {
+    if (!isUserTable) return undefined;
+    const made = await addTableRow(scope);
+    // `undefined` either way, never glide's "bottom": glide would move the selection to the
+    // last row it currently knows about, which is the row BEFORE the one just created. The
+    // effect below lands the cursor when the re-read brings the real one in.
+    if (!made) return undefined;            // addTableRow already said why, in the server's words
+    setNewRowPid(made.pid);
+    // R4 — the append is undoable: Ctrl+Z deletes the row it just created, and a redo restores
+    // it under the SAME rid (the server's `{rid}` passthrough, C-ADDROW). An empty new record
+    // carries no values, so the entry is the id and nothing else.
+    undoBook.current[scope] = pushUndo(stackFor(undoBook.current, scope), {
+      kind: "rowAdd", table: scope, rid: made.rid, values: {},
+    });
+    signal(ROWS_STALE_EVENT);
+    return undefined;
+  }, [isUserTable, scope]);
+
+  /* wave20 item 2 — measure key + window -> the columns that display it. Built ONCE per field
+     list and handed to every consumer of "which column is this rule about", so the tint
+     (`columnTones`, inside the hook above) and the column menu's filter doors resolve a
+     measure condition the same way. See `types.ruleColumnKeys`. */
+  const measureCols = useMemo(() => measureColumnIndex(fields), [fields]);
+
   // Airtable behavior: configuration changes to the active view autosave.
   useEffect(() => {
     if (!workspaceReady) return;
@@ -780,6 +874,8 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
       setViews((current) =>
         current.map((view) => (view.id === updated.id ? updated : view))
       );
+      viewWritesRef.current = stampTombstone(viewWritesRef.current, updated.id,
+                                             Date.now());
       emitHostEvent({ id: eventId("view"), type: "view_upsert", view: updated });
       setSaveState("saved");
       saveTimer.current = null;
@@ -1122,6 +1218,223 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
       displayPidToIndex,
       visibleCols.length
     );
+  /* ════════════════════════ owner item 16 / R4 / C-UNDO ════════════════════════
+     THE RECORDING LAYER. `undoStack.ts` owns the stack and every inverse; this owns the one
+     thing it cannot: reading the value a cell held BEFORE the write, which only exists at the
+     call site. Everything below funnels through `patchAndRecord` / `patchManyAndRecord`, so a
+     write path that forgets to record is a write path that does not reach the store either.
+
+     ⚠ A REF, NOT STATE. Nothing on screen depends on the stack in v1 (no undo button), so
+     keeping it in state would repaint the grid on every keystroke of a paste for no pixels.
+     Per SCOPE (a Ctrl+Z on the Customer grid must never rewrite a user table's cell) and per
+     tab (nothing persists it — a stack restored into a session that did not make those edits
+     would undo somebody else's work). */
+  const undoBook = useRef<UndoBook>({});
+  const applyingUndo = useRef(false);
+
+  /** The value a cell holds RIGHT NOW: the overlay stratum wins over the payload row, exactly
+   *  as `useGetCellContent` renders it — so what undo restores is what was on screen. */
+  const rowByPid = useMemo(() => {
+    const map = new Map<number, Row>();
+    for (const r of rawRows) map.set(r.pid, r);
+    return map;
+  }, [rawRows]);
+  const currentValue = useCallback(
+    (pid: number, key: string): UndoValue => {
+      const edited = overlayEdits[pid]?.[key];
+      const raw = edited !== undefined ? edited : rowByPid.get(pid)?.[key];
+      return raw == null ? null : (raw as UndoValue);
+    },
+    [overlayEdits, rowByPid]
+  );
+
+  const recordCells = useCallback(
+    (changes: CellChange[], label: string) => {
+      if (applyingUndo.current || changes.length === 0) return;
+      undoBook.current[scope] = pushUndo(stackFor(undoBook.current, scope), {
+        kind: "cells", label, changes,
+      });
+    },
+    [scope]
+  );
+
+  /** ONE cell write, recorded. Every editor, picker and drag goes through this. */
+  const patchAndRecord = useCallback(
+    (pid: number, updates: Partial<Row>, label = "an edit") => {
+      const changes: CellChange[] = Object.entries(updates).map(([key, value]) => ({
+        pid, key,
+        before: currentValue(pid, key),
+        after: (value ?? null) as UndoValue,
+      }));
+      patchOverlay(pid, updates);
+      recordCells(changes, label);
+    },
+    [currentValue, patchOverlay, recordCells]
+  );
+
+  /** MANY cells, ONE stack entry — a paste and a bulk clear are each one user action (R4). */
+  const patchManyAndRecord = useCallback(
+    (writes: { pid: number; updates: Partial<Row> }[], label: string) => {
+      const changes: CellChange[] = [];
+      for (const w of writes)
+        for (const [key, value] of Object.entries(w.updates))
+          changes.push({
+            pid: w.pid, key,
+            before: currentValue(w.pid, key),
+            after: (value ?? null) as UndoValue,
+          });
+      for (const w of writes) patchOverlay(w.pid, w.updates);
+      recordCells(changes, label);
+    },
+    [currentValue, patchOverlay, recordCells]
+  );
+
+  /**
+   * Apply one stack entry in one direction. The INVERSE lives in `undoStack.directed` — this
+   * only knows how to WRITE each op, and it writes through the same doors the user does
+   * (`patchOverlay`, the rows endpoint), so an undone edit is persisted exactly like the edit
+   * was. Nothing here is optimistic-only: a Ctrl+Z that reverted the screen and not the store
+   * would come back on the next reload.
+   */
+  const applyEntry = useCallback(
+    async (entry: UndoEntry, dir: "back" | "forward") => {
+      const op = directed(entry, dir);
+      if (op.kind === "cells") {
+        const byPid = new Map<number, Partial<Row>>();
+        for (const c of op.changes) {
+          const at = byPid.get(c.pid) ?? {};
+          at[c.key] = (c.after ?? "") as Row[string];
+          byPid.set(c.pid, at);
+        }
+        applyingUndo.current = true;
+        try {
+          for (const [pid, updates] of byPid) patchOverlay(pid, updates);
+        } finally {
+          applyingUndo.current = false;
+        }
+      } else if (op.kind === "rowAdd") {
+        // Restore under the OLD id where the store still has it free; the server answers with
+        // what it actually wrote and the re-read is what puts the row back on screen.
+        const made = await addTableRow(op.table, op.values as Record<string, unknown>, op.rid);
+        if (!made) return;                       // the server already said why
+        signal(ROWS_STALE_EVENT);
+      } else if (op.kind === "rowDelete") {
+        const ok = await deleteTableRow(op.table, op.rid);
+        if (!ok) return;
+        signal(ROWS_STALE_EVENT);
+      } else if (op.kind === "choiceRename") {
+        // Item 15 — the inverse mapping. The host rewrites the values and the saved views that
+        // name them, exactly as it did on the way out; `directed` already turned the pairs
+        // around, so this emits what it is given.
+        emitHostEvent({
+          id: eventId("choicerename"),
+          type: "choice_rename",
+          key: op.fieldKey,
+          renames: op.renames,
+        });
+      }
+      signal(TOAST_EVENT, describe(entry, dir));
+    },
+    [patchOverlay]
+  );
+
+  /**
+   * Ctrl+Z / Ctrl+Shift+Z (and Ctrl+Y, which is the same request on Windows).
+   *
+   * ⚠ ON `window`, IN CAPTURE, and it steps aside for real text fields. The grid is a canvas —
+   * glide's key handling only fires while the canvas has focus, so a Ctrl+Z after clicking the
+   * toolbar would do nothing, which is exactly the "sometimes it works" the owner would report
+   * next. But an <input> with a cursor in it has its OWN undo that belongs to the browser, and
+   * stealing that would be worse than not having ours: the search box, the rename field and
+   * glide's own cell editor are all inputs, so `activeElement` decides.
+   *
+   * Nothing to undo says so out loud rather than silently ignoring the key — an undo that
+   * appears to do nothing is indistinguishable from one that is broken.
+   */
+  useEffect(() => {
+    const onKey = (event: KeyboardEvent) => {
+      if (!(event.ctrlKey || event.metaKey) || event.altKey) return;
+      const key = event.key.toLowerCase();
+      if (key !== "z" && key !== "y") return;
+      const el = document.activeElement as HTMLElement | null;
+      if (el && (el.tagName === "INPUT" || el.tagName === "TEXTAREA" || el.isContentEditable))
+        return;
+      const forward = key === "y" || event.shiftKey;
+      event.preventDefault();
+      const book = undoBook.current;
+      const state = stackFor(book, scope);
+      const { state: next, entry } = forward ? popRedo(state) : popUndo(state);
+      if (!entry) {
+        signal(TOAST_EVENT, forward ? "Nothing to redo." : "Nothing to undo.");
+        return;
+      }
+      book[scope] = next;
+      void applyEntry(entry, forward ? "forward" : "back");
+    };
+    window.addEventListener("keydown", onKey, true);
+    return () => window.removeEventListener("keydown", onKey, true);
+  }, [scope, applyEntry]);
+
+  /**
+   * R4 — **BULK BACKSPACE/DELETE IS ONE ACTION.** glide's own delete walks the selection and
+   * calls `onCellEdited` per cell, which would put forty entries on the stack for one keypress;
+   * returning `false` takes the whole operation over so it lands as one.
+   *
+   * ⚠ PRESETS ARE NEVER ATTEMPTED (the contract says so, and it is also the only honest
+   * behaviour): `canEditField` is the same verdict the editor and the paste path use, so a
+   * selection spanning read-only columns clears the editable ones and leaves the rest exactly
+   * as they were — rather than firing writes the server will refuse one by one.
+   */
+  const onGridDelete = useCallback(
+    (sel: GridSelection): boolean => {
+      const byPid = new Map<number, Partial<Row>>();
+      const clear = (rowIndex: number, colIndex: number) => {
+        const vr = displayRows[rowIndex];
+        if (!vr || vr.kind !== "data") return;
+        const column = visibleCols[colIndex];
+        const field = column ? fieldByKey.get(column.id!) : undefined;
+        if (!field || !canEditField(field)) return;
+        const at = byPid.get(vr.record.pid) ?? {};
+        at[field.key] = "";
+        byPid.set(vr.record.pid, at);
+      };
+      for (const rowIndex of sel.rows)
+        for (let c = 0; c < visibleCols.length; c++) clear(rowIndex, c);
+      const range = sel.current?.range;
+      if (range)
+        for (let y = range.y; y < range.y + range.height; y++)
+          for (let x = range.x; x < range.x + range.width; x++) clear(y, x);
+      const writes = [...byPid.entries()].map(([pid, updates]) => ({ pid, updates }));
+      if (!writes.length) return true;
+      patchManyAndRecord(writes, "clearing cells");
+      // ⚠ `false` ONLY WHEN THIS ACTUALLY DID THE WORK. Returning it unconditionally cancels
+      // glide's own delete for cases this handler does not cover — a COLUMN selection, which
+      // glide deletes from `toDelete.columns` and the loops above never look at — so Delete
+      // would silently clear nothing. Handing the keypress back when there is nothing to
+      // group is strictly safer than swallowing it: the per-cell path still refuses read-only
+      // fields (`onCellEdited`'s own `canEditField`), it just does not arrive as one entry.
+      return false;
+    },
+    [displayRows, visibleCols, fieldByKey, canEditField, patchManyAndRecord]
+  );
+
+  /**
+   * Owner item 4 / C-ADDROW — the cursor FOLLOWS the appended row, once it exists.
+   *
+   * The append is a server round trip, so at click time there is nothing to focus; this waits
+   * for the re-read to bring the pid back and then lands the active cell on its first column,
+   * scrolled into view. `newRowPid` is cleared either way — a row the re-read never produced
+   * (a refused write, a filter that excludes it) must not leave a cursor waiting forever.
+   */
+  useEffect(() => {
+    if (newRowPid === null) return;
+    const index = displayPidToIndex.get(newRowPid);
+    if (index === undefined) return;
+    setActiveCell(0, index);
+    gridRef.current?.scrollTo(0, index, "vertical", 0, 0, { vAlign: "center" });
+    setNewRowPid(null);
+  }, [newRowPid, displayPidToIndex, setActiveCell]);
+
   /** Owner item 23 — the fields in the view's column order, for the Hide-fields panel. Built
    *  from `order` (already reconciled by useGridColumns) rather than from `config.order` so the
    *  panel and the grid can never disagree about which fields exist or where they sit. */
@@ -1334,6 +1647,15 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
     let rowsPx = HEADER_PX;
     if (typeof rowHeight === "number") rowsPx += displayRows.length * rowHeight;
     else for (let i = 0; i < displayRows.length; i++) rowsPx += rowHeight(i);
+    // ⚠ Owner item 4 — THE GHOST ROW IS PART OF THE TABLE, and this line is what makes it
+    // visible. glide draws its trailing row AFTER the last data row, but `displayRows` (our
+    // rows) does not contain it, so the void started exactly where the ghost row does and
+    // painted flat #F6F8FC straight over it. The "+" was still clickable the whole time
+    // (`.cg-grid-void` is `pointer-events: none`), which is the worst version of this bug:
+    // the gate went green on an affordance nobody could see. Found by READING THE SCREENSHOT
+    // ([[ui-invisible-to-assertions]], [[finalize-visual-review-sop]]).
+    if (isUserTable)
+      rowsPx += typeof rowHeight === "number" ? rowHeight : rowHeight(displayRows.length);
 
     /* Fit is tested against the client box the OTHER axis's scrollbar leaves behind — the same
        `clientWidth`/`clientHeight` glide's own scroll handler reads (infinite-scroller.js:
@@ -1355,7 +1677,7 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
       below: rowsPx < clientH ? rowsPx : null,
       right: colsPx < clientW ? colsPx : null,
     };
-  }, [visibleCols, displayRows, rowHeight, gridSize]);
+  }, [visibleCols, displayRows, rowHeight, gridSize, isUserTable]);
   /* ═══ end W18-B VOID (geometry) ═══ */
 
   // The record drawer resolves positions against what the MODE paints: the display slice for
@@ -1619,18 +1941,18 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
       // Wave-5 item 11 — a checkbox toggles straight through glide's BooleanCell (no overlay
       // editor); the overlay store keeps its '1'-or-empty contract.
       if (value.kind === GridCellKind.Boolean && field.type === "checkbox") {
-        patchOverlay(row.record.pid, { [field.key]: value.data ? "1" : "" });
+        patchAndRecord(row.record.pid, { [field.key]: value.data ? "1" : "" }, "a tick");
         return;
       }
       if (value.kind === GridCellKind.Uri) {
-        patchOverlay(row.record.pid, { [field.key]: value.data ?? "" });
+        patchAndRecord(row.record.pid, { [field.key]: value.data ?? "" }, "an edit");
         return;
       }
       if (value.kind === GridCellKind.Text || value.kind === GridCellKind.Number) {
-        patchOverlay(row.record.pid, { [field.key]: value.data });
+        patchAndRecord(row.record.pid, { [field.key]: value.data }, "an edit");
       }
     },
-    [displayRows, visibleCols, fieldByKey, patchOverlay, canEditField]
+    [displayRows, visibleCols, fieldByKey, patchAndRecord, canEditField]
   );
   const validateCell = useCallback(
     (cell: Item): boolean => {
@@ -1676,13 +1998,17 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
         allowedChoices: statusValues[field.key] ?? choiceOptions(field),
       });
       if (!patches) return false;
-      for (const patch of patches)
-        patchOverlay(patch.pid, { [field.key]: patch.value });
+      // R4 — ONE stack entry for the whole paste. Cell by cell would put forty entries on the
+      // stack for one Ctrl+V, and undoing a paste one cell at a time is not undoing a paste.
+      patchManyAndRecord(
+        patches.map((patch) => ({ pid: patch.pid, updates: { [field.key]: patch.value } })),
+        "a paste"
+      );
       // We handled the write ourselves. Returning false tells glide not to run its cell
       // renderers' generic paste path (Bubble/rating renderers cannot enforce this contract).
       return false;
     },
-    [visibleCols, fieldByKey, canEditField, statusValues, displayRows, patchOverlay,
+    [visibleCols, fieldByKey, canEditField, statusValues, displayRows, patchManyAndRecord,
      gridSelection.current]
   );
 
@@ -2623,8 +2949,23 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
         ...(type === "rating" ? { max: extra?.max ?? 5 } : {}),
       };
       saveField(next);
+      /* ⭐ Owner item 15 / C-RENAME — the VALUES follow the definition.
+         BESIDE the upsert, never instead of it, and AFTER it: the def is written optimistically
+         here, while the rename is a host-side migration over overlay values and saved views. The
+         order matters if the host processes the batch in order — the list must already offer
+         "Navy" before any cell is moved onto it. */
+      const renames = extra?.renames?.filter((r) => r.from && r.to && r.from !== r.to) ?? [];
+      if (renames.length) {
+        emitHostEvent({ id: eventId("choicerename"), type: "choice_rename", key, renames });
+        // R4 — and it is undoable: Ctrl+Z emits the mapping turned around. The declared LIST is
+        // restored by the same inverse (the host rewrites values and views back), so undo does
+        // not need to re-send the definition.
+        undoBook.current[scope] = pushUndo(stackFor(undoBook.current, scope), {
+          kind: "choiceRename", fieldKey: key, renames,
+        });
+      }
     },
-    [fieldByKey, saveField]
+    [fieldByKey, saveField, scope]
   );
 
   /**
@@ -2713,6 +3054,61 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
   }, [activeCohortId, selectedPids, cohortMemberSet, clearSelection]);
 
 
+  /**
+   * ⭐ Wave-20 owner item 9 — **REMOVE FROM A COHORT WITHOUT BEING INSIDE IT.**
+   *
+   * "Remove from cohort" existed only under `cohortMode` (you had to open the locked view
+   * first), while "Add to cohort" worked from any view. So the two halves of the same idea
+   * lived on different screens: you could put a customer in a cohort from wherever you found
+   * them, and then had to go looking for the cohort to take them out again.
+   *
+   * SAME EVENT, same host validation as the cohort-mode button — `cohort_remove` with the pids
+   * intersected client-side as a courtesy. What is new is only WHICH cohort: the picker names
+   * it, instead of it being implied by the page you are standing on.
+   */
+  const removeSelectionFromList = useCallback(
+    (cohortId: string) => {
+      const members = cohortSets[cohortId];
+      if (!members) return;
+      const pids = [...selectedPids].filter((p) => members.has(p));
+      if (!pids.length) return;
+      emitHostEvent({ id: eventId("cohortrm"), type: "cohort_remove", cohortId, pids });
+      setSelRemoveOpen(false);
+      clearSelection();
+    },
+    [cohortSets, selectedPids, clearSelection]
+  );
+
+  /**
+   * The cohorts the checked rows can actually be removed FROM: those holding at least one of
+   * them, and only where this viewer may edit the projected view.
+   *
+   * ⚠ A cohort holding NONE of the checked rows is not offered. Airtable's rule and the one R8
+   * states for the ghost row: an affordance that can only refuse is a fake affordance — and
+   * here it would be worse than that, because "Remove from Q3 plan" that removes nothing looks
+   * exactly like a write that failed.
+   *
+   * The edit test is the COURTESY half (`mayEditView`, like every other client-side permission
+   * check on this surface); the host re-validates ownership and pool on the event regardless.
+   * A cohort with no projected view is still offered — the host owns that verdict, and hiding
+   * it here would silently drop sets the reader can see in their own rail.
+   */
+  const removableLists = useMemo(() => {
+    if (cohortMode || selectedPids.size === 0) return [];
+    const out: { id: string; name: string; hits: number }[] = [];
+    for (const l of lists) {
+      const members = cohortSets[l.id];
+      if (!members) continue;
+      let hits = 0;
+      for (const pid of selectedPids) if (members.has(pid)) hits += 1;
+      if (!hits) continue;
+      const projected = views.find((v) => v.id === l.id);
+      if (projected && !mayEditView(projected, viewer)) continue;
+      out.push({ id: l.id, name: l.name, hits });
+    }
+    return out;
+  }, [cohortMode, selectedPids, lists, cohortSets, views, viewer]);
+
   /** Cohort mode — confirm the "+ Add customers" picker (contract event `cohort_add`). */
   const addCustomersToCohort = useCallback(() => {
     if (!activeCohortId || addCustPicked.size === 0) return;
@@ -2981,9 +3377,9 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
   const onKanbanMove = useCallback(
     (pid: number, value: string) => {
       if (!kanbanField) return;
-      patchOverlay(pid, { [kanbanField.key]: value });
+      patchAndRecord(pid, { [kanbanField.key]: value }, "a card move");
     },
-    [kanbanField, patchOverlay]
+    [kanbanField, patchAndRecord]
   );
   const onListToggleGroup = useCallback((groupKey: string) => {
     setCollapsed((current) => {
@@ -3101,7 +3497,7 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
     ? config.sorts.find((s) => s.colId === menuField.key)?.dir ?? null
     : null;
   const menuIsFiltered = menuField
-    ? treeNamesField(config.filters, menuField.key)
+    ? treeNamesField(config.filters, menuField.key, measureCols)
     : false;
   // Item 11c — is the menu's field the current frozen boundary (its Pin would be a no-op)?
   const menuVisIndex = menuField ? visibleKeys.indexOf(menuField.key) : -1;
@@ -3414,6 +3810,9 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
               onCellActivated={onCellActivated}
               onCellEdited={onCellEdited}
               onPaste={onGridPaste}
+              // R4 — Backspace/Delete over a selection is ONE undoable action. Returning
+              // `false` from here takes the write over from glide's per-cell path.
+              onDelete={onGridDelete}
               validateCell={validateCell}
               onColumnResize={onColumnResize}
               onColumnMoved={onColumnMoved}
@@ -3433,9 +3832,23 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
               customRenderers={[ratingCellRenderer, userCellRenderer, imageCellRenderer]}
               headerIcons={HEADER_ICONS}
               rightElement={
-                // Wave-6 item 4 — the far-right "+" of the header row: the create-field
-                // form, insert-at-end. Sticky so it stays visible however far the columns
-                // scroll.
+                // Wave-6 item 4 — the "+" of the header row: the create-field form,
+                // insert-at-end.
+                //
+                // ⚠ Wave-20 owner item 5 UNPINNED it. It used to be `sticky: true` ("so it
+                // stays visible however far the columns scroll"), which parked it against the
+                // right edge of the WINDOW — on a four-column table that is half a screen of
+                // white between the last field and the control that adds the next one, and it
+                // reads as page chrome rather than as part of the table. It now sits
+                // immediately after the last column, where Airtable puts it.
+                //
+                // TWO changes are needed and neither works alone: `sticky:false` stops glide
+                // pinning the wrapper (`infinite-scroller.js:204` sets `right` only when
+                // sticky), and the CSS region kills `.dvn-spacer`'s `flex-grow: 1`, which
+                // would otherwise expand to fill the scroller and push the button right back
+                // to the edge. Consequence, accepted: on a table wider than the viewport the
+                // "+" is off-screen until you scroll to the end of the columns — which is
+                // where the new column is going to land anyway.
                 <button
                   type="button"
                   className="cg-add-field-btn"
@@ -3456,7 +3869,22 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
                   +
                 </button>
               }
-              rightElementProps={{ sticky: true, fill: false }}
+              rightElementProps={{ sticky: false, fill: false }}
+              // Owner item 4 (R8) — the trailing "+" row, USER DATABASES ONLY. Passing
+              // `onRowAppended` is what makes glide paint the ghost row at all, so the
+              // affordance exists exactly where a POST can succeed. See `appendRow`.
+              onRowAppended={isUserTable ? appendRow : undefined}
+              trailingRowOptions={
+                isUserTable
+                  ? {
+                      // The hint sits in the identity column (targetColumn 0), which is the
+                      // one a new record is named in — the same cell the cursor lands on.
+                      hint: "New record",
+                      sticky: false,
+                      targetColumn: 0,
+                    }
+                  : undefined
+              }
             />
             {/* ═══ W18-B VOID ═══ (wave 18, owner item 1b / ruling R12) — the two rectangles.
 
@@ -3740,6 +4168,24 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
                   Add to cohort
                 </button>
               )}
+              {/* ⭐ Owner item 9 — the counterpart, and it renders ONLY when it can do
+                  something: the checked rows have to be in a cohort this viewer may edit for
+                  "Remove from cohort…" to mean anything. Same bar, same selection, opposite
+                  direction — the ellipsis says a picker follows, because unlike cohort mode
+                  the target is not implied by where you are standing. */}
+              {!cohortMode && removableLists.length > 0 && (
+                <button
+                  type="button"
+                  className="cg-btn cg-selbar-remove-pick"
+                  style={ONE_LINE}
+                  ref={selRemoveRef}
+                  onClick={() => setSelRemoveOpen((open) => !open)}
+                  aria-expanded={selRemoveOpen}
+                  aria-haspopup="dialog"
+                >
+                  Remove from cohort…
+                </button>
+              )}
               <button type="button" className="cg-btn" style={ONE_LINE}
                       onClick={clearSelection}>
                 Clear
@@ -3880,7 +4326,7 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
           onClearFilter={() =>
             updateConfig({
               ...config,
-              filters: dropFieldFromTree(config.filters, menuField.key),
+              filters: dropFieldFromTree(config.filters, menuField.key, measureCols),
             })
           }
           onGroupByField={() => updateConfig({ ...config, groupBy: menuField.key })}
@@ -3982,6 +4428,41 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
         </AnchoredOverlay>
       )}
 
