latticesql 2.1.0 → 2.2.0

package/dist/cli.js

@@ -417,12 +417,6 @@ function assertSafeLabel(label) {
     throw new Error(`Invalid label "${label}": must match [A-Za-z0-9._-]+ and not start with .`);
   }
 }
-function readToken(label) {
-  assertSafeLabel(label);
-  const path2 = join2(ensureKeysDir(), label + TOKEN_EXT);
-  if (!existsSync2(path2)) return null;
-  return readFileSync(path2, "utf8").trim();
-}
 function writeToken(label, token) {
   assertSafeLabel(label);
   const path2 = join2(ensureKeysDir(), label + TOKEN_EXT);
@@ -4380,6 +4374,12 @@ function buildAdapter(dbPath, options) {
   return new SQLiteAdapter(sqlitePath, adapterOpts);
 }
 var NOT_DELETED2 = "(deleted_at IS NULL OR deleted_at = '')";
+function rowAclVisibleExists(teamExpr, tableExpr, pkExpr) {
+  return `EXISTS (SELECT 1 FROM "__lattice_row_acl" la WHERE la."team_id" = ${teamExpr} AND la."table_name" = ${tableExpr} AND la."pk" = ${pkExpr} AND (la."owner_user_id" = ? OR la."visibility" = 'everyone' OR (la."visibility" = 'custom' AND EXISTS (SELECT 1 FROM "__lattice_row_grants" lg WHERE lg."team_id" = la."team_id" AND lg."table_name" = la."table_name" AND lg."pk" = la."pk" AND lg."grantee_user_id" = ?))))`;
+}
+function rowAclAbsent(teamExpr, tableExpr, pkExpr) {
+  return `NOT EXISTS (SELECT 1 FROM "__lattice_row_acl" la2 WHERE la2."team_id" = ${teamExpr} AND la2."table_name" = ${tableExpr} AND la2."pk" = ${pkExpr})`;
+}
 var Lattice = class _Lattice {
   _adapter;
   _changelogService;
@@ -5479,6 +5479,131 @@ var Lattice = class _Lattice {
     const rows = await allAsyncOrSync(this._adapter, sql, params);
     return this._decryptRows(table, rows);
   }
+  /**
+   * Row-level-security list read for Lattice Teams (2.2). Returns only the
+   * rows of `table` that `userId` may see in team `teamId`, evaluated
+   * entirely in SQL (indexed, bounded — never "load every row then filter
+   * in JS"). A row is visible iff it has a `__lattice_row_acl` entry owned by
+   * the user or marked 'everyone', or a 'custom' entry with a matching
+   * `__lattice_row_grants` row, OR it has no ACL entry at all and the caller
+   * passes `noAclVisible` (the table default is 'everyone', or the user owns
+   * the table — the pre-2.2 / never-narrowed case). Soft-deleted rows are
+   * excluded by default; results reuse the same decrypt path as `query()`.
+   *
+   * The ACL predicate joins on the table's primary-key column cast to TEXT
+   * (ACL pks are stored as TEXT), so it is correct regardless of the user
+   * table's pk type and works on both SQLite and Postgres. The teams layer's
+   * `listVisibleRows` (src/teams/row-access.ts) is the intended caller.
+   */
+  async queryVisible(table, opts) {
+    const notInit = this._notInitError();
+    if (notInit) return notInit;
+    this._assertIdent(table);
+    if (opts.orderBy) this._assertIdent(table, opts.orderBy);
+    const cols = this._ensureColumnCache(table);
+    const pkCol = this._schema.getPrimaryKey(table)[0] ?? "id";
+    let softDelete = "";
+    if (cols.has("deleted_at") && opts.deleted !== "any") {
+      softDelete = opts.deleted === "only" ? `t."deleted_at" IS NOT NULL AND ` : `t."deleted_at" IS NULL AND `;
+    }
+    const pkExpr = `CAST(t."${pkCol}" AS TEXT)`;
+    let sql = `SELECT t.* FROM "${table}" t WHERE ${softDelete}(${rowAclVisibleExists("?", "?", pkExpr)}`;
+    const params = [opts.teamId, table, opts.userId, opts.userId];
+    if (opts.noAclVisible) {
+      sql += ` OR ${rowAclAbsent("?", "?", pkExpr)}`;
+      params.push(opts.teamId, table);
+    }
+    sql += `)`;
+    if (opts.orderBy && cols.has(opts.orderBy)) {
+      const dir = opts.orderDir === "desc" ? "DESC" : "ASC";
+      sql += ` ORDER BY t."${opts.orderBy}" ${dir}`;
+    }
+    if (opts.limit !== void 0 && Number.isFinite(opts.limit)) {
+      sql += ` LIMIT ${Math.trunc(opts.limit).toString()}`;
+    }
+    if (opts.offset !== void 0 && Number.isFinite(opts.offset)) {
+      if (opts.limit === void 0 && this.getDialect() === "sqlite") sql += " LIMIT -1";
+      sql += ` OFFSET ${Math.trunc(opts.offset).toString()}`;
+    }
+    const rows = await allAsyncOrSync(this._adapter, sql, params);
+    return this._decryptRows(table, rows);
+  }
+  /**
+   * Visible-row counts for MANY tables in a single round-trip, using the same
+   * ACL predicate as {@link queryVisible} — so dashboard tiles agree with what
+   * the rows view lists and a physical count never reveals the existence or
+   * volume of rows the user can't see. One aggregated
+   * `SELECT (SELECT COUNT(*) …) AS c0, …` statement (no per-table fan-out, so
+   * a session pooler with few slots survives concurrent refreshes), capped at
+   * 50 tables per pass; overflow is logged and skipped (no silent truncation)
+   * and those tables count as absent — the caller renders "—". Soft-deleted
+   * rows are excluded wherever the table carries `deleted_at`, matching the
+   * default rows view.
+   */
+  async countVisibleMany(specs, opts) {
+    const out = /* @__PURE__ */ new Map();
+    const notInit = this._notInitError();
+    if (notInit) return notInit;
+    if (specs.length === 0) return out;
+    const VISIBLE_COUNT_CAP = 50;
+    let bounded = specs;
+    if (bounded.length > VISIBLE_COUNT_CAP) {
+      const dropped = bounded.length - VISIBLE_COUNT_CAP;
+      console.warn(
+        `[lattice] visible-count pass capped at ${String(VISIBLE_COUNT_CAP)} tables; ${String(dropped)} table(s) report no count this pass`
+      );
+      bounded = bounded.slice(0, VISIBLE_COUNT_CAP);
+    }
+    const selects = [];
+    const params = [];
+    for (const [i, spec] of bounded.entries()) {
+      this._assertIdent(spec.table);
+      const cols = this._ensureColumnCache(spec.table);
+      const pkCol = this._schema.getPrimaryKey(spec.table)[0] ?? "id";
+      const softDelete = cols.has("deleted_at") ? `t."deleted_at" IS NULL AND ` : "";
+      const pkExpr = `CAST(t."${pkCol}" AS TEXT)`;
+      let predicate = rowAclVisibleExists("?", "?", pkExpr);
+      params.push(opts.teamId, spec.table, opts.userId, opts.userId);
+      if (spec.noAclVisible) {
+        predicate += ` OR ${rowAclAbsent("?", "?", pkExpr)}`;
+        params.push(opts.teamId, spec.table);
+      }
+      selects.push(
+        `(SELECT COUNT(*) FROM "${spec.table}" t WHERE ${softDelete}(${predicate})) AS c${String(i)}`
+      );
+    }
+    const row = await getAsyncOrSync(this._adapter, `SELECT ${selects.join(", ")}`, params);
+    if (!row) return out;
+    for (const [i, spec] of bounded.entries()) {
+      const raw = row[`c${String(i)}`];
+      const n = typeof raw === "bigint" ? Number(raw) : Number(raw);
+      if (Number.isFinite(n) && n >= 0) out.set(spec.table, n);
+    }
+    return out;
+  }
+  /**
+   * Hosted-sync change-log pull, filtered per recipient for 2.2 row-level
+   * security (the hosted server's sole enforcement mechanism). Returns
+   * `__lattice_change_log` rows with seq > `since` for team `teamId` that
+   * `userId` is permitted to receive:
+   *   - targeted envelopes (`recipient_user_id = userId`), plus
+   *   - broadcast envelopes (`recipient_user_id IS NULL`) that are either
+   *     table-level (`pk IS NULL` — schema / unshare, delivered to all) or
+   *     whose row is currently visible to the user via `__lattice_row_acl` /
+   *     `__lattice_row_grants` (or has no ACL entry and the table defaults to
+   *     'everyone').
+   * Ordered by seq, capped at `limit`. Raw SQL because the predicate needs
+   * OR / EXISTS that the `query()` API can't express; bounded by the seq
+   * window and indexed ACL point-lookups. Mirrors {@link queryVisible}'s
+   * visibility logic so a member never pulls the bytes of a row they can't see.
+   */
+  async listChangesForRecipient(teamId, since, userId, limit) {
+    const notInit = this._notInitError();
+    if (notInit) return notInit;
+    const sql = `SELECT cl.* FROM "__lattice_change_log" cl WHERE cl."team_id" = ? AND cl."seq" > ? AND (cl."recipient_user_id" = ? OR (cl."recipient_user_id" IS NULL AND (cl."pk" IS NULL OR ${rowAclVisibleExists('cl."team_id"', 'cl."table_name"', 'cl."pk"')} OR (${rowAclAbsent('cl."team_id"', 'cl."table_name"', 'cl."pk"')} AND EXISTS (SELECT 1 FROM "__lattice_shared_objects" so WHERE so."team_id" = cl."team_id" AND so."table_name" = cl."table_name" AND so."deleted_at" IS NULL AND so."default_row_visibility" = 'everyone'))))) ORDER BY cl."seq" ASC LIMIT ${Math.trunc(limit).toString()}`;
+    const params = [teamId, since, userId, userId, userId];
+    return allAsyncOrSync(this._adapter, sql, params);
+  }
   async count(table, opts = {}) {
     const notInit = this._notInitError();
     if (notInit) return notInit;
@@ -7086,6 +7211,8 @@ var css = `
     }
     a.chip-link { cursor: pointer; }
     a.chip-link:hover { background: var(--accent); color: white; }
+    /* Inline object-reference pills the assistant emits \u2014 render flush in prose. */
+    a.lattice-ref { text-decoration: none; vertical-align: baseline; }
     .empty-row td {
       color: var(--text-muted); font-style: italic; text-align: center;
       padding: 24px;
@@ -7351,7 +7478,7 @@ var css = `
     .view-header .actions { margin-left: auto; display: flex; gap: 8px; }
 
     /* Row delete / restore controls */
-    .row-actions { width: 64px; text-align: center; white-space: nowrap; }
+    .row-actions { width: 88px; text-align: center; white-space: nowrap; }
     .row-delete, .row-restore {
       background: transparent; border: none; color: var(--text-muted);
       font-size: 16px; cursor: pointer; padding: 4px 6px;
@@ -7362,6 +7489,43 @@ var css = `
     .row-restore:hover { background: var(--accent-soft); color: var(--accent); }
     tr.row-deleted td { background: rgba(251, 146, 60, 0.08); color: var(--text-muted); }
     tr.row-deleted:hover td { background: #fcf5e3; }
+    /* Per-row visibility indicator (2.2). Reuses the team share colour
+       language \u2014 yellow (#eab308) = visible to everyone, red (#ef4444) =
+       private \u2014 matching the .sw-shared / .sw-private swatches. Owner =
+       interactive toggle; non-owner = faded + inert (status only). */
+    .row-vis {
+      background: transparent; border: none; padding: 4px 6px; border-radius: 4px;
+      font-size: 14px; line-height: 1; cursor: pointer; text-decoration: none;
+      color: #eab308;
+    }
+    .row-vis:hover { filter: brightness(1.18); }
+    .row-vis-private { color: #ef4444; }
+    .row-vis-disabled { cursor: default; pointer-events: none; opacity: 0.45; }
+    /* Grants checklist (detail view, owner-only): who can see a
+       shared-with-specific-people row. Checkboxes post straight to the
+       row-grant endpoints. */
+    .grants-panel {
+      margin: 4px 0 10px; padding: 10px 12px; max-width: 420px;
+      border: 1px solid var(--border); border-radius: 6px; background: var(--surface-2);
+      font-size: 13px;
+    }
+    .grants-panel .grants-title { font-weight: 600; margin-bottom: 6px; }
+    .grants-panel .grants-row { display: flex; align-items: center; gap: 8px; padding: 3px 0; cursor: pointer; }
+    .grants-panel .grants-row input { accent-color: var(--accent); }
+    /* Deprecation banner: shown when the workspace holds a grandfathered
+       direct database cloud connection (no row-level security). Amber so
+       it reads as a warning, not an error. */
+    .deprecation-banner {
+      display: flex; align-items: center; gap: 12px;
+      padding: 8px 16px; font-size: 13px;
+      background: rgba(234, 179, 8, 0.12); color: var(--text);
+      border-bottom: 1px solid rgba(234, 179, 8, 0.45);
+    }
+    .deprecation-banner button {
+      margin-left: auto; background: transparent; border: none; cursor: pointer;
+      color: var(--text-muted); font-size: 13px; padding: 2px 6px; border-radius: 4px;
+    }
+    .deprecation-banner button:hover { background: rgba(234, 179, 8, 0.18); }
 
     /* Inline create-row at the bottom of every table */
     tr.create-row td { background: var(--surface-2); }
@@ -7812,20 +7976,9 @@ var css = `
       padding: 8px; margin: 0 0 8px; overflow-x: auto;
     }
     .chat-bubble.assistant pre code { background: none; border: none; padding: 0; white-space: pre; }
-    .chat-tools { display: flex; flex-wrap: wrap; gap: 4px; margin-bottom: 4px; }
-    .tool-pill {
-      display: inline-flex; align-items: center; gap: 5px;
-      border-radius: 999px; padding: 2px 9px; font-size: 11px; font-weight: 500;
-      background: var(--accent-soft); color: var(--accent);
-      box-shadow: var(--glow-accent-soft);
-    }
-    .tool-pill.done { background: var(--surface-2); color: var(--text-muted); box-shadow: none; }
-    .tool-pill.error { background: rgba(251,146,60,0.14); color: var(--warn); box-shadow: none; }
-    .tool-pill .spin { display: inline-block; width: 9px; height: 9px;
-      border: 1.5px solid currentColor; border-top-color: transparent; border-radius: 50%;
-      animation: pillspin 0.7s linear infinite; }
-    @keyframes pillspin { to { transform: rotate(360deg); } }
-    /* Typing indicator: three pulsing dots shown in an assistant bubble while
+    /* The assistant's data changes render as activity-feed cards (.feed-item) in
+       the rail \u2014 there is no separate inline pill style. Reads emit no card.
+       Typing indicator: three pulsing dots shown in an assistant bubble while
        the model is generating (before the first text delta of a turn). */
     .chat-typing { display: inline-flex; align-items: center; gap: 4px; padding: 1px 0; }
     .chat-typing i {
@@ -7963,6 +8116,13 @@ var appJs = `
       return !!(t && t[colName] && t[colName].secret);
     }
     var SECRET_MASK = '\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022'; // \u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022
+    // An encrypted-at-rest value (native secrets etc.) is stored with an "enc:"
+    // sentinel prefix (see framework/native-entities decrypt). It is never
+    // plaintext, so the GUI must never render the raw ciphertext \u2014 mask it the
+    // same way an operator-flagged secret column is masked.
+    function looksEncrypted(v) {
+      return typeof v === 'string' && v.slice(0, 4) === 'enc:';
+    }
 
     function displayFor(name) {
       var override = state.iconOverrides[name];
@@ -8794,9 +8954,16 @@ var appJs = `
                 headers: { 'content-type': 'application/json' },
                 body: JSON.stringify({ id: id }),
               }).then(function () {
-                menu.hidden = true;
+                // Keep the menu OPEN with the item's spinner through the reload \u2014
+                // for a CLOUD workspace the slow part (connecting + fetching
+                // against the remote DB) happens here in reloadEverything, AFTER
+                // the switch POST. Hiding the menu now (the old behavior) hid the
+                // only progress signal, so a cloud switch looked unresponsive.
+                // renderWsSwitcher (inside reloadEverything) only re-binds the
+                // toggle + updates the label, so the spinning item survives.
                 return reloadEverything();
               }).then(function () {
+                menu.hidden = true;
                 // Conversations + activity both live in the workspace DB. Drop
                 // the old workspace's thread + activity cards, reconnect the feed
                 // to THIS workspace, and reload its thread list (+ latest convo).
@@ -8805,7 +8972,7 @@ var appJs = `
                 startFeed();
                 refreshThreadList(true);
                 showToast('Switched workspace', {});
-              }).catch(function (err) { showToast('Switch failed: ' + err.message, {}); });
+              }).catch(function (err) { menu.hidden = true; showToast('Switch failed: ' + err.message, {}); });
             });
           });
         });
@@ -8849,6 +9016,27 @@ var appJs = `
 
     window.addEventListener('hashchange', renderRoute);
 
+    // Deprecation banner: a grandfathered direct database cloud connection
+    // bypasses the hosted server's row security entirely \u2014 say so up front.
+    // Dismiss hides it for this browser session only.
+    function initDeprecationBanner() {
+      if (sessionStorage.getItem('lattice-direct-banner-dismissed')) return;
+      fetchJson('/api/dbconfig').then(function (d) {
+        if (!d || !d.directCloud) return;
+        var banner = document.getElementById('deprecation-banner');
+        var text = document.getElementById('deprecation-banner-text');
+        if (!banner || !text) return;
+        text.textContent = "Direct database cloud connections are deprecated and don't support row-level security. Migrate to a hosted workspace.";
+        banner.hidden = false;
+        var dismiss = document.getElementById('deprecation-banner-dismiss');
+        if (dismiss) dismiss.addEventListener('click', function () {
+          banner.hidden = true;
+          sessionStorage.setItem('lattice-direct-banner-dismissed', '1');
+        });
+      }).catch(function () { /* dbconfig unavailable (e.g. team-cloud server mode) \u2014 no banner */ });
+    }
+    initDeprecationBanner();
+
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
     // Sidebar
     // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
@@ -9204,13 +9392,38 @@ var appJs = `
           .map(function (h) { return '<th>' + escapeHtml(h) + '</th>'; }).join('');
         headers += '<th class="row-actions"></th>';
 
