zz-meridian 0.27.1 → 0.29.0

package/README.md

@@ -80,6 +80,11 @@ styles) and `src/app.config.ts` for the new flags and records them in the manife
 refuses when one of those outputs was edited, while an update is open, or on a dirty tree (unless `--allow-dirty`). Run
 it with the version the manifest records. The project's own `pnpm brand` still works, but its changes count as your edits.
 
+The standard a project on Meridian is built to is
+[data-layers.md](https://github.com/zhixuan312/zz-meridian/blob/main/docs/data-layers.md): the four layers between a
+database and the screen, the contract a backend answers, and the six rules a project switches on in its own
+`scripts/check.local.ts`.
+
 Requires Node 22.18 or newer. The default `pnpm verify` runs without Google Chrome and reports the browser checks as not run; `--full`, `--timed` and `--perf` need it.
 
 ## What this package does not do

package/dist/migrations.js

@@ -230,6 +230,60 @@ function viewToolCalls(src) {
 }
 // ── The registry ─────────────────────────────────────────────────────────────────────────────────────
 const GATE_AND_BUILD = ['gate', 'build'];
+/**
+ * The thirty-eight modules 0.28.0 moved into `src/logic/`, as the path each left and the path it went to: the figures
+ * and sentences that were `src/views/`'s, the status list's summary, and the alerts the dashboard layout reads.
+ */
+const MOVED_TO_LOGIC = [
+    ['src/data/alerts.ts', 'src/logic/alerts.ts'],
+    ['src/components/patterns/status-list/summarise.ts', 'src/logic/summarise.ts'],
+    ...['customer-context', 'customer-explore', 'customers-context', 'customers-explore', 'fact-insight',
+        'home-context', 'home-explore', 'home-parts', 'key-scopes', 'keys-context', 'keys-explore', 'main-summary',
+        'members-context', 'members-explore', 'now-context', 'now-explore', 'now-parts', 'releases-context',
+        'releases-explore', 'request-context', 'request-explore', 'requests-context', 'requests-explore',
+        'revenue-context', 'revenue-explore', 'revenue-parts', 'services-context', 'services-explore',
+        'tests-context', 'tests-explore', 'tickets-context', 'tickets-explore', 'tools', 'usage-context',
+        'usage-explore', 'usage-parts',
+    ].map((name) => [`src/views/${name}.ts`, `src/logic/${name}.ts`]),
+];
+/** The paths those modules left, without their extension, as an import resolves them. */
+const MOVED_FROM = new Set(MOVED_TO_LOGIC.map(([from]) => from.replace(/\.ts$/, '')));
+/**
+ * The symbols that left a shipped card for the logic layer: `afterStart` was exported by the incident card's own module
+ * and `summarise` re-exported by the status list's. Both cards are Meridian's, so the update replaces them and a team
+ * file that imported either symbol from the card stops compiling — a break the moved paths alone do not report.
+ */
+const REMOVED_CARD_EXPORTS = [
+    ['src/components/patterns/incident-card', 'afterStart'],
+    ['src/components/patterns/status-list', 'summarise'],
+];
+/** Each moved module as "the path it left → the path it went to", for the migration's instruction. */
+const MOVED_LIST = MOVED_TO_LOGIC.map(([from, to]) => `\`${from}\` → \`${to}\``).join(', ');
+/**
+ * Whether one of the team's files reads a symbol that left a managed module — by naming it in an import list, through
+ * a namespace (`card.afterStart(…)`), or by handing it on with a re-export. `removedExportReaders` below reads the same
+ * three shapes for 0.16.0's removals; a symbol is named in all three, and each stops compiling once the module is replaced.
+ */
+function readsRemovedExport(rel, src, module, symbols) {
+    const escapes = (name) => name.replace(/\$/g, '\\$');
+    const reading = importsOf(rel, src).some(({ from, names, namespace }) => from === module && (names.some((n) => symbols.includes(n))
+        || (namespace !== null && symbols.some((s) => new RegExp(`(?<![\\w$.])${escapes(namespace)}\\.${s}\\b`).test(src)))));
+    if (reading)
+        return true;
+    for (const m of src.matchAll(/^\s*export\s+(?:type\s+)?(?:\*|\{([^}]*)\})\s*from\s+(['"])([^'"]+)\2/gm)) {
+        if (resolvedImport(rel, m[3]) !== module)
+            continue;
+        // `export *` hands on every symbol, the removed one among them.
+        if (m[1] === undefined)
+            return true;
+        if (m[1].split(',').map((s) => s.trim().replace(/^type\s+/, '').split(/\s+as\s+/)[0]).some((n) => symbols.includes(n)))
+            return true;
+    }
+    return false;
+}
+/** The team's files that import a moved module from the path it left, or a symbol from a card it no longer lives on. */
+const importsAMovedModule = (root) => matching(root, (rel, src) => importsOf(rel, src).some(({ from }) => MOVED_FROM.has(from))
+    || REMOVED_CARD_EXPORTS.some(([module, symbol]) => readsRemovedExport(rel, src, module, [symbol])));
 export const RELEASE_MIGRATIONS = [
     {
         id: 'verify-modes',
@@ -478,6 +532,14 @@ export const RELEASE_MIGRATIONS = [
         instructions: 'Bring `tests/table-cut-cell.test.tsx` over from the release as it has it. Since 0.26.0 `src/components/ui/table/index.tsx` lays a table out as a grid whose rows are subgrids: every column is as wide as its content, the spare is shared equally between the gaps, and a `grow` column\'s floor is `min-w-40` at every width, without the `@min-[672px]:min-w-64` it had from a 672px table. A test of your own that expects that class expects `min-w-40` alone. A `TableCell` of your own with a `colSpan` takes one track of the grid, so it draws in the first column only: a row that should run the width of the table, such as an empty state, is drawn outside the table, or as a `DataTable` `empty`.',
         checks: ['gate'],
     },
+    {
+        id: 'four-layers',
+        since: '0.28.0',
+        applies: importsAMovedModule,
+        summary: "The template's figures and sentences moved into `src/logic/`: thirty-eight modules left `src/views/` and `src/data/`.",
+        instructions: `Read "The four layers" and "The path an existing product follows" in references/data-layers.md. Thirty-eight modules moved into the logic layer, and each import of one in your own \`src/views/\` producers and pages names the path it left: ${MOVED_LIST}. Rewrite each import to the path the module has now, or move your own module beside the work it does. Two symbols left a card of Meridian's, and both must be rewritten because the update replaces the card: \`afterStart\`, which the incident card exported, is \`@/logic/after-start\`, and \`summarise\`, which the status list re-exported, is \`@/logic/summarise\`. Every other path your own files name is still there, so a project that imported neither symbol keeps building as it was. The six layer rules stay off until your own \`scripts/check.local.ts\` exports \`fourLayers = true\`; turn them on once your figures have moved, and the gate and the build are what show the work is done.`,
+        checks: GATE_AND_BUILD,
+    },
 ];
 /**
  * A test of the rail that stands over a fake `ResizeObserver` answering `observe` with nothing (0.16.2). The lookbehind

