From c778cba86587372b495c604d54cf01e229af288d Mon Sep 17 00:00:00 2001
From: Boris Tyshkevich <btyshkevich@altinity.com>
Date: Mon, 27 Jul 2026 12:17:12 +0000
Subject: [PATCH 1/8] fix(#429): handle rename outcomes, isolate button keys,
 unify create (#495 review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Post-merge review of PR #495 raised four defects; all four are fixed here,
and three of them are foundations #494 (phase 4) builds three more row
buttons and two more dialogs on.

1. Enter on a nested action button ran the ROW's command. The tree's keydown
   handler is on the list and its Enter arm calls preventDefault() + runs the
   focused row's single command, so Enter on the pencil opened the Dashboard
   — and the preventDefault() could swallow the button's own activation on
   the way out. The `⋯` and the orphan-variable trash shared the bug. Fixed
   in two independent layers: `isolateActivationKeys` stops Enter/Space
   propagating from each control (without preventing the default, so native
   activation still fires exactly once), and `handleTreeKeydown` ignores an
   Enter that originated on a button. Arrow/Home/End still reach the tree
   from a nested control, which is what keeps the row's composite tab stop
   navigable.

2. Rename failures closed the dialog and discarded the outcome. `commit()`
   now awaits `commitDashboardRename` and keeps the card open with the typed
   values on every unsuccessful outcome, showing one targeted diagnostic
   inline (`role="alert"`): a distinct sentence for a Dashboard that no
   longer resolves vs. the aggregate's own rejection diagnostic. Both
   actions are disabled while a write is in flight, so the same mutation
   cannot be submitted twice, and a late answer for a force-closed dialog is
   dropped rather than written into a detached card.

3. Dashboard creation had two commands with divergent failure behaviour.
   `application/dashboard-create.ts` is now the single one: it mints, appends
   against dequeue-time truth (falling back to a caller-supplied baseline for
   a workspace with no persisted aggregate), and `dashboardCreateMessage`
   normalizes the report. Both entry points call it; each keeps its own
   reveal policy, which is genuinely different. The placeholder previously
   said NOTHING on a rejected commit.

4. The modal had no dialog semantics. `openDialogShell` gives the card
   `role="dialog"`, `aria-modal="true"` and `aria-labelledby` pointing at a
   per-dialog title id.

The two-field metadata dialog moves from `ui/dashboard-tree.ts` to
`ui/dialog-shell.ts` as `openMetadataDialog` — #494's panel pencil is the
second consumer hard rule 5 asks for before extracting.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018mujm1kW7jDGpTEfscndcU
---
 src/application/dashboard-create.ts |  93 ++++++++++++++++
 src/styles.css                      |   9 ++
 src/ui/dashboard-tree.ts            | 131 ++++++++++++++--------
 src/ui/dashboard.ts                 |  34 +++---
 src/ui/dialog-shell.ts              | 136 ++++++++++++++++++++++-
 src/ui/file-menu.ts                 |  46 ++++----
 tests/unit/dashboard-create.test.ts | 119 ++++++++++++++++++++
 tests/unit/dashboard-tree.test.ts   | 146 ++++++++++++++++++++++++-
 tests/unit/dashboard.test.ts        |  40 +++++++
 tests/unit/dialog-shell.test.ts     | 162 +++++++++++++++++++++++++++-
 10 files changed, 830 insertions(+), 86 deletions(-)
 create mode 100644 src/application/dashboard-create.ts
 create mode 100644 tests/unit/dashboard-create.test.ts

diff --git a/src/application/dashboard-create.ts b/src/application/dashboard-create.ts
new file mode 100644
index 00000000..6689b3cf
--- /dev/null
+++ b/src/application/dashboard-create.ts
@@ -0,0 +1,93 @@
+// Creating ONE Dashboard document — the single command behind every entry
+// point that mints one (#481, #495 review 3).
+//
+// #481 asked for one `createDashboard` action, and #429 phase 3 delivered half
+// of it: the File menu and the empty-workspace placeholder came to share a
+// dialog and the pure `appendDashboard` transform, but kept two separate
+// commands around them. They disagreed about the thing that matters least
+// often and hurts most when it happens — the File menu toasted a rejected
+// persistence/validation outcome, the placeholder silently did nothing — and
+// nothing stopped a third rule diverging later.
+//
+// So the MINT + APPEND + report decision lives here, once. What each caller
+// still owns is its REVEAL policy, which is genuinely different: the File menu
+// opens the new Dashboard in Edit mode and swaps the sidebar to the Dashboards
+// tree, while the placeholder selects it in whichever mode the surface is
+// already showing. Those are navigation choices about where the user was, not
+// creation rules.
+//
+// Typed against a structural deps bag rather than `App`: `src/application/**`
+// must never import `src/ui/**` (build/check-boundaries.mjs), and both the real
+// `App` and `ui/dashboard.ts`'s narrower `DashboardApp` satisfy it directly.
+
+import { createEmptyDashboard } from '../dashboard/application/empty-dashboard.js';
+import { appendDashboard } from '../workspace/workspace-operations.js';
+import type { MutateWorkspace, WorkspaceMutationOutcome } from '../state.js';
+import type { StoredWorkspaceV5 } from '../generated/json-schema.types.js';
+
+/** The created Dashboard's id, threaded back through `mutateWorkspace`'s
+ *  `data` channel so a caller can navigate to exactly what was committed
+ *  without reading it back out of the aggregate. */
+export type DashboardCreateOutcome = WorkspaceMutationOutcome<string>;
+
+export interface DashboardCreateDeps {
+  /** The serialized, read-latest-at-dequeue write primitive every workspace
+   *  producer commits through. */
+  mutateWorkspace: MutateWorkspace;
+  /** Mints the new document's id through the injected `crypto.randomUUID`
+   *  seam, like every other producer. */
+  genId(): string;
+  /**
+   * What to append onto when NOTHING is persisted yet — `mutateWorkspace`
+   * hands the transform `null` for a workspace that has never been committed,
+   * and the very first Dashboard of a fresh workspace is created exactly
+   * there. Each caller answers with the freshest baseline it has (the File
+   * menu folds its live in-memory Dashboard in; the Dashboard surface hands
+   * over its projected aggregate), and `null` — no workspace at all — aborts,
+   * committing nothing.
+   */
+  baseline(): StoredWorkspaceV5 | null;
+}
+
+/**
+ * Append one empty Dashboard named `name`, and answer what happened.
+ *
+ * The document is minted BEFORE the commit is queued, and deliberately: an
+ * empty Dashboard's content does not depend on the baseline — only the APPEND
+ * does, and that runs inside the transform against dequeue-time truth. That is
+ * what lets a caller navigate to `outcome.data` without re-reading the
+ * aggregate.
+ *
+ * Additive by construction: `appendDashboard` preserves every existing
+ * Dashboard and query in place, so this can never reach `dashboards[0]` or the
+ * compatibility slot. It aborts — committing nothing — only when neither a
+ * persisted aggregate nor a caller baseline exists.
+ */
+export async function createDashboard(
+  deps: DashboardCreateDeps, name: string,
+): Promise<DashboardCreateOutcome> {
+  const created = createEmptyDashboard(deps.genId(), name);
+  return deps.mutateWorkspace<string>((latest) => {
+    const base = latest ?? deps.baseline();
+    return base === null ? null : { candidate: appendDashboard(base, created), data: created.id };
+  });
+}
+
+/**
+ * What to tell the user about a creation attempt — the same sentence from
+ * whichever entry point ran it (#495 review 3). `null` means say nothing.
+ *
+ * Modeled on `library-assignment-service.ts`'s `libraryAssignmentMessage`: the
+ * pure message mapping lives beside the command, in the layer that knows the
+ * outcome shape, while the toast itself stays with the UI — `src/application/**`
+ * cannot reach `ui/toast.ts`.
+ *
+ * An abort is silent on purpose: nothing was committed and nothing was lost —
+ * the only reachable abort is "no workspace loaded", which is not a failure the
+ * user caused or can act on.
+ */
+export function dashboardCreateMessage(outcome: DashboardCreateOutcome): string | null {
+  if (outcome.ok) return 'Created dashboard';
+  if (outcome.aborted) return null;
+  return '✕ ' + (outcome.diagnostics[0]?.message || 'Could not save workspace');
+}
diff --git a/src/styles.css b/src/styles.css
index c3f7a14b..5fa92c16 100644
--- a/src/styles.css
+++ b/src/styles.css
@@ -794,6 +794,15 @@ h1, h2, h3, h4, h5, h6 {
    given breathing room above the title field it follows. */
 .fm-dialog-textarea { min-height: 64px; resize: vertical; font-family: inherit; }
 .fm-dialog-input + .fm-dialog-label { margin-top: 12px; }
+/* #495 review 2: a rename/edit that could not commit reports INSIDE the dialog
+   it failed in, right above the actions, while the card keeps the text the
+   user typed — a toast fired from a dialog that simultaneously vanished was
+   how the entered title used to be lost. */
+.fm-dialog-error {
+  margin: 12px 0 0; color: var(--error-fg);
+  font-size: var(--text-label); line-height: var(--lh-body);
+}
+.fm-dialog-cancel:disabled { opacity: .45; cursor: default; }
 
 /* ------------ main row ------------ */
 /* position:relative so the mobile sidebar overlay + backdrop (#126) can anchor
diff --git a/src/ui/dashboard-tree.ts b/src/ui/dashboard-tree.ts
index 0d0d032e..d304f731 100644
--- a/src/ui/dashboard-tree.ts
+++ b/src/ui/dashboard-tree.ts
@@ -41,7 +41,8 @@ import {
 } from '../application/dashboard-tree-model.js';
 import { commitVariableConfig } from '../application/dashboard-variable-config.js';
 import { commitDashboardRename } from '../application/dashboard-title.js';
-import { openDialogShell } from './dialog-shell.js';
+import type { DashboardRenameOutcome } from '../application/dashboard-title.js';
+import { openMetadataDialog } from './dialog-shell.js';
 import {
   assignLibraryQuerySqlToVariable, assignLibraryQueryToPanel, libraryAssignmentMessage,
 } from '../application/library-assignment-service.js';
@@ -159,6 +160,32 @@ const rowAccessibleName = (row: DashboardTreeRow): string => [
   row.invalid === null ? '' : STATUS_LABELS[row.invalid],
 ].filter((part) => part !== '').join(' ');
 
+/**
+ * Keep Enter/Space on a nested action button from ALSO reaching the tree's own
+ * keyboard handler (#495 review 1).
+ *
+ * The tree's `keydown` listener lives on the LIST, and its Enter arm calls
+ * `preventDefault()` and runs the focused ROW's primary command. A button
+ * inside that row is a descendant, so without this its Enter bubbled up and
+ * did two wrong things at once: it ran the row's action (for a Dashboard row,
+ * navigating away), and the `preventDefault()` suppressed the browser's own
+ * key-to-click synthesis, so the button's actual job might never happen.
+ *
+ * Propagation is stopped but the default is NOT prevented, which is the whole
+ * point: native activation still fires — exactly once, on keydown for Enter
+ * and on keyup for Space — so each control keeps standard button semantics
+ * instead of re-implementing them. The chevron is the one exception and wires
+ * its own handler: it must also `preventDefault()`, because it toggles
+ * directly and would otherwise be re-toggled by the synthesized click.
+ *
+ * `handleTreeKeydown` independently ignores anything that did not originate on
+ * a row. Two layers, deliberately: this one keeps each button self-contained,
+ * that one holds even for a control that forgets to install this.
+ */
+const isolateActivationKeys = (event: KeyboardEvent): void => {
+  if (event.key === 'Enter' || event.key === ' ') event.stopPropagation();
+};
+
 /** One arbiter per app instance, surviving the repaints that replace every row. */
 function arbiterFor(app: DashboardTreeApp): ClickArbiter {
   if (!app._dashTreeArbiter) {
@@ -786,6 +813,7 @@ function buildDeleteButton(app: DashboardTreeApp, doc: Document, row: DashboardT
     'aria-haspopup': 'menu', 'aria-expanded': 'false',
     'aria-label': 'Delete the stored option SQL for ' + row.label,
     title: 'Delete stored option SQL',
+    onkeydown: isolateActivationKeys,
     onclick: (event: MouseEvent) => {
       event.stopPropagation();
       app._dashTreeArbiter?.cancelFor(row.key);
@@ -831,6 +859,7 @@ function buildRenameButton(app: DashboardTreeApp, doc: Document, row: DashboardT
     'aria-haspopup': 'dialog', 'aria-expanded': 'false',
     'aria-label': 'Edit dashboard ' + row.label,
     title: 'Edit dashboard title & description',
+    onkeydown: isolateActivationKeys,
     onclick: (event: MouseEvent) => {
       event.stopPropagation();
       app._dashTreeArbiter?.cancelFor(row.key);
@@ -840,12 +869,18 @@ function buildRenameButton(app: DashboardTreeApp, doc: Document, row: DashboardT
   return trigger;
 }
 
-/** Two-field (title + description) metadata dialog — distinct from the
- *  single-field `openNameDialog` (`dialog-shell.ts`) the create flows use, so
- *  that shared primitive stays single-purpose. Built directly on
- *  `openDialogShell` (colocated here rather than in the shared module: it has
- *  exactly one consumer today, matching hard rule 5's "extract a shared
- *  primitive only when a SECOND consumer appears"). */
+/**
+ * The Dashboard document's own title/description dialog, on the shared
+ * two-field `openMetadataDialog` (`dialog-shell.ts` — the panel pencil below
+ * is its second consumer, which is what moved it out of this module).
+ *
+ * Every unsuccessful outcome keeps the dialog open with the typed text intact
+ * and reports inside it (#495 review 2). The first version closed the card
+ * before starting the mutation and discarded the promise, so a Dashboard
+ * deleted in another tab, a duplicate id, a validation rejection or a storage
+ * failure all read as "the dialog just disappeared" — and took the user's
+ * edits with it.
+ */
 function openDashboardMetadataDialog(
   app: DashboardTreeApp, doc: Document, trigger: HTMLButtonElement, row: DashboardTreeRow,
 ): void {
@@ -857,49 +892,36 @@ function openDashboardMetadataDialog(
   // enforces no CSS layout at all).
   trigger.setAttribute('aria-expanded', 'true');
   const current = app.currentWorkspace?.dashboards?.find((d) => d.id === row.dashboardId);
-  const titleInput = h('input', {
-    class: 'fm-dialog-input', type: 'text', id: 'dash-rename-title', spellcheck: 'false',
-    value: current?.title ?? row.label,
-  }) as HTMLInputElement;
-  const descInput = h('textarea', {
-    class: 'fm-dialog-input fm-dialog-textarea', id: 'dash-rename-description', spellcheck: 'false',
-  }) as HTMLTextAreaElement;
-  descInput.value = current?.description ?? '';
-  const confirm = h('button', {
-    class: 'fm-dialog-confirm',
-    onclick: () => commit(),
-  }, 'Save') as HTMLButtonElement;
-  const commit = (): void => {
-    const title = titleInput.value.trim();
-    if (!title) return;
-    handle.close();
-    // Fire-and-forget: a successful commit reprojects the workspace and
-    // repaints the tree/any open Dashboard surface on its own; an aborted one
-    // (the Dashboard was deleted/duplicated concurrently) leaves nothing here
-    // to undo.
-    void commitDashboardRename(app, row.dashboardId, title, descInput.value);
-  };
-  const sync = (): void => { confirm.disabled = titleInput.value.trim() === ''; };
-  titleInput.addEventListener('input', sync);
-  titleInput.addEventListener('keydown', (e) => {
-    // Enter commits from the TITLE field only — the description is a
-    // `<textarea>`, where Enter legitimately inserts a newline.
-    if (e.key === 'Enter') { e.preventDefault(); commit(); }
+  openMetadataDialog({ document: doc, acquireKeyboardOwner: app.acquireKeyboardOwner }, {
+    title: 'Edit dashboard',
+    nameLabel: 'Dashboard title',
+    descriptionLabel: 'Dashboard description',
+    name: current?.title ?? row.label,
+    description: current?.description ?? '',
+    confirmLabel: 'Save',
+    idPrefix: 'dash-rename',
+    returnFocusTo: trigger,
+    onClose: () => trigger.setAttribute('aria-expanded', 'false'),
+    onConfirm: async ({ name, description }) =>
+      renameMessage(await commitDashboardRename(app, row.dashboardId, name, description)),
   });
-  const handle = openDialogShell({ document: doc, acquireKeyboardOwner: app.acquireKeyboardOwner }, 'Edit dashboard', [
-    h('div', { class: 'fm-dialog-body' },
-      h('label', { class: 'fm-dialog-label', for: 'dash-rename-title' }, 'Dashboard title'),
-      titleInput,
-      h('label', { class: 'fm-dialog-label', for: 'dash-rename-description' }, 'Dashboard description'),
-      descInput),
-    h('div', { class: 'fm-dialog-actions' },
-      h('button', { class: 'fm-dialog-cancel', onclick: () => handle.close() }, 'Cancel'),
-      confirm),
-  ], { returnFocusTo: trigger, onClose: () => trigger.setAttribute('aria-expanded', 'false') });
-  sync();
-  setTimeout(() => { titleInput.focus(); titleInput.select(); });
 }
 
+/** What a Dashboard rename attempt has to say for itself — `null` when it
+ *  committed and the dialog should close.
+ *
+ *  The two failures are deliberately different sentences: `declined` is the
+ *  transform refusing because the Dashboard no longer resolves (deleted or
+ *  duplicated while the dialog was open), which no retry can fix, and a
+ *  rejection carries the aggregate's own validation/persistence diagnostic,
+ *  which is about the values just entered. The missing-resource wording
+ *  matches the one #429 phase 1 settled for `openSavedQuery`. */
+const renameMessage = (outcome: DashboardRenameOutcome): string | null => {
+  if (outcome.ok) return null;
+  if (outcome.aborted) return 'That dashboard is no longer part of this workspace.';
+  return outcome.diagnostics[0]?.message || 'Could not save this dashboard.';
+};
+
 /** The keyboard-reachable, DISCOVERABLE equivalent of the gestures a pointer-only
  *  affordance would otherwise hide — a panel row's double-click and Shift-click, and
  *  (since #429/#472 dropped the now-redundant *Open in View*) a Dashboard row's
@@ -910,6 +932,7 @@ function buildMenuButton(app: DashboardTreeApp, doc: Document, row: DashboardTre
     'aria-haspopup': 'menu', 'aria-expanded': 'false',
     'aria-label': 'Actions for ' + row.label,
     title: 'Actions',
+    onkeydown: isolateActivationKeys,
     onclick: (event: MouseEvent) => {
       // Never the row's own gesture, and never a pending single of its own — but
       // #426 is explicit that this must cancel no UNRELATED row operation.
@@ -981,6 +1004,20 @@ function handleTreeKeydown(
   // handler when there are no rows, so it can only ever run against a painted
   // tree. `clampKeyboardRow` ran during that paint, so the roving-tabindex owner
   // is always one of `rows` by the time any key arrives.
+  // #495 review 1: this handler speaks for the ROW. A key pressed while one of
+  // the row's nested action buttons has focus belongs to that button — running
+  // the row's command as well would open a Dashboard the user was only trying
+  // to rename, and the `preventDefault()` below would swallow the button's own
+  // activation on the way. Every such control also stops propagation
+  // (`isolateActivationKeys`); this is the guard that does not depend on each
+  // of them remembering to.
+  // Scoped to Enter: the arrow keys, Home and End still work while a nested
+  // control has focus, because the chevron and the action buttons rove WITH
+  // their row and are part of the same composite tab stop — walking the tree
+  // from them is correct. It is only ACTIVATION that belongs to whichever
+  // target has focus. (The target is always an element inside the list this
+  // handler is assigned to, so there is no null case to defend against.)
+  if (event.key === 'Enter' && (event.target as Element).closest('button') !== null) return;
   const ui = readUi(app);
   const index = rows.findIndex((row) => row.key === ui.keyboardRowKey);
   const row = rows[index];
diff --git a/src/ui/dashboard.ts b/src/ui/dashboard.ts
index 32d2c657..7c646aac 100644
--- a/src/ui/dashboard.ts
+++ b/src/ui/dashboard.ts
@@ -79,8 +79,8 @@ import { applyCommand } from '../dashboard/application/dashboard-commands.js';
 import type { DashboardCommand } from '../dashboard/application/dashboard-commands.js';
 import { removeTileMembership } from '../dashboard/application/tile-membership.js';
 import { buildQueryOwnershipIndex } from '../dashboard/model/query-ownership.js';
-import { DEFAULT_DASHBOARD_TITLE, createEmptyDashboard } from '../dashboard/application/empty-dashboard.js';
-import { appendDashboard } from '../workspace/workspace-operations.js';
+import { DEFAULT_DASHBOARD_TITLE } from '../dashboard/application/empty-dashboard.js';
+import { createDashboard, dashboardCreateMessage } from '../application/dashboard-create.js';
 import {
   findDashboard, replaceDashboard, resolveCompatibilityDashboard,
 } from '../workspace/workspace-dashboards.js';
@@ -404,23 +404,31 @@ function renderDashboardNotFound(app: DashboardApp, target: DashboardRenderTarge
 
 /**
  * Append one empty Dashboard — named through the same prompt File ▸ New
- * dashboard… uses — and open it (#429 phase 3/#481). Additive by
- * construction: `appendDashboard` preserves every existing Dashboard and
- * query in place, so this never reaches `dashboards[0]`/the compatibility
- * slot the way the pre-#481 placeholder did.
+ * dashboard… uses — and open it (#429 phase 3/#481).
  *
- * The `!latest` guard is required by `appendDashboard`'s non-nullable
- * parameter but is provably dead at runtime: `app.mutateWorkspace` only ever
- * invokes this transform once a workspace has actually loaded.
+ * Both the mint/append transform and the report are `createDashboard` /
+ * `dashboardCreateMessage` (`application/dashboard-create.ts`), shared with
+ * the File menu since #495 review 3: this path used to call
+ * `app.mutateWorkspace` directly and say NOTHING when the commit was
+ * rejected, so a storage or validation failure looked exactly like a dialog
+ * that had done its job. What stays here is the placeholder's own reveal
+ * policy — select the new Dashboard in whichever mode this surface is
+ * already showing.
  */
 async function doCreateDashboardFromPlaceholder(
   app: DashboardApp, name: string, target: DashboardRenderTarget, surfaceGeneration: number,
 ): Promise<void> {
-  const created = createEmptyDashboard(app.genId(), name);
-  const outcome = await app.mutateWorkspace<string>((latest) => (
-    !latest ? null : { candidate: appendDashboard(latest, created), data: created.id }
-  ));
+  const outcome = await createDashboard({
+    mutateWorkspace: app.mutateWorkspace,
+    genId: app.genId,
+    // This surface only renders once a workspace is projected, so the
+    // fallback is the projection itself; `null` (no workspace at all) aborts
+    // exactly as the pre-#495 transform's own `!latest` guard did.
+    baseline: () => app.currentWorkspace,
+  }, name);
   if (!app.refreshCurrentSurfaceAfterStale(surfaceGeneration, outcome.ok)) return;
+  const message = dashboardCreateMessage(outcome);
+  if (message !== null) flashToast(message, { document: app.document });
   // #425: SELECT what we just created rather than re-rendering an unselected
   // surface. Without this the session would keep reporting Query mode while a
   // Dashboard is on screen — harmless today (every consumer falls back to the
diff --git a/src/ui/dialog-shell.ts b/src/ui/dialog-shell.ts
index c705cb6a..2b1ebcba 100644
--- a/src/ui/dialog-shell.ts
+++ b/src/ui/dialog-shell.ts
@@ -56,6 +56,11 @@ export interface OpenDialogShellOpts {
 
 let openHandle: { backdrop: Element; close: () => void } | null = null;
 
+/** Distinguishes one dialog's `aria-labelledby` target from the next one's.
+ *  Module-local and monotonic — never reset — so a stale dialog being torn
+ *  down cannot collide with the one replacing it. */
+let dialogSeq = 0;
+
 /** Force-close whatever dialog `openDialogShell` currently has open, if any —
  *  the same teardown every surface transition already runs for anchored
  *  popovers and the doc pane. A no-op when nothing is open. */
@@ -99,8 +104,21 @@ export function openDialogShell(
     if (doc.activeElement === edge) { e.preventDefault(); wrapTo.focus(); }
     else if (!card.contains(doc.activeElement)) { e.preventDefault(); items[0].focus(); }
   };
-  const card = h('div', { class: opts.extraCardClass ? `fm-dialog-card ${opts.extraCardClass}` : 'fm-dialog-card' },
-    h('div', { class: 'fm-dialog-title' }, title), content);
+  // #495 review 4: a modal that only LOOKS modal is invisible to assistive
+  // technology — the Tab trap above keeps a keyboard user inside the card, but
+  // without these three attributes a screen reader is never told a dialog
+  // opened, never reads its name, and still exposes the page behind it. The id
+  // is minted per dialog (never a constant) because two shells can briefly
+  // coexist while a stale one is being force-closed, and a duplicated id would
+  // point `aria-labelledby` at whichever heading the document happened to
+  // match first.
+  const titleId = 'fm-dialog-title-' + (++dialogSeq);
+  const card = h('div', {
+    class: opts.extraCardClass ? `fm-dialog-card ${opts.extraCardClass}` : 'fm-dialog-card',
+    role: 'dialog',
+    'aria-modal': 'true',
+    'aria-labelledby': titleId,
+  }, h('div', { class: 'fm-dialog-title', id: titleId }, title), content);
   backdrop = h('div', { class: 'fm-dialog-backdrop' }, card);
   const detachBackdrop = attachBackdropClose(backdrop, close);
   const handle: DialogHandle = { close };
@@ -110,6 +128,120 @@ export function openDialogShell(
   return handle;
 }
 
+// ── the two-field name/description metadata dialog ──────────────────────────
+
+export interface MetadataDialogValues {
+  /** Already trimmed — the dialog refuses to commit a blank name. */
+  name: string;
+  /** Verbatim; each commit path decides what an empty description means. */
+  description: string;
+}
+
+export interface MetadataDialogOpts {
+  /** Heading, and the dialog's accessible name (`Edit dashboard`). */
+  title: string;
+  nameLabel: string;
+  descriptionLabel: string;
+  name: string;
+  description: string;
+  confirmLabel: string;
+  /** Prefix for the two field ids, so a `for`/`id` pair is unique per caller. */
+  idPrefix: string;
+  returnFocusTo: HTMLElement | null;
+  onClose?: () => void;
+  /**
+   * Commit the edit. Resolve `null` when it succeeded — the dialog closes —
+   * or a message to show, keeping the dialog open with the user's text intact.
+   */
+  onConfirm(values: MetadataDialogValues): Promise<string | null>;
+}
+
+/**
+ * Edit one resource's name + description (#429 phase 3 for a Dashboard
+ * document, #494 for a panel's owned query — the second consumer that earns
+ * this its place beside `openNameDialog` rather than staying colocated in
+ * `ui/dashboard-tree.ts`).
+ *
+ * The commit is AWAITED, and that is the whole point of the shape (#495
+ * review 2). The first version closed the dialog and dropped the returned
+ * promise on the floor, so a concurrently deleted target, a duplicate id, a
+ * validation rejection or a storage failure all presented as "the dialog
+ * vanished" — with the text the user had typed gone with it. Here every
+ * unsuccessful outcome keeps the card open, restores its controls and shows
+ * ONE diagnostic; only a real commit closes it.
+ *
+ * While a commit is in flight both buttons are disabled, so the same mutation
+ * cannot be submitted twice by an impatient second Enter. If the shell was
+ * force-closed underneath us (a surface transition runs
+ * `closeOpenDialogShell()`), the late resolution is dropped rather than
+ * writing a diagnostic into a detached card.
+ */
+export function openMetadataDialog(app: DialogHostApp, opts: MetadataDialogOpts): DialogHandle {
+  const nameId = opts.idPrefix + '-name';
+  const descriptionId = opts.idPrefix + '-description';
+  const nameInput = h('input', {
+    class: 'fm-dialog-input', type: 'text', id: nameId, spellcheck: 'false', value: opts.name,
+  }) as HTMLInputElement;
+  const descInput = h('textarea', {
+    class: 'fm-dialog-input fm-dialog-textarea', id: descriptionId, spellcheck: 'false',
+  }) as HTMLTextAreaElement;
+  descInput.value = opts.description;
+  // `role="alert"` rather than a bare paragraph: the message appears long
+  // after the dialog opened, in response to a Save the user has already made,
+  // so it has to be announced rather than merely be present.
+  const error = h('p', { class: 'fm-dialog-error', role: 'alert', hidden: true }) as HTMLParagraphElement;
+  const cancel = h('button', { class: 'fm-dialog-cancel', onclick: () => handle.close() }, 'Cancel') as HTMLButtonElement;
+  const confirm = h('button', {
+    class: 'fm-dialog-confirm',
+    onclick: () => { void commit(); },
+  }, opts.confirmLabel) as HTMLButtonElement;
+
+  let closed = false;
+  let inFlight = false;
+  const sync = (): void => {
+    confirm.disabled = inFlight || nameInput.value.trim() === '';
+    cancel.disabled = inFlight;
+  };
+  const commit = async (): Promise<void> => {
+    const name = nameInput.value.trim();
+    if (!name || inFlight) return;
+    inFlight = true;
+    sync();
+    const message = await opts.onConfirm({ name, description: descInput.value });
+    // Force-closed while the write was queued: whatever it answered belongs to
+    // a dialog that is no longer on screen, and its own commit path reports.
+    if (closed) return;
+    inFlight = false;
+    sync();
+    if (message === null) { handle.close(); return; }
+    error.textContent = message;
+    error.hidden = false;
+    nameInput.focus();
+  };
+  nameInput.addEventListener('input', sync);
+  nameInput.addEventListener('keydown', (e) => {
+    // Enter commits from the NAME field only — the description is a
+    // `<textarea>`, where Enter legitimately inserts a newline.
+    if (e.key === 'Enter') { e.preventDefault(); void commit(); }
+  });
+
+  const handle = openDialogShell(app, opts.title, [
+    h('div', { class: 'fm-dialog-body' },
+      h('label', { class: 'fm-dialog-label', for: nameId }, opts.nameLabel),
+      nameInput,
+      h('label', { class: 'fm-dialog-label', for: descriptionId }, opts.descriptionLabel),
+      descInput,
+      error),
+    h('div', { class: 'fm-dialog-actions' }, cancel, confirm),
+  ], {
+    returnFocusTo: opts.returnFocusTo,
+    onClose: () => { closed = true; opts.onClose?.(); },
+  });
+  sync();
+  setTimeout(() => { nameInput.focus(); nameInput.select(); });
+  return handle;
+}
+
 export interface NameDialogOpts {
   title: string;
   /** The input's visible + accessible label — the two are the same element. */
diff --git a/src/ui/file-menu.ts b/src/ui/file-menu.ts
index 564b8a2b..2c45e167 100644
--- a/src/ui/file-menu.ts
+++ b/src/ui/file-menu.ts
@@ -64,7 +64,8 @@ import type {
 import {
   appendDashboard, createNewWorkspace, renameWorkspace,
 } from '../workspace/workspace-operations.js';
-import { DEFAULT_DASHBOARD_TITLE, createEmptyDashboard } from '../dashboard/application/empty-dashboard.js';
+import { DEFAULT_DASHBOARD_TITLE } from '../dashboard/application/empty-dashboard.js';
+import { createDashboard, dashboardCreateMessage } from '../application/dashboard-create.js';
 import { deriveWorkspaceKey } from '../core/workspace-key.js';
 import type { App } from './app.types.js';
 import {
@@ -709,27 +710,34 @@ function newDashboardAction(app: App): void {
 /**
  * Append one empty Dashboard to the workspace and open it in Edit mode (#463).
  *
- * Additive by construction: `appendDashboard` preserves every existing Dashboard
- * and query in place, so nothing here can reach `dashboards[0]` or the
- * compatibility slot.
+ * The mint/append/report half is `application/dashboard-create.ts` — the ONE
+ * creation command, shared with the empty-workspace placeholder since #495
+ * review 3, so the two entry points cannot disagree about what a rejected
+ * commit means. What stays here is this entry point's own reveal policy.
  *
- * The document is minted BEFORE the commit is queued, unlike the imports — which
- * must re-plan against the dequeue-time baseline because their content depends
- * on it. An empty Dashboard's content does not: it is a self-contained value
- * with a freshly minted id, and only the APPEND has to see `latest`. That is
- * what lets the navigation below name exactly what was committed without reading
- * anything back out of the aggregate.
- *
- * A rejected commit leaves navigation and local state untouched —
- * `commitWorkspace` toasts the diagnostic and answers `false`.
+ * A rejected commit leaves navigation and local state untouched, and reports
+ * through the same `dashboardCreateMessage` the placeholder uses. The success
+ * toast fires here rather than inside `commitWorkspace` because this path no
+ * longer goes through it — `afterLibraryChange` is still owed, since a new
+ * Dashboard changes what the sidebar renders.
  */
 async function doNewDashboard(app: App, name: string): Promise<void> {
-  const created: DashboardDocumentV2 = createEmptyDashboard(app.genId(), name);
-  const committed = await commitWorkspace(
-    app, (latest) => appendDashboard(latest ?? currentWorkspace(app), created), 'Created dashboard',
-  );
-  if (!committed) return;
-  revealDashboard(app, created.id);
+  const outcome = await createDashboard({
+    mutateWorkspace: app.mutateWorkspace,
+    genId: app.genId,
+    // The one path that reaches a workspace with no persisted aggregate at
+    // all: `currentWorkspace` synthesizes the envelope from projected state
+    // (and folds in the live in-memory Dashboard), which is what lets the
+    // very first Dashboard of a fresh workspace be created here.
+    baseline: () => currentWorkspace(app),
+  }, name);
+  const message = dashboardCreateMessage(outcome);
+  if (message !== null) flashToast(message, { document: app.document });
+  if (!outcome.ok) return;
+  // #343 §2: `mutateWorkspace` already projected the committed workspace; this
+  // is the local re-render every file-menu commit owes afterwards.
+  afterLibraryChange(app);
+  revealDashboard(app, outcome.data!);
 }
 
 /**
diff --git a/tests/unit/dashboard-create.test.ts b/tests/unit/dashboard-create.test.ts
new file mode 100644
index 00000000..129a19bb
--- /dev/null
+++ b/tests/unit/dashboard-create.test.ts
@@ -0,0 +1,119 @@
+// The ONE Dashboard-creation command (#481, #495 review 3).
+//
+// Both entry points — File ▸ New dashboard… and the empty-workspace
+// placeholder — run this, so what is pinned here is the behaviour they now
+// cannot disagree about: what gets appended, what is reported, and what a
+// baseline-less workspace does. Their own reveal policies stay covered by
+// `file-menu.test.ts` / `dashboard.test.ts`.
+
+import { describe, it, expect, vi } from 'vitest';
+import { createDashboard, dashboardCreateMessage } from '../../src/application/dashboard-create.js';
+import type { DashboardCreateOutcome } from '../../src/application/dashboard-create.js';
+import type { MutateWorkspace } from '../../src/state.js';
+import type { StoredWorkspaceV5 } from '../../src/generated/json-schema.types.js';
+
+const workspace = (over: Partial<StoredWorkspaceV5> = {}): StoredWorkspaceV5 => ({
+  storageVersion: 5, id: 'w1', key: 'k1', name: 'Lib', queries: [], dashboards: [], ...over,
+});
+
+/** A `mutateWorkspace` that hands the transform `latest` and commits whatever
+ *  candidate comes back, recording it. */
+const mutateOver = (latest: StoredWorkspaceV5 | null) => {
+  const committed: (StoredWorkspaceV5 | null)[] = [];
+  const mutateWorkspace = (async (transform) => {
+    const input = await transform(latest);
+    const candidate = input === null ? null : input.candidate;
+    committed.push(candidate);
+    if (input === null || candidate === null) return { ok: false, aborted: true, data: input?.data };
+    return { ok: true, workspace: candidate, dashboardRevision: null, data: input.data };
+  }) as MutateWorkspace;
+  return { committed, mutateWorkspace };
+};
+
+describe('createDashboard', () => {
+  it('appends one empty Dashboard with the given name and reports its id', async () => {
+    const { committed, mutateWorkspace } = mutateOver(workspace());
+    const outcome = await createDashboard(
+      { mutateWorkspace, genId: () => 'd-new', baseline: () => null }, 'Revenue',
+    );
+    expect(outcome.ok).toBe(true);
+    expect(outcome.data).toBe('d-new');
+    expect(committed[0]!.dashboards).toHaveLength(1);
+    expect(committed[0]!.dashboards[0].id).toBe('d-new');
+    expect(committed[0]!.dashboards[0].title).toBe('Revenue');
+    expect(committed[0]!.dashboards[0].tiles).toEqual([]);
+  });
+
+  it('is additive — every existing Dashboard and query is preserved in place', async () => {
+    const existing = workspace({
+      queries: [{ id: 'q1', sql: 'SELECT 1', specVersion: 1, spec: { specVersion: 1, name: 'Q' } }],
+      dashboards: [{
+        id: 'd1', title: 'First', revision: 3, tiles: [],
+        layout: { kind: 'flow', order: [] },
+      } as unknown as StoredWorkspaceV5['dashboards'][number]],
+    });
+    const { committed, mutateWorkspace } = mutateOver(existing);
+    await createDashboard({ mutateWorkspace, genId: () => 'd2', baseline: () => null }, 'Second');
+    expect(committed[0]!.dashboards.map((d) => d.id)).toEqual(['d1', 'd2']);
+    expect(committed[0]!.dashboards[0]).toEqual(existing.dashboards[0]);
+    expect(committed[0]!.queries).toEqual(existing.queries);
+  });
+
+  it('appends onto the caller BASELINE when nothing is persisted yet', async () => {
+    // The very first Dashboard of a fresh workspace: `mutateWorkspace` hands
+    // the transform `null`, and only the caller knows what the projected
+    // envelope is.
+    const { committed, mutateWorkspace } = mutateOver(null);
+    const outcome = await createDashboard(
+      { mutateWorkspace, genId: () => 'd1', baseline: () => workspace({ name: 'Fresh' }) }, 'First',
+    );
+    expect(outcome.ok).toBe(true);
+    expect(committed[0]!.name).toBe('Fresh');
+    expect(committed[0]!.dashboards.map((d) => d.id)).toEqual(['d1']);
+  });
+
+  it('prefers the dequeue-time aggregate over the baseline', async () => {
+    // The baseline is a FALLBACK, never the base: a write that landed while
+    // this one was queued must not be dropped.
+    const baseline = vi.fn(() => workspace({ name: 'stale' }));
+    const { committed, mutateWorkspace } = mutateOver(workspace({ name: 'latest' }));
+    await createDashboard({ mutateWorkspace, genId: () => 'd1', baseline }, 'First');
+    expect(committed[0]!.name).toBe('latest');
+    expect(baseline).not.toHaveBeenCalled();
+  });
+
+  it('aborts, committing nothing, when there is no workspace at all', async () => {
+    const { committed, mutateWorkspace } = mutateOver(null);
+    const outcome = await createDashboard(
+      { mutateWorkspace, genId: () => 'd1', baseline: () => null }, 'First',
+    );
+    expect(outcome.ok).toBe(false);
+    expect(committed).toEqual([null]);
+  });
+});
+
+describe('dashboardCreateMessage', () => {
+  const ok: DashboardCreateOutcome = { ok: true, workspace: workspace(), dashboardRevision: null, data: 'd1' };
+
+  it('confirms a real commit', () => {
+    expect(dashboardCreateMessage(ok)).toBe('Created dashboard');
+  });
+
+  it('says nothing about an abort — nothing was committed and nothing was lost', () => {
+    expect(dashboardCreateMessage({ ok: false, aborted: true })).toBeNull();
+  });
+
+  it('reports a rejection with the aggregate\'s first diagnostic', () => {
+    expect(dashboardCreateMessage({
+      ok: false,
+      diagnostics: [
+        { path: [], severity: 'error', code: 'x', message: 'Storage is full' },
+        { path: [], severity: 'error', code: 'y', message: 'second' },
+      ],
+    })).toBe('✕ Storage is full');
+  });
+
+  it('falls back to one sentence when a rejection carries no diagnostic', () => {
+    expect(dashboardCreateMessage({ ok: false, diagnostics: [] })).toBe('✕ Could not save workspace');
+  });
+});
diff --git a/tests/unit/dashboard-tree.test.ts b/tests/unit/dashboard-tree.test.ts
index 8024d76a..1dd058ca 100644
--- a/tests/unit/dashboard-tree.test.ts
+++ b/tests/unit/dashboard-tree.test.ts
@@ -842,10 +842,13 @@ describe('renderDashboardTree — Dashboard metadata pencil (#429 phase 3)', ()
   const pencil = (list: HTMLElement, rowKey: string): HTMLButtonElement | null =>
     rowFor(list, rowKey).querySelector<HTMLButtonElement>('.dash-tree-rename-btn');
   const dialogTitleInput = (): HTMLInputElement =>
-    document.querySelector<HTMLInputElement>('#dash-rename-title')!;
+    document.querySelector<HTMLInputElement>('#dash-rename-name')!;
   const dialogDescInput = (): HTMLTextAreaElement =>
     document.querySelector<HTMLTextAreaElement>('#dash-rename-description')!;
   const dialogSave = (): HTMLButtonElement => document.querySelector<HTMLButtonElement>('.fm-dialog-confirm')!;
+  /** Let the awaited commit chain (`mutateWorkspace` → the reprojection poke →
+   *  the dialog's own resolution) run to completion. */
+  const settle = (): Promise<void> => new Promise((resolve) => { setTimeout(resolve, 0); });
 
   it('renders the pencil on every Dashboard row', () => {
     const { app, list } = treeApp();
@@ -893,7 +896,7 @@ describe('renderDashboardTree — Dashboard metadata pencil (#429 phase 3)', ()
     expect(dialogDescInput().value).toBe('Quarterly figures');
   });
 
-  it('commits the edited title and description, and closes', async () => {
+  it('commits the edited title and description, and closes once the commit lands', async () => {
     const { app, list, committed } = treeApp();
     renderDashboardTree(app);
     click(pencil(list, 'w1:sales')!);
@@ -901,8 +904,13 @@ describe('renderDashboardTree — Dashboard metadata pencil (#429 phase 3)', ()
     dialogTitleInput().dispatchEvent(new Event('input', { bubbles: true }));
     dialogDescInput().value = 'Quarterly figures';
     dialogSave().click();
+    // #495 review 2: the card stays up until the write ANSWERS — it used to be
+    // torn down first, which is how a rejected commit lost the typed values
+    // with nothing said.
+    expect(document.querySelector('.fm-dialog-card')).not.toBeNull();
+    expect(dialogSave().disabled).toBe(true);
+    await settle();
     expect(document.querySelector('.fm-dialog-card')).toBeNull();
-    await Promise.resolve(); await Promise.resolve();
     expect(committed).toHaveLength(1);
     expect(committed[0]!.dashboards[0].title).toBe('Sales revenue');
     expect(committed[0]!.dashboards[0].description).toBe('Quarterly figures');
@@ -963,6 +971,63 @@ describe('renderDashboardTree — Dashboard metadata pencil (#429 phase 3)', ()
     expect(trigger.getAttribute('aria-expanded')).toBe('false');
   });
 
+  // ── #495 review 2: every unsuccessful outcome is HANDLED ─────────────────
+  // The dialog used to close before starting the mutation and then discard the
+  // promise, so each of these presented as "the dialog vanished" while the
+  // typed values went with it.
+
+  /** Mount the pencil dialog over a `mutateWorkspace` that answers `outcome`. */
+  const dialogOver = (outcome: unknown) => {
+    const mutateWorkspace = vi.fn(async () => outcome) as unknown as App['mutateWorkspace'];
+    const { app, list } = treeApp({ mutateWorkspace });
+    renderDashboardTree(app);
+    click(pencil(list, 'w1:sales')!);
+    dialogTitleInput().value = 'Sales revenue';
+    dialogTitleInput().dispatchEvent(new Event('input', { bubbles: true }));
+    dialogDescInput().value = 'Quarterly figures';
+    return { app, list };
+  };
+  const dialogError = (): HTMLElement | null => document.querySelector<HTMLElement>('.fm-dialog-error');
+
+  it('keeps the dialog, the typed values and a targeted diagnostic when the Dashboard no longer resolves', async () => {
+    dialogOver({ ok: false, aborted: true, data: 'declined' });
+    dialogSave().click();
+    await settle();
+    expect(document.querySelector('.fm-dialog-card')).not.toBeNull();
+    expect(dialogTitleInput().value).toBe('Sales revenue');
+    expect(dialogDescInput().value).toBe('Quarterly figures');
+    expect(dialogError()!.hidden).toBe(false);
+    expect(dialogError()!.textContent).toBe('That dashboard is no longer part of this workspace.');
+    // Recoverable from: the controls come back, so Cancel is reachable and a
+    // second Save is possible.
+    expect(dialogSave().disabled).toBe(false);
+  });
+
+  it('reports the aggregate\'s own diagnostic when the commit is rejected', async () => {
+    dialogOver({ ok: false, diagnostics: [{ path: [], severity: 'error', code: 'x', message: 'Storage is full' }] });
+    dialogSave().click();
+    await settle();
+    expect(document.querySelector('.fm-dialog-card')).not.toBeNull();
+    expect(dialogError()!.textContent).toBe('Storage is full');
+  });
+
+  it('falls back to one sentence when a rejection carries no diagnostic', async () => {
+    dialogOver({ ok: false, diagnostics: [] });
+    dialogSave().click();
+    await settle();
+    expect(dialogError()!.textContent).toBe('Could not save this dashboard.');
+  });
+
+  it('cannot submit the same rename twice while the first write is in flight', async () => {
+    const { app } = dialogOver({ ok: true, workspace: workspace(), dashboardRevision: null });
+    dialogSave().click();
+    // Both the button and the Enter shortcut are refused until it answers.
+    dialogSave().click();
+    dialogTitleInput().dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true, cancelable: true }));
+    await settle();
+    expect(app.mutateWorkspace).toHaveBeenCalledTimes(1);
+  });
+
   it('does not also run the row\'s own navigation, and cancels only its own row\'s pending click', () => {
     vi.useFakeTimers();
     const { app, list } = treeApp();
@@ -979,6 +1044,81 @@ describe('renderDashboardTree — Dashboard metadata pencil (#429 phase 3)', ()
   });
 });
 
+/**
+ * #495 review 1 — every nested action control owns its own activation keys.
+ *
+ * The tree's `keydown` handler is on the LIST, and its Enter arm calls
+ * `preventDefault()` and runs the FOCUSED ROW's command. Before this, Enter on
+ * the pencil opened the Dashboard instead of the dialog (and the
+ * `preventDefault()` could suppress the button's own activation on the way
+ * out), which the `⋯` and the orphan-variable trash shared.
+ *
+ * Two independent layers are asserted here: each button stops Enter/Space from
+ * propagating, AND the list handler ignores an Enter that originated on a
+ * button — either alone would fix the bug, and a later control that forgets
+ * the first is still covered by the second.
+ */
+describe('renderDashboardTree — nested action buttons own their activation keys (#495)', () => {
+  /** Dispatch a real bubbling keydown, and report whether anything called
+   *  `preventDefault()` — the signal that the tree handler claimed the key. */
+  const press = (el: Element, k: string): boolean =>
+    !el.dispatchEvent(new KeyboardEvent('keydown', { key: k, bubbles: true, cancelable: true }));
+
+  it('Enter on the Dashboard pencil opens the dialog and does NOT open the Dashboard', () => {
+    const { app, list } = treeApp();
+    renderDashboardTree(app);
+    const trigger = rowFor(list, 'w1:sales').querySelector<HTMLButtonElement>('.dash-tree-rename-btn')!;
+    // The browser's own key-to-click synthesis is what opens the dialog; what
+    // matters here is that nothing prevented it and the row did not act.
+    expect(press(trigger, 'Enter')).toBe(false);
+    expect(app.openDashboard).not.toHaveBeenCalled();
+    // ...and the click the browser then synthesizes opens exactly one dialog.
+    click(trigger);
+    expect(document.querySelectorAll('.fm-dialog-card')).toHaveLength(1);
+    expect(app.openDashboard).not.toHaveBeenCalled();
+  });
+
+  it('Space on the Dashboard pencil neither navigates nor is swallowed', () => {
+    const { app, list } = treeApp();
+    renderDashboardTree(app);
+    const trigger = rowFor(list, 'w1:sales').querySelector<HTMLButtonElement>('.dash-tree-rename-btn')!;
+    expect(press(trigger, ' ')).toBe(false);
+    expect(app.openDashboard).not.toHaveBeenCalled();
+  });
+
+  it('Enter on the ⋯ menu button does not run the row\'s primary action', () => {
+    const { app, list } = treeApp();
+    renderDashboardTree(app);
+    const trigger = rowFor(list, 'w1:sales').querySelector<HTMLButtonElement>('.dash-tree-menu-btn')!;
+    expect(press(trigger, 'Enter')).toBe(false);
+    expect(app.openDashboard).not.toHaveBeenCalled();
+  });
+
+  it('Enter on an orphaned variable\'s trash does not open its option-SQL tab', () => {
+    const { app, list } = treeApp();
+    openAll(app, 'sales');
+    renderDashboardTree(app);
+    const trigger = rowFor(list, 'w1:sales:variable:region')
+      .querySelector<HTMLButtonElement>('.dash-tree-del-btn')!;
+    expect(press(trigger, 'Enter')).toBe(false);
+    expect(app.openVariableTab).not.toHaveBeenCalled();
+  });
+
+  it('the list handler itself refuses an Enter that came from a button, even one that let it bubble', () => {
+    const { app, list } = treeApp();
+    renderDashboardTree(app);
+    // A control with NO `isolateActivationKeys` of its own: the second layer.
+    const naive = document.createElement('button');
+    rowFor(list, 'w1:sales').appendChild(naive);
+    expect(press(naive, 'Enter')).toBe(false);
+    expect(app.openDashboard).not.toHaveBeenCalled();
+    // The row itself still activates on Enter — the guard is about the target,
+    // not about Enter.
+    expect(press(rowFor(list, 'w1:sales'), 'Enter')).toBe(true);
+    expect(app.openDashboard).toHaveBeenCalledExactlyOnceWith({ dashboardId: 'sales', mode: 'view' });
+  });
+});
+
 describe('renderDashboardTree — keyboard', () => {
   it('Down/Up traverse the VISIBLE rows and stop at the ends', () => {
     const { app, list } = treeApp();
diff --git a/tests/unit/dashboard.test.ts b/tests/unit/dashboard.test.ts
index 1079703e..e1ab32ac 100644
--- a/tests/unit/dashboard.test.ts
+++ b/tests/unit/dashboard.test.ts
@@ -4036,6 +4036,46 @@ describe('renderDashboard — unified live modes (#407)', () => {
     expect(openDashboard).toHaveBeenCalledWith({ dashboardId: created.id, mode: 'edit' });
   });
 
+  // #495 review 3: the placeholder and File ▸ New dashboard… run ONE creation
+  // command now (`application/dashboard-create.ts`). It used to call
+  // `mutateWorkspace` directly and say nothing at all when the commit was
+  // rejected, so a storage or validation failure was indistinguishable from
+  // success — the File menu had always toasted the same failure.
+  it('reports a rejected create instead of failing silently', async () => {
+    const empty = { ...wsWith(), dashboards: [] } as unknown as ReturnType<typeof wsWith>;
+    const commit = vi.fn(async () => ({
+      ok: false as const,
+      diagnostics: [{ path: [], severity: 'error' as const, code: 'x', message: 'Storage is full' }],
+    }));
+    const { app } = modeApp({ workspace: empty, mode: 'edit' });
+    app.workspace.commit = commit as unknown as App['workspace']['commit'];
+    const openDashboard = vi.fn();
+    app.openDashboard = openDashboard;
+    await render(app);
+    qs<HTMLButtonElement>(app.root, '.dash-create').click();
+    document.querySelector<HTMLButtonElement>('.fm-dialog-confirm')!.click();
+    await flush();
+    expect(document.querySelector('.share-toast')?.textContent).toBe('✕ Storage is full');
+    // Nothing was created, so nothing is opened.
+    expect(openDashboard).not.toHaveBeenCalled();
+  });
+
+  it('creates the first Dashboard of a workspace with no persisted aggregate yet', async () => {
+    // `mutateWorkspace` hands the transform `null` until an aggregate has been
+    // committed once; the projected workspace is the baseline this entry point
+    // supplies, exactly as the File menu supplies its own.
+    const empty = { ...wsWith(), dashboards: [] } as unknown as ReturnType<typeof wsWith>;
+    const { app, commit } = modeApp({ workspace: empty, mode: 'edit' });
+    app.workspace.loadById = (async () => ({ status: 'empty' as const })) as App['workspace']['loadById'];
+    await render(app);
+    qs<HTMLButtonElement>(app.root, '.dash-create').click();
+    document.querySelector<HTMLButtonElement>('.fm-dialog-confirm')!.click();
+    await flush();
+    expect(commit).toHaveBeenCalledOnce();
+    expect(commit.mock.calls[0][0].dashboards).toHaveLength(1);
+    expect(document.querySelector('.share-toast')?.textContent).toBe('Created dashboard');
+  });
+
   it('cancelling the prompt commits nothing', async () => {
     const empty = { ...wsWith(), dashboards: [] } as unknown as ReturnType<typeof wsWith>;
     const { app, commit } = modeApp({ workspace: empty, mode: 'edit' });
diff --git a/tests/unit/dialog-shell.test.ts b/tests/unit/dialog-shell.test.ts
index bc7d9367..420f63b9 100644
--- a/tests/unit/dialog-shell.test.ts
+++ b/tests/unit/dialog-shell.test.ts
@@ -6,8 +6,11 @@
 // an explicit `returnFocusTo` (replacing the hardcoded File-menu-button
 // restore) and `closeOpenDialogShell()`'s single-slot staleness guard.
 