+        // Per-row visibility indicator (2.2 row-level permissions). Reads the
+        // server-attached _access summary (team clouds only); absent yields ''.
+        // U+25C9 = everyone (yellow) / private (red, by colour); U+25CE =
+        // custom (shared with specific people). Owner = interactive toggle;
+        // non-owner = faded + inert status.
+        function rowVisMarkup(tbl, r) {
+          var a = r._access;
+          if (!a) return '';
+          var vis = a.visibility;
+          var glyph = vis === 'custom' ? '\u25CE' : '\u25C9';
+          if (!a.ownedByMe) {
+            var seen = vis === 'custom' ? 'Shared with you' : 'Visible to everyone';
+            return '<span class="row-vis row-vis-disabled" title="' + escapeHtml(seen) + '">' + glyph + '</span>';
+          }
+          if (vis === 'custom') {
+            return '<a class="row-vis" href="#/objects/' + encodeURIComponent(tbl) + '/' + encodeURIComponent(r.id) +
+              '" title="Shared with specific people \u2014 open to manage">' + glyph + '</a>';
+          }
+          var cls = vis === 'private' ? 'row-vis row-vis-private' : 'row-vis';
+          var title = vis === 'everyone'
+            ? 'Visible to everyone \u2014 click to make private'
+            : 'Private to you \u2014 click to share with everyone';
+          return '<button class="' + cls + '" data-vis-toggle="' + escapeHtml(r.id) +
+            '" data-vis-cur="' + vis + '" title="' + escapeHtml(title) + '">' + glyph + '</button>';
+        }
         var bodyRows;
         if (rows.length === 0) {
           bodyRows = '';
         } else {
           bodyRows = rows.map(function (r) {
             var tds = intrinsic.map(function (c) {
-              if (isSecretColumn(tableName, c) && r[c] != null && r[c] !== '') {
+              if ((isSecretColumn(tableName, c) || looksEncrypted(r[c])) && r[c] != null && r[c] !== '') {
                 return '<td class="muted">' + SECRET_MASK + '</td>';
               }
               return '<td><div class="cell-clip">' + escapeHtml(truncate(r[c], 120)) + '</div></td>';
@@ -9234,7 +9447,8 @@ var appJs = `
                 '<button class="row-delete" title="Delete permanently" data-hard-del="' + escapeHtml(r.id) + '">\u2715</button>' +
                 '</td>');
             } else {
-              tds.push('<td class="row-actions"><button class="row-delete" title="Delete" data-del="' + escapeHtml(r.id) + '">\u2715</button></td>');
+              tds.push('<td class="row-actions">' + rowVisMarkup(tableName, r) +
+                '<button class="row-delete" title="Delete" data-del="' + escapeHtml(r.id) + '">\u2715</button></td>');
             }
             return '<tr data-id="' + escapeHtml(r.id) + '"' + (viewMode === 'trash' ? ' class="row-deleted"' : '') + '>' + tds.join('') + '</tr>';
           }).join('');
@@ -9343,6 +9557,30 @@ var appJs = `
           });
         });
 
+        content.querySelectorAll('button[data-vis-toggle]').forEach(function (btn) {
+          btn.addEventListener('click', function (e) {
+            e.stopPropagation();
+            var id = btn.getAttribute('data-vis-toggle');
+            var cur = btn.getAttribute('data-vis-cur');
+            var next = cur === 'everyone' ? 'private' : 'everyone';
+            withBusy(btn, function () {
+              return fetchJson('/api/tables/' + encodeURIComponent(tableName) + '/rows/' + encodeURIComponent(id) + '/visibility', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ visibility: next }),
+              }).then(function () {
+                invalidate(tableName);
+                return refreshEntities();
+              }).then(function () {
+                renderTable(content, tableName);
+                showToast(next === 'everyone' ? 'Row shared with everyone' : 'Row made private', {});
+              }).catch(function (err) {
+                showToast('Visibility update failed: ' + err.message, {});
+              });
+            });
+          });
+        });
+
         content.querySelectorAll('tr[data-id]').forEach(function (tr) {
           tr.addEventListener('click', function (e) {
             // Let chip-link anchors and the delete button handle their own click.
@@ -9469,6 +9707,39 @@ var appJs = `
       });
     }
 
+    // Detail-view row visibility line (2.2). Owner: status + everyone/private
+    // toggle + a "Specific people\u2026" / "Manage access" control that opens the
+    // grants checklist (the table view's "open to manage" affordance lands
+    // here). Non-owner: read-only status.
+    function detailVisLineEl(row) {
+      var a = row._access;
+      if (!a) return '';
+      var vis = a.visibility;
+      var labelMap = { everyone: 'Visible to everyone', private: 'Private to you', custom: 'Shared with specific people' };
+      if (!a.ownedByMe) {
+        var seen = vis === 'custom' ? 'Shared with you' : (labelMap[vis] || '');
+        return '<div class="detail-vis muted" style="margin:6px 0;font-size:13px">' + escapeHtml(seen) + '</div>';
+      }
+      var info = labelMap[vis] || '';
+      if (vis === 'custom' && a.grantees) info += ' (' + a.grantees.length + ')';
+      var buttons;
+      if (vis === 'custom') {
+        // Leaving custom stops the grant list from applying \u2014 the toggle
+        // handler asks for confirmation. The grants themselves are kept
+        // server-side, so reopening "Manage access" restores the list.
+        buttons = '<button class="btn" id="detail-vis-manage">Manage access</button>' +
+          '<button class="btn" id="detail-vis-toggle" data-vis-cur="custom" data-vis-next="everyone">Share with everyone</button>';
+      } else {
+        var btnLabel = vis === 'everyone' ? 'Make private' : 'Share with everyone';
+        var next = vis === 'everyone' ? 'private' : 'everyone';
+        buttons = '<button class="btn" id="detail-vis-toggle" data-vis-cur="' + vis + '" data-vis-next="' + next + '">' + btnLabel + '</button>' +
+          '<button class="btn" id="detail-vis-manage">Specific people\u2026</button>';
+      }
+      return '<div class="detail-vis" style="display:flex;align-items:center;gap:8px;margin:6px 0;font-size:13px;flex-wrap:wrap">' +
+        '<span class="muted" id="detail-vis-info">' + escapeHtml(info) + '</span>' + buttons +
+        '</div>' +
+        '<div class="grants-panel" id="grants-panel" hidden></div>';
+    }
     function renderDetail(content, tableName, id) {
       var t = tableByName(tableName);
       if (!t) {
@@ -9495,7 +9766,7 @@ var appJs = `
         function paint(editing) {
           var rows = [];
           intrinsic.forEach(function (c) {
-            var secret = isSecretColumn(tableName, c);
+            var secret = isSecretColumn(tableName, c) || looksEncrypted(row[c]);
             var dd;
             if (editing) {
               dd = fieldFor(c, row[c], t);
@@ -9567,6 +9838,7 @@ var appJs = `
               '<h1>' + escapeHtml(displayNameFor(row) || d.label) + '</h1>' +
               '<div class="actions">' + actions + '</div>' +
             '</div>' +
+            detailVisLineEl(row) +
             lastEditedLineEl(tableName, id) +
             (tableName === 'files' ? '<div class="file-preview" id="file-preview"></div>' : '') +
             '<div class="detail"><dl class="' + (editing ? 'editing' : '') + '">' + rows.join('') + '</dl></div>' +
@@ -9579,6 +9851,93 @@ var appJs = `
           if (!editing) loadRowContext(tableName, id);
           if (!editing && tableName === 'files') renderFilePreview(row);
 
+          function postVisibility(next) {
+            return fetchJson('/api/tables/' + encodeURIComponent(tableName) + '/rows/' + encodeURIComponent(id) + '/visibility', {
+              method: 'POST',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ visibility: next }),
+            });
+          }
+          var detailVisBtn = content.querySelector('#detail-vis-toggle');
+          if (detailVisBtn) detailVisBtn.addEventListener('click', function () {
+            var cur = detailVisBtn.getAttribute('data-vis-cur');
+            var next = detailVisBtn.getAttribute('data-vis-next') || (cur === 'everyone' ? 'private' : 'everyone');
+            if (cur === 'custom') {
+              // Non-destructive guard: the grant rows survive server-side, but
+              // the custom list stops applying the moment visibility changes.
+              var cnt = (row._access && row._access.grantees ? row._access.grantees.length : 0);
+              var who = cnt === 1 ? '1 specific person' : cnt + ' specific people';
+              if (!confirm('This row is shared with ' + who + '. The custom list will stop applying (it is kept and reapplies if you return to specific people). Continue?')) return;
+            }
+            withBusy(detailVisBtn, function () {
+              return postVisibility(next).then(function () {
+                invalidate(tableName);
+                renderDetail(content, tableName, id);
+                showToast(next === 'everyone' ? 'Shared with everyone' : 'Made private', {});
+              }).catch(function (e) { showToast('Visibility update failed: ' + e.message, {}); });
+            });
+          });
+
+          // Grants checklist ("Specific people\u2026" / "Manage access"): member
+          // checkboxes wired to the row-grant endpoints. Opening it on a
+          // non-custom row first narrows visibility to custom so an empty
+          // checklist is a coherent state (owner-only until people are added).
+          var detailVisManage = content.querySelector('#detail-vis-manage');
+          if (detailVisManage) detailVisManage.addEventListener('click', function () {
+            var panel = content.querySelector('#grants-panel');
+            if (!panel) return;
+            if (!panel.hidden) { panel.hidden = true; return; }
+            var access = row._access || {};
+            var ensure = access.visibility === 'custom'
+              ? Promise.resolve()
+              : postVisibility('custom').then(function () { access.visibility = 'custom'; });
+            withBusy(detailVisManage, function () {
+              return ensure.then(function () {
+                return fetchJson('/api/team/users');
+              }).then(function (d) {
+                var users = ((d && d.users) || []).filter(function (u) { return u.id !== access.owner_user_id; });
+                var granted = {};
+                (access.grantees || []).forEach(function (g) { granted[g] = true; });
+                if (users.length === 0) {
+                  panel.innerHTML = '<div class="muted">No other members in this workspace yet.</div>';
+                } else {
+                  panel.innerHTML = '<div class="grants-title">Who can see this</div>' + users.map(function (u) {
+                    var label = u.name || u.email || u.id;
+                    return '<label class="grants-row"><input type="checkbox" data-grant-user="' + escapeHtml(u.id) + '"' +
+                      (granted[u.id] ? ' checked' : '') + '> ' + escapeHtml(label) + '</label>';
+                  }).join('');
+                }
+                panel.hidden = false;
+                panel.querySelectorAll('[data-grant-user]').forEach(function (cb) {
+                  cb.addEventListener('change', function () {
+                    var uid = cb.getAttribute('data-grant-user');
+                    var base = '/api/tables/' + encodeURIComponent(tableName) + '/rows/' + encodeURIComponent(id) + '/grants';
+                    var req = cb.checked
+                      ? fetchJson(base, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ user_id: uid }) })
+                      : fetchJson(base + '/' + encodeURIComponent(uid), { method: 'DELETE' });
+                    cb.disabled = true;
+                    req.then(function () {
+                      var list = access.grantees || (access.grantees = []);
+                      var at = list.indexOf(uid);
+                      if (cb.checked && at === -1) list.push(uid);
+                      if (!cb.checked && at !== -1) list.splice(at, 1);
+                      var infoEl = content.querySelector('#detail-vis-info');
+                      if (infoEl) infoEl.textContent = 'Shared with specific people (' + list.length + ')';
+                      invalidate(tableName);
+                    }).catch(function (e) {
+                      cb.checked = !cb.checked; // revert the failed change
+                      showToast('Access update failed: ' + e.message, {});
+                    }).then(function () { cb.disabled = false; });
+                  });
+                });
+                if (access.visibility === 'custom') {
+                  var infoEl = content.querySelector('#detail-vis-info');
+                  if (infoEl) infoEl.textContent = 'Shared with specific people (' + (access.grantees || []).length + ')';
+                }
+              }).catch(function (e) { showToast('Could not load members: ' + e.message, {}); });
+            });
+          });
+
           // Junction link/unlink handlers (active in both read and edit modes).
           content.querySelectorAll('.remove-link').forEach(function (btn) {
             btn.addEventListener('click', function (e) {
@@ -9863,7 +10222,7 @@ var appJs = `
     function fsValInner(table, row, col) {
       var raw = row[col];
       if (raw == null || raw === '') return '<span class="fs-empty-val">\u2014</span>';
-      if (isSecretColumn(table, col)) return '<span class="muted">' + SECRET_MASK + '</span>';
+      if (isSecretColumn(table, col) || looksEncrypted(raw)) return '<span class="muted">' + SECRET_MASK + '</span>';
       var s = String(raw);
       if (FS_LONGFORM.indexOf(col) >= 0 || s.indexOf('\\n') >= 0) {
         return '<div class="md-body">' + mdToHtml(s.slice(0, 40000)) + '</div>';
@@ -11008,6 +11367,18 @@ var appJs = `
             '</span>' +
           '</div>'
         : '';
+      // Owner-only "new rows default to" control, shown for a shared table.
+      var defaultVis = (t && t.defaultRowVisibility) || 'private';
+      var defaultVisRow = canShare && isShared
+        ? '<label>New rows default to</label>' +
+          '<div style="display:flex;align-items:center;gap:8px;flex-wrap:wrap">' +
+            '<select id="dm-rowvis-select">' +
+              '<option value="private"' + (defaultVis === 'private' ? ' selected' : '') + '>Private (owner only)</option>' +
+              '<option value="everyone"' + (defaultVis === 'everyone' ? ' selected' : '') + '>Everyone on the workspace</option>' +
+            '</select>' +
+            '<span style="font-size:12px;color:var(--text-muted)">Visibility new rows in this table are created with.</span>' +
+          '</div>'
+        : '';
       panel.innerHTML =
         '<h3>' + d.icon + ' ' + escapeHtml(d.label) + '</h3>' +
         '<div class="dm-edit-grid">' +
@@ -11022,6 +11393,7 @@ var appJs = `
             '<button class="btn" id="dm-icon-btn" style="margin-top:6px;">Save</button>' +
           '</div>' +
           shareRow +
+          defaultVisRow +
           '<label>Columns</label>' +
           '<div>' +
             '<div class="dm-cols">' + (columnsHtml || '<span class="muted">No columns</span>') + '</div>' +
@@ -11073,6 +11445,22 @@ var appJs = `
           }).catch(function (e) { showToast('Share update failed: ' + e.message, {}); });
         });
       });
+
+      var rowvisSelect = panel.querySelector('#dm-rowvis-select');
+      if (rowvisSelect) rowvisSelect.addEventListener('change', function () {
+        var next = rowvisSelect.value;
+        withBusy(rowvisSelect, function () {
+          return fetchJson('/api/schema/entities/' + encodeURIComponent(tableName) + '/default-row-visibility', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ visibility: next }),
+          }).then(function () {
+            return dmRefreshPanel(tableName, false);
+          }).then(function () {
+            showToast(next === 'everyone' ? 'New rows now default to everyone' : 'New rows now default to private', {});
+          }).catch(function (e) { showToast('Default visibility update failed: ' + e.message, {}); });
+        });
+      });
     }
 
     /**
@@ -11760,6 +12148,7 @@ var appJs = `
       // enters per-DB things (cloud URL + DB name) in this modal.
       fetchJson('/api/userconfig/identity').then(function (id) {
         var bodyHtml =
+          '<p style="font-size:12px;color:#ef4444;margin:0 0 8px">Direct postgres:// connections are deprecated and do not enforce row-level permissions \u2014 use a hosted Lattice Teams URL (https://\u2026) instead.</p>' +
           '<div class="field"><label>Cloud URL</label>' +
             '<input name="cloud_url" placeholder="postgres://postgres.&lt;ref&gt;:password@aws-x-region.pooler.supabase.com:5432/postgres" autocapitalize="off" autocorrect="off" spellcheck="false" />' +
           '</div>' +
@@ -11787,6 +12176,7 @@ var appJs = `
     function showJoinTeamModal(kind) {
       fetchJson('/api/userconfig/identity').then(function (id) {
         var bodyHtml =
+          '<p style="font-size:12px;color:#ef4444;margin:0 0 8px">Direct postgres:// connections are deprecated and do not enforce row-level permissions \u2014 use a hosted Lattice Teams URL (https://\u2026) instead.</p>' +
           '<div class="field"><label>Cloud URL</label>' +
             '<input name="cloud_url" placeholder="postgres://postgres.&lt;ref&gt;:password@aws-x-region.pooler.supabase.com:5432/postgres" autocapitalize="off" autocorrect="off" spellcheck="false" />' +
           '</div>' +
@@ -11865,20 +12255,29 @@ var appJs = `
             '</div>' +
           '</div>';
         }
+        // Only the selected provider's key input is shown (declutter). 'auto'
+        // ("Select provider\u2026") shows no key row until a provider is chosen.
+        function voiceRowHtml(provider) {
+          if (provider === 'openai') {
+            return rowHtml('asst-openai', 'OpenAI Whisper key', !!cfg.hasOpenaiKey, 'sk-\u2026');
+          }
+          if (provider === 'elevenlabs') {
+            return rowHtml('asst-elevenlabs', 'ElevenLabs key', !!cfg.hasElevenlabsKey, 'xi-\u2026');
+          }
+          return '';
+        }
         host.innerHTML =
           '<div class="dbconfig-panel" style="margin-bottom:18px;padding:14px;border:1px solid var(--border);border-radius:8px;background:var(--surface)">' +
             '<h3 style="margin:0 0 10px">Assistant</h3>' +
             '<p class="lead" style="margin:0 0 12px;font-size:12px;color:var(--text-muted)">' +
-              'Keys are stored encrypted in the <code>secrets</code> table \u2014 never shown again once ' +
-              'saved. Environment variables (<code>ANTHROPIC_API_KEY</code>, <code>OPENAI_API_KEY</code>, ' +
-              '<code>ELEVENLABS_API_KEY</code>) also work.' +
+              'Keys are stored encrypted in the <code>secrets</code> table.' +
             '</p>' +
             rowHtml('asst-anthropic', 'Claude API token (chat)', !!cfg.hasAnthropicKey, 'sk-ant-\u2026') +
-            '<div style="margin:0 0 12px;font-size:12px;color:var(--text-muted)">' +
-              (cfg.oauthEnabled
-                ? 'Or <a href="/api/assistant/oauth/start" style="color:var(--accent)">connect your Claude subscription</a>.'
-                : 'Subscription login: set the <code>ANTHROPIC_OAUTH_*</code> env vars to enable.') +
-            '</div>' +
+            (cfg.oauthEnabled
+              ? '<div style="margin:0 0 12px;font-size:12px;color:var(--text-muted)">' +
+                  'Or <a href="/api/assistant/oauth/start" style="color:var(--accent)">connect your Claude subscription</a>.' +
+                '</div>'
+              : '') +
             '<div style="margin:6px 0 12px">' +
               '<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:4px">' +
                 '<strong style="font-size:13px">Inference aggressiveness</strong>' +
@@ -11895,17 +12294,16 @@ var appJs = `
                 'auto-creates link tables) when you drop in files. Higher extrapolates more.' +
               '</p>' +
             '</div>' +
-            '<div style="font-size:11px;color:var(--text-muted);margin:10px 0 8px;text-transform:uppercase;letter-spacing:0.05em">Voice \u2014 speech to text (set either)</div>' +
-            rowHtml('asst-openai', 'OpenAI Whisper key', !!cfg.hasOpenaiKey, 'sk-\u2026') +
-            rowHtml('asst-elevenlabs', 'ElevenLabs key', !!cfg.hasElevenlabsKey, 'xi-\u2026') +
-            '<div style="margin:6px 0 2px;display:flex;align-items:center;gap:8px">' +
+            '<div style="font-size:11px;color:var(--text-muted);margin:10px 0 8px;text-transform:uppercase;letter-spacing:0.05em">Voice \u2014 speech to text</div>' +
+            '<div style="margin:6px 0 8px;display:flex;align-items:center;gap:8px">' +
               '<span style="font-size:12px;color:var(--text-muted)">Use for voice:</span>' +
               '<select id="asst-stt" style="background:var(--surface-2);color:var(--text);border:1px solid var(--border);border-radius:6px;font-size:12px;padding:3px 6px">' +
-                '<option value="auto">Auto</option>' +
-                '<option value="openai">OpenAI Whisper</option>' +
+                '<option value="auto">Select provider\u2026</option>' +
+                '<option value="openai">OpenAI</option>' +
                 '<option value="elevenlabs">ElevenLabs</option>' +
               '</select>' +
             '</div>' +
+            '<div id="asst-voice-key">' + voiceRowHtml(cfg.sttPreference || 'auto') + '</div>' +
             '<div id="assistant-msg" style="margin-top:4px;font-size:12px;color:var(--text-muted)"></div>' +
           '</div>';
         var msg = host.querySelector('#assistant-msg');
@@ -11935,12 +12333,18 @@ var appJs = `
           });
         }
         wire('asst-anthropic', 'anthropic');
-        wire('asst-openai', 'openai');
-        wire('asst-elevenlabs', 'elevenlabs');
         var sttSel = host.querySelector('#asst-stt');
+        var voiceKeyHost = host.querySelector('#asst-voice-key');
+        function wireVoiceKey(provider) {
+          if (provider === 'openai') wire('asst-openai', 'openai');
+          else if (provider === 'elevenlabs') wire('asst-elevenlabs', 'elevenlabs');
+        }
         if (sttSel) {
           sttSel.value = cfg.sttPreference || 'auto';
+          wireVoiceKey(sttSel.value);
           sttSel.addEventListener('change', function () {
+            if (voiceKeyHost) voiceKeyHost.innerHTML = voiceRowHtml(sttSel.value);
+            wireVoiceKey(sttSel.value);
             msg.textContent = 'Saving\u2026';
             fetch('/api/assistant/stt-provider', {
               method: 'PUT',
@@ -12331,9 +12735,10 @@ var appJs = `
 