package/dist/ownership.js

@@ -2,23 +2,40 @@ const HASH = /^sha256-[0-9a-f]{64}$/;
 const SEMVER = /^\d+\.\d+\.\d+$/;
 /** The library modules Meridian's components and gates import; the rest of src/lib belongs to the template's pages. */
 export const LIB = ['cn', 'format', 'format-date', 'period', 'color', 'host', 'preferences', 'csv', 'safe-markdown', 'logo', 'collection', 'explore', 'live', 'shared-context', 'agent-guidance', 'insight', 'facts'].map((n) => `src/lib/${n}.ts`);
-/** The single files adopt copies besides the folders and the library: all of them must be in a payload that is whole. */
-export const FIXED = [...LIB, 'src/lib/assistant/prompt.ts', 'src/views/console-chrome.tsx', 'tests/setup.ts'];
+/**
+ * The single files adopt copies besides the folders and the library: all of them must be in a payload that is whole.
+ * The three `src/logic/` helpers are here because shipped components import them; the rest of `src/logic/` is the
+ * team's own figures and no other module under it is delivered.
+ */
+export const FIXED = [
+    ...LIB, 'src/lib/assistant/prompt.ts', 'src/views/console-chrome.tsx', 'tests/setup.ts',
+    'src/logic/after-start.ts', 'src/logic/derivations.ts', 'src/logic/summarise.ts',
+];
 /** The one rule, a plain-English line per clause. `references/ownership.md` renders it, so the guidance cannot drift. */
 export const OWNERSHIP = [
     'Managed: the payload files under `tokens/`, `src/styles/` and `src/components/`, except each component\'s `README.md` and `preview.tsx`.',
     'Managed: the distributed scripts under `scripts/`, except `scripts/verify.config.ts`, the size baseline `optional:scripts/verify.baseline.json` (first-load JS and the HTML of each page) and a team-local `optional:scripts/check.local.ts`.',
     'Managed: the library helpers `src/lib/cn.ts`, `src/lib/format.ts`, `src/lib/format-date.ts`, `src/lib/period.ts`, `src/lib/color.ts`, `src/lib/host.ts`, `src/lib/preferences.ts`, `src/lib/csv.ts`, `src/lib/safe-markdown.ts`, `src/lib/logo.ts`, `src/lib/collection.ts`, `src/lib/explore.ts`, `src/lib/live.ts`, `src/lib/shared-context.ts`, `src/lib/agent-guidance.ts`, `src/lib/insight.ts` and `src/lib/facts.ts`, and the assistant prompt `src/lib/assistant/prompt.ts`.',
-    'Managed: `src/views/console-chrome.tsx` and `tests/setup.ts`.',
+    'Managed: the three `src/logic/` helpers a shipped component imports — `src/logic/after-start.ts`, `src/logic/derivations.ts` and `src/logic/summarise.ts` — so a payload\'s cards build in an adopted project; every other module under `src/logic/` is the team\'s.',
+    'Managed: `src/views/console-chrome.tsx`, `tests/setup.ts`, and — in a project `create` made — every test the release ships. A shipped test pins the behaviour of the module it covers, so a release that changes one changes the other; a test the team edits is staged for its decision like any other edited file.',
     'Managed: `optional:scripts/package.json`, only when the adopt or create that set the project up generated it for this project shape.',
     'Managed: both installed skill trees, `optional:.agents/skills/zz-meridian/` and `optional:.claude/skills/zz-meridian/`, taken from the release\'s skill payload.',
     'Managed: the brand token and stylesheet paths under `tokens/` and `src/styles/` that the release generated from the recorded brand.',
-    'Team-owned: every other product path, for example `src/app.config.ts`, `optional:src/views/`, `optional:src/data/`, `optional:app/`, `optional:docs/`, `AGENTS.md` and `package.json`.',
+    'Team-owned: every other product path, for example `src/app.config.ts`, `optional:src/views/`, `optional:src/data/`, `optional:src/logic/`, `optional:app/`, `optional:docs/`, `AGENTS.md` and `package.json`.',
     'Team-preserved: a path that was once recorded but is no longer managed, and any team file inside a managed folder, is never changed or deleted by an update.',
     'Kept: a path in the keep register (`optional:.meridian/keep.json`) is left as the team has it. When the new release removes it, it is retired-kept: still left, and recorded as retired.',
 ];
 /** The rule as a markdown bullet list, for `references/ownership.md`. */
 export const renderOwnership = () => OWNERSHIP.map((l) => `- ${l}`).join('\n');
+/**
+ * The managed set as one path pattern, for a caller that holds a manifest but no payload list — the consumer smoke checks
+ * a manifest read from a tarball it never enumerates. `managedPaths` is the rule; this is that rule said once more in a
+ * regex, and `tests/cli-ownership.test.ts` holds the two together over the payload paths it knows. The tests clause is the
+ * `create` route's, so it is permissive for an adopted project — whose manifest never names a test but `tests/setup.ts`.
+ */
+export const MANAGED_PATH = /^(tokens\/|src\/styles\/|src\/components\/|scripts\/|src\/lib\/|\.agents\/|\.claude\/)|^(src\/views\/console-chrome\.tsx|tests\/(?:[^/]+\.test\.tsx?|setup\.ts)|src\/logic\/(?:after-start|derivations|summarise)\.ts)$/;
+/** A path inside the managed folders that is the team's all the same: their own views, their app, their docs, their config. */
+export const NEVER_MANAGED = (p) => p === 'src/app.config.ts' || p === 'scripts/verify.config.ts' || p.startsWith('app/') || p.startsWith('docs/') || (p.startsWith('src/views/') && p !== 'src/views/console-chrome.tsx');
 /** The raw `.meridian/manifest.json`, checked field by field; anything off throws an Error that names it. */
 export function parseManifest(text) {
     let raw;
@@ -67,8 +84,16 @@ export function adoptSetOf(payloadFiles) {
  * routes. `generated` is every path a replay or a real run produced; only the ones under `tokens/` or `src/styles/`
  * and `scripts/package.json` become managed, so a generated page or config stays the team's.
  */
-export function managedPaths(payloadFiles, _route, generated = []) {
+export function managedPaths(payloadFiles, route, generated = []) {
     const out = new Set(adoptSetOf(payloadFiles));
+    // A created project's tests are Meridian's: it wrote every one of them, and each pins the behaviour of the module it
+    // covers. Left the team's, a release that changed `splitFigure` could not change the test that reads it, and the
+    // project's own gate failed after an update that was otherwise correct (0.29.0's consumer smoke). Adopt still copies
+    // none of them: that project has a test suite of its own.
+    if (route === 'create')
+        for (const f of payloadFiles)
+            if (/^tests\/[^/]+\.test\.tsx?$/.test(f))
+                out.add(f);
     for (const g of generated)
         if (g.startsWith('tokens/') || g.startsWith('src/styles/') || g === 'scripts/package.json')
             out.add(g);