-import { describe, it, expect } from 'vitest';
-import { closeOpenDialogShell, openDialogShell, openNameDialog } from '../../src/ui/dialog-shell.js';
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import {
+  closeOpenDialogShell, openDialogShell, openMetadataDialog, openNameDialog,
+} from '../../src/ui/dialog-shell.js';
+import type { DialogHandle } from '../../src/ui/dialog-shell.js';
 import { h } from '../../src/ui/dom.js';
 import { makeApp } from '../helpers/fake-app.js';
 
@@ -17,6 +20,14 @@ const click = (el: Element): boolean => el.dispatchEvent(new Event('click', { bu
 const mousedown = (el: Element): boolean => el.dispatchEvent(new Event('mousedown', { bubbles: true }));
 const backdropOf = (): HTMLElement | null => document.querySelector('.fm-dialog-backdrop');
 
+/** Dialogs opened by a test that does not close them itself. Every shell
+ *  installs a CAPTURE-phase document `keydown` listener that outlives its
+ *  node, so one left mounted answers a later test's Tab before that test's own
+ *  dialog does — closing is the only real teardown. */
+const opened: DialogHandle[] = [];
+const track = (handle: DialogHandle): DialogHandle => { opened.push(handle); return handle; };
+afterEach(() => { while (opened.length) opened.pop()!.close(); });
+
 describe('openNameDialog', () => {
   it('renders the title/label/initial value and confirm label', () => {
     const app = makeApp();
@@ -160,6 +171,153 @@ describe('openNameDialog', () => {
   });
 });
 
+// #495 review 4: the Tab trap alone made the card behave like a modal for a
+// sighted keyboard user while telling assistive technology nothing at all.
+describe('openDialogShell — dialog semantics', () => {
+  it('marks the card as a modal dialog named by its own title', () => {
+    const app = makeApp();
+    track(openDialogShell(app, 'Edit dashboard', [h('span', {}, 'Body')], { returnFocusTo: null }));
+    const card = document.querySelector('.fm-dialog-card')!;
+    expect(card.getAttribute('role')).toBe('dialog');
+    expect(card.getAttribute('aria-modal')).toBe('true');
+    const titleId = card.getAttribute('aria-labelledby')!;
+    expect(titleId).not.toBe('');
+    const title = document.getElementById(titleId)!;
+    expect(title.classList.contains('fm-dialog-title')).toBe(true);
+    expect(title.textContent).toBe('Edit dashboard');
+  });
+
+  it('gives two coexisting dialogs distinct title ids', () => {
+    // A stale dialog can still be mounted while a newer one opens; a shared
+    // constant id would make both `aria-labelledby`s resolve to the first.
+    const app = makeApp();
+    track(openDialogShell(app, 'A', [h('span', {}, 'a')], { returnFocusTo: null }));
+    track(openDialogShell(app, 'B', [h('span', {}, 'b')], { returnFocusTo: null }));
+    const [a, b] = [...document.querySelectorAll('.fm-dialog-card')];
+    expect(a.getAttribute('aria-labelledby')).not.toBe(b.getAttribute('aria-labelledby'));
+    expect(document.getElementById(a.getAttribute('aria-labelledby')!)!.textContent).toBe('A');
+    expect(document.getElementById(b.getAttribute('aria-labelledby')!)!.textContent).toBe('B');
+  });
+});
+
+describe('openMetadataDialog', () => {
+  const nameInput = (): HTMLInputElement => document.querySelector<HTMLInputElement>('#pnl-name')!;
+  const descInput = (): HTMLTextAreaElement => document.querySelector<HTMLTextAreaElement>('#pnl-description')!;
+  const save = (): HTMLButtonElement => document.querySelector<HTMLButtonElement>('.fm-dialog-confirm')!;
+  const cancelBtn = (): HTMLButtonElement => document.querySelector<HTMLButtonElement>('.fm-dialog-cancel')!;
+  const errorEl = (): HTMLParagraphElement => document.querySelector<HTMLParagraphElement>('.fm-dialog-error')!;
+  const settle = (): Promise<void> => new Promise((resolve) => { setTimeout(resolve, 0); });
+
+  const open = (
+    onConfirm: (values: { name: string; description: string }) => Promise<string | null>,
+    over: Partial<Parameters<typeof openMetadataDialog>[1]> = {},
+  ) => track(openMetadataDialog(makeApp(), {
+    title: 'Edit panel', nameLabel: 'Name', descriptionLabel: 'Description',
+    name: 'Revenue', description: 'By region', confirmLabel: 'Save',
+    idPrefix: 'pnl', returnFocusTo: null, onConfirm, ...over,
+  }));
+
+  it('prefills both fields, labels them, and names the dialog', () => {
+    open(async () => null);
+    expect(document.querySelector('.fm-dialog-card')!.getAttribute('role')).toBe('dialog');
+    expect(nameInput().value).toBe('Revenue');
+    expect(descInput().value).toBe('By region');
+    expect(document.querySelector('label[for="pnl-name"]')!.textContent).toBe('Name');
+    expect(document.querySelector('label[for="pnl-description"]')!.textContent).toBe('Description');
+    expect(save().textContent).toBe('Save');
+    expect(errorEl().hidden).toBe(true);
+  });
+
+  it('commits the TRIMMED name with the description verbatim, and closes on success', async () => {
+    const onConfirm = vi.fn(async () => null);
+    open(onConfirm);
+    nameInput().value = '  Revenue by region  ';
+    descInput().value = 'line one\nline two';
+    save().click();
+    await settle();
+    expect(onConfirm).toHaveBeenCalledExactlyOnceWith({
+      name: 'Revenue by region', description: 'line one\nline two',
+    });
+    expect(backdropOf()).toBeNull();
+  });
+
+  it('Enter in the name field commits; Enter in the description does not', async () => {
+    const onConfirm = vi.fn(async () => null);
+    open(onConfirm);
+    key(descInput(), 'Enter');
+    expect(onConfirm).not.toHaveBeenCalled();
+    key(nameInput(), 'Enter');
+    await settle();
+    expect(onConfirm).toHaveBeenCalledTimes(1);
+  });
+
+  it('refuses a blank name: Save is disabled and Enter commits nothing', async () => {
+    const onConfirm = vi.fn(async () => null);
+    open(onConfirm);
+    nameInput().value = '   ';
+    nameInput().dispatchEvent(new Event('input', { bubbles: true }));
+    expect(save().disabled).toBe(true);
+    key(nameInput(), 'Enter');
+    await settle();
+    expect(onConfirm).not.toHaveBeenCalled();
+    expect(backdropOf()).not.toBeNull();
+  });
+
+  it('keeps the card, the typed values and the controls when the commit reports a failure', async () => {
+    open(async () => 'That dashboard is no longer part of this workspace.');
+    nameInput().value = 'Kept';
+    nameInput().dispatchEvent(new Event('input', { bubbles: true }));
+    save().click();
+    await settle();
+    expect(backdropOf()).not.toBeNull();
+    expect(nameInput().value).toBe('Kept');
+    expect(errorEl().hidden).toBe(false);
+    expect(errorEl().getAttribute('role')).toBe('alert');
+    expect(errorEl().textContent).toBe('That dashboard is no longer part of this workspace.');
+    expect(save().disabled).toBe(false);
+    expect(cancelBtn().disabled).toBe(false);
+    expect(document.activeElement).toBe(nameInput());
+  });
+
+  it('disables both actions while a commit is in flight, so the same write cannot be submitted twice', async () => {
+    let release = (): void => {};
+    const onConfirm = vi.fn(() => new Promise<string | null>((resolve) => { release = () => resolve(null); }));
+    open(onConfirm);
+    save().click();
+    expect(save().disabled).toBe(true);
+    expect(cancelBtn().disabled).toBe(true);
+    save().click();
+    key(nameInput(), 'Enter');
+    expect(onConfirm).toHaveBeenCalledTimes(1);
+    release();
+    await settle();
+    expect(backdropOf()).toBeNull();
+  });
+
+  it('drops a late answer for a dialog that was force-closed while the write was queued', async () => {
+    let release = (message: string | null): void => { void message; };
+    open(() => new Promise<string | null>((resolve) => { release = resolve; }));
+    save().click();
+    // A surface transition tears every dialog down mid-write.
+    closeOpenDialogShell();
+    expect(backdropOf()).toBeNull();
+    release('Storage is full');
+    await settle();
+    // No diagnostic is written into a detached card, and nothing reopens.
+    expect(backdropOf()).toBeNull();
+  });
+
+  it('runs the caller\'s onClose and restores focus to the trigger', () => {
+    const trigger = h('button', {}, 'Pencil') as HTMLButtonElement;
+    document.body.appendChild(trigger);
+    const onClose = vi.fn();
+    const handle = open(async () => null, { returnFocusTo: trigger, onClose });
+    handle.close();
+    expect(onClose).toHaveBeenCalledTimes(1);
+    expect(document.activeElement).toBe(trigger);
+  });
+});
+
 describe('openDialogShell — Tab trap', () => {
   it('wraps Tab from the last focusable to the first, and Shift+Tab the other way', () => {
     const app = makeApp();

From 1d7d1e7d1fbb22a721b62ab74b0e62158ca6f4a3 Mon Sep 17 00:00:00 2001
From: Boris Tyshkevich <btyshkevich@altinity.com>
Date: Mon, 27 Jul 2026 12:46:25 +0000
Subject: [PATCH 2/8] =?UTF-8?q?feat(#494):=20direct=20Dashboard/Panel=20ro?=
 =?UTF-8?q?w=20actions,=20replacing=20the=20=E2=8B=AF=20overflow=20menus?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Dashboard tree's rows now expose their operations as real buttons instead
of hiding them behind a menu, following the Library Query row's pencil/trash
vocabulary. No production row renders a `⋯` any more, so `DashboardTreeMenuItem`,
`buildMenuButton` and the menu CSS are gone rather than left as an unused
abstraction.

Model (`application/dashboard-tree-model.ts`): `menu`, `deletable` and
`renamable` — three expressions of the same idea — collapse into one
`actions: DashboardTreeAction[]`, each carrying its accessible name, tooltip,
fully-resolved target (stable ids only), an `unavailable` reason and, for the
destructive ones, the confirmation sentence. Availability is the #427
exactly-one-owner rule, answered ONCE here through `buildQueryOwnershipIndex`
rather than re-derived in the view; `OwnershipWorkspace.queries` narrows to
`{ id }` so the tree's own loosened projection types can be indexed by it.

Pure transforms (`dashboard/application/dashboard-removal.ts`):
`removeDashboardPanel` removes a tile and exactly the dedicated query it owns
— proving ownership first, composing `removeTileMembership` for layout
normalization and grid-fallback regeneration, bumping the target revision
exactly once — and `removeDashboardDocument` removes a document plus the
queries its own tiles own, keeping any query another Dashboard also
references. An orphaned `variableConfigs` entry deliberately survives a panel
delete (#494 non-goal).

Commits (`application/dashboard-delete.ts`, `dashboard-panel-metadata.ts`):
both re-resolve their target inside the queued read-latest transform, so a
confirmation or dialog that went stale while it was open commits nothing. The
panel pencil edits the tile's OWNED QUERY through `renameSaved` — inheriting
its linked-tab reconciliation — with a new dequeue-time `guard` on
`patchSavedSpec` proving the tile still owns it.

View: one `buildActionButton` per model action; unavailable controls render
`aria-disabled` and inert with the reason as their tooltip, rather than
vanishing; destructive ones confirm through the same anchored-menu primitive
#447 already used; deleting a panel moves keyboard focus to the next sibling,
else the previous, else the Panels group. The panel dialog warns when an
imported tile title outranks the query name being edited.

Not included: the Open-in-Dashboard focus button. It dispatches
`focus: { kind: 'tile' }`, which is a proven no-op on flow-layout KPI tiles
until #438 lands, and #494 forbids shipping a known no-op focus action.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018mujm1kW7jDGpTEfscndcU
---
 src/application/dashboard-delete.ts           | 118 ++++
 src/application/dashboard-panel-metadata.ts   | 122 ++++
 src/application/dashboard-tree-model.ts       | 218 +++++--
 .../application/dashboard-removal.ts          | 185 ++++++
 src/dashboard/model/query-ownership.ts        |  16 +-
 src/state.ts                                  |  29 +-
 src/styles.css                                |  78 +--
 src/ui/dashboard-tree.ts                      | 353 +++++++----
 src/ui/dialog-shell.ts                        |  10 +-
 tests/unit/dashboard-delete.test.ts           | 321 ++++++++++
 tests/unit/dashboard-panel-metadata.test.ts   | 289 +++++++++
 tests/unit/dashboard-removal.test.ts          | 223 +++++++
 tests/unit/dashboard-tree-model.test.ts       | 257 +++++++-
 tests/unit/dashboard-tree.test.ts             | 555 +++++++++++++++---
 14 files changed, 2458 insertions(+), 316 deletions(-)
 create mode 100644 src/application/dashboard-delete.ts
 create mode 100644 src/application/dashboard-panel-metadata.ts
 create mode 100644 src/dashboard/application/dashboard-removal.ts
 create mode 100644 tests/unit/dashboard-delete.test.ts
 create mode 100644 tests/unit/dashboard-panel-metadata.test.ts
 create mode 100644 tests/unit/dashboard-removal.test.ts

diff --git a/src/application/dashboard-delete.ts b/src/application/dashboard-delete.ts
new file mode 100644
index 00000000..4e84ef5e
--- /dev/null
+++ b/src/application/dashboard-delete.ts
@@ -0,0 +1,118 @@
+// The `mutateWorkspace` plumbing around #494's two atomic deletes.
+//
+// Split along the same boundary every other Dashboard write in this repo
+// holds: the pure transforms are `dashboard/application/dashboard-removal.ts`
+// (beside the tile/layout code they compose), and the async, serialized,
+// read-latest-at-dequeue commit is here — modeled on
+// `dashboard-variable-config.ts` and `dashboard-title.ts`, which is what makes
+// three different destructive tree controls behave identically under
+// concurrency.
+//
+// The transform runs INSIDE the queue, so the target is re-resolved and its
+// ownership re-proven against committed truth rather than against whatever the
+// tree was painting when the confirmation opened. A row can be several seconds
+// stale by the time a user reads a confirmation and answers it.
+//
+// Typed against structural deps rather than the `App` contract:
+// `src/application/**` must never import `src/ui/**`
+// (build/check-boundaries.mjs).
+
+import {
+  removeDashboardDocument, removeDashboardPanel,
+} from '../dashboard/application/dashboard-removal.js';
+import type { PanelRemovalRefusal } from '../dashboard/application/dashboard-removal.js';
+import type {
+  MutateWorkspace, WorkspaceExternallyChangedInfo, WorkspaceMutationOutcome,
+} from '../state.js';
+
+/** Why the transform declined, threaded back through `mutateWorkspace`'s
+ *  `data` channel. `no-workspace` is the primitive's own "nothing is loaded"
+ *  case; every other value is the pure transform's refusal, verbatim. */
+export type DashboardDeleteAbort = PanelRemovalRefusal | 'dashboard-missing' | 'no-workspace';
+
+export type DashboardDeleteOutcome = WorkspaceMutationOutcome<DashboardDeleteAbort>;
+
+export interface DashboardDeleteDeps {
+  mutateWorkspace: MutateWorkspace;
+  /** Re-read committed truth: a rendered Dashboard holds its document from
+   *  construction, and a deleted panel (or Dashboard) must not stay on screen
+   *  after its removal commits. */
+  onWorkspaceExternallyChanged(info: WorkspaceExternallyChangedInfo): void;
+}
+
+/** One tile, addressed by the ids the row carried — never by label or index. */
+export interface PanelDeleteTarget {
+  dashboardId: string;
+  tileId: string;
+}
+
+/**
+ * Remove one panel tile and its dedicated owned query, atomically.
+ *
+ * `queriesChanged: true` is a fact, not a default: this write deletes a query,
+ * so a rendered Dashboard has to rebuild its viewer session rather than merely
+ * re-read a document.
+ */
+export async function commitPanelRemoval(
+  deps: DashboardDeleteDeps, target: PanelDeleteTarget,
+): Promise<DashboardDeleteOutcome> {
+  const outcome = await deps.mutateWorkspace<DashboardDeleteAbort>((latest) => {
+    if (latest === null) return { candidate: null, data: 'no-workspace' };
+    const result = removeDashboardPanel({ workspace: latest, ...target });
+    return result.status === 'refused'
+      ? { candidate: null, data: result.reason }
+      : { candidate: result.workspace };
+  });
+  if (outcome.ok) {
+    deps.onWorkspaceExternallyChanged({ workspace: outcome.workspace, queriesChanged: true });
+  }
+  return outcome;
+}
+
+/** Remove one whole Dashboard document and the queries its panels own. */
+export async function commitDashboardRemoval(
+  deps: DashboardDeleteDeps, dashboardId: string,
+): Promise<DashboardDeleteOutcome> {
+  const outcome = await deps.mutateWorkspace<DashboardDeleteAbort>((latest) => {
+    if (latest === null) return { candidate: null, data: 'no-workspace' };
+    const result = removeDashboardDocument({ workspace: latest, dashboardId });
+    return result.status === 'refused'
+      ? { candidate: null, data: result.reason }
+      : { candidate: result.workspace };
+  });
+  if (outcome.ok) {
+    deps.onWorkspaceExternallyChanged({ workspace: outcome.workspace, queriesChanged: true });
+  }
+  return outcome;
+}
+
+/**
+ * What to tell the user about a delete — `null` when it succeeded and the
+ * disappearing row is its own report.
+ *
+ * Every refusal gets a sentence that says what the DATA did, because none of
+ * them is something the user did wrong and all of them mean "nothing was
+ * deleted". The missing-resource wording matches the one #429 phase 1 settled
+ * for `openSavedQuery`, so the tree speaks with one voice about resources that
+ * vanished under it.
+ */
+export function dashboardDeleteMessage(outcome: DashboardDeleteOutcome): string | null {
+  if (outcome.ok) return null;
+  if (!outcome.aborted) {
+    return '✕ ' + (outcome.diagnostics[0]?.message || 'Could not save workspace');
+  }
+  switch (outcome.data) {
+    case 'dashboard-missing':
+      return 'That dashboard is no longer part of this workspace.';
+    case 'tile-missing':
+      return 'That panel is no longer part of this dashboard.';
+    case 'ownership-unproven':
+      return 'This panel’s query is shared or missing, so nothing was deleted.';
+    case 'dashboard-duplicate':
+      return 'This workspace has two dashboards with the same id, so nothing was deleted.';
+    // `no-workspace` — nothing is loaded, so nothing was lost and there is
+    // nothing the user can act on.
+    default:
+      return null;
+  }
+}
diff --git a/src/application/dashboard-panel-metadata.ts b/src/application/dashboard-panel-metadata.ts
new file mode 100644
index 00000000..8d3f66c4
--- /dev/null
+++ b/src/application/dashboard-panel-metadata.ts
@@ -0,0 +1,122 @@
+// Editing ONE panel's dedicated owned query metadata — name and description
+// only (#494).
+//
+// A Dashboard panel does not own a title of its own for ordinary authoring:
+// what the tile displays comes from the query it owns (`spec.name` /
+// `spec.description`), and only an IMPORTED tile carries a local override.
+// So the pencil on a Panel row edits the owned QUERY, through the very same
+// `renameSaved` path the Library row's pencil uses — which is what keeps a
+// linked Query tab in sync (clean tabs adopt the commit, dirty ones are
+// conflict-flagged) instead of this growing a second, subtly different
+// metadata writer.
+//
+// What this module adds on top is the part a Library rename does not need:
+// PROOF, at dequeue time, that the query still belongs to the tile the dialog
+// was opened for. A tree dialog can outlive the row it came from — another tab
+// can delete the tile, or #428's assignment can re-point it — and the query id
+// alone cannot say which member owns it. The `guard` runs inside the queued
+// transform, so the answer comes from committed truth rather than from
+// whatever the tree was painting when the pencil was clicked.
+//
+// Typed against a structural deps bag: `src/application/**` must never import
+// `src/ui/**` (build/check-boundaries.mjs).
+
+import { renameSaved } from '../state.js';
+import type { AppState, MutateWorkspace, SpecValidationService } from '../state.js';
+import { ownersOfQuery } from '../dashboard/model/query-ownership.js';
+import type { SavedQueryV2, StoredWorkspaceV5 } from '../generated/json-schema.types.js';
+
+/** Which owned query to edit, addressed the way #430 requires — Dashboard id +
+ *  the member's own Dashboard-local id + the query id, never a title, a name
+ *  or a collection position. All three are re-resolved at dequeue time. */
+export interface PanelMetadataTarget {
+  dashboardId: string;
+  tileId: string;
+  queryId: string;
+}
+
+export type PanelMetadataOutcome =
+  | { status: 'ok'; entry: SavedQueryV2 }
+  /** The tile no longer owns this query (deleted, re-pointed, or now shared),
+   *  or the query itself is gone. Nothing was committed, and no retry of the
+   *  same edit can succeed. */
+  | { status: 'stale' }
+  /** A linked tab is holding Spec JSON that does not parse/validate, so the
+   *  same patch cannot be applied to both the entry and the draft. Nothing was
+   *  committed; the tab is where this gets resolved. */
+  | { status: 'invalid-draft' }
+  | { status: 'rejected'; message: string };
+
+export interface PanelMetadataDeps {
+  state: AppState;
+  mutateWorkspace: MutateWorkspace;
+  specValidators: SpecValidationService;
+  /**
+   * Ask every rendered surface to re-read committed truth, so a renamed panel's
+   * tile heading and its tree row update without waiting for an unrelated
+   * repaint. Declared as a plain notification rather than as
+   * `onWorkspaceExternallyChanged` itself: `renameSaved` does not hand back the
+   * committed aggregate, and inventing a `workspace: null` for that hook would
+   * mean "the record was cleared", which is the opposite of what happened.
+   */
+  refreshCommittedSurfaces(): void;
+}
+
+/**
+ * The #427 exactly-one-owner rule, asked about ONE specific member.
+ *
+ * Exported because the tree model answers the same question when it decides
+ * whether to enable the pencil at all — the difference is only WHEN it is
+ * asked (paint time there, dequeue time here), and the two must agree.
+ */
+export function ownedByPanel(
+  workspace: StoredWorkspaceV5, target: PanelMetadataTarget,
+): boolean {
+  const owners = ownersOfQuery(workspace, target.queryId);
+  return owners.length === 1
+    && owners[0].dashboardId === target.dashboardId
+    && owners[0].tileId === target.tileId
+    && workspace.queries.some((query) => query.id === target.queryId);
+}
+
+/**
+ * Commit a panel's owned-query name/description.
+ *
+ * `renameSaved` does the rest of the work and its rules are inherited
+ * deliberately: the name is trimmed and a blank one commits nothing, an empty
+ * description CLEARS the field rather than storing `''`, the SQL, the query
+ * id, `spec.dashboard.role`, panel configuration, variants, size hints, time
+ * ranges and unknown Spec fields are all carried through untouched, and no
+ * Dashboard document is read or written — so a metadata-only edit cannot
+ * increment a Dashboard revision.
+ *
+ * A tile-local imported `title`/`description` override is likewise untouched:
+ * this writes the QUERY, and the override keeps its established display
+ * precedence (the caller is responsible for saying so).
+ */
+export async function commitPanelQueryMetadata(
+  deps: PanelMetadataDeps, target: PanelMetadataTarget, name: string, description: string,
+): Promise<PanelMetadataOutcome> {
+  const result = await renameSaved(
+    deps.state, target.queryId, name, description,
+    deps.mutateWorkspace, deps.specValidators,
+    (latest) => ownedByPanel(latest, target),
+  );
+  // `renameSaved` answers `undefined` for a blank name or a query missing from
+  // the PROJECTED collection — both mean "nothing was attempted".
+  if (result === undefined) return { status: 'stale' };
+  if (result.ok) {
+    deps.refreshCommittedSurfaces();
+    return { status: 'ok', entry: result.entry };
+  }
+  // `deletedExternally` is deliberately NOT checked alongside this: it means
+  // the query was absent from `latest`, and `ownedByPanel` already requires it
+  // to be present — `patchSavedSpec` evaluates the guard BEFORE its own
+  // deleted-externally test, so a deleted query always refuses here first.
+  if (result.guardRefused) return { status: 'stale' };
+  if (result.invalidTab !== null) return { status: 'invalid-draft' };
+  return {
+    status: 'rejected',
+    message: result.diagnostics?.[0]?.message || 'Could not save this panel.',
+  };
+}
diff --git a/src/application/dashboard-tree-model.ts b/src/application/dashboard-tree-model.ts
index de136e39..39012c62 100644
--- a/src/application/dashboard-tree-model.ts
+++ b/src/application/dashboard-tree-model.ts
@@ -30,6 +30,7 @@ import type { DashboardFocusTarget, MainSurfaceState, OpenDashboardRequest } fro
 import type { DashboardTreeGroup, DashboardTreeUiState } from '../core/dashboard-tree-ui-state.js';
 import { encodeKeyPart, groupStateKey } from '../core/dashboard-tree-ui-state.js';
 import { inferDashboardVariables } from '../core/dashboard-variables.js';
+import { buildQueryOwnershipIndex } from '../dashboard/model/query-ownership.js';
 import type { DashboardVariable } from '../core/dashboard-variables.js';
 import type { LibraryDropTarget } from '../core/library-drag.js';
 
@@ -126,12 +127,60 @@ export type DashboardTreeCommand =
    *  drawer; the command itself is unchanged, since the identity is the same. */
   | { kind: 'open-variable'; dashboardId: string; name: string };
 
-export interface DashboardTreeMenuItem {
+/**
+ * #494 — the trailing DIRECT controls a row offers, replacing the `⋯` overflow
+ * menu on Dashboard and Panel rows alike.
+ *
+ * A row's operations are stated here, fully resolved, for the same reason its
+ * commands are: `ui/dashboard-tree.ts` must not re-derive capability from row
+ * kind, DOM classes or — worst of all — ownership. Which panel may be edited
+ * or deleted is a data-integrity question about the whole workspace, and it is
+ * answered exactly once, here.
+ */
+export type DashboardTreeActionKind =
+  | 'edit-dashboard'
+  | 'delete-dashboard'
+  | 'edit-panel'
+  | 'delete-panel'
+  /** #447's orphaned-variable trash, now expressed as one of these rather
+   *  than as its own `deletable` boolean. */
+  | 'delete-variable-config';
+
+/** What an action acts ON, by stable ids only — never a title, a label or a
+ *  collection position (#430). A panel action carries the owned query's id as
+ *  well as the tile's: both are re-resolved inside the write's transform, and
+ *  the pair is what proves the write is aimed at the intended resource. */
+export type DashboardTreeActionTarget =
+  | { kind: 'dashboard'; dashboardId: string }
+  | { kind: 'panel'; dashboardId: string; tileId: string; queryId: string }
+  | { kind: 'variable-config'; dashboardId: string; name: string };
+
+export interface DashboardTreeAction {
+  kind: DashboardTreeActionKind;
+  /** The control's accessible name. Always identifies the target RESOURCE —
+   *  a screen-reader user hears the buttons of many rows in sequence, and
+   *  "Edit" alone names none of them. */
   label: string;
-  /** `null` when the operation is unavailable — a source-less or broken member's
-   *  query-open. The item still renders, disabled, so the row's full vocabulary
-   *  stays discoverable and keyboard-reachable. */
-  command: DashboardTreeCommand | null;
+  /** The pointer tooltip, which may be shorter than the accessible name. */
+  tooltip: string;
+  /** `null` when the operation belongs to this row's vocabulary but cannot be
+   *  performed right now (#494's malformed-ownership rule). The control still
+   *  renders — disabled semantically, not merely greyed out — so the row's
+   *  vocabulary stays stable and discoverable. */
+  target: DashboardTreeActionTarget | null;
+  /** Why it is unavailable, for the tooltip and the accessible description.
+   *  Non-null exactly when `target` is `null`. */
+  unavailable: string | null;
+  /**
+   * The question a DESTRUCTIVE action asks before it runs; `null` for an
+   * editing one, which needs no confirmation.
+   *
+   * Composed here rather than in the view because it names the resources by
+   * their resolved display titles — the panel's label AND its owning
+   * Dashboard's — and the view holds only the row it is painting. It is the
+   * same reason a row's `diagnostic` is composed by the model.
+   */
+  confirm: string | null;
 }
 
 export interface DashboardTreeRow {
@@ -174,16 +223,16 @@ export interface DashboardTreeRow {
    *  variable this is the variable's OWN diagnostic, verbatim from
    *  `core/dashboard-variables.ts` — never re-composed here. */
   diagnostic: string | null;
-  /** #447: whether this row offers a trailing destructive affordance. True for
-   *  an ORPHANED variable only — deleting it drops stored SQL that nothing else
-   *  holds. An active or conflicted variable is inferred from the panel queries,
-   *  so there is nothing about it a tree row could delete. */
-  deletable: boolean;
-  /** #429 phase 3: whether this row offers a trailing rename affordance (title
-   *  + description). True for the DASHBOARD row only — a panel row's own
-   *  metadata pencil is phase 4's, and a variable/group row has no document of
-   *  its own to rename. */
-  renamable: boolean;
+  /**
+   * #494: the row's trailing direct controls, in paint order — edit before
+   * delete, so the destructive one is rightmost and never where the pointer
+   * lands by habit.
+   *
+   * This replaced three separate expressions of the same idea: `renamable`
+   * (#429 phase 3's Dashboard pencil), `deletable` (#447's orphaned-variable
+   * trash) and the `menu` list. A group row has none.
+   */
+  actions: readonly DashboardTreeAction[];
   dashboardId: string;
   /** The member this row addresses, by Dashboard-local id — never by query id. */
   member: DashboardFocusTarget | null;
@@ -201,14 +250,6 @@ export interface DashboardTreeRow {
    *  press can open at once. */
   double: DashboardTreeCommand | null;
   shift: DashboardTreeCommand | null;
-  /** The keyboard-reachable equivalent of every gesture this row offers that a
-   *  pointer-only affordance would otherwise HIDE. A Dashboard row therefore
-   *  offers *Open in Edit* only (#429/#472): plain View is its primary press, so
-   *  it is not hidden, while Edit exists only as Shift-click/Shift+Enter. EMPTY
-   *  for a variable row: #447 forbids the `…` menu there, and a variable row has
-   *  no double/Shift gesture for it to expose — its single activation (open the
-   *  option-SQL editor) is already reachable with Enter. */
-  menu: readonly DashboardTreeMenuItem[];
   /**
    * #428: what a Library-query drop on THIS row would write, or `null` when the
    * row rejects assignment. Resolved here for the same reason every other
@@ -367,19 +408,90 @@ const variableAnnotation = (
   return { invalid: null, severity: null };
 };
 
-/** A panel row's action vocabulary. #447 removed the filter half: a variable row
- *  has no menu at all. */
-const PANEL_MENU_LABELS = {
-  open: 'Open query',
-  view: 'Open Dashboard in View and focus panel',
-  edit: 'Open Dashboard in Edit and focus panel',
-};
+/**
+ * Why a panel's pencil and trash are rendered but unavailable (#494).
+ *
+ * Both say what is wrong with the DATA rather than "not allowed": the row is
+ * showing a tile whose dedicated query cannot be proven, and the user's next
+ * move is to look at the panel, not to try again. Repairing such a workspace
+ * is #429's repair-planner phase, deliberately not something these controls
+ * attempt — a guessed owner is how one delete becomes two.
+ */
+const MISSING_PANEL_QUERY_REASON =
+  'This panel’s query is not in this workspace, so there is nothing to edit or remove.';
+const UNPROVEN_OWNERSHIP_REASON =
+  'This panel’s query is shared with another panel, so it cannot be edited or removed here.';
+
+/** One trailing control, available. */
+const action = (
+  kind: DashboardTreeActionKind, label: string, tooltip: string,
+  target: DashboardTreeActionTarget, confirm: string | null = null,
+): DashboardTreeAction => ({ kind, label, tooltip, target, unavailable: null, confirm });
+
+/** One trailing control the data does not permit right now. It still renders:
+ *  a row whose vocabulary silently shrinks teaches the user that panels
+ *  sometimes have no pencil, which is a worse lie than a disabled one. */
+const unavailableAction = (
+  kind: DashboardTreeActionKind, label: string, reason: string,
+): DashboardTreeAction => ({
+  kind, label, tooltip: reason, target: null, unavailable: reason, confirm: null,
+});
+
+/** Quoted for a confirmation sentence, in the typographic quotes this UI uses
+ *  everywhere else. */
+const quoted = (name: string): string => '“' + name + '”';
 
 export function deriveDashboardTree(
   { workspace, surface, ui }: DashboardTreeInput,
 ): DashboardTree {
   const dashboards = workspace?.dashboards ?? [];
   const queries = queryMap(workspace);
+  // #494: ONE ownership index per paint, from the #427 module that defines the
+  // rule — the tree does not get its own private notion of who owns a query.
+  // Tiles with no `queryId` are dropped on the way in because ownership is
+  // exactly the set of tile→query references; a tile that references nothing
+  // owns nothing, and its panel row's edit/delete are unavailable anyway.
+  const ownership = buildQueryOwnershipIndex({
+    queries: workspace?.queries ?? [],
+    dashboards: dashboards.map((dashboard) => ({
+      id: dashboard.id,
+      tiles: (dashboard.tiles ?? [])
+        .filter((tile): tile is TreeTile & { queryId: string } => typeof tile.queryId === 'string')
+        .map((tile) => ({ id: tile.id, queryId: tile.queryId })),
+    })),
+  });
+
+  /**
+   * The pencil + trash a panel row offers, and whether the data permits them.
+   *
+   * Availability is the #427 exactly-one-owner rule, checked against THIS
+   * Dashboard and THIS tile: a query with several owners, one owned by a
+   * different member, or a reference to a query the workspace does not carry
+   * all leave both controls rendered and unavailable. `facts.queryId` is
+   * already `null` for a reference that resolves to nothing, which is what
+   * separates the two reasons.
+   */
+  const panelActions = (
+    dashboardId: string, dashboardLabel: string, tileId: string, label: string, queryId: string | null,
+  ): DashboardTreeAction[] => {
+    const owners = queryId === null ? [] : ownership.ownersByQueryId.get(queryId) ?? [];
+    const owned = owners.length === 1
+      && owners[0].dashboardId === dashboardId && owners[0].tileId === tileId;
+    if (queryId === null || !owned) {
+      const reason = queryId === null ? MISSING_PANEL_QUERY_REASON : UNPROVEN_OWNERSHIP_REASON;
+      return [
+        unavailableAction('edit-panel', 'Edit ' + label, reason),
+        unavailableAction('delete-panel', 'Remove ' + label + ' from dashboard', reason),
+      ];
+    }
+    const target: DashboardTreeActionTarget = { kind: 'panel', dashboardId, tileId, queryId };
+    return [
+      action('edit-panel', 'Edit ' + label, 'Edit name & description', target),
+      action('delete-panel', 'Remove ' + label + ' from dashboard', 'Remove panel', target,
+        'Remove panel ' + quoted(label) + ' from ' + quoted(dashboardLabel)
+        + '? This also deletes its dedicated query copy.'),
+    ];
+  };
 
   const search = ui.searchText.trim().toLowerCase();
   const hits = (haystack: readonly string[]): boolean =>
@@ -442,8 +554,18 @@ export function deriveDashboardTree(
       invalid: null,
       severity: null,
       diagnostic: null,
-      deletable: false,
-      renamable: true,
+      // #494: the Dashboard row's own two direct controls. Its `⋯` menu is
+      // gone — *Open in Edit* was its last item, and a menu button that opens
+      // a one-item menu beside two real controls is chrome, not vocabulary.
+      // Shift-click / Shift+Enter remain the Edit gesture (`shift` below).
+      actions: [
+        action('edit-dashboard', 'Edit dashboard ' + (title || UNTITLED_DASHBOARD),
+          'Edit dashboard title & description', { kind: 'dashboard', dashboardId: dashboard.id }),
+        action('delete-dashboard', 'Delete dashboard ' + (title || UNTITLED_DASHBOARD),
+          'Delete dashboard', { kind: 'dashboard', dashboardId: dashboard.id },
+          'Delete dashboard ' + quoted(title || UNTITLED_DASHBOARD)
+          + '? This also deletes every query its panels own.'),
+      ],
       dashboardId: dashboard.id,
       member: null,
       queryId: null,
@@ -457,14 +579,6 @@ export function deriveDashboardTree(
       single: openDashboardCommand(dashboard.id, 'view'),
       double: null,
       shift: openDashboardCommand(dashboard.id, 'edit'),
-      // *Open in View* is gone: it IS the primary press now, and the menu existed
-      // only to keep a pointer-hidden gesture discoverable. *Open in Edit* stays
-      // for exactly that reason — its only forms are Shift-click and Shift+Enter,
-      // both hidden modifiers, so this row is where a keyboard or first-time user
-      // finds Edit mode at all.
-      menu: [
-        { label: 'Open in Edit', command: openDashboardCommand(dashboard.id, 'edit') },
-      ],
       dropTarget: { kind: 'panel', dashboardId: dashboard.id },
     });
 
@@ -502,8 +616,15 @@ export function deriveDashboardTree(
         severity,
         // Verbatim from the inference service — never re-composed here.
         diagnostic: variable.diagnostic,
-        deletable: variable.status === 'orphaned',
-        renamable: false,
+        // #447's trash, unchanged in behaviour: an ORPHANED configuration is
+        // the only variable state with anything of its own to delete — an
+        // active or conflicted variable is inferred from the panel SQL.
+        actions: variable.status === 'orphaned'
+          ? [action('delete-variable-config',
+            'Delete the stored option SQL for ' + variable.name, 'Delete stored option SQL',
+            { kind: 'variable-config', dashboardId: dashboard.id, name: variable.name },
+            'Delete the stored option SQL for ' + quoted(variable.name) + '? The SQL is lost.')]
+          : [],
         dashboardId: dashboard.id,
         member,
         queryId: null,
@@ -511,7 +632,6 @@ export function deriveDashboardTree(
         single: { kind: 'open-variable', dashboardId: dashboard.id, name: variable.name },
         double: null,
         shift: null,
-        menu: [],
         // #428: an ORPHAN is not an assignment destination. A configuration no
         // panel declares any more has nothing to bind to, though it stays
         // editable and deletable through its own affordances — which is why this
@@ -547,8 +667,7 @@ export function deriveDashboardTree(
         invalid: facts.invalid,
         severity: facts.invalid === null ? null : 'error',
         diagnostic: facts.invalid === null ? null : MISSING_QUERY_DIAGNOSTIC,
-        deletable: false,
-        renamable: false,
+        actions: panelActions(dashboard.id, title || UNTITLED_DASHBOARD, tile.id, facts.label, facts.queryId),
         dashboardId: dashboard.id,
         member,
         queryId: facts.queryId,
@@ -559,11 +678,6 @@ export function deriveDashboardTree(
         single: openQuery,
         double: focusView,
         shift: focusEdit,
-        menu: [
-          { label: PANEL_MENU_LABELS.open, command: openQuery },
-          { label: PANEL_MENU_LABELS.view, command: focusView },
-          { label: PANEL_MENU_LABELS.edit, command: focusEdit },
-        ],
         // #428 rejects an individual panel row: sharing one query between panels
         // and moving members between Dashboards are both out of scope, so there
         // is no assignment a panel row could mean.
@@ -609,8 +723,7 @@ export function deriveDashboardTree(
         invalid: null,
         severity: null,
         diagnostic: null,
-        deletable: false,
-        renamable: false,
+        actions: [],
         dashboardId: dashboard.id,
         member: null,
         queryId: null,
@@ -620,7 +733,6 @@ export function deriveDashboardTree(
         single: groupForced ? null : { kind: 'toggle' },
         double: null,
         shift: null,
-        menu: [],
         // #428: Panels means the same thing as the Dashboard row itself. The
         // VARIABLES group never accepts — it does not identify which variable
         // would receive the SQL, and guessing is worse than rejecting.
diff --git a/src/dashboard/application/dashboard-removal.ts b/src/dashboard/application/dashboard-removal.ts
new file mode 100644
index 00000000..d35e3634
--- /dev/null
+++ b/src/dashboard/application/dashboard-removal.ts
@@ -0,0 +1,185 @@
+// Dashboard/panel DELETE, atomically (#429/#494).
+//
+// #427 made Dashboard membership an explicit reference a tile OWNS: a panel
+// tile's `queryId` names a dedicated copy that exists nowhere else. Deleting a
+// tile or a whole Dashboard therefore has to delete the queries that copy
+// represents too, or the Library would silently accumulate orphaned "owned"
+// copies that are no longer reachable from anywhere and no longer Library
+// entries either (#427's own partition: zero owners is what MAKES a query a
+// Library query).
+//
+// Both transforms here PROVE ownership through the #427 index
+// (`ownersOfQuery`) before deleting anything, rather than assuming a tile's
+// `queryId` is safe to remove because it looks like the tile's own copy. The
+// index is the one place that can tell a genuinely dedicated copy apart from
+// the invalid states a workspace can still be caught in mid-edit — a second
+// reference to the same id, or a reference to an id nothing carries any more.
+// Guessing in either state and deleting anyway would either destroy a query
+// another Dashboard still renders, or silently no-op while claiming success.
+// Neither transform ever cascades past what it can prove: the single-panel
+// delete refuses instead of picking an owner, and the whole-Dashboard delete
+// keeps a query the invalid multi-owner state also points at from elsewhere.
+//
+// `dashboard.variableConfigs` is left untouched by a panel delete on purpose.
+// #457 made a variable's identity and type come from the `{name:Type}`
+// placeholders its panel queries declare, not from a stored object — so an
+// orphaned configuration (a name no panel declares any more) is designed to
+// survive and keep displaying, exactly the way a panel's last declaration
+// disappearing through an ordinary SQL edit already leaves it. Deleting the
+// tile is not a special case of that, and #494's own non-goals say so
+// explicitly: the configuration is not a side effect to clean up here.
+//
+// Pure — no DOM, no persistence, no globals, never mutates its input.
+
+import { removeTileMembership } from './tile-membership.js';
+import type { TileRemovalResult } from './tile-membership.js';
+import { findDashboardStrict, replaceDashboard } from '../../workspace/workspace-dashboards.js';
+import { buildQueryOwnershipIndex, ownersOfQuery } from '../model/query-ownership.js';
+import type { DashboardDocumentV2, StoredWorkspaceV5 } from '../../generated/json-schema.types.js';
+
+/** Why a single-panel delete refused, as a value rather than a thrown error —
+ *  every one of these is an ordinary concurrent-state or data-integrity
+ *  outcome, never a bug, and the UI phrases each differently. */
+export type PanelRemovalRefusal =
+  | 'dashboard-missing'
+  | 'dashboard-duplicate'
+  | 'tile-missing'
+  | 'ownership-unproven';
+
+export type PanelRemovalResult =
+  | { status: 'ok'; workspace: StoredWorkspaceV5; queryId: string }
+  | { status: 'refused'; reason: PanelRemovalRefusal };
+
+/**
+ * Remove ONE Dashboard panel tile and exactly the dedicated query it owns, in
+ * one atomic commit.
+ *
+ * Resolution is entirely id-addressed, matching `findDashboardStrict`'s own
+ * rule: `dashboard-missing`/`dashboard-duplicate` refuse before anything else
+ * is even looked at, because an ambiguous-id workspace must never be written
+ * through a guess at which entry was meant.
+ *
+ * Ownership is PROVEN, not assumed: the tile's `queryId` must both name a
+ * query that still exists in `workspace.queries`, and have EXACTLY ONE owner
+ * in the #427 index. A dangling id, a query with no owners left after some
+ * other edit, or — the invalid state #427 forbids reaching but this cannot
+ * assume away — more than one owner, all refuse `ownership-unproven` rather
+ * than deleting the tile alone and leaving a stray query behind, or deleting a
+ * query some other tile still renders. The sole owner is never re-checked
+ * against `dashboardId`/`tileId` by hand: `ownersOfQuery` is built by scanning
+ * every tile of `workspace.dashboards` including this very one, so whenever it
+ * reports exactly one owner for this tile's own `queryId`, that owner IS this
+ * Dashboard and this tile — there is no second identity for a single-owner
+ * result to disagree with.
+ *
+ * The tile itself is removed through `removeTileMembership`, which already
+ * normalizes through the active layout plugin and regenerates the
+ * grafana-grid flow fallback — neither is reimplemented here. The target
+ * Dashboard's `revision` is bumped by exactly one; every other Dashboard,
+ * every other query, and both collections' order are preserved exactly.
+ */
+export function removeDashboardPanel(input: {
+  workspace: StoredWorkspaceV5;
+  dashboardId: string;
+  tileId: string;
+}): PanelRemovalResult {
+  const { workspace, dashboardId, tileId } = input;
+
+  const lookup = findDashboardStrict(workspace, dashboardId);
+  if (lookup.status !== 'ok') {
+    return { status: 'refused', reason: lookup.status === 'missing' ? 'dashboard-missing' : 'dashboard-duplicate' };
+  }
+  const dashboard = lookup.dashboard;
+
+  const tile = dashboard.tiles.find((candidate) => candidate.id === tileId);
+  if (!tile) return { status: 'refused', reason: 'tile-missing' };
+
+  const { queryId } = tile;
+  const queryExists = workspace.queries.some((query) => query.id === queryId);
+  const owners = ownersOfQuery(workspace, queryId);
+  if (!queryExists || owners.length !== 1) {
+    return { status: 'refused', reason: 'ownership-unproven' };
+  }
+
+  // `removeTileMembership` returns `null` only for a tile id it cannot find in
+  // `dashboard.tiles` — already excluded by the `tile` lookup above, so this
+  // cast reflects a genuinely unreachable branch rather than skipping a check.
+  const removed = removeTileMembership(dashboard, workspace.queries, tileId) as TileRemovalResult;
+  const nextDashboard: DashboardDocumentV2 = { ...removed.dashboard, revision: dashboard.revision + 1 };
+  const nextQueries = workspace.queries.filter((query) => query.id !== queryId);
+  const withQueries: StoredWorkspaceV5 = { ...workspace, queries: nextQueries };
+
+  // `replaceDashboard` re-checks the exactly-one-match rule at write time, but
+  // `withQueries` only changed `queries` — `dashboards` is the same reference
+  // `lookup` already resolved to `ok` above, so `null` here is unreachable too.
+  const next = replaceDashboard(withQueries, dashboardId, nextDashboard) as StoredWorkspaceV5;
+
+  return { status: 'ok', workspace: next, queryId };
+}
+
+export type DashboardRemovalResult =
+  | { status: 'ok'; workspace: StoredWorkspaceV5; removedQueryIds: readonly string[] }
+  | { status: 'refused'; reason: 'dashboard-missing' | 'dashboard-duplicate' };
+
+/**
+ * Remove ONE whole Dashboard document and, recursively, the queries its own
+ * tiles own — the document-level counterpart to `removeDashboardPanel` above.
+ *
+ * A tile's `queryId` joins the delete set only when BOTH hold: the query
+ * still exists in `workspace.queries`, and every owner `ownersOfQuery` reports
+ * for it belongs to THIS Dashboard. The second half is what protects the
+ * invalid multi-owner state (a query some other Dashboard's tile also
+ * references) rather than trusting that this Dashboard's own reference is the
+ * only one — deleting a query another Dashboard still renders would trade one
+ * data-integrity problem for a worse one. A query with no owners at all
+ * (Library) never reaches this check because it is never named by one of this
+ * Dashboard's own tiles in the first place. Ids repeated across this
+ * Dashboard's own tiles are deduplicated, and the result is reported in tile
+ * order.
+ *
+ * There is no revision bump: the document that carried a revision is gone.
+ * Every other Dashboard, every other query, and both collections' order are
+ * preserved exactly.
+ */
+export function removeDashboardDocument(input: {
+  workspace: StoredWorkspaceV5;
+  dashboardId: string;
+}): DashboardRemovalResult {
+  const { workspace, dashboardId } = input;
+
+  const lookup = findDashboardStrict(workspace, dashboardId);
+  if (lookup.status !== 'ok') {
+    return { status: 'refused', reason: lookup.status === 'missing' ? 'dashboard-missing' : 'dashboard-duplicate' };
+  }
+  const dashboard = lookup.dashboard;
+
+  // One index for the whole walk: `ownersOfQuery` rebuilds it per call, and a
+  // Dashboard's tiles are exactly the ids being asked about.
+  const { ownersByQueryId, dashboardOwnedQueryIds } = buildQueryOwnershipIndex(workspace);
+  const removedQueryIds: string[] = [];
+  const considered = new Set<string>();
+  for (const tile of dashboard.tiles) {
+    const { queryId } = tile;
+    if (considered.has(queryId)) continue;
+    considered.add(queryId);
+
+    // `dashboardOwnedQueryIds` holds only ids that EXIST and have an owner, so
+    // it answers the dangling-reference case as well.
+    if (!dashboardOwnedQueryIds.has(queryId)) continue;
+
+    // Present by construction: `dashboardOwnedQueryIds` is exactly the ids
+    // `ownersByQueryId` carries an owner list for.
+    const ownedOnlyHere = ownersByQueryId.get(queryId)!
+      .every((owner) => owner.dashboardId === dashboardId);
+    if (ownedOnlyHere) removedQueryIds.push(queryId);
+  }
+
+  const removeSet = new Set(removedQueryIds);
+  const next: StoredWorkspaceV5 = {
+    ...workspace,
+    dashboards: workspace.dashboards.filter((candidate) => candidate.id !== dashboardId),
+    queries: workspace.queries.filter((query) => !removeSet.has(query.id)),
+  };
+
+  return { status: 'ok', workspace: next, removedQueryIds };
+}
diff --git a/src/dashboard/model/query-ownership.ts b/src/dashboard/model/query-ownership.ts
index 4103fa53..fa30213a 100644
--- a/src/dashboard/model/query-ownership.ts
+++ b/src/dashboard/model/query-ownership.ts
@@ -65,8 +65,18 @@ export interface OwnershipDashboard {
   tiles: readonly OwnershipTile[];
 }
 
+/** All ownership reads of a query: its identity. Narrowed to this in #494 so
+ *  the Dashboard tree's own loosened projection types (`TreeQuery`, which
+ *  makes `sql`/`spec` optional because the tree must render stale or imported
+ *  data) can be indexed by the ONE ownership rule instead of re-deriving
+ *  "which member owns this query" beside it. `libraryQueries` still answers in
+ *  the caller's own element type — see its generic below. */
+export interface OwnershipQuery {
+  id: string;
+}
+
 export interface OwnershipWorkspace {
-  queries: readonly SavedQueryV2[];
+  queries: readonly OwnershipQuery[];
   dashboards: readonly OwnershipDashboard[];
 }
 
@@ -120,7 +130,9 @@ export function buildQueryOwnershipIndex(workspace: OwnershipWorkspace): QueryOw
  *  original `workspace.queries[]` relative order. The lower sidebar renders
  *  exactly this (#427); owned copies stay serialized and stay openable by id,
  *  they are simply not Library entries. */
-export function libraryQueries(workspace: OwnershipWorkspace): SavedQueryV2[] {
+export function libraryQueries<Q extends OwnershipQuery>(
+  workspace: { queries: readonly Q[]; dashboards: readonly OwnershipDashboard[] },
+): Q[] {
   const { libraryQueryIds } = buildQueryOwnershipIndex(workspace);
   return workspace.queries.filter((query) => libraryQueryIds.has(query.id));
 }
diff --git a/src/state.ts b/src/state.ts
index 7d78f769..ddec10be 100644
--- a/src/state.ts
+++ b/src/state.ts
@@ -451,7 +451,16 @@ export type PatchDraftResult =
  *  dead Library row until the next activation refresh. */
 export type PatchSavedResult =
   | { ok: true; invalidTab: null; entry: SavedQueryV2 }
-  | { ok: false; invalidTab: QueryTab | null; entry: null; diagnostics?: SpecDiagnostic[]; deletedExternally?: true };
+  | {
+    ok: false; invalidTab: QueryTab | null; entry: null;
+    diagnostics?: SpecDiagnostic[]; deletedExternally?: true;
+    /** #494: the caller's own dequeue-time precondition no longer holds — for
+     *  the Dashboard tree's panel pencil, the tile that owned this query was
+     *  deleted or re-pointed while the dialog was open. Distinct from
+     *  `deletedExternally` (the QUERY itself is gone): the query is still
+     *  there, it is simply no longer the resource the caller meant to edit. */
+    guardRefused?: true;
+  };
 
