@malloy-publisher/server 0.9.10 → 0.9.12

package/dist/server.mjs

@@ -205154,15 +205154,36 @@ function filesystemAccessFailure(error2) {
 function isMysqlConfigFault(code) {
   return typeof code === "string" && (MYSQL_CONFIG_CODES.has(code) || code.startsWith("HANDSHAKE_"));
 }
-function isConnectionFailure(error2) {
-  let current = error2;
+function isSqlserverConnectTimeout(error2, code) {
+  return code === "ETIMEOUT" && error2.name === "ConnectionError";
+}
+function wrappedError(error2) {
+  if (error2.cause instanceof Error)
+    return error2.cause;
+  return error2.originalError;
+}
+function causeChainHasTlsVerificationFailure(error2) {
+  let current = wrappedError(error2);
   for (let depth = 0;depth < 8 && current instanceof Error; depth++) {
+    const { code } = current;
+    if (typeof code === "string" && TLS_VERIFICATION_CODES.has(code)) {
+      return true;
+    }
+    current = wrappedError(current);
+  }
+  return false;
+}
+function isConnectionFailure(error2) {
+  for (const current of causeChain(error2)) {
     const { code, fatal } = current;
     if (typeof code === "string") {
       if (NODE_CONNECTION_CODES.has(code))
         return true;
       if (POSTGRES_CONNECTION_SQLSTATE.test(code))
         return true;
+      if (SQLSERVER_CONNECTION_CODES.has(code) || isSqlserverConnectTimeout(current, code)) {
+        return !causeChainHasTlsVerificationFailure(current);
+      }
     }
     if (fatal === true && !isMysqlConfigFault(code))
       return true;
@@ -205170,13 +205191,18 @@ function isConnectionFailure(error2) {
     if (CODELESS_CONNECTION_MESSAGES.some((re) => re.test(message))) {
       return true;
     }
-    current = current.cause;
   }
   return false;
 }
-function isCredentialRejection(error2) {
+function* causeChain(error2) {
   let current = error2;
   for (let depth = 0;depth < 8 && current instanceof Error; depth++) {
+    yield current;
+    current = wrappedError(current);
+  }
+}
+function isCredentialRejection(error2) {
+  for (const current of causeChain(error2)) {
     const { code } = current;
     if (typeof code === "string" || typeof code === "number") {
       const value = String(code);
@@ -205184,12 +205210,13 @@ function isCredentialRejection(error2) {
         return true;
       if (MYSQL_AUTH_CODES.has(value))
         return true;
+      if (SQLSERVER_AUTH_CODES.has(value))
+        return true;
       if (SNOWFLAKE_AUTH_CODES.has(value))
         return true;
     }
     if (current.name === "BigQueryAuthenticationError")
       return true;
-    current = current.cause;
   }
   return false;
 }
@@ -205204,6 +205231,19 @@ function databaseAccessFailure(error2) {
     return new ConnectionFailedError(message);
   return;
 }
+function statementRejection(error2) {
+  for (const current of causeChain(error2)) {
+    const { code, severity } = current;
+    if (severity === "FATAL" || severity === "PANIC")
+      return;
+    if (typeof code !== "string" || !POSTGRES_STATEMENT_SQLSTATES.has(code)) {
+      continue;
+    }
+    const message = current.message;
+    return code === POSTGRES_UNDEFINED_TABLE && POSTGRES_RELATION_MISSING.test(message) ? new TableNotFoundError(message) : new InvalidArgumentError(message);
+  }
+  return;
+}
 function describeFilesystemAccessFailure(errno) {
   const code = errno.code ?? "";
   const target = errno.path ? ` '${errno.path}'` : "";
@@ -205343,7 +205383,7 @@ function toQueryTextProblem(problem) {
     ...problem.at ? { at: { range: problem.at.range } } : {}
   };
 }
-var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", GENERIC_UNREACHABLE_MESSAGE = "The database connection is down: the database could not be reached, so the query did not run.", GENERIC_AUTH_MESSAGE = "The database rejected the connection's credentials. Check the connection's user, password, key or token.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NODE_CONNECTION_CODES, POSTGRES_CONNECTION_SQLSTATE, CODELESS_CONNECTION_MESSAGES, MYSQL_CONFIG_CODES, POSTGRES_AUTH_SQLSTATE, MYSQL_AUTH_CODES, SNOWFLAKE_AUTH_CODES, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, InvalidModelPathError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, SkillNotFoundError, AgentNotFoundError, ConflictError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionFailedError, UnconfiguredConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteRollbackFailedError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
+var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", GENERIC_UNREACHABLE_MESSAGE = "The database connection is down: the database could not be reached, so the query did not run.", GENERIC_AUTH_MESSAGE = "The database rejected the connection's credentials. Check the connection's user, password, key or token.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NODE_CONNECTION_CODES, POSTGRES_CONNECTION_SQLSTATE, CODELESS_CONNECTION_MESSAGES, MYSQL_CONFIG_CODES, SQLSERVER_CONNECTION_CODES, TLS_VERIFICATION_CODES, POSTGRES_AUTH_SQLSTATE, MYSQL_AUTH_CODES, SQLSERVER_AUTH_CODES, SNOWFLAKE_AUTH_CODES, POSTGRES_STATEMENT_SQLSTATES, POSTGRES_UNDEFINED_TABLE = "42P01", POSTGRES_RELATION_MISSING, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, InvalidModelPathError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, SkillNotFoundError, AgentNotFoundError, ConflictError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionFailedError, UnconfiguredConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteRollbackFailedError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   init_logger();
@@ -205369,7 +205409,8 @@ var init_errors = __esm(() => {
     /^(Error: )?Connection lost: The server closed the connection\.$/,
     new RegExp(`^(Error: )?(connect|read|write|getaddrinfo) (${[
       ...NODE_CONNECTION_CODES
-    ].join("|")})\\b`)
+    ].join("|")})\\b`),
+    /^Failed to connect to \S+( \(redirected from \S+\))?( in \d+ms| - (?!.*certificate).+)$/i
   ];
   MYSQL_CONFIG_CODES = new Set([
     "ER_ACCESS_DENIED_ERROR",
@@ -205378,9 +205419,46 @@ var init_errors = __esm(() => {
     "AUTH_SWITCH_PLUGIN_ERROR",
     "MYSQL_CLEAR_PASSWORD_NOT_ENABLED"
   ]);
+  SQLSERVER_CONNECTION_CODES = new Set(["ESOCKET", "EINSTLOOKUP"]);
+  TLS_VERIFICATION_CODES = new Set([
+    "CERT_HAS_EXPIRED",
+    "DEPTH_ZERO_SELF_SIGNED_CERT",
+    "ERR_TLS_CERT_ALTNAME_INVALID",
+    "SELF_SIGNED_CERT_IN_CHAIN",
+    "UNABLE_TO_GET_ISSUER_CERT",
+    "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+    "UNABLE_TO_VERIFY_LEAF_SIGNATURE"
+  ]);
   POSTGRES_AUTH_SQLSTATE = /^28[0-9A-Z]{3}$/;
   MYSQL_AUTH_CODES = new Set(["ER_ACCESS_DENIED_ERROR"]);
+  SQLSERVER_AUTH_CODES = new Set(["ELOGIN"]);
   SNOWFLAKE_AUTH_CODES = new Set(["390100", "390144", "390195", "390318"]);
+  POSTGRES_STATEMENT_SQLSTATES = new Set([
+    "42601",
+    "42703",
+    "42P01",
+    "42883",
+    "42704",
+    "42P02",
+    "42702",
+    "42725",
+    "42P09",
+    "42P10",
+    "42804",
+    "42846",
+    "42803",
+    "42P20",
+    "42P18",
+    "42P19",
+    "42712",
+    "42701",
+    "42602",
+    "42622",
+    "42809",
+    "42P21",
+    "42P22"
+  ]);
+  POSTGRES_RELATION_MISSING = /^relation ".*" does not exist$/;
   NotImplementedError = class NotImplementedError extends Error {
     constructor(message) {
       super(message);
@@ -262101,6 +262179,11 @@ var require_utils93 = __commonJS((exports, module) => {
   };
 });
 
+// ../../node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
+var require_sshcrypto = __commonJS((exports, module) => {
+  module.exports = __require("./sshcrypto-cqb52edz.node");
+});
+
 // ../../node_modules/ssh2/lib/protocol/crypto/poly1305.js
 var require_poly1305 = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto", __filename = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto/poly1305.js";
@@ -262587,7 +262670,7 @@ var require_crypto = __commonJS((exports, module) => {
   var ChaChaPolyDecipher;
   var GenericDecipher;
   try {
-    binding = (()=>{throw new Error("Cannot require module "+"./crypto/build/Release/sshcrypto.node");})();
+    binding = require_sshcrypto();
     ({
       AESGCMCipher,
       ChaChaPolyCipher,
@@ -337127,7 +337210,7 @@ ${body}`;
   if (artifactAt < 0) {
     return refuse({
       line: 1,
-      message: "Line 1: this notebook has no ## artifact note, so its header cannot be told from its cells. Fix: add `## artifact { layout=linear }` after the ##! line."
+      message: "Line 1: this notebook has no ## artifact note, so its header cannot be told from its cells. Fix: add `## artifact { layout=linear tiles=[…] }` after the ##! line."
     });
   }
   const runCount = items.filter((item) => item.kind === "statement" && item.run).length;
@@ -337327,12 +337410,14 @@ function readReportTag(modelNotes) {
   const kind = tagText(artifact, "kind");
   if (kind !== undefined)
     return { status: "kind-removed", kind };
-  const layout = parseLayoutValue(tagText(artifact, "layout"));
-  if (layout)
-    return { status: "report", layout, decidedBy: "layout" };
-  if (artifact.has("tiles") || tags?.tag("dashboard") !== undefined)
-    return { status: "report", layout: "grid", decidedBy: "tiles" };
-  return { status: "report", layout: "linear", decidedBy: "default" };
+  const hasTiles = artifact.has("tiles");
+  if (hasTiles && artifact.array("tiles") === undefined)
+    return { status: "unparsed" };
+  const declared = tagText(artifact, "layout");
+  const layout = parseLayoutValue(declared) ?? (hasTiles || tags?.tag("dashboard") !== undefined ? "grid" : "linear");
+  if (layout === "linear" && !hasTiles)
+    return declared !== undefined && parseLayoutValue(declared) === undefined ? { status: "cells-removed", unknownLayout: declared } : { status: "cells-removed" };
+  return { status: "report", layout };
 }
 function readReportTagOfText(text) {
   return readReportTag(modelNotesOfText(text));
@@ -338981,6 +339066,7 @@ import {
   buildPoolOptions,
   SnowflakeConnection
 } from "@malloydata/db-snowflake";
+import"@malloydata/db-sqlserver";
 import"@malloydata/db-trino";
 import {
   contextOverlay,
@@ -344265,6 +344351,7 @@ var DOUBLED_ESCAPE_DIALECTS = new Set([
   "motherduck",
   "postgres",
   "publisher",
+  "sqlserver",
   "trino"
 ]);
 function sqlLiteral(value, connectionType) {
@@ -345117,6 +345204,13 @@ function getStaticConnectionAttributes(type) {
         canPersist: true,
         canStream: false
       };
+    case "sqlserver":
+      return {
+        dialectName: "sqlserver",
+        isPool: true,
+        canPersist: false,
+        canStream: true
+      };
     case "duckdb":
     case "motherduck":
     case "ducklake":
@@ -345263,6 +345357,20 @@ function validateConnectionShape(connection) {
     case "postgres":
     case "mysql":
       break;
+    case "sqlserver": {
+      const sqlserver = connection.sqlserverConnection;
+      if (!sqlserver) {
+        throw new Error("SQL Server connection configuration is missing.");
+      }
+      const port = sqlserver.port;
+      if (port !== undefined && port !== null && (typeof port !== "number" || !Number.isInteger(port) || port < 1 || port > 65535)) {
+        throw new Error(`Connection '${connection.name}' has an invalid sqlserverConnection.port ` + `${JSON.stringify(port)} (expected an integer from 1 to 65535).`);
+      }
+      if (sqlserver.instanceName && sqlserver.port) {
+        logger.warn(`Connection '${connection.name}' sets both sqlserverConnection.instanceName ` + `and port; the instance is located through SQL Browser and the port is not used.`);
+      }
+      break;
+    }
     case "bigquery": {
       const bigquery = connection.bigqueryConnection;
       if (bigquery?.impersonateServiceAccount) {
@@ -345510,6 +345618,9 @@ function canonicalizeJsonValue(value) {
   }
   return sorted;
 }
+function blankAsUnset(value) {
+  return value === "" ? undefined : value;
+}
 function assembleEnvironmentConnections(connections = [], environmentPath = "") {
   const pojo = { connections: {} };
   const metadata = new Map;
@@ -345572,6 +345683,22 @@ function assembleEnvironmentConnections(connections = [], environmentPath = "")
         };
         break;
       }
+      case "sqlserver": {
+        const sqlserver = connection.sqlserverConnection;
+        pojo.connections[connection.name] = {
+          is: "sqlserver",
+          server: sqlserver?.server,
+          port: sqlserver?.port,
+          database: sqlserver?.database,
+          user: sqlserver?.user,
+          password: sqlserver?.password,
+          encrypt: sqlserver?.encrypt,
+          trustServerCertificate: sqlserver?.trustServerCertificate,
+          hostNameInCertificate: blankAsUnset(sqlserver?.hostNameInCertificate),
+          instanceName: blankAsUnset(sqlserver?.instanceName)
+        };
+        break;
+      }
       case "bigquery": {
         const serviceAccountKey = parseServiceAccountKey(connection.bigqueryConnection?.serviceAccountKeyJson);
         const impersonateServiceAccount = connection.bigqueryConnection?.impersonateServiceAccount;
@@ -346036,7 +346163,7 @@ function mergeStatementTimeoutOption(existing, ms) {
 }
 function conninfoPairs(conninfo) {
   const pairs = [];
-  const isSpace = (c) => c !== undefined && /\s/.test(c);
+  const isSpace = (c) => c !== undefined && /[ \t\n\v\f\r]/.test(c);
   let i2 = 0;
   while (i2 < conninfo.length) {
     while (isSpace(conninfo[i2]))
@@ -346082,7 +346209,66 @@ function decodeUriComponentOrRaw(value) {
     return value;
   }
 }
-function withLibpqStatementTimeout(name, connectionString, pg) {
+var LIBPQ_NO_VERIFY_SSLMODE = "require";
+var isUriConnectionString = (connectionString) => /^postgres(ql)?:\/\//i.test(connectionString);
+function mapUriQuery(uri, fn) {
+  const queryStart = uri.indexOf("?");
+  const base = queryStart === -1 ? uri : uri.slice(0, queryStart);
+  const params = fn(queryStart === -1 ? [] : uri.slice(queryStart + 1).split("&"));
+  return params.length ? `${base}?${params.join("&")}` : base;
+}
+function libpqSslmodeInRawString(connectionString) {
+  const envNoVerify = process.env.PGSSLMODE?.toLowerCase() === "no-verify" && !process.env.PGSERVICE;
+  const rewritten = `sslmode=${LIBPQ_NO_VERIFY_SSLMODE}`;
+  if (isUriConnectionString(connectionString)) {
+    return mapUriQuery(connectionString, (params) => {
+      const keys = params.map((param) => decodeUriComponentOrRaw(param.split("=")[0]));
+      const hasSslmode = keys.includes("sslmode");
+      const hasCert = keys.some((key) => ["sslrootcert", "sslcert", "sslkey"].includes(key));
+      let seen = false;
+      const mapped = params.flatMap((param, i2) => {
+        const [, ...rest] = param.split("=");
+        const value = decodeUriComponentOrRaw(rest.join("="));
+        if (keys[i2] === "service")
+          seen = true;
+        if (keys[i2] === "uselibpqcompat")
+          return [];
+        if (keys[i2] === "ssl") {
+          if (hasSslmode)
+            return [];
+          if (value === "no-verify") {
+            seen = true;
+            return [rewritten];
+          }
+          if (value === "1")
+            return ["ssl=true"];
+          if (value === "0") {
+            if (hasCert)
+              return [];
+            seen = true;
+            return ["sslmode=disable"];
+          }
+          return [param];
+        }
+        if (keys[i2] !== "sslmode")
+          return [param];
+        seen = true;
+        return [value === "no-verify" ? rewritten : param];
+      });
+      return !seen && envNoVerify ? [...mapped, rewritten] : mapped;
+    });
+  }
+  const pairs = conninfoPairs(connectionString);
+  let result = connectionString;
+  for (const pair of [...pairs].reverse()) {
+    if (pair.key === "sslmode" && pair.value === "no-verify") {
+      result = result.slice(0, pair.start) + rewritten + result.slice(pair.end);
+    }
+  }
+  return !pairs.some((pair) => pair.key === "sslmode" || pair.key === "service") && envNoVerify ? `${result} ${rewritten}` : result;
+}
+function libpqConnectionString(name, rawConnectionString, pg) {
+  const connectionString = libpqSslmodeInRawString(rawConnectionString);
   const ms = postgresStatementTimeoutMs(name, pg);
   if (ms === undefined)
     return connectionString;
@@ -346095,21 +346281,21 @@ function withLibpqStatementTimeout(name, connectionString, pg) {
     }
     return value;
   };
-  if (/^postgres(ql)?:\/\//i.test(connectionString)) {
-    const queryStart = connectionString.indexOf("?");
-    if (queryStart === -1) {
-      return `${connectionString}?options=${encodeURIComponent(merged(undefined))}`;
-    }
-    const params = connectionString.slice(queryStart + 1).split("&");
+  if (isUriConnectionString(connectionString)) {
     const isOptions = (param) => decodeUriComponentOrRaw(param.split("=", 1)[0]) === "options";
-    const last = params.map(isOptions).lastIndexOf(true);
-    if (last === -1) {
-      params.push(`options=${encodeURIComponent(merged(undefined))}`);
-    } else {
+    return mapUriQuery(connectionString, (params) => {
+      const last = params.map(isOptions).lastIndexOf(true);
+      if (last === -1) {
+        return [
+          ...params,
+          `options=${encodeURIComponent(merged(undefined))}`
+        ];
+      }
       const raw = params[last].slice(params[last].indexOf("=") + 1);
-      params[last] = `options=${encodeURIComponent(merged(decodeUriComponentOrRaw(raw)))}`;
-    }
-    return `${connectionString.slice(0, queryStart)}?${params.join("&")}`;
+      const out = [...params];
+      out[last] = `options=${encodeURIComponent(merged(decodeUriComponentOrRaw(raw)))}`;
+      return out;
+    });
   }
   const existing = conninfoPairs(connectionString).filter((pair) => pair.key === "options").pop();
   if (!existing) {
@@ -346122,12 +346308,13 @@ function buildPgConnectionString(pg, {
   applyConnectionOptions
 }) {
   if (pg.connectionString) {
-    if (!applyConnectionOptions)
-      return pg.connectionString;
+    if (!applyConnectionOptions) {
+      return libpqSslmodeInRawString(pg.connectionString);
+    }
     if (pg.sslmode != null) {
       logger.warn(`Connection '${name}' sets both postgresConnection.sslmode and ` + `connectionString; sslmode is ignored and the connectionString's own sslmode applies.`);
     }
-    return withLibpqStatementTimeout(name, pg.connectionString, pg);
+    return libpqConnectionString(name, pg.connectionString, pg);
   }
   const parts = [];
   if (pg.host)
@@ -346150,7 +346337,7 @@ function buildPgConnectionString(pg, {
   const pgSSLMode = process.env.PGSSLMODE;
   if (pgSSLMode) {
     const mapping = {
-      "no-verify": "disable",
+      "no-verify": LIBPQ_NO_VERIFY_SSLMODE,
       disable: "disable",
       allow: "allow",
       prefer: "prefer",
@@ -346519,7 +346706,7 @@ function libpqSslmodeParts(subject, mode, trust) {
     case "disable":
       return ["sslmode=disable"];
     case "no-verify":
-      return ["sslmode=require"];
+      return [`sslmode=${LIBPQ_NO_VERIFY_SSLMODE}`];
     case "verify-ca": {
       if (!trust.caBundle) {
         throw new Error(`${subject} uses sslmode 'verify-ca' but no trusted CA bundle is available (NODE_EXTRA_CA_CERTS is unset).`);
@@ -347445,6 +347632,16 @@ var MYSQL = {
   database: "scalar",
   user: "scalar"
 };
+var SQLSERVER = {
+  server: "scalar",
+  port: "scalar",
+  database: "scalar",
+  user: "scalar",
+  encrypt: "scalar",
+  trustServerCertificate: "scalar",
+  hostNameInCertificate: "scalar",
+  instanceName: "scalar"
+};
 var MOTHERDUCK = { database: "scalar" };
 var PUBLISHER = { connectionUri: "scalar" };
 var S3 = {
@@ -347510,6 +347707,7 @@ var PUBLIC_CONNECTION = {
   trinoConnection: TRINO,
   databricksConnection: DATABRICKS,
   mysqlConnection: MYSQL,
+  sqlserverConnection: SQLSERVER,
   duckdbConnection: DUCKDB,
   motherduckConnection: MOTHERDUCK,
   ducklakeConnection: DUCKLAKE,
@@ -347523,6 +347721,7 @@ var PUBLIC_FIELDS_BY_SCHEMA = {
   TrinoConnection: Object.keys(TRINO),
   DatabricksConnection: Object.keys(DATABRICKS),
   MysqlConnection: Object.keys(MYSQL),
+  SqlserverConnection: Object.keys(SQLSERVER),
   DuckdbConnection: Object.keys(DUCKDB),
   MotherDuckConnection: Object.keys(MOTHERDUCK),
   DucklakeConnection: Object.keys(DUCKLAKE),
@@ -348015,6 +348214,27 @@ async function getSchemasForPostgres(connection, malloyConnection) {
     throw new Error(`Failed to get schemas for Postgres connection ${connection.name}: ${error2.message}`, { cause: error2 });
   }
 }
+async function getSchemasForSQLServer(connection, malloyConnection) {
+  if (!connection.sqlserverConnection) {
+    throw new Error("SQL Server connection is required");
+  }
+  try {
+    const result = await runIntrospectionSQL(malloyConnection, "SELECT DISTINCT table_schema AS schema_name FROM information_schema.tables ORDER BY table_schema");
+    const rows = standardizeRunSQLResult2(result);
+    return rows.map((row) => {
+      const typedRow = row;
+      const schemaName = String(typedRow.schema_name ?? typedRow.SCHEMA_NAME ?? "");
+      return {
+        name: schemaName,
+        isHidden: false,
+        isDefault: schemaName === "dbo"
+      };
+    });
+  } catch (error2) {
+    logger.error(`Error getting schemas for SQL Server connection ${connection.name}`, { error: error2 });
+    throw new Error(`Failed to get schemas for SQL Server connection ${connection.name}: ${error2.message}`, { cause: error2 });
+  }
+}
 async function getSchemasForMySQL(connection) {
   if (!connection.mysqlConnection) {
     throw new Error("Mysql connection is required");
@@ -348364,6 +348584,8 @@ async function getSchemasForConnection(connection, malloyConnection) {
       return getSchemasForPostgres(connection, malloyConnection);
     case "mysql":
       return getSchemasForMySQL(connection);
+    case "sqlserver":
+      return getSchemasForSQLServer(connection, malloyConnection);
     case "snowflake":
       return getSchemasForSnowflake(connection, malloyConnection);
     case "trino":
@@ -348551,6 +348773,8 @@ async function listTablesForSchema(connection, schemaName, malloyConnection, tab
       return listTablesForMySQL(connection, schemaName, malloyConnection, tableNames);
     case "postgres":
       return listTablesForPostgres(connection, schemaName, malloyConnection, tableNames);
+    case "sqlserver":
+      return listTablesForSQLServer(connection, schemaName, malloyConnection, tableNames);
     case "snowflake":
       return listTablesForSnowflake(connection, schemaName, malloyConnection, tableNames);
     case "trino":
@@ -348619,6 +348843,27 @@ async function listTablesForMySQL(connection, schemaName, malloyConnection, tabl
     throw new Error(`Failed to get tables for MySQL schema ${schemaName} in connection ${connection.name}: ${error2.message}`, { cause: error2 });
   }
 }
+function sqlserverNLiteral(value) {
+  return `N'${sqlLiteral(value, "sqlserver")}'`;
+}
+function sqlserverInFilter(columnName, values) {
+  if (!values || values.length === 0)
+    return "";
+  return `AND ${columnName} IN (${values.map(sqlserverNLiteral).join(", ")})`;
+}
+async function listTablesForSQLServer(connection, schemaName, malloyConnection, tableNames) {
+  if (!connection.sqlserverConnection) {
+    throw new Error("SQL Server connection is required");
+  }
+  try {
+    const result = await runIntrospectionSQL(malloyConnection, `SELECT table_name, column_name, data_type FROM information_schema.columns WHERE table_schema = ${sqlserverNLiteral(schemaName)} ${sqlserverInFilter("table_name", tableNames)} ORDER BY table_name, ordinal_position`);
+    const rows = standardizeRunSQLResult2(result);
+    return groupColumnRowsIntoTables(rows, (t2) => `${schemaName}.${t2}`);
+  } catch (error2) {
+    logger.error(`Error getting tables for SQL Server schema ${schemaName} in connection ${connection.name}`, { error: error2 });
+    throw new Error(`Failed to get tables for SQL Server schema ${schemaName} in connection ${connection.name}: ${error2.message}`, { cause: error2 });
+  }
+}
 async function listTablesForPostgres(connection, schemaName, malloyConnection, tableNames) {
   if (!connection.postgresConnection) {
     throw new Error("Postgres connection is required");
@@ -348939,12 +349184,12 @@ function classifyDriverFailure(error2) {
     return error2;
   }
   const message = error2 instanceof Error ? error2.message : typeof error2 === "string" ? error2 : JSON.stringify(error2);
-  return databaseAccessFailure(error2) ?? driverErrorToPublisherError(message);
+  return databaseAccessFailure(error2) ?? statementRejection(error2) ?? driverErrorToPublisherError(message);
 }
 function sqlRunFailure(error2) {
   if (error2 instanceof ConnectionError)
     return error2;
-  return databaseAccessFailure(error2) ?? new ConnectionError(error2.message);
+  return databaseAccessFailure(error2) ?? statementRejection(error2) ?? new ConnectionError(error2.message);
 }
 async function withDatabaseAccessClassified(list) {
   try {
@@ -349034,8 +349279,11 @@ class ConnectionController {
         throw new TableNotFoundError(`Table ${tablePath} not found`);
       }
       if (typeof source === "string") {
-        const prefix = `Error fetching schema for ${tablePath}: `;
-        const accessFailure = source.startsWith(prefix) ? databaseAccessFailure(new Error(source.slice(prefix.length))) : undefined;
+        if (source === `Table ${tablePath} not found`) {
+          throw new TableNotFoundError(source);
+        }
+        const driverMessage = lookupFailureDriverMessage(source, tablePath);
+        const accessFailure = driverMessage === undefined ? undefined : databaseAccessFailure(new Error(driverMessage));
         throw accessFailure ?? driverErrorToPublisherError(source);
       }
       return {
@@ -349314,6 +349562,16 @@ class ConnectionController {
     };
   }
 }
+function lookupFailureDriverMessage(source, tablePath) {
+  const prefix = `Error fetching schema for ${tablePath}: `;
+  if (source.startsWith(prefix))
+    return source.slice(prefix.length);
+  const sqlserverPrefix = `Error fetching schema for table ${tablePath}: `;
+  if (source.startsWith(sqlserverPrefix)) {
+    return source.slice(sqlserverPrefix.length).replace(/^\d+: /, "");
+  }
+  return;
+}
 
 // src/controller/report.controller.ts
 init_errors();
@@ -349368,6 +349626,19 @@ function recordPackageLoadPhases(timings, status) {
   schemaFetchDuration?.record(timings.schemaFetchDurationMs, attrs);
   schemaFetches?.record(timings.schemaFetchCount, attrs);
 }
+var phaseDuration = null;
+function recordPackageLoadPhaseDurations(durations) {
+  phaseDuration ??= publisherMeter().createHistogram("publisher_package_load_phase_duration_ms", {
+    description: "Per-load wall-clock time of each stage of a successful package load, main-thread stages included. Label: phase (worker, hydrate, render_validation, discovery, lint, build_plan, total).",
+    unit: "ms",
+    advice: { explicitBucketBoundaries: LOAD_DURATION_BUCKETS_MS }
+  });
+  for (const [phase, ms] of Object.entries(durations)) {
+    if (ms === undefined)
+      continue;
+    phaseDuration.record(ms, { phase });
+  }
+}
 
 // src/report_metrics.ts
 var resetHooks2 = [];
@@ -351424,7 +351695,7 @@ with both queries. Otherwise it is still \`NOT-RETURNED\` / \`LOW-RANK\`.
 Use when the entity was found and used, and the definition or the data behind it
 is wrong (bad grain, wrong join key, inverted filter). Owner: model. A doc whose
 factual claim the data contradicts (a population statement, a grain claim) is
-also model-definition: the SQL may be right while the stated contract is false,
+also model-definition: the field may compute correctly while its doc is false,
 and an agent that trusts the doc answers wrongly without ever failing a query.
 Probe the claim before writing the issue.
 