package/dist/session.js

@@ -154,7 +154,15 @@ function plan(ctx, manifest, startedAt) {
         const inBase = baseManaged.has(p);
         const inTarget = targetManaged.has(p);
         const managed = inBase || inTarget;
-        const recorded = manifest.files[p] ?? (inBase && !sourcePayload.has(p) ? source.hashes.get(p) : undefined) ?? null;
+        // What the recorded release wrote at this path: the manifest's hash, or — for a project `create` made, which received
+        // every payload file — the recorded release's own bytes. The second term is what made 0.29.0's tests unclassifiable:
+        // a test that release shipped but did not record (it managed none but `tests/setup.ts` then) had no hash to compare
+        // with, so an unedited copy of it collided instead of being replaced, and the update stopped for a decision on a file
+        // nobody had touched.
+        const recorded = manifest.files[p]
+            ?? (manifest.route === 'create' && sourcePayload.has(p) ? source.hashes.get(p) : undefined)
+            ?? (inBase && !sourcePayload.has(p) ? source.hashes.get(p) : undefined)
+            ?? null;
         const targetHash = inTarget ? target.hashes.get(p) ?? null : null;
         if (targetHash)
             targetFiles[p] = targetHash;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian",
-  "version": "0.27.1",
+  "version": "0.29.0",
   "description": "Bring ZZ Meridian, a dashboard design system, into a Next.js project, or start a new dashboard on it. Copies the files in; nothing depends on this package at runtime.",
   "license": "MIT",
   "type": "module",

package/payload/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 Every release of ZZ Meridian, newest first. Versions follow semver: a removed or renamed token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. Each entry says what breaks and what to do instead.
 
+## [0.29.0] · 2026-10-25
+
+### New
+
+- **A mark says what it encodes** ([#94](https://github.com/zhixuan312/zz-meridian/issues/94)). A colour, a fill or a size a reader is meant to decode now carries its words, built from the data the component already holds, so it is right at the call site rather than added page by page. A Bar list row names its row, its figure and its share (`Checkout · 420 · 42.0% of 1,000`, and without a total too); a Trend chart's marked day names the day and what it is marked for; its dashed stretch into a period still running says "Today so far, dashed"; a Sparkline says the range it draws, which was the one chart carrying no readout; a Delta says whether its colour reads better or worse, which the colour alone could not; a Status dot takes a `label` and becomes an image to assistive technology where it stands with no word beside it, and an activity's tone says what it means ("Went well", "Needs attention", "Failed"). `ColumnChart` and `BarList` take `highlightLabel` — what makes the accented row or column the one the card is about — and say it on that mark and in the hidden table's caption. `docs/data-display.md`'s `## Marks` now states the rule, so a new chart is held to it.
+
+### Fixed
+
+- **A card's head never draws its title over its controls** ([#87](https://github.com/zhixuan312/zz-meridian/issues/87)). `CardHeader` gave the title `min-w-0 flex-1` and the actions `shrink-0`, so in a narrow column the title's box collapsed: at 1024px the second column of `<Row split="2/3">` is 229px, a head with a `Select size="sm"` and two labels took 138 of them, and the title's first word was drawn 32px past its own box, across the controls. The head wraps now, and the title's box has a floor (8rem, the width a word or two needs), so the actions drop to their own line when the two cannot share one. A title that wraps breaks a word too long for the line instead of drawing it over its neighbour.
+- **A page headed by a sentence that opens with its own name announces it once** ([#88](https://github.com/zhixuan312/zz-meridian/issues/88)). `PageTitle` drew the name out of sight and then the sentence, so "USDC: no rule met…" was read as "USDC : USDC: no rule met…" in the heading and twice in a screen reader's list of headings. A sentence that is a plain string is compared with the name, and one that reads data takes `speaksName` on `PageTitle` or `PageFrame`; the name stays in the markup either way, so the heading is in the prerendered shell, and a sentence still to come leaves the name read.
+- **A Key value list wraps a value on a phone instead of cutting it behind a title no phone shows** ([#89](https://github.com/zhixuan312/zz-meridian/issues/89)). Every value truncated unless its item set `wrap`, with the whole of it in the row's `title` — which a pointer reads and a phone cannot. Below the width where a sentence value cannot fit beside its 8rem label (26rem of row) the value wraps as `wrap` asks for; above it the one line and the title stay.
+- **The CLS observer bounds a session window at 5 s** ([#90](https://github.com/zhixuan312/zz-meridian/issues/90)). It summed shifts into a session while each was within 1 s of the last, which is half of web-vitals' definition: a page that filled in over half a minute reported one session the length of the page, so `verify --timed` could fail a page inside its budget and the number could not be compared with another tool's. `scripts/lib/cls.ts` is the rule now, both bounds with it, and `tests/cli-vitals-cls.test.ts` runs the source the page runs.
+- **A collection may hide or page-own a field it computes** ([#91](https://github.com/zhixuan312/zz-meridian/issues/91)). `visibleFields` and `writableFields` built their `omit` masks from the names alone, so a `hidden` or `pageOnlyFields` entry for a joined label or a derived total — which both doc comments allow — threw on a key the shape never had, on every render. A name the shape does not hold is skipped; the ones it holds are still masked, and the write schema stays strict, so a hidden or page-owned field sent anyway is refused.
+- **An image's address is read the way the URL parser reads it** ([#92](https://github.com/zhixuan312/zz-meridian/issues/92)). `safe-markdown` accepted a `src` with no scheme that was not written `//`, so `\\host/p.png`, `/\host/p.png` and `\/host/p.png` passed while the browser resolved each to `//host/p.png` and fetched a third party — the case the rule exists to stop. The address is now resolved against a fixed origin with the backslashes normalised, and kept only when it lands back on it.
+- **A filter bar's search has a floor, so its hint reads the same on a 2x display as on a 1x one** ([#93](https://github.com/zhixuan312/zz-meridian/issues/93)). The field took whatever five facets left: 129px at a 1440px window on a Retina screen, where the placeholder needs 134, so the same page read "Headline, address, ru" there and the whole hint on a laptop. It is 10rem wide at least, and the facets truncate their own labels to make the room.
+- **The environment is put back before every test** ([#95](https://github.com/zhixuan312/zz-meridian/issues/95)). Files share a worker (`pool: 'vmThreads'`), so a file that stubbed a store's variables in a `beforeAll` left them set for the file beside it — seen as an intermittent gate where a view test found a store configured and asked a stub for a snapshot. `tests/setup.ts` restores the environment before each test, so a stub belongs in a `beforeEach`, which runs after it.
+- **A created project's tests move with the release that changes them.** A test the template ships pins the behaviour of the module it covers, and every shipped test but `tests/setup.ts` was the team's, so an update could change `src/lib/format.ts` and leave `tests/format.test.ts` asserting what it did before: a project created with 0.28.0 and updated to 0.29.0 failed its own gate on `splitFigure`. `create` now records the tests it writes as managed, so an update replaces an unedited one with the release's; a test your team edited is staged for your decision, as any other edited file is. `adopt` still copies none of them, because a project it joins has a suite of its own.
+
+- **A figure keeps its symbol and its sign when it is split or shortened, and an amount too small for 20 places never reads as zero** ([#96](https://github.com/zhixuan312/zz-meridian/issues/96)). `splitFigure` failed on a leading mark-and-sign figure (`-$298.43` came back whole), so a tile set it in its number face, or lost both the `$` and the minus when it shortened; `fitFigure` re-built a shortened figure with the app's own currency, so `HK$12,345,678` read `$12.3M`. The minus belongs to the mark, and a figure shortens with the mark and the sign it was given. `formatCost` below 5e-5 keeps its two leading digits in exponent form (`$1.0e-21`) where `toFixed` printed a row of zeroes.
+
+## [0.28.0] · 2026-10-24
+
+### Breaking
+
+- **The four data layers are the standard, and the template's figures moved into `src/logic/`.** Thirty-eight modules that computed a figure or wrote a sentence — thirty-six under `src/views/`, the status list's `summarise`, and the alerts the dashboard layout reads — live in `src/logic/` now, and every import names the path each has. `docs/data-layers.md` is the standard: the four layers between a database and the screen, the contract a backend answers, the seven direct reads, and the order a product with its own API or tables follows.
+  - **What a team does.** Run `update`; it reports `migration:four-layers` for each of your own files that still imports a module from a path the move left, and its instruction names all thirty-eight with the path each left. Rewrite each of those imports in your own `src/views/` producers and pages to `src/logic/`, or move the module itself beside the work it does. Two symbols left the cards they were exported from and must move with them: `afterStart` is `@/logic/after-start`, and `summarise` is `@/logic/summarise`.
+  - **Doing nothing.** A project that imported neither symbol keeps building: the move is in this template, not in your project, so every path your own files name is still there. A file of yours that imported `afterStart` from `src/components/patterns/incident-card`, or `summarise` from `src/components/patterns/status-list`, stops compiling — both cards are Meridian's and the update replaces them. What no project gets by doing nothing is the layer: your figures stay where they were, and the six rules below stay silent about them until you move them and say so.
+  - **Three helpers arrive managed.** `src/logic/after-start.ts`, `src/logic/derivations.ts` and `src/logic/summarise.ts` are Meridian's from this release, because a shipped card imports them: `update` replaces each when you have not edited it, and stages base, ours and new when you have. Every other module under `src/logic/` is yours.
+  - **Six rules, off until you ask.** `node scripts/check.ts` checks `data-imports-neither`, `logic-does-not-import-views`, `views-produce-nothing`, `presentation-does-not-read`, `no-direct-query` and `client-does-not-import-a-reading-module`. Every one is silent until your own `scripts/check.local.ts` exports `fourLayers = true`; until then the check runs exactly as it did before. `docs/data-layers.md`'s "The six rules, and the switch" says what each asks and what skipping it costs.
+
+### Fixed
+
+- **The first load carried a second copy of the shell.** Turbopack's chunker merges small chunks and duplicates what it cannot merge: after the data layer stopped importing `@/views`, every route's first load held a second copy of the shell and the shared UI set — 40.3 and 29.9 KiB of it on `/engineering` — and three routes went over budget, `/engineering` 832 KiB against the 820 KiB cap, `/business` at the cap, and `/customers/[id]` 5.6% over its baseline. Smaller chunks are reusable across pages, so `experimental.turbopackChunking` now asks the chunker for them (`minChunkSize: 35000`, `maxChunkCountPerGroup: 80`): `/engineering` 811 KiB, and a page asks for 27 chunks where it asked for 23. A chunk is also a script tag in the page's HTML, so the split is taken as coarse as the HTML budget allows — every page stays within 3.8% of its baseline HTML, `/keys` the closest — and no cap, baseline or page was moved.
+
+- **A created project's `pnpm verify` no longer fails on this repository's own record.** Two checks that ship with the template read files only this checkout has — the changelog beside the CLI's migrations and their tests, and the five guides the skill is delivered from, which `create` installs at `.claude/skills/` and `.agents/skills/` instead. Each now asks only where its subject exists, which is a checkout carrying `cli/src/migrations.ts`: a created or adopted project has no such record to check, and in this repository both run exactly as they did.
+
 ## [0.27.1] · 2026-10-24
 