+      {/* ⭐ Owner item 9 — the remove picker. Every row states how many of the CHECKED rows it
+          would take out ("3 of 4"), because the selection and the cohort are two different sets
+          and the difference is the whole reason this needs a picker rather than a button. */}
+      {selRemoveOpen && selRemoveRef.current && removableLists.length > 0 && (
+        <AnchoredOverlay
+          anchor={selRemoveRef.current}
+          className="cg-pop cg-add-list-pop"
+          placement="bottom-start"
+          role="dialog"
+          ariaLabel="Remove selected customers from a locked view"
+          onDismiss={() => setSelRemoveOpen(false)}
+          dataKind="selection-remove-from-list"
+        >
+          <div className="cg-pop-title">Remove from locked view</div>
+          <div className="cg-pop-note">
+            Only the locked views holding one of the {selectedPids.size.toLocaleString()} checked
+            customer{selectedPids.size === 1 ? "" : "s"} are listed. The records themselves are
+            not touched.
+          </div>
+          {removableLists.map((l) => (
+            <button
+              type="button"
+              key={l.id}
+              className="cg-pick-row"
+              onClick={() => removeSelectionFromList(l.id)}
+            >
+              {l.name}
+              <span className="cg-pick-hint">
+                {l.hits.toLocaleString()} of {selectedPids.size.toLocaleString()}
+              </span>
+            </button>
+          ))}
+        </AnchoredOverlay>
+      )}
+
       {/* Cohort mode's "+ Add customers" picker (item 2c): search the POOL, tick many, confirm
           once. Candidates exclude current members; picks ACCUMULATE across searches, so the
           confirm button carries the running total. The 50-row render cap is stated beside the
@@ -4122,7 +4603,7 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
                     }
                     aria-label={`${n} star${n === 1 ? "" : "s"}`}
                     onClick={() => {
-                      patchOverlay(picker.pid, { [pickerField.key]: String(n) });
+                      patchAndRecord(picker.pid, { [pickerField.key]: String(n) }, "a rating");
                       closePicker();
                     }}
                   >
@@ -4160,12 +4641,12 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
                       const next = on
                         ? pickerParts.filter((p) => p !== choice)
                         : [...pickerParts, choice];
-                      patchOverlay(picker.pid, {
+                      patchAndRecord(picker.pid, {
                         [pickerField.key]: next.join(","),
-                      });
+                      }, "a choice");
                       return;
                     }
-                    patchOverlay(picker.pid, { [pickerField.key]: choice });
+                    patchAndRecord(picker.pid, { [pickerField.key]: choice }, "a choice");
                     closePicker();
                   }}
                 >
@@ -4255,7 +4736,7 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
               // (the querySelector takes the FIRST match, so a real choice row wins).
               data-overlay-autofocus={pickerChoices.length === 0 ? true : undefined}
               onClick={() => {
-                patchOverlay(picker.pid, { [pickerField.key]: "" });
+                patchAndRecord(picker.pid, { [pickerField.key]: "" }, "a choice");
                 closePicker();
               }}
             >
@@ -4329,7 +4810,7 @@ function CustomerGrid({ scope = "customer" }: { scope?: SurfaceScope } = {}) {
               [detailPid]: { ...current[detailPid], [key]: value },
             }))
           }
-          onNotesCommit={(key, value) => patchOverlay(detailPid, { [key]: value })}
+          onNotesCommit={(key, value) => patchAndRecord(detailPid, { [key]: value })}
           viewer={viewer}
           // Wave-14 close-out stitch (HOST): TSREC's two light-switch props, unwired when
           // the GRID session ended — item 9's picker vocabulary + item 11's photos. Same

web/src/customer-grid/ViewSidebar.tsx

@@ -37,7 +37,14 @@ import {
   MODE_TONE,
 } from "./iconShapes";
 import { FolderMark, LockMark, MenuLabel, ModeIcon, ToneModeIcon } from "./icons";
-import { groupByFolder } from "./folders";
+import { groupByFolder, reorderFolderIds } from "./folders";
+
+/**
+ * WAVE 20 item 18 (C-SHARE) — the system folder every view shared WITH you lands in
+ * until you file it somewhere of your own. The id is the CONTRACT's, not this file's
+ * invention, and it is the only folder id this component ever recognises by name.
+ */
+const SHARED_FOLDER_ID = "__shared__";
 
 interface ViewSidebarProps {
   views: SavedView[];
@@ -99,6 +106,16 @@ interface ViewSidebarProps {
   onFolderDelete?: (folderId: string) => void;
   onFolderDuplicate?: (folderId: string) => void;
   onItemMove?: (viewId: string, folderId: string | null) => void;
+  /**
+   * WAVE 20 item 19 (C-FOLDER-REORDER) — the folders, in the order the user just dragged
+   * them into. The FULL list every time, never a delta: a partial order cannot say where an
+   * unnamed folder went, and the host has to be able to stamp `order` on all of them.
+   *
+   * Optional like every other folder handler here: a caller that does not pass it gets a
+   * rail with no folder drag at all, rather than a grip that lifts a folder and drops it
+   * back — the posture this whole component takes toward an action nobody can honour.
+   */
+  onFolderReorder?: (order: string[]) => void;
   /**
    * C4 as AMENDED 2026-07-28 — the folder-level bulk "Add to cohort". The caller
    * owns the arithmetic (it holds the engine); the rail owns the confirm.
@@ -151,6 +168,7 @@ export default function ViewSidebar({
   onFolderDelete,
   onFolderDuplicate,
   onItemMove,
+  onFolderReorder,
   folderAddPreview,
   onFolderAddToList,
   viewer,
@@ -257,6 +275,32 @@ export default function ViewSidebar({
   const shownViews = viewNeedle
     ? views.filter((v) => (v.name || "").toLowerCase().includes(viewNeedle))
     : views;
+  // ── WAVE 20 item 19 (C-FOLDER-REORDER) — dragging a FOLDER to reorder the rail ──────
+  //
+  // ⚠ A PRIVATE dataTransfer MIME, and it is not decoration. The VIEW drag two blocks down
+  // carries `text/plain`, and the folder groups already accept that drop ("file this view
+  // into me"). Sharing one channel would make every folder drag look like a view drop to
+  // the handler that fires first — so the two drags are told apart by TYPE, the same
+  // discipline the shell nav's own drag uses, and a drop of this type anywhere
+  // text-editable types nothing.
+  const FOLD_DRAG_TYPE = "application/x-loopable-fold";
+  /** The folder being dragged, and the group its insertion line is currently drawn above. */
+  const [foldDrag, setFoldDrag] = useState<string | null>(null);
+  const [foldOver, setFoldOver] = useState<string | null>(null);
+  const foldsReorderable = !!folders && !!onFolderReorder;
+  /**
+   * Land `draggedId` before `beforeId` (null = last) and emit the new order. The arithmetic
+   * lives in `folders.ts` so a gate can run it under node — the handler around it is DOM.
+   *
+   * ⚠ The order is computed from the `folders` PROP, never from the rendered groups: a live
+   * "Find a view" query hides folders with no matches, and an order derived from what is on
+   * screen would silently drop the hidden ones out of the sequence.
+   */
+  const reorderFolders = (draggedId: string, beforeId: string | null) => {
+    const next = reorderFolderIds((folders ?? []).map((f) => f.id), draggedId, beforeId);
+    // `null` is "nothing to say" — an unknown id, or a drop that changed nothing.
+    if (next) onFolderReorder?.(next);
+  };
   const foldersOn = !!folders && !!folderIdOf && !!onItemMove;
   const groups = groupByFolder(
     shownViews,
@@ -265,15 +309,47 @@ export default function ViewSidebar({
   );
   const folderMenuF = folderMenu ? folders?.find((f) => f.id === folderMenu.id) : undefined;
   const addPreview = addTarget && folderAddPreview ? folderAddPreview(addTarget) : null;
+  /**
+   * ONE pair of drop handlers per group, serving TWO drags — a view being filed into this
+   * folder (`text/plain`) and, since wave 20 item 19, a folder being dropped in front of
+   * this one (`FOLD_DRAG_TYPE`). They must be one pair rather than two spreads: a second
+   * `onDragOver`/`onDrop` on the same element replaces the first, silently, and the drag
+   * that lost would simply stop working.
+   *
+   * The type is read BEFORE anything else, so a folder drag never paints the "file a view
+   * in here" fill and a view drag never draws the insertion rule.
+   */
   const dropHandlers = (folderId: string | null) =>
-    foldersOn
+    foldersOn || foldsReorderable
       ? {
           onDragOver: (e: React.DragEvent) => {
+            if (e.dataTransfer.types.includes(FOLD_DRAG_TYPE)) {
+              if (!foldsReorderable) return;
+              e.preventDefault();
+              e.dataTransfer.dropEffect = "move";
+              setFoldOver(folderId ?? "__root__");
+              return;
+            }
+            if (!foldersOn) return;
             e.preventDefault();
             setDropTarget(folderId ?? "__root__");
           },
-          onDragLeave: () => setDropTarget(null),
+          onDragLeave: () => {
+            setDropTarget(null);
+            setFoldOver(null);
+          },
           onDrop: (e: React.DragEvent) => {
+            if (e.dataTransfer.types.includes(FOLD_DRAG_TYPE)) {
+              const dragged = e.dataTransfer.getData(FOLD_DRAG_TYPE);
+              setFoldOver(null);
+              setFoldDrag(null);
+              if (!foldsReorderable || !dragged) return;
+              e.preventDefault();
+              e.stopPropagation();
+              reorderFolders(dragged, folderId);
+              return;
+            }
+            if (!foldersOn) return;
             e.preventDefault();
             setDropTarget(null);
             const id = e.dataTransfer.getData("text/plain");
@@ -299,6 +375,23 @@ export default function ViewSidebar({
     setPermEdit("personal");
     setPermUsers([]);
     setCreating(null);
+    // WAVE 20 item 20 — the two steps share ONE panel, so the anchor outlives step 1 and
+    // has to be released here. Left set, the flyout would spring back to the type chooser
+    // the instant the view was created.
+    setCreateMenu(null);
+  };
+
+  /** Item 20 — abandon the whole flyout, from either step. Escape, an outside click and
+   *  Cancel all mean the same thing ("I am not creating anything"), so they call one
+   *  function rather than three combinations of setters — and abandoning drops the DRAFT
+   *  too, or the next "+ Create new…" would hand back a half-filled form from a decision
+   *  the user already walked away from. */
+  const closeCreate = () => {
+    setCreating(null);
+    setCreateMenu(null);
+    setName("");
+    setPermEdit("personal");
+    setPermUsers([]);
   };
 
   const createFolder = () => {
@@ -312,10 +405,18 @@ export default function ViewSidebar({
     setCreatingFolder(false);
   };
 
-  /** Both create doors close the flyout first — leaving it open over the form it just
-   *  spawned would put a menu on top of the input it asked you to fill in. */
+  /**
+   * WAVE 20 item 20 — the view door KEEPS the anchor, because the name/permissions step
+   * now renders in the SAME anchored box the type chooser used. The old comment ("close
+   * the flyout first, or the menu sits on top of the input") described the bug the owner
+   * reported from the other side: the two steps of one action were drawn in two different
+   * places, one beside the rail and one inside it, so step 2 read as an unrelated form.
+   * One panel, two contents, one geometry.
+   *
+   * The FOLDER door still closes it: that path is a single step and has no second panel
+   * to disagree with. Moving it too would be a change the ruling does not ask for.
+   */
   const startView = (mode: DisplayMode) => {
-    setCreateMenu(null);
     setCreatingFolder(false);
     setCreating(mode);
   };
@@ -325,6 +426,28 @@ export default function ViewSidebar({
     setCreatingFolder(true);
   };
 
+  /**
+   * WAVE 20 items 18/23/26 (R10, C-SHARE) — open the access editor for a view or a
+   * folder.
+   *
+   * ⚠ A WINDOW EVENT, NOT A PROP, and not for convenience. The dialog is the SHELL's
+   * (one editor for views, folders and databases — R10 asks for one vocabulary), and
+   * this tree is host-neutral: `customer-grid/**` must not import a shell. The frame
+   * already listens on this channel for toasts and staleness; this is one more note on
+   * it. The literal is spelled once here and once in `shell/shareModel.ts`, which is
+   * where it becomes a shared constant when S3 publishes it in `apiContract.ts`
+   * (amendment A-S4-4).
+   *
+   * ⛔ It degrades to NOTHING when no shell is listening (the Streamlit-era bare grid):
+   * a dispatched event nobody hears opens no dialog and throws no error — which is the
+   * right failure for a frame-level surface reached from a rail.
+   */
+  const openShare = (kind: "view" | "folder", id: string, label: string) => {
+    window.dispatchEvent(
+      new CustomEvent("aios:share-open", { detail: { kind, id, label } })
+    );
+  };
+
   const onMenuKeyDown = (event: ReactKeyboardEvent<HTMLElement>) => {
     if (!["ArrowDown", "ArrowUp", "Home", "End"].includes(event.key)) return;
     const items = [
@@ -403,9 +526,24 @@ export default function ViewSidebar({
           className="cg-link-btn cg-create-btn"
           aria-haspopup="menu"
           aria-expanded={!!createMenu}
-          onClick={(event) =>
-            setCreateMenu((current) => (current ? null : event.currentTarget))
-          }
+          onClick={(event) => {
+            // ⛔ THE ANCHOR IS HOISTED OUT OF THE UPDATER — the same line that took the whole
+            // app white from the view row's "…" (see the long note at that button). React
+            // nulls `event.currentTarget` when the handler returns and may re-invoke a
+            // functional updater afterwards, so `setCreateMenu(cur => … event.currentTarget)`
+            // can store null. Item 20 made this panel outlive a single click — it now carries
+            // the name step too — so a randomly-nulled anchor would close a form mid-typing
+            // rather than merely mis-place a menu.
+            const anchor = event.currentTarget;
+            if (createMenu) {
+              closeCreate();
+              return;
+            }
+            // Every open starts at the type chooser: `creating` left set by an abandoned
+            // flyout would re-enter at step 2 for a kind nobody just picked.
+            setCreating(null);
+            setCreateMenu(anchor);
+          }}
         >
           <span className="cg-create-icon" aria-hidden="true">+</span>
           <span className="cg-create-label">Create new…</span>
@@ -444,97 +582,10 @@ export default function ViewSidebar({
         />
       </div>
 
-      {creating && (
-        <div className="cg-view-create cg-create-form">
-          <label htmlFor="cg-new-view">
-            {/* The prompt NAMES the kind picked in the flyout — otherwise the two steps read
-                as unrelated and "Calendar" silently becomes a fact you cannot see. */}
-            New {MODE_LABELS[creating].toLowerCase()} view
-          </label>
-          <input
-            id="cg-new-view"
-            className="cg-input"
-            autoFocus
-            value={name}
-            placeholder="e.g. Florida at risk"
-            onChange={(event) => setName(event.target.value)}
-            onKeyDown={(event) => {
-              if (event.key === "Enter") create();
-              if (event.key === "Escape") setCreating(null);
-            }}
-          />
-          {/* I17 (C4) — the owner's prompt ORDER: type (picked in the flyout, named above)
-              → who can edit → the user picker, and the picker only when it applies. */}
-          <div className="cg-perm" role="radiogroup" aria-label="Who can edit this view">
-            <span className="cg-perm-title">Who can edit</span>
-            {VIEW_EDIT_MODES.map((m) => (
-              <label key={m} className="cg-radio-row cg-perm-row">
-                <input
-                  type="radio"
-                  name="cg-view-perm"
-                  checked={permEdit === m}
-                  onChange={() => setPermEdit(m)}
-                />
-                <span className="cg-perm-label">
-                  {VIEW_EDIT_LABELS[m]}
-                  <span className="cg-perm-blurb">{VIEW_EDIT_BLURBS[m]}</span>
-                </span>
-              </label>
-            ))}
-            {permEdit === "users" && (
-              <div className="cg-perm-users">
-                {userOptions.length === 0 ? (
-                  // Never a silent empty box: an empty grant collapses to Personal host-side,
-                  // so say that rather than letting the user think they shared it.
-                  <span className="cg-perm-empty">
-                    No other accounts to pick — this will save as Personal.
-                  </span>
-                ) : (
-                  userOptions.map((u) => (
-                    <label key={u} className="cg-perm-user">
-                      <input
-                        type="checkbox"
-                        checked={permUsers.includes(u)}
-                        onChange={(e) =>
-                          setPermUsers((cur) =>
-                            e.target.checked
-                              ? [...cur, u].slice(0, MAX_VIEW_USERS)
-                              : cur.filter((x) => x !== u)
-                          )
-                        }
-                      />
-                      <span>{u}</span>
-                    </label>
-                  ))
-                )}
-                {userOptions.length > 0 && permUsers.length === 0 && (
-                  <span className="cg-perm-empty">
-                    Pick at least one person, or this saves as Personal.
-                  </span>
-                )}
-              </div>
-            )}
-          </div>
-          <div className="cg-form-actions">
-            <button
-              type="button"
-              className="cg-btn cg-btn--primary"
-              onClick={create}
-              disabled={!name.trim()}
-            >
-              Create
-            </button>
-            <button
-              type="button"
-              className="cg-btn"
-              onClick={() => setCreating(null)}
-            >
-              Cancel
-            </button>
-          </div>
-        </div>
-      )}
-
+      {/* ⛔ WAVE 20 item 20 — THE CREATE FORM NO LONGER RENDERS HERE. It is the flyout's
+          second step, inside the same `AnchoredOverlay` (below, next to the type list it
+          follows). This comment stands in for the moved markup because the move IS the
+          item: two steps of one action that used to appear in two different places. */}
       {/* I15 — the folder form: name + the icon the folder will wear. */}
       {foldersOn && onFolderCreate && creatingFolder && (
         <div className="cg-view-create cg-create-form cg-fold-form">
@@ -613,38 +664,144 @@ export default function ViewSidebar({
           anchor={createMenu}
           className="cg-view-menu cg-create-flyout"
           placement="right-start"
-          role="menu"
-          ariaLabel="Create new"
-          onDismiss={() => setCreateMenu(null)}
-          onKeyDown={onMenuKeyDown}
-          dataKind="create-new"
+          // WAVE 20 item 20 — ONE panel, two contents. A menu of choices and a form are
+          // different KINDS of thing to a screen reader even when they are one box to the
+          // eye, so the role and the label follow the step rather than being frozen at the
+          // panel's first purpose.
+          role={creating ? "dialog" : "menu"}
+          ariaLabel={
+            creating ? `New ${MODE_LABELS[creating].toLowerCase()} view` : "Create new"
+          }
+          onDismiss={closeCreate}
+          // ⛔ THE ARROW-KEY HANDLER IS STEP 1's ONLY. `onMenuKeyDown` swallows
+          // ArrowUp/ArrowDown to walk `[role=menuitem]`; over a text input that is the
+          // cursor keys refusing to move through what you just typed.
+          {...(creating ? {} : { onKeyDown: onMenuKeyDown })}
+          dataKind={creating ? "create-new-name" : "create-new"}
         >
-          {CREATABLE_MODES.map((mode) => (
-            <button
-              key={mode}
-              type="button"
-              role="menuitem"
-              className="cg-create-row"
-              onClick={() => startView(mode)}
-            >
-              {/* size 16 — item 13's "bigger icons", and the SAME 16 the view rows use, so a
-                  Calendar is one mark at one size on this whole surface. */}
-              <ToneModeIcon mode={mode} tone={MODE_TONE[mode]} size={16} />
-              <span>{MODE_LABELS[mode]}</span>
-            </button>
-          ))}
-          {foldersOn && onFolderCreate && (
+          {creating ? (
+            <div className="cg-view-create cg-create-form">
+              <label htmlFor="cg-new-view">
+                {/* The prompt NAMES the kind picked one step ago — the panel replaced its
+                    own contents, so without this the box gives no sign that "Calendar" was
+                    ever chosen. */}
+                New {MODE_LABELS[creating].toLowerCase()} view
+              </label>
+              <input
+                id="cg-new-view"
+                className="cg-input"
+                autoFocus
+                // The overlay's own initial-focus effect fires on MOUNT, and this panel does
+                // not re-mount between the two steps — so the input carries `autoFocus` (React
+                // focuses it when it mounts) and the marker the other in-panel forms use.
+                data-overlay-autofocus
+                value={name}
+                placeholder="e.g. Florida at risk"
+                onChange={(event) => setName(event.target.value)}
+                onKeyDown={(event) => {
+                  if (event.key === "Enter") create();
+                  // Escape is handled by the overlay layer too; both mean "abandon", and
+                  // calling the same closer twice is idempotent.
+                  if (event.key === "Escape") closeCreate();
+                }}
+              />
+              {/* I17 (C4) — the owner's prompt ORDER: type (picked in step 1, named above)
+                  → who can edit → the user picker, and the picker only when it applies. */}
+              <div className="cg-perm" role="radiogroup" aria-label="Who can edit this view">
+                <span className="cg-perm-title">Who can edit</span>
+                {VIEW_EDIT_MODES.map((m) => (
+                  <label key={m} className="cg-radio-row cg-perm-row">
+                    <input
+                      type="radio"
+                      name="cg-view-perm"
+                      checked={permEdit === m}
+                      onChange={() => setPermEdit(m)}
+                    />
+                    <span className="cg-perm-label">
+                      {VIEW_EDIT_LABELS[m]}
+                      <span className="cg-perm-blurb">{VIEW_EDIT_BLURBS[m]}</span>
+                    </span>
+                  </label>
+                ))}
+                {permEdit === "users" && (
+                  <div className="cg-perm-users">
+                    {userOptions.length === 0 ? (
+                      // Never a silent empty box: an empty grant collapses to Personal
+                      // host-side, so say that rather than letting the user think they
+                      // shared it.
+                      <span className="cg-perm-empty">
+                        No other accounts to pick — this will save as Personal.
+                      </span>
+                    ) : (
+                      userOptions.map((u) => (
+                        <label key={u} className="cg-perm-user">
+                          <input
+                            type="checkbox"
+                            checked={permUsers.includes(u)}
+                            onChange={(e) =>
+                              setPermUsers((cur) =>
+                                e.target.checked
+                                  ? [...cur, u].slice(0, MAX_VIEW_USERS)
+                                  : cur.filter((x) => x !== u)
+                              )
+                            }
+                          />
+                          <span>{u}</span>
+                        </label>
+                      ))
+                    )}
+                    {userOptions.length > 0 && permUsers.length === 0 && (
+                      <span className="cg-perm-empty">
+                        Pick at least one person, or this saves as Personal.
+                      </span>
+                    )}
+                  </div>
+                )}
+              </div>
+              <div className="cg-form-actions">
+                <button
+                  type="button"
+                  className="cg-btn cg-btn--primary"
+                  onClick={create}
+                  disabled={!name.trim()}
+                >
+                  Create
+                </button>
+                <button type="button" className="cg-btn" onClick={closeCreate}>
+                  Cancel
+                </button>
+              </div>
+            </div>
+          ) : (
             <>
-              <div className="cg-menu-sep" role="separator" aria-hidden />
-              <button
-                type="button"
-                role="menuitem"
-                className="cg-create-row"
-                onClick={() => startFolder()}
-              >
-                <FolderMark size={16} />
-                <span>Folder</span>
-              </button>
+              {CREATABLE_MODES.map((mode) => (
+                <button
+                  key={mode}
+                  type="button"
+                  role="menuitem"
+                  className="cg-create-row"
+                  onClick={() => startView(mode)}
+                >
+                  {/* size 16 — item 13's "bigger icons", and the SAME 16 the view rows use,
+                      so a Calendar is one mark at one size on this whole surface. */}
+                  <ToneModeIcon mode={mode} tone={MODE_TONE[mode]} size={16} />
+                  <span>{MODE_LABELS[mode]}</span>
+                </button>
+              ))}
+              {foldersOn && onFolderCreate && (
+                <>
+                  <div className="cg-menu-sep" role="separator" aria-hidden />
+                  <button
+                    type="button"
+                    role="menuitem"
+                    className="cg-create-row"
+                    onClick={() => startFolder()}
+                  >
+                    <FolderMark size={16} />
+                    <span>Folder</span>
+                  </button>
+                </>
+              )}
             </>
           )}
         </AnchoredOverlay>
@@ -662,12 +819,42 @@ export default function ViewSidebar({
           key={gid ?? "__root__"}
           className={
             (isRoot ? "cg-fold-root" : "cg-fold") +
-            (dropTarget === (gid ?? "__root__") ? " is-drop" : "")
+            (dropTarget === (gid ?? "__root__") ? " is-drop" : "") +
+            // Item 19 — the insertion rule reads "the folder you are dragging lands HERE":
+            // above this folder, or above the ungrouped section, which is after them all.
+            (foldOver === (gid ?? "__root__") && foldDrag && foldDrag !== gid
+              ? " is-drop-above"
+              : "") +
+            (foldDrag === gid ? " is-folddrag" : "")
           }
           {...dropHandlers(gid)}
         >
           {group.folder && (
-            <div className="cg-fold-head">
+            <div
+              className="cg-fold-head"
+              // ── Item 19 — the folder itself is the drag handle ─────────────────────
+              // Draggable only while it is renameable-idle: a `draggable` ancestor eats
+              // the text selection inside an input, so dragging would win over editing
+              // the name you just opened.
+              draggable={foldsReorderable && renamingFolder !== group.folder.id}
+              onDragStart={(e) => {
+                e.dataTransfer.setData(FOLD_DRAG_TYPE, group.folder!.id);
+                e.dataTransfer.effectAllowed = "move";
+                setFoldDrag(group.folder!.id);
+              }}
+              onDragEnd={() => {
+                setFoldDrag(null);
+                setFoldOver(null);
+              }}
+            >
+              {/* ⛔ NO DRAG GRIP, and that is a decision rather than an omission. A grip in
+                  flow shifts the folder's name to the right, and this rail's indent is
+                  MEASURED to the pixel (index.css: "root view name 41.00px / folder header
+                  48.36px" — the whole point of the wave-10 item-2 fix); the gutter it would
+                  otherwise hide in is already occupied by the disclosure chevron, whose
+                  open/shut state is the only one this row has. The view rows above have been
+                  draggable with no handle since wave 8, so a folder that drags the same way
+                  is the vocabulary this list already teaches, not a hidden feature. */}
               <button
                 type="button"
                 className="cg-fold-toggle"
@@ -710,8 +897,28 @@ export default function ViewSidebar({
                 ) : (
                   <span className="cg-fold-name">{group.folder.name}</span>
                 )}
-                <span className="cg-fold-count">{group.items.length}</span>
+                {/* ⛔ WAVE 20 item 21 — THE VIEW COUNT IS DELETED, and the item is not
+                    really about the number. `.cg-view-more` (the "…" beside this button)
+                    ships `opacity: 0` and is revealed by `.cg-view-row:hover`; a folder
+                    head is not a view row, so NO rule ever revealed it — the folder's
+                    actions button was painted at zero opacity in every state but keyboard
+                    focus. The badge is what the owner saw sitting where the control should
+                    have been. Deleting it and making the "…" unconditionally visible (one
+                    rule in this wave's S4 region) are the two halves of one fix.
+                    ⚠ `.cg-fold-count` in index.css now has no consumer in this tree. Left
+                    in place rather than swept blind — same posture as `.cg-fold-new` above
+                    — and booked in the S4 mailbox so the sweep is a decision, not a
+                    discovery. The NAV rail's own count stays: that rail reveals its "…" on
+                    hover already, so it never had this defect and item 21 never named it. */}
               </button>
+              {/* ⛔ THE SYSTEM FOLDER HAS NO ACTIONS (item 18 / C-SHARE). "Shared with
+                  me" is not the reader's folder: it cannot be renamed into something
+                  else, duplicated into a second copy of other people's work, or
+                  deleted — the contract calls it undeletable, and a menu whose every
+                  row the server would refuse is three fake affordances rather than
+                  one. Views MOVE OUT of it normally (that is per-receiver placement),
+                  which is the only thing anyone needs to do to it. */}
+              {group.folder.id === SHARED_FOLDER_ID ? null : (
               <button
                 type="button"
                 className="cg-view-more"
@@ -729,6 +936,7 @@ export default function ViewSidebar({
               >
                 ···
               </button>
+              )}
             </div>
           )}
           {/* A collapsed folder hides its rows but stays a DROP TARGET, so you can
@@ -818,6 +1026,35 @@ export default function ViewSidebar({
                       so explicitly), so most rows have exactly one reason. When a row has both,
                       the row-set meaning leads and the title carries the other — never two
                       padlocks side by side, which would read as a bug. */}
+                  {/* ⭐ WAVE 20 item 23 (C-SHARE) — THE SECOND MARK, beside the padlock
+                      and never instead of it. They answer different questions: the lock
+                      says what this view may become, this says how it got to you. A
+                      view someone shared with you is one you can be looking at without
+                      having made it — the single most useful thing the rail can tell you
+                      before the click.
+                      ⚠ `shared` is not on `SavedView` yet (S3, amendment A-S4-4). Read
+                      through ONE narrowed cast, here, rather than loosening the type
+                      everywhere: an absent flag reads as false, which is exactly right
+                      until the server projects it. */}
+                  {(view as { shared?: boolean }).shared ? (
+                    <span
+                      className="cg-view-shared"
+                      role="img"
+                      aria-label={`${view.name}, shared with you`}
+                      title="Shared with you — someone gave you access to this view."
+                    >
+                      <svg width="13" height="13" viewBox="0 0 16 16" aria-hidden>
+                        <circle cx="5.6" cy="5.6" r="2.2" fill="none" stroke="currentColor"
+                                strokeWidth="1.3" />
+                        <path d="M1.9 12.6c0-2 1.7-3.2 3.7-3.2s3.7 1.2 3.7 3.2"
+                              fill="none" stroke="currentColor" strokeWidth="1.3"
+                              strokeLinecap="round" />
+                        <path d="M10.6 4.1a2.2 2.2 0 0 1 0 4.2M11.4 9.7c1.6.3 2.7 1.4 2.7 2.9"
+                              fill="none" stroke="currentColor" strokeWidth="1.3"
+                              strokeLinecap="round" />
+                      </svg>
+                    </span>
+                  ) : null}
                   {(view.kind === "locked" || isModeFrozen(view)) && (
                     <span
                       className="cg-view-lock"
@@ -902,7 +1139,15 @@ export default function ViewSidebar({
           The lock MARK moved onto the ordinary view row, where `kind === "locked"` drives it. */}
       </div>
 