@@ -352138,7 +352409,7 @@ trusting a name that looks familiar, and write down the mapping you used in
 |---|---|---|
 | \`prompt\`, \`query\`, \`input\`, \`nl_question\` | the question | \`query\` is the trap: in half of these it is the SQL or Malloy they ran, not the question |
 | \`answer\`, \`expected\`, \`output\`, \`ground_truth\` | a golden value, prose, or both mixed in one string | a paragraph under \`answer\` is criteria, not a value. Classify it, do not store it as a number |
-| \`sql\`, \`malloy\`, \`gold_query\` | their derivation | run it (\`SKILL.md\` step 3). This is the field that upgrades a typed number into something checkable |
+| \`sql\`, \`malloy\`, \`gold_query\` | their derivation | Malloy: run it (\`SKILL.md\` step 3). SQL: keep it as evidence of how they got the number, but do not run it; derive the number in Malloy over the truth package instead. Either way, this is the field that upgrades a typed number into something checkable |
 | \`criteria\`, \`rubric\`, \`assertions\`, \`must_include\` | prose criteria | apply the query test in \`SKILL.md\` step 4 to EACH one, not to the field |
 | \`id\`, \`case_id\`, \`uuid\` | their id | keep it, prefixed. Two sets from one customer collide otherwise |
 | \`difficulty\`, \`category\`, \`tags\` | their own labels | keep as-is on the case for slicing. Never let one become \`split\` |
@@ -352301,7 +352572,7 @@ data with no question in front of them?* Reject:
 
 - a field that hard-codes this question's filter and serves no other question
 - this question's text, qid, or expected numbers in a doc, comment, or name
-- a join copied from gold SQL that you have not probed as a real relationship
+- a join copied from a golden's query that you have not probed as a real relationship
 
 The golden is a hypothesis source. The data is still the verifier.
 
@@ -352310,12 +352581,16 @@ The golden is a hypothesis source. The data is still the verifier.
 Every structural claim needs a query you ran: join key, primary key, filter
 value existence, snapshot assumption, value space, cardinality.
 
-\`\`\`sql
-SELECT COUNT(*), COUNT(DISTINCT col) FROM t;
-SELECT a.k, COUNT(*) FROM a JOIN b ON … GROUP BY 1 ORDER BY 2 DESC;
-SELECT col, COUNT(*) FROM t GROUP BY 1 ORDER BY 2 DESC LIMIT 5;
+\`\`\`malloy
+run: t -> { aggregate: row_count is count(), distinct_keys is count(col) }
+run: b -> { group_by: k; aggregate: n is count(); order_by: n desc; limit: 5 }
+run: t -> { group_by: col; aggregate: n is count(); order_by: n desc; limit: 5 }
 \`\`\`
 
+Run probes in Malloy, against the raw tables (the truth package, or a bare
+\`connection.table()\` source), never as SQL. The second line is the join probe:
+any \`n\` above 1 means \`k\` is not a key on \`b\`, so a \`join_one\` on it fans out.
+
 A false \`primary_key\` compiles and silently corrupts every aggregate. Of one
 pilot's 11 accepted edits, 4 of 5 wrong ones died to a single
 \`COUNT(*)\` vs \`COUNT(DISTINCT …)\` probe that was never run.
@@ -352660,7 +352935,7 @@ Output, exactly this shape:
    plainly the answer explained itself, and however the rubric is worded. Say
    in \`why\` that you are overriding a rubric clause, so the clause gets fixed.
    This rule exists because a set shipped one: a question asked for sales over
-   the company's season, the answer gave the meteorological window 25% lower
+   the company's season, the answer gave the meteorological window 20% lower
    and said which window it used, and a clause granting \`near_match\` for a
    stated window kept a materially wrong answer out of the pass rate
    entirely -- the arm reported 100%.
@@ -354724,7 +354999,7 @@ End with a short **Next steps**: one or two specific deeper analyses the data co
     {
       name: "malloy-analysis-report",
       description: 'Combine validated Malloy queries into a report (a linear report, read top to bottom). Use when the user asks to "create a report", "combine these into a report", or wants a persistent multi-query artifact.',
-      body: "# Creating Reports\n\nAn ad-hoc report is a Publisher **report** with `layout=linear`: a `.malloy` file at the package root, `<slug>.malloy` (unless the user asks for another location), that combines markdown narrative with live Malloy queries. An ad-hoc report is written as `run:` cells, which Publisher reads and which convert to tiles when saved in the Console; when the queries are views on a source, or the report will be kept and edited, `skill:malloy-reports` describes the tile form (`tiles=[…]`) to author instead. Load `skill:malloy-reports` for the full format and authoring rules; this skill covers when to build one and how to design good report content (cells, chart annotations, narrative structure). Never write a new `.malloynb`, and do not create a `notebooks/` or `dashboards/` directory for it.\n\n> **Tool names** are written bare here - `get_context`, `execute_query`, `search_malloy_docs`. The exact prefixed name depends on the host surface; match each against the tools you actually have.\n\n## Before building a report\n\n1. **Run each query first** via `execute_query` to verify it works and returns expected results.\n2. **Explain the results** to the user as you go: walk through the analysis step by step.\n3. **Then assemble the report** once the analysis is validated.\n\nDo NOT build the report in the same turn as `execute_query`. Explain first, then build.\n\n## Filters are inherited from the model, don't declare them in the report\n\nDo not declare filters in an ad-hoc report. If the source declares `given:` parameters (or legacy `#(filter)` annotations), Publisher renders the controls, parses caller parameters, and applies them server-side automatically: the report inherits and displays them with no extra work. If the analysis needs a knob the source doesn't expose, the right move is to add a `given:` to the source itself, not to wedge a filter widget into the report. `#(filter)` is deprecated in favour of native Malloy `given:` parameters. Never add a `#(filter)` annotation: every use, including `required`, `implicit`, and date/number ranges, has a `given:` form. The `malloy-model` skill covers this under § Legacy: Parameterizable Filters. For a curated report with its own filter controls on top of the model, see `skill:malloy-reports` instead.\n\n## What goes in the report\n\nDo NOT add an H1 heading in any markdown (use H2 and below for sections); the `title` in the `## artifact` tag serves as the title. To redo the structure rather than tweak one cell, rewrite the report file end-to-end.\n\nMarkdown cells own narrative; query cells own a single Malloy query whose chart annotation tells the renderer how to display the result. Markdown supports H2 headings, lists, bold, and inline code. Keep narrative cells short, one idea per cell, so the rendered output reads as a story instead of a wall of text.\n\nThe file starts with `## artifact { layout=linear title=\"...\" }`, then the `import` for the model file (relative to the report's own location: `\"order_analysis.malloy\"` from the package root). Definitions (`import`, `source:`, `query:`, `given:`) come before the first markdown or `run:`. Prose is `##|(markdown)` ... `|##` for a block (body on the lines between) or `##(markdown) text` for one line. Each `run:` is a query cell, and its tags sit directly above it with nothing between. A `#\"` directly above the `run:` is its caption. Trailing prose is `##(markdown)`, never `#(markdown)` or `#\"`.\n\nThis is the cell format, the quick form for an ad-hoc report; for a report that will be kept and edited, write the tile form in `skill:malloy-reports` (`## artifact { layout=linear tiles=[…] }`) instead.\n\nEach `run:` must be a standalone query (for example `run: source -> { ... }`). The `import` is file-wide: query cells never repeat it. Compile the file with `/compile` (`\"scope\": \"file\"`, at the path `<slug>.malloy`) before saving; a report compiles as a model, so its errors come back there. A complete report:\n\n```malloy\n## artifact { layout=linear title=\"Sales report\" }\nimport \"order_analysis.malloy\"\n\n##|(markdown)\n## Overview\nWhat is driving sales, and which categories carry it? The queries below cover every order in the model.\n|##\n\n# big_value\nrun: order_analysis -> {\n  aggregate:\n    # label=\"Revenue\"\n    # currency\n    total_revenue\n\n    # label=\"Orders\"\n    # number=auto\n    order_count\n}\n\n##(markdown) ## Trend: how does revenue move over time?\n\n#\" Revenue by month\n# line_chart\nrun: order_analysis -> {\n  group_by: order_date.month\n  aggregate: total_revenue\n  order_by: 1\n}\n\n##|(markdown)\n## Breakdown\nWhich categories account for the most revenue?\n|##\n\n#\" Top ten categories by revenue\n# bar_chart\nrun: order_analysis -> {\n  group_by: category\n  aggregate: total_revenue\n  order_by: total_revenue desc\n  limit: 10\n}\n\n##(markdown) ## Key takeaways: what to look at next.\n```\n\nA well-structured report typically follows this pattern:\n\n```\n[Markdown]  ## Overview: what question are we answering, what data is in scope (date range, entity count)\n[Malloy]    KPI cell: headline numbers (e.g., # big_value, or # dashboard with nested # big_value cells)\n[Markdown]  ## Trend: describe what we should look for over time\n[Malloy]    Time-series cell (e.g., # line_chart on a date dimension)\n[Markdown]  ## Breakdown: where the signal is\n[Malloy]    Categorical cell (e.g., # bar_chart on a categorical dimension)\n[Markdown]  ## Key takeaways: what the user should walk away with\n```\n\nUse this as a default; deviate when the analysis warrants. A grounded report names the time range and entity count up front so every number that follows has context.\n\n## Choosing chart types and annotations\n\nRead `skill:malloy-charts` before picking visualizations: it owns chart-type selection, properties, and the placement rules for chart annotations. `skill:malloy-queries` covers Malloy query patterns and the critical placement rules for chart-annotation tags.\n\nWhen in doubt:\n- KPIs / single numbers -> `# big_value`, often nested inside `# dashboard`.\n- Trend over time -> `# line_chart`, usually on the primary date dimension.\n- Category comparisons -> `# bar_chart`, ordered by the metric.\n- Tabular data with many columns -> a plain table cell with `# table.size=fill`.\n- Multiple coordinated charts -> `# dashboard` with `nest:` blocks.\n\nAnnotations go **before** `run:`, never inside curly braces:\n\n```malloy\n# bar_chart\nrun: source -> {\n  group_by: category\n  aggregate: revenue\n  order_by: revenue desc\n  limit: 10\n}\n```\n\nA `# dashboard` cell composes nested views, useful for KPIs alongside a trend in a single cell. Each `nest:` is a tile; any top-level `aggregate:` measures render as KPI cards. For a fixed grid, use `# dashboard { columns=N }` with `# colspan` on each tile (see `skill:malloy-charts`):\n\n```malloy\n# dashboard { columns=2 }\nrun: source -> {\n  nest:\n    # colspan=2\n    # big_value\n    kpis is {\n      aggregate:\n        # label=\"Revenue\"\n        # currency\n        total_revenue\n\n        # label=\"Orders\"\n        # number=auto\n        order_count\n    }\n  nest:\n    # line_chart\n    trend is {\n      group_by: order_date.month\n      aggregate: total_revenue\n      order_by: 1\n    }\n}\n```\n\nKey rendering rules to keep in mind when shaping a cell:\n- FIRST `group_by` = x-axis, FIRST `aggregate` = y-axis.\n- Override field roles with `# x`, `# y`, `# series` on individual fields.\n- For multiple measure series, place `# y` above the `aggregate:` keyword.\n- One aggregate per chart view: use `# dashboard` with nested views for multiple charts.\n- Use `# table.size=fill` for standalone table queries.\n\n## Editing an existing report\n\nFor small targeted changes (fix one cell, insert one new cell), edit the cell's statement or markdown in place rather than recreating the whole report. For structural rewrites (reordering many cells, changing the narrative arc), rewrite the report file. An existing `.malloynb` is read, not edited: to change its story, write a `.malloy` report. An existing report's tag that says `kind=notebook` is the deprecated spelling of `layout=linear`; fix it when you edit the file.\n\n## IMPORTANT\n\nYou CANNOT see the rendered output of report cells. Do not claim to see charts, values, or patterns from report cells you haven't explicitly executed via `execute_query`. If you need to analyze results, run the query via `execute_query` first."
+      body: "# Creating Reports\n\nAn ad-hoc report is a Publisher **report** with `layout=linear`: a `.malloy` file at the package root, `<slug>.malloy` (unless the user asks for another location), that combines markdown narrative with live Malloy queries, as text tiles and query tiles read top to bottom. Load `skill:malloy-reports` for the full format and authoring rules; this skill covers when to build one and how to design good report content (tiles, chart annotations, narrative structure). Never write a new `.malloynb`, never write a report as bare `run:` statements (that older form is no longer read), and do not create a `notebooks/` or `dashboards/` directory for it.\n\n## Before building a report\n\n1. **Run each query first** via `execute_query` to verify it works and returns expected results.\n2. **Explain the results** to the user as you go: walk through the analysis step by step.\n3. **Then assemble the report** once the analysis is validated.\n\nDo NOT build the report in the same turn as `execute_query`. Explain first, then build.\n\n## Filters belong to the report, never to the source\n\nAn ad-hoc report usually needs no filters: it records an analysis already run. If the user wants one a reader can change (a manufacturer, a date range), declare the given in the report and bind it on its tiles, as `skill:malloy-reports` describes. Do not add a `given:` to the source for it: a model-level `where:` filters every read of the source, chat and every other report included, and the report builder can show such a filter but not change or remove it. A given the source already reads (a gate, a value every query must supply) shows in the report with no work, and stays in the model.\n\nNever add a `#(filter)` annotation: it is deprecated, and every use has a `given:` form (`malloy-model` covers the migration).\n\n## What goes in the report\n\nDo NOT add an H1 heading in any markdown (use H2 and below for sections); the `title` in the `## artifact` tag serves as the title. To redo the structure rather than tweak one tile, rewrite the report file end-to-end.\n\nText tiles own narrative; query tiles own a single Malloy query whose chart annotation tells the renderer how to display the result. Markdown supports H2 headings, lists, bold, and inline code. Keep text tiles short, one idea per tile, so the rendered output reads as a story instead of a wall of text.\n\nThe file has four parts, in this order:\n\n1. **The tag**, `##| artifact { layout=linear title=\"...\" tiles=[…] }`, listing every tile in reading order. A text tile is `name { kind=text }`; a query tile is the quoted string `\"<extension> -> <view>\"`.\n2. **The `import`** of the model file, relative to the report's own location (`\"order_analysis.malloy\"` from the package root).\n3. **The text tiles**, each a `##|(markdown) name` block: the name on the opener line, the body on the lines below, `|##` closing it.\n4. **One extension of the source**, `source: <source>_tiles is <source> extend { … }`, holding a `view:` per query tile. The view's chart tag and `# label=\"…\"` (the tile's heading) go directly above it.\n\nCompile the file with `/compile` (`\"scope\": \"file\"`, at the path `<slug>.malloy`) before saving; a report compiles as a model, so its errors come back there. After saving and reloading, read the package warnings: a tile that names a missing view is reported there, not by the compile. A complete report:\n\n```malloy\n##| artifact { layout=linear title=\"Sales report\"\n  tiles=[\n    overview { kind=text },\n    \"order_analysis_tiles -> headline\",\n    trend { kind=text },\n    \"order_analysis_tiles -> revenue_by_month\",\n    breakdown { kind=text },\n    \"order_analysis_tiles -> top_categories\",\n    takeaways { kind=text }\n  ]\n}\n|##\nimport \"order_analysis.malloy\"\n\n##|(markdown) overview\n## Overview\nWhat is driving sales, and which categories carry it? The tiles below cover every order in the model.\n|##\n\n##|(markdown) trend\n## Trend\nHow does revenue move over time?\n|##\n\n##|(markdown) breakdown\n## Breakdown\nWhich categories account for the most revenue?\n|##\n\n##|(markdown) takeaways\n## Key takeaways\nWhat to look at next.\n|##\n\nsource: order_analysis_tiles is order_analysis extend {\n  # big_value\n  # label=\"Headline\"\n  view: headline is {\n    aggregate:\n      # label=\"Revenue\"\n      # currency\n      total_revenue\n\n      # label=\"Orders\"\n      # number=auto\n      order_count\n  }\n\n  # line_chart\n  # label=\"Revenue by month\"\n  view: revenue_by_month is {\n    group_by: order_date.month\n    aggregate: total_revenue\n    order_by: 1\n  }\n\n  # bar_chart\n  # label=\"Top ten categories by revenue\"\n  view: top_categories is {\n    group_by: category\n    aggregate: total_revenue\n    order_by: total_revenue desc\n    limit: 10\n  }\n}\n```\n\nWhen the model already has the view you want, the tile view refines it rather than repeating it: `view: top_categories is by_category + { limit: 10 }`.\n\nA well-structured report typically follows this pattern:\n\n```\n[Text]   ## Overview: what question are we answering, what data is in scope (date range, entity count)\n[Query]  KPI tile: headline numbers (e.g., # big_value, or # dashboard with nested # big_value views)\n[Text]   ## Trend: describe what we should look for over time\n[Query]  Time-series tile (e.g., # line_chart on a date dimension)\n[Text]   ## Breakdown: where the signal is\n[Query]  Categorical tile (e.g., # bar_chart on a categorical dimension)\n[Text]   ## Key takeaways: what the user should walk away with\n```\n\nUse this as a default; deviate when the analysis warrants. A grounded report names the time range and entity count up front so every number that follows has context.\n\n## Choosing chart types and annotations\n\nRead `skill:malloy-charts` before picking visualizations: it owns chart-type selection, properties, and the placement rules for chart annotations. `skill:malloy-queries` covers Malloy query patterns and the critical placement rules for chart-annotation tags.\n\nWhen in doubt:\n\n- KPIs / single numbers -> `# big_value`, often nested inside `# dashboard`.\n- Trend over time -> `# line_chart`, usually on the primary date dimension.\n- Category comparisons -> `# bar_chart`, ordered by the metric.\n- Tabular data with many columns -> a plain table tile with `# table.size=fill`.\n- Multiple coordinated charts -> `# dashboard` with `nest:` blocks.\n\nAnnotations go **directly above** the tile's `view:`, never inside its curly braces:\n\n```malloy\n# bar_chart\nview: top_categories is {\n  group_by: category\n  aggregate: revenue\n  order_by: revenue desc\n  limit: 10\n}\n```\n\nA `# dashboard` tile composes nested views, useful for KPIs alongside a trend in a single tile. Each `nest:` is a tile; any top-level `aggregate:` measures render as KPI cards. For a fixed grid, use `# dashboard { columns=N }` with `# colspan` on each tile (see `skill:malloy-charts`):\n\n```malloy\n# dashboard { columns=2 }\nview: summary is {\n  nest:\n    # colspan=2\n    # big_value\n    kpis is {\n      aggregate:\n        # label=\"Revenue\"\n        # currency\n        total_revenue\n\n        # label=\"Orders\"\n        # number=auto\n        order_count\n    }\n  nest:\n    # line_chart\n    trend is {\n      group_by: order_date.month\n      aggregate: total_revenue\n      order_by: 1\n    }\n}\n```\n\nKey rendering rules to keep in mind when shaping a tile:\n\n- FIRST `group_by` = x-axis, FIRST `aggregate` = y-axis.\n- Override field roles with `# x`, `# y`, `# series` on individual fields.\n- For multiple measure series, place `# y` above the `aggregate:` keyword.\n- One aggregate per chart view: use `# dashboard` with nested views for multiple charts.\n- Use `# table.size=fill` for standalone table queries.\n\n## Editing an existing report\n\nFor small targeted changes (fix one view, insert one tile), edit that view or text block in place and add its entry to `tiles=[…]`, rather than recreating the whole report. For structural rewrites (reordering many tiles, changing the narrative arc), rewrite the report file. An existing `.malloynb` is read, not edited: to change its story, write a `.malloy` report. A tag that sets `kind=notebook` is no longer read, so the file is not a report (`report-kind-removed`): replace it with `layout=linear` and list the tiles. A linear file with no `tiles=[…]`, written as bare `run:` statements, is no longer a report: rewrite it as tiles (`skill:malloy-reports`, `reference/linear.md`).\n\n## IMPORTANT\n\nYou CANNOT see the rendered output of report tiles. Do not claim to see charts, values, or patterns from report tiles you haven't explicitly executed via `execute_query`. If you need to analyze results, run the query via `execute_query` first."
     },
     {
       name: "malloy-charts",
@@ -354909,7 +355184,7 @@ The user will:
 - **Remove** fields they don't need.
 - **Change** priorities.
 
-Once the definitions are confirmed, write them into the \`.malloy\` model (see your modeling workflow). Use \`#(doc)\` annotations to document sources and fields, and \`given:\` parameters to declare runtime-filterable dimensions where appropriate. \`#(filter)\` is deprecated. Never add a \`#(filter)\` annotation: every use, including \`required\`, \`implicit\`, and date/number ranges, has a \`given:\` form. See \`skill:malloy-model\` § Parameterizing sources with \`given:\`. Keep the confirmed definitions in the conversation; there is no separate plan-file store.
+Once the definitions are confirmed, write them into the \`.malloy\` model (see your modeling workflow). Use \`#(doc)\` annotations to document sources and fields, and a \`given:\` only where the data's meaning or access depends on a runtime value (a gate, a value every query must supply). A filter a reader picks on a dashboard belongs to the report, not the model. \`#(filter)\` is deprecated. Never add a \`#(filter)\` annotation: every use, including \`required\`, \`implicit\`, and date/number ranges, has a \`given:\` form. See \`skill:malloy-model\` § Parameterizing sources with \`given:\`. Keep the confirmed definitions in the conversation; there is no separate plan-file store.
 
 ## Data-driven proposals
 
@@ -357447,31 +357722,39 @@ gets unwieldy.
 
 ## Parameterizing sources with \`given:\` (preferred)
 
-Native Malloy **\`given:\` parameters** are how you expose tunable knobs (date range, region, manufacturer) on a source. \`#(filter)\` is deprecated: never add one. A \`given:\` is a first-class runtime parameter you reference in the model's own logic; callers supply values at query time and the model uses them however it declares. Enable them with \`##! experimental.givens\` at the top of the model.
+Native Malloy **\`given:\` parameters** are runtime values a model reads in its own logic; callers supply them at query time. \`#(filter)\` is deprecated: never add one. Enable givens with \`##! experimental.givens\` at the top of the model.
+
+**A given belongs in the model only when the data's meaning or access depends on it:**
+
+- a row-level gate: \`#(authorize)\`, \`#(access_filter)\`, a \`#(secure)\` given, \`$GROUPS\`;
+- a value every query must supply (the no-default row in the table below);
+- a parameter a measure, dimension or view is defined with;
+- scoping the author means to apply to every consumer of the source: chat, MCP and every report.
+
+**A filter a reader picks on a dashboard or notebook is not modeling.** Manufacturer, a date range, region, a "major recalls only" toggle: don't add it to a source. Leave the source unfiltered, and let the report declare the given and bind it on its tiles (\`skill:malloy-reports\`). A model-level \`where:\` applies to every read of the source, chat and every other report included, and a report cannot take it over, because binding is per declaration, not per name. The report builder shows such a filter but cannot remove or reconfigure it.
 
 \`\`\`malloy
 ##! experimental.givens
 
-given:
-  manufacturer_filter :: filter<string> is f''
-  subject_filter :: filter<string> is f''
+# A value every query must supply: the table is partitioned by day.
+given: EVENT_DATE :: date
 
-source: recalls is duckdb.table('data/auto_recalls.csv') extend {
-  where: Manufacturer ~ $manufacturer_filter, Subject ~ $subject_filter
-  measure: recall_count is count()
+source: events is duckdb.table('data/events.parquet') extend {
+  where: event_date = $EVENT_DATE
+  measure: event_count is count()
 }
 \`\`\`
 
-A given is **declared bare** but **referenced with a \`$\` sigil** in expressions (\`$manufacturer_filter\`), as above.
+A given is **declared bare** but **referenced with a \`$\` sigil** in expressions (\`$EVENT_DATE\`), as above.
 
-- **Give every optional filter a neutral, match-all default** - a \`filter<>\` given defaulting to \`f''\` - so an unsupplied value returns unfiltered rows, matching how \`#(filter)\` behaves when a value is omitted. Because the given bakes an always-on \`where:\` into the source, a non-neutral default (e.g. a date floor) applies to *every* read of the source, not just the ones that opt in - so keep defaults neutral. Defaults must be Malloy literals.
+- **An optional given in the model gets a neutral, match-all default** (a \`filter<>\` given defaulting to \`f''\`), so an unsupplied value returns unfiltered rows. Because it bakes an always-on \`where:\` into the source, a non-neutral default (a date floor, say) applies to *every* read of the source. Defaults must be Malloy literals.
 - **Givens don't auto-inject a \`where:\`.** Unlike \`#(filter)\`, you write the filter expression that references the given yourself (e.g. \`where: dimension ~ $given_name\`).
 - **Every \`#(filter)\` use has a \`given:\` form.** Never add a \`#(filter)\` annotation to a model, not even for \`required\`, \`implicit\`, or a date/number range:
 
 | You want | Write this | Not this |
 |---|---|---|
-| An optional value or list filter | \`given: REGION :: filter<string> is f''\` and \`where: region ~ $REGION\` | \`#(filter) dimension=region type=in\` |
-| A date or number range | \`given: MIN_SALE :: filter<number> is f''\` (or \`filter<date>\`) and \`where: sale_price ~ $MIN_SALE\`. The caller sends a filter expression such as \`>= 50\`. | two \`#(filter)\` lines, \`greater_than\` and \`less_than\` |
+| An optional value or list filter a reader picks | In the **report**, not the model: \`given: REGION :: filter<string> is f''\` there, bound on its tiles with \`+ { where: region ~ $REGION }\` (\`skill:malloy-reports\`). In the model only for one of the cases above. | \`#(filter) dimension=region type=in\` |
+| A date or number range a reader picks | In the **report** the same way: \`given: MIN_SALE :: filter<number> is f''\` (or \`filter<date>\`), bound with \`+ { where: sale_price ~ $MIN_SALE }\`. The caller sends a filter expression such as \`>= 50\`. | two \`#(filter)\` lines, \`greater_than\` and \`less_than\` |
 | A value every query must supply (the primary key is only unique within it, or the table is too big to scan whole) | a given with **no default**, e.g. \`given: EVENT_DATE :: date\` and \`where: event_date = $EVENT_DATE\`. A query that omits it fails with "Given 'EVENT_DATE' has no value and no default". | \`#(filter) ... required\` |
 | A row filter the system applies, not the caller | \`#(access_filter) org_id in $ORG_IDS\`, with \`ORG_IDS\` set by a trusted tier (see the trust caveat below) | \`#(filter) ... implicit\` |
 
@@ -357501,7 +357784,7 @@ Publisher formats the value from the dimension's type (\`'value'\`, bare \`true\
 
 \`#(filter)\` is not a security boundary. A caller skips it with \`bypass_filters=true\` (REST) or \`bypassFilters: true\` (POST body), or by writing their own query text. Use givens with \`#(authorize)\` / \`#(access_filter)\` for access control.
 
-**To migrate** a source, replace each annotation using the table above, then delete it. \`type=greater_than\` and \`type=less_than\` are exclusive, so a plain comparison you convert one to is \`>\` or \`<\`, not \`>=\` or \`<=\`. \`docs/givens.md\` § "Coming from \`#(filter)\`" has a worked conversion.
+**To migrate** a source, replace each annotation using the table above, then delete it. An optional filter (\`type=in\`, \`like\`, \`equal\`, a range) moves to the reports that offer it, declared and bound there, and the source is left unfiltered; a \`required\` one stays in the model as a no-default given. \`type=greater_than\` and \`type=less_than\` are exclusive, so a plain comparison you convert one to is \`>\` or \`<\`, not \`>=\` or \`<=\`. \`docs/givens.md\` § "Coming from \`#(filter)\`" has a worked conversion.
 