     // State-machine Database panel (v1.13+). Renders a different body
     // per info.state: local -> Migrate / Connect-existing wizards;
-    // cloud-connected -> Upgrade-to-team; team-cloud-creator/member ->
-    // team management UI; team-cloud-needs-invite -> join form.
-    // Progression is one-way: local -> cloud -> team-cloud.
+    // team-cloud-creator/member -> connection details + members. A connected
+    // cloud workspace is always a member workspace (created or invited), so
+    // there is no in-settings "join via invite" \u2014 that lives in the Join
+    // Workspace flow only.
     function renderDatabasePanel(host) {
       fetchJson('/api/dbconfig').then(function (info) {
         var badge = renderStateBadge(info);
@@ -12369,10 +12774,6 @@ var appJs = `
           label = 'CLOUD \xB7 MEMBER';
           color = 'var(--accent)';
           break;
-        case 'team-cloud-needs-invite':
-          label = 'CLOUD \xB7 NEEDS INVITE';
-          color = 'var(--warn)';
-          break;
         default:
           label = String(info.state || 'UNKNOWN').toUpperCase();
       }
@@ -12408,21 +12809,6 @@ var appJs = `
           '<div id="db-members-host" style="margin-top:12px"><div style="font-size:12px;color:var(--text-muted)">Loading members\u2026</div></div>'
         );
       }
-      if (info.state === 'team-cloud-needs-invite') {
-        return (
-          renderConnectionSummary(info) +
-          '<p style="margin-top:10px;color:var(--warn);font-size:13px">' +
-            'Not a member of this cloud workspace yet \u2014 paste your invite token to join.' +
-          '</p>' +
-          '<div style="display:grid;grid-template-columns:1fr;gap:8px;margin-top:6px">' +
-            '<div><label class="field-label">Invite token</label>' +
-            '<textarea id="db-rejoin-token" placeholder="latinv_..." style="width:100%;height:54px;font-family:JetBrains Mono,monospace"></textarea></div>' +
-          '</div>' +
-          '<div class="team-actions" style="margin-top:10px">' +
-            '<button class="btn primary" data-act="rejoin-with-token">Join workspace \u2192</button>' +
-          '</div>'
-        );
-      }
       return '<p style="color:var(--text-muted)">Unknown database state.</p>';
     }
 
@@ -12494,32 +12880,6 @@ var appJs = `
         }).catch(function () { membersHost.innerHTML = '<div style="font-size:12px;color:var(--text-muted)">Members unavailable.</div>'; });
       }
 
-      var rejoinBtn = host.querySelector('[data-act="rejoin-with-token"]');
-      if (rejoinBtn) rejoinBtn.addEventListener('click', function () {
-        var token = (document.getElementById('db-rejoin-token').value || '').trim();
-        if (!token) { setMsg('Invite token required.', false); return; }
-        // Without form re-entry the credentials are already saved; we
-        // call the connect-existing endpoint with just the invite
-        // token. The handler reads credentials from db-credentials.enc
-        // via the active configPath's label.
-        setMsg('Joining workspace\u2026');
-        fetch('/api/dbconfig/connect-existing', {
-          method: 'POST', headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({
-            type: 'postgres',
-            label: info.label,
-            host: info.host, port: info.port, dbname: info.dbname,
-            user: info.user, password: '', // password lives in db-credentials.enc; backend will pull
-            invite_token: token,
-          }),
-        })
-          .then(function (r) { return r.json(); })
-          .then(function (d) {
-            if (d.error) { setMsg('Failed: ' + d.error, false); return; }
-            setMsg('Joined.', true); rerender();
-          })
-          .catch(function (e) { setMsg('Failed: ' + e.message, false); });
-      });
     }
 