-      {/* I11c — the folder "…" menu. Rename · Add to cohort · Duplicate · Delete. */}
+      {/* I11c — the folder "…" menu. Rename · Add to cohort · Duplicate · Delete.
+          WAVE 20 item 22 — every row now carries the SAME icon vocabulary the view row's
+          menu uses (`MenuLabel` over `MENU_ICONS`), and Delete is red AT REST rather than
+          only once armed. Two menus that do the same kind of thing to two kinds of object
+          were drawn in two registers: one with icons and a red delete, one with neither.
+          ⚠ NO NEW CSS FOR THE COLOUR: this overlay already wears `cg-view-menu`, so adding
+          `is-danger` to the button reuses `.cg-view-menu button.is-danger` — the exact rule
+          that paints the view row's Delete, which is what "matching" has to mean. The
+          `cg-menu-item--danger` class stays for its armed background. */}
       {folderMenu && folderMenuF && (
         <AnchoredOverlay
           anchor={folderMenu.anchor}
@@ -925,7 +1170,7 @@ export default function ViewSidebar({
               setFolderMenu(null);
             }}
           >
-            Rename
+            <MenuLabel icon="rename" text="Rename" />
           </button>
           {folderAddPreview && onFolderAddToList && (
             <button
@@ -939,7 +1184,7 @@ export default function ViewSidebar({
                 setFolderMenu(null);
               }}
             >
-              Add to cohort…
+              <MenuLabel icon="cohortAdd" text="Add to cohort…" />
             </button>
           )}
           {onFolderDuplicate && (
@@ -952,14 +1197,30 @@ export default function ViewSidebar({
                 setFolderMenu(null);
               }}
             >
-              Duplicate folder and its views
+              <MenuLabel icon="duplicate" text="Duplicate folder and its views" />
             </button>
           )}
+          {/* WAVE 20 item 18 (R10) — a folder shares, and its views ride along
+              (the server's rule, stated in C-SHARE; this row only opens the editor). */}
+          <button
+            type="button"
+            role="menuitem"
+            className="cg-menu-item"
+            onClick={() => {
+              openShare("folder", folderMenuF.id, folderMenuF.name);
+              setFolderMenu(null);
+            }}
+          >
+            <MenuLabel icon="permissions" text="Share folder…" />
+          </button>
           {onFolderDelete && (
             <button
               type="button"
               role="menuitem"
-              className={"cg-menu-item cg-menu-item--danger" + (confirmDelete === folderMenuF.id ? " is-armed" : "")}
+              className={
+                "cg-menu-item cg-menu-item--danger is-danger" +
+                (confirmDelete === folderMenuF.id ? " is-armed" : "")
+              }
               onClick={() => {
                 if (confirmDelete !== folderMenuF.id) {
                   setConfirmDelete(folderMenuF.id);
@@ -970,9 +1231,18 @@ export default function ViewSidebar({
                 setFolderMenu(null);
               }}
             >
-              {confirmDelete === folderMenuF.id
-                ? "Delete folder? Its views move to the top level."
-                : "Delete folder"}
+              {/* The ARMED label is a whole sentence and the menu row is `nowrap` with a
+                  260px ceiling, so it used to run out of the panel. It wraps while armed
+                  (one rule in the S4 region) rather than being ellipsised: a confirmation
+                  the reader cannot finish reading is not a confirmation. */}
+              <MenuLabel
+                icon="trash"
+                text={
+                  confirmDelete === folderMenuF.id
+                    ? "Delete folder? Its views move to the top level."
+                    : "Delete folder"
+                }
+              />
             </button>
           )}
         </AnchoredOverlay>
@@ -1170,6 +1440,44 @@ export default function ViewSidebar({
           >
             <MenuLabel icon="duplicate" text="Duplicate" />
           </button>
+          {/* WAVE 20 items 23/26 (R10) — "who else can reach this view", the same
+              editor a folder and a database open. Deliberately NOT gated on
+              `canEditMenuView`: the server decides who may administer (owner or
+              admin) and says so in the dialog, and hiding the row from everyone else
+              would hide the ANSWER too — "who has this?" is a fair question for
+              anyone the view was shared with. */}
+          <button
+            type="button"
+            role="menuitem"
+            onClick={() => {
+              openShare("view", menuView.id, menuView.name);
+              setMenu(null);
+            }}
+          >
+            <MenuLabel icon="permissions" text="Share view…" />
+          </button>
+          {/* WAVE 20 item 25 (C-ALERT) — the door that MAKES an alert, on the view it
+              watches. It belongs here and nowhere else: an alert IS "tell me when a
+              record enters THIS view", so the only place the question has an obvious
+              subject is the view's own menu.
+              ⚠ The frame answers, because this rail does not know its own topic (it
+              holds views; the scope key belongs to the route) — and because the server
+              refuses a view with no active filter, which is a message the frame is
+              already in the business of showing. */}
+          <button
+            type="button"
+            role="menuitem"
+            onClick={() => {
+              window.dispatchEvent(
+                new CustomEvent("aios:alert-create", {
+                  detail: { viewId: menuView.id, label: menuView.name },
+                })
+              );
+              setMenu(null);
+            }}
+          >
+            <MenuLabel icon="cohortAdd" text="Alert me about new records…" />
+          </button>
           {onAddToList && (
             <button
               type="button"

web/src/customer-grid/apiBridge.ts

@@ -219,6 +219,78 @@ export function patchCustomer(pid: number, updates: Partial<Row>): Promise<boole
   return patchTopicRow(CUSTOMER_TOPIC, pid, updates);
 }
 
+/**
+ * ⭐ Wave-20 owner item 4 / contract C-ADDROW — **APPEND A ROW TO A USER DATABASE**, and
+ * (C-UNDO) restore a deleted one under its old id.
+ *
+ * USER TABLES ONLY, and the refusal is structural rather than checked here: no other scope has
+ * a `/tables/{key}/rows` endpoint at all. A connector's rows are read-synced from its source —
+ * R8 is explicit that a "+" which must refuse is a fake affordance, so the caller never renders
+ * one there.
+ *
+ * ⚠ THE ANSWER IS THE ID THAT WAS STORED, never the one that was asked for. An undo that
+ * requests `rid` may find that id re-used, and the server's own note says it answers with what
+ * it actually wrote; the caller re-anchors on the returned value rather than assuming.
+ *
+ * ⚠ The rows cache is CLEARED on success. `fetchTopicRows` holds a 5-minute window per topic,
+ * so a re-read straight after an append would serve the payload from before it — the new row
+ * would appear minutes later, which reads as "the button did nothing". Same reason the shell's
+ * retired Add-record bar cleared it (wave 20 item 4 moved that door here).
+ */
+export async function addTableRow(
+  tableKey: string,
+  values: Record<string, unknown> = {},
+  rid?: string | number
+): Promise<{ rid: string | number; pid: number } | null> {
+  try {
+    const res = await fetch(`${API_V1}/tables/${encodeURIComponent(tableKey)}/rows`, {
+      method: "POST",
+      credentials: CREDENTIALS,
+      headers: JSON_HEADERS,
+      body: JSON.stringify(rid === undefined ? { values } : { rid, values }),
+    });
+    if (handledUnauthorized(res.status)) return null;
+    const body = (await readJson(res)) as { rid?: string | number; pid?: number;
+                                            detail?: { message?: string } } | null;
+    if (!res.ok) {
+      // The server states WHY (a row cap, a store refusal). Surfacing its sentence beats a
+      // generic failure toast, and staying silent would be the worst of the three.
+      const why = typeof body?.detail?.message === "string"
+        ? body.detail.message
+        : `The server answered ${res.status}.`;
+      signal(TOAST_EVENT, why);
+      return null;
+    }
+    if (body?.rid === undefined || typeof body?.pid !== "number") {
+      signal(DATA_ERROR_EVENT, "The server did not say which row it created.");
+      return null;
+    }
+    rowsCache.delete(`tables/${tableKey}/rows`);
+    return { rid: body.rid, pid: body.pid };
+  } catch {
+    signal(DATA_ERROR_EVENT, "Cannot reach the server.");
+    return null;
+  }
+}
+
+/** C-UNDO's other half: drop a row this session just added. Same cache rule as the append. */
+export async function deleteTableRow(
+  tableKey: string,
+  rid: string | number
+): Promise<boolean> {
+  try {
+    const res = await fetch(
+      `${API_V1}/tables/${encodeURIComponent(tableKey)}/rows/${encodeURIComponent(String(rid))}`,
+      { method: "DELETE", credentials: CREDENTIALS }
+    );
+    if (handledUnauthorized(res.status)) return false;
+    if (res.ok) rowsCache.delete(`tables/${tableKey}/rows`);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Item 7 (contract C-TS) — `POST /api/v1/grid/timeseries`.
  *

web/src/customer-grid/folders.ts

@@ -30,6 +30,16 @@ export interface FolderStamps {
   deleted?: Record<string, number>;
   /** itemId -> {at, folderId} for a drag this browser just performed. */
   moved?: Record<string, { at: number; folderId: string | null }>;
+  /**
+   * WAVE 20 item 19 (C-FOLDER-REORDER) — the FULL folder order this browser just set.
+   *
+   * ONE stamp, not one per folder, because a reorder is one decision about a list: the
+   * order the user dropped into is the order they want, and reconstructing it from N
+   * per-folder stamps would let two of them age out at different moments and leave a
+   * sequence nobody ever chose. The host answers with `order` NUMBERS on each folder
+   * (that is the durable form); this is what to render until it does.
+   */
+  ordered?: { at: number; order: string[] };
 }
 
 export const FOLDER_STAMP_MAX = 64;
@@ -59,6 +69,9 @@ export function pruneFolderStamps(stamps: FolderStamps | undefined, now: number)
   if (renamed) out.renamed = renamed;
   if (deleted) out.deleted = deleted;
   if (moved) out.moved = moved;
+  // Item 19: a single stamp, so it is kept or dropped whole — pruning it by halves is
+  // exactly the partial sequence the field's own note refuses.
+  if (isRecent(stamps?.ordered?.at, now) && stamps?.ordered) out.ordered = stamps.ordered;
   return out;
 }
 
@@ -102,7 +115,28 @@ export function reconcileFolders(
     out.push(f);
   }
 
-  return out.sort((a, b) => (a.order ?? 0) - (b.order ?? 0) || a.name.localeCompare(b.name));
+  out.sort((a, b) => (a.order ?? 0) - (b.order ?? 0) || a.name.localeCompare(b.name));
+
+  // ── WAVE 20 item 19 (C-FOLDER-REORDER): this browser's drag, until the echo carries it.
+  //
+  // Applied AFTER the host sort and as a SEPARATE pass, both deliberately:
+  //   · the host's `order` numbers are the durable truth and stay the base sequence, so a
+  //     folder the stamp never names keeps exactly the place the server gave it;
+  //   · `Array.prototype.sort` is stable (ES2019), so every unnamed folder — one created in
+  //     another tab between the drag and the echo, say — holds its relative position at the
+  //     end instead of being flung to the front by a missing rank.
+  // A stamped id that has since been DELETED needs no handling: the tombstone pass above
+  // already dropped it, and `rank` is only ever consulted for folders that survived.
+  const ordered = stamps?.ordered;
+  if (isRecent(ordered?.at, now) && ordered) {
+    const rank = new Map(ordered.order.map((id, i) => [id, i]));
+    out.sort(
+      (a, b) =>
+        (rank.get(a.id) ?? Number.MAX_SAFE_INTEGER) -
+        (rank.get(b.id) ?? Number.MAX_SAFE_INTEGER)
+    );
+  }
+  return out;
 }
 
 /**
@@ -158,6 +192,44 @@ export function groupByFolder<T>(
   return out;
 }
 
+/**
+ * WAVE 20 item 19 (C-FOLDER-REORDER) — where a dragged folder lands: the full order with
+ * `draggedId` moved to sit immediately BEFORE `beforeId`, or last when that is null (the
+ * drop on the ungrouped section below every folder).
+ *
+ * Here rather than inside the rail because it is the only part of the drag a test can hold:
+ * the drop handler is DOM, the emit is the caller's, and this is the arithmetic that decides
+ * what the user sees. `null` means "emit nothing" — an unknown id, or a drop that changes
+ * nothing. Returning the unchanged array instead would be worse than useless: the caller
+ * cannot tell it apart from a real reorder, so every no-op drag would write the store, bump
+ * every reader's payload, and reconcile to the identical list.
+ *
+ * ⚠ The dragged id is REMOVED BEFORE the target index is read. Taking the index first and
+ * splicing after is the classic off-by-one here: dragging a folder DOWNWARD would land it one
+ * place short of where it was dropped, and only in that direction — the shape of bug that
+ * survives a demo and gets reported as "it sometimes doesn't move".
+ */
+export function reorderFolderIds(
+  ids: string[],
+  draggedId: string,
+  beforeId: string | null
+): string[] | null {
+  if (!ids.includes(draggedId)) return null;
+  // ⛔ DROPPED ON ITSELF. Without this the id is filtered out, `indexOf` cannot find its own
+  // target, and the "not found" branch sends the folder to the END — so releasing a drag over
+  // the folder you picked up would quietly move it to the bottom of the rail. Found by this
+  // function's own gate the minute the arithmetic left the component; the drop handler's
+  // indicator suppresses the same case visually, which is exactly why it would never have
+  // been noticed there.
+  if (beforeId === draggedId) return null;
+  const rest = ids.filter((id) => id !== draggedId);
+  const found = beforeId ? rest.indexOf(beforeId) : -1;
+  const at = found < 0 ? rest.length : found;
+  const next = [...rest.slice(0, at), draggedId, ...rest.slice(at)];
+  if (next.length === ids.length && next.every((id, i) => id === ids[i])) return null;
+  return next;
+}
+
 /** A fresh folder id. Client-generated, like every other id in this component. */
 export function newFolderId(): string {
   const rand =

web/src/customer-grid/liveWorkspace.ts

@@ -81,6 +81,52 @@ export function stampTombstone(stamps: Tombstones | undefined, id: string, now:
   return pruneTombstones({ ...(stamps ?? {}), [id]: now }, now);
 }
 
+/**
+ * ⭐ D-19 (wave 20) — **THE LOCALSTORAGE GHOST.**
+ *
+ * At init the grid seeded EVERY view from localStorage and then merged the host's list over the
+ * top, so a view the host no longer names simply survived — for ever, in that browser. Three
+ * ordinary paths produce one: the view was deleted from another tab or another machine, its
+ * share was revoked, or the store moved under it. The row keeps working until you click it, and
+ * then it is a saved view nobody else can see and no write can reach; the owner reported it as
+ * "live and staging disagree". Item 13's pg cutover makes the host list authoritative for real,
+ * which turns a rare confusion into a visible one.
+ *
+ * So: **the host's list decides which views exist.** A local copy the host does not name is
+ * dropped — with two guards, and neither is optional:
+ *
+ *   1. `hostAuthoritative === false` keeps everything. Standalone with no `/workspace` (and the
+ *      legacy embed) has no host list at all, and "not named" there means "not asked", not
+ *      "deleted". Dropping on a payload that never carried views would empty the rail.
+ *      ⛔ **An EMPTY host list counts as not-authoritative for the same reason, and this is the
+ *      one branch that could destroy data.** A `/workspace` answering `200 {views: []}` is
+ *      indistinguishable from a store that has not answered yet — a scope whose bucket is
+ *      briefly empty during item 13's `hf → pg` migration, a fresh backend, a bucket that was
+ *      never seeded. Dropping there wipes every saved view in that browser, and the persist
+ *      effect rewrites localStorage immediately after, so there is no second chance. The ghost
+ *      this exists for is a view missing from a NON-EMPTY list; nothing is lost by refusing to
+ *      act on no list at all.
+ *   2. A view THIS BROWSER wrote inside the echo window survives. A create is optimistic: the
+ *      row exists locally the instant it is made, and the host cannot name it until its
+ *      `view_upsert` has been sent AND the next `/workspace` read has come back. Without this
+ *      guard, creating a view and reloading fast enough would delete it — the exact inverse of
+ *      the bug, and a worse one.
+ *
+ * Same window, same reasoning and the same stamp shape as the tombstones above: past
+ * ECHO_RECENT_MS, divergence is not an echo.
+ */
+export function seedLocalViews(
+  localViews: readonly SavedView[],
+  hostViews: readonly SavedView[],
+  writes: Tombstones | undefined,
+  now: number,
+  hostAuthoritative: boolean
+): SavedView[] {
+  if (!hostAuthoritative || hostViews.length === 0) return [...localViews];
+  const named = new Set(hostViews.map((v) => v.id));
+  return localViews.filter((v) => named.has(v.id) || isRecent(writes?.[v.id], now));
+}
+
 /**
  * Views that have APPEARED on the host since this browser last looked.
  *

web/src/customer-grid/overlayPlacement.ts

@@ -480,9 +480,22 @@ export function computeOverlayPosition(args: {
     side = placeBelow ? "below" : "above";
     maxHeight = Math.max(1, placeBelow ? below : above);
     const unclampedLeft = placement === "bottom-end" ? target.right - width : target.left;
+    // The horizontal clamp needs no `Math.max(minLeft, …)` on its outer bound, unlike the
+    // `right-start` branch above: `width` is ALREADY clamped to `maxWidth = maxRight - minLeft`,
+    // so `maxRight - width >= minLeft` always holds and the min cannot undo the max. Proven the
+    // only way worth proving it — a mutation that removed the "fix" left every leg green, which
+    // is what a guard against an impossible state looks like ([[gate-negative-control]]).
     left = Math.min(Math.max(unclampedLeft, minLeft), maxRight - width);
+    // ⚠ D-20 (wave 20) — `Math.max(minTop, …)` IS load-bearing, and it was missing.
+    //
+    // The below-branch had no lower bound, so an anchor ABOVE the viewport put the panel above
+    // it too — painted, and unreachable. Not hypothetical: it is the null-anchor case D-20 is
+    // about (a null anchor degrades to a ZERO rect at the DOCUMENT origin, which is above the
+    // viewport whenever `visualViewport` carries an offset — a pinch-zoomed phone), and it is
+    // equally a trigger that scrolls out of view with its menu still open. `verify_overlay`'s
+    // `below-branch-loses-its-top-clamp` control restages exactly this.
     top = placeBelow
-      ? Math.min(target.bottom + gap, maxBottom - maxHeight)
+      ? Math.max(minTop, Math.min(target.bottom + gap, maxBottom - maxHeight))
       : Math.max(minTop, target.top - gap - Math.min(desiredHeight, maxHeight));
   }
 

web/src/customer-grid/types.ts

@@ -963,10 +963,21 @@ export function directionLabel(t: FieldType, dir: "asc" | "desc"): string {
 }
 
 /**
- * Groupable = a CLOSED vocabulary (status/select/multiselect/checkbox) or a non-overlay text
- * attribute other than the locked identity column (unique per row -> useless as a group key).
+ * Groupable = a CLOSED vocabulary (status/select/multiselect/checkbox) or ANY text attribute
+ * other than the locked identity column (unique per row -> useless as a group key).
  * ONE definition, consumed by the toolbar's Group panel and the column menu's "Group by this
  * field" alike — two copies of this predicate would drift exactly like operator vocabularies.
+ *
+ * ⭐ Wave-20 owner item 11 — `field.source !== "overlay"` is GONE. A user-created text column
+ * was the one text field you could not group by, which is backwards: those are the columns
+ * holding the reader's OWN vocabulary (a segment, an owner, a call outcome), and they are
+ * exactly what a person wants to bucket a table by. The exclusion was never a rule about
+ * groupability — the only text field that is useless as a group key is the identity column,
+ * and that is tested for on its own.
+ *
+ * ⚠ Free text does NOT become a closed vocabulary by being grouped: `groupRows` keys on the
+ * TRIMMED cell, so "Miami" and "Miami " are one bucket, and blanks fall into the same
+ * "(empty)" group every other type uses.
  */
 export function isGroupableField(field: Field, lockedKey: string): boolean {
   return (
@@ -974,7 +985,7 @@ export function isGroupableField(field: Field, lockedKey: string): boolean {
     field.type === "select" ||
     field.type === "multiselect" ||
     field.type === "checkbox" ||
-    (field.type === "text" && field.source !== "overlay" && field.key !== lockedKey)
+    (field.type === "text" && field.key !== lockedKey)
   );
 }
 
@@ -1134,6 +1145,19 @@ export interface Field {
    * which is one popover away and is the governed path (CG-8/CG-12's replacement rule).
    */
   measure?: { key: string; window: WindowSpec };
+  /**
+   * ⭐ Wave-20 R2 / contract C-FIELD — **who may edit THIS COLUMN'S DEFINITION** on a `ut_*`
+   * table, whose fields are the TABLE's schema rather than one user's overlay. `admins` (the
+   * fail-closed default) means the database's creator or an admin; `everyone` opens this one
+   * column without handing over the table.
+   *
+   * ⚠ IT GOVERNS THE SCHEMA, NEVER THE VALUES. `everyone` means anybody with access may rename
+   * the column or change its options — not that anybody may type in its cells. Those are
+   * different questions, and conflating them would turn a column's settings into a
+   * data-permission system nobody wrote (`user_tables._clean_field` says the same thing from
+   * the other side; `verify_grid_ux`'s C-FIELD parity holds the two shapes together).
+   */
+  editRole?: "admins" | "everyone";
 }
 
 /** One data record. Always carries a stable `pid` — the semantic identity that
@@ -1516,6 +1540,144 @@ export function isRuleActive(rule: FilterRule): boolean {
   return rule.value !== "";
 }
 
+/**
+ * ⭐ Wave-20 owner item 15 (contract C-RENAME) — **THE RENAME MAPPING, BY ROW IDENTITY.**
+ *
+ * Given the option rows as they stand and what each row SAID when the editor opened, which
+ * renames did the user make? A row that kept its id and changed its label was renamed; an id
+ * nobody has seen is a new option; an id that is gone was deleted. That is why the answer is
+ * exact rather than a guess: two lists cannot distinguish "renamed Blue to Navy" from "deleted
+ * Blue, added Navy", and picking wrong empties every cell that said Blue.
+ *
+ * Two cases are deliberately NOT renames:
+ *   · a row emptied to "" — a label being retyped is not a rename to nothing;
+ *   · a rename ONTO an option that already exists — that is a MERGE, and merging two choices is
+ *     a different operation with a different answer for the cells that held either. Refused
+ *     here rather than sent as a rename the host would apply as one.
+ *
+ * Lives in types.ts, not beside the editor, for the usual reason: ColumnMenu imports React and
+ * cannot be loaded by a node gate, and this is the half that has to be right.
+ */
+export function choiceRenames(
+  rows: readonly { id: string; label: string }[],
+  origin: ReadonlyMap<string, string>,
+  savedChoices: readonly string[]
+): { from: string; to: string }[] {
+  const existing = new Set(savedChoices.map((o) => o.toLowerCase()));
+  const out: { from: string; to: string }[] = [];
+  for (const row of rows) {
+    const from = origin.get(row.id);
+    const to = row.label.trim();
+    if (!from || !to || from === to) continue;
+    if (existing.has(to.toLowerCase())) continue;
+    out.push({ from, to });
+  }
+  return out;
+}
+
+/**
+ * ⭐ Wave-20 owner item 14 — **IS THIS SELECTION EVENT'S ROW SET AUTHORITATIVE, or is it glide
+ * clearing the checkboxes because you clicked a cell?**
+ *
+ * glide's selection is EXCLUSIVE by default: `useSelectionBehavior.setCurrent` (its own
+ * `internal/data-grid/use-selection-behavior.js`) builds every cell-click event with
+ * `rows: CompactSelection.empty()`, and `rowSelectionBlending="mixed"` does NOT change that —
+ * the flag is gated behind `rangeMixable`, which needs `append || trigger === "drag"`, so a
+ * plain click empties the rows whatever props we pass. Translating that emptiness into
+ * `selectedPids` is what un-ticked the checked rows the moment the user clicked another
+ * customer's name: tick four customers for a cohort, click the fifth to read its row, keep one.
+ *
+ * The discriminator is `current`. A ROW-marker interaction comes through `setSelectedRows`,
+ * which sets `current: undefined` in BOTH of its branches; a CELL interaction always carries a
+ * `current`. So:
+ *   current === undefined  -> a row/marker event (or a genuine clear: Escape, void click) -> ADOPT
+ *   rows.length > 0        -> the rows were positively set -> ADOPT (dead under "exclusive",
+ *                             kept because it is the property meant, not the proxy)
+ *   otherwise              -> a cell click that emptied the rows -> KEEP the pids
+ *
+ * ⚠ IT LIVES HERE, NOT IN `useGridSelection`, FOR ONE REASON: that module imports glide, and
+ * glide cannot be loaded under node — its CJS build trips over the package's `"type":"module"`
+ * (measured: `ReferenceError: exports is not defined in ES module scope`). A predicate inside it
+ * is therefore ungateable, and there is no vitest here. types.ts imports nothing but `windows`,
+ * so the gate exercises the SHIPPED function rather than a copy ([[gate-negative-control]]).
+ *
+ * ⚠ Typed structurally rather than as glide's `GridSelection` for the same reason — a real
+ * `GridSelection` satisfies it (`CompactSelection` exposes `length`).
+ */
+export function rowsAuthoritative(sel: {
+  current?: unknown;
+  rows: { length: number };
+}): boolean {
+  return sel.current === undefined || sel.rows.length > 0;
+}
+
+/**
+ * ⭐ Wave-20 owner item 2 — **WHICH COLUMN A FILTER RULE IS ABOUT, and it is not always
+ * `rule.colId`.**
+ *
+ * A FORMULA-MEASURE column (`{measure:{key, window}}`, owner item 7) is `filterable:false`;
+ * its filter REPLACEMENT is a measure CONDITION carrying the same measure and window. That
+ * condition's `colId` is the MEASURE key ("revenue"), while a SORT on the very same column is
+ * written with the COLUMN key (`measure_sales_90d_…`, from `ColumnMenu`'s `onSort`). Two keys,
+ * one column — so every consumer that asked "does the filter tree name this column?" by string
+ * equality answered NO for a column the user had visibly filtered:
+ *
+ *   · the tint (`useGridColumns.columnTones`) fell through to the SORT hue, which is owner
+ *     item 2 exactly: filter > sort, violated, on the one column class where the two keys
+ *     differ. MEASURED — `_qa_wave20_tone.py` reproduced it as the only failing combination
+ *     in a 26-check sweep, with the condition provably narrowing 40 rows to 38.
+ *   · the column menu's "Don't filter by this field" (`treeNamesField`) never offered itself
+ *     on a measure column, and would have dropped nothing if it had.
+ *
+ * ⚠ The window is part of the identity, not decoration. Two columns can display the SAME
+ * measure over different windows; a condition on `last 90 days` is about the 90-day column and
+ * not about the LTM one beside it. `normalizeWindow` first, so a saved view whose window says
+ * `{kind:'last_n_days', n:'90'}` (a string, from JSON) still matches the column that declares
+ * `n: 90`.
+ *
+ * ⚠ NO GUESSING when nothing matches: a measure condition whose measure is not displayed as a
+ * column returns NO keys, so the toolbar chip carries it alone — which is correct and is what
+ * the pre-measure code did by accident. Cohort leaves (`__cohort__`) are deliberately in the
+ * same boat: the derived cohort column's key is chosen HOST-side and the client has no constant
+ * for it, and a tint on the wrong column is worse than no tint.
+ */
+export function windowKey(spec: unknown): string {
+  const w = normalizeWindow(spec);
+  return w ? `${w.kind}|${w.n ?? ""}|${w.from ?? ""}|${w.to ?? ""}` : "";
+}
+
+/** `measureKey|windowKey` -> every column key DISPLAYING that measure over that window
+ *  (a duplicated column means two, and both are about the same condition). */
+export function measureColumnIndex(fields: Field[]): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  for (const field of fields ?? []) {
+    if (!field.measure) continue;
+    const k = `${field.measure.key}|${windowKey(field.measure.window)}`;
+    const at = out.get(k);
+    if (at) at.push(field.key);
+    else out.set(k, [field.key]);
+  }
+  return out;
+}
+
+/**
+ * THE resolution, and the only one any consumer may use: the column keys this rule is about.
+ * A measure condition (the presence of `window` is the discriminator — see FilterRule.window)
+ * resolves through the index; every other rule is about its own `colId`.
+ */
+export function ruleColumnKeys(
+  rule: FilterRule,
+  measureCols?: Map<string, string[]>
+): string[] {
+  // `__cohort__` is a SENTINEL, not a column key. Returned as-is it would put a key in the
+  // tone map that no column can ever match — harmless on screen, but it makes "every key in
+  // this map is a column" false, and that is the invariant the gate checks.
+  if (rule.colId === COHORT_FIELD) return [];
+  if (rule.window)
+    return measureCols?.get(`${rule.colId}|${windowKey(rule.window)}`) ?? [];
+  return [rule.colId];
+}
+
 /**
  * CG-8 — a measure the condition builder may offer: FILTERABLE BUT NEVER DISPLAYABLE.
  *
@@ -2382,6 +2544,30 @@ export type HostEvent =
    * global, so an old bundle keeps today's behavior byte-for-byte.
    */
   | { id: string; type: "field_upsert"; field: Field; scope?: FieldScope }
+  /**
+   * ⭐ Wave-20 owner item 15 / contract C-RENAME — **a choice was RENAMED, and here is the
+   * mapping.** Emitted BESIDE the `field_upsert` that changes the declared list, never instead
+   * of it: the definition and the values are two stores, and only the definition can be written
+   * optimistically.
+   *
+   * The host rewrites (S1's half): every overlay VALUE holding `from`, and every saved view
+   * that names it in a filter or a colour-by. That second half is not tidiness — a view
+   * filtering `Stage is Blue` after Blue became Navy silently matches nothing, which looks
+   * exactly like a view whose records all went away.
+   *
+   * ⚠ EXPLICIT, never a diff. "Renamed Blue to Navy" and "deleted Blue, added Navy" produce
+   * the same pair of lists; the client knows which happened because its option rows carry
+   * stable ids, and this event is how that knowledge crosses the wire (`ColumnMenu`'s
+   * `optionRenames`). One event per SAVE, carrying every rename in it, so the migration is one
+   * pass over the values rather than one per option.
+   */
+  | {
+      id: string;
+      type: "choice_rename";
+      key: string;
+      renames: { from: string; to: string }[];
+      scope?: FieldScope;
+    }
   /**
    * Wave-5 item 1 — Duplicate field (contract AMENDMENT ~20:20: the CLIENT generates the
    * destination `key`, same prefix as `sourceKey` — the established key-generation pattern —