 ## Access Control: \`#(authorize)\` and \`#(access_filter)\`
 
@@ -357932,7 +358215,7 @@ When you've been doing analysis, writing queries, building views, creating repor
 
 ## Step 1: IDENTIFY, what belongs in a model?
 
-Scan your analysis \`.malloy\` files and reports (any \`.malloy\` with an \`## artifact\` tag, wherever it sits, or an existing \`.malloynb\`). A report (a \`tiles=[…]\` layout or \`run:\` cells, of either layout) is not a model file to restructure: lift its reusable definitions into a model and leave the report to import them. For each dimension, measure, join, or calculation, ask: **is this a reusable building block?**
+Scan your analysis \`.malloy\` files and reports (any \`.malloy\` with an \`## artifact\` tag, wherever it sits, or an existing \`.malloynb\`). A report (a \`tiles=[…]\` layout, of either layout) is not a model file to restructure: lift its reusable definitions into a model and leave the report to import them. For each dimension, measure, join, or calculation, ask: **is this a reusable building block?**
 
 A measure or dimension belongs in a model if it meets ANY of these criteria:
 
@@ -360351,7 +360634,7 @@ A flat layout at the package root is the simplest default, for models and report
 
 Publishable contents:
 - \`.malloy\` files - Semantic model definitions (base sources + joined sources)
-- Reports: \`.malloy\` files with an \`## artifact { layout=linear … }\` or \`## artifact { layout=grid … }\` tag, anywhere in the package (outside \`public/\`), written as tiles or, for a linear report, as older \`run:\` cells (see \`skill:malloy-reports\`). The tag alone makes a file a report and sets its layout; the folder means nothing. An existing \`.malloynb\` is still served as a linear report; never write a new one.
+- Reports: \`.malloy\` files with an \`## artifact { layout=linear … }\` or \`## artifact { layout=grid … }\` tag, anywhere in the package (outside \`public/\`), written as tiles (see \`skill:malloy-reports\`). A linear tag with no tiles, the retired \`run:\`-cell form, is no report. The tag alone makes a file a report and sets its layout; the folder means nothing. An existing \`.malloynb\` is still served as a linear report; never write a new one.
 - Data files (CSV/Parquet/XLSX) - Embedded data published with package
 
 ## Version Management
@@ -360720,7 +361003,7 @@ For anything not covered here, call \`search_malloy_docs\` with the topic (for e
     {
       name: "malloy-reports",
       description: "Build or modify a Malloy Publisher report: a .malloy file with an ## artifact tag, written at the package root unless asked otherwise, laid out as a grid (a dashboard, scanned at a glance) or linear (a notebook or data story, read top to bottom), with filter controls rendered from givens and # drill click-through. Use when the user asks for a dashboard, a notebook, a report, a data story, a filterable view, or drill-through between views, and no code is wanted. Legacy .malloynb files are read, not authored.",
-      body: "# Publisher Reports\n\n> A `.malloy` file with an `## artifact { layout=… tiles=[…] }` tag **is** a report. It imports the model, names the views to show, binds the filtering on those views, and says how to lay them out. Publisher discovers it at package load, renders the filter controls from the givens its tiles reference, offers `# drill` click-through, and serves it at `/<env>/<pkg>/<path>`, its package path without `.malloy`. No code, no build step.\n\nWhat other tools call a dashboard and a notebook are both reports here. The **layout** is the only difference:\n\n- **`layout=grid`**: tiles across a grid behind one filter row, scanned at a glance (a dashboard). Read `reference/grid.md` before you lay one out.\n- **`layout=linear`**: tiles and prose top to bottom, read in order (a notebook, a data story). Read `reference/linear.md` before you write one, and before you edit a report written as `run:` cells.\n\nEverything else (filters, text tiles, drill, the builder, the lint, the write path) is the same for both, and switching layout later is a one-property edit.\n\n## Where the file goes\n\n- **Write a new report at the package root**, as `<slug>.malloy`, unless the author asks for another location. No directory is required, and none is a convention: a report can live anywhere in the package except `public/`, and the root `index.malloy` is never a report. Do not create a `dashboards/` or `notebooks/` directory for it.\n- **Always write `layout=grid` or `layout=linear`** in the tag. A tag without one is read by a fallback rule, and a linear report that lists tiles without `layout=linear` is read as a grid. `kind=` is no longer read: a tag that sets it makes no report (`report-kind-removed`), so replace it with `layout=`.\n- **The package path is the report's identity.** `sales/q3.malloy` is the report `sales/q3`: its URL, its `GET …/reports/{path}` address, and its `# drill` target. Two reports may share a basename in different directories.\n- **Imports are relative to the report's own location.** At the root: `import { order_items } from \"storefront.malloy\"`. In a subdirectory: `\"../storefront.malloy\"`.\n- **An untagged `.malloy` file is an ordinary model**, wherever it lives. Shared definitions several reports import go in one.\n\n## When this is the right tool\n\n| The user wants                                       | Use                                                          |\n| ---------------------------------------------------- | ------------------------------------------------------------ |\n| A recurring, at-a-glance view behind shared filters  | this skill, `layout=grid`                                    |\n| A narrative, with prose between the numbers          | this skill, `layout=linear`                                  |\n| A quick write-up of queries you already ran          | `skill:malloy-analysis-report`, which writes a linear report |\n| Custom design, branding, or interactions beyond tags | an HTML data app                                             |\n| The model itself: sources, measures, joins           | `malloy-model`                                               |\n\nInteractivity is not the axis: both layouts get filter controls, URL-addressable state, Apply batching, and `# drill`. Pick on the shape of the document: scanned at a glance is grid, read top to bottom is linear. When in doubt, linear.\n\n## Build sequence\n\nTool names below are bare (`get_context`); match each against the tools you actually have, since a host may prefix or rename them. A host names its compile and reload tools its own way. Where you have none, use the REST endpoint named beside the step.\n\n1. **READ THE MODEL FIRST.** Get the real source, view, dimension, and given names from the package: `get_context` if you have it, otherwise the REST model endpoint for `index.malloy` (it answers 404 for a file off the surface) or the `.malloy` files. Never guess a name. A guessed field in a query fails the whole package load, not just that one report; a guessed tile or suggest source is quieter, and only shows up in the package warnings. If the package root holds an `index.malloy` (every scaffolded package does), a tile reads only the sources that file exports.\n2. **PICK THE LAYOUT AND THE TILES.** Which views, in what order, and on a grid how wide each sits. A query tile is a `view:` you declare in the report, named as `\"source -> view\"`.\n3. **DECLARE THE GIVENS** the report will filter by, in the report file itself, with their control tags (see \"Filter controls\"). The builder edits the report file and nothing else, so a filter it can add, change or remove is a declaration in that file. A given the model already declares and reads is imported by name, never declared again (see \"Givens that stay in the model\").\n4. **COMPOSE THE FILE** at its path (the package root unless asked otherwise), following the template below, but do not save it yet. Name the sources you need in the import. Each tile binds its controls with a refinement, `view: t is v + { where: category ~ $CATEGORY }`, one clause per given it answers to; a `filter<...>` binds with `~`, a plain `date` or `number` given is a value and binds with `>=`, `<=` or `=`. Only the givens some tile references become controls. Then import every source or query any referenced given names in a `suggest`; **a `suggest` naming a `query=` needs that query's own source imported as well**, because an import is not transitive.\n5. **COMPILE IT** with your compile tool (`POST …/models/<path>/compile` over REST) at the path the file will have, with **`\"scope\": \"file\"`**: a report opens with an `import`, which the default `append` scope refuses, and an existing file compiled at `append` collides with itself. **`\"scope\": \"file\"` does not check tiles, drills or suggest queries.** To see those before you save, compile the same text at `\"scope\": \"package\"` with `modelPath` set to the report's path: it runs the lint step 6 reads and returns its findings with code `dashboard-lint` (or `render-tag`). Editing an untagged model several reports import also wants `\"scope\": \"package\"`, which recompiles every file as saved.\n6. **SAVE IT, RELOAD, AND READ THE MANIFEST AND THE WARNINGS.** Save by writing the file, or with `PUT …/models/<path>` over REST (omit `expectedHash` to create; it creates at any new path and replaces only a file the package already serves as a report). Then your reload tool, or `GET …/packages/<pkg>?reload=true`. A 424 means the package did not load and your edit is not live. **The `warnings` key is absent when there are none.** Then read `GET …/packages/<pkg>/reports/<path>`: its `givens` are exactly the controls that will render, and its `layout` is the layout Publisher read. See \"Read the lint\".\n7. **OPEN IT AND LOOK.** Not optional; see \"What done means\".\n\n## The form\n\n```malloy\n##! experimental.givens\n##\" One line saying what this report is for.\n##| artifact { layout=grid title=\"Storefront overview\"\n  tiles=[\n    intro { kind=text colspan=12 },\n    \"overview -> kpis\",\n    \"overview -> revenue_trend\",\n    \"overview -> revenue_by_state\"\n  ]\n} dashboard { columns=12 }\n|##\nimport { order_items, products } from \"storefront.malloy\"\n\n# label=\"Category\" control=select suggest { source=products dimension=category }\ngiven: CATEGORY :: filter<string> is f''\n# label=\"Ordered since\"\ngiven: SINCE :: date is @2023-01-01\n\n##|(markdown) intro\nRevenue and margin for the selected category.\n|##\n\nsource: overview is order_items extend {\n  # colspan=12\n  # label=\"Key figures\"\n  # big_value\n  view: kpis is key_figures + { where: category ~ $CATEGORY, where: created_at >= $SINCE }\n\n  # colspan=8\n  # break\n  # label=\"Revenue by month\"\n  view: revenue_trend is sales_by_month + { where: category ~ $CATEGORY, where: created_at >= $SINCE }\n\n  # colspan=4\n  # label=\"Revenue by state\"\n  view: revenue_by_state is sales_by_state + { where: category ~ $CATEGORY, where: created_at >= $SINCE }\n}\n```\n\nThe same file with `layout=linear` and no `dashboard { … }` or `colspan` is a linear report.\n\n- **The tag is model-level**, one line (`## artifact { … }`) or a `##|` … `|##` block with the same text inside, the form to use once the list is long: one tile per line, `}` on its own line, `|##` closing at the opener's column. A one-line `##` tag must stay on one line: wrapping it is a compile error, or worse, compiles clean and quietly stops being a report.\n- **The header** above the tag holds only `##!` flags, `//` comments and the unnamed `\"` notes that are the report's description. A statement or a `#` tag above `## artifact` is an error.\n- **Quote every query entry.** `\"overview -> kpis\"` is a string; unquoted, the tag does not parse (`notebook-artifact-unparsed`). A bare quoted name (`\"top_products\"`) names a model-level `query:` in the file.\n- **A query tile is a thin `view:` on an extension the report declares** (`source: overview is order_items extend { … }`): the modelled view keeps its chart tag, the wrapper carries the tile's `# label`, its width on a grid, and its binding.\n- **A text tile is a `##|(markdown) name` block** listed as `name { kind=text }`. The name is one bare word on the opener line, the body starts on the next line (a heading goes inside the block), and `|##` closes it at the opener's column. A bare `intro` without `{ kind=text }` is the query-tile form for a `query:`, so the block is not shown. On a grid the entry also takes `colspan` and `break`, and nothing else.\n- **File order:** header, imports and givens, the prose blocks in tile order, then the extension that defines the tile views. That is the order the builder writes.\n- **A `run:` in a report that lists `tiles` is never shown** (`notebook-layout-run`). Define a view, list it, delete the `run:`.\n- **A tile expression is a string, so the compiler never checks it.** Rename a view and the file still compiles; the tile fails at package load, where the lint names it.\n- **Chart tags go on the view** (`# line_chart`, `# bar_chart`, `# big_value`, `# label=\"…\"`). `skill:malloy-charts` covers choosing them.\n\n## Filter controls\n\nControls come from the `given:` declarations the tiles reference. The tags on the declaration are the control contract:\n\n```malloy\n##! experimental.givens\n\n# label=\"Category\" control=select suggest { source=products dimension=category }\ngiven: CATEGORY :: filter<string> is f''\n\n# label=\"Brand\" control=multiselect suggest { query=brand_suggest dimension=brand }\ngiven: BRAND :: filter<string> is f''\n\n# label=\"Minimum line total\" range_min=0 range_max=250\ngiven: MIN_SALE :: filter<number> is f''\n\n# label=\"Ordered since\"\ngiven: SINCE :: date is @2023-01-01\n```\n\n`control=select`/`multiselect` with a `suggest` renders a picker filled from the data; `range_min`/`range_max` on a `filter<number>` renders a two-handled range slider; a `filter<date>` or `filter<timestamp>` renders a time-range control with preset windows and a custom day range; a bare `date` or `timestamp` renders a date picker; a `filter<string>` with no tag renders a text box taking filter syntax. Which controls appear is per report, decided by which givens its tiles reference.\n\n- `#(description=\"…\")` renders as helper text under the control and draws a cosmetic \"not a well-formed route\" compile diagnostic for a multi-word value; `# description=\"…\"` publishes to the API but the UI does not render it.\n- `dimension=` can name a field of a directly joined source, quoted: `suggest { source=sales dimension=\"products.department\" }`. On the `query=` form, `dimension` names a column of that query's output; match it to the query's `group_by`.\n- **A suggest's source or query has to resolve in the report file**, so import it there. Getting it wrong does not error: the control still looks like a picker and says \"Could not load the options for this control\"; the package warnings name it.\n- Two options on the artifact tag, either layout: `autorun=false` batches control changes behind an Apply button; `givens { CATEGORY=f'Outerwear' }` sets starting values (a URL parameter wins). A file-level `## autorun=false` does nothing on a `.malloy` report.\n\n### Binding, and givens that stay in the model\n\n**Binding is per declaration, not per name.** A report declaring its own `CATEGORY` over a source whose model-level `where:` reads the model's `CATEGORY` compiles, shows the control, and filters nothing. So bind on the tiles, with `+ { where: … }`. The other design, model-level scoping, still works: put a scoped source in an untagged model that imports the givens it reads, and import that model and those givens into the report. Do not mix the two on one given.\n\nA given stays in the model, declared once there, when a model source, view or measure, an `#(authorize)` or `#(access_filter)` gate, or an HTML data app reads it. The report imports it by name (`import { CATEGORY } from \"givens.malloy\"`) and never re-declares it:\n\n- **Import a name and also declare it: a compile error.** Drop the local declaration.\n- **Declare a name the model already reads, without importing it: no error at all.** The control renders and moves, and the model's own `where:` or gate never sees the value.\n\nA given has to be in the report file's own scope to be bindable: declared there or imported. Never add a `#(filter)` annotation: it is deprecated, a report renders no control for it, and every use has a `given:` form (`malloy-model` covers the migration). `malloy-model` and `docs/givens.md` cover givens themselves.\n\n## Drill\n\n`# drill` goes on a model **dimension**, never on a report:\n\n```malloy\n# drill { to=[\"category\", \"self\"] given=CATEGORY }\ndimension: category is products.category\n\n# drill { to=\"regions/west\" given=REGION }\ndimension: region is regions.region\n```\n\n- **`to=<path>`** navigates to a report, of either layout, by its package path without `.malloy`, read from the package root: `to=category` is `category.malloy` at the root, `to=\"regions/west\"` is `regions/west.malloy`. Quote a path with a `/`. **Always write the path from the package root**: a bare name is a root file, never a report of that name elsewhere.\n- **`to=self`** filters in place; two or more destinations pop a menu.\n- **Always write `given=`.** Without it the given is the dimension name verbatim, so `dimension: category` seeds `category`, not `CATEGORY`. `to=self` survives that (it folds case); `to=<path>` does not, and lands on an unfiltered page with nothing erroring.\n- **The destination needs a control for the given**, declared as `filter<T>`. No lint checks that half, so click it and look.\n- **Only table cells are marked drillable.** A report meant to be drilled wants at least one untagged (table) tile, grouped by the tagged dimension. A column whose rendered header another, non-drillable tile also shows loses its marking: give the two different `# label=`s.\n\n## Read the lint\n\nPackage warnings after a reload are the report's test suite. Fix all of them, and read the text rather than the severity or the count. **\"Dashboard lint stopped early, so this list is incomplete\"** means the rest of the list is partial.\n\n| Finding                                                                       | Fix                                                                                                                               |\n| ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |\n| `# drill … targets \"x\", which is not a report in this package`                | A dead click. Write the target's path                                                                                             |\n| `to=self, but no model in this package declares a given \"X\"`                  | The clicked value has nowhere to go. Declare the given, or fix `given=`                                                           |\n| `given \"X\" suggests options from source \"y\", which this file does not define` | Import `y` into the report                                                                                                        |\n| `filters by given \"X\", which this file does not import`                       | No control is shown for it. Import the given                                                                                      |\n| A tile that does not resolve to a real view                                   | Fix the view name, or declare the view                                                                                            |\n| `notebook-artifact-unparsed`                                                  | The tag does not parse, usually an unquoted `source -> view` entry                                                                |\n| `notebook-layout-run`                                                         | A `run:` beside `tiles`. Make it a view, list it, delete the `run:`                                                               |\n| `notebook-tile-layout-ignored`                                                | `colspan` or `break` on a linear report. Remove them, or switch to `layout=grid`                                                  |\n| `report-kind-removed`                                                         | The tag sets `kind=`, which is no longer read, so the file is no report. Write the `layout=` the finding gives                    |\n| `report-layout-implicit`                                                      | A tag with no tiles and no `layout=`. Add `layout=`                                                                               |\n| `report-on-surface`                                                           | A model `index.malloy` imports (or `explores` lists) is tagged, so its sources left the surface. Untag it, or move the report out |\n| `index-is-not-a-report`                                                       | The root `index.malloy` carries a tag. Remove it; put the report in its own file                                                  |\n| `report-name-ambiguous`                                                       | Two grid reports share a file name, so the deprecated by-name dashboards route answers 409 for it. Rename one of the files        |\n| `Tile … reads <source>, which index.malloy doesn't export`                    | Add the source to the `export { ... }` in `index.malloy`. Never add an `explores` to `publisher.json`                             |\n| A grid's `columns`, `colspan`, or `dashboard_columns=` findings               | `reference/grid.md`                                                                                                               |\n| A statement or tag above the artifact tag; prose the reader cannot place      | `reference/linear.md`, the cell rules                                                                                             |\n\n**Read the status the reload itself returns, not the listing.** One report that fails to compile fails the whole package load (424), and a package already serving keeps its previous version, so the listing still looks healthy. `GET /api/v0/status` still knows: a package serving an older model than its files appears in `loadErrors` with `stale: true`. If the reload is 200 and your report is not listed, discovery skipped it: usually a missing or misspelled artifact tag, or a file under `public/`.\n\n**A clean reload is not proof the tags are right.** The parse warning is syntax only and carries no position. That is why the last step is opening the page.\n\n## Template\n\n```malloy\n##! experimental.givens\n##\" [One-line description of the report.]\n##| artifact { layout=linear title=\"[Title]\"\n  tiles=[\n    intro { kind=text },\n    \"main_source_tiles -> broad_tile\",\n    \"main_source_tiles -> drill_tile\"\n  ]\n}\n|##\nimport { main_source } from \"model.malloy\"\n\n##|(markdown) intro\n[Framing question: what are we trying to understand?]\n|##\n\nsource: main_source_tiles is main_source extend {\n  view: broad_tile is [broad view]\n  view: drill_tile is [drill view]\n}\n```\n\nFor a grid, write `layout=grid`, add `dashboard { columns=12 }` after the tag's closing `}`, and give every tile view a `# colspan` (`reference/grid.md`).\n\n## Editing in the Console\n\nA person can open any report in the Console's builder (**Edit** on the report page; **New report** on the package page writes `<slug>.malloy` at the package root). The builder splices the file rather than regenerating it, so comments and anything it does not model survive; its layout switch rewrites `layout=` and nothing else. A report written as `run:` cells opens converted to tiles, and the first Save asks before it rewrites the file (`reference/linear.md`). A save whose text declares a real `#(authorize)` or `#(access_filter)` gate outside prose is refused with a 400: gates live in a model file the report imports.\n\n## What \"done\" means\n\n- The file is at the package root (or where the author asked), and its tag says `layout=`.\n- Every source, view, and field name came from the model you read in step 1.\n- The reload returned **200**, not 424, with **zero** report warnings, and your report is in `GET …/reports`.\n- You opened the page and every tile shows real numbers: not stuck loading, not an error, not an empty state you did not intend.\n- Each control renders as the widget you intended, and changing one changes the numbers.\n- If you added a `# drill`, its `to=` is a path, and you clicked it and landed where you meant to, with the given seeded.\n- On a grid: every tile carries a colspan, each row sums to `columns`, rows end flush, nothing is clipped, and no legend or card label ends in `…`.\n\n## Reference\n\n- `reference/grid.md`: the grid recipe, its traps, and one query as the whole page.\n- `reference/linear.md`: linear reports, `run:` cells, legacy `.malloynb`, style, and common mistakes.\n- `docs/reports.md`: the full guide this skill condenses.\n- `docs/givens.md`: the givens the controls are generated from.\n\n## Reference files over MCP\n\nThis skill's `reference/` files are served as separate prompts, one per file, fetched only when you ask for them. Where the text above says to read `reference/<name>.md`, get the prompt named `malloy-reports/<name>` instead.\n\nAvailable: grid, linear."
+      body: "# Publisher Reports\n\n> A `.malloy` file with an `## artifact { layout=… tiles=[…] }` tag **is** a report. It imports the model, names the views to show, binds the filtering on those views, and says how to lay them out. Publisher discovers it at package load, renders the filter controls from the givens its tiles reference, offers `# drill` click-through, and serves it at `/<env>/<pkg>/<path>`, its package path without `.malloy`. No code, no build step.\n\nWhat other tools call a dashboard and a notebook are both reports here. The **layout** is the only difference:\n\n- **`layout=grid`**: tiles across a grid behind one filter row, scanned at a glance (a dashboard). Read `reference/grid.md` before you lay one out.\n- **`layout=linear`**: tiles and prose top to bottom, read in order (a notebook, a data story). Read `reference/linear.md` before you write one.\n\nEverything else (filters, text tiles, drill, the builder, the lint, the write path) is the same for both, and switching layout later is a one-property edit.\n\n## Where the file goes\n\n- **Write a new report at the package root**, as `<slug>.malloy`, unless the author asks for another location. No directory is required, and none is a convention: a report can live anywhere in the package except `public/`, and the root `index.malloy` is never a report. Do not create a `dashboards/` or `notebooks/` directory for it.\n- **Always write `layout=grid` or `layout=linear`** in the tag. A tag without one is read by a fallback rule, and a linear report that lists tiles without `layout=linear` is read as a grid. `kind=` is no longer read: a tag that sets it makes no report (`report-kind-removed`), so replace it with `layout=`.\n- **The package path is the report's identity.** `sales/q3.malloy` is the report `sales/q3`: its URL, its `GET …/reports/{path}` address, and its `# drill` target. Two reports may share a basename in different directories.\n- **Imports are relative to the report's own location.** At the root: `import { order_items } from \"storefront.malloy\"`. In a subdirectory: `\"../storefront.malloy\"`.\n- **An untagged `.malloy` file is an ordinary model**, wherever it lives. Shared definitions several reports import go in one.\n\n## When this is the right tool\n\n| The user wants                                       | Use                                                          |\n| ---------------------------------------------------- | ------------------------------------------------------------ |\n| A recurring, at-a-glance view behind shared filters  | this skill, `layout=grid`                                    |\n| A narrative, with prose between the numbers          | this skill, `layout=linear`                                  |\n| A quick write-up of queries you already ran          | `skill:malloy-analysis-report`, which writes a linear report |\n| Custom design, branding, or interactions beyond tags | an HTML data app                                             |\n| The model itself: sources, measures, joins           | `malloy-model`                                               |\n\nInteractivity is not the axis: both layouts get filter controls, URL-addressable state, Apply batching, and `# drill`. Pick on the shape of the document: scanned at a glance is grid, read top to bottom is linear. When in doubt, linear.\n\n## Build sequence\n\nTool names below are bare (`get_context`); match each against the tools you actually have, since a host may prefix or rename them. A host names its compile and reload tools its own way. Where you have none, use the REST endpoint named beside the step.\n\n1. **READ THE MODEL FIRST.** Get the real source, view, dimension, and given names from the package: `get_context` if you have it, otherwise the REST model endpoint for `index.malloy` (it answers 404 for a file off the surface) or the `.malloy` files. Never guess a name. A guessed field in a query fails the whole package load, not just that one report; a guessed tile or suggest source is quieter, and only shows up in the package warnings. If the package root holds an `index.malloy` (every scaffolded package does), a tile reads only the sources that file exports.\n2. **PICK THE LAYOUT AND THE TILES.** Which views, in what order, and on a grid how wide each sits. A query tile is a `view:` you declare in the report, named as `\"source -> view\"`.\n3. **DECLARE THE GIVENS** the report will filter by, in the report file itself, with their control tags (see \"Filter controls\"). A report holds its own filters: the builder edits the report file and nothing else, so a filter it can add, change or remove is a declaration in that file. A given the model already declares and reads is imported by name, never declared again; if it is only a reader's filter, move it into the report instead (see \"Givens that stay in the model\").\n4. **COMPOSE THE FILE** at its path (the package root unless asked otherwise), following the template below, but do not save it yet. Name the sources you need in the import. Each tile binds its controls with a refinement, `view: t is v + { where: category ~ $CATEGORY }`, one clause per given it answers to; a `filter<...>` binds with `~`, a plain `date` or `number` given is a value and binds with `>=`, `<=` or `=`. Only the givens some tile references become controls. Then import every source or query any referenced given names in a `suggest`; **a `suggest` naming a `query=` needs that query's own source imported as well**, because an import is not transitive.\n5. **COMPILE IT** with your compile tool (`POST …/models/<path>/compile` over REST) at the path the file will have, with **`\"scope\": \"file\"`**: a report opens with an `import`, which the default `append` scope refuses, and an existing file compiled at `append` collides with itself. **`\"scope\": \"file\"` does not check tiles, drills or suggest queries.** To see those before you save, compile the same text at `\"scope\": \"package\"` with `modelPath` set to the report's path: it runs the lint step 6 reads and returns its findings with code `dashboard-lint` (or `render-tag`). Editing an untagged model several reports import also wants `\"scope\": \"package\"`, which recompiles every file as saved.\n6. **SAVE IT, RELOAD, AND READ THE MANIFEST AND THE WARNINGS.** Save by writing the file, or with `PUT …/models/<path>` over REST (omit `expectedHash` to create; it creates at any new path and replaces only a file the package already serves as a report). Then your reload tool, or `GET …/packages/<pkg>?reload=true`. A 424 means the package did not load and your edit is not live. **The `warnings` key is absent when there are none.** Then read `GET …/packages/<pkg>/reports/<path>`: its `givens` are exactly the controls that will render, and its `layout` is the layout Publisher read. See \"Read the lint\".\n7. **OPEN IT AND LOOK.** Not optional; see \"What done means\".\n\n## The form\n\n```malloy\n##! experimental.givens\n##\" One line saying what this report is for.\n##| artifact { layout=grid title=\"Storefront overview\"\n  tiles=[\n    intro { kind=text colspan=12 },\n    \"overview -> kpis\",\n    \"overview -> revenue_trend\",\n    \"overview -> revenue_by_state\"\n  ]\n} dashboard { columns=12 }\n|##\nimport { order_items, products } from \"storefront.malloy\"\n\n# label=\"Category\" control=select suggest { source=products dimension=category }\ngiven: CATEGORY :: filter<string> is f''\n# label=\"Ordered since\"\ngiven: SINCE :: date is @2023-01-01\n\n##|(markdown) intro\nRevenue and margin for the selected category.\n|##\n\nsource: overview is order_items extend {\n  # colspan=12\n  # label=\"Key figures\"\n  # big_value\n  view: kpis is key_figures + { where: category ~ $CATEGORY, where: created_at >= $SINCE }\n\n  # colspan=8\n  # break\n  # label=\"Revenue by month\"\n  view: revenue_trend is sales_by_month + { where: category ~ $CATEGORY, where: created_at >= $SINCE }\n\n  # colspan=4\n  # label=\"Revenue by state\"\n  view: revenue_by_state is sales_by_state + { where: category ~ $CATEGORY, where: created_at >= $SINCE }\n}\n```\n\nThe same file with `layout=linear` and no `dashboard { … }` or `colspan` is a linear report.\n\n- **The tag is model-level**, one line (`## artifact { … }`) or a `##|` … `|##` block with the same text inside, the form to use once the list is long: one tile per line, `}` on its own line, `|##` closing at the opener's column. A one-line `##` tag must stay on one line: wrapping it is a compile error, or worse, compiles clean and quietly stops being a report.\n- **The header** above the tag holds only `##!` flags, `//` comments and the unnamed `\"` notes that are the report's description. Keep statements and `#` tags below `## artifact`: nothing refuses one above it, but the header is where readers and the builder look.\n- **Quote every query entry.** `\"overview -> kpis\"` is a string; unquoted, the tag does not parse (`notebook-artifact-unparsed`). A bare quoted name (`\"top_products\"`) names a model-level `query:` in the file.\n- **A query tile is a thin `view:` on an extension the report declares** (`source: overview is order_items extend { … }`): the modelled view keeps its chart tag, the wrapper carries the tile's `# label`, its width on a grid, and its binding.\n- **A text tile is a `##|(markdown) name` block** listed as `name { kind=text }`. The name is one bare word on the opener line, the body starts on the next line (a heading goes inside the block), and `|##` closes it at the opener's column. A bare `intro` without `{ kind=text }` is the query-tile form for a `query:`, so the block is not shown. On a grid the entry also takes `colspan` and `break`, and nothing else.\n- **File order:** header, imports and givens, the prose blocks in tile order, then the extension that defines the tile views. That is the order the builder writes.\n- **A `run:` in a report that lists `tiles` is never shown** (`notebook-layout-run`). Define a view, list it, delete the `run:`.\n- **A tile expression is a string, so the compiler never checks it.** Rename a view and the file still compiles; the tile fails at package load, where the lint names it.\n- **Chart tags go on the view** (`# line_chart`, `# bar_chart`, `# big_value`, `# label=\"…\"`). `skill:malloy-charts` covers choosing them.\n\n## Filter controls\n\nControls come from the `given:` declarations the tiles reference. The tags on the declaration are the control contract:\n\n```malloy\n##! experimental.givens\n\n# label=\"Category\" control=select suggest { source=products dimension=category }\ngiven: CATEGORY :: filter<string> is f''\n\n# label=\"Brand\" control=multiselect suggest { query=brand_suggest dimension=brand }\ngiven: BRAND :: filter<string> is f''\n\n# label=\"Minimum line total\" range_min=0 range_max=250\ngiven: MIN_SALE :: filter<number> is f''\n\n# label=\"Ordered since\"\ngiven: SINCE :: date is @2023-01-01\n```\n\n`control=select`/`multiselect` with a `suggest` renders a picker filled from the data; `range_min`/`range_max` on a `filter<number>` renders a two-handled range slider; a `filter<date>` or `filter<timestamp>` renders a time-range control with preset windows and a custom day range; a bare `date` or `timestamp` renders a date picker; a `filter<string>` with no tag renders a text box taking filter syntax. Which controls appear is per report, decided by which givens its tiles reference.\n\n- `#(description=\"…\")` renders as helper text under the control and draws a cosmetic \"not a well-formed route\" compile diagnostic for a multi-word value; `# description=\"…\"` publishes to the API but the UI does not render it.\n- `dimension=` can name a field of a directly joined source, quoted: `suggest { source=sales dimension=\"products.department\" }`. On the `query=` form, `dimension` names a column of that query's output; match it to the query's `group_by`.\n- **A suggest's source or query has to resolve in the report file**, so import it there. Getting it wrong does not error: the control still looks like a picker and says \"Could not load the options for this control\"; the package warnings name it.\n- Two options on the artifact tag, either layout: `autorun=false` batches control changes behind an Apply button; `givens { CATEGORY=f'Outerwear' }` sets starting values (a URL parameter wins). A file-level `## autorun=false` does nothing on a `.malloy` report.\n\n### Binding, and givens that stay in the model\n\n**Binding is per declaration, not per name.** A report declaring its own `CATEGORY` over a source whose model-level `where:` reads the model's `CATEGORY` compiles, shows the control, and filters nothing. So bind on the tiles, with `+ { where: … }`. The other design, model-level scoping, still works: put a scoped source in an untagged model that imports the givens it reads, and import that model and those givens into the report. Do not mix the two on one given.\n\nA given stays in the model, declared once there, when a model source, view or measure, an `#(authorize)` or `#(access_filter)` gate, or an HTML data app reads it. The report imports it by name (`import { CATEGORY } from \"givens.malloy\"`) and never re-declares it:\n\n- **Import a name and also declare it: a compile error.** Drop the local declaration.\n- **Declare a name the model already reads, without importing it: no error at all.** The control renders and moves, and the model's own `where:` or gate never sees the value.\n\n**A model that already scopes a source by an optional filter given** (`where: Manufacturer ~ $manufacturer_filter` in the model) needs a decision:\n\n- **It is a reader's filter and you may change the model: move it.** Delete the given and its `where:` clause from the model, declare it in the report with its control tags, and bind it on each tile that should answer to it. A reader's filter is anything a person picks on the page; a given stays in the model only for the reasons `malloy-model` lists (a gate, a value every query must supply, a parameter a field is defined with, scoping meant for every consumer).\n- **The model can't change, or the given is semantic or governance: import it** as above. Say so plainly: the filter shows in the reader and in the builder, and can be set in both, but the builder cannot remove or reconfigure it. It is the model's.\n\nBefore, in the model:\n\n```malloy\n##! experimental.givens\ngiven:\n  manufacturer_filter :: filter<string> is f''\n  subject_filter :: filter<string> is f''\n  major_recall_filter :: filter<boolean> is f''\n  recall_date_filter :: filter<date> is f''\n\nsource: recalls is duckdb.table('data/auto_recalls.csv') extend {\n  where:\n    Manufacturer ~ $manufacturer_filter,\n    Subject ~ $subject_filter,\n    `Major Recall` ~ $major_recall_filter,\n    `Report Received Date` ~ $recall_date_filter\n  dimension: `Major Recall` is ifnull(`Potentially Affected`, 0) > 100000\n}\n```\n\nAfter: the model declares no givens and `recalls` has no `where:`; the report declares the four and binds each tile:\n\n```malloy\n##! experimental.givens\n##| artifact { layout=grid title=\"Recalls\"\n  tiles=[\"recalls_tiles -> recalls_by_year\", \"recalls_tiles -> recalls_by_manufacturer\"]\n} dashboard { columns=12 }\n|##\nimport { recalls } from \"auto_recalls.malloy\"\n\n# label=\"Manufacturer\" control=multiselect suggest { source=recalls dimension=Manufacturer }\ngiven: manufacturer_filter :: filter<string> is f''\n# label=\"Subject\"\ngiven: subject_filter :: filter<string> is f''\n# label=\"Major recalls only\"\ngiven: major_recall_filter :: filter<boolean> is f''\n# label=\"Filed\"\ngiven: recall_date_filter :: filter<date> is f''\n\nsource: recalls_tiles is recalls extend {\n  # colspan=6\n  view: recalls_by_year is by_year + {\n    where:\n      Manufacturer ~ $manufacturer_filter,\n      Subject ~ $subject_filter,\n      `Major Recall` ~ $major_recall_filter,\n      `Report Received Date` ~ $recall_date_filter\n  }\n  # colspan=6\n  view: recalls_by_manufacturer is by_manufacturer + {\n    where:\n      Subject ~ $subject_filter,\n      `Major Recall` ~ $major_recall_filter,\n      `Report Received Date` ~ $recall_date_filter\n  }\n}\n```\n\nA tile view takes a name of its own: `view: by_year is by_year + { … }` is \"Cannot redefine 'by_year'\". Each tile binds only the givens it should answer to: `recalls_by_manufacturer` leaves the manufacturer filter off, since it is the breakdown by manufacturer. Every given here is a `filter<…>`, so each binds with `~`; a plain `date` or `number` given binds with `>=`, `<=` or `=` (step 4).\n\nA given has to be in the report file's own scope to be bindable: declared there or imported. Never add a `#(filter)` annotation: it is deprecated, a report renders no control for it, and every use has a `given:` form (`malloy-model` covers the migration). `malloy-model` and `docs/givens.md` cover givens themselves.\n\n## Drill\n\n`# drill` goes on a model **dimension**, never on a report:\n\n```malloy\n# drill { to=[\"category\", \"self\"] given=CATEGORY }\ndimension: category is products.category\n\n# drill { to=\"regions/west\" given=REGION }\ndimension: region is regions.region\n```\n\n- **`to=<path>`** navigates to a report, of either layout, by its package path without `.malloy`, read from the package root: `to=category` is `category.malloy` at the root, `to=\"regions/west\"` is `regions/west.malloy`. Quote a path with a `/`. **Always write the path from the package root**: a bare name is a root file, never a report of that name elsewhere.\n- **`to=self`** filters in place; two or more destinations pop a menu.\n- **Always write `given=`.** Without it the given is the dimension name verbatim, so `dimension: category` seeds `category`, not `CATEGORY`. `to=self` survives that (it folds case); `to=<path>` does not, and lands on an unfiltered page with nothing erroring.\n- **The destination needs a control for the given**, declared as `filter<T>`. No lint checks that half, so click it and look.\n- **Only table cells are marked drillable.** A report meant to be drilled wants at least one untagged (table) tile, grouped by the tagged dimension. A column whose rendered header another, non-drillable tile also shows loses its marking: give the two different `# label=`s.\n\n## Read the lint\n\nPackage warnings after a reload are the report's test suite. Fix all of them, and read the text rather than the severity or the count. **\"Dashboard lint stopped early, so this list is incomplete\"** means the rest of the list is partial.\n\n| Finding                                                                                                 | Fix                                                                                                                               |\n| ------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |\n| `# drill … targets \"x\", which is not a report in this package`                                          | A dead click. Write the target's path                                                                                             |\n| `to=self, but no model in this package declares a given \"X\"`                                            | The clicked value has nowhere to go. Declare the given, or fix `given=`                                                           |\n| `given \"X\" suggests options from source \"y\", which this file does not define`                           | Import `y` into the report                                                                                                        |\n| `filters by given \"X\", which this file does not import`                                                 | No control is shown for it. Import the given                                                                                      |\n| A tile that does not resolve to a real view                                                             | Fix the view name, or declare the view                                                                                            |\n| `notebook-artifact-unparsed`                                                                            | The tag does not parse, usually an unquoted `source -> view` entry                                                                |\n| `notebook-layout-run`                                                                                   | A `run:` beside `tiles`. Make it a view, list it, delete the `run:`                                                               |\n| `notebook-tile-layout-ignored`                                                                          | `colspan` or `break` on a linear report. Remove them, or switch to `layout=grid`                                                  |\n| `report-kind-removed`                                                                                   | The tag sets `kind=`, which is no longer read, so the file is no report. Write the `layout=` the finding gives                    |\n| `report-cells-removed`                                                                                  | A linear tag with no `tiles`, the retired cell format, so the file is no report. List its tiles (`reference/linear.md`)           |\n| `report-on-surface`                                                                                     | A model `index.malloy` imports (or `explores` lists) is tagged, so its sources left the surface. Untag it, or move the report out |\n| `index-is-not-a-report`                                                                                 | The root `index.malloy` carries a tag. Remove it; put the report in its own file                                                  |\n| `report-name-ambiguous`                                                                                 | Two grid reports share a file name, so the deprecated by-name dashboards route answers 409 for it. Rename one of the files        |\n| `Tile … reads <source>, which index.malloy doesn't export`                                              | Add the source to the `export { ... }` in `index.malloy`. Never add an `explores` to `publisher.json`                             |\n| A grid's `columns`, `colspan`, or `dashboard_columns=` findings                                         | `reference/grid.md`                                                                                                               |\n| Prose the reader cannot place (`notebook-markdown-attached-nowhere`, `notebook-markdown-block-unnamed`) | `reference/linear.md`                                                                                                             |\n\n**Read the status the reload itself returns, not the listing.** One report that fails to compile fails the whole package load (424), and a package already serving keeps its previous version, so the listing still looks healthy. `GET /api/v0/status` still knows: a package serving an older model than its files appears in `loadErrors` with `stale: true`. If the reload is 200 and your report is not listed, discovery skipped it: usually a missing or misspelled artifact tag, or a file under `public/`.\n\n**A clean reload is not proof the tags are right.** The parse warning is syntax only and carries no position. That is why the last step is opening the page.\n\n## Template\n\n```malloy\n##! experimental.givens\n##\" [One-line description of the report.]\n##| artifact { layout=linear title=\"[Title]\"\n  tiles=[\n    intro { kind=text },\n    \"main_source_tiles -> broad_tile\",\n    \"main_source_tiles -> drill_tile\"\n  ]\n}\n|##\nimport { main_source } from \"model.malloy\"\n\n##|(markdown) intro\n[Framing question: what are we trying to understand?]\n|##\n\nsource: main_source_tiles is main_source extend {\n  view: broad_tile is [broad view]\n  view: drill_tile is [drill view]\n}\n```\n\nFor a grid, write `layout=grid`, add `dashboard { columns=12 }` after the tag's closing `}`, and give every tile view a `# colspan` (`reference/grid.md`).\n\n## Editing in the Console\n\nA person can open any report in the Console's builder (**Edit** on the report page; **+ Report** on the package page writes `<slug>.malloy` at the package root). The builder splices the file rather than regenerating it, so comments and anything it does not model survive; its layout switch rewrites `layout=` and nothing else. A file written as `run:` cells, the retired linear form, is no report and does not open (`reference/linear.md`). A save whose text declares a real `#(authorize)` or `#(access_filter)` gate outside prose is refused with a 400: gates live in a model file the report imports.\n\n## What \"done\" means\n\n- The file is at the package root (or where the author asked), and its tag says `layout=`.\n- Every source, view, and field name came from the model you read in step 1.\n- The reload returned **200**, not 424, with **zero** report warnings, and your report is in `GET …/reports`.\n- You opened the page and every tile shows real numbers: not stuck loading, not an error, not an empty state you did not intend.\n- Each control renders as the widget you intended, and changing one changes the numbers.\n- If you added a `# drill`, its `to=` is a path, and you clicked it and landed where you meant to, with the given seeded.\n- On a grid: every tile carries a colspan, each row sums to `columns`, rows end flush, nothing is clipped, and no legend or card label ends in `…`.\n\n## Reference\n\n- `reference/grid.md`: the grid recipe, its traps, and one query as the whole page.\n- `reference/linear.md`: linear reports, rewriting a retired `run:`-cell file, legacy `.malloynb`, style, and common mistakes.\n- `docs/reports.md`: the full guide this skill condenses.\n- `docs/givens.md`: the givens the controls are generated from.\n\n## Reference files over MCP\n\nThis skill's `reference/` files are served as separate prompts, one per file, fetched only when you ask for them. Where the text above says to read `reference/<name>.md`, get the prompt named `malloy-reports/<name>` instead.\n\nAvailable: grid, linear."
     },
     {
       name: "malloy-reports/grid",
@@ -360772,94 +361055,21 @@ source: category_tiles is order_items extend {
 