 ### Fixed

package/payload/README.md

@@ -35,6 +35,8 @@ These govern every layer. When two choices both fit the specs, pick the one that
 
 A change at the bottom moves everything above it, and nothing above may invent a value of its own.
 
+The **four data layers** answer a different question: where an answer comes from. The database, `src/data/` (the one place a product's backend is touched), `src/logic/` (the business logic) and what draws it. They describe the path between records and the screen, so a data layer is not a content layer and adds nothing to the count above. `docs/data-layers.md` is the standard, and the skill ships the same text.
+
 ## Three surfaces, two operators
 
 | Surface | Where | Navigation |

package/payload/app/(dashboard)/(home)/README.md

@@ -24,11 +24,11 @@ No other chart card is on Home: the busiest endpoints, the responses by status c
 
 ### The year's card
 
-Its title states the year: "Requests grew 105.7% in a year, and p95 stayed between 277 and 294 ms" in the sample at 30 days, from the first window to the latest and over the windows' p95 in whole milliseconds; with fewer than two windows, as with All, "Requests and latency, a period at a time". The sentence starts at the first window that begins on or after the first day with a request (`yearLine` in `src/views/home-parts.ts`); a quiet day after that keeps its window. A window that holds the first request after days with none is not whole: its requests are short and its median day may have no p95, so measured from it flat traffic would read as growth and p95 as 0. When the days kept begin before the first request, the sentence grows from the first whole window and names it ("Requests grew … from the 30 days to 14 Sept 2026, and p95 stayed between …", a form the sample, whose first day has requests, never takes), its p95 range is over the windows from there, and with fewer than two windows from that one to the latest it is the sentence for fewer than two windows. A change that rounds to 0.0% reads "Requests held level". Now states the same sentence, at 30 days, among the facts of the band. A window is a whole period of the period's length counted back from yesterday over every complete day kept: 51 of 7 days, 12 of 30, 4 of 90, one of All. Its line says how long a column is. Revenue a period takes the same windows and the same cursor: point at a window in either chart and the three read it.
+Its title states the year: "Requests grew 105.7% in a year, and p95 stayed between 277 and 294 ms" in the sample at 30 days, from the first window to the latest and over the windows' p95 in whole milliseconds; with fewer than two windows, as with All, "Requests and latency, a period at a time". The sentence starts at the first window that begins on or after the first day with a request (`yearLine` in `src/logic/home-parts.ts`); a quiet day after that keeps its window. A window that holds the first request after days with none is not whole: its requests are short and its median day may have no p95, so measured from it flat traffic would read as growth and p95 as 0. When the days kept begin before the first request, the sentence grows from the first whole window and names it ("Requests grew … from the 30 days to 14 Sept 2026, and p95 stayed between …", a form the sample, whose first day has requests, never takes), its p95 range is over the windows from there, and with fewer than two windows from that one to the latest it is the sentence for fewer than two windows. A change that rounds to 0.0% reads "Requests held level". Now states the same sentence, at 30 days, among the facts of the band. A window is a whole period of the period's length counted back from yesterday over every complete day kept: 51 of 7 days, 12 of 30, 4 of 90, one of All. Its line says how long a column is. Revenue a period takes the same windows and the same cursor: point at a window in either chart and the three read it.
 