web/src/customer-grid/undoStack.ts

@@ -0,0 +1,189 @@
+// ---------------------------------------------------------------------------
+// customer-grid / undoStack.ts
+// ⭐ Wave-20 owner item 16 (ruling R4, contract C-UNDO) — Ctrl+Z for grid DATA.
+//
+// THE SHAPE, and why it is a module of its own rather than a hook.
+//
+// The contract says "inverse ops recorded at the write layer (optimism.ts /
+// apiBridge.ts)". Neither of those can actually hold it: `optimism.ts` is pure
+// reconciliation with no write functions, and `apiBridge.patchTopicRow` never
+// sees the value a cell held BEFORE the edit — by the time the PATCH is built,
+// the old value is gone. **An inverse can only be captured at the call site**,
+// where both halves are still in hand. So the recording happens in
+// `CustomerGrid.patchAndRecord` (one wrapper over the single `patchOverlay`
+// door every cell write already goes through), and THIS module owns the part
+// that can be reasoned about on its own: the stack, the bounds, the
+// fork-on-new-write rule, and what the inverse of each op IS.
+//
+// It imports nothing. That is deliberate and it is the only way this is
+// gateable: there is no vitest here, gates are `tsc → node` over a `_test/*.ts`,
+// and anything that pulls in React or glide cannot be loaded under node at all
+// (measured: glide's CJS build trips over its own `"type":"module"`).
+//
+// R4 SCOPE — grid DATA only: cell edits, paste, bulk clear, select/multiselect
+// value changes, ut row add/delete. NOT view config (filters, sorts, column
+// widths), NOT field definitions, NOT cohort membership. Those are governed by
+// their own echo/persistence rules and an undo that silently reverted a saved
+// view would be a second writer of the same state.
+// ---------------------------------------------------------------------------
+
+/** What a cell can hold on the wire. `null` is a real value (cleared), not "no entry". */
+export type UndoValue = string | number | null;
+
+export interface CellChange {
+  pid: number;
+  key: string;
+  before: UndoValue;
+  after: UndoValue;
+}
+
+/**
+ * One user action. A single entry can carry MANY cells — that is what makes a paste or a
+ * bulk Backspace one Ctrl+Z instead of forty (R4: "bulk Backspace = ONE grouped stack entry").
+ */
+export type UndoEntry =
+  | { kind: "cells"; label: string; changes: CellChange[] }
+  /** A ut row that was APPENDED. `values` is what it held, so redo can restore it verbatim. */
+  | { kind: "rowAdd"; table: string; rid: string | number; values: Record<string, UndoValue> }
+  /** A ut row that was DELETED, with the full row so the undo can put it back under its id. */
+  | { kind: "rowDelete"; table: string; rid: string | number; values: Record<string, UndoValue> }
+  /** Item 15 — an explicit choice rename; the inverse is the mapping turned around. */
+  | { kind: "choiceRename"; fieldKey: string; renames: { from: string; to: string }[] };
+
+export interface UndoState {
+  past: UndoEntry[];
+  future: UndoEntry[];
+}
+
+/**
+ * The stack's depth. Bounded because every entry holds the values it replaced: a session that
+ * pasted a thousand rows would otherwise keep every one of them alive for the life of the tab.
+ * Fifty user actions is far past the point where anyone reaches for Ctrl+Z rather than for the
+ * value they wanted.
+ */
+export const UNDO_MAX = 50;
+
+export const EMPTY_UNDO: UndoState = { past: [], future: [] };
+
+/**
+ * Is this entry worth a stack slot?
+ *
+ * ⚠ A cell "edit" that changed nothing is the common case, not an edge case: glide commits an
+ * edit on every editor close, including one the user opened and left alone, and a bulk clear
+ * over rows that were already blank produces a whole selection of them. Recording those makes
+ * Ctrl+Z do nothing visible — which reads as "undo is broken" rather than "there was nothing to
+ * undo". Compared as STRINGS because the overlay stratum stores strings and a number that has
+ * been through the store comes back as one (the `reconcileCellJournal` rule).
+ */
+export function meaningful(entry: UndoEntry): boolean {
+  if (entry.kind !== "cells") return true;
+  return entry.changes.some((c) => String(c.before ?? "") !== String(c.after ?? ""));
+}
+
+/** Drop the no-op cells, so an entry that survives is entirely made of real changes. */
+export function pruned(entry: UndoEntry): UndoEntry {
+  if (entry.kind !== "cells") return entry;
+  return {
+    ...entry,
+    changes: entry.changes.filter((c) => String(c.before ?? "") !== String(c.after ?? "")),
+  };
+}
+
+/**
+ * Record a new action.
+ *
+ * ⚠ IT CLEARS `future`, and that is the standard undo law rather than a simplification: once
+ * you undo three edits and then type something new, the three you undid are no longer reachable
+ * — a redo after a fork would apply a change on top of a state it was never computed against.
+ */
+export function pushUndo(state: UndoState, entry: UndoEntry): UndoState {
+  const clean = pruned(entry);
+  if (!meaningful(clean)) return state;
+  return { past: [...state.past, clean].slice(-UNDO_MAX), future: [] };
+}
+
+/** The entry to apply BACKWARD, and the state that remembers it for redo. */
+export function popUndo(state: UndoState): { state: UndoState; entry: UndoEntry | null } {
+  // `[length - 1]`, not `.at(-1)`: the gates compile this module at es2020, where
+  // `Array.prototype.at` is not in the lib — and a module a gate cannot compile is a
+  // module with no gate.
+  const entry = state.past[state.past.length - 1];
+  if (!entry) return { state, entry: null };
+  return {
+    state: { past: state.past.slice(0, -1), future: [...state.future, entry].slice(-UNDO_MAX) },
+    entry,
+  };
+}
+
+/** The entry to apply FORWARD again. */
+export function popRedo(state: UndoState): { state: UndoState; entry: UndoEntry | null } {
+  const entry = state.future[state.future.length - 1];
+  if (!entry) return { state, entry: null };
+  return {
+    state: { past: [...state.past, entry].slice(-UNDO_MAX), future: state.future.slice(0, -1) },
+    entry,
+  };
+}
+
+/**
+ * The entry as it must be applied in the given direction — the ONE place the inverse of each op
+ * is written down.
+ *
+ * `"back"` is what Ctrl+Z applies; `"forward"` is the redo. For cells the two differ only in
+ * which side of the change is written, which is why `CellChange` keeps both rather than storing
+ * a "delta" that would have to be re-derived (and could be re-derived wrongly).
+ */
+export function directed(
+  entry: UndoEntry,
+  dir: "back" | "forward"
+): UndoEntry {
+  if (dir === "forward") return entry;
+  switch (entry.kind) {
+    case "cells":
+      return {
+        ...entry,
+        changes: entry.changes.map((c) => ({ ...c, before: c.after, after: c.before })),
+      };
+    // Undoing an APPEND deletes the row; undoing a DELETE puts it back. The pair is symmetric,
+    // so inverting the kind is the whole of it — and the `values` ride along either way, because
+    // a restore needs them and a delete has to keep them for its own undo.
+    case "rowAdd":
+      return { ...entry, kind: "rowDelete" };
+    case "rowDelete":
+      return { ...entry, kind: "rowAdd" };
+    case "choiceRename":
+      return {
+        ...entry,
+        renames: entry.renames.map((r) => ({ from: r.to, to: r.from })),
+      };
+  }
+}
+
+/** What to tell the user. Short, and always a COUNT — "Undid an edit" on a 40-cell paste is a
+ *  sentence that makes them check what happened. */
+export function describe(entry: UndoEntry, dir: "back" | "forward"): string {
+  const verb = dir === "back" ? "Undid" : "Redid";
+  switch (entry.kind) {
+    case "cells": {
+      const n = entry.changes.length;
+      return `${verb} ${n === 1 ? entry.label : `${entry.label} (${n} cells)`}`;
+    }
+    case "rowAdd":
+      return `${verb} adding a record`;
+    case "rowDelete":
+      return `${verb} deleting a record`;
+    case "choiceRename": {
+      const n = entry.renames.length;
+      return `${verb} renaming ${n === 1 ? "an option" : `${n} options`}`;
+    }
+  }
+}
+
+/** Per-SCOPE stacks in one bag: the customer grid and a user table are different tables, and a
+ *  Ctrl+Z on one must never rewrite a cell on the other. Per-TAB comes for free — this lives in
+ *  component state and nothing persists it. */
+export type UndoBook = Record<string, UndoState>;
+
+export function stackFor(book: UndoBook, scope: string): UndoState {
+  return book[scope] ?? EMPTY_UNDO;
+}

web/src/customer-grid/useGridColumns.ts

@@ -1,7 +1,7 @@
 import { useCallback, useMemo } from "react";
 import type { GridColumn, Theme } from "@glideapps/glide-data-grid";
 import type { Field, FilterNode, ViewConfig } from "./types";
-import { isFilterGroup, isRuleActive } from "./types";
+import { isFilterGroup, isRuleActive, measureColumnIndex, ruleColumnKeys } from "./types";
 import { typeIconName } from "./iconShapes";
 import { fitHeaderTitle, headerLabelSpace, headerMarkSizes } from "./overlayPlacement";
 import { COLUMN_TONE_THEME, INVOLVED_HEADER_FONT, lightTheme } from "./theme";
@@ -62,14 +62,22 @@ function hasInfoMark(field: Field): boolean {
 
 /** Every column key an ACTIVE filter rule names, anywhere in the tree. Inactive (half-typed)
  *  rules are skipped: a rule that is not narrowing anything must not tint a column as though
- *  it were — that is the same "it looks like it is working" lie the engine refuses to tell. */
-function filteredKeys(nodes: FilterNode[], out: Set<string>): void {
+ *  it were — that is the same "it looks like it is working" lie the engine refuses to tell.
+ *
+ *  ⚠ Wave-20 item 2: the key a rule NAMES is not always the column it is ABOUT — a measure
+ *  condition carries the MEASURE key. `ruleColumnKeys` is the one resolution (types.ts); it
+ *  is what stopped a filtered-and-sorted measure column wearing the sort hue. */
+function filteredKeys(
+  nodes: FilterNode[],
+  out: Set<string>,
+  measureCols: Map<string, string[]>
+): void {
   for (const node of nodes ?? []) {
     if (isFilterGroup(node)) {
-      filteredKeys(node.children, out);
+      filteredKeys(node.children, out, measureCols);
       continue;
     }
-    if (isRuleActive(node)) out.add(node.colId);
+    if (isRuleActive(node)) for (const key of ruleColumnKeys(node, measureCols)) out.add(key);
   }
 }
 
@@ -107,12 +115,19 @@ function columnTheme(tone: ControlTone | undefined): Partial<Theme> | undefined
    whole-table band; the band was its only consumer, so R5 took both. That left the surviving
    precedence — the one that still paints — asserted by nothing, because `verify_icons` was
    testing the twin. Exported so the gate can reach the function that is actually on screen. */
-export function columnTones(config: ViewConfig): Map<string, ControlTone> {
+export function columnTones(
+  config: ViewConfig,
+  /* wave20 item 2 — the FIELDS, because a measure condition names its measure and only the
+     field list can say which column displays it. Defaulted so the signature stays callable
+     with a config alone (the pre-wave-20 gate legs), and because a caller with no fields
+     legitimately has no measure columns to resolve. */
+  fields: Field[] = []
+): Map<string, ControlTone> {
   const out = new Map<string, ControlTone>();
   if (config.groupBy) out.set(config.groupBy, "group");
   for (const s of config.sorts ?? []) out.set(s.colId, "sort");
   const filtered = new Set<string>();
-  filteredKeys(config.filters ?? [], filtered);
+  filteredKeys(config.filters ?? [], filtered, measureColumnIndex(fields));
   for (const key of filtered) out.set(key, "filter");
   return out;
 }
@@ -199,9 +214,11 @@ export function useGridColumns(
   );
 
   // Item 22 — recomputed only when the three controls move, not on every width drag.
+  // Wave-20 item 2 adds `fields`: a measure condition can only be resolved to the column that
+  // displays it, and a new measure column must re-tint without waiting for a control to move.
   const tones = useMemo(
-    () => columnTones(config),
-    [config.filters, config.sorts, config.groupBy]  // eslint-disable-line react-hooks/exhaustive-deps
+    () => columnTones(config, fields),
+    [config.filters, config.sorts, config.groupBy, fields]  // eslint-disable-line react-hooks/exhaustive-deps
   );
 
   const visibleCols = useMemo<GridColumn[]>(

web/src/customer-grid/useGridSelection.ts

@@ -19,6 +19,7 @@ import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { CompactSelection } from "@glideapps/glide-data-grid";
 import type { GridSelection, Item } from "@glideapps/glide-data-grid";
 import type { VisibleRow } from "./types";
+import { rowsAuthoritative } from "./types";
 
 export interface GridSelectionApi {
   gridSelection: GridSelection;
@@ -99,6 +100,9 @@ export function useGridSelection(
       // follows across row-pipeline rebuilds.
       const at = sel.current ? visibleRows[sel.current.cell[1]] : undefined;
       currentPidRef.current = at && at.kind === "data" ? at.record.pid : null;
+      // Owner item 14 — the active cell moves; the CHECKED ROWS do not, unless this event is
+      // actually about them. See `rowsAuthoritative`.
+      if (!rowsAuthoritative(sel)) return;
       // Translate the new row index-set back to pids (guard synthetic rows).
       const pids = new Set<number>();
       for (const i of sel.rows) {

web/src/customer-grid/useVisibleRows.ts

@@ -580,7 +580,12 @@ function groupRows(
   };
   for (const r of rows) {
     const raw = r[groupBy];
-    const cell = raw == null ? "" : String(raw);
+    // ⭐ Wave-20 item 11 — TRIMMED. User-created text columns are groupable now, and typed text
+    // carries stray spaces: "Miami" and "Miami " are the same bucket to a reader and were two
+    // groups here, one of which looked empty-labelled. The multi path below already trimmed its
+    // members; this is the single-value half of the same rule. A cell of only spaces trims to
+    // "" and joins "(empty)", which is what it looks like on screen.
+    const cell = raw == null ? "" : String(raw).trim();
     const keys = isMulti
       ? cell.split(",").map((s) => s.trim()).filter((s) => s !== "")
       : [cell];

web/src/index.css

@@ -8199,106 +8199,637 @@ a.cg-map-ctl-b { text-decoration: none; }
   }
 }
 /* == /W19-D == */
-
-/* == EXIT-6 STATEMENTS == */
-/* `settings/StatementsPane.tsx` — the statement-of-account sender, ported off
-   `app.py::_collections_statements` when Streamlit was deleted.
-
-   ⛔ WHY THE TABLE RULES ARE `stmt-` AND NOT `set-table`. The accounts table was
-   removed in wave 17 (R7) and its rules deliberately went with it, with a note
-   in this file saying a dead rule with a plausible name is worse than no rule
-   because the next thing needing a table adopts decisions nobody made for it.
-   This IS that next thing, so it declares its own, named for its one purpose.
-
-   Quiet by intent: this pane ends in a control that emails real customers, so
-   nothing here competes with the confirm block for attention. */
-.stmt-row { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin: 12px 0 0; }
-.stmt-row .set-input { width: auto; min-width: 180px; flex: 1 1 180px; }
-.stmt-small { margin-top: 6px; }
-.stmt-stack { display: flex; flex-direction: column; gap: 10px; margin-top: 12px; }
-.stmt-wide { width: 100%; }
-.stmt-link {
-  margin-top: 14px;
-  padding: 0;
-  border: 0;
-  background: none;
-  color: var(--lp-blue-deep);
-  font: inherit;
-  font-size: var(--lp-fs-2xs);
-  font-weight: 600;
-  cursor: pointer;
-  text-align: left;
-}
-.stmt-textarea {
-  width: 100%;
-  padding: 8px 10px;
-  border: 1px solid var(--lp-line);
-  border-radius: var(--lp-r-sm);
-  background: var(--lp-surface);
-  color: var(--lp-ink);
-  font: inherit;
-  font-size: var(--lp-fs-xs);
-  line-height: var(--lp-lh);
-  resize: vertical;
-}
-/* The worklist scrolls INSIDE its own box. A dunning list is hundreds of rows and
-   the settings modal must not grow a second scrollbar for it. */
-.stmt-tablewrap {
-  margin-top: 12px;
-  max-height: 340px;
-  overflow: auto;
-  border: 1px solid var(--lp-line);
-  border-radius: var(--lp-r-sm);
-}
-.stmt-tablewrap--short { max-height: 200px; }
-.stmt-table { width: 100%; border-collapse: collapse; font-size: var(--lp-fs-2xs); }
-.stmt-table th,
-.stmt-table td { padding: 6px 10px; text-align: left; border-bottom: 1px solid var(--lp-line); }
-/* Sticky head: scrolling 400 dunning rows without column labels is unreadable. */
-.stmt-table thead th {
-  position: sticky;
-  top: 0;
-  z-index: 1;
-  background: var(--lp-surface-2);
-  font-weight: 620;
-}
-.stmt-table tbody tr:last-child td { border-bottom: 0; }
-.stmt-table tbody tr.is-picked { background: var(--lp-blue-tint); }
-/* Money aligns right, everywhere in this product. */
-.stmt-num { text-align: right; font-variant-numeric: tabular-nums; }
-.stmt-table th.stmt-num { text-align: right; }
-/* ⚠ AMBER, NOT `.set-notice` (green) AND NOT `.set-error` (red). The SAFE_MODE
-   banner is neither success nor failure — it is a live restriction, and dressing
-   a guardrail in green is how somebody reads "ON" as "you are clear to send". */
-.stmt-warn {
-  margin: 0 0 12px;
-  padding: 9px 12px;
-  border-radius: var(--lp-r-sm);
-  background: var(--lp-yellow-tint);
-  color: var(--lp-yellow-deep);
-  font-size: var(--lp-fs-2xs);
-  line-height: var(--lp-lh);
-}
-.stmt-details { margin-top: 10px; font-size: var(--lp-fs-2xs); }
-.stmt-details summary { cursor: pointer; font-weight: 600; }
-/* The rendered statement is OUR html from OUR template, but it is still foreign
-   markup inside a pane: box it so its own font sizes cannot reflow the modal. */
-.stmt-preview {
-  margin-top: 10px;
-  padding: 12px;
-  max-height: 320px;
-  overflow: auto;
-  border: 1px solid var(--lp-line);
-  border-radius: var(--lp-r-sm);
-  background: var(--lp-surface);
-}
-.stmt-preview img { max-width: 100%; }
-/* The confirm block is the loudest thing on the pane, on purpose. */
-.stmt-confirm {
-  margin-top: 16px;
-  padding: 12px;
-  border: 1px solid var(--lp-line);
-  border-radius: var(--lp-r-sm);
-  background: var(--lp-surface-2);
-}
-.stmt-confirm .stmt-row { margin-top: 12px; }
+
+/* == EXIT-6 STATEMENTS == */
+/* `settings/StatementsPane.tsx` — the statement-of-account sender, ported off
+   `app.py::_collections_statements` when Streamlit was deleted.
+
+   ⛔ WHY THE TABLE RULES ARE `stmt-` AND NOT `set-table`. The accounts table was
+   removed in wave 17 (R7) and its rules deliberately went with it, with a note
+   in this file saying a dead rule with a plausible name is worse than no rule
+   because the next thing needing a table adopts decisions nobody made for it.
+   This IS that next thing, so it declares its own, named for its one purpose.
+
+   Quiet by intent: this pane ends in a control that emails real customers, so
+   nothing here competes with the confirm block for attention. */
+.stmt-row { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin: 12px 0 0; }
+.stmt-row .set-input { width: auto; min-width: 180px; flex: 1 1 180px; }
+.stmt-small { margin-top: 6px; }
+.stmt-stack { display: flex; flex-direction: column; gap: 10px; margin-top: 12px; }
+.stmt-wide { width: 100%; }
+.stmt-link {
+  margin-top: 14px;
+  padding: 0;
+  border: 0;
+  background: none;
+  color: var(--lp-blue-deep);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+  cursor: pointer;
+  text-align: left;
+}
+.stmt-textarea {
+  width: 100%;
+  padding: 8px 10px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-surface);
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-xs);
+  line-height: var(--lp-lh);
+  resize: vertical;
+}
+/* The worklist scrolls INSIDE its own box. A dunning list is hundreds of rows and
+   the settings modal must not grow a second scrollbar for it. */
+.stmt-tablewrap {
+  margin-top: 12px;
+  max-height: 340px;
+  overflow: auto;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+}
+.stmt-tablewrap--short { max-height: 200px; }
+.stmt-table { width: 100%; border-collapse: collapse; font-size: var(--lp-fs-2xs); }
+.stmt-table th,
+.stmt-table td { padding: 6px 10px; text-align: left; border-bottom: 1px solid var(--lp-line); }
+/* Sticky head: scrolling 400 dunning rows without column labels is unreadable. */
+.stmt-table thead th {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  background: var(--lp-surface-2);
+  font-weight: 620;
+}
+.stmt-table tbody tr:last-child td { border-bottom: 0; }
+.stmt-table tbody tr.is-picked { background: var(--lp-blue-tint); }
+/* Money aligns right, everywhere in this product. */
+.stmt-num { text-align: right; font-variant-numeric: tabular-nums; }
+.stmt-table th.stmt-num { text-align: right; }
+/* ⚠ AMBER, NOT `.set-notice` (green) AND NOT `.set-error` (red). The SAFE_MODE
+   banner is neither success nor failure — it is a live restriction, and dressing
+   a guardrail in green is how somebody reads "ON" as "you are clear to send". */
+.stmt-warn {
+  margin: 0 0 12px;
+  padding: 9px 12px;
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-yellow-tint);