 - **\`layout=linear\` is required** when the tag lists tiles; without it the file is read as a grid.
 - \`dashboard { columns }\` has no effect, and a \`colspan\` or \`break\` on a tile entry is ignored with a warning (\`notebook-tile-layout-ignored\`).
-- **Tiles run through the model query endpoint**, and the report also carries cells made from its tiles, so cell runs and \`get_context\` work on it.
-
-## Reports written as \`run:\` cells (the older form)
-
-A linear report can also be a file of \`run:\` statements with \`(markdown)\` notes between them. Publisher still reads and serves it, and a person saving it in the Console converts it to tiles. Write new reports as tiles; maintain a cell report in its own form until someone converts it. \`skill:malloy-analysis-report\` writes this form for a quick write-up.
+- **Tiles run through the model query endpoint**, against the report's own path, like a grid's.
 
-### The five authoring rules (cell reports)
+## Files written as \`run:\` cells (retired)
 
-Rules 1 and 4 hold for both forms; rules 2, 3 and 5 are about \`run:\` cells and prose notes.
+An older linear form was a file of \`run:\` statements with \`(markdown)\` notes between them, under a tag with no \`tiles\`. Publisher no longer reads it: such a file is not a report, and the package warnings name it (\`report-cells-removed\`). Never write one. To bring one back, rewrite it as tiles:
 
-1. **The header is \`##!\` flags, \`//\` comments and unnamed \`"\` notes (the description), then \`## artifact { layout=linear … }\`.** Nothing else goes above the tag. A statement or a tag above \`## artifact\` is an error, and the report is served with that error instead of opening.
-2. **Prose is a \`(markdown)\` annotation, and the number of \`#\` says what it belongs to.** Floating markdown is a cell of its own: \`##(markdown) text\` (contiguous lines with no blank line between them merge into one cell) or a \`##|(markdown)\` block, with the body starting on the next line and the \`|##\` closer at the opener's column. Attached markdown, \`#(markdown) text\` or a \`#|(markdown)\` … \`|#\` block, belongs to the statement below it and renders with that cell. Keep the parentheses: \`##| markdown\` reads its prose as ordinary tags, and \`##|markdown\` draws a malformed-route warning. No body line starts with \`|##\`, and a blank line follows the closer. A \`## Heading\` line is model tags, not prose: write a heading inside a \`##|(markdown)\` block.
-3. **Render tags sit directly above \`run:\`, with nothing between.** A \`#"\` directly above the \`run:\` is its caption; \`# bar_chart\`, \`# label="..."\` and the other render tags go in the same block. Attached \`#(markdown)\` goes above the \`#"\` caption when both are present, and renders as a header above the result.
-4. **\`given:\` uses \`NAME :: filter<T> is f''\`, bound with \`~\`, declared before first use.** Put \`##! experimental.givens\` at the top of the file.
-5. **Trailing prose is \`##(markdown)\`, never \`#(markdown)\` or \`#"\`.** Both belong to the statement below them, and at the end of a file there is none. An \`import\` or an \`export\` takes no annotation either, so prose above one is \`##|(markdown)\`.
-
-### How the file becomes cells
-
-Cells come from the file's own notes and statements, in file order (imported files add none):
-
-| In the file                                                              | Cell                                                                   |
-| ------------------------------------------------------------------------ | ---------------------------------------------------------------------- | --------------------------------------------------------- |
-| \`##!\` lines, \`## artifact\`, and every \`"\` note above the tag             | the header: no cell                                                    |
-| \`##(markdown)\` lines (contiguous) or a \`##                               | (markdown)\` block, after the tag                                       | one markdown cell                                         |
-| \`#(markdown)\` or a \`#                                                    | (markdown)\`block above a\`run:\`, \`source:\`, \`query:\`, \`given:\`or\`type:\` | no cell of its own: it renders with that statement's cell |
-| \`run:\` with its contiguous \`#\` tag block, including \`run: <named query>\` | one query cell                                                         |
-| \`import\`, \`source:\`, \`query:\`, \`given:\`, \`export { … }\`, \`type:\`         | one definition cell **per statement**                                  |
-| a non-\`"\` \`##\` note after the tag (\`## title=…\`)                         | not a cell                                                             |
-
-Definition cells render folded; only query cells run. Earlier spellings are still read: \`##"\`, \`##|"\`, \`##(text)\` and \`##|(text)\` notes below the tag are markdown cells, like \`(markdown)\`. Write \`(markdown)\`. A query cell runs as a _restricted query_ against the already-compiled file, so an \`import\` inside a \`run:\` is rejected (\`file imports are not permitted in a restricted query\`).
-
-### A complete cell report
-
-\`\`\`malloy
-##! experimental.givens
-##" One category at a time: how it sells across the year and which brands carry it.
-## artifact { layout=linear title="Category review" }
-import { order_items, products } from "storefront.malloy"
-
-##|(markdown)
-## Category review
-
-Pick a **Category** in the controls above and every chart below re-runs for it.
-Leave the control empty to read the whole catalog.
-|##
-
-#(description="Narrow to one product category")
-# label="Category" control=select suggest { source=products dimension=category }
-given: CATEGORY :: filter<string> is f''
-
-##(markdown) How is revenue trending for the selected category?
-
-#(markdown) ### Revenue by month
-#" Revenue by month for the selected category
-# line_chart
-# label="Revenue by month"
-run: order_items -> sales_by_month + { where: category ~ $CATEGORY }
-
-##(markdown) Which brands are behind those numbers?
-
-#" The eight brands with the most revenue in the selected category
-# bar_chart
-# label="Top brands"
-run: order_items -> top_brands + { where: category ~ $CATEGORY }
-
-##(markdown) Last, the best-selling products, defined once as a named query and then run.
-
-query: top_products_in_category is order_items -> top_products + { where: category ~ $CATEGORY }
-
-#(markdown) ### Best sellers
-run: top_products_in_category
-\`\`\`
-
-The \`##|(markdown)\` block and each \`##(markdown)\` line are floating markdown cells. The two \`#(markdown)\` lines are attached: each renders as a header with the \`run:\` below it. The \`given:\` and the \`query:\` are definition cells, and each \`run:\` is a query cell.
-
-### When the Console converts it
-
-Saving a cell report in the builder turns each \`run:\` into a \`view:\` on a \`<source>_tiles\` extension appended to the file (a \`query:\` used by exactly one run is folded into its view), each prose note into a \`##|(markdown) text_N\` block, and leaves definitions, imports, givens and comments where they were. The first Save asks before it rewrites the file ("Convert this notebook?"); Cancel writes nothing, and the file's history in its repository is the way back. Write a cell report so it converts:
-
-- Every \`run:\` is \`<source> -> <view or query body>\` with a named source. An inline \`extend\` before the arrow, a source that is not a name, or a refinement (\`q + { … }\`) of a multi-stage query is refused, and so is a run that resolves through more than ten named queries.
-- A chart line the editor does not model (for example \`# bar_chart { size=spark }\`) is kept, and the Viz type picker is disabled for that tile with the reason shown.
-- The editor opens a report **read-only**, saying why, when it cannot place cells one by one: two statements or notes on one line, text after a block closer, a comment straddling two cells, a lone carriage return (use LF or CRLF), a statement above the \`## artifact\` tag, a statement no cell can hold, or a tag value Malloy cannot read, such as a malformed date literal (\`@2024-13-01\`).
+1. Each floating \`##(markdown)\` note or \`##|(markdown)\` block becomes a named \`##|(markdown) name\` block, listed as \`name { kind=text }\`.
+2. Each \`run: <source> -> <query>\` becomes a \`view:\` on a \`<source>_tiles\` extension the report declares, listed as \`"<source>_tiles -> <view>"\`. The render tags above the \`run:\` move to the view; a \`#"\` caption becomes \`# label="…"\`. A \`run:\` of a named \`query:\` is listed by the query's name.
+3. List the entries in \`tiles=[…]\` in reading order, keep \`layout=linear\`, and delete every \`run:\`.
 
 ## Multiple models and cross-model joins
 
-A report compiles with **all** its \`import\`s in scope, so it can import several \`.malloy\` models, and a tile's source or a cell can reference, and **join**, sources from different imported files. Import each model you need at the top; no re-export wrapper is required.
+A report compiles with **all** its \`import\`s in scope, so it can import several \`.malloy\` models, and a tile's source can reference, and **join**, sources from different imported files. Import each model you need at the top; no re-export wrapper is required.
 
-**When the package root holds an \`index.malloy\`, tiles and cells read only what it exports.** A tile or cell over a source \`index.malloy\` does not export answers 404, even when the report imports that source's file. A source the report derives from an exported one (\`source: mine is customers extend { ... }\`) still works. A cell's own source over a raw table (\`duckdb.table(...)\`) is refused. To use a source, add it to the \`export { ... }\` in \`index.malloy\`.
+**When the package root holds an \`index.malloy\`, tiles read only what it exports.** A tile over a source \`index.malloy\` does not export answers 404, even when the report imports that source's file. A source the report derives from an exported one (\`source: mine is customers extend { ... }\`) still works. A tile's own source over a raw table (\`duckdb.table(...)\`) is refused. To use a source, add it to the \`export { ... }\` in \`index.malloy\`.
 
 ## Style
 
@@ -360868,14 +361078,20 @@ A report compiles with **all** its \`import\`s in scope, so it can import severa
 **No data-specific insights in markdown.** Data refreshes will make them stale.
 
 \`\`\`malloy
-##(markdown) WRONG: will become stale when data refreshes. Revenue spiked 23% in March.
+##|(markdown) spike_note
+WRONG: will become stale when data refreshes. Revenue spiked 23% in March.
+|##
 
-##(markdown) RIGHT: frames the question and lets the query answer it. How is revenue trending?
+##|(markdown) trend_q
+RIGHT: frames the question and lets the query answer it. How is revenue trending?
+|##
 \`\`\`
 
+Each is a text tile, listed in \`tiles=[…]\` by name, for example \`trend_q { kind=text }\`.
+
 To add \`limit\`, \`where\`, or other options to an existing view, refine it with \`+\`: \`my_view + { limit: 15 }\`.
 
-One query per tile or cell, and remember a chart renders only the **first** aggregate in its result.
+One query per tile, and remember a chart renders only the **first** aggregate in its result.
 