 /**
  * A tab's complete `spec.panel` payload, cloned for safe use/persistence. The
@@ -1155,9 +1164,17 @@ export async function patchSavedSpec(
   id: string, patch: SpecPatch,
   mutate: MutateWorkspace,
   validationService: SpecValidationService = defaultSpecValidationService,
+  guard?: (base: StoredWorkspaceV5) => boolean,
 ): Promise<PatchSavedResult> {
   const invalidTab = invalidSpecTabForSaved(state, id);
   if (invalidTab) return { ok: false, invalidTab, entry: null };
+  // #494: a caller-supplied precondition, re-checked against DEQUEUE-TIME truth
+  // rather than against whatever the caller saw when it opened its dialog. The
+  // Dashboard tree's panel pencil is the first user: the query id alone does not
+  // say which tile owns it, so "still owned by the tile I was opened for" is a
+  // fact only `latest` can settle, and settling it out here would leave exactly
+  // the race the write queue exists to close.
+  let guardRefused = false;
   // The PERSISTED entry patch folds into the LATEST workspace (#343): resolve
   // the entry by id against `latest.queries` (not stale `state`) and preserve
   // every other latest query. #427 removed the Dashboard-membership half — a
@@ -1175,6 +1192,7 @@ export async function patchSavedSpec(
   let prePatchToken: string | null = null;
   const outcome = await mutate((latest) => {
     const base = baselineWorkspace(state, latest);
+    if (guard !== undefined && !guard(base)) { guardRefused = true; return null; }
     const index = base.queries.findIndex((query) => query.id === id);
     if (index < 0) return null;
     prePatchToken = queryToken(base.queries[index]);
@@ -1205,6 +1223,7 @@ export async function patchSavedSpec(
     // (invalidTab null); a blocking linked draft identifies its tab; an entry no
     // longer present in `latest` (deleted externally) aborts flagged so the
     // caller can refresh the tab association (#343 review).
+    if (guardRefused) return { ok: false, invalidTab: null, entry: null, guardRefused: true };
     if (entryDiagnostics) return { ok: false, invalidTab: null, entry: null, diagnostics: entryDiagnostics };
     // `blockedDraft` is assigned inside a `for` loop nested in the `mutate`
     // closure above; TS's control-flow narrowing loses the loop-nested closure
@@ -1258,11 +1277,17 @@ export async function patchSavedSpec(
  * Rename a saved query, keeping any linked tab's name in sync. When
  * `description` is provided (not undefined) it is set/cleared too; pass
  * undefined to leave the existing description untouched (name-only rename).
+ *
+ * `guard` (#494) is an extra precondition evaluated against the dequeue-time
+ * workspace: the Dashboard tree's panel pencil uses it to re-prove that the
+ * tile it was opened for still owns this query. A refusal commits nothing and
+ * answers `guardRefused`.
  */
 export async function renameSaved(
   state: AppState, id: string, name: unknown, description: string | null | undefined,
   mutate: MutateWorkspace,
   validationService: SpecValidationService = defaultSpecValidationService,
+  guard?: (base: StoredWorkspaceV5) => boolean,
 ): Promise<PatchSavedResult | undefined> {
   const nm = String(name || '').trim();
   const index = state.savedQueries.findIndex((q) => q.id === id);
@@ -1273,7 +1298,7 @@ export async function renameSaved(
     const desc = String(description || '').trim(); // match saveQuery: null/non-string → '' → cleared
     patch.description = desc || undefined;
   }
-  return patchSavedSpec(state, id, patch, mutate, validationService);
+  return patchSavedSpec(state, id, patch, mutate, validationService, guard);
 }
 
 /**
diff --git a/src/styles.css b/src/styles.css
index 5fa92c16..8d738ebe 100644
--- a/src/styles.css
+++ b/src/styles.css
@@ -703,7 +703,7 @@ h1, h2, h3, h4, h5, h6 {
 .fm-item:hover { background: var(--bg-hover); }
 /* #452: an unavailable operation still renders in its settled position — the
    menu's vocabulary must not change with the work surface, only its reachability.
-   Same treatment as `.dash-tree-menu .is-disabled`. The `:hover` override is
+   Same treatment as the tree's own disabled controls. The `:hover` override is
    required: `.fm-item:hover` above still matches a disabled <button>. */
 .fm-item[aria-disabled="true"] { opacity: .45; cursor: default; }
 .fm-item[aria-disabled="true"]:hover { background: transparent; }
@@ -802,6 +802,13 @@ h1, h2, h3, h4, h5, h6 {
   margin: 12px 0 0; color: var(--error-fg);
   font-size: var(--text-label); line-height: var(--lh-body);
 }
+/* #494: a standing caveat (an imported tile's own title outranks the query
+   name being edited), present from the moment the dialog opens — quieter than
+   the failure diagnostic above, which answers a Save. */
+.fm-dialog-note {
+  margin: 12px 0 0; color: var(--fg-mute);
+  font-size: var(--text-label); line-height: var(--lh-body);
+}
 .fm-dialog-cancel:disabled { opacity: .45; cursor: default; }
 
 /* ------------ main row ------------ */
@@ -1739,17 +1746,45 @@ body.detached-tab .graph-overlay-panel {
   border-radius: var(--r-pill);
   padding: 0 6px;
 }
-/* #447: the orphan-only delete affordance. Unlike the action-menu button it is
-   ALWAYS visible — it is the only way to remove stored SQL nothing references, and
-   a hover-only affordance would hide the row's whole point. */
-.dash-tree-del-btn {
+/* #494 — the trailing DIRECT action cluster: pencil + trash on Dashboard and
+   Panel rows, and #447's orphan-variable trash, all one control vocabulary now
+   that the `⋯` overflow button is gone from every production row. */
+.dash-tree-act {
   width: 18px; height: 18px; padding: 0;
   border: none; background: transparent;
   color: var(--fg-faint); cursor: pointer;
   border-radius: var(--r-xs); flex-shrink: 0;
-  display: inline-flex; align-items: center; justify-content: center;
+  display: none; align-items: center; justify-content: center;
+}
+/* Revealed on hover like the Library row actions, but ALWAYS present for the
+   keyboard: `:focus-within` keeps the cluster visible while the row or one of
+   its controls owns focus, so no operation is keyboard-unreachable.
+   `[aria-expanded="true"]` holds it visible for its own dialog/confirmation's
+   whole lifetime — both are body-mounted, so by the time one closes the
+   pointer and focus have left the row, and `focus()` on a `display: none`
+   trigger is a silent no-op in a real browser. */
+.dash-tree-row:hover .dash-tree-act,
+.dash-tree-row:focus-within .dash-tree-act,
+.dash-tree-act[aria-expanded="true"] { display: inline-flex; }
+/* #447's orphan-variable trash stays ALWAYS visible: it is the only way to
+   remove stored SQL nothing references any more, and a hover-only affordance
+   would hide that row's whole point. #494 preserves that control as it was. */
+.dash-tree-act-static { display: inline-flex; }
+.dash-tree-act:hover { color: var(--fg); background: var(--bg-hover); }
+/* Destructive treatment on hover/focus, so the rightmost control of the
+   cluster reads as the one that removes something. */
+.dash-tree-act-danger:hover,
+.dash-tree-act-danger:focus-visible { color: var(--error-fg); background: var(--bg-hover); }
+/* An operation the DATA does not permit (a panel whose owned query cannot be
+   proven): rendered, focusable and announced — `aria-disabled`, not
+   `disabled` — but visibly inert, with the reason in its tooltip. */
+.dash-tree-act[aria-disabled="true"] { opacity: .4; cursor: default; }
+.dash-tree-act[aria-disabled="true"]:hover { color: var(--fg-faint); background: transparent; }
+/* Each control carries its OWN focus ring, in a channel the row does not use —
+   #472's "three independent targets" now being up to four. */
+.dash-tree-row .dash-tree-act:focus-visible {
+  outline: 2px solid var(--accent); outline-offset: -2px;
 }
-.dash-tree-del-btn:hover { color: var(--error-fg); background: var(--bg-hover); }
 /* The delete CONFIRMATION, built from the shared menu primitive (ui/menu.ts) and
    anchored on the trash button. Wider than the action menu because its heading is
    a sentence stating what is lost. */
@@ -1757,29 +1792,6 @@ body.detached-tab .graph-overlay-panel {
 .dash-tree-confirm .fm-section { white-space: normal; line-height: var(--lh-label); }
 .dash-tree-confirm-go { color: var(--error-fg); font-weight: var(--fw-medium); }
 .dash-tree-confirm-cancel { color: var(--fg-mute); }
-.dash-tree-menu-btn, .dash-tree-rename-btn {
-  width: 18px; height: 18px; padding: 0;
-  border: none; background: transparent;
-  color: var(--fg-faint); cursor: pointer;
-  border-radius: var(--r-xs); flex-shrink: 0;
-  display: none; align-items: center; justify-content: center;
-}
-/* Revealed on hover like the Library row actions, but ALWAYS present for the
-   keyboard: focus-within keeps it visible while it or the row owns focus, so the
-   double-click-only operations (and #429 phase 3's rename pencil — renaming is
-   routine, not destructive like the always-visible trash above) are never
-   keyboard-unreachable. */
-.dash-tree-row:hover .dash-tree-menu-btn,
-.dash-tree-row:focus-within .dash-tree-menu-btn,
-.dash-tree-menu-btn[aria-expanded="true"],
-.dash-tree-row:hover .dash-tree-rename-btn,
-.dash-tree-row:focus-within .dash-tree-rename-btn,
-/* #429 phase 3: stays visible for its OWN dialog's whole lifetime, not just
-   hover/focus-within — the dialog is body-mounted, so once its own controls are
-   interacted with, the pointer and focus both leave the row, and a `display:
-   none` trigger could not receive the focus the dialog returns to it on close. */
-.dash-tree-rename-btn[aria-expanded="true"] { display: inline-flex; }
-.dash-tree-menu-btn:hover, .dash-tree-rename-btn:hover { color: var(--fg); background: var(--bg-hover); }
 /* #429/#472 — the disclosure control is its own BUTTON, because expansion is now
    the only thing this target does (the row itself opens the Dashboard). Box, width
    and colour still come from the shared `.tree-row .chev` rule below, so the two
@@ -1813,12 +1825,6 @@ body.detached-tab .graph-overlay-panel {
   border-radius: var(--r-xs);
 }
 .dash-tree-row .dash-tree-chev:hover { color: var(--fg); }
-.dash-tree-menu { min-width: 220px; }
-/* An unavailable operation still renders, so the row's vocabulary stays
-   discoverable — it just cannot be invoked. */
-.dash-tree-menu .is-disabled {
-  opacity: .45; cursor: default; pointer-events: none;
-}
 
 .tree-row {
   display: flex; align-items: center; gap: 6px;
diff --git a/src/ui/dashboard-tree.ts b/src/ui/dashboard-tree.ts
index d304f731..07863c6a 100644
--- a/src/ui/dashboard-tree.ts
+++ b/src/ui/dashboard-tree.ts
@@ -37,11 +37,20 @@ import { discardVariableDraft, reconcileVariableTab } from './tabs.js';
 import { createClickArbiter, type ClickArbiter } from '../core/tree-click-arbiter.js';
 import {
   UNUSED_VARIABLE_STATUS, deriveDashboardTree, tileRowKey,
+  type DashboardTreeAction, type DashboardTreeActionKind, type DashboardTreeActionTarget,
   type DashboardTreeCommand, type DashboardTreeInvalid, type DashboardTreeRow, type TreeWorkspace,
 } from '../application/dashboard-tree-model.js';
 import { commitVariableConfig } from '../application/dashboard-variable-config.js';
 import { commitDashboardRename } from '../application/dashboard-title.js';
 import type { DashboardRenameOutcome } from '../application/dashboard-title.js';
+import {
+  commitDashboardRemoval, commitPanelRemoval, dashboardDeleteMessage,
+} from '../application/dashboard-delete.js';
+import type { DashboardDeleteOutcome } from '../application/dashboard-delete.js';
+import { commitPanelQueryMetadata } from '../application/dashboard-panel-metadata.js';
+import type {
+  PanelMetadataDeps, PanelMetadataOutcome,
+} from '../application/dashboard-panel-metadata.js';
 import { openMetadataDialog } from './dialog-shell.js';
 import {
   assignLibraryQuerySqlToVariable, assignLibraryQueryToPanel, libraryAssignmentMessage,
@@ -89,6 +98,10 @@ export interface DashboardTreeApp {
    *  pencil's dialog acquires — the same seam every other body-mounted
    *  overlay (File menu's dialogs, the shortcuts sheet) uses. */
   acquireKeyboardOwner: App['acquireKeyboardOwner'];
+  /** #494: the Spec validation service a panel-metadata write runs the patched
+   *  entry AND every linked draft through, inside the commit transform — the
+   *  same injected seam the Library row's pencil passes to `renameSaved`. */
+  specValidators: App['specValidators'];
   document?: Document;
   /** The window whose timers back the click arbiter; defaults to the row's own. */
   window?: Pick<Window, 'setTimeout' | 'clearTimeout'>;
@@ -101,6 +114,11 @@ export interface DashboardTreeApp {
   /** #428: the pending hover auto-expand, with the row that armed it — so one
    *  row's departure cannot cancel another row's timer. */
   _dashTreeHover?: { key: string; handle: number } | null;
+  /** #494: the rows this app last PAINTED. A panel delete has to decide where
+   *  keyboard focus goes next (next sibling → previous → the Panels group),
+   *  and "next" means next on screen — a search can be filtering siblings out,
+   *  and focus must never land on a row the user cannot see. */
+  _dashTreeRows?: readonly DashboardTreeRow[];
 }
 
 /** Indent per level, on top of `.tree-row`'s own 10px padding. */
@@ -609,6 +627,7 @@ export function renderDashboardTree(app: DashboardTreeApp): void {
     return;
   }
 
+  app._dashTreeRows = tree.rows;
   for (const row of tree.rows) {
     list.appendChild(buildRow(app, doc, row, ui));
   }
@@ -692,9 +711,9 @@ function buildRow(
     },
   }, chevron, h('span', { class: 'icon' }, rowIcon(row)), label, count, status,
     h('span', { class: 'meta' }, row.meta), marker,
-    row.deletable ? buildDeleteButton(app, doc, row) : null,
-    row.renamable ? buildRenameButton(app, doc, row) : null,
-    row.menu.length === 0 ? null : buildMenuButton(app, doc, row));
+    // #494: the trailing DIRECT controls, in the model's own order — edit
+    // before delete, destructive rightmost. There is no `⋯` any more.
+    row.actions.map((act) => buildActionButton(app, doc, row, act)));
 
   return rowEl;
 }
@@ -787,86 +806,139 @@ function pressRow(app: DashboardTreeApp, row: DashboardTreeRow, shift: boolean):
 }
 
 /**
- * #447 — the trailing trash affordance, rendered for an ORPHANED variable only.
+ * #494 — one trailing direct control, built from the model's resolved action.
  *
- * Deleting drops stored SQL nothing else holds, so it CONFIRMS first. The
- * confirmation is `openMenu` (ui/menu.ts) anchored on the trash button itself —
- * the same primitive this row's own action menu uses, so no new dialog is
- * invented: it gives the destructive action a real `<button role="menuitem">`, an
- * explicit Cancel, Escape/outside-click dismissal, and focus restored to the
- * trigger. (`file-menu.ts`'s `.fm-dialog-*` shell is module-private to that
- * file — and #463 retired its one confirm dialog with the destructive import
- * that needed it — while `window.confirm` is browser chrome this stylesheet
- * cannot reach.)
+ * Every Dashboard/Panel operation is its own real `<button>` now: the `⋯`
+ * overflow menu is gone from both, so nothing a row can do is hidden behind a
+ * second press. The orphaned-variable trash (#447) came along, because it was
+ * already exactly this shape and keeping it separate would have meant two ways
+ * of saying "a trailing control".
  *
- * Like the menu button, it stops propagation and calls `cancelFor` rather than
- * going through the arbiter: clicking trash must NOT also open the variable's
- * tab, and it must cancel no OTHER row's pending click.
+ * Availability is the MODEL's answer, never re-derived here (#494 forbids
+ * reading capability off DOM classes): an unavailable action still renders, so
+ * a Panel row's vocabulary does not silently shrink when its data is
+ * malformed, but it announces `aria-disabled` and does nothing when pressed.
+ * `aria-disabled` rather than `disabled` on purpose — the control stays
+ * focusable, so a keyboard user can reach it and hear WHY.
  */
-function buildDeleteButton(app: DashboardTreeApp, doc: Document, row: DashboardTreeRow): HTMLElement {
-  // `row.label` IS the variable's exact name by construction — the model sets a
-  // variable row's label to its name precisely because that name is the variable's
-  // whole identity (see `dashboard-tree-model.ts`). Reading it here needs no null
-  // check, unlike `row.member`, which is nullable for the row kinds that have none.
+function buildActionButton(
+  app: DashboardTreeApp, doc: Document, row: DashboardTreeRow, act: DashboardTreeAction,
+): HTMLElement {
+  const destructive = act.confirm !== null;
   const trigger: HTMLButtonElement = h('button', {
-    class: 'dash-tree-del-btn', type: 'button',
-    'aria-haspopup': 'menu', 'aria-expanded': 'false',
-    'aria-label': 'Delete the stored option SQL for ' + row.label,
-    title: 'Delete stored option SQL',
+    class: 'dash-tree-act'
+      + (destructive ? ' dash-tree-act-danger' : '')
+      // #447's control was always visible, and stays so: on a variable row the
+      // trash IS the affordance that says an orphaned configuration can be
+      // dropped, and #494 asks for that one to be preserved rather than
+      // rebuilt. The Dashboard/Panel controls are revealed on hover and
+      // `:focus-within`, matching the Library Query row.
+      + (act.kind === 'delete-variable-config' ? ' dash-tree-act-static' : ''),
+    type: 'button',
+    'aria-haspopup': destructive ? 'menu' : 'dialog',
+    'aria-expanded': 'false',
+    'aria-label': act.label,
+    title: act.tooltip,
+    ...(act.unavailable === null ? {} : { 'aria-disabled': 'true' }),
     onkeydown: isolateActivationKeys,
     onclick: (event: MouseEvent) => {
+      // Never the row's own gesture, and never a pending single of its own —
+      // but #426 is explicit that this must cancel no UNRELATED row operation.
       event.stopPropagation();
       app._dashTreeArbiter?.cancelFor(row.key);
-      openMenu({
-        document: doc,
-        trigger,
-        menuClass: 'dash-tree-confirm',
-        rows: [
-          {
-            kind: 'section',
-            label: 'Delete the stored option SQL for “' + row.label + '”? The SQL is lost.',
-          },
-          {
-            kind: 'item',
-            label: 'Delete option SQL',
-            extraClass: 'dash-tree-confirm-go',
-            // Removes ONLY this key from `variableConfigs` (both `sql` and
-            // `lastKnownType` go with it). No panel query is touched — a
-            // variable's name and type live in the panel SQL, not here.
-            // Fire-and-forget: the delete has no per-row UI to settle against —
-            // a successful commit reprojects the workspace and repaints the tree
-            // on its own, and an aborted one leaves nothing to undo.
-            onClick: () => { void commitVariableConfig(app, row.dashboardId, row.label, null); },
-          },
-          { kind: 'item', label: 'Cancel', extraClass: 'dash-tree-confirm-cancel', onClick: () => {} },
-        ],
-      });
+      runAction(app, doc, row, act, trigger);
     },
-  }, Icon.trash());
+  }, act.kind === 'edit-dashboard' || act.kind === 'edit-panel' ? Icon.pencil() : Icon.trash());
   return trigger;
 }
 
+/** The confirm menu's own go-ahead label, per action. Short and specific: the
+ *  question above it already named the resource, and "OK" next to a sentence
+ *  full of names is where a destructive click gets made by accident. */
+const CONFIRM_LABELS: Record<DashboardTreeActionKind, string> = {
+  'edit-dashboard': '',
+  'edit-panel': '',
+  'delete-dashboard': 'Delete dashboard',
+  'delete-panel': 'Remove panel',
+  'delete-variable-config': 'Delete option SQL',
+};
+
 /**
- * The Dashboard row's rename pencil (#429 phase 3): edit title + description
- * on the promoted `openDialogShell` (`dialog-shell.ts`), prefilled from the
- * current committed document. Revealed on hover/focus-within like the `⋯`
- * button below — renaming is routine, not destructive, unlike the
- * always-visible trash above.
+ * Run one trailing control.
+ *
+ * An unavailable action does nothing at all — the model already said why, and
+ * the button carries that reason as its tooltip and `aria-disabled` state.
+ * Destructive actions never run straight from the press: they open the
+ * confirmation this repo already uses for the same job (`openMenu`, anchored
+ * on the trigger), which gives them a real `role="menuitem"`, an explicit
+ * Cancel, Escape/outside-click dismissal and focus restored to the trigger.
  */
-function buildRenameButton(app: DashboardTreeApp, doc: Document, row: DashboardTreeRow): HTMLElement {
-  const trigger: HTMLButtonElement = h('button', {
-    class: 'dash-tree-rename-btn', type: 'button',
-    'aria-haspopup': 'dialog', 'aria-expanded': 'false',
-    'aria-label': 'Edit dashboard ' + row.label,
-    title: 'Edit dashboard title & description',
-    onkeydown: isolateActivationKeys,
-    onclick: (event: MouseEvent) => {
-      event.stopPropagation();
-      app._dashTreeArbiter?.cancelFor(row.key);
-      openDashboardMetadataDialog(app, doc, trigger, row);
-    },
-  }, Icon.pencil());
-  return trigger;
+function runAction(
+  app: DashboardTreeApp, doc: Document, row: DashboardTreeRow, act: DashboardTreeAction,
+  trigger: HTMLButtonElement,
+): void {
+  const target = act.target;
+  if (target === null) return;
+  if (act.kind === 'edit-dashboard') { openDashboardMetadataDialog(app, doc, trigger, row); return; }
+  if (act.kind === 'edit-panel') {
+    openPanelMetadataDialog(app, doc, trigger, row, target as PanelActionTarget);
+    return;
+  }
+  confirmDestructive(doc, trigger, act, () => runDestructive(app, doc, row, act, target));
+}
+
+/** The `panel` arm of `DashboardTreeActionTarget`, which the two panel actions
+ *  are the only carriers of. Narrowed once here rather than with a guard at
+ *  each use: the model pairs kind and target by construction. */
+type PanelActionTarget = Extract<DashboardTreeActionTarget, { kind: 'panel' }>;
+
+/** Ask before destroying something, anchored on the control that asked. */
+function confirmDestructive(
+  doc: Document, trigger: HTMLButtonElement, act: DashboardTreeAction, go: () => void,
+): void {
+  openMenu({
+    document: doc,
+    trigger,
+    menuClass: 'dash-tree-confirm',
+    rows: [
+      { kind: 'section', label: act.confirm! },
+      {
+        kind: 'item',
+        label: CONFIRM_LABELS[act.kind],
+        extraClass: 'dash-tree-confirm-go',
+        onClick: go,
+      },
+      { kind: 'item', label: 'Cancel', extraClass: 'dash-tree-confirm-cancel', onClick: () => {} },
+    ],
+  });
+}
+
+/**
+ * Dispatch a confirmed destructive action.
+ *
+ * All three are fire-and-forget for the same reason: a successful commit
+ * reprojects the workspace and repaints the tree (and any rendered Dashboard)
+ * on its own, and a refused one leaves nothing here to undo. What they do NOT
+ * share is what happens to keyboard focus afterwards — removing the row the
+ * user is standing on is the one case with somewhere specific to go.
+ */
+function runDestructive(
+  app: DashboardTreeApp, doc: Document, row: DashboardTreeRow, act: DashboardTreeAction,
+  target: DashboardTreeActionTarget,
+): void {
+  if (target.kind === 'variable-config') {
+    void commitVariableConfig(app, target.dashboardId, target.name, null);
+    return;
+  }
+  if (act.kind === 'delete-dashboard') {
+    void reportRemoval(app, doc, commitDashboardRemoval(app, target.dashboardId));
+    return;
+  }
+  const panel = target as PanelActionTarget;
+  // Decided BEFORE the commit, against the rows currently painted: once the
+  // write lands, the row this focus decision is relative to no longer exists.
+  const successor = focusSuccessorKey(app, row);
+  void reportRemoval(app, doc, commitPanelRemoval(app, panel), successor);
 }
 
 /**
@@ -922,39 +994,116 @@ const renameMessage = (outcome: DashboardRenameOutcome): string | null => {
   return outcome.diagnostics[0]?.message || 'Could not save this dashboard.';
 };
 
-/** The keyboard-reachable, DISCOVERABLE equivalent of the gestures a pointer-only
- *  affordance would otherwise hide — a panel row's double-click and Shift-click, and
- *  (since #429/#472 dropped the now-redundant *Open in View*) a Dashboard row's
- *  Shift-click alone. */
-function buildMenuButton(app: DashboardTreeApp, doc: Document, row: DashboardTreeRow): HTMLElement {
-  const trigger: HTMLButtonElement = h('button', {
-    class: 'dash-tree-menu-btn', type: 'button',
-    'aria-haspopup': 'menu', 'aria-expanded': 'false',
-    'aria-label': 'Actions for ' + row.label,
-    title: 'Actions',
-    onkeydown: isolateActivationKeys,
-    onclick: (event: MouseEvent) => {
-      // Never the row's own gesture, and never a pending single of its own — but
-      // #426 is explicit that this must cancel no UNRELATED row operation.
-      event.stopPropagation();
-      app._dashTreeArbiter?.cancelFor(row.key);
-      openMenu({
-        document: doc,
-        trigger,
-        menuClass: 'dash-tree-menu',
-        rows: row.menu.map((item) => ({
-          kind: 'item' as const,
-          label: item.label,
-          // An unavailable operation still RENDERS, so the row's vocabulary stays
-          // discoverable — but disabled semantically, not merely greyed out.
-          ...(item.command === null
-            ? { extraClass: 'is-disabled', disabled: true, onClick: () => {} }
-            : { onClick: () => runCommand(app, row, item.command!) }),
-        })),
-      });
-    },
-  }, Icon.more());
-  return trigger;
+/**
+ * The panel pencil's dialog (#494): the same two fields, the same shell and
+ * the same awaited-outcome contract as the Dashboard pencil above — but
+ * editing the tile's dedicated OWNED QUERY, which is where a panel's displayed
+ * name and description actually live.
+ *
+ * Prefilled from the committed query, never from the row's label: the label is
+ * a resolved DISPLAY string, and for an imported tile that carries a local
+ * `title` override it is the override rather than the query's own name. Typing
+ * over it would silently rewrite the query to match a title it does not own.
+ * When such an override exists the dialog says so instead, because the commit
+ * genuinely will not change what the tile renders.
+ */
+function openPanelMetadataDialog(
+  app: DashboardTreeApp, doc: Document, trigger: HTMLButtonElement, row: DashboardTreeRow,
+  target: PanelActionTarget,
+): void {
+  // Same hover-reveal trap as the Dashboard pencil: the trigger is
+  // `display: none` unless the row is hovered or holds focus, and `focus()` on
+  // a `display: none` element is a silent no-op in a real browser.
+  trigger.setAttribute('aria-expanded', 'true');
+  const query = app.currentWorkspace?.queries?.find((entry) => entry.id === target.queryId);
+  const tile = app.currentWorkspace?.dashboards
+    ?.find((dashboard) => dashboard.id === target.dashboardId)
+    ?.tiles?.find((entry) => entry.id === target.tileId);
+  const overridden = (tile?.title ?? '').trim() !== '';
+  openMetadataDialog({ document: doc, acquireKeyboardOwner: app.acquireKeyboardOwner }, {
+    title: 'Edit panel',
+    nameLabel: 'Query name',
+    descriptionLabel: 'Query description',
+    name: query?.spec?.name ?? '',
+    description: query?.spec?.description ?? '',
+    confirmLabel: 'Save',
+    idPrefix: 'panel-metadata',
+    note: overridden
+      ? 'This tile was imported with its own title, which keeps priority over the query name here.'
+      : null,
+    returnFocusTo: trigger,
+    onClose: () => trigger.setAttribute('aria-expanded', 'false'),
+    onConfirm: async ({ name, description }) => panelMetadataMessage(
+      await commitPanelQueryMetadata(panelMetadataDeps(app), target, name, description),
+    ),
+  });
+}
+
+/** The tree's slice of `PanelMetadataDeps`. `refreshCommittedSurfaces` is the
+ *  same poke every other tree write sends — a rendered Dashboard reads its
+ *  document at construction, so a renamed tile would otherwise keep its old
+ *  heading until something unrelated repainted it. */
+const panelMetadataDeps = (app: DashboardTreeApp): PanelMetadataDeps => ({
+  state: app.state,
+  mutateWorkspace: app.mutateWorkspace,
+  specValidators: app.specValidators,
+  refreshCommittedSurfaces: () => app.onWorkspaceExternallyChanged(
+    { workspace: null, queriesChanged: true },
+  ),
+});
+
+/** What a panel-metadata attempt has to say — `null` closes the dialog. */
+const panelMetadataMessage = (outcome: PanelMetadataOutcome): string | null => {
+  if (outcome.status === 'ok') return null;
+  if (outcome.status === 'stale') return 'That panel is no longer part of this dashboard.';
+  if (outcome.status === 'invalid-draft') {
+    // The same patch has to apply to the entry AND to every linked draft; an
+    // unparseable Spec draft blocks both, and the tab is the only place it can
+    // be fixed.
+    return 'This panel’s query has invalid Spec JSON in an open tab. Fix it there first.';
+  }
+  return outcome.message;
+};
+
+/**
+ * Report a delete, and — for a panel — put keyboard focus somewhere sensible.
+ *
+ * The successor is chosen BEFORE the write (the row it is relative to is gone
+ * afterwards) but only APPLIED on success, so a refused delete leaves the tree
+ * exactly as it was, focus included.
+ */
+async function reportRemoval(
+  app: DashboardTreeApp, doc: Document,
+  pending: Promise<DashboardDeleteOutcome>, successorKey?: string,
+): Promise<void> {
+  const outcome = await pending;
+  const message = dashboardDeleteMessage(outcome);
+  if (message !== null) flashToast(message, { document: doc });
+  if (!outcome.ok || successorKey === undefined) return;
+  // The commit reprojected and repainted the tree already, so this addresses
+  // rows that exist NOW.
+  moveTo(app, successorKey);
+}
+
+/**
+ * Where keyboard focus goes when a Panel row is deleted: the next Panel row,
+ * else the previous one, else the Panels group that contained it (#494).
+ *
+ * Resolved from the CURRENTLY PAINTED rows rather than from the model, because
+ * "next" means next on screen — a search may be filtering siblings out, and
+ * focus must not jump to a row the user cannot see. A row whose parent group
+ * is collapsed is not painted at all, so the parent key is the floor.
+ */
+function focusSuccessorKey(app: DashboardTreeApp, row: DashboardTreeRow): string {
+  const painted = app._dashTreeRows ?? [];
+  const index = painted.findIndex((candidate) => candidate.key === row.key);
+  const sibling = (candidate: DashboardTreeRow): boolean => candidate.parentKey === row.parentKey;
+  const after = painted.slice(index + 1).find(sibling);
+  if (after !== undefined) return after.key;
+  const before = painted.slice(0, index).reverse().find(sibling);
+  // A panel row always HAS a parent group — it is level 3 by construction — so
+  // the fallback is never the empty string in practice.
+  return before?.key ?? row.parentKey!;
 }
 
 // A positive guard, not an early `return`: `clampKeyboardRow` has already made the
diff --git a/src/ui/dialog-shell.ts b/src/ui/dialog-shell.ts
index 2b1ebcba..dabf5f7b 100644
--- a/src/ui/dialog-shell.ts
+++ b/src/ui/dialog-shell.ts
@@ -42,7 +42,7 @@ export interface OpenDialogShellOpts {
   /** Runs on every close path (Escape, outside-click, and whatever the caller's
    *  own content wires up) — AFTER `returnFocusTo` is focused, never before. A
    *  trigger that is only revealed on hover/`:focus-within` (the Dashboard-tree
-   *  pencil, `.dash-tree-rename-btn`) must stay revealed (e.g. `aria-expanded`
+   *  action cluster, `.dash-tree-act`) must stay revealed (e.g. `aria-expanded`
    *  kept `"true"` by the caller) right up through the `focus()` call below —
    *  by the time a dialog closes the pointer has typically moved onto the
    *  dialog's own controls, so neither `:hover` nor `:focus-within` still holds
@@ -147,6 +147,12 @@ export interface MetadataDialogOpts {
   confirmLabel: string;
   /** Prefix for the two field ids, so a `for`/`id` pair is unique per caller. */
   idPrefix: string;
+  /** A standing caveat about what this edit will and will not change, shown
+   *  from the moment the dialog opens — unlike the failure diagnostic, which
+   *  appears only after a Save. #494's imported tile-title override is the
+   *  case: the query name is editable, but the tile keeps rendering its own
+   *  imported title, and a dialog that said nothing would look broken. */
+  note?: string | null;
   returnFocusTo: HTMLElement | null;
   onClose?: () => void;
   /**
@@ -190,6 +196,7 @@ export function openMetadataDialog(app: DialogHostApp, opts: MetadataDialogOpts)
   // after the dialog opened, in response to a Save the user has already made,
   // so it has to be announced rather than merely be present.
   const error = h('p', { class: 'fm-dialog-error', role: 'alert', hidden: true }) as HTMLParagraphElement;
+  const note = opts.note ? h('p', { class: 'fm-dialog-note' }, opts.note) : null;
   const cancel = h('button', { class: 'fm-dialog-cancel', onclick: () => handle.close() }, 'Cancel') as HTMLButtonElement;
   const confirm = h('button', {
     class: 'fm-dialog-confirm',
@@ -231,6 +238,7 @@ export function openMetadataDialog(app: DialogHostApp, opts: MetadataDialogOpts)
       nameInput,
       h('label', { class: 'fm-dialog-label', for: descriptionId }, opts.descriptionLabel),
       descInput,
+      note,
       error),
     h('div', { class: 'fm-dialog-actions' }, cancel, confirm),
   ], {
diff --git a/tests/unit/dashboard-delete.test.ts b/tests/unit/dashboard-delete.test.ts
new file mode 100644
index 00000000..9857f2d2
--- /dev/null
+++ b/tests/unit/dashboard-delete.test.ts
@@ -0,0 +1,321 @@
+// #494 — the async `mutateWorkspace` plumbing around the two atomic deletes.
+// The pure transforms (`removeDashboardPanel`/`removeDashboardDocument`) are
+// covered in `dashboard-removal.test.ts`; what is tested here is the
+// plumbing: committed truth is read at DEQUEUE time (never a pre-queue
+// snapshot), every refusal reason is threaded through `mutateWorkspace`'s
+// `data` channel untouched, a rendered surface is poked only on a real
+// commit, and `dashboardDeleteMessage` reports each outcome in one voice.
+// Modeled directly on `dashboard-title.test.ts`.
+
+import { describe, expect, it, vi } from 'vitest';
+import {
+  commitDashboardRemoval, commitPanelRemoval, dashboardDeleteMessage,
+} from '../../src/application/dashboard-delete.js';
+import type {
+  DashboardDeleteAbort, DashboardDeleteDeps, DashboardDeleteOutcome,
+} from '../../src/application/dashboard-delete.js';
+import { removeDashboardDocument, removeDashboardPanel } from '../../src/dashboard/application/dashboard-removal.js';
+import type {
+  DashboardDocumentV2, SavedQueryV2, StoredWorkspaceV5,
+} from '../../src/generated/json-schema.types.js';
+import type { MutateWorkspace, WorkspaceExternallyChangedInfo } from '../../src/state.js';
+import type { WorkspaceDiagnostic } from '../../src/dashboard/model/workspace-diagnostics.js';
+
+const panelQuery = (id: string): SavedQueryV2 => ({
+  id, sql: 'SELECT 1', specVersion: 1, spec: { name: id, dashboard: { role: 'panel' } },
+} as SavedQueryV2);
+
+const dash = (over: Partial<DashboardDocumentV2> = {}): DashboardDocumentV2 => ({
+  documentVersion: 2, id: 'dash', title: 'D', revision: 1,
+  layout: { type: 'flow', version: 1, preset: 'report', items: {} },
+  tiles: [], ...over,
+} as DashboardDocumentV2);
+
+const ws = (over: Partial<StoredWorkspaceV5> = {}): StoredWorkspaceV5 => ({
+  storageVersion: 5, id: 'ws1', key: 'ws1', name: 'W', queries: [], dashboards: [], ...over,
+} as StoredWorkspaceV5);
+
+/**
+ * A `mutateWorkspace` that behaves like the real one: it hands the transform
+ * `latest` (committed truth at dequeue time, NOT a caller snapshot), records
+ * every candidate it was asked to commit, and maps a null candidate to an
+ * abort that carries the transform's own `data` channel through untouched.
+ */
+const fakeMutate = (latest: StoredWorkspaceV5 | null) => {
+  const committed: (StoredWorkspaceV5 | null)[] = [];
+  const mutateWorkspace = (async (transform) => {
+    const input = await transform(latest);
+    const candidate = input === null ? null : input.candidate;
+    committed.push(candidate);
+    if (candidate === null) {
+      return { ok: false, aborted: true, data: input === null ? undefined : input.data };
+    }
+    return { ok: true, workspace: candidate, dashboardRevision: null, data: input!.data };
+  }) as MutateWorkspace;
+  return { mutateWorkspace, committed };
+};
+
+// A standalone const with its real signature before it ever enters an object
+// literal: inlining `vi.fn()` into a literal typed against `DashboardDeleteDeps`
+// collapses its inferred call signature and the assignment stops type-checking
+// (same footgun `dashboard-title.test.ts` avoids the same way).
+const pokeMock = () => vi.fn<(info: WorkspaceExternallyChangedInfo) => void>();
+
+const deps = (latest: StoredWorkspaceV5 | null) => {
+  const { mutateWorkspace, committed } = fakeMutate(latest);
+  const onWorkspaceExternallyChanged = pokeMock();
+  const bag: DashboardDeleteDeps = { mutateWorkspace, onWorkspaceExternallyChanged };
+  return { ...bag, committed, onWorkspaceExternallyChanged };
+};
+
+describe('commitPanelRemoval', () => {
+  it('commits exactly the pure transform\'s candidate and reports queriesChanged: true (a query really was deleted)', async () => {
+    const latest = ws({
+      queries: [panelQuery('p1'), panelQuery('p2')],
+      dashboards: [dash({
+        tiles: [{ id: 't1', queryId: 'p1' }, { id: 't2', queryId: 'p2' }], revision: 3,
+        layout: { type: 'flow', version: 1, preset: 'report', items: { t1: {}, t2: {} } },
+      })],
+    });
+    const expected = removeDashboardPanel({ workspace: latest, dashboardId: 'dash', tileId: 't1' });
+    if (expected.status !== 'ok') throw new Error(`expected ok, got ${expected.status}`);
+
+    const app = deps(latest);
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+    if (!outcome.ok) throw new Error(`expected ok, got aborted/rejected`);
+
+    // The wrapper never reimplements the transform — it hands `mutateWorkspace`
+    // exactly what `removeDashboardPanel` itself produced from the same input.
+    expect(app.committed[0]).toEqual(expected.workspace);
+    expect(outcome.workspace).toEqual(expected.workspace);
+    // `queriesChanged: true` is a fact, not a default: this write deleted p1.
+    expect(app.onWorkspaceExternallyChanged).toHaveBeenCalledExactlyOnceWith({
+      workspace: outcome.workspace, queriesChanged: true,
+    });
+  });
+
+  it('builds the candidate from DEQUEUE-TIME truth, never a snapshot the caller could have seen earlier', async () => {
+    // A decoy shape the caller might plausibly have painted its row from —
+    // this object is never handed to `mutateWorkspace` at all, so nothing
+    // about its structure may appear in the outcome.
+    const staleBelief = ws({
+      queries: [panelQuery('p1')],
+      dashboards: [dash({ tiles: [{ id: 't1', queryId: 'p1' }], revision: 1 })],
+    });
+    void staleBelief;
+    // What the queue actually reads at dequeue time: a third tile has joined
+    // since, and the revision has moved on from anything a pre-queue snapshot
+    // could have shown.
+    const dequeueLatest = ws({
+      queries: [panelQuery('p1'), panelQuery('p3')],
+      dashboards: [dash({
+        tiles: [{ id: 't1', queryId: 'p1' }, { id: 't3', queryId: 'p3' }], revision: 7,
+        layout: { type: 'flow', version: 1, preset: 'report', items: { t1: {}, t3: {} } },
+      })],
+    });
+    const app = deps(dequeueLatest);
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+    if (!outcome.ok) throw new Error(`expected ok, got aborted/rejected`);
+
+    // t3/p3 — wholly absent from `staleBelief` — survives, and the revision
+    // advanced from the DEQUEUE value (7), never from the stale one (1).
+    const changed = outcome.workspace.dashboards[0];
+    expect(changed.tiles).toEqual([{ id: 't3', queryId: 'p3' }]);
+    expect(changed.revision).toBe(8);
+    expect(outcome.workspace.queries.map((q) => q.id)).toEqual(['p3']);
+  });
+
+  it('aborts with no-workspace, threaded through data, and commits nothing when nothing is loaded', async () => {
+    const app = deps(null);
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+
+    expect(outcome).toEqual({ ok: false, aborted: true, data: 'no-workspace' });
+    expect(app.committed).toEqual([null]);
+    expect(app.onWorkspaceExternallyChanged).not.toHaveBeenCalled();
+  });
+
+  it('aborts dashboard-missing, threaded through data, and commits nothing', async () => {
+    const latest = ws({ dashboards: [dash({ id: 'ops' })] });
+    const app = deps(latest);
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+
+    expect(outcome).toEqual({ ok: false, aborted: true, data: 'dashboard-missing' });
+    expect(app.committed).toEqual([null]);
+    expect(app.onWorkspaceExternallyChanged).not.toHaveBeenCalled();
+  });
+
+  it('aborts dashboard-duplicate, threaded through data, and commits nothing', async () => {
+    const latest = ws({
+      dashboards: [dash({ id: 'dup', tiles: [{ id: 't1', queryId: 'p1' }] }), dash({ id: 'dup' })],
+      queries: [panelQuery('p1')],
+    });
+    const app = deps(latest);
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dup', tileId: 't1' });
+
+    expect(outcome).toEqual({ ok: false, aborted: true, data: 'dashboard-duplicate' });
+    expect(app.committed).toEqual([null]);
+    expect(app.onWorkspaceExternallyChanged).not.toHaveBeenCalled();
+  });
+
+  it('aborts tile-missing, threaded through data, and commits nothing', async () => {
+    const latest = ws({ dashboards: [dash({ tiles: [{ id: 't1', queryId: 'p1' }] })], queries: [panelQuery('p1')] });
+    const app = deps(latest);
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 'ghost' });
+
+    expect(outcome).toEqual({ ok: false, aborted: true, data: 'tile-missing' });
+    expect(app.committed).toEqual([null]);
+    expect(app.onWorkspaceExternallyChanged).not.toHaveBeenCalled();
+  });
+
+  it('aborts ownership-unproven, threaded through data, and commits nothing', async () => {
+    const latest = ws({ dashboards: [dash({ tiles: [{ id: 't1', queryId: 'ghost' }] })], queries: [] });
+    const app = deps(latest);
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+
+    expect(outcome).toEqual({ ok: false, aborted: true, data: 'ownership-unproven' });
+    expect(app.committed).toEqual([null]);
+    expect(app.onWorkspaceExternallyChanged).not.toHaveBeenCalled();
+  });
+});
+
+describe('commitDashboardRemoval', () => {
+  it('commits exactly the pure transform\'s candidate and reports queriesChanged: true (queries really were deleted)', async () => {
+    const latest = ws({
+      queries: [panelQuery('p1'), panelQuery('p2'), panelQuery('shared')],
+      dashboards: [
+        dash({
+          id: 'dash',
+          tiles: [{ id: 't1', queryId: 'p1' }, { id: 't2', queryId: 'p2' }, { id: 't3', queryId: 'shared' }],
+        }),
+        dash({ id: 'dash2', tiles: [{ id: 't9', queryId: 'shared' }] }),
+      ],
+    });
+    const expected = removeDashboardDocument({ workspace: latest, dashboardId: 'dash' });
+    if (expected.status !== 'ok') throw new Error(`expected ok, got ${expected.status}`);
+
+    const app = deps(latest);
+    const outcome = await commitDashboardRemoval(app, 'dash');
+    if (!outcome.ok) throw new Error(`expected ok, got aborted/rejected`);
+
+    expect(app.committed[0]).toEqual(expected.workspace);
+    expect(outcome.workspace).toEqual(expected.workspace);
+    expect(app.onWorkspaceExternallyChanged).toHaveBeenCalledExactlyOnceWith({
+      workspace: outcome.workspace, queriesChanged: true,
+    });
+  });
+
+  it('builds the candidate from DEQUEUE-TIME truth, never a snapshot the caller could have seen earlier', async () => {
+    // Decoy: as far as the caller could tell, 'dash' owned p1 alone and no
+    // other Dashboard existed. Never handed to `mutateWorkspace`.
+    const staleBelief = ws({
+      queries: [panelQuery('p1')],
+      dashboards: [dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'p1' }] })],
+    });
+    void staleBelief;
+    // Dequeue-time truth: a second tile on 'dash' now shares a query with a
+    // Dashboard the stale belief never knew existed — that query must survive.
+    const dequeueLatest = ws({
+      queries: [panelQuery('p1'), panelQuery('shared')],
+      dashboards: [
+        dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'p1' }, { id: 't2', queryId: 'shared' }] }),
+        dash({ id: 'dash2', tiles: [{ id: 't9', queryId: 'shared' }] }),
+      ],
+    });
+    const app = deps(dequeueLatest);
+    const outcome = await commitDashboardRemoval(app, 'dash');
+    if (!outcome.ok) throw new Error(`expected ok, got aborted/rejected`);
+
+    expect(outcome.workspace.dashboards.map((d) => d.id)).toEqual(['dash2']);
+    // 'shared' — a reference the stale belief never carried — survives because
+    // dash2's own tile (read at dequeue time) still owns it.
+    expect(outcome.workspace.queries.map((q) => q.id)).toEqual(['shared']);
+  });
+
+  it('aborts with no-workspace, threaded through data, and commits nothing when nothing is loaded', async () => {
+    const app = deps(null);
+    const outcome = await commitDashboardRemoval(app, 'dash');
+
+    expect(outcome).toEqual({ ok: false, aborted: true, data: 'no-workspace' });
+    expect(app.committed).toEqual([null]);
+    expect(app.onWorkspaceExternallyChanged).not.toHaveBeenCalled();
+  });
+
+  it('aborts dashboard-missing, threaded through data, and commits nothing', async () => {
+    const latest = ws({ dashboards: [dash({ id: 'ops' })] });
+    const app = deps(latest);
+    const outcome = await commitDashboardRemoval(app, 'dash');
+
+    expect(outcome).toEqual({ ok: false, aborted: true, data: 'dashboard-missing' });
+    expect(app.committed).toEqual([null]);
+    expect(app.onWorkspaceExternallyChanged).not.toHaveBeenCalled();
+  });
+
+  it('aborts dashboard-duplicate, threaded through data, and commits nothing', async () => {
+    const latest = ws({ dashboards: [dash({ id: 'dup' }), dash({ id: 'dup' })] });
+    const app = deps(latest);
+    const outcome = await commitDashboardRemoval(app, 'dup');
+
+    expect(outcome).toEqual({ ok: false, aborted: true, data: 'dashboard-duplicate' });
+    expect(app.committed).toEqual([null]);
+    expect(app.onWorkspaceExternallyChanged).not.toHaveBeenCalled();
+  });
+});
+
+describe('dashboardDeleteMessage', () => {
+  const ok = (): DashboardDeleteOutcome => ({
+    ok: true, workspace: ws(), dashboardRevision: null,
+  });
+  const aborted = (data: DashboardDeleteAbort): DashboardDeleteOutcome => ({ ok: false, aborted: true, data });
+  const rejected = (diagnostics: WorkspaceDiagnostic[]): DashboardDeleteOutcome => (
+    { ok: false, aborted: false, diagnostics }
+  );
+
+  it('reports nothing on success — the disappearing row is its own report', () => {
+    expect(dashboardDeleteMessage(ok())).toBeNull();
+  });
+
+  it('reports nothing for no-workspace — nothing was lost, nothing to act on', () => {
+    expect(dashboardDeleteMessage(aborted('no-workspace'))).toBeNull();
+  });
+
+  it('reports the dashboard-missing sentence', () => {
+    expect(dashboardDeleteMessage(aborted('dashboard-missing')))
+      .toBe('That dashboard is no longer part of this workspace.');
+  });
+
+  it('reports the tile-missing sentence', () => {
+    expect(dashboardDeleteMessage(aborted('tile-missing')))
+      .toBe('That panel is no longer part of this dashboard.');
+  });
+
+  it('reports the ownership-unproven sentence', () => {
+    expect(dashboardDeleteMessage(aborted('ownership-unproven')))
+      .toBe('This panel’s query is shared or missing, so nothing was deleted.');
+  });
+
+  it('reports the dashboard-duplicate sentence', () => {
+    expect(dashboardDeleteMessage(aborted('dashboard-duplicate')))
+      .toBe('This workspace has two dashboards with the same id, so nothing was deleted.');
+  });
+
+  it('every one of the four distinct refusal sentences is actually distinct', () => {
+    const sentences = new Set([
+      dashboardDeleteMessage(aborted('dashboard-missing')),
+      dashboardDeleteMessage(aborted('tile-missing')),
+      dashboardDeleteMessage(aborted('ownership-unproven')),
+      dashboardDeleteMessage(aborted('dashboard-duplicate')),
+    ]);
+    expect(sentences.size).toBe(4);
+  });
+
+  it('reports "✕ " + the first diagnostic for a rejected commit', () => {
+    const diagnostics: WorkspaceDiagnostic[] = [
+      { path: ['dashboards', 0], severity: 'error', code: 'x', message: 'Persisting the workspace failed' },
+    ];
+    expect(dashboardDeleteMessage(rejected(diagnostics))).toBe('✕ Persisting the workspace failed');
+  });
+
+  it('falls back to a generic sentence when a rejection carries no diagnostics', () => {
+    expect(dashboardDeleteMessage(rejected([]))).toBe('✕ Could not save workspace');
+  });
+});
diff --git a/tests/unit/dashboard-panel-metadata.test.ts b/tests/unit/dashboard-panel-metadata.test.ts
new file mode 100644
index 00000000..230206fe
--- /dev/null
+++ b/tests/unit/dashboard-panel-metadata.test.ts
@@ -0,0 +1,289 @@
+// #494 — editing one panel's dedicated owned query metadata (name/description).
+// `renameSaved` (state.ts) does the actual patch and its own rules
+// (trim/clear, linked-draft sync, deleted-externally) are covered by
+// state.test.ts; what is tested here is what this module ADDS on top: the
+// dequeue-time ownership guard (`ownedByPanel`), and the plumbing/reporting
+// around `renameSaved`'s result (`commitPanelQueryMetadata`).
+
+import { describe, expect, it, vi } from 'vitest';
+import {
+  commitPanelQueryMetadata, ownedByPanel,
+} from '../../src/application/dashboard-panel-metadata.js';
+import type {
+  PanelMetadataDeps, PanelMetadataTarget,
+} from '../../src/application/dashboard-panel-metadata.js';
+import { createState } from '../../src/state.js';
+import type { MutateWorkspace, SpecValidationService } from '../../src/state.js';
+import { savedQuery } from '../helpers/saved-query.js';
+import type {
+  DashboardDocumentV2, SavedQueryV2, StoredWorkspaceV5,
+} from '../../src/generated/json-schema.types.js';
+import type { WorkspaceDiagnostic } from '../../src/dashboard/model/workspace-diagnostics.js';
+
+const dash = (over: Partial<DashboardDocumentV2> = {}): DashboardDocumentV2 => ({
+  documentVersion: 2, id: 'dash', title: 'D', revision: 1,
+  layout: { type: 'flow', version: 1, preset: 'report', items: {} },
+  tiles: [], ...over,
+} as DashboardDocumentV2);
+
+const ws = (dashboards: DashboardDocumentV2[], queries: SavedQueryV2[]): StoredWorkspaceV5 => ({
+  storageVersion: 5, id: 'w1', key: 'w1', name: 'W', queries, dashboards,
+});
+
+describe('ownedByPanel (#494, #427 exactly-one-owner rule asked about ONE member)', () => {
+  it('is true when the query exists, has exactly one owner, and that owner is this dashboard+tile', () => {
+    const workspace = ws(
+      [dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }] })],
+      [savedQuery({ id: 'q1' })],
+    );
+    expect(ownedByPanel(workspace, { dashboardId: 'dash', tileId: 't1', queryId: 'q1' })).toBe(true);
+  });
+
+  it('is false when the query itself is missing from the collection, even though a tile still names it', () => {
+    const workspace = ws(
+      [dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }] })],
+      [], // the dangling state the exactly-one-owner rule must never trust
+    );
+    expect(ownedByPanel(workspace, { dashboardId: 'dash', tileId: 't1', queryId: 'q1' })).toBe(false);
+  });
+
+  it('is false when the query has more than one owner', () => {
+    const workspace = ws(
+      [dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }, { id: 't2', queryId: 'q1' }] })],
+      [savedQuery({ id: 'q1' })],
+    );
+    expect(ownedByPanel(workspace, { dashboardId: 'dash', tileId: 't1', queryId: 'q1' })).toBe(false);
+  });
+
+  it('is false when the sole owner is a DIFFERENT tile of the same Dashboard', () => {
+    const workspace = ws(
+      [dash({ id: 'dash', tiles: [{ id: 't2', queryId: 'q1' }] })],
+      [savedQuery({ id: 'q1' })],
+    );
+    expect(ownedByPanel(workspace, { dashboardId: 'dash', tileId: 't1', queryId: 'q1' })).toBe(false);
+  });
+
+  it('is false when the sole owner belongs to a DIFFERENT Dashboard', () => {
+    const workspace = ws(
+      [
+        dash({ id: 'dash', tiles: [] }),
+        dash({ id: 'dash2', tiles: [{ id: 't9', queryId: 'q1' }] }),
+      ],
+      [savedQuery({ id: 'q1' })],
+    );
+    expect(ownedByPanel(workspace, { dashboardId: 'dash', tileId: 't1', queryId: 'q1' })).toBe(false);
+  });
+});
+
+/**
+ * A `mutateWorkspace` that behaves like the real one: `latest` is committed
+ * truth READ AT DEQUEUE TIME (never a value the caller captured earlier), and
+ * a null candidate maps to an abort carrying the transform's own `data`.
+ * Modeled on `dashboard-title.test.ts`'s own `fakeMutate`.
+ */
+const fakeMutate = (latest: StoredWorkspaceV5 | null) => {
+  const committed: (StoredWorkspaceV5 | null)[] = [];
+  const mutateWorkspace = (async (transform) => {
+    const input = await transform(latest);
+    const candidate = input === null ? null : input.candidate;
+    committed.push(candidate);
+    if (candidate === null) {
+      return { ok: false, aborted: true, data: input === null ? undefined : input.data };
+    }
+    return { ok: true, workspace: candidate, dashboardRevision: null, data: input!.data };
+  }) as MutateWorkspace;
+  return { mutateWorkspace, committed };
+};
+
+const permissiveValidators: SpecValidationService = { validate: () => [] };
+
+/** A real `AppState` (via `createState`) with `savedQueries` seeded to the
+ *  CALLER'S OWN pre-dialog view — the coarse local lookup `renameSaved` does
+ *  before ever touching the queue. The queue's own `latest` (supplied
+ *  separately to `fakeMutate`) is what the ownership guard actually judges
+ *  against, and the two are allowed to disagree — that disagreement is the
+ *  whole point of #494's guard. */
+const stateWith = (savedQueries: SavedQueryV2[]) => {
+  const state = createState({ loadStr: (_k, d) => d, loadJSON: (_k, d) => d });
+  state.savedQueries = savedQueries;
+  return state;
+};
+
+describe('commitPanelQueryMetadata', () => {
+  const target: PanelMetadataTarget = { dashboardId: 'dash', tileId: 't1', queryId: 'q1' };
+
+  it('commits ONLY spec.name/spec.description; everything else survives byte-identical, and no Dashboard is touched', async () => {
+    const q1 = savedQuery({
+      id: 'q1', sql: 'SELECT 1', name: 'Old name', description: 'Old description',
+      dashboard: { role: 'panel' },
+      panel: { cfg: { type: 'table' }, key: 'panel-key' },
+      futureExtension: 'keep-me',
+    });
+    const q2 = savedQuery({ id: 'q2', name: 'Untouched Library entry', sql: 'SELECT 2' });
+    const dashDoc = dash({ id: 'dash', revision: 5, tiles: [{ id: 't1', queryId: 'q1' }] });
+    const latest = ws([dashDoc], [q1, q2]);
+
+    const state = stateWith([q1, q2]);
+    const { mutateWorkspace, committed } = fakeMutate(latest);
+    const refreshCommittedSurfaces = vi.fn();
+    const deps: PanelMetadataDeps = {
+      state, mutateWorkspace, specValidators: permissiveValidators, refreshCommittedSurfaces,
+    };
+
+    const outcome = await commitPanelQueryMetadata(deps, target, '  New name  ', '  New description  ');
+    if (outcome.status !== 'ok') throw new Error(`expected ok, got ${outcome.status}`);
+
+    expect(outcome.entry.spec.name).toBe('New name');
+    expect(outcome.entry.spec.description).toBe('New description');
+    // Everything else about the query: byte-identical.
+    expect(outcome.entry.id).toBe('q1');
+    expect(outcome.entry.sql).toBe('SELECT 1');
+    expect(outcome.entry.spec.dashboard).toEqual({ role: 'panel' });
+    expect(outcome.entry.spec.panel).toEqual({ cfg: { type: 'table' }, key: 'panel-key' });
+    expect(outcome.entry.spec.futureExtension).toBe('keep-me');
+
+    // No Dashboard document is read or rewritten: same array, same reference,
+    // revision never bumped.
+    expect(committed[0]!.dashboards).toBe(latest.dashboards);
+    expect(committed[0]!.dashboards[0].revision).toBe(5);
+    // The Library query is a completely untouched reference.
+    expect(committed[0]!.queries.find((q) => q.id === 'q2')).toBe(q2);
+
+    expect(refreshCommittedSurfaces).toHaveBeenCalledTimes(1);
+  });
+
+  it('trims the name and CLEARS the description on an empty string — renameSaved\'s own rule, inherited', async () => {
+    const q1 = savedQuery({ id: 'q1', name: 'Old', description: 'Old description' });
+    const dashDoc = dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }] });
+    const latest = ws([dashDoc], [q1]);
+    const state = stateWith([q1]);
+    const { mutateWorkspace } = fakeMutate(latest);
+    const deps: PanelMetadataDeps = {
+      state, mutateWorkspace, specValidators: permissiveValidators, refreshCommittedSurfaces: vi.fn(),
+    };
+
+    const outcome = await commitPanelQueryMetadata(deps, target, '  Renamed  ', '   ');
+    if (outcome.status !== 'ok') throw new Error(`expected ok, got ${outcome.status}`);
+
+    expect(outcome.entry.spec.name).toBe('Renamed');
+    expect(outcome.entry.spec.description).toBeUndefined();
+    expect(Object.prototype.hasOwnProperty.call(outcome.entry.spec, 'description')).toBe(false);
+  });
+
+  it('commits nothing for a blank name — the same "nothing was attempted" outcome as a missing target', async () => {
+    const q1 = savedQuery({ id: 'q1', name: 'Old' });
+    const latest = ws([dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }] })], [q1]);
+    const state = stateWith([q1]);
+    const { mutateWorkspace, committed } = fakeMutate(latest);
+    const deps: PanelMetadataDeps = {
+      state, mutateWorkspace, specValidators: permissiveValidators, refreshCommittedSurfaces: vi.fn(),
+    };
+
+    const outcome = await commitPanelQueryMetadata(deps, target, '   ', 'irrelevant');
+
+    expect(outcome).toEqual({ status: 'stale' });
+    // `renameSaved` returns before ever touching the queue for a blank name.
+    expect(committed).toEqual([]);
+  });
+
+  it('evaluates the ownership guard at DEQUEUE time: a tile re-pointed at a different query since the dialog opened aborts stale, committing nothing', async () => {
+    const q1 = savedQuery({ id: 'q1', name: 'Old' });
+    const q2 = savedQuery({ id: 'q2', name: 'Other' });
+    // The caller's own pre-dialog view: t1 still owns q1, so its pencil dialog
+    // opened believing this edit was valid.
+    const state = stateWith([q1, q2]);
+    // Dequeue-time truth: t1 has since been re-pointed at q2 — q1 has no
+    // owner left at all, so the tile the dialog was opened for no longer
+    // owns the query it was opened for.
+    const dequeueLatest = ws([dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q2' }] })], [q1, q2]);
+    const { mutateWorkspace, committed } = fakeMutate(dequeueLatest);
+    const refreshCommittedSurfaces = vi.fn();
+    const deps: PanelMetadataDeps = {
+      state, mutateWorkspace, specValidators: permissiveValidators, refreshCommittedSurfaces,
+    };
+
+    const outcome = await commitPanelQueryMetadata(deps, target, 'New name', 'New description');
+
+    expect(outcome).toEqual({ status: 'stale' });
+    // The guard runs INSIDE the queued transform and refuses before any
+    // candidate is built — the candidate handed to `mutateWorkspace` is null.
+    expect(committed).toEqual([null]);
+    expect(refreshCommittedSurfaces).not.toHaveBeenCalled();
+  });
+
+  it('reports stale (not a crash) when the query itself was deleted while the dialog was open, even though the tile still names it', async () => {
+    const q1 = savedQuery({ id: 'q1', name: 'Old' });
+    const state = stateWith([q1]);
+    // Dequeue-time truth: q1 is gone from the collection entirely, though the
+    // tile's reference to it (a dangling id) is still sitting there.
+    const dequeueLatest = ws([dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }] })], []);
+    const { mutateWorkspace, committed } = fakeMutate(dequeueLatest);
+    const deps: PanelMetadataDeps = {
+      state, mutateWorkspace, specValidators: permissiveValidators, refreshCommittedSurfaces: vi.fn(),
+    };
+
+    const outcome = await commitPanelQueryMetadata(deps, target, 'New name', '');
+
+    expect(outcome).toEqual({ status: 'stale' });
+    expect(committed).toEqual([null]);
+  });
+
+  it('reports invalid-draft, committing nothing, when a linked tab holds Spec JSON that will not parse', async () => {
+    const q1 = savedQuery({ id: 'q1', name: 'Old' });
+    const latest = ws([dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }] })], [q1]);
+    const state = stateWith([q1]);
+    // A tab linked to this query, but its textual Spec is not currently valid
+    // JSON — `invalidSpecTabForSaved`'s own precondition (mirrors
+    // state.test.ts's own invalid-tab fixture).
+    const tab = state.tabs.value[0];
+    tab.savedId = 'q1';
+    tab.specText = '{"name":';
+    tab.specParsed = null;
+    tab.specDiagnostics = [{ severity: 'error', code: 'invalid-json', message: 'invalid JSON' }];
+    const { mutateWorkspace, committed } = fakeMutate(latest);
+    const refreshCommittedSurfaces = vi.fn();
+    const deps: PanelMetadataDeps = {
+      state, mutateWorkspace, specValidators: permissiveValidators, refreshCommittedSurfaces,
+    };
+
+    const outcome = await commitPanelQueryMetadata(deps, target, 'New name', '');
+
+    expect(outcome).toEqual({ status: 'invalid-draft' });
+    // The invalid-draft check runs BEFORE the queue is even touched.
+    expect(committed).toEqual([]);
+    expect(refreshCommittedSurfaces).not.toHaveBeenCalled();
+  });
+
+  it('reports the aggregate\'s first diagnostic on a rejected commit', async () => {
+    const q1 = savedQuery({ id: 'q1', name: 'Old' });
+    const state = stateWith([q1]);
+    const diagnostics: WorkspaceDiagnostic[] = [
+      { path: ['queries', 0, 'spec', 'name'], severity: 'error', code: 'x', message: 'Name collides' },
+    ];
+    const deps: PanelMetadataDeps = {
+      state,
+      mutateWorkspace: (async () => ({ ok: false, diagnostics })) as MutateWorkspace,
+      specValidators: permissiveValidators,
+      refreshCommittedSurfaces: vi.fn(),
+    };
+
+    const outcome = await commitPanelQueryMetadata(deps, target, 'New name', '');
+
+    expect(outcome).toEqual({ status: 'rejected', message: 'Name collides' });
+  });
+
+  it('falls back to a generic message when a rejected commit carries no diagnostics', async () => {
+    const q1 = savedQuery({ id: 'q1', name: 'Old' });
+    const state = stateWith([q1]);
+    const deps: PanelMetadataDeps = {
+      state,
+      mutateWorkspace: (async () => ({ ok: false, diagnostics: [] })) as MutateWorkspace,
+      specValidators: permissiveValidators,
+      refreshCommittedSurfaces: vi.fn(),
+    };
+
+    const outcome = await commitPanelQueryMetadata(deps, target, 'New name', '');
+
+    expect(outcome).toEqual({ status: 'rejected', message: 'Could not save this panel.' });
+  });
+});
diff --git a/tests/unit/dashboard-removal.test.ts b/tests/unit/dashboard-removal.test.ts
new file mode 100644
index 00000000..16e2e158
--- /dev/null
+++ b/tests/unit/dashboard-removal.test.ts
@@ -0,0 +1,223 @@
+import { describe, expect, it } from 'vitest';
+import { removeDashboardDocument, removeDashboardPanel } from '../../src/dashboard/application/dashboard-removal.js';
+import type {
+  DashboardDocumentV2, SavedQueryV2, StoredWorkspaceV5,
+} from '../../src/generated/json-schema.types.js';
+
+const panelQuery = (id: string): SavedQueryV2 => ({
+  id, sql: 'SELECT 1', specVersion: 1, spec: { name: id, dashboard: { role: 'panel' } },
+} as SavedQueryV2);
+
+const dashboard = (over: Partial<DashboardDocumentV2> = {}): DashboardDocumentV2 => ({
+  documentVersion: 2, id: 'dash', title: 'D', revision: 1,
+  layout: { type: 'flow', version: 1, preset: 'report', items: {} },
+  tiles: [], ...over,
+} as DashboardDocumentV2);
+
+const workspace = (over: Partial<StoredWorkspaceV5> = {}): StoredWorkspaceV5 => ({
+  storageVersion: 5, id: 'ws1', key: 'ws1', name: 'W',
+  queries: [], dashboards: [], ...over,
+} as StoredWorkspaceV5);
+
+// Deep snapshot so a refusal test can prove the input was never touched,
+// independent of which nested object identity the transform happens to reuse.
+const snapshot = (input: StoredWorkspaceV5): unknown => JSON.parse(JSON.stringify(input));
+
+describe('removeDashboardPanel (#429, #494)', () => {
+  it('removes the tile and its dedicated query, bumps revision by one, leaves everything else alone', () => {
+    const input = workspace({
+      queries: [panelQuery('p1'), panelQuery('p2'), panelQuery('other-p')],
+      dashboards: [
+        dashboard({
+          id: 'dash', revision: 3,
+          tiles: [{ id: 't1', queryId: 'p1' }, { id: 't2', queryId: 'p2' }],
+          layout: { type: 'flow', version: 1, preset: 'report', items: { t1: {}, t2: {} } },
+          // An entry with no matching panel declaration is already an orphaned
+          // configuration by #457's own rule — asserting it survives the
+          // delete proves #494's non-goal (no side-effect cleanup here), not
+          // that this transform infers anything about it.
+          variableConfigs: { orphanVar: { sql: 'SELECT 1' } },
+        }),
+        dashboard({ id: 'dash2', revision: 5, tiles: [{ id: 'tx', queryId: 'other-p' }] }),
+      ],
+    });
+    const before = snapshot(input);
+
+    const result = removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' });
+    if (result.status !== 'ok') throw new Error(`expected ok, got ${result.status}`);
+
+    expect(result.queryId).toBe('p1');
+    const changed = result.workspace.dashboards.find((candidate) => candidate.id === 'dash')!;
+    expect(changed.tiles).toEqual([{ id: 't2', queryId: 'p2' }]);
+    expect(changed.revision).toBe(4);
+    expect(changed.variableConfigs).toEqual({ orphanVar: { sql: 'SELECT 1' } });
+
+    expect(result.workspace.queries.map((query) => query.id)).toEqual(['p2', 'other-p']);
+    expect(result.workspace.dashboards.map((candidate) => candidate.id)).toEqual(['dash', 'dash2']);
+    // The other Dashboard is byte-identical — same reference even, since this
+    // transform never rebuilds an entry it did not target.
+    expect(result.workspace.dashboards[1]).toBe(input.dashboards[1]);
+
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('normalizes grafana-grid primary and fallback placements after the removal', () => {
+    const input = workspace({
+      queries: [panelQuery('p1'), panelQuery('p2')],
+      dashboards: [dashboard({
+        tiles: [{ id: 't1', queryId: 'p1' }, { id: 't2', queryId: 'p2' }],
+        layout: {
+          type: 'grafana-grid', version: 1,
+          items: { t1: { colStart: 0, span: 6, height: 2 }, t2: { colStart: 6, span: 6, height: 3 } },
+          fallback: {
+            type: 'flow', version: 1, preset: 'columns-2',
+            items: { t1: { span: 2, height: 'medium' }, t2: { span: 2, height: 'large' } },
+          },
+        },
+      })],
+    });
+
+    const result = removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' });
+    if (result.status !== 'ok') throw new Error(`expected ok, got ${result.status}`);
+
+    const layout = result.workspace.dashboards[0].layout as {
+      items: Record<string, unknown>; fallback: { items: Record<string, unknown> };
+    };
+    expect(layout.items).toEqual({ t2: { colStart: 6, span: 6, height: 3 } });
+    expect(layout.fallback.items).toEqual({ t2: { span: 2, height: 'large' } });
+  });
+
+  it('refuses dashboard-missing and commits nothing', () => {
+    const input = workspace({ dashboards: [dashboard()] });
+    const before = snapshot(input);
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'nope', tileId: 't1' }))
+      .toEqual({ status: 'refused', reason: 'dashboard-missing' });
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('refuses dashboard-duplicate and commits nothing', () => {
+    const input = workspace({
+      dashboards: [dashboard({ id: 'dup', tiles: [{ id: 't1', queryId: 'p1' }] }), dashboard({ id: 'dup' })],
+      queries: [panelQuery('p1')],
+    });
+    const before = snapshot(input);
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dup', tileId: 't1' }))
+      .toEqual({ status: 'refused', reason: 'dashboard-duplicate' });
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('refuses tile-missing and commits nothing', () => {
+    const input = workspace({
+      dashboards: [dashboard({ tiles: [{ id: 't1', queryId: 'p1' }] })],
+      queries: [panelQuery('p1')],
+    });
+    const before = snapshot(input);
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 'missing' }))
+      .toEqual({ status: 'refused', reason: 'tile-missing' });
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('refuses ownership-unproven when the queryId names no query in the collection', () => {
+    const input = workspace({
+      dashboards: [dashboard({ tiles: [{ id: 't1', queryId: 'ghost' }] })],
+      queries: [],
+    });
+    const before = snapshot(input);
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' }))
+      .toEqual({ status: 'refused', reason: 'ownership-unproven' });
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('refuses ownership-unproven when two tiles of the SAME Dashboard reference the query', () => {
+    const input = workspace({
+      dashboards: [dashboard({
+        tiles: [{ id: 't1', queryId: 'p1' }, { id: 't2', queryId: 'p1' }],
+      })],
+      queries: [panelQuery('p1')],
+    });
+    const before = snapshot(input);
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' }))
+      .toEqual({ status: 'refused', reason: 'ownership-unproven' });
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('refuses ownership-unproven when the query is also owned by a DIFFERENT Dashboard\'s tile', () => {
+    const input = workspace({
+      dashboards: [
+        dashboard({ id: 'dash', tiles: [{ id: 't1', queryId: 'p1' }] }),
+        dashboard({ id: 'dash2', tiles: [{ id: 't9', queryId: 'p1' }] }),
+      ],
+      queries: [panelQuery('p1')],
+    });
+    const before = snapshot(input);
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' }))
+      .toEqual({ status: 'refused', reason: 'ownership-unproven' });
+    expect(snapshot(input)).toEqual(before);
+  });
+});
+
+describe('removeDashboardDocument (#429, #494)', () => {
+  it('deletes the document and recursively the queries only it owns, keeping a Library query and a shared query', () => {
+    const input = workspace({
+      queries: [
+        panelQuery('p1'), panelQuery('p2'), panelQuery('dup'), panelQuery('shared'), panelQuery('lib1'),
+      ],
+      dashboards: [
+        dashboard({
+          id: 'dash',
+          tiles: [
+            { id: 't1', queryId: 'p1' },
+            { id: 't2', queryId: 'p2' },
+            { id: 't3', queryId: 'dup' },
+            { id: 't4', queryId: 'dup' },
+            { id: 't5', queryId: 'shared' },
+          ],
+        }),
+        dashboard({ id: 'dash2', tiles: [{ id: 't9', queryId: 'shared' }] }),
+      ],
+    });
+    const before = snapshot(input);
+
+    const result = removeDashboardDocument({ workspace: input, dashboardId: 'dash' });
+    if (result.status !== 'ok') throw new Error(`expected ok, got ${result.status}`);
+
+    // Tile order, deduplicated: t3 and t4 both name 'dup' but it is reported
+    // (and removed) exactly once. 'shared' is kept — dash2's own tile still
+    // references it, so it is not this Dashboard's alone to remove.
+    expect(result.removedQueryIds).toEqual(['p1', 'p2', 'dup']);
+
+    expect(result.workspace.dashboards.map((candidate) => candidate.id)).toEqual(['dash2']);
+    expect(result.workspace.queries.map((query) => query.id)).toEqual(['shared', 'lib1']);
+    // dash2 and its tile are untouched by a document delete that targeted 'dash'.
+    expect(result.workspace.dashboards[0]).toBe(input.dashboards[1]);
+
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('skips a tile whose queryId names no query in the collection, removing nothing for it', () => {
+    const input = workspace({
+      dashboards: [dashboard({ tiles: [{ id: 't1', queryId: 'ghost' }] })],
+      queries: [],
+    });
+    const result = removeDashboardDocument({ workspace: input, dashboardId: 'dash' });
+    if (result.status !== 'ok') throw new Error(`expected ok, got ${result.status}`);
+    expect(result.removedQueryIds).toEqual([]);
+    expect(result.workspace.dashboards).toEqual([]);
+  });
+
+  it('refuses dashboard-missing and commits nothing', () => {
+    const input = workspace({ dashboards: [dashboard()] });
+    const before = snapshot(input);
+    expect(removeDashboardDocument({ workspace: input, dashboardId: 'nope' }))
+      .toEqual({ status: 'refused', reason: 'dashboard-missing' });
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('refuses dashboard-duplicate and commits nothing', () => {
+    const input = workspace({ dashboards: [dashboard({ id: 'dup' }), dashboard({ id: 'dup' })] });
+    const before = snapshot(input);
+    expect(removeDashboardDocument({ workspace: input, dashboardId: 'dup' }))
+      .toEqual({ status: 'refused', reason: 'dashboard-duplicate' });
+    expect(snapshot(input)).toEqual(before);
+  });
+});
diff --git a/tests/unit/dashboard-tree-model.test.ts b/tests/unit/dashboard-tree-model.test.ts
index ab7e3efa..1a03d3ab 100644
--- a/tests/unit/dashboard-tree-model.test.ts
+++ b/tests/unit/dashboard-tree-model.test.ts
@@ -269,7 +269,9 @@ describe('deriveDashboardTree — variable inference', () => {
     expect(only.invalid).toBeNull();
     expect(only.severity).toBeNull();
     expect(only.diagnostic).toBeNull();
-    expect(only.deletable).toBe(false);
+    // An ACTIVE variable is inferred from the panel SQL — there is no stored
+    // configuration of its own to edit or delete.
+    expect(only.actions).toEqual([]);
   });
 