     // \u2500\u2500 v1.13 wizards \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
@@ -12895,64 +13255,103 @@ var appJs = `
       insert: '\u2795', update: '\u270F\uFE0F', delete: '\u{1F5D1}',
       link: '\u{1F517}', unlink: '\u26D3', undo: '\u21B6', redo: '\u21B7', schema: '\u{1F6E0}',
     };
-    // Ops whose consecutive runs collapse into one counted bubble (bulk row work
-    // spams N near-identical rows otherwise). Schema/undo/redo stay distinct.
+    // Schema mutations reach the client in two shapes: the LIVE feed publishes the
+    // coarse op:'schema', while the persisted audit log / per-thread replay carry
+    // the fine-grained op:'schema.delete_entity' (etc.). Treat both as schema so
+    // they collapse + pick the \u{1F6E0} icon identically (regression: backfilled schema
+    // ops showed '\u2022' and never grouped).
+    function isSchemaOp(op) { var o = String(op || ''); return o === 'schema' || o.indexOf('schema.') === 0; }
+    function feedIcon(op) { return isSchemaOp(op) ? FEED_ICONS.schema : (FEED_ICONS[op] || '\u2022'); }
+    // Ops whose runs collapse into one counted bubble (bulk row work spams N
+    // near-identical rows otherwise). Undo/redo stay distinct.
     var GROUPABLE_OPS = { insert: 1, update: 1, delete: 1, link: 1, unlink: 1 };
-    // Active group bubbles keyed by op|table|source so a burst of identical
-    // events coalesces into ONE counted bubble even when other events interleave
-    // (a bulk ingest emits create/link/update across several tables at once \u2014
-    // consecutive-only grouping let those interleaved runs spam the feed). A
-    // group stays "open" for FEED_GROUP_WINDOW_MS after its last hit; later
+    var ROW_VERB = { insert: 'Added', update: 'Updated', delete: 'Removed', link: 'Linked', unlink: 'Unlinked' };
+    var ROW_PREP = { insert: 'to', update: 'in', delete: 'from', link: 'in', unlink: 'in' };
+    // Schema events all arrive as op:'schema'; the specific action lives only in
+    // the summary text. Map that text to a stable sub-action so a bulk run of
+    // "Deleted table X" collapses into one "Deleted 19 tables" pill. Each entry
+    // is [verb, singular, plural].
+    var SCHEMA_GROUP = {
+      'created-table':  ['Created', 'table', 'tables'],
+      'deleted-table':  ['Deleted', 'table', 'tables'],
+      'renamed-table':  ['Renamed', 'table', 'tables'],
+      'added-column':   ['Added', 'column', 'columns'],
+      'renamed-column': ['Renamed', 'column', 'columns'],
+      'added-link':     ['Added', 'link', 'links'],
+      'deleted-link':   ['Deleted', 'link', 'links'],
+      'created-link':   ['Created', 'link table', 'link tables'],
+    };
+    function schemaAction(summary) {
+      var s = String(summary || '');
+      if (/^Created link table/.test(s)) return 'created-link';
+      if (/^Created table/.test(s)) return 'created-table';
+      if (/^Deleted table/.test(s)) return 'deleted-table';
+      if (/^Renamed table/.test(s)) return 'renamed-table';
+      if (/^Added a column/.test(s)) return 'added-column';
+      if (/^Renamed a column/.test(s)) return 'renamed-column';
+      if (/^Added a link/.test(s)) return 'added-link';
+      if (/^Deleted a link/.test(s)) return 'deleted-link';
+      return null; // unknown schema op: keep it ungrouped (stay honest)
+    }
+    // Group identical-TYPE events into one counted pill regardless of which
+    // object they touched, so a bulk run (delete N tables, remove rows across M
+    // tables) shows a single bubble instead of overflowing the rail. Keyed by
+    // op+source (+schema sub-action); the table is intentionally NOT in the key.
+    // A group stays "open" for FEED_GROUP_WINDOW_MS after its last hit; later
     // activity starts a fresh bubble so unrelated edits aren't merged in.
-    var feedGroups = {}; // key -> { count, item, summaryEl, timeEl, last }
-    var FEED_GROUP_WINDOW_MS = 15000;
-    function groupedSummary(op, table, count) {
-      var t = String(table || '');
-      switch (op) {
-        case 'insert': return 'Added ' + count + ' rows to ' + t;
-        case 'update': return 'Updated ' + count + ' rows in ' + t;
-        case 'delete': return 'Removed ' + count + ' rows from ' + t;
-        case 'link': return 'Linked ' + count + ' rows in ' + t;
-        case 'unlink': return 'Unlinked ' + count + ' rows in ' + t;
-        default: return String(op || '') + ' ' + t;
+    function feedGroupKey(ev) {
+      var src = String(ev.source || '');
+      if (isSchemaOp(ev.op)) {
+        var a = schemaAction(ev.summary);
+        return a ? 'schema|' + a + '|' + src : null;
       }
+      return GROUPABLE_OPS[ev.op] ? String(ev.op) + '|' + src : null;
     }
-    function renderFeedItem(ev) {
-      var feedEl = document.getElementById('rail-feed');
-      if (!feedEl) return;
-      var empty = document.getElementById('rail-empty');
-      if (empty) empty.remove();
-      // Coalesce identical events (same op + table + source) into one counted
-      // bubble. Unlike the old consecutive-only rule, the bubble is found by key
-      // within a recency window, so interleaved bursts still merge instead of
-      // spamming a pill per event.
-      var groupKey = GROUPABLE_OPS[ev.op] && ev.table
-        ? String(ev.op) + '|' + String(ev.table) + '|' + String(ev.source || '')
-        : null;
-      var nowMs = Date.now();
-      if (groupKey) {
-        var g = feedGroups[groupKey];
-        if (g && g.item.parentNode === feedEl && (nowMs - g.last) < FEED_GROUP_WINDOW_MS) {
-          g.count += 1;
-          g.last = nowMs;
-          g.summaryEl.textContent = groupedSummary(ev.op, ev.table, g.count);
-          g.timeEl.textContent = relTime(ev.ts);
-          // A grouped bubble stands for many rows \u2014 disable the single-row click,
-          // and expose it to assistive tech as a live status, not a button.
-          g.item._rowClickOff = true;
-          g.item.classList.remove('feed-clickable');
-          g.item.removeAttribute('tabindex');
-          g.item.removeAttribute('title');
-          g.item.setAttribute('role', 'status');
-          feedEl.scrollTop = feedEl.scrollHeight;
-          return;
-        }
-      }
+    var feedGroups = {}; // key -> { op, count, tables, tableCount, schemaKey, firstSummary, item, summaryEl, timeEl, last, startMs, endMs, turnId }
+    var FEED_GROUP_WINDOW_MS = 15000;
+    // Assistant-turn scope for live activity-card grouping + duration. While a
+    // turn is active, its same-type events all collapse into one card (no window
+    // expiry); the card's timer measures from feedTurnStartMs to the last event.
+    var feedTurnId = 0;
+    var feedTurnActive = false;
+    var feedTurnStartMs = 0;
+    function onlyKey(obj) { for (var k in obj) { if (obj.hasOwnProperty(k)) return k; } return ''; }
+    function groupedRowSummary(op, count, tables, tableCount) {
+      var verb = ROW_VERB[op] || String(op || '');
+      var noun = count === 1 ? 'row' : 'rows';
+      var where = '';
+      if (tableCount > 1) { where = ' across ' + tableCount + ' tables'; }
+      else { var only = onlyKey(tables); if (only) where = ' ' + (ROW_PREP[op] || 'in') + ' ' + only; }
+      return verb + ' ' + count + ' ' + noun + where;
+    }
+    function schemaGroupSummary(schemaKey, count, firstSummary) {
+      var g = SCHEMA_GROUP[schemaKey];
+      if (count <= 1 || !g) return firstSummary || '';
+      return g[0] + ' ' + count + ' ' + g[2];
+    }
+    function groupedSummary(g) {
+      return isSchemaOp(g.op)
+        ? schemaGroupSummary(g.schemaKey, g.count, g.firstSummary)
+        : groupedRowSummary(g.op, g.count, g.tables, g.tableCount);
+    }
+    // While a chat turn is streaming, its typing bubble (the not-yet-arrived next
+    // assistant message) must stay last; tool-driven activity cards belong ABOVE
+    // it, not below \u2014 otherwise the "typing\u2026" dots land mid-conversation. Returns
+    // the .chat-msg to insert before, or null when nothing is streaming.
+    function feedTypingAnchor(feedEl) {
+      var typing = feedEl.querySelector('.chat-bubble[data-typing="1"]');
+      var msg = typing && typing.closest ? typing.closest('.chat-msg') : null;
+      return (msg && msg.parentNode === feedEl) ? msg : null;
+    }
+    // Build one activity card (the shared full-width pill shape). Used by BOTH
+    // the live feed and the per-thread replay so they look identical. Returns the
+    // element plus the summary/time nodes a group mutates in place.
+    function makeFeedCard(ev) {
       var item = document.createElement('div');
       item.className = 'feed-item';
       var icon = document.createElement('div');
       icon.className = 'feed-icon';
-      icon.textContent = FEED_ICONS[ev.op] || '\u2022';
+      icon.textContent = feedIcon(ev.op);
       var body = document.createElement('div');
       body.className = 'feed-body';
       var summary = document.createElement('div');
@@ -12968,11 +13367,13 @@ var appJs = `
       body.appendChild(meta);
       var time = document.createElement('div');
       time.className = 'feed-time';
-      time.textContent = relTime(ev.ts);
+      // Duration ("4s" / "4m 2s") is filled in by the caller once the group's
+      // start/end span is known \u2014 not a relative "ago".
+      time.textContent = '';
       item.appendChild(icon);
       item.appendChild(body);
       item.appendChild(time);
-      // Row events (insert/update/delete) carry a rowId \u2014 make the bubble a
+      // Row events (insert/update/delete) carry a rowId \u2014 make the card a
       // shortcut to that object. Link/unlink and schema events have no single
       // row (rowId is null), so they stay non-clickable.
       if (ev.rowId && ev.table) {
@@ -12980,18 +13381,117 @@ var appJs = `
         item.setAttribute('role', 'button');
         item.setAttribute('tabindex', '0');
         item.title = 'Open this ' + String(ev.table);
-        // _rowClickOff is set when the bubble becomes a group \u2014 clicks no-op then.
+        // _rowClickOff is set when the card becomes a group \u2014 clicks no-op then.
         var openRow = function () { if (item._rowClickOff) return; openSearchHit(String(ev.table), String(ev.rowId)); };
         item.addEventListener('click', openRow);
         item.addEventListener('keydown', function (e) {
           if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); openRow(); }
         });
       }
-      feedEl.appendChild(item);
+      return { item: item, summaryEl: summary, timeEl: time };
+    }
+    // Fold another event into an existing group card: bump the count, track the
+    // table, refresh the summary, and drop the single-row affordances (a grouped
+    // card stands for many rows, so it's a status, not a clickable button).
+    // The card timer shows the TASK DURATION (start \u2192 finish), not a relative
+    // "ago": for a single op it's the time that op took; for a grouped run it's
+    // from the first task's start to the last task's finish. startMs is anchored
+    // to the assistant turn's start (so a one-event card still shows real time);
+    // endMs tracks the latest event in the group.
+    function setGroupTime(g) {
+      if (g.timeEl) g.timeEl.textContent = formatElapsed(Math.max(0, g.endMs - g.startMs));
+    }
+    function applyGroupHit(g, ev, endMs) {
+      g.count += 1;
+      if (ev.table && !g.tables[ev.table]) { g.tables[ev.table] = 1; g.tableCount += 1; }
+      if (typeof endMs === 'number' && endMs > g.endMs) g.endMs = endMs;
+      g.summaryEl.textContent = groupedSummary(g);
+      setGroupTime(g);
+      g.item._rowClickOff = true;
+      g.item.classList.remove('feed-clickable');
+      g.item.removeAttribute('tabindex');
+      g.item.removeAttribute('title');
+      g.item.setAttribute('role', 'status');
+    }
+    function newGroup(ev, card, startMs, endMs) {
+      var tbls = {}; var tc = 0;
+      if (ev.table) { tbls[ev.table] = 1; tc = 1; }
+      return {
+        op: ev.op, count: 1, tables: tbls, tableCount: tc,
+        schemaKey: isSchemaOp(ev.op) ? schemaAction(ev.summary) : null,
+        firstSummary: ev.summary || '',
+        item: card.item, summaryEl: card.summaryEl, timeEl: card.timeEl,
+        startMs: startMs, endMs: endMs,
+      };
+    }
+    function renderFeedItem(ev) {
+      var feedEl = document.getElementById('rail-feed');
+      if (!feedEl) return;
+      var empty = document.getElementById('rail-empty');
+      if (empty) empty.remove();
+      // Coalesce same-TYPE events into one counted card within a recency window \u2014
+      // even across different objects (op+source key, table excluded), so a bulk
+      // run collapses to one card ("Removed 49 rows across 9 tables") instead of
+      // spamming the rail. Distinct tables touched are tracked so a single-table
+      // run still reads "\u2026 from <table>".
+      var groupKey = feedGroupKey(ev);
+      var nowMs = Date.now();
+      if (groupKey) {
+        var g = feedGroups[groupKey];
+        // A group stays open to merge while: (a) we're inside the SAME assistant
+        // turn that opened it \u2014 no time limit, so a slow bulk run (deleting many
+        // tables against a remote DB) stays one card instead of splitting when a
+        // 15s window lapses mid-run; or (b) outside a turn (manual edits / another
+        // client), within the rolling window. Cross-turn events never merge.
+        var open = g && g.item.parentNode === feedEl && (
+          feedTurnActive ? (g.turnId === feedTurnId) : ((nowMs - g.last) < FEED_GROUP_WINDOW_MS)
+        );
+        if (open) {
+          applyGroupHit(g, ev, nowMs);
+          g.last = nowMs;
+          feedEl.scrollTop = feedEl.scrollHeight;
+          return;
+        }
+      }
+      var card = makeFeedCard(ev);
+      // Keep a streaming chat turn's typing bubble pinned to the bottom: insert
+      // this card above it rather than appending below (the dots are the next
+      // message, not done yet). No active turn \u2192 append as usual.
+      var anchor = feedTypingAnchor(feedEl);
+      if (anchor) feedEl.insertBefore(card.item, anchor); else feedEl.appendChild(card.item);
       feedEl.scrollTop = feedEl.scrollHeight;
-      // Register/refresh the group anchored on this bubble (groupable ops only).
+      // Anchor the card's duration to the turn start (so even a single-op card
+      // shows how long the task took); fall back to now for non-turn activity.
+      var startMs = (feedTurnActive && feedTurnStartMs) ? feedTurnStartMs : nowMs;
       if (groupKey) {
-        feedGroups[groupKey] = { count: 1, item: item, summaryEl: summary, timeEl: time, last: nowMs };
+        var grp = newGroup(ev, card, startMs, nowMs);
+        grp.turnId = feedTurnId;
+        grp.last = nowMs;
+        feedGroups[groupKey] = grp;
+        setGroupTime(grp);
+      } else {
+        card.timeEl.textContent = formatElapsed(Math.max(0, nowMs - startMs));
+      }
+    }
+    // Replay a persisted assistant turn's data-change events as collapsed activity
+    // cards. Grouping is PER-TURN (self-contained, independent of the live feed's
+    // rolling window) so each turn's bulk run shows one card and stays tied to the
+    // turn that produced it. Reads aren't persisted as events, so only mutations
+    // appear. Appends in order; the caller positions them after the turn's text.
+    function renderTurnEventCards(feedEl, events, startedMs) {
+      if (!feedEl || !events || !events.length) return;
+      var groups = {};
+      for (var i = 0; i < events.length; i++) {
+        var ev = events[i];
+        var evMs = ev.ts ? new Date(ev.ts).getTime() : startedMs;
+        if (typeof evMs !== 'number' || isNaN(evMs)) evMs = startedMs;
+        var startMs = (typeof startedMs === 'number' && !isNaN(startedMs)) ? startedMs : evMs;
+        var key = feedGroupKey(ev);
+        if (key && groups[key]) { applyGroupHit(groups[key], ev, evMs); continue; }
+        var card = makeFeedCard(ev);
+        feedEl.appendChild(card.item);
+        if (key) { var g = newGroup(ev, card, startMs, evMs); groups[key] = g; setGroupTime(g); }
+        else { card.timeEl.textContent = formatElapsed(Math.max(0, evMs - startMs)); }
       }
     }
     function startFeed() {
@@ -13013,7 +13513,7 @@ var appJs = `
         // scheduleRealtimeRefresh is debounced (200ms) so a burst from one
         // ingest still coalesces into a single refetch \u2014 and on Postgres/cloud
         // it shares that debounce with the realtime 'change' handler (no double
-        // fetch). See Rule 28: /api/entities uses batched counts, not N queries.
+        // fetch). /api/entities batches its row counts into one query, not N.
         if (data && (data.table || data.op === 'schema')) {
           scheduleRealtimeRefresh();
         }
@@ -13076,12 +13576,13 @@ var appJs = `
       chatHistory = [];
       var feedEl = railFeedEl();
       if (!feedEl) return;
-      // Remove only the chat bubbles. The activity cards (.feed-item) are
-      // workspace-global, not part of any one conversation \u2014 loading, switching,
-      // or starting a conversation must NOT wipe them (they're backfilled once
-      // on connect). Otherwise auto-loading a thread on refresh erases the feed.
-      var msgs = feedEl.querySelectorAll('.chat-msg');
-      for (var i = 0; i < msgs.length; i++) msgs[i].remove();
+      // The rail is conversation-scoped: clearing or switching a conversation
+      // drops both its chat bubbles AND its activity cards (each conversation
+      // replays its own data-change cards from the persisted per-turn events).
+      // Reset the grouping anchors so a freshly loaded thread starts clean.
+      var nodes = feedEl.querySelectorAll('.chat-msg, .feed-item');
+      for (var i = 0; i < nodes.length; i++) nodes[i].remove();
+      feedGroups = {};
       // Restore the empty hint only when the rail is now completely empty.
       if (!feedEl.firstElementChild) {
         feedEl.innerHTML = '<div class="rail-empty" id="rail-empty">No activity yet. Changes you make will appear here.</div>';
@@ -13134,11 +13635,12 @@ var appJs = `
         msgs.forEach(function (m) {
           if (m.role === 'user') { appendUserBubble(m.text); chatHistory.push({ role: 'user', text: m.text }); }
           else if (m.role === 'assistant') {
-            // Rich replay: the saved per-turn structure (text + tool pills),
-            // matching the live stream. Falls back to a plain text bubble for
-            // messages saved before turns were persisted.
-            if (Array.isArray(m.turns) && m.turns.length > 0) { m.turns.forEach(appendAssistantTurn); }
-            else { var c = newAssistantBubble(); setBubbleText(c, m.text); }
+            // Rich replay: the saved per-turn structure (text + the data-change
+            // activity cards it produced), matching the live stream. Falls back to
+            // a plain text bubble for messages saved before turns were persisted.
+            if (Array.isArray(m.turns) && m.turns.length > 0) {
+              m.turns.forEach(function (t) { appendAssistantTurn(t, m.created_at, m.startedAt); });
+            } else { var c = newAssistantBubble(); setBubbleText(c, m.text); }
             chatHistory.push({ role: 'assistant', text: m.text });
           }
         });
@@ -13162,126 +13664,88 @@ var appJs = `
       railEmptyGone();
       var feedEl = railFeedEl();
       var msg = document.createElement('div'); msg.className = 'chat-msg assistant';
-      var wrap = document.createElement('div');
-      var tools = document.createElement('div'); tools.className = 'chat-tools';
       var b = document.createElement('div'); b.className = 'chat-bubble assistant';
       // Show an animated typing indicator until the first text delta arrives.
       b.innerHTML = '<span class="chat-typing"><i></i><i></i><i></i></span>';
       b.setAttribute('data-typing', '1');
-      wrap.appendChild(tools); wrap.appendChild(b);
-      msg.appendChild(wrap); feedEl.appendChild(msg); feedEl.scrollTop = feedEl.scrollHeight;
-      // lastTool anchors the current run of identical tool calls so consecutive
-      // same-name calls coalesce into one counted pill (see addToolPill).
-      return { bubble: b, tools: tools, pills: {}, lastTool: null, msg: msg };
+      msg.appendChild(b); feedEl.appendChild(msg); feedEl.scrollTop = feedEl.scrollHeight;
+      return { bubble: b, msg: msg };
     }
     /** Set an assistant bubble's text, clearing the typing indicator. */
+    // Turn [label](lattice://table/id) object references the assistant emits into
+    // clickable pills that open the row (mode-aware, via openSearchHit). The
+    // links are pulled out into placeholders BEFORE markdown rendering and the
+    // pill HTML is swapped back in AFTER \u2014 so it's independent of mdToHtml's own
+    // link handling and survives HTML-escaping. Labels/ids are re-escaped.
+    function renderAssistantHtml(text) {
+      var pills = [];
+      // U+0002 sentinel survives mdToHtml's escape + inline passes untouched.
+      // Use a unicode-escape string literal for insertion and a REGEX LITERAL for
+      // the swap (one escaping level each) \u2014 a new RegExp('(\\d+)') here would be
+      // double-collapsed by the template literal into a literal "d", silently
+      // breaking the swap (the pill rendered as a bare index).
+      var pre = String(text == null ? '' : text).replace(
+        /\\[([^\\]]+)\\]\\(lattice:\\/\\/([a-zA-Z0-9_]+)\\/([^)\\s]+)\\)/g,
+        function (_, label, table, id) {
+          pills.push({ label: label, table: table, id: id });
+          return '\\u0002' + (pills.length - 1) + '\\u0002';
+        }
+      );
+      var html = mdToHtml(pre);
+      return html.replace(/\\u0002([0-9]+)\\u0002/g, function (_, n) {
+        var p = pills[Number(n)];
+        return '<a class="chip chip-link lattice-ref" data-table="' + escapeHtml(p.table) +
+          '" data-id="' + escapeHtml(p.id) + '" title="Open this ' + escapeHtml(p.table) + '">\u{1F517} ' +
+          escapeHtml(p.label) + '</a>';
+      });
+    }
+    // One delegated click handler on the rail feed: a lattice-ref pill opens its
+    // object through the same mode-aware navigator the activity feed uses.
+    var _latticeRefWired = false;
+    function ensureLatticeRefHandler() {
+      if (_latticeRefWired) return;
+      var feedEl = document.getElementById('rail-feed');
+      if (!feedEl) return;
+      feedEl.addEventListener('click', function (e) {
+        var a = e.target && e.target.closest ? e.target.closest('.lattice-ref') : null;
+        if (!a) return;
+        e.preventDefault();
+        openSearchHit(a.getAttribute('data-table'), a.getAttribute('data-id'));
+      });
+      _latticeRefWired = true;
+    }
     function setBubbleText(ctx, text) {
       if (!ctx || !ctx.bubble) return; // bubble may have been finalized/removed
       ctx.bubble.removeAttribute('data-typing');
       // Assistant turns are Markdown; render (input is HTML-escaped inside
-      // mdToHtml first, so this is injection-safe).
-      ctx.bubble.innerHTML = mdToHtml(text);
+      // mdToHtml first, so this is injection-safe) + linkify object references.
+      ctx.bubble.innerHTML = renderAssistantHtml(text);
+      ensureLatticeRefHandler();
     }
     /**
-     * A turn ended. If its bubble never got text (still showing the typing
-     * indicator), drop the empty bubble \u2014 keeping any tool pills it fired, or
-     * removing the whole message when there were none. Stops a dangling
-     * "typing\u2026" bubble after the stream completes.
+     * A turn ended still showing the typing indicator (no text streamed) \u2014 drop
+     * the empty bubble. The turn's data-change activity cards live in the rail
+     * feed independently (not inside the message), so they remain.
      */
     function finalizeBubble(ctx) {
       if (!ctx || !ctx.bubble || !ctx.bubble.getAttribute('data-typing')) return;
-      if (ctx.tools && ctx.tools.children.length > 0) ctx.bubble.remove();
-      else if (ctx.msg) ctx.msg.remove();
-    }
-    var TOOL_VERBS = {
-      create_row: ['Creating row', 'Row created', 'Could not create row'],
-      update_row: ['Updating row', 'Row updated', 'Could not update row'],
-      delete_row: ['Deleting row', 'Row deleted', 'Could not delete row'],
-      list_rows: ['Listing rows', 'Listed rows', 'Could not list rows'],
-      get_row: ['Fetching row', 'Fetched row', 'Could not fetch row'],
-      list_entities: ['Listing tables', 'Listed tables', 'Could not list tables']
-    };
-    // Grouped (count > 1) [gerund, past, noun] so a run of identical tool calls
-    // collapses into ONE counted pill \u2014 "Listed 5 rows" \u2014 instead of N identical
-    // "Listed rows" pills. Mirrors the activity feed's groupedSummary() coalescing.
-    var TOOL_GROUP = {
-      create_row:    ['Creating', 'Created', 'rows'],
-      update_row:    ['Updating', 'Updated', 'rows'],
-      delete_row:    ['Deleting', 'Deleted', 'rows'],
-      list_rows:     ['Listing',  'Listed',  'rows'],
-      get_row:       ['Fetching', 'Fetched', 'rows'],
-      list_entities: ['Listing',  'Listed',  'tables']
-    };
-    function toolLabel(name, state) {
-      var v = TOOL_VERBS[name] || [name, name, name];
-      return state === 'pending' ? v[0] + '\u2026' : (state === 'error' ? v[2] : v[1]);
-    }
-    // Label for a run of "count" identical calls. count <= 1 falls back to the
-    // single-call label so a lone pill reads exactly as before.
-    function toolGroupLabel(name, count, state) {
-      if (count <= 1) return toolLabel(name, state);
-      var g = TOOL_GROUP[name];
-      if (!g) return toolLabel(name, state) + ' \xD7' + count; // unknown tool: stay honest
-      var verb = state === 'pending' ? g[0] : g[1];
-      return verb + ' ' + count + ' ' + g[2] + (state === 'pending' ? '\u2026' : '');
-    }
-    // Paint a (possibly grouped) pill from its live counts: spinner while any call
-    // is still running, then \u2713 (or \u26A0 if any errored) once every call resolves.
-    function paintToolPill(g) {
-      var pending = g.pending > 0;
-      var err = !pending && g.error > 0;
-      if (pending) {
-        g.el.className = 'tool-pill';
-        g.el.innerHTML = '<span class="spin"></span>' + escapeHtml(toolGroupLabel(g.name, g.total, 'pending'));
-      } else {
-        g.el.className = 'tool-pill ' + (err ? 'error' : 'done');
-        g.el.textContent = (err ? '\u26A0 ' : '\u2713 ') + toolGroupLabel(g.name, g.total, err ? 'error' : 'done');
-      }
-    }
-    function addToolPill(ctx, id, name) {
-      // Coalesce a run of the same tool within this turn's pill row into one
-      // counted pill (the model emits several list_rows in a single turn).
-      var g = ctx.lastTool;
-      if (g && g.name === name) {
-        g.total += 1; g.pending += 1;
-      } else {
-        var pill = document.createElement('span'); pill.className = 'tool-pill';
-        ctx.tools.appendChild(pill);
-        g = { name: name, el: pill, total: 1, pending: 1, error: 0 };
-        ctx.lastTool = g;
-      }
-      ctx.pills[id] = g; // resolveToolPill maps the tool-use id back to its group
-      paintToolPill(g);
-    }
-    function resolveToolPill(ctx, id, isError) {
-      var g = ctx.pills[id]; if (!g) return;
-      if (g.pending > 0) g.pending -= 1;
-      if (isError) g.error += 1;
-      paintToolPill(g);
+      if (ctx.msg) ctx.msg.remove();
     }
-    /**
-     * Append already-resolved pills for a replayed turn, collapsing consecutive
-     * identical tools into one counted pill (matching the live grouping above).
-     */
-    function renderResolvedPills(ctx, tools) {
-      var i = 0;
-      while (i < tools.length) {
-        var name = tools[i].name, j = i, errors = 0;
-        while (j < tools.length && tools[j].name === name) { if (tools[j].isError) errors += 1; j++; }
-        var count = j - i, err = errors > 0;
-        var pill = document.createElement('span');
-        pill.className = 'tool-pill ' + (err ? 'error' : 'done');
-        pill.textContent = (err ? '\u26A0 ' : '\u2713 ') + toolGroupLabel(name, count, err ? 'error' : 'done');
-        ctx.tools.appendChild(pill);
-        i = j;
-      }
-    }
-    /** Replay one persisted assistant turn: its tool pills + text bubble. */
-    function appendAssistantTurn(turn) {
+    /** Replay one persisted assistant turn: its text bubble + the data-change
+     *  activity cards it produced (collapsed, per-turn). Reads aren't persisted
+     *  as events, so a read-only turn with no text renders nothing. createdAt
+     *  stamps the cards' relative time (events carry no ts of their own). */
+    function appendAssistantTurn(turn, createdAt, startedAt) {
       var ctx = newAssistantBubble();
-      renderResolvedPills(ctx, turn.tools || []);
       if (turn.text) setBubbleText(ctx, turn.text);
-      else finalizeBubble(ctx); // tool-only turn: drop the empty bubble, keep pills
+      else finalizeBubble(ctx); // no text \u2192 drop the empty typing bubble
+      var events = (turn.events || []).map(function (e) {
+        return e.ts ? e : { op: e.op, table: e.table, rowId: e.rowId, summary: e.summary, source: e.source || 'ai', ts: createdAt };
+      });
+      // Task start for the duration timer: the persisted turn-start, else the
+      // message time. Per-event ts (above) gives the run's finish.
+      var startedMs = new Date(startedAt || createdAt || 0).getTime();
+      renderTurnEventCards(railFeedEl(), events, startedMs);
     }
     function parseSse(buffer, onEvent) {
       var sep;
@@ -13297,6 +13761,11 @@ var appJs = `
     function sendChat(text) {
       if (chatBusy || !text) return;
       chatBusy = true;
+      // Open a fresh turn scope: this turn's activity cards group together (no
+      // window expiry) and their timers measure from now.
+      feedTurnId += 1;
+      feedTurnStartMs = Date.now();
+      feedTurnActive = true;
       appendUserBubble(text);
       var historyToSend = chatHistory.slice();
       chatHistory.push({ role: 'user', text: text });
@@ -13323,8 +13792,10 @@ var appJs = `
             buf = parseSse(buf, function (ev) {
               if (ev.type === 'assistant_message_start') { finalizeBubble(actx); actx = newAssistantBubble(); assembled = ''; }
               else if (ev.type === 'text_delta' && actx) { assembled += ev.delta; setBubbleText(actx, assembled); railFeedEl().scrollTop = railFeedEl().scrollHeight; }
-              else if (ev.type === 'tool_use' && actx) { addToolPill(actx, ev.id, ev.name); }
-              else if (ev.type === 'tool_result' && actx) { resolveToolPill(actx, ev.toolUseId, ev.isError); }
+              // tool_use / tool_result are no longer painted as inline pills \u2014 the
+              // assistant's data changes stream in as activity cards over the feed
+              // SSE (renderFeedItem), which sit above the typing bubble. Reads emit
+              // no card by design (only data changes show).
               else if (ev.type === 'warn') { finalizeBubble(actx); var wb = newAssistantBubble(); setBubbleText(wb, '\u26A0 ' + ev.message); actx = null; }
               else if (ev.type === 'error') { if (!actx) actx = newAssistantBubble(); setBubbleText(actx, (assembled ? assembled + '\\n' : '') + '\u26A0 ' + ev.message); }
             });
@@ -13341,6 +13812,9 @@ var appJs = `
         var c = newAssistantBubble(); setBubbleText(c, '\u26A0 ' + e.message);
       }).finally(function () {
         chatBusy = false;
+        // Close the turn scope: later activity starts fresh cards (the next turn,
+        // or manual edits via the rolling window).
+        feedTurnActive = false;
         var sb = document.getElementById('chat-send'); if (sb) sb.disabled = false;
         var inp = document.getElementById('chat-input'); if (inp) inp.focus();
       });
@@ -13476,7 +13950,10 @@ var appJs = `
         '<div class="feed-icon"><span class="feed-spinner"></span></div>' +
         '<div class="feed-body"><div class="feed-summary">Analyzing ' + escapeHtml(label) + '\u2026</div></div>' +
         '<div class="feed-time">0s</div>';
-      feedEl.appendChild(item);
+      // Same bottom-pin rule as renderFeedItem: don't bury a streaming chat
+      // turn's typing bubble beneath this card.
+      var anchor = feedTypingAnchor(feedEl);
+      if (anchor) feedEl.insertBefore(item, anchor); else feedEl.appendChild(item);
       feedEl.scrollTop = feedEl.scrollHeight;
       // Live elapsed-time counter while the upload + server-side extraction run.
       // Previously the time element was left empty (rendered as a stuck "0s")
@@ -13682,6 +14159,10 @@ var guiAppHtml = `<!doctype html>
       </svg>
     </button>
   </header>
+  <div class="deprecation-banner" id="deprecation-banner" hidden>
+    <span id="deprecation-banner-text"></span>
+    <button id="deprecation-banner-dismiss" title="Dismiss for this session" aria-label="Dismiss">\u2715</button>
+  </div>
   <div class="layout">
     <nav class="sidebar">
       <label class="sidebar-advanced toggle" title="Advanced mode \u2014 row/table editor instead of the file workspace">
@@ -13876,7 +14357,13 @@ var CLOUD_INTERNAL_TABLE_DEFS = {
       // Client-generated idempotency key for offline replay: a queued edit
       // carries a stable edit_id, so re-sending it after a reconnect is a
       // no-op rather than a duplicate write. Nullable + additive.
-      edit_id: "TEXT"
+      edit_id: "TEXT",
+      // Per-recipient targeting for 2.2 hard row-level sync. NULL =
+      // broadcast (delivered to every member, then filtered at pull time
+      // against __lattice_row_acl); non-null = targeted to exactly this
+      // user (the grant / revoke / delete fan-out). Nullable + additive,
+      // same precedent as client_ts / edit_id.
+      recipient_user_id: "TEXT"
     },
     render: () => "",
     outputFile: ".lattice-teams/change-log.md"
@@ -13892,6 +14379,44 @@ var CLOUD_INTERNAL_TABLE_DEFS = {
     primaryKey: ["team_id", "table_name", "pk"],
     render: () => "",
     outputFile: ".lattice-teams/row-links.md"
+  },
+  // Per-row access control for a team cloud (2.2 row-level permissions).
+  // Mirrors __lattice_object_owners at row granularity: each shared row
+  // has an owner (its creator) and a visibility. Enforcement is at the
+  // application layer (see src/teams/row-access.ts) — every member shares
+  // the same physical DB, so a row a user can't see must be filtered out
+  // before its bytes reach them. Kept out-of-band (never injected into
+  // user tables) so the user's own schema stays untouched.
+  __lattice_row_acl: {
+    columns: {
+      team_id: "TEXT NOT NULL",
+      table_name: "TEXT NOT NULL",
+      pk: "TEXT NOT NULL",
+      owner_user_id: "TEXT NOT NULL",
+      // 'private' = owner only · 'everyone' = all team members ·
+      // 'custom' = the explicit grant list in __lattice_row_grants.
+      visibility: "TEXT NOT NULL CHECK (visibility IN ('private', 'everyone', 'custom'))",
+      created_at: "TEXT NOT NULL",
+      updated_at: "TEXT NOT NULL"
+    },
+    primaryKey: ["team_id", "table_name", "pk"],
+    render: () => "",
+    outputFile: ".lattice-teams/row-acl.md"
+  },
+  // Explicit per-row grant list, consulted only when the owning row's
+  // __lattice_row_acl.visibility = 'custom'. One row per (row, grantee).
+  __lattice_row_grants: {
+    columns: {
+      team_id: "TEXT NOT NULL",
+      table_name: "TEXT NOT NULL",
+      pk: "TEXT NOT NULL",
+      grantee_user_id: "TEXT NOT NULL",
+      granted_by_user_id: "TEXT NOT NULL",
+      granted_at: "TEXT NOT NULL"
+    },
+    primaryKey: ["team_id", "table_name", "pk", "grantee_user_id"],
+    render: () => "",
+    outputFile: ".lattice-teams/row-grants.md"
   }
 };
 var LOCAL_INTERNAL_TABLE_DEFS = {
@@ -13992,47 +14517,382 @@ async function installCloudInternalTriggers(db) {
   };
   await db.migrate([migration]);
 }
-
-// src/teams/server/auth.ts
-import { createHash as createHash2, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
-var TOKEN_PREFIX = "lat_";
-var INVITE_PREFIX = "latinv_";
-var TOKEN_BYTES = 32;
-var INVITE_BYTES = 24;
-function extractBearer(req) {
-  const header = req.headers.authorization;
-  if (typeof header !== "string") return null;
-  const match = /^Bearer\s+(\S+)$/i.exec(header.trim());
-  if (!match) return null;
-  const token = match[1];
-  if (!token?.startsWith(TOKEN_PREFIX)) return null;
-  return token;
-}
-function hashToken(rawToken) {
-  return createHash2("sha256").update(rawToken).digest("hex");
+async function installRowPermsSchema(db) {
+  const migrations = [
+    {
+      // 01 — per-table default visibility for newly-created rows. Born
+      // 'private' unless the table owner opts the table into 'everyone';
+      // the backfill (06) flips already-shared tables to preserve pre-2.2
+      // visibility. No IF NOT EXISTS: the version guard runs this exactly
+      // once, which is what SQLite's ADD COLUMN needs (it has no
+      // IF NOT EXISTS form).
+      version: "internal:row-perms:01-default-row-visibility:v1",
+      sql: `ALTER TABLE "__lattice_shared_objects" ADD COLUMN "default_row_visibility" TEXT NOT NULL DEFAULT 'private' CHECK ("default_row_visibility" IN ('private', 'everyone'))`
+    },
+    {
+      // 02-05 — indexes. One CREATE INDEX per migration (single-statement
+      // for the SQLite path). IF NOT EXISTS is valid in both dialects.
+      version: "internal:row-perms:02-idx-change-log-team-seq:v1",
+      sql: `CREATE INDEX IF NOT EXISTS "idx_lattice_change_log_team_seq" ON "__lattice_change_log" ("team_id", "seq")`
+    },
+    {
+      version: "internal:row-perms:03-idx-change-log-team-recipient-seq:v1",
+      sql: `CREATE INDEX IF NOT EXISTS "idx_lattice_change_log_team_recipient_seq" ON "__lattice_change_log" ("team_id", "recipient_user_id", "seq")`
+    },
+    {
+      version: "internal:row-perms:04-idx-change-log-team-table-pk:v1",
+      sql: `CREATE INDEX IF NOT EXISTS "idx_lattice_change_log_team_table_pk" ON "__lattice_change_log" ("team_id", "table_name", "pk")`
+    },
+    {
+      version: "internal:row-perms:05-idx-row-grants-grantee:v1",
+      sql: `CREATE INDEX IF NOT EXISTS "idx_lattice_row_grants_grantee" ON "__lattice_row_grants" ("team_id", "grantee_user_id", "table_name", "pk")`
+    },
+    {
+      // 06 — upgrade backfill. Every already-shared table defaults to
+      // 'everyone' so pre-2.2 rows stay visible to all members (nothing
+      // disappears on upgrade). Pre-2.2 rows have no __lattice_row_acl
+      // entry; resolveRowAcl() folds in this table default, so they read
+      // as 'everyone' until an owner narrows an individual row. Runs once.
+      version: "internal:row-perms:06-backfill-shared-defaults:v1",
+      sql: `UPDATE "__lattice_shared_objects" SET "default_row_visibility" = 'everyone' WHERE "deleted_at" IS NULL`
+    }
+  ];
+  await db.migrate(migrations);
 }
-function generateToken() {
-  const raw = `${TOKEN_PREFIX}${randomBytes4(TOKEN_BYTES).toString("hex")}`;
-  return { raw, hash: hashToken(raw) };
+
+// src/teams/row-access.ts
+var RowAccessError = class extends Error {
+  code = "row_access_denied";
+  constructor(message = "Row not accessible") {
+    super(message);
+    this.name = "RowAccessError";
+  }
+};
+var RowOwnerOnlyError = class extends Error {
+  code = "row_owner_only";
+  constructor(message = "Only the row owner may change its sharing") {
+    super(message);
+    this.name = "RowOwnerOnlyError";
+  }
+};
+function isRowVisibility(v) {
+  return v === "private" || v === "everyone" || v === "custom";
 }
-function generateInviteToken() {
-  const raw = `${INVITE_PREFIX}${randomBytes4(INVITE_BYTES).toString("hex")}`;
-  return { raw, hash: hashToken(raw) };
+async function tableDefaultVisibility(db, teamId, table) {
+  const rows = await db.query("__lattice_shared_objects", {
+    filters: [
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table },
+      { col: "deleted_at", op: "isNull" }
+    ],
+    limit: 1
+  });
+  return rows[0]?.default_row_visibility === "everyone" ? "everyone" : "private";
 }
-async function authenticate(req, db) {
-  const raw = extractBearer(req);
-  if (!raw) return null;
-  const incomingHash = hashToken(raw);
-  const rows = await db.query("__lattice_api_tokens", {
+async function tableOwner(db, teamId, table) {
+  const owners = await db.query("__lattice_object_owners", {
     filters: [
-      { col: "token_hash", op: "eq", val: incomingHash },
-      { col: "revoked_at", op: "isNull" }
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table }
     ],
     limit: 1
   });
-  const tokenRow = rows[0];
-  if (!tokenRow) return null;
-  const storedBuf = Buffer.from(tokenRow.token_hash, "hex");
+  const ownerId = owners[0]?.owner_user_id;
+  if (typeof ownerId === "string" && ownerId) return ownerId;
+  const shared = await db.query("__lattice_shared_objects", {
+    filters: [
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table },
+      { col: "deleted_at", op: "isNull" }
+    ],
+    limit: 1
+  });
+  const createdBy = shared[0]?.created_by_user_id;
+  return typeof createdBy === "string" ? createdBy : "";
+}
+async function rawAclRow(db, teamId, table, pk) {
+  const rows = await db.query("__lattice_row_acl", {
+    filters: [
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table },
+      { col: "pk", op: "eq", val: pk }
+    ],
+    limit: 1
+  });
+  return rows[0];
+}
+async function resolveRowAcl(db, teamId, table, pk) {
+  const acl = await rawAclRow(db, teamId, table, pk);
+  if (acl && isRowVisibility(acl.visibility)) {
+    return { ownerUserId: String(acl.owner_user_id), visibility: acl.visibility };
+  }
+  const [visibility, owner] = await Promise.all([
+    tableDefaultVisibility(db, teamId, table),
+    tableOwner(db, teamId, table)
+  ]);
+  return { ownerUserId: owner, visibility };
+}
+async function hasRowGrant(db, teamId, table, pk, userId) {
+  if (!userId) return false;
+  const grants = await db.query("__lattice_row_grants", {
+    filters: [
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table },
+      { col: "pk", op: "eq", val: pk },
+      { col: "grantee_user_id", op: "eq", val: userId }
+    ],
+    limit: 1
+  });
+  return grants.length > 0;
+}
+async function canAccessRow(db, teamId, table, pk, userId) {
+  const acl = await resolveRowAcl(db, teamId, table, pk);
+  if (userId && acl.ownerUserId === userId) return true;
+  if (acl.visibility === "everyone") return true;
+  if (acl.visibility === "custom") return hasRowGrant(db, teamId, table, pk, userId);
+  return false;
+}
+async function listVisibleRows(db, teamId, table, userId, opts = {}) {
+  const [owner, def] = await Promise.all([
+    tableOwner(db, teamId, table),
+    tableDefaultVisibility(db, teamId, table)
+  ]);
+  const noAclVisible = def === "everyone" || userId !== "" && owner === userId;
+  return db.queryVisible(table, { teamId, userId, noAclVisible, ...opts });
+}
+async function recordRowAcl(db, teamId, table, pk, ownerUserId, visibility) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const existing = await rawAclRow(db, teamId, table, pk);
+  await db.upsert("__lattice_row_acl", {
+    team_id: teamId,
+    table_name: table,
+    pk,
+    owner_user_id: ownerUserId,
+    visibility,
+    created_at: existing?.created_at ?? now,
+    updated_at: now
+  });
+}
+async function requireOwner(db, teamId, table, pk, actorUserId) {
+  const existing = await rawAclRow(db, teamId, table, pk);
+  const owner = existing ? String(existing.owner_user_id) : await tableOwner(db, teamId, table);
+  if (!actorUserId || owner !== actorUserId) throw new RowOwnerOnlyError();
+  return { existing, owner };
+}
+async function setRowVisibility(db, teamId, table, pk, actorUserId, visibility) {
+  const { existing, owner } = await requireOwner(db, teamId, table, pk, actorUserId);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  await db.upsert("__lattice_row_acl", {
+    team_id: teamId,
+    table_name: table,
+    pk,
+    owner_user_id: owner,
+    visibility,
+    created_at: existing?.created_at ?? now,
+    updated_at: now
+  });
+}
+async function addRowGrant(db, teamId, table, pk, granteeUserId, grantedByUserId) {
+  const { existing, owner } = await requireOwner(db, teamId, table, pk, grantedByUserId);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const currentVis = existing && isRowVisibility(existing.visibility) ? existing.visibility : await tableDefaultVisibility(db, teamId, table);
+  const nextVis = currentVis === "everyone" ? "everyone" : "custom";
+  await db.upsert("__lattice_row_acl", {
+    team_id: teamId,
+    table_name: table,
+    pk,
+    owner_user_id: owner,
+    visibility: nextVis,
+    created_at: existing?.created_at ?? now,
+    updated_at: now
+  });
+  await db.upsert("__lattice_row_grants", {
+    team_id: teamId,
+    table_name: table,
+    pk,
+    grantee_user_id: granteeUserId,
+    granted_by_user_id: grantedByUserId,
+    granted_at: now
+  });
+}
+async function removeRowGrant(db, teamId, table, pk, granteeUserId, actorUserId) {
+  await requireOwner(db, teamId, table, pk, actorUserId);
+  await db.delete("__lattice_row_grants", {
+    team_id: teamId,
+    table_name: table,
+    pk,
+    grantee_user_id: granteeUserId
+  });
+}
+async function rowAccessSummaries(db, teamId, table, userId, pks) {
+  const out = /* @__PURE__ */ new Map();
+  if (pks.length === 0) return out;
+  const acls = await db.query("__lattice_row_acl", {
+    filters: [
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table }
+    ]
+  });
+  const aclByPk = new Map(acls.map((a) => [String(a.pk), a]));
+  const [owner, def] = await Promise.all([
+    tableOwner(db, teamId, table),
+    tableDefaultVisibility(db, teamId, table)
+  ]);
+  for (const pk of pks) {
+    const a = aclByPk.get(pk);
+    const ownerUserId = a ? String(a.owner_user_id) : owner;
+    const visibility = a && isRowVisibility(a.visibility) ? a.visibility : def;
+    out.set(pk, { owner_user_id: ownerUserId, visibility, ownedByMe: ownerUserId === userId });
+  }
+  return out;
+}
+async function filterVisiblePks(db, teamId, table, userId, pks) {
+  const out = /* @__PURE__ */ new Set();
+  if (pks.length === 0) return out;
+  const acls = await db.query("__lattice_row_acl", {
+    filters: [
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table },
+      { col: "pk", op: "in", val: pks }
+    ]
+  });
+  const aclByPk = new Map(acls.map((a) => [String(a.pk), a]));
+  const [owner, def] = await Promise.all([
+    tableOwner(db, teamId, table),
+    tableDefaultVisibility(db, teamId, table)
+  ]);
+  const customPks = [];
+  for (const pk of pks) {
+    const a = aclByPk.get(pk);
+    const ownerUserId = a ? String(a.owner_user_id) : owner;
+    const visibility = a && isRowVisibility(a.visibility) ? a.visibility : def;
+    if (userId && ownerUserId === userId) {
+      out.add(pk);
+    } else if (visibility === "everyone") {
+      out.add(pk);
+    } else if (visibility === "custom" && userId) {
+      customPks.push(pk);
+    }
+  }
+  if (customPks.length > 0) {
+    const grants = await db.query("__lattice_row_grants", {
+      filters: [
+        { col: "team_id", op: "eq", val: teamId },
+        { col: "table_name", op: "eq", val: table },
+        { col: "grantee_user_id", op: "eq", val: userId },
+        { col: "pk", op: "in", val: customPks }
+      ]
+    });
+    for (const g of grants) out.add(String(g.pk));
+  }
+  return out;
+}
+async function usersWithRowAccess(db, teamId, table, pk, candidateUserIds) {
+  const out = [];
+  for (const uid of candidateUserIds) {
+    if (await canAccessRow(db, teamId, table, pk, uid)) out.push(uid);
+  }
+  return out;
+}
+async function deleteRowAcl(db, teamId, table, pk) {
+  await db.delete("__lattice_row_acl", { team_id: teamId, table_name: table, pk });
+  const grants = await db.query("__lattice_row_grants", {
+    filters: [
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table },
+      { col: "pk", op: "eq", val: pk }
+    ]
+  });
+  for (const g of grants) {
+    await db.delete("__lattice_row_grants", {
+      team_id: teamId,
+      table_name: table,
+      pk,
+      grantee_user_id: g.grantee_user_id
+    });
+  }
+}
+async function rowGrantees(db, teamId, table, pk) {
+  const grants = await db.query("__lattice_row_grants", {
+    filters: [
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table },
+      { col: "pk", op: "eq", val: pk }
+    ]
+  });
+  return grants.map((g) => String(g.grantee_user_id));
+}
+async function visibleRowEdits(db, teamId, table, userId, scanLimit = 2e3) {
+  const scan = await db.query("__lattice_change_log", {
+    filters: [
+      { col: "team_id", op: "eq", val: teamId },
+      { col: "table_name", op: "eq", val: table }
+    ],
+    orderBy: "seq",
+    orderDir: "desc",
+    limit: scanLimit
+  });
+  const visible = await listVisibleRows(db, teamId, table, userId, { limit: 5e3, deleted: "any" });
+  const visiblePks = new Set(visible.map((r) => String(r.id)));
+  const edits = {};
+  for (const r of scan) {
+    if (!r.pk || edits[r.pk] || !visiblePks.has(r.pk)) continue;
+    edits[r.pk] = { ownerUserId: r.owner_user_id, at: r.client_ts ?? r.created_at };
+  }
+  return edits;
+}
+async function setTableDefaultVisibility(db, teamId, table, actorUserId, visibility) {
+  const owner = await tableOwner(db, teamId, table);
+  if (!actorUserId || owner !== actorUserId) {
+    throw new RowOwnerOnlyError("Only the table owner may change the default row visibility");
+  }
+  await db.update(
+    "__lattice_shared_objects",
+    { team_id: teamId, table_name: table },
+    { default_row_visibility: visibility, updated_at: (/* @__PURE__ */ new Date()).toISOString() }
+  );
+}
+
+// src/teams/server/auth.ts
+import { createHash as createHash2, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
+var TOKEN_PREFIX = "lat_";
+var INVITE_PREFIX = "latinv_";
+var TOKEN_BYTES = 32;
+var INVITE_BYTES = 24;
+function extractBearer(req) {
+  const header = req.headers.authorization;
+  if (typeof header !== "string") return null;
+  const match = /^Bearer\s+(\S+)$/i.exec(header.trim());
+  if (!match) return null;
+  const token = match[1];
+  if (!token?.startsWith(TOKEN_PREFIX)) return null;
+  return token;
+}
+function hashToken(rawToken) {
+  return createHash2("sha256").update(rawToken).digest("hex");
+}
+function generateToken() {
+  const raw = `${TOKEN_PREFIX}${randomBytes4(TOKEN_BYTES).toString("hex")}`;
+  return { raw, hash: hashToken(raw) };
+}
+function generateInviteToken() {
+  const raw = `${INVITE_PREFIX}${randomBytes4(INVITE_BYTES).toString("hex")}`;
+  return { raw, hash: hashToken(raw) };
+}
+async function authenticate(req, db) {
+  const raw = extractBearer(req);
+  if (!raw) return null;
+  const incomingHash = hashToken(raw);
+  const rows = await db.query("__lattice_api_tokens", {
+    filters: [
+      { col: "token_hash", op: "eq", val: incomingHash },
+      { col: "revoked_at", op: "isNull" }
+    ],
+    limit: 1
+  });
+  const tokenRow = rows[0];
+  if (!tokenRow) return null;
+  const storedBuf = Buffer.from(tokenRow.token_hash, "hex");
   const incomingBuf = Buffer.from(incomingHash, "hex");
   if (storedBuf.length !== incomingBuf.length || !timingSafeEqual(storedBuf, incomingBuf)) {
     return null;
@@ -14052,81 +14912,6 @@ async function authenticate(req, db) {
 function isPostgresUrl(url) {
   return /^postgres(ql)?:\/\//i.test(url);
 }
-async function registerDirectViaPostgres(cloudUrl, email, name, teamName) {
-  if (!isPostgresUrl(cloudUrl)) {
-    throw new Error(
-      `registerDirectViaPostgres: cloudUrl must be a postgres:// URL (got ${cloudUrl.slice(0, 12)}\u2026)`
-    );
-  }
-  const db = new Lattice(cloudUrl);
-  try {
-    await db.init();
-    for (const [table, def] of Object.entries(CLOUD_INTERNAL_TABLE_DEFS)) {
-      await db.defineLate(table, def);
-    }
-    const existing = await db.query("__lattice_users", {
-      filters: [{ col: "deleted_at", op: "isNull" }],
-      limit: 1
-    });
-    if (existing.length > 0) {
-      throw new Error(
-        "Registration is disabled. This cloud already has users \u2014 join via invitation."
-      );
-    }
-    let identity = null;
-    try {
-      identity = await db.get("__lattice_team_identity", "singleton");
-    } catch {
-      identity = null;
-    }
-    if (identity) {
-      throw new Error("This cloud already has a team. Use Connect to existing cloud instead.");
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const userId = await db.insert("__lattice_users", {
-      email,
-      name,
-      created_at: now,
-      updated_at: now
-    });
-    const { raw, hash } = generateToken();
-    await db.insert("__lattice_api_tokens", {
-      user_id: userId,
-      token_hash: hash,
-      name: `creator:${teamName}`,
-      created_at: now
-    });
-    const teamId = await db.insert("__lattice_team", {
-      name: teamName,
-      created_by_user_id: userId,
-      created_at: now,
-      updated_at: now
-    });
-    await db.insert("__lattice_team_members", {
-      team_id: teamId,
-      user_id: userId,
-      role: "creator",
-      joined_at: now
-    });
-    await db.insert("__lattice_team_identity", {
-      id: "singleton",
-      team_id: teamId,
-      team_name: teamName,
-      creator_email: email,
-      created_at: now
-    });
-    return {
-      user: { id: userId, email, name },
-      raw_token: raw,
-      team: { id: teamId, name: teamName, role: "creator" }
-    };
-  } finally {
-    try {
-      db.close();
-    } catch {
-    }
-  }
-}
 