+  color: var(--lp-yellow-deep);
+  font-size: var(--lp-fs-2xs);
+  line-height: var(--lp-lh);
+}
+.stmt-details { margin-top: 10px; font-size: var(--lp-fs-2xs); }
+.stmt-details summary { cursor: pointer; font-weight: 600; }
+/* The rendered statement is OUR html from OUR template, but it is still foreign
+   markup inside a pane: box it so its own font sizes cannot reflow the modal. */
+.stmt-preview {
+  margin-top: 10px;
+  padding: 12px;
+  max-height: 320px;
+  overflow: auto;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-surface);
+}
+.stmt-preview img { max-width: 100%; }
+/* The confirm block is the loudest thing on the pane, on purpose. */
+.stmt-confirm {
+  margin-top: 16px;
+  padding: 12px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-surface-2);
+}
+.stmt-confirm .stmt-row { margin-top: 12px; }
+
+/* ==== wave20:S4 shell+rail ====================================================
+   WAVE 20, SESSION S4 — the shell frame and the views rail. Owner items 4, 7,
+   19, 20, 21, 22, 24 (+ 18/23/25/26 once S1 posts C-SHARE / C-ALERT).
+
+   ⚠ Everything in this block is scoped under a class this session owns, or is a
+   deliberate specificity correction NAMED as one. Nothing here is edited by any
+   other session, and this session edits nothing outside it (the wave-17 scar:
+   four sessions, one stylesheet, line numbers that moved under each other).
+   ============================================================================ */
+
+/* ── Item 24 — a primary CTA that is only primary ON HOVER ──────────────────
+   `.shell-newdb-actions button` (0,1,1) OUT-RANKS `.login-submit` (0,1,0), so
+   every primary button inside a shell dialog rendered white-on-ink at REST and
+   only turned purple under the pointer — the AI-assistant note's Close (owner
+   item 24) and, from the same cause, the New-database dialog's "Create
+   database". The fix is the specificity, not a new colour: this rule is (0,2,0),
+   so it wins at rest, while `.login-submit:hover:not(:disabled)` (0,3,0) and
+   `:focus-visible` still win over it — the button keeps ONE hover shade and one
+   focus ring, published once at `.login-submit`.
+   Tokens, never literals: `--shell-on-solid` is the MEASURED white for text on
+   `--lp-primary` (7.71:1), declared by `.login-submit` itself and inherited here
+   rather than re-typed as `#fff`. The row's unclassed buttons (Cancel) are
+   untouched — a dialog has one primary. */
+.shell-newdb-actions .login-submit {
+  color: var(--shell-on-solid);
+  background: var(--lp-primary);
+  border-color: var(--lp-primary);
+}
+
+/* ── Item 21 — the folder row's "…" is ALWAYS visible ───────────────────────
+   `.cg-view-more` ships `opacity: 0` and is revealed by `.cg-view-row:hover` /
+   `.is-active`. A FOLDER head is not a `.cg-view-row`, so no rule ever revealed
+   it: the folder's actions button was painted at zero opacity in every state but
+   keyboard focus — present, clickable, invisible ([[ui-invisible-to-assertions]]
+   in reverse). The count badge that sat beside it is deleted in the markup; this
+   makes the control it was standing in front of actually appear. (0,2,0) over
+   the base rule's (0,1,0). */
+.cg-fold-head .cg-view-more { opacity: 1; }
+
+/* ── Item 22 — the folder menu's ARMED delete may use two lines ─────────────
+   The one stated exception to R7's "a menu row is ONE LINE". Every other row in
+   both menus is closed vocabulary that fits; this one is a sentence
+   ("Delete folder? Its views move to the top level."), and under `nowrap` with a
+   260px panel it ran outside the box. Wrapping is the only option that keeps a
+   confirmation readable — an ellipsised confirm asks the reader to agree to a
+   sentence they cannot finish. Armed only, so the resting menu is unchanged. */
+.cg-view-menu button.is-armed { white-space: normal; }
+.cg-view-menu button.is-armed .cg-mi-text { overflow: visible; text-overflow: clip; }
+
+/* ── Item 20 — the create flyout's SECOND step, in the SAME box ─────────────
+   Step 2 (name + who-can-edit) now renders inside the same `AnchoredOverlay` as
+   the type chooser. `.cg-view-create` carries its own border, background and
+   margins for the rail-inline placement it used to have; inside the panel that
+   would draw a second box inside the first. Geometry only — the form's own
+   controls are unchanged, which is the point of the item. */
+.cg-create-flyout .cg-create-form {
+  margin: 0;
+  padding: 2px;
+  border: 0;
+  background: transparent;
+}
+.cg-create-flyout .cg-create-form > label:first-child {
+  display: block;
+  margin-bottom: 4px;
+  font-size: var(--lp-fs-3xs);
+  font-weight: 600;
+  color: var(--lp-muted);
+}
+/* ⚠ THE PANEL IS A MENU, AND `.cg-view-menu button` (0,1,1) OUT-RANKS `.cg-btn` (0,1,0).
+   Moving the form inside the flyout therefore repainted its Create/Cancel as full-width,
+   left-aligned, borderless MENU ROWS — the panel's own row style applied to a form's
+   buttons. Caught by READING the screenshot: every assertion about the step (geometry,
+   focus, labels) was green while the two buttons looked like list items
+   ([[ui-invisible-to-assertions]]). These rules restate `.cg-btn`'s own declarations at a
+   specificity that wins inside the panel; they are a copy of that rule, never a second
+   opinion about what a button looks like. */
+.cg-create-flyout .cg-create-form .cg-btn {
+  width: auto;
+  min-height: 28px;
+  padding: 0 9px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  background: var(--cg-white);
+  color: var(--cg-text);
+  font-size: var(--lp-fs-2xs);
+  text-align: center;
+}
+.cg-create-flyout .cg-create-form .cg-btn:hover:not(:disabled) { background: var(--cg-soft); }
+.cg-create-flyout .cg-create-form .cg-btn--primary {
+  border-color: var(--lp-primary);
+  background: var(--lp-primary);
+  color: var(--cg-white);
+}
+.cg-create-flyout .cg-create-form .cg-btn--primary:hover:not(:disabled) {
+  background: var(--lp-primary-hover);
+}
+/* The who-can-edit rows are `<label>`s, and `.cg-view-create label` (0,1,1) stacks every
+   label in a create form into a COLUMN — so the radio sat above its own words rather than
+   beside them. Pre-dates this wave (the same two rules met in the rail-inline form), but
+   item 20 makes these three rows the whole content of a small panel, where a radio floating
+   over its label is the first thing you see. Scoped to the flyout: nothing else that reads
+   `.cg-view-create label` moves. */
+.cg-create-flyout .cg-perm-row {
+  flex-direction: row;
+  align-items: flex-start;
+  gap: 9px;
+}
+
+/* ── Item 19 (C-FOLDER-REORDER) — dragging a FOLDER to reorder ──────────────
+   A private drag MIME (`application/x-loopable-fold`) keeps this apart from the
+   view drag, which carries `text/plain`; the indicator is an insertion RULE at
+   the top edge of the folder you would land above, never a fill, because a
+   filled folder already means "drop this view INTO me" (`.is-drop`). */
+.cg-fold.is-folddrag,
+.cg-fold-root.is-folddrag { opacity: 0.45; }
+.cg-fold.is-drop-above,
+.cg-fold-root.is-drop-above { box-shadow: inset 0 2px 0 0 var(--lp-primary); }
+/* ⛔ NO `.cg-fold-grip` RULE, because there is no grip — see the note at the folder head in
+   ViewSidebar.tsx. A handle in flow moves the folder name off the measured indent this rail
+   spent wave-10 item 2 getting right, and the gutter it could hide in belongs to the
+   disclosure chevron. The head drags whole, exactly as the view rows under it already do. */
+
+/* ── Item 4 (R8 / C-ADDROW) — the UNIVERSAL database header ─────────────────
+   Every database wears the same header: a chip in a bold colour with a white
+   mark, then the database's name (`reference/Airtable 6.png`). It replaces the
+   `shell-ut-bar`, which existed on user tables ONLY and carried the "Add record"
+   button that S3's trailing "+" row supersedes.
+   ⚠ THE HEIGHT CHAIN IS LOAD-BEARING: glide measures its parent, so a frame that
+   forgets `min-height: 0` or `flex: 1 1 auto` gives the canvas 0px and paints a
+   blank grid that looks like a working page. These three rules are the wave-18
+   `.shell-ut-frame` chain, kept intact rather than re-derived. */
+.shell-db-frame {
+  display: flex;
+  flex-direction: column;
+  width: 100%;
+  height: 100%;
+  min-height: 0;
+  overflow: hidden;
+}
+.shell-db-frame > .shell-grid-host { flex: 1 1 auto; min-height: 0; height: auto; }
+.shell-db-head {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex: 0 0 auto;
+  padding: 9px 16px;
+  border-bottom: 1px solid var(--lp-line);
+  background: var(--lp-surface);
+}
+/* The chip is the one place in the product that paints a mark ON a solid tone
+   rather than beside one. Every pairing below is white on a `-deep` token, whose
+   measured ratio is published beside its declaration: primary 7.71:1, ink
+   15.42:1, yellow 5.61:1, green 5.52:1, red 5.35:1, blue 3.29:1 — the last is
+   under the 4.5:1 TEXT bar and over the 3:1 bar for a graphical object, which is
+   what a 16px glyph is. */
+.shell-db-chip {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  flex: 0 0 auto;
+  width: 26px;
+  height: 26px;
+  border-radius: var(--lp-r-md);
+  background: var(--lp-primary);
+  color: var(--shell-on-solid, #ffffff);
+}
+.shell-db-chip--neutral { background: var(--lp-ink); }
+.shell-db-chip--blue { background: var(--lp-blue-deep); }
+.shell-db-chip--green { background: var(--lp-green-deep); }
+.shell-db-chip--yellow { background: var(--lp-yellow-deep); }
+.shell-db-chip--red { background: var(--lp-red-deep); }
+/* `.shell-nav-icon` dims to 0.55 for the rail; on a solid chip that reads as a
+   half-erased glyph. And `FolderMark` paints its own `-deep` stroke — legible on
+   the white rail, invisible on its own tone — so inside the chip the mark takes
+   the chip's ink, which is the measured white above. */
+.shell-db-chip .shell-nav-icon { opacity: 1; }
+.shell-db-chip .cg-folder-mark path { stroke: currentColor; }
+/* An `h1` — so the UA's own heading margins and 2em size have to be reset here, or the
+   header row grows to 60px and the name lands off the chip's centre line. */
+.shell-db-name {
+  margin: 0;
+  min-width: 0;
+  overflow: hidden;
+  font-size: var(--lp-fs-md);
+  font-weight: 650;
+  color: var(--lp-ink);
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+/* ── Items 18 / 23 / 26 (R10, C-SHARE) — the access editor ──────────────────
+   One dialog for a view, a folder and a database, in the shell's existing dialog
+   family (`.shell-newdb`'s box, so a third modal does not introduce a third look).
+   The rail's second mark is `.cg-view-shared`, mirroring `.cg-view-lock` token for
+   token — they sit side by side on the same row and must read as one family. */
+.cg-view-shared {
+  flex: 0 0 auto;
+  display: inline-flex;
+  align-items: center;
+  margin-left: auto;
+  padding-left: 4px;
+  color: var(--lp-muted);
+}
+/* ⚠ When BOTH marks are present the second one must not claim the auto margin as
+   well, or the pair splits across the row with the name stranded between them. */
+.cg-view-shared + .cg-view-lock { margin-left: 0; }
+.shell-share { width: 460px; }
+/* The one-line answer, above the rows that spell it out. Muted and small: it
+   REPEATS what the list says, so it must not compete with it — its whole value is
+   being readable before the eye reaches the rows. */
+.shell-share-summary {
+  margin: 14px 0 0;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+  font-weight: 600;
+}
+.shell-share-summary + .shell-share-list { margin-top: 6px; }
+.shell-share-wait { display: flex; justify-content: center; padding: 18px 0; }
+.shell-share-list {
+  margin-top: 14px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  overflow: hidden;
+}
+.shell-share-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 7px 10px;
+  border-bottom: 1px solid var(--lp-line);
+  font-size: var(--lp-fs-xs);
+}
+.shell-share-row:last-child { border-bottom: 0; }
+.shell-share-row.is-owner { background: var(--lp-wash); }
+.shell-share-who {
+  flex: 1 1 auto;
+  min-width: 0;
+  overflow: hidden;
+  color: var(--lp-ink);
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.shell-share-role { flex: 0 0 auto; color: var(--lp-muted); font-size: var(--lp-fs-2xs); }
+.shell-share-empty {
+  padding: 10px;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+}
+.shell-share-select {
+  flex: 0 0 auto;
+  max-width: 190px;
+  padding: 4px 6px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+  background: var(--lp-surface);
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+}
+.shell-share-select:disabled { opacity: 0.55; }
+.shell-share-revoke {
+  flex: 0 0 auto;
+  border: 0;
+  border-radius: var(--lp-r-sm);
+  padding: 4px 6px;
+  background: transparent;
+  color: var(--lp-red-deep);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  cursor: pointer;
+}
+.shell-share-revoke:hover:not(:disabled) { background: var(--lp-red-tint); }
+.shell-share-revoke:disabled { opacity: 0.45; cursor: not-allowed; }
+.shell-share-add {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-top: 12px;
+}
+/* `.login-submit` is `display:block; width:100%` — right for a form's one button,
+   wrong for the third control in a row. Same reset `.shell-hero-create` takes. */
+.shell-share-grant {
+  display: inline-block;
+  width: auto;
+  height: auto;
+  margin-top: 0;
+  padding: 6px 12px;
+}
+.shell-share-blurb,
+.shell-share-note {
+  flex: 1 1 100%;
+  margin: 2px 0 0;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+  line-height: 1.4;
+}
+.shell-share-note { margin-top: 12px; }
+
+/* ── Item 25 (C-ALERT) — the Alerts row, its badge, and the inbox ───────────
+   The row is a `<button>` wearing `.shell-nav-item`, so the UA's own button
+   chrome has to go or it renders as a grey box in a rail of links (the wave-19
+   R11 complaint, in the one place a nav row is not an anchor). */
+.shell-nav-alerts {
+  width: 100%;
+  border: 0;
+  background: transparent;
+  font: inherit;
+  text-align: left;
+  cursor: pointer;
+}
+.shell-nav-badge {
+  flex: 0 0 auto;
+  margin-left: auto;
+  min-width: 18px;
+  padding: 1px 5px;
+  border-radius: var(--lp-r-pill);
+  background: var(--lp-primary);
+  color: var(--shell-on-solid, #ffffff);
+  font-size: var(--lp-fs-4xs);
+  font-weight: 600;
+  font-variant-numeric: tabular-nums;
+  text-align: center;
+}
+/* Collapsed, the label is gone and the badge would sit alone in a 56px strip
+   pretending to be the icon. It rides the mark's top-right corner instead. */
+.shell-side.is-collapsed .shell-nav-badge {
+  position: absolute;
+  top: 2px;
+  right: 6px;
+  margin-left: 0;
+}
+.shell-side.is-collapsed .shell-nav-alerts { position: relative; }
+.alerts-pane {
+  width: 520px;
+  max-width: calc(100vw - 48px);
+  max-height: 76vh;
+  display: flex;
+  flex-direction: column;
+  background: var(--lp-surface);
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-lg);
+  box-shadow: 0 18px 50px rgba(15, 23, 42, 0.18);
+  overflow: hidden;
+}
+.alerts-head {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 16px 20px 10px;
+}
+.alerts-head h2 {
+  flex: 1 1 auto;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin: 0;
+  font-size: var(--lp-fs-md);
+  font-weight: 650;
+  color: var(--lp-ink);
+}
+.alerts-bell {
+  width: 18px;
+  height: 18px;
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.3;
+  stroke-linecap: round;
+  stroke-linejoin: round;
+}
+.alerts-markall {
+  flex: 0 0 auto;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-sm);
+  padding: 4px 9px;
+  background: var(--lp-surface);
+  color: var(--lp-ink);
+  font: inherit;
+  font-size: var(--lp-fs-2xs);
+  cursor: pointer;
+}
+.alerts-markall:hover:not(:disabled) { background: var(--lp-wash); }
+.alerts-markall:disabled { opacity: 0.45; cursor: not-allowed; }
+.alerts-scroll { flex: 1 1 auto; min-height: 0; overflow: auto; padding: 0 20px; }
+.alerts-empty {
+  margin: 8px 0 16px;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+  line-height: 1.5;
+}
+.alerts-list { list-style: none; margin: 0; padding: 0; }
+.alerts-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  border-bottom: 1px solid var(--lp-line);
+}
+.alerts-row-main {
+  flex: 1 1 auto;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  border: 0;
+  background: transparent;
+  padding: 9px 4px;
+  font: inherit;
+  text-align: left;
+  cursor: pointer;
+}
+.alerts-row-label {
+  overflow: hidden;
+  color: var(--lp-ink);
+  font-size: var(--lp-fs-xs);
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+/* The unread mark is WEIGHT plus a dot, never colour alone — the row already
+   carries two colours' worth of meaning and a third would need explaining. */
+.alerts-row.is-unread .alerts-row-label { font-weight: 650; }
+.alerts-row.is-unread .alerts-row-label::before {
+  content: "";
+  display: inline-block;
+  width: 6px;
+  height: 6px;
+  margin-right: 7px;
+  border-radius: 50%;
+  background: var(--lp-primary);
+  vertical-align: middle;
+}
+.alerts-row-meta { color: var(--lp-muted); font-size: var(--lp-fs-3xs); }
+.alerts-row-toggle {
+  flex: 0 0 auto;
+  border: 0;
+  border-radius: var(--lp-r-sm);
+  padding: 4px 7px;
+  background: transparent;
+  color: var(--lp-muted);
+  font: inherit;
+  font-size: var(--lp-fs-3xs);
+  cursor: pointer;
+}
+.alerts-row-toggle:hover { background: var(--lp-wash); color: var(--lp-ink); }
+.alerts-watching { margin: 18px 0 10px; }
+.alerts-watching h3 {
+  margin: 0 0 6px;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-3xs);
+  font-weight: 600;
+}
+.alerts-watch-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 6px 0;
+  border-top: 1px solid var(--lp-line);
+  font-size: var(--lp-fs-2xs);
+}
+.alerts-watch-label {
+  flex: 1 1 auto;
+  min-width: 0;
+  overflow: hidden;
+  color: var(--lp-ink);
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.alerts-watch-meta { flex: 0 0 auto; color: var(--lp-muted); font-size: var(--lp-fs-3xs); }
+.alerts-watch-run,
+.alerts-watch-del {
+  flex: 0 0 auto;
+  border: 0;
+  border-radius: var(--lp-r-sm);
+  padding: 3px 7px;
+  background: transparent;
+  color: var(--lp-muted);
+  font: inherit;
+  font-size: var(--lp-fs-3xs);
+  cursor: pointer;
+}
+.alerts-watch-run:hover:not(:disabled) { background: var(--lp-wash); color: var(--lp-ink); }
+.alerts-watch-del { color: var(--lp-red-deep); }
+.alerts-watch-del:hover:not(:disabled) { background: var(--lp-red-tint); }
+.alerts-foot { padding: 10px 20px 16px; margin-top: 0; }
+
+/* ── Item 7 (R9) — the collapsed rail expands from its own background ───────
+   The strip's blank area is now a click target, so it says so. Interactive
+   children keep their own cursor (the UA default for a link/button is already
+   `pointer`), and `.shell-brand-btn` keeps the explicit one it had. */
+.shell-side.is-collapsed { cursor: pointer; }
+
+/* ==== /wave20:S4 ==== */
+
+/* ==== wave20:S3 grid =========================================================
+   S3's region. Everything below belongs to the grid surface (customer-grid/,
+   ui/, filter-kit/). Comment-anchored, never line-numbered: index.css is shared
+   with S1/S4 this wave and is staged LAST by the integrator.
+   ============================================================================= */
+
+/* Owner item 5 — THE ADD-FIELD "+" HUGS THE LAST COLUMN.
+   glide lays its `rightElement` out as [ .dvn-stack (the columns) | .dvn-spacer |
+   the element ], and its own rule `…  .dvn-scroll-inner .dvn-spacer { flex-grow: 1 }`
+   makes that spacer eat every pixel between the last column and the right edge of the
+   scroller. Unpinning the wrapper (`rightElementProps.sticky = false`) is therefore only
+   half the fix: without this the button lands back on the window edge, one flex rule later.
+
+   ⚠ THE DOUBLED CLASS IS DELIBERATE. glide's selector is `.gdg-… .dvn-scroll-inner
+   .dvn-spacer` — three classes, exactly the specificity of the obvious `.cg-grid-box
+   .dvn-scroll-inner .dvn-spacer`, and at a tie the LATER rule wins. Which of the two
+   stylesheets lands later is a bundler ordering detail (glide's CSS is imported from
+   CustomerGrid.tsx, ours from main.tsx), and this project has already lost one rule to
+   exactly that coin flip ([[loopable-nav-logo-toggle]]). `.cg-grid-box.cg-grid-box`
+   repeats a class that is genuinely on the element, costs nothing, and wins on
+   specificity rather than on order. */
+.cg-grid-box.cg-grid-box .dvn-scroll-inner .dvn-spacer { flex-grow: 0; }
+
+/* Owner item 9 — the count each row of the remove picker would take out ("3 of 4"). Pushed to
+   the trailing edge with `margin-left: auto` rather than a spacer element, and allowed to
+   shrink last: the cohort NAME is what the reader is choosing between, so it keeps the
+   ellipsis budget (`.cg-pick-row` above) and this never wraps. */
+.cg-pick-hint {
+  margin-left: auto;
+  padding-left: 10px;
+  color: var(--lp-muted);
+  font-size: var(--lp-fs-2xs);
+  font-variant-numeric: tabular-nums;
+  white-space: nowrap;
+  flex: 0 0 auto;
+}
+
+/* ==== /wave20:S3 ==== */