   it('still produces ONE row when several panels declare the same name and type', () => {
@@ -297,8 +299,8 @@ describe('deriveDashboardTree — variable inference', () => {
     expect(rows[0].meta).toBe('String | UInt64');
     expect(rows[0].invalid).toBe('variable-conflict');
     expect(rows[0].severity).toBe('error');
-    // Never deletable: there is no stored configuration behind a conflict.
-    expect(rows[0].deletable).toBe(false);
+    // Never has an action: there is no stored configuration behind a conflict.
+    expect(rows[0].actions).toEqual([]);
   });
 
   it('names the conflicting panel/query usages in the hover text, the way the TREE labels them', () => {
@@ -347,7 +349,16 @@ describe('deriveDashboardTree — variable inference', () => {
     expect(orphan.diagnostic).toContain('not referenced by any Dashboard panel');
     // The remembered type still displays, so the row is not mysteriously blank.
     expect(orphan.meta).toBe('String');
-    expect(orphan.deletable).toBe(true);
+    // #494: an orphan's ONE action is the trash for its stored option SQL,
+    // fully resolved and carrying the confirmation sentence.
+    expect(orphan.actions).toEqual([{
+      kind: 'delete-variable-config',
+      label: 'Delete the stored option SQL for region',
+      tooltip: 'Delete stored option SQL',
+      target: { kind: 'variable-config', dashboardId: 'd', name: 'region' },
+      unavailable: null,
+      confirm: 'Delete the stored option SQL for “region”? The SQL is lost.',
+    }]);
   });
 
   it('shows NO type for an orphan whose configuration never recorded one', () => {
@@ -405,7 +416,13 @@ describe('deriveDashboardTree — invalid panel references', () => {
     const broken = row(derive(workspace(), allOpen(['d'])).rows, 'w1:d:tile:t-broken');
     expect(broken.double).toMatchObject({ kind: 'open-dashboard' });
     expect(broken.shift).toMatchObject({ kind: 'open-dashboard' });
-    expect(broken.menu.map((item) => item.command === null)).toEqual([true, false, false]);
+    // #494: both direct controls still RENDER — the row's vocabulary does not
+    // shrink — but neither can act on a query that is not in the workspace.
+    expect(broken.actions.map((a) => a.kind)).toEqual(['edit-panel', 'delete-panel']);
+    expect(broken.actions.every((a) => a.target === null)).toBe(true);
+    expect(broken.actions.every((a) => a.confirm === null)).toBe(true);
+    expect(broken.actions[0].unavailable).toContain('not in this workspace');
+    expect(broken.actions[1].unavailable).toBe(broken.actions[0].unavailable);
   });
 
   it('never hides the Dashboard because one reference is bad', () => {
@@ -585,7 +602,8 @@ describe('deriveDashboardTree — search', () => {
     // like any other, where before it was a dead click.
     expect(dash.single).toMatchObject({ kind: 'open-dashboard', request: { mode: 'view' } });
     expect(dash.shift).toMatchObject({ kind: 'open-dashboard', request: { mode: 'edit' } });
-    expect(dash.menu).toHaveLength(1);
+    // The search forcing expansion open does not touch the row's OWN actions.
+    expect(dash.actions.map((a) => a.kind)).toEqual(['edit-dashboard', 'delete-dashboard']);
   });
 
   it('every row is toggleable again once the search clears', () => {
@@ -685,18 +703,18 @@ describe('deriveDashboardTree — command sets', () => {
     expect(dash.shift).toEqual({ kind: 'open-dashboard', request: { dashboardId: 'd', mode: 'edit' } });
     // Both requests name the Dashboard alone: a Dashboard row focuses no member.
     expect('focus' in (dash.single as { request: object }).request).toBe(false);
-    // *Open in View* is redundant once the row itself opens View; *Open in Edit*
-    // stays, being reachable only through the hidden Shift modifier otherwise.
-    expect(dash.menu.map((item) => item.label)).toEqual(['Open in Edit']);
-    expect(dash.menu.every((item) => item.command !== null)).toBe(true);
+    // #494 removed the `⋯` menu — *Open in Edit* was its last item, and Shift
+    // (asserted above via `shift`) is still how Edit is reached. The row's
+    // vocabulary is now its two direct actions, and nothing else mirrors a menu.
+    expect(dash.actions.map((a) => a.kind)).toEqual(['edit-dashboard', 'delete-dashboard']);
   });
 
-  it('gives a group row ONLY a toggle — no double, no Shift, no menu', () => {
+  it('gives a group row ONLY a toggle — no double, no Shift, no actions', () => {
     const group = row(tree().rows, 'w1:d:group:panels');
     expect(group.single).toEqual({ kind: 'toggle' });
     expect(group.double).toBeNull();
     expect(group.shift).toBeNull();
-    expect(group.menu).toEqual([]);
+    expect(group.actions).toEqual([]);
   });
 
   it('gives a panel row query-open plus tile-focused View/Edit, addressed by TILE id', () => {
@@ -711,36 +729,41 @@ describe('deriveDashboardTree — command sets', () => {
       kind: 'open-dashboard',
       request: { dashboardId: 'd', mode: 'edit', focus: { kind: 'tile', id: 't1' } },
     });
-    expect(panel.menu.map((item) => item.label)).toEqual([
-      'Open query',
-      'Open Dashboard in View and focus panel',
-      'Open Dashboard in Edit and focus panel',
-    ]);
+    // #494 removed the `⋯` menu — Open query/View/Edit are the gestures above;
+    // this healthy panel's SOLE owner is this tile, so its own edit/delete
+    // controls are fully resolved rather than withheld.
+    expect(panel.actions.map((a) => a.kind)).toEqual(['edit-panel', 'delete-panel']);
+    expect(panel.actions.every((a) => a.target !== null)).toBe(true);
+    expect(panel.actions.every((a) => a.unavailable === null)).toBe(true);
   });
 
   // #447: a variable row activates its own editor and offers NOTHING else — no
   // `…` menu (the issue forbids it), and no hidden double/Shift gesture a menu
   // would have to expose.
-  it('gives a variable row open-variable and no menu, double or Shift action', () => {
+  it('gives a variable row open-variable and no double or Shift action', () => {
     const variable = row(tree().rows, 'w1:d:variable:region');
     expect(variable.single).toEqual({ kind: 'open-variable', dashboardId: 'd', name: 'region' });
     expect(variable.double).toBeNull();
     expect(variable.shift).toBeNull();
-    expect(variable.menu).toEqual([]);
+    // 'region' is declared by no panel SQL in this fixture (the tile's query is
+    // plain `SELECT 1`), so it is the orphaned case — its ONE action is the
+    // trash, never a menu mirroring the gestures above.
+    expect(variable.actions.map((a) => a.kind)).toEqual(['delete-variable-config']);
     expect(variable.queryId).toBeNull();
     expect(variable.member).toEqual({ kind: 'variable', id: 'region' });
   });
 
-  // #429 phase 3: the metadata pencil is a Dashboard-row-only affordance —
-  // panel edit (phase 4) is a SEPARATE control, and a group/variable row has
-  // no document of its own to rename.
-  it('offers the rename affordance on the Dashboard row only', () => {
+  // #429 phase 3 / #494: editing is now expressed as an `edit-*` action rather
+  // than a `renamable` boolean — a Dashboard row and a healthy Panel row both
+  // carry one; a group or variable row never does (a variable's own SQL is
+  // reached through its `open-variable` command, not a pencil).
+  it('offers an edit action on the Dashboard row and the Panel row only', () => {
     const rows = tree().rows;
-    expect(row(rows, 'w1:d').renamable).toBe(true);
-    expect(row(rows, 'w1:d:group:panels').renamable).toBe(false);
-    expect(row(rows, 'w1:d:group:variables').renamable).toBe(false);
-    expect(row(rows, 'w1:d:tile:t1').renamable).toBe(false);
-    expect(row(rows, 'w1:d:variable:region').renamable).toBe(false);
+    expect(row(rows, 'w1:d').actions.some((a) => a.kind === 'edit-dashboard')).toBe(true);
+    expect(row(rows, 'w1:d:group:panels').actions.some((a) => a.kind.startsWith('edit-'))).toBe(false);
+    expect(row(rows, 'w1:d:group:variables').actions.some((a) => a.kind.startsWith('edit-'))).toBe(false);
+    expect(row(rows, 'w1:d:tile:t1').actions.some((a) => a.kind === 'edit-panel')).toBe(true);
+    expect(row(rows, 'w1:d:variable:region').actions.some((a) => a.kind.startsWith('edit-'))).toBe(false);
   });
 
   it('marks member rows as non-expandable leaves at level 3', () => {
@@ -753,6 +776,182 @@ describe('deriveDashboardTree — command sets', () => {
   });
 });
 
+// #494 replaced `menu` / `deletable` / `renamable` with one resolved `actions`
+// list per row. These are the CONTRACT for `panelActions` and the Dashboard /
+// variable action literals — every branch that decides `target: null` vs a
+// resolved target is exercised here, not just the shape of the field.
+describe('deriveDashboardTree — direct actions (#494)', () => {
+  it('gives a healthy Panel row edit and delete, in that order, fully resolved', () => {
+    const tree = derive(ws({
+      dashboards: [dashboard({ id: 'd', title: 'D', tiles: [{ id: 't1', queryId: 'q1' }] })],
+      queries: [query('q1', 'Q1')],
+    }), allOpen(['d']));
+    const panel = row(tree.rows, 'w1:d:tile:t1');
+    // Accessible names identify the RESOURCE, never a bare "Edit" — a screen
+    // reader hears many rows' buttons in sequence.
+    expect(panel.actions).toEqual([
+      {
+        kind: 'edit-panel', label: 'Edit Q1', tooltip: 'Edit name & description',
+        target: { kind: 'panel', dashboardId: 'd', tileId: 't1', queryId: 'q1' },
+        unavailable: null, confirm: null,
+      },
+      {
+        kind: 'delete-panel', label: 'Remove Q1 from dashboard', tooltip: 'Remove panel',
+        target: { kind: 'panel', dashboardId: 'd', tileId: 't1', queryId: 'q1' },
+        unavailable: null,
+        confirm: 'Remove panel “Q1” from “D”? This also deletes its dedicated query copy.',
+      },
+    ]);
+  });
+
+  it('names the Dashboard row\'s own controls "Edit dashboard <title>" / "Delete dashboard <title>"', () => {
+    const tree = derive(ws({ dashboards: [dashboard({ id: 'd', title: 'D' })] }));
+    const dash = row(tree.rows, 'w1:d');
+    expect(dash.actions.map((a) => a.kind)).toEqual(['edit-dashboard', 'delete-dashboard']);
+    expect(dash.actions.map((a) => a.label)).toEqual(['Edit dashboard D', 'Delete dashboard D']);
+    expect(dash.actions[1].confirm).toBe('Delete dashboard “D”? This also deletes every query its panels own.');
+  });
+
+  it('falls back to the row\'s own Untitled label in an action name, on both row kinds', () => {
+    const tree = derive(ws({
+      dashboards: [dashboard({ id: 'd', title: '   ', tiles: [{ id: 't1', queryId: 'q1' }] })],
+      queries: [query('q1')],
+    }), allOpen(['d']));
+    const dash = row(tree.rows, 'w1:d');
+    const panel = row(tree.rows, 'w1:d:tile:t1');
+    // Same fallback the ROW itself displays — never a second, disagreeing default.
+    expect(dash.label).toBe(UNTITLED_DASHBOARD);
+    expect(panel.label).toBe(UNTITLED_PANEL);
+    expect(dash.actions.map((a) => a.label)).toEqual([
+      'Edit dashboard ' + UNTITLED_DASHBOARD, 'Delete dashboard ' + UNTITLED_DASHBOARD,
+    ]);
+    expect(panel.actions.map((a) => a.label)).toEqual([
+      'Edit ' + UNTITLED_PANEL, 'Remove ' + UNTITLED_PANEL + ' from dashboard',
+    ]);
+    expect(panel.actions[1].confirm).toBe(
+      'Remove panel “' + UNTITLED_PANEL + '” from “' + UNTITLED_DASHBOARD
+      + '”? This also deletes its dedicated query copy.',
+    );
+  });
+
+  // The #427 exactly-one-owner rule, checked against every shape that fails it.
+  // Every case asserts the SAME shape — both panel actions withheld, the row's
+  // own navigation untouched — so a future branch that forgets one arm shows up
+  // as a failing case here rather than a silent regression.
+  describe('the #427 exactly-one-owner rule (malformed ownership)', () => {
+    const bothUnavailable = (member: DashboardTreeRow): void => {
+      expect(member.actions.map((a) => a.kind)).toEqual(['edit-panel', 'delete-panel']);
+      for (const a of member.actions) {
+        expect(a.target).toBeNull();
+        expect(a.confirm).toBeNull();
+        expect(a.unavailable).not.toBeNull();
+      }
+    };
+
+    it('(a) withholds both actions when the queryId names no query in the collection', () => {
+      const tree = derive(ws({
+        dashboards: [dashboard({ id: 'd', title: 'D', tiles: [{ id: 't1', queryId: 'q-gone' }] })],
+        queries: [],
+      }), allOpen(['d']));
+      const panel = row(tree.rows, 'w1:d:tile:t1');
+      bothUnavailable(panel);
+      expect(panel.actions[0].unavailable).toContain('not in this workspace');
+      // The broken reference still leaves View/Edit focus navigation reachable —
+      // only the operation that needs the missing query is withheld.
+      expect(panel.single).toBeNull();
+      expect(panel.double).toMatchObject({ kind: 'open-dashboard' });
+      expect(panel.shift).toMatchObject({ kind: 'open-dashboard' });
+    });
+
+    it('(b) withholds both actions on TWO tiles of the SAME Dashboard sharing one query', () => {
+      const tree = derive(ws({
+        dashboards: [dashboard({
+          id: 'd', title: 'D',
+          tiles: [{ id: 't1', queryId: 'q1' }, { id: 't2', queryId: 'q1' }],
+        })],
+        queries: [query('q1', 'Q1')],
+      }), allOpen(['d']));
+      const t1 = row(tree.rows, 'w1:d:tile:t1');
+      const t2 = row(tree.rows, 'w1:d:tile:t2');
+      bothUnavailable(t1);
+      bothUnavailable(t2);
+      expect(t1.actions[0].unavailable).toContain('shared with another panel');
+      // The query itself resolves fine, so the row's own open-query gesture and
+      // Dashboard focus navigation are both untouched.
+      expect(t1.single).toEqual({ kind: 'open-query', queryId: 'q1' });
+      expect(t2.single).toEqual({ kind: 'open-query', queryId: 'q1' });
+      expect(t1.double).toMatchObject({ kind: 'open-dashboard' });
+    });
+
+    it('(c) withholds both actions on two tiles of DIFFERENT Dashboards sharing one query', () => {
+      const tree = derive(ws({
+        dashboards: [
+          dashboard({ id: 'd1', title: 'D1', tiles: [{ id: 't1', queryId: 'shared' }] }),
+          dashboard({ id: 'd2', title: 'D2', tiles: [{ id: 't2', queryId: 'shared' }] }),
+        ],
+        queries: [query('shared', 'Shared')],
+      }), allOpen(['d1', 'd2']));
+      const t1 = row(tree.rows, 'w1:d1:tile:t1');
+      const t2 = row(tree.rows, 'w1:d2:tile:t2');
+      bothUnavailable(t1);
+      bothUnavailable(t2);
+      expect(t1.actions[0].unavailable).toContain('shared with another panel');
+      expect(t1.single).toEqual({ kind: 'open-query', queryId: 'shared' });
+      expect(t2.single).toEqual({ kind: 'open-query', queryId: 'shared' });
+    });
+
+    it('(d) withholds both actions on a tile with NO queryId at all', () => {
+      const tree = derive(ws({
+        dashboards: [dashboard({ id: 'd', title: 'D', tiles: [{ id: 't1' }] })],
+      }), allOpen(['d']));
+      const panel = row(tree.rows, 'w1:d:tile:t1');
+      bothUnavailable(panel);
+      expect(panel.actions[0].unavailable).toContain('not in this workspace');
+      expect(panel.single).toBeNull();
+    });
+
+    it('gives a missing query and a shared query DIFFERENT reasons', () => {
+      const missing = derive(ws({
+        dashboards: [dashboard({ id: 'd', title: 'D', tiles: [{ id: 't1', queryId: 'q-gone' }] })],
+      }), allOpen(['d']));
+      const shared = derive(ws({
+        dashboards: [dashboard({
+          id: 'd', title: 'D', tiles: [{ id: 't1', queryId: 'q1' }, { id: 't2', queryId: 'q1' }],
+        })],
+        queries: [query('q1', 'Q1')],
+      }), allOpen(['d']));
+      const missingReason = row(missing.rows, 'w1:d:tile:t1').actions[0].unavailable;
+      const sharedReason = row(shared.rows, 'w1:d:tile:t1').actions[0].unavailable;
+      expect(missingReason).not.toBe(sharedReason);
+    });
+  });
+
+  it('gives no actions to a group row or an ACTIVE (non-orphaned) variable row', () => {
+    const tree = derive(ws({
+      dashboards: [dashboard({ id: 'd', title: 'D', tiles: [{ id: 't1', queryId: 'q1' }] })],
+      queries: [query('q1', 'Q1', undefined, 'SELECT 1 WHERE c = {country:String}')],
+    }), allOpen(['d']));
+    expect(row(tree.rows, 'w1:d:group:panels').actions).toEqual([]);
+    expect(row(tree.rows, 'w1:d:group:variables').actions).toEqual([]);
+    expect(row(tree.rows, 'w1:d:variable:country').actions).toEqual([]);
+  });
+
+  it('gives an orphaned variable row exactly one action, with its confirm sentence', () => {
+    const tree = derive(ws({
+      dashboards: [dashboard({ id: 'd', title: 'D', variableConfigs: { region: { sql: 'SELECT r, r' } } })],
+    }), allOpen(['d']));
+    const orphan = row(tree.rows, 'w1:d:variable:region');
+    expect(orphan.actions).toEqual([{
+      kind: 'delete-variable-config',
+      label: 'Delete the stored option SQL for region',
+      tooltip: 'Delete stored option SQL',
+      target: { kind: 'variable-config', dashboardId: 'd', name: 'region' },
+      unavailable: null,
+      confirm: 'Delete the stored option SQL for “region”? The SQL is lost.',
+    }]);
+  });
+});
+
 describe('dashboardVariables', () => {
   const workspace = ws({
     dashboards: [dashboard({
@@ -846,7 +1045,7 @@ describe('deriveDashboardTree — Library-query drop targets (#428)', () => {
   it('rejects an ORPHANED variable row, which stays editable and deletable', () => {
     const rows = derive(fixture(), allOpen(['d1'])).rows;
     const orphan = row(rows, 'w1:d1:variable:region');
-    expect(orphan.deletable).toBe(true);
+    expect(orphan.actions.map((a) => a.kind)).toEqual(['delete-variable-config']);
     expect(orphan.dropTarget).toBeNull();
   });
 
diff --git a/tests/unit/dashboard-tree.test.ts b/tests/unit/dashboard-tree.test.ts
index 1dd058ca..ec866e35 100644
--- a/tests/unit/dashboard-tree.test.ts
+++ b/tests/unit/dashboard-tree.test.ts
@@ -67,8 +67,11 @@ const treeApp = (over: Partial<DashboardTreeApp> = {}) => {
       const input = await transform(app.currentWorkspace as StoredWorkspaceV5);
       const candidate = input === null ? null : input.candidate;
       committed.push(candidate);
-      if (candidate === null) return { ok: false, aborted: true };
-      return { ok: true, workspace: candidate, dashboardRevision: null };
+      // `data` rides through BOTH outcomes, exactly as the real primitive
+      // threads it: #494's panel-metadata write reads back the entry it
+      // committed, and a delete reads back the refusal reason.
+      if (candidate === null) return { ok: false, aborted: true, data: input?.data };
+      return { ok: true, workspace: candidate, dashboardRevision: null, data: input!.data };
     }) as App['mutateWorkspace'];
   }
   const upper = buildSidebarUpper(app, []);
@@ -91,6 +94,14 @@ const labels = (list: HTMLElement): string[] =>
 /** #429/#472: the row's disclosure BUTTON — one of its three independent targets. */
 const chevron = (list: HTMLElement, rowKey: string): HTMLButtonElement =>
   rowFor(list, rowKey).querySelector<HTMLButtonElement>('.dash-tree-chev')!;
+/** #494: one of the row's trailing DIRECT controls, addressed the way a user
+ *  finds it — by its accessible name, not by a per-operation class. */
+const actionBtn = (list: HTMLElement, rowKey: string, label: string): HTMLButtonElement | null =>
+  rowFor(list, rowKey).querySelector<HTMLButtonElement>('.dash-tree-act[aria-label="' + label + '"]');
+/** Every trailing control on a row, in paint order, by accessible name. */
+const actionNames = (list: HTMLElement, rowKey: string): string[] =>
+  [...rowFor(list, rowKey).querySelectorAll<HTMLButtonElement>('.dash-tree-act')]
+    .map((button) => button.getAttribute('aria-label')!);
 const click = (el: Element, over: MouseEventInit = {}): void => {
   el.dispatchEvent(new MouseEvent('click', { bubbles: true, ...over }));
 };
@@ -195,10 +206,15 @@ describe('renderDashboardTree — structure and ARIA', () => {
     const variable = rowFor(list, 'w1:sales:variable:country');
     expect(variable.querySelector('.label')!.textContent).toBe('country');
     expect(variable.querySelector('.meta')!.textContent).toBe('String');
-    // #447 explicitly forbids the `…` overflow menu on a variable row.
-    expect(variable.querySelector('.dash-tree-menu-btn')).toBeNull();
-    // Panel rows keep theirs.
-    expect(rowFor(list, 'w1:sales:tile:t1').querySelector('.dash-tree-menu-btn')).not.toBeNull();
+    // #447 forbade the `…` overflow menu on a variable row; #494 removed it
+    // from every other row too, so no production row renders one at all.
+    expect(list.querySelectorAll('.dash-tree-menu-btn')).toHaveLength(0);
+    // An ACTIVE variable has nothing of its own to delete — only an orphaned
+    // configuration does.
+    expect(actionNames(list, 'w1:sales:variable:country')).toEqual([]);
+    // A panel row exposes its two direct operations instead of a menu.
+    expect(actionNames(list, 'w1:sales:tile:t1'))
+      .toEqual(['Edit Revenue', 'Remove Revenue from dashboard']);
   });
 
   it('labels the Variables group with the brace glyph and a count', () => {
@@ -461,29 +477,29 @@ describe('renderDashboardTree — mouse gestures', () => {
     expect(app.openSavedQuery).not.toHaveBeenCalled();
   });
 
-  it('an action-menu click cancels its OWN row\'s pending single but no other row\'s', () => {
+  it('an action click cancels its OWN row\'s pending single but no other row\'s', () => {
     const { app, list } = treeApp();
     openAll(app, 'sales');
     renderDashboardTree(app);
     // Pending single belongs to the PANEL row...
     click(rowFor(list, 'w1:sales:tile:t1'));
-    // ...and the menu button clicked here belongs to a DIFFERENT row.
-    click(rowFor(list, 'w1:sales:tile:t-broken').querySelector('.dash-tree-menu-btn')!);
+    // ...and the control clicked here belongs to a DIFFERENT row.
+    click(actionBtn(list, 'w1:sales:tile:t-broken', 'Edit Untitled panel')!);
     settle();
     // #426: "action-menu/button clicks … cancel no unrelated row operation".
     expect(app.openSavedQuery).toHaveBeenCalledExactlyOnceWith('q1');
   });
 
-  it('uses a menu glyph distinct from the row\'s disclosure chevron', () => {
+  it('uses action glyphs distinct from the row\'s disclosure chevron', () => {
     const { app, list } = treeApp();
     renderDashboardTree(app);
     const row = rowFor(list, 'w1:sales');
     // #426 requires the two not be confusable; an expanded row would otherwise
     // carry two identical chevrons at opposite ends.
     const chevronPaths = row.querySelector('.chev')!.innerHTML;
-    const menuPaths = row.querySelector('.dash-tree-menu-btn')!.innerHTML;
-    expect(menuPaths).not.toBe(chevronPaths);
-    expect(menuPaths).toContain('circle');
+    for (const act of row.querySelectorAll('.dash-tree-act')) {
+      expect(act.innerHTML).not.toBe(chevronPaths);
+    }
   });
 
   it('moves the roving tabindex in the DOM immediately on click, not 300ms later', () => {
@@ -646,110 +662,459 @@ describe('renderDashboardTree — the disclosure control (#472)', () => {
     expect(name('w1:sales:variable:region')).toBe('region unused String Unused');
     expect(name('w1:sales:variable:country')).toBe('country String');
     expect(name('w1:sales:tile:t-broken')).toBe('Untitled panel Broken reference');
-    // The chevron and the menu keep their own, distinct names (`openAll` expanded
-    // this row, so its verb is Collapse).
+    // The chevron and every trailing control keep their own, distinct names
+    // (`openAll` expanded this row, so its verb is Collapse).
     expect(chevron(list, 'w1:sales').getAttribute('aria-label')).toBe('Collapse Sales');
-    expect(rowFor(list, 'w1:sales').querySelector('.dash-tree-menu-btn')!.getAttribute('aria-label'))
-      .toBe('Actions for Sales');
+    expect(actionNames(list, 'w1:sales')).toEqual(['Edit dashboard Sales', 'Delete dashboard Sales']);
+    // …and none of those four names leaks into the row's own (#494 adds three
+    // more labelled buttons per row than #472 measured this against).
+    for (const label of ['Edit dashboard', 'Delete dashboard', 'Collapse']) {
+      expect(name('w1:sales')).not.toContain(label);
+    }
+    expect(name('w1:sales:tile:t1')).toBe('Revenue');
+    expect(name('w1:sales:variable:region')).not.toContain('Delete the stored option SQL');
   });
 
-  it('is isolated from the trailing action, which expands and navigates neither', () => {
+  it('is isolated from the trailing actions, which expand and navigate neither', () => {
     vi.useFakeTimers();
     const { app, list } = treeApp();
     renderDashboardTree(app);
     const row = rowFor(list, 'w1:sales');
-    click(row.querySelector<HTMLElement>('.dash-tree-menu-btn')!);
+    click(actionBtn(list, 'w1:sales', 'Delete dashboard Sales')!);
     vi.advanceTimersByTime(400);
     expect(readTreeUi(app.state.dashboardTreeUi, 'w1').expandedDashboardIds.size).toBe(0);
     expect(app.openDashboard).not.toHaveBeenCalled();
-    // Three targets, three outcomes, from one row.
+    // #472's three targets became four (#494): chevron, row, pencil, trash.
     expect(row.querySelectorAll('.dash-tree-chev')).toHaveLength(1);
-    expect(row.querySelectorAll('.dash-tree-menu-btn')).toHaveLength(1);
+    expect(row.querySelectorAll('.dash-tree-act')).toHaveLength(2);
     vi.useRealTimers();
   });
 });
 
-describe('renderDashboardTree — action menu', () => {
-  const menuButton = (list: HTMLElement, rowKey: string): HTMLButtonElement =>
-    rowFor(list, rowKey).querySelector<HTMLButtonElement>('.dash-tree-menu-btn')!;
-  const menuLabels = (): string[] =>
-    [...document.querySelectorAll('.dash-tree-menu .fm-label')].map((n) => n.textContent!);
+/**
+ * #494 — the trailing DIRECT controls that replaced the `⋯` overflow menu on
+ * Dashboard and Panel rows.
+ *
+ * The menu's own coverage moved here rather than being deleted: what it used to
+ * prove (a row's whole vocabulary is reachable, an unavailable operation is
+ * rendered-but-inert, activating one never runs the row's gesture) is exactly
+ * what the buttons must prove now. What is GONE is the indirection — no row
+ * renders a menu button at all any more, and the commands the menu mirrored
+ * (`single`/`double`/`shift`) are untouched.
+ */
+describe('renderDashboardTree — direct row actions (#494)', () => {
+  const open = () => {
+    const fixture = treeApp();
+    openAll(fixture.app, 'sales');
+    renderDashboardTree(fixture.app);
+    return fixture;
+  };
+  const confirmItems = (): HTMLElement[] =>
+    [...document.querySelectorAll<HTMLElement>('.dash-tree-confirm .fm-item')];
 
-  // #429/#472 — the redundant-menu-item reconcile. *Open in View* is gone because it
-  // IS the row's primary press now; *Open in Edit* stays because its only gestures
-  // are Shift-click and Shift+Enter, so the menu is where it is discoverable at all.
-  it('offers the Dashboard row Open in Edit only, and runs it', () => {
-    const { app, list } = treeApp();
-    renderDashboardTree(app);
-    click(menuButton(list, 'w1:sales'));
-    expect(menuLabels()).toEqual(['Open in Edit']);
-    click(document.querySelector<HTMLElement>('.dash-tree-menu .fm-item')!);
-    expect(app.openDashboard).toHaveBeenCalledExactlyOnceWith({ dashboardId: 'sales', mode: 'edit' });
+  it('renders no overflow menu on ANY row, and no menu markup at all', () => {
+    const { list } = open();
+    expect(list.querySelectorAll('.dash-tree-menu-btn')).toHaveLength(0);
+    expect(document.querySelectorAll('.dash-tree-menu')).toHaveLength(0);
+    expect(list.querySelectorAll('[aria-label^="Actions for"]')).toHaveLength(0);
   });
 