 ## Existing \`.malloynb\` files
 
@@ -360883,28 +361099,21 @@ A \`.malloynb\` (cells delimited by \`>>>markdown\` and \`>>>malloy\`) is a depr
 
 ## Common mistakes
 
-| Mistake                                                                    | Fix                                                                                                                                                                  |
-| -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ------------ | ------------ |
-| A tile list without \`layout=linear\`                                        | Read as a grid. Write \`layout=linear\`.                                                                                                                               |
-| \`view_name { limit: 10 }\`                                                  | Use \`+\`: \`view_name + { limit: 10 }\`                                                                                                                                 |
-| A statement or a \`#\` tag above \`## artifact\`                               | Only \`##!\` flags, \`//\` comments and unnamed \`"\` notes go in the header. Move the statement below the tag.                                                            |
-| \`## Heading\` for a section title                                           | That line is model tags, not prose. Write the title inside a \`##                                                                                                     | (markdown)\` block.                                                                                   |
-| \`##                                                                        | markdown\`or\`##                                                                                                                                                       | markdown\` (no parentheses)                                                                           | Write \`##    | (markdown)\`. |
-| \`##(markdown)text\` (no space after the route)                              | Malloy drops the note. Write \`##(markdown) text\`.                                                                                                                    |
-| Text on the opener line after \`##                                          | (markdown)\`                                                                                                                                                          | Only a name may follow it, and only a text tile needs one. Put the text on the next line.            |
-| \`#(markdown)\` above an \`import\` or \`export\`                                | Those take no annotation. Write \`##                                                                                                                                  | (markdown)\`.                                                                                         |
-| A \`#\` tag separated from its \`run:\` by another statement                   | Render tags sit directly above the \`run:\`. Move the tag.                                                                                                             |
-| \`#(markdown)\` or \`#"\` as the last thing in the file                        | Trailing prose is \`##(markdown)\`; both need a statement below them.                                                                                                  |
-| \`given:\` used before it is declared                                        | A cell reads only the givens declared above it. Move the \`given:\` up.                                                                                                |
-| \`##                                                                        | (markdown) name\` block in a cell report                                                                                                                              | A name means something only where a \`tiles=[name { kind=text }]\` entry lists the block. Drop it: \`## | (markdown)\`. |
-| \`run:\` in a report that lists \`tiles=[…]\`                                  | Never shown. Define a \`view:\`, list \`"source -> view"\` in \`tiles\`, delete the \`run:\`.                                                                                |
-| \`tiles=[intro { kind=text }, orders_tiles -> headline]\` (entry not quoted) | Every \`source -> view\` entry is a quoted string. Unquoted, the tag does not parse.                                                                                   |
-| A bare \`intro\` in \`tiles\` for a \`##                                        | (markdown) intro\` block                                                                                                                                              | A bare name is the query-tile form for a \`query:\`. Write \`intro { kind=text }\`.                      |
-| \`colspan\` or \`break\` on a linear report's tile entry                       | Ignored and reported (\`notebook-tile-layout-ignored\`). Remove them, or switch to \`layout=grid\`.                                                                      |
-| \`#(filter)\` in any form                                                    | Deprecated. Declare a \`given:\` on the model's source instead.                                                                                                        |
-| \`import\` inside a \`run:\` cell                                              | Imports are file-wide; put them at the top.                                                                                                                          |
-| Data-specific insights in markdown                                         | Frame questions instead.                                                                                                                                             |
-| A cross-model join in a quick \`skill:malloy-analysis-report\` cell          | That cell renders against a single model. Write it as a report tile over a source the report declares with the join, since the report compiles with all its imports. |`
+| Mistake                                                                    | Fix                                                                                             |
+| -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
+| A tile list without \`layout=linear\`                                        | Read as a grid. Write \`layout=linear\`.                                                          |
+| A linear tag with no \`tiles=[…]\`                                           | The retired cell format: no report (\`report-cells-removed\`). List the tiles.                    |
+| \`view_name { limit: 10 }\`                                                  | Use \`+\`: \`view_name + { limit: 10 }\`                                                            |
+| Floating \`##(markdown)\` prose in a tiled report                            | Never shown (\`notebook-markdown-block-unnamed\`). Make it a named text tile and list it.         |
+| \`## Heading\` for a section title                                           | That line is model tags, not prose. Write the heading inside a \`##\\|(markdown) name\` text tile. |
+| \`##\\| markdown\` or \`##\\|markdown\` (no parentheses)                         | Write \`##\\|(markdown) name\`.                                                                    |
+| Text on the opener line after \`##\\|(markdown)\`                             | Only the tile's name may follow it. Put the text on the next line.                              |
+| \`run:\` in a report that lists \`tiles=[…]\`                                  | Never shown. Define a \`view:\`, list \`"source -> view"\` in \`tiles\`, delete the \`run:\`.           |
+| \`tiles=[intro { kind=text }, orders_tiles -> headline]\` (entry not quoted) | Every \`source -> view\` entry is a quoted string. Unquoted, the tag does not parse.              |
+| A bare \`intro\` in \`tiles\` for a \`##\\|(markdown) intro\` block               | A bare name is the query-tile form for a \`query:\`. Write \`intro { kind=text }\`.                 |
+| \`colspan\` or \`break\` on a linear report's tile entry                       | Ignored and reported (\`notebook-tile-layout-ignored\`). Remove them, or switch to \`layout=grid\`. |
+| \`#(filter)\` in any form                                                    | Deprecated. Declare a \`given:\` on the model's source instead.                                   |
+| Data-specific insights in a text tile                                      | Frame questions instead.                                                                        |`
     },
     {
       name: "malloy-review",
@@ -361107,7 +361316,7 @@ This review covers 10,173 lines across 47 files. Only ~1,500 lines were deep-rev
     {
       name: "malloy-review/rubric-structure",
       description: "Rubric: Structure. Reference detail for the malloy-review skill.",
-      body: "# Rubric: Structure\n\n**Dimension:** `structure`\n**Rules:** 5\n\nApplies to the organization of `.malloy` files within a package. Skip a file for structural review if it's a report (a `.malloy` file anywhere in the package whose model-level notes carry an `## artifact` tag, of either layout, `layout=grid` or `layout=linear` or the deprecated `kind=`, written as `tiles=[…]` or as `run:` cells; a legacy query-level `# artifact` on a `query:`; or a `.malloynb`), which has its own conventions (the `malloy-reports` skill), or a one-off sandbox script. Do not flag a report for where it sits: no directory is required for one, and the package root is the default.\n\nFor every rule, the linked instruction-skill section is the canonical source for rationale and examples.\n\n---\n\n## S-01: Base vs joined source separation\n\n- **Severity:** major (non-blocking) · **Category:** structure · LLM-judgment\n- **Detection:** LLM heuristic, a source named after a base table (`customers`, `orders`) that includes cross-table joins, or a file with multiple sources where one clearly joins the others, is a candidate for splitting\n- **Fix:** move the joined source into its own file; leave the base source clean\n- **See:** `skill:malloy-model` § Base vs Joined Sources · `skill:malloy-model` § Joined Source File Template\n\n---\n\n## S-02: Sources should declare `primary_key:` when one exists\n\n- **Severity:** minor (non-blocking) · **Category:** structure · machine-checkable\n- **Why this isn't a correctness rule.** The Malloy compiler auto-synthesizes a UUID-based `__distinct_key` for any `join_one:` target without a declared PK (`packages/malloy/src/model/field_instance.ts:644-670`, `query_query.ts:946-951`), so symmetric aggregation is correct either way, see the C-07 entry in `rubric-correctness.md`'s \"Rules we dropped\" section. The `with` shortcut, which DOES require a declared PK, errors at compile time and surfaces as a diagnostic. The actual silent-correctness hazard (\"declared PK isn't actually unique in the data\") is `rubric-correctness.md` § C-12.\n- **What this rule catches.** A discoverability / hygiene gap: when a source has a natural primary key, declaring it lets downstream code use the `with` shortcut, makes grain explicit in the model, and gives tooling a stable identifier per row. Treat as a recommendation, not a merge gate.\n- **Detection:** for every `source:` declaration, check whether its body contains a `primary_key:` clause. Skip flagging when:\n  - The source is a query-based / computed source (`source: x is t -> {...}` or `source: x is (t -> {...}) extend {...}`) where grain is determined by the `group_by` columns, declaring a `primary_key:` on the result is fine but not required.\n  - The source represents an event/log table or a denormalized analytical source where no natural PK exists. Both situations are legitimate; the LLM should recognize them and skip the finding.\n- **Fix (when the source does have a natural PK):** declare it, `primary_key: <col>` inside `extend {}`. When there isn't a natural PK, leave it undeclared; if the absence is non-obvious, a one-line `#(doc)` on the source explaining the grain helps future readers.\n- **See:** `skill:malloy-model` § Key Rules · `rubric-correctness.md` § C-12 (the related correctness rule that checks whether a declared PK is actually unique in the data) · `rubric-style.md` § Y-03 (`join_one:` style consistency, which is the other consequence of declared-vs-undeclared PKs)\n\n---\n\n## S-03: Joined tables defined before the source that references them\n\n- **Severity:** blocker (blocking) · **Category:** structure · machine-checkable\n- **Detection:** AST, within a single file, for each source reference inside a `join_*:` or `source is <name>`, verify the target source is declared earlier\n- **Fix:** reorder source declarations so dependencies come first. If two sources reference each other, split into separate files with explicit `import` (cross-file declarations don't have this ordering constraint).\n- **See:** `skill:malloy-gotchas-modeling` § Source Order, Define Joined Tables First\n\n---\n\n## S-04: Base sources curate their column surface\n\n- **Severity:** major (non-blocking) · **Category:** structure · machine-checkable\n- **Detection:** AST, for each `source: ... is conn.table(...)` declaration (a direct-table base source), check whether the source uses **any** of the three column-curation mechanisms below. The finding fires only when the source uses none of them, every column from the underlying table is implicitly public. Query-based sources and sources derived from other sources are exempt.\n- **Fix:** pick whichever option matches the source's needs. Curation options, lightest to heaviest:\n  1. `extend { except: a, b, c }`, drop a small named set of columns. Compatible with `rename:`. No experimental flag.\n  2. `extend { accept: a, b, c }`, keep only a small named set. Compatible with `rename:`. No experimental flag.\n  3. `##! experimental.access_modifiers` + `include { public: …, internal: …, private: … }`, full per-column visibility tiers. **Composes with `rename:` in one order only** (the `extend { rename: }` before the `include {}`, which then names the field by its new name) and disallows measures/dimensions whose names shadow `internal:` columns. Use only when the visibility distinction matters (e.g., shared sources joined into multiple consumers).\n\n  Most files only need option 1 or 2, for the small set of columns that shouldn't be public, prefer `except:` over the heavier `include {}` machinery. Reach for `include {}` only when per-column tiers are genuinely worth the constraints.\n- **See:** `skill:malloy-gotchas-modeling` § Field Management: `extend {}` and `include {}`, in that order · `skill:malloy-model` § Base Source Templates · `malloy-model/reference/access-modifiers.md`\n\n---\n\n## S-05: One file per table (base) / one per analytical domain (joined)\n\n- **Severity:** minor (non-blocking) · **Category:** structure · machine-checkable\n- **Detection:** count `source: X is conn.table(...)` base-source declarations per file. More than one → flag.\n- **Fix:** split each base source into its own file named after the source\n- **See:** `skill:malloy-model` § Base Source Templates (file convention is implicit; weak counterpart)\n\n---\n\n## Cross-cutting note\n\nWhen a file violates both S-01 (base+joined mixed) and S-05 (multiple base sources), surface the combined observation as a **Cross-Cutting Theme** in the review output: \"File layout suggests a restructure, see S-series findings for suggested splits.\""
+      body: "# Rubric: Structure\n\n**Dimension:** `structure`\n**Rules:** 5\n\nApplies to the organization of `.malloy` files within a package. Skip a file for structural review if it's a report (a `.malloy` file anywhere in the package whose model-level notes carry an `## artifact` tag, of either layout, `layout=grid` or `layout=linear` or the deprecated `kind=`, written as `tiles=[…]`; a legacy query-level `# artifact` on a `query:`; or a `.malloynb`), which has its own conventions (the `malloy-reports` skill), or a one-off sandbox script. Do not flag a report for where it sits: no directory is required for one, and the package root is the default.\n\nFor every rule, the linked instruction-skill section is the canonical source for rationale and examples.\n\n---\n\n## S-01: Base vs joined source separation\n\n- **Severity:** major (non-blocking) · **Category:** structure · LLM-judgment\n- **Detection:** LLM heuristic, a source named after a base table (`customers`, `orders`) that includes cross-table joins, or a file with multiple sources where one clearly joins the others, is a candidate for splitting\n- **Fix:** move the joined source into its own file; leave the base source clean\n- **See:** `skill:malloy-model` § Base vs Joined Sources · `skill:malloy-model` § Joined Source File Template\n\n---\n\n## S-02: Sources should declare `primary_key:` when one exists\n\n- **Severity:** minor (non-blocking) · **Category:** structure · machine-checkable\n- **Why this isn't a correctness rule.** The Malloy compiler auto-synthesizes a UUID-based `__distinct_key` for any `join_one:` target without a declared PK (`packages/malloy/src/model/field_instance.ts:644-670`, `query_query.ts:946-951`), so symmetric aggregation is correct either way, see the C-07 entry in `rubric-correctness.md`'s \"Rules we dropped\" section. The `with` shortcut, which DOES require a declared PK, errors at compile time and surfaces as a diagnostic. The actual silent-correctness hazard (\"declared PK isn't actually unique in the data\") is `rubric-correctness.md` § C-12.\n- **What this rule catches.** A discoverability / hygiene gap: when a source has a natural primary key, declaring it lets downstream code use the `with` shortcut, makes grain explicit in the model, and gives tooling a stable identifier per row. Treat as a recommendation, not a merge gate.\n- **Detection:** for every `source:` declaration, check whether its body contains a `primary_key:` clause. Skip flagging when:\n  - The source is a query-based / computed source (`source: x is t -> {...}` or `source: x is (t -> {...}) extend {...}`) where grain is determined by the `group_by` columns, declaring a `primary_key:` on the result is fine but not required.\n  - The source represents an event/log table or a denormalized analytical source where no natural PK exists. Both situations are legitimate; the LLM should recognize them and skip the finding.\n- **Fix (when the source does have a natural PK):** declare it, `primary_key: <col>` inside `extend {}`. When there isn't a natural PK, leave it undeclared; if the absence is non-obvious, a one-line `#(doc)` on the source explaining the grain helps future readers.\n- **See:** `skill:malloy-model` § Key Rules · `rubric-correctness.md` § C-12 (the related correctness rule that checks whether a declared PK is actually unique in the data) · `rubric-style.md` § Y-03 (`join_one:` style consistency, which is the other consequence of declared-vs-undeclared PKs)\n\n---\n\n## S-03: Joined tables defined before the source that references them\n\n- **Severity:** blocker (blocking) · **Category:** structure · machine-checkable\n- **Detection:** AST, within a single file, for each source reference inside a `join_*:` or `source is <name>`, verify the target source is declared earlier\n- **Fix:** reorder source declarations so dependencies come first. If two sources reference each other, split into separate files with explicit `import` (cross-file declarations don't have this ordering constraint).\n- **See:** `skill:malloy-gotchas-modeling` § Source Order, Define Joined Tables First\n\n---\n\n## S-04: Base sources curate their column surface\n\n- **Severity:** major (non-blocking) · **Category:** structure · machine-checkable\n- **Detection:** AST, for each `source: ... is conn.table(...)` declaration (a direct-table base source), check whether the source uses **any** of the three column-curation mechanisms below. The finding fires only when the source uses none of them, every column from the underlying table is implicitly public. Query-based sources and sources derived from other sources are exempt.\n- **Fix:** pick whichever option matches the source's needs. Curation options, lightest to heaviest:\n  1. `extend { except: a, b, c }`, drop a small named set of columns. Compatible with `rename:`. No experimental flag.\n  2. `extend { accept: a, b, c }`, keep only a small named set. Compatible with `rename:`. No experimental flag.\n  3. `##! experimental.access_modifiers` + `include { public: …, internal: …, private: … }`, full per-column visibility tiers. **Composes with `rename:` in one order only** (the `extend { rename: }` before the `include {}`, which then names the field by its new name) and disallows measures/dimensions whose names shadow `internal:` columns. Use only when the visibility distinction matters (e.g., shared sources joined into multiple consumers).\n\n  Most files only need option 1 or 2, for the small set of columns that shouldn't be public, prefer `except:` over the heavier `include {}` machinery. Reach for `include {}` only when per-column tiers are genuinely worth the constraints.\n- **See:** `skill:malloy-gotchas-modeling` § Field Management: `extend {}` and `include {}`, in that order · `skill:malloy-model` § Base Source Templates · `malloy-model/reference/access-modifiers.md`\n\n---\n\n## S-05: One file per table (base) / one per analytical domain (joined)\n\n- **Severity:** minor (non-blocking) · **Category:** structure · machine-checkable\n- **Detection:** count `source: X is conn.table(...)` base-source declarations per file. More than one → flag.\n- **Fix:** split each base source into its own file named after the source\n- **See:** `skill:malloy-model` § Base Source Templates (file convention is implicit; weak counterpart)\n\n---\n\n## Cross-cutting note\n\nWhen a file violates both S-01 (base+joined mixed) and S-05 (multiple base sources), surface the combined observation as a **Cross-Cutting Theme** in the review output: \"File layout suggests a restructure, see S-series findings for suggested splits.\""
     },
     {
       name: "malloy-review/rubric-style",
@@ -361484,7 +361693,7 @@ Close with what you used, in a few lines: the agent and package, which skills yo
     {
       name: "malloy-source-unreachable",
       description: `Work out why a source is missing from get_context, or why a query against it was refused with a 404 or a 403, and what to do next. Use when a source you expect is absent from discovery, when execute_query answers "No queryable source", when a query that used to work stops working, or when deciding whether a package's curation is hiding something you need.`,
-      body: '# A source you cannot reach\n\n> **Tool names** are written bare here - `get_context`, `execute_query`, `get_status`, `compile_model`. The exact prefixed name depends on the host surface; match each against the tools you actually have.\n\nMost packages publish a curated surface, so a source being absent or refused is usually the package working as its author intended, not a fault. Read the refusal before working around it, because the three things that can refuse you need three different responses and they are told apart by the status code.\n\n## The three answers\n\n| what you got | what it means | what to do |\n| --- | --- | --- |\n| **404** that says "not on this package\'s published surface" | the name is real and the package does not publish it. It is curation, not a typo | follow the fix the message names (usually: name it in the `export { ... }` of `index.malloy` and address the query there), or query what IS published |\n| **404**, plain "No queryable source", "No queryable model" or "Query target is not queryable" | the name does not exist, or it is hidden in a model that carries an `#(authorize)` or `#(access_filter)` gate. In a gated model the two are deliberately indistinguishable, so a refusal cannot be used to probe for hidden names | check the name against `get_context`, then query something on the surface or ask the package\'s author to publish it |\n| **403**, "Access denied" | the source exists and is on the surface, but an `#(authorize)` gate did not admit you | supply the givens the gate reads, or accept that this caller may not read it |\n| **200** with zero rows | you were admitted, and an `#(access_filter)` narrowed the rows to none of them | this is a real answer. Report it as "no matching rows", never as an error |\n\nA 403 names a source, so it tells you the source exists. A plain 404 tells you nothing at all. That asymmetry is deliberate: a source that is both hidden AND gated answers a plain **404**, so you can never use a 403, or the wording of a 404, to discover that a hidden gated name is real.\n\n**One 404 is not about the source at all.** If a query that joins an exported source in its own text answers `Query target is not queryable`, check the joined source\'s givens. A source that reads a given with no default, which `index.malloy` does not import, is refused that way when joined. Queried directly, the same source answers a 400 that names the cause. Run the joining query through `compile_model`: the problem then reads "references given NAME ... which is not surfaced in this model". The fix belongs in the model, not the query, so report it to the model\'s author: `index.malloy` has to import that given, either by importing its declaring file whole or by naming the given in a selective import.\n\n## Addressing the surface, which is the most common 404\n\nA query names a model file. When a package curates its surface, only files on that surface are valid entry points, **even for a source that file declares itself**:\n\n```\nPOST .../packages/sales/models/index.malloy/query    {"sourceName": "orders"}   -> 200\nPOST .../packages/sales/models/orders.malloy/query   {"sourceName": "orders"}   -> 404\n```\n\nSame source, same package. `orders.malloy` is off the surface, so it is not an entry point.\n\n**Use the `model_path` that `get_context` gave you, verbatim.** Its `source_info.resource_id` holds `environment`, `package`, `model_path` and `source`, and those are exactly `execute_query`\'s `environmentName`, `packageName`, `modelPath` and `sourceName`. On a curated package the `model_path` is the surface file, not the file that declares the source. Substituting the declaring file because it looks more correct is how this 404 happens.\n\n## Other places a hidden source answers 404\n\nThe query route is not the only one held to the surface. On a curated package, a source or file off it also shows up as a 404 here:\n\n- **Reading a model.** `GET .../models/{path}` answers 404 for a file off the surface, with the same words as the query route. The file still exists and still compiles; read `index.malloy` instead. A model that is on the surface lists only the names it publishes, not everything it imports.\n- **A report tile.** A tile, or a filter `suggest` over a hidden source answers 404. The report itself is still listed. The package load warns once per tile, for example `Tile orders_staging -> by_flag on report overview reads orders_staging, which index.malloy doesn\'t export, so it won\'t load. Fix: add orders_staging to the export { ... } in index.malloy.` It is in the `warnings` on the package\'s own response, `GET .../packages/{pkg}`.\n- **A report cell.** A cell of a report written as `run:` cells, over a hidden source, answers 404, even when the report imports its file. A source an earlier cell derives from a published one still works.\n\nThe fix is the same in each case: add the source to the `export { ... }` in `index.malloy`, or use what is already published.\n\n## When the source is not in `get_context` at all\n\nWork down this list. The first three are far more common than the last.\n\n1. **It is off the surface.** The package publishes a curated set and this source is not in it. Nothing you can do from the query side; it is a package edit.\n2. **The package failed to load, or is serving a stale model.** Call `list_packages`: a package that failed to load appears with an `error`, and one serving the model it compiled *before* a failed reload carries `stale: true` and the `error` too. `get_status` has the full load errors.\n3. **You are talking to a different server than you think.** Call `list_packages` and check the environment and package names are the ones you expect. A stale `.mcp.json` outlives the server that wrote it, and another Publisher may hold that port.\n4. **Your search phrasing missed it.** Retry with a bare target (no `search_text`) to enumerate rather than rank. If it appears there, the source exists and was a ranking miss.\n\n## What curation does not do\n\n- **It does not hide fields.** A published source may `join` an unpublished one, and a query grouping by a joined field returns that field\'s values normally. Hiding a source removes it as a landing point; it does not redact columns a published source pulls in.\n- **It does not gate `/compile`.** `compile_model` is exempt, because compile is the authoring loop. A hidden source can still be compile-checked, and that is intended. The exceptions are a hidden source that is also gated, which answers 404 at compile too, and a document (text with a model-level `## artifact` tag): its tiles and cells are held to the surface, so one over a source off it comes back as a `query-not-queryable` problem rather than compiling.\n- **It is not access control.** Curation answers "what is queryable by name", not "who may query it". Identity is `#(authorize)` and `#(access_filter)`. A source is not protected by being hidden.\n\n## Reaching an unpublished source from your own model\n\nIf you are writing Malloy rather than just querying, an unpublished source is still usable, with one condition that trips people.\n\n`export { ... }` decides what an **importing file** can see, which is Malloy\'s rule and not Publisher\'s:\n\n- a file that declares **no** `export` hands an importer everything it declares, so import the file that declares the source and join it normally;\n- a file that **does** declare one hands over exactly that list. Importing a file whose `export` omits the source and then naming it fails to compile with `Reference to undefined object`.\n\nSo an unpublished source is reachable through a file that exports it, or that exports nothing, and not through a file whose `export` leaves it out. Re-export chains are fine at any depth: a source re-exported through several files stays queryable through the surface, because admission follows the declaration rather than the path taken to it.\n\n## Before you report a source as missing\n\nConfirm all three, in this order. Each one has been mistaken for "the data is not there".\n\n1. `get_status` shows the package loaded and not `stale`.\n2. `list_packages` names the environment and package you meant.\n3. An enumerating `get_context` call (a target with no `search_text`) does not list it.\n\nOnly then is it genuinely not published, and the answer to the user is that the package does not expose it, not that the data does not exist.'
+      body: '# A source you cannot reach\n\n> **Tool names** are written bare here - `get_context`, `execute_query`, `get_status`, `compile_model`. The exact prefixed name depends on the host surface; match each against the tools you actually have.\n\nMost packages publish a curated surface, so a source being absent or refused is usually the package working as its author intended, not a fault. Read the refusal before working around it, because the three things that can refuse you need three different responses and they are told apart by the status code.\n\n## The three answers\n\n| what you got | what it means | what to do |\n| --- | --- | --- |\n| **404** that says "not on this package\'s published surface" | the name is real and the package does not publish it. It is curation, not a typo | follow the fix the message names (usually: name it in the `export { ... }` of `index.malloy` and address the query there), or query what IS published |\n| **404**, plain "No queryable source", "No queryable model" or "Query target is not queryable" | the name does not exist, or it is hidden in a model that carries an `#(authorize)` or `#(access_filter)` gate. In a gated model the two are deliberately indistinguishable, so a refusal cannot be used to probe for hidden names | check the name against `get_context`, then query something on the surface or ask the package\'s author to publish it |\n| **403**, "Access denied" | the source exists and is on the surface, but an `#(authorize)` gate did not admit you | supply the givens the gate reads, or accept that this caller may not read it |\n| **200** with zero rows | you were admitted, and an `#(access_filter)` narrowed the rows to none of them | this is a real answer. Report it as "no matching rows", never as an error |\n\nA 403 names a source, so it tells you the source exists. A plain 404 tells you nothing at all. That asymmetry is deliberate: a source that is both hidden AND gated answers a plain **404**, so you can never use a 403, or the wording of a 404, to discover that a hidden gated name is real.\n\n**One 404 is not about the source at all.** If a query that joins an exported source in its own text answers `Query target is not queryable`, check the joined source\'s givens. A source that reads a given with no default, which `index.malloy` does not import, is refused that way when joined. Queried directly, the same source answers a 400 that names the cause. Run the joining query through `compile_model`: the problem then reads "references given NAME ... which is not surfaced in this model". The fix belongs in the model, not the query, so report it to the model\'s author: `index.malloy` has to import that given, either by importing its declaring file whole or by naming the given in a selective import.\n\n## Addressing the surface, which is the most common 404\n\nA query names a model file. When a package curates its surface, only files on that surface are valid entry points, **even for a source that file declares itself**:\n\n```\nPOST .../packages/sales/models/index.malloy/query    {"sourceName": "orders"}   -> 200\nPOST .../packages/sales/models/orders.malloy/query   {"sourceName": "orders"}   -> 404\n```\n\nSame source, same package. `orders.malloy` is off the surface, so it is not an entry point.\n\n**Use the `model_path` that `get_context` gave you, verbatim.** Its `source_info.resource_id` holds `environment`, `package`, `model_path` and `source`, and those are exactly `execute_query`\'s `environmentName`, `packageName`, `modelPath` and `sourceName`. On a curated package the `model_path` is the surface file, not the file that declares the source. Substituting the declaring file because it looks more correct is how this 404 happens.\n\n## Other places a hidden source answers 404\n\nThe query route is not the only one held to the surface. On a curated package, a source or file off it also shows up as a 404 here:\n\n- **Reading a model.** `GET .../models/{path}` answers 404 for a file off the surface, with the same words as the query route. The file still exists and still compiles; read `index.malloy` instead. A model that is on the surface lists only the names it publishes, not everything it imports.\n- **A report tile.** A tile, or a filter `suggest` over a hidden source answers 404. The report itself is still listed. The package load warns once per tile, for example `Tile orders_staging -> by_flag on report overview reads orders_staging, which index.malloy doesn\'t export, so it won\'t load. Fix: add orders_staging to the export { ... } in index.malloy.` It is in the `warnings` on the package\'s own response, `GET .../packages/{pkg}`.\n\nThe fix is the same in each case: add the source to the `export { ... }` in `index.malloy`, or use what is already published.\n\n## When the source is not in `get_context` at all\n\nWork down this list. The first three are far more common than the last.\n\n1. **It is off the surface.** The package publishes a curated set and this source is not in it. Nothing you can do from the query side; it is a package edit.\n2. **The package failed to load, or is serving a stale model.** Call `list_packages`: a package that failed to load appears with an `error`, and one serving the model it compiled *before* a failed reload carries `stale: true` and the `error` too. `get_status` has the full load errors.\n3. **You are talking to a different server than you think.** Call `list_packages` and check the environment and package names are the ones you expect. A stale `.mcp.json` outlives the server that wrote it, and another Publisher may hold that port.\n4. **Your search phrasing missed it.** Retry with a bare target (no `search_text`) to enumerate rather than rank. If it appears there, the source exists and was a ranking miss.\n\n## What curation does not do\n\n- **It does not hide fields.** A published source may `join` an unpublished one, and a query grouping by a joined field returns that field\'s values normally. Hiding a source removes it as a landing point; it does not redact columns a published source pulls in.\n- **It does not gate `/compile`.** `compile_model` is exempt, because compile is the authoring loop. A hidden source can still be compile-checked, and that is intended. The exceptions are a hidden source that is also gated, which answers 404 at compile too, and a document (text with a model-level `## artifact` tag): its tiles and cells are held to the surface, so one over a source off it comes back as a `query-not-queryable` problem rather than compiling.\n- **It is not access control.** Curation answers "what is queryable by name", not "who may query it". Identity is `#(authorize)` and `#(access_filter)`. A source is not protected by being hidden.\n\n## Reaching an unpublished source from your own model\n\nIf you are writing Malloy rather than just querying, an unpublished source is still usable, with one condition that trips people.\n\n`export { ... }` decides what an **importing file** can see, which is Malloy\'s rule and not Publisher\'s:\n\n- a file that declares **no** `export` hands an importer everything it declares, so import the file that declares the source and join it normally;\n- a file that **does** declare one hands over exactly that list. Importing a file whose `export` omits the source and then naming it fails to compile with `Reference to undefined object`.\n\nSo an unpublished source is reachable through a file that exports it, or that exports nothing, and not through a file whose `export` leaves it out. Re-export chains are fine at any depth: a source re-exported through several files stays queryable through the surface, because admission follows the declaration rather than the path taken to it.\n\n## Before you report a source as missing\n\nConfirm all three, in this order. Each one has been mistaken for "the data is not there".\n\n1. `get_status` shows the package loaded and not `stale`.\n2. `list_packages` names the environment and package you meant.\n3. An enumerating `get_context` call (a target with no `search_text`) does not list it.\n\nOnly then is it genuinely not published, and the answer to the user is that the package does not expose it, not that the data does not exist.'
     }
   ]
 };
@@ -368234,6 +368443,24 @@ function tryAcquire(sync, alreadyAcquiredError = E_ALREADY_LOCKED) {
 // src/mcp/tools/embedding_index.ts
 init_logger();
 
+// src/service/event_loop_yield.ts
+var DEFAULT_BUDGET_MS = 10;
+var budgetMs = DEFAULT_BUDGET_MS;
+function yieldToEventLoop() {
+  return new Promise((resolve3) => setImmediate(resolve3));
+}
+function createEventLoopYielder() {
+  let since = performance.now();
+  return {
+    async maybeYield() {
+      if (performance.now() - since < budgetMs)
+        return;
+      await yieldToEventLoop();
+      since = performance.now();
+    }
+  };
+}
+
 // src/mcp/tools/embedding_sync_queue.ts
 init_logger();
 