web/src/settings/AdminPane.tsx

@@ -1,568 +1,646 @@
-// ---------------------------------------------------------------------------
-// settings / AdminPane.tsx — THE LOOPABLE ADMIN PLANE (wave 19, owner item 13 /
-// R3+R4, contract C2).
-//
-// The one surface in this product that looks ACROSS tenants: who our customers
-// are, how many people use each workspace, what they have built in it, whether
-// their data sources are alive, and what the automation fleet costs.
-//
-// SELF-CONTAINED BY CONTRACT (C2). It fetches its own data via
-// `platformAdminApi` and takes ONE prop, so mounting it is a rail entry plus a
-// line in the pane switch — `SettingsModal.tsx` is another session's file this
-// wave and must not have to learn anything about this pane's data.
-//
-// ⚠ THE PROP IS TYPED STRUCTURALLY, not as `SessionUser` from `../shell/session`.
-// The mount site passes the shell's session user (a wider object), which
-// satisfies this shape by structural typing — and this pane therefore imports
-// nothing from the shell, which is what the wave's cross-fence rule asks for
-// while `session.ts` is open on another desk.
-//
-// ⛔ EVERY NUMBER HERE IS THE SERVER'S, AND EVERY NUMBER DRILLS. Clicking a count
-// opens the rows it was computed from — the same collector, projected twice
-// ([[no-unverifiable-aggregates]]). A count that could not be READ renders as an
-// em dash with the reason, never as a zero: "this customer has no databases" and
-// "we could not look" are different facts and the pane refuses to conflate them.
-//
-// DESIGN: sentence-case micro-labels (R6 — no caps in app chrome), short noun
-// headers, tabular figures right-aligned, hairlines not shadows, tokens only,
-// no emojis (DESIGN.md §2–§4).
-// ---------------------------------------------------------------------------
-
-import { useCallback, useEffect, useState } from "react";
-import type {
-  AutomationRow,
-  ConnectorRow,
-  DatabaseRow,
-  FleetCost,
-  Overview,
-  PlatformUser,
-} from "./platformAdminApi";
-import {
-  getAutomations,
-  getAws,
-  getConnectors,
-  getDatabases,
-  getOverview,
-  getUsers,
-} from "./platformAdminApi";
-
-// --- formatting -------------------------------------------------------------
-
-const int = (n: number) => n.toLocaleString();
-
-/** A count that may be unknown. `null` is NOT zero — see the api module's header. */
-function Count({ n, why }: { n: number | null | undefined; why?: string }) {
-  if (n === null || n === undefined)
-    return (
-      <span className="padmin-unknown" title={why || "This could not be read just now"}>
-        —
-      </span>
-    );
-  return <>{int(n)}</>;
-}
-
-/** "3 days ago" for a stamp, "never" for an absent one. Never a fabricated date.
- *
- *  ⛔ ONLY FOR OFFSET-BEARING STAMPS. `Date.parse` reads a stamp with no zone as
- *  BROWSER-LOCAL, so running a container-local timestamp through this reports the
- *  viewer's UTC offset as elapsed time — hours of error in a column people scan,
- *  and a future-dated stamp that renders as "just now" indefinitely. Everything
- *  this pane passes here (`last_login`, `last_active`, `generatedAt`) is written
- *  with an explicit offset; the automation engine's `lastRunAt` is NOT, so it is
- *  rendered verbatim instead. */
-function ago(stamp: string): string {
-  if (!stamp) return "never";
-  const t = Date.parse(stamp.includes("T") ? stamp : stamp.replace(" ", "T"));
-  if (Number.isNaN(t)) return stamp;
-  const mins = Math.floor((Date.now() - t) / 60000);
-  if (mins < 2) return "just now";
-  if (mins < 60) return `${mins} minutes ago`;
-  const hours = Math.floor(mins / 60);
-  if (hours < 24) return `${hours} hour${hours === 1 ? "" : "s"} ago`;
-  const days = Math.floor(hours / 24);
-  if (days < 60) return `${days} day${days === 1 ? "" : "s"} ago`;
-  return `${Math.floor(days / 30)} months ago`;
-}
-
-type DrillKind = "users" | "databases" | "connectors" | "automations";
-
-const DRILL_NOUN: Record<DrillKind, string> = {
-  users: "People",
-  databases: "Databases",
-  connectors: "Data sources",
-  automations: "Automations",
-};
-
-/** The loading shape — a skeleton, not a spinner (DESIGN.md §4). */
-function Skeleton({ rows = 3 }: { rows?: number }) {
-  return (
-    <div className="padmin-skel" aria-hidden="true">
-      {Array.from({ length: rows }, (_, i) => (
-        <div key={i} className="padmin-skel-row" />
-      ))}
-    </div>
-  );
-}
-
-// --- the pane ---------------------------------------------------------------
-
-export function AdminPane({ user }: { user: { username: string; name: string; role: string } }) {
-  const [ov, setOv] = useState<Overview | null>(null);
-  const [err, setErr] = useState("");
-  const [fleet, setFleet] = useState<{ rows: AutomationRow[]; cost: FleetCost } | null>(null);
-
-  const [drill, setDrill] = useState<{ kind: DrillKind; tenant: string } | null>(null);
-  const [drillRows, setDrillRows] = useState<unknown[] | null>(null);
-  const [drillNote, setDrillNote] = useState("");
-
-  const [aws, setAws] = useState<{ text: string; note: string; available: boolean } | null>(null);
-  const [awsBusy, setAwsBusy] = useState(false);
-
-  const load = useCallback(() => {
-    setOv(null);
-    void getOverview().then((r) => {
-      if (r.ok) {
-        setOv(r.data);
-        setErr("");
-      } else setErr(r.message);
-    });
-    void getAutomations().then((r) => {
-      if (r.ok) setFleet({ rows: r.data.automations, cost: r.data.cost });
-    });
-  }, []);
-  useEffect(load, [load]);
-
-  const openDrill = useCallback((kind: DrillKind, tenant: string) => {
-    setDrill({ kind, tenant });
-    setDrillRows(null);
-    setDrillNote("");
-    const fetcher =
-      kind === "users"
-        ? getUsers
-        : kind === "databases"
-          ? getDatabases
-          : kind === "connectors"
-            ? getConnectors
-            : getAutomations;
-    void fetcher(tenant || undefined).then((r) => {
-      if (!r.ok) {
-        setDrillRows([]);
-        setDrillNote(r.message);
-        return;
-      }
-      const d = r.data as Record<string, unknown>;
-      setDrillRows((d[kind] as unknown[]) ?? []);
-      // The server's own honest note travels with the rows rather than being
-      // re-invented here: it is the one that knows WHY a tenant is missing.
-      const errors = (d.errors as Record<string, string>) ?? {};
-      const words = Object.entries(errors).map(([t, e]) => `${t}: ${e}`);
-      setDrillNote(
-        [typeof d.stampsNote === "string" ? d.stampsNote : "", ...words]
-          .filter(Boolean)
-          .join(" · ")
-      );
-    });
-  }, []);
-
-  const loadAws = useCallback(() => {
-    setAwsBusy(true);
-    void getAws(7).then((r) => {
-      setAwsBusy(false);
-      if (r.ok) setAws(r.data.report);
-      else setAws({ text: "", note: r.message, available: false });
-    });
-  }, []);
-
-  return (
-    <div className="set-pane">
-      <h3 className="set-h">Loopable admin</h3>
-      <p className="set-help set-pane-intro">
-        Every workspace on the platform, signed in as {user.name}. Counts open the rows they were
-        computed from; anything that could not be read shows a dash and says why, rather than a
-        zero.
-      </p>
-      {err ? <p className="set-error">{err}</p> : null}
-
-      {!ov ? (
-        <Skeleton rows={4} />
-      ) : (
-        <>
-          <div className="padmin-totals">
-            <Total label="Workspaces" value={int(ov.totals.tenants)} />
-            <Total label="People" value={int(ov.totals.users)} />
-            <Total label="Databases" value={int(ov.totals.databases)} />
-            <Total label="Records" value={int(ov.totals.rows)} />
-            <Total
-              label="Automation cost"
-              value={fleet ? `$${fleet.cost.usd.toFixed(2)}` : "—"}
-              hint={fleet?.cost.basis}
-            />
-          </div>
-          {ov.totals.unknownTenants > 0 ? (
-            <p className="set-help padmin-caveat">
-              {ov.totals.unknownTenants} workspace
-              {ov.totals.unknownTenants === 1 ? "" : "s"} could not be read, so the totals above
-              exclude {ov.totals.unknownTenants === 1 ? "it" : "them"}.
-            </p>
-          ) : null}
-
-          <div className="padmin-tablewrap">
-            <table className="padmin-table">
-              <thead>
-                <tr>
-                  <th>Workspace</th>
-                  <th>Storage</th>
-                  <th className="padmin-num">People</th>
-                  <th className="padmin-num">Databases</th>
-                  <th className="padmin-num">Records</th>
-                  <th className="padmin-num">Sources</th>
-                  <th className="padmin-num">Automations</th>
-                </tr>
-              </thead>
-              <tbody>
-                {ov.tenants.map((t) => (
-                  <tr key={t.slug}>
-                    <td>
-                      <span className="padmin-name">{t.name}</span>
-                      <span className="padmin-meta">
-                        {t.slug}
-                        {t.status !== "active" ? ` · ${t.status}` : ""}
-                        {t.errors && t.errors.length ? ` · ${t.errors[0]}` : ""}
-                      </span>
-                    </td>
-                    <td>
-                      <span className="padmin-meta">
-                        {t.storeRepo && t.storeRepo.includes("/")
-                          ? "own repository"
-                          : t.storePrefix
-                            ? "shared repository"
-                            : "tenant #0 repository"}
-                        {t.keychainLocked ? " · keychain locked" : ""}
-                      </span>
-                    </td>
-                    <DrillCell
-                      n={t.users}
-                      onOpen={() => openDrill("users", t.slug)}
-                      title={`${t.admins} administrator${t.admins === 1 ? "" : "s"}`}
-                    />
-                    <DrillCell
-                      n={t.databases}
-                      onOpen={() => openDrill("databases", t.slug)}
-                      why={t.errors?.[0]}
-                    />
-                    <DrillCell
-                      n={t.rows}
-                      onOpen={() => openDrill("databases", t.slug)}
-                      why={t.errors?.[0]}
-                    />
-                    <DrillCell
-                      n={t.connectors}
-                      onOpen={() => openDrill("connectors", t.slug)}
-                      why={t.errors?.[0]}
-                      title={
-                        t.connectorsPaused ? `${t.connectorsPaused} paused` : "none paused"
-                      }
-                    />
-                    <DrillCell
-                      n={t.automations}
-                      onOpen={() => openDrill("automations", t.slug)}
-                      why={t.errors?.[0]}
-                      title={
-                        t.automationsEnabled != null
-                          ? `${t.automationsEnabled} scheduled`
-                          : undefined
-                      }
-                    />
-                  </tr>
-                ))}
-              </tbody>
-            </table>
-          </div>
-
-          <p className="set-help padmin-caveat">
-            Read {ago(ov.generatedAt)} in {ov.tookMs} ms.{" "}
-            {ov.totals.orphanUsers > 0
-              ? `${ov.totals.orphanUsers} account${
-                  ov.totals.orphanUsers === 1 ? "" : "s"
-                } belong to a workspace this deployment no longer knows. `
-              : ""}
-            <button type="button" className="padmin-link" onClick={load}>
-              Refresh
-            </button>
-          </p>
-
-          {drill ? (
-            <section className="padmin-drill">
-              <div className="padmin-drill-head">
-                <h4 className="padmin-h4">
-                  {DRILL_NOUN[drill.kind]}
-                  {drill.tenant ? ` — ${drill.tenant}` : ""}
-                </h4>
-                <button type="button" className="padmin-link" onClick={() => setDrill(null)}>
-                  Close
-                </button>
-              </div>
-              {drillRows === null ? (
-                <Skeleton rows={2} />
-              ) : drillRows.length === 0 ? (
-                <p className="set-help">Nothing here yet.</p>
-              ) : (
-                <DrillTable kind={drill.kind} rows={drillRows} />
-              )}
-              {drillNote ? <p className="set-help padmin-caveat">{drillNote}</p> : null}
-            </section>
-          ) : null}
-
-          {fleet ? (
-            <section className="padmin-block">
-              {/* Named for what it SHOWS. The fleet's rows live one level down,
-                  behind the Automations count — this section is the cost and the
-                  reasoning behind it, so calling it "fleet" would promise a
-                  table that is deliberately not here. */}
-              <h4 className="padmin-h4">Automation cost</h4>
-              <p className="set-help">
-                {fleet.rows.filter((a) => a.enabled).length} scheduled of {fleet.rows.length}
-                {fleet.cost.fleetRunsPerDay
-                  ? `, about ${fleet.cost.fleetRunsPerDay} runs a day`
-                  : ""}
-                {fleet.cost.unknownCadence
-                  ? ` (${fleet.cost.unknownCadence} on a custom cadence, not counted)`
-                  : ""}
-                . {fleet.cost.basis}
-              </p>
-            </section>
-          ) : null}
-
-          <section className="padmin-block">
-            <h4 className="padmin-h4">AWS cron</h4>
-            {!aws ? (
-              <p className="set-help">
-                The external tick that wakes this app on schedule. Reading its usage runs a live
-                CloudWatch query and takes a few seconds.{" "}
-                <button
-                  type="button"
-                  className="padmin-link"
-                  onClick={loadAws}
-                  disabled={awsBusy}
-                >
-                  {awsBusy ? "Reading…" : "Check usage"}
-                </button>
-              </p>
-            ) : aws.available ? (
-              <pre className="padmin-pre">{aws.text}</pre>
-            ) : (
-              <p className="set-help">{aws.note}</p>
-            )}
-          </section>
-        </>
-      )}
-    </div>
-  );
-}
-
-function Total({ label, value, hint }: { label: string; value: string; hint?: string }) {
-  // A tooltip nobody can see is a tooltip nobody reads: the label carries a
-  // dotted underline exactly when there is something behind it.
-  return (
-    <div className={"padmin-total" + (hint ? " has-hint" : "")} title={hint || undefined}>
-      <span className="padmin-total-label">{label}</span>
-      <span className="padmin-total-value">{value}</span>
-    </div>
-  );
-}
-
-/** A numeric cell that opens its own rows. Unknown counts are not clickable —
- *  there is nothing to drill INTO when the read failed, and a button that opens
- *  an empty table would read as "none". */
-function DrillCell({
-  n,
-  onOpen,
-  why,
-  title,
-}: {
-  n: number | null | undefined;
-  onOpen: () => void;
-  why?: string;
-  title?: string;
-}) {
-  if (n === null || n === undefined)
-    return (
-      <td className="padmin-num">
-        <Count n={n} why={why} />
-      </td>
-    );
-  return (
-    <td className="padmin-num">
-      <button type="button" className="padmin-drill-btn" onClick={onOpen} title={title}>
-        {int(n)}
-      </button>
-    </td>
-  );
-}
-
-function DrillTable({ kind, rows }: { kind: DrillKind; rows: unknown[] }) {
-  if (kind === "users") {
-    const rs = rows as PlatformUser[];
-    return (
-      <div className="padmin-tablewrap">
-        <table className="padmin-table">
-          <thead>
-            <tr>
-              <th>Person</th>
-              <th>Workspace</th>
-              <th>Role</th>
-              <th>Last sign-in</th>
-              <th>Last active</th>
-            </tr>
-          </thead>
-          <tbody>
-            {rs.map((u) => (
-              <tr key={`${u.tenant}/${u.username}`}>
-                <td>
-                  <span className="padmin-name">{u.name}</span>
-                  <span className="padmin-meta">
-                    {u.username}
-                    {u.email ? ` · ${u.email}` : ""}
-                    {u.active ? "" : " · deactivated"}
-                  </span>
-                </td>
-                <td>{u.tenant}</td>
-                <td>
-                  {u.role}
-                  {u.platformAdmin ? " · platform" : ""}
-                </td>
-                <td>{ago(u.lastLogin)}</td>
-                <td>{ago(u.lastActive)}</td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
-      </div>
-    );
-  }
-  if (kind === "databases") {
-    const rs = rows as DatabaseRow[];
-    return (
-      <div className="padmin-tablewrap">
-        <table className="padmin-table">
-          <thead>
-            <tr>
-              <th>Database</th>
-              <th>Workspace</th>
-              <th>Built from</th>
-              <th className="padmin-num">Fields</th>
-              <th className="padmin-num">Records</th>
-            </tr>
-          </thead>
-          <tbody>
-            {rs.map((d) => (
-              <tr key={`${d.tenant}/${d.key}`}>
-                <td>
-                  <span className="padmin-name">{d.label}</span>
-                  <span className="padmin-meta">
-                    {d.key}
-                    {d.createdBy ? ` · ${d.createdBy}` : ""}
-                  </span>
-                </td>
-                <td>{d.tenant}</td>
-                <td>{d.source}</td>
-                <td className="padmin-num">{int(d.fields)}</td>
-                <td className="padmin-num">{int(d.rowCount)}</td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
-      </div>
-    );
-  }
-  if (kind === "connectors") {
-    const rs = rows as ConnectorRow[];
-    return (
-      <div className="padmin-tablewrap">
-        <table className="padmin-table">
-          <thead>
-            <tr>
-              <th>Source</th>
-              <th>Workspace</th>
-              <th>Kind</th>
-              <th>Status</th>
-            </tr>
-          </thead>
-          <tbody>
-            {rs.map((c) => (
-              <tr key={`${c.tenant}/${c.key}`}>
-                <td>
-                  <span className="padmin-name">{c.label}</span>
-                  <span className="padmin-meta">
-                    {c.source === "env" ? "environment credentials" : "keychain"}
-                  </span>
-                </td>
-                <td>{c.tenant}</td>
-                <td>{c.type}</td>
-                <td>
-                  <span
-                    className={
-                      "padmin-dot " +
-                      (c.paused ? "is-paused" : c.active ? "is-live" : "is-idle")
-                    }
-                  />
-                  {c.paused ? "paused" : c.active ? "serving" : "stored"}
-                </td>
-              </tr>
-            ))}
-          </tbody>
-        </table>
-      </div>
-    );
-  }
-  const rs = rows as AutomationRow[];
-  return (
-    <div className="padmin-tablewrap">
-      <table className="padmin-table">
-        <thead>
-          <tr>
-            <th>Automation</th>
-            <th>Workspace</th>
-            <th>Schedule</th>
-            <th className="padmin-num">Runs a day</th>
-            <th>Last run</th>
-          </tr>
-        </thead>
-        <tbody>
-          {rs.map((a) => (
-            <tr key={`${a.tenant}/${a.id}`}>
-              <td>
-                <span className="padmin-name">{a.name}</span>
-                <span className="padmin-meta">
-                  {a.kind}
-                  {a.failedRetained
-                    ? ` · ${a.failedRetained} of the last ${a.runsRetained} runs failed`
-                    : ""}
-                </span>
-              </td>
-              <td>{a.tenant}</td>
-              <td>{a.enabled ? a.cron || "scheduled" : "paused"}</td>
-              <td className="padmin-num">
-                {a.enabled ? (a.runsPerDay === null ? "custom" : a.runsPerDay) : "—"}
-              </td>
-              <td>
-                <span
-                  className={
-                    "padmin-dot " +
-                    (a.state === "error" ? "is-error" : a.state === "ok" ? "is-live" : "is-idle")
-                  }
-                />
-                {/* Verbatim, not relative: the engine writes this stamp with no
-                    zone (`automation_engine._iso()` is naive local-to-container),
-                    so "x hours ago" would be wrong by the viewer's offset. */}
-                {a.lastRunAt ? a.lastRunAt.replace("T", " ") : "never"}
-              </td>
-            </tr>
-          ))}
-        </tbody>
-      </table>
-    </div>
-  );
-}
-
-export default AdminPane;
+// ---------------------------------------------------------------------------
+// settings / AdminPane.tsx — THE LOOPABLE ADMIN PLANE (wave 19, owner item 13 /
+// R3+R4, contract C2).
+//
+// The one surface in this product that looks ACROSS tenants: who our customers
+// are, how many people use each workspace, what they have built in it, whether
+// their data sources are alive, and what the automation fleet costs.
+//
+// SELF-CONTAINED BY CONTRACT (C2). It fetches its own data via
+// `platformAdminApi` and takes ONE prop, so mounting it is a rail entry plus a
+// line in the pane switch — `SettingsModal.tsx` is another session's file this
+// wave and must not have to learn anything about this pane's data.
+//
+// ⚠ THE PROP IS TYPED STRUCTURALLY, not as `SessionUser` from `../shell/session`.
+// The mount site passes the shell's session user (a wider object), which
+// satisfies this shape by structural typing — and this pane therefore imports
+// nothing from the shell, which is what the wave's cross-fence rule asks for
+// while `session.ts` is open on another desk.
+//
+// ⛔ EVERY NUMBER HERE IS THE SERVER'S, AND EVERY NUMBER DRILLS. Clicking a count
+// opens the rows it was computed from — the same collector, projected twice
+// ([[no-unverifiable-aggregates]]). A count that could not be READ renders as an
+// em dash with the reason, never as a zero: "this customer has no databases" and
+// "we could not look" are different facts and the pane refuses to conflate them.
+//
+// DESIGN: sentence-case micro-labels (R6 — no caps in app chrome), short noun
+// headers, tabular figures right-aligned, hairlines not shadows, tokens only,
+// no emojis (DESIGN.md §2–§4).
+// ---------------------------------------------------------------------------
+
+import { useCallback, useEffect, useState } from "react";
+import type {
+  AutomationRow,
+  ConnectorRow,
+  DatabaseRow,
+  FleetCost,
+  Overview,
+  PlatformUser,
+  ReleasesPayload,
+} from "./platformAdminApi";
+import {
+  getAutomations,
+  getAws,
+  getReleases,
+  getConnectors,
+  getDatabases,
+  getOverview,
+  getUsers,
+} from "./platformAdminApi";
+
+// --- formatting -------------------------------------------------------------
+
+const int = (n: number) => n.toLocaleString();
+
+/** A count that may be unknown. `null` is NOT zero — see the api module's header. */
+function Count({ n, why }: { n: number | null | undefined; why?: string }) {
+  if (n === null || n === undefined)
+    return (
+      <span className="padmin-unknown" title={why || "This could not be read just now"}>
+        —
+      </span>
+    );
+  return <>{int(n)}</>;
+}
+
+/** "3 days ago" for a stamp, "never" for an absent one. Never a fabricated date.
+ *
+ *  ⛔ ONLY FOR OFFSET-BEARING STAMPS. `Date.parse` reads a stamp with no zone as
+ *  BROWSER-LOCAL, so running a container-local timestamp through this reports the
+ *  viewer's UTC offset as elapsed time — hours of error in a column people scan,
+ *  and a future-dated stamp that renders as "just now" indefinitely. Everything
+ *  this pane passes here (`last_login`, `last_active`, `generatedAt`) is written
+ *  with an explicit offset; the automation engine's `lastRunAt` is NOT, so it is
+ *  rendered verbatim instead. */
+function ago(stamp: string): string {
+  if (!stamp) return "never";
+  const t = Date.parse(stamp.includes("T") ? stamp : stamp.replace(" ", "T"));
+  if (Number.isNaN(t)) return stamp;
+  const mins = Math.floor((Date.now() - t) / 60000);
+  if (mins < 2) return "just now";
+  if (mins < 60) return `${mins} minutes ago`;
+  const hours = Math.floor(mins / 60);
+  if (hours < 24) return `${hours} hour${hours === 1 ? "" : "s"} ago`;
+  const days = Math.floor(hours / 24);
+  if (days < 60) return `${days} day${days === 1 ? "" : "s"} ago`;
+  return `${Math.floor(days / 30)} months ago`;
+}
+
+type DrillKind = "users" | "databases" | "connectors" | "automations";
+
+const DRILL_NOUN: Record<DrillKind, string> = {
+  users: "People",
+  databases: "Databases",
+  connectors: "Data sources",
+  automations: "Automations",
+};
+
+/** The loading shape — a skeleton, not a spinner (DESIGN.md §4). */
+function Skeleton({ rows = 3 }: { rows?: number }) {
+  return (
+    <div className="padmin-skel" aria-hidden="true">
+      {Array.from({ length: rows }, (_, i) => (
+        <div key={i} className="padmin-skel-row" />
+      ))}
+    </div>
+  );
+}
+
+// --- the pane ---------------------------------------------------------------
+
+export function AdminPane({ user }: { user: { username: string; name: string; role: string } }) {
+  const [ov, setOv] = useState<Overview | null>(null);
+  const [err, setErr] = useState("");
+  const [fleet, setFleet] = useState<{ rows: AutomationRow[]; cost: FleetCost } | null>(null);
+
+  const [drill, setDrill] = useState<{ kind: DrillKind; tenant: string } | null>(null);
+  const [drillRows, setDrillRows] = useState<unknown[] | null>(null);
+  const [drillNote, setDrillNote] = useState("");
+
+  const [aws, setAws] = useState<{ text: string; note: string; available: boolean } | null>(null);
+  // Wave 20 (R6): the releases panel. Loaded with the overview rather than on demand — it is
+  // two small Hub reads and the first question an operator opens this pane to answer.
+  const [rel, setRel] = useState<ReleasesPayload | null>(null);
+  const [awsBusy, setAwsBusy] = useState(false);
+
+  const load = useCallback(() => {
+    setOv(null);
+    void getOverview().then((r) => {
+      if (r.ok) {
+        setOv(r.data);
+        setErr("");
+      } else setErr(r.message);
+    });
+    void getAutomations().then((r) => {
+      if (r.ok) setFleet({ rows: r.data.automations, cost: r.data.cost });
+    });
+    void getReleases().then((r) => {
+      if (r.ok) setRel(r.data);
+    });
+  }, []);
+  useEffect(load, [load]);
+
+  const openDrill = useCallback((kind: DrillKind, tenant: string) => {
+    setDrill({ kind, tenant });
+    setDrillRows(null);
+    setDrillNote("");
+    const fetcher =
+      kind === "users"
+        ? getUsers
+        : kind === "databases"
+          ? getDatabases
+          : kind === "connectors"
+            ? getConnectors
+            : getAutomations;
+    void fetcher(tenant || undefined).then((r) => {
+      if (!r.ok) {
+        setDrillRows([]);
+        setDrillNote(r.message);
+        return;
+      }
+      const d = r.data as Record<string, unknown>;
+      setDrillRows((d[kind] as unknown[]) ?? []);
+      // The server's own honest note travels with the rows rather than being
+      // re-invented here: it is the one that knows WHY a tenant is missing.
+      const errors = (d.errors as Record<string, string>) ?? {};
+      const words = Object.entries(errors).map(([t, e]) => `${t}: ${e}`);
+      setDrillNote(
+        [typeof d.stampsNote === "string" ? d.stampsNote : "", ...words]
+          .filter(Boolean)
+          .join(" · ")
+      );
+    });
+  }, []);
+
+  const loadAws = useCallback(() => {
+    setAwsBusy(true);
+    void getAws(7).then((r) => {
+      setAwsBusy(false);
+      if (r.ok) setAws(r.data.report);
+      else setAws({ text: "", note: r.message, available: false });
+    });
+  }, []);
+
+  return (
+    <div className="set-pane">
+      <h3 className="set-h">Loopable admin</h3>
+      <p className="set-help set-pane-intro">
+        Every workspace on the platform, signed in as {user.name}. Counts open the rows they were
+        computed from; anything that could not be read shows a dash and says why, rather than a
+        zero.
+      </p>
+      {err ? <p className="set-error">{err}</p> : null}
+
+      {!ov ? (
+        <Skeleton rows={4} />
+      ) : (
+        <>
+          <div className="padmin-totals">
+            <Total label="Workspaces" value={int(ov.totals.tenants)} />
+            <Total label="People" value={int(ov.totals.users)} />
+            <Total label="Databases" value={int(ov.totals.databases)} />
+            <Total label="Records" value={int(ov.totals.rows)} />
+            <Total
+              label="Automation cost"
+              value={fleet ? `$${fleet.cost.usd.toFixed(2)}` : "—"}
+              hint={fleet?.cost.basis}
+            />
+          </div>
+          {ov.totals.unknownTenants > 0 ? (
+            <p className="set-help padmin-caveat">
+              {ov.totals.unknownTenants} workspace
+              {ov.totals.unknownTenants === 1 ? "" : "s"} could not be read, so the totals above
+              exclude {ov.totals.unknownTenants === 1 ? "it" : "them"}.
+            </p>
+          ) : null}
+
+          <div className="padmin-tablewrap">
+            <table className="padmin-table">
+              <thead>
+                <tr>
+                  <th>Workspace</th>
+                  <th>Storage</th>
+                  <th className="padmin-num">People</th>
+                  <th className="padmin-num">Databases</th>
+                  <th className="padmin-num">Records</th>
+                  <th className="padmin-num">Sources</th>
+                  <th className="padmin-num">Automations</th>
+                </tr>
+              </thead>
+              <tbody>
+                {ov.tenants.map((t) => (
+                  <tr key={t.slug}>
+                    <td>
+                      <span className="padmin-name">{t.name}</span>
+                      <span className="padmin-meta">
+                        {t.slug}
+                        {t.status !== "active" ? ` · ${t.status}` : ""}
+                        {t.errors && t.errors.length ? ` · ${t.errors[0]}` : ""}
+                      </span>
+                    </td>
+                    <td>
+                      <span className="padmin-meta">
+                        {t.storeRepo && t.storeRepo.includes("/")
+                          ? "own repository"
+                          : t.storePrefix
+                            ? "shared repository"
+                            : "tenant #0 repository"}
+                        {t.keychainLocked ? " · keychain locked" : ""}
+                      </span>
+                    </td>
+                    <DrillCell
+                      n={t.users}
+                      onOpen={() => openDrill("users", t.slug)}
+                      title={`${t.admins} administrator${t.admins === 1 ? "" : "s"}`}
+                    />
+                    <DrillCell
+                      n={t.databases}
+                      onOpen={() => openDrill("databases", t.slug)}
+                      why={t.errors?.[0]}
+                    />
+                    <DrillCell
+                      n={t.rows}
+                      onOpen={() => openDrill("databases", t.slug)}
+                      why={t.errors?.[0]}
+                    />
+                    <DrillCell
+                      n={t.connectors}
+                      onOpen={() => openDrill("connectors", t.slug)}
+                      why={t.errors?.[0]}
+                      title={
+                        t.connectorsPaused ? `${t.connectorsPaused} paused` : "none paused"
+                      }
+                    />
+                    <DrillCell
+                      n={t.automations}
+                      onOpen={() => openDrill("automations", t.slug)}
+                      why={t.errors?.[0]}
+                      title={
+                        t.automationsEnabled != null
+                          ? `${t.automationsEnabled} scheduled`
+                          : undefined
+                      }
+                    />
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+
+          <p className="set-help padmin-caveat">
+            Read {ago(ov.generatedAt)} in {ov.tookMs} ms.{" "}
+            {ov.totals.orphanUsers > 0
+              ? `${ov.totals.orphanUsers} account${
+                  ov.totals.orphanUsers === 1 ? "" : "s"
+                } belong to a workspace this deployment no longer knows. `
+              : ""}
+            <button type="button" className="padmin-link" onClick={load}>
+              Refresh
+            </button>
+          </p>
+
+          {drill ? (
+            <section className="padmin-drill">
+              <div className="padmin-drill-head">
+                <h4 className="padmin-h4">
+                  {DRILL_NOUN[drill.kind]}
+                  {drill.tenant ? ` — ${drill.tenant}` : ""}
+                </h4>
+                <button type="button" className="padmin-link" onClick={() => setDrill(null)}>
+                  Close
+                </button>
+              </div>
+              {drillRows === null ? (
+                <Skeleton rows={2} />
+              ) : drillRows.length === 0 ? (
+                <p className="set-help">Nothing here yet.</p>
+              ) : (
+                <DrillTable kind={drill.kind} rows={drillRows} />
+              )}
+              {drillNote ? <p className="set-help padmin-caveat">{drillNote}</p> : null}
+            </section>
+          ) : null}
+
+          {fleet ? (
+            <section className="padmin-block">
+              {/* Named for what it SHOWS. The fleet's rows live one level down,
+                  behind the Automations count — this section is the cost and the
+                  reasoning behind it, so calling it "fleet" would promise a
+                  table that is deliberately not here. */}
+              <h4 className="padmin-h4">Automation cost</h4>
+              <p className="set-help">
+                {fleet.rows.filter((a) => a.enabled).length} scheduled of {fleet.rows.length}
+                {fleet.cost.fleetRunsPerDay
+                  ? `, about ${fleet.cost.fleetRunsPerDay} runs a day`
+                  : ""}
+                {fleet.cost.unknownCadence
+                  ? ` (${fleet.cost.unknownCadence} on a custom cadence, not counted)`
+                  : ""}
+                . {fleet.cost.basis}
+              </p>
+            </section>
+          ) : null}
+
+          {/* ── Wave 20 (owner item 12 / R6): what is running where ─���────────────────
+              READ-ONLY BY RULING. The operator sees both environments and every cut
+              release; moving one is a CLI command, printed below rather than wired to
+              a button, so no browser session can rewrite production. */}
+          <section className="padmin-block">
+            <h4 className="padmin-h4">Releases</h4>
+            {!rel ? (
+              <Skeleton rows={2} />
+            ) : (
+              <>
+                <table className="padmin-table">
+                  <thead>
+                    <tr>
+                      <th>Environment</th>
+                      <th>Version</th>
+                      <th>Stage</th>
+                      <th>Space</th>
+                    </tr>
+                  </thead>
+                  <tbody>
+                    {rel.environments.map((e) => (
+                      <tr key={e.env}>
+                        <td>{e.env === "live" ? "Live (pinned)" : "Staging (follows the tree)"}</td>
+                        {/* ⚠ An unreadable version is a NOTE, never a blank. A blank cell in a
+                            column headed "Version" reads as "nothing is deployed", which about a
+                            production environment is the worst available way to be wrong. */}
+                        <td>{e.version || <span className="set-help">{e.note || "unknown"}</span>}</td>
+                        <td>{e.stage || "—"}</td>
+                        {/* The Space ID as TEXT, not a link: the server deliberately builds no
+                            URL (portability C1 — a host literal in runtime code hard-codes the
+                            current host into a process designed to move). */}
+                        <td>{e.space}</td>
+                      </tr>
+                    ))}
+                  </tbody>
+                </table>
+                {rel.releases.length ? (
+                  <table className="padmin-table">
+                    <thead>
+                      <tr>
+                        <th>Release</th>
+                        <th>Commit</th>
+                        <th>Cut</th>
+                        <th>What shipped</th>
+                      </tr>
+                    </thead>
+                    <tbody>
+                      {rel.releases.map((r) => (
+                        <tr key={r.version}>
+                          <td>{r.version}</td>
+                          <td>{r.sha}</td>
+                          <td>{r.date}</td>
+                          <td>{r.subject}</td>
+                        </tr>
+                      ))}
+                    </tbody>
+                  </table>
+                ) : (
+                  <p className="set-help">
+                    No tagged releases were readable from either Space.
+                  </p>
+                )}
+                <p className="set-help">
+                  To move Live to another version, or roll it back, run:{" "}
+                  <code>{rel.promote}</code>
+                </p>
+              </>
+            )}
+          </section>
+
+          <section className="padmin-block">
+            <h4 className="padmin-h4">AWS cron</h4>
+            {!aws ? (
+              <p className="set-help">
+                The external tick that wakes this app on schedule. Reading its usage runs a live
+                CloudWatch query and takes a few seconds.{" "}
+                <button
+                  type="button"
+                  className="padmin-link"
+                  onClick={loadAws}
+                  disabled={awsBusy}
+                >
+                  {awsBusy ? "Reading…" : "Check usage"}
+                </button>
+              </p>
+            ) : aws.available ? (
+              <pre className="padmin-pre">{aws.text}</pre>
+            ) : (
+              <p className="set-help">{aws.note}</p>
+            )}
+          </section>
+        </>
+      )}
+    </div>
+  );
+}
+
+function Total({ label, value, hint }: { label: string; value: string; hint?: string }) {
+  // A tooltip nobody can see is a tooltip nobody reads: the label carries a
+  // dotted underline exactly when there is something behind it.
+  return (
+    <div className={"padmin-total" + (hint ? " has-hint" : "")} title={hint || undefined}>
+      <span className="padmin-total-label">{label}</span>
+      <span className="padmin-total-value">{value}</span>
+    </div>
+  );
+}
+
+/** A numeric cell that opens its own rows. Unknown counts are not clickable —
+ *  there is nothing to drill INTO when the read failed, and a button that opens
+ *  an empty table would read as "none". */
+function DrillCell({
+  n,
+  onOpen,
+  why,
+  title,
+}: {
+  n: number | null | undefined;
+  onOpen: () => void;
+  why?: string;
+  title?: string;
+}) {
+  if (n === null || n === undefined)
+    return (
+      <td className="padmin-num">
+        <Count n={n} why={why} />
+      </td>
+    );
+  return (
+    <td className="padmin-num">
+      <button type="button" className="padmin-drill-btn" onClick={onOpen} title={title}>
+        {int(n)}
+      </button>
+    </td>
+  );
+}
+
+function DrillTable({ kind, rows }: { kind: DrillKind; rows: unknown[] }) {
+  if (kind === "users") {
+    const rs = rows as PlatformUser[];
+    return (
+      <div className="padmin-tablewrap">
+        <table className="padmin-table">
+          <thead>
+            <tr>
+              <th>Person</th>
+              <th>Workspace</th>
+              <th>Role</th>
+              <th>Last sign-in</th>
+              <th>Last active</th>
+            </tr>
+          </thead>
+          <tbody>
+            {rs.map((u) => (
+              <tr key={`${u.tenant}/${u.username}`}>
+                <td>
+                  <span className="padmin-name">{u.name}</span>
+                  <span className="padmin-meta">
+                    {u.username}
+                    {u.email ? ` · ${u.email}` : ""}
+                    {u.active ? "" : " · deactivated"}
+                  </span>
+                </td>
+                <td>{u.tenant}</td>
+                <td>
+                  {u.role}
+                  {u.platformAdmin ? " · platform" : ""}
+                </td>
+                <td>{ago(u.lastLogin)}</td>
+                <td>{ago(u.lastActive)}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    );
+  }
+  if (kind === "databases") {
+    const rs = rows as DatabaseRow[];
+    return (
+      <div className="padmin-tablewrap">
+        <table className="padmin-table">
+          <thead>
+            <tr>
+              <th>Database</th>
+              <th>Workspace</th>
+              <th>Built from</th>
+              <th className="padmin-num">Fields</th>
+              <th className="padmin-num">Records</th>
+            </tr>
+          </thead>
+          <tbody>
+            {rs.map((d) => (
+              <tr key={`${d.tenant}/${d.key}`}>
+                <td>
+                  <span className="padmin-name">{d.label}</span>
+                  <span className="padmin-meta">
+                    {d.key}
+                    {d.createdBy ? ` · ${d.createdBy}` : ""}
+                  </span>
+                </td>
+                <td>{d.tenant}</td>
+                <td>{d.source}</td>
+                <td className="padmin-num">{int(d.fields)}</td>
+                <td className="padmin-num">{int(d.rowCount)}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    );
+  }
+  if (kind === "connectors") {
+    const rs = rows as ConnectorRow[];
+    return (
+      <div className="padmin-tablewrap">
+        <table className="padmin-table">
+          <thead>
+            <tr>
+              <th>Source</th>
+              <th>Workspace</th>
+              <th>Kind</th>
+              <th>Status</th>
+            </tr>
+          </thead>
+          <tbody>
+            {rs.map((c) => (
+              <tr key={`${c.tenant}/${c.key}`}>
+                <td>
+                  <span className="padmin-name">{c.label}</span>
+                  <span className="padmin-meta">
+                    {c.source === "env" ? "environment credentials" : "keychain"}
+                  </span>
+                </td>
+                <td>{c.tenant}</td>
+                <td>{c.type}</td>
+                <td>
+                  <span
+                    className={
+                      "padmin-dot " +
+                      (c.paused ? "is-paused" : c.active ? "is-live" : "is-idle")
+                    }
+                  />
+                  {c.paused ? "paused" : c.active ? "serving" : "stored"}
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    );
+  }
+  const rs = rows as AutomationRow[];
+  return (
+    <div className="padmin-tablewrap">
+      <table className="padmin-table">
+        <thead>
+          <tr>
+            <th>Automation</th>
+            <th>Workspace</th>
+            <th>Schedule</th>
+            <th className="padmin-num">Runs a day</th>
+            <th>Last run</th>
+          </tr>
+        </thead>
+        <tbody>
+          {rs.map((a) => (
+            <tr key={`${a.tenant}/${a.id}`}>
+              <td>
+                <span className="padmin-name">{a.name}</span>
+                <span className="padmin-meta">
+                  {a.kind}
+                  {a.failedRetained
+                    ? ` · ${a.failedRetained} of the last ${a.runsRetained} runs failed`
+                    : ""}
+                </span>
+              </td>
+              <td>{a.tenant}</td>
+              <td>{a.enabled ? a.cron || "scheduled" : "paused"}</td>
+              <td className="padmin-num">
+                {a.enabled ? (a.runsPerDay === null ? "custom" : a.runsPerDay) : "—"}
+              </td>
+              <td>
+                <span
+                  className={
+                    "padmin-dot " +
+                    (a.state === "error" ? "is-error" : a.state === "ok" ? "is-live" : "is-idle")
+                  }
+                />
+                {/* Verbatim, not relative: the engine writes this stamp with no
+                    zone (`automation_engine._iso()` is naive local-to-container),
+                    so "x hours ago" would be wrong by the viewer's offset. */}
+                {a.lastRunAt ? a.lastRunAt.replace("T", " ") : "never"}
+              </td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+export default AdminPane;