-  it('exposes a panel row\'s three operations and runs the chosen one', () => {
-    const { app, list } = treeApp();
+  it('gives the Dashboard row a pencil and a trash, in that order', () => {
+    const { list } = open();
+    // Destructive rightmost — never where the pointer lands by habit.
+    expect(actionNames(list, 'w1:sales')).toEqual(['Edit dashboard Sales', 'Delete dashboard Sales']);
+  });
+
+  it('gives a Panel row a pencil and a trash that name the panel', () => {
+    const { list } = open();
+    expect(actionNames(list, 'w1:sales:tile:t1'))
+      .toEqual(['Edit Revenue', 'Remove Revenue from dashboard']);
+  });
+
+  it('gives group rows none', () => {
+    const { list } = open();
+    expect(actionNames(list, 'w1:sales:group:panels')).toEqual([]);
+    expect(actionNames(list, 'w1:sales:group:variables')).toEqual([]);
+  });
+
+  it('makes every control a real, individually named button with a tooltip', () => {
+    const { list } = open();
+    for (const button of rowFor(list, 'w1:sales:tile:t1').querySelectorAll<HTMLButtonElement>('.dash-tree-act')) {
+      expect(button.tagName).toBe('BUTTON');
+      expect(button.type).toBe('button');
+      expect(button.getAttribute('aria-label')).not.toBe('');
+      expect(button.getAttribute('title')).not.toBe('');
+      expect(button.getAttribute('aria-expanded')).toBe('false');
+    }
+    expect(actionBtn(list, 'w1:sales:tile:t1', 'Edit Revenue')!.getAttribute('aria-haspopup'))
+      .toBe('dialog');
+    expect(actionBtn(list, 'w1:sales:tile:t1', 'Remove Revenue from dashboard')!
+      .getAttribute('aria-haspopup')).toBe('menu');
+  });
+
+  it('marks the destructive one so it can be styled apart from the pencil', () => {
+    const { list } = open();
+    expect(actionBtn(list, 'w1:sales', 'Edit dashboard Sales')!.classList.contains('dash-tree-act-danger'))
+      .toBe(false);
+    expect(actionBtn(list, 'w1:sales', 'Delete dashboard Sales')!.classList.contains('dash-tree-act-danger'))
+      .toBe(true);
+  });
+
+  // A panel whose query cannot be proven to be its own: the controls stay, so
+  // the row's vocabulary does not silently shrink, but they are inert and say
+  // why. `t-broken` references a query this workspace does not carry.
+  it('renders an unprovable panel\'s controls disabled rather than hiding them', () => {
+    const { app, list } = open();
+    const names = actionNames(list, 'w1:sales:tile:t-broken');
+    expect(names).toEqual(['Edit Untitled panel', 'Remove Untitled panel from dashboard']);
+    const pencil = actionBtn(list, 'w1:sales:tile:t-broken', 'Edit Untitled panel')!;
+    // `aria-disabled`, not the native attribute — a natively disabled button is
+    // dropped from the accessibility tree, so the reason would never be heard.
+    expect(pencil.disabled).toBe(false);
+    expect(pencil.getAttribute('aria-disabled')).toBe('true');
+    expect(pencil.getAttribute('title')).toContain('not in this workspace');
+    click(pencil);
+    expect(document.querySelector('.fm-dialog-card')).toBeNull();
+    expect(app.openSavedQuery).not.toHaveBeenCalled();
+  });
+
+  it('does nothing at all when an unavailable trash is activated', async () => {
+    const { list, committed } = open();
+    click(actionBtn(list, 'w1:sales:tile:t-broken', 'Remove Untitled panel from dashboard')!);
+    await Promise.resolve();
+    expect(document.querySelector('.dash-tree-confirm')).toBeNull();
+    expect(committed).toEqual([]);
+  });
+
+  it('an action never expands, never navigates, and cancels no other row\'s pending click', () => {
+    vi.useFakeTimers();
+    const { app, list } = open();
+    click(rowFor(list, 'w1:sales:tile:t1'));            // a pending single on ANOTHER row
+    click(actionBtn(list, 'w1:sales', 'Edit dashboard Sales')!);
+    vi.advanceTimersByTime(400);
+    expect(app.openDashboard).not.toHaveBeenCalled();
+    expect(app.openSavedQuery).toHaveBeenCalledExactlyOnceWith('q1');
+    vi.useRealTimers();
+  });
+});
+
+/** #494 — removing one panel: the tile AND its dedicated owned query, once. */
+describe('renderDashboardTree — panel trash (#494)', () => {
+  const open = () => {
+    const fixture = treeApp();
+    openAll(fixture.app, 'sales');
+    renderDashboardTree(fixture.app);
+    return fixture;
+  };
+  const trash = (list: HTMLElement): HTMLButtonElement =>
+    actionBtn(list, 'w1:sales:tile:t1', 'Remove Revenue from dashboard')!;
+  const confirmItems = (): HTMLElement[] =>
+    [...document.querySelectorAll<HTMLElement>('.dash-tree-confirm .fm-item')];
+  const settle = (): Promise<void> => new Promise((resolve) => { setTimeout(resolve, 0); });
+
+  it('CONFIRMS first, naming both the panel and the Dashboard, and the query copy it takes with it', async () => {
+    const { list, committed } = open();
+    click(trash(list));
+    expect(document.querySelector('.dash-tree-confirm .fm-section')!.textContent)
+      .toBe('Remove panel “Revenue” from “Sales”? This also deletes its dedicated query copy.');
+    expect(confirmItems().map((item) => item.textContent)).toEqual(['Remove panel', 'Cancel']);
+    await settle();
+    expect(committed).toEqual([]);
+  });
+
+  it('commits nothing when the confirmation is refused', async () => {
+    const { list, committed } = open();
+    click(trash(list));
+    click(confirmItems()[1]);
+    await settle();
+    expect(committed).toEqual([]);
+  });
+
+  it('removes the tile and exactly its owned query, in one commit', async () => {
+    const { list, committed } = open();
+    click(trash(list));
+    click(confirmItems()[0]);
+    await settle();
+    expect(committed).toHaveLength(1);
+    const dashboard = committed[0]!.dashboards[0];
+    expect(dashboard.tiles.map((tile) => tile.id)).toEqual(['t-broken']);
+    expect(committed[0]!.queries).toEqual([]);
+    // The other Dashboard is untouched, and the orphaned variable config
+    // survives — #494's non-goals forbid deleting one as a side effect.
+    expect(committed[0]!.dashboards[1]).toEqual(workspace().dashboards![1]);
+    expect(dashboard.variableConfigs!.region).toBeDefined();
+  });
+
+  it('reports a refused delete and commits nothing', async () => {
+    const mutateWorkspace = vi.fn(async () => (
+      { ok: false, aborted: true, data: 'tile-missing' }
+    )) as unknown as App['mutateWorkspace'];
+    const { app } = treeApp({ mutateWorkspace });
     openAll(app, 'sales');
     renderDashboardTree(app);
-    click(menuButton(list, 'w1:sales:tile:t1'));
-    expect(menuLabels()).toEqual([
-      'Open query',
-      'Open Dashboard in View and focus panel',
-      'Open Dashboard in Edit and focus panel',
-    ]);
-    const edit = [...document.querySelectorAll<HTMLElement>('.dash-tree-menu .fm-item')]
-      .find((item) => item.textContent!.includes('Edit'))!;
-    click(edit);
-    expect(app.openDashboard).toHaveBeenCalledWith({
-      dashboardId: 'sales', mode: 'edit', focus: { kind: 'tile', id: 't1' },
-    });
+    click(trash(app.dom.dashboardTreeList!));
+    click(confirmItems()[0]);
+    await settle();
+    expect(document.querySelector('.share-toast')!.textContent)
+      .toBe('That panel is no longer part of this dashboard.');
+  });
+
+  it('moves keyboard focus to the NEXT panel row when there is one', async () => {
+    const { app, list } = open();
+    click(trash(list));
+    click(confirmItems()[0]);
+    await settle();
+    // `t1` is gone; the next sibling panel row takes the keyboard.
+    expect(readTreeUi(app.state.dashboardTreeUi, 'w1').keyboardRowKey).toBe('w1:sales:tile:t-broken');
+  });
+
+  it('falls back to the PREVIOUS panel row when the deleted one was last', async () => {
+    const fixture = treeApp();
+    // Make the healthy panel the LAST row of the group, so there is no next.
+    const dashboards = (fixture.app.currentWorkspace as unknown as TreeWorkspace).dashboards!;
+    dashboards[0]!.tiles = [{ id: 't-broken', queryId: 'q-gone' }, { id: 't1', queryId: 'q1' }];
+    openAll(fixture.app, 'sales');
+    renderDashboardTree(fixture.app);
+    click(actionBtn(fixture.list, 'w1:sales:tile:t1', 'Remove Revenue from dashboard')!);
+    click(confirmItems()[0]);
+    await settle();
+    expect(readTreeUi(fixture.app.state.dashboardTreeUi, 'w1').keyboardRowKey)
+      .toBe('w1:sales:tile:t-broken');
+  });
+
+  it('falls back to the Panels GROUP when the deleted row was the only panel', async () => {
+    const fixture = treeApp();
+    const dashboards = (fixture.app.currentWorkspace as unknown as TreeWorkspace).dashboards!;
+    dashboards[0]!.tiles = [{ id: 't1', queryId: 'q1' }];
+    openAll(fixture.app, 'sales');
+    renderDashboardTree(fixture.app);
+    click(actionBtn(fixture.list, 'w1:sales:tile:t1', 'Remove Revenue from dashboard')!);
+    click(confirmItems()[0]);
+    await settle();
+    // Never nowhere: the group that contained it keeps the keyboard, so the
+    // arrow keys still have an origin and the focus ring stays visible.
+    expect(readTreeUi(fixture.app.state.dashboardTreeUi, 'w1').keyboardRowKey)
+      .toBe('w1:sales:group:panels');
+  });
+});
+
+/**
+ * #494 — the Panel row's pencil, which edits the tile's dedicated OWNED QUERY.
+ *
+ * The Dashboard pencil above edits a document; this one edits the query the
+ * tile owns, because that is where a panel's displayed name and description
+ * actually live. Everything else about the two is deliberately identical: the
+ * same shell, the same awaited-outcome contract, the same hover-reveal
+ * `aria-expanded` treatment.
+ */
+describe('renderDashboardTree — panel metadata pencil (#494)', () => {
+  const open = () => {
+    const fixture = treeApp();
+    // `state.savedQueries` is what `renameSaved` resolves the target against
+    // before it queues anything.
+    fixture.app.state.savedQueries = [
+      query('q1', 'Revenue', 'SELECT * FROM rev WHERE c = {country:String}'),
+    ];
+    openAll(fixture.app, 'sales');
+    renderDashboardTree(fixture.app);
+    return fixture;
+  };
+  const pencil = (list: HTMLElement): HTMLButtonElement =>
+    actionBtn(list, 'w1:sales:tile:t1', 'Edit Revenue')!;
+  const nameInput = (): HTMLInputElement =>
+    document.querySelector<HTMLInputElement>('#panel-metadata-name')!;
+  const descInput = (): HTMLTextAreaElement =>
+    document.querySelector<HTMLTextAreaElement>('#panel-metadata-description')!;
+  const save = (): HTMLButtonElement => document.querySelector<HTMLButtonElement>('.fm-dialog-confirm')!;
+  const settle = (): Promise<void> => new Promise((resolve) => { setTimeout(resolve, 0); });
+
+  it('prefills from the OWNED QUERY, not from the row label', () => {
+    const { list } = open();
+    click(pencil(list));
+    expect(document.querySelector('.fm-dialog-title')!.textContent).toBe('Edit panel');
+    expect(nameInput().value).toBe('Revenue');
+    expect(descInput().value).toBe('');
+    // No standing caveat: this tile carries no imported title override.
+    expect(document.querySelector('.fm-dialog-note')).toBeNull();
   });
 
-  it('renders an unavailable operation as disabled rather than hiding it', () => {
+  it('warns when an imported tile title outranks the query name being edited', () => {
     const { app, list } = treeApp();
+    const dashboards = (app.currentWorkspace as unknown as TreeWorkspace).dashboards!;
+    dashboards[0]!.tiles = [{ id: 't1', queryId: 'q1', title: 'Imported heading' }];
+    app.state.savedQueries = [query('q1', 'Revenue')];
     openAll(app, 'sales');
     renderDashboardTree(app);
-    click(menuButton(list, 'w1:sales:tile:t-broken'));
-    expect(menuLabels()[0]).toBe('Open query');
-    const disabled = document.querySelector<HTMLButtonElement>('.dash-tree-menu .is-disabled')!;
-    expect(disabled.textContent).toContain('Open query');
-    // Disabled SEMANTICALLY, not merely greyed out: assistive technology would
-    // otherwise announce an enabled action, and keyboard activation would silently
-    // do nothing.
-    // #452: `aria-disabled`, not the native attribute — a natively disabled
-    // button is dropped from the accessibility tree, so the row would never be
-    // announced. It stays reachable and inert instead.
-    expect(disabled.disabled).toBe(false);
-    expect(disabled.getAttribute('aria-disabled')).toBe('true');
-    // Clicking it does nothing at all.
-    click(disabled);
-    expect(app.openSavedQuery).not.toHaveBeenCalled();
+    // The row shows the OVERRIDE, so the pencil is named after it…
+    click(actionBtn(app.dom.dashboardTreeList!, 'w1:sales:tile:t1', 'Edit Imported heading')!);
+    // …while the field it edits is still the query's own name.
+    expect(nameInput().value).toBe('Revenue');
+    expect(document.querySelector('.fm-dialog-note')!.textContent)
+      .toContain('keeps priority over the query name');
   });
 
-  it('labels the trigger accessibly and never runs the row\'s own gesture', () => {
-    vi.useFakeTimers();
-    const { app, list } = treeApp();
-    renderDashboardTree(app);
-    const trigger = menuButton(list, 'w1:sales');
-    expect(trigger.getAttribute('aria-label')).toBe('Actions for Sales');
-    expect(trigger.getAttribute('aria-haspopup')).toBe('menu');
+  it('commits name and description onto the owned query and closes', async () => {
+    const { list, committed } = open();
+    click(pencil(list));
+    nameInput().value = 'Revenue by region';
+    nameInput().dispatchEvent(new Event('input', { bubbles: true }));
+    descInput().value = 'Monthly';
+    save().click();
+    await settle();
+    expect(document.querySelector('.fm-dialog-card')).toBeNull();
+    expect(committed).toHaveLength(1);
+    const written = committed[0]!.queries[0];
+    expect(written.spec.name).toBe('Revenue by region');
+    expect(written.spec.description).toBe('Monthly');
+    // The SQL, the id and the Dashboard document are untouched — a
+    // metadata-only edit must not move a Dashboard revision.
+    expect(written.id).toBe('q1');
+    expect(written.sql).toBe('SELECT * FROM rev WHERE c = {country:String}');
+    expect(committed[0]!.dashboards).toEqual(workspace().dashboards);
+  });
+
+  it('keeps the dialog open and reports when the tile no longer owns the query', async () => {
+    const { app, list } = open();
+    // The commit re-resolves ownership at DEQUEUE time: by then this tile is
+    // gone, so nothing is written and the typed values survive.
+    app.mutateWorkspace = (async (transform) => {
+      const latest = workspace() as unknown as StoredWorkspaceV5;
+      latest.dashboards[0].tiles = [];
+      return transform(latest) === null ? { ok: false, aborted: true } : { ok: false, aborted: true };
+    }) as App['mutateWorkspace'];
+    click(pencil(list));
+    nameInput().value = 'Kept';
+    nameInput().dispatchEvent(new Event('input', { bubbles: true }));
+    save().click();
+    await settle();
+    expect(document.querySelector('.fm-dialog-card')).not.toBeNull();
+    expect(nameInput().value).toBe('Kept');
+    expect(document.querySelector('.fm-dialog-error')!.textContent)
+      .toBe('That panel is no longer part of this dashboard.');
+  });
+
+  it('keeps the trigger revealed for the dialog\'s whole lifetime', () => {
+    const { list } = open();
+    const trigger = pencil(list);
+    expect(trigger.getAttribute('aria-expanded')).toBe('false');
     click(trigger);
-    vi.advanceTimersByTime(400);
+    expect(trigger.getAttribute('aria-expanded')).toBe('true');
+    click(document.querySelector<HTMLButtonElement>('.fm-dialog-cancel')!);
+    expect(trigger.getAttribute('aria-expanded')).toBe('false');
+    expect(document.activeElement).toBe(trigger);
+  });
+
+  it('Cancel commits nothing', async () => {
+    const { list, committed } = open();
+    click(pencil(list));
+    nameInput().value = 'Not saved';
+    nameInput().dispatchEvent(new Event('input', { bubbles: true }));
+    click(document.querySelector<HTMLButtonElement>('.fm-dialog-cancel')!);
+    await settle();
+    expect(committed).toEqual([]);
+  });
+
+  it('sends the user to the tab when a linked draft\'s Spec JSON will not parse', async () => {
+    const { app, list, committed } = open();
+    // The same patch has to apply to the persisted entry AND to every linked
+    // draft; an unparseable draft blocks both, and only the tab can fix it.
+    const tab = app.state.tabs.value[0];
+    tab.savedId = 'q1';
+    tab.specText = '{"name":';
+    tab.specParsed = null;
+    tab.specDiagnostics = [{ severity: 'error', code: 'invalid-json', message: 'invalid JSON' }];
+    click(pencil(list));
+    nameInput().value = 'Revenue by region';
+    nameInput().dispatchEvent(new Event('input', { bubbles: true }));
+    save().click();
+    await settle();
+    expect(committed).toEqual([]);
+    expect(document.querySelector('.fm-dialog-error')!.textContent)
+      .toBe('This panel’s query has invalid Spec JSON in an open tab. Fix it there first.');
+  });
+
+  it('shows the aggregate\'s own diagnostic when the commit is rejected', async () => {
+    const mutateWorkspace = vi.fn(async () => ({
+      ok: false,
+      diagnostics: [{ path: [], severity: 'error', code: 'x', message: 'Storage is full' }],
+    })) as unknown as App['mutateWorkspace'];
+    const { app } = treeApp({ mutateWorkspace });
+    app.state.savedQueries = [query('q1', 'Revenue')];
+    openAll(app, 'sales');
+    renderDashboardTree(app);
+    click(pencil(app.dom.dashboardTreeList!));
+    nameInput().value = 'Revenue by region';
+    nameInput().dispatchEvent(new Event('input', { bubbles: true }));
+    save().click();
+    await settle();
+    expect(document.querySelector('.fm-dialog-error')!.textContent).toBe('Storage is full');
+  });
+});
+
+/** #494 — removing a whole Dashboard, with the queries its panels own. */
+describe('renderDashboardTree — Dashboard trash (#494)', () => {
+  const confirmItems = (): HTMLElement[] =>
+    [...document.querySelectorAll<HTMLElement>('.dash-tree-confirm .fm-item')];
+  const settle = (): Promise<void> => new Promise((resolve) => { setTimeout(resolve, 0); });
+  const open = () => {
+    const fixture = treeApp();
+    renderDashboardTree(fixture.app);
+    return fixture;
+  };
+  const trash = (list: HTMLElement): HTMLButtonElement =>
+    actionBtn(list, 'w1:sales', 'Delete dashboard Sales')!;
+
+  it('CONFIRMS, naming the Dashboard and the cascade', async () => {
+    const { list, committed } = open();
+    click(trash(list));
+    expect(document.querySelector('.dash-tree-confirm .fm-section')!.textContent)
+      .toBe('Delete dashboard “Sales”? This also deletes every query its panels own.');
+    expect(confirmItems().map((item) => item.textContent)).toEqual(['Delete dashboard', 'Cancel']);
+    await settle();
+    expect(committed).toEqual([]);
+  });
+
+  it('removes the document and the queries its panels own, keeping every other Dashboard', async () => {
+    const { list, committed } = open();
+    click(trash(list));
+    click(confirmItems()[0]);
+    await settle();
+    expect(committed).toHaveLength(1);
+    expect(committed[0]!.dashboards.map((dashboard) => dashboard.id)).toEqual(['ops']);
+    // `q1` was owned by `sales`'s panel tile, so it goes with the document.
+    expect(committed[0]!.queries).toEqual([]);
+  });
+
+  it('does not navigate, expand, or delete anything when refused', async () => {
+    const { app, list, committed } = open();
+    click(trash(list));
+    click(confirmItems()[1]);
+    await settle();
+    expect(committed).toEqual([]);
     expect(app.openDashboard).not.toHaveBeenCalled();
-    expect(readTreeUi(app.state.dashboardTreeUi, 'w1').expandedDashboardIds.has('sales')).toBe(false);
+    expect(readTreeUi(app.state.dashboardTreeUi, 'w1').expandedDashboardIds.size).toBe(0);
   });
 
-  it('gives a group row no menu button at all', () => {
-    const { app, list } = treeApp();
-    setUi(app, (ui) => toggleDashboardExpanded(ui, 'sales'));
+  it('reports a rejected commit', async () => {
+    const mutateWorkspace = vi.fn(async () => ({
+      ok: false,
+      diagnostics: [{ path: [], severity: 'error', code: 'x', message: 'Storage is full' }],
+    })) as unknown as App['mutateWorkspace'];
+    const { app } = treeApp({ mutateWorkspace });
     renderDashboardTree(app);
-    expect(rowFor(list, 'w1:sales:group:panels').querySelector('.dash-tree-menu-btn')).toBeNull();
+    click(trash(app.dom.dashboardTreeList!));
+    click(confirmItems()[0]);
+    await settle();
+    expect(document.querySelector('.share-toast')!.textContent).toBe('✕ Storage is full');
   });
 });
 
 describe('renderDashboardTree — deleting an orphaned variable (#447)', () => {
+  /** #494 folded this control into the shared action cluster; it is still the
+   *  only one addressed by THIS name, and still the only one always visible. */
   const trash = (list: HTMLElement, rowKey: string): HTMLButtonElement | null =>
-    rowFor(list, rowKey).querySelector<HTMLButtonElement>('.dash-tree-del-btn');
+    rowFor(list, rowKey)
+      .querySelector<HTMLButtonElement>('.dash-tree-act[aria-label^="Delete the stored option SQL"]');
   const confirmItems = (): HTMLElement[] =>
     [...document.querySelectorAll<HTMLElement>('.dash-tree-confirm .fm-item')];
   const open = () => {
@@ -759,14 +1124,21 @@ describe('renderDashboardTree — deleting an orphaned variable (#447)', () => {
     return fixture;
   };
 
-  it('renders the trash affordance on an ORPHAN row only', () => {
+  it('renders the stored-option-SQL trash on an ORPHAN row only', () => {
     const { list } = open();
-    expect(trash(list, 'w1:sales:variable:region')).not.toBeNull();
-    // Never on an active variable, a panel, a group or the Dashboard row.
+    const button = trash(list, 'w1:sales:variable:region')!;
+    expect(button).not.toBeNull();
+    // #447's control stays ALWAYS visible, unlike #494's hover-revealed
+    // cluster: it is the only way to remove SQL nothing references any more.
+    expect(button.classList.contains('dash-tree-act-static')).toBe(true);
+    // Never on an active variable or a group. Panel and Dashboard rows have a
+    // trash of their OWN now (#494) — it deletes a different thing, and says so.
     expect(trash(list, 'w1:sales:variable:country')).toBeNull();
     expect(trash(list, 'w1:sales:tile:t1')).toBeNull();
     expect(trash(list, 'w1:sales:group:variables')).toBeNull();
     expect(trash(list, 'w1:sales')).toBeNull();
+    expect(actionNames(list, 'w1:sales:variable:region'))
+      .toEqual(['Delete the stored option SQL for region']);
   });
 
   it('names what it deletes, for the keyboard and for assistive technology', () => {
@@ -817,7 +1189,7 @@ describe('renderDashboardTree — deleting an orphaned variable (#447)', () => {
     const { app, list } = open();
     click(trash(list, 'w1:sales:variable:region')!);
     vi.advanceTimersByTime(400);
-    // The trash button bypasses row activation entirely (like the action menu).
+    // The trash button bypasses row activation entirely.
     expect(app.openVariableTab).not.toHaveBeenCalled();
     click(confirmItems()[0]);
     vi.advanceTimersByTime(400);
@@ -840,7 +1212,8 @@ describe('renderDashboardTree — deleting an orphaned variable (#447)', () => {
 
 describe('renderDashboardTree — Dashboard metadata pencil (#429 phase 3)', () => {
   const pencil = (list: HTMLElement, rowKey: string): HTMLButtonElement | null =>
-    rowFor(list, rowKey).querySelector<HTMLButtonElement>('.dash-tree-rename-btn');
+    rowFor(list, rowKey)
+      .querySelector<HTMLButtonElement>('.dash-tree-act[aria-label^="Edit dashboard"]');
   const dialogTitleInput = (): HTMLInputElement =>
     document.querySelector<HTMLInputElement>('#dash-rename-name')!;
   const dialogDescInput = (): HTMLTextAreaElement =>
@@ -1067,7 +1440,7 @@ describe('renderDashboardTree — nested action buttons own their activation key
   it('Enter on the Dashboard pencil opens the dialog and does NOT open the Dashboard', () => {
     const { app, list } = treeApp();
     renderDashboardTree(app);
-    const trigger = rowFor(list, 'w1:sales').querySelector<HTMLButtonElement>('.dash-tree-rename-btn')!;
+    const trigger = actionBtn(list, 'w1:sales', 'Edit dashboard Sales')!;
     // The browser's own key-to-click synthesis is what opens the dialog; what
     // matters here is that nothing prevented it and the row did not act.
     expect(press(trigger, 'Enter')).toBe(false);
@@ -1081,15 +1454,15 @@ describe('renderDashboardTree — nested action buttons own their activation key
   it('Space on the Dashboard pencil neither navigates nor is swallowed', () => {
     const { app, list } = treeApp();
     renderDashboardTree(app);
-    const trigger = rowFor(list, 'w1:sales').querySelector<HTMLButtonElement>('.dash-tree-rename-btn')!;
+    const trigger = actionBtn(list, 'w1:sales', 'Edit dashboard Sales')!;
     expect(press(trigger, ' ')).toBe(false);
     expect(app.openDashboard).not.toHaveBeenCalled();
   });
 
-  it('Enter on the ⋯ menu button does not run the row\'s primary action', () => {
+  it('Enter on the Dashboard trash does not run the row\'s primary action', () => {
     const { app, list } = treeApp();
     renderDashboardTree(app);
-    const trigger = rowFor(list, 'w1:sales').querySelector<HTMLButtonElement>('.dash-tree-menu-btn')!;
+    const trigger = actionBtn(list, 'w1:sales', 'Delete dashboard Sales')!;
     expect(press(trigger, 'Enter')).toBe(false);
     expect(app.openDashboard).not.toHaveBeenCalled();
   });
@@ -1098,8 +1471,8 @@ describe('renderDashboardTree — nested action buttons own their activation key
     const { app, list } = treeApp();
     openAll(app, 'sales');
     renderDashboardTree(app);
-    const trigger = rowFor(list, 'w1:sales:variable:region')
-      .querySelector<HTMLButtonElement>('.dash-tree-del-btn')!;
+    const trigger = actionBtn(list, 'w1:sales:variable:region',
+      'Delete the stored option SQL for region')!;
     expect(press(trigger, 'Enter')).toBe(false);
     expect(app.openVariableTab).not.toHaveBeenCalled();
   });

From a4c0ff5735846604d53448f9676db88420c98d26 Mon Sep 17 00:00:00 2001
From: Boris Tyshkevich <btyshkevich@altinity.com>
Date: Mon, 27 Jul 2026 13:03:47 +0000
Subject: [PATCH 3/8] docs(#494): e2e coverage for the direct action cluster,
 and the CHANGELOG entry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Real-browser coverage for what happy-dom cannot see: Enter and Space on a
hover-revealed pencil (the #495 review defect, reached by tabbing rather than
by `.click()`), the dialog's `role="dialog"` accessible name, the panel
pencil's committed rename, the panel trash's confirmation and cascade, and —
sabotage-checked against a label pinned to `flex: 0 0 auto` — that a long
title still ellipsizes with both controls revealed instead of pushing them out
of the pane.

The action buttons deliberately keep the user agent's own focus ring: the
chevron owns the `2px solid` outline channel, and #472 requires the row's
targets to stay visibly distinguishable — the existing Tab-walk test catches a
collision, which an earlier custom ring here caused.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018mujm1kW7jDGpTEfscndcU
---
 CHANGELOG.md                     |  49 ++++++++
 src/styles.css                   |  11 +-
 tests/e2e/dashboard-tree.spec.js | 207 +++++++++++++++++++++++++++----
 3 files changed, 238 insertions(+), 29 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b9a9026..5f0eaec7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,33 @@ auto-generated per-PR notes; this file is the curated, human-readable history.
 ## [Unreleased]
 
 ### Added
+- **Dashboard and Panel rows act directly, and the `⋯` overflow menus are gone**
+  (#494 / #429 phase 4). A Dashboard row now carries a pencil and a trash; a
+  Panel row carries a pencil that edits its dedicated query's name and
+  description, and a trash that removes the tile *and* that query in one atomic
+  commit. Both clusters follow the Library Query row's vocabulary: revealed on
+  hover and `:focus-within`, destructive action rightmost, each button
+  separately named for a screen reader (`Edit Revenue`, `Remove Revenue from
+  dashboard`), each keyboard-operable inside the row's single tab stop, and
+  each isolated from the row's own click/Shift-click/expand gestures.
+
+  Deleting anything **confirms first**, naming both the panel and the Dashboard
+  and saying that the dedicated query copy goes too. A panel delete removes the
+  tile, every layout placement (including the grafana-grid flow fallback) and
+  exactly its owned query, bumps that Dashboard's revision once, and moves
+  keyboard focus to the next panel row — then the previous, then the Panels
+  group. An orphaned variable configuration deliberately survives.
+
+  Edit and delete are only offered when ownership can be **proven**: the tile's
+  query must exist and be owned by that one tile. A query shared between panels,
+  or a reference to a query the workspace no longer carries, leaves both
+  controls rendered but `aria-disabled` with the reason in their tooltip —
+  nothing is ever guessed or cascade-deleted. Every dialog and confirmation
+  re-resolves its target inside the write queue, so one that went stale while it
+  was open commits nothing and says so.
+
+  Not yet included: the **Open in Dashboard** focus button, which is held back
+  until #438 fixes tile focus on flow-layout KPI tiles.
 - **A Dashboard row's pencil edits its title and description** (#429 phase 3).
   Revealed on hover/focus-within next to the existing `⋯`, it opens a small
   dialog prefilled from the Dashboard's own committed document — Cancel and
@@ -115,6 +142,28 @@ auto-generated per-PR notes; this file is the curated, human-readable history.
   no row appears, disappears or moves when the work surface changes.
 
 ### Fixed
+- **Enter on a Dashboard-tree action button ran the row's command instead of the
+  button's** (#495 review). The tree's keyboard handler lives on the list and its
+  Enter arm runs the focused row's action, so Enter on the rename pencil opened
+  the Dashboard — and could swallow the button's own activation on the way. Every
+  nested control now stops Enter/Space from propagating (without preventing the
+  default, so native activation still fires exactly once), and the tree handler
+  independently ignores an Enter that originated on a button. Arrow keys, Home and
+  End still walk the tree from a focused control.
+- **A failed Dashboard rename closed its dialog and discarded the edit** (#495
+  review). The dialog now waits for the write: a Dashboard deleted in another tab,
+  a duplicate id, a validation rejection or a storage failure keeps the card open
+  with the typed text intact and shows one targeted message inside it. Both
+  buttons are disabled while a write is in flight, so the same rename cannot be
+  submitted twice.
+- **Creating a Dashboard from the empty-workspace placeholder said nothing when
+  the commit was rejected** (#495 review / #481). Both entry points — File ▸ New
+  dashboard… and the placeholder — now run one creation command and report
+  identically; each keeps its own "where to go afterwards" policy.
+- **Modal dialogs were invisible to assistive technology** (#495 review). The
+  shared dialog shell now marks its card `role="dialog"` with `aria-modal="true"`
+  and an `aria-labelledby` pointing at its own heading, so a screen reader is told
+  a modal opened and which one.
 - **A Dashboard variable's Run action validates its option SQL again** (#465,
   follow-up to #457). #457 moved option SQL into a `dashboard-variable` main-editor
   tab and deleted the drawer's **Test** action along with it, but nothing replaced
diff --git a/src/styles.css b/src/styles.css
index 8d738ebe..722cfbb5 100644
--- a/src/styles.css
+++ b/src/styles.css
@@ -1780,11 +1780,12 @@ body.detached-tab .graph-overlay-panel {
    `disabled` — but visibly inert, with the reason in its tooltip. */
 .dash-tree-act[aria-disabled="true"] { opacity: .4; cursor: default; }
 .dash-tree-act[aria-disabled="true"]:hover { color: var(--fg-faint); background: transparent; }
-/* Each control carries its OWN focus ring, in a channel the row does not use —
-   #472's "three independent targets" now being up to four. */
-.dash-tree-row .dash-tree-act:focus-visible {
-  outline: 2px solid var(--accent); outline-offset: -2px;
-}
+/* No custom focus ring here, deliberately: the chevron already owns the
+   `2px solid var(--accent)` outline channel, and #472 requires each of the
+   row's targets to be visibly DISTINGUISHABLE — the row rings with a
+   box-shadow, the chevron with that outline, and these keep the user agent's
+   own focus ring, which is what shipped with #429 phase 3's pencil. An e2e
+   test compares all three and fails if any two collapse into one look. */
 /* The delete CONFIRMATION, built from the shared menu primitive (ui/menu.ts) and
    anchored on the trash button. Wider than the action menu because its heading is
    a sentence stating what is lost. */
diff --git a/tests/e2e/dashboard-tree.spec.js b/tests/e2e/dashboard-tree.spec.js
index 7005d027..51b03291 100644
--- a/tests/e2e/dashboard-tree.spec.js
+++ b/tests/e2e/dashboard-tree.spec.js
@@ -223,7 +223,7 @@ test.describe('Dashboard hierarchy tree', () => {
     const tree = page.getByRole('tree', { name: 'Dashboards' });
     await expect(tree.getByRole('treeitem', { name: 'Sales revenue 2', exact: true })).toHaveCount(1);
     // No row's own name may contain a control's verb.
-    await expect(tree.getByRole('treeitem', { name: /Expand|Collapse|Actions for|Edit dashboard/ })).toHaveCount(0);
+    await expect(tree.getByRole('treeitem', { name: /Expand|Collapse|Edit dashboard|Delete dashboard/ })).toHaveCount(0);
     // The controls keep those names for themselves. The pencil is `display:
     // none` (and thus absent from the accessibility tree) until the row is
     // hovered or holds focus, like the trailing `⋯` it sits beside.
@@ -232,7 +232,7 @@ test.describe('Dashboard hierarchy tree', () => {
     await expect(tree.getByRole('button', { name: 'Edit dashboard Sales revenue' })).toHaveCount(1);
     await tree.getByRole('button', { name: 'Expand Sales revenue' }).click();
     await expect(tree.getByRole('button', { name: 'Collapse Sales revenue' })).toHaveCount(1);
-    await expect(tree.getByRole('treeitem', { name: /Expand|Collapse|Actions for|Edit dashboard/ })).toHaveCount(0);
+    await expect(tree.getByRole('treeitem', { name: /Expand|Collapse|Edit dashboard|Delete dashboard/ })).toHaveCount(0);
   });
 
   test('a Dashboard Shift-click on the name opens Edit', async ({ page }) => {
@@ -321,9 +321,8 @@ test.describe('Dashboard hierarchy tree', () => {
       const style = getComputedStyle(el);
       return {
         what: el.classList.contains('dash-tree-chev') ? 'chevron'
-          : el.classList.contains('dash-tree-rename-btn') ? 'pencil'
-            : el.classList.contains('dash-tree-menu-btn') ? 'menu'
-              : el.dataset.key ?? el.tagName,
+          : el.classList.contains('dash-tree-act') ? el.getAttribute('aria-label')
+            : el.dataset.key ?? el.tagName,
         outline: style.outlineStyle === 'none' ? 'none' : style.outlineWidth + ' ' + style.outlineStyle,
         shadow: style.boxShadow,
       };
@@ -339,9 +338,14 @@ test.describe('Dashboard hierarchy tree', () => {
     await page.keyboard.press('Tab');
     const pencil = await ring();
     await page.keyboard.press('Tab');
-    const menu = await ring();
+    const trash = await ring();
 
-    expect([row.what, chevron.what, pencil.what, menu.what]).toEqual(['workspace:sales', 'chevron', 'pencil', 'menu']);
+    // #494: the trailing target became a CLUSTER — pencil then trash, the
+    // destructive one last — and Tab reaches both inside the one composite
+    // tab stop, in paint order.
+    expect([row.what, chevron.what, pencil.what, trash.what]).toEqual([
+      'workspace:sales', 'chevron', 'Edit dashboard Sales revenue', 'Delete dashboard Sales revenue',
+    ]);
     // The row rings with a box-shadow and no outline; the chevron with an outline and
     // no shadow. Different channels, so neither reads as the other — and neither
     // trailing button matches the chevron's channel.
@@ -350,7 +354,7 @@ test.describe('Dashboard hierarchy tree', () => {
     expect(chevron.outline).toContain('solid');
     expect(chevron.shadow).toBe('none');
     expect(pencil.outline).not.toBe(chevron.outline);
-    expect(menu.outline).not.toBe(chevron.outline);
+    expect(trash.outline).not.toBe(chevron.outline);
     // Nothing was opened or expanded by walking the row.
     expect(await page.evaluate(() => window.__opened)).toEqual([]);
     await expect(page.locator('.dash-tree-row')).toHaveCount(3);
@@ -398,17 +402,20 @@ test.describe('Dashboard hierarchy tree', () => {
     expect(await page.evaluate(() => window.__opened)).toEqual([]);
   });
 
-  // #429/#472 dropped *Open in View* — it is the row's own click now — and kept
-  // *Open in Edit*, whose only gestures are the hidden Shift modifiers.
-  test('the action menu exposes the Shift-click operation to the keyboard', async ({ page }) => {
+  // #494 removed the `⋯` from every production row: a Dashboard row's last
+  // menu item was *Open in Edit*, and Shift-click / Shift+Enter remain its
+  // gestures. What replaced the menu is two real buttons.
+  test('no row renders an overflow menu, and the direct controls are real buttons', async ({ page }) => {
     await open(page);
     await roleTab(page, 'Dashboards').click();
+    await expect(page.locator('.dash-tree-menu-btn')).toHaveCount(0);
     const row = treeRow(page, 'workspace:sales');
     await row.hover();
-    await row.locator('.dash-tree-menu-btn').click();
-    await expect(page.locator('.dash-tree-menu')).toBeVisible();
-    await expect(page.locator('.dash-tree-menu .fm-label')).toHaveText(['Open in Edit']);
-    await page.locator('.dash-tree-menu .fm-item', { hasText: 'Open in Edit' }).click();
+    await expect(row.getByRole('button', { name: 'Edit dashboard Sales revenue' })).toBeVisible();
+    await expect(row.getByRole('button', { name: 'Delete dashboard Sales revenue' })).toBeVisible();
+    // Shift+Enter still opens Edit mode, unchanged by the menu's removal.
+    await row.focus();
+    await page.keyboard.press('Shift+Enter');
     await expect.poll(() => page.evaluate(() => window.__opened)).toEqual([
       { kind: 'dashboard', dashboardId: 'sales', mode: 'edit' },
     ]);
@@ -455,13 +462,12 @@ test.describe('Dashboard hierarchy tree', () => {
 // compute either.
 test.describe('Dashboard metadata pencil (#429 phase 3)', () => {
   // `display: none` (and thus unclickable/absent from the a11y tree) until the
-  // row is hovered or holds focus, like the trailing `⋯` it sits beside —
-  // every interaction here hovers the row first, matching how the existing
-  // `.dash-tree-menu-btn` tests above reach that button.
+  // row is hovered or holds focus, like every other control in #494's trailing
+  // cluster — so each interaction here hovers the row first.
   const pencil = async (page, key) => {
     const row = treeRow(page, key);
     await row.hover();
-    return row.locator('.dash-tree-rename-btn');
+    return row.locator('.dash-tree-act[aria-label^="Edit dashboard"]');
   };
   const dialog = (page) => page.locator('.fm-dialog-card');
 
@@ -470,10 +476,10 @@ test.describe('Dashboard metadata pencil (#429 phase 3)', () => {
     await roleTab(page, 'Dashboards').click();
     await (await pencil(page, 'workspace:sales')).click();
     await expect(dialog(page)).toBeVisible();
-    await expect(dialog(page).locator('#dash-rename-title')).toHaveValue('Sales revenue');
+    await expect(dialog(page).locator('#dash-rename-name')).toHaveValue('Sales revenue');
     await expect(dialog(page).locator('#dash-rename-description')).toHaveValue('');
 
-    await dialog(page).locator('#dash-rename-title').fill('Sales revenue (EMEA)');
+    await dialog(page).locator('#dash-rename-name').fill('Sales revenue (EMEA)');
     await dialog(page).locator('#dash-rename-description').fill('Quarterly figures');
     await dialog(page).getByRole('button', { name: 'Save' }).click();
     await expect(dialog(page)).toHaveCount(0);
@@ -492,13 +498,13 @@ test.describe('Dashboard metadata pencil (#429 phase 3)', () => {
     await open(page);
     await roleTab(page, 'Dashboards').click();
     await (await pencil(page, 'workspace:sales')).click();
-    await dialog(page).locator('#dash-rename-title').fill('Should not be saved');
+    await dialog(page).locator('#dash-rename-name').fill('Should not be saved');
     await page.keyboard.press('Escape');
     await expect(dialog(page)).toHaveCount(0);
     await expect(treeRow(page, 'workspace:sales').locator('.label')).toHaveText('Sales revenue');
 
     await (await pencil(page, 'workspace:sales')).click();
-    await dialog(page).locator('#dash-rename-title').fill('Should not be saved either');
+    await dialog(page).locator('#dash-rename-name').fill('Should not be saved either');
     await dialog(page).getByRole('button', { name: 'Cancel' }).click();
     await expect(dialog(page)).toHaveCount(0);
     await expect(treeRow(page, 'workspace:sales').locator('.label')).toHaveText('Sales revenue');
@@ -510,7 +516,7 @@ test.describe('Dashboard metadata pencil (#429 phase 3)', () => {
     await open(page);
     await roleTab(page, 'Dashboards').click();
     await (await pencil(page, 'workspace:sales')).click();
-    await dialog(page).locator('#dash-rename-title').fill('   ');
+    await dialog(page).locator('#dash-rename-name').fill('   ');
     await expect(dialog(page).getByRole('button', { name: 'Save' })).toBeDisabled();
     await page.keyboard.press('Escape');
     expect(await page.evaluate(() => window.__opened)).toEqual([]);
@@ -714,3 +720,156 @@ test.describe('Library → Dashboard assignment (#428)', () => {
     expect(await page.evaluate(() => window.__opened)).toEqual([]);
   });
 });
+
+/**
+ * #494/#495 — the direct action cluster in a REAL browser.
+ *
+ * Everything here is real-browser-only on purpose: the controls are
+ * `display: none` until hover/`:focus-within` (so happy-dom, which enforces no
+ * CSS at all, cannot tell an unreachable control from a reachable one), native
+ * Enter/Space activation is a browser behaviour rather than a DOM API, and
+ * `getByRole` is the only cross-engine way to read an accessible name.
+ */
+test.describe('direct row actions (#494)', () => {
+  const act = async (page, key, name) => {
+    const row = treeRow(page, key);
+    await row.hover();
+    return row.getByRole('button', { name });
+  };
+
+  test('Enter on the pencil opens exactly one dialog and does NOT open the Dashboard', async ({ page }) => {
+    await open(page);
+    await roleTab(page, 'Dashboards').click();
+    // Tab to the pencil the way a keyboard user reaches it — row, chevron,
+    // pencil — rather than calling `.click()`, which is what let the #495
+    // review defect through: the tree's own Enter handler runs on the LIST and
+    // would otherwise navigate instead.
+    await treeRow(page, 'workspace:sales').focus();
+    await page.keyboard.press('Tab');
+    await page.keyboard.press('Tab');
+    await expect(treeRow(page, 'workspace:sales')
+      .getByRole('button', { name: 'Edit dashboard Sales revenue' })).toBeFocused();
+    await page.keyboard.press('Enter');
+    await expect(page.getByRole('dialog', { name: 'Edit dashboard' })).toBeVisible();
+    await expect(page.locator('.fm-dialog-card')).toHaveCount(1);
+    expect(await page.evaluate(() => window.__opened)).toEqual([]);
+    await page.keyboard.press('Escape');
+  });
+
+  test('Space on the pencil behaves the same, and neither navigates', async ({ page }) => {
+    await open(page);
+    await roleTab(page, 'Dashboards').click();
+    await treeRow(page, 'workspace:sales').focus();
+    await page.keyboard.press('Tab');
+    await page.keyboard.press('Tab');
+    await page.keyboard.press('Space');
+    await expect(page.locator('.fm-dialog-card')).toHaveCount(1);
+    expect(await page.evaluate(() => window.__opened)).toEqual([]);
+    await page.keyboard.press('Escape');
+  });
+
+  test('the dialog announces itself as a modal named by its heading', async ({ page }) => {
+    await open(page);
+    await roleTab(page, 'Dashboards').click();
+    await (await act(page, 'workspace:sales', 'Edit dashboard Sales revenue')).click();
+    const dialog = page.getByRole('dialog', { name: 'Edit dashboard' });
+    await expect(dialog).toBeVisible();
+    await expect(dialog).toHaveAttribute('aria-modal', 'true');
+    await page.keyboard.press('Escape');
+  });
+
+  test('a panel row exposes a pencil and a trash that name the panel', async ({ page }) => {
+    await open(page);
+    await roleTab(page, 'Dashboards').click();
+    await treeRow(page, 'workspace:sales').locator('.chev').click();
+    await treeRow(page, 'workspace:sales:group:panels').click();
+    const row = treeRow(page, 'workspace:sales:tile:t-rev');
+    await row.hover();
+    await expect(row.getByRole('button', { name: 'Edit Revenue' })).toBeVisible();
+    await expect(row.getByRole('button', { name: 'Remove Revenue from dashboard' })).toBeVisible();
+    // The row's own announcement stays ITS own — nested control labels are not
+    // folded into the treeitem's accessible name.
+    await expect(page.getByRole('treeitem', { name: 'Revenue', exact: true })).toHaveCount(1);
+  });
+
+  test('the panel pencil edits the owned query and the tree label follows', async ({ page }) => {
+    await open(page);
+    await roleTab(page, 'Dashboards').click();
+    await treeRow(page, 'workspace:sales').locator('.chev').click();
+    await treeRow(page, 'workspace:sales:group:panels').click();
+    await (await act(page, 'workspace:sales:tile:t-rev', 'Edit Revenue')).click();
+    const dialog = page.getByRole('dialog', { name: 'Edit panel' });
+    await expect(dialog).toBeVisible();
+    await dialog.locator('#panel-metadata-name').fill('Revenue by region');
+    await dialog.getByRole('button', { name: 'Save' }).click();
+    await expect(dialog).toHaveCount(0);
+    await expect(treeRow(page, 'workspace:sales:tile:t-rev').locator('.label'))
+      .toHaveText('Revenue by region');
+    // Committed, not merely painted.
+    await expect.poll(async () => {
+      const committed = await page.evaluate(() => window.__committed());
+      return committed.queries.find((query) => query.id === 'q-rev').spec.name;
+    }).toBe('Revenue by region');
+  });
+
+  // #494: "narrow sidebar layout must preserve the label's usable width and
+  // ellipsis rather than overlapping or wrapping the controls". Two revealed
+  // buttons per row is one more than #429 phase 3 had, and happy-dom can see
+  // none of this — only a real layout can.
+  test('a long title still ellipsizes with the cluster revealed, and nothing overlaps', async ({ page }) => {
+    await open(page, 900);
+    await roleTab(page, 'Dashboards').click();
+    const row = treeRow(page, 'workspace:long');
+    await row.hover();
+    const box = await page.evaluate(() => {
+      const el = document.querySelector('.dash-tree-row[data-key="workspace:long"]');
+      const label = el.querySelector('.label');
+      const acts = [...el.querySelectorAll('.dash-tree-act')];
+      const list = document.querySelector('.dash-tree-list');
+      const listBox = list.getBoundingClientRect();
+      const labelBox = label.getBoundingClientRect();
+      return {
+        actCount: acts.length,
+        // The label is clipped, not wrapped: one line, and narrower than its
+        // own content.
+        lines: Math.round(labelBox.height),
+        clipped: label.scrollWidth > label.clientWidth,
+        // No control sits on top of the label…
+        overlap: acts.some((act) => act.getBoundingClientRect().left < labelBox.right - 0.5),
+        // …and, the assertion that actually bites: the label SHRINKS to make
+        // room, so both controls stay inside the visible pane instead of being
+        // pushed off its right edge where nothing can reach them.
+        spilled: acts.filter((act) => act.getBoundingClientRect().right > listBox.right + 0.5).length,
+        rowOverflow: el.scrollWidth - list.clientWidth,
+      };
+    });
+    expect(box.actCount).toBe(2);
+    expect(box.lines).toBeLessThanOrEqual(24);
+    expect(box.clipped).toBe(true);
+    expect(box.overlap).toBe(false);
+    expect(box.spilled).toBe(0);
+    expect(box.rowOverflow).toBeLessThanOrEqual(0);
+  });
+
+  test('the panel trash confirms, then removes the tile and its owned query', async ({ page }) => {
+    await open(page);
+    await roleTab(page, 'Dashboards').click();
+    await treeRow(page, 'workspace:sales').locator('.chev').click();
+    await treeRow(page, 'workspace:sales:group:panels').click();
+    await (await act(page, 'workspace:sales:tile:t-cost', 'Remove Cost from dashboard')).click();
+    // A confirmation naming both resources, not an immediate delete.
+    await expect(page.locator('.dash-tree-confirm .fm-section'))
+      .toHaveText('Remove panel “Cost” from “Sales revenue”? This also deletes its dedicated query copy.');
+    await page.locator('.dash-tree-confirm .fm-item', { hasText: 'Remove panel' }).click();
+    await expect(treeRow(page, 'workspace:sales:tile:t-cost')).toHaveCount(0);
+    await expect.poll(async () => {
+      const committed = await page.evaluate(() => window.__committed());
+      return {
+        tiles: committed.dashboards.find((d) => d.id === 'sales').tiles.map((t) => t.id),
+        queries: committed.queries.map((q) => q.id).sort(),
+      };
+    }).toEqual({ tiles: ['t-rev'], queries: ['q-lib', 'q-rev'] });
+    // Focus did not vanish with the row it was standing on.
+    await expect(page.locator('.dash-tree-list')).toContainText('Revenue');
+  });
+});

From f058150512b326866cb9ed95723ccf3391cb6cec Mon Sep 17 00:00:00 2001
From: Boris Tyshkevich <btyshkevich@altinity.com>
Date: Mon, 27 Jul 2026 13:28:16 +0000
Subject: [PATCH 4/8] fix(#494): keep focus with the user across dialogs,
 deletes and confirmations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two independent review passes over the branch found one regression and one
contract that no test could fail on. Both are fixed here.

**Focus was lost to `<body>` after a successful metadata commit.** #495's
review-2 fix made the dialog close only once the write ANSWERS — but that write
repaints the tree first, so the trigger button the dialog captured at open time
is detached by the time focus is handed back, and `focus()` on a detached node
is a silent no-op. `renderDashboardTree`'s own restore deliberately declines to
help, because focus was inside the body-mounted dialog rather than in the list.
`returnFocusTo` now also accepts a resolver called at CLOSE time: the trigger
while it is still on screen (Cancel/Escape, where nothing repainted), else the
row, re-resolved by key. Sabotage-checked.

**Deleting a Dashboard stranded focus the same way** — only the panel delete
placed it. Both now do, and when the last Dashboard goes there is no row left
to stand on, so focus lands on the tree's own search box.

**A destructive confirmation opened with the destructive item focused.**
`openMenu` autofocuses its first row, which for a confirmation means an Enter
pressed out of momentum deletes a Dashboard. It takes an `initialFocus` hint
now, and confirmations pass `'last'` — Cancel.

**An UNAVAILABLE delete stopped looking like one**: `destructive` was derived
from `act.confirm`, which the model nulls for an action it will never ask about,
so a malformed-ownership trash lost its destructive styling and announced
`aria-haspopup="dialog"`. It comes from the action's KIND now.

**Cancel stays operable while a write is in flight.** Only the confirm is
barred (that is what prevents a double submit); Escape and the backdrop were
never gated, so a visibly dead Cancel just read as a wedged dialog.