 // src/teams/schema-spec.ts
 var TYPE_MAP = {
@@ -14397,7 +15182,8 @@ async function appendChangeEnvelope(db, entry) {
     owner_user_id: entry.owner_user_id ?? null,
     created_at: now,
     client_ts: entry.client_ts ?? now,
-    edit_id: entry.edit_id ?? null
+    edit_id: entry.edit_id ?? null,
+    recipient_user_id: entry.recipient_user_id ?? null
   });
   return seq;
 }
@@ -14447,7 +15233,14 @@ async function shareObject(db, teamId, createdByUserId, table, spec) {
       created_by_user_id: createdByUserId,
       created_at: prior?.created_at ?? now,
       updated_at: now,
-      deleted_at: null
+      deleted_at: null,
+      // 2.2: a freshly-shared table defaults to 'everyone' so the existing
+      // "share a table → every member sees its rows" contract is preserved.
+      // The owner can narrow the table default (or individual rows) afterward.
+      // Re-share (the branch above) intentionally omits this so an owner's
+      // earlier choice survives a schema bump (the upsert only sets the
+      // columns it lists).
+      default_row_visibility: "everyone"
     });
   }
   await applySchemaSpec(db, table, outSpec);
@@ -14541,88 +15334,26 @@ async function destroyTeamDirect(db) {
   }
   await db.delete("__lattice_team_identity", "singleton");
 }
-async function redeemInviteDirect(cloudUrl, inviteToken, email, name) {
-  if (!isPostgresUrl(cloudUrl)) {
-    throw new Error(
-      `redeemInviteDirect: cloudUrl must be a postgres:// URL (got ${cloudUrl.slice(0, 12)}\u2026)`
-    );
-  }
-  const db = new Lattice(cloudUrl);
-  try {
-    await db.init();
-    for (const [table, def] of Object.entries(CLOUD_INTERNAL_TABLE_DEFS)) {
-      await db.defineLate(table, def);
-    }
-    await installCloudInternalTriggers(db);
-    const invites = await db.query("__lattice_invitations", {
-      filters: [
-        { col: "token_hash", op: "eq", val: hashToken(inviteToken) },
-        { col: "redeemed_at", op: "isNull" }
-      ],
-      limit: 1
-    });
-    const invite = invites[0];
-    if (!invite) {
-      throw new Error("Invitation invalid or already used");
-    }
-    if (invite.expires_at && new Date(invite.expires_at).getTime() < Date.now()) {
-      throw new Error("Invitation expired");
-    }
-    if (invite.invitee_email && invite.invitee_email.toLowerCase() !== email.toLowerCase()) {
-      throw new Error("Invitation is addressed to a different email");
-    }
-    const team = await db.get("__lattice_team", invite.team_id);
-    if (!team || team.deleted_at) {
-      throw new Error("Team no longer exists");
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const userId = await db.insert("__lattice_users", {
-      email,
-      name,
-      created_at: now,
-      updated_at: now
-    });
-    await db.insert("__lattice_team_members", {
-      team_id: invite.team_id,
-      user_id: userId,
-      role: "member",
-      joined_at: now
-    });
-    const { raw, hash } = generateToken();
-    await db.insert("__lattice_api_tokens", {
-      user_id: userId,
-      token_hash: hash,
-      name: `invited:${team.name}`,
-      created_at: now
-    });
-    await db.update("__lattice_invitations", invite.id, {
-      redeemed_at: now,
-      redeemed_by_user_id: userId
-    });
-    return {
-      user: { id: userId, email, name },
-      raw_token: raw,
-      team: { id: team.id, name: team.name }
-    };
-  } finally {
-    try {
-      db.close();
-    } catch {
-    }
-  }
-}
+var directDeprecationWarned = false;
 async function openCloud(cloudUrl) {
   if (!isPostgresUrl(cloudUrl)) {
     throw new Error(
       `direct-ops: cloudUrl must be a postgres:// URL (got ${cloudUrl.slice(0, 12)}\u2026)`
     );
   }
+  if (!directDeprecationWarned) {
+    directDeprecationWarned = true;
+    console.warn(
+      "[teams] Direct postgres:// team-cloud connection is deprecated and does NOT enforce 2.2 row-level security. Migrate to a hosted Lattice Teams server."
+    );
+  }
   const db = new Lattice(cloudUrl);
   await db.init();
   for (const [table, def] of Object.entries(CLOUD_INTERNAL_TABLE_DEFS)) {
     await db.defineLate(table, def);
   }
   await installCloudInternalTriggers(db);
+  await installRowPermsSchema(db);
   return db;
 }
 function closeQuiet(db) {
@@ -15103,6 +15834,23 @@ var FeedBus = class {
   }
 };
 