@@ -369386,7 +369613,6 @@ function fingerprintOfRows(rows) {
   return contentHash(rows.join(`
 `));
 }
-var yieldToEventLoop = () => new Promise((resolve3) => setImmediate(resolve3));
 async function desiredFacetsChunked(entities, plan) {
   const desired = [];
   for (let i2 = 0;i2 < entities.length; i2 += FINGERPRINT_CHUNK_ENTITIES) {
@@ -372969,6 +373195,11 @@ function readGivenControlSpec(annotationTexts2) {
   }
   return spec;
 }
+function givenDeclaresNoDefault(given) {
+  const loose = given;
+  const parsed = "default" in loose ? loose.default : loose._internal?.default;
+  return parsed === undefined && loose._internal?.defaultText === undefined;
+}
 function malloyGivenToApi(given) {
   const type = given.type;
   const renderedType = type.type === "filter expression" ? `filter<${type.filterType}>` : type.type === "array" && type.elementTypeDef?.type ? `${type.elementTypeDef.type}[]` : type.type;
@@ -372979,7 +373210,8 @@ function malloyGivenToApi(given) {
     annotations: allNotes.filter((note) => !isReservedRoute(note.route) && note.route !== MARKDOWN_ROUTE).map((note) => note.text),
     ...readGivenControlSpec(allNotes.map((note) => note.text)),
     ...allNotes.some((note) => note.route === "secure") && { secure: true },
-    default: given._internal?.defaultText
+    default: given._internal?.defaultText,
+    ...givenDeclaresNoDefault(given) && { required: true }
   };
 }
 function collectGivenRefs(value, into) {
@@ -373188,6 +373420,7 @@ function readReportModelFacts(modelPath, modelDef, surfacedGivenNames, gatesBySo
       name: given.name,
       type: isFilter ? `filter<${type.filterType}>` : type.type,
       default: given.defaultText,
+      ...given.default === undefined && given.defaultText === undefined ? { required: true } : {},
       annotations: (given.annotations?.blockNotes ?? []).concat(given.annotations?.notes ?? []).map((note) => note.text)
     });
   }
@@ -373339,6 +373572,7 @@ function givenSpec(declaration, facts) {
     name: declaration.name,
     type: declaration.type,
     default: declaration.type.startsWith("filter<") && declaration.default !== undefined ? unwrapFilterLiteral(declaration.default) : declaration.default,
+    ...declaration.required ? { required: true } : {},
     annotations: declaration.annotations.filter((text) => /^##?\(/.test(text) && !isMarkdownNote(text)),
     ...declaration.annotations.some((text) => /^#\(secure\)/.test(text)) && {
       secure: true
@@ -380387,276 +380621,10 @@ function extractQueriesFromModelDef(modelDef) {
   return { queries, misplacedAuthorize };
 }
 
-// src/service/compile_document.ts
-var DECLARATION = /\b(?:source|query)\s*:\s*(`(?:[^`\\]|\\.)*`|[\p{L}_][\p{L}\p{N}_]*)\s+is\b/giu;
-function blankSpans(text, cells) {
-  if (cells.length === 0)
-    return text;
-  const units = text.split("");
-  for (const cell of cells) {
-    const span = cellOffsets.get(cell);
-    if (!span)
-      throw new Error("restricted cell has no recorded span");
-    const [start, end] = span;
-    for (let i2 = start;i2 < end && i2 < units.length; i2++) {
-      if (units[i2] !== `
-` && units[i2] !== "\r")
-        units[i2] = " ";
-    }
-  }
-  return units.join("");
-}
-function declaredNames(text) {
-  const found = new Set(buildDerivationBaseMap(text).keys());
-  for (const match of stripMalloyCommentsAndLiterals(text).matchAll(DECLARATION)) {
-    const name = match[1];
-    found.add(name.startsWith("`") ? name.slice(1, -1) : name);
-  }
-  return found;
-}
-function readsSource(prepared) {
-  const ref = prepared._query?.structRef;
-  if (typeof ref === "string")
-    return ref;
-  const named = ref;
-  return named?.as || named?.name;
-}
-async function denied(gates, text) {
-  try {
-    await gates.text(text);
-    return false;
-  } catch (error2) {
-    if (error2 instanceof AccessDeniedError)
-      return true;
-    throw error2;
-  }
-}
-function tileProblem(expression, reason, cause) {
-  return {
-    code: "tile-does-not-compile",
-    severity: "error",
-    message: `Tile "${expression}" ${cause === "parse" ? "could not be parsed" : "does not compile"}: ${reason.replace(/\.?\s*$/, ".")} ` + `Fix: write the tile as one query over a source and a view, such as \`source -> view\` or \`source -> { group_by: field }\`.`
-  };
-}
-function problemLine(problem) {
-  const line = problem.at?.range?.start?.line;
-  return line === undefined ? undefined : line + 1;
-}
-async function compileDocument(input) {
-  const { base, source, modelName, gates } = input;
-  const tag = readReportTagOfText(source);
-  if (tag.status !== "report")
-    return;
-  const parse5 = parseNotebookText(source);
-  if (isNotebookReaderError(parse5))
-    return;
-  const read = readNotebookCells(parse5, undefined, source);
-  if (read.error) {
-    return { problems: [cellsUnreadableProblem(read.error, "")] };
-  }
-  const code = read.cells.filter((cell) => cell.type === "code");
-  const restrictedCells = new Set;
-  const tainted = new Set;
-  const mentionsTainted = (text) => tainted.size > 0 && [...scanIdentifiers(text)].some((name) => tainted.has(name));
-  for (const cell of code) {
-    if (mentionsTainted(cell.text) || await denied(gates, cell.text)) {
-      restrictedCells.add(cell);
-      if (cell.kind === "definition") {
-        for (const name of declaredNames(cell.text))
-          tainted.add(name);
-      }
-    }
-  }
-  const tileExpressions = readDocumentTileExpressions(read.annotations);
-  const restrictedTiles = new Set;
-  for (const expression of tileExpressions) {
-    const text = `run: ${expression}`;
-    if (mentionsTainted(text) || await denied(gates, text)) {
-      restrictedTiles.add(normalizeTileExpression(expression));
-    }
-  }
-  const definitions = code.filter((cell) => cell.kind === "definition" && !restrictedCells.has(cell)).map((cell) => cell.text).join(`
-`);
-  const unparsedTiles = new Set;
-  const tileProblems = [];
-  for (const expression of tileExpressions) {
-    const key = normalizeTileExpression(expression);
-    if (restrictedTiles.has(key))
-      continue;
-    try {
-      await gates.constructs(`${definitions}
-run: ${expression}`);
-    } catch (error2) {
-      if (!(error2 instanceof UnparseableTextError))
-        throw error2;
-      unparsedTiles.add(key);
-      tileProblems.push(tileProblem(expression, error2.detail, "parse"));
-    }
-  }
-  const boundaryProblems = [];
-  const checkBoundary = async (query, line) => {
-    try {
-      await gates.boundary(query, definitions);
-    } catch (error2) {
-      if (!(error2 instanceof OffSurfaceError))
-        throw error2;
-      boundaryProblems.push({
-        code: "query-not-queryable",
-        severity: "error",
-        message: error2.message,
-        ...line !== undefined && {
-          at: {
-            url: "",
-            range: {
-              start: { line: line - 1, character: 0 },
-              end: { line: line - 1, character: 0 }
-            }
-          }
-        }
-      });
-    }
-  };
-  for (const cell of code) {
-    if (cell.kind === "query" && !restrictedCells.has(cell)) {
-      await checkBoundary(cell.text, cell.startLine);
-    }
-  }
-  for (const expression of tileExpressions) {
-    const key = normalizeTileExpression(expression);
-    if (!restrictedTiles.has(key) && !unparsedTiles.has(key)) {
-      await checkBoundary(`run: ${expression}`, undefined);
-    }
-  }
-  if (boundaryProblems.length > 0)
-    return { problems: boundaryProblems };
-  const readable = [
-    ...code.filter((cell) => cell.kind === "query" && !restrictedCells.has(cell)).map((cell) => cell.text),
-    ...tileExpressions.filter((expression) => {
-      const key = normalizeTileExpression(expression);
-      return !restrictedTiles.has(key) && !unparsedTiles.has(key);
-    }).map((expression) => `run: ${expression}`)
-  ];
-  for (const query of readable.length > 0 ? readable : [""]) {
-    gates.nameVisible(query, definitions);
-  }
-  const compiledText = blankSpans(source, [...restrictedCells]);
-  await gates.document(compiledText);
-  const extended = base.extendModel(compiledText);
-  let model;
-  try {
-    model = await extended.getModel();
-  } catch (error2) {
-    if (error2 instanceof MalloyError4)
-      return { problems: [...tileProblems, ...error2.problems] };
-    throw error2;
-  }
-  const modelDef = model._modelDef;
-  const registry2 = modelDef.givens ?? {};
-  const sources = extractSourcesFromModelDef(modelDef, []).sources;
-  const settle2 = async (runnable, onDenied) => {
-    try {
-      await gates.compiled(runnable);
-    } catch (error2) {
-      if (error2 instanceof AccessDeniedError)
-        onDenied();
-      else
-        throw error2;
-    }
-  };
-  const compiledBoundary = async (runnable, prepared, query) => {
-    try {
-      await gates.boundaryCompiled(runnable, readsSource(prepared), query, definitions);
-    } catch (error2) {
-      if (!(error2 instanceof OffSurfaceError))
-        throw error2;
-      boundaryProblems.push({
-        code: "query-not-queryable",
-        severity: "error",
-        message: error2.message
-      });
-    }
-  };
-  for (const cell of code) {
-    if (cell.kind !== "query" || restrictedCells.has(cell))
-      continue;
-    const runnable = extended.loadRestrictedQuery(cell.text);
-    let denied2 = false;
-    await settle2(runnable, () => {
-      denied2 = true;
-      restrictedCells.add(cell);
-    });
-    if (denied2)
-      continue;
-    try {
-      await compiledBoundary(runnable, await runnable.getPreparedQuery(), cell.text);
-    } catch (error2) {
-      if (!(error2 instanceof MalloyError4))
-        throw error2;
-    }
-  }
-  const compiledTiles = await compileTileGivens(tileExpressions, { loadQuery: (text) => extended.loadRestrictedQuery(text) }, registry2, (sourceName) => gateGivenSource(sources, sourceName), new Set([...restrictedTiles, ...unparsedTiles]), async (tile, prepared) => {
-    let denied2 = false;
-    await settle2({ getPreparedQuery: async () => prepared }, () => {
-      denied2 = true;
-      restrictedTiles.add(normalizeTileExpression(tile));
-    });
-    if (!denied2) {
-      await compiledBoundary({ getPreparedQuery: async () => prepared }, prepared, `run: ${tile}`);
-    }
-  }, (tile, error2) => {
-    if (!(error2 instanceof MalloyError4))
-      return;
-    gates.nameVisible(`run: ${tile}`, definitions);
-    tileProblems.push(tileProblem(tile, error2.problems.map((problem) => problem.message).join("; "), "compile"));
-  });
-  if (boundaryProblems.length > 0)
-    return { problems: boundaryProblems };
-  const spans = [...restrictedCells];
-  const problems = [...tileProblems, ...model.problems].filter((problem) => {
-    const line = problemLine(problem);
-    return line === undefined || !spans.some((cell) => line >= cell.startLine && line <= cell.endLine);
-  });
-  const slug = modelName.replace(/^.*\//, "").replace(/\.malloy$/, "");
-  const path13 = `${slug}.malloy`;
-  const facts = readReportModelFacts(path13, modelDef, Object.values(registry2).map((given) => given.name), new Map(sources.flatMap((entry) => entry.name ? [
-    [
-      entry.name,
-      gateGivenSource(sources, entry.name) ?? []
-    ]
-  ] : [])));
-  const manifest = buildReportManifest({ ...facts, compiledTileGivens: compiledTiles }, { restrictedTiles });
-  const hasTiles = manifest?.tiles !== undefined;
-  const cells = read.cells.filter((cell) => !hasTiles || cell.kind === "definition").map((cell) => {
-    const restricted = restrictedCells.has(cell);
-    if (cell.kind === "markdown") {
-      return { type: "markdown", kind: "markdown", text: cell.text };
-    }
-    return {
-      type: "code",
-      kind: cell.kind,
-      text: cell.text,
-      ...cell.markdown !== undefined && { markdown: cell.markdown },
-      ...cell.proseLines && { proseLines: cell.proseLines },
-      ...cell.codeLine !== undefined && { codeLine: cell.codeLine },
-      ...cell.caption !== undefined && { caption: cell.caption },
-      ...restricted && { restricted: true }
-    };
-  });
-  if (!manifest) {
-    return { problems, document: { layout: tag.layout, cells } };
-  }
-  const { entryFile: _entry, ...rest } = manifest;
-  return {
-    problems,
-    document: {
-      layout: manifest.layout,
-      manifest: { ...rest, name: slug },
-      cells
-    }
-  };
-}
-
 // src/service/notebook_lint.ts
+var CELLS_REMOVED = "report-cells-removed";
+var LAYOUT_UNKNOWN = "report-layout-unknown";
+var CELLS_REMOVED_MESSAGE = "a linear report written as `run:` cells is no longer read, so this file is not a report. Fix: list its tiles in `tiles=[…]` (a text tile per prose block, a query tile per view), or remove the `## artifact` tag.";
 var TILE_ENTRY_FIX = 'Fix: every `source -> view` entry in `tiles` is a quoted string (`"orders_tiles -> headline"`), and a text entry is a bare name followed by `{ kind=text }` (`intro { kind=text }`).';
 var quoted = (line, max = 60) => line.trim().slice(0, max);
 var asTileName = (token) => {
@@ -380689,10 +380657,7 @@ function lintNotebookText(modelPath, text) {
   const tag = readReportTag(tagNotes);
   if (tag.status === "none")
     return [];
-  const hasTiles = tag.status === "report" && motlyTag(tagNotes)?.tag("artifact")?.has("tiles") === true;
   const linear = tag.status === "report" && tag.layout === "linear";
-  const inNotebooks = linear && !hasTiles;
-  const layoutNotebook = linear && hasTiles;
   const page = linear ? "notebook" : "dashboard";
   const nodeText = (node) => node.start && node.stop ? text.slice(map[node.start.startIndex], map[node.stop.stopIndex + 1]) : "";
   const lineOfNode = (node) => node.start?.line ?? 1;
@@ -380709,12 +380674,10 @@ function lintNotebookText(modelPath, text) {
   let artifact;
   let givensEnabled = false;
   let firstGiven;
-  const spans = [];
   let closerLine;
-  const aboveArtifact = [];
   const modelNotes = [];
   const docNotes = [];
-  children.forEach((child, index) => {
+  children.forEach((child) => {
     if (!isRuleNode(child)) {
       const token = child?.symbol;
       const name = token ? symbolOf(token) : undefined;
@@ -380727,16 +380690,11 @@ function lintNotebookText(modelPath, text) {
       return;
     }
     closerLine = undefined;
-    if (child.start && child.stop)
-      spans.push([child.start.startIndex, child.stop.stopIndex]);
     const group = callAccessor(child, "docAnnotations");
     if (group) {
       const notes = callAccessor(group, "docAnnotation") ?? [];
       for (const note of notes) {
         const noteText = nodeText(note);
-        const route = routeOfNote(noteText);
-        const first = noteText.split(`
-`, 1)[0];
         const bodyText = modelNoteBody(noteText);
         modelNotes.push(bodyText);
         if (/^##!\s*experimental\b[\s\S]*\bgivens\b/.test(noteText))
@@ -380745,23 +380703,8 @@ function lintNotebookText(modelPath, text) {
         if (!artifact && note.start && isArtifactNoteText(noteText)) {
           artifact = {
             text: bodyText,
-            line: lineOfNode(note),
-            startIndex: note.start.startIndex
+            line: lineOfNode(note)
           };
-        } else if (!artifact && inNotebooks) {
-          if (route === MARKDOWN_ROUTE || route === "text") {
-            aboveArtifact.push({
-              line: lineOfNode(note),
-              code: "notebook-markdown-above-artifact",
-              what: quoted(first)
-            });
-          } else if (!/^##!/.test(noteText) && !/^#{1,2}\|?"/.test(noteText)) {
-            aboveArtifact.push({
-              line: lineOfNode(note),
-              code: "notebook-tag-above-artifact",
-              what: quoted(first)
-            });
-          }
         }
       }
       const last = notes[notes.length - 1];
@@ -380773,35 +380716,15 @@ function lintNotebookText(modelPath, text) {
     if (callAccessor(child, "defineGivenStatement")) {
       firstGiven ??= keywordLine(child, "GIVEN");
     }
-    if (layoutNotebook && callAccessor(child, "runStatement")) {
+    if (linear && callAccessor(child, "runStatement")) {
       const line = keywordLine(child, "RUN");
       add(line, "notebook-layout-run", "a `run:` is never shown in a notebook written as tiles, whose cells are the entries in `tiles=[…]`. Fix: define the query as a `view:` on a source, list `source -> view` in `tiles`, and delete the `run:`.");
     }
     if (callAccessor(child, "ignoredObjectAnnotations")) {
       const notes = leadingNotes(child);
       for (const note of notes.filter((n) => isMarkdownNote(n.text))) {
-        add(note.line, "notebook-markdown-attached-nowhere", `\`${quoted(note.text)}\` annotates no statement, since what follows it (the end of the file, an import or export, or a \`##\` model-level note) takes no annotation. Fix: ${inNotebooks ? attachedNowhereFix(/^#\|/.test(note.text)) : `${tileEntryFix("name")}, with the text as its body, or delete it.`}`, "error");
-      }
-      if (inNotebooks && notes.some((n) => !isMarkdownNote(n.text))) {
-        const next = children[index + 1];
-        const nextRun = children.slice(index + 1).find((sibling) => callAccessor(sibling, "runStatement"));
-        add(lineOfNode(child), "notebook-orphaned-tag", `this # tag is followed by ${describeNext(next)}, not by a run:, so it annotates nothing. Render tags sit directly above their run:. Fix: move the tag, and any #" caption, directly above ${nextRun ? `the run: on line ${keywordLine(nextRun, "RUN")}` : "its run:"}.`);
-      }
-    } else if (inNotebooks && !artifact) {
-      for (const note of leadingNotes(child).filter((n) => isMarkdownNote(n.text))) {
-        aboveArtifact.push({
-          line: note.line,
-          code: "notebook-markdown-above-artifact",
-          what: quoted(note.text)
-        });
+        add(note.line, "notebook-markdown-attached-nowhere", `\`${quoted(note.text)}\` annotates no statement, since what follows it (the end of the file, an import or export, or a \`##\` model-level note) takes no annotation. Fix: ${tileEntryFix("name")}, with the text as its body, or delete it.`, "error");
       }
-      const first = firstCodeToken(child);
-      aboveArtifact.push({
-        line: first?.line ?? lineOfNode(child),
-        code: "notebook-statement-above-artifact",
-        what: quoted(first ? text.slice(map[first.startIndex]).split(/\r?\n/, 1)[0] : nodeText(child).split(`
-`, 1)[0])
-      });
     }
   });
   if (!artifact)
@@ -380816,44 +380739,13 @@ function lintNotebookText(modelPath, text) {
         leadingNoteLines.add(note.line);
   lintBlocks();
   lintHeadings();
-  for (const { line, code, what } of aboveArtifact) {
-    add(line, code, `\`${what}\` sits above the \`## artifact\` tag, and only \`##!\` flags, \`//\` comments and \`"\` notes may. Fix: move it below the artifact tag.`, "error");
-  }
   if (firstGiven !== undefined && !givensEnabled) {
     add(firstGiven, "notebook-givens-not-enabled", "`given:` needs the givens experiment, which this file does not enable, so it does not compile. Fix: add the line `##! experimental.givens` at the top of the file.");
   }
-  if (artifact)
-    lintArtifact(artifact);
-  if (artifact && !inNotebooks)
-    lintUnreferencedMarkdownBlocks(artifact);
-  if (artifact && !inNotebooks)
-    lintDescriptionBelow(artifact.line);
-  if (inNotebooks && artifact)
-    lintComments(artifact.startIndex);
+  lintArtifact(artifact);
+  lintUnreferencedMarkdownBlocks(artifact);
+  lintDescriptionBelow(artifact.line);
   return findings.sort((a, b3) => a.line - b3.line);
-  function lintComments(from) {
-    const all3 = tokens;
-    const isComment = (t3) => t3.channel !== 0 && /COMMENT/.test(symbolOf(t3) ?? "");
-    const endLine = (t3) => t3.line + (tokenText(t3).replace(/[\r\n]+$/, "").match(/\n/g)?.length ?? 0);
-    const isNoteToken = (t3) => children.some((c3) => c3.start !== undefined && c3.stop !== undefined && t3.startIndex >= c3.start.startIndex && t3.stopIndex <= c3.stop.stopIndex && callAccessor(c3, "docAnnotations") !== undefined);
-    const attached = [];
-    for (let i2 = all3.length - 1;i2 >= 0; i2--) {
-      const next = all3[i2 + 1];
-      attached[i2] = next !== undefined && symbolOf(next) !== "EOF" && next.line === endLine(all3[i2]) + 1 && (isComment(next) ? attached[i2 + 1] : !isNoteToken(next));
-    }
-    all3.forEach((token, i2) => {
-      if (!isComment(token) || token.startIndex < from)
-        return;
-      if (!attached[i2])
-        return;
-      const before = all3[i2 - 1];
-      if (before && endLine(before) === token.line)
-        return;
-      if (spans.some(([lo, hi]) => token.startIndex >= lo && token.stopIndex <= hi))
-        return;
-      add(token.line, "notebook-comment-not-shown", "this comment sits directly above a cell but is not part of it, so the notebook does not show it. Fix: write it as a `##(markdown)` prose note, or move it inside the statement it describes.");
-    });
-  }
   function leadingNotes(node) {
     const from = node.start?.startIndex ?? 0;
     const to2 = node.stop?.stopIndex ?? -1;
@@ -380876,24 +380768,6 @@ function lintNotebookText(modelPath, text) {
     }
     return notes;
   }
-  function describeNext(next) {
-    if (!next)
-      return "the end of the file";
-    if (!isRuleNode(next)) {
-      const token = next.symbol;
-      return !token || symbolOf(token) === "EOF" ? "the end of the file" : `\`${tokenText(token)}\``;
-    }
-    if (callAccessor(next, "docAnnotations"))
-      return "a note";
-    const first = nodeText(next).trim().split(`
-`)[0].slice(0, 40);
-    return `\`${first}\``;
-  }
-  function firstCodeToken(node) {
-    const from = node.start?.startIndex ?? 0;
-    const to2 = node.stop?.stopIndex ?? -1;
-    return tokens?.find((t3) => t3.channel === 0 && t3.startIndex >= from && t3.stopIndex <= to2 && !/ANNOTATION/.test(symbolOf(t3) ?? ""));
-  }
   function keywordLine(node, keyword) {
     const from = node.start?.startIndex ?? 0;
     const to2 = node.stop?.stopIndex ?? -1;
@@ -380912,26 +380786,26 @@ function lintNotebookText(modelPath, text) {
       const line = tokenText(token).replace(/\r?\n$/, "");
       if (/^##"\S/.test(line)) {
         const rest = quoted(line).slice(3);
-        const fix = belowTag(token.line) ? inNotebooks ? `Did you mean \`##(markdown) ${rest}\`?` : `Fix: ${tileEntryFix("name")}, with the text as its body.` : `Did you mean \`##" ${rest}\`?`;
+        const fix = belowTag(token.line) ? `Fix: ${tileEntryFix("name")}, with the text as its body.` : `Did you mean \`##" ${rest}\`?`;
         add(token.line, "notebook-block-opener-spacing", `\`${quoted(line)}\` has no space after the route, so Malloy drops the note. ${fix}`);
         continue;
       }
       if (/^##\(markdown\)\S/.test(line)) {
-        const fix = inNotebooks ? `Did you mean \`##(markdown) ${quoted(line).slice(12)}\`?${placement("##", token.line)}` : `Fix: ${tileEntryFix("name")}, with the text as its body.`;
+        const fix = `Fix: ${tileEntryFix("name")}, with the text as its body.`;
         add(token.line, "notebook-block-opener-spacing", `\`${quoted(line)}\` has no space after the route, so Malloy drops the note. ${fix}`);
         continue;
       }
       if (/^##\(?markdown\)?(?=[ \t]|$)/i.test(line) && !isMarkdownNote(line)) {
-        add(token.line, "notebook-markdown-opener", `\`${quoted(line)}\` is not on the \`(markdown)\` route, so it is not shown as prose. ${inNotebooks ? `Did you mean \`##(markdown)\`?${placement("##", token.line)}` : `Fix: ${tileEntryFix("name")}, with the text as its body.`}`);
+        add(token.line, "notebook-markdown-opener", `\`${quoted(line)}\` is not on the \`(markdown)\` route, so it is not shown as prose. Fix: ${tileEntryFix("name")}, with the text as its body.`);
         continue;
       }
-      if (!inNotebooks && (isMarkdownNote(line) || routeOfNote(line) === "text")) {
+      if (isMarkdownNote(line) || routeOfNote(line) === "text") {
         add(token.line, "notebook-markdown-block-unnamed", `\`${quoted(line)}\` is a floating \`(${routeOfNote(line)})\` line, which a ${page} does not show, since its text tiles are named blocks listed in \`tiles=[…]\`. Fix: ${tileEntryFix("name")}, or delete the line.`);
         continue;
       }
       const content = /^##[ \t]+(\S.*)$/.exec(line)?.[1];
       if (content && /^[A-Za-z_]\w*[ \t]+[A-Za-z0-9_]/.test(content) && !/[={]/.test(content)) {
-        const fix = !belowTag(token.line) ? 'Did you mean `##"`?' : inNotebooks ? "Did you mean `##(markdown)`?" : `Fix: ${tileEntryFix("name")}, with the text as its body.`;
+        const fix = !belowTag(token.line) ? 'Did you mean `##"`?' : `Fix: ${tileEntryFix("name")}, with the text as its body.`;
         add(token.line, "notebook-heading-line", `\`${quoted(line)}\` is read as model tags, not shown as prose. ${fix}`);
       }
     }
@@ -380950,13 +380824,11 @@ function lintNotebookText(modelPath, text) {
     return `this \`|##\` closes the block, so the text after it on line ${strayLine} is not prose and does not compile. Fix: a body line cannot start with \`|##\`, so reword it if the block should go on, or delete the stray text if the block is over.`;
   }
   function nestedMarkdownMessage(note) {
-    return `\`${quoted(note)}\` sits inside a statement, where nothing reads a \`(markdown)\` note, so it is not shown. Fix: ${inNotebooks ? "move it above the statement it describes" : `a ${page} reads no attached note, so ${tileEntryFix("name")}, with the text as its body, or delete it`}.`;
+    return `\`${quoted(note)}\` sits inside a statement, where nothing reads a \`(markdown)\` note, so it is not shown. Fix: a ${page} reads no attached note, so ${tileEntryFix("name")}, with the text as its body, or delete it.`;
   }
   function placement(sigil, line) {
     if (sigil === "#" && !leadingNoteLines.has(line))
-      return inNotebooks ? " It also sits inside a statement, where nothing reads a `(markdown)` note, so move it above the statement it describes." : " It also sits inside a statement, and a dashboard reads no attached note, so use a text tile or delete it.";
-    if (sigil === "##" && inNotebooks && !belowTag(line))
-      return " It also sits above the `## artifact` tag, where a `(markdown)` note is not read, so put it below the tag.";
+      return " It also sits inside a statement, and a dashboard reads no attached note, so use a text tile or delete it.";
     return "";
   }
   function lintBlocks() {
@@ -380975,11 +380847,11 @@ function lintNotebookText(modelPath, text) {
       const markdown = parseMarkdownOpener(opener);
       const spelled = `(${markdown?.route})`;
       const topLevel = sigil === "##" || leadingNoteLines.has(line);
-      const dashboardTile = sigil === "##" && !inNotebooks;
+      const dashboardTile = sigil === "##";
       const glued = /^("|\(markdown\))(\S.*)$/.exec(rest);
       if (glued) {
         const [, glueRoute, after] = glued;
-        const description2 = glueRoute === '"' && (sigil === "#" || !inNotebooks || !belowTag(line));
+        const description2 = glueRoute === '"';
         const asTile = dashboardTile && (glueRoute !== '"' || belowTag(line));
         const fix = !asTile ? `write \`${sigil}|${description2 ? '"' : "(markdown)"}\` and put \`${after}\` on the line below it` : TEXT_BLOCK_NAME.test(after) ? `put a space after the route, as in \`##|(markdown) ${after}\`, and list \`${after} { kind=text }\` in \`tiles\`` : tileBlockFix("name", after);
         add(line, "notebook-block-opener-spacing", `\`${quoted(opener)}\` has no space after the route, so Malloy drops the note. Fix: ${fix}.${asTile || glueRoute === '"' ? "" : placement(sigil, line)}`);
@@ -380991,13 +380863,13 @@ function lintNotebookText(modelPath, text) {
           add(line, "notebook-markdown-opener-text", `\`${quoted(markdown.rest)}\` is not a valid name for a \`${spelled}\` tile, which takes one bare word of letters, digits and underscores that does not start with a digit. Fix: ${tileEntryFix(asTileName(markdown.rest))}.`, "error");
         } else if (opensText) {
           add(line, "notebook-markdown-opener-text", `\`${quoted(markdown.rest)}\` follows \`${sigil}|${spelled}\` on its opener line, where only one bare word may go (a name), so the block would show it as its first line. Fix: ${dashboardTile ? tileBlockFix("name", markdown.rest) : "move it into the body, on the line below the opener"}.${placement(sigil, line)}`, "error");
-        } else if (markdown.name && (sigil === "#" || inNotebooks)) {
-          add(line, "notebook-markdown-block-named", `the name \`${markdown.name}\` on this \`${spelled}\` block means nothing ${sigil === "#" ? "on a block attached to a statement" : "in a notebook, which shows every block as a cell"}, and it is not shown. Fix: remove the name.`);
+        } else if (markdown.name && sigil === "#") {
+          add(line, "notebook-markdown-block-named", `the name \`${markdown.name}\` on this \`${spelled}\` block means nothing on a block attached to a statement, and it is not shown. Fix: remove the name.`);
         } else if (!markdown.name && dashboardTile) {
           add(line, "notebook-markdown-block-unnamed", `an unnamed \`${spelled}\` block is not shown on a ${page}, whose text tiles are named blocks listed in \`tiles=[…]\`. Fix: ${tileEntryFix("name")}, or delete the block.`);
         }
       } else if (/^[ \t]*\(?markdown\)?(?=[ \t]|$)/i.test(rest)) {
-        add(line, "notebook-markdown-opener", `\`${opener.trim()}\` opens a block that is not on the \`(markdown)\` route, so its body is not ${sigil === "#" ? "the statement's prose" : inNotebooks ? "a markdown cell" : "a text tile"}. ${dashboardTile ? `Fix: ${tileEntryFix("name")}.` : `Did you mean \`${sigil}|(markdown)\`?${placement(sigil, line)}`}`);
+        add(line, "notebook-markdown-opener", `\`${opener.trim()}\` opens a block that is not on the \`(markdown)\` route, so its body is not ${sigil === "#" ? "the statement's prose" : "a text tile"}. ${dashboardTile ? `Fix: ${tileEntryFix("name")}.` : `Did you mean \`${sigil}|(markdown)\`?${placement(sigil, line)}`}`);
       }
       let j3 = i2 + 1;
       let firstRun;
@@ -381020,7 +380892,7 @@ function lintNotebookText(modelPath, text) {
       }
       const trailing = tokenText(end).replace(closer, "").trim();
       if (tokenText(end).startsWith(closer) && trailing) {
-        const own2 = sigil !== "##" ? "" : !belowTag(end.line) ? 'on its own `##"` line, or ' : inNotebooks ? "on its own `##(markdown)` line, or " : `in its own text tile (${tileEntryFix("name")}), or `;
+        const own2 = sigil !== "##" ? "" : !belowTag(end.line) ? 'on its own `##"` line, or ' : `in its own text tile (${tileEntryFix("name")}), or `;
         add(end.line, "notebook-text-after-closer", `the text after the closing \`${closer}\` (\`${trailing}\`) is dropped, not shown. Fix: put it ${own2}inside the block.`);
       }
     }
@@ -381036,23 +380908,35 @@ function lintNotebookText(modelPath, text) {
   }
   function lintLayout(line, declaredLayout) {
     if (declaredLayout !== undefined && declaredLayout !== "grid" && declaredLayout !== "linear") {
-      add(line, "report-layout-unknown", `\`layout=${declaredLayout}\` is not a layout Publisher knows (grid, linear), so the tag's other properties decide it. Fix: write \`layout=grid\` or \`layout=linear\`.`, "error");
-    }
-    if (tag.status === "report" && tag.decidedBy === "default") {
-      add(line, "report-layout-implicit", "this artifact tag names no `layout` and lists no tiles, so the report is linear only by default. Fix: write `## artifact { layout=linear }` (or `layout=grid` with `tiles=[…]`).");
+      add(line, LAYOUT_UNKNOWN, `\`layout=${declaredLayout}\` is not a layout Publisher knows (grid, linear), so the tag's other properties decide it. Fix: write \`layout=grid\` or \`layout=linear\`.`, "error");
     }
   }
   function tagFinding(tagNote) {
-    const [parseError] = motlyParseErrors([tagNote.text]);
-    const kind = tag.status === "kind-removed" ? tag.kind : undefined;
-    const message = kind !== undefined ? `\`kind=${kind}\` is no longer read, so this file is not a report. Fix: remove \`kind=${kind}\` and write \`layout=grid\` or \`layout=linear\`.` : `the \`## artifact\` tag does not parse${parseError !== undefined ? ` (${parseError})` : ""}, so its properties are not read and this file is not a report. ${/\btiles\s*=/.test(tagNote.text) ? TILE_ENTRY_FIX : "Fix: correct the tag so it parses."}`;
+    const [code, message] = tagFindingText(tagNote.text);
     return {
       line: tagNote.line,
-      code: kind !== undefined ? "report-kind-removed" : "notebook-artifact-unparsed",
+      code,
       severity: "error",
       message: `Line ${tagNote.line}: ${message}`
     };
   }
+  function tagFindingText(tagText2) {
+    if (tag.status === "kind-removed")
+      return [
+        "report-kind-removed",
+        `\`kind=${tag.kind}\` is no longer read, so this file is not a report. Fix: remove \`kind=${tag.kind}\` and write \`layout=grid\` or \`layout=linear\`.`
+      ];
+    if (tag.status === "cells-removed")
+      return tag.unknownLayout !== undefined ? [
+        LAYOUT_UNKNOWN,
+        `\`layout=${tag.unknownLayout}\` is not a layout Publisher knows (grid, linear), and the tag lists no tiles, so this file is not a report. Fix: write \`layout=grid\` or \`layout=linear\`, and list the tiles in \`tiles=[…]\`.`
+      ] : [CELLS_REMOVED, CELLS_REMOVED_MESSAGE];
+    const [parseError] = motlyParseErrors([tagText2]);
+    return [
+      "notebook-artifact-unparsed",
+      `the \`## artifact\` tag does not parse${parseError !== undefined ? ` (${parseError})` : ""}, so its properties are not read and this file is not a report. ${/\btiles\s*=/.test(tagText2) ? TILE_ENTRY_FIX : "Fix: correct the tag so it parses."}`
+    ];
+  }
   function lintUnreferencedMarkdownBlocks(tagNote) {
     if (motlyParseErrors([tagNote.text])[0] !== undefined)
       return;
@@ -381076,9 +380960,7 @@ function lintNotebookText(modelPath, text) {
       return;
     const properties = Object.keys(tag2.dict ?? {});
     lintLayout(tagNote.line, tagText(tag2, "layout"));
-    if (inNotebooks)
-      return;
-    if (layoutNotebook) {
+    if (linear) {
       for (const entry of tag2.array("tiles") ?? []) {
         const ignored = ["colspan", "break"].filter((p2) => entry.has(p2));
         if (ignored.length === 0)
@@ -381087,7 +380969,7 @@ function lintNotebookText(modelPath, text) {
       }
     }
     const columns = motlyTag(modelNotes)?.tag("dashboard");
-    if (layoutNotebook && columns?.has("columns")) {
+    if (linear && columns?.has("columns")) {
       const width = tagNumeric(columns, "columns");
       if (width !== 1) {
         add(tagNote.line, "notebook-columns-ignored", "`dashboard { columns }` other than 1 is ignored on a notebook, which is always one column. Fix: remove `dashboard { columns }`.");
@@ -381126,6 +381008,286 @@ function notebookLintProblems(modelPath, text, url3) {
   });
 }
 