Tests that could not fail, now able to: the same-row `cancelFor` (all three
existing tests only exercised the other-row half, so deleting the call left the
suite green), the pencil/trash glyph mapping (swapping the icons passed
everything), two `not.toBe('')` assertions that also pass on a missing
attribute, and the e2e post-delete focus check, which asserted row text rather
than `document.activeElement`. A keyboard-driven delete now proves the whole
path in a real browser, including that the landing row is `:focus-visible`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018mujm1kW7jDGpTEfscndcU
---
 src/ui/dashboard-tree.ts          |  72 ++++++++++++++-----
 src/ui/dialog-shell.ts            |  35 ++++++---
 src/ui/menu.ts                    |  16 ++++-
 tests/e2e/dashboard-tree.spec.js  |  44 +++++++++++-
 tests/unit/dashboard-tree.test.ts | 113 ++++++++++++++++++++++++++++--
 tests/unit/dialog-shell.test.ts   |  17 ++++-
 6 files changed, 259 insertions(+), 38 deletions(-)

diff --git a/src/ui/dashboard-tree.ts b/src/ui/dashboard-tree.ts
index 07863c6a..3898183f 100644
--- a/src/ui/dashboard-tree.ts
+++ b/src/ui/dashboard-tree.ts
@@ -824,7 +824,11 @@ function pressRow(app: DashboardTreeApp, row: DashboardTreeRow, shift: boolean):
 function buildActionButton(
   app: DashboardTreeApp, doc: Document, row: DashboardTreeRow, act: DashboardTreeAction,
 ): HTMLElement {
-  const destructive = act.confirm !== null;
+  // From the KIND, never from `act.confirm`: an UNAVAILABLE delete still has
+  // to look and announce like a delete (#494 — a row's vocabulary must not
+  // change with availability), and its `confirm` is null precisely because it
+  // will never be asked.
+  const destructive = act.kind !== 'edit-dashboard' && act.kind !== 'edit-panel';
   const trigger: HTMLButtonElement = h('button', {
     class: 'dash-tree-act'
       + (destructive ? ' dash-tree-act-danger' : '')
@@ -839,6 +843,7 @@ function buildActionButton(
     'aria-expanded': 'false',
     'aria-label': act.label,
     title: act.tooltip,
+    'data-act': act.kind,
     ...(act.unavailable === null ? {} : { 'aria-disabled': 'true' }),
     onkeydown: isolateActivationKeys,
     onclick: (event: MouseEvent) => {
@@ -852,6 +857,26 @@ function buildActionButton(
   return trigger;
 }
 
+/**
+ * Where a dialog opened from a row control hands focus back.
+ *
+ * The trigger while it is still on screen — the Cancel/Escape paths, where
+ * nothing repainted. But a SUCCESSFUL commit repaints the tree before the
+ * dialog closes (the write projects synchronously, and the tree's effect
+ * rebuilds every row), which detaches that button; `renderDashboardTree`'s own
+ * restore deliberately declines to help, because focus was inside the
+ * body-mounted dialog rather than in the list. So the fallback is the ROW,
+ * re-resolved by key: it is what the freshly painted control belongs to, and
+ * unlike the rebuilt control it is not hidden behind hover/`:focus-within`.
+ */
+const returnFocusAfterDialog = (
+  app: DashboardTreeApp, trigger: HTMLButtonElement, rowKey: string,
+) => (): HTMLElement | null => (trigger.isConnected
+  ? trigger
+  : app.dom.dashboardTreeList?.querySelector<HTMLElement>(
+    '[data-key="' + CSS.escape(rowKey) + '"]',
+  ) ?? null);
+
 /** The confirm menu's own go-ahead label, per action. Short and specific: the
  *  question above it already named the resource, and "OK" next to a sentence
  *  full of names is where a destructive click gets made by accident. */
@@ -900,6 +925,10 @@ function confirmDestructive(
     document: doc,
     trigger,
     menuClass: 'dash-tree-confirm',
+    // Cancel, not the destructive item: this menu exists to interpose a
+    // deliberate second act, and `openMenu`'s default first-row focus would
+    // put an out-of-momentum Enter straight through it.
+    initialFocus: 'last',
     rows: [
       { kind: 'section', label: act.confirm! },
       {
@@ -930,15 +959,14 @@ function runDestructive(
     void commitVariableConfig(app, target.dashboardId, target.name, null);
     return;
   }
-  if (act.kind === 'delete-dashboard') {
-    void reportRemoval(app, doc, commitDashboardRemoval(app, target.dashboardId));
-    return;
-  }
-  const panel = target as PanelActionTarget;
   // Decided BEFORE the commit, against the rows currently painted: once the
   // write lands, the row this focus decision is relative to no longer exists.
   const successor = focusSuccessorKey(app, row);
-  void reportRemoval(app, doc, commitPanelRemoval(app, panel), successor);
+  if (act.kind === 'delete-dashboard') {
+    void reportRemoval(app, doc, commitDashboardRemoval(app, target.dashboardId), successor);
+    return;
+  }
+  void reportRemoval(app, doc, commitPanelRemoval(app, target as PanelActionTarget), successor);
 }
 
 /**
@@ -972,7 +1000,7 @@ function openDashboardMetadataDialog(
     description: current?.description ?? '',
     confirmLabel: 'Save',
     idPrefix: 'dash-rename',
-    returnFocusTo: trigger,
+    returnFocusTo: returnFocusAfterDialog(app, trigger, row.key),
     onClose: () => trigger.setAttribute('aria-expanded', 'false'),
     onConfirm: async ({ name, description }) =>
       renameMessage(await commitDashboardRename(app, row.dashboardId, name, description)),
@@ -1031,7 +1059,7 @@ function openPanelMetadataDialog(
     note: overridden
       ? 'This tile was imported with its own title, which keeps priority over the query name here.'
       : null,
-    returnFocusTo: trigger,
+    returnFocusTo: returnFocusAfterDialog(app, trigger, row.key),
     onClose: () => trigger.setAttribute('aria-expanded', 'false'),
     onConfirm: async ({ name, description }) => panelMetadataMessage(
       await commitPanelQueryMetadata(panelMetadataDeps(app), target, name, description),
@@ -1074,15 +1102,26 @@ const panelMetadataMessage = (outcome: PanelMetadataOutcome): string | null => {
  */
 async function reportRemoval(
   app: DashboardTreeApp, doc: Document,
-  pending: Promise<DashboardDeleteOutcome>, successorKey?: string,
+  pending: Promise<DashboardDeleteOutcome>, successorKey: string | null,
 ): Promise<void> {
   const outcome = await pending;
   const message = dashboardDeleteMessage(outcome);
   if (message !== null) flashToast(message, { document: doc });
-  if (!outcome.ok || successorKey === undefined) return;
+  if (!outcome.ok) return;
   // The commit reprojected and repainted the tree already, so this addresses
   // rows that exist NOW.
-  moveTo(app, successorKey);
+  //
+  // Focus is NOT optional here. The confirmation's own menu closes by removing
+  // the item that was just activated, without restoring the trigger — and the
+  // trigger is on its way out with the row anyway — so at this moment DOM focus
+  // is on `<body>`. `renderDashboardTree`'s own restore is deliberately
+  // conditional on the tree ALREADY holding focus, so it will not step in.
+  // Without this, deleting from the keyboard drops the user at the top of the
+  // page with no ring anywhere.
+  if (successorKey !== null) { moveTo(app, successorKey); return; }
+  // Nothing is left to stand on (the last Dashboard just went): the search box
+  // is the tree's own always-present landing spot.
+  app.dom.dashboardSearchInput?.focus();
 }
 
 /**
@@ -1094,16 +1133,17 @@ async function reportRemoval(
  * focus must not jump to a row the user cannot see. A row whose parent group
  * is collapsed is not painted at all, so the parent key is the floor.
  */
-function focusSuccessorKey(app: DashboardTreeApp, row: DashboardTreeRow): string {
+function focusSuccessorKey(app: DashboardTreeApp, row: DashboardTreeRow): string | null {
   const painted = app._dashTreeRows ?? [];
   const index = painted.findIndex((candidate) => candidate.key === row.key);
   const sibling = (candidate: DashboardTreeRow): boolean => candidate.parentKey === row.parentKey;
   const after = painted.slice(index + 1).find(sibling);
   if (after !== undefined) return after.key;
   const before = painted.slice(0, index).reverse().find(sibling);
-  // A panel row always HAS a parent group — it is level 3 by construction — so
-  // the fallback is never the empty string in practice.
-  return before?.key ?? row.parentKey!;
+  // A panel row always has a parent group to fall back to; a DASHBOARD row is
+  // top-level, so when it was the last one there is no row left at all — the
+  // tree paints its empty state, and the caller sends focus elsewhere.
+  return before?.key ?? row.parentKey;
 }
 
 // A positive guard, not an early `return`: `clampKeyboardRow` has already made the
diff --git a/src/ui/dialog-shell.ts b/src/ui/dialog-shell.ts
index dabf5f7b..7a6b1c9a 100644
--- a/src/ui/dialog-shell.ts
+++ b/src/ui/dialog-shell.ts
@@ -32,13 +32,22 @@ export interface DialogHostApp {
 
 export interface OpenDialogShellOpts {
   extraCardClass?: string;
-  /** Element to return focus to when the dialog closes — `null` when there is
-   *  nothing to remember (the trigger is already gone by the time the dialog
-   *  mounts, as with a File-menu row: `openMenu` closes the row's menu before
-   *  running the click). `focus()` on a since-detached element is a harmless
-   *  no-op, so a caller may pass its own trigger button without re-checking
-   *  it is still attached. */
-  returnFocusTo: HTMLElement | null;
+  /**
+   * Where focus goes when the dialog closes — `null` when there is nothing to
+   * remember (the trigger is already gone by the time the dialog mounts, as
+   * with a File-menu row: `openMenu` closes the row's menu before running the
+   * click).
+   *
+   * Pass a FUNCTION when the trigger may not survive the dialog. Since #495
+   * review 2 a metadata dialog closes only after its write ANSWERS, and that
+   * write repaints the surface underneath — so the button captured at open
+   * time is detached by the time focus is handed back, and `focus()` on a
+   * detached element is a silent no-op that strands the keyboard on `<body>`.
+   * A resolver is called at CLOSE time, so it can hand back whatever is on
+   * screen now. An element (or a resolver answering one) that is merely
+   * detached is still harmless — it just does nothing.
+   */
+  returnFocusTo: HTMLElement | (() => HTMLElement | null) | null;
   /** Runs on every close path (Escape, outside-click, and whatever the caller's
    *  own content wires up) — AFTER `returnFocusTo` is focused, never before. A
    *  trigger that is only revealed on hover/`:focus-within` (the Dashboard-tree
@@ -83,7 +92,8 @@ export function openDialogShell(
     if (openHandle?.backdrop === backdrop) openHandle = null;
     backdrop.remove();
     releaseKeyboard();
-    opts.returnFocusTo?.focus();
+    const restore = typeof opts.returnFocusTo === 'function' ? opts.returnFocusTo() : opts.returnFocusTo;
+    restore?.focus();
     opts.onClose?.();
   };
   /** Everything inside the card a Tab can land on, in DOM order. Disabled
@@ -153,7 +163,7 @@ export interface MetadataDialogOpts {
    *  case: the query name is editable, but the tile keeps rendering its own
    *  imported title, and a dialog that said nothing would look broken. */
   note?: string | null;
-  returnFocusTo: HTMLElement | null;
+  returnFocusTo: OpenDialogShellOpts['returnFocusTo'];
   onClose?: () => void;
   /**
    * Commit the edit. Resolve `null` when it succeeded — the dialog closes —
@@ -206,8 +216,13 @@ export function openMetadataDialog(app: DialogHostApp, opts: MetadataDialogOpts)
   let closed = false;
   let inFlight = false;
   const sync = (): void => {
+    // Only the CONFIRM is barred while a write is in flight — that is what
+    // stops the same mutation being submitted twice. Cancel stays operable, so
+    // the visible way out agrees with Escape and the backdrop, which were never
+    // gated; a dialog whose only escape hatches are invisible reads as wedged.
+    // Closing mid-write is safe: the late answer is dropped below rather than
+    // written into a detached card.
     confirm.disabled = inFlight || nameInput.value.trim() === '';
-    cancel.disabled = inFlight;
   };
   const commit = async (): Promise<void> => {
     const name = nameInput.value.trim();
diff --git a/src/ui/menu.ts b/src/ui/menu.ts
index ddf61102..d9c76ea8 100644
--- a/src/ui/menu.ts
+++ b/src/ui/menu.ts
@@ -61,6 +61,17 @@ export interface MenuOptions {
    *  lets the caller clear its own open/closed bookkeeping. */
   onClose?: () => void;
   onKeyboardOwnerChange?: (owner: KeyboardOwner | null) => void;
+  /**
+   * Which focusable row takes focus when the menu opens. Defaults to the
+   * FIRST, which is right for a menu of ordinary operations — a keyboard user
+   * arrives on the thing they most likely came for.
+   *
+   * A destructive CONFIRMATION inverts that: its whole purpose is to interpose
+   * a deliberate second act, and landing on "Delete" means an Enter pressed
+   * out of momentum — the reflex right after opening any other menu — destroys
+   * something. Those pass `'last'`, which is Cancel.
+   */
+  initialFocus?: 'first' | 'last';
 }
 
 export interface MenuHandle {
@@ -184,7 +195,10 @@ export function openMenu(opts: MenuOptions): MenuHandle {
   menu.style.top = a.top + 'px';
   menu.style.left = a.left + 'px';
   doc.addEventListener('keydown', onKey, true);
-  if (focusable.length) setTimeout(() => focusable[0].focus());
+  if (focusable.length) {
+    const initial = opts.initialFocus === 'last' ? focusable[focusable.length - 1] : focusable[0];
+    setTimeout(() => initial.focus());
+  }
 
   const handle: MenuHandle = { el: menu, close };
   openByTrigger.set(trigger, handle);
diff --git a/tests/e2e/dashboard-tree.spec.js b/tests/e2e/dashboard-tree.spec.js
index 51b03291..1a4f9054 100644
--- a/tests/e2e/dashboard-tree.spec.js
+++ b/tests/e2e/dashboard-tree.spec.js
@@ -812,11 +812,45 @@ test.describe('direct row actions (#494)', () => {
     }).toBe('Revenue by region');
   });
 
+  // #494's Browser-accessibility section asks for REAL keyboard events, not
+  // `.click()` substitutes — and the ring is the half a mouse-driven test
+  // cannot show, because Chromium withholds `:focus-visible` after a pointer
+  // interaction.
+  test('a keyboard-driven panel delete leaves focus on a VISIBLY ringed row', async ({ page }) => {
+    await open(page);
+    await roleTab(page, 'Dashboards').click();
+    await treeRow(page, 'workspace:sales').locator('.chev').click();
+    await treeRow(page, 'workspace:sales:group:panels').click();
+
+    // Walk to the first panel row's trash with real keys: row → pencil → trash.
+    await treeRow(page, 'workspace:sales:tile:t-rev').focus();
+    await page.keyboard.press('Tab');
+    await page.keyboard.press('Tab');
+    await expect(treeRow(page, 'workspace:sales:tile:t-rev')
+      .getByRole('button', { name: 'Remove Revenue from dashboard' })).toBeFocused();
+    await page.keyboard.press('Enter');
+
+    // The confirmation opens on CANCEL, so an Enter pressed out of momentum
+    // cannot delete anything; the destructive item is one step away.
+    await expect(page.locator('.dash-tree-confirm .fm-item', { hasText: 'Cancel' })).toBeFocused();
+    await page.keyboard.press('ArrowUp');
+    await expect(page.locator('.dash-tree-confirm .fm-item', { hasText: 'Remove panel' })).toBeFocused();
+    await page.keyboard.press('Enter');
+
+    await expect(treeRow(page, 'workspace:sales:tile:t-rev')).toHaveCount(0);
+    const landed = await page.evaluate(() => ({
+      key: document.activeElement?.dataset?.key ?? document.activeElement?.tagName,
+      ringed: document.activeElement?.matches(':focus-visible') ?? false,
+    }));
+    expect(landed.key).toMatch(/:tile:t-cost$/);
+    expect(landed.ringed).toBe(true);
+  });
+
   // #494: "narrow sidebar layout must preserve the label's usable width and
   // ellipsis rather than overlapping or wrapping the controls". Two revealed
   // buttons per row is one more than #429 phase 3 had, and happy-dom can see
   // none of this — only a real layout can.
-  test('a long title still ellipsizes with the cluster revealed, and nothing overlaps', async ({ page }) => {
+  test('a long title still ellipsizes in a narrow pane with the cluster revealed', async ({ page }) => {
     await open(page, 900);
     await roleTab(page, 'Dashboards').click();
     const row = treeRow(page, 'workspace:long');
@@ -869,7 +903,11 @@ test.describe('direct row actions (#494)', () => {
         queries: committed.queries.map((q) => q.id).sort(),
       };
     }).toEqual({ tiles: ['t-rev'], queries: ['q-lib', 'q-rev'] });
-    // Focus did not vanish with the row it was standing on.
-    await expect(page.locator('.dash-tree-list')).toContainText('Revenue');
+    // Focus did not vanish with the row it was standing on: the surviving
+    // sibling panel row holds it, with a visible ring. `toContainText` would
+    // have passed with focus on `<body>`.
+    const landed = await page.evaluate(() =>
+      document.activeElement?.dataset?.key ?? document.activeElement?.tagName);
+    expect(landed).toMatch(/:tile:t-rev$/);
   });
 });
diff --git a/tests/unit/dashboard-tree.test.ts b/tests/unit/dashboard-tree.test.ts
index ec866e35..45bd8628 100644
--- a/tests/unit/dashboard-tree.test.ts
+++ b/tests/unit/dashboard-tree.test.ts
@@ -5,6 +5,7 @@ import {
 import { LIBRARY_QUERY_MIME } from '../../src/ui/dnd-mime.js';
 import type { DashboardTreeApp } from '../../src/ui/dashboard-tree.js';
 import { buildSidebarUpper } from '../../src/ui/sidebar-upper.js';
+import { Icon } from '../../src/ui/icons.js';
 import { makeApp } from '../helpers/fake-app.js';
 import {
   EMPTY_TREE_UI, groupStateKey, readTreeUi, setTreeSearch, toggleDashboardExpanded,
@@ -709,9 +710,6 @@ describe('renderDashboardTree — direct row actions (#494)', () => {
     renderDashboardTree(fixture.app);
     return fixture;
   };
-  const confirmItems = (): HTMLElement[] =>
-    [...document.querySelectorAll<HTMLElement>('.dash-tree-confirm .fm-item')];
-
   it('renders no overflow menu on ANY row, and no menu markup at all', () => {
     const { list } = open();
     expect(list.querySelectorAll('.dash-tree-menu-btn')).toHaveLength(0);
@@ -742,8 +740,12 @@ describe('renderDashboardTree — direct row actions (#494)', () => {
     for (const button of rowFor(list, 'w1:sales:tile:t1').querySelectorAll<HTMLButtonElement>('.dash-tree-act')) {
       expect(button.tagName).toBe('BUTTON');
       expect(button.type).toBe('button');
-      expect(button.getAttribute('aria-label')).not.toBe('');
-      expect(button.getAttribute('title')).not.toBe('');
+      // `not.toBe('')` would also pass on a MISSING attribute; these are the
+      // exact strings the model composed.
+      expect(button.getAttribute('aria-label')).toMatch(/^(Edit|Remove) Revenue/);
+      expect(button.getAttribute('title')).toBe(
+        button.dataset.act === 'edit-panel' ? 'Edit name & description' : 'Remove panel',
+      );
       expect(button.getAttribute('aria-expanded')).toBe('false');
     }
     expect(actionBtn(list, 'w1:sales:tile:t1', 'Edit Revenue')!.getAttribute('aria-haspopup'))
@@ -760,6 +762,24 @@ describe('renderDashboardTree — direct row actions (#494)', () => {
       .toBe(true);
   });
 
+  it('keeps a delete looking and announcing like a delete even when it is unavailable', () => {
+    // #494: a row's vocabulary must not change with availability. The
+    // confirmation is what an unavailable action loses, not its identity.
+    const { list } = open();
+    const trash = actionBtn(list, 'w1:sales:tile:t-broken', 'Remove Untitled panel from dashboard')!;
+    expect(trash.classList.contains('dash-tree-act-danger')).toBe(true);
+    expect(trash.getAttribute('aria-haspopup')).toBe('menu');
+  });
+
+  it('paints the pencil glyph on edit and the trash glyph on delete', () => {
+    const { list } = open();
+    // Swapping the two icons would otherwise pass every other assertion here.
+    expect(actionBtn(list, 'w1:sales', 'Edit dashboard Sales')!.innerHTML)
+      .toBe(Icon.pencil().outerHTML);
+    expect(actionBtn(list, 'w1:sales', 'Delete dashboard Sales')!.innerHTML)
+      .toBe(Icon.trash().outerHTML);
+  });
+
   // A panel whose query cannot be proven to be its own: the controls stay, so
   // the row's vocabulary does not silently shrink, but they are inert and say
   // why. `t-broken` references a query this workspace does not carry.
@@ -786,6 +806,22 @@ describe('renderDashboardTree — direct row actions (#494)', () => {
     expect(committed).toEqual([]);
   });
 
+  it('cancels its OWN row\'s pending single — the click that armed it must not fire behind the dialog', () => {
+    vi.useFakeTimers();
+    const { app, list } = open();
+    // Arm a pending `open-query` on the panel row (a panel row arbitrates,
+    // because it has a double-click action)…
+    click(rowFor(list, 'w1:sales:tile:t1'));
+    // …then press THAT SAME row's own control inside the ~300ms window.
+    click(actionBtn(list, 'w1:sales:tile:t1', 'Edit Revenue')!);
+    vi.advanceTimersByTime(400);
+    // Without the `cancelFor`, the deferred single fires a third of a second
+    // later and navigates the surface out from under the dialog just opened.
+    expect(app.openSavedQuery).not.toHaveBeenCalled();
+    expect(document.querySelectorAll('.fm-dialog-card')).toHaveLength(1);
+    vi.useRealTimers();
+  });
+
   it('an action never expands, never navigates, and cancels no other row\'s pending click', () => {
     vi.useFakeTimers();
     const { app, list } = open();
@@ -980,7 +1016,10 @@ describe('renderDashboardTree — panel metadata pencil (#494)', () => {
     app.mutateWorkspace = (async (transform) => {
       const latest = workspace() as unknown as StoredWorkspaceV5;
       latest.dashboards[0].tiles = [];
-      return transform(latest) === null ? { ok: false, aborted: true } : { ok: false, aborted: true };
+      // The transform is still RUN, so its dequeue-time guard is exercised;
+      // it refuses, and the outcome is the abort that refusal produces.
+      await transform(latest);
+      return { ok: false, aborted: true };
     }) as App['mutateWorkspace'];
     click(pencil(list));
     nameInput().value = 'Kept';
@@ -993,6 +1032,34 @@ describe('renderDashboardTree — panel metadata pencil (#494)', () => {
       .toBe('That panel is no longer part of this dashboard.');
   });
 
+  it('lands focus on the ROW when a successful commit repainted the trigger away', async () => {
+    // #495 review 2 made the dialog close only after the write answers — and
+    // that write repaints the tree, detaching the button the dialog captured.
+    // `focus()` on a detached node is a silent no-op, which used to strand the
+    // keyboard on `<body>`.
+    const fixture = treeApp();
+    fixture.app.state.savedQueries = [query('q1', 'Revenue')];
+    // The production ordering, which the plain fixture does not reproduce: the
+    // commit projects and REPAINTS before it resolves, so by the time the
+    // dialog closes the button it captured is gone.
+    const inner = fixture.app.mutateWorkspace;
+    fixture.app.mutateWorkspace = (async (transform) => {
+      const outcome = await inner(transform);
+      renderDashboardTree(fixture.app);
+      return outcome;
+    }) as App['mutateWorkspace'];
+    openAll(fixture.app, 'sales');
+    renderDashboardTree(fixture.app);
+    const trigger = actionBtn(fixture.list, 'w1:sales:tile:t1', 'Edit Revenue')!;
+    click(trigger);
+    nameInput().value = 'Renamed';
+    nameInput().dispatchEvent(new Event('input', { bubbles: true }));
+    save().click();
+    await settle();
+    expect(trigger.isConnected).toBe(false);
+    expect(document.activeElement).toBe(rowFor(fixture.list, 'w1:sales:tile:t1'));
+  });
+
   it('keeps the trigger revealed for the dialog\'s whole lifetime', () => {
     const { list } = open();
     const trigger = pencil(list);
@@ -1095,6 +1162,40 @@ describe('renderDashboardTree — Dashboard trash (#494)', () => {
     expect(readTreeUi(app.state.dashboardTreeUi, 'w1').expandedDashboardIds.size).toBe(0);
   });
 
+  it('moves keyboard focus to the next Dashboard row, and to the search box when none is left', async () => {
+    const { app, list } = open();
+    click(trash(list));
+    click(confirmItems()[0]);
+    await settle();
+    // The confirmation's own menu closed by removing the item that was just
+    // activated, and the trigger went with the row — so without an explicit
+    // placement here, focus would be on `<body>`.
+    expect(readTreeUi(app.state.dashboardTreeUi, 'w1').keyboardRowKey).toBe('w1:ops');
+
+    // …and when the LAST Dashboard goes, there is no row to stand on at all.
+    const only = treeApp();
+    (only.app.currentWorkspace as unknown as TreeWorkspace).dashboards = [
+      { id: 'sales', title: 'Sales', tiles: [] },
+    ];
+    renderDashboardTree(only.app);
+    click(actionBtn(only.list, 'w1:sales', 'Delete dashboard Sales')!);
+    click(confirmItems()[0]);
+    await settle();
+    expect(document.activeElement).toBe(only.app.dom.dashboardSearchInput);
+  });
+
+  it('a destructive confirmation lands on Cancel, not on the destructive item', () => {
+    vi.useFakeTimers();
+    const { list } = open();
+    click(trash(list));
+    // `openMenu` autofocuses its first focusable row by default; a
+    // confirmation exists to interpose a deliberate act, so an Enter pressed
+    // out of momentum must not delete a Dashboard.
+    vi.advanceTimersByTime(10);
+    expect(document.activeElement!.textContent).toBe('Cancel');
+    vi.useRealTimers();
+  });
+
   it('reports a rejected commit', async () => {
     const mutateWorkspace = vi.fn(async () => ({
       ok: false,
diff --git a/tests/unit/dialog-shell.test.ts b/tests/unit/dialog-shell.test.ts
index 420f63b9..ca04b0ea 100644
--- a/tests/unit/dialog-shell.test.ts
+++ b/tests/unit/dialog-shell.test.ts
@@ -279,21 +279,34 @@ describe('openMetadataDialog', () => {
     expect(document.activeElement).toBe(nameInput());
   });
 
-  it('disables both actions while a commit is in flight, so the same write cannot be submitted twice', async () => {
+  it('bars a SECOND submit while the first is in flight, but leaves the way out open', async () => {
     let release = (): void => {};
     const onConfirm = vi.fn(() => new Promise<string | null>((resolve) => { release = () => resolve(null); }));
     open(onConfirm);
     save().click();
     expect(save().disabled).toBe(true);
-    expect(cancelBtn().disabled).toBe(true);
     save().click();
     key(nameInput(), 'Enter');
     expect(onConfirm).toHaveBeenCalledTimes(1);
+    // Cancel is NOT disabled: Escape and the backdrop were never gated, and a
+    // visible button that dies with no explanation reads as a wedged dialog.
+    expect(cancelBtn().disabled).toBe(false);
     release();
     await settle();
     expect(backdropOf()).toBeNull();
   });
 
+  it('a Cancel taken mid-write closes, and the late answer is dropped', async () => {
+    let release = (message: string | null): void => { void message; };
+    open(() => new Promise<string | null>((resolve) => { release = resolve; }));
+    save().click();
+    cancelBtn().click();
+    expect(backdropOf()).toBeNull();
+    release('Storage is full');
+    await settle();
+    expect(backdropOf()).toBeNull();
+  });
+
   it('drops a late answer for a dialog that was force-closed while the write was queued', async () => {
     let release = (message: string | null): void => { void message; };
     open(() => new Promise<string | null>((resolve) => { release = resolve; }));

From fd6341ffc129e7d396a399f9b5d1b2fedbecf72e Mon Sep 17 00:00:00 2001
From: Boris Tyshkevich <btyshkevich@altinity.com>
Date: Mon, 27 Jul 2026 14:36:20 +0000
Subject: [PATCH 5/8] fix(#494): re-prove the confirmed identity, and never
 leave focus on <body>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A third review pass raised five findings. I verified each against the code
before acting: three reproduce exactly as described, one is real but was
overstated, and one turns on data the persistence layer forbids. All five are
addressed; each fix is sabotage-checked (reverting all of them together fails
twelve tests, spread across every area).

**The delete discarded the identity the confirmation named.** The row captured
`{dashboardId, tileId, queryId}` but `PanelDeleteTarget` dropped `queryId`, so
the transform deleted whatever the tile pointed at AT DEQUEUE TIME. Verified:
with the tile re-pointed from `qa` to `qb` between confirmation and commit, the
transform deleted `qb` — a state that is valid before and after, so nothing else
would have noticed. `queryId` is threaded through now and the tile must still
reference it (`tile-retargeted`).

The same transform resolved a tile with `.find` and removed with `.filter`, so a
duplicated tile id would have removed BOTH tiles (verified: 2 tiles in, 0 out,
one query orphaned), and a duplicated query id would have deleted every document
carrying it. Both now refuse (`tile-duplicate`) rather than resolving an
ambiguous id by picking one; the Dashboard cascade likewise keeps a query id
carried by two documents. Note these two states are NOT reachable from storage —
`dashboard-duplicate-tile-id` and `workspace-duplicate-query-id` are
error-severity diagnostics, and both decode-on-load and encode-on-commit reject
any workspace carrying one — so this is defence in depth, not a live data-loss
path. It is three lines, and #494 asks for fail-closed.

**A wrong-role query was editable and deletable.** A tile may only reference a
panel-role query; the validator says so (`dashboard-setup-reference`). Nothing
in the tree, the metadata guard or the delete checked it, so a tile referencing
a Setup query offered live controls whose use would "repair" the workspace by
destroying the evidence. `queryDashboardRole` is now consulted in all three, and
the controls render `aria-disabled` with their own reason. Same reachability
caveat as above.

**Deleting the only search match stranded focus on `<body>`.** Verified: rows
empty, `activeElement` BODY, `keyboardRowKey` null. The successor was chosen
before the write and applied blindly afterwards, but a search matching only the
deleted panel takes its group and its Dashboard off screen too. The pre-commit
choice is a preference now, re-checked against the rows that actually exist
after the repaint, with the search box as the floor. An empty render also
records its (empty) row list instead of leaving the previous one behind.

**Closing a stale dialog could lose focus the same way** — verified BODY when
the row was deleted while the dialog was open. The resolver falls back to the
tree's current roving row, then the search box.

**Repeated activation opened duplicate modals.** Verified: three clicks, three
backdrops, three `#dash-rename-name` elements. `openDialogShell` now enforces
the single-modal invariant its own header always claimed; the stale-slot guard
stays reachable through a second `close()` on an already-replaced handle.

The tree fixture's `mutateWorkspace` now projects AND repaints what it commits,
the way a real commit does — without that, post-delete assertions were made
against rows the write was supposed to have removed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018mujm1kW7jDGpTEfscndcU
---
 CHANGELOG.md                                  |  8 ++
 src/application/dashboard-delete.ts           | 10 +-
 src/application/dashboard-panel-metadata.ts   | 12 ++-
 src/application/dashboard-tree-model.ts       | 16 ++-
 .../application/dashboard-removal.ts          | 48 +++++++--
 src/ui/dashboard-tree.ts                      | 43 +++++---
 src/ui/dialog-shell.ts                        |  9 ++
 tests/unit/dashboard-delete.test.ts           | 28 ++++--
 tests/unit/dashboard-panel-metadata.test.ts   | 23 +++++
 tests/unit/dashboard-removal.test.ts          | 95 ++++++++++++++++--
 tests/unit/dashboard-tree-model.test.ts       | 26 +++++
 tests/unit/dashboard-tree.test.ts             | 98 +++++++++++++++++--
 tests/unit/dialog-shell.test.ts               | 41 +++++---
 13 files changed, 392 insertions(+), 65 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f0eaec7..984b62f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,6 +35,14 @@ auto-generated per-PR notes; this file is the curated, human-readable history.
   re-resolves its target inside the write queue, so one that went stale while it
   was open commits nothing and says so.
 
+  Every one of those operations re-proves the **exact identity** the user
+  confirmed, inside the write queue: the Dashboard, the tile, the query the
+  confirmation named, that the tile still references it, that exactly one
+  document carries that id, and that it is a panel-role query. A tile
+  re-pointed while the confirmation was open, an ambiguous id, or a reference
+  to a non-panel query all refuse and say why, rather than deleting whatever
+  the tile happens to point at by then.
+
   Not yet included: the **Open in Dashboard** focus button, which is held back
   until #438 fixes tile focus on flow-layout KPI tiles.
 - **A Dashboard row's pencil edits its title and description** (#429 phase 3).
diff --git a/src/application/dashboard-delete.ts b/src/application/dashboard-delete.ts
index 4e84ef5e..66b06c59 100644
--- a/src/application/dashboard-delete.ts
+++ b/src/application/dashboard-delete.ts
@@ -44,6 +44,10 @@ export interface DashboardDeleteDeps {
 export interface PanelDeleteTarget {
   dashboardId: string;
   tileId: string;
+  /** The owned query the confirmation named. Carried all the way into the
+   *  transform so the delete can refuse a tile that was re-pointed at a
+   *  DIFFERENT query while the confirmation was open. */
+  queryId: string;
 }
 
 /**
@@ -107,7 +111,11 @@ export function dashboardDeleteMessage(outcome: DashboardDeleteOutcome): string
     case 'tile-missing':
       return 'That panel is no longer part of this dashboard.';
     case 'ownership-unproven':
-      return 'This panel’s query is shared or missing, so nothing was deleted.';
+      return 'This panel’s query is shared, missing or not a panel query, so nothing was deleted.';
+    case 'tile-retargeted':
+      return 'That panel now shows a different query, so nothing was deleted.';
+    case 'tile-duplicate':
+      return 'This workspace has two resources with the same id, so nothing was deleted.';
     case 'dashboard-duplicate':
       return 'This workspace has two dashboards with the same id, so nothing was deleted.';
     // `no-workspace` — nothing is loaded, so nothing was lost and there is
diff --git a/src/application/dashboard-panel-metadata.ts b/src/application/dashboard-panel-metadata.ts
index 8d3f66c4..a78f7e27 100644
--- a/src/application/dashboard-panel-metadata.ts
+++ b/src/application/dashboard-panel-metadata.ts
@@ -24,6 +24,7 @@
 import { renameSaved } from '../state.js';
 import type { AppState, MutateWorkspace, SpecValidationService } from '../state.js';
 import { ownersOfQuery } from '../dashboard/model/query-ownership.js';
+import { queryDashboardRole } from '../dashboard/model/workspace-semantics.js';
 import type { SavedQueryV2, StoredWorkspaceV5 } from '../generated/json-schema.types.js';
 
 /** Which owned query to edit, addressed the way #430 requires — Dashboard id +
@@ -73,10 +74,19 @@ export function ownedByPanel(
   workspace: StoredWorkspaceV5, target: PanelMetadataTarget,
 ): boolean {
   const owners = ownersOfQuery(workspace, target.queryId);
+  const matching = workspace.queries.filter((query) => query.id === target.queryId);
   return owners.length === 1
     && owners[0].dashboardId === target.dashboardId
     && owners[0].tileId === target.tileId
-    && workspace.queries.some((query) => query.id === target.queryId);
+    // Exactly one document, and a PANEL one: an ambiguous id would make
+    // "which query am I editing" unanswerable, and a Setup- or other-role
+    // reference is malformed data this must not quietly write over.
+    && matching.length === 1
+    && queryDashboardRole(matching[0]) === 'panel'
+    // The tile must still point AT it — the pair is the identity, and a tile
+    // re-pointed while the dialog was open is a different resource.
+    && workspace.dashboards.some((dashboard) => dashboard.id === target.dashboardId
+      && dashboard.tiles.some((tile) => tile.id === target.tileId && tile.queryId === target.queryId));
 }
 
 /**
diff --git a/src/application/dashboard-tree-model.ts b/src/application/dashboard-tree-model.ts
index 39012c62..054d9043 100644
--- a/src/application/dashboard-tree-model.ts
+++ b/src/application/dashboard-tree-model.ts
@@ -31,6 +31,7 @@ import type { DashboardTreeGroup, DashboardTreeUiState } from '../core/dashboard
 import { encodeKeyPart, groupStateKey } from '../core/dashboard-tree-ui-state.js';
 import { inferDashboardVariables } from '../core/dashboard-variables.js';
 import { buildQueryOwnershipIndex } from '../dashboard/model/query-ownership.js';
+import { queryDashboardRole } from '../dashboard/model/workspace-semantics.js';
 import type { DashboardVariable } from '../core/dashboard-variables.js';
 import type { LibraryDropTarget } from '../core/library-drag.js';
 
@@ -49,7 +50,7 @@ export interface TreeQuery {
    *  Optional here for the same reason the collections are — a real
    *  `SavedQueryV2` always carries it. */
   sql?: string;
-  spec?: { name?: string; description?: string } | null;
+  spec?: { name?: string; description?: string; dashboard?: { role?: string } | null } | null;
 }
 
 export interface TreeTile {
@@ -421,6 +422,12 @@ const MISSING_PANEL_QUERY_REASON =
   'This panel’s query is not in this workspace, so there is nothing to edit or remove.';
 const UNPROVEN_OWNERSHIP_REASON =
   'This panel’s query is shared with another panel, so it cannot be edited or removed here.';
+/** A tile may only reference a PANEL-role query (`dashboard-setup-reference` /
+ *  `dashboard-tile-role-incompatible` in the semantic validator). Editing or
+ *  deleting through a tile that references, say, a Setup query would silently
+ *  repair the workspace by destroying the evidence — fail closed instead. */
+const WRONG_ROLE_REASON =
+  'This panel references a query that is not a panel query, so it cannot be edited or removed here.';
 
 /** One trailing control, available. */
 const action = (
@@ -477,8 +484,11 @@ export function deriveDashboardTree(
     const owners = queryId === null ? [] : ownership.ownersByQueryId.get(queryId) ?? [];
     const owned = owners.length === 1
       && owners[0].dashboardId === dashboardId && owners[0].tileId === tileId;
-    if (queryId === null || !owned) {
-      const reason = queryId === null ? MISSING_PANEL_QUERY_REASON : UNPROVEN_OWNERSHIP_REASON;
+    const rightRole = queryId !== null && queryDashboardRole(queries.get(queryId)) === 'panel';
+    if (queryId === null || !owned || !rightRole) {
+      const reason = queryId === null
+        ? MISSING_PANEL_QUERY_REASON
+        : (owned ? WRONG_ROLE_REASON : UNPROVEN_OWNERSHIP_REASON);
       return [
         unavailableAction('edit-panel', 'Edit ' + label, reason),
         unavailableAction('delete-panel', 'Remove ' + label + ' from dashboard', reason),
diff --git a/src/dashboard/application/dashboard-removal.ts b/src/dashboard/application/dashboard-removal.ts
index d35e3634..a21da9df 100644
--- a/src/dashboard/application/dashboard-removal.ts
+++ b/src/dashboard/application/dashboard-removal.ts
@@ -35,6 +35,7 @@ import { removeTileMembership } from './tile-membership.js';
 import type { TileRemovalResult } from './tile-membership.js';
 import { findDashboardStrict, replaceDashboard } from '../../workspace/workspace-dashboards.js';
 import { buildQueryOwnershipIndex, ownersOfQuery } from '../model/query-ownership.js';
+import { queryDashboardRole } from '../model/workspace-semantics.js';
 import type { DashboardDocumentV2, StoredWorkspaceV5 } from '../../generated/json-schema.types.js';
 
 /** Why a single-panel delete refused, as a value rather than a thrown error —
@@ -44,6 +45,14 @@ export type PanelRemovalRefusal =
   | 'dashboard-missing'
   | 'dashboard-duplicate'
   | 'tile-missing'
+  /** Two tiles carry this id, or two query documents do. An ambiguous id is
+   *  never resolved by picking one: `tiles.filter(id !== target)` would take
+   *  BOTH tiles out, and the query filter would drop both documents. */
+  | 'tile-duplicate'
+  /** The tile no longer references the query the caller captured — it was
+   *  re-pointed while the confirmation was open. The caller confirmed removing
+   *  a specific panel's specific query copy; this is a different one now. */
+  | 'tile-retargeted'
   | 'ownership-unproven';
 
 export type PanelRemovalResult =
@@ -82,8 +91,12 @@ export function removeDashboardPanel(input: {
   workspace: StoredWorkspaceV5;
   dashboardId: string;
   tileId: string;
+  /** The query the CALLER resolved when it built the confirmation. Re-checked
+   *  against the tile's own reference below rather than trusted: it is what
+   *  the user was told would be deleted. */
+  queryId: string;
 }): PanelRemovalResult {
-  const { workspace, dashboardId, tileId } = input;
+  const { workspace, dashboardId, tileId, queryId } = input;
 
   const lookup = findDashboardStrict(workspace, dashboardId);
   if (lookup.status !== 'ok') {
@@ -91,13 +104,29 @@ export function removeDashboardPanel(input: {
   }
   const dashboard = lookup.dashboard;
 
-  const tile = dashboard.tiles.find((candidate) => candidate.id === tileId);
-  if (!tile) return { status: 'refused', reason: 'tile-missing' };
-
-  const { queryId } = tile;
-  const queryExists = workspace.queries.some((query) => query.id === queryId);
+  // Exactly one match, the same rule `findDashboardStrict` applies one level
+  // up. The removal below is a `filter` by id, so an ambiguous id would take
+  // out every match — which is precisely why this refuses instead.
+  const tiles = dashboard.tiles.filter((candidate) => candidate.id === tileId);
+  if (tiles.length === 0) return { status: 'refused', reason: 'tile-missing' };
+  if (tiles.length > 1) return { status: 'refused', reason: 'tile-duplicate' };
+  const tile = tiles[0];
+
+  // The tile still has to reference the query the caller confirmed. Both the
+  // before and after states of a re-pointed tile are perfectly valid, so
+  // nothing else in this transform would notice.
+  if (tile.queryId !== queryId) return { status: 'refused', reason: 'tile-retargeted' };
+
+  const matching = workspace.queries.filter((query) => query.id === queryId);
+  if (matching.length > 1) return { status: 'refused', reason: 'tile-duplicate' };
   const owners = ownersOfQuery(workspace, queryId);
-  if (!queryExists || owners.length !== 1) {
+  // Owned by exactly this tile, and a PANEL query — the role the tile
+  // contract requires. A Setup- or other-role reference is malformed data
+  // (`dashboard-setup-reference` / `dashboard-tile-role-incompatible`), and
+  // deleting it here would silently "repair" the workspace by destroying the
+  // evidence, which #494's fail-closed rule forbids.
+  if (matching.length === 0 || owners.length !== 1
+    || queryDashboardRole(matching[0]) !== 'panel') {
     return { status: 'refused', reason: 'ownership-unproven' };
   }
 
@@ -166,6 +195,11 @@ export function removeDashboardDocument(input: {
     // `dashboardOwnedQueryIds` holds only ids that EXIST and have an owner, so
     // it answers the dangling-reference case as well.
     if (!dashboardOwnedQueryIds.has(queryId)) continue;
+    // An id carried by two query documents is ambiguous: the removal is a
+    // filter, so deleting "it" would delete both. Keep them, and let the
+    // Dashboard go without them — an orphaned copy is recoverable, a
+    // destroyed one is not.
+    if (workspace.queries.filter((query) => query.id === queryId).length > 1) continue;
 
     // Present by construction: `dashboardOwnedQueryIds` is exactly the ids
     // `ownersByQueryId` carries an owner list for.
diff --git a/src/ui/dashboard-tree.ts b/src/ui/dashboard-tree.ts
index 3898183f..8d27af3c 100644
--- a/src/ui/dashboard-tree.ts
+++ b/src/ui/dashboard-tree.ts
@@ -620,6 +620,7 @@ export function renderDashboardTree(app: DashboardTreeApp): void {
   const keptFocus = list.contains(doc.activeElement);
 
   list.replaceChildren();
+  app._dashTreeRows = tree.rows;
   if (tree.rows.length === 0) {
     list.appendChild(h('div', { class: 'schema-empty' }, tree.empty === 'no-dashboards'
       ? 'No dashboards in this workspace.'
@@ -627,7 +628,6 @@ export function renderDashboardTree(app: DashboardTreeApp): void {
     return;
   }
 
-  app._dashTreeRows = tree.rows;
   for (const row of tree.rows) {
     list.appendChild(buildRow(app, doc, row, ui));
   }
@@ -871,11 +871,21 @@ function buildActionButton(
  */
 const returnFocusAfterDialog = (
   app: DashboardTreeApp, trigger: HTMLButtonElement, rowKey: string,
-) => (): HTMLElement | null => (trigger.isConnected
-  ? trigger
-  : app.dom.dashboardTreeList?.querySelector<HTMLElement>(
-    '[data-key="' + CSS.escape(rowKey) + '"]',
-  ) ?? null);
+) => (): HTMLElement | null => {
+  if (trigger.isConnected) return trigger;
+  const list = app.dom.dashboardTreeList;
+  const byKey = (key: string | null): HTMLElement | null => (key === null
+    ? null
+    : list?.querySelector<HTMLElement>('[data-key="' + CSS.escape(key) + '"]') ?? null);
+  // The row the dialog belonged to, if it survived; else the tree's current
+  // roving row — the resource can have been deleted from another tab while
+  // this dialog was open, which is exactly when a stale dialog is closed;
+  // else the search box, the one control the tree always has.
+  return byKey(rowKey)
+    ?? byKey(readUi(app).keyboardRowKey)
+    ?? app.dom.dashboardSearchInput
+    ?? null;
+};
 
 /** The confirm menu's own go-ahead label, per action. Short and specific: the
  *  question above it already named the resource, and "OK" next to a sentence
@@ -966,7 +976,10 @@ function runDestructive(
     void reportRemoval(app, doc, commitDashboardRemoval(app, target.dashboardId), successor);
     return;
   }
-  void reportRemoval(app, doc, commitPanelRemoval(app, target as PanelActionTarget), successor);
+  const panel = target as PanelActionTarget;
+  void reportRemoval(app, doc, commitPanelRemoval(app, {
+    dashboardId: panel.dashboardId, tileId: panel.tileId, queryId: panel.queryId,
+  }), successor);
 }
 
 /**
@@ -1108,9 +1121,6 @@ async function reportRemoval(
   const message = dashboardDeleteMessage(outcome);
   if (message !== null) flashToast(message, { document: doc });
   if (!outcome.ok) return;
-  // The commit reprojected and repainted the tree already, so this addresses
-  // rows that exist NOW.
-  //
   // Focus is NOT optional here. The confirmation's own menu closes by removing
   // the item that was just activated, without restoring the trigger — and the
   // trigger is on its way out with the row anyway — so at this moment DOM focus
@@ -1118,9 +1128,16 @@ async function reportRemoval(
   // conditional on the tree ALREADY holding focus, so it will not step in.
   // Without this, deleting from the keyboard drops the user at the top of the
   // page with no ring anywhere.
-  if (successorKey !== null) { moveTo(app, successorKey); return; }
-  // Nothing is left to stand on (the last Dashboard just went): the search box
-  // is the tree's own always-present landing spot.
+  //
+  // The successor was chosen against the rows painted BEFORE the write, and the
+  // repaint can have dropped it too — a search matching only the deleted panel
+  // takes its group and Dashboard off screen with it. So the pre-commit choice
+  // is a preference, re-checked against what is actually rendered now, and the
+  // search box is the landing spot when the tree has nothing left to offer.
+  const painted = app._dashTreeRows ?? [];
+  const landing = painted.find((row) => row.key === successorKey)
+    ?? painted[0];
+  if (landing !== undefined) { moveTo(app, landing.key); return; }
   app.dom.dashboardSearchInput?.focus();
 }
 
diff --git a/src/ui/dialog-shell.ts b/src/ui/dialog-shell.ts
index 7a6b1c9a..12ce9ac1 100644
--- a/src/ui/dialog-shell.ts
+++ b/src/ui/dialog-shell.ts
@@ -80,6 +80,15 @@ export function closeOpenDialogShell(): void {
 export function openDialogShell(
   app: DialogHostApp, title: string, content: unknown[], opts: OpenDialogShellOpts,
 ): DialogHandle {
+  // ONE modal at a time — the invariant this module's header always claimed,
+  // now enforced rather than assumed. #494 requires that repeated activation
+  // cannot open duplicate dialogs, and a second shell would otherwise mount a
+  // second modal keyboard owner, a second capture-phase key listener, and a
+  // duplicate of every `id` the caller's fields carry (two `panel-metadata-name`
+  // elements break `label for` and `getById` alike). The trigger's own
+  // `aria-expanded` does not close this window: a keyboard autorepeat fires
+  // again while focus is still on the trigger, before the deferred focus move.
+  closeOpenDialogShell();
   const doc = app.document;
   const releaseKeyboard = app.acquireKeyboardOwner('modal');
   let backdrop: HTMLElement;
diff --git a/tests/unit/dashboard-delete.test.ts b/tests/unit/dashboard-delete.test.ts
index 9857f2d2..afec8103 100644
--- a/tests/unit/dashboard-delete.test.ts
+++ b/tests/unit/dashboard-delete.test.ts
@@ -77,11 +77,11 @@ describe('commitPanelRemoval', () => {
         layout: { type: 'flow', version: 1, preset: 'report', items: { t1: {}, t2: {} } },
       })],
     });
-    const expected = removeDashboardPanel({ workspace: latest, dashboardId: 'dash', tileId: 't1' });
+    const expected = removeDashboardPanel({ workspace: latest, dashboardId: 'dash', tileId: 't1', queryId: 'p1' });
     if (expected.status !== 'ok') throw new Error(`expected ok, got ${expected.status}`);
 
     const app = deps(latest);
-    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1', queryId: 'p1' });
     if (!outcome.ok) throw new Error(`expected ok, got aborted/rejected`);
 
     // The wrapper never reimplements the transform — it hands `mutateWorkspace`
@@ -114,7 +114,7 @@ describe('commitPanelRemoval', () => {
       })],
     });
     const app = deps(dequeueLatest);
-    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1', queryId: 'p1' });
     if (!outcome.ok) throw new Error(`expected ok, got aborted/rejected`);
 
     // t3/p3 — wholly absent from `staleBelief` — survives, and the revision
@@ -127,7 +127,7 @@ describe('commitPanelRemoval', () => {
 
   it('aborts with no-workspace, threaded through data, and commits nothing when nothing is loaded', async () => {
     const app = deps(null);
-    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1', queryId: 'p1' });
 
     expect(outcome).toEqual({ ok: false, aborted: true, data: 'no-workspace' });
     expect(app.committed).toEqual([null]);
@@ -137,7 +137,7 @@ describe('commitPanelRemoval', () => {
   it('aborts dashboard-missing, threaded through data, and commits nothing', async () => {
     const latest = ws({ dashboards: [dash({ id: 'ops' })] });
     const app = deps(latest);
-    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1', queryId: 'p1' });
 
     expect(outcome).toEqual({ ok: false, aborted: true, data: 'dashboard-missing' });
     expect(app.committed).toEqual([null]);
@@ -150,7 +150,7 @@ describe('commitPanelRemoval', () => {
       queries: [panelQuery('p1')],
     });
     const app = deps(latest);
-    const outcome = await commitPanelRemoval(app, { dashboardId: 'dup', tileId: 't1' });
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dup', tileId: 't1', queryId: 'p1' });
 
     expect(outcome).toEqual({ ok: false, aborted: true, data: 'dashboard-duplicate' });
     expect(app.committed).toEqual([null]);
@@ -160,7 +160,7 @@ describe('commitPanelRemoval', () => {
   it('aborts tile-missing, threaded through data, and commits nothing', async () => {
     const latest = ws({ dashboards: [dash({ tiles: [{ id: 't1', queryId: 'p1' }] })], queries: [panelQuery('p1')] });
     const app = deps(latest);
-    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 'ghost' });
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 'ghost', queryId: 'p1' });
 
     expect(outcome).toEqual({ ok: false, aborted: true, data: 'tile-missing' });
     expect(app.committed).toEqual([null]);
@@ -170,7 +170,7 @@ describe('commitPanelRemoval', () => {
   it('aborts ownership-unproven, threaded through data, and commits nothing', async () => {
     const latest = ws({ dashboards: [dash({ tiles: [{ id: 't1', queryId: 'ghost' }] })], queries: [] });
     const app = deps(latest);
-    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1' });
+    const outcome = await commitPanelRemoval(app, { dashboardId: 'dash', tileId: 't1', queryId: 'ghost' });
 
     expect(outcome).toEqual({ ok: false, aborted: true, data: 'ownership-unproven' });
     expect(app.committed).toEqual([null]);
@@ -290,7 +290,7 @@ describe('dashboardDeleteMessage', () => {
 
   it('reports the ownership-unproven sentence', () => {
     expect(dashboardDeleteMessage(aborted('ownership-unproven')))
-      .toBe('This panel’s query is shared or missing, so nothing was deleted.');
+      .toBe('This panel’s query is shared, missing or not a panel query, so nothing was deleted.');
   });
 
   it('reports the dashboard-duplicate sentence', () => {
@@ -318,4 +318,14 @@ describe('dashboardDeleteMessage', () => {
   it('falls back to a generic sentence when a rejection carries no diagnostics', () => {
     expect(dashboardDeleteMessage(rejected([]))).toBe('✕ Could not save workspace');
   });
+
+  it('names the two identity refusals distinctly', () => {
+    // Both mean "nothing was deleted", but they are different situations: one
+    // is a panel that changed under the user, the other a workspace whose ids
+    // are ambiguous and must never be written through a guess.
+    expect(dashboardDeleteMessage({ ok: false, aborted: true, data: 'tile-retargeted' }))
+      .toBe('That panel now shows a different query, so nothing was deleted.');
+    expect(dashboardDeleteMessage({ ok: false, aborted: true, data: 'tile-duplicate' }))
+      .toBe('This workspace has two resources with the same id, so nothing was deleted.');
+  });
 });
diff --git a/tests/unit/dashboard-panel-metadata.test.ts b/tests/unit/dashboard-panel-metadata.test.ts
index 230206fe..40dd2459 100644
--- a/tests/unit/dashboard-panel-metadata.test.ts
+++ b/tests/unit/dashboard-panel-metadata.test.ts
@@ -286,4 +286,27 @@ describe('commitPanelQueryMetadata', () => {
 
     expect(outcome).toEqual({ status: 'rejected', message: 'Could not save this panel.' });
   });
+
+  it('refuses a query that is not a PANEL query, an ambiguous id, and a re-pointed tile', () => {
+    const q1 = savedQuery({ id: 'q1', name: 'Q' });
+    const target = { dashboardId: 'dash', tileId: 't1', queryId: 'q1' };
+
+    // Wrong role — malformed data the semantic validator rejects; editing it
+    // here would quietly write over the evidence.
+    const setup = { ...q1, spec: { ...q1.spec, dashboard: { role: 'setup' } } } as typeof q1;
+    expect(ownedByPanel(
+      ws([dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }] })], [setup]), target,
+    )).toBe(false);
+
+    // Two documents carrying the id: "which query am I editing" has no answer.
+    expect(ownedByPanel(
+      ws([dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }] })], [q1, q1]), target,
+    )).toBe(false);
+
+    // The tile no longer points at it — the pair IS the identity.
+    expect(ownedByPanel(
+      ws([dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q2' }] })], [q1, savedQuery({ id: 'q2', name: 'Other' })]),
+      target,
+    )).toBe(false);
+  });
 });
diff --git a/tests/unit/dashboard-removal.test.ts b/tests/unit/dashboard-removal.test.ts
index 16e2e158..cbc6e1c6 100644
--- a/tests/unit/dashboard-removal.test.ts
+++ b/tests/unit/dashboard-removal.test.ts
@@ -43,7 +43,7 @@ describe('removeDashboardPanel (#429, #494)', () => {
     });
     const before = snapshot(input);
 