+// src/gui/search-acl.ts
+async function filterSearchGroupsByAcl(db, teamId, userId, result) {
+  const groups = [];
+  for (const group of result.groups) {
+    const visible = await filterVisiblePks(
+      db,
+      teamId,
+      group.table,
+      userId,
+      group.hits.map((h) => h.id)
+    );
+    const hits = group.hits.filter((h) => visible.has(h.id));
+    if (hits.length > 0) groups.push({ ...group, hits, count: hits.length });
+  }
+  return { ...result, groups };
+}
+
 // src/gui/mutations.ts
 function rowLabel2(row) {
   if (!row || typeof row !== "object") return null;
@@ -15232,6 +15980,10 @@ async function emitTeamEnvelope(ctx, table, pk, op, after) {
 async function createRow(ctx, table, values) {
   const id = await ctx.db.insert(table, values);
   const row = await ctx.db.get(table, id);
+  if (ctx.team) {
+    const vis = await tableDefaultVisibility(ctx.db, ctx.team.teamId, table);
+    await recordRowAcl(ctx.db, ctx.team.teamId, table, id, ctx.team.myUserId, vis);
+  }
   await appendAudit(ctx.db, ctx.feed, table, id, "insert", null, row, ctx.source, ctx.sessionId);
   await emitTeamEnvelope(ctx, table, id, "upsert", row);
   return { id, row };
@@ -15255,6 +16007,9 @@ async function updateRow(ctx, table, id, values) {
   if (before === null) {
     throw new Error(`Cannot update "${table}": no row with id "${id}"`);
   }
+  if (ctx.team && !await canAccessRow(ctx.db, ctx.team.teamId, table, id, ctx.team.myUserId)) {
+    throw new RowAccessError();
+  }
   await ctx.db.update(table, id, values);
   const after = await ctx.db.get(table, id);
   if (after != null) {
@@ -15284,6 +16039,9 @@ async function deleteRow(ctx, table, id, hard) {
   if (before === null) {
     throw new Error(`Cannot delete from "${table}": no row with id "${id}"`);
   }
+  if (ctx.team && !await canAccessRow(ctx.db, ctx.team.teamId, table, id, ctx.team.myUserId)) {
+    throw new RowAccessError();
+  }
   if (!hard && ctx.softDeletable.has(table)) {
     await ctx.db.update(table, id, { deleted_at: (/* @__PURE__ */ new Date()).toISOString() });
     const after = await ctx.db.get(table, id);
@@ -16340,25 +17098,30 @@ async function autoUnlinkUserRows(db, teamId, userId) {
     ]
   });
   for (const link of links) {
-    await db.delete("__lattice_row_links", {
-      team_id: link.team_id,
-      table_name: link.table_name,
-      pk: link.pk
-    });
-    try {
-      await db.delete(link.table_name, link.pk);
-    } catch {
-    }
+    await tearDownSharedRow(db, link.team_id, link.table_name, link.pk, link.owner_user_id);
+  }
+  return links.length;
+}
+async function tearDownSharedRow(db, teamId, tableName, pk, ownerUserId) {
+  const members = (await listTeamMembers(db, teamId)).map((m) => m.user_id);
+  const permitted = await usersWithRowAccess(db, teamId, tableName, pk, members);
+  await db.delete("__lattice_row_links", { team_id: teamId, table_name: tableName, pk });
+  try {
+    await db.delete(tableName, pk);
+  } catch {
+  }
+  for (const uid of permitted) {
     await appendChangeEnvelope(db, {
-      team_id: link.team_id,
-      table_name: link.table_name,
-      pk: link.pk,
+      team_id: teamId,
+      table_name: tableName,
+      pk,
       op: "unlink",
       payload_json: null,
-      owner_user_id: link.owner_user_id
+      owner_user_id: ownerUserId,
+      recipient_user_id: uid
     });
   }
-  return links.length;
+  await deleteRowAcl(db, teamId, tableName, pk);
 }
 async function isObjectShared(db, teamId, tableName) {
   const rows = await db.query("__lattice_shared_objects", {
@@ -16474,15 +17237,12 @@ async function handleListChanges(res, ctx, teamId, params) {
   const since = sinceRaw !== null && /^\d+$/.test(sinceRaw) ? Number(sinceRaw) : 0;
   const limitParsed = limitRaw !== null && /^\d+$/.test(limitRaw) ? Number(limitRaw) : 500;
   const limit = Math.min(Math.max(limitParsed, 1), 1e3);
-  const rows = await ctx.db.query("__lattice_change_log", {
-    filters: [
-      { col: "team_id", op: "eq", val: teamId },
-      { col: "seq", op: "gt", val: since }
-    ],
-    orderBy: "seq",
-    orderDir: "asc",
+  const rows = await ctx.db.listChangesForRecipient(
+    teamId,
+    since,
+    ctx.authContext.user.id,
     limit
-  });
+  );
   const envelopes = rows.map((r) => ({
     seq: r.seq,
     table_name: r.table_name,
@@ -16544,6 +17304,10 @@ async function handleLinkRow(req, res, ctx, teamId, tableName) {
     });
   }
   await ctx.db.upsert(tableName, snapshot);
+  if (!existing) {
+    const vis = await tableDefaultVisibility(ctx.db, teamId, tableName);
+    await recordRowAcl(ctx.db, teamId, tableName, pk, ctx.authContext.user.id, vis);
+  }
   await appendChangeEnvelope(ctx.db, {
     team_id: teamId,
     table_name: tableName,
@@ -16589,23 +17353,7 @@ async function handleUnlinkRow(res, ctx, teamId, tableName, pk) {
     sendJson2(res, { error: "Only the row owner or team creator can unlink" }, 403);
     return;
   }
-  await ctx.db.delete("__lattice_row_links", {
-    team_id: teamId,
-    table_name: tableName,
-    pk
-  });
-  try {
-    await ctx.db.delete(tableName, pk);
-  } catch {
-  }
-  await appendChangeEnvelope(ctx.db, {
-    team_id: teamId,
-    table_name: tableName,
-    pk,
-    op: "unlink",
-    payload_json: null,
-    owner_user_id: link.owner_user_id
-  });
+  await tearDownSharedRow(ctx.db, teamId, tableName, pk, link.owner_user_id);
   sendJson2(res, { ok: true });
 }
 async function handlePushRow(req, res, ctx, teamId, tableName) {
@@ -16676,23 +17424,7 @@ async function handleDeleteRow(res, ctx, teamId, tableName, pk) {
     sendJson2(res, { error: "Only the row owner can delete the row" }, 403);
     return;
   }
-  await ctx.db.delete("__lattice_row_links", {
-    team_id: teamId,
-    table_name: tableName,
-    pk
-  });
-  try {
-    await ctx.db.delete(tableName, pk);
-  } catch {
-  }
-  await appendChangeEnvelope(ctx.db, {
-    team_id: teamId,
-    table_name: tableName,
-    pk,
-    op: "unlink",
-    payload_json: null,
-    owner_user_id: link.owner_user_id
-  });
+  await tearDownSharedRow(ctx.db, teamId, tableName, pk, link.owner_user_id);
   sendJson2(res, { ok: true });
 }
 