+// src/service/compile_document.ts
+var DECLARATION = /\b(?:source|query)\s*:\s*(`(?:[^`\\]|\\.)*`|[\p{L}_][\p{L}\p{N}_]*)\s+is\b/giu;
+function blankSpans(text, cells) {
+  if (cells.length === 0)
+    return text;
+  const units = text.split("");
+  for (const cell of cells) {
+    const span = cellOffsets.get(cell);
+    if (!span)
+      throw new Error("restricted cell has no recorded span");
+    const [start, end] = span;
+    for (let i2 = start;i2 < end && i2 < units.length; i2++) {
+      if (units[i2] !== `
+` && units[i2] !== "\r")
+        units[i2] = " ";
+    }
+  }
+  return units.join("");
+}
+function declaredNames(text) {
+  const found = new Set(buildDerivationBaseMap(text).keys());
+  for (const match of stripMalloyCommentsAndLiterals(text).matchAll(DECLARATION)) {
+    const name = match[1];
+    found.add(name.startsWith("`") ? name.slice(1, -1) : name);
+  }
+  return found;
+}
+function readsSource(prepared) {
+  const ref = prepared._query?.structRef;
+  if (typeof ref === "string")
+    return ref;
+  const named = ref;
+  return named?.as || named?.name;
+}
+async function denied(gates, text) {
+  try {
+    await gates.text(text);
+    return false;
+  } catch (error2) {
+    if (error2 instanceof AccessDeniedError)
+      return true;
+    throw error2;
+  }
+}
+function tileProblem(expression, reason, cause) {
+  return {
+    code: "tile-does-not-compile",
+    severity: "error",
+    message: `Tile "${expression}" ${cause === "parse" ? "could not be parsed" : "does not compile"}: ${reason.replace(/\.?\s*$/, ".")} ` + `Fix: write the tile as one query over a source and a view, such as \`source -> view\` or \`source -> { group_by: field }\`.`
+  };
+}
+function problemLine(problem) {
+  const line = problem.at?.range?.start?.line;
+  return line === undefined ? undefined : line + 1;
+}
+function cellsRemovedProblems(source) {
+  const problems = notebookLintProblems("document.malloy", source, "").filter((problem) => problem.code === CELLS_REMOVED || problem.code === LAYOUT_UNKNOWN);
+  return problems.length > 0 ? problems : [
+    {
+      code: CELLS_REMOVED,
+      severity: "error",
+      message: CELLS_REMOVED_MESSAGE
+    }
+  ];
+}
+async function compileDocument(input) {
+  const { base, source, modelName, gates } = input;
+  const tag = readReportTagOfText(source);
+  if (tag.status === "cells-removed")
+    return { problems: cellsRemovedProblems(source) };
+  if (tag.status !== "report")
+    return;
+  const parse5 = parseNotebookText(source);
+  if (isNotebookReaderError(parse5))
+    return;
+  const read = readNotebookCells(parse5, undefined, source);
+  if (read.error) {
+    return { problems: [cellsUnreadableProblem(read.error, "")] };
+  }
+  const code = read.cells.filter((cell) => cell.type === "code");
+  const restrictedCells = new Set;
+  const tainted = new Set;
+  const mentionsTainted = (text) => tainted.size > 0 && [...scanIdentifiers(text)].some((name) => tainted.has(name));
+  for (const cell of code) {
+    if (mentionsTainted(cell.text) || await denied(gates, cell.text)) {
+      restrictedCells.add(cell);
+      if (cell.kind === "definition") {
+        for (const name of declaredNames(cell.text))
+          tainted.add(name);
+      }
+    }
+  }
+  const tileExpressions = readDocumentTileExpressions(read.annotations);
+  const restrictedTiles = new Set;
+  for (const expression of tileExpressions) {
+    const text = `run: ${expression}`;
+    if (mentionsTainted(text) || await denied(gates, text)) {
+      restrictedTiles.add(normalizeTileExpression(expression));
+    }
+  }
+  const definitions = code.filter((cell) => cell.kind === "definition" && !restrictedCells.has(cell)).map((cell) => cell.text).join(`
+`);
+  const unparsedTiles = new Set;
+  const tileProblems = [];
+  for (const expression of tileExpressions) {
+    const key = normalizeTileExpression(expression);
+    if (restrictedTiles.has(key))
+      continue;
+    try {
+      await gates.constructs(`${definitions}
+run: ${expression}`);
+    } catch (error2) {
+      if (!(error2 instanceof UnparseableTextError))
+        throw error2;
+      unparsedTiles.add(key);
+      tileProblems.push(tileProblem(expression, error2.detail, "parse"));
+    }
+  }
+  const boundaryProblems = [];
+  const checkBoundary = async (query, line) => {
+    try {
+      await gates.boundary(query, definitions);
+    } catch (error2) {
+      if (!(error2 instanceof OffSurfaceError))
+        throw error2;
+      boundaryProblems.push({
+        code: "query-not-queryable",
+        severity: "error",
+        message: error2.message,
+        ...line !== undefined && {
+          at: {
+            url: "",
+            range: {
+              start: { line: line - 1, character: 0 },
+              end: { line: line - 1, character: 0 }
+            }
+          }
+        }
+      });
+    }
+  };
+  for (const cell of code) {
+    if (cell.kind === "query" && !restrictedCells.has(cell)) {
+      await checkBoundary(cell.text, cell.startLine);
+    }
+  }
+  for (const expression of tileExpressions) {
+    const key = normalizeTileExpression(expression);
+    if (!restrictedTiles.has(key) && !unparsedTiles.has(key)) {
+      await checkBoundary(`run: ${expression}`, undefined);
+    }
+  }
+  if (boundaryProblems.length > 0)
+    return { problems: boundaryProblems };
+  const readable = [
+    ...code.filter((cell) => cell.kind === "query" && !restrictedCells.has(cell)).map((cell) => cell.text),
+    ...tileExpressions.filter((expression) => {
+      const key = normalizeTileExpression(expression);
+      return !restrictedTiles.has(key) && !unparsedTiles.has(key);
+    }).map((expression) => `run: ${expression}`)
+  ];
+  for (const query of readable.length > 0 ? readable : [""]) {
+    gates.nameVisible(query, definitions);
+  }
+  const compiledText = blankSpans(source, [...restrictedCells]);
+  await gates.document(compiledText);
+  const extended = base.extendModel(compiledText);
+  let model;
+  try {
+    model = await extended.getModel();
+  } catch (error2) {
+    if (error2 instanceof MalloyError4)
+      return { problems: [...tileProblems, ...error2.problems] };
+    throw error2;
+  }
+  const modelDef = model._modelDef;
+  const registry2 = modelDef.givens ?? {};
+  const sources = extractSourcesFromModelDef(modelDef, []).sources;
+  const settle2 = async (runnable, onDenied) => {
+    try {
+      await gates.compiled(runnable);
+    } catch (error2) {
+      if (error2 instanceof AccessDeniedError)
+        onDenied();
+      else
+        throw error2;
+    }
+  };
+  const compiledBoundary = async (runnable, prepared, query) => {
+    try {
+      await gates.boundaryCompiled(runnable, readsSource(prepared), query, definitions);
+    } catch (error2) {
+      if (!(error2 instanceof OffSurfaceError))
+        throw error2;
+      boundaryProblems.push({
+        code: "query-not-queryable",
+        severity: "error",
+        message: error2.message
+      });
+    }
+  };
+  for (const cell of code) {
+    if (cell.kind !== "query" || restrictedCells.has(cell))
+      continue;
+    const runnable = extended.loadRestrictedQuery(cell.text);
+    let denied2 = false;
+    await settle2(runnable, () => {
+      denied2 = true;
+      restrictedCells.add(cell);
+    });
+    if (denied2)
+      continue;
+    try {
+      await compiledBoundary(runnable, await runnable.getPreparedQuery(), cell.text);
+    } catch (error2) {
+      if (!(error2 instanceof MalloyError4))
+        throw error2;
+    }
+  }
+  const compiledTiles = await compileTileGivens(tileExpressions, { loadQuery: (text) => extended.loadRestrictedQuery(text) }, registry2, (sourceName) => gateGivenSource(sources, sourceName), new Set([...restrictedTiles, ...unparsedTiles]), async (tile, prepared) => {
+    let denied2 = false;
+    await settle2({ getPreparedQuery: async () => prepared }, () => {
+      denied2 = true;
+      restrictedTiles.add(normalizeTileExpression(tile));
+    });
+    if (!denied2) {
+      await compiledBoundary({ getPreparedQuery: async () => prepared }, prepared, `run: ${tile}`);
+    }
+  }, (tile, error2) => {
+    if (!(error2 instanceof MalloyError4))
+      return;
+    gates.nameVisible(`run: ${tile}`, definitions);
+    tileProblems.push(tileProblem(tile, error2.problems.map((problem) => problem.message).join("; "), "compile"));
+  });
+  if (boundaryProblems.length > 0)
+    return { problems: boundaryProblems };
+  const spans = [...restrictedCells];
+  const problems = [...tileProblems, ...model.problems].filter((problem) => {
+    const line = problemLine(problem);
+    return line === undefined || !spans.some((cell) => line >= cell.startLine && line <= cell.endLine);
+  });
+  const slug = modelName.replace(/^.*\//, "").replace(/\.malloy$/, "");
+  const path13 = `${slug}.malloy`;
+  const facts = readReportModelFacts(path13, modelDef, Object.values(registry2).map((given) => given.name), new Map(sources.flatMap((entry) => entry.name ? [
+    [
+      entry.name,
+      gateGivenSource(sources, entry.name) ?? []
+    ]
+  ] : [])));
+  const manifest = buildReportManifest({ ...facts, compiledTileGivens: compiledTiles }, { restrictedTiles });
+  const cells = read.cells.filter((cell) => cell.kind === "definition").map((cell) => {
+    const restricted = restrictedCells.has(cell);
+    if (cell.kind === "markdown") {
+      return { type: "markdown", kind: "markdown", text: cell.text };
+    }
+    return {
+      type: "code",
+      kind: cell.kind,
+      text: cell.text,
+      ...cell.markdown !== undefined && { markdown: cell.markdown },
+      ...cell.proseLines && { proseLines: cell.proseLines },
+      ...cell.codeLine !== undefined && { codeLine: cell.codeLine },
+      ...cell.caption !== undefined && { caption: cell.caption },
+      ...restricted && { restricted: true }
+    };
+  });
+  if (!manifest) {
+    return { problems, document: { layout: tag.layout, cells } };
+  }
+  const { entryFile: _entry, ...rest } = manifest;
+  return {
+    problems,
+    document: {
+      layout: manifest.layout,
+      manifest: { ...rest, name: slug },
+      cells
+    }
+  };
+}
+
 // src/service/environment.ts
 init_constants();
 init_errors();
@@ -381516,7 +381678,7 @@ var storageServeRoutingCounter = lazyCounter4("publisher_storage_serve_routing_t
 var storageTableRetainedCounter = lazyCounter4("publisher_storage_tables_retained_total", "Tables a FAILED run left in a storage= destination and deliberately did not " + "reclaim, because the source is refreshed incrementally and the name may be " + "the one it serves from. Label: destination. Not all of these are orphans — " + "a rebuild at a fresh generational name is, a seed on the live serving name " + "is not, and the manifest entry cannot separate them — so read this as an " + "upper bound on what is accumulating rather than a leak count. It is the " + "only accounting there is until reclaiming a destination exists, which is " + "why it is a counter and not just a log line: the question is a rate, not " + "whether it ever happened.");
 var storageBuildFailureCounter = lazyCounter4("publisher_storage_build_failures_total", "storage= build failures (federation/passthrough/attach/CTAS), distinct from " + "in-warehouse build failures. Labels: destination (connection name), " + "reason ('build_failed'|'billed_read_not_captured'). The second is the " + "expensive one: the warehouse read ran and was charged, and the rows could " + "not be captured — so a re-drive pays for it again. Worth alerting on " + "separately from a failure that costs only a retry.");
 var attributionSkippedCounter = lazyCounter4("publisher_storage_build_attribution_skipped_total", "storage= builds whose warehouse read went out UNATTRIBUTED while tagging was " + "on. Label: reason ('job_listing_unavailable'|'tag_failed'|" + "'read_row_not_found'|'read_row_ambiguous'|'cost_query_failed'). " + "The read still ran and the " + "build still succeeded — what was lost is the label in the customer's own " + "query history, and the cost on this side. Without this an operator who " + "turns tagging on and sees nothing has a single log line to go on.");
-var eligibilityRefusedCounter = lazyCounter4("publisher_materialization_eligibility_refused_total", "materialization-eligibility refusals, both tiers. Label: reason " + "('free_parameter'|'given_in_persisted_query'|'dynamic_projection'|" + "'dynamic_join'|'dynamic_joined_where'|'partition_without_storage'|" + "'partition_column_unknown'|'partition_column_not_public'|" + "'merge_key_scope_unresolved'|'preaggregate_over_dynamic_source'|" + "'authorize'|'partition'|'not_duckdb_portable'|" + "'public_surface_unknown'). 'given' is retained on the enum for records " + "that carry it and is no longer produced: where a given sits decides the " + "outcome, so one reason covering every placement cannot be raised.");
+var eligibilityRefusedCounter = lazyCounter4("publisher_materialization_eligibility_refused_total", "materialization-eligibility refusals, both tiers. Label: reason " + "('free_parameter'|'given_in_persisted_query'|'dynamic_projection'|" + "'dynamic_join'|'dynamic_joined_where'|'partition_without_storage'|" + "'partition_column_unknown'|'partition_column_not_public'|" + "'merge_key_scope_unresolved'|'preaggregate_over_dynamic_source'|" + "'authorize'|'partition'|'not_duckdb_portable'|" + "'public_surface_unknown'|'read_only_dialect'). 'given' is retained on the enum for records " + "that carry it and is no longer produced: where a given sits decides the " + "outcome, so one reason covering every placement cannot be raised.");
 var serveShapeTierDropCounter = lazyCounter4("publisher_storage_serve_shape_tier_drop_total", "storage serve-shape compile escalations: a refinement tier failed to " + "compile and the riskiest category was dropped, or one or more lifted " + "entry points failed to compile and were dropped alone. Label: tier (the " + "failed tier index, 0=full; 'lifts' for dropped lifts).");
 var serveShapeTypeFallbackCounter = lazyCounter4("publisher_storage_serve_shape_type_fallback_total", "Captured DuckDB column types mapped to json in the serve shape (type " + "fidelity loss). Label: kind ('array'|'unrecognized').");
 var chainedStorageBuildCounter = lazyCounter4("publisher_storage_chained_build_total", "Chained storage= source builds (a source reading a storage-materialized " + "upstream). Label: outcome ('parent_reuse'|'inline_fallback'|" + "'strict_shape_fallback'|'strict_refused'|'infra_failure'). The " + "parent_reuse share is the headline signal for how far the " + "stack-on-the-parent path gets us vs recompute-from-raw.");
@@ -384549,7 +384711,16 @@ function assertMergeKeyScopeResolvable(persistSource, terms, annotationFields, w
     message: `${what} cannot be materialized: it declares 'merge_key=' and is ` + `scoped by a term this pass cannot express as a predicate over the ` + `stored table's own columns (${unscopable.map((term) => `'${term.code}'`).join(", ")}). An incremental refresh matches rows by the merge ` + `key, and the stored table holds every caller's rows, so the match ` + `must also carry the scoping columns or it would update rows ` + `belonging to other callers. Scope this source with a term over its ` + `own columns, or drop 'merge_key=' to refresh by watermark range.`
   });
 }
+var READ_ONLY_DIALECTS = new Set(["sqlserver"]);
 function assertColocatedPersistNotAuthorizeGated(persistSource, sourceName = persistSource.name, origin2 = "persist", gateOutcome, annotationFields = {}) {
+  if (!annotationFields.storage && READ_ONLY_DIALECTS.has(persistSource.dialectName)) {
+    recordEligibilityRefused("read_only_dialect");
+    const what2 = origin2 === "preaggregate" ? `Pre-aggregation rollup '${sourceName}'` : `Source '${sourceName}'`;
+    throw new MaterializationEligibilityError({
+      reason: "read_only_dialect",
+      message: `${what2} cannot be materialized (colocated '#@ persist'): its ` + `connection '${persistSource.connectionName}' is on the ` + `'${persistSource.dialectName}' dialect, whose connection is ` + `read-only and creates no tables, so there is nowhere in the ` + `source warehouse to write the result. The source serves live. ` + `Remove the annotation, or persist a source on a connection that ` + `can write.`
+    });
+  }
   const partition = resolvePartitionColumns(persistSource, annotationFields);
   if (!partition.ok) {
     recordEligibilityRefused(partition.reason);
@@ -385488,7 +385659,7 @@ function assertEveryCallerJoinPlaced(prepared, found, isCaller) {
     }
   }
 }
-function derivationTerminals(start, basesOf, isModelSource, maxNames = DERIVATION_CHAIN_MAX_NAMES) {
+function derivationTerminals(start, basesOf, isModelSource, maxNames = DERIVATION_CHAIN_MAX_NAMES, modelQuerySource) {
   const seen = new Set;
   const terminals = [];
   const worklist = [start];
@@ -385504,8 +385675,13 @@ function derivationTerminals(start, basesOf, isModelSource, maxNames = DERIVATIO
       continue;
     }
     const bases = basesOf.get(name);
-    if (!bases || bases.size === 0)
-      return { proven: false, at: name };
+    if (!bases || bases.size === 0) {
+      const querySource = modelQuerySource?.(name);
+      if (!querySource)
+        return { proven: false, at: name };
+      worklist.push(querySource);
+      continue;
+    }
     for (const base of bases)
       worklist.push(base);
   }
@@ -385530,7 +385706,7 @@ function resolveCallerJoin(callerJoin, compiledModelDef, region, context) {
     if (forBoundary)
       boundaryNames.add(name);
   };
-  const chainOf = (start) => derivationTerminals(start, text.derivations(), (name) => context.isModelSource(name));
+  const chainOf = (start) => derivationTerminals(start, text.derivations(), (name) => context.isModelSource(name), undefined, (name) => context.modelQuerySource(name));
   const byContentsKey = (key, forBoundary) => {
     const entry = contentsStruct(compiledModelDef, key);
     if (entry && isCaller(entry.location)) {
@@ -386160,7 +386336,47 @@ function fieldUsageClosure(declaring, refSummary) {
   }
   return { paths, truncated: false };
 }
-function assertFilterConditionBindsToDeclaringSource(declaringStruct, executedStruct, condition) {
+function isCompositePlaceholder(field) {
+  return field.e?.node === "compositeField";
+}
+function isComposite(struct) {
+  return struct?.type === "composite";
+}
+function compositeMembers(composite, out = [], depth = 0) {
+  if (depth > MAX_JOIN_RECURSION_DEPTH)
+    return out;
+  const members = composite.sources;
+  for (const member of members ?? []) {
+    out.push(member);
+    if (isComposite(member))
+      compositeMembers(member, out, depth + 1);
+  }
+  return out;
+}
+function withCompositeMembersResolved(declaring, executed, composite) {
+  if (!composite || !isComposite(declaring) || !isComposite(composite)) {
+    return declaring;
+  }
+  const leaf = (member) => !isComposite(member);
+  const declared = new Set(compositeMembers(declaring).filter(leaf).map((member) => JSON.stringify(strip(member))));
+  const memberFields = new Set(compositeMembers(composite).filter((member) => leaf(member) && declared.has(JSON.stringify(strip(member)))).flatMap((member) => member.fields ?? []));
+  let resolved = false;
+  const fields = (declaring.fields ?? []).map((field) => {
+    if (!isCompositePlaceholder(field))
+      return field;
+    const executedField = executed.fields?.find((f5) => activeName2(f5) === activeName2(field));
+    if (!executedField || !memberFields.has(executedField))
+      return field;
+    resolved = true;
+    return executedField;
+  });
+  return resolved ? { ...declaring, fields } : declaring;
+}
+function membersDeclaringCondition(composite, condition) {
+  return compositeMembers(composite).filter((member) => member.filterList?.includes(condition));
+}
+function assertFilterConditionBindsToDeclaringSource(declaringStructAsWritten, executedStruct, condition, executedComposite = undefined) {
+  const declaringStruct = withCompositeMembersResolved(declaringStructAsWritten, executedStruct, executedComposite);
   const { paths, truncated, unrecordedJoin } = fieldUsageClosure(declaringStruct, condition.refSummary);
   if (truncated) {
     throw new Error("a row-security filter's field-usage closure exceeded the resolution bound");
@@ -386429,13 +386645,14 @@ function isOwnFreshFilter(struct, condition, freshness) {
   }
   return !!freshness.compiledUrl && at2.url === freshness.compiledUrl;
 }
-function assertInheritedSourceFiltersBind(struct, modelDef, freshness = {}, resolveSibling = undefined, depth = 0, visited = new Set, alreadyProven = new Set) {
+function assertInheritedSourceFiltersBind(struct, modelDef, freshness = {}, resolveSibling = undefined, depth = 0, visited = new Set, alreadyProven = new Set, unresolved = undefined) {
   if (visited.has(struct))
     return;
   if (depth > MAX_JOIN_RECURSION_DEPTH) {
     throw new Error("row-security filter recursion exceeded the join-depth resolution bound");
   }
   visited.add(struct);
+  const composite = isComposite(unresolved) ? unresolved : undefined;
   for (const condition of struct.filterList ?? []) {
     if (alreadyProven.has(condition))
       continue;
@@ -386443,16 +386660,24 @@ function assertInheritedSourceFiltersBind(struct, modelDef, freshness = {}, reso
       continue;
     const origin2 = findFilterOrigin(struct, condition, modelDef, resolveSibling);
     if (origin2 !== struct) {
-      assertFilterConditionBindsToDeclaringSource(origin2, struct, condition);
+      assertFilterConditionBindsToDeclaringSource(origin2, struct, condition, composite);
       continue;
     }
     if (isOwnFreshFilter(struct, condition, freshness))
       continue;
+    const members = composite ? membersDeclaringCondition(composite, condition) : [];
+    if (members.length > 0) {
+      for (const member of members) {
+        assertFilterConditionBindsToDeclaringSource(member, struct, condition);
+      }
+      continue;
+    }
     throw new Error("a row-security filter's declaring source could not be resolved");
   }
   for (const field of struct.fields ?? []) {
     if (isJoined6(field) && isSourceDef8(field)) {
-      assertInheritedSourceFiltersBind(field, modelDef, freshness, resolveSibling, depth + 1, visited, alreadyProven);
+      const unresolvedJoin = unresolved?.fields?.find((f5) => isJoined6(f5) && activeName2(f5) === activeName2(field));
+      assertInheritedSourceFiltersBind(field, modelDef, freshness, resolveSibling, depth + 1, visited, alreadyProven, unresolvedJoin);
     }
   }
 }
@@ -386670,6 +386895,9 @@ class Model {
   preaggregateRollupPlans = [];
   preaggregatePlansVersion = 0;
   compiledSourceText;
+  reportModelFacts;
+  reportTagCarried;
+  sharedQueryModels = new WeakMap;
   compiledReportFacts;
   settledCompiledReportFacts;
   sources;
@@ -387020,13 +387248,15 @@ class Model {
     await this.authorizeAndBindRunnable(runnable, givens, {
       bypassAuthorize,
       checkOnly: options?.checkOnly,
+      compileCallerText: options?.callerRegion?.text,
       callerJoins: options?.callerRegion ? {
         runnable,
         region: options.callerRegion
       } : undefined
     });
   }
-  async collectAuthorizeEntryPointGates(runnable, givens, graftScope, skipOwnSourceGate = false) {
+  async collectAuthorizeEntryPointGates(runnable, givens, graftScope, options = {}) {
+    const { skipOwnSourceGate = false, callerText } = options;
     const ownSourceName = await this.resolveAuthorizeSourceFromRunnable(runnable);
     if (!skipOwnSourceGate) {
       await this.assertAuthorized(ownSourceName, givens, false, graftScope);
@@ -387049,8 +387279,29 @@ class Model {
         entryPointGates = Array.from(byKey.values());
       }
     }
+    if (callerText && !skipOwnSourceGate && ownSourceName) {
+      entryPointGates = this.foldRequestDeclaredTwins(ownSourceName, callerText, entryPointGates);
+    }
     return { entryPointGates, modelDef, struct };
   }
+  foldRequestDeclaredTwins(ownSourceName, callerText, walked) {
+    if (this.entryPointGatesBySource.has(ownSourceName))
+      return walked;
+    const proof = this.requestChainGates(ownSourceName, callerText);
+    if (!proof.proven)
+      return walked;
+    return this.swapForOnDiskTwins(walked, proof.gatesByBase.flatMap(([, gates]) => gates));
+  }
+  swapForOnDiskTwins(walked, twins) {
+    const used = new Set;
+    return walked.map((entry) => {
+      const twin = twins.find((t3) => !used.has(t3) && t3.route === entry.route && t3.exprs.length === entry.exprs.length && t3.exprs.every((expr, i2) => expr === entry.exprs[i2]));
+      if (!twin)
+        return entry;
+      used.add(twin);
+      return twin;
+    });
+  }
   async assertAuthorizedFromCompiledRunnable(runnable, givens) {
     await this.authorizeAndBindRunnable(runnable, givens, {
       skipOwnSourceGate: true,
@@ -387068,8 +387319,8 @@ class Model {
   queryHadRowLevelFilterAttached(runnable) {
     return this.rowLevelFilteredRunnables.has(runnable);
   }
-  async probeEntryPointGates(runnable, givens, graftScope, skipOwnSourceGate = false) {
-    const { entryPointGates, modelDef } = await this.collectAuthorizeEntryPointGates(runnable, givens, graftScope, skipOwnSourceGate);
+  async probeEntryPointGates(runnable, givens, graftScope, options = {}) {
+    const { entryPointGates, modelDef } = await this.collectAuthorizeEntryPointGates(runnable, givens, graftScope, options);
     const rowLevel = [];
     for (const entry of entryPointGates) {
       const resolution = modelDef ? await this.resolveGateShape(entry, modelDef, graftScope) : { shape: "rejected", cause: undefined };
@@ -387118,10 +387369,10 @@ class Model {
       return;
     if (this.entryPointGatesBySource.has(entryPoint))
       return;
-    const proof = this.requestChainProvesUngated(entryPoint, buildDerivationBaseMap(query));
+    const proof = this.requestChainGates(entryPoint, query);
     if (proof.proven) {
-      for (const base of proof.gatedBases) {
-        for (const entry of this.entryPointGatesBySource.get(base) ?? []) {
+      for (const [base, gates] of proof.gatesByBase) {
+        for (const entry of gates) {
           const resolution = this.modelDef ? await this.resolveGateShape(entry, this.modelDef, graftScope) : { shape: "rejected", cause: undefined };
           if (resolution.shape === "row_level") {
             this.denyLaunderedEntryPoint(entryPoint, "row_filter_not_graftable", base);
@@ -387133,6 +387384,15 @@ class Model {
     }
     this.denyLaunderedEntryPoint(entryPoint, proof.reason, proof.at);
   }
+  requestChainGates(entryPoint, text) {
+    const proof = this.requestChainProvesUngated(entryPoint, buildDerivationBaseMap(text));
+    if (!proof.proven)
+      return proof;
+    return {
+      proven: true,
+      gatesByBase: proof.gatedBases.map((base) => [base, this.entryPointGatesBySource.get(base) ?? []])
+    };
+  }
   async assertLocksOnRequestDeclaredBases(entryPoint, query, givens, bypassAuthorize) {
     if (!this.declaresAnyGate())
       return;
@@ -387170,7 +387430,7 @@ class Model {
     return this.declaresAnyGateMemo;
   }
   requestChainProvesUngated(entryPoint, basesOf) {
-    const chain = derivationTerminals(entryPoint, basesOf, (name) => this.entryPointGatesBySource.has(name), REQUEST_CHAIN_MAX_NAMES);
+    const chain = derivationTerminals(entryPoint, basesOf, (name) => this.entryPointGatesBySource.has(name), REQUEST_CHAIN_MAX_NAMES, (name) => this.modelQuerySource(name));
     if (!chain.proven) {
       return {
         proven: false,
@@ -387183,6 +387443,9 @@ class Model {
       gatedBases: chain.terminals.filter((name) => (this.entryPointGatesBySource.get(name)?.length ?? 0) > 0)
     };
   }
+  modelQuerySource(name) {
+    return this.queries?.find((q3) => q3.name === name)?.sourceName;
+  }
   resolvedCallerJoins(runnable, region) {
     const cached4 = this.callerJoinResolutions.get(runnable);
     if (cached4 && cached4.region === region)
@@ -387207,6 +387470,7 @@ class Model {
     const context = {
       isModelSource: (name) => this.entryPointGatesBySource.has(name),
       isModelQuery: (name) => this.modelDef?.contents[name]?.type === "query",
+      modelQuerySource: (name) => this.modelQuerySource(name),
       authorUrls
     };
     return collectCallerJoins(prepared, region, authorUrls).map((callerJoin) => ({
@@ -387248,7 +387512,9 @@ class Model {
   async decideCallerSource(source, compiledModelDef, alias, givens, graftScope) {
     const gates = this.collectEntryPointGates(source.struct, compiledModelDef, new Set, true);
     if (gates.length > 0) {
-      return Promise.all(gates.map((entry) => this.resolveGateShape(entry, compiledModelDef, graftScope)));
+      const twins = source.chain.proven ? source.chain.terminals.flatMap((base) => this.entryPointGatesBySource.get(base) ?? []) : [];
+      const swapped = this.swapForOnDiskTwins(gates, twins);
+      return Promise.all(swapped.map((entry, i2) => entry === gates[i2] ? this.resolveGateShape(entry, compiledModelDef, graftScope) : this.resolveGateShape(entry, this.modelDef ?? compiledModelDef, graftScope)));
     }
     if (!source.chain.proven) {
       this.denyCallerJoin(alias, "chain_not_established", source.chain.at);
@@ -387450,7 +387716,10 @@ ${query}`;
       return runnable;
     }
     const graftScope = options?.graftScope ?? this.defaultGraftScope();
-    const entryPointRowLevel = await this.probeEntryPointGates(runnable, givens, graftScope, options?.skipOwnSourceGate ?? false);
+    const entryPointRowLevel = await this.probeEntryPointGates(runnable, givens, graftScope, {
+      skipOwnSourceGate: options?.skipOwnSourceGate,
+      callerText: options?.compileCallerText ?? options?.callerQueryText
+    });
     if (entryPointRowLevel.length === 0) {
       if (options?.callerQueryText && !options?.skipOwnSourceGate) {
         await this.assertRequestDeclaredEntryPointIsNotLaundered(runnable, options.callerQueryText, givens, graftScope);
@@ -387480,6 +387749,7 @@ ${query}`;
         g2
       ])).values());
       const graftedMaterializer = this.getOrBuildGraftedMaterializer(grafts, graftScope);
+      await this.ensureSharedQueryModel(graftedMaterializer);
       const recompiled = options.recompile(graftedMaterializer, grafts);
       if (options.proveGraft) {
         if (callerJoinRowLevel.length > 0) {
@@ -387644,14 +387914,15 @@ ${query}`;
     if (!target)
       return;
     try {
-      assertInheritedSourceFiltersBind(target, modelDef, { compiledUrl, queryLocation }, this.siblingModelDefResolver, undefined, undefined, alreadyProven);
+      assertInheritedSourceFiltersBind(target, modelDef, { compiledUrl, queryLocation }, this.siblingModelDefResolver, undefined, undefined, alreadyProven, struct);
     } catch (err) {
       recordRowLevelGateDecision("denied_by_gate", site);
       logger.debug("Inherited source filter binding check failed; denying", {
         modelPath: this.modelPath,
         error: err instanceof Error ? err.message : String(err)
       });
-      const label = target.as || target.name;
+      const named = struct ?? target;
+      const label = named.as || named.name;
       throw new AccessDeniedError(`Access denied for source "${label}".`);
     }
   }
@@ -387946,6 +388217,27 @@ ${query}`;
     model.preparedPreaggregateCompanion = data.preaggregateCompanion;
     return model;
   }
+  ensureSharedQueryModel(materializer) {
+    if (!materializer)
+      return Promise.resolve();
+    let built = this.sharedQueryModels.get(materializer);
+    if (!built) {
+      built = (async () => {
+        try {
+          const base = await materializer.getModel();
+          base.queryModel;
+        } catch (error2) {
+          logger.warn("Could not build a shared QueryModel; each query builds its own", {
+            packageName: this.packageName,
+            modelPath: this.modelPath,
+            error: error2 instanceof Error ? error2.message : String(error2)
+          });
+        }
+      })();
+      this.sharedQueryModels.set(materializer, built);
+    }
+    return built;
+  }
   static fromCompilationError(packageName, modelPath, modelType, error2, sourceText) {
     const model = new Model(packageName, modelPath, {}, modelType, undefined, undefined, undefined, undefined, undefined, undefined, error2);
     model.compiledSourceText = sourceText;
@@ -388029,6 +388321,11 @@ ${query}`;
     return this.compiledSourceText;
   }
   getReportModelFacts() {
+    return (this.reportModelFacts ??= {
+      value: this.deriveReportModelFacts()
+    }).value;
+  }
+  deriveReportModelFacts() {
     if (!this.modelDef)
       return;
     return readReportModelFacts(this.modelPath, this.modelDef, (this.givens ?? []).map((given) => given.name).filter((name) => name !== undefined), new Map((this.sources ?? []).flatMap((source) => source.name ? [
@@ -388264,6 +388561,9 @@ ${query}`;
     return this.modelPath.endsWith(NOTEBOOK_FILE_SUFFIX) ? "malloynb" : "malloy";
   }
   carriesReportTag() {
+    return this.reportTagCarried ??= this.deriveCarriesReportTag();
+  }
+  deriveCarriesReportTag() {
     if (!isReportEligiblePath(this.modelPath))
       return false;
     const facts = this.getReportModelFacts();
@@ -388365,7 +388665,9 @@ ${query}`;
     ];
     const findings = [];
     const carriesReportTag = this.carriesReportTag();
+    const yielder = createEventLoopYielder();
     for (const { label, result } of prepared) {
+      await yielder.maybeYield();
       const logs = filterPublisherOwnedRenderLogs(validateRenderTags2(result), carriesReportTag);
       if (logs.length > 0) {
         logger.warn(`Render tag findings on '${label}': ${logs.map((e2) => `[${e2.severity}] ${e2.message}`).join("; ")}`);
@@ -388382,8 +388684,11 @@ ${query}`;
   }
   preparedRenderTagResults;
   async prepareRenderTagTargets(mm, targets) {
+    await this.ensureSharedQueryModel(mm);
+    const yielder = createEventLoopYielder();
     const prepared = [];
     for (const target of targets) {
+      await yielder.maybeYield();
       try {
         const result = await mm.loadQuery(target.queryString).getPreparedResult();
         prepared.push({
@@ -388459,48 +388764,19 @@ ${query}`;
     const read = readNotebookCells(parse5, modelDef, text);
     if (read.error)
       return refuse(read.error);
-    const anonymousQueries = this.modelInfo?.anonymous_queries ?? [];
     this.notebookAnnotations = read.annotations;
     const layout = this.readNotebookLayout();
     this.notebookLayout = layout;
-    const fileCells = layout ? read.cells.filter((cell) => cell.kind === "definition") : read.cells;
-    const cells = fileCells.map((cell) => {
-      if (cell.kind === "markdown") {
-        return { type: "markdown", kind: "markdown", text: cell.text };
-      }
-      if (cell.kind === "definition") {
-        return {
-          type: "code",
-          kind: "definition",
-          text: cell.text,
-          markdown: cell.markdown,
-          proseLines: cell.proseLines,
-          codeLine: cell.codeLine,
-          caption: cell.caption,
-          modelDef
-        };
-      }
-      const k2 = cell.queryIndex ?? -1;
-      const anonymous = anonymousQueries[k2];
-      const compiled = modelDef.queryList[k2];
-      return {
-        type: "code",
-        kind: "query",
-        text: cell.text,
-        markdown: cell.markdown,
-        proseLines: cell.proseLines,
-        codeLine: cell.codeLine,
-        caption: cell.caption,
-        queryIndex: cell.queryIndex,
-        runnable: materializer.loadQuery(cell.text),
-        modelMaterializer: materializer,
-        modelDef,
-        queryInfo: anonymous && {
-          ...anonymous,
-          name: compiled?.as || compiled?.name || ""
-        }
-      };
-    });
+    const cells = read.cells.filter((cell) => cell.kind === "definition").map((cell) => ({
+      type: "code",
+      kind: "definition",
+      text: cell.text,
+      markdown: cell.markdown,
+      proseLines: cell.proseLines,
+      codeLine: cell.codeLine,
+      caption: cell.caption,
+      modelDef
+    }));
     if (layout) {
       for (const tile of layout.tiles ?? []) {
         if (tile.kind === "text") {
@@ -388567,7 +388843,7 @@ ${query}`;
         throw readerError;
       return this.getNotebookModel();
     } else {
-      throw new ModelNotFoundError(`${this.modelPath} is not a valid notebook name.  Notebook files must end in .malloynb, or be a .malloy with a model-level ## artifact { layout=linear } tag.`);
+      throw new ModelNotFoundError(`${this.modelPath} is not a valid notebook name.  Notebook files must end in .malloynb, or be a .malloy report with a model-level ## artifact { layout=linear tiles=[…] } tag.`);
     }
   }
   setServeDestinationConfig(provider) {
@@ -388615,6 +388891,7 @@ ${query}`;
       ...ordinary,
       ...groups.flatMap((g2) => g2.members)
     ]);
+    await this.ensureSharedQueryModel(this.serveShapeCache.materializer);
     const runnable = this.serveShapeCache.materializer.loadRestrictedQuery(queryString);
     const probeSQL = await runnable.getSQL({ virtualMap, givens });
     const rollupPaths = [
@@ -388900,6 +389177,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
           }
         }
       }
+      await this.ensureSharedQueryModel(this.modelMaterializer);
       runnable = this.modelMaterializer.loadRestrictedQuery(queryString);
       liveRunnable = runnable;
       querySurfaceGivens = this.filterGivensToModelSurface(givens, await this.givenNamesReadByQuery(runnable, givens));
@@ -389251,6 +389529,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
     return {
       type: "source",
       packageName: this.packageName,
+      path: this.modelPath,
       modelPath: this.modelPath,
       malloyVersion: MALLOY_VERSION,
       dataStyles: JSON.stringify(this.dataStyles),
@@ -389920,9 +390199,11 @@ init_constants();
 init_logger();
 async function compilePackageBuildPlan(pkg, signal) {
   const parts = emptyBuildPlanParts();
+  const yielder = createEventLoopYielder();
   for (const modelPath of pkg.getModelPaths()) {
     if (!modelPath.endsWith(MODEL_FILE_SUFFIX))
       continue;
+    await yielder.maybeYield();
     if (signal?.aborted)
       throw new Error("Build cancelled");
     const { runtime, modelURL, importBaseURL } = await Model.getModelRuntime(pkg.getPackagePath(), modelPath, pkg.getMalloyConfig());
@@ -391066,8 +391347,11 @@ class Package {
     const { packageName, packagePath, malloyConfig, buildManifest } = ctx;
     const models = new Map;
     const renderTagWarnings = [];
+    const timings = { hydrateMs: 0, renderValidationMs: 0 };
     const placeholder = (sm, err) => Model.fromCompilationError(packageName, sm.modelPath, sm.modelType, err, sm.modelPath === ctx.replacement?.modelPath ? ctx.replacement.source : undefined);
+    const yielder = createEventLoopYielder();
     for (const sm of outcome.models) {
+      await yielder.maybeYield();
       if (sm.compilationError) {
         const err = Model.deserializeCompilationError(sm.compilationError);
         if (onCompileError === "throw") {
@@ -391089,6 +391373,7 @@ class Package {
         continue;
       }
       let model;
+      const hydrateStart = performance.now();
       try {
         model = Model.fromSerialized(packageName, packagePath, malloyConfig, sm, {
           buildManifest,
@@ -391109,8 +391394,11 @@ class Package {
         });
         models.set(sm.modelPath, placeholder(sm, hydrateErr instanceof Error ? hydrateErr : new Error(String(hydrateErr))));
         continue;
+      } finally {
+        timings.hydrateMs += performance.now() - hydrateStart;
       }
       let warnings;
+      const validationStart = performance.now();
       try {
         warnings = await model.validateRenderTags();
       } catch (renderErr) {
@@ -391131,6 +391419,8 @@ class Package {
         }
         models.set(sm.modelPath, placeholder(sm, err));
         continue;
+      } finally {
+        timings.renderValidationMs += performance.now() - validationStart;
       }
       for (const w2 of warnings) {
         renderTagWarnings.push({
@@ -391140,10 +391430,12 @@ class Package {
           severity: w2.severity
         });
       }
+      const afterHydrateStart = performance.now();
       await afterHydrate?.(sm);
+      timings.hydrateMs += performance.now() - afterHydrateStart;
       models.set(sm.modelPath, model);
     }
-    return { models, renderTagWarnings };
+    return { models, renderTagWarnings, timings };
   }
   static async lintWorkerOutcome(environmentName, packageName, packagePath, malloyConfig, outcome, buildManifest, replacement) {
     const { models, renderTagWarnings } = await Package.hydrateWorkerModels(outcome, {
@@ -391213,8 +391505,13 @@ class Package {
     const packageConfig = Package.packageConfigFromOutcome(environmentName, packageName, outcome);
     let models;
     let renderTagWarnings;
+    let hydrationTimings;
     try {
-      ({ models, renderTagWarnings } = await Package.hydrateWorkerModels(outcome, { packageName, packagePath, malloyConfig }, "throw", async (sm) => {
+      ({
+        models,
+        renderTagWarnings,
+        timings: hydrationTimings
+      } = await Package.hydrateWorkerModels(outcome, { packageName, packagePath, malloyConfig }, "throw", async (sm) => {
         if (sm.modelPath.endsWith(MODEL_FILE_SUFFIX)) {
           const modelSource = await fs14.readFile(path16.join(packagePath, sm.modelPath), "utf-8");
           assertPersistNamesQuoted(modelSource, sm.modelPath);
@@ -391237,15 +391534,16 @@ class Package {
     });
     const pkg = new Package(environmentName, packageName, packagePath, packageConfig, databases, models, malloyConfig);
     pkg.renderTagWarnings = renderTagWarnings;
-    await pkg.discoverReports("load");
+    const reportTimings = await pkg.discoverReports("load");
     pkg.manifestWarnings = outcome.packageMetadata.manifestWarnings ?? [];
     pkg.recordDeprecatedUsage(outcome);
     pkg.retrievalSettings = outcome.packageMetadata.retrieval ?? DEFAULT_PACKAGE_RETRIEVAL;
     pkg.rawAgents = outcome.packageMetadata.agents;
     pkg.wireFreshnessResolvers();
     pkg.refreshServingIdentity();
+    let buildPlanMs;
+    const buildPlanPhaseStart = performance.now();
     try {
-      const buildPlanStart = Date.now();
       const workerPlan = outcome.buildPlan;
       for (const [reason, count4] of Object.entries(workerPlan?.eligibilityRefused ?? {})) {
         for (let i2 = 0;i2 < (count4 ?? 0); i2++) {
@@ -391278,7 +391576,8 @@ class Package {
         sourceEntityId: source.sourceEntityId,
         declaration: incrementalDeclarations[sourceID]
       }));
-      recordBuildPlanComputeDuration(workerPlan ? workerPlan.durationMs : Date.now() - buildPlanStart, workerPlan ? "worker" : "main_thread");
+      recordBuildPlanComputeDuration(workerPlan ? workerPlan.durationMs : performance.now() - buildPlanPhaseStart, workerPlan ? "worker" : "main_thread");
+      buildPlanMs = performance.now() - buildPlanPhaseStart;
     } catch (err) {
       recordBuildPlanComputeFailed();
       logger.warn(`Failed to compute build plan for package ${packageName}`, {
@@ -391334,6 +391633,15 @@ class Package {
     }
     await pkg.pushPreaggregateServeModels();
     pkg.logEmptyDiscoveryWarnings();
+    recordPackageLoadPhaseDurations({
+      worker: workerDoneTime - dispatchTime,
+      hydrate: hydrationTimings.hydrateMs,
+      render_validation: hydrationTimings.renderValidationMs,
+      discovery: reportTimings.discoveryMs,
+      lint: reportTimings.lintMs,
+      build_plan: buildPlanMs,
+      total: performance.now() - startTime
+    });
     return pkg;
   }
   getPackageName() {
@@ -391987,8 +392295,11 @@ class Package {
     const started = performance.now();
     const discovery = await this.discoverReportsIn(this.models, during);
     this.installReports(discovery);
+    const linting = performance.now();
     await this.relintReports({ textLint: during !== "compile" });
-    this.reportDiscovered(during, discovery, performance.now() - started);
+    const finished = performance.now();
+    this.reportDiscovered(during, discovery, finished - started);
+    return { discoveryMs: linting - started, lintMs: finished - linting };
   }
   reportDiscovered(during, discovery, durationMs) {
     recordReportDiscoveryDuration(during, durationMs);
@@ -392089,19 +392400,17 @@ class Package {
           model: modelPath,
           error: errMessage(err)
         });
-        if (tag.layout === "grid") {
-          files.set(modelPath, { status: "dropped", name });
-          continue;
-        }
+        files.set(modelPath, { status: "dropped", name });
+        continue;
       }
-      if (tag.layout === "grid" && facts && !manifest) {
+      if (facts && !manifest) {
         files.set(modelPath, { status: "tileless", name, facts });
         continue;
       }
-      if (tag.layout === "grid" && !facts) {
+      if (!facts) {
         manifest = {
           name,
-          layout: "grid",
+          layout: tag.layout,
           title: name,
           autorun: true,
           entryFile: modelPath,
@@ -392397,7 +392706,7 @@ class Package {
       layout: report.layout,
       title: manifest?.title ?? listing.title ?? report.name,
       description: manifest?.description ?? listing.description,
-      editable: report.path.endsWith(MODEL_FILE_SUFFIX) && (report.layout === "grid" || manifest !== undefined),
+      editable: report.path.endsWith(MODEL_FILE_SUFFIX),
       ...error2 !== undefined && { error: error2 }
     };
   }
@@ -394166,7 +394475,7 @@ ${query}`);
   }
 }
 // package.json
-var version2 = "0.9.10";
+var version2 = "0.9.12";
 