-    const result = removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' });
+    const result = removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1', queryId: 'p1' });
     if (result.status !== 'ok') throw new Error(`expected ok, got ${result.status}`);
 
     expect(result.queryId).toBe('p1');
@@ -77,7 +77,7 @@ describe('removeDashboardPanel (#429, #494)', () => {
       })],
     });
 
-    const result = removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' });
+    const result = removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1', queryId: 'p1' });
     if (result.status !== 'ok') throw new Error(`expected ok, got ${result.status}`);
 
     const layout = result.workspace.dashboards[0].layout as {
@@ -90,7 +90,7 @@ describe('removeDashboardPanel (#429, #494)', () => {
   it('refuses dashboard-missing and commits nothing', () => {
     const input = workspace({ dashboards: [dashboard()] });
     const before = snapshot(input);
-    expect(removeDashboardPanel({ workspace: input, dashboardId: 'nope', tileId: 't1' }))
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'nope', tileId: 't1', queryId: 'p1' }))
       .toEqual({ status: 'refused', reason: 'dashboard-missing' });
     expect(snapshot(input)).toEqual(before);
   });
@@ -101,7 +101,7 @@ describe('removeDashboardPanel (#429, #494)', () => {
       queries: [panelQuery('p1')],
     });
     const before = snapshot(input);
-    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dup', tileId: 't1' }))
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dup', tileId: 't1', queryId: 'p1' }))
       .toEqual({ status: 'refused', reason: 'dashboard-duplicate' });
     expect(snapshot(input)).toEqual(before);
   });
@@ -112,7 +112,7 @@ describe('removeDashboardPanel (#429, #494)', () => {
       queries: [panelQuery('p1')],
     });
     const before = snapshot(input);
-    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 'missing' }))
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 'missing', queryId: 'p1' }))
       .toEqual({ status: 'refused', reason: 'tile-missing' });
     expect(snapshot(input)).toEqual(before);
   });
@@ -123,7 +123,7 @@ describe('removeDashboardPanel (#429, #494)', () => {
       queries: [],
     });
     const before = snapshot(input);
-    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' }))
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1', queryId: 'ghost' }))
       .toEqual({ status: 'refused', reason: 'ownership-unproven' });
     expect(snapshot(input)).toEqual(before);
   });
@@ -136,7 +136,7 @@ describe('removeDashboardPanel (#429, #494)', () => {
       queries: [panelQuery('p1')],
     });
     const before = snapshot(input);
-    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' }))
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1', queryId: 'p1' }))
       .toEqual({ status: 'refused', reason: 'ownership-unproven' });
     expect(snapshot(input)).toEqual(before);
   });
@@ -150,7 +150,70 @@ describe('removeDashboardPanel (#429, #494)', () => {
       queries: [panelQuery('p1')],
     });
     const before = snapshot(input);
-    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1' }))
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1', queryId: 'p1' }))
+      .toEqual({ status: 'refused', reason: 'ownership-unproven' });
+    expect(snapshot(input)).toEqual(before);
+  });
+});
+
+/**
+ * #494 review round 2 — the identity the CONFIRMATION named must still be the
+ * identity being destroyed.
+ *
+ * The transform used to resolve the tile and then delete "whatever query it
+ * points at now", by `filter`, which meant three ways to destroy the wrong
+ * thing. All three inputs below are states the codec forbids (a duplicate id
+ * or a Setup-role reference cannot be loaded OR committed) except the FIRST,
+ * which is two perfectly valid states with a re-point in between — so this
+ * transform must not be the thing that assumes it is safe.
+ */
+describe('removeDashboardPanel — the captured identity is re-proven (#494)', () => {
+  it('refuses a tile that was re-pointed at a DIFFERENT query while the confirmation was open', () => {
+    const input = workspace({
+      queries: [panelQuery('p1'), panelQuery('p2')],
+      dashboards: [dashboard({ tiles: [{ id: 't1', queryId: 'p2' }] })],
+    });
+    const before = snapshot(input);
+    // The user confirmed removing the panel backed by `p1`.
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1', queryId: 'p1' }))
+      .toEqual({ status: 'refused', reason: 'tile-retargeted' });
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('refuses an ambiguous TILE id rather than removing both tiles', () => {
+    // The removal is a `filter` by id: resolving "the first match" and then
+    // filtering would take the other tile out too, and orphan its query.
+    const input = workspace({
+      queries: [panelQuery('p1'), panelQuery('p2')],
+      dashboards: [dashboard({ tiles: [{ id: 't1', queryId: 'p1' }, { id: 't1', queryId: 'p2' }] })],
+    });
+    const before = snapshot(input);
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1', queryId: 'p1' }))
+      .toEqual({ status: 'refused', reason: 'tile-duplicate' });
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('refuses an ambiguous QUERY id rather than deleting every document carrying it', () => {
+    const input = workspace({
+      queries: [panelQuery('p1'), panelQuery('p1')],
+      dashboards: [dashboard({ tiles: [{ id: 't1', queryId: 'p1' }] })],
+    });
+    const before = snapshot(input);
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1', queryId: 'p1' }))
+      .toEqual({ status: 'refused', reason: 'tile-duplicate' });
+    expect(snapshot(input)).toEqual(before);
+  });
+
+  it('refuses a tile referencing a query that is not a PANEL query', () => {
+    // `dashboard-setup-reference` is malformed data. Deleting through it would
+    // "repair" the workspace by destroying the evidence — fail closed.
+    const setup = { ...panelQuery('s1'), spec: { name: 's1', dashboard: { role: 'setup' } } } as typeof input.queries[number];
+    const input = workspace({
+      queries: [setup],
+      dashboards: [dashboard({ tiles: [{ id: 't1', queryId: 's1' }] })],
+    });
+    const before = snapshot(input);
+    expect(removeDashboardPanel({ workspace: input, dashboardId: 'dash', tileId: 't1', queryId: 's1' }))
       .toEqual({ status: 'refused', reason: 'ownership-unproven' });
     expect(snapshot(input)).toEqual(before);
   });
@@ -221,3 +284,19 @@ describe('removeDashboardDocument (#429, #494)', () => {
     expect(snapshot(input)).toEqual(before);
   });
 });
+
+describe('removeDashboardDocument — ambiguous ids (#494)', () => {
+  it('keeps a query id carried by two documents rather than deleting both', () => {
+    const input = workspace({
+      queries: [panelQuery('p1'), panelQuery('p1'), panelQuery('lib')],
+      dashboards: [dashboard({ tiles: [{ id: 't1', queryId: 'p1' }] })],
+    });
+    const result = removeDashboardDocument({ workspace: input, dashboardId: 'dash' });
+    if (result.status !== 'ok') throw new Error(`expected ok, got ${result.status}`);
+    // The Dashboard goes; the ambiguous pair stays. An orphaned copy is
+    // recoverable, a destroyed one is not.
+    expect(result.workspace.dashboards).toEqual([]);
+    expect(result.removedQueryIds).toEqual([]);
+    expect(result.workspace.queries.map((query) => query.id)).toEqual(['p1', 'p1', 'lib']);
+  });
+});
diff --git a/tests/unit/dashboard-tree-model.test.ts b/tests/unit/dashboard-tree-model.test.ts
index 1a03d3ab..25c05842 100644
--- a/tests/unit/dashboard-tree-model.test.ts
+++ b/tests/unit/dashboard-tree-model.test.ts
@@ -1087,4 +1087,30 @@ describe('deriveDashboardTree — Library-query drop targets (#428)', () => {
     expect(row(derive(cased, allOpen(['d1'])).rows, 'w1:d1:variable:Country').dropTarget)
       .toEqual({ kind: 'variable', dashboardId: 'd1', variableName: 'Country' });
   });
+
+  it('withholds edit and delete from a tile whose query is not a PANEL query', () => {
+    // The semantic validator calls this out (`dashboard-setup-reference` /
+    // `dashboard-tile-role-incompatible`). Offering the controls anyway would
+    // let a delete "repair" the workspace by destroying the evidence.
+    const tree = deriveDashboardTree({
+      workspace: {
+        id: 'w1',
+        queries: [{ id: 'q1', sql: 'SELECT 1', spec: { name: 'Setup', dashboard: { role: 'setup' } } }],
+        dashboards: [{ id: 'd1', title: 'D', tiles: [{ id: 't1', queryId: 'q1' }] }],
+      },
+      surface: QUERY_SURFACE,
+      ui: allOpen(['d1']),
+    });
+    const panel = tree.rows.find((row) => row.kind === 'panel')!;
+    expect(panel.actions.map((action) => action.kind)).toEqual(['edit-panel', 'delete-panel']);
+    for (const action of panel.actions) {
+      expect(action.target).toBeNull();
+      expect(action.unavailable).toBe(
+        'This panel references a query that is not a panel query, so it cannot be edited or removed here.',
+      );
+    }
+    // The row itself still navigates — only the WRITES are withheld.
+    expect(panel.single).not.toBeNull();
+    expect(panel.double).not.toBeNull();
+  });
 });
diff --git a/tests/unit/dashboard-tree.test.ts b/tests/unit/dashboard-tree.test.ts
index 45bd8628..99fbab4c 100644
--- a/tests/unit/dashboard-tree.test.ts
+++ b/tests/unit/dashboard-tree.test.ts
@@ -72,6 +72,15 @@ const treeApp = (over: Partial<DashboardTreeApp> = {}) => {
       // threads it: #494's panel-metadata write reads back the entry it
       // committed, and a delete reads back the refusal reason.
       if (candidate === null) return { ok: false, aborted: true, data: input?.data };
+      // A real commit PROJECTS what it wrote before it resolves — which is how
+      // a deleted row actually leaves the tree. Without this the fixture's
+      // projection never changes, and every post-delete assertion would be
+      // made against rows the write was supposed to have removed.
+      app.currentWorkspace = candidate as never;
+      // …and REPAINTS from it (production: `applyCommittedWorkspace` →
+      // `invalidateDashboardTree` → the app-shell effect), so anything reading
+      // the painted rows after a commit sees what the write actually left.
+      renderDashboardTree(app);
       return { ok: true, workspace: candidate, dashboardRevision: null, data: input!.data };
     }) as App['mutateWorkspace'];
   }
@@ -844,6 +853,7 @@ describe('renderDashboardTree — panel trash (#494)', () => {
   };
   const trash = (list: HTMLElement): HTMLButtonElement =>
     actionBtn(list, 'w1:sales:tile:t1', 'Remove Revenue from dashboard')!;
+  const list0 = (app: DashboardTreeApp): HTMLElement => app.dom.dashboardTreeList!;
   const confirmItems = (): HTMLElement[] =>
     [...document.querySelectorAll<HTMLElement>('.dash-tree-confirm .fm-item')];
   const settle = (): Promise<void> => new Promise((resolve) => { setTimeout(resolve, 0); });
@@ -881,6 +891,32 @@ describe('renderDashboardTree — panel trash (#494)', () => {
     expect(dashboard.variableConfigs!.region).toBeDefined();
   });
 
+  it('hands the command the query id the confirmation named, not just the tile', async () => {
+    // The transform re-proves that the tile still points at THIS query; a
+    // target without it would delete whatever the tile references by then.
+    const mutateWorkspace = vi.fn(async (transform: (latest: unknown) => unknown) => {
+      transform(workspace());
+      return { ok: false, aborted: true, data: 'tile-missing' };
+    }) as unknown as App['mutateWorkspace'];
+    const { app } = treeApp({ mutateWorkspace });
+    openAll(app, 'sales');
+    renderDashboardTree(app);
+    // A tile re-pointed at another query between paint and dequeue is refused
+    // rather than silently deleting the new one.
+    const retargeted = workspace();
+    retargeted.dashboards![0]!.tiles = [{ id: 't1', queryId: 'q-other' }];
+    (mutateWorkspace as unknown as { mockImplementation: (fn: unknown) => void })
+      .mockImplementation(async (transform: (latest: unknown) => { data?: unknown }) => {
+        const input = transform(retargeted);
+        return { ok: false, aborted: true, data: input?.data };
+      });
+    click(trash(list0(app)));
+    click(confirmItems()[0]);
+    await settle();
+    expect(document.querySelector('.share-toast')!.textContent)
+      .toBe('That panel now shows a different query, so nothing was deleted.');
+  });
+
   it('reports a refused delete and commits nothing', async () => {
     const mutateWorkspace = vi.fn(async () => (
       { ok: false, aborted: true, data: 'tile-missing' }
@@ -918,6 +954,25 @@ describe('renderDashboardTree — panel trash (#494)', () => {
       .toBe('w1:sales:tile:t-broken');
   });
 
+  it('lands on the search box when the delete empties the FILTERED tree', async () => {
+    // A search matching only this panel takes its group and its Dashboard off
+    // screen with it, so the successor chosen before the write (the Panels
+    // group) does not exist afterwards — and `focusRow` on a missing key is a
+    // silent no-op that would strand the keyboard on `<body>`.
+    const fixture = treeApp();
+    const dashboards = (fixture.app.currentWorkspace as unknown as TreeWorkspace).dashboards!;
+    dashboards[0]!.tiles = [{ id: 't1', queryId: 'q1' }];
+    setUi(fixture.app, (ui) => setTreeSearch(ui, 'Revenue'));
+    openAll(fixture.app, 'sales');
+    renderDashboardTree(fixture.app);
+    expect(rows(fixture.list).length).toBeGreaterThan(0);
+    click(actionBtn(fixture.list, 'w1:sales:tile:t1', 'Remove Revenue from dashboard')!);
+    click(confirmItems()[0]);
+    await settle();
+    expect(rows(fixture.list)).toHaveLength(0);
+    expect(document.activeElement).toBe(fixture.app.dom.dashboardSearchInput);
+  });
+
   it('falls back to the Panels GROUP when the deleted row was the only panel', async () => {
     const fixture = treeApp();
     const dashboards = (fixture.app.currentWorkspace as unknown as TreeWorkspace).dashboards!;
@@ -1039,15 +1094,9 @@ describe('renderDashboardTree — panel metadata pencil (#494)', () => {
     // keyboard on `<body>`.
     const fixture = treeApp();
     fixture.app.state.savedQueries = [query('q1', 'Revenue')];
-    // The production ordering, which the plain fixture does not reproduce: the
-    // commit projects and REPAINTS before it resolves, so by the time the
-    // dialog closes the button it captured is gone.
-    const inner = fixture.app.mutateWorkspace;
-    fixture.app.mutateWorkspace = (async (transform) => {
-      const outcome = await inner(transform);
-      renderDashboardTree(fixture.app);
-      return outcome;
-    }) as App['mutateWorkspace'];
+    // The fixture's `mutateWorkspace` projects and repaints before it
+    // resolves, exactly as a real commit does — which is what detaches the
+    // button this dialog captured.
     openAll(fixture.app, 'sales');
     renderDashboardTree(fixture.app);
     const trigger = actionBtn(fixture.list, 'w1:sales:tile:t1', 'Edit Revenue')!;
@@ -1502,6 +1551,37 @@ describe('renderDashboardTree — Dashboard metadata pencil (#429 phase 3)', ()
     expect(app.mutateWorkspace).toHaveBeenCalledTimes(1);
   });
 
+  it('repeated activation opens exactly ONE dialog', () => {
+    // #494: "repeated activation cannot open duplicate dialogs". A keyboard
+    // autorepeat fires again while focus is still on the trigger, before the
+    // dialog's own deferred focus move — and two shells would mean two modal
+    // keyboard owners and a duplicate of every field id.
+    const { list } = treeApp();
+    renderDashboardTree(treeApp().app);
+    const { app } = treeApp();
+    renderDashboardTree(app);
+    const trigger = actionBtn(app.dom.dashboardTreeList!, 'w1:sales', 'Edit dashboard Sales')!;
+    click(trigger);
+    click(trigger);
+    click(trigger);
+    expect(document.querySelectorAll('.fm-dialog-card')).toHaveLength(1);
+    expect(document.querySelectorAll('#dash-rename-name')).toHaveLength(1);
+    expect(list).toBeDefined();
+  });
+
+  it('still restores focus when the row the dialog belonged to is gone', async () => {
+    // Another tab deletes the Dashboard while its rename dialog is open. The
+    // trigger AND its row are detached by the time the user cancels.
+    const { app, list } = treeApp();
+    renderDashboardTree(app);
+    click(actionBtn(list, 'w1:sales', 'Edit dashboard Sales')!);
+    (app.currentWorkspace as unknown as TreeWorkspace).dashboards = [];
+    renderDashboardTree(app);
+    click(document.querySelector<HTMLButtonElement>('.fm-dialog-cancel')!);
+    await settle();
+    expect(document.activeElement).toBe(app.dom.dashboardSearchInput);
+  });
+
   it('does not also run the row\'s own navigation, and cancels only its own row\'s pending click', () => {
     vi.useFakeTimers();
     const { app, list } = treeApp();
diff --git a/tests/unit/dialog-shell.test.ts b/tests/unit/dialog-shell.test.ts
index ca04b0ea..af23e3d0 100644
--- a/tests/unit/dialog-shell.test.ts
+++ b/tests/unit/dialog-shell.test.ts
@@ -187,16 +187,29 @@ describe('openDialogShell — dialog semantics', () => {
     expect(title.textContent).toBe('Edit dashboard');
   });
 
-  it('gives two coexisting dialogs distinct title ids', () => {
-    // A stale dialog can still be mounted while a newer one opens; a shared
-    // constant id would make both `aria-labelledby`s resolve to the first.
+  it('mounts ONE modal: a second open replaces the first', () => {
+    // #494 forbids repeated activation opening duplicate dialogs, and two
+    // shells would mean two modal keyboard owners, two capture-phase key
+    // listeners, and a duplicate of every `id` the caller's fields carry.
     const app = makeApp();
     track(openDialogShell(app, 'A', [h('span', {}, 'a')], { returnFocusTo: null }));
     track(openDialogShell(app, 'B', [h('span', {}, 'b')], { returnFocusTo: null }));
-    const [a, b] = [...document.querySelectorAll('.fm-dialog-card')];
-    expect(a.getAttribute('aria-labelledby')).not.toBe(b.getAttribute('aria-labelledby'));
-    expect(document.getElementById(a.getAttribute('aria-labelledby')!)!.textContent).toBe('A');
-    expect(document.getElementById(b.getAttribute('aria-labelledby')!)!.textContent).toBe('B');
+    const cards = [...document.querySelectorAll('.fm-dialog-card')];
+    expect(cards).toHaveLength(1);
+    expect(cards[0].querySelector('.fm-dialog-title')!.textContent).toBe('B');
+  });
+
+  it('gives successive dialogs distinct title ids', () => {
+    // Never a constant: a stale card can still be in the document while its
+    // replacement mounts, and a shared id would make both `aria-labelledby`s
+    // resolve to whichever the document matched first.
+    const app = makeApp();
+    track(openDialogShell(app, 'A', [h('span', {}, 'a')], { returnFocusTo: null }));
+    const first = document.querySelector('.fm-dialog-card')!.getAttribute('aria-labelledby');
+    track(openDialogShell(app, 'B', [h('span', {}, 'b')], { returnFocusTo: null }));
+    const second = document.querySelector('.fm-dialog-card')!.getAttribute('aria-labelledby');
+    expect(second).not.toBe(first);
+    expect(document.getElementById(second!)!.textContent).toBe('B');
   });
 });
 
@@ -373,18 +386,18 @@ describe('closeOpenDialogShell', () => {
     expect(backdropOf()).toBeNull();
   });
 
-  it('a STALE dialog closing on its own does not clobber a NEWER one\'s tracked slot', () => {
+  it('a STALE dialog closing again does not clobber the NEWER one\'s tracked slot', () => {
     const app = makeApp();
     const handleA = openDialogShell(app, 'A', [h('span', {}, 'A body')], { returnFocusTo: null });
-    // A second dialog opens without the first being closed first (the modal
-    // keyboard-owner stack does not itself prevent this).
+    // Opening B force-closes A (one modal at a time) …
     openDialogShell(app, 'B', [h('span', {}, 'B body')], { returnFocusTo: null });
-    expect(document.querySelectorAll('.fm-dialog-backdrop').length).toBe(2);
+    expect(document.querySelectorAll('.fm-dialog-backdrop').length).toBe(1);
+    expect(document.querySelector('.fm-dialog-title')!.textContent).toBe('B');
 
-    // A's own close must remove only ITS backdrop, and must not null out the
-    // module's "currently open" slot — which by now points at B, not A.
+    // … and a caller still holding A's handle may close it again. That second
+    // close must not null the module's "currently open" slot, which by now
+    // points at B.
     handleA.close();
-    expect(document.querySelectorAll('.fm-dialog-backdrop').length).toBe(1);
     expect(document.querySelector('.fm-dialog-title')!.textContent).toBe('B');
 
     // The slot still resolves to B, so a surface-transition teardown reaches it.

From fb6e7b5df8b0a16941a6655595fc7f3c38f24c6f Mon Sep 17 00:00:00 2001
From: Boris Tyshkevich <btyshkevich@altinity.com>
Date: Mon, 27 Jul 2026 15:18:21 +0000
Subject: [PATCH 6/8] fix(#494): make the model and the commands agree, and
 close() idempotent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review round 4. All four findings verified in the code first; each fix is
sabotage-checked (reverting them together fails five tests).

**`DialogHandle.close()` was not idempotent.** Now that opening a dialog
force-closes the previous one, a caller can legitimately still hold a handle
whose dialog is gone — and a second `close()` re-ran the focus restore (stealing
focus from behind the modal that replaced it) and the caller's `onClose`. One
`torndown` flag per handle. The previous round's double-close test was fair game
for the criticism: it passed no `returnFocusTo` and no `onClose`, so it only
proved the replacement stayed mounted. The new one asserts both.

**The model offered controls the commands would refuse.** The tree's projection
collapses duplicate query ids into one map entry (last wins), so availability
was decided from whichever document won — while both commit paths require
exactly one. A pencil that opens a dialog only to refuse at the end of it is
worse than one that says up front why it cannot act. Cardinality is counted
during derivation now, with its own reason.

**A description-only tile override warned about nothing.** The viewer resolves a
tile's body text as `tile.description || query description`, exactly as it
resolves the heading from `tile.title || query name`. The note detected only the
title, so an imported tile carrying just a description let the user edit a query
description the tile goes on ignoring, silently. Both are detected
independently and the sentence is composed from what is actually masked.

**The whole-Dashboard delete cascaded into a non-panel query** while the
single-panel delete refuses one — answering the reviewer's open question in the
direction the narrower command already set: a tile referencing a Setup-role
query is malformed data, and destroying that query as a side effect of removing
its Dashboard is the cascade #494's fail-closed rule forbids. It survives as a
Library query.

CHANGELOG: the phase-3 entry still described the pencil as sitting beside the
`⋯` and said there was no Dashboard trash — both superseded within the same
unreleased section.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018mujm1kW7jDGpTEfscndcU
---
 CHANGELOG.md                                  | 12 +++++----
 src/application/dashboard-tree-model.ts       | 19 +++++++++++--
 .../application/dashboard-removal.ts          | 15 ++++++++---
 src/ui/dashboard-tree.ts                      | 27 ++++++++++++++++---
 src/ui/dialog-shell.ts                        |  8 ++++++
 tests/unit/dashboard-removal.test.ts          | 14 ++++++++++
 tests/unit/dashboard-tree-model.test.ts       | 25 +++++++++++++++++
 tests/unit/dashboard-tree.test.ts             | 24 ++++++++++++++++-
 tests/unit/dialog-shell.test.ts               | 24 +++++++++++++++++
 9 files changed, 152 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 984b62f4..85580a5a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,11 +46,13 @@ auto-generated per-PR notes; this file is the curated, human-readable history.
   Not yet included: the **Open in Dashboard** focus button, which is held back
   until #438 fixes tile focus on flow-layout KPI tiles.
 - **A Dashboard row's pencil edits its title and description** (#429 phase 3).
-  Revealed on hover/focus-within next to the existing `⋯`, it opens a small
-  dialog prefilled from the Dashboard's own committed document — Cancel and
-  Escape commit nothing, a blank title disables Save, and a real commit bumps
-  only that Dashboard's revision and refreshes the tree and any open Dashboard
-  surface. There is still no Dashboard **trash** action.
+  It opens a small dialog prefilled from the Dashboard's own committed
+  document — Cancel and Escape commit nothing, a blank title disables Save, and
+  a real commit bumps only that Dashboard's revision and refreshes the tree and
+  any open Dashboard surface. (Phase 3 put this pencil beside the row's `⋯`
+  menu and shipped no Dashboard trash; #494 above then removed that menu and
+  added the trash, so what ships in this release is the pencil as part of the
+  direct-action cluster.)
 - **Drag a Library query onto a Dashboard to assign it** (#428). One drag from the
   lower Library list now has three destination-dependent meanings, and the row
   publishes two independent payloads to serve them:
diff --git a/src/application/dashboard-tree-model.ts b/src/application/dashboard-tree-model.ts
index 054d9043..5210d004 100644
--- a/src/application/dashboard-tree-model.ts
+++ b/src/application/dashboard-tree-model.ts
@@ -422,6 +422,12 @@ const MISSING_PANEL_QUERY_REASON =
   'This panel’s query is not in this workspace, so there is nothing to edit or remove.';
 const UNPROVEN_OWNERSHIP_REASON =
   'This panel’s query is shared with another panel, so it cannot be edited or removed here.';
+/** Two saved-query documents carry this id (`workspace-duplicate-query-id`).
+ *  Which one the pencil would edit has no answer, so neither control is
+ *  offered — and the commit paths refuse the same state, which is the point:
+ *  a control must not open a dialog only to refuse at the end of it. */
+const AMBIGUOUS_QUERY_REASON =
+  'Two saved queries in this workspace share this panel’s query id, so it cannot be edited or removed here.';
 /** A tile may only reference a PANEL-role query (`dashboard-setup-reference` /
  *  `dashboard-tile-role-incompatible` in the semantic validator). Editing or
  *  deleting through a tile that references, say, a Setup query would silently
@@ -458,6 +464,13 @@ export function deriveDashboardTree(
   // Tiles with no `queryId` are dropped on the way in because ownership is
   // exactly the set of tile→query references; a tile that references nothing
   // owns nothing, and its panel row's edit/delete are unavailable anyway.
+  // How many DOCUMENTS carry each id — not the same question as how many
+  // owners reference it. `queryMap` above collapses duplicates (last wins), so
+  // the availability rule below cannot read cardinality off it.
+  const documentsById = new Map<string, number>();
+  for (const query of workspace?.queries ?? []) {
+    documentsById.set(query.id, (documentsById.get(query.id) ?? 0) + 1);
+  }
   const ownership = buildQueryOwnershipIndex({
     queries: workspace?.queries ?? [],
     dashboards: dashboards.map((dashboard) => ({
@@ -485,10 +498,12 @@ export function deriveDashboardTree(
     const owned = owners.length === 1
       && owners[0].dashboardId === dashboardId && owners[0].tileId === tileId;
     const rightRole = queryId !== null && queryDashboardRole(queries.get(queryId)) === 'panel';
-    if (queryId === null || !owned || !rightRole) {
+    const unique = queryId !== null && documentsById.get(queryId) === 1;
+    if (queryId === null || !owned || !unique || !rightRole) {
       const reason = queryId === null
         ? MISSING_PANEL_QUERY_REASON
-        : (owned ? WRONG_ROLE_REASON : UNPROVEN_OWNERSHIP_REASON);
+        : (!owned ? UNPROVEN_OWNERSHIP_REASON
+          : (!unique ? AMBIGUOUS_QUERY_REASON : WRONG_ROLE_REASON));
       return [
         unavailableAction('edit-panel', 'Edit ' + label, reason),
         unavailableAction('delete-panel', 'Remove ' + label + ' from dashboard', reason),
diff --git a/src/dashboard/application/dashboard-removal.ts b/src/dashboard/application/dashboard-removal.ts
index a21da9df..70e86a3c 100644
--- a/src/dashboard/application/dashboard-removal.ts
+++ b/src/dashboard/application/dashboard-removal.ts
@@ -154,9 +154,9 @@ export type DashboardRemovalResult =
  * Remove ONE whole Dashboard document and, recursively, the queries its own
  * tiles own — the document-level counterpart to `removeDashboardPanel` above.
  *
- * A tile's `queryId` joins the delete set only when BOTH hold: the query
- * still exists in `workspace.queries`, and every owner `ownersOfQuery` reports
- * for it belongs to THIS Dashboard. The second half is what protects the
+ * A tile's `queryId` joins the delete set only when ALL of these hold: exactly
+ * one query document carries it, every owner `ownersOfQuery` reports for it
+ * belongs to THIS Dashboard, and it is a PANEL query. The second half is what protects the
  * invalid multi-owner state (a query some other Dashboard's tile also
  * references) rather than trusting that this Dashboard's own reference is the
  * only one — deleting a query another Dashboard still renders would trade one
@@ -199,7 +199,14 @@ export function removeDashboardDocument(input: {
     // filter, so deleting "it" would delete both. Keep them, and let the
     // Dashboard go without them — an orphaned copy is recoverable, a
     // destroyed one is not.
-    if (workspace.queries.filter((query) => query.id === queryId).length > 1) continue;
+    const documents = workspace.queries.filter((query) => query.id === queryId);
+    if (documents.length > 1) continue;
+    // Same rule the single-panel delete applies: only a PANEL query is a
+    // dedicated copy this Dashboard may take with it. A tile referencing a
+    // Setup- or other-role query is malformed data, and destroying that query
+    // as a side effect of removing the Dashboard would be the cascade #494's
+    // fail-closed rule forbids — it survives as a Library query instead.
+    if (queryDashboardRole(documents[0]) !== 'panel') continue;
 
     // Present by construction: `dashboardOwnedQueryIds` is exactly the ids
     // `ownersByQueryId` carries an owner list for.
diff --git a/src/ui/dashboard-tree.ts b/src/ui/dashboard-tree.ts
index 8d27af3c..1e0afef0 100644
--- a/src/ui/dashboard-tree.ts
+++ b/src/ui/dashboard-tree.ts
@@ -1060,7 +1060,14 @@ function openPanelMetadataDialog(
   const tile = app.currentWorkspace?.dashboards
     ?.find((dashboard) => dashboard.id === target.dashboardId)
     ?.tiles?.find((entry) => entry.id === target.tileId);
-  const overridden = (tile?.title ?? '').trim() !== '';
+  // BOTH overrides mask, and independently: the viewer resolves a tile's
+  // heading as `tile.title || query name` and its body text as
+  // `tile.description || query description`
+  // (`dashboard-viewer-session.ts`). An imported tile carrying only a
+  // description would otherwise let the user edit a query description that
+  // the rendered tile goes on ignoring, with nothing said.
+  const maskedName = (tile?.title ?? '').trim() !== '';
+  const maskedDescription = (tile?.description ?? '').trim() !== '';
   openMetadataDialog({ document: doc, acquireKeyboardOwner: app.acquireKeyboardOwner }, {
     title: 'Edit panel',
     nameLabel: 'Query name',
@@ -1069,9 +1076,7 @@ function openPanelMetadataDialog(
     description: query?.spec?.description ?? '',
     confirmLabel: 'Save',
     idPrefix: 'panel-metadata',
-    note: overridden
-      ? 'This tile was imported with its own title, which keeps priority over the query name here.'
-      : null,
+    note: overrideNote(maskedName, maskedDescription),
     returnFocusTo: returnFocusAfterDialog(app, trigger, row.key),
     onClose: () => trigger.setAttribute('aria-expanded', 'false'),
     onConfirm: async ({ name, description }) => panelMetadataMessage(
@@ -1080,6 +1085,20 @@ function openPanelMetadataDialog(
   });
 }
 
+/** What to warn about when an imported tile carries its own title and/or
+ *  description: those keep display precedence over the query fields this
+ *  dialog edits, so the commit will not change what the tile renders. `null`
+ *  when neither is overridden — the ordinary case. */
+const overrideNote = (maskedName: boolean, maskedDescription: boolean): string | null => {
+  if (!maskedName && !maskedDescription) return null;
+  const masked = maskedName && maskedDescription ? 'title and description'
+    : (maskedName ? 'title' : 'description');
+  const fields = maskedName && maskedDescription ? 'these fields'
+    : (maskedName ? 'the query name' : 'the query description');
+  return 'This tile was imported with its own ' + masked
+    + ', which keeps priority over ' + fields + ' here.';
+};
+
 /** The tree's slice of `PanelMetadataDeps`. `refreshCommittedSurfaces` is the
  *  same poke every other tree write sends — a rendered Dashboard reads its
  *  document at construction, so a renamed tile would otherwise keep its old
diff --git a/src/ui/dialog-shell.ts b/src/ui/dialog-shell.ts
index 12ce9ac1..ee836207 100644
--- a/src/ui/dialog-shell.ts
+++ b/src/ui/dialog-shell.ts
@@ -92,7 +92,15 @@ export function openDialogShell(
   const doc = app.document;
   const releaseKeyboard = app.acquireKeyboardOwner('modal');
   let backdrop: HTMLElement;
+  // One teardown per dialog, however many times its handle is closed. Since a
+  // new dialog force-closes the previous one, a caller can legitimately still
+  // hold — and call — a handle whose dialog is already gone; without this,
+  // that second call would restore focus (stealing it from behind the modal
+  // that replaced it) and run the caller's `onClose` a second time.
+  let torndown = false;
   const close = (): void => {
+    if (torndown) return;
+    torndown = true;
     doc.removeEventListener('keydown', onKey, true);
     detachBackdrop();
     // Guard against a STALE dialog's close clobbering a newer one's tracked
diff --git a/tests/unit/dashboard-removal.test.ts b/tests/unit/dashboard-removal.test.ts
index cbc6e1c6..4711203c 100644
--- a/tests/unit/dashboard-removal.test.ts
+++ b/tests/unit/dashboard-removal.test.ts
@@ -299,4 +299,18 @@ describe('removeDashboardDocument — ambiguous ids (#494)', () => {
     expect(result.removedQueryIds).toEqual([]);
     expect(result.workspace.queries.map((query) => query.id)).toEqual(['p1', 'p1', 'lib']);
   });
+
+  it('keeps a non-PANEL query its tile referenced, rather than cascading into it', () => {
+    // The single-panel delete refuses such a tile outright; removing the whole
+    // Dashboard must not quietly do what the narrower command declines to.
+    const setup = { ...panelQuery('s1'), spec: { name: 's1', dashboard: { role: 'setup' } } };
+    const input = workspace({
+      queries: [panelQuery('p1'), setup as typeof input.queries[number]],
+      dashboards: [dashboard({ tiles: [{ id: 't1', queryId: 'p1' }, { id: 't2', queryId: 's1' }] })],
+    });
+    const result = removeDashboardDocument({ workspace: input, dashboardId: 'dash' });
+    if (result.status !== 'ok') throw new Error(`expected ok, got ${result.status}`);
+    expect(result.removedQueryIds).toEqual(['p1']);
+    expect(result.workspace.queries.map((query) => query.id)).toEqual(['s1']);
+  });
 });
diff --git a/tests/unit/dashboard-tree-model.test.ts b/tests/unit/dashboard-tree-model.test.ts
index 25c05842..6c5a8776 100644
--- a/tests/unit/dashboard-tree-model.test.ts
+++ b/tests/unit/dashboard-tree-model.test.ts
@@ -1113,4 +1113,29 @@ describe('deriveDashboardTree — Library-query drop targets (#428)', () => {
     expect(panel.single).not.toBeNull();
     expect(panel.double).not.toBeNull();
   });
+
+  it('withholds edit and delete when TWO query documents carry the panel\'s query id', () => {
+    // The commit paths refuse this state, so the model must not offer a
+    // control that opens a dialog only to refuse at the end of it. The
+    // projection collapses duplicates into one map entry, so cardinality is
+    // counted separately.
+    const query = { id: 'q1', sql: 'SELECT 1', spec: { name: 'Twin' } };
+    const tree = deriveDashboardTree({
+      workspace: {
+        id: 'w1',
+        queries: [query, query],
+        dashboards: [{ id: 'd1', title: 'D', tiles: [{ id: 't1', queryId: 'q1' }] }],
+      },
+      surface: QUERY_SURFACE,
+      ui: allOpen(['d1']),
+    });
+    const panel = tree.rows.find((row) => row.kind === 'panel')!;
+    expect(panel.actions.map((action) => action.kind)).toEqual(['edit-panel', 'delete-panel']);
+    for (const action of panel.actions) {
+      expect(action.target).toBeNull();
+      expect(action.unavailable).toBe(
+        'Two saved queries in this workspace share this panel’s query id, so it cannot be edited or removed here.',
+      );
+    }
+  });
 });
diff --git a/tests/unit/dashboard-tree.test.ts b/tests/unit/dashboard-tree.test.ts
index 99fbab4c..a495c8c2 100644
--- a/tests/unit/dashboard-tree.test.ts
+++ b/tests/unit/dashboard-tree.test.ts
@@ -1041,7 +1041,29 @@ describe('renderDashboardTree — panel metadata pencil (#494)', () => {
     // …while the field it edits is still the query's own name.
     expect(nameInput().value).toBe('Revenue');
     expect(document.querySelector('.fm-dialog-note')!.textContent)
-      .toContain('keeps priority over the query name');
+      .toBe('This tile was imported with its own title, which keeps priority over the query name here.');
+    expect(list).toBeDefined();
+  });
+
+  // The viewer resolves a tile's body text as `tile.description || query
+  // description`, exactly as it resolves the heading — so an imported
+  // DESCRIPTION masks the field being edited just as a title does, and used to
+  // do it silently.
+  it.each<[string, { title?: string; description?: string }, string]>([
+    ['description only', { description: 'Imported blurb' },
+      'This tile was imported with its own description, which keeps priority over the query description here.'],
+    ['both', { title: 'Imported heading', description: 'Imported blurb' },
+      'This tile was imported with its own title and description, which keeps priority over these fields here.'],
+  ])('warns about an imported %s override', (_name, over, expected) => {
+    const { app } = treeApp();
+    const dashboards = (app.currentWorkspace as unknown as TreeWorkspace).dashboards!;
+    dashboards[0]!.tiles = [{ id: 't1', queryId: 'q1', ...over }];
+    app.state.savedQueries = [query('q1', 'Revenue')];
+    openAll(app, 'sales');
+    renderDashboardTree(app);
+    const label = 'Edit ' + (over.title ?? 'Revenue');
+    click(actionBtn(app.dom.dashboardTreeList!, 'w1:sales:tile:t1', label)!);
+    expect(document.querySelector('.fm-dialog-note')!.textContent).toBe(expected);
   });
 
   it('commits name and description onto the owned query and closes', async () => {
diff --git a/tests/unit/dialog-shell.test.ts b/tests/unit/dialog-shell.test.ts
index af23e3d0..89d14ccc 100644
--- a/tests/unit/dialog-shell.test.ts
+++ b/tests/unit/dialog-shell.test.ts
@@ -399,6 +399,30 @@ describe('closeOpenDialogShell', () => {
     // points at B.
     handleA.close();
     expect(document.querySelector('.fm-dialog-title')!.textContent).toBe('B');
+  });
+
+  it('a stale close is inert: no focus move, no second onClose', () => {
+    // The teardown is per-handle idempotent. Without that, closing an
+    // already-replaced dialog would restore focus — stealing it from behind
+    // the modal that replaced it — and run the caller's own cleanup twice.
+    const app = makeApp();
+    const trigger = h('button', {}, 'A trigger') as HTMLButtonElement;
+    document.body.appendChild(trigger);
+    const onClose = vi.fn();
+    const handleA = openDialogShell(app, 'A', [h('button', {}, 'a')], {
+      returnFocusTo: trigger, onClose,
+    });
+    track(openDialogShell(app, 'B', [h('button', {}, 'b')], { returnFocusTo: null }));
+    // Opening B tore A down exactly once.
+    expect(onClose).toHaveBeenCalledTimes(1);
+    const bButton = document.querySelector<HTMLButtonElement>('.fm-dialog-card button')!;
+    bButton.focus();
+
+    handleA.close();
+
+    expect(onClose).toHaveBeenCalledTimes(1);
+    expect(document.activeElement).toBe(bButton);
+    trigger.remove();
 
     // The slot still resolves to B, so a surface-transition teardown reaches it.
     closeOpenDialogShell();

From d2de4265988b58d35d4313828e98a8b15f715f0f Mon Sep 17 00:00:00 2001
From: Boris Tyshkevich <btyshkevich@altinity.com>
Date: Mon, 27 Jul 2026 18:41:52 +0200
Subject: [PATCH 7/8] fix(#494): fail closed on ambiguous Dashboard/tile
 identity, fix trigger-reveal race
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review round 5. Four findings, each verified against the code and
sabotage-checked before landing.

**Repeated activation could leave the trigger's `aria-expanded` stuck
`"false"` while its replacement dialog was open.** Both pencils set
`aria-expanded="true"` before calling `openMetadataDialog`, which force-closes
any dialog already open — and that closing dialog's own `onClose` resets the
SAME trigger back to `"false"`, landing after the "true" this same click set.
Since the trigger's hover-reveal CSS keys off exactly that attribute, the
result was a trigger invisible (and unfocusable) for as long as the
replacement stayed open. Fixed by closing the existing shell before setting
the attribute, not after. Added a real-browser e2e regression for each
pencil, dispatching repeated `.click()` directly (the fair proxy for the
keyboard autorepeat that is the only real way to reach a trigger a modal
backdrop already covers) and sabotage-verified against the pre-fix code.

**A duplicated Dashboard or tile id could still commit through the pencil
while the neighbouring trash already refused it.** The tree's own
availability rule and `ownedByPanel` both asked "is there at least one
match" rather than "is there exactly one" — so two Dashboard documents
sharing an id, or two tiles of the same Dashboard sharing an id (even
referencing different queries), passed the #427 ownership check untouched:
each query still looked, independently, like its sole owner. Both now count
Dashboard and Dashboard-local tile ids during the same pass that counts query
ids, and `ownedByPanel` resolves through `findDashboardStrict` plus an
exact-one-tile filter instead of a loose `.some(...)` — the same resolution
`removeDashboardPanel` already used.

**A whitespace-only tile description masked the query's own description with
nothing, silently.** The viewer resolved `tile.description || query
description` untrimmed, while the tree's own override-warning note already
trimmed before deciding whether to show a caveat — so a `"   "` description
was schema-legal, masked the query field exactly like a real override, and
never triggered the warning that a real override would have. Trimmed the
viewer's resolution to match its own title-trim precedent (#476).

**A duplicated unit test.** Two consecutive, identical "focuses Cancel by
default" tests — merge-resolution debris. Removed one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019LVPCmA3tJHwv6a25MRkJs
---
 CHANGELOG.md                                  | 18 +++++
 src/application/dashboard-panel-metadata.ts   | 38 ++++++----
 src/application/dashboard-tree-model.ts       | 76 ++++++++++++++++---
 .../application/dashboard-viewer-session.ts   |  8 +-
 src/ui/dashboard-tree.ts                      | 16 +++-
 tests/e2e/dashboard-tree.spec.js              | 52 +++++++++++++
 tests/unit/dashboard-panel-metadata.test.ts   | 31 ++++++++
 tests/unit/dashboard-tree-model.test.ts       | 60 +++++++++++++++
 tests/unit/dashboard-tree.test.ts             | 49 +++++++++---
 tests/unit/dashboard-viewer-session.test.ts   | 27 +++++++
 10 files changed, 340 insertions(+), 35 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c3619b3..ce25d468 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -45,6 +45,24 @@ auto-generated per-PR notes; this file is the curated, human-readable history.
   to a non-panel query all refuse and say why, rather than deleting whatever
   the tile happens to point at by then.
 
+  A fifth review pass found the Dashboard/tile identity check was looser than
+  delete's own: both the tree's availability rule and the metadata guard asked
+  "is there at least one match" rather than "is there exactly one", so two
+  Dashboard documents sharing an id — or two tiles of the *same* Dashboard
+  sharing an id, even when they reference different queries — could still
+  offer a pencil that delete already refused. Both now count Dashboard and
+  Dashboard-local tile ids the same pass counts query ids, and refuse
+  identically. The pencil's own rapid-reactivation race is fixed too:
+  replacing an already-open dialog force-closes it first, and that closing
+  dialog's `onClose` used to reset the *same* trigger's `aria-expanded` back to
+  `"false"` right after the new dialog had just set it `"true"` — stranding
+  the trigger effectively unfocusable for as long as the replacement stayed
+  open. And the viewer's tile-description override now trims before the
+  fallback, matching its title override (#476): a whitespace-only description
+  is schema-legal and was silently masking the query's own description with
+  nothing, since the tree's own warning note already trimmed and so never
+  fired for it.
+
   Not yet included: the **Open in Dashboard** focus button, which is held back
   until #438 fixes tile focus on flow-layout KPI tiles.
 - **Closing a dirty tab, or leaving the page, now confirms first** (#466). The
diff --git a/src/application/dashboard-panel-metadata.ts b/src/application/dashboard-panel-metadata.ts
index a78f7e27..b5c7bb4c 100644
--- a/src/application/dashboard-panel-metadata.ts
+++ b/src/application/dashboard-panel-metadata.ts
@@ -25,6 +25,7 @@ import { renameSaved } from '../state.js';
 import type { AppState, MutateWorkspace, SpecValidationService } from '../state.js';
 import { ownersOfQuery } from '../dashboard/model/query-ownership.js';
 import { queryDashboardRole } from '../dashboard/model/workspace-semantics.js';
+import { findDashboardStrict } from '../workspace/workspace-dashboards.js';
 import type { SavedQueryV2, StoredWorkspaceV5 } from '../generated/json-schema.types.js';
 
 /** Which owned query to edit, addressed the way #430 requires — Dashboard id +
@@ -69,24 +70,35 @@ export interface PanelMetadataDeps {
  * Exported because the tree model answers the same question when it decides
  * whether to enable the pencil at all — the difference is only WHEN it is
  * asked (paint time there, dequeue time here), and the two must agree.
+ *
+ * Dashboard and tile identity are resolved STRICTLY, the same way
+ * `removeDashboardPanel` resolves them, rather than by a loose `.some(...)`
+ * membership check: a duplicated Dashboard id or a duplicated Dashboard-local
+ * tile id refuses here even when the query-ownership index alone cannot see
+ * it. Two tiles sharing an id but referencing different queries would each
+ * otherwise still look, independently, like that query's sole owner — the
+ * `.some(...)` check never asked "how many", only "does at least one match".
  */
 export function ownedByPanel(
   workspace: StoredWorkspaceV5, target: PanelMetadataTarget,
 ): boolean {
-  const owners = ownersOfQuery(workspace, target.queryId);
+  const lookup = findDashboardStrict(workspace, target.dashboardId);
+  if (lookup.status !== 'ok') return false;
+
+  const tiles = lookup.dashboard.tiles.filter((tile) => tile.id === target.tileId);
+  if (tiles.length !== 1 || tiles[0].queryId !== target.queryId) return false;
+
+  // Exactly one document, and a PANEL one: an ambiguous id would make "which
+  // query am I editing" unanswerable, and a Setup- or other-role reference is
+  // malformed data this must not quietly write over.
   const matching = workspace.queries.filter((query) => query.id === target.queryId);
-  return owners.length === 1
-    && owners[0].dashboardId === target.dashboardId
-    && owners[0].tileId === target.tileId
-    // Exactly one document, and a PANEL one: an ambiguous id would make
-    // "which query am I editing" unanswerable, and a Setup- or other-role
-    // reference is malformed data this must not quietly write over.
-    && matching.length === 1
-    && queryDashboardRole(matching[0]) === 'panel'
-    // The tile must still point AT it — the pair is the identity, and a tile
-    // re-pointed while the dialog was open is a different resource.
-    && workspace.dashboards.some((dashboard) => dashboard.id === target.dashboardId
-      && dashboard.tiles.some((tile) => tile.id === target.tileId && tile.queryId === target.queryId));
+  if (matching.length !== 1 || queryDashboardRole(matching[0]) !== 'panel') return false;
+
+  // The sole owner is never re-checked against `dashboardId`/`tileId` by hand
+  // — same as `removeDashboardPanel`'s own comment: whenever this reports
+  // exactly one owner for a query id this exact (now uniquely resolved) tile
+  // references, that owner IS this Dashboard and this tile.
+  return ownersOfQuery(workspace, target.queryId).length === 1;
 }
 
 /**
diff --git a/src/application/dashboard-tree-model.ts b/src/application/dashboard-tree-model.ts
index 5210d004..af6e9548 100644
--- a/src/application/dashboard-tree-model.ts
+++ b/src/application/dashboard-tree-model.ts
@@ -434,6 +434,19 @@ const AMBIGUOUS_QUERY_REASON =
  *  repair the workspace by destroying the evidence — fail closed instead. */
 const WRONG_ROLE_REASON =
   'This panel references a query that is not a panel query, so it cannot be edited or removed here.';
+/** Two Dashboard documents carry this id. Which one a Dashboard-level edit or
+ *  delete would act on has no answer — the same "a control must not open a
+ *  dialog only to refuse at the end of it" rule `AMBIGUOUS_QUERY_REASON`
+ *  states, applied to the Dashboard identity delete already refuses on
+ *  (`dashboard-duplicate` in `removeDashboardDocument`/`removeDashboardPanel`). */
+const AMBIGUOUS_DASHBOARD_REASON =
+  'Two dashboards in this workspace share this id, so it cannot be edited or removed here.';
+/** Two tiles in the SAME Dashboard carry this id — even when they reference
+ *  different queries. Each would otherwise look, independently, like that
+ *  query's sole owner (`ownersOfQuery` cannot tell them apart), so this is
+ *  checked ahead of ownership rather than folded into it. */
+const AMBIGUOUS_TILE_REASON =
+  'Two panels in this dashboard share this id, so it cannot be edited or removed here.';
 