@@ -16742,6 +17474,7 @@ async function probeCloud(targetUrl) {
 }
 
 // src/teams/client.ts
+var DIRECT_CLOUD_DEPRECATION_MESSAGE = "Direct postgres:// team-cloud connections are deprecated and do not support row-level security. Create or join a workspace through a hosted Lattice Teams server (an http(s):// URL) instead. Existing direct connections continue to work but should be migrated.";
 var TeamsClient = class {
   constructor(local) {
     this.local = local;
@@ -16774,6 +17507,9 @@ var TeamsClient = class {
    * members join via `redeemInvite`). Returns the new user + bearer
    * token + team summary so the caller can immediately save a
    * connection.
+   *
+   * @param teamName The workspace display name (stored as `team_name` for
+   * backward compatibility — a cloud IS a workspace with members).
    */
   async register(cloudUrl, email, name, teamName) {
     return this.fetchUnauthed(cloudUrl, "POST", "/api/auth/register", {
@@ -16784,7 +17520,7 @@ var TeamsClient = class {
   }
   async redeemInvite(cloudUrl, inviteToken, email, name) {
     if (isPostgresUrl(cloudUrl)) {
-      return redeemInviteDirect(cloudUrl, inviteToken, email, name);
+      throw new Error(DIRECT_CLOUD_DEPRECATION_MESSAGE);
     }
     return this.fetchUnauthed(cloudUrl, "POST", "/api/auth/redeem-invite", {
       invite_token: inviteToken,
@@ -16795,9 +17531,11 @@ var TeamsClient = class {
   // ── High-level orchestration (v1.13+) ───────────────────────────────────
   // Wraps the multi-step flows the GUI's Database panel + library
   // consumers both need: connecting to an existing cloud DB (with
-  // optional team join), and upgrading a non-team cloud into a team
-  // cloud. The HTTP routes in src/gui/dbconfig-routes.ts are thin
-  // shells over these methods.
+  // optional team join), and initializing a fresh cloud DB's owner so
+  // its members + per-table sharing surface exists. A cloud workspace IS
+  // a workspace with members — there is no separate "team" to convert to.
+  // The HTTP routes in src/gui/dbconfig-routes.ts are thin shells over
+  // these methods.
   /**
    * Connect a local project to an existing cloud DB by URL. Probes
    * the target for team status first; if it's a teams DB, the caller
@@ -16846,15 +17584,18 @@ var TeamsClient = class {
     return { probe };
   }
   /**
-   * Upgrade an already-connected cloud DB to a team DB. Two paths
-   * depending on the cloud URL's scheme:
+   * Initialize a fresh cloud DB's owner: register the first member (who
+   * becomes owner) so the cloud's members + per-table sharing surface
+   * exists. This is NOT a "convert a cloud into a team" step — a cloud
+   * workspace IS a workspace with members; this just bootstraps the owner
+   * the first time a cloud is opened. The hosted server path is the only
+   * supported one:
    *
    *   - `http(s)://…` — POST to the cloud's `/api/auth/register` endpoint
-   *     (`lattice serve --team-cloud` is fronting the Postgres).
-   *   - `postgres(ql)://…` — drive the same INSERT sequence directly
-   *     against the cloud Postgres via {@link registerDirectViaPostgres}.
-   *     The HTTP path can't be used here because the browser's Fetch
-   *     API refuses URLs with embedded credentials.
+   *     (a hosted `lattice serve` teams server is fronting the Postgres).
+   *   - `postgres(ql)://…` — rejected: direct postgres:// owner bootstrap
+   *     is deprecated. Row-level security is enforced by the hosted server,
+   *     so it is the only supported connection method for new workspaces.
    *
    * On success writes the bearer token to `~/.lattice/keys/<label>.token`
    * **and** persists the local `__lattice_team_connections` row so the
@@ -16864,8 +17605,11 @@ var TeamsClient = class {
    * the token file, leaving GUI authenticated calls with no
    * `cloud_url` + `my_user_id` + `api_token_encrypted` row to read.
    */
-  async upgradeToTeamCloud(opts) {
-    const reg = isPostgresUrl(opts.cloudUrl) ? await registerDirectViaPostgres(opts.cloudUrl, opts.email, opts.displayName, opts.teamName) : await this.register(opts.cloudUrl, opts.email, opts.displayName, opts.teamName);
+  async registerCloudOwner(opts) {
+    if (isPostgresUrl(opts.cloudUrl)) {
+      throw new Error(DIRECT_CLOUD_DEPRECATION_MESSAGE);
+    }
+    const reg = await this.register(opts.cloudUrl, opts.email, opts.displayName, opts.teamName);
     writeToken(opts.label, reg.raw_token);
     await this.saveConnection({
       team_id: reg.team.id,
@@ -16898,7 +17642,7 @@ var TeamsClient = class {
     }
     try {
       const displayName = opts.displayName?.trim() ? opts.displayName : opts.email;
-      await this.upgradeToTeamCloud({
+      await this.registerCloudOwner({
         label: opts.label,
         cloudUrl: opts.cloudUrl,
         teamName: opts.workspaceName,
@@ -18157,7 +18901,11 @@ async function handleRegisterAndCreate(req, res, ctx) {
     sendJson(res, { error: "cloud_url, email, user_name, team_name required" }, 400);
     return;
   }
-  const reg = isPostgresUrl(cloudUrl) ? await registerDirectViaPostgres(cloudUrl, email, userName, teamName) : await ctx.client.register(cloudUrl, email, userName, teamName);
+  if (isPostgresUrl(cloudUrl)) {
+    sendJson(res, { error: DIRECT_CLOUD_DEPRECATION_MESSAGE }, 400);
+    return;
+  }
+  const reg = await ctx.client.register(cloudUrl, email, userName, teamName);
   await ctx.client.saveConnection({
     team_id: reg.team.id,
     team_name: reg.team.name,
@@ -18449,19 +19197,8 @@ async function getCreatorEmail(db) {
     return null;
   }
 }
-function computeState(type, teamEnabled, label, creatorEmail) {
+function computeState(type, creatorEmail) {
   if (type === "sqlite") return "local";
-  if (!teamEnabled) return "team-cloud-needs-invite";
-  if (!label) {
-    return "team-cloud-needs-invite";
-  }
-  let token = null;
-  try {
-    token = readToken(label);
-  } catch {
-    token = null;
-  }
-  if (!token) return "team-cloud-needs-invite";
   const identity = readIdentity();
   if (creatorEmail !== null && identity.email.length > 0 && creatorEmail.toLowerCase() === identity.email.toLowerCase()) {
     return "team-cloud-creator";
@@ -18469,8 +19206,9 @@ function computeState(type, teamEnabled, label, creatorEmail) {
   return "team-cloud-member";
 }
 function applyTeamMembershipState(info, membership) {
-  if (!membership || info.type !== "postgres" || !info.teamEnabled) return info.state;
-  return membership.joined ? membership.isCreator ? "team-cloud-creator" : "team-cloud-member" : "team-cloud-needs-invite";
+  if (info.type !== "postgres") return info.state;
+  if (membership) return membership.isCreator ? "team-cloud-creator" : "team-cloud-member";
+  return info.state;
 }
 async function describeCurrent(configPath, db) {
   const rawYaml = readFileSync14(configPath, "utf8");
@@ -18492,7 +19230,7 @@ async function describeCurrent(configPath, db) {
   if (labelMatch) {
     const label = labelMatch[1] ?? "";
     const url = getDbCredential(label);
-    const state = computeState("postgres", teamEnabled, label, creatorEmail);
+    const state = computeState("postgres", creatorEmail);
     if (url) {
       const parsed = parsePostgresUrl(url);
       if (parsed) {
@@ -18519,7 +19257,7 @@ async function describeCurrent(configPath, db) {
   }
   if (/^postgres(ql)?:\/\//i.test(dbLine)) {
     const parsed = parsePostgresUrl(dbLine);
-    const state = computeState("postgres", teamEnabled, void 0, creatorEmail);
+    const state = computeState("postgres", creatorEmail);
     return parsed ? {
       type: "postgres",
       state,
@@ -18593,7 +19331,10 @@ async function dispatchDbConfigRoute(req, res, ctx) {
         // without a local `__lattice_team_connections` row (which doesn't
         // exist when the team cloud itself is the active database).
         teamId: ctx.teamMembership?.teamId ?? null,
-        myUserId: ctx.teamMembership?.myUserId ?? null
+        myUserId: ctx.teamMembership?.myUserId ?? null,
+        // Deprecated direct postgres:// team connection present → the SPA
+        // shows the migrate-to-hosted deprecation banner.
+        directCloud: ctx.directCloud
       });
     });
     return true;
@@ -19796,7 +20537,10 @@ async function executeFunction(ctx, name, args) {
     db: ctx.db,
     feed: ctx.feed,
     softDeletable: ctx.softDeletable,
-    source: "ai"
+    source: "ai",
+    // Thread the team through so create/update/delete enforce the row ACL for
+    // the assistant exactly as they do for the HTTP API.
+    team: ctx.team ?? null
   };
   try {
     switch (name) {
@@ -19810,14 +20554,24 @@ async function executeFunction(ctx, name, args) {
       }
       case "list_rows": {
         const table = requireTable(args.table, ctx.validTables);
-        const opts = { limit: 200 };
-        if (ctx.softDeletable.has(table) && args.includeDeleted !== true) {
-          opts.filters = [{ col: "deleted_at", op: "isNull" }];
-        }
+        const includeDeleted = args.includeDeleted === true;
         const cols = ctx.db.getRegisteredColumns(table);
-        opts.orderBy = cols && "created_at" in cols ? "created_at" : ctx.db.getPrimaryKey(table)[0] ?? "id";
-        opts.orderDir = "asc";
-        const rows = await ctx.db.query(table, opts);
+        const orderBy = cols && "created_at" in cols ? "created_at" : ctx.db.getPrimaryKey(table)[0] ?? "id";
+        let rows;
+        if (ctx.team) {
+          rows = await listVisibleRows(ctx.db, ctx.team.teamId, table, ctx.team.myUserId, {
+            limit: 200,
+            orderBy,
+            orderDir: "asc",
+            deleted: ctx.softDeletable.has(table) && includeDeleted ? "any" : "exclude"
+          });
+        } else {
+          const opts = { limit: 200, orderBy, orderDir: "asc" };
+          if (ctx.softDeletable.has(table) && !includeDeleted) {
+            opts.filters = [{ col: "deleted_at", op: "isNull" }];
+          }
+          rows = await ctx.db.query(table, opts);
+        }
         const secretCols = await secretColumnsFor(ctx.db, table);
         return { ok: true, result: rows.map((r) => redactRow(r, secretCols)) };
       }
@@ -19826,6 +20580,9 @@ async function executeFunction(ctx, name, args) {
         const id = requireString3(args.id, "id");
         const row = await ctx.db.get(table, id);
         if (row === null) return { ok: false, error: "Row not found" };
+        if (ctx.team && !await canAccessRow(ctx.db, ctx.team.teamId, table, id, ctx.team.myUserId)) {
+          return { ok: false, error: "Row not found" };
+        }
         return { ok: true, result: redactRow(row, await secretColumnsFor(ctx.db, table)) };
       }
       case "search": {
@@ -19836,10 +20593,18 @@ async function executeFunction(ctx, name, args) {
           tables = tables.filter((t) => want.has(t));
         }
         const limit = typeof args.limit === "number" ? args.limit : 8;
-        const result = await fullTextSearch(ctx.db.adapter, tables, {
+        let result = await fullTextSearch(ctx.db.adapter, tables, {
           query,
           limitPerTable: limit
         });
+        if (ctx.team) {
+          result = await filterSearchGroupsByAcl(
+            ctx.db,
+            ctx.team.teamId,
+            ctx.team.myUserId,
+            result
+          );
+        }
         return { ok: true, result };
       }
       case "create_row": {
@@ -20001,6 +20766,7 @@ var BASE_SYSTEM_PROMPT = [
   "- To relate two tables (link their rows), call create_relationship(table_a, table_b) to get a junction + its two foreign-key columns, then `link` each pair using those columns. If the junction already exists, just `link`.",
   "- Use the exact table names from the schema (or one you just created) \u2014 never guess a name for a table that should already exist.",
   "- Prefer reading (list_rows, get_row) before writing.",
+  '- When you point the user at a specific row/object \u2014 especially if they ask you to "link", "open", or "show" it \u2014 make it clickable with an INLINE link in this exact form: [short label](lattice://<table>/<id>), using the real table name and the row id from your tool results (e.g. [the offer contract](lattice://contracts/9b7c60f0-fbc2-4f87-a550-c59e3c5d761f)). It renders as a pill that opens that object in the GUI. Only link ids you actually retrieved \u2014 never invent one \u2014 and prefer the user-facing record (the contract/person/etc. row) over an internal `files` id.',
   "- Attached files are rows in the `files` table; a file's full text content (CSV, document, etc.) is in its `extracted_text` column. To work from an attached file, read the relevant `files` row(s) and parse `extracted_text` \u2014 never guess a file's contents.",
   '- A tool result that contains "error" means the call FAILED. Do NOT claim success or proceed as if it returned data \u2014 read the error, correct your arguments, and retry.',
   "- For bulk work, emit several tool calls in one turn instead of one at a time. Every change is recorded in version history and can be undone.",
@@ -20496,15 +21262,14 @@ var REHYDRATE_MAX_BYTES = 24e3;
 function rehydrateEnabled() {
   return process.env.LATTICE_CHAT_REHYDRATE !== "false";
 }
-async function persistMessage(db, threadId, role, text, turns) {
+async function persistMessage(db, threadId, role, text, turns, startedAt) {
+  const payload = turns && turns.length > 0 ? { text, turns } : { text };
+  if (startedAt) payload.startedAt = startedAt;
   await db.insert("chat_messages", {
     id: crypto.randomUUID(),
     thread_id: threadId,
     role,
-    // `text` stays for backward-compat (old clients + the model-history replay);
-    // `turns` carries the rich structure so a reloaded conversation shows the
-    // same text bubbles + tool pills as the live stream, not one text wall.
-    content_json: JSON.stringify(turns && turns.length > 0 ? { text, turns } : { text }),
+    content_json: JSON.stringify(payload),
     source: role === "user" ? "gui" : "ai"
   });
 }
@@ -20526,11 +21291,17 @@ async function dispatchChatRoute(req, res, ctx) {
     const messages = rows.filter((r) => r.thread_id === threadId2 && !r.deleted_at).map((r) => {
       let text = "";
       let turns2;
+      let startedAt;
       try {
         const parsed = JSON.parse(asStr(r.content_json, "{}"));
         text = parsed.text ?? "";
+        if (typeof parsed.startedAt === "string") startedAt = parsed.startedAt;
         if (Array.isArray(parsed.turns)) {
-          turns2 = parsed.turns.map((t) => ({ text: t.text, tools: t.tools }));
+          turns2 = parsed.turns.map((t) => ({
+            text: t.text,
+            tools: t.tools,
+            ...t.events ? { events: t.events } : {}
+          }));
         }
       } catch {
       }
@@ -20538,6 +21309,7 @@ async function dispatchChatRoute(req, res, ctx) {
         role: asStr(r.role),
         text,
         ...turns2 ? { turns: turns2 } : {},
+        ...startedAt ? { startedAt } : {},
         created_at: asStr(r.created_at)
       };
     }).sort((a, b) => a.created_at.localeCompare(b.created_at));
@@ -20590,12 +21362,26 @@ async function dispatchChatRoute(req, res, ctx) {
     validTables: new Set([...ctx.validTables].filter((t) => !ASSISTANT_HIDDEN_TABLES.has(t))),
     junctionTables: new Set([...ctx.junctionTables].filter((t) => !ASSISTANT_HIDDEN_TABLES.has(t))),
     softDeletable: ctx.softDeletable,
+    ...ctx.team ? { team: ctx.team } : {},
     ...ctx.createEntity ? { createEntity: ctx.createEntity } : {},
     ...ctx.createJunction ? { createJunction: ctx.createJunction } : {},
     ...ctx.deleteEntity ? { deleteEntity: ctx.deleteEntity } : {}
   };
+  const turnStartedAt = (/* @__PURE__ */ new Date()).toISOString();
   let assistantText = "";
   const turns = [];
+  const unsubscribeFeed = ctx.feed.subscribe((fe) => {
+    if (fe.source !== "ai") return;
+    const cur = turns[turns.length - 1];
+    if (cur)
+      cur.events.push({
+        op: fe.op,
+        table: fe.table,
+        rowId: fe.rowId,
+        summary: fe.summary ?? "",
+        ts: fe.ts
+      });
+  });
   try {
     const client = createAnthropicClient(auth);
     const temperature = aggressivenessToTemperature(getAggressiveness());
@@ -20611,7 +21397,7 @@ async function dispatchChatRoute(req, res, ctx) {
       }
     })) {
       if (ev.type === "assistant_message_start") {
-        turns.push({ text: "", tools: [], toolCalls: [] });
+        turns.push({ text: "", tools: [], events: [], toolCalls: [] });
       } else if (ev.type === "text_delta") {
         assistantText += ev.delta;
         const cur = turns[turns.length - 1];
@@ -20634,16 +21420,19 @@ async function dispatchChatRoute(req, res, ctx) {
       res.write(formatSseFrame({ type: "done" }));
     } catch {
     }
+  } finally {
+    unsubscribeFeed();
   }
   res.end();
   if (threadId) {
     const cleanTurns = turns.map((t) => ({
       text: t.text,
       tools: t.tools.map((x) => ({ name: x.name, isError: x.isError })),
+      ...t.events.length > 0 ? { events: t.events } : {},
       ...t.toolCalls.length > 0 ? { toolCalls: t.toolCalls } : {}
-    })).filter((t) => t.text.length > 0 || t.tools.length > 0);
+    })).filter((t) => t.text.length > 0 || t.tools.length > 0 || (t.events?.length ?? 0) > 0);
     try {
-      await persistMessage(ctx.db, threadId, "assistant", assistantText, cleanTurns);
+      await persistMessage(ctx.db, threadId, "assistant", assistantText, cleanTurns, turnStartedAt);
     } catch (e) {
       console.warn("[chat] persist assistant message failed:", e.message);
     }
@@ -21696,6 +22485,41 @@ async function countManyPostgres(adapter, tableNames) {
   }
   return out;
 }
+var EXACT_COUNT_CAP = 50;
+async function exactCountMany(adapter, tableNames, softDeleteTables) {
+  const out = /* @__PURE__ */ new Map();
+  if (tableNames.length === 0) return out;
+  if (!adapter.getAsync) return out;
+  let names = tableNames;
+  if (names.length > EXACT_COUNT_CAP) {
+    const dropped = names.length - EXACT_COUNT_CAP;
+    console.warn(
+      `[count-many] exact-count subset capped at ${String(EXACT_COUNT_CAP)} tables; ${String(dropped)} suspicious table(s) keep their approximate count this pass`
+    );
+    names = names.slice(0, EXACT_COUNT_CAP);
+  }
+  const selects = names.map((name, i) => {
+    assertSafeIdentifier(name, "table");
+    const where = softDeleteTables.has(name) ? ` WHERE "deleted_at" IS NULL` : "";
+    return `(SELECT count(*) FROM "${name}"${where}) AS c${String(i)}`;
+  });
+  let row;
+  try {
+    row = await adapter.getAsync(`SELECT ${selects.join(", ")}`);
+  } catch (err) {
+    console.warn(
+      `[count-many] exact-count fallback skipped (${err.message}); using approximate counts`
+    );
+    return out;
+  }
+  if (!row) return out;
+  names.forEach((name, i) => {
+    const v = row[`c${String(i)}`];
+    const n = typeof v === "bigint" ? Number(v) : Number(v);
+    if (Number.isFinite(n) && n >= 0) out.set(name, n);
+  });
+  return out;
+}
 