 ### The title
 
-The page is headed by what its revenue says for the period chosen, worked out by `homeTitle` in `src/views/home-context.ts`. The heading reads "Home: " before it, out of sight, and the top bar shows "Home".
+The page is headed by what its revenue says for the period chosen, worked out by `homeTitle` in `src/logic/home-context.ts`. The heading reads "Home: " before it, out of sight, and the top bar shows "Home".
 
 | When | The title |
 |---|---|
@@ -42,7 +42,7 @@ In the sample the four periods read "The highest 7 days yet: $810,137.13", "The
 
 ### The line under the title
 
-One line, worked out by `homeLine` in `src/views/home-context.ts`: the customers that have not left, the period's requests and their change, and gross margin for a person who may read what compute cost, with the services last. Counts are written at a glance (`formatCompact`). A service that is not operational, or a product monitoring none, is the line's own second sentence, after the figures: on a day whose title states a record it is the only place on the page that says what is wrong today. In the sample at 30 days an Owner reads "320 customers, 1.1B requests in 30 days (up 4.7%), and a gross margin of 62.4%. Inference API is degraded." and a Member or a Viewer the same line without the margin clause. A clause whose figures could not be read is left out.
+One line, worked out by `homeLine` in `src/logic/home-context.ts`: the customers that have not left, the period's requests and their change, and gross margin for a person who may read what compute cost, with the services last. Counts are written at a glance (`formatCompact`). A service that is not operational, or a product monitoring none, is the line's own second sentence, after the figures: on a day whose title states a record it is the only place on the page that says what is wrong today. In the sample at 30 days an Owner reads "320 customers, 1.1B requests in 30 days (up 4.7%), and a gross margin of 62.4%. Inference API is degraded." and a Member or a Viewer the same line without the margin clause. A clause whose figures could not be read is left out.
 
 The revenue card and the tiles share the page's Meridian: its dates are the period's complete days, then the day in progress. Point at a day in the revenue chart and the featured figure reads it; at the day in progress its pill says "so far". A tile reads the pointed day only when its points are the Meridian's dates (the Metric tile's rule). While a day is in progress, the Requests, Compute cost and Gross margin tiles have a point for each complete day and none for the day in progress, one short of the Meridian's dates, so they keep the period's figure and a part-day is never read as a whole one. When the latest day kept is complete, no day is in progress, their points are the Meridian's dates, and pointing at a day reads it in those three tiles too.
 
@@ -63,12 +63,12 @@ Below 1024px every row stacks: the revenue card first, then its three tiles (thr
 
 ## Data
 
-Every figure is read on the server by the Home tool's read (`homeTool` in `src/views/tools.ts`), which needs every grant it reads (`FEATURES.home.needs`: the days, the usage by model, the models, compute, customers, services, incidents, tickets, verifications and releases; neither members nor keys nor what compute cost); a person lacking one is refused before anything is read. Each collection is read apart from the others through `read()` or `readAll()`, so one that cannot be read leaves its part saying so (`unread` on the page's data names it) and the rest standing. `homeData` in `src/views/home-parts.ts` turns the rows into what the parts draw: figures, lines and the points of their charts, never a row of the customers, the usage, the compute or its cost.
+Every figure is read on the server by the Home tool's read (`homeTool` in `src/logic/tools.ts`), which needs every grant it reads (`FEATURES.home.needs`: the days, the usage by model, the models, compute, customers, services, incidents, tickets, verifications and releases; neither members nor keys nor what compute cost); a person lacking one is refused before anything is read. Each collection is read apart from the others through `read()` or `readAll()`, so one that cannot be read leaves its part saying so (`unread` on the page's data names it) and the rest standing. `homeData` in `src/logic/home-parts.ts` turns the rows into what the parts draw: figures, lines and the points of their charts, never a row of the customers, the usage, the compute or its cost.
 
-- **The period's figures** come from `readDays(period)`: the complete days counted back from yesterday, their totals and those of the same number of days before, and the day in progress on its own, counted in nothing. Revenue (a day's average and the best day), tokens served, requests and the days inside the band (`steady` with `facts.band`) are of those days. Compute in use is the GPU-hours used over those provisioned (`gpus × 24`) of the `compute` rows of the same days, with the fullest region; what we sell is the `usage` rows' revenue by model over the same days, the largest first, each with its share of the whole; past the four slots (`SOLD_SLOTS` in `src/views/home-context.ts`) the rest are summed into one part, "Other", which the page draws and the context states with the same shares.
+- **The period's figures** come from `readDays(period)`: the complete days counted back from yesterday, their totals and those of the same number of days before, and the day in progress on its own, counted in nothing. Revenue (a day's average and the best day), tokens served, requests and the days inside the band (`steady` with `facts.band`) are of those days. Compute in use is the GPU-hours used over those provisioned (`gpus × 24`) of the `compute` rows of the same days, with the fullest region; what we sell is the `usage` rows' revenue by model over the same days, the largest first, each with its share of the whole; past the four slots (`SOLD_SLOTS` in `src/logic/home-context.ts`) the rest are summed into one part, "Other", which the page draws and the context states with the same shares.
 - **What compute cost** is read only when the person may read it: the read asks `can(scope, 'costs', 'read')` once, the question `read()` and the assistant's query ask, and reads `costs` only on a yes. Then Compute cost is the period's `compute` summed, and Gross margin is revenue less compute cost, over revenue, over the same complete days, each with its change. For anyone else the page's data has no key that names a cost or a margin, the line under the title has no margin clause, and the context says neither: nothing stands in their place.
 - **The year** comes from every complete day kept (`readDays('all')`): whole windows of the period's length counted back from yesterday (51 of 7 days, 12 of 30, 4 of 90, one of All), each with its requests, the median day's p95 and its revenue, the windows' median p95 for the latency chart's baseline, and the year card's title from the first window to the latest. The title of the page, its record and the facts of a year are worked out from the same days, on the server, and the page's client is handed the sentences and never the history.
-- **The customers** are every customer that has not left: how many, how many active, on a trial and past due, and the `all` fact (`allSentMore` in `src/views/customers-context.ts`, the one Revenue is headed by) as the tile's finding when it holds.
+- **The customers** are every customer that has not left: how many, how many active, on a trial and past due, and the `all` fact (`allSentMore` in `src/logic/customers-context.ts`, the one Revenue is headed by) as the tile's finding when it holds.
 - **Business and Engineering** each hand four lines of a label and a figure (a figure that could not be read is a dash) and one counted fact: Revenue, Customers, On a trial and Past due with the `all` fact or how many customers sent more this week than last; Services operational, Incidents open, Releases in testing and Tickets open with the days inside the band over every complete day kept.
 - **Worth knowing across the company** is at most four lines, in this order, each with the address where it is handled: the newest incident nobody has resolved (`/engineering`); the largest customer paying `facts.concentrationAt` or more of the revenue of the last 30 complete days, whatever the period, with how many others do (`/customers/<id>`; no other line states a customer's share); a release that has passed every required check and has not gone out, as the Releases page stages it (`/releases?state=ready`); and the customers past due, with what they were billed. With none, one line says so.
 