web/src/settings/platformAdminApi.ts

@@ -1,224 +1,263 @@
-// ---------------------------------------------------------------------------
-// settings / platformAdminApi.ts — the Loopable admin plane's client half
-// (wave 19, owner item 13 / R3+R4, contract C2).
-//
-// ⛔ THE CLIENT HIDES; THE SERVER FORBIDS. Every route here is walled by
-// `core.platform_admin.is_platform_admin` — a double lock (the record flag AND
-// the `loopable` tenant), fail-closed, proven by `verify_api.py` enumerating the
-// router and having a tenant admin try every path. The `platformAdmin` flag on
-// `GET /settings` exists so the rail does not paint a door that would 403; it is
-// never the permission ([[aios-permissioning]]).
-//
-// SELF-CONTAINED BY CONTRACT (C2). This module and `AdminPane.tsx` are the only
-// two files the admin plane owns on the client, and they import nothing from the
-// rest of `settings/` — the pane fetches its own data, so mounting it is one line
-// in the rail and one line in the pane switch.
-//
-// ⚠ NULL IS A REAL VALUE HERE, AND IT IS NOT ZERO. Any per-tenant count can come
-// back `null`, meaning "that subsystem could not be read for this customer" — a
-// suspended tenant record, a locked keychain, an HF repo that did not answer.
-// Rendering it as 0 would tell an operator a customer has no databases when the
-// truth is that we did not look. The types say `number | null` for exactly that
-// reason and the pane renders the difference.
-// ---------------------------------------------------------------------------
-
-import { API_V1, CREDENTIALS } from "../apiContract";
-
-export type ApiResult<T> = { ok: true; data: T } | { ok: false; status: number; message: string };
-
-async function call<T>(path: string): Promise<ApiResult<T>> {
-  try {
-    const res = await fetch(`${API_V1}/platform-admin${path}`, { credentials: CREDENTIALS });
-    let body: unknown = null;
-    try {
-      body = await res.json();
-    } catch {
-      /* an unreadable body is handled below, never thrown at the pane */
-    }
-    if (!res.ok) {
-      const err = (body as { error?: { message?: string } } | null)?.error;
-      const message =
-        res.status >= 500
-          ? "Something went wrong on our side. Try again in a moment."
-          : err?.message ||
-            (res.status === 403
-              ? "This surface is not available to your account."
-              : "That could not be loaded.");
-      return { ok: false, status: res.status, message };
-    }
-    return { ok: true, data: body as T };
-  } catch {
-    return { ok: false, status: 0, message: "The server could not be reached." };
-  }
-}
-
-/** One customer. `error` / `errors` carry the honest reason a count is null. */
-export interface TenantRow {
-  slug: string;
-  name: string;
-  /** `record` = provisioned into the control-plane bucket; `compiled` = tenant #0. */
-  source: string;
-  status: string;
-  domains: string[];
-  modules: string[] | "all";
-  /** R2: a dedicated dataset repo, or the shared repo. The isolation shape. */
-  storeRepo: string;
-  storePrefix: string;
-  error: string;
-  users: number;
-  admins: number;
-  databases: number | null;
-  rows: number | null;
-  connectors: number | null;
-  connectorsPaused?: number | null;
-  automations: number | null;
-  automationsEnabled?: number | null;
-  keychainLocked?: boolean | null;
-  errors?: string[];
-}
-
-export interface Overview {
-  tenants: TenantRow[];
-  totals: {
-    tenants: number;
-    users: number;
-    orphanUsers: number;
-    databases: number;
-    rows: number;
-    automations: number;
-    unknownTenants: number;
-  };
-  storeAvailable: boolean;
-  generatedAt: string;
-  tookMs: number;
-}
-
-export interface PlatformUser {
-  username: string;
-  name: string;
-  email: string;
-  tenant: string;
-  role: string;
-  active: boolean;
-  /** R4 — absent means never, and the pane says "never" rather than inventing a date. */
-  lastLogin: string;
-  lastActive: string;
-  platformAdmin: boolean;
-}
-
-export interface DatabaseRow {
-  tenant: string;
-  key: string;
-  label: string;
-  source: string;
-  createdBy: string;
-  created: string;
-  fields: number;
-  rowCount: number;
-}
-
-export interface ConnectorRow {
-  tenant: string;
-  key: string;
-  label: string;
-  type: string;
-  source: string;
-  active: boolean;
-  paused: boolean;
-}
-
-export interface AutomationRow {
-  tenant: string;
-  id: string;
-  name: string;
-  kind: string;
-  enabled: boolean;
-  cron: string;
-  /** null = a cadence the server would not parse; shown as "custom", never as a number. */
-  runsPerDay: number | null;
-  state: string;
-  lastRunAt: string;
-  lastSummary: string;
-  runsRetained: number;
-  failedRetained: number;
-  createdBy: string;
-  created: string;
-}
-
-export interface FleetCost {
-  cadence: string;
-  invocationsPerMonth: number;
-  freeRequestsPct: number;
-  freeSchedulerPct: number;
-  lambdaMb: number;
-  usd: number;
-  fleetRunsPerDay: number;
-  unknownCadence: number;
-  basis: string;
-}
-
-export interface AwsReport {
-  available: boolean;
-  text: string;
-  note: string;
-}
-
-export function getOverview(): Promise<ApiResult<Overview>> {
-  return call<Overview>("/overview");
-}
-
-/** `tenant` narrows every drill; omitted, they answer for the whole platform. */
-const q = (tenant?: string) => (tenant ? `?tenant=${encodeURIComponent(tenant)}` : "");
-
-export function getUsers(
-  tenant?: string
-): Promise<ApiResult<{ users: PlatformUser[]; count: number; stampsNote: string }>> {
-  return call(`/users${q(tenant)}`);
-}
-
-export function getDatabases(
-  tenant?: string
-): Promise<
-  ApiResult<{
-    databases: DatabaseRow[];
-    count: number;
-    rows: number;
-    errors: Record<string, string>;
-  }>
-> {
-  return call(`/databases${q(tenant)}`);
-}
-
-export function getConnectors(
-  tenant?: string
-): Promise<
-  ApiResult<{
-    connectors: ConnectorRow[];
-    count: number;
-    keychainLocked: Record<string, boolean>;
-    errors: Record<string, string>;
-    note: string;
-  }>
-> {
-  return call(`/connectors${q(tenant)}`);
-}
-
-export function getAutomations(
-  tenant?: string
-): Promise<
-  ApiResult<{
-    automations: AutomationRow[];
-    count: number;
-    enabled: number;
-    historyRetained: number;
-    cost: FleetCost;
-    errors: Record<string, string>;
-    tickEnabled: boolean;
-  }>
-> {
-  return call(`/automations${q(tenant)}`);
-}
-
-export function getAws(days = 7): Promise<ApiResult<{ days: number; report: AwsReport }>> {
-  return call(`/aws?days=${encodeURIComponent(String(days))}`);
-}
+// ---------------------------------------------------------------------------
+// settings / platformAdminApi.ts — the Loopable admin plane's client half
+// (wave 19, owner item 13 / R3+R4, contract C2).
+//
+// ⛔ THE CLIENT HIDES; THE SERVER FORBIDS. Every route here is walled by
+// `core.platform_admin.is_platform_admin` — a double lock (the record flag AND
+// the `loopable` tenant), fail-closed, proven by `verify_api.py` enumerating the
+// router and having a tenant admin try every path. The `platformAdmin` flag on
+// `GET /settings` exists so the rail does not paint a door that would 403; it is
+// never the permission ([[aios-permissioning]]).
+//
+// SELF-CONTAINED BY CONTRACT (C2). This module and `AdminPane.tsx` are the only
+// two files the admin plane owns on the client, and they import nothing from the
+// rest of `settings/` — the pane fetches its own data, so mounting it is one line
+// in the rail and one line in the pane switch.
+//
+// ⚠ NULL IS A REAL VALUE HERE, AND IT IS NOT ZERO. Any per-tenant count can come
+// back `null`, meaning "that subsystem could not be read for this customer" — a
+// suspended tenant record, a locked keychain, an HF repo that did not answer.
+// Rendering it as 0 would tell an operator a customer has no databases when the
+// truth is that we did not look. The types say `number | null` for exactly that
+// reason and the pane renders the difference.
+// ---------------------------------------------------------------------------
+
+import { API_V1, CREDENTIALS } from "../apiContract";
+
+export type ApiResult<T> = { ok: true; data: T } | { ok: false; status: number; message: string };
+
+async function call<T>(path: string): Promise<ApiResult<T>> {
+  try {
+    const res = await fetch(`${API_V1}/platform-admin${path}`, { credentials: CREDENTIALS });
+    let body: unknown = null;
+    try {
+      body = await res.json();
+    } catch {
+      /* an unreadable body is handled below, never thrown at the pane */
+    }
+    if (!res.ok) {
+      const err = (body as { error?: { message?: string } } | null)?.error;
+      const message =
+        res.status >= 500
+          ? "Something went wrong on our side. Try again in a moment."
+          : err?.message ||
+            (res.status === 403
+              ? "This surface is not available to your account."
+              : "That could not be loaded.");
+      return { ok: false, status: res.status, message };
+    }
+    return { ok: true, data: body as T };
+  } catch {
+    return { ok: false, status: 0, message: "The server could not be reached." };
+  }
+}
+
+/** One customer. `error` / `errors` carry the honest reason a count is null. */
+export interface TenantRow {
+  slug: string;
+  name: string;
+  /** `record` = provisioned into the control-plane bucket; `compiled` = tenant #0. */
+  source: string;
+  status: string;
+  domains: string[];
+  modules: string[] | "all";
+  /** R2: a dedicated dataset repo, or the shared repo. The isolation shape. */
+  storeRepo: string;
+  storePrefix: string;
+  error: string;
+  users: number;
+  admins: number;
+  databases: number | null;
+  rows: number | null;
+  connectors: number | null;
+  connectorsPaused?: number | null;
+  automations: number | null;
+  automationsEnabled?: number | null;
+  keychainLocked?: boolean | null;
+  errors?: string[];
+}
+
+export interface Overview {
+  tenants: TenantRow[];
+  totals: {
+    tenants: number;
+    users: number;
+    orphanUsers: number;
+    databases: number;
+    rows: number;
+    automations: number;
+    unknownTenants: number;
+  };
+  storeAvailable: boolean;
+  generatedAt: string;
+  tookMs: number;
+}
+
+export interface PlatformUser {
+  username: string;
+  name: string;
+  email: string;
+  tenant: string;
+  role: string;
+  active: boolean;
+  /** R4 — absent means never, and the pane says "never" rather than inventing a date. */
+  lastLogin: string;
+  lastActive: string;
+  platformAdmin: boolean;
+}
+
+export interface DatabaseRow {
+  tenant: string;
+  key: string;
+  label: string;
+  source: string;
+  createdBy: string;
+  created: string;
+  fields: number;
+  rowCount: number;
+}
+
+export interface ConnectorRow {
+  tenant: string;
+  key: string;
+  label: string;
+  type: string;
+  source: string;
+  active: boolean;
+  paused: boolean;
+}
+
+export interface AutomationRow {
+  tenant: string;
+  id: string;
+  name: string;
+  kind: string;
+  enabled: boolean;
+  cron: string;
+  /** null = a cadence the server would not parse; shown as "custom", never as a number. */
+  runsPerDay: number | null;
+  state: string;
+  lastRunAt: string;
+  lastSummary: string;
+  runsRetained: number;
+  failedRetained: number;
+  createdBy: string;
+  created: string;
+}
+
+export interface FleetCost {
+  cadence: string;
+  invocationsPerMonth: number;
+  freeRequestsPct: number;
+  freeSchedulerPct: number;
+  lambdaMb: number;
+  usd: number;
+  fleetRunsPerDay: number;
+  unknownCadence: number;
+  basis: string;
+}
+
+export interface AwsReport {
+  available: boolean;
+  text: string;
+  note: string;
+}
+
+export function getOverview(): Promise<ApiResult<Overview>> {
+  return call<Overview>("/overview");
+}
+
+/** `tenant` narrows every drill; omitted, they answer for the whole platform. */
+const q = (tenant?: string) => (tenant ? `?tenant=${encodeURIComponent(tenant)}` : "");
+
+export function getUsers(
+  tenant?: string
+): Promise<ApiResult<{ users: PlatformUser[]; count: number; stampsNote: string }>> {
+  return call(`/users${q(tenant)}`);
+}
+
+export function getDatabases(
+  tenant?: string
+): Promise<
+  ApiResult<{
+    databases: DatabaseRow[];
+    count: number;
+    rows: number;
+    errors: Record<string, string>;
+  }>
+> {
+  return call(`/databases${q(tenant)}`);
+}
+
+export function getConnectors(
+  tenant?: string
+): Promise<
+  ApiResult<{
+    connectors: ConnectorRow[];
+    count: number;
+    keychainLocked: Record<string, boolean>;
+    errors: Record<string, string>;
+    note: string;
+  }>
+> {
+  return call(`/connectors${q(tenant)}`);
+}
+
+export function getAutomations(
+  tenant?: string
+): Promise<
+  ApiResult<{
+    automations: AutomationRow[];
+    count: number;
+    enabled: number;
+    historyRetained: number;
+    cost: FleetCost;
+    errors: Record<string, string>;
+    tickEnabled: boolean;
+  }>
+> {
+  return call(`/automations${q(tenant)}`);
+}
+
+export function getAws(days = 7): Promise<ApiResult<{ days: number; report: AwsReport }>> {
+  return call(`/aws?days=${encodeURIComponent(String(days))}`);
+}
+
+// ── Wave 20 (owner item 12 / R6): RELEASES ──────────────────────────────────
+// Read-only by ruling. The operator SEES what is running where and what could be
+// gone back to; promoting stays `deploy_web.py --promote=vN`, so no web session
+// can move production. `promote` carries that command in the payload because the
+// person reading this panel is exactly the person who needs it.
+
+/** One environment. `version` is what the SPACE says about itself (its own
+ *  `VERSION` file) — never inferred from a timestamp, because `last_modified`
+ *  moves when a SECRET is pushed and would report a deploy that never happened. */
+export interface ReleaseEnv {
+  env: string;
+  space: string;
+  /** null + a `note` = we could not read it. NOT "nothing is deployed". */
+  version: string | null;
+  note: string | null;
+  /** HF runtime stage (`RUNNING`, `BUILDING`, …), or null when unreadable. */
+  stage: string | null;
+}
+
+export interface ReleaseTag {
+  version: string;
+  sha: string;
+  date: string;
+  subject: string;
+}
+
+export interface ReleasesPayload {
+  /** The version THIS container is running (`AIOS_VERSION`), for the "you are here" case. */
+  here: string;
+  environments: ReleaseEnv[];
+  releases: ReleaseTag[];
+  /** The CLI that moves a version. In the payload because the panel is read-only by ruling. */
+  promote: string;
+}
+
+export function getReleases(): Promise<ApiResult<ReleasesPayload>> {
+  return call("/releases");
+}

web/src/shell/NavExtras.tsx

@@ -180,6 +180,7 @@ export function RowMenu({
   icon,
   onIcon,
   onIconClear,
+  onShare,
 }: {
   entryLabel: string;
   canSchema: boolean;
@@ -199,6 +200,9 @@ export function RowMenu({
   icon?: FolderIcon;
   onIcon?: (icon: FolderIcon) => void;
   onIconClear?: () => void;
+  /** WAVE 20 item 18 (C-SHARE) — open the access editor for THIS database.
+   *  Absent = the row does not offer sharing (a group head has nothing to share). */
+  onShare?: () => void;
 }) {
   // Wave 14 C-NAVFOLD (ruling R10): the three-dots kept "View schema" ONLY.
   // Wave 19 (R8/C1) adds Rename and Change icon — the first two things a
@@ -210,7 +214,7 @@ export function RowMenu({
   const [name, setName] = useState(entryLabel);
   const renameOn = !!canRename && !!onRename;
   const iconOn = !!canIcon && !!onIcon;
-  if (!canSchema && !renameOn && !iconOn) return null;
+  if (!canSchema && !renameOn && !iconOn && !onShare) return null;
   const submitRename = () => {
     const clean = name.trim().replace(/\s+/g, " ");
     if (clean && clean !== entryLabel) onRename?.(clean);
@@ -312,6 +316,22 @@ export function RowMenu({
                   View schema
                 </button>
               ) : null}
+              {/* WAVE 20 item 18 (R10, C-SHARE) — a DATABASE shares with the same two
+                  roles a view does. Gated on `onShare`, which the Shell passes only
+                  for a real database row, so a family head or a hand-off link never
+                  offers to share something that has no id on the server. */}
+              {onShare ? (
+                <button
+                  type="button"
+                  className="shell-navmenu-item"
+                  onClick={() => {
+                    close();
+                    onShare();
+                  }}
+                >
+                  Share…
+                </button>
+              ) : null}
             </>
           )}
         </MenuShell>

web/src/shell/ShareDialog.tsx

@@ -0,0 +1,328 @@
+// ---------------------------------------------------------------------------
+// shell/ShareDialog.tsx — WAVE 20 items 18 / 23 / 26 (R10, contract C-SHARE):
+// ONE dialog that shares a view, a folder or a database, and edits who already
+// has it.
+//
+// ONE dialog for three kinds is the ruling, not a convenience: R10 says folders
+// and databases share "with the SAME two-role vocabulary views use". Three
+// dialogs would drift into three vocabularies within a wave.
+//
+// It renders over the ALREADY-LOADED state and decides nothing itself — every
+// rule (what a junk entry means, who may administer, what the PUT carries) is in
+// `shareModel.ts`, where the access gate can run it.
+// ---------------------------------------------------------------------------
+
+import { useCallback, useEffect, useState } from "react";
+import { API_V1, CREDENTIALS } from "../apiContract";
+import {
+  SHARE_ROLES,
+  addablePeople,
+  parseShare,
+  sharePutBody,
+  shareSummary,
+  withEntry,
+  withoutEntry,
+} from "./shareModel";
+import type { ShareEntry, ShareKind, ShareRole, ShareState } from "./shareModel";
+
+const KIND_WORD: Record<ShareKind, string> = {
+  view: "view",
+  folder: "folder",
+  database: "database",
+};
+
+/** What each role MEANS on each kind, in the reader's own terms. A role picker
+ *  whose options are two nouns makes the reader guess; these are the sentences
+ *  the view rail already uses ("Anyone who can see this table can change it"),
+ *  extended to the two new kinds rather than re-invented for them. */
+const ROLE_BLURB: Record<ShareKind, Record<ShareRole, string>> = {
+  view: {
+    view: "Can open this view. Cannot rename, refilter or delete it.",
+    edit: "Can change this view's filters, sorts and columns.",
+  },
+  folder: {
+    view: "Can open the folder and the views inside it.",
+    edit: "Can rename the folder and move views in and out of it.",
+  },
+  database: {
+    view: "Can open this database and read its records.",
+    edit: "Can add, edit and delete its records.",
+  },
+};
+
+export default function ShareDialog({
+  kind,
+  id,
+  label,
+  me,
+  onClose,
+  onToast,
+}: {
+  kind: ShareKind;
+  id: string;
+  label: string;
+  /** The signed-in account's username, so the reader recognises themselves in the
+   *  list. `people` is deliberately the OTHER accounts (it is the add-picker's
+   *  source), so without this the owner row prints a raw login where every other
+   *  row prints a name. */
+  me: string;
+  onClose: () => void;
+  onToast: (message: string) => void;
+}) {
+  const [state, setState] = useState<ShareState | null>(null);
+  const [entries, setEntries] = useState<ShareEntry[]>([]);
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [pick, setPick] = useState("");
+  const [pickRole, setPickRole] = useState<ShareRole>("view");
+
+  const path = `${API_V1}/share/${encodeURIComponent(kind)}/${encodeURIComponent(id)}`;
+
+  useEffect(() => {
+    let dead = false;
+    setError("");
+    void (async () => {
+      try {
+        const res = await fetch(path, { credentials: CREDENTIALS });
+        if (!res.ok) {
+          // 4xx text is policy the reader needs; a 5xx's internals are not theirs.
+          if (!dead) setError(res.status >= 500
+            ? "Something went wrong on our side. Try again in a moment."
+            : `The server answered ${res.status}.`);
+          return;
+        }
+        const body = (await res.json().catch(() => null)) as unknown;
+        if (dead) return;
+        const parsed = parseShare(body);
+        setState(parsed);
+        setEntries(parsed.entries);
+      } catch {
+        if (!dead) setError("Cannot reach the server.");
+      }
+    })();
+    return () => {
+      dead = true;
+    };
+  }, [path]);
+
+  // ⛔ ESCAPE CLOSES A MODAL, or its scrim becomes a trap — the wave-18 lesson this
+  // shell already carries at its other two dialogs.
+  useEffect(() => {
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape" && !busy) onClose();
+    };
+    window.addEventListener("keydown", onKey);
+    return () => window.removeEventListener("keydown", onKey);
+  }, [busy, onClose]);
+
+  const save = useCallback(
+    async (next: ShareEntry[]) => {
+      setBusy(true);
+      setError("");
+      try {
+        const res = await fetch(path, {
+          method: "PUT",
+          credentials: CREDENTIALS,
+          headers: { "Content-Type": "application/json" },
+          // The WHOLE list, every time: the PUT replaces, so a body assembled from
+          // a delta would revoke everyone it failed to mention.
+          body: JSON.stringify(sharePutBody(next)),
+        });
+        if (!res.ok) {
+          const body = (await res.json().catch(() => null)) as
+            | { error?: { message?: string } }
+            | null;
+          setError(
+            res.status >= 500
+              ? "Something went wrong on our side. Try again in a moment."
+              : body?.error?.message || `The server answered ${res.status}.`
+          );
+          return false;
+        }
+        const body = (await res.json().catch(() => null)) as unknown;
+        // Re-read the SERVER's copy rather than trusting the draft: `_clean_entries`
+        // drops what it will not store, and an editor that kept showing a row the
+        // store rejected would be the "shared, silently inert" failure this feature
+        // exists to avoid.
+        // ⚠ Only `.entries` is consumed here — the PUT answers with the stored record
+        // (`{owner, entries}`) and says nothing about this session's standing, so the
+        // literal below feeds the parser's required field and is never read back. The
+        // editor's `mayAdminister` stays the one the GET established; a save cannot
+        // promote anybody, and this line must never be the reason it looks like it can.
+        const saved = parseShare({ ...(body as object), mayAdminister: true });
+        setEntries(saved.entries);
+        return true;
+      } catch {
+        setError("Cannot reach the server.");
+        return false;
+      } finally {
+        setBusy(false);
+      }
+    },
+    [path]
+  );
+
+  const mayAdminister = !!state?.mayAdminister;
+  const options = state ? addablePeople(state.people, entries) : [];
+  const nameOf = (user: string) =>
+    user === "*"
+      ? "Everyone"
+      : user && user === me.trim().toLowerCase()
+        ? "You"
+        : state?.people.find((p) => p.user === user)?.name ?? user;
+
+  return (
+    <div className="shell-newdb-scrim" onClick={() => (busy ? null : onClose())}>
+      <div
+        className="shell-newdb shell-share"
+        role="dialog"
+        aria-label={`Share ${label}`}
+        onClick={(e) => e.stopPropagation()}
+      >
+        <h2>Share {KIND_WORD[kind]}</h2>
+        <p className="shell-newdb-sub">
+          <strong>{label}</strong> — who can reach it, and what they can do with it. Sharing
+          never widens past this workspace: everyone here can already open the surface it
+          lives on.
+        </p>
+
+        {!state && !error ? (
+          <div className="shell-share-wait">
+            <span className="lp-spin" role="status" aria-label="Loading" />
+          </div>
+        ) : null}
+
+        {state ? (
+          <>
+            {/* THE MANAGE-ACCESS EDITOR (item 23): the list first, because the
+                question people open this for is "who has this already" — with the
+                one-line answer above it, since the fact that changes everything
+                ("Everyone can edit") is the one a list of rows buries. */}
+            <p className="shell-share-summary">{shareSummary(entries)}</p>
+            <div className="shell-share-list">
+              {state.owner ? (
+                <div className="shell-share-row is-owner">
+                  <span className="shell-share-who">{nameOf(state.owner)}</span>
+                  <span className="shell-share-role">Owner</span>
+                </div>
+              ) : null}
+              {entries.length === 0 ? (
+                <div className="shell-share-empty">
+                  Not shared with anyone yet.
+                </div>
+              ) : null}
+              {entries.map((e) => (
+                <div className="shell-share-row" key={e.user}>
+                  <span className="shell-share-who">{nameOf(e.user)}</span>
+                  <select
+                    className="shell-share-select"
+                    value={e.role}
+                    disabled={!mayAdminister || busy}
+                    aria-label={`Role for ${nameOf(e.user)}`}
+                    onChange={(ev) => {
+                      const next = withEntry(entries, e.user, ev.target.value as ShareRole);
+                      setEntries(next);
+                      void save(next);
+                    }}
+                  >
+                    {SHARE_ROLES.map((r) => (
+                      <option key={r} value={r}>
+                        {r === "edit" ? "Can edit" : "Can view"}
+                      </option>
+                    ))}
+                  </select>
+                  <button
+                    type="button"
+                    className="shell-share-revoke"
+                    disabled={!mayAdminister || busy}
+                    onClick={() => {
+                      const next = withoutEntry(entries, e.user);
+                      setEntries(next);
+                      void save(next).then((ok) => {
+                        if (ok) onToast(`${nameOf(e.user)} no longer has this ${KIND_WORD[kind]}.`);
+                      });
+                    }}
+                  >
+                    Remove
+                  </button>
+                </div>
+              ))}
+            </div>
+
+            {mayAdminister ? (
+              <div className="shell-share-add">
+                <select
+                  className="shell-share-select"
+                  value={pick}
+                  disabled={busy}
+                  aria-label="Who to share with"
+                  onChange={(e) => setPick(e.target.value)}
+                >
+                  {/* ⚠ An explicit placeholder OPTION, not a blank first row: a
+                      <select> whose value matches nothing renders its first option
+                      while holding "", so the box would read as a chosen person and
+                      the button beside it would grant somebody nobody picked
+                      ([[cg-condition-builder-items]]). */}
+                  <option value="">Choose a person…</option>
+                  <option value="*">Everyone in this workspace</option>
+                  {options.map((p) => (
+                    <option key={p.user} value={p.user}>
+                      {p.name}
+                    </option>
+                  ))}
+                </select>
+                <select
+                  className="shell-share-select"
+                  value={pickRole}
+                  disabled={busy}
+                  aria-label="Role for the person being added"
+                  onChange={(e) => setPickRole(e.target.value as ShareRole)}
+                >
+                  {SHARE_ROLES.map((r) => (
+                    <option key={r} value={r}>
+                      {r === "edit" ? "Can edit" : "Can view"}
+                    </option>
+                  ))}
+                </select>
+                <button
+                  type="button"
+                  className="login-submit shell-share-grant"
+                  disabled={busy || !pick}
+                  onClick={() => {
+                    const next = withEntry(entries, pick, pickRole);
+                    setEntries(next);
+                    void save(next).then((ok) => {
+                      if (ok) {
+                        onToast(`${nameOf(pick)} can now ${pickRole} this ${KIND_WORD[kind]}.`);
+                        setPick("");
+                      }
+                    });
+                  }}
+                >
+                  Share
+                </button>
+                <p className="shell-share-blurb">{ROLE_BLURB[kind][pickRole]}</p>
+              </div>
+            ) : (
+              // ⛔ NOT A HIDDEN EDITOR — a stated refusal. A collaborator who can
+              // change this object's CONTENT still cannot change who else reaches
+              // it (the server's rule; this is the courtesy half). Saying why beats
+              // greying three controls and letting the reader guess.
+              <p className="shell-share-note">
+                Only the owner of this {KIND_WORD[kind]} — or an administrator — can change who
+                it is shared with. You can still use it as your role allows.
+              </p>
+            )}
+          </>
+        ) : null}
+
+        {error ? <p className="shell-newdb-err">{error}</p> : null}
+        <div className="shell-newdb-actions">
+          <button type="button" className="login-submit" disabled={busy} onClick={onClose}>
+            Done
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}

web/src/shell/Shell.tsx

@@ -36,15 +36,30 @@ import AutomationSurface from "../automation/AutomationSurface";
 import CustomerGrid from "../customer-grid/CustomerGrid";
 import { clearCustomersCache } from "../customer-grid/apiBridge";
 import { OverlayProvider } from "../customer-grid/OverlaySurface";
-import { API_V1, CREDENTIALS, DATA_ERROR_EVENT, NAV_MINIMIZE_EVENT, ROWS_STALE_EVENT, TOAST_EVENT, UNAUTHORIZED_EVENT } from "../apiContract";
+// ROWS_STALE_EVENT left with `addRecord` (wave 20 item 4): the shell no longer writes rows,
+// so it no longer has to tell the grid that it did.
+import { API_V1, CREDENTIALS, DATA_ERROR_EVENT, NAV_MINIMIZE_EVENT, TOAST_EVENT, UNAUTHORIZED_EVENT } from "../apiContract";
 import { PageSurface } from "../pages/PageSurface";
 import { SettingsModal } from "../settings/SettingsModal";
 import type { SettingsSection } from "../settings/SettingsModal";
 import { Brand } from "./Brand";
 import LoginPage from "./LoginPage";
-import { EMPTY_NAV_PREFS, ENVELOPE_KEYS, MAX_NAV_FOLDERS, appLink, defaultRoute, fetchNav, fetchNavPrefs, foldNav, resolveRoute, saveNavMeta, saveNavPrefs, shapeNav, splitChrome } from "./nav";
+import { EMPTY_NAV_PREFS, ENVELOPE_KEYS, MAX_NAV_FOLDERS, appLink, dbChipClass, defaultRoute, fetchNav, fetchNavPrefs, foldNav, resolveRoute, saveNavMeta, saveNavPrefs, shapeNav, splitChrome } from "./nav";
 import type { NavEntry, NavMetaPatch, NavPage, NavPrefs } from "./nav";
 import { CreateNewRow, FolderHead, RowMenu, SchemaDrawer } from "./NavExtras";
+import AlertsPane from "../alerts/AlertsPane";
+import { createAlert, fetchInbox } from "../alerts/alertsApi";
+import {
+  ALERT_CREATE_EVENT,
+  EMPTY_INBOX,
+  badgeText,
+  parseAlertCreate,
+  routeForTopic,
+} from "../alerts/alertsModel";
+import type { Inbox } from "../alerts/alertsModel";
+import ShareDialog from "./ShareDialog";
+import { SHARE_OPEN_EVENT, parseShareRequest } from "./shareModel";
+import type { ShareRequest } from "./shareModel";
 // WAVE 19 R8 — the chosen database mark. Read-only across the session fence.
 import { FolderMark } from "../customer-grid/icons";
 import type { FolderIcon } from "../customer-grid/types";
@@ -140,6 +155,44 @@ function ExtIcon() {
   );
 }
 