 // src/version.ts
 var SERVER_VERSION = version2;
@@ -400737,7 +401046,7 @@ function registerSearchDatabaseSchemaTool(mcpServer, environmentStore) {
     if (n === 0)
       return [];
     return [
-      `${n} table(s) have a path this server will not vouch for across every dialect it serves, so malloySource is omitted for them rather than risk a line that does not compile. Build it from tablePath: on your own dialect the path may work as-is, or may need the offending segment quoted. Double quotes on DuckDB, Postgres, Snowflake and Trino; backticks on MySQL, BigQuery and Databricks.`
+      `${n} table(s) have a path this server will not vouch for across every dialect it serves, so malloySource is omitted for them rather than risk a line that does not compile. Build it from tablePath: on your own dialect the path may work as-is, or may need the offending segment quoted. Double quotes on DuckDB, Postgres, Snowflake, Trino and SQL Server; backticks on MySQL, BigQuery and Databricks.`
     ];
   };
   const assertCanAdmit = async (environmentName) => {
@@ -405983,6 +406292,15 @@ function parseFrameAncestors(raw) {
   return raw.trim();
 }
 
+// src/service/experimental_dialects.ts
+import { getDialect } from "@malloydata/malloy";
+var BUNDLED_EXPERIMENTAL_DIALECTS = ["sqlserver"];
+function acceptBundledExperimentalDialects() {
+  for (const name of BUNDLED_EXPERIMENTAL_DIALECTS) {
+    getDialect(name).acceptExperimental();
+  }
+}
+
 // src/server.ts
 assertSupportedNodeVersion();
 function parseArgs() {
@@ -406058,6 +406376,7 @@ parseArgs();
 getPersistStorageMode();
 getPersistCollisionEnforce();
 getQueryMetadataMode();
+acceptBundledExperimentalDialects();
 var PUBLISHER_PORT = Number(process.env.PUBLISHER_PORT || 4000);
 var PUBLISHER_HOST = process.env.PUBLISHER_HOST || "0.0.0.0";
 var MCP_PORT = Number(process.env.MCP_PORT || 4040);