@@ -84,7 +84,7 @@ The body registers the ten collections its feature needs (`days`, `usage`, `mode
 
 ## Agents
 
-The page shares one context with both agents (decision 0011), built by `homeContext` in `src/views/home-context.ts` from the figures the page draws. The page states each fact of a year in the line the context carries, under the same kind, so a person and an agent read one sentence. The activity feed, which marks an agent's own changes, is not on Home: it is one team's detail, and it moves to Now.
+The page shares one context with both agents (decision 0011), built by `homeContext` in `src/logic/home-context.ts` from the figures the page draws. The page states each fact of a year in the line the context carries, under the same kind, so a person and an agent read one sentence. The activity feed, which marks an agent's own changes, is not on Home: it is one team's detail, and it moves to Now.
 
 ### What the agent reads
 
@@ -124,7 +124,7 @@ The page marks the revenue card `data-protagonist="Revenue"` on a wrapper that i
 - "How many customers are on each plan, and what did each plan pay?" — the customers that have not left and their revenue over the last 30 complete days, by plan
 - "How full were the GPUs in each region over the last 90 days?" — compute in use over 90 complete days, by region, against the 90 days before
 
-Home's prepared query (`homeExplore` in `src/views/home-explore.ts`) reads five sources. `days` is windowed by complete days and bucketed by day, week, month or weekday, with revenue, requests, tokens served and gross margin, a margin of the days' revenue and what compute cost over the same window. `usage` is the same days by model, `compute` by region, with the share of GPU-hours used, and `costs` is what compute cost a day. `customers` has no date: each customer's figures cover the last 30 complete days, narrowed and grouped by plan, status, region and owner. What compute cost, and so gross margin, is offered only to an Owner and an Admin: for anyone else the `costs` source and the gross margin are absent from the tool. A drilled day opens Home pointed at it, and a drilled customer its own page.
+Home's prepared query (`homeExplore` in `src/logic/home-explore.ts`) reads five sources. `days` is windowed by complete days and bucketed by day, week, month or weekday, with revenue, requests, tokens served and gross margin, a margin of the days' revenue and what compute cost over the same window. `usage` is the same days by model, `compute` by region, with the share of GPU-hours used, and `costs` is what compute cost a day. `customers` has no date: each customer's figures cover the last 30 complete days, narrowed and grouped by plan, status, region and owner. What compute cost, and so gross margin, is offered only to an Owner and an Admin: for anyone else the `costs` source and the gross margin are absent from the tool. A drilled day opens Home pointed at it, and a drilled customer its own page.
 
 ## Embed view
 

package/payload/app/(dashboard)/(home)/page.tsx

@@ -6,9 +6,10 @@ import { PeriodSelect } from '@/components/patterns/period-select';
 import { HomeBody } from '@/views/home';
 import { PeriodActionsRoom, PeriodRoom } from '@/views/period-actions';
 import { gate, gatedMetadata } from '@/data/access';
+import { RefusalScreen } from '@/views/refusal';
 import { DEMO_NOW, DEMO_UPDATED_AT } from '@/data/sample';
-import { dayRows } from '@/views/home-context';
-import { homeTool } from '@/views/tools';
+import { dayRows } from '@/logic/home-context';
+import { homeTool } from '@/logic/tools';
 import { cache } from 'react';
 import { parsePeriod, type Period } from '@/lib/period';
 import { app, workspaces } from '@/app.config';
@@ -21,7 +22,7 @@ export function generateMetadata() {
 
 type SearchParams = Promise<{ period?: string; day?: string }>;
 
-/** The page's one read, through the Home tool (`src/views/tools.ts`), shared by the title, the line, the export and the body. */
+/** The page's one read, through the Home tool (`src/logic/tools.ts`), shared by the title, the line, the export and the body. */
 const readPeriod = cache((period: Period, day: string | undefined) => homeTool.read({ period, day: /^\d{4}-\d{2}-\d{2}$/.test(day ?? '') ? day : undefined }));
 /**
  * Every part reads the page through this, so each asks `readPeriod` with the same two arguments: `cache` keys first on
@@ -42,7 +43,7 @@ const readHome = async (searchParams: SearchParams) => {
  */
 export default async function HomePage({ searchParams }: { searchParams: SearchParams } = { searchParams: Promise.resolve({}) }) {
   const denied = await gate('home');
-  if (denied) return denied;
+  if (denied) return RefusalScreen(denied);
   return (
     <PageFrame
       kicker={<>{app.name} · {app.workspace}</>}

package/payload/app/(dashboard)/business/README.md

@@ -31,7 +31,7 @@ The period control moves what is read from the daily records: the title's revenu
 
 ### The title
 
-The page is headed by what its customers and its revenue say for the period chosen, worked out by `revenueTitle` in `src/views/revenue-context.ts`. The heading reads "Revenue: " before it, out of sight, and the top bar shows "Revenue".
+The page is headed by what its customers and its revenue say for the period chosen, worked out by `revenueTitle` in `src/logic/revenue-context.ts`. The heading reads "Revenue: " before it, out of sight, and the top bar shows "Revenue".
 
 | When | The title |
 |---|---|
@@ -62,10 +62,10 @@ Below 1024px (`lg`) every row stacks, the Featured metric first. The three tiles
 
 ## Data
 
-Every figure is read on the server by the Revenue tool's read (`revenueTool` in `src/views/tools.ts`, which takes `period`, 30d when not given). Each collection is read apart from the others, so one that cannot be read leaves its part saying so (`unread` on the page's data) and the rest standing. `revenueData` in `src/views/revenue-parts.ts` turns the rows into what the parts draw, never a customer's record: the wall gets the eight of each order, the ladder each stage's two named customers (three when it holds three) and what each other customer paid, which the Bar list folds into "N others".
+Every figure is read on the server by the Revenue tool's read (`revenueTool` in `src/logic/tools.ts`, which takes `period`, 30d when not given). Each collection is read apart from the others, so one that cannot be read leaves its part saying so (`unread` on the page's data) and the rest standing. `revenueData` in `src/logic/revenue-parts.ts` turns the rows into what the parts draw, never a customer's record: the wall gets the eight of each order, the ladder each stage's two named customers (three when it holds three) and what each other customer paid, which the Bar list folds into "N others".
 