+/**
+ * WAVE 20 item 4 (R8 / C-ADDROW) — THE UNIVERSAL DATABASE HEADER.
+ *
+ * One header, identical on every database (`reference/Airtable 6.png`): a chip in
+ * a bold colour carrying the database's mark, then its name. It replaces
+ * `shell-ut-bar`, which existed on USER TABLES only — so the two built-in
+ * databases had no header at all, and the one place the product named the thing
+ * you were looking at appeared or vanished depending on where the table came
+ * from. R8 makes it universal.
+ *
+ * The "Add record" button the old bar carried is GONE with it, deliberately: R8
+ * replaces it with the grid's own trailing "+" row (S3's half of C-ADDROW), on
+ * user databases only — a connector-backed table's rows are read-synced, and a
+ * "+" that must refuse is a fake affordance.
+ *
+ * The chip is decorative and says so: the name beside it is real text, so a
+ * second announcement of the same fact is noise to a screen reader.
+ */
+function DbHead({ label, icon }: { label: string; icon?: FolderIcon }) {
+  return (
+    <div className="shell-db-head">
+      <span className={dbChipClass(icon)} aria-hidden="true">
+        {/* The database's own mark when it has one, the cylinder when it does not —
+            the same pair the rail row draws, so the header and the nav agree. Both
+            paint in the chip's ink (the stylesheet's two overrides): `FolderMark`
+            would otherwise stroke its pastel `-deep`, which is measured against the
+            WHITE rail and disappears on its own tone. */}
+        {icon ? <FolderMark icon={icon} size={16} /> : <DbIcon />}
+      </span>
+      {/* An `h1`, not a styled span: this is the first time the work surface has NAMED itself,
+          and the name of the thing you are looking at is what a heading is for. Every other
+          full-pane surface in this shell (`shell-placeholder`) already uses one, and they never
+          render together — so the page gains a heading rather than a second one. */}
+      <h1 className="shell-db-name">{label}</h1>
+    </div>
+  );
+}
+
 /** The ⋯ affordance on the account row. */
 function DotsIcon() {
   return (
@@ -177,6 +230,18 @@ function AutoIcon() {
   );
 }
 
+/** WAVE 20 item 25 — the Alerts row's mark. A bell, in the same 16x16 stroke
+ *  vocabulary as its neighbours, so it sits beside the sparkle and the flow rather
+ *  than arriving from another icon set. */
+function BellIcon() {
+  return (
+    <svg className="shell-nav-icon" viewBox="0 0 16 16" aria-hidden="true">
+      <path d="M8 2.4a3.5 3.5 0 0 1 3.5 3.5v2.3l1.2 2H3.3l1.2-2V5.9A3.5 3.5 0 0 1 8 2.4Z" />
+      <path d="M6.6 12.4a1.5 1.5 0 0 0 2.8 0" />
+    </svg>
+  );
+}
+
 /** Owner item 11 — the rail toggle: three horizontal bars. One glyph for both rails (the
  *  views rail draws the same geometry), so "minimize a panel" reads as one idea. */
 function RailToggleIcon() {
@@ -354,6 +419,21 @@ export default function Shell() {
   // `null` = closed. The SECTION is the open state, so "Settings" and
   // "Users" are one component reached two ways rather than two dialogs.
   const [settings, setSettings] = useState<SettingsSection | null>(null);
+  // ── WAVE 20 items 18/23/26 (R10, C-SHARE): the access editor, for all three kinds ──
+  //
+  // The dialog is the SHELL's, and it is opened from two places that must not import
+  // each other: this frame (a database's ⋯) and the views rail (a view's or folder's
+  // ⋯), which is host-neutral `customer-grid/` code. So the rail raises a window event
+  // — the same channel the grid already uses for toasts and staleness — and the frame,
+  // which owns modals, renders it.
+  const [shareFor, setShareFor] = useState<ShareRequest | null>(null);
+  // ── WAVE 20 item 25 (C-ALERT): the inbox lives beside the nav, not in it ──────
+  //
+  // `inbox` is held HERE rather than inside the pane because the badge outlives the
+  // pane: the count has to be on screen while the panel is shut, which is the only
+  // state in which a badge is useful at all.
+  const [alertsOpen, setAlertsOpen] = useState(false);
+  const [inbox, setInbox] = useState<Inbox>(EMPTY_INBOX);
   const route = useHashRoute();
   // Owner items 10/11 — the navigation folds to a slim strip: by the toggle in the rail head,
   // or automatically when the user clicks into the work surface (NAV_MINIMIZE_EVENT from the
@@ -389,6 +469,26 @@ export default function Shell() {
     []
   );
   const tipLeave = useCallback(() => setNavTip(null), []);
+  // ── WAVE 20 item 7 (R9): the collapsed strip expands from its own BACKGROUND ──
+  //
+  // Until now the 56px strip had exactly one way back — the logo — and the owner
+  // kept clicking the empty space beside an icon, which did nothing at all. R9:
+  // "clicking the collapsed strip's blank/background area EXPANDS it; page icons
+  // keep navigating directly."
+  //
+  // ⚠ THE TEST IS THE TARGET, NOT THE CURRENT ELEMENT. `e.currentTarget === e.target`
+  // would only fire on the aside's own few pixels of padding — every gap the user
+  // actually clicks belongs to `.shell-nav` or `.shell-nav-list`, which are not
+  // interactive but ARE elements. So the rule is inverted: a click that landed on
+  // (or inside) a control does what that control does; anything else is background.
+  // ⛔ `closest` and not a tag check: the click usually lands on the `<svg>` or the
+  // `<span>` INSIDE the link, so testing the target's own tagName would treat every
+  // icon click as background and swallow the navigation R9 explicitly preserves.
+  const expandOnBlank = useCallback((e: ReactMouseEvent<HTMLElement>) => {
+    const hit = e.target as Element | null;
+    if (hit?.closest?.('a,button,input,textarea,select,[role="menuitem"],[role="dialog"]')) return;
+    setNavCollapsed(false);
+  }, []);
 
   // The window signals the data layer raises (apiContract.ts). It talks to the
   // frame this way because `customer-grid/**` is host-neutral — the same tree
@@ -399,15 +499,22 @@ export default function Shell() {
       setDataError(String((e as CustomEvent).detail ?? "") || "The data could not be loaded.");
     const onToast = (e: Event) => setToast(String((e as CustomEvent).detail ?? ""));
     const onNavMinimize = () => setNavCollapsed(true);
+    // C-SHARE: the rail asks, the frame opens. A malformed detail opens NOTHING —
+    // `parseShareRequest` fail-closes on an unknown kind rather than launching a
+    // dialog whose every save would 400.
+    const onShareOpen = (e: Event) =>
+      setShareFor(parseShareRequest((e as CustomEvent).detail));
     window.addEventListener(UNAUTHORIZED_EVENT, onUnauthorized);
     window.addEventListener(DATA_ERROR_EVENT, onDataError);
     window.addEventListener(TOAST_EVENT, onToast);
     window.addEventListener(NAV_MINIMIZE_EVENT, onNavMinimize);
+    window.addEventListener(SHARE_OPEN_EVENT, onShareOpen);
     return () => {
       window.removeEventListener(UNAUTHORIZED_EVENT, onUnauthorized);
       window.removeEventListener(DATA_ERROR_EVENT, onDataError);
       window.removeEventListener(TOAST_EVENT, onToast);
       window.removeEventListener(NAV_MINIMIZE_EVENT, onNavMinimize);
+      window.removeEventListener(SHARE_OPEN_EVENT, onShareOpen);
     };
   }, []);
 
@@ -593,6 +700,61 @@ export default function Shell() {
   // holds no copy to update. Painting a new name locally would mean rendering a
   // label from one source while every other reader of the nav still had the old
   // one; re-asking is one cheap round trip and it cannot disagree with itself.
+  // ── C-ALERT: the unread count, and the door that MAKES an alert ───────────────
+  //
+  // Polled once per session boot and after every write this frame knows about —
+  // never on a timer. A nav badge that re-fetches every 30 seconds is a background
+  // request per user per minute for a number nobody is looking at; the honest
+  // refresh points are "the app just started" and "you just did something".
+  useEffect(() => {
+    if (who === null) {
+      setInbox(EMPTY_INBOX);
+      return;
+    }
+    let dead = false;
+    const pull = () => {
+      void fetchInbox().then((r) => {
+        if (!dead && r.ok) setInbox(r.value);
+      });
+    };
+    pull();
+    // ...and again when the tab is looked at, which is the honest substitute for a
+    // timer: news arrives while you are elsewhere, and "elsewhere" is exactly when a
+    // poll would be wasted. One request per return to the tab, none while it sits.
+    window.addEventListener("focus", pull);
+    return () => {
+      dead = true;
+      window.removeEventListener("focus", pull);
+    };
+  }, [who]);
+
+  // The rail asks for an alert on a view; the FRAME answers, because the rail does
+  // not know its own topic — it holds views, and the scope key is the route's.
+  useEffect(() => {
+    const onCreate = (e: Event) => {
+      const req = parseAlertCreate((e as CustomEvent).detail);
+      if (!req) return;
+      const key = window.location.hash.replace(/^#\/?/, "");
+      const topic =
+        key === "product_data" ? "product" : key.startsWith("ut_") ? key : "customer";
+      void createAlert(req.viewId, topic, req.label).then((r) => {
+        if (!r.ok) {
+          // ⚠ The 400 `no_filter` is a real answer and rides through verbatim: a
+          // view with no active filter matches everything, so an alert on it could
+          // never see an entrant. "Refused, and here is why" beats a dead bell.
+          setToast(r.message);
+          return;
+        }
+        setToast(`Alerting on "${req.label}". New records that enter it appear under Alerts.`);
+        void fetchInbox().then((got) => {
+          if (got.ok) setInbox(got.value);
+        });
+      });
+    };
+    window.addEventListener(ALERT_CREATE_EVENT, onCreate);
+    return () => window.removeEventListener(ALERT_CREATE_EVENT, onCreate);
+  }, []);
+
   const commitNavMeta = useCallback(async (key: string, patch: NavMetaPatch) => {
     const ok = await saveNavMeta(key, patch);
     if (ok) setNavEpoch((e) => e + 1);
@@ -644,7 +806,6 @@ export default function Shell() {
   const [newDb, setNewDb] = useState<null | { name: string; busy: boolean; err: string }>(null);
   const newDbOpenRef = useRef(false);
   newDbOpenRef.current = newDb !== null;
-  const [utBusy, setUtBusy] = useState(false);
   const createDb = useCallback(async () => {
     setNewDb((cur) => {
       if (!cur || cur.busy || !cur.name.trim()) return cur;
@@ -675,32 +836,12 @@ export default function Shell() {
       return { ...cur, busy: true, err: "" };
     });
   }, []);
-  const addRecord = useCallback(async (key: string) => {
-    setUtBusy(true);
-    try {
-      const res = await fetch(`${API_V1}/tables/${encodeURIComponent(key)}/rows`, {
-        method: "POST",
-        credentials: CREDENTIALS,
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ values: {} }),
-      });
-      if (res.ok) {
-        // The grid's rows cache would happily serve the pre-add pull for 5 minutes —
-        // clear it, then tell the current topic to refetch (the C3-UT amendment's event).
-        clearCustomersCache();
-        window.dispatchEvent(new Event(ROWS_STALE_EVENT));
-      } else {
-        const body = (await res.json().catch(() => null)) as
-          | { error?: { message?: string } }
-          | null;
-        setToast(body?.error?.message || "The row was not added.");
-      }
-    } catch {
-      setToast("Cannot reach the server.");
-    } finally {
-      setUtBusy(false);
-    }
-  }, []);
+  // ⛔ `addRecord` LIVED HERE AND IS DELETED WITH THE BAR THAT CALLED IT (wave 20 item 4,
+  // R8 / C-ADDROW). The shell was POSTing `/tables/{key}/rows` itself, clearing the grid's
+  // cache and firing ROWS_STALE_EVENT to make the new row appear — a write path owned by
+  // the frame, for a surface the grid owns. R8 moves the affordance into the grid as a
+  // trailing "+" row (S3's half), where the row it adds is the row you are looking at, so
+  // the shell stops being a second writer of table data.
 
   if (session.phase === "checking") {
     // Deliberately wordless. A "Loading…" line here would flash for one round
@@ -751,7 +892,13 @@ export default function Shell() {
 
   return (
     <div className="shell-root">
-      <aside className={"shell-side" + (navCollapsed ? " is-collapsed" : "")}>
+      <aside
+        className={"shell-side" + (navCollapsed ? " is-collapsed" : "")}
+        // Item 7 (R9) — background click expands. Bound only while collapsed, so the
+        // open rail is exactly what it was; the accessible route stays the labelled
+        // brand button below ("Expand navigation"), which is what a keyboard reaches.
+        onClick={navCollapsed ? expandOnBlank : undefined}
+      >
         {/* The PRODUCT brand — the same mark the Streamlit host paints, from the
             same generated file, so the two shells cannot drift. "Royal Imports"
             stays on business documents only. */}
@@ -841,6 +988,37 @@ export default function Shell() {
             </a>
           ) : null}
 
+          {/* WAVE 20 item 25 (C-ALERT) — "Alerts", directly under Automation and above
+              the database band, with the unread count on it.
+              ⛔ A BUTTON, NOT A NAV LINK, and the distinction is this shell's oldest
+              rule: the nav is server-filtered and an undeclared surface is denied, so a
+              client-invented `#/alerts` route would be exactly the hard-coded surface
+              the frame refuses to have. An inbox is not a granted module — it is this
+              account's own notifications about its own views — so it opens a panel, the
+              way the AI assistant does. */}
+          <button
+            type="button"
+            className={"shell-nav-item shell-nav-alerts" + (alertsOpen ? " is-active" : "")}
+            aria-haspopup="dialog"
+            aria-expanded={alertsOpen}
+            onMouseEnter={navCollapsed ? tipEnter("Alerts") : undefined}
+            onMouseLeave={navCollapsed ? tipLeave : undefined}
+            onClick={() => setAlertsOpen(true)}
+          >
+            <BellIcon />
+            <span className="shell-nav-label">Alerts</span>
+            {badgeText(inbox.unread) ? (
+              <span
+                className="shell-nav-badge"
+                // Not aria-hidden: the count IS the information, and a badge a screen
+                // reader cannot see makes the row read as an empty inbox.
+                aria-label={`${inbox.unread} unread`}
+              >
+                {badgeText(inbox.unread)}
+              </span>
+            ) : null}
+          </button>
+
           <div
             className={
               "shell-nav-list" + (dropTarget === "__root__" ? " is-drop-root" : "")
@@ -1026,6 +1204,22 @@ export default function Shell() {
                           void commitNavMeta(item.key, { icon })
                         }
                         onIconClear={() => void commitNavMeta(item.key, { icon: null })}
+                        // WAVE 20 item 18 (R10) — share THIS database. Offered on the
+                        // user's own tables only: `customer_data` and `product_data` are
+                        // registry surfaces whose reach is the permission wall's answer,
+                        // not one person's to grant ([[aios-permission-wall]]), and a
+                        // dialog that recorded a grant the module gate would then ignore
+                        // is the "shared, silently inert" failure in reverse.
+                        {...(item.key.startsWith("ut_")
+                          ? {
+                              onShare: () =>
+                                setShareFor({
+                                  kind: "database",
+                                  id: item.key,
+                                  label: item.label,
+                                }),
+                            }
+                          : {})}
                       />
                     )}
                   </div>
@@ -1152,20 +1346,14 @@ export default function Shell() {
           // view state never bleeds into the other's. Wave 18 (C3-UT): a `ut_` route is a
           // USER TABLE through the same tree — scope IS the key — with the shell-owned
           // Add-record bar above it (the doc's amendment: zero CustomerGrid edits).
-          <div className={active.key.startsWith("ut_") ? "shell-ut-frame" : "shell-grid-host"}>
-            {active.key.startsWith("ut_") ? (
-              <div className="shell-ut-bar">
-                <span className="shell-ut-name">{active.label}</span>
-                <button
-                  type="button"
-                  className="shell-ut-add"
-                  onClick={() => void addRecord(active.key)}
-                  disabled={utBusy}
-                >
-                  {utBusy ? "Adding…" : "Add record"}
-                </button>
-              </div>
-            ) : null}
+          // WAVE 20 item 4 (R8): ONE frame for every database. The old branch gave user
+          // tables a header-plus-grid frame and the built-ins a bare grid, which is why
+          // Customer and Product had nowhere to put a name.
+          <div className="shell-db-frame">
+            <DbHead
+              label={active.label}
+              {...(active.icon ? { icon: active.icon } : {})}
+            />
             <div className="shell-grid-host">
               <OverlayProvider>
                 <CustomerGrid
@@ -1325,6 +1513,41 @@ export default function Shell() {
         />
       ) : null}
 
+      {/* C-ALERT (item 25): the inbox. */}
+      {alertsOpen ? (
+        <AlertsPane
+          onClose={() => setAlertsOpen(false)}
+          onInbox={setInbox}
+          onToast={setToast}
+          onOpenView={(topic, viewId) => {
+            const route = routeForTopic(topic);
+            if (!route) return;
+            window.location.hash = `#/${route}`;
+            // ⚠ HALF A CLICK-THROUGH UNTIL S3 LISTENS (amendment A-S4-4): this lands
+            // the reader on the right TABLE and asks the grid to select the view. The
+            // grid owns view selection — its `activeViewId` is seeded from its own
+            // storage key, which this frame does not know — so until the listener
+            // exists the request is simply not heard. Navigating anyway is the honest
+            // half: a notification that took you nowhere would be worse.
+            window.dispatchEvent(
+              new CustomEvent("aios:view-open", { detail: { topic, viewId } })
+            );
+          }}
+        />
+      ) : null}
+
+      {/* C-SHARE (items 18/23/26): the access editor — one dialog, three kinds. */}
+      {shareFor ? (
+        <ShareDialog
+          kind={shareFor.kind}
+          id={shareFor.id}
+          label={shareFor.label}
+          me={session.user.username}
+          onClose={() => setShareFor(null)}
+          onToast={setToast}
+        />
+      ) : null}
+
       {/* C-SCHEMA: the database schema drawer, over everything but the toast. */}
       {schemaFor ? (
         <SchemaDrawer schemaKey={schemaFor} onClose={() => setSchemaFor(null)} />

web/src/shell/nav.ts

@@ -97,6 +97,35 @@ export function parseNavIcon(raw: unknown): FolderIcon | undefined {
   return { shape: r.shape as FolderIcon["shape"], tone: r.tone as FolderIcon["tone"] };
 }
 
+/**
+ * WAVE 20 item 4 (R8) — the class list for the universal database header's icon
+ * chip: `shell-db-chip`, plus a tone modifier when the database wears a mark.
+ *
+ * R8 asks for "an icon chip on a bold colour background on EVERY database", and
+ * that sentence hides a decision the JSX would otherwise bury: what colour does a
+ * database that never chose one get? Three cases, and they are here rather than
+ * inline so a gate can hold them (and so the answer is written once, not once per
+ * render branch):
+ *
+ *   · no icon at all — every built-in and every un-styled table — takes the BASE
+ *     chip, which the stylesheet paints in the brand primary. That is the
+ *     "sensible default where unset" the ruling asks for, and it is why the base
+ *     class carries a colour instead of leaving the chip transparent.
+ *   · an icon takes its own TONE at the bold `-deep` weight, so the header agrees
+ *     with the mark the same database wears in the rail.
+ *   · an UNRECOGNISED tone falls back to the base, never `--unknown`: emitting a
+ *     class no stylesheet defines would paint a chip with no background at all,
+ *     and a white glyph on white is an invisible header. Same fail-safe posture
+ *     as `parseNavIcon` above — a drifted vocabulary reverts to the default mark
+ *     rather than breaking the frame.
+ */
+export function dbChipClass(icon?: FolderIcon): string {
+  const base = "shell-db-chip";
+  const tone = icon?.tone;
+  if (!tone || !(FOLDER_TONES as readonly string[]).includes(tone)) return base;
+  return `${base} ${base}--${tone}`;
+}
+
 /**
  * Read X2's `{pages:[…]}`. An entry with no key or no label is DROPPED rather
  * than rendered: a nav row with no name is a door with no sign on it, and

web/src/shell/shareModel.ts

@@ -0,0 +1,206 @@
+// ---------------------------------------------------------------------------
+// shell/shareModel.ts — WAVE 20 items 18/23/26 (owner ruling R10, contract
+// C-SHARE): the manage-access editor's PURE half.
+//
+// Reading and editing a grant set is arithmetic over a list, and every way it
+// can be wrong is silent:
+//
+//   · a grant stored against the wrong identifier binds to nobody (see the
+//     mailbox amendment A-S4-5 — `people` may arrive as display names while
+//     every server-side check compares login usernames);
+//   · a PUT that REPLACES, given a list assembled by halves, revokes people
+//     nobody meant to revoke — the API has no DELETE verb, so an omission IS a
+//     revocation and every edit must carry the whole set forward;
+//   · `mayAdminister` read loosely turns "you may edit this view" into "you may
+//     decide who else can", which is the privilege escalation R10's server half
+//     refuses in as many words.
+//
+// So the model is React-free and lives here, where `verify_login.py` — this
+// codebase's ACCESS gate — can run it under node with negative controls. The
+// dialog is a renderer over these functions and decides nothing.
+// ---------------------------------------------------------------------------
+
+/** The three shareable kinds. Closed vocabulary: the server 400s anything else. */
+export const SHARE_KINDS = ["view", "folder", "database"] as const;
+export type ShareKind = (typeof SHARE_KINDS)[number];
+
+/** The two roles, the same two words the view rail already speaks (R10). */
+export const SHARE_ROLES = ["view", "edit"] as const;
+export type ShareRole = (typeof SHARE_ROLES)[number];
+
+/** The wildcard entry: "everyone who can already open this surface". */
+export const EVERYONE = "*";
+
+export interface ShareEntry {
+  user: string;
+  role: ShareRole;
+}
+
+/** One assignable account. `name` is what a human reads; `user` is what binds. */
+export interface SharePerson {
+  user: string;
+  name: string;
+}
+
+export interface ShareState {
+  owner: string | null;
+  entries: ShareEntry[];
+  /** This session's own role on the object: 'owner' | 'edit' | 'view' | null. */
+  role: string | null;
+  /** Owner or admin — the only people the server lets change grants. */
+  mayAdminister: boolean;
+  people: SharePerson[];
+}
+
+const str = (v: unknown): string => (typeof v === "string" ? v.trim() : "");
+
+/**
+ * `GET /api/v1/share/{kind}/{oid}` → a state the editor can render, FAIL-CLOSED.
+ *
+ * Two absences matter and they are not the same:
+ *   · a missing `entries` list is an object nobody has shared yet — an empty
+ *     editor, which is correct and ordinary;
+ *   · a missing `mayAdminister` is a server that did not answer the question,
+ *     and it reads as NO. Defaulting it to yes would open the editor for a
+ *     collaborator, who would then meet a 403 on save — or, worse, would meet a
+ *     server that had also been relaxed.
+ */
+export function parseShare(body: unknown): ShareState {
+  const b = (body && typeof body === "object" ? body : {}) as Record<string, unknown>;
+  const rawEntries = Array.isArray(b.entries) ? b.entries : [];
+  const entries: ShareEntry[] = [];
+  const seen = new Set<string>();
+  for (const item of rawEntries) {
+    if (!item || typeof item !== "object") continue;
+    const e = item as Record<string, unknown>;
+    const user = str(e.user).toLowerCase();
+    const role = str(e.role).toLowerCase();
+    // Same posture as the server's `_clean_entries`: a junk ROLE is dropped, never
+    // coerced to a default — a row shown as "can view" that the store holds as
+    // something else is a lie the editor would then save back.
+    if (!user || !(SHARE_ROLES as readonly string[]).includes(role) || seen.has(user)) continue;
+    seen.add(user);
+    entries.push({ user, role: role as ShareRole });
+  }
+  return {
+    owner: str(b.owner).toLowerCase() || null,
+    entries,
+    role: str(b.role).toLowerCase() || null,
+    mayAdminister: b.mayAdminister === true,
+    people: parsePeople(b.people),
+  };
+}
+
+/**
+ * The assignable accounts.
+ *
+ * ⚠ TWO SHAPES ACCEPTED, AND THE REASON IS A LIVE CONTRACT QUESTION (A-S4-5).
+ * The route serves `users.assignable_people()`, which returns DISPLAY NAMES,
+ * while every grant check compares LOGIN USERNAMES — so a picker that stores
+ * what it was shown can write a grant that binds to nobody. An object entry
+ * (`{username, name}`) resolves that; a bare string is read as a username,
+ * because that is the only reading under which the current payload is correct.
+ * Nothing here can repair a display name: no payload maps one to an account.
+ */
+export function parsePeople(raw: unknown): SharePerson[] {
+  if (!Array.isArray(raw)) return [];
+  const out: SharePerson[] = [];
+  const seen = new Set<string>();
+  for (const item of raw) {
+    let user = "";
+    let name = "";
+    if (typeof item === "string") {
+      user = item.trim();
+      name = user;
+    } else if (item && typeof item === "object") {
+      const p = item as Record<string, unknown>;
+      user = str(p.username) || str(p.user);
+      name = str(p.name) || user;
+    }
+    const key = user.toLowerCase();
+    if (!key || seen.has(key)) continue;
+    seen.add(key);
+    out.push({ user: key, name: name || user });
+  }
+  return out;
+}
+
+/**
+ * Add a person, or change the role of one already listed. The whole list comes
+ * back, because the PUT replaces: an editor that returned only its delta would
+ * revoke everyone it forgot to mention.
+ */
+export function withEntry(entries: ShareEntry[], user: string, role: ShareRole): ShareEntry[] {
+  const key = str(user).toLowerCase();
+  if (!key || !(SHARE_ROLES as readonly string[]).includes(role)) return entries;
+  let found = false;
+  const next = entries.map((e) => {
+    if (e.user !== key) return e;
+    found = true;
+    return { user: key, role };
+  });
+  return found ? next : [...next, { user: key, role }];
+}
+
+/** Revoke: the entry's ABSENCE is the revocation (there is no DELETE verb). */
+export function withoutEntry(entries: ShareEntry[], user: string): ShareEntry[] {
+  const key = str(user).toLowerCase();
+  return entries.filter((e) => e.user !== key);
+}
+
+/** The people not yet granted anything — what the "add someone" picker offers. */
+export function addablePeople(people: SharePerson[], entries: ShareEntry[]): SharePerson[] {
+  const taken = new Set(entries.map((e) => e.user));
+  return people.filter((p) => !taken.has(p.user));
+}
+
+/**
+ * One sentence naming who can reach this object, for the row that opens the
+ * editor. Never a count on its own: "3 people" reads as reassurance, and the
+ * fact that matters is whether one of them is EVERYONE.
+ */
+export function shareSummary(entries: ShareEntry[]): string {
+  if (!entries.length) return "Not shared";
+  const everyone = entries.find((e) => e.user === EVERYONE);
+  if (everyone) {
+    return everyone.role === "edit" ? "Everyone can edit" : "Everyone can view";
+  }
+  const editors = entries.filter((e) => e.role === "edit").length;
+  const people = entries.length === 1 ? "1 person" : `${entries.length} people`;
+  return editors ? `${people}, ${editors} can edit` : `${people} can view`;
+}
+
+/** The PUT body. One shape, one place — the editor never assembles it inline. */
+export function sharePutBody(entries: ShareEntry[]): { entries: ShareEntry[] } {
+  return { entries };
+}
+
+/**
+ * The shell↔rail channel for "open the access editor for this thing".
+ *
+ * A window event rather than a prop, because the two callers live in trees that
+ * must not import each other: the views rail is host-neutral `customer-grid/`
+ * and the dialog is the shell's. The name is a literal in both files until S3
+ * publishes it in `apiContract.ts` (amendment A-S4-4) — the constant is here so
+ * only one file in this tree spells it.
+ */
+export const SHARE_OPEN_EVENT = "aios:share-open";
+
+export interface ShareRequest {
+  kind: ShareKind;
+  id: string;
+  /** What to call the thing in the dialog's title — the user's word for it. */
+  label: string;
+}
+
+/** Read a `SHARE_OPEN_EVENT` detail, dropping anything malformed (fail-closed:
+ *  an unknown kind is not a new namespace, it is a bug that must not open a
+ *  dialog that would 400 on save). */
+export function parseShareRequest(detail: unknown): ShareRequest | null {
+  if (!detail || typeof detail !== "object") return null;
+  const d = detail as Record<string, unknown>;
+  const kind = str(d.kind).toLowerCase();
+  const id = str(d.id);
+  if (!id || !(SHARE_KINDS as readonly string[]).includes(kind)) return null;
+  return { kind: kind as ShareKind, id, label: str(d.label) || id };
+}