 // src/gui/server.ts
 function sendText(res, body, status = 200, contentType = "text/plain; charset=utf-8") {
@@ -21754,17 +22578,64 @@ async function entitiesWithCounts(db, configPath, outputDir, teamContext) {
   if (teamContext) {
     allTables = allTables.filter((t) => isVisibleInTeam(t.name, teamContext));
   }
+  const rowVisDefaults = /* @__PURE__ */ new Map();
+  const sharedCreatedBy = /* @__PURE__ */ new Map();
+  if (teamContext) {
+    const sharedObjs = await db.query("__lattice_shared_objects", {
+      filters: [
+        { col: "team_id", op: "eq", val: teamContext.teamId },
+        { col: "deleted_at", op: "isNull" }
+      ]
+    });
+    for (const r of sharedObjs) {
+      rowVisDefaults.set(
+        String(r.table_name),
+        r.default_row_visibility === "everyone" ? "everyone" : "private"
+      );
+      if (typeof r.created_by_user_id === "string") {
+        sharedCreatedBy.set(String(r.table_name), r.created_by_user_id);
+      }
+    }
+  }
+  let visibleCounts = /* @__PURE__ */ new Map();
+  if (teamContext) {
+    const tc = teamContext;
+    const specs = allTables.map((t) => {
+      const def = rowVisDefaults.get(t.name) ?? "private";
+      const owner = tc.owners.get(t.name) ?? sharedCreatedBy.get(t.name) ?? "";
+      return {
+        table: t.name,
+        noAclVisible: def === "everyone" || tc.myUserId !== "" && owner === tc.myUserId
+      };
+    });
+    visibleCounts = await db.countVisibleMany(specs, {
+      teamId: tc.teamId,
+      userId: tc.myUserId
+    });
+  }
   const adapter = db._adapter;
-  const useBatched = adapter.dialect === "postgres" && typeof adapter.allAsync === "function";
+  const useBatched = !teamContext && adapter.dialect === "postgres" && typeof adapter.allAsync === "function";
   const approxCounts = useBatched ? await countManyPostgres(
     adapter,
     allTables.map((t) => t.name)
   ) : /* @__PURE__ */ new Map();
+  let exactCounts = /* @__PURE__ */ new Map();
+  if (useBatched) {
+    const suspicious = allTables.map((t) => t.name).filter((n) => (approxCounts.get(n) ?? 0) === 0);
+    if (suspicious.length > 0) {
+      const softDeleteTables = new Set(
+        allTables.filter((t) => t.columns.includes("deleted_at")).map((t) => t.name)
+      );
+      exactCounts = await exactCountMany(adapter, suspicious, softDeleteTables);
+    }
+  }
   const enrichedTables = await Promise.all(
     allTables.map(async (t) => {
       let rowCount;
-      if (useBatched) {
-        rowCount = approxCounts.get(t.name) ?? null;
+      if (teamContext) {
+        rowCount = visibleCounts.get(t.name) ?? null;
+      } else if (useBatched) {
+        rowCount = exactCounts.get(t.name) ?? approxCounts.get(t.name) ?? null;
       } else {
         rowCount = t.columns.includes("deleted_at") ? await db.count(t.name, { filters: [{ col: "deleted_at", op: "isNull" }] }) : await db.count(t.name);
       }
@@ -21778,6 +22649,8 @@ async function entitiesWithCounts(db, configPath, outputDir, teamContext) {
         base.ownedByMe = teamContext.owners.get(t.name) === teamContext.myUserId;
         const ver = teamContext.sharedVersions.get(t.name);
         if (ver !== void 0) base.schemaVersion = ver;
+        const dv = rowVisDefaults.get(t.name);
+        if (dv) base.defaultRowVisibility = dv;
       }
       return base;
     })
@@ -21786,6 +22659,14 @@ async function entitiesWithCounts(db, configPath, outputDir, teamContext) {
 }
 var FRESHNESS_COLS = ["updated_at", "created_at", "ts"];
 var DASHBOARD_STALE_DAYS = 14;
+function requireTeamContext(active, res) {
+  const ctx = active.teamContext;
+  if (!ctx) {
+    sendJson(res, { error: "Row permissions require a team cloud" }, 400);
+    return null;
+  }
+  return ctx;
+}
 function operatorOwnsTable(teamContext, table) {
   if (!teamContext) return true;
   return teamContext.owners.get(table) === teamContext.myUserId;
@@ -22075,6 +22956,13 @@ async function openConfig(configPath, outputDir, autoRender = false) {
       if (!isVisibleInTeam(name, teamContext)) validTables.delete(name);
     }
   }
+  let directTeamConnection = false;
+  try {
+    const conns = await teamsClient.listConnections();
+    directTeamConnection = conns.some((c) => isPostgresUrl(c.cloud_url));
+  } catch (e) {
+    console.warn("[openConfig] could not check for direct team connections:", e.message);
+  }
   let realtime = null;
   if (db.getDialect() === "postgres") {
     try {
@@ -22115,6 +23003,7 @@ async function openConfig(configPath, outputDir, autoRender = false) {
     teamsClient,
     validTables,
     teamContext,
+    directTeamConnection,
     junctionTables,
     entityContextByTable,
     manifest,
@@ -22218,6 +23107,18 @@ async function registerTeamCloudTables(db) {
     await db.defineLate(name, def);
   }
   await installCloudInternalTriggers(db);
+  await installRowPermsSchema(db);
+}
+async function emitRowChangeSignal(db, team, table, pk) {
+  const row = await db.get(table, pk);
+  await appendChangeEnvelope(db, {
+    team_id: team.teamId,
+    table_name: table,
+    pk,
+    op: "upsert",
+    payload_json: row ? JSON.stringify(row) : null,
+    owner_user_id: team.myUserId
+  });
 }
 async function syncUserIdentityRow(db) {
   const identity = readIdentity();
@@ -22462,34 +23363,6 @@ data: ${JSON.stringify(data)}
             } catch {
             }
           };
-          try {
-            const auditBackfill = await active.db.query("_lattice_gui_audit", {
-              orderBy: "ts",
-              orderDir: "desc",
-              limit: 20
-            });
-            for (const a of auditBackfill.reverse()) {
-              const json = a.operation === "delete" ? a.before_json : a.after_json;
-              let labelRow;
-              if (json) {
-                try {
-                  labelRow = JSON.parse(json);
-                } catch {
-                  labelRow = void 0;
-                }
-              }
-              writeFeed({
-                seq: 0,
-                table: a.table_name,
-                op: a.operation,
-                rowId: a.row_id,
-                source: "gui",
-                ts: a.ts,
-                summary: feedSummary(a.operation, a.table_name, labelRow)
-              });
-            }
-          } catch {
-          }
           const keepalive = setInterval(() => {
             try {
               res.write(`: keepalive
@@ -22571,10 +23444,19 @@ data: ${JSON.stringify(data)}
             );
             tables = tables.filter((t) => want.has(t));
           }
-          sendJson(
-            res,
-            await fullTextSearch(active.db.adapter, tables, { query: q, limitPerTable: limit })
-          );
+          let result = await fullTextSearch(active.db.adapter, tables, {
+            query: q,
+            limitPerTable: limit
+          });
+          if (active.teamContext) {
+            result = await filterSearchGroupsByAcl(
+              active.db,
+              active.teamContext.teamId,
+              active.teamContext.myUserId,
+              result
+            );
+          }
+          sendJson(res, result);
           return;
         }
         if (method === "GET" && pathname === "/api/team/users") {
@@ -22775,6 +23657,78 @@ data: ${JSON.stringify(data)}
           sendJson(res, result.body, result.status);
           return;
         }
+        {
+          const m = /^\/api\/tables\/([^/]+)\/rows\/([^/]+)\/visibility$/.exec(pathname);
+          if (method === "POST" && m) {
+            const ctx = requireTeamContext(active, res);
+            if (!ctx) return;
+            const table = decodeURIComponent(m[1] ?? "");
+            const rowId = decodeURIComponent(m[2] ?? "");
+            const body = await readJson(req);
+            const vis = body.visibility;
+            if (vis !== "private" && vis !== "everyone" && vis !== "custom") {
+              sendJson(res, { error: "visibility must be private, everyone, or custom" }, 400);
+              return;
+            }
+            await setRowVisibility(active.db, ctx.teamId, table, rowId, ctx.myUserId, vis);
+            await emitRowChangeSignal(active.db, ctx, table, rowId);
+            sendJson(res, { ok: true });
+            return;
+          }
+        }
+        {
+          const m = /^\/api\/tables\/([^/]+)\/rows\/([^/]+)\/grants$/.exec(pathname);
+          if (method === "POST" && m) {
+            const ctx = requireTeamContext(active, res);
+            if (!ctx) return;
+            const table = decodeURIComponent(m[1] ?? "");
+            const rowId = decodeURIComponent(m[2] ?? "");
+            const body = await readJson(req);
+            let granteeId = typeof body.user_id === "string" ? body.user_id : "";
+            if (!granteeId && typeof body.email === "string") {
+              granteeId = await resolveUserIdByEmail(active.db, body.email) ?? "";
+            }
+            if (!granteeId) {
+              sendJson(res, { error: "user_id or a resolvable email is required" }, 400);
+              return;
+            }
+            await addRowGrant(active.db, ctx.teamId, table, rowId, granteeId, ctx.myUserId);
+            await emitRowChangeSignal(active.db, ctx, table, rowId);
+            sendJson(res, { ok: true });
+            return;
+          }
+        }
+        {
+          const m = /^\/api\/tables\/([^/]+)\/rows\/([^/]+)\/grants\/([^/]+)$/.exec(pathname);
+          if (method === "DELETE" && m) {
+            const ctx = requireTeamContext(active, res);
+            if (!ctx) return;
+            const table = decodeURIComponent(m[1] ?? "");
+            const rowId = decodeURIComponent(m[2] ?? "");
+            const granteeId = decodeURIComponent(m[3] ?? "");
+            await removeRowGrant(active.db, ctx.teamId, table, rowId, granteeId, ctx.myUserId);
+            await emitRowChangeSignal(active.db, ctx, table, rowId);
+            sendJson(res, { ok: true });
+            return;
+          }
+        }
+        {
+          const m = /^\/api\/schema\/entities\/([^/]+)\/default-row-visibility$/.exec(pathname);
+          if (method === "POST" && m) {
+            const ctx = requireTeamContext(active, res);
+            if (!ctx) return;
+            const table = decodeURIComponent(m[1] ?? "");
+            const body = await readJson(req);
+            const vis = body.visibility;
+            if (vis !== "private" && vis !== "everyone") {
+              sendJson(res, { error: "visibility must be private or everyone" }, 400);
+              return;
+            }
+            await setTableDefaultVisibility(active.db, ctx.teamId, table, ctx.myUserId, vis);
+            sendJson(res, { ok: true });
+            return;
+          }
+        }
         if (method === "GET" && pathname === "/api/gui-meta/columns") {
           const rows = await active.db.query("_lattice_gui_column_meta", {});
           const out = {};
@@ -23869,6 +24823,10 @@ data: ${JSON.stringify(data)}
             sendJson(res, { error: `Unknown table: ${table}` }, 400);
             return;
           }
+          if (!await canAccessRow(active.db, tctx.teamId, table, rowId, tctx.myUserId)) {
+            sendJson(res, { error: "Row not found" }, 404);
+            return;
+          }
           const limit = Math.min(200, Math.max(1, Number(url2.searchParams.get("limit") ?? "50")));
           const rows = await active.db.query("__lattice_change_log", {
             filters: [
@@ -23903,20 +24861,7 @@ data: ${JSON.stringify(data)}
             sendJson(res, { error: `Unknown table: ${table}` }, 400);
             return;
           }
-          const scan = await active.db.query("__lattice_change_log", {
-            filters: [
-              { col: "team_id", op: "eq", val: tctx.teamId },
-              { col: "table_name", op: "eq", val: table }
-            ],
-            orderBy: "seq",
-            orderDir: "desc",
-            limit: 2e3
-          });
-          const edits = {};
-          for (const r of scan) {
-            if (!r.pk || edits[r.pk]) continue;
-            edits[r.pk] = { ownerUserId: r.owner_user_id, at: r.client_ts ?? r.created_at };
-          }
+          const edits = await visibleRowEdits(active.db, tctx.teamId, table, tctx.myUserId);
           sendJson(res, { edits });
           return;
         }
@@ -23958,13 +24903,31 @@ data: ${JSON.stringify(data)}
               const limit = Number(url2.searchParams.get("limit") ?? "500");
               const offset = Number(url2.searchParams.get("offset") ?? "0");
               const deletedMode = url2.searchParams.get("deleted");
-              const queryOpts = { limit, offset };
-              if (active.softDeletable.has(table) && deletedMode !== "any") {
-                queryOpts.filters = [
-                  { col: "deleted_at", op: deletedMode === "only" ? "isNotNull" : "isNull" }
-                ];
+              let rows;
+              if (active.teamContext) {
+                const tc = active.teamContext;
+                rows = await listVisibleRows(active.db, tc.teamId, table, tc.myUserId, {
+                  limit,
+                  offset,
+                  deleted: deletedMode === "any" ? "any" : deletedMode === "only" ? "only" : "exclude"
+                });
+                const summaries = await rowAccessSummaries(
+                  active.db,
+                  tc.teamId,
+                  table,
+                  tc.myUserId,
+                  rows.map((r) => String(r.id))
+                );
+                rows = rows.map((r) => ({ ...r, _access: summaries.get(String(r.id)) ?? null }));
+              } else {
+                const queryOpts = { limit, offset };
+                if (active.softDeletable.has(table) && deletedMode !== "any") {
+                  queryOpts.filters = [
+                    { col: "deleted_at", op: deletedMode === "only" ? "isNotNull" : "isNull" }
+                  ];
+                }
+                rows = await active.db.query(table, queryOpts);
               }
-              const rows = await active.db.query(table, queryOpts);
               sendJson(res, { rows });
               return;
             }
@@ -23981,6 +24944,19 @@ data: ${JSON.stringify(data)}
                 sendJson(res, { error: "Row not found" }, 404);
                 return;
               }
+              if (active.teamContext) {
+                const tc = active.teamContext;
+                if (!await canAccessRow(active.db, tc.teamId, table, id, tc.myUserId)) {
+                  sendJson(res, { error: "Row not found" }, 404);
+                  return;
+                }
+                const summary = (await rowAccessSummaries(active.db, tc.teamId, table, tc.myUserId, [id])).get(
+                  id
+                ) ?? null;
+                const access = summary?.ownedByMe ? { ...summary, grantees: await rowGrantees(active.db, tc.teamId, table, id) } : summary;
+                sendJson(res, { ...row, _access: access });
+                return;
+              }
               sendJson(res, row);
               return;
             }
@@ -24073,6 +25049,7 @@ data: ${JSON.stringify(data)}
             validTables: active.validTables,
             junctionTables: active.junctionTables,
             softDeletable: active.softDeletable,
+            team: active.teamContext ? { teamId: active.teamContext.teamId, myUserId: active.teamContext.myUserId } : null,
             // The assistant can create tables + relationships on request — same
             // audited, no-reopen primitives the Context Constructor uses.
             createEntity: (name, columns) => createUserEntity(active, name, columns, sessionId),
@@ -24122,6 +25099,7 @@ data: ${JSON.stringify(data)}
               teamId: active.teamContext.teamId,
               myUserId: active.teamContext.myUserId
             } : null,
+            directCloud: active.directTeamConnection,
             swap: async () => {
               const next = await openConfig(active.configPath, active.outputDir, autoRender);
               await disposeActive(active);
@@ -24133,6 +25111,14 @@ data: ${JSON.stringify(data)}
         sendJson(res, { error: "Not found" }, 404);
       } catch (err) {
         const e = err;
+        if (e.code === "row_access_denied") {
+          sendJson(res, { error: "Row not found" }, 404);
+          return;
+        }
+        if (e.code === "row_owner_only") {
+          sendJson(res, { error: e.message }, 403);
+          return;
+        }
         console.error(
           `[gui] ${req.method ?? "?"} ${req.url ?? "?"} failed: ${e.message}
 ${e.stack ?? ""}`
@@ -24845,7 +25831,7 @@ function printHelp() {
       "  status      Dry-run reconcile \u2014 show what would change without writing",
       "  watch       Poll for changes and re-render on each cycle",
       "  gui         Start a local browser GUI for exploring Lattice context",
-      "  serve       Start a server-mode lattice (use --team-cloud for Lattice Teams)",
+      "  serve       Start a server-mode lattice (add --team-cloud to host a shared cloud for remote members)",
       "  teams       Manage Lattice Teams (run `lattice teams help` for subcommands)",
       "  update      Upgrade latticesql to the latest version",
       "",
@@ -24890,7 +25876,11 @@ function printHelp() {
       "  --output <dir>         Output directory for rendered context (default: ./context)",
       "  --host <addr>          Bind address (default: 127.0.0.1; use 0.0.0.0 to expose)",
       "  --port <number>        Port (default: 4317; auto-increments if busy)",
-      "  --team-cloud           Enable Lattice Teams cloud mode (bearer auth required)",
+      "  --team-cloud           Host this cloud as a shared server for remote members (bearer auth).",
+      "                         A cloud already IS a workspace with members; this only adds the",
+      "                         auth-gated HTTP surface so other people can connect. Omit it to",
+      "                         open the cloud yourself (you connect directly; eye-icon row",
+      "                         permissions are active).",
       "",
       "Options (init / workspace):",
       "  --root <dir>           The .lattice root location (default: discovered or ./.lattice)",
@@ -25134,7 +26124,7 @@ async function runServe(args) {
       openBrowser: false,
       teamCloud: args.teamCloud
     });
-    const label = args.teamCloud ? "Lattice team cloud" : "Lattice server";
+    const label = args.teamCloud ? "Lattice shared cloud server" : "Lattice server";
     console.log(`${label} listening on ${args.host}:${String(handle.port)} (${handle.url})`);
     console.log("Press Ctrl+C to stop.");
     const shutdown = () => {