 - **The period's figures** come from `readDays(period)` and its `revenueByPlan`; the windows, the year ago and the best day from every complete day kept (`readDays('all')`), read on the server, and the page is handed the sentences and figures, never the history.
-- **The customers' figures** are every customer that has not left (`kept`), from the `customers` collection: what each paid in the last 30 complete days, its 14-day trend and its week (`week` in `src/views/customers-context.ts`). Those that have left are counted in nothing but the ladder's "left".
+- **The customers' figures** are every customer that has not left (`kept`), from the `customers` collection: what each paid in the last 30 complete days, its 14-day trend and its week (`week` in `src/logic/customers-context.ts`). Those that have left are counted in nothing but the ladder's "left".
 - **The ladder's moves** are of the last 30 complete days: joined (`joined`), moved up (`planSince` with a `previousPlan` below the plan) and left (`left`).
 - **What they buy** is the `usage` rows' revenue by model over the period's complete days, labelled from `models`; **where they are** is the `regions` collection.
 - **`facts.nextPlanAt`** (`src/app.config.ts`, 0.75 in the sample) is read each time the read runs.
@@ -80,7 +80,7 @@ Revenue over 30 days equals Home's and the customers' revenue to the cent. Nothi
 
 ## Agents
 
-The page itself takes no agent action. It shares one context with both agents (decision 0011), built by `revenueContext` in `src/views/revenue-context.ts` from the figures the page draws; the wall's order is the person's, and the context states the wall in that order.
+The page itself takes no agent action. It shares one context with both agents (decision 0011), built by `revenueContext` in `src/logic/revenue-context.ts` from the figures the page draws; the wall's order is the person's, and the context states the wall in that order.
 
 ### What the agent reads
 
@@ -108,7 +108,7 @@ Protagonist: Revenue.
 - "Which model brought the most revenue in the last 90 days, and how did that move?" — the usage's revenue over 90 complete days, by model, against the 90 days before
 - "What do the customers past due pay, by plan?" — the customers whose status is past due, their revenue over the last 30 complete days, by plan
 
-Revenue's prepared query (`revenueExplore` in `src/views/revenue-explore.ts`, set as `explore` on the Revenue tool) reads three sources. `days` is windowed by complete days and bucketed by day, week, month or weekday, with revenue and each plan's revenue. `customers` has no date: each customer's figures cover the last 30 complete days, narrowed and grouped by plan, status, region and owner. `usage` is the days by model, with revenue and requests. A drilled day or model-day opens the page at every day kept, and a drilled customer its own page.
+Revenue's prepared query (`revenueExplore` in `src/logic/revenue-explore.ts`, set as `explore` on the Revenue tool) reads three sources. `days` is windowed by complete days and bucketed by day, week, month or weekday, with revenue and each plan's revenue. `customers` has no date: each customer's figures cover the last 30 complete days, narrowed and grouped by plan, status, region and owner. `usage` is the days by model, with revenue and requests. A drilled day or model-day opens the page at every day kept, and a drilled customer its own page.
 
 ## Accessibility
 

package/payload/app/(dashboard)/business/page.tsx

@@ -1,6 +1,7 @@
 import { Suspense, cache } from 'react';
 import { app, workspaces } from '@/app.config';
 import { gate, gatedMetadata } from '@/data/access';
+import { RefusalScreen } from '@/views/refusal';
 import { DEMO_NOW, DEMO_UPDATED_AT } from '@/data/sample';
 import { PageFrame } from '@/components/base/shell';
 import { ExportButton } from '@/components/patterns/export-button';
@@ -9,9 +10,9 @@ import { Busy, LeadRoom } from '@/components/patterns/page-loading';
 import { PeriodSelect } from '@/components/patterns/period-select';
 import { parsePeriod } from '@/lib/period';
 import { PeriodActionsRoom, PeriodRoom } from '@/views/period-actions';
-import { dayRows } from '@/views/home-context';
+import { dayRows } from '@/logic/home-context';
 import { RevenueBody } from '@/views/revenue';
-import { revenueTool } from '@/views/tools';
+import { revenueTool } from '@/logic/tools';
 import { RevenueSkeleton } from './loading';
 
 export function generateMetadata() {
@@ -20,7 +21,7 @@ export function generateMetadata() {
 
 type SearchParams = Promise<{ period?: string }>;
 
-/** The page's one read, through the Revenue tool (`src/views/tools.ts`), shared by the title, the line, the export and the body. */
+/** The page's one read, through the Revenue tool (`src/logic/tools.ts`), shared by the title, the line, the export and the body. */
 const readPeriod = cache((period: ReturnType<typeof parsePeriod>) => revenueTool.read({ period }));
 
 /**
@@ -32,7 +33,7 @@ const readPeriod = cache((period: ReturnType<typeof parsePeriod>) => revenueTool
  */
 export default async function RevenuePage({ searchParams }: { searchParams: SearchParams } = { searchParams: Promise.resolve({}) }) {
   const denied = await gate('revenue');
-  if (denied) return denied;
+  if (denied) return RefusalScreen(denied);
   return (
     <PageFrame
       kicker={<>{app.name} · {app.workspace}</>}

package/payload/app/(dashboard)/customers/README.md

@@ -30,7 +30,7 @@ The body (rows 1 and 2) is the records template, `Records` from `src/components/
 
 The `customers` collection, read through `readAll()` under `customers:read`, like every other collection; its rows are the sample's `CUSTOMERS` (made in `src/system/fixtures/company.ts`): 329 records, 320 that have not left and 9 that have. It is read-only: nobody in the console creates or changes a customer. Revenue is what a customer was billed for metered usage, before credits, over the last 30 complete days; over those days the customers' revenue and requests are the days' own, to the cent and to the request.
 
-The page reads every customer and hands its client the fields a row draws (`customerRow` in `src/views/customers-context.ts`): the id, name, plan, status, requests, 14-day trend, error rate, revenue and the day it joined. What only a customer's own page shows, its requests by route among it, stays on the server. `kept()` and `customerFigures()` there decide what is counted: every customer that has not left.
+The page reads every customer and hands its client the fields a row draws (`customerRow` in `src/logic/customers-context.ts`): the id, name, plan, status, requests, 14-day trend, error rate, revenue and the day it joined. What only a customer's own page shows, its requests by route among it, stays on the server. `kept()` and `customerFigures()` there decide what is counted: every customer that has not left.
 
 The page renders the masthead (title, sentence) itself, outside the boundary that reads the address, so a cold load has them in the first HTML. The tiles and the table wait inside their own boundary.
 
@@ -44,7 +44,7 @@ None yet: a `zz_meridian_customer { id }` view would show one customer's card wi
 
 ## Agents
 
-An agent reads customers through this page's shared context (the `customers` view tool reads every customer, as the page does, and takes the same `q`, `plan` and `status`, `left` among them) and their requests view; it changes nothing here: no one in the console creates or changes a customer. The context is built by `customersContext` in `src/views/customers-context.ts`, and the tiles' `hint`s come from its `CUSTOMER_METRICS`.
+An agent reads customers through this page's shared context (the `customers` view tool reads every customer, as the page does, and takes the same `q`, `plan` and `status`, `left` among them) and their requests view; it changes nothing here: no one in the console creates or changes a customer. The context is built by `customersContext` in `src/logic/customers-context.ts`, and the tiles' `hint`s come from its `CUSTOMER_METRICS`.
 