 /** One trailing control, available. */
 const action = (
@@ -471,6 +484,15 @@ export function deriveDashboardTree(
   for (const query of workspace?.queries ?? []) {
     documentsById.set(query.id, (documentsById.get(query.id) ?? 0) + 1);
   }
+  // How many Dashboard DOCUMENTS carry each Dashboard id — the same shape of
+  // count as `documentsById` above, one level up. `deleteDashboardDocument`/
+  // `removeDashboardPanel` already refuse a duplicated Dashboard id
+  // (`dashboard-duplicate`); this is what lets the row's own pencil/trash
+  // agree ahead of a commit rather than opening a dialog that then refuses.
+  const dashboardIdCounts = new Map<string, number>();
+  for (const dashboard of dashboards) {
+    dashboardIdCounts.set(dashboard.id, (dashboardIdCounts.get(dashboard.id) ?? 0) + 1);
+  }
   const ownership = buildQueryOwnershipIndex({
     queries: workspace?.queries ?? [],
     dashboards: dashboards.map((dashboard) => ({
@@ -493,7 +515,21 @@ export function deriveDashboardTree(
    */
   const panelActions = (
     dashboardId: string, dashboardLabel: string, tileId: string, label: string, queryId: string | null,
+    identityReason: string | null,
   ): DashboardTreeAction[] => {
+    // Checked BEFORE ownership, not folded into it: a duplicated Dashboard or
+    // Dashboard-local tile id is ambiguous on its own terms, and the #427
+    // ownership index — keyed by query id — cannot see it. Two tiles sharing
+    // an id but referencing different queries each look, independently, like
+    // that query's sole owner; this is what keeps the model agreeing with
+    // `removeDashboardPanel`'s own `dashboard-duplicate`/`tile-duplicate`
+    // refusals instead of offering a pencil delete already refuses.
+    if (identityReason !== null) {
+      return [
+        unavailableAction('edit-panel', 'Edit ' + label, identityReason),
+        unavailableAction('delete-panel', 'Remove ' + label + ' from dashboard', identityReason),
+      ];
+    }
     const owners = queryId === null ? [] : ownership.ownersByQueryId.get(queryId) ?? [];
     const owned = owners.length === 1
       && owners[0].dashboardId === dashboardId && owners[0].tileId === tileId;
@@ -535,6 +571,14 @@ export function deriveDashboardTree(
     const dashboardMatched = search !== '' && hits([title, description]);
 
     const tiles = dashboard.tiles ?? [];
+    const dashboardIdDuplicated = (dashboardIdCounts.get(dashboard.id) ?? 0) > 1;
+    // Dashboard-LOCAL tile-id cardinality: two tiles of the SAME Dashboard
+    // sharing an id, never a count across Dashboards — a tile id is only ever
+    // addressed together with its owning Dashboard id (#430).
+    const tileIdCounts = new Map<string, number>();
+    for (const tile of tiles) {
+      tileIdCounts.set(tile.id, (tileIdCounts.get(tile.id) ?? 0) + 1);
+    }
     const tileEntries = tileEntriesOf(dashboard, queries);
     // #447: the variable rows come from the pure inference service, over THIS
     // Dashboard's panel-owned queries plus its stored option SQL.
@@ -583,14 +627,26 @@ export function deriveDashboardTree(
       // gone — *Open in Edit* was its last item, and a menu button that opens
       // a one-item menu beside two real controls is chrome, not vocabulary.
       // Shift-click / Shift+Enter remain the Edit gesture (`shift` below).
-      actions: [
-        action('edit-dashboard', 'Edit dashboard ' + (title || UNTITLED_DASHBOARD),
-          'Edit dashboard title & description', { kind: 'dashboard', dashboardId: dashboard.id }),
-        action('delete-dashboard', 'Delete dashboard ' + (title || UNTITLED_DASHBOARD),
-          'Delete dashboard', { kind: 'dashboard', dashboardId: dashboard.id },
-          'Delete dashboard ' + quoted(title || UNTITLED_DASHBOARD)
-          + '? This also deletes every query its panels own.'),
-      ],
+      //
+      // A duplicated Dashboard id leaves both unavailable: `findDashboardStrict`
+      // already refuses `dashboard-duplicate` for both removal paths, and a
+      // rename has no less ambiguous a target — offering a pencil that a
+      // commit would only refuse is the exact bug this closes.
+      actions: dashboardIdDuplicated
+        ? [
+          unavailableAction('edit-dashboard', 'Edit dashboard ' + (title || UNTITLED_DASHBOARD),
+            AMBIGUOUS_DASHBOARD_REASON),
+          unavailableAction('delete-dashboard', 'Delete dashboard ' + (title || UNTITLED_DASHBOARD),
+            AMBIGUOUS_DASHBOARD_REASON),
+        ]
+        : [
+          action('edit-dashboard', 'Edit dashboard ' + (title || UNTITLED_DASHBOARD),
+            'Edit dashboard title & description', { kind: 'dashboard', dashboardId: dashboard.id }),
+          action('delete-dashboard', 'Delete dashboard ' + (title || UNTITLED_DASHBOARD),
+            'Delete dashboard', { kind: 'dashboard', dashboardId: dashboard.id },
+            'Delete dashboard ' + quoted(title || UNTITLED_DASHBOARD)
+            + '? This also deletes every query its panels own.'),
+        ],
       dashboardId: dashboard.id,
       member: null,
       queryId: null,
@@ -692,7 +748,9 @@ export function deriveDashboardTree(
         invalid: facts.invalid,
         severity: facts.invalid === null ? null : 'error',
         diagnostic: facts.invalid === null ? null : MISSING_QUERY_DIAGNOSTIC,
-        actions: panelActions(dashboard.id, title || UNTITLED_DASHBOARD, tile.id, facts.label, facts.queryId),
+        actions: panelActions(dashboard.id, title || UNTITLED_DASHBOARD, tile.id, facts.label, facts.queryId,
+          dashboardIdDuplicated ? AMBIGUOUS_DASHBOARD_REASON
+            : ((tileIdCounts.get(tile.id) ?? 0) > 1 ? AMBIGUOUS_TILE_REASON : null)),
         dashboardId: dashboard.id,
         member,
         queryId: facts.queryId,
diff --git a/src/dashboard/application/dashboard-viewer-session.ts b/src/dashboard/application/dashboard-viewer-session.ts
index 3b1bdfe6..0491761b 100644
--- a/src/dashboard/application/dashboard-viewer-session.ts
+++ b/src/dashboard/application/dashboard-viewer-session.ts
@@ -560,7 +560,13 @@ export function createDashboardViewerSession(deps: DashboardViewerDeps): Dashboa
     // labels, and all of `ui/dashboard.ts`'s composed names alike).
     const authored = typeof tile.title === 'string' ? tile.title.trim() : '';
     const title = authored || (query ? queryName(query) : tile.queryId) || tile.id;
-    const description = (typeof tile.description === 'string' && tile.description)
+    // Same TRIM-before-fallback as the title above, for the same reason: the
+    // tile description has no `minLength` either, so a whitespace-only
+    // authored value is schema-legal, and left untrimmed it wins the chain
+    // and masks `query.spec.description` with blank text instead of falling
+    // through to it.
+    const authoredDescription = typeof tile.description === 'string' ? tile.description.trim() : '';
+    const description = authoredDescription
       || (typeof query?.spec?.description === 'string' ? query.spec.description : '');
     const state: ViewerTileState = {
       tileId: tile.id, queryId: tile.queryId, title, description, isKpi, panel,
diff --git a/src/ui/dashboard-tree.ts b/src/ui/dashboard-tree.ts
index 5cf48d29..2fc5b48c 100644
--- a/src/ui/dashboard-tree.ts
+++ b/src/ui/dashboard-tree.ts
@@ -51,7 +51,7 @@ import { commitPanelQueryMetadata } from '../application/dashboard-panel-metadat
 import type {
   PanelMetadataDeps, PanelMetadataOutcome,
 } from '../application/dashboard-panel-metadata.js';
-import { openMetadataDialog } from './dialog-shell.js';
+import { closeOpenDialogShell, openMetadataDialog } from './dialog-shell.js';
 import {
   assignLibraryQuerySqlToVariable, assignLibraryQueryToPanel, libraryAssignmentMessage,
 } from '../application/library-assignment-service.js';
@@ -1006,6 +1006,14 @@ function openDashboardMetadataDialog(
   // `:focus-within` still holds on the row, and a `display: none` trigger cannot
   // receive the focus this dialog returns to it (only e2e catches this; happy-dom
   // enforces no CSS layout at all).
+  //
+  // Force-closed FIRST: `openMetadataDialog` → `openDialogShell` closes any
+  // already-open dialog for us, and on a rapid second activation of THIS same
+  // trigger that closing dialog's own `onClose` resets `aria-expanded` back to
+  // `"false"` — clobbering the `"true"` below if it ran after. Closing here,
+  // before setting the attribute, means that reset lands first and is
+  // superseded rather than the other way round.
+  closeOpenDialogShell();
   trigger.setAttribute('aria-expanded', 'true');
   const current = app.currentWorkspace?.dashboards?.find((d) => d.id === row.dashboardId);
   openMetadataDialog({ document: doc, acquireKeyboardOwner: app.acquireKeyboardOwner }, {
@@ -1058,6 +1066,12 @@ function openPanelMetadataDialog(
   // Same hover-reveal trap as the Dashboard pencil: the trigger is
   // `display: none` unless the row is hovered or holds focus, and `focus()` on
   // a `display: none` element is a silent no-op in a real browser.
+  //
+  // Force-closed FIRST — see the matching comment in
+  // `openDashboardMetadataDialog`: on a rapid re-activation of this same
+  // trigger, the previous dialog's `onClose` resets `aria-expanded` to
+  // `"false"`, and that has to happen before this sets it `"true"`, not after.
+  closeOpenDialogShell();
   trigger.setAttribute('aria-expanded', 'true');
   const query = app.currentWorkspace?.queries?.find((entry) => entry.id === target.queryId);
   const tile = app.currentWorkspace?.dashboards
diff --git a/tests/e2e/dashboard-tree.spec.js b/tests/e2e/dashboard-tree.spec.js
index 1a4f9054..8ab508b6 100644
--- a/tests/e2e/dashboard-tree.spec.js
+++ b/tests/e2e/dashboard-tree.spec.js
@@ -534,6 +534,35 @@ test.describe('Dashboard metadata pencil (#429 phase 3)', () => {
     await page.keyboard.press('Escape');
     await expect(trigger).toBeFocused();
   });
+
+  // Real-browser-only regression: replacing an already-open dialog
+  // force-closes it first, and that closing dialog's OWN `onClose` used to
+  // reset this SAME trigger's `aria-expanded` back to "false" right after the
+  // new dialog had just set it "true" — happy-dom cannot see the consequence,
+  // since it never enforces the `[aria-expanded="true"] { display: inline-flex }`
+  // CSS rule that is the only thing keeping a hover-revealed trigger visible
+  // (and thus focusable) once the pointer has moved onto the dialog itself.
+  test('repeated activation leaves the trigger visibly revealed, not stranded by a stale aria-expanded', async ({ page }) => {
+    await open(page);
+    await roleTab(page, 'Dashboards').click();
+    const trigger = await pencil(page, 'workspace:sales');
+    // Three activations of the SAME trigger, dispatched directly rather than
+    // through Playwright's pointer-actionability checks: a real second mouse
+    // click cannot reach a button the first dialog's backdrop now covers, but
+    // a keyboard autorepeat's synthesized click can (the review's own repro),
+    // and a direct `.click()` is the fair proxy for that — same synchronous
+    // call stack as the unit-level "opens exactly ONE dialog" regression, now
+    // asserting on the REAL CSS the unit test cannot see.
+    await trigger.evaluate((el) => { el.click(); el.click(); el.click(); });
+    await expect(dialog(page)).toHaveCount(1);
+    await expect(trigger).toHaveAttribute('aria-expanded', 'true');
+    // Off the row entirely, so nothing but `aria-expanded="true"` is keeping
+    // the trigger's `display` non-`none`.
+    await page.mouse.move(0, 0);
+    await expect(trigger).toBeVisible();
+    await page.keyboard.press('Escape');
+    await expect(trigger).toBeFocused();
+  });
 });
 
 // #428 — dragging a Library query onto a Dashboard destination. Real
@@ -812,6 +841,29 @@ test.describe('direct row actions (#494)', () => {
     }).toBe('Revenue by region');
   });
 
+  // Same real-browser-only regression as the Dashboard pencil above: the
+  // replacement dialog's own force-close resets THIS trigger's
+  // `aria-expanded` too, and only a real `[aria-expanded="true"]` CSS rule can
+  // show whether it landed before or after the new dialog's own "true".
+  test('repeated activation of the panel pencil leaves the trigger visibly revealed', async ({ page }) => {
+    await open(page);
+    await roleTab(page, 'Dashboards').click();
+    await treeRow(page, 'workspace:sales').locator('.chev').click();
+    await treeRow(page, 'workspace:sales:group:panels').click();
+    const trigger = await act(page, 'workspace:sales:tile:t-rev', 'Edit Revenue');
+    // See the Dashboard pencil's own comment above: a direct `.click()`,
+    // dispatched three times in one call, is the fair proxy for the keyboard
+    // autorepeat that is the only real way a user re-activates a trigger a
+    // modal backdrop already covers.
+    await trigger.evaluate((el) => { el.click(); el.click(); el.click(); });
+    await expect(page.locator('.fm-dialog-card')).toHaveCount(1);
+    await expect(trigger).toHaveAttribute('aria-expanded', 'true');
+    await page.mouse.move(0, 0);
+    await expect(trigger).toBeVisible();
+    await page.keyboard.press('Escape');
+    await expect(trigger).toBeFocused();
+  });
+
   // #494's Browser-accessibility section asks for REAL keyboard events, not
   // `.click()` substitutes — and the ring is the half a mouse-driven test
   // cannot show, because Chromium withholds `:focus-visible` after a pointer
diff --git a/tests/unit/dashboard-panel-metadata.test.ts b/tests/unit/dashboard-panel-metadata.test.ts
index 40dd2459..7aeca3ac 100644
--- a/tests/unit/dashboard-panel-metadata.test.ts
+++ b/tests/unit/dashboard-panel-metadata.test.ts
@@ -73,6 +73,37 @@ describe('ownedByPanel (#494, #427 exactly-one-owner rule asked about ONE member
     );
     expect(ownedByPanel(workspace, { dashboardId: 'dash', tileId: 't1', queryId: 'q1' })).toBe(false);
   });
+
+  // Strict resolution (findDashboardStrict), not a loose `.some(...)` match:
+  // two Dashboard DOCUMENTS sharing an id is `dashboard-duplicate` for
+  // `removeDashboardPanel` too, and "which one is being edited" has no answer
+  // even when the query-ownership index alone would report exactly one owner.
+  it('is false when TWO Dashboard documents share this dashboardId', () => {
+    const workspace = ws(
+      [
+        dash({ id: 'dash', tiles: [{ id: 't1', queryId: 'q1' }] }),
+        dash({ id: 'dash', tiles: [] }),
+      ],
+      [savedQuery({ id: 'q1' })],
+    );
+    expect(ownedByPanel(workspace, { dashboardId: 'dash', tileId: 't1', queryId: 'q1' })).toBe(false);
+  });
+
+  // Two tiles of the SAME Dashboard sharing an id, referencing DIFFERENT
+  // queries: the #427 ownership index cannot see this at all — q1 and q2 each
+  // still have exactly one owner naming {dash, t1}. Only resolving the tile
+  // by id INSIDE the dashboard (and requiring exactly one match) catches it.
+  it('is false when TWO tiles of the same Dashboard share this tileId, even though each still names exactly one owner', () => {
+    const workspace = ws(
+      [dash({
+        id: 'dash',
+        tiles: [{ id: 't1', queryId: 'q1' }, { id: 't1', queryId: 'q2' }],
+      })],
+      [savedQuery({ id: 'q1' }), savedQuery({ id: 'q2' })],
+    );
+    expect(ownedByPanel(workspace, { dashboardId: 'dash', tileId: 't1', queryId: 'q1' })).toBe(false);
+    expect(ownedByPanel(workspace, { dashboardId: 'dash', tileId: 't1', queryId: 'q2' })).toBe(false);
+  });
 });
 
 /**
diff --git a/tests/unit/dashboard-tree-model.test.ts b/tests/unit/dashboard-tree-model.test.ts
index 6c5a8776..0409776f 100644
--- a/tests/unit/dashboard-tree-model.test.ts
+++ b/tests/unit/dashboard-tree-model.test.ts
@@ -926,6 +926,66 @@ describe('deriveDashboardTree — direct actions (#494)', () => {
     });
   });
 
+  // A different failure shape than the #427 exactly-one-owner rule above:
+  // this is an ambiguous ID, not an ownership conflict — the #427 index alone
+  // cannot see it (each query still has exactly one owner), which is exactly
+  // why deriveDashboardTree has to check cardinality on the id itself, ahead
+  // of ownership, and why `removeDashboardPanel`/`removeDashboardDocument`
+  // already refuse the same shapes (`dashboard-duplicate`/`tile-duplicate`).
+  describe('ambiguous Dashboard/tile identity', () => {
+    it('withholds Dashboard edit/delete on TWO Dashboard documents sharing one id', () => {
+      const tree = derive(ws({
+        dashboards: [
+          dashboard({ id: 'd', title: 'D1', tiles: [{ id: 't1', queryId: 'q1' }] }),
+          dashboard({ id: 'd', title: 'D2' }),
+        ],
+        queries: [query('q1', 'Q1')],
+      }), allOpen(['d']));
+      const dupes = tree.rows.filter((r) => r.key === 'w1:d');
+      expect(dupes).toHaveLength(2);
+      for (const dash of dupes) {
+        expect(dash.actions.map((a) => a.kind)).toEqual(['edit-dashboard', 'delete-dashboard']);
+        for (const a of dash.actions) {
+          expect(a.target).toBeNull();
+          expect(a.confirm).toBeNull();
+          expect(a.unavailable).toContain('share this id');
+        }
+      }
+      // The ambiguity cascades to the panels underneath: which Dashboard "d"
+      // even is has no answer, so its tiles cannot be resolved either.
+      const panel = row(tree.rows, 'w1:d:tile:t1');
+      expect(panel.actions.map((a) => a.kind)).toEqual(['edit-panel', 'delete-panel']);
+      for (const a of panel.actions) {
+        expect(a.target).toBeNull();
+        expect(a.unavailable).toContain('share this id');
+      }
+    });
+
+    it('withholds panel edit/delete on TWO tiles of the SAME Dashboard sharing one tileId, even when they reference DIFFERENT queries', () => {
+      const tree = derive(ws({
+        dashboards: [dashboard({
+          id: 'd', title: 'D',
+          tiles: [{ id: 't1', queryId: 'q1' }, { id: 't1', queryId: 'q2' }],
+        })],
+        queries: [query('q1', 'Q1'), query('q2', 'Q2')],
+      }), allOpen(['d']));
+      const dupes = tree.rows.filter((r) => r.key === 'w1:d:tile:t1');
+      expect(dupes).toHaveLength(2);
+      for (const panel of dupes) {
+        expect(panel.actions.map((a) => a.kind)).toEqual(['edit-panel', 'delete-panel']);
+        for (const a of panel.actions) {
+          expect(a.target).toBeNull();
+          expect(a.confirm).toBeNull();
+          expect(a.unavailable).toContain('share this id');
+        }
+        // Each tile still resolves its OWN open-query gesture — only the
+        // identity-addressed edit/delete controls are withheld.
+      }
+      expect(dupes[0].single).toEqual({ kind: 'open-query', queryId: 'q1' });
+      expect(dupes[1].single).toEqual({ kind: 'open-query', queryId: 'q2' });
+    });
+  });
+
   it('gives no actions to a group row or an ACTIVE (non-orphaned) variable row', () => {
     const tree = derive(ws({
       dashboards: [dashboard({ id: 'd', title: 'D', tiles: [{ id: 't1', queryId: 'q1' }] })],
diff --git a/tests/unit/dashboard-tree.test.ts b/tests/unit/dashboard-tree.test.ts
index 2cfb84ab..e7dfe146 100644
--- a/tests/unit/dashboard-tree.test.ts
+++ b/tests/unit/dashboard-tree.test.ts
@@ -1149,6 +1149,23 @@ describe('renderDashboardTree — panel metadata pencil (#494)', () => {
     expect(document.activeElement).toBe(trigger);
   });
 
+  it('stays aria-expanded "true" across repeated activation, and returns focus visibly on close', () => {
+    // Same race as the Dashboard pencil: the replacement dialog's own
+    // `openDialogShell` force-closes the one this same trigger already
+    // opened, running that dialog's `onClose` — which resets THIS trigger's
+    // `aria-expanded` to "false" — before the replacement's own "true" is set.
+    const { list } = open();
+    const trigger = pencil(list);
+    click(trigger);
+    click(trigger);
+    click(trigger);
+    expect(document.querySelectorAll('.fm-dialog-card')).toHaveLength(1);
+    expect(trigger.getAttribute('aria-expanded')).toBe('true');
+    click(document.querySelector<HTMLButtonElement>('.fm-dialog-cancel')!);
+    expect(trigger.getAttribute('aria-expanded')).toBe('false');
+    expect(document.activeElement).toBe(trigger);
+  });
+
   it('Cancel commits nothing', async () => {
     const { list, committed } = open();
     click(pencil(list));
@@ -1353,17 +1370,6 @@ describe('renderDashboardTree — deleting an orphaned variable (#447)', () => {
     expect(document.activeElement!.textContent).toBe('Cancel');
   });
 
-  // #501 — the destructive row is listed FIRST (`openMenu` autofocuses
-  // whichever row asks for it), so a keyboard user pressing Enter right after
-  // opening this must land on Cancel, not on the row that deletes the SQL.
-  it('focuses Cancel by default, not the destructive action', async () => {
-    const { list } = open();
-    click(trash(list, 'w1:sales:variable:region')!);
-    await new Promise((resolve) => { setTimeout(resolve); }); // openMenu's deferred autofocus
-    expect(document.activeElement).toBe(confirmItems()[1]);
-    expect(document.activeElement!.textContent).toBe('Cancel');
-  });
-
   it('deletes nothing when the confirmation is refused', async () => {
     const { list, committed } = open();
     click(trash(list, 'w1:sales:variable:region')!);
@@ -1621,6 +1627,27 @@ describe('renderDashboardTree — Dashboard metadata pencil (#429 phase 3)', ()
     expect(list).toBeDefined();
   });
 
+  it('stays aria-expanded "true" across repeated activation, and returns focus visibly on close', () => {
+    // Regression for the force-close/set-attribute race: the REPLACEMENT
+    // dialog's own `openDialogShell` call force-closes whatever the first
+    // click opened, which runs the first dialog's `onClose` — resetting THIS
+    // SAME trigger's `aria-expanded` to "false". If that reset ran after this
+    // click's own "true", the trigger would be left "false" (and later
+    // effectively unfocusable/hidden by the hover-reveal CSS) for the entire
+    // time the replacement dialog is open.
+    const { app, list } = treeApp();
+    renderDashboardTree(app);
+    const trigger = actionBtn(list, 'w1:sales', 'Edit dashboard Sales')!;
+    click(trigger);
+    click(trigger);
+    click(trigger);
+    expect(document.querySelectorAll('.fm-dialog-card')).toHaveLength(1);
+    expect(trigger.getAttribute('aria-expanded')).toBe('true');
+    click(document.querySelector<HTMLButtonElement>('.fm-dialog-cancel')!);
+    expect(trigger.getAttribute('aria-expanded')).toBe('false');
+    expect(document.activeElement).toBe(trigger);
+  });
+
   it('still restores focus when the row the dialog belonged to is gone', async () => {
     // Another tab deletes the Dashboard while its rename dialog is open. The
     // trigger AND its row are detached by the time the user cancels.
diff --git a/tests/unit/dashboard-viewer-session.test.ts b/tests/unit/dashboard-viewer-session.test.ts
index a2fb6851..6a738bb8 100644
--- a/tests/unit/dashboard-viewer-session.test.ts
+++ b/tests/unit/dashboard-viewer-session.test.ts
@@ -644,6 +644,33 @@ describe('variables and the affected-panel planner', () => {
     session.setTileSearch('query a');
     expect(session.state.value.tiles.map((entry) => entry.tileId)).toEqual(['blank']);
   });
+
+  // Same schema gap as the title above, on the OTHER field: `dashboardTileV1.description`
+  // carries no `minLength` either, so a whitespace-only authored description is
+  // schema-legal. Left untrimmed it was truthy and won the fallback chain,
+  // masking `query.spec.description` with blank text — silently, since the
+  // tree's own override warning already trims and so never fired for it.
+  it('treats a whitespace-only tile description as absent, and trims a padded one', async () => {
+    const { exec } = makeExec();
+    const document = doc({
+      tiles: [
+        tile('blank', 'qa', { description: '   \t\n ' }),
+        tile('padded', 'qb', { description: '  Padded  ' }),
+        tile('absent', 'qc'),
+      ],
+    });
+    const session = createDashboardViewerSession(makeDeps({
+      document, exec,
+      queries: [
+        query('qa', 'SELECT 1', { description: 'Query A description' }),
+        query('qb', 'SELECT 2', { description: 'Query B description' }),
+        query('qc', 'SELECT 3', { description: 'Query C description' }),
+      ],
+    }));
+    await session.start();
+    expect(session.state.value.tiles.map((entry) => entry.description))
+      .toEqual(['Query A description', 'Padded', 'Query C description']);
+  });
 });
 
 describe('variable-bar bridge (controls / getVariableField / applyVariable)', () => {

From 2464b581b4debf37d92d30b9af63392f445b0f7e Mon Sep 17 00:00:00 2001
From: Boris Tyshkevich <btyshkevich@altinity.com>
Date: Mon, 27 Jul 2026 19:10:16 +0200
Subject: [PATCH 8/8] fix(#494): distinct presentation keys for duplicate rows,
 report orphan-delete outcome
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review round 6. Two findings, each verified against the code and
sabotage-checked before landing.

**A duplicated Dashboard or tile id still broke keyboard/navigation
identity.** Round 5 made edit/delete agree with delete's own strict
duplicate-id refusal, but the row's own `row.key` — and thus the `data-key`
every focus restoration, drag highlight and `syncRovingTabindex` resolve by —
still collapsed two ambiguous rows onto one key. `syncRovingTabindex` sets
`tabindex="0"` on every node whose `data-key` matches, so a shared key put
BOTH duplicate rows in the Tab order at once; every other lookup is a
first-match `querySelector`, so focus restoration and drag highlighting
silently picked whichever node was first in the DOM. Malformed duplicates now
get distinct `:dup:<occurrence>` presentation keys — separate from the
(still ambiguous) `dashboardId`/`tileId` pair their unavailable actions still
name — while every child row built from a Dashboard's key (its groups,
variables and panels) inherits the same disambiguation automatically. A
Panel row's `double`/`shift` (View/Edit Dashboard-focus navigation, addressed
by dashboard id + tile id) are nulled under the same ambiguity: the Dashboard
viewer's own tile-focus lookup is keyed by tile id alone and would otherwise
resolve the OTHER duplicate. Every drop target the ambiguity could reach —
the Dashboard row, its Panels group, and a Variable row — is withheld too.
Added a rendered-tree unit test asserting exactly one `tabindex="0"` with
duplicated Dashboard and tile ids, sabotage-verified against the pre-fix key
format.

**Orphan-variable deletion discarded every commit outcome.** `runDestructive`
fired `commitVariableConfig` and dropped its result with `void` — the one
destructive control that predates round 5's `reportRemoval` pattern for the
Dashboard and Panel trash. A concurrent Dashboard deletion, a Dashboard that
became a duplicate id mid-flight, or a storage rejection all committed
nothing and reported nothing: the confirmation just closed. It now awaits the
outcome and reports it through the same toast path (`reportVariableConfigRemoval`
+ `variableConfigMessage`, mirroring `dashboardDeleteMessage`), and the
orphan-delete action is itself withheld — via `unavailableAction`, matching
the Dashboard row's own pencil/trash — when the Dashboard id is already known
to be ambiguous. Added tests for both the aborted and the rejected outcome,
each sabotage-verified.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019LVPCmA3tJHwv6a25MRkJs
---
 CHANGELOG.md                            |  25 ++++++
 src/application/dashboard-tree-model.ts | 106 +++++++++++++++++++-----
 src/ui/dashboard-tree.ts                |  37 ++++++++-
 tests/unit/dashboard-tree-model.test.ts |  76 ++++++++++++++---
 tests/unit/dashboard-tree.test.ts       |  59 +++++++++++++
 5 files changed, 270 insertions(+), 33 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce25d468..b82123bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -63,6 +63,31 @@ auto-generated per-PR notes; this file is the curated, human-readable history.
   nothing, since the tree's own warning note already trimmed and so never
   fired for it.
 
+  A sixth pass found the fifth round's own fix incomplete: counting duplicated
+  ids made edit/delete agree with delete's stricter rule, but the row's
+  *presentation* identity — `row.key`, and the `data-key` every focus
+  restoration, drag highlight and the roving tabindex resolve by — still
+  collapsed two ambiguous rows onto one key. A duplicated Dashboard or tile id
+  could therefore put more than one row in the Tab order at once, and let
+  focus/highlight resolution silently pick whichever matching DOM node came
+  first. Malformed duplicates now get distinct presentation keys, and a
+  Panel row's own View/Edit Dashboard-focus navigation (addressed by
+  Dashboard id + tile id, unlike its still-available open-query gesture,
+  addressed by query id alone) is withheld under the same ambiguity — the
+  Dashboard viewer's own tile-focus lookup is keyed by tile id alone and
+  would otherwise resolve the *other* duplicate. Every drop target this
+  ambiguity could reach (the Dashboard row, its Panels group, and a Variable
+  row) is withheld too.
+
+  The same pass found the orphaned-variable trash still discarding its own
+  commit outcome (`void commitVariableConfig(...)`) — the one destructive
+  control on this row that predates this round's `reportRemoval` pattern for
+  the Dashboard and Panel trash. A concurrent Dashboard deletion, a Dashboard
+  that became a duplicate id, or a storage rejection all committed nothing
+  and said nothing: the confirmation just closed. It now awaits and reports
+  the outcome the same way, and the orphan-delete control is itself withheld
+  when the Dashboard id is already known to be ambiguous.
+
   Not yet included: the **Open in Dashboard** focus button, which is held back
   until #438 fixes tile focus on flow-layout KPI tiles.
 - **Closing a dirty tab, or leaving the page, now confirms first** (#466). The
diff --git a/src/application/dashboard-tree-model.ts b/src/application/dashboard-tree-model.ts
index af6e9548..f18a5869 100644
--- a/src/application/dashboard-tree-model.ts
+++ b/src/application/dashboard-tree-model.ts
@@ -447,6 +447,13 @@ const AMBIGUOUS_DASHBOARD_REASON =
  *  checked ahead of ownership rather than folded into it. */
 const AMBIGUOUS_TILE_REASON =
   'Two panels in this dashboard share this id, so it cannot be edited or removed here.';
+/** Same ambiguity as `AMBIGUOUS_DASHBOARD_REASON`, worded for the one control
+ *  an orphaned-variable row offers — delete only, never edit. Deleting stored
+ *  option SQL is addressed by Dashboard id alone (#447), so a duplicated
+ *  Dashboard id leaves it exactly as unresolvable as a Dashboard-level delete;
+ *  `commitVariableConfig`'s own strict-replacement guard refuses it too. */
+const AMBIGUOUS_DASHBOARD_VARIABLE_REASON =
+  'Two dashboards in this workspace share this id, so this stored option SQL cannot be removed here.';
 
 /** One trailing control, available. */
 const action = (
@@ -493,6 +500,14 @@ export function deriveDashboardTree(
   for (const dashboard of dashboards) {
     dashboardIdCounts.set(dashboard.id, (dashboardIdCounts.get(dashboard.id) ?? 0) + 1);
   }
+  // Which OCCURRENCE of a duplicated Dashboard id this is, in document order —
+  // 0 for the first, 1 for the second, and so on. Availability only needs the
+  // COUNT above; this is what lets two rows sharing a duplicated id still get
+  // two DISTINCT presentation keys below, so the roving tabindex, `data-key`
+  // focus restoration and drag-highlight lookups (all keyed on `row.key`) each
+  // resolve to exactly one row instead of silently picking whichever matching
+  // node happens to be first in the DOM.
+  const dashboardOccurrenceSeen = new Map<string, number>();
   const ownership = buildQueryOwnershipIndex({
     queries: workspace?.queries ?? [],
     dashboards: dashboards.map((dashboard) => ({
@@ -565,13 +580,24 @@ export function deriveDashboardTree(
   const rows: DashboardTreeRow[] = [];
 
   for (const dashboard of dashboards) {
-    const dashboardKey = encodeKeyPart(workspaceId) + ':' + encodeKeyPart(dashboard.id);
+    const dashboardIdDuplicated = (dashboardIdCounts.get(dashboard.id) ?? 0) > 1;
+    const dashboardOccurrenceIndex = dashboardOccurrenceSeen.get(dashboard.id) ?? 0;
+    dashboardOccurrenceSeen.set(dashboard.id, dashboardOccurrenceIndex + 1);
+    // The PRESENTATION key, distinct from the (still ambiguous) mutation
+    // target below: when the id is duplicated, every row this Dashboard emits
+    // — this one and, through `groupKeyFor`/the variable and panel keys built
+    // from it, every descendant — carries a `:dup:<occurrence>` suffix so the
+    // two Dashboards' subtrees never collide on `row.key`/`data-key`, even
+    // though `dashboardId: dashboard.id` (what `edit-dashboard`'s target and
+    // `dropTarget` would name, were either not already unavailable/null below)
+    // still names the SAME ambiguous id.
+    const dashboardKey = encodeKeyPart(workspaceId) + ':' + encodeKeyPart(dashboard.id)
+      + (dashboardIdDuplicated ? ':dup:' + dashboardOccurrenceIndex : '');
     const title = trimmed(dashboard.title);
     const description = trimmed(dashboard.description);
     const dashboardMatched = search !== '' && hits([title, description]);
 
     const tiles = dashboard.tiles ?? [];
-    const dashboardIdDuplicated = (dashboardIdCounts.get(dashboard.id) ?? 0) > 1;
     // Dashboard-LOCAL tile-id cardinality: two tiles of the SAME Dashboard
     // sharing an id, never a count across Dashboards — a tile id is only ever
     // addressed together with its owning Dashboard id (#430).
@@ -579,6 +605,10 @@ export function deriveDashboardTree(
     for (const tile of tiles) {
       tileIdCounts.set(tile.id, (tileIdCounts.get(tile.id) ?? 0) + 1);
     }
+    // Same occurrence-tracking as `dashboardOccurrenceSeen`, scoped to THIS
+    // Dashboard's own tiles — reset every iteration, since a tile id is only
+    // ever compared against siblings of the same Dashboard.
+    const tileOccurrenceSeen = new Map<string, number>();
     const tileEntries = tileEntriesOf(dashboard, queries);
     // #447: the variable rows come from the pure inference service, over THIS
     // Dashboard's panel-owned queries plus its stored option SQL.
@@ -660,7 +690,11 @@ export function deriveDashboardTree(
       single: openDashboardCommand(dashboard.id, 'view'),
       double: null,
       shift: openDashboardCommand(dashboard.id, 'edit'),
-      dropTarget: { kind: 'panel', dashboardId: dashboard.id },
+      // A duplicated Dashboard id cannot be a drop destination either: an
+      // assignment drop resolves its target by `dashboardId` alone, and
+      // `dashboardId` alone has two answers here — the same ambiguity that
+      // already withholds this row's own pencil/trash above.
+      dropTarget: dashboardIdDuplicated ? null : { kind: 'panel', dashboardId: dashboard.id },
     });
 
     if (!dashboardExpanded) continue;
@@ -700,11 +734,21 @@ export function deriveDashboardTree(
         // #447's trash, unchanged in behaviour: an ORPHANED configuration is
         // the only variable state with anything of its own to delete — an
         // active or conflicted variable is inferred from the panel SQL.
+        //
+        // A duplicated Dashboard id leaves it unavailable too: the delete is
+        // addressed by `dashboardId` alone, `commitVariableConfig`'s own
+        // strict-replacement guard refuses an ambiguous one exactly the way
+        // the Dashboard row's own delete does, and offering a trash the
+        // commit would only silently no-op is the same bug being closed
+        // everywhere else on this row.
         actions: variable.status === 'orphaned'
-          ? [action('delete-variable-config',
-            'Delete the stored option SQL for ' + variable.name, 'Delete stored option SQL',
-            { kind: 'variable-config', dashboardId: dashboard.id, name: variable.name },
-            'Delete the stored option SQL for ' + quoted(variable.name) + '? The SQL is lost.')]
+          ? [dashboardIdDuplicated
+            ? unavailableAction('delete-variable-config',
+              'Delete the stored option SQL for ' + variable.name, AMBIGUOUS_DASHBOARD_VARIABLE_REASON)
+            : action('delete-variable-config',
+              'Delete the stored option SQL for ' + variable.name, 'Delete stored option SQL',
+              { kind: 'variable-config', dashboardId: dashboard.id, name: variable.name },
+              'Delete the stored option SQL for ' + quoted(variable.name) + '? The SQL is lost.')]
           : [],
         dashboardId: dashboard.id,
         member,
@@ -717,7 +761,9 @@ export function deriveDashboardTree(
         // panel declares any more has nothing to bind to, though it stays
         // editable and deletable through its own affordances — which is why this
         // reads the same `status === 'orphaned'` that `deletable` above does.
-        dropTarget: variable.status === 'orphaned'
+        // A duplicated Dashboard id is withheld here too — same reasoning as
+        // the Dashboard row's own `dropTarget` above.
+        dropTarget: (variable.status === 'orphaned' || dashboardIdDuplicated)
           ? null
           : { kind: 'variable', dashboardId: dashboard.id, variableName: variable.name },
       };
@@ -725,6 +771,10 @@ export function deriveDashboardTree(
 
     const panelRows = shownTiles.map(({ tile, facts }): DashboardTreeRow => {
       const member: DashboardFocusTarget = { kind: 'tile', id: tile.id };
+      const tileIdDuplicated = (tileIdCounts.get(tile.id) ?? 0) > 1;
+      const tileOccurrenceIndex = tileOccurrenceSeen.get(tile.id) ?? 0;
+      tileOccurrenceSeen.set(tile.id, tileOccurrenceIndex + 1);
+      const identityAmbiguous = dashboardIdDuplicated || tileIdDuplicated;
       // One query can back several panels, so this is one row PER TILE — never
       // merged by query id or label.
       const openQuery: DashboardTreeCommand | null = facts.queryId === null
@@ -733,7 +783,19 @@ export function deriveDashboardTree(
       const focusView = openDashboardCommand(dashboard.id, 'view', member);
       const focusEdit = openDashboardCommand(dashboard.id, 'edit', member);
       return {
-        key: tileRowKey(workspaceId, dashboard.id, tile.id),
+        // Disambiguated the SAME way the Dashboard row's own key is — built
+        // from `dashboardKey` (already carrying its own `:dup:` suffix when
+        // the DASHBOARD id is duplicated, never the raw `dashboard.id`
+        // `tileRowKey` would use) plus this tile's own suffix when the TILE
+        // id is duplicated. A duplicated id at either level still needs a
+        // UNIQUE `row.key` per row — the roving tabindex, `data-key` focus
+        // restoration and drag-highlight lookups downstream all resolve by
+        // this key alone, so two rows sharing one would let either mechanism
+        // silently pick the wrong (first-in-DOM) row. Equal to
+        // `tileRowKey(workspaceId, dashboard.id, tile.id)` whenever neither is
+        // duplicated, since `dashboardKey` itself is then unsuffixed.
+        key: dashboardKey + ':tile:' + encodeKeyPart(tile.id)
+          + (tileIdDuplicated ? ':dup:' + tileOccurrenceIndex : ''),
         kind: 'panel',
         level: 3,
         parentKey: groupKeyFor('panels'),
@@ -750,17 +812,20 @@ export function deriveDashboardTree(
         diagnostic: facts.invalid === null ? null : MISSING_QUERY_DIAGNOSTIC,
         actions: panelActions(dashboard.id, title || UNTITLED_DASHBOARD, tile.id, facts.label, facts.queryId,
           dashboardIdDuplicated ? AMBIGUOUS_DASHBOARD_REASON
-            : ((tileIdCounts.get(tile.id) ?? 0) > 1 ? AMBIGUOUS_TILE_REASON : null)),
+            : (tileIdDuplicated ? AMBIGUOUS_TILE_REASON : null)),
         dashboardId: dashboard.id,
         member,
         queryId: facts.queryId,
         group: 'panels',
-        // Only the query-open action is withheld: Dashboard View/Edit focus
-        // navigation stays available so a broken panel's diagnostics remain
-        // reachable.
+        // Only the query-open action stays available under identity ambiguity
+        // (it is addressed by `queryId` alone, which is unaffected): View/Edit
+        // focus navigation is withheld instead, because both are addressed by
+        // `dashboard.id` + `member.id` — the Dashboard viewer's own tile-focus
+        // lookup is keyed by tile id alone, so an ambiguous pair could resolve
+        // (or highlight) a DIFFERENT tile than the one the row names.
         single: openQuery,
-        double: focusView,
-        shift: focusEdit,
+        double: identityAmbiguous ? null : focusView,
+        shift: identityAmbiguous ? null : focusEdit,
         // #428 rejects an individual panel row: sharing one query between panels
         // and moving members between Dashboards are both out of scope, so there
         // is no assignment a panel row could mean.
@@ -816,10 +881,13 @@ export function deriveDashboardTree(
         single: groupForced ? null : { kind: 'toggle' },
         double: null,
         shift: null,
-        // #428: Panels means the same thing as the Dashboard row itself. The
-        // VARIABLES group never accepts — it does not identify which variable
-        // would receive the SQL, and guessing is worse than rejecting.
-        dropTarget: group === 'panels' ? { kind: 'panel', dashboardId: dashboard.id } : null,
+        // #428: Panels means the same thing as the Dashboard row itself —
+        // including its own ambiguous-id rejection when `dashboardId` alone
+        // has two answers. The VARIABLES group never accepts — it does not
+        // identify which variable would receive the SQL, and guessing is
+        // worse than rejecting.
+        dropTarget: (group === 'panels' && !dashboardIdDuplicated)
+          ? { kind: 'panel', dashboardId: dashboard.id } : null,
       });
       if (groupExpanded) rows.push(...members);
     }
diff --git a/src/ui/dashboard-tree.ts b/src/ui/dashboard-tree.ts
index 2fc5b48c..4df97f8f 100644
--- a/src/ui/dashboard-tree.ts
+++ b/src/ui/dashboard-tree.ts
@@ -41,6 +41,7 @@ import {
   type DashboardTreeCommand, type DashboardTreeInvalid, type DashboardTreeRow, type TreeWorkspace,
 } from '../application/dashboard-tree-model.js';
 import { commitVariableConfig } from '../application/dashboard-variable-config.js';
+import type { VariableConfigOutcome } from '../application/dashboard-variable-config.js';
 import { commitDashboardRename } from '../application/dashboard-title.js';
 import type { DashboardRenameOutcome } from '../application/dashboard-title.js';
 import {
@@ -969,7 +970,9 @@ function runDestructive(
   target: DashboardTreeActionTarget,
 ): void {
   if (target.kind === 'variable-config') {
-    void commitVariableConfig(app, target.dashboardId, target.name, null);
+    void reportVariableConfigRemoval(
+      doc, commitVariableConfig(app, target.dashboardId, target.name, null),
+    );
     return;
   }
   // Decided BEFORE the commit, against the rows currently painted: once the
@@ -1177,6 +1180,38 @@ async function reportRemoval(
   app.dom.dashboardSearchInput?.focus();
 }
 
+/** What an orphaned-variable delete has to say — `null` on a real commit,
+ *  mirroring `dashboardDeleteMessage`'s own shape. `commitVariableConfig`'s
+ *  ONE abort reason (`'declined'`) covers both a Dashboard deleted
+ *  concurrently and one that became a duplicate id after this row was
+ *  painted available — `withVariableConfig`/`replaceDashboard` collapse both
+ *  into the same "no single entry to write" refusal, so there is no narrower
+ *  reason to report than the Dashboard-missing wording #429 phase 1 already
+ *  settled. */
+const variableConfigMessage = (outcome: VariableConfigOutcome): string | null => {
+  if (outcome.ok) return null;
+  if (!outcome.aborted) return '✕ ' + (outcome.diagnostics[0]?.message || 'Could not save workspace');
+  return outcome.data === 'declined' ? 'That dashboard is no longer part of this workspace.' : null;
+};
+
+/**
+ * Report an orphaned-variable delete — the variable-config counterpart to
+ * `reportRemoval` above, minus the successor-focus step neither this row's
+ * own row nor its siblings need: deleting stored option SQL never removes a
+ * row, so there is nowhere for focus to need to go.
+ *
+ * Awaiting and reporting this (rather than firing it and discarding the
+ * result, as the pre-#501-review-5 code did) is what surfaces a concurrent
+ * Dashboard deletion or a storage rejection instead of leaving the
+ * confirmation close over a write that silently did nothing.
+ */
+async function reportVariableConfigRemoval(
+  doc: Document, pending: Promise<VariableConfigOutcome>,
+): Promise<void> {
+  const message = variableConfigMessage(await pending);
+  if (message !== null) flashToast(message, { document: doc });
+}
+
 /**
  * Where keyboard focus goes when a Panel row is deleted: the next Panel row,
  * else the previous one, else the Panels group that contained it (#494).
diff --git a/tests/unit/dashboard-tree-model.test.ts b/tests/unit/dashboard-tree-model.test.ts
index 0409776f..49ac5a68 100644
--- a/tests/unit/dashboard-tree-model.test.ts
+++ b/tests/unit/dashboard-tree-model.test.ts
@@ -933,7 +933,7 @@ describe('deriveDashboardTree — direct actions (#494)', () => {
   // of ownership, and why `removeDashboardPanel`/`removeDashboardDocument`
   // already refuse the same shapes (`dashboard-duplicate`/`tile-duplicate`).
   describe('ambiguous Dashboard/tile identity', () => {
-    it('withholds Dashboard edit/delete on TWO Dashboard documents sharing one id', () => {
+    it('withholds Dashboard edit/delete on TWO Dashboard documents sharing one id, and gives each row a DISTINCT presentation key', () => {
       const tree = derive(ws({
         dashboards: [
           dashboard({ id: 'd', title: 'D1', tiles: [{ id: 't1', queryId: 'q1' }] }),
@@ -941,24 +941,43 @@ describe('deriveDashboardTree — direct actions (#494)', () => {
         ],
         queries: [query('q1', 'Q1')],
       }), allOpen(['d']));
-      const dupes = tree.rows.filter((r) => r.key === 'w1:d');
-      expect(dupes).toHaveLength(2);
-      for (const dash of dupes) {
+      // No two rows share a key: `keys` below is exactly `tree.rows.length` long
+      // as a set. That is what keeps the roving tabindex, `data-key` focus
+      // restoration and drag highlighting — all resolved by `row.key` alone —
+      // from ever picking the wrong (first-in-DOM) row.
+      const keys = tree.rows.map((r) => r.key);
+      expect(new Set(keys).size).toBe(keys.length);
+      const dash0 = row(tree.rows, 'w1:d:dup:0');
+      const dash1 = row(tree.rows, 'w1:d:dup:1');
+      for (const dash of [dash0, dash1]) {
         expect(dash.actions.map((a) => a.kind)).toEqual(['edit-dashboard', 'delete-dashboard']);
         for (const a of dash.actions) {
           expect(a.target).toBeNull();
           expect(a.confirm).toBeNull();
           expect(a.unavailable).toContain('share this id');
         }
+        // An ambiguous Dashboard id is not a drop destination either — same
+        // reasoning as the pencil/trash above: `dashboardId` alone has two
+        // answers here.
+        expect(dash.dropTarget).toBeNull();
       }
       // The ambiguity cascades to the panels underneath: which Dashboard "d"
-      // even is has no answer, so its tiles cannot be resolved either.
-      const panel = row(tree.rows, 'w1:d:tile:t1');
+      // even is has no answer, so its tiles cannot be resolved either — and the
+      // panel row's own key inherits dash0's `:dup:0` disambiguation rather
+      // than colliding on the bare `tileRowKey` shape.
+      const panel = row(tree.rows, 'w1:d:dup:0:tile:t1');
       expect(panel.actions.map((a) => a.kind)).toEqual(['edit-panel', 'delete-panel']);
       for (const a of panel.actions) {
         expect(a.target).toBeNull();
         expect(a.unavailable).toContain('share this id');
       }
+      // View/Edit Dashboard-focus navigation is withheld too: both are
+      // addressed by dashboard.id + tile.id, and the Dashboard half is
+      // ambiguous — only the query-open gesture (addressed by queryId alone)
+      // survives.
+      expect(panel.single).toEqual({ kind: 'open-query', queryId: 'q1' });
+      expect(panel.double).toBeNull();
+      expect(panel.shift).toBeNull();
     });
 
     it('withholds panel edit/delete on TWO tiles of the SAME Dashboard sharing one tileId, even when they reference DIFFERENT queries', () => {
@@ -969,20 +988,27 @@ describe('deriveDashboardTree — direct actions (#494)', () => {
         })],
         queries: [query('q1', 'Q1'), query('q2', 'Q2')],
       }), allOpen(['d']));
-      const dupes = tree.rows.filter((r) => r.key === 'w1:d:tile:t1');
-      expect(dupes).toHaveLength(2);
-      for (const panel of dupes) {
+      const keys = tree.rows.map((r) => r.key);
+      expect(new Set(keys).size).toBe(keys.length);
+      const first = row(tree.rows, 'w1:d:tile:t1:dup:0');
+      const second = row(tree.rows, 'w1:d:tile:t1:dup:1');
+      for (const panel of [first, second]) {
         expect(panel.actions.map((a) => a.kind)).toEqual(['edit-panel', 'delete-panel']);
         for (const a of panel.actions) {
           expect(a.target).toBeNull();
           expect(a.confirm).toBeNull();
           expect(a.unavailable).toContain('share this id');
         }
-        // Each tile still resolves its OWN open-query gesture — only the
-        // identity-addressed edit/delete controls are withheld.
+        // View/Edit navigation is withheld: the Dashboard viewer resolves tile
+        // focus by tile id alone, so an ambiguous id could focus/highlight the
+        // OTHER duplicate instead of the row that was actually activated.
+        expect(panel.double).toBeNull();
+        expect(panel.shift).toBeNull();
       }
-      expect(dupes[0].single).toEqual({ kind: 'open-query', queryId: 'q1' });
-      expect(dupes[1].single).toEqual({ kind: 'open-query', queryId: 'q2' });
+      // Each tile still resolves its OWN open-query gesture — only the
+      // identity-addressed edit/delete/navigation controls are withheld.
+      expect(first.single).toEqual({ kind: 'open-query', queryId: 'q1' });
+      expect(second.single).toEqual({ kind: 'open-query', queryId: 'q2' });
     });
   });
 
@@ -1139,6 +1165,30 @@ describe('deriveDashboardTree — Library-query drop targets (#428)', () => {
       .toEqual({ kind: 'panel', dashboardId: 'empty' });
   });
 
+  it('rejects every drop target and the orphan delete when the Dashboard id is duplicated', () => {
+    const rows = derive(ws({
+      dashboards: [
+        dashboard({ id: 'd1', variableConfigs: { region: { sql: 'SELECT r, r' } } }),
+        dashboard({ id: 'd1' }),
+      ],
+    }), allOpen(['d1'])).rows;
+    // Both Dashboard rows, under their disambiguated presentation keys.
+    expect(row(rows, 'w1:d1:dup:0').dropTarget).toBeNull();
+    expect(row(rows, 'w1:d1:dup:0:group:panels').dropTarget).toBeNull();
+    // An orphaned variable's delete is addressed by dashboardId alone too —
+    // ambiguous the same way, and `commitVariableConfig`'s own guard refuses
+    // it the same way `removeDashboardDocument` refuses the Dashboard delete.
+    const orphan = row(rows, 'w1:d1:dup:0:variable:region');
+    expect(orphan.actions).toEqual([{
+      kind: 'delete-variable-config',
+      label: 'Delete the stored option SQL for region',
+      tooltip: 'Two dashboards in this workspace share this id, so this stored option SQL cannot be removed here.',
+      target: null,
+      unavailable: 'Two dashboards in this workspace share this id, so this stored option SQL cannot be removed here.',
+      confirm: null,
+    }]);
+  });
+
   it('preserves case-sensitive variable identity in the target', () => {
     const cased = ws({
       queries: [query('q1', 'Q', undefined, 'SELECT {Country:String}')],
diff --git a/tests/unit/dashboard-tree.test.ts b/tests/unit/dashboard-tree.test.ts
index e7dfe146..9c222da6 100644
--- a/tests/unit/dashboard-tree.test.ts
+++ b/tests/unit/dashboard-tree.test.ts
@@ -175,6 +175,32 @@ describe('renderDashboardTree — structure and ARIA', () => {
     expect(tabbableChevrons[0].closest('.dash-tree-row')!.getAttribute('data-key')).toBe('w1:sales');
   });
 
+  // #501 review — a duplicated Dashboard or tile id used to collapse two rows
+  // onto the same `row.key`/`data-key`, and `syncRovingTabindex` sets
+  // `tabindex="0"` on every node whose `dataset.key` matches the owner: with a
+  // shared key that meant BOTH duplicate rows entered the Tab order at once,
+  // breaking the tree's "exactly one row" roving-tabindex invariant.
+  it('keeps exactly ONE row in the Tab order even with duplicated Dashboard and tile ids', () => {
+    const { app, list } = treeApp();
+    (app.currentWorkspace as unknown as TreeWorkspace).dashboards = [
+      { id: 'dup', title: 'A', tiles: [{ id: 't1', queryId: 'q1' }, { id: 't1', queryId: 'q1' }] },
+      { id: 'dup', title: 'B', tiles: [] },
+    ];
+    openAll(app, 'dup');
+    renderDashboardTree(app);
+    // Every rendered row has its own unique `data-key` — the precondition for
+    // a roving tabindex (or any `data-key` lookup) to ever pick the right node.
+    const keys = rows(list).map((row) => row.dataset.key);
+    expect(new Set(keys).size).toBe(keys.length);
+    const tabbable = rows(list).filter((row) => row.getAttribute('tabindex') === '0');
+    expect(tabbable).toHaveLength(1);
+    expect(rows(list).filter((row) => row.getAttribute('tabindex') === '-1'))
+      .toHaveLength(rows(list).length - 1);
+    const tabbableChevrons = [...list.querySelectorAll<HTMLElement>('.dash-tree-chev')]
+      .filter((chev) => chev.getAttribute('tabindex') === '0');
+    expect(tabbableChevrons).toHaveLength(1);
+  });
+
   it('indents by level', () => {
     const { app, list } = treeApp();
     openAll(app, 'sales');
@@ -1416,6 +1442,39 @@ describe('renderDashboardTree — deleting an orphaned variable (#447)', () => {
     expect(app.openSavedQuery).toHaveBeenCalledExactlyOnceWith('q1');
     vi.useRealTimers();
   });
+
+  // #501 review 5 — the delete used to fire `commitVariableConfig` and discard
+  // its result (`void commitVariableConfig(...)`), so a concurrent race or a
+  // storage rejection presented as "the confirmation closed and nothing
+  // happened", with no diagnostic anywhere.
+  it('reports a Dashboard that no longer resolves (deleted, or made a duplicate id) concurrently, committing nothing further', async () => {
+    const mutateWorkspace = vi.fn(async () => ({
+      ok: false, aborted: true, data: 'declined',
+    })) as unknown as App['mutateWorkspace'];
+    const { app, list } = treeApp({ mutateWorkspace });
+    openAll(app, 'sales');
+    renderDashboardTree(app);
+    click(trash(list, 'w1:sales:variable:region')!);
+    click(confirmItems()[0]);
+    await Promise.resolve(); await Promise.resolve();
+    expect(document.querySelector('.share-toast')!.textContent)
+      .toBe('That dashboard is no longer part of this workspace.');
+    expect(mutateWorkspace).toHaveBeenCalledTimes(1);
+  });
+
+  it('reports the aggregate\'s own diagnostic when the commit is rejected', async () => {
+    const mutateWorkspace = vi.fn(async () => ({
+      ok: false,
+      diagnostics: [{ path: [], severity: 'error', code: 'x', message: 'Storage is full' }],
+    })) as unknown as App['mutateWorkspace'];
+    const { app, list } = treeApp({ mutateWorkspace });
+    openAll(app, 'sales');
+    renderDashboardTree(app);
+    click(trash(list, 'w1:sales:variable:region')!);
+    click(confirmItems()[0]);
+    await Promise.resolve(); await Promise.resolve();
+    expect(document.querySelector('.share-toast')!.textContent).toBe('✕ Storage is full');
+  });
 });
 
 describe('renderDashboardTree — Dashboard metadata pencil (#429 phase 3)', () => {