 ### What the agent reads
 
@@ -72,7 +72,7 @@ The page marks the list `data-protagonist="Customers"` on a wrapper whose displa
 - "Which region are our customers based in, and how many requests do they send?" — the customers' requests over the last 30 complete days, by each customer's own region
 - "Which Enterprise customers are on a trial or past due, and where do I open them?" — the customers on Enterprise whose status is trial or past due, with up to 20 of them, each with its page's address
 
-Customers' prepared query (`customersExplore` in `src/views/customers-explore.ts`) reads one source, `customers`, which has no date: each customer's figures cover the last 30 complete days. It is narrowed and grouped by plan, status, region and owner, with the customers that have not left, their revenue, requests and tokens. A drilled customer opens its own page, and a call narrowed to one plan or one status opens the list filtered to it.
+Customers' prepared query (`customersExplore` in `src/logic/customers-explore.ts`) reads one source, `customers`, which has no date: each customer's figures cover the last 30 complete days. It is narrowed and grouped by plan, status, region and owner, with the customers that have not left, their revenue, requests and tokens. A drilled customer opens its own page, and a call narrowed to one plan or one status opens the list filtered to it.
 
 ## Content
 

package/payload/app/(dashboard)/customers/[id]/README.md

@@ -18,7 +18,7 @@ Five parts, in this order. The page has no period control: every part names the
 
 ### The title
 
-The page is headed by what the customer's record says, worked out by `customerTitle` in `src/views/customer-context.ts`. The heading reads the customer's name and a colon before it, out of sight, and the top bar shows the name.
+The page is headed by what the customer's record says, worked out by `customerTitle` in `src/logic/customer-context.ts`. The heading reads the customer's name and a colon before it, out of sight, and the top bar shows the name.
 
 | When | The title |
 |---|---|
@@ -49,7 +49,7 @@ A customer is named by its name across the product, and wherever it is, the name
 
 ## Data
 
-One row of the `customers` collection through `read()` under `customers:read`, whose key is the id; the product's revenue and error rate over the last 30 complete days (`readDays('30d')`); and the newest five requests of the `requests` collection whose customer is this one's name (`readLatestFrom` in `src/data/requests.ts`). `readCustomer` in `src/views/tools.ts` reads all three, each apart, and is shared by the page and the Customer tool; the page's metadata and its body share one read. Three ids are built ahead of time, the three largest customers; any other renders on its first request. Nothing writes.
+One row of the `customers` collection through `read()` under `customers:read`, whose key is the id; the product's revenue and error rate over the last 30 complete days (`readDays('30d')`); and the newest five requests of the `requests` collection whose customer is this one's name (`readLatestFrom` in `src/data/requests.ts`). `readCustomer` in `src/logic/tools.ts` reads all three, each apart, and is shared by the page and the Customer tool; the page's metadata and its body share one read. Three ids are built ahead of time, the three largest customers; any other renders on its first request. Nothing writes.
 
 Its share of revenue is what it paid over the revenue of the same 30 complete days. The busiest of its 14 days is the largest of its trend, dated from the day before the read.
 
@@ -59,7 +59,7 @@ Its share of revenue is what it paid over the revenue of the same 30 complete da
 
 ## Agents
 
-The page itself takes no agent action. It shares one context with both agents (decision 0011), built by `customerContext` in `src/views/customer-context.ts`.
+The page itself takes no agent action. It shares one context with both agents (decision 0011), built by `customerContext` in `src/logic/customer-context.ts`.
 
 ### What the agent reads
 
@@ -85,7 +85,7 @@ The page marks the card `data-protagonist="Where it stands"` on a wrapper whose
 - "Which of its sampled requests failed, and where do I open them?" — its requests in the sampled log whose status class is 4xx or 5xx, with up to 20 of them, each with its request's address
 - "How many tokens did it use in the last 30 days?" — the tokens, requests and revenue of its own row of the customers
 
-The protagonist is the card the structure calls Where it stands, which is titled by where the customer stands and since when. One customer's prepared query (`customerExplore` in `src/views/customer-explore.ts`, set as `explore` on the Customer tool) takes the page's `id` beside the call and reads two sources, neither with a date: its requests in the sampled log, grouped by route or status class, and its own row of the customers. Its `fixed` reads that row by the id under the person's rights and holds every call to the customer's name and id, so no other customer is read; an id that names no customer is answered that there is no such customer, and nothing else is read.
+The protagonist is the card the structure calls Where it stands, which is titled by where the customer stands and since when. One customer's prepared query (`customerExplore` in `src/logic/customer-explore.ts`, set as `explore` on the Customer tool) takes the page's `id` beside the call and reads two sources, neither with a date: its requests in the sampled log, grouped by route or status class, and its own row of the customers. Its `fixed` reads that row by the id under the person's rights and holds every call to the customer's name and id, so no other customer is read; an id that names no customer is answered that there is no such customer, and nothing else is read.
 
 ## Accessibility
 

package/payload/app/(dashboard)/customers/[id]/page.tsx

@@ -1,10 +1,11 @@
 import { cache } from 'react';
 import { gate, gatedMetadata, may, Unauthenticated } from '@/data/access';
+import { RefusalScreen } from '@/views/refusal';
 import { FEATURES } from '@/data/features';
 import { CustomerView } from '@/views/customer';
 import { MissingPage } from '@/views/missing-page';
 import { NOT_FOUND } from '@/views/not-found';
-import { readCustomer } from '@/views/tools';
+import { readCustomer } from '@/logic/tools';
 
 /** The page's one read, shared by its metadata and its body. */
 const readOne = cache(readCustomer);
@@ -35,7 +36,7 @@ export async function generateMetadata({ params }: { params: Promise<{ id: strin
 export default async function CustomerPage({ params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
   const denied = await gate('customer');
-  if (denied) return denied;
+  if (denied) return RefusalScreen(denied);
   const found = await readOne(id);
   // Rendered here rather than thrown, so the screen is in the first HTML (see MissingPage).
   if (!found) return <MissingPage />;

package/payload/app/(dashboard)/customers/page.tsx

@@ -2,10 +2,11 @@ import { Suspense } from 'react';
 import { app } from '@/app.config';
 import { PageFrame } from '@/components/base/shell';
 import { gate, gatedMetadata } from '@/data/access';
+import { RefusalScreen } from '@/views/refusal';
 import { readAll } from '@/data/read';
 import type { CustomerRecord } from '@/data/sample';
 import { CustomersView } from '@/views/customers';
-import { customerRow } from '@/views/customers-context';
+import { customerRow } from '@/logic/customers-context';
 import { Busy } from '@/components/patterns/page-loading';
 import { RecordsSkeleton } from '@/components/templates/records';
 
@@ -20,7 +21,7 @@ export function generateMetadata() {
  */
 export default async function CustomersPage() {
   const denied = await gate('customers');
-  if (denied) return denied;
+  if (denied) return RefusalScreen(denied);
   return (
     <PageFrame
       kicker={<>{app.name} · {app.workspace